Stephen RitzandClaude Opus 4.8
4cba448671
The forced password change modal posts to the JSON API and renders data[0].msg directly. The API returns raw language keys rather than translated strings, so a user who fails the complexity policy is shown the literal text "password_complexity" instead of a message. Every other password form renders errors through alertbox_log_parser(), which resolves the key against $lang. The modal is the only one that talks to the API directly, and it never resolved the key. Resolve it against lang_danger, which base.twig already exposes for this purpose. This also covers password_mismatch, password_empty and access_denied, and applies to the admin path as well. Unknown keys still fall through unchanged. The lookup is guarded with hasOwnProperty because msg is attacker- independent but dynamic: a bare lang_danger[msg] would resolve inherited Object.prototype members such as "constructor" to a function, which jQuery's .text() would then invoke as a callback. Language files are untouched: prerequisites.inc.php loads lang.en-gb.json as the base and merges the active locale over it, so locales that lack the key inherit the English string. Fixes #7301 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
mailcow: dockerized - 🐮 + 🐋 = 💕
Want to support mailcow?
Please consider a support contract with Servercow to support further development. We support you while you support us. :)
You can also get a SAL which is a one-time payment with no liabilities or returning fees.
Or just spread the word: moo.
Many thanks to our GitHub Sponsors ❤️
A big thank you to everyone supporting us on GitHub Sponsors—your contributions mean the world to us! Special thanks to the following amazing supporters:
100$/Month Sponsors
50$/Month Sponsors
Info, documentation and support
Please see the official documentation for installation and support instructions. 🐄
🐛 If you found a critical security issue, please mail us to info at servercow.de.
Cowmunity
Telegram mailcow Off-Topic channel
Telegram desktop clients are available for multiple platforms. You can search the groups history for keywords.
Misc
Important: mailcow makes use of various open-source software. Please assure you agree with their license before using mailcow. Any part of mailcow itself is released under GNU General Public License, Version 3.
mailcow is a registered word mark of The Infrastructure Company GmbH, Parkstr. 42, 47877 Willich, Germany.
The project is managed and maintained by The Infrastructure Company GmbH.
Originated from @andryyy (André)