amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-09-15 02:18:00 +00:00
Code Issues Projects Releases Wiki Activity

fix(pwd): use the proper url for reset password mail part2

Browse Source
This commit is contained in:
Hivert Quentin
2026-09-10 08:11:23 +02:00
parent 3d9853e95b
commit 04a3e98238
5 changed files with 49 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
UI/MainUI/SOGoRootPage.m
+24 -3
View File
@@ -1316,7 +1316,8 @@ static const NSString *kJwtKey = @"jwt";
*/
- (WOResponse *) passwordRecoveryEmailAction
{
NSString *username, *domain, *mode, *uid, *mailDomain, *fromEmail, *toEmail, *jwtToken, *url, *mailContent, *email;
NSString *username, *domain, *mode, *uid, *mailDomain, *fromEmail, *toEmail, *jwtToken, *url, *mailContent, *email, *serverUrl;
NSArray *baseUrls;
NSDictionary *message, *info;
WORequest *request;
SOGoUserManager *um;
@@ -1372,8 +1373,28 @@ static const NSString *kJwtKey = @"jwt";
// Send mail
mailer = [SOGoMailer mailerWithDomainDefaults: dd];
url = [NSString stringWithFormat:@"%@/%@?token=%@"
, [[context serverURL] absoluteString]
//Get Allowed server URL and check if it's OK
baseUrls = [[SOGoSystemDefaults sharedSystemDefaults] passwordRecoveryBaseURLs];
serverUrl = [[request headers] objectForKey:@"origin"];
if(!(baseUrls && [baseUrls count] > 0))
{
[self logWithFormat: @"Password recovery exception for user %@: empty or unset SOGoPasswordRecoveryBaseURLs", uid];
response = [self responseWithStatus: 403
andString: @"Password recovery email in error"];
return response;
}
if(![baseUrls containsObject:serverUrl])
{
[self logWithFormat: @"Password recovery exception for user %@: invalid request header", uid];
response = [self responseWithStatus: 403
andString: @"Password recovery email in error"];
return response;
}
url = [NSString stringWithFormat:@"%@%@?token=%@"
, serverUrl
, [request uri]
, jwtToken];