Jordi Mallach
a863283680
feat(web): add optional Content Security Policy
...
AngularJS (EOL since 2022-01) and AngularJS Material no longer receive
security fixes, so any new vulnerability in them will stay unpatched.
In AngularJS, templates are code: any attacker-controlled text that
ends up in a compiled template is evaluated as an expression, and
since 1.6 there is no expression sandbox, so a single
{{constructor.constructor('...')()}} gives full script execution.
SOGo renders untrusted data (mail bodies, invitations, attachment
names, contact fields) into such templates and currently relies on
server-side filtering, like stripping "{{" and "}}", to prevent this.
Any gap in that filtering, or a bypass of $sanitize/ng-bind-html,
would mean XSS in the webmail session: reading and sending mail as
the user, and access to calendars and contacts.
A Content Security Policy adds a second layer in the browser that
doesn't depend on catching every injection. The new
SOGoContentSecurityPolicy system default ("report-only" or "enforce",
disabled when unset) sends a strict policy with the pages of the web
interface:
script-src 'self' 'nonce-<random>' (no 'unsafe-inline'/'unsafe-eval')
style-src 'self' 'unsafe-inline' (Angular Material, CKEditor 5)
object-src 'none'; base-uri 'self'; frame-ancestors 'self'; ...
The policy is generated by sogod, since a fresh 128-bit nonce is needed
per response: it is shared by all components of the response and set
on the inline configuration scripts of the page frame and module views.
The page also gets ng-csp="no-unsafe-eval", so AngularJS evaluates
expressions with its interpreter instead of Function().
With the policy enforced, an expression injected into a compiled
template, such as {{constructor.constructor('...')()}}, can no longer
reach Function() and fails with an EvalError, and injected inline
scripts are blocked. Injected expressions are limited to calling
functions available on the scope.
Tested with Chromium in both modes on login, Mail (HTML messages,
remote content, invitations, compose), Calendar and Contacts editors,
Preferences and Administration: no violations from SOGo's own code.
With the default unset, the generated output is unchanged.
form-action is deliberately not restricted, so SAML2/CAS/OpenID
logins posting to an external IdP keep working. Scripts listed in
SOGoUIAdditionalJSFiles are served from WebServerResources and allowed,
but must not load scripts from other origins, use eval() or rely on
inline handlers; their dependencies have to be installed and listed
alongside them.
2026-11-06 16:22:03 +01:00
Hivert Quentin
04a3e98238
fix(pwd): use the proper url for reset password mail part2
2026-09-10 08:11:23 +02:00
Hivert Quentin
4ef79e219c
fix(openid): correcly type userTokenInterval
2025-07-28 16:08:17 +02:00
Hivert Quentin
51f1521dba
feat(api): add endpoint for caldav/cardav url
2025-06-23 17:14:39 +02:00
Hivert Quentin
a782424a30
feat(openid): swicth to libcurl for http request
...
It was using an internal library before and there were too much errors due to incomplete http's protocol implementation
2025-06-23 09:24:02 +02:00
Hivert Quentin
a1f2670485
revert: feat add url for creating account on login page
2025-03-13 15:47:16 +01:00
Hivert Quentin
c3234882eb
feat(openID): second part with a lot of fixes and cleaning
2025-03-13 15:25:56 +01:00
Hivert Quentin
458d39d48a
feat(openID): first stable version
2025-03-13 15:24:03 +01:00
Hivert Quentin
42c227beca
feat(calendar): Can now create Jitsi link when making event
2025-01-27 14:27:09 +01:00
smizrahi
ea427ea41a
feat(mail): Deletion of mail older than x. Closes #6023 . Remove also template folder. Change SOGoDisableMailCleaning to SOGoEnableMailCleaning (disabled by default).
2024-11-25 10:23:31 +01:00
smizrahi
6f86506b28
feat(mail): Deletion of mail older than x. Closes #6023 .
2024-11-20 16:50:15 +01:00
smizrahi
f2ba6870d5
feat(core): Add new SOGoURLCreateAccount option to add a create account link below login form
2024-10-22 16:03:50 +02:00
Hivert Quentin
56598d1e37
feat(login): add parameters to prevent uneccesary connection request when the domain is unknown
2024-10-01 17:53:46 +02:00
smizrahi
4dba56f70d
fix(addressbook): Removed SOGoGlobalAddressBookFirstEntries (use listRequiresDot instead) and move SOGoGlobalAddressBookFirstEntriesCount to globalAddressBookFirstEntriesCount in source scope. This fixed the broken listRequiresDot in 5.10
2024-02-26 15:40:49 +01:00
Hivert Quentin
e6bfab7ee1
feat(accounts): Add parameter to encrypt/decrypt auxiliary account's password
2024-02-01 16:55:41 +01:00
smizrahi
d505b874f7
Merge branch 'master' into feature-gdpr
2023-12-20 18:01:40 +01:00
smizrahi
17eca6f96a
feature(contact): Show 100 first results for global address book
2023-12-18 08:34:53 +01:00
Hivert Quentin
d0b4b50456
feat(core): add SOGoDisableExport option to disable export for mail, calendar and contacts
2023-11-03 18:20:12 +01:00
Hivert Quentin
e0ef59d5f2
feat(core): Add SOGoDisableSharingAnyAuthUser option to disable sharing to any user authenticated for mail, contacts and calendar
2023-11-03 17:01:49 +01:00
smizrahi
31c6f78913
feat(core): Add URL encryption for GDPR compliancy
2023-10-17 16:17:25 +02:00
Hivert Quentin
f5f74f751a
fix(preferences): Fix language list sorting on preferences page
2023-08-04 10:36:50 +02:00
smizrahi
04e15b5695
feat(eas): Add SOGoEASDisableUI system parameter to remove EAS options in UI when ActiveSync is not used
2023-01-16 15:31:27 +01:00
smizrahi
435495f007
feat(core): Add SOGoDisableSharing option to disable sharing for mail, contacts and calendar
2022-12-12 12:03:59 +01:00
smizrahi
cddfdb90f9
feat(calendar): Add SOGoDisableOrganizerEventCheck parameter - this parameter is used to avoid checking calendar event's organizer
2022-10-05 22:12:14 +02:00
smizrahi
656807b77d
feat(password-recovery): Add password recovery with secret question or secondary email
2022-10-03 08:56:41 +02:00
Francis Lachapelle
045f134321
feat(mail): initial support for ms-tnef (winmail.dat) body part
...
Fixes #2242
Fixes #4503
2021-08-13 11:12:37 -04:00
tfux
fab8061766
feat(eas): Allow EAS Search operation in all parts of a message
2020-12-09 13:34:19 -05:00
Ludovic Marcotte
2c9c1e0d01
(fix) support Squeeze + minor cleanups
2017-07-05 11:08:00 -04:00
Ludovic Marcotte
a9763e94a4
(feat) added photo support in GAL search ops
2017-04-21 15:29:34 -04:00
Ludovic Marcotte
2cebee42b7
(feat) added new SOGoMaximumMessageSizeLimit config parameter ( fixes #3510 )
...
Conflicts:
SoObjects/Mailer/SOGoDraftObject.m
2016-12-28 10:23:19 -05:00
Ludovic Marcotte
582baf2960
(feat) added AngularJS's XSRF support ( #3246 )
2016-04-26 11:07:22 -04:00
Ludovic Marcotte
916806cc2c
(feat) new SOGoHelpURL preference to set a custom URL for SOGo help ( fixes #2768 )
2016-03-22 14:25:55 -04:00
Ludovic Marcotte
9d6ab2df33
(feat) user rate-limiting support for all SOGo requests
2016-03-18 11:04:41 -04:00
Ludovic Marcotte
5412599832
(feat) now possible to log EAS commands using the SOGoEASDebugEnabled system defaults
2015-05-14 15:26:18 -04:00
Ludovic Marcotte
8015688df3
Added SOGoMaximumSyncResponseSize to support memory-limited EAS syncs
2014-12-22 11:50:51 -05:00
Ludovic Marcotte
3f3673cf5a
Added SOGoSAML2LogoutURL
2014-12-04 17:59:17 -05:00
Ludovic Marcotte
913a75f410
Fix for bug #
2014-11-26 13:00:47 -05:00
Ludovic Marcotte
0d1c39ca71
Added new configuration parameter to limit the window size
2014-04-09 20:12:19 -04:00
Alexandre Cloutier
f8939bfb3e
Change the variable name for sieveFolderEncoding instead of folderEncoding
2014-03-10 10:07:47 -04:00
Alexandre Cloutier
e7a16cba0d
BugFix #0002622 : The server Dovecot use by default an UTF-8 and by doing so it cause a wrong re-encoding in UTF-7 when reaching the sieve server (knowing that the foldername in sieve are encoded in UTF-7). Since it is not the case with a Cyrus server, I created a new variable available in the sogo.conf that let you specified the type of encoding you need. By default the encoding is set to UTF-7. ex : SOGoFolderEncoding = 'UTF-7'
2014-03-06 14:33:31 -05:00
Ludovic Marcotte
b14e99b32a
New prefs for intervals, fixed missing events in meeting requests, bumped v14.1
2014-02-10 20:16:43 -05:00
Ludovic Marcotte
afb7bc309c
Added message submissions rate-limiting support
2013-06-11 11:21:58 -04:00
Ludovic Marcotte
cfee5aa3f4
Added new failed login rate-limiting options
2013-06-11 09:41:17 -04:00
Francis Lachapelle
d12c651d59
New system default SOGoEncryptionKey
...
To be used to encrypt the passwords of remote Web calendars when
SOGoTrustProxyAuthentication is enabled.
2013-03-11 09:34:36 -04:00
Wolfgang Sourdeau
695fc5fff9
added methods for supporting SAML2 configuration
2012-11-02 15:30:13 -04:00
Francis Lachapelle
20e43626b5
Renamed SOGoEnableDomainWithUID to SOGoEnableDomainBasedUID.
...
Monotone-Parent: 297140f163083c23ae6ed58e7f2fe17a62277d31
Monotone-Revision: 6d9f4a1dbd4808e626cd25041219c5bb22a5626f
Monotone-Author: flachapelle@inverse.ca
Monotone-Date: 2011-07-19T16:25:11
Monotone-Branch: ca.inverse.sogo
Monotone-Tag: SOGo_v1.3.8a
Monotone-Tag: v1.3.8a
2011-07-19 16:25:11 +00:00
Francis Lachapelle
26126b8959
See ChangeLog
...
Monotone-Parent: b60a07f4bcb416be85fafcd1299d398c09b58190
Monotone-Revision: b836806e761968a4845035ee408cce501a3f9fc5
Monotone-Author: flachapelle@inverse.ca
Monotone-Date: 2011-07-19T01:21:18
Monotone-Branch: ca.inverse.sogo
2011-07-19 01:21:18 +00:00
Francis Lachapelle
620872202d
See ChangeLog.
...
Monotone-Parent: 42fa26da9b1def06a194726cab4199338a4bdf4c
Monotone-Revision: 88b07aa8edf775fa02705a9c03a0f8f14f905db3
Monotone-Author: flachapelle@inverse.ca
Monotone-Date: 2011-07-15T22:22:11
Monotone-Branch: ca.inverse.sogo
2011-07-15 22:22:11 +00:00
Francis Lachapelle
f44212f0e6
See ChangeLog
...
Monotone-Parent: c0fdc871e5cf2faadbed16ce1c4275647d0928b4
Monotone-Revision: 178cf4e5311729ac333305676b5ad2aa35a7ca71
Monotone-Author: flachapelle@inverse.ca
Monotone-Date: 2011-06-24T19:19:50
Monotone-Branch: ca.inverse.sogo
2011-06-24 19:19:50 +00:00
Francis Lachapelle
f630dd1c83
See ChangeLog.
...
Monotone-Parent: b3af4618e267496536ae158c684a391e497913f0
Monotone-Revision: 85f004835cf5ba09158bc317c859435dd12fe5bf
Monotone-Author: flachapelle@inverse.ca
Monotone-Date: 2011-03-30T15:21:27
Monotone-Branch: ca.inverse.sogo
2011-03-30 15:21:27 +00:00
Jordi Mallach
Hivert Quentin
smizrahi
Francis Lachapelle
tfux
Ludovic Marcotte
Alexandre Cloutier
Wolfgang Sourdeau