From 8a60b658b46dd8b8f9a99581849d8fa04dc76fdb Mon Sep 17 00:00:00 2001 From: Vincent Kling Date: Thu, 20 Oct 2022 13:41:35 +0200 Subject: [PATCH 01/31] Implement FETCHMAIL_ENABLED --- core/admin/mailu/configuration.py | 5 +++-- core/admin/mailu/ui/templates/sidebar.html | 2 ++ core/admin/mailu/ui/views/fetches.py | 9 +++++++++ docs/configuration.rst | 3 +++ setup/flavors/compose/mailu.env | 3 +++ towncrier/newsfragments/2127.feature | 1 + 6 files changed, 21 insertions(+), 2 deletions(-) create mode 100644 towncrier/newsfragments/2127.feature diff --git a/core/admin/mailu/configuration.py b/core/admin/mailu/configuration.py index 2f137c0c..e7de2a40 100644 --- a/core/admin/mailu/configuration.py +++ b/core/admin/mailu/configuration.py @@ -16,13 +16,14 @@ DEFAULT_CONFIG = { 'DOMAIN_REGISTRATION': False, 'TEMPLATES_AUTO_RELOAD': True, 'MEMORY_SESSIONS': False, + 'FETCHMAIL_ENABLED': False, # Database settings 'DB_FLAVOR': None, 'DB_USER': 'mailu', 'DB_PW': None, 'DB_HOST': 'database', 'DB_NAME': 'mailu', - 'SQLITE_DATABASE_FILE':'data/main.db', + 'SQLITE_DATABASE_FILE': 'data/main.db', 'SQLALCHEMY_DATABASE_URI': 'sqlite:////data/main.db', 'SQLALCHEMY_TRACK_MODIFICATIONS': False, # Statistics management @@ -59,7 +60,7 @@ DEFAULT_CONFIG = { # Web settings 'SITENAME': 'Mailu', 'WEBSITE': 'https://mailu.io', - 'ADMIN' : 'none', + 'ADMIN': 'none', 'WEB_ADMIN': '/admin', 'WEB_WEBMAIL': '/webmail', 'WEBMAIL': 'none', diff --git a/core/admin/mailu/ui/templates/sidebar.html b/core/admin/mailu/ui/templates/sidebar.html index a57a2abe..54448c8b 100644 --- a/core/admin/mailu/ui/templates/sidebar.html +++ b/core/admin/mailu/ui/templates/sidebar.html @@ -31,12 +31,14 @@

{% trans %}Auto-reply{% endtrans %}

+ {%- if config["FETCHMAIL_ENABLED"] %}

  • {% trans %}Fetched accounts{% endtrans %}
    • + {%- endif %}
  • diff --git a/core/admin/mailu/ui/views/fetches.py b/core/admin/mailu/ui/views/fetches.py index ec208af1..ca837a8e 100644 --- a/core/admin/mailu/ui/views/fetches.py +++ b/core/admin/mailu/ui/views/fetches.py @@ -1,5 +1,6 @@ from mailu import models from mailu.ui import ui, forms, access +from flask import current_app as app import flask import flask_login @@ -10,6 +11,8 @@ import wtforms @ui.route('/fetch/list/', methods=['GET']) @access.owner(models.User, 'user_email') def fetch_list(user_email): + if not app.config['FETCHMAIL_ENABLED']: + flask.abort(404) user_email = user_email or flask_login.current_user.email user = models.User.query.get(user_email) or flask.abort(404) return flask.render_template('fetch/list.html', user=user) @@ -19,6 +22,8 @@ def fetch_list(user_email): @ui.route('/fetch/create/', methods=['GET', 'POST']) @access.owner(models.User, 'user_email') def fetch_create(user_email): + if not app.config['FETCHMAIL_ENABLED']: + flask.abort(404) user_email = user_email or flask_login.current_user.email user = models.User.query.get(user_email) or flask.abort(404) form = forms.FetchForm() @@ -37,6 +42,8 @@ def fetch_create(user_email): @ui.route('/fetch/edit/', methods=['GET', 'POST']) @access.owner(models.Fetch, 'fetch_id') def fetch_edit(fetch_id): + if not app.config['FETCHMAIL_ENABLED']: + flask.abort(404) fetch = models.Fetch.query.get(fetch_id) or flask.abort(404) form = forms.FetchForm(obj=fetch) if form.validate_on_submit(): @@ -55,6 +62,8 @@ def fetch_edit(fetch_id): @access.confirmation_required("delete a fetched account") @access.owner(models.Fetch, 'fetch_id') def fetch_delete(fetch_id): + if not app.config['FETCHMAIL_ENABLED']: + flask.abort(404) fetch = models.Fetch.query.get(fetch_id) or flask.abort(404) user = fetch.user models.db.session.delete(fetch) diff --git a/docs/configuration.rst b/docs/configuration.rst index 80f97d3a..58965dff 100644 --- a/docs/configuration.rst +++ b/docs/configuration.rst @@ -102,6 +102,9 @@ support or e.g. mismatching TLS versions to deliver emails to Mailu. .. _fetchmail: +When ``FETCHMAIL_ENABLED`` is set to ``True``, the fetchmail functionality is shown in the admin interface. +The container itself still needs to be deployed manually. As fetchmail is optional, ``FETCHMAIL_ENABLED`` defaults to ``False``. + The ``FETCHMAIL_DELAY`` is a delay (in seconds) for the fetchmail service to go and fetch new email if available. Do not use too short delays if you do not want to be blacklisted by external services, but not too long delays if you diff --git a/setup/flavors/compose/mailu.env b/setup/flavors/compose/mailu.env index 2963c882..4e13a8c9 100644 --- a/setup/flavors/compose/mailu.env +++ b/setup/flavors/compose/mailu.env @@ -79,6 +79,9 @@ RELAYNETS= # Will relay all outgoing mails if configured RELAYHOST={{ relayhost }} +# Show fetchmail functionality in admin interface +FETCHMAIL_ENABLED={{ fetchmail_enabled or 'False' }} + # Fetchmail delay FETCHMAIL_DELAY={{ fetchmail_delay or '600' }} diff --git a/towncrier/newsfragments/2127.feature b/towncrier/newsfragments/2127.feature new file mode 100644 index 00000000..dd4951dd --- /dev/null +++ b/towncrier/newsfragments/2127.feature @@ -0,0 +1 @@ +Add FETCHMAIL_ENABLED to toggle the fetchmail functionality in the admin interface \ No newline at end of file From 83fdc07a6fc2c8b3fad75619c4e8ce988dff8621 Mon Sep 17 00:00:00 2001 From: Vincent Kling Date: Fri, 4 Nov 2022 11:59:26 +0100 Subject: [PATCH 02/31] Default FETCHMAIL_ENABLED to True --- core/admin/mailu/configuration.py | 2 +- docs/configuration.rst | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/core/admin/mailu/configuration.py b/core/admin/mailu/configuration.py index e7de2a40..060edc8e 100644 --- a/core/admin/mailu/configuration.py +++ b/core/admin/mailu/configuration.py @@ -16,7 +16,7 @@ DEFAULT_CONFIG = { 'DOMAIN_REGISTRATION': False, 'TEMPLATES_AUTO_RELOAD': True, 'MEMORY_SESSIONS': False, - 'FETCHMAIL_ENABLED': False, + 'FETCHMAIL_ENABLED': True, # Database settings 'DB_FLAVOR': None, 'DB_USER': 'mailu', diff --git a/docs/configuration.rst b/docs/configuration.rst index 58965dff..6bf0845b 100644 --- a/docs/configuration.rst +++ b/docs/configuration.rst @@ -102,8 +102,8 @@ support or e.g. mismatching TLS versions to deliver emails to Mailu. .. _fetchmail: -When ``FETCHMAIL_ENABLED`` is set to ``True``, the fetchmail functionality is shown in the admin interface. -The container itself still needs to be deployed manually. As fetchmail is optional, ``FETCHMAIL_ENABLED`` defaults to ``False``. +When ``FETCHMAIL_ENABLED`` is set to ``True``, the fetchmail functionality is enabled in the admin interface. +The container itself still needs to be deployed manually. ``FETCHMAIL_ENABLED`` defaults to ``True``. The ``FETCHMAIL_DELAY`` is a delay (in seconds) for the fetchmail service to go and fetch new email if available. Do not use too short delays if you do not From 6901b0f05e8fb5167fa7c1d0c8cec6ea002bef3f Mon Sep 17 00:00:00 2001 From: Vincent Kling Date: Tue, 8 Nov 2022 11:47:20 +0100 Subject: [PATCH 03/31] Implement FETCHMAIL_ENABLED in fetchmail.py --- optional/fetchmail/fetchmail.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/optional/fetchmail/fetchmail.py b/optional/fetchmail/fetchmail.py index 5459de59..1889d808 100755 --- a/optional/fetchmail/fetchmail.py +++ b/optional/fetchmail/fetchmail.py @@ -1,5 +1,5 @@ #!/usr/bin/python3 - +import distutils.util import time import os import tempfile @@ -96,5 +96,9 @@ def run(debug): if __name__ == "__main__": while True: time.sleep(int(os.environ.get("FETCHMAIL_DELAY", 60))) + + if not os.environ.get("FETCHMAIL_ENABLED", 'True') in ('True', 'true'): + continue + run(os.environ.get("DEBUG", None) == "True") sys.stdout.flush() From 4a74cd9afeb5c75a1f3ceaadd5cdfdb07d0b8918 Mon Sep 17 00:00:00 2001 From: Vincent Kling Date: Tue, 8 Nov 2022 11:56:08 +0100 Subject: [PATCH 04/31] Resolve conflict --- optional/fetchmail/fetchmail.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/optional/fetchmail/fetchmail.py b/optional/fetchmail/fetchmail.py index 1889d808..2afd103b 100755 --- a/optional/fetchmail/fetchmail.py +++ b/optional/fetchmail/fetchmail.py @@ -1,5 +1,5 @@ #!/usr/bin/python3 -import distutils.util + import time import os import tempfile From 728afdd34a698e065240b0650e73ab394fa2e8f2 Mon Sep 17 00:00:00 2001 From: Vincent Kling Date: Tue, 8 Nov 2022 16:51:35 +0100 Subject: [PATCH 05/31] Add basic logging for FETCHMAIL_ENABLED and FETCHMAIL_DELAY --- optional/fetchmail/fetchmail.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/optional/fetchmail/fetchmail.py b/optional/fetchmail/fetchmail.py index 2afd103b..dfac6d2d 100755 --- a/optional/fetchmail/fetchmail.py +++ b/optional/fetchmail/fetchmail.py @@ -95,9 +95,12 @@ def run(debug): if __name__ == "__main__": while True: - time.sleep(int(os.environ.get("FETCHMAIL_DELAY", 60))) + delay = int(os.environ.get("FETCHMAIL_DELAY", 60)) + print("Sleeping for {} seconds".format(delay)) + time.sleep(delay) if not os.environ.get("FETCHMAIL_ENABLED", 'True') in ('True', 'true'): + print("Fetchmail disabled, skipping...") continue run(os.environ.get("DEBUG", None) == "True") From 97df65e9efd1951639f2451d5eb99c9077fa8de0 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Fri, 11 Nov 2022 13:56:04 +0100 Subject: [PATCH 06/31] Switch to GrapheneOS's hardened_malloc This was suggested during the dev meeting of the 18/09/22. It may break things and it may make things unbearably slow --- core/base/Dockerfile | 3 ++- towncrier/newsfragments/2525.feature | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 towncrier/newsfragments/2525.feature diff --git a/core/base/Dockerfile b/core/base/Dockerfile index d5be6a90..242fd060 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -12,7 +12,8 @@ ARG MAILU_GID=1000 RUN set -euxo pipefail \ ; addgroup -Sg ${MAILU_GID} mailu \ ; adduser -Sg ${MAILU_UID} -G mailu -h /app -g "mailu app" -s /bin/bash mailu \ - ; apk add --no-cache bash ca-certificates curl python3 tzdata + ; apk add --no-cache bash ca-certificates curl python3 tzdata \ + ; apk add --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc WORKDIR /app diff --git a/towncrier/newsfragments/2525.feature b/towncrier/newsfragments/2525.feature new file mode 100644 index 00000000..634733c7 --- /dev/null +++ b/towncrier/newsfragments/2525.feature @@ -0,0 +1 @@ +Switch to GrapheneOS's hardened_malloc From f11c4514031571f3b56801958a422da358d819c2 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Fri, 11 Nov 2022 14:12:54 +0100 Subject: [PATCH 07/31] Restrict it to arch where there is a package --- core/base/Dockerfile | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/core/base/Dockerfile b/core/base/Dockerfile index 242fd060..ad9dfa57 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -13,7 +13,12 @@ RUN set -euxo pipefail \ ; addgroup -Sg ${MAILU_GID} mailu \ ; adduser -Sg ${MAILU_UID} -G mailu -h /app -g "mailu app" -s /bin/bash mailu \ ; apk add --no-cache bash ca-certificates curl python3 tzdata \ - ; apk add --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc + ; machine="$(uname -m)" \ + ; ( [[ "${machine}" == x86_64 ]] || \ + [[ "${machine}" == armv8* ]] || \ + [[ "${machine}" == aarch64 ]] ) && \ + echo "Installing hardened-malloc" && \ + apk add --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc WORKDIR /app From 455180043d03fda9a906e38e5b85776db9011bad Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Mon, 14 Nov 2022 09:34:43 +0100 Subject: [PATCH 08/31] doh --- core/base/Dockerfile | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/core/base/Dockerfile b/core/base/Dockerfile index ad9dfa57..8e25d428 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -14,11 +14,17 @@ RUN set -euxo pipefail \ ; adduser -Sg ${MAILU_UID} -G mailu -h /app -g "mailu app" -s /bin/bash mailu \ ; apk add --no-cache bash ca-certificates curl python3 tzdata \ ; machine="$(uname -m)" \ - ; ( [[ "${machine}" == x86_64 ]] || \ - [[ "${machine}" == armv8* ]] || \ - [[ "${machine}" == aarch64 ]] ) && \ - echo "Installing hardened-malloc" && \ - apk add --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc + ; if [[ "${machine}" == x86_64 || "${machine}" == armv8* || "${machine}" == aarch64 ]] \ + ; then \ + echo "Installing hardened-malloc" \ + ; apk add --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc \ + ; else \ + echo "Faking the install of hardened-malloc" \ + ; cp /lib/ld-musl-${machine}.so.1 /usr/lib/libhardened_malloc.so \ + ; touch /usr/lib/libhardened_malloc.so.faked \ + ; fi + +ENV LD_PRELOAD=/usr/lib/libhardened_malloc.so WORKDIR /app From 505bb79a78203da87cde5f9f3b31c579f3bcfac1 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Mon, 14 Nov 2022 15:03:57 +0100 Subject: [PATCH 09/31] Don't set the secure Cookie flag if TLS_FLAVOR=notls --- core/admin/mailu/sso/views/base.py | 2 +- core/admin/mailu/utils.py | 2 +- core/admin/run_dev.sh | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/core/admin/mailu/sso/views/base.py b/core/admin/mailu/sso/views/base.py index 6fa9403f..a4218ac6 100644 --- a/core/admin/mailu/sso/views/base.py +++ b/core/admin/mailu/sso/views/base.py @@ -39,7 +39,7 @@ def login(): flask.session.regenerate() flask_login.login_user(user) response = flask.redirect(destination) - response.set_cookie('rate_limit', utils.limiter.device_cookie(username), max_age=31536000, path=flask.url_for('sso.login'), secure=app.config['SESSION_COOKIE_SECURE'], httponly=True) + response.set_cookie('rate_limit', utils.limiter.device_cookie(username), max_age=31536000, path=flask.url_for('sso.login'), secure=False if app.config['TLS_FLAVOR'] == 'notls' else app.config['SESSION_COOKIE_SECURE'], httponly=True) flask.current_app.logger.info(f'Login succeeded for {username} from {client_ip} pwned={form.pwned.data}.') if msg := utils.isBadOrPwned(form): flask.flash(msg, "error") diff --git a/core/admin/mailu/utils.py b/core/admin/mailu/utils.py index f160fe3f..a330a7d6 100644 --- a/core/admin/mailu/utils.py +++ b/core/admin/mailu/utils.py @@ -408,7 +408,7 @@ class MailuSessionInterface(SessionInterface): httponly=self.get_cookie_httponly(app), domain=self.get_cookie_domain(app), path=self.get_cookie_path(app), - secure=self.get_cookie_secure(app), + secure=False if app.config['TLS_FLAVOR'] == 'notls' else self.get_cookie_secure(app), samesite=self.get_cookie_samesite(app) ) diff --git a/core/admin/run_dev.sh b/core/admin/run_dev.sh index 4ab76e74..65841f2c 100755 --- a/core/admin/run_dev.sh +++ b/core/admin/run_dev.sh @@ -68,12 +68,12 @@ ENV \ FLASK_ENV="development" \ MEMORY_SESSIONS="true" \ RATELIMIT_STORAGE_URL="memory://" \ - SESSION_COOKIE_SECURE="false" \ \ DEBUG="true" \ DEBUG_PROFILER="${DEV_PROFILER}" \ DEBUG_ASSETS="/app/static" \ DEBUG_TB_ENABLED="true" \ + DEBUG_TB_INTERCEPT_REDIRECTS=False \ \ IMAP_ADDRESS="127.0.0.1" \ POP3_ADDRESS="127.0.0.1" \ From a566cb07d6181a846962c74aa7e35884fa76df7c Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Mon, 14 Nov 2022 16:51:05 +0100 Subject: [PATCH 10/31] fix --- core/admin/run_dev.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/admin/run_dev.sh b/core/admin/run_dev.sh index 7c6e8467..05da792e 100755 --- a/core/admin/run_dev.sh +++ b/core/admin/run_dev.sh @@ -82,7 +82,7 @@ ENV \ REDIS_ADDRESS="127.0.0.1" \ WEBMAIL_ADDRESS="127.0.0.1" -CMD ["/bin/bash", "-c", "flask db upgrade &>/dev/null && flask mailu admin '${DEV_ADMIN/@*}' '${DEV_ADMIN#*@}' '${DEV_PASSWORD}' --mode ifmissing >/dev/null; flask --debug run --host=0.0.0.0 --port=8080"] +CMD ["/bin/bash", "-c", "flask db upgrade &>/dev/null && flask mailu admin '${DEV_ADMIN/@*}' '${DEV_ADMIN#*@}' '${DEV_PASSWORD}' --mode ifmissing >/dev/null; flask --debugger run --host=0.0.0.0 --port=8080"] EOF # build From 7aad1158fb10df2f61596e56bfe336a255ac9952 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Mon, 14 Nov 2022 17:31:31 +0100 Subject: [PATCH 11/31] @ghostwheel42 will fix it in another PR --- core/admin/run_dev.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/core/admin/run_dev.sh b/core/admin/run_dev.sh index 05da792e..cbe625f6 100755 --- a/core/admin/run_dev.sh +++ b/core/admin/run_dev.sh @@ -73,7 +73,6 @@ ENV \ DEBUG_PROFILER="${DEV_PROFILER}" \ DEBUG_ASSETS="/app/static" \ DEBUG_TB_ENABLED="true" \ - DEBUG_TB_INTERCEPT_REDIRECTS=False \ \ IMAP_ADDRESS="127.0.0.1" \ POP3_ADDRESS="127.0.0.1" \ @@ -82,7 +81,7 @@ ENV \ REDIS_ADDRESS="127.0.0.1" \ WEBMAIL_ADDRESS="127.0.0.1" -CMD ["/bin/bash", "-c", "flask db upgrade &>/dev/null && flask mailu admin '${DEV_ADMIN/@*}' '${DEV_ADMIN#*@}' '${DEV_PASSWORD}' --mode ifmissing >/dev/null; flask --debugger run --host=0.0.0.0 --port=8080"] +CMD ["/bin/bash", "-c", "flask db upgrade &>/dev/null && flask mailu admin '${DEV_ADMIN/@*}' '${DEV_ADMIN#*@}' '${DEV_PASSWORD}' --mode ifmissing >/dev/null; flask --debug run --host=0.0.0.0 --port=8080"] EOF # build From 6b470ac4038f5981e2106e8f0cfc8acdbe9825b0 Mon Sep 17 00:00:00 2001 From: Alexander Graf Date: Mon, 14 Nov 2022 17:38:10 +0100 Subject: [PATCH 12/31] Allow proper JS debugging, speed-up assets dev-build, disable redirect-debug by default. --- core/admin/assets/Dockerfile | 2 +- core/admin/assets/assets/app.js | 5 ----- core/admin/assets/assets/vendor.js | 6 +++--- core/admin/assets/webpack.config.js | 2 +- core/admin/mailu/configuration.py | 1 + core/admin/run_dev.sh | 2 +- 6 files changed, 7 insertions(+), 11 deletions(-) diff --git a/core/admin/assets/Dockerfile b/core/admin/assets/Dockerfile index 613aa6c0..33b9bdb9 100644 --- a/core/admin/assets/Dockerfile +++ b/core/admin/assets/Dockerfile @@ -5,7 +5,6 @@ FROM node:16-alpine3.16 WORKDIR /work COPY package.json ./ -COPY webpack.config.js ./ RUN set -euxo pipefail \ ; npm config set update-notifier false \ @@ -17,6 +16,7 @@ RUN set -euxo pipefail \ done COPY assets/ ./assets/ +COPY webpack.config.js ./ RUN set -euxo pipefail \ ; node_modules/.bin/webpack-cli --color diff --git a/core/admin/assets/assets/app.js b/core/admin/assets/assets/app.js index ad2b543a..661e0242 100644 --- a/core/admin/assets/assets/app.js +++ b/core/admin/assets/assets/app.js @@ -1,8 +1,3 @@ -require('./app.css'); - -import logo from './mailu.png'; -import modules from "./*.json"; - // Inspired from https://github.com/mehdibo/hibp-js/blob/master/hibp.js function sha1(string) { var buffer = new TextEncoder("utf-8").encode(string); diff --git a/core/admin/assets/assets/vendor.js b/core/admin/assets/assets/vendor.js index 906448cf..819240ad 100644 --- a/core/admin/assets/assets/vendor.js +++ b/core/admin/assets/assets/vendor.js @@ -1,5 +1,5 @@ // AdminLTE -import 'admin-lte/plugins/jquery/jquery.min.js'; +window.$ = window.jQuery = require('admin-lte/plugins/jquery/jquery.min.js'); import 'admin-lte/plugins/bootstrap/js/bootstrap.bundle.min.js'; import 'admin-lte/build/scss/adminlte.scss'; import 'admin-lte/build/js/AdminLTE.js'; @@ -18,7 +18,7 @@ import 'admin-lte/plugins/datatables/jquery.dataTables.min.js'; import 'admin-lte/plugins/datatables-bs4/js/dataTables.bootstrap4.min.js'; import 'admin-lte/plugins/datatables-responsive/js/dataTables.responsive.min.js'; import 'admin-lte/plugins/datatables-responsive/js/responsive.bootstrap4.min.js'; +import modules from "./*.json"; // clipboard.js -import 'clipboard/dist/clipboard.min.js'; - +window.ClipboardJS = require('clipboard/dist/clipboard.min.js'); diff --git a/core/admin/assets/webpack.config.js b/core/admin/assets/webpack.config.js index 25c966c1..8c3d6c27 100644 --- a/core/admin/assets/webpack.config.js +++ b/core/admin/assets/webpack.config.js @@ -9,7 +9,7 @@ module.exports = { mode: 'production', entry: { app: { - import: './assets/app.js', + import: ['./assets/app.css', './assets/mailu.png', './assets/app.js'], dependOn: 'vendor', }, vendor: './assets/vendor.js', diff --git a/core/admin/mailu/configuration.py b/core/admin/mailu/configuration.py index b941e95c..a058a760 100644 --- a/core/admin/mailu/configuration.py +++ b/core/admin/mailu/configuration.py @@ -13,6 +13,7 @@ DEFAULT_CONFIG = { 'RATELIMIT_STORAGE_URL': '', 'DEBUG': False, 'DEBUG_PROFILER': False, + 'DEBUG_TB_INTERCEPT_REDIRECTS': False, 'DEBUG_ASSETS': '', 'DOMAIN_REGISTRATION': False, 'TEMPLATES_AUTO_RELOAD': True, diff --git a/core/admin/run_dev.sh b/core/admin/run_dev.sh index dbe3368a..cf05fba3 100755 --- a/core/admin/run_dev.sh +++ b/core/admin/run_dev.sh @@ -73,7 +73,7 @@ ENV \ DEBUG="true" \ DEBUG_PROFILER="${DEV_PROFILER}" \ DEBUG_ASSETS="/app/static" \ - DEBUG_TB_ENABLED="true" \ + DEBUG_TB_INTERCEPT_REDIRECTS=False \ \ IMAP_ADDRESS="127.0.0.1" \ POP3_ADDRESS="127.0.0.1" \ From 76f8517e00a33a3e51126a7a54cdaa7ce3b9dd26 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Mon, 14 Nov 2022 19:38:17 +0100 Subject: [PATCH 13/31] This is still required (as TLS_FLAVOR isn't set) --- core/admin/run_dev.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/core/admin/run_dev.sh b/core/admin/run_dev.sh index cbe625f6..dbe3368a 100755 --- a/core/admin/run_dev.sh +++ b/core/admin/run_dev.sh @@ -68,6 +68,7 @@ ENV \ FLASK_DEBUG="true" \ MEMORY_SESSIONS="true" \ RATELIMIT_STORAGE_URL="memory://" \ + SESSION_COOKIE_SECURE="false" \ \ DEBUG="true" \ DEBUG_PROFILER="${DEV_PROFILER}" \ From 9b2f018be615400ed78befdcdd6649e8b815fa8d Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Tue, 15 Nov 2022 09:09:47 +0100 Subject: [PATCH 14/31] add --no-cache --- core/base/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/base/Dockerfile b/core/base/Dockerfile index 8e25d428..683f718f 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -17,7 +17,7 @@ RUN set -euxo pipefail \ ; if [[ "${machine}" == x86_64 || "${machine}" == armv8* || "${machine}" == aarch64 ]] \ ; then \ echo "Installing hardened-malloc" \ - ; apk add --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc \ + ; apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc \ ; else \ echo "Faking the install of hardened-malloc" \ ; cp /lib/ld-musl-${machine}.so.1 /usr/lib/libhardened_malloc.so \ From 81628149a234985e1fba07881ac3448078ce2bc3 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Tue, 15 Nov 2022 09:17:06 +0100 Subject: [PATCH 15/31] don't fake the library --- core/base/Dockerfile | 4 ---- 1 file changed, 4 deletions(-) diff --git a/core/base/Dockerfile b/core/base/Dockerfile index 683f718f..35bcbd15 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -18,10 +18,6 @@ RUN set -euxo pipefail \ ; then \ echo "Installing hardened-malloc" \ ; apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc \ - ; else \ - echo "Faking the install of hardened-malloc" \ - ; cp /lib/ld-musl-${machine}.so.1 /usr/lib/libhardened_malloc.so \ - ; touch /usr/lib/libhardened_malloc.so.faked \ ; fi ENV LD_PRELOAD=/usr/lib/libhardened_malloc.so From 66de1dcec88f6a961a4a5d792045be8bc8774347 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Tue, 15 Nov 2022 10:47:20 +0100 Subject: [PATCH 16/31] Change the logic The idea here is that if you have set SESSION_COOKIE_SECURE we should honor that... and if you haven't we should try to do the right thing. --- core/admin/mailu/configuration.py | 4 +++- core/admin/mailu/sso/views/base.py | 2 +- core/admin/mailu/utils.py | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/core/admin/mailu/configuration.py b/core/admin/mailu/configuration.py index b941e95c..eb27aee0 100644 --- a/core/admin/mailu/configuration.py +++ b/core/admin/mailu/configuration.py @@ -73,7 +73,7 @@ DEFAULT_CONFIG = { 'SESSION_KEY_BITS': 128, 'SESSION_TIMEOUT': 3600, 'PERMANENT_SESSION_LIFETIME': 30*24*3600, - 'SESSION_COOKIE_SECURE': True, + 'SESSION_COOKIE_SECURE': False, 'CREDENTIAL_ROUNDS': 12, 'TLS_PERMISSIVE': True, 'TZ': 'Etc/UTC', @@ -156,6 +156,8 @@ class ConfigManager: self.config['SESSION_STORAGE_URL'] = f'redis://{self.config["REDIS_ADDRESS"]}/3' self.config['SESSION_COOKIE_SAMESITE'] = 'Strict' self.config['SESSION_COOKIE_HTTPONLY'] = True + if self.config['TLS_FLAVOR'] != 'notls' and not self.config['SESSION_COOKIE_SECURE']: + self.config['SESSION_COOKIE_SECURE'] = True self.config['SESSION_PERMANENT'] = True self.config['SESSION_TIMEOUT'] = int(self.config['SESSION_TIMEOUT']) self.config['PERMANENT_SESSION_LIFETIME'] = int(self.config['PERMANENT_SESSION_LIFETIME']) diff --git a/core/admin/mailu/sso/views/base.py b/core/admin/mailu/sso/views/base.py index a4218ac6..6fa9403f 100644 --- a/core/admin/mailu/sso/views/base.py +++ b/core/admin/mailu/sso/views/base.py @@ -39,7 +39,7 @@ def login(): flask.session.regenerate() flask_login.login_user(user) response = flask.redirect(destination) - response.set_cookie('rate_limit', utils.limiter.device_cookie(username), max_age=31536000, path=flask.url_for('sso.login'), secure=False if app.config['TLS_FLAVOR'] == 'notls' else app.config['SESSION_COOKIE_SECURE'], httponly=True) + response.set_cookie('rate_limit', utils.limiter.device_cookie(username), max_age=31536000, path=flask.url_for('sso.login'), secure=app.config['SESSION_COOKIE_SECURE'], httponly=True) flask.current_app.logger.info(f'Login succeeded for {username} from {client_ip} pwned={form.pwned.data}.') if msg := utils.isBadOrPwned(form): flask.flash(msg, "error") diff --git a/core/admin/mailu/utils.py b/core/admin/mailu/utils.py index a330a7d6..f160fe3f 100644 --- a/core/admin/mailu/utils.py +++ b/core/admin/mailu/utils.py @@ -408,7 +408,7 @@ class MailuSessionInterface(SessionInterface): httponly=self.get_cookie_httponly(app), domain=self.get_cookie_domain(app), path=self.get_cookie_path(app), - secure=False if app.config['TLS_FLAVOR'] == 'notls' else self.get_cookie_secure(app), + secure=self.get_cookie_secure(app), samesite=self.get_cookie_samesite(app) ) From 63513608b9423aee8c21c710f70f532e58ed81bd Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Tue, 15 Nov 2022 11:12:27 +0100 Subject: [PATCH 17/31] Close #2533: document SQLALCHEMY_DATABASE_URI --- docs/configuration.rst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/configuration.rst b/docs/configuration.rst index d411d2c7..ba75e0bf 100644 --- a/docs/configuration.rst +++ b/docs/configuration.rst @@ -287,6 +287,10 @@ The admin service stores configurations in a database. - ``DB_USER``: the database user for mailu admin service. (when not ``sqlite``) - ``DB_NAME``: the database name for mailu admin service. (when not ``sqlite``) +Alternatively, if you need more control, you can use a `DB URL`_ : do not set any of the ``DB_`` settings and set ``SQLALCHEMY_DATABASE_URI`` instead. + +.. _`DB URL`: https://docs.sqlalchemy.org/en/latest/core/engines.html#database-urls + The roundcube service stores configurations in a database. - ``ROUNDCUBE_DB_FLAVOR``: the database type for roundcube service. (``sqlite``, ``postgresql``, ``mysql``) From b9e5560fb6942bde84419024cf53d04263dd8a03 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Tue, 15 Nov 2022 12:47:38 +0100 Subject: [PATCH 18/31] Better way to express the same thing Thanks @ghostwheel42 --- core/admin/mailu/configuration.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/core/admin/mailu/configuration.py b/core/admin/mailu/configuration.py index eb27aee0..fa638520 100644 --- a/core/admin/mailu/configuration.py +++ b/core/admin/mailu/configuration.py @@ -73,7 +73,7 @@ DEFAULT_CONFIG = { 'SESSION_KEY_BITS': 128, 'SESSION_TIMEOUT': 3600, 'PERMANENT_SESSION_LIFETIME': 30*24*3600, - 'SESSION_COOKIE_SECURE': False, + 'SESSION_COOKIE_SECURE': None, 'CREDENTIAL_ROUNDS': 12, 'TLS_PERMISSIVE': True, 'TZ': 'Etc/UTC', @@ -156,8 +156,8 @@ class ConfigManager: self.config['SESSION_STORAGE_URL'] = f'redis://{self.config["REDIS_ADDRESS"]}/3' self.config['SESSION_COOKIE_SAMESITE'] = 'Strict' self.config['SESSION_COOKIE_HTTPONLY'] = True - if self.config['TLS_FLAVOR'] != 'notls' and not self.config['SESSION_COOKIE_SECURE']: - self.config['SESSION_COOKIE_SECURE'] = True + if self.config['SESSION_COOKIE_SECURE'] is None: + self.config['SESSION_COOKIE_SECURE'] = self.config['TLS_FLAVOR'] != 'notls' self.config['SESSION_PERMANENT'] = True self.config['SESSION_TIMEOUT'] = int(self.config['SESSION_TIMEOUT']) self.config['PERMANENT_SESSION_LIFETIME'] = int(self.config['PERMANENT_SESSION_LIFETIME']) From 031a157ad9f3f966e47114b1c7dc7dd014963eec Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Tue, 15 Nov 2022 17:25:44 +0100 Subject: [PATCH 19/31] fix the linux/arm/v7 build --- core/base/Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/core/base/Dockerfile b/core/base/Dockerfile index 35bcbd15..1ddffc1b 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -8,11 +8,13 @@ ENV TZ=Etc/UTC LANG=C.UTF-8 ARG MAILU_UID=1000 ARG MAILU_GID=1000 +ARG TARGETPLATFORM RUN set -euxo pipefail \ ; addgroup -Sg ${MAILU_GID} mailu \ ; adduser -Sg ${MAILU_UID} -G mailu -h /app -g "mailu app" -s /bin/bash mailu \ ; apk add --no-cache bash ca-certificates curl python3 tzdata \ + ; if [[ "$TARGETPLATFORM" == 'linux/arm/v7' ]]; then exit;fi \ ; machine="$(uname -m)" \ ; if [[ "${machine}" == x86_64 || "${machine}" == armv8* || "${machine}" == aarch64 ]] \ ; then \ From 1f895d5f82de3afee546870022ff477b49cc60d9 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Wed, 16 Nov 2022 11:53:52 +0100 Subject: [PATCH 20/31] ghostwheel42's suggestion --- core/base/Dockerfile | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/core/base/Dockerfile b/core/base/Dockerfile index 1ddffc1b..4972d303 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -14,13 +14,8 @@ RUN set -euxo pipefail \ ; addgroup -Sg ${MAILU_GID} mailu \ ; adduser -Sg ${MAILU_UID} -G mailu -h /app -g "mailu app" -s /bin/bash mailu \ ; apk add --no-cache bash ca-certificates curl python3 tzdata \ - ; if [[ "$TARGETPLATFORM" == 'linux/arm/v7' ]]; then exit;fi \ - ; machine="$(uname -m)" \ - ; if [[ "${machine}" == x86_64 || "${machine}" == armv8* || "${machine}" == aarch64 ]] \ - ; then \ - echo "Installing hardened-malloc" \ - ; apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc \ - ; fi + ; ! [[ "${TARGETPLATFORM}" != linux/arm/v7 && \( "${machine}" == x86_64 || "${machine}" == armv8* || "${machine}" == aarch64 \) ]] \ + || apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc ENV LD_PRELOAD=/usr/lib/libhardened_malloc.so From d43e7f72df9cadb0c5f74d80c2dda54e6c605a92 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Wed, 16 Nov 2022 11:55:12 +0100 Subject: [PATCH 21/31] ghostwheel42's suggestion --- core/base/Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/core/base/Dockerfile b/core/base/Dockerfile index 4972d303..4a7ffb38 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -14,6 +14,7 @@ RUN set -euxo pipefail \ ; addgroup -Sg ${MAILU_GID} mailu \ ; adduser -Sg ${MAILU_UID} -G mailu -h /app -g "mailu app" -s /bin/bash mailu \ ; apk add --no-cache bash ca-certificates curl python3 tzdata \ + ; machine="$(uname -m)" \ ; ! [[ "${TARGETPLATFORM}" != linux/arm/v7 && \( "${machine}" == x86_64 || "${machine}" == armv8* || "${machine}" == aarch64 \) ]] \ || apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc From 04f6bd263390265da9357b17b9f77a4fd6a22330 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Wed, 16 Nov 2022 12:23:14 +0100 Subject: [PATCH 22/31] simplify --- core/base/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/base/Dockerfile b/core/base/Dockerfile index 4a7ffb38..bded67e0 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -15,8 +15,8 @@ RUN set -euxo pipefail \ ; adduser -Sg ${MAILU_UID} -G mailu -h /app -g "mailu app" -s /bin/bash mailu \ ; apk add --no-cache bash ca-certificates curl python3 tzdata \ ; machine="$(uname -m)" \ - ; ! [[ "${TARGETPLATFORM}" != linux/arm/v7 && \( "${machine}" == x86_64 || "${machine}" == armv8* || "${machine}" == aarch64 \) ]] \ - || apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc + ; [[ "${TARGETPLATFORM}" != linux/arm/v7 && \( "${machine}" == x86_64 || "${machine}" == armv8* || "${machine}" == aarch64 \) ]] \ + && apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc ENV LD_PRELOAD=/usr/lib/libhardened_malloc.so From aa44a42654c9f4175922410a307645d1addaa630 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Wed, 16 Nov 2022 12:33:05 +0100 Subject: [PATCH 23/31] ensure we compile the wheels with bells and whistles too --- core/base/Dockerfile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/core/base/Dockerfile b/core/base/Dockerfile index bded67e0..bfc8cbc9 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -42,6 +42,10 @@ RUN set -euxo pipefail \ ; rm -f /tmp/*.pem ENV PATH="${VIRTUAL_ENV}/bin:${PATH}" +ENV CXXFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security" +ENV CFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security" +ENV CPPFLAGS="-Wdate-time -D_FORTIFY_SOURCE=2" +ENV LDFLAGS="-Wl,-z,relro" COPY requirements-${MAILU_DEPS}.txt ./ COPY libs/ libs/ From 7ab3d8f9feda2375e3a689dd5002f6712146c351 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Wed, 16 Nov 2022 12:34:45 +0100 Subject: [PATCH 24/31] There is no good reason not to export them is the base image too --- core/base/Dockerfile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/core/base/Dockerfile b/core/base/Dockerfile index bfc8cbc9..57ed1fa1 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -19,6 +19,10 @@ RUN set -euxo pipefail \ && apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc ENV LD_PRELOAD=/usr/lib/libhardened_malloc.so +ENV CXXFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security" +ENV CFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security" +ENV CPPFLAGS="-Wdate-time -D_FORTIFY_SOURCE=2" +ENV LDFLAGS="-Wl,-z,relro" WORKDIR /app @@ -42,10 +46,6 @@ RUN set -euxo pipefail \ ; rm -f /tmp/*.pem ENV PATH="${VIRTUAL_ENV}/bin:${PATH}" -ENV CXXFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security" -ENV CFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security" -ENV CPPFLAGS="-Wdate-time -D_FORTIFY_SOURCE=2" -ENV LDFLAGS="-Wl,-z,relro" COPY requirements-${MAILU_DEPS}.txt ./ COPY libs/ libs/ From 32f3241569a0ed68e59d8bb0bfde4bc3c87ff384 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Wed, 16 Nov 2022 12:47:43 +0100 Subject: [PATCH 25/31] ensure we have -pie too --- core/base/Dockerfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/core/base/Dockerfile b/core/base/Dockerfile index 57ed1fa1..4639781b 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -19,9 +19,9 @@ RUN set -euxo pipefail \ && apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc ENV LD_PRELOAD=/usr/lib/libhardened_malloc.so -ENV CXXFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security" -ENV CFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security" -ENV CPPFLAGS="-Wdate-time -D_FORTIFY_SOURCE=2" +ENV CXXFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security -pie -fPIE" +ENV CFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security -pie -fPIE" +ENV CPPFLAGS="-Wdate-time -D_FORTIFY_SOURCE=2 -pie -fPIE" ENV LDFLAGS="-Wl,-z,relro" WORKDIR /app From 8afb544a10238e831dea5428b4c2bc9f38de454b Mon Sep 17 00:00:00 2001 From: Dimitri Huisman Date: Wed, 16 Nov 2022 12:12:04 +0000 Subject: [PATCH 26/31] Default FETCHMAIL_ENABLED to False --- core/admin/mailu/configuration.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/admin/mailu/configuration.py b/core/admin/mailu/configuration.py index 060edc8e..e7de2a40 100644 --- a/core/admin/mailu/configuration.py +++ b/core/admin/mailu/configuration.py @@ -16,7 +16,7 @@ DEFAULT_CONFIG = { 'DOMAIN_REGISTRATION': False, 'TEMPLATES_AUTO_RELOAD': True, 'MEMORY_SESSIONS': False, - 'FETCHMAIL_ENABLED': True, + 'FETCHMAIL_ENABLED': False, # Database settings 'DB_FLAVOR': None, 'DB_USER': 'mailu', From b9b0c77d2ed683a1de793e22ff3fb06cf720b344 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Thu, 17 Nov 2022 09:28:26 +0100 Subject: [PATCH 27/31] Revert "simplify": ghostwheel42's approach was right This reverts commit 04f6bd263390265da9357b17b9f77a4fd6a22330. --- core/base/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/base/Dockerfile b/core/base/Dockerfile index 4639781b..1f80a4af 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -15,8 +15,8 @@ RUN set -euxo pipefail \ ; adduser -Sg ${MAILU_UID} -G mailu -h /app -g "mailu app" -s /bin/bash mailu \ ; apk add --no-cache bash ca-certificates curl python3 tzdata \ ; machine="$(uname -m)" \ - ; [[ "${TARGETPLATFORM}" != linux/arm/v7 && \( "${machine}" == x86_64 || "${machine}" == armv8* || "${machine}" == aarch64 \) ]] \ - && apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc + ; ! [[ "${TARGETPLATFORM}" != linux/arm/v7 && \( "${machine}" == x86_64 || "${machine}" == armv8* || "${machine}" == aarch64 \) ]] \ + || apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc ENV LD_PRELOAD=/usr/lib/libhardened_malloc.so ENV CXXFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security -pie -fPIE" From 7745420fe01d8d4ad95acb5154cf05df6c0a7bbf Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Thu, 17 Nov 2022 11:25:33 +0100 Subject: [PATCH 28/31] Fix the ARM build again --- core/base/Dockerfile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/core/base/Dockerfile b/core/base/Dockerfile index 1f80a4af..6f31e21c 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -19,10 +19,10 @@ RUN set -euxo pipefail \ || apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc ENV LD_PRELOAD=/usr/lib/libhardened_malloc.so -ENV CXXFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security -pie -fPIE" -ENV CFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security -pie -fPIE" -ENV CPPFLAGS="-Wdate-time -D_FORTIFY_SOURCE=2 -pie -fPIE" -ENV LDFLAGS="-Wl,-z,relro" +ENV CXXFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security -fstack-clash-protection -fexceptions" +ENV CFLAGS="-g -O2 -fdebug-prefix-map=/app=. -fstack-protector-strong -Wformat -Werror=format-security -fstack-clash-protection -fexceptions" +ENV CPPFLAGS="-Wdate-time -D_FORTIFY_SOURCE=2" +ENV LDFLAGS="-Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,now" WORKDIR /app From f802601a08b6c2e399a4520a76ef8cb028238359 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Sun, 20 Nov 2022 15:00:04 +0100 Subject: [PATCH 29/31] Update f4f0f89e0047_.py --- core/admin/migrations/versions/f4f0f89e0047_.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/admin/migrations/versions/f4f0f89e0047_.py b/core/admin/migrations/versions/f4f0f89e0047_.py index 5843e9d2..8d20063c 100644 --- a/core/admin/migrations/versions/f4f0f89e0047_.py +++ b/core/admin/migrations/versions/f4f0f89e0047_.py @@ -1,4 +1,4 @@ -"""empty message +""" Add fetch.scan and fetch.folders Revision ID: f4f0f89e0047 Revises: 8f9ea78776f4 From db9ed1fd594c419c492553f988cd75d705b2b58d Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Sun, 20 Nov 2022 16:26:27 +0100 Subject: [PATCH 30/31] Disable libhardened-malloc for non x86. @see #2541 Support is going to be a nightmare if RPI4 is not working. --- core/base/Dockerfile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/core/base/Dockerfile b/core/base/Dockerfile index 6f31e21c..25c8bd81 100644 --- a/core/base/Dockerfile +++ b/core/base/Dockerfile @@ -8,14 +8,13 @@ ENV TZ=Etc/UTC LANG=C.UTF-8 ARG MAILU_UID=1000 ARG MAILU_GID=1000 -ARG TARGETPLATFORM RUN set -euxo pipefail \ ; addgroup -Sg ${MAILU_GID} mailu \ ; adduser -Sg ${MAILU_UID} -G mailu -h /app -g "mailu app" -s /bin/bash mailu \ ; apk add --no-cache bash ca-certificates curl python3 tzdata \ ; machine="$(uname -m)" \ - ; ! [[ "${TARGETPLATFORM}" != linux/arm/v7 && \( "${machine}" == x86_64 || "${machine}" == armv8* || "${machine}" == aarch64 \) ]] \ + ; ! [[ "${machine}" == x86_64 ]] \ || apk add --no-cache --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing hardened-malloc ENV LD_PRELOAD=/usr/lib/libhardened_malloc.so From dcf11aea482f97ad1c5a0acf9a0e54c66ed314eb Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Sun, 20 Nov 2022 09:10:39 +0100 Subject: [PATCH 31/31] Don't force a password reset --- core/admin/mailu/ui/views/users.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/core/admin/mailu/ui/views/users.py b/core/admin/mailu/ui/views/users.py index 85a5c2db..b1b42c17 100644 --- a/core/admin/mailu/ui/views/users.py +++ b/core/admin/mailu/ui/views/users.py @@ -64,10 +64,11 @@ def user_edit(user_email): form.quota_bytes.validators = [ wtforms.validators.NumberRange(max=max_quota_bytes)] if form.validate_on_submit(): - if msg := utils.isBadOrPwned(form): - flask.flash(msg, "error") - return flask.render_template('user/edit.html', form=form, user=user, - domain=user.domain, max_quota_bytes=max_quota_bytes) + if form.pw.data: + if msg := utils.isBadOrPwned(form): + flask.flash(msg, "error") + return flask.render_template('user/edit.html', form=form, user=user, + domain=user.domain, max_quota_bytes=max_quota_bytes) form.populate_obj(user) if form.pw.data: user.set_password(form.pw.data)