Commit Graph

1117 Commits (2cf4e61fd2179e5f872886a963d3925bef1534b8)

Author SHA1 Message Date
Dimitri Huisman 61d092922c
Process review comments (PR2464)
Dimitri Huisman afb224e796
Update password hash description for user API endpoint
Dimitri Huisman d4e5db5084
Remove unneeded comment
Dimitri Huisman 7a36f6bbb9
Use hmac.compare_digest to prevent timing attacks.
Dimitri Huisman 5c9cdfe1de
Introduction of the Mailu RESTful API.
Anything that can be configured in the web administration interface,
can also be configured via the Mailu RESTful API.
See the section Advanced configuration in the configuration reference
for the relevant settings in mailu.env for enabling the API.
(API, WEB_API, API_TOKEN).
Alexander Graf 866ad89dfc
first try at api using flask-restx & marshmallow
Alexander Graf c30944404d
Add "API" flag to config (default: disabled)
Florent Daigniere 108958cabb drop privs better
bors[bot] 8461a11ff4
Merge
2588: IMAP folder names may contain characters outside of \w: [a-zA-Z0-9] r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

IMAP folder names may contain characters outside of \w: [a-zA-Z0-9]. Typically it may be subfolders...

I have also simplified the regexp since we strip spaces the line below.

This is used for "external accounts"/fetchmail.

### Related issue(s)

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [ ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Johnson Thiang bd20ef04cc change field type to db.text
Alexander Graf c38e6aae4e
Add button to mailu-admin in roundcube task menu
bors[bot] 251db0b1af
Merge
2562: Dynamic address resolution everywhere r=mergify[bot] a=nextgens

## What type of PR?

enhancement

## What does this PR do?

Use dynamic address resolution everywhere.
Derive a new key for admin/SECRET_KEY
Cleanup the environment

This should allow restarting containers.

### Related issue(s)
- closes 
- closes 
- closes 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Florent Daigniere c634b9ac04 IMAP folder names may contain characters outside of \w: [a-zA-Z0-9]
fastlorenzo 135207db3e
fix missing casting to int for SESSION_KEY_BITS
Signed-off-by: fastlorenzo <git@bernardi.be>
Florent Daigniere b630355d03 Autofocus the login form on /sso/login
Florent Daigniere 4e3874b0c1 Enable dynamic resolution of hostnames
bors[bot] 8c3da2815d
Merge
2565: Fix DB downgrade r=mergify[bot] a=nextgens

Fix DB downgrade. This isn't used in normal operations but is wrong nevertheless.

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
bors[bot] cd5e6c896f
Merge
2568: Fix a bug preventing users without IMAP access to access the webmails r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

Fix a bug preventing users without IMAP access to access the webmails

### Related issue(s)
- close 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Florent Daigniere c565e69a01
as requested
Florent Daigniere b553d025eb
remove newline
Florent Daigniere 00f07ef533 close : prevent an auth-loop on webmails
Florent Daigniere 3e38e7b89d Remove the dependency on pyOpenSSL
Florent Daigniere 98f16b1d47 Fix DB downgrade
Florent Daigniere c1062f3db2 set the umask
bors[bot] 033889dc95
Merge
2542: Implement header authentication via external proxy r=mergify[bot] a=nextgens

## What type of PR?

Feature

## What does this PR do?

Implement header authentication via external proxy

### Related issue(s)
- closes 
- closes 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


2559: Turns out that php81-ctype is required by roundcube r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

It solves:
```
[25-Nov-2022 08:19:20] WARNING: [pool php] child 335 said into stderr: "NOTICE: PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function Masterminds\HTML5\Parser\ctype_alpha() in /var/www/roundcube/vendor/masterminds/html5/src/HTML5/Parser/Tokenizer.php:140"
[25-Nov-2022 08:19:20] WARNING: [pool php] child 335 said into stderr: "Stack trace:"
[25-Nov-2022 08:19:20] WARNING: [pool php] child 335 said into stderr: "#0 /var/www/roundcube/vendor/masterminds/html5/src/HTML5/Parser/Tokenizer.php(82): Masterminds\HTML5\Parser\Tokenizer->consumeData()"
[25-Nov-2022 08:19:20] WARNING: [pool php] child 335 said into stderr: "#1 /var/www/roundcube/vendor/masterminds/html5/src/HTML5.php(161): Masterminds\HTML5\Parser\Tokenizer->parse()"
[25-Nov-2022 08:19:20] WARNING: [pool php] child 335 said into stderr: "#2 /var/www/roundcube/vendor/masterminds/html5/src/HTML5.php(89): Masterminds\HTML5->parse('<html>\n    <hea...', Array)"
[25-Nov-2022 08:19:20] WARNING: [pool php] child 335 said into stderr: "#3 /var/www/roundcube/program/lib/Roundcube/rcube_washtml.php(700): Masterminds\HTML5->loadHTML('<html>\n    <hea...')"
[25-Nov-2022 08:19:20] WARNING: [pool php] child 335 said into stderr: "#4 /var/www/roundcube/program/actions/mail/index.php(975): rcube_washtml->wash('<html>\n    <hea...')"
[25-Nov-2022 08:19:20] WARNING: [pool php] child 335 said into stderr: "#5 /var/www/roundcube/program/actions/mail/index.php(1019): rcmail_action_mail_index::wash_html('<!doctype html>...', Array, Array)"
[25-Nov-2022 08:19:20] WARNING: [pool php] child 335 said into stderr: "#6 /var/www/roundcube/program/actions/mail/show.php(720): rcmail_action_mail_index::pr..."
```

see https://github.com/roundcube/roundcubemail/issues/7049


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
bors[bot] e0d42cadc0
Merge
2546: Implement a GUI for WILDCARD_SENDERS r=mergify[bot] a=nextgens

## What type of PR?

Feature

## What does this PR do?

- Implement a GUI for WILDCARD_SENDERS

### Related issue(s)
- closes 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Co-authored-by: Florent Daigniere <nextgens@users.noreply.github.com>
Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
Alexander Graf b0990460a4
Fix error display
Alexander Graf 53720876b4
Colorize feature badges
Alexander Graf a5eeab37e1
Add default for column allow_spoofing
Florent Daigniere 3721a6aa02 Merge branch 'master' of https://github.com/Mailu/Mailu into HEAD
bors[bot] 2104c04e3b
Merge
2544: Fix : Make quotas adjustable in 50MiB increments r=mergify[bot] a=nextgens

## What type of PR?

enhancement

## What does this PR do?

Make quotas adjustable in 50MiB increments

### Related issue(s)
- closes 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Florent Daigniere 19bd9362d3 As suggested by ghost
Florent Daigniere 12117cef37 Reduce the scope of the try: except
Florent Daigniere 546884d10c ghost's requested changes
Florent Daigniere c1144612be
fix sorting
Florent Daigniere 4d8bd210c5
Update run_dev.sh
Florent Daigniere ee512112fb
fix flask db history
bors[bot] 9c6e9b05db
Merge
2543: Fix : make public announcements work r=nextgens a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

Ensure public announcements bypass filters.

They can still time-out... but this is already a big improvement that we should be able to backport.

### Related issue(s)
- closes 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Florent Daigniere f994c8687e doh
Florent Daigniere 44c47586ea Fix potential permission problems
Florent Daigniere d3d7916b58 Merge remote-tracking branch 'upstream/master' into upgrade-alpine
Florent Daigniere 45b01db9de Fix the language switcher
Florent Daigniere 3fc0a0e7fa Merge branch 'master' of https://github.com/Mailu/Mailu into fetchmail-improvements
Florent Daigniere 4da2db1b0b add comment as requested
Florent Daigniere c79e8d3852 Fix display bug
bors[bot] 553b02fb3d
Merge
2529: Improve fetchmail r=mergify[bot] a=nextgens

## What type of PR?

enhancement

## What does this PR do?

Improve fetchmail:
- allow delivery via LMTP (faster, bypassing the filters)
- allow several folders to be retrieved
- run fetchmail as non-root
- tweak the compose file to ensure we have all the dependencies

### Related issue(s)
- closes  
- closes  
- closes 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Co-authored-by: Florent Daigniere <nextgens@users.noreply.github.com>
Florent Daigniere dcf11aea48 Don't force a password reset
Florent Daigniere f802601a08
Update f4f0f89e0047_.py
Florent Daigniere d5ac9199a0
Update 7ac252f2bbbf_.py
Florent Daigniere 7822b41048 same for domains
Florent Daigniere ef9cc3c866 Show spoofing on /admin/user/list too
Florent Daigniere 38507b2e1b Close : Implement a GUI for WILDCARD_SENDERS
Florent Daigniere 6a22c82c02 Fix run_dev
Florent Daigniere cf7404e26c Fix : Make quotas adjustable in 50MiB increments
Florent Daigniere b20bf996ec Fix : make public announcements work
Florent Daigniere e2d4e3eb2e Implement header authentication via external proxy
Florent Daigniere bdc085048d Restore the Dockerfile like it was
Florent Daigniere 699be6f9fa Drop privs when running admin too
bors[bot] f43c8c652e
Merge
2483: Introduce FETCHMAIL_ENABLED r=mergify[bot] a=DjVinnii

## What type of PR?

Enhancement

## What does this PR do?
Add `FETCHMAIL_ENABLED` to enable/disable the Fetchmail functionality in the Admin UI.

### Related issue(s)
- closes 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


2535: fix the linux/arm/v7 build r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

The arm builder is running aarch64 ... and there is no package for arm/v7


Co-authored-by: Vincent Kling <v.kling@vinniict.nl>
Co-authored-by: Dimitri Huisman <diman@huisman.xyz>
Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Dimitri Huisman 8afb544a10
Default FETCHMAIL_ENABLED to False
bors[bot] 40bdf7a6d9
Merge
2530: disable SESSION_COOKIE_SECURE when TLS_FLAVOR=notls r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

People are unlikely to proxy everything

### Related issue(s)
- closes 

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Florent Daigniere b9e5560fb6 Better way to express the same thing
Thanks @ghostwheel42
Florent Daigniere 66de1dcec8 Change the logic
The idea here is that if you have set SESSION_COOKIE_SECURE we should
honor that... and if you haven't we should try to do the right thing.
Florent Daigniere 76f8517e00 This is still required (as TLS_FLAVOR isn't set)
Florent Daigniere b9564c0bc9 This shouldn't have been commited
Florent Daigniere 19af2944d7 Refactor as requested
Alexander Graf 6b470ac403
Allow proper JS debugging, speed-up assets dev-build, disable redirect-debug by default.
Florent Daigniere 7aad1158fb @ghostwheel42 will fix it in another PR
Florent Daigniere a566cb07d6 fix
Florent Daigniere 08b3a2814b Merge branch 'master' of https://github.com/Mailu/Mailu into notls
Florent Daigniere 6474108056 Use a join() instead
Florent Daigniere c0c91691fd Fix the issue on /admin/fetch/edit
Alexander Graf b0b64a8e63
Use FLASK_DEBUG, fix assets, show startup errors.
Florent Daigniere 505bb79a78 Don't set the secure Cookie flag if TLS_FLAVOR=notls
Florent Daigniere 08a9ab9a56 Improve fetchmail
bors[bot] 8a90f83bd0
Merge
2514: Update deps r=mergify[bot] a=ghostwheel42

## What type of PR?

update python dependencies

## What does this PR do?

Update python deps in base image


Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
bors[bot] 745c211c4a
Merge
2523: fix JS error r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

It fixes a bug whereby one may have to click twice on the submit button depending on timing.

e.trigger() will error out on most browsers.

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
bors[bot] 0839490beb
Merge
2479: Rework the anti-spoofing rule r=mergify[bot] a=nextgens

## What type of PR?

Feature

## What does this PR do?

We shouldn't assume that Mailu is the only MTA allowed to send emails on behalf of the domains it hosts.
We should also ensure that it's non-trivial for email-spoofing of hosted domains to happen

Previously we were preventing any spoofing of the envelope from; Now we are preventing spoofing of both the envelope from and the header from unless some form of authentication passes (is a RELAYHOST, SPF, DKIM, ARC)

### Related issue(s)
- close 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Florent Daigniere c91c9df134 fix error
Alexander Graf e0d2432c6b
Rename data-ordered to data-sort
Alexander Graf 2a4402cdc2
Fix datatable for list fo sign-up domains
Alexander Graf af6cf5fd1d
Fix language selector without session
Alexander Graf 2778641e78
Fix screen reader title of language selector
Alexander Graf 4776094ea7
Configure datatables on missing tables, add sign in button to sso page.
Alexander Graf 6218b36372
configure datatables via html5 data attributes
Alexander Graf a74396a9ef
Fix wtforms usage
Alexander Graf 4b179d9008
Merge branch 'master' into hibp
Alexander Graf 36019a8ce9
Don't show Dockerfile before building
Alexander Graf 91e12d510d
Use default password used everywhere else
Alexander Graf defd533319
Don't duplicate hidden fields
Alexander Graf db87a0f3a1
Move temporary db into container and show docker run command
Alexander Graf f7caaddbec
Speed up asset building when developing
Alexander Graf 71263f1a8c
Add more env variables and restyle code
Alexander Graf fd8570ec34
Remove unused QUOTA_STORAGE_URL
Alexander Graf bbeb211d72
Listen to localhost by default
Alexander Graf 1d90dc3ea3
Allow running without redis
Alexander Graf c507b765be
Improve dev runner
Alexander Graf 8732b70b30
Add shell script to run admin dev environment
Alexander Graf ea636a1835
Fix hibp test
Alexander Graf 311f41c331
Add missing hidden fields