265 Commits (9175b15d4902e6846b5e4656547bd902232eaad0)

Author SHA1 Message Date
mergify[bot] 9175b15d49
Merge pull request #826 from Nebukadneza/reverse_user_alias_pref
Reverse the resolution order of user and alias
6 years ago
mergify[bot] 278bcfb13a
Merge pull request #814 from Nebukadneza/fix_delimiter_alias
Deliver mails to alias-stripped-of-delimeter, even if catchall exists
6 years ago
Dario Ernst 276dc3ffda Reverse the resolution order of user and alias
Since it’s common for wildcard~ish systems to prefer concrete objects over
wildcards, and aliases can be broad-wildcards (think catchall, %@xxx.tld), it
may be more intuitive for users that user-names rank higher than aliases. This
makes it impossible for user-names to be unreachable, since they can be
completely overridden by a catchall otherwise.

This changes default behavior, and is not configurable.

closes #815
6 years ago
Tim Möhlmann 8541ae2c46
Fix migration order after merge 6 years ago
mergify[bot] 99cd1d714b
Merge pull request #799 from hoellen/fix-domain-negative-values-1
don't allow negative values on domain creation/edit
6 years ago
Tim Möhlmann 2567646f47
Merge branch 'master' into fix-domain-negative-values-1 6 years ago
Ionut Filip 50343f354e Merge remote-tracking branch 'upstream/master' into feat-psql-support 6 years ago
Dario Ernst b8d1beed29 Simplify alias-wildcard detection to not consider actual % anymore 6 years ago
Dario Ernst 10d2601963 Unsimplify alias precedence handling
As discussed with hoellen on matrix, since postfix indeed supports including
the recipient delimiter character in a verbatim alias, we should support so too
— and handle its precedence correctly. The clearer and simpler formulation of
the precedence-clauses are credit to @hoellen. Thanks!
6 years ago
mergify[bot] 161394a774
Merge pull request #817 from hoellen/fix-fetch-passwordfield-1
fix edit of fetched acc without changing password
6 years ago
Dario Ernst ac64a75743 Simplify alias precedence handling; Remove bogus changelog 6 years ago
hoellen 7247b4b10c
Merge branch 'master' into fix-password-on-user-edit 6 years ago
hoellen a59d5dad23 fix edit of fetched acc without changing password 6 years ago
hoellen f08491dc46 fix forced password on user edit 6 years ago
Ionut Filip 2b0a2d561b Fix connection to mysql db 6 years ago
Dario Ernst 291f8a457b Deliver mails to alias-stripped-of-delimeter, even if catchall exists
This fixes delivery to an alias minus recipient delimiter in cases where a
wildcard alias would also match. For example,
* foo@xxx.tld
* %@xxx.tld
Sending to foo+spam@xxx.tld would get eaten by the catchall before this fix.
Now, the order of alias resolution is made clearer.

closes #813
6 years ago
hoellen 732b5fe161 change password field type in fetch creation/edit and add validators. 6 years ago
mergify[bot] 3b5f3af207
Merge pull request #778 from Nebukadneza/fix_recipient_delimiter
Attempt stripping recipient delimiter from localpart
6 years ago
Ionut Filip 9077bf7313 Merge remote-tracking branch 'upstream/master' into feat-psql-support 6 years ago
Ionut Filip 953aa04354 Added postgresql-libs to admin 6 years ago
Tim Möhlmann 561e2fda67
Merge remote-tracking branch 'upstream/master' into fix-favicon 6 years ago
hoellen 501ecf13c1 add migration script 6 years ago
Tim Möhlmann a358b5305f
Merge pull request #797 from Mailu/upgrade-pyyaml
Upgrade PyYAML
6 years ago
Tim Möhlmann 4f93e09028
Implement favicon package
Credit to:
- https://stackoverflow.com/a/19590415/1816774
- https://realfavicongenerator.net/
6 years ago
Tim Möhlmann 284d54190a
Upgrade PyYAML to 4.2b4 6 years ago
hoellen dda64fe91e allow to disable aliases or users for domains and don't allow negativ values on domain creation/edit 6 years ago
hoellen 8fe1e788b3 add missing route fixes 6 years ago
Tim Möhlmann 3c7bf58211
Upgrade PyYAML
CVE-2017-18342
Vulnerable versions: < 4.2b1
Patched version: 4.2b1
In PyYAML before 4.1, the yaml.load() API could execute arbitrary code. In other words, yaml.safe_load is not used.
6 years ago
hoellen d5d4d6c337 harden email address validation and fix routes with user_email 6 years ago
Ionut Filip 01ec6e7bf3 Removed undefined function 6 years ago
mergify[bot] d483ef3c2a
Merge pull request #792 from hoellen/admin-broken-links-1
fix broken webmail and logo url in admin
6 years ago
Tim Möhlmann 74fe177297
Merge pull request #785 from TheLegend875/feat-displayed-name
Feature: send auto reply with displayed name
6 years ago
hoellen f617e82c06 fix broken webmail and logo url in admin 6 years ago
Tim Möhlmann 4068c5b751
Versioning for mysqlclient and psycopg2 6 years ago
Tim Möhlmann b2823c23b8
Merge remote-tracking branch 'upstream/master' into feat-psql-support 6 years ago
Tim Möhlmann 9eaeb80a27
Finalize merge with kaiyou/feat-multiple-db 6 years ago
TheLegend875 999d2a9557 changed default.sieve to send displayed name 6 years ago
TheLegend875 2954d84790 added necessary ui elements 6 years ago
TheLegend875 56f4d4c894 fixed auto-forward 6 years ago
TheLegend875 5bdbbf60d7 fixed display of username when not logged in 6 years ago
Dario Ernst c2d45a47fe Attempt stripping recipient delimiter from localpart
Since postfix now asks us for the complete email over podop, which
includes the recipient-delimiter-and-what-follows not stripped, we need
to attempt to find both the verbatim localpart, as well as the localpart
stripped of the delimited part ….

Fixes #755
6 years ago
Tim Möhlmann 19df86f13f
Merge pull request #764 from usrpro/fix-alias-bug
Added regex validation for alias username
6 years ago
Tim Möhlmann af086bbdbe
Include DKIM in VOLUME 6 years ago
Ionut Filip 8fc2846924 Added regex validation for alias username 6 years ago
Tim Möhlmann 3c4ee1b31e
Merge pull request #743 from kaiyou/master
Fixes #738 regarding application context
6 years ago
ofthesun9 97b3a85090
Merge pull request #737 from hoellen/fix-alias-match-behaviour
fix alias match behaviour
6 years ago
mergify-bot 09a50b6cfc Merge branch 'master' into 'master' 6 years ago
kaiyou 4060ac2223 Remove some forgotten debugging 6 years ago
kaiyou 087841d5b7 Fix the way we handle the application context
The init script was pushing an application context, which maked
flask.g global and persisted across requests. This was evaluated
to have a minimal security impact.

This explains/fixes #738: flask_wtf caches the csrf token in the
application context to have a single token per request, and only
sets the session attribute after the first generation.
6 years ago
kaiyou b5f51b0e2e Update python dependencies 6 years ago