3869 Commits (d0631558c741f6949087a197a9b4a57e5b20547c)
 

Author SHA1 Message Date
bors[bot] a5b1d36171
Merge #2017
2017: rspamd: get dkim keys via REST API instead of filesystem r=mergify[bot] a=ghostwheel42

## What type of PR?

enhancement

## What does this PR do?

rspamd now uses hashicorp's vault api v1 to get dkim keys and selectors for a domain.
this allows future enhancement (multiple keys) without reconfiguring and restarting rspamd.
it also makes mounting the /dkim volume into the rspamd container unnecessary.

### Related issue(s)

- improves and closes #2012 
- allows to implement key rotation using multiple selectors (see #1700)
- allows to implement dkim for alternate domains (see #1519)
- fixes and closes #1345 (selector transmitted by admin container is used)
- closes #1179 (no keys on disk)
- allows to implement key rotation from the outside (ie. via a helper script talking to some dns provider's api) (see #547)

## Prerequisites

- [X] In case of feature or enhancement: documentation updated accordingly
- [X] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
3 years ago
Alexander Graf 135c5119c5 added newsfragment 3 years ago
Alexander Graf 7b0c5935a8 only support GET method in vault 3 years ago
Alexander Graf 303fae00fb cleanup modules. use dkim selector from config 3 years ago
Alexander Graf dc9f970a91 removed zh_CN and updated locale-map for datatables 3 years ago
Alexander Graf 893705169e PoC rspamd use dkimkeys from admin using vault api 3 years ago
bors[bot] a9ec601e3e
Merge #2015
2015: Prevent logins with no password r=mergify[bot] a=nextgens

## What type of PR?

enhancement

## What does this PR do?

Prevent logins with no password; These may occur with imported hashes.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
3 years ago
Florent Daigniere 632ce663ee Prevent logins with no password 3 years ago
qy117121 866f784d06
Create messages.po
Update the translation
3 years ago
qy117121 251eea5553
Update messages.po
Updated translation
3 years ago
Florent Daigniere 7277e0b4e4
Merge branch 'master' into ratelimits 3 years ago
bors[bot] 8c8c1b2015
Merge #1997
1997: Prevent traceback when using non-email in login r=mergify[bot] a=ghostwheel42

There's a traceback when the username used to log via SMTPAUTH
in is not an email address:

=== before ===
```
[...] ERROR in app: Exception on /internal/auth/email [GET]
Traceback (most recent call last):
  File "/usr/lib/python3.9/site-packages/sqlalchemy/engine/base.py", line 1179, in _execute_context
    context = constructor(dialect, self, conn, *args)
  File "/usr/lib/python3.9/site-packages/sqlalchemy/engine/default.py", line 719, in _init_compiled
    param.append(processors[key](compiled_params[key]))
  File "/usr/lib/python3.9/site-packages/sqlalchemy/sql/type_api.py", line 1201, in process
    return process_param(value, dialect)
  File "/app/mailu/models.py", line 60, in process_bind_param
    localpart, domain_name = value.lower().rsplit('`@',` 1)
ValueError: not enough values to unpack (expected 2, got 1)
[...]
[parameters: [{'%(140657157923216 param)s': 'foobar'}]]
```

=== after ===
```
[...] WARNING in nginx: Invalid user 'foobar': (builtins.ValueError) invalid email address (no "`@")`
```

## What type of PR?

enhancement

## What does this PR do?

replace traceback (ERROR) with error message (WARNING)

### Related issue(s)

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [ ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
3 years ago
bors[bot] 9b01e663b2
Merge #2007
2007: allow sending emails as user+detail@domain.tld r=mergify[bot] a=ghostwheel42

## What type of PR?

bug-fix or enhancement

## What does this PR do?

Allows sending emails with an added "+detail" in the local part.
 
### Related issue(s)

closes #1948

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [X] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
Co-authored-by: root <ghostwheel42@users.noreply.github.com>
Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
3 years ago
Florent Daigniere e127e6b32f clarify the documentation 3 years ago
Florent Daigniere 14360f8926 RECIPIENT_DELIMITER can have several characters 3 years ago
root 8c59f35697 use RECIPIENT_DELIMITER for splitting 3 years ago
Alexander Graf 6a8066c0ae renamed newsfragment 3 years ago
Alexander Graf 22ed2b7f90 add newsfragment 3 years ago
Alexander Graf 1d571dedfc split localpart into user and tag 3 years ago
bors[bot] c22d853c1a
Merge #2005
2005: SESSION_COOKIE_SECURE and HTTP won't work; make it explicit by displaying an alert r=mergify[bot] a=nextgens

## What type of PR?

enhancement

## What does this PR do?

Display an explicit alert and disable the login form (using javascript) when we have SESSION_COOKIE_SECURE=True and clients using HTTP to access it.

### Related issue(s)
- close #1996

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
3 years ago
Florent Daigniere d131d863ba The if needs to be inside the block 3 years ago
bors[bot] 61bd1da247
Merge #1992
1992: Improve unbound configuration r=mergify[bot] a=nextgens

## What type of PR?

enhancement

## What does this PR do?

Improve the unbound configuration:
- remove settings that were default
- don't setup IPv6 if it's not configured
- enable qname minimization (for privacy)
- add a minimum TTL of 5m (prevent excessive resource usage and naive rebinding attacks)

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
3 years ago
Alexander Graf aaf3ddd002 moved javascript to app.js 3 years ago
Florent Daigniere b48779ea70 SESSION_COOKIE_SECURE and HTTP won't work 3 years ago
bors[bot] 7678365ab3
Merge #2002
2002: Misc improvements to the postfix configuration r=mergify[bot] a=nextgens

## What type of PR?

enhancement

## What does this PR do?

- It removes a useless "Received" header
- It changes the SRS key from SECRET_KEY to a subkey (this will affect "in flight" bounces)

### Related issue(s)
- #466

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
3 years ago
Florent Daigniere 502affbe66 Use the regexp engine since we have one 3 years ago
Florent Daigniere a349190e52 simplify 3 years ago
Florent Daigniere 4a78d646db doh 3 years ago
Florent Daigniere 65ee1c1ef2 doh 3 years ago
Florent Daigniere 10d78a888b Derive a new subkey for SRS 3 years ago
Florent Daigniere 995ce8d437 Remove OUTCLEAN_ADDRESS
I believe that this isn't relevant anymore as we don't use OpenDKIM
anymore

Background on:
https://bofhskull.wordpress.com/2014/03/25/postfix-opendkim-and-missing-from-header/
3 years ago
bors[bot] 3f8aa4adfa
Merge #1998
1998: Fix healthcheck r=mergify[bot] a=ghostwheel42

## What type of PR?

bug-fix

## What does this PR do?

- fixes health check of roundcube container (introduced with sso / endless redirect)
- silence logging of health checks
- write php error log directly to /dev/stderr

### Related issue(s)

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [ ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
3 years ago
Alexander Graf ef9e1ac279 remove health check from log 3 years ago
Alexander Graf 7380b248cf direct logging of php errors to stderr 3 years ago
Alexander Graf cd17aa0c43 repair failing health-check 3 years ago
Alexander Graf 65133a960a Prevent traceback when using non-email in login
There's a traceback when the username used to log via SMTPAUTH
in is not an email address:

=== before ===
```
[...] ERROR in app: Exception on /internal/auth/email [GET]
Traceback (most recent call last):
  File "/usr/lib/python3.9/site-packages/sqlalchemy/engine/base.py", line 1179, in _execute_context
    context = constructor(dialect, self, conn, *args)
  File "/usr/lib/python3.9/site-packages/sqlalchemy/engine/default.py", line 719, in _init_compiled
    param.append(processors[key](compiled_params[key]))
  File "/usr/lib/python3.9/site-packages/sqlalchemy/sql/type_api.py", line 1201, in process
    return process_param(value, dialect)
  File "/app/mailu/models.py", line 60, in process_bind_param
    localpart, domain_name = value.lower().rsplit('@', 1)
ValueError: not enough values to unpack (expected 2, got 1)
[...]
[parameters: [{'%(140657157923216 param)s': 'foobar'}]]
```

=== after ===
```
[...] WARNING in nginx: Invalid user 'foobar': (builtins.ValueError) invalid email address (no "@")
```
3 years ago
Florent Daigniere 1cf0f76b52 not required anymore 3 years ago
Florent Daigniere 739702a034 doc 3 years ago
Florent Daigniere e9f84d7d99 Improve the unbound configuration 3 years ago
bors[bot] 5236196288
Merge #1991
1991: re-enable mod_rewrite in roundcube r=mergify[bot] a=ghostwheel42

## What type of PR?

bug-fix

## What does this PR do?

re-enabled mod_rewrite to make use of safeguards in .htaccess
fixed permissions of /var/www/html to make sso.php symlink work with htaccess safeguards enabled
moved chown/mkdir/symlink from start.py to Dockerfile

### Related issue(s)

undo of #1990

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [X] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
3 years ago
Alexander Graf 16691e83ad re-enable mod_rewrite in roundcube
moved chown/mkdir/symlink from start.py to Dockerfile
3 years ago
Diman0 c1beee8fd7 Added newsfragment 3 years ago
Diman0 41f5b43b38 Set nginx logging to level info again. 3 years ago
Diman0 f4cde61148 Make header translatable. More finishing touches. 3 years ago
Florent Daigniere 7d56ed3b70 Merge branch 'master' of https://github.com/Mailu/Mailu into ratelimits 3 years ago
Florent Daigniere 464a117e9f this should be changed too 3 years ago
Florent Daigniere 862fdda55b Tweak the wording 3 years ago
Diman0 fbe0a446b9 Merge branch 'master' of github.com:Mailu/Mailu into fix-sso-1929 3 years ago
Diman0 ac496eed19 Update setup with new rate limit config vars. 3 years ago
bors[bot] 71c5ca9fea
Merge #1990
1990: Fix roundcube sso login r=mergify[bot] a=Diman0

## What type of PR?

bug-fix

## What does this PR do?

It fixes SSO login for roundcube. PR #1966 added additional apache modules in the roundcube dockerfile. The additional rewrite module breaks the sso login. This PR removes the unused apache rewrite module.

### Related issue(s)
#1966 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Diman0 <diman@huisman.xyz>
3 years ago