Merge #2844

2844: Ensure we log which account is invalid r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

Ensure we log which account is invalid

### Related issue(s)


## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>

core/admin/mailu/internal/nginx.py

@@ -28,9 +28,9 @@ STATUSES = {
 
 WEBMAIL_PORTS = ['14190', '10143', '10025']
 
-def check_credentials(user, password, ip, protocol=None, auth_port=None, source_port=None):
+def check_credentials(user, password, ip, protocol=None, auth_port=None, source_port=None, raw_user=None):
     if not user or not user.enabled or (protocol == "imap" and not user.enable_imap and not auth_port in WEBMAIL_PORTS) or (protocol == "pop3" and not user.enable_pop):
-        app.logger.info(f'Login attempt for: {user}/{protocol}/{auth_port} from: {ip}/{source_port}: failed: account disabled')
+        app.logger.info(f'Login attempt for: {user or raw_user!r}/{protocol}/{auth_port} from: {ip}/{source_port}: failed: account disabled')
         return False
     # webmails
     if auth_port in WEBMAIL_PORTS and password.startswith('token-'):
@@ -104,7 +104,7 @@ def handle_authentication(headers):
             else:
                 is_valid_user = user is not None
                 ip = urllib.parse.unquote(headers["Client-Ip"])
-                if check_credentials(user, password, ip, protocol, headers["Auth-Port"], headers['Client-Port']):
+                if check_credentials(user, password, ip, protocol, headers["Auth-Port"], headers['Client-Port'], user_email):
                     server, port = get_server(headers["Auth-Protocol"], True)
                     return {
                         "Auth-Status": "OK",

core/admin/mailu/internal/views/auth.py

@@ -116,7 +116,7 @@ def basic_authentication():
             exc = str(exc).split('\n', 1)[0]
             app.logger.warn(f'Invalid user {user_email!r}: {exc}')
         else:
-            if user is not None and nginx.check_credentials(user, password.decode('utf-8'), client_ip, "web", flask.request.headers.get('X-Real-Port', None)):
+            if user is not None and nginx.check_credentials(user, password.decode('utf-8'), client_ip, "web", flask.request.headers.get('X-Real-Port', None), user_email):
                 response = flask.Response()
                 response.headers["X-User"] = models.IdnaEmail.process_bind_param(flask_login, user.email, "")
                 utils.limiter.exempt_ip_from_ratelimits(client_ip)

core/admin/mailu/internal/views/postfix.py

@@ -125,6 +125,8 @@ def postfix_sender_map(sender):
 
     This is for bounces to come back the reverse path properly.
     """
+    if sender.count('@') > 1 or sender.startswith('"'):
+        return flask.abort(404)
     srs = srslib.SRS(flask.current_app.srs_key)
     domain = flask.current_app.config["DOMAIN"]
     try:

towncrier/newsfragments/2841.misc

@@ -0,0 +1 @@
+Ensure we log which account was not found/invalid