1
0
mirror of https://github.com/Mailu/Mailu.git synced 2024-12-14 10:53:30 +02:00
Commit Graph

2363 Commits

Author SHA1 Message Date
Florent Daigniere
0917a6817f Set ADMIN=false to ensure that the tests pass 2021-02-08 10:17:43 +01:00
Florent Daigniere
80f939cf1a Revert to the old behaviour when ADMIN=false 2021-02-08 10:16:03 +01:00
Florent Daigniere
b49554bec1 merge artifact 2021-02-07 18:12:00 +01:00
Florent Daigniere
ef637f51b7 derive the SSO keys from a KDF 2021-02-07 17:58:19 +01:00
Florent Daigniere
99c7420f92 towncrier 2021-02-07 17:51:19 +01:00
Florent Daigniere
2cdee8d18e Make roundcube use internal auth 2021-02-07 17:50:30 +01:00
Florent Daigniere
906a051925 Make rainloop use internal auth 2021-02-07 17:50:17 +01:00
bors[bot]
6518ef19af
Merge #1730
1730: Use alpine 3.13 to fix CVE-2020-25275 and CVE-2020-24386 r=mergify[bot] a=micw

## What type of PR?

bug-fix

## What does this PR do?

Upgrade dovecot alpine to 3.13 to fix CVEs in dovecot

### Related issue(s)

- #1720

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: Michael Wyraz <michael@wyraz.de>
2021-01-16 03:08:06 +00:00
Michael Wyraz
2b37be9889 Use alpine 3.13 to fix CVE-2020-25275 and CVE-2020-24386 2021-01-15 10:56:49 +01:00
bors[bot]
b2eded5879
Merge #1693
1693: Bump cryptography from 2.6.1 to 3.2 in /core/admin r=mergify[bot] a=dependabot[bot]

Bumps [cryptography](https://github.com/pyca/cryptography) from 2.6.1 to 3.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst">cryptography's changelog</a>.</em></p>
<blockquote>
<p>3.2 - 2020-10-25</p>
<pre><code>
* **SECURITY ISSUE:** Attempted to make RSA PKCS#1v1.5 decryption more constant
  time, to protect against Bleichenbacher vulnerabilities. Due to limitations
  imposed by our API, we cannot completely mitigate this vulnerability and a
  future release will contain a new API which is designed to be resilient to
  these for contexts where it is required. Credit to **Hubert Kario** for
  reporting the issue. *CVE-2020-25659*
* Support for OpenSSL 1.0.2 has been removed. Users on older version of OpenSSL
  will need to upgrade.
* Added basic support for PKCS7 signing (including SMIME) via
  :class:`~cryptography.hazmat.primitives.serialization.pkcs7.PKCS7SignatureBuilder`.
<p>.. _v3-1-1:</p>
<p>3.1.1 - 2020-09-22
</code></pre></p>
<ul>
<li>Updated Windows, macOS, and <code>manylinux</code> wheels to be compiled with
OpenSSL 1.1.1h.</li>
</ul>
<p>.. _v3-1:</p>
<p>3.1 - 2020-08-26</p>
<pre><code>
* **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
  :term:`U-label` parsing in various X.509 classes. This support was originally
  deprecated in version 2.1 and moved to an extra in 2.5.
* Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by
  the OpenSSL project. The next version of ``cryptography`` will drop support
  for it.
* Deprecated support for Python 3.5. This version sees very little use and will
  be removed in the next release.
* ``backend`` arguments to functions are no longer required and the
  default backend will automatically be selected if no ``backend`` is provided.
* Added initial support for parsing certificates from PKCS7 files with
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
  and
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
  .
* Calling ``update`` or ``update_into`` on
  :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
  longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
  also resolves the same issue in :doc:`/fernet`.
<p>.. _v3-0:</p>
<p>3.0 - 2020-07-20
&lt;/tr&gt;&lt;/table&gt;
</code></pre></p>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="c9e65222c9"><code>c9e6522</code></a> 3.2 release (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5508">#5508</a>)</li>
<li><a href="58494b41d6"><code>58494b4</code></a> Attempt to mitigate Bleichenbacher attacks on RSA decryption (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5507">#5507</a>)</li>
<li><a href="cf9bd6a36b"><code>cf9bd6a</code></a> move blinding to <strong>init</strong> on both RSA public and private (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5506">#5506</a>)</li>
<li><a href="bf4b962f4b"><code>bf4b962</code></a> be more verbose in the 102 deprecation notice (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5505">#5505</a>)</li>
<li><a href="ada53e7ca0"><code>ada53e7</code></a> make the regexes for branches more strict (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5504">#5504</a>)</li>
<li><a href="8be1d4b111"><code>8be1d4b</code></a> Stop using <a href="https://github.com/master">@master</a> for GH actions (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5503">#5503</a>)</li>
<li><a href="08a97cca71"><code>08a97cc</code></a> Bump actions/upload-artifact from v1 to v2.2.0 (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5502">#5502</a>)</li>
<li><a href="52a0e44e97"><code>52a0e44</code></a> Add a dependabot configuration to bump our github actions (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5501">#5501</a>)</li>
<li><a href="611c4a340f"><code>611c4a3</code></a> PKCS7SignatureBuilder now supports new option NoCerts when signing (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5500">#5500</a>)</li>
<li><a href="836a92a28f"><code>836a92a</code></a> chunking didn't actually work (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5499">#5499</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/pyca/cryptography/compare/2.6.1...3.2">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cryptography&package-manager=pip&previous-version=2.6.1&new-version=3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Mailu/Mailu/network/alerts).

</details>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2020-12-16 07:21:17 +00:00
bors[bot]
8a425c92e0
Merge #1696
1696: disable php version expose r=Diman0 a=ronivay

## What type of PR?

enhancement

## What does this PR do?

Disable exposing PHP-version from webmails in x-powered-by header for security reasons.

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [N/A] In case of feature or enhancement: documentation updated accordingly
- [x ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: ronivay <roni@vayrynen.info>
2020-11-26 08:52:29 +00:00
ronivay
96bf16605c fix changelog entry from feature to misc 2020-11-23 09:27:55 +02:00
ronivay
1ef62f5a2f changelog entry for #1696 2020-11-23 09:17:40 +02:00
ronivay
eb0dc7f90a disable php version expose 2020-11-23 08:55:58 +02:00
dependabot[bot]
54ccfdf975
Bump cryptography from 2.6.1 to 3.2 in /core/admin
Bumps [cryptography](https://github.com/pyca/cryptography) from 2.6.1 to 3.2.
- [Release notes](https://github.com/pyca/cryptography/releases)
- [Changelog](https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/2.6.1...3.2)

Signed-off-by: dependabot[bot] <support@github.com>
2020-11-21 11:15:31 +00:00
bors[bot]
900d4f16ae
Merge #1684
1684: add warning about removing front r=mergify[bot] a=lub

## What type of PR?

documentation

## What does this PR do?

### Related issue(s)
- caused confusion e.g. in #1678

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [ ] ~~Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.~~


Co-authored-by: lub <git@lubiland.de>
2020-11-19 14:55:43 +00:00
bors[bot]
dad1964c11
Merge #1680
1680: remove service status "feature" r=ofthesun9 a=ebdavison

Per the issue tracker, this was removed in issue Mailu#463 (Remove the Service Status page)

## What type of PR?

documentation

## What does this PR do?

remove feature for services status which no longer exists; this confused me as I was trying to find it and was not able to.

## Related issue(s)

Remove the Service Status page Mailu#463

## Prerequistes

Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

N/A

Co-authored-by: ebdavison <549431+ebdavison@users.noreply.github.com>
2020-11-18 07:53:44 +00:00
bors[bot]
d9cd5168ab
Merge #1687
1687: Fix letsencrypt access to certbot for the mail-letsencrypt flavour r=ofthesun9 a=ofthesun9

## What type of PR?

bug-fix

## What does this PR do?
This PR changes nginx.conf file to ensure that the flavor mail-letsencrypt is also having the redirection for .well-known/acme-challenge

### Related issue(s)
closes #1686

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: ofthesun9 <olivier@ofthesun.net>
2020-11-18 07:25:50 +00:00
ebdavison
ad97266f77
removing unneeded image
Removing this image as request in PR #1680
2020-11-17 11:41:01 -06:00
ofthesun9
d32e73c5bc Fix letsencrypt access to certbot for the mail-letsencrypt flavour 2020-11-17 10:26:41 +01:00
bors[bot]
3ca81913fc
Merge #1654
1654: Ensure that the rendered file ends with newline in order to make `pos… r=mergify[bot] a=tremlin

## What type of PR?

Bugfix

## What does this PR do?

This fixes #1580 

### Related issue(s)
- closes #1580

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.


Co-authored-by: Thomas Rehn <thomas.rehn@initos.com>
2020-11-15 14:13:06 +00:00
lub
900b28178a add warning about removing front 2020-11-15 14:22:00 +01:00
bors[bot]
d2ff6769cc
Merge #1669 #1672
1669: Fix extract_host_port port separation r=mergify[bot] a=cbachert

Regex quantifier should be lazy to make port separation work.

## What type of PR?
bug-fix

## What does this PR do?
The "extract_host_port" function in admin/mailu/internal/nginx.py and optional/fetchmail/fetchmail.py is not actually separating host and port due to the `(.*)` part of the regex being too generous. Lazy quantifier `(.*?)` allows the other capturing groups to match.

### Related issue(s)
- No issue raised for this

## Prerequistes
- [x] Documentation updated accordingly: N/A, bug-fix
- [x] Add [changelog] entry file: Added towncrier newsfragment with second commit

1672: mark radio buttons in setup utility as required r=mergify[bot] a=lub

## What type of PR?
bug-fix

## What does this PR do?
mark radio buttons in setup utility as required

Otherwise it's possible to submit the form without selecting e.g. any
flavor, which would need additional handling on the server side.

### Related issue(s)

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [ ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: cbachert <cbachert@users.noreply.github.com>
Co-authored-by: lub <git@lubiland.de>
2020-11-15 10:24:09 +00:00
bors[bot]
77c7fe2aa0
Merge #1671
1671: manually merge wrongly named news fragments r=mergify[bot] a=lub

see https://github.com/twisted/towncrier#news-fragments for a list of
default news fragment types

## What type of PR?

documentation

## What does this PR do?
adds the missing news fragemnts to the 1.8 changelog

### Related issue(s)
- #1653

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [ ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: lub <git@lubiland.de>
2020-11-15 09:55:49 +00:00
ebdavison
2cf9fdb220
remove service status "feature"
Per the issue tracker, this was removed in issue #463 (Remove the Service Status page)
2020-11-11 12:10:41 -06:00
lub
708e31660f mark radio buttons in setup utility as required
Otherwise it's possible to submit the form without selecting e.g. any
flavor, which would need additional handling on the server side.
2020-10-27 12:52:07 +01:00
lub
b159275057 manually merge wrongly named news fragments
see https://github.com/twisted/towncrier#news-fragments for a list of
default news fragment types
2020-10-27 12:13:06 +01:00
cbachert
862086ea37 Fix extract_host_port port separation
Add towncrier newsfragment
2020-10-24 21:52:21 +01:00
cbachert
72a9ec5b7c Fix extract_host_port port separation
Regex quantifier should be lazy to make port separation work.
2020-10-24 00:25:53 +01:00
Dario Ernst
966383c762
Merge pull request #1653 from Diman0/1.8
Preparations for 1.8 release.
2020-10-16 21:04:53 +02:00
Dimitri Huisman
26839c9066 Fixed small typo, added clarification for full text search and added japanese local as a new feature. 2020-10-14 15:15:04 +00:00
Dario Ernst
c0cc6bbaec Add DNS SPF upgrade notice; Extend Changelog items 2020-10-12 22:10:58 +02:00
Dario Ernst
2e55329b8b Improve changelog and release texts for 1.8 2020-10-12 21:18:20 +02:00
Dario Ernst
7483ea1d49 Make setup show external DB parameters automaticaly when selecting postgres
Before, the "external postgres" options were not shown, even though
"extrnal" was pre-selected. This fixes the mechanics surrounding the
picker.
2020-10-12 20:30:26 +02:00
Dimitri Huisman
7b27d0dd4e When selecting a non-stable version, add a message this is version is "only for testing".
The stable version is set via the new environment variable stable_version. E.g.
stable_version=1.7
2020-10-05 09:26:50 +00:00
Thomas Rehn
05ab244638 Ensure that the rendered file ends with newline in order to make postconf work correctly 2020-10-04 16:36:37 +02:00
Dimitri Huisman
17cea83301 Completely remove step 5 where you can set the replica count for docker-stack.
Add additional warning to ´experimental' notice in setup for stack.
Add a notice the shipped PostgreSQL is deprecated.
Make the external PostgreSQL database the default option.
Make 1.7 the default version (stable_version': '1.7', in docs\conf.py)
Update mergify.yml with 1.8 version
2020-10-04 13:22:59 +00:00
Dimitri Huisman
78890a97ff Preparations for 1.8 release. 2020-10-01 20:32:05 +02:00
bors[bot]
90984c4d2b
Merge #1645
1645: Update stale.yml r=mergify[bot] a=Diman0

as discussed in chat https://matrix.to/#/!RJFCFtixHgPhzacdhW:tedomum.net/$160120578037UHNkM:huisman.xyz?via=ghostdub.de&via=matrix.org&via=tedomum.net
stalebot should only touch
- user support (issue with no label or issue with label type/question).
- issues we explicitly mark with a response_needed label (whatever the name will be of this label).
To give more time to respond when we mark issue with more info needed, we increase the daysUntilClose to 14


Co-authored-by: Dimitri Huisman <52963853+Diman0@users.noreply.github.com>
2020-09-27 11:57:12 +00:00
Dimitri Huisman
b51d9eb58f
Update stale.yml
as discussed in chat https://matrix.to/#/!RJFCFtixHgPhzacdhW:tedomum.net/$160120578037UHNkM:huisman.xyz?via=ghostdub.de&via=matrix.org&via=tedomum.net
stalebot should only touch
- user support (issue with no label or issue with label type/question).
- issues we explicitly mark with a response_needed label (whatever the name will be of this label).
To give more time to respond when we mark issue with more info needed, we increase the daysUntilClose to 14
2020-09-27 13:30:11 +02:00
bors[bot]
62c54ea57f
Merge #1592
1592: Add documentation for the web administration gui. r=mergify[bot] a=Diman0

## What type of PR?

Documentation

## What does this PR do?

This PR adds the section Web Administration Interface to the documentation site which completely documents all available settings in the web administration interface.

### Related issue(s)
- Closes issue #1590 (please close this issue for me)

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ Done ] In case of feature or enhancement: documentation updated accordingly
- [ Done ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: Dimitri Huisman <diman@huisman.xyz>
Co-authored-by: Dimitri Huisman <52963853+Diman0@users.noreply.github.com>
2020-09-27 08:03:49 +00:00
bors[bot]
5a108fe848
Merge #1643
1643: Exempt status/work in progress label from stalebot r=mergify[bot] a=Nebukadneza

## What type of PR?
enhancement

## What does this PR do?
Exempt status/wip label from stalebot

Co-authored-by: Dario Ernst <dario@kanojo.de>
2020-09-26 09:26:27 +00:00
Dimitri Huisman
86d6caa789
Update docs/webadministration.rst
additional clarification. We only support secure connections.

Co-authored-by: lub <github@lubiland.de>
2020-09-26 10:19:48 +02:00
Dimitri Huisman
a50e6d55c5
Update docs/webadministration.rst
grammar

Co-authored-by: lub <github@lubiland.de>
2020-09-26 10:17:19 +02:00
Dimitri Huisman
5981a34397
Update docs/webadministration.rst
typo/grammar

Co-authored-by: lub <github@lubiland.de>
2020-09-26 10:14:26 +02:00
Dimitri Huisman
4a3b16d3bc
Update docs/webadministration.rst
typo/grammar

Co-authored-by: lub <github@lubiland.de>
2020-09-26 10:14:15 +02:00
Dimitri Huisman
04436dd047
Update docs/webadministration.rst
additional clarification

Co-authored-by: lub <github@lubiland.de>
2020-09-26 10:12:29 +02:00
Dimitri Huisman
037a7a40e7
Update docs/webadministration.rst
additional clarification

Co-authored-by: lub <github@lubiland.de>
2020-09-26 10:11:12 +02:00
Dimitri Huisman
465540229a
Update docs/webadministration.rst
Co-authored-by: lub <github@lubiland.de>
2020-09-26 10:09:56 +02:00
Dario Ernst
fd5e604cf1 Exempt status/wip label from stalebot 2020-09-26 09:40:36 +02:00