1
0
mirror of https://github.com/Mailu/Mailu.git synced 2024-12-12 10:45:38 +02:00
Commit Graph

394 Commits

Author SHA1 Message Date
bors[bot]
25e8910b89
Merge #1783
1783: Switch to server-side sessions r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

It simplifies session management.
- it ensures that sessions will eventually expire (*)
- it implements some mitigation against session-fixation attacks
- it switches from client-side to server-side sessions (in Redis)

It doesn't prevent us from (re)-implementing a "remember_me" type of feature if that's considered useful by some.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
2021-03-10 09:44:31 +00:00
lub
f3f0a4d86d
Merge branch 'master' into enforce-tls-admin 2021-03-09 23:40:51 +01:00
Florent Daigniere
b9becd8649 make sessions expire 2021-03-09 14:21:02 +01:00
Florent Daigniere
20d2b621aa Improve the description of CREDENTIAL_ROUNDS 2021-03-09 12:05:46 +01:00
Florent Daigniere
7137ba6ff1 Misc improvements to PASSWORD_SCHEME
- remove PASSWORD_SCHEME altogether
- introduce CREDENTIAL_ROUNDS
- migrate all old hashes to the current format
- auto-detect/enable all hash types that passlib supports
- upgrade passlib to 1.7.4 (see #1706: ldap_salted_sha512 support)
2021-03-09 12:04:42 +01:00
bors[bot]
464e46b02b
Merge #1765
1765: Set sensible cookie flags on the admin app r=mergify[bot] a=nextgens

## What type of PR?

Bugfix

## What does this PR do?

It sets the right flags on the session cookie issued by the admin app.
This should probably be backported as the lack of secure flag on TLS-enabled setup is a high risk vulnerability.

SameSite is hardening / helps against CSRF on modern browsers
HTTPOnly is hardening / helps reduce the impact of XSS

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
2021-03-09 09:25:04 +00:00
bors[bot]
81f8cbec56
Merge #1711 #1712
1711: fix typo in faq.rst r=Diman0 a=tomwojcik



1712: Add details for postfix-overrides r=mergify[bot] a=sholl

## What type of PR?

Documentation clarification

## What does this PR do?

### Related issue(s)

this clarifies the FAQ about overrides and fixes #1628 


Co-authored-by: Tomasz Wójcik <tomwojcik@users.noreply.github.com>
Co-authored-by: Stephan Holl <stephan@holl-land.de>
Co-authored-by: Stephan Holl <1610827+sholl@users.noreply.github.com>
2021-03-08 10:10:52 +00:00
bors[bot]
cca4b50915
Merge #1607
1607: _FILE variables for Docker swarm secrets r=mergify[bot] a=lub

## What type of PR?

enhancement

## What does this PR do?

This PR enables usage of DB_PW_FILE and SECRET_KEY_FILE instead of DB_PW and SECRET_KEY to load these values from files instead of supplying them directly. That way it's possible to use Docker secrets.

### Related issue(s)


## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: lub <git@lubiland.de>
2021-03-08 09:07:10 +00:00
Florent Daigniere
0dcc059cd6 Add a new knob as discussed on matrix with lub 2021-03-05 22:26:46 +01:00
Stephan Holl
3ada506dbd
Update docs/faq.rst
as @lub suggests

Co-authored-by: lub <github@lubiland.de>
2021-02-13 17:35:33 +01:00
Raphaël P. Barazzutti
9e8183ee71
rewording about the usage of PostgreSQL
Co-authored-by: lub <github@lubiland.de>
2021-01-22 05:29:54 +01:00
Raphaël P. Barazzutti
444529b7df rewording in doc 2021-01-21 22:35:58 +01:00
Raphaël P. Barazzutti
82b5920b16 typos 2021-01-21 22:35:55 +01:00
Stephan Holl
bee0261dd8 Add details for postfix-overrides 2020-12-23 18:48:11 +01:00
Tomasz Wójcik
0b14fefb1a
fix typo in faq.rst 2020-12-21 00:19:27 +01:00
bors[bot]
900d4f16ae
Merge #1684
1684: add warning about removing front r=mergify[bot] a=lub

## What type of PR?

documentation

## What does this PR do?

### Related issue(s)
- caused confusion e.g. in #1678

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [ ] ~~Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.~~


Co-authored-by: lub <git@lubiland.de>
2020-11-19 14:55:43 +00:00
ebdavison
ad97266f77
removing unneeded image
Removing this image as request in PR #1680
2020-11-17 11:41:01 -06:00
lub
900b28178a add warning about removing front 2020-11-15 14:22:00 +01:00
ebdavison
2cf9fdb220
remove service status "feature"
Per the issue tracker, this was removed in issue #463 (Remove the Service Status page)
2020-11-11 12:10:41 -06:00
Dimitri Huisman
26839c9066 Fixed small typo, added clarification for full text search and added japanese local as a new feature. 2020-10-14 15:15:04 +00:00
Dario Ernst
c0cc6bbaec Add DNS SPF upgrade notice; Extend Changelog items 2020-10-12 22:10:58 +02:00
Dario Ernst
2e55329b8b Improve changelog and release texts for 1.8 2020-10-12 21:18:20 +02:00
Dimitri Huisman
17cea83301 Completely remove step 5 where you can set the replica count for docker-stack.
Add additional warning to ´experimental' notice in setup for stack.
Add a notice the shipped PostgreSQL is deprecated.
Make the external PostgreSQL database the default option.
Make 1.7 the default version (stable_version': '1.7', in docs\conf.py)
Update mergify.yml with 1.8 version
2020-10-04 13:22:59 +00:00
Dimitri Huisman
78890a97ff Preparations for 1.8 release. 2020-10-01 20:32:05 +02:00
bors[bot]
62c54ea57f
Merge #1592
1592: Add documentation for the web administration gui. r=mergify[bot] a=Diman0

## What type of PR?

Documentation

## What does this PR do?

This PR adds the section Web Administration Interface to the documentation site which completely documents all available settings in the web administration interface.

### Related issue(s)
- Closes issue #1590 (please close this issue for me)

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ Done ] In case of feature or enhancement: documentation updated accordingly
- [ Done ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: Dimitri Huisman <diman@huisman.xyz>
Co-authored-by: Dimitri Huisman <52963853+Diman0@users.noreply.github.com>
2020-09-27 08:03:49 +00:00
Dimitri Huisman
86d6caa789
Update docs/webadministration.rst
additional clarification. We only support secure connections.

Co-authored-by: lub <github@lubiland.de>
2020-09-26 10:19:48 +02:00
Dimitri Huisman
a50e6d55c5
Update docs/webadministration.rst
grammar

Co-authored-by: lub <github@lubiland.de>
2020-09-26 10:17:19 +02:00
Dimitri Huisman
5981a34397
Update docs/webadministration.rst
typo/grammar

Co-authored-by: lub <github@lubiland.de>
2020-09-26 10:14:26 +02:00
Dimitri Huisman
4a3b16d3bc
Update docs/webadministration.rst
typo/grammar

Co-authored-by: lub <github@lubiland.de>
2020-09-26 10:14:15 +02:00
Dimitri Huisman
04436dd047
Update docs/webadministration.rst
additional clarification

Co-authored-by: lub <github@lubiland.de>
2020-09-26 10:12:29 +02:00
Dimitri Huisman
037a7a40e7
Update docs/webadministration.rst
additional clarification

Co-authored-by: lub <github@lubiland.de>
2020-09-26 10:11:12 +02:00
Dimitri Huisman
465540229a
Update docs/webadministration.rst
Co-authored-by: lub <github@lubiland.de>
2020-09-26 10:09:56 +02:00
Dimitri Huisman
5c4a8069e4 Add additional instructions for first time usage. 2020-09-26 01:13:29 +02:00
Dimitri Huisman
9fe750dc2b Add FAQ entry for how to use webdav(radicale) 2020-09-24 16:43:18 +02:00
Dimitri Huisman
f843bfe9d5 Add additional clarification that you may have to add a new domain to HOSTNAMES in your mailu.env file. 2020-09-24 14:17:05 +02:00
Dimitri Huisman
769a143e45
Update docs/webadministration.rst
typo

Co-authored-by: Dario Ernst <github@kanojo.de>
2020-09-24 12:34:29 +02:00
Dimitri Huisman
98f59a8763
Update docs/webadministration.rst
typo

Co-authored-by: Dario Ernst <github@kanojo.de>
2020-09-24 12:09:11 +02:00
Dimitri Huisman
2387e53c58
Update docs/webadministration.rst
More clarification.

Co-authored-by: Dario Ernst <github@kanojo.de>
2020-09-24 12:08:44 +02:00
Dimitri Huisman
ec711cf021
Update docs/webadministration.rst
rewording to add more clarification

Co-authored-by: Dario Ernst <github@kanojo.de>
2020-09-24 12:06:48 +02:00
Dimitri Huisman
5f8e98c70f
Update docs/webadministration.rst
rewording to make it more clear

Co-authored-by: Dario Ernst <github@kanojo.de>
2020-09-24 12:05:44 +02:00
Dimitri Huisman
1083527647
Update docs/webadministration.rst
rewording to make it more clear.

Co-authored-by: Dario Ernst <github@kanojo.de>
2020-09-24 11:54:50 +02:00
Dimitri Huisman
a772c19546
Update docs/webadministration.rst
Rewording to make it more clear.

Co-authored-by: Dario Ernst <github@kanojo.de>
2020-09-24 11:52:36 +02:00
Dimitri Huisman
4bc0962fb8
Update docs/webadministration.rst
typo

Co-authored-by: Dario Ernst <github@kanojo.de>
2020-09-24 11:50:36 +02:00
Dimitri Huisman
9f4e906534
Update docs/webadministration.rst
Co-authored-by: Dario Ernst <github@kanojo.de>
2020-09-24 11:50:12 +02:00
Simonmicro
4a5678f571
Added explaining message about the current ipv6 problem 2020-09-05 12:16:21 +02:00
lub
f0f873ffe7 add option to enforce inbound starttls 2020-09-01 21:48:09 +02:00
lub
426355f6b8 add some docs about _FILE variables 2020-08-30 01:14:47 +02:00
bors[bot]
550065b043
Merge #1601
1601: Fixing documentation minor typo r=mergify[bot] a=akevinieron

## What type of PR?
Documentation

## What does this PR do?
Fixing minor typo on certificate section

## Related issue(s)
N/A

Co-authored-by: Kevin Jimenez <kevinjimenezlorenzo@gmail.com>
2020-08-27 12:17:52 +00:00
Alexander Graf
669d8da9ac fixed workflow example in documentation
use "git remote add" instead of "git add remote"
2020-08-26 10:35:03 +02:00
Kevin Jimenez
b86dc12c1f
Fixing documentation minor typo 2020-08-23 20:21:14 -04:00