1
0
mirror of https://github.com/Mailu/Mailu.git synced 2024-12-12 10:45:38 +02:00
Commit Graph

4635 Commits

Author SHA1 Message Date
Florent Daigniere
bc863b4bbc Long term fix against SMTP smuggling 2023-12-28 08:51:50 +01:00
bors-mailu[bot]
df5b48a52d
Merge #3100
3100: Do not block webmail when we have a valid SSO session r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

Ensure we do not block webmail when we have a valid SSO session

### Related issue(s)
- close  #3094

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
2023-12-22 08:43:12 +00:00
bors-mailu[bot]
e43212aec5
Merge #3102
3102: Prevent SMTP smuggling r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

Prevent SMTP smuggling; see https://www.mail-archive.com/postfix-users@postfix.org/msg100901.html and https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/

### Related issue(s)


## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
2023-12-22 08:33:28 +00:00
Florent Daigniere
64d83d061e Prevent SMTP smuggling 2023-12-21 18:17:29 +01:00
Florent Daigniere
325aa5452b Do not block webmail when we have a valid SSO sess 2023-12-21 12:37:08 +01:00
bors-mailu[bot]
774dfa4da8
Merge #3096
3096: Fix 3095: fix the form validator of forwarding addresses r=nextgens a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

Fix the form validator of forwarding addresses (allow uppercase).

I don't think this warrants a backport but if you think it does add the label.

### Related issue(s)
- closes #3095

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
2023-12-20 11:25:20 +00:00
Florent Daigniere
98848b45c7 Do the minimum to solve the problem at hand 2023-12-20 12:06:44 +01:00
Florent Daigniere
30574445e4 Better regexp 2023-12-20 11:41:45 +01:00
Florent Daigniere
422f005c3f Fix 3095 2023-12-19 18:25:04 +01:00
bors-mailu[bot]
2ee1c0698e
Merge #3076
3076: Slow down the turtle policy r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

Slow down the turtle policy

### Related issue(s)
- close #3075 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
2023-11-30 20:30:32 +00:00
Florent Daigniere
1f19ac5d8d Slow down the turtle policy 2023-11-30 18:17:53 +01:00
bors-mailu[bot]
bddbfabd82
Merge #3025
3025: Fix SETUP generating invalid files. r=mergify[bot] a=Diman0

## What type of PR?

bug-fix

## What does this PR do?
If JavaScript script is disabled or JS files are blocked from the setup website, the SETUP website would generate invalid configuration. Checks were added to prevent this situation from occurring.

Bootstrap loaded an outdated jquery version 1. We already use Jquery 2. I have disabled this and configured bootstrap to load our jquery js file.

Also fixed a regular expression that makes sure the specified Mailu storage path is valid.

### Related issue(s)
- closes #2396
- closes #2890
- closes #1524  

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [n/a] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Dimitri Huisman <diman@huisman.xyz>
Co-authored-by: Dimitri Huisman <52963853+Diman0@users.noreply.github.com>
2023-11-18 12:10:14 +00:00
Dimitri Huisman
e7cf213da7
Forgot to include this in the previous commit for removing WEB_* settings from setup. 2023-11-18 11:17:33 +00:00
Dimitri Huisman
e43fb69864
Update changelog fragment of 2890 2023-11-18 11:16:22 +00:00
Dimitri Huisman
823b01041a
Remove WEB_ variables from setup.
Setup is meant for the standard use case where you don't change
WEB_*. WEB_* can still be changed via mailu.env
2023-11-18 11:10:14 +00:00
Dimitri Huisman
0e04871cbe
Use better python method for validating IP address and subnet 2023-11-18 09:40:52 +00:00
bors-mailu[bot]
42db941fa9
Merge #3057
3057: Retry up to 5 times if not ready r=mergify[bot] a=nextgens

Add retry logic to ensure we don't always pass if clamav is not ready; return a 25 error only if it's a permanent rejection code so that we can differentiate in between "definitely reject" and "was rejected because of a glitch"

Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
2023-11-15 12:55:47 +00:00
Dimitri Huisman
6466759f30
Update setup/templates/steps/compose/03_expose.html
Better sentence structure

Co-authored-by: Florent Daigniere <nextgens@users.noreply.github.com>
2023-11-15 13:28:57 +01:00
Florent Daigniere
3d13e72133 Only return 25 when it's a permanent error 2023-11-15 10:33:02 +01:00
Florent Daigniere
0b776fffbd Ensure the logic is right 2023-11-15 10:25:55 +01:00
Florent Daigniere
5312495d0e Retry up to 5 times if not ready 2023-11-15 10:15:34 +01:00
bors-mailu[bot]
245a5df4f1
Merge #3055
3055: Doh r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

Fix CI



Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
2023-11-15 08:48:14 +00:00
Florent Daigniere
8ae6b4dd89 Doh 2023-11-15 09:45:40 +01:00
bors-mailu[bot]
a1158ec224
Merge #3044
3044: Add a sigterm handler to make docker stop go faster r=mergify[bot] a=nextgens

## What type of PR?

enhancement

## What does this PR do?

- Add a sigterm handler to make ``docker stop`` go way faster
- Ensure we don't log requests to /ping in admin
- Fixup doc
- Upgrade WTForms to fix alias creation

### Related issue(s)

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [ ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
Co-authored-by: Florent Daigniere <nextgens@users.noreply.github.com>
2023-11-14 19:10:40 +00:00
bors-mailu[bot]
260b363957
Merge #3049
3049: Ensure that we do not silently discard PUAs flagged by clamav r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

Ensure that we do not silently discard PUAs flagged by clamav. Instead we will reject emails.

### Related issue(s)
- closes #3048 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [ ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
2023-11-14 18:58:18 +00:00
Florent Daigniere
ffe823d6bc Upgrade to WTForms==3.1.1 2023-11-14 14:47:16 +01:00
Florent Daigniere
a61f31e7c5 Now it should fail earlier 2023-11-13 08:13:20 +01:00
Florent Daigniere
6765c45ab8 simplify 2023-11-10 12:27:02 +01:00
Florent Daigniere
2c422bbfbe doh 2023-11-10 12:25:34 +01:00
Florent Daigniere
e3675a676c Reject on OLETOOLS too 2023-11-10 12:24:14 +01:00
Florent Daigniere
f7fb0f6625 Add a new test for PUAs 2023-11-10 12:13:04 +01:00
Florent Daigniere
aefbd9552c fix clamav handling 2023-11-10 12:00:29 +01:00
Florent Daigniere
dbb2d78558 Fixup doc 2023-11-09 16:03:22 +01:00
Florent Daigniere
38b6d360d3
Update system.py
promote to log.critical()
2023-11-09 10:26:04 +01:00
Florent Daigniere
e75834f746
Update system.py
143 is the standard following SIGTERM
2023-11-09 10:20:42 +01:00
Florent Daigniere
81b458efe2 Maybe fix the log-filter on admin 2023-11-07 17:02:32 +01:00
Florent Daigniere
1c26368b37 Add a sigterm handler to make docker go faster 2023-11-07 16:55:24 +01:00
Dimitri Huisman
d370d40df7
Reinstate statistics which is currently not used. Remove unneeded line in
Dockerfile.
2023-11-07 15:24:23 +00:00
bors-mailu[bot]
fd66c76c83
Merge #3033
3033: Enable snowball on FTS r=mergify[bot] a=nextgens

## What type of PR?

enhancement

## What does this PR do?

Enable [snowball](http://snowball.tartarus.org/algorithms/english/stemmer.html), a filter that will significantly cut down the size of FTS indexes.

It looks like the packages for aarch64 haven't been built yet... but this works on x64_86.
Don't unblock as long as  https://dl-cdn.alpinelinux.org/alpine/edge/testing/aarch64/dovecot-fts-flatcurve-0.3.4-r3.apk is 404

### Related issue(s)
- close #2977 

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
2023-11-07 15:07:07 +00:00
Dimitri Huisman
eb65e5eea0
Add extra server-side validation of setup form values
Remove deprecated database_flavor JavaScript functionality
Remove statistics question which has never been implemented
2023-11-07 14:14:27 +00:00
Dimitri Huisman
02d5202c68
Process ghostwheel's suggestion. By default hide the container div element and
show the no-javascript div element. Via JavaScript hide the no-java div element
and show the container div element.
2023-11-07 10:49:59 +00:00
Florent Daigniere
80d03ae60b doh2 2023-11-07 09:42:43 +01:00
Florent Daigniere
239ef0092e Doh 2023-11-07 09:23:22 +01:00
bors-mailu[bot]
b7ca4eb9f0
Merge #3032
3032: Update all python dependencies r=mergify[bot] a=Diman0

## What type of PR?

enhancement

## What does this PR do?
Updates all dependencies. Unfortunately multiple things were deprecated such as
* `@babel.localeselector` decorator
* app.app.session_cookie_name
* app.before_first_request

Unfortunately flask_debugtoolbar is not compatible with the updated version of flask.
Flask-SQLAlchemy cannot be updated to 3.0.5 because this introduces an error/bug.

### Related issue(s)

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [n/a] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Dimitri Huisman <diman@huisman.xyz>
2023-11-06 14:48:09 +00:00
Dimitri Huisman
7b3f08ac28
Merge pull request #3041 from ctrl-i/roundcube-1.6.5
SECURITY FIX: Update to Roundcube 1.6.5
2023-11-06 13:09:51 +01:00
ctrl-i
3a3f6d0694
Update Dockerfile 2023-11-06 07:56:13 +00:00
ctrl-i
b74cd17bdd
Upgrade to roundcube 1.6.5 (fix XSS) 2023-11-06 07:55:23 +00:00
bors[bot]
a69071628f
Merge #3023
3023: Add zonefile download r=mergify[bot] a=MajliTech

## What type of PR?

Feature

## What does this PR do?
On /admin/domain/details/{domain}, adds a button to redirect to /admin/domain/details/{domain}/zonefile, which downloads a zonefile for this domain.

closes #2618

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [X] In case of feature or enhancement: documentation updated accordingly
- [X] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Miłosz <hello@majlitech.pl>
Co-authored-by: Miłosz Thiede <git@majlitech.pl>
Co-authored-by: Alexander Graf <ghostwheel42@users.noreply.github.com>
2023-11-02 16:01:03 +00:00
Alexander Graf
901e4a772d
Remove surplus double quote 2023-11-02 15:58:15 +01:00
Alexander Graf
fa8e8f4f73
Rename 3008.feature to 3023.feature 2023-11-01 18:02:40 +01:00