self-hosted/Mailu
1
0
Fork 0
mirror of https://github.com/Mailu/Mailu.git synced 2025-01-30 04:30:49 +02:00
Code Issues Releases Activity
2,991 Commits 123 Branches 132 Tags
Commit Graph

722 Commits

Author SHA1 Message Date
Alexander Graf
4b71bd56c4 replace flask_kvsession with mailu's own storage 2021-04-04 14:35:31 +02:00
DjVinnii
7dafa22762 Add /language/<language> route for changing the locale using a session variable 2021-04-03 10:33:08 +02:00
DjVinnii
f30cca1263 Do imports based on AdminLTE plugins 2021-04-03 10:32:01 +02:00
DjVinnii
a4bb42faeb Remove extra space between 'AdminLTE' and 'on' in footer 2021-04-02 09:22:05 +02:00
DjVinnii
b2498e8c8f Refactor box macro to card 2021-04-01 19:47:59 +02:00
DjVinnii
5ddea07c9a Fix form input append class 2021-04-01 19:46:38 +02:00
DjVinnii
1db0a870f3 Fix log in icon in sidebar 2021-04-01 19:45:49 +02:00
DjVinnii
51346c4860 Fix pre- and append styling 2021-04-01 18:30:13 +02:00
DjVinnii
e963e7495d Create datatable based on dataTable class instead of table class 2021-04-01 18:02:50 +02:00
DjVinnii
0984173504 Change label to badge 2021-04-01 16:54:25 +02:00
DjVinnii
8246497d16 Add card header to tables 2021-04-01 16:51:33 +02:00
DjVinnii
49d68fa6d1 Fix horizontal scrollbar in sidebar 2021-04-01 16:51:13 +02:00
DjVinnii
7d3c9d412d Change tables to datatables 2021-04-01 16:05:30 +02:00
DjVinnii
cdfa94c243 Make main action float right 2021-04-01 14:59:12 +02:00
DjVinnii
0c5fda3fca Change macros.box to macros.card 2021-04-01 14:47:41 +02:00
DjVinnii
deca6e0c4a update user/settings 2021-04-01 14:45:12 +02:00
DjVinnii
6b3170cb4c Update side menu 2021-04-01 14:42:15 +02:00
DjVinnii
c97728289b Update node version for building the image (AdminLTE requires node 10 or higher) 2021-04-01 11:34:03 +02:00
DjVinnii
e46d9e1fc9 Update admin-lte version in package.json 2021-04-01 11:26:37 +02:00
Vincent Kling
c6d0ef229f
Update messages.po 2021-03-19 10:46:42 +01:00
Alexander Graf
f0f79b23a3 Allow cleanup of sessions by key&value in data 
This can be used to delete all sessions belonging to a user/login.
For no it just iterates over all sessions.
This could be enhanced by using a prefix for and deleting by prefix.
 2021-03-14 21:38:16 +01:00
Alexander Graf
83b1fbb9d6 Lazy loading of KVSessionExtension 
- call cleanup_sessions on first kvstore access
  this allows to run cmdline actions without redis (and makes it faster)
- Allow development using DictStore by setting REDIS_ADDRESS to the empty string in env
- don't sign 64bit random session id as suggested by nextgens
 2021-03-14 18:09:21 +01:00
Alexander Graf
8bc4445572 Sync update of localpart, domain_name and email 2021-03-12 17:56:17 +01:00
Alexander Graf
0c38128c4e Add pygments to requirements 2021-03-11 18:38:00 +01:00
Alexander Graf
9cb6962335 Moved MyYamlLexer into logger 
now cmdline runs without pygments
 2021-03-11 18:12:50 +01:00
Alexander Graf
ce9a9ec572 always init Logger first 2021-03-10 18:50:52 +01:00
Alexander Graf
c17bfae240 correct rfc3339 datetime serialization 
now using correct timezone
 2021-03-10 18:50:25 +01:00
Alexander Graf
dc5464f254 Merge remote-tracking branch 'upstream/master' into import-export 2021-03-10 18:32:19 +01:00
Alexander Graf
e90d5548a6 use RFC3339 for last_check 
fixed to UTC for now
 2021-03-10 18:30:28 +01:00
Florent Daigniere
dd3d03f06d Merge remote-tracking branch 'upstream/master' into webmail-sso 2021-03-10 14:41:12 +01:00
bors[bot]
25e8910b89
Merge #1783 
1783: Switch to server-side sessions r=mergify[bot] a=nextgens

## What type of PR?

bug-fix

## What does this PR do?

It simplifies session management.
- it ensures that sessions will eventually expire (*)
- it implements some mitigation against session-fixation attacks
- it switches from client-side to server-side sessions (in Redis)

It doesn't prevent us from (re)-implementing a "remember_me" type of feature if that's considered useful by some.


Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
 2021-03-10 09:44:31 +00:00
lub
f3f0a4d86d
Merge branch 'master' into enforce-tls-admin 2021-03-09 23:40:51 +01:00
Florent Daigniere
64d757582d Disable anti-csrf on the login form 
The rationale is that the attacker doesn't have the password...
and that doing it this way we avoid creating useless sessions
 2021-03-09 14:21:02 +01:00
Florent Daigniere
481cb67392 cleanup old sessions on startup 2021-03-09 14:21:02 +01:00
Florent Daigniere
b9becd8649 make sessions expire 2021-03-09 14:21:02 +01:00
Florent Daigniere
a1d32568d6 Regenerate session-ids to prevent session fixation 2021-03-09 14:20:22 +01:00
Florent Daigniere
d459c37432 make session IDs 128bits 2021-03-09 14:20:22 +01:00
Florent Daigniere
22af5b8432 Switch to server-side sessions in redis 2021-03-09 14:20:22 +01:00
Alexander Graf
dd2e218375 Merge remote-tracking branch 'upstream/master' into import-export 2021-03-09 13:31:21 +01:00
Florent Daigniere
96ae54d04d CryptContext should be a singleton 2021-03-09 12:05:46 +01:00
Florent Daigniere
5f05fee8b3 Don't need regexps anymore 2021-03-09 12:05:46 +01:00
Florent Daigniere
1c5b58cba4 Remove scheme_dict 2021-03-09 12:05:46 +01:00
Florent Daigniere
df230cb482 Refactor auth under nginx.check_credentials() 2021-03-09 12:05:46 +01:00
Florent Daigniere
f9ed517b39 Be specific token length 2021-03-09 12:05:46 +01:00
Florent Daigniere
d0b34f8e24 Move CREDENTIAL_ROUNDS to advanced settings 2021-03-09 12:05:46 +01:00
Florent Daigniere
fda758e2b4 remove merge artifact 2021-03-09 12:04:42 +01:00
Florent Daigniere
57a6abaf50 Remove {scheme} from the DB if mailu has set it 2021-03-09 12:04:42 +01:00
Florent Daigniere
7137ba6ff1 Misc improvements to PASSWORD_SCHEME 
- remove PASSWORD_SCHEME altogether
- introduce CREDENTIAL_ROUNDS
- migrate all old hashes to the current format
- auto-detect/enable all hash types that passlib supports
- upgrade passlib to 1.7.4 (see #1706: ldap_salted_sha512 support)
 2021-03-09 12:04:42 +01:00
Florent Daigniere
00b001f76b Improve the token storage format 
shortcomings of the previous format included:
- 1000x slower than it should be (no point in adding rounds since there
 is enough entropy: they are not bruteforceable)
- vulnerable to DoS as explained in
https://passlib.readthedocs.io/en/stable/lib/passlib.hash.sha256_crypt.html#security-issues
 2021-03-09 12:04:42 +01:00
Florent Daigniere
eb7895bd1c Don't do more work than necessary (/webdav) 
This is also fixing tokens on /webdav/
 2021-03-09 12:04:42 +01:00