1
0
mirror of https://github.com/Mailu/Mailu.git synced 2024-12-26 22:57:26 +02:00
Commit Graph

2831 Commits

Author SHA1 Message Date
Florent Daigniere
99c7420f92 towncrier 2021-02-07 17:51:19 +01:00
Florent Daigniere
2cdee8d18e Make roundcube use internal auth 2021-02-07 17:50:30 +01:00
Florent Daigniere
906a051925 Make rainloop use internal auth 2021-02-07 17:50:17 +01:00
bors[bot]
21d1f32885
Merge
1748: For travis Ci: Need to docker login before pulling images r=mergify[bot] a=ofthesun9

To avoid triggering the Download rate limit from Docker Hub

## What type of PR?
enhancement

## What does this PR do?
This PR add a docker login cmd before launching the build script

Co-authored-by: ofthesun9 <olivier@ofthesun.net>
2021-02-01 09:58:18 +00:00
ofthesun9
788d069b53
Modify docker login cmd to use --password-stdin and avoid warning 2021-01-31 15:39:32 +01:00
ofthesun9
612632e4fc
Need to docker login before pulling images
To avoid triggering the Download rate limite
2021-01-31 10:58:41 +01:00
Alexander Graf
1c9abf6e48 updated requirements for import/export
api reqs (flask-restx, ...) are still missing
2021-01-24 19:27:22 +01:00
Alexander Graf
1da7e5b8d2 Merge remote-tracking branch 'upstream/master' into api 2021-01-24 19:10:24 +01:00
Alexander Graf
902b398127 next step for import/export yaml & json 2021-01-24 19:07:48 +01:00
bors[bot]
227118e20f
Merge
1743: Doc fixes r=ofthesun9 a=rbarazzutti

## Documentations fixes

- 82b5920 typos
- 444529b PostgreSQL deprecation (reword)

Co-authored-by: Raphaël P. Barazzutti <raphael@barazzutti.net>
2021-01-24 17:10:59 +00:00
Raphaël P. Barazzutti
9e8183ee71
rewording about the usage of PostgreSQL
Co-authored-by: lub <github@lubiland.de>
2021-01-22 05:29:54 +01:00
Raphaël P. Barazzutti
444529b7df rewording in doc 2021-01-21 22:35:58 +01:00
Raphaël P. Barazzutti
82b5920b16 typos 2021-01-21 22:35:55 +01:00
Mordi Sacks
f56af3053a
Removed email address 2021-01-17 01:28:25 +02:00
bors[bot]
6518ef19af
Merge
1730: Use alpine 3.13 to fix CVE-2020-25275 and CVE-2020-24386 r=mergify[bot] a=micw

## What type of PR?

bug-fix

## What does this PR do?

Upgrade dovecot alpine to 3.13 to fix CVEs in dovecot

### Related issue(s)

- 

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: Michael Wyraz <michael@wyraz.de>
2021-01-16 03:08:06 +00:00
Alexander Graf
65b1ad46d9 order yaml data and allow callback on import
- in yaml the primary key is now always first
- calling a function on import allows import to be more verbose
- skip "fetches" when empty
2021-01-15 13:57:20 +01:00
Alexander Graf
8213d044b2 added docstrings, use f-strings, cleanup
- idna.encode does not encode upper-case letters,
  so .lower() has to be called on value not on result
- split email-address on '@' only once
- converted '*'.format(*) to f-strings
- added docstrings
- removed from_dict method
- code cleanup/style (list concat, exceptions, return&else, line-length)
- added TODO comments on possible future changes
2021-01-15 13:53:47 +01:00
Alexander Graf
31a903f959 revived & renamed config-fns. cosmetics.
- revived original config-update function for backwards compability
- renamed config-dump to config-export to be in line with config-import
- converted '*'.format(*) to f-strings
- converted string-concatenation to f-strings
2021-01-15 13:45:36 +01:00
Michael Wyraz
2b37be9889 Use alpine 3.13 to fix CVE-2020-25275 and CVE-2020-24386 2021-01-15 10:56:49 +01:00
Alexander Graf
c24bff1c1b added config_import using marshmallow 2021-01-14 01:11:04 +01:00
Alexander Graf
7413f9b7b4 config_dump now using marshmallow 2021-01-13 00:05:43 +01:00
Alexander Graf
dc42d375e2 added filtering of keys and default value 2021-01-08 14:22:59 +01:00
Alexander Graf
82cf0d843f fix sqlalchemy column definitions 2021-01-08 14:22:11 +01:00
Alexander Graf
b3f8dacdad add docstrings and make linter happy 2021-01-08 14:17:28 +01:00
Alexander Graf
6629aa3ff8 first try at api using flask-restx & marshmallow 2021-01-06 17:05:21 +01:00
Alexander Graf
4c258f5a6b cosmetic changes & make linter happy
renamed single letter variables (m => match)
renamed classmethod arguments to cls (model)
removed shadowing of variables (hash, context)
shortened unneeded lambda functions (id)
converted type ... is to isinstance(...)
removed unneded imports (flask)
2021-01-06 16:45:55 +01:00
Alexander Graf
7229c89de1 ConfigManager should not replace app.config
Updated ConfigManager to only modify app.config and not replace it.
Swagger does not play well, when app.config is not a real dict and
it is not necessary to keep ConfigManager around after init.

Also added "API" flag to config (default: disabled).
2021-01-06 16:31:03 +01:00
Grace
a1a527f201
Warn people off of the documentation's K8s recipe.
Based on a discussion on Matrix (2020.12.19),
the helm charts are the way to go.
2021-01-04 02:37:48 -05:00
Stephan Holl
6ba40bc0d7 Add newsfragment 2020-12-23 18:53:56 +01:00
Stephan Holl
bee0261dd8 Add details for postfix-overrides 2020-12-23 18:48:11 +01:00
Tomasz Wójcik
0b14fefb1a
fix typo in faq.rst 2020-12-21 00:19:27 +01:00
Alexander Graf
3b35180b41 cosmetic changes 2020-12-20 23:50:26 +01:00
Alexander Graf
815f47667b update dkim-key on commit only 2020-12-20 23:49:42 +01:00
Alexander Graf
0a594aaa2c cosmetic changes 2020-12-20 23:45:27 +01:00
Alexander Graf
3064a1dcff removed call to (undefined) cli 2020-12-20 23:38:55 +01:00
Alexander Graf
0051b93077 removed unused variable 2020-12-16 22:39:50 +01:00
Alexander Graf
2cd3acdc1a Merge remote-tracking branch 'upstream/master' into import-export 2020-12-16 22:39:09 +01:00
bors[bot]
b2eded5879
Merge
1693: Bump cryptography from 2.6.1 to 3.2 in /core/admin r=mergify[bot] a=dependabot[bot]

Bumps [cryptography](https://github.com/pyca/cryptography) from 2.6.1 to 3.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst">cryptography's changelog</a>.</em></p>
<blockquote>
<p>3.2 - 2020-10-25</p>
<pre><code>
* **SECURITY ISSUE:** Attempted to make RSA PKCS#1v1.5 decryption more constant
  time, to protect against Bleichenbacher vulnerabilities. Due to limitations
  imposed by our API, we cannot completely mitigate this vulnerability and a
  future release will contain a new API which is designed to be resilient to
  these for contexts where it is required. Credit to **Hubert Kario** for
  reporting the issue. *CVE-2020-25659*
* Support for OpenSSL 1.0.2 has been removed. Users on older version of OpenSSL
  will need to upgrade.
* Added basic support for PKCS7 signing (including SMIME) via
  :class:`~cryptography.hazmat.primitives.serialization.pkcs7.PKCS7SignatureBuilder`.
<p>.. _v3-1-1:</p>
<p>3.1.1 - 2020-09-22
</code></pre></p>
<ul>
<li>Updated Windows, macOS, and <code>manylinux</code> wheels to be compiled with
OpenSSL 1.1.1h.</li>
</ul>
<p>.. _v3-1:</p>
<p>3.1 - 2020-08-26</p>
<pre><code>
* **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
  :term:`U-label` parsing in various X.509 classes. This support was originally
  deprecated in version 2.1 and moved to an extra in 2.5.
* Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by
  the OpenSSL project. The next version of ``cryptography`` will drop support
  for it.
* Deprecated support for Python 3.5. This version sees very little use and will
  be removed in the next release.
* ``backend`` arguments to functions are no longer required and the
  default backend will automatically be selected if no ``backend`` is provided.
* Added initial support for parsing certificates from PKCS7 files with
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
  and
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
  .
* Calling ``update`` or ``update_into`` on
  :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
  longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
  also resolves the same issue in :doc:`/fernet`.
<p>.. _v3-0:</p>
<p>3.0 - 2020-07-20
&lt;/tr&gt;&lt;/table&gt;
</code></pre></p>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="c9e65222c9"><code>c9e6522</code></a> 3.2 release (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5508">#5508</a>)</li>
<li><a href="58494b41d6"><code>58494b4</code></a> Attempt to mitigate Bleichenbacher attacks on RSA decryption (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5507">#5507</a>)</li>
<li><a href="cf9bd6a36b"><code>cf9bd6a</code></a> move blinding to <strong>init</strong> on both RSA public and private (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5506">#5506</a>)</li>
<li><a href="bf4b962f4b"><code>bf4b962</code></a> be more verbose in the 102 deprecation notice (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5505">#5505</a>)</li>
<li><a href="ada53e7ca0"><code>ada53e7</code></a> make the regexes for branches more strict (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5504">#5504</a>)</li>
<li><a href="8be1d4b111"><code>8be1d4b</code></a> Stop using <a href="https://github.com/master">@master</a> for GH actions (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5503">#5503</a>)</li>
<li><a href="08a97cca71"><code>08a97cc</code></a> Bump actions/upload-artifact from v1 to v2.2.0 (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5502">#5502</a>)</li>
<li><a href="52a0e44e97"><code>52a0e44</code></a> Add a dependabot configuration to bump our github actions (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5501">#5501</a>)</li>
<li><a href="611c4a340f"><code>611c4a3</code></a> PKCS7SignatureBuilder now supports new option NoCerts when signing (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5500">#5500</a>)</li>
<li><a href="836a92a28f"><code>836a92a</code></a> chunking didn't actually work (<a href="https://github-redirect.dependabot.com/pyca/cryptography/issues/5499">#5499</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/pyca/cryptography/compare/2.6.1...3.2">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cryptography&package-manager=pip&previous-version=2.6.1&new-version=3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/configuring-github-dependabot-security-updates)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Mailu/Mailu/network/alerts).

</details>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2020-12-16 07:21:17 +00:00
Alexander Graf
63176f4878 Merge remote-tracking branch 'upstream/master' into import-export 2020-11-30 22:03:10 +01:00
bors[bot]
8a425c92e0
Merge
1696: disable php version expose r=Diman0 a=ronivay

## What type of PR?

enhancement

## What does this PR do?

Disable exposing PHP-version from webmails in x-powered-by header for security reasons.

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [N/A] In case of feature or enhancement: documentation updated accordingly
- [x ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: ronivay <roni@vayrynen.info>
2020-11-26 08:52:29 +00:00
ronivay
96bf16605c fix changelog entry from feature to misc 2020-11-23 09:27:55 +02:00
ronivay
1ef62f5a2f changelog entry for 2020-11-23 09:17:40 +02:00
ronivay
eb0dc7f90a disable php version expose 2020-11-23 08:55:58 +02:00
lub
2606ace1df add changelog for 2020-11-21 12:39:42 +01:00
lub
98a6ffb497 add compression via xz and lz4 2020-11-21 12:37:08 +01:00
dependabot[bot]
54ccfdf975
Bump cryptography from 2.6.1 to 3.2 in /core/admin
Bumps [cryptography](https://github.com/pyca/cryptography) from 2.6.1 to 3.2.
- [Release notes](https://github.com/pyca/cryptography/releases)
- [Changelog](https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/2.6.1...3.2)

Signed-off-by: dependabot[bot] <support@github.com>
2020-11-21 11:15:31 +00:00
lub
8dd5dac3ed update roundcube to php 7.4 2020-11-21 00:55:38 +01:00
lub
d63ca857b4 update rainloop to php 7.4 2020-11-21 00:55:28 +01:00
bors[bot]
900d4f16ae
Merge
1684: add warning about removing front r=mergify[bot] a=lub

## What type of PR?

documentation

## What does this PR do?

### Related issue(s)
- caused confusion e.g. in 

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [ ] ~~Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.~~


Co-authored-by: lub <git@lubiland.de>
2020-11-19 14:55:43 +00:00
bors[bot]
dad1964c11
Merge
1680: remove service status "feature" r=ofthesun9 a=ebdavison

Per the issue tracker, this was removed in issue Mailu#463 (Remove the Service Status page)

## What type of PR?

documentation

## What does this PR do?

remove feature for services status which no longer exists; this confused me as I was trying to find it and was not able to.

## Related issue(s)

Remove the Service Status page Mailu#463

## Prerequistes

Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

N/A

Co-authored-by: ebdavison <549431+ebdavison@users.noreply.github.com>
2020-11-18 07:53:44 +00:00