mirror of
https://github.com/Mailu/Mailu.git
synced 2024-12-14 10:53:30 +02:00
fc1a663da2
1754: centralize Webmail authentication behind the admin panel (SSO) r=mergify[bot] a=nextgens ## What type of PR? Enhancement: it centralizes the authentication of webmails to the admin interface. ## What does this PR do? It implements the glue required for webmails to do SSO using the admin interface. One of the main advantages of centralizing things this way is that it reduces significantly the attack surface available to an unauthenticated attacker (no webmail access until there is a valid Flask session). Others include the ability to implement 2FA down the line and rate-limit things as required. ### Related issue(s) - #783 ## Prerequistes Before we can consider review and merge, please make sure the following list is done and checked. If an entry in not applicable, you can check it or remove it from the list. - [x] In case of feature or enhancement: documentation updated accordingly - [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file. Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
69 lines
2.3 KiB
Python
Executable File
69 lines
2.3 KiB
Python
Executable File
#!/usr/bin/python3
|
|
|
|
import os
|
|
import logging as log
|
|
import sys
|
|
from socrate import conf
|
|
import subprocess
|
|
|
|
log.basicConfig(stream=sys.stderr, level=os.environ.get("LOG_LEVEL", "WARNING"))
|
|
|
|
os.environ["MAX_FILESIZE"] = str(int(int(os.environ.get("MESSAGE_SIZE_LIMIT")) * 0.66 / 1048576))
|
|
|
|
db_flavor = os.environ.get("ROUNDCUBE_DB_FLAVOR", "sqlite")
|
|
if db_flavor == "sqlite":
|
|
os.environ["DB_DSNW"] = "sqlite:////data/roundcube.db"
|
|
elif db_flavor == "mysql":
|
|
os.environ["DB_DSNW"] = "mysql://%s:%s@%s/%s" % (
|
|
os.environ.get("ROUNDCUBE_DB_USER", "roundcube"),
|
|
os.environ.get("ROUNDCUBE_DB_PW"),
|
|
os.environ.get("ROUNDCUBE_DB_HOST", "database"),
|
|
os.environ.get("ROUNDCUBE_DB_NAME", "roundcube")
|
|
)
|
|
elif db_flavor == "postgresql":
|
|
os.environ["DB_DSNW"] = "pgsql://%s:%s@%s/%s" % (
|
|
os.environ.get("ROUNDCUBE_DB_USER", "roundcube"),
|
|
os.environ.get("ROUNDCUBE_DB_PW"),
|
|
os.environ.get("ROUNDCUBE_DB_HOST", "database"),
|
|
os.environ.get("ROUNDCUBE_DB_NAME", "roundcube")
|
|
)
|
|
else:
|
|
print("Unknown ROUNDCUBE_DB_FLAVOR: %s", db_flavor)
|
|
exit(1)
|
|
|
|
conf.jinja("/php.ini", os.environ, "/usr/local/etc/php/conf.d/roundcube.ini")
|
|
|
|
# Create dirs, setup permissions
|
|
os.system("mkdir -p /data/gpg /var/www/html/logs")
|
|
os.system("touch /var/www/html/logs/errors.log")
|
|
os.system("chown -R www-data:www-data /var/www/html/logs")
|
|
os.system("chmod -R a+rX /var/www/html/")
|
|
os.system("ln -sf /var/www/html/index.php /var/www/html/sso.php")
|
|
|
|
try:
|
|
print("Initializing database")
|
|
result = subprocess.check_output(["/var/www/html/bin/initdb.sh", "--dir", "/var/www/html/SQL"],
|
|
stderr=subprocess.STDOUT)
|
|
print(result.decode())
|
|
except subprocess.CalledProcessError as e:
|
|
if "already exists" in e.stdout.decode():
|
|
print("Already initialzed")
|
|
else:
|
|
print(e.stdout.decode())
|
|
quit(1)
|
|
|
|
try:
|
|
print("Upgrading database")
|
|
subprocess.check_call(["/var/www/html/bin/update.sh", "--version=?", "-y"], stderr=subprocess.STDOUT)
|
|
except subprocess.CalledProcessError as e:
|
|
quit(1)
|
|
|
|
# Setup database permissions
|
|
os.system("chown -R www-data:www-data /data")
|
|
|
|
# Tail roundcube logs
|
|
subprocess.Popen(["tail", "-f", "-n", "0", "/var/www/html/logs/errors.log"])
|
|
|
|
# Run apache
|
|
os.execv("/usr/local/bin/apache2-foreground", ["apache2-foreground"])
|