public/mailcow-dockerized
1
0 Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-11-05 07:58:20 +00:00
Code Issues Releases Wiki Activity

Merge branch 'fix/sec' into fix/rework-bugs

Browse Source
This commit is contained in:
FreddleSpl0it committed 2026-11-04 11:46:47 +01:00
2 parents 72613e7e2b 510674ee67
commit 3c03f8e567
22 files changed
+212 -104
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/web/inc/functions.auth.inc.php
+3 -1
View File
@@ -498,10 +498,12 @@ function apppass_login($user, $pass, $extra = null, &$denied = false){
continue;
}
$key = strtolower($extra['service']) . '_access';
$mailbox_attributes = json_decode($row['mailbox_attributes'], true);
// app passwords never grant a protocol the mailbox itself is denied
if ($row['active'] != '1' || $row['mailbox_active'] != '1' || $row['domain_active'] != '1'
|| ($mailbox_attributes['shared'] ?? '0') == '1'
|| ($extra['service'] != 'NONE' && $row[strtolower($extra['service']) . '_access'] != '1')) {
|| ($extra['service'] != 'NONE' && ($row[$key] != '1' || (isset($mailbox_attributes[$key]) && $mailbox_attributes[$key] != '1')))) {
// right password, but the app password does not allow this login
$denied = true;
continue;