public/mailcow-dockerized
1
0 Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-11-05 07:58:20 +00:00
Code Issues Releases Wiki Activity

[Web] App password and API adjustments

Browse Source
This commit is contained in:
FreddleSpl0it committed 2026-10-28 15:29:55 +01:00
1 parent bab03ed88b
commit 44429fa0d0
5 files changed
+21 -5
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/web/inc/functions.auth.inc.php
+8 -3
View File
@@ -474,7 +474,7 @@ function apppass_login($user, $pass, $extra = null){
}
// fetch app password data
$stmt = $pdo->prepare("SELECT `app_passwd`.*, `app_passwd`.`password` as `password`, `app_passwd`.`id` as `app_passwd_id` FROM `app_passwd`
$stmt = $pdo->prepare("SELECT `app_passwd`.*, `app_passwd`.`password` as `password`, `app_passwd`.`id` as `app_passwd_id`, `mailbox`.`attributes` as `mailbox_attributes` FROM `app_passwd`
INNER JOIN `mailbox` ON `mailbox`.`username` = `app_passwd`.`mailbox`
INNER JOIN `domain` ON `mailbox`.`domain` = `domain`.`domain`
WHERE `mailbox`.`kind` NOT REGEXP 'location|thing|group'
@@ -491,8 +491,13 @@ function apppass_login($user, $pass, $extra = null){
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
foreach ($rows as $row) {
if ($extra['service'] != 'NONE' && $row[strtolower($extra['service']) . '_access'] != '1'){
continue;
if ($extra['service'] != 'NONE') {
$key = strtolower($extra['service']) . '_access';
// app passwords never grant a protocol the mailbox itself is denied
$mailbox_attributes = json_decode($row['mailbox_attributes'], true);
if ($row[$key] != '1' || (isset($mailbox_attributes[$key]) && $mailbox_attributes[$key] != '1')) {
continue;
}
}
// verify password