[Web] Domain admins: show sender ACL and alias entries of their own domains only

data/web/inc/functions.mailbox.inc.php

@@ -3988,6 +3988,9 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
           $stmt->execute(array(':goto' => '(^|,)'.preg_quote($_data, '/').'($|,)'));
           $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
           while ($row = array_shift($rows)) {
+            if (!hasAliasObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $row['address'])) {
+              continue;
+            }
             // Keep old array for backward compatibility
             $data['fixed_sender_aliases'][] = $row['address'];
             // Split into allowed/blocked for proper display
@@ -4977,7 +4980,16 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             $stmt->execute(array(':username' => $_data));
             $sender_acl_rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
             foreach ($sender_acl_rows as $sender_acl_row) {
-              $mailboxdata['sender_acl'][] = $sender_acl_row['send_as'];
+              $send_as = $sender_acl_row['send_as'];
+              if ($_SESSION['mailcow_cc_role'] == 'domainadmin' && $send_as != '*') {
+                $in_scope = (substr($send_as, 0, 1) == '@')
+                  ? hasDomainAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], substr($send_as, 1))
+                  : hasAliasObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $send_as);
+                if (!$in_scope) {
+                  continue;
+                }
+              }
+              $mailboxdata['sender_acl'][] = $send_as;
             }
           }
           $stmt = $pdo->prepare("SELECT `tag_name`

data/web/json_api.php

@@ -1087,14 +1087,18 @@ if (isset($_GET['query'])) {
                   $data['mailboxes'][$mailbox][] = $mailbox;
                   $user_alias_details = user_get_alias_details($mailbox);
                   foreach ($user_alias_details['direct_aliases'] as $k => $v) {
+                    if (hasDomainAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], substr(strrchr($k, '@'), 1))) {
                       $data['mailboxes'][$mailbox][] = $k;
                     }
+                  }
                   foreach ($user_alias_details['shared_aliases'] as $k => $v) {
+                    if (hasDomainAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], substr(strrchr($k, '@'), 1))) {
                       $data['mailboxes'][$mailbox][] = $k;
                     }
                   }
                 }
               }
+            }
             if (!empty($alias_domains)) {
               foreach ($alias_domains as $alias_domain) {
                 $data['alias_domains'][] = $alias_domain;

data/web/templates/edit/mailbox.twig

@@ -97,9 +97,11 @@
                     <div class="col-sm-10">
                       <select data-live-search="true" data-width="100%" style="width:100%" id="editSelectSenderACL" name="sender_acl" size="10" multiple>
                         {% for domain in sender_acl_handles.sender_acl_domains.ro %}
+                          {% if domain == '*' or mailcow_cc_role == 'admin' %}
                             <option data-subtext="Admin" value="{{ domain }}" disabled selected>
                               {{ lang.edit.dont_check_sender_acl|format(domain) }}
                             </option>
+                          {% endif %}
                         {% endfor %}
                         {% for domain in sender_acl_handles.sender_acl_domains.rw %}
                           <option value="{{ domain }}" selected>