public/mailcow-dockerized
1
0 Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-11-05 07:58:20 +00:00
Code Issues Releases Wiki Activity

[Web] Mask IdP secrets for read-only API keys, deny sync job OAuth to read-only and pending sessions

Browse Source
This commit is contained in:
FreddleSpl0it committed 2026-11-02 09:56:24 +01:00
1 parent 5eb3148bd5
commit 4b7ebab8f3
2 files changed
+11 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/web/syncjob-oauth.php
+3 -1
View File
@@ -35,7 +35,9 @@ if (empty($_SESSION['mailcow_cc_username']) || empty($_SESSION['mailcow_cc_role'
}
$context = \Mailcow\Core\Context::fromSession($_SESSION);
$imapsync = \Mailcow\Imapsync\ImapsyncModule::fromGlobals($context);
if (!$context->hasAcl('syncjobs')) {
// Storing a token is a write: no read-only API keys, no session with pending 2FA setup or password update
if (!$context->hasAcl('syncjobs') || $context->isReadOnlyApi()
|| !empty($_SESSION['pending_tfa_setup']) || !empty($_SESSION['pending_pw_update'])) {
syncjob_oauth_finish(false, array('error' => 'access_denied'));
}