public/mailcow-dockerized
1
0 Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-11-04 23:48:22 +00:00
Code Issues Releases Wiki Activity

[Web] Mask IdP secrets for read-only API keys, deny sync job OAuth to read-only and pending sessions

Browse Source
This commit is contained in:
FreddleSpl0it committed 2026-11-02 09:56:24 +01:00
1 parent 5eb3148bd5
commit 4b7ebab8f3
2 files changed
+11 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/web/json_api.php
+8 -1
View File
@@ -1549,7 +1549,14 @@ if (isset($_GET['query'])) {
if ($object == "sync-status") { if ($object == "sync-status") {
process_get_return(\Mailcow\Identity\IdentityModule::fromGlobals()->api->getStatus()); process_get_return(\Mailcow\Identity\IdentityModule::fromGlobals()->api->getStatus());
} elseif($_SESSION['mailcow_cc_role'] === 'admin') { } elseif($_SESSION['mailcow_cc_role'] === 'admin') {
process_get_return($iam_settings); $iam_settings_out = $iam_settings;
// Read-only API keys never get the secrets of the identity provider
if (($_SESSION['mailcow_cc_api_access'] ?? '') == 'ro') {
foreach (array('client_secret', 'bindpass', 'access_token') as $iam_secret) {
if (isset($iam_settings_out[$iam_secret])) $iam_settings_out[$iam_secret] = '*';
}
}
process_get_return($iam_settings_out);
} else { } else {
process_get_return(null); process_get_return(null);
} }
data/web/syncjob-oauth.php
+3 -1
View File
@@ -35,7 +35,9 @@ if (empty($_SESSION['mailcow_cc_username']) || empty($_SESSION['mailcow_cc_role'
} }
$context = \Mailcow\Core\Context::fromSession($_SESSION); $context = \Mailcow\Core\Context::fromSession($_SESSION);
$imapsync = \Mailcow\Imapsync\ImapsyncModule::fromGlobals($context); $imapsync = \Mailcow\Imapsync\ImapsyncModule::fromGlobals($context);
if (!$context->hasAcl('syncjobs')) { // Storing a token is a write: no read-only API keys, no session with pending 2FA setup or password update
if (!$context->hasAcl('syncjobs') || $context->isReadOnlyApi()
|| !empty($_SESSION['pending_tfa_setup']) || !empty($_SESSION['pending_pw_update'])) {
syncjob_oauth_finish(false, array('error' => 'access_denied')); syncjob_oauth_finish(false, array('error' => 'access_denied'));
} }