diff --git a/docker-compose.yml b/docker-compose.yml
index 473b33466..1c0d099f4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,5 +1,5 @@
# Version of the database schema
-x-db-version: &db_version DB_VERSION=28102026_1300
+x-db-version: &db_version DB_VERSION=02112026_1600
services:
diff --git a/tests/php/Imapsync/Service/SourceServiceTest.php b/tests/php/Imapsync/Service/SourceServiceTest.php
index 2c13ad978..8028700f2 100644
--- a/tests/php/Imapsync/Service/SourceServiceTest.php
+++ b/tests/php/Imapsync/Service/SourceServiceTest.php
@@ -219,6 +219,23 @@ class SourceServiceTest extends TestCase
$this->service(FakeContext::admin())->create(['name' => 'a', 'host1' => '192.0.2.10', 'port1' => 143, 'enc1' => 'PLAIN']);
}
+ public function testCertificateIsCheckedUnlessTurnedOff(): void
+ {
+ $stored = [];
+ $this->repo->expects($this->exactly(3))->method('insert')->willReturnCallback(function (Source $s) use (&$stored): int {
+ $stored[] = $s->verifyCert;
+ return 1;
+ });
+ $service = $this->service(FakeContext::admin());
+ $basics = ['name' => 'a', 'host' => 'imap.example.org', 'port' => 143, 'enc' => 'TLS'];
+
+ $service->create($basics);
+ $service->create($basics + ['verify_cert' => '0']);
+ $service->create($basics + ['verify_cert' => '1']);
+ $this->assertSame([1, 0, 1], $stored);
+ $this->assertSame(0, Source::fromRow(['verify_cert' => '0'])->toArray(true, '')['verify_cert']);
+ }
+
public function testNameMustBeUniquePerCreator(): void
{
$this->repo->method('nameExists')->with('', 'admin', null)->willReturn(true);
@@ -306,6 +323,22 @@ class SourceServiceTest extends TestCase
$service->update(7, ['description' => 'x']);
}
+ public function testCertificateCheckOnlyTurnsOffWhenAllJobsAreAccessible(): void
+ {
+ $this->repo->method('findVisible')->willReturnOnConsecutiveCalls(
+ self::source(['created_by' => 'u@example.org']),
+ self::source(['created_by' => 'u@example.org', 'verify_cert' => 0])
+ );
+ $this->repo->expects($this->once())->method('jobMailboxes')->willReturn(['u@example.org', 'other@example.org']);
+ // Turning it on needs no check and keeps the tokens
+ $this->repo->expects($this->once())->method('update')
+ ->with($this->callback(fn(Source $s): bool => $s->verifyCert === 1), $this->anything(), false);
+ $service = $this->service(FakeContext::user('u@example.org'));
+
+ $this->expectUserError(['imapsync_source_used_by_others', 'src'], fn() => $service->update(7, ['verify_cert' => '0']));
+ $service->update(7, ['verify_cert' => '1']);
+ }
+
public function testUsersMayNotSwitchToXOAuth2(): void
{
$this->repo->method('findVisible')->willReturn(self::source(['created_by' => 'u@example.org']));
From 9293e4ce43ae2fe5a9a4a44f883489306263d127 Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Wed, 4 Nov 2026 10:39:32 +0100
Subject: [PATCH 21/26] [Web][Dovecot] Do not count denied logins as failed
logins
---
data/conf/dovecot/auth/mailcowauth.php | 10 +++-
data/web/inc/functions.auth.inc.php | 79 ++++++++++++++------------
2 files changed, 52 insertions(+), 37 deletions(-)
diff --git a/data/conf/dovecot/auth/mailcowauth.php b/data/conf/dovecot/auth/mailcowauth.php
index 2865ea083..9a4637506 100644
--- a/data/conf/dovecot/auth/mailcowauth.php
+++ b/data/conf/dovecot/auth/mailcowauth.php
@@ -71,6 +71,8 @@ $isSOGoRequest = $post['real_rip'] == getenv('IPV4_NETWORK') . '.248';
// real_rip is the address that connected to Dovecot (for proxied connections the proxy), client_ip the client (for logs)
$client_ip = filter_var($post['client_ip'] ?? '', FILTER_VALIDATE_IP) ? $post['client_ip'] : $post['real_rip'];
$result = false;
+// set when the password is right, but the account does not allow this login
+$denied = false;
if ($isSOGoRequest) {
// This is a SOGo Auth request. First check for SSO password.
$sogo_sso_pass = file_get_contents("/etc/sogo-sso/sogo-sso.pass");
@@ -93,7 +95,7 @@ if ($result === false){
'service' => $post['service'],
'is_internal' => true,
'remote_addr' => $post['real_rip']
- ));
+ ), $denied);
if ($result) {
error_log('MAILCOWAUTH: App auth for user ' . $post['username'] . " with service " . $service . " from IP " . $client_ip);
set_sasl_log($post['username'], $client_ip, $service);
@@ -104,7 +106,7 @@ if ($result === false){
$iam_provider = identity_provider('init');
$iam_settings = identity_provider('get');
try {
- $result = user_login($post['username'], $post['password'], array('is_internal' => true, 'service' => $post['service']));
+ $result = user_login($post['username'], $post['password'], array('is_internal' => true, 'service' => $post['service']), $denied);
} catch (\Mailcow\Auth\IdpUnavailable $e) {
// temporary failure for Dovecot, no failed login
error_log("MAILCOWAUTH: Identity provider unavailable for user " . $post['username'] . " with service " . $post['service'] . " from IP " . $client_ip . ": " . $e->getMessage());
@@ -122,6 +124,10 @@ if ($result === false){
if ($result) {
http_response_code(200); // OK
$return['success'] = true;
+} elseif ($denied) {
+ // Logged, but no failed login for netfilter: e.g. a client of a shared mailbox or without IMAP access
+ error_log("MAILCOWAUTH: Login denied for user " . $post['username'] . " with service " . $service . " from IP " . $client_ip);
+ http_response_code(401); // Unauthorized
} else {
// Same line for the log and netfilter, which counts it for IMAP, POP3, Sieve and SMTP (Postfix asks Dovecot);
// SOGo logins have their own rule
diff --git a/data/web/inc/functions.auth.inc.php b/data/web/inc/functions.auth.inc.php
index cd88b2a6a..98cc5b931 100644
--- a/data/web/inc/functions.auth.inc.php
+++ b/data/web/inc/functions.auth.inc.php
@@ -6,6 +6,8 @@ function check_login($user, $pass, $extra = null) {
$is_internal = $extra['is_internal'];
$role = $extra['role'];
$extra['service'] = !isset($extra['service']) ? 'NONE' : $extra['service'];
+ // set when the password is right, but the account does not allow this login
+ $denied = false;
// Try validate admin
if (!isset($role) || $role == "admin") {
@@ -26,7 +28,7 @@ function check_login($user, $pass, $extra = null) {
// Try validate app password
if (!isset($role) || $role == "app") {
- $result = apppass_login($user, $pass, $extra);
+ $result = apppass_login($user, $pass, $extra, $denied);
if ($result !== false) {
$real_rip = ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR']);
set_sasl_log($user, $real_rip, $extra['service'], $pass);
@@ -37,7 +39,7 @@ function check_login($user, $pass, $extra = null) {
// Try validate user
if (!isset($role) || $role == "user") {
try {
- $result = user_login($user, $pass, $extra);
+ $result = user_login($user, $pass, $extra, $denied);
} catch (\Mailcow\Auth\IdpUnavailable $e) {
// no failed login, netfilter must not count it
error_log("mailcow UI: Identity provider unavailable for " . $user . " by " . $_SERVER['REMOTE_ADDR'] . ": " . $e->getMessage());
@@ -54,19 +56,20 @@ function check_login($user, $pass, $extra = null) {
return $result;
}
}
-
// skip log and only return false if it's an internal request
if ($is_internal == true) return false;
+ // A denied login is logged, but not counted by netfilter (e.g. EAS/DAV clients of accounts without access)
+ $msg = ($denied ? "mailcow UI: Login denied for " : "mailcow UI: Invalid password for ") . $user . " by " . $_SERVER['REMOTE_ADDR'];
if (!isset($_SESSION['ldelay'])) {
$_SESSION['ldelay'] = "0";
- $redis->publish("F2B_CHANNEL", "mailcow UI: Invalid password for " . $user . " by " . $_SERVER['REMOTE_ADDR']);
- error_log("mailcow UI: Invalid password for " . $user . " by " . $_SERVER['REMOTE_ADDR']);
+ if (!$denied) $redis->publish("F2B_CHANNEL", $msg);
+ error_log($msg);
}
elseif (!isset($_SESSION['mailcow_cc_username'])) {
$_SESSION['ldelay'] = $_SESSION['ldelay']+0.5;
- $redis->publish("F2B_CHANNEL", "mailcow UI: Invalid password for " . $user . " by " . $_SERVER['REMOTE_ADDR']);
- error_log("mailcow UI: Invalid password for " . $user . " by " . $_SERVER['REMOTE_ADDR']);
+ if (!$denied) $redis->publish("F2B_CHANNEL", $msg);
+ error_log($msg);
}
$_SESSION['return'][] = array(
'type' => 'danger',
@@ -207,7 +210,7 @@ function domainadmin_login($user, $pass){
return false;
}
-function user_login($user, $pass, $extra = null){
+function user_login($user, $pass, $extra = null, &$denied = false){
global $pdo;
global $iam_provider;
global $iam_settings;
@@ -261,11 +264,14 @@ function user_login($user, $pass, $extra = null){
if ($extra['service'] != 'NONE') {
$key = strtolower($extra['service']) . "_access";
if (isset($row['attributes'][$key]) && $row['attributes'][$key] != '1') {
+ $denied = true;
return false;
}
}
return true;
}
+ // the IdP accepted the password, the mailbox is inactive
+ $denied = true;
}
clear_session();
return false;
@@ -273,18 +279,16 @@ function user_login($user, $pass, $extra = null){
// check if user has access to service (imap, smtp, pop3, sieve) if service is set
$row['attributes'] = json_decode($row['attributes'], true);
- // Shared mailboxes have no login of their own, members open them through group shares
- if (($row['attributes']['shared'] ?? '0') == '1') {
- return false;
- }
- if ($extra['service'] != 'NONE') {
- $key = strtolower($extra['service']) . "_access";
- if (isset($row['attributes'][$key]) && $row['attributes'][$key] != '1') {
- return false;
+ $key = strtolower($extra['service']) . "_access";
+ // Shared mailboxes have no login of their own, members open them through group shares.
+ // Checked before asking an IdP (no template side effects).
+ if (($row['attributes']['shared'] ?? '0') == '1'
+ || ($extra['service'] != 'NONE' && isset($row['attributes'][$key]) && $row['attributes'][$key] != '1')
+ || $row['active'] != '1' || $row['d_active'] != '1') {
+ // Denied, not failed, unless the password is wrong; IdP passwords are not checked for that
+ if ($row['authsource'] != 'mailcow' || verify_hash($row['password'], $pass) !== false) {
+ $denied = true;
}
- }
- // IdP accounts: refuse inactive mailboxes and domains before asking the IdP (no template side effects)
- if ($row['authsource'] != 'mailcow' && ($row['active'] != '1' || $row['d_active'] != '1')) {
return false;
}
switch ($row['authsource']) {
@@ -303,6 +307,7 @@ function user_login($user, $pass, $extra = null){
$stmt->execute(array(':user' => $user));
$row = $stmt->fetch(PDO::FETCH_ASSOC);
if (empty($row)) {
+ $denied = true;
return false;
}
@@ -361,6 +366,7 @@ function user_login($user, $pass, $extra = null){
$stmt->execute(array(':user' => $user));
$row = $stmt->fetch(PDO::FETCH_ASSOC);
if (empty($row)) {
+ $denied = true;
return false;
}
@@ -403,9 +409,6 @@ function user_login($user, $pass, $extra = null){
return $result;
break;
case 'mailcow':
- if ($row['active'] != 1 || $row['d_active'] != 1) {
- return false;
- }
// verify password
if (verify_hash($row['password'], $pass) !== false) {
@@ -446,13 +449,15 @@ function user_login($user, $pass, $extra = null){
}
return "user";
}
+ // TFA accounts use app passwords in mail clients
+ $denied = true;
}
break;
}
return false;
}
-function apppass_login($user, $pass, $extra = null){
+function apppass_login($user, $pass, $extra = null, &$denied = false){
global $pdo;
$is_internal = $extra['is_internal'];
@@ -473,15 +478,12 @@ function apppass_login($user, $pass, $extra = null){
return false;
}
- // fetch app password data
- $stmt = $pdo->prepare("SELECT `app_passwd`.*, `app_passwd`.`password` as `password`, `app_passwd`.`id` as `app_passwd_id` FROM `app_passwd`
+ // fetch app password data, inactive ones too: their right password is denied, not failed
+ $stmt = $pdo->prepare("SELECT `app_passwd`.*, `app_passwd`.`password` as `password`, `app_passwd`.`id` as `app_passwd_id`,
+ `mailbox`.`active` as `mailbox_active`, `domain`.`active` as `domain_active`, `mailbox`.`attributes` as `mailbox_attributes` FROM `app_passwd`
INNER JOIN `mailbox` ON `mailbox`.`username` = `app_passwd`.`mailbox`
INNER JOIN `domain` ON `mailbox`.`domain` = `domain`.`domain`
WHERE `mailbox`.`kind` NOT REGEXP 'location|thing|group'
- AND `mailbox`.`active` = '1'
- AND `domain`.`active` = '1'
- AND `app_passwd`.`active` = '1'
- AND COALESCE(JSON_UNQUOTE(JSON_VALUE(`mailbox`.`attributes`, '$.shared')), '0') != '1'
AND `app_passwd`.`mailbox` = :user"
);
// fetch password data
@@ -491,16 +493,23 @@ function apppass_login($user, $pass, $extra = null){
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
foreach ($rows as $row) {
- if ($extra['service'] != 'NONE' && $row[strtolower($extra['service']) . '_access'] != '1'){
+ // verify password
+ if (verify_hash($row['password'], $pass) === false) {
continue;
}
- // verify password
- if (verify_hash($row['password'], $pass) !== false) {
- $_SESSION['app_passwd_id'] = $row['app_passwd_id'];
- unset($_SESSION['ldelay']);
- return "user";
+ $mailbox_attributes = json_decode($row['mailbox_attributes'], true);
+ if ($row['active'] != '1' || $row['mailbox_active'] != '1' || $row['domain_active'] != '1'
+ || ($mailbox_attributes['shared'] ?? '0') == '1'
+ || ($extra['service'] != 'NONE' && $row[strtolower($extra['service']) . '_access'] != '1')) {
+ // right password, but the app password does not allow this login
+ $denied = true;
+ continue;
}
+
+ $_SESSION['app_passwd_id'] = $row['app_passwd_id'];
+ unset($_SESSION['ldelay']);
+ return "user";
}
return false;
From 72613e7e2b3deb68c35fc6cc88dea143d24f0bd1 Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Wed, 4 Nov 2026 11:29:00 +0100
Subject: [PATCH 22/26] [Dovecot][Watchdog] Limit the wait for the schema
update to 5 minutes
---
data/Dockerfiles/dovecot/docker-entrypoint.sh | 10 ++++++++--
data/Dockerfiles/watchdog/watchdog.sh | 13 +++++++++++++
docker-compose.yml | 3 ++-
3 files changed, 23 insertions(+), 3 deletions(-)
diff --git a/data/Dockerfiles/dovecot/docker-entrypoint.sh b/data/Dockerfiles/dovecot/docker-entrypoint.sh
index 0a66275f6..f97a3ff6d 100755
--- a/data/Dockerfiles/dovecot/docker-entrypoint.sh
+++ b/data/Dockerfiles/dovecot/docker-entrypoint.sh
@@ -307,12 +307,18 @@ echo "$(envsubst < /usr/local/bin/maildir_gc.sh)" > /usr/local/bin/maildir_gc.sh
# Wait for updated schema (DB_VERSION from docker-compose.yml), the userdb query reads tables the init_db of php-fpm creates on updates
DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
-while [[ "${DBV_NOW}" != "${DB_VERSION}" ]]; do
+DBV_WAIT=0
+while [[ "${DBV_NOW}" != "${DB_VERSION}" ]] && [[ ${DBV_WAIT} -lt 60 ]]; do
echo "Waiting for schema update..."
sleep 5
+ DBV_WAIT=$((DBV_WAIT + 1))
DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
done
-echo "DB schema is ${DBV_NOW}"
+if [[ "${DBV_NOW}" != "${DB_VERSION}" ]]; then
+ echo -e "\e[31mDB schema is ${DBV_NOW}, expected ${DB_VERSION} - starting anyway, check the php-fpm log (init_db)\e[0m"
+else
+ echo "DB schema is ${DBV_NOW}"
+fi
# GUID generation
while [[ ${VERSIONS_OK} != 'OK' ]]; do
diff --git a/data/Dockerfiles/watchdog/watchdog.sh b/data/Dockerfiles/watchdog/watchdog.sh
index 020f3f838..91eb05890 100755
--- a/data/Dockerfiles/watchdog/watchdog.sh
+++ b/data/Dockerfiles/watchdog/watchdog.sh
@@ -43,6 +43,19 @@ while ! mariadb-admin status --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u$
sleep 2
done
+# Wait for the schema update (DB_VERSION) at startup, do not restart them meanwhile.
+DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
+DBV_WAIT=0
+while [[ "${DBV_NOW}" != "${DB_VERSION}" ]] && [[ ${DBV_WAIT} -lt 60 ]]; do
+ echo "Waiting for schema update..."
+ sleep 5
+ DBV_WAIT=$((DBV_WAIT + 1))
+ DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
+done
+if [[ "${DBV_NOW}" != "${DB_VERSION}" ]]; then
+ echo -e "\e[31m$(date) - DB schema is ${DBV_NOW}, expected ${DB_VERSION} - starting checks anyway, check the php-fpm log (init_db)\e[0m"
+fi
+
# Do not attempt to write to slave
if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
REDIS_CMDLINE="redis-cli -h ${REDIS_SLAVEOF_IP} -p ${REDIS_SLAVEOF_PORT} -a ${REDISPASS} --no-auth-warning"
diff --git a/docker-compose.yml b/docker-compose.yml
index 1c0d099f4..05afa2aaa 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -535,7 +535,7 @@ services:
- /lib/modules:/lib/modules:ro
watchdog-mailcow:
- image: ghcr.io/mailcow/watchdog:2.12
+ image: ghcr.io/mailcow/watchdog:2.13
dns:
- ${IPV4_NETWORK:-172.22.1}.254
tmpfs:
@@ -553,6 +553,7 @@ services:
- acme-mailcow
- redis-mailcow
environment:
+ - *db_version
- IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
- LOG_LINES=${LOG_LINES:-9999}
- TZ=${TZ}
From 52f28025a5ac139332e214ce872b26727e489d7c Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Wed, 4 Nov 2026 12:02:18 +0100
Subject: [PATCH 23/26] [Web][Dovecot] imapsync: Block skipmess in custom
params
---
data/Dockerfiles/dovecot/imapsync_runner.py | 2 +-
.../mailcow/Imapsync/Model/CustomParams.php | 2 +-
tests/php/Imapsync/Model/CustomParamsTest.php | 21 +++++++++++++++++++
3 files changed, 23 insertions(+), 2 deletions(-)
diff --git a/data/Dockerfiles/dovecot/imapsync_runner.py b/data/Dockerfiles/dovecot/imapsync_runner.py
index 1d581ac58..ea75e2652 100755
--- a/data/Dockerfiles/dovecot/imapsync_runner.py
+++ b/data/Dockerfiles/dovecot/imapsync_runner.py
@@ -23,7 +23,7 @@ token_min_valid = 900
# Custom params never passed, also when stored before (same list as CustomParams::BLOCKED in the web UI)
blocked_params = {'abort', 'delete2foldersbutnot', 'delete2foldersonly', 'logdir', 'logfile', 'maxlinelengthcmd',
'oauthrefreshcmd1', 'oauthrefreshcmd2', 'passfile1', 'passfile2', 'pidfile', 'pipemess', 'regexflag', 'regexmess',
- 'regextrans2', 'showpasswords', 'tests', 'testsdebug', 'testslive', 'testslive6', 'testsunit', 'tmpdir'}
+ 'regextrans2', 'showpasswords', 'skipmess', 'tests', 'testsdebug', 'testslive', 'testslive6', 'testsunit', 'tmpdir'}
# imapsync only gets these variables, not the secrets of the container environment
job_env_keys = ('PATH', 'LANG', 'LC_ALL', 'TZ')
# A source must not point to mailcow itself (internal Docker network), host1 is checked before each run
diff --git a/data/web/inc/lib/mailcow/Imapsync/Model/CustomParams.php b/data/web/inc/lib/mailcow/Imapsync/Model/CustomParams.php
index 7f31d67d7..2ea8c43d8 100644
--- a/data/web/inc/lib/mailcow/Imapsync/Model/CustomParams.php
+++ b/data/web/inc/lib/mailcow/Imapsync/Model/CustomParams.php
@@ -26,7 +26,7 @@ class CustomParams
*/
public const BLOCKED = ['abort', 'delete2foldersbutnot', 'delete2foldersonly', 'logdir', 'logfile', 'maxlinelengthcmd',
'oauthrefreshcmd1', 'oauthrefreshcmd2', 'passfile1', 'passfile2', 'pidfile', 'pipemess', 'regexflag', 'regexmess',
- 'regextrans2', 'showpasswords', 'tests', 'testsdebug', 'testslive', 'testslive6', 'testsunit', 'tmpdir'];
+ 'regextrans2', 'showpasswords', 'skipmess', 'tests', 'testsdebug', 'testslive', 'testslive6', 'testsunit', 'tmpdir'];
private static bool $warnedOldFormat = false;
diff --git a/tests/php/Imapsync/Model/CustomParamsTest.php b/tests/php/Imapsync/Model/CustomParamsTest.php
index 9ca43eace..674cc15dc 100644
--- a/tests/php/Imapsync/Model/CustomParamsTest.php
+++ b/tests/php/Imapsync/Model/CustomParamsTest.php
@@ -142,6 +142,27 @@ class CustomParamsTest extends TestCase
CustomParams::toJson([['o' => '--tests', 'v' => '']], $allowlist);
}
+ public function testCodeExecutingOptionsAreBlocked(): void
+ {
+ // imapsync evaluates these values as Perl code (eval) or runs them as commands
+ foreach (['delete2foldersbutnot', 'delete2foldersonly', 'maxlinelengthcmd', 'oauthrefreshcmd1', 'oauthrefreshcmd2',
+ 'pipemess', 'regexflag', 'regexmess', 'regextrans2', 'skipmess'] as $option) {
+ $this->assertContains($option, CustomParams::BLOCKED);
+ }
+ }
+
+ public function testRunnerBlocksTheSameOptions(): void
+ {
+ $runner = file_get_contents(__DIR__ . '/../../../../data/Dockerfiles/dovecot/imapsync_runner.py');
+ $this->assertSame(1, preg_match('/^blocked_params = \{(.*?)\}/ms', $runner, $m));
+ preg_match_all("/'([a-z0-9]+)'/", $m[1], $options);
+ $runnerBlocked = $options[1];
+ $blocked = CustomParams::BLOCKED;
+ sort($runnerBlocked);
+ sort($blocked);
+ $this->assertSame($blocked, $runnerBlocked);
+ }
+
public function testOldWhitelistFormatIsIgnored(): void
{
$errorLog = ini_set('error_log', '/dev/null');
From a2ab4301e7ef6daccadb89dc8999fd7a10e62cb5 Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Wed, 4 Nov 2026 15:10:40 +0100
Subject: [PATCH 24/26] [Web][Dovecot][Compose] Keep group shares on Enter, no
restarts while waiting for the schema, run sync crons on master only
---
data/Dockerfiles/dovecot/docker-entrypoint.sh | 5 +++--
data/web/templates/edit/mailbox-group-grant.twig | 2 +-
data/web/templates/edit/mailbox-group-grants.twig | 2 +-
docker-compose.yml | 6 +++---
4 files changed, 8 insertions(+), 7 deletions(-)
diff --git a/data/Dockerfiles/dovecot/docker-entrypoint.sh b/data/Dockerfiles/dovecot/docker-entrypoint.sh
index f97a3ff6d..99bbabcf8 100755
--- a/data/Dockerfiles/dovecot/docker-entrypoint.sh
+++ b/data/Dockerfiles/dovecot/docker-entrypoint.sh
@@ -306,13 +306,14 @@ IMAPSYNC_TABLE=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DB
echo "$(envsubst < /usr/local/bin/maildir_gc.sh)" > /usr/local/bin/maildir_gc.sh
# Wait for updated schema (DB_VERSION from docker-compose.yml), the userdb query reads tables the init_db of php-fpm creates on updates
-DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
+# No error while the versions table is missing (fresh install, set -e)
+DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN 2>/dev/null || true)
DBV_WAIT=0
while [[ "${DBV_NOW}" != "${DB_VERSION}" ]] && [[ ${DBV_WAIT} -lt 60 ]]; do
echo "Waiting for schema update..."
sleep 5
DBV_WAIT=$((DBV_WAIT + 1))
- DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
+ DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN 2>/dev/null || true)
done
if [[ "${DBV_NOW}" != "${DB_VERSION}" ]]; then
echo -e "\e[31mDB schema is ${DBV_NOW}, expected ${DB_VERSION} - starting anyway, check the php-fpm log (init_db)\e[0m"
diff --git a/data/web/templates/edit/mailbox-group-grant.twig b/data/web/templates/edit/mailbox-group-grant.twig
index 5c9c21f39..88fddf12d 100644
--- a/data/web/templates/edit/mailbox-group-grant.twig
+++ b/data/web/templates/edit/mailbox-group-grant.twig
@@ -43,7 +43,7 @@
{% if not ro %}
-
+
{% endif %}
|
diff --git a/data/web/templates/edit/mailbox-group-grants.twig b/data/web/templates/edit/mailbox-group-grants.twig
index 46fea6cb5..0e6953330 100644
--- a/data/web/templates/edit/mailbox-group-grants.twig
+++ b/data/web/templates/edit/mailbox-group-grants.twig
@@ -17,7 +17,7 @@
{% include 'edit/mailbox-group-grant.twig' with {'kind': kind, 'grant': {}} %}
-
+
{% endif %}
{{ attribute(lang.groups, field ~ '_hint') }}
diff --git a/docker-compose.yml b/docker-compose.yml
index a2816c1ab..0635db3e6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -194,13 +194,13 @@ services:
ofelia.enabled: "true"
ofelia.job-exec.phpfpm_identity_sync.schedule: "0 * * * * *"
ofelia.job-exec.phpfpm_identity_sync.no-overlap: "true"
- ofelia.job-exec.phpfpm_identity_sync.command: "/bin/bash -c \"php /crons/identity-sync.php || exit 0\""
+ ofelia.job-exec.phpfpm_identity_sync.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && php /crons/identity-sync.php || exit 0\""
ofelia.job-exec.phpfpm_group_grants.schedule: "0 * * * * *"
ofelia.job-exec.phpfpm_group_grants.no-overlap: "true"
- ofelia.job-exec.phpfpm_group_grants.command: "/bin/bash -c \"php /crons/group-grants.php || exit 0\""
+ ofelia.job-exec.phpfpm_group_grants.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && php /crons/group-grants.php || exit 0\""
ofelia.job-exec.phpfpm_imapsync_oauth_refresh.schedule: "0 * * * * *"
ofelia.job-exec.phpfpm_imapsync_oauth_refresh.no-overlap: "true"
- ofelia.job-exec.phpfpm_imapsync_oauth_refresh.command: "/bin/bash -c \"php /crons/imapsync-oauth-refresh.php || exit 0\""
+ ofelia.job-exec.phpfpm_imapsync_oauth_refresh.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && php /crons/imapsync-oauth-refresh.php || exit 0\""
networks:
mailcow-network:
aliases:
From 716f67844d7f34664e17d6f0a6be061b632143dc Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Wed, 4 Nov 2026 15:44:57 +0100
Subject: [PATCH 25/26] [Web] mobileconfig: Wait for a pending account setup
---
data/web/mobileconfig.php | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/data/web/mobileconfig.php b/data/web/mobileconfig.php
index 02e0e9a56..af387b7c6 100644
--- a/data/web/mobileconfig.php
+++ b/data/web/mobileconfig.php
@@ -12,6 +12,10 @@ if (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != 'use
header('Location: index.php?mobileconfig' . $append_get);
die();
}
+if (!empty($_SESSION['pending_tfa_setup']) || !empty($_SESSION['pending_pw_update'])) {
+ header('Location: /');
+ die();
+}
error_reporting(0);
From 1752dd6ddf74cd501386b57daeae7694ffd90e20 Mon Sep 17 00:00:00 2001
From: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Date: Wed, 4 Nov 2026 16:54:00 +0100
Subject: [PATCH 26/26] [SOGo] Update to 5.12.13
---
data/Dockerfiles/sogo/Dockerfile | 6 +++---
docker-compose.yml | 2 +-
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/data/Dockerfiles/sogo/Dockerfile b/data/Dockerfiles/sogo/Dockerfile
index d55a98901..e93d926bb 100644
--- a/data/Dockerfiles/sogo/Dockerfile
+++ b/data/Dockerfiles/sogo/Dockerfile
@@ -1,6 +1,6 @@
# SOGo built from source to enable security patch application
# Repository: https://github.com/Alinto/sogo
-# Version: SOGo-5.12.12
+# Version: SOGo-5.12.13
#
# Applied security patches:
# -
@@ -12,8 +12,8 @@ FROM debian:bookworm
LABEL maintainer="The Infrastructure Company GmbH
"
ARG DEBIAN_FRONTEND=noninteractive
-ARG SOGO_VERSION=SOGo-5.12.12
-ARG SOPE_VERSION=SOPE-5.12.12
+ARG SOGO_VERSION=SOGo-5.12.13
+ARG SOPE_VERSION=SOPE-5.12.13
# Security patches to apply (space-separated commit hashes)
ARG SOGO_SECURITY_PATCHES=""
# renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?.*)$
diff --git a/docker-compose.yml b/docker-compose.yml
index 0635db3e6..c6e07d7c5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -207,7 +207,7 @@ services:
- phpfpm
sogo-mailcow:
- image: ghcr.io/mailcow/sogo:5.12.12-2
+ image: ghcr.io/mailcow/sogo:5.12.13-1
environment:
- *db_version
- DBNAME=${DBNAME}