FreddleSpl0it
c5e89a9e03
Merge pull request #7633 from mailcow/fix/7501
...
[Web] Forwarding hosts: store IPv6 addresses in canonical form
2026-11-09 23:25:40 +01:00
FreddleSpl0it
45d31b3279
[Web] Forwarding hosts: store IPv6 addresses in canonical form
2026-11-09 23:24:39 +01:00
FreddleSpl0it
f810cecd3a
Merge pull request #7630 from mailcow/fix/7476
...
[Web] force_tfa did not prevent removing 2FA
2026-11-09 23:14:38 +01:00
FreddleSpl0it
cfad223824
[Web] force_tfa: read the flag with JSON_VALUE
2026-11-09 23:13:26 +01:00
FreddleSpl0it
1911847c3b
Merge pull request #7625 from mailcow/fix/6931
...
[Web] Update "Last modified" when tags of a domain or mailbox change
2026-11-09 22:48:21 +01:00
FreddleSpl0it
497872080b
[Web] Update "Last modified" when tags of a domain or mailbox change
2026-11-09 22:46:15 +01:00
FreddleSpl0it
e0640949a2
[Web][Dovecot] Show the last SOGo login in the mailbox list and API
2026-11-09 22:39:42 +01:00
FreddleSpl0it
6a83b9e0f0
[Web] Mailbox protocols do not limit app passwords
2026-11-05 12:46:22 +01:00
FreddleSpl0it
e8f12cd061
[Web] Add Netfilter unban all button
2026-11-04 22:23:16 +01:00
FreddleSpl0it
52f28025a5
[Web][Dovecot] imapsync: Block skipmess in custom params
2026-11-04 12:02:18 +01:00
FreddleSpl0it
3c03f8e567
Merge branch 'fix/sec' into fix/rework-bugs
2026-11-04 11:46:47 +01:00
FreddleSpl0it
9293e4ce43
[Web][Dovecot] Do not count denied logins as failed logins
2026-11-04 10:39:32 +01:00
FreddleSpl0it
a8d1121f0e
[Dovecot][Web] imapsync: verify certificates against the source host, make the check optional per source
2026-11-03 09:31:16 +01:00
FreddleSpl0it
a4b60ae26f
[Netfilter][Dovecot] Count failed master logins, log the client address of successful logins
2026-11-02 14:55:42 +01:00
FreddleSpl0it
7c73199bde
[Web] Groups: limit changes of domain admins to their domains
2026-11-02 10:01:43 +01:00
FreddleSpl0it
5eb3148bd5
[Web] OIDC/LDAP: check the OAuth state, keep the mailbox on token refresh, require unique IdP users
2026-11-02 09:54:54 +01:00
FreddleSpl0it
41467dc47f
[Web] imapsync: change the server of a sync source only with access to all its sync jobs
2026-11-02 09:50:24 +01:00
FreddleSpl0it
a1cbd51d70
[Dovecot][Web] imapsync: restrict custom parameters and source hosts, verify certificates
2026-11-02 09:49:03 +01:00
FreddleSpl0it
510674ee67
[Web] Pending account setup adjustments
2026-10-28 17:11:25 +01:00
FreddleSpl0it
9eb3a79f3b
[Web] Quarantine list adjustments
2026-10-28 16:16:00 +01:00
FreddleSpl0it
d5e3de3ae8
[Web] Add TFA Ratelimit
2026-10-28 16:04:45 +01:00
FreddleSpl0it
44429fa0d0
[Web] App password and API adjustments
2026-10-28 15:29:55 +01:00
FreddleSpl0it
4dd7aead73
[Web] Store PKCE data of OAuth2 authorization codes
2026-10-28 11:57:46 +01:00
FreddleSpl0it
bd8c784118
[Web] Update composer libraries
2026-10-28 11:56:29 +01:00
FreddleSpl0it
1c7c328a2a
[Web][Netfilter] Fix netban limits, no negative ban times, save lists atomically, check banlist id
2026-10-27 12:53:01 +01:00
FreddleSpl0it
7457fd59aa
[Web][Dovecot] Do not count logins as failed while the identity provider is unavailable
2026-10-27 12:46:24 +01:00
FreddleSpl0it
2c5718c9c9
[Web][Dovecot][SOGo][DockerApi] Add mailbox groups, shared mailboxes and identity provider sync
2026-10-27 10:01:33 +01:00
FreddleSpl0it
f63042bbaf
[Web] Bind API sessions to their key
2026-10-23 11:22:32 +02:00
FreddleSpl0it
4828f0cf64
[Web] Restrict read-only API sessions
2026-10-23 11:21:45 +02:00
FreddleSpl0it
0dadf49934
[Web] Rework API keys: multiple read-only/read-write keys, service keys from mailcow.conf
2026-10-23 11:20:17 +02:00
FreddleSpl0it
c145f858e2
[Web][Dovecot] imapsync: update to 2.314, refresh OAuth tokens of running jobs, add source presets
2026-10-22 18:27:49 +02:00
FreddleSpl0it
7c62a57910
[Web][Dovecot] Rework imapsync: sync sources, OAuth2 (XOAUTH2), worker pool, Python runner
2026-10-22 10:07:52 +02:00
FreddleSpl0it
b2a152fe45
[Web] Add Mailcow\ class structure and imapsync module classes
2026-10-22 10:07:43 +02:00
FreddleSpl0it
571c1b5b29
[Web] Update Bootstrap to 5.3.8, add theme support
2026-10-15 14:43:06 +02:00
FreddleSpl0it
ed4fe41d7a
Merge pull request #7349 from smpaz7467/fix/login-redirect-deeplink
...
[Web] redirect deep links to the matching login page
2026-08-18 14:37:32 +02:00
FreddleSpl0it
6b9d875773
Merge pull request #7347 from smpaz7467/fix/dns-zonefile-absolute-rhs
...
[Web] use absolute RHS names in generated DNS zonefile
2026-08-18 14:30:50 +02:00
FreddleSpl0it
8bd9e12a73
[Web] Add ACL + global switch to disable external alias goto
2026-08-18 14:07:37 +02:00
FreddleSpl0it
91d3b7246a
[Web] Minor hardening across web UI and nginx
2026-08-18 09:08:17 +02:00
FreddleSpl0it
2d5f166ba8
Merge pull request #7389 from mailcow/fix/default-mbox-template
...
[Web] Create default mailbox template with eas and dav access
2026-07-30 09:23:24 +02:00
FreddleSpl0it
94b5a623ab
Merge pull request #7388 from mailcow/fix/7329
...
[Web] Move mailcow update check to server side
2026-07-30 09:13:19 +02:00
FreddleSpl0it
e406ecd461
Merge pull request #7387 from mailcow/fix/mfk25
...
Hardening mailcow
2026-07-30 09:07:10 +02:00
FreddleSpl0it
36c70db86c
[Web] harden CORS origin matching and add Vary: Origin
2026-07-30 08:37:18 +02:00
FreddleSpl0it
f4961c4023
Merge pull request #7333 from fallmo/fix/cors-settings-validation
...
fix: cors allowed origins settings validation
2026-07-28 15:35:29 +02:00
FreddleSpl0it
95a77f2dcb
Merge pull request #7348 from smpaz7467/fix/api-get-mailbox-sender-acl
...
[Web] return sender_acl in get/mailbox API
2026-07-28 14:12:57 +02:00
FreddleSpl0it
54170d075a
[Web] Move mailcow update check to server side
2026-07-28 13:32:18 +02:00
FreddleSpl0it
cc9af65852
[Web] remove domain admin sso token after use
2026-07-24 10:26:23 +02:00
FreddleSpl0it
92cc8bec90
[Web] Use parameterized LIKE for sogo_acl deletion
2026-07-23 15:29:41 +02:00
FreddleSpl0it
145745329e
[Web] add dot stuffing for quarantine raw release
2026-07-23 15:01:44 +02:00
Stephen Ritz and Claude Opus 4.8
90ca1bf25a
[Web] redirect deep links to the matching login page
...
An unauthenticated request to a deep link such as /admin/dashboard was
redirected to /, the user login, instead of the admin login. protect_route
always sent unauthenticated visitors to /.
Pick the login page from the request path: /admin/* redirects to /admin,
/domainadmin/* to /domainadmin, everything else to / as before.
Fixes #7284
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-14 16:39:19 -07:00
Stephen Ritz and Claude Opus 4.8
14772c3a20
[Web] return sender_acl in get/mailbox API
...
sender_acl can be set through edit/mailbox but was never returned by
get/mailbox, so an API client could not read back what it had written,
and get/mailbox/all / get/mailbox/{mailbox} both omitted it.
Add the mailbox's internal send-as ACL (the sender_acl table rows with
external = 0) to mailbox_details as sender_acl, an array of send_as
values, mirroring the field edit/mailbox accepts. It is added in the same
block as the other detailed fields, so the lightweight get/mailbox/reduced
endpoint is unaffected.
Fixes #7011
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-14 16:36:40 -07:00
FreddleSpl0it