f4961c4023
Merge pull request #7333 from fallmo/fix/cors-settings-validation
...
fix: cors allowed origins settings validation
2026-07-28 15:35:29 +02:00
95a77f2dcb
Merge pull request #7348 from smpaz7467/fix/api-get-mailbox-sender-acl
...
[Web] return sender_acl in get/mailbox API
2026-07-28 14:12:57 +02:00
14772c3a20
[Web] return sender_acl in get/mailbox API
...
sender_acl can be set through edit/mailbox but was never returned by
get/mailbox, so an API client could not read back what it had written,
and get/mailbox/all / get/mailbox/{mailbox} both omitted it.
Add the mailbox's internal send-as ACL (the sender_acl table rows with
external = 0) to mailbox_details as sender_acl, an array of send_as
values, mirroring the field edit/mailbox accepts. It is added in the same
block as the other detailed fields, so the lightweight get/mailbox/reduced
endpoint is unaffected.
Fixes #7011
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-14 16:36:40 -07:00
c17cc8a792
[Web] fix add/time_limited_alias silently discarding requests and validity
...
Three defects in add/time_limited_alias:
The description was read as $_data['description'] without a guard. When a
client omits it, null is bound to spamalias.description, which is TEXT NOT
NULL, so the insert raises a PDOException. The global exception handler is
terminal, so process_add_return() never echoes anything and the caller sees
HTTP 200 with an empty body while no alias was created. Default it to an
empty string instead.
The validity guard used a single condition whose else branch also caught the
success case, so every valid validity was overwritten with the 8760 hour
default and the parameter did nothing. Only invalid values were rejected.
Nest the range check so a valid value survives.
The OpenAPI spec documented only username and domain, while the code also
reads description, validity and permanent. Spec driven clients therefore
could not construct a working request. Document all three.
spamalias.description is the only NOT NULL description column in the schema,
which is why the same unguarded read in add/domain and add/resource does not
fail, both of those columns are nullable.
This does not change the generic exception handling. A database error is
still swallowed into an empty HTTP 200, and the message the handler builds
carries the raw PDOException, so surfacing it to API clients would need
sanitising first. That is left for a separate change.
Refs #7287
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-14 15:23:31 -07:00
6f7fee49cd
fix: cors allowed origins settings validation
2026-07-13 15:29:48 +00:00
2d8db72d46
Merge pull request #7275 from Snafu/fix/admin-mailbox-tfa-missing
...
Fix force_tfa not available in mailbox template #7216
2026-06-11 10:03:39 +02:00
277a307fb9
[Web] Fix refresh SOGo view on mailbox deletion
2026-06-11 09:55:32 +02:00
cce02e2b15
Refresh SOGo view after mailbox activation
2026-06-08 00:01:43 +07:00
0fafda696b
Fix force_tfa not available in mailbox template #7216
2026-06-07 17:03:52 +02:00
4ddcee28e4
Add Uzbek language ( #7224 )
2026-05-13 16:42:38 +02:00
5a00b5124b
[Web][Dovecot] Add parameterized queries and input validation for quarantine_category
2026-03-29 12:08:45 +02:00
8c039f694f
Improve template URI escaping and parameter handling
2026-03-19 12:48:43 +01:00
ecb848493b
add missing object-level access control
2026-03-19 12:42:45 +01:00
8a65b9d1c6
add missing access control
2026-03-19 12:41:47 +01:00
ed9264fd2a
[Web] Allow force_tfa for LDAP and Keycloak users
2026-03-13 14:13:25 +01:00
d1feebf164
[Web] Fix LDAP/Keycloak login TypeError - missing JSON decode for attributes
2026-03-11 09:18:03 +01:00
4e33c7143f
[SOGo][Web] use incremental updates for mailbox/alias/resource sync in sogo_static_view
2026-03-04 11:16:48 +01:00
ddc2309f1e
Merge pull request #7089 from mailcow/fix/7039
...
[Web] switch from GET to POST for datatable requests
2026-03-03 15:07:17 +01:00
ce5659f300
Merge pull request #7082 from JeremieCrinon/fix/show-stopped-containers-api-and-dashboard
...
fix: show stopped and failed containers in dashboard and API
2026-03-03 14:01:03 +01:00
43f570e761
[Web] switch from GET to POST for datatable requests
2026-03-03 08:10:16 +01:00
99dc0f6616
fix: show stopped and failed containers in dashboard and API
2026-02-27 13:41:36 +01:00
96d4802cb2
[Web] Switch QR code generation from external API to local library and fix composer.json/lock mismatch
2026-02-24 11:02:47 +01:00
ad5b94af5e
[Web] Add forced 2FA setup and password update enforcement
2026-02-24 10:44:33 +01:00
c1d4f04c22
Merge branch 'staging' into feat/restrict-alias-sending
2026-01-28 10:02:03 +01:00
82276cd1ca
Merge pull request #7022 from mailcow/feat/eas-dav-access
...
[Web] Allow admins to limit EAS and DAV access for mailbox users
2026-01-28 09:54:47 +01:00
56ea4302ed
[Web] Allow admins to limit EAS and DAV access for mailbox users
2026-01-28 09:49:33 +01:00
c06112b26e
[Postfix] Configurable send permissions for alias addresses
2026-01-27 09:05:51 +01:00
95d61e8aa2
Merge pull request #6980 from bluewalk/feat/issue-6489
...
Configurable displayName(s) - Fixes issue #6489
2026-01-27 08:02:20 +01:00
70101d1187
fix: Password for mobileconfig that conforms to password-complexity policy
2026-01-01 16:57:21 +01:00
c060c205d3
Fixes issue #6489
2025-12-21 16:56:16 +01:00
038b2efb75
Add MTA-STS support for alias domains ( #6972 )
...
* Initial plan
* Add MTA-STS support for alias domains
Co-authored-by: DerLinkman <62480600+DerLinkman@users.noreply.github.com >
* Improve domain normalization and code style in mta-sts.php
Co-authored-by: DerLinkman <62480600+DerLinkman@users.noreply.github.com >
* Add error handling for idn_to_ascii in mta-sts.php
Co-authored-by: DerLinkman <62480600+DerLinkman@users.noreply.github.com >
* Add database error handling for alias domain query
Co-authored-by: DerLinkman <62480600+DerLinkman@users.noreply.github.com >
* Add ACME certificate support for MTA-STS on alias domains
Query alias_domain table to find aliases with MTA-STS enabled target domains and request certificates for mta-sts.<alias-domain> subdomains.
Co-authored-by: DerLinkman <62480600+DerLinkman@users.noreply.github.com >
* compose: bump image tag to 1.95
* Add MTA-STS DNS records display for alias domains in UI
When viewing an alias domain's DNS diagnostics, check if the target domain has MTA-STS enabled and display the required DNS records for the alias domain.
Co-authored-by: DerLinkman <62480600+DerLinkman@users.noreply.github.com >
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
Co-authored-by: DerLinkman <62480600+DerLinkman@users.noreply.github.com >
Co-authored-by: DerLinkman <niklas.meyer@servercow.de >
2025-12-15 16:29:21 +01:00
1ab6af21e3
Merge pull request #6905 from Ashitaka57/6646-pbkdf2-sha512-verify-hash
...
Support for PBKDF2-SHA512 hash algorithm in verify_hash() (FreeIPA compatibility) (issue 6646)
2025-12-10 11:41:06 +01:00
0413d26855
Allow making spam aliases permanent ( #6888 )
...
* Allow making spam aliases permanent
* added german translation
* updated Spamalias Twig + Rename in Spam Alias
* compose: update image tags to align to vendor version
---------
Co-authored-by: DerLinkman <niklas.meyer@servercow.de >
2025-11-13 16:05:01 +01:00
9912e41f78
[Web] Correct order of Dansk/Danish in UI ( #6887 )
2025-11-03 21:07:20 +01:00
23fb5e2fca
Add Vietnamese language ( #6854 )
...
* [Web] Updated lang.vi-vn.json
[Web] Added lang.vi-vn.json
Co-authored-by: Nguyễn Thái Dũng <nguyenthaidung.work+mailcow.email@gmail.com >
Co-authored-by: Peter <magic@kthx.at >
Co-authored-by: milkmaker <milkmaker@mailcow.de >
* Add Vietnamese language
---------
Co-authored-by: Nguyễn Thái Dũng <nguyenthaidung.work+mailcow.email@gmail.com >
Co-authored-by: Peter <magic@kthx.at >
2025-10-20 18:35:00 +02:00
b85837c803
[Web] Add password verification when setting recovery email
2025-10-13 12:05:17 +02:00
455ef084b4
[Web] clear old app_passwd log entries
2025-10-07 10:37:44 +02:00
c2948735f2
[Web] clear old app_passwd log entries
2025-10-07 10:18:07 +02:00
1ef0149076
[Web] make SameSite policy and cookie name configurable via vars.local.inc
2025-10-06 11:00:03 +02:00
922d173540
[Web] include hostname in default website title
2025-10-06 10:58:35 +02:00
2e7eb7c0fd
Merge pull request #6780 from patschi/fix-pwcomplexity-apppasswds
...
Fixed password complexity check for AppPasswords creation/edit
2025-09-29 11:53:26 +02:00
4c83147d01
Merge pull request #6781 from patschi/pw-field-name-consistency
...
Rename password fields for AppPasswords same way for consistency
2025-09-29 11:52:08 +02:00
702ed85dfd
Fixed footer escaping
2025-09-26 14:41:19 +02:00
ce219668cf
Rename AppPasswds fields uniquely like 'add'
2025-09-26 03:37:49 +02:00
5b1b49a418
Fixed password complexity check for AppPasswords
2025-09-26 02:37:02 +02:00
8ead77083f
[Web] Rename PHP Cookie to MCSESSID
2025-09-23 12:39:48 +02:00
4440bd46ad
[Web] set cookie SameSite attribute to Lax
2025-09-23 12:24:25 +02:00
28985973eb
[Web] Revert - allow "*" as wildcard domain
2025-09-23 10:07:33 +02:00
ed4dcff63b
[Web] allow "*" as wildcard domain
2025-09-22 14:42:14 +02:00
a36485f0f1
[Web] Allow wildcard subdomains for MTA-STS
2025-09-22 13:55:18 +02:00
FreddleSpl0it