[Web] Add ACL + global switch to disable external alias goto

Merge pull request #7426 from mailcow/fix/web-hardening
[Web] Minor hardening across web UI and nginx
2026-08-18 17:47:06 +00:00 · 2026-08-18 14:07:37 +02:00 · 2026-08-18 09:10:09 +02:00 · 2026-08-18 09:08:17 +02:00 · 2026-08-18 08:14:21 +02:00 · 2026-08-18 08:12:32 +02:00
18 changed files with 144 additions and 35 deletions
@@ -30,6 +30,8 @@ A big thank you to everyone supporting us on GitHub Sponsors—your contribution
 ### 50$/Month Sponsors
  <a href="https://github.com/vnukhr" target=_blank><img
    src="https://avatars.githubusercontent.com/u/7805987?s=52&v=4" height="58"
+  /></a><a href="https://github.com/humiico" target=_blank><img
+    src="https://avatars.githubusercontent.com/u/110134705?s=52&v=4" height="58"
  /></a>

 ## Info, documentation and support
@@ -1,7 +1,7 @@
-FROM alpine:3.21 AS builder
+FROM alpine:3.24 AS builder

 WORKDIR /src
-ENV CLAMD_VERSION=1.4.2
+ENV CLAMD_VERSION=1.4.6

 RUN apk upgrade --no-cache \
  && apk add --update --no-cache \
@@ -68,7 +68,7 @@ RUN wget -P /src https://www.clamav.net/downloads/production/clamav-${CLAMD_VERS
  "/clamav/etc/clamav/clamav-milter.conf.sample" > "/clamav/etc/clamav/clamav-milter.conf" || exit 1


-FROM alpine:3.21
+FROM alpine:3.24

 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"

@@ -12,8 +12,8 @@ FROM debian:bookworm
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

 ARG DEBIAN_FRONTEND=noninteractive
-ARG SOGO_VERSION=SOGo-5.12.9
-ARG SOPE_VERSION=SOPE-5.12.9
+ARG SOGO_VERSION=SOGo-5.12.10
+ARG SOPE_VERSION=SOPE-5.12.10
 # Security patches to apply (space-separated commit hashes)
 ARG SOGO_SECURITY_PATCHES=""
 # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?<version>.*)$
@@ -1,13 +1,3 @@
 # global_sieve_before script
 # global_sieve_before -> user sieve_before (mailcow UI) -> user sieve_after (mailcow UI) -> global_sieve_after

-require ["mailbox", "fileinto"];
-
-if header :contains ["Chat-Version"] [""] {
-  if mailboxexists "DeltaChat" {
-    fileinto "DeltaChat";
-  } else {
-    fileinto :create "DeltaChat";
-  }
-  stop;
-}
@@ -116,6 +116,7 @@ location ~ \.php$ {
    include /etc/nginx/fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param PATH_INFO $fastcgi_path_info;
+    fastcgi_param HTTP_X_REAL_IP $remote_addr;
    # trusted internal-auth marker; empty for external clients (see nginx.conf map)
    fastcgi_param SOGO_AUTH_INTERNAL $sogo_auth_internal;
    fastcgi_read_timeout 3600;
@@ -1,6 +1,6 @@
-# Whitelist generated by Postwhite v3.4 on Wed Jul  1 00:51:20 UTC 2026
+# Whitelist generated by Postwhite v3.4 on Sat Aug  1 00:35:20 UTC 2026
 # https://github.com/stevejenkins/postwhite/
-# 2251 total rules
+# 2256 total rules
 2a00:1450:4000::/36	permit
 2a00:1450:4864::/56	permit
 2a01:111:f400::/48	permit
@@ -29,6 +29,7 @@
 2a01:b747:3004:200::/56	permit
 2a01:b747:3005:200::/56	permit
 2a01:b747:3006:200::/56	permit
+2a01:b747:3007::/56	permit
 2a02:a60:0:5::/64	permit
 2a0f:f640::/56	permit
 2c0f:fb50:4000::/36	permit
@@ -56,7 +57,14 @@
 8.25.194.0/23	permit
 8.25.196.0/23	permit
 8.36.116.0/24	permit
+8.39.54.0/23	permit
+8.39.54.240/29	permit
+8.39.54.250/31	permit
 8.39.144.0/24	permit
+8.40.222.0/23	permit
+8.40.222.240/29	permit
+8.40.222.250/31	permit
+8.47.10.9	permit
 12.130.86.238	permit
 13.108.16.0/20	permit
 13.110.208.0/21	permit
@@ -67,6 +75,7 @@
 13.111.191.0/24	permit
 13.216.7.111	permit
 13.216.54.180	permit
+13.247.164.219	permit
 15.200.21.50	permit
 15.200.44.248	permit
 15.200.201.185	permit
@@ -170,6 +179,7 @@
 34.215.104.144	permit
 34.218.115.239	permit
 34.225.212.172	permit
+34.241.242.183	permit
 35.83.148.184	permit
 35.155.198.111	permit
 35.158.23.94	permit
@@ -193,6 +203,7 @@
 40.233.64.216	permit
 40.233.83.78	permit
 40.233.88.28	permit
+43.239.212.33	permit
 44.206.138.57	permit
 44.210.169.44	permit
 44.217.45.156	permit
@@ -275,6 +286,7 @@
 51.83.17.38	permit
 52.1.14.157	permit
 52.5.230.59	permit
+52.6.74.205	permit
 52.12.53.23	permit
 52.13.214.179	permit
 52.26.1.71	permit
@@ -331,6 +343,7 @@
 54.244.54.130	permit
 54.244.242.0/24	permit
 54.255.61.23	permit
+56.124.6.228	permit
 57.103.64.0/18	permit
 57.129.93.249	permit
 62.13.128.0/24	permit
@@ -397,6 +410,7 @@
 65.110.161.77	permit
 65.123.29.213	permit
 65.123.29.220	permit
+65.154.166.0/24	permit
 65.212.180.36	permit
 66.102.0.0/20	permit
 66.119.150.192/26	permit
@@ -1210,6 +1224,9 @@
 99.78.197.208/28	permit
 103.9.96.0/22	permit
 103.28.42.0/24	permit
+103.84.217.15	permit
+103.84.217.238	permit
+103.89.75.238	permit
 103.151.192.0/23	permit
 103.168.172.128/27	permit
 103.237.104.0/22	permit
@@ -1370,6 +1387,10 @@
 117.120.16.0/21	permit
 119.42.242.52/31	permit
 119.42.242.156	permit
+121.244.91.31	permit
+121.244.91.48	permit
+121.244.91.52	permit
+122.15.156.182	permit
 123.126.78.64/29	permit
 124.108.96.24/31	permit
 124.108.96.28/31	permit
@@ -1452,7 +1473,21 @@
 134.170.141.64/26	permit
 134.170.143.0/24	permit
 134.170.174.0/24	permit
+135.84.80.0/24	permit
+135.84.81.0/24	permit
+135.84.82.0/24	permit
+135.84.83.0/24	permit
 135.84.216.0/22	permit
+136.143.160.0/24	permit
+136.143.161.0/24	permit
+136.143.162.0/24	permit
+136.143.176.0/24	permit
+136.143.177.0/24	permit
+136.143.178.49	permit
+136.143.182.0/23	permit
+136.143.184.0/24	permit
+136.143.188.0/24	permit
+136.143.190.0/23	permit
 136.146.128.0/20	permit
 136.147.128.0/20	permit
 136.147.135.0/24	permit
@@ -1472,6 +1507,7 @@
 139.138.46.219	permit
 139.138.57.55	permit
 139.138.58.119	permit
+139.167.79.86	permit
 139.177.108.0/25	permit
 139.180.17.0/24	permit
 140.238.148.191	permit
@@ -1528,7 +1564,7 @@
 149.97.173.180	permit
 149.118.160.128/25	permit
 150.136.21.199	permit
-150.171.109.183	permit
+150.171.109.72	permit
 150.230.98.160	permit
 151.145.38.14	permit
 152.67.105.195	permit
@@ -1643,6 +1679,19 @@
 168.245.12.252	permit
 168.245.46.9	permit
 168.245.127.231	permit
+169.148.129.0/24	permit
+169.148.131.0/24	permit
+169.148.138.0/24	permit
+169.148.142.10	permit
+169.148.142.33	permit
+169.148.144.0/25	permit
+169.148.144.10	permit
+169.148.146.0/23	permit
+169.148.174.10	permit
+169.148.175.3	permit
+169.148.179.3	permit
+169.148.188.0/24	permit
+169.148.188.182	permit
 170.9.232.254	permit
 170.10.128.0/24	permit
 170.10.129.0/24	permit
@@ -1849,7 +1898,16 @@
 199.16.156.0/22	permit
 199.33.145.1	permit
 199.33.145.32	permit
+199.34.22.36	permit
 199.59.148.0/22	permit
+199.67.80.2	permit
+199.67.80.20	permit
+199.67.82.2	permit
+199.67.82.20	permit
+199.67.84.0/24	permit
+199.67.86.0/24	permit
+199.67.88.0/24	permit
+199.67.90.0/24	permit
 199.101.161.130	permit
 199.101.162.0/25	permit
 199.122.120.0/21	permit
@@ -1905,6 +1963,8 @@
 204.92.114.187	permit
 204.92.114.203	permit
 204.92.114.204/31	permit
+204.141.32.0/23	permit
+204.141.42.0/23	permit
 204.216.164.202	permit
 204.220.160.0/21	permit
 204.220.168.0/21	permit
@@ -2178,7 +2238,7 @@
 2001:748:400:3301::4	permit
 2404:6800:4000::/36	permit
 2404:6800:4864::/56	permit
-2603:1061:14:1c2::1	permit
+2603:1061:14:75::1	permit
 2607:13c0:0001:0000:0000:0000:0000:7000/116	permit
 2607:13c0:0002:0000:0000:0000:0000:1000/116	permit
 2607:13c0:0004:0000:0000:0000:0000:0000/116	permit
@@ -380,13 +380,13 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
            else {
              $state = state_nomatch;
            }
-            $state .= '<br />' . $current[$data_field[$current['type']]];
+            $state .= '<br />' . htmlspecialchars($current[$data_field[$current['type']]]);
          }
          if ($current['type'] == 'TXT' &&
              stripos($current['txt'], 'v=dmarc') === 0 &&
              $record[2] == $dmarc_link) {
            $current['txt'] = str_replace(' ', '', $current['txt']);
-            $state = $current[$data_field[$current['type']]] . state_optional;
+            $state = htmlspecialchars($current[$data_field[$current['type']]]) . state_optional;
          }
          elseif ($current['type'] == 'TXT' &&
                  stripos($current['txt'], 'v=spf') === 0 &&
@@ -396,7 +396,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
            if (in_array($ip, $rslt) && in_array(expand_ipv6($ip6), $rslt)) {
              $state = state_good;
            }
-            $state .= '<br />' . $current[$data_field[$current['type']]] . state_optional;
+            $state .= '<br />' . htmlspecialchars($current[$data_field[$current['type']]]) . state_optional;
          }
          elseif ($current['type'] == 'TXT' &&
                  stripos($current['txt'], 'v=dkim') === 0 &&
@@ -426,7 +426,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
        if ($state == state_nomatch) {
          $state = array();
          foreach ($currents as $current) {
-            $state[] = $current[$data_field[$current['type']]];
+            $state[] = htmlspecialchars($current[$data_field[$current['type']]]);
          }
          $state = implode('<br />', $state);
        }
@@ -436,7 +436,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
          <td>%s</td>
          <td class="dns-found">%s</td>
          <td class="dns-recommended">%s</td>
-        </tr>', $record[0], $record[1], $record[2], $state);
+        </tr>', htmlspecialchars($record[0]), htmlspecialchars($record[1]), $record[2], $state);
        $record[3] = explode('<br />', $state);
      }

@@ -477,7 +477,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
      }
      ?>
    </table>
-    <a id='download-zonefile' class="btn btn-sm btn-secondary visible-xs-block visible-sm-inline visible-md-inline visible-lg-inline mb-4" style="margin-top:10px" data-zonefile="<?=base64_encode($dns_data);?>" download='<?=$_GET['domain'];?>.txt' type='text/csv'>Download</a>
+    <a id='download-zonefile' class="btn btn-sm btn-secondary visible-xs-block visible-sm-inline visible-md-inline visible-lg-inline mb-4" style="margin-top:10px" data-zonefile="<?=base64_encode($dns_data);?>" download='<?=htmlspecialchars($_GET['domain']);?>.txt' type='text/csv'>Download</a>
    <script>
      var zonefile_dl_link = document.getElementById('download-zonefile');
      var zonefile = atob(zonefile_dl_link.getAttribute('data-zonefile'));
@@ -591,7 +591,7 @@ function logger($_data = false) {
      $type = $return['type'];
      $msg = null;
      if (isset($return['msg'])) {
-        $msg = json_encode($return['msg'], JSON_UNESCAPED_UNICODE);
+        $msg = json_encode($return['msg'], JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
      }
      $call = null;
      if (isset($return['log'])) {
@@ -633,6 +633,18 @@ function logger($_data = false) {
    return true;
  }
 }
+function is_local_mailcow_domain($domain) {
+  // True if domain is a locally managed, active primary or alias domain
+  global $pdo;
+  $domain = idn_to_ascii($domain, 0, INTL_IDNA_VARIANT_UTS46);
+  if (empty($domain)) {
+    return false;
+  }
+  $stmt = $pdo->prepare("SELECT 1 FROM `domain` WHERE `domain` = :d AND `active` = 1
+    UNION SELECT 1 FROM `alias_domain` WHERE `alias_domain` = :d2 AND `active` = 1 LIMIT 1");
+  $stmt->execute(array(':d' => $domain, ':d2' => $domain));
+  return (bool)$stmt->fetchColumn();
+}
 function hasDomainAccess($username, $role, $domain) {
  global $pdo;
  if (empty($domain) || !is_valid_domain_name($domain)) {
@@ -750,6 +750,18 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              $goto_domain = idn_to_ascii(substr(strstr($goto, '@'), 1), 0, INTL_IDNA_VARIANT_UTS46);
              $goto_local_part = strstr($goto, '@', true);
              $goto = $goto_local_part.'@'.$goto_domain;
+              // Deny external goto domains: global switch (all roles) overrides the per-DA ACL
+              if (($GLOBALS['ALIAS_DISABLE_EXTERNAL_DOMAINS'] === true ||
+                  (isset($_SESSION['acl']['alias_external_goto']) && $_SESSION['acl']['alias_external_goto'] != "1")) &&
+                  !is_local_mailcow_domain($goto_domain)) {
+                $_SESSION['return'][] = array(
+                  'type' => 'danger',
+                  'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                  'msg' => array('external_goto_denied', htmlspecialchars($goto))
+                );
+                unset($gotos[$i]);
+                continue;
+              }
              $stmt = $pdo->prepare("SELECT `username` FROM `mailbox`
                WHERE `kind` REGEXP 'location|thing|group'
                  AND `username`= :goto");
@@ -2715,6 +2727,19 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                  unset($gotos[$i]);
                  continue;
                }
+                // Deny external goto domains: global switch (all roles) overrides the per-DA ACL
+                $goto_domain = idn_to_ascii(substr(strstr($goto, '@'), 1), 0, INTL_IDNA_VARIANT_UTS46);
+                if (($GLOBALS['ALIAS_DISABLE_EXTERNAL_DOMAINS'] === true ||
+                    (isset($_SESSION['acl']['alias_external_goto']) && $_SESSION['acl']['alias_external_goto'] != "1")) &&
+                    !is_local_mailcow_domain($goto_domain)) {
+                  $_SESSION['return'][] = array(
+                    'type' => 'danger',
+                    'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                    'msg' => array('external_goto_denied', htmlspecialchars($goto))
+                  );
+                  unset($gotos[$i]);
+                  continue;
+                }
                if ($goto == $address) {
                  $_SESSION['return'][] = array(
                    'type' => 'danger',
@@ -4,7 +4,7 @@ function init_db_schema()
  try {
    global $pdo;

-    $db_version = "19022026_1220";
+    $db_version = "18082026_1200";

    $stmt = $pdo->query("SHOW TABLES LIKE 'versions'");
    $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
@@ -719,7 +719,8 @@ function init_db_schema()
          "alias_domains" => "TINYINT(1) NOT NULL DEFAULT '0'",
          "mailbox_relayhost" => "TINYINT(1) NOT NULL DEFAULT '1'",
          "domain_relayhost" => "TINYINT(1) NOT NULL DEFAULT '1'",
-          "domain_desc" => "TINYINT(1) NOT NULL DEFAULT '0'"
+          "domain_desc" => "TINYINT(1) NOT NULL DEFAULT '0'",
+          "alias_external_goto" => "TINYINT(1) NOT NULL DEFAULT '1'"
        ),
        "keys" => array(
          "primary" => array(
@@ -246,6 +246,10 @@ $PW_RESET_TOKEN_LIMIT = 3;
 // Maximum time in minutes a password reset token is valid
 $PW_RESET_TOKEN_LIFETIME = 15;

+// Globally forbid aliases with external (non-local) goto domains for ALL roles (incl. admins),
+// overriding the per-domain-admin da_acl. false = defer to da_acl.
+$ALIAS_DISABLE_EXTERNAL_DOMAINS = false;
+
 // UV flag handling in FIDO2/WebAuthn - defaults to false to allow iOS logins
 // true = required
 // false = preferred
@@ -1169,6 +1169,7 @@ jQuery(function($){
        if (item === null) { return true; }
        item.user = escapeHtml(item.user);
        item.call = escapeHtml(item.call);
+        if (item.msg) item.msg = escapeHtml(item.msg);
        item.task = '<code>' + item.task + '</code>';
        item.type = '<span class="badge fs-6 bg-' + item.type + '">' + item.type + '</span>';
      });
@@ -1176,6 +1177,7 @@ jQuery(function($){
      $.each(data, function (i, item) {
        if (item === null) { return true; }
        item.username = escapeHtml(item.username);
+        item.real_rip = escapeHtml(item.real_rip);
        item.service = '<div class="badge fs-6 bg-secondary">' + item.service.toUpperCase() + '</div>';
      });
    } else if (table == 'general_syslog') {
@@ -1,6 +1,7 @@
 {
    "acl": {
        "alias_domains": "Alias-Domains hinzufügen",
+        "alias_external_goto": "Aliase mit externen Ziel-Domains erlauben",
        "app_passwds": "App-Passwörter verwalten",
        "bcc_maps": "BCC-Maps",
        "delimiter_action": "Delimiter-Aktionen (tags)",
@@ -443,6 +444,7 @@
        "domain_not_found": "Domain %s nicht gefunden",
        "domain_quota_m_in_use": "Domain-Speicherplatzlimit muss größer oder gleich %d MiB sein",
        "extended_sender_acl_denied": "Keine Rechte zum Setzen von externen Absenderadressen",
+        "external_goto_denied": "Externe Ziel-Adresse %s ist nicht erlaubt",
        "extra_acl_invalid": "Externe Absenderadresse \"%s\" ist ungültig",
        "extra_acl_invalid_domain": "Externe Absenderadresse \"%s\" verwendet eine ungültige Domain",
        "fido2_verification_failed": "FIDO2-Verifizierung fehlgeschlagen: %s",
@@ -1,6 +1,7 @@
 {
    "acl": {
        "alias_domains": "Add alias domains",
+        "alias_external_goto": "Allow aliases with external goto domains",
        "app_passwds": "Manage app passwords",
        "bcc_maps": "BCC maps",
        "delimiter_action": "Delimiter action",
@@ -444,6 +445,7 @@
        "domain_not_found": "Domain %s not found",
        "domain_quota_m_in_use": "Domain quota must be greater or equal to %s MiB",
        "extended_sender_acl_denied": "missing ACL to set external sender addresses",
+        "external_goto_denied": "External goto address %s is not allowed",
        "extra_acl_invalid": "External sender address \"%s\" is invalid",
        "extra_acl_invalid_domain": "External sender \"%s\" uses an invalid domain",
        "fido2_verification_failed": "FIDO2 verification failed: %s",
@@ -786,7 +786,8 @@
        "mta_sts_mx_info": "Permite envio apenas para nomes de host de servidor de email explicitamente listados; o MTA de envio verifica se o nome do host DNS MX corresponde à lista de políticas e permite entrega apenas com certificado TLS válido (protege contra MITM).",
        "mta_sts_mx_notice": "Múltiplos servidores MX podem ser especificados (separados por vírgulas).",
        "sender_allowed": "Permitir enviar como este alias",
-        "sender_allowed_info": "Se desativado, este alias poderá apenas receber e-mails. Use a ACL de remetente para substituir essa configuração e conceder a caixas de correio específicas permissão para enviar."
+        "sender_allowed_info": "Se desativado, este alias poderá apenas receber e-mails. Use a ACL de remetente para substituir essa configuração e conceder a caixas de correio específicas permissão para enviar.",
+        "mta_sts_active_info": "Se esta opção estiver desmarcada, a política MTA-STS não será publicada e nenhum certificado será solicitado via ACME para o subdomínio mta-sts."
    },
    "fido2": {
        "confirm": "Confirme",
@@ -1034,7 +1035,8 @@
        "weekly": "Semanalmente",
        "yes": "✓",
        "iam": "Provedor de Identidade",
-        "internal": "Interno"
+        "internal": "Interno",
+        "force_tfa": "A2F"
    },
    "oauth2": {
        "access_denied": "Faça login como proprietário da mailbox para conceder acesso via OAuth2.",
@@ -1086,7 +1088,7 @@
        "rspamd_result": "Resultado do Rspamd",
        "sender": "Remetente (SMTP)",
        "sender_header": "Remetente (cabeçalho “De”)",
-        "settings_info": "Quantidade máxima de elementos a serem colocados em quarentena: %s <br>Tamanho máximo do e-mail: %s MiB",
+        "settings_info": "Número máximo de elementos em quarentena (por caixa de correio): %s <br>Tamanho máximo do e-mail: %s MiB",
        "show_item": "Mostrar item",
        "spam": "Spam",
        "spam_score": "Ponto",
@@ -1078,7 +1078,7 @@
        "rspamd_result": "Rezultat Rspamd",
        "sender": "Pošiljatelj (SMTP)",
        "sender_header": "Pošiljatelj (glava »Od«)",
-        "settings_info": "Največje število elementov za karanteno: %s<br>Največja velikost e-pošte: %s MiB",
+        "settings_info": "Največje število elementov za karanteno (na poštni predal): %s<br>Največja velikost e-pošte: %s MiB",
        "show_item": "Prikaži element",
        "spam": "Neželena pošta",
        "subj": "Zadeva",
@@ -4,6 +4,7 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 if (!isset($_SESSION['mailcow_cc_role'])) {
  $_SESSION['oauth2_request'] = $_SERVER['REQUEST_URI'];
  header('Location: /?oauth');
+  exit;
 }

 $request = OAuth2\Request::createFromGlobals();
@@ -24,6 +25,11 @@ if (!isset($_POST['authorized'])) {
  exit;
 }

+if (empty($_SESSION['mailcow_cc_username'])) {
+  header('Location: /?oauth');
+  exit;
+}
+
 // print the authorization code if the user has authorized your client
 $is_authorized = ($_POST['authorized'] == '1');
 $oauth2_server->handleAuthorizeRequest($request, $response, $is_authorized, $_SESSION['mailcow_cc_username']);
@@ -42,7 +42,7 @@ services:
            - mysql

    redis-mailcow:
-      image: redis:7.4.6-alpine
+      image: redis:7.4.10-alpine
      entrypoint: ["/bin/sh","/redis-conf.sh"]
      volumes:
        - redis-vol-1:/data/
@@ -65,7 +65,7 @@ services:
            - redis

    clamd-mailcow:
-      image: ghcr.io/mailcow/clamd:1.71
+      image: ghcr.io/mailcow/clamd:1.4.6-1
      restart: always
      depends_on:
        unbound-mailcow:
@@ -200,7 +200,7 @@ services:
            - phpfpm

    sogo-mailcow:
-      image: ghcr.io/mailcow/sogo:5.12.9-1
+      image: ghcr.io/mailcow/sogo:5.12.10-1
      environment:
        - DBNAME=${DBNAME}
        - DBUSER=${DBUSER}
Author	SHA1	Message	Date
FreddleSpl0it	8bd9e12a73	[Web] Add ACL + global switch to disable external alias goto	2026-08-18 14:07:37 +02:00
FreddleSpl0it	6644699e65	Merge pull request #7426 from mailcow/fix/web-hardening [Web] Minor hardening across web UI and nginx	2026-08-18 09:10:09 +02:00
FreddleSpl0it	91d3b7246a	[Web] Minor hardening across web UI and nginx	2026-08-18 09:08:17 +02:00
FreddleSpl0it	b362c7105d	Merge pull request #7425 from mailcow/feat/redis-7.4.10 [Redis] Update to 7.4.10	2026-08-18 08:14:21 +02:00
FreddleSpl0it	555e7ed706	[Redis] Update to 7.4.10	2026-08-18 08:12:32 +02:00
FreddleSpl0it	59e2a9ac77	Merge pull request #7423 from mailcow/fix/7418 [Dovecot] Remove legacy DeltaChat auto-filing sieve rule	2026-08-17 08:41:18 +02:00
FreddleSpl0it	feed5ad183	[Dovecot] Remove legacy DeltaChat auto-filing sieve rule	2026-08-17 08:35:53 +02:00
FreddleSpl0it	f1f7a9800b	Merge pull request #7422 from mailcow/feat/sogo-5.12.10 [SOGo] Update to 5.12.10	2026-08-17 08:24:10 +02:00
FreddleSpl0it	8c85044781	[SOGo] Update to 5.12.10	2026-08-17 08:20:45 +02:00
FreddleSpl0it	8fb32e4b59	Merge pull request #7415 from mailcow/feat/clamd-1.4.6 [Clamd] Update to 1.4.6	2026-08-13 13:59:13 +02:00
FreddleSpl0it	b5fa926bc0	[Clamd] Update to 1.4.6	2026-08-13 13:56:49 +02:00
milkmaker Matjaž Tekavec André Glazastov	d1a2f4e168	Translations update from Weblate (#7400 ) * [Web] Updated lang.si-si.json Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si> Co-authored-by: milkmaker <milkmaker@mailcow.de> * [Web] Updated lang.pt-br.json Co-authored-by: André Glazastov <andre@glazastov.com> --------- Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si> Co-authored-by: André Glazastov <andre@glazastov.com>	2026-08-04 18:37:38 +02:00
milkmaker	f7a536d634	update postscreen_access.cidr (#7394 )	2026-08-04 18:35:48 +02:00
Maximal Benedikt	8b456a33e7	Merge pull request #7392 from mailcow/update-sponsoring update README.md sponsors	2026-07-30 14:21:39 +02:00
MaximalBenedikt	54da526d41	update README.md sponsors	2026-07-30 14:11:32 +02:00