Update dependency composer/composer to v2.11.2

Signed-off-by: milkmaker <milkmaker@mailcow.de>

_modules/scripts/ipv6_controller.sh

@@ -3,11 +3,6 @@
 # THIS SCRIPT IS DESIGNED TO BE RUNNING BY MAILCOW SCRIPTS ONLY!
 # DO NOT, AGAIN, NOT TRY TO RUN THIS SCRIPT STANDALONE!!!!!!
 
-# Global IPv6 address that is no unique local address (fc00::/7, e.g. Docker bridges)
-_has_public_ipv6() {
-  ip -6 -o addr show scope global 2>/dev/null | awk '{print $4}' | grep -qviE '^f[cd]'
-}
-
 # 1) Check if the host supports IPv6
 get_ipv6_support() {
   # ---- helper: probe external IPv6 connectivity without DNS ----
@@ -42,9 +37,6 @@ get_ipv6_support() {
     if _probe_ipv6_connectivity; then
       DETECTED_IPV6=true
       echo -e "IPv6 detected on host – ${LIGHT_GREEN}leaving IPv6 support enabled${YELLOW}.${NC}"
-    elif _has_public_ipv6; then
-      DETECTED_IPV6=true
-      echo -e "${YELLOW}External IPv6 connectivity test failed, but the host has a public IPv6 address – ${LIGHT_GREEN}leaving IPv6 support enabled${YELLOW}.${NC}"
     else
       DETECTED_IPV6=false
       echo -e "${YELLOW}Default IPv6 route present but external IPv6 connectivity failed – ${LIGHT_RED}disabling IPv6 support${YELLOW}.${NC}"
@@ -200,31 +192,9 @@ EOF
   fi
 }
 
-_set_enable_ipv6() {
-  if [[ -n "$MAILCOW_CONF" && -f "$MAILCOW_CONF" ]]; then
-    if grep -q '^ENABLE_IPV6=' "$MAILCOW_CONF"; then
-      sed -i "s/^ENABLE_IPV6=.*/ENABLE_IPV6=$1/" "$MAILCOW_CONF"
-    else
-      echo "ENABLE_IPV6=$1" >> "$MAILCOW_CONF"
-    fi
-  else
-    export IPV6_BOOL=$1
-  fi
-}
-
-_warn_ipv6_disabled() {
-  _has_public_ipv6 || return 0
-  ip -6 route show default 2>/dev/null | grep -qE '^default' || return 0
-  grep -Eq '"userland-proxy"[[:space:]]*:[[:space:]]*false' /etc/docker/daemon.json 2>/dev/null && return 0
-  echo -e "${LIGHT_RED}WARNING: ENABLE_IPV6=false, but this host has a public IPv6 address.${NC}"
-  echo -e "${YELLOW}Docker forwards IPv6 connections to mailcow with an internal source address, which Postfix trusts. This can make your server an open relay over IPv6.${NC}"
-  echo -e "${YELLOW}Set ENABLE_IPV6=true in mailcow.conf, or set \"userland-proxy\": false in /etc/docker/daemon.json and restart Docker.${NC}"
-  echo -e "${YELLOW}See https://docs.mailcow.email/post_installation/firststeps-disable_ipv6/${NC}"
-  sleep 5
-}
-
 # 3) Main wrapper for generate_config.sh and update.sh
 configure_ipv6() {
+  # detect manual override if mailcow.conf is present
   if [[ -n "$MAILCOW_CONF" && -f "$MAILCOW_CONF" ]] && grep -q '^ENABLE_IPV6=' "$MAILCOW_CONF"; then
     MANUAL_SETTING=$(grep '^ENABLE_IPV6=' "$MAILCOW_CONF" | cut -d= -f2)
   elif [[ -z "$MAILCOW_CONF" ]] && [[ -n "${ENABLE_IPV6:-}" ]]; then
@@ -233,23 +203,19 @@ configure_ipv6() {
     MANUAL_SETTING=""
   fi
 
-  if [[ "${MANUAL_SETTING,,}" == "false" ]]; then
-    _set_enable_ipv6 false
-    echo "ENABLE_IPV6=false is set, skipping Docker IPv6 configuration."
-    _warn_ipv6_disabled
-    echo "IPv6 configuration complete: ENABLE_IPV6=false"
-    return
-  fi
-
   get_ipv6_support
 
-  if [[ "$DETECTED_IPV6" != "true" && "${MANUAL_SETTING,,}" == "true" ]] && _has_public_ipv6; then
+  # if user manually set it, check for mismatch
-    echo -e "${YELLOW}Keeping ENABLE_IPV6=true, the host has a public IPv6 address.${NC}"
-    DETECTED_IPV6=true
-  fi
-
   if [[ "$DETECTED_IPV6" != "true" ]]; then
-    _set_enable_ipv6 false
+    if [[ -n "$MAILCOW_CONF" && -f "$MAILCOW_CONF" ]]; then
+      if grep -q '^ENABLE_IPV6=' "$MAILCOW_CONF"; then
+        sed -i 's/^ENABLE_IPV6=.*/ENABLE_IPV6=false/' "$MAILCOW_CONF"
+      else
+        echo "ENABLE_IPV6=false" >> "$MAILCOW_CONF"
+      fi
+    else
+      export IPV6_BOOL=false
+    fi
     echo "Skipping Docker IPv6 configuration because host does not support IPv6."
     echo "Make sure to check if your docker daemon.json does not include \"enable_ipv6\": true if you do not want IPv6."
     echo "IPv6 configuration complete: ENABLE_IPV6=false"
@@ -258,7 +224,16 @@ configure_ipv6() {
   fi
 
   docker_daemon_edit
-  _set_enable_ipv6 true
+
+  if [[ -n "$MAILCOW_CONF" && -f "$MAILCOW_CONF" ]]; then
+    if grep -q '^ENABLE_IPV6=' "$MAILCOW_CONF"; then
+      sed -i 's/^ENABLE_IPV6=.*/ENABLE_IPV6=true/' "$MAILCOW_CONF"
+    else
+      echo "ENABLE_IPV6=true" >> "$MAILCOW_CONF"
+    fi
+  else
+    export IPV6_BOOL=true
+  fi
 
   echo "IPv6 configuration complete: ENABLE_IPV6=true"
 }

data/Dockerfiles/dovecot/trim_logs.sh

@@ -4,7 +4,7 @@ catch_non_zero() {
   ${CMD} > /dev/null
   EC=$?
   if [ ${EC} -ne 0 ]; then
-    echo "Command ${CMD//${REDISPASS}/***} failed to execute, exit code was ${EC}"
+    echo "Command ${CMD} failed to execute, exit code was ${EC}"
   fi
 }
 source /source_env.sh

data/Dockerfiles/phpfpm/Dockerfile

@@ -13,7 +13,7 @@ ARG MEMCACHED_PECL_VERSION=3.4.0
 # renovate: datasource=github-tags depName=phpredis/phpredis versioning=semver-coerced extractVersion=(?<version>.*)$
 ARG REDIS_PECL_VERSION=6.3.0
 # renovate: datasource=github-tags depName=composer/composer versioning=semver-coerced extractVersion=(?<version>.*)$
-ARG COMPOSER_VERSION=2.10.2
+ARG COMPOSER_VERSION=2.11.2
 
 RUN apk add -U --no-cache autoconf \
   aspell-dev \

data/conf/rspamd/local.d/multimap.conf

@@ -145,6 +145,20 @@ BAD_LANG {
   score = 5.0;
 }
 
+BAZAAR_ABUSE_CH {
+  type = "selector";
+  selector = "attachments(hex,md5)";
+  map = "https://bazaar.abuse.ch/export/txt/md5/recent/";
+  score = 10.0;
+}
+
+URLHAUS_ABUSE_CH {
+  type = "selector";
+  selector = "urls";
+  map = "https://urlhaus.abuse.ch/downloads/text_online/";
+  score = 10.0;
+}
+
 SMTP_LIMITED_ACCESS {
   type = "user";
   map = "redis://SMTP_LIMITED_ACCESS";

data/web/css/build/013-datatables.css

@@ -15,10 +15,6 @@ table.dataTable>tbody>tr.child ul.dtr-details>li {
     border-bottom: 1px solid rgba(0, 0, 0, 0.129);
     padding: 0.5em 0;
 }
-/* like the first entry has no top padding, the last one needs no bottom padding */
-table.dataTable>tbody>tr.child ul.dtr-details>li:last-child {
-    padding-bottom: 0;
-}
 table.dataTable.dtr-inline.collapsed>tbody>tr>td.dtr-control:before:hover, 
 table.dataTable.dtr-inline.collapsed>tbody>tr>th.dtr-control:before:hover {
     background-color: var(--mc-dtr-hover-bg);
@@ -32,8 +28,7 @@ table.dataTable td.dt-control:before {
     color: var(--mc-dtr-color);
     height: 1em;
     width: 1em;
-    line-height: 1em;
+    line-height: 1.25em;
-    margin-top: calc(-0.5em - 1.5px);
     border-radius: 0px;
     box-shadow: none;
     font-size: 14px;
@@ -44,29 +39,11 @@ table.dataTable.dtr-inline.collapsed>tbody>tr.parent>th.dtr-control:before,
 table.dataTable td.dt-control:before {
     background-color: var(--mc-dtr-active-bg) !important;
 }
-/* The default initial order targets column 0, which is usually the non-orderable expand column */
-table.dataTable thead > tr > th.sorting_disabled.sorting_asc,
-table.dataTable thead > tr > th.sorting_disabled.sorting_desc {
-    padding-right: 0.5rem;
-    cursor: auto;
-}
-table.dataTable thead > tr > th.sorting_disabled.sorting_asc:before,
-table.dataTable thead > tr > th.sorting_disabled.sorting_asc:after,
-table.dataTable thead > tr > th.sorting_disabled.sorting_desc:before,
-table.dataTable thead > tr > th.sorting_disabled.sorting_desc:after {
-    display: none;
-}
 table.dataTable.table-striped>tbody>tr>td {
     vertical-align: middle;
 }
 table.dataTable.table-striped>tbody>tr>td>input[type="checkbox"] {
-    /* centers the 1em checkbox in the 1.5em line, level with the expand control */
+    margin-top: 7px;
-    margin-top: 0.25em;
-}
-/* the vertical margin is meant for the tag editor in edit forms, in tables it only adds height */
-table.dataTable .tag-badge {
-    margin-top: 0;
-    margin-bottom: 0;
 }
 td.dtr-col-lg {
     min-width: 350px;

data/web/css/build/014-mailcow.css

@@ -139,13 +139,6 @@ body {
   display: inline-block;
   font-size: inherit;
 }
-.badge .bi {
-  font-size: inherit;
-}
-/* keeps icons from making a badge taller than one with text only */
-.badge .bi::before {
-  line-height: 0;
-}
 .btn-group-xs > .btn, .btn-xs {
   padding: .25rem .4rem;
   font-size: .875rem;
@@ -350,7 +343,6 @@ code {
 }
 .tag-badge .bi {
   font-size: 12px;
-  line-height: 0;
 }
 .tag-badge.btn-badge:hover {
   filter: brightness(0.9);

data/web/css/build/015-responsive.css

@@ -191,7 +191,7 @@
       height: 2rem;
       width: 2rem;
       line-height: 2rem;
-      margin-top: calc(-1rem - 1.5px);
+      margin-top: -15px;
   }
 
   li .dtr-data {

data/web/inc/functions.inc.php

@@ -1394,18 +1394,6 @@ function set_tfa($_data) {
     case "webauthn":
         $key_id = (!isset($_data["key_id"])) ? 'unidentified' : $_data["key_id"];
 
-        // Refuse incomplete WebAuthn registrations. Without this guard a request
-        // that does not contain the parsed credential data (e.g. a plain form
-        // POST) would silently insert an empty keyHandle while reporting success.
-        if (empty($_data['registration']) || empty($_data['registration']->credentialId)) {
-          $_SESSION['return'][] = array(
-            'type' => 'danger',
-            'log' => array(__FUNCTION__, $_data_log),
-            'msg' => 'webauthn_registration_failed'
-          );
-          return false;
-        }
-
         $stmt = $pdo->prepare("INSERT INTO `tfa` (`username`, `key_id`, `authmech`, `keyHandle`, `publicKey`, `certificate`, `counter`, `active`)
         VALUES (?, ?, 'webauthn', ?, ?, ?, ?, '1')");
         $stmt->execute(array(
@@ -2432,7 +2420,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
           case "use_ssl":
           case "use_tls":
           case "login_provisioning":
-          case "ignore_ssl_error":
+          case "ignore_ssl_errors":
             $settings[$row["key"]] = boolval($row["value"]);
           break;
           default:
@@ -2456,7 +2444,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
       if ($settings["authsource"] == "ldap"){
         $settings['use_ssl'] = !isset($settings['use_ssl']) ? false : $settings['use_ssl'];
         $settings['use_tls'] = !isset($settings['use_tls']) ? false : $settings['use_tls'];
-        $settings['ignore_ssl_error'] = !isset($settings['ignore_ssl_error']) ? false : $settings['ignore_ssl_error'];
+        $settings['ignore_ssl_errors'] = !isset($settings['ignore_ssl_errors']) ? false : $settings['ignore_ssl_errors'];
       }
       return $settings;
     break;

data/web/js/site/mailbox.js

@@ -614,7 +614,7 @@ jQuery(function($){
           defaultContent: ''
         },
         {
-          title: lang_edit.ratelimit,
+          title: 'RL',
           data: 'rl',
           searchable: false,
           orderable: false,

data/web/lang/lang.en-gb.json

@@ -1127,7 +1127,7 @@
         "mailbox_defaults_info": "Define default settings for new mailboxes.",
         "mailbox_defquota": "Default mailbox size",
         "mailbox_templates": "Mailbox Templates",
-        "mailbox_quota": "Max. mailbox size",
+        "mailbox_quota": "Max. size of a mailbox",
         "mailboxes": "Mailboxes",
         "max_aliases": "Max. aliases",
         "max_mailboxes": "Max. possible mailboxes",
@@ -1429,7 +1429,6 @@
         "u2f_deprecated": "It seems that your Key was registered using the deprecated U2F method. We will deactivate Two-Factor-Authenticaiton for you and delete your Key.",
         "u2f_deprecated_important": "Please register your Key in the admin panel with the new WebAuthn method.",
         "webauthn": "WebAuthn authentication",
-        "webauthn_registration_failed": "WebAuthn registration failed. The credential could not be verified, please try again.",
         "waiting_usb_auth": "<i>Waiting for USB device...</i><br><br>Please tap the button on your USB device now.",
         "waiting_usb_register": "<i>Waiting for USB device...</i><br><br>Please enter your password above and confirm your registration by tapping the button on your USB device.",
         "yubi_otp": "Yubico OTP authentication"

data/web/templates/base.twig

@@ -416,24 +416,18 @@ function recursiveBase64StrToArrayBuffer(obj) {
         return navigator.credentials.create(json);
       }).then(function(cred) {
         return {
-          clientDataJSON: arrayBufferToBase64(cred.response.clientDataJSON),
+          id: cred.id,
-          attestationObject: arrayBufferToBase64(cred.response.attestationObject),
+          rawId: arrayBufferToBase64(cred.rawId),
-          key_id: keyId,
+          response: {
-          tfa_method: 'webauthn',
+            attestationObject: arrayBufferToBase64(cred.response.attestationObject),
-          confirm_password: ''
+            clientDataJSON: arrayBufferToBase64(cred.response.clientDataJSON)
+          },
+          type: cred.type
         };
-      }).then(JSON.stringify).then(function(credentialData) {
+      }).then(function(credData) {
-        // send the attestation to the JSON API, like the regular WebAuthn modal does,
+        $('#setup_webauthn_register_data').val(JSON.stringify(credData));
-        // so that the credential is parsed and stored correctly
+        $('#setup_webauthn_reg_form input[name=set_tfa]').val('1');
-        return window.fetch('/api/v1/add/webauthn-tfa-registration', {method: 'POST', body: credentialData, cache: 'no-cache'});
+        $('#setup_webauthn_reg_form').submit();
-      }).then(function(response) {
-        return response.json();
-      }).then(function(json) {
-        if (json.success) {
-          window.location = window.location.href.split('#')[0];
-        } else {
-          throw new Error(json.msg);
-        }
       }).catch(function(err) {
         $('#setup_webauthn_return_code').show().text(err.message || 'Registration failed');
       });

update.sh

@@ -374,12 +374,10 @@ if ! $COMPOSE_COMMAND config -q; then
 fi
 
 echo -e "\e[32mChecking for conflicting bridges...\e[0m"
-MAILCOW_BRIDGE=$($COMPOSE_COMMAND config | grep -i com.docker.network.bridge.name | cut -d':' -f2 | tr -d "[:space:]\"'")
+MAILCOW_BRIDGE=$($COMPOSE_COMMAND config | grep -i com.docker.network.bridge.name | cut -d':' -f2)
-if [[ -n "${MAILCOW_BRIDGE}" ]]; then
+while read NAT_ID; do
-  while read NAT_ID; do
+  iptables -t nat -D POSTROUTING "$NAT_ID"
-    iptables -t nat -D POSTROUTING "$NAT_ID"
+done < <(iptables -L -vn -t nat --line-numbers | grep "$IPV4_NETWORK" | grep -E 'MASQUERADE.*all' | grep -v "${MAILCOW_BRIDGE}" | cut -d' ' -f1)
-  done < <(iptables -L -vn -t nat --line-numbers | grep "$IPV4_NETWORK" | grep -E 'MASQUERADE.*all' | grep -vE "[[:space:]]!?${MAILCOW_BRIDGE}[[:space:]]" | cut -d' ' -f1)
-fi
 
 DIFF_DIRECTORY=update_diffs
 DIFF_FILE=${DIFF_DIRECTORY}/diff_before_update_$(date +"%Y-%m-%d-%H-%M-%S")