From 43559af0cc75440b0059d43ecc057af24433b598 Mon Sep 17 00:00:00 2001 From: "Thomas R. Koll" Date: Sun, 5 Dec 2021 18:59:39 +0100 Subject: [PATCH 01/63] Add a not about creating a backup before starting over I was stupid/tired enough to copy and run that `docker-compose down -v`. Hopefully this little change will prevent others from loosing their data as well. Btw, I did get that page after my disk space was running out. --- data/web/_status.502.html | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/data/web/_status.502.html b/data/web/_status.502.html index ec6617e4..efbc0e8b 100644 --- a/data/web/_status.502.html +++ b/data/web/_status.502.html @@ -16,8 +16,9 @@ 
docker-compose logs --tail=200 php-fpm-mailcow nginx-mailcow

Make sure your SQL credentials in mailcow.conf (a link to .env) do fit your initialized SQL volume. If you see an access denied, you might have the wrong mailcow.conf:

source mailcow.conf ; docker-compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME}
-

In case of a previous failed installation, remove all volumes and start over (NEVER do this with a production system, it will remove ALL data):

- 
docker-compose down -v ; docker-compose up -d
+

In case of a previous failed installation, create a backup of your existing data, followed by removing all volumes and starting over (NEVER do this with a production system, it will remove ALL data):

+ 
BACKUP_LOCATION=/tmp/ ./helper-scripts/backup_and_restore.sh backup all
+ 
docker-compose down --volumes ; docker-compose up -d

Make sure your timezone is correct. Use "America/New_York" for example, do not use spaces. Check here for a list.


Click to learn more about getting support. From e4d23b7887903b2aebcab51a5c5a8e7a5f17457f Mon Sep 17 00:00:00 2001 From: andryyy Date: Tue, 7 Dec 2021 13:56:56 +0100 Subject: [PATCH 02/63] [Web] Add default sieve accessq --- data/web/inc/vars.inc.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/data/web/inc/vars.inc.php b/data/web/inc/vars.inc.php index 91d2145d..94d32df9 100644 --- a/data/web/inc/vars.inc.php +++ b/data/web/inc/vars.inc.php @@ -175,6 +175,9 @@ $MAILBOX_DEFAULT_ATTRIBUTES['pop3_access'] = true; // Mailbox has SMTP access by default $MAILBOX_DEFAULT_ATTRIBUTES['smtp_access'] = true; +// Mailbox has sieve access by default +$MAILBOX_DEFAULT_ATTRIBUTES['sieve_access'] = true; + // Mailbox receives notifications about... // "add_header" - mail that was put into the Junk folder // "reject" - mail that was rejected From 41819d354f89f53058dc8bc885e415c208d9bada Mon Sep 17 00:00:00 2001 From: milkmaker Date: Wed, 8 Dec 2021 19:09:30 +0100 Subject: [PATCH 03/63] Translations update from Weblate (#4364) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * [Web] Updated lang.it.json [CI SKIP] [Web] Updated lang.it.json [CI SKIP] Co-authored-by: Stefano Co-authored-by: milkmaker * [Web] Updated lang.sk.json [CI SKIP] Co-authored-by: Lukáš Matula Co-authored-by: Stefano Co-authored-by: Lukáš Matula --- data/web/lang/lang.it.json | 56 +++++++++++++++++++++++++++++++------- data/web/lang/lang.sk.json | 28 +++++++++---------- 2 files changed, 60 insertions(+), 24 deletions(-) diff --git a/data/web/lang/lang.it.json b/data/web/lang/lang.it.json index 496c0d71..5b862568 100644 --- a/data/web/lang/lang.it.json +++ b/data/web/lang/lang.it.json @@ -105,7 +105,8 @@ "username": "Username", "validate": "Convalida", "validation_success": "Convalidato con successo", - "bcc_dest_format": "Il destinatario in copia nascosta, dev'essere un solo indirizzo email.
Se devi spedire una copia del messaggio a più destinatari, crea un alias ed utilizzalo per questa opzione." + "bcc_dest_format": "Il destinatario in copia nascosta deve essere un singolo indirizzo email.
Se si vuole spedire una copia del messaggio a più destinatari, bisogna creare un alias ed utilizzarlo per questa opzione.", + "app_passwd_protocols": "Protocolli consentiti per la password dell'app" }, "admin": { "access": "Accedi", @@ -337,7 +338,12 @@ "username": "Username", "validate_license_now": "Validate GUID against license server", "verify": "Verifica", - "yes": "✓" + "yes": "✓", + "api_read_only": "Accesso in sola lettura", + "api_read_write": "Accesso in lettura-scrittura", + "oauth2_apps": "App OAuth2", + "oauth2_add_client": "Aggiungere il client OAuth2", + "rsettings_preset_4": "Disattivare Rspamd per un dominio" }, "danger": { "access_denied": "Accesso negato o form di login non corretto", @@ -456,7 +462,7 @@ "username_invalid": "Username %s non può essere utilizzato", "validity_missing": "Assegnare un periodo di validità", "value_missing": "Si prega di fornire tutti i valori", - "yotp_verification_failed": "Verifica Yubico OTP fallita: %s" + "yotp_verification_failed": "Verifica OTP Yubico fallita: %s" }, "debug": { "chart_this_server": "Grafico (questo server)", @@ -601,7 +607,13 @@ "title": "Modifica oggetto", "unchanged_if_empty": "Se immutato lasciare vuoto", "username": "Username", - "validate_save": "Convalida e salva" + "validate_save": "Convalida e salva", + "pushover": "Pushover", + "sogo_access_info": "Il single-sign-on dall'interno dell'interfaccia di posta rimane funzionante. Questa impostazione non influisce sull'accesso a tutti gli altri servizi né cancella o modifica il profilo SOGo esistente dell'utente.", + "none_inherit": "Nessuno / Eredita", + "sogo_access": "Concedere l'accesso diretto a SOGo", + "acl": "ACL (autorizzazione)", + "app_passwd_protocols": "Protocolli consentiti per la password dell'app" }, "fido2": { "confirm": "Confirm", @@ -615,7 +627,8 @@ "rename": "Rename", "set_fido2": "Register FIDO2 device", "set_fn": "Set friendly name", - "start_fido2_validation": "Start FIDO2 validation" + "start_fido2_validation": "Start FIDO2 validation", + "set_fido2_touchid": "Registrare il Touch ID su Apple M1" }, "footer": { "cancel": "Annulla", @@ -629,7 +642,8 @@ "restart_container_info": "Importante: Il completamento di un normale riavvio potrebbe richiedere diversi minuti, ti consigliamo di attendere.", "restart_now": "Riavvia adesso", "restarting_container": "Riavvia il container, potrebbe richiedere diversi minuti", - "hibp_check": "Verifica con haveibeenpwned.com" + "hibp_check": "Verifica con haveibeenpwned.com", + "nothing_selected": "Niente di selezionato" }, "header": { "administration": "Amministrazione", @@ -694,7 +708,7 @@ "bcc_to_rcpt": "Switch to recipient map type", "bcc_to_sender": "Switch to sender map type", "bcc_type": "BCC type", - "booking_null": "Always show as free", + "booking_null": "Mostra sempre come libero", "booking_0_short": "Always free", "booking_custom": "Hard-limit to a custom amount of bookings", "booking_custom_short": "Hard limit", @@ -802,7 +816,17 @@ "goto_spam": "Apprendi come spam", "open_logs": "Apri i log", "syncjob_check_log": "Controlla il log", - "syncjob_last_run_result": "Risultato dell'ultima esecuzione" + "syncjob_last_run_result": "Risultato dell'ultima esecuzione", + "syncjob_EXIT_TLS_FAILURE": "Problema con la connessione criptata", + "syncjob_EXIT_AUTHENTICATION_FAILURE": "Problema di autenticazione", + "syncjob_EXIT_OVERQUOTA": "La casella di posta del destinatario ha superato la quota", + "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Impossibile connettersi al server remoto", + "syncjob_EXIT_CONNECTION_FAILURE": "Problema di connessione", + "catch_all": "Catch-All", + "sender": "Mittente", + "all_domains": "Tutti i domini", + "recipient": "Destinatario", + "syncjob_EX_OK": "Successo" }, "oauth2": { "access_denied": "Effettua il login alla casella di posta per garantire l'accesso tramite OAuth2.", @@ -1123,7 +1147,17 @@ "change_password_hint_app_passwords": "Il tuo account ha {{number_of_app_passwords}} password delle app che non verranno modificate. Per gestirle, vai alla scheda App passwords.", "syncjob_check_log": "Controlla i log", "syncjob_last_run_result": "Risultato dell'ultima esecuzione", - "open_logs": "Apri i log" + "open_logs": "Apri i log", + "apple_connection_profile_with_app_password": "Una nuova password dell'app è stata generata ed aggiunta al profilo così che non sia più necessario inserire alcuna password quando si imposta il dispositivo. Si prega di non condividere il file in quanto concede l'accesso completo alla tua casella di posta elettronica.", + "allowed_protocols": "Protocolli consentiti", + "syncjob_EX_OK": "Successo", + "syncjob_EXIT_CONNECTION_FAILURE": "Problema di connessione", + "syncjob_EXIT_TLS_FAILURE": "Problema con la connessione criptata", + "syncjob_EXIT_AUTHENTICATION_FAILURE": "Problema di autenticazione", + "syncjob_EXIT_OVERQUOTA": "La casella di posta del destinatario ha superato la quota", + "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Impossibile connettersi al server remoto", + "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Nome utente o password errati", + "with_app_password": "con password dell'app" }, "warning": { "cannot_delete_self": "Cannot delete logged in user", @@ -1141,6 +1175,8 @@ "ratelimit": { "minute": "messaggi / minuto", "disabled": "Disabilitato", - "second": "messaggi / secondo" + "second": "messaggi / secondo", + "hour": "messaggi / ora", + "day": "messaggi / giorno" } } diff --git a/data/web/lang/lang.sk.json b/data/web/lang/lang.sk.json index b3518908..456d6a35 100644 --- a/data/web/lang/lang.sk.json +++ b/data/web/lang/lang.sk.json @@ -80,7 +80,7 @@ "password": "Heslo", "password_repeat": "Potvrdzovacie heslo (zopakovať)", "port": "Port", - "post_domain_add": "SOGo kontajner, \"sogo-mailcow\", musí byť reštartovaný po pridaní novej domény!
", + "post_domain_add": "SOGo kontajner, \"sogo-mailcow\", musí byť reštartovaný po pridaní novej domény!

Okrem toho by sa mala skontrolovať konfigurácia DNS domény. Ak je konfigurácia v poriadku, reštartujte \"acme-mailcow\", aby sa automaticky vygenerovali certifikáty pre vašu novú doménu (autoconfig.<domain>, autodiscover.<domain>).
Tento krok je voliteľný a bude sa opakovať každých 24 hodín.", "private_comment": "Súkromný komentár", "public_comment": "Verejný komentár", "quota_mb": "Kvóta (MiB)", @@ -323,7 +323,7 @@ "to_top": "Naspať navrch", "transport_dest_format": "Regulárny výraz alebo syntax: example.org, .example.org, *, box@example.org (viacero hodnôt môžu byť oddelené čiarkou)", "transport_maps": "Transportné Mapy", - "transport_test_rcpt_info": "• Na otestovanie odchádzajúcej pošty je možné použiť null@hosted.mailcow.de ako adresáta", + "transport_test_rcpt_info": "• Na otestovanie odchádzajúcej pošty je možné použiť null@hosted.mailcow.de ako adresáta.", "transports_hint": "• Záznam v transportnej mape prevažuje nad transportnou mapou pre odosielanie.
\r\n• Prenos na základe MX je preferovaná voľba.
\r\n• Nastavenie TLS pre používateľa je ignorované a môže byť vynútené TLS mapovaním.
\r\n• Transportná služba je definovaná vždy \"smtp:\" a použije TLS ak to bude umožnené. Wrapped TLS (SMTPS) nie je podporované.
\r\n• Adresy ktoré sa rovnajú hodnote \"/localhost$/\" budú vždy transportované cez \"local:\" a nebudú použité pre cieľový záznam \"*\".
\r\n• Po zadaní prihlasovacích údajov pre ďalší skok \"[host]:25\", Postfix vždy hľadá \"host\" a následne \"[host]:25\". Táto vlastnosť znemožňuje používať \"host\" a \"[host]:25\" naraz.", "ui_footer": "Pätička (HTML povolené)", "ui_header_announcement": "Oznámenie", @@ -394,9 +394,9 @@ "invalid_recipient_map_old": "Neplatná pôvodná mapa príjemcu: %s", "ip_list_empty": "Zoznam povolených IP nemôže byť prázdny", "is_alias": "%s je už používané ako alias adresa", - "is_alias_or_mailbox": "%s je už používaná ako adresa aliasu, mailovej schránky alebo aliasu odvodeného z aliasu domény", + "is_alias_or_mailbox": "%s je už používaná ako adresa aliasu, mailovej schránky alebo aliasu odvodeného z aliasu domény.", "is_spam_alias": "%s je už používaná ako adresa dočasného aliasu (spam alias adresa)", - "last_key": "Posledný kľúč nemôže byť vymazaný, deaktivujte najprv TFA", + "last_key": "Posledný kľúč nemôže byť vymazaný, deaktivujte najprv TFA.", "login_failed": "Prihlásenie zlyhalo", "mailbox_defquota_exceeds_mailbox_maxquota": "Predvolená kvóta presahuje max. kvótu mailovej schránky", "mailbox_invalid": "Meno mailovej schránky je neplatné", @@ -638,7 +638,7 @@ "restart_container": "Reštartovať kontajner", "restart_container_info": "Dôležité: Reštartovanie môže trvať dlhšie, čakajte prosím ...", "restart_now": "Reštartuj teraz", - "restarting_container": "Prebieha reštartovanie kontajnera, čakajte prosím ..." + "restarting_container": "Prebieha reštartovanie kontajnera, čakajte prosím" }, "header": { "administration": "Konfigurácia & Detaily", @@ -741,7 +741,7 @@ "last_run_reset": "Znovu naplánovať", "mailbox": "Mailová schránka", "mailbox_defaults": "Predvolené nastavenia", - "mailbox_defaults_info": "Definuje predvolené nastavenia pre nové schránky", + "mailbox_defaults_info": "Definuje predvolené nastavenia pre nové schránky.", "mailbox_defquota": "Predvolená veľkosť schránky", "mailbox_quota": "Max. veľkosť schránky", "mailboxes": "Mailové schránky", @@ -815,7 +815,7 @@ "tls_map_policy": "Podmienky", "tls_policy_maps": "Mapy TLS pravidiel", "tls_policy_maps_enforced_tls": "Tieto politiky prepisujú používateľské nastavenia pre mailové schránky ktoré majú vynútene odchodzie TLS pripojenie. Ak nižšie nie sú uvedené žiadne pravidlá, budú použité ako východzie pravidlá smtp_tls_mandatory_protocols a smtp_tls_mandatory_ciphers.", - "tls_policy_maps_info": "Táto mapa prevažuje nad TLS pravidlami nezávisle od TLS pravidiel jednotlivých používateľov.
\r\n Viac informácií navštívte info k \"smtp_tls_policy_maps\" ", + "tls_policy_maps_info": "Táto mapa prevažuje nad TLS pravidlami nezávisle od TLS pravidiel jednotlivých používateľov.
\nPre viac informácií navštívte postfix \"smtp_tls_policy_maps\".", "tls_policy_maps_long": "Prepisovanie TLS pravidiel pre odosielanie", "toggle_all": "Označiť všetky", "username": "Používateľské meno", @@ -886,11 +886,11 @@ "type": "Typ" }, "ratelimit": { - "disabled": "Vypnuté", - "second": "správ za sekundu", - "minute": "správ za minútu", - "hour": "správ za hodinu", - "day": "správ za deň" + "disabled": "Vypnuté", + "second": "správ za sekundu", + "minute": "správ za minútu", + "hour": "správ za hodinu", + "day": "správ za deň" }, "start": { "help": "Zobraziť/Skryť panel nápoveď", @@ -1069,8 +1069,8 @@ "never": "Nikdy", "new_password": "Nové heslo", "new_password_repeat": "Potvrdiť heslo (opakovať)", - "no_active_filter": "Nie je dostupný žiadny aktívny filter.", - "no_last_login": "Žiadne informácie o UI prihlásení.", + "no_active_filter": "Nie je dostupný žiadny aktívny filter", + "no_last_login": "Žiadny záznam o prihlásení cez web", "no_record": "Žiaden záznam", "open_logs": "Otvoriť záznam", "open_webmail_sso": "Prihláste sa do webmailu", From 2892a1b2641dad721b24e6a6aedec589d4eaf0fc Mon Sep 17 00:00:00 2001 From: roswitina Date: Wed, 8 Dec 2021 19:10:54 +0100 Subject: [PATCH 04/63] Typo lang.de.json (#4359) --- data/web/lang/lang.de.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/web/lang/lang.de.json b/data/web/lang/lang.de.json index c94eb31b..b822de15 100644 --- a/data/web/lang/lang.de.json +++ b/data/web/lang/lang.de.json @@ -86,7 +86,7 @@ "public_comment": "Öffentlicher Kommentar", "quota_mb": "Speicherplatz (MiB)", "relay_all": "Alle Empfänger-Adressen relayen", - "relay_all_info": "↪ Wenn nicht alle Empfänger-Adressen relayt werden sollen, müssen \"blinde\" Mailboxen für jede Adresse, die relayt werden soll, erstellen werden.", + "relay_all_info": "↪ Wenn nicht alle Empfänger-Adressen relayt werden sollen, müssen \"blinde\" Mailboxen für jede Adresse, die relayt werden soll, erstellt werden.", "relay_domain": "Diese Domain relayen", "relay_transport_info": "
Info
Transport-Maps können erstellt werden, um individuelle Ziele für eine Relay-Domain zu definieren.", "relay_unknown_only": "Nur nicht-lokale Mailboxen relayen. Existente Mailboxen werden weiterhin lokal zugestellt.", From 77ac84eaa4d91effa7dfad163ea3e1b749f8ec89 Mon Sep 17 00:00:00 2001 From: DerLinkman <62480600+DerLinkman@users.noreply.github.com> Date: Wed, 8 Dec 2021 19:23:28 +0100 Subject: [PATCH 05/63] [WEB] fixed wrong value entry in Pushover.twig (#4363) --- data/web/templates/user/Pushover.twig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/web/templates/user/Pushover.twig b/data/web/templates/user/Pushover.twig index c7abe164..096655cb 100644 --- a/data/web/templates/user/Pushover.twig +++ b/data/web/templates/user/Pushover.twig @@ -39,7 +39,7 @@
- +
From 03542bfa713e236a357e7dbf4acc6cb010151ad0 Mon Sep 17 00:00:00 2001 From: DerLinkman <62480600+DerLinkman@users.noreply.github.com> Date: Wed, 8 Dec 2021 20:17:30 +0100 Subject: [PATCH 06/63] [Dovecot] Update to 2.3.17.1 (#4365) --- data/Dockerfiles/dovecot/Dockerfile | 2 +- docker-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/data/Dockerfiles/dovecot/Dockerfile b/data/Dockerfiles/dovecot/Dockerfile index 1fc40009..ee30eec8 100644 --- a/data/Dockerfiles/dovecot/Dockerfile +++ b/data/Dockerfiles/dovecot/Dockerfile @@ -2,7 +2,7 @@ FROM debian:buster-slim LABEL maintainer "Andre Peters " ARG DEBIAN_FRONTEND=noninteractive -ARG DOVECOT=2.3.17 +ARG DOVECOT=2.3.17.1 ENV LC_ALL C ENV GOSU_VERSION 1.12 diff --git a/docker-compose.yml b/docker-compose.yml index e3693e22..07fa1b61 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -211,7 +211,7 @@ services: - sogo dovecot-mailcow: - image: mailcow/dovecot:1.158 + image: mailcow/dovecot:1.159 depends_on: - mysql-mailcow dns: From 42d756362680fdf66ef93c52d149420626ea1538 Mon Sep 17 00:00:00 2001 From: milkmaker Date: Thu, 9 Dec 2021 21:11:59 +0100 Subject: [PATCH 07/63] [Web] Updated lang.it.json [CI SKIP] (#4367) Co-authored-by: Stefano Co-authored-by: Stefano --- data/web/lang/lang.it.json | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/data/web/lang/lang.it.json b/data/web/lang/lang.it.json index 5b862568..934b652f 100644 --- a/data/web/lang/lang.it.json +++ b/data/web/lang/lang.it.json @@ -18,8 +18,8 @@ "quarantine_attachments": "Allegati in quarantena", "quarantine_category": "Modifica la categoria delle notifiche di quarantena", "quarantine_notification": "Modifica notifiche quarantena", - "ratelimit": "Rate limit", - "recipient_maps": "Recipient maps", + "ratelimit": "Limite di invio", + "recipient_maps": "Mappe dei destinatari", "smtp_ip_access": "Modifica gli host consentiti per SMTP", "sogo_access": "Consenti la gestione dell'accesso SOGo", "sogo_profile_reset": "Ripristina profilo SOGo", @@ -27,7 +27,7 @@ "spam_policy": "Blacklist/Whitelist", "spam_score": "Punteggio SPAM", "syncjobs": "Processi di sync", - "tls_policy": "TLS policy", + "tls_policy": "Politica TLS", "unlimited_quota": "Spazio illimitato per le caselle di posta" }, "add": { @@ -102,7 +102,7 @@ "target_domain": "Dominio di destinazione", "timeout1": "Timeout per la connessione all'host remoto", "timeout2": "Timeout per la connessione all'host locale", - "username": "Username", + "username": "Nome utente", "validate": "Convalida", "validation_success": "Convalidato con successo", "bcc_dest_format": "Il destinatario in copia nascosta deve essere un singolo indirizzo email.
Se si vuole spedire una copia del messaggio a più destinatari, bisogna creare un alias ed utilizzarlo per questa opzione.", @@ -134,18 +134,18 @@ "advanced_settings": "Impostazioni avanzate", "api_allow_from": "Allow API access from these IPs/CIDR network notations", "api_info": "The API is a work in progress. The documentation can be found at /api", - "api_key": "API key", - "api_skip_ip_check": "Skip IP check for API", + "api_key": "Chiave API", + "api_skip_ip_check": "Salta il controllo dell'IP per l'API", "app_links": "App links", - "app_name": "App name", + "app_name": "Nome dell'app", "apps_name": "\"mailcow Apps\" name", - "arrival_time": "Arrival time (server time)", + "arrival_time": "Ora di arrivo (ora del server)", "authed_user": "Auth. user", "ays": "Sei sicuro di voler procedere?", "ban_list_info": "See a list of banned IPs below: network (remaining ban time) - [actions].
IPs queued to be unbanned will be removed from the active ban list within a few seconds.
Red labels indicate active permanent bans by blacklisting.", "change_logo": "Cambia logo", "configuration": "Configurazione", - "convert_html_to_text": "Convert HTML to plain text", + "convert_html_to_text": "Converti HTML in testo semplice", "credentials_transport_warning": "Warning: Adding a new transport map entry will update the credentials for all entries with a matching next hop column.", "customer_id": "ID cliente", "customize": "Personalizzare", @@ -1157,7 +1157,8 @@ "syncjob_EXIT_OVERQUOTA": "La casella di posta del destinatario ha superato la quota", "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Impossibile connettersi al server remoto", "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Nome utente o password errati", - "with_app_password": "con password dell'app" + "with_app_password": "con password dell'app", + "direct_protocol_access": "Questo utente della mailbox ha accesso diretto ed esterno ai seguenti protocolli e applicazioni. Questa impostazione è controllata dal tuo amministratore. Le password delle applicazioni possono essere create per garantire l'accesso ai singoli protocolli e applicazioni.
Il pulsante \"Accedi alla webmail\" fornisce un singolo accesso a SOGo ed è sempre disponibile." }, "warning": { "cannot_delete_self": "Cannot delete logged in user", From 11af104ad9f9f46dcbd194f4f18304341e1dd406 Mon Sep 17 00:00:00 2001 From: Peter Date: Sat, 11 Dec 2021 18:25:40 +0100 Subject: [PATCH 08/63] [GH-Actions][stale] Exempt draft PRs --- .github/workflows/close_old_issues_and_prs.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/close_old_issues_and_prs.yml b/.github/workflows/close_old_issues_and_prs.yml index cfb36037..045605ed 100644 --- a/.github/workflows/close_old_issues_and_prs.yml +++ b/.github/workflows/close_old_issues_and_prs.yml @@ -29,6 +29,7 @@ jobs: exempt-pr-labels: "pinned,security,enhancement,investigating" stale-issue-label: "stale" stale-pr-label: "stale" + exempt-draft-pr: "true" operations-per-run: "250" ascending: "true" #DRY-RUN From f58cc2aa43b96e4de391bec76b6024bac8eddf40 Mon Sep 17 00:00:00 2001 From: Christian Burmeister Date: Mon, 13 Dec 2021 19:01:07 +0100 Subject: [PATCH 09/63] Update docker-compose.yml (#4381) ofelia-mailcow does not have the correct time zone. Test: ocker exec -it mailcowdockerized_ofelia-mailcow_1 date --- docker-compose.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/docker-compose.yml b/docker-compose.yml index c6c5374f..3d7fe46f 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -560,6 +560,7 @@ services: image: mcuadros/ofelia:latest restart: always command: daemon --docker + environment: - TZ=${TZ} depends_on: - sogo-mailcow From 2f9d8213b695dd9cc03c1e60e1aae85ae10d9cab Mon Sep 17 00:00:00 2001 From: Niklas Meyer <62480600+DerLinkman@users.noreply.github.com> Date: Tue, 14 Dec 2021 14:10:31 +0100 Subject: [PATCH 10/63] [Alpine] Update to 3.15 (#4372) --- data/Dockerfiles/acme/Dockerfile | 2 +- data/Dockerfiles/dockerapi/Dockerfile | 2 +- data/Dockerfiles/unbound/Dockerfile | 2 +- docker-compose.yml | 6 +++--- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/data/Dockerfiles/acme/Dockerfile b/data/Dockerfiles/acme/Dockerfile index 82369a88..a0ec058c 100644 --- a/data/Dockerfiles/acme/Dockerfile +++ b/data/Dockerfiles/acme/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.14 +FROM alpine:3.15 LABEL maintainer "Andre Peters " diff --git a/data/Dockerfiles/dockerapi/Dockerfile b/data/Dockerfiles/dockerapi/Dockerfile index b6eef462..fb51f079 100644 --- a/data/Dockerfiles/dockerapi/Dockerfile +++ b/data/Dockerfiles/dockerapi/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.14 +FROM alpine:3.15 LABEL maintainer "Andre Peters " diff --git a/data/Dockerfiles/unbound/Dockerfile b/data/Dockerfiles/unbound/Dockerfile index a937e7e6..54387a6e 100644 --- a/data/Dockerfiles/unbound/Dockerfile +++ b/data/Dockerfiles/unbound/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.14 +FROM alpine:3.15 LABEL maintainer "Andre Peters " diff --git a/docker-compose.yml b/docker-compose.yml index 3d7fe46f..a8549d0d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,7 +2,7 @@ version: '2.1' services: unbound-mailcow: - image: mailcow/unbound:1.14 + image: mailcow/unbound:1.15 environment: - TZ=${TZ} volumes: @@ -384,7 +384,7 @@ services: acme-mailcow: depends_on: - nginx-mailcow - image: mailcow/acme:1.80 + image: mailcow/acme:1.81 dns: - ${IPV4_NETWORK:-172.22.1}.254 environment: @@ -505,7 +505,7 @@ services: - watchdog dockerapi-mailcow: - image: mailcow/dockerapi:1.40 + image: mailcow/dockerapi:1.41 security_opt: - label=disable restart: always From 758f2ef8d1fd1b1f5136c2d26549e23c0b88eb19 Mon Sep 17 00:00:00 2001 From: Niklas Meyer <62480600+DerLinkman@users.noreply.github.com> Date: Wed, 15 Dec 2021 09:59:50 +0100 Subject: [PATCH 11/63] [Compose] Revert prior image tag version change Removed the newer image tag in the docker-compose.yml (one version ahead) --- docker-compose.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index a8549d0d..3d7fe46f 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,7 +2,7 @@ version: '2.1' services: unbound-mailcow: - image: mailcow/unbound:1.15 + image: mailcow/unbound:1.14 environment: - TZ=${TZ} volumes: @@ -384,7 +384,7 @@ services: acme-mailcow: depends_on: - nginx-mailcow - image: mailcow/acme:1.81 + image: mailcow/acme:1.80 dns: - ${IPV4_NETWORK:-172.22.1}.254 environment: @@ -505,7 +505,7 @@ services: - watchdog dockerapi-mailcow: - image: mailcow/dockerapi:1.41 + image: mailcow/dockerapi:1.40 security_opt: - label=disable restart: always From 3a94926913fc34f03c1eab92c94dd65caf9e4dc7 Mon Sep 17 00:00:00 2001 From: milkmaker Date: Wed, 15 Dec 2021 18:48:09 +0100 Subject: [PATCH 12/63] [Web] Updated lang.it.json [CI SKIP] (#4386) Co-authored-by: Stefano Co-authored-by: Stefano --- data/web/lang/lang.it.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/data/web/lang/lang.it.json b/data/web/lang/lang.it.json index 934b652f..955db1fd 100644 --- a/data/web/lang/lang.it.json +++ b/data/web/lang/lang.it.json @@ -138,7 +138,7 @@ "api_skip_ip_check": "Salta il controllo dell'IP per l'API", "app_links": "App links", "app_name": "Nome dell'app", - "apps_name": "\"mailcow Apps\" name", + "apps_name": "Nome \"mailcow Apps\"", "arrival_time": "Ora di arrivo (ora del server)", "authed_user": "Auth. user", "ays": "Sei sicuro di voler procedere?", @@ -191,7 +191,7 @@ "forwarding_hosts_add_hint": "È possibile specificare indirizzi IPv4 / IPv6, reti nella notazione CIDR, nomi host (che verranno risolti in indirizzi IP) o nomi di dominio (che verranno risolti agli indirizzi IP richiamando i record SPF o, in assenza, i record MX) .", "forwarding_hosts_hint": "I messaggi in entrata sono accettati in maniera incondizionata da tutti gli host qui elencati. Questi host sono quindi non controllati tramite DNSBL o sottoposti a greylisting. Lo spam ricevuto da questi host non viene mai rifiutato, ma potrebbe essere archiviato nella cartella Posta indesiderata. L'utilizzo più comune è quello di specificare i server di posta elettronica su cui è stata impostata una regola che inoltra le email in arrivo al server mailcow.", "from": "Da", - "generate": "generate", + "generate": "generare", "guid": "GUID - ID istanza univoco", "guid_and_license": "GUID & Licenza", "hash_remove_info": "Removing a ratelimit hash (if still existing) will reset its counter completely.
\r\n Each hash is indicated by an individual color.", @@ -206,7 +206,7 @@ "include_exclude_info": "Di default - se nessuna voce viene selezionata - tutte le caselle di posta risultano attivate", "includes": "Includi questi destinatari", "is_mx_based": "Basato sul record MX", - "last_applied": "Last applied", + "last_applied": "Ultima applicazione", "license_info": "Non è necessario essere in possesso di una licenza ma aiuta gli sviluppatori a far crescere il prodotto.
Registra qui il tuo GUID oppure acquista il supporto per la tua installazione di mailcow.", "link": "Link", "loading": "Caricamento in corso...", @@ -231,7 +231,7 @@ "optional": "facoltativo", "password": "Password", "password_length": "Lunghezza password", - "password_policy": "Password policy", + "password_policy": "Criteri della password", "password_policy_chars": "Deve contenere almeno un carattere alfabetico", "password_policy_length": "La lunghezza minima della password è %d caratteri", "password_policy_lowerupper": "Deve contenere caratteri minuscoli e maiuscoli", @@ -283,7 +283,7 @@ "remove": "Rimuovi", "remove_row": "Elimina riga", "reset_default": "Riporta alle condizioni di default", - "reset_limit": "Remove hash", + "reset_limit": "Rimuovi hash", "routing": "Routing", "rsetting_add_rule": "Aggiungi regola", "rsetting_content": "Contenuto della regola", @@ -335,7 +335,7 @@ "unban_pending": "unban pending", "unchanged_if_empty": "Se immutato lasciare vuoto", "upload": "Upload", - "username": "Username", + "username": "Nome utente", "validate_license_now": "Validate GUID against license server", "verify": "Verifica", "yes": "✓", From e8ca5888843e887abde90e8eb5b40f182f6a888f Mon Sep 17 00:00:00 2001 From: Niklas Meyer <62480600+DerLinkman@users.noreply.github.com> Date: Fri, 17 Dec 2021 12:43:05 +0100 Subject: [PATCH 13/63] [Solr] Remove breached class from log4j-core.jar (#4390) --- data/Dockerfiles/solr/Dockerfile | 5 +++++ docker-compose.yml | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/data/Dockerfiles/solr/Dockerfile b/data/Dockerfiles/solr/Dockerfile index 6dfec41f..06299257 100644 --- a/data/Dockerfiles/solr/Dockerfile +++ b/data/Dockerfiles/solr/Dockerfile @@ -16,10 +16,15 @@ RUN dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')" \ tzdata \ curl \ bash \ + zip \ && apt-get autoclean \ && rm -rf /var/lib/apt/lists/* \ && chmod +x /solr.sh \ && sync \ && bash /solr.sh --bootstrap + +RUN zip -q -d /opt/solr/server/lib/ext/log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class + +RUN apt remove zip -y CMD ["/solr.sh"] diff --git a/docker-compose.yml b/docker-compose.yml index 3d7fe46f..acd2ea15 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -523,7 +523,7 @@ services: - dockerapi solr-mailcow: - image: mailcow/solr:1.8 + image: mailcow/solr:1.8.1 restart: always volumes: - solr-vol-1:/opt/solr/server/solr/dovecot-fts/data:Z From 36e29710da8558bb779e0a0aefd8f711f257a553 Mon Sep 17 00:00:00 2001 From: Razvan Date: Wed, 22 Dec 2021 20:34:50 +0200 Subject: [PATCH 14/63] [Web] Updated lang.ro.json (#4396) [Web] Updated lang.ro.json --- data/web/lang/lang.ro.json | 79 ++++++++++++++++++++++++++++++-------- data/web/mobileconfig.php | 8 ++++ 2 files changed, 72 insertions(+), 15 deletions(-) diff --git a/data/web/lang/lang.ro.json b/data/web/lang/lang.ro.json index 20ba0e7e..44104a14 100644 --- a/data/web/lang/lang.ro.json +++ b/data/web/lang/lang.ro.json @@ -42,8 +42,10 @@ "alias_domain_info": "Doar nume de domenii valide (separate prin virgulă).", "app_name": "Nume aplicație", "app_password": "Adaugă parolă aplicație", + "app_passwd_protocols": "Protocoale permise pentru parola aplicației", "automap": "Încearcă maparea automată a folderelor (\"Obiecte trimise\", \"Trimise\" => \"Trimise\" etc.)", "backup_mx_options": "Opțiuni backup MX", + "bcc_dest_format": "Destinația BCC trebuie să fie o singură adresă de email validă.", "comment_info": "Un comentariu privat nu este vizibil pentru utilizator, în timp ce un comentariu public este afișat ca un tooltip când se trece peste el într-o privire de ansamblu asupra utilizatorilor", "custom_params": "Parametri personalizați", "custom_params_hint": "Corect: --param=xy, greşit: --param xy", @@ -133,6 +135,8 @@ "api_allow_from": "Permite accesul API de la aceste adrese IP/CIDR", "api_info": "API-ul este în dezvoltare. Documentația se găsește la adresa: /api", "api_key": "Cheie API", + "api_read_only": "Acces doar pentru citire", + "api_read_write": "Acces pentru citire și scriere", "api_skip_ip_check": "Săriți verificarea IP pentru API", "app_links": "Linkuri aplicație", "app_name": "Nume aplicație", @@ -220,6 +224,8 @@ "no_active_bans": "Nu există interdicții active", "no_new_rows": "Nu există alte rânduri disponibile", "no_record": "Nici o înregistrare", + "oauth2_apps": "Aplicații OAuth2", + "oauth2_add_client": "Adaugă client OAuth2", "oauth2_client_id": "ID client", "oauth2_client_secret": "Secret client", "oauth2_info": "Implementarea OAuth2 suportă tipul de acces \"Cod de autorizare\" și emite jetoane de actualizare.
\r\nServerul emite automat noi jetoane de actualizare, după ce a fost folosit un jeton de actualizare.

\r\n→ Scopul implicit este profil. Doar utilizatorii căsuței poștale pot fi autentificați cu OAuth2. Dacă parametrul scop este omis, acesta revine la profil.
\r\n→ Parametrul stare trebuie să fie trimis de client ca parte a cererii de autorizare.

\r\nCăile pentru cereri către API-ul OAuth2:
\r\n
    \r\n
  • Calea de autorizare: /oauth/autorize
    • \r\n
  • Calea jetonului: /oauth/token
    • \r\n
  • Calea pentru resursă: /oauth/profile
    • \r\n
\r\nRegenerarea secretului clientului nu va expira codurile de autorizare existente, dar vor eșua să-și reînnoiască jetonul.

\r\nRevocarea jetoanelor clientului va cauza încheierea imediată a tuturor sesiunilor active. Toți clienții trebuie să se autentifice din nou.", @@ -497,6 +503,7 @@ "optional": "Această înregistrare este opțională." }, "edit": { + "acl": "ACL (Permisiune)", "active": "Activ", "admin": "Editează administrator", "advanced_settings": "Setări avansate", @@ -506,9 +513,10 @@ "allowed_protocols": "Protocoale permise", "app_name": "Nume aplicație", "app_passwd": "Parolă apicație", + "app_passwd_protocols": "Protocoale permise pentru parola aplicației", "automap": "Încearcă maparea automată a folderelor (\"Obiecte trimise\", \"Trimise\" => \"Trimise\" etc.)", "backup_mx_options": "Opțiuni backup MX", - "bcc_dest_format": "Destinația BCC trebuie să fie o singură adresă de email validă.", + "bcc_dest_format": "Destinația BCC trebuie să fie o singură adresă de email validă.
Dacă trebuie să trimiteți o copie la mai multe adrese, creați un alias și utilizați-l aici.", "client_id": "ID Client", "client_secret": "Secret client", "comment_info": "Un comentariu privat nu este vizibil pentru utilizator, în timp ce un comentariu public este afișat ca un tooltip când se trece peste el într-o privire de ansamblu asupra utilizatorilor", @@ -550,12 +558,14 @@ "mbox_rl_info": "Această limitare de rată se aplică pe numele de conectare SASL, se potrivește cu orice adresă „de la” folosită de către utilizatorul autentificat. O limitare a ratei căsuței poștale înlocuiește limitarea ratei la nivel de domeniu.", "mins_interval": "Interval (min)", "multiple_bookings": "Rezervări multiple", + "none_inherit": "Nici una / Moștenește", "nexthop": "Următorul hop", "password": "Parolă", "password_repeat": "Confirmă parolă (repetă)", "previous": "Pagina precedentă", "private_comment": "Comentariu privat", "public_comment": "Comentariu public", + "pushover": "Pushover", "pushover_evaluate_x_prio": "Escalează e-mailurile cu prioritate înaltă [X-Priority: 1]", "pushover_info": "Setările de notificare push se vor aplica tuturor e-mailurilor curate (non-spam) livrate la % s inclusiv aliasuri (partajate, care nu sunt partajate, etichetate).", "pushover_only_x_prio": "Luați în considerare doar e-mailurile cu prioritate înaltă [X-Priority: 1]", @@ -586,6 +596,8 @@ "sieve_desc": "Descriere scurtă", "sieve_type": "Tip filtru", "skipcrossduplicates": "Sari peste mesajele duplicate din toate folderele (primul venit, primul servit)", + "sogo_access": "Acordați acces direct de conectare la SOGo", + "sogo_access_info": "Conectarea unică din interfața de administrare a e-mailului continuă să funcționeze. Această setare nu afectează accesul la toate celelalte servicii și nici nu șterge sau modifică profilul SOGo existent al unui utilizator.", "sogo_visible": "Aliasul este vizibil în SOGo", "sogo_visible_info": "Această opțiune afectează doar obiecte, care pot fi afișate în SOGo (adrese alias partajate sau ne-partajate cu cel puțin o căsuță poștală locală). Dacă este ascuns, un alias nu va apărea ca expeditor selectabil în SOGo.", "spam_alias": "Crează sau modifică adrese alias limitate în funcție de timp", @@ -603,6 +615,21 @@ "username": "Nume de utilizator", "validate_save": "Validează și salvează" }, + "fido2": { + "set_fn": "Setați un nume prietenos", + "fn": "Nume prietenos", + "rename": "redenumiți", + "confirm": "Confirmați", + "register_status": "Starea înregistrării", + "known_ids": "ID-uri cunoscute", + "none": "Dezactivat", + "set_fido2": "Înregistrați dispozitivul FIDO2", + "set_fido2_touchid": "Înregistrați Touch ID pe Apple M1", + "start_fido2_validation": "Începeți validarea FIDO2", + "fido2_auth": "Conectați-vă cu FIDO2", + "fido2_success": "Dispozitivul a fost înregistrat cu succes", + "fido2_validation_failed": "Validarea a eșuat" + }, "footer": { "cancel": "Anulează", "confirm_delete": "Confirmă ștergerea", @@ -664,6 +691,7 @@ "alias_domain_alias_hint": "Aliasurile nu sunt aplicate automat pe domeniile alias. O adresă alias aliasul-meu@domeniu nu acoperă adresa aliasul-meu@domeniu-alias (unde \"domeniu-alias\" este un domeniu alias imaginar pentru \"domeniu\").
Vă rugăm să utilizați un filtru sită pentru a redirecționa poșta către o căsuță poștală externă (consultați zona \"Filtre\" sau utilizați SOGo -> Redirecționare).", "alias_domain_backupmx": "Alias domeniu inactiv pentru domeniu releu", "aliases": "Aliasuri", + "all_domains": "Toate Domeniile", "allow_from_smtp": "Permiteți acestor adrese IP să utilizeze numai SMTP", "allow_from_smtp_info": "Lăsați gol pentru a permite tuturor expeditorilor.
Adrese și rețele IPv4/IPv6.", "allowed_protocols": "Protocoale permise", @@ -687,6 +715,7 @@ "booking_custom_short": "Limită maximă", "booking_ltnull": "Nelimitat, dar arată ca ocupat atunci când este rezervat", "booking_lt0_short": "Limită redusă", + "catch_all": "Prinde-Tot", "daily": "Zilnic", "deactivate": "Deactivează", "description": "Descriere", @@ -704,6 +733,8 @@ "filter_table": "Tabel filtre", "filters": "Filtre", "fname": "Nume complet", + "goto_ham": "Învață ca ham", + "goto_spam": "Învață ca spam", "hourly": "Din oră în oră", "in_use": "În uz (%)", "inactive": "Inactiv", @@ -736,6 +767,7 @@ "quarantine_notification": "Notificări de carantină", "quarantine_category": "Categoria notificărilor despre carantină", "quick_actions": "Acţiuni", + "recipient": "Destinatar", "recipient_map": "Hartă destinatar", "recipient_map_info": "Hărțile destinatarilor sunt folosite pentru a înlocui adresa de destinație a unui mesaj înainte de a fi livrat.", "recipient_map_new": "Destinatar nou", @@ -746,6 +778,7 @@ "remove": "Elimină", "resources": "Resurse", "running": "Rulare", + "sender": "Expeditor", "set_postfilter": "Marchează ca postfiltru", "set_prefilter": "Marchează ca prefiltru", "sieve_info": "Poți stoca mai multe filtre pentru fiecare utilizator, dar numai un singur prefiltru și un singur postfiltru pot fi active în același timp.
\nFiecare filtru va fi procesat în ordinea descrisă. Nici un script eșuat, nici un \"keep;\" emis nu va opri procesarea altor scripturi.Modificările aduse scripturilor sită globale vor declanșa o repornire a Dovecot.
\nPrefilter → User scripts → Postfilter → global sieve postfilter", @@ -765,6 +798,15 @@ "stats": "Statistici", "status": "Stare", "sync_jobs": "Lucrări de sincronizare", + "syncjob_check_log": "Verificați jurnalul", + "syncjob_last_run_result": "Rezultatul ultimei rulări", + "syncjob_EX_OK": "Succes", + "syncjob_EXIT_CONNECTION_FAILURE": "Problemă de conectare", + "syncjob_EXIT_TLS_FAILURE": "Problemă cu conexiunea criptată", + "syncjob_EXIT_AUTHENTICATION_FAILURE": "Problemă de autentificare", + "syncjob_EXIT_OVERQUOTA": "Cutia poștală țintă depășește cota maximă", + "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Nu se poate conecta la server", + "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Nume de utilizator sau parolă greșite", "table_size": "Mărime tabel", "table_size_show_n": "Arată %s articole", "target_address": "Adresă goto", @@ -848,6 +890,13 @@ "text_plain_content": "Conținut (text/simplu)", "toggle_all": "Comută toate" }, + "ratelimit": { + "disabled": "Dezactivat", + "second": "mesaje / sec", + "minute": "mesaje / min", + "hour": "mesaje / ora", + "day": "mesaje / zi" + }, "start": { "help": "Afișează/Ascunde panoul de ajutor", "imap_smtp_server_auth_info": "Utilizează adresa completă de email și mecanismul de autentificare SIMPLU.
\nDatele tale de conectare vor fi criptate prin criptarea obligatorie de la server.", @@ -957,20 +1006,6 @@ "waiting_usb_register": "În așteptarea dispozitivului USB...

Introdu parola ta mai sus și confirmă înregistrarea ta U2F atingând butonul de pe dispozitivul tău USB U2F.", "yubi_otp": "Autentificare Yubico OTP" }, - "fido2": { - "set_fn": "Setați un nume prietenos", - "fn": "Nume prietenos", - "rename": "redenumiți", - "confirm": "Confirmați", - "register_status": "Starea înregistrării", - "known_ids": "ID-uri cunoscute", - "none": "Dezactivat", - "set_fido2": "Înregistrați dispozitivul FIDO2", - "start_fido2_validation": "Începeți validarea FIDO2", - "fido2_auth": "Conectați-vă cu FIDO2", - "fido2_success": "Dispozitivul a fost înregistrat cu succes", - "fido2_validation_failed": "Validarea a esuat" - }, "user": { "action": "Acțiune", "active": "Activ", @@ -987,12 +1022,15 @@ "aliases_also_send_as": "De asemenea, este permis să trimită ca utilizator", "aliases_send_as_all": "Nu se verifică accesul expeditorului pentru următorul(arele) domeniu(i) și domeniile sale alias", "app_hint": "Parolele aplicației sunt parole alternative pentru autentificarea IMAP, SMTP, CalDAV, CardDAV și EAS. Numele de utilizator rămâne neschimbat.
SOGo nu este disponibil prin parolele aplicației.", + "allowed_protocols": "Protocoale permise", "app_name": "Nume aplicație", "app_passwds": "Parole aplicație", "apple_connection_profile": "Profil de conexiune Apple", "apple_connection_profile_complete": "Acest profil de conexiune include parametrii IMAP și SMTP, precum și calDAV (calendar) și carduri CardDAV (contacte) pentru dispozitivele Apple.", "apple_connection_profile_mailonly": "Acest profil de conexiune include parametrii de configurare IMAP și SMTP pentru dispozitivele Apple.", + "apple_connection_profile_with_app_password": "O nouă parolă pentru aplicație este generată și adăugată la profil, astfel încât să nu fie necesară introducerea unei parole la configurarea dispozitivului. Vă rugăm să nu partajați fișierul, deoarece oferă acces deplin la căsuța dvs. poștală.", "change_password": "Schimbă parola", + "change_password_hint_app_passwords": "Contul dvs. are {{number_of_app_passwords}} parole de aplicație care nu vor fi modificate. Pentru a le gestiona, accesați secțiunea Parole aplicație.", "clear_recent_successful_connections": "Ștergeți conexiunile reușite văzute", "client_configuration": "Afișează ghidurile de configurare pentru clienții de email și smartphone-uri", "create_app_passwd": "Crează parola aplicației", @@ -1003,6 +1041,7 @@ "delete_ays": "Vă rugăm să confirmați stergerea.", "direct_aliases": "Adrese alias directe", "direct_aliases_desc": "Adresele alias directe sunt afectate de setările filtrului de spam și ale politicii TLS.", + "direct_protocol_access": "Acest utilizator are acces direct, extern la următoarele protocoale și aplicații. Această setare este controlată de administratorul dvs. Parolele pentru aplicații pot fi create pentru a acorda acces la protocoale și aplicații individuale.
Butonul \"Conectați-vă la webmail\" oferă conectare unică la SOGo și este întotdeauna disponibil.", "eas_reset": "Resetează memoria cache a dispozitivului ActiveSync", "eas_reset_help": "În multe cazuri, resetarea cache-ului dispozitivului va ajuta la recuperarea unui profil ActiveSync defect.
Atenţie: Toate elementele vor fi descărcate din nou!", "eas_reset_now": "Resetează acum", @@ -1096,6 +1135,15 @@ "spamfilter_yellow": "Galben: acest mesaj poate fi spam, va fi etichetat ca spam și va fi mutat în dosarul de junk", "status": "Stare", "sync_jobs": "Lucrări de sincronizare", + "syncjob_check_log": "Verificați jurnalul", + "syncjob_last_run_result": "Rezultatul ultimei rulări", + "syncjob_EX_OK": "Succes", + "syncjob_EXIT_CONNECTION_FAILURE": "Problemă de conectare", + "syncjob_EXIT_TLS_FAILURE": "Problemă cu conexiunea criptată", + "syncjob_EXIT_AUTHENTICATION_FAILURE": "Problemă de autentificare", + "syncjob_EXIT_OVERQUOTA": "Cutia poștală țintă depășește cota maximă", + "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Nu se poate conecta la server", + "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Nume de utilizator sau parolă greșite", "tag_handling": "Setează manevrarea pentru mailurile etichetate", "tag_help_example": "Exemplu pentru o adresă de email etichetată: me+Facebook@example.org", "tag_help_explain": "În subfolder: un nou subfolder numit după etichetă va fi creat sub INBOX (\"INBOX/Facebook\").
\nÎn subiect: numele etichetelor va fi prefixat la subiectul mailurilor, de exemplu: \"[Facebook] My News\".", @@ -1115,6 +1163,7 @@ "week": "săptămână", "weekly": "Săptămânal", "weeks": "săptămâni", + "with_app_password": "cu parola aplicație", "year": "an", "years": "ani" }, diff --git a/data/web/mobileconfig.php b/data/web/mobileconfig.php index 532e405c..44aaa30a 100644 --- a/data/web/mobileconfig.php +++ b/data/web/mobileconfig.php @@ -153,6 +153,10 @@ echo '' . "\n"; CalDAVUsername + + CalDAVPassword + + PayloadDescription Configures CalDAV account. PayloadDisplayName @@ -181,6 +185,10 @@ echo '' . "\n"; CardDAVUsername + + CardDAVPassword + + PayloadDescription Configures CardDAV accounts PayloadDisplayName From 29bd368a9819548db16e86b4be3dbb2ed5ad3eb1 Mon Sep 17 00:00:00 2001 From: Niklas Meyer <62480600+DerLinkman@users.noreply.github.com> Date: Fri, 24 Dec 2021 05:55:17 +0100 Subject: [PATCH 15/63] [SOGo] Update to 5.4.0 (#4397) --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index acd2ea15..0317fb1a 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -164,7 +164,7 @@ services: - phpfpm sogo-mailcow: - image: mailcow/sogo:1.104 + image: mailcow/sogo:1.105 environment: - DBNAME=${DBNAME} - DBUSER=${DBUSER} From a0b0d36e222a47fd9bbf8064aa85954d7e4e89f0 Mon Sep 17 00:00:00 2001 From: Alex Beakes Date: Sun, 2 Jan 2022 03:51:09 +0300 Subject: [PATCH 16/63] Fix pip3 uninstall error --- data/Dockerfiles/netfilter/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/Dockerfiles/netfilter/Dockerfile b/data/Dockerfiles/netfilter/Dockerfile index c63e99bc..0b6b6b6e 100644 --- a/data/Dockerfiles/netfilter/Dockerfile +++ b/data/Dockerfiles/netfilter/Dockerfile @@ -16,7 +16,7 @@ RUN apk add --virtual .build-deps \ tzdata \ py3-pip \ musl-dev \ -&& pip3 install --upgrade pip \ +&& pip3 install --ignore-installed --upgrade pip \ python-iptables \ redis \ ipaddress \ From 6ef8b90c767473e6f7a5b66973af77151b2677a3 Mon Sep 17 00:00:00 2001 From: milkmaker Date: Sun, 9 Jan 2022 16:23:17 +0100 Subject: [PATCH 17/63] [Web] Updated lang.fr.json [CI SKIP] (#4417) Co-authored-by: crep7424 Co-authored-by: crep7424 --- data/web/lang/lang.fr.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/data/web/lang/lang.fr.json b/data/web/lang/lang.fr.json index e0750c5e..b6492fcb 100644 --- a/data/web/lang/lang.fr.json +++ b/data/web/lang/lang.fr.json @@ -259,7 +259,7 @@ "recipients": "Destinataires", "refresh": "Rafraîchir", "regen_api_key": "Regénérer la clé API", - "regex_maps": "Cartes Regex (Regex = expression régulière)", + "regex_maps": "Cartes Regex (expression régulière)", "relay_from": "\"De:\" adresse", "relay_run": "Lancer le test", "relayhosts": "Transports de l’expéditeur", @@ -699,7 +699,7 @@ "private_comment": "Commentaire privé", "public_comment": "Commentaire public", "q_add_header": "Courriers indésirables", - "q_all": "Toutes les catégories", + "q_all": " quand déplacé dans le dossier spam ou rejeté", "q_reject": "Rejecté", "quarantine_notification": "Avis de quarantaine", "quarantine_category": "Catégorie de la notification de quarantaine", @@ -729,7 +729,7 @@ "sogo_visible": "Alias visible dans SOGo", "sogo_visible_n": "Masquer alias dans SOGo", "sogo_visible_y": "Afficher alias dans SOGo", - "spam_aliases": "Alias temp.", + "spam_aliases": "Alias temporaire", "stats": "Statistiques", "status": "Statut", "sync_jobs": "Tâches de synchronisation", @@ -1070,7 +1070,7 @@ "warning": { "cannot_delete_self": "Impossible de supprimer l’utilisateur connecté", "domain_added_sogo_failed": "Ajout d’un domaine mais échec du redémarrage de Sogo, veuillez vérifier les journaux de votre serveur.", - "dovecot_restart_failed": "Dovecot n’a pas pu redémarrer, veuillez vérifier les journaux de votre serveur.", + "dovecot_restart_failed": "Dovecot n’a pas pu redémarrer, veuillez vérifier les journaux", "fuzzy_learn_error": "Erreur d’apprentissage du hachage flou: %s", "hash_not_found": "Hachage non trouvé ou déjà supprimé", "ip_invalid": "IP non valide ignorée: %s", From 026be03a6a335f8146c75d83557eb3d410ec857c Mon Sep 17 00:00:00 2001 From: Niklas Meyer <62480600+DerLinkman@users.noreply.github.com> Date: Tue, 11 Jan 2022 09:52:58 +0100 Subject: [PATCH 18/63] [Compose] Updated Unbound Tag to 1.15 (Alpine Update) --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 0317fb1a..83b10502 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,7 +2,7 @@ version: '2.1' services: unbound-mailcow: - image: mailcow/unbound:1.14 + image: mailcow/unbound:1.15 environment: - TZ=${TZ} volumes: From b0679b1c4fa223d67e16d04220ae8d29afb80e7d Mon Sep 17 00:00:00 2001 From: Niklas Meyer <62480600+DerLinkman@users.noreply.github.com> Date: Tue, 11 Jan 2022 10:00:24 +0100 Subject: [PATCH 19/63] [Compose] Docker Tag fix to include Alpine Update Referencing: https://github.com/mailcow/mailcow-dockerized/pull/4372 --- docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 83b10502..24c6374d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -384,7 +384,7 @@ services: acme-mailcow: depends_on: - nginx-mailcow - image: mailcow/acme:1.80 + image: mailcow/acme:1.81 dns: - ${IPV4_NETWORK:-172.22.1}.254 environment: @@ -505,7 +505,7 @@ services: - watchdog dockerapi-mailcow: - image: mailcow/dockerapi:1.40 + image: mailcow/dockerapi:1.41 security_opt: - label=disable restart: always From d1d134038ffa2bde66ccfafd842dcafe5eb3ea11 Mon Sep 17 00:00:00 2001 From: FreddlePat Date: Wed, 12 Jan 2022 21:09:18 +0100 Subject: [PATCH 20/63] migrating from u2f-api.js to webauthn --- data/web/inc/functions.inc.php | 431 ++++++++++++------ data/web/inc/init_db.inc.php | 2 +- .../Attestation/AttestationObject.php | 67 ++- .../Attestation/AuthenticatorData.php | 8 +- .../Attestation/Format/AndroidKey.php | 9 +- .../Attestation/Format/AndroidSafetyNet.php | 9 +- .../lib/WebAuthn/Attestation/Format/Apple.php | 9 +- .../Attestation/Format/FormatBase.php | 13 +- .../lib/WebAuthn/Attestation/Format/None.php | 12 +- .../WebAuthn/Attestation/Format/Packed.php | 9 +- .../lib/WebAuthn/Attestation/Format/Tpm.php | 9 +- .../lib/WebAuthn/Attestation/Format/U2f.php | 7 +- .../inc/lib/WebAuthn/Binary/ByteBuffer.php | 50 +- .../web/inc/lib/WebAuthn/CBOR/CborDecoder.php | 6 +- data/web/inc/lib/WebAuthn/LICENSE | 22 - data/web/inc/lib/WebAuthn/WebAuthn.php | 118 ++++- .../inc/lib/WebAuthn/WebAuthnException.php | 2 +- data/web/inc/prerequisites.inc.php | 28 +- data/web/inc/triggers.inc.php | 17 +- data/web/inc/vars.inc.php | 6 + data/web/json_api.php | 107 ++++- data/web/lang/lang.ca.json | 6 +- data/web/lang/lang.cs.json | 14 +- data/web/lang/lang.da.json | 10 +- data/web/lang/lang.de.json | 10 +- data/web/lang/lang.en.json | 10 +- data/web/lang/lang.es.json | 10 +- data/web/lang/lang.fi.json | 14 +- data/web/lang/lang.fr.json | 14 +- data/web/lang/lang.it.json | 14 +- data/web/lang/lang.ko.json | 14 +- data/web/lang/lang.lv.json | 6 +- data/web/lang/lang.nl.json | 14 +- data/web/lang/lang.pl.json | 6 +- data/web/lang/lang.ro.json | 14 +- data/web/lang/lang.ru.json | 10 +- data/web/lang/lang.sk.json | 10 +- data/web/lang/lang.sv.json | 12 +- data/web/lang/lang.zh.json | 14 +- .../templates/admin/tab-config-admins.twig | 2 +- data/web/templates/base.twig | 160 ++++--- data/web/templates/modals/footer.twig | 74 +-- 42 files changed, 918 insertions(+), 461 deletions(-) delete mode 100644 data/web/inc/lib/WebAuthn/LICENSE diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php index 7ac0af58..b222e13d 100644 --- a/data/web/inc/functions.inc.php +++ b/data/web/inc/functions.inc.php @@ -1142,7 +1142,7 @@ function set_tfa($_data) { global $yubi; global $u2f; global $tfa; - $_data_log = $_data; + $_data_log = $_data["tfa_method"]; !isset($_data_log['confirm_password']) ?: $_data_log['confirm_password'] = '*'; $username = $_SESSION['mailcow_cc_username']; if (!isset($_SESSION['mailcow_cc_role']) || empty($username)) { @@ -1183,6 +1183,8 @@ function set_tfa($_data) { return false; } } + + switch ($_data["tfa_method"]) { case "yubi_otp": $key_id = (!isset($_data["key_id"])) ? 'unidentified' : $_data["key_id"]; @@ -1240,14 +1242,18 @@ function set_tfa($_data) { 'msg' => array('object_modified', htmlspecialchars($username)) ); break; + // u2f - deprecated, should be removed case "u2f": $key_id = (!isset($_data["key_id"])) ? 'unidentified' : $_data["key_id"]; try { $reg = $u2f->doRegister(json_decode($_SESSION['regReq']), json_decode($_data['token'])); + $stmt = $pdo->prepare("DELETE FROM `tfa` WHERE `username` = :username AND `authmech` != 'u2f'"); $stmt->execute(array(':username' => $username)); + $stmt = $pdo->prepare("INSERT INTO `tfa` (`username`, `key_id`, `authmech`, `keyHandle`, `publicKey`, `certificate`, `counter`, `active`) VALUES (?, ?, 'u2f', ?, ?, ?, ?, '1')"); $stmt->execute(array($username, $key_id, $reg->keyHandle, $reg->publicKey, $reg->certificate, $reg->counter)); + $_SESSION['return'][] = array( 'type' => 'success', 'log' => array(__FUNCTION__, $_data_log), @@ -1286,6 +1292,29 @@ function set_tfa($_data) { ); } break; + case "webauthn": + $key_id = (!isset($_data["key_id"])) ? 'unidentified' : $_data["key_id"]; + + $stmt = $pdo->prepare("DELETE FROM `tfa` WHERE `username` = :username AND `authmech` != 'webauthn'"); + $stmt->execute(array(':username' => $username)); + + $stmt = $pdo->prepare("INSERT INTO `tfa` (`username`, `key_id`, `authmech`, `keyHandle`, `publicKey`, `certificate`, `counter`, `active`) + VALUES (?, ?, 'webauthn', ?, ?, ?, ?, '1')"); + $stmt->execute(array( + $username, + $key_id, + base64_encode($_data['registration']->credentialId), + $_data['registration']->credentialPublicKey, + $_data['registration']->certificate, + 0 + )); + + $_SESSION['return'][] = array( + 'type' => 'success', + 'log' => array(__FUNCTION__, $_data_log), + 'msg' => array('object_modified', $username) + ); + break; case "none": $stmt = $pdo->prepare("DELETE FROM `tfa` WHERE `username` = :username"); $stmt->execute(array(':username' => $username)); @@ -1516,6 +1545,7 @@ function get_tfa($username = null) { } return $data; break; + // u2f - deprecated, should be removed case "u2f": $data['name'] = "u2f"; $data['pretty'] = "Fido U2F"; @@ -1534,7 +1564,7 @@ function get_tfa($username = null) { $data['pretty'] = "HMAC-based OTP"; return $data; break; - case "totp": + case "totp": $data['name'] = "totp"; $data['pretty'] = "Time-based OTP"; $stmt = $pdo->prepare("SELECT `id`, `key_id`, `secret` FROM `tfa` WHERE `authmech` = 'totp' AND `username` = :username"); @@ -1546,7 +1576,20 @@ function get_tfa($username = null) { $data['additional'][] = $row; } return $data; - break; + break; + case "webauthn": + $data['name'] = "webauthn"; + $data['pretty'] = "WebAuthn"; + $stmt = $pdo->prepare("SELECT `id`, `key_id` FROM `tfa` WHERE `authmech` = 'webauthn' AND `username` = :username"); + $stmt->execute(array( + ':username' => $username, + )); + $rows = $stmt->fetchAll(PDO::FETCH_ASSOC); + while($row = array_shift($rows)) { + $data['additional'][] = $row; + } + return $data; + break; default: $data['name'] = 'none'; $data['pretty'] = "-"; @@ -1560,140 +1603,261 @@ function get_tfa($username = null) { return $data; } } -function verify_tfa_login($username, $token) { - global $pdo; - global $yubi; - global $u2f; - global $tfa; - $stmt = $pdo->prepare("SELECT `authmech` FROM `tfa` - WHERE `username` = :username AND `active` = '1'"); - $stmt->execute(array(':username' => $username)); - $row = $stmt->fetch(PDO::FETCH_ASSOC); +function verify_tfa_login($username, $_data, $WebAuthn) { + global $pdo; + global $yubi; + global $u2f; + global $tfa; + $stmt = $pdo->prepare("SELECT `authmech` FROM `tfa` + WHERE `username` = :username AND `active` = '1'"); + $stmt->execute(array(':username' => $username)); + $row = $stmt->fetch(PDO::FETCH_ASSOC); - switch ($row["authmech"]) { - case "yubi_otp": - if (!ctype_alnum($token) || strlen($token) != 44) { - $_SESSION['return'][] = array( - 'type' => 'danger', - 'log' => array(__FUNCTION__, $username, '*'), - 'msg' => array('yotp_verification_failed', 'token length error') - ); - return false; - } - $yubico_modhex_id = substr($token, 0, 12); - $stmt = $pdo->prepare("SELECT `id`, `secret` FROM `tfa` - WHERE `username` = :username - AND `authmech` = 'yubi_otp' - AND `active`='1' - AND `secret` LIKE :modhex"); - $stmt->execute(array(':username' => $username, ':modhex' => '%' . $yubico_modhex_id)); - $row = $stmt->fetch(PDO::FETCH_ASSOC); - $yubico_auth = explode(':', $row['secret']); - $yubi = new Auth_Yubico($yubico_auth[0], $yubico_auth[1]); - $yauth = $yubi->verify($token); - if (PEAR::isError($yauth)) { - $_SESSION['return'][] = array( - 'type' => 'danger', - 'log' => array(__FUNCTION__, $username, '*'), - 'msg' => array('yotp_verification_failed', $yauth->getMessage()) - ); - return false; - } - else { - $_SESSION['tfa_id'] = $row['id']; - $_SESSION['return'][] = array( - 'type' => 'success', - 'log' => array(__FUNCTION__, $username, '*'), - 'msg' => 'verified_yotp_login' - ); - return true; - } - $_SESSION['return'][] = array( - 'type' => 'danger', - 'log' => array(__FUNCTION__, $username, '*'), - 'msg' => array('yotp_verification_failed', 'unknown') - ); - return false; - break; - case "u2f": - try { - $reg = $u2f->doAuthenticate(json_decode($_SESSION['authReq']), get_u2f_registrations($username), json_decode($token)); - $stmt = $pdo->prepare("SELECT `id` FROM `tfa` WHERE `keyHandle` = ?"); - $stmt->execute(array($reg->keyHandle)); - $row_key_id = $stmt->fetch(PDO::FETCH_ASSOC); - $_SESSION['tfa_id'] = $row_key_id['id']; - $_SESSION['authReq'] = null; - $_SESSION['return'][] = array( - 'type' => 'success', - 'log' => array(__FUNCTION__, $username, '*'), - 'msg' => 'verified_u2f_login' - ); - return true; - } - catch (Exception $e) { - $_SESSION['return'][] = array( - 'type' => 'danger', - 'log' => array(__FUNCTION__, $username, '*'), - 'msg' => array('u2f_verification_failed', $e->getMessage()) - ); - $_SESSION['regReq'] = null; - return false; - } - $_SESSION['return'][] = array( - 'type' => 'danger', - 'log' => array(__FUNCTION__, $username, '*'), - 'msg' => array('u2f_verification_failed', 'unknown') - ); - return false; - break; - case "hotp": - return false; - break; - case "totp": - try { - $stmt = $pdo->prepare("SELECT `id`, `secret` FROM `tfa` - WHERE `username` = :username - AND `authmech` = 'totp' - AND `active`='1'"); - $stmt->execute(array(':username' => $username)); - $rows = $stmt->fetchAll(PDO::FETCH_ASSOC); - foreach ($rows as $row) { - if ($tfa->verifyCode($row['secret'], $_POST['token']) === true) { - $_SESSION['tfa_id'] = $row['id']; - $_SESSION['return'][] = array( - 'type' => 'success', + switch ($row["authmech"]) { + case "yubi_otp": + if (!ctype_alnum($_data['token']) || strlen($_data['token']) != 44) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $username, '*'), + 'msg' => array('yotp_verification_failed', 'token length error') + ); + return false; + } + $yubico_modhex_id = substr($_data['token'], 0, 12); + $stmt = $pdo->prepare("SELECT `id`, `secret` FROM `tfa` + WHERE `username` = :username + AND `authmech` = 'yubi_otp' + AND `active`='1' + AND `secret` LIKE :modhex"); + $stmt->execute(array(':username' => $username, ':modhex' => '%' . $yubico_modhex_id)); + $row = $stmt->fetch(PDO::FETCH_ASSOC); + $yubico_auth = explode(':', $row['secret']); + $yubi = new Auth_Yubico($yubico_auth[0], $yubico_auth[1]); + $yauth = $yubi->verify($_data['token']); + if (PEAR::isError($yauth)) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $username, '*'), + 'msg' => array('yotp_verification_failed', $yauth->getMessage()) + ); + return false; + } + else { + $_SESSION['tfa_id'] = $row['id']; + $_SESSION['return'][] = array( + 'type' => 'success', + 'log' => array(__FUNCTION__, $username, '*'), + 'msg' => 'verified_yotp_login' + ); + return true; + } + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $username, '*'), + 'msg' => array('yotp_verification_failed', 'unknown') + ); + return false; + break; + case "hotp": + return false; + break; + case "totp": + try { + $stmt = $pdo->prepare("SELECT `id`, `secret` FROM `tfa` + WHERE `username` = :username + AND `authmech` = 'totp' + AND `active`='1'"); + $stmt->execute(array(':username' => $username)); + $rows = $stmt->fetchAll(PDO::FETCH_ASSOC); + foreach ($rows as $row) { + if ($tfa->verifyCode($row['secret'], $_data['token']) === true) { + $_SESSION['tfa_id'] = $row['id']; + $_SESSION['return'][] = array( + 'type' => 'success', + 'log' => array(__FUNCTION__, $username, '*'), + 'msg' => 'verified_totp_login' + ); + return true; + } + } + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $username, '*'), + 'msg' => 'totp_verification_failed' + ); + return false; + } + catch (PDOException $e) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $username, '*'), + 'msg' => array('mysql_error', $e) + ); + return false; + } + break; + // u2f - deprecated, should be removed + case "u2f": + $tokenData = json_decode($_data['token']); + $clientDataJSON = base64_decode($tokenData->clientDataJSON); + $authenticatorData = base64_decode($tokenData->authenticatorData); + $signature = base64_decode($tokenData->signature); + $id = base64_decode($tokenData->id); + $challenge = $_SESSION['challenge']; + + $stmt = $pdo->prepare("SELECT `key_id`, `keyHandle`, `username`, `publicKey` FROM `tfa` WHERE `keyHandle` = :tokenId"); + $stmt->execute(array(':tokenId' => $tokenData->id)); + $process_webauthn = $stmt->fetch(PDO::FETCH_ASSOC); + + if (empty($process_webauthn) || empty($process_webauthn['publicKey']) || empty($process_webauthn['username'])) return false; + + if ($process_webauthn['publicKey'] === false) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $username, '*'), + 'msg' => array('webauthn_verification_failed', 'publicKey not found') + ); + return false; + } + try { + $WebAuthn->processGet($clientDataJSON, $authenticatorData, $signature, $process_webauthn['publicKey'], $challenge, null, $GLOBALS['WEBAUTHN_UV_FLAG_LOGIN'], $GLOBALS['WEBAUTHN_USER_PRESENT_FLAG']); + } + catch (Throwable $ex) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $username, '*'), + 'msg' => array('webauthn_verification_failed', $ex->getMessage()) + ); + return false; + } + + + $stmt = $pdo->prepare("SELECT `superadmin` FROM `admin` WHERE `username` = :username"); + $stmt->execute(array(':username' => $process_webauthn['username'])); + $obj_props = $stmt->fetch(PDO::FETCH_ASSOC); + if ($obj_props['superadmin'] === 1) { + $_SESSION["mailcow_cc_role"] = "admin"; + } + elseif ($obj_props['superadmin'] === 0) { + $_SESSION["mailcow_cc_role"] = "domainadmin"; + } + else { + $stmt = $pdo->prepare("SELECT `username` FROM `mailbox` WHERE `username` = :username"); + $stmt->execute(array(':username' => $process_webauthn['username'])); + $row = $stmt->fetch(PDO::FETCH_ASSOC); + if ($row['username'] == $process_webauthn['username']) { + $_SESSION["mailcow_cc_role"] = "user"; + } + } + + + if ($process_webauthn['username'] != $_SESSION['pending_mailcow_cc_username']){ + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $username, '*'), + 'msg' => array('webauthn_verification_failed', 'user who requests does not match with sql entry') + ); + return false; + } + + + $_SESSION["mailcow_cc_username"] = $process_webauthn['username']; + $_SESSION['tfa_id'] = $process_webauthn['key_id']; + $_SESSION['authReq'] = null; + unset($_SESSION["challenge"]); + $_SESSION['return'][] = array( + 'type' => 'success', + 'log' => array("webauthn_login"), + 'msg' => array('logged_in_as', $process_webauthn['username']) + ); + return true; + break; + case "webauthn": + $tokenData = json_decode($_data['token']); + $clientDataJSON = base64_decode($tokenData->clientDataJSON); + $authenticatorData = base64_decode($tokenData->authenticatorData); + $signature = base64_decode($tokenData->signature); + $id = base64_decode($tokenData->id); + $challenge = $_SESSION['challenge']; + + $stmt = $pdo->prepare("SELECT `key_id`, `keyHandle`, `username`, `publicKey` FROM `tfa` WHERE `keyHandle` = :tokenId"); + $stmt->execute(array(':tokenId' => $tokenData->id)); + $process_webauthn = $stmt->fetch(PDO::FETCH_ASSOC); + + if (empty($process_webauthn) || empty($process_webauthn['publicKey']) || empty($process_webauthn['username'])) return false; + + if ($process_webauthn['publicKey'] === false) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $username, '*'), + 'msg' => array('webauthn_verification_failed', 'publicKey not found') + ); + return false; + } + try { + $WebAuthn->processGet($clientDataJSON, $authenticatorData, $signature, $process_webauthn['publicKey'], $challenge, null, $GLOBALS['WEBAUTHN_UV_FLAG_LOGIN'], $GLOBALS['WEBAUTHN_USER_PRESENT_FLAG']); + } + catch (Throwable $ex) { + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $username, '*'), + 'msg' => array('webauthn_verification_failed', $ex->getMessage()) + ); + return false; + } + + + $stmt = $pdo->prepare("SELECT `superadmin` FROM `admin` WHERE `username` = :username"); + $stmt->execute(array(':username' => $process_webauthn['username'])); + $obj_props = $stmt->fetch(PDO::FETCH_ASSOC); + if ($obj_props['superadmin'] === 1) { + $_SESSION["mailcow_cc_role"] = "admin"; + } + elseif ($obj_props['superadmin'] === 0) { + $_SESSION["mailcow_cc_role"] = "domainadmin"; + } + else { + $stmt = $pdo->prepare("SELECT `username` FROM `mailbox` WHERE `username` = :username"); + $stmt->execute(array(':username' => $process_webauthn['username'])); + $row = $stmt->fetch(PDO::FETCH_ASSOC); + if ($row['username'] == $process_webauthn['username']) { + $_SESSION["mailcow_cc_role"] = "user"; + } + } + + + if ($process_webauthn['username'] != $_SESSION['pending_mailcow_cc_username']){ + $_SESSION['return'][] = array( + 'type' => 'danger', + 'log' => array(__FUNCTION__, $username, '*'), + 'msg' => array('webauthn_verification_failed', 'user who requests does not match with sql entry') + ); + return false; + } + + + $_SESSION["mailcow_cc_username"] = $process_webauthn['username']; + $_SESSION['tfa_id'] = $process_webauthn['key_id']; + $_SESSION['authReq'] = null; + unset($_SESSION["challenge"]); + $_SESSION['return'][] = array( + 'type' => 'success', + 'log' => array("webauthn_login"), + 'msg' => array('logged_in_as', $process_webauthn['username']) + ); + return true; + break; + default: + $_SESSION['return'][] = array( + 'type' => 'danger', 'log' => array(__FUNCTION__, $username, '*'), - 'msg' => 'verified_totp_login' - ); - return true; - } - } - $_SESSION['return'][] = array( - 'type' => 'danger', - 'log' => array(__FUNCTION__, $username, '*'), - 'msg' => 'totp_verification_failed' - ); - return false; + 'msg' => 'unknown_tfa_method' + ); + return false; + break; } - catch (PDOException $e) { - $_SESSION['return'][] = array( - 'type' => 'danger', - 'log' => array(__FUNCTION__, $username, '*'), - 'msg' => array('mysql_error', $e) - ); - return false; - } - break; - default: - $_SESSION['return'][] = array( - 'type' => 'danger', - 'log' => array(__FUNCTION__, $username, '*'), - 'msg' => 'unknown_tfa_method' - ); + return false; - break; - } - return false; } function admin_api($access, $action, $data = null) { global $pdo; @@ -1955,6 +2119,7 @@ function rspamd_ui($action, $data = null) { break; } } +// u2f - deprecated, should be removed function get_u2f_registrations($username) { global $pdo; $sel = $pdo->prepare("SELECT * FROM `tfa` WHERE `authmech` = 'u2f' AND `username` = ? AND `active` = '1'"); diff --git a/data/web/inc/init_db.inc.php b/data/web/inc/init_db.inc.php index 60a8ead2..a79c6237 100644 --- a/data/web/inc/init_db.inc.php +++ b/data/web/inc/init_db.inc.php @@ -696,7 +696,7 @@ function init_db_schema() { "id" => "INT NOT NULL AUTO_INCREMENT", "key_id" => "VARCHAR(255) NOT NULL", "username" => "VARCHAR(255) NOT NULL", - "authmech" => "ENUM('yubi_otp', 'u2f', 'hotp', 'totp')", + "authmech" => "ENUM('yubi_otp', 'u2f', 'hotp', 'totp', 'webauthn')", "secret" => "VARCHAR(255) DEFAULT NULL", "keyHandle" => "VARCHAR(255) DEFAULT NULL", "publicKey" => "VARCHAR(255) DEFAULT NULL", diff --git a/data/web/inc/lib/WebAuthn/Attestation/AttestationObject.php b/data/web/inc/lib/WebAuthn/Attestation/AttestationObject.php index aeb4e201..115d7878 100644 --- a/data/web/inc/lib/WebAuthn/Attestation/AttestationObject.php +++ b/data/web/inc/lib/WebAuthn/Attestation/AttestationObject.php @@ -1,9 +1,9 @@ _authenticatorData = new AuthenticatorData($enc['authData']->getBinaryString()); + $this->_attestationFormatName = $enc['fmt']; // Format ok? - if (!in_array($enc['fmt'], $allowedFormats)) { - throw new WebAuthnException('invalid atttestation format: ' . $enc['fmt'], WebAuthnException::INVALID_DATA); + if (!in_array($this->_attestationFormatName, $allowedFormats)) { + throw new WebAuthnException('invalid atttestation format: ' . $this->_attestationFormatName, WebAuthnException::INVALID_DATA); } - switch ($enc['fmt']) { + + switch ($this->_attestationFormatName) { case 'android-key': $this->_attestationFormat = new Format\AndroidKey($enc, $this->_authenticatorData); break; case 'android-safetynet': $this->_attestationFormat = new Format\AndroidSafetyNet($enc, $this->_authenticatorData); break; case 'apple': $this->_attestationFormat = new Format\Apple($enc, $this->_authenticatorData); break; @@ -47,6 +50,14 @@ class AttestationObject { } } + /** + * returns the attestation format name + * @return string + */ + public function getAttestationFormatName() { + return $this->_attestationFormatName; + } + /** * returns the attestation public key in PEM format * @return AuthenticatorData @@ -72,16 +83,19 @@ class AttestationObject { $issuer = ''; if ($pem) { $certInfo = \openssl_x509_parse($pem); - if (\is_array($certInfo) && \is_array($certInfo['issuer'])) { - if ($certInfo['issuer']['CN']) { - $issuer .= \trim($certInfo['issuer']['CN']); + if (\is_array($certInfo) && \array_key_exists('issuer', $certInfo) && \is_array($certInfo['issuer'])) { + + $cn = $certInfo['issuer']['CN'] ?? ''; + $o = $certInfo['issuer']['O'] ?? ''; + $ou = $certInfo['issuer']['OU'] ?? ''; + + if ($cn) { + $issuer .= $cn; } - if ($certInfo['issuer']['O'] || $certInfo['issuer']['OU']) { - if ($issuer) { - $issuer .= ' (' . \trim($certInfo['issuer']['O'] . ' ' . $certInfo['issuer']['OU']) . ')'; - } else { - $issuer .= \trim($certInfo['issuer']['O'] . ' ' . $certInfo['issuer']['OU']); - } + if ($issuer && ($o || $ou)) { + $issuer .= ' (' . trim($o . ' ' . $ou) . ')'; + } else { + $issuer .= trim($o . ' ' . $ou); } } } @@ -98,16 +112,19 @@ class AttestationObject { $subject = ''; if ($pem) { $certInfo = \openssl_x509_parse($pem); - if (\is_array($certInfo) && \is_array($certInfo['subject'])) { - if ($certInfo['subject']['CN']) { - $subject .= \trim($certInfo['subject']['CN']); + if (\is_array($certInfo) && \array_key_exists('subject', $certInfo) && \is_array($certInfo['subject'])) { + + $cn = $certInfo['subject']['CN'] ?? ''; + $o = $certInfo['subject']['O'] ?? ''; + $ou = $certInfo['subject']['OU'] ?? ''; + + if ($cn) { + $subject .= $cn; } - if ($certInfo['subject']['O'] || $certInfo['subject']['OU']) { - if ($subject) { - $subject .= ' (' . \trim($certInfo['subject']['O'] . ' ' . $certInfo['subject']['OU']) . ')'; - } else { - $subject .= \trim($certInfo['subject']['O'] . ' ' . $certInfo['subject']['OU']); - } + if ($subject && ($o || $ou)) { + $subject .= ' (' . trim($o . ' ' . $ou) . ')'; + } else { + $subject .= trim($o . ' ' . $ou); } } } diff --git a/data/web/inc/lib/WebAuthn/Attestation/AuthenticatorData.php b/data/web/inc/lib/WebAuthn/Attestation/AuthenticatorData.php index 374d9ab4..1e1212ea 100644 --- a/data/web/inc/lib/WebAuthn/Attestation/AuthenticatorData.php +++ b/data/web/inc/lib/WebAuthn/Attestation/AuthenticatorData.php @@ -1,9 +1,9 @@ _attestationObject = $AttestionObject; $this->_authenticatorData = $authenticatorData; } @@ -26,7 +27,7 @@ abstract class FormatBase { */ public function __destruct() { // delete X.509 chain certificate file after use - if (\is_file($this->_x5c_tempFile)) { + if ($this->_x5c_tempFile && \is_file($this->_x5c_tempFile)) { \unlink($this->_x5c_tempFile); } } @@ -36,7 +37,7 @@ abstract class FormatBase { * @return string|null */ public function getCertificateChain() { - if (\is_file($this->_x5c_tempFile)) { + if ($this->_x5c_tempFile && \is_file($this->_x5c_tempFile)) { return \file_get_contents($this->_x5c_tempFile); } return null; diff --git a/data/web/inc/lib/WebAuthn/Attestation/Format/None.php b/data/web/inc/lib/WebAuthn/Attestation/Format/None.php index 1664c559..ba95e40f 100644 --- a/data/web/inc/lib/WebAuthn/Attestation/Format/None.php +++ b/data/web/inc/lib/WebAuthn/Attestation/Format/None.php @@ -1,13 +1,14 @@ PHP 7.0 @@ -97,6 +97,14 @@ class ByteBuffer implements \JsonSerializable, \Serializable { return \ord(\substr($this->_data, $offset, 1)); } + public function getJson($jsonFlags=0) { + $data = \json_decode($this->getBinaryString(), null, 512, $jsonFlags); + if (\json_last_error() !== JSON_ERROR_NONE) { + throw new WebAuthnException(\json_last_error_msg(), WebAuthnException::BYTEBUFFER); + } + return $data; + } + public function getLength() { return $this->_length; } @@ -203,7 +211,7 @@ class ByteBuffer implements \JsonSerializable, \Serializable { /** * jsonSerialize interface * return binary data in RFC 1342-Like serialized string - * @return \stdClass + * @return string */ public function jsonSerialize() { if (ByteBuffer::$useBase64UrlEncoding) { @@ -231,6 +239,36 @@ class ByteBuffer implements \JsonSerializable, \Serializable { $this->_length = \strlen($this->_data); } + /** + * (PHP 8 deprecates Serializable-Interface) + * @return array + */ + public function __serialize() { + return [ + 'data' => \serialize($this->_data) + ]; + } + + /** + * object to string + * @return string + */ + public function __toString() { + return $this->getHex(); + } + + /** + * (PHP 8 deprecates Serializable-Interface) + * @param array $data + * @return void + */ + public function __unserialize($data) { + if ($data && isset($data['data'])) { + $this->_data = \unserialize($data['data']); + $this->_length = \strlen($this->_data); + } + } + // ----------------------- // PROTECTED STATIC // ----------------------- diff --git a/data/web/inc/lib/WebAuthn/CBOR/CborDecoder.php b/data/web/inc/lib/WebAuthn/CBOR/CborDecoder.php index 45626eb1..e6b5427d 100644 --- a/data/web/inc/lib/WebAuthn/CBOR/CborDecoder.php +++ b/data/web/inc/lib/WebAuthn/CBOR/CborDecoder.php @@ -1,9 +1,9 @@ _caFiles)) { $this->_caFiles = array(); } + if ($certFileExtensions === null) { + $certFileExtensions = array('pem', 'crt', 'cer', 'der'); + } $path = \rtrim(\trim($path), '\\/'); if (\is_dir($path)) { foreach (\scandir($path) as $ca) { - if (\is_file($path . '/' . $ca)) { - $this->addRootCertificates($path . '/' . $ca); + if (\is_file($path . DIRECTORY_SEPARATOR . $ca) && \in_array(\strtolower(\pathinfo($ca, PATHINFO_EXTENSION)), $certFileExtensions)) { + $this->addRootCertificates($path . DIRECTORY_SEPARATOR . $ca); } } } else if (\is_file($path) && !\in_array(\realpath($path), $this->_caFiles)) { @@ -273,10 +277,11 @@ class WebAuthn { * @param string|ByteBuffer $challenge binary used challange * @param bool $requireUserVerification true, if the device must verify user (e.g. by biometric data or pin) * @param bool $requireUserPresent false, if the device must NOT check user presence (e.g. by pressing a button) + * @param bool $failIfRootMismatch false, if there should be no error thrown if root certificate doesn't match * @return \stdClass * @throws WebAuthnException */ - public function processCreate($clientDataJSON, $attestationObject, $challenge, $requireUserVerification=false, $requireUserPresent=true) { + public function processCreate($clientDataJSON, $attestationObject, $challenge, $requireUserVerification=false, $requireUserPresent=true, $failIfRootMismatch=true) { $clientDataHash = \hash('sha256', $clientDataJSON, true); $clientData = \json_decode($clientDataJSON); $challenge = $challenge instanceof ByteBuffer ? $challenge : new ByteBuffer($challenge); @@ -318,18 +323,21 @@ class WebAuthn { } // 15. If validation is successful, obtain a list of acceptable trust anchors - if (is_array($this->_caFiles) && !$attestationObject->validateRootCertificate($this->_caFiles)) { + $rootValid = is_array($this->_caFiles) ? $attestationObject->validateRootCertificate($this->_caFiles) : null; + if ($failIfRootMismatch && is_array($this->_caFiles) && !$rootValid) { throw new WebAuthnException('invalid root certificate', WebAuthnException::CERTIFICATE_NOT_TRUSTED); } // 10. Verify that the User Present bit of the flags in authData is set. - if ($requireUserPresent && !$attestationObject->getAuthenticatorData()->getUserPresent()) { + $userPresent = $attestationObject->getAuthenticatorData()->getUserPresent(); + if ($requireUserPresent && !$userPresent) { throw new WebAuthnException('user not present during authentication', WebAuthnException::USER_PRESENT); } // 11. If user verification is required for this registration, verify that the User Verified bit of the flags in authData is set. - if ($requireUserVerification && !$attestationObject->getAuthenticatorData()->getUserVerified()) { - throw new WebAuthnException('user not verificated during authentication', WebAuthnException::USER_VERIFICATED); + $userVerified = $attestationObject->getAuthenticatorData()->getUserVerified(); + if ($requireUserVerification && !$userVerified) { + throw new WebAuthnException('user not verified during authentication', WebAuthnException::USER_VERIFICATED); } $signCount = $attestationObject->getAuthenticatorData()->getSignCount(); @@ -340,6 +348,7 @@ class WebAuthn { // prepare data to store for future logins $data = new \stdClass(); $data->rpId = $this->_rpId; + $data->attestationFormat = $attestationObject->getAttestationFormatName(); $data->credentialId = $attestationObject->getAuthenticatorData()->getCredentialId(); $data->credentialPublicKey = $attestationObject->getAuthenticatorData()->getPublicKeyPem(); $data->certificateChain = $attestationObject->getCertificateChain(); @@ -348,6 +357,9 @@ class WebAuthn { $data->certificateSubject = $attestationObject->getCertificateSubject(); $data->signatureCounter = $this->_signatureCounter; $data->AAGUID = $attestationObject->getAuthenticatorData()->getAAGUID(); + $data->rootValid = $rootValid; + $data->userPresent = $userPresent; + $data->userVerified = $userVerified; return $data; } @@ -453,6 +465,92 @@ class WebAuthn { return true; } + /** + * Downloads root certificates from FIDO Alliance Metadata Service (MDS) to a specific folder + * https://fidoalliance.org/metadata/ + * @param string $certFolder Folder path to save the certificates in PEM format. + * @param bool $deleteCerts=true + * @return int number of cetificates + * @throws WebAuthnException + */ + public function queryFidoMetaDataService($certFolder, $deleteCerts=true) { + $url = 'https://mds.fidoalliance.org/'; + $raw = null; + if (\function_exists('curl_init')) { + $ch = \curl_init($url); + \curl_setopt($ch, CURLOPT_HEADER, false); + \curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); + \curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); + \curl_setopt($ch, CURLOPT_USERAGENT, 'github.com/lbuchs/WebAuthn - A simple PHP WebAuthn server library'); + $raw = \curl_exec($ch); + \curl_close($ch); + } else { + $raw = \file_get_contents($url); + } + + $certFolder = \rtrim(\realpath($certFolder), '\\/'); + if (!is_dir($certFolder)) { + throw new WebAuthnException('Invalid folder path for query FIDO Alliance Metadata Service'); + } + + if (!\is_string($raw)) { + throw new WebAuthnException('Unable to query FIDO Alliance Metadata Service'); + } + + $jwt = \explode('.', $raw); + if (\count($jwt) !== 3) { + throw new WebAuthnException('Invalid JWT from FIDO Alliance Metadata Service'); + } + + if ($deleteCerts) { + foreach (\scandir($certFolder) as $ca) { + if (\substr($ca, -4) === '.pem') { + if (\unlink($certFolder . DIRECTORY_SEPARATOR . $ca) === false) { + throw new WebAuthnException('Cannot delete certs in folder for FIDO Alliance Metadata Service'); + } + } + } + } + + list($header, $payload, $hash) = $jwt; + $payload = Binary\ByteBuffer::fromBase64Url($payload)->getJson(); + + $count = 0; + if (\is_object($payload) && \property_exists($payload, 'entries') && \is_array($payload->entries)) { + foreach ($payload->entries as $entry) { + if (\is_object($entry) && \property_exists($entry, 'metadataStatement') && \is_object($entry->metadataStatement)) { + $description = $entry->metadataStatement->description ?? null; + $attestationRootCertificates = $entry->metadataStatement->attestationRootCertificates ?? null; + + if ($description && $attestationRootCertificates) { + + // create filename + $certFilename = \preg_replace('/[^a-z0-9]/i', '_', $description); + $certFilename = \trim(\preg_replace('/\_{2,}/i', '_', $certFilename),'_') . '.pem'; + $certFilename = \strtolower($certFilename); + + // add certificate + $certContent = $description . "\n"; + $certContent .= \str_repeat('-', \mb_strlen($description)) . "\n"; + + foreach ($attestationRootCertificates as $attestationRootCertificate) { + $count++; + $certContent .= "\n-----BEGIN CERTIFICATE-----\n"; + $certContent .= \chunk_split(\trim($attestationRootCertificate), 64, "\n"); + $certContent .= "-----END CERTIFICATE-----\n"; + } + + if (\file_put_contents($certFolder . DIRECTORY_SEPARATOR . $certFilename, $certContent) === false) { + throw new WebAuthnException('unable to save certificate from FIDO Alliance Metadata Service'); + } + } + } + } + } + + return $count; + } + // ----------------------------------------------- // PRIVATE // ----------------------------------------------- diff --git a/data/web/inc/lib/WebAuthn/WebAuthnException.php b/data/web/inc/lib/WebAuthn/WebAuthnException.php index 823f7d80..e399bd3b 100644 --- a/data/web/inc/lib/WebAuthn/WebAuthnException.php +++ b/data/web/inc/lib/WebAuthn/WebAuthnException.php @@ -1,5 +1,5 @@ addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/solo.pem'); -$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/apple.pem'); -$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/nitro.pem'); -$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/yubico.pem'); -$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/hypersecu.pem'); -$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/globalSign.pem'); -$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/googleHardware.pem'); -$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/microsoftTpmCollection.pem'); -$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/huawei.pem'); -$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/trustkey.pem'); -$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/bsi.pem'); +$WebAuthn = new lbuchs\WebAuthn\WebAuthn('WebAuthn Library', $_SERVER['HTTP_HOST'], $formats); +// only include root ca's when dev mode is false, to support testing with chromiums virutal authenticator +if (!$DEV_MODE){ + $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/solo.pem'); + $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/apple.pem'); + $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/nitro.pem'); + $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/yubico.pem'); + $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/hypersecu.pem'); + $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/globalSign.pem'); + $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/googleHardware.pem'); + $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/microsoftTpmCollection.pem'); + $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/huawei.pem'); + $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/trustkey.pem'); + $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/bsi.pem'); +} // Redis $redis = new Redis(); diff --git a/data/web/inc/triggers.inc.php b/data/web/inc/triggers.inc.php index a2342dfc..cb3a3771 100644 --- a/data/web/inc/triggers.inc.php +++ b/data/web/inc/triggers.inc.php @@ -1,15 +1,28 @@ array( diff --git a/data/web/json_api.php b/data/web/json_api.php index 595bd8f9..e04fe549 100644 --- a/data/web/json_api.php +++ b/data/web/json_api.php @@ -117,12 +117,12 @@ if (isset($_GET['query'])) { echo isset($_SESSION['return']) ? json_encode($_SESSION['return']) : $generic_success; } } - if (!isset($_POST['attr']) && $category != "fido2-registration") { + if (!isset($_POST['attr']) && $category != "fido2-registration" && $category != "webauthn-tfa-registration") { echo $request_incomplete; exit; } else { - if ($category != "fido2-registration") { + if ($category != "fido2-registration" && $category != "webauthn-tfa-registration") { $attr = (array)json_decode($_POST['attr'], true); } unset($attr['csrf_token']); @@ -170,6 +170,48 @@ if (isset($_GET['query'])) { exit; } break; + case "webauthn-tfa-registration": + if (isset($_SESSION["mailcow_cc_role"])) { + // parse post data + $post = trim(file_get_contents('php://input')); + if ($post) $post = json_decode($post); + + // decode base64 strings + $clientDataJSON = base64_decode($post->clientDataJSON); + $attestationObject = base64_decode($post->attestationObject); + + // process registration data from authenticator + try { + // processCreate($clientDataJSON, $attestationObject, $challenge, $requireUserVerification=false, $requireUserPresent=true, $failIfRootMismatch=true) + $data = $WebAuthn->processCreate($clientDataJSON, $attestationObject, $_SESSION['challenge'], false, true); + } + catch (Throwable $ex) { + // err + $return = new stdClass(); + $return->success = false; + $return->msg = $ex->getMessage(); + echo json_encode($return); + exit; + } + + // safe authenticator in mysql `tfa` table + $_data['tfa_method'] = $post->tfa_method; + $_data['key_id'] = $post->key_id; + $_data['registration'] = $data; + set_tfa($_data); + + // send response + $return = new stdClass(); + $return->success = true; + echo json_encode($return); + exit; + } + else { + // err - request incomplete + echo $request_incomplete; + exit; + } + break; case "time_limited_alias": process_add_return(mailbox('add', 'time_limited_alias', $attr)); break; @@ -350,6 +392,7 @@ if (isset($_GET['query'])) { exit(); } switch ($category) { + // u2f - deprecated, should be removed case "u2f-registration": header('Content-Type: application/javascript'); if (isset($_SESSION["mailcow_cc_role"]) && $_SESSION["mailcow_cc_username"] == $object) { @@ -366,21 +409,6 @@ if (isset($_GET['query'])) { return; } break; - // fido2-registration via GET - case "fido2-registration": - header('Content-Type: application/json'); - if (isset($_SESSION["mailcow_cc_role"])) { - // Exclude existing CredentialIds, if any - $excludeCredentialIds = fido2(array("action" => "get_user_cids")); - $createArgs = $WebAuthn->getCreateArgs($_SESSION["mailcow_cc_username"], $_SESSION["mailcow_cc_username"], $_SESSION["mailcow_cc_username"], 30, true, $GLOBALS['FIDO2_UV_FLAG_REGISTER'], $excludeCredentialIds); - print(json_encode($createArgs)); - $_SESSION['challenge'] = $WebAuthn->getChallenge(); - return; - } - else { - return; - } - break; case "u2f-authentication": header('Content-Type: application/javascript'); if (isset($_SESSION['pending_mailcow_cc_username']) && $_SESSION['pending_mailcow_cc_username'] == $object) { @@ -403,6 +431,21 @@ if (isset($_GET['query'])) { return; } break; + // fido2 + case "fido2-registration": + header('Content-Type: application/json'); + if (isset($_SESSION["mailcow_cc_role"])) { + // Exclude existing CredentialIds, if any + $excludeCredentialIds = fido2(array("action" => "get_user_cids")); + $createArgs = $WebAuthn->getCreateArgs($_SESSION["mailcow_cc_username"], $_SESSION["mailcow_cc_username"], $_SESSION["mailcow_cc_username"], 30, true, $GLOBALS['FIDO2_UV_FLAG_REGISTER'], $excludeCredentialIds); + print(json_encode($createArgs)); + $_SESSION['challenge'] = $WebAuthn->getChallenge(); + return; + } + else { + return; + } + break; case "fido2-get-args": header('Content-Type: application/json'); // Login without username, no ids! @@ -416,6 +459,36 @@ if (isset($_GET['query'])) { $_SESSION['challenge'] = $WebAuthn->getChallenge(); return; break; + // webauthn two factor authentication + case "webauthn-tfa-registration": + if (isset($_SESSION["mailcow_cc_role"])) { + $excludeCredentialIds = null; + + $createArgs = $WebAuthn->getCreateArgs($_SESSION["mailcow_cc_username"], $_SESSION["mailcow_cc_username"], $_SESSION["mailcow_cc_username"], 30, false, $GLOBALS['WEBAUTHN_UV_FLAG_REGISTER'], true); + + print(json_encode($createArgs)); + $_SESSION['challenge'] = $WebAuthn->getChallenge(); + return; + + } + else { + return; + } + break; + case "webauthn-tfa-get-args": + $stmt = $pdo->prepare("SELECT `keyHandle` FROM `tfa` WHERE username = :username"); + $stmt->execute(array(':username' => $_SESSION['pending_mailcow_cc_username'])); + $rows = $stmt->fetchAll(PDO::FETCH_ASSOC); + while($row = array_shift($rows)) { + $cids[] = base64_decode($row['keyHandle']); + } + + $getArgs = $WebAuthn->getGetArgs($cids, 30, true, true, true, true, $GLOBALS['WEBAUTHN_UV_FLAG_LOGIN']); + $getArgs->publicKey->extensions = array('appid' => "https://".$getArgs->publicKey->rpId); + print(json_encode($getArgs)); + $_SESSION['challenge'] = $WebAuthn->getChallenge(); + return; + break; } if (isset($_SESSION['mailcow_cc_role'])) { switch ($category) { diff --git a/data/web/lang/lang.ca.json b/data/web/lang/lang.ca.json index d75c83b1..88bbcef1 100644 --- a/data/web/lang/lang.ca.json +++ b/data/web/lang/lang.ca.json @@ -443,9 +443,9 @@ "set_tfa": "Definir el mètode d'autenticació de dos factors", "tfa": "Autenticació de dos factors", "totp": "OTP basat en temps (Google Authenticator etc.)", - "u2f": "Autenticació U2F", - "waiting_usb_auth": "Esperant el dispositiu USB...

Apreta el botó del teu dispositiu USB U2F ara.", - "waiting_usb_register": "Esperant el dispositiu USB...

Posa el teu password i confirma el registre del teu U2F apretant el botó del teu dispositiiu USB U2F.", + "webauthn": "Autenticació WebAuthn", + "waiting_usb_auth": "Esperant el dispositiu USB...

Apreta el botó del teu dispositiu USB WebAuthn ara.", + "waiting_usb_register": "Esperant el dispositiu USB...

Posa el teu password i confirma el registre del teu WebAuthn apretant el botó del teu dispositiiu USB WebAuthn.", "yubi_otp": "Autenticació OTP de Yubico" }, "user": { diff --git a/data/web/lang/lang.cs.json b/data/web/lang/lang.cs.json index 5d82a007..5021dec4 100644 --- a/data/web/lang/lang.cs.json +++ b/data/web/lang/lang.cs.json @@ -454,7 +454,7 @@ "tls_policy_map_parameter_invalid": "Parametr pravidel TLS je neplatný", "totp_verification_failed": "TOTP ověření selhalo", "transport_dest_exists": "Transportní cíl \"%s\" již existuje", - "u2f_verification_failed": "U2F ověření selhalo: %s", + "webauthn": "WebAuthn ověření selhalo: %s", "unknown": "Došlo k neznámé chybě", "unknown_tfa_method": "Neznámá 2FA metoda", "unlimited_quota_acl": "Neomeznou kvótu nepovoluje seznam oprávnění ACL", @@ -972,7 +972,7 @@ "upload_success": "Soubor úspěšně nahrán", "verified_fido2_login": "Ověřené FIDO2 přihlášení", "verified_totp_login": "TOTP přihlášení ověřeno", - "verified_u2f_login": "U2F přihlášení ověřeno", + "webauthn": "WebAuthn přihlášení ověřeno", "verified_yotp_login": "Yubico OTP přihlášení ověřeno" }, "tfa": { @@ -983,7 +983,7 @@ "disable_tfa": "Zakázat 2FA do příštího úspěšného přihlášení", "enter_qr_code": "Kód TOTP, pokud zařízení neumí číst QR kódy", "error_code": "Kód chyby", - "init_u2f": "Probíhá inicializace, čekejte...", + "init_webauthn": "Probíhá inicializace, čekejte...", "key_id": "Identifikátor YubiKey", "key_id_totp": "Identifikátor klíče", "none": "Deaktivovat", @@ -991,13 +991,13 @@ "scan_qr_code": "Prosím načtěte následující kód svou aplikací na ověření nebo zadejte kód ručně.", "select": "Prosím vyberte...", "set_tfa": "Nastavení způsobu dvoufaktorového ověření", - "start_u2f_validation": "Zahájit inicializaci", + "start_webauthn_validation": "Zahájit inicializaci", "tfa": "Dvoufaktorové ověření (TFA)", "tfa_token_invalid": "Neplatný TFA token", "totp": "Časově založené OTP (Google Authenticator, Authy apod.)", - "u2f": "U2F ověření", - "waiting_usb_auth": "Čeká se na USB zařízení...

Prosím stiskněte tlačítko na svém U2F USB zařízení.", - "waiting_usb_register": "Čeká se na USB zařízení...

Prosím zadejte své heslo výše a potvrďte U2F registraci stiskem tlačítka na svém U2F USB zařízení.", + "webauthn": "WebAuthn ověření", + "waiting_usb_auth": "Čeká se na USB zařízení...

Prosím stiskněte tlačítko na svém WebAuthn USB zařízení.", + "waiting_usb_register": "Čeká se na USB zařízení...

Prosím zadejte své heslo výše a potvrďte WebAuthn registraci stiskem tlačítka na svém WebAuthn USB zařízení.", "yubi_otp": "Yubico OTP ověření" }, "user": { diff --git a/data/web/lang/lang.da.json b/data/web/lang/lang.da.json index 7c23e323..fc03ec5c 100644 --- a/data/web/lang/lang.da.json +++ b/data/web/lang/lang.da.json @@ -426,7 +426,7 @@ "tls_policy_map_parameter_invalid": "Politikparameter er ugyldig", "totp_verification_failed": "Bekræftelse af TOTP mislykkedes", "transport_dest_exists": "Transport destination \"%s\" eksisterer", - "u2f_verification_failed": "U2F-bekræftelse mislykkedes: %s", + "webauthn_verification_failed": "WebAuthn-bekræftelse mislykkedes: %s", "fido2_verification_failed": "Bekræftelse af FIDO2 mislykkedes: %s", "unknown": "Der opstod en ukendt fejl", "unknown_tfa_method": "Ukendt TFA-metode", @@ -881,7 +881,7 @@ "ui_texts": "Gemte ændringer til UI-tekster", "upload_success": "Filen blev uploadet", "verified_totp_login": "Bekræftet TOTP-login", - "verified_u2f_login": "Bekræftet U2F-login", + "verified_webauthn_login": "Bekræftet WebAuthn-login", "verified_fido2_login": "Bekræftet FIDO2-login", "verified_yotp_login": "Bekræftet Yubico OTP-login" }, @@ -893,7 +893,7 @@ "disable_tfa": "Deaktiver TFA indtil næste vellykkede login", "enter_qr_code": "Din TOTP kode hvis din enhed ikke kan scanne QR-koder", "error_code": "Fejl kode", - "init_u2f": "Initialiserer, vent venligst...", + "init_webauthn": "Initialiserer, vent venligst...", "key_id": "En identifikator til din YubiKey", "key_id_totp": "En identifikator for din nøgle", "none": "Deaktivere", @@ -901,11 +901,11 @@ "scan_qr_code": "Scan venligst følgende kode med din godkendelsesapp, eller indtast koden manuelt.", "select": "Vælg venligst", "set_tfa": "Set 2-faktor godkendelses metoden", - "start_u2f_validation": "Start validering", + "start_webauthn_validation": "Start validering", "tfa": "2-faktor godkendelse", "tfa_token_invalid": "TFA nøgle ugyldig", "totp": "Tids-baseret OTP (Google Authenticator, Authy, etc.)", - "u2f": "U2F godkendelse", + "webauthn": "WebAuthn godkendelse", "waiting_usb_auth": "Venter på USB-enhed...

Tryk let på knappen på din USB-enhed nu.", "waiting_usb_register": "Venter på USB-enhed...

Indtast din adgangskode ovenfor, og bekræft din registrering ved at trykke på knappen på din USB-enhed.", "yubi_otp": "Yubico OTP godkendelse" diff --git a/data/web/lang/lang.de.json b/data/web/lang/lang.de.json index c94eb31b..6f928c0b 100644 --- a/data/web/lang/lang.de.json +++ b/data/web/lang/lang.de.json @@ -455,7 +455,7 @@ "tls_policy_map_parameter_invalid": "Parameter ist ungültig", "totp_verification_failed": "TOTP-Verifizierung fehlgeschlagen", "transport_dest_exists": "Transport-Maps-Ziel \"%s\" existiert bereits", - "u2f_verification_failed": "U2F-Verifizierung fehlgeschlagen: %s", + "webauthn_verification_failed": "WebAuthn-Verifizierung fehlgeschlagen: %s", "unknown": "Ein unbekannter Fehler trat auf", "unknown_tfa_method": "Unbekannte TFA-Methode", "unlimited_quota_acl": "Unendliche Quota untersagt durch ACL", @@ -971,7 +971,7 @@ "upload_success": "Datei wurde erfolgreich hochgeladen", "verified_fido2_login": "FIDO2-Anmeldung verifiziert", "verified_totp_login": "TOTP-Anmeldung verifiziert", - "verified_u2f_login": "U2F-Anmeldung verifiziert", + "verified_webauthn_login": "WebAuthn-Anmeldung verifiziert", "verified_yotp_login": "Yubico-OTP-Anmeldung verifiziert" }, "tfa": { @@ -982,7 +982,7 @@ "disable_tfa": "Deaktiviere 2FA bis zur nächsten erfolgreichen Anmeldung", "enter_qr_code": "Falls Sie den angezeigten QR-Code nicht scannen können, verwenden Sie bitte nachstehenden Sicherheitsschlüssel", "error_code": "Fehlercode", - "init_u2f": "Initialisiere, bitte warten...", + "init_webauthn": "Initialisiere, bitte warten...", "key_id": "Ein Namen für diesen YubiKey", "key_id_totp": "Ein eindeutiger Name", "none": "Deaktiviert", @@ -990,11 +990,11 @@ "scan_qr_code": "Bitte scannen Sie jetzt den angezeigten QR-Code:", "select": "Bitte auswählen", "set_tfa": "Konfiguriere Zwei-Faktor-Authentifizierungsmethode", - "start_u2f_validation": "Starte Validierung", + "start_webauthn_validation": "Starte Validierung", "tfa": "Zwei-Faktor-Authentifizierung", "tfa_token_invalid": "TFA-Token ungültig!", "totp": "Time-based-OTP (Google Authenticator etc.)", - "u2f": "U2F-Authentifizierung", + "webauthn": "WebAuthn-Authentifizierung", "waiting_usb_auth": "Warte auf USB-Gerät...

Bitte jetzt den vorgesehenen Taster des USB-Gerätes berühren.", "waiting_usb_register": "Warte auf USB-Gerät...

Bitte zuerst das obere Passwortfeld ausfüllen und erst dann den vorgesehenen Taster des USB-Gerätes berühren.", "yubi_otp": "Yubico OTP-Authentifizierung" diff --git a/data/web/lang/lang.en.json b/data/web/lang/lang.en.json index aae79c70..4c26ee0c 100644 --- a/data/web/lang/lang.en.json +++ b/data/web/lang/lang.en.json @@ -455,7 +455,7 @@ "tls_policy_map_parameter_invalid": "Policy parameter is invalid", "totp_verification_failed": "TOTP verification failed", "transport_dest_exists": "Transport destination \"%s\" exists", - "u2f_verification_failed": "U2F verification failed: %s", + "webauthn_verification_failed": "WebAuthn verification failed: %s", "unknown": "An unknown error occurred", "unknown_tfa_method": "Unknown TFA method", "unlimited_quota_acl": "Unlimited quota prohibited by ACL", @@ -978,7 +978,7 @@ "upload_success": "File uploaded successfully", "verified_fido2_login": "Verified FIDO2 login", "verified_totp_login": "Verified TOTP login", - "verified_u2f_login": "Verified U2F login", + "verified_webauthn_login": "Verified WebAuthn login", "verified_yotp_login": "Verified Yubico OTP login" }, "tfa": { @@ -989,7 +989,7 @@ "disable_tfa": "Disable TFA until next successful login", "enter_qr_code": "Your TOTP code if your device cannot scan QR codes", "error_code": "Error code", - "init_u2f": "Initializing, please wait...", + "init_webauthn": "Initializing, please wait...", "key_id": "An identifier for your YubiKey", "key_id_totp": "An identifier for your key", "none": "Deactivate", @@ -997,11 +997,11 @@ "scan_qr_code": "Please scan the following code with your authenticator app or enter the code manually.", "select": "Please select", "set_tfa": "Set two-factor authentication method", - "start_u2f_validation": "Start validation", + "start_webauthn_validation": "Start validation", "tfa": "Two-factor authentication", "tfa_token_invalid": "TFA token invalid", "totp": "Time-based OTP (Google Authenticator, Authy, etc.)", - "u2f": "U2F authentication", + "webauthn": "WebAuthn authentication", "waiting_usb_auth": "Waiting for USB device...

Please tap the button on your USB device now.", "waiting_usb_register": "Waiting for USB device...

Please enter your password above and confirm your registration by tapping the button on your USB device.", "yubi_otp": "Yubico OTP authentication" diff --git a/data/web/lang/lang.es.json b/data/web/lang/lang.es.json index 1e269650..87be8b4d 100644 --- a/data/web/lang/lang.es.json +++ b/data/web/lang/lang.es.json @@ -323,7 +323,7 @@ "tls_policy_map_parameter_invalid": "El parámetro de póliza no es válido.", "totp_verification_failed": "Verificación TOTP fallida", "transport_dest_exists": "Destino de la regla de transporte ya existe", - "u2f_verification_failed": "Verificación U2F fallida: %s", + "webauthn_verification_failed": "Verificación WebAuthn fallida: %s", "unknown": "Se produjo un error desconocido", "unknown_tfa_method": "Método TFA desconocido", "unlimited_quota_acl": "Cuota ilimitada restringida por controles administrativos", @@ -649,7 +649,7 @@ "tls_policy_map_entry_deleted": "Regla de póliza de TLS con ID %s ha sido elimindada", "tls_policy_map_entry_saved": "Regla de póliza de TLS \"%s\" ha sido guardada", "verified_totp_login": "Inicio de sesión TOTP verificado", - "verified_u2f_login": "Inicio de sesión U2F verificado", + "verified_webauthn_login": "Inicio de sesión WebAuthn verificado", "verified_yotp_login": "Inicio de sesión Yubico OTP verificado" }, "tfa": { @@ -667,9 +667,9 @@ "set_tfa": "Establecer el método de autenticación de dos factores", "tfa": "Autenticación de dos factores", "totp": "OTP basado en tiempo (Google Authenticator, Authy, etc.)", - "u2f": "Autenticación U2F", - "waiting_usb_auth": "Esperando al dispositivo USB...

Toque el botón en su dispositivo USB U2F ahora.", - "waiting_usb_register": "Esperando al dispositivo USB....

Ingrese su contraseña arriba y confirme su registro U2F tocando el botón en su dispositivo USB U2F.", + "webauthn": "Autenticación WebAuthn", + "waiting_usb_auth": "Esperando al dispositivo USB...

Toque el botón en su dispositivo USB WebAuthn ahora.", + "waiting_usb_register": "Esperando al dispositivo USB....

Ingrese su contraseña arriba y confirme su registro WebAuthn tocando el botón en su dispositivo USB WebAuthn.", "yubi_otp": "Yubico OTP" }, "user": { diff --git a/data/web/lang/lang.fi.json b/data/web/lang/lang.fi.json index 950d3a62..66e279e2 100644 --- a/data/web/lang/lang.fi.json +++ b/data/web/lang/lang.fi.json @@ -370,7 +370,7 @@ "tls_policy_map_parameter_invalid": "Käytäntö parametri ei kelpaa", "totp_verification_failed": "TOTP-vahvistus epäonnistui", "transport_dest_exists": "Kuljetuksen määränpää \"%s\" olemassa", - "u2f_verification_failed": "U2F vahvistaminen epäonnistui: %s", + "webauthn_verification_failed": "WebAuthn vahvistaminen epäonnistui: %s", "unknown": "Ilmeni tuntematon virhe", "unknown_tfa_method": "Tuntematon TFA-menetelmä", "unlimited_quota_acl": "Rajoittamaton kiintiö kielletty ACL", @@ -754,7 +754,7 @@ "ui_texts": "Tallennettu käyttöliittymätekstien muutokset", "upload_success": "Tiedosto ladattu onnistuneesti", "verified_totp_login": "Vahvistettu TOTP-kirjautuminen", - "verified_u2f_login": "Vahvistettu U2F kirjautuminen", + "verified_webauthn_login": "Vahvistettu WebAuthn kirjautuminen", "verified_yotp_login": "Vahvistettu Yubico OTP kirjautuminen" }, "tfa": { @@ -765,7 +765,7 @@ "disable_tfa": "Poista TFA käytöstä seuraavaan onnistuneen kirjautumisen jälkeen", "enter_qr_code": "TOTP-koodisi, jos laitteesi ei pysty tarkistamaan QR-koodeja", "error_code": "Virhekoodi", - "init_u2f": "Alustetaan, odota...", + "init_webauthn": "Alustetaan, odota...", "key_id": "Tunniste YubiKey", "key_id_totp": "Avaimen tunnus", "none": "Poista", @@ -773,12 +773,12 @@ "scan_qr_code": "Tarkista seuraava koodi Authenticator-sovelluksella tai Syötä koodi manuaalisesti.", "select": "Valitse", "set_tfa": "Määritä kaksiosainen todennus menetelmä", - "start_u2f_validation": "Aloita oikeellisuus tarkistus", + "start_webauthn_validation": "Aloita oikeellisuus tarkistus", "tfa": "Kaksiosainen todennus", "totp": "Aikapohjainen OTP (Google Authenticator, Authy jne.)", - "u2f": "U2F todennus", - "waiting_usb_auth": "Odotetaan USB-laitetta...

Napauta painiketta U2F USB-laitteessa nyt", - "waiting_usb_register": "Odotetaan USB-laitetta...

Anna salasanasi yltä ja vahvista U2F-rekisteröinti napauttamalla painiketta U2F USB-laitteessa.", + "webauthn": "WebAuthn todennus", + "waiting_usb_auth": "Odotetaan USB-laitetta...

Napauta painiketta WebAuthn USB-laitteessa nyt", + "waiting_usb_register": "Odotetaan USB-laitetta...

Anna salasanasi yltä ja vahvista WebAuthn-rekisteröinti napauttamalla painiketta WebAuthn USB-laitteessa.", "yubi_otp": "Yubico OTP-todennus" }, "user": { diff --git a/data/web/lang/lang.fr.json b/data/web/lang/lang.fr.json index e0750c5e..1b5c4233 100644 --- a/data/web/lang/lang.fr.json +++ b/data/web/lang/lang.fr.json @@ -430,7 +430,7 @@ "tls_policy_map_parameter_invalid": "Le paramètre Policy est invalide", "totp_verification_failed": "Echec de la vérification TOTP", "transport_dest_exists": "La destination de transport \"%s\" existe", - "u2f_verification_failed": "Echec de la vérification U2F: %s", + "webauthn_verification_failed": "Echec de la vérification WebAuthn: %s", "fido2_verification_failed": "La vérification FIDO2 a échoué: %s", "unknown": "Une erreur inconnue est survenue", "unknown_tfa_method": "Methode TFA inconnue", @@ -895,7 +895,7 @@ "ui_texts": "Enregistrement des modifications apportées aux textes de l’interface utilisateur", "upload_success": "Fichier téléchargé avec succès", "verified_totp_login": "Authentification TOTP vérifiée", - "verified_u2f_login": "Authentification U2F vérifiée", + "verified_webauthn_login": "Authentification WebAuthn vérifiée", "verified_fido2_login": "Authentification FIDO2 vérifiée", "verified_yotp_login": "Authentification Yubico OTP vérifiée" }, @@ -907,7 +907,7 @@ "disable_tfa": "Désactiver TFA jusqu’à la prochaine ouverture de session réussie", "enter_qr_code": "Votre code TOTP si votre appareil ne peut pas scanner les codes QR", "error_code": "Code d'erreur", - "init_u2f": "Initialisation, veuillez patienter...", + "init_webauthn": "Initialisation, veuillez patienter...", "key_id": "Un identifiant pour votre Yubikey", "key_id_totp": "Un identifiant pour votre clé", "none": "Désactiver", @@ -915,13 +915,13 @@ "scan_qr_code": "Veuillez scanner le code suivant avec votre application d’authentification ou entrer le code manuellement.", "select": "Veuillez sélectionner", "set_tfa": "Définir une méthode d’authentification à deux facteurs", - "start_u2f_validation": "Début de la validation", + "start_webauthn_validation": "Début de la validation", "tfa": "Authentification à deux facteurs", "tfa_token_invalid": "Token TFA invalide", "totp": "OTP (One Time Password = Mot de passe à usage unique : Google Authenticator, Authy, etc.)", - "u2f": "Authentification U2F", - "waiting_usb_auth": "En attente d’un périphérique USB...

S’il vous plaît appuyez maintenant sur le bouton de votre périphérique USB U2F.", - "waiting_usb_register": "En attente d’un périphérique USB...

Veuillez entrer votre mot de passe ci-dessus et confirmer votre inscription U2F en appuyant sur le bouton de votre périphérique USB U2F.", + "webauthn": "Authentification WebAuthn", + "waiting_usb_auth": "En attente d’un périphérique USB...

S’il vous plaît appuyez maintenant sur le bouton de votre périphérique USB WebAuthn.", + "waiting_usb_register": "En attente d’un périphérique USB...

Veuillez entrer votre mot de passe ci-dessus et confirmer votre inscription WebAuthn en appuyant sur le bouton de votre périphérique USB WebAuthn.", "yubi_otp": "Authentification OTP Yubico" }, "fido2": { diff --git a/data/web/lang/lang.it.json b/data/web/lang/lang.it.json index 496c0d71..70786eea 100644 --- a/data/web/lang/lang.it.json +++ b/data/web/lang/lang.it.json @@ -449,7 +449,7 @@ "tls_policy_map_parameter_invalid": "Policy parameter is invalid", "totp_verification_failed": "TOTP verification failed", "transport_dest_exists": "Transport destination \"%s\" exists", - "u2f_verification_failed": "U2F verification failed: %s", + "webauthn_verification_failed": "WebAuthn verification failed: %s", "unknown": "An unknown error occurred", "unknown_tfa_method": "Unknown TFA method", "unlimited_quota_acl": "Unlimited quota prohibited by ACL", @@ -947,7 +947,7 @@ "upload_success": "File caricato con successo", "verified_fido2_login": "Verified FIDO2 login", "verified_totp_login": "Verified TOTP login", - "verified_u2f_login": "Verified U2F login", + "verified_webauthn_login": "Verified WebAuthn login", "verified_yotp_login": "Verified Yubico OTP login" }, "tfa": { @@ -958,7 +958,7 @@ "disable_tfa": "Disabilita TFA fino al prossimo accesso", "enter_qr_code": "Il codice TOTP se il tuo dispositivo non è in grado di acquisire i codici QR", "error_code": "Codice di errore", - "init_u2f": "Inizializzazione, attendere prego...", + "init_webauthn": "Inizializzazione, attendere prego...", "key_id": "Identificatore per il tuo YubiKey", "key_id_totp": "Identificatore per la tua chiave", "none": "Disattivato", @@ -966,12 +966,12 @@ "scan_qr_code": "Esegui la scansione del seguente codice con l'applicazione di autenticazione o inserisci manualmente il codice.", "select": "Seleziona", "set_tfa": "Imposta il metodo di autenticazione a due fattori", - "start_u2f_validation": "Avvia convalida", + "start_webauthn_validation": "Avvia convalida", "tfa": "Autenticazione a due fattori", "totp": "Time-based OTP (Google Authenticator etc.)", - "u2f": "Autenticazione U2F", - "waiting_usb_auth": "In attesa del device USB...

Tocca ora il pulsante sul dispositivo U2F USB.", - "waiting_usb_register": "In attesa del device USB...

Inserisci la tua password qui sopra e conferma la tua registrazione U2F toccando il pulsante del dispositivo U2F USB.", + "webauthn": "Autenticazione WebAuthn", + "waiting_usb_auth": "In attesa del device USB...

Tocca ora il pulsante sul dispositivo WebAuthn USB.", + "waiting_usb_register": "In attesa del device USB...

Inserisci la tua password qui sopra e conferma la tua registrazione WebAuthn toccando il pulsante del dispositivo WebAuthn USB.", "yubi_otp": "Autenticazione Yubico OTP", "tfa_token_invalid": "Token TFA non valido" }, diff --git a/data/web/lang/lang.ko.json b/data/web/lang/lang.ko.json index e4ceb1c7..3dd1f446 100644 --- a/data/web/lang/lang.ko.json +++ b/data/web/lang/lang.ko.json @@ -417,7 +417,7 @@ "tls_policy_map_parameter_invalid": "유효하지 않은 정책 매개변수", "totp_verification_failed": "TOTP 확인 실패", "transport_dest_exists": "전송 목적지 \"%s\"가 존재합니다.", - "u2f_verification_failed": "U2F 검증 실패: %s", + "webauthn_verification_failed": "WebAuthn 검증 실패: %s", "unknown": "알 수 없는 오류 발생", "unknown_tfa_method": "알 수 없는 TFA 방식", "unlimited_quota_acl": "ACL에 따라 할당량을 무제한으로 둘 수 없습니다.", @@ -852,7 +852,7 @@ "ui_texts": "Saved changes to UI texts", "upload_success": "File uploaded successfully", "verified_totp_login": "Verified TOTP login", - "verified_u2f_login": "Verified U2F login", + "verified_webauthn_login": "Verified WebAuthn login", "verified_yotp_login": "Verified Yubico OTP login" }, "tfa": { @@ -863,7 +863,7 @@ "disable_tfa": "Disable TFA until next successful login", "enter_qr_code": "Your TOTP code if your device cannot scan QR codes", "error_code": "Error code", - "init_u2f": "Initializing, please wait...", + "init_webauthn": "Initializing, please wait...", "key_id": "An identifier for your YubiKey", "key_id_totp": "An identifier for your key", "none": "Deactivate", @@ -871,12 +871,12 @@ "scan_qr_code": "Please scan the following code with your authenticator app or enter the code manually.", "select": "Please select", "set_tfa": "Set two-factor authentication method", - "start_u2f_validation": "Start validation", + "start_webauthn_validation": "Start validation", "tfa": "Two-factor authentication", "totp": "Time-based OTP (Google Authenticator, Authy, etc.)", - "u2f": "U2F authentication", - "waiting_usb_auth": "Waiting for USB device...

Please tap the button on your U2F USB device now.", - "waiting_usb_register": "Waiting for USB device...

Please enter your password above and confirm your U2F registration by tapping the button on your U2F USB device.", + "webauthn": "WebAuthn authentication", + "waiting_usb_auth": "Waiting for USB device...

Please tap the button on your WebAuthn USB device now.", + "waiting_usb_register": "Waiting for USB device...

Please enter your password above and confirm your WebAuthn registration by tapping the button on your WebAuthn USB device.", "yubi_otp": "Yubico OTP authentication" }, "user": { diff --git a/data/web/lang/lang.lv.json b/data/web/lang/lang.lv.json index d4af59c6..ef6f85fb 100644 --- a/data/web/lang/lang.lv.json +++ b/data/web/lang/lang.lv.json @@ -450,9 +450,9 @@ "set_tfa": "Uzstādīt difi faktoru autentifik;acijas metodi", "tfa": "Divu faktoru autentifikācija", "totp": "Uz laiku bāzēta vienreizēja parole (Google Autentifikātors utt.)", - "u2f": "U2F autentifikācija", - "waiting_usb_auth": "Gaida USB ierīci...

Lūdzu, tagad nospiežiet pogu uz Jūsu U2F USB ierīces.", - "waiting_usb_register": "Gaida USB ierīci...

Lūdzu augšā ievadiet Jūsu paroli un apstipriniet U2F reģistrāciju nospiežot pogu uz Jūsu U2F USB ierīces.", + "webauthn": "WebAuthn autentifikācija", + "waiting_usb_auth": "Gaida USB ierīci...

Lūdzu, tagad nospiežiet pogu uz Jūsu WebAuthn USB ierīces.", + "waiting_usb_register": "Gaida USB ierīci...

Lūdzu augšā ievadiet Jūsu paroli un apstipriniet WebAuthn reģistrāciju nospiežot pogu uz Jūsu WebAuthn USB ierīces.", "yubi_otp": "Yubico OTP autentifikators" }, "user": { diff --git a/data/web/lang/lang.nl.json b/data/web/lang/lang.nl.json index 0c548d00..4628aacf 100644 --- a/data/web/lang/lang.nl.json +++ b/data/web/lang/lang.nl.json @@ -428,7 +428,7 @@ "tls_policy_map_parameter_invalid": "Beleidsparameter is ongeldig", "totp_verification_failed": "TOTP-verificatie mislukt", "transport_dest_exists": "Transportbestemming \"%s\" bestaat reeds", - "u2f_verification_failed": "U2F-verificatie mislukt: %s", + "webauthn_verification_failed": "WebAuthn-verificatie mislukt: %s", "fido2_verification_failed": "FIDO2-verificatie mislukt: %s", "unknown": "Er is een onbekende fout opgetreden", "unknown_tfa_method": "Onbekende tweefactorauthenticatiemethode", @@ -891,7 +891,7 @@ "ui_texts": "Wijzigingen aan labels en teksten zijn opgeslagen", "upload_success": "Bestand succesvol geupload", "verified_totp_login": "TOTP succesvol geverifieerd", - "verified_u2f_login": "U2F succesvol geverifieerd", + "verified_webauthn_login": "WebAuthn succesvol geverifieerd", "verified_fido2_login": "FIDO2 succesvol geverifieerd", "verified_yotp_login": "Yubico OTP succesvol geverifieerd" }, @@ -903,7 +903,7 @@ "disable_tfa": "Pauzeer tweefactorauthenticatie tot de eerstvolgende succesvolle login", "enter_qr_code": "Voer deze code in als je apparaat geen QR-codes kan scannen:", "error_code": "Errorcode", - "init_u2f": "Even geduld aub...", + "init_webauthn": "Even geduld aub...", "key_id": "Geef deze YubiKey een naam", "key_id_totp": "Geef deze key een naam", "none": "Deactiveer", @@ -911,13 +911,13 @@ "scan_qr_code": "Scan de volgende QR-code met je authenticatie-app:", "select": "Selecteer...", "set_tfa": "Kies methode voor tweefactorauthenticatie", - "start_u2f_validation": "Start validatie", + "start_webauthn_validation": "Start validatie", "tfa": "Tweefactorauthenticatie", "tfa_token_invalid": "Tweefactorauthenticatietoken is ongeldig", "totp": "TOTP (Step Two, Authy, etc.)", - "u2f": "U2F", - "waiting_usb_auth": "In afwachting van USB-apparaat...

Druk nu op de knop van je U2F-apparaat.", - "waiting_usb_register": "In afwachting van USB-apparaat...

Voer je wachtwoord hierboven in en bevestig de registratie van het U2F-apparaat door op de knop van het apparaat te drukken.", + "webauthn": "WebAuthn", + "waiting_usb_auth": "In afwachting van USB-apparaat...

Druk nu op de knop van je WebAuthn-apparaat.", + "waiting_usb_register": "In afwachting van USB-apparaat...

Voer je wachtwoord hierboven in en bevestig de registratie van het WebAuthn-apparaat door op de knop van het apparaat te drukken.", "yubi_otp": "Yubico OTP" }, "fido2": { diff --git a/data/web/lang/lang.pl.json b/data/web/lang/lang.pl.json index ea8fb6f2..4bfde1d7 100644 --- a/data/web/lang/lang.pl.json +++ b/data/web/lang/lang.pl.json @@ -329,9 +329,9 @@ "set_tfa": "Ustaw metodę uwierzytelniania dwuetapowego", "tfa": "Uwierzytelnianie dwuetapowe", "totp": "Time-based OTP (Google Authenticator itd.)", - "u2f": "Uwierzytelnianie U2F", - "waiting_usb_auth": "Czekam na urządzenie USB...

Wciśnij teraz przycisk na urządzeniu U2F USB.", - "waiting_usb_register": " Czekam na urządzenie USB...

Wprowadź swoje hasło powyżej i potwierdź rejestrację U2F przez naciśnięcie przycisku na urządzeniu U2F USB.", + "webauthn": "Uwierzytelnianie WebAuthn", + "waiting_usb_auth": "Czekam na urządzenie USB...

Wciśnij teraz przycisk na urządzeniu WebAuthn USB.", + "waiting_usb_register": " Czekam na urządzenie USB...

Wprowadź swoje hasło powyżej i potwierdź rejestrację WebAuthn przez naciśnięcie przycisku na urządzeniu WebAuthn USB.", "yubi_otp": "Uwierzytelnianie Yubico OTP" }, "user": { diff --git a/data/web/lang/lang.ro.json b/data/web/lang/lang.ro.json index 20ba0e7e..07d615cf 100644 --- a/data/web/lang/lang.ro.json +++ b/data/web/lang/lang.ro.json @@ -448,7 +448,7 @@ "tls_policy_map_parameter_invalid": "Parametrul politicii este invalid", "totp_verification_failed": "Verificarea TOTP a eșuat", "transport_dest_exists": "Destinația transportului \"%s\" există", - "u2f_verification_failed": "Verificarea U2F a eșuat: %s", + "webauthn_verification_failed": "Verificarea WebAuthn a eșuat: %s", "fido2_verification_failed": "Verificarea FIDO2 a eșuat: %s", "unknown": "A apărut o eroare necunoscută", "unknown_tfa_method": "Metodă TFA necunoscută", @@ -928,7 +928,7 @@ "ui_texts": "Modificări salvate în textele UI", "upload_success": "Fișier încărcat cu succes", "verified_totp_login": "Autentificarea TOTP verificată", - "verified_u2f_login": "Autentificarea U2F verificată", + "verified_webauthn_login": "Autentificarea WebAuthn verificată", "verified_fido2_login": "Conectare FIDO2 verificată", "verified_yotp_login": "Autentificarea Yubico OTP verificată" }, @@ -940,7 +940,7 @@ "disable_tfa": "Dezactivează TFA până la următoarea conectare reușită", "enter_qr_code": "Codul tău TOTP dacă dispozitivul tău nu poate scana codurile QR", "error_code": "Cod de eroare", - "init_u2f": "Inițializare, vă rugăm așteptați...", + "init_webauthn": "Inițializare, vă rugăm așteptați...", "key_id": "Un identificator pentru YubiKey", "key_id_totp": "Un identificator pentru cheia ta", "none": "Dezactivează", @@ -948,13 +948,13 @@ "scan_qr_code": "Scanează codul următor cu aplicația ta de autentificare sau introdu manual codul.", "select": "Te rog selectează", "set_tfa": "Setează metoda de autentificare cu doi factori", - "start_u2f_validation": "Începi validarea", + "start_webauthn_validation": "Începi validarea", "tfa": "Autentificare cu doi factori", "tfa_token_invalid": "Jeton TFA invalid", "totp": "OTP pe bază de timp (Google Authenticator etc.)", - "u2f": "Autentificare U2F", - "waiting_usb_auth": "În așteptarea dispozitivului USB...

Apasă acum butonul de pe dispozitivul tău USB U2F.", - "waiting_usb_register": "În așteptarea dispozitivului USB...

Introdu parola ta mai sus și confirmă înregistrarea ta U2F atingând butonul de pe dispozitivul tău USB U2F.", + "webauthn": "Autentificare WebAuthn", + "waiting_usb_auth": "În așteptarea dispozitivului USB...

Apasă acum butonul de pe dispozitivul tău USB WebAuthn.", + "waiting_usb_register": "În așteptarea dispozitivului USB...

Introdu parola ta mai sus și confirmă înregistrarea ta WebAuthn atingând butonul de pe dispozitivul tău USB WebAuthn.", "yubi_otp": "Autentificare Yubico OTP" }, "fido2": { diff --git a/data/web/lang/lang.ru.json b/data/web/lang/lang.ru.json index 9310e276..0628fe2d 100644 --- a/data/web/lang/lang.ru.json +++ b/data/web/lang/lang.ru.json @@ -454,7 +454,7 @@ "tls_policy_map_parameter_invalid": "Недопустимое значение параметра политики", "totp_verification_failed": "Ошибка валидации TOTP", "transport_dest_exists": "Назначение для отправки \"%s\" уже существует", - "u2f_verification_failed": "Ошибка валидации U2F: %s", + "webauthn_verification_failed": "Ошибка валидации WebAuthn: %s", "unknown": "Произошла неизвестная ошибка", "unknown_tfa_method": "Неизвестный метод TFA", "unlimited_quota_acl": "Неограниченная квота запрещена политикой доступа", @@ -973,7 +973,7 @@ "upload_success": "Файл загружен успешно", "verified_fido2_login": "Авторизация FIDO2 пройдена", "verified_totp_login": "Авторизация TOTP пройдена", - "verified_u2f_login": "Авторизация U2F пройдена", + "verified_webauthn_login": "Авторизация WebAuthn пройдена", "verified_yotp_login": "Авторизация Yubico OTP пройдена" }, "tfa": { @@ -984,7 +984,7 @@ "disable_tfa": "Отключить TFA до следующего успешного входа", "enter_qr_code": "Ваш код TOTP, если устройство не может отсканировать QR-код", "error_code": "Код ошибки", - "init_u2f": "Инициализация, пожалуйста, подождите...", + "init_webauthn": "Инициализация, пожалуйста, подождите...", "key_id": "Идентификатор YubiKey ключа", "key_id_totp": "Идентификатор TOTP ключа", "none": "Отключить", @@ -992,11 +992,11 @@ "scan_qr_code": "Пожалуйста, отсканируйте QR-код с помощью приложения или введите его вручную.", "select": "Пожалуйста, выберите", "set_tfa": "Задать метод двухфакторной проверки", - "start_u2f_validation": "Начать проверку", + "start_webauthn_validation": "Начать проверку", "tfa": "Двухфакторная проверка подлинности", "tfa_token_invalid": "Неправильный TFA токен", "totp": "OTP (Authy, Google Authenticator и др.)", - "u2f": "U2F аутентификация", + "webauthn": "WebAuthn аутентификация", "waiting_usb_auth": "Ожидание устройства USB...

Пожалуйста, нажмите кнопку на USB устройстве сейчас.", "waiting_usb_register": "Ожидание устройства USB...

Пожалуйста, введите пароль выше и подтвердите регистрацию, нажав кнопку на USB устройстве.", "yubi_otp": "Yubico OTP аутентификация" diff --git a/data/web/lang/lang.sk.json b/data/web/lang/lang.sk.json index b3518908..49002c56 100644 --- a/data/web/lang/lang.sk.json +++ b/data/web/lang/lang.sk.json @@ -454,7 +454,7 @@ "tls_policy_map_parameter_invalid": "Podmienkový parameter mapy TLS pravidiel je neplatný", "totp_verification_failed": "TOTP overenie zlyhalo", "transport_dest_exists": "Transportný cieľ \"%s\" už existuje", - "u2f_verification_failed": "U2F overenie zlyhalo: %s", + "webauthn_verification_failed": "WebAuthn overenie zlyhalo: %s", "unknown": "Nastala neznáma chyba", "unknown_tfa_method": "Neznáma TFA metóda", "unlimited_quota_acl": "Neobmedzené kvóta je zakázaná cez ACL", @@ -973,7 +973,7 @@ "upload_success": "Súbor úspešne nahratý", "verified_fido2_login": "Overené FIDO2 prihlásenie", "verified_totp_login": "Overené TOTP prihlásenie", - "verified_u2f_login": "Overené U2F prihlásenie", + "verified_webauthn_login": "Overené WebAuthn prihlásenie", "verified_yotp_login": "Overené Yubico OTP prihlásenie" }, "tfa": { @@ -984,7 +984,7 @@ "disable_tfa": "Vypnúť TFA do ďalšieho úspešného prihlásenia", "enter_qr_code": "Zadajte váš TOTP kód, ak vaše zariadenie nedokáže skenovať QR kódy", "error_code": "Chyba kódu", - "init_u2f": "Inicializácia, prosím čakajte...", + "init_webauthn": "Inicializácia, prosím čakajte...", "key_id": "Identifikátor pre váš YubiKey", "key_id_totp": "Identifikátor pre váš kľúč", "none": "Deaktivovať", @@ -992,11 +992,11 @@ "scan_qr_code": "Prosím oskenujte nasledovný kód pomocou vašej autentizačnej aplikácie alebo zadajte kód manuálne.", "select": "Prosím vyberte", "set_tfa": "Nastaviť dvojúrovňovú autentifikačnú metódu", - "start_u2f_validation": "Spustiť validáciu", + "start_webauthn_validation": "Spustiť validáciu", "tfa": "Dvojúrovňová autentifikácia (TFA)", "tfa_token_invalid": "Neplatný TFA token", "totp": "Časovo-založený OTP (Google Authenticator, Authy, atď.)", - "u2f": "U2F autentifikácia", + "webauthn": "WebAuthn autentifikácia", "waiting_usb_auth": "Čakanie na USB zariadenie...

Prosím stlačte tlačidlo na vašom USB zariadení.", "waiting_usb_register": "Čakanie na USB zariadenie...

Prosím zadajte vaše heslo a potvrďte registráciu stlačením tlačidla na vašom USB zariadení.", "yubi_otp": "Yubico OTP autentifikácia" diff --git a/data/web/lang/lang.sv.json b/data/web/lang/lang.sv.json index f2b9e8fc..12cf2586 100644 --- a/data/web/lang/lang.sv.json +++ b/data/web/lang/lang.sv.json @@ -441,8 +441,8 @@ "tls_policy_map_parameter_invalid": "Policy parameter är ogiltig", "totp_verification_failed": "TOTP-verifiering misslyckades", "transport_dest_exists": "Transportdestinationen \"%s\" existerar redan", - "u2f_verification_failed": "U2F-verifiering misslyckades: %s", - "fido2_verification_failed": "U2F-verifiering misslyckades: %s", + "webauthn_verification_failed": "WebAuthn-verifiering misslyckades: %s", + "fido2_verification_failed": "WebAuthn-verifiering misslyckades: %s", "unknown": "Ett fel har inträffat", "unknown_tfa_method": "Okänd TFA method", "unlimited_quota_acl": "På grund av en åtkomstlista tillåts inte en obegränsad kvot", @@ -911,7 +911,7 @@ "ui_texts": "Ändringarna på texter och rubriker i gränssnittet sparade", "upload_success": "Filen har laddats upp", "verified_totp_login": "Verifierad TOTP inloggning", - "verified_u2f_login": "Verifierad U2F inloggning", + "verified_webauthn_login": "Verifierad WebAuthn inloggning", "verified_fido2_login": "Verifierad FIDO2 inloggning", "verified_yotp_login": "Verifierad Yubico OTP inloggning" }, @@ -923,7 +923,7 @@ "disable_tfa": "Inaktivera tvåfaktorsautentisering tills nästa lyckade inloggning", "enter_qr_code": "Om du inte kan skanna den QR-kod som visas, använd säkerhetsnyckeln som visas nedan", "error_code": "Felkod", - "init_u2f": "Initierar, vänta...", + "init_webauthn": "Initierar, vänta...", "key_id": "En identifierare för din YubiKey", "key_id_totp": "En identifierare för din nyckel", "none": "Avaktivera", @@ -931,11 +931,11 @@ "scan_qr_code": "Skanna nu den QR-kod som visas på skärmen.", "select": "Välj", "set_tfa": "Metod för tvåfaktorsautentisering", - "start_u2f_validation": "Startar validering", + "start_webauthn_validation": "Startar validering", "tfa": "Tvåfaktorsautentisering", "tfa_token_invalid": "TFA nyckeln är ogiltig!", "totp": "Tidsbaserad OTP (Google Authenticator, Authy, mm)", - "u2f": "U2F-autentisering", + "webauthn": "WebAuthn-autentisering", "waiting_usb_auth": "Väntar på USB-enhet...

Tryck på knappen på USB-enheten nu.", "waiting_usb_register": "Väntar på USB-enhet...

Vänligen fyll i det övre lösenordsfältet först och tryck sedan på knappen på USB-enheten.", "yubi_otp": "Yubico OTP-autentisering" diff --git a/data/web/lang/lang.zh.json b/data/web/lang/lang.zh.json index 4d587385..485a4636 100644 --- a/data/web/lang/lang.zh.json +++ b/data/web/lang/lang.zh.json @@ -424,7 +424,7 @@ "tls_policy_map_parameter_invalid": "策略参数非法", "totp_verification_failed": "TOTP认证失败", "transport_dest_exists": "传输目标 \"%s\" 已存在", - "u2f_verification_failed": "U2F认证失败: %s", + "webauthn_verification_failed": "WebAuthn认证失败: %s", "unknown": "发生未知错误", "unknown_tfa_method": "未知TFA方法", "unlimited_quota_acl": "ACL设置禁止了无限配额", @@ -875,7 +875,7 @@ "ui_texts": "已保存UI文本更改", "upload_success": "成功上传文件", "verified_totp_login": "TOTP登录验证成功", - "verified_u2f_login": "U2F登录验证成功", + "verified_webauthn_login": "WebAuthn登录验证成功", "verified_yotp_login": "Yubico OTP登录验证成功" }, "tfa": { @@ -886,7 +886,7 @@ "disable_tfa": "在下一次成功登录前关闭两步验证", "enter_qr_code": "如果你的设备不能扫描QR码，输入此TOTP码", "error_code": "错误码", - "init_u2f": "初始化中，请等待...", + "init_webauthn": "初始化中，请等待...", "key_id": "你的YubiKey的标识", "key_id_totp": "你的密钥的标识", "none": "禁用", @@ -894,12 +894,12 @@ "scan_qr_code": "请用你认证应用扫描或手动输入此码。", "select": "请选择", "set_tfa": "设置两步验证方法", - "start_u2f_validation": "开始认证", + "start_webauthn_validation": "开始认证", "tfa": "两步验证(2FA)", "totp": "TOTP认证 (Google Authenticator、Authy等)", - "u2f": "U2F认证", - "waiting_usb_auth": "等待USB设备...

现在请触碰你的U2F USB设备上的按钮。", - "waiting_usb_register": "等待USB设备...

请在上方输入你的密码并请触碰你的U2F USB设备上的按钮以确认注册U2F设备。", + "webauthn": "WebAuthn认证", + "waiting_usb_auth": "等待USB设备...

现在请触碰你的WebAuthn USB设备上的按钮。", + "waiting_usb_register": "等待USB设备...

请在上方输入你的密码并请触碰你的WebAuthn USB设备上的按钮以确认注册WebAuthn设备。", "yubi_otp": "Yubico OTP认证" }, "user": { diff --git a/data/web/templates/admin/tab-config-admins.twig b/data/web/templates/admin/tab-config-admins.twig index d7c17c8b..cfb69d4d 100644 --- a/data/web/templates/admin/tab-config-admins.twig +++ b/data/web/templates/admin/tab-config-admins.twig @@ -40,7 +40,7 @@
diff --git a/data/web/templates/base.twig b/data/web/templates/base.twig index 79042d59..96728878 100644 --- a/data/web/templates/base.twig +++ b/data/web/templates/base.twig @@ -160,7 +160,7 @@ function recursiveBase64StrToArrayBuffer(obj) { } } } - } +} $(window).load(function() { $(".overlay").hide(); }); @@ -181,32 +181,52 @@ function recursiveBase64StrToArrayBuffer(obj) { backdrop: 'static', keyboard: false }); - $('#u2f_status_auth').html('

' + lang_tfa.init_u2f + '

'); + $('#webauthn_status_auth').html('

' + lang_tfa.init_u2f + '

'); $('#ConfirmTFAModal').on('shown.bs.modal', function(){ $(this).find('input[name=token]').focus(); - // If U2F - if(document.getElementById("u2f_auth_data") !== null) { - $.ajax({ - type: "GET", - cache: false, - dataType: 'script', - url: "/api/v1/get/u2f-authentication/{{ pending_mailcow_cc_username|url_encode(true)|default('null') }}", - complete: function(data){ - $('#u2f_status_auth').html(lang_tfa.waiting_usb_auth); - data; - setTimeout(function() { - console.log("Ready to authenticate"); - u2f.sign(appId, challenge, registeredKeys, function(data) { - var form = document.getElementById('u2f_auth_form'); - var auth = document.getElementById('u2f_auth_data'); - console.log("Authenticate callback", data); - auth.value = JSON.stringify(data); - form.submit(); - }); - }, 1000); - } + // If WebAuthn + if(document.getElementById("webauthn_auth_data") !== null) { + // Check Browser support + if (!window.fetch || !navigator.credentials || !navigator.credentials.create) { + window.alert('Browser not supported for WebAuthn.'); + return; + } + + window.fetch("/api/v1/get/webauthn-tfa-get-args", {method:'GET',cache:'no-cache'}).then(response => { + return response.json(); + }).then(json => { + console.log(json); + if (json.success === false) throw new Error(); + + recursiveBase64StrToArrayBuffer(json); + return json; + }).then(getCredentialArgs => { + console.log(getCredentialArgs); + return navigator.credentials.get(getCredentialArgs); + }).then(cred => { + console.log(cred); + return { + id: cred.rawId ? arrayBufferToBase64(cred.rawId) : null, + clientDataJSON: cred.response.clientDataJSON ? arrayBufferToBase64(cred.response.clientDataJSON) : null, + authenticatorData: cred.response.authenticatorData ? arrayBufferToBase64(cred.response.authenticatorData) : null, + signature : cred.response.signature ? arrayBufferToBase64(cred.response.signature) : null + }; + }).then(JSON.stringify).then(function(AuthenticatorAttestationResponse) { + console.log(AuthenticatorAttestationResponse); + + var form = document.getElementById('webauthn_auth_form'); + var auth = document.getElementById('webauthn_auth_data'); + console.log("Authenticate callback", AuthenticatorAttestationResponse); + auth.value = AuthenticatorAttestationResponse; + form.submit(); + }).catch(function(err) { + if (typeof err.message === 'undefined') { + mailcow_alert_box(lang_fido2.fido2_validation_failed, "danger"); + } else { + mailcow_alert_box(lang_fido2.fido2_validation_failed + ":
" + err.message + "", "danger"); + } }); - } + } }); $('#ConfirmTFAModal').on('hidden.bs.modal', function(){ $.ajax({ @@ -327,46 +347,62 @@ function recursiveBase64StrToArrayBuffer(obj) { }); $("option:selected").prop("selected", false); } - if ($(this).val() == "u2f") { - $('#U2FModal').modal('show'); - $("option:selected").prop("selected", false); - $("#start_u2f_register").click(function(){ - $('#u2f_return_code').html(''); - $('#u2f_return_code').hide(); - $('#u2f_status_reg').html('

' + lang_tfa.init_u2f + '

'); - $.ajax({ - type: "GET", - cache: false, - dataType: 'script', - url: "/api/v1/get/u2f-registration/{{ mailcow_cc_username|url_encode(true)|default('null') }}", - complete: function(data){ - data; - setTimeout(function() { - console.log("Ready to register"); - $('#u2f_status_reg').html(lang_tfa.waiting_usb_register); - u2f.register(appId, registerRequests, registeredKeys, function(deviceResponse) { - var form = document.getElementById('u2f_reg_form'); - var reg = document.getElementById('u2f_register_data'); - console.log("Register callback: ", data); - if (deviceResponse.errorCode && deviceResponse.errorCode != 0) { - var u2f_return_code = document.getElementById('u2f_return_code'); - u2f_return_code.style.display = u2f_return_code.style.display === 'none' ? '' : null; - if (deviceResponse.errorCode == "4") { - deviceResponse.errorCode = "4 - The presented device is not eligible for this request. For a registration request this may mean that the token is already registered, and for a sign request it may mean that the token does not know the presented key handle"; - } - else if (deviceResponse.errorCode == "5") { - deviceResponse.errorCode = "5 - Timeout reached before request could be satisfied."; - } - u2f_return_code.innerHTML = lang_tfa.error_code + ': ' + deviceResponse.errorCode + ' ' + lang_tfa.reload_retry; - return; + if ($(this).val() == "webauthn") { + // check if Browser is supported + if (!window.fetch || !navigator.credentials || !navigator.credentials.create) { + window.alert('Browser not supported.'); + return; + } + + // show modal + $('#WebAuthnModal').modal('show'); + $("option:selected").prop("selected", false); + + $("#start_webauthn_register").click(() => { + var key_id = document.getElementsByName('key_id')[1].value; + + // fetch WebAuthn CreateArgs + window.fetch("/api/v1/get/webauthn-tfa-registration/{{ mailcow_cc_username|url_encode(true)|default('null') }}", {method:'GET',cache:'no-cache'}).then(response => { + return response.json(); + }).then(json => { + console.log(json); + + if (json.success === false) throw new Error(json.msg); + + recursiveBase64StrToArrayBuffer(json); + + return json; + }).then(createCredentialArgs => { + return navigator.credentials.create(createCredentialArgs); + }).then(cred => { + return { + clientDataJSON: cred.response.clientDataJSON ? arrayBufferToBase64(cred.response.clientDataJSON) : null, + attestationObject: cred.response.attestationObject ? arrayBufferToBase64(cred.response.attestationObject) : null, + key_id: key_id, + tfa_method: "webauthn" + }; + }).then(JSON.stringify).then(AuthenticatorAttestationResponse => { + console.log(AuthenticatorAttestationResponse); + + return window.fetch("/api/v1/add/webauthn-tfa-registration", {method:'POST', body: AuthenticatorAttestationResponse, cache:'no-cache'}); + }).then(response => { + return response.json(); + }).then(json => { + console.log(json); + + if (json.success) { + console.log("success"); + window.location.reload(); + } else { + throw new Error(json.msg); } - reg.value = JSON.stringify(deviceResponse); - form.submit(); - }); - }, 1000); - } + }).catch(function(err) { + console.log(err); + var webauthn_return_code = document.getElementById('webauthn_return_code'); + webauthn_return_code.style.display = webauthn_return_code.style.display === 'none' ? '' : null; + webauthn_return_code.innerHTML = lang_tfa.error_code + ': ' + err + ' ' + lang_tfa.reload_retry; + }); }); - }); } if ($(this).val() == "none") { $('#DisableTFAModal').modal('show'); diff --git a/data/web/templates/modals/footer.twig b/data/web/templates/modals/footer.twig index 8e5cb175..306005a1 100644 --- a/data/web/templates/modals/footer.twig +++ b/data/web/templates/modals/footer.twig @@ -37,15 +37,15 @@
-