[Web] Fix BCC validation for aliases
parent
51b32bc4c0
commit
7050d7c259
|
@ -0,0 +1,2 @@
|
|||
<?php
|
||||
// PoC
|
|
@ -48,7 +48,8 @@ function bcc($_action, $_data = null, $attr = null) {
|
|||
$local_dest_sane = '@' . idn_to_ascii($local_dest, 0, INTL_IDNA_VARIANT_UTS46);
|
||||
}
|
||||
elseif (filter_var($local_dest, FILTER_VALIDATE_EMAIL)) {
|
||||
if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $local_dest)) {
|
||||
$mailbox = mailbox('get', 'mailbox_details', $local_dest);
|
||||
if ($mailbox === false && array_key_exists($local_dest, array_merge($direct_aliases, $shared_aliases)) === false) {
|
||||
$_SESSION['return'][] = array(
|
||||
'type' => 'danger',
|
||||
'log' => array(__FUNCTION__, $_action, $_data, $_attr),
|
||||
|
@ -56,10 +57,16 @@ function bcc($_action, $_data = null, $attr = null) {
|
|||
);
|
||||
return false;
|
||||
}
|
||||
$domain = mailbox('get', 'mailbox_details', $local_dest)['domain'];
|
||||
if (empty($domain)) {
|
||||
if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $local_dest) &&
|
||||
!hasAliasObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $local_dest)) {
|
||||
$_SESSION['return'][] = array(
|
||||
'type' => 'danger',
|
||||
'log' => array(__FUNCTION__, $_action, $_data, $_attr),
|
||||
'msg' => 'access_denied'
|
||||
);
|
||||
return false;
|
||||
}
|
||||
$domain = idn_to_ascii(substr(strstr($local_dest, '@'), 1), 0, INTL_IDNA_VARIANT_UTS46);
|
||||
$local_dest_sane = $local_dest;
|
||||
}
|
||||
else {
|
||||
|
|
|
@ -548,16 +548,17 @@ function hasMailboxObjectAccess($username, $role, $object) {
|
|||
}
|
||||
function hasAliasObjectAccess($username, $role, $object) {
|
||||
global $pdo;
|
||||
if (empty($username) || empty($role) || empty($object)) {
|
||||
return false;
|
||||
}
|
||||
if (!filter_var(html_entity_decode(rawurldecode($username)), FILTER_VALIDATE_EMAIL) && !ctype_alnum(str_replace(array('_', '.', '-'), '', $username))) {
|
||||
return false;
|
||||
}
|
||||
if ($role != 'admin' && $role != 'domainadmin' && $role != 'user') {
|
||||
return false;
|
||||
}
|
||||
if ($username == $object) {
|
||||
return true;
|
||||
}
|
||||
$stmt = $pdo->prepare("SELECT `domain` FROM `alias` WHERE `address` = :object");
|
||||
// Do not verify mailboxes
|
||||
$stmt = $pdo->prepare("SELECT `domain` FROM `alias` WHERE `address` = :object AND `address` != `goto`");
|
||||
$stmt->execute(array(':object' => $object));
|
||||
$row = $stmt->fetch(PDO::FETCH_ASSOC);
|
||||
if (isset($row['domain']) && hasDomainAccess($username, $role, $row['domain'])) {
|
||||
|
@ -1031,7 +1032,7 @@ function user_get_alias_details($username) {
|
|||
if (empty($row['ad_alias'])) {
|
||||
continue;
|
||||
}
|
||||
$data['direct_aliases'][$row['ad_alias']]['public_comment'] = '<span data-toggle="tooltip" title="' . $lang['add']['alias_domain'] . '">' . $row['alias_domain'] . '</span>';
|
||||
$data['direct_aliases'][$row['ad_alias']]['public_comment'] = $lang['add']['alias_domain'];
|
||||
$data['alias_domains'][] = $row['alias_domain'];
|
||||
}
|
||||
$stmt = $pdo->prepare("SELECT IFNULL(GROUP_CONCAT(`send_as` SEPARATOR ', '), '') AS `send_as` FROM `sender_acl` WHERE `logged_in_as` = :username AND `send_as` NOT LIKE '@%';");
|
||||
|
|
Loading…
Reference in New Issue