From 8e1ac0bfbb7bbcdd9796bfeed4c5789eafe132b6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Peters?= Date: Sat, 10 Feb 2018 21:00:00 +0100 Subject: [PATCH] [Web] More fixes for #1017 --- data/web/edit.php | 18 ++++----- data/web/inc/functions.mailbox.inc.php | 10 ++--- data/web/js/mailbox.js | 51 +++++++++++++------------- 3 files changed, 40 insertions(+), 39 deletions(-) diff --git a/data/web/edit.php b/data/web/edit.php index 8049386a..6652d7f3 100644 --- a/data/web/edit.php +++ b/data/web/edit.php @@ -20,7 +20,7 @@ if (isset($_SESSION['mailcow_cc_role'])) { if ($_SESSION['mailcow_cc_role'] == "admin" || $_SESSION['mailcow_cc_role'] == "domainadmin") { if (isset($_GET["alias"]) && !empty($_GET["alias"])) { - $alias = $_GET["alias"]; + $alias = html_entity_decode(rawurldecode($_GET["alias"])); $result = mailbox('get', 'alias_details', $alias); if (!empty($result)) { ?> @@ -46,7 +46,7 @@ if (isset($_SESSION['mailcow_cc_role'])) {
- +
@@ -313,9 +313,9 @@ if (isset($_SESSION['mailcow_cc_role'])) { } } elseif (isset($_GET['aliasdomain']) && - is_valid_domain_name($_GET["aliasdomain"]) && + is_valid_domain_name(html_entity_decode(rawurldecode($_GET["aliasdomain"]))) && !empty($_GET["aliasdomain"])) { - $alias_domain = $_GET["aliasdomain"]; + $alias_domain = html_entity_decode(rawurldecode($_GET["aliasdomain"])); $result = mailbox('get', 'alias_domain_details', $alias_domain); $rl = mailbox('get', 'ratelimit', $alias_domain); if (!empty($result)) { @@ -380,8 +380,8 @@ if (isset($_SESSION['mailcow_cc_role'])) {
- +
@@ -555,8 +555,8 @@ if (isset($_SESSION['mailcow_cc_role'])) { diff --git a/data/web/inc/functions.mailbox.inc.php b/data/web/inc/functions.mailbox.inc.php index 5bd9ac58..6cc5bf30 100644 --- a/data/web/inc/functions.mailbox.inc.php +++ b/data/web/inc/functions.mailbox.inc.php @@ -511,8 +511,8 @@ function mailbox($_action, $_type, $_data = null, $attr = null) { if (in_array($address, $gotos)) { continue; } - $domain = idn_to_ascii(substr(strstr($address, '@'), 1)); - $local_part = strstr($address, '@', true); + $domain = idn_to_ascii(substr(strrchr($address, '@'), 1)); + $local_part = substr($address, 0, strripos($address, '@')); $address = $local_part.'@'.$domain; $stmt = $pdo->prepare("SELECT `address` FROM `alias` WHERE `address`= :address OR `address` IN ( @@ -1713,8 +1713,8 @@ function mailbox($_action, $_type, $_data = null, $attr = null) { $gotos = array_filter($gotos); $goto = implode(",", $gotos); } - $domain = idn_to_ascii(substr(strstr($address, '@'), 1)); - $local_part = strstr($address, '@', true); + $domain = idn_to_ascii(substr(strrchr($address, '@'), 1)); + $local_part = substr($address, 0, strripos($address, '@')); if (!hasDomainAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $domain)) { $_SESSION['return'] = array( 'type' => 'danger', @@ -3478,7 +3478,7 @@ function mailbox($_action, $_type, $_data = null, $attr = null) { $addresses = $_data['address']; } foreach ($addresses as $address) { - $local_part = strstr($address, '@', true); + $local_part = substr($address, 0, strripos($address, '@')); $domain = mailbox('get', 'alias_details', $address)['domain']; try { $stmt = $pdo->prepare("SELECT `goto` FROM `alias` WHERE `address` = :address"); diff --git a/data/web/js/mailbox.js b/data/web/js/mailbox.js index 1ff4066d..93418d92 100644 --- a/data/web/js/mailbox.js +++ b/data/web/js/mailbox.js @@ -186,16 +186,16 @@ jQuery(function($){ item.mailboxes = item.mboxes_in_domain + " / " + item.max_num_mboxes_for_domain; item.quota = item.quota_used_in_domain + "/" + item.max_quota_for_domain; item.max_quota_for_mbox = humanFileSize(item.max_quota_for_mbox); - item.chkbox = ''; + item.chkbox = ''; item.action = '
'; if (role == "admin") { - item.action += ' ' + lang.edit + '' + - ' ' + lang.remove + ''; + item.action += ' ' + lang.edit + '' + + ' ' + lang.remove + ''; } else { - item.action += ' ' + lang.edit + ''; + item.action += ' ' + lang.edit + ''; } - item.action += ' DNS
'; + item.action += ' DNS'; }); } }), @@ -251,18 +251,18 @@ jQuery(function($){ item.quota = item.quota_used + "/" + item.quota; item.max_quota_for_mbox = humanFileSize(item.max_quota_for_mbox); item.username = escapeHtml(item.username); - item.chkbox = ''; + item.chkbox = ''; if (role == "admin") { item.action = '
' + - ' ' + lang.edit + '' + - ' ' + lang.remove + '' + - ' Login' + + ' ' + lang.edit + '' + + ' ' + lang.remove + '' + + ' Login' + '
'; } else { item.action = '
' + - ' ' + lang.edit + '' + - ' ' + lang.remove + '' + + ' ' + lang.edit + '' + + ' ' + lang.remove + '' + '
'; } item.in_use = '
' + @@ -309,11 +309,12 @@ jQuery(function($){ }, success: function (data) { $.each(data, function (i, item) { + item.name = escapeHtml(item.name); item.action = '
' + - ' ' + lang.edit + '' + - ' ' + lang.remove + '' + + ' ' + lang.edit + '' + + ' ' + lang.remove + '' + '
'; - item.chkbox = ''; + item.chkbox = ''; }); } }), @@ -455,14 +456,14 @@ jQuery(function($){ success: function (data) { $.each(data, function (i, item) { item.action = '
' + - ' ' + lang.edit + '' + - ' ' + lang.remove + '' + + ' ' + lang.edit + '' + + ' ' + lang.remove + '' + '
'; - item.chkbox = ''; + item.chkbox = ''; item.goto = escapeHtml(item.goto); item.address = escapeHtml(item.address); if (item.is_catch_all == 1) { - item.address = '
Catch-All
' + item.address; + item.address = '
Catch-All
' + escapeHtml(item.address); } if (item.goto == "null@localhost") { item.goto = '⤷ '; @@ -510,11 +511,11 @@ jQuery(function($){ success: function (data) { $.each(data, function (i, item) { item.action = '
' + - ' ' + lang.edit + '' + - ' ' + lang.remove + '' + - ' DNS
' + + ' ' + lang.edit + '' + + ' ' + lang.remove + '' + + ' DNS
' + ''; - item.chkbox = ''; + item.chkbox = ''; }); } }), @@ -560,7 +561,7 @@ jQuery(function($){ }, success: function (data) { $.each(data, function (i, item) { - item.log = 'Open logs' + item.log = 'Open logs' item.user2 = escapeHtml(item.user2); if (!item.exclude > 0) { item.exclude = '-'; @@ -570,7 +571,7 @@ jQuery(function($){ item.server_w_port = item.user1 + '@' + item.host1 + ':' + item.port1; item.action = '
' + ' ' + lang.edit + '' + - ' ' + lang.remove + '' + + ' ' + lang.remove + '' + '
'; item.chkbox = ''; if (item.is_running == 1) { @@ -632,7 +633,7 @@ jQuery(function($){ item.filter_type = '
' + item.filter_type.charAt(0).toUpperCase() + item.filter_type.slice(1).toLowerCase() + '
' item.action = '
' + ' ' + lang.edit + '' + - ' ' + lang.remove + '' + + ' ' + lang.remove + '' + '
'; item.chkbox = '' });