paxton
/
mailcow
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

remove obsolete code, use openssl instead of `cat /dev/urandom`

master
Marcel Hofer 2019-02-26 20:44:53 +01:00
parent 9f3b79b361
commit e2f39df7d8
2 changed files with 12 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
data/Dockerfiles/sogo/bootstrap-sogo.sh
View File

@ -83,19 +83,16 @@ EOF
done
mkdir -p /var/lib/sogo/GNUstep/Defaults/
# Force-remove lines from sogo.conf
sed -i '/SOGoIMAPServer/d' /etc/sogo/sogo.conf
if [[ "${ALLOW_ADMIN_EMAIL_LOGIN}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
TRUST_PROXY="YES"
else
TRUST_PROXY="NO"
fi
RAND_PASS=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 24 | head -n 1)
# cat /dev/urandom seems to hang here occasionally and is not recommended anyway, better use openssl
RAND_PASS=$(openssl rand -base64 16 | tr -dc _A-Z-a-z-0-9)
# Generate plist header with timezone data
mkdir -p /var/lib/sogo/GNUstep/Defaults/
cat <<EOF > /var/lib/sogo/GNUstep/Defaults/sogod.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//GNUstep//DTD plist 0.9//EN" "http://www.gnustep.org/plist-0_9.xml">

37
data/web/sogo-auth.php
View File

@ -1,30 +1,5 @@
<?php
/**
* currently disabled: we could add auth_request to ningx sogo_eas.template
* but this seems to be not required with the postfix allow_real_nets option
*/
/*
if (substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 28) === "/Microsoft-Server-ActiveSync") {
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
$server=print_r($_SERVER, true);
$username = $_SERVER['PHP_AUTH_USER'];
$password = $_SERVER['PHP_AUTH_PW'];
$login_check = check_login($username, $password);
if ($login_check !== 'user') {
header('HTTP/1.0 401 Unauthorized');
echo 'Invalid login';
exit;
} else {
echo 'Login OK';
exit;
}
} else {
// other code
}
*/
$ALLOW_ADMIN_EMAIL_LOGIN = (preg_match(
"/^([yY][eE][sS]|[yY])+$/",
$_ENV["ALLOW_ADMIN_EMAIL_LOGIN"]
@ -34,28 +9,34 @@ $session_var_user = 'sogo-sso-user';
$session_var_pass = 'sogo-sso-pass';
if (!$ALLOW_ADMIN_EMAIL_LOGIN) {
header("Location: /");
header('HTTP/1.0 401 Forbidden');
echo "this feature is disabled";
exit;
}
elseif (isset($_GET['login'])) {
// load prerequisites only when required
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
// check permissions
if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['acl']['login_as'] == "1") {
$login = html_entity_decode(rawurldecode($_GET["login"]));
if (filter_var($login, FILTER_VALIDATE_EMAIL)) {
if (!empty(mailbox('get', 'mailbox_details', $login))) {
// load master password
$sogo_sso_pass = file_get_contents("/etc/sogo-sso/sogo-sso.pass");
// register username and password in session
$_SESSION[$session_var_user] = $login;
$_SESSION[$session_var_pass] = $sogo_sso_pass;
// redirect to sogo (sogo will get the correct credentials via nginx auth_request
header("Location: /SOGo/");
exit;
}
}
}
header("Location: /");
header('HTTP/1.0 401 Forbidden');
exit;
}
else {
// this is an nginx auth_request call, we check for an existing sogo-sso-user session variable
// this is an nginx auth_request call, we check for existing sogo-sso session variables
session_start();
if (isset($_SESSION[$session_var_user]) && filter_var($_SESSION[$session_var_user], FILTER_VALIDATE_EMAIL)) {
$username = $_SESSION[$session_var_user];