Merge 978a5cf4c2 into 864065cd37

config.inc.php

@@ -506,6 +506,10 @@ EOM;
 // address is legal by performing a name server look-up.
 $CONF['emailcheck_resolve_domain']='YES';
 
+// When creating mailboxes or aliases, check that the domain-part of the
+// address is local and managed by postfixadmin, preventing remote domains
+// from being the destination for an alias
+$CONF['emailcheck_localaliasonly']='NO';
 
 // Optional:
 // Analyze alias gotos and display a colored block in the first column

functions.inc.php

@@ -267,6 +267,33 @@ function check_domain($domain) {
     return '';
 }
 
+/**
+ * Checks if a domain is local
+ * @param string $domain
+ * @return string empty if the domain is valid, otherwise string with the errormessage
+ */
+function check_localaliasonly($domain) {
+    // If emailcheck_localaliasonly is set to 'YES', disallow aliases to remote servers (but allow aliases on this server)
+    if (Config::bool('emailcheck_localaliasonly')) {
+        // get the domain part of the e-mail
+        list(/*NULL*/, $domain) = explode('@', $domain);
+        
+        // get all domains managed on this system by postfixadmin
+        $domains = list_domains();
+        
+        // Only allow local domains to be alias destinations
+        if (in_array($domain, $domains)) {
+            return '';
+        } else {
+            // FIXME: Add transaltions
+            return sprintf("You may only make aliases to domains hosted on this server. %s is a remote domain name.", htmlentities($domain));
+        }
+    } else {
+      return '';
+    }
+
+}
+
 /**
  * Get password expiration value for a domain
  * @param string $domain - a string that may be a domain

model/AliasHandler.php

@@ -394,12 +394,20 @@ class AliasHandler extends PFAHandler {
                 if ($domain_check != '') {
                     $errors[] = "$singlegoto: $domain_check";
                 }
+                $localaliasonly_check = check_localaliasonly($domain);
+                if ($localaliasonly_check != '') {
+                    $errors[] = "$singlegoto: $localaliasonly_check";
+                }
             } else {
                 $email_check = check_email($singlegoto);
                 // preg_match -> allows for redirect to a local system account.
                 if ($email_check != '' && !preg_match('/^[a-z0-9]+$/', $singlegoto)) {
                     $errors[] = "$singlegoto: $email_check";
                 }
+                $localaliasonly_check = check_localaliasonly($singlegoto);
+                if ($localaliasonly_check != '') {
+                    $errors[] = "$singlegoto: $localaliasonly_check";
+                }
             }
         }