Commit Graph

276 Commits (3d28caf759d4e290f794ee3fb14e5911f6c4d260)

Author SHA1 Message Date
Christian Boltz 52a7df2b3a Add CSRF protection for POST requests
Add the CSRF token to all forms, and validate it when those forms are
submitted.

https://sourceforge.net/p/postfixadmin/bugs/372/



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1842 a1433add-5e2c-0410-b055-b7f2511e0802
10 years ago
Christian Boltz 530c489ec4 editform.tpl:
- add {if} block for description column to make customization for
  special fields/cases easier


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1829 a1433add-5e2c-0410-b055-b7f2511e0802
10 years ago
Christian Boltz 2102c1baa8 list.tpl:
- 'itemkey' escaping again. I found another corner case that was broken
  with |escape:"html". Therefore switch to the exact htmlentities() call
  that we use in smarty.inc.php.


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1827 a1433add-5e2c-0410-b055-b7f2511e0802
10 years ago
Christian Boltz 48dde6468a list.tpl:
- getting the key from $RAW_item.$id_field turned out to be broken in
  corner cases, leading to empty output. The better (and simpler) fix is
  to just let the foreach loop set 'itemkey'.
- the example for special handling of a specific table and field
  contained a superfluous </tr>




git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1826 a1433add-5e2c-0410-b055-b7f2511e0802
10 years ago
Christian Boltz ba46282f92 use smarty html_options instead of select_options()
list-virtual and viewlog were the last users of select_options()

smarty.inc.php:
- drop (now unused) select_options()



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1822 a1433add-5e2c-0410-b055-b7f2511e0802
10 years ago
Christian Boltz 085e7e4bfb list.tpl:
- base edit, editactive and delete links on $RAW_item to avoid double
  escaping ($items is already html-escaped, and we url-escape it for
  links). This fixes the remaining part of
  http://sourceforge.net/p/postfixadmin/bugs/356/
- simplify displaying "html" fields by using $RAW_item. This also fixes
  problems with funny[tm] item names that differ when html-encoded (like
  the ' char)



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1812 a1433add-5e2c-0410-b055-b7f2511e0802
10 years ago
Christian Boltz 680e96b590 list-virtual_alias_domain:
- also assign RAW_items (from $RAW_tAliasDomains)



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1811 a1433add-5e2c-0410-b055-b7f2511e0802
10 years ago
Christian Boltz 7cf10f81a7 list*.tpl
- display the "Go" button only if javascript is disabled (the dropdowns
  have an onchange event defined, which makes the "Go" button superfluous)


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1780 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 993c0ec2b6 list.tpl:
- improve headline:
  - in search mode, display the search term instead of the last selected
    domain (which isn't useful at all when displaying search results)
  - display number of aliases and mailboxes only in domain mode (they
    are useless/wrong in search mode)



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1779 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz d2a80adedc list-virtual.tpl:
- update/fix search part of subnav links (all/mailboxes/aliases/alias domains)
  for $search[_]


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1778 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 37bba15625 Use list.tpl to display the alias list
list-virtual.php:
- use list.tpl for aliases
- move show_gen_status handling for aliases to AliasHandler

AliasHandler:
- initStruct():
  - add 'status' column (hidden by default)
  - hide 'created'
  - move 'active' after 'modified' to match old list-virtual.php layout
- initMsg: add list_header
- webformConfig(): if $CONF[show_status], set display_in_list for
  'status' column. Also set a (whitespace) label to make sure it's
  displayed
- db_read_from_db_postprocess(): if 'status' column is requested, call
  gen_show_status() for each row

list-virtual.tpl
- remove alias table header and create alias button (which should have
  been in list-virtual_alias.tpl)

list-virtual_alias.tpl:
- replace code to generate the alias table with {include 'list.tpl'}
  (and some variable assignments)


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1777 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz adc038e218 list.tpl:
- add support for list_header (like ":: Alias" in list-virtual)

PFAHandler:
- add empty default for $msg['list_header']


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1776 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 35fad174f7 smarty.inc.php:
- assign(): additionally provide the unsanitized values as RAW_$key

PFAHandler.php:
- document 'html' field type (used for raw html), including a big warning

list.tpl:
- add handling to display raw html fields

This is a preparation to use the status markers with list.tpl without
introducing too big changes.


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1775 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 3a72203de4 AliasHandler:
- initStruct(): replace (wrong) 'editable' with '_can_edit' and '_can_delete'
- read_from_db_postprocess(): disable _can_edit and _can_delete for
  default aliases if special_alias_control is off and not superadmin

list.tpl:
- use $item._can_edit instead of $check_alias_owner

list-virtual.php:
- drop $check_alias_owner variable and check_alias_owner() call
  (replaced by the code added in AliasHandler)
- drop unused $sql_domain

functions.inc.php:
- delete no longer used check_alias_owner() function



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1774 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 8043515fdf migrate search input field to use search[_], and use list.tpl for alias domains
User-visible changes:
- alias domain list can be downloaded as CSV
- no more search highlighting for alias domains

list-virtual.php:
- expect $search to be an array
- change alias domain handling to use list.php instead of
  list-virtual_alias_domain.tpl, and move some logic from the template
  to list-virtual.php. (The template file is kept as list.tpl wrapper.)
- adopt mailbox and alias search to $search[_]
- adopt pagebrowser to $search[_]

list-virtual_alias_domain.tpl:
- replace custom output generation with {include 'list.php'} and some
  variable assignments

PFAHandler.php:
- add $this->id_field to $this->msg (avoids another smarty template
  variable)

configs/menu.conf:
- change input name to search[_]

list-virtual_alias.tpl, list-virtual_mailbox.tpl:
- adopt to $search[_] by setting $search in a backwards-compatible way

list.tpl:
- add special handling for aliasdomain.target_domain linking



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1773 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 4ce0a57e83 PFAHandler:
- add protected $searchfields = array(); - list of fields to search by
  default, if just a search term is given. This will be done with
  $search['_'], but that code is not implemented yet.
- add $this->msg['show_simple_search'] (true if $searchfields is non-empty)

list.tpl:
- display search input box and search overview only if $searchfields is
  not empty

AliasdomainHandler:
- add 'alias_domain' and 'target_domain' to $searchfields

MailboxHandler:
- add 'username' to $searchfields

AliasHandler:
- add 'address' and 'goto' to $searchfields

This effectively means that the search input box is no longer displayed
in list.php for admin, domain and fetchmail listings.


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1770 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 6e5c8f8054 add 'can_create' flag
PFAHandler:
- add $msg['can_create'] (true by default)

DomainHandler:
- set $msg['can_create'] based on is_superadmin

list.tpl:
- display 'create' button only if $msg['can_create'] is true

Note: This is only an optical improvement, not a permission check.


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1769 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 4322486b21 delete fetchmail.php and templates/fetchmail.tpl
(replaced by FetchmailHandler)


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1765 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz dd43f12e9b delete list-admin.php and its template, use list.php instead
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1754 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 64c6e9f0a0 list.tpl:
- fix displaying list and txtl fields


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1751 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz eb7e40cf94 PFAHandler, editform.tpl:
- add support for 'b64p' fields (passwords stored base64-encoded)
  as preparation to migrate fetchmail.php to FetchmailHandler


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1750 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 86dc74fd86 menu.tpl:
- display "view log" menu entry only if logging is enabled
  https://sourceforge.net/p/postfixadmin/patches/127/


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1748 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 6e82a41121 delete list-domain.php and its templates
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1747 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 1d35ba80ab model/DomainHandler.php:
- initStruct():
  - add optical quota indicators for aliases, mailboxes, domain quota
  - some adjustments to get nice output with list.php (mostly following
    list-domain.php)
- webformConfig(): switch listview to list.php

configs/menu.conf, templates/adminlistadmin.tpl:
- switch list-domain.php to list.php?table=domain



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1745 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 4bc2d5f691 list.tpl, default.css:
- format unlimited/disabled quota similar to x/y, but no border


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1743 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 6051729458 list.tpl:
- make "active" a link only if the record is editable


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1741 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 03b0c869dd list.php:
- add search support:
  - new parameters:
    - search[$field] - value to search for
    - searchmode[$field] - search mode (=, <, > etc.)
    - reset_search - if given, empty $search and $searchmode
  - remember $search and $searchmode via session
  - display errormsg and infomsg from $handler, if any
 
list.tpl:
- display current search parameters and a "[x]" link to remove all
  search parameters

This change doesn't add a search form, but you can use ?search[field]=
and ?searchmode[field]= URL parameters


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1732 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz d2490f6153 list.tpl:
- add support for $struct[linkto]



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1727 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 7a23b3cda8 list.tpl:
- add handling for quota fields (visual quota indicator)


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1726 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz a826564962 list.php:
- add CSV export

list.tpl:
- add "export as CSV" link

*.lang:
- new text 'download_csv'


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1725 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 1e35c579b6 list.php, list.tpl:
- use smarty-style dropdown for admin dropdown instead of select_options()
- only display admin dropdown if more than one admin is available
  (which basically means hiding it for domain admins)


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1723 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz b5a6417a6e add list.php and list.tpl - generic files to display lists
(will replace list-admin, list-domain etc.)

list.php:
- generic list view, select *Handler with ?table=

list.tpl:
- display list view
- columns based on $struct (every column with display_in_list and 
  non-empty label will be displayed)


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1722 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 1ad0d6832b editform.tpl:
- display cleartext value instead of key for readonly enma fields


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1721 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 3d58d1f092 editform.tpl:
- add handling for 'enma' fields (see PFAHandler r1711)


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1720 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz e670bcd5b8 list-virtual_mailbox.tpl:
- fix: display quota if $CONF[used_quotas] == NO
  https://sourceforge.net/p/postfixadmin/bugs/307/



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1674 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz 9913a446fc header.tpl:
- add page-{$smarty_template} and page-{$smarty_template}-{$table} 
  classes to allow more targeted CSS styling


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1656 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz c2752782a2 header.tpl:
- remove isset() - this re-introduces the risk to produce an "undefined"
  notice if someone uses an outdated config.inc.php, but also avoids 
  <link ... href=""> (notice the empty href) if $CONF[theme_custom_css]
  is set, but empty


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1634 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz 0cf9d7e53c templates/editform.tpl:
- change all field names to "value[$key]" instead of just "$key"
  to keep the main "namespace" clean

edit.php:
- adjust POST handling code to changed form field names ("value[$key]")



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1629 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
David Goodwin c2cfd6fe04 templates/header.tpl : check for existance of thing before trying to use it
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1624 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz 4a653e0da6 footer.tpl:
- do not escape $CONF.footer_text - it is already escaped


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1620 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz 8c139c95d6 vacation:
restrict reply type to a list of options ($CONF[vacation_choice_of_reply]),
remove input field for custom interval


config.inc.php:
- change $CONF['vacation_choice_of_reply'] to [seconds] => [$PALANG label]
  (note: reply to every mail is commented by default because it can be
  annoying. Admins will have to explicitely add/enable it in their config.)
- remove $CONF[vacation_replytype_default]
- update comment about dovecot:* for $CONF[encrypt]

*.lang:
- add texts for reply types

VacationHandler.php:
- remove reply_type at various places
- set_away(): remove reply_type from list of function parameters

templates/vacation.tpl:
- update reply type dropdown for the changed $CONF['vacation_choice_of_reply']
- remove the input fields for custom reply delay

vacation.php:
- restrict reply type to a list of options ($CONF[vacation_choice_of_reply])
- if vacation is disabled, but old values are stored in the database,
  change the activeFrom and activeUntil date to today to avoid users
  have to scroll through the calendar a lot

xmlrpc.php:
- update set_away() call to match the removed parameter

upgrade.php:
- comment out upgrade_1345_mysql() which created the reply_type and 
  interval_time fields in the vacation table in mysql
- add upgrade_1610() to add the vacation.interval_time field


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1610 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz 60297e483c *.lang:
- rename pAdminCreate_admin_username_text to email_address
- rename pAdminEdit_admin_super_admin to super_admin

AdminHandler.php - initStruct(): 
- adopt to the renamed $PALANG texts
- remove some TODOs
- whitespace changes

setup.php, adminlistadmin.tpl:
- adopt to the renamed $PALANG texts


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1580 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz b871b47709 As a side effect of the previous commit (r1568), we can use login.php
for logout.

This means:
- change logout URL to login.php in menu.conf and users_main.tpl
- delete logout.php and users/logout.php



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1569 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz e079e85461 editactive.php:
- new, small script to change the 'active' status
- also include CSRF protection token

edit.php:
- remove handling of 'active' to make it more readable

*list*.tpl:
- change links to use editactive.php, add CSRF token

configs/menu.conf
- add url_editactive


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1566 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz 1a79b2798e delete.php:
- require token for CSRF protection, see
  https://sourceforge.net/p/postfixadmin/bugs/269/

login.php, users/login.php:
- create token and store it in $_SESSION

templates/*:
- add token to all delete.php links

templates/list-virtual_alias_domain.tpl:
- change delete confirmation dialog to contain "from->target"


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1564 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz 4847173755 delete.php:
- use *Handler for deletion
  (which also means delete.php only has 17 lines of code now - 130 lines 
  less than before :-)

templates/list-virtual_*.tpl:
- remove now superfluous "domain" parameter in delete.php link


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1563 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz 2dc71b6c9f templates/index.tpl:
- replace {php} usage (which is no longer allowed since switching
  from SmartyBC to Smarty) with $smarty.server

fixes https://sourceforge.net/p/postfixadmin/bugs/303/


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1552 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz ee90f4a74e smarty.inc.php:
- move header() calls from index.tpl to smarty.inc.php, which means 
  we no longer need to use SmartyBC class
- use Smarty instead of SmartyBC class
- eval_size(): use Config::Lang instead of $PALANG

templates/header.tpl:
- move header() calls to smarty.inc.php, and drop {php} usage



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1544 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz f02b781376 backup.php:
- move "unmaintained" warning to templates/backupwarning.tpl (that's 
  the easiest way to have working HTML tags) 
- remove <p> tag from pgsql error message

templates/backupwarning.tpl
- new file, contains the "unmaintained" warning for backup.php


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1542 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz b985816baa fetchmail: add sslcertck, sslcertpath, sslfingerprint
ADDITIONS/fetchmail.pl
- add sslcertck, sslcertpath and sslfingerprint to fetchmail config
- some whitespace fixes

fetchmail.php
- add sslcertck, sslcertpath, sslfingerprint fields
  (sslcertpath and sslfingerprint require $CONF[fetchmail_extra_options]
  because they don't have input validation)

languages/*.lang
- add new texts needed for the added fields

templates/fetchmail.tpl:
- add the new fields
- also add extra_options and mda fields - they were not displayed yet

upgrade.php
- fix _db_add_field() to call _db_field_exists() with correct table name
- upgrade_1519(): add sslcertck, sslcertpath, sslfingerprint fields to the
  fetchmail table


Most parts of this commit are based on the work of Lars Engelhard
(modified files sent on the mailinglist 2013-07-30)


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1519 a1433add-5e2c-0410-b055-b7f2511e0802
13 years ago