Commit Graph

17 Commits (6eda18fcded6dc1e5c74bac3d59a6204474f434e)

Author SHA1 Message Date
Christian Boltz 52a7df2b3a Add CSRF protection for POST requests
Add the CSRF token to all forms, and validate it when those forms are
submitted.

https://sourceforge.net/p/postfixadmin/bugs/372/



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1842 a1433add-5e2c-0410-b055-b7f2511e0802
8 years ago
Christian Boltz 23bdd02dcb broadcast-message.php, sendmail.php, MailboxHandler, *.lang:
- include mailbox name in pSendmail_result_error and
  pSendmail_result_success



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1781 a1433add-5e2c-0410-b055-b7f2511e0802
10 years ago
Christian Boltz 6e2e132bac remove "postfixadmin.com" in comments in lots of files
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1558 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 871bcbbe2f functions.inc.php:
- check_domain(), check_email(): instead of calling flash_error(),
  return string with error message - or empty string if everything is ok

model/AdminHandler.php, model/AliasHandler.php,
model/DomainHandler.php, model/MailboxHandler.php,
sendmail.php, users/edit-alias.php:
- adopt to changed check_domain() and check_email() return value


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1451 a1433add-5e2c-0410-b055-b7f2511e0802
12 years ago
Christian Boltz f0a153f0fc sendmail.php, broadcast-message.php:
- use smtp_get_admin_email() to determinate the mail sender
- rename $SESSID_USERNAME to $smtp_from_email
- replaced tMessage with flash_error() / flash_info()

sendmail.php:
- changes compared to Dale's patch:
  - use flash_info() for $PALANG['pSendmail_result_success']

broadcast-message.php:
- use flash_error() for $PALANG['pBroadcast_error_empty'] instead of
  hardcoding it in the template


sendmail.tpl,templates/broadcast-message.tpl:
- replace <h3> with <th>
- replaced $SESSID_USERNAME / $CONF[admin_email] with $smtp_from_email
- mark labels with <label>
- mark non-editable fields with <em>
- align buttons with input fields
- remove tMessage

sendmail.tpl:
- changes compared to Dale's patch:
  - fixed colspan for buttons cell

templates/broadcast-message.tpl:
- remove hardcoded error message (see broadcast-message.php change above)
- changes compared to Dale's patch:
  - fixed colspan for <th>

This commit is part of the huge cleanup patch by Dale Blount (lnxus@SF),
https://sourceforge.net/tracker/?func=detail&atid=937966&aid=3370510&group_id=191583


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1094 a1433add-5e2c-0410-b055-b7f2511e0802
13 years ago
Christian Boltz b37811d153 sendmail.php:
- hand over subject and body as separate parameters to smtp_mail()
  instead of cooking the mail headers manually


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1051 a1433add-5e2c-0410-b055-b7f2511e0802
14 years ago
Christian Boltz d66262f00e Remove usage of $CONF['postfix_admin_url'] in various Location: headers
to avoid problems with wrong values of $CONF['postfix_admin_url'].

https://sourceforge.net/tracker/?func=detail&atid=937964&aid=3039042&group_id=191583
contains the technical details and reasons.

Note: $CONF['postfix_admin_url'] is still used at some places that are
a bit harder to change.


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1021 a1433add-5e2c-0410-b055-b7f2511e0802
14 years ago
Sebastian 9ddf15439f - fix some display errors after rev. 788, found and patch supplied by Jan-Kruis, thx.
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@791 a1433add-5e2c-0410-b055-b7f2511e0802
15 years ago
Sebastian b1287d97e2 - big merge of Postfixadmin smarty into trunk
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@757 a1433add-5e2c-0410-b055-b7f2511e0802
15 years ago
Christian Boltz 723cde0905 sendmail.php:
- encode Subject with mb_encode_mimeheader
  https://sourceforge.net/tracker2/?func=detail&atid=937964&aid=2682897&group_id=191583


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@573 a1433add-5e2c-0410-b055-b7f2511e0802
16 years ago
Christian Boltz afbe36d572 sendmail.php:
- do not escape_string() the mailbody - having \n in mails instead of 
  real newlines is not nice. This fixes 
  https://sourceforge.net/tracker/?func=detail&atid=937964&aid=2005839&group_id=191583
  Thanks to Tabmow for the report!
- added missing newline between headers and message body


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@396 a1433add-5e2c-0410-b055-b7f2511e0802
16 years ago
David Goodwin 39953d029d rename templates to .php instead of .tpl
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@250 a1433add-5e2c-0410-b055-b7f2511e0802
17 years ago
Christian Boltz a00d456084 functions.inc.php
- encode_header(): made charset parameter optional, defaults to utf-8
- db_delete(): escape_string() $where and $delete

create-mailbox.php:
- always encode mail header and insert Content-Type etc. headers
  (previous code never did this, $PALANG['charset'] is not set in any
  language. so this code part was never used)

sendmail.php:
- always encode mail header and insert Content-Type etc. headers
  (had the same bug as create-mailbox.php)
- merge GET and POST

These changes fix
http://sourceforge.net/tracker/index.php?func=detail&aid=1811214&group_id=191583&atid=937964



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@199 a1433add-5e2c-0410-b055-b7f2511e0802
17 years ago
David Goodwin dc51d62e15 update license headers
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@107 a1433add-5e2c-0410-b055-b7f2511e0802
17 years ago
David Goodwin cc0e532ecc sendmail.php: s/succes/success/
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@87 a1433add-5e2c-0410-b055-b7f2511e0802
17 years ago
David Goodwin 3e70f276c2 final set of refactoring patches (and the rest)
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@71 a1433add-5e2c-0410-b055-b7f2511e0802
17 years ago
Mischa Peters 85dc57beee Initial Import in SourceForge
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1 a1433add-5e2c-0410-b055-b7f2511e0802
18 years ago