Commit Graph

302 Commits (77b87107f9e1cb352169ac3b3c2056fac2d6eaa6)

Author SHA1 Message Date
David Goodwin 74002bbf57 psalm fixes 6 years ago
David Goodwin 173d5775cd psalm fixes 6 years ago
David Goodwin 69e234f668
Merge pull request #200 from doktoil-makresh/master
Support for password expiration, managed in PostFix Admin
6 years ago
David Goodwin afd418675c pointless comment 6 years ago
David Goodwin 77d1b6c2e7 rename sql fields to just have mailbox.password_expiry and domain.password_expiry 6 years ago
Damien Martins ce60b9fa59 Now password expiration is managed through Postfix Admin GUI 6 years ago
Damien Martins e786609aa9 Adding support for password expiration. Please read README.password_expiration for more details 6 years ago
David Goodwin 76ee147375 phpdoc fix 7 years ago
David Goodwin ec085b668b missing class property 7 years ago
David Goodwin 9c0e1dd575 phpdoc fixes 7 years ago
David Goodwin c44e82cc2d phpdoc fix 7 years ago
David Goodwin b48f99d4c6 reformat (phpcs) 7 years ago
David Goodwin 94f05bf9e4 switch to store $config internally within an array 7 years ago
Christian Boltz 24ad5cc3d8
Set $reset_by_sms even if password reset is disabled
... to avoid an "undefined variable" warning
7 years ago
Christian Boltz 3f1866d041
display phone number field only if $CONF[sms_send_function] is set
Without a way to send a SMS, asking users for their mobile number is
pointless.
7 years ago
Christian Boltz cdf3c9acb9
initStruct(): use multiopt for 'id' 'dont_write_to_db'
This also means we can drop the 0 for not_in_db because this is the
default.
7 years ago
Christian Boltz d2588a4de2
Fix phpcs whitespace breakage in initStruct etc. 7 years ago
Christian Boltz 12c4a4f29e
move shells/shell.php to model/Shell.php
... and drop a few lines in postfixadmin-cli.php that became superfluous
by this move (thanks autoloader!)
7 years ago
Christian Boltz 500c847fe0
re-add lost comment 7 years ago
Christian Boltz 91c07c9eae
VacationHandler: re-enable and fix code in validate_new_id()
Note that vacation.php doesn't use this function yet, so it's not
surprising that users didn't notice the broken code.
7 years ago
David Goodwin 4fb4d406ee phpdoc; disable function init() - seems invalid 7 years ago
David Goodwin fef2591335 phpdoc fixes 7 years ago
David Goodwin cb34da4f46 phpcs reformat 7 years ago
David Goodwin 152975d05c move to use db_assoc() rather than db_array() (code assumes assoc. array) 7 years ago
David Goodwin 5e1855632a allow local aliases - see #134 7 years ago
Adrien Crivelli 15df6c1d7b
Reformat everything with PHP-Cs-Fixer 7 years ago
Christian Boltz 8fb67e6fbf
Fix broken table names caused by doubled table_by_key() calls
The high-level db_*() functions (like db_update(), and also
_db_add_field() in upgrade.php) call table_by_key() internally, which
also means the unwrangled table name needs to be handed over to them.
If handing over an already table_by_key()'d table name, it gets modified
again and results in something like prefix_prefix_mailbox.
7 years ago
houmingtao 5f1ac12d72 use current time as default token_validity value 7 years ago
root 4670182d79 fix invalid value for token_validity 7 years ago
Sylvain Tissot ffb84283c2
Harden password reset process
The improvements are:

- Die with an explicit message when a user is trying to reset his lost password and the option is disabled in config
- Redirect user to main page after password change using relative URL
- Don't leak info whether user exists or has recovery info defined
- Throttle password reset requests to prevent brute force attacks
- Show phone/alt email fields in mailbox/admin edit form only when the password reset option is enabled
- Make database upgrade code compatible with other databases types
- Use the existing password generator to generate OTP. It is now stored in database, unique to each user, valid only for 1 hour and can only by used once.
7 years ago
Sylvain Tissot 9c9ba64a7f Allows a user or admin to reset his/her forgotten password with a code sent by email/SMS #18 7 years ago
Christian Boltz a366654757
Better use Config::Lang instead of global $PALANG 8 years ago
David Goodwin 8508b8e119 global PALANG 8 years ago
Christian Boltz 80d381f644 Make VacationHandler compatible with MySQL strict mode again
The MySQL database layout includes a 'cache' column for historical
reasons, the PostgreSQL database never did.

r1883 removed the 'cache' column from VacationHandler to unbreak
PostgreSQL, and at the same time broke MySQL in strict mode.

This patch re-adds the 'cache' column only for MySQL to fix this
regression.



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1890 a1433add-5e2c-0410-b055-b7f2511e0802
8 years ago
Jan-Frederik Rieckers 800f07816a
Fix wrong way of check for can_delete 8 years ago
Jan-Frederik Rieckers 7bb36d0bbc
Fix security hole in AliasHandler
Without this fix it is possible to delete a protected alias via editing
the request parameter of the alias to delete.
8 years ago
David Goodwin 2f2db5949a fix date formatting in non-english languages, thanks to uz@musoftware.de
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1884 a1433add-5e2c-0410-b055-b7f2511e0802
8 years ago
David Goodwin bd8e0e3ae3 apparently dead columns - thanks to uz@musoftware.de
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1883 a1433add-5e2c-0410-b055-b7f2511e0802
8 years ago
Christian Boltz 9ba7118d7b AliasHandler: restrict mailbox subquery to requested domains
set_is_mailbox_extrafrom() restricts the domain list to the domain that
needs to be checked (in normal list-virtual listing one domain), and is
then used to restore the default extrafrom.
This improves the performance for most usecases even for superadmins.

Note: Search mode might still be slow because by default it searches in
all domains available to the admin.


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1882 a1433add-5e2c-0410-b055-b7f2511e0802
8 years ago
Christian Boltz 40b4fdf61c beautify alias list search parameters
AliasHandler:
- initStruct(): handle __mailbox_username as separate field (needed to
  make it searchable)
- split off a condition_ignore_mailboxes() function (used in getList()
  and getPagebrowser()) to add '__mailbox_username IS NULL' to the search
  condition array. Also, make sure $condition can be an array (preferred)
  or a string with a raw query

list-virtual.php:
- hand over a search array instead of a raw query


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1879 a1433add-5e2c-0410-b055-b7f2511e0802
8 years ago
Christian Boltz bd28fcb194 AliasHandler: restrict __is_mailbox subquery to allowed domains
This improves performance on setups with lots of mailboxes.
Well, except for superadmins because restricting to "all domains"
doesn't really help ;-)

Thanks to gygy for reporting this on IRC, and for testing the patch.



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1877 a1433add-5e2c-0410-b055-b7f2511e0802
8 years ago
Christian Boltz c909d4a71e FetchmailHandler: use a valid date as default for 'date'
This fixes an invalid query when using mysql strict mode.

Reported by Martin Kenney, https://sourceforge.net/p/postfixadmin/bugs/380/


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1873 a1433add-5e2c-0410-b055-b7f2511e0802
8 years ago
Christian Boltz 386f37dfdb Don't decode b64p (base64-encoded password) fields.
This is not supported in MySQL < 5.6.
Besides that, we don't display the content of b64p fields anywhere, so
the easiest way is not to decode it.

Note: Currently, the only user of b64p is FetchmailHandler.

Fixes https://sourceforge.net/p/postfixadmin/bugs/357/


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1847 a1433add-5e2c-0410-b055-b7f2511e0802
9 years ago
Christian Boltz 1d76c5af88 VacationHandler: Fill 'cache' field on INSERT
The 'cache' field is a leftover from PostfixAdmin 2.2 and unused (except
if someone still uses an ancient vacation.pl). However, MySQL in strict
mode errors out if isn't included in INSERTs because it doesn't have a
default value.

Fixes https://sourceforge.net/p/postfixadmin/bugs/345/


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1845 a1433add-5e2c-0410-b055-b7f2511e0802
9 years ago
Christian Boltz b261db86c7 Merge pull request #9 from phyrog/master
Add sqlite backend option (thank you @phyrog for doing this)

(imported from github)


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1824 a1433add-5e2c-0410-b055-b7f2511e0802
9 years ago
Christian Boltz c837eac20a DomainHandler:
- initStruct(): in 'aliases_quot' and '_aliases_quot_percent', use
  coalesce(__mailbox_count,0) - without, we always get _0_ aliases if
  a domain doesn't have mailboxes


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1783 a1433add-5e2c-0410-b055-b7f2511e0802
10 years ago
Christian Boltz 23bdd02dcb broadcast-message.php, sendmail.php, MailboxHandler, *.lang:
- include mailbox name in pSendmail_result_error and
  pSendmail_result_success



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1781 a1433add-5e2c-0410-b055-b7f2511e0802
10 years ago
Christian Boltz 37bba15625 Use list.tpl to display the alias list
list-virtual.php:
- use list.tpl for aliases
- move show_gen_status handling for aliases to AliasHandler

AliasHandler:
- initStruct():
  - add 'status' column (hidden by default)
  - hide 'created'
  - move 'active' after 'modified' to match old list-virtual.php layout
- initMsg: add list_header
- webformConfig(): if $CONF[show_status], set display_in_list for
  'status' column. Also set a (whitespace) label to make sure it's
  displayed
- db_read_from_db_postprocess(): if 'status' column is requested, call
  gen_show_status() for each row

list-virtual.tpl
- remove alias table header and create alias button (which should have
  been in list-virtual_alias.tpl)

list-virtual_alias.tpl:
- replace code to generate the alias table with {include 'list.tpl'}
  (and some variable assignments)


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1777 a1433add-5e2c-0410-b055-b7f2511e0802
10 years ago
Christian Boltz adc038e218 list.tpl:
- add support for list_header (like ":: Alias" in list-virtual)

PFAHandler:
- add empty default for $msg['list_header']


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1776 a1433add-5e2c-0410-b055-b7f2511e0802
10 years ago
Christian Boltz 35fad174f7 smarty.inc.php:
- assign(): additionally provide the unsanitized values as RAW_$key

PFAHandler.php:
- document 'html' field type (used for raw html), including a big warning

list.tpl:
- add handling to display raw html fields

This is a preparation to use the status markers with list.tpl without
introducing too big changes.


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1775 a1433add-5e2c-0410-b055-b7f2511e0802
10 years ago