Commit Graph

8 Commits (b434f7070a5ef7022393209c159320fe8694ebcc)

Author SHA1 Message Date
Christian Boltz 52a7df2b3a Add CSRF protection for POST requests
Add the CSRF token to all forms, and validate it when those forms are
submitted.

https://sourceforge.net/p/postfixadmin/bugs/372/



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1842 a1433add-5e2c-0410-b055-b7f2511e0802
8 years ago
Christian Boltz 4d0ebd7e1b vacation.php:
- check that $tActiveUntil >= today and $tActiveUntil >= $tActiveFrom
- update header comments
- display "vacation is active" notice also to admins
(based on a patch by J.Kruis @SF,
https://sourceforge.net/p/postfixadmin/patches/122/ )

*.lang:
- add 
  - pVacation_until_before_today
  - pVacation_until_before_from
  - reply_once_per_day
- change pUsersVacation_welcome_text to 'Auto response for %s is active!'
- remove "obsolete" marker from pUsersVacation_activefrom and
  pUsersVacation_activeuntil, they are still used

nl.lang:
- translation update by J.Kruis @SF
  https://sourceforge.net/p/postfixadmin/patches/122/



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1697 a1433add-5e2c-0410-b055-b7f2511e0802
10 years ago
Christian Boltz 8c139c95d6 vacation:
restrict reply type to a list of options ($CONF[vacation_choice_of_reply]),
remove input field for custom interval


config.inc.php:
- change $CONF['vacation_choice_of_reply'] to [seconds] => [$PALANG label]
  (note: reply to every mail is commented by default because it can be
  annoying. Admins will have to explicitely add/enable it in their config.)
- remove $CONF[vacation_replytype_default]
- update comment about dovecot:* for $CONF[encrypt]

*.lang:
- add texts for reply types

VacationHandler.php:
- remove reply_type at various places
- set_away(): remove reply_type from list of function parameters

templates/vacation.tpl:
- update reply type dropdown for the changed $CONF['vacation_choice_of_reply']
- remove the input fields for custom reply delay

vacation.php:
- restrict reply type to a list of options ($CONF[vacation_choice_of_reply])
- if vacation is disabled, but old values are stored in the database,
  change the activeFrom and activeUntil date to today to avoid users
  have to scroll through the calendar a lot

xmlrpc.php:
- update set_away() call to match the removed parameter

upgrade.php:
- comment out upgrade_1345_mysql() which created the reply_type and 
  interval_time fields in the vacation table in mysql
- add upgrade_1610() to add the vacation.interval_time field


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1610 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
Christian Boltz 6e2e132bac remove "postfixadmin.com" in comments in lots of files
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1558 a1433add-5e2c-0410-b055-b7f2511e0802
11 years ago
David Goodwin 87f33d95ae patch from Jan Kruis - see http://sourceforge.net/tracker/?func=detail&aid=3520749&group_id=191583&atid=937966 (Tracker id 3520749) ; thank you!
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1374 a1433add-5e2c-0410-b055-b7f2511e0802
13 years ago
David Goodwin ef80736445 Merge jan-kruis's vacation interval reply behaviour - see SF patch 3508083 - https://sourceforge.net/tracker/?func=detail&aid=3508083&group_id=191583&atid=937966 ; Thank you
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1373 a1433add-5e2c-0410-b055-b7f2511e0802
13 years ago
Christian Boltz 1033c950fa vacation.php:
- split off $fDomain from ?username= (admin mode)
- basic sanity check for ?username= (admin mode)
- urlencode $fDomain for $Return_url (admin mode)
- don't split off domain from username in users mode (not needed)
- added various TODO notes
- some whitespace fixes near the end of the file (2*3 lines)

list-virtual_mailbox.tpl
- don't include domain in link to vacation.php (no longer needed)


git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1172 a1433add-5e2c-0410-b055-b7f2511e0802
13 years ago
Christian Boltz 9bee8d89c1 Merge users/vacation.php and edit-vacation.php into vacation.php
vacation.php
- result of merging edit-vacation.php and users/vacation.php
- vacation.php comes with the svn history of edit-vacation.php
- display "vacation already active" (only) in user mode if vacation is active
  (would be useful in admin mode too, but needs a text change)
- various comment updates
- add username in $PALANG[pVacation_result_removed] and
  $PALANG[pVacation_result_added] using sprintf
- change compared to Jan Kruis' patch:
  - set return url for users to main.php instead of users/main.php
  - set return url for admins after setting $fDomain. Otherwise the return url
    does not contain the domain.
  - removed unused variable $tDomain

users/vacation.php:
- require(../vacation.php)
- remove everything else
- whitespace changes in the license header
- note: this is completely different from Jan Kruis' patch - his intention was
  to remove this file and use ../vacation.php. However, with his way all links
  in the users menu would point to the wrong place/directory

edit-vacation.php:
- deleted

templates/vacation.tpl
- display username only in admin mode

templates/list-virtual_mailbox.tpl
- link changed to merged vacation.php

languages/en.lang
- add username in $PALANG[pVacation_result_removed] and
  $PALANG[pVacation_result_added] as sprintf variable
- (comments added by Jan Kruis' patch are not part of this commit)

languages/nl.lang
- translation updates
- already contains the sprintf variable in $PALANG[pVacation_result_removed]
  and $PALANG[pVacation_result_added]

(updates for other *.lang files follow in another commit)

The following parts of Jan Kruis' patch are not part of this commit:
- rejected:
  - variables.inc.php: don't add $Admin_role and $Return_url
    If we initialize them, it should be done directly in (edit-)vacation.php,
    but the current code always sets them already in all cases.
  - templates/users_main.tpl: do not change url for vacation.php
- postponed:
  - added comments in en.lang about obsolete texts


Most parts of this commit (see exceptions above) were provided as patch 
by Jan Kruis (jan-kruis@SF), see
https://sourceforge.net/tracker/?func=detail&aid=3383236&group_id=191583&atid=937966



git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1169 a1433add-5e2c-0410-b055-b7f2511e0802
13 years ago