From ab5a6d5894cd00247c395f79b0ba915d78234ba9 Mon Sep 17 00:00:00 2001 From: Michael Krieger Date: Thu, 5 Mar 2020 17:41:45 -0500 Subject: [PATCH 1/6] Add configuration parameter defaulting to 'NO' Adds optional parameter to limit the alias destinations to local domains. An additional check makes sure that the domain is in the list of postfix domain names. --- config.inc.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/config.inc.php b/config.inc.php index 376bfbe3..f1a0df15 100644 --- a/config.inc.php +++ b/config.inc.php @@ -505,6 +505,10 @@ EOM; // address is legal by performing a name server look-up. $CONF['emailcheck_resolve_domain']='YES'; +// When creating mailboxes or aliases, check that the domain-part of the +// address is local and managed by postfixadmin, preventing remote domains +// from being the destination for an alias +$CONF['emailcheck_localonly_domain']='NO'; // Optional: // Analyze alias gotos and display a colored block in the first column From 02e238cf30d4e3c9745ae103e8e583f1065978e1 Mon Sep 17 00:00:00 2001 From: Michael Krieger Date: Thu, 5 Mar 2020 17:47:04 -0500 Subject: [PATCH 2/6] Add a local-only domain check --- model/AliasHandler.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/model/AliasHandler.php b/model/AliasHandler.php index 1fdf2206..6d8684a8 100644 --- a/model/AliasHandler.php +++ b/model/AliasHandler.php @@ -391,12 +391,20 @@ class AliasHandler extends PFAHandler { if ($domain_check != '') { $errors[] = "$singlegoto: $domain_check"; } + $localonlydomain_check = check_localonlydomain($domain); + if ($localonlydomain_check != '') { + $errors[] = "$singlegoto: $localonlydomain_check"; + } } else { $email_check = check_email($singlegoto); // preg_match -> allows for redirect to a local system account. if ($email_check != '' && !preg_match('/^[a-z0-9]+$/', $singlegoto)) { $errors[] = "$singlegoto: $email_check"; } + $localonlydomain_check = check_localonlydomain($domain); + if ($localonlydomain_check != '') { + $errors[] = "$singlegoto: $localonlydomain_check"; + } } } From 41d03fa15850dbadd4d499cc440a2dd2fee23a72 Mon Sep 17 00:00:00 2001 From: Michael Krieger Date: Thu, 5 Mar 2020 18:02:43 -0500 Subject: [PATCH 3/6] Update functions.inc.php --- functions.inc.php | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/functions.inc.php b/functions.inc.php index 70c6c49e..b2157ca1 100644 --- a/functions.inc.php +++ b/functions.inc.php @@ -260,6 +260,33 @@ function check_domain($domain) { return ''; } +/** + * Checks if a domain is local + * @param string $domain + * @return string empty if the domain is valid, otherwise string with the errormessage + */ +function check_localaliasonly($domain) { + // If emailcheck_localonly_domain is set to 'YES', disallow aliases to remote servers (but allow aliases on this server) + if (Config::bool('emailcheck_localaliasonly')) { + // get the domain part of the e-mail + list(/*NULL*/, $domain) = explode('@', $domain); + + // get all domains managed on this system by postfixadmin + $domains = list_domains(); + + // Only allow local domains to be alias destinations + if (in_array($domain, $domains)) { + return ''; + } else { + // FIXME: Add transaltions + return sprintf("You may only make aliases to domains hosted on this server. %s is a remote domain name.", htmlentities($domain)); + } + } else { + return ''; + } + +} + /** * Get password expiration value for a domain * @param string $domain - a string that may be a domain From e3847a8d26a928dc618f942a2ee0fe0158c6f551 Mon Sep 17 00:00:00 2001 From: Michael Krieger Date: Thu, 5 Mar 2020 18:03:34 -0500 Subject: [PATCH 4/6] Rename to emailcheck_localaliasonly --- config.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config.inc.php b/config.inc.php index f1a0df15..6f72fd21 100644 --- a/config.inc.php +++ b/config.inc.php @@ -508,7 +508,7 @@ $CONF['emailcheck_resolve_domain']='YES'; // When creating mailboxes or aliases, check that the domain-part of the // address is local and managed by postfixadmin, preventing remote domains // from being the destination for an alias -$CONF['emailcheck_localonly_domain']='NO'; +$CONF['emailcheck_localaliasonly']='NO'; // Optional: // Analyze alias gotos and display a colored block in the first column From 101490111ad697935a2cfb5cca3858a9978e42e2 Mon Sep 17 00:00:00 2001 From: Michael Krieger Date: Thu, 5 Mar 2020 18:06:13 -0500 Subject: [PATCH 5/6] Update AliasHandler.php --- model/AliasHandler.php | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/model/AliasHandler.php b/model/AliasHandler.php index 6d8684a8..7ca2f4fa 100644 --- a/model/AliasHandler.php +++ b/model/AliasHandler.php @@ -391,9 +391,9 @@ class AliasHandler extends PFAHandler { if ($domain_check != '') { $errors[] = "$singlegoto: $domain_check"; } - $localonlydomain_check = check_localonlydomain($domain); - if ($localonlydomain_check != '') { - $errors[] = "$singlegoto: $localonlydomain_check"; + $localaliasonly_check = check_localaliasonly($domain); + if ($localaliasonly_check != '') { + $errors[] = "$singlegoto: $localaliasonly_check"; } } else { $email_check = check_email($singlegoto); @@ -401,9 +401,9 @@ class AliasHandler extends PFAHandler { if ($email_check != '' && !preg_match('/^[a-z0-9]+$/', $singlegoto)) { $errors[] = "$singlegoto: $email_check"; } - $localonlydomain_check = check_localonlydomain($domain); - if ($localonlydomain_check != '') { - $errors[] = "$singlegoto: $localonlydomain_check"; + $localaliasonly_check = check_localaliasonly($singlegoto); + if ($localaliasonly_check != '') { + $errors[] = "$singlegoto: $localaliasonly_check"; } } } From 978a5cf4c286eb3d806e1730b682afb68dbb7a9c Mon Sep 17 00:00:00 2001 From: Michael Krieger Date: Thu, 5 Mar 2020 18:07:34 -0500 Subject: [PATCH 6/6] Update functions.inc.php --- functions.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/functions.inc.php b/functions.inc.php index b2157ca1..e2f2f18e 100644 --- a/functions.inc.php +++ b/functions.inc.php @@ -266,7 +266,7 @@ function check_domain($domain) { * @return string empty if the domain is valid, otherwise string with the errormessage */ function check_localaliasonly($domain) { - // If emailcheck_localonly_domain is set to 'YES', disallow aliases to remote servers (but allow aliases on this server) + // If emailcheck_localaliasonly is set to 'YES', disallow aliases to remote servers (but allow aliases on this server) if (Config::bool('emailcheck_localaliasonly')) { // get the domain part of the e-mail list(/*NULL*/, $domain) = explode('@', $domain);