The improvements are:
- Die with an explicit message when a user is trying to reset his lost password and the option is disabled in config
- Redirect user to main page after password change using relative URL
- Don't leak info whether user exists or has recovery info defined
- Throttle password reset requests to prevent brute force attacks
- Show phone/alt email fields in mailbox/admin edit form only when the password reset option is enabled
- Make database upgrade code compatible with other databases types
- Use the existing password generator to generate OTP. It is now stored in database, unique to each user, valid only for 1 hour and can only by used once.
This replaces the hardcoded "LIMIT 10" with "LIMIT <page_size>".
Patch by Dan <dannyro @SF>, https://sourceforge.net/p/postfixadmin/patches/133/
Additional change on top of Dan's patch:
- wrap $CONF['page_size'] in intval() to avoid that a broken config
setting can break or exploit the query
* Make it possible by config option that non global admins can send
broadcast messages to their domains.
* Allow the sender to select the domains the broadcast message should be
delivered to
* Allow the sender to decide if the broadcast message should just be
delivered to mailboxes
Simplify hiding the software update check from display. Not really for security. More for aesthetics; and keeping the more basic users from questioning it. Add #update-check {display: none;} to your custom css. See related feature patch: https://sourceforge.net/p/postfixadmin/patches/134/
- 'itemkey' escaping again. I found another corner case that was broken
with |escape:"html". Therefore switch to the exact htmlentities() call
that we use in smarty.inc.php.
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1827 a1433add-5e2c-0410-b055-b7f2511e0802
- getting the key from $RAW_item.$id_field turned out to be broken in
corner cases, leading to empty output. The better (and simpler) fix is
to just let the foreach loop set 'itemkey'.
- the example for special handling of a specific table and field
contained a superfluous </tr>
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1826 a1433add-5e2c-0410-b055-b7f2511e0802
list-virtual and viewlog were the last users of select_options()
smarty.inc.php:
- drop (now unused) select_options()
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1822 a1433add-5e2c-0410-b055-b7f2511e0802
- base edit, editactive and delete links on $RAW_item to avoid double
escaping ($items is already html-escaped, and we url-escape it for
links). This fixes the remaining part of
http://sourceforge.net/p/postfixadmin/bugs/356/
- simplify displaying "html" fields by using $RAW_item. This also fixes
problems with funny[tm] item names that differ when html-encoded (like
the ' char)
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1812 a1433add-5e2c-0410-b055-b7f2511e0802
- display the "Go" button only if javascript is disabled (the dropdowns
have an onchange event defined, which makes the "Go" button superfluous)
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1780 a1433add-5e2c-0410-b055-b7f2511e0802
- improve headline:
- in search mode, display the search term instead of the last selected
domain (which isn't useful at all when displaying search results)
- display number of aliases and mailboxes only in domain mode (they
are useless/wrong in search mode)
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1779 a1433add-5e2c-0410-b055-b7f2511e0802
list-virtual.php:
- use list.tpl for aliases
- move show_gen_status handling for aliases to AliasHandler
AliasHandler:
- initStruct():
- add 'status' column (hidden by default)
- hide 'created'
- move 'active' after 'modified' to match old list-virtual.php layout
- initMsg: add list_header
- webformConfig(): if $CONF[show_status], set display_in_list for
'status' column. Also set a (whitespace) label to make sure it's
displayed
- db_read_from_db_postprocess(): if 'status' column is requested, call
gen_show_status() for each row
list-virtual.tpl
- remove alias table header and create alias button (which should have
been in list-virtual_alias.tpl)
list-virtual_alias.tpl:
- replace code to generate the alias table with {include 'list.tpl'}
(and some variable assignments)
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1777 a1433add-5e2c-0410-b055-b7f2511e0802
- add support for list_header (like ":: Alias" in list-virtual)
PFAHandler:
- add empty default for $msg['list_header']
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1776 a1433add-5e2c-0410-b055-b7f2511e0802
- assign(): additionally provide the unsanitized values as RAW_$key
PFAHandler.php:
- document 'html' field type (used for raw html), including a big warning
list.tpl:
- add handling to display raw html fields
This is a preparation to use the status markers with list.tpl without
introducing too big changes.
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1775 a1433add-5e2c-0410-b055-b7f2511e0802
- initStruct(): replace (wrong) 'editable' with '_can_edit' and '_can_delete'
- read_from_db_postprocess(): disable _can_edit and _can_delete for
default aliases if special_alias_control is off and not superadmin
list.tpl:
- use $item._can_edit instead of $check_alias_owner
list-virtual.php:
- drop $check_alias_owner variable and check_alias_owner() call
(replaced by the code added in AliasHandler)
- drop unused $sql_domain
functions.inc.php:
- delete no longer used check_alias_owner() function
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1774 a1433add-5e2c-0410-b055-b7f2511e0802
User-visible changes:
- alias domain list can be downloaded as CSV
- no more search highlighting for alias domains
list-virtual.php:
- expect $search to be an array
- change alias domain handling to use list.php instead of
list-virtual_alias_domain.tpl, and move some logic from the template
to list-virtual.php. (The template file is kept as list.tpl wrapper.)
- adopt mailbox and alias search to $search[_]
- adopt pagebrowser to $search[_]
list-virtual_alias_domain.tpl:
- replace custom output generation with {include 'list.php'} and some
variable assignments
PFAHandler.php:
- add $this->id_field to $this->msg (avoids another smarty template
variable)
configs/menu.conf:
- change input name to search[_]
list-virtual_alias.tpl, list-virtual_mailbox.tpl:
- adopt to $search[_] by setting $search in a backwards-compatible way
list.tpl:
- add special handling for aliasdomain.target_domain linking
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1773 a1433add-5e2c-0410-b055-b7f2511e0802
- add protected $searchfields = array(); - list of fields to search by
default, if just a search term is given. This will be done with
$search['_'], but that code is not implemented yet.
- add $this->msg['show_simple_search'] (true if $searchfields is non-empty)
list.tpl:
- display search input box and search overview only if $searchfields is
not empty
AliasdomainHandler:
- add 'alias_domain' and 'target_domain' to $searchfields
MailboxHandler:
- add 'username' to $searchfields
AliasHandler:
- add 'address' and 'goto' to $searchfields
This effectively means that the search input box is no longer displayed
in list.php for admin, domain and fetchmail listings.
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1770 a1433add-5e2c-0410-b055-b7f2511e0802
PFAHandler:
- add $msg['can_create'] (true by default)
DomainHandler:
- set $msg['can_create'] based on is_superadmin
list.tpl:
- display 'create' button only if $msg['can_create'] is true
Note: This is only an optical improvement, not a permission check.
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1769 a1433add-5e2c-0410-b055-b7f2511e0802
- add support for 'b64p' fields (passwords stored base64-encoded)
as preparation to migrate fetchmail.php to FetchmailHandler
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1750 a1433add-5e2c-0410-b055-b7f2511e0802
- initStruct():
- add optical quota indicators for aliases, mailboxes, domain quota
- some adjustments to get nice output with list.php (mostly following
list-domain.php)
- webformConfig(): switch listview to list.php
configs/menu.conf, templates/adminlistadmin.tpl:
- switch list-domain.php to list.php?table=domain
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1745 a1433add-5e2c-0410-b055-b7f2511e0802
- add search support:
- new parameters:
- search[$field] - value to search for
- searchmode[$field] - search mode (=, <, > etc.)
- reset_search - if given, empty $search and $searchmode
- remember $search and $searchmode via session
- display errormsg and infomsg from $handler, if any
list.tpl:
- display current search parameters and a "[x]" link to remove all
search parameters
This change doesn't add a search form, but you can use ?search[field]=
and ?searchmode[field]= URL parameters
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1732 a1433add-5e2c-0410-b055-b7f2511e0802
- use smarty-style dropdown for admin dropdown instead of select_options()
- only display admin dropdown if more than one admin is available
(which basically means hiding it for domain admins)
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1723 a1433add-5e2c-0410-b055-b7f2511e0802
(will replace list-admin, list-domain etc.)
list.php:
- generic list view, select *Handler with ?table=
list.tpl:
- display list view
- columns based on $struct (every column with display_in_list and
non-empty label will be displayed)
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1722 a1433add-5e2c-0410-b055-b7f2511e0802
- remove isset() - this re-introduces the risk to produce an "undefined"
notice if someone uses an outdated config.inc.php, but also avoids
<link ... href=""> (notice the empty href) if $CONF[theme_custom_css]
is set, but empty
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1634 a1433add-5e2c-0410-b055-b7f2511e0802
- change all field names to "value[$key]" instead of just "$key"
to keep the main "namespace" clean
edit.php:
- adjust POST handling code to changed form field names ("value[$key]")
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1629 a1433add-5e2c-0410-b055-b7f2511e0802
restrict reply type to a list of options ($CONF[vacation_choice_of_reply]),
remove input field for custom interval
config.inc.php:
- change $CONF['vacation_choice_of_reply'] to [seconds] => [$PALANG label]
(note: reply to every mail is commented by default because it can be
annoying. Admins will have to explicitely add/enable it in their config.)
- remove $CONF[vacation_replytype_default]
- update comment about dovecot:* for $CONF[encrypt]
*.lang:
- add texts for reply types
VacationHandler.php:
- remove reply_type at various places
- set_away(): remove reply_type from list of function parameters
templates/vacation.tpl:
- update reply type dropdown for the changed $CONF['vacation_choice_of_reply']
- remove the input fields for custom reply delay
vacation.php:
- restrict reply type to a list of options ($CONF[vacation_choice_of_reply])
- if vacation is disabled, but old values are stored in the database,
change the activeFrom and activeUntil date to today to avoid users
have to scroll through the calendar a lot
xmlrpc.php:
- update set_away() call to match the removed parameter
upgrade.php:
- comment out upgrade_1345_mysql() which created the reply_type and
interval_time fields in the vacation table in mysql
- add upgrade_1610() to add the vacation.interval_time field
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1610 a1433add-5e2c-0410-b055-b7f2511e0802
- rename pAdminCreate_admin_username_text to email_address
- rename pAdminEdit_admin_super_admin to super_admin
AdminHandler.php - initStruct():
- adopt to the renamed $PALANG texts
- remove some TODOs
- whitespace changes
setup.php, adminlistadmin.tpl:
- adopt to the renamed $PALANG texts
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1580 a1433add-5e2c-0410-b055-b7f2511e0802
for logout.
This means:
- change logout URL to login.php in menu.conf and users_main.tpl
- delete logout.php and users/logout.php
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1569 a1433add-5e2c-0410-b055-b7f2511e0802
- new, small script to change the 'active' status
- also include CSRF protection token
edit.php:
- remove handling of 'active' to make it more readable
*list*.tpl:
- change links to use editactive.php, add CSRF token
configs/menu.conf
- add url_editactive
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1566 a1433add-5e2c-0410-b055-b7f2511e0802
- require token for CSRF protection, see
https://sourceforge.net/p/postfixadmin/bugs/269/
login.php, users/login.php:
- create token and store it in $_SESSION
templates/*:
- add token to all delete.php links
templates/list-virtual_alias_domain.tpl:
- change delete confirmation dialog to contain "from->target"
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1564 a1433add-5e2c-0410-b055-b7f2511e0802
- use *Handler for deletion
(which also means delete.php only has 17 lines of code now - 130 lines
less than before :-)
templates/list-virtual_*.tpl:
- remove now superfluous "domain" parameter in delete.php link
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1563 a1433add-5e2c-0410-b055-b7f2511e0802
- move header() calls from index.tpl to smarty.inc.php, which means
we no longer need to use SmartyBC class
- use Smarty instead of SmartyBC class
- eval_size(): use Config::Lang instead of $PALANG
templates/header.tpl:
- move header() calls to smarty.inc.php, and drop {php} usage
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1544 a1433add-5e2c-0410-b055-b7f2511e0802
- move "unmaintained" warning to templates/backupwarning.tpl (that's
the easiest way to have working HTML tags)
- remove <p> tag from pgsql error message
templates/backupwarning.tpl
- new file, contains the "unmaintained" warning for backup.php
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1542 a1433add-5e2c-0410-b055-b7f2511e0802
ADDITIONS/fetchmail.pl
- add sslcertck, sslcertpath and sslfingerprint to fetchmail config
- some whitespace fixes
fetchmail.php
- add sslcertck, sslcertpath, sslfingerprint fields
(sslcertpath and sslfingerprint require $CONF[fetchmail_extra_options]
because they don't have input validation)
languages/*.lang
- add new texts needed for the added fields
templates/fetchmail.tpl:
- add the new fields
- also add extra_options and mda fields - they were not displayed yet
upgrade.php
- fix _db_add_field() to call _db_field_exists() with correct table name
- upgrade_1519(): add sslcertck, sslcertpath, sslfingerprint fields to the
fetchmail table
Most parts of this commit are based on the work of Lars Engelhard
(modified files sent on the mailinglist 2013-07-30)
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1519 a1433add-5e2c-0410-b055-b7f2511e0802
- use PALANG['last_modified'] everywhere
- get rid of various duplicate texts for "Last modified":
-$PALANG['pOverview_alias_modified']
-$PALANG['pOverview_alias_domain_modified']
-$PALANG['pOverview_mailbox_modified']
-$PALANG['pOverview_get_modified']
-$PALANG['pAdminList_admin_modified']
-$PALANG['pAdminList_virtual_alias_modified']
-$PALANG['pAdminList_virtual_mailbox_modified']
- add a translator note to some *.lang if the texts were not exact duplicates
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1501 a1433add-5e2c-0410-b055-b7f2511e0802
- replace $PALANG.pUsersLogin_username with $PALANG.pLogin_username
languages/*.lang:
- remove obsolete pUsersLogin_username
- add translator notes in some languages
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1496 a1433add-5e2c-0410-b055-b7f2511e0802
configs/menu.conf:
- change url_create_mailbox to edit.php?table=mailbox
templates/list-virtual.tpl:
- replace hardcoded create-mailbox.php with {#url_create_mailbox#}
functions.inc.php:
- delete functions that are now part of MailboxHandler:
- check_mailbox()
- multiply_quota()
- add some TODO notes
config.inc.php:
- rewrite a comment that referenced create-mailbox.php
create-mailbox.php:
- delete - no longer needed
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1433 a1433add-5e2c-0410-b055-b7f2511e0802
- use edit.php to enable/disable aliases (instead of edit-active.php)
- merge/simplify conditions for "editable"/check_alias_owner
- use {#url_create_alias#} instead of hardcoded edit.php
- some whitespace changes
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1380 a1433add-5e2c-0410-b055-b7f2511e0802
AliasHandler.php:
- remove obsolete functions update(), is_mailbox_alias(),
is_vacation_address(), hasAliasRecord()
- updated delete() to use new *Handler syntax (most of it should be
moved to PFAHandler, but that's another story ;-)
users/edit-alias.php:
- replace $ah->update with $ah->set / $ah->store
- use 0/1 for $fForward_and_store instead of YES/NO
- use safepost instead of isset()
templates/users_edit-alias.tpl:
- use 0/1 for $fForward_and_store instead of YES/NO
xmlrpc.php:
- replace $ah->update with new *Handler syntax
Note: the changes in xmlrpc.php are untested again ;-)
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1358 a1433add-5e2c-0410-b055-b7f2511e0802
- use AliasHandler instead of direct SQL queries
templates/list-virtual_alias.tpl:
- goto is an array now, not a comma-separated string
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1354 a1433add-5e2c-0410-b055-b7f2511e0802
