From 640c567210938f987441c7b3cabb56dc93c3ff60 Mon Sep 17 00:00:00 2001 From: Rong Zhou Date: Sun, 16 Aug 2026 18:17:08 +0200 Subject: [PATCH] Admin panel: accept trusted proxy-auth header (X-NC-Admin) on the admin host Allows gating the SnappyMail admin panel behind an external single sign-on layer (e.g. a reverse-proxy auth_request validated against an OpenID Connect / Nextcloud session) without embedding an OIDC client in SnappyMail. The header is honored only when present AND the request Host matches admin_panel.host (defense in depth), so it has no effect on regular webmail or on the panel when admin_panel.host is unset. Behavior is unchanged when the header is absent: the existing admin_login/admin_password (+ optional admin_totp) check applies. Contributed from Ron-RONZZ-org/ronzz-nextcloud (webmail/patches/). --- .../v/0.0.0/app/libraries/RainLoop/Actions/Admin.php | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Admin.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Admin.php index 970703a77..c2f4db681 100644 --- a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Admin.php +++ b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Admin.php @@ -14,6 +14,15 @@ trait Admin public function IsAdminLoggined(bool $bThrowExceptionOnFalse = true) : bool { if ($this->Config()->Get('security', 'allow_admin_panel', true)) { + // [PATCH ronzz.org] OIDC bridge: nginx auth_request (webmail-admin.ronzz.org) + // sets X-NC-Admin after validating the Nextcloud session. Honored only on the + // dedicated admin host (admin_panel.host); the header is stripped/overridden + // at nginx for any other path. + if (!empty($_SERVER['HTTP_X_NC_ADMIN']) + && \strtolower((string) $this->Config()->Get('admin_panel', 'host', '')) === \strtolower($this->Http()->GetHost())) + { + return true; + } $sAdminKey = $this->getAdminAuthKey(); if ($sAdminKey && $this->Cacher(null, true)->Get(KeyPathHelper::SessionAdminKey($sAdminKey))) { return true;