Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-08-25 10:09:20 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Admin panel: accept trusted proxy-auth header (X-NC-Admin) on the admin host

Browse source 
Allows gating the SnappyMail admin panel behind an external single sign-on
layer (e.g. a reverse-proxy auth_request validated against an OpenID Connect /
Nextcloud session) without embedding an OIDC client in SnappyMail. The header
is honored only when present AND the request Host matches admin_panel.host
(defense in depth), so it has no effect on regular webmail or on the panel
when admin_panel.host is unset.

Behavior is unchanged when the header is absent: the existing
admin_login/admin_password (+ optional admin_totp) check applies.

Contributed from Ron-RONZZ-org/ronzz-nextcloud (webmail/patches/).
This commit is contained in:
Rong Zhou 2026-08-16 18:17:08 +02:00
parent c154d23cfe
commit 640c567210
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Admin.php
View file

@ -14,6 +14,15 @@ trait Admin
public function IsAdminLoggined(bool $bThrowExceptionOnFalse = true) : bool
{
if ($this->Config()->Get('security', 'allow_admin_panel', true)) {
// [PATCH ronzz.org] OIDC bridge: nginx auth_request (webmail-admin.ronzz.org)
// sets X-NC-Admin after validating the Nextcloud session. Honored only on the
// dedicated admin host (admin_panel.host); the header is stripped/overridden
// at nginx for any other path.
if (!empty($_SERVER['HTTP_X_NC_ADMIN'])
&& \strtolower((string) $this->Config()->Get('admin_panel', 'host', '')) === \strtolower($this->Http()->GetHost()))
{
return true;
}
$sAdminKey = $this->getAdminAuthKey();
if ($sAdminKey && $this->Cacher(null, true)->Get(KeyPathHelper::SessionAdminKey($sAdminKey))) {
return true;