Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-07-13 03:27:39 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Reduce AppData result for unauthorized visitor

Browse source
This commit is contained in:
the-djmaze 2022-10-04 10:04:41 +02:00
parent a51f86ae28
commit 74f830486e
4 changed files with 115 additions and 134 deletions
Download patch file Download diff file Expand all files Collapse all files

2
dev/App/Admin.js
View file

@ -1,6 +1,7 @@
import 'External/ko'; import 'External/ko';
import { Settings, SettingsGet } from 'Common/Globals'; import { Settings, SettingsGet } from 'Common/Globals';
import { ThemeStore } from 'Stores/Theme';
import Remote from 'Remote/Admin/Fetch'; import Remote from 'Remote/Admin/Fetch';
@ -17,6 +18,7 @@ export class AdminApp extends AbstractApp {
} }
refresh() { refresh() {
ThemeStore.populate();
this.start(); this.start();
} }

14
dev/App/User.js
View file

@ -94,13 +94,6 @@ export class AppUser extends AbstractApp {
this.folderList = FolderUserStore.folderList; this.folderList = FolderUserStore.folderList;
} }
refresh() {
LanguageStore.language(SettingsGet('Language'));
ThemeStore.populate();
changeTheme(SettingsGet('Theme'));
this.start();
}
/** /**
* @param {number} iFolderType * @param {number} iFolderType
* @param {string} sFromFolderFullName * @param {string} sFromFolderFullName
@ -230,6 +223,13 @@ export class AppUser extends AbstractApp {
}, {capture: true}); }, {capture: true});
} }
refresh() {
ThemeStore.populate();
LanguageStore.language(SettingsGet('Language'));
changeTheme(SettingsGet('Theme'));
this.start();
}
start() { start() {
if (SettingsGet('Auth')) { if (SettingsGet('Auth')) {
rl.setWindowTitle(i18n('GLOBAL/LOADING')); rl.setWindowTitle(i18n('GLOBAL/LOADING'));

2
plugins/demo-account/index.php
View file

@ -40,7 +40,7 @@ class DemoAccountPlugin extends \RainLoop\Plugins\AbstractPlugin
*/ */
public function FilterAppData($bAdmin, &$aResult) public function FilterAppData($bAdmin, &$aResult)
{ {
if (!$bAdmin && \is_array($aResult) && isset($aResult['Auth']) && !$aResult['Auth']) { if (!$bAdmin && \is_array($aResult) && empty($aResult['Auth'])) {
$aResult['DevEmail'] = $this->Config()->Get('plugin', 'email', $aResult['DevEmail']); $aResult['DevEmail'] = $this->Config()->Get('plugin', 'email', $aResult['DevEmail']);
$aResult['DevPassword'] = APP_DUMMY; $aResult['DevPassword'] = APP_DUMMY;
} }

231
snappymail/v/0.0.0/app/libraries/RainLoop/Actions.php
View file

@ -637,110 +637,28 @@ class Actions
} }
} }
public function AppDataSystem(bool $bAdmin = false): array
{
$oConfig = $this->oConfig;
$aAttachmentsActions = array();
if ($this->GetCapa(Enumerations\Capa::ATTACHMENTS_ACTIONS)) {
if (\class_exists('PharData') || \class_exists('ZipArchive')) {
$aAttachmentsActions[] = 'zip';
}
}
return \array_merge(array(
'version' => APP_VERSION,
'admin' => $bAdmin,
'token' => $oConfig->Get('security', 'csrf_protection', false) ? Utils::GetCsrfToken() : '',
'allowHtmlEditorBitiButtons' => (bool)$oConfig->Get('labs', 'allow_html_editor_biti_buttons', false),
'allowCtrlEnterOnCompose' => (bool)$oConfig->Get('labs', 'allow_ctrl_enter_on_compose', false),
'useImapThread' => (bool)$oConfig->Get('labs', 'use_imap_thread', false),
'allowAppendMessage' => (bool)$oConfig->Get('labs', 'allow_message_append', false),
'folderSpecLimit' => (int)$oConfig->Get('labs', 'folders_spec_limit', 50),
'listPermanentFiltered' => '' !== \trim($oConfig->Get('labs', 'imap_message_list_permanent_filter', '')),
'themes' => $this->GetThemes(),
'languages' => \SnappyMail\L10n::getLanguages(false),
'languagesAdmin' => \SnappyMail\L10n::getLanguages(true),
'attachmentsActions' => $aAttachmentsActions
), $bAdmin ? array(
'adminHostUse' => '' !== $oConfig->Get('security', 'admin_panel_host', ''),
'adminPath' => $oConfig->Get('security', 'admin_panel_key', '') ?: 'admin',
'adminAllowed' => (bool)$oConfig->Get('security', 'allow_admin_panel', true),
) : array(
'customLogoutLink' => $oConfig->Get('labs', 'custom_logout_link', ''),
));
}
public function AppData(bool $bAdmin): array public function AppData(bool $bAdmin): array
{ {
$oAccount = null; $oAccount = null;
$oConfig = $this->oConfig; $oConfig = $this->oConfig;
/*
required by Index.html and rl.js:
PluginsLink
*/
$value = \ini_get('upload_max_filesize');
$upload_max_filesize = \intval($value);
switch (\strtoupper(\substr($value, -1))) {
case 'G': $upload_max_filesize *= 1024;
case 'M': $upload_max_filesize *= 1024;
case 'K': $upload_max_filesize *= 1024;
}
$aResult = array( $aResult = array(
'Auth' => false, 'Auth' => false,
'AccountHash' => '',
'AccountSignMe' => false,
'MailToEmail' => '',
'Email' => '',
'DevEmail' => '',
'DevPassword' => '',
'Title' => $oConfig->Get('webmail', 'title', 'SnappyMail Webmail'), 'Title' => $oConfig->Get('webmail', 'title', 'SnappyMail Webmail'),
'LoadingDescription' => $oConfig->Get('webmail', 'loading_description', 'SnappyMail'), 'LoadingDescription' => $oConfig->Get('webmail', 'loading_description', 'SnappyMail'),
'FaviconUrl' => $oConfig->Get('webmail', 'favicon_url', ''),
'LoginDefaultDomain' => $oConfig->Get('login', 'default_domain', ''),
'DetermineUserLanguage' => (bool)$oConfig->Get('login', 'determine_user_language', true),
'DetermineUserDomain' => (bool)$oConfig->Get('login', 'determine_user_domain', false),
'SieveAllowFileintoInbox' => (bool)$oConfig->Get('labs', 'sieve_allow_fileinto_inbox', false),
'ContactsIsAllowed' => false,
'Admin' => array(),
'Capa' => array(),
'Plugins' => array(), 'Plugins' => array(),
'System' => $this->AppDataSystem($bAdmin), 'System' => \array_merge(
array(
'AllowLanguagesOnSettings' => (bool) $oConfig->Get('webmail', 'allow_languages_on_settings', true), 'version' => APP_VERSION,
'AllowLanguagesOnLogin' => (bool) $oConfig->Get('login', 'allow_languages_on_login', true), 'token' => $oConfig->Get('security', 'csrf_protection', false) ? Utils::GetCsrfToken() : '',
'AttachmentLimit' => \min($upload_max_filesize, ((int) $oConfig->Get('webmail', 'attachment_size_limit', 10)) * 1024 * 1024), 'languages' => \SnappyMail\L10n::getLanguages(false)
'SignMe' => (string) $oConfig->Get('login', 'sign_me_auto', Enumerations\SignMeType::DEFAULT_OFF), ), $bAdmin ? array(
'UseLocalProxyForExternalImages' => (bool)$oConfig->Get('labs', 'use_local_proxy_for_external_images', false), 'adminHostUse' => '' !== $oConfig->Get('security', 'admin_panel_host', ''),
'adminPath' => $oConfig->Get('security', 'admin_panel_key', '') ?: 'admin',
// user 'adminAllowed' => (bool)$oConfig->Get('security', 'allow_admin_panel', true)
'ViewHTML' => (bool) $oConfig->Get('defaults', 'view_html', true), ) : array()
'ShowImages' => (bool) $oConfig->Get('defaults', 'show_images', false), ),
'RemoveColors' => (bool) $oConfig->Get('defaults', 'remove_colors', false), 'AllowLanguagesOnLogin' => (bool) $oConfig->Get('login', 'allow_languages_on_login', true)
'ListInlineAttachments' => false,
'MessagesPerPage' => (int) $oConfig->Get('webmail', 'messages_per_page', 25),
'MessageReadDelay' => (int) $oConfig->Get('webmail', 'message_read_delay', 5),
'MsgDefaultAction' => 1,
'SoundNotification' => true,
'NotificationSound' => 'new-mail',
'DesktopNotifications' => true,
'Layout' => (int) $oConfig->Get('defaults', 'view_layout', Enumerations\Layout::SIDE_PREVIEW),
'EditorDefaultType' => \str_replace('Forced', '', $oConfig->Get('defaults', 'view_editor_type', '')),
'UseCheckboxesInList' => (bool) $oConfig->Get('defaults', 'view_use_checkboxes', true),
'AutoLogout' => (int) $oConfig->Get('defaults', 'autologout', 30),
'UseThreads' => (bool) $oConfig->Get('defaults', 'mail_use_threads', false),
'AllowDraftAutosave' => (bool) $oConfig->Get('defaults', 'allow_draft_autosave', true),
'ReplySameFolder' => (bool) $oConfig->Get('defaults', 'mail_reply_same_folder', false),
'ContactsAutosave' => (bool) $oConfig->Get('defaults', 'contacts_autosave', true),
'HideUnsubscribed' => false,
'HideDeleted' => true,
'UnhideKolabFolders' => false,
'MainEmail' => '',
'UserBackgroundName' => '',
'UserBackgroundHash' => ''
); );
$sLanguage = $oConfig->Get('webmail', 'language', 'en'); $sLanguage = $oConfig->Get('webmail', 'language', 'en');
@ -754,6 +672,10 @@ class Actions
$aResult['UseTokenProtection'] = (bool)$oConfig->Get('security', 'csrf_protection', true); $aResult['UseTokenProtection'] = (bool)$oConfig->Get('security', 'csrf_protection', true);
$aResult['EnabledPlugins'] = (bool)$oConfig->Get('plugins', 'enable', false); $aResult['EnabledPlugins'] = (bool)$oConfig->Get('plugins', 'enable', false);
$aResult['LoginDefaultDomain'] = $oConfig->Get('login', 'default_domain', '');
$aResult['DetermineUserLanguage'] = (bool)$oConfig->Get('login', 'determine_user_language', true);
$aResult['DetermineUserDomain'] = (bool)$oConfig->Get('login', 'determine_user_domain', false);
$aResult['VerifySslCertificate'] = (bool)$oConfig->Get('ssl', 'verify_certificate', false); $aResult['VerifySslCertificate'] = (bool)$oConfig->Get('ssl', 'verify_certificate', false);
$aResult['AllowSelfSigned'] = (bool)$oConfig->Get('ssl', 'allow_self_signed', true); $aResult['AllowSelfSigned'] = (bool)$oConfig->Get('ssl', 'allow_self_signed', true);
@ -767,7 +689,13 @@ class Actions
$aResult['ContactsPdoUser'] = (string)$oConfig->Get('contacts', 'pdo_user', ''); $aResult['ContactsPdoUser'] = (string)$oConfig->Get('contacts', 'pdo_user', '');
$aResult['ContactsPdoPassword'] = (string)APP_DUMMY; $aResult['ContactsPdoPassword'] = (string)APP_DUMMY;
$aResult['FaviconUrl'] = $oConfig->Get('webmail', 'favicon_url', '');
$aResult['WeakPassword'] = \is_file(APP_PRIVATE_DATA.'admin_password.txt'); $aResult['WeakPassword'] = \is_file(APP_PRIVATE_DATA.'admin_password.txt');
$aResult['System']['languagesAdmin'] = \SnappyMail\L10n::getLanguages(true);
$aResult['LanguageAdmin'] = $this->ValidateLanguage($oConfig->Get('webmail', 'language_admin', 'en'), '', true);
$aResult['UserLanguageAdmin'] = $this->ValidateLanguage($UserLanguageRaw, '', true, true);
} else { } else {
$passfile = APP_PRIVATE_DATA.'admin_password.txt'; $passfile = APP_PRIVATE_DATA.'admin_password.txt';
$sPassword = $oConfig->Get('security', 'admin_password', ''); $sPassword = $oConfig->Get('security', 'admin_password', '');
@ -779,26 +707,72 @@ class Actions
$oConfig->Save(); $oConfig->Save();
} }
} }
$aResult['LanguageAdmin'] = $this->ValidateLanguage($oConfig->Get('webmail', 'language_admin', 'en'), '', true);
$aResult['UserLanguageAdmin'] = $this->ValidateLanguage($UserLanguageRaw, '', true, true);
} else { } else {
$oAccount = $this->getAccountFromToken(false); $oAccount = $this->getAccountFromToken(false);
if ($oAccount) { if ($oAccount) {
$aResult['Auth'] = true; $aResult = \array_merge($aResult, [
$aResult['Email'] = $oAccount->Email(); 'Auth' => true,
$aResult['IncLogin'] = $oAccount->IncLogin(); 'Email' => \MailSo\Base\Utils::IdnToUtf8($oAccount->Email()),
$aResult['OutLogin'] = $oAccount->OutLogin(); 'IncLogin' => $oAccount->IncLogin(),
$aResult['AccountHash'] = $oAccount->Hash(); 'OutLogin' => $oAccount->OutLogin(),
$aResult['AccountSignMe'] = isset($_COOKIE[self::AUTH_SIGN_ME_TOKEN_KEY]); 'AccountHash' => $oAccount->Hash(),
$aResult['ContactsIsAllowed'] = $this->AddressBookProvider($oAccount)->IsActive(); 'AccountSignMe' => isset($_COOKIE[self::AUTH_SIGN_ME_TOKEN_KEY]),
$aResult['ContactsSyncIsAllowed'] = (bool)$oConfig->Get('contacts', 'allow_sync', false); 'MainEmail' => \MailSo\Base\Utils::IdnToUtf8($this->getMainAccountFromToken()->Email()),
$aResult['ContactsSyncInterval'] = (int)$oConfig->Get('contacts', 'sync_interval', 20); 'MailToEmail' => '',
$aResult['ContactsSyncMode'] = 0; 'ContactsIsAllowed' => $this->AddressBookProvider($oAccount)->IsActive(),
$aResult['ContactsSyncUrl'] = ''; 'ContactsSyncIsAllowed' => (bool)$oConfig->Get('contacts', 'allow_sync', false),
$aResult['ContactsSyncUser'] = ''; 'ContactsSyncInterval' => (int)$oConfig->Get('contacts', 'sync_interval', 20),
$aResult['ContactsSyncPassword'] = ''; 'ContactsSyncMode' => 0,
'ContactsSyncUrl' => '',
'ContactsSyncUser' => '',
'ContactsSyncPassword' => '',
'ViewHTML' => (bool) $oConfig->Get('defaults', 'view_html', true),
'ShowImages' => (bool) $oConfig->Get('defaults', 'show_images', false),
'RemoveColors' => (bool) $oConfig->Get('defaults', 'remove_colors', false),
'ListInlineAttachments' => false,
'MessagesPerPage' => (int) $oConfig->Get('webmail', 'messages_per_page', 25),
'MessageReadDelay' => (int) $oConfig->Get('webmail', 'message_read_delay', 5),
'MsgDefaultAction' => 1,
'SoundNotification' => true,
'NotificationSound' => 'new-mail',
'DesktopNotifications' => true,
'Layout' => (int) $oConfig->Get('defaults', 'view_layout', Enumerations\Layout::SIDE_PREVIEW),
'EditorDefaultType' => \str_replace('Forced', '', $oConfig->Get('defaults', 'view_editor_type', '')),
'UseCheckboxesInList' => (bool) $oConfig->Get('defaults', 'view_use_checkboxes', true),
'AutoLogout' => (int) $oConfig->Get('defaults', 'autologout', 30),
'UseThreads' => (bool) $oConfig->Get('defaults', 'mail_use_threads', false),
'AllowDraftAutosave' => (bool) $oConfig->Get('defaults', 'allow_draft_autosave', true),
'ReplySameFolder' => (bool) $oConfig->Get('defaults', 'mail_reply_same_folder', false),
'ContactsAutosave' => (bool) $oConfig->Get('defaults', 'contacts_autosave', true),
'HideUnsubscribed' => false,
'HideDeleted' => true,
'UnhideKolabFolders' => false,
'MainEmail' => '',
'UserBackgroundName' => '',
'UserBackgroundHash' => '',
'SieveAllowFileintoInbox' => (bool)$oConfig->Get('labs', 'sieve_allow_fileinto_inbox', false)
]);
$aAttachmentsActions = array();
if ($this->GetCapa(Enumerations\Capa::ATTACHMENTS_ACTIONS)) {
if (\class_exists('PharData') || \class_exists('ZipArchive')) {
$aAttachmentsActions[] = 'zip';
}
}
$aResult['System'] = \array_merge(
$aResult['System'], array(
'allowHtmlEditorBitiButtons' => (bool)$oConfig->Get('labs', 'allow_html_editor_biti_buttons', false),
'allowCtrlEnterOnCompose' => (bool)$oConfig->Get('labs', 'allow_ctrl_enter_on_compose', false),
'useImapThread' => (bool)$oConfig->Get('labs', 'use_imap_thread', false),
'allowAppendMessage' => (bool)$oConfig->Get('labs', 'allow_message_append', false),
'folderSpecLimit' => (int)$oConfig->Get('labs', 'folders_spec_limit', 50),
'listPermanentFiltered' => '' !== \trim($oConfig->Get('labs', 'imap_message_list_permanent_filter', '')),
'attachmentsActions' => $aAttachmentsActions,
'customLogoutLink' => $oConfig->Get('labs', 'custom_logout_link', ''),
)
);
if ($aResult['ContactsIsAllowed'] && $aResult['ContactsSyncIsAllowed']) { if ($aResult['ContactsIsAllowed'] && $aResult['ContactsSyncIsAllowed']) {
$mData = $this->getContactsSyncData($oAccount); $mData = $this->getContactsSyncData($oAccount);
@ -815,18 +789,12 @@ class Actions
Utils::ClearCookie(self::AUTH_MAILTO_TOKEN_KEY); Utils::ClearCookie(self::AUTH_MAILTO_TOKEN_KEY);
$mMailToData = Utils::DecodeKeyValuesQ($sToken); $mMailToData = Utils::DecodeKeyValuesQ($sToken);
if (!empty($mMailToData['MailTo']) && if (!empty($mMailToData['MailTo']) && 'MailTo' === $mMailToData['MailTo'] && !empty($mMailToData['To'])) {
'MailTo' === $mMailToData['MailTo'] && !empty($mMailToData['To'])) { $aResult['MailToEmail'] = \MailSo\Base\Utils::IdnToUtf8($mMailToData['To']);
$aResult['MailToEmail'] = $mMailToData['To'];
} }
} }
$oSettings = $this->SettingsProvider()->Load($oAccount);
$aResult['MainEmail'] = \MailSo\Base\Utils::IdnToUtf8($this->getMainAccountFromToken()->Email());
$oSettingsLocal = $this->SettingsProvider(true)->Load($oAccount); $oSettingsLocal = $this->SettingsProvider(true)->Load($oAccount);
if ($oSettingsLocal instanceof Settings) { if ($oSettingsLocal instanceof Settings) {
$aResult['SentFolder'] = (string)$oSettingsLocal->GetConf('SentFolder', ''); $aResult['SentFolder'] = (string)$oSettingsLocal->GetConf('SentFolder', '');
$aResult['DraftsFolder'] = (string)$oSettingsLocal->GetConf('DraftFolder', ''); $aResult['DraftsFolder'] = (string)$oSettingsLocal->GetConf('DraftFolder', '');
@ -844,6 +812,7 @@ class Actions
$sLanguage = $this->ValidateLanguage($UserLanguageRaw, $sLanguage, false); $sLanguage = $this->ValidateLanguage($UserLanguageRaw, $sLanguage, false);
} }
$oSettings = $this->SettingsProvider()->Load($oAccount);
if ($oSettings instanceof Settings) { if ($oSettings instanceof Settings) {
if ($oConfig->Get('webmail', 'allow_languages_on_settings', true)) { if ($oConfig->Get('webmail', 'allow_languages_on_settings', true)) {
$sLanguage = (string) $oSettings->GetConf('Language', $sLanguage); $sLanguage = (string) $oSettings->GetConf('Language', $sLanguage);
@ -900,20 +869,34 @@ class Actions
if ('0.0.0' === APP_VERSION) { if ('0.0.0' === APP_VERSION) {
$aResult['DevEmail'] = $oConfig->Get('labs', 'dev_email', ''); $aResult['DevEmail'] = $oConfig->Get('labs', 'dev_email', '');
$aResult['DevPassword'] = $oConfig->Get('labs', 'dev_password', ''); $aResult['DevPassword'] = $oConfig->Get('labs', 'dev_password', '');
} else {
$aResult['DevEmail'] = '';
$aResult['DevPassword'] = '';
} }
if (empty($aResult['AdditionalLoginError'])) { $aResult['SignMe'] = (string) $oConfig->Get('login', 'sign_me_auto', Enumerations\SignMeType::DEFAULT_OFF);
$aResult['AdditionalLoginError'] = $this->GetSpecLogoutCustomMgsWithDeletion();
} $aResult['AdditionalLoginError'] = $this->GetSpecLogoutCustomMgsWithDeletion();
} }
} }
if ($aResult['Auth']) { if ($aResult['Auth']) {
$aResult['UseLocalProxyForExternalImages'] = (bool)$oConfig->Get('labs', 'use_local_proxy_for_external_images', false);
$aResult['AllowLanguagesOnSettings'] = (bool) $oConfig->Get('webmail', 'allow_languages_on_settings', true);
$aResult['Capa'] = $this->Capa($bAdmin, $oAccount); $aResult['Capa'] = $this->Capa($bAdmin, $oAccount);
$value = \ini_get('upload_max_filesize');
$upload_max_filesize = \intval($value);
switch (\strtoupper(\substr($value, -1))) {
case 'G': $upload_max_filesize *= 1024;
case 'M': $upload_max_filesize *= 1024;
case 'K': $upload_max_filesize *= 1024;
}
$aResult['AttachmentLimit'] = \min($upload_max_filesize, ((int) $oConfig->Get('webmail', 'attachment_size_limit', 10)) * 1024 * 1024);
$aResult['PhpUploadSizes'] = array( $aResult['PhpUploadSizes'] = array(
'upload_max_filesize' => \ini_get('upload_max_filesize'), 'upload_max_filesize' => $value,
'post_max_size' => \ini_get('post_max_size') 'post_max_size' => \ini_get('post_max_size')
); );
$aResult['System']['themes'] = $this->GetThemes();
} }
$sStaticCache = $this->StaticCache(); $sStaticCache = $this->StaticCache();
@ -932,10 +915,6 @@ class Actions
$aResult['StaticLibsJs'] = Utils::WebStaticPath('js/' . ($bAppJsDebug ? '' : 'min/') . $aResult['StaticLibsJs'] = Utils::WebStaticPath('js/' . ($bAppJsDebug ? '' : 'min/') .
'libs' . ($bAppJsDebug ? '' : '.min') . '.js'); 'libs' . ($bAppJsDebug ? '' : '.min') . '.js');
// IDN
$aResult['Email'] = \MailSo\Base\Utils::IdnToUtf8($aResult['Email']);
$aResult['MailToEmail'] = \MailSo\Base\Utils::IdnToUtf8($aResult['MailToEmail']);
$this->oPlugins->InitAppData($bAdmin, $aResult, $oAccount); $this->oPlugins->InitAppData($bAdmin, $aResult, $oAccount);
return $aResult; return $aResult;