Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-07-13 03:27:39 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Reduce AppData result for unauthorized visitor

Browse source
This commit is contained in:
the-djmaze 2022-10-04 10:04:41 +02:00
parent a51f86ae28
commit 74f830486e
4 changed files with 115 additions and 134 deletions
Download patch file Download diff file Expand all files Collapse all files

2
dev/App/Admin.js
View file

@ -1,6 +1,7 @@
import 'External/ko';
import { Settings, SettingsGet } from 'Common/Globals';
import { ThemeStore } from 'Stores/Theme';
import Remote from 'Remote/Admin/Fetch';
@ -17,6 +18,7 @@ export class AdminApp extends AbstractApp {
}
refresh() {
ThemeStore.populate();
this.start();
}

14
dev/App/User.js
View file

@ -94,13 +94,6 @@ export class AppUser extends AbstractApp {
this.folderList = FolderUserStore.folderList;
}
refresh() {
LanguageStore.language(SettingsGet('Language'));
ThemeStore.populate();
changeTheme(SettingsGet('Theme'));
this.start();
}
/**
* @param {number} iFolderType
* @param {string} sFromFolderFullName
@ -230,6 +223,13 @@ export class AppUser extends AbstractApp {
}, {capture: true});
}
refresh() {
ThemeStore.populate();
LanguageStore.language(SettingsGet('Language'));
changeTheme(SettingsGet('Theme'));
this.start();
}
start() {
if (SettingsGet('Auth')) {
rl.setWindowTitle(i18n('GLOBAL/LOADING'));

2
plugins/demo-account/index.php
View file

@ -40,7 +40,7 @@ class DemoAccountPlugin extends \RainLoop\Plugins\AbstractPlugin
*/
public function FilterAppData($bAdmin, &$aResult)
{
if (!$bAdmin && \is_array($aResult) && isset($aResult['Auth']) && !$aResult['Auth']) {
if (!$bAdmin && \is_array($aResult) && empty($aResult['Auth'])) {
$aResult['DevEmail'] = $this->Config()->Get('plugin', 'email', $aResult['DevEmail']);
$aResult['DevPassword'] = APP_DUMMY;
}

261
snappymail/v/0.0.0/app/libraries/RainLoop/Actions.php
View file

@ -637,86 +637,97 @@ class Actions
}
}
public function AppDataSystem(bool $bAdmin = false): array
{
$oConfig = $this->oConfig;
$aAttachmentsActions = array();
if ($this->GetCapa(Enumerations\Capa::ATTACHMENTS_ACTIONS)) {
if (\class_exists('PharData') || \class_exists('ZipArchive')) {
$aAttachmentsActions[] = 'zip';
}
}
return \array_merge(array(
'version' => APP_VERSION,
'admin' => $bAdmin,
'token' => $oConfig->Get('security', 'csrf_protection', false) ? Utils::GetCsrfToken() : '',
'allowHtmlEditorBitiButtons' => (bool)$oConfig->Get('labs', 'allow_html_editor_biti_buttons', false),
'allowCtrlEnterOnCompose' => (bool)$oConfig->Get('labs', 'allow_ctrl_enter_on_compose', false),
'useImapThread' => (bool)$oConfig->Get('labs', 'use_imap_thread', false),
'allowAppendMessage' => (bool)$oConfig->Get('labs', 'allow_message_append', false),
'folderSpecLimit' => (int)$oConfig->Get('labs', 'folders_spec_limit', 50),
'listPermanentFiltered' => '' !== \trim($oConfig->Get('labs', 'imap_message_list_permanent_filter', '')),
'themes' => $this->GetThemes(),
'languages' => \SnappyMail\L10n::getLanguages(false),
'languagesAdmin' => \SnappyMail\L10n::getLanguages(true),
'attachmentsActions' => $aAttachmentsActions
), $bAdmin ? array(
'adminHostUse' => '' !== $oConfig->Get('security', 'admin_panel_host', ''),
'adminPath' => $oConfig->Get('security', 'admin_panel_key', '') ?: 'admin',
'adminAllowed' => (bool)$oConfig->Get('security', 'allow_admin_panel', true),
) : array(
'customLogoutLink' => $oConfig->Get('labs', 'custom_logout_link', ''),
));
}
public function AppData(bool $bAdmin): array
{
$oAccount = null;
$oConfig = $this->oConfig;
/*
required by Index.html and rl.js:
PluginsLink
*/
$value = \ini_get('upload_max_filesize');
$upload_max_filesize = \intval($value);
switch (\strtoupper(\substr($value, -1))) {
case 'G': $upload_max_filesize *= 1024;
case 'M': $upload_max_filesize *= 1024;
case 'K': $upload_max_filesize *= 1024;
}
$aResult = array(
'Auth' => false,
'AccountHash' => '',
'AccountSignMe' => false,
'MailToEmail' => '',
'Email' => '',
'DevEmail' => '',
'DevPassword' => '',
'Title' => $oConfig->Get('webmail', 'title', 'SnappyMail Webmail'),
'LoadingDescription' => $oConfig->Get('webmail', 'loading_description', 'SnappyMail'),
'FaviconUrl' => $oConfig->Get('webmail', 'favicon_url', ''),
'LoginDefaultDomain' => $oConfig->Get('login', 'default_domain', ''),
'DetermineUserLanguage' => (bool)$oConfig->Get('login', 'determine_user_language', true),
'DetermineUserDomain' => (bool)$oConfig->Get('login', 'determine_user_domain', false),
'SieveAllowFileintoInbox' => (bool)$oConfig->Get('labs', 'sieve_allow_fileinto_inbox', false),
'ContactsIsAllowed' => false,
'Admin' => array(),
'Capa' => array(),
'Plugins' => array(),
'System' => $this->AppDataSystem($bAdmin),
'System' => \array_merge(
array(
'version' => APP_VERSION,
'token' => $oConfig->Get('security', 'csrf_protection', false) ? Utils::GetCsrfToken() : '',
'languages' => \SnappyMail\L10n::getLanguages(false)
), $bAdmin ? array(
'adminHostUse' => '' !== $oConfig->Get('security', 'admin_panel_host', ''),
'adminPath' => $oConfig->Get('security', 'admin_panel_key', '') ?: 'admin',
'adminAllowed' => (bool)$oConfig->Get('security', 'allow_admin_panel', true)
) : array()
),
'AllowLanguagesOnLogin' => (bool) $oConfig->Get('login', 'allow_languages_on_login', true)
);
'AllowLanguagesOnSettings' => (bool) $oConfig->Get('webmail', 'allow_languages_on_settings', true),
'AllowLanguagesOnLogin' => (bool) $oConfig->Get('login', 'allow_languages_on_login', true),
'AttachmentLimit' => \min($upload_max_filesize, ((int) $oConfig->Get('webmail', 'attachment_size_limit', 10)) * 1024 * 1024),
'SignMe' => (string) $oConfig->Get('login', 'sign_me_auto', Enumerations\SignMeType::DEFAULT_OFF),
'UseLocalProxyForExternalImages' => (bool)$oConfig->Get('labs', 'use_local_proxy_for_external_images', false),
$sLanguage = $oConfig->Get('webmail', 'language', 'en');
$UserLanguageRaw = $this->detectUserLanguage($bAdmin);
if ($bAdmin) {
$aResult['Auth'] = $this->IsAdminLoggined(false);
if ($aResult['Auth']) {
$aResult['AdminLogin'] = (string)$oConfig->Get('security', 'admin_login', '');
$aResult['AdminTOTP'] = (string)$oConfig->Get('security', 'admin_totp', '');
$aResult['UseTokenProtection'] = (bool)$oConfig->Get('security', 'csrf_protection', true);
$aResult['EnabledPlugins'] = (bool)$oConfig->Get('plugins', 'enable', false);
$aResult['LoginDefaultDomain'] = $oConfig->Get('login', 'default_domain', '');
$aResult['DetermineUserLanguage'] = (bool)$oConfig->Get('login', 'determine_user_language', true);
$aResult['DetermineUserDomain'] = (bool)$oConfig->Get('login', 'determine_user_domain', false);
$aResult['VerifySslCertificate'] = (bool)$oConfig->Get('ssl', 'verify_certificate', false);
$aResult['AllowSelfSigned'] = (bool)$oConfig->Get('ssl', 'allow_self_signed', true);
$aResult['supportedPdoDrivers'] = \RainLoop\Common\PdoAbstract::getAvailableDrivers();
$aResult['ContactsEnable'] = (bool)$oConfig->Get('contacts', 'enable', false);
$aResult['ContactsSync'] = (bool)$oConfig->Get('contacts', 'allow_sync', false);
$aResult['ContactsPdoType'] = Providers\AddressBook\PdoAddressBook::validPdoType($this->oConfig->Get('contacts', 'type', 'sqlite'));
$aResult['ContactsPdoDsn'] = (string)$oConfig->Get('contacts', 'pdo_dsn', '');
$aResult['ContactsPdoType'] = (string)$oConfig->Get('contacts', 'type', '');
$aResult['ContactsPdoUser'] = (string)$oConfig->Get('contacts', 'pdo_user', '');
$aResult['ContactsPdoPassword'] = (string)APP_DUMMY;
$aResult['FaviconUrl'] = $oConfig->Get('webmail', 'favicon_url', '');
$aResult['WeakPassword'] = \is_file(APP_PRIVATE_DATA.'admin_password.txt');
$aResult['System']['languagesAdmin'] = \SnappyMail\L10n::getLanguages(true);
$aResult['LanguageAdmin'] = $this->ValidateLanguage($oConfig->Get('webmail', 'language_admin', 'en'), '', true);
$aResult['UserLanguageAdmin'] = $this->ValidateLanguage($UserLanguageRaw, '', true, true);
} else {
$passfile = APP_PRIVATE_DATA.'admin_password.txt';
$sPassword = $oConfig->Get('security', 'admin_password', '');
if (!$sPassword) {
$sPassword = \substr(\base64_encode(\random_bytes(16)), 0, 12);
Utils::saveFile($passfile, $sPassword . "\n");
// \chmod($passfile, 0600);
$oConfig->SetPassword($sPassword);
$oConfig->Save();
}
}
} else {
$oAccount = $this->getAccountFromToken(false);
if ($oAccount) {
$aResult = \array_merge($aResult, [
'Auth' => true,
'Email' => \MailSo\Base\Utils::IdnToUtf8($oAccount->Email()),
'IncLogin' => $oAccount->IncLogin(),
'OutLogin' => $oAccount->OutLogin(),
'AccountHash' => $oAccount->Hash(),
'AccountSignMe' => isset($_COOKIE[self::AUTH_SIGN_ME_TOKEN_KEY]),
'MainEmail' => \MailSo\Base\Utils::IdnToUtf8($this->getMainAccountFromToken()->Email()),
'MailToEmail' => '',
'ContactsIsAllowed' => $this->AddressBookProvider($oAccount)->IsActive(),
'ContactsSyncIsAllowed' => (bool)$oConfig->Get('contacts', 'allow_sync', false),
'ContactsSyncInterval' => (int)$oConfig->Get('contacts', 'sync_interval', 20),
'ContactsSyncMode' => 0,
'ContactsSyncUrl' => '',
'ContactsSyncUser' => '',
'ContactsSyncPassword' => '',
// user
'ViewHTML' => (bool) $oConfig->Get('defaults', 'view_html', true),
'ShowImages' => (bool) $oConfig->Get('defaults', 'show_images', false),
'RemoveColors' => (bool) $oConfig->Get('defaults', 'remove_colors', false),
@ -740,66 +751,29 @@ class Actions
'UnhideKolabFolders' => false,
'MainEmail' => '',
'UserBackgroundName' => '',
'UserBackgroundHash' => ''
'UserBackgroundHash' => '',
'SieveAllowFileintoInbox' => (bool)$oConfig->Get('labs', 'sieve_allow_fileinto_inbox', false)
]);
$aAttachmentsActions = array();
if ($this->GetCapa(Enumerations\Capa::ATTACHMENTS_ACTIONS)) {
if (\class_exists('PharData') || \class_exists('ZipArchive')) {
$aAttachmentsActions[] = 'zip';
}
}
$aResult['System'] = \array_merge(
$aResult['System'], array(
'allowHtmlEditorBitiButtons' => (bool)$oConfig->Get('labs', 'allow_html_editor_biti_buttons', false),
'allowCtrlEnterOnCompose' => (bool)$oConfig->Get('labs', 'allow_ctrl_enter_on_compose', false),
'useImapThread' => (bool)$oConfig->Get('labs', 'use_imap_thread', false),
'allowAppendMessage' => (bool)$oConfig->Get('labs', 'allow_message_append', false),
'folderSpecLimit' => (int)$oConfig->Get('labs', 'folders_spec_limit', 50),
'listPermanentFiltered' => '' !== \trim($oConfig->Get('labs', 'imap_message_list_permanent_filter', '')),
'attachmentsActions' => $aAttachmentsActions,
'customLogoutLink' => $oConfig->Get('labs', 'custom_logout_link', ''),
)
);
$sLanguage = $oConfig->Get('webmail', 'language', 'en');
$UserLanguageRaw = $this->detectUserLanguage($bAdmin);
if ($bAdmin) {
$aResult['Auth'] = $this->IsAdminLoggined(false);
if ($aResult['Auth']) {
$aResult['AdminLogin'] = (string)$oConfig->Get('security', 'admin_login', '');
$aResult['AdminTOTP'] = (string)$oConfig->Get('security', 'admin_totp', '');
$aResult['UseTokenProtection'] = (bool)$oConfig->Get('security', 'csrf_protection', true);
$aResult['EnabledPlugins'] = (bool)$oConfig->Get('plugins', 'enable', false);
$aResult['VerifySslCertificate'] = (bool)$oConfig->Get('ssl', 'verify_certificate', false);
$aResult['AllowSelfSigned'] = (bool)$oConfig->Get('ssl', 'allow_self_signed', true);
$aResult['supportedPdoDrivers'] = \RainLoop\Common\PdoAbstract::getAvailableDrivers();
$aResult['ContactsEnable'] = (bool)$oConfig->Get('contacts', 'enable', false);
$aResult['ContactsSync'] = (bool)$oConfig->Get('contacts', 'allow_sync', false);
$aResult['ContactsPdoType'] = Providers\AddressBook\PdoAddressBook::validPdoType($this->oConfig->Get('contacts', 'type', 'sqlite'));
$aResult['ContactsPdoDsn'] = (string)$oConfig->Get('contacts', 'pdo_dsn', '');
$aResult['ContactsPdoType'] = (string)$oConfig->Get('contacts', 'type', '');
$aResult['ContactsPdoUser'] = (string)$oConfig->Get('contacts', 'pdo_user', '');
$aResult['ContactsPdoPassword'] = (string)APP_DUMMY;
$aResult['WeakPassword'] = \is_file(APP_PRIVATE_DATA.'admin_password.txt');
} else {
$passfile = APP_PRIVATE_DATA.'admin_password.txt';
$sPassword = $oConfig->Get('security', 'admin_password', '');
if (!$sPassword) {
$sPassword = \substr(\base64_encode(\random_bytes(16)), 0, 12);
Utils::saveFile($passfile, $sPassword . "\n");
// \chmod($passfile, 0600);
$oConfig->SetPassword($sPassword);
$oConfig->Save();
}
}
$aResult['LanguageAdmin'] = $this->ValidateLanguage($oConfig->Get('webmail', 'language_admin', 'en'), '', true);
$aResult['UserLanguageAdmin'] = $this->ValidateLanguage($UserLanguageRaw, '', true, true);
} else {
$oAccount = $this->getAccountFromToken(false);
if ($oAccount) {
$aResult['Auth'] = true;
$aResult['Email'] = $oAccount->Email();
$aResult['IncLogin'] = $oAccount->IncLogin();
$aResult['OutLogin'] = $oAccount->OutLogin();
$aResult['AccountHash'] = $oAccount->Hash();
$aResult['AccountSignMe'] = isset($_COOKIE[self::AUTH_SIGN_ME_TOKEN_KEY]);
$aResult['ContactsIsAllowed'] = $this->AddressBookProvider($oAccount)->IsActive();
$aResult['ContactsSyncIsAllowed'] = (bool)$oConfig->Get('contacts', 'allow_sync', false);
$aResult['ContactsSyncInterval'] = (int)$oConfig->Get('contacts', 'sync_interval', 20);
$aResult['ContactsSyncMode'] = 0;
$aResult['ContactsSyncUrl'] = '';
$aResult['ContactsSyncUser'] = '';
$aResult['ContactsSyncPassword'] = '';
if ($aResult['ContactsIsAllowed'] && $aResult['ContactsSyncIsAllowed']) {
$mData = $this->getContactsSyncData($oAccount);
if (\is_array($mData)) {
@ -815,18 +789,12 @@ class Actions
Utils::ClearCookie(self::AUTH_MAILTO_TOKEN_KEY);
$mMailToData = Utils::DecodeKeyValuesQ($sToken);
if (!empty($mMailToData['MailTo']) &&
'MailTo' === $mMailToData['MailTo'] && !empty($mMailToData['To'])) {
$aResult['MailToEmail'] = $mMailToData['To'];
if (!empty($mMailToData['MailTo']) && 'MailTo' === $mMailToData['MailTo'] && !empty($mMailToData['To'])) {
$aResult['MailToEmail'] = \MailSo\Base\Utils::IdnToUtf8($mMailToData['To']);
}
}
$oSettings = $this->SettingsProvider()->Load($oAccount);
$aResult['MainEmail'] = \MailSo\Base\Utils::IdnToUtf8($this->getMainAccountFromToken()->Email());
$oSettingsLocal = $this->SettingsProvider(true)->Load($oAccount);
if ($oSettingsLocal instanceof Settings) {
$aResult['SentFolder'] = (string)$oSettingsLocal->GetConf('SentFolder', '');
$aResult['DraftsFolder'] = (string)$oSettingsLocal->GetConf('DraftFolder', '');
@ -844,6 +812,7 @@ class Actions
$sLanguage = $this->ValidateLanguage($UserLanguageRaw, $sLanguage, false);
}
$oSettings = $this->SettingsProvider()->Load($oAccount);
if ($oSettings instanceof Settings) {
if ($oConfig->Get('webmail', 'allow_languages_on_settings', true)) {
$sLanguage = (string) $oSettings->GetConf('Language', $sLanguage);
@ -900,20 +869,34 @@ class Actions
if ('0.0.0' === APP_VERSION) {
$aResult['DevEmail'] = $oConfig->Get('labs', 'dev_email', '');
$aResult['DevPassword'] = $oConfig->Get('labs', 'dev_password', '');
} else {
$aResult['DevEmail'] = '';
$aResult['DevPassword'] = '';
}
if (empty($aResult['AdditionalLoginError'])) {
$aResult['SignMe'] = (string) $oConfig->Get('login', 'sign_me_auto', Enumerations\SignMeType::DEFAULT_OFF);
$aResult['AdditionalLoginError'] = $this->GetSpecLogoutCustomMgsWithDeletion();
}
}
}
if ($aResult['Auth']) {
$aResult['UseLocalProxyForExternalImages'] = (bool)$oConfig->Get('labs', 'use_local_proxy_for_external_images', false);
$aResult['AllowLanguagesOnSettings'] = (bool) $oConfig->Get('webmail', 'allow_languages_on_settings', true);
$aResult['Capa'] = $this->Capa($bAdmin, $oAccount);
$value = \ini_get('upload_max_filesize');
$upload_max_filesize = \intval($value);
switch (\strtoupper(\substr($value, -1))) {
case 'G': $upload_max_filesize *= 1024;
case 'M': $upload_max_filesize *= 1024;
case 'K': $upload_max_filesize *= 1024;
}
$aResult['AttachmentLimit'] = \min($upload_max_filesize, ((int) $oConfig->Get('webmail', 'attachment_size_limit', 10)) * 1024 * 1024);
$aResult['PhpUploadSizes'] = array(
'upload_max_filesize' => \ini_get('upload_max_filesize'),
'upload_max_filesize' => $value,
'post_max_size' => \ini_get('post_max_size')
);
$aResult['System']['themes'] = $this->GetThemes();
}
$sStaticCache = $this->StaticCache();
@ -932,10 +915,6 @@ class Actions
$aResult['StaticLibsJs'] = Utils::WebStaticPath('js/' . ($bAppJsDebug ? '' : 'min/') .
'libs' . ($bAppJsDebug ? '' : '.min') . '.js');
// IDN
$aResult['Email'] = \MailSo\Base\Utils::IdnToUtf8($aResult['Email']);
$aResult['MailToEmail'] = \MailSo\Base\Utils::IdnToUtf8($aResult['MailToEmail']);
$this->oPlugins->InitAppData($bAdmin, $aResult, $oAccount);
return $aResult;