Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-09-07 16:37:02 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Moved Fetch Metadata security due to issues with API and

Browse source 
https://github.com/the-djmaze/snappymail/issues/99#issuecomment-895293750
This should prevent security error on visiting "index" in any way, but keep security on any sub-request
This commit is contained in:
djmaze 2021-08-09 21:22:57 +02:00
parent adb5619438
commit 89740bf50f
2 changed files with 17 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

10
snappymail/v/0.0.0/app/handle.php
View file

@ -28,16 +28,6 @@ if (!\defined('RAINLOOP_APP_LIBRARIES_PATH'))
if (\class_exists('RainLoop\Api')) if (\class_exists('RainLoop\Api'))
{ {
if (!\SnappyMail\HTTP\SecFetch::isEntering() && !\SnappyMail\HTTP\SecFetch::isSameOrigin()) {
\MailSo\Base\Http::StatusHeader(403);
exit("Disallowed Sec-Fetch
Dest: " . ($_SERVER['HTTP_SEC_FETCH_DEST'] ?? '') . "
Mode: " . ($_SERVER['HTTP_SEC_FETCH_MODE'] ?? '') . "
Site: " . ($_SERVER['HTTP_SEC_FETCH_SITE'] ?? '') . "
User: " . (\SnappyMail\HTTP\SecFetch::user() ? 'true' : 'false')
);
}
\MailSo\Base\Loader::Init(); \MailSo\Base\Loader::Init();
if (!empty($_ENV['RAINLOOP_INCLUDE_AS_API'])) if (!empty($_ENV['RAINLOOP_INCLUDE_AS_API']))

21
snappymail/v/0.0.0/app/libraries/RainLoop/Service.php
View file

@ -107,15 +107,26 @@ class Service
{ {
\MailSo\Base\Http::StatusHeader(403); \MailSo\Base\Http::StatusHeader(403);
echo $this->oServiceActions->ErrorTemplates('Access Denied.', echo $this->oServiceActions->ErrorTemplates('Access Denied.',
'Access to the SnappyMail Admin Panel is not allowed!', true); 'Access to the SnappyMail Admin Panel is not allowed!');
return $this; return false;
} }
$bIndex = true; $bIndex = true;
$sResult = ''; $sResult = '';
if (0 < \count($aPaths) && !empty($aPaths[0]) && !$bAdmin && 'index' !== \strtolower($aPaths[0])) if (0 < \count($aPaths) && !empty($aPaths[0]) && !$bAdmin && 'index' !== \strtolower($aPaths[0]))
{ {
if (!\SnappyMail\HTTP\SecFetch::isSameOrigin()) {
\MailSo\Base\Http::StatusHeader(403);
echo $this->oServiceActions->ErrorTemplates('Access Denied.',
"Disallowed Sec-Fetch
Dest: " . ($_SERVER['HTTP_SEC_FETCH_DEST'] ?? '') . "
Mode: " . ($_SERVER['HTTP_SEC_FETCH_MODE'] ?? '') . "
Site: " . ($_SERVER['HTTP_SEC_FETCH_SITE'] ?? '') . "
User: " . (\SnappyMail\HTTP\SecFetch::user() ? 'true' : 'false'));
return false;
}
$bIndex = false; $bIndex = false;
$sMethodName = 'Service'.\preg_replace('/@.+$/', '', $aPaths[0]); $sMethodName = 'Service'.\preg_replace('/@.+$/', '', $aPaths[0]);
$sMethodExtra = 0 < \strpos($aPaths[0], '@') ? \preg_replace('/^[^@]+@/', '', $aPaths[0]) : ''; $sMethodExtra = 0 < \strpos($aPaths[0], '@') ? \preg_replace('/^[^@]+@/', '', $aPaths[0]) : '';
@ -134,6 +145,7 @@ class Service
if ($bIndex) if ($bIndex)
{ {
// if (!\SnappyMail\HTTP\SecFetch::isEntering()) {
\header('Content-Type: text/html; charset=utf-8'); \header('Content-Type: text/html; charset=utf-8');
$this->oHttp->ServerNoCache(); $this->oHttp->ServerNoCache();
@ -141,10 +153,10 @@ class Service
{ {
echo $this->oServiceActions->ErrorTemplates( echo $this->oServiceActions->ErrorTemplates(
'Permission denied!', 'Permission denied!',
'SnappyMail cannot access to the data folder "'.APP_DATA_FOLDER_PATH.'"' 'SnappyMail can not access the data folder "'.APP_DATA_FOLDER_PATH.'"'
); );
return $this; return false;
} }
$sLanguage = $this->oActions->GetLanguage($bAdmin); $sLanguage = $this->oActions->GetLanguage($bAdmin);
@ -204,6 +216,7 @@ class Service
} }
// Internet Explorer does not support 'nonce' // Internet Explorer does not support 'nonce'
if (!\strpos($_SERVER['HTTP_USER_AGENT'], 'Trident/') && !\strpos($_SERVER['HTTP_USER_AGENT'], 'Edge/1')) { if (!\strpos($_SERVER['HTTP_USER_AGENT'], 'Trident/') && !\strpos($_SERVER['HTTP_USER_AGENT'], 'Edge/1')) {
// Knockout.js requires unsafe-inline?
if ($sScriptNonce) { if ($sScriptNonce) {
$sContentSecurityPolicy = \preg_replace("/(script-src[^;]+)'unsafe-inline'/", "\$1'nonce-{$sScriptNonce}'", $sContentSecurityPolicy); $sContentSecurityPolicy = \preg_replace("/(script-src[^;]+)'unsafe-inline'/", "\$1'nonce-{$sScriptNonce}'", $sContentSecurityPolicy);
} }