public nobgit read

NobMail

Based on mailcow: dockerized

Languages

Repository composition by tracked source files.

PHP

PHP 49% JavaScript 35% HTML 9% CSS 4% Shell 2% Python 1% Lua 0% Perl 0% Ruby 0% SCSS 0%

Create file Wiki Documentation

Clone

https://nobgit.com/orgs/nobgit/nobmail.git

ssh://[email protected]:2222/orgs/nobgit/nobmail.git

Commit

[Web] Fix alias verification

05c85b41

andryyy <[email protected]> 5 years ago

data/web/inc/functions.inc.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Diff

diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php
index 7854acd6..d88d7e6c 100644
--- a/data/web/inc/functions.inc.php
+++ b/data/web/inc/functions.inc.php
@@ -589,6 +589,7 @@ function hasMailboxObjectAccess($username, $role, $object) {
   }
 	return false;
 }
+// does also verify mailboxes as a mailbox is a alias == goto
 function hasAliasObjectAccess($username, $role, $object) {
 	global $pdo;
 	if (empty($username) || empty($role) || empty($object)) {
@@ -600,8 +601,7 @@ function hasAliasObjectAccess($username, $role, $object) {
 	if ($role != 'admin' && $role != 'domainadmin' && $role != 'user') {
 		return false;
 	}
-  // Do not verify mailboxes
-  $stmt = $pdo->prepare("SELECT `domain` FROM `alias` WHERE `address` = :object AND `address` != `goto`");
+  $stmt = $pdo->prepare("SELECT `domain` FROM `alias` WHERE `address` = :object");
   $stmt->execute(array(':object' => $object));
   $row = $stmt->fetch(PDO::FETCH_ASSOC);
   if (isset($row['domain']) && hasDomainAccess($username, $role, $row['domain'])) {