public nobgit read

NobMail

Based on mailcow: dockerized

Languages

Repository composition by tracked source files.

PHP

PHP 49% JavaScript 35% HTML 9% CSS 4% Shell 2% Python 1% Lua 0% Perl 0% Ruby 0% SCSS 0%

Create file Wiki Documentation

Clone

https://nobgit.com/orgs/nobgit/nobmail.git

ssh://[email protected]:2222/orgs/nobgit/nobmail.git

Commit

autodiscover: use generalized error logging instead of specific to prevent user enumeration

5ca90074

DerLinkman <[email protected]> 7 months ago

data/web/autodiscover.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Diff

diff --git a/data/web/autodiscover.php b/data/web/autodiscover.php
index e5d15981..c0e69537 100644
--- a/data/web/autodiscover.php
+++ b/data/web/autodiscover.php
@@ -165,7 +165,7 @@ catch(PDOException $e) {
   exit(0);
 }
 
-// Mailbox not found or not active - return error
+// Mailbox not found or not active - return generic error to prevent user enumeration
 if (empty($MailboxData)) {
   try {
     $json = json_encode(
@@ -188,7 +188,7 @@ if (empty($MailboxData)) {
   <Response>
     <Error Time="<?=date('H:i:s', $sec) . substr($usec, 0, strlen($usec) - 2);?>" Id="<?=rand(1000000000, 9999999999);?>">
       <ErrorCode>600</ErrorCode>
-      <Message>Mailbox not found</Message>
+      <Message>Invalid Request</Message>
       <DebugData />
     </Error>
   </Response>