public
nobgit
read
NobMail
Based on mailcow: dockerized
Languages
Repository composition by tracked source files.
PHP
49%
JavaScript
35%
HTML
9%
CSS
4%
Shell
2%
Python
1%
Lua
0%
Perl
0%
Ruby
0%
SCSS
0%
Create file
Wiki Documentation
Clone
https://nobgit.com/orgs/nobgit/nobmail.git
ssh://[email protected]:2222/orgs/nobgit/nobmail.git
Commit
hotfix imapsync
71db83ef
data/web/inc/functions.mailbox.inc.php | 61 +++++++++++++--
data/web/inc/vars.inc.php | 132 +++++++++++++++++++++++++++++++++
2 files changed, 188 insertions(+), 5 deletions(-)Diff
diff --git a/data/web/inc/functions.mailbox.inc.php b/data/web/inc/functions.mailbox.inc.php
index 7f8ff3ac..d6a07eab 100644
--- a/data/web/inc/functions.mailbox.inc.php
+++ b/data/web/inc/functions.mailbox.inc.php
@@ -336,9 +336,34 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
$mins_interval = $_data['mins_interval'];
$enc1 = $_data['enc1'];
$custom_params = (empty(trim($_data['custom_params']))) ? '' : trim($_data['custom_params']);
- // Workaround, fixme
- if (stripos($custom_params, 'pipemess') || stripos($custom_params, 'pipemes')) {
- $custom_params = '';
+
+ // validate custom params
+ foreach (explode(' -', $custom_params) as $param){
+ if (str_contains($param, ' ')) {
+ // bad char
+ $_SESSION['return'][] = array(
+ 'type' => 'danger',
+ 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+ 'msg' => 'bad character SPACE'
+ );
+ return false;
+ }
+
+ // extract option
+ if (str_contains($param, '=')) $param = explode('=', $param)[0];
+ // remove first char if first char is -
+ if ($param[0] == '-') $param = ltrim($param, $param[0]);
+
+ // check if param is whitelisted
+ if (!in_array(strtolower($param), $GLOBALS["IMAPSYNC_OPTIONS"]["whitelist"])){
+ // bad option
+ $_SESSION['return'][] = array(
+ 'type' => 'danger',
+ 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+ 'msg' => 'bad option '. $param
+ );
+ return false;
+ }
}
if (empty($subfolder2)) {
$subfolder2 = "";
@@ -1764,8 +1789,34 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
);
continue;
}
- if (stripos($custom_params, 'pipemess') || stripos($custom_params, 'pipemes')) {
- $custom_params = '';
+
+ // validate custom params
+ foreach (explode(' -', $custom_params) as $param){
+ if (str_contains($param, ' ')) {
+ // bad char
+ $_SESSION['return'][] = array(
+ 'type' => 'danger',
+ 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+ 'msg' => 'bad character SPACE'
+ );
+ return false;
+ }
+
+ // extract option
+ if (str_contains($param, '=')) $param = explode('=', $param)[0];
+ // remove first char if first char is -
+ if ($param[0] == '-') $param = ltrim($param, $param[0]);
+
+ // check if param is whitelisted
+ if (!in_array(strtolower($param), $GLOBALS["IMAPSYNC_OPTIONS"]["whitelist"])){
+ // bad option
+ $_SESSION['return'][] = array(
+ 'type' => 'danger',
+ 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+ 'msg' => 'bad option '. $param
+ );
+ return false;
+ }
}
if (empty($subfolder2)) {
$subfolder2 = "";
diff --git a/data/web/inc/vars.inc.php b/data/web/inc/vars.inc.php
index c8e79bc4..6e08be13 100644
--- a/data/web/inc/vars.inc.php
+++ b/data/web/inc/vars.inc.php
@@ -228,3 +228,135 @@ $RSPAMD_MAPS = array(
'Monitoring Hosts' => 'monitoring_nolog.map'
)
);
+
+
+$IMAPSYNC_OPTIONS = array(
+ 'whitelist' => array(
+ 'log',
+ 'showpasswords',
+ 'nossl1',
+ 'nossl2',
+ 'ssl2',
+ 'notls1',
+ 'notls2',
+ 'tls2',
+ 'debugssl',
+ 'sslargs1',
+ 'sslargs2',
+ 'authmech1',
+ 'authmech2',
+ 'authuser1',
+ 'authuser2',
+ 'proxyauth1',
+ 'proxyauth2',
+ 'authmd51',
+ 'authmd52',
+ 'domain1',
+ 'domain2',
+ 'oauthaccesstoken1',
+ 'oauthaccesstoken2',
+ 'oauthdirect1',
+ 'oauthdirect2',
+ 'folder',
+ 'folder',
+ 'folderrec',
+ 'folderrec',
+ 'folderfirst',
+ 'folderfirst',
+ 'folderlast',
+ 'folderlast',
+ 'nomixfolders',
+ 'skipemptyfolders',
+ 'include',
+ 'include',
+ 'subfolder1',
+ 'subscribed',
+ 'subscribe',
+ 'prefix1',
+ 'prefix2',
+ 'sep1',
+ 'sep2',
+ 'nofoldersizesatend',
+ 'justfoldersizes',
+ 'pidfile',
+ 'pidfilelocking',
+ 'nolog',
+ 'logfile',
+ 'logdir',
+ 'debugcrossduplicates',
+ 'disarmreadreceipts',
+ 'truncmess',
+ 'synclabels',
+ 'resynclabels',
+ 'resyncflags',
+ 'noresyncflags',
+ 'filterbuggyflags',
+ 'expunge1',
+ 'noexpunge1',
+ 'delete1emptyfolders',
+ 'delete2folders',
+ 'noexpunge2',
+ 'nouidexpunge2',
+ 'syncinternaldates',
+ 'idatefromheader',
+ 'maxsize',
+ 'minsize',
+ 'minage',
+ 'search',
+ 'search1',
+ 'search2',
+ 'noabletosearch',
+ 'noabletosearch1',
+ 'noabletosearch2',
+ 'maxlinelength',
+ 'useheader',
+ 'useheader',
+ 'syncduplicates',
+ 'usecache',
+ 'nousecache',
+ 'useuid',
+ 'syncacls',
+ 'nosyncacls',
+ 'debug',
+ 'debugfolders',
+ 'debugcontent',
+ 'debugflags',
+ 'debugimap1',
+ 'debugimap2',
+ 'debugimap',
+ 'debugmemory',
+ 'errorsmax',
+ 'tests',
+ 'testslive',
+ 'testslive6',
+ 'gmail1',
+ 'gmail2',
+ 'office1',
+ 'office2',
+ 'exchange1',
+ 'exchange2',
+ 'domino1',
+ 'domino2',
+ 'keepalive1',
+ 'keepalive2',
+ 'maxmessagespersecond',
+ 'maxbytesafter',
+ 'maxsleep',
+ 'abort',
+ 'exitwhenover',
+ 'noid',
+ 'justconnect',
+ 'justlogin',
+ 'justfolders'
+ ),
+ 'blacklist' => array(
+ 'skipmess',
+ 'delete2foldersonly',
+ 'delete2foldersbutnot',
+ 'regexflag',
+ 'regexmess',
+ 'pipemess',
+ 'regextrans2',
+ 'maxlinelengthcmd'
+ )
+);