public
nobgit
read
NobMail
Based on mailcow: dockerized
Languages
Repository composition by tracked source files.
PHP
49%
JavaScript
35%
HTML
9%
CSS
4%
Shell
2%
Python
1%
Lua
0%
Perl
0%
Ruby
0%
SCSS
0%
Create file
Wiki Documentation
Clone
https://nobgit.com/orgs/nobgit/nobmail.git
ssh://[email protected]:2222/orgs/nobgit/nobmail.git
Commit
[Web] Do not allow admin login to mailbox logged in as user while ALLOW_ADMIN_EMAIL_LOGIN is n
78270f97
data/web/sogo-auth.php | 10 ++++++++++
1 file changed, 10 insertions(+)Diff
diff --git a/data/web/sogo-auth.php b/data/web/sogo-auth.php
index 41c64a6d..3bd19c6e 100644
--- a/data/web/sogo-auth.php
+++ b/data/web/sogo-auth.php
@@ -1,5 +1,10 @@
<?php
+$ALLOW_ADMIN_EMAIL_LOGIN = (preg_match(
+ "/^([yY][eE][sS]|[yY])+$/",
+ $_ENV["ALLOW_ADMIN_EMAIL_LOGIN"]
+));
+
$session_var_user_allowed = 'sogo-sso-user-allowed';
$session_var_pass = 'sogo-sso-pass';
@@ -29,6 +34,11 @@ elseif (isset($_GET['login'])) {
$is_dual = (!empty($_SESSION["dual-login"]["username"])) ? true : false;
// check permissions (if dual_login is active, deny sso when acl is not given)
$login = html_entity_decode(rawurldecode($_GET["login"]));
+ if ($ALLOW_ADMIN_EMAIL_LOGIN === 0 && $is_dual === true) {
+ header('HTTP/1.0 403 Forbidden');
+ echo "Admin login is forbidden";
+ exit;
+ }
if (isset($_SESSION['mailcow_cc_role']) &&
($_SESSION['acl']['login_as'] == "1" || ($is_dual === false && $login == $_SESSION['mailcow_cc_username']))) {
if (filter_var($login, FILTER_VALIDATE_EMAIL)) {