public nobgit read

NobMail

Based on mailcow: dockerized

Languages

Repository composition by tracked source files.

PHP

PHP 49% JavaScript 35% HTML 9% CSS 4% Shell 2% Python 1% Lua 0% Perl 0% Ruby 0% SCSS 0%

Create file Wiki Documentation

Clone

https://nobgit.com/orgs/nobgit/nobmail.git

ssh://[email protected]:2222/orgs/nobgit/nobmail.git

Commit

[Dovecot, Web] Fix remaining issues of app password enhancements from #4296

f0aae22f

andryyy <[email protected]> 4 years, 9 months ago

data/Dockerfiles/dovecot/docker-entrypoint.sh | 6 +++++-
 data/web/inc/functions.inc.php                | 2 +-
 data/web/sogo-auth.php                        | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

Diff

diff --git a/data/Dockerfiles/dovecot/docker-entrypoint.sh b/data/Dockerfiles/dovecot/docker-entrypoint.sh
index 2ae2c407..2b1d92ad 100755
--- a/data/Dockerfiles/dovecot/docker-entrypoint.sh
+++ b/data/Dockerfiles/dovecot/docker-entrypoint.sh
@@ -177,7 +177,11 @@ function auth_password_verify(req, pass)
     while row do
       if req.password_verify(req, row.password, pass) == 1 then
         -- if password is valid and protocol access is 1 OR real_rip matches SOGo, proceed
-        if tostring(req.real_ip) == "__IPV4_SOGO__" or row.has_prot_access == "1" then
+        if tostring(req.real_rip) == "__IPV4_SOGO__" then
+          cur:close()
+          con:close()
+          return dovecot.auth.PASSDB_RESULT_OK, "password=" .. pass
+        if row.has_prot_access == "1" then
           con:execute(string.format([[REPLACE INTO sasl_log (service, app_password, username, real_rip)
             VALUES ("%s", %d, "%s", "%s")]], con:escape(req.service), row.id, con:escape(req.user), con:escape(req.real_rip)))
           cur:close()
diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php
index 1425ea3a..209baa3a 100644
--- a/data/web/inc/functions.inc.php
+++ b/data/web/inc/functions.inc.php
@@ -944,7 +944,7 @@ function check_login($user, $pass, $app_passwd_data = false) {
           ':service' => $service,
           ':app_id' => $row['app_passwd_id'],
           ':username' => $user,
-          ':remote_addr' => $_SERVER['REMOTE_ADDR']
+          ':remote_addr' => ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR'])
         ));
       }
       return "user";
diff --git a/data/web/sogo-auth.php b/data/web/sogo-auth.php
index 1e163232..bb2673a4 100644
--- a/data/web/sogo-auth.php
+++ b/data/web/sogo-auth.php
@@ -57,7 +57,7 @@ elseif (isset($_GET['login'])) {
         $stmt = $pdo->prepare("REPLACE INTO sasl_log (`service`, `app_password`, `username`, `real_rip`) VALUES ('SSO', 0, :username, :remote_addr)");
         $stmt->execute(array(
           ':username' => $login,
-          ':remote_addr' => $_SERVER['REMOTE_ADDR']
+          ':remote_addr' => ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR'])
         ));
         // redirect to sogo (sogo will get the correct credentials via nginx auth_request
         header("Location: /SOGo/so/${login}");