public
nobgit
read
NobMail
Based on mailcow: dockerized
Languages
Repository composition by tracked source files.
PHP
49%
JavaScript
35%
HTML
9%
CSS
4%
Shell
2%
Python
1%
Lua
0%
Perl
0%
Ruby
0%
SCSS
0%
Create file
Wiki Documentation
Clone
https://nobgit.com/orgs/nobgit/nobmail.git
ssh://[email protected]:2222/orgs/nobgit/nobmail.git
Trace
data/web/sogo-auth.php
Trace helps you understand code history line by line. See who changed each line, when it changed, and which commit introduced it.
Author
Date
Commit
Line
Code
1
<?php
3
$ALLOW_ADMIN_EMAIL_LOGIN = (preg_match(
4
"/^([yY][eE][sS]|[yY])+$/",
5
$_ENV["ALLOW_ADMIN_EMAIL_LOGIN"]
6
));
8
$session_var_user_allowed = 'sogo-sso-user-allowed';
9
$session_var_pass = 'sogo-sso-pass';
11
// validate credentials for basic auth requests
12
if (isset($_SERVER['PHP_AUTH_USER'])) {
13
// load prerequisites only when required
14
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
16
$username = $_SERVER['PHP_AUTH_USER'];
17
$password = $_SERVER['PHP_AUTH_PW'];
19
// Determine service type for protocol access check
20
$service = 'NONE';
21
$original_uri = isset($_SERVER['HTTP_X_ORIGINAL_URI']) ? $_SERVER['HTTP_X_ORIGINAL_URI'] : '';
22
if (preg_match('/^(\/SOGo|)\/dav.*/', $original_uri) === 1) {
23
$service = 'DAV';
24
}
25
elseif (preg_match('/^(\/SOGo|)\/Microsoft-Server-ActiveSync.*/', $original_uri) === 1) {
26
$service = 'EAS';
27
}
29
$login_check = check_login($username, $password, array('service' => $service));
30
if ($login_check === 'user') {
31
header("X-User: $username");
32
header("X-Auth: Basic ".base64_encode("$username:$password"));
33
header("X-Auth-Type: Basic");
34
exit;
35
} else {
36
header('HTTP/1.0 401 Unauthorized');
37
echo 'Invalid login';
38
exit;
39
}
40
}
41
// check permissions and redirect for direct GET ?login=xy requests
42
elseif (isset($_GET['login'])) {
43
// load prerequisites only when required
44
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
45
// check if dual_login is active
46
$is_dual = (!empty($_SESSION["dual-login"]["username"])) ? true : false;
47
// check permissions (if dual_login is active, deny sso when acl is not given)
48
$login = html_entity_decode(rawurldecode($_GET["login"]));
49
if (isset($_SESSION['mailcow_cc_role']) &&
50
(($_SESSION['acl']['login_as'] == "1" && $ALLOW_ADMIN_EMAIL_LOGIN !== 0) || ($is_dual === false && $login == $_SESSION['mailcow_cc_username']))) {
51
if (filter_var($login, FILTER_VALIDATE_EMAIL)) {
52
if (user_get_alias_details($login) !== false) {
53
// Block SOGo access if pending actions (2FA setup, password update)
54
if (!empty($_SESSION['pending_tfa_setup']) || !empty($_SESSION['pending_pw_update'])) {
55
header("Location: /");
56
exit;
57
}
58
// register username in session
59
$_SESSION[$session_var_user_allowed][] = $login;
60
// set dual login
61
if ($_SESSION['acl']['login_as'] == "1" && $ALLOW_ADMIN_EMAIL_LOGIN !== 0 && $is_dual === false && $_SESSION['mailcow_cc_role'] != "user"){
62
$_SESSION["dual-login"]["username"] = $_SESSION['mailcow_cc_username'];
63
$_SESSION["dual-login"]["role"] = $_SESSION['mailcow_cc_role'];
64
$_SESSION['mailcow_cc_username'] = $login;
65
$_SESSION['mailcow_cc_role'] = "user";
66
}
67
// update sasl logs
68
$stmt = $pdo->prepare("REPLACE INTO sasl_log (`service`, `app_password`, `username`, `real_rip`) VALUES ('SSO', 0, :username, :remote_addr)");
69
$stmt->execute(array(
70
':username' => $login,
71
':remote_addr' => ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR'])
72
));
73
// redirect to sogo (sogo will get the correct credentials via nginx auth_request
74
header("Location: /SOGo/so/");
75
exit;
76
}
77
}
78
}
79
header("Location: /");
80
exit;
81
}
82
// only check for admin-login on sogo GUI requests
83
elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 9), "/SOGo/so/") === 0) {
84
// this is an nginx auth_request call, we check for existing sogo-sso session variables
85
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/vars.inc.php';
86
if (file_exists($_SERVER['DOCUMENT_ROOT'] . '/inc/vars.local.inc.php')) {
87
include_once $_SERVER['DOCUMENT_ROOT'] . '/inc/vars.local.inc.php';
88
}
89
require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/sessions.inc.php';
91
$email_list = array(
92
($_SESSION['mailcow_cc_username'] ?? ''), // Current user
93
($_SESSION["dual-login"]["username"] ?? ''), // Dual login user
94
);
95
foreach($email_list as $email) {
96
// check if this email is in session allowed list
97
if (
98
!empty($email) &&
99
filter_var($email, FILTER_VALIDATE_EMAIL) &&
100
is_array($_SESSION[$session_var_user_allowed]) &&
101
in_array($email, $_SESSION[$session_var_user_allowed]) &&
102
!$_SESSION['pending_pw_update'] &&
103
!$_SESSION['pending_tfa_setup']
104
) {
105
$username = $email;
106
$password = file_get_contents("/etc/sogo-sso/sogo-sso.pass");
107
header("X-User: $username");
108
header("X-Auth: Basic ".base64_encode("$username:$password"));
109
header("X-Auth-Type: Basic");
110
exit;
111
}
112
}
113
}
115
// if username is empty, SOGo will use the normal login methods / login form
116
header("X-User: ");
117
header("X-Auth: ");
118
header("X-Auth-Type: ");