FOSS/mailcow-dockerized
0
0
Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-07-25 09:04:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

add missing object-level access control

Browse Source
This commit is contained in:
FreddleSpl0it
2026-03-19 12:42:45 +01:00
parent 8a65b9d1c6
commit ecb848493b
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data/web/inc/functions.mailbox.inc.php
+8
View File
@@ -2062,6 +2062,14 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
return false; return false;
} }
foreach ($usernames as $username) { foreach ($usernames as $username) {
if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $username)) {
$_SESSION['return'][] = array(
'type' => 'danger',
'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
'msg' => 'access_denied'
);
continue;
}
if ($_data['spam_score'] == "default") { if ($_data['spam_score'] == "default") {
$stmt = $pdo->prepare("DELETE FROM `filterconf` WHERE `object` = :username $stmt = $pdo->prepare("DELETE FROM `filterconf` WHERE `object` = :username
AND (`option` = 'lowspamlevel' OR `option` = 'highspamlevel')"); AND (`option` = 'lowspamlevel' OR `option` = 'highspamlevel')");