Merge pull request #7333 from fallmo/fix/cors-settings-validation

fix: cors allowed origins settings validation
Merge pull request #7358 from SYNLINQ/staging
2026-07-28 18:39:37 +00:00 · 2026-07-28 15:35:29 +02:00 · 2026-07-28 14:40:30 +02:00 · 2026-07-28 14:19:45 +02:00 · 2026-07-28 14:12:57 +02:00 · 2026-07-28 13:49:37 +02:00
32 changed files with 212 additions and 177 deletions
@@ -14,7 +14,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Mark/Close Stale Issues and Pull Requests 🗑️
-        uses: actions/stale@v10.3.0
+        uses: actions/stale@v11.0.0
        with:
          repo-token: ${{ secrets.STALE_ACTION_PAT }}
          days-before-stale: 60
@@ -27,7 +27,7 @@ jobs:
          - "watchdog-mailcow"
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
      - name: Setup Docker
        run: |
          curl -sSL https://get.docker.com/ | CHANNEL=stable sudo sh
@@ -8,11 +8,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Run the Action
-        uses: devops-infra/action-pull-request@v1.2.1
+        uses: devops-infra/action-pull-request@v1.4.0
        with:
          github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }}
          title: Automatic PR to nightly from ${{ github.event.repository.updated_at}}
@@ -13,7 +13,7 @@ jobs:
      packages: write
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
@@ -15,7 +15,7 @@ jobs:
   runs-on: ubuntu-latest
   steps:
    - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7

    - name: Generate postscreen_access.cidr
      run: |
@@ -23,6 +23,9 @@ A big thank you to everyone supporting us on GitHub Sponsors—your contribution
  <a href="https://www.maehdros.com/" target=_blank><img
    src="https://avatars.githubusercontent.com/u/173894712" height="58"
  /></a>
+  <a href="https://garske-systems.de/" target=_blank><img
+    src="https://garske-systems.de/img/logo_min.png" height="58"
+  /></a>

 ### 50$/Month Sponsors
  <a href="https://github.com/vnukhr" target=_blank><img
@@ -1,4 +1,4 @@
-FROM nginx:1.30.2-alpine
+FROM nginx:1.30.4-alpine
 LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"

 ENV PIP_BREAK_SYSTEM_PACKAGES=1
@@ -7,13 +7,13 @@ ARG APCU_PECL_VERSION=5.1.28
 # renovate: datasource=github-tags depName=Imagick/imagick versioning=semver-coerced extractVersion=(?<version>.*)$
 ARG IMAGICK_PECL_VERSION=3.8.1
 # renovate: datasource=github-tags depName=php/pecl-mail-mailparse versioning=semver-coerced extractVersion=^v(?<version>.*)$
-ARG MAILPARSE_PECL_VERSION=3.1.9
+ARG MAILPARSE_PECL_VERSION=3.2.0
 # renovate: datasource=github-tags depName=php-memcached-dev/php-memcached versioning=semver-coerced extractVersion=^v(?<version>.*)$
 ARG MEMCACHED_PECL_VERSION=3.4.0
 # renovate: datasource=github-tags depName=phpredis/phpredis versioning=semver-coerced extractVersion=(?<version>.*)$
 ARG REDIS_PECL_VERSION=6.3.0
 # renovate: datasource=github-tags depName=composer/composer versioning=semver-coerced extractVersion=(?<version>.*)$
-ARG COMPOSER_VERSION=2.9.5
+ARG COMPOSER_VERSION=2.10.2

 RUN apk add -U --no-cache autoconf \
  aspell-dev \
@@ -1,4 +1,4 @@
-FROM debian:bookworm-slim
+FROM debian:trixie-slim

 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

@@ -1,4 +1,4 @@
-@version: 3.38
+@version: 4.8
@include "scl.conf"
 options {
  chain_hostnames(off);
@@ -7,7 +7,7 @@ options {
  dns_cache(no);
  use_fqdn(no);
  owner("root"); group("adm"); perm(0640);
-  stats_freq(0);
+  stats(freq(0));
  bad_hostname("^gconfd$");
 };
 source s_src {
@@ -1,4 +1,4 @@
-@version: 3.38
+@version: 4.8
@include "scl.conf"
 options {
  chain_hostnames(off);
@@ -7,7 +7,7 @@ options {
  dns_cache(no);
  use_fqdn(no);
  owner("root"); group("adm"); perm(0640);
-  stats_freq(0);
+  stats(freq(0));
  bad_hostname("^gconfd$");
 };
 source s_src {
@@ -2,7 +2,7 @@ FROM debian:trixie-slim
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

 ARG DEBIAN_FRONTEND=noninteractive
-ARG RSPAMD_VER=rspamd_3.14.3-1~236eb65
+ARG RSPAMD_VER=rspamd_4.1.0-1~e2b0b18
 ARG CODENAME=trixie
 ENV LC_ALL=C

@@ -1,6 +1,6 @@
 # SOGo built from source to enable security patch application
 # Repository: https://github.com/Alinto/sogo
-# Version: SOGo-5.12.8
+# Version: SOGo-5.12.9
 #
 # Applied security patches:
 # -
@@ -12,8 +12,8 @@ FROM debian:bookworm
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

 ARG DEBIAN_FRONTEND=noninteractive
-ARG SOGO_VERSION=SOGo-5.12.8
-ARG SOPE_VERSION=SOPE-5.12.8
+ARG SOGO_VERSION=SOGo-5.12.9
+ARG SOPE_VERSION=SOPE-5.12.9
 # Security patches to apply (space-separated commit hashes)
 ARG SOGO_SECURITY_PATCHES=""
 # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?<version>.*)$
@@ -47,7 +47,9 @@ http {
    server {
        root /web;
        listen {{ HTTP_PORT }} default_server;
+        {% if ENABLE_IPV6 %}
        listen [::]:{{ HTTP_PORT }} default_server;
+        {%endif%}

        server_name {{ MAILCOW_HOSTNAME }} autodiscover.* autoconfig.* mta-sts.* {{ ADDITIONAL_SERVER_NAMES | join(' ') }};

@@ -37,7 +37,7 @@ postscreen_access_list = permit_mynetworks,
  cidr:/opt/postfix/conf/postscreen_access.cidr,
  tcp:127.0.0.1:10027
 postscreen_bare_newline_enable = no
-postscreen_blacklist_action = drop
+postscreen_denylist_action = drop
 postscreen_cache_cleanup_interval = 24h
 postscreen_cache_map = proxy:btree:$data_directory/postscreen_cache
 postscreen_dnsbl_action = enforce
@@ -107,8 +107,6 @@ smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch,
  reject_unknown_sender_domain
 smtpd_soft_error_limit = 3
 smtpd_tls_auth_only = yes
-smtpd_tls_dh1024_param_file = /etc/ssl/mail/dhparams.pem
-smtpd_tls_eecdh_grade = auto
 smtpd_tls_exclude_ciphers = ECDHE-RSA-RC4-SHA, RC4, aNULL, DES-CBC3-SHA, ECDHE-RSA-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA
 smtpd_tls_loglevel = 1

@@ -29,7 +29,6 @@ smtps    inet  n       -       n       -       -       smtpd
 # TLS protocol can be modified by setting submission_smtpd_tls_mandatory_protocols in extra.cf
 submission inet n       -       n       -       -       smtpd
  -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
-  -o smtpd_enforce_tls=yes
  -o smtpd_tls_security_level=encrypt
  -o smtpd_tls_mandatory_protocols=$submission_smtpd_tls_mandatory_protocols
  -o tls_preempt_cipherlist=yes
@@ -38,7 +37,6 @@ submission inet n       -       n       -       -       smtpd
 10587      inet n       -       n       -       -       smtpd
  -o smtpd_upstream_proxy_protocol=haproxy
  -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
-  -o smtpd_enforce_tls=yes
  -o smtpd_tls_security_level=encrypt
  -o smtpd_tls_mandatory_protocols=$submission_smtpd_tls_mandatory_protocols
  -o tls_preempt_cipherlist=yes
@@ -1,6 +1,6 @@
-# Whitelist generated by Postwhite v3.4 on Fri May  1 00:43:37 UTC 2026
+# Whitelist generated by Postwhite v3.4 on Wed Jul  1 00:51:20 UTC 2026
 # https://github.com/stevejenkins/postwhite/
-# 2249 total rules
+# 2251 total rules
 2a00:1450:4000::/36	permit
 2a00:1450:4864::/56	permit
 2a01:111:f400::/48	permit
@@ -56,14 +56,8 @@
 8.25.194.0/23	permit
 8.25.196.0/23	permit
 8.36.116.0/24	permit
-8.39.54.0/23	permit
-8.39.54.250/31	permit
 8.39.144.0/24	permit
-8.40.222.0/23	permit
-8.40.222.250/31	permit
 12.130.86.238	permit
-13.107.213.40	permit
-13.107.246.40	permit
 13.108.16.0/20	permit
 13.110.208.0/21	permit
 13.110.209.0/24	permit
@@ -73,7 +67,6 @@
 13.111.191.0/24	permit
 13.216.7.111	permit
 13.216.54.180	permit
-13.247.164.219	permit
 15.200.21.50	permit
 15.200.44.248	permit
 15.200.201.185	permit
@@ -177,7 +170,6 @@
 34.215.104.144	permit
 34.218.115.239	permit
 34.225.212.172	permit
-34.241.242.183	permit
 35.83.148.184	permit
 35.155.198.111	permit
 35.158.23.94	permit
@@ -201,7 +193,6 @@
 40.233.64.216	permit
 40.233.83.78	permit
 40.233.88.28	permit
-43.239.212.33	permit
 44.206.138.57	permit
 44.210.169.44	permit
 44.217.45.156	permit
@@ -284,7 +275,6 @@
 51.83.17.38	permit
 52.1.14.157	permit
 52.5.230.59	permit
-52.6.74.205	permit
 52.12.53.23	permit
 52.13.214.179	permit
 52.26.1.71	permit
@@ -341,7 +331,6 @@
 54.244.54.130	permit
 54.244.242.0/24	permit
 54.255.61.23	permit
-56.124.6.228	permit
 57.103.64.0/18	permit
 57.129.93.249	permit
 62.13.128.0/24	permit
@@ -408,7 +397,6 @@
 65.110.161.77	permit
 65.123.29.213	permit
 65.123.29.220	permit
-65.154.166.0/24	permit
 65.212.180.36	permit
 66.102.0.0/20	permit
 66.119.150.192/26	permit
@@ -1222,9 +1210,6 @@
 99.78.197.208/28	permit
 103.9.96.0/22	permit
 103.28.42.0/24	permit
-103.84.217.15	permit
-103.84.217.238	permit
-103.89.75.238	permit
 103.151.192.0/23	permit
 103.168.172.128/27	permit
 103.237.104.0/22	permit
@@ -1385,9 +1370,6 @@
 117.120.16.0/21	permit
 119.42.242.52/31	permit
 119.42.242.156	permit
-121.244.91.48	permit
-121.244.91.52	permit
-122.15.156.182	permit
 123.126.78.64/29	permit
 124.108.96.24/31	permit
 124.108.96.28/31	permit
@@ -1470,21 +1452,7 @@
 134.170.141.64/26	permit
 134.170.143.0/24	permit
 134.170.174.0/24	permit
-135.84.80.0/24	permit
-135.84.81.0/24	permit
-135.84.82.0/24	permit
-135.84.83.0/24	permit
 135.84.216.0/22	permit
-136.143.160.0/24	permit
-136.143.161.0/24	permit
-136.143.162.0/24	permit
-136.143.176.0/24	permit
-136.143.177.0/24	permit
-136.143.178.49	permit
-136.143.182.0/23	permit
-136.143.184.0/24	permit
-136.143.188.0/24	permit
-136.143.190.0/23	permit
 136.146.128.0/20	permit
 136.147.128.0/20	permit
 136.147.135.0/24	permit
@@ -1504,7 +1472,6 @@
 139.138.46.219	permit
 139.138.57.55	permit
 139.138.58.119	permit
-139.167.79.86	permit
 139.177.108.0/25	permit
 139.180.17.0/24	permit
 140.238.148.191	permit
@@ -1554,12 +1521,14 @@
 147.243.128.26	permit
 148.105.0.0/16	permit
 148.105.8.0/21	permit
+148.116.32.128/25	permit
 149.72.0.0/16	permit
 149.72.234.184	permit
 149.72.248.236	permit
 149.97.173.180	permit
 149.118.160.128/25	permit
 150.136.21.199	permit
+150.171.109.183	permit
 150.230.98.160	permit
 151.145.38.14	permit
 152.67.105.195	permit
@@ -1637,8 +1606,9 @@
 164.177.132.168/30	permit
 165.1.100.0/25	permit
 165.173.128.0/24	permit
-165.173.180.1	permit
+165.173.180.0/24	permit
 165.173.180.250/31	permit
+165.173.182.0/24	permit
 165.173.182.250/31	permit
 165.173.189.205	permit
 166.78.68.0/22	permit
@@ -1673,19 +1643,6 @@
 168.245.12.252	permit
 168.245.46.9	permit
 168.245.127.231	permit
-169.148.129.0/24	permit
-169.148.131.0/24	permit
-169.148.138.0/24	permit
-169.148.142.10	permit
-169.148.142.33	permit
-169.148.144.0/25	permit
-169.148.144.10	permit
-169.148.146.0/23	permit
-169.148.174.10	permit
-169.148.175.3	permit
-169.148.179.3	permit
-169.148.188.0/24	permit
-169.148.188.182	permit
 170.9.232.254	permit
 170.10.128.0/24	permit
 170.10.129.0/24	permit
@@ -1700,6 +1657,7 @@
 173.203.81.39	permit
 173.224.161.128/25	permit
 173.224.165.0/26	permit
+173.224.166.48/28	permit
 174.36.84.8/29	permit
 174.36.84.16/29	permit
 174.36.84.32/29	permit
@@ -1891,16 +1849,7 @@
 199.16.156.0/22	permit
 199.33.145.1	permit
 199.33.145.32	permit
-199.34.22.36	permit
 199.59.148.0/22	permit
-199.67.80.2	permit
-199.67.80.20	permit
-199.67.82.2	permit
-199.67.82.20	permit
-199.67.84.0/24	permit
-199.67.86.0/24	permit
-199.67.88.0/24	permit
-199.67.90.0/24	permit
 199.101.161.130	permit
 199.101.162.0/25	permit
 199.122.120.0/21	permit
@@ -1956,8 +1905,6 @@
 204.92.114.187	permit
 204.92.114.203	permit
 204.92.114.204/31	permit
-204.141.32.0/23	permit
-204.141.42.0/23	permit
 204.216.164.202	permit
 204.220.160.0/21	permit
 204.220.168.0/21	permit
@@ -2231,7 +2178,7 @@
 2001:748:400:3301::4	permit
 2404:6800:4000::/36	permit
 2404:6800:4864::/56	permit
-2603:1061:14:72::1	permit
+2603:1061:14:1c2::1	permit
 2607:13c0:0001:0000:0000:0000:0000:7000/116	permit
 2607:13c0:0002:0000:0000:0000:0000:1000/116	permit
 2607:13c0:0004:0000:0000:0000:0000:0000/116	permit
@@ -3,8 +3,7 @@ rules {
    backend = "http";
    url = "http://nginx:9081/pipe.php";
    selector = "reject_no_global_bl";
-    formatter = "default";
-    meta_headers = true;
+    formatter = "multipart";
  }
 	RLINFO {
 		backend = "http";
@@ -16,8 +15,7 @@ rules {
    backend = "http";
    url = "http://nginx:9081/pushover.php";
    selector = "mailcow_rcpt";
-    formatter = "json";
-    meta_headers = true;
+    formatter = "multipart";
  }
 }

@@ -32,47 +32,42 @@ function parse_email($email) {
  $a = strrpos($email, '@');
  return array('local' => substr($email, 0, $a), 'domain' => substr(substr($email, $a), 1));
 }
-if (!function_exists('getallheaders'))  {
-  function getallheaders() {
-    if (!is_array($_SERVER)) {
-      return array();
-    }
-    $headers = array();
-    foreach ($_SERVER as $name => $value) {
-      if (substr($name, 0, 5) == 'HTTP_') {
-        $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
-      }
-    }
-    return $headers;
-  }
+// rspamd metadata_exporter (multipart formatter):
+//   - $_POST['metadata']        JSON with the rspamd metadata
+//   - $_FILES['message']        raw RFC822 message
+if (empty($_POST['metadata']) || !isset($_FILES['message']) || $_FILES['message']['error'] !== UPLOAD_ERR_OK) {
+  error_log("QUARANTINE: missing multipart parts from rspamd" . PHP_EOL);
+  http_response_code(400);
+  exit;
 }

-$raw_data_content = file_get_contents('php://input');
+$meta = json_decode($_POST['metadata'], true);
+if (!is_array($meta)) {
+  error_log("QUARANTINE: cannot decode metadata JSON" . PHP_EOL);
+  http_response_code(400);
+  exit;
+}
+
+$raw_data_content = file_get_contents($_FILES['message']['tmp_name']);
 $raw_data = mb_convert_encoding($raw_data_content, 'HTML-ENTITIES', "UTF-8");
-$headers = getallheaders();
+$raw_size = (int)$_FILES['message']['size'];

-$qid      = $headers['X-Rspamd-Qid'];
-$fuzzy    = $headers['X-Rspamd-Fuzzy'];
-$subject  = iconv_mime_decode($headers['X-Rspamd-Subject']);
-$score    = $headers['X-Rspamd-Score'];
-$rcpts    = $headers['X-Rspamd-Rcpt'];
-$user     = $headers['X-Rspamd-User'];
-$ip       = $headers['X-Rspamd-Ip'];
-$action   = $headers['X-Rspamd-Action'];
-$sender   = $headers['X-Rspamd-From'];
-$symbols  = $headers['X-Rspamd-Symbols'];
-
-$raw_size = (int)$_SERVER['CONTENT_LENGTH'];
+$qid      = $meta['qid']     ?? 'unknown';
+$subject  = $meta['subject'] ?? '';
+$score    = $meta['score']   ?? 0;
+$rcpts    = $meta['rcpt']    ?? array();
+$user     = $meta['user']    ?? 'unknown';
+$ip       = $meta['ip']      ?? 'unknown';
+$action   = $meta['action']  ?? 'no action';
+$sender   = $meta['from']    ?? '';
+$symbols  = json_encode($meta['symbols'] ?? array());
+$fuzzy    = json_encode(is_array($meta['fuzzy'] ?? null) ? $meta['fuzzy'] : array());

 if (empty($sender)) {
  error_log("QUARANTINE: Unknown sender, assuming empty-env-from@localhost" . PHP_EOL);
  $sender = 'empty-env-from@localhost';
 }

-if ($fuzzy == 'unknown') {
-  $fuzzy = '[]';
-}
-
 try {
  $max_size = (int)$redis->Get('Q_MAX_SIZE');
  if (($max_size * 1048576) < $raw_size) {
@@ -94,7 +89,7 @@ catch (RedisException $e) {
 $rcpt_final_mailboxes = array();

 // Loop through all rcpts
-foreach (json_decode($rcpts, true) as $rcpt) {
+foreach ($rcpts as $rcpt) {
  // Remove tag
  $rcpt = preg_replace('/^(.*?)\+.*(@.*)$/', '$1$2', $rcpt);

@@ -32,50 +32,46 @@ function parse_email($email) {
  $a = strrpos($email, '@');
  return array('local' => substr($email, 0, $a), 'domain' => substr(substr($email, $a), 1));
 }
-if (!function_exists('getallheaders'))  {
-  function getallheaders() {
-    if (!is_array($_SERVER)) {
-      return array();
-    }
-    $headers = array();
-    foreach ($_SERVER as $name => $value) {
-      if (substr($name, 0, 5) == 'HTTP_') {
-        $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
-      }
-    }
-    return $headers;
-  }
+// rspamd metadata_exporter (multipart formatter): metadata JSON arrives as $_POST['metadata'].
+if (empty($_POST['metadata'])) {
+  error_log("NOTIFY: missing metadata part from rspamd" . PHP_EOL);
+  http_response_code(400);
+  exit;
 }

-$headers = getallheaders();
-$json_body = json_decode(file_get_contents('php://input'));
+$meta = json_decode($_POST['metadata'], true);
+if (!is_array($meta)) {
+  error_log("NOTIFY: cannot decode metadata JSON" . PHP_EOL);
+  http_response_code(400);
+  exit;
+}

-$qid      = $headers['X-Rspamd-Qid'];
-$rcpts    = $headers['X-Rspamd-Rcpt'];
-$sender   = $headers['X-Rspamd-From'];
-$ip       = $headers['X-Rspamd-Ip'];
-$subject  = iconv_mime_decode($headers['X-Rspamd-Subject']);
-$messageid= $json_body->message_id;
+$qid      = $meta['qid']    ?? 'unknown';
+$rcpts    = $meta['rcpt']   ?? array();
+$sender   = $meta['from']   ?? '';
+$ip       = $meta['ip']     ?? 'unknown';
+$subject  = $meta['subject'] ?? '';
+$messageid= $meta['message_id'] ?? '';
 $priority = 0;

-$symbols_array = json_decode($headers['X-Rspamd-Symbols'], true);
+$symbols_array = $meta['symbols'] ?? array();
 if (is_array($symbols_array)) {
  foreach ($symbols_array as $symbol) {
-    if ($symbol['name'] == 'HAS_X_PRIO_ONE') {
+    if (($symbol['name'] ?? null) == 'HAS_X_PRIO_ONE') {
      $priority = 1;
      break;
    }
  }
 }

-$sender_address = $json_body->header_from[0];
+$sender_address = $meta['header_from'][0] ?? '';
 $sender_name = '-';
 if (preg_match('/(?<name>.*?)<(?<address>.*?)>/i', $sender_address, $matches)) {
 	$sender_address = $matches['address'];
  $sender_name =  trim($matches['name'], '"\' ');
 }

-$to_address = $json_body->header_to[0];
+$to_address = $meta['header_to'][0] ?? '';
 $to_name = '-';
 if (preg_match('/(?<name>.*?)<(?<address>.*?)>/i', $to_address, $matches)) {
 	$to_address = $matches['address'];
@@ -85,7 +81,7 @@ if (preg_match('/(?<name>.*?)<(?<address>.*?)>/i', $to_address, $matches)) {
 $rcpt_final_mailboxes = array();

 // Loop through all rcpts
-foreach (json_decode($rcpts, true) as $rcpt) {
+foreach ($rcpts as $rcpt) {
  // Remove tag
  $rcpt = preg_replace('/^(.*?)\+.*(@.*)$/', '$1$2', $rcpt);

@@ -185,6 +185,9 @@ paths:
              example:
                username: info@domain.tld
                domain: domain.tld
+                description: my time limited alias
+                validity: 8760
+                permanent: false
              properties:
                username:
                  description: 'the mailbox an alias should be created for'
@@ -192,6 +195,15 @@ paths:
                domain:
                  description: "the domain"
                  type: string
+                description:
+                  description: "a description for the alias, defaults to an empty string"
+                  type: string
+                validity:
+                  description: "how many hours the alias stays valid, 1 to 87600, defaults to 8760 (one year)"
+                  type: integer
+                permanent:
+                  description: "keep the alias after it expired, defaults to false"
+                  type: boolean
              type: object
      summary: Create time limited alias
  /api/v1/add/app-passwd:
@@ -1072,6 +1084,7 @@ paths:
                          password2: "*"
                          quota: "3072"
                          force_pw_update: "1"
+                          force_tfa: "1"
                          tls_enforce_in: "1"
                          tls_enforce_out: "1"
                          tags: ["tag1", "tag2"]
@@ -1118,6 +1131,7 @@ paths:
                password2: atedismonsin
                quota: "3072"
                force_pw_update: "1"
+                force_tfa: "1"
                tls_enforce_in: "1"
                tls_enforce_out: "1"
                tags: ["tag1", "tag2"]
@@ -1151,6 +1165,9 @@ paths:
                force_pw_update:
                  description: forces the user to update its password on first login
                  type: boolean
+                force_tfa:
+                  description: force 2FA enrollment at login
+                  type: boolean
                tls_enforce_in:
                  description: force inbound email tls encryption
                  type: boolean
@@ -2510,7 +2527,7 @@ paths:
      description: >-
        Using this endpoint you can perform actions on quarantine items. It is possible to release
        emails from quarantine into to the inbox, or learn them as ham to improve Rspamd filtering.
-        You must provide the quarantine item IDs. You can get the IDs using the GET method.      
+        You must provide the quarantine item IDs. You can get the IDs using the GET method.
      operationId: Edit mails in Quarantine
      requestBody:
        content:
@@ -3414,6 +3431,7 @@ paths:
                        - mailbox
                        - active: "1"
                          force_pw_update: "0"
+                          force_tfa: "0"
                          name: Full name
                          password: "*"
                          password2: "*"
@@ -3464,6 +3482,7 @@ paths:
                attr:
                  active: "1"
                  force_pw_update: "0"
+                  force_tfa: "0"
                  name: Full name
                  authsource: mailcow
                  password: ""
@@ -3487,6 +3506,9 @@ paths:
                    force_pw_update:
                      description: force user to change password on next login
                      type: boolean
+                    force_tfa:
+                      description: force 2FA enrollment at login
+                      type: boolean
                    name:
                      description: Full name of the mailbox user
                      type: string
@@ -4881,6 +4903,7 @@ paths:
                    - active: "1"
                      attributes:
                        force_pw_update: "0"
+                        force_tfa: "0"
                        mailbox_format: "maildir:"
                        quarantine_notification: never
                        sogo_access: "1"
@@ -4897,6 +4920,7 @@ paths:
                      quota: 3221225472
                      quota_used: 0
                      rl: false
+                      sender_acl: ["otherbox@doman3.tld", "@aliasdomain.tld"]
                      spam_aliases: 0
                      username: info@doman3.tld
                      tags: ["tag1", "tag2"]
@@ -5805,6 +5829,7 @@ paths:
                    - active: "1"
                      attributes:
                        force_pw_update: "0"
+                        force_tfa: "0"
                        mailbox_format: "maildir:"
                        quarantine_notification: never
                        sogo_access: "1"
@@ -5822,6 +5847,7 @@ paths:
                      quota: 3221225472
                      quota_used: 0
                      rl: false
+                      sender_acl: ["otherbox@domain3.tld", "@aliasdomain.tld"]
                      spam_aliases: 0
                      username: info@domain3.tld
                      tags: ["tag1", "tag2"]
@@ -5844,7 +5870,7 @@ paths:
                response:
                  value:
                    - type: "success"
-                      log: ["cors", "edit", {"allowed_origins": ["*", "mail.mailcow.tld"], "allowed_methods": ["POST", "GET", "DELETE", "PUT"]}]
+                      log: ["cors", "edit", {"allowed_origins": ["*", "https://mail.mailcow.tld"], "allowed_methods": ["POST", "GET", "DELETE", "PUT"]}]
                      msg: "cors_headers_edited"
          description: OK
          headers: { }
@@ -5861,7 +5887,7 @@ paths:
            schema:
              example:
                attr:
-                  allowed_origins: ["*", "mail.mailcow.tld"]
+                  allowed_origins: ["*", "https://mail.mailcow.tld"]
                  allowed_methods: ["POST", "GET", "DELETE", "PUT"]
              properties:
                attr:
@@ -53,6 +53,28 @@ function valid_network($network) {
 function valid_hostname($hostname) {
  return filter_var($hostname, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME);
 }
+// Validates a browser-style Origin: scheme://host[:port], no path/query/fragment/credentials
+function valid_origin($origin) {
+  $parts = parse_url($origin);
+  if ($parts === false || !isset($parts['scheme']) || !isset($parts['host'])) {
+    return false;
+  }
+  if (!in_array(strtolower($parts['scheme']), array('http', 'https'), true)) {
+    return false;
+  }
+  if (isset($parts['user']) || isset($parts['pass']) || isset($parts['path']) || isset($parts['query']) || isset($parts['fragment'])) {
+    return false;
+  }
+  $host = $parts['host'];
+  $host_without_brackets = trim($host, '[]');
+  if (!valid_hostname($host_without_brackets) && !filter_var($host_without_brackets, FILTER_VALIDATE_IP)) {
+    return false;
+  }
+  // Reject anything that doesn't round-trip to the exact same origin (e.g. stray trailing slash)
+  $port = isset($parts['port']) ? ':' . $parts['port'] : '';
+  $rebuilt = strtolower($parts['scheme']) . '://' . strtolower($host) . $port;
+  return strtolower($origin) === $rebuilt;
+}
 // Thanks to https://stackoverflow.com/a/49373789
 // Validates exact ip matches and ip-in-cidr, ipv4 and ipv6
 function ip_acl($ip, $networks) {
@@ -2283,10 +2305,13 @@ function cors($action, $data = null) {
        return false;
      }

-      $allowed_origins = isset($data['allowed_origins']) ? $data['allowed_origins'] : array($_SERVER['SERVER_NAME']);
+      $allowed_origins = isset($data['allowed_origins']) ? $data['allowed_origins'] : array(getBaseURL());
      $allowed_origins = !is_array($allowed_origins) ? array_filter(array_map('trim', explode("\n", $allowed_origins))) : $allowed_origins;
-      foreach ($allowed_origins as $origin) {
-        if (!filter_var($origin, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) && $origin != '*') {
+      foreach ($allowed_origins as &$origin) {
+        if ($origin === '*') {
+          continue;
+        }
+        if (!valid_origin($origin)) {
          $_SESSION['return'][] = array(
            'type' => 'danger',
            'log' => array(__FUNCTION__, $action, $data),
@@ -2294,7 +2319,10 @@ function cors($action, $data = null) {
          );
          return false;
        }
+        // browsers always send a lowercase scheme/host in the Origin header, so normalize to match
+        $origin = strtolower($origin);
      }
+      unset($origin);

      $allowed_methods = isset($data['allowed_methods']) ? $data['allowed_methods'] : array('GET', 'POST', 'PUT', 'DELETE');
      $allowed_methods  = !is_array($allowed_methods) ? array_map('trim', preg_split( "/( |,|;|\n)/", $allowed_methods)) : $allowed_methods;
@@ -41,13 +41,15 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          else {
            $username = $_SESSION['mailcow_cc_username'];
          }
-          if (isset($_data["validity"]) && !filter_var($_data["validity"], FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 87600)))) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => 'validity_missing'
-            );
-            return false;
+          if (isset($_data["validity"])) {
+            if (!filter_var($_data["validity"], FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 87600)))) {
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => 'validity_missing'
+              );
+              return false;
+            }
          }
          else {
            // Default to 1 yr
@@ -60,7 +62,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $permanent = 0;
          }
          $domain = $_data['domain'];
-          $description = $_data['description'];
+          // spamalias.description is NOT NULL, an absent description must not become a null insert
+          $description = $_data['description'] ?? '';
          $valid_domains[] = mailbox('get', 'mailbox_details', $username)['domain'];
          $valid_alias_domains = user_get_alias_details($username)['alias_domains'];
          if (!empty($valid_alias_domains)) {
@@ -3505,7 +3508,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            // Track affected mailboxes for SOGo update
            $update_sogo_mailboxes[] = $username;
          }
-          return true;
        break;
        case 'mailbox_rename':
          $domain = $_data['domain'];
@@ -3828,6 +3830,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $attr["rl_frame"]                    = (!empty($_data['rl_frame'])) ? $_data['rl_frame'] : $is_now['rl_frame'];
            $attr["rl_value"]                    = (!empty($_data['rl_value'])) ? $_data['rl_value'] : $is_now['rl_value'];
            $attr["force_pw_update"]             = isset($_data['force_pw_update']) ? intval($_data['force_pw_update']) : $is_now['force_pw_update'];
+            $attr["force_tfa"]                   = isset($_data['force_tfa']) ? intval($_data['force_tfa']) : $is_now['force_tfa'];
            $attr["sogo_access"]                 = isset($_data['sogo_access']) ? intval($_data['sogo_access']) : $is_now['sogo_access'];
            $attr["active"]                      = isset($_data['active']) ? intval($_data['active']) : $is_now['active'];
            $attr["tls_enforce_in"]              = isset($_data['tls_enforce_in']) ? intval($_data['tls_enforce_in']) : $is_now['tls_enforce_in'];
@@ -5320,6 +5323,14 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              $mailboxdata['rl_scope'] = 'domain';
            }
            $mailboxdata['is_relayed'] = $row['backupmx'];
+            // Internal send-as ACL for this mailbox, mirrors the sender_acl field accepted by edit/mailbox
+            $mailboxdata['sender_acl'] = array();
+            $stmt = $pdo->prepare("SELECT `send_as` FROM `sender_acl` WHERE `logged_in_as` = :username AND `external` = '0'");
+            $stmt->execute(array(':username' => $_data));
+            $sender_acl_rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
+            foreach ($sender_acl_rows as $sender_acl_row) {
+              $mailboxdata['sender_acl'][] = $sender_acl_row['send_as'];
+            }
          }
          $stmt = $pdo->prepare("SELECT `tag_name`
            FROM `tags_mailbox` WHERE `username`= :username");
@@ -6127,7 +6138,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            // Track affected mailboxes for SOGo update
            $update_sogo_mailboxes[] = $username;
          }
-          return true;
        break;
        case 'mailbox_templates':
          if ($_SESSION['mailcow_cc_role'] != "admin") {
@@ -424,6 +424,11 @@ $(document).ready(function() {
    } else {
      $('#force_pw_update').prop('checked', false);
    }
+    if (template.force_tfa == 1){
+      $('#force_tfa').prop('checked', true);
+    } else {
+      $('#force_tfa').prop('checked', false);
+    }
    if (template.sogo_access == 1){
      $('#sogo_access').prop('checked', true);
    } else {
@@ -1242,6 +1247,7 @@ jQuery(function($){
            item.attributes.eas_access = '<i class="text-' + (item.attributes.eas_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.eas_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.eas_access == 1 ? '1' : '0') + '</span></i>';
            item.attributes.dav_access = '<i class="text-' + (item.attributes.dav_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.dav_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.dav_access == 1 ? '1' : '0') + '</span></i>';
            item.attributes.sogo_access = '<i class="text-' + (item.attributes.sogo_access == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.sogo_access == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.sogo_access == 1 ? '1' : '0') + '</span></i>';
+            item.attributes.force_tfa = '<i class="text-' + (item.attributes.force_tfa == 1 ? 'success' : 'danger') + ' bi bi-' + (item.attributes.force_tfa == 1 ? 'check-lg' : 'x-lg') + '"><span class="sorting-value">' + (item.attributes.force_tfa == 1 ? '1' : '0') + '</span></i>';
            if (item.attributes.quarantine_notification === 'never') {
              item.attributes.quarantine_notification = lang.never;
            } else if (item.attributes.quarantine_notification === 'hourly') {
@@ -1385,6 +1391,11 @@ jQuery(function($){
            return 1==data?'<i class="bi bi-check-lg"></i>':'<i class="bi bi-x-lg"></i>';
          }
        },
+        {
+          title: lang.force_tfa,
+          data: 'attributes.force_tfa',
+          defaultContent: ''
+        },
        {
          title: lang_edit.ratelimit,
          data: 'attributes.ratelimit',
@@ -1086,7 +1086,7 @@
        "rspamd_result": "Rspamd-Ergebnis",
        "sender": "Sender (SMTP)",
        "sender_header": "Sender (\"From\"-Header)",
-        "settings_info": "Maximale Anzahl der zurückgehaltenen E-Mails: %s<br>Maximale Größe einer zu speichernden E-Mail: %s MiB",
+        "settings_info": "Maximale Anzahl der zurückgehaltenen E-Mails (pro Mailbox): %s<br>Maximale Größe einer zu speichernden E-Mail: %s MiB",
        "show_item": "Details",
        "spam": "Spam",
        "spam_score": "Bewertung",
@@ -929,6 +929,7 @@
        "filters": "Filters",
        "fname": "Full name",
        "force_pw_update": "Force password update at next login",
+        "force_tfa": "TFA",
        "gal": "Global Address List",
        "goto_ham": "Learn as <b>ham</b>",
        "goto_spam": "Learn as <b>spam</b>",
@@ -1086,7 +1087,7 @@
        "rspamd_result": "Rspamd result",
        "sender": "Sender (SMTP)",
        "sender_header": "Sender (\"From\" header)",
-        "settings_info": "Maximum amount of elements to be quarantined: %s<br>Maximum email size: %s MiB",
+        "settings_info": "Maximum amount of elements to be quarantined (per mailbox): %s<br>Maximum email size: %s MiB",
        "show_item": "Show item",
        "spam": "Spam",
        "spam_score": "Score",
@@ -111,7 +111,8 @@
        "app_passwd_protocols": "Protocoles autorisés pour le mot de passe de l'application",
        "dry": "Simuler la synchronisation",
        "internal": "Interne",
-        "internal_info": "Les alias internes sont accessibles uniquement depuis le domaine ou les alias du domaine."
+        "internal_info": "Les alias internes sont accessibles uniquement depuis le domaine ou les alias du domaine.",
+        "sender_allowed": "Autoriser l'envoi sous cet alias"
    },
    "admin": {
        "access": "Accès",
@@ -556,7 +557,9 @@
        "max_age_invalid": "L'âge maximum %s est invalide",
        "mode_invalid": "Le mode %s est invalide",
        "mx_invalid": "L'enregistrement MX %s est invalide",
-        "version_invalid": "La version %s est invalide"
+        "version_invalid": "La version %s est invalide",
+        "tfa_removal_blocked": "L’authentification à deux facteurs ne peut pas être supprimée, car elle est requise pour votre compte.",
+        "quarantine_category_invalid": "La catégorie de quarantaine doit être l’une des suivantes : add_header, reject, all\""
    },
    "debug": {
        "chart_this_server": "Graphique (ce serveur)",
@@ -755,7 +758,9 @@
        "mta_sts_info": "<a href='https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#SMTP_MTA_Strict_Transport_Security' target='_blank'>MTA-STS</a> est un standard qui oblige la délivrance des courriels entre les serveurs de courriels à utiliser TLS avec des certificats valides. <br>Il est utilisé quand <a target='_blank' href='https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities'>DANE</a> n'est pas possible à cause d'un manque ou d'un non support de DNSSEC.<br><b>Note</b> : Si le domaine du destinataire supporte DANE avec DNSSEC, DANE est <b>toujours</b> préféré – MTA-STS sert seulement en secours.",
        "mta_sts_mode_info": "Il y a trois modes parmi lesquels choisir :<ul><li><em>testing</em> – la politique est seulement surveillée, les violations n'ont pas d'impact.</li><li><em>enforce</em> – la politique est appliquée strictement, les connexions sans TLS valide sont rejetées.</li><li><em>none</em> – la politique est publiée mais non appliquée.</li></ul>",
        "mta_sts_max_age_info": "Durée en secondes pendant laquelle les serveurs de courriel peuvent mettre en cache cette politique avant de revérifier.",
-        "mta_sts_mx_info": "Autoriser l'envoi uniquement aux noms d'hôtes des serveurs de courriels indiqués explicitement ; le MTA émetteur vérifie si le nom d'hôte DNS du MX correspond à la liste de la politique, et autorise la délivrance seulement avec un certificat TLS valide (protège contre le MITM)."
+        "mta_sts_mx_info": "Autoriser l'envoi uniquement aux noms d'hôtes des serveurs de courriels indiqués explicitement ; le MTA émetteur vérifie si le nom d'hôte DNS du MX correspond à la liste de la politique, et autorise la délivrance seulement avec un certificat TLS valide (protège contre le MITM).",
+        "sender_allowed": "Autoriser l'envoi sous cet alias",
+        "sender_allowed_info": "Si cette option est désactivée, cet alias peut uniquement recevoir des courriels. Utilisez les ACL d’expéditeur pour autoriser certaines boîtes aux lettres à envoyer des messages via cet alias."
    },
    "footer": {
        "cancel": "Annuler",
@@ -988,7 +993,8 @@
        "recipient": "Destinataire",
        "open_logs": "Afficher les journaux",
        "iam": "Fournisseur d'identité",
-        "internal": "Interne"
+        "internal": "Interne",
+        "force_tfa": "TFA"
    },
    "oauth2": {
        "access_denied": "Veuillez vous connecter en tant que propriétaire de la boîte de réception pour accorder l’accès via Oauth2.",
@@ -1189,7 +1195,11 @@
        "yubi_otp": "Authentification OTP Yubico",
        "authenticators": "Authentificateurs",
        "u2f_deprecated_important": "Veuillez enregistrer votre clé dans le panneau d'administration avec la nouvelle méthode WebAuthn.",
-        "u2f_deprecated": "Il semble que votre clé ait été enregistrée à l'aide de la méthode U2F obsolète. Nous allons désactiver l'authentification à deux facteurs pour vous et supprimer votre clé."
+        "u2f_deprecated": "Il semble que votre clé ait été enregistrée à l'aide de la méthode U2F obsolète. Nous allons désactiver l'authentification à deux facteurs pour vous et supprimer votre clé.",
+        "force_tfa": "Imposer l'authentification à deux facteurs lors de la connexion",
+        "force_tfa_info": "L’utilisateur doit configurer l’authentification à deux facteurs avant de pouvoir accéder à l’interface.",
+        "setup_title": "Authentification à deux facteurs requise",
+        "setup_required": "Votre compte nécessite l’authentification à deux facteurs. Veuillez configurer une méthode 2FA pour continuer."
    },
    "fido2": {
        "set_fn": "Définir un nom",
@@ -1378,7 +1388,8 @@
        "forever": "Pour toujours",
        "spam_aliases_info": "Un alias de spam est une adresse de courriel temporaire qui peut être utilisée pour protéger les véritables adresses de courriel. <br> De manière optionnelle, une durée d'expiration peut être définie afin que l'alias soit automatiquement désactivé après la période définie, éliminant ainsi les adresses étant abusées ou ayant fuité.",
        "authentication": "Authentification",
-        "protocols": "Protocoles"
+        "protocols": "Protocoles",
+        "pw_update_required": "Votre compte nécessite un changement de mot de passe. Veuillez définir un nouveau mot de passe pour continuer."
    },
    "warning": {
        "cannot_delete_self": "Impossible de supprimer l’utilisateur connecté",
@@ -1001,7 +1001,8 @@
        "weekly": "Tedensko",
        "sieve_info": "Na uporabnika lahko shranite več filtrov, vendar je lahko hkrati aktiven le en predfilter in en postfilter.<br>\nVsak filter bo obdelan v opisanem vrstnem redu. Niti neuspešen skript niti izdan ukaz »keep;« ne bosta ustavila obdelave nadaljnjih skript. Spremembe globalnih skriptov sita bodo sprožile ponovni zagon Dovecota.<br><br>Globalni predfilter sita &#8226; Predfilter &#8226; Uporabniški skripti &#8226; Postfilter &#8226; Globalni postfilter sita",
        "tls_policy_maps_info": "Ta preslikava pravilnikov preglasi pravila odhodnega prenosa TLS neodvisno od uporabnikovih nastavitev pravilnikov TLS.<br>\n  Za več informacij preverite <a href=\"http://www.postfix.org/postconf.5.html#smtp_tls_policy_maps\" target=\"_blank\">dokumentacijo »smtp_tls_policy_maps«</a>.",
-        "internal": "Notranje"
+        "internal": "Notranje",
+        "force_tfa": "TFA"
    },
    "fido2": {
        "known_ids": "Znani ID-ji",
@@ -65,6 +65,7 @@ if (isset($_GET['app_password'])) {
      $attr['protocols'][] = 'dav_access';
  }
  app_passwd("add", $attr);
+  $password = htmlspecialchars($password, ENT_NOQUOTES);
 } else {
  $app_password = false;
 }
@@ -8,6 +8,7 @@

    <input type="hidden" value="default" name="sender_acl">
    <input type="hidden" value="0" name="force_pw_update">
+    <input type="hidden" value="0" name="force_tfa">
    <input type="hidden" value="0" name="sogo_access">
    <input type="hidden" value="0" name="protocol_access">

@@ -165,6 +166,14 @@
        </div>
      </div>
    </div>
+    <div class="row">
+      <div class="offset-sm-2 col-sm-10">
+        <div class="form-check">
+          <label><input type="checkbox" class="form-check-input" value="1" name="force_tfa" id="force_tfa"{% if template.attributes.force_tfa == '1' %} checked{% endif %}> {{ lang.tfa.force_tfa }}</label>
+          <small class="text-muted">{{ lang.tfa.force_tfa_info }}</small>
+        </div>
+      </div>
+    </div>
    {% if not skip_sogo %}
    <div class="row">
      <div class="offset-sm-2 col-sm-10">
@@ -84,7 +84,7 @@ services:
            - clamd

    rspamd-mailcow:
-      image: ghcr.io/mailcow/rspamd:3.14.3-1
+      image: ghcr.io/mailcow/rspamd:4.1.0-1
      stop_grace_period: 30s
      depends_on:
        - dovecot-mailcow
@@ -117,7 +117,7 @@ services:
            - rspamd

    php-fpm-mailcow:
-      image: ghcr.io/mailcow/phpfpm:8.2.29-2
+      image: ghcr.io/mailcow/phpfpm:8.2.29-3
      command: "php-fpm -d date.timezone=${TZ} -d expose_php=0"
      depends_on:
        - redis-mailcow
@@ -200,7 +200,7 @@ services:
            - phpfpm

    sogo-mailcow:
-      image: ghcr.io/mailcow/sogo:5.12.8-1
+      image: ghcr.io/mailcow/sogo:5.12.9-1
      environment:
        - DBNAME=${DBNAME}
        - DBUSER=${DBUSER}
@@ -339,7 +339,7 @@ services:
            - dovecot

    postfix-mailcow:
-      image: ghcr.io/mailcow/postfix:3.7.11-2
+      image: ghcr.io/mailcow/postfix:3.10.12-1
      depends_on:
        mysql-mailcow:
          condition: service_started
@@ -419,7 +419,7 @@ services:
        - php-fpm-mailcow
        - sogo-mailcow
        - rspamd-mailcow
-      image: ghcr.io/mailcow/nginx:1.30.2-1
+      image: ghcr.io/mailcow/nginx:1.30.4
      dns:
        - ${IPV4_NETWORK:-172.22.1}.254
      environment:
@@ -25,6 +25,6 @@ services:
        - /var/run/mysqld/mysqld.sock:/var/run/mysqld/mysqld.sock

    mysql-mailcow:
-      image: alpine:3.23
+      image: alpine:3.24
      command: /bin/true
      restart: "no"
Author	SHA1	Message	Date
FreddleSpl0it	f4961c4023	Merge pull request #7333 from fallmo/fix/cors-settings-validation fix: cors allowed origins settings validation	2026-07-28 15:35:29 +02:00
FreddleSpl0it	38de21592c	Merge pull request #7358 from SYNLINQ/staging Fix nginx CVE-2026-42533	2026-07-28 14:40:30 +02:00
FreddleSpl0it	f44bd2f36a	[Web] document sender_acl in get/mailbox API examples	2026-07-28 14:19:45 +02:00
FreddleSpl0it	95a77f2dcb	Merge pull request #7348 from smpaz7467/fix/api-get-mailbox-sender-acl [Web] return sender_acl in get/mailbox API	2026-07-28 14:12:57 +02:00
FreddleSpl0it	e856510fb2	Merge pull request #7345 from smpaz7467/fix/time-limited-alias-api [Web] fix add/time_limited_alias silently discarding requests and validity	2026-07-28 13:49:37 +02:00
FreddleSpl0it	d51d06d716	Merge pull request #7343 from smpaz7467/fix/nginx-ipv6-default-server [Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set	2026-07-28 13:35:17 +02:00
renovate[bot]	b4bb1a625b	Update actions/stale action to v11 (#7375 )	2026-07-28 11:07:20 +02:00
FreddleSpl0it	2e5a29bf69	Merge pull request #7367 from oidipos/fix/quarantine-subject fix: restore subject display in quarantine overview	2026-07-28 10:54:23 +02:00
oidipos	c877fdf0a5	fix: remove MIME decoding of JSON encoded subject Since moving to rspamd's multipart metadata_exporter, `subject` is a JSON encoded UTF-8 string and must not be MIME decoded.	2026-07-24 21:03:00 +02:00
SYNLINQ	8c9524a2fe	Update docker-compose.yml reference patched nginx image	2026-07-20 21:32:57 +02:00
SYNLINQ	2ebd32d2ee	Update Dockerfile bump nginx version to 1.30.4	2026-07-20 21:31:57 +02:00
FreddleSpl0it	4b62af9d02	update README.md sponsors	2026-07-15 08:29:46 +02:00
Stephen Ritz	14772c3a20	[Web] return sender_acl in get/mailbox API sender_acl can be set through edit/mailbox but was never returned by get/mailbox, so an API client could not read back what it had written, and get/mailbox/all / get/mailbox/{mailbox} both omitted it. Add the mailbox's internal send-as ACL (the sender_acl table rows with external = 0) to mailbox_details as sender_acl, an array of send_as values, mirroring the field edit/mailbox accepts. It is added in the same block as the other detailed fields, so the lightweight get/mailbox/reduced endpoint is unaffected. Fixes #7011 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-14 16:36:40 -07:00
Stephen Ritz	c17cc8a792	[Web] fix add/time_limited_alias silently discarding requests and validity Three defects in add/time_limited_alias: The description was read as $_data['description'] without a guard. When a client omits it, null is bound to spamalias.description, which is TEXT NOT NULL, so the insert raises a PDOException. The global exception handler is terminal, so process_add_return() never echoes anything and the caller sees HTTP 200 with an empty body while no alias was created. Default it to an empty string instead. The validity guard used a single condition whose else branch also caught the success case, so every valid validity was overwritten with the 8760 hour default and the parameter did nothing. Only invalid values were rejected. Nest the range check so a valid value survives. The OpenAPI spec documented only username and domain, while the code also reads description, validity and permanent. Spec driven clients therefore could not construct a working request. Document all three. spamalias.description is the only NOT NULL description column in the schema, which is why the same unguarded read in add/domain and add/resource does not fail, both of those columns are nullable. This does not change the generic exception handling. A database error is still swallowed into an empty HTTP 200, and the message the handler builds carries the raw PDOException, so surfacing it to API clients would need sanitising first. That is left for a separate change. Refs #7287 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-14 15:23:31 -07:00
Stephen Ritz	7dab6c63d1	[Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set The HTTP-to-HTTPS redirect server block bound `listen [::]:{{ HTTP_PORT }} default_server` unconditionally, while every other IPv6 listen directive in this template is guarded by `{% if ENABLE_IPV6 %}`. On hosts where IPv6 is disabled at the kernel level, nginx cannot bind `::` and fails to start. This only triggers when HTTP_REDIRECT is enabled and ENABLE_IPV6 is false, which is why it survives testing with ENABLE_IPV6=false alone. Guard the directive like the other six IPv6 listeners in the template. Refs #7296 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-14 14:54:28 -07:00
Mohamed Fall	6f7fee49cd	fix: cors allowed origins settings validation	2026-07-13 15:29:48 +00:00
FreddleSpl0it	c1d75cf808	Merge pull request #7312 from mailcow/renovate/composer-composer-2.x Update dependency composer/composer to v2.10.2	2026-07-13 09:40:58 +02:00
FreddleSpl0it	473fe2885d	Merge pull request #7326 from ralfbergs/fix/quarantine-text-refining Refined wording for displaying of active settings on quarantine page.	2026-07-13 09:40:24 +02:00
FreddleSpl0it	31e1550668	[Postfix] change postscreen blacklist_action to denylist_action	2026-07-13 08:45:56 +02:00
FreddleSpl0it	315f55bc65	Merge pull request #7323 from DerLinkman/feat/postfix-deb13 postfix: migrate from bookworm to trixie	2026-07-13 08:23:57 +02:00
Ralf Bergs	e696ee2f6c	Refined wording for displaying of active settings on quarantine page.	2026-07-12 17:22:15 +02:00
renovate[bot]	d65aa11870	Update devops-infra/action-pull-request action to v1.4.0 (#7321 ) Signed-off-by: milkmaker <milkmaker@mailcow.de> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-07-12 15:20:18 +02:00
renovate[bot]	f6630e5b43	Update actions/stale action to v10.4.0 (#7322 ) Signed-off-by: milkmaker <milkmaker@mailcow.de> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-07-12 15:19:49 +02:00
DerLinkman	98e26c5603	compose: upgrade Postfix	2026-07-10 18:41:58 +02:00
DerLinkman	3098caebbc	migrate postfix to trixie	2026-07-10 18:29:45 +02:00
renovate[bot]	94e23a3cd3	Update dependency composer/composer to v2.10.2 Signed-off-by: milkmaker <milkmaker@mailcow.de>	2026-07-01 09:32:23 +00:00
milkmaker	1840074991	update postscreen_access.cidr (#7311 )	2026-07-01 11:31:58 +02:00
FreddleSpl0it	99768e16f5	Merge pull request #7305 from mailcow/feat/nginx-1.30.3 [Nignx] Update to 1.30.3	2026-06-25 12:20:25 +02:00
FreddleSpl0it	1f8b4679cc	[Nignx] Update to 1.30.3	2026-06-25 12:17:37 +02:00
milkmaker	9e723e942d	Translations update from Weblate (#7302 ) * [Web] Updated lang.fr-fr.json Co-authored-by: Romain Ayme <ayme.romain@hotmail.fr> * [Web] Updated lang.si-si.json Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si> --------- Co-authored-by: Romain Ayme <ayme.romain@hotmail.fr> Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si>	2026-06-20 13:57:15 +02:00
renovate[bot]	47e4552b44	Update actions/checkout action to v7 (#7300 )	2026-06-19 08:34:02 +02:00
renovate[bot]	7e6c36dce1	Update alpine Docker tag to v3.24 (#7280 )	2026-06-11 11:35:03 +02:00
FreddleSpl0it	fa154c71f3	[PHP] Rebuild Image	2026-06-11 10:29:01 +02:00
FreddleSpl0it	83a045ed3e	Merge pull request #7193 from mailcow/renovate/composer-composer-2.x Update dependency composer/composer to v2.10.1	2026-06-11 10:07:19 +02:00
FreddleSpl0it	064817ac70	Merge pull request #7189 from mailcow/renovate/php-pecl-mail-mailparse-3.x Update dependency php/pecl-mail-mailparse to v3.2.0	2026-06-11 10:06:49 +02:00
FreddleSpl0it	2bd7a24b8c	Merge pull request #7212 from mailcow/mkuron-patch-mobileconfig Escape generated password in mobileconfig	2026-06-11 10:05:17 +02:00
FreddleSpl0it	ecc2462e4c	Merge pull request #7267 from goodygh/7249-update-sogo [SOGo] Update to 5.12.9	2026-06-11 10:04:30 +02:00
FreddleSpl0it	2d8db72d46	Merge pull request #7275 from Snafu/fix/admin-mailbox-tfa-missing Fix force_tfa not available in mailbox template #7216	2026-06-11 10:03:39 +02:00
FreddleSpl0it	277a307fb9	[Web] Fix refresh SOGo view on mailbox deletion	2026-06-11 09:55:32 +02:00
FreddleSpl0it	d455555621	Merge pull request #7277 from ibobgunardi/bobi/mailcow-7136-sogo-active-refresh Refresh SOGo view after mailbox activation	2026-06-11 09:53:30 +02:00
FreddleSpl0it	9ea2ff1dff	Merge pull request #7283 from mailcow/feat/update-metadata-exporter [Rspamd] Migrate metadata_exporter to multipart formatter	2026-06-11 09:40:34 +02:00
FreddleSpl0it	24cc369d84	[Rspamd] Migrate metadata_exporter to multipart formatter	2026-06-11 09:34:27 +02:00
FreddleSpl0it	5f5367f2f9	Merge pull request #7172 from mailcow/dragoangel-patch-4 Update RSPAMD version to 4.1.0 in Dockerfile	2026-06-11 09:04:19 +02:00
milkmaker	03c31f825a	update postscreen_access.cidr (#7269 )	2026-06-09 12:20:53 +02:00
renovate[bot]	c0050e8836	Update devops-infra/action-pull-request action to v1.3.0 (#7272 )	2026-06-09 12:19:09 +02:00
Dmytro Alieksieiev	15891960f7	Update RSPAMD version to 4.1.0	2026-06-09 01:19:06 +02:00
Bobby	cce02e2b15	Refresh SOGo view after mailbox activation	2026-06-08 00:01:43 +07:00
Snafu	0fafda696b	Fix force_tfa not available in mailbox template #7216	2026-06-07 17:03:52 +02:00
renovate[bot]	843db5854c	Update dependency composer/composer to v2.10.1 Signed-off-by: milkmaker <milkmaker@mailcow.de>	2026-06-04 11:04:42 +00:00
goodygh	23e4e4f373	[SOGo] Update to 5.12.9	2026-05-29 01:39:38 +02:00
Michael Kuron	ffbc37a00c	Escape generated password in mobileconfig Escape ampersand, less than, greater than to avoid generating invalid XML. Fixes #7171	2026-05-24 11:52:12 +02:00
renovate[bot]	104af58628	Update dependency php/pecl-mail-mailparse to v3.2.0 Signed-off-by: milkmaker <milkmaker@mailcow.de>	2026-05-14 18:33:03 +00:00
Dmitriy Alekseev	b0873edb6a	Update RSPAMD version in Dockerfile	2026-04-06 17:28:32 +02:00
Dmitriy Alekseev	694d751915	Update RSPAMD version in Dockerfile	2026-04-06 17:28:14 +02:00
Dmitriy Alekseev	08278a8be9	Update RSPAMD version to 4.0.0 in Dockerfile	2026-03-30 23:51:05 +02:00