blob: 220c87cb9b74c09234648d7247dc37e7a9415e97 [file] [log] [blame]
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +01001<?php
2
3// Slave does not serve UI
4/* if (!preg_match('/y|yes/i', getenv('MASTER'))) {
5 header('Location: /SOGo', true, 307);
6 exit;
7}*/
8
9require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/vars.inc.php';
10$default_autodiscover_config = $autodiscover_config;
11
12if (file_exists($_SERVER['DOCUMENT_ROOT'] . '/inc/vars.local.inc.php')) {
13 include_once $_SERVER['DOCUMENT_ROOT'] . '/inc/vars.local.inc.php';
14}
15unset($https_port);
16$autodiscover_config = array_merge($default_autodiscover_config, $autodiscover_config);
17
18header_remove("X-Powered-By");
19
20// Yubi OTP API
21require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/Yubico.php';
22
23// WebAuthn
24require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/WebAuthn.php';
25
26// Autoload composer
27require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/vendor/autoload.php';
28
29// Load Sieve
30require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/sieve/SieveParser.php';
31
32// minifierExtended
33require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/JSminifierExtended.php';
34require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/CSSminifierExtended.php';
35
36require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/array_merge_real.php';
37
38// Minify JS
39use MatthiasMullie\Minify;
40$js_minifier = new JSminifierExtended();
41$js_dir = array_diff(scandir('/web/js/build'), array('..', '.'));
42foreach ($js_dir as $js_file) {
43 $js_minifier->add('/web/js/build/' . $js_file);
44}
45
46// Minify CSS
47$css_minifier = new CSSminifierExtended();
48$css_dir = array_diff(scandir('/web/css/build'), array('..', '.'));
49foreach ($css_dir as $css_file) {
50 $css_minifier->add('/web/css/build/' . $css_file);
51}
52
53// U2F API + T/HOTP API
54$u2f = new u2flib_server\U2F('https://' . $_SERVER['HTTP_HOST']);
55$qrprovider = new RobThree\Auth\Providers\Qr\QRServerProvider();
56$tfa = new RobThree\Auth\TwoFactorAuth($OTP_LABEL, 6, 30, 'sha1', $qrprovider);
57
58// FIDO2
59$formats = $GLOBALS['FIDO2_FORMATS'];
60$WebAuthn = new \WebAuthn\WebAuthn('WebAuthn Library', $_SERVER['HTTP_HOST'], $formats);
61$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/solo.pem');
62$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/apple.pem');
63$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/nitro.pem');
64$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/yubico.pem');
65$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/hypersecu.pem');
66$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/globalSign.pem');
67$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/googleHardware.pem');
68$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/microsoftTpmCollection.pem');
69$WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/huawei.pem');
70
71// Redis
72$redis = new Redis();
73try {
74 if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
75 $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
76 }
77 else {
78 $redis->connect('redis-mailcow', 6379);
79 }
80}
81catch (Exception $e) {
82?>
83<center style='font-family:sans-serif;'>Connection to Redis failed.<br /><br />The following error was reported:<br/><?=$e->getMessage();?></center>
84<?php
85exit;
86}
87
88// PDO
89// Calculate offset
90// $now = new DateTime();
91// $mins = $now->getOffset() / 60;
92// $sgn = ($mins < 0 ? -1 : 1);
93// $mins = abs($mins);
94// $hrs = floor($mins / 60);
95// $mins -= $hrs * 60;
96// $offset = sprintf('%+d:%02d', $hrs*$sgn, $mins);
97
98$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
99$opt = [
100 PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
101 PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
102 PDO::ATTR_EMULATE_PREPARES => false,
103 //PDO::MYSQL_ATTR_INIT_COMMAND => "SET time_zone = '" . $offset . "', group_concat_max_len = 3423543543;",
104];
105try {
106 $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
107}
108catch (PDOException $e) {
109// Stop when SQL connection fails
110?>
111<center style='font-family:sans-serif;'>Connection to database failed.<br /><br />The following error was reported:<br/> <?=$e->getMessage();?></center>
112<?php
113exit;
114}
115// Stop when dockerapi is not available
116if (fsockopen("tcp://dockerapi", 443, $errno, $errstr) === false) {
117?>
118<center style='font-family:sans-serif;'>Connection to dockerapi container failed.<br /><br />The following error was reported:<br/><?=$errno;?> - <?=$errstr;?></center>
119<?php
120exit;
121}
122
123// OAuth2
124class mailcowPdo extends OAuth2\Storage\Pdo {
125 public function __construct($connection, $config = array()) {
126 parent::__construct($connection, $config);
127 $this->config['user_table'] = 'mailbox';
128 }
129 public function checkUserCredentials($username, $password) {
130 if (check_login($username, $password) == 'user') {
131 return true;
132 }
133 return false;
134 }
135 public function getUserDetails($username) {
136 return $this->getUser($username);
137 }
138}
139$oauth2_scope_storage = new OAuth2\Storage\Memory(array('default_scope' => 'profile', 'supported_scopes' => array('profile')));
140$oauth2_storage = new mailcowPdo(array('dsn' => $dsn, 'username' => $database_user, 'password' => $database_pass));
141$oauth2_server = new OAuth2\Server($oauth2_storage, array(
142 'refresh_token_lifetime' => $REFRESH_TOKEN_LIFETIME,
143 'access_lifetime' => $ACCESS_TOKEN_LIFETIME,
144));
145$oauth2_server->setScopeUtil(new OAuth2\Scope($oauth2_scope_storage));
146$oauth2_server->addGrantType(new OAuth2\GrantType\AuthorizationCode($oauth2_storage));
147$oauth2_server->addGrantType(new OAuth2\GrantType\UserCredentials($oauth2_storage));
148$oauth2_server->addGrantType(new OAuth2\GrantType\RefreshToken($oauth2_storage, array(
149 'always_issue_new_refresh_token' => true
150)));
151
152function exception_handler($e) {
153 if ($e instanceof PDOException) {
154 $_SESSION['return'][] = array(
155 'type' => 'danger',
156 'log' => array(__FUNCTION__),
157 'msg' => array('mysql_error', $e)
158 );
159 return false;
160 }
161 else {
162 $_SESSION['return'][] = array(
163 'type' => 'danger',
164 'log' => array(__FUNCTION__),
165 'msg' => 'An unknown error occured: ' . print_r($e, true)
166 );
167 return false;
168 }
169}
170set_exception_handler('exception_handler');
171
172// TODO: Move function
173function get_remote_ip($anonymize = null) {
174 global $ANONYMIZE_IPS;
175 if ($anonymize === null) {
176 $anonymize = $ANONYMIZE_IPS;
177 }
178 elseif ($anonymize !== true && $anonymize !== false) {
179 $anonymize = true;
180 }
181 $remote = $_SERVER['REMOTE_ADDR'];
182 if (filter_var($remote, FILTER_VALIDATE_IP) === false) {
183 return '0.0.0.0';
184 }
185 if ($anonymize) {
186 if (strlen(inet_pton($remote)) == 4) {
187 return inet_ntop(inet_pton($remote) & inet_pton("255.255.255.0"));
188 }
189 elseif (strlen(inet_pton($remote)) == 16) {
190 return inet_ntop(inet_pton($remote) & inet_pton('ffff:ffff:ffff:ffff:0000:0000:0000:0000'));
191 }
192 }
193 else {
194 return $remote;
195 }
196}
197
198// Load core functions first
199require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.inc.php';
200require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/sessions.inc.php';
201
202// IMAP lib
203// use Ddeboer\Imap\Server;
204// $imap_server = new Server('dovecot', 143, '/imap/tls/novalidate-cert');
205
206// Set language
207if (!isset($_SESSION['mailcow_locale']) && !isset($_COOKIE['mailcow_locale'])) {
208 if ($DETECT_LANGUAGE && isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])) {
209 $header_lang = strtolower(substr($_SERVER['HTTP_ACCEPT_LANGUAGE'], 0, 2));
210 if (in_array($header_lang, $AVAILABLE_LANGUAGES)) {
211 $_SESSION['mailcow_locale'] = $header_lang;
212 }
213 }
214 else {
215 $_SESSION['mailcow_locale'] = strtolower(trim($DEFAULT_LANG));
216 }
217}
218if (isset($_COOKIE['mailcow_locale'])) {
219 (preg_match('/^[a-z]{2}$/', $_COOKIE['mailcow_locale'])) ? $_SESSION['mailcow_locale'] = $_COOKIE['mailcow_locale'] : setcookie("mailcow_locale", "", time() - 300);
220}
221if (isset($_GET['lang']) && in_array($_GET['lang'], $AVAILABLE_LANGUAGES)) {
222 $_SESSION['mailcow_locale'] = $_GET['lang'];
223 setcookie("mailcow_locale", $_GET['lang'], time()+30758400); // one year
224}
225
226/*
227 * load language
228 */
229$lang = json_decode(file_get_contents($_SERVER['DOCUMENT_ROOT'] . '/lang/lang.en.json'), true);
230
231$langFile = $_SERVER['DOCUMENT_ROOT'] . '/lang/lang.'.$_SESSION['mailcow_locale'].'.json';
232if(file_exists($langFile)) {
233 $lang = array_merge_real($lang, json_decode(file_get_contents($langFile), true));
234}
235
236require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.acl.inc.php';
237require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.app_passwd.inc.php';
238require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.mailbox.inc.php';
239require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.customize.inc.php';
240require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.address_rewriting.inc.php';
241require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.domain_admin.inc.php';
242require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.admin.inc.php';
243require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.quarantine.inc.php';
244require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.quota_notification.inc.php';
245require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.policy.inc.php';
246require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.dkim.inc.php';
247require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.fwdhost.inc.php';
248require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.mailq.inc.php';
249require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.oauth2.inc.php';
250require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.pushover.inc.php';
251require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.ratelimit.inc.php';
252require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.transports.inc.php';
253require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.rspamd.inc.php';
254require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.tls_policy_maps.inc.php';
255require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.fail2ban.inc.php';
256require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.docker.inc.php';
257require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.presets.inc.php';
258require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/init_db.inc.php';
259require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.inc.php';
260init_db_schema();
261if (isset($_SESSION['mailcow_cc_role'])) {
262 // if ($_SESSION['mailcow_cc_role'] == 'user') {
263 // list($master_user, $master_passwd) = explode(':', file_get_contents('/etc/sogo/sieve.creds'));
264 // $imap_connection = $imap_server->authenticate($_SESSION['mailcow_cc_username'] . '*' . trim($master_user), trim($master_passwd));
265 // $master_user = $master_passwd = null;
266 // }
267 acl('to_session');
268}
269$UI_TEXTS = customize('get', 'ui_texts');