Matthias Andreas Benkard | b382b10 | 2021-01-02 15:32:21 +0100 | [diff] [blame] | 1 | <?php |
| 2 | |
| 3 | // Slave does not serve UI |
| 4 | /* if (!preg_match('/y|yes/i', getenv('MASTER'))) { |
| 5 | header('Location: /SOGo', true, 307); |
| 6 | exit; |
| 7 | }*/ |
| 8 | |
| 9 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/vars.inc.php'; |
| 10 | $default_autodiscover_config = $autodiscover_config; |
| 11 | |
| 12 | if (file_exists($_SERVER['DOCUMENT_ROOT'] . '/inc/vars.local.inc.php')) { |
| 13 | include_once $_SERVER['DOCUMENT_ROOT'] . '/inc/vars.local.inc.php'; |
| 14 | } |
| 15 | unset($https_port); |
| 16 | $autodiscover_config = array_merge($default_autodiscover_config, $autodiscover_config); |
| 17 | |
| 18 | header_remove("X-Powered-By"); |
| 19 | |
| 20 | // Yubi OTP API |
| 21 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/Yubico.php'; |
| 22 | |
| 23 | // WebAuthn |
| 24 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/WebAuthn.php'; |
| 25 | |
| 26 | // Autoload composer |
| 27 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/vendor/autoload.php'; |
| 28 | |
| 29 | // Load Sieve |
| 30 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/sieve/SieveParser.php'; |
| 31 | |
| 32 | // minifierExtended |
| 33 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/JSminifierExtended.php'; |
| 34 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/CSSminifierExtended.php'; |
| 35 | |
| 36 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/array_merge_real.php'; |
| 37 | |
| 38 | // Minify JS |
| 39 | use MatthiasMullie\Minify; |
| 40 | $js_minifier = new JSminifierExtended(); |
| 41 | $js_dir = array_diff(scandir('/web/js/build'), array('..', '.')); |
| 42 | foreach ($js_dir as $js_file) { |
| 43 | $js_minifier->add('/web/js/build/' . $js_file); |
| 44 | } |
| 45 | |
| 46 | // Minify CSS |
| 47 | $css_minifier = new CSSminifierExtended(); |
| 48 | $css_dir = array_diff(scandir('/web/css/build'), array('..', '.')); |
| 49 | foreach ($css_dir as $css_file) { |
| 50 | $css_minifier->add('/web/css/build/' . $css_file); |
| 51 | } |
| 52 | |
| 53 | // U2F API + T/HOTP API |
| 54 | $u2f = new u2flib_server\U2F('https://' . $_SERVER['HTTP_HOST']); |
| 55 | $qrprovider = new RobThree\Auth\Providers\Qr\QRServerProvider(); |
| 56 | $tfa = new RobThree\Auth\TwoFactorAuth($OTP_LABEL, 6, 30, 'sha1', $qrprovider); |
| 57 | |
| 58 | // FIDO2 |
| 59 | $formats = $GLOBALS['FIDO2_FORMATS']; |
| 60 | $WebAuthn = new \WebAuthn\WebAuthn('WebAuthn Library', $_SERVER['HTTP_HOST'], $formats); |
| 61 | $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/solo.pem'); |
| 62 | $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/apple.pem'); |
| 63 | $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/nitro.pem'); |
| 64 | $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/yubico.pem'); |
| 65 | $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/hypersecu.pem'); |
| 66 | $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/globalSign.pem'); |
| 67 | $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/googleHardware.pem'); |
| 68 | $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/microsoftTpmCollection.pem'); |
| 69 | $WebAuthn->addRootCertificates($_SERVER['DOCUMENT_ROOT'] . '/inc/lib/WebAuthn/rootCertificates/huawei.pem'); |
| 70 | |
| 71 | // Redis |
| 72 | $redis = new Redis(); |
| 73 | try { |
| 74 | if (!empty(getenv('REDIS_SLAVEOF_IP'))) { |
| 75 | $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT')); |
| 76 | } |
| 77 | else { |
| 78 | $redis->connect('redis-mailcow', 6379); |
| 79 | } |
| 80 | } |
| 81 | catch (Exception $e) { |
| 82 | ?> |
| 83 | <center style='font-family:sans-serif;'>Connection to Redis failed.<br /><br />The following error was reported:<br/><?=$e->getMessage();?></center> |
| 84 | <?php |
| 85 | exit; |
| 86 | } |
| 87 | |
| 88 | // PDO |
| 89 | // Calculate offset |
| 90 | // $now = new DateTime(); |
| 91 | // $mins = $now->getOffset() / 60; |
| 92 | // $sgn = ($mins < 0 ? -1 : 1); |
| 93 | // $mins = abs($mins); |
| 94 | // $hrs = floor($mins / 60); |
| 95 | // $mins -= $hrs * 60; |
| 96 | // $offset = sprintf('%+d:%02d', $hrs*$sgn, $mins); |
| 97 | |
| 98 | $dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name; |
| 99 | $opt = [ |
| 100 | PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, |
| 101 | PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, |
| 102 | PDO::ATTR_EMULATE_PREPARES => false, |
| 103 | //PDO::MYSQL_ATTR_INIT_COMMAND => "SET time_zone = '" . $offset . "', group_concat_max_len = 3423543543;", |
| 104 | ]; |
| 105 | try { |
| 106 | $pdo = new PDO($dsn, $database_user, $database_pass, $opt); |
| 107 | } |
| 108 | catch (PDOException $e) { |
| 109 | // Stop when SQL connection fails |
| 110 | ?> |
| 111 | <center style='font-family:sans-serif;'>Connection to database failed.<br /><br />The following error was reported:<br/> <?=$e->getMessage();?></center> |
| 112 | <?php |
| 113 | exit; |
| 114 | } |
| 115 | // Stop when dockerapi is not available |
| 116 | if (fsockopen("tcp://dockerapi", 443, $errno, $errstr) === false) { |
| 117 | ?> |
| 118 | <center style='font-family:sans-serif;'>Connection to dockerapi container failed.<br /><br />The following error was reported:<br/><?=$errno;?> - <?=$errstr;?></center> |
| 119 | <?php |
| 120 | exit; |
| 121 | } |
| 122 | |
| 123 | // OAuth2 |
| 124 | class mailcowPdo extends OAuth2\Storage\Pdo { |
| 125 | public function __construct($connection, $config = array()) { |
| 126 | parent::__construct($connection, $config); |
| 127 | $this->config['user_table'] = 'mailbox'; |
| 128 | } |
| 129 | public function checkUserCredentials($username, $password) { |
| 130 | if (check_login($username, $password) == 'user') { |
| 131 | return true; |
| 132 | } |
| 133 | return false; |
| 134 | } |
| 135 | public function getUserDetails($username) { |
| 136 | return $this->getUser($username); |
| 137 | } |
| 138 | } |
| 139 | $oauth2_scope_storage = new OAuth2\Storage\Memory(array('default_scope' => 'profile', 'supported_scopes' => array('profile'))); |
| 140 | $oauth2_storage = new mailcowPdo(array('dsn' => $dsn, 'username' => $database_user, 'password' => $database_pass)); |
| 141 | $oauth2_server = new OAuth2\Server($oauth2_storage, array( |
| 142 | 'refresh_token_lifetime' => $REFRESH_TOKEN_LIFETIME, |
| 143 | 'access_lifetime' => $ACCESS_TOKEN_LIFETIME, |
| 144 | )); |
| 145 | $oauth2_server->setScopeUtil(new OAuth2\Scope($oauth2_scope_storage)); |
| 146 | $oauth2_server->addGrantType(new OAuth2\GrantType\AuthorizationCode($oauth2_storage)); |
| 147 | $oauth2_server->addGrantType(new OAuth2\GrantType\UserCredentials($oauth2_storage)); |
| 148 | $oauth2_server->addGrantType(new OAuth2\GrantType\RefreshToken($oauth2_storage, array( |
| 149 | 'always_issue_new_refresh_token' => true |
| 150 | ))); |
| 151 | |
| 152 | function exception_handler($e) { |
| 153 | if ($e instanceof PDOException) { |
| 154 | $_SESSION['return'][] = array( |
| 155 | 'type' => 'danger', |
| 156 | 'log' => array(__FUNCTION__), |
| 157 | 'msg' => array('mysql_error', $e) |
| 158 | ); |
| 159 | return false; |
| 160 | } |
| 161 | else { |
| 162 | $_SESSION['return'][] = array( |
| 163 | 'type' => 'danger', |
| 164 | 'log' => array(__FUNCTION__), |
| 165 | 'msg' => 'An unknown error occured: ' . print_r($e, true) |
| 166 | ); |
| 167 | return false; |
| 168 | } |
| 169 | } |
| 170 | set_exception_handler('exception_handler'); |
| 171 | |
| 172 | // TODO: Move function |
| 173 | function get_remote_ip($anonymize = null) { |
| 174 | global $ANONYMIZE_IPS; |
| 175 | if ($anonymize === null) { |
| 176 | $anonymize = $ANONYMIZE_IPS; |
| 177 | } |
| 178 | elseif ($anonymize !== true && $anonymize !== false) { |
| 179 | $anonymize = true; |
| 180 | } |
| 181 | $remote = $_SERVER['REMOTE_ADDR']; |
| 182 | if (filter_var($remote, FILTER_VALIDATE_IP) === false) { |
| 183 | return '0.0.0.0'; |
| 184 | } |
| 185 | if ($anonymize) { |
| 186 | if (strlen(inet_pton($remote)) == 4) { |
| 187 | return inet_ntop(inet_pton($remote) & inet_pton("255.255.255.0")); |
| 188 | } |
| 189 | elseif (strlen(inet_pton($remote)) == 16) { |
| 190 | return inet_ntop(inet_pton($remote) & inet_pton('ffff:ffff:ffff:ffff:0000:0000:0000:0000')); |
| 191 | } |
| 192 | } |
| 193 | else { |
| 194 | return $remote; |
| 195 | } |
| 196 | } |
| 197 | |
| 198 | // Load core functions first |
| 199 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.inc.php'; |
| 200 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/sessions.inc.php'; |
| 201 | |
| 202 | // IMAP lib |
| 203 | // use Ddeboer\Imap\Server; |
| 204 | // $imap_server = new Server('dovecot', 143, '/imap/tls/novalidate-cert'); |
| 205 | |
| 206 | // Set language |
| 207 | if (!isset($_SESSION['mailcow_locale']) && !isset($_COOKIE['mailcow_locale'])) { |
| 208 | if ($DETECT_LANGUAGE && isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])) { |
| 209 | $header_lang = strtolower(substr($_SERVER['HTTP_ACCEPT_LANGUAGE'], 0, 2)); |
| 210 | if (in_array($header_lang, $AVAILABLE_LANGUAGES)) { |
| 211 | $_SESSION['mailcow_locale'] = $header_lang; |
| 212 | } |
| 213 | } |
| 214 | else { |
| 215 | $_SESSION['mailcow_locale'] = strtolower(trim($DEFAULT_LANG)); |
| 216 | } |
| 217 | } |
| 218 | if (isset($_COOKIE['mailcow_locale'])) { |
| 219 | (preg_match('/^[a-z]{2}$/', $_COOKIE['mailcow_locale'])) ? $_SESSION['mailcow_locale'] = $_COOKIE['mailcow_locale'] : setcookie("mailcow_locale", "", time() - 300); |
| 220 | } |
| 221 | if (isset($_GET['lang']) && in_array($_GET['lang'], $AVAILABLE_LANGUAGES)) { |
| 222 | $_SESSION['mailcow_locale'] = $_GET['lang']; |
| 223 | setcookie("mailcow_locale", $_GET['lang'], time()+30758400); // one year |
| 224 | } |
| 225 | |
| 226 | /* |
| 227 | * load language |
| 228 | */ |
| 229 | $lang = json_decode(file_get_contents($_SERVER['DOCUMENT_ROOT'] . '/lang/lang.en.json'), true); |
| 230 | |
| 231 | $langFile = $_SERVER['DOCUMENT_ROOT'] . '/lang/lang.'.$_SESSION['mailcow_locale'].'.json'; |
| 232 | if(file_exists($langFile)) { |
| 233 | $lang = array_merge_real($lang, json_decode(file_get_contents($langFile), true)); |
| 234 | } |
| 235 | |
| 236 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.acl.inc.php'; |
| 237 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.app_passwd.inc.php'; |
| 238 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.mailbox.inc.php'; |
| 239 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.customize.inc.php'; |
| 240 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.address_rewriting.inc.php'; |
| 241 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.domain_admin.inc.php'; |
| 242 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.admin.inc.php'; |
| 243 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.quarantine.inc.php'; |
| 244 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.quota_notification.inc.php'; |
| 245 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.policy.inc.php'; |
| 246 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.dkim.inc.php'; |
| 247 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.fwdhost.inc.php'; |
| 248 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.mailq.inc.php'; |
| 249 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.oauth2.inc.php'; |
| 250 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.pushover.inc.php'; |
| 251 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.ratelimit.inc.php'; |
| 252 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.transports.inc.php'; |
| 253 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.rspamd.inc.php'; |
| 254 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.tls_policy_maps.inc.php'; |
| 255 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.fail2ban.inc.php'; |
| 256 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.docker.inc.php'; |
| 257 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.presets.inc.php'; |
| 258 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/init_db.inc.php'; |
| 259 | require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.inc.php'; |
| 260 | init_db_schema(); |
| 261 | if (isset($_SESSION['mailcow_cc_role'])) { |
| 262 | // if ($_SESSION['mailcow_cc_role'] == 'user') { |
| 263 | // list($master_user, $master_passwd) = explode(':', file_get_contents('/etc/sogo/sieve.creds')); |
| 264 | // $imap_connection = $imap_server->authenticate($_SESSION['mailcow_cc_username'] . '*' . trim($master_user), trim($master_passwd)); |
| 265 | // $master_user = $master_passwd = null; |
| 266 | // } |
| 267 | acl('to_session'); |
| 268 | } |
| 269 | $UI_TEXTS = customize('get', 'ui_texts'); |