1 (edited by ozapien 2013-06-23 14:55:50)

Topic: iRedAPD source code error allow any user send mail to alias accounts

==== Required information ====
- iRedMail version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Linux/BSD distribution name and version:
- Related log if you're reporting an issue:
======== Required information ====
- iRedMail version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Linux/BSD distribution name and version:
- Related log if you're reporting an issue:
============ Required information ====
- iRedMail version: 1.6.0
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Linux/BSD distribution name and version: Ubuntu 12.04
- Related log if you're reporting an issue:

*************************************iredAPD log***********************************
...
...
2013-06-23 00:06:31 DEBUG SQL: SELECT accesspolicy, goto, moderators
            FROM alias
            WHERE
                address=alias@domain.tld
                AND address <> goto
                AND domain=domain.tld
                AND active=1
            LIMIT 1
   
2013-06-23 00:06:31 DEBUG <!> Error: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '@domain.tld\n                AND address <> goto\n                AND domain=domain' at line 4")
2013-06-23 00:06:31 DEBUG --> Apply plugin: sql_user_restrictions
2013-06-23 00:06:31 DEBUG SQL to get restriction rules of sender (johndoe@gmail.com):
        SELECT
            allowedrecipients, rejectedrecipients,
            allowedsenders, rejectedsenders
        FROM mailbox
        WHERE username=johndoe@gmail.com
        LIMIT 1
   
2013-06-23 00:06:31 DEBUG <!> Error: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '@gmail.com\n        LIMIT 1' at line 5")

*************************************************************************************
====


Error caused by missing single quotes on sql_alias_access_policy.py query....
****************************************************************************
sql = '''SELECT accesspolicy, goto, moderators
            FROM alias
            WHERE
                address=\'%s\'
                AND address <> goto
                AND domain=\'%s\'
                AND active=1
            LIMIT 1
    ''' % (recipient, recipient_domain)
****************************************************************************

same for sql_user_restrictions.py
****************************************************************************
sql = '''
        SELECT
            allowedrecipients, rejectedrecipients,
            allowedsenders, rejectedsenders
        FROM mailbox
        WHERE username=\'%s\'
        LIMIT 1
    ''' % sender

****************************************************************************


compile pyc files, restart and new error appear and mail still incoming from anyone to the alias....

2013-06-23 00:46:11 DEBUG policy: domain
2013-06-23 00:46:11 DEBUG members: user1@domain.tld,...,usern@domain.tld
2013-06-23 00:46:11 DEBUG moderators:
2013-06-23 00:46:11 DEBUG <!> Error: global name 'senderReceiver' is not defined     <------ No reject action deployed!!!


Fix it by adding this lines in sql_alias_access_policy.py .....
*************************
def restriction(**kwargs):
    conn = kwargs['conn']
    sender = kwargs['sender']
    recipient = kwargs['recipient']
    recipient_domain = kwargs['recipient_domain']

     # Add this two lines.....
    sender_domain = sender.split('@')[1]
    senderReceiver = {'conn': conn, 'sender': sender, 'recipient':recipient, 'recipient_domain':recipient_domain, 'sender_domain':sender_domain}

compile pyc files, restart iredAPD.... now work like a charm

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: iRedAPD source code error allow any user send mail to alias accounts

Fixed in May:
https://bitbucket.org/zhb/iredapd/commi … 0115dd8c96
https://bitbucket.org/zhb/iredapd/commi … 2e857ed782