Sorry about this trouble. Below patch fixes this issue. If you're not familiar with patch, mail us to get a patched version.
diff -r 811a0e5a960d -r 04b5bef1bcff controllers/amavisd/wblist.py
--- a/controllers/amavisd/wblist.py Wed Jan 07 17:47:29 2015 +0800
+++ b/controllers/amavisd/wblist.py Thu Jan 08 20:11:36 2015 +0800
@@ -28,7 +28,7 @@
bl_senders = get_wblist_from_form(form, 'bl_sender')
wblist_lib = wblistlib.WBList()
- qr = wblist_lib.add_wblist(account='@.',
+ qr = wblist_lib.add_wblist(account=account,
wl_senders=wl_senders,
bl_senders=bl_senders,
flush_before_import=False)
diff -r 811a0e5a960d -r 04b5bef1bcff libs/mysql/core.py
--- a/libs/mysql/core.py Wed Jan 07 17:47:29 2015 +0800
+++ b/libs/mysql/core.py Thu Jan 08 20:11:36 2015 +0800
@@ -434,6 +434,12 @@
else:
return (False, 'INVALID_ACCOUNT_TYPE')
+ if len(result) != 1:
+ # Account not found.
+ # Do NOT return msg like 'Account does not ***EXIST***', crackers
+ # can use it to verify valid accounts.
+ return (False, 'INVALID_CREDENTIALS')
+
# It's a valid account.
record = result[0]
password_sql = str(record.password)
diff -r 811a0e5a960d -r 04b5bef1bcff templates/default/macros/msgHandlers.html
--- a/templates/default/macros/msgHandlers.html Wed Jan 07 17:47:29 2015 +0800
+++ b/templates/default/macros/msgHandlers.html Thu Jan 08 20:11:36 2015 +0800
@@ -153,6 +153,7 @@
'NO_ACCOUNT_SELECTED': errorInfo(_('Please select at least one account.')),
'NOT_ALLOWED': errorInfo(_('Not allowed to create mail user under this domain.')),
'PERMISSION_DENIED': errorInfo(_("Permission denied.")),
+ 'WBLIST_UPDATED': successInfo( _('Records were successfully updated.')),
}
%}
