1 Topic by bradford

  • bradford
  • Member
  • Offline
  • Registered: 2019-05-03
  • Posts: 33

Topic: Non-existent addresses in alias members...

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version: 1.6.0 MariaDB
- Deployed with: downloadable installer
- Linux/BSD distribution name and version: CentOS 7
- Store mail accounts in which backend: MySQL (MariaDB 5.5.60)
- Web server: Nginx 1.12.2
- Manage mail accounts with iRedAdmin-Pro: Yes
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

Addresses that do not exist for a hosted domain can be added as alias members. Previously, if a non-existent address of a hosted domain, was added as an alias member, it would be removed when saved.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by bradford

  • bradford
  • Member
  • Offline
  • Registered: 2019-05-03
  • Posts: 33

Re: Non-existent addresses in alias members...

It looks like it will remove non-existent accounts from alias members with the same domain as the alias, but not other domains even when hosted by the same server.

I think it should remove any address in alias members that does not exist in any of the domains hosted by the server.

3 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,082

Re: Non-existent addresses in alias members...

Let's say you do email hosting and have several domain admins, if domain admin logs in to manage alias members and he knows there's another domain hosted on same server, he can use the suggested method to validate which email addresses exist in that domain.

Or, you don't think this is a risk?

4 Reply by bradford

  • bradford
  • Member
  • Offline
  • Registered: 2019-05-03
  • Posts: 33

Re: Non-existent addresses in alias members...

This would not be an issue for us but I understand the concern.

Perhaps address validation should change depending on if you are a global admin, or a domain admin.

If you're a global admin, instead of checking if the address ends with the alias domain, check if the address ends with any of the hosted domains, then validate that the address exists. Otherwise it should function as-is.