Topic: iRedAPD source code error allow any user send mail to alias accounts
==== Required information ====
- iRedMail version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Linux/BSD distribution name and version:
- Related log if you're reporting an issue:
======== Required information ====
- iRedMail version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Linux/BSD distribution name and version:
- Related log if you're reporting an issue:
============ Required information ====
- iRedMail version: 1.6.0
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Linux/BSD distribution name and version: Ubuntu 12.04
- Related log if you're reporting an issue:
*************************************iredAPD log***********************************
...
...
2013-06-23 00:06:31 DEBUG SQL: SELECT accesspolicy, goto, moderators
FROM alias
WHERE
address=alias@domain.tld
AND address <> goto
AND domain=domain.tld
AND active=1
LIMIT 1
2013-06-23 00:06:31 DEBUG <!> Error: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '@domain.tld\n AND address <> goto\n AND domain=domain' at line 4")
2013-06-23 00:06:31 DEBUG --> Apply plugin: sql_user_restrictions
2013-06-23 00:06:31 DEBUG SQL to get restriction rules of sender (johndoe@gmail.com):
SELECT
allowedrecipients, rejectedrecipients,
allowedsenders, rejectedsenders
FROM mailbox
WHERE username=johndoe@gmail.com
LIMIT 1
2013-06-23 00:06:31 DEBUG <!> Error: (1064, "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '@gmail.com\n LIMIT 1' at line 5")
*************************************************************************************
====
Error caused by missing single quotes on sql_alias_access_policy.py query....
****************************************************************************
sql = '''SELECT accesspolicy, goto, moderators
FROM alias
WHERE
address=\'%s\'
AND address <> goto
AND domain=\'%s\'
AND active=1
LIMIT 1
''' % (recipient, recipient_domain)
****************************************************************************
same for sql_user_restrictions.py
****************************************************************************
sql = '''
SELECT
allowedrecipients, rejectedrecipients,
allowedsenders, rejectedsenders
FROM mailbox
WHERE username=\'%s\'
LIMIT 1
''' % sender
****************************************************************************
compile pyc files, restart and new error appear and mail still incoming from anyone to the alias....
2013-06-23 00:46:11 DEBUG policy: domain
2013-06-23 00:46:11 DEBUG members: user1@domain.tld,...,usern@domain.tld
2013-06-23 00:46:11 DEBUG moderators:
2013-06-23 00:46:11 DEBUG <!> Error: global name 'senderReceiver' is not defined <------ No reject action deployed!!!
Fix it by adding this lines in sql_alias_access_policy.py .....
*************************
def restriction(**kwargs):
conn = kwargs['conn']
sender = kwargs['sender']
recipient = kwargs['recipient']
recipient_domain = kwargs['recipient_domain']
# Add this two lines.....
sender_domain = sender.split('@')[1]
senderReceiver = {'conn': conn, 'sender': sender, 'recipient':recipient, 'recipient_domain':recipient_domain, 'sender_domain':sender_domain}
compile pyc files, restart iredAPD.... now work like a charm
----
Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.