json_api.php 42 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154
  1. <?php
  2. /*
  3. edit/alias => POST data:
  4. {
  5. address: {a, b, c}, (where a, b, c represent alias addresses)
  6. active: 1 (0 or 1)
  7. }
  8. delete/alias => POST data:
  9. {
  10. address: {a, b, c}, (where a, b, c represent alias addresses)
  11. }
  12. */
  13. header('Content-Type: application/json');
  14. require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
  15. error_reporting(0);
  16. function api_log($_data) {
  17. global $redis;
  18. $data_var = array();
  19. foreach ($_data as $data => &$value) {
  20. if ($data == 'csrf_token') {
  21. continue;
  22. }
  23. if ($value = json_decode($value, true)) {
  24. unset($value["csrf_token"]);
  25. foreach ($value as $key => &$val) {
  26. if(preg_match("/pass/i", $key)) {
  27. $val = '*';
  28. }
  29. }
  30. $value = json_encode($value);
  31. }
  32. $data_var[] = $data . "='" . $value . "'";
  33. }
  34. try {
  35. $log_line = array(
  36. 'time' => time(),
  37. 'uri' => $_SERVER['REQUEST_URI'],
  38. 'method' => $_SERVER['REQUEST_METHOD'],
  39. 'remote' => get_remote_ip(),
  40. 'data' => implode(', ', $data_var)
  41. );
  42. $redis->lPush('API_LOG', json_encode($log_line));
  43. }
  44. catch (RedisException $e) {
  45. $_SESSION['return'][] = array(
  46. 'type' => 'danger',
  47. 'msg' => 'Redis: '.$e
  48. );
  49. return false;
  50. }
  51. }
  52. api_log($_POST);
  53. if (isset($_SESSION['mailcow_cc_role']) || isset($_SESSION['pending_mailcow_cc_username'])) {
  54. if (isset($_GET['query'])) {
  55. $query = explode('/', $_GET['query']);
  56. $action = (isset($query[0])) ? $query[0] : null;
  57. $category = (isset($query[1])) ? $query[1] : null;
  58. $object = (isset($query[2])) ? $query[2] : null;
  59. $extra = (isset($query[3])) ? $query[3] : null;
  60. $request_incomplete = json_encode(array(
  61. 'type' => 'error',
  62. 'msg' => 'Cannot find attributes in post data'
  63. ));
  64. switch ($action) {
  65. case "add":
  66. function process_add_return($return) {
  67. $generic_failure = json_encode(array(
  68. 'type' => 'error',
  69. 'msg' => 'Cannot add item'
  70. ));
  71. $generic_success = json_encode(array(
  72. 'type' => 'success',
  73. 'msg' => 'Task completed'
  74. ));
  75. if ($return === false) {
  76. echo isset($_SESSION['return']) ? json_encode($_SESSION['return']) : $generic_failure;
  77. }
  78. else {
  79. echo isset($_SESSION['return']) ? json_encode($_SESSION['return']) : $generic_success;
  80. }
  81. }
  82. if (!isset($_POST['attr'])) {
  83. echo $request_incomplete;
  84. exit;
  85. }
  86. else {
  87. $attr = (array)json_decode($_POST['attr'], true);
  88. unset($attr['csrf_token']);
  89. }
  90. switch ($category) {
  91. case "time_limited_alias":
  92. process_add_return(mailbox('add', 'time_limited_alias', $attr));
  93. break;
  94. case "relayhost":
  95. process_add_return(relayhost('add', $attr));
  96. break;
  97. case "rsetting":
  98. process_add_return(rsettings('add', $attr));
  99. break;
  100. case "mailbox":
  101. process_add_return(mailbox('add', 'mailbox', $attr));
  102. break;
  103. case "domain":
  104. process_add_return(mailbox('add', 'domain', $attr));
  105. break;
  106. case "resource":
  107. process_add_return(mailbox('add', 'resource', $attr));
  108. break;
  109. case "alias":
  110. process_add_return(mailbox('add', 'alias', $attr));
  111. break;
  112. case "filter":
  113. process_add_return(mailbox('add', 'filter', $attr));
  114. break;
  115. case "domain-policy":
  116. process_add_return(policy('add', 'domain', $attr));
  117. break;
  118. case "mailbox-policy":
  119. process_add_return(policy('add', 'mailbox', $attr));
  120. break;
  121. case "alias-domain":
  122. process_add_return(mailbox('add', 'alias_domain', $attr));
  123. break;
  124. case "fwdhost":
  125. process_add_return(fwdhost('add', $attr));
  126. break;
  127. case "dkim":
  128. process_add_return(dkim('add', $attr));
  129. break;
  130. case "dkim_duplicate":
  131. process_add_return(dkim('duplicate', $attr));
  132. break;
  133. case "dkim_import":
  134. process_add_return(dkim('import', $attr));
  135. break;
  136. case "domain-admin":
  137. process_add_return(domain_admin('add', $attr));
  138. break;
  139. case "admin":
  140. process_add_return(admin('add', $attr));
  141. break;
  142. case "syncjob":
  143. process_add_return(mailbox('add', 'syncjob', $attr));
  144. break;
  145. case "bcc":
  146. process_add_return(bcc('add', $attr));
  147. break;
  148. case "recipient_map":
  149. process_add_return(recipient_map('add', $attr));
  150. break;
  151. case "tls-policy-map":
  152. process_add_return(tls_policy_maps('add', $attr));
  153. break;
  154. }
  155. break;
  156. case "get":
  157. function process_get_return($data) {
  158. echo (!isset($data) || empty($data)) ? '{}' : json_encode($data, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT);
  159. }
  160. switch ($category) {
  161. case "rspamd":
  162. switch ($object) {
  163. case "actions":
  164. $curl = curl_init();
  165. curl_setopt($curl, CURLOPT_UNIX_SOCKET_PATH, '/var/lib/rspamd/rspamd.sock');
  166. curl_setopt($curl, CURLOPT_URL,"http://rspamd/stat");
  167. curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
  168. $data = curl_exec($curl);
  169. if ($data) {
  170. $return = array();
  171. $stats_array = json_decode($data, true)['actions'];
  172. $stats_array['soft reject'] = $stats_array['soft reject'] + $stats_array['greylist'];
  173. unset($stats_array['greylist']);
  174. foreach ($stats_array as $action => $count) {
  175. $return[] = array($action, $count);
  176. }
  177. echo json_encode($return, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT);
  178. }
  179. elseif (!isset($data) || empty($data)) {
  180. echo '{}';
  181. }
  182. break;
  183. }
  184. break;
  185. case "domain":
  186. switch ($object) {
  187. case "all":
  188. $domains = mailbox('get', 'domains');
  189. if (!empty($domains)) {
  190. foreach ($domains as $domain) {
  191. if ($details = mailbox('get', 'domain_details', $domain)) {
  192. $data[] = $details;
  193. }
  194. else {
  195. continue;
  196. }
  197. }
  198. process_get_return($data);
  199. }
  200. else {
  201. echo '{}';
  202. }
  203. break;
  204. default:
  205. $data = mailbox('get', 'domain_details', $object);
  206. process_get_return($data);
  207. break;
  208. }
  209. break;
  210. case "rl-domain":
  211. switch ($object) {
  212. case "all":
  213. $domains = array_merge(mailbox('get', 'domains'), mailbox('get', 'alias_domains'));
  214. if (!empty($domains)) {
  215. foreach ($domains as $domain) {
  216. if ($details = ratelimit('get', 'domain', $domain)) {
  217. $details['domain'] = $domain;
  218. $data[] = $details;
  219. }
  220. else {
  221. continue;
  222. }
  223. }
  224. process_get_return($data);
  225. }
  226. else {
  227. echo '{}';
  228. }
  229. break;
  230. default:
  231. $data = ratelimit('get', 'domain', $object);
  232. process_get_return($data);
  233. break;
  234. }
  235. break;
  236. case "rl-mbox":
  237. switch ($object) {
  238. case "all":
  239. $domains = mailbox('get', 'domains');
  240. if (!empty($domains)) {
  241. foreach ($domains as $domain) {
  242. $mailboxes = mailbox('get', 'mailboxes', $domain);
  243. if (!empty($mailboxes)) {
  244. foreach ($mailboxes as $mailbox) {
  245. if ($details = ratelimit('get', 'mailbox', $mailbox)) {
  246. $details['mailbox'] = $mailbox;
  247. $data[] = $details;
  248. }
  249. else {
  250. continue;
  251. }
  252. }
  253. }
  254. }
  255. process_get_return($data);
  256. }
  257. else {
  258. echo '{}';
  259. }
  260. break;
  261. default:
  262. $data = ratelimit('get', 'mailbox', $object);
  263. process_get_return($data);
  264. break;
  265. }
  266. break;
  267. case "relayhost":
  268. switch ($object) {
  269. case "all":
  270. $relayhosts = relayhost('get');
  271. if (!empty($relayhosts)) {
  272. foreach ($relayhosts as $relayhost) {
  273. if ($details = relayhost('details', $relayhost['id'])) {
  274. $data[] = $details;
  275. }
  276. else {
  277. continue;
  278. }
  279. }
  280. process_get_return($data);
  281. }
  282. else {
  283. echo '{}';
  284. }
  285. break;
  286. default:
  287. $data = relayhost('details', $object);
  288. process_get_return($data);
  289. break;
  290. }
  291. break;
  292. case "rsetting":
  293. switch ($object) {
  294. case "all":
  295. $rsettings = rsettings('get');
  296. if (!empty($rsettings)) {
  297. foreach ($rsettings as $rsetting) {
  298. if ($details = rsettings('details', $rsetting['id'])) {
  299. $data[] = $details;
  300. }
  301. else {
  302. continue;
  303. }
  304. }
  305. process_get_return($data);
  306. }
  307. else {
  308. echo '{}';
  309. }
  310. break;
  311. default:
  312. $data = rsetting('details', $object);
  313. process_get_return($data);
  314. break;
  315. }
  316. break;
  317. case "oauth2-client":
  318. switch ($object) {
  319. case "all":
  320. $clients = oauth2('get', 'clients');
  321. if (!empty($clients)) {
  322. foreach ($clients as $client) {
  323. if ($details = oauth2('details', 'client', $client)) {
  324. $data[] = $details;
  325. }
  326. else {
  327. continue;
  328. }
  329. }
  330. process_get_return($data);
  331. }
  332. else {
  333. echo '{}';
  334. }
  335. break;
  336. default:
  337. $data = oauth2('details', 'client', $object);
  338. process_get_return($data);
  339. break;
  340. }
  341. break;
  342. case "logs":
  343. switch ($object) {
  344. case "dovecot":
  345. // 0 is first record, so empty is fine
  346. if (isset($extra)) {
  347. $extra = preg_replace('/[^\d\-]/i', '', $extra);
  348. $logs = get_logs('dovecot-mailcow', $extra);
  349. }
  350. else {
  351. $logs = get_logs('dovecot-mailcow');
  352. }
  353. echo (isset($logs) && !empty($logs)) ? json_encode($logs, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) : '{}';
  354. break;
  355. case "netfilter":
  356. // 0 is first record, so empty is fine
  357. if (isset($extra)) {
  358. $extra = preg_replace('/[^\d\-]/i', '', $extra);
  359. $logs = get_logs('netfilter-mailcow', $extra);
  360. }
  361. else {
  362. $logs = get_logs('netfilter-mailcow');
  363. }
  364. echo (isset($logs) && !empty($logs)) ? json_encode($logs, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) : '{}';
  365. break;
  366. case "postfix":
  367. // 0 is first record, so empty is fine
  368. if (isset($extra)) {
  369. $extra = preg_replace('/[^\d\-]/i', '', $extra);
  370. $logs = get_logs('postfix-mailcow', $extra);
  371. }
  372. else {
  373. $logs = get_logs('postfix-mailcow');
  374. }
  375. echo (isset($logs) && !empty($logs)) ? json_encode($logs, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) : '{}';
  376. break;
  377. case "autodiscover":
  378. // 0 is first record, so empty is fine
  379. if (isset($extra)) {
  380. $extra = preg_replace('/[^\d\-]/i', '', $extra);
  381. $logs = get_logs('autodiscover-mailcow', $extra);
  382. }
  383. else {
  384. $logs = get_logs('autodiscover-mailcow');
  385. }
  386. echo (isset($logs) && !empty($logs)) ? json_encode($logs, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) : '{}';
  387. break;
  388. case "sogo":
  389. // 0 is first record, so empty is fine
  390. if (isset($extra)) {
  391. $extra = preg_replace('/[^\d\-]/i', '', $extra);
  392. $logs = get_logs('sogo-mailcow', $extra);
  393. }
  394. else {
  395. $logs = get_logs('sogo-mailcow');
  396. }
  397. echo (isset($logs) && !empty($logs)) ? json_encode($logs, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) : '{}';
  398. break;
  399. case "ui":
  400. // 0 is first record, so empty is fine
  401. if (isset($extra)) {
  402. $extra = preg_replace('/[^\d\-]/i', '', $extra);
  403. $logs = get_logs('mailcow-ui', $extra);
  404. }
  405. else {
  406. $logs = get_logs('mailcow-ui');
  407. }
  408. echo (isset($logs) && !empty($logs)) ? json_encode($logs, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) : '{}';
  409. break;
  410. case "watchdog":
  411. // 0 is first record, so empty is fine
  412. if (isset($extra)) {
  413. $extra = preg_replace('/[^\d\-]/i', '', $extra);
  414. $logs = get_logs('watchdog-mailcow', $extra);
  415. }
  416. else {
  417. $logs = get_logs('watchdog-mailcow');
  418. }
  419. echo (isset($logs) && !empty($logs)) ? json_encode($logs, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) : '{}';
  420. break;
  421. case "acme":
  422. // 0 is first record, so empty is fine
  423. if (isset($extra)) {
  424. $extra = preg_replace('/[^\d\-]/i', '', $extra);
  425. $logs = get_logs('acme-mailcow', $extra);
  426. }
  427. else {
  428. $logs = get_logs('acme-mailcow');
  429. }
  430. echo (isset($logs) && !empty($logs)) ? json_encode($logs, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) : '{}';
  431. break;
  432. case "api":
  433. // 0 is first record, so empty is fine
  434. if (isset($extra)) {
  435. $extra = preg_replace('/[^\d\-]/i', '', $extra);
  436. $logs = get_logs('api-mailcow', $extra);
  437. }
  438. else {
  439. $logs = get_logs('api-mailcow');
  440. }
  441. echo (isset($logs) && !empty($logs)) ? json_encode($logs, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) : '{}';
  442. break;
  443. case "rspamd-history":
  444. // 0 is first record, so empty is fine
  445. if (isset($extra)) {
  446. $extra = preg_replace('/[^\d\-]/i', '', $extra);
  447. $logs = get_logs('rspamd-history', $extra);
  448. }
  449. else {
  450. $logs = get_logs('rspamd-history');
  451. }
  452. echo (isset($logs) && !empty($logs)) ? json_encode($logs, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT) : '{}';
  453. break;
  454. }
  455. break;
  456. case "mailbox":
  457. switch ($object) {
  458. case "all":
  459. $domains = mailbox('get', 'domains');
  460. if (!empty($domains)) {
  461. foreach ($domains as $domain) {
  462. $mailboxes = mailbox('get', 'mailboxes', $domain);
  463. if (!empty($mailboxes)) {
  464. foreach ($mailboxes as $mailbox) {
  465. if ($details = mailbox('get', 'mailbox_details', $mailbox)) {
  466. $data[] = $details;
  467. }
  468. else {
  469. continue;
  470. }
  471. }
  472. }
  473. }
  474. process_get_return($data);
  475. }
  476. else {
  477. echo '{}';
  478. }
  479. break;
  480. default:
  481. $data = mailbox('get', 'mailbox_details', $object);
  482. process_get_return($data);
  483. break;
  484. }
  485. break;
  486. case "syncjobs":
  487. switch ($object) {
  488. case "all":
  489. $domains = mailbox('get', 'domains');
  490. if (!empty($domains)) {
  491. foreach ($domains as $domain) {
  492. $mailboxes = mailbox('get', 'mailboxes', $domain);
  493. if (!empty($mailboxes)) {
  494. foreach ($mailboxes as $mailbox) {
  495. $syncjobs = mailbox('get', 'syncjobs', $mailbox);
  496. if (!empty($syncjobs)) {
  497. foreach ($syncjobs as $syncjob) {
  498. if (isset($extra)) {
  499. $details = mailbox('get', 'syncjob_details', $syncjob, explode(',', $extra));
  500. }
  501. else {
  502. $details = mailbox('get', 'syncjob_details', $syncjob);
  503. }
  504. if ($details) {
  505. $data[] = $details;
  506. }
  507. else {
  508. continue;
  509. }
  510. }
  511. }
  512. }
  513. }
  514. }
  515. process_get_return($data);
  516. }
  517. else {
  518. echo '{}';
  519. }
  520. break;
  521. default:
  522. $syncjobs = mailbox('get', 'syncjobs', $object);
  523. if (!empty($syncjobs)) {
  524. foreach ($syncjobs as $syncjob) {
  525. if (isset($extra)) {
  526. $details = mailbox('get', 'syncjob_details', $syncjob, explode(',', $extra));
  527. }
  528. else {
  529. $details = mailbox('get', 'syncjob_details', $syncjob);
  530. }
  531. if ($details) {
  532. $data[] = $details;
  533. }
  534. else {
  535. continue;
  536. }
  537. }
  538. }
  539. process_get_return($data);
  540. break;
  541. }
  542. break;
  543. case "active-user-sieve":
  544. if (isset($object)) {
  545. $sieve_filter = mailbox('get', 'active_user_sieve', $object);
  546. if (!empty($sieve_filter)) {
  547. $data[] = $sieve_filter;
  548. }
  549. }
  550. process_get_return($data);
  551. break;
  552. case "filters":
  553. switch ($object) {
  554. case "all":
  555. $domains = mailbox('get', 'domains');
  556. if (!empty($domains)) {
  557. foreach ($domains as $domain) {
  558. $mailboxes = mailbox('get', 'mailboxes', $domain);
  559. if (!empty($mailboxes)) {
  560. foreach ($mailboxes as $mailbox) {
  561. $filters = mailbox('get', 'filters', $mailbox);
  562. if (!empty($filters)) {
  563. foreach ($filters as $filter) {
  564. if ($details = mailbox('get', 'filter_details', $filter)) {
  565. $data[] = $details;
  566. }
  567. else {
  568. continue;
  569. }
  570. }
  571. }
  572. }
  573. }
  574. }
  575. process_get_return($data);
  576. }
  577. else {
  578. echo '{}';
  579. }
  580. break;
  581. default:
  582. $filters = mailbox('get', 'filters', $object);
  583. if (!empty($filters)) {
  584. foreach ($filters as $filter) {
  585. if ($details = mailbox('get', 'filter_details', $filter)) {
  586. $data[] = $details;
  587. }
  588. else {
  589. continue;
  590. }
  591. }
  592. }
  593. process_get_return($data);
  594. break;
  595. }
  596. break;
  597. case "bcc":
  598. switch ($object) {
  599. case "all":
  600. $bcc_items = bcc('get');
  601. if (!empty($bcc_items)) {
  602. foreach ($bcc_items as $bcc_item) {
  603. if ($details = bcc('details', $bcc_item)) {
  604. $data[] = $details;
  605. }
  606. else {
  607. continue;
  608. }
  609. }
  610. }
  611. process_get_return($data);
  612. break;
  613. default:
  614. $data = bcc('details', $object);
  615. if (!empty($data)) {
  616. $data[] = $details;
  617. }
  618. process_get_return($data);
  619. break;
  620. }
  621. break;
  622. case "recipient_map":
  623. switch ($object) {
  624. case "all":
  625. $recipient_map_items = recipient_map('get');
  626. if (!empty($recipient_map_items)) {
  627. foreach ($recipient_map_items as $recipient_map_item) {
  628. if ($details = recipient_map('details', $recipient_map_item)) {
  629. $data[] = $details;
  630. }
  631. else {
  632. continue;
  633. }
  634. }
  635. }
  636. process_get_return($data);
  637. break;
  638. default:
  639. $data = recipient_map('details', $object);
  640. if (!empty($data)) {
  641. $data[] = $details;
  642. }
  643. process_get_return($data);
  644. break;
  645. }
  646. break;
  647. case "tls-policy-map":
  648. switch ($object) {
  649. case "all":
  650. $tls_policy_maps_items = tls_policy_maps('get');
  651. if (!empty($tls_policy_maps_items)) {
  652. foreach ($tls_policy_maps_items as $tls_policy_maps_item) {
  653. if ($details = tls_policy_maps('details', $tls_policy_maps_item)) {
  654. $data[] = $details;
  655. }
  656. else {
  657. continue;
  658. }
  659. }
  660. }
  661. process_get_return($data);
  662. break;
  663. default:
  664. $data = tls_policy_maps('details', $object);
  665. if (!empty($data)) {
  666. $data[] = $details;
  667. }
  668. process_get_return($data);
  669. break;
  670. }
  671. break;
  672. case "policy_wl_mailbox":
  673. switch ($object) {
  674. default:
  675. $data = policy('get', 'mailbox', $object)['whitelist'];
  676. process_get_return($data);
  677. break;
  678. }
  679. break;
  680. case "policy_bl_mailbox":
  681. switch ($object) {
  682. default:
  683. $data = policy('get', 'mailbox', $object)['blacklist'];
  684. process_get_return($data);
  685. break;
  686. }
  687. break;
  688. case "policy_wl_domain":
  689. switch ($object) {
  690. default:
  691. $data = policy('get', 'domain', $object)['whitelist'];
  692. process_get_return($data);
  693. break;
  694. }
  695. break;
  696. case "policy_bl_domain":
  697. switch ($object) {
  698. default:
  699. $data = policy('get', 'domain', $object)['blacklist'];
  700. process_get_return($data);
  701. break;
  702. }
  703. break;
  704. case "time_limited_aliases":
  705. switch ($object) {
  706. default:
  707. $data = mailbox('get', 'time_limited_aliases', $object);
  708. process_get_return($data);
  709. break;
  710. }
  711. break;
  712. case "resource":
  713. switch ($object) {
  714. case "all":
  715. $domains = mailbox('get', 'domains');
  716. if (!empty($domains)) {
  717. foreach ($domains as $domain) {
  718. $resources = mailbox('get', 'resources', $domain);
  719. if (!empty($resources)) {
  720. foreach ($resources as $resource) {
  721. if ($details = mailbox('get', 'resource_details', $resource)) {
  722. $data[] = $details;
  723. }
  724. else {
  725. continue;
  726. }
  727. }
  728. }
  729. }
  730. process_get_return($data);
  731. }
  732. else {
  733. echo '{}';
  734. }
  735. break;
  736. default:
  737. $data = mailbox('get', 'resource_details', $object);
  738. process_get_return($data);
  739. break;
  740. }
  741. break;
  742. case "fwdhost":
  743. switch ($object) {
  744. case "all":
  745. process_get_return(fwdhost('get'));
  746. break;
  747. default:
  748. process_get_return(fwdhost('details', $object));
  749. break;
  750. }
  751. break;
  752. case "quarantine":
  753. // "all" will not print details
  754. switch ($object) {
  755. case "all":
  756. process_get_return(quarantine('get'));
  757. break;
  758. default:
  759. process_get_return(quarantine('details', $object));
  760. break;
  761. }
  762. break;
  763. case "alias-domain":
  764. switch ($object) {
  765. case "all":
  766. $alias_domains = mailbox('get', 'alias_domains');
  767. if (!empty($alias_domains)) {
  768. foreach ($alias_domains as $alias_domain) {
  769. if ($details = mailbox('get', 'alias_domain_details', $alias_domain)) {
  770. $data[] = $details;
  771. }
  772. else {
  773. continue;
  774. }
  775. }
  776. }
  777. process_get_return($data);
  778. break;
  779. default:
  780. process_get_return(mailbox('get', 'alias_domain_details', $object));
  781. break;
  782. }
  783. break;
  784. case "alias":
  785. switch ($object) {
  786. case "all":
  787. $domains = array_merge(mailbox('get', 'domains'), mailbox('get', 'alias_domains'));
  788. if (!empty($domains)) {
  789. foreach ($domains as $domain) {
  790. $aliases = mailbox('get', 'aliases', $domain);
  791. if (!empty($aliases)) {
  792. foreach ($aliases as $alias) {
  793. if ($details = mailbox('get', 'alias_details', $alias)) {
  794. $data[] = $details;
  795. }
  796. else {
  797. continue;
  798. }
  799. }
  800. }
  801. }
  802. process_get_return($data);
  803. }
  804. else {
  805. echo '{}';
  806. }
  807. break;
  808. default:
  809. process_get_return(mailbox('get', 'alias_details', $object));
  810. break;
  811. }
  812. break;
  813. case "domain-admin":
  814. switch ($object) {
  815. case "all":
  816. $domain_admins = domain_admin('get');
  817. if (!empty($domain_admins)) {
  818. foreach ($domain_admins as $domain_admin) {
  819. if ($details = domain_admin('details', $domain_admin)) {
  820. $data[] = $details;
  821. }
  822. else {
  823. continue;
  824. }
  825. }
  826. process_get_return($data);
  827. }
  828. else {
  829. echo '{}';
  830. }
  831. break;
  832. default:
  833. process_get_return(domain_admin('details', $object));
  834. break;
  835. }
  836. break;
  837. case "admin":
  838. switch ($object) {
  839. case "all":
  840. $admins = admin('get');
  841. if (!empty($admins)) {
  842. foreach ($admins as $admin) {
  843. if ($details = admin('details', $admin)) {
  844. $data[] = $details;
  845. }
  846. else {
  847. continue;
  848. }
  849. }
  850. process_get_return($data);
  851. }
  852. else {
  853. echo '{}';
  854. }
  855. break;
  856. default:
  857. process_get_return(admin('details', $object));
  858. break;
  859. }
  860. break;
  861. case "u2f-registration":
  862. header('Content-Type: application/javascript');
  863. if (($_SESSION["mailcow_cc_role"] == "admin" || $_SESSION["mailcow_cc_role"] == "domainadmin") && $_SESSION["mailcow_cc_username"] == $object) {
  864. list($req, $sigs) = $u2f->getRegisterData(get_u2f_registrations($object));
  865. $_SESSION['regReq'] = json_encode($req);
  866. $_SESSION['regSigs'] = json_encode($sigs);
  867. echo 'var req = ' . json_encode($req) . ';';
  868. echo 'var registeredKeys = ' . json_encode($sigs) . ';';
  869. echo 'var appId = req.appId;';
  870. echo 'var registerRequests = [{version: req.version, challenge: req.challenge}];';
  871. }
  872. else {
  873. return;
  874. }
  875. break;
  876. case "u2f-authentication":
  877. header('Content-Type: application/javascript');
  878. if (isset($_SESSION['pending_mailcow_cc_username']) && $_SESSION['pending_mailcow_cc_username'] == $object) {
  879. $auth_data = $u2f->getAuthenticateData(get_u2f_registrations($object));
  880. $challenge = $auth_data[0]->challenge;
  881. $appId = $auth_data[0]->appId;
  882. foreach ($auth_data as $each) {
  883. $key = array(); // Empty array
  884. $key['version'] = $each->version;
  885. $key['keyHandle'] = $each->keyHandle;
  886. $registeredKey[] = $key;
  887. }
  888. $_SESSION['authReq'] = json_encode($auth_data);
  889. echo 'var appId = "' . $appId . '";';
  890. echo 'var challenge = ' . json_encode($challenge) . ';';
  891. echo 'var registeredKeys = ' . json_encode($registeredKey) . ';';
  892. }
  893. else {
  894. return;
  895. }
  896. break;
  897. case "dkim":
  898. switch ($object) {
  899. default:
  900. $data = dkim('details', $object);
  901. process_get_return($data);
  902. break;
  903. }
  904. break;
  905. default:
  906. echo '{}';
  907. break;
  908. }
  909. break;
  910. case "delete":
  911. function process_delete_return($return) {
  912. $generic_failure = json_encode(array(
  913. 'type' => 'error',
  914. 'msg' => 'Cannot delete item'
  915. ));
  916. $generic_success = json_encode(array(
  917. 'type' => 'success',
  918. 'msg' => 'Task completed'
  919. ));
  920. if ($return === false) {
  921. echo isset($_SESSION['return']) ? json_encode($_SESSION['return']) : $generic_failure;
  922. }
  923. else {
  924. echo isset($_SESSION['return']) ? json_encode($_SESSION['return']) : $generic_success;
  925. }
  926. }
  927. if (!isset($_POST['items'])) {
  928. echo $request_incomplete;
  929. exit;
  930. }
  931. else {
  932. $items = (array)json_decode($_POST['items'], true);
  933. }
  934. switch ($category) {
  935. case "alias":
  936. process_delete_return(mailbox('delete', 'alias', array('id' => $items)));
  937. break;
  938. case "relayhost":
  939. process_delete_return(relayhost('delete', array('id' => $items)));
  940. break;
  941. case "rsetting":
  942. process_delete_return(rsettings('delete', array('id' => $items)));
  943. break;
  944. case "syncjob":
  945. process_delete_return(mailbox('delete', 'syncjob', array('id' => $items)));
  946. break;
  947. case "filter":
  948. process_delete_return(mailbox('delete', 'filter', array('id' => $items)));
  949. break;
  950. case "qitem":
  951. process_delete_return(quarantine('delete', array('id' => $items)));
  952. break;
  953. case "bcc":
  954. process_delete_return(bcc('delete', array('id' => $items)));
  955. break;
  956. case "recipient_map":
  957. process_delete_return(recipient_map('delete', array('id' => $items)));
  958. break;
  959. case "tls-policy-map":
  960. process_delete_return(tls_policy_maps('delete', array('id' => $items)));
  961. break;
  962. case "fwdhost":
  963. process_delete_return(fwdhost('delete', array('forwardinghost' => $items)));
  964. break;
  965. case "dkim":
  966. process_delete_return(dkim('delete', array('domains' => $items)));
  967. break;
  968. case "domain":
  969. file_put_contents('/tmp/dssaa', $items);
  970. process_delete_return(mailbox('delete', 'domain', array('domain' => $items)));
  971. break;
  972. case "alias-domain":
  973. process_delete_return(mailbox('delete', 'alias_domain', array('alias_domain' => $items)));
  974. break;
  975. case "mailbox":
  976. process_delete_return(mailbox('delete', 'mailbox', array('username' => $items)));
  977. break;
  978. case "resource":
  979. process_delete_return(mailbox('delete', 'resource', array('name' => $items)));
  980. break;
  981. case "mailbox-policy":
  982. process_delete_return(policy('delete', 'mailbox', array('prefid' => $items)));
  983. break;
  984. case "domain-policy":
  985. process_delete_return(policy('delete', 'domain', array('prefid' => $items)));
  986. break;
  987. case "time_limited_alias":
  988. process_delete_return(mailbox('delete', 'time_limited_alias', array('address' => $items)));
  989. break;
  990. case "eas_cache":
  991. process_delete_return(mailbox('delete', 'eas_cache', array('username' => $items)));
  992. break;
  993. case "domain-admin":
  994. process_delete_return(domain_admin('delete', array('username' => $items)));
  995. break;
  996. case "admin":
  997. process_delete_return(admin('delete', array('username' => $items)));
  998. break;
  999. }
  1000. break;
  1001. case "edit":
  1002. function process_edit_return($return) {
  1003. $generic_failure = json_encode(array(
  1004. 'type' => 'error',
  1005. 'msg' => 'Cannot edit item'
  1006. ));
  1007. $generic_success = json_encode(array(
  1008. 'type' => 'success',
  1009. 'msg' => 'Task completed'
  1010. ));
  1011. if ($return === false) {
  1012. echo isset($_SESSION['return']) ? json_encode($_SESSION['return']) : $generic_failure;
  1013. }
  1014. else {
  1015. echo isset($_SESSION['return']) ? json_encode($_SESSION['return']) : $generic_success;
  1016. }
  1017. }
  1018. if (!isset($_POST['attr'])) {
  1019. echo $request_incomplete;
  1020. exit;
  1021. }
  1022. else {
  1023. $attr = (array)json_decode($_POST['attr'], true);
  1024. unset($attr['csrf_token']);
  1025. $items = isset($_POST['items']) ? (array)json_decode($_POST['items'], true) : null;
  1026. }
  1027. switch ($category) {
  1028. case "bcc":
  1029. process_edit_return(bcc('edit', array_merge(array('id' => $items), $attr)));
  1030. break;
  1031. case "oauth2-client":
  1032. process_edit_return(oauth2('edit', 'client', array_merge(array('id' => $items), $attr)));
  1033. break;
  1034. case "recipient_map":
  1035. process_edit_return(recipient_map('edit', array_merge(array('id' => $items), $attr)));
  1036. break;
  1037. case "tls-policy-map":
  1038. process_edit_return(tls_policy_maps('edit', array_merge(array('id' => $items), $attr)));
  1039. break;
  1040. case "alias":
  1041. process_edit_return(mailbox('edit', 'alias', array_merge(array('id' => $items), $attr)));
  1042. break;
  1043. case "app_links":
  1044. process_edit_return(customize('edit', 'app_links', $attr));
  1045. break;
  1046. case "relayhost":
  1047. process_edit_return(relayhost('edit', array_merge(array('id' => $items), $attr)));
  1048. break;
  1049. case "rsetting":
  1050. process_edit_return(rsettings('edit', array_merge(array('id' => $items), $attr)));
  1051. break;
  1052. case "delimiter_action":
  1053. process_edit_return(mailbox('edit', 'delimiter_action', array_merge(array('username' => $items), $attr)));
  1054. break;
  1055. case "tls_policy":
  1056. process_edit_return(mailbox('edit', 'tls_policy', array_merge(array('username' => $items), $attr)));
  1057. break;
  1058. case "qitem":
  1059. process_edit_return(quarantine('edit', array_merge(array('id' => $items), $attr)));
  1060. break;
  1061. case "quarantine":
  1062. process_edit_return(quarantine('edit', $attr));
  1063. break;
  1064. case "time_limited_alias":
  1065. process_edit_return(mailbox('edit', 'time_limited_alias', array_merge(array('address' => $items), $attr)));
  1066. break;
  1067. case "mailbox":
  1068. process_edit_return(mailbox('edit', 'mailbox', array_merge(array('username' => $items), $attr)));
  1069. break;
  1070. case "syncjob":
  1071. process_edit_return(mailbox('edit', 'syncjob', array_merge(array('id' => $items), $attr)));
  1072. break;
  1073. case "filter":
  1074. process_edit_return(mailbox('edit', 'filter', array_merge(array('id' => $items), $attr)));
  1075. break;
  1076. case "resource":
  1077. process_edit_return(mailbox('edit', 'resource', array_merge(array('name' => $items), $attr)));
  1078. break;
  1079. case "domain":
  1080. process_edit_return(mailbox('edit', 'domain', array_merge(array('domain' => $items), $attr)));
  1081. break;
  1082. case "rl-domain":
  1083. process_edit_return(ratelimit('edit', 'domain', array_merge(array('object' => $items), $attr)));
  1084. break;
  1085. case "rl-mbox":
  1086. process_edit_return(ratelimit('edit', 'mailbox', array_merge(array('object' => $items), $attr)));
  1087. break;
  1088. case "user-acl":
  1089. process_edit_return(acl('edit', 'user', array_merge(array('username' => $items), $attr)));
  1090. break;
  1091. case "da-acl":
  1092. process_edit_return(acl('edit', 'domainadmin', array_merge(array('username' => $items), $attr)));
  1093. break;
  1094. case "alias-domain":
  1095. process_edit_return(mailbox('edit', 'alias_domain', array_merge(array('alias_domain' => $items), $attr)));
  1096. break;
  1097. case "spam-score":
  1098. process_edit_return(mailbox('edit', 'spam_score', array_merge(array('username' => $items), $attr)));
  1099. break;
  1100. case "domain-admin":
  1101. process_edit_return(domain_admin('edit', array_merge(array('username' => $items), $attr)));
  1102. break;
  1103. case "admin":
  1104. process_edit_return(admin('edit', array_merge(array('username' => $items), $attr)));
  1105. break;
  1106. case "fwdhost":
  1107. process_edit_return(fwdhost('edit', array_merge(array('fwdhost' => $items), $attr)));
  1108. break;
  1109. case "fail2ban":
  1110. process_edit_return(fail2ban('edit', array_merge(array('network' => $items), $attr)));
  1111. break;
  1112. case "ui_texts":
  1113. process_edit_return(customize('edit', 'ui_texts', $attr));
  1114. break;
  1115. case "self":
  1116. if ($_SESSION['mailcow_cc_role'] == "domainadmin") {
  1117. process_edit_return(domain_admin('edit', $attr));
  1118. }
  1119. elseif ($_SESSION['mailcow_cc_role'] == "user") {
  1120. process_edit_return(edit_user_account($attr));
  1121. }
  1122. break;
  1123. }
  1124. break;
  1125. }
  1126. }
  1127. }