Skip to content

Commit eb40d64

Browse files
serghey-rodinserghey-rodin
committed
password reset support for rouncube webmail
1 parent 32bb9ff commit eb40d64

5 files changed

Lines changed: 306 additions & 1 deletion

File tree

‎bin/v-get-mail-account-value‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
#!/bin/bash
2+
# info: get mail account value
3+
# options: user domain account key
4+
#
5+
# The function for getting a certain mail account parameter.
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Argument defenition
13+
user=$1
14+
domain=$(idn -t --quiet -u "$2" )
15+
domain_idn=$(idn -t --quiet -a "$domain")
16+
account=$3
17+
key=$(echo "$4"| tr '[:lower:]' '[:upper:]'|sed -e "s/^/$/")
18+
19+
# Includes
20+
source $VESTA/func/main.sh
21+
22+
23+
#----------------------------------------------------------#
24+
# Verifications #
25+
#----------------------------------------------------------#
26+
27+
check_args '3' "$#" 'user domain key'
28+
validate_format 'user' 'domain'
29+
is_object_valid 'user' 'USER' "$user"
30+
is_object_valid 'mail' 'DOMAIN' "$domain"
31+
is_object_valid "mail/$domain" 'ACCOUNT' "$account"
32+
33+
34+
#----------------------------------------------------------#
35+
# Action #
36+
#----------------------------------------------------------#
37+
38+
# Print
39+
get_object_value "mail/$domain" 'ACCOUNT' "$account" "$key"
40+
41+
42+
#----------------------------------------------------------#
43+
# Vesta #
44+
#----------------------------------------------------------#
45+
46+
# Logging
47+
log_event "$OK" "$EVENT"
48+
49+
exit

‎bin/v-get-mail-domain-value‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#!/bin/bash
2+
# info: get mail domain value
3+
# options: user domain key
4+
#
5+
# The function for getting a certain mail domain parameter.
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Argument defenition
13+
user=$1
14+
domain=$(idn -t --quiet -u "$2" )
15+
domain_idn=$(idn -t --quiet -a "$domain")
16+
key=$(echo "$3"| tr '[:lower:]' '[:upper:]'|sed -e "s/^/$/")
17+
18+
# Includes
19+
source $VESTA/func/main.sh
20+
21+
22+
#----------------------------------------------------------#
23+
# Verifications #
24+
#----------------------------------------------------------#
25+
26+
check_args '3' "$#" 'user domain key'
27+
validate_format 'user' 'domain'
28+
is_object_valid 'user' 'USER' "$user"
29+
is_object_valid 'mail' 'DOMAIN' "$domain"
30+
31+
32+
#----------------------------------------------------------#
33+
# Action #
34+
#----------------------------------------------------------#
35+
36+
# Print
37+
get_object_value 'mail' 'DOMAIN' "$domain" "$key"
38+
39+
40+
#----------------------------------------------------------#
41+
# Vesta #
42+
#----------------------------------------------------------#
43+
44+
# Logging
45+
log_event "$OK" "$EVENT"
46+
47+
exit

‎bin/v-search-domain-owner‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
#!/bin/bash
2+
# info: search domain owner
3+
# options: domain [type]
4+
#
5+
# The function that allows to find user objects.
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Argument defenition
13+
domain=$(idn -t --quiet -u "$1" )
14+
type=${2-any}
15+
16+
# Includes
17+
source $VESTA/func/main.sh
18+
19+
20+
#----------------------------------------------------------#
21+
# Verifications #
22+
#----------------------------------------------------------#
23+
24+
check_args '1' "$#" 'domain [type]'
25+
26+
27+
#----------------------------------------------------------#
28+
# Action #
29+
#----------------------------------------------------------#
30+
31+
# Define conf
32+
case $type in
33+
web) conf="$VESTA/data/users/*/web.conf" ;;
34+
dns) conf="$VESTA/data/users/*/dns.conf" ;;
35+
mail) conf="$VESTA/data/users/*/mail.conf" ;;
36+
*) conf="$VESTA/data/users/*/*.conf"
37+
esac
38+
39+
40+
owner=$(grep "DOMAIN='$domain'" $conf | head -n 1 | cut -f7 -d '/')
41+
if [ -z "$owner" ]; then
42+
exit $E_NOTEXIST
43+
fi
44+
45+
echo $owner
46+
47+
48+
#----------------------------------------------------------#
49+
# Vesta #
50+
#----------------------------------------------------------#
51+
52+
# Logging
53+
#log_event "$OK" "$EVENT"
54+
55+
exit

‎web/inc/main.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
// Check user session
3-
if (!isset($_SESSION['user'])) {
3+
if ((!isset($_SESSION['user'])) && (!isset($api_mode))) {
44
$_SESSION['request_uri'] = $_SERVER['REQUEST_URI'];
55
header("Location: /login/");
66
exit;

‎web/reset/mail/index.php‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
<?php
2+
// Init
3+
error_reporting(NULL);
4+
$api_mode = true;
5+
6+
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
7+
8+
//
9+
// sourceforge.net/projects/postfixadmin/
10+
// md5crypt
11+
// Action: Creates MD5 encrypted password
12+
// Call: md5crypt (string cleartextpassword)
13+
//
14+
15+
function md5crypt ($pw, $salt="", $magic="")
16+
{
17+
$MAGIC = "$1$";
18+
19+
if ($magic == "") $magic = $MAGIC;
20+
if ($salt == "") $salt = create_salt ();
21+
$slist = explode ("$", $salt);
22+
if ($slist[0] == "1") $salt = $slist[1];
23+
24+
$salt = substr ($salt, 0, 8);
25+
$ctx = $pw . $magic . $salt;
26+
$final = hex2bin (md5 ($pw . $salt . $pw));
27+
28+
for ($i=strlen ($pw); $i>0; $i-=16)
29+
{
30+
if ($i > 16)
31+
{
32+
$ctx .= substr ($final,0,16);
33+
}
34+
else
35+
{
36+
$ctx .= substr ($final,0,$i);
37+
}
38+
}
39+
$i = strlen ($pw);
40+
41+
while ($i > 0)
42+
{
43+
if ($i & 1) $ctx .= chr (0);
44+
else $ctx .= $pw[0];
45+
$i = $i >> 1;
46+
}
47+
$final = hex2bin (md5 ($ctx));
48+
49+
for ($i=0;$i<1000;$i++)
50+
{
51+
$ctx1 = "";
52+
if ($i & 1)
53+
{
54+
$ctx1 .= $pw;
55+
}
56+
else
57+
{
58+
$ctx1 .= substr ($final,0,16);
59+
}
60+
if ($i % 3) $ctx1 .= $salt;
61+
if ($i % 7) $ctx1 .= $pw;
62+
if ($i & 1)
63+
{
64+
$ctx1 .= substr ($final,0,16);
65+
}
66+
else
67+
{
68+
$ctx1 .= $pw;
69+
}
70+
$final = hex2bin (md5 ($ctx1));
71+
}
72+
$passwd = "";
73+
$passwd .= to64 (((ord ($final[0]) << 16) | (ord ($final[6]) << 8) | (ord ($final[12]))), 4);
74+
$passwd .= to64 (((ord ($final[1]) << 16) | (ord ($final[7]) << 8) | (ord ($final[13]))), 4);
75+
$passwd .= to64 (((ord ($final[2]) << 16) | (ord ($final[8]) << 8) | (ord ($final[14]))), 4);
76+
$passwd .= to64 (((ord ($final[3]) << 16) | (ord ($final[9]) << 8) | (ord ($final[15]))), 4);
77+
$passwd .= to64 (((ord ($final[4]) << 16) | (ord ($final[10]) << 8) | (ord ($final[5]))), 4);
78+
$passwd .= to64 (ord ($final[11]), 2);
79+
return "$magic$salt\$$passwd";
80+
}
81+
82+
83+
//
84+
// sourceforge.net/projects/postfixadmin/
85+
// to64
86+
//
87+
88+
function to64 ($v, $n)
89+
{
90+
$ITOA64 = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
91+
$ret = "";
92+
while (($n - 1) >= 0)
93+
{
94+
$n--;
95+
$ret .= $ITOA64[$v & 0x3f];
96+
$v = $v >> 6;
97+
}
98+
return $ret;
99+
}
100+
101+
102+
// Check arguments
103+
if ((!empty($_POST['email'])) && (!empty($_POST['password'])) && (!empty($_POST['new']))) {
104+
list($v_account, $v_domain) = explode('@', $_POST['email']);
105+
$v_domain = escapeshellarg($v_domain);
106+
$v_account = escapeshellarg($v_account);
107+
$password = $_POST['password'];
108+
$new = escapeshellarg($_POST['new']);
109+
110+
// Get domain owner
111+
exec (VESTA_CMD."v-search-domain-owner ".$v_domain." 'mail'", $output, $return_var);
112+
if ($return_var == 0) {
113+
$v_user = $output[0];
114+
}
115+
unset($output);
116+
117+
// Get current md5 hash
118+
if (!empty($v_user)) {
119+
exec (VESTA_CMD."v-get-mail-account-value '".$v_user."' ".$v_domain." ".$v_account." 'md5'", $output, $return_var);
120+
if ($return_var == 0) {
121+
$v_hash = $output[0];
122+
}
123+
}
124+
unset($output);
125+
126+
// Compare hashes
127+
if (!empty($v_hash)) {
128+
$salt = explode('$', $v_hash);
129+
$n_hash = md5crypt($password, $salt[2]);
130+
$n_hash = '{MD5}'.$n_hash;
131+
132+
// Change password
133+
if ( $v_hash == $n_hash ) {
134+
exec (VESTA_CMD."v-change-mail-account-password '".$v_user."' ".$v_domain." ".$v_account." ".$new, $output, $return_var);
135+
$fp = fopen('/tmp/vst.log', 'w');
136+
fwrite($fp, "Owner: ".$v_user."\n");
137+
fwrite($fp, "Hash: ".$v_hash."\n");
138+
fwrite($fp, "New: ".$n_hash."\n");
139+
fwrite($fp, "Salt : ".$salt[2]."\n");
140+
fwrite($fp, "Password: ".$password."\n");
141+
fwrite($fp, "Return: ".$return_var."\n");
142+
fclose($fp);
143+
144+
if ($return_var == 0) {
145+
echo "ok";
146+
exit;
147+
}
148+
}
149+
}
150+
}
151+
152+
echo 'error';
153+
154+
exit;

0 commit comments

Comments
 (0)