diff --git a/CHANGELOG.md b/CHANGELOG.md
index a90605c0..45516ea4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,11 @@ v0.53 (April 12, 2021)
* Migrate to the ECDSAP256SHA256 DNSSEC algorithm. If a DS record is set for any of your domain names that have DNS hosted on your box, you will be prompted by status checks to update the DS record.
* Roundcube's login cookie is updated to use a new encryption algorithm (AES-256-CBC instead of DES-EDE-CBC).
+v0.53a (May 8, 2021)
+--------------------
+
+The download URL for Z-Push has been revised becaue the old URL stopped working.
+
v0.53 (April 12, 2021)
----------------------
diff --git a/management/status_checks.py b/management/status_checks.py
index 922bde63..355ffbbb 100755
--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -664,6 +664,8 @@ def check_mail_domain(domain, env, output):
if mx is None:
mxhost = None
+ elif mx == "[timeout]":
+ mxhost = None
else:
# query_dns returns a semicolon-delimited list
# of priority-host pairs.
diff --git a/management/templates/system-backup.html b/management/templates/system-backup.html
index 7cdc3803..a63b38e6 100644
--- a/management/templates/system-backup.html
+++ b/management/templates/system-backup.html
@@ -5,7 +5,7 @@
Backup Status
-
The box makes an incremental backup each night. By default the backup is stored on the machine itself, but you can also have it stored on Amazon S3.
+
The box makes an incremental backup each night. By default the backup is stored on the machine itself, but you can also store in on S3-compatible services like Amazon Web Services (AWS).
Configuration
@@ -17,7 +17,7 @@
-
+
@@ -73,8 +73,8 @@
-
Backups are stored in an Amazon Web Services S3 bucket. You must have an AWS account already.
-
You MUST manually copy the encryption password from to a safe and secure location. You will need this file to decrypt backup files. It is NOT stored in your Amazon S3 bucket.
+
Backups are stored in an S3-compatible bucket. You must have an AWS or other S3 service account already.
+
You MUST manually copy the encryption password from to a safe and secure location. You will need this file to decrypt backup files. It is NOT stored in your S3 bucket.
@@ -84,7 +84,7 @@
{% for name, host in backup_s3_hosts %}
{% endfor %}
-
+
@@ -343,4 +343,4 @@ function init_inputs(target_type) {
set_host($('#backup-target-s3-host-select').val());
}
}
-
\ No newline at end of file
+
diff --git a/management/web_update.py b/management/web_update.py
index ac89d51c..a91fcc0e 100644
--- a/management/web_update.py
+++ b/management/web_update.py
@@ -162,17 +162,27 @@ def make_domain_config(domain, templates, ssl_certificates, env):
for path, url in yaml.get("proxies", {}).items():
# Parse some flags in the fragment of the URL.
pass_http_host_header = False
+ proxy_redirect_off = False
+ frame_options_header_sameorigin = False
m = re.search("#(.*)$", url)
if m:
for flag in m.group(1).split(","):
if flag == "pass-http-host":
pass_http_host_header = True
+ elif flag == "no-proxy-redirect":
+ proxy_redirect_off = True
+ elif flag == "frame-options-sameorigin":
+ frame_options_header_sameorigin = True
url = re.sub("#(.*)$", "", url)
nginx_conf_extra += "\tlocation %s {" % path
nginx_conf_extra += "\n\t\tproxy_pass %s;" % url
+ if proxy_redirect_off:
+ nginx_conf_extra += "\n\t\tproxy_redirect off;"
if pass_http_host_header:
nginx_conf_extra += "\n\t\tproxy_set_header Host $http_host;"
+ if frame_options_header_sameorigin:
+ nginx_conf_extra += "\n\t\tproxy_set_header X-Frame-Options SAMEORIGIN;"
nginx_conf_extra += "\n\t\tproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;"
nginx_conf_extra += "\n\t\tproxy_set_header X-Forwarded-Host $http_host;"
nginx_conf_extra += "\n\t\tproxy_set_header X-Forwarded-Proto $scheme;"
@@ -253,3 +263,4 @@ def get_web_domains_info(env):
}
for domain in get_web_domains(env)
]
+
diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh
index c834701c..6af57dcf 100644
--- a/setup/bootstrap.sh
+++ b/setup/bootstrap.sh
@@ -18,11 +18,11 @@ if [ -z "$TAG" ]; then
# space, but if we put it in a comment it would confuse the status checks!)
# to get the latest version, so the first such line must be the one that we
# want to display in status checks.
- if [ "`lsb_release -d | sed 's/.*:\s*//' | sed 's/18\.04\.[0-9]/18.04/' `" == "Ubuntu 18.04 LTS" ]; then
+ if [ "$(lsb_release -d | sed 's/.*:\s*//' | sed 's/18\.04\.[0-9]/18.04/' )" == "Ubuntu 18.04 LTS" ]; then
# This machine is running Ubuntu 18.04.
- TAG=v0.53
+ TAG=v0.53a
- elif [ "`lsb_release -d | sed 's/.*:\s*//' | sed 's/14\.04\.[0-9]/14.04/' `" == "Ubuntu 14.04 LTS" ]; then
+ elif [ "$(lsb_release -d | sed 's/.*:\s*//' | sed 's/14\.04\.[0-9]/14.04/' )" == "Ubuntu 14.04 LTS" ]; then
# This machine is running Ubuntu 14.04.
echo "You are installing the last version of Mail-in-a-Box that will"
echo "support Ubuntu 14.04. If this is a new installation of Mail-in-a-Box,"
@@ -68,11 +68,11 @@ fi
cd $HOME/mailinabox
# Update it.
-if [ "$TAG" != `git describe` ]; then
+if [ "$TAG" != $(git describe) ]; then
echo Updating Mail-in-a-Box to $TAG . . .
git fetch --depth 1 --force --prune origin tag $TAG
if ! git checkout -q $TAG; then
- echo "Update failed. Did you modify something in `pwd`?"
+ echo "Update failed. Did you modify something in $(pwd)?"
exit 1
fi
echo
diff --git a/setup/dns.sh b/setup/dns.sh
index a7bdefb3..f5a9ba8d 100755
--- a/setup/dns.sh
+++ b/setup/dns.sh
@@ -150,7 +150,7 @@ cat > /etc/cron.daily/mailinabox-dnssec << EOF;
#!/bin/bash
# Mail-in-a-Box
# Re-sign any DNS zones with DNSSEC because the signatures expire periodically.
-`pwd`/tools/dns_update
+$(pwd)/tools/dns_update
EOF
chmod +x /etc/cron.daily/mailinabox-dnssec
diff --git a/setup/firstuser.sh b/setup/firstuser.sh
index e2d6531c..7caec35d 100644
--- a/setup/firstuser.sh
+++ b/setup/firstuser.sh
@@ -1,5 +1,5 @@
# If there aren't any mail users yet, create one.
-if [ -z "`management/cli.py user`" ]; then
+if [ -z "$(management/cli.py user)" ]; then
# The outut of "management/cli.py user" is a list of mail users. If there
# aren't any yet, it'll be empty.
@@ -10,7 +10,7 @@ if [ -z "`management/cli.py user`" ]; then
input_box "Mail Account" \
"Let's create your first mail account.
\n\nWhat email address do you want?" \
- me@`get_default_hostname` \
+ me@$(get_default_hostname) \
EMAIL_ADDR
if [ -z "$EMAIL_ADDR" ]; then
diff --git a/setup/functions.sh b/setup/functions.sh
index 60da46da..8bf3ec96 100644
--- a/setup/functions.sh
+++ b/setup/functions.sh
@@ -10,12 +10,12 @@ function hide_output {
# and returns a non-zero exit code.
# Get a temporary file.
- OUTPUT=$(tempfile)
+ OUTPUT=$(mktemp)
# Execute command, redirecting stderr/stdout to the temporary file. Since we
# check the return code ourselves, disable 'set -e' temporarily.
set +e
- $@ &> $OUTPUT
+ "$@" &> $OUTPUT
E=$?
set -e
@@ -23,7 +23,7 @@ function hide_output {
if [ $E != 0 ]; then
# Something failed.
echo
- echo FAILED: $@
+ echo FAILED: "$@"
echo -----------------------------------------
cat $OUTPUT
echo -----------------------------------------
@@ -54,8 +54,7 @@ function apt_install {
# install' for all of the packages. Calling `dpkg` on each package is slow,
# and doesn't affect what we actually do, except in the messages, so let's
# not do that anymore.
- PACKAGES=$@
- apt_get_quiet install $PACKAGES
+ apt_get_quiet install "$@"
}
function get_default_hostname {
diff --git a/setup/mail-dovecot.sh b/setup/mail-dovecot.sh
index 52b15be9..5b38155b 100755
--- a/setup/mail-dovecot.sh
+++ b/setup/mail-dovecot.sh
@@ -45,8 +45,8 @@ apt_install \
# - https://www.dovecot.org/list/dovecot/2012-August/137569.html
# - https://www.dovecot.org/list/dovecot/2011-December/132455.html
tools/editconf.py /etc/dovecot/conf.d/10-master.conf \
- default_process_limit=$(echo "`nproc` * 250" | bc) \
- default_vsz_limit=$(echo "`free -tm | tail -1 | awk '{print $2}'` / 3" | bc)M \
+ default_process_limit=$(echo "$(nproc) * 250" | bc) \
+ default_vsz_limit=$(echo "$(free -tm | tail -1 | awk '{print $2}') / 3" | bc)M \
log_path=/var/log/mail.log
# The inotify `max_user_instances` default is 128, which constrains
@@ -185,6 +185,7 @@ plugin {
sieve_after = $STORAGE_ROOT/mail/sieve/global_after
sieve = $STORAGE_ROOT/mail/sieve/%d/%n.sieve
sieve_dir = $STORAGE_ROOT/mail/sieve/%d/%n
+ sieve_redirect_envelope_from = recipient
}
EOF
diff --git a/setup/mail-postfix.sh b/setup/mail-postfix.sh
index 2f2385be..ab6cec80 100755
--- a/setup/mail-postfix.sh
+++ b/setup/mail-postfix.sh
@@ -203,7 +203,7 @@ tools/editconf.py /etc/postfix/main.cf \
#
# In a basic setup we would pass mail directly to Dovecot by setting
# virtual_transport to `lmtp:unix:private/dovecot-lmtp`.
-tools/editconf.py /etc/postfix/main.cf virtual_transport=lmtp:[127.0.0.1]:10025
+tools/editconf.py /etc/postfix/main.cf "virtual_transport=lmtp:[127.0.0.1]:10025"
# Because of a spampd bug, limit the number of recipients in each connection.
# See https://github.com/mail-in-a-box/mailinabox/issues/1523.
tools/editconf.py /etc/postfix/main.cf lmtp_destination_recipient_limit=1
diff --git a/setup/management.sh b/setup/management.sh
index 5bf59361..83b2ffac 100755
--- a/setup/management.sh
+++ b/setup/management.sh
@@ -97,7 +97,7 @@ export LANG=en_US.UTF-8
export LC_TYPE=en_US.UTF-8
source $venv/bin/activate
-exec python `pwd`/management/daemon.py
+exec python $(pwd)/management/daemon.py
EOF
chmod +x $inst_dir/start
cp --remove-destination conf/mailinabox.service /lib/systemd/system/mailinabox.service # target was previously a symlink so remove it first
@@ -112,7 +112,7 @@ minute=$((RANDOM % 60)) # avoid overloading mailinabox.email
cat > /etc/cron.d/mailinabox-nightly << EOF;
# Mail-in-a-Box --- Do not edit / will be overwritten on update.
# Run nightly tasks: backup, status checks.
-$minute 3 * * * root (cd `pwd` && management/daily_tasks.sh)
+$minute 3 * * * root (cd $(pwd) && management/daily_tasks.sh)
EOF
# Start the management server.
diff --git a/setup/nextcloud.sh b/setup/nextcloud.sh
index dd18045c..acddfcbe 100755
--- a/setup/nextcloud.sh
+++ b/setup/nextcloud.sh
@@ -102,12 +102,12 @@ InstallNextcloud() {
}
# Nextcloud Version to install. Checks are done down below to step through intermediate versions.
-nextcloud_ver=20.0.1
-nextcloud_hash=f2b3faa570c541df73f209e873a1c2852e79eab8
-contacts_ver=3.4.1
-contacts_hash=aee680a75e95f26d9285efd3c1e25cf7f3bfd27e
-calendar_ver=2.1.2
-calendar_hash=930c07863bb7a65652dec34793802c8d80502336
+nextcloud_ver=20.0.8
+nextcloud_hash=372b0b4bb07c7984c04917aff86b280e68fbe761
+contacts_ver=3.5.1
+contacts_hash=d2ffbccd3ed89fa41da20a1dff149504c3b33b93
+calendar_ver=2.2.0
+calendar_hash=673ad72ca28adb8d0f209015ff2dca52ffad99af
user_external_ver=1.0.0
user_external_hash=3bf2609061d7214e7f0f69dd8883e55c4ec8f50a
@@ -137,7 +137,7 @@ if [ ! -d /usr/local/lib/owncloud/ ] || [[ ! ${CURRENT_NEXTCLOUD_VER} =~ ^$nextc
# Backup the existing ownCloud/Nextcloud.
# Create a backup directory to store the current installation and database to
- BACKUP_DIRECTORY=$STORAGE_ROOT/owncloud-backup/`date +"%Y-%m-%d-%T"`
+ BACKUP_DIRECTORY=$STORAGE_ROOT/owncloud-backup/$(date +"%Y-%m-%d-%T")
mkdir -p "$BACKUP_DIRECTORY"
if [ -d /usr/local/lib/owncloud/ ]; then
echo "Upgrading Nextcloud --- backing up existing installation, configuration, and database to directory to $BACKUP_DIRECTORY..."
@@ -321,7 +321,9 @@ sudo -u www-data php /usr/local/lib/owncloud/occ upgrade
if [ \( $? -ne 0 \) -a \( $? -ne 3 \) ]; then exit 1; fi
# Disable default apps that we don't support
-sudo -u www-data php /usr/local/lib/owncloud/occ app:disable photos dashboard activity
+sudo -u www-data \
+ php /usr/local/lib/owncloud/occ app:disable photos dashboard activity \
+ | (grep -v "No such app enabled" || /bin/true)
# Set PHP FPM values to support large file uploads
# (semicolon is the comment character in this file, hashes produce deprecation warnings)
diff --git a/setup/preflight.sh b/setup/preflight.sh
index acaf80c9..9d2715c5 100644
--- a/setup/preflight.sh
+++ b/setup/preflight.sh
@@ -8,7 +8,7 @@ if [[ $EUID -ne 0 ]]; then
fi
# Check that we are running on Ubuntu 18.04 LTS (or 18.04.xx).
-if [ "`lsb_release -d | sed 's/.*:\s*//' | sed 's/18\.04\.[0-9]/18.04/' `" != "Ubuntu 18.04 LTS" ]; then
+if [ "$(lsb_release -d | sed 's/.*:\s*//' | sed 's/18\.04\.[0-9]/18.04/' )" != "Ubuntu 18.04 LTS" ]; then
echo "Mail-in-a-Box only supports being installed on Ubuntu 18.04, sorry. You are running:"
echo
lsb_release -d | sed 's/.*:\s*//'
diff --git a/setup/start.sh b/setup/start.sh
index 3931b05f..e620f3f7 100755
--- a/setup/start.sh
+++ b/setup/start.sh
@@ -49,7 +49,7 @@ fi
# in the first dialog prompt, so we should do this before that starts.
cat > /usr/local/bin/mailinabox << EOF;
#!/bin/bash
-cd `pwd`
+cd $(pwd)
source setup/start.sh
EOF
chmod +x /usr/local/bin/mailinabox
@@ -97,7 +97,7 @@ PUBLIC_IP=$PUBLIC_IP
PUBLIC_IPV6=$PUBLIC_IPV6
PRIVATE_IP=$PRIVATE_IP
PRIVATE_IPV6=$PRIVATE_IPV6
-MTA_STS_MODE=${MTA_STS_MODE-}
+MTA_STS_MODE=${DEFAULT_MTA_STS_MODE:-enforce}
EOF
# Start service configuration.
diff --git a/setup/web.sh b/setup/web.sh
index 42c301ec..4433ff0d 100755
--- a/setup/web.sh
+++ b/setup/web.sh
@@ -126,13 +126,13 @@ chmod a+r /var/lib/mailinabox/mozilla-autoconfig.xml
# nginx configuration at /.well-known/mta-sts.txt
# more documentation is available on:
# https://www.uriports.com/blog/mta-sts-explained/
-# default mode is "enforce". Change to "testing" which means
-# "Messages will be delivered as though there was no failure
-# but a report will be sent if TLS-RPT is configured" if you
-# are not sure you want this yet. Or "none".
+# default mode is "enforce". In /etc/mailinabox.conf change
+# "MTA_STS_MODE=testing" which means "Messages will be delivered
+# as though there was no failure but a report will be sent if
+# TLS-RPT is configured" if you are not sure you want this yet. Or "none".
PUNY_PRIMARY_HOSTNAME=$(echo "$PRIMARY_HOSTNAME" | idn2)
cat conf/mta-sts.txt \
- | sed "s/MODE/${MTA_STS_MODE:-enforce}/" \
+ | sed "s/MODE/${MTA_STS_MODE}/" \
| sed "s/PRIMARY_HOSTNAME/$PUNY_PRIMARY_HOSTNAME/" \
> /var/lib/mailinabox/mta-sts.txt
chmod a+r /var/lib/mailinabox/mta-sts.txt
diff --git a/setup/webmail.sh b/setup/webmail.sh
index fe5f4693..c3c7262f 100755
--- a/setup/webmail.sh
+++ b/setup/webmail.sh
@@ -48,7 +48,7 @@ needs_update=0 #NODOC
if [ ! -f /usr/local/lib/roundcubemail/version ]; then
# not installed yet #NODOC
needs_update=1 #NODOC
-elif [[ "$UPDATE_KEY" != `cat /usr/local/lib/roundcubemail/version` ]]; then
+elif [[ "$UPDATE_KEY" != $(cat /usr/local/lib/roundcubemail/version) ]]; then
# checks if the version is what we want
needs_update=1 #NODOC
fi
diff --git a/setup/zpush.sh b/setup/zpush.sh
index 1a84e86a..c1c00f2a 100755
--- a/setup/zpush.sh
+++ b/setup/zpush.sh
@@ -23,22 +23,22 @@ phpenmod -v php imap
# Copy Z-Push into place.
VERSION=2.6.2
-TARGETHASH=4b312d64227ef887b24d9cc8f0ae17519586f6e2
+TARGETHASH=f0e8091a8030e5b851f5ba1f9f0e1a05b8762d80
needs_update=0 #NODOC
if [ ! -f /usr/local/lib/z-push/version ]; then
needs_update=1 #NODOC
-elif [[ $VERSION != `cat /usr/local/lib/z-push/version` ]]; then
+elif [[ $VERSION != $(cat /usr/local/lib/z-push/version) ]]; then
# checks if the version
needs_update=1 #NODOC
fi
if [ $needs_update == 1 ]; then
# Download
- wget_verify "https://stash.z-hub.io/rest/api/latest/projects/ZP/repos/z-push/archive?at=refs%2Ftags%2F$VERSION&format=zip" $TARGETHASH /tmp/z-push.zip
+ wget_verify "https://github.com/Z-Hub/Z-Push/archive/refs/tags/$VERSION.zip" $TARGETHASH /tmp/z-push.zip
# Extract into place.
rm -rf /usr/local/lib/z-push /tmp/z-push
unzip -q /tmp/z-push.zip -d /tmp/z-push
- mv /tmp/z-push/src /usr/local/lib/z-push
+ mv /tmp/z-push/*/src /usr/local/lib/z-push
rm -rf /tmp/z-push.zip /tmp/z-push
rm -f /usr/sbin/z-push-{admin,top}