Merge tag 'v0.43' of https://github.com/mail-in-a-box/mailinabox

v0.43 (September 1, 2019)
-------------------------

Security fixes:

* A security issue was discovered in rsync backups. If you have enabled
rsync backups, the file `id_rsa_miab` may have been copied to your
backup destination. This file can be used to access your backup
destination. If the file was copied to your backup destination, we
recommend that you delete the file on your backup destination, delete
`/root/.ssh/id_rsa_miab` on your Mail-in-a-Box, then re-run
Mail-in-a-Box setup, and re-configure your SSH public key at your backup
destination according to the instructions in the Mail-in-a-Box control
panel.
* Brute force attack prevention was missing for the managesieve service.

Setup:

* Nextcloud was not upgraded properly after restoring Mail-in-a-Box from
a backup from v0.40 or earlier.

Mail:

* Upgraded Roundcube to 1.3.10.
* Fetch an updated whitelist for greylisting on a monthly basis to
reduce the number of delayed incoming emails.

Control panel:

* When using secondary DNS, it is now possible to specify a subnet range
with the `xfr:` option.
* Fixed an issue when the secondary DNS option is used and the secondary
DNS hostname resolves to multiple IP addresses.
* Fix a bug in how a backup configuration error is shown.

5F4C0E7313CCD744693B2AEAB92041F4C10BDD81

management/templates/custom-dns.html

@@ -90,7 +90,7 @@
     <div class="col-sm-offset-1 col-sm-11">
       <p class="small">
         Multiple secondary servers can be separated with commas or spaces (i.e., <code>ns2.hostingcompany.com ns3.hostingcompany.com</code>). 
-        To enable zone transfers to additional servers without listing them as secondary nameservers, add <code>xfr:IPADDRESS</code>.
+        To enable zone transfers to additional servers without listing them as secondary nameservers, add an IP address or subnet using <code>xfr:10.20.30.40</code> or <code>xfr:10.20.30.40/24</code>.
       </p>
       <p id="secondarydns-clear-instructions" style="display: none" class="small">
         Clear the input field above and click Update to use this machine itself as secondary DNS, which is the default/normal setup.

management/templates/login.html

@@ -17,13 +17,13 @@ sudo tools/mail.py user make-admin me@{{hostname}}</pre>
   {% endif %}
   <hr>
 </div>
-</div>  
+</div>
 {% endif %}
 
 <p style="margin: 2em; text-align: center;">Log in here for your Mail-in-a-Box control panel.</p>
 
 <div style="margin: 0 auto; max-width: 32em;">
-  <form class="form-horizontal" role="form" onsubmit="do_login(); return false;">
+  <form class="form-horizontal" role="form" onsubmit="do_login(); return false;" method="get">
     <div class="form-group">
       <label for="inputEmail3" class="col-sm-3 control-label">Email</label>
       <div class="col-sm-9">
@@ -76,7 +76,7 @@ function do_login() {
   "/me",
   "GET",
   { },
-  function(response){ 
+  function(response){
     // This API call always succeeds. It returns a JSON object indicating
     // whether the request was authenticated or not.
     if (response.status != "ok") {

management/templates/system-backup.html

@@ -77,15 +77,22 @@
     </div>
   </div>
   <div class="form-group backup-target-s3">
-    <label for="backup-target-s3-host" class="col-sm-2 control-label">S3 Region</label>
+    <label for="backup-target-s3-host-select" class="col-sm-2 control-label">S3 Region</label>
     <div class="col-sm-8">
-      <select class="form-control" rows="1" id="backup-target-s3-host">
+      <select class="form-control" rows="1" id="backup-target-s3-host-select">
         {% for name, host in backup_s3_hosts %}
           <option value="{{host}}">{{name}}</option>
         {% endfor %}
+        <option value="other">Other</option>
       </select>
     </div>
   </div>
+  <div class="form-group backup-target-s3">
+    <label for="backup-target-s3-host" class="col-sm-2 control-label">S3 Host / Endpoint</label>
+    <div class="col-sm-8">
+      <input type="text" placeholder="Endpoint" class="form-control" rows="1" id="backup-target-s3-host">
+    </div>
+  </div>
   <div class="form-group backup-target-s3">
     <label for="backup-target-s3-path" class="col-sm-2 control-label">S3 Path</label>
     <div class="col-sm-8">
@@ -139,6 +146,8 @@ function toggle_form() {
   var target_type = $("#backup-target-type").val();
   $(".backup-target-local, .backup-target-rsync, .backup-target-s3").hide();
   $(".backup-target-" + target_type).show();
+
+  init_inputs(target_type);
 }
 
 function nice_size(bytes) {
@@ -278,4 +287,20 @@ function set_custom_backup() {
     });
   return false;
 }
+
+function init_inputs(target_type) {
+  function set_host(host) {
+    if(host !== 'other') {
+      $("#backup-target-s3-host").val(host);
+    } else {
+      $("#backup-target-s3-host").val('');
+    }
+  }
+  if (target_type == "s3") {
+    $('#backup-target-s3-host-select').off('change').on('change', function() {
+      set_host($('#backup-target-s3-host-select').val());
+    });
+    set_host($('#backup-target-s3-host-select').val());
+  }
+}
 </script>