MFA fix, added IP blacklist, update webmail client

internal/webui/account.go

@@ -3,6 +3,7 @@ package webui
 import (
 	"bytes"
 	"encoding/base64"
+	"html/template"
 	"image/png"
 	"net/http"
 	"strings"
@@ -96,7 +97,11 @@ func (a *App) totpSetupBegin(w http.ResponseWriter, r *http.Request) {
 			qrDataURI = "data:image/png;base64," + base64.StdEncoding.EncodeToString(buf.Bytes())
 		}
 	}
-	a.render(w, r, "totp_setup.html", M{"secret": key.Secret(), "qr_data_uri": qrDataURI})
+	// html/template's URL-context escaper only allows http/https/mailto schemes for a
+	// plain string in a src="..." attribute — anything else, including data: URIs,
+	// gets silently replaced with "#ZgotmplZ" (confirmed live). template.URL marks
+	// this value as pre-approved so the actual QR image renders instead of nothing.
+	a.render(w, r, "totp_setup.html", M{"secret": key.Secret(), "qr_data_uri": template.URL(qrDataURI)})
 }
 
 // totpSetupConfirm verifies a code against the pending secret and, if correct, flips
@@ -114,7 +119,7 @@ func (a *App) totpSetupConfirm(w http.ResponseWriter, r *http.Request) {
 		http.Redirect(w, r, Prefix+"/account", http.StatusFound)
 		return
 	}
-	_ = a.DB.LogAuthAttempt("admin_mfa", user.Username, requestIP(r), true, "TOTP authenticator enabled")
+	_ = a.DB.LogAuthAttempt("admin_mfa", user.Username, a.requestIP(r), true, "TOTP authenticator enabled")
 	setFlash(w, "success", "Authenticator app MFA enabled")
 	http.Redirect(w, r, Prefix+"/account", http.StatusFound)
 }
@@ -124,7 +129,7 @@ func (a *App) totpDisable(w http.ResponseWriter, r *http.Request) {
 	if err := a.DB.DisableAdminTOTP(user.ID); err != nil {
 		setFlash(w, "error", "Something went wrong")
 	} else {
-		_ = a.DB.LogAuthAttempt("admin_mfa", user.Username, requestIP(r), true, "TOTP authenticator disabled")
+		_ = a.DB.LogAuthAttempt("admin_mfa", user.Username, a.requestIP(r), true, "TOTP authenticator disabled")
 		setFlash(w, "success", "Authenticator app MFA disabled")
 	}
 	http.Redirect(w, r, Prefix+"/account", http.StatusFound)