nahakubuilder/mailgoserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MFA fix, added IP blacklist, update webmail client

Browse Source
This commit is contained in:
nahakubuilder
2026-08-14 13:04:55 +01:00
parent 6063f95504
commit 892f366a16
122 changed files with 13362 additions and 251 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/webui/mfa_enforcement_test.go
+13 -6
View File
@@ -134,9 +134,9 @@ func TestMailboxMFAEnforcementLetsLoginThroughButIsolatesEverythingElse(t *testi
t.Fatal("expected a session cookie despite no MFA configured")
}
// The dashboard, password change, and app-password creation are ALL redirected
// to the isolated setup page — nothing else is reachable in the browser.
blockedGets := []string{MailboxPrefix + "/"}
// The mailbox, account page, password change, and app-password creation are ALL
// redirected to the isolated setup page — nothing else is reachable in the browser.
blockedGets := []string{MailboxPrefix + "/", MailboxPrefix + "/account"}
for _, path := range blockedGets {
req = httptest.NewRequest(http.MethodGet, path, nil)
req.AddCookie(cookie)
@@ -193,8 +193,8 @@ func TestMailboxMFAEnforcementLetsLoginThroughButIsolatesEverythingElse(t *testi
t.Error("expected no other portal sections on the isolated setup page")
}
// Once TOTP is configured, everything works normally again — dashboard, password
// change, and app passwords.
// Once TOTP is configured, everything works normally again — mailbox, account
// page, password change, and app passwords.
if err := app.DB.SetMailboxTOTPSecret(mboxID, "JBSWY3DPEHPK3PXP", true); err != nil {
t.Fatal(err)
}
@@ -202,8 +202,15 @@ func TestMailboxMFAEnforcementLetsLoginThroughButIsolatesEverythingElse(t *testi
req.AddCookie(cookie)
rec = httptest.NewRecorder()
mux.ServeHTTP(rec, req)
if rec.Code != http.StatusFound || rec.Header().Get("Location") != MailboxPrefix+"/mail/INBOX" {
t.Fatalf("mailbox root: expected reachable (redirect to inbox) after enabling MFA, got %d Location=%q", rec.Code, rec.Header().Get("Location"))
}
req = httptest.NewRequest(http.MethodGet, MailboxPrefix+"/account", nil)
req.AddCookie(cookie)
rec = httptest.NewRecorder()
mux.ServeHTTP(rec, req)
if rec.Code != http.StatusOK {
t.Fatalf("dashboard: expected reachable after enabling MFA, got %d", rec.Code)
t.Fatalf("account page: expected reachable after enabling MFA, got %d", rec.Code)
}
req = httptest.NewRequest(http.MethodPost, MailboxPrefix+"/account/password", strings.NewReader(pwForm.Encode()))