MFA fix, added IP blacklist, update webmail client

2026-08-14 13:04:55 +01:00
parent 6063f95504
commit 892f366a16
122 changed files with 13362 additions and 251 deletions
@@ -0,0 +1,61 @@
+package webui
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// TestTOTPSetupRendersRealQRImage guards against a real html/template bug found live:
+// html/template's URL-context escaper only allows http/https/mailto schemes for a plain
+// string in a src="..." attribute — a data: URI (how the QR code image is embedded, see
+// totpSetupBegin) gets silently replaced with "#ZgotmplZ" unless typed as template.URL,
+// making the QR code invisible with no server-side error at all.
+func TestTOTPSetupRendersRealQRImage(t *testing.T) {
+	app := newTestApp(t)
+	mux := app.Mux()
+	cookie := loginSession(t, app)
+
+	req := httptest.NewRequest(http.MethodPost, Prefix+"/account/totp/setup", nil)
+	req.AddCookie(cookie)
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	body := rec.Body.String()
+	if strings.Contains(body, "ZgotmplZ") {
+		t.Fatal("QR image src was stripped to #ZgotmplZ — qr_data_uri must be typed as template.URL")
+	}
+	if !strings.Contains(body, "src=\"data:image/png;base64,") {
+		t.Fatalf("expected a real data:image/png;base64 QR image src in the response, got: %s", body)
+	}
+}
+
+// TestWebmailTOTPSetupRendersRealQRImage is the mailbox self-service equivalent of the
+// admin-side test above — same bug, same fix, in webmailTOTPSetupBegin.
+func TestWebmailTOTPSetupRendersRealQRImage(t *testing.T) {
+	app := newTestApp(t)
+	mux := app.Mux()
+	domains, _ := app.DB.ListDomains()
+	mailboxID := createTestMailboxWithPassword(t, app, "totpuser@example.com", domains[0].ID, "portal-password-123!")
+	cookie := webmailLoginSession(t, app, mailboxID)
+
+	req := httptest.NewRequest(http.MethodPost, MailboxPrefix+"/account/totp/setup", nil)
+	req.AddCookie(cookie)
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	body := rec.Body.String()
+	if strings.Contains(body, "ZgotmplZ") {
+		t.Fatal("QR image src was stripped to #ZgotmplZ — qr_data_uri must be typed as template.URL")
+	}
+	if !strings.Contains(body, "src=\"data:image/png;base64,") {
+		t.Fatalf("expected a real data:image/png;base64 QR image src in the response, got: %s", body)
+	}
+}