nahakubuilder/mailgoserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MFA fix, added IP blacklist, update webmail client

Browse Source
This commit is contained in:
nahakubuilder
2026-08-14 13:04:55 +01:00
parent 6063f95504
commit 892f366a16
122 changed files with 13362 additions and 251 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/webui/webmail_webauthn.go
+5 -5
View File
@@ -140,7 +140,7 @@ func (a *App) webmailPasskeyRegisterFinish(w http.ResponseWriter, r *http.Reques
writeJSON(w, http.StatusInternalServerError, M{"error": "Could not save passkey"})
return
}
_ = a.DB.LogAuthAttempt("mailbox_mfa", mbox.Email, requestIP(r), true, "Passkey added: "+name)
_ = a.DB.LogAuthAttempt("mailbox_mfa", mbox.Email, a.requestIP(r), true, "Passkey added: "+name)
writeJSON(w, http.StatusOK, M{"success": true})
}
@@ -149,10 +149,10 @@ func (a *App) webmailPasskeyRemove(w http.ResponseWriter, r *http.Request) {
if err := a.DB.DeleteMailboxWebAuthnCredential(pathID(r), mbox.ID); err != nil {
setFlash(w, "error", "Could not remove passkey")
} else {
_ = a.DB.LogAuthAttempt("mailbox_mfa", mbox.Email, requestIP(r), true, "Passkey removed")
_ = a.DB.LogAuthAttempt("mailbox_mfa", mbox.Email, a.requestIP(r), true, "Passkey removed")
setFlash(w, "success", "Passkey removed")
}
http.Redirect(w, r, MailboxPrefix+"/", http.StatusFound)
http.Redirect(w, r, MailboxPrefix+"/account", http.StatusFound)
}
// webmailPasskeyLoginBegin starts the passkey ceremony for the mailbox that's already
@@ -218,7 +218,7 @@ func (a *App) webmailPasskeyLoginFinish(w http.ResponseWriter, r *http.Request)
}
if _, err := wa.FinishLogin(wu, *session, r); err != nil {
clearMailboxWebauthnSession(w)
_ = a.DB.LogAuthAttempt("webmail_login", mbox.Email, requestIP(r), false, "Passkey verification failed")
_ = a.DB.LogAuthAttempt("webmail_login", mbox.Email, a.requestIP(r), false, "Passkey verification failed")
writeJSON(w, http.StatusUnauthorized, M{"error": "Passkey verification failed"})
return
}
@@ -229,7 +229,7 @@ func (a *App) webmailPasskeyLoginFinish(w http.ResponseWriter, r *http.Request)
writeJSON(w, http.StatusInternalServerError, M{"error": "Could not start session"})
return
}
_ = a.DB.LogAuthAttempt("webmail_login", mbox.Email, requestIP(r), true, "Login successful (passkey)")
_ = a.DB.LogAuthAttempt("webmail_login", mbox.Email, a.requestIP(r), true, "Login successful (passkey)")
clearMailboxPendingMFACookie(w)
setMailboxSessionCookie(w, token, r.TLS != nil)
writeJSON(w, http.StatusOK, M{"success": true})