Mirrors/mailcow-dockerized
1
0
Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-01-22 18:04:44 +00:00
Code Issues Projects Releases Wiki Activity

autodiscover: use generalized error logging instead of specific to prevent user enumeration

Browse source
This commit is contained in:
DerLinkman 2025-12-18 16:54:45 +01:00
parent b005803fe0
commit 5ca900749c
No known key found for this signature in database
GPG key ID: AA4A82514748F5A9
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
data/web/autodiscover.php
View file

@ -165,7 +165,7 @@ catch(PDOException $e) {
exit(0);
}
// Mailbox not found or not active - return error
// Mailbox not found or not active - return generic error to prevent user enumeration
if (empty($MailboxData)) {
try {
$json = json_encode(
@ -188,7 +188,7 @@ if (empty($MailboxData)) {
<Response>
<Error Time="<?=date('H:i:s', $sec) . substr($usec, 0, strlen($usec) - 2);?>" Id="<?=rand(1000000000, 9999999999);?>">
<ErrorCode>600</ErrorCode>
<Message>Mailbox not found</Message>
<Message>Invalid Request</Message>
<DebugData />
</Error>
</Response>