Ticket created by ~mfashby on ~migadu/alps
So that e.g. fail2ban can be configured to block users who are attempting credentials stuffing.
This could also be handled at the IMAP server, however alps is running on the same host, and it's not desirable to rate-limit connections from localhost.
Simply logging the failed login attempts with a clear pattern and the connecting user's IP allows a fail2ban rule to be added which offers some protection from this kind of abuse.
Comment by ~mfashby on ~migadu/alps
I still haven't quite figured this out. The error message is coming from the server, which means it thinks we're sending an invalid command, I think. The command looks fine to me though,
It's worth noting this is only happening for a server running dovecot. I'm using alps on two mail servers, one with dovecot version
1:2.3.4.1-5+deb10u6and another running maddy versionv0.4.4and this error is only occurring on the former.If it's not very harmful for performance, I might submit a patch with this workaround. The downside will be a few more SELECT commands issued.
Comment by ~mfashby on ~migadu/alps
There's some kind of internal state causing this. If I restart alps, the problem goes away (and I can see the sent message) I experimented a little, and found the following change to fix the bug, but I'm not totally sure why it works:
diff --git a/plugins/base/imap.go b/plugins/base/imap.go index 64b3164..089a374 100644 --- a/plugins/base/imap.go +++ b/plugins/base/imap.go @@ -151,12 +151,12 @@ func getMailboxByType(conn *imapclient.Client, mboxType mailboxType) (*MailboxIn } func ensureMailboxSelected(conn *imapclient.Client, mboxName string) error { - mbox := conn.Mailbox() - if mbox == nil || mbox.Name != mboxName { + // mbox := conn.Mailbox() + //if mbox == nil || mbox.Name != mboxName { if _, err := conn.Select(mboxName, false); err != nil { return fmt.Errorf("failed to select mailbox: %v", err) } - } + //} return nil }
Ticket created by ~mfashby on ~migadu/alps
To reproduce:
- have an IMAP account missing a common folder, e.g. Trash
- use sourcehut with the 'alps' theme configured
Expected behaviour:
- mailbox page renders correctly
Actual behaviour:
- mailbox page crashes
This is happening because there is an assumption built into themes/alps/util.html that all the common mailboxes are present. Some mail servers (maddy.email in this case) do not automatically include a Trash folder.
Comment by ~mfashby on ~migadu/alps
Closing; this works as expected and I've submitted a patch to clarify the documentation (thanks for accepting)
I'll open separate tickets for subsequent issues.
REPORTED RESOLVED FIXED
Comment by ~mfashby on ~migadu/alps
I thought it might be the reverse proxy, but it's much simpler than that:
The loginToken cookie is only set if the 'remember me' checkbox is ticked on the login page. This checkbox is only present in the 'alps' theme, not the base or sourcehut themes.
It should probably be added to those themes I guess.
Separately, the alps theme crashes when it tries to load my inbox, but another issue should be raised for that probably.
Comment by ~mfashby on ~migadu/alps
I added some logging, seems the cookie is getting lost somehow. Logging:
@@ -315,6 +315,11 @@ func (ctx *Context) SetLoginToken(username, password string) { func (ctx *Context) GetLoginToken() (string, string) { cookie, err := ctx.Cookie(loginTokenCookieName) if err != nil || cookie == nil { + if err != nil { + log.Println(err) + } else { + log.Println("cookie is null") + } return "", "" }Result:
⇨ http server started on 0.0.0.0:1323 2021/07/04 14:07:47 http: named cookie not present
Comment by ~mfashby on ~migadu/alps
Turned debug logging on and tried again, nothing interesting I can see.
2021-07-04T13:56:32Z - Configured upstream IMAP server: <mail server> 2021-07-04T13:56:32Z - Configured upstream SMTP server: <mail server> 2021-07-04T13:56:32Z - Loaded plugin "base" 2021-07-04T13:56:32Z - Loaded plugin "viewhtml" 2021-07-04T13:56:32Z - Loaded plugin "viewtext" 2021-07-04T13:56:32Z - Loading theme "alps" 2021-07-04T13:56:32Z - Loading theme "sourcehut" ⇨ http server started on 0.0.0.0:1323 2021-07-04T13:56:35Z method=GET, uri=/login?next=%2Fmailbox%2FINBOX, status=200Will do some more digging.
Ticket created by ~mfashby on ~migadu/alps
Steps to reproduce:
- Generate a key for the -login-key option. I've submitted a patch to add documentation here (https://lists.sr.ht/~migadu/alps-devel/patches/23601)
- Start alps using the -login-key option.
- Login in my browser.
- Restart alps ensuring the same -login-key is specified.
- Reload the page in my browser.
Expected behaviour:
- Page loads and I'm still logged in.
Actual behaviour:
- I am redirected to the login screen.
Notes: Since this option appears to be undocumented, perhaps it simply isn't finished and tested yet. I can do some further investigation later.
Comment by ~mfashby on ~migadu/alps
Sure! Here's the output
Testing! --c45ca1d3d95e1241471edb400a1612a217e01e3784049836d59b3e795705-- 5hYANQ OK [APPENDUID 1223931916 1094] Append completed (0.051 + 0.000 + 0.050 secs). 2020-11-30T22:24:48Z method=POST, uri=/compose, status=302 6otHUQ GETMETADATA "" ("/private/vendor/alps/base.settings") * METADATA "" (/private/vendor/alps/base.settings NIL) 6otHUQ OK Getmetadata completed (0.001 + 0.000 secs). wXr5rQ LIST "" "*" * LIST (\NoInferiors \UnMarked) "/" Receipts * LIST (\NoInferiors \UnMarked) "/" Archive * LIST (\NoInferiors \UnMarked) "/" "Archive 20130323" * LIST (\NoInferiors \UnMarked) "/" "Archive 20170919" * LIST (\NoInferiors \UnMarked) "/" Keys * LIST (\NoInferiors \UnMarked) "/" "Archive 20111203" * LIST (\NoInferiors \Drafts) "/" Drafts * LIST (\NoInferiors \UnMarked) "/" "Archive 20110915" * LIST (\NoInferiors \UnMarked) "/" house * LIST (\NoInferiors \UnMarked) "/" Archives * LIST (\NoInferiors \UnMarked) "/" Bookings * LIST (\NoInferiors \UnMarked) "/" "Archive 20140106" * LIST (\NoInferiors \Junk) "/" Junk * LIST (\NoInferiors \UnMarked) "/" "Archive 20110322" * LIST (\NoInferiors \UnMarked) "/" Spam * LIST (\NoInferiors \Marked \Sent) "/" Sent * LIST (\NoInferiors \Trash) "/" Trash * LIST (\Noselect \HasChildren) "/" Shared * LIST (\HasNoChildren \UnMarked) "/" Shared/Genealogy * LIST (\HasNoChildren) "/" Shared/Addresses * LIST (\HasNoChildren) "/" INBOX wXr5rQ OK List completed (0.001 + 0.000 secs). Oln9BA STATUS INBOX (MESSAGES UIDVALIDITY UNSEEN) * STATUS INBOX (MESSAGES 11 UIDVALIDITY 1223931848 UNSEEN 2) Oln9BA OK [CLIENTBUG] Status on selected mailbox completed (0.001 + 0.000 secs). -Gs3CA GETMETADATA "" ("/private/vendor/alps/base.settings") * METADATA "" (/private/vendor/alps/base.settings NIL) -Gs3CA OK Getmetadata completed (0.001 + 0.000 secs). 5u6iBA FETCH 1:11 (FLAGS ENVELOPE UID BODYSTRUCTURE) 5u6iBA BAD Error in IMAP command FETCH: Invalid messageset (0.001 + 0.000 secs). 2020-11-30T22:24:48Z ERROR failed to fetch message list: Error in IMAP command FETCH: Invalid messageset (0.001 + 0.000 secs). 2020-11-30T22:24:48Z method=GET, uri=/mailbox/INBOX, status=500It seems like that last FETCH command is problematic, but I'm not sure why
5u6iBA FETCH 1:11 (FLAGS ENVELOPE UID BODYSTRUCTURE)