1. 17 Nov, 2015 3 commits
  2. 11 Nov, 2015 1 commit
  3. 08 Nov, 2015 2 commits
  4. 05 Nov, 2015 3 commits
  5. 04 Nov, 2015 1 commit
    • Joshua Tauberer's avatar
      v0.14 · 57b4c685
      Joshua Tauberer authored
      v0.14 (November 4, 2015)
      ------------------------
      
      Mail:
      
      * Spamassassin's network-based tests (Pyzor, others) and DKIM tests are now enabled. (Pyzor had always been installed but was not active due to a misconfiguration.)
      * Moving spam out of the Spam folder and into Trash would incorrectly train Spamassassin that those messages were not spam.
      * Automatically create the Sent and Archive folders for new users.
      * The HTML5_Notifier plugin for Roundcube is now included, which when turned on in Roundcube settings provides desktop notifications for new mail.
      * The Exchange/ActiveSync backend Z-Push has been updated to fix a problem with CC'd emails not being sent to the CC recipients.
      
      Calender/Contacts:
      
      * CalDAV/CardDAV and Exchange/ActiveSync for calendar/contacts wasn't working in some network configurations.
      
      Web:
      
      * When a new domain is added to the box, rather than applying a new self-signed certificate for that domain, the SSL certificate for the box's primary hostname will be used instead.
      * If a custom DNS record is set on a domain or 'www'+domain, web would not be served for that domain. If the custom DNS record is just the box's IP address, that's a configuration mistake, but allow it and let web continue to be served.
      * Accommodate really long domain names by increasing an nginx setting.
      
      Control panel:
      
      * Added an option to check for new Mail-in-a-Box versions within status checks. It is off by default so that boxes don't "phone home" without permission.
      * Added a random password generator on the users page to simplify creating new accounts.
      * When S3 backup credentials are set, the credentials are now no longer ever sent back from the box to the client, for better security.
      * Fixed the jumpiness when a modal is displayed.
      * Focus is put into the login form fields when the login form is displayed.
      * Status checks now include a warning if a custom DNS record has been set on a domain that would normally serve web and as a result that domain no longer is serving web.
      * Status checks now check that secondary nameservers, if specified, are actually serving the domains.
      * Some errors in the control panel when there is invalid data in the database or an improperly named archived user account have been suppressed.
      * Added subresource integrity attributes to all remotely-sourced resources (i.e. via CDNs) to guard against CDNs being used as an attack vector.
      
      System:
      
      * Tweaks to fail2ban settings.
      * Fixed a spurrious warning while installing munin.
      57b4c685
  6. 03 Nov, 2015 2 commits
  7. 01 Nov, 2015 1 commit
  8. 31 Oct, 2015 6 commits
  9. 27 Oct, 2015 4 commits
  10. 25 Oct, 2015 4 commits
  11. 24 Oct, 2015 1 commit
  12. 22 Oct, 2015 2 commits
  13. 18 Oct, 2015 2 commits
  14. 12 Oct, 2015 2 commits
  15. 11 Oct, 2015 1 commit
  16. 10 Oct, 2015 1 commit
  17. 08 Oct, 2015 1 commit
  18. 27 Sep, 2015 1 commit
  19. 18 Sep, 2015 2 commits
    • Joshua Tauberer's avatar
      use subresource integrity attributes to guard against CDNs being used as an... · 6c8ee186
      Joshua Tauberer authored
      use subresource integrity attributes to guard against CDNs being used as an attack vector; drop external resources that we can't protect this way (fonts); fixes #234
      6c8ee186
    • Joshua Tauberer's avatar
      choose the best SSL cert from among the installed certificates; use the server... · 787beab6
      Joshua Tauberer authored
      choose the best SSL cert from among the installed certificates; use the server certificate instead of self-signed certificates
      
      For HTTPS for the non-primary domains, instead of selecting an SSL certificate by expecting it to be in a directory named after the domain name (with special-case lookups
      for www domains, and reusing the server certificate where possible), now scan all of the certificates that have been installed and just pick the best to use for each domain.
      
      If no certificate is available, don't create a self-signed certificate anymore. This wasn't ever really necessary. Instead just use the server certificate.
      787beab6