Seems like if REQUEST_METHOD is set to GET, then we can drop two redundant ways the query string is given. munin-cgi-graph itself reads the environment variables only, but its calls to Perl's CGI::param will look at the command line if REQUEST_METHOD is not used, otherwise it uses environment variables like CGI used to work.

Since this is all behind admin auth anyway, there isn't a public vulnerability. #914 was opened without comment which lead me to notice the redundancy and worry about a vulnerability, before I realized this is admin-only anyway.

The vulnerability was created by 6d6f3ea3.

See #914.

This is the v0.19b hotfix commit.

fixes #911

closes #898

DavDroid's latest version's account configuration no longer just asked for a hostname. Its email address & password configuration mode did not work without a SRV record.

This is checked during preflight. See https://github.com/mail-in-a-box/mailinabox/issues/885 (#889)

Added information about API endpoints

add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon

Small extension to mail log management script

Remove owncloud log configuration from initial setup and only apply it during the configuration updates. This applies to both the timezone and the log format

Owncloud needs more time to detect blocks. It doesn't respond as fast as the other services. Also owncloud logs UTC (since latest update) even though the timezone is not UTC. Also to detect a block, we get a timeout instead of a refused)

for DANE, the smtp_tls_mandatory_protocols setting seems like it also needs to be set (unlike the cipher settings, this isn't documented to be in addition to the non-mandatory setting)

outbound SMTP connections should use the same TLS settings as inbound: drop SSLv2, SSLv3, anonymous ciphers, RC4

Per http://googleappsupdates.blogspot.ro/2016/05/disabling-support-for-sslv3-and-rc4-for.html, Google is about to do the same.

fixes #611

add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon

(tests squashed into this commit by josh)

closes #840

There hasn't been a sqlite migration yet, since Mail-in-a-Box's creation, but with Roundcube 1.2 there will be.

Dovecot LMTP accepted all mail regardless of whether destination was a user, broken by ae8cd4ef, fixes #852

In the earlier commit, I added a Dovecot userdb lookup. Without a userdb lookup, Dovecot would use the password db for user lookups. With a userdb lookup we can support iterating over users.

But I forgot the WHERE clause in the query, resulting in every incoming message being accepted if the user database contained any users at all. Since the mailbox path template is the same for all users, mail was delivered correctly except that mail that should have been rejected was delivered too.

Added a pre-backup script to complement post-backup script.

adding :
target="_blank"
to 
<li><a href="/admin/munin">Munin Monitoring</a></li> on line 96
Why ?
Because when you click on munin link, and follow links, you lose your index, or click back many times...
So i propose my pull request.
Et voilà ^^

can't change roundcube's default_host setting, partially reverts 6d259a6e

The default_host setting is a part of the internal username key. We can't change that without causing Roundcube to create new internal user accounts.