From daab7bf6995fb006d9612da9d9540f30b94889b5 Mon Sep 17 00:00:00 2001 From: Pierre-Olivier Mercier Date: Fri, 31 May 2024 17:08:15 +0200 Subject: [PATCH 1/8] Can delete own aliases --- addy.go | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++------ login.go | 8 ++++++-- main.go | 3 ++- 3 files changed, 62 insertions(+), 9 deletions(-) diff --git a/addy.go b/addy.go index fcb76d4..806717c 100644 --- a/addy.go +++ b/addy.go @@ -66,25 +66,32 @@ func checkAddyApiAuthorization(authorization []byte) *string { return &username } -func addyAliasAPI(w http.ResponseWriter, r *http.Request) { +func addyAliasAPIAuth(r *http.Request) (*string, error) { // Check authorization header fields := strings.Fields(r.Header.Get("Authorization")) if len(fields) != 2 || fields[0] != "Bearer" { - http.Error(w, "Authorization header should be a valid Bearer token", http.StatusUnauthorized) - return + return nil, fmt.Errorf("Authorization header should be a valid Bearer token") } // Decode header authorization, err := base32.StdEncoding.DecodeString(fields[1]) if err != nil { log.Println("Invalid Authorization header: %s", err.Error()) - http.Error(w, "Authorization header should be a valid Bearer token", http.StatusUnauthorized) - return + return nil, err } user := checkAddyApiAuthorization(authorization) if user == nil { - http.Error(w, "Not authorized", http.StatusUnauthorized) + return nil, fmt.Errorf("Not authorized") + } + + return user, nil +} + +func addyAliasAPI(w http.ResponseWriter, r *http.Request) { + user, err := addyAliasAPIAuth(r) + if err != nil { + http.Error(w, err.Error(), http.StatusUnauthorized) return } @@ -154,6 +161,47 @@ func addyAliasAPI(w http.ResponseWriter, r *http.Request) { } } +func addyAliasAPIDelete(w http.ResponseWriter, r *http.Request) { + user, err := addyAliasAPIAuth(r) + if err != nil { + http.Error(w, err.Error(), http.StatusUnauthorized) + return + } + + email := r.PathValue("alias") + + conn, err := myLDAP.Connect() + if err != nil || conn == nil { + log.Println(err) + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + + err = conn.ServiceBind() + if err != nil { + log.Println(err) + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + + dn, err := conn.SearchDN(*user, true) + if err != nil { + log.Println(err) + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + + err = conn.DelMailAlias(dn, email) + if err != nil { + log.Println(err) + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + + log.Printf("Alias deleted for %s: %s", dn, email) + http.Error(w, "", http.StatusOK) +} + func generateRandomString(length int) string { charset := "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" result := make([]byte, length) diff --git a/login.go b/login.go index a702e07..a00ca0c 100644 --- a/login.go +++ b/login.go @@ -50,17 +50,21 @@ func tryLogin(w http.ResponseWriter, r *http.Request) { log.Println(err) displayTmplError(w, http.StatusInternalServerError, "login.html", map[string]interface{}{"error": err.Error()}) } else { + apiToken := AddyAPIToken(r.PostFormValue("login")) + cnt := "

To use our Addy.io compatible API, use the following token: " + AddyAPIToken(r.PostFormValue("login")) + "

")}) + displayTmpl(w, "message.html", map[string]interface{}{"details": template.HTML(`Login ok

Here are the information we have about you:` + cnt + "

To use our Addy.io compatible API, use the following token: " + apiToken + "

")}) } } diff --git a/main.go b/main.go index 696b94e..f1b4436 100644 --- a/main.go +++ b/main.go @@ -148,8 +148,9 @@ func main() { signal.Notify(interrupt, os.Interrupt, syscall.SIGTERM) // Register handlers - http.HandleFunc(fmt.Sprintf("%s/", *baseURL), changePassword) + http.HandleFunc(fmt.Sprintf("%s/{$}", *baseURL), changePassword) http.HandleFunc(fmt.Sprintf("POST %s/api/v1/aliases", *baseURL), addyAliasAPI) + http.HandleFunc(fmt.Sprintf("DELETE %s/api/v1/aliases/{alias}", *baseURL), addyAliasAPIDelete) http.HandleFunc(fmt.Sprintf("%s/auth", *baseURL), httpBasicAuth) http.HandleFunc(fmt.Sprintf("%s/login", *baseURL), tryLogin) http.HandleFunc(fmt.Sprintf("%s/change", *baseURL), changePassword) From a9eae794147f4a0a5ad29832db8a71ebde2561e1 Mon Sep 17 00:00:00 2001 From: Pierre-Olivier Mercier Date: Fri, 31 May 2024 17:19:12 +0200 Subject: [PATCH 2/8] Hide krbPrincipalKey --- login.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/login.go b/login.go index a00ca0c..8329600 100644 --- a/login.go +++ b/login.go @@ -55,7 +55,7 @@ func tryLogin(w http.ResponseWriter, r *http.Request) { cnt := "