mirror of
https://github.com/karatektus/pl_mail.git
synced 2026-10-25 01:54:10 +00:00
Paul LütznerandClaude Opus 5.5
3e0b4456cf
#34 points out that the default trusts every private range, so a machine on the LAN that reaches plMail directly can forge X-Forwarded-For and step around the per-address limits on the login form and the booking page. The default stays. The proxy's own address cannot be known here, and a proxy missing from the list breaks OAuth sign-in, shares one login allowance between everybody and strips `secure` off cookies, with nothing saying why — a worse failure, on every proxied install, than the one being closed. What was missing is the sentence: the comment in .env and the reverse-proxy page now say that the default is wide, what that costs, what it does not (the per-account login limit ignores the address and still holds), and how to narrow it once the proxy works. SECURITY.md is new. The report was filed publicly because there was nowhere private to send it. Refs #34 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
43 lines
1.9 KiB
Markdown
43 lines
1.9 KiB
Markdown
# Security
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please report it privately first: on GitHub, open the repository's **Security** tab and choose
|
|
**Report a vulnerability**. That opens a private advisory only the maintainer can read, and it is
|
|
where the fix and the disclosure are coordinated.
|
|
|
|
If you would rather not use GitHub for it, open an ordinary issue that says only that you have a
|
|
security report and how to reach you — no details — and you will be contacted.
|
|
|
|
What helps most:
|
|
|
|
- which version or commit you looked at, and whether you ran it or read the code;
|
|
- what an attacker needs (an account, a place on the network, only the ability to send mail);
|
|
- what they get, in a sentence;
|
|
- the files and lines involved, if you know them.
|
|
|
|
You will get an answer within a few days. plMail is maintained by one person in spare time, so a
|
|
fix can take longer than that; you will be told what the plan is either way. Reporters are credited
|
|
in the changelog unless they ask not to be.
|
|
|
|
## What counts
|
|
|
|
plMail is self-hosted, so the things worth reporting are the ones that cross a boundary an
|
|
installation relies on:
|
|
|
|
- one user reading or changing another user's mail, calendar or settings;
|
|
- anything a **sender of mail** can make happen on the reader's side beyond showing them a
|
|
message — running script in the app, changing the calendar, reaching the reader's session;
|
|
- anything an unauthenticated visitor can do beyond the pages meant for them (login, shared
|
|
calendar links, booking pages, the demo door);
|
|
- secrets or tokens leaving the install.
|
|
|
|
How the app is meant to hold those lines is written down in
|
|
[docs/internals/security-model.md](docs/internals/security-model.md). A report that shows one of
|
|
its claims to be false is exactly what this file is for.
|
|
|
|
## Supported versions
|
|
|
|
Fixes go into `main` and the next release. There are no maintained older branches: the answer to a
|
|
fixed vulnerability is upgrading.
|