#!/usr/bin/env perl
# conf.pl
#
-# Copyright (c) 1999-2007 The SquirrelMail Project Team
+# Copyright (c) 1999-2009 The SquirrelMail Project Team
# Licensed under the GNU GPL. For full terms see COPYING.
#
# A simple configure script to configure SquirrelMail
$lossy_encoding = 'false' if ( !$lossy_encoding );
$allow_remote_configtest = 'false' if ( !$allow_remote_configtest );
$secured_config = 'true' if ( !$secured_config );
+$sq_https_port = 443 if ( !$sq_https_port );
+$sq_ignore_http_x_forwarded_headers = 'true' if ( !$sq_ignore_http_x_forwarded_headers );
$sm_debug_mode = 'SM_DEBUG_MODE_MODERATE' if ( !$sm_debug_mode );
#FIXME: When this is STABLE software, remove the line above and uncomment the one below:
#####################################################################################
if ( $config_use_color == 1 ) {
- $WHT = "\x1B[37;1m";
+ $WHT = "\x1B[1m";
$NRM = "\x1B[0m";
} else {
$WHT = "";
print "7. Allow remote configtest : $WHT$allow_remote_configtest$NRM\n";
print "8. Debug mode : $WHT$sm_debug_mode$NRM\n";
print "9. Secured configuration mode : $WHT$secured_config$NRM\n";
+ print "10. HTTPS port : $WHT$sq_https_port$NRM\n";
+ print "11. Ignore HTTP_X_FORWARDED headers: $WHT$sq_ignore_http_x_forwarded_headers$NRM\n";
print "\n";
print "R Return to Main Menu\n";
}
$NRM = "";
} else {
$config_use_color = 1;
- $WHT = "\x1B[37;1m";
+ $WHT = "\x1B[1m";
$NRM = "\x1B[0m";
}
} elsif ( $command =~ /^w([0-9]+)/ ) {
elsif ( $command == 7 ) { $allow_remote_configtest = commandB7(); }
elsif ( $command == 8 ) { $sm_debug_mode = commandB8(); }
elsif ( $command == 9 ) { $secured_config = commandB9(); }
+ elsif ( $command == 10 ) { $sq_https_port = commandB10(); }
+ elsif ( $command == 11 ) { $sq_ignore_http_x_forwarded_headers = commandB11(); }
}
}
}
# $encode_header_key
sub command114 {
- print "Encryption key allows to hide SquirrelMail Received: headers\n";
- print "in outbound messages. Interface uses encryption key to encode\n";
- print "username, remote address and proxied address, then stores encoded\n";
- print "information in X-Squirrel-* headers.\n";
+ print "This encryption key allows the hiding of SquirrelMail Received:\n";
+ print "headers in outbound messages. SquirrelMail uses the encryption\n";
+ print "key to encode the username, remote address, and proxied address\n";
+ print "and then stores that encoded information in X-Squirrel-* headers.\n";
print "\n";
- print "Warning: used encryption function is not bulletproof. When used\n";
- print "with static encryption keys, it provides only minimal security\n";
- print "measures and information can be decoded quickly.\n";
+ print "Warning: the encryption function used to accomplish this is not\n";
+ print "bulletproof. When used with a static encryption key as it is here,\n";
+ print "it provides only minimal security and the encoded user information\n";
+ print "in the X-Squirrel-* headers can be decoded quickly by a skilled\n";
+ print "attacker.\n";
print "\n";
- print "Encoded information can be decoded with decrypt_headers.php script\n";
- print "from SquirrelMail contrib/ directory.\n";
+ print "When you need to inspect an email sent from your system with the\n";
+ print "X-Squirrel-* headers, you can decode the user information therein\n";
+ print "by using the decrypt_headers.php script found in the SquirrelMail\n";
+ print "contrib/ directory. You'll need the encryption key that you\n";
+ print "defined here when doing so.\n";
print "\n";
print "Enter encryption key: ";
$new_encode_header_key = <STDIN>;
}
sub command311 {
- print " Given that users are not allowed to modify their
+ print "$NRM";
+ print "\n Given that users are not allowed to modify their
email address, can they edit their full name?
";
}
sub command311b {
- print " SquirrelMail adds username information to every sent email
- in order to prevent possible sender forging when users are allowed
- to change their email and/or full name.
+ print "$NRM";
+ print "\n SquirrelMail adds username information to every outgoing
+ email in order to prevent possible sender forging when users are
+ allowed to change their email and/or full name.
- You can remove user information from this header (y), if you think that
+ You can remove user information from this header (y) if you think that
it violates privacy or security.
Note: If users are allowed to change their email addresses,
this setting will make it difficult to determine who sent what where.
Use at your own risk.
+ Note: If you have defined a header encryption key in your SMTP or
+ Sendmail settings (see the \"Server Settings\" option page), this
+ setting is ignored because all user information in outgoing messages
+ is encoded.
+
";
if ( lc($hide_auth_header) eq "true" ) {
return $secured_config;
}
+# Set a (non-standard) HTTPS port
+sub commandB10 {
+ print "If you run HTTPS (SSL-secured HTTP) on a non-standard port, you should\n";
+ print "indicate that port here. Even if you do not, SquirrelMail may still\n";
+ print "auto-detect secure connections, but it is safer and also very useful\n";
+ print "for third party plugins if you specify the port number here.\n";
+ print "\n";
+ print "Most SquirrelMail administrators will not need to use this setting\n";
+ print "because most all web servers use port 443 for HTTPS connections, and\n";
+ print "SquirrelMail assumes 443 unless something else is given here.\n";
+ print "\n";
+
+ print "Enter your HTTPS port [$sq_https_port]: ";
+ my $tmp = <STDIN>;
+ $tmp = trim($tmp);
+ # value is not modified, if user hits Enter or enters space
+ if ($tmp ne '') {
+ # make sure that input is numeric
+ if ($tmp =~ /^\d+$/) {
+ $sq_https_port = $tmp;
+ } else {
+ print "\n";
+ print "--- INPUT ERROR ---\n";
+ print "\n";
+ print "If you want to change this setting, you must enter a number.\n";
+ print "If you want to keep the original value, just press Enter.\n\n";
+ print "Press Enter to continue...";
+ $tmp = <STDIN>;
+ }
+ }
+ return $sq_https_port;
+}
+
+# Ignore HTTP_X_FORWARDED_* headers?
+sub commandB11 {
+
+ if ( lc($sq_ignore_http_x_forwarded_headers) eq 'true' ) {
+ $default_value = "y";
+ } else {
+ $default_value = "n";
+ }
+
+ print "Because HTTP_X_FORWARDED_* headers can be sent by the client and\n";
+ print "therefore possibly exploited by an outsider, SquirrelMail ignores\n";
+ print "them by default. If a proxy server or other machine sits between\n";
+ print "clients and your SquirrelMail server, you can turn this off to\n";
+ print "tell SquirrelMail to use such headers.\n";
+ print "\n";
+
+ print "Ignore HTTP_X_FORWARDED headers? (y/n) [$WHT$default_value$NRM]: $WHT";
+ $sq_ignore_http_x_forwarded_headers = <STDIN>;
+ if ( ( $sq_ignore_http_x_forwarded_headers =~ /^y\n/i ) || ( ( $sq_ignore_http_x_forwarded_headers =~ /^\n/ ) && ( $default_value eq "y" ) ) ) {
+ $sq_ignore_http_x_forwarded_headers = 'true';
+ } else {
+ $sq_ignore_http_x_forwarded_headers = 'false';
+ }
+ return $sq_ignore_http_x_forwarded_headers;
+}
+
sub save_data {
$tab = " ";
if ( open( CF, ">config.php" ) ) {
# boolean
print CF "\$allow_remote_configtest = $allow_remote_configtest;\n";
print CF "\$secured_config = $secured_config;\n";
+ # integer
+ print CF "\$sq_https_port = $sq_https_port;\n";
+ # boolean
+ print CF "\$sq_ignore_http_x_forwarded_headers = $sq_ignore_http_x_forwarded_headers;\n";
# (binary) integer or constant - convert integer
# values to constants before output
$sm_debug_mode = convert_debug_binary_integer_to_constants($sm_debug_mode);
# the SM directory tree, the SM_PATH variable will be
# prepended to the path, if not, then the path will be
# converted to an absolute path, e.g.
-# '../images/logo.gif' --> SM_PATH . 'images/logo.gif'
-# '../../someplace/data' --> '/absolute/path/someplace/data'
-# 'images/logo.gif' --> SM_PATH . 'config/images/logo.gif'
-# '/absolute/path/logo.gif' --> '/absolute/path/logo.gif'
-# 'http://whatever/' --> 'http://whatever'
-# $some_var/path --> "$some_var/path"
+# '../images/logo.gif' --> SM_PATH . 'images/logo.gif'
+# '../../someplace/data' --> '/absolute/path/someplace/data'
+# 'images/logo.gif' --> SM_PATH . 'config/images/logo.gif'
+# '/absolute/path/logo.gif' --> '/absolute/path/logo.gif'
+# 'C:\absolute\path\logo.gif' --> 'C:\absolute\path\logo.gif'
+# 'http://whatever/' --> 'http://whatever'
+# $some_var/path --> "$some_var/path"
sub change_to_SM_path() {
my ($old_path) = @_;
my $new_path = '';
# If the path is absolute, don't bother.
return "\'" . $old_path . "\'" if ( $old_path eq '');
return "\'" . $old_path . "\'" if ( $old_path =~ /^(\/|http)/ );
- return "\'" . $old_path . "\'" if ( $old_path =~ /^\w:\// );
+ return "\'" . $old_path . "\'" if ( $old_path =~ /^\w:(\\|\/)/ );
return $old_path if ( $old_path =~ /^\'(\/|http)/ );
return $old_path if ( $old_path =~ /^\'\w:\// );
return $old_path if ( $old_path =~ /^SM_PATH/);
projects / squirrelmail.git / blobdiff