You are viewing a plain text version of this content. The canonical link for it is here.
Posted to server-dev@james.apache.org by bt...@apache.org on 2017/10/16 02:43:11 UTC
[13/13] james-project git commit: JAMES-2181 Avoid mailbox Id
disclosure over JMAP
JAMES-2181 Avoid mailbox Id disclosure over JMAP
Before a user can now the use of a specific mailboxId (does it belong to an other user? Or is this mailboxId not used?) by looking at the SetMessages update error message.
Project: http://git-wip-us.apache.org/repos/asf/james-project/repo
Commit: http://git-wip-us.apache.org/repos/asf/james-project/commit/825d7392
Tree: http://git-wip-us.apache.org/repos/asf/james-project/tree/825d7392
Diff: http://git-wip-us.apache.org/repos/asf/james-project/diff/825d7392
Branch: refs/heads/master
Commit: 825d73922faaed9f6431731b4bfe0593f29ef07a
Parents: 81c8907
Author: benwa <bt...@linagora.com>
Authored: Wed Oct 11 10:34:55 2017 +0700
Committer: benwa <bt...@linagora.com>
Committed: Mon Oct 16 09:42:16 2017 +0700
----------------------------------------------------------------------
.../james/mailbox/inmemory/InMemoryMessageIdManager.java | 6 +++++-
.../org/apache/james/mailbox/store/StoreMessageIdManager.java | 4 +++-
2 files changed, 8 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/james-project/blob/825d7392/mailbox/memory/src/main/java/org/apache/james/mailbox/inmemory/InMemoryMessageIdManager.java
----------------------------------------------------------------------
diff --git a/mailbox/memory/src/main/java/org/apache/james/mailbox/inmemory/InMemoryMessageIdManager.java b/mailbox/memory/src/main/java/org/apache/james/mailbox/inmemory/InMemoryMessageIdManager.java
index 698b107..68f4b57 100644
--- a/mailbox/memory/src/main/java/org/apache/james/mailbox/inmemory/InMemoryMessageIdManager.java
+++ b/mailbox/memory/src/main/java/org/apache/james/mailbox/inmemory/InMemoryMessageIdManager.java
@@ -47,6 +47,8 @@ import org.apache.james.mailbox.model.MessageResult;
import org.apache.james.mailbox.model.MessageResult.FetchGroup;
import org.apache.james.mailbox.model.search.MailboxQuery;
import org.apache.james.util.OptionalUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
import com.github.fge.lambdas.Throwing;
import com.github.steveash.guavate.Guavate;
@@ -58,6 +60,7 @@ import com.google.common.collect.Sets.SetView;
public class InMemoryMessageIdManager implements MessageIdManager {
+ private static final Logger LOGGER = LoggerFactory.getLogger(InMemoryMessageIdManager.class);
private final MailboxManager mailboxManager;
@Inject
@@ -161,7 +164,8 @@ public class InMemoryMessageIdManager implements MessageIdManager {
.findAny();
if (mailboxForbidden.isPresent()) {
- throw new MailboxNotFoundException("Mailbox " + mailboxForbidden.get() + " does not belong to session");
+ LOGGER.info("Mailbox with Id " + mailboxForbidden.get() + " does not belong to " + mailboxSession.getUser().getUserName());
+ throw new MailboxNotFoundException(mailboxForbidden.get());
}
}
http://git-wip-us.apache.org/repos/asf/james-project/blob/825d7392/mailbox/store/src/main/java/org/apache/james/mailbox/store/StoreMessageIdManager.java
----------------------------------------------------------------------
diff --git a/mailbox/store/src/main/java/org/apache/james/mailbox/store/StoreMessageIdManager.java b/mailbox/store/src/main/java/org/apache/james/mailbox/store/StoreMessageIdManager.java
index f167a9e..b57fd1b 100644
--- a/mailbox/store/src/main/java/org/apache/james/mailbox/store/StoreMessageIdManager.java
+++ b/mailbox/store/src/main/java/org/apache/james/mailbox/store/StoreMessageIdManager.java
@@ -29,6 +29,7 @@ import java.util.Optional;
import java.util.Set;
import java.util.function.Function;
import java.util.function.Predicate;
+
import javax.inject.Inject;
import javax.mail.Flags;
import javax.mail.internet.SharedInputStream;
@@ -295,7 +296,8 @@ public class StoreMessageIdManager implements MessageIdManager {
.findFirst();
if (mailboxForbidden.isPresent()) {
- throw new MailboxNotFoundException("Mailbox with Id " + mailboxForbidden.get() + " does not belong to session");
+ LOGGER.info("Mailbox with Id " + mailboxForbidden.get() + " does not belong to " + mailboxSession.getUser().getUserName());
+ throw new MailboxNotFoundException(mailboxForbidden.get());
}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org