 kevin
|
551ed981de
|
fix(security): 会话密钥改为随机生成，修复硬编码密钥可伪造管理员会话
安全审计 P0 修复：旧版会话签名密钥硬编码在源码中（源码公开即泄露），
任何人可据此伪造 isAdmin 会话接管后台。
- config: 新增 [web].secret_key，首启/升级时用 crypto/rand 自动生成
32 字节随机密钥并持久化；旧硬编码值自动替换
- config: 支持 MAILGO_SECRET_KEY 环境变量覆盖（覆盖值不落盘）
- config: 配置文件权限收紧为 0600（同时保护 relay_password 等敏感字段）
- web: NewWebServer 校验密钥（空/旧默认值/短于16字节拒绝启动）
- test: 伪造会话拒绝、密钥生命周期（生成/持久化/重启稳定/env不落盘）等
9 个测试
- docs: README 配置参考、security_todo.md 安全修复清单
部署注意：升级重启后所有用户需重新登录。
|
2026-08-19 16:21:28 +08:00 |
|
|
kevin
|
6484af7e63
|
Merge pull request 'fix: 返回列表后未读邮件状态不更新（BFCache 静默同步）' (#9) from dsh/mailgo:fix/unread-status-bfcache into main
Reviewed-on: #9
|
2026-08-17 23:18:30 -04:00 |
|
|
kevin
|
e3514246b0
|
Merge pull request 'feat: 前端移动端响应式适配' (#8) from dsh/mailgo:feature/mobile-responsive into main
Reviewed-on: #8
|
2026-08-17 22:48:48 -04:00 |
|
|
kevin
|
fe1bf25d31
|
Merge pull request 'docs: README 增加界面预览截图（QQ 邮箱风格界面）' (#7) from dsh/mailgo:docs/readme-screenshots into main
Reviewed-on: #7
|
2026-08-17 04:51:15 -04:00 |
|
|
kevin
|
9e7e8e1fb5
|
Merge pull request 'feat: 前端整体重写为 QQ 邮箱风格布局' (#6) from dsh/mailgo:feature/qq-mail-frontend into main
Reviewed-on: #6
|
2026-08-17 04:42:34 -04:00 |
|
|
kevin
|
9036523d9f
|
Merge pull request 'fix: 修复编辑域名时私钥留空仍报“TLS 私钥和公钥证书必须同时填写”' (#5) from dsh/mailgo:caddy-cert-hot-reload into main
Reviewed-on: #5
|
2026-08-16 23:46:57 -04:00 |
|
|
kevin
|
f24c939eda
|
Merge pull request 'feat: 管理后台一键从 Caddy 获取证书 + TLS 证书热加载' (#4) from dsh/mailgo:caddy-cert-hot-reload into main
Reviewed-on: #4
|
2026-08-16 23:41:25 -04:00 |
|
|
kevin
|
cead42fd69
|
Merge pull request 'fix: 外发优先 IPv4 + smarthost 中继 + 地址族配置（补 PR #1 合并后遗漏的提交）' (#3) from dsh/mailgo:outbound-ipv4-relay into main
Reviewed-on: #3
|
2026-08-16 00:13:00 -04:00 |
|
|
kevin
|
c40113d3bf
|
Merge pull request 'fix: SMTP 收件邮件的附件未保存（Web 邮箱看不到附件）' (#2) from dsh/mailgo:fix/smtp-received-attachments into main
Reviewed-on: #2
|
2026-08-15 23:55:09 -04:00 |
|
|
kevin
|
79220b816d
|
Merge pull request 'feat: 实现对外邮件投递（外发队列 + MX 直投 + DKIM 签名 + 退信 + 管理后台）' (#1) from dsh/mailgo:outbound-delivery into main
Reviewed-on: #1
|
2026-08-15 23:38:46 -04:00 |
|
|
kevin
|
0545a71ba2
|
删除垃圾
Signed-off-by: 吴文峰 <kevin@lmve.net>
|
2026-06-02 20:49:03 +08:00 |
|
|
kevin
|
c7f466c99b
|
修复网页端编码问题
|
2026-06-02 20:46:59 +08:00 |
|
|
kevin
|
59719586a1
|
修复部分功能
|
2026-06-02 20:33:08 +08:00 |
|
|
kevin
|
b35d468396
|
自签证书
|
2026-06-02 19:10:25 +08:00 |
|
|
kevin
|
bd56c4dc5f
|
完善tls配置
|
2026-06-02 18:47:28 +08:00 |
|
|
kevin
|
3dcc3f9a35
|
up
|
2026-06-01 20:43:01 +08:00 |
|
|
kevin
|
0e9b62f5cf
|
修复socket问题
|
2026-06-01 20:18:38 +08:00 |
|
|
kevin
|
7c1ce77563
|
up
|
2026-06-01 20:06:02 +08:00 |
|
|
kevin
|
b8810d09b6
|
up
|
2026-06-01 19:54:53 +08:00 |
|
|
kevin
|
c3be042acb
|
up
|
2026-06-01 19:51:19 +08:00 |
|
|
kevin
|
4e233c82b4
|
二阶段差不多
|
2026-06-01 19:46:51 +08:00 |
|
|
kevin
|
9e50d05e71
|
一阶段ok
|
2026-06-01 18:59:55 +08:00 |
|