Don't let mortals set an (arbitrary) IMAP pobox.

diff --git a/server/mr_server.h b/server/mr_server.h
index cb542c81180ffb1e61c2ef11d764879f4bb394b3..518bd42a2a515fb8c44c90eba2749227df7e453d 100644 (file)
--- a/server/mr_server.h
+++ b/server/mr_server.h
@@ -138,6 +138,7 @@ char *xstrdup(char *);
 /* prototypes from qaccess.pc */
 int access_user(struct query *q, char *argv[], client *cl);
 int access_login(struct query *q, char *argv[], client *cl);
+int access_spob(struct query *q, char *argv[], client *cl);
 int access_list(struct query *q, char *argv[], client *cl);
 int access_visible_list(struct query *q, char *argv[], client *cl);
 int access_vis_list_by_name(struct query *q, char *argv[], client *cl);

diff --git a/server/qaccess.pc b/server/qaccess.pc
index 49cdc9ecc115e77d17302c3b138405c2aefab6cc..848c6f0dfeebb3592e25270f7bd555d808163133 100644 (file)
--- a/server/qaccess.pc
+++ b/server/qaccess.pc
@@ -88,6 +88,16 @@ int access_login(struct query *q, char *argv[], client *cl)
 }
 
 
+/* access_spob - check access for set_pobox */
+
+int access_spob(struct query *q, char *argv[], client *cl)
+{
+  if (cl->users_id != *(int *)argv[0] || !strcmp(argv[1], "IMAP"))
+    return MR_PERM;
+  else
+    return MR_SUCCESS;
+}
+
 
 /* access_list - check access for most list operations
  *

diff --git a/server/queries2.c b/server/queries2.c
index 2f2bce2cc4006dcbe806049181a542110cdbb9c3..0012cdbc618af580a59271aff880e9d4bbe49dff 100644 (file)
--- a/server/queries2.c
+++ b/server/queries2.c
@@ -501,7 +501,7 @@ static struct validate spob_validate =      /* SET_POBOX */
   0,
   0,
   0,
-  access_user,
+  access_spob,
   0,
   set_pobox,
 };