imap: Allow SET/GETMETADATA to access validated attributes with imap_metadata=no

Some IMAP extensions use these commands to set/get their internal state.
This should be allowed even if full METADATA isn't enabled.

The initial plan was to restrict this in the lib-imap-storage layer, so it
would apply to everything using the imap-metadata API. This would have
affected for example accessing metadata in Sieve scripts, which could be
either good or bad. It might not be wanted to give users read access to
some metadata either, but admins really should be given the ability to
write Sieve scripts that access the metadata. However there's just no good
way to differentiate between admin-written (or tool-written) Sieve script
and user-written Sieve script.

Another issue is using metadata to configure virtual mailboxes. Currently
they're all admin-written and should be allowed to access metadata, but in
the future we might want to allow user-written virtual mailbox rules as
well.

So the end result at least for now is to just prevent IMAP GETMETADATA and
SETMETADATA specifically from accessing the non-validated attributes. Most
of the time there aren't any secrets in the metadata. In case there is,
users need to be prevented from accessing metadata via Sieve, and in such
systems users rarely have direct Sieve access anyway.

diff --git a/src/imap/cmd-getmetadata.c b/src/imap/cmd-getmetadata.c
index 9cbc3e2c789093eee2e2accde90af0d098844300..b2a6e6eca5a2e234d7e91b4ef010e8d7bb27e119 100644 (file)
--- a/src/imap/cmd-getmetadata.c
+++ b/src/imap/cmd-getmetadata.c
@@ -381,6 +381,8 @@ cmd_getmetadata_start(struct imap_getmetadata_context *ctx)
 
        if (ctx->depth > 0)
                ctx->iter_entry_prefix = str_new(cmd->pool, 128);
+       imap_metadata_transaction_validated_only(ctx->trans,
+               !cmd->client->set->imap_metadata);
 
        if (!cmd_getmetadata_continue(cmd)) {
                cmd->state = CLIENT_COMMAND_STATE_WAIT_OUTPUT;
@@ -464,11 +466,6 @@ bool cmd_getmetadata(struct client_command_context *cmd)
        if (!client_read_args(cmd, 0, 0, &args))
                return FALSE;
 
-       if (!cmd->client->imap_metadata_enabled) {
-               client_send_command_error(cmd, "METADATA disabled.");
-               return TRUE;
-       }
-
        ctx = p_new(cmd->pool, struct imap_getmetadata_context, 1);
        ctx->cmd = cmd;
        ctx->maxsize = (uint32_t)-1;

diff --git a/src/imap/cmd-setmetadata.c b/src/imap/cmd-setmetadata.c
index 8516e369d6a3b059496cba4d7463b51b03b68d8b..d5fe3e5ce1507d8e8c6eb40814bd2084f0e17a2e 100644 (file)
--- a/src/imap/cmd-setmetadata.c
+++ b/src/imap/cmd-setmetadata.c
@@ -273,6 +273,8 @@ cmd_setmetadata_start(struct imap_setmetadata_context *ctx)
        struct client_command_context *cmd = ctx->cmd;
        struct client *client = cmd->client;
 
+       imap_metadata_transaction_validated_only(ctx->trans,
+               !cmd->client->set->imap_metadata);
        /* we support large literals, so read the values from client
           asynchronously the same way as APPEND does. */
        client->input_lock = cmd;
@@ -343,11 +345,6 @@ bool cmd_setmetadata(struct client_command_context *cmd)
                return TRUE;
        }
 
-       if (!cmd->client->imap_metadata_enabled) {
-               client_send_command_error(cmd, "METADATA disabled.");
-               return TRUE;
-       }
-
        ctx = p_new(cmd->pool, struct imap_setmetadata_context, 1);
        ctx->cmd = cmd;
        ctx->cmd->context = ctx;

diff --git a/src/imap/imap-client.c b/src/imap/imap-client.c
index 1ac2e66ce7686a086f2619a6d35f7ff60fa43308..168e9cdc27a1241e69550cd976493e35754d6cb1 100644 (file)
--- a/src/imap/imap-client.c
+++ b/src/imap/imap-client.c
@@ -199,10 +199,8 @@ struct client *client_create(int fd_in, int fd_out, const char *session_id,
                client_add_capability(client, "URLAUTH");
                client_add_capability(client, "URLAUTH=BINARY");
        }
-       if (set->imap_metadata && *mail_set->mail_attribute_dict != '\0') {
-               client->imap_metadata_enabled = TRUE;
+       if (set->imap_metadata && *mail_set->mail_attribute_dict != '\0')
                client_add_capability(client, "METADATA");
-       }
        if (user_has_special_use_mailboxes(user)) {
                /* Advertise SPECIAL-USE only if there are actually some
                   SPECIAL-USE flags in mailbox configuration. */

diff --git a/src/imap/imap-client.h b/src/imap/imap-client.h
index c4e4b04309301cd8105438c792a1c92c7bbac2e9..866513cb30aaaf6d4837088bb18b3012b4fd9ba1 100644 (file)
--- a/src/imap/imap-client.h
+++ b/src/imap/imap-client.h
@@ -239,7 +239,6 @@ struct client {
        bool notify_immediate_expunges:1;
        bool notify_count_changes:1;
        bool notify_flag_changes:1;
-       bool imap_metadata_enabled:1;
        bool nonpermanent_modseqs:1;
        bool state_import_bad_idle_done:1;
        bool state_import_idle_continue:1;