{"action":"created","issue":{"url":"https://api.github.com/repos/mailwatch/MailWatch/issues/940","repository_url":"https://api.github.com/repos/mailwatch/MailWatch","labels_url":"https://api.github.com/repos/mailwatch/MailWatch/issues/940/labels{/name}","comments_url":"https://api.github.com/repos/mailwatch/MailWatch/issues/940/comments","events_url":"https://api.github.com/repos/mailwatch/MailWatch/issues/940/events","html_url":"https://github.com/mailwatch/MailWatch/issues/940","id":254640918,"number":940,"title":"Unsecure user management for domain admins","user":{"login":"z-jun","id":14344342,"avatar_url":"https://avatars3.githubusercontent.com/u/14344342?v=4","gravatar_id":"","url":"https://api.github.com/users/z-jun","html_url":"https://github.com/z-jun","followers_url":"https://api.github.com/users/z-jun/followers","following_url":"https://api.github.com/users/z-jun/following{/other_user}","gists_url":"https://api.github.com/users/z-jun/gists{/gist_id}","starred_url":"https://api.github.com/users/z-jun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/z-jun/subscriptions","organizations_url":"https://api.github.com/users/z-jun/orgs","repos_url":"https://api.github.com/users/z-jun/repos","events_url":"https://api.github.com/users/z-jun/events{/privacy}","received_events_url":"https://api.github.com/users/z-jun/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2017-09-01T13:28:49Z","updated_at":"2017-09-04T18:28:26Z","closed_at":null,"author_association":"NONE","body":"Any domain admin without user part (before @) in username can:\r\n\r\n- create new and modify domain admin and user acounts without user part(before @)\r\n- change properties of admin account ( ie. downgrade type from admin to domain admin)\r\n- delete admin account\r\n\r\nAny domain admin EVEN with full username(user@domain.tld) can create new user with username @domain.tld and subsequently escalate privileges to other domains.\r\n\r\n## Installation\r\n### Version and method\r\n - MailWatch Version: stable 1.2.5\r\n - Install type: Zip/tarball install\r\n - Updated from an older MailWatch or fresh install: Fresh install\r\n\r\n### Server configuration\r\n- Operation System: gentoo\r\n- Postfix Version: 3.1.6 \r\n- MailScanner Version: 5.0.3\r\n- SpamAssassin Version: 3.4.1 \r\n- PHP Version: 7.1.8\r\n- MySQL Version: 10.1.26-MariaDB\r\n\r\n### Client configuration \r\nany combination"},"comment":{"url":"https://api.github.com/repos/mailwatch/MailWatch/issues/comments/327012438","html_url":"https://github.com/mailwatch/MailWatch/issues/940#issuecomment-327012438","issue_url":"https://api.github.com/repos/mailwatch/MailWatch/issues/940","id":327012438,"user":{"login":"shawniverson","id":6255179,"avatar_url":"https://avatars3.githubusercontent.com/u/6255179?v=4","gravatar_id":"","url":"https://api.github.com/users/shawniverson","html_url":"https://github.com/shawniverson","followers_url":"https://api.github.com/users/shawniverson/followers","following_url":"https://api.github.com/users/shawniverson/following{/other_user}","gists_url":"https://api.github.com/users/shawniverson/gists{/gist_id}","starred_url":"https://api.github.com/users/shawniverson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shawniverson/subscriptions","organizations_url":"https://api.github.com/users/shawniverson/orgs","repos_url":"https://api.github.com/users/shawniverson/repos","events_url":"https://api.github.com/users/shawniverson/events{/privacy}","received_events_url":"https://api.github.com/users/shawniverson/received_events","type":"User","site_admin":false},"created_at":"2017-09-04T18:28:26Z","updated_at":"2017-09-04T18:28:26Z","author_association":"CONTRIBUTOR","body":"@Skywalker-11 I have also a patch ready.  Please reach out to me if you want to compare notes.  IRC freenode.org #efa-project.org channel."}}
{"actor":{"display_login":"shawniverson"}}