starred/modoboa-modoboa

Fork 0

mirror of https://github.com/modoboa/modoboa.git synced 2026-04-26 17:36:01 +03:00

[GH-ISSUE #2120] Disabled account can still receive email #1527

New issue

Closed

opened 2026-02-27 11:17:35 +03:00 by kerem · 6 comments

kerem commented

2026-02-27 11:17:35 +03:00

Owner

Originally created by @jeromelebleu on GitHub (Jan 11, 2021).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/2120

Impacted versions

OS Type: Debian
OS Version: Buster
Database Type: PostgreSQL
Database version: 11
Modoboa: 1.17.0

Steps to reproduce

Create an account with Simple user role and disable it - either at the creation or after
Send an email to this account

Current behavior

Even if the account is disabled, the recipient is still allowed by Postfix and the email is delivered.

Expected behavior

If I understand the meaning of a disabled account, emails to this address should be rejected.

Debugging

While trying to find in Postfix when this recipient is accepted, I found that it was by looking up in sql-aliases.cf table. Even if there is a condition on enabled in the admin_alias table, the object is still returned. And indeed, even if the core_user is disabled, the corresponding admin_alias is not.

Originally created by @jeromelebleu on GitHub (Jan 11, 2021). Original GitHub issue: https://github.com/modoboa/modoboa/issues/2120 # Impacted versions * OS Type: Debian * OS Version: Buster * Database Type: PostgreSQL * Database version: 11 * Modoboa: 1.17.0 # Steps to reproduce 1. Create an account with _Simple user_ role and disable it - either at the creation or after 2. Send an email to this account # Current behavior Even if the account is disabled, the recipient is still allowed by Postfix and the email is delivered. # Expected behavior If I understand the meaning of a disabled account, emails to this address should be rejected. # Debugging While trying to find in Postfix when this recipient is accepted, I found that it was by looking up in `sql-aliases.cf` table. Even if there is a condition on `enabled` in the `admin_alias` table, the object is still returned. And indeed, even if the `core_user` is disabled, the corresponding `admin_alias` is not.

kerem

2026-02-27 11:17:35 +03:00

closed this issue
added the
bug

feedback-needed
labels

kerem commented

2026-02-27 11:17:36 +03:00

Author

Owner

@cyberal77 commented on GitHub (Jan 14, 2021):

Hi,

I Cant reproduce.

When i send mail to desactivated user, it's reject.

Regard

PS : Manual installed server

@cyberal77 commented on GitHub (Jan 14, 2021): Hi, I Cant reproduce. When i send mail to desactivated user, it's reject. Regard PS : Manual installed server

kerem commented

2026-02-27 11:17:36 +03:00

Author

Owner

@jeromelebleu commented on GitHub (Jan 14, 2021):

Thanks @cyberal77 to give it a try! Are you also using the last Modoba's version? I encounter that on manual installations too, but my Postfix configuration is almost the same as the automatic installer's one. Anyway, from what I understood, I don't think this is related.

Could you also check that the corresponding admin_alias's object is also disabled please? For example, here is what I have in a shell:

>>> from modoboa.core.models import User
>>> from modoboa.admin.models import Alias

>>> u = User.objects.get(email='user2@example.org')
>>> u.enabled
False
>>> a = Alias.objects.get(address=u.email)
>>> a.enabled
True
>>> a.internal
True

@jeromelebleu commented on GitHub (Jan 14, 2021): Thanks @cyberal77 to give it a try! Are you also using the last Modoba's version? I encounter that on manual installations too, but my Postfix configuration is almost the same as the automatic installer's one. Anyway, from what I understood, I don't think this is related. Could you also check that the corresponding `admin_alias`'s object is also disabled please? For example, here is what I have in a shell: ```python >>> from modoboa.core.models import User >>> from modoboa.admin.models import Alias >>> u = User.objects.get(email='user2@example.org') >>> u.enabled False >>> a = Alias.objects.get(address=u.email) >>> a.enabled True >>> a.internal True ```

kerem commented

2026-02-27 11:17:36 +03:00

Author

Owner

@kryskool commented on GitHub (Jan 18, 2021):

Hi @jeromelebleu

It seem that @tonioo fix the problem in this commit can you retry ?

Regards,

@kryskool commented on GitHub (Jan 18, 2021): Hi @jeromelebleu It seem that @tonioo fix the problem in this [commit](https://github.com/modoboa/modoboa/commit/1aed875f6865046a0d538a1a0772e50962987789) can you retry ? Regards,

kerem commented

2026-02-27 11:17:36 +03:00

Author

Owner

@jeromelebleu commented on GitHub (Jan 18, 2021):

Hi @kryskool, no it does not fix this problem and this is why I commented this commit. It only disables aliases which have been added manually from the interface (internal=False) and not automatically like here (internal=True).

@jeromelebleu commented on GitHub (Jan 18, 2021): Hi @kryskool, no it does not fix this problem and this is why I commented this commit. It only disables aliases which have been added *manually* from the interface (`internal=False`) and not automatically like here (`internal=True`).

kerem commented

2026-02-27 11:17:36 +03:00

Author

Owner

@Toniob commented on GitHub (Jun 28, 2022):

Hi,

I’m running 1.17.0 and I added the patch manually. But the mail are still received. I think that’s because that’s dovecot-lmtp which is responsible for accepting or not the mail. And in the user_query in dovecot, we never check for the is_active attribute.

@Toniob commented on GitHub (Jun 28, 2022): Hi, I’m running 1.17.0 and I added the patch manually. But the mail are still received. I think that’s because that’s dovecot-lmtp which is responsible for accepting or not the mail. And in the user_query in dovecot, we never check for the is_active attribute.

kerem commented

2026-02-27 11:17:36 +03:00

Author

Owner

@DaveDischord commented on GitHub (Jul 12, 2023):

Hi,

I’m running 1.17.0 and I added the patch manually. But the mail are still received. I think that’s because that’s dovecot-lmtp which is responsible for accepting or not the mail. And in the user_query in dovecot, we never check for the is_active attribute.

How can I manually fix this? What files would I need to edit and how? Thank you.

@DaveDischord commented on GitHub (Jul 12, 2023): > Hi, > > I’m running 1.17.0 and I added the patch manually. But the mail are still received. I think that’s because that’s dovecot-lmtp which is responsible for accepting or not the mail. And in the user_query in dovecot, we never check for the is_active attribute. How can I manually fix this? What files would I need to edit and how? Thank you.

kerem referenced this issue

2026-02-27 12:10:06 +03:00

[PR #1527] [MERGED] Fix attempt for #1510. #2253