Commit Diff


commit - e0b946dd8b114ac17fb1ceb84acc1dd8236cadf7
commit + e6bb18d3eb328deb39b87f1972da4f2a65a25b56
blob - d3f7356c5473993e6c2ee78eb59056b5ee3b4263
blob + f596135405f2ecd8c1dff449a0fff46c68d4a884
--- add-alias.php
+++ add-alias.php
@@ -5,108 +5,74 @@
 // Copyright (c) 2022 High5!
 // License Info: LICENSE.TXT
 //
-// File: create-alias.php
+// File: add-alias.php
 //
-// Template File: create-alias.tpl
+// Template File: add-alias.tpl
 //
 // Template Variables:
 //
-// tMessage
-// tAddress
-// tGoto
-// tDomain
+// message
+// address
+// domain
+// goto
 //
 // Form POST \ GET Variables:
 //
-// fAddress
-// fGoto
-// fDomain
+// address
+// domain
+// goto
 //
-require("./functions.inc.php");
-include("./languages/" . check_language() . ".lang");
+require_once './functions.inc.php';
+include './languages/' . check_language() . '.lang';
 
 $SESSID_USERNAME = check_session();
 $list_domains = list_domains($SESSID_USERNAME);
+$admin = $SESSID_USERNAME ?? ADMIN_EMAIL;
 
 if ($_SERVER['REQUEST_METHOD'] == "GET") {
-	$pCreate_alias_goto_text = $LANG['Create_alias_goto_text'];
-
-	if (isset($_GET['domain'])) $tDomain = escape_string($_GET['domain']);
+	$domain = filter_input(INPUT_GET, 'domain', FILTER_VALIDATE_DOMAIN);
+	$domain_key = array_search($domain, array_column($list_domains, 'domain'));
 }
 
 if ($_SERVER['REQUEST_METHOD'] == "POST") {
-	$pCreate_alias_goto_text = $LANG['Create_alias_goto_text'];
+	$address = strtolower(filter_input(INPUT_POST, 'address', FILTER_DEFAULT));
+	$domain = filter_input(INPUT_POST, 'domain', FILTER_VALIDATE_DOMAIN);
+	$goto = strtolower(filter_input(INPUT_POST, 'goto', FILTER_DEFAULT));
+	$domain_key = array_search($domain, array_column($list_domains, 'domain'));
+	$from = filter_var($address . '@' . $domain, FILTER_VALIDATE_EMAIL);
 
-	$fAddress = escape_string($_POST['fAddress']) . "@" . escape_string($_POST['fDomain']);
-	$fAddress = strtolower($fAddress);
-	$fGoto = escape_string($_POST['fGoto']);
-	$fGoto = strtolower($fGoto);
-	$fDomain = escape_string($_POST['fDomain']);
-
-	if (!preg_match('/@/',$fGoto)) {
-		$fGoto = $fGoto . "@" . escape_string($_POST['fDomain']);
+	if (!str_contains($goto, '@')) {
+		$goto = $goto . "@" . $domain;
 	}
+	$goto = filter_var($goto, FILTER_VALIDATE_EMAIL);
 
-	if (!check_owner($SESSID_USERNAME, $fDomain)) {
-		$error = 1;
-		$tAddress = escape_string($_POST['fAddress']);
-		$tGoto = $fGoto;
-		$tDomain = $fDomain;		
-		$pCreate_alias_address_text = $LANG['Create_alias_address_text_error1'];
+	if ($list_domains[$domain_key]['aliases'] != 0 && $list_domains[$domain_key]['alias_count'] >= $list_domains[$domain_key]['aliases']) {
+		$message = $LANG['Create_alias_address_text_error2'];
 	}
 
-	if (!check_alias($fDomain)) {
-		$error = 1;
-		$tAddress = escape_string($_POST['fAddress']);
-		$tGoto = $fGoto;
-		$tDomain = $fDomain;
-		$pCreate_alias_address_text = $LANG['Create_alias_address_text_error3'];
+	if (empty($address) || empty($goto)) {
+		$message = $LANG['Create_alias_address_text_error1'];
 	}
-	
-	if (empty($fAddress) or !check_email($fAddress)) {
-		$error = 1;
-		$tAddress = escape_string($_POST['fAddress']);
-		$tGoto = $fGoto;
-		$tDomain = $fDomain;
-		$pCreate_alias_address_text = $LANG['Create_alias_address_text_error1'];
-	}
 
-	if (empty($fGoto) or !check_email($fGoto)) {
-		$error = 1;
-		$tAddress = escape_string($_POST['fAddress']);
-		$tGoto = $fGoto;
-		$tDomain = $fDomain;
-		$pCreate_alias_goto_text = $LANG['Create_alias_goto_text_error'];
-	}
-
-	if (escape_string($_POST['fAddress']) == "*") $fAddress = "@" . escape_string($_POST['fDomain']);
-
-	$result = db_query("SELECT * FROM alias WHERE address='$fAddress'");
-	if ($result['rows'] == 1) {
-		$error = 1;
-		$tAddress = escape_string($_POST['fAddress']);
-		$tGoto = $fGoto;
-		$tDomain = $fDomain;
-		$pCreate_alias_address_text = $LANG['Create_alias_address_text_error2'];
-	}
-
-	if ($error != 1) {
-		if (preg_match('/^\*@(.*)$/', $fGoto, $match)) $fGoto = "@" . $match[1];
-
-		$result = db_query("INSERT INTO alias (address,goto,domain,created,modified) VALUES ('$fAddress','$fGoto','$fDomain',NOW(),NOW())");
-		if ($result['rows'] != 1) {
-			$tDomain = $fDomain;
-			$tMessage = $LANG['Create_alias_result_error'] . "<br />($fAddress -> $fGoto)<br />\n";
-		} else {
-			db_log($SESSID_USERNAME, $fDomain, "create alias", "$fAddress -> $fGoto");
-
-			$tDomain = $fDomain;
-			$tMessage = $LANG['Create_alias_result_succes'] . "<br />($fAddress -> $fGoto)<br />\n";
+	if (empty($message) && isset($domain_key)) {
+		try {
+			$dbh = connect_db();
+			$sth = $dbh->prepare("INSERT INTO alias (address,goto,domain,created,modified) VALUES (?,?,?,NOW(),NOW())");
+			$sth->bindParam(1, $from, PDO::PARAM_STR);
+			$sth->bindParam(2, $goto, PDO::PARAM_STR);
+			$sth->bindParam(3, $domain, PDO::PARAM_STR);
+			$sth->execute();
+			logging($admin, $domain, "create alias", "$from -> $goto");
+			$message = $LANG['Create_alias_result_succes'] . "<br />($from -> $goto)</br />";
+			$address = '';
+			$goto = '';
+ 		} catch(PDOException $e) { 
+			$message = $LANG['Create_alias_result_error'] . "<br />($from -> $goto)<br />";
 		}
 	}
 }
-include("./templates/header.tpl");
-include("./templates/menu.tpl");
-include("./templates/add-alias.tpl");
-include("./templates/footer.tpl");
+include './templates/header.tpl';
+include './templates/menu.tpl';
+include './templates/add-alias.tpl';
+include './templates/footer.tpl';
 ?>
blob - 23698790470ccda7a42802a038efdb6a87b52708
blob + 0cedbe468ba4d9f8f3bfec125a792d8a1db25820
--- add-mailbox.php
+++ add-mailbox.php
@@ -5,187 +5,95 @@
 // Copyright (c) 2022 High5!
 // License Info: LICENSE.TXT
 //
-// File: create-mailbox.php
+// File: add-mailbox.php
 //
-// Template File: create-mailbox.tpl
+// Template File: add-mailbox.tpl
 //
 // Template Variables:
 //
-// tMessage
-// tUsername
-// tName
-// tQuota
-// tDomain
+// message
+// username
+// name
+// domain
 //
 // Form POST \ GET Variables:
 //
-// fUsername
-// fPassword
-// fPassword2
-// fName
-// fQuota
-// fDomain
-// fActive
-// fMail
+// username
+// password1
+// password2
+// name
+// domain
 //
-require("./functions.inc.php");
-include("./languages/" . check_language() . ".lang");
+require_once './functions.inc.php';
+include './languages/' . check_language() . '.lang';
 
 $SESSID_USERNAME = check_session();
 $list_domains = list_domains($SESSID_USERNAME);
+$admin = $SESSID_USERNAME ?? ADMIN_EMAIL;
 
 if ($_SERVER['REQUEST_METHOD'] == "GET") {
-	$tQuota = $CONF['maxquota'];
-
-	$pCreate_mailbox_password_text = $LANG['Create_mailbox_password_text'];
-	$pCreate_mailbox_name_text = $LANG['Create_mailbox_name_text'];
-	$pCreate_mailbox_quota_text = $LANG['Create_mailbox_quota_text'];
-
-	if (isset($_GET['domain'])) $tDomain = escape_string($_GET['domain']);
+        $domain = filter_input(INPUT_GET, 'domain', FILTER_VALIDATE_DOMAIN);
+        $domain_key = array_search($domain, array_column($list_domains, 'domain'));
 }
 
 if ($_SERVER['REQUEST_METHOD'] == "POST") {
-	$pCreate_mailbox_password_text = $LANG['Create_mailbox_password_text'];
-	$pCreate_mailbox_name_text = $LANG['Create_mailbox_name_text'];
-	$pCreate_mailbox_quota_text = $LANG['Create_mailbox_quota_text'];
-  
-	$fUsername = escape_string($_POST['fUsername']) . "@" . escape_string($_POST['fDomain']);
-	$fUsername = strtolower($fUsername);
-	$fPassword = escape_string($_POST['fPassword']);
-	$fPassword2 = escape_string($_POST['fPassword2']);
-	$fName = escape_string($_POST['fName']);
-	$fDomain = escape_string($_POST['fDomain']);
-	if (isset($_POST['fQuota'])) $fQuota = escape_string($_POST['fQuota']);
-	if (isset($_POST['fActive'])) $fActive = escape_string($_POST['fActive']);
-	if (isset($_POST['fMail'])) $fMail = escape_string($_POST['fMail']);
+        $username = strtolower(filter_input(INPUT_POST, 'username', FILTER_DEFAULT));
+        $domain = filter_input(INPUT_POST, 'domain', FILTER_VALIDATE_DOMAIN);
+	$password1 = filter_input(INPUT_POST, 'password1', FILTER_DEFAULT);
+	$password2 = filter_input(INPUT_POST, 'password2', FILTER_DEFAULT);
+	$name = filter_input(INPUT_POST, 'name', FILTER_DEFAULT);
 
-	if (!check_owner($SESSID_USERNAME, $fDomain)) {
-		$error = 1;
-		$tUsername = escape_string($_POST['fUsername']);
-		$tName = $fName;
-		$tQuota = $fQuota;
-		$tDomain = $fDomain;
-		$pCreate_mailbox_username_text = $LANG['Create_mailbox_username_text_error1'];
-	}
+        $domain_key = array_search($domain, array_column($list_domains, 'domain'));
 
-	if (!check_mailbox($fDomain)) {
-		$error = 1;
-		$tUsername = escape_string($_POST['fUsername']);
-		$tName = $fName;
-		$tQuota = $fQuota;
-		$tDomain = $fDomain;
-		$pCreate_mailbox_username_text = $LANG['Create_mailbox_username_text_error3'];
+        $from = filter_var($username . '@' . $domain, FILTER_VALIDATE_EMAIL);
+
+        if ($list_domains[$domain_key]['mailboxes'] != 0 && $list_domains[$domain_key]['mailbox_count'] >= $list_domains[$domain_key]['mailboxes']) {
+		$message = $LANG['Create_mailbox_username_text_error3'];
 	}
 	 
-	if (empty($fUsername) or !check_email($fUsername)) {
-		$error = 1;
-		$tUsername = escape_string($_POST['fUsername']);
-		$tName = $fName;
-		$tQuota = $fQuota;
-		$tDomain = $fDomain;
-		$pCreate_mailbox_username_text = $LANG['Create_mailbox_username_text_error1'];
+	if (empty($username)) {
+		$message = $LANG['Create_mailbox_username_text_error1'];
 	}
 
-	if (empty($fPassword) or ($fPassword != $fPassword2)) {
-		if ($CONF['generate_password'] == "YES") {
-			$fPassword = generate_password();
-		} else {
-			$error = 1;
-			$tUsername = escape_string($_POST['fUsername']);
-			$tName = $fName;
-			$tQuota = $fQuota;
-			$tDomain = $fDomain;
-			$pCreate_mailbox_password_text = $LANG['Create_mailbox_password_text_error'];
-		}
+	if (empty($password1) or ($password1 != $password2)) {
+		$message = $LANG['Create_mailbox_password_text_error'];
 	}
 
-	if ($CONF['quota'] == "YES") {
-		if (!check_quota($fQuota, $fDomain)) {
-			$error = 1;
-			$tUsername = escape_string($_POST['fUsername']);
-			$tName = $fName;
-			$tQuota = $fQuota;
-			$tDomain = $fDomain;
-			$pCreate_mailbox_quota_text = $LANG['Create_mailbox_quota_text_error'];
-		}
-	}
-	
-	$result = db_query("SELECT * FROM alias WHERE address='$fUsername'");
-	if ($result['rows'] == 1) {
-		$error = 1;
-		$tUsername = escape_string($_POST['fUsername']);
-		$tName = $fName;
-		$tQuota = $fQuota;
-		$tDomain = $fDomain;
-		$pCreate_mailbox_username_text = $LANG['Create_mailbox_username_text_error2'];
-	}
+	if (empty($message) && isset($domain_key)) {
+		$hashed = bcrypt($password1);
+		$maildir = $from . "/";
 
-	if ($error != 1) {
-		$password = pacrypt($fPassword);
-		
-		if ($CONF['domain_path'] == "YES") {
-			if ($CONF['domain_in_mailbox'] == "YES") {
-				$maildir = $fDomain . "/" . $fUsername . "/";
-			} else {
-				$maildir = $fDomain . "/" . escape_string($_POST['fUsername']) . "/";
-			}
-		} else {
-			$maildir = $fUsername . "/";
+		try {
+			$dbh = connect_db();
+			$sth = $dbh->prepare("INSERT INTO alias (address,goto,domain,created,modified) VALUES (?,'vmail',?,NOW(),NOW())");
+			$sth->bindParam(1, $from, PDO::PARAM_STR);
+			$sth->bindParam(2, $domain, PDO::PARAM_STR);
+			$sth->execute();
+			$username = '';
+ 		} catch(PDOException $e) { 
+			$message = $LANG['Create_alias_result_error'] . "<br />($from) - $e<br />";
 		}
-		
-		if (!empty($fQuota)) {
-			$quota = $fQuota * $CONF['quota_multiplier'];
-		} else {
-			$quota = 0;
-		}
-	
-		if ($fActive == "on") {
-			$fActive = 1;
-		} else {
-			$fActive = 0;
-		}
 
-		$result = db_query("INSERT INTO alias (address,goto,domain,created,modified,active) VALUES ('$fUsername','vmail','$fDomain',NOW(),NOW(),'$fActive')");
-		if ($result['rows'] != 1) {
-			$tDomain = $fDomain;
-			$tMessage = $LANG['Alias_result_error'] . "<br />($fUsername -> $fUsername)</br />";
+		try {
+			$dbh = connect_db();
+			$sth = $dbh->prepare("INSERT INTO mailbox (username,password,name,maildir,domain,created,modified) VALUES (?,?,?,?,?,NOW(),NOW())");
+			$sth->bindParam(1, $from, PDO::PARAM_STR);
+			$sth->bindParam(2, $hashed, PDO::PARAM_STR);
+			$sth->bindParam(3, $name, PDO::PARAM_STR);
+			$sth->bindParam(4, $maildir, PDO::PARAM_STR);
+			$sth->bindParam(5, $domain, PDO::PARAM_STR);
+			$sth->execute();
+			logging($admin, $domain, "create mailbox", "$from");
+			$message = $LANG['Create_mailbox_result_succes'] . "<br />($from)";
+			$username = '';
+			$name = '';
+ 		} catch(PDOException $e) { 
+			$message = $LANG['Create_alias_result_error'] . "<br />($from) - $e<br />";
 		}
-
-		$result = db_query("INSERT INTO mailbox (username,password,name,maildir,quota,domain,created,modified,active) VALUES ('$fUsername','$password','$fName','$maildir','$quota','$fDomain',NOW(),NOW(),'$fActive')");
-		if ($result['rows'] != 1) {
-			$tDomain = $fDomain;
-			$tMessage .= $LANG['Create_mailbox_result_error'] . "<br />($fUsername)<br />";
-		} else {
-			db_log($SESSID_USERNAME, $fDomain, "create mailbox", "$fUsername");
-
-			$tDomain = $fDomain;
-			$tMessage = $LANG['Create_mailbox_result_succes'] . "<br />($fUsername";
-			if ($CONF['generate_password'] == "YES") {
-				$tMessage .= " / $fPassword)</br />";
-			} else {
-				$tMessage .= ")</br />";
-			}
-	
-			$tQuota = $CONF['maxquota'];
-
-			if ($fMail == "on") {
-				$fTo = $fUsername;
-				$fSubject = $LANG['Sendmail_subject_text'];
-				$fHeaders = "From: " . $SESSID_USERNAME . "\r\n";
-				$fHeaders .= "Content-Type: text/plain; charset=utf-8\r\n";
-				$fBody = $CONF['welcome_text'];
-
-				if (!mail($fTo, $fSubject, $fBody, $fHeaders)) {
-					$tMessage .= "<br />" . $LANG['Sendmail_result_error'] . "<br />";
-				} else {
-					$tMessage .= "<br />" . $LANG['Sendmail_result_succes'] . "<br />";
-				}
-			}
-		}
 	}
 }
-include("./templates/header.tpl");
-include("./templates/menu.tpl");
-include("./templates/add-mailbox.tpl");
-include("./templates/footer.tpl");
+include './templates/header.tpl';
+include './templates/menu.tpl';
+include './templates/add-mailbox.tpl';
+include './templates/footer.tpl';
 ?>
blob - ac2bcfffbb87b0fb863a84f7c4c6cbb4ccda9d09
blob + 294e56589b62367aca06c0e9f05480cbd474ba5c
--- admin/add-alias.php
+++ admin/add-alias.php
@@ -26,6 +26,7 @@ require_once '../functions.inc.php';
 include '../languages/' . check_language() . '.lang';
 
 $list_domains = list_domains();
+$admin = $SESSID_USERNAME ?? ADMIN_EMAIL;
 
 if ($_SERVER['REQUEST_METHOD'] == "GET") {
 	$domain = filter_input(INPUT_GET, 'domain', FILTER_VALIDATE_DOMAIN);
@@ -36,17 +37,15 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
 	$address = strtolower(filter_input(INPUT_POST, 'address', FILTER_DEFAULT));
 	$domain = filter_input(INPUT_POST, 'domain', FILTER_VALIDATE_DOMAIN);
 	$goto = strtolower(filter_input(INPUT_POST, 'goto', FILTER_DEFAULT));
-
 	$domain_key = array_search($domain, array_column($list_domains, 'domain'));
-	print "$domain_key";
-
 	$from = filter_var($address . '@' . $domain, FILTER_VALIDATE_EMAIL);
+
 	if (!str_contains($goto, '@')) {
 		$goto = $goto . "@" . $domain;
 	}
 	$goto = filter_var($goto, FILTER_VALIDATE_EMAIL);
 
-	if ($list_domains[$domain_key]['alias_count'] < 0 || $list_domains[$domain_key]['alias_count'] >= $list_domains[$domain_key]['aliases']) {
+	if ($list_domains[$domain_key]['aliases'] != 0 && $list_domains[$domain_key]['alias_count'] >= $list_domains[$domain_key]['aliases']) {
 		$message = $LANG['Create_alias_address_text_error2'];
 	}
 
@@ -54,7 +53,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
 		$message = $LANG['Create_alias_address_text_error1'];
 	}
 
-	if (empty($message)) {
+	if (empty($message) && isset($domain_key)) {
 		try {
 			$dbh = connect_db();
 			$sth = $dbh->prepare("INSERT INTO alias (address,goto,domain,created,modified) VALUES (?,?,?,NOW(),NOW())");
@@ -62,12 +61,12 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
 			$sth->bindParam(2, $goto, PDO::PARAM_STR);
 			$sth->bindParam(3, $domain, PDO::PARAM_STR);
 			$sth->execute();
-			logging(ADMIN_EMAIL, $domain, "create alias", "$from -> $goto");
+			logging($admin, $domain, "create alias", "$from -> $goto");
 			$message = $LANG['Create_alias_result_succes'] . "<br />($from -> $goto)</br />";
 			$address = '';
 			$goto = '';
  		} catch(PDOException $e) { 
-			$message = $LANG['Create_alias_result_error'] . "<br />($from -> $goto) - $e<br />";
+			$message = $LANG['Create_alias_result_error'] . "<br />($from -> $goto)<br />";
 		}
 	}
 }
blob - d6f2fe79c4154dc312e8d23ede8a84d6292f3838
blob + 95bf5159986ec9155e2e01491c9a833a64ec24ca
--- admin/add-mailbox.php
+++ admin/add-mailbox.php
@@ -28,6 +28,7 @@ require_once '../functions.inc.php';
 include '../languages/' . check_language() . '.lang';
 
 $list_domains = list_domains();
+$admin = $SESSID_USERNAME ?? ADMIN_EMAIL;
 
 if ($_SERVER['REQUEST_METHOD'] == "GET") {
         $domain = filter_input(INPUT_GET, 'domain', FILTER_VALIDATE_DOMAIN);
@@ -45,7 +46,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
 
         $from = filter_var($username . '@' . $domain, FILTER_VALIDATE_EMAIL);
 
-        if ($list_domains[$domain_key]['mailbox_count'] < 0 || $list_domains[$domain_key]['mailbox_count'] >= $list_domains[$domain_key]['mailboxes']) {
+        if ($list_domains[$domain_key]['mailboxes'] != 0 && $list_domains[$domain_key]['mailbox_count'] >= $list_domains[$domain_key]['mailboxes']) {
 		$message = $LANG['Create_mailbox_username_text_error3'];
 	}
 	 
@@ -57,7 +58,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
 		$message = $LANG['Create_mailbox_password_text_error'];
 	}
 
-	if (empty($message)) {
+	if (empty($message) && isset($domain_key)) {
 		$hashed = bcrypt($password1);
 		$maildir = $from . "/";
 
@@ -81,7 +82,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
 			$sth->bindParam(4, $maildir, PDO::PARAM_STR);
 			$sth->bindParam(5, $domain, PDO::PARAM_STR);
 			$sth->execute();
-			logging(ADMIN_EMAIL, $domain, "create mailbox", "$from");
+			logging($admin, $domain, "create mailbox", "$from");
 			$message = $LANG['Create_mailbox_result_succes'] . "<br />($from)";
 			$username = '';
 			$name = '';
blob - 3c3e4a1cea6402bae2029c65ec53d9cec65e9e41
blob + 7d8b93eb80e1e444b43137a229ef92d2cfb7b95a
--- admin/admin.php
+++ admin/admin.php
@@ -84,7 +84,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
 		if ($password1 != $password2) {
 			$message = $LANG['AdminAdd_admin_password_error'];
 		}
-		if (!empty($password1) && empty($message)) {
+		if (empty($message) && !empty($password1)) {
 			$hashed = bcrypt($password1);
 			try {
 				$dbh = connect_db();
blob - 85dc92c9a5bd3d429f61eb8aec5d37d4dce12195
blob + 3ffa13e5f71e8f480397b030e9b444d42fca2e3c
--- admin/delete.php
+++ admin/delete.php
@@ -23,10 +23,14 @@
 require_once '../functions.inc.php';
 include '../languages/' . check_language() . '.lang';
 
+$list_domains = list_domains();
+$admin = $SESSID_USERNAME ?? ADMIN_EMAIL;
+
 if ($_SERVER['REQUEST_METHOD'] == "GET") {
         $table = strtolower(filter_input(INPUT_GET, 'table', FILTER_DEFAULT));
         $delete = filter_input(INPUT_GET, 'delete', FILTER_DEFAULT);
-        $domain = filter_input(INPUT_GET, 'domain', FILTER_DEFAULT);
+        $domain = filter_input(INPUT_GET, 'domain', FILTER_VALIDATE_DOMAIN);
+	$domain_key = array_search($domain, array_column($list_domains, 'domain'));
 
 	if ($table == "domain") {
 		try {
@@ -95,6 +99,7 @@ if ($_SERVER['REQUEST_METHOD'] == "GET") {
 
 			$dbh->commit();
 			header("Location: list-domain.php");
+			exit;
 		} catch (RuntimeException $e) {
 			$message =  $e->getMessage();
 			$dbh->rollBack();
@@ -130,6 +135,7 @@ if ($_SERVER['REQUEST_METHOD'] == "GET") {
 
 			$dbh->commit();
 			header("Location: list-admin.php");
+			exit;
 		} catch (RuntimeException $e) {
 			$message =  $e->getMessage();
 			$dbh->rollBack();
@@ -139,7 +145,7 @@ if ($_SERVER['REQUEST_METHOD'] == "GET") {
 		}
 	}
 
-	if ($table == 'alias' || $table == 'mailbox') {
+	if (($table == 'alias' || $table == 'mailbox') && in_array($domain, array_column($list_domains, 'domain'))) {
 		try {
 			$dbh = connect_db();
 			$sth = $dbh->prepare("DELETE FROM alias WHERE address=? AND domain=?");
@@ -149,9 +155,10 @@ if ($_SERVER['REQUEST_METHOD'] == "GET") {
 			if ($sth->rowCount() != 1) {
 				throw new RuntimeException('alias');
 			}
-			logging(ADMIN_EMAIL, $domain, "delete alias", $delete);
+			logging($admin, $domain, "delete alias", $delete);
 
 			header("Location: list-virtual.php?domain=$domain");
+			exit;
 		} catch (RuntimeException $e) {
 			$message = $LANG['Delete_delete_error'] . "<b>$delete</b> (" . $e->getMessage() . ")!</span>";
 		} catch (PDOException $e) {
@@ -167,7 +174,7 @@ if ($_SERVER['REQUEST_METHOD'] == "GET") {
 			if ($sth->rowCount() != 1) {
 				throw new RuntimeException('mailbox');
 			}
-			logging(ADMIN_EMAIL, $domain, "delete mailbox", $delete);
+			logging($admin, $domain, "delete mailbox", $delete);
 
 			$sth = $dbh->prepare("DELETE FROM vacation WHERE email=? AND domain=?");
 			$sth->bindParam(1, $delete, PDO::PARAM_STR);
@@ -175,6 +182,7 @@ if ($_SERVER['REQUEST_METHOD'] == "GET") {
 			$sth->execute();
 
 			header("Location: list-virtual.php?domain=$domain");
+			exit;
 		} catch (RuntimeException $e) {
 			$message = $LANG['Delete_delete_error'] . "<b>$delete</b> (" . $e->getMessage() . ")!</span>";
 		} catch (PDOException $e) {
blob - 7f1a027de573ab5aae777a005bd848fcdbff0e08
blob + 1622f6f8c57769ad5b3184689db3ae6507ea16e0
--- admin/edit-alias.php
+++ admin/edit-alias.php
@@ -23,9 +23,13 @@
 require_once '../functions.inc.php';
 include '../languages/' . check_language() . '.lang';
 
+$list_domains = list_domains();
+$admin = $SESSID_USERNAME ?? ADMIN_EMAIL;
+
 if ($_SERVER['REQUEST_METHOD'] == "GET") {
 	$address = filter_input(INPUT_GET, 'address', FILTER_VALIDATE_EMAIL);
 	$domain = filter_input(INPUT_GET, 'domain', FILTER_VALIDATE_DOMAIN);
+	$domain_key = array_search($domain, array_column($list_domains, 'domain'));
 
 	try {
 		$dbh = connect_db();
@@ -44,6 +48,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
 	$address = strtolower(filter_input(INPUT_GET, 'address', FILTER_VALIDATE_EMAIL));
 	$domain = strtolower(filter_input(INPUT_GET, 'domain', FILTER_VALIDATE_DOMAIN));
 	$goto = strtolower(filter_input(INPUT_POST, 'goto', FILTER_DEFAULT));
+	$domain_key = array_search($domain, array_column($list_domains, 'domain'));
 	
 	if (empty($goto)) {
 		$goto = array();
@@ -62,7 +67,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
 		}
 	}
 
-	if (empty($message)) {
+	if (empty($message) && isset($domain_key)) {
 		try {
 			$dbh = connect_db();
 			$sth = $dbh->prepare("UPDATE alias SET goto=?,modified=NOW() WHERE address=? AND domain=?");
@@ -70,7 +75,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
 			$sth->bindParam(2, $address, PDO::PARAM_STR);
 			$sth->bindParam(3, $domain, PDO::PARAM_STR);
 			$sth->execute();
-			logging(ADMIN_EMAIL, $domain, "edit alias", "$address -> $goto");
+			logging($admin, $domain, "edit alias", "$address -> $goto");
 			header("Location: list-virtual.php?domain=$domain");
  		} catch(PDOException $e) { 
 			$message = $LANG['Edit_alias_result_error'];
blob - c85fea4d119c8cdcee0f15d53e82c8479afa0701
blob + 350f25d1ed76be281939270fbbd3c28b6e5d33ae
--- admin/edit-mailbox.php
+++ admin/edit-mailbox.php
@@ -25,6 +25,9 @@
 require_once '../functions.inc.php';
 include '../languages/' . check_language() . '.lang';
 
+$list_domains = list_domains();
+$admin = $SESSID_USERNAME ?? ADMIN_EMAIL;
+
 if ($_SERVER['REQUEST_METHOD'] == "GET") {
         $username = strtolower(filter_input(INPUT_GET, 'username', FILTER_DEFAULT));
         $domain = filter_input(INPUT_GET, 'domain', FILTER_VALIDATE_DOMAIN);
@@ -53,7 +56,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
 		$message = $LANG['Edit_mailbox_password_text_error'];
 	}
 
-	if (!empty($pqassword1) && empty($message)) {
+	if (empty($message) && isset($domain_key) && !empty($password1)) {
 		$hashed = bcrypt($password1);
 		try {
 			$dbh = connect_db();
@@ -68,7 +71,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
 		}	
 	}
 
-	if (empty($message)) {
+	if (empty($message) && isset($domain_key)) {
 		try {
 			$dbh = connect_db();
 			$sth = $dbh->prepare("UPDATE mailbox SET name=?,modified=NOW() WHERE username=? AND domain=?");
@@ -76,7 +79,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
 			$sth->bindParam(2, $username, PDO::PARAM_STR);
 			$sth->bindParam(3, $domain, PDO::PARAM_STR);
 			$sth->execute();
-			logging(ADMIN_EMAIL, $domain, "edit mailbox", $username);
+			logging($admin, $domain, "edit mailbox", $username);
 			header("Location: list-virtual.php?domain=$domain");
 		} catch(PDOException $e) {
 			$message = $LANG['Edit_mailbox_result_error'];
blob - f788e5ac19e6fd8570fbc3b04e2e058296f0416c
blob + 0b3bd426c576459c8b7481eae4e11eb9415a1d4d
--- delete.php
+++ delete.php
@@ -11,67 +11,75 @@
 //
 // Template Variables:
 //
-// tMessage
+// message
 //
 // Form POST \ GET Variables:
 //
-// fDelete
-// fDomain
+// table
+// where
+// delete
+// domain
 //
-require("./variables.inc.php");
-require("./config.inc.php");
-require("./functions.inc.php");
-include("./languages/" . check_language() . ".lang");
+require_once './functions.inc.php';
+include './languages/' . check_language() . '.lang';
 
 $SESSID_USERNAME = check_session();
-$list_domains = list_domains_for_admin($SESSID_USERNAME);
+$list_domains = list_domains($SESSID_USERNAME);
+$admin = $SESSID_USERNAME ?? ADMIN_EMAIL;
 
 if ($_SERVER['REQUEST_METHOD'] == "GET") {
-	if (isset($_GET['delete'])) $fDelete = escape_string($_GET['delete']);
-	if (isset($_GET['domain'])) $fDomain = escape_string($_GET['domain']);
+        $table = strtolower(filter_input(INPUT_GET, 'table', FILTER_DEFAULT));
+        $delete = filter_input(INPUT_GET, 'delete', FILTER_DEFAULT);
+        $domain = filter_input(INPUT_GET, 'domain', FILTER_VALIDATE_DOMAIN);
+	$domain_key = array_search($domain, array_column($list_domains, 'domain'));
 
-	if (in_array($_GET['domain'], array_column($list_domains, 'domain'))) {
-	#if (!check_owner($SESSID_USERNAME, $fDomain)) {
-		$error = 1;
-		$tMessage = $LANG['Delete_domain_error'] . "<b>$fDomain</b>!</div>";
-	} else {
+	if (($table == 'alias' || $table == 'mailbox') && in_array($domain, array_column($list_domains, 'domain'))) {
+		try {
+			$dbh = connect_db();
+			$sth = $dbh->prepare("DELETE FROM alias WHERE address=? AND domain=?");
+			$sth->bindParam(1, $delete, PDO::PARAM_STR);
+			$sth->bindParam(2, $domain, PDO::PARAM_STR);
+			$sth->execute();
+			if ($sth->rowCount() != 1) {
+				throw new RuntimeException('alias');
+			}
+			logging($admin, $domain, "delete alias", $delete);
 
-		$result = db_query("DELETE FROM alias WHERE address='$fDelete' AND domain='$fDomain'");
-		if ($result['rows'] != 1) {
-			$error = 1;
-			$tMessage = $LANG['Delete_delete_error'] . "<b>$fDelete</b> (alias)!</div>";
-		} else {
-			db_log($SESSID_USERNAME, $fDomain, "delete alias", $fDelete);
+			header("Location: list-virtual.php?domain=$domain");
+			exit;
+		} catch (RuntimeException $e) {
+			$message = $LANG['Delete_delete_error'] . "<b>$delete</b> (" . $e->getMessage() . ")!</span>";
+		} catch (PDOException $e) {
+			$message = $LANG['Delete_delete_error'] . "<b>$delete</b> (alias)!</span> " . $e-getMessage();
 		}
 
-		$result = db_query("SELECT * FROM mailbox WHERE username='$fDelete' AND domain='$fDomain'");
-		if ($result['rows'] == 1) {
-			$result = db_query("DELETE FROM mailbox WHERE username='$fDelete' AND domain='$fDomain'");
-			if ($result['rows'] != 1) {
-				$error = 1;
-				$tMessage = $LANG['Delete_delete_error'] . "<b>$fDelete</b> (mailbox)!</div>";
-			} else {
-				db_query("DELETE FROM vacation WHERE email='$fDelete' AND domain='$fDomain'");
-				db_log($SESSID_USERNAME, $fDomain, "delete mailbox", $fDelete);
+		try {
+			$dbh = connect_db();
+			$sth = $dbh->prepare("DELETE FROM mailbox WHERE username=? AND domain=?");
+			$sth->bindParam(1, $delete, PDO::PARAM_STR);
+			$sth->bindParam(2, $domain, PDO::PARAM_STR);
+			$sth->execute();
+			if ($sth->rowCount() != 1) {
+				throw new RuntimeException('mailbox');
 			}
-		}
-	}
+			logging($admin, $domain, "delete mailbox", $delete);
 
-	if ($error != 1) {
-		header("Location: overview.php?domain=$fDomain");
-		exit;
-	}
+			$sth = $dbh->prepare("DELETE FROM vacation WHERE email=? AND domain=?");
+			$sth->bindParam(1, $delete, PDO::PARAM_STR);
+			$sth->bindParam(2, $domain, PDO::PARAM_STR);
+			$sth->execute();
 
-	include("./templates/header.tpl");
-	include("./templates/menu.tpl");
-	include("./templates/message.tpl");
-	include("./templates/footer.tpl");
+			header("Location: list-virtual.php?domain=$domain");
+			exit;
+		} catch (RuntimeException $e) {
+			$message = $LANG['Delete_delete_error'] . "<b>$delete</b> (" . $e->getMessage() . ")!</span>";
+		} catch (PDOException $e) {
+			$message = $LANG['Delete_delete_error'] . "<b>$delete</b> (mailbox)!</span>";
+		}
+	}
 }
-
-if ($_SERVER['REQUEST_METHOD'] == "POST") {
-	include("./templates/header.tpl");
-	include("./templates/menu.tpl");
-	include("./templates/message.tpl");
-	include("./templates/footer.tpl");
-}
+include './templates/header.tpl';
+include './templates/menu.tpl';
+include './templates/message.tpl';
+include './templates/footer.tpl';
 ?>
blob - 2e9487f71b5274bfcab2a6e8ede6fb828bf6790e (mode 644)
blob + /dev/null
--- edit-active.php
+++ /dev/null
@@ -1,54 +0,0 @@
-<?php
-// 
-// OpenSMTPD Admin 
-// by Mischa Peters <mischa at high5 dot nl>
-// Copyright (c) 2022 High5!
-// License Info: LICENSE.TXT
-//
-// File: edit-active.php
-//
-// Template File: message.tpl
-//
-// Template Variables:
-//
-// tMessage
-//
-// Form POST \ GET Variables:
-//
-// fUsername
-// fDomain
-//
-require("./variables.inc.php");
-require("./config.inc.php");
-require("./functions.inc.php");
-include("./languages/" . check_language() . ".lang");
-
-$SESSID_USERNAME = check_session();
-
-if ($_SERVER['REQUEST_METHOD'] == "GET") {
-	if (isset($_GET['username'])) $fUsername = escape_string($_GET['username']);
-	if (isset($_GET['domain'])) $fDomain = escape_string($_GET['domain']);
-	
-	if (!check_owner($SESSID_USERNAME, $fDomain)) {
-		$error = 1;
-		$tMessage = $LANG['Edit_mailbox_domain_error'] . "<b>$fDomain</b>!</font>";
-	} else {
-		$result = db_query("UPDATE mailbox SET active=1-active WHERE username='$fUsername' AND domain='$fDomain'");
-		if ($result['rows'] != 1) {
-			$error = 1;
-			$tMessage = $LANG['Edit_mailbox_result_error'];
-		} else {
-			db_log($SESSID_USERNAME, $fDomain, "edit active", $fUsername);
-		}
-	}
-	
-	if ($error != 1) {
-		header("Location: overview.php?domain=$fDomain");
-		exit;
-	}
-}
-include("./templates/header.tpl");
-include("./templates/menu.tpl");
-include("./templates/message.tpl");
-include("./templates/footer.tpl");
-?>
blob - fc36f8c1e578e9ba5e9a9698a287bd2c3fba9e68
blob + 5a3333a88e1bc08540b2bd23ec499451fa5852ce
--- edit-alias.php
+++ edit-alias.php
@@ -11,91 +11,80 @@
 //
 // Template Variables:
 //
-// tMessage
-// tGoto
+// message
+// goto
 //
 // Form POST \ GET Variables:
 //
-// fAddress
-// fDomain
-// fGoto
+// address
+// domain
+// goto
 //
-require("./variables.inc.php");
-require("./config.inc.php");
-require("./functions.inc.php");
-include("./languages/" . check_language() . ".lang");
+require_once './functions.inc.php';
+include './languages/' . check_language() . '.lang';
 
 $SESSID_USERNAME = check_session();
+$list_domains = list_domains($SESSID_USERNAME);
+$admin = $SESSID_USERNAME ?? ADMIN_EMAIL;
 
 if ($_SERVER['REQUEST_METHOD'] == "GET") {
-	$fAddress = escape_string($_GET['address']);
-	$fDomain = escape_string($_GET['domain']);
+	$address = filter_input(INPUT_GET, 'address', FILTER_VALIDATE_EMAIL);
+	$domain = filter_input(INPUT_GET, 'domain', FILTER_VALIDATE_DOMAIN);
+	$domain_key = array_search($domain, array_column($list_domains, 'domain'));
 
-	if (check_owner($SESSID_USERNAME, $fDomain)) {
-		$result = db_query("SELECT * FROM alias WHERE address='$fAddress' AND domain='$fDomain'");
-		if ($result['rows'] == 1) {
-			$row = db_array($result['result']);
-			$tGoto = $row['goto'];
-		}
-	} else {
-		$tMessage = $LANG['Edit_alias_address_error'];
+	try {
+		$dbh = connect_db();
+		$sth = $dbh->prepare("SELECT goto FROM alias WHERE address=? AND domain=?");
+		$sth->bindParam(1, $address, PDO::PARAM_STR);
+		$sth->bindParam(2, $domain, PDO::PARAM_STR);
+		$sth->execute();
+		$goto = $sth->fetch(PDO::FETCH_COLUMN);
+		$goto = explode(',', $goto);
+	} catch(PDOException $e) {
+		$message = $LANG['Edit_alias_address_error'];
 	}
 }
 
 if ($_SERVER['REQUEST_METHOD'] == "POST") {
-	$pEdit_alias_goto = $LANG['Edit_alias_goto'];
+	$address = strtolower(filter_input(INPUT_GET, 'address', FILTER_VALIDATE_EMAIL));
+	$domain = strtolower(filter_input(INPUT_GET, 'domain', FILTER_VALIDATE_DOMAIN));
+	$goto = strtolower(filter_input(INPUT_POST, 'goto', FILTER_DEFAULT));
+	$domain_key = array_search($domain, array_column($list_domains, 'domain'));
 	
-	$fAddress = escape_string($_GET['address']);
-	$fAddress = strtolower($fAddress);
-	$fDomain = escape_string($_GET['domain']);
-	$fGoto = escape_string($_POST['fGoto']);
-	$fGoto = strtolower($fGoto);
-
-	if (!check_owner($SESSID_USERNAME, $fDomain)) {
-		$error = 1;
-		$tGoto = $fGoto;
-		$tMessage = $LANG['Edit_alias_domain_error'] . "$fDomain</font>";
-	}	
-	
-	if (empty($fGoto)) {
-		$error = 1;
-		$tGoto = $fGoto;
-		$tMessage = $LANG['Edit_alias_goto_text_error1'];
+	if (empty($goto)) {
+		$goto = array();
+		$message = $LANG['Edit_alias_goto_text_error1'];
+	} else {
+		$goto = preg_replace('/\\\r\\\n/', ',', $goto);
+		$goto = preg_replace('/\r\n/', ',', $goto);
+		$goto = preg_replace('/[\s]+/i', '', $goto);
+		$goto = preg_replace('/\,*$/', '', $goto);
+		$validate_goto = explode(',', $goto);
+		foreach ($validate_goto as $row) {
+			if (!filter_var($row, FILTER_VALIDATE_EMAIL)) {
+				$goto = explode(',', $goto);
+				$message = $LANG['Edit_alias_goto_text_error2'] . "$row</div>";
+			}
+		}
 	}
 
-	$goto = preg_replace('/\\\r\\\n/', ',', $fGoto);
-	$goto = preg_replace('/\r\n/', ',', $fGoto);
-	$goto = preg_replace('/[\s]+/i', '', $goto);
-	$goto = preg_replace('/\,*$/', '', $goto);
-	$array = preg_split('/,/', $goto);
-
-	if (!empty($array)) { $array_count = count($array); }
-
-	for($i = 0; $i < $array_count; $i++) {
-		if (in_array("$array[$i]", $CONF['default_aliases'])) continue;
-		if (empty($array[$i])) continue;
-		if (!check_email($array[$i]))
-		{
-			$error = 1;
-			$tGoto = $goto;
-			$tMessage = $LANG['Edit_alias_goto_text_error2'] . "$array[$i]</div>";
+	if (empty($message) && isset($domain_key)) {
+		try {
+			$dbh = connect_db();
+			$sth = $dbh->prepare("UPDATE alias SET goto=?,modified=NOW() WHERE address=? AND domain=?");
+			$sth->bindParam(1, $goto, PDO::PARAM_STR);
+			$sth->bindParam(2, $address, PDO::PARAM_STR);
+			$sth->bindParam(3, $domain, PDO::PARAM_STR);
+			$sth->execute();
+			logging($admin, $domain, "edit alias", "$address -> $goto");
+			header("Location: list-virtual.php?domain=$domain");
+ 		} catch(PDOException $e) { 
+			$message = $LANG['Edit_alias_result_error'];
 		}
 	}
-	
-	if ($error != 1) {
-		$result = db_query("UPDATE alias SET goto='$goto',modified=NOW() WHERE address='$fAddress' AND domain='$fDomain'");
-		if ($result['rows'] != 1) {
-			$tMessage = $LANG['Edit_alias_result_error'];
-		} else {
-			db_log($SESSID_USERNAME, $fDomain, "edit alias", "$fAddress -> $goto");
-					
-			header("Location: overview.php?domain=$fDomain");
-			exit;
-		}
-	}
 }
-include("./templates/header.tpl");
-include("./templates/menu.tpl");
-include("./templates/edit-alias.tpl");
-include("./templates/footer.tpl");
+include './templates/header.tpl';
+include './templates/menu.tpl';
+include './templates/edit-alias.tpl';
+include './templates/footer.tpl';
 ?>
blob - 6a6f1386fe7e802123165001c2c76356ec339ee1
blob + 88ade1ff74edfa0c44d3a3dee9a705283679fa32
--- edit-mailbox.php
+++ edit-mailbox.php
@@ -11,122 +11,84 @@
 //
 // Template Variables:
 //
-// tMessage
-// tName
-// tQuota
+// message
+// name
 //
 // Form POST \ GET Variables:
 //
-// fUsername
-// fDomain
-// fPassword
-// fPassword2
-// fName
-// fQuota
-// fActive
+// username
+// domain
+// password1
+// password2
+// name
 //
-require("./variables.inc.php");
-require("./config.inc.php");
-require("./functions.inc.php");
-include("./languages/" . check_language() . ".lang");
+require_once './functions.inc.php';
+include './languages/' . check_language() . '.lang';
 
 $SESSID_USERNAME = check_session();
+$list_domains = list_domains($SESSID_USERNAME);
+$admin = $SESSID_USERNAME ?? ADMIN_EMAIL;
 
 if ($_SERVER['REQUEST_METHOD'] == "GET") {
-	$fUsername = escape_string($_GET['username']);
-	$fDomain = escape_string($_GET['domain']);
+        $username = strtolower(filter_input(INPUT_GET, 'username', FILTER_DEFAULT));
+        $domain = filter_input(INPUT_GET, 'domain', FILTER_VALIDATE_DOMAIN);
 
-	if (check_owner($SESSID_USERNAME, $fDomain)) {
-		$result = db_query("SELECT * FROM mailbox WHERE username='$fUsername' AND domain='$fDomain'");
-		if ($result['rows'] == 1) {
-			$row = db_array($result['result']);
-			$tName = $row['name'];
-			$tQuota = $row['quota'] / $CONF['quota_multiplier'];
-			$tActive = $row['active'];
-		}
-	} else {
-		$tMessage = $LANG['Edit_mailbox_login_error'];
+	try {
+		$dbh = connect_db();
+		$sth = $dbh->prepare("SELECT * FROM mailbox WHERE username=? AND domain=?");
+		$sth->bindParam(1, $username, PDO::PARAM_STR);
+		$sth->bindParam(2, $domain, PDO::PARAM_STR);
+		$sth->execute();
+		$mailbox_details = $sth->fetch();
+		$name = $mailbox_details['name'];
+	} catch(PDOException $e) {
+		$message = $LANG['Edit_mailbox_login_error'];
 	}
-	
-	include("./templates/header.tpl");
-	include("./templates/menu.tpl");
-	include("./templates/edit-mailbox.tpl");
-	include("./templates/footer.tpl");
 }
 
 if ($_SERVER['REQUEST_METHOD'] == "POST") {
-	$pEdit_mailbox_password_text = $LANG['Edit_mailbox_password_text_error'];
-	$pEdit_mailbox_quota_text = $LANG['Edit_mailbox_quota_text'];
-	
-	$fUsername = escape_string($_GET['username']);
-	$fUsername = strtolower($fUsername);
-	$fDomain = escape_string($_GET['domain']);
-	
-	$fPassword = escape_string($_POST['fPassword']);
-	$fPassword2 = escape_string($_POST['fPassword2']);
-	$fName = escape_string($_POST['fName']);
-	if (isset($_POST['fQuota'])) $fQuota = escape_string($_POST['fQuota']);
-	if (isset($_POST['fActive'])) $fActive = escape_string($_POST['fActive']);
-  
-	if (!check_owner($SESSID_USERNAME, $fDomain)) {
-		$error = 1;
-		$tName = $fName;
-		$tQuota = $fQuota;
-		$tActive = $fActive;
-		$tMessage = $LANG['Edit_mailbox_domain_error'] . "$fDomain</font>";
-	}
+        $username = strtolower(filter_input(INPUT_GET, 'username', FILTER_DEFAULT));
+        $domain = filter_input(INPUT_GET, 'domain', FILTER_VALIDATE_DOMAIN);
+	$password1 = filter_input(INPUT_POST, 'password1', FILTER_DEFAULT);
+	$password2 = filter_input(INPUT_POST, 'password2', FILTER_DEFAULT);
+	$name = filter_input(INPUT_POST, 'name', FILTER_DEFAULT);
 
-	if ($fPassword != $fPassword2) {
-		$error = 1;
-		$tName = $fName;
-		$tQuota = $fQuota;
-		$tActive = $fActive;
-		$pEdit_mailbox_password_text = $LANG['Edit_mailbox_password_text_error'];
+	if ($password1 != $password2) {
+		$message = $LANG['Edit_mailbox_password_text_error'];
 	}
 
-	if ($CONF['quota'] == "YES") {
-		if (!check_quota($fQuota, $fDomain)) {
-			$error = 1;
-			$tName = $fName;
-			$tQuota = $fQuota;
-			$tActive = $fActive;
-			$pEdit_mailbox_quota_text = $LANG['Edit_mailbox_quota_text_error'];
-		}
+	if (empty($message) && isset($domain_key) && !empty($password1)) {
+		$hashed = bcrypt($password1);
+		try {
+			$dbh = connect_db();
+			$sth = $dbh->prepare("UPDATE mailbox SET password=?,name=?,modified=NOW() WHERE username=? AND domain=?");
+			$sth->bindParam(1, $hashed, PDO::PARAM_STR);
+			$sth->bindParam(2, $name, PDO::PARAM_STR);
+			$sth->bindParam(3, $username, PDO::PARAM_STR);
+			$sth->bindParam(4, $domain, PDO::PARAM_STR);
+			$sth->execute();
+		} catch(PDOException $e) {
+			$message = $LANG['Edit_mailbox_result_error'];
+		}	
 	}
 
-	if ($error != 1) {
-		if (!empty($fQuota)) {
-			$quota = $fQuota * $CONF['quota_multiplier'];
-		} else {
-			$quota = 0;
-		}
-		
-		if ($fActive == "on") {
-			$fActive = 1;
-		} else {
-			$fActive = 0;
-		}
-		
-		if (empty($fPassword) and empty($fPassword2)) {
-			$result = db_query("UPDATE mailbox SET name='$fName',quota='$quota',modified=NOW(),active='$fActive' WHERE username='$fUsername' AND domain='$fDomain'");
-		} else {
-			$password = pacrypt($fPassword);
-			$result = db_query("UPDATE mailbox SET password='$password',name='$fName',quota='$quota',modified=NOW(),active='$fActive',scheme='' WHERE username='$fUsername' AND domain='$fDomain'");
-		}
-
-		if ($result['rows'] != 1) {
-			$tMessage = $LANG['Edit_mailbox_result_error'];
-		} else {
-			db_log($SESSID_USERNAME, $fDomain, "edit mailbox", $fUsername);
-			
-			header("Location: overview.php?domain=$fDomain");
-			exit;
-		}
+	if (empty($message) && isset($domain_key)) {
+		try {
+			$dbh = connect_db();
+			$sth = $dbh->prepare("UPDATE mailbox SET name=?,modified=NOW() WHERE username=? AND domain=?");
+			$sth->bindParam(1, $name, PDO::PARAM_STR);
+			$sth->bindParam(2, $username, PDO::PARAM_STR);
+			$sth->bindParam(3, $domain, PDO::PARAM_STR);
+			$sth->execute();
+			logging($admin, $domain, "edit mailbox", $username);
+			header("Location: list-virtual.php?domain=$domain");
+		} catch(PDOException $e) {
+			$message = $LANG['Edit_mailbox_result_error'];
+		}	
 	}
-	
-	include("./templates/header.tpl");
-	include("./templates/menu.tpl");
-	include("./templates/edit-mailbox.tpl");
-	include("./templates/footer.tpl");
 }
+include './templates/header.tpl';
+include './templates/menu.tpl';
+include './templates/edit-mailbox.tpl';
+include './templates/footer.tpl';
 ?>
blob - 7df5602026b21c5491bb0f36c8ea88e15120b056 (mode 644)
blob + /dev/null
--- list-domains.php
+++ /dev/null
@@ -1,30 +0,0 @@
-<?php
-// 
-// OpenSMTPD Admin 
-// by Mischa Peters <mischa at high5 dot nl>
-// Copyright (c) 2022 High5!
-// License Info: LICENSE.TXT
-//
-// File: list-domains.php
-//
-// Template File: list-domains.tpl
-//
-// Template variables:
-//
-// list_domains
-//
-// GET / POST variables:
-//
-// -none-
-//
-require_once './functions.inc.php';
-include './languages/' . check_language() . '.lang';
-
-$SESSID_USERNAME = check_session();
-$list_domains = list_domains($SESSID_USERNAME);
-
-include './templates/header.tpl';
-include './templates/menu.tpl';
-include './templates/list-domains.tpl';
-include './templates/footer.tpl';
-?>
blob - 6683e3ca78804bccc6557681ea8ec13fedfb82b9 (mode 644)
blob + /dev/null
--- list-virtuals.php
+++ /dev/null
@@ -1,43 +0,0 @@
-<?php
-// 
-// OpenSMTPD Admin 
-// by Mischa Peters <mischa at high5 dot nl>
-// Copyright (c) 2022 High5!
-// License Info: LICENSE.TXT
-//
-// File: list-virtual.php
-//
-// Template File: list-virtual.tpl
-//
-// Template Variables:
-//
-// list_alias
-// list_mailbox
-//
-// Form POST \ GET Variables:
-//
-// domain
-// offset
-//
-require_once './functions.inc.php';
-include './languages/' . check_language() . '.lang';
-
-$SESSID_USERNAME = check_session();
-$list_domains = list_domains($SESSID_USERNAME);
-
-if ($_SERVER['REQUEST_METHOD'] == "GET") {
-	$offset = filter_input(INPUT_GET, 'offset', FILTER_VALIDATE_INT) ?? '0';
-	$limit = PAGE_SIZE;
-	$domain = filter_input(INPUT_GET, 'domain', FILTER_VALIDATE_DOMAIN);
-	if (in_array($domain, array_column($list_domains, 'domain'))) {
-		$domain_key = array_search($domain, array_column($list_domains, 'domain'));
-		$list_alias = list_aliases($domain, $offset, $limit);
-		$list_mailbox = list_mailboxes($domain, $offset, $limit);
-	}
-}
-
-include './templates/header.tpl';
-include './templates/menu.tpl';
-include './templates/list-virtuals.tpl';
-include './templates/footer.tpl';
-?>
blob - 45a9ed4916d0aa53bccb53a47c9adeffa840d95c
blob + a00158ad2fc2f8746e70aded25f224872dade863
--- templates/list-domains.tpl
+++ templates/list-domains.tpl
@@ -19,7 +19,7 @@ foreach ($list_domains as $row) {
 	if ($row['aliases'] < 0) $row['aliases'] = $LANG['Overview_disabled'];
 	if ($row['mailboxes'] < 0) $row['mailboxes'] = $LANG['Overview_disabled'];
 	echo "	<tr class=\"hilightoff\" onMouseOver=\"className='hilighton';\" onMouseOut=\"className='hilightoff';\">\n";
-	echo "		<td><a href=\"list-virtuals.php?domain=" . $row['domain'] . "\">" . $row['domain'] . "</a></td>\n";
+	echo "		<td><a href=\"list-virtual.php?domain=" . $row['domain'] . "\">" . $row['domain'] . "</a></td>\n";
 	echo "		<td>" . $row['alias_count'] . " / " . $row['aliases'] . "</td>\n";
 	echo "		<td>" . $row['mailbox_count'] . " / " . $row['mailboxes'] . "</td>\n";
 	echo "	</tr>\n";
blob - /dev/null
blob + a00158ad2fc2f8746e70aded25f224872dade863 (mode 644)
--- /dev/null
+++ templates/list-domain.tpl
@@ -0,0 +1,28 @@
+<div id="overview">
+<form name="search" method="post" action="search.php">
+Search: <input type="textbox" name="search" size="25">
+</form>
+</div>
+<?php
+echo "<table id=\"overview_table\">\n";
+echo "	<tr>\n";
+echo "		<td colspan=\"5\"><h3>".$LANG['Overview_title']."</h3></td>";
+echo "	</tr>";
+echo "	<tr class=\"header\">\n";
+echo "		<td>" . $LANG['Overview_get_domain'] . "</td>\n";
+echo "		<td>" . $LANG['Overview_get_aliases'] . "</td>\n";
+echo "		<td>" . $LANG['Overview_get_mailboxes'] . "</td>\n";
+echo "	</tr>\n";
+foreach ($list_domains as $row) {
+	if ($row['aliases'] == 0) $row['aliases'] = $LANG['Overview_unlimited'];
+	if ($row['mailboxes'] == 0) $row['mailboxes'] = $LANG['Overview_unlimited'];
+	if ($row['aliases'] < 0) $row['aliases'] = $LANG['Overview_disabled'];
+	if ($row['mailboxes'] < 0) $row['mailboxes'] = $LANG['Overview_disabled'];
+	echo "	<tr class=\"hilightoff\" onMouseOver=\"className='hilighton';\" onMouseOut=\"className='hilightoff';\">\n";
+	echo "		<td><a href=\"list-virtual.php?domain=" . $row['domain'] . "\">" . $row['domain'] . "</a></td>\n";
+	echo "		<td>" . $row['alias_count'] . " / " . $row['aliases'] . "</td>\n";
+	echo "		<td>" . $row['mailbox_count'] . " / " . $row['mailboxes'] . "</td>\n";
+	echo "	</tr>\n";
+}
+echo "</table>\n";
+?>
blob - 8e65d72f3de8328882c59a88cd2b4bec610cfae0
blob + 20902c0ac9e8c295fde8ae69e9a9694b3d6139f1
--- templates/menu.tpl
+++ templates/menu.tpl
@@ -1,6 +1,6 @@
 <div id="menu">
 <ul>
-	<li><a target="_top" href="list-domains.php"><?php echo $LANG['Menu_overview']; ?></a></li>
+	<li><a target="_top" href="list-domain.php"><?php echo $LANG['Menu_overview']; ?></a></li>
 	<li><a target="_top" href="add-alias.php<?php if (isset($domain)) echo '?domain=' . $domain; ?>"><?php echo $LANG['Menu_create_alias']; ?></a></li>
 	<li><a target="_top" href="add-mailbox.php<?php if (isset($domain)) echo '?domain=' . $domain; ?>"><?php echo $LANG['Menu_create_mailbox']; ?></a></li>
 	<li><a target="_top" href="sendmail.php"><?php echo $LANG['Menu_sendmail']; ?></a></li>