(Partly kind of security bug) Mail: SendAs Permisison for redirects and aliases but not for everyone

Hi
the database table mail_forwarding holds redirects as well as aliases.
1st: Of course users should not be able to send mails using other one's mail adress but aliases should allow the user to send as that mail adress by default. This is a simple security/bugfix.
2nd: I would love to be able to set things so I can allow a user who is a redirection target to also send as that mail adress.
Example: [email protected] is redirected to usera@ and [email protected] so usera and userb should be able to answer that email and send answer "from" info@
That is not possible now (after fixing 1st) but could be easily implemented by adding a checkbox to "new redirect" dialog.

For 1st request I changed my config as follows:
/etc/postfix/main.cf:

Code:

[...]
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql-sender_login_map.cf
[...]

/etc/postfix/mysql-sender_login_map.cf:

Code:

user = ispconfig
password = blahblah
dbname = ispconfig
table = mail_user
select_field = email
where_field = login
hosts = 127.0.0.1
additional_conditions = and disablesmtp = 'n' union select source as email from mail_forwarding where destination = '%u' and active = 'y' and type = 'alias'

2nd point could be a filed in database called "send_as" (could then also be implemented for aliases as well but should be checked by default for aliases) and we could adapt the config as I wrote above:

Code:

user = ispconfig
password = blahblah
dbname = ispconfig
table = mail_user
select_field = email
where_field = login
hosts = 127.0.0.1
additional_conditions = and disablesmtp = 'n' union select source as email from mail_forwarding where destination = '%u' and active = 'y' and send_as = 'Y'

Note: If I remember correctly ISPC does not setup login maps AT ALL by default so EVERYONE having an email account could send as ANYONE else without limits.
furthermore there are no security contstraints limiting sending mails if you setup webs on the mailserver btw... (In my opinion that should at least be marked as not recommended during setup)

 

UPDATE:

I Saw ISPC 3.1 already ha some sort of login-sender validation. I forked the repo and changed things to implement the permission way.
I would be happy if you would decide to pull the changes

http://git.ispconfig.org/darkalex/ispconfig3/commit/7799762f2a7ac3835f5e1f238ef32143fdeb3455

//Edit: moved to a branch, link corrected

 

I am not allowed to do so (button is missing)

my login: darkalex (guess I just need the permission)

 

//EDIT

Damned... I found out how to do it...
It's a bit complicated for one who is used to SVN and not git at all yet