make app password work with sftp

(cherry picked from commit 9faae96d61)
(cherry picked from commit f3b979f112)

CHANGES

@@ -1848,4 +1848,9 @@
 [5.0.5]
 * Fix bug where incoming mail from dynamic hostnames was rejected
 * Increase token expiry
+* Fix bug in tag UI where tag removal did not work
+
+[5.0.6]
+* Make mail eventlog only visible to owners
+* Make app password work with sftp
 

src/ldap.js

@@ -534,13 +534,16 @@ function authenticateSftp(req, res, next) {
     var parts = email.split('@');
     if (parts.length !== 2) return next(new ldap.NoSuchObjectError(req.dn.toString()));
 
-    // actual user bind
-    users.verifyWithUsername(parts[0], req.credentials, users.AP_SFTP, function (error) {
+    apps.getByFqdn(parts[1], function (error, app) {
         if (error) return next(new ldap.InvalidCredentialsError(req.dn.toString()));
 
-        debug('sftp auth: success');
+        users.verifyWithUsername(parts[0], req.credentials, app.id, function (error) {
+            if (error) return next(new ldap.InvalidCredentialsError(req.dn.toString()));
 
-        res.end();
+            debug('sftp auth: success');
+
+            res.end();
+        });
     });
 }
 

src/server.js

@@ -244,7 +244,13 @@ function initializeExpressSync() {
     }, routes.settings.set);
 
     // email routes
-    router.get('/api/v1/mailserver/:pathname', token, authorizeAdmin, routes.mailserver.proxy);
+    router.get('/api/v1/mailserver/:pathname', token, (req, res, next) => {
+        // some routes are more special than others
+        if (req.params.pathname === 'eventlog' || req.params.pathname === 'clear_eventlog') {
+            return authorizeOwner(req, res, next);
+        }
+        authorizeAdmin(req, res, next);
+    }, routes.mailserver.proxy);
 
     router.get ('/api/v1/mail/:domain',       token, authorizeAdmin, routes.mail.getDomain);
     router.post('/api/v1/mail',               token, authorizeAdmin, routes.mail.addDomain);

src/users.js

@@ -31,7 +31,6 @@ exports = module.exports = {
     count: count,
 
     AP_MAIL: 'mail',
-    AP_SFTP: 'sftp',
     AP_WEBADMIN: 'webadmin',
 
     ROLE_ADMIN: 'admin',