Disabled account can still receive email

Impacted versions

• OS Type: Debian
• OS Version: Buster
• Database Type: PostgreSQL
• Database version: 11
• Modoboa: 1.17.0

Steps to reproduce

1. Create an account with Simple user role and disable it - either at the creation or after
2. Send an email to this account

Current behavior

Even if the account is disabled, the recipient is still allowed by Postfix and the email is delivered.

Expected behavior

If I understand the meaning of a disabled account, emails to this address should be rejected.

Debugging

While trying to find in Postfix when this recipient is accepted, I found that it was by looking up in sql-aliases.cf table. Even if there is a condition on enabled in the admin_alias table, the object is still returned. And indeed, even if the core_user is disabled, the corresponding admin_alias is not.

[Toniob]

Hi,

I’m running 1.17.0 and I added the patch manually. But the mail are still received. I think that’s because that’s dovecot-lmtp which is responsible for accepting or not the mail. And in the user_query in dovecot, we never check for the is_active attribute.

[jeromelebleu]

Hi @kryskool, no it does not fix this problem and this is why I commented this commit. It only disables aliases which have been added manually from the interface (internal=False) and not automatically like here (internal=True).