Webmail currently obtains the email address from the html form. The patch I propose replaces that with the official address obtained from authentication. Often they are equal. However, using advanced configuration features of Courier-Authlib, it is possible to obtain different results. (In such cases, IME, webmail just fails to set the sender address correctly.)

--- webmail/auth.original.h 2004-11-21 04:49:57.000000000 +0100 +++ webmail/auth.h 2006-10-22 18:51:13.000000000 +0200 @@ -11,7 +11,7 @@ #define auth_h

extern int prelogin(const char *); -extern const char *do_login(const char *, const char *, const char *); +extern const char *do_login(char **, const char *, const char *);

extern const char *login_returnaddr(); extern const char *login_fromhdr(); --- webmail/sqwebmail.original.c 2006-07-25 03:21:17.000000000 +0200 +++ webmail/sqwebmail.c 2006-10-22 19:24:40.000000000 +0200 @@ -2900,13 +2900,14 @@ const char *u2=cgi("logindomain"); char *ubuf=malloc(strlen(u)+strlen(u2)+2);

+ if (ubuf == NULL) enomem(); strcpy(ubuf, u); if (*u2) strcat(strcat(ubuf, "@"), u2);

maildir_cache_start();

- if (*p && (mailboxid=do_login(ubuf, p, ip_addr)) + if (*p && (mailboxid=do_login(&ubuf, p, ip_addr)) != 0) { char *q; --- webmail/auth.original.c 2006-05-28 17:29:52.000000000 +0200 +++ webmail/auth.c 2006-10-22 19:20:24.000000000 +0200 @@ -91,14 +91,15 @@ { const char *p=auth_getoption(a->options ? a->options:"", "disablewebmail"); - const char *c=(const char *)vp; + const char *c=a->address;

static char *authaddr=NULL; static char *authfullname=NULL; static char *authoptions=NULL; const char *n; - char *b; + char *b, **ubuf = (char **)vp; int rc; + size_t len;

if (p && atoi(p)) @@ -117,7 +118,7 @@ return (-1); }

- b=malloc(sizeof("AUTHADDR=")+strlen(c)); + b=malloc(sizeof("AUTHADDR=") + (len = strlen(c)));

if (!b) enomem(); @@ -126,6 +127,17 @@ if (authaddr) free(authaddr); authaddr=b; + + if (ubuf) + { + if (strlen(*ubuf) < len) + { + free(*ubuf); + if ((*ubuf = malloc(len + 1)) == NULL) + enomem(); + } + strcpy(*ubuf, c); + }

n=a->fullname; @@ -156,17 +168,18 @@ return (0); }

-const char *do_login(const char *u, const char *p, const char *ip) +const char *do_login(char **ubuf, const char *p, const char *ip) { - if (auth_login("webmail", u, p, doauthlogin, (void *)u)) + char *u = ubuf? *ubuf: NULL; + if (auth_login("webmail", u, p, doauthlogin, (void *)ubuf)) { courier_safe_printf("INFO: LOGIN FAILED, user=%s, ip=[%s]", u?u:"", ip); return NULL; }

- fprintf(stderr, "INFO: LOGIN, user=%s, ip=[%s]\n", u, ip); - return u; + fprintf(stderr, "INFO: LOGIN, user=%s, ip=[%s]\n", *ubuf, ip); + return *ubuf; }

int nochangepass() @@ -205,7 +218,7 @@

int prelogin(const char *u) { - return auth_getuserinfo("webmail", u, doauthlogin, (void *)u); + return auth_getuserinfo("webmail", u, doauthlogin, NULL); }

const char *login_returnaddr()