<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
Posted to the Forums: <a href="https://forums.zimbra.org/viewtopic.php?f=13&t=71763&p=308522">https://forums.zimbra.org/viewtopic.php?f=13&t=71763&p=308522</a><br>
<div>
<div dir="auto" style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div dir="auto" style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div dir="auto" style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
___________________________________<br>
<b>Another Message From… L. Mark Stone</b><br>
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<br>
</div>
</div>
</div>
</div>
</div>
<br class="Apple-interchange-newline">
<br class="Apple-interchange-newline">
</div>
<div><br>
<blockquote type="cite">
<div>On Mar 9, 2023, at 4:58 PM, Marc Gadsdon <mg@in-tuition.net> wrote:</div>
<br class="Apple-interchange-newline">
<div>
<title></title>
<div>
<div name="messageBodySection">
<div dir="auto">Heads up - the security fix mentioned in the release notes will break preauth depending on your configuration and there’s no documentation for this.<br>
<br>
Release notes mention:<br>
"Strengthened PreAuth servlet to only redirect to admin configured url, which will prevent security issues related to open redirection vulnerabilities."<br>
<br>
The code contains this comment:<br>
// ZBUG-3105: we are allowing redirectURL only from zimbraPublicServiceHostname and<br>
// also url from zimbra_allowed_redirect_url<br>
<br>
The solution is to ensure that whatever redirectURL you pass in during the preauth process needs to match the value of `zimbra_allowed_redirect_url`<br>
<br>
```<br>
zmlocalconfig -e zimbra_allowed_redirect_url="/"<br>
zmcontrol restart<br>
```<br>
<br>
Hope this helps someone.<br>
<br>
Regards,<br>
<br>
Marc</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</body>
</html>