ChangeLog

v2.7.4, 2024-12-19

• Improvements:

  • Add daily cron jobs to remove old stats and events data from databases.
  • Store raw size and archived size of messages and attachments in databases. They are already stored in FTS, but not in databases.

• Fixed issues:

  • OTP may not work in some cases.

v2.7.3, 2024-12-12

• Improvements:

  • Count smtp rejections and display the reject reasons in Daily Archiving Report email.
  • Refactored 2FA implementation.
  • spider-import: Display a warning message when importing via IMAP without --tls or --ssl argument.

• Fixed issues:

  • Not count rejected sessions in RCPT state of smtp session.
  • Not compress rotated log files by default.
  • Not correctly validate email address while login as end user.

• Docker:

  • Binary programs are now placed under /usr/local/bin/ instead of /, same as standalone installation.
    • /spiderd -> /usr/local/bin/spiderd
    • /spider-import -> /usr/local/bin/spider-import

• Updated packages:

  • github.com/blevesearch/bleve/v2 v2.4.3
  • github.com/jhillyerd/enmime/v2 v2.0.0
  • github.com/emersion/go-imap/v2 v2.0.0-beta.4

v2.7.2, 2024-07-17

• Docker images are now built with golang:1.22.5-alpine3.20.
• Upgrade to latest http server (GoFiber v2.52.5) which addressed a security vulnerability.
• Improvements:
  • [Daily Archiving Report] Hide domains which didn't sent or received any message.
  • Print more info while importing messages via IMAP.
  • Save more info in SMTP Events and daemon log file if email was rejected.
• Fixed issues:
  • Searching imported messages may return inconsistent results. Thanks to Haus Seeblick for the feedback and help.

v2.7.1, 2024-06-05

• Slight improvement in Daily Archiving Report email.
• Fixed issues:
  • User in auditor group can switch to admin group. Thanks @nmaluge for the feedback.

v2.7.0, 2024-05-09

• Improvements:

  • New argument required for importing from Maildir format mailbox: --owner.
  • Only one email address is counted as licensed mailbox for imported mailbox.
  • Improved content in Daily Archiving Report email.

• Fixed issues:

  • Not handle special wildcard searches which may cause huge memory increasing and killed by systemd due to out-of-memory.
  • Losing search highlight.
  • Not convert HTML body to text in some edge cases.
  • Not closing database while stopping smtp service in some edge cases.
  • Not log year/month/day in log file.
  • Linux: Improved systemd service file (Restart=on-abnormal, RestartSec=30).

v2.6.3, 2024-01-30

• Fixed issues:
  • Panic while parsing invalid URL.
  • Update dependent smtp package to prevent the SMTP Smuggling attack. FYI https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/

v2.6.2, 2024-01-12

• Revert dependent smtp package (the SMTP Smuggling fix causes failing to read message from SMTP server).
• Improvements:
  • Log possible detailed error when asks mail server to retry delivery.

v2.6.1, 2024-01-09

• Improvements:
  • Simplify the content in daily archiving report email.
  • spider-import:
    • New argument to explicitly specify IMAP secure connection type: --ssl and --tls.
    • Dropped argument --insecure. It uses insecure connection if neither --ssl nor --tls is given.

• Fixed issues:
  • Settings -> Notifications: username without domain part is now allowed as SMTP Username.
  • Settings -> Email Domains: IP address is now disallowed as email domain name.

v2.6.0, 2023-12-08

• RESTful API (New in v2.6.0):

  • Able to query global, per-domain and per-mailbox archiving statistics. API Document.

• New features:

  • Notification support (Settings -> Notifications). Spider will now send daily archiving statistics to specified admin(s) from provided SMTP account.
  • Able to view per-domain and per-mailbox archiving statstics (Settings -> Email Domains).

• Improvements:

  • Support parsing email messages forwarded as Microsoft Exchange Journal Report.

    Note: Currently you have to configure Exchange to forward Journal Report to Spider directly, we will improve Spider to support periodly fetching messages from a Journal mailbox for archiving in future release.

  • Removed SQL database /opt/spider/db/participants.db. FTS document contains required info, so this database is not necessary at all.

  • Batch action support on mailbox list page (Settings -> Email Domains -> Mailboxes): Stop Archiving, Start Archiving, Delete (delete mail addresses, not archived messages).

  • Able to import emails in given time range.

    Two arguments are introduced to specify time range, it's ok to use either or both at the same time:

    • --since-time: Import messages since given datetime (in yyyy-mm-dd HH:MM:SS format).
    • --before-time: Import messages before given datetime (in yyyy-mm-dd HH:MM:SS format).

  • Able to exclude IMAP folders while importing with argument --exclude-folder. Multiple folders can be specified with multiple arguments, for example, --exclude-folder AAA --exclude-folder BBB.

• Fixed issues:

  • Stop Archiving doesn't work if email address contains invalid char. Thanks Victor for the feedback.
  • Not auto vacuum database to reduce size. This issue was introduced in v2.5.1.
  • No notifications on web UI after clicked Reindex All button.
  • Can not view body of email messages in thread. Thanks Marcin Wisniowski for the feedback.
  • Changing the number of results per page triggers error. Thanks Marcin Wisniowski for the feedback.
  • If message was failed to parse, click Reindex or Reindex All button on web UI doesn't trigger the reindex immediately (need to restart spiderd service).

v2.5.2, 2023-10-19

• Fixed issues:
  • Can not stop archiving for mailbox with non-ascii character in address. Thanks Victor (victorsina@) for the report.
  • Not automatically vacuum database to reduce size. This issue was introduced in v2.5.1. Thanks Victor (victorsina@) for the report.

v2.5.1, 2023-09-13

• Fixed issues:
  • Incorrectly enable TLS for http and smtp services without ssl cert.

v2.5.0, 2023-09-06

• New features:

  • Amazon S3 compatible storage support (Settings -> Storage).
  • You can now customize branding on web UI directly (Settings -> Custom Branding), including short and full brand name, website link, logo image and favicon icon.
  • End user authentication against ActiveSync service running on email server (Settings -> End User Authentication).

• Improvements:

  • "License" page now always shows an input field to activate license key.
  • "SMTP Events" page:
    • Drop "Subject" field (it didn't display subject in earlier versions).
    • Add links to settings pages for events:
      • "Not contain any hosted domain"
      • "Not an authorized mail server"
      • "Not secure SMTP connection"
      • "Wrong archiving address"

• Fixed issues:

  • Can not render charts if server OS doesn't have package tzdata installed.

v2.4.2, 2023-07-17

• Improvements:
  • Add small icons to easily clear input texts and dates in search form.
• Fixed issues:
  • Not correctly wildcard search keyword with upper cases. Thanks Harvey (hw234 at gmx.de) for the report.

v2.4.1, 2023-07-15

• Improved tooltip of search form.
• Fixed issues:
  • Not correctly handle wildcard search keyword. Thanks Harvey (hw234 at gmx.de) for the report.
  • Not correctly display admin emails on page footer (Contact Webmaster).

v2.4.0, 2023-06-25

• WARNING: A license key is now always required. Sign up to our website to get a trial license or purchase one: https://store.iredmail.org/
• Improvements:
  • Simplified event filters on SMTP Events page.
  • Refactored SMTP queue info on Dashboard page.
  • Add filters on Activities page.
  • Display account display name and login username while editing account profile.
  • Log more info of SMTP events.
  • spider-import:
    • It now supports importing from specified IMAP folders instead of all folders (argument --imap-folder). Multiple folders can be specified with multiple --imap-folder arguments. For example, to import emails from INBOX and Sent folders: --imap-folder INBOX --imap-folder Sent.
    • Simplified console output.
• Fixed issues:
  • Not set strict file permission on log files (it's now 0700).
  • Not rotate web log file.
  • Not start and stop components in proper order. This may cause database access error after closed databases.
  • Several minor web UI display issues.

v2.3.0, 2023-05-22

• NEW: Export all emails match the search pattern.
• Disable animation while updating charts on Dashboard page.
• Fixed issues:
  • Not elegantly shut down fts doc queue.
  • Not recheck max mailboxes after starting or stopping archiving for user.
  • Cannot export emails in some cases if attachment is an inline MIME part in plain text or html.
  • Incorrect timezone in statistic charts on Dashboard page.
  • Few other minor issues.

v2.2.0, 2023-04-28

• Improvements:
  • Precisely search sender and recipient with full email address.
  • Display mail subject and header "Message-ID:" on "SMTP Events" page for discarded message only.
• Fixed issues:
  • Another smtp server "Cannot start TLS: handshake failure" error.

v2.1.0, 2023-04-24

• Improvements:
  • New "SMTP Events" page to show smtp action/reply of each smtp session.
  • Only one domain name is allowed in ssl cert.
  • New command line argument: "-debug-smtp", useful to get detailed smtp session data for troubleshooting if necessary.
  • Add few more strong secure SSL ciphers for smtp service.
  • Some other minor improvements.
• Fixed issues:
  • spider-import panic while importing messages from IMAP server.
  • smtp server raised "Cannot start TLS: handshake failure" error.

v2.0.0, 2023-03-17

• Improvements
  • Not collect email addresses in Delivered-To: header(s).
  • Log sender/recipients for troubleshooting when rejecting email. #904
  • Handle multiple email addresses in one X-Envelope-To: header. #936
  • Log detailed error message if failed to request ssl cert. #906
  • Use TLSv1.3 by default when requesting ssl cert.
  • Enable SQLite WAL mode by default.
• Fixed issues
  • Can not parse email with invalid character in header field.
  • Can not parse email with incomplete attachment.
  • Invalid renewal time for newly submitted domain name used to request ssl cert.
  • Still count "Stop Archiving" mailboxes as valid one.
  • Initialize API routers before csrf middleware to avoid CSRF verification.

v1.1.0, 2022-08-09

• Improvements
  • List all email addresses under (hosted) email domain, including mailbox stats: numbers of sent / received messages, size of sent / received messages.
  • Display latest messages when auditor selects a mailbox.
  • Auditor can now search keyword for selected mailbox.
  • Display mail subjects of messages which are stayed in smtp queue but failed to parse. This should be easier for sysadmin to decide whether or not to delete them.
  • Automate SQL structure upgrade for smtp queue.
  • Simplify JavaScript code, improve unittests, web UI.

v1.0.0, 2022-07-27

• First stable release.