From 0fb9b4a7c080441860447b8a6b8e5b54c15c4a3e Mon Sep 17 00:00:00 2001
From: greyhatsec-au <111026372+greyhatsec-au@users.noreply.github.com>
Date: Sat, 8 Oct 2022 15:32:49 +1100
Subject: [PATCH] Add configuration option to enable list of accounts -
 defaults to hidden

---
 docker/rootfs/start.sh  |  5 +++++
 example.config.ini      |  3 +++
 web/api.php             | 10 +++++++++-
 web/js/opentrashmail.js |  5 +++++
 4 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/docker/rootfs/start.sh b/docker/rootfs/start.sh
index 037bd2d..ca07589 100644
--- a/docker/rootfs/start.sh
+++ b/docker/rootfs/start.sh
@@ -28,6 +28,11 @@ else
   echo "DOMAINS=localhost" >> /var/www/opentrashmail/config.ini
 fi
 
+if [ "$SHOW_ACCOUNT_LIST" != "" ]; then
+	echo "SHOW_ACCOUNT_LIST=$SHOW_ACCOUNT_LIST" >> /var/www/opentrashmail/config.ini
+  echo "   [i] Set show account list to: $SHOW_ACCOUNT_LIST"
+fi
+
 if [ "$ADMIN" != "" ]; then
 	echo "ADMIN=$ADMIN" >> /var/www/opentrashmail/config.ini
   echo "   [i] Set admin to: $ADMIN"
diff --git a/example.config.ini b/example.config.ini
index 167581e..86f2dec 100644
--- a/example.config.ini
+++ b/example.config.ini
@@ -5,6 +5,9 @@
 ; pro tip: Use a wildcard domain like *.yourdomain.com to auto-generate the subdomains (you'll need to add a wildcard dns record too)
 DOMAINS=yourdomain,sub.yourdomain,*.mydom.com
 
+; Enable to show a list of all existing accounts with mail
+;SHOW_ACCOUNT_LIST=true
+
 ; Enter the admin email address. If you choose this email on the website you will see all emails from all users
 ; The email doesn't really have to exist or have mail but must look like an email address
 ;ADMIN=some@random.email
diff --git a/web/api.php b/web/api.php
index d178f19..aaf42e7 100644
--- a/web/api.php
+++ b/web/api.php
@@ -141,8 +141,16 @@ switch($action)
             $o = array('status'=>'ok','emails'=>$data); 
         }
     break;
+    case 'show-list':
+        $settings = loadSettings();
+        $o = $settings['SHOW_ACCOUNT_LIST'];
+    break;
     case 'list-addresses':
-        $o = array('status'=>'ok','addresses'=>listEmailAdresses());
+        $settings = loadSettings();
+        $o = array('status'=>'ok','addresses'=>[]);
+        
+        if ($settings['SHOW_ACCOUNT_LIST']) 
+            $o['addresses'] = listEmailAdresses();
     break;
 }
 
diff --git a/web/js/opentrashmail.js b/web/js/opentrashmail.js
index 2bed3eb..5f7a092 100644
--- a/web/js/opentrashmail.js
+++ b/web/js/opentrashmail.js
@@ -16,6 +16,11 @@ $( document ).ready(function() {
             domains = data;
         else $("#btn-gen-random").hide();
     },"json")
+
+    $.get("api.php?a=show-list",function(data){
+        if (!data)
+            $("#btn-list-addresses").hide();
+    },"json")
 });
 
 function loadMail(email,id)