From c663f7ab4c458fd0c992b97b250eebd65e7db881 Mon Sep 17 00:00:00 2001
From: Francis Lachapelle <flachapelle@inverse.ca>
Date: Mon, 5 Dec 2016 16:12:16 -0500
Subject: [PATCH] Prevent using localhost on auxiliary IMAP accounts

---
 NEWS                                                        | 3 +++
 UI/PreferencesUI/English.lproj/Localizable.strings          | 1 +
 UI/Templates/PreferencesUI/UIxAccountEditor.wox             | 6 +++++-
 .../js/Preferences/AccountDialogController.js               | 1 +
 4 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index a9da9eded..e20e9245a 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,9 @@
 3.2.5 (2016-12-DD)
 ------------------
 
+Enhancements
+ - [web] prevent using localhost on additional IMAP accounts
+
 Bug fixes
  - [web] fixed confusion between owner and active user in ACLs management of Administration module
  - [web] fixed JavaScript exception after renaming an address book
diff --git a/UI/PreferencesUI/English.lproj/Localizable.strings b/UI/PreferencesUI/English.lproj/Localizable.strings
index 6801c4653..a4c4212df 100644
--- a/UI/PreferencesUI/English.lproj/Localizable.strings
+++ b/UI/PreferencesUI/English.lproj/Localizable.strings
@@ -194,6 +194,7 @@
 "Please enter your signature below" = "Please enter your signature below";
 "Please specify a valid sender address." = "Please specify a valid sender address.";
 "Please specify a valid reply-to address." = "Please specify a valid reply-to address.";
+"Specify a hostname other than the local host" = "Specify a hostname other than the local host";
 
 /* Additional Parameters */
 "Additional Parameters" = "Additional Parameters";
diff --git a/UI/Templates/PreferencesUI/UIxAccountEditor.wox b/UI/Templates/PreferencesUI/UIxAccountEditor.wox
index 8ec18bac8..701304e90 100644
--- a/UI/Templates/PreferencesUI/UIxAccountEditor.wox
+++ b/UI/Templates/PreferencesUI/UIxAccountEditor.wox
@@ -27,9 +27,13 @@
         <div layout="row">
           <md-input-container class="md-block md-flex">
             <label><var:string label:value="Server Name"/></label>
-            <input type="text" required="required"
+            <input name="serverName" type="text" required="required"
+                   ng-pattern="$AccountDialogController.hostnameRE"
                    ng-disabled="$AccountDialogController.accountId == 0"
                    ng-model="$AccountDialogController.account.serverName"/>
+            <div ng-messages="accountForm.serverName.$error" role="alert">
+              <div ng-message="pattern"><var:string label:value="Specify a hostname other than the local host"/></div>
+            </div>
           </md-input-container>
 
           <md-input-container class="md-block" flex="30">
diff --git a/UI/WebServerResources/js/Preferences/AccountDialogController.js b/UI/WebServerResources/js/Preferences/AccountDialogController.js
index 61f491260..feb1fa8a3 100644
--- a/UI/WebServerResources/js/Preferences/AccountDialogController.js
+++ b/UI/WebServerResources/js/Preferences/AccountDialogController.js
@@ -18,6 +18,7 @@
     vm.customFromIsReadonly = customFromIsReadonly;
     vm.cancel = cancel;
     vm.save = save;
+    vm.hostnameRE = accountId > 0 ? /^(?!(127\.0\.0\.1|localhost(?:\.localdomain)?)$)/ : /./;
 
     if (!vm.account.encryption)
       vm.account.encryption = "none";