# Cant get to admin panel

**URL:** <https://discourse.mailinabox.email/t/cant-get-to-admin-panel/1163>\
**Category:** Help with Setup/Upgrade\
**Created:** [March 28, 2016, 1:37pm UTC](https://discourse.mailinabox.email/t/cant-get-to-admin-panel/1163 "2016-03-28T13:37:07Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![MahNah](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/m/e495f1/32.png) [@MahNah](https://discourse.mailinabox.email/u/MahNah)\
**Post date:** [March 28, 2016, 1:37pm UTC](https://discourse.mailinabox.email/t/cant-get-to-admin-panel/1163/1 "2016-03-28T13:37:08Z")

</div>

Hello, I am setting up my “personal cloud” on a one domain with this setup, using Digital Ocean -  
(www.)domain.xyz - home page with blog or someting  
box.domain.xyz - MyCloud or SeaFile droplet  
mail.domain.xyz - Mail-In-a-Box droplet, using user@domain.xyz for emails  
First I set the box stuff, using DigitalOcean DNS and that works. Then I created mail droplet, named is mail.domain.xyz, added domain to this droplet, used mail-in-a-box setup and it went all ok. But now when I open IP/admin, I am getting top menu that I am unable to use and page shows the defaul domain webpage

> this is a mail-in-a-box  
> take control of your email at [https://mailinabox.email/](https://mailinabox.email/)

Any help on that, please? I have no idea what to set up next, maybe it is something with the DNS.

EDIT: I just found out that this happens only on a PC, when opening page on iPhone, it works…

---

<div class="post-metadata">

**Author:** ![v60fan](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/v60fan/32/277_2.png) [@v60fan](https://discourse.mailinabox.email/u/v60fan)\
**Post date:** [March 28, 2016, 10:35pm UTC](https://discourse.mailinabox.email/t/cant-get-to-admin-panel/1163/2 "2016-03-28T22:35:01Z")

</div>

Have you tried going to?:  
[https://mail.domain.xyz/mail/](https://mail.domain.xyz/mail/)

---

<div class="post-metadata">

**Author:** ![MahNah](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/m/e495f1/32.png) [@MahNah](https://discourse.mailinabox.email/u/MahNah)\
**Post date:** [March 28, 2016, 10:37pm UTC](https://discourse.mailinabox.email/t/cant-get-to-admin-panel/1163/3 "2016-03-28T22:37:05Z")

</div>

Decentraleyes was blocking js files 😒

---

<div class="post-metadata">

**Author:** ![dave](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/d/ee7513/32.png) [@dave](https://discourse.mailinabox.email/u/dave)\
**Post date:** [March 31, 2016, 7:50pm UTC](https://discourse.mailinabox.email/t/cant-get-to-admin-panel/1163/4 "2016-03-31T19:50:44Z")

</div>

I ran into the same issue with the admin panel and the [decentraleyes firefox addon](https://addons.mozilla.org/en-GB/firefox/addon/decentraleyes/) and had to whitelist my mailserver domain in the addon preferences. This is a real shame, as part of the reason I’m using mailinabox is to reduce my contact with google and others.

It looks like decentraleyes is adding a default whitellist for known sites where the proxying isn’t working, but that doesn’t help with mailinabox.

---

<div class="post-metadata">

**Author:** ![JoshData](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/joshdata/32/2153_2.png) [@JoshData](https://discourse.mailinabox.email/u/JoshData)\
**Post date:** [March 31, 2016, 8:22pm UTC](https://discourse.mailinabox.email/t/cant-get-to-admin-panel/1163/5 "2016-03-31T20:22:58Z")

</div>

> [@dave](#):
>
> This is a real shame

Pull requests are welcome. Build the thing you want to see in the world.

---

<div class="post-metadata">

**Author:** ![dave](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/d/ee7513/32.png) [@dave](https://discourse.mailinabox.email/u/dave)\
**Post date:** [March 31, 2016, 11:30pm UTC](https://discourse.mailinabox.email/t/cant-get-to-admin-panel/1163/6 "2016-03-31T23:30:19Z")

</div>

I’ve taken a look, but don’t yet know why things ain’t working.

I dumped out the requests using the [LiveHTTPHeaders firefox addon](http://livehttpheaders.mozdev.org/)

**Without decentraleyes:**  
[https://mymailserver.com/admin/](https://mymailserver.com/admin/) HTTP/1.1 200 OK  
[https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css](https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css) HTTP/1.1 200 OK  
[https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap-theme.min.css](https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap-theme.min.css) HTTP/1.1 200 OK  
[https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js](https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js) HTTP/1.1 200 OK  
[https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js](https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js) HTTP/2.0 200 OK

**With decentraleyes installed and running:**  
[https://mymailserver.com/admin/](https://mymailserver.com/admin/) HTTP/1.1 200 OK  
[https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css](https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css) HTTP/1.1 200 OK  
[https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap-theme.min.css](https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap-theme.min.css) HTTP/1.1 200 OK  
[https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js](https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js) HTTP/1.1 200 OK

The only difference is the request for [https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js](https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js) is blocked when decentraleyes is turned on. The docs/issues at [https://github.com/Synzvato/decentraleyes](https://github.com/Synzvato/decentraleyes) suggest that [maxcdn.bootstrapcdn.com](http://maxcdn.bootstrapcdn.com) isn’t currently being intercepted, so that’s why those requests are made in both cases.

It’s not immediately obvious why the interception is failing for jquery/1.11.3/jquery.min.js as I found mention of that version in the decentraleyes repo. I’ll look further.

---

<div class="post-metadata">

**Author:** ![dave](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/d/ee7513/32.png) [@dave](https://discourse.mailinabox.email/u/dave)\
**Post date:** [April 1, 2016, 1:58am UTC](https://discourse.mailinabox.email/t/cant-get-to-admin-panel/1163/7 "2016-04-01T01:58:42Z")

</div>

It appears that decentraleyes behaves differently for \<script\> tags with an **integrity** element.

The script that isn’t being loaded is embedded as follows:

```
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js" integrity="sha256-rsPUGdUPBXgalvIj4YKJrrUlmLXbOb6Cp7cdxn1qeUc=" crossorigin="anonymous"></script>

```

[https://github.com/Synzvato/decentraleyes/blob/f5f0154cfd40ab34c9cb223766f9ad33c39942fa/lib/load-watcher.js](https://github.com/Synzvato/decentraleyes/blob/f5f0154cfd40ab34c9cb223766f9ad33c39942fa/lib/load-watcher.js) has the following:

```
if (node.hasAttribute('crossorigin') || node.hasAttribute('integrity')) {   
    // Add corresponding origin domain to the list of tainted domains.
    storage.taintedDomains[requestOrigin.host] = true;
}

```

I’m not sure how that changes the behaviour though.

---

<div class="post-metadata">

**Author:** ![dave](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/d/ee7513/32.png) [@dave](https://discourse.mailinabox.email/u/dave)\
**Post date:** [April 1, 2016, 2:19am UTC](https://discourse.mailinabox.email/t/cant-get-to-admin-panel/1163/8 "2016-04-01T02:19:56Z")

</div>

I looked at the Firefox developer web console while loading /admin with decentraleyes turned on. There were the three errors/warnings below.

```
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js. (Reason: CORS header 'Access-Control-Allow-Origin' missing). :: <unknown>

None of the "sha256" hashes in the integrity attribute match the content of the subresource. :: admin

Error: Bootstrap's JavaScript requires jQuery :: bootstrap.min.js:6:37

```

This led me to [Breaks report-uri analyse tools · Issue #17 · Synzvato/decentraleyes · GitHub](https://github.com/Synzvato/decentraleyes/issues/17) (and a couple of other linked issues)

The decentraleyes developer sez:

> But should not the hashes be equal if the file is exactly the same […].

> That’s a very good observation! The injected code is, of course,  
> fully identical. Bundled files have been stripped of things like source  
> mapping comments, because the actual mapping files are not bundled to  
> save space. Also, by default, Decentraleyes adds comments to injected  
> files to signal local delivery.

> A tool to ensure resource integrity is included in the add-on, and is  
> also used by reviewers at Mozilla to make sure the actual code is  
> unaltered. So that’s why regular file fingerprints often don’t match.

> The reason the other attribute crossorigin causes  
> issues, is because it demands that the responses contain headers that  
> state cross-origin requests are allowed. Decentraleyes currently  
> redirects requests to data URIs. That particular protocol has nothing to do with HTTP, so chaos ensues.

> That’s the problem in a nutshell. Any ideas or suggestions are highly welcome!

So, TL;DR, the combination of the **crossorigin** and **integrity** attributes of the \<script\> tags in the /admin page aren’t currently supported by decentraleyes, so you need to whitelist your email domain in the addon until the addon is fixed.

**UPDATE 2016-05-09** : Decentraleyes v1.3.5, which was released recently appears to fix the issues with the admin pages of MiaB. I removed my mailserver from the Decentraleyes whitelist, and everything worked as expected.

The Decentraleyes release notes include:

> Enhanced: Improved CDN-mappings.  
> The add-on now supports a greater amount of Google Hosted Libraries  
> shorthand mappings. This effectively means that it’s now able to detect  
> even more injection opportunities, and can prevent an even higher amount  
> of requests to this particular network.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.mailinabox.email/uploads/default/original/2X/4/4d0933d13c456b7e57f296aa6cc344525b6f0c70.png) [@system](https://discourse.mailinabox.email/u/system)\
**Post date:** [April 8, 2016, 2:19am UTC](https://discourse.mailinabox.email/t/cant-get-to-admin-panel/1163/9 "2016-04-08T02:19:55Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.