+
+
+/**
+ * Sanitize a value using sm_encode_html_special_chars() or similar, but also
+ * recursively run sm_encode_html_special_chars() (or similar) on array keys
+ * and values.
+ *
+ * If $value is not a string or an array with strings in it,
+ * the value is returned as is.
+ *
+ * @param mixed $value The value to be sanitized.
+ * @param mixed $quote_style Either boolean or an integer. If it
+ * is an integer, it must be the PHP
+ * constant indicating if/how to escape
+ * quotes: ENT_QUOTES, ENT_COMPAT, or
+ * ENT_NOQUOTES. If it is a boolean value,
+ * it must be TRUE and thus indicates
+ * that the only sanitizing to be done
+ * herein is to replace single and double
+ * quotes with ' and ", no other
+ * changes are made to $value. If it is
+ * boolean and FALSE, behavior reverts
+ * to same as if the value was ENT_QUOTES
+ * (OPTIONAL; default is ENT_QUOTES).
+ *
+ * @return mixed The sanitized value.
+ *
+ * @since 1.5.2
+ *
+ **/
+function sq_htmlspecialchars($value, $quote_style=ENT_QUOTES) {
+
+ if ($quote_style === FALSE) $quote_style = ENT_QUOTES;
+
+ // array? go recursive...
+ //
+ if (is_array($value)) {
+ $return_array = array();
+ foreach ($value as $key => $val) {
+ $return_array[sq_htmlspecialchars($key, $quote_style)]
+ = sq_htmlspecialchars($val, $quote_style);
+ }
+ return $return_array;
+
+ // sanitize strings only
+ //
+ } else if (is_string($value)) {
+ if ($quote_style === TRUE)
+ return str_replace(array('\'', '"'), array(''', '"'), $value);
+ else
+ return sm_encode_html_special_chars($value, $quote_style);
+ }
+
+ // anything else gets returned with no changes
+ //
+ return $value;
+
+}
+
+
+/**
+ * Detect whether or not we have a SSL secured (HTTPS) connection
+ * connection to the browser
+ *
+ * It is thought to be so if you have 'SSLOptions +StdEnvVars'
+ * in your Apache configuration,
+ * OR if you have HTTPS set to a non-empty value (except "off")
+ * in your HTTP_SERVER_VARS,
+ * OR if you have HTTP_X_FORWARDED_PROTO=https in your HTTP_SERVER_VARS,
+ * OR if you are on port 443.
+ *
+ * Note: HTTP_X_FORWARDED_PROTO could be sent from the client and
+ * therefore possibly spoofed/hackable. Thus, SquirrelMail
+ * ignores such headers by default. The administrator
+ * can tell SM to use such header values by setting
+ * $sq_ignore_http_x_forwarded_headers to boolean FALSE
+ * in config/config.php or by using config/conf.pl.
+ *
+ * Note: It is possible to run SSL on a port other than 443, and
+ * if that is the case, the administrator should set
+ * $sq_https_port in config/config.php or by using config/conf.pl.
+ *
+ * @return boolean TRUE if the current connection is SSL-encrypted;
+ * FALSE otherwise.
+ *
+ * @since 1.4.17 and 1.5.2
+ *
+ */
+function is_ssl_secured_connection()
+{
+ global $sq_ignore_http_x_forwarded_headers, $sq_https_port;
+ $https_env_var = getenv('HTTPS');
+ if ($sq_ignore_http_x_forwarded_headers
+ || !sqgetGlobalVar('HTTP_X_FORWARDED_PROTO', $forwarded_proto, SQ_SERVER))
+ $forwarded_proto = '';
+ if (empty($sq_https_port)) // won't work with port 0 (zero)
+ $sq_https_port = 443;
+ if ((isset($https_env_var) && strcasecmp($https_env_var, 'on') === 0)
+ || (sqgetGlobalVar('HTTPS', $https, SQ_SERVER) && !empty($https)
+ && strcasecmp($https, 'off') !== 0)
+ || (strcasecmp($forwarded_proto, 'https') === 0)
+ || (sqgetGlobalVar('SERVER_PORT', $server_port, SQ_SERVER)
+ && $server_port == $sq_https_port))
+ return TRUE;
+ return FALSE;
+}
+
+
+/**
+ * Endeavor to detect what user and group PHP is currently
+ * running as. Probably only works in non-Windows environments.
+ *
+ * @return mixed Boolean FALSE is returned if something went wrong,
+ * otherwise an array is returned with the following
+ * elements:
+ * uid The current process' UID (integer)
+ * euid The current process' effective UID (integer)
+ * gid The current process' GID (integer)
+ * egid The current process' effective GID (integer)
+ * name The current process' name/handle (string)
+ * ename The current process' effective name/handle (string)
+ * group The current process' group name (string)
+ * egroup The current process' effective group name (string)
+ * Note that some of these elements may have empty
+ * values, especially if they could not be determined.
+ *
+ * @since 1.5.2
+ *
+ */
+function get_process_owner_info()
+{
+ if (!function_exists('posix_getuid'))
+ return FALSE;
+
+ $process_info['uid'] = posix_getuid();
+ $process_info['euid'] = posix_geteuid();
+ $process_info['gid'] = posix_getgid();
+ $process_info['egid'] = posix_getegid();
+
+ $user_info = posix_getpwuid($process_info['uid']);
+ $euser_info = posix_getpwuid($process_info['euid']);
+ $group_info = posix_getgrgid($process_info['gid']);
+ $egroup_info = posix_getgrgid($process_info['egid']);
+
+ $process_info['name'] = $user_info['name'];
+ $process_info['ename'] = $euser_info['name'];
+ $process_info['group'] = $user_info['name'];
+ $process_info['egroup'] = $euser_info['name'];
+
+ return $process_info;
+}
+
+