+ }
+ $trusted .= "\n";
+ }
+ $trusted .= "<!-- end sanitized html -->\n";
+ return $trusted;
+}
+
+/**
+* This is a wrapper function to call html sanitizing routines.
+*
+* @param $body the body of the message
+* @param $id the id of the message
+* @param $message
+* @param $mailbox
+* @param boolean $take_mailto_links When TRUE, converts mailto: links
+* into internal SM compose links
+* (optional; default = TRUE)
+* @return a string with html safe to display in the browser.
+*/
+function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links = true) {
+
+ require_once(SM_PATH . 'functions/url_parser.php'); // for $MailTo_PReg_Match
+
+ global $attachment_common_show_images, $view_unsafe_images,
+ $has_unsafe_images;
+
+ /**
+ * Don't display attached images in HTML mode.
+ */
+ $attachment_common_show_images = false;
+ $tag_list = Array(
+ false,
+ "object",
+ "meta",
+ "html",
+ "head",
+ "base",
+ "link",
+ "frame",
+ "iframe",
+ "plaintext",
+ "marquee"
+ );
+
+ $rm_tags_with_content = Array(
+ "script",
+ "applet",
+ "embed",
+ "title",
+ "frameset",
+ "xml"
+ );
+
+ $self_closing_tags = Array(
+ "img",
+ "br",
+ "hr",
+ "input",
+ "outbind"
+ );
+
+ $force_tag_closing = true;
+
+ $rm_attnames = Array(
+ "/.*/" =>
+ Array(
+ "/target/i",
+ "/^on.*/i",
+ "/^dynsrc/i",
+ "/^data.*/i",
+ "/^lowsrc.*/i"
+ )
+ );
+
+ $secremoveimg = "../images/" . _("sec_remove_eng.png");
+ $bad_attvals = Array(
+ "/.*/" =>
+ Array(
+ "/^src|background/i" =>
+ Array(
+ Array(
+ "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
+ "/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
+ "/^([\'\"])\s*about\s*:.*([\'\"])/si"
+ ),
+ Array(
+ "\\1$secremoveimg\\2",
+ "\\1$secremoveimg\\2",
+ "\\1$secremoveimg\\2",
+ "\\1$secremoveimg\\2"
+ )
+ ),
+ "/^href|action/i" =>
+ Array(
+ Array(
+ "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
+ "/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
+ "/^([\'\"])\s*about\s*:.*([\'\"])/si"
+ ),
+ Array(
+ "\\1#\\1",
+ "\\1#\\1",
+ "\\1#\\1",
+ "\\1#\\1"
+ )
+ ),
+ "/^style/i" =>
+ Array(
+ Array(
+ "/expression/i",
+ "/binding/i",
+ "/behaviou*r/i",
+ "/include-source/i",
+ "/position\s*:\s*absolute/i",
+ "/url\s*\(\s*([\'\"])\s*\S+script\s*:.*([\'\"])\s*\)/si",
+ "/url\s*\(\s*([\'\"])\s*mocha\s*:.*([\'\"])\s*\)/si",
+ "/url\s*\(\s*([\'\"])\s*about\s*:.*([\'\"])\s*\)/si",
+ "/(.*)\s*:\s*url\s*\(\s*([\'\"]*)\s*\S+script\s*:.*([\'\"]*)\s*\)/si"
+ ),
+ Array(
+ "idiocy",
+ "idiocy",
+ "idiocy",
+ "idiocy",
+ "",
+ "url(\\1#\\1)",
+ "url(\\1#\\1)",
+ "url(\\1#\\1)",
+ "url(\\1#\\1)",
+ "\\1:url(\\2#\\3)"
+ )
+ )
+ )
+ );
+ if( !sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET) ) {
+ $view_unsafe_images = false;
+ }
+ if (!$view_unsafe_images){
+ /**
+ * Remove any references to http/https if view_unsafe_images set
+ * to false.
+ */
+ array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[0],
+ '/^([\'\"])\s*https*:.*([\'\"])/si');
+ array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[1],
+ "\\1$secremoveimg\\1");
+ array_push($bad_attvals{'/.*/'}{'/^style/i'}[0],
+ '/url\(([\'\"])\s*https*:.*([\'\"])\)/si');
+ array_push($bad_attvals{'/.*/'}{'/^style/i'}[1],
+ "url(\\1$secremoveimg\\1)");
+ }
+
+ $add_attr_to_tag = Array(
+ "/^a$/i" =>
+ Array('target'=>'"_blank"',
+ 'title'=>'"'._("This external link will open in a new window").'"'
+ )
+ );
+ $trusted = sq_sanitize($body,
+ $tag_list,
+ $rm_tags_with_content,
+ $self_closing_tags,
+ $force_tag_closing,
+ $rm_attnames,
+ $bad_attvals,
+ $add_attr_to_tag,
+ $message,
+ $id,
+ $mailbox
+ );
+ if (preg_match("|$secremoveimg|i", $trusted)){
+ $has_unsafe_images = true;
+ }
+
+
+ // we want to parse mailto's in HTML output, change to SM compose links
+ // this is a modified version of code from url_parser.php... but Marc is
+ // right: we need a better filtering implementation; adding this randomly
+ // here is not a great solution
+ //
+ if ($take_mailto_links) {
+ // parseUrl($trusted); // this even parses URLs inside of tags... too aggressive
+ global $MailTo_PReg_Match;
+ $MailTo_PReg_Match = '/mailto:' . substr($MailTo_PReg_Match, 1);
+ if ((preg_match_all($MailTo_PReg_Match, $trusted, $regs)) && ($regs[0][0] != '')) {
+ foreach ($regs[0] as $i => $mailto_before) {
+ $mailto_params = $regs[10][$i];
+
+ // get rid of any tailing quote since we have to add send_to to the end
+ //
+ if (substr($mailto_before, strlen($mailto_before) - 1) == '"')
+ $mailto_before = substr($mailto_before, 0, strlen($mailto_before) - 1);
+ if (substr($mailto_params, strlen($mailto_params) - 1) == '"')
+ $mailto_params = substr($mailto_params, 0, strlen($mailto_params) - 1);
+
+ if ($regs[1][$i]) { //if there is an email addr before '?', we need to merge it with the params
+ $to = 'to=' . $regs[1][$i];
+ if (strpos($mailto_params, 'to=') > -1) //already a 'to='
+ $mailto_params = str_replace('to=', $to . '%2C%20', $mailto_params);
+ else {
+ if ($mailto_params) //already some params, append to them
+ $mailto_params .= '&' . $to;
+ else
+ $mailto_params .= '?' . $to;
+ }
+ }
+
+ $url_str = preg_replace(array('/to=/i', '/(?<!b)cc=/i', '/bcc=/i'), array('send_to=', 'send_to_cc=', 'send_to_bcc='), $mailto_params);
+
+ // we'll already have target=_blank, no need to allow comp_in_new
+ // here (which would be a lot more work anyway)
+ //
+ global $compose_new_win;
+ $temp_comp_in_new = $compose_new_win;
+ $compose_new_win = 0;
+ $comp_uri = makeComposeLink('src/compose.php' . $url_str, $mailto_before);
+ $compose_new_win = $temp_comp_in_new;
+
+ // remove <a href=" and anything after the next quote (we only
+ // need the uri, not the link HTML) in compose uri
+ //
+ $comp_uri = substr($comp_uri, 9);
+ $comp_uri = substr($comp_uri, 0, strpos($comp_uri, '"', 1));
+ $trusted = str_replace($mailto_before, $comp_uri, $trusted);