Add ask_user_info redirect to compose screen

[squirrelmail.git] / functions / global.php

diff --git a/functions/global.php b/functions/global.php
index 749ed394a13d0e58fc9f623dd7e4a1c072e26c56..10a861ee8d70fdb846f0a0dcf25f463edac8c53b 100644 (file)
--- a/functions/global.php
+++ b/functions/global.php
@@ -7,7 +7,7 @@
  * It also has some session register functions that work across various
  * php versions.
  *
- * @copyright © 1999-2006 The SquirrelMail Project Team
+ * @copyright © 1999-2007 The SquirrelMail Project Team
  * @license http://opensource.org/licenses/gpl-license.php GNU Public License
  * @version $Id$
  * @package squirrelmail
@@ -93,9 +93,7 @@ function sqsession_register ($var, $name) {
 
     sqsession_is_active();
 
-    $_SESSION["$name"] = $var;
-
-    session_register("$name");
+    $_SESSION[$name] = $var;
 }
 
 /**
@@ -138,8 +136,8 @@ function sqsession_is_registered ($name) {
   * input we should retrieve.  An example is if we have:
   *     <select name="startMessage_1">
   *     <select name="startMessage_2">
-  *     <input type="submit" name="form_submit_1">
-  *     <input type="submit" name="form_submit_2">
+  *     <input type="submit" name="form_submit_1" />
+  *     <input type="submit" name="form_submit_2" />
   * and we want to know which one of the select inputs should be
   * returned as $startMessage (without the suffix!), this function
   * decides by looking for either "form_submit_1" or "form_submit_2"
@@ -326,7 +324,7 @@ function sqsession_destroy() {
      * merging of sessions.
      */
 
-    global $base_uri;
+    global $base_uri, $_COOKIE, $_SESSION;
 
     if (isset($_COOKIE[session_name()]) && session_name()) sqsetcookie(session_name(), '', 0, $base_uri);
     if (isset($_COOKIE['username']) && $_COOKIE['username']) sqsetcookie('username','',0,$base_uri);
@@ -344,23 +342,30 @@ function sqsession_destroy() {
  * start a session up.  php.net doesn't tell you that $_SESSION
  * (even though autoglobal), is not created unless a session is
  * started, unlike $_POST, $_GET and such
+ * Update: (see #1685031) the session ID is left over after the
+ * session is closed in some PHP setups; this function just becomes
+ * a passthru to sqsession_start(), but leaving old code in for
+ * edification.
  */
 function sqsession_is_active() {
-    $sessid = session_id();
-    if ( empty( $sessid ) ) {
+    //$sessid = session_id();
+    //if ( empty( $sessid ) ) {
         sqsession_start();
-    }
+    //}
 }
 
 /**
  * Function to start the session and store the cookie with the session_id as
  * HttpOnly cookie which means that the cookie isn't accessible by javascript
  * (IE6 only)
+ * Note that as sqsession_is_active() no longer discriminates as to when 
+ * it calls this function, session_start() has to have E_NOTICE suppression
+ * (thus the @ sign).
  */
 function sqsession_start() {
     global $base_uri;
 
-    session_start();
+    @session_start();
     $session_id = session_id();
 
     // session_starts sets the sessionid cookie buth without the httponly var
@@ -380,11 +385,17 @@ function sqsession_start() {
  * @param boolean $bHttpOnly Disallow JS to access the cookie (IE6 only)
  * @return void
  */
-function sqsetcookie($sName,$sValue="deleted",$iExpire=0,$sPath="",$sDomain="",$bSecure=false,$bHttpOnly=true) {
+function sqsetcookie($sName,$sValue='deleted',$iExpire=0,$sPath="",$sDomain="",$bSecure=false,$bHttpOnly=true) {
     // if we have a secure connection then limit the cookies to https only.
     if ($sName && isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']) {
         $bSecure = true;
     }
+
+    // admin config can override the restriction of secure-only cookies
+    global $only_secure_cookies;
+    if (!$only_secure_cookies)
+        $bSecure = false;
+
     if (false && check_php_version(5,2)) {
        // php 5 supports the httponly attribute in setcookie, but because setcookie seems a bit
        // broken we use the header function for php 5.2 as well. We might change that later.
@@ -635,4 +646,59 @@ function sm_print_r() {
     print '</pre></div>';
 }
 
+/**
+  * Sanitize a value using htmlspecialchars() or similar, but also
+  * recursively run htmlspecialchars() (or similar) on array keys
+  * and values.
+  *
+  * If $value is not a string or an array with strings in it,
+  * the value is returned as is.
+  *
+  * @param mixed $value       The value to be sanitized.
+  * @param mixed $quote_style Either boolean or an integer.  If it
+  *                           is an integer, it must be the PHP
+  *                           constant indicating if/how to escape
+  *                           quotes: ENT_QUOTES, ENT_COMPAT, or
+  *                           ENT_NOQUOTES.  If it is a boolean value,
+  *                           it must be TRUE and thus indicates
+  *                           that the only sanitizing to be done
+  *                           herein is to replace single and double
+  *                           quotes with &#039; and &quot;, no other
+  *                           changes are made to $value.  If it is
+  *                           boolean and FALSE, behavior reverts
+  *                           to same as if the value was ENT_QUOTES
+  *                           (OPTIONAL; default is ENT_QUOTES).
+  *
+  * @return mixed The sanitized value.
+  *
+  * @since 1.5.2
+  *
+  **/
+function sq_htmlspecialchars($value, $quote_style=ENT_QUOTES) {
+
+    if ($quote_style === FALSE) $quote_style = ENT_QUOTES;
+
+    // array?  go recursive...
+    //
+    if (is_array($value)) {
+        $return_array = array();
+        foreach ($value as $key => $val) {
+            $return_array[sq_htmlspecialchars($key, $quote_style)]
+                = sq_htmlspecialchars($val, $quote_style);
+        }
+        return $return_array;
 
+    // sanitize strings only
+    //
+    } else if (is_string($value)) {
+        if ($quote_style === TRUE)
+            return str_replace(array('\'', '"'), array('&#039;', '&quot;'), $value);
+        else
+            return htmlspecialchars($value, $quote_style);
+    }
+
+    // anything else gets returned with no changes
+    //
+    return $value;
+
+}