Added security patch

[squirrelmail.git] / functions / imap_general.php

diff --git a/functions/imap_general.php b/functions/imap_general.php
index 12a84601d58b6bf802a97a40bf09e7c48de6c46c..8e2dc16b2b9b9af100ea4d5fd50e7c1834618730 100755 (executable)
--- a/functions/imap_general.php
+++ b/functions/imap_general.php
@@ -25,7 +25,7 @@
          $size = 0;
       }
       
-      $data = Array();
+      $data = array();
       $total_size = 0;
       
       $continue = true;
@@ -46,7 +46,9 @@
             if ($total_size == $size) {
                $data[] = $read;
                $read = fgets($imap_stream, 9096);
-               $read = fgets($imap_stream, 9096);
+               while (!ereg("^$pre (OK|BAD|NO)(.*)$", $read, $regs)) {
+                  $read = fgets($imap_stream, 9096);
+               }
                $continue = false;
             } else if ($total_size > $size) {
                $difference = $total_size - $size;
@@ -80,7 +82,7 @@
      
       if ($response == 'NO') {
          // ignore this error from m$ exchange, it is not fatal (aka bug)
-         if (!ereg('command resulted in',$message)) { 
+         if (strstr($message, 'command resulted in') === false) {
             set_up_language($squirrelmail_language);
             echo "<br><b><font color=$color[2]>\n";
             echo _("ERROR : Could not complete request.");
@@ -126,8 +128,8 @@
          exit;
       }
 
-      fputs ($imap_stream, "a001 LOGIN \"" . quotemeta($username) . 
-         '" "' . quotemeta($password) . "\"\r\n");
+      fputs ($imap_stream, "a001 LOGIN \"" . quoteIMAP($username) . 
+         '" "' . quoteIMAP($password) . "\"\r\n");
       $read = sqimap_read_data ($imap_stream, 'a001', false, $response, $message);
 
       /** If the connection was not successful, lets see why **/
@@ -255,8 +257,8 @@ function sqimap_get_delimiter ($imap_stream = false) {
                        */
                        fputs ($imap_stream, "a001 NAMESPACE\r\n");
                        $read = sqimap_read_data($imap_stream, 'a001', true, $a, $b);
-                       if (eregi('\* NAMESPACE +(\( *\(.+\) *\)|NIL) +(\( *\(.+\) *\)|NIL) +(\( *\(.+\) *\)|NIL)', $read[0], $data)) {
-                               if (eregi('^\( *\((.*)\) *\)', $data[1], $data2))
+                       if (eregi('\\* NAMESPACE +(\\( *\\(.+\\) *\\)|NIL) +(\\( *\\(.+\\) *\\)|NIL) +(\\( *\\(.+\\) *\\)|NIL)', $read[0], $data)) {
+                               if (eregi('^\\( *\\((.*)\\) *\\)', $data[1], $data2))
                                        $pn = $data2[1];
                                $pna = explode(')(', $pn);
                                while (list($k, $v) = each($pna))