Fix for [ 545933 ] Cross-site scripting vulnerability.

[squirrelmail.git] / functions / mailbox_display.php

diff --git a/functions/mailbox_display.php b/functions/mailbox_display.php
index b727d456d35a35b5a1bc8e88c5e5e32ccc99bd94..566b953b427561b5543ea673a238f95c1b23523a 100644 (file)
--- a/functions/mailbox_display.php
+++ b/functions/mailbox_display.php
@@ -161,8 +161,10 @@ function printMessageInfo($imapConnection, $t, $i, $key, $mailbox, $sort,
       case 4: /* subject */
        echo "   <td bgcolor=\"$hlt_color\">$bold";
        if ($thread_sort_messages == 1) {
-         echo str_repeat("&nbsp;&nbsp;&nbsp;&nbsp;",$indent_array[$msg["ID"]]);
-       }
+      if (isset($indent_array[$msg["ID"]])) {
+           echo str_repeat("&nbsp;&nbsp;&nbsp;&nbsp;",$indent_array[$msg["ID"]]);
+         }
+    }
        echo "<a href=\"read_body.php?mailbox=$urlMailbox&amp;passed_id="
          . $msg["ID"] 
          . "&amp;startMessage=$start_msg&amp;show_more=0$search_stuff\"";
@@ -240,7 +242,7 @@ function showMessagesForMailbox($imapConnection, $mailbox, $num_msgs,
       echo '<b><small><center><font color=red>Thread sorting is not'.
              ' supported by your IMAP server.<br>Please report this'.
              'to the system administrator.</center></small></b>';
-     $thread_sort_messages == 0; 
+     $thread_sort_messages = 0; 
     $id = array();
   }
   else {
@@ -263,7 +265,7 @@ function showMessagesForMailbox($imapConnection, $mailbox, $num_msgs,
        'is not supported by your IMAP server.<br>Please report this'.
        ' to the system administrator.</center></small></b>';
     $sort = $server_sort_order;
-         $allow_server_sort = false;
+         $allow_server_sort = FALSE;
          $id = array();
        }
        else {
@@ -670,7 +672,7 @@ function mail_message_listing_beginning ($imapConnection, $moveURL,
     . "</TD>\n"
     . "   </TR>\n";
 
-/* draws thread sorting links */
+  /* draws thread sorting links */
   if ($allow_thread_sort == TRUE) {
     if ($thread_sort_messages == 1 ) {
       $set_thread = 2;
@@ -719,21 +721,21 @@ function mail_message_listing_beginning ($imapConnection, $moveURL,
       } else {
        echo '   <TD WIDTH="25%"><B>' . _("From") . '</B>';
       }
-      if ($thread_sort_messages != 1) {
+      if ($allow_thread_sort != TRUE || $thread_sort_messages != 1) {
        ShowSortButton($sort, $mailbox, 2, 3);
       }
       echo "</TD>\n";
       break;
     case 3: /* date */
       echo '   <TD NOWRAP WIDTH="5%"><B>' . _("Date") . '</B>';
-      if ($thread_sort_messages != 1) {
+      if ($allow_thread_sort != TRUE || $thread_sort_messages != 1) {
        ShowSortButton($sort, $mailbox, 0, 1);
       }
       echo "</TD>\n";
       break;
     case 4: /* subject */
       echo '   <TD><B>' . _("Subject") . '</B> ';
-      if ($thread_sort_messages != 1) {
+      if ($allow_thread_sort != TRUE || $thread_sort_messages != 1) {
        ShowSortButton($sort, $mailbox, 4, 5);
       }
       echo "</TD>\n";
@@ -814,10 +816,6 @@ function get_selectall_link($start_msg, $sort) {
        . '&amp;what=' . urlencode($what);
     }
     
-    if ($PG_SHOWNUM == 999999) {
-      $result .= '&amp;PG_SHOWNUM=999999';
-    }
-    
     $result .= "\">";
     
     if (isset($checkall) && ($checkall == '1')) {
@@ -1025,14 +1023,14 @@ function get_paginator_str($box, $start_msg, $end_msg, $num_msgs,
        }
       }
   } else if ($PG_SHOWNUM == 999999) {
-    $pg_str = "<A HREF=\"right_main.php?use_mailbox_cache=$use"
-      . "&amp;startMessage=1&amp;mailbox=$box\" TARGET=\"right\">"
-      . _("Paginate") . '</A>' . $spc;
+    $pg_str = "<A HREF=\"right_main.php?PG_SHOWALL=0"
+      . "&amp;use_mailbox_cache=$use&amp;startMessage=1&amp;mailbox=$box\" "
+      . "TARGET=\"right\">" ._("Paginate") . '</A>' . $spc;
   }
 
   /* If necessary, compute the 'show all' string. */
   if (($prv_str != '') || ($nxt_str != '')) {
-    $all_str = "<A HREF=\"right_main.php?PG_SHOWNUM=999999"
+    $all_str = "<A HREF=\"right_main.php?PG_SHOWALL=1"
       . "&amp;use_mailbox_cache=$use&amp;startMessage=1&amp;mailbox=$box\" "
       . "TARGET=\"right\">" . _("Show All") . '</A>';
   }