if (!is_object($msg)) {
include_once(SM_PATH . 'functions/display_messages.php');
global $color, $mailbox;
- displayPageHeader( $color, urldecode($mailbox) );
+ /* removed urldecode because $_GET is auto urldecoded ??? */
+ displayPageHeader( $color, $mailbox );
echo "<BODY TEXT=\"$color[8]\" BGCOLOR=\"$color[4]\" LINK=\"$color[7]\" VLINK=\"$color[7]\" ALINK=\"$color[7]\">\n\n" .
'<CENTER>';
$errormessage = _("SquirrelMail could not decode the bodystructure of the message");
/* There is some information in the content info header that could be important
* in order to parse html messages. Let's get them here.
*/
- if ($ret{0} == '<') {
- $data = sqimap_run_command ($imap_stream, "FETCH $id BODY[$ent_id.MIME]", true, $response, $message, $uid_support);
- }
+// if ($ret{0} == '<') {
+// $data = sqimap_run_command ($imap_stream, "FETCH $id BODY[$ent_id.MIME]", true, $response, $message, $uid_support);
+// }
} else if (ereg('"([^"]*)"', $topline, $regs)) {
$ret = $regs[1];
} else {
sqWordWrap($line, $wrap_at);
}
$line = charset_decode($charset, $line);
- $line = htmlspecialchars($line);
$line = str_replace("\t", ' ', $line);
parseUrl ($line);
}
}
- if ($quotes > 1) {
- if (!isset($color[14])) {
- $color[14] = '#FF0000';
- }
- $line = '<FONT COLOR="' . $color[14] . '">' . $line . '</FONT>';
- } elseif ($quotes) {
+ if ($quotes % 2) {
if (!isset($color[13])) {
$color[13] = '#800000';
}
- $line = '<FONT COLOR="' . $color[13] . '">' . $line . '</FONT>';
+ $line = '<font color="' . $color[13] . '">' . $line . '</font>';
+ } elseif ($quotes) {
+ if (!isset($color[14])) {
+ $color[14] = '#FF0000';
+ }
+ $line = '<font color="' . $color[14] . '">' . $line . '</font>';
}
$body_ary[$i] = $line;
$body = '<pre>' . implode("\n", $body_ary) . '</pre>';
}
-
/* This returns a parsed string called $body. That string can then
* be displayed as the actual message in the HTML. It contains
* everything needed, including HTML Tags, Attachments at the
*/
global $startMessage, $username, $key, $imapServerAddress, $imapPort,
$show_html_default, $sort, $has_unsafe_images, $passed_ent_id;
+ global $languages, $squirrelmail_language;
if( !sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET) ) {
$view_unsafe_images = false;
($body_message->header->type0 == 'rfc822')) {
$body = mime_fetch_body ($imap_stream, $id, $ent_num);
$body = decodeBody($body, $body_message->header->encoding);
+
+ if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
+ function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
+ if (mb_detect_encoding($body) != 'ASCII') {
+ $body = $languages[$squirrelmail_language]['XTRA_CODE']('decode', $body);
+ }
+ }
$hookResults = do_hook("message_body", $body);
$body = $hookResults[1];
$urlMailbox = urlencode($mailbox);
foreach ($att_ar as $att) {
- $ent = urldecode($att->entity_id);
+ $ent = $att->entity_id;
$header = $att->header;
$type0 = strtolower($header->type0);
$type1 = strtolower($header->type1);
if ($type0 =='message' && $type1 == 'rfc822') {
$default_page = '../src/read_body.php';
$rfc822_header = $att->rfc822_header;
- $filename = decodeHeader($rfc822_header->subject);
+ $filename = $rfc822_header->subject;
if (trim( $filename ) == '') {
$filename = 'untitled-[' . $ent . ']' ;
}
} else {
$from_name = _("Unknown sender");
}
- $from_name = decodeHeader(htmlspecialchars($from_name));
+ $from_name = decodeHeader(($from_name));
$description = $from_name;
} else {
$default_page = '../src/download.php';
if (is_object($header->disposition)) {
- $filename = decodeHeader($header->disposition->getProperty('filename'));
+ $filename = $header->disposition->getProperty('filename');
if (trim($filename) == '') {
$name = decodeHeader($header->disposition->getProperty('name'));
if (trim($name) == '') {
- $name = decodeHeader($header->getParameter('name'));
+ $name = $header->getParameter('name');
if(trim($name) == '') {
if (trim( $header->id ) == '') {
$filename = 'untitled-[' . $ent . ']' ;
}
}
} else {
- $filename = decodeHeader($header->getParameter('name'));
+ $filename = $header->getParameter('name');
if (!trim($filename)) {
if (trim( $header->id ) == '') {
$filename = 'untitled-[' . $ent . ']' ;
}
}
if ($header->description) {
- $description = htmlspecialchars($header->description);
+ $description = decodeHeader($header->description);
} else {
$description = '';
}
$defaultlink = $hookresults[6];
$attachments .= '<TR><TD>' .
- '<A HREF="'.$defaultlink.'">'.htmlspecialchars($display_filename).'</A> </TD>' .
+ '<A HREF="'.$defaultlink.'">'.decodeHeader($display_filename).'</A> </TD>' .
'<TD><SMALL><b>' . show_readable_size($header->size) .
'</b> </small></TD>' .
"<TD><SMALL>[ $type0/$type1 ] </SMALL></TD>" .
/* This function decodes the body depending on the encoding type. */
function decodeBody($body, $encoding) {
- global $languages, $squirrelmail_language;
global $show_html_default;
$body = str_replace("\r\n", "\n", $body);
$body = base64_decode($body);
}
- if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
- function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
- $body = $languages[$squirrelmail_language]['XTRA_CODE']('decode', $body);
- }
-
// All other encodings are returned raw.
return $body;
}
* RFC1522 (MIME Part Two: Message Header Extensions for Non-ASCII Text).
* Patched by Christian Schmidt <christian@ostenfeld.dk> 23/03/2002
*/
-function decodeHeader ($string, $utfencode=true) {
+function decodeHeader ($string, $utfencode=true,$htmlsave=true) {
global $languages, $squirrelmail_language;
if (is_array($string)) {
$string = implode("\n", $string);
}
-
+
if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
$string = $languages[$squirrelmail_language]['XTRA_CODE']('decodeheader', $string);
+ // Do we need to return at this point?
+ // return $string;
}
-
$i = 0;
- while (preg_match('/^(.{' . $i . '})(.*)=\?([^?]*)\?(Q|B)\?([^?]*)\?=/Ui',
- $string, $res)) {
- $prefix = $res[1];
- /* Ignore white-space between consecutive encoded-words. */
- if (strspn($res[2], " \t") != strlen($res[2])) {
- $prefix .= $res[2];
- }
-
- if (ucfirst($res[4]) == 'B') {
- $replace = base64_decode($res[5]);
- $replace = charset_decode($res[3],$replace);
-
- } else {
- $replace = str_replace('_', ' ', $res[5]);
- $replace = preg_replace('/=([0-9a-f]{2})/ie', 'chr(hexdec("\1"))',
+ $aString = explode(' ',$string);
+ foreach ($aString as $chunk) {
+ $encoded = false;
+ $aString[$i] = '';
+ while (preg_match('/^(.*)=\?([^?]*)\?(Q|B)\?([^?]*)\?=(.*)$/Ui',$chunk,$res)) {
+ $aString[$i] .= $res[1];
+ //echo "$chunk match ". $res[5] . "<br>";
+ $encoding = ucfirst($res[3]);
+ switch ($encoding)
+ {
+ case 'B':
+ $replace = base64_decode($res[4]);
+ $aString[$i] .= charset_decode($res[2],$replace);
+ break;
+ case 'Q':
+ $replace = str_replace('_', ' ', $res[4]);
+ $replace = preg_replace('/=([0-9a-f]{2})/ie', 'chr(hexdec("\1"))',
$replace);
- /* Only encode into entities by default. Some places
- * don't need the encoding, like the compose form.
- */
- if ($utfencode) {
- $replace = charset_decode($res[3], $replace);
+ /* Only encode into entities by default. Some places
+ * don't need the encoding, like the compose form.
+ */
+ if ($utfencode) {
+ $replace = charset_decode($res[2], $replace);
+ } else {
+ if ($htmlsave) {
+ $replace = htmlspecialchars($replace);
+ }
+ }
+ $aString[$i] .= $replace;
+ break;
+ default:
+ break;
}
+ $chunk = $res[5];
+ $encoded = true;
+ }
+ if (!$encoded && $htmlsave) {
+ $aString[$i] = htmlspecialchars($chunk);
+ } else {
+ $aString[$i] .= $chunk;
}
- $string = $prefix . $replace . substr($string, strlen($res[0]));
- $i = strlen($prefix) + strlen($replace);
+ ++$i;
}
- return $string;
+ return implode (' ',$aString);
+
}
/*
function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
return $languages[$squirrelmail_language]['XTRA_CODE']('encodeheader', $string);
}
+ if (strtolower($default_charset) == 'iso-8859-1') {
+ $string = str_replace("\240",' ',$string);
+ }
// Encode only if the string contains 8-bit characters or =?
$j = strlen($string);
- $l = strstr($string, '=?'); // Must be encoded ?
+ $max_l = 75 - strlen($default_charset) - 7;
+ $aRet = array();
$ret = '';
+ $iEncStart = $enc_init = false;
+ $cur_l = $iOffset = 0;
for($i = 0; $i < $j; ++$i) {
- switch($string{$i}) {
- case '=':
- $ret .= '=3D';
- break;
- case '?':
- $ret .= '=3F';
- break;
- case '_':
- $ret .= '=5F';
- break;
- case ' ':
- $ret .= '_';
- break;
- default:
- $k = ord($string{$i});
- if ($k > 126) {
- $ret .= sprintf("=%02X", $k);
- $l = TRUE;
- } else {
- $ret .= $string{$i};
+ switch($string{$i})
+ {
+ case '=':
+ case '<':
+ case '>':
+ case ',':
+ case '?':
+ case '_':
+ if ($iEncStart === false) {
+ $iEncStart = $i;
+ }
+ $cur_l+=3;
+ if ($cur_l > ($max_l-2)) {
+ $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
+ $aRet[] = "=?$default_charset?Q?$ret?=";
+ $iOffset = $i;
+ $cur_l = 0;
+ $ret = '';
+ $iEncStart = false;
+ } else {
+ $ret .= sprintf("=%02X",ord($string{$i}));
+ }
+ break;
+ case '(':
+ case ')':
+ if ($iEncStart !== false) {
+ $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
+ $aRet[] = "=?$default_charset?Q?$ret?=";
+ $iOffset = $i;
+ $cur_l = 0;
+ $ret = '';
+ $iEncStart = false;
+ }
+ break;
+ case ' ':
+ if ($iEncStart !== false) {
+ $cur_l++;
+ if ($cur_l > $max_l) {
+ $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
+ $aRet[] = "=?$default_charset?Q?$ret?=";
+ $iOffset = $i;
+ $cur_l = 0;
+ $ret = '';
+ $iEncStart = false;
+ } else {
+ $ret .= '_';
}
- break;
+ }
+ break;
+ default:
+ $k = ord($string{$i});
+ if ($k > 126) {
+ if ($iEncStart === false) {
+ $iEncStart = $i;
+ }
+ $cur_l += 3;
+ if ($cur_l > ($max_l-2)) {
+ if ($iEncStart !== false) {
+ $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
+ $aRet[] = "=?$default_charset?Q?$ret?=";
+ } else {
+ $aRet[] = substr($string,$iOffset,$i-$iOffset);
+ }
+ $cur_l = 3;
+ $ret = '';
+ $iOffset = $i;
+ }
+ $enc_init = true;
+ $ret .= sprintf("=%02X", $k);
+ } else {
+ if ($iEncStart !== false) {
+ $cur_l++;
+ if ($cur_l > $max_l) {
+ $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
+ $aRet[] = "=?$default_charset?Q?$ret?=";
+ $iEncStart = false;
+ $iOffset = $i;
+ $cur_l = 0;
+ $ret = '';
+ } else {
+ $ret .= $string{$i};
+ }
+ }
+ }
+ break;
}
}
- if ($l) {
- $string = "=?$default_charset?Q?$ret?=";
+ if ($enc_init) {
+ if ($iEncStart !== false) {
+ $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
+ $aRet[] = "=?$default_charset?Q?$ret?=";
+ } else {
+ $aRet[] = substr($string,$iOffset);
+ }
+ $string = implode('',$aRet);
}
-
return $string;
}
$content = preg_replace("|url\(([\'\"])\s*https*:.*?([\'\"])\)|si",
"url(\\1$secremoveimg\\2)", $content);
}
-
+
/**
* Fix urls that refer to cid:
*/
$rm_attnames = Array(
"/.*/" =>
Array(
- "/target/si",
- "/^on.*/si",
- "/^dynsrc/si",
- "/^data.*/si"
+ "/target/i",
+ "/^on.*/i",
+ "/^dynsrc/i",
+ "/^data.*/i",
+ "/^lowsrc.*/i"
)
);
"/^src|background/i" =>
Array(
Array(
- "|^([\'\"])\s*\.\./.*([\'\"])|si",
- "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
- "/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
- "/^([\'\"])\s*about\s*:.*([\'\"])/si"
+ "|^([\'\"])\s*\.\./.*([\'\"])|i",
+ "/^([\'\"])\s*\S+script\s*:.*([\'\"])/i",
+ "/^([\'\"])\s*mocha\s*:*.*([\'\"])/i",
+ "/^([\'\"])\s*about\s*:.*([\'\"])/i"
),
Array(
"\\1$secremoveimg\\2",
"/^href|action/i" =>
Array(
Array(
- "|^([\'\"])\s*\.\./.*([\'\"])|si",
- "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
- "/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
- "/^([\'\"])\s*about\s*:.*([\'\"])/si"
+ "|^([\'\"])\s*\.\./.*([\'\"])|i",
+ "/^([\'\"])\s*\S+script\s*:.*([\'\"])/i",
+ "/^([\'\"])\s*mocha\s*:*.*([\'\"])/i",
+ "/^([\'\"])\s*about\s*:.*([\'\"])/i"
),
Array(
"\\1#\\2",
"/expression/si",
"/binding/si",
"/behaviou*r/si",
- "|url\(([\'\"])\s*\.\./.*([\'\"])\)|si",
- "/url\(([\'\"])\s*\S+script\s*:.*([\'\"])\)/si",
- "/url\(([\'\"])\s*mocha\s*:.*([\'\"])\)/si",
- "/url\(([\'\"])\s*about\s*:.*([\'\"])\)/si"
+ "|url\(([\'\"])\s*\.\./.*([\'\"])\)|i",
+ "/url\(([\'\"])\s*\S+script\s*:.*([\'\"])\)/i",
+ "/url\(([\'\"])\s*mocha\s*:.*([\'\"])\)/i",
+ "/url\(([\'\"])\s*about\s*:.*([\'\"])\)/i"
),
Array(
"idiocy",
* to false.
*/
array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[0],
- '/^([\'\"])\s*https*:.*([\'\"])/si');
+ '/^([\'\"])\s*https*:.*([\'\"])/i');
array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[1],
"\\1$secremoveimg\\2");
- array_push($bad_attvals{'/.*/'}{'/^style/si'}[0],
+ array_push($bad_attvals{'/.*/'}{'/^style/i'}[0],
'/url\(([\'\"])\s*https*:.*([\'\"])\)/si');
- array_push($bad_attvals{'/.*/'}{'/^style/si'}[1],
+ array_push($bad_attvals{'/.*/'}{'/^style/i'}[1],
"url(\\1$secremoveimg\\2)");
}
projects / squirrelmail.git / blobdiff