- Create a generic function to empty a folder tree, thanks to

[squirrelmail.git] / src / webmail.php

diff --git a/src/webmail.php b/src/webmail.php
index 243314e0b569777ce5a677811880839c300cd77c..70e61fcf2e67be5305964f6536a4495eb3f47881 100644 (file)
--- a/src/webmail.php
+++ b/src/webmail.php
@@ -3,7 +3,7 @@
 /**
  * webmail.php -- Displays the main frameset
  *
- * Copyright (c) 1999-2005 The SquirrelMail development team
+ * Copyright (c) 1999-2005 The SquirrelMail Project Team
  * Licensed under the GNU GPL. For full terms see the file COPYING.
  *
  * This file generates the main frameset. The files that are
@@ -41,6 +41,18 @@ sqgetGlobalVar('username', $username, SQ_SESSION);
 sqgetGlobalVar('delimiter', $delimiter, SQ_SESSION);
 sqgetGlobalVar('onetimepad', $onetimepad, SQ_SESSION);
 
+if (sqgetGlobalVar('sort', $sort)) {
+    $sort = (int) $sort;
+}
+
+if (sqgetGlobalVar('startMessage', $startMessage)) {
+    $startMessage = (int) $startMessage;
+}
+
+if (!sqgetGlobalVar('mailbox',$mailbox)) {
+    $mailbox = 'INBOX';
+}
+
 sqgetGlobalVar('right_frame', $right_frame, SQ_GET);
 
 if ( isset($_SESSION['session_expired_post']) ) {
@@ -129,13 +141,16 @@ else {
  * This was done to create a pure HTML way of refreshing the folder list since
  * we would like to use as little Javascript as possible.
  */
-if (!isset($right_frame)) {
+
+if (empty($right_frame) || (strpos(urldecode($right_frame), '://'))) {
     $right_frame = '';
 }
+
 if ($right_frame == 'right_main.php') {
     $urlMailbox = urlencode($mailbox);
-    $right_frame_url =
-        "right_main.php?mailbox=$urlMailbox&sort=$sort&startMessage=$startMessage";
+    $right_frame_url = "right_main.php?mailbox=$urlMailbox"
+                       . (!empty($sort)?"&sort=$sort":'')
+                       . (!empty($startMessage)?"&startMessage=$startMessage":'');
 } elseif ($right_frame == 'options.php') {
     $right_frame_url = 'options.php';
 } elseif ($right_frame == 'folders.php') {
@@ -145,7 +160,7 @@ if ($right_frame == 'right_main.php') {
 } else if ($right_frame == '') {
     $right_frame_url = 'right_main.php';
 } else {
-    $right_frame_url =  $right_frame;
+    $right_frame_url =  htmlspecialchars($right_frame);
 }
 
 $left_frame  = '<frame src="left_main.php" name="left" frameborder="1" title="'.
@@ -166,4 +181,4 @@ if($ret != '') {
 echo $output;
 ?>
 </frameset>
-</html>
\ No newline at end of file
+</html>