X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=functions%2Faddressbook.php;h=6e18d1b68af864cb53197c44e27e871532e83472;hb=7b0ea8602d2a437280347c0f0a46a27540e2ffcc;hp=fc3174f4fca63d52db33c817fe98e26646c592b0;hpb=91e0dccca7b2452d8b450791cae3aa4125e8889e;p=squirrelmail.git diff --git a/functions/addressbook.php b/functions/addressbook.php index fc3174f4..6e18d1b6 100644 --- a/functions/addressbook.php +++ b/functions/addressbook.php @@ -1,50 +1,49 @@ in main directory) - - If you don't want a global site-wide addressbook, comment these - two lines out. (They are disabled by default.) - - The global addressbook is unmodifiable by anyone. You must actually - use a shell script or whatnot to modify the contents. - - global $data_dir, $address_book_global_filename; - $address_book_global_filename = "$data_dir/global.abook"; + * If SM_PATH isn't defined, define it. Required to include files. + * @ignore + */ +if (!defined('SM_PATH')) { + define('SM_PATH','../'); +} -*/ +/* make sure that display_messages.php is loaded */ +include_once(SM_PATH . 'functions/display_messages.php'); global $addrbook_dsn, $addrbook_global_dsn; /** - Create and initialize an addressbook object. - Returns the created object -*/ + * Create and initialize an addressbook object. + * @param boolean $showerr display any address book init errors. html page header + * must be created before calling addressbook_init() with $showerr enabled. + * @param boolean $onlylocal enable only local address book backends + * @return object address book object. + */ function addressbook_init($showerr = true, $onlylocal = false) { - global $data_dir, $username, $ldap_server, $address_book_global_filename; + global $data_dir, $username, $color, $ldap_server, $address_book_global_filename; global $addrbook_dsn, $addrbook_table; - global $abook_global_file, $abook_global_file_writeable; + global $abook_global_file, $abook_global_file_writeable, $abook_global_file_listing; global $addrbook_global_dsn, $addrbook_global_table, $addrbook_global_writeable, $addrbook_global_listing; /* Create a new addressbook object */ $abook = new AddressBook; + /* Create empty error message */ + $abook_init_error=''; + /* Always add a local backend. We use *either* file-based *or* a database addressbook. If $addrbook_dsn is set, the database @@ -59,8 +58,7 @@ function addressbook_init($showerr = true, $onlylocal = false) { 'owner' => $username, 'table' => $addrbook_table)); if (!$r && $showerr) { - echo _("Error initializing addressbook database."); - exit; + $abook_init_error.=_("Error initializing addressbook database.") . "
\n" . $abook->error; } } else { /* File */ @@ -68,32 +66,43 @@ function addressbook_init($showerr = true, $onlylocal = false) { $r = $abook->add_backend('local_file', Array('filename' => $filename, 'create' => true)); if(!$r && $showerr) { - printf( _("Error opening file %s"), $filename ); - exit; + // no need to use $abook->error, because message explains error. + $abook_init_error.=sprintf( _("Error opening file %s"), $filename ); } - } - /* This would be for the global addressbook */ - if (isset($abook_global_file) && isset($abook_global_file_writeable) - && trim($abook_global_file)!=''){ + /* Global file based addressbook */ + if (isset($abook_global_file) && + isset($abook_global_file_writeable) && + isset($abook_global_file_listing) && + trim($abook_global_file)!=''){ + // Detect place of address book if (! preg_match("/[\/\\\]/",$abook_global_file)) { - // no path chars - $abook_global_filename=$data_dir . $abook_global_file; + /* no path chars, address book stored in data directory + * make sure that there is a slash between data directory + * and address book file name + */ + $abook_global_filename=$data_dir + . ((substr($data_dir, -1) != '/') ? '/' : '') + . $abook_global_file; } elseif (preg_match("/^\/|\w:/",$abook_global_file)) { // full path is set in options (starts with slash or x:) $abook_global_filename=$abook_global_file; } else { $abook_global_filename=SM_PATH . $abook_global_file; } + $r = $abook->add_backend('local_file',array('filename'=>$abook_global_filename, 'name' => _("Global address book"), 'detect_writeable' => false, - 'writeable'=> $abook_global_file_writeable)); + 'writeable'=> $abook_global_file_writeable, + 'listing' => $abook_global_file_listing)); + + /* global abook init error is not fatal. add error message and continue */ if (!$r && $showerr) { - echo _("Error initializing global addressbook."); - exit; + if ($abook_init_error!='') $abook_init_error.="
\n"; + $abook_init_error.=_("Error initializing global addressbook.") . "
\n" . $abook->error; } } @@ -110,35 +119,46 @@ function addressbook_init($showerr = true, $onlylocal = false) { 'writeable' => $addrbook_global_writeable, 'listing' => $addrbook_global_listing, 'table' => $addrbook_global_table)); + /* global abook init error is not fatal. add error message and continue */ + if (!$r && $showerr) { + if ($abook_init_error!='') $abook_init_error.="
\n"; + $abook_init_error.=_("Error initializing global addressbook.") . "
\n" . $abook->error; + } } /* * hook allows to include different address book backends. * plugins should extract $abook and $r from arguments * and use same add_backend commands as above functions. + * @since 1.5.1 and 1.4.5 */ $hookReturn = do_hook('abook_init', $abook, $r); $abook = $hookReturn[1]; $r = $hookReturn[2]; - if ($onlylocal) { - return $abook; - } - - /* Load configured LDAP servers (if PHP has LDAP support) */ - if (isset($ldap_server) && is_array($ldap_server) && function_exists('ldap_connect')) { - reset($ldap_server); - while (list($undef,$param) = each($ldap_server)) { - if (is_array($param)) { - $r = $abook->add_backend('ldap_server', $param); - if (!$r && $showerr) { - printf( ' ' . _("Error initializing LDAP server %s:") . - "
\n", $param['host']); - echo ' ' . $abook->error; - exit; + if (! $onlylocal) { + /* Load configured LDAP servers (if PHP has LDAP support) */ + if (isset($ldap_server) && is_array($ldap_server)) { + reset($ldap_server); + while (list($undef,$param) = each($ldap_server)) { + if (is_array($param)) { + $r = $abook->add_backend('ldap_server', $param); + if (!$r && $showerr) { + if ($abook_init_error!='') $abook_init_error.="
\n"; + $abook_init_error.=sprintf(_("Error initializing LDAP server %s:") . + "
\n", $param['host']); + $abook_init_error.= $abook->error; + } } } - } + } // end of ldap server init + } // end of remote abook backend init + + /** + * display address book init errors. + */ + if ($abook_init_error!='' && $showerr) { + error_box($abook_init_error,$color); } /* Return the initialized object */ @@ -165,12 +185,12 @@ function abook_create_form($form_url,$name,$title,$button,$defdata=array()) { 'center', $color[0] ) ) - , 'center', '', 'width="100%"' ) ."\n"; + , 'center', '', 'width="90%"' ) ."\n"; address_form($name, $button, $defdata); } -/* +/** * Had to move this function outside of the Addressbook Class * PHP 4.0.4 Seemed to be having problems with inline functions. * Note: this can return now since we don't support 4.0.4 anymore. @@ -253,28 +273,40 @@ function address_form($name, $submittext, $values = array()) { } } +/** + * Provides list of writeable backends. + * Works only when address is added ($name='addaddr') + * @param string $name name of form + * @return string html formated backend field (select or hidden) + */ function list_writable_backends($name) { global $color, $abook; if ( $name != 'addaddr' ) { return; } + $writeable_abook = 1; if ( $abook->numbackends > 1 ) { - $ret = '"; - return html_tag( 'tr', - html_tag( 'td', _("Add to:"),'right', $color[4] ) . - html_tag( 'td', $ret, 'left', $color[4] )) . "\n"; - } else { - return html_tag( 'tr', - html_tag( 'td', - addHidden('backend', '1'), - 'center', $color[4], 'colspan="2"')) . "\n"; + if (count($writeable_abooks)>1) { + // we have more than one writeable backend + $ret=addSelect('backend',$writeable_abooks,null,true); + return html_tag( 'tr', + html_tag( 'td', _("Add to:"),'right', $color[4] ) . + html_tag( 'td', $ret, 'left', $color[4] )) . "\n"; + } } + // Only one backend exists or is writeable. + return html_tag( 'tr', + html_tag( 'td', + addHidden('backend', $writeable_abook), + 'center', $color[4], 'colspan="2"')) . "\n"; } /** @@ -382,6 +414,14 @@ function show_abook_sort_button($abook_sort_order, $alt_tag, $Down, $Up ) { * @subpackage addressbook */ class AddressBook { + + /* + Cleaning errors from html with htmlspecialchars: + Errors from the backend are cleaned up in this class because we not always + have control over it when error output is generated in the backend. + If this appears to be wrong place then clean it up at the source (the backend) + */ + /** * Enabled address book backends * @var array @@ -407,6 +447,20 @@ class AddressBook { * @var string */ var $localbackendname = ''; + /** + * Controls use of 'extra' field + * + * Extra field can be used to add link to form, which allows + * to modify all fields supported by backend. This is the only field + * that is not sanitized with htmlspecialchars. Backends MUST make + * sure that field data is sanitized and displayed correctly inside + * table cell. Use of html formating in other address book fields is + * not allowed. Backends that don't return 'extra' row in address book + * data should not modify this object property. + * @var boolean + * @since 1.5.1 + */ + var $add_extra_field = false; /** * Constructor function. @@ -510,7 +564,7 @@ class AddressBook { if (is_array($res)) { $ret = array_merge($ret, $res); } else { - $this->error .= "
\n" . $backend->error; + $this->error .= "
\n" . htmlspecialchars($backend->error); $failed++; } } @@ -526,7 +580,7 @@ class AddressBook { $ret = $this->backends[$bnum]->search($expression); if (!is_array($ret)) { - $this->error .= "
\n" . $this->backends[$bnum]->error; + $this->error .= "
\n" . htmlspecialchars($this->backends[$bnum]->error); $ret = FALSE; } } @@ -567,7 +621,7 @@ class AddressBook { if (is_array($res)) { return $res; } else { - $this->error = $backend->error; + $this->error = htmlspecialchars($backend->error); return false; } } @@ -581,7 +635,7 @@ class AddressBook { if(!empty($res)) return $res; } else { - $this->error = $backend->error; + $this->error = htmlspecialchars($backend->error); return false; } } @@ -611,7 +665,7 @@ class AddressBook { if (is_array($res)) { $ret = array_merge($ret, $res); } else { - $this->error = $backend->error; + $this->error = htmlspecialchars($backend->error); return false; } } @@ -661,7 +715,7 @@ class AddressBook { if ($res) { return $bnum; } else { - $this->error = $this->backends[$bnum]->error; + $this->error = htmlspecialchars($this->backends[$bnum]->error); return false; } @@ -698,7 +752,7 @@ class AddressBook { if ($res) { return $bnum; } else { - $this->error = $this->backends[$bnum]->error; + $this->error = htmlspecialchars($this->backends[$bnum]->error); return false; } @@ -753,7 +807,7 @@ class AddressBook { if ($res) { return $bnum; } else { - $this->error = $this->backends[$bnum]->error; + $this->error = htmlspecialchars($this->backends[$bnum]->error); return false; } @@ -824,6 +878,10 @@ class addressbook_backend { /** * Search for entries in backend + * + * Working backend should support use of wildcards. * symbol + * should match one or more symbols. ? symbol should match any + * single symbol. * @param string $expression * @return bool */ @@ -844,6 +902,9 @@ class addressbook_backend { /** * List all entries in backend + * + * Working backend should provide this function or at least + * dummy function that returns empty array. * @return bool */ function list_addr() { @@ -893,8 +954,8 @@ require_once(SM_PATH . 'functions/abook_ldap_server.php'); /* Only load database backend if database is configured */ if((isset($addrbook_dsn) && !empty($addrbook_dsn)) || - (isset($addrbook_global_dsn) && !empty($addrbook_global_dsn)) ) { - include_once(SM_PATH . 'functions/abook_database.php'); + (isset($addrbook_global_dsn) && !empty($addrbook_global_dsn))) { + include_once(SM_PATH . 'functions/abook_database.php'); } /* @@ -902,6 +963,7 @@ if((isset($addrbook_dsn) && !empty($addrbook_dsn)) || * class must follow address book class coding standards. * * see addressbook_backend class and functions/abook_*.php files. + * @since 1.5.1 and 1.4.5 */ do_hook('abook_add_class');