X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=functions%2Fmime.php;h=8f232695cf8c902030d2fd44d52b36373c42141a;hb=4517d1c380440e290b53a1cc2b4289ab7d731de4;hp=7e0770077444a8f68acbd587966dacdc9641d467;hpb=f270a6ebb05f310560d08f207aad52f3eeaf2e26;p=squirrelmail.git
diff --git a/functions/mime.php b/functions/mime.php
index 7e077007..8f232695 100644
--- a/functions/mime.php
+++ b/functions/mime.php
@@ -3,12 +3,11 @@
/**
* mime.php
*
- * Copyright (c) 1999-2005 The SquirrelMail Project Team
- * Licensed under the GNU GPL. For full terms see the file COPYING.
- *
* This contains the functions necessary to detect and decode MIME
* messages.
*
+ * @copyright © 1999-2006 The SquirrelMail Project Team
+ * @license http://opensource.org/licenses/gpl-license.php GNU Public License
* @version $Id$
* @package squirrelmail
*/
@@ -335,7 +334,8 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma
* order that is their priority.
*/
global $startMessage, $languages, $squirrelmail_language,
- $show_html_default, $sort, $has_unsafe_images, $passed_ent_id, $use_iframe,$iframe_height;
+ $show_html_default, $sort, $has_unsafe_images, $passed_ent_id,
+ $use_iframe, $iframe_height, $download_and_unsafe_link;
// workaround for not updated config.php
if (! isset($use_iframe)) $use_iframe = false;
@@ -388,7 +388,9 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma
* If we don't add html message between iframe tags,
* we must detect unsafe images and modify $has_unsafe_images.
*/
- $html_body = magicHTML($body, $id, $message, $mailbox);
+ $html_body = magicHTML($body, $id, $message, $mailbox);
+ // Convert character set in order to display html mails in different character set
+ $html_body = charset_decode($body_message->header->getParameter('charset'),$html_body,false,true);
// creating iframe url
$iframeurl=sqm_baseuri().'src/view_html.php?'
@@ -427,6 +429,12 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma
} else {
// old way of html rendering
$body = magicHTML($body, $id, $message, $mailbox);
+ /**
+ * convert character set. charset_decode does not remove html special chars
+ * applied by magicHTML functions and does not sanitize them second time if
+ * fourth argument is true.
+ */
+ $body = charset_decode($body_message->header->getParameter('charset'),$body,false,true);
}
} else {
translateText($body, $wrap_at,
@@ -438,13 +446,15 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma
return $body;
}
+ $download_and_unsafe_link = '';
+
$link = 'passed_id=' . $id . '&ent_id='.$ent_num.
'&mailbox=' . $urlmailbox .'&sort=' . $sort .
'&startMessage=' . $startMessage . '&show_more=0';
if (isset($passed_ent_id)) {
$link .= '&passed_ent_id='.$passed_ent_id;
}
- $body .= '
' . _("Download this as a file") . '';
if ($view_unsafe_images) {
$text = _("Hide Unsafe Images");
@@ -457,9 +467,8 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma
}
}
if($text != '') {
- $body .= ' | ' . $text . '';
+ $download_and_unsafe_link .= ' | ' . $text . '';
}
- $body .= '
' . "\n";
}
return $body;
}
@@ -509,6 +518,13 @@ function formatAttachments($message, $exclude_id, $mailbox, $id) {
$from_o = $rfc822_header->from;
if (is_object($from_o)) {
$from_name = decodeHeader($from_o->getAddress(false));
+ } elseif (is_array($from_o) && count($from_o) && is_object($from_o[0])) {
+ // something weird happens when a digest message is opened and you return to the digest
+ // now the from object is part of an array. Probably the parseHeader call overwrites the info
+ // retrieved from the bodystructure in a different way. We need to fix this later.
+ // possible starting point, do not fetch header we already have and inspect how
+ // the rfc822_header object behaves.
+ $from_name = decodeHeader($from_o[0]->getAddress(false));
} else {
$from_name = _("Unknown sender");
}
@@ -606,10 +622,18 @@ function sqimap_base64_decode(&$string) {
return $sStringRem;
}
-
-/* This function decodes the body depending on the encoding type. */
+/**
+ * Decodes encoded message body
+ *
+ * This function decodes the body depending on the encoding type.
+ * Currently quoted-printable and base64 encodings are supported.
+ * decode_body hook was added to this function in 1.4.2/1.5.0
+ * @param string $body encoded message body
+ * @param string $encoding used encoding
+ * @return string decoded string
+ * @since 1.0
+ */
function decodeBody($body, $encoding) {
- global $show_html_default;
$body = str_replace("\r\n", "\n", $body);
$encoding = strtolower($encoding);
@@ -622,15 +646,16 @@ function decodeBody($body, $encoding) {
if (!empty($encoding_handler) && function_exists($encoding_handler)) {
$body = $encoding_handler('decode', $body);
- } else if ($encoding == 'quoted-printable' ||
+ } elseif ($encoding == 'quoted-printable' ||
$encoding == 'quoted_printable') {
+ /**
+ * quoted_printable_decode() function is broken in older
+ * php versions. Text with \r\n decoding was fixed only
+ * in php 4.3.0. Minimal code requirement 4.0.4 +
+ * str_replace("\r\n", "\n", $body); call.
+ */
$body = quoted_printable_decode($body);
-
- while (ereg("=\n", $body)) {
- $body = ereg_replace ("=\n", '', $body);
- }
-
- } else if ($encoding == 'base64') {
+ } elseif ($encoding == 'base64') {
$body = base64_decode($body);
}
@@ -785,13 +810,13 @@ function decodeHeader ($string, $utfencode=true,$htmlsave=true,$decide=false) {
*
* Function uses XTRA_CODE _encodeheader function, if such function exists.
*
- * Function uses Q encoding by default and encodes a string according to RFC
- * 1522 for use in headers if it contains 8-bit characters or anything that
+ * Function uses Q encoding by default and encodes a string according to RFC
+ * 1522 for use in headers if it contains 8-bit characters or anything that
* looks like it should be encoded.
*
- * Function switches to B encoding and encodeHeaderBase64() function, if
- * string is 8bit and multibyte character set supported by mbstring extension
- * is used. It can cause E_USER_NOTICE errors, if interface is used with
+ * Function switches to B encoding and encodeHeaderBase64() function, if
+ * string is 8bit and multibyte character set supported by mbstring extension
+ * is used. It can cause E_USER_NOTICE errors, if interface is used with
* multibyte character set unsupported by mbstring extension.
*
* @param string $string header string, that has to be encoded
@@ -935,27 +960,27 @@ function encodeHeader ($string) {
/**
* Encodes string according to rfc2047 B encoding header formating rules
*
- * It is recommended way to encode headers with character sets that store
+ * It is recommended way to encode headers with character sets that store
* symbols in more than one byte.
*
* Function requires mbstring support. If required mbstring functions are missing,
* function returns false and sets E_USER_WARNING level error message.
*
- * Minimal requirements - php 4.0.6 with mbstring extension. Please note,
- * that mbstring functions will generate E_WARNING errors, if unsupported
+ * Minimal requirements - php 4.0.6 with mbstring extension. Please note,
+ * that mbstring functions will generate E_WARNING errors, if unsupported
* character set is used. mb_encode_mimeheader function provided by php
* mbstring extension is not used in order to get better control of header
* encoding.
*
- * Used php code functions - function_exists(), trigger_error(), strlen()
- * (is used with charset names and base64 strings). Used php mbstring
+ * Used php code functions - function_exists(), trigger_error(), strlen()
+ * (is used with charset names and base64 strings). Used php mbstring
* functions - mb_strlen and mb_substr.
*
- * Related documents: rfc 2045 (BASE64 encoding), rfc 2047 (mime header
+ * Related documents: rfc 2045 (BASE64 encoding), rfc 2047 (mime header
* encoding), rfc 2822 (header folding)
*
* @param string $string header string that must be encoded
- * @param string $charset character set. Must be supported by mbstring extension.
+ * @param string $charset character set. Must be supported by mbstring extension.
* Use sq_mb_list_encodings() to detect supported charsets.
* @return string string encoded according to rfc2047 B encoding formating rules
* @since 1.5.1
@@ -1676,44 +1701,50 @@ function sq_fixstyle($body, $pos, $message, $id, $mailbox){
// "url(\\1$secremoveimg\\2)", $content);
// remove NUL
$content = str_replace("\0", "", $content);
+ // translate ur\l and variations (IE parses that)
+ $content = preg_replace("/(\\\\)?u(\\\\)?r(\\\\)?l(\\\\)?/i", 'url', $content);
// NB I insert NUL characters to keep to avoid an infinite loop. They are removed after the loop.
while (preg_match("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si", $content, $matches)) {
$sProto = strtolower($matches[1]);
switch ($sProto) {
- /**
- * Fix url('https*://.*) declarations but only if $view_unsafe_images
- * is false.
- */
- case 'https':
- case 'http':
- if (!$view_unsafe_images){
- $sExpr = "/url\s*\(\s*([\'\"])\s*$sProto*:.*?([\'\"])\s*\)/si";
- $content = preg_replace($sExpr, "u\0r\0l(\\1$secremoveimg\\2)", $content);
- }
- break;
- /**
- * Fix urls that refer to cid:
- */
- case 'cid':
- $cidurl = 'cid:'. $matches[2];
- $httpurl = sq_cid2http($message, $id, $cidurl, $mailbox);
- $content = preg_replace("|url\s*\(\s*$cidurl\s*\)|si",
- "u\0r\0l($httpurl)", $content);
- break;
- default:
/**
- * replace url with protocol other then the white list
- * http,https and cid by an empty string.
+ * Fix url('https*://.*) declarations but only if $view_unsafe_images
+ * is false.
*/
- $content = preg_replace("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si",
- "", $content);
- break;
+ case 'https':
+ case 'http':
+ if (!$view_unsafe_images){
+
+ $sExpr = "/url\s*\(\s*[\'\"]?\s*$sProto*:.*[\'\"]?\s*\)/si";
+ $content = preg_replace($sExpr, "u\0r\0l(\\1$secremoveimg\\2)", $content);
+
+ } else {
+ $content = preg_replace('/url/i',"u\0r\0l",$content);
+ }
+ break;
+ /**
+ * Fix urls that refer to cid:
+ */
+ case 'cid':
+ $cidurl = 'cid:'. $matches[2];
+ $httpurl = sq_cid2http($message, $id, $cidurl, $mailbox);
+ // escape parentheses that can modify the regular expression
+ $cidurl = str_replace(array('(',')'),array('\\(','\\)'),$cidurl);
+ $content = preg_replace("|url\s*\(\s*$cidurl\s*\)|si",
+ "u\0r\0l($httpurl)", $content);
+ break;
+ default:
+ /**
+ * replace url with protocol other then the white list
+ * http,https and cid by an empty string.
+ */
+ $content = preg_replace("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si",
+ "", $content);
+ break;
}
- break;
}
// remove NUL
$content = str_replace("\0", "", $content);
-
/**
* Remove any backslashes, entities, and extraneous whitespace.
*/
@@ -1725,11 +1756,12 @@ function sq_fixstyle($body, $pos, $message, $id, $mailbox){
* Fix stupid css declarations which lead to vulnerabilities
* in IE.
*/
- $match = Array('/expression/i',
+ $match = Array('/\/\*.*\*\//',
+ '/expression/i',
'/behaviou*r/i',
'/binding/i',
'/include-source/i');
- $replace = Array('idiocy', 'idiocy', 'idiocy', 'idiocy');
+ $replace = Array('','idiocy', 'idiocy', 'idiocy', 'idiocy');
$contentNew = preg_replace($match, $replace, $contentTemp);
if ($contentNew !== $contentTemp) {
// insecure css declarations are used. From now on we don't care
@@ -2109,7 +2141,6 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links
"\\1$secremoveimg\\2",
"\\1$secremoveimg\\2",
"\\1$secremoveimg\\2",
- "\\1$secremoveimg\\2"
)
),
"/^href|action/i" =>
@@ -2120,7 +2151,6 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links
"/^([\'\"])\s*about\s*:.*([\'\"])/si"
),
Array(
- "\\1#\\1",
"\\1#\\1",
"\\1#\\1",
"\\1#\\1"
@@ -2129,24 +2159,26 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links
"/^style/i" =>
Array(
Array(
+ "/\/\*.*\*\//",
"/expression/i",
"/binding/i",
"/behaviou*r/i",
"/include-source/i",
"/position\s*:\s*absolute/i",
+ "/(\\\\)?u(\\\\)?r(\\\\)?l(\\\\)?/i",
"/url\s*\(\s*([\'\"])\s*\S+script\s*:.*([\'\"])\s*\)/si",
"/url\s*\(\s*([\'\"])\s*mocha\s*:.*([\'\"])\s*\)/si",
"/url\s*\(\s*([\'\"])\s*about\s*:.*([\'\"])\s*\)/si",
"/(.*)\s*:\s*url\s*\(\s*([\'\"]*)\s*\S+script\s*:.*([\'\"]*)\s*\)/si"
),
Array(
+ "",
"idiocy",
"idiocy",
"idiocy",
"idiocy",
"",
- "url(\\1#\\1)",
- "url(\\1#\\1)",
+ "url",
"url(\\1#\\1)",
"url(\\1#\\1)",
"url(\\1#\\1)",
@@ -2168,7 +2200,7 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links
array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[1],
"\\1$secremoveimg\\1");
array_push($bad_attvals{'/.*/'}{'/^style/i'}[0],
- '/url\(([\'\"])\s*https*:.*([\'\"])\)/si');
+ '/url\([\'\"]?https?:[^\)]*[\'\"]?\)/si');
array_push($bad_attvals{'/.*/'}{'/^style/i'}[1],
"url(\\1$secremoveimg\\1)");
}
@@ -2266,18 +2298,18 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links
*/
function SendDownloadHeaders($type0, $type1, $filename, $force, $filesize=0) {
global $languages, $squirrelmail_language;
- $isIE = $isIE6 = 0;
+ $isIE = $isIE6plus = false;
sqgetGlobalVar('HTTP_USER_AGENT', $HTTP_USER_AGENT, SQ_SERVER);
if (strstr($HTTP_USER_AGENT, 'compatible; MSIE ') !== false &&
strstr($HTTP_USER_AGENT, 'Opera') === false) {
- $isIE = 1;
+ $isIE = true;
}
- if (strstr($HTTP_USER_AGENT, 'compatible; MSIE 6') !== false &&
- strstr($HTTP_USER_AGENT, 'Opera') === false) {
- $isIE6 = 1;
+ if (preg_match('/compatible; MSIE ([0-9]+)/', $HTTP_USER_AGENT, $match) &&
+ ((int)$match[1]) >= 6 && strstr($HTTP_USER_AGENT, 'Opera') === false) {
+ $isIE6plus = true;
}
if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
@@ -2334,7 +2366,7 @@ function SendDownloadHeaders($type0, $type1, $filename, $force, $filesize=0) {
// "attachment"... does it apply to inline too?
header ("Content-Disposition: attachment; filename=\"$filename\"");
- if ($isIE && !$isIE6) {
+ if ($isIE && !$isIE6plus) {
// This combination seems to work mostly. IE 5.5 SP 1 has
// known issues (see the Microsoft Knowledge Base)