X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=functions%2Fmime.php;h=8f232695cf8c902030d2fd44d52b36373c42141a;hb=ca885a4ff4cc1175af8db97bab02f7aa74ced73a;hp=af426110fae3fc205e2735e41dcc6001775981f2;hpb=c189a9636981d340246670a156f85de3a7bce40f;p=squirrelmail.git diff --git a/functions/mime.php b/functions/mime.php index af426110..8f232695 100644 --- a/functions/mime.php +++ b/functions/mime.php @@ -3,12 +3,11 @@ /** * mime.php * - * Copyright (c) 1999-2005 The SquirrelMail Project Team - * Licensed under the GNU GPL. For full terms see the file COPYING. - * * This contains the functions necessary to detect and decode MIME * messages. * + * @copyright © 1999-2006 The SquirrelMail Project Team + * @license http://opensource.org/licenses/gpl-license.php GNU Public License * @version $Id$ * @package squirrelmail */ @@ -335,7 +334,8 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma * order that is their priority. */ global $startMessage, $languages, $squirrelmail_language, - $show_html_default, $sort, $has_unsafe_images, $passed_ent_id, $use_iframe,$iframe_height; + $show_html_default, $sort, $has_unsafe_images, $passed_ent_id, + $use_iframe, $iframe_height, $download_and_unsafe_link; // workaround for not updated config.php if (! isset($use_iframe)) $use_iframe = false; @@ -388,7 +388,9 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma * If we don't add html message between iframe tags, * we must detect unsafe images and modify $has_unsafe_images. */ - $html_body = magicHTML($body, $id, $message, $mailbox); + $html_body = magicHTML($body, $id, $message, $mailbox); + // Convert character set in order to display html mails in different character set + $html_body = charset_decode($body_message->header->getParameter('charset'),$html_body,false,true); // creating iframe url $iframeurl=sqm_baseuri().'src/view_html.php?' @@ -427,6 +429,12 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma } else { // old way of html rendering $body = magicHTML($body, $id, $message, $mailbox); + /** + * convert character set. charset_decode does not remove html special chars + * applied by magicHTML functions and does not sanitize them second time if + * fourth argument is true. + */ + $body = charset_decode($body_message->header->getParameter('charset'),$body,false,true); } } else { translateText($body, $wrap_at, @@ -438,13 +446,15 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma return $body; } + $download_and_unsafe_link = ''; + $link = 'passed_id=' . $id . '&ent_id='.$ent_num. '&mailbox=' . $urlmailbox .'&sort=' . $sort . '&startMessage=' . $startMessage . '&show_more=0'; if (isset($passed_ent_id)) { $link .= '&passed_ent_id='.$passed_ent_id; } - $body .= '
' . _("Download this as a file") . ''; if ($view_unsafe_images) { $text = _("Hide Unsafe Images"); @@ -457,9 +467,8 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma } } if($text != '') { - $body .= ' | ' . $text . ''; + $download_and_unsafe_link .= ' | ' . $text . ''; } - $body .= '

' . "\n"; } return $body; } @@ -509,6 +518,13 @@ function formatAttachments($message, $exclude_id, $mailbox, $id) { $from_o = $rfc822_header->from; if (is_object($from_o)) { $from_name = decodeHeader($from_o->getAddress(false)); + } elseif (is_array($from_o) && count($from_o) && is_object($from_o[0])) { + // something weird happens when a digest message is opened and you return to the digest + // now the from object is part of an array. Probably the parseHeader call overwrites the info + // retrieved from the bodystructure in a different way. We need to fix this later. + // possible starting point, do not fetch header we already have and inspect how + // the rfc822_header object behaves. + $from_name = decodeHeader($from_o[0]->getAddress(false)); } else { $from_name = _("Unknown sender"); } @@ -606,10 +622,18 @@ function sqimap_base64_decode(&$string) { return $sStringRem; } - -/* This function decodes the body depending on the encoding type. */ +/** + * Decodes encoded message body + * + * This function decodes the body depending on the encoding type. + * Currently quoted-printable and base64 encodings are supported. + * decode_body hook was added to this function in 1.4.2/1.5.0 + * @param string $body encoded message body + * @param string $encoding used encoding + * @return string decoded string + * @since 1.0 + */ function decodeBody($body, $encoding) { - global $show_html_default; $body = str_replace("\r\n", "\n", $body); $encoding = strtolower($encoding); @@ -622,15 +646,16 @@ function decodeBody($body, $encoding) { if (!empty($encoding_handler) && function_exists($encoding_handler)) { $body = $encoding_handler('decode', $body); - } else if ($encoding == 'quoted-printable' || + } elseif ($encoding == 'quoted-printable' || $encoding == 'quoted_printable') { + /** + * quoted_printable_decode() function is broken in older + * php versions. Text with \r\n decoding was fixed only + * in php 4.3.0. Minimal code requirement 4.0.4 + + * str_replace("\r\n", "\n", $body); call. + */ $body = quoted_printable_decode($body); - - while (ereg("=\n", $body)) { - $body = ereg_replace ("=\n", '', $body); - } - - } else if ($encoding == 'base64') { + } elseif ($encoding == 'base64') { $body = base64_decode($body); } @@ -781,14 +806,22 @@ function decodeHeader ($string, $utfencode=true,$htmlsave=true,$decide=false) { } /** - * Encodes header as quoted-printable + * Encodes header + * + * Function uses XTRA_CODE _encodeheader function, if such function exists. * - * Encode a string according to RFC 1522 for use in headers if it - * contains 8-bit characters or anything that looks like it should - * be encoded. + * Function uses Q encoding by default and encodes a string according to RFC + * 1522 for use in headers if it contains 8-bit characters or anything that + * looks like it should be encoded. + * + * Function switches to B encoding and encodeHeaderBase64() function, if + * string is 8bit and multibyte character set supported by mbstring extension + * is used. It can cause E_USER_NOTICE errors, if interface is used with + * multibyte character set unsupported by mbstring extension. * * @param string $string header string, that has to be encoded * @return string quoted-printable encoded string + * @todo make $mb_charsets system wide constant */ function encodeHeader ($string) { global $default_charset, $languages, $squirrelmail_language; @@ -798,6 +831,19 @@ function encodeHeader ($string) { return call_user_func($languages[$squirrelmail_language]['XTRA_CODE'] . '_encodeheader', $string); } + // Use B encoding for multibyte charsets + $mb_charsets = array('utf-8','big5','gb2313','euc-kr'); + if (in_array($default_charset,$mb_charsets) && + in_array($default_charset,sq_mb_list_encodings()) && + sq_is8bit($string)) { + return encodeHeaderBase64($string,$default_charset); + } elseif (in_array($default_charset,$mb_charsets) && + sq_is8bit($string) && + ! in_array($default_charset,sq_mb_list_encodings())) { + // Add E_USER_NOTICE error here (can cause 'Cannot add header information' warning in compose.php) + // trigger_error('encodeHeader: Multibyte character set unsupported by mbstring extension.',E_USER_NOTICE); + } + // Encode only if the string contains 8-bit characters or =? $j = strlen($string); $max_l = 75 - strlen($default_charset) - 7; @@ -911,6 +957,100 @@ function encodeHeader ($string) { return $string; } +/** + * Encodes string according to rfc2047 B encoding header formating rules + * + * It is recommended way to encode headers with character sets that store + * symbols in more than one byte. + * + * Function requires mbstring support. If required mbstring functions are missing, + * function returns false and sets E_USER_WARNING level error message. + * + * Minimal requirements - php 4.0.6 with mbstring extension. Please note, + * that mbstring functions will generate E_WARNING errors, if unsupported + * character set is used. mb_encode_mimeheader function provided by php + * mbstring extension is not used in order to get better control of header + * encoding. + * + * Used php code functions - function_exists(), trigger_error(), strlen() + * (is used with charset names and base64 strings). Used php mbstring + * functions - mb_strlen and mb_substr. + * + * Related documents: rfc 2045 (BASE64 encoding), rfc 2047 (mime header + * encoding), rfc 2822 (header folding) + * + * @param string $string header string that must be encoded + * @param string $charset character set. Must be supported by mbstring extension. + * Use sq_mb_list_encodings() to detect supported charsets. + * @return string string encoded according to rfc2047 B encoding formating rules + * @since 1.5.1 + * @todo First header line can be wrapped to $iMaxLength - $HeaderFieldLength - 1 + * @todo Do we want to control max length of header? + * @todo Do we want to control EOL (end-of-line) marker? + * @todo Do we want to translate error message? + */ +function encodeHeaderBase64($string,$charset) { + /** + * Check mbstring function requirements. + */ + if (! function_exists('mb_strlen') || + ! function_exists('mb_substr')) { + // set E_USER_WARNING + trigger_error('encodeHeaderBase64: Required mbstring functions are missing.',E_USER_WARNING); + // return false + return false; + } + + // initial return array + $aRet = array(); + + /** + * header length = 75 symbols max (same as in encodeHeader) + * remove $charset length + * remove =? ? ?= (5 chars) + * remove 2 more chars (\r\n ?) + */ + $iMaxLength = 75 - strlen($charset) - 7; + + // set first character position + $iStartCharNum = 0; + + // loop through all characters. count characters and not bytes. + for ($iCharNum=1; $iCharNum<=mb_strlen($string,$charset); $iCharNum++) { + // encode string from starting character to current character. + $encoded_string = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum,$charset)); + + // Check encoded string length + if(strlen($encoded_string)>$iMaxLength) { + // if string exceeds max length, reduce number of encoded characters and add encoded string part to array + $aRet[] = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum-1,$charset)); + + // set new starting character + $iStartCharNum = $iCharNum-1; + + // encode last char (in case it is last character in string) + $encoded_string = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum,$charset)); + } // if string is shorter than max length - add next character + } + + // add last encoded string to array + $aRet[] = $encoded_string; + + // set initial return string + $sRet = ''; + + // loop through encoded strings + foreach($aRet as $string) { + // TODO: Do we want to control EOL (end-of-line) marker + if ($sRet!='') $sRet.= " "; + + // add header tags and encoded string to return string + $sRet.= '=?'.$charset.'?B?'.$string.'?='; + } + + return $sRet; +} + /* This function trys to locate the entity_id of a specific mime element */ function find_ent_id($id, $message) { for ($i = 0, $ret = ''; $ret == '' && $i < count($message->entities); $i++) { @@ -1561,44 +1701,50 @@ function sq_fixstyle($body, $pos, $message, $id, $mailbox){ // "url(\\1$secremoveimg\\2)", $content); // remove NUL $content = str_replace("\0", "", $content); + // translate ur\l and variations (IE parses that) + $content = preg_replace("/(\\\\)?u(\\\\)?r(\\\\)?l(\\\\)?/i", 'url', $content); // NB I insert NUL characters to keep to avoid an infinite loop. They are removed after the loop. while (preg_match("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si", $content, $matches)) { $sProto = strtolower($matches[1]); switch ($sProto) { - /** - * Fix url('https*://.*) declarations but only if $view_unsafe_images - * is false. - */ - case 'https': - case 'http': - if (!$view_unsafe_images){ - $sExpr = "/url\s*\(\s*([\'\"])\s*$sProto*:.*?([\'\"])\s*\)/si"; - $content = preg_replace($sExpr, "u\0r\0l(\\1$secremoveimg\\2)", $content); - } - break; - /** - * Fix urls that refer to cid: - */ - case 'cid': - $cidurl = 'cid:'. $matches[2]; - $httpurl = sq_cid2http($message, $id, $cidurl, $mailbox); - $content = preg_replace("|url\s*\(\s*$cidurl\s*\)|si", - "u\0r\0l($httpurl)", $content); - break; - default: /** - * replace url with protocol other then the white list - * http,https and cid by an empty string. + * Fix url('https*://.*) declarations but only if $view_unsafe_images + * is false. */ - $content = preg_replace("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si", - "", $content); - break; + case 'https': + case 'http': + if (!$view_unsafe_images){ + + $sExpr = "/url\s*\(\s*[\'\"]?\s*$sProto*:.*[\'\"]?\s*\)/si"; + $content = preg_replace($sExpr, "u\0r\0l(\\1$secremoveimg\\2)", $content); + + } else { + $content = preg_replace('/url/i',"u\0r\0l",$content); + } + break; + /** + * Fix urls that refer to cid: + */ + case 'cid': + $cidurl = 'cid:'. $matches[2]; + $httpurl = sq_cid2http($message, $id, $cidurl, $mailbox); + // escape parentheses that can modify the regular expression + $cidurl = str_replace(array('(',')'),array('\\(','\\)'),$cidurl); + $content = preg_replace("|url\s*\(\s*$cidurl\s*\)|si", + "u\0r\0l($httpurl)", $content); + break; + default: + /** + * replace url with protocol other then the white list + * http,https and cid by an empty string. + */ + $content = preg_replace("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si", + "", $content); + break; } - break; } // remove NUL $content = str_replace("\0", "", $content); - /** * Remove any backslashes, entities, and extraneous whitespace. */ @@ -1610,11 +1756,12 @@ function sq_fixstyle($body, $pos, $message, $id, $mailbox){ * Fix stupid css declarations which lead to vulnerabilities * in IE. */ - $match = Array('/expression/i', + $match = Array('/\/\*.*\*\//', + '/expression/i', '/behaviou*r/i', '/binding/i', '/include-source/i'); - $replace = Array('idiocy', 'idiocy', 'idiocy', 'idiocy'); + $replace = Array('','idiocy', 'idiocy', 'idiocy', 'idiocy'); $contentNew = preg_replace($match, $replace, $contentTemp); if ($contentNew !== $contentTemp) { // insecure css declarations are used. From now on we don't care @@ -1683,7 +1830,7 @@ function sq_cid2http($message, $id, $cidurl, $mailbox){ * If we couldn't generate a proper img url, drop in a blank image * instead of sending back empty, otherwise it causes unusual behaviour */ - $httpurl = $quotchar . SM_PATH . 'images/blank.png'; + $httpurl = $quotchar . SM_PATH . 'images/blank.png' . $quotchar; } return $httpurl; @@ -1994,7 +2141,6 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links "\\1$secremoveimg\\2", "\\1$secremoveimg\\2", "\\1$secremoveimg\\2", - "\\1$secremoveimg\\2" ) ), "/^href|action/i" => @@ -2005,7 +2151,6 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links "/^([\'\"])\s*about\s*:.*([\'\"])/si" ), Array( - "\\1#\\1", "\\1#\\1", "\\1#\\1", "\\1#\\1" @@ -2014,24 +2159,26 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links "/^style/i" => Array( Array( + "/\/\*.*\*\//", "/expression/i", "/binding/i", "/behaviou*r/i", "/include-source/i", "/position\s*:\s*absolute/i", + "/(\\\\)?u(\\\\)?r(\\\\)?l(\\\\)?/i", "/url\s*\(\s*([\'\"])\s*\S+script\s*:.*([\'\"])\s*\)/si", "/url\s*\(\s*([\'\"])\s*mocha\s*:.*([\'\"])\s*\)/si", "/url\s*\(\s*([\'\"])\s*about\s*:.*([\'\"])\s*\)/si", "/(.*)\s*:\s*url\s*\(\s*([\'\"]*)\s*\S+script\s*:.*([\'\"]*)\s*\)/si" ), Array( + "", "idiocy", "idiocy", "idiocy", "idiocy", "", - "url(\\1#\\1)", - "url(\\1#\\1)", + "url", "url(\\1#\\1)", "url(\\1#\\1)", "url(\\1#\\1)", @@ -2053,7 +2200,7 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[1], "\\1$secremoveimg\\1"); array_push($bad_attvals{'/.*/'}{'/^style/i'}[0], - '/url\(([\'\"])\s*https*:.*([\'\"])\)/si'); + '/url\([\'\"]?https?:[^\)]*[\'\"]?\)/si'); array_push($bad_attvals{'/.*/'}{'/^style/i'}[1], "url(\\1$secremoveimg\\1)"); } @@ -2151,18 +2298,18 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links */ function SendDownloadHeaders($type0, $type1, $filename, $force, $filesize=0) { global $languages, $squirrelmail_language; - $isIE = $isIE6 = 0; + $isIE = $isIE6plus = false; sqgetGlobalVar('HTTP_USER_AGENT', $HTTP_USER_AGENT, SQ_SERVER); if (strstr($HTTP_USER_AGENT, 'compatible; MSIE ') !== false && strstr($HTTP_USER_AGENT, 'Opera') === false) { - $isIE = 1; + $isIE = true; } - if (strstr($HTTP_USER_AGENT, 'compatible; MSIE 6') !== false && - strstr($HTTP_USER_AGENT, 'Opera') === false) { - $isIE6 = 1; + if (preg_match('/compatible; MSIE ([0-9]+)/', $HTTP_USER_AGENT, $match) && + ((int)$match[1]) >= 6 && strstr($HTTP_USER_AGENT, 'Opera') === false) { + $isIE6plus = true; } if (isset($languages[$squirrelmail_language]['XTRA_CODE']) && @@ -2219,7 +2366,7 @@ function SendDownloadHeaders($type0, $type1, $filename, $force, $filesize=0) { // "attachment"... does it apply to inline too? header ("Content-Disposition: attachment; filename=\"$filename\""); - if ($isIE && !$isIE6) { + if ($isIE && !$isIE6plus) { // This combination seems to work mostly. IE 5.5 SP 1 has // known issues (see the Microsoft Knowledge Base) @@ -2243,4 +2390,4 @@ function SendDownloadHeaders($type0, $type1, $filename, $force, $filesize=0) { } // end fn SendDownloadHeaders -?> \ No newline at end of file +?>