X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=functions%2Fmime.php;h=8f232695cf8c902030d2fd44d52b36373c42141a;hb=ca885a4ff4cc1175af8db97bab02f7aa74ced73a;hp=e68f684fd64dce0cc16f066fada8da6b4cc3be3b;hpb=5d374bafb701b9b17d658c61dff5f269995bd8cd;p=squirrelmail.git diff --git a/functions/mime.php b/functions/mime.php index e68f684f..8f232695 100644 --- a/functions/mime.php +++ b/functions/mime.php @@ -6,7 +6,7 @@ * This contains the functions necessary to detect and decode MIME * messages. * - * @copyright © 1999-2005 The SquirrelMail Project Team + * @copyright © 1999-2006 The SquirrelMail Project Team * @license http://opensource.org/licenses/gpl-license.php GNU Public License * @version $Id$ * @package squirrelmail @@ -334,7 +334,8 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma * order that is their priority. */ global $startMessage, $languages, $squirrelmail_language, - $show_html_default, $sort, $has_unsafe_images, $passed_ent_id, $use_iframe,$iframe_height; + $show_html_default, $sort, $has_unsafe_images, $passed_ent_id, + $use_iframe, $iframe_height, $download_and_unsafe_link; // workaround for not updated config.php if (! isset($use_iframe)) $use_iframe = false; @@ -387,7 +388,7 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma * If we don't add html message between iframe tags, * we must detect unsafe images and modify $has_unsafe_images. */ - $html_body = magicHTML($body, $id, $message, $mailbox); + $html_body = magicHTML($body, $id, $message, $mailbox); // Convert character set in order to display html mails in different character set $html_body = charset_decode($body_message->header->getParameter('charset'),$html_body,false,true); @@ -429,10 +430,10 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma // old way of html rendering $body = magicHTML($body, $id, $message, $mailbox); /** - * convert character set. charset_decode does not remove html special chars + * convert character set. charset_decode does not remove html special chars * applied by magicHTML functions and does not sanitize them second time if - * fourth argument is true. - */ + * fourth argument is true. + */ $body = charset_decode($body_message->header->getParameter('charset'),$body,false,true); } } else { @@ -445,13 +446,15 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma return $body; } + $download_and_unsafe_link = ''; + $link = 'passed_id=' . $id . '&ent_id='.$ent_num. '&mailbox=' . $urlmailbox .'&sort=' . $sort . '&startMessage=' . $startMessage . '&show_more=0'; if (isset($passed_ent_id)) { $link .= '&passed_ent_id='.$passed_ent_id; } - $body .= '
' . _("Download this as a file") . ''; if ($view_unsafe_images) { $text = _("Hide Unsafe Images"); @@ -464,9 +467,8 @@ function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $ma } } if($text != '') { - $body .= ' | ' . $text . ''; + $download_and_unsafe_link .= ' | ' . $text . ''; } - $body .= '

' . "\n"; } return $body; } @@ -516,6 +518,13 @@ function formatAttachments($message, $exclude_id, $mailbox, $id) { $from_o = $rfc822_header->from; if (is_object($from_o)) { $from_name = decodeHeader($from_o->getAddress(false)); + } elseif (is_array($from_o) && count($from_o) && is_object($from_o[0])) { + // something weird happens when a digest message is opened and you return to the digest + // now the from object is part of an array. Probably the parseHeader call overwrites the info + // retrieved from the bodystructure in a different way. We need to fix this later. + // possible starting point, do not fetch header we already have and inspect how + // the rfc822_header object behaves. + $from_name = decodeHeader($from_o[0]->getAddress(false)); } else { $from_name = _("Unknown sender"); } @@ -642,7 +651,7 @@ function decodeBody($body, $encoding) { /** * quoted_printable_decode() function is broken in older * php versions. Text with \r\n decoding was fixed only - * in php 4.3.0. Minimal code requirement 4.0.4 + + * in php 4.3.0. Minimal code requirement 4.0.4 + * str_replace("\r\n", "\n", $body); call. */ $body = quoted_printable_decode($body); @@ -801,13 +810,13 @@ function decodeHeader ($string, $utfencode=true,$htmlsave=true,$decide=false) { * * Function uses XTRA_CODE _encodeheader function, if such function exists. * - * Function uses Q encoding by default and encodes a string according to RFC - * 1522 for use in headers if it contains 8-bit characters or anything that + * Function uses Q encoding by default and encodes a string according to RFC + * 1522 for use in headers if it contains 8-bit characters or anything that * looks like it should be encoded. * - * Function switches to B encoding and encodeHeaderBase64() function, if - * string is 8bit and multibyte character set supported by mbstring extension - * is used. It can cause E_USER_NOTICE errors, if interface is used with + * Function switches to B encoding and encodeHeaderBase64() function, if + * string is 8bit and multibyte character set supported by mbstring extension + * is used. It can cause E_USER_NOTICE errors, if interface is used with * multibyte character set unsupported by mbstring extension. * * @param string $string header string, that has to be encoded @@ -951,27 +960,27 @@ function encodeHeader ($string) { /** * Encodes string according to rfc2047 B encoding header formating rules * - * It is recommended way to encode headers with character sets that store + * It is recommended way to encode headers with character sets that store * symbols in more than one byte. * * Function requires mbstring support. If required mbstring functions are missing, * function returns false and sets E_USER_WARNING level error message. * - * Minimal requirements - php 4.0.6 with mbstring extension. Please note, - * that mbstring functions will generate E_WARNING errors, if unsupported + * Minimal requirements - php 4.0.6 with mbstring extension. Please note, + * that mbstring functions will generate E_WARNING errors, if unsupported * character set is used. mb_encode_mimeheader function provided by php * mbstring extension is not used in order to get better control of header * encoding. * - * Used php code functions - function_exists(), trigger_error(), strlen() - * (is used with charset names and base64 strings). Used php mbstring + * Used php code functions - function_exists(), trigger_error(), strlen() + * (is used with charset names and base64 strings). Used php mbstring * functions - mb_strlen and mb_substr. * - * Related documents: rfc 2045 (BASE64 encoding), rfc 2047 (mime header + * Related documents: rfc 2045 (BASE64 encoding), rfc 2047 (mime header * encoding), rfc 2822 (header folding) * * @param string $string header string that must be encoded - * @param string $charset character set. Must be supported by mbstring extension. + * @param string $charset character set. Must be supported by mbstring extension. * Use sq_mb_list_encodings() to detect supported charsets. * @return string string encoded according to rfc2047 B encoding formating rules * @since 1.5.1 @@ -1692,44 +1701,50 @@ function sq_fixstyle($body, $pos, $message, $id, $mailbox){ // "url(\\1$secremoveimg\\2)", $content); // remove NUL $content = str_replace("\0", "", $content); + // translate ur\l and variations (IE parses that) + $content = preg_replace("/(\\\\)?u(\\\\)?r(\\\\)?l(\\\\)?/i", 'url', $content); // NB I insert NUL characters to keep to avoid an infinite loop. They are removed after the loop. while (preg_match("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si", $content, $matches)) { $sProto = strtolower($matches[1]); switch ($sProto) { - /** - * Fix url('https*://.*) declarations but only if $view_unsafe_images - * is false. - */ - case 'https': - case 'http': - if (!$view_unsafe_images){ - $sExpr = "/url\s*\(\s*([\'\"])\s*$sProto*:.*?([\'\"])\s*\)/si"; - $content = preg_replace($sExpr, "u\0r\0l(\\1$secremoveimg\\2)", $content); - } - break; - /** - * Fix urls that refer to cid: - */ - case 'cid': - $cidurl = 'cid:'. $matches[2]; - $httpurl = sq_cid2http($message, $id, $cidurl, $mailbox); - $content = preg_replace("|url\s*\(\s*$cidurl\s*\)|si", - "u\0r\0l($httpurl)", $content); - break; - default: /** - * replace url with protocol other then the white list - * http,https and cid by an empty string. + * Fix url('https*://.*) declarations but only if $view_unsafe_images + * is false. */ - $content = preg_replace("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si", - "", $content); - break; + case 'https': + case 'http': + if (!$view_unsafe_images){ + + $sExpr = "/url\s*\(\s*[\'\"]?\s*$sProto*:.*[\'\"]?\s*\)/si"; + $content = preg_replace($sExpr, "u\0r\0l(\\1$secremoveimg\\2)", $content); + + } else { + $content = preg_replace('/url/i',"u\0r\0l",$content); + } + break; + /** + * Fix urls that refer to cid: + */ + case 'cid': + $cidurl = 'cid:'. $matches[2]; + $httpurl = sq_cid2http($message, $id, $cidurl, $mailbox); + // escape parentheses that can modify the regular expression + $cidurl = str_replace(array('(',')'),array('\\(','\\)'),$cidurl); + $content = preg_replace("|url\s*\(\s*$cidurl\s*\)|si", + "u\0r\0l($httpurl)", $content); + break; + default: + /** + * replace url with protocol other then the white list + * http,https and cid by an empty string. + */ + $content = preg_replace("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si", + "", $content); + break; } - break; } // remove NUL $content = str_replace("\0", "", $content); - /** * Remove any backslashes, entities, and extraneous whitespace. */ @@ -1741,11 +1756,12 @@ function sq_fixstyle($body, $pos, $message, $id, $mailbox){ * Fix stupid css declarations which lead to vulnerabilities * in IE. */ - $match = Array('/expression/i', + $match = Array('/\/\*.*\*\//', + '/expression/i', '/behaviou*r/i', '/binding/i', '/include-source/i'); - $replace = Array('idiocy', 'idiocy', 'idiocy', 'idiocy'); + $replace = Array('','idiocy', 'idiocy', 'idiocy', 'idiocy'); $contentNew = preg_replace($match, $replace, $contentTemp); if ($contentNew !== $contentTemp) { // insecure css declarations are used. From now on we don't care @@ -2143,22 +2159,26 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links "/^style/i" => Array( Array( + "/\/\*.*\*\//", "/expression/i", "/binding/i", "/behaviou*r/i", "/include-source/i", "/position\s*:\s*absolute/i", + "/(\\\\)?u(\\\\)?r(\\\\)?l(\\\\)?/i", "/url\s*\(\s*([\'\"])\s*\S+script\s*:.*([\'\"])\s*\)/si", "/url\s*\(\s*([\'\"])\s*mocha\s*:.*([\'\"])\s*\)/si", "/url\s*\(\s*([\'\"])\s*about\s*:.*([\'\"])\s*\)/si", "/(.*)\s*:\s*url\s*\(\s*([\'\"]*)\s*\S+script\s*:.*([\'\"]*)\s*\)/si" ), Array( + "", "idiocy", "idiocy", "idiocy", "idiocy", "", + "url", "url(\\1#\\1)", "url(\\1#\\1)", "url(\\1#\\1)", @@ -2278,18 +2298,18 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links */ function SendDownloadHeaders($type0, $type1, $filename, $force, $filesize=0) { global $languages, $squirrelmail_language; - $isIE = $isIE6 = 0; + $isIE = $isIE6plus = false; sqgetGlobalVar('HTTP_USER_AGENT', $HTTP_USER_AGENT, SQ_SERVER); if (strstr($HTTP_USER_AGENT, 'compatible; MSIE ') !== false && strstr($HTTP_USER_AGENT, 'Opera') === false) { - $isIE = 1; + $isIE = true; } - if (strstr($HTTP_USER_AGENT, 'compatible; MSIE 6') !== false && - strstr($HTTP_USER_AGENT, 'Opera') === false) { - $isIE6 = 1; + if (preg_match('/compatible; MSIE ([0-9]+)/', $HTTP_USER_AGENT, $match) && + ((int)$match[1]) >= 6 && strstr($HTTP_USER_AGENT, 'Opera') === false) { + $isIE6plus = true; } if (isset($languages[$squirrelmail_language]['XTRA_CODE']) && @@ -2346,7 +2366,7 @@ function SendDownloadHeaders($type0, $type1, $filename, $force, $filesize=0) { // "attachment"... does it apply to inline too? header ("Content-Disposition: attachment; filename=\"$filename\""); - if ($isIE && !$isIE6) { + if ($isIE && !$isIE6plus) { // This combination seems to work mostly. IE 5.5 SP 1 has // known issues (see the Microsoft Knowledge Base)