X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=functions%2Fmime.php;h=ca7f836c0affe9722c52f5b89ecc92b61eea8892;hb=969c1e9fcec1fb8c0e67004dc5f22aee9cc4d003;hp=f253bab241bac10771c936d2f95e0ef16637e2ed;hpb=a540f994f3478529b1dc2ac78535cae774ba5af0;p=squirrelmail.git diff --git a/functions/mime.php b/functions/mime.php index f253bab2..ca7f836c 100644 --- a/functions/mime.php +++ b/functions/mime.php @@ -181,7 +181,7 @@ function mime_fetch_body($imap_stream, $id, $ent_id=1, $fetch_size=0) { return $ret; } -function mime_print_body_lines ($imap_stream, $id, $ent_id=1, $encoding, $rStream='php://stdout') { +function mime_print_body_lines ($imap_stream, $id, $ent_id=1, $encoding, $rStream='php://stdout', $force_crlf='') { /* Don't kill the connection if the browser is over a dialup * and it would take over 30 seconds to download it. @@ -203,9 +203,9 @@ function mime_print_body_lines ($imap_stream, $id, $ent_id=1, $encoding, $rStrea } else { $body = mime_fetch_body ($imap_stream, $id, $ent_id); if (is_resource($rStream)) { - fputs($rStream,decodeBody($body,$encoding)); + fputs($rStream,decodeBody($body, $encoding, $force_crlf)); } else { - echo decodeBody($body, $encoding); + echo decodeBody($body, $encoding, $force_crlf); } } @@ -291,7 +291,8 @@ function translateText(&$body, $wrap_at, $charset) { $body_ary = explode("\n", $body); for ($i=0; $i < count($body_ary); $i++) { - $line = $body_ary[$i]; + $line = rtrim($body_ary[$i],"\r"); + if (strlen($line) - 2 >= $wrap_at) { sqWordWrap($line, $wrap_at, $charset); } @@ -688,44 +689,79 @@ function sqimap_base64_decode(&$string) { } /** - * Decodes encoded message body + * Decodes encoded string (usually message body) + * + * This function decodes a string (usually the message body) + * depending on the encoding type. Currently quoted-printable + * and base64 encodings are supported. + * + * The decode_body hook was added to this function in 1.4.2/1.5.0. + * The $force_crlf parameter was added in 1.5.2. + * + * @param string $string The encoded string + * @param string $encoding used encoding + * @param string $force_crlf Whether or not to force CRLF or LF + * line endings (or to leave as is). + * If given as "LF", line endings will + * all be converted to LF; if "CRLF", + * line endings will all be converted + * to CRLF. If given as an empty value, + * the global $default_force_crlf will + * be consulted (it can be specified in + * config/config_local.php). Otherwise, + * any other value will cause the string + * to be left alone. Note that this will + * be overridden to "LF" if not using at + * least PHP version 4.3.0. (OPTIONAL; + * default is empty - consult global + * default value) + * + * @return string The decoded string * - * This function decodes the body depending on the encoding type. - * Currently quoted-printable and base64 encodings are supported. - * decode_body hook was added to this function in 1.4.2/1.5.0 - * @param string $body encoded message body - * @param string $encoding used encoding - * @return string decoded string * @since 1.0 + * */ -function decodeBody($body, $encoding) { +function decodeBody($string, $encoding, $force_crlf='') { + + global $force_crlf_default; + if (empty($force_crlf)) $force_crlf = $force_crlf_default; + $force_crlf = strtoupper($force_crlf); + + // must force line endings to LF due to broken + // quoted_printable_decode() in PHP versions + // before 4.3.0 (see below) + // + if (!check_php_version(4, 3, 0) || $force_crlf == 'LF') + $string = str_replace("\r\n", "\n", $string); + else if ($force_crlf == 'CRLF') + $string = str_replace("\n", "\r\n", $string); - $body = str_replace("\r\n", "\n", $body); $encoding = strtolower($encoding); $encoding_handler = do_hook('decode_body', $encoding); - // plugins get first shot at decoding the body + // plugins get first shot at decoding the string // if (!empty($encoding_handler) && function_exists($encoding_handler)) { - $body = $encoding_handler('decode', $body); + $string = $encoding_handler('decode', $string); } elseif ($encoding == 'quoted-printable' || $encoding == 'quoted_printable') { - /** - * quoted_printable_decode() function is broken in older - * php versions. Text with \r\n decoding was fixed only - * in php 4.3.0. Minimal code requirement 4.0.4 + - * str_replace("\r\n", "\n", $body); call. - */ - $body = quoted_printable_decode($body); + + // quoted_printable_decode() function is broken in older + // php versions. Text with \r\n decoding was fixed only + // in php 4.3.0. Minimal code requirement is PHP 4.0.4+ + // and the above call to: str_replace("\r\n", "\n", $string); + // + $string = quoted_printable_decode($string); + } elseif ($encoding == 'base64') { - $body = base64_decode($body); + $string = base64_decode($string); } // All other encodings are returned raw. - return $body; + return $string; } /** @@ -1880,15 +1916,72 @@ function sq_fix_url($attname, &$attvalue, $message, $id, $mailbox,$sQuote = '"') $attvalue = $sQuote . $secremoveimg . $sQuote; } else { if (isset($aUrl['path'])) { + + // No one has been able to show that image URIs + // can be exploited, so for now, no restrictions + // are made at all. If this proves to be a problem, + // the commented-out code below can be of help. + // (One consideration is that I see nothing in this + // function that specifically says that we will + // only ever arrive here when inspecting an image + // tag, although that does seem to be the end + // result - e.g.,