X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=functions%2Fpage_header.php;h=0c762c5629e262dc42b0bf4a85c764072a5141a1;hb=821d1f1424ce74d60ae3b6e357a148658f17424e;hp=ef84f2d20d279e4f7a457a0ed22bfdf85f81f24c;hpb=1c52ba77ca7d72fd34feeb6b338d3e60b6083f07;p=squirrelmail.git diff --git a/functions/page_header.php b/functions/page_header.php index ef84f2d2..0c762c56 100644 --- a/functions/page_header.php +++ b/functions/page_header.php @@ -3,134 +3,400 @@ /** * page_header.php * - * Copyright (c) 1999-2002 The SquirrelMail Project Team - * Licensed under the GNU GPL. For full terms see the file COPYING. - * * Prints the page header (duh) * - * $Id$ + * @copyright 1999-2012 The SquirrelMail Project Team + * @license http://opensource.org/licenses/gpl-license.php GNU Public License + * @version $Id$ + * @package squirrelmail */ -// Always set up the language before calling these functions -function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE ) { +/** Include required files from SM */ +include_once(SM_PATH . 'functions/imap_mailbox.php'); - global $theme_css, $custom_css; - - echo '' . - "\n\n\n
\n"; +/** + * Output a SquirrelMail page header, from to + * Always set up the language before calling these functions. + * + * Since 1.5.1 function sends http headers. Function should be called + * before any output is started. + * @param string title the page title, default SquirrelMail. + * @param string xtra extra HTML to insert into the header + * @param bool do_hook whether to execute hooks, default true + * @param bool frames generate html frameset doctype (since 1.5.1) + * @param bool $browser_cache_ok When TRUE, it's OK to leave out the + * no-cache browser headers (OPTIONAL; + * default = FALSE, send no-cache headers) + * @return void + */ +function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE, $frames = FALSE, $browser_cache_ok=FALSE ) { + global $squirrelmail_language, $sTemplateID, $oErrorHandler, $oTemplate; + + if ( !sqgetGlobalVar('base_uri', $base_uri, SQ_SESSION) ) { + global $base_uri; + } + global $custom_css, $pageheader_sent, $theme, $theme_default, $text_direction, + $default_fontset, $chosen_fontset, $default_fontsize, $chosen_fontsize, + $chosen_theme, $chosen_theme_path, $user_themes, $user_theme_default; + + // add no cache headers here + // + if (!$browser_cache_ok) { +//FIXME: should change all header() calls in SM core to use $oTemplate->header()!! + $oTemplate->header('Pragma: no-cache'); // http 1.0 (rfc1945) + $oTemplate->header('Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0'); // http 1.1 (rfc2616) + $oTemplate->header('Expires: Sat, 1 Jan 2000 00:00:00 GMT'); +//TODO: is this needed? $oTemplate->header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . 'GMT'); + } + /* prevent information leakage about read emails by forbidding Firefox + * to do preemptive DNS requests for any links in the message body. */ + $oTemplate->header('X-DNS-Prefetch-Control: off'); + + // don't show version as a security measure + //$oTemplate->header('X-Powered-By: SquirrelMail/' . SM_VERSION, FALSE); + $oTemplate->header('X-Powered-By: SquirrelMail', FALSE); + + // prevent clickjack attempts +// FIXME: should we use DENY instead? We can also make this a configurable value, including giving the admin the option of removing this entirely in case they WANT to be framed by an external domain + $oTemplate->header('X-Frame-Options: SAMEORIGIN'); + + // prevent clickjack attempts using JavaScript for browsers that + // don't support the X-Frame-Options header... + // we check to see if we are *not* the top page, and if not, check + // whether or not the top page is in the same domain as we are... + // if not, log out immediately -- this is an attempt to do the same + // thing that the X-Frame-Options does using JavaScript (never a good + // idea to rely on JavaScript-based solutions, though) +//FIXME: is it a problem that we still force the clickjack protection code whether or not JavaScript is supported or desired by the user? + $header_tags = '\n"; + + $oTemplate->assign('frames', $frames); + $oTemplate->assign('lang', $squirrelmail_language); + + $header_tags .= "\n"; + + $used_fontset = (!empty($chosen_fontset) ? $chosen_fontset : $default_fontset); + $used_fontsize = (!empty($chosen_fontsize) ? $chosen_fontsize : $default_fontsize); + $used_theme = !isset($chosen_theme) && $user_theme_default != 'none' && is_dir($chosen_theme) && is_readable($chosen_theme)? $user_themes[$user_theme_default]['PATH'].'/default.css' : $chosen_theme_path; - if ( !isset( $custom_css ) || $custom_css == 'none' ) { - if ($theme_css != '') { - echo "\n"; + /** + * Stylesheets are loaded in the following order: + * 1) All stylesheets provided by the template. Normally, these are + * stylsheets in templates//css/. This is accomplished by calling + * $oTemplate->fetch_standard_stylesheet_links(). + * 2) An optional user-defined stylesheet. This is set in the Display + * Preferences. + * 3) src/style.php which sets some basic font prefs. + * 4) If we are dealing with an RTL language, we load rtl.css from the + * template set. + */ + + // 1. Stylesheets from the template. + $header_tags .= $oTemplate->fetch_standard_stylesheet_links(); + + $aUserStyles = array(); + + // 2. Option user-defined stylesheet from preferences. + if (!empty($used_theme) && $used_theme != 'none') { + /** + * All styles (except "none" - ugh) just point to a directory, + * so we need to include all .css files in that directory. + */ +//FIXME: rid ourselves of "none" strings! I didn't do it here because I think the problem is that the theme itself should never be "none" (? well, what else would it be? if "none" theme is actually OK, then is there a constant to use below in stead of a hard-coded string?) + $styles = $used_theme == 'none' ? array() + : list_files($used_theme, '.css'); + foreach ($styles as $sheet) { + $aUserStyles[] = $used_theme .'/'.$sheet; } - } else { - echo "\n"; } - - if( $do_hook ) { - do_hook ("generic_header"); + + // 3. src/style.php + $aUserStyles[] = $base_uri .'src/style.php?' + . (!empty($used_fontset) ? '&fontset='.$used_fontset : '') + . (!empty($used_fontsize) ? '&fontsize='.$used_fontsize : ''); + + // 3.1. Load the stylesheets we have already + $header_tags .= $oTemplate->fetch_external_stylesheet_links($aUserStyles); + + // 4. Optional rtl.css stylesheet + if ($text_direction == 'rtl') { + $header_tags .= $oTemplate->fetch_right_to_left_stylesheet_link(); } - - echo "\n" - . ' ' . _("Current Folder") . ": $shortBoxName \n" - . " | \n" - . "\n"; - displayInternalLink ('src/signout.php', _("Sign Out"), '_top'); - echo " | \n" - . "
\n"; - $urlMailbox = urlencode($mailbox); - displayInternalLink ("src/compose.php?mailbox=$urlMailbox", _("Compose"), 'right'); - echo " \n"; - displayInternalLink ("src/addressbook.php", _("Addresses"), 'right'); - echo " \n"; - displayInternalLink ("src/folders.php", _("Folders"), 'right'); - echo " \n"; - displayInternalLink ("src/options.php", _("Options"), 'right'); - echo " \n"; - displayInternalLink ("src/search.php?mailbox=$urlMailbox", _("Search"), 'right'); - echo " \n"; - displayInternalLink ("src/help.php", _("Help"), 'right'); - echo " \n"; - - do_hook("menuline"); - - echo " | \n"; - echo ($hide_sm_attributions ? ' ' : - "SquirrelMail\n"); - echo " | \n". - "