X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=functions%2Fpage_header.php;h=7c09c6f745de5478f8d92ee50c87a48466b36a48;hb=bb40a9c1d9766ba4212a3350fbd702af3e2d06ee;hp=ecb1aabcd880e580b98602f14dd4843a2d2ba699;hpb=c12535f66d320a6054ad7ce89f396b0841ae03fc;p=squirrelmail.git
diff --git a/functions/page_header.php b/functions/page_header.php
index ecb1aabc..7c09c6f7 100644
--- a/functions/page_header.php
+++ b/functions/page_header.php
@@ -5,7 +5,7 @@
*
* Prints the page header (duh)
*
- * @copyright © 1999-2007 The SquirrelMail Project Team
+ * @copyright 1999-2011 The SquirrelMail Project Team
* @license http://opensource.org/licenses/gpl-license.php GNU Public License
* @version $Id$
* @package squirrelmail
@@ -24,9 +24,12 @@ include_once(SM_PATH . 'functions/imap_mailbox.php');
* @param string xtra extra HTML to insert into the header
* @param bool do_hook whether to execute hooks, default true
* @param bool frames generate html frameset doctype (since 1.5.1)
+ * @param bool $browser_cache_ok When TRUE, it's OK to leave out the
+ * no-cache browser headers (OPTIONAL;
+ * default = FALSE, send no-cache headers)
* @return void
*/
-function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE, $frames = FALSE ) {
+function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE, $frames = FALSE, $browser_cache_ok=FALSE ) {
global $squirrelmail_language, $sTemplateID, $oErrorHandler, $oTemplate;
if ( !sqgetGlobalVar('base_uri', $base_uri, SQ_SESSION) ) {
@@ -36,20 +39,46 @@ function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE
$default_fontset, $chosen_fontset, $default_fontsize, $chosen_fontsize,
$chosen_theme, $chosen_theme_path, $user_themes, $user_theme_default;
- /* add no cache headers here */
+ // add no cache headers here
+ //
+ if (!$browser_cache_ok) {
//FIXME: should change all header() calls in SM core to use $oTemplate->header()!!
- $oTemplate->header('Pragma: no-cache'); // http 1.0 (rfc1945)
- $oTemplate->header('Cache-Control: private, no-cache, no-store'); // http 1.1 (rfc2616)
+ $oTemplate->header('Pragma: no-cache'); // http 1.0 (rfc1945)
+ $oTemplate->header('Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0'); // http 1.1 (rfc2616)
+ $oTemplate->header('Expires: Sat, 1 Jan 2000 00:00:00 GMT');
+//TODO: is this needed? $oTemplate->header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . 'GMT');
+ }
+ /* prevent information leakage about read emails by forbidding Firefox
+ * to do preemptive DNS requests for any links in the message body. */
+ $oTemplate->header('X-DNS-Prefetch-Control: off');
// don't show version as a security measure
//$oTemplate->header('X-Powered-By: SquirrelMail/' . SM_VERSION, FALSE);
$oTemplate->header('X-Powered-By: SquirrelMail', FALSE);
+ // prevent clickjack attempts
+// FIXME: should we use DENY instead? We can also make this a configurable value, including giving the admin the option of removing this entirely in case they WANT to be framed by an external domain
+ $oTemplate->header('X-Frame-Options: SAMEORIGIN');
+
+ // prevent clickjack attempts using JavaScript for browsers that
+ // don't support the X-Frame-Options header...
+ // we check to see if we are *not* the top page, and if not, check
+ // whether or not the top page is in the same domain as we are...
+ // if not, log out immediately -- this is an attempt to do the same
+ // thing that the X-Frame-Options does using JavaScript (never a good
+ // idea to rely on JavaScript-based solutions, though)
+//FIXME: is it a problem that we still force the clickjack protection code whether or not JavaScript is supported or desired by the user?
+ $header_tags = '\n";
+
$oTemplate->assign('frames', $frames);
$oTemplate->assign('lang', $squirrelmail_language);
- $header_tags = '';
-
$header_tags .= "\n";
$used_fontset = (!empty($chosen_fontset) ? $chosen_fontset : $default_fontset);
@@ -258,7 +287,13 @@ function displayPageHeader($color, $mailbox='', $sHeaderJs='', $sOnload = '') {
$shortBoxName = htmlspecialchars(imap_utf7_decode_local(
readShortMailboxName($mailbox, $delimiter)));
if (getPref($data_dir, $username, 'translate_special_folders')) {
- $shortBoxName = _($shortBoxName);
+ global $sent_folder, $trash_folder, $draft_folder;
+ if ($mailbox == $sent_folder)
+ $shortBoxName = _("Sent");
+ else if ($mailbox == $trash_folder)
+ $shortBoxName = _("Trash");
+ else if ($mailbox == $sent_folder)
+ $shortBoxName = _("Drafts");
}
$urlMailbox = urlencode($mailbox);
} else {