X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=src%2Fright_main.php;h=b8bf19ab492d77119bff1f4b1becccb8f68445b6;hb=8061a3fb7663a4e8edf2f415e5547fc81bcdbcb6;hp=6c1ca9b06cd8268b7aa472e343a5a96f80018ba1;hpb=5c54e435cf4a3ee9ecdaf2305205a2fbc7af4662;p=squirrelmail.git

diff --git a/src/right_main.php b/src/right_main.php
index 6c1ca9b0..b8bf19ab 100644
--- a/src/right_main.php
+++ b/src/right_main.php
@@ -8,44 +8,17 @@
     **  This is where the mailboxes are listed.  This controls most of what
     **  goes on in SquirrelMail.
     **
+    **  $Id$
     **/
 
-   if (!isset($i18n_php))
-      include("../functions/i18n.php");
+   include('../src/validate.php');
+   include('../functions/imap.php');
+   include('../functions/date.php');
+   include('../functions/array.php');
+   include('../functions/mime.php');
+   include('../functions/mailbox_display.php');
+   include('../functions/display_messages.php');
 
-   session_start();
-
-   if(!isset($logged_in)) {
-      set_up_language($squirrelmail_language, true);
-      echo _("You must login first.");
-      exit;
-   }
-   if(!isset($username) || !isset($key)) {
-      set_up_language($squirrelmail_language, true);
-      echo _("You need a valid user and password to access this page!");
-      exit;
-   }
-
-   if (!isset($config_php))
-      include("../config/config.php");
-   if (!isset($imap_php))
-      include("../functions/imap.php");
-   if (!isset($strings_php))
-      include("../functions/strings.php");
-   if (!isset($date_php))
-      include("../functions/date.php");
-   if (!isset($page_header_php))
-      include("../functions/page_header.php");
-   if (!isset($array_php))
-      include("../functions/array.php");
-   if (!isset($mime_php))
-      include("../functions/mime.php");
-   if (!isset($mailbox_display_php))
-      include("../functions/mailbox_display.php");
-   if (!isset($display_messages_php))
-      include("../functions/display_messages.php");
-?>
-<?php
    /////////////////////////////////////////////////////////////////////////////////
    //
    // incoming variables from URL:
@@ -64,26 +37,30 @@
    // open a connection on the imap port (143)
    $imapConnection = sqimap_login($username, $key, $imapServerAddress, $imapPort, 0);
 
-   /** If it was a successful login, lets load their preferences **/
-   include("../src/load_prefs.php");
-
    if (isset($newsort) && $newsort != $sort) {
-      setPref($data_dir, $username, "sort", $newsort);
+      setPref($data_dir, $username, 'sort', $newsort);
    }
 
    // If the page has been loaded without a specific mailbox,
    //   send them to the inbox
    if (!isset($mailbox)) {
-      $mailbox = "INBOX";
+      $mailbox = 'INBOX';
       $startMessage = 1;
    }
 
+   // compensate for the UW vulnerability
+   if ($imap_server_type == 'uw' && (strstr($mailbox, '../') !== false ||
+                                     substr($mailbox, 0, 1) == '/')) {
+      $mailbox = 'INBOX';
+   }
+
    sqimap_mailbox_select($imapConnection, $mailbox);
    displayPageHeader($color, $mailbox);
 
-   do_hook("right_main_after_header");
+   do_hook('right_main_after_header');
    
-   if ($just_logged_in == 1 && strlen(trim($motd)) > 0) {
+   if (isset($just_logged_in) && $just_logged_in == 1 && 
+       strlen(trim($motd)) > 0) {
       echo "<center><br>\n";
       echo "<table width=70% cellpadding=0 cellspacing=0 border=0><tr><td bgcolor=\"$color[9]\">\n";
       echo "<table width=100% cellpadding=5 cellspacing=1 border=0><tr><td bgcolor=\"$color[4]\">\n";
@@ -95,36 +72,36 @@
 
 	if (isset($newsort)) {
 		$sort = $newsort;
-		session_register("sort");
+		session_register('sort');
 	}	
 
    // Check to see if we can use cache or not.  Currently the only time when you wont use it is
    //    when a link on the left hand frame is used.  Also check to make sure we actually have the
    //    array in the registered session data.  :)
-   if ($use_mailbox_cache && session_is_registered("msgs")) {
+   if (! isset($use_mailbox_cache))
+       $use_mailbox_cache = 0;
+   if ($use_mailbox_cache && session_is_registered('msgs')) {
       showMessagesForMailbox($imapConnection, $mailbox, $numMessages, $startMessage, $sort, $color, $show_num, $use_mailbox_cache);
    } else {
-      if (session_is_registered("msgs"))
+      if (session_is_registered('msgs'))
          unset($msgs);
-      if (session_is_registered("msort"))
+      if (session_is_registered('msort'))
          unset($msort);
-		if (session_is_registered("numMessages"))
+		if (session_is_registered('numMessages'))
 			unset($numMessages);
 
    	$numMessages = sqimap_get_num_messages ($imapConnection, $mailbox);
 
       showMessagesForMailbox($imapConnection, $mailbox, $numMessages, $startMessage, $sort, $color, $show_num, $use_mailbox_cache);
       
-      if (session_is_registered("msgs") && isset($msgs))
-         session_register("msgs");
-      if (session_is_registered("msort") && isset($msort))
-         session_register("msort");
-      session_register("numMessages");
+      if (session_is_registered('msgs') && isset($msgs))
+         session_register('msgs');
+      if (session_is_registered('msort') && isset($msort))
+         session_register('msort');
+      session_register('numMessages');
    }
 
-   do_hook("right_main_bottom");
-   // close the connection
-   sqimap_mailbox_close($imapConnection);
+   do_hook('right_main_bottom');
    sqimap_logout ($imapConnection);
 ?>
 </FONT>