Improve HTML escaping

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@7269 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/plugins/filters/options.php b/plugins/filters/options.php
index 35436671a3e23ecdefe1cc5d42b744aebf6c91fc..f439ad07e0b331bd1fed78a7bef65623c5ef3f07 100644 (file)
--- a/plugins/filters/options.php
+++ b/plugins/filters/options.php
@@ -37,6 +37,7 @@ require_once(SM_PATH . 'functions/page_header.php');
 require_once(SM_PATH . 'functions/imap.php');
 require_once(SM_PATH . 'functions/imap_mailbox.php');
 require_once(SM_PATH . 'include/load_prefs.php');
+require_once(SM_PATH . 'functions/forms.php');
 require_once(SM_PATH . 'plugins/filters/filters.php');
 
 global $AllowSpamFilters;
@@ -207,7 +208,7 @@ if (sqgetGlobalVar('filter_submit',$filter_submit,SQ_POST)) {
             '</tr>'.
             '</table>'.
             '<input type="submit" name="filter_submit" value="' . _("Submit") . "\" />\n".
-            '<input type="hidden" name="theid" value="' . $theid . "\" />\n".
+            addHidden('theid', $theid).
             '</form>'.
             '</div>';
 
@@ -258,4 +259,4 @@ if (sqgetGlobalVar('filter_submit',$filter_submit,SQ_POST)) {
             ) ,
         'center', '', 'width="80%" border="0" cellpadding="2" cellspacing="0"' );
     echo '</body></html>';
-?>
\ No newline at end of file
+?>

diff --git a/plugins/fortune/setup.php b/plugins/fortune/setup.php
index d1c21bccd592fc3730105de133612dd13198f7ac..dbdc7b109853f30650bddcb04eeeae6c1e908f75 100644 (file)
--- a/plugins/fortune/setup.php
+++ b/plugins/fortune/setup.php
@@ -41,16 +41,18 @@ function fortune() {
 
     $fortune_location = '/usr/games/fortune';
     $exist = file_exists($fortune_location);
-    echo "<center><table cellpadding=0 cellspacing=0 border=0 bgcolor=$color[10]><tr><td><table width=100% cellpadding=2 cellspacing=1 border=0 bgcolor=\"$color[5]\"><tr><td align=center>";
-    echo '<TABLE><TR><TD>';
+    echo "<center><table cellpadding=\"0\" cellspacing=\"0\" border=\"0\" bgcolor=\"$color[10]\">\n".
+         "<tr><td><table width=\"100%\" cellpadding=\"2\" cellspacing=\"1\" border=\"0\" bgcolor=\"$color[5]\">\n".
+        "<tr><td align=\"center\">\n";
+    echo '<table><tr><td>';
     if (!$exist) {
         echo "$fortune_location" . _(" not found.");
     } else {
-        echo "<CENTER><FONT=3><EM>" . _("Today's Fortune") . "</EM><BR></FONT></CENTER><pre>";
-        system($fortune_location);
+        echo "<center><em>" . _("Today's Fortune") . "</em><br></font></center><pre>";
+        htmlspecialchars(system($fortune_location));
     } 
   
-    echo '</pre></TD></TR></TABLE></td></tr></table></td></tr></table></center>';
+    echo '</pre></td></tr></table></td></tr></table></td></tr></table></center>';
 }
 
 /**
@@ -91,4 +93,4 @@ function fortune_save() {
     }
 }
 
-?>
\ No newline at end of file
+?>

diff --git a/plugins/info/functions.php b/plugins/info/functions.php
index b715d933ce327dcc267ac8bfe4898ecc3a2d8fc5..412a2d894b9a5ac5e8dd880e1402d1b0559cf33f 100644 (file)
--- a/plugins/info/functions.php
+++ b/plugins/info/functions.php
@@ -31,7 +31,7 @@ function get_caps($imap_stream) {
  */
 function imap_test($imap_stream, $string) {
     global $default_charset;
-    print "<TR><TD>".$string."</TD></TR>";
+    print "<tr><td>".htmlspecialchars($string)."</td></tr>";
     $response = sqimap_run_command_list($imap_stream, trim($string),false, $responses, $message,false);
     array_push($response, $responses . ' ' .$message);
     return $response;
@@ -46,9 +46,7 @@ function print_response($response) {
             print_response($value);
         }
         else {
-            $value = preg_replace("/</", "&lt;", $value);
-            $value = preg_replace("/>/", "&gt;", $value);
-            print $value."<BR>\n";
+            print htmlspecialchars($value)."<br />\n";
         }
     }
 }

diff --git a/plugins/info/options.php b/plugins/info/options.php
index 90f34522fcef7e51f564c8700bbbd6d0f7218471..fc78d8d066040471d951d92d4731c731b77908e1 100644 (file)
--- a/plugins/info/options.php
+++ b/plugins/info/options.php
@@ -22,6 +22,7 @@ define('SM_PATH','../../');
 require_once(SM_PATH . 'include/validate.php');
 require_once(SM_PATH . 'functions/page_header.php');
 require_once(SM_PATH . 'functions/imap.php');
+require_once(SM_PATH . 'functions/forms.php');
 require_once(SM_PATH . 'plugins/info/functions.php');
 
 global $username, $color, $folder_prefix, $default_charset;
@@ -65,23 +66,29 @@ print "<CENTER><TABLE WIDTH=\"95%\" BORDER=1 BGCOLOR=".$color[3].">\n";
 print "<TR><TD BGCOLOR=".$color[4]."><B>Server Capability response:</B><BR>\n";
 
 foreach($caps_array[0] as $value) {
-    print $value;
+    print htmlspecialchars($value);
 }
 
 print "</TD></TR><TR><TD>\n";
 
 if (!isset($submit) || $submit == 'default') {
-    print "<BR><SMALL><FONT COLOR=".$color[6].">Select the IMAP commands you would like to run. Most commands require a selected mailbox so the select command is already setup. You can clear all the commands and test your own IMAP command strings. The commands are executed in order. The default values are simple IMAP commands using your default_charset and folder_prefix from Squirrelmail when needed.<BR><BR><B><CENTER>NOTE: These commands are live, any changes made will effect your current email account.</B></CENTER></FONT></SMALL><BR>\n";
+    print "<br><small><font color=".$color[6].">Select the IMAP commands you would like to run.
+        Most commands require a selected mailbox so the select command is already setup.
+        You can clear all the commands and test your own IMAP command strings. The commands are
+        executed in order. The default values are simple IMAP commands using your default_charset
+        and folder_prefix from SquirrelMail when needed.<br><br>
+        <b><center>NOTE: These commands are live, any changes made will effect your current
+        email account.</b></center></font></small><br>\n";
     if (!isset($submit)) {
         $submit = '';
     }
 }
 else {
-    print "folder_prefix = $folder_prefix<BR>\n";
-    print "default_charset = $default_charset\n";
+    print 'folder_prefix = ' . htmlspecialchars($folder_prefix)."<br />\n" .
+          'default_charset = '.htmlspecialchars($default_charset)."\n";
 }
 
-print "<BR></TD></TR></TABLE></CENTER><BR>\n";
+print "<br /></td></tr></table></center><br />\n";
 
 
 if ($submit == 'submit') {
@@ -126,13 +133,15 @@ foreach($type as $index=>$value) {
         print " CHECKED";
     }
     print "></TD><TD WIDTH=\"30%\">$index</TD><TD WIDTH=\"60%\">\n";
-    print "<INPUT TYPE=TEXT NAME=$index VALUE='$value' SIZE=60>\n"; 
+    print addInput($index, $value, 60);
 }
 
-print "</TD></TR></TABLE></CENTER><BR>\n";
-print "<CENTER><INPUT TYPE=SUBMIT NAME=submit value=submit>\n";
-print "<INPUT TYPE=SUBMIT NAME=submit value=clear>\n";
-print "<INPUT TYPE=SUBMIT NAME=submit value=default></CENTER><BR>\n";
+print "</td></tr></table></center><br>\n";
+print "<center>".
+        addSubmit('submit','submit').
+        addSubmit('clear','submit').
+        addSubmit('default','submit').
+        "</center><br>\n";
 
 $tests = array();
 

diff --git a/plugins/mail_fetch/fetch.php b/plugins/mail_fetch/fetch.php
index 39e0d1df79043996426445c265aa2468ea59c68e..0efb7bb767cd4f7ecabb62ac366b52ccd4e90aba 100644 (file)
--- a/plugins/mail_fetch/fetch.php
+++ b/plugins/mail_fetch/fetch.php
@@ -183,7 +183,7 @@ sqgetGlobalVar('delimiter',  $delimiter,  SQ_SESSION);
         Mail_Fetch_Status(_("Opening POP server"));
         $Count = $pop3->login($mailfetch_user, $mailfetch_pass);
         if (($Count == false || $Count == -1) && $pop3->ERROR != '') {
-            Mail_Fetch_Status(_("Login Failed:") . ' ' . $pop3->ERROR );
+            Mail_Fetch_Status(_("Login Failed:") . ' ' . htmlspecialchars($pop3->ERROR) );
             continue;
         }
 
@@ -290,7 +290,7 @@ sqgetGlobalVar('delimiter',  $delimiter,  SQ_SESSION);
                    if( $pop3->delete($i) ) {
                         Mail_Fetch_Status(_("Message ") . $i . _(" deleted from Remote Server!"));
                    } else {
-                        Mail_Fetch_Status(_("Delete failed:") . $pop3->ERROR );
+                        Mail_Fetch_Status(_("Delete failed:") . htmlspecialchars($pop3->ERROR) );
                    }
                 }
             } else {

diff --git a/plugins/mail_fetch/options.php b/plugins/mail_fetch/options.php
index 27b1a9403abd73c99934c84814c0df9ddb5542cc..1b91d718466196ab5b59cbbd12ea5cc71a8da03c 100644 (file)
--- a/plugins/mail_fetch/options.php
+++ b/plugins/mail_fetch/options.php
@@ -281,7 +281,7 @@ sqgetGlobalVar('submit_mailfetch', $submit_mailfetch, SQ_POST);
                     html_tag( 'td',
                         "<INPUT TYPE=\"hidden\" NAME=\"mf_sn\" VALUE=\"$mf_sn\">" .
                         '<INPUT TYPE="hidden" NAME="mf_action" VALUE="confirm_delete">' .
-                        '<br>' . _("Selected Server:") . " <b>" . htmlentities($mailfetch_server_[$mf_sn]) . "</b><br>" .
+                        '<br>' . _("Selected Server:") . " <b>" . htmlspecialchars($mailfetch_server_[$mf_sn]) . "</b><br>" .
                         _("Confirm delete of selected server?") . '<br><br>' .
                         '<input type=submit name=submit_mailfetch value="' . _("Confirm Delete") . '">' .
                         '<br></form>' ,
@@ -308,23 +308,28 @@ sqgetGlobalVar('submit_mailfetch', $submit_mailfetch, SQ_POST);
             html_tag( 'table' ) .
                 html_tag( 'tr',
                     html_tag( 'th', _("Server:"), 'right' ) .
-                    html_tag( 'td', '<input type="text" name="mf_server" value="' . htmlentities($mailfetch_server_[$mf_sn]) . '" size="40">', 'left' )
+                    html_tag( 'td', '<input type="text" name="mf_server" value="' .
+                        htmlspecialchars($mailfetch_server_[$mf_sn]) . '" size="40">', 'left' )
                 ) .
                 html_tag( 'tr',
                     html_tag( 'th', _("Port:"), 'right' ) .
-                    html_tag( 'td', '<input type="text" name="mf_port" value="' . $mailfetch_port_[$mf_sn] . '" size="40">', 'left' )
+                    html_tag( 'td', '<input type="text" name="mf_port" value="' .
+                        htmlspecialchars($mailfetch_port_[$mf_sn]) . '" size="40">', 'left' )
                 ) .
                 html_tag( 'tr',
                     html_tag( 'th', _("Alias:"), 'right' ) .
-                    html_tag( 'td', '<input type="text" name="mf_alias" value="' . htmlentities($mailfetch_alias_[$mf_sn]) . '" size="40">', 'left' )
+                    html_tag( 'td', '<input type="text" name="mf_alias" value="' .
+                        htmlspecialchars($mailfetch_alias_[$mf_sn]) . '" size="40">', 'left' )
                 ) .
                 html_tag( 'tr',
                     html_tag( 'th', _("Username:"), 'right' ) .
-                    html_tag( 'td', '<input type="text" name="mf_user" value="' . $mailfetch_user_[$mf_sn] . '" size="20">', 'left' )
+                    html_tag( 'td', '<input type="text" name="mf_user" value="' . 
+                        htmlspecialchars($mailfetch_user_[$mf_sn]) . '" size="20">', 'left' )
                 ) .
                 html_tag( 'tr',
                     html_tag( 'th', _("Password:"), 'right' ) .
-                    html_tag( 'td', '<input type="password" name="mf_pass" value="' . $mailfetch_pass_[$mf_sn] . '" size="20">', 'left' )
+                    html_tag( 'td', '<input type="password" name="mf_pass" value="' .
+                        htmlspecialchars($mailfetch_pass_[$mf_sn]) . '" size="20">', 'left' )
                 ) .
                 html_tag( 'tr' ) .
                     html_tag( 'th', _("Store in Folder:"), 'right' ) .

diff --git a/plugins/newmail/newmail_opt.php b/plugins/newmail/newmail_opt.php
index 181abb364f028b0382284a07e690edb56f9cf610..d41cb111203d2bc076e8f54791d4cdce61132f42 100644 (file)
--- a/plugins/newmail/newmail_opt.php
+++ b/plugins/newmail/newmail_opt.php
@@ -132,7 +132,8 @@ if ($allowsound == "true") {
             if ($fname == $media) {
                 echo 'selected ';
             }
-            echo 'value="' . $fname . '">' . $entry . "</option>\n";
+            echo 'value="' . htmlspecialchars($fname) . '">' .
+                htmlspecialchars($entry) . "</option>\n";
         }
     }
     $d->close();
@@ -146,7 +147,9 @@ if ($allowsound == "true") {
          '</tr>'.
          html_tag( 'tr', "\n" .
              html_tag( 'td', _("Current File:"), 'right', '', 'nowrap' ) .
-             html_tag( 'td', '<input type="hidden" value="' . $media . '" name="media_default">' . $media . '', 'left' )
+             html_tag( 'td', '<input type="hidden" value="' . 
+                 htmlspecialchars($media) . '" name="media_default">' .
+                 htmlspecialchars($media) . '', 'left' )
          ) . "\n";
     }
          echo html_tag( 'tr', "\n" .

diff --git a/plugins/newmail/setup.php b/plugins/newmail/setup.php
index 9364b9a76ef2844fd4262a7d6cf07798654d3e4d..12bd65f75679a6926ce1cdd25ec2bedee2a7375c 100644 (file)
--- a/plugins/newmail/setup.php
+++ b/plugins/newmail/setup.php
@@ -215,7 +215,8 @@
             }
 
             if ($totalNew > 0 && $newmail_enable == 'on' && $newmail_media != '' ) {
-                echo "<EMBED SRC=\"$newmail_media\" HIDDEN=TRUE AUTOSTART=TRUE>\n";
+                echo '<EMBED SRC="'.htmlspecialchars($newmail_media) .
+                    "\" HIDDEN=\"TRUE\" AUTOSTART=\"TRUE\">\n";
             }
             if ($totalNew > 0 && $newmail_popup == 'on') {
                 echo "<SCRIPT LANGUAGE=\"JavaScript\">\n".

diff --git a/plugins/newmail/testsound.php b/plugins/newmail/testsound.php
index 7fd03c7b4a236f9e8a794c06cc4a3e349d0a4997..16d53892f4df7cf5480be05de14abc5e8046d53c 100644 (file)
--- a/plugins/newmail/testsound.php
+++ b/plugins/newmail/testsound.php
@@ -37,7 +37,7 @@ if ( ! sqgetGlobalVar('sound', $sound, SQ_GET) ) {
 echo html_tag( 'table',
          html_tag( 'tr',
              html_tag( 'td',
-                    "<embed src=\"$sound\" hidden=true autostart=true>".
+                    '<embed src="'.htmlspecialchars($sound)."\" hidden=\"true\" autostart=\"true\">\n".
                     '<br>'.
                     '<b>' . _("Loading the sound...") . '</b><br>'.
                     '<form>'.

diff --git a/plugins/spamcop/spamcop.php b/plugins/spamcop/spamcop.php
index 5c97285dc238ff3e04af4b04630f3887cca6a958..2cf67cdee115d559df55d2cee119ed8054ca81aa 100644 (file)
--- a/plugins/spamcop/spamcop.php
+++ b/plugins/spamcop/spamcop.php
@@ -171,7 +171,7 @@ echo "</p>";
 ?>  <form method="post" action="<?PHP echo $form_action?>">
   <input type="hidden" name="mailbox" value="<?PHP echo htmlspecialchars($mailbox) ?>" />
   <input type="hidden" name="spamcop_is_composing" value="<?PHP echo htmlspecialchars($passed_id) ?>" />
-  <input type="hidden" name="send_to" value="<?PHP echo $report_email?>" />
+  <input type="hidden" name="send_to" value="<?PHP echo htmlspecialchars($report_email)?>" />
   <input type="hidden" name="subject" value="reply anyway" />
   <input type="hidden" name="identity" value="0" />
   <input type="hidden" name="session" value="<?PHP echo $session?>" />
@@ -198,7 +198,7 @@ echo "</p>";
    } ?>
   <input type="hidden" name="action" value="submit" />
   <input type="hidden" name="oldverbose" value="1" />
-  <input type="hidden" name="code" value="<?PHP echo $spamcop_id ?>" />
+  <input type="hidden" name="code" value="<?PHP echo htmlspecialchars($spamcop_id) ?>" />
   <input type="hidden" name="spam" value="<?PHP echo htmlspecialchars($spam_message); ?>" />
     <?php
        echo '<input type="submit" name="x1" value="' . _("Send Spam Report") . "\" />\n";