Make sure no plugins output things before protocol header goes out

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@12269 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/functions/page_header.php b/functions/page_header.php
index 1581db79543e1f6227821327bfda80ce8b624702..530774a85aeeaaa7dfdf7a51406dbd5628c35937 100644 (file)
--- a/functions/page_header.php
+++ b/functions/page_header.php
@@ -106,10 +106,24 @@ function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE
         $header_tags .= '<meta http-equiv="Content-type" content="text/html; charset=euc-jp">' . "\n";
     }
     if ($do_hook) {
-        // NOTE! plugins here must assign output to template 
-        //       and NOT echo anything directly!!
+        // NOTE! plugins here MUST assign output to template 
+        //       and NOT echo anything directly!!  A common
+        //       approach is if a plugin decides it needs to
+        //       put something at page-top after the standard
+        //       SM page header, to dynamically add itself to
+        //       the page_header_bottom and/or compose_header_bottom
+        //       hooks for the current page request.  See 
+        //       the Sent Confirmation v1.7 or Restrict Senders v1.2
+        //       plugins for examples of this approach.
         global $null;
+        ob_start();
         do_hook('generic_header', $null);
+        $output = ob_get_contents();
+        ob_end_clean();
+        // plugin authors can debug their errors with one of the following:
+        //sm_print_r($output);
+        //echo $output;
+        if (!empty($output)) trigger_error('A plugin on the "generic_header" hook has attempted to output directly to the browser', E_USER_ERROR);
     }
 
     $header_tags .= $xtra;
@@ -316,6 +330,8 @@ function compose_Header($color, $mailbox, $sHeaderJs='', $sOnload = '') {
     $aAttribs = array('text' => $color[8], 'bgcolor' => $color[4],
                       'link' => $color[7], 'vlink' => $color[7],
                       'alink' => $color[7]);
+
+    // this is template-safe (see create_body() function)
     echo create_body($sOnload, $class, $aAttribs);
 
     global $null;