Marcos Tadeu von Lutzow Vidal

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3721 7612ce4b-ef26-0410-bec9-ea0150e637f0

Update for session.auto_start:
If session is automatically started before the class
definitions are loaded, many functions (compose, certain
parts of read_body, download, etc.) will fail with the
following error:
The script tried to execute a method or access a
property of an incomplete object.

Still to do: ensure that we close the session using
session_write_close() as soon as the page is finished
loading session-specific variables to reduce
contention between frames.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3717 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix moving of src directory

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3716 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix SRC directory being moved on Windows systems: check whether a file was really uploaded;
if not bail out.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3715 7612ce4b-ef26-0410-bec9-ea0150e637f0

Some plugins to rg=0: bug_report message_details newmail sent_subfolders spamcop translate

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3713 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix for IMAP servers that don't always return a UIDNEXT value

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3712 7612ce4b-ef26-0410-bec9-ea0150e637f0

Removed code we don't use anymore.
Cleanup rg=0 initialized vars

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3711 7612ce4b-ef26-0410-bec9-ea0150e637f0

rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3710 7612ce4b-ef26-0410-bec9-ea0150e637f0

Keep on going... rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3709 7612ce4b-ef26-0410-bec9-ea0150e637f0

Even more rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3706 7612ce4b-ef26-0410-bec9-ea0150e637f0

More rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3703 7612ce4b-ef26-0410-bec9-ea0150e637f0

Wrong include path

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3700 7612ce4b-ef26-0410-bec9-ea0150e637f0

Update function directory to rg=0.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3699 7612ce4b-ef26-0410-bec9-ea0150e637f0

Start some register_globals = off fixes:
Login, logout, and folder manipulation are now possible with rg=0. More to come.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3698 7612ce4b-ef26-0410-bec9-ea0150e637f0

Spanish Update

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3697 7612ce4b-ef26-0410-bec9-ea0150e637f0

Main po update

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3696 7612ce4b-ef26-0410-bec9-ea0150e637f0

Array index off by 1

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3695 7612ce4b-ef26-0410-bec9-ea0150e637f0

fix undefined var

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3694 7612ce4b-ef26-0410-bec9-ea0150e637f0

Hernan's email change

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3693 7612ce4b-ef26-0410-bec9-ea0150e637f0

more noselect fixes

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3692 7612ce4b-ef26-0410-bec9-ea0150e637f0

don't STATUS a mailbox that isn't selectable

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3691 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix for data_dir relative path location (also corrects relative paths for themes, attach_dir, signature_page, and org_logo). Similar fix is still required in administration plugin in order for relative paths to be completely resolved.

This change to conf.pl does not create any incompatibility with previous versions, so I did not change the level - let me know if we should.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3690 7612ce4b-ef26-0410-bec9-ea0150e637f0

Removed someone's debug message.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3689 7612ce4b-ef26-0410-bec9-ea0150e637f0

fix for forward as attachment from the messagelist

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3688 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix for forward as attachment. (Make use of composeMessage)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3687 7612ce4b-ef26-0410-bec9-ea0150e637f0

somehow url vars with &amp are not picked up by PHP

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3686 7612ce4b-ef26-0410-bec9-ea0150e637f0

redirect fixes

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3685 7612ce4b-ef26-0410-bec9-ea0150e637f0

fixed warnings

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3684 7612ce4b-ef26-0410-bec9-ea0150e637f0

XSS fix based on Jason's fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3666 7612ce4b-ef26-0410-bec9-ea0150e637f0

4) XSS in help.php:

http://<VULNERABLE
SITE>.net/webmail/src/help.php?chapter=<script>alert('boop!')</script>

Based on Jason's fix.

Also include a nasty i18n bugfix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3665 7612ce4b-ef26-0410-bec9-ea0150e637f0

Time to stop coding for tonight. Making this kind of terrible bugs is bad.
Thnx Seth Randall for noticing it.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3664 7612ce4b-ef26-0410-bec9-ea0150e637f0

uid fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3663 7612ce4b-ef26-0410-bec9-ea0150e637f0

Remove redundant spaces around the login.. this prevents prefs files like "thijs .pref" to be created.
Can't think what would be broken by this but please report/fix if so.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3657 7612ce4b-ef26-0410-bec9-ea0150e637f0

added unsave tags (commited to stable by Konstantin)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3656 7612ce4b-ef26-0410-bec9-ea0150e637f0

5) XSS in addressbook (different):

Manually entered nicks, email addresses, first names, last names, and
info sections in the addressbook are not filtered so script can be
placed and executed through them the next time the page is viewed.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3653 7612ce4b-ef26-0410-bec9-ea0150e637f0

_MAIN_ Exploit:

The XSS hole I developed the most is in addressbook.php. I was able to
inject and execute javascript code and after opening the addressbook
page there was no indication that I had changed anything (after
entering the HTML comment tags to get rid of some hanging code that my
javascript had made text).

The URL I crafted for the exploit is as follows:

http://<VULNERABLE
SITE>.net/webmail/src/addressbook.php?"><script>alert(document.cookie)</script><!--

If you execute the code without the HTML comment tag on the end it
leaves a nasty hanging bit of HTML code which is a clear indication
that something has gone awry to many users (however some may ignore it
as they don't understand it).

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3652 7612ce4b-ef26-0410-bec9-ea0150e637f0

_OTHER_ Holes:

1) This will reveal the path to PHP directory and other...maybe
interesting to someone, I didn't really care but decided to include
it. The problem is in options.php.

http://<VULNERABLE
SITE>.net/webmail/src/options.php?optpage=<script>alert('boop!')</script>

it returns the following on the page for the server I tested:

Fatal error: Failed opening required ''
(include_path='.:/php/includes:/usr/share/php') in
/var/www/squirrelmail/src/options.php on line 172

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3651 7612ce4b-ef26-0410-bec9-ea0150e637f0

Putting back SM_PATH the way it should be and eliminating chdir in the
plugins.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3649 7612ce4b-ef26-0410-bec9-ea0150e637f0

Need chdir in plugins when data_dir is relative

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3648 7612ce4b-ef26-0410-bec9-ea0150e637f0

Remove SM_PATH from prefs file path

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3647 7612ce4b-ef26-0410-bec9-ea0150e637f0

Claus Jensen & Kent B. Hansen

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3645 7612ce4b-ef26-0410-bec9-ea0150e637f0

Remove unused graphics file.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3643 7612ce4b-ef26-0410-bec9-ea0150e637f0

SM_PATH fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3642 7612ce4b-ef26-0410-bec9-ea0150e637f0

Message details seems to work without chdir now.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3641 7612ce4b-ef26-0410-bec9-ea0150e637f0

More SM_PATH changes

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3640 7612ce4b-ef26-0410-bec9-ea0150e637f0

Javascript detection no longer requires SquirrelSpell.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3639 7612ce4b-ef26-0410-bec9-ea0150e637f0

SM_PATH fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3638 7612ce4b-ef26-0410-bec9-ea0150e637f0

if I don't do a chdir('..') required files in required files failed to
include because SMPATH is defined relative.
Paul, I don't know what you have in mind with de SMPATH definition but it
doesn't work for plugins.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3637 7612ce4b-ef26-0410-bec9-ea0150e637f0

Eliminated all eveil chdir statements.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3635 7612ce4b-ef26-0410-bec9-ea0150e637f0

Some code cleanups to read_body.php

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3634 7612ce4b-ef26-0410-bec9-ea0150e637f0

Make directories unbrowsable.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3633 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix HTML-compliance here and there.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3618 7612ce4b-ef26-0410-bec9-ea0150e637f0

Do not parse Message-ID as emailaddress.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3617 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix a bunch of plugins to cope with moved load_prefs/validate files.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3616 7612ce4b-ef26-0410-bec9-ea0150e637f0

Better error messages: for some reason, the strings weren't used to report the error?
Now they are. This eliminates a subset of the "You must be logged in.." error messages by
giving the admin a clue as to what's going wrong.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3614 7612ce4b-ef26-0410-bec9-ea0150e637f0

array_key_exists() only exists in PHP 4 >= 4.1.0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3612 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fixed some string issues.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3607 7612ce4b-ef26-0410-bec9-ea0150e637f0

Added require_once for filters.php

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3605 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fixed validate.php require

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3604 7612ce4b-ef26-0410-bec9-ea0150e637f0

Argg

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3603 7612ce4b-ef26-0410-bec9-ea0150e637f0

fix for never ending while loop

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3602 7612ce4b-ef26-0410-bec9-ea0150e637f0

SMPATH BORKED everything

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3601 7612ce4b-ef26-0410-bec9-ea0150e637f0

almost forgot: SMPATH fixes from Paul BORKED spamcop

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3600 7612ce4b-ef26-0410-bec9-ea0150e637f0

SMPATH fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3599 7612ce4b-ef26-0410-bec9-ea0150e637f0

SMPATH fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3598 7612ce4b-ef26-0410-bec9-ea0150e637f0

SMPATH fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3596 7612ce4b-ef26-0410-bec9-ea0150e637f0

fix for new SMPATH

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3595 7612ce4b-ef26-0410-bec9-ea0150e637f0

Masato's Fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3594 7612ce4b-ef26-0410-bec9-ea0150e637f0

Locales fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3593 7612ce4b-ef26-0410-bec9-ea0150e637f0

Masato's fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3592 7612ce4b-ef26-0410-bec9-ea0150e637f0

ahh, from is an array

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3591 7612ce4b-ef26-0410-bec9-ea0150e637f0

fix for bcc

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3590 7612ce4b-ef26-0410-bec9-ea0150e637f0

extra address checking

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3589 7612ce4b-ef26-0410-bec9-ea0150e637f0

second try to fix sendMail. Return true after finalizeStream.
Very very stupid mistake from me. Maybe I shouldn't code anymore when I'm
tired.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3588 7612ce4b-ef26-0410-bec9-ea0150e637f0

Forgot to return the stream

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3587 7612ce4b-ef26-0410-bec9-ea0150e637f0

Added fortune plugin.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3581 7612ce4b-ef26-0410-bec9-ea0150e637f0

A terrible pile of things done to the code. Did a little bit of SM_PATH
stuff in plugins.

Then I moved some files:
  src/validate.php         -> include/validate.php
  src/load_prefs.php       -> include/load_prefs.php
  src/options_personal.php -> include/options/personal.php
  src/options_display.php  -> include/options/display.php
  src/options_folder.php   -> include/options/folder.php

Basically, the concept here is that src/ should ONLY contain files that
actually get called from the web browser as a php script directly. All
of these files do not really contain functions or anything (so the
functions/ directory did not really make sense), but were more strictly
include files.

Of course, the name functions for a directory is bad organization, IMHO,
anyhow. I guess class would fall in the same category. Oh well, some of
that might get fixed someday.

So, new rule. Only put it in src/ if it gets called directly.

That was really sort of an unwritten rule before. However, since it was
never really enforced or officialized, things got sloppy.

I think I have everything fixed in the CORE with this traumatic moves. I
am sure all of the plugins will be broken. Oh well, the error messages
should be pretty loud and easy enough to fix.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3580 7612ce4b-ef26-0410-bec9-ea0150e637f0

Converted all files in functions/ to use SM_PATH. This will break all
plugins. Each callable script needs a:

  define('SM_PATH', '../../');

Or something like that put at the top.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3579 7612ce4b-ef26-0410-bec9-ea0150e637f0

More SM_PATH fixes. This time, everything in class/.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3578 7612ce4b-ef26-0410-bec9-ea0150e637f0

Part 1 of switch to use of SM_PATH with require_once.

Feel free to convert things in functions/, class/, plugins/, etc too. I
have everything in src/ done.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3577 7612ce4b-ef26-0410-bec9-ea0150e637f0

s/Deliver_SentMail/Deliver_SendMail/

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3576 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fixed require_once paths in class/deliver/deliver_FOO.class.php

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3575 7612ce4b-ef26-0410-bec9-ea0150e637f0

previous cleanup broke the find_ent_id function

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3568 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fixed stupid bug causing double lines (the same)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3567 7612ce4b-ef26-0410-bec9-ea0150e637f0

Added Message details plugin to CVS

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3566 7612ce4b-ef26-0410-bec9-ea0150e637f0

remove unnessecarry \r\n

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3565 7612ce4b-ef26-0410-bec9-ea0150e637f0

fix warning

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3564 7612ce4b-ef26-0410-bec9-ea0150e637f0

fixed warning

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3563 7612ce4b-ef26-0410-bec9-ea0150e637f0

extra error checking

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3562 7612ce4b-ef26-0410-bec9-ea0150e637f0

Make use of the deliver class

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3561 7612ce4b-ef26-0410-bec9-ea0150e637f0

"Arief S Fitrianto" <arief@gurame.fisika.ui.ac.id>
"-= M.J. Prinsen =-" <various@bovendelft.xs4all.nl>
"Tomas Kuliavas" <tokul@users.sourceforge.net>

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3560 7612ce4b-ef26-0410-bec9-ea0150e637f0

undisclosed recipients fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3559 7612ce4b-ef26-0410-bec9-ea0150e637f0

xtra check for To addresses, if not available don't show the headerline.
Fix for bcc addresses. the returned length should contain the length of the
bcc-line because we want this information in the sent_folder.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3558 7612ce4b-ef26-0410-bec9-ea0150e637f0

Added function for initializing attachments (for compose)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3547 7612ce4b-ef26-0410-bec9-ea0150e637f0

fix for getbcc

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3546 7612ce4b-ef26-0410-bec9-ea0150e637f0

added info

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3545 7612ce4b-ef26-0410-bec9-ea0150e637f0

First fixes

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3544 7612ce4b-ef26-0410-bec9-ea0150e637f0

Changed subfolder summing to only show total for subfolders for a
collapsed folder.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3543 7612ce4b-ef26-0410-bec9-ea0150e637f0

Very big update to make use of the new Deliver class.
In the future a lot of message related stuff should be moved to the
Message.class.
Probably save as draft also should be modified.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3542 7612ce4b-ef26-0410-bec9-ea0150e637f0

IMAP backend for the deliver class

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3541 7612ce4b-ef26-0410-bec9-ea0150e637f0