rg=0 fixes

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3767 7612ce4b-ef26-0410-bec9-ea0150e637f0

rg=0 fixes; ReplyCitation fix, Draft save fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3766 7612ce4b-ef26-0410-bec9-ea0150e637f0

remove debug code

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3765 7612ce4b-ef26-0410-bec9-ea0150e637f0

rg=0 fix & put exit commands after the redirects

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3764 7612ce4b-ef26-0410-bec9-ea0150e637f0

fix for incorrect PHP_SELF

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3763 7612ce4b-ef26-0410-bec9-ea0150e637f0

Updated no_NO translation.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3762 7612ce4b-ef26-0410-bec9-ea0150e637f0

First param is a constant not a string

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3761 7612ce4b-ef26-0410-bec9-ea0150e637f0

Some small optimizations

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3754 7612ce4b-ef26-0410-bec9-ea0150e637f0

Writeout session data to disk before redirecting. Suggestion from Thomas.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3753 7612ce4b-ef26-0410-bec9-ea0150e637f0

Updated help files for nl_NL

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3751 7612ce4b-ef26-0410-bec9-ea0150e637f0

Make show_more_(b)cc work again with rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3748 7612ce4b-ef26-0410-bec9-ea0150e637f0

rg=0 fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3747 7612ce4b-ef26-0410-bec9-ea0150e637f0

fix parsing group related address headers.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3746 7612ce4b-ef26-0410-bec9-ea0150e637f0

Rollback previous commit... seems move complicated

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3745 7612ce4b-ef26-0410-bec9-ea0150e637f0

Missing var

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3744 7612ce4b-ef26-0410-bec9-ea0150e637f0

Do not use mixed get/post variables because this breaks some browers.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3743 7612ce4b-ef26-0410-bec9-ea0150e637f0

rg=0 fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3742 7612ce4b-ef26-0410-bec9-ea0150e637f0

2d try

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3741 7612ce4b-ef26-0410-bec9-ea0150e637f0

rg=0 fix for attachment_common_types

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3740 7612ce4b-ef26-0410-bec9-ea0150e637f0

fix for not available attachment_common_types array when rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3739 7612ce4b-ef26-0410-bec9-ea0150e637f0

rg=0 updates

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3738 7612ce4b-ef26-0410-bec9-ea0150e637f0

initialize f, replace if elseif ..  by switch statement, corrected wrong
$base_uri

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3737 7612ce4b-ef26-0410-bec9-ea0150e637f0

rg=0 d_m_n

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3735 7612ce4b-ef26-0410-bec9-ea0150e637f0

rg=0 fixes

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3734 7612ce4b-ef26-0410-bec9-ea0150e637f0

include globals.php

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3733 7612ce4b-ef26-0410-bec9-ea0150e637f0

rg=0 fixes

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3732 7612ce4b-ef26-0410-bec9-ea0150e637f0

rg=0 updates

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3731 7612ce4b-ef26-0410-bec9-ea0150e637f0

rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3730 7612ce4b-ef26-0410-bec9-ea0150e637f0

rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3729 7612ce4b-ef26-0410-bec9-ea0150e637f0

Keep on going... filters plugin rg=0 compat.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3728 7612ce4b-ef26-0410-bec9-ea0150e637f0

Calendar rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3727 7612ce4b-ef26-0410-bec9-ea0150e637f0

mail_fetch => rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3726 7612ce4b-ef26-0410-bec9-ea0150e637f0

fix warning: remove define SM_PATH because it's already defined

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3725 7612ce4b-ef26-0410-bec9-ea0150e637f0

initialize result array (unseen/total count)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3724 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix missing $username when rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3723 7612ce4b-ef26-0410-bec9-ea0150e637f0

Marcos Tadeu von Lutzow Vidal

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3721 7612ce4b-ef26-0410-bec9-ea0150e637f0

Update for session.auto_start:
If session is automatically started before the class
definitions are loaded, many functions (compose, certain
parts of read_body, download, etc.) will fail with the
following error:
The script tried to execute a method or access a
property of an incomplete object.

Still to do: ensure that we close the session using
session_write_close() as soon as the page is finished
loading session-specific variables to reduce
contention between frames.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3717 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix moving of src directory

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3716 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix SRC directory being moved on Windows systems: check whether a file was really uploaded;
if not bail out.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3715 7612ce4b-ef26-0410-bec9-ea0150e637f0

Some plugins to rg=0: bug_report message_details newmail sent_subfolders spamcop translate

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3713 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix for IMAP servers that don't always return a UIDNEXT value

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3712 7612ce4b-ef26-0410-bec9-ea0150e637f0

Removed code we don't use anymore.
Cleanup rg=0 initialized vars

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3711 7612ce4b-ef26-0410-bec9-ea0150e637f0

rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3710 7612ce4b-ef26-0410-bec9-ea0150e637f0

Keep on going... rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3709 7612ce4b-ef26-0410-bec9-ea0150e637f0

Even more rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3706 7612ce4b-ef26-0410-bec9-ea0150e637f0

More rg=0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3703 7612ce4b-ef26-0410-bec9-ea0150e637f0

Wrong include path

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3700 7612ce4b-ef26-0410-bec9-ea0150e637f0

Update function directory to rg=0.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3699 7612ce4b-ef26-0410-bec9-ea0150e637f0

Start some register_globals = off fixes:
Login, logout, and folder manipulation are now possible with rg=0. More to come.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3698 7612ce4b-ef26-0410-bec9-ea0150e637f0

Spanish Update

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3697 7612ce4b-ef26-0410-bec9-ea0150e637f0

Main po update

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3696 7612ce4b-ef26-0410-bec9-ea0150e637f0

Array index off by 1

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3695 7612ce4b-ef26-0410-bec9-ea0150e637f0

fix undefined var

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3694 7612ce4b-ef26-0410-bec9-ea0150e637f0

Hernan's email change

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3693 7612ce4b-ef26-0410-bec9-ea0150e637f0

more noselect fixes

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3692 7612ce4b-ef26-0410-bec9-ea0150e637f0

don't STATUS a mailbox that isn't selectable

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3691 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix for data_dir relative path location (also corrects relative paths for themes, attach_dir, signature_page, and org_logo). Similar fix is still required in administration plugin in order for relative paths to be completely resolved.

This change to conf.pl does not create any incompatibility with previous versions, so I did not change the level - let me know if we should.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3690 7612ce4b-ef26-0410-bec9-ea0150e637f0

Removed someone's debug message.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3689 7612ce4b-ef26-0410-bec9-ea0150e637f0

fix for forward as attachment from the messagelist

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3688 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix for forward as attachment. (Make use of composeMessage)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3687 7612ce4b-ef26-0410-bec9-ea0150e637f0

somehow url vars with &amp are not picked up by PHP

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3686 7612ce4b-ef26-0410-bec9-ea0150e637f0

redirect fixes

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3685 7612ce4b-ef26-0410-bec9-ea0150e637f0

fixed warnings

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3684 7612ce4b-ef26-0410-bec9-ea0150e637f0

XSS fix based on Jason's fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3666 7612ce4b-ef26-0410-bec9-ea0150e637f0

4) XSS in help.php:

http://<VULNERABLE
SITE>.net/webmail/src/help.php?chapter=<script>alert('boop!')</script>

Based on Jason's fix.

Also include a nasty i18n bugfix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3665 7612ce4b-ef26-0410-bec9-ea0150e637f0

Time to stop coding for tonight. Making this kind of terrible bugs is bad.
Thnx Seth Randall for noticing it.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3664 7612ce4b-ef26-0410-bec9-ea0150e637f0

uid fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3663 7612ce4b-ef26-0410-bec9-ea0150e637f0

Remove redundant spaces around the login.. this prevents prefs files like "thijs .pref" to be created.
Can't think what would be broken by this but please report/fix if so.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3657 7612ce4b-ef26-0410-bec9-ea0150e637f0

added unsave tags (commited to stable by Konstantin)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3656 7612ce4b-ef26-0410-bec9-ea0150e637f0

5) XSS in addressbook (different):

Manually entered nicks, email addresses, first names, last names, and
info sections in the addressbook are not filtered so script can be
placed and executed through them the next time the page is viewed.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3653 7612ce4b-ef26-0410-bec9-ea0150e637f0

_MAIN_ Exploit:

The XSS hole I developed the most is in addressbook.php. I was able to
inject and execute javascript code and after opening the addressbook
page there was no indication that I had changed anything (after
entering the HTML comment tags to get rid of some hanging code that my
javascript had made text).

The URL I crafted for the exploit is as follows:

http://<VULNERABLE
SITE>.net/webmail/src/addressbook.php?"><script>alert(document.cookie)</script><!--

If you execute the code without the HTML comment tag on the end it
leaves a nasty hanging bit of HTML code which is a clear indication
that something has gone awry to many users (however some may ignore it
as they don't understand it).

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3652 7612ce4b-ef26-0410-bec9-ea0150e637f0

_OTHER_ Holes:

1) This will reveal the path to PHP directory and other...maybe
interesting to someone, I didn't really care but decided to include
it. The problem is in options.php.

http://<VULNERABLE
SITE>.net/webmail/src/options.php?optpage=<script>alert('boop!')</script>

it returns the following on the page for the server I tested:

Fatal error: Failed opening required ''
(include_path='.:/php/includes:/usr/share/php') in
/var/www/squirrelmail/src/options.php on line 172

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3651 7612ce4b-ef26-0410-bec9-ea0150e637f0

Putting back SM_PATH the way it should be and eliminating chdir in the
plugins.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3649 7612ce4b-ef26-0410-bec9-ea0150e637f0

Need chdir in plugins when data_dir is relative

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3648 7612ce4b-ef26-0410-bec9-ea0150e637f0

Remove SM_PATH from prefs file path

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3647 7612ce4b-ef26-0410-bec9-ea0150e637f0

Claus Jensen & Kent B. Hansen

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3645 7612ce4b-ef26-0410-bec9-ea0150e637f0

Remove unused graphics file.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3643 7612ce4b-ef26-0410-bec9-ea0150e637f0

SM_PATH fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3642 7612ce4b-ef26-0410-bec9-ea0150e637f0

Message details seems to work without chdir now.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3641 7612ce4b-ef26-0410-bec9-ea0150e637f0

More SM_PATH changes

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3640 7612ce4b-ef26-0410-bec9-ea0150e637f0

Javascript detection no longer requires SquirrelSpell.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3639 7612ce4b-ef26-0410-bec9-ea0150e637f0

SM_PATH fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3638 7612ce4b-ef26-0410-bec9-ea0150e637f0

if I don't do a chdir('..') required files in required files failed to
include because SMPATH is defined relative.
Paul, I don't know what you have in mind with de SMPATH definition but it
doesn't work for plugins.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3637 7612ce4b-ef26-0410-bec9-ea0150e637f0

Eliminated all eveil chdir statements.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3635 7612ce4b-ef26-0410-bec9-ea0150e637f0

Some code cleanups to read_body.php

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3634 7612ce4b-ef26-0410-bec9-ea0150e637f0

Make directories unbrowsable.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3633 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix HTML-compliance here and there.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3618 7612ce4b-ef26-0410-bec9-ea0150e637f0

Do not parse Message-ID as emailaddress.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3617 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix a bunch of plugins to cope with moved load_prefs/validate files.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3616 7612ce4b-ef26-0410-bec9-ea0150e637f0

Better error messages: for some reason, the strings weren't used to report the error?
Now they are. This eliminates a subset of the "You must be logged in.." error messages by
giving the admin a clue as to what's going wrong.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3614 7612ce4b-ef26-0410-bec9-ea0150e637f0

array_key_exists() only exists in PHP 4 >= 4.1.0

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3612 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fixed some string issues.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3607 7612ce4b-ef26-0410-bec9-ea0150e637f0

Added require_once for filters.php

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3605 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fixed validate.php require

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3604 7612ce4b-ef26-0410-bec9-ea0150e637f0

Argg

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3603 7612ce4b-ef26-0410-bec9-ea0150e637f0

fix for never ending while loop

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3602 7612ce4b-ef26-0410-bec9-ea0150e637f0

SMPATH BORKED everything

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3601 7612ce4b-ef26-0410-bec9-ea0150e637f0

almost forgot: SMPATH fixes from Paul BORKED spamcop

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3600 7612ce4b-ef26-0410-bec9-ea0150e637f0

SMPATH fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3599 7612ce4b-ef26-0410-bec9-ea0150e637f0

SMPATH fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@3598 7612ce4b-ef26-0410-bec9-ea0150e637f0