Stop using curly braces
[squirrelmail.git] / functions / mime.php
CommitLineData
59177427 1<?php
2ba13803 2
35586184 3/**
8bd0068d 4 * mime.php
5 *
8bd0068d 6 * This contains the functions necessary to detect and decode MIME
7 * messages.
8 *
c997cbe6 9 * @copyright 1999-2021 The SquirrelMail Project Team
4b4abf93 10 * @license http://opensource.org/licenses/gpl-license.php GNU Public License
8bd0068d 11 * @version $Id$
12 * @package squirrelmail
13 */
b74ba498 14
202bcbcc 15/**
16 * dependency information
17 functions dependency
18 mime_structure
19 class/mime/Message.class.php
20 Message::parseStructure
21 functions/page_header.php
22 displayPageHeader
23 functions/display_messages.php
24 plain_error_message
25 mime_fetch_body
26 functions/imap_general.php
27 sqimap_run_command
28 mime_print_body_lines
29
30
31
32functions/imap.php
33functions/attachment_common.php
34functions/display_messages.php
35
36magicHtml => url_parser
37translateText => url_parser
38
39*/
40
8beafbbc 41
7c7b74b3 42/* -------------------------------------------------------------------------- */
43/* MIME DECODING */
44/* -------------------------------------------------------------------------- */
b74ba498 45
d6c32258 46/**
8bd0068d 47 * Get the MIME structure
48 *
49 * This function gets the structure of a message and stores it in the "message" class.
50 * It will return this object for use with all relevant header information and
51 * fully parsed into the standard "message" object format.
52 */
a4a70693 53function mime_structure ($bodystructure, $flags=array()) {
c9d78ab4 54
3d8371be 55 /* Isolate the body structure and remove beginning and end parenthesis. */
a4a70693 56 $read = trim(substr ($bodystructure, strpos(strtolower($bodystructure), 'bodystructure') + 13));
451f74a2 57 $read = trim(substr ($read, 0, -1));
22efa9fb 58 $i = 0;
59 $msg = Message::parseStructure($read,$i);
2b665f28 60
9de42168 61 if (!is_object($msg)) {
3d8371be 62 global $color, $mailbox;
a48eba8f 63 displayPageHeader( $color, $mailbox );
5e8de8b6 64 $errormessage = _("SquirrelMail could not decode the bodystructure of the message");
8bd0068d 65 $errormessage .= '<br />'._("The bodystructure provided by your IMAP server:").'<br /><br />';
3047e291 66 $errormessage .= '<pre>' . sm_encode_html_special_chars($read) . '</pre>';
ce8c6f42 67 plain_error_message( $errormessage );
3d8371be 68 echo '</body></html>';
9de42168 69 exit;
70 }
a4a70693 71 if (count($flags)) {
7a9e9c89 72 foreach ($flags as $flag) {
e1115979 73//FIXME: please document why it is we have to check the first char of the flag but we then go ahead and do a full string comparison anyway. Is this a speed enhancement? If not, let's keep it simple and just compare the full string and forget the switch block.
1710ad65 74 $char = strtoupper($flag[1]);
7a9e9c89 75 switch ($char) {
3d8371be 76 case 'S':
77 if (strtolower($flag) == '\\seen') {
78 $msg->is_seen = true;
79 }
80 break;
81 case 'A':
82 if (strtolower($flag) == '\\answered') {
83 $msg->is_answered = true;
84 }
85 break;
86 case 'D':
87 if (strtolower($flag) == '\\deleted') {
88 $msg->is_deleted = true;
89 }
90 break;
91 case 'F':
92 if (strtolower($flag) == '\\flagged') {
93 $msg->is_flagged = true;
94 }
1a753239 95 else if (strtolower($flag) == '$forwarded') {
96 $msg->is_forwarded = true;
97 }
3d8371be 98 break;
99 case 'M':
100 if (strtolower($flag) == '$mdnsent') {
101 $msg->is_mdnsent = true;
102 }
103 break;
104 default:
105 break;
7a9e9c89 106 }
107 }
451f74a2 108 }
7a9e9c89 109 // listEntities($msg);
3d8371be 110 return $msg;
451f74a2 111}
b74ba498 112
22efa9fb 113
114
3d8371be 115/* This starts the parsing of a particular structure. It is called recursively,
8bd0068d 116 * so it can be passed different structures. It returns an object of type
117 * $message.
118 * First, it checks to see if it is a multipart message. If it is, then it
119 * handles that as it sees is necessary. If it is just a regular entity,
120 * then it parses it and adds the necessary header information (by calling out
121 * to mime_get_elements()
122 */
451f74a2 123
4d592352 124function mime_fetch_body($imap_stream, $id, $ent_id=1, $fetch_size=0) {
3d8371be 125 /* Do a bit of error correction. If we couldn't find the entity id, just guess
8bd0068d 126 * that it is the first one. That is usually the case anyway.
127 */
7c7b74b3 128
09a4bde3 129 if (!$ent_id) {
08b7f7cc 130 $cmd = "FETCH $id BODY[]";
1035e159 131 } else {
08b7f7cc 132 $cmd = "FETCH $id BODY[$ent_id]";
09a4bde3 133 }
3d8371be 134
4d592352 135 if ($fetch_size!=0) $cmd .= "<0.$fetch_size>";
da2415c1 136
6201339c 137 $data = sqimap_run_command ($imap_stream, $cmd, true, $response, $message, TRUE);
77b88425 138 do {
3d8371be 139 $topline = trim(array_shift($data));
8439f61d 140 } while($topline && ($topline[0] == '*') && !preg_match('/\* [0-9]+ FETCH .*BODY.*/i', $topline)) ;
141 // Matching with "BODY" above is difficult: in most cases "FETCH \(BODY" would work
142 // but some servers may put other things in the same result, perhaps something such
143 // as "* 23 FETCH (FLAGS (\Seen) BODY[1] {174}". There is some small chance that
144 // if the character sequence "BODY" appears in a response where it isn't actually
145 // a FETCH response data item name, the current regex will break things. The better
146 // way to do this would be to parse the response correctly and not use a regex.
a4a70693 147
451f74a2 148 $wholemessage = implode('', $data);
b7910e12 149 if (preg_match('/\{([^\}]*)\}/', $topline, $regs)) {
3d8371be 150 $ret = substr($wholemessage, 0, $regs[1]);
151 /* There is some information in the content info header that could be important
8bd0068d 152 * in order to parse html messages. Let's get them here.
153 */
1710ad65 154// if ($ret[0] == '<') {
6201339c 155// $data = sqimap_run_command ($imap_stream, "FETCH $id BODY[$ent_id.MIME]", true, $response, $message, TRUE);
0600bdf1 156// }
b7910e12 157 } else if (preg_match('/"([^"]*)"/', $topline, $regs)) {
451f74a2 158 $ret = $regs[1];
06bcb9c3 159 } else if ((stristr($topline, 'nil') !== false) && (empty($wholemessage))) {
160 $ret = $wholemessage;
451f74a2 161 } else {
162 global $where, $what, $mailbox, $passed_id, $startMessage;
3d8371be 163 $par = 'mailbox=' . urlencode($mailbox) . '&amp;passed_id=' . $passed_id;
451f74a2 164 if (isset($where) && isset($what)) {
3d8371be 165 $par .= '&amp;where=' . urlencode($where) . '&amp;what=' . urlencode($what);
a3daaaf3 166 } else {
3d8371be 167 $par .= '&amp;startMessage=' . $startMessage . '&amp;show_more=0';
451f74a2 168 }
e5ea9327 169 $par .= '&amp;response=' . urlencode($response) .
8bd0068d 170 '&amp;message=' . urlencode($message) .
171 '&amp;topline=' . urlencode($topline);
a019eeb8 172
8bd0068d 173 echo '<tt><br />' .
02474e43 174 '<table width="80%"><tr>' .
175 '<tr><td colspan="2">' .
176 _("Body retrieval error. The reason for this is most probably that the message is malformed.") .
177 '</td></tr>' .
178 '<tr><td><b>' . _("Command:") . "</td><td>$cmd</td></tr>" .
179 '<tr><td><b>' . _("Response:") . "</td><td>$response</td></tr>" .
180 '<tr><td><b>' . _("Message:") . "</td><td>$message</td></tr>" .
181 '<tr><td><b>' . _("FETCH line:") . "</td><td>$topline</td></tr>" .
182 "</table><br /></tt></font><hr />";
346817d4 183
6201339c 184 $data = sqimap_run_command ($imap_stream, "FETCH $passed_id BODY[]", true, $response, $message, TRUE);
451f74a2 185 array_shift($data);
186 $wholemessage = implode('', $data);
a019eeb8 187
346817d4 188 $ret = $wholemessage;
a3daaaf3 189 }
3d8371be 190 return $ret;
451f74a2 191}
d4467150 192
fa26ab45 193function mime_print_body_lines ($imap_stream, $id, $ent_id=1, $encoding, $rStream='php://stdout', $force_crlf='') {
1035e159 194
3d8371be 195 /* Don't kill the connection if the browser is over a dialup
8bd0068d 196 * and it would take over 30 seconds to download it.
197 * Don't call set_time_limit in safe mode.
198 */
b7206e1d 199
3d8371be 200 if (!ini_get('safe_mode')) {
b7206e1d 201 set_time_limit(0);
202 }
7c7b74b3 203 /* in case of base64 encoded attachments, do not buffer them.
8bd0068d 204 Instead, echo the decoded attachment directly to screen */
7c7b74b3 205 if (strtolower($encoding) == 'base64') {
206 if (!$ent_id) {
7591f143 207 $query = "FETCH $id BODY[]";
7c7b74b3 208 } else {
7591f143 209 $query = "FETCH $id BODY[$ent_id]";
7c7b74b3 210 }
7591f143 211 sqimap_run_command($imap_stream,$query,true,$response,$message,TRUE,'sqimap_base64_decode',$rStream,true);
1d142b8d 212 } else {
7591f143 213 $body = mime_fetch_body ($imap_stream, $id, $ent_id);
214 if (is_resource($rStream)) {
fa26ab45 215 fputs($rStream,decodeBody($body, $encoding, $force_crlf));
7591f143 216 } else {
fa26ab45 217 echo decodeBody($body, $encoding, $force_crlf);
7591f143 218 }
1d142b8d 219 }
346817d4 220
da2415c1 221 /*
8bd0068d 222 TODO, use the same method for quoted printable.
223 However, I assume that quoted printable attachments aren't that large
224 so the performancegain / memory usage drop will be minimal.
225 If we decide to add that then we need to adapt sqimap_fread because
226 we need to split te result on \n and fread doesn't stop at \n. That
227 means we also should provide $results from sqimap_fread (by ref) to
228 te function and set $no_return to false. The $filter function for
229 quoted printable should handle unsetting of $results.
230 */
da2415c1 231 /*
8bd0068d 232 TODO 2: find out how we write to the output stream php://stdout. fwrite
233 doesn't work because 'php://stdout isn't a stream.
234 */
7c7b74b3 235
5d9c6f73 236 return;
451f74a2 237}
beb9e459 238
451f74a2 239/* -[ END MIME DECODING ]----------------------------------------------------------- */
d4467150 240
3d8371be 241/* This is here for debugging purposes. It will print out a list
8bd0068d 242 * of all the entity IDs that are in the $message object.
243 */
451f74a2 244function listEntities ($message) {
3d8371be 245 if ($message) {
3c621ba1 246 echo "<tt>" . $message->entity_id . ' : ' . $message->type0 . '/' . $message->type1 . ' parent = '. $message->parent->entity_id. '<br />';
3d8371be 247 for ($i = 0; isset($message->entities[$i]); $i++) {
248 echo "$i : ";
249 $msg = listEntities($message->entities[$i]);
250
251 if ($msg) {
252 echo "return: ";
253 return $msg;
254 }
255 }
a4a70693 256 }
451f74a2 257}
f0c4dc12 258
f792c641 259function getPriorityStr($priority) {
3d8371be 260 $priority_level = substr($priority,0,1);
261
262 switch($priority_level) {
263 /* Check for a higher then normal priority. */
264 case '1':
265 case '2':
266 $priority_string = _("High");
267 break;
268
269 /* Check for a lower then normal priority. */
270 case '4':
271 case '5':
272 $priority_string = _("Low");
273 break;
274
275 /* Check for a normal priority. */
276 case '3':
277 default:
278 $priority_level = '3';
279 $priority_string = _("Normal");
280 break;
281
282 }
283 return $priority_string;
f792c641 284}
285
451f74a2 286/* returns a $message object for a particular entity id */
287function getEntity ($message, $ent_id) {
a4a70693 288 return $message->getEntity($ent_id);
451f74a2 289}
8beafbbc 290
3d8371be 291/* translateText
8bd0068d 292 * Extracted from strings.php 23/03/2002
293 */
da4c66e8 294
295function translateText(&$body, $wrap_at, $charset) {
3d8371be 296 global $where, $what; /* from searching */
297 global $color; /* color theme */
da4c66e8 298
202bcbcc 299 // require_once(SM_PATH . 'functions/url_parser.php');
da4c66e8 300
301 $body_ary = explode("\n", $body);
da4c66e8 302 for ($i=0; $i < count($body_ary); $i++) {
4c1f4be3 303 $line = rtrim($body_ary[$i],"\r");
304
da4c66e8 305 if (strlen($line) - 2 >= $wrap_at) {
c7aff938 306 sqWordWrap($line, $wrap_at, $charset);
da4c66e8 307 }
308 $line = charset_decode($charset, $line);
309 $line = str_replace("\t", ' ', $line);
310
311 parseUrl ($line);
312
3d8371be 313 $quotes = 0;
da4c66e8 314 $pos = 0;
3d8371be 315 $j = strlen($line);
da4c66e8 316
3d8371be 317 while ($pos < $j) {
da4c66e8 318 if ($line[$pos] == ' ') {
3d8371be 319 $pos++;
da4c66e8 320 } else if (strpos($line, '&gt;', $pos) === $pos) {
321 $pos += 4;
3d8371be 322 $quotes++;
da4c66e8 323 } else {
324 break;
325 }
326 }
3d8371be 327
83c94382 328 if ($quotes % 2) {
d0814c02 329 $line = '<span class="quote1">' . $line . '</span>';
4c25967c 330 } elseif ($quotes) {
d0814c02 331 $line = '<span class="quote2">' . $line . '</span>';
da4c66e8 332 }
3d8371be 333
da4c66e8 334 $body_ary[$i] = $line;
335 }
336 $body = '<pre>' . implode("\n", $body_ary) . '</pre>';
337}
338
a2bfcbce 339/**
da1b55ad 340 * This returns a parsed string called $body. That string can then
341 * be displayed as the actual message in the HTML. It contains
342 * everything needed, including HTML Tags, Attachments at the
343 * bottom, etc.
f8a1ed5a 344 *
da1b55ad 345 * Since 1.2.0 function uses message_body hook.
346 * Till 1.3.0 function included output of formatAttachments().
347 *
348 * @param resource $imap_stream imap connection resource
349 * @param object $message squirrelmail message object
350 * @param array $color squirrelmail color theme array
351 * @param integer $wrap_at number of characters per line
352 * @param string $ent_num (since 1.3.0) message part id
353 * @param integer $id (since 1.3.0) message id
354 * @param string $mailbox (since 1.3.0) imap folder name
da1b55ad 355 * @return string html formated message text
356 */
a540f994 357function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $mailbox='INBOX') {
3d8371be 358 /* This if statement checks for the entity to show as the
8bd0068d 359 * primary message. To add more of them, just put them in the
360 * order that is their priority.
361 */
ce68b76b 362 global $startMessage, $languages, $squirrelmail_language,
40a34e57 363 $show_html_default, $sort, $has_unsafe_images, $passed_ent_id,
14c85e39 364 $use_iframe, $iframe_height, $download_and_unsafe_link,
955bfc8f 365 $download_href, $unsafe_image_toggle_href, $unsafe_image_toggle_text,
551c7b53 366 $oTemplate, $nbsp;
2c25d36a 367
368 // workaround for not updated config.php
369 if (! isset($use_iframe)) $use_iframe = false;
77bfbd2e 370
d31f73f1 371 // If there's no "view_unsafe_images" variable in the URL, turn unsafe
372 // images off by default.
afbf184c 373 sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET, FALSE);
d03c24f4 374
cc34b00d 375 $body = '';
23bcec6f 376 $urlmailbox = urlencode($mailbox);
451f74a2 377 $body_message = getEntity($message, $ent_num);
378 if (($body_message->header->type0 == 'text') ||
8bd0068d 379 ($body_message->header->type0 == 'rfc822')) {
3d8371be 380 $body = mime_fetch_body ($imap_stream, $id, $ent_num);
451f74a2 381 $body = decodeBody($body, $body_message->header->encoding);
e842b215 382
383 if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
8bd0068d 384 function_exists($languages[$squirrelmail_language]['XTRA_CODE'] . '_decode')) {
e842b215 385 if (mb_detect_encoding($body) != 'ASCII') {
33a55f5a 386 $body = call_user_func($languages[$squirrelmail_language]['XTRA_CODE'] . '_decode',$body);
e842b215 387 }
388 }
d849b570 389
390 /* As of 1.5.2, $body is passed (and modified) by reference */
391 do_hook('message_body', $body);
23bcec6f 392
3d8371be 393 /* If there are other types that shouldn't be formatted, add
8bd0068d 394 * them here.
395 */
3d8371be 396
451f74a2 397 if ($body_message->header->type1 == 'html') {
3d8371be 398 if ($show_html_default <> 1) {
85015544 399 $entity_conv = array('&nbsp;' => ' ',
8bd0068d 400 '<p>' => "\n",
401 '<P>' => "\n",
402 '<br>' => "\n",
403 '<BR>' => "\n",
404 '<br />' => "\n",
405 '<BR />' => "\n",
406 '&gt;' => '>',
407 '&lt;' => '<');
85015544 408 $body = strtr($body, $entity_conv);
3d8371be 409 $body = strip_tags($body);
85015544 410 $body = trim($body);
411 translateText($body, $wrap_at,
8bd0068d 412 $body_message->header->getParameter('charset'));
a540f994 413 } elseif ($use_iframe) {
84410f31 414 /**
415 * If we don't add html message between iframe tags,
416 * we must detect unsafe images and modify $has_unsafe_images.
f8a1ed5a 417 */
758a7889 418 $html_body = magicHTML($body, $id, $message, $mailbox);
b6c52e61 419 // Convert character set in order to display html mails in different character set
420 $html_body = charset_decode($body_message->header->getParameter('charset'),$html_body,false,true);
84410f31 421
2c25d36a 422 // creating iframe url
423 $iframeurl=sqm_baseuri().'src/view_html.php?'
f8a1ed5a 424 . 'mailbox=' . $urlmailbox
2c25d36a 425 . '&amp;passed_id=' . $id
426 . '&amp;ent_id=' . $ent_num
427 . '&amp;view_unsafe_images=' . (int) $view_unsafe_images;
428
79d58d4c 429 global $oTemplate;
430 $oTemplate->assign('iframe_url', $iframeurl);
51554708 431 $oTemplate->assign('iframe_height', $iframe_height);
79d58d4c 432 $oTemplate->assign('html_body', $html_body);
2b665f28 433
79d58d4c 434 $body = $oTemplate->fetch('read_html_iframe.tpl');
a3daaaf3 435 } else {
2c25d36a 436 // old way of html rendering
b6c52e61 437 /**
758a7889 438 * convert character set. charset_decode does not remove html special chars
b6c52e61 439 * applied by magicHTML functions and does not sanitize them second time if
758a7889 440 * fourth argument is true.
441 */
567dc524 442 $charset = $body_message->header->getParameter('charset');
443 if (!empty($charset)) {
444 $body = charset_decode($charset,$body,false,true);
445 }
446 $body = magicHTML($body, $id, $message, $mailbox);
a3daaaf3 447 }
451f74a2 448 } else {
3d8371be 449 translateText($body, $wrap_at,
8bd0068d 450 $body_message->header->getParameter('charset'));
451f74a2 451 }
a2bfcbce 452
9ebace19 453 /*
454 * Previously the links for downloading and unsafe images were printed
455 * under the mail. By putting the links in a global variable we can
456 * print it in the toolbar where it belongs. Since the original code was
457 * in this place it's left here. It might be possible to move it to some
458 * other place if that makes sense. The possibility to do so has not
459 * been evaluated yet.
460 */
461
462 // Initialize the global variable to an empty string.
463 // FIXME: To have $download_and_unsafe_link as a global variable might not be needed since the use of separate variables ($download_href, $unsafe_image_toggle_href, and $unsafe_image_toggle_text) for the templates was introduced.
40a34e57 464 $download_and_unsafe_link = '';
465
9ebace19 466 // Prepare and build a link for downloading the mail.
83cf04bd 467 $link = 'passed_id=' . $id . '&amp;ent_id='.$ent_num.
8bd0068d 468 '&amp;mailbox=' . $urlmailbox .'&amp;sort=' . $sort .
469 '&amp;startMessage=' . $startMessage . '&amp;show_more=0';
08b7f7cc 470 if (isset($passed_ent_id)) {
471 $link .= '&amp;passed_ent_id='.$passed_ent_id;
472 }
14c85e39 473 $download_href = SM_PATH . 'src/download.php?absolute_dl=true&amp;' . $link;
9ebace19 474
475 // Always add the link for downloading the mail as a file to the global
476 // variable.
955bfc8f 477 $download_and_unsafe_link .= "$nbsp|$nbsp"
478 . create_hyperlink($download_href, _("Download this as a file"));
9ebace19 479
480 // Find out the right text to use in the link depending on the
481 // circumstances. If the unsafe images are displayed the link should
482 // hide them, if they aren't displayed the link should only appear if
483 // the mail really contains unsafe images.
7aad7b77 484 if ($view_unsafe_images) {
23f617b8 485 $text = _("Hide Unsafe Images");
7aad7b77 486 } else {
08b7f7cc 487 if (isset($has_unsafe_images) && $has_unsafe_images) {
488 $link .= '&amp;view_unsafe_images=1';
489 $text = _("View Unsafe Images");
490 } else {
491 $text = '';
492 }
3d8371be 493 }
9ebace19 494
495 // Only create a link for unsafe images if there's need for one. If so:
496 // add it to the global variable.
83cf04bd 497 if($text != '') {
14c85e39 498 $unsafe_image_toggle_href = SM_PATH . 'src/read_body.php?'.$link;
499 $unsafe_image_toggle_text = $text;
955bfc8f 500 $download_and_unsafe_link .= "$nbsp|$nbsp"
501 . create_hyperlink($unsafe_image_toggle_href, $text);
83cf04bd 502 }
3d8371be 503 }
504 return $body;
451f74a2 505}
b74ba498 506
da1b55ad 507/**
a540f994 508 * Generate attachments array for passing to templates.
2b665f28 509 *
d67f519a 510 * @since 1.5.2
da1b55ad 511 * @param object $message SquirrelMail message object
512 * @param array $exclude_id message parts that are not attachments.
513 * @param string $mailbox mailbox name
514 * @param integer $id message id
da1b55ad 515 */
d67f519a 516function buildAttachmentArray($message, $exclude_id, $mailbox, $id) {
caf0ab1d 517 global $where, $what, $startMessage, $color, $passed_ent_id,
518 $base_uri, $block_svg_download;
451f74a2 519
23bcec6f 520 $att_ar = $message->getAttachments($exclude_id);
23bcec6f 521 $urlMailbox = urlencode($mailbox);
522
d67f519a 523 $attachments = array();
23bcec6f 524 foreach ($att_ar as $att) {
fdc9d9b5 525 $ent = $att->entity_id;
2e25760a 526 $header = $att->header;
f0c4dc12 527 $type0 = strtolower($header->type0);
528 $type1 = strtolower($header->type1);
caf0ab1d 529 if ($block_svg_download && strpos($type1, 'svg') === 0)
530 continue;
531
2e25760a 532 $name = '';
d0187bd6 533 $links = array();
21dab2dc 534 $links['download link']['text'] = _("Download");
202bcbcc 535 $links['download link']['href'] = $base_uri .
8bd0068d 536 "src/download.php?absolute_dl=true&amp;passed_id=$id&amp;mailbox=$urlMailbox&amp;ent_id=$ent";
2b665f28 537
2e25760a 538 if ($type0 =='message' && $type1 == 'rfc822') {
202bcbcc 539 $default_page = $base_uri . 'src/read_body.php';
2e25760a 540 $rfc822_header = $att->rfc822_header;
098ea084 541 $filename = $rfc822_header->subject;
6cc08d8b 542 if (trim( $filename ) == '') {
543 $filename = 'untitled-[' . $ent . ']' ;
08b7f7cc 544 }
2e25760a 545 $from_o = $rfc822_header->from;
546 if (is_object($from_o)) {
04ea844e 547 $from_name = decodeHeader($from_o->getAddress(false));
7e697748 548 } elseif (is_array($from_o) && count($from_o) && is_object($from_o[0])) {
549 // something weird happens when a digest message is opened and you return to the digest
550 // now the from object is part of an array. Probably the parseHeader call overwrites the info
551 // retrieved from the bodystructure in a different way. We need to fix this later.
552 // possible starting point, do not fetch header we already have and inspect how
553 // the rfc822_header object behaves.
554 $from_name = decodeHeader($from_o[0]->getAddress(false));
2e25760a 555 } else {
556 $from_name = _("Unknown sender");
f0c4dc12 557 }
d0187bd6 558 $description = _("From").': '.$from_name;
23bcec6f 559 } else {
202bcbcc 560 $default_page = $base_uri . 'src/download.php';
02474e43 561 $filename = $att->getFilename();
f810c0b2 562 if ($header->description) {
098ea084 563 $description = decodeHeader($header->description);
f810c0b2 564 } else {
3d8371be 565 $description = '';
566 }
2e25760a 567 }
568
569 $display_filename = $filename;
3d8371be 570 if (isset($passed_ent_id)) {
571 $passed_ent_id_link = '&amp;passed_ent_id='.$passed_ent_id;
572 } else {
573 $passed_ent_id_link = '';
574 }
575 $defaultlink = $default_page . "?startMessage=$startMessage"
8bd0068d 576 . "&amp;passed_id=$id&amp;mailbox=$urlMailbox"
577 . '&amp;ent_id='.$ent.$passed_ent_id_link;
2e25760a 578 if ($where && $what) {
8bd0068d 579 $defaultlink .= '&amp;where='. urlencode($where).'&amp;what='.urlencode($what);
2e25760a 580 }
7e2ff844 581 // IE does make use of mime content sniffing. Forcing a download
582 // prohibit execution of XSS inside an application/octet-stream attachment
583 if ($type0 == 'application' && $type1 == 'octet-stream') {
584 $defaultlink .= '&amp;absolute_dl=true';
585 }
2b665f28 586
3d8371be 587 /* This executes the attachment hook with a specific MIME-type.
53901c7b 588 * It also allows plugins to run if there's a rule for a more
589 * generic type. Finally, a hook for ALL attachment types is
590 * run as well.
8bd0068d 591 */
8dca4d22 592 // First remember the default link.
593 $defaultlink_orig = $defaultlink;
594
d849b570 595 /* The API for this hook has changed as of 1.5.2 so that all plugin
596 arguments are passed in an array instead of each their own plugin
597 argument, and arguments are passed by reference, so instead of
598 returning any changes, changes should simply be made to the original
599 arguments themselves. */
53901c7b 600 $temp = array(&$links, &$startMessage, &$id, &$urlMailbox, &$ent,
9f6cc07c 601 &$defaultlink, &$display_filename, &$where, &$what,
c2eacf5e 602 &$type0, &$type1);
9c3b2d22 603 do_hook("attachment $type0/$type1", $temp);
53901c7b 604 /* The API for this hook has changed as of 1.5.2 so that all plugin
605 arguments are passed in an array instead of each their own plugin
606 argument, and arguments are passed by reference, so instead of
607 returning any changes, changes should simply be made to the original
608 arguments themselves. */
609 $temp = array(&$links, &$startMessage, &$id, &$urlMailbox, &$ent,
c2eacf5e 610 &$defaultlink, &$display_filename, &$where, &$what,
611 &$type0, &$type1);
53901c7b 612 // Do not let a generic plugin change the default link if a more
613 // specialized one already did it...
614 if ($defaultlink != $defaultlink_orig) {
615 $dummy = '';
616 $temp[5] = &$dummy;
2e25760a 617 }
53901c7b 618 do_hook("attachment $type0/*", $temp);
d849b570 619 /* The API for this hook has changed as of 1.5.2 so that all plugin
620 arguments are passed in an array instead of each their own plugin
621 argument, and arguments are passed by reference, so instead of
622 returning any changes, changes should simply be made to the original
623 arguments themselves. */
9c3b2d22 624 $temp = array(&$links, &$startMessage, &$id, &$urlMailbox, &$ent,
c2eacf5e 625 &$defaultlink, &$display_filename, &$where, &$what,
626 &$type0, &$type1);
8dca4d22 627 // Do not let a generic plugin change the default link if a more
628 // specialized one already did it...
629 if ($defaultlink != $defaultlink_orig) {
630 $dummy = '';
631 $temp[5] = &$dummy;
632 }
9c3b2d22 633 do_hook("attachment */*", $temp);
77b88425 634
d67f519a 635 $this_attachment = array();
636 $this_attachment['Name'] = decodeHeader($display_filename);
637 $this_attachment['Description'] = $description;
638 $this_attachment['DefaultHREF'] = $defaultlink;
639 $this_attachment['DownloadHREF'] = $links['download link']['href'];
640 $this_attachment['ViewHREF'] = isset($links['attachment_common']) ? $links['attachment_common']['href'] : '';
24e8917e 641
642 // base64 encoded file sizes are misleading, so approximate real size
643 if (!empty($header->encoding) && strtolower($header->encoding) == 'base64')
644 $this_attachment['Size'] = $header->size / 4 * 3;
645 else
646 $this_attachment['Size'] = $header->size;
647
3047e291 648 $this_attachment['ContentType'] = sm_encode_html_special_chars($type0 .'/'. $type1);
d67f519a 649 $this_attachment['OtherLinks'] = array();
3d8371be 650 foreach ($links as $val) {
336995ea 651 if ($val['text']==_("Download")) {
652 $this_attachment['DownloadHREF'] = $val['href'];
d0187bd6 653 continue;
336995ea 654 }
655 if ($val['text']==_("View")) {
656 $this_attachment['ViewHREF'] = $val['href'];
657 continue;
658 }
4ed45b62 659
660 // This makes no sense - If 'text' and 'extra' are just concatenated,
661 // there is no point in having 'extra'.... I am going to assume this
662 // was a mistake and am changing 'extra' to be what I think it was
663 // meant to be: additional tag attributes. However, I'm not checking
664 // extensively for plugins that were using this the wrong way (but why would they?)
665 if (empty($val['text']))
d0187bd6 666 continue;
2b665f28 667
d67f519a 668 $temp = array();
669 $temp['HREF'] = $val['href'];
4ed45b62 670 $temp['Text'] = $val['text'];
671 $temp['Extra'] = (empty($val['extra']) ? '' : $val['extra']);
d67f519a 672 $this_attachment['OtherLinks'][] = $temp;
2e25760a 673 }
d67f519a 674 $attachments[] = $this_attachment;
2b665f28 675
3d8371be 676 unset($links);
2e25760a 677 }
2b665f28 678
d67f519a 679 return $attachments;
680}
681
682/**
683 * Displays attachment links and information
684 *
685 * Since 1.3.0 function is not included in formatBody() call.
686 *
687 * Since 1.0.2 uses attachment $type0/$type1 hook.
688 * Since 1.2.5 uses attachment $type0/* hook.
689 * Since 1.5.0 uses attachments_bottom hook.
690 * Since 1.5.2 uses templates and does *not* return a value.
691 *
692 * @param object $message SquirrelMail message object
693 * @param array $exclude_id message parts that are not attachments.
694 * @param string $mailbox mailbox name
695 * @param integer $id message id
696 */
697function formatAttachments($message, $exclude_id, $mailbox, $id) {
698 global $oTemplate;
2b665f28 699
d67f519a 700 $attach = buildAttachmentArray($message, $exclude_id, $mailbox, $id);
d0187bd6 701
702 $oTemplate->assign('attachments', $attach);
703 $oTemplate->display('read_attachments.tpl');
451f74a2 704}
b74ba498 705
7c7b74b3 706function sqimap_base64_decode(&$string) {
7c0ec1d8 707
b17a8968 708 // Base64 encoded data goes in pairs of 4 bytes. To achieve on the
7c0ec1d8 709 // fly decoding (to reduce memory usage) you have to check if the
710 // data has incomplete pairs
711
b17a8968 712 // Remove the noise in order to check if the 4 bytes pairs are complete
7c0ec1d8 713 $string = str_replace(array("\r\n","\n", "\r", " "),array('','','',''),$string);
714
42ce44f8 715 $sStringRem = '';
7c0ec1d8 716 $iMod = strlen($string) % 4;
717 if ($iMod) {
718 $sStringRem = substr($string,-$iMod);
b17a8968 719 // Check if $sStringRem contains padding characters
7c0ec1d8 720 if (substr($sStringRem,-1) != '=') {
721 $string = substr($string,0,-$iMod);
722 } else {
723 $sStringRem = '';
724 }
725 }
7c7b74b3 726 $string = base64_decode($string);
7c0ec1d8 727 return $sStringRem;
7c7b74b3 728}
729
fdf7cef1 730/**
fa26ab45 731 * Decodes encoded string (usually message body)
732 *
733 * This function decodes a string (usually the message body)
734 * depending on the encoding type. Currently quoted-printable
735 * and base64 encodings are supported.
736 *
737 * The decode_body hook was added to this function in 1.4.2/1.5.0.
738 * The $force_crlf parameter was added in 1.5.2.
739 *
740 * @param string $string The encoded string
741 * @param string $encoding used encoding
742 * @param string $force_crlf Whether or not to force CRLF or LF
743 * line endings (or to leave as is).
744 * If given as "LF", line endings will
745 * all be converted to LF; if "CRLF",
746 * line endings will all be converted
747 * to CRLF. If given as an empty value,
9785376e 748 * the global $force_crlf_default will
fa26ab45 749 * be consulted (it can be specified in
750 * config/config_local.php). Otherwise,
751 * any other value will cause the string
752 * to be left alone. Note that this will
753 * be overridden to "LF" if not using at
754 * least PHP version 4.3.0. (OPTIONAL;
755 * default is empty - consult global
756 * default value)
757 *
758 * @return string The decoded string
fdf7cef1 759 *
fdf7cef1 760 * @since 1.0
fa26ab45 761 *
fdf7cef1 762 */
fa26ab45 763function decodeBody($string, $encoding, $force_crlf='') {
764
765 global $force_crlf_default;
766 if (empty($force_crlf)) $force_crlf = $force_crlf_default;
767 $force_crlf = strtoupper($force_crlf);
768
769 // must force line endings to LF due to broken
770 // quoted_printable_decode() in PHP versions
771 // before 4.3.0 (see below)
772 //
773 if (!check_php_version(4, 3, 0) || $force_crlf == 'LF')
774 $string = str_replace("\r\n", "\n", $string);
775 else if ($force_crlf == 'CRLF')
776 $string = str_replace("\n", "\r\n", $string);
83be314a 777
b583c3e8 778 $encoding = strtolower($encoding);
3d8371be 779
d849b570 780 $encoding_handler = do_hook('decode_body', $encoding);
5166f86a 781
782
fa26ab45 783 // plugins get first shot at decoding the string
5166f86a 784 //
785 if (!empty($encoding_handler) && function_exists($encoding_handler)) {
fa26ab45 786 $string = $encoding_handler('decode', $string);
5166f86a 787
fdf7cef1 788 } elseif ($encoding == 'quoted-printable' ||
8bd0068d 789 $encoding == 'quoted_printable') {
fa26ab45 790
791 // quoted_printable_decode() function is broken in older
792 // php versions. Text with \r\n decoding was fixed only
793 // in php 4.3.0. Minimal code requirement is PHP 4.0.4+
794 // and the above call to: str_replace("\r\n", "\n", $string);
795 //
796 $string = quoted_printable_decode($string);
797
fdf7cef1 798 } elseif ($encoding == 'base64') {
fa26ab45 799 $string = base64_decode($string);
b583c3e8 800 }
3d8371be 801
b583c3e8 802 // All other encodings are returned raw.
fa26ab45 803 return $string;
451f74a2 804}
805
9f7f68c3 806/**
8bd0068d 807 * Decodes headers
808 *
e1115979 809 * This function decodes strings that are encoded according to
8bd0068d 810 * RFC1522 (MIME Part Two: Message Header Extensions for Non-ASCII Text).
811 * Patched by Christian Schmidt <christian@ostenfeld.dk> 23/03/2002
812 *
813 * @param string $string header string that has to be made readable
814 * @param boolean $utfencode change message in order to be readable on user's charset. defaults to true
bcae324b 815 * @param boolean $htmlsafe preserve spaces and sanitize html special characters. defaults to true
8bd0068d 816 * @param boolean $decide decide if string can be utfencoded. defaults to false
817 * @return string decoded header string
818 */
bcae324b 819function decodeHeader ($string, $utfencode=true,$htmlsafe=true,$decide=false) {
caf0ab1d 820 global $languages, $squirrelmail_language,$default_charset, $fix_broken_base64_encoded_messages;
79e07c7e 821 if (is_array($string)) {
822 $string = implode("\n", $string);
823 }
da2415c1 824
10dec454 825 if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
8bd0068d 826 function_exists($languages[$squirrelmail_language]['XTRA_CODE'] . '_decodeheader')) {
33a55f5a 827 $string = call_user_func($languages[$squirrelmail_language]['XTRA_CODE'] . '_decodeheader', $string);
08b7f7cc 828 // Do we need to return at this point?
829 // return $string;
83be314a 830 }
79e07c7e 831 $i = 0;
08b7f7cc 832 $iLastMatch = -2;
db65b6b0 833 $encoded = true;
0a06275a 834
821d1f14 835// FIXME: spaces are allowed inside quoted-printable encoding, but the following line will bust up any such encoded strings
098ea084 836 $aString = explode(' ',$string);
08b7f7cc 837 $ret = '';
098ea084 838 foreach ($aString as $chunk) {
358a78a1 839 if ($encoded && $chunk === '') {
08b7f7cc 840 continue;
358a78a1 841 } elseif ($chunk === '') {
08b7f7cc 842 $ret .= ' ';
843 continue;
844 }
098ea084 845 $encoded = false;
08b7f7cc 846 /* if encoded words are not separated by a linear-space-white we still catch them */
847 $j = $i-1;
7e6ca3e8 848
08b7f7cc 849 while ($match = preg_match('/^(.*)=\?([^?]*)\?(Q|B)\?([^?]*)\?=(.*)$/Ui',$chunk,$res)) {
850 /* if the last chunk isn't an encoded string then put back the space, otherwise don't */
851 if ($iLastMatch !== $j) {
bcae324b 852 if ($htmlsafe) {
9f7f68c3 853 $ret .= '&#32;';
08b7f7cc 854 } else {
855 $ret .= ' ';
856 }
857 }
858 $iLastMatch = $i;
859 $j = $i;
bcae324b 860 if ($htmlsafe) {
3047e291 861 $ret .= sm_encode_html_special_chars($res[1]);
cb718de0 862 } else {
863 $ret .= $res[1];
864 }
098ea084 865 $encoding = ucfirst($res[3]);
d6f584fc 866
867 /* decide about valid decoding */
868 if ($decide && is_conversion_safe($res[2])) {
8bd0068d 869 $utfencode=true;
870 $can_be_encoded=true;
d6f584fc 871 } else {
8bd0068d 872 $can_be_encoded=false;
d6f584fc 873 }
098ea084 874 switch ($encoding)
875 {
8bd0068d 876 case 'B':
caf0ab1d 877 // fix broken base64-encoded strings (remove end = padding,
878 // change any = to + in middle of string, add padding back
879 // to the end)
880 if ($fix_broken_base64_encoded_messages) {
881 $encoded_string_minus_padding = strtr(rtrim($res[4], '='), '=', '+');
882 $res[4] = str_pad($encoded_string_minus_padding, strlen($res[4]), '=');
883 }
8bd0068d 884 $replace = base64_decode($res[4]);
885 if ($utfencode) {
886 if ($can_be_encoded) {
887 /* convert string to different charset,
888 * if functions asks for it (usually in compose)
889 */
bcae324b 890 $ret .= charset_convert($res[2],$replace,$default_charset,$htmlsafe);
8bd0068d 891 } else {
892 // convert string to html codes in order to display it
893 $ret .= charset_decode($res[2],$replace);
894 }
fab65ca9 895 } else {
bcae324b 896 if ($htmlsafe) {
3047e291 897 $replace = sm_encode_html_special_chars($replace);
8bd0068d 898 }
899 $ret.= $replace;
fab65ca9 900 }
8bd0068d 901 break;
902 case 'Q':
903 $replace = str_replace('_', ' ', $res[4]);
6c4e2e9b 904 $replace = preg_replace_callback('/=([0-9a-f]{2})/i',
905 create_function ('$matches', 'return chr(hexdec($matches[1]));'),
8bd0068d 906 $replace);
907 if ($utfencode) {
908 if ($can_be_encoded) {
909 /* convert string to different charset,
910 * if functions asks for it (usually in compose)
911 */
bcae324b 912 $replace = charset_convert($res[2], $replace,$default_charset,$htmlsafe);
8bd0068d 913 } else {
914 // convert string to html codes in order to display it
915 $replace = charset_decode($res[2], $replace);
916 }
917 } else {
bcae324b 918 if ($htmlsafe) {
3047e291 919 $replace = sm_encode_html_special_chars($replace);
8bd0068d 920 }
098ea084 921 }
8bd0068d 922 $ret .= $replace;
923 break;
924 default:
925 break;
79e07c7e 926 }
098ea084 927 $chunk = $res[5];
928 $encoded = true;
08b7f7cc 929 }
930 if (!$encoded) {
bcae324b 931 if ($htmlsafe) {
9f7f68c3 932 $ret .= '&#32;';
08b7f7cc 933 } else {
934 $ret .= ' ';
da2415c1 935 }
08b7f7cc 936 }
dc3d13a7 937
bcae324b 938 if (!$encoded && $htmlsafe) {
3047e291 939 $ret .= sm_encode_html_special_chars($chunk);
dc3d13a7 940 } else {
941 $ret .= $chunk;
942 }
098ea084 943 ++$i;
944 }
fd81e884 945 /* remove the first added space */
946 if ($ret) {
bcae324b 947 if ($htmlsafe) {
9f7f68c3 948 $ret = substr($ret,5);
fd81e884 949 } else {
950 $ret = substr($ret,1);
951 }
952 }
da2415c1 953
08b7f7cc 954 return $ret;
451f74a2 955}
956
9f7f68c3 957/**
a24cf710 958 * Encodes header
8bd0068d 959 *
a24cf710 960 * Function uses XTRA_CODE _encodeheader function, if such function exists.
a24cf710 961 *
758a7889 962 * Function uses Q encoding by default and encodes a string according to RFC
963 * 1522 for use in headers if it contains 8-bit characters or anything that
a24cf710 964 * looks like it should be encoded.
8bd0068d 965 *
758a7889 966 * Function switches to B encoding and encodeHeaderBase64() function, if
967 * string is 8bit and multibyte character set supported by mbstring extension
968 * is used. It can cause E_USER_NOTICE errors, if interface is used with
f270a6eb 969 * multibyte character set unsupported by mbstring extension.
970 *
8bd0068d 971 * @param string $string header string, that has to be encoded
972 * @return string quoted-printable encoded string
f270a6eb 973 * @todo make $mb_charsets system wide constant
8bd0068d 974 */
451f74a2 975function encodeHeader ($string) {
6fbd125b 976 global $default_charset, $languages, $squirrelmail_language;
83be314a 977
10dec454 978 if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
8bd0068d 979 function_exists($languages[$squirrelmail_language]['XTRA_CODE'] . '_encodeheader')) {
33a55f5a 980 return call_user_func($languages[$squirrelmail_language]['XTRA_CODE'] . '_encodeheader', $string);
83be314a 981 }
793cc001 982
a24cf710 983 // Use B encoding for multibyte charsets
f270a6eb 984 $mb_charsets = array('utf-8','big5','gb2313','euc-kr');
985 if (in_array($default_charset,$mb_charsets) &&
986 in_array($default_charset,sq_mb_list_encodings()) &&
987 sq_is8bit($string)) {
988 return encodeHeaderBase64($string,$default_charset);
989 } elseif (in_array($default_charset,$mb_charsets) &&
990 sq_is8bit($string) &&
991 ! in_array($default_charset,sq_mb_list_encodings())) {
992 // Add E_USER_NOTICE error here (can cause 'Cannot add header information' warning in compose.php)
993 // trigger_error('encodeHeader: Multibyte character set unsupported by mbstring extension.',E_USER_NOTICE);
994 }
a24cf710 995
451f74a2 996 // Encode only if the string contains 8-bit characters or =?
3d8371be 997 $j = strlen($string);
098ea084 998 $max_l = 75 - strlen($default_charset) - 7;
999 $aRet = array();
451f74a2 1000 $ret = '';
c96c32f4 1001 $iEncStart = $enc_init = false;
0d53f0f9 1002 $cur_l = $iOffset = 0;
3d8371be 1003 for($i = 0; $i < $j; ++$i) {
1710ad65 1004 switch($string[$i])
c96c32f4 1005 {
6b76cffa 1006 case '"':
8bd0068d 1007 case '=':
1008 case '<':
1009 case '>':
1010 case ',':
1011 case '?':
1012 case '_':
1013 if ($iEncStart === false) {
1014 $iEncStart = $i;
1015 }
1016 $cur_l+=3;
1017 if ($cur_l > ($max_l-2)) {
1018 /* if there is an stringpart that doesn't need encoding, add it */
08b7f7cc 1019 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
c96c32f4 1020 $aRet[] = "=?$default_charset?Q?$ret?=";
1021 $iOffset = $i;
1022 $cur_l = 0;
1023 $ret = '';
1024 $iEncStart = false;
08b7f7cc 1025 } else {
1710ad65 1026 $ret .= sprintf("=%02X",ord($string[$i]));
c96c32f4 1027 }
8bd0068d 1028 break;
1029 case '(':
1030 case ')':
1031 if ($iEncStart !== false) {
08b7f7cc 1032 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
8bd0068d 1033 $aRet[] = "=?$default_charset?Q?$ret?=";
c96c32f4 1034 $iOffset = $i;
8bd0068d 1035 $cur_l = 0;
1036 $ret = '';
1037 $iEncStart = false;
c96c32f4 1038 }
8bd0068d 1039 break;
1040 case ' ':
c96c32f4 1041 if ($iEncStart !== false) {
098ea084 1042 $cur_l++;
1043 if ($cur_l > $max_l) {
08b7f7cc 1044 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
c96c32f4 1045 $aRet[] = "=?$default_charset?Q?$ret?=";
c96c32f4 1046 $iOffset = $i;
1047 $cur_l = 0;
098ea084 1048 $ret = '';
8bd0068d 1049 $iEncStart = false;
08b7f7cc 1050 } else {
8bd0068d 1051 $ret .= '_';
c96c32f4 1052 }
3d8371be 1053 }
8bd0068d 1054 break;
1055 default:
1710ad65 1056 $k = ord($string[$i]);
8bd0068d 1057 if ($k > 126) {
1058 if ($iEncStart === false) {
1059 // do not start encoding in the middle of a string, also take the rest of the word.
1060 $sLeadString = substr($string,0,$i);
1061 $aLeadString = explode(' ',$sLeadString);
1062 $sToBeEncoded = array_pop($aLeadString);
1063 $iEncStart = $i - strlen($sToBeEncoded);
1064 $ret .= $sToBeEncoded;
1065 $cur_l += strlen($sToBeEncoded);
1066 }
1067 $cur_l += 3;
1068 /* first we add the encoded string that reached it's max size */
1069 if ($cur_l > ($max_l-2)) {
1070 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
1071 $aRet[] = "=?$default_charset?Q?$ret?= "; /* the next part is also encoded => separate by space */
1072 $cur_l = 3;
1073 $ret = '';
1074 $iOffset = $i;
1075 $iEncStart = $i;
1076 }
1077 $enc_init = true;
1078 $ret .= sprintf("=%02X", $k);
1079 } else {
1080 if ($iEncStart !== false) {
1081 $cur_l++;
1082 if ($cur_l > $max_l) {
1083 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
1084 $aRet[] = "=?$default_charset?Q?$ret?=";
1085 $iEncStart = false;
1086 $iOffset = $i;
1087 $cur_l = 0;
1088 $ret = '';
1089 } else {
1710ad65 1090 $ret .= $string[$i];
8bd0068d 1091 }
1092 }
1093 }
1094 break;
f7b3ba37 1095 }
451f74a2 1096 }
793cc001 1097
c96c32f4 1098 if ($enc_init) {
1099 if ($iEncStart !== false) {
1100 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
1101 $aRet[] = "=?$default_charset?Q?$ret?=";
1102 } else {
1103 $aRet[] = substr($string,$iOffset);
1104 }
1105 $string = implode('',$aRet);
451f74a2 1106 }
3d8371be 1107 return $string;
451f74a2 1108}
b74ba498 1109
f270a6eb 1110/**
1111 * Encodes string according to rfc2047 B encoding header formating rules
1112 *
758a7889 1113 * It is recommended way to encode headers with character sets that store
f270a6eb 1114 * symbols in more than one byte.
1115 *
1116 * Function requires mbstring support. If required mbstring functions are missing,
1117 * function returns false and sets E_USER_WARNING level error message.
1118 *
758a7889 1119 * Minimal requirements - php 4.0.6 with mbstring extension. Please note,
1120 * that mbstring functions will generate E_WARNING errors, if unsupported
f270a6eb 1121 * character set is used. mb_encode_mimeheader function provided by php
1122 * mbstring extension is not used in order to get better control of header
1123 * encoding.
1124 *
758a7889 1125 * Used php code functions - function_exists(), trigger_error(), strlen()
1126 * (is used with charset names and base64 strings). Used php mbstring
f270a6eb 1127 * functions - mb_strlen and mb_substr.
1128 *
758a7889 1129 * Related documents: rfc 2045 (BASE64 encoding), rfc 2047 (mime header
f270a6eb 1130 * encoding), rfc 2822 (header folding)
1131 *
1132 * @param string $string header string that must be encoded
758a7889 1133 * @param string $charset character set. Must be supported by mbstring extension.
f270a6eb 1134 * Use sq_mb_list_encodings() to detect supported charsets.
1135 * @return string string encoded according to rfc2047 B encoding formating rules
1136 * @since 1.5.1
1137 * @todo First header line can be wrapped to $iMaxLength - $HeaderFieldLength - 1
1138 * @todo Do we want to control max length of header?
1139 * @todo Do we want to control EOL (end-of-line) marker?
1140 * @todo Do we want to translate error message?
1141 */
1142function encodeHeaderBase64($string,$charset) {
1143 /**
1144 * Check mbstring function requirements.
1145 */
1146 if (! function_exists('mb_strlen') ||
1147 ! function_exists('mb_substr')) {
1148 // set E_USER_WARNING
1149 trigger_error('encodeHeaderBase64: Required mbstring functions are missing.',E_USER_WARNING);
1150 // return false
1151 return false;
1152 }
1153
1154 // initial return array
1155 $aRet = array();
1156
1157 /**
1158 * header length = 75 symbols max (same as in encodeHeader)
1159 * remove $charset length
1160 * remove =? ? ?= (5 chars)
1161 * remove 2 more chars (\r\n ?)
1162 */
1163 $iMaxLength = 75 - strlen($charset) - 7;
1164
1165 // set first character position
1166 $iStartCharNum = 0;
1167
1168 // loop through all characters. count characters and not bytes.
1169 for ($iCharNum=1; $iCharNum<=mb_strlen($string,$charset); $iCharNum++) {
1170 // encode string from starting character to current character.
1171 $encoded_string = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum,$charset));
1172
1173 // Check encoded string length
1174 if(strlen($encoded_string)>$iMaxLength) {
1175 // if string exceeds max length, reduce number of encoded characters and add encoded string part to array
1176 $aRet[] = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum-1,$charset));
1177
1178 // set new starting character
1179 $iStartCharNum = $iCharNum-1;
1180
1181 // encode last char (in case it is last character in string)
1182 $encoded_string = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum,$charset));
1183 } // if string is shorter than max length - add next character
1184 }
1185
1186 // add last encoded string to array
1187 $aRet[] = $encoded_string;
1188
1189 // set initial return string
1190 $sRet = '';
1191
1192 // loop through encoded strings
1193 foreach($aRet as $string) {
1194 // TODO: Do we want to control EOL (end-of-line) marker
1195 if ($sRet!='') $sRet.= " ";
1196
1197 // add header tags and encoded string to return string
1198 $sRet.= '=?'.$charset.'?B?'.$string.'?=';
1199 }
1200
1201 return $sRet;
1202}
1203
691a2d25 1204/* This function trys to locate the entity_id of a specific mime element */
3d8371be 1205function find_ent_id($id, $message) {
a171b359 1206 for ($i = 0, $ret = ''; $ret == '' && $i < count($message->entities); $i++) {
1207 if ($message->entities[$i]->header->type0 == 'multipart') {
3d8371be 1208 $ret = find_ent_id($id, $message->entities[$i]);
451f74a2 1209 } else {
3d8371be 1210 if (strcasecmp($message->entities[$i]->header->id, $id) == 0) {
d8cffbab 1211// if (sq_check_save_extension($message->entities[$i])) {
8bd0068d 1212 return $message->entities[$i]->entity_id;
da2415c1 1213// }
c8f5f606 1214 } elseif (!empty($message->entities[$i]->header->parameters['name'])) {
1215 /**
1216 * This is part of a fix for Outlook Express 6.x generating
1217 * cid URLs without creating content-id headers
1218 * @@JA - 20050207
1219 */
1220 if (strcasecmp($message->entities[$i]->header->parameters['name'], $id) == 0) {
1221 return $message->entities[$i]->entity_id;
1222 }
3d8371be 1223 }
a3daaaf3 1224 }
451f74a2 1225 }
3d8371be 1226 return $ret;
451f74a2 1227}
a3daaaf3 1228
e5e9381a 1229function sq_check_save_extension($message) {
1230 $filename = $message->getFilename();
1231 $ext = substr($filename, strrpos($filename,'.')+1);
1232 $save_extensions = array('jpg','jpeg','gif','png','bmp');
3d8371be 1233 return in_array($ext, $save_extensions);
e5e9381a 1234}
1235
1236
691a2d25 1237/**
8bd0068d 1238 ** HTMLFILTER ROUTINES
1239 */
451f74a2 1240
691a2d25 1241/**
0493ed11 1242 * This function checks attribute values for entity-encoded values
1243 * and returns them translated into 8-bit strings so we can run
1244 * checks on them.
8bd0068d 1245 *
0493ed11 1246 * @param $attvalue A string to run entity check against.
1247 * @return Nothing, modifies a reference value.
8bd0068d 1248 */
0493ed11 1249function sq_defang(&$attvalue){
1250 $me = 'sq_defang';
2dd879b8 1251 /**
0493ed11 1252 * Skip this if there aren't ampersands or backslashes.
8bd0068d 1253 */
0493ed11 1254 if (strpos($attvalue, '&') === false
1255 && strpos($attvalue, '\\') === false){
1256 return;
2dd879b8 1257 }
0493ed11 1258 $m = false;
2b665f28 1259 // before deent, translate the dangerous unicode characters and ... to safe values
1260 // otherwise the regular expressions do not match.
1261
1262
1263
0493ed11 1264 do {
1265 $m = false;
1266 $m = $m || sq_deent($attvalue, '/\&#0*(\d+);*/s');
1267 $m = $m || sq_deent($attvalue, '/\&#x0*((\d|[a-f])+);*/si', true);
1268 $m = $m || sq_deent($attvalue, '/\\\\(\d+)/s', true);
1269 } while ($m == true);
1270 $attvalue = stripslashes($attvalue);
2dd879b8 1271}
1272
1273/**
8bd0068d 1274 * Kill any tabs, newlines, or carriage returns. Our friends the
1275 * makers of the browser with 95% market value decided that it'd
1276 * be funny to make "java[tab]script" be just as good as "javascript".
1277 *
1278 * @param attvalue The attribute value before extraneous spaces removed.
0493ed11 1279 * @return attvalue Nothing, modifies a reference value.
8bd0068d 1280 */
0493ed11 1281function sq_unspace(&$attvalue){
1282 $me = 'sq_unspace';
1283 if (strcspn($attvalue, "\t\r\n\0 ") != strlen($attvalue)){
1284 $attvalue = str_replace(Array("\t", "\r", "\n", "\0", " "),
1285 Array('', '', '', '', ''), $attvalue);
2dd879b8 1286 }
2dd879b8 1287}
1288
1289/**
88de4926 1290 * Translate all dangerous Unicode or Shift_JIS characters which are accepted by
2b665f28 1291 * IE as regular characters.
1292 *
1293 * @param attvalue The attribute value before dangerous characters are translated.
1294 * @return attvalue Nothing, modifies a reference value.
1295 * @author Marc Groot Koerkamp.
1296 */
1297function sq_fixIE_idiocy(&$attvalue) {
1298 // remove NUL
1299 $attvalue = str_replace("\0", "", $attvalue);
1300 // remove comments
1301 $attvalue = preg_replace("/(\/\*.*?\*\/)/","",$attvalue);
1302
88de4926 1303 // IE has the evil habit of accepting every possible value for the attribute expression.
1304 // The table below contains characters which are parsed by IE if they are used in the "expression"
2b665f28 1305 // attribute value.
1306 $aDangerousCharsReplacementTable = array(
1307 array('&#x029F;', '&#0671;' ,/* L UNICODE IPA Extension */
1308 '&#x0280;', '&#0640;' ,/* R UNICODE IPA Extension */
1309 '&#x0274;', '&#0628;' ,/* N UNICODE IPA Extension */
567dc524 1310 '&#xFF25;', '&#65317;' ,/* Unicode FULLWIDTH LATIN CAPITAL LETTER E */
1311 '&#xFF45;', '&#65349;' ,/* Unicode FULLWIDTH LATIN SMALL LETTER E */
2b665f28 1312 '&#xFF38;', '&#65336;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER X */
1313 '&#xFF58;', '&#65368;',/* Unicode FULLWIDTH LATIN SMALL LETTER X */
1314 '&#xFF30;', '&#65328;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER P */
1315 '&#xFF50;', '&#65360;',/* Unicode FULLWIDTH LATIN SMALL LETTER P */
1316 '&#xFF32;', '&#65330;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER R */
1317 '&#xFF52;', '&#65362;',/* Unicode FULLWIDTH LATIN SMALL LETTER R */
1318 '&#xFF33;', '&#65331;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER S */
1319 '&#xFF53;', '&#65363;',/* Unicode FULLWIDTH LATIN SMALL LETTER S */
1320 '&#xFF29;', '&#65321;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER I */
1321 '&#xFF49;', '&#65353;',/* Unicode FULLWIDTH LATIN SMALL LETTER I */
1322 '&#xFF2F;', '&#65327;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER O */
1323 '&#xFF4F;', '&#65359;',/* Unicode FULLWIDTH LATIN SMALL LETTER O */
1324 '&#xFF2E;', '&#65326;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER N */
1325 '&#xFF4E;', '&#65358;',/* Unicode FULLWIDTH LATIN SMALL LETTER N */
1326 '&#xFF2C;', '&#65324;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER L */
1327 '&#xFF4C;', '&#65356;',/* Unicode FULLWIDTH LATIN SMALL LETTER L */
1328 '&#xFF35;', '&#65333;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER U */
1329 '&#xFF55;', '&#65365;',/* Unicode FULLWIDTH LATIN SMALL LETTER U */
1330 '&#x207F;', '&#8319;' ,/* Unicode SUPERSCRIPT LATIN SMALL LETTER N */
567dc524 1331 "\xEF\xBC\xA5", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER E */ // in unicode this is some Chinese char range
1332 "\xEF\xBD\x85", /* Shift JIS FULLWIDTH LATIN SMALL LETTER E */
1333 "\xEF\xBC\xB8", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER X */
1334 "\xEF\xBD\x98", /* Shift JIS FULLWIDTH LATIN SMALL LETTER X */
1335 "\xEF\xBC\xB0", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER P */
1336 "\xEF\xBD\x90", /* Shift JIS FULLWIDTH LATIN SMALL LETTER P */
1337 "\xEF\xBC\xB2", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER R */
1338 "\xEF\xBD\x92", /* Shift JIS FULLWIDTH LATIN SMALL LETTER R */
1339 "\xEF\xBC\xB3", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER S */
1340 "\xEF\xBD\x93", /* Shift JIS FULLWIDTH LATIN SMALL LETTER S */
1341 "\xEF\xBC\xA9", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER I */
1342 "\xEF\xBD\x89", /* Shift JIS FULLWIDTH LATIN SMALL LETTER I */
1343 "\xEF\xBC\xAF", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER O */
1344 "\xEF\xBD\x8F", /* Shift JIS FULLWIDTH LATIN SMALL LETTER O */
1345 "\xEF\xBC\xAE", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER N */
1346 "\xEF\xBD\x8E", /* Shift JIS FULLWIDTH LATIN SMALL LETTER N */
1347 "\xEF\xBC\xAC", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER L */
1348 "\xEF\xBD\x8C", /* Shift JIS FULLWIDTH LATIN SMALL LETTER L */
1349 "\xEF\xBC\xB5", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER U */
1350 "\xEF\xBD\x95", /* Shift JIS FULLWIDTH LATIN SMALL LETTER U */
1351 "\xE2\x81\xBF", /* Shift JIS FULLWIDTH SUPERSCRIPT N */
1352 "\xCA\x9F", /* L UNICODE IPA Extension */
1353 "\xCA\x80", /* R UNICODE IPA Extension */
1354 "\xC9\xB4"), /* N UNICODE IPA Extension */
2b665f28 1355 array('l', 'l', 'r','r','n','n',
567dc524 1356 'E','E','e','e','X','X','x','x','P','P','p','p','R','R','r','r','S','S','s','s','I','I',
1357 'i','i','O','O','o','o','N','N','n','n','L','L','l','l','U','U','u','u','n','n',
1358 'E','e','X','x','P','p','R','r','S','s','I','i','O','o','N','n','L','l','U','u','n','l','r','n'));
2b665f28 1359 $attvalue = str_replace($aDangerousCharsReplacementTable[0],$aDangerousCharsReplacementTable[1],$attvalue);
1360
88de4926 1361 // Escapes are useful for special characters like "{}[]()'&. In other cases they are
1362 // used for XSS.
2b665f28 1363 $attvalue = preg_replace("/(\\\\)([a-zA-Z]{1})/",'$2',$attvalue);
1364}
1365
1366/**
8bd0068d 1367 * This function returns the final tag out of the tag name, an array
1368 * of attributes, and the type of the tag. This function is called by
1369 * sq_sanitize internally.
1370 *
1371 * @param $tagname the name of the tag.
1372 * @param $attary the array of attributes and their values
1373 * @param $tagtype The type of the tag (see in comments).
1374 * @return a string with the final tag representation.
1375 */
691a2d25 1376function sq_tagprint($tagname, $attary, $tagtype){
b583c3e8 1377 $me = 'sq_tagprint';
3d8371be 1378
691a2d25 1379 if ($tagtype == 2){
1380 $fulltag = '</' . $tagname . '>';
1381 } else {
1382 $fulltag = '<' . $tagname;
1383 if (is_array($attary) && sizeof($attary)){
1384 $atts = Array();
c71c845c 1385 foreach ($attary as $attname => $attvalue){
691a2d25 1386 array_push($atts, "$attname=$attvalue");
1387 }
1388 $fulltag .= ' ' . join(" ", $atts);
1389 }
1390 if ($tagtype == 3){
b583c3e8 1391 $fulltag .= ' /';
691a2d25 1392 }
b583c3e8 1393 $fulltag .= '>';
451f74a2 1394 }
691a2d25 1395 return $fulltag;
451f74a2 1396}
a3daaaf3 1397
691a2d25 1398/**
8bd0068d 1399 * A small helper function to use with array_walk. Modifies a by-ref
1400 * value and makes it lowercase.
1401 *
1402 * @param $val a value passed by-ref.
1403 * @return void since it modifies a by-ref value.
1404 */
691a2d25 1405function sq_casenormalize(&$val){
1406 $val = strtolower($val);
1407}
451f74a2 1408
691a2d25 1409/**
8bd0068d 1410 * This function skips any whitespace from the current position within
1411 * a string and to the next non-whitespace value.
1412 *
1413 * @param $body the string
1414 * @param $offset the offset within the string where we should start
1415 * looking for the next non-whitespace character.
1416 * @return the location within the $body where the next
1417 * non-whitespace char is located.
1418 */
691a2d25 1419function sq_skipspace($body, $offset){
b583c3e8 1420 $me = 'sq_skipspace';
3d8371be 1421 preg_match('/^(\s*)/s', substr($body, $offset), $matches);
aab65dbd 1422 if (!empty($matches[1])){
1423 $offset += strlen($matches[1]);
451f74a2 1424 }
691a2d25 1425 return $offset;
451f74a2 1426}
a3daaaf3 1427
691a2d25 1428/**
8bd0068d 1429 * This function looks for the next character within a string. It's
1430 * really just a glorified "strpos", except it catches if failures
1431 * nicely.
1432 *
1433 * @param $body The string to look for needle in.
1434 * @param $offset Start looking from this position.
1435 * @param $needle The character/string to look for.
1436 * @return location of the next occurance of the needle, or
1437 * strlen($body) if needle wasn't found.
1438 */
691a2d25 1439function sq_findnxstr($body, $offset, $needle){
3d8371be 1440 $me = 'sq_findnxstr';
691a2d25 1441 $pos = strpos($body, $needle, $offset);
1442 if ($pos === FALSE){
1443 $pos = strlen($body);
451f74a2 1444 }
691a2d25 1445 return $pos;
451f74a2 1446}
a3daaaf3 1447
691a2d25 1448/**
8bd0068d 1449 * This function takes a PCRE-style regexp and tries to match it
1450 * within the string.
1451 *
1452 * @param $body The string to look for needle in.
1453 * @param $offset Start looking from here.
1454 * @param $reg A PCRE-style regex to match.
1455 * @return Returns a false if no matches found, or an array
1456 * with the following members:
1457 * - integer with the location of the match within $body
1458 * - string with whatever content between offset and the match
1459 * - string with whatever it is we matched
1460 */
691a2d25 1461function sq_findnxreg($body, $offset, $reg){
b583c3e8 1462 $me = 'sq_findnxreg';
691a2d25 1463 $matches = Array();
1464 $retarr = Array();
7d06541f 1465 preg_match("%^(.*?)($reg)%si", substr($body, $offset), $matches);
1710ad65 1466 if (!isset($matches[0]) || !$matches[0]){
691a2d25 1467 $retarr = false;
1468 } else {
1710ad65 1469 $retarr[0] = $offset + strlen($matches[1]);
1470 $retarr[1] = $matches[1];
1471 $retarr[2] = $matches[2];
691a2d25 1472 }
1473 return $retarr;
1474}
a3daaaf3 1475
691a2d25 1476/**
8bd0068d 1477 * This function looks for the next tag.
1478 *
1479 * @param $body String where to look for the next tag.
1480 * @param $offset Start looking from here.
1481 * @return false if no more tags exist in the body, or
1482 * an array with the following members:
1483 * - string with the name of the tag
1484 * - array with attributes and their values
1485 * - integer with tag type (1, 2, or 3)
1486 * - integer where the tag starts (starting "<")
1487 * - integer where the tag ends (ending ">")
1488 * first three members will be false, if the tag is invalid.
1489 */
691a2d25 1490function sq_getnxtag($body, $offset){
b583c3e8 1491 $me = 'sq_getnxtag';
691a2d25 1492 if ($offset > strlen($body)){
1493 return false;
1494 }
1495 $lt = sq_findnxstr($body, $offset, "<");
1496 if ($lt == strlen($body)){
1497 return false;
1498 }
1499 /**
8bd0068d 1500 * We are here:
1501 * blah blah <tag attribute="value">
1502 * \---------^
1503 */
691a2d25 1504 $pos = sq_skipspace($body, $lt+1);
1505 if ($pos >= strlen($body)){
1506 return Array(false, false, false, $lt, strlen($body));
1507 }
1508 /**
8bd0068d 1509 * There are 3 kinds of tags:
1510 * 1. Opening tag, e.g.:
1511 * <a href="blah">
1512 * 2. Closing tag, e.g.:
1513 * </a>
1514 * 3. XHTML-style content-less tag, e.g.:
1515 * <img src="blah" />
1516 */
691a2d25 1517 $tagtype = false;
1518 switch (substr($body, $pos, 1)){
3d8371be 1519 case '/':
1520 $tagtype = 2;
1521 $pos++;
1522 break;
1523 case '!':
1524 /**
8bd0068d 1525 * A comment or an SGML declaration.
1526 */
3d8371be 1527 if (substr($body, $pos+1, 2) == "--"){
1528 $gt = strpos($body, "-->", $pos);
1529 if ($gt === false){
1530 $gt = strlen($body);
1531 } else {
1532 $gt += 2;
1533 }
1534 return Array(false, false, false, $lt, $gt);
bb8d0799 1535 } else {
3d8371be 1536 $gt = sq_findnxstr($body, $pos, ">");
1537 return Array(false, false, false, $lt, $gt);
1538 }
1539 break;
1540 default:
1541 /**
8bd0068d 1542 * Assume tagtype 1 for now. If it's type 3, we'll switch values
1543 * later.
1544 */
3d8371be 1545 $tagtype = 1;
1546 break;
691a2d25 1547 }
a3daaaf3 1548
0493ed11 1549 $tag_start = $pos;
691a2d25 1550 $tagname = '';
1551 /**
8bd0068d 1552 * Look for next [\W-_], which will indicate the end of the tag name.
1553 */
691a2d25 1554 $regary = sq_findnxreg($body, $pos, "[^\w\-_]");
1555 if ($regary == false){
1556 return Array(false, false, false, $lt, strlen($body));
1557 }
1558 list($pos, $tagname, $match) = $regary;
1559 $tagname = strtolower($tagname);
1560
1561 /**
8bd0068d 1562 * $match can be either of these:
1563 * '>' indicating the end of the tag entirely.
1564 * '\s' indicating the end of the tag name.
1565 * '/' indicating that this is type-3 xhtml tag.
1566 *
1567 * Whatever else we find there indicates an invalid tag.
1568 */
691a2d25 1569 switch ($match){
3d8371be 1570 case '/':
691a2d25 1571 /**
8bd0068d 1572 * This is an xhtml-style tag with a closing / at the
1573 * end, like so: <img src="blah" />. Check if it's followed
1574 * by the closing bracket. If not, then this tag is invalid
1575 */
3d8371be 1576 if (substr($body, $pos, 2) == "/>"){
1577 $pos++;
1578 $tagtype = 3;
1579 } else {
1580 $gt = sq_findnxstr($body, $pos, ">");
1581 $retary = Array(false, false, false, $lt, $gt);
1582 return $retary;
1583 }
1584 case '>':
1585 return Array($tagname, false, $tagtype, $lt, $pos);
1586 break;
1587 default:
1588 /**
8bd0068d 1589 * Check if it's whitespace
1590 */
3d8371be 1591 if (!preg_match('/\s/', $match)){
1592 /**
8bd0068d 1593 * This is an invalid tag! Look for the next closing ">".
1594 */
7d06541f 1595 $gt = sq_findnxstr($body, $lt, ">");
3d8371be 1596 return Array(false, false, false, $lt, $gt);
1597 }
1598 break;
691a2d25 1599 }
3d8371be 1600
691a2d25 1601 /**
8bd0068d 1602 * At this point we're here:
1603 * <tagname attribute='blah'>
1604 * \-------^
1605 *
1606 * At this point we loop in order to find all attributes.
1607 */
691a2d25 1608 $attname = '';
0493ed11 1609 $atttype = false;
691a2d25 1610 $attary = Array();
1611
1612 while ($pos <= strlen($body)){
1613 $pos = sq_skipspace($body, $pos);
1614 if ($pos == strlen($body)){
1615 /**
8bd0068d 1616 * Non-closed tag.
1617 */
691a2d25 1618 return Array(false, false, false, $lt, $pos);
1619 }
1620 /**
8bd0068d 1621 * See if we arrived at a ">" or "/>", which means that we reached
1622 * the end of the tag.
1623 */
691a2d25 1624 $matches = Array();
164800ad 1625 if (preg_match("%^(\s*)(>|/>)%s", substr($body, $pos), $matches)) {
c828931c 1626 /**
8bd0068d 1627 * Yep. So we did.
1628 */
1710ad65 1629 $pos += strlen($matches[1]);
1630 if ($matches[2] == "/>"){
c828931c 1631 $tagtype = 3;
1632 $pos++;
1633 }
1634 return Array($tagname, $attary, $tagtype, $lt, $pos);
1635 }
a3daaaf3 1636
cca46357 1637 /**
8bd0068d 1638 * There are several types of attributes, with optional
1639 * [:space:] between members.
1640 * Type 1:
1641 * attrname[:space:]=[:space:]'CDATA'
1642 * Type 2:
1643 * attrname[:space:]=[:space:]"CDATA"
1644 * Type 3:
1645 * attr[:space:]=[:space:]CDATA
1646 * Type 4:
1647 * attrname
1648 *
1649 * We leave types 1 and 2 the same, type 3 we check for
1650 * '"' and convert to "&quot" if needed, then wrap in
1651 * double quotes. Type 4 we convert into:
1652 * attrname="yes".
1653 */
3f7c623f 1654 $regary = sq_findnxreg($body, $pos, "[^:\w\-_]");
691a2d25 1655 if ($regary == false){
1656 /**
8bd0068d 1657 * Looks like body ended before the end of tag.
1658 */
691a2d25 1659 return Array(false, false, false, $lt, strlen($body));
cca46357 1660 }
691a2d25 1661 list($pos, $attname, $match) = $regary;
1662 $attname = strtolower($attname);
1663 /**
8bd0068d 1664 * We arrived at the end of attribute name. Several things possible
1665 * here:
1666 * '>' means the end of the tag and this is attribute type 4
1667 * '/' if followed by '>' means the same thing as above
1668 * '\s' means a lot of things -- look what it's followed by.
1669 * anything else means the attribute is invalid.
1670 */
691a2d25 1671 switch($match){
3d8371be 1672 case '/':
691a2d25 1673 /**
8bd0068d 1674 * This is an xhtml-style tag with a closing / at the
1675 * end, like so: <img src="blah" />. Check if it's followed
1676 * by the closing bracket. If not, then this tag is invalid
1677 */
3d8371be 1678 if (substr($body, $pos, 2) == "/>"){
691a2d25 1679 $pos++;
3d8371be 1680 $tagtype = 3;
691a2d25 1681 } else {
3d8371be 1682 $gt = sq_findnxstr($body, $pos, ">");
1683 $retary = Array(false, false, false, $lt, $gt);
1684 return $retary;
1685 }
1686 case '>':
1710ad65 1687 $attary[$attname] = '"yes"';
3d8371be 1688 return Array($tagname, $attary, $tagtype, $lt, $pos);
1689 break;
1690 default:
1691 /**
8bd0068d 1692 * Skip whitespace and see what we arrive at.
1693 */
3d8371be 1694 $pos = sq_skipspace($body, $pos);
1695 $char = substr($body, $pos, 1);
1696 /**
8bd0068d 1697 * Two things are valid here:
1698 * '=' means this is attribute type 1 2 or 3.
1699 * \w means this was attribute type 4.
1700 * anything else we ignore and re-loop. End of tag and
1701 * invalid stuff will be caught by our checks at the beginning
1702 * of the loop.
1703 */
3d8371be 1704 if ($char == "="){
1705 $pos++;
1706 $pos = sq_skipspace($body, $pos);
691a2d25 1707 /**
8bd0068d 1708 * Here are 3 possibilities:
1709 * "'" attribute type 1
1710 * '"' attribute type 2
1711 * everything else is the content of tag type 3
1712 */
3d8371be 1713 $quot = substr($body, $pos, 1);
1714 if ($quot == "'"){
1715 $regary = sq_findnxreg($body, $pos+1, "\'");
1716 if ($regary == false){
1717 return Array(false, false, false, $lt, strlen($body));
1718 }
1719 list($pos, $attval, $match) = $regary;
1720 $pos++;
1710ad65 1721 $attary[$attname] = "'" . $attval . "'";
3d8371be 1722 } else if ($quot == '"'){
1723 $regary = sq_findnxreg($body, $pos+1, '\"');
1724 if ($regary == false){
1725 return Array(false, false, false, $lt, strlen($body));
1726 }
1727 list($pos, $attval, $match) = $regary;
1728 $pos++;
1710ad65 1729 $attary[$attname] = '"' . $attval . '"';
3d8371be 1730 } else {
1731 /**
8bd0068d 1732 * These are hateful. Look for \s, or >.
1733 */
3d8371be 1734 $regary = sq_findnxreg($body, $pos, "[\s>]");
1735 if ($regary == false){
1736 return Array(false, false, false, $lt, strlen($body));
1737 }
1738 list($pos, $attval, $match) = $regary;
1739 /**
8bd0068d 1740 * If it's ">" it will be caught at the top.
1741 */
3d8371be 1742 $attval = preg_replace("/\"/s", "&quot;", $attval);
1710ad65 1743 $attary[$attname] = '"' . $attval . '"';
7e235a1a 1744 }
3d8371be 1745 } else if (preg_match("|[\w/>]|", $char)) {
691a2d25 1746 /**
8bd0068d 1747 * That was attribute type 4.
1748 */
1710ad65 1749 $attary[$attname] = '"yes"';
3d8371be 1750 } else {
1751 /**
8bd0068d 1752 * An illegal character. Find next '>' and return.
1753 */
3d8371be 1754 $gt = sq_findnxstr($body, $pos, ">");
1755 return Array(false, false, false, $lt, $gt);
451f74a2 1756 }
3d8371be 1757 break;
691a2d25 1758 }
1759 }
1760 /**
8bd0068d 1761 * The fact that we got here indicates that the tag end was never
1762 * found. Return invalid tag indication so it gets stripped.
1763 */
691a2d25 1764 return Array(false, false, false, $lt, strlen($body));
1765}
1766
1767/**
0493ed11 1768 * Translates entities into literal values so they can be checked.
8bd0068d 1769 *
0493ed11 1770 * @param $attvalue the by-ref value to check.
1771 * @param $regex the regular expression to check against.
1772 * @param $hex whether the entites are hexadecimal.
1773 * @return True or False depending on whether there were matches.
8bd0068d 1774 */
0493ed11 1775function sq_deent(&$attvalue, $regex, $hex=false){
b583c3e8 1776 $me = 'sq_deent';
0493ed11 1777 $ret_match = false;
2b665f28 1778 // remove comments
1779 //$attvalue = preg_replace("/(\/\*.*\*\/)/","",$attvalue);
0493ed11 1780 preg_match_all($regex, $attvalue, $matches);
1781 if (is_array($matches) && sizeof($matches[0]) > 0){
1782 $repl = Array();
1783 for ($i = 0; $i < sizeof($matches[0]); $i++){
1784 $numval = $matches[1][$i];
1785 if ($hex){
1786 $numval = hexdec($numval);
a3daaaf3 1787 }
1710ad65 1788 $repl[$matches[0][$i]] = chr($numval);
691a2d25 1789 }
0493ed11 1790 $attvalue = strtr($attvalue, $repl);
1791 return true;
1792 } else {
1793 return false;
691a2d25 1794 }
691a2d25 1795}
1796
1797/**
8bd0068d 1798 * This function runs various checks against the attributes.
1799 *
1800 * @param $tagname String with the name of the tag.
1801 * @param $attary Array with all tag attributes.
1802 * @param $rm_attnames See description for sq_sanitize
1803 * @param $bad_attvals See description for sq_sanitize
1804 * @param $add_attr_to_tag See description for sq_sanitize
1805 * @param $message message object
1806 * @param $id message id
1807 * @return Array with modified attributes.
1808 */
da2415c1 1809function sq_fixatts($tagname,
1810 $attary,
691a2d25 1811 $rm_attnames,
1812 $bad_attvals,
1813 $add_attr_to_tag,
1814 $message,
b3af12ef 1815 $id,
3d8371be 1816 $mailbox
691a2d25 1817 ){
b583c3e8 1818 $me = 'sq_fixatts';
c71c845c 1819 foreach ($attary as $attname => $attvalue){
691a2d25 1820 /**
8bd0068d 1821 * See if this attribute should be removed.
1822 */
691a2d25 1823 foreach ($rm_attnames as $matchtag=>$matchattrs){
1824 if (preg_match($matchtag, $tagname)){
1825 foreach ($matchattrs as $matchattr){
1826 if (preg_match($matchattr, $attname)){
1710ad65 1827 unset($attary[$attname]);
691a2d25 1828 continue;
1829 }
451f74a2 1830 }
451f74a2 1831 }
691a2d25 1832 }
1833 /**
2b665f28 1834 * Workaround for IE quirks
1835 */
1836 sq_fixIE_idiocy($attvalue);
1837
1838 /**
8bd0068d 1839 * Remove any backslashes, entities, and extraneous whitespace.
1840 */
2b665f28 1841
1842 $oldattvalue = $attvalue;
0493ed11 1843 sq_defang($attvalue);
2b665f28 1844 if ($attname == 'style' && $attvalue !== $oldattvalue) {
1845 // entities are used in the attribute value. In 99% of the cases it's there as XSS
1846 // i.e.<div style="{ left:exp&#x0280;essio&#x0274;( alert('XSS') ) }">
1847 $attvalue = "idiocy";
1710ad65 1848 $attary[$attname] = $attvalue;
2b665f28 1849 }
0493ed11 1850 sq_unspace($attvalue);
af861a34 1851
1852 /**
8bd0068d 1853 * Now let's run checks on the attvalues.
1854 * I don't expect anyone to comprehend this. If you do,
1855 * get in touch with me so I can drive to where you live and
1856 * shake your hand personally. :)
1857 */
691a2d25 1858 foreach ($bad_attvals as $matchtag=>$matchattrs){
1859 if (preg_match($matchtag, $tagname)){
1860 foreach ($matchattrs as $matchattr=>$valary){
1861 if (preg_match($matchattr, $attname)){
1862 /**
8bd0068d 1863 * There are two arrays in valary.
1864 * First is matches.
1865 * Second one is replacements
1866 */
691a2d25 1867 list($valmatch, $valrepl) = $valary;
da2415c1 1868 $newvalue =
691a2d25 1869 preg_replace($valmatch, $valrepl, $attvalue);
1870 if ($newvalue != $attvalue){
1710ad65 1871 $attary[$attname] = $newvalue;
567dc524 1872 $attvalue = $newvalue;
691a2d25 1873 }
1874 }
1875 }
451f74a2 1876 }
a3daaaf3 1877 }
567dc524 1878 if ($attname == 'style') {
1879 if (preg_match('/[\0-\37\200-\377]+/',$attvalue)) {
1880 // 8bit and control characters in style attribute values can be used for XSS, remove them
1710ad65 1881 $attary[$attname] = '"disallowed character"';
567dc524 1882 }
1883 preg_match_all("/url\s*\((.+)\)/si",$attvalue,$aMatch);
1884 if (count($aMatch)) {
1885 foreach($aMatch[1] as $sMatch) {
1886 // url value
1887 $urlvalue = $sMatch;
1888 sq_fix_url($attname, $urlvalue, $message, $id, $mailbox,"'");
1710ad65 1889 $attary[$attname] = str_replace($sMatch,$urlvalue,$attvalue);
567dc524 1890 }
1891 }
691a2d25 1892 }
ff940ebc 1893 /**
567dc524 1894 * Use white list based filtering on attributes which can contain url's
ff940ebc 1895 */
caf0ab1d 1896 else if ($attname == 'href' || $attname == 'xlink:href' || $attname == 'src'
1897 || $attname == 'poster' || $attname == 'formaction'
1898 || $attname == 'background' || $attname == 'action') {
567dc524 1899 sq_fix_url($attname, $attvalue, $message, $id, $mailbox);
1710ad65 1900 $attary[$attname] = $attvalue;
ff940ebc 1901 }
a3daaaf3 1902 }
691a2d25 1903 /**
8bd0068d 1904 * See if we need to append any attributes to this tag.
1905 */
691a2d25 1906 foreach ($add_attr_to_tag as $matchtag=>$addattary){
1907 if (preg_match($matchtag, $tagname)){
1908 $attary = array_merge($attary, $addattary);
1909 }
1910 }
1911 return $attary;
451f74a2 1912}
a3daaaf3 1913
691a2d25 1914/**
567dc524 1915 * This function filters url's
1916 *
1917 * @param $attvalue String with attribute value to filter
1918 * @param $message message object
1919 * @param $id message id
1920 * @param $mailbox mailbox
1921 * @param $sQuote quoting characters around url's
1922 */
1923function sq_fix_url($attname, &$attvalue, $message, $id, $mailbox,$sQuote = '"') {
1924 $attvalue = trim($attvalue);
1925 if ($attvalue && ($attvalue[0] =='"'|| $attvalue[0] == "'")) {
1926 // remove the double quotes
1927 $sQuote = $attvalue[0];
1928 $attvalue = trim(substr($attvalue,1,-1));
1929 }
1930
d31f73f1 1931 // If there's no "view_unsafe_images" variable in the URL, turn unsafe
1932 // images off by default.
afbf184c 1933 sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET, FALSE);
d31f73f1 1934
6ab8321f 1935 global $use_transparent_security_image;
1936 if ($use_transparent_security_image) $secremoveimg = '../images/spacer.png';
1937 else $secremoveimg = '../images/' . _("sec_remove_eng.png");
567dc524 1938
1939 /**
1940 * Replace empty src tags with the blank image. src is only used
1941 * for frames, images, and image inputs. Doing a replace should
1942 * not affect them working as should be, however it will stop
1943 * IE from being kicked off when src for img tags are not set
1944 */
1945 if ($attvalue == '') {
1946 $attvalue = '"' . SM_PATH . 'images/blank.png"';
1947 } else {
1948 // first, disallow 8 bit characters and control characters
1949 if (preg_match('/[\0-\37\200-\377]+/',$attvalue)) {
1950 switch ($attname) {
1951 case 'href':
1952 $attvalue = $sQuote . 'http://invalid-stuff-detected.example.com' . $sQuote;
1953 break;
1954 default:
1955 $attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote;
1956 break;
1957 }
1958 } else {
1959 $aUrl = parse_url($attvalue);
1960 if (isset($aUrl['scheme'])) {
1961 switch(strtolower($aUrl['scheme'])) {
d75e755b 1962 case 'mailto':
567dc524 1963 case 'http':
1964 case 'https':
1965 case 'ftp':
1966 if ($attname != 'href') {
1967 if ($view_unsafe_images == false) {
1968 $attvalue = $sQuote . $secremoveimg . $sQuote;
1969 } else {
1970 if (isset($aUrl['path'])) {
8bbbc757 1971
1972 // No one has been able to show that image URIs
1973 // can be exploited, so for now, no restrictions
1974 // are made at all. If this proves to be a problem,
1975 // the commented-out code below can be of help.
1976 // (One consideration is that I see nothing in this
1977 // function that specifically says that we will
1978 // only ever arrive here when inspecting an image
1979 // tag, although that does seem to be the end
1980 // result - e.g., <script src="..."> where malicious
1981 // image URIs are in fact a problem are already
1982 // filtered out elsewhere.
1983 /* ---------------------------------
567dc524 1984 // validate image extension.
1985 $ext = strtolower(substr($aUrl['path'],strrpos($aUrl['path'],'.')));
1986 if (!in_array($ext,array('.jpeg','.jpg','xjpeg','.gif','.bmp','.jpe','.png','.xbm'))) {
8bbbc757 1987 // If URI is to something other than
1988 // a regular image file, get the contents
1989 // and try to see if it is an image.
1990 // Don't use Fileinfo (finfo_file()) because
1991 // we'd need to make the admin configure the
1992 // location of the magic.mime file (FIXME: add finfo_file() support later?)
1993 //
1994 $mime_type = '';
1995 if (function_exists('mime_content_type')
1996 && ($FILE = @fopen($attvalue, 'rb', FALSE))) {
1997
1998 // fetch file
1999 //
2000 $file_contents = '';
2001 while (!feof($FILE)) {
2002 $file_contents .= fread($FILE, 8192);
2003 }
2004 fclose($FILE);
2005
2006 // store file locally
2007 //
2008 global $attachment_dir, $username;
2009 $hashed_attachment_dir = getHashedDir($username, $attachment_dir);
2010 $localfilename = GenerateRandomString(32, '', 7);
2011 $full_localfilename = "$hashed_attachment_dir/$localfilename";
2012 while (file_exists($full_localfilename)) {
2013 $localfilename = GenerateRandomString(32, '', 7);
2014 $full_localfilename = "$hashed_attachment_dir/$localfilename";
2015 }
2016 $FILE = fopen("$hashed_attachment_dir/$localfilename", 'wb');
2017 fwrite($FILE, $file_contents);
2018 fclose($FILE);
2019
2020 // get mime type and remove file
2021 //
2022 $mime_type = mime_content_type("$hashed_attachment_dir/$localfilename");
2023 unlink("$hashed_attachment_dir/$localfilename");
2024 }
2025 // debug: echo "$attvalue FILE TYPE IS $mime_type<HR>";
2026 if (substr(strtolower($mime_type), 0, 5) != 'image') {
2027 $attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote;
2028 }
567dc524 2029 }
8bbbc757 2030 --------------------------------- */
567dc524 2031 } else {
2032 $attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote;
2033 }
2034 }
cf088f55 2035 } else {
2036 $attvalue = $sQuote . $attvalue . $sQuote;
567dc524 2037 }
2038 break;
2039 case 'outbind':
2040 /**
2041 * "Hack" fix for Outlook using propriatary outbind:// protocol in img tags.
2042 * One day MS might actually make it match something useful, for now, falling
2043 * back to using cid2http, so we can grab the blank.png.
2044 */
cf088f55 2045 $attvalue = $sQuote . sq_cid2http($message, $id, $attvalue, $mailbox) . $sQuote;
567dc524 2046 break;
2047 case 'cid':
2048 /**
2049 * Turn cid: urls into http-friendly ones.
2050 */
cf088f55 2051 $attvalue = $sQuote . sq_cid2http($message, $id, $attvalue, $mailbox) . $sQuote;
567dc524 2052 break;
2053 default:
2054 $attvalue = $sQuote . SM_PATH . 'images/blank.png' . $sQuote;
2055 break;
2056 }
2057 } else {
b1fbb25f 2058 if (!isset($aUrl['path']) || $aUrl['path'] != $secremoveimg) {
567dc524 2059 // parse_url did not lead to satisfying result
2060 $attvalue = $sQuote . SM_PATH . 'images/blank.png' . $sQuote;
2061 }
2062 }
2063 }
2064 }
2065}
2066
2067/**
8bd0068d 2068 * This function edits the style definition to make them friendly and
2069 * usable in SquirrelMail.
2070 *
2071 * @param $message the message object
2072 * @param $id the message id
2073 * @param $content a string with whatever is between <style> and </style>
2074 * @param $mailbox the message mailbox
2075 * @return a string with edited content.
2076 */
e60a299a 2077function sq_fixstyle($body, $pos, $message, $id, $mailbox){
b583c3e8 2078 $me = 'sq_fixstyle';
7e2ff844 2079 // workaround for </style> in between comments
2080 $iCurrentPos = $pos;
2081 $content = '';
2082 $sToken = '';
2083 $bSucces = false;
2084 $bEndTag = false;
2085 for ($i=$pos,$iCount=strlen($body);$i<$iCount;++$i) {
1710ad65 2086 $char = $body[$i];
7e2ff844 2087 switch ($char) {
2088 case '<':
10c0caeb 2089 $sToken = $char;
7e2ff844 2090 break;
2091 case '/':
2092 if ($sToken == '<') {
2093 $sToken .= $char;
2094 $bEndTag = true;
2095 } else {
2096 $content .= $char;
2097 }
2098 break;
2099 case '>':
2100 if ($bEndTag) {
2101 $sToken .= $char;
2102 if (preg_match('/\<\/\s*style\s*\>/i',$sToken,$aMatch)) {
2103 $newpos = $i + 1;
2104 $bSucces = true;
2105 break 2;
2106 } else {
2107 $content .= $sToken;
2108 }
2109 $bEndTag = false;
2110 } else {
2111 $content .= $char;
2112 }
2113 break;
2114 case '!':
2115 if ($sToken == '<') {
2116 // possible comment
1710ad65 2117 if (isset($body[$i+2]) && substr($body,$i,3) == '!--') {
7e2ff844 2118 $i = strpos($body,'-->',$i+3);
2b665f28 2119 if ($i === false) { // no end comment
2120 $i = strlen($body);
2121 }
7e2ff844 2122 $sToken = '';
2123 }
2124 } else {
2125 $content .= $char;
2126 }
2127 break;
2128 default:
2129 if ($bEndTag) {
2130 $sToken .= $char;
2131 } else {
2132 $content .= $char;
2133 }
2134 break;
2135 }
2136 }
2137 if ($bSucces == FALSE){
7d06541f 2138 return array(FALSE, strlen($body));
2139 }
7e2ff844 2140
2b665f28 2141
2142
691a2d25 2143 /**
9ebace19 2144 * First look for general BODY style declaration, which would be
2145 * like so:
2146 * body {background: blah-blah}
2147 * and change it to .bodyclass so we can just assign it to a <div>
2148 */
7732acc6 2149 // $content = preg_replace("|body(\s*\{.*?\})|si", ".bodyclass\\1", $content);
d2f3a6fb 2150 // Nah, this is even better - try to preface all CSS selectors with
2151 // our <div> class ID "bodyclass" then correct generic "body" selectors
2152 // TODO: this works pretty good but breaks stuff like this:
2153 // @media print { body { font-size: 10pt; } }
2154 // but there isn't an easy way to make this regex skip @media
2155 // definitions... though lots of the ones in the wild will be
2156 // correctly handled because they tend to end with a parenthesis, like:
2157 // @media screen and (max-width:480px) { ...
2158 $content = preg_replace('/([a-z0-9._-][a-z0-9 >+~|:._-]*\s*(?:,|{.*?}))/si', '.bodyclass $1', $content);
2159 $content = str_replace('.bodyclass body', '.bodyclass', $content);
6ab8321f 2160
2161 global $use_transparent_security_image;
2162 if ($use_transparent_security_image) $secremoveimg = '../images/spacer.png';
2163 else $secremoveimg = '../images/' . _("sec_remove_eng.png");
2164
691a2d25 2165 /**
0493ed11 2166 * Fix url('blah') declarations.
2167 */
2168 // $content = preg_replace("|url\s*\(\s*([\'\"])\s*\S+script\s*:.*?([\'\"])\s*\)|si",
2169 // "url(\\1$secremoveimg\\2)", $content);
2b665f28 2170
567dc524 2171 // first check for 8bit sequences and disallowed control characters
2172 if (preg_match('/[\16-\37\200-\377]+/',$content)) {
2173 $content = '<!-- style block removed by html filter due to presence of 8bit characters -->';
2174 return array($content, $newpos);
2175 }
2176
2b665f28 2177 // IE Sucks hard. We have a special function for it.
2178 sq_fixIE_idiocy($content);
2179
2180 // remove @import line
2181 $content = preg_replace("/^\s*(@import.*)$/mi","\n<!-- @import rules forbidden -->\n",$content);
2182
5b4884be 2183 // translate ur\l and variations (IE parses that)
2b665f28 2184 // TODO check if the sq_fixIE_idiocy function already handles this.
5b4884be 2185 $content = preg_replace("/(\\\\)?u(\\\\)?r(\\\\)?l(\\\\)?/i", 'url', $content);
567dc524 2186 preg_match_all("/url\s*\((.+)\)/si",$content,$aMatch);
2187 if (count($aMatch)) {
2188 $aValue = $aReplace = array();
2189 foreach($aMatch[1] as $sMatch) {
2190 // url value
2191 $urlvalue = $sMatch;
2192 sq_fix_url('style',$urlvalue, $message, $id, $mailbox,"'");
2193 $aValue[] = $sMatch;
2194 $aReplace[] = $urlvalue;
0493ed11 2195 }
567dc524 2196 $content = str_replace($aValue,$aReplace,$content);
691a2d25 2197 }
567dc524 2198
9ebace19 2199 /**
2200 * Remove any backslashes, entities, and extraneous whitespace.
2201 */
0493ed11 2202 $contentTemp = $content;
2203 sq_defang($contentTemp);
2204 sq_unspace($contentTemp);
a3daaaf3 2205
691a2d25 2206 /**
8bd0068d 2207 * Fix stupid css declarations which lead to vulnerabilities
2208 * in IE.
39352565 2209 *
2210 * Also remove "position" attribute, as it can easily be set
2211 * to "fixed" or "absolute" with "left" and "top" attributes
2212 * of zero, taking over the whole content frame. It can also
2213 * be set to relative and move itself anywhere it wants to,
2214 * displaying content in areas it shouldn't be allowed to touch.
8bd0068d 2215 */
caf0ab1d 2216 $match = Array('/\/\*.*\*\//', // removes /* blah blah */
5db90261 2217 '/expression/i',
0493ed11 2218 '/behaviou*r/i',
2219 '/binding/i',
2b665f28 2220 '/include-source/i',
2221 '/javascript/i',
39352565 2222 '/script/i',
2223 '/position/i');
2224 $replace = Array('','idiocy', 'idiocy', 'idiocy', 'idiocy', 'idiocy', 'idiocy', '');
0493ed11 2225 $contentNew = preg_replace($match, $replace, $contentTemp);
2226 if ($contentNew !== $contentTemp) {
2227 // insecure css declarations are used. From now on we don't care
2228 // anymore if the css is destroyed by sq_deent, sq_unspace or sq_unbackslash
2229 $content = $contentNew;
2230 }
7d06541f 2231 return array($content, $newpos);
691a2d25 2232}
a3daaaf3 2233
0493ed11 2234
691a2d25 2235/**
8bd0068d 2236 * This function converts cid: url's into the ones that can be viewed in
2237 * the browser.
2238 *
2239 * @param $message the message object
2240 * @param $id the message id
2241 * @param $cidurl the cid: url.
2242 * @param $mailbox the message mailbox
2243 * @return a string with a http-friendly url
2244 */
b3af12ef 2245function sq_cid2http($message, $id, $cidurl, $mailbox){
691a2d25 2246 /**
8bd0068d 2247 * Get rid of quotes.
2248 */
691a2d25 2249 $quotchar = substr($cidurl, 0, 1);
2dd879b8 2250 if ($quotchar == '"' || $quotchar == "'"){
2251 $cidurl = str_replace($quotchar, "", $cidurl);
2252 } else {
2253 $quotchar = '';
2254 }
691a2d25 2255 $cidurl = substr(trim($cidurl), 4);
0493ed11 2256
2257 $match_str = '/\{.*?\}\//';
2258 $str_rep = '';
2259 $cidurl = preg_replace($match_str, $str_rep, $cidurl);
2260
e5e9381a 2261 $linkurl = find_ent_id($cidurl, $message);
9ebace19 2262 /* in case of non-safe cid links $httpurl should be replaced by a sort of
2263 unsafe link image */
e5e9381a 2264 $httpurl = '';
c8f5f606 2265
8bd0068d 2266 /**
2267 * This is part of a fix for Outlook Express 6.x generating
2268 * cid URLs without creating content-id headers. These images are
2269 * not part of the multipart/related html mail. The html contains
2270 * <img src="cid:{some_id}/image_filename.ext"> references to
2271 * attached images with as goal to render them inline although
2272 * the attachment disposition property is not inline.
2273 */
c8f5f606 2274
2275 if (empty($linkurl)) {
2276 if (preg_match('/{.*}\//', $cidurl)) {
2277 $cidurl = preg_replace('/{.*}\//','', $cidurl);
2278 if (!empty($cidurl)) {
2279 $linkurl = find_ent_id($cidurl, $message);
2280 }
2281 }
2282 }
f8a1ed5a 2283
c8f5f606 2284 if (!empty($linkurl)) {
fa26ab45 2285 $httpurl = $quotchar . sqm_baseuri() . 'src/download.php?absolute_dl=true&amp;' .
8bd0068d 2286 "passed_id=$id&amp;mailbox=" . urlencode($mailbox) .
2287 '&amp;ent_id=' . $linkurl . $quotchar;
c8f5f606 2288 } else {
2289 /**
2290 * If we couldn't generate a proper img url, drop in a blank image
2291 * instead of sending back empty, otherwise it causes unusual behaviour
2292 */
bc017c1d 2293 $httpurl = $quotchar . SM_PATH . 'images/blank.png' . $quotchar;
e5e9381a 2294 }
f8a1ed5a 2295
691a2d25 2296 return $httpurl;
2297}
2298
2299/**
8bd0068d 2300 * This function changes the <body> tag into a <div> tag since we
2301 * can't really have a body-within-body.
2302 *
2303 * @param $attary an array of attributes and values of <body>
2304 * @param $mailbox mailbox we're currently reading (for cid2http)
2305 * @param $message current message (for cid2http)
2306 * @param $id current message id (for cid2http)
2307 * @return a modified array of attributes to be set for <div>
2308 */
2dd879b8 2309function sq_body2div($attary, $mailbox, $message, $id){
b583c3e8 2310 $me = 'sq_body2div';
3d8371be 2311 $divattary = Array('class' => "'bodyclass'");
b583c3e8 2312 $text = '#000000';
c189a963 2313 $has_bgc_stl = $has_txt_stl = false;
b583c3e8 2314 $styledef = '';
691a2d25 2315 if (is_array($attary) && sizeof($attary) > 0){
2316 foreach ($attary as $attname=>$attvalue){
2317 $quotchar = substr($attvalue, 0, 1);
2318 $attvalue = str_replace($quotchar, "", $attvalue);
2319 switch ($attname){
3d8371be 2320 case 'background':
8bd0068d 2321 $attvalue = sq_cid2http($message, $id, $attvalue, $mailbox);
3d8371be 2322 $styledef .= "background-image: url('$attvalue'); ";
2323 break;
2324 case 'bgcolor':
c189a963 2325 $has_bgc_stl = true;
3d8371be 2326 $styledef .= "background-color: $attvalue; ";
2327 break;
2328 case 'text':
c189a963 2329 $has_txt_stl = true;
3d8371be 2330 $styledef .= "color: $attvalue; ";
2331 break;
691a2d25 2332 }
a3daaaf3 2333 }
c189a963 2334 // Outlook defines a white bgcolor and no text color. This can lead to
2335 // white text on a white bg with certain themes.
2336 if ($has_bgc_stl && !$has_txt_stl) {
2337 $styledef .= "color: $text; ";
2338 }
691a2d25 2339 if (strlen($styledef) > 0){
1710ad65 2340 $divattary["style"] = "\"$styledef\"";
691a2d25 2341 }
2342 }
2343 return $divattary;
2344}
a3daaaf3 2345
691a2d25 2346/**
8bd0068d 2347 * This is the main function and the one you should actually be calling.
2348 * There are several variables you should be aware of an which need
2349 * special description.
2350 *
2351 * Since the description is quite lengthy, see it here:
2352 * http://linux.duke.edu/projects/mini/htmlfilter/
2353 *
2354 * @param $body the string with HTML you wish to filter
2355 * @param $tag_list see description above
2356 * @param $rm_tags_with_content see description above
2357 * @param $self_closing_tags see description above
2358 * @param $force_tag_closing see description above
2359 * @param $rm_attnames see description above
2360 * @param $bad_attvals see description above
2361 * @param $add_attr_to_tag see description above
2362 * @param $message message object
2363 * @param $id message id
dfc64d14 2364 * @param $recursively_called boolean flag for recursive calls into this function (optional; default FALSE)
8bd0068d 2365 * @return sanitized html safe to show on your pages.
2366 */
da2415c1 2367function sq_sanitize($body,
8bd0068d 2368 $tag_list,
2369 $rm_tags_with_content,
2370 $self_closing_tags,
2371 $force_tag_closing,
2372 $rm_attnames,
2373 $bad_attvals,
2374 $add_attr_to_tag,
2375 $message,
2376 $id,
dfc64d14 2377 $mailbox,
2378 $recursively_called=FALSE
8bd0068d 2379 ){
b583c3e8 2380 $me = 'sq_sanitize';
dfc64d14 2381
2382 /**
2383 * See if tag_list is of tags to remove or tags to allow.
2384 * false means remove these tags
2385 * true means allow these tags
2386 */
2387 $orig_tag_list = $tag_list;
7d06541f 2388 $rm_tags = array_shift($tag_list);
dfc64d14 2389
691a2d25 2390 /**
8bd0068d 2391 * Normalize rm_tags and rm_tags_with_content.
2392 */
7d06541f 2393 @array_walk($tag_list, 'sq_casenormalize');
691a2d25 2394 @array_walk($rm_tags_with_content, 'sq_casenormalize');
2395 @array_walk($self_closing_tags, 'sq_casenormalize');
dfc64d14 2396
691a2d25 2397 $curpos = 0;
2398 $open_tags = Array();
2dd879b8 2399 $trusted = "\n<!-- begin sanitized html -->\n";
691a2d25 2400 $skip_content = false;
bb8d0799 2401 /**
8bd0068d 2402 * Take care of netscape's stupid javascript entities like
2403 * &{alert('boo')};
2404 */
bb8d0799 2405 $body = preg_replace("/&(\{.*?\};)/si", "&amp;\\1", $body);
691a2d25 2406
7d06541f 2407 while (($curtag = sq_getnxtag($body, $curpos)) != FALSE){
691a2d25 2408 list($tagname, $attary, $tagtype, $lt, $gt) = $curtag;
dfc64d14 2409
2410 /**
2411 * RCDATA and RAWTEXT tags are handled differently:
2412 * next instance of closing tag is used, whether or not
2413 * the HTML is well formed before that
2414 */
2415 global $rcdata_rawtext_tags;
2416 if (!$recursively_called
2417 && in_array($tagname, $rcdata_rawtext_tags)
2418 && $tagtype === 1){
2419 $closing_tag = false;
2420 $closing_tag_offset = $curpos;
2421 // seek out the closing tag for the current RCDATA/RAWTEXT tag
2422 while (1) {
2423 // first we need to move forward to next available closing tag
2424 // (intentionally leave off the closing > and let sq_getnxtag() validate a proper tag syntax)
2425 $next_tag = sq_findnxreg($body, $closing_tag_offset, "</\s*$tagname");
2426 if ($next_tag === false) {
2427 $closing_tag = false;
2428 break;
2429 }
2430 // but then we have to make sure it's a well-formed tag
2431 $closing_tag = sq_getnxtag($body, $next_tag[0]);
2432 if ($closing_tag === false)
2433 break;
2434 else if ($closing_tag[0] !== false
2435 // these should be redundant
2436 && $closing_tag[0] === $tagname && $closing_tag[2] === 2) {
2437 $trusted .= sq_sanitize(substr($body, $curpos, $closing_tag[4] - $curpos + 1),
2438 $orig_tag_list, $rm_tags_with_content, $self_closing_tags,
2439 $force_tag_closing, $rm_attnames, $bad_attvals, $add_attr_to_tag,
2440 $message, $id, $mailbox, true);
2441 $curpos = $closing_tag[4] + 1;
2442 continue 2;
2443 }
2444 $closing_tag_offset = $next_tag[0] + 1;
2445 }
2446 if ($closing_tag === false)
2447 { /* no-op... there was no closing tag for this RCDATA/RAWTEXT tag - we could probably set $curpos to the end of $body, but this HTML is malformed anyway and should just fall apart on its own */ }
2448 }
2449
691a2d25 2450 $free_content = substr($body, $curpos, $lt-$curpos);
2451 /**
8bd0068d 2452 * Take care of <style>
2453 */
7d06541f 2454 if ($tagname == "style" && $tagtype == 1){
da2415c1 2455 list($free_content, $curpos) =
e60a299a 2456 sq_fixstyle($body, $gt+1, $message, $id, $mailbox);
7d06541f 2457 if ($free_content != FALSE){
1d398b1d 2458 if ( !empty($attary) ) {
2459 $attary = sq_fixatts($tagname,
2460 $attary,
2461 $rm_attnames,
2462 $bad_attvals,
2463 $add_attr_to_tag,
2464 $message,
2465 $id,
2466 $mailbox
2467 );
2468 }
7d06541f 2469 $trusted .= sq_tagprint($tagname, $attary, $tagtype);
2470 $trusted .= $free_content;
2471 $trusted .= sq_tagprint($tagname, false, 2);
2472 }
2473 continue;
691a2d25 2474 }
2475 if ($skip_content == false){
2476 $trusted .= $free_content;
691a2d25 2477 }
2478 if ($tagname != FALSE){
2479 if ($tagtype == 2){
2480 if ($skip_content == $tagname){
2481 /**
8bd0068d 2482 * Got to the end of tag we needed to remove.
2483 */
691a2d25 2484 $tagname = false;
2485 $skip_content = false;
2486 } else {
2487 if ($skip_content == false){
c828931c 2488 if ($tagname == "body"){
2489 $tagname = "div";
2dd879b8 2490 }
1710ad65 2491 if (isset($open_tags[$tagname]) &&
2492 $open_tags[$tagname] > 0){
2493 $open_tags[$tagname]--;
691a2d25 2494 } else {
2dd879b8 2495 $tagname = false;
691a2d25 2496 }
691a2d25 2497 }
2498 }
2499 } else {
2500 /**
8bd0068d 2501 * $rm_tags_with_content
2502 */
691a2d25 2503 if ($skip_content == false){
2504 /**
8bd0068d 2505 * See if this is a self-closing type and change
2506 * tagtype appropriately.
2507 */
691a2d25 2508 if ($tagtype == 1
8bd0068d 2509 && in_array($tagname, $self_closing_tags)){
2dd879b8 2510 $tagtype = 3;
691a2d25 2511 }
2512 /**
8bd0068d 2513 * See if we should skip this tag and any content
2514 * inside it.
2515 */
691a2d25 2516 if ($tagtype == 1 &&
8bd0068d 2517 in_array($tagname, $rm_tags_with_content)){
691a2d25 2518 $skip_content = $tagname;
2519 } else {
da2415c1 2520 if (($rm_tags == false
8bd0068d 2521 && in_array($tagname, $tag_list)) ||
2522 ($rm_tags == true &&
2523 !in_array($tagname, $tag_list))){
691a2d25 2524 $tagname = false;
2525 } else {
2dd879b8 2526 /**
8bd0068d 2527 * Convert body into div.
2528 */
2dd879b8 2529 if ($tagname == "body"){
2530 $tagname = "div";
da2415c1 2531 $attary = sq_body2div($attary, $mailbox,
8bd0068d 2532 $message, $id);
2dd879b8 2533 }
691a2d25 2534 if ($tagtype == 1){
1710ad65 2535 if (isset($open_tags[$tagname])){
2536 $open_tags[$tagname]++;
691a2d25 2537 } else {
1710ad65 2538 $open_tags[$tagname]=1;
691a2d25 2539 }
2540 }
2541 /**
8bd0068d 2542 * This is where we run other checks.
2543 */
691a2d25 2544 if (is_array($attary) && sizeof($attary) > 0){
2545 $attary = sq_fixatts($tagname,
8bd0068d 2546 $attary,
2547 $rm_attnames,
2548 $bad_attvals,
2549 $add_attr_to_tag,
2550 $message,
2551 $id,
2552 $mailbox
2553 );
691a2d25 2554 }
2555 }
2556 }
691a2d25 2557 }
2558 }
2559 if ($tagname != false && $skip_content == false){
2560 $trusted .= sq_tagprint($tagname, $attary, $tagtype);
2561 }
691a2d25 2562 }
2563 $curpos = $gt+1;
a3daaaf3 2564 }
691a2d25 2565 $trusted .= substr($body, $curpos, strlen($body)-$curpos);
2566 if ($force_tag_closing == true){
2567 foreach ($open_tags as $tagname=>$opentimes){
2568 while ($opentimes > 0){
2569 $trusted .= '</' . $tagname . '>';
2570 $opentimes--;
2571 }
2572 }
2573 $trusted .= "\n";
2574 }
2575 $trusted .= "<!-- end sanitized html -->\n";
2576 return $trusted;
2577}
451f74a2 2578
691a2d25 2579/**
8bd0068d 2580 * This is a wrapper function to call html sanitizing routines.
2581 *
2582 * @param $body the body of the message
2583 * @param $id the id of the message
c189a963 2584
2585 * @param $message
2586 * @param $mailbox
2587 * @param boolean $take_mailto_links When TRUE, converts mailto: links
2588 * into internal SM compose links
2589 * (optional; default = TRUE)
8bd0068d 2590 * @return a string with html safe to display in the browser.
2591 */
c189a963 2592function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links =true) {
2593
202bcbcc 2594 // require_once(SM_PATH . 'functions/url_parser.php'); // for $MailTo_PReg_Match
c189a963 2595
691a2d25 2596 global $attachment_common_show_images, $view_unsafe_images,
dfc64d14 2597 $has_unsafe_images, $allow_svg_display, $rcdata_rawtext_tags,
2598 $remove_rcdata_rawtext_tags_and_content;
2599
2600 $rcdata_rawtext_tags = array(
2601 "noscript",
2602 "noframes",
2603 "noembed",
2604 "textarea",
2605 // also "title", "xmp", "script", "iframe", "plaintext" which we already remove below
2606 );
2607
691a2d25 2608 /**
8bd0068d 2609 * Don't display attached images in HTML mode.
2b665f28 2610 *
d0187bd6 2611 * SB: why?
8bd0068d 2612 */
691a2d25 2613 $attachment_common_show_images = false;
2614 $tag_list = Array(
dfc64d14 2615 false, // remove these tags
8bd0068d 2616 "meta",
2617 "html",
2618 "head",
2619 "base",
2620 "link",
2621 "frame",
2622 "iframe",
2623 "plaintext",
caf0ab1d 2624 "marquee",
8bd0068d 2625 );
691a2d25 2626
2627 $rm_tags_with_content = Array(
8bd0068d 2628 "script",
caf0ab1d 2629 "object",
8bd0068d 2630 "applet",
2631 "embed",
2632 "title",
2633 "frameset",
0493ed11 2634 "xmp",
caf0ab1d 2635 "xml",
8bd0068d 2636 );
c88cef21 2637 if (!$allow_svg_display)
caf0ab1d 2638 $rm_tags_with_content[] = 'svg';
dfc64d14 2639 /**
2640 * SquirrelMail will parse RCDATA and RAWTEXT tags and handle them as the special
2641 * case that they are, but if you prefer to remove them and their contents entirely
2642 * (in most cases, should be a safe thing with minimal impact), you can add the
2643 * following to config/config_local.php
2644 * $remove_rcdata_rawtext_tags_and_content = TRUE;
2645 */
2646 if ($remove_rcdata_rawtext_tags_and_content)
2647 $rm_tags_with_content = array_merge($rm_tags_with_content, $rcdata_rawtext_tags);
691a2d25 2648
2649 $self_closing_tags = Array(
8bd0068d 2650 "img",
2651 "br",
2652 "hr",
2653 "input",
caf0ab1d 2654 "outbind",
8bd0068d 2655 );
691a2d25 2656
2dd879b8 2657 $force_tag_closing = true;
691a2d25 2658
2659 $rm_attnames = Array(
8bd0068d 2660 "/.*/" =>
2661 Array(
2662 "/target/i",
2663 "/^on.*/i",
2664 "/^dynsrc/i",
2665 "/^data.*/i",
caf0ab1d 2666 "/^lowsrc.*/i",
8bd0068d 2667 )
2668 );
691a2d25 2669
6ab8321f 2670 global $use_transparent_security_image;
2671 if ($use_transparent_security_image) $secremoveimg = '../images/spacer.png';
2672 else $secremoveimg = '../images/' . _("sec_remove_eng.png");
2673
691a2d25 2674 $bad_attvals = Array(
8bd0068d 2675 "/.*/" =>
691a2d25 2676 Array(
0a6ec9b5 2677 "/^src|background/i" =>
8bd0068d 2678 Array(
691a2d25 2679 Array(
8bd0068d 2680 "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
2681 "/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
2682 "/^([\'\"])\s*about\s*:.*([\'\"])/si"
691a2d25 2683 ),
8bd0068d 2684 Array(
2685 "\\1$secremoveimg\\2",
2686 "\\1$secremoveimg\\2",
2687 "\\1$secremoveimg\\2",
8bd0068d 2688 )
2689 ),
0a6ec9b5 2690 "/^href|action/i" =>
8bd0068d 2691 Array(
0a6ec9b5 2692 Array(
8bd0068d 2693 "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
2694 "/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
2695 "/^([\'\"])\s*about\s*:.*([\'\"])/si"
0a6ec9b5 2696 ),
691a2d25 2697 Array(
8bd0068d 2698 "\\1#\\1",
2699 "\\1#\\1",
8bd0068d 2700 "\\1#\\1"
02474e43 2701 )
8bd0068d 2702 ),
2703 "/^style/i" =>
2704 Array(
2705 Array(
5db90261 2706 "/\/\*.*\*\//",
8bd0068d 2707 "/expression/i",
2708 "/binding/i",
2709 "/behaviou*r/i",
2710 "/include-source/i",
39352565 2711
2712 // position:relative can also be exploited
2713 // to put content outside of email body area
2714 // and position:fixed is similarly exploitable
2715 // as position:absolute, so we'll remove it
2716 // altogether....
2717 //
2718 // Does this screw up legitimate HTML messages?
2719 // If so, the only fix I see is to allow position
2720 // attributes (any values? I think we still have
2721 // to block static and fixed) only if $use_iframe
2722 // is enabled (1.5.0+)
2723 //
2724 // was: "/position\s*:\s*absolute/i",
2725 //
2726 "/position\s*:/i",
2727
1d935bc2 2728 "/(\\\\)?u(\\\\)?r(\\\\)?l(\\\\)?/i",
8bd0068d 2729 "/url\s*\(\s*([\'\"])\s*\S+script\s*:.*([\'\"])\s*\)/si",
2730 "/url\s*\(\s*([\'\"])\s*mocha\s*:.*([\'\"])\s*\)/si",
2731 "/url\s*\(\s*([\'\"])\s*about\s*:.*([\'\"])\s*\)/si",
39352565 2732 "/(.*)\s*:\s*url\s*\(\s*([\'\"]*)\s*\S+script\s*:.*([\'\"]*)\s*\)/si",
8bd0068d 2733 ),
2734 Array(
5db90261 2735 "",
8bd0068d 2736 "idiocy",
2737 "idiocy",
2738 "idiocy",
2739 "idiocy",
567dc524 2740 "idiocy",
5b4884be 2741 "url",
8bd0068d 2742 "url(\\1#\\1)",
2743 "url(\\1#\\1)",
2744 "url(\\1#\\1)",
8bd0068d 2745 "\\1:url(\\2#\\3)"
2746 )
691a2d25 2747 )
8bd0068d 2748 )
691a2d25 2749 );
9ebace19 2750
d31f73f1 2751 // If there's no "view_unsafe_images" variable in the URL, turn unsafe
2752 // images off by default.
afbf184c 2753 sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET, FALSE);
9ebace19 2754
691a2d25 2755 if (!$view_unsafe_images){
2756 /**
8bd0068d 2757 * Remove any references to http/https if view_unsafe_images set
2758 * to false.
2759 */
1710ad65 2760 array_push($bad_attvals['/.*/']['/^src|background/i'][0],
8bd0068d 2761 '/^([\'\"])\s*https*:.*([\'\"])/si');
1710ad65 2762 array_push($bad_attvals['/.*/']['/^src|background/i'][1],
8bd0068d 2763 "\\1$secremoveimg\\1");
1710ad65 2764 array_push($bad_attvals['/.*/']['/^style/i'][0],
7ef0b415 2765 '/url\([\'\"]?https?:[^\)]*[\'\"]?\)/si');
1710ad65 2766 array_push($bad_attvals['/.*/']['/^style/i'][1],
8bd0068d 2767 "url(\\1$secremoveimg\\1)");
691a2d25 2768 }
451f74a2 2769
691a2d25 2770 $add_attr_to_tag = Array(
8bd0068d 2771 "/^a$/i" =>
c25f2fbb 2772 Array('target'=>'"_blank"',
02474e43 2773 'title'=>'"'._("This external link will open in a new window").'"'
8bd0068d 2774 )
2775 );
da2415c1 2776 $trusted = sq_sanitize($body,
8bd0068d 2777 $tag_list,
2778 $rm_tags_with_content,
2779 $self_closing_tags,
2780 $force_tag_closing,
2781 $rm_attnames,
2782 $bad_attvals,
2783 $add_attr_to_tag,
2784 $message,
2785 $id,
2786 $mailbox
2787 );
567dc524 2788 if (strpos($trusted,$secremoveimg)){
691a2d25 2789 $has_unsafe_images = true;
da2415c1 2790 }
c189a963 2791
2792 // we want to parse mailto's in HTML output, change to SM compose links
2793 // this is a modified version of code from url_parser.php... but Marc is
2794 // right: we need a better filtering implementation; adding this randomly
2795 // here is not a great solution
2796 //
2797 if ($take_mailto_links) {
2798 // parseUrl($trusted); // this even parses URLs inside of tags... too aggressive
2799 global $MailTo_PReg_Match;
7196da62 2800 // some mailers (Microsoft, surprise surprise) produce mailto strings without being
2801 // inside an anchor (link) tag, so we have to make sure the regex looks for the
2802 // quote before mailto, and we'll also try to convert the non-links back into links
2803 $MailTo_PReg_Match = '/([\'"])?mailto:' . substr($MailTo_PReg_Match, 1) ;
c189a963 2804 if ((preg_match_all($MailTo_PReg_Match, $trusted, $regs)) && ($regs[0][0] != '')) {
2805 foreach ($regs[0] as $i => $mailto_before) {
7196da62 2806 $mailto_params = $regs[11][$i];
2807
2808 // get rid of any leading quote we may have captured but don't care about
2809 //
2810 $mailto_before = ltrim($mailto_before, '"\'');
2811
c189a963 2812 // get rid of any tailing quote since we have to add send_to to the end
2813 //
7196da62 2814 $mailto_before = rtrim($mailto_before, '"\'');
2815 $mailto_params = rtrim($mailto_params, '"\'');
c189a963 2816
7196da62 2817 if ($regs[2][$i]) { //if there is an email addr before '?', we need to merge it with the params
2818 $to = 'to=' . $regs[2][$i];
c189a963 2819 if (strpos($mailto_params, 'to=') > -1) //already a 'to='
2820 $mailto_params = str_replace('to=', $to . '%2C%20', $mailto_params);
2821 else {
2822 if ($mailto_params) //already some params, append to them
2823 $mailto_params .= '&amp;' . $to;
2824 else
2825 $mailto_params .= '?' . $to;
2826 }
2827 }
2828
2829 $url_str = preg_replace(array('/to=/i', '/(?<!b)cc=/i', '/bcc=/i'), array('send_to=', 'send_to_cc=', 'send_to_bcc='), $mailto_params);
2830
2831 // we'll already have target=_blank, no need to allow comp_in_new
2832 // here (which would be a lot more work anyway)
2833 //
2834 global $compose_new_win;
2835 $temp_comp_in_new = $compose_new_win;
2836 $compose_new_win = 0;
2837 $comp_uri = makeComposeLink('src/compose.php' . $url_str, $mailto_before);
2838 $compose_new_win = $temp_comp_in_new;
2839
2840 // remove <a href=" and anything after the next quote (we only
2841 // need the uri, not the link HTML) in compose uri
2842 //
7196da62 2843 // but only do this if the original mailto was in a real anchor tag
2844 //
2845 if (!empty($regs[1][$i])) {
2846 $comp_uri = substr($comp_uri, 9);
2847 $comp_uri = substr($comp_uri, 0, strpos($comp_uri, '"', 1));
2848 }
c189a963 2849 $trusted = str_replace($mailto_before, $comp_uri, $trusted);
2850 }
2851 }
2852 }
2853
691a2d25 2854 return $trusted;
451f74a2 2855}
a4a70693 2856
da2415c1 2857/**
8bd0068d 2858 * function SendDownloadHeaders - send file to the browser
2859 *
2860 * Original Source: SM core src/download.php
2861 * moved here to make it available to other code, and separate
2862 * front end from back end functionality.
2863 *
2864 * @param string $type0 first half of mime type
2865 * @param string $type1 second half of mime type
2866 * @param string $filename filename to tell the browser for downloaded file
2867 * @param boolean $force whether to force the download dialog to pop
2868 * @param optional integer $filesize send the Content-Header and length to the browser
2869 * @return void
2870 */
02474e43 2871function SendDownloadHeaders($type0, $type1, $filename, $force, $filesize=0) {
2872 global $languages, $squirrelmail_language;
cfffd60b 2873 $isIE = $isIE6plus = false;
02474e43 2874
2875 sqgetGlobalVar('HTTP_USER_AGENT', $HTTP_USER_AGENT, SQ_SERVER);
2876
2877 if (strstr($HTTP_USER_AGENT, 'compatible; MSIE ') !== false &&
8bd0068d 2878 strstr($HTTP_USER_AGENT, 'Opera') === false) {
cfffd60b 2879 $isIE = true;
02474e43 2880 }
2881
cfffd60b 2882 if (preg_match('/compatible; MSIE ([0-9]+)/', $HTTP_USER_AGENT, $match) &&
2883 ((int)$match[1]) >= 6 && strstr($HTTP_USER_AGENT, 'Opera') === false) {
2884 $isIE6plus = true;
02474e43 2885 }
2886
2887 if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
8bd0068d 2888 function_exists($languages[$squirrelmail_language]['XTRA_CODE'] . '_downloadfilename')) {
02474e43 2889 $filename =
8bd0068d 2890 call_user_func($languages[$squirrelmail_language]['XTRA_CODE'] . '_downloadfilename', $filename, $HTTP_USER_AGENT);
02474e43 2891 } else {
1a4bc4a6 2892 $filename = preg_replace('/[\\\\\/:*?"<>|;]/', '_', str_replace('&nbsp;', ' ', $filename));
02474e43 2893 }
2894
2895 // A Pox on Microsoft and it's Internet Explorer!
2896 //
2897 // IE has lots of bugs with file downloads.
2898 // It also has problems with SSL. Both of these cause problems
2899 // for us in this function.
2900 //
2901 // See this article on Cache Control headers and SSL
2902 // http://support.microsoft.com/default.aspx?scid=kb;en-us;323308
2903 //
2904 // The best thing you can do for IE is to upgrade to the latest
2905 // version
2906 //set all the Cache Control Headers for IE
2907 if ($isIE) {
2908 $filename=rawurlencode($filename);
2909 header ("Pragma: public");
8bd0068d 2910 header ("Cache-Control: no-store, max-age=0, no-cache, must-revalidate"); // HTTP/1.1
c2503a4e 2911 // does nothing - see: https://blogs.msdn.microsoft.com/ieinternals/2009/07/20/internet-explorers-cache-control-extensions/
2912 // header ("Cache-Control: post-check=0, pre-check=0", false);
8bd0068d 2913 header ("Cache-Control: private");
02474e43 2914
2915 //set the inline header for IE, we'll add the attachment header later if we need it
2916 header ("Content-Disposition: inline; filename=$filename");
2917 }
2918
2919 if (!$force) {
2920 // Try to show in browser window
2921 header ("Content-Disposition: inline; filename=\"$filename\"");
2922 header ("Content-Type: $type0/$type1; name=\"$filename\"");
2923 } else {
2924 // Try to pop up the "save as" box
2925
2926 // IE makes this hard. It pops up 2 save boxes, or none.
2927 // http://support.microsoft.com/support/kb/articles/Q238/5/88.ASP
2928 // http://support.microsoft.com/default.aspx?scid=kb;EN-US;260519
2929 // But, according to Microsoft, it is "RFC compliant but doesn't
2930 // take into account some deviations that allowed within the
2931 // specification." Doesn't that mean RFC non-compliant?
2932 // http://support.microsoft.com/support/kb/articles/Q258/4/52.ASP
2933
2934 // all browsers need the application/octet-stream header for this
2935 header ("Content-Type: application/octet-stream; name=\"$filename\"");
2936
2937 // http://support.microsoft.com/support/kb/articles/Q182/3/15.asp
2938 // Do not have quotes around filename, but that applied to
2939 // "attachment"... does it apply to inline too?
2940 header ("Content-Disposition: attachment; filename=\"$filename\"");
2941
cfffd60b 2942 if ($isIE && !$isIE6plus) {
02474e43 2943 // This combination seems to work mostly. IE 5.5 SP 1 has
2944 // known issues (see the Microsoft Knowledge Base)
2945
2946 // This works for most types, but doesn't work with Word files
2947 header ("Content-Type: application/download; name=\"$filename\"");
7e2ff844 2948 header ("Content-Type: application/force-download; name=\"$filename\"");
02474e43 2949 // These are spares, just in case. :-)
2950 //header("Content-Type: $type0/$type1; name=\"$filename\"");
2951 //header("Content-Type: application/x-msdownload; name=\"$filename\"");
2952 //header("Content-Type: application/octet-stream; name=\"$filename\"");
7e2ff844 2953 } else if ($isIE) {
2954 // This is to prevent IE for MIME sniffing and auto open a file in IE
2955 header ("Content-Type: application/force-download; name=\"$filename\"");
02474e43 2956 } else {
2957 // another application/octet-stream forces download for Netscape
2958 header ("Content-Type: application/octet-stream; name=\"$filename\"");
2959 }
2960 }
2961
2962 //send the content-length header if the calling function provides it
2963 if ($filesize > 0) {
2964 header("Content-Length: $filesize");
2965 }
07c49f57 2966
8d863f64 2967} // end fn SendDownloadHeaders