projects / squirrelmail.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
info about disabled feature
[squirrelmail.git] / functions / mime.php
CommitLineData
59177427 1<?php
2ba13803 2
35586184 3/**
4 * mime.php
5 *
76911253 6 * Copyright (c) 1999-2003 The SquirrelMail Project Team
35586184 7 * Licensed under the GNU GPL. For full terms see the file COPYING.
8 *
9 * This contains the functions necessary to detect and decode MIME
10 * messages.
11 *
12 * $Id$
d6c32258 13 * @package squirrelmail
35586184 14 */
b74ba498 15
d6c32258 16/** The typical includes... */
b68edc75 17require_once(SM_PATH . 'functions/imap.php');
18require_once(SM_PATH . 'functions/attachment_common.php');
8beafbbc 19
7c7b74b3 20/* -------------------------------------------------------------------------- */
21/* MIME DECODING */
22/* -------------------------------------------------------------------------- */
b74ba498 23
d6c32258 24/**
25 * Get the MIME structure
26 *
27 * This function gets the structure of a message and stores it in the "message" class.
451f74a2 28 * It will return this object for use with all relevant header information and
29 * fully parsed into the standard "message" object format.
30 */
a4a70693 31function mime_structure ($bodystructure, $flags=array()) {
c9d78ab4 32
3d8371be 33 /* Isolate the body structure and remove beginning and end parenthesis. */
a4a70693 34 $read = trim(substr ($bodystructure, strpos(strtolower($bodystructure), 'bodystructure') + 13));
451f74a2 35 $read = trim(substr ($read, 0, -1));
22efa9fb 36 $i = 0;
37 $msg = Message::parseStructure($read,$i);
9de42168 38 if (!is_object($msg)) {
bd9c880b 39 include_once(SM_PATH . 'functions/display_messages.php');
3d8371be 40 global $color, $mailbox;
c96c32f4 41 /* removed urldecode because $_GET is auto urldecoded ??? */
a48eba8f 42 displayPageHeader( $color, $mailbox );
5e8de8b6 43 $errormessage = _("SquirrelMail could not decode the bodystructure of the message");
3d8371be 44 $errormessage .= '<BR>'._("the provided bodystructure by your imap-server").':<BR><BR>';
472e7acb 45 $errormessage .= '<pre>' . htmlspecialchars($read) . '</pre>';
9de42168 46 plain_error_message( $errormessage, $color );
3d8371be 47 echo '</body></html>';
9de42168 48 exit;
49 }
a4a70693 50 if (count($flags)) {
7a9e9c89 51 foreach ($flags as $flag) {
52 $char = strtoupper($flag{1});
53 switch ($char) {
3d8371be 54 case 'S':
55 if (strtolower($flag) == '\\seen') {
56 $msg->is_seen = true;
57 }
58 break;
59 case 'A':
60 if (strtolower($flag) == '\\answered') {
61 $msg->is_answered = true;
62 }
63 break;
64 case 'D':
65 if (strtolower($flag) == '\\deleted') {
66 $msg->is_deleted = true;
67 }
68 break;
69 case 'F':
70 if (strtolower($flag) == '\\flagged') {
71 $msg->is_flagged = true;
72 }
73 break;
74 case 'M':
75 if (strtolower($flag) == '$mdnsent') {
76 $msg->is_mdnsent = true;
77 }
78 break;
79 default:
80 break;
7a9e9c89 81 }
82 }
451f74a2 83 }
7a9e9c89 84 // listEntities($msg);
3d8371be 85 return $msg;
451f74a2 86}
b74ba498 87
22efa9fb 88
89
3d8371be 90/* This starts the parsing of a particular structure. It is called recursively,
451f74a2 91 * so it can be passed different structures. It returns an object of type
92 * $message.
93 * First, it checks to see if it is a multipart message. If it is, then it
94 * handles that as it sees is necessary. If it is just a regular entity,
95 * then it parses it and adds the necessary header information (by calling out
96 * to mime_get_elements()
97 */
451f74a2 98
4d592352 99function mime_fetch_body($imap_stream, $id, $ent_id=1, $fetch_size=0) {
da2415c1 100 global $uid_support;
3d8371be 101 /* Do a bit of error correction. If we couldn't find the entity id, just guess
09a4bde3 102 * that it is the first one. That is usually the case anyway.
103 */
7c7b74b3 104
09a4bde3 105 if (!$ent_id) {
08b7f7cc 106 $cmd = "FETCH $id BODY[]";
1035e159 107 } else {
08b7f7cc 108 $cmd = "FETCH $id BODY[$ent_id]";
09a4bde3 109 }
3d8371be 110
4d592352 111 if ($fetch_size!=0) $cmd .= "<0.$fetch_size>";
da2415c1 112
a4a70693 113 $data = sqimap_run_command ($imap_stream, $cmd, true, $response, $message, $uid_support);
77b88425 114 do {
3d8371be 115 $topline = trim(array_shift($data));
116 } while($topline && ($topline[0] == '*') && !preg_match('/\* [0-9]+ FETCH.*/i', $topline)) ;
a4a70693 117
451f74a2 118 $wholemessage = implode('', $data);
119 if (ereg('\\{([^\\}]*)\\}', $topline, $regs)) {
3d8371be 120 $ret = substr($wholemessage, 0, $regs[1]);
121 /* There is some information in the content info header that could be important
122 * in order to parse html messages. Let's get them here.
123 */
0600bdf1 124// if ($ret{0} == '<') {
125// $data = sqimap_run_command ($imap_stream, "FETCH $id BODY[$ent_id.MIME]", true, $response, $message, $uid_support);
126// }
451f74a2 127 } else if (ereg('"([^"]*)"', $topline, $regs)) {
128 $ret = $regs[1];
129 } else {
130 global $where, $what, $mailbox, $passed_id, $startMessage;
3d8371be 131 $par = 'mailbox=' . urlencode($mailbox) . '&amp;passed_id=' . $passed_id;
451f74a2 132 if (isset($where) && isset($what)) {
3d8371be 133 $par .= '&amp;where=' . urlencode($where) . '&amp;what=' . urlencode($what);
a3daaaf3 134 } else {
3d8371be 135 $par .= '&amp;startMessage=' . $startMessage . '&amp;show_more=0';
451f74a2 136 }
e5ea9327 137 $par .= '&amp;response=' . urlencode($response) .
3d8371be 138 '&amp;message=' . urlencode($message) .
139 '&amp;topline=' . urlencode($topline);
a019eeb8 140
346817d4 141 echo '<tt><br>' .
142 '<table width="80%"><tr>' .
143 '<tr><td colspan=2>' .
0e5b61b4 144 _("Body retrieval error. The reason for this is most probably that the message is malformed.") .
346817d4 145 '</td></tr>' .
0e5b61b4 146 '<tr><td><b>' . _("Command:") . "</td><td>$cmd</td></tr>" .
147 '<tr><td><b>' . _("Response:") . "</td><td>$response</td></tr>" .
148 '<tr><td><b>' . _("Message:") . "</td><td>$message</td></tr>" .
149 '<tr><td><b>' . _("FETCH line:") . "</td><td>$topline</td></tr>" .
346817d4 150 "</table><BR></tt></font><hr>";
151
a4a70693 152 $data = sqimap_run_command ($imap_stream, "FETCH $passed_id BODY[]", true, $response, $message, $uid_support);
451f74a2 153 array_shift($data);
154 $wholemessage = implode('', $data);
a019eeb8 155
346817d4 156 $ret = $wholemessage;
a3daaaf3 157 }
3d8371be 158 return $ret;
451f74a2 159}
d4467150 160
1035e159 161function mime_print_body_lines ($imap_stream, $id, $ent_id=1, $encoding) {
a4a70693 162 global $uid_support;
1035e159 163
3d8371be 164 /* Don't kill the connection if the browser is over a dialup
165 * and it would take over 30 seconds to download it.
7e6ca3e8 166 * Dont call set_time_limit in safe mode.
3d8371be 167 */
b7206e1d 168
3d8371be 169 if (!ini_get('safe_mode')) {
b7206e1d 170 set_time_limit(0);
171 }
7c7b74b3 172 /* in case of base64 encoded attachments, do not buffer them.
173 Instead, echo the decoded attachment directly to screen */
174 if (strtolower($encoding) == 'base64') {
175 if (!$ent_id) {
176 $query = "FETCH $id BODY[]";
177 } else {
178 $query = "FETCH $id BODY[$ent_id]";
179 }
180 sqimap_run_command($imap_stream,$query,true,$response,$message,$uid_support,'sqimap_base64_decode','php://stdout',true);
1d142b8d 181 } else {
7c7b74b3 182 $body = mime_fetch_body ($imap_stream, $id, $ent_id);
183 echo decodeBody($body, $encoding);
1d142b8d 184 }
346817d4 185
da2415c1 186 /*
7c7b74b3 187 TODO, use the same method for quoted printable.
188 However, I assume that quoted printable attachments aren't that large
189 so the performancegain / memory usage drop will be minimal.
190 If we decide to add that then we need to adapt sqimap_fread because
da2415c1 191 we need to split te result on \n and fread doesn't stop at \n. That
7c7b74b3 192 means we also should provide $results from sqimap_fread (by ref) to
193 te function and set $no_return to false. The $filter function for
da2415c1 194 quoted printable should handle unsetting of $results.
7c7b74b3 195 */
da2415c1 196 /*
7c7b74b3 197 TODO 2: find out how we write to the output stream php://stdout. fwrite
198 doesn't work because 'php://stdout isn't a stream.
199 */
200
5d9c6f73 201 return;
202/*
451f74a2 203 fputs ($imap_stream, "$sid FETCH $id BODY[$ent_id]\r\n");
204 $cnt = 0;
205 $continue = true;
1d142b8d 206 $read = fgets ($imap_stream,8192);
207
208
451f74a2 209 // This could be bad -- if the section has sqimap_session_id() . ' OK'
210 // or similar, it will kill the download.
1d142b8d 211 while (!ereg("^".$sid_s." (OK|BAD|NO)(.*)$", $read, $regs)) {
5d9c6f73 212 if (trim($read) == ')==') {
213 $read1 = $read;
214 $read = fgets ($imap_stream,4096);
215 if (ereg("^".$sid." (OK|BAD|NO)(.*)$", $read, $regs)) {
216 return;
217 } else {
218 echo decodeBody($read1, $encoding) .
219 decodeBody($read, $encoding);
220 }
221 } else if ($cnt) {
222 echo decodeBody($read, $encoding);
223 }
224 $read = fgets ($imap_stream,4096);
225 $cnt++;
1d142b8d 226// break;
451f74a2 227 }
5d9c6f73 228*/
451f74a2 229}
beb9e459 230
451f74a2 231/* -[ END MIME DECODING ]----------------------------------------------------------- */
d4467150 232
3d8371be 233/* This is here for debugging purposes. It will print out a list
234 * of all the entity IDs that are in the $message object.
235 */
451f74a2 236function listEntities ($message) {
3d8371be 237 if ($message) {
238 echo "<tt>" . $message->entity_id . ' : ' . $message->type0 . '/' . $message->type1 . ' parent = '. $message->parent->entity_id. '<br>';
239 for ($i = 0; isset($message->entities[$i]); $i++) {
240 echo "$i : ";
241 $msg = listEntities($message->entities[$i]);
242
243 if ($msg) {
244 echo "return: ";
245 return $msg;
246 }
247 }
a4a70693 248 }
451f74a2 249}
f0c4dc12 250
f792c641 251function getPriorityStr($priority) {
3d8371be 252 $priority_level = substr($priority,0,1);
253
254 switch($priority_level) {
255 /* Check for a higher then normal priority. */
256 case '1':
257 case '2':
258 $priority_string = _("High");
259 break;
260
261 /* Check for a lower then normal priority. */
262 case '4':
263 case '5':
264 $priority_string = _("Low");
265 break;
266
267 /* Check for a normal priority. */
268 case '3':
269 default:
270 $priority_level = '3';
271 $priority_string = _("Normal");
272 break;
273
274 }
275 return $priority_string;
f792c641 276}
277
451f74a2 278/* returns a $message object for a particular entity id */
279function getEntity ($message, $ent_id) {
a4a70693 280 return $message->getEntity($ent_id);
451f74a2 281}
8beafbbc 282
3d8371be 283/* translateText
da4c66e8 284 * Extracted from strings.php 23/03/2002
285 */
286
287function translateText(&$body, $wrap_at, $charset) {
3d8371be 288 global $where, $what; /* from searching */
289 global $color; /* color theme */
da4c66e8 290
b68edc75 291 require_once(SM_PATH . 'functions/url_parser.php');
da4c66e8 292
293 $body_ary = explode("\n", $body);
da4c66e8 294 for ($i=0; $i < count($body_ary); $i++) {
295 $line = $body_ary[$i];
296 if (strlen($line) - 2 >= $wrap_at) {
297 sqWordWrap($line, $wrap_at);
298 }
299 $line = charset_decode($charset, $line);
300 $line = str_replace("\t", ' ', $line);
301
302 parseUrl ($line);
303
3d8371be 304 $quotes = 0;
da4c66e8 305 $pos = 0;
3d8371be 306 $j = strlen($line);
da4c66e8 307
3d8371be 308 while ($pos < $j) {
da4c66e8 309 if ($line[$pos] == ' ') {
3d8371be 310 $pos++;
da4c66e8 311 } else if (strpos($line, '&gt;', $pos) === $pos) {
312 $pos += 4;
3d8371be 313 $quotes++;
da4c66e8 314 } else {
315 break;
316 }
317 }
3d8371be 318
83c94382 319 if ($quotes % 2) {
3d8371be 320 if (!isset($color[13])) {
da4c66e8 321 $color[13] = '#800000';
322 }
4c25967c 323 $line = '<font color="' . $color[13] . '">' . $line . '</font>';
324 } elseif ($quotes) {
325 if (!isset($color[14])) {
326 $color[14] = '#FF0000';
327 }
328 $line = '<font color="' . $color[14] . '">' . $line . '</font>';
da4c66e8 329 }
3d8371be 330
da4c66e8 331 $body_ary[$i] = $line;
332 }
333 $body = '<pre>' . implode("\n", $body_ary) . '</pre>';
334}
335
451f74a2 336/* This returns a parsed string called $body. That string can then
3d8371be 337 * be displayed as the actual message in the HTML. It contains
338 * everything needed, including HTML Tags, Attachments at the
339 * bottom, etc.
340 */
b3af12ef 341function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $mailbox='INBOX') {
3d8371be 342 /* This if statement checks for the entity to show as the
343 * primary message. To add more of them, just put them in the
344 * order that is their priority.
345 */
008989da 346 global $startMessage, $username, $key, $imapServerAddress, $imapPort,
23f617b8 347 $show_html_default, $sort, $has_unsafe_images, $passed_ent_id;
08b7f7cc 348 global $languages, $squirrelmail_language;
77bfbd2e 349
5262d9a6 350 if( !sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET) ) {
351 $view_unsafe_images = false;
77bfbd2e 352 }
d03c24f4 353
cc34b00d 354 $body = '';
23bcec6f 355 $urlmailbox = urlencode($mailbox);
451f74a2 356 $body_message = getEntity($message, $ent_num);
357 if (($body_message->header->type0 == 'text') ||
358 ($body_message->header->type0 == 'rfc822')) {
3d8371be 359 $body = mime_fetch_body ($imap_stream, $id, $ent_num);
451f74a2 360 $body = decodeBody($body, $body_message->header->encoding);
e842b215 361
362 if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
363 function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
364 if (mb_detect_encoding($body) != 'ASCII') {
365 $body = $languages[$squirrelmail_language]['XTRA_CODE']('decode', $body);
366 }
367 }
451f74a2 368 $hookResults = do_hook("message_body", $body);
369 $body = $hookResults[1];
23bcec6f 370
3d8371be 371 /* If there are other types that shouldn't be formatted, add
372 * them here.
373 */
374
451f74a2 375 if ($body_message->header->type1 == 'html') {
3d8371be 376 if ($show_html_default <> 1) {
85015544 377 $entity_conv = array('&nbsp;' => ' ',
3d8371be 378 '<p>' => "\n",
379 '<br>' => "\n",
380 '<P>' => "\n",
381 '<BR>' => "\n",
85015544 382 '&gt;' => '>',
383 '&lt;' => '<');
85015544 384 $body = strtr($body, $entity_conv);
3d8371be 385 $body = strip_tags($body);
85015544 386 $body = trim($body);
387 translateText($body, $wrap_at,
807e884a 388 $body_message->header->getParameter('charset'));
a3daaaf3 389 } else {
3d8371be 390 $body = magicHTML($body, $id, $message, $mailbox);
a3daaaf3 391 }
451f74a2 392 } else {
3d8371be 393 translateText($body, $wrap_at,
394 $body_message->header->getParameter('charset'));
451f74a2 395 }
08b7f7cc 396 $link = 'read_body.php?passed_id=' . $id . '&amp;ent_id='.$ent_num.
397 '&amp;mailbox=' . $urlmailbox .'&amp;sort=' . $sort .
da2415c1 398 '&amp;startMessage=' . $startMessage . '&amp;show_more=0';
08b7f7cc 399 if (isset($passed_ent_id)) {
400 $link .= '&amp;passed_ent_id='.$passed_ent_id;
401 }
7aad7b77 402 if ($view_unsafe_images) {
23f617b8 403 $text = _("Hide Unsafe Images");
7aad7b77 404 } else {
08b7f7cc 405 if (isset($has_unsafe_images) && $has_unsafe_images) {
406 $link .= '&amp;view_unsafe_images=1';
407 $text = _("View Unsafe Images");
408 } else {
409 $text = '';
410 }
3d8371be 411 }
23f617b8 412 $body .= '<center><small><a href="'.$link.'">'.$text.
08b7f7cc 413 '</a></small></center><br>' . "\n";
3d8371be 414 }
415 return $body;
451f74a2 416}
b74ba498 417
23bcec6f 418
419function formatAttachments($message, $exclude_id, $mailbox, $id) {
b583c3e8 420 global $where, $what, $startMessage, $color;
77b88425 421 static $ShownHTML = 0;
451f74a2 422
23bcec6f 423 $att_ar = $message->getAttachments($exclude_id);
451f74a2 424
23bcec6f 425 if (!count($att_ar)) return '';
2e25760a 426
8f5425ec 427 $attachments = '';
2e25760a 428
23bcec6f 429 $urlMailbox = urlencode($mailbox);
430
431 foreach ($att_ar as $att) {
fdc9d9b5 432 $ent = $att->entity_id;
2e25760a 433 $header = $att->header;
f0c4dc12 434 $type0 = strtolower($header->type0);
435 $type1 = strtolower($header->type1);
2e25760a 436 $name = '';
3d8371be 437 $links['download link']['text'] = _("download");
6b04287c 438 $links['download link']['href'] = SM_PATH .
439 "src/download.php?absolute_dl=true&amp;passed_id=$id&amp;mailbox=$urlMailbox&amp;ent_id=$ent";
2e25760a 440 $ImageURL = '';
441 if ($type0 =='message' && $type1 == 'rfc822') {
6b04287c 442 $default_page = SM_PATH . 'src/read_body.php';
2e25760a 443 $rfc822_header = $att->rfc822_header;
098ea084 444 $filename = $rfc822_header->subject;
6cc08d8b 445 if (trim( $filename ) == '') {
446 $filename = 'untitled-[' . $ent . ']' ;
08b7f7cc 447 }
2e25760a 448 $from_o = $rfc822_header->from;
449 if (is_object($from_o)) {
04ea844e 450 $from_name = decodeHeader($from_o->getAddress(false));
2e25760a 451 } else {
452 $from_name = _("Unknown sender");
f0c4dc12 453 }
3d8371be 454 $description = $from_name;
23bcec6f 455 } else {
6b04287c 456 $default_page = SM_PATH . 'src/download.php';
3d8371be 457 if (is_object($header->disposition)) {
098ea084 458 $filename = $header->disposition->getProperty('filename');
3d8371be 459 if (trim($filename) == '') {
460 $name = decodeHeader($header->disposition->getProperty('name'));
461 if (trim($name) == '') {
098ea084 462 $name = $header->getParameter('name');
1035e159 463 if(trim($name) == '') {
464 if (trim( $header->id ) == '') {
465 $filename = 'untitled-[' . $ent . ']' ;
466 } else {
467 $filename = 'cid: ' . $header->id;
08b7f7cc 468 }
3d8371be 469 } else {
08b7f7cc 470 $filename = $name;
3d8371be 471 }
472 } else {
473 $filename = $name;
474 }
475 }
476 } else {
08b7f7cc 477 $filename = $header->getParameter('name');
478 if (!trim($filename)) {
479 if (trim( $header->id ) == '') {
480 $filename = 'untitled-[' . $ent . ']' ;
481 } else {
482 $filename = 'cid: ' . $header->id;
483 }
484 }
485 }
f810c0b2 486 if ($header->description) {
098ea084 487 $description = decodeHeader($header->description);
f810c0b2 488 } else {
3d8371be 489 $description = '';
490 }
2e25760a 491 }
492
493 $display_filename = $filename;
3d8371be 494 if (isset($passed_ent_id)) {
495 $passed_ent_id_link = '&amp;passed_ent_id='.$passed_ent_id;
496 } else {
497 $passed_ent_id_link = '';
498 }
499 $defaultlink = $default_page . "?startMessage=$startMessage"
2e25760a 500 . "&amp;passed_id=$id&amp;mailbox=$urlMailbox"
6b04287c 501 . '&amp;ent_id='.$ent.$passed_ent_id_link;
2e25760a 502 if ($where && $what) {
09f4707e 503 $defaultlink .= '&amp;where='. urlencode($where).'&amp;what='.urlencode($what);
2e25760a 504 }
3d8371be 505 /* This executes the attachment hook with a specific MIME-type.
506 * If that doesn't have results, it tries if there's a rule
507 * for a more generic type.
508 */
509 $hookresults = do_hook("attachment $type0/$type1", $links,
510 $startMessage, $id, $urlMailbox, $ent, $defaultlink,
511 $display_filename, $where, $what);
512 if(count($hookresults[1]) <= 1) {
513 $hookresults = do_hook("attachment $type0/*", $links,
514 $startMessage, $id, $urlMailbox, $ent, $defaultlink,
515 $display_filename, $where, $what);
2e25760a 516 }
451f74a2 517
3d8371be 518 $links = $hookresults[1];
519 $defaultlink = $hookresults[6];
77b88425 520
2e25760a 521 $attachments .= '<TR><TD>' .
098ea084 522 '<A HREF="'.$defaultlink.'">'.decodeHeader($display_filename).'</A>&nbsp;</TD>' .
23bcec6f 523 '<TD><SMALL><b>' . show_readable_size($header->size) .
77b88425 524 '</b>&nbsp;&nbsp;</small></TD>' .
525 "<TD><SMALL>[ $type0/$type1 ]&nbsp;</SMALL></TD>" .
526 '<TD><SMALL>';
f810c0b2 527 $attachments .= '<b>' . $description . '</b>';
2e25760a 528 $attachments .= '</SMALL></TD><TD><SMALL>&nbsp;';
b74ba498 529
3d8371be 530 $skipspaces = 1;
531 foreach ($links as $val) {
532 if ($skipspaces) {
533 $skipspaces = 0;
2e25760a 534 } else {
535 $attachments .= '&nbsp;&nbsp;|&nbsp;&nbsp;';
77b88425 536 }
3d8371be 537 $attachments .= '<a href="' . $val['href'] . '">' . $val['text'] . '</a>';
2e25760a 538 }
3d8371be 539 unset($links);
2e25760a 540 $attachments .= "</TD></TR>\n";
541 }
9ad17edb 542 $attachmentadd = do_hook_function('attachments_bottom',$attachments);
543 if ($attachmentadd != '')
544 $attachments = $attachmentadd;
2e25760a 545 return $attachments;
451f74a2 546}
b74ba498 547
7c7b74b3 548function sqimap_base64_decode(&$string) {
325978ac 549 $string = str_replace("\r\n", "\n", $string);
7c7b74b3 550 $string = base64_decode($string);
551}
552
3d8371be 553/* This function decodes the body depending on the encoding type. */
451f74a2 554function decodeBody($body, $encoding) {
3d8371be 555 global $show_html_default;
83be314a 556
b583c3e8 557 $body = str_replace("\r\n", "\n", $body);
558 $encoding = strtolower($encoding);
3d8371be 559
5166f86a 560 $encoding_handler = do_hook_function('decode_body', $encoding);
561
562
563 // plugins get first shot at decoding the body
564 //
565 if (!empty($encoding_handler) && function_exists($encoding_handler)) {
566 $body = $encoding_handler('decode', $body);
567
568 } else if ($encoding == 'quoted-printable' ||
3d8371be 569 $encoding == 'quoted_printable') {
b583c3e8 570 $body = quoted_printable_decode($body);
3d8371be 571
b583c3e8 572 while (ereg("=\n", $body)) {
573 $body = ereg_replace ("=\n", '', $body);
574 }
3d8371be 575
b583c3e8 576 } else if ($encoding == 'base64') {
577 $body = base64_decode($body);
578 }
3d8371be 579
b583c3e8 580 // All other encodings are returned raw.
3d8371be 581 return $body;
451f74a2 582}
583
584/*
585 * This functions decode strings that is encoded according to
586 * RFC1522 (MIME Part Two: Message Header Extensions for Non-ASCII Text).
79e07c7e 587 * Patched by Christian Schmidt <christian@ostenfeld.dk> 23/03/2002
451f74a2 588 */
098ea084 589function decodeHeader ($string, $utfencode=true,$htmlsave=true) {
d7448126 590 global $languages, $squirrelmail_language;
79e07c7e 591 if (is_array($string)) {
592 $string = implode("\n", $string);
593 }
da2415c1 594
10dec454 595 if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
596 function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
6fbd125b 597 $string = $languages[$squirrelmail_language]['XTRA_CODE']('decodeheader', $string);
08b7f7cc 598 // Do we need to return at this point?
599 // return $string;
83be314a 600 }
79e07c7e 601 $i = 0;
08b7f7cc 602 $iLastMatch = -2;
db65b6b0 603 $encoded = true;
0a06275a 604
098ea084 605 $aString = explode(' ',$string);
08b7f7cc 606 $ret = '';
098ea084 607 foreach ($aString as $chunk) {
358a78a1 608 if ($encoded && $chunk === '') {
08b7f7cc 609 continue;
358a78a1 610 } elseif ($chunk === '') {
08b7f7cc 611 $ret .= ' ';
612 continue;
613 }
098ea084 614 $encoded = false;
08b7f7cc 615 /* if encoded words are not separated by a linear-space-white we still catch them */
616 $j = $i-1;
7e6ca3e8 617
08b7f7cc 618 while ($match = preg_match('/^(.*)=\?([^?]*)\?(Q|B)\?([^?]*)\?=(.*)$/Ui',$chunk,$res)) {
619 /* if the last chunk isn't an encoded string then put back the space, otherwise don't */
620 if ($iLastMatch !== $j) {
621 if ($htmlsave) {
622 $ret .= '&nbsp;';
623 } else {
624 $ret .= ' ';
625 }
626 }
627 $iLastMatch = $i;
628 $j = $i;
629 $ret .= $res[1];
098ea084 630 $encoding = ucfirst($res[3]);
631 switch ($encoding)
632 {
633 case 'B':
634 $replace = base64_decode($res[4]);
08b7f7cc 635 $ret .= charset_decode($res[2],$replace);
098ea084 636 break;
637 case 'Q':
098ea084 638 $replace = str_replace('_', ' ', $res[4]);
da2415c1 639 $replace = preg_replace('/=([0-9a-f]{2})/ie', 'chr(hexdec("\1"))',
79e07c7e 640 $replace);
098ea084 641 /* Only encode into entities by default. Some places
642 * don't need the encoding, like the compose form.
643 */
644 if ($utfencode) {
645 $replace = charset_decode($res[2], $replace);
646 } else {
647 if ($htmlsave) {
c96c32f4 648 $replace = htmlspecialchars($replace);
098ea084 649 }
650 }
08b7f7cc 651 $ret .= $replace;
098ea084 652 break;
653 default:
654 break;
79e07c7e 655 }
098ea084 656 $chunk = $res[5];
657 $encoded = true;
08b7f7cc 658 }
7e6ca3e8 659
660 if (!$encoded && $htmlsave) {
661 $ret .= htmlspecialchars($chunk);
662 } else {
663 $ret .= $chunk;
664 }
665
08b7f7cc 666 if (!$encoded) {
667 if ($htmlsave) {
668 $ret .= '&nbsp;';
669 } else {
670 $ret .= ' ';
da2415c1 671 }
08b7f7cc 672 }
098ea084 673 ++$i;
674 }
da2415c1 675
08b7f7cc 676 return $ret;
451f74a2 677}
678
679/*
680 * Encode a string according to RFC 1522 for use in headers if it
681 * contains 8-bit characters or anything that looks like it should
682 * be encoded.
683 */
684function encodeHeader ($string) {
6fbd125b 685 global $default_charset, $languages, $squirrelmail_language;
83be314a 686
10dec454 687 if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
688 function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
6fbd125b 689 return $languages[$squirrelmail_language]['XTRA_CODE']('encodeheader', $string);
83be314a 690 }
c96c32f4 691 if (strtolower($default_charset) == 'iso-8859-1') {
692 $string = str_replace("\240",' ',$string);
693 }
793cc001 694
451f74a2 695 // Encode only if the string contains 8-bit characters or =?
3d8371be 696 $j = strlen($string);
098ea084 697 $max_l = 75 - strlen($default_charset) - 7;
698 $aRet = array();
451f74a2 699 $ret = '';
c96c32f4 700 $iEncStart = $enc_init = false;
0d53f0f9 701 $cur_l = $iOffset = 0;
3d8371be 702 for($i = 0; $i < $j; ++$i) {
c96c32f4 703 switch($string{$i})
704 {
705 case '=':
706 case '<':
707 case '>':
708 case ',':
709 case '?':
710 case '_':
711 if ($iEncStart === false) {
712 $iEncStart = $i;
713 }
714 $cur_l+=3;
715 if ($cur_l > ($max_l-2)) {
08b7f7cc 716 /* if there is an stringpart that doesn't need encoding, add it */
c96c32f4 717 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
718 $aRet[] = "=?$default_charset?Q?$ret?=";
719 $iOffset = $i;
720 $cur_l = 0;
721 $ret = '';
722 $iEncStart = false;
723 } else {
724 $ret .= sprintf("=%02X",ord($string{$i}));
725 }
726 break;
727 case '(':
728 case ')':
729 if ($iEncStart !== false) {
08b7f7cc 730 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
c96c32f4 731 $aRet[] = "=?$default_charset?Q?$ret?=";
732 $iOffset = $i;
733 $cur_l = 0;
734 $ret = '';
735 $iEncStart = false;
736 }
737 break;
738 case ' ':
739 if ($iEncStart !== false) {
098ea084 740 $cur_l++;
741 if ($cur_l > $max_l) {
08b7f7cc 742 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
c96c32f4 743 $aRet[] = "=?$default_charset?Q?$ret?=";
744 $iOffset = $i;
745 $cur_l = 0;
746 $ret = '';
747 $iEncStart = false;
08b7f7cc 748 } else {
c96c32f4 749 $ret .= '_';
750 }
751 }
752 break;
753 default:
754 $k = ord($string{$i});
755 if ($k > 126) {
756 if ($iEncStart === false) {
325978ac 757 // do not start encoding in the middle of a string, also take the rest of the word.
758 $sLeadString = substr($string,0,$i);
759 $aLeadString = explode(' ',$sLeadString);
da2415c1 760 $sToBeEncoded = array_pop($aLeadString);
325978ac 761 $iEncStart = $i - strlen($sToBeEncoded);
762 $ret .= $sToBeEncoded;
763 $cur_l += strlen($sToBeEncoded);
c96c32f4 764 }
765 $cur_l += 3;
08b7f7cc 766 /* first we add the encoded string that reached it's max size */
c96c32f4 767 if ($cur_l > ($max_l-2)) {
08b7f7cc 768 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
769 $aRet[] = "=?$default_charset?Q?$ret?= "; /* the next part is also encoded => separate by space */
c96c32f4 770 $cur_l = 3;
771 $ret = '';
772 $iOffset = $i;
08b7f7cc 773 $iEncStart = $i;
c96c32f4 774 }
08b7f7cc 775 $enc_init = true;
c96c32f4 776 $ret .= sprintf("=%02X", $k);
777 } else {
778 if ($iEncStart !== false) {
098ea084 779 $cur_l++;
780 if ($cur_l > $max_l) {
08b7f7cc 781 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
c96c32f4 782 $aRet[] = "=?$default_charset?Q?$ret?=";
783 $iEncStart = false;
784 $iOffset = $i;
785 $cur_l = 0;
098ea084 786 $ret = '';
08b7f7cc 787 } else {
c96c32f4 788 $ret .= $string{$i};
789 }
3d8371be 790 }
c96c32f4 791 }
792 break;
f7b3ba37 793 }
451f74a2 794 }
793cc001 795
c96c32f4 796 if ($enc_init) {
797 if ($iEncStart !== false) {
798 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
799 $aRet[] = "=?$default_charset?Q?$ret?=";
800 } else {
801 $aRet[] = substr($string,$iOffset);
802 }
803 $string = implode('',$aRet);
451f74a2 804 }
3d8371be 805 return $string;
451f74a2 806}
b74ba498 807
691a2d25 808/* This function trys to locate the entity_id of a specific mime element */
3d8371be 809function find_ent_id($id, $message) {
a171b359 810 for ($i = 0, $ret = ''; $ret == '' && $i < count($message->entities); $i++) {
811 if ($message->entities[$i]->header->type0 == 'multipart') {
3d8371be 812 $ret = find_ent_id($id, $message->entities[$i]);
451f74a2 813 } else {
3d8371be 814 if (strcasecmp($message->entities[$i]->header->id, $id) == 0) {
d8cffbab 815// if (sq_check_save_extension($message->entities[$i])) {
a171b359 816 return $message->entities[$i]->entity_id;
da2415c1 817// }
3d8371be 818 }
a3daaaf3 819 }
451f74a2 820 }
3d8371be 821 return $ret;
451f74a2 822}
a3daaaf3 823
e5e9381a 824function sq_check_save_extension($message) {
825 $filename = $message->getFilename();
826 $ext = substr($filename, strrpos($filename,'.')+1);
827 $save_extensions = array('jpg','jpeg','gif','png','bmp');
3d8371be 828 return in_array($ext, $save_extensions);
e5e9381a 829}
830
831
691a2d25 832/**
833 ** HTMLFILTER ROUTINES
834 */
451f74a2 835
2dd879b8 836/**
837 * This function is more or less a wrapper around stripslashes. Apparently
838 * Explorer is stupid enough to just remove the backslashes and then
839 * execute the content of the attribute as if nothing happened.
840 * Who does that?
841 *
842 * @param attvalue The value of the attribute
843 * @return attvalue The value of the attribute stripslashed.
844 */
845function sq_unbackslash($attvalue){
846 /**
847 * Remove any backslashes. See if there are any first.
848 */
849 if (strstr($attvalue, '\\') !== false){
850 $attvalue = stripslashes($attvalue);
851 }
852 return $attvalue;
853}
854
855/**
856 * Kill any tabs, newlines, or carriage returns. Our friends the
857 * makers of the browser with 95% market value decided that it'd
858 * be funny to make "java[tab]script" be just as good as "javascript".
da2415c1 859 *
2dd879b8 860 * @param attvalue The attribute value before extraneous spaces removed.
861 * @return attvalue The attribute value after extraneous spaces removed.
862 */
863function sq_unspace($attvalue){
864 if (strcspn($attvalue, "\t\r\n") != strlen($attvalue)){
865 $attvalue = str_replace(Array("\t", "\r", "\n"), Array('', '', ''),
866 $attvalue);
867 }
868 return $attvalue;
869}
870
691a2d25 871/**
872 * This function returns the final tag out of the tag name, an array
da2415c1 873 * of attributes, and the type of the tag. This function is called by
691a2d25 874 * sq_sanitize internally.
875 *
876 * @param $tagname the name of the tag.
877 * @param $attary the array of attributes and their values
878 * @param $tagtype The type of the tag (see in comments).
879 * @return a string with the final tag representation.
880 */
881function sq_tagprint($tagname, $attary, $tagtype){
b583c3e8 882 $me = 'sq_tagprint';
3d8371be 883
691a2d25 884 if ($tagtype == 2){
885 $fulltag = '</' . $tagname . '>';
886 } else {
887 $fulltag = '<' . $tagname;
888 if (is_array($attary) && sizeof($attary)){
889 $atts = Array();
890 while (list($attname, $attvalue) = each($attary)){
891 array_push($atts, "$attname=$attvalue");
892 }
893 $fulltag .= ' ' . join(" ", $atts);
894 }
895 if ($tagtype == 3){
b583c3e8 896 $fulltag .= ' /';
691a2d25 897 }
b583c3e8 898 $fulltag .= '>';
451f74a2 899 }
691a2d25 900 return $fulltag;
451f74a2 901}
a3daaaf3 902
691a2d25 903/**
904 * A small helper function to use with array_walk. Modifies a by-ref
905 * value and makes it lowercase.
906 *
907 * @param $val a value passed by-ref.
908 * @return void since it modifies a by-ref value.
909 */
910function sq_casenormalize(&$val){
911 $val = strtolower($val);
912}
451f74a2 913
691a2d25 914/**
915 * This function skips any whitespace from the current position within
916 * a string and to the next non-whitespace value.
da2415c1 917 *
691a2d25 918 * @param $body the string
919 * @param $offset the offset within the string where we should start
920 * looking for the next non-whitespace character.
921 * @return the location within the $body where the next
922 * non-whitespace char is located.
923 */
924function sq_skipspace($body, $offset){
b583c3e8 925 $me = 'sq_skipspace';
3d8371be 926 preg_match('/^(\s*)/s', substr($body, $offset), $matches);
691a2d25 927 if (sizeof($matches{1})){
928 $count = strlen($matches{1});
929 $offset += $count;
451f74a2 930 }
691a2d25 931 return $offset;
451f74a2 932}
a3daaaf3 933
691a2d25 934/**
935 * This function looks for the next character within a string. It's
936 * really just a glorified "strpos", except it catches if failures
937 * nicely.
938 *
939 * @param $body The string to look for needle in.
940 * @param $offset Start looking from this position.
941 * @param $needle The character/string to look for.
942 * @return location of the next occurance of the needle, or
943 * strlen($body) if needle wasn't found.
944 */
945function sq_findnxstr($body, $offset, $needle){
3d8371be 946 $me = 'sq_findnxstr';
691a2d25 947 $pos = strpos($body, $needle, $offset);
948 if ($pos === FALSE){
949 $pos = strlen($body);
451f74a2 950 }
691a2d25 951 return $pos;
451f74a2 952}
a3daaaf3 953
691a2d25 954/**
955 * This function takes a PCRE-style regexp and tries to match it
956 * within the string.
957 *
958 * @param $body The string to look for needle in.
959 * @param $offset Start looking from here.
960 * @param $reg A PCRE-style regex to match.
961 * @return Returns a false if no matches found, or an array
962 * with the following members:
963 * - integer with the location of the match within $body
964 * - string with whatever content between offset and the match
965 * - string with whatever it is we matched
966 */
967function sq_findnxreg($body, $offset, $reg){
b583c3e8 968 $me = 'sq_findnxreg';
691a2d25 969 $matches = Array();
970 $retarr = Array();
7d06541f 971 preg_match("%^(.*?)($reg)%si", substr($body, $offset), $matches);
972 if (!isset($matches{0}) || !$matches{0}){
691a2d25 973 $retarr = false;
974 } else {
975 $retarr{0} = $offset + strlen($matches{1});
976 $retarr{1} = $matches{1};
977 $retarr{2} = $matches{2};
978 }
979 return $retarr;
980}
a3daaaf3 981
691a2d25 982/**
983 * This function looks for the next tag.
984 *
985 * @param $body String where to look for the next tag.
986 * @param $offset Start looking from here.
987 * @return false if no more tags exist in the body, or
988 * an array with the following members:
989 * - string with the name of the tag
990 * - array with attributes and their values
991 * - integer with tag type (1, 2, or 3)
992 * - integer where the tag starts (starting "<")
993 * - integer where the tag ends (ending ">")
994 * first three members will be false, if the tag is invalid.
995 */
996function sq_getnxtag($body, $offset){
b583c3e8 997 $me = 'sq_getnxtag';
691a2d25 998 if ($offset > strlen($body)){
999 return false;
1000 }
1001 $lt = sq_findnxstr($body, $offset, "<");
1002 if ($lt == strlen($body)){
1003 return false;
1004 }
1005 /**
1006 * We are here:
1007 * blah blah <tag attribute="value">
1008 * \---------^
1009 */
1010 $pos = sq_skipspace($body, $lt+1);
1011 if ($pos >= strlen($body)){
1012 return Array(false, false, false, $lt, strlen($body));
1013 }
1014 /**
1015 * There are 3 kinds of tags:
1016 * 1. Opening tag, e.g.:
1017 * <a href="blah">
1018 * 2. Closing tag, e.g.:
1019 * </a>
1020 * 3. XHTML-style content-less tag, e.g.:
1021 * <img src="blah"/>
1022 */
1023 $tagtype = false;
1024 switch (substr($body, $pos, 1)){
3d8371be 1025 case '/':
1026 $tagtype = 2;
1027 $pos++;
1028 break;
1029 case '!':
1030 /**
1031 * A comment or an SGML declaration.
1032 */
1033 if (substr($body, $pos+1, 2) == "--"){
1034 $gt = strpos($body, "-->", $pos);
1035 if ($gt === false){
1036 $gt = strlen($body);
1037 } else {
1038 $gt += 2;
1039 }
1040 return Array(false, false, false, $lt, $gt);
bb8d0799 1041 } else {
3d8371be 1042 $gt = sq_findnxstr($body, $pos, ">");
1043 return Array(false, false, false, $lt, $gt);
1044 }
1045 break;
1046 default:
1047 /**
1048 * Assume tagtype 1 for now. If it's type 3, we'll switch values
1049 * later.
1050 */
1051 $tagtype = 1;
1052 break;
691a2d25 1053 }
a3daaaf3 1054
691a2d25 1055 $tag_start = $pos;
1056 $tagname = '';
1057 /**
1058 * Look for next [\W-_], which will indicate the end of the tag name.
1059 */
1060 $regary = sq_findnxreg($body, $pos, "[^\w\-_]");
1061 if ($regary == false){
1062 return Array(false, false, false, $lt, strlen($body));
1063 }
1064 list($pos, $tagname, $match) = $regary;
1065 $tagname = strtolower($tagname);
1066
1067 /**
1068 * $match can be either of these:
1069 * '>' indicating the end of the tag entirely.
1070 * '\s' indicating the end of the tag name.
1071 * '/' indicating that this is type-3 xhtml tag.
da2415c1 1072 *
691a2d25 1073 * Whatever else we find there indicates an invalid tag.
1074 */
1075 switch ($match){
3d8371be 1076 case '/':
691a2d25 1077 /**
3d8371be 1078 * This is an xhtml-style tag with a closing / at the
1079 * end, like so: <img src="blah"/>. Check if it's followed
1080 * by the closing bracket. If not, then this tag is invalid
691a2d25 1081 */
3d8371be 1082 if (substr($body, $pos, 2) == "/>"){
1083 $pos++;
1084 $tagtype = 3;
1085 } else {
1086 $gt = sq_findnxstr($body, $pos, ">");
1087 $retary = Array(false, false, false, $lt, $gt);
1088 return $retary;
1089 }
1090 case '>':
1091 return Array($tagname, false, $tagtype, $lt, $pos);
1092 break;
1093 default:
1094 /**
1095 * Check if it's whitespace
1096 */
1097 if (!preg_match('/\s/', $match)){
1098 /**
1099 * This is an invalid tag! Look for the next closing ">".
1100 */
7d06541f 1101 $gt = sq_findnxstr($body, $lt, ">");
3d8371be 1102 return Array(false, false, false, $lt, $gt);
1103 }
1104 break;
691a2d25 1105 }
3d8371be 1106
691a2d25 1107 /**
1108 * At this point we're here:
1109 * <tagname attribute='blah'>
1110 * \-------^
1111 *
1112 * At this point we loop in order to find all attributes.
1113 */
1114 $attname = '';
1115 $atttype = false;
1116 $attary = Array();
1117
1118 while ($pos <= strlen($body)){
1119 $pos = sq_skipspace($body, $pos);
1120 if ($pos == strlen($body)){
1121 /**
1122 * Non-closed tag.
1123 */
1124 return Array(false, false, false, $lt, $pos);
1125 }
1126 /**
1127 * See if we arrived at a ">" or "/>", which means that we reached
1128 * the end of the tag.
1129 */
1130 $matches = Array();
164800ad 1131 if (preg_match("%^(\s*)(>|/>)%s", substr($body, $pos), $matches)) {
c828931c 1132 /**
1133 * Yep. So we did.
1134 */
1135 $pos += strlen($matches{1});
1136 if ($matches{2} == "/>"){
1137 $tagtype = 3;
1138 $pos++;
1139 }
1140 return Array($tagname, $attary, $tagtype, $lt, $pos);
1141 }
a3daaaf3 1142
cca46357 1143 /**
691a2d25 1144 * There are several types of attributes, with optional
1145 * [:space:] between members.
1146 * Type 1:
1147 * attrname[:space:]=[:space:]'CDATA'
1148 * Type 2:
1149 * attrname[:space:]=[:space:]"CDATA"
1150 * Type 3:
1151 * attr[:space:]=[:space:]CDATA
1152 * Type 4:
1153 * attrname
cca46357 1154 *
691a2d25 1155 * We leave types 1 and 2 the same, type 3 we check for
1156 * '"' and convert to "&quot" if needed, then wrap in
1157 * double quotes. Type 4 we convert into:
1158 * attrname="yes".
cca46357 1159 */
3f7c623f 1160 $regary = sq_findnxreg($body, $pos, "[^:\w\-_]");
691a2d25 1161 if ($regary == false){
1162 /**
1163 * Looks like body ended before the end of tag.
1164 */
1165 return Array(false, false, false, $lt, strlen($body));
cca46357 1166 }
691a2d25 1167 list($pos, $attname, $match) = $regary;
1168 $attname = strtolower($attname);
1169 /**
1170 * We arrived at the end of attribute name. Several things possible
1171 * here:
1172 * '>' means the end of the tag and this is attribute type 4
1173 * '/' if followed by '>' means the same thing as above
1174 * '\s' means a lot of things -- look what it's followed by.
1175 * anything else means the attribute is invalid.
1176 */
1177 switch($match){
3d8371be 1178 case '/':
691a2d25 1179 /**
3d8371be 1180 * This is an xhtml-style tag with a closing / at the
1181 * end, like so: <img src="blah"/>. Check if it's followed
1182 * by the closing bracket. If not, then this tag is invalid
691a2d25 1183 */
3d8371be 1184 if (substr($body, $pos, 2) == "/>"){
691a2d25 1185 $pos++;
3d8371be 1186 $tagtype = 3;
691a2d25 1187 } else {
3d8371be 1188 $gt = sq_findnxstr($body, $pos, ">");
1189 $retary = Array(false, false, false, $lt, $gt);
1190 return $retary;
1191 }
1192 case '>':
1193 $attary{$attname} = '"yes"';
1194 return Array($tagname, $attary, $tagtype, $lt, $pos);
1195 break;
1196 default:
1197 /**
1198 * Skip whitespace and see what we arrive at.
1199 */
1200 $pos = sq_skipspace($body, $pos);
1201 $char = substr($body, $pos, 1);
1202 /**
1203 * Two things are valid here:
1204 * '=' means this is attribute type 1 2 or 3.
1205 * \w means this was attribute type 4.
1206 * anything else we ignore and re-loop. End of tag and
1207 * invalid stuff will be caught by our checks at the beginning
1208 * of the loop.
1209 */
1210 if ($char == "="){
1211 $pos++;
1212 $pos = sq_skipspace($body, $pos);
691a2d25 1213 /**
3d8371be 1214 * Here are 3 possibilities:
1215 * "'" attribute type 1
1216 * '"' attribute type 2
1217 * everything else is the content of tag type 3
691a2d25 1218 */
3d8371be 1219 $quot = substr($body, $pos, 1);
1220 if ($quot == "'"){
1221 $regary = sq_findnxreg($body, $pos+1, "\'");
1222 if ($regary == false){
1223 return Array(false, false, false, $lt, strlen($body));
1224 }
1225 list($pos, $attval, $match) = $regary;
1226 $pos++;
1227 $attary{$attname} = "'" . $attval . "'";
1228 } else if ($quot == '"'){
1229 $regary = sq_findnxreg($body, $pos+1, '\"');
1230 if ($regary == false){
1231 return Array(false, false, false, $lt, strlen($body));
1232 }
1233 list($pos, $attval, $match) = $regary;
1234 $pos++;
1235 $attary{$attname} = '"' . $attval . '"';
1236 } else {
1237 /**
1238 * These are hateful. Look for \s, or >.
1239 */
1240 $regary = sq_findnxreg($body, $pos, "[\s>]");
1241 if ($regary == false){
1242 return Array(false, false, false, $lt, strlen($body));
1243 }
1244 list($pos, $attval, $match) = $regary;
1245 /**
1246 * If it's ">" it will be caught at the top.
1247 */
1248 $attval = preg_replace("/\"/s", "&quot;", $attval);
1249 $attary{$attname} = '"' . $attval . '"';
7e235a1a 1250 }
3d8371be 1251 } else if (preg_match("|[\w/>]|", $char)) {
691a2d25 1252 /**
3d8371be 1253 * That was attribute type 4.
691a2d25 1254 */
3d8371be 1255 $attary{$attname} = '"yes"';
1256 } else {
1257 /**
1258 * An illegal character. Find next '>' and return.
1259 */
1260 $gt = sq_findnxstr($body, $pos, ">");
1261 return Array(false, false, false, $lt, $gt);
451f74a2 1262 }
3d8371be 1263 break;
691a2d25 1264 }
1265 }
1266 /**
1267 * The fact that we got here indicates that the tag end was never
1268 * found. Return invalid tag indication so it gets stripped.
1269 */
1270 return Array(false, false, false, $lt, strlen($body));
1271}
1272
1273/**
1274 * This function checks attribute values for entity-encoded values
1275 * and returns them translated into 8-bit strings so we can run
1276 * checks on them.
1277 *
1278 * @param $attvalue A string to run entity check against.
1279 * @return Translated value.
1280 */
1281function sq_deent($attvalue){
b583c3e8 1282 $me = 'sq_deent';
691a2d25 1283 /**
1284 * See if we have to run the checks first. All entities must start
1285 * with "&".
1286 */
1287 if (strpos($attvalue, "&") === false){
1288 return $attvalue;
1289 }
1290 /**
1291 * Check named entities first.
1292 */
1293 $trans = get_html_translation_table(HTML_ENTITIES);
1294 /**
1295 * Leave &quot; in, as it can mess us up.
1296 */
1297 $trans = array_flip($trans);
1298 unset($trans{"&quot;"});
1299 while (list($ent, $val) = each($trans)){
1300 $attvalue = preg_replace("/$ent*(\W)/si", "$val\\1", $attvalue);
1301 }
1302 /**
1303 * Now translate numbered entities from 1 to 255 if needed.
1304 */
1305 if (strpos($attvalue, "#") !== false){
1306 $omit = Array(34, 39);
1307 for ($asc=1; $asc<256; $asc++){
1308 if (!in_array($asc, $omit)){
1309 $chr = chr($asc);
da2415c1 1310 $attvalue = preg_replace("/\&#0*$asc;*(\D)/si", "$chr\\1",
691a2d25 1311 $attvalue);
1312 $attvalue = preg_replace("/\&#x0*".dechex($asc).";*(\W)/si",
1313 "$chr\\1", $attvalue);
a3daaaf3 1314 }
691a2d25 1315 }
1316 }
1317 return $attvalue;
1318}
1319
1320/**
1321 * This function runs various checks against the attributes.
1322 *
1323 * @param $tagname String with the name of the tag.
1324 * @param $attary Array with all tag attributes.
1325 * @param $rm_attnames See description for sq_sanitize
1326 * @param $bad_attvals See description for sq_sanitize
1327 * @param $add_attr_to_tag See description for sq_sanitize
1328 * @param $message message object
1329 * @param $id message id
1330 * @return Array with modified attributes.
1331 */
da2415c1 1332function sq_fixatts($tagname,
1333 $attary,
691a2d25 1334 $rm_attnames,
1335 $bad_attvals,
1336 $add_attr_to_tag,
1337 $message,
b3af12ef 1338 $id,
3d8371be 1339 $mailbox
691a2d25 1340 ){
b583c3e8 1341 $me = 'sq_fixatts';
691a2d25 1342 while (list($attname, $attvalue) = each($attary)){
1343 /**
1344 * See if this attribute should be removed.
1345 */
1346 foreach ($rm_attnames as $matchtag=>$matchattrs){
1347 if (preg_match($matchtag, $tagname)){
1348 foreach ($matchattrs as $matchattr){
1349 if (preg_match($matchattr, $attname)){
1350 unset($attary{$attname});
1351 continue;
1352 }
451f74a2 1353 }
451f74a2 1354 }
691a2d25 1355 }
1356 /**
2dd879b8 1357 * Remove any backslashes, entities, and extraneous whitespace.
691a2d25 1358 */
2dd879b8 1359 $attvalue = sq_unbackslash($attvalue);
691a2d25 1360 $attvalue = sq_deent($attvalue);
2dd879b8 1361 $attvalue = sq_unspace($attvalue);
691a2d25 1362
1363 /**
1364 * Now let's run checks on the attvalues.
1365 * I don't expect anyone to comprehend this. If you do,
1366 * get in touch with me so I can drive to where you live and
1367 * shake your hand personally. :)
1368 */
1369 foreach ($bad_attvals as $matchtag=>$matchattrs){
1370 if (preg_match($matchtag, $tagname)){
1371 foreach ($matchattrs as $matchattr=>$valary){
1372 if (preg_match($matchattr, $attname)){
1373 /**
1374 * There are two arrays in valary.
1375 * First is matches.
1376 * Second one is replacements
1377 */
1378 list($valmatch, $valrepl) = $valary;
da2415c1 1379 $newvalue =
691a2d25 1380 preg_replace($valmatch, $valrepl, $attvalue);
1381 if ($newvalue != $attvalue){
1382 $attary{$attname} = $newvalue;
1383 }
1384 }
1385 }
451f74a2 1386 }
a3daaaf3 1387 }
691a2d25 1388 /**
1389 * Turn cid: urls into http-friendly ones.
1390 */
1391 if (preg_match("/^[\'\"]\s*cid:/si", $attvalue)){
b3af12ef 1392 $attary{$attname} = sq_cid2http($message, $id, $attvalue, $mailbox);
691a2d25 1393 }
a3daaaf3 1394 }
691a2d25 1395 /**
1396 * See if we need to append any attributes to this tag.
1397 */
1398 foreach ($add_attr_to_tag as $matchtag=>$addattary){
1399 if (preg_match($matchtag, $tagname)){
1400 $attary = array_merge($attary, $addattary);
1401 }
1402 }
1403 return $attary;
451f74a2 1404}
a3daaaf3 1405
691a2d25 1406/**
1407 * This function edits the style definition to make them friendly and
1408 * usable in squirrelmail.
da2415c1 1409 *
691a2d25 1410 * @param $message the message object
1411 * @param $id the message id
1412 * @param $content a string with whatever is between <style> and </style>
e60a299a 1413 * @param $mailbox the message mailbox
691a2d25 1414 * @return a string with edited content.
1415 */
e60a299a 1416function sq_fixstyle($body, $pos, $message, $id, $mailbox){
691a2d25 1417 global $view_unsafe_images;
b583c3e8 1418 $me = 'sq_fixstyle';
7d06541f 1419 $ret = sq_findnxreg($body, $pos, '</\s*style\s*>');
1420 if ($ret == FALSE){
1421 return array(FALSE, strlen($body));
1422 }
1423 $newpos = $ret[0] + strlen($ret[2]);
1424 $content = $ret[1];
691a2d25 1425 /**
1426 * First look for general BODY style declaration, which would be
1427 * like so:
1428 * body {background: blah-blah}
1429 * and change it to .bodyclass so we can just assign it to a <div>
1430 */
1431 $content = preg_replace("|body(\s*\{.*?\})|si", ".bodyclass\\1", $content);
3d8371be 1432 $secremoveimg = '../images/' . _("sec_remove_eng.png");
691a2d25 1433 /**
1434 * Fix url('blah') declarations.
1435 */
7d06541f 1436 $content = preg_replace("|url\s*\(\s*([\'\"])\s*\S+script\s*:.*?([\'\"])\s*\)|si",
691a2d25 1437 "url(\\1$secremoveimg\\2)", $content);
1438 /**
1439 * Fix url('https*://.*) declarations but only if $view_unsafe_images
1440 * is false.
1441 */
1442 if (!$view_unsafe_images){
7d06541f 1443 $content = preg_replace("|url\s*\(\s*([\'\"])\s*https*:.*?([\'\"])\s*\)|si",
691a2d25 1444 "url(\\1$secremoveimg\\2)", $content);
1445 }
da2415c1 1446
691a2d25 1447 /**
1448 * Fix urls that refer to cid:
1449 */
da2415c1 1450 while (preg_match("|url\s*\(\s*([\'\"]\s*cid:.*?[\'\"])\s*\)|si",
7d06541f 1451 $content, $matches)){
691a2d25 1452 $cidurl = $matches{1};
e60a299a 1453 $httpurl = sq_cid2http($message, $id, $cidurl, $mailbox);
7d06541f 1454 $content = preg_replace("|url\s*\(\s*$cidurl\s*\)|si",
691a2d25 1455 "url($httpurl)", $content);
1456 }
a3daaaf3 1457
691a2d25 1458 /**
bb8d0799 1459 * Fix stupid css declarations which lead to vulnerabilities
691a2d25 1460 * in IE.
1461 */
f83c60a2 1462 $match = Array('/expression/i',
1463 '/behaviou*r/i',
2dd879b8 1464 '/binding/i',
1465 '/include-source/i');
1466 $replace = Array('idiocy', 'idiocy', 'idiocy', 'idiocy');
bb8d0799 1467 $content = preg_replace($match, $replace, $content);
7d06541f 1468 return array($content, $newpos);
691a2d25 1469}
a3daaaf3 1470
691a2d25 1471/**
1472 * This function converts cid: url's into the ones that can be viewed in
1473 * the browser.
1474 *
1475 * @param $message the message object
1476 * @param $id the message id
1477 * @param $cidurl the cid: url.
e60a299a 1478 * @param $mailbox the message mailbox
691a2d25 1479 * @return a string with a http-friendly url
1480 */
b3af12ef 1481function sq_cid2http($message, $id, $cidurl, $mailbox){
691a2d25 1482 /**
1483 * Get rid of quotes.
1484 */
1485 $quotchar = substr($cidurl, 0, 1);
2dd879b8 1486 if ($quotchar == '"' || $quotchar == "'"){
1487 $cidurl = str_replace($quotchar, "", $cidurl);
1488 } else {
1489 $quotchar = '';
1490 }
691a2d25 1491 $cidurl = substr(trim($cidurl), 4);
e5e9381a 1492 $linkurl = find_ent_id($cidurl, $message);
1493 /* in case of non-save cid links $httpurl should be replaced by a sort of
1494 unsave link image */
1495 $httpurl = '';
1496 if ($linkurl) {
6b04287c 1497 $httpurl = $quotchar . SM_PATH . 'src/download.php?absolute_dl=true&amp;' .
e5e9381a 1498 "passed_id=$id&amp;mailbox=" . urlencode($mailbox) .
3d8371be 1499 '&amp;ent_id=' . $linkurl . $quotchar;
e5e9381a 1500 }
691a2d25 1501 return $httpurl;
1502}
1503
1504/**
1505 * This function changes the <body> tag into a <div> tag since we
1506 * can't really have a body-within-body.
1507 *
2dd879b8 1508 * @param $attary an array of attributes and values of <body>
1509 * @param $mailbox mailbox we're currently reading (for cid2http)
1510 * @param $message current message (for cid2http)
1511 * @param $id current message id (for cid2http)
1512 * @return a modified array of attributes to be set for <div>
691a2d25 1513 */
2dd879b8 1514function sq_body2div($attary, $mailbox, $message, $id){
b583c3e8 1515 $me = 'sq_body2div';
3d8371be 1516 $divattary = Array('class' => "'bodyclass'");
b583c3e8 1517 $bgcolor = '#ffffff';
1518 $text = '#000000';
80b4debd 1519 $has_bgc_stl = $has_txt_stl = false;
b583c3e8 1520 $styledef = '';
691a2d25 1521 if (is_array($attary) && sizeof($attary) > 0){
1522 foreach ($attary as $attname=>$attvalue){
1523 $quotchar = substr($attvalue, 0, 1);
1524 $attvalue = str_replace($quotchar, "", $attvalue);
1525 switch ($attname){
3d8371be 1526 case 'background':
da2415c1 1527 $attvalue = sq_cid2http($message, $id,
2dd879b8 1528 $attvalue, $mailbox);
3d8371be 1529 $styledef .= "background-image: url('$attvalue'); ";
1530 break;
1531 case 'bgcolor':
80b4debd 1532 $has_bgc_stl = true;
3d8371be 1533 $styledef .= "background-color: $attvalue; ";
1534 break;
1535 case 'text':
80b4debd 1536 $has_txt_stl = true;
3d8371be 1537 $styledef .= "color: $attvalue; ";
1538 break;
691a2d25 1539 }
a3daaaf3 1540 }
80b4debd 1541 // Outlook defines a white bgcolor and no text color. This can lead to
1542 // white text on a white bg with certain themes.
1543 if ($has_bgc_stl && !$has_txt_stl) {
1544 $styledef .= "color: $text; ";
1545 }
691a2d25 1546 if (strlen($styledef) > 0){
1547 $divattary{"style"} = "\"$styledef\"";
1548 }
1549 }
1550 return $divattary;
1551}
a3daaaf3 1552
691a2d25 1553/**
1554 * This is the main function and the one you should actually be calling.
1555 * There are several variables you should be aware of an which need
1556 * special description.
1557 *
1558 * Since the description is quite lengthy, see it here:
1559 * http://www.mricon.com/html/phpfilter.html
1560 *
1561 * @param $body the string with HTML you wish to filter
1562 * @param $tag_list see description above
1563 * @param $rm_tags_with_content see description above
1564 * @param $self_closing_tags see description above
1565 * @param $force_tag_closing see description above
1566 * @param $rm_attnames see description above
1567 * @param $bad_attvals see description above
1568 * @param $add_attr_to_tag see description above
1569 * @param $message message object
1570 * @param $id message id
1571 * @return sanitized html safe to show on your pages.
1572 */
da2415c1 1573function sq_sanitize($body,
1574 $tag_list,
691a2d25 1575 $rm_tags_with_content,
1576 $self_closing_tags,
1577 $force_tag_closing,
1578 $rm_attnames,
1579 $bad_attvals,
1580 $add_attr_to_tag,
1581 $message,
b3af12ef 1582 $id,
3d8371be 1583 $mailbox
691a2d25 1584 ){
b583c3e8 1585 $me = 'sq_sanitize';
7d06541f 1586 $rm_tags = array_shift($tag_list);
691a2d25 1587 /**
1588 * Normalize rm_tags and rm_tags_with_content.
1589 */
7d06541f 1590 @array_walk($tag_list, 'sq_casenormalize');
691a2d25 1591 @array_walk($rm_tags_with_content, 'sq_casenormalize');
1592 @array_walk($self_closing_tags, 'sq_casenormalize');
1593 /**
1594 * See if tag_list is of tags to remove or tags to allow.
1595 * false means remove these tags
1596 * true means allow these tags
1597 */
691a2d25 1598 $curpos = 0;
1599 $open_tags = Array();
2dd879b8 1600 $trusted = "\n<!-- begin sanitized html -->\n";
691a2d25 1601 $skip_content = false;
bb8d0799 1602 /**
1603 * Take care of netscape's stupid javascript entities like
1604 * &{alert('boo')};
1605 */
1606 $body = preg_replace("/&(\{.*?\};)/si", "&amp;\\1", $body);
691a2d25 1607
7d06541f 1608 while (($curtag = sq_getnxtag($body, $curpos)) != FALSE){
691a2d25 1609 list($tagname, $attary, $tagtype, $lt, $gt) = $curtag;
1610 $free_content = substr($body, $curpos, $lt-$curpos);
1611 /**
1612 * Take care of <style>
1613 */
7d06541f 1614 if ($tagname == "style" && $tagtype == 1){
da2415c1 1615 list($free_content, $curpos) =
e60a299a 1616 sq_fixstyle($body, $gt+1, $message, $id, $mailbox);
7d06541f 1617 if ($free_content != FALSE){
1618 $trusted .= sq_tagprint($tagname, $attary, $tagtype);
1619 $trusted .= $free_content;
1620 $trusted .= sq_tagprint($tagname, false, 2);
1621 }
1622 continue;
691a2d25 1623 }
1624 if ($skip_content == false){
1625 $trusted .= $free_content;
691a2d25 1626 }
1627 if ($tagname != FALSE){
1628 if ($tagtype == 2){
1629 if ($skip_content == $tagname){
1630 /**
1631 * Got to the end of tag we needed to remove.
1632 */
1633 $tagname = false;
1634 $skip_content = false;
1635 } else {
1636 if ($skip_content == false){
c828931c 1637 if ($tagname == "body"){
1638 $tagname = "div";
2dd879b8 1639 }
da2415c1 1640 if (isset($open_tags{$tagname}) &&
2dd879b8 1641 $open_tags{$tagname} > 0){
1642 $open_tags{$tagname}--;
691a2d25 1643 } else {
2dd879b8 1644 $tagname = false;
691a2d25 1645 }
691a2d25 1646 }
1647 }
1648 } else {
1649 /**
1650 * $rm_tags_with_content
1651 */
1652 if ($skip_content == false){
1653 /**
1654 * See if this is a self-closing type and change
1655 * tagtype appropriately.
1656 */
1657 if ($tagtype == 1
1658 && in_array($tagname, $self_closing_tags)){
2dd879b8 1659 $tagtype = 3;
691a2d25 1660 }
1661 /**
1662 * See if we should skip this tag and any content
1663 * inside it.
1664 */
1665 if ($tagtype == 1 &&
1666 in_array($tagname, $rm_tags_with_content)){
1667 $skip_content = $tagname;
1668 } else {
da2415c1 1669 if (($rm_tags == false
691a2d25 1670 && in_array($tagname, $tag_list)) ||
1671 ($rm_tags == true &&
1672 !in_array($tagname, $tag_list))){
1673 $tagname = false;
1674 } else {
2dd879b8 1675 /**
1676 * Convert body into div.
1677 */
1678 if ($tagname == "body"){
1679 $tagname = "div";
da2415c1 1680 $attary = sq_body2div($attary, $mailbox,
2dd879b8 1681 $message, $id);
1682 }
691a2d25 1683 if ($tagtype == 1){
1684 if (isset($open_tags{$tagname})){
1685 $open_tags{$tagname}++;
1686 } else {
1687 $open_tags{$tagname}=1;
1688 }
1689 }
1690 /**
1691 * This is where we run other checks.
1692 */
1693 if (is_array($attary) && sizeof($attary) > 0){
1694 $attary = sq_fixatts($tagname,
1695 $attary,
1696 $rm_attnames,
1697 $bad_attvals,
1698 $add_attr_to_tag,
1699 $message,
b3af12ef 1700 $id,
3d8371be 1701 $mailbox
691a2d25 1702 );
1703 }
1704 }
1705 }
691a2d25 1706 }
1707 }
1708 if ($tagname != false && $skip_content == false){
1709 $trusted .= sq_tagprint($tagname, $attary, $tagtype);
1710 }
691a2d25 1711 }
1712 $curpos = $gt+1;
a3daaaf3 1713 }
691a2d25 1714 $trusted .= substr($body, $curpos, strlen($body)-$curpos);
1715 if ($force_tag_closing == true){
1716 foreach ($open_tags as $tagname=>$opentimes){
1717 while ($opentimes > 0){
1718 $trusted .= '</' . $tagname . '>';
1719 $opentimes--;
1720 }
1721 }
1722 $trusted .= "\n";
1723 }
1724 $trusted .= "<!-- end sanitized html -->\n";
1725 return $trusted;
1726}
451f74a2 1727
691a2d25 1728/**
1729 * This is a wrapper function to call html sanitizing routines.
1730 *
1731 * @param $body the body of the message
1732 * @param $id the id of the message
1733 * @return a string with html safe to display in the browser.
1734 */
7aad7b77 1735function magicHTML($body, $id, $message, $mailbox = 'INBOX') {
691a2d25 1736 global $attachment_common_show_images, $view_unsafe_images,
3d8371be 1737 $has_unsafe_images;
691a2d25 1738 /**
1739 * Don't display attached images in HTML mode.
1740 */
1741 $attachment_common_show_images = false;
1742 $tag_list = Array(
1743 false,
1744 "object",
1745 "meta",
1746 "html",
1747 "head",
cc34b00d 1748 "base",
e18cb31b 1749 "link",
45071bd6 1750 "frame",
2dd879b8 1751 "iframe",
1752 "plaintext",
1753 "marquee"
691a2d25 1754 );
1755
1756 $rm_tags_with_content = Array(
1757 "script",
1758 "applet",
1759 "embed",
2dd879b8 1760 "title",
1761 "frameset",
1762 "xml"
691a2d25 1763 );
1764
1765 $self_closing_tags = Array(
1766 "img",
1767 "br",
1768 "hr",
1769 "input"
1770 );
1771
2dd879b8 1772 $force_tag_closing = true;
691a2d25 1773
1774 $rm_attnames = Array(
1775 "/.*/" =>
1776 Array(
3a50c8d2 1777 "/target/i",
1778 "/^on.*/i",
1779 "/^dynsrc/i",
1780 "/^data.*/i",
1781 "/^lowsrc.*/i"
691a2d25 1782 )
1783 );
1784
1785 $secremoveimg = "../images/" . _("sec_remove_eng.png");
1786 $bad_attvals = Array(
1787 "/.*/" =>
1788 Array(
0a6ec9b5 1789 "/^src|background/i" =>
691a2d25 1790 Array(
1791 Array(
f83c60a2 1792 "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
1793 "/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
1794 "/^([\'\"])\s*about\s*:.*([\'\"])/si"
691a2d25 1795 ),
1796 Array(
1797 "\\1$secremoveimg\\2",
bb8d0799 1798 "\\1$secremoveimg\\2",
3d8371be 1799 "\\1$secremoveimg\\2",
1800 "\\1$secremoveimg\\2"
691a2d25 1801 )
1802 ),
0a6ec9b5 1803 "/^href|action/i" =>
1804 Array(
1805 Array(
f83c60a2 1806 "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
1807 "/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
1808 "/^([\'\"])\s*about\s*:.*([\'\"])/si"
0a6ec9b5 1809 ),
1810 Array(
2dd879b8 1811 "\\1#\\1",
1812 "\\1#\\1",
1813 "\\1#\\1",
1814 "\\1#\\1"
0a6ec9b5 1815 )
1816 ),
f83c60a2 1817 "/^style/i" =>
691a2d25 1818 Array(
1819 Array(
f83c60a2 1820 "/expression/i",
1821 "/binding/i",
1822 "/behaviou*r/i",
2dd879b8 1823 "/include-source/i",
7d06541f 1824 "/url\s*\(\s*([\'\"])\s*\S+script\s*:.*([\'\"])\s*\)/si",
1825 "/url\s*\(\s*([\'\"])\s*mocha\s*:.*([\'\"])\s*\)/si",
1826 "/url\s*\(\s*([\'\"])\s*about\s*:.*([\'\"])\s*\)/si"
691a2d25 1827 ),
1828 Array(
bb8d0799 1829 "idiocy",
3d8371be 1830 "idiocy",
1831 "idiocy",
2dd879b8 1832 "idiocy",
1833 "url(\\1#\\1)",
1834 "url(\\1#\\1)",
1835 "url(\\1#\\1)",
1836 "url(\\1#\\1)"
691a2d25 1837 )
1838 )
1839 )
1840 );
5262d9a6 1841 if( !sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET) ) {
2dd879b8 1842 $view_unsafe_images = false;
45071bd6 1843 }
691a2d25 1844 if (!$view_unsafe_images){
1845 /**
1846 * Remove any references to http/https if view_unsafe_images set
1847 * to false.
1848 */
0a6ec9b5 1849 array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[0],
f83c60a2 1850 '/^([\'\"])\s*https*:.*([\'\"])/si');
0a6ec9b5 1851 array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[1],
2dd879b8 1852 "\\1$secremoveimg\\1");
3a50c8d2 1853 array_push($bad_attvals{'/.*/'}{'/^style/i'}[0],
43d678b6 1854 '/url\(([\'\"])\s*https*:.*([\'\"])\)/si');
3a50c8d2 1855 array_push($bad_attvals{'/.*/'}{'/^style/i'}[1],
2dd879b8 1856 "url(\\1$secremoveimg\\1)");
691a2d25 1857 }
451f74a2 1858
691a2d25 1859 $add_attr_to_tag = Array(
da2415c1 1860 "/^a$/i" =>
2dd879b8 1861 Array('target'=>'"_new"',
1862 'title'=>'"'._("This external link will open in a new window").'"'
1863 )
1864 );
da2415c1 1865 $trusted = sq_sanitize($body,
1866 $tag_list,
691a2d25 1867 $rm_tags_with_content,
1868 $self_closing_tags,
1869 $force_tag_closing,
1870 $rm_attnames,
1871 $bad_attvals,
1872 $add_attr_to_tag,
1873 $message,
b3af12ef 1874 $id,
3d8371be 1875 $mailbox
691a2d25 1876 );
f83c60a2 1877 if (preg_match("|$secremoveimg|i", $trusted)){
691a2d25 1878 $has_unsafe_images = true;
da2415c1 1879 }
691a2d25 1880 return $trusted;
451f74a2 1881}
a4a70693 1882
da2415c1 1883/**
1884 * function SendDownloadHeaders - send file to the browser
1885 *
1886 * Original Source: SM core src/download.php
1887 * moved here to make it available to other code, and separate
1888 * front end from back end functionality.
1889 *
1890 * @param string $type0 first half of mime type
1891 * @param string $type1 second half of mime type
1892 * @param string $filename filename to tell the browser for downloaded file
1893 * @param boolean $force whether to force the download dialog to pop
1894 * @return void
1895 */
1896 function SendDownloadHeaders($type0, $type1, $filename, $force) {
1897 global $languages, $squirrelmail_language;
1898 $isIE = $isIE6 = 0;
1899
1900 sqgetGlobalVar('HTTP_USER_AGENT', $HTTP_USER_AGENT, SQ_SERVER);
1901
1902 if (strstr($HTTP_USER_AGENT, 'compatible; MSIE ') !== false &&
1903 strstr($HTTP_USER_AGENT, 'Opera') === false) {
1904 $isIE = 1;
1905 }
1906
1907 if (strstr($HTTP_USER_AGENT, 'compatible; MSIE 6') !== false &&
1908 strstr($HTTP_USER_AGENT, 'Opera') === false) {
1909 $isIE6 = 1;
1910 }
1911
1912 if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
1913 function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
1914 $filename =
1915 $languages[$squirrelmail_language]['XTRA_CODE']('downloadfilename', $filename, $HTTP_USER_AGENT);
1916 } else {
1917 $filename = ereg_replace('[\\/:\*\?"<>\|;]', '_', str_replace('&nbsp;', ' ', $filename));
1918 }
1919
1920 // A Pox on Microsoft and it's Office!
1921 if (!$force) {
1922 // Try to show in browser window
1923 header("Content-Disposition: inline; filename=\"$filename\"");
1924 header("Content-Type: $type0/$type1; name=\"$filename\"");
1925 } else {
1926 // Try to pop up the "save as" box
1927 // IE makes this hard. It pops up 2 save boxes, or none.
1928 // http://support.microsoft.com/support/kb/articles/Q238/5/88.ASP
1929 // But, accordint to Microsoft, it is "RFC compliant but doesn't
1930 // take into account some deviations that allowed within the
1931 // specification." Doesn't that mean RFC non-compliant?
1932 // http://support.microsoft.com/support/kb/articles/Q258/4/52.ASP
1933 //
1934 // The best thing you can do for IE is to upgrade to the latest
1935 // version
1936 if ($isIE && !$isIE6) {
1937 // http://support.microsoft.com/support/kb/articles/Q182/3/15.asp
1938 // Do not have quotes around filename, but that applied to
1939 // "attachment"... does it apply to inline too?
1940 //
1941 // This combination seems to work mostly. IE 5.5 SP 1 has
1942 // known issues (see the Microsoft Knowledge Base)
1943 header("Content-Disposition: inline; filename=$filename");
1944 // This works for most types, but doesn't work with Word files
1945 header("Content-Type: application/download; name=\"$filename\"");
1946
1947 // These are spares, just in case. :-)
1948 //header("Content-Type: $type0/$type1; name=\"$filename\"");
1949 //header("Content-Type: application/x-msdownload; name=\"$filename\"");
1950 //header("Content-Type: application/octet-stream; name=\"$filename\"");
1951 } else {
1952 header("Content-Disposition: attachment; filename=\"$filename\"");
1953 // application/octet-stream forces download for Netscape
1954 header("Content-Type: application/octet-stream; name=\"$filename\"");
1955 }
1956 }
1957 }
1958
d6c32258 1959?>
Unnamed repository; edit this file 'description' to name the repository.