projects / squirrelmail.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Use constant instead of hard-coded string for plugin incompatibility indicator
[squirrelmail.git] / functions / mime.php
CommitLineData
59177427 1<?php
2ba13803 2
35586184 3/**
8bd0068d 4 * mime.php
5 *
8bd0068d 6 * This contains the functions necessary to detect and decode MIME
7 * messages.
8 *
4b5049de 9 * @copyright &copy; 1999-2007 The SquirrelMail Project Team
4b4abf93 10 * @license http://opensource.org/licenses/gpl-license.php GNU Public License
8bd0068d 11 * @version $Id$
12 * @package squirrelmail
13 */
b74ba498 14
202bcbcc 15/**
16 * dependency information
17 functions dependency
18 mime_structure
19 class/mime/Message.class.php
20 Message::parseStructure
21 functions/page_header.php
22 displayPageHeader
23 functions/display_messages.php
24 plain_error_message
25 mime_fetch_body
26 functions/imap_general.php
27 sqimap_run_command
28 mime_print_body_lines
29
30
31
32functions/imap.php
33functions/attachment_common.php
34functions/display_messages.php
35
36magicHtml => url_parser
37translateText => url_parser
38
39*/
40
8beafbbc 41
7c7b74b3 42/* -------------------------------------------------------------------------- */
43/* MIME DECODING */
44/* -------------------------------------------------------------------------- */
b74ba498 45
d6c32258 46/**
8bd0068d 47 * Get the MIME structure
48 *
49 * This function gets the structure of a message and stores it in the "message" class.
50 * It will return this object for use with all relevant header information and
51 * fully parsed into the standard "message" object format.
52 */
a4a70693 53function mime_structure ($bodystructure, $flags=array()) {
c9d78ab4 54
3d8371be 55 /* Isolate the body structure and remove beginning and end parenthesis. */
a4a70693 56 $read = trim(substr ($bodystructure, strpos(strtolower($bodystructure), 'bodystructure') + 13));
451f74a2 57 $read = trim(substr ($read, 0, -1));
22efa9fb 58 $i = 0;
59 $msg = Message::parseStructure($read,$i);
2b665f28 60
9de42168 61 if (!is_object($msg)) {
3d8371be 62 global $color, $mailbox;
c96c32f4 63 /* removed urldecode because $_GET is auto urldecoded ??? */
a48eba8f 64 displayPageHeader( $color, $mailbox );
5e8de8b6 65 $errormessage = _("SquirrelMail could not decode the bodystructure of the message");
8bd0068d 66 $errormessage .= '<br />'._("The bodystructure provided by your IMAP server:").'<br /><br />';
472e7acb 67 $errormessage .= '<pre>' . htmlspecialchars($read) . '</pre>';
9de42168 68 plain_error_message( $errormessage, $color );
3d8371be 69 echo '</body></html>';
9de42168 70 exit;
71 }
a4a70693 72 if (count($flags)) {
7a9e9c89 73 foreach ($flags as $flag) {
74 $char = strtoupper($flag{1});
75 switch ($char) {
3d8371be 76 case 'S':
77 if (strtolower($flag) == '\\seen') {
78 $msg->is_seen = true;
79 }
80 break;
81 case 'A':
82 if (strtolower($flag) == '\\answered') {
83 $msg->is_answered = true;
84 }
85 break;
86 case 'D':
87 if (strtolower($flag) == '\\deleted') {
88 $msg->is_deleted = true;
89 }
90 break;
91 case 'F':
92 if (strtolower($flag) == '\\flagged') {
93 $msg->is_flagged = true;
94 }
95 break;
96 case 'M':
97 if (strtolower($flag) == '$mdnsent') {
98 $msg->is_mdnsent = true;
99 }
100 break;
101 default:
102 break;
7a9e9c89 103 }
104 }
451f74a2 105 }
7a9e9c89 106 // listEntities($msg);
3d8371be 107 return $msg;
451f74a2 108}
b74ba498 109
22efa9fb 110
111
3d8371be 112/* This starts the parsing of a particular structure. It is called recursively,
8bd0068d 113 * so it can be passed different structures. It returns an object of type
114 * $message.
115 * First, it checks to see if it is a multipart message. If it is, then it
116 * handles that as it sees is necessary. If it is just a regular entity,
117 * then it parses it and adds the necessary header information (by calling out
118 * to mime_get_elements()
119 */
451f74a2 120
4d592352 121function mime_fetch_body($imap_stream, $id, $ent_id=1, $fetch_size=0) {
3d8371be 122 /* Do a bit of error correction. If we couldn't find the entity id, just guess
8bd0068d 123 * that it is the first one. That is usually the case anyway.
124 */
7c7b74b3 125
09a4bde3 126 if (!$ent_id) {
08b7f7cc 127 $cmd = "FETCH $id BODY[]";
1035e159 128 } else {
08b7f7cc 129 $cmd = "FETCH $id BODY[$ent_id]";
09a4bde3 130 }
3d8371be 131
4d592352 132 if ($fetch_size!=0) $cmd .= "<0.$fetch_size>";
da2415c1 133
6201339c 134 $data = sqimap_run_command ($imap_stream, $cmd, true, $response, $message, TRUE);
77b88425 135 do {
3d8371be 136 $topline = trim(array_shift($data));
137 } while($topline && ($topline[0] == '*') && !preg_match('/\* [0-9]+ FETCH.*/i', $topline)) ;
a4a70693 138
451f74a2 139 $wholemessage = implode('', $data);
140 if (ereg('\\{([^\\}]*)\\}', $topline, $regs)) {
3d8371be 141 $ret = substr($wholemessage, 0, $regs[1]);
142 /* There is some information in the content info header that could be important
8bd0068d 143 * in order to parse html messages. Let's get them here.
144 */
0600bdf1 145// if ($ret{0} == '<') {
6201339c 146// $data = sqimap_run_command ($imap_stream, "FETCH $id BODY[$ent_id.MIME]", true, $response, $message, TRUE);
0600bdf1 147// }
451f74a2 148 } else if (ereg('"([^"]*)"', $topline, $regs)) {
149 $ret = $regs[1];
150 } else {
151 global $where, $what, $mailbox, $passed_id, $startMessage;
3d8371be 152 $par = 'mailbox=' . urlencode($mailbox) . '&amp;passed_id=' . $passed_id;
451f74a2 153 if (isset($where) && isset($what)) {
3d8371be 154 $par .= '&amp;where=' . urlencode($where) . '&amp;what=' . urlencode($what);
a3daaaf3 155 } else {
3d8371be 156 $par .= '&amp;startMessage=' . $startMessage . '&amp;show_more=0';
451f74a2 157 }
e5ea9327 158 $par .= '&amp;response=' . urlencode($response) .
8bd0068d 159 '&amp;message=' . urlencode($message) .
160 '&amp;topline=' . urlencode($topline);
a019eeb8 161
8bd0068d 162 echo '<tt><br />' .
02474e43 163 '<table width="80%"><tr>' .
164 '<tr><td colspan="2">' .
165 _("Body retrieval error. The reason for this is most probably that the message is malformed.") .
166 '</td></tr>' .
167 '<tr><td><b>' . _("Command:") . "</td><td>$cmd</td></tr>" .
168 '<tr><td><b>' . _("Response:") . "</td><td>$response</td></tr>" .
169 '<tr><td><b>' . _("Message:") . "</td><td>$message</td></tr>" .
170 '<tr><td><b>' . _("FETCH line:") . "</td><td>$topline</td></tr>" .
171 "</table><br /></tt></font><hr />";
346817d4 172
6201339c 173 $data = sqimap_run_command ($imap_stream, "FETCH $passed_id BODY[]", true, $response, $message, TRUE);
451f74a2 174 array_shift($data);
175 $wholemessage = implode('', $data);
a019eeb8 176
346817d4 177 $ret = $wholemessage;
a3daaaf3 178 }
3d8371be 179 return $ret;
451f74a2 180}
d4467150 181
6cc670de 182function mime_print_body_lines ($imap_stream, $id, $ent_id=1, $encoding, $rStream='php://stdout') {
1035e159 183
3d8371be 184 /* Don't kill the connection if the browser is over a dialup
8bd0068d 185 * and it would take over 30 seconds to download it.
186 * Don't call set_time_limit in safe mode.
187 */
b7206e1d 188
3d8371be 189 if (!ini_get('safe_mode')) {
b7206e1d 190 set_time_limit(0);
191 }
7c7b74b3 192 /* in case of base64 encoded attachments, do not buffer them.
8bd0068d 193 Instead, echo the decoded attachment directly to screen */
7c7b74b3 194 if (strtolower($encoding) == 'base64') {
195 if (!$ent_id) {
7591f143 196 $query = "FETCH $id BODY[]";
7c7b74b3 197 } else {
7591f143 198 $query = "FETCH $id BODY[$ent_id]";
7c7b74b3 199 }
7591f143 200 sqimap_run_command($imap_stream,$query,true,$response,$message,TRUE,'sqimap_base64_decode',$rStream,true);
1d142b8d 201 } else {
7591f143 202 $body = mime_fetch_body ($imap_stream, $id, $ent_id);
203 if (is_resource($rStream)) {
204 fputs($rStream,decodeBody($body,$encoding));
205 } else {
206 echo decodeBody($body, $encoding);
207 }
1d142b8d 208 }
346817d4 209
da2415c1 210 /*
8bd0068d 211 TODO, use the same method for quoted printable.
212 However, I assume that quoted printable attachments aren't that large
213 so the performancegain / memory usage drop will be minimal.
214 If we decide to add that then we need to adapt sqimap_fread because
215 we need to split te result on \n and fread doesn't stop at \n. That
216 means we also should provide $results from sqimap_fread (by ref) to
217 te function and set $no_return to false. The $filter function for
218 quoted printable should handle unsetting of $results.
219 */
da2415c1 220 /*
8bd0068d 221 TODO 2: find out how we write to the output stream php://stdout. fwrite
222 doesn't work because 'php://stdout isn't a stream.
223 */
7c7b74b3 224
5d9c6f73 225 return;
451f74a2 226}
beb9e459 227
451f74a2 228/* -[ END MIME DECODING ]----------------------------------------------------------- */
d4467150 229
3d8371be 230/* This is here for debugging purposes. It will print out a list
8bd0068d 231 * of all the entity IDs that are in the $message object.
232 */
451f74a2 233function listEntities ($message) {
3d8371be 234 if ($message) {
3c621ba1 235 echo "<tt>" . $message->entity_id . ' : ' . $message->type0 . '/' . $message->type1 . ' parent = '. $message->parent->entity_id. '<br />';
3d8371be 236 for ($i = 0; isset($message->entities[$i]); $i++) {
237 echo "$i : ";
238 $msg = listEntities($message->entities[$i]);
239
240 if ($msg) {
241 echo "return: ";
242 return $msg;
243 }
244 }
a4a70693 245 }
451f74a2 246}
f0c4dc12 247
f792c641 248function getPriorityStr($priority) {
3d8371be 249 $priority_level = substr($priority,0,1);
250
251 switch($priority_level) {
252 /* Check for a higher then normal priority. */
253 case '1':
254 case '2':
255 $priority_string = _("High");
256 break;
257
258 /* Check for a lower then normal priority. */
259 case '4':
260 case '5':
261 $priority_string = _("Low");
262 break;
263
264 /* Check for a normal priority. */
265 case '3':
266 default:
267 $priority_level = '3';
268 $priority_string = _("Normal");
269 break;
270
271 }
272 return $priority_string;
f792c641 273}
274
451f74a2 275/* returns a $message object for a particular entity id */
276function getEntity ($message, $ent_id) {
a4a70693 277 return $message->getEntity($ent_id);
451f74a2 278}
8beafbbc 279
3d8371be 280/* translateText
8bd0068d 281 * Extracted from strings.php 23/03/2002
282 */
da4c66e8 283
284function translateText(&$body, $wrap_at, $charset) {
3d8371be 285 global $where, $what; /* from searching */
286 global $color; /* color theme */
da4c66e8 287
202bcbcc 288 // require_once(SM_PATH . 'functions/url_parser.php');
da4c66e8 289
290 $body_ary = explode("\n", $body);
da4c66e8 291 for ($i=0; $i < count($body_ary); $i++) {
292 $line = $body_ary[$i];
293 if (strlen($line) - 2 >= $wrap_at) {
c7aff938 294 sqWordWrap($line, $wrap_at, $charset);
da4c66e8 295 }
296 $line = charset_decode($charset, $line);
297 $line = str_replace("\t", ' ', $line);
298
299 parseUrl ($line);
300
3d8371be 301 $quotes = 0;
da4c66e8 302 $pos = 0;
3d8371be 303 $j = strlen($line);
da4c66e8 304
3d8371be 305 while ($pos < $j) {
da4c66e8 306 if ($line[$pos] == ' ') {
3d8371be 307 $pos++;
da4c66e8 308 } else if (strpos($line, '&gt;', $pos) === $pos) {
309 $pos += 4;
3d8371be 310 $quotes++;
da4c66e8 311 } else {
312 break;
313 }
314 }
3d8371be 315
83c94382 316 if ($quotes % 2) {
d0814c02 317 $line = '<span class="quote1">' . $line . '</span>';
4c25967c 318 } elseif ($quotes) {
d0814c02 319 $line = '<span class="quote2">' . $line . '</span>';
da4c66e8 320 }
3d8371be 321
da4c66e8 322 $body_ary[$i] = $line;
323 }
324 $body = '<pre>' . implode("\n", $body_ary) . '</pre>';
325}
326
a2bfcbce 327/**
da1b55ad 328 * This returns a parsed string called $body. That string can then
329 * be displayed as the actual message in the HTML. It contains
330 * everything needed, including HTML Tags, Attachments at the
331 * bottom, etc.
f8a1ed5a 332 *
da1b55ad 333 * Since 1.2.0 function uses message_body hook.
334 * Till 1.3.0 function included output of formatAttachments().
335 *
336 * @param resource $imap_stream imap connection resource
337 * @param object $message squirrelmail message object
338 * @param array $color squirrelmail color theme array
339 * @param integer $wrap_at number of characters per line
340 * @param string $ent_num (since 1.3.0) message part id
341 * @param integer $id (since 1.3.0) message id
342 * @param string $mailbox (since 1.3.0) imap folder name
41f701c1 343 * @param boolean $clean (since 1.5.1) Do not output stuff that's irrelevant for the printable version.
da1b55ad 344 * @return string html formated message text
345 */
a2bfcbce 346function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $mailbox='INBOX', $clean=FALSE) {
3d8371be 347 /* This if statement checks for the entity to show as the
8bd0068d 348 * primary message. To add more of them, just put them in the
349 * order that is their priority.
350 */
ce68b76b 351 global $startMessage, $languages, $squirrelmail_language,
40a34e57 352 $show_html_default, $sort, $has_unsafe_images, $passed_ent_id,
14c85e39 353 $use_iframe, $iframe_height, $download_and_unsafe_link,
955bfc8f 354 $download_href, $unsafe_image_toggle_href, $unsafe_image_toggle_text,
355 $oTemplate;
356
357 $nbsp = $oTemplate->fetch('non_breaking_space.tpl');
2c25d36a 358
359 // workaround for not updated config.php
360 if (! isset($use_iframe)) $use_iframe = false;
77bfbd2e 361
5262d9a6 362 if( !sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET) ) {
363 $view_unsafe_images = false;
77bfbd2e 364 }
d03c24f4 365
cc34b00d 366 $body = '';
23bcec6f 367 $urlmailbox = urlencode($mailbox);
451f74a2 368 $body_message = getEntity($message, $ent_num);
369 if (($body_message->header->type0 == 'text') ||
8bd0068d 370 ($body_message->header->type0 == 'rfc822')) {
3d8371be 371 $body = mime_fetch_body ($imap_stream, $id, $ent_num);
451f74a2 372 $body = decodeBody($body, $body_message->header->encoding);
e842b215 373
374 if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
8bd0068d 375 function_exists($languages[$squirrelmail_language]['XTRA_CODE'] . '_decode')) {
e842b215 376 if (mb_detect_encoding($body) != 'ASCII') {
33a55f5a 377 $body = call_user_func($languages[$squirrelmail_language]['XTRA_CODE'] . '_decode',$body);
e842b215 378 }
379 }
d849b570 380
381 /* As of 1.5.2, $body is passed (and modified) by reference */
382 do_hook('message_body', $body);
23bcec6f 383
3d8371be 384 /* If there are other types that shouldn't be formatted, add
8bd0068d 385 * them here.
386 */
3d8371be 387
451f74a2 388 if ($body_message->header->type1 == 'html') {
3d8371be 389 if ($show_html_default <> 1) {
85015544 390 $entity_conv = array('&nbsp;' => ' ',
8bd0068d 391 '<p>' => "\n",
392 '<P>' => "\n",
393 '<br>' => "\n",
394 '<BR>' => "\n",
395 '<br />' => "\n",
396 '<BR />' => "\n",
397 '&gt;' => '>',
398 '&lt;' => '<');
85015544 399 $body = strtr($body, $entity_conv);
3d8371be 400 $body = strip_tags($body);
85015544 401 $body = trim($body);
402 translateText($body, $wrap_at,
8bd0068d 403 $body_message->header->getParameter('charset'));
2c25d36a 404 } elseif ($use_iframe && ! $clean) {
405 // $clean is used to remove iframe in printable view.
406
84410f31 407 /**
408 * If we don't add html message between iframe tags,
409 * we must detect unsafe images and modify $has_unsafe_images.
f8a1ed5a 410 */
758a7889 411 $html_body = magicHTML($body, $id, $message, $mailbox);
b6c52e61 412 // Convert character set in order to display html mails in different character set
413 $html_body = charset_decode($body_message->header->getParameter('charset'),$html_body,false,true);
84410f31 414
2c25d36a 415 // creating iframe url
416 $iframeurl=sqm_baseuri().'src/view_html.php?'
f8a1ed5a 417 . 'mailbox=' . $urlmailbox
2c25d36a 418 . '&amp;passed_id=' . $id
419 . '&amp;ent_id=' . $ent_num
420 . '&amp;view_unsafe_images=' . (int) $view_unsafe_images;
421
79d58d4c 422 global $oTemplate;
423 $oTemplate->assign('iframe_url', $iframeurl);
424 $oTemplate->assign('html_body', $html_body);
2b665f28 425
79d58d4c 426 $body = $oTemplate->fetch('read_html_iframe.tpl');
a3daaaf3 427 } else {
2c25d36a 428 // old way of html rendering
f8a1ed5a 429 $body = magicHTML($body, $id, $message, $mailbox);
b6c52e61 430 /**
758a7889 431 * convert character set. charset_decode does not remove html special chars
b6c52e61 432 * applied by magicHTML functions and does not sanitize them second time if
758a7889 433 * fourth argument is true.
434 */
b6c52e61 435 $body = charset_decode($body_message->header->getParameter('charset'),$body,false,true);
a3daaaf3 436 }
451f74a2 437 } else {
3d8371be 438 translateText($body, $wrap_at,
8bd0068d 439 $body_message->header->getParameter('charset'));
451f74a2 440 }
a2bfcbce 441
442 // if this is the clean display (i.e. printer friendly), stop here.
443 if ( $clean ) {
444 return $body;
445 }
446
40a34e57 447 $download_and_unsafe_link = '';
448
83cf04bd 449 $link = 'passed_id=' . $id . '&amp;ent_id='.$ent_num.
8bd0068d 450 '&amp;mailbox=' . $urlmailbox .'&amp;sort=' . $sort .
451 '&amp;startMessage=' . $startMessage . '&amp;show_more=0';
08b7f7cc 452 if (isset($passed_ent_id)) {
453 $link .= '&amp;passed_ent_id='.$passed_ent_id;
454 }
14c85e39 455 $download_href = SM_PATH . 'src/download.php?absolute_dl=true&amp;' . $link;
955bfc8f 456 $download_and_unsafe_link .= "$nbsp|$nbsp"
457 . create_hyperlink($download_href, _("Download this as a file"));
7aad7b77 458 if ($view_unsafe_images) {
23f617b8 459 $text = _("Hide Unsafe Images");
7aad7b77 460 } else {
08b7f7cc 461 if (isset($has_unsafe_images) && $has_unsafe_images) {
462 $link .= '&amp;view_unsafe_images=1';
463 $text = _("View Unsafe Images");
464 } else {
465 $text = '';
466 }
3d8371be 467 }
83cf04bd 468 if($text != '') {
14c85e39 469 $unsafe_image_toggle_href = SM_PATH . 'src/read_body.php?'.$link;
470 $unsafe_image_toggle_text = $text;
955bfc8f 471 $download_and_unsafe_link .= "$nbsp|$nbsp"
472 . create_hyperlink($unsafe_image_toggle_href, $text);
83cf04bd 473 }
3d8371be 474 }
475 return $body;
451f74a2 476}
b74ba498 477
da1b55ad 478/**
d67f519a 479 * Generate attachments array for passing to templates. Separated from
480 * formatAttachments() below so that the same array can be given to the
481 * print-friendly version.
2b665f28 482 *
d67f519a 483 * @since 1.5.2
da1b55ad 484 * @param object $message SquirrelMail message object
485 * @param array $exclude_id message parts that are not attachments.
486 * @param string $mailbox mailbox name
487 * @param integer $id message id
da1b55ad 488 */
d67f519a 489function buildAttachmentArray($message, $exclude_id, $mailbox, $id) {
490 global $where, $what, $startMessage, $color, $passed_ent_id, $base_uri;
451f74a2 491
23bcec6f 492 $att_ar = $message->getAttachments($exclude_id);
23bcec6f 493 $urlMailbox = urlencode($mailbox);
494
d67f519a 495 $attachments = array();
23bcec6f 496 foreach ($att_ar as $att) {
fdc9d9b5 497 $ent = $att->entity_id;
2e25760a 498 $header = $att->header;
f0c4dc12 499 $type0 = strtolower($header->type0);
500 $type1 = strtolower($header->type1);
2e25760a 501 $name = '';
d0187bd6 502 $links = array();
21dab2dc 503 $links['download link']['text'] = _("Download");
202bcbcc 504 $links['download link']['href'] = $base_uri .
8bd0068d 505 "src/download.php?absolute_dl=true&amp;passed_id=$id&amp;mailbox=$urlMailbox&amp;ent_id=$ent";
2b665f28 506
2e25760a 507 if ($type0 =='message' && $type1 == 'rfc822') {
202bcbcc 508 $default_page = $base_uri . 'src/read_body.php';
2e25760a 509 $rfc822_header = $att->rfc822_header;
098ea084 510 $filename = $rfc822_header->subject;
6cc08d8b 511 if (trim( $filename ) == '') {
512 $filename = 'untitled-[' . $ent . ']' ;
08b7f7cc 513 }
2e25760a 514 $from_o = $rfc822_header->from;
515 if (is_object($from_o)) {
04ea844e 516 $from_name = decodeHeader($from_o->getAddress(false));
7e697748 517 } elseif (is_array($from_o) && count($from_o) && is_object($from_o[0])) {
518 // something weird happens when a digest message is opened and you return to the digest
519 // now the from object is part of an array. Probably the parseHeader call overwrites the info
520 // retrieved from the bodystructure in a different way. We need to fix this later.
521 // possible starting point, do not fetch header we already have and inspect how
522 // the rfc822_header object behaves.
523 $from_name = decodeHeader($from_o[0]->getAddress(false));
2e25760a 524 } else {
525 $from_name = _("Unknown sender");
f0c4dc12 526 }
d0187bd6 527 $description = _("From").': '.$from_name;
23bcec6f 528 } else {
202bcbcc 529 $default_page = $base_uri . 'src/download.php';
02474e43 530 $filename = $att->getFilename();
f810c0b2 531 if ($header->description) {
098ea084 532 $description = decodeHeader($header->description);
f810c0b2 533 } else {
3d8371be 534 $description = '';
535 }
2e25760a 536 }
537
538 $display_filename = $filename;
3d8371be 539 if (isset($passed_ent_id)) {
540 $passed_ent_id_link = '&amp;passed_ent_id='.$passed_ent_id;
541 } else {
542 $passed_ent_id_link = '';
543 }
544 $defaultlink = $default_page . "?startMessage=$startMessage"
8bd0068d 545 . "&amp;passed_id=$id&amp;mailbox=$urlMailbox"
546 . '&amp;ent_id='.$ent.$passed_ent_id_link;
2e25760a 547 if ($where && $what) {
8bd0068d 548 $defaultlink .= '&amp;where='. urlencode($where).'&amp;what='.urlencode($what);
2e25760a 549 }
7e2ff844 550 // IE does make use of mime content sniffing. Forcing a download
551 // prohibit execution of XSS inside an application/octet-stream attachment
552 if ($type0 == 'application' && $type1 == 'octet-stream') {
553 $defaultlink .= '&amp;absolute_dl=true';
554 }
2b665f28 555
3d8371be 556 /* This executes the attachment hook with a specific MIME-type.
8bd0068d 557 * If that doesn't have results, it tries if there's a rule
9b94c54d 558 * for a more generic type. Finally, a hook for ALL attachment
559 * types is run as well.
8bd0068d 560 */
d849b570 561 /* The API for this hook has changed as of 1.5.2 so that all plugin
562 arguments are passed in an array instead of each their own plugin
563 argument, and arguments are passed by reference, so instead of
564 returning any changes, changes should simply be made to the original
565 arguments themselves. */
566 do_hook("attachment $type0/$type1", $temp=array(&$links,
567 &$startMessage, &$id, &$urlMailbox, &$ent, &$defaultlink,
568 &$display_filename, &$where, &$what));
569 if(count($links) <= 1) {
570 /* The API for this hook has changed as of 1.5.2 so that all plugin
571 arguments are passed in an array instead of each their own plugin
572 argument, and arguments are passed by reference, so instead of
573 returning any changes, changes should simply be made to the original
574 arguments themselves. */
575 do_hook("attachment $type0/*", $temp=array(&$links,
576 &$startMessage, &$id, &$urlMailbox, &$ent, &$defaultlink,
577 &$display_filename, &$where, &$what));
2e25760a 578 }
d849b570 579 /* The API for this hook has changed as of 1.5.2 so that all plugin
580 arguments are passed in an array instead of each their own plugin
581 argument, and arguments are passed by reference, so instead of
582 returning any changes, changes should simply be made to the original
583 arguments themselves. */
584 do_hook("attachment */*", $temp=array(&$links,
585 &$startMessage, &$id, &$urlMailbox, &$ent, &$defaultlink,
586 &$display_filename, &$where, &$what));
77b88425 587
d67f519a 588 $this_attachment = array();
589 $this_attachment['Name'] = decodeHeader($display_filename);
590 $this_attachment['Description'] = $description;
591 $this_attachment['DefaultHREF'] = $defaultlink;
592 $this_attachment['DownloadHREF'] = $links['download link']['href'];
593 $this_attachment['ViewHREF'] = isset($links['attachment_common']) ? $links['attachment_common']['href'] : '';
594 $this_attachment['Size'] = $header->size;
595 $this_attachment['ContentType'] = htmlspecialchars($type0 .'/'. $type1);
596 $this_attachment['OtherLinks'] = array();
3d8371be 597 foreach ($links as $val) {
d0187bd6 598 if ($val['text']==_("Download") || $val['text'] == _("View"))
599 continue;
600 if (empty($val['text']) && empty($val['extra']))
601 continue;
2b665f28 602
d67f519a 603 $temp = array();
604 $temp['HREF'] = $val['href'];
605 $temp['Text'] = (empty($val['text']) ? '' : $val['text']) . (empty($val['extra']) ? '' : $val['extra']);
606 $this_attachment['OtherLinks'][] = $temp;
2e25760a 607 }
d67f519a 608 $attachments[] = $this_attachment;
2b665f28 609
3d8371be 610 unset($links);
2e25760a 611 }
2b665f28 612
d67f519a 613 return $attachments;
614}
615
616/**
617 * Displays attachment links and information
618 *
619 * Since 1.3.0 function is not included in formatBody() call.
620 *
621 * Since 1.0.2 uses attachment $type0/$type1 hook.
622 * Since 1.2.5 uses attachment $type0/* hook.
623 * Since 1.5.0 uses attachments_bottom hook.
624 * Since 1.5.2 uses templates and does *not* return a value.
625 *
626 * @param object $message SquirrelMail message object
627 * @param array $exclude_id message parts that are not attachments.
628 * @param string $mailbox mailbox name
629 * @param integer $id message id
630 */
631function formatAttachments($message, $exclude_id, $mailbox, $id) {
632 global $oTemplate;
2b665f28 633
d67f519a 634 $attach = buildAttachmentArray($message, $exclude_id, $mailbox, $id);
d0187bd6 635
636 $oTemplate->assign('attachments', $attach);
637 $oTemplate->display('read_attachments.tpl');
451f74a2 638}
b74ba498 639
7c7b74b3 640function sqimap_base64_decode(&$string) {
7c0ec1d8 641
b17a8968 642 // Base64 encoded data goes in pairs of 4 bytes. To achieve on the
7c0ec1d8 643 // fly decoding (to reduce memory usage) you have to check if the
644 // data has incomplete pairs
645
b17a8968 646 // Remove the noise in order to check if the 4 bytes pairs are complete
7c0ec1d8 647 $string = str_replace(array("\r\n","\n", "\r", " "),array('','','',''),$string);
648
42ce44f8 649 $sStringRem = '';
7c0ec1d8 650 $iMod = strlen($string) % 4;
651 if ($iMod) {
652 $sStringRem = substr($string,-$iMod);
b17a8968 653 // Check if $sStringRem contains padding characters
7c0ec1d8 654 if (substr($sStringRem,-1) != '=') {
655 $string = substr($string,0,-$iMod);
656 } else {
657 $sStringRem = '';
658 }
659 }
7c7b74b3 660 $string = base64_decode($string);
7c0ec1d8 661 return $sStringRem;
7c7b74b3 662}
663
fdf7cef1 664/**
665 * Decodes encoded message body
666 *
667 * This function decodes the body depending on the encoding type.
668 * Currently quoted-printable and base64 encodings are supported.
669 * decode_body hook was added to this function in 1.4.2/1.5.0
670 * @param string $body encoded message body
671 * @param string $encoding used encoding
672 * @return string decoded string
673 * @since 1.0
674 */
451f74a2 675function decodeBody($body, $encoding) {
83be314a 676
b583c3e8 677 $body = str_replace("\r\n", "\n", $body);
678 $encoding = strtolower($encoding);
3d8371be 679
d849b570 680 $encoding_handler = do_hook('decode_body', $encoding);
5166f86a 681
682
683 // plugins get first shot at decoding the body
684 //
685 if (!empty($encoding_handler) && function_exists($encoding_handler)) {
686 $body = $encoding_handler('decode', $body);
687
fdf7cef1 688 } elseif ($encoding == 'quoted-printable' ||
8bd0068d 689 $encoding == 'quoted_printable') {
fdf7cef1 690 /**
691 * quoted_printable_decode() function is broken in older
692 * php versions. Text with \r\n decoding was fixed only
758a7889 693 * in php 4.3.0. Minimal code requirement 4.0.4 +
fdf7cef1 694 * str_replace("\r\n", "\n", $body); call.
695 */
b583c3e8 696 $body = quoted_printable_decode($body);
fdf7cef1 697 } elseif ($encoding == 'base64') {
b583c3e8 698 $body = base64_decode($body);
699 }
3d8371be 700
b583c3e8 701 // All other encodings are returned raw.
3d8371be 702 return $body;
451f74a2 703}
704
9f7f68c3 705/**
8bd0068d 706 * Decodes headers
707 *
708 * This functions decode strings that is encoded according to
709 * RFC1522 (MIME Part Two: Message Header Extensions for Non-ASCII Text).
710 * Patched by Christian Schmidt <christian@ostenfeld.dk> 23/03/2002
711 *
712 * @param string $string header string that has to be made readable
713 * @param boolean $utfencode change message in order to be readable on user's charset. defaults to true
714 * @param boolean $htmlsave preserve spaces and sanitize html special characters. defaults to true
715 * @param boolean $decide decide if string can be utfencoded. defaults to false
716 * @return string decoded header string
717 */
9f7f68c3 718function decodeHeader ($string, $utfencode=true,$htmlsave=true,$decide=false) {
d6f584fc 719 global $languages, $squirrelmail_language,$default_charset;
79e07c7e 720 if (is_array($string)) {
721 $string = implode("\n", $string);
722 }
da2415c1 723
10dec454 724 if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
8bd0068d 725 function_exists($languages[$squirrelmail_language]['XTRA_CODE'] . '_decodeheader')) {
33a55f5a 726 $string = call_user_func($languages[$squirrelmail_language]['XTRA_CODE'] . '_decodeheader', $string);
08b7f7cc 727 // Do we need to return at this point?
728 // return $string;
83be314a 729 }
79e07c7e 730 $i = 0;
08b7f7cc 731 $iLastMatch = -2;
db65b6b0 732 $encoded = true;
0a06275a 733
098ea084 734 $aString = explode(' ',$string);
08b7f7cc 735 $ret = '';
098ea084 736 foreach ($aString as $chunk) {
358a78a1 737 if ($encoded && $chunk === '') {
08b7f7cc 738 continue;
358a78a1 739 } elseif ($chunk === '') {
08b7f7cc 740 $ret .= ' ';
741 continue;
742 }
098ea084 743 $encoded = false;
08b7f7cc 744 /* if encoded words are not separated by a linear-space-white we still catch them */
745 $j = $i-1;
7e6ca3e8 746
08b7f7cc 747 while ($match = preg_match('/^(.*)=\?([^?]*)\?(Q|B)\?([^?]*)\?=(.*)$/Ui',$chunk,$res)) {
748 /* if the last chunk isn't an encoded string then put back the space, otherwise don't */
749 if ($iLastMatch !== $j) {
750 if ($htmlsave) {
9f7f68c3 751 $ret .= '&#32;';
08b7f7cc 752 } else {
753 $ret .= ' ';
754 }
755 }
756 $iLastMatch = $i;
757 $j = $i;
cb718de0 758 if ($htmlsave) {
759 $ret .= htmlspecialchars($res[1]);
760 } else {
761 $ret .= $res[1];
762 }
098ea084 763 $encoding = ucfirst($res[3]);
d6f584fc 764
765 /* decide about valid decoding */
766 if ($decide && is_conversion_safe($res[2])) {
8bd0068d 767 $utfencode=true;
768 $can_be_encoded=true;
d6f584fc 769 } else {
8bd0068d 770 $can_be_encoded=false;
d6f584fc 771 }
098ea084 772 switch ($encoding)
773 {
8bd0068d 774 case 'B':
775 $replace = base64_decode($res[4]);
776 if ($utfencode) {
777 if ($can_be_encoded) {
778 /* convert string to different charset,
779 * if functions asks for it (usually in compose)
780 */
bc6c0fba 781 $ret .= charset_convert($res[2],$replace,$default_charset,$htmlsave);
8bd0068d 782 } else {
783 // convert string to html codes in order to display it
784 $ret .= charset_decode($res[2],$replace);
785 }
fab65ca9 786 } else {
8bd0068d 787 if ($htmlsave) {
788 $replace = htmlspecialchars($replace);
789 }
790 $ret.= $replace;
fab65ca9 791 }
8bd0068d 792 break;
793 case 'Q':
794 $replace = str_replace('_', ' ', $res[4]);
795 $replace = preg_replace('/=([0-9a-f]{2})/ie', 'chr(hexdec("\1"))',
796 $replace);
797 if ($utfencode) {
798 if ($can_be_encoded) {
799 /* convert string to different charset,
800 * if functions asks for it (usually in compose)
801 */
bc6c0fba 802 $replace = charset_convert($res[2], $replace,$default_charset,$htmlsave);
8bd0068d 803 } else {
804 // convert string to html codes in order to display it
805 $replace = charset_decode($res[2], $replace);
806 }
807 } else {
808 if ($htmlsave) {
809 $replace = htmlspecialchars($replace);
810 }
098ea084 811 }
8bd0068d 812 $ret .= $replace;
813 break;
814 default:
815 break;
79e07c7e 816 }
098ea084 817 $chunk = $res[5];
818 $encoded = true;
08b7f7cc 819 }
820 if (!$encoded) {
821 if ($htmlsave) {
9f7f68c3 822 $ret .= '&#32;';
08b7f7cc 823 } else {
824 $ret .= ' ';
da2415c1 825 }
08b7f7cc 826 }
dc3d13a7 827
828 if (!$encoded && $htmlsave) {
829 $ret .= htmlspecialchars($chunk);
830 } else {
831 $ret .= $chunk;
832 }
098ea084 833 ++$i;
834 }
fd81e884 835 /* remove the first added space */
836 if ($ret) {
837 if ($htmlsave) {
9f7f68c3 838 $ret = substr($ret,5);
fd81e884 839 } else {
840 $ret = substr($ret,1);
841 }
842 }
da2415c1 843
08b7f7cc 844 return $ret;
451f74a2 845}
846
9f7f68c3 847/**
a24cf710 848 * Encodes header
8bd0068d 849 *
a24cf710 850 * Function uses XTRA_CODE _encodeheader function, if such function exists.
a24cf710 851 *
758a7889 852 * Function uses Q encoding by default and encodes a string according to RFC
853 * 1522 for use in headers if it contains 8-bit characters or anything that
a24cf710 854 * looks like it should be encoded.
8bd0068d 855 *
758a7889 856 * Function switches to B encoding and encodeHeaderBase64() function, if
857 * string is 8bit and multibyte character set supported by mbstring extension
858 * is used. It can cause E_USER_NOTICE errors, if interface is used with
f270a6eb 859 * multibyte character set unsupported by mbstring extension.
860 *
8bd0068d 861 * @param string $string header string, that has to be encoded
862 * @return string quoted-printable encoded string
f270a6eb 863 * @todo make $mb_charsets system wide constant
8bd0068d 864 */
451f74a2 865function encodeHeader ($string) {
6fbd125b 866 global $default_charset, $languages, $squirrelmail_language;
83be314a 867
10dec454 868 if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
8bd0068d 869 function_exists($languages[$squirrelmail_language]['XTRA_CODE'] . '_encodeheader')) {
33a55f5a 870 return call_user_func($languages[$squirrelmail_language]['XTRA_CODE'] . '_encodeheader', $string);
83be314a 871 }
793cc001 872
a24cf710 873 // Use B encoding for multibyte charsets
f270a6eb 874 $mb_charsets = array('utf-8','big5','gb2313','euc-kr');
875 if (in_array($default_charset,$mb_charsets) &&
876 in_array($default_charset,sq_mb_list_encodings()) &&
877 sq_is8bit($string)) {
878 return encodeHeaderBase64($string,$default_charset);
879 } elseif (in_array($default_charset,$mb_charsets) &&
880 sq_is8bit($string) &&
881 ! in_array($default_charset,sq_mb_list_encodings())) {
882 // Add E_USER_NOTICE error here (can cause 'Cannot add header information' warning in compose.php)
883 // trigger_error('encodeHeader: Multibyte character set unsupported by mbstring extension.',E_USER_NOTICE);
884 }
a24cf710 885
451f74a2 886 // Encode only if the string contains 8-bit characters or =?
3d8371be 887 $j = strlen($string);
098ea084 888 $max_l = 75 - strlen($default_charset) - 7;
889 $aRet = array();
451f74a2 890 $ret = '';
c96c32f4 891 $iEncStart = $enc_init = false;
0d53f0f9 892 $cur_l = $iOffset = 0;
3d8371be 893 for($i = 0; $i < $j; ++$i) {
c96c32f4 894 switch($string{$i})
895 {
8bd0068d 896 case '=':
897 case '<':
898 case '>':
899 case ',':
900 case '?':
901 case '_':
902 if ($iEncStart === false) {
903 $iEncStart = $i;
904 }
905 $cur_l+=3;
906 if ($cur_l > ($max_l-2)) {
907 /* if there is an stringpart that doesn't need encoding, add it */
08b7f7cc 908 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
c96c32f4 909 $aRet[] = "=?$default_charset?Q?$ret?=";
910 $iOffset = $i;
911 $cur_l = 0;
912 $ret = '';
913 $iEncStart = false;
08b7f7cc 914 } else {
8bd0068d 915 $ret .= sprintf("=%02X",ord($string{$i}));
c96c32f4 916 }
8bd0068d 917 break;
918 case '(':
919 case ')':
920 if ($iEncStart !== false) {
08b7f7cc 921 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
8bd0068d 922 $aRet[] = "=?$default_charset?Q?$ret?=";
c96c32f4 923 $iOffset = $i;
8bd0068d 924 $cur_l = 0;
925 $ret = '';
926 $iEncStart = false;
c96c32f4 927 }
8bd0068d 928 break;
929 case ' ':
c96c32f4 930 if ($iEncStart !== false) {
098ea084 931 $cur_l++;
932 if ($cur_l > $max_l) {
08b7f7cc 933 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
c96c32f4 934 $aRet[] = "=?$default_charset?Q?$ret?=";
c96c32f4 935 $iOffset = $i;
936 $cur_l = 0;
098ea084 937 $ret = '';
8bd0068d 938 $iEncStart = false;
08b7f7cc 939 } else {
8bd0068d 940 $ret .= '_';
c96c32f4 941 }
3d8371be 942 }
8bd0068d 943 break;
944 default:
945 $k = ord($string{$i});
946 if ($k > 126) {
947 if ($iEncStart === false) {
948 // do not start encoding in the middle of a string, also take the rest of the word.
949 $sLeadString = substr($string,0,$i);
950 $aLeadString = explode(' ',$sLeadString);
951 $sToBeEncoded = array_pop($aLeadString);
952 $iEncStart = $i - strlen($sToBeEncoded);
953 $ret .= $sToBeEncoded;
954 $cur_l += strlen($sToBeEncoded);
955 }
956 $cur_l += 3;
957 /* first we add the encoded string that reached it's max size */
958 if ($cur_l > ($max_l-2)) {
959 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
960 $aRet[] = "=?$default_charset?Q?$ret?= "; /* the next part is also encoded => separate by space */
961 $cur_l = 3;
962 $ret = '';
963 $iOffset = $i;
964 $iEncStart = $i;
965 }
966 $enc_init = true;
967 $ret .= sprintf("=%02X", $k);
968 } else {
969 if ($iEncStart !== false) {
970 $cur_l++;
971 if ($cur_l > $max_l) {
972 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
973 $aRet[] = "=?$default_charset?Q?$ret?=";
974 $iEncStart = false;
975 $iOffset = $i;
976 $cur_l = 0;
977 $ret = '';
978 } else {
979 $ret .= $string{$i};
980 }
981 }
982 }
983 break;
f7b3ba37 984 }
451f74a2 985 }
793cc001 986
c96c32f4 987 if ($enc_init) {
988 if ($iEncStart !== false) {
989 $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
990 $aRet[] = "=?$default_charset?Q?$ret?=";
991 } else {
992 $aRet[] = substr($string,$iOffset);
993 }
994 $string = implode('',$aRet);
451f74a2 995 }
3d8371be 996 return $string;
451f74a2 997}
b74ba498 998
f270a6eb 999/**
1000 * Encodes string according to rfc2047 B encoding header formating rules
1001 *
758a7889 1002 * It is recommended way to encode headers with character sets that store
f270a6eb 1003 * symbols in more than one byte.
1004 *
1005 * Function requires mbstring support. If required mbstring functions are missing,
1006 * function returns false and sets E_USER_WARNING level error message.
1007 *
758a7889 1008 * Minimal requirements - php 4.0.6 with mbstring extension. Please note,
1009 * that mbstring functions will generate E_WARNING errors, if unsupported
f270a6eb 1010 * character set is used. mb_encode_mimeheader function provided by php
1011 * mbstring extension is not used in order to get better control of header
1012 * encoding.
1013 *
758a7889 1014 * Used php code functions - function_exists(), trigger_error(), strlen()
1015 * (is used with charset names and base64 strings). Used php mbstring
f270a6eb 1016 * functions - mb_strlen and mb_substr.
1017 *
758a7889 1018 * Related documents: rfc 2045 (BASE64 encoding), rfc 2047 (mime header
f270a6eb 1019 * encoding), rfc 2822 (header folding)
1020 *
1021 * @param string $string header string that must be encoded
758a7889 1022 * @param string $charset character set. Must be supported by mbstring extension.
f270a6eb 1023 * Use sq_mb_list_encodings() to detect supported charsets.
1024 * @return string string encoded according to rfc2047 B encoding formating rules
1025 * @since 1.5.1
1026 * @todo First header line can be wrapped to $iMaxLength - $HeaderFieldLength - 1
1027 * @todo Do we want to control max length of header?
1028 * @todo Do we want to control EOL (end-of-line) marker?
1029 * @todo Do we want to translate error message?
1030 */
1031function encodeHeaderBase64($string,$charset) {
1032 /**
1033 * Check mbstring function requirements.
1034 */
1035 if (! function_exists('mb_strlen') ||
1036 ! function_exists('mb_substr')) {
1037 // set E_USER_WARNING
1038 trigger_error('encodeHeaderBase64: Required mbstring functions are missing.',E_USER_WARNING);
1039 // return false
1040 return false;
1041 }
1042
1043 // initial return array
1044 $aRet = array();
1045
1046 /**
1047 * header length = 75 symbols max (same as in encodeHeader)
1048 * remove $charset length
1049 * remove =? ? ?= (5 chars)
1050 * remove 2 more chars (\r\n ?)
1051 */
1052 $iMaxLength = 75 - strlen($charset) - 7;
1053
1054 // set first character position
1055 $iStartCharNum = 0;
1056
1057 // loop through all characters. count characters and not bytes.
1058 for ($iCharNum=1; $iCharNum<=mb_strlen($string,$charset); $iCharNum++) {
1059 // encode string from starting character to current character.
1060 $encoded_string = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum,$charset));
1061
1062 // Check encoded string length
1063 if(strlen($encoded_string)>$iMaxLength) {
1064 // if string exceeds max length, reduce number of encoded characters and add encoded string part to array
1065 $aRet[] = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum-1,$charset));
1066
1067 // set new starting character
1068 $iStartCharNum = $iCharNum-1;
1069
1070 // encode last char (in case it is last character in string)
1071 $encoded_string = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum,$charset));
1072 } // if string is shorter than max length - add next character
1073 }
1074
1075 // add last encoded string to array
1076 $aRet[] = $encoded_string;
1077
1078 // set initial return string
1079 $sRet = '';
1080
1081 // loop through encoded strings
1082 foreach($aRet as $string) {
1083 // TODO: Do we want to control EOL (end-of-line) marker
1084 if ($sRet!='') $sRet.= " ";
1085
1086 // add header tags and encoded string to return string
1087 $sRet.= '=?'.$charset.'?B?'.$string.'?=';
1088 }
1089
1090 return $sRet;
1091}
1092
691a2d25 1093/* This function trys to locate the entity_id of a specific mime element */
3d8371be 1094function find_ent_id($id, $message) {
a171b359 1095 for ($i = 0, $ret = ''; $ret == '' && $i < count($message->entities); $i++) {
1096 if ($message->entities[$i]->header->type0 == 'multipart') {
3d8371be 1097 $ret = find_ent_id($id, $message->entities[$i]);
451f74a2 1098 } else {
3d8371be 1099 if (strcasecmp($message->entities[$i]->header->id, $id) == 0) {
d8cffbab 1100// if (sq_check_save_extension($message->entities[$i])) {
8bd0068d 1101 return $message->entities[$i]->entity_id;
da2415c1 1102// }
c8f5f606 1103 } elseif (!empty($message->entities[$i]->header->parameters['name'])) {
1104 /**
1105 * This is part of a fix for Outlook Express 6.x generating
1106 * cid URLs without creating content-id headers
1107 * @@JA - 20050207
1108 */
1109 if (strcasecmp($message->entities[$i]->header->parameters['name'], $id) == 0) {
1110 return $message->entities[$i]->entity_id;
1111 }
3d8371be 1112 }
a3daaaf3 1113 }
451f74a2 1114 }
3d8371be 1115 return $ret;
451f74a2 1116}
a3daaaf3 1117
e5e9381a 1118function sq_check_save_extension($message) {
1119 $filename = $message->getFilename();
1120 $ext = substr($filename, strrpos($filename,'.')+1);
1121 $save_extensions = array('jpg','jpeg','gif','png','bmp');
3d8371be 1122 return in_array($ext, $save_extensions);
e5e9381a 1123}
1124
1125
691a2d25 1126/**
8bd0068d 1127 ** HTMLFILTER ROUTINES
1128 */
451f74a2 1129
2dd879b8 1130/**
0493ed11 1131 * This function checks attribute values for entity-encoded values
1132 * and returns them translated into 8-bit strings so we can run
1133 * checks on them.
8bd0068d 1134 *
0493ed11 1135 * @param $attvalue A string to run entity check against.
1136 * @return Nothing, modifies a reference value.
8bd0068d 1137 */
0493ed11 1138function sq_defang(&$attvalue){
1139 $me = 'sq_defang';
2dd879b8 1140 /**
0493ed11 1141 * Skip this if there aren't ampersands or backslashes.
8bd0068d 1142 */
0493ed11 1143 if (strpos($attvalue, '&') === false
1144 && strpos($attvalue, '\\') === false){
1145 return;
2dd879b8 1146 }
0493ed11 1147 $m = false;
2b665f28 1148 // before deent, translate the dangerous unicode characters and ... to safe values
1149 // otherwise the regular expressions do not match.
1150
1151
1152
0493ed11 1153 do {
1154 $m = false;
1155 $m = $m || sq_deent($attvalue, '/\&#0*(\d+);*/s');
1156 $m = $m || sq_deent($attvalue, '/\&#x0*((\d|[a-f])+);*/si', true);
1157 $m = $m || sq_deent($attvalue, '/\\\\(\d+)/s', true);
1158 } while ($m == true);
1159 $attvalue = stripslashes($attvalue);
2dd879b8 1160}
1161
1162/**
8bd0068d 1163 * Kill any tabs, newlines, or carriage returns. Our friends the
1164 * makers of the browser with 95% market value decided that it'd
1165 * be funny to make "java[tab]script" be just as good as "javascript".
1166 *
1167 * @param attvalue The attribute value before extraneous spaces removed.
0493ed11 1168 * @return attvalue Nothing, modifies a reference value.
8bd0068d 1169 */
0493ed11 1170function sq_unspace(&$attvalue){
1171 $me = 'sq_unspace';
1172 if (strcspn($attvalue, "\t\r\n\0 ") != strlen($attvalue)){
1173 $attvalue = str_replace(Array("\t", "\r", "\n", "\0", " "),
1174 Array('', '', '', '', ''), $attvalue);
2dd879b8 1175 }
2dd879b8 1176}
1177
2b665f28 1178/**
88de4926 1179 * Translate all dangerous Unicode or Shift_JIS characters which are accepted by
2b665f28 1180 * IE as regular characters.
1181 *
1182 * @param attvalue The attribute value before dangerous characters are translated.
1183 * @return attvalue Nothing, modifies a reference value.
1184 * @author Marc Groot Koerkamp.
1185 */
1186function sq_fixIE_idiocy(&$attvalue) {
1187 // remove NUL
1188 $attvalue = str_replace("\0", "", $attvalue);
1189 // remove comments
1190 $attvalue = preg_replace("/(\/\*.*?\*\/)/","",$attvalue);
1191
88de4926 1192 // IE has the evil habit of accepting every possible value for the attribute expression.
1193 // The table below contains characters which are parsed by IE if they are used in the "expression"
2b665f28 1194 // attribute value.
1195 $aDangerousCharsReplacementTable = array(
1196 array('&#x029F;', '&#0671;' ,/* L UNICODE IPA Extension */
1197 '&#x0280;', '&#0640;' ,/* R UNICODE IPA Extension */
1198 '&#x0274;', '&#0628;' ,/* N UNICODE IPA Extension */
1199 '&#xFF25;', '&#65317' ,/* Unicode FULLWIDTH LATIN CAPITAL LETTER E */
1200 '&#xFF45;', '&#65349' ,/* Unicode FULLWIDTH LATIN SMALL LETTER E */
1201 '&#xFF38;', '&#65336;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER X */
1202 '&#xFF58;', '&#65368;',/* Unicode FULLWIDTH LATIN SMALL LETTER X */
1203 '&#xFF30;', '&#65328;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER P */
1204 '&#xFF50;', '&#65360;',/* Unicode FULLWIDTH LATIN SMALL LETTER P */
1205 '&#xFF32;', '&#65330;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER R */
1206 '&#xFF52;', '&#65362;',/* Unicode FULLWIDTH LATIN SMALL LETTER R */
1207 '&#xFF33;', '&#65331;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER S */
1208 '&#xFF53;', '&#65363;',/* Unicode FULLWIDTH LATIN SMALL LETTER S */
1209 '&#xFF29;', '&#65321;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER I */
1210 '&#xFF49;', '&#65353;',/* Unicode FULLWIDTH LATIN SMALL LETTER I */
1211 '&#xFF2F;', '&#65327;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER O */
1212 '&#xFF4F;', '&#65359;',/* Unicode FULLWIDTH LATIN SMALL LETTER O */
1213 '&#xFF2E;', '&#65326;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER N */
1214 '&#xFF4E;', '&#65358;',/* Unicode FULLWIDTH LATIN SMALL LETTER N */
1215 '&#xFF2C;', '&#65324;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER L */
1216 '&#xFF4C;', '&#65356;',/* Unicode FULLWIDTH LATIN SMALL LETTER L */
1217 '&#xFF35;', '&#65333;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER U */
1218 '&#xFF55;', '&#65365;',/* Unicode FULLWIDTH LATIN SMALL LETTER U */
1219 '&#x207F;', '&#8319;' ,/* Unicode SUPERSCRIPT LATIN SMALL LETTER N */
88de4926 1220 '&#x8264;', /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER E */ // in unicode this is some Chinese char range
2b665f28 1221 '&#x8285;', /* Shift JIS FULLWIDTH LATIN SMALL LETTER E */
1222 '&#x8277;', /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER X */
1223 '&#x8298;', /* Shift JIS FULLWIDTH LATIN SMALL LETTER X */
1224 '&#x826F;', /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER P */
1225 '&#x8290;', /* Shift JIS FULLWIDTH LATIN SMALL LETTER P */
1226 '&#x8271;', /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER R */
1227 '&#x8292;', /* Shift JIS FULLWIDTH LATIN SMALL LETTER R */
1228 '&#x8272;', /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER S */
1229 '&#x8293;', /* Shift JIS FULLWIDTH LATIN SMALL LETTER S */
1230 '&#x8268;', /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER I */
1231 '&#x8289;', /* Shift JIS FULLWIDTH LATIN SMALL LETTER I */
1232 '&#x826E;', /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER O */
1233 '&#x828F;', /* Shift JIS FULLWIDTH LATIN SMALL LETTER O */
1234 '&#x826D;', /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER N */
1235 '&#x828E;'), /* Shift JIS FULLWIDTH LATIN SMALL LETTER N */
1236 array('l', 'l', 'r','r','n','n',
1237 'E','E','e','e','X','X','x','x','P','P','p','p','S','S','s','s','I','I',
1238 'i','i','O','O','o','o','N','N','n','n','L','L','l','l','U','U','u','u','n',
1239 'E','e','X','x','P','p','S','s','I','i','O','o','N','n'));
1240 $attvalue = str_replace($aDangerousCharsReplacementTable[0],$aDangerousCharsReplacementTable[1],$attvalue);
1241
88de4926 1242 // Escapes are useful for special characters like "{}[]()'&. In other cases they are
1243 // used for XSS.
2b665f28 1244 $attvalue = preg_replace("/(\\\\)([a-zA-Z]{1})/",'$2',$attvalue);
1245}
1246
691a2d25 1247/**
8bd0068d 1248 * This function returns the final tag out of the tag name, an array
1249 * of attributes, and the type of the tag. This function is called by
1250 * sq_sanitize internally.
1251 *
1252 * @param $tagname the name of the tag.
1253 * @param $attary the array of attributes and their values
1254 * @param $tagtype The type of the tag (see in comments).
1255 * @return a string with the final tag representation.
1256 */
691a2d25 1257function sq_tagprint($tagname, $attary, $tagtype){
b583c3e8 1258 $me = 'sq_tagprint';
3d8371be 1259
691a2d25 1260 if ($tagtype == 2){
1261 $fulltag = '</' . $tagname . '>';
1262 } else {
1263 $fulltag = '<' . $tagname;
1264 if (is_array($attary) && sizeof($attary)){
1265 $atts = Array();
1266 while (list($attname, $attvalue) = each($attary)){
1267 array_push($atts, "$attname=$attvalue");
1268 }
1269 $fulltag .= ' ' . join(" ", $atts);
1270 }
1271 if ($tagtype == 3){
b583c3e8 1272 $fulltag .= ' /';
691a2d25 1273 }
b583c3e8 1274 $fulltag .= '>';
451f74a2 1275 }
691a2d25 1276 return $fulltag;
451f74a2 1277}
a3daaaf3 1278
691a2d25 1279/**
8bd0068d 1280 * A small helper function to use with array_walk. Modifies a by-ref
1281 * value and makes it lowercase.
1282 *
1283 * @param $val a value passed by-ref.
1284 * @return void since it modifies a by-ref value.
1285 */
691a2d25 1286function sq_casenormalize(&$val){
1287 $val = strtolower($val);
1288}
451f74a2 1289
691a2d25 1290/**
8bd0068d 1291 * This function skips any whitespace from the current position within
1292 * a string and to the next non-whitespace value.
1293 *
1294 * @param $body the string
1295 * @param $offset the offset within the string where we should start
1296 * looking for the next non-whitespace character.
1297 * @return the location within the $body where the next
1298 * non-whitespace char is located.
1299 */
691a2d25 1300function sq_skipspace($body, $offset){
b583c3e8 1301 $me = 'sq_skipspace';
3d8371be 1302 preg_match('/^(\s*)/s', substr($body, $offset), $matches);
691a2d25 1303 if (sizeof($matches{1})){
1304 $count = strlen($matches{1});
1305 $offset += $count;
451f74a2 1306 }
691a2d25 1307 return $offset;
451f74a2 1308}
a3daaaf3 1309
691a2d25 1310/**
8bd0068d 1311 * This function looks for the next character within a string. It's
1312 * really just a glorified "strpos", except it catches if failures
1313 * nicely.
1314 *
1315 * @param $body The string to look for needle in.
1316 * @param $offset Start looking from this position.
1317 * @param $needle The character/string to look for.
1318 * @return location of the next occurance of the needle, or
1319 * strlen($body) if needle wasn't found.
1320 */
691a2d25 1321function sq_findnxstr($body, $offset, $needle){
3d8371be 1322 $me = 'sq_findnxstr';
691a2d25 1323 $pos = strpos($body, $needle, $offset);
1324 if ($pos === FALSE){
1325 $pos = strlen($body);
451f74a2 1326 }
691a2d25 1327 return $pos;
451f74a2 1328}
a3daaaf3 1329
691a2d25 1330/**
8bd0068d 1331 * This function takes a PCRE-style regexp and tries to match it
1332 * within the string.
1333 *
1334 * @param $body The string to look for needle in.
1335 * @param $offset Start looking from here.
1336 * @param $reg A PCRE-style regex to match.
1337 * @return Returns a false if no matches found, or an array
1338 * with the following members:
1339 * - integer with the location of the match within $body
1340 * - string with whatever content between offset and the match
1341 * - string with whatever it is we matched
1342 */
691a2d25 1343function sq_findnxreg($body, $offset, $reg){
b583c3e8 1344 $me = 'sq_findnxreg';
691a2d25 1345 $matches = Array();
1346 $retarr = Array();
7d06541f 1347 preg_match("%^(.*?)($reg)%si", substr($body, $offset), $matches);
1348 if (!isset($matches{0}) || !$matches{0}){
691a2d25 1349 $retarr = false;
1350 } else {
1351 $retarr{0} = $offset + strlen($matches{1});
1352 $retarr{1} = $matches{1};
1353 $retarr{2} = $matches{2};
1354 }
1355 return $retarr;
1356}
a3daaaf3 1357
691a2d25 1358/**
8bd0068d 1359 * This function looks for the next tag.
1360 *
1361 * @param $body String where to look for the next tag.
1362 * @param $offset Start looking from here.
1363 * @return false if no more tags exist in the body, or
1364 * an array with the following members:
1365 * - string with the name of the tag
1366 * - array with attributes and their values
1367 * - integer with tag type (1, 2, or 3)
1368 * - integer where the tag starts (starting "<")
1369 * - integer where the tag ends (ending ">")
1370 * first three members will be false, if the tag is invalid.
1371 */
691a2d25 1372function sq_getnxtag($body, $offset){
b583c3e8 1373 $me = 'sq_getnxtag';
691a2d25 1374 if ($offset > strlen($body)){
1375 return false;
1376 }
1377 $lt = sq_findnxstr($body, $offset, "<");
1378 if ($lt == strlen($body)){
1379 return false;
1380 }
1381 /**
8bd0068d 1382 * We are here:
1383 * blah blah <tag attribute="value">
1384 * \---------^
1385 */
691a2d25 1386 $pos = sq_skipspace($body, $lt+1);
1387 if ($pos >= strlen($body)){
1388 return Array(false, false, false, $lt, strlen($body));
1389 }
1390 /**
8bd0068d 1391 * There are 3 kinds of tags:
1392 * 1. Opening tag, e.g.:
1393 * <a href="blah">
1394 * 2. Closing tag, e.g.:
1395 * </a>
1396 * 3. XHTML-style content-less tag, e.g.:
1397 * <img src="blah" />
1398 */
691a2d25 1399 $tagtype = false;
1400 switch (substr($body, $pos, 1)){
3d8371be 1401 case '/':
1402 $tagtype = 2;
1403 $pos++;
1404 break;
1405 case '!':
1406 /**
8bd0068d 1407 * A comment or an SGML declaration.
1408 */
3d8371be 1409 if (substr($body, $pos+1, 2) == "--"){
1410 $gt = strpos($body, "-->", $pos);
1411 if ($gt === false){
1412 $gt = strlen($body);
1413 } else {
1414 $gt += 2;
1415 }
1416 return Array(false, false, false, $lt, $gt);
bb8d0799 1417 } else {
3d8371be 1418 $gt = sq_findnxstr($body, $pos, ">");
1419 return Array(false, false, false, $lt, $gt);
1420 }
1421 break;
1422 default:
1423 /**
8bd0068d 1424 * Assume tagtype 1 for now. If it's type 3, we'll switch values
1425 * later.
1426 */
3d8371be 1427 $tagtype = 1;
1428 break;
691a2d25 1429 }
a3daaaf3 1430
0493ed11 1431 $tag_start = $pos;
691a2d25 1432 $tagname = '';
1433 /**
8bd0068d 1434 * Look for next [\W-_], which will indicate the end of the tag name.
1435 */
691a2d25 1436 $regary = sq_findnxreg($body, $pos, "[^\w\-_]");
1437 if ($regary == false){
1438 return Array(false, false, false, $lt, strlen($body));
1439 }
1440 list($pos, $tagname, $match) = $regary;
1441 $tagname = strtolower($tagname);
1442
1443 /**
8bd0068d 1444 * $match can be either of these:
1445 * '>' indicating the end of the tag entirely.
1446 * '\s' indicating the end of the tag name.
1447 * '/' indicating that this is type-3 xhtml tag.
1448 *
1449 * Whatever else we find there indicates an invalid tag.
1450 */
691a2d25 1451 switch ($match){
3d8371be 1452 case '/':
691a2d25 1453 /**
8bd0068d 1454 * This is an xhtml-style tag with a closing / at the
1455 * end, like so: <img src="blah" />. Check if it's followed
1456 * by the closing bracket. If not, then this tag is invalid
1457 */
3d8371be 1458 if (substr($body, $pos, 2) == "/>"){
1459 $pos++;
1460 $tagtype = 3;
1461 } else {
1462 $gt = sq_findnxstr($body, $pos, ">");
1463 $retary = Array(false, false, false, $lt, $gt);
1464 return $retary;
1465 }
1466 case '>':
1467 return Array($tagname, false, $tagtype, $lt, $pos);
1468 break;
1469 default:
1470 /**
8bd0068d 1471 * Check if it's whitespace
1472 */
3d8371be 1473 if (!preg_match('/\s/', $match)){
1474 /**
8bd0068d 1475 * This is an invalid tag! Look for the next closing ">".
1476 */
7d06541f 1477 $gt = sq_findnxstr($body, $lt, ">");
3d8371be 1478 return Array(false, false, false, $lt, $gt);
1479 }
1480 break;
691a2d25 1481 }
3d8371be 1482
691a2d25 1483 /**
8bd0068d 1484 * At this point we're here:
1485 * <tagname attribute='blah'>
1486 * \-------^
1487 *
1488 * At this point we loop in order to find all attributes.
1489 */
691a2d25 1490 $attname = '';
0493ed11 1491 $atttype = false;
691a2d25 1492 $attary = Array();
1493
1494 while ($pos <= strlen($body)){
1495 $pos = sq_skipspace($body, $pos);
1496 if ($pos == strlen($body)){
1497 /**
8bd0068d 1498 * Non-closed tag.
1499 */
691a2d25 1500 return Array(false, false, false, $lt, $pos);
1501 }
1502 /**
8bd0068d 1503 * See if we arrived at a ">" or "/>", which means that we reached
1504 * the end of the tag.
1505 */
691a2d25 1506 $matches = Array();
164800ad 1507 if (preg_match("%^(\s*)(>|/>)%s", substr($body, $pos), $matches)) {
c828931c 1508 /**
8bd0068d 1509 * Yep. So we did.
1510 */
c828931c 1511 $pos += strlen($matches{1});
1512 if ($matches{2} == "/>"){
1513 $tagtype = 3;
1514 $pos++;
1515 }
1516 return Array($tagname, $attary, $tagtype, $lt, $pos);
1517 }
a3daaaf3 1518
cca46357 1519 /**
8bd0068d 1520 * There are several types of attributes, with optional
1521 * [:space:] between members.
1522 * Type 1:
1523 * attrname[:space:]=[:space:]'CDATA'
1524 * Type 2:
1525 * attrname[:space:]=[:space:]"CDATA"
1526 * Type 3:
1527 * attr[:space:]=[:space:]CDATA
1528 * Type 4:
1529 * attrname
1530 *
1531 * We leave types 1 and 2 the same, type 3 we check for
1532 * '"' and convert to "&quot" if needed, then wrap in
1533 * double quotes. Type 4 we convert into:
1534 * attrname="yes".
1535 */
3f7c623f 1536 $regary = sq_findnxreg($body, $pos, "[^:\w\-_]");
691a2d25 1537 if ($regary == false){
1538 /**
8bd0068d 1539 * Looks like body ended before the end of tag.
1540 */
691a2d25 1541 return Array(false, false, false, $lt, strlen($body));
cca46357 1542 }
691a2d25 1543 list($pos, $attname, $match) = $regary;
1544 $attname = strtolower($attname);
1545 /**
8bd0068d 1546 * We arrived at the end of attribute name. Several things possible
1547 * here:
1548 * '>' means the end of the tag and this is attribute type 4
1549 * '/' if followed by '>' means the same thing as above
1550 * '\s' means a lot of things -- look what it's followed by.
1551 * anything else means the attribute is invalid.
1552 */
691a2d25 1553 switch($match){
3d8371be 1554 case '/':
691a2d25 1555 /**
8bd0068d 1556 * This is an xhtml-style tag with a closing / at the
1557 * end, like so: <img src="blah" />. Check if it's followed
1558 * by the closing bracket. If not, then this tag is invalid
1559 */
3d8371be 1560 if (substr($body, $pos, 2) == "/>"){
691a2d25 1561 $pos++;
3d8371be 1562 $tagtype = 3;
691a2d25 1563 } else {
3d8371be 1564 $gt = sq_findnxstr($body, $pos, ">");
1565 $retary = Array(false, false, false, $lt, $gt);
1566 return $retary;
1567 }
1568 case '>':
1569 $attary{$attname} = '"yes"';
1570 return Array($tagname, $attary, $tagtype, $lt, $pos);
1571 break;
1572 default:
1573 /**
8bd0068d 1574 * Skip whitespace and see what we arrive at.
1575 */
3d8371be 1576 $pos = sq_skipspace($body, $pos);
1577 $char = substr($body, $pos, 1);
1578 /**
8bd0068d 1579 * Two things are valid here:
1580 * '=' means this is attribute type 1 2 or 3.
1581 * \w means this was attribute type 4.
1582 * anything else we ignore and re-loop. End of tag and
1583 * invalid stuff will be caught by our checks at the beginning
1584 * of the loop.
1585 */
3d8371be 1586 if ($char == "="){
1587 $pos++;
1588 $pos = sq_skipspace($body, $pos);
691a2d25 1589 /**
8bd0068d 1590 * Here are 3 possibilities:
1591 * "'" attribute type 1
1592 * '"' attribute type 2
1593 * everything else is the content of tag type 3
1594 */
3d8371be 1595 $quot = substr($body, $pos, 1);
1596 if ($quot == "'"){
1597 $regary = sq_findnxreg($body, $pos+1, "\'");
1598 if ($regary == false){
1599 return Array(false, false, false, $lt, strlen($body));
1600 }
1601 list($pos, $attval, $match) = $regary;
1602 $pos++;
1603 $attary{$attname} = "'" . $attval . "'";
1604 } else if ($quot == '"'){
1605 $regary = sq_findnxreg($body, $pos+1, '\"');
1606 if ($regary == false){
1607 return Array(false, false, false, $lt, strlen($body));
1608 }
1609 list($pos, $attval, $match) = $regary;
1610 $pos++;
1611 $attary{$attname} = '"' . $attval . '"';
1612 } else {
1613 /**
8bd0068d 1614 * These are hateful. Look for \s, or >.
1615 */
3d8371be 1616 $regary = sq_findnxreg($body, $pos, "[\s>]");
1617 if ($regary == false){
1618 return Array(false, false, false, $lt, strlen($body));
1619 }
1620 list($pos, $attval, $match) = $regary;
1621 /**
8bd0068d 1622 * If it's ">" it will be caught at the top.
1623 */
3d8371be 1624 $attval = preg_replace("/\"/s", "&quot;", $attval);
1625 $attary{$attname} = '"' . $attval . '"';
7e235a1a 1626 }
3d8371be 1627 } else if (preg_match("|[\w/>]|", $char)) {
691a2d25 1628 /**
8bd0068d 1629 * That was attribute type 4.
1630 */
3d8371be 1631 $attary{$attname} = '"yes"';
1632 } else {
1633 /**
8bd0068d 1634 * An illegal character. Find next '>' and return.
1635 */
3d8371be 1636 $gt = sq_findnxstr($body, $pos, ">");
1637 return Array(false, false, false, $lt, $gt);
451f74a2 1638 }
3d8371be 1639 break;
691a2d25 1640 }
1641 }
1642 /**
8bd0068d 1643 * The fact that we got here indicates that the tag end was never
1644 * found. Return invalid tag indication so it gets stripped.
1645 */
691a2d25 1646 return Array(false, false, false, $lt, strlen($body));
1647}
1648
1649/**
0493ed11 1650 * Translates entities into literal values so they can be checked.
8bd0068d 1651 *
0493ed11 1652 * @param $attvalue the by-ref value to check.
1653 * @param $regex the regular expression to check against.
1654 * @param $hex whether the entites are hexadecimal.
1655 * @return True or False depending on whether there were matches.
8bd0068d 1656 */
0493ed11 1657function sq_deent(&$attvalue, $regex, $hex=false){
b583c3e8 1658 $me = 'sq_deent';
0493ed11 1659 $ret_match = false;
2b665f28 1660 // remove comments
1661 //$attvalue = preg_replace("/(\/\*.*\*\/)/","",$attvalue);
0493ed11 1662 preg_match_all($regex, $attvalue, $matches);
1663 if (is_array($matches) && sizeof($matches[0]) > 0){
1664 $repl = Array();
1665 for ($i = 0; $i < sizeof($matches[0]); $i++){
1666 $numval = $matches[1][$i];
1667 if ($hex){
1668 $numval = hexdec($numval);
a3daaaf3 1669 }
0493ed11 1670 $repl{$matches[0][$i]} = chr($numval);
691a2d25 1671 }
0493ed11 1672 $attvalue = strtr($attvalue, $repl);
1673 return true;
1674 } else {
1675 return false;
691a2d25 1676 }
691a2d25 1677}
1678
1679/**
8bd0068d 1680 * This function runs various checks against the attributes.
1681 *
1682 * @param $tagname String with the name of the tag.
1683 * @param $attary Array with all tag attributes.
1684 * @param $rm_attnames See description for sq_sanitize
1685 * @param $bad_attvals See description for sq_sanitize
1686 * @param $add_attr_to_tag See description for sq_sanitize
1687 * @param $message message object
1688 * @param $id message id
1689 * @return Array with modified attributes.
1690 */
da2415c1 1691function sq_fixatts($tagname,
1692 $attary,
691a2d25 1693 $rm_attnames,
1694 $bad_attvals,
1695 $add_attr_to_tag,
1696 $message,
b3af12ef 1697 $id,
3d8371be 1698 $mailbox
691a2d25 1699 ){
b583c3e8 1700 $me = 'sq_fixatts';
691a2d25 1701 while (list($attname, $attvalue) = each($attary)){
1702 /**
8bd0068d 1703 * See if this attribute should be removed.
1704 */
691a2d25 1705 foreach ($rm_attnames as $matchtag=>$matchattrs){
1706 if (preg_match($matchtag, $tagname)){
1707 foreach ($matchattrs as $matchattr){
1708 if (preg_match($matchattr, $attname)){
1709 unset($attary{$attname});
1710 continue;
1711 }
451f74a2 1712 }
451f74a2 1713 }
691a2d25 1714 }
2b665f28 1715 /**
1716 * Workaround for IE quirks
1717 */
1718 sq_fixIE_idiocy($attvalue);
1719
691a2d25 1720 /**
8bd0068d 1721 * Remove any backslashes, entities, and extraneous whitespace.
1722 */
2b665f28 1723
1724 $oldattvalue = $attvalue;
0493ed11 1725 sq_defang($attvalue);
2b665f28 1726 if ($attname == 'style' && $attvalue !== $oldattvalue) {
1727 // entities are used in the attribute value. In 99% of the cases it's there as XSS
1728 // i.e.<div style="{ left:exp&#x0280;essio&#x0274;( alert('XSS') ) }">
1729 $attvalue = "idiocy";
1730 $attary{$attname} = $attvalue;
1731 }
0493ed11 1732 sq_unspace($attvalue);
af861a34 1733
691a2d25 1734 /**
8bd0068d 1735 * Now let's run checks on the attvalues.
1736 * I don't expect anyone to comprehend this. If you do,
1737 * get in touch with me so I can drive to where you live and
1738 * shake your hand personally. :)
1739 */
691a2d25 1740 foreach ($bad_attvals as $matchtag=>$matchattrs){
1741 if (preg_match($matchtag, $tagname)){
1742 foreach ($matchattrs as $matchattr=>$valary){
1743 if (preg_match($matchattr, $attname)){
1744 /**
8bd0068d 1745 * There are two arrays in valary.
1746 * First is matches.
1747 * Second one is replacements
1748 */
691a2d25 1749 list($valmatch, $valrepl) = $valary;
da2415c1 1750 $newvalue =
691a2d25 1751 preg_replace($valmatch, $valrepl, $attvalue);
1752 if ($newvalue != $attvalue){
1753 $attary{$attname} = $newvalue;
1754 }
1755 }
1756 }
451f74a2 1757 }
a3daaaf3 1758 }
834a1027 1759
834a1027 1760 /**
1761 * Replace empty src tags with the blank image. src is only used
1762 * for frames, images, and image inputs. Doing a replace should
1763 * not affect them working as should be, however it will stop
1764 * IE from being kicked off when src for img tags are not set
1765 */
5a6fde9e 1766 if (($attname == 'src') && ($attvalue == '""')) {
834a1027 1767 $attary{$attname} = '"' . SM_PATH . 'images/blank.png"';
1768 }
1769
691a2d25 1770 /**
8bd0068d 1771 * Turn cid: urls into http-friendly ones.
1772 */
691a2d25 1773 if (preg_match("/^[\'\"]\s*cid:/si", $attvalue)){
b3af12ef 1774 $attary{$attname} = sq_cid2http($message, $id, $attvalue, $mailbox);
691a2d25 1775 }
ff940ebc 1776
1777 /**
1778 * "Hack" fix for Outlook using propriatary outbind:// protocol in img tags.
1779 * One day MS might actually make it match something useful, for now, falling
1780 * back to using cid2http, so we can grab the blank.png.
1781 */
1782 if (preg_match("/^[\'\"]\s*outbind:\/\//si", $attvalue)) {
1783 $attary{$attname} = sq_cid2http($message, $id, $attvalue, $mailbox);
1784 }
1785
a3daaaf3 1786 }
691a2d25 1787 /**
8bd0068d 1788 * See if we need to append any attributes to this tag.
1789 */
691a2d25 1790 foreach ($add_attr_to_tag as $matchtag=>$addattary){
1791 if (preg_match($matchtag, $tagname)){
1792 $attary = array_merge($attary, $addattary);
1793 }
1794 }
1795 return $attary;
451f74a2 1796}
a3daaaf3 1797
691a2d25 1798/**
8bd0068d 1799 * This function edits the style definition to make them friendly and
1800 * usable in SquirrelMail.
1801 *
1802 * @param $message the message object
1803 * @param $id the message id
1804 * @param $content a string with whatever is between <style> and </style>
1805 * @param $mailbox the message mailbox
1806 * @return a string with edited content.
1807 */
e60a299a 1808function sq_fixstyle($body, $pos, $message, $id, $mailbox){
691a2d25 1809 global $view_unsafe_images;
b583c3e8 1810 $me = 'sq_fixstyle';
7e2ff844 1811 // workaround for </style> in between comments
1812 $iCurrentPos = $pos;
1813 $content = '';
1814 $sToken = '';
1815 $bSucces = false;
1816 $bEndTag = false;
1817 for ($i=$pos,$iCount=strlen($body);$i<$iCount;++$i) {
1818 $char = $body{$i};
1819 switch ($char) {
1820 case '<':
1821 $sToken .= $char;
1822 break;
1823 case '/':
1824 if ($sToken == '<') {
1825 $sToken .= $char;
1826 $bEndTag = true;
1827 } else {
1828 $content .= $char;
1829 }
1830 break;
1831 case '>':
1832 if ($bEndTag) {
1833 $sToken .= $char;
1834 if (preg_match('/\<\/\s*style\s*\>/i',$sToken,$aMatch)) {
1835 $newpos = $i + 1;
1836 $bSucces = true;
1837 break 2;
1838 } else {
1839 $content .= $sToken;
1840 }
1841 $bEndTag = false;
1842 } else {
1843 $content .= $char;
1844 }
1845 break;
1846 case '!':
1847 if ($sToken == '<') {
1848 // possible comment
1849 if (isset($body{$i+2}) && substr($body,$i,3) == '!--') {
1850 $i = strpos($body,'-->',$i+3);
2b665f28 1851 if ($i === false) { // no end comment
1852 $i = strlen($body);
1853 }
7e2ff844 1854 $sToken = '';
1855 }
1856 } else {
1857 $content .= $char;
1858 }
1859 break;
1860 default:
1861 if ($bEndTag) {
1862 $sToken .= $char;
1863 } else {
1864 $content .= $char;
1865 }
1866 break;
1867 }
1868 }
1869 if ($bSucces == FALSE){
7d06541f 1870 return array(FALSE, strlen($body));
1871 }
7e2ff844 1872
2b665f28 1873
1874
691a2d25 1875 /**
0493ed11 1876 * First look for general BODY style declaration, which would be
1877 * like so:
1878 * body {background: blah-blah}
1879 * and change it to .bodyclass so we can just assign it to a <div>
1880 */
691a2d25 1881 $content = preg_replace("|body(\s*\{.*?\})|si", ".bodyclass\\1", $content);
3d8371be 1882 $secremoveimg = '../images/' . _("sec_remove_eng.png");
691a2d25 1883 /**
0493ed11 1884 * Fix url('blah') declarations.
1885 */
1886 // $content = preg_replace("|url\s*\(\s*([\'\"])\s*\S+script\s*:.*?([\'\"])\s*\)|si",
1887 // "url(\\1$secremoveimg\\2)", $content);
2b665f28 1888
1889 // IE Sucks hard. We have a special function for it.
1890 sq_fixIE_idiocy($content);
1891
1892 // remove @import line
1893 $content = preg_replace("/^\s*(@import.*)$/mi","\n<!-- @import rules forbidden -->\n",$content);
1894
5b4884be 1895 // translate ur\l and variations (IE parses that)
2b665f28 1896 // TODO check if the sq_fixIE_idiocy function already handles this.
5b4884be 1897 $content = preg_replace("/(\\\\)?u(\\\\)?r(\\\\)?l(\\\\)?/i", 'url', $content);
0493ed11 1898 // NB I insert NUL characters to keep to avoid an infinite loop. They are removed after the loop.
1899 while (preg_match("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si", $content, $matches)) {
1900 $sProto = strtolower($matches[1]);
1901 switch ($sProto) {
0493ed11 1902 /**
758a7889 1903 * Fix url('https*://.*) declarations but only if $view_unsafe_images
1904 * is false.
0493ed11 1905 */
758a7889 1906 case 'https':
1907 case 'http':
1908 if (!$view_unsafe_images){
1909
1910 $sExpr = "/url\s*\(\s*[\'\"]?\s*$sProto*:.*[\'\"]?\s*\)/si";
1911 $content = preg_replace($sExpr, "u\0r\0l(\\1$secremoveimg\\2)", $content);
1912
1913 } else {
1914 $content = preg_replace('/url/i',"u\0r\0l",$content);
1915 }
1916 break;
1917 /**
1918 * Fix urls that refer to cid:
1919 */
1920 case 'cid':
1921 $cidurl = 'cid:'. $matches[2];
1922 $httpurl = sq_cid2http($message, $id, $cidurl, $mailbox);
1923 // escape parentheses that can modify the regular expression
1924 $cidurl = str_replace(array('(',')'),array('\\(','\\)'),$cidurl);
1925 $content = preg_replace("|url\s*\(\s*$cidurl\s*\)|si",
1926 "u\0r\0l($httpurl)", $content);
1927 break;
1928 default:
1929 /**
1930 * replace url with protocol other then the white list
1931 * http,https and cid by an empty string.
1932 */
1933 $content = preg_replace("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si",
1934 "", $content);
1935 break;
0493ed11 1936 }
691a2d25 1937 }
0493ed11 1938 // remove NUL
1939 $content = str_replace("\0", "", $content);
0493ed11 1940 /**
1941 * Remove any backslashes, entities, and extraneous whitespace.
1942 */
1943 $contentTemp = $content;
1944 sq_defang($contentTemp);
1945 sq_unspace($contentTemp);
a3daaaf3 1946
691a2d25 1947 /**
8bd0068d 1948 * Fix stupid css declarations which lead to vulnerabilities
1949 * in IE.
1950 */
5db90261 1951 $match = Array('/\/\*.*\*\//',
1952 '/expression/i',
0493ed11 1953 '/behaviou*r/i',
1954 '/binding/i',
2b665f28 1955 '/include-source/i',
1956 '/javascript/i',
1957 '/script/i');
1958 $replace = Array('','idiocy', 'idiocy', 'idiocy', 'idiocy', 'idiocy', 'idiocy');
0493ed11 1959 $contentNew = preg_replace($match, $replace, $contentTemp);
1960 if ($contentNew !== $contentTemp) {
1961 // insecure css declarations are used. From now on we don't care
1962 // anymore if the css is destroyed by sq_deent, sq_unspace or sq_unbackslash
1963 $content = $contentNew;
1964 }
7d06541f 1965 return array($content, $newpos);
691a2d25 1966}
a3daaaf3 1967
0493ed11 1968
691a2d25 1969/**
8bd0068d 1970 * This function converts cid: url's into the ones that can be viewed in
1971 * the browser.
1972 *
1973 * @param $message the message object
1974 * @param $id the message id
1975 * @param $cidurl the cid: url.
1976 * @param $mailbox the message mailbox
1977 * @return a string with a http-friendly url
1978 */
b3af12ef 1979function sq_cid2http($message, $id, $cidurl, $mailbox){
691a2d25 1980 /**
8bd0068d 1981 * Get rid of quotes.
1982 */
691a2d25 1983 $quotchar = substr($cidurl, 0, 1);
2dd879b8 1984 if ($quotchar == '"' || $quotchar == "'"){
1985 $cidurl = str_replace($quotchar, "", $cidurl);
1986 } else {
1987 $quotchar = '';
1988 }
691a2d25 1989 $cidurl = substr(trim($cidurl), 4);
0493ed11 1990
1991 $match_str = '/\{.*?\}\//';
1992 $str_rep = '';
1993 $cidurl = preg_replace($match_str, $str_rep, $cidurl);
1994
e5e9381a 1995 $linkurl = find_ent_id($cidurl, $message);
1996 /* in case of non-save cid links $httpurl should be replaced by a sort of
8bd0068d 1997 unsave link image */
e5e9381a 1998 $httpurl = '';
c8f5f606 1999
8bd0068d 2000 /**
2001 * This is part of a fix for Outlook Express 6.x generating
2002 * cid URLs without creating content-id headers. These images are
2003 * not part of the multipart/related html mail. The html contains
2004 * <img src="cid:{some_id}/image_filename.ext"> references to
2005 * attached images with as goal to render them inline although
2006 * the attachment disposition property is not inline.
2007 */
c8f5f606 2008
2009 if (empty($linkurl)) {
2010 if (preg_match('/{.*}\//', $cidurl)) {
2011 $cidurl = preg_replace('/{.*}\//','', $cidurl);
2012 if (!empty($cidurl)) {
2013 $linkurl = find_ent_id($cidurl, $message);
2014 }
2015 }
2016 }
f8a1ed5a 2017
c8f5f606 2018 if (!empty($linkurl)) {
6b04287c 2019 $httpurl = $quotchar . SM_PATH . 'src/download.php?absolute_dl=true&amp;' .
8bd0068d 2020 "passed_id=$id&amp;mailbox=" . urlencode($mailbox) .
2021 '&amp;ent_id=' . $linkurl . $quotchar;
c8f5f606 2022 } else {
2023 /**
2024 * If we couldn't generate a proper img url, drop in a blank image
2025 * instead of sending back empty, otherwise it causes unusual behaviour
2026 */
bc017c1d 2027 $httpurl = $quotchar . SM_PATH . 'images/blank.png' . $quotchar;
e5e9381a 2028 }
f8a1ed5a 2029
691a2d25 2030 return $httpurl;
2031}
2032
2033/**
8bd0068d 2034 * This function changes the <body> tag into a <div> tag since we
2035 * can't really have a body-within-body.
2036 *
2037 * @param $attary an array of attributes and values of <body>
2038 * @param $mailbox mailbox we're currently reading (for cid2http)
2039 * @param $message current message (for cid2http)
2040 * @param $id current message id (for cid2http)
2041 * @return a modified array of attributes to be set for <div>
2042 */
2dd879b8 2043function sq_body2div($attary, $mailbox, $message, $id){
b583c3e8 2044 $me = 'sq_body2div';
3d8371be 2045 $divattary = Array('class' => "'bodyclass'");
b583c3e8 2046 $text = '#000000';
c189a963 2047 $has_bgc_stl = $has_txt_stl = false;
b583c3e8 2048 $styledef = '';
691a2d25 2049 if (is_array($attary) && sizeof($attary) > 0){
2050 foreach ($attary as $attname=>$attvalue){
2051 $quotchar = substr($attvalue, 0, 1);
2052 $attvalue = str_replace($quotchar, "", $attvalue);
2053 switch ($attname){
3d8371be 2054 case 'background':
8bd0068d 2055 $attvalue = sq_cid2http($message, $id, $attvalue, $mailbox);
3d8371be 2056 $styledef .= "background-image: url('$attvalue'); ";
2057 break;
2058 case 'bgcolor':
c189a963 2059 $has_bgc_stl = true;
3d8371be 2060 $styledef .= "background-color: $attvalue; ";
2061 break;
2062 case 'text':
c189a963 2063 $has_txt_stl = true;
3d8371be 2064 $styledef .= "color: $attvalue; ";
2065 break;
691a2d25 2066 }
a3daaaf3 2067 }
c189a963 2068 // Outlook defines a white bgcolor and no text color. This can lead to
2069 // white text on a white bg with certain themes.
2070 if ($has_bgc_stl && !$has_txt_stl) {
2071 $styledef .= "color: $text; ";
2072 }
691a2d25 2073 if (strlen($styledef) > 0){
2074 $divattary{"style"} = "\"$styledef\"";
2075 }
2076 }
2077 return $divattary;
2078}
a3daaaf3 2079
691a2d25 2080/**
8bd0068d 2081 * This is the main function and the one you should actually be calling.
2082 * There are several variables you should be aware of an which need
2083 * special description.
2084 *
2085 * Since the description is quite lengthy, see it here:
2086 * http://linux.duke.edu/projects/mini/htmlfilter/
2087 *
2088 * @param $body the string with HTML you wish to filter
2089 * @param $tag_list see description above
2090 * @param $rm_tags_with_content see description above
2091 * @param $self_closing_tags see description above
2092 * @param $force_tag_closing see description above
2093 * @param $rm_attnames see description above
2094 * @param $bad_attvals see description above
2095 * @param $add_attr_to_tag see description above
2096 * @param $message message object
2097 * @param $id message id
2098 * @return sanitized html safe to show on your pages.
2099 */
da2415c1 2100function sq_sanitize($body,
8bd0068d 2101 $tag_list,
2102 $rm_tags_with_content,
2103 $self_closing_tags,
2104 $force_tag_closing,
2105 $rm_attnames,
2106 $bad_attvals,
2107 $add_attr_to_tag,
2108 $message,
2109 $id,
2110 $mailbox
2111 ){
b583c3e8 2112 $me = 'sq_sanitize';
7d06541f 2113 $rm_tags = array_shift($tag_list);
691a2d25 2114 /**
8bd0068d 2115 * Normalize rm_tags and rm_tags_with_content.
2116 */
7d06541f 2117 @array_walk($tag_list, 'sq_casenormalize');
691a2d25 2118 @array_walk($rm_tags_with_content, 'sq_casenormalize');
2119 @array_walk($self_closing_tags, 'sq_casenormalize');
2120 /**
8bd0068d 2121 * See if tag_list is of tags to remove or tags to allow.
2122 * false means remove these tags
2123 * true means allow these tags
2124 */
691a2d25 2125 $curpos = 0;
2126 $open_tags = Array();
2dd879b8 2127 $trusted = "\n<!-- begin sanitized html -->\n";
691a2d25 2128 $skip_content = false;
bb8d0799 2129 /**
8bd0068d 2130 * Take care of netscape's stupid javascript entities like
2131 * &{alert('boo')};
2132 */
bb8d0799 2133 $body = preg_replace("/&(\{.*?\};)/si", "&amp;\\1", $body);
691a2d25 2134
7d06541f 2135 while (($curtag = sq_getnxtag($body, $curpos)) != FALSE){
691a2d25 2136 list($tagname, $attary, $tagtype, $lt, $gt) = $curtag;
2137 $free_content = substr($body, $curpos, $lt-$curpos);
2138 /**
8bd0068d 2139 * Take care of <style>
2140 */
7d06541f 2141 if ($tagname == "style" && $tagtype == 1){
da2415c1 2142 list($free_content, $curpos) =
e60a299a 2143 sq_fixstyle($body, $gt+1, $message, $id, $mailbox);
7d06541f 2144 if ($free_content != FALSE){
2145 $trusted .= sq_tagprint($tagname, $attary, $tagtype);
2146 $trusted .= $free_content;
2147 $trusted .= sq_tagprint($tagname, false, 2);
2148 }
2149 continue;
691a2d25 2150 }
2151 if ($skip_content == false){
2152 $trusted .= $free_content;
691a2d25 2153 }
2154 if ($tagname != FALSE){
2155 if ($tagtype == 2){
2156 if ($skip_content == $tagname){
2157 /**
8bd0068d 2158 * Got to the end of tag we needed to remove.
2159 */
691a2d25 2160 $tagname = false;
2161 $skip_content = false;
2162 } else {
2163 if ($skip_content == false){
c828931c 2164 if ($tagname == "body"){
2165 $tagname = "div";
2dd879b8 2166 }
da2415c1 2167 if (isset($open_tags{$tagname}) &&
8bd0068d 2168 $open_tags{$tagname} > 0){
2dd879b8 2169 $open_tags{$tagname}--;
691a2d25 2170 } else {
2dd879b8 2171 $tagname = false;
691a2d25 2172 }
691a2d25 2173 }
2174 }
2175 } else {
2176 /**
8bd0068d 2177 * $rm_tags_with_content
2178 */
691a2d25 2179 if ($skip_content == false){
2180 /**
8bd0068d 2181 * See if this is a self-closing type and change
2182 * tagtype appropriately.
2183 */
691a2d25 2184 if ($tagtype == 1
8bd0068d 2185 && in_array($tagname, $self_closing_tags)){
2dd879b8 2186 $tagtype = 3;
691a2d25 2187 }
2188 /**
8bd0068d 2189 * See if we should skip this tag and any content
2190 * inside it.
2191 */
691a2d25 2192 if ($tagtype == 1 &&
8bd0068d 2193 in_array($tagname, $rm_tags_with_content)){
691a2d25 2194 $skip_content = $tagname;
2195 } else {
da2415c1 2196 if (($rm_tags == false
8bd0068d 2197 && in_array($tagname, $tag_list)) ||
2198 ($rm_tags == true &&
2199 !in_array($tagname, $tag_list))){
691a2d25 2200 $tagname = false;
2201 } else {
2dd879b8 2202 /**
8bd0068d 2203 * Convert body into div.
2204 */
2dd879b8 2205 if ($tagname == "body"){
2206 $tagname = "div";
da2415c1 2207 $attary = sq_body2div($attary, $mailbox,
8bd0068d 2208 $message, $id);
2dd879b8 2209 }
691a2d25 2210 if ($tagtype == 1){
2211 if (isset($open_tags{$tagname})){
2212 $open_tags{$tagname}++;
2213 } else {
2214 $open_tags{$tagname}=1;
2215 }
2216 }
2217 /**
8bd0068d 2218 * This is where we run other checks.
2219 */
691a2d25 2220 if (is_array($attary) && sizeof($attary) > 0){
2221 $attary = sq_fixatts($tagname,
8bd0068d 2222 $attary,
2223 $rm_attnames,
2224 $bad_attvals,
2225 $add_attr_to_tag,
2226 $message,
2227 $id,
2228 $mailbox
2229 );
691a2d25 2230 }
2231 }
2232 }
691a2d25 2233 }
2234 }
2235 if ($tagname != false && $skip_content == false){
2236 $trusted .= sq_tagprint($tagname, $attary, $tagtype);
2237 }
691a2d25 2238 }
2239 $curpos = $gt+1;
a3daaaf3 2240 }
691a2d25 2241 $trusted .= substr($body, $curpos, strlen($body)-$curpos);
2242 if ($force_tag_closing == true){
2243 foreach ($open_tags as $tagname=>$opentimes){
2244 while ($opentimes > 0){
2245 $trusted .= '</' . $tagname . '>';
2246 $opentimes--;
2247 }
2248 }
2249 $trusted .= "\n";
2250 }
2251 $trusted .= "<!-- end sanitized html -->\n";
2252 return $trusted;
2253}
451f74a2 2254
691a2d25 2255/**
8bd0068d 2256 * This is a wrapper function to call html sanitizing routines.
2257 *
2258 * @param $body the body of the message
2259 * @param $id the id of the message
c189a963 2260
2261 * @param $message
2262 * @param $mailbox
2263 * @param boolean $take_mailto_links When TRUE, converts mailto: links
2264 * into internal SM compose links
2265 * (optional; default = TRUE)
8bd0068d 2266 * @return a string with html safe to display in the browser.
2267 */
c189a963 2268function magicHTML($body, $id, $message, $mailbox = 'INBOX', $take_mailto_links =true) {
2269
202bcbcc 2270 // require_once(SM_PATH . 'functions/url_parser.php'); // for $MailTo_PReg_Match
c189a963 2271
691a2d25 2272 global $attachment_common_show_images, $view_unsafe_images,
8bd0068d 2273 $has_unsafe_images;
691a2d25 2274 /**
8bd0068d 2275 * Don't display attached images in HTML mode.
2b665f28 2276 *
d0187bd6 2277 * SB: why?
8bd0068d 2278 */
691a2d25 2279 $attachment_common_show_images = false;
2280 $tag_list = Array(
8bd0068d 2281 false,
2282 "object",
2283 "meta",
2284 "html",
2285 "head",
2286 "base",
2287 "link",
2288 "frame",
2289 "iframe",
2290 "plaintext",
2291 "marquee"
2292 );
691a2d25 2293
2294 $rm_tags_with_content = Array(
8bd0068d 2295 "script",
2296 "applet",
2297 "embed",
2298 "title",
2299 "frameset",
0493ed11 2300 "xmp",
8bd0068d 2301 "xml"
2302 );
691a2d25 2303
2304 $self_closing_tags = Array(
8bd0068d 2305 "img",
2306 "br",
2307 "hr",
2308 "input",
2309 "outbind"
2310 );
691a2d25 2311
2dd879b8 2312 $force_tag_closing = true;
691a2d25 2313
2314 $rm_attnames = Array(
8bd0068d 2315 "/.*/" =>
2316 Array(
2317 "/target/i",
2318 "/^on.*/i",
2319 "/^dynsrc/i",
2320 "/^data.*/i",
2321 "/^lowsrc.*/i"
2322 )
2323 );
691a2d25 2324
2325 $secremoveimg = "../images/" . _("sec_remove_eng.png");
2326 $bad_attvals = Array(
8bd0068d 2327 "/.*/" =>
691a2d25 2328 Array(
0a6ec9b5 2329 "/^src|background/i" =>
8bd0068d 2330 Array(
691a2d25 2331 Array(
8bd0068d 2332 "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
2333 "/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
2334 "/^([\'\"])\s*about\s*:.*([\'\"])/si"
691a2d25 2335 ),
8bd0068d 2336 Array(
2337 "\\1$secremoveimg\\2",
2338 "\\1$secremoveimg\\2",
2339 "\\1$secremoveimg\\2",
8bd0068d 2340 )
2341 ),
0a6ec9b5 2342 "/^href|action/i" =>
8bd0068d 2343 Array(
0a6ec9b5 2344 Array(
8bd0068d 2345 "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
2346 "/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
2347 "/^([\'\"])\s*about\s*:.*([\'\"])/si"
0a6ec9b5 2348 ),
691a2d25 2349 Array(
8bd0068d 2350 "\\1#\\1",
2351 "\\1#\\1",
2352 "\\1#\\1"
02474e43 2353 )
8bd0068d 2354 ),
2355 "/^style/i" =>
2356 Array(
2357 Array(
5db90261 2358 "/\/\*.*\*\//",
8bd0068d 2359 "/expression/i",
2360 "/binding/i",
2361 "/behaviou*r/i",
2362 "/include-source/i",
2363 "/position\s*:\s*absolute/i",
1d935bc2 2364 "/(\\\\)?u(\\\\)?r(\\\\)?l(\\\\)?/i",
8bd0068d 2365 "/url\s*\(\s*([\'\"])\s*\S+script\s*:.*([\'\"])\s*\)/si",
2366 "/url\s*\(\s*([\'\"])\s*mocha\s*:.*([\'\"])\s*\)/si",
2367 "/url\s*\(\s*([\'\"])\s*about\s*:.*([\'\"])\s*\)/si",
2368 "/(.*)\s*:\s*url\s*\(\s*([\'\"]*)\s*\S+script\s*:.*([\'\"]*)\s*\)/si"
2369 ),
2370 Array(
5db90261 2371 "",
8bd0068d 2372 "idiocy",
2373 "idiocy",
2374 "idiocy",
2375 "idiocy",
2376 "",
5b4884be 2377 "url",
8bd0068d 2378 "url(\\1#\\1)",
2379 "url(\\1#\\1)",
2380 "url(\\1#\\1)",
8bd0068d 2381 "\\1:url(\\2#\\3)"
2382 )
691a2d25 2383 )
8bd0068d 2384 )
691a2d25 2385 );
5262d9a6 2386 if( !sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET) ) {
2dd879b8 2387 $view_unsafe_images = false;
45071bd6 2388 }
691a2d25 2389 if (!$view_unsafe_images){
2390 /**
8bd0068d 2391 * Remove any references to http/https if view_unsafe_images set
2392 * to false.
2393 */
02474e43 2394 array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[0],
8bd0068d 2395 '/^([\'\"])\s*https*:.*([\'\"])/si');
02474e43 2396 array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[1],
8bd0068d 2397 "\\1$secremoveimg\\1");
02474e43 2398 array_push($bad_attvals{'/.*/'}{'/^style/i'}[0],
7ef0b415 2399 '/url\([\'\"]?https?:[^\)]*[\'\"]?\)/si');
02474e43 2400 array_push($bad_attvals{'/.*/'}{'/^style/i'}[1],
8bd0068d 2401 "url(\\1$secremoveimg\\1)");
691a2d25 2402 }
451f74a2 2403
691a2d25 2404 $add_attr_to_tag = Array(
8bd0068d 2405 "/^a$/i" =>
c25f2fbb 2406 Array('target'=>'"_blank"',
02474e43 2407 'title'=>'"'._("This external link will open in a new window").'"'
8bd0068d 2408 )
2409 );
da2415c1 2410 $trusted = sq_sanitize($body,
8bd0068d 2411 $tag_list,
2412 $rm_tags_with_content,
2413 $self_closing_tags,
2414 $force_tag_closing,
2415 $rm_attnames,
2416 $bad_attvals,
2417 $add_attr_to_tag,
2418 $message,
2419 $id,
2420 $mailbox
2421 );
f83c60a2 2422 if (preg_match("|$secremoveimg|i", $trusted)){
691a2d25 2423 $has_unsafe_images = true;
da2415c1 2424 }
c189a963 2425
2426 // we want to parse mailto's in HTML output, change to SM compose links
2427 // this is a modified version of code from url_parser.php... but Marc is
2428 // right: we need a better filtering implementation; adding this randomly
2429 // here is not a great solution
2430 //
2431 if ($take_mailto_links) {
2432 // parseUrl($trusted); // this even parses URLs inside of tags... too aggressive
2433 global $MailTo_PReg_Match;
202bcbcc 2434 $MailTo_PReg_Match = '/mailto:' . substr($MailTo_PReg_Match, 1) ;
c189a963 2435 if ((preg_match_all($MailTo_PReg_Match, $trusted, $regs)) && ($regs[0][0] != '')) {
2436 foreach ($regs[0] as $i => $mailto_before) {
2437 $mailto_params = $regs[10][$i];
2438 // get rid of any tailing quote since we have to add send_to to the end
2439 //
2440 if (substr($mailto_before, strlen($mailto_before) - 1) == '"')
2441 $mailto_before = substr($mailto_before, 0, strlen($mailto_before) - 1);
2442 if (substr($mailto_params, strlen($mailto_params) - 1) == '"')
2443 $mailto_params = substr($mailto_params, 0, strlen($mailto_params) - 1);
2444
2445 if ($regs[1][$i]) { //if there is an email addr before '?', we need to merge it with the params
2446 $to = 'to=' . $regs[1][$i];
2447 if (strpos($mailto_params, 'to=') > -1) //already a 'to='
2448 $mailto_params = str_replace('to=', $to . '%2C%20', $mailto_params);
2449 else {
2450 if ($mailto_params) //already some params, append to them
2451 $mailto_params .= '&amp;' . $to;
2452 else
2453 $mailto_params .= '?' . $to;
2454 }
2455 }
2456
2457 $url_str = preg_replace(array('/to=/i', '/(?<!b)cc=/i', '/bcc=/i'), array('send_to=', 'send_to_cc=', 'send_to_bcc='), $mailto_params);
2458
2459 // we'll already have target=_blank, no need to allow comp_in_new
2460 // here (which would be a lot more work anyway)
2461 //
2462 global $compose_new_win;
2463 $temp_comp_in_new = $compose_new_win;
2464 $compose_new_win = 0;
2465 $comp_uri = makeComposeLink('src/compose.php' . $url_str, $mailto_before);
2466 $compose_new_win = $temp_comp_in_new;
2467
2468 // remove <a href=" and anything after the next quote (we only
2469 // need the uri, not the link HTML) in compose uri
2470 //
2471 $comp_uri = substr($comp_uri, 9);
2472 $comp_uri = substr($comp_uri, 0, strpos($comp_uri, '"', 1));
2473 $trusted = str_replace($mailto_before, $comp_uri, $trusted);
2474 }
2475 }
2476 }
2477
691a2d25 2478 return $trusted;
451f74a2 2479}
a4a70693 2480
da2415c1 2481/**
8bd0068d 2482 * function SendDownloadHeaders - send file to the browser
2483 *
2484 * Original Source: SM core src/download.php
2485 * moved here to make it available to other code, and separate
2486 * front end from back end functionality.
2487 *
2488 * @param string $type0 first half of mime type
2489 * @param string $type1 second half of mime type
2490 * @param string $filename filename to tell the browser for downloaded file
2491 * @param boolean $force whether to force the download dialog to pop
2492 * @param optional integer $filesize send the Content-Header and length to the browser
2493 * @return void
2494 */
02474e43 2495function SendDownloadHeaders($type0, $type1, $filename, $force, $filesize=0) {
2496 global $languages, $squirrelmail_language;
cfffd60b 2497 $isIE = $isIE6plus = false;
02474e43 2498
2499 sqgetGlobalVar('HTTP_USER_AGENT', $HTTP_USER_AGENT, SQ_SERVER);
2500
2501 if (strstr($HTTP_USER_AGENT, 'compatible; MSIE ') !== false &&
8bd0068d 2502 strstr($HTTP_USER_AGENT, 'Opera') === false) {
cfffd60b 2503 $isIE = true;
02474e43 2504 }
2505
cfffd60b 2506 if (preg_match('/compatible; MSIE ([0-9]+)/', $HTTP_USER_AGENT, $match) &&
2507 ((int)$match[1]) >= 6 && strstr($HTTP_USER_AGENT, 'Opera') === false) {
2508 $isIE6plus = true;
02474e43 2509 }
2510
2511 if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
8bd0068d 2512 function_exists($languages[$squirrelmail_language]['XTRA_CODE'] . '_downloadfilename')) {
02474e43 2513 $filename =
8bd0068d 2514 call_user_func($languages[$squirrelmail_language]['XTRA_CODE'] . '_downloadfilename', $filename, $HTTP_USER_AGENT);
02474e43 2515 } else {
2516 $filename = ereg_replace('[\\/:\*\?"<>\|;]', '_', str_replace('&nbsp;', ' ', $filename));
2517 }
2518
2519 // A Pox on Microsoft and it's Internet Explorer!
2520 //
2521 // IE has lots of bugs with file downloads.
2522 // It also has problems with SSL. Both of these cause problems
2523 // for us in this function.
2524 //
2525 // See this article on Cache Control headers and SSL
2526 // http://support.microsoft.com/default.aspx?scid=kb;en-us;323308
2527 //
2528 // The best thing you can do for IE is to upgrade to the latest
2529 // version
2530 //set all the Cache Control Headers for IE
2531 if ($isIE) {
2532 $filename=rawurlencode($filename);
2533 header ("Pragma: public");
8bd0068d 2534 header ("Cache-Control: no-store, max-age=0, no-cache, must-revalidate"); // HTTP/1.1
02474e43 2535 header ("Cache-Control: post-check=0, pre-check=0", false);
8bd0068d 2536 header ("Cache-Control: private");
02474e43 2537
2538 //set the inline header for IE, we'll add the attachment header later if we need it
2539 header ("Content-Disposition: inline; filename=$filename");
2540 }
2541
2542 if (!$force) {
2543 // Try to show in browser window
2544 header ("Content-Disposition: inline; filename=\"$filename\"");
2545 header ("Content-Type: $type0/$type1; name=\"$filename\"");
2546 } else {
2547 // Try to pop up the "save as" box
2548
2549 // IE makes this hard. It pops up 2 save boxes, or none.
2550 // http://support.microsoft.com/support/kb/articles/Q238/5/88.ASP
2551 // http://support.microsoft.com/default.aspx?scid=kb;EN-US;260519
2552 // But, according to Microsoft, it is "RFC compliant but doesn't
2553 // take into account some deviations that allowed within the
2554 // specification." Doesn't that mean RFC non-compliant?
2555 // http://support.microsoft.com/support/kb/articles/Q258/4/52.ASP
2556
2557 // all browsers need the application/octet-stream header for this
2558 header ("Content-Type: application/octet-stream; name=\"$filename\"");
2559
2560 // http://support.microsoft.com/support/kb/articles/Q182/3/15.asp
2561 // Do not have quotes around filename, but that applied to
2562 // "attachment"... does it apply to inline too?
2563 header ("Content-Disposition: attachment; filename=\"$filename\"");
2564
cfffd60b 2565 if ($isIE && !$isIE6plus) {
02474e43 2566 // This combination seems to work mostly. IE 5.5 SP 1 has
2567 // known issues (see the Microsoft Knowledge Base)
2568
2569 // This works for most types, but doesn't work with Word files
2570 header ("Content-Type: application/download; name=\"$filename\"");
7e2ff844 2571 header ("Content-Type: application/force-download; name=\"$filename\"");
02474e43 2572 // These are spares, just in case. :-)
2573 //header("Content-Type: $type0/$type1; name=\"$filename\"");
2574 //header("Content-Type: application/x-msdownload; name=\"$filename\"");
2575 //header("Content-Type: application/octet-stream; name=\"$filename\"");
7e2ff844 2576 } else if ($isIE) {
2577 // This is to prevent IE for MIME sniffing and auto open a file in IE
2578 header ("Content-Type: application/force-download; name=\"$filename\"");
02474e43 2579 } else {
2580 // another application/octet-stream forces download for Netscape
2581 header ("Content-Type: application/octet-stream; name=\"$filename\"");
2582 }
2583 }
2584
2585 //send the content-length header if the calling function provides it
2586 if ($filesize > 0) {
2587 header("Content-Length: $filesize");
2588 }
07c49f57 2589
8d863f64 2590} // end fn SendDownloadHeaders
Unnamed repository; edit this file 'description' to name the repository.