functions/page_header.php

   1 <?php
   2
   3 /**
   4  * page_header.php
   5  *
   6  * Prints the page header (duh)
   7  *
   8  * @copyright 1999-2022 The SquirrelMail Project Team
   9  * @license http://opensource.org/licenses/gpl-license.php GNU Public License
  10  * @version $Id$
  11  * @package squirrelmail
  12  */
  13
  14 /** Include required files from SM */
  15 include_once(SM_PATH . 'functions/imap_mailbox.php');
  16
  17 /**
  18  * Output a SquirrelMail page header, from <!doctype> to </head>
  19  * Always set up the language before calling these functions.
  20  *
  21  * Since 1.5.1 function sends http headers. Function should be called
  22  * before any output is started.
  23  * @param string title the page title, default SquirrelMail.
  24  * @param string xtra extra HTML to insert into the header
  25  * @param bool do_hook whether to execute hooks, default true
  26  * @param bool frames generate html frameset doctype (since 1.5.1)
  27  * @param bool $browser_cache_ok When TRUE, it's OK to leave out the
  28  *                               no-cache browser headers (OPTIONAL;
  29  *                               default = FALSE, send no-cache headers)
  30  * @return void
  31  */
  32 function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE, $frames = FALSE, $browser_cache_ok=FALSE ) {
  33     global $squirrelmail_language, $sTemplateID, $oErrorHandler, $oTemplate;
  34
  35     if ( !sqgetGlobalVar('base_uri', $base_uri, SQ_SESSION) ) {
  36         global $base_uri;
  37     }
  38     global $custom_css, $pageheader_sent, $theme, $theme_default, $text_direction,
  39         $default_fontset, $chosen_fontset, $default_fontsize, $chosen_fontsize,
  40         $chosen_theme, $chosen_theme_path, $user_themes, $user_theme_default,
  41         $head_tag_extra;
  42
  43     // add no cache headers here
  44     //
  45     if (!$browser_cache_ok) {
  46 //FIXME: should change all header() calls in SM core to use $oTemplate->header()!!
  47         $oTemplate->header('Pragma: no-cache'); // http 1.0 (rfc1945)
  48         $oTemplate->header('Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0'); // http 1.1 (rfc2616)
  49         $oTemplate->header('Expires: Sat, 1 Jan 2000 00:00:00 GMT');
  50 //TODO: is this needed? $oTemplate->header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . 'GMT');
  51     }
  52     /* prevent information leakage about read emails by forbidding Firefox
  53      * to do preemptive DNS requests for any links in the message body. */
  54     $oTemplate->header('X-DNS-Prefetch-Control: off');
  55
  56     // don't show version as a security measure
  57     //$oTemplate->header('X-Powered-By: SquirrelMail/' . SM_VERSION, FALSE);
  58     $oTemplate->header('X-Powered-By: SquirrelMail', FALSE);
  59
  60     // prevent clickjack attempts
  61 // FIXME: should we use DENY instead?  We can also make this a configurable value, including giving the admin the option of removing this entirely in case they WANT to be framed by an external domain
  62     $oTemplate->header('X-Frame-Options: SAMEORIGIN');
  63
  64     // prevent clickjack attempts using JavaScript for browsers that
  65     // don't support the X-Frame-Options header...
  66     // we check to see if we are *not* the top page, and if not, check
  67     // whether or not the top page is in the same domain as we are...
  68     // if not, log out immediately -- this is an attempt to do the same
  69     // thing that the X-Frame-Options does using JavaScript (never a good
  70     // idea to rely on JavaScript-based solutions, though)
  71 //FIXME: is it a problem that we still force the clickjack protection code whether or not JavaScript is supported or desired by the user?
  72     $header_tags = '<script type="text/javascript" language="JavaScript">'
  73        . "\n<!--\n"
  74        . 'if (self != top) { try { if (document.domain != top.document.domain) {'
  75        . ' throw "Clickjacking security violation! Please log out immediately!"; /* this code should never execute - exception should already have been thrown since it\'s a security violation in this case to even try to access top.document.domain (but it\'s left here just to be extra safe) */ } } catch (e) { self.location = "'
  76        . sqm_baseuri() . 'src/signout.php"; top.location = "'
  77        . sqm_baseuri() . 'src/signout.php" } }'
  78        . "\n// -->\n</script>\n";
  79
  80     $oTemplate->assign('frames', $frames);
  81     $oTemplate->assign('lang', $squirrelmail_language);
  82
  83     $header_tags .= "<meta name=\"robots\" content=\"noindex,nofollow\" />\n"
  84
  85     // For adding a favicon or anything else that should be inserted in *ALL* <head> for *ALL* documents,
  86     // define $head_tag_extra in config/config_local.php
  87     // The string "###SM BASEURI###" will be replaced with the base URI for this SquirrelMail installation.
  88     // When not defined, a default is provided that displays the default favicon.ico.
  89     // If you override this and still want to use the default favicon.ico, you'll have to include the following
  90     // following in your $head_tag_extra string:
  91     // $head_tag_extra = '<link rel="shortcut icon" href="###SM BASEURI###favicon.ico" />...<YOUR CONTENT HERE>...';
  92     //
  93     . (empty($head_tag_extra) ? '<link rel="shortcut icon" href="' . sqm_baseuri() . 'favicon.ico" />'
  94     : str_replace('###SM BASEURI###', sqm_baseuri(), $head_tag_extra));
  95
  96     $used_fontset = (!empty($chosen_fontset) ? $chosen_fontset : $default_fontset);
  97     $used_fontsize = (!empty($chosen_fontsize) ? $chosen_fontsize : $default_fontsize);
  98     if (!empty($chosen_theme) && is_dir($chosen_theme) && is_readable($chosen_theme))
  99         $used_theme = $chosen_theme_path;
 100     else if ($user_theme_default != 'none')
 101         $used_theme = $user_themes[$user_theme_default]['PATH'];
 102     else
 103         $used_theme = 'none';
 104
 105
 106     /**
 107      * Stylesheets are loaded in the following order:
 108      *    1) All stylesheets provided by the template.  Normally, these are
 109      *       stylsheets in templates/<template>/css/.  This is accomplished by calling
 110      *       $oTemplate->fetch_standard_stylesheet_links().
 111      *    2) An optional user-defined stylesheet.  This is set in the Display
 112      *       Preferences.
 113      *    3) src/style.php which sets some basic font prefs.
 114      *    4) If we are dealing with an RTL language, we load rtl.css from the
 115      *       template set.
 116      */
 117
 118     // 1. Stylesheets from the template.
 119     $header_tags .= $oTemplate->fetch_standard_stylesheet_links();
 120
 121     $aUserStyles = array();
 122
 123     // 2. Option user-defined stylesheet from preferences.
 124     if ($used_theme != 'none') {
 125 //FIXME: rid ourselves of "none" strings!  I didn't do it here because I think the problem is that the theme itself should never be "none" (? well, what else would it be?  if "none" theme is actually OK, then is there a constant to use below instead of a hard-coded string?)
 126         /**
 127          * All styles (except "none" - ugh) just point to a directory,
 128          * so we need to include all .css files in that directory.
 129          */
 130         $styles = list_files($used_theme, '.css');
 131         foreach ($styles as $sheet) {
 132             $aUserStyles[] = $used_theme .'/'.$sheet;
 133         }
 134     }
 135
 136     // 3. src/style.php
 137     $aUserStyles[] = $base_uri .'src/style.php?'
 138                    . (!empty($used_fontset) ? '&amp;fontset='.$used_fontset : '')
 139                    . (!empty($used_fontsize) ? '&amp;fontsize='.$used_fontsize : '');
 140
 141     // 3.1.  Load the stylesheets we have already
 142     $header_tags .= $oTemplate->fetch_external_stylesheet_links($aUserStyles);
 143
 144     // 4. Optional rtl.css stylesheet
 145     if ($text_direction == 'rtl') {
 146         $header_tags .= $oTemplate->fetch_right_to_left_stylesheet_link();
 147     }
 148
 149     // 5. Printer friendly stylesheet
 150     $header_tags .= create_css_link($base_uri . 'css/print.css', 'printerfriendly', false, 'print');
 151
 152     if ($squirrelmail_language == 'ja_JP') {
 153         /*
 154          * force correct detection of charset, when browser does not follow
 155          * http content-type and tries to detect charset from page content.
 156          * Shooting of browser's creator can't be implemented in php.
 157          * We might get rid of it, if we follow http://www.w3.org/TR/japanese-xml/
 158          * recommendations and switch to unicode.
 159          */
 160         $header_tags .= "<!-- \xfd\xfe -->\n";
 161         $header_tags .= '<meta http-equiv="Content-type" content="' . $oTemplate->get_content_type() . '; charset=euc-jp" />' . "\n";
 162     }
 163     if ($do_hook) {
 164         // NOTE! plugins here MUST assign output to template
 165         //       and NOT echo anything directly!!  A common
 166         //       approach is if a plugin decides it needs to
 167         //       put something at page-top after the standard
 168         //       SM page header, to dynamically add itself to
 169         //       the page_header_bottom and/or compose_header_bottom
 170         //       hooks for the current page request.  See
 171         //       the Sent Confirmation v1.7 or Restrict Senders v1.2
 172         //       plugins for examples of this approach.
 173         ob_start();
 174         $temp = array(&$header_tags);
 175         do_hook('generic_header', $temp);
 176         $output = ob_get_contents();
 177         ob_end_clean();
 178         // plugin authors can debug their errors with one of the following:
 179         //sm_print_r($output);
 180         //echo $output;
 181         if (!empty($output)) trigger_error('A plugin on the "generic_header" hook has attempted to output directly to the browser', E_USER_ERROR);
 182     }
 183
 184     // Add message subject to page title (should only have an effect when loaded in its own browser window/tab)
 185     // TODO: For search page, could add " - Search: $what" or something like that
 186     global $message;
 187     if (!empty($message) && !empty($message->rfc822_header) && !empty($message->rfc822_header->subject))
 188         // decodeHeader() should already encode the output, so no sm_encode_html_special_chars()
 189         $title .= ' - ' . decodeHeader($message->rfc822_header->subject);
 190
 191     $header_tags .= $xtra;
 192     $oTemplate->assign('page_title', $title);
 193
 194     /* work around IE6's scrollbar bug */
 195     $header_tags .= <<<EOS
 196 <!--[if IE 6]>
 197 <style type="text/css">
 198 /* avoid stupid IE6 bug with frames and scrollbars */
 199 body {
 200     width: expression(document.documentElement.clientWidth - 30);
 201 }
 202 </style>
 203 <![endif]-->
 204
 205 EOS;
 206
 207     $oTemplate->assign('header_tags', $header_tags);
 208     $oTemplate->display('protocol_header.tpl');
 209
 210     /* this is used to check elsewhere whether we should call this function */
 211     $pageheader_sent = TRUE;
 212     if (isset($oErrorHandler)) {
 213         $oErrorHandler->HeaderSent();
 214     }
 215
 216 }
 217
 218 /**
 219  * Given a path to a SquirrelMail file, return a HTML link to it
 220  *
 221  * @param string $path      The SquirrelMail file to link to
 222  *                          (should start with something like "src/..." or
 223  *                          "functions/..." or "plugins/..." etc.)
 224  * @param string $text      The link text
 225  * @param string $target    The target frame for this link
 226  * @param string $accesskey The access key to be used, if any
 227  */
 228 function makeInternalLink($path, $text, $target='', $accesskey='NONE') {
 229     global $base_uri, $oTemplate;
 230 //    sqgetGlobalVar('base_uri', $base_uri, SQ_SESSION);
 231
 232     // This is an inefficient hook and is only used by
 233     // one plugin that still needs to patch this code,
 234     // plus if we are templat-izing SM, visual hooks
 235     // are not needed.  However, I am leaving the code
 236     // here just in case we find a good (non-visual?)
 237     // use for the internal_link hook.
 238     //
 239     //do_hook('internal_link', $text);
 240
 241     return create_hyperlink($base_uri . $path, $text, $target,
 242                             '', '', '', '',
 243                             ($accesskey == 'NONE'
 244                             ? array()
 245                             : array('accesskey' => $accesskey)));
 246 }
 247
 248 /**
 249  * Outputs a complete SquirrelMail page header, starting with <!doctype> and
 250  * including the default menu bar. Uses displayHtmlHeader and takes
 251  * JavaScript and locale settings into account.
 252  *
 253  * @param array color the array of theme colors
 254  * @param string mailbox the current mailbox name to display
 255  * @param string sHeaderJs javascipt code to be inserted in a script block in the header
 256  * @param string sOnload JavaScript code to be added inside the body's onload handler
 257  *                       as of 1.5.2, this replaces $sBodyTagJs argument
 258  * @return void
 259  */
 260 function displayPageHeader($color, $mailbox='', $sHeaderJs='', $sOnload = '') {
 261
 262     global $reply_focus, $hide_sm_attributions, $frame_top,
 263         $provider_name, $provider_uri, $startMessage,
 264         $action, $oTemplate, $org_title, $base_uri,
 265         $data_dir, $username;
 266
 267     if (empty($sOnload)) {
 268         if (strpos($action, 'reply') !== FALSE && $reply_focus) {
 269             if ($reply_focus == 'select')
 270                 $sOnload = 'checkForm(\'select\');';
 271             else if ($reply_focus == 'focus')
 272                 $sOnload = 'checkForm(\'focus\');';
 273             else if ($reply_focus != 'none')
 274                 $sOnload = 'checkForm();';
 275         }
 276         else
 277             $sOnload = 'checkForm();';
 278     }
 279
 280     $startMessage = (int)$startMessage;
 281
 282     sqgetGlobalVar('delimiter', $delimiter, SQ_SESSION );
 283
 284     if (!isset($frame_top)) {
 285         $frame_top = '_top';
 286     }
 287
 288 //FIXME: does checkForJavascript() make the 2nd part of the if() below unneccessary?? (that is, I think checkForJavascript() might already look for new_js_autodetect_results...(?))
 289     if( checkForJavascript() || strpos($sHeaderJs, 'new_js_autodetect_results.value') ) {
 290         $js_includes = $oTemplate->get_javascript_includes(TRUE);
 291         $sJsBlock = '';
 292         foreach ($js_includes as $js_file) {
 293             $sJsBlock .= '<script src="'.$js_file.'" type="text/javascript"></script>' ."\n";
 294         }
 295         if ($sHeaderJs) {
 296             $sJsBlock .= "\n<script type=\"text/javascript\">" .
 297                         "\n<!--\n" .
 298                         $sHeaderJs . "\n\n// -->\n</script>\n";
 299         }
 300         displayHtmlHeader ($org_title, $sJsBlock);
 301     } else {
 302         /* do not use JavaScript */
 303         displayHtmlHeader ($org_title);
 304         $sOnload = '';
 305     }
 306     if ($mailbox) {
 307         /*
 308         * this explains the imap_mailbox.php dependency. We should instead store
 309         * the selected mailbox in the session and fallback to the session var.
 310         */
 311         $shortBoxName = sm_encode_html_special_chars(imap_utf7_decode_local(
 312                     readShortMailboxName($mailbox, $delimiter)));
 313         if (getPref($data_dir, $username, 'translate_special_folders')) {
 314             global $sent_folder, $trash_folder, $draft_folder;
 315             if ($mailbox == $sent_folder)
 316                 $shortBoxName = _("Sent");
 317             else if ($mailbox == $trash_folder)
 318                 $shortBoxName = _("Trash");
 319             else if ($mailbox == $sent_folder)
 320                 $shortBoxName = _("Drafts");
 321         }
 322         $urlMailbox = urlencode($mailbox);
 323     } else {
 324         $shortBoxName = '';
 325         $urlMailbox = '';
 326     }
 327
 328     $provider_link = '';
 329     if (!empty($provider_uri) && !empty($provider_name) && $provider_name != 'SquirrelMail') {
 330         $provider_link = create_hyperlink($provider_uri, $provider_name, '_blank');
 331     }
 332
 333     $oTemplate->assign('onload', $sOnload);
 334     $oTemplate->assign('shortBoxName', $shortBoxName);
 335     $oTemplate->assign('provider_link', $provider_link);
 336     $oTemplate->assign('frame_top', $frame_top);
 337     $oTemplate->assign('urlMailbox', $urlMailbox);
 338     $oTemplate->assign('startMessage', $startMessage);
 339     $oTemplate->assign('hide_sm_attributions', $hide_sm_attributions);
 340
 341     // access keys
 342     //
 343     global $accesskey_menubar_compose, $accesskey_menubar_addresses,
 344            $accesskey_menubar_folders, $accesskey_menubar_options,
 345            $accesskey_menubar_search, $accesskey_menubar_help,
 346            $accesskey_menubar_signout;
 347     $oTemplate->assign('accesskey_menubar_compose', $accesskey_menubar_compose);
 348     $oTemplate->assign('accesskey_menubar_addresses', $accesskey_menubar_addresses);
 349     $oTemplate->assign('accesskey_menubar_folders', $accesskey_menubar_folders);
 350     $oTemplate->assign('accesskey_menubar_options', $accesskey_menubar_options);
 351     $oTemplate->assign('accesskey_menubar_search', $accesskey_menubar_search);
 352     $oTemplate->assign('accesskey_menubar_help', $accesskey_menubar_help);
 353     $oTemplate->assign('accesskey_menubar_signout', $accesskey_menubar_signout);
 354
 355     $oTemplate->display('page_header.tpl');
 356
 357     global $null;
 358     do_hook('page_header_bottom', $null);
 359 }
 360
 361 /**
 362  * Blatantly copied/truncated/modified from displayPageHeader.
 363  * Outputs a page header specifically for the compose_in_new popup window
 364  *
 365  * @param array color the array of theme colors
 366  * @param string mailbox the current mailbox name to display
 367  * @param string sHeaderJs javascipt code to be inserted in a script block in the header
 368  * @param string sOnload JavaScript code to be added inside the body's onload handler
 369  *                       as of 1.5.2, this replaces $sBodyTagJs argument
 370  * @return void
 371  */
 372 function compose_Header($color, $mailbox, $sHeaderJs='', $sOnload = '') {
 373
 374     global $reply_focus, $action, $oTemplate;
 375
 376     if (empty($sOnload)) {
 377         if (strpos($action, 'reply') !== FALSE && $reply_focus) {
 378             if ($reply_focus == 'select')
 379                 $sOnload = 'checkForm(\'select\');';
 380             else if ($reply_focus == 'focus')
 381                 $sOnload = 'checkForm(\'focus\');';
 382             else if ($reply_focus != 'none')
 383                 $sOnload = 'checkForm();';
 384         }
 385         else
 386             $sOnload = 'checkForm();';
 387     }
 388
 389
 390     /*
 391      * Locate the first displayable form element (only when JavaScript on)
 392      */
 393     if(checkForJavascript()) {
 394         if ($sHeaderJs) {
 395             $sJsBlock = "\n<script type=\"text/javascript\">" .
 396                         "\n<!--\n" .
 397                         $sHeaderJs . "\n\n// -->\n</script>\n";
 398         } else {
 399         $sJsBlock = '';
 400         }
 401         $sJsBlock .= "\n";
 402
 403         $js_includes = $oTemplate->get_javascript_includes(TRUE);
 404         foreach ($js_includes as $js_file) {
 405             $sJsBlock .= '<script src="'.$js_file.'" type="text/javascript"></script>' ."\n";
 406         }
 407
 408         displayHtmlHeader (_("Compose"), $sJsBlock);
 409     } else {
 410         /* javascript off */
 411         displayHtmlHeader(_("Compose"));
 412         $sOnload = '';
 413     }
 414
 415 // FIXME: change the colorization attributes below to a CSS class!
 416     $class = '';
 417     $aAttribs = array('text' => $color[8], 'bgcolor' => $color[4],
 418                       'link' => $color[7], 'vlink' => $color[7],
 419                       'alink' => $color[7]);
 420
 421     // this is template-safe (see create_body() function)
 422     echo create_body($sOnload, $class, $aAttribs);
 423
 424     global $null;
 425     do_hook('compose_header_bottom', $null);
 426 }