5) XSS in addressbook (different):
[squirrelmail.git] / src / addressbook.php
1 <?php
2
3 /**
4 * addressbook.php
5 *
6 * Copyright (c) 1999-2002 The SquirrelMail Project Team
7 * Licensed under the GNU GPL. For full terms see the file COPYING.
8 *
9 * Manage personal address book.
10 *
11 * $Id$
12 */
13
14 /* Path for SquirrelMail required files. */
15 define('SM_PATH','../');
16
17 /* SquirrelMail required files. */
18 require_once(SM_PATH . 'include/validate.php');
19 require_once(SM_PATH . 'functions/array.php');
20 require_once(SM_PATH . 'functions/display_messages.php');
21 require_once(SM_PATH . 'functions/addressbook.php');
22 require_once(SM_PATH . 'functions/strings.php');
23 require_once(SM_PATH . 'functions/html.php');
24
25 /* Make an input field */
26 function adressbook_inp_field($label, $field, $name, $size, $values, $add) {
27 global $color;
28 $td_str = '<INPUT NAME="' . $name . '[' . $field . ']" SIZE="' . $size . '" VALUE="';
29 if (isset($values[$field])) {
30 $td_str .= htmlspecialchars( strip_tags( $values[$field] ) );
31 }
32 $td_str .= '">' . $add . '';
33 return html_tag( 'tr' ,
34 html_tag( 'td', $label . ':', 'right', $color[4]) .
35 html_tag( 'td', $td_str, 'left', $color[4])
36 )
37 . "\n";
38 }
39
40 /* Output form to add and modify address data */
41 function address_form($name, $submittext, $values = array()) {
42 global $color;
43
44 echo html_tag( 'table',
45 adressbook_inp_field(_("Nickname"), 'nickname', $name, 15, $values,
46 ' <SMALL>' . _("Must be unique") . '</SMALL>') .
47 adressbook_inp_field(_("E-mail address"), 'email', $name, 45, $values, '') .
48 adressbook_inp_field(_("First name"), 'firstname', $name, 45, $values, '') .
49 adressbook_inp_field(_("Last name"), 'lastname', $name, 45, $values, '') .
50 adressbook_inp_field(_("Additional info"), 'label', $name, 45, $values, '') .
51 html_tag( 'tr',
52 html_tag( 'td',
53 '<INPUT TYPE=submit NAME="' . $name . '[SUBMIT]" VALUE="' .
54 $submittext . '">',
55 'center', $color[4], 'colspan="2"')
56 )
57 , 'center', '', 'border="0" cellpadding="1" width="90%"') ."\n";
58 }
59
60 /* Open addressbook, with error messages on but without LDAP (the *
61 * second "true"). Don't need LDAP here anyway */
62 $abook = addressbook_init(true, true);
63 if($abook->localbackend == 0) {
64 plain_error_message(
65 _("No personal address book is defined. Contact administrator."),
66 $color);
67 exit();
68 }
69
70 displayPageHeader($color, 'None');
71
72 $defdata = array();
73 $formerror = '';
74 $abortform = false;
75 $showaddrlist = true;
76 $defselected = array();
77 $form_url = 'addressbook.php';
78
79
80 /* Handle user's actions */
81 if($REQUEST_METHOD == 'POST') {
82
83 /**************************************************
84 * Add new address *
85 **************************************************/
86 if (!empty($addaddr['nickname'])) {
87 foreach( $addaddr as $k => $adr ) {
88 $addaddr[$k] = strip_tags( $adr );
89 }
90 $r = $abook->add($addaddr, $abook->localbackend);
91
92 /* Handle error messages */
93 if (!$r) {
94 /* Remove backend name from error string */
95 $errstr = $abook->error;
96 $errstr = ereg_replace('^\[.*\] *', '', $errstr);
97
98 $formerror = $errstr;
99 $showaddrlist = false;
100 $defdata = $addaddr;
101 }
102 } else {
103
104 /************************************************
105 * Delete address(es) *
106 ************************************************/
107 if ((!empty($deladdr)) && sizeof($sel) > 0) {
108 $orig_sel = $sel;
109 sort($sel);
110
111 /* The selected addresses are identidied by "backend:nickname". *
112 * Sort the list and process one backend at the time */
113 $prevback = -1;
114 $subsel = array();
115 $delfailed = false;
116
117 for ($i = 0 ; (($i < sizeof($sel)) && !$delfailed) ; $i++) {
118 list($sbackend, $snick) = explode(':', $sel[$i]);
119
120 /* When we get to a new backend, process addresses in *
121 * previous one. */
122 if ($prevback != $sbackend && $prevback != -1) {
123
124 $r = $abook->remove($subsel, $prevback);
125 if (!$r) {
126 $formerror = $abook->error;
127 $i = sizeof($sel);
128 $delfailed = true;
129 break;
130 }
131 $subsel = array();
132 }
133
134 /* Queue for processing */
135 array_push($subsel, $snick);
136 $prevback = $sbackend;
137 }
138
139 if (!$delfailed) {
140 $r = $abook->remove($subsel, $prevback);
141 if (!$r) { /* Handle errors */
142 $formerror = $abook->error;
143 $delfailed = true;
144 }
145 }
146
147 if ($delfailed) {
148 $showaddrlist = true;
149 $defselected = $orig_sel;
150 }
151
152 } else {
153
154 /***********************************************
155 * Update/modify address *
156 ***********************************************/
157 if (!empty($editaddr)) {
158
159 /* Stage one: Copy data into form */
160 if (isset($sel) && sizeof($sel) > 0) {
161 if(sizeof($sel) > 1) {
162 $formerror = _("You can only edit one address at the time");
163 $showaddrlist = true;
164 $defselected = $sel;
165 } else {
166 $abortform = true;
167 list($ebackend, $enick) = explode(':', $sel[0]);
168 $olddata = $abook->lookup($enick, $ebackend);
169
170 /* Display the "new address" form */
171 echo '<FORM ACTION="' . $form_url . '" METHOD="POST">' .
172 "\n" .
173 html_tag( 'table',
174 html_tag( 'tr',
175 html_tag( 'td',
176 "\n". '<strong>' . _("Update address") . '</strong>' ."\n",
177 'center', $color[0] )
178 ),
179 'center', '', 'width="100%" ' );
180 address_form("editaddr", _("Update address"), $olddata);
181 echo '<INPUT TYPE=hidden NAME=oldnick VALUE="' .
182 htmlspecialchars($olddata["nickname"]) . "\">\n" .
183 '<INPUT TYPE=hidden NAME=backend VALUE="' .
184 htmlspecialchars($olddata["backend"]) . "\">\n" .
185 '<INPUT TYPE=hidden NAME=doedit VALUE=1>' . "\n" .
186 '</FORM>';
187 }
188 } else {
189
190 /* Stage two: Write new data */
191 if ($doedit = 1) {
192 $newdata = $editaddr;
193 $r = $abook->modify($oldnick, $newdata, $backend);
194
195 /* Handle error messages */
196 if (!$r) {
197 /* Display error */
198 echo html_tag( 'table',
199 html_tag( 'tr',
200 html_tag( 'td',
201 "\n". '<br><strong><font color="' . $color[2] .
202 '">' . _("ERROR") . ': ' . $abook->error . '</font></strong>' ."\n",
203 'center' )
204 ),
205 'center', '', 'width="100%"' );
206
207 /* Display the "new address" form again */
208 echo '<FORM ACTION="' . $form_url .
209 '" METHOD="POST">' . "\n" .
210 html_tag( 'table',
211 html_tag( 'tr',
212 html_tag( 'td',
213 "\n". '<br><strong>' . _("Update address") . '</strong>' ."\n",
214 'center', $color[0] )
215 ),
216 'center', '', 'width="100%"' ) .
217 address_form("editaddr", _("Update address"), $newdata);
218 echo '<INPUT TYPE=hidden NAME=oldnick VALUE="' .
219 htmlspecialchars($oldnick) . "\">\n" .
220 '<INPUT TYPE=hidden NAME=backend VALUE="' .
221 htmlspecialchars($backend) . "\">\n" .
222 '<INPUT TYPE=hidden NAME=doedit VALUE=1>' .
223 "\n" . '</FORM>';
224 $abortform = true;
225 }
226 } else {
227
228 /* Should not get here... */
229 plain_error_message(_("Unknown error"), $color);
230 $abortform = true;
231 }
232 }
233 } /* !empty($editaddr) - Update/modify address */
234 } /* (!empty($deladdr)) && sizeof($sel) > 0 - Delete address(es) */
235 } /* !empty($addaddr['nickname']) - Add new address */
236
237 // Some times we end output before forms are printed
238 if($abortform) {
239 echo "</BODY></HTML>\n";
240 exit();
241 }
242 }
243
244
245 /* =================================================================== *
246 * The following is only executed on a GET request, or on a POST when *
247 * a user is added, or when "delete" or "modify" was successful. *
248 * =================================================================== */
249
250 /* Display error messages */
251 if (!empty($formerror)) {
252 echo html_tag( 'table',
253 html_tag( 'tr',
254 html_tag( 'td',
255 "\n". '<br><strong><font color="' . $color[2] .
256 '">' . _("ERROR") . ': ' . $formerror . '</font></strong>' ."\n",
257 'center' )
258 ),
259 'center', '', 'width="100%"' );
260 }
261
262
263 /* Display the address management part */
264 if ($showaddrlist) {
265 /* Get and sort address list */
266 $alist = $abook->list_addr();
267 if(!is_array($alist)) {
268 plain_error_message($abook->error, $color);
269 exit;
270 }
271
272 usort($alist,'alistcmp');
273 $prevbackend = -1;
274 $headerprinted = false;
275
276 echo html_tag( 'p', '<a href="#AddAddress">' . _("Add address") . '</a>', 'center' ) . "\n";
277
278 /* List addresses */
279 if (count($alist) > 0) {
280 echo '<FORM ACTION="' . $form_url . '" METHOD="POST">' . "\n";
281 while(list($undef,$row) = each($alist)) {
282
283 /* New table header for each backend */
284 if($prevbackend != $row['backend']) {
285 if($prevbackend < 0) {
286 echo html_tag( 'table',
287 html_tag( 'tr',
288 html_tag( 'td',
289 '<INPUT TYPE=submit NAME=editaddr VALUE="' .
290 _("Edit selected") . "\">\n" .
291 '<INPUT TYPE=submit NAME=deladdr VALUE="' .
292 _("Delete selected") . "\">\n",
293 'center', '', 'colspan="5"' )
294 ) .
295 html_tag( 'tr',
296 html_tag( 'td', '&nbsp;<br>', 'center', '', 'colspan="5"' )
297 ) ,
298 'center' );
299 }
300
301 echo html_tag( 'table',
302 html_tag( 'tr',
303 html_tag( 'td', "\n" . '<strong>' . $row['source'] . '</strong>' . "\n", 'center', $color[0] )
304 ) ,
305 'center', '', 'width="95%"' ) ."\n"
306 . html_tag( 'table', '', 'center', '', 'border="0" cellpadding="1" cellspacing="0" width="90%"' ) .
307 html_tag( 'tr', "\n" .
308 html_tag( 'th', '&nbsp;', 'left', '', 'width="1%"' ) .
309 html_tag( 'th', _("Nickname"), 'left', '', 'width="1%"' ) .
310 html_tag( 'th', _("Name"), 'left', '', 'width="1%"' ) .
311 html_tag( 'th', _("E-mail"), 'left', '', 'width="1%"' ) .
312 html_tag( 'th', _("Info"), 'left', '', 'width="1%"' ) ,
313 '', $color[9] ) . "\n";
314
315 $line = 0;
316 $headerprinted = true;
317 } /* End of header */
318
319 $prevbackend = $row['backend'];
320
321 /* Check if this user is selected */
322 if(in_array($row['backend'] . ':' . $row['nickname'], $defselected)) {
323 $selected = 'CHECKED';
324 } else {
325 $selected = '';
326 }
327
328 /* Print one row */
329 $tr_bgcolor = '';
330 if ($line % 2) { $tr_bgcolor = $color[0]; }
331 echo html_tag( 'tr', '') .
332 html_tag( 'td',
333 '<SMALL>' .
334 '<INPUT TYPE=checkbox ' . $selected . ' NAME="sel[]" VALUE="' .
335 $row['backend'] . ':' . $row['nickname'] . '"></SMALL>' ,
336 'center', '', 'valign="top" width="1%"' ) .
337 html_tag( 'td', '&nbsp;' . $row['nickname'] . '&nbsp;', 'left', '', 'valign="top" width="1%" nowrap' ) .
338 html_tag( 'td', '&nbsp;' . $row['name'] . '&nbsp;', 'left', '', 'valign="top" width="1%" nowrap' ) .
339 html_tag( 'td', '', 'left', '', 'valign="top" width="1%" nowrap' ) . '&nbsp;';
340 $email = $abook->full_address($row);
341 if ($compose_new_win == '1') {
342 echo '<a href="javascript:void(0)" onclick=comp_in_new(false,"compose.php?send_to='.rawurlencode($email).'")>';
343 }
344 else {
345 echo '<A HREF="compose.php?send_to=' . rawurlencode($email).'">';
346 }
347 echo htmlspecialchars($row['email']) . '</A>&nbsp;</td>'."\n".
348 html_tag( 'td', '&nbsp;' . htmlspecialchars($row['label']) . '&nbsp;', 'left', '', 'valign="top" width="1%"' ) .
349 "</tr>\n";
350 $line++;
351 }
352
353 /* End of list. Close table. */
354 if ($headerprinted) {
355 echo html_tag( 'tr',
356 html_tag( 'td',
357 '<INPUT TYPE="submit" NAME="editaddr" VALUE="' . _("Edit selected") .
358 "\">\n" .
359 '<INPUT TYPE="submit" NAME="deladdr" VALUE="' . _("Delete selected") .
360 "\">\n",
361 'center', '', 'colspan="5"' )
362 );
363 }
364 echo '</table></FORM>';
365 }
366 } /* end of addresslist */
367
368
369 /* Display the "new address" form */
370 echo '<a name="AddAddress"></a>' . "\n" .
371 '<FORM ACTION="' . $form_url . '" NAME=f_add METHOD="POST">' . "\n" .
372 html_tag( 'table',
373 html_tag( 'tr',
374 html_tag( 'td', "\n". '<strong>' . sprintf(_("Add to %s"), $abook->localbackendname) . '</strong>' . "\n",
375 'center', $color[0]
376 )
377 )
378 , 'center', '', 'width="100%"' ) ."\n";
379 address_form('addaddr', _("Add address"), $defdata);
380 echo '</FORM>';
381
382 /* Add hook for anything that wants on the bottom */
383 do_hook('addressbook_bottom');
384 ?>
385
386 </BODY></HTML>