src/redirect.php

   1 <?php
   2
   3 /**
   4  * Prevents users from reposting their form data after a successful logout.
   5  *
   6  * Derived from webmail.php by Ralf Kraudelt <kraude@wiwi.uni-rostock.de>
   7  *
   8  * @copyright &copy; 1999-2009 The SquirrelMail Project Team
   9  * @license http://opensource.org/licenses/gpl-license.php GNU Public License
  10  * @version $Id$
  11  * @package squirrelmail
  12  */
  13
  14 /** This is the redirect page */
  15 define('PAGE_NAME', 'redirect');
  16
  17 /**
  18  * Include the SquirrelMail initialization file.
  19  */
  20 require('../include/init.php');
  21
  22 /* SquirrelMail required files. */
  23 require_once(SM_PATH . 'functions/imap_general.php');
  24 require_once(SM_PATH . 'functions/strings.php');
  25
  26 header('Pragma: no-cache');
  27 $location = get_location();
  28
  29 // session_set_cookie_params (0, $base_uri);
  30
  31 sqsession_unregister ('user_is_logged_in');
  32 sqsession_register ($base_uri, 'base_uri');
  33
  34 /* get globals we me need */
  35 sqGetGlobalVar('login_username', $login_username);
  36 sqGetGlobalVar('secretkey', $secretkey);
  37 if(!sqGetGlobalVar('squirrelmail_language', $squirrelmail_language) || $squirrelmail_language == '') {
  38     $squirrelmail_language = $squirrelmail_default_language;
  39 }
  40 if (!sqgetGlobalVar('mailtodata', $mailtodata)) {
  41     $mailtodata = '';
  42 }
  43
  44 /* end of get globals */
  45
  46 set_up_language($squirrelmail_language, true);
  47 /* Refresh the language cookie. */
  48 sqsetcookie('squirrelmail_language', $squirrelmail_language, time()+2592000,
  49           $base_uri);
  50
  51 if (!isset($login_username)) {
  52     logout_error( _("You must be logged in to access this page.") );
  53     exit;
  54 }
  55
  56 do_hook('login_before', $null);
  57
  58 $onetimepad = OneTimePadCreate(strlen($secretkey));
  59 $key = OneTimePadEncrypt($secretkey, $onetimepad);
  60
  61 /* remove redundant spaces */
  62 $login_username = trim($login_username);
  63
  64 /* Case-normalise username if so desired */
  65 if ($force_username_lowercase) {
  66     $login_username = strtolower($login_username);
  67 }
  68
  69 /* Verify that username and password are correct. */
  70 $imapConnection = sqimap_login($login_username, $key, $imapServerAddress, $imapPort, 0);
  71 /* From now on we are logged it. If the login failed then sqimap_login handles it */
  72
  73 /**
  74  * Regenerate session id to make sure that authenticated session uses
  75  * different ID than one used before user authenticated.  This is a
  76  * countermeasure against session fixation attacks.
  77  * NB: session_regenerate_id() was added in PHP 4.3.2 (and new session
  78  *     cookie is only sent out in this call as of PHP 4.3.3), but PHP 4
  79  *     is not vulnerable to session fixation problems in SquirrelMail
  80  *     because it prioritizes $base_uri subdirectory cookies differently
  81  *     than PHP 5, which is otherwise vulnerable.  If we really want to,
  82  *     we could define our own session_regenerate_id() when one does not
  83  *     exist, but there seems to be no reason to do so.
  84  */
  85 sqsession_is_active();
  86 if (function_exists('session_regenerate_id')) {
  87     session_regenerate_id();
  88 }
  89
  90 /**
  91 * The cookie part. session_start and session_regenerate_session normally set
  92 * their own cookie. SquirrelMail sets another cookie which overwites the
  93 * php cookies. The sqsetcookie function sets the cookie by using the header
  94 * function which gives us full control how the cookie is set. We do that
  95 * to add the HttpOnly cookie attribute which blocks javascript access on
  96 * IE6 SP1.
  97 */
  98 sqsetcookie(session_name(),session_id(),false,$base_uri);
  99 sqsetcookie('key', $key, false, $base_uri);
 100
 101 sqsession_register($onetimepad, 'onetimepad');
 102
 103 $sqimap_capabilities = sqimap_capability($imapConnection);
 104
 105 /* Server side sorting control */
 106 if (isset($sqimap_capabilities['SORT']) && $sqimap_capabilities['SORT'] == true &&
 107     isset($disable_server_sort) && $disable_server_sort) {
 108     unset($sqimap_capabilities['SORT']);
 109 }
 110
 111 /* Thread sort control */
 112 if (isset($sqimap_capabilities['THREAD']) && $sqimap_capabilities['THREAD'] == true &&
 113     isset($disable_thread_sort) && $disable_thread_sort) {
 114     unset($sqimap_capabilities['THREAD']);
 115 }
 116
 117 sqsession_register($sqimap_capabilities, 'sqimap_capabilities');
 118 $delimiter = sqimap_get_delimiter ($imapConnection);
 119
 120 if (isset($sqimap_capabilities['NAMESPACE']) && $sqimap_capabilities['NAMESPACE'] == true) {
 121     $namespace = sqimap_get_namespace($imapConnection);
 122     sqsession_register($namespace, 'sqimap_namespace');
 123 }
 124
 125 sqimap_logout($imapConnection);
 126 sqsession_register($delimiter, 'delimiter');
 127
 128 $username = $login_username;
 129 sqsession_register ($username, 'username');
 130 do_hook('login_verified', $null);
 131
 132 /* Set the login variables. */
 133 $user_is_logged_in = true;
 134 $just_logged_in = true;
 135
 136 /* And register with them with the session. */
 137 sqsession_register ($user_is_logged_in, 'user_is_logged_in');
 138 sqsession_register ($just_logged_in, 'just_logged_in');
 139
 140 /* parse the accepted content-types of the client */
 141 $attachment_common_types = array();
 142 $attachment_common_types_parsed = array();
 143 sqsession_register($attachment_common_types, 'attachment_common_types');
 144 sqsession_register($attachment_common_types_parsed, 'attachment_common_types_parsed');
 145
 146 if ( sqgetGlobalVar('HTTP_ACCEPT', $http_accept, SQ_SERVER) &&
 147     !isset($attachment_common_types_parsed[$http_accept]) ) {
 148     attachment_common_parse($http_accept);
 149 }
 150
 151 // having just logged in, need to synch the template file cache
 152 // so the right template set is displayed (per user prefs)
 153 require(SM_PATH . 'include/load_prefs.php');
 154 global $sTemplateID;
 155 Template::cache_template_file_hierarchy($sTemplateID, TRUE);
 156
 157 /* Complete autodetection of Javascript. */
 158 checkForJavascript();
 159
 160 /* Compute the URL to forward the user to. */
 161 $redirect_url = $location . '/webmail.php';
 162
 163 if ( sqgetGlobalVar('session_expired_location', $session_expired_location, SQ_SESSION) ) {
 164     sqsession_unregister('session_expired_location');
 165     if ( $session_expired_location == 'compose' ) {
 166         $compose_new_win = getPref($data_dir, $username, 'compose_new_win', 0);
 167         if ($compose_new_win) {
 168             // do not prefix $location here because $session_expired_location is set to the PAGE_NAME
 169             // of the last page
 170             $redirect_url = $location . '/' . $session_expired_location . '.php';
 171         } else {
 172             $redirect_url = $location . '/webmail.php?right_frame=' . urlencode($session_expired_location . '.php');
 173         }
 174     } else if ($session_expired_location != 'webmail'
 175             && $session_expired_location != 'left_main') {
 176         $redirect_url = $location . '/webmail.php?right_frame=' . urlencode($session_expired_location . '.php');
 177     }
 178     unset($session_expired_location);
 179 }
 180
 181 if($mailtodata != '') {
 182     $redirect_url  = $location . '/webmail.php?right_frame=compose.php&mailtodata=';
 183     $redirect_url .= urlencode($mailtodata);
 184 }
 185
 186 /* Write session data and send them off to the appropriate page. */
 187 session_write_close();
 188 header("Location: $redirect_url");
 189 exit;
 190
 191 /* --------------------- end main ----------------------- */
 192
 193 function attachment_common_parse($str) {
 194     global $attachment_common_types, $attachment_common_types_parsed;
 195
 196     /*
 197      * Replace ", " with "," and explode on that as Mozilla 1.x seems to
 198      * use "," to seperate whilst IE, and earlier versions of Mozilla use
 199      * ", " to seperate
 200      */
 201
 202     $str = str_replace( ', ' , ',' , $str );
 203     $types = explode(',', $str);
 204
 205     foreach ($types as $val) {
 206         // Ignore the ";q=1.0" stuff
 207         if (strpos($val, ';') !== false) {
 208             $val = substr($val, 0, strpos($val, ';'));
 209         }
 210         if (! isset($attachment_common_types[$val])) {
 211             $attachment_common_types[$val] = true;
 212         }
 213     }
 214     sqsession_register($attachment_common_types, 'attachment_common_types');
 215
 216     /* mark as parsed */
 217     $attachment_common_types_parsed[$str] = true;
 218 }