src/redirect.php

   1 <?php
   2
   3 /**
   4  * Prevents users from reposting their form data after a successful logout.
   5  *
   6  * Derived from webmail.php by Ralf Kraudelt <kraude@wiwi.uni-rostock.de>
   7  *
   8  * @copyright 1999-2020 The SquirrelMail Project Team
   9  * @license http://opensource.org/licenses/gpl-license.php GNU Public License
  10  * @version $Id$
  11  * @package squirrelmail
  12  */
  13
  14 /** This is the redirect page */
  15 define('PAGE_NAME', 'redirect');
  16
  17 /**
  18  * Include the SquirrelMail initialization file.
  19  */
  20 require('../include/init.php');
  21
  22 /* SquirrelMail required files. */
  23 require_once(SM_PATH . 'functions/imap_general.php');
  24 require_once(SM_PATH . 'functions/strings.php');
  25
  26 // Disable browser caching
  27 //
  28 header('Cache-Control: no-cache, no-store, must-revalidate, max-age=0');
  29 header('Pragma: no-cache');
  30 header('Expires: Sat, 1 Jan 2000 00:00:00 GMT');
  31 $location = get_location();
  32
  33 // session_set_cookie_params (0, $base_uri);
  34
  35 sqsession_unregister ('user_is_logged_in');
  36 sqsession_register ($base_uri, 'base_uri');
  37
  38 /* get globals we me need */
  39 sqGetGlobalVar('login_username', $login_username);
  40 sqGetGlobalVar('secretkey', $secretkey);
  41 if(!sqGetGlobalVar('squirrelmail_language', $squirrelmail_language) || $squirrelmail_language == '') {
  42     $squirrelmail_language = $squirrelmail_default_language;
  43 }
  44 if (!sqgetGlobalVar('mailtodata', $mailtodata)) {
  45     $mailtodata = '';
  46 }
  47
  48 /* end of get globals */
  49
  50 set_up_language($squirrelmail_language, true);
  51 /* Refresh the language cookie. */
  52 sqsetcookie('squirrelmail_language', $squirrelmail_language, time()+2592000,
  53           $base_uri);
  54
  55 if (!isset($login_username)) {
  56     logout_error( _("You must be logged in to access this page.") );
  57     exit;
  58 }
  59
  60 do_hook('login_before', $null);
  61
  62 $onetimepad = OneTimePadCreate(strlen($secretkey));
  63 $key = OneTimePadEncrypt($secretkey, $onetimepad);
  64
  65 /* remove redundant spaces */
  66 $login_username = trim($login_username);
  67
  68 /* Case-normalise username if so desired */
  69 if ($force_username_lowercase) {
  70     $login_username = strtolower($login_username);
  71 }
  72
  73 /* Verify that username and password are correct. */
  74 global $imap_stream_options; // in case not defined in config
  75 $imapConnection = sqimap_login($login_username, $key, $imapServerAddress, $imapPort, 0, $imap_stream_options);
  76 /* From now on we are logged it. If the login failed then sqimap_login handles it */
  77
  78 /**
  79  * Regenerate session id to make sure that authenticated session uses
  80  * different ID than one used before user authenticated.  This is a
  81  * countermeasure against session fixation attacks.
  82  * NB: session_regenerate_id() was added in PHP 4.3.2 (and new session
  83  *     cookie is only sent out in this call as of PHP 4.3.3), but PHP 4
  84  *     is not vulnerable to session fixation problems in SquirrelMail
  85  *     because it prioritizes $base_uri subdirectory cookies differently
  86  *     than PHP 5, which is otherwise vulnerable.  If we really want to,
  87  *     we could define our own session_regenerate_id() when one does not
  88  *     exist, but there seems to be no reason to do so.
  89  */
  90 sqsession_is_active();
  91 if (function_exists('session_regenerate_id')) {
  92     session_regenerate_id();
  93 }
  94
  95 /**
  96 * The cookie part. session_start and session_regenerate_session normally set
  97 * their own cookie. SquirrelMail sets another cookie which overwites the
  98 * php cookies. The sqsetcookie function sets the cookie by using the header
  99 * function which gives us full control how the cookie is set. We do that
 100 * to add the HttpOnly cookie attribute which blocks javascript access on
 101 * IE6 SP1.
 102 */
 103 sqsetcookie(session_name(),session_id(),false,$base_uri);
 104 sqsetcookie('key', $key, false, $base_uri);
 105
 106 sqsession_register($onetimepad, 'onetimepad');
 107
 108 $sqimap_capabilities = sqimap_capability($imapConnection);
 109
 110 /* Server side sorting control */
 111 if (isset($sqimap_capabilities['SORT']) && $sqimap_capabilities['SORT'] == true &&
 112     isset($disable_server_sort) && $disable_server_sort) {
 113     unset($sqimap_capabilities['SORT']);
 114 }
 115
 116 /* Thread sort control */
 117 if (isset($sqimap_capabilities['THREAD']) && $sqimap_capabilities['THREAD'] == true &&
 118     isset($disable_thread_sort) && $disable_thread_sort) {
 119     unset($sqimap_capabilities['THREAD']);
 120 }
 121
 122 sqsession_register($sqimap_capabilities, 'sqimap_capabilities');
 123 $delimiter = sqimap_get_delimiter ($imapConnection);
 124
 125 if (isset($sqimap_capabilities['NAMESPACE']) && $sqimap_capabilities['NAMESPACE'] == true) {
 126     $namespace = sqimap_get_namespace($imapConnection);
 127     sqsession_register($namespace, 'sqimap_namespace');
 128 }
 129
 130 sqimap_logout($imapConnection);
 131 sqsession_register($delimiter, 'delimiter');
 132
 133 $username = $login_username;
 134 sqsession_register ($username, 'username');
 135 do_hook('login_verified', $null);
 136
 137 /* Set the login variables. */
 138 $user_is_logged_in = true;
 139 $just_logged_in = true;
 140
 141 /* And register with them with the session. */
 142 sqsession_register ($user_is_logged_in, 'user_is_logged_in');
 143 sqsession_register ($just_logged_in, 'just_logged_in');
 144
 145 /* parse the accepted content-types of the client */
 146 $attachment_common_types = array();
 147 $attachment_common_types_parsed = array();
 148 sqsession_register($attachment_common_types, 'attachment_common_types');
 149 sqsession_register($attachment_common_types_parsed, 'attachment_common_types_parsed');
 150
 151 if ( sqgetGlobalVar('HTTP_ACCEPT', $http_accept, SQ_SERVER) &&
 152     !isset($attachment_common_types_parsed[$http_accept]) ) {
 153     attachment_common_parse($http_accept);
 154 }
 155
 156 // having just logged in, need to synch the template file cache
 157 // so the right template set is displayed (per user prefs)
 158 require(SM_PATH . 'include/load_prefs.php');
 159 global $sTemplateID;
 160 Template::cache_template_file_hierarchy($sTemplateID, TRUE);
 161
 162 /* Complete autodetection of Javascript. */
 163 checkForJavascript();
 164
 165 /* Compute the URL to forward the user to. */
 166 $redirect_url = $location . '/webmail.php';
 167
 168 if ( sqgetGlobalVar('session_expired_location', $session_expired_location, SQ_SESSION) ) {
 169     sqsession_unregister('session_expired_location');
 170     if ( $session_expired_location == 'compose' ) {
 171         $compose_new_win = getPref($data_dir, $username, 'compose_new_win', 0);
 172         if ($compose_new_win) {
 173             // do not prefix $location here because $session_expired_location is set to the PAGE_NAME
 174             // of the last page
 175             $redirect_url = $location . '/' . $session_expired_location . '.php';
 176         } else {
 177             $redirect_url = $location . '/webmail.php?right_frame=' . urlencode($session_expired_location . '.php');
 178         }
 179     } else if ($session_expired_location != 'webmail'
 180             && $session_expired_location != 'left_main') {
 181         $redirect_url = $location . '/webmail.php?right_frame=' . urlencode($session_expired_location . '.php');
 182     }
 183     unset($session_expired_location);
 184 }
 185
 186 if($mailtodata != '') {
 187     $redirect_url  = $location . '/webmail.php?right_frame=compose.php&mailtodata=';
 188     $redirect_url .= urlencode($mailtodata);
 189 }
 190
 191 /* Write session data and send them off to the appropriate page. */
 192 session_write_close();
 193 header("Location: $redirect_url");
 194 exit;
 195
 196 /* --------------------- end main ----------------------- */
 197
 198 function attachment_common_parse($str) {
 199     global $attachment_common_types, $attachment_common_types_parsed;
 200
 201     /*
 202      * Replace ", " with "," and explode on that as Mozilla 1.x seems to
 203      * use "," to seperate whilst IE, and earlier versions of Mozilla use
 204      * ", " to seperate
 205      */
 206
 207     $str = str_replace( ', ' , ',' , $str );
 208     $types = explode(',', $str);
 209
 210     foreach ($types as $val) {
 211         // Ignore the ";q=1.0" stuff
 212         if (strpos($val, ';') !== false) {
 213             $val = substr($val, 0, strpos($val, ';'));
 214         }
 215         if (! isset($attachment_common_types[$val])) {
 216             $attachment_common_types[$val] = true;
 217         }
 218     }
 219     sqsession_register($attachment_common_types, 'attachment_common_types');
 220
 221     /* mark as parsed */
 222     $attachment_common_types_parsed[$str] = true;
 223 }