Another XSS problem, carefully constructed X-Mailer header would result in
[squirrelmail.git] / src / view_text.php
1 <?php
2
3 /**
4 * view_text.php -- Displays the main frameset
5 *
6 * Copyright (c) 1999-2003 The SquirrelMail development team
7 * Licensed under the GNU GPL. For full terms see the file COPYING.
8 *
9 * Who knows what this file does. However PUT IT HERE DID NOT PUT
10 * A SINGLE FREAKING COMMENT IN! Whoever is responsible for this,
11 * be very ashamed.
12 *
13 * $Id$
14 */
15
16 /* Path for SquirrelMail required files. */
17 define('SM_PATH','../');
18
19 /* SquirrelMail required files. */
20 require_once(SM_PATH . 'include/validate.php');
21 require_once(SM_PATH . 'functions/imap.php');
22 require_once(SM_PATH . 'functions/mime.php');
23 require_once(SM_PATH . 'functions/html.php');
24
25 $mailbox = urldecode($_GET['mailbox']);
26 if (!isset($_GET['passed_ent_id'])) {
27 $passed_ent_id = '';
28 } else {
29 $passed_ent_id = $_GET['passed_ent_id'];
30 }
31 $passed_id = $_GET['passed_id'];
32 if (isset($_GET['ent_id'])) {
33 $ent_id = $_GET['ent_id'];
34 } else {
35 $ent_id = '';
36 }
37
38 $username = $_SESSION['username'];
39 $key = $_COOKIE['key'];
40 $delimiter = $_SESSION['delimiter'];
41 $onetimepad = $_SESSION['onetimepad'];
42 $QUERY_STRING = $_SERVER['QUERY_STRING'];
43 sqextractGlobalVar('messages');
44
45 $imapConnection = sqimap_login($username, $key, $imapServerAddress, $imapPort, 0);
46 $mbx_response = sqimap_mailbox_select($imapConnection, $mailbox);
47
48 $message = &$messages[$mbx_response['UIDVALIDITY']]["$passed_id"];
49 $message_ent = &$message->getEntity($ent_id);
50 if ($passed_ent_id) {
51 $message = &$message->getEntity($passed_ent_id);
52 }
53
54 $header = $message_ent->header;
55 $charset = $header->getParameter('charset');
56 $type0 = $header->type0;
57 $type1 = $header->type1;
58 $encoding = strtolower($header->encoding);
59
60 $msg_url = 'read_body.php?' . $QUERY_STRING;
61 $msg_url = set_url_var($msg_url, 'ent_id', 0);
62
63 $body = mime_fetch_body($imapConnection, $passed_id, $ent_id);
64 $body = decodeBody($body, $encoding);
65
66 displayPageHeader($color, 'None');
67
68 echo "<BR><TABLE WIDTH=\"100%\" BORDER=0 CELLSPACING=0 CELLPADDING=2 ALIGN=CENTER><TR><TD BGCOLOR=\"$color[0]\">".
69 "<B><CENTER>".
70 _("Viewing a text attachment") . " - ";
71 echo '<a href="'.$msg_url.'">'. _("View message") . '</a>';
72
73 $dwnld_url = '../src/download.php?'. $QUERY_STRING.'&amp;absolute_dl=true';
74 echo '</b></td><tr><tr><td><CENTER><A HREF="'.$dwnld_url. '">'.
75 _("Download this as a file").
76 "</A></CENTER><BR>".
77 "</CENTER></B>".
78 "</TD></TR></TABLE>".
79 "<TABLE WIDTH=\"98%\" BORDER=0 CELLSPACING=0 CELLPADDING=2 ALIGN=CENTER><TR><TD BGCOLOR=\"$color[0]\">".
80 "<TR><TD BGCOLOR=\"$color[4]\"><TT>";
81 if ($type1 == 'html' || (isset($override_type1) && $override_type1 == 'html')) {
82 $body = MagicHTML( $body, $passed_id, $message, $mailbox);
83 } else {
84 translateText($body, $wrap_at, $charset);
85 }
86 echo $body . "</TT></TD></TR></TABLE>";
87
88 ?>