Sanitize integer option fields - only digits allowed

[squirrelmail.git] / class / mime / Rfc822Header.class.php

diff --git a/class/mime/Rfc822Header.class.php b/class/mime/Rfc822Header.class.php
index 2cc08f703ce786b3de058b16361ce346a0c0bed8..0d33f7542d17e3c5e90836a870a006e2033ab3f0 100644 (file)
--- a/class/mime/Rfc822Header.class.php
+++ b/class/mime/Rfc822Header.class.php
@@ -5,7 +5,7 @@
  *
  * This file contains functions needed to handle headers in mime messages.
  *
- * @copyright © 2003-2007 The SquirrelMail Project Team
+ * @copyright 2003-2011 The SquirrelMail Project Team
  * @license http://opensource.org/licenses/gpl-license.php GNU Public License
  * @version $Id$
  * @package squirrelmail
@@ -509,7 +509,7 @@ class Rfc822Header {
             $sComment = trim(implode(' ',$aComment));
             $sPersonal .= $sComment;
         }
-        $oAddr =& new AddressStructure();
+        $oAddr = new AddressStructure();
         if ($sPersonal && substr($sPersonal,0,2) == '=?') {
             $oAddr->personal = encodeHeader($sPersonal);
         } else {
@@ -566,7 +566,7 @@ class Rfc822Header {
                 if ($sGroup) {
                     $aAddress[] = $this->createAddressObject($aStack,$aComment,$sEmail,$sGroup);
                     $oAddr = end($aAddress);
-                    if(!$oAddr || ((isset($oAddr)) && !$oAddr->mailbox && !$oAddr->personal)) {
+                    if(!$oAddr || ((isset($oAddr)) && !strlen($oAddr->mailbox) && !$oAddr->personal)) {
                         $sEmail = $sGroup . ':;';
                     }
                     $aAddress[] = $this->createAddressObject($aStack,$aComment,$sEmail,$sGroup);
@@ -607,8 +607,13 @@ class Rfc822Header {
                          $aAddrBookAddress = $this->parseAddress($aAddr['email'],true);
                      } else {
                          $iPosAt = strpos($aAddr['email'], '@');
-                         $oAddr->mailbox = substr($aAddr['email'], 0, $iPosAt);
-                         $oAddr->host = substr($aAddr['email'], $iPosAt+1);
+                         if ($iPosAt === FALSE) {
+                             $oAddr->mailbox = $aAddr['email'];
+                             $oAddr->host = FALSE;
+                         } else {
+                             $oAddr->mailbox = substr($aAddr['email'], 0, $iPosAt);
+                             $oAddr->host = substr($aAddr['email'], $iPosAt+1);
+                         } 
                          if (isset($aAddr['name'])) {
                              $oAddr->personal = $aAddr['name'];
                          } else {
@@ -617,18 +622,18 @@ class Rfc822Header {
                      }
                  }
             }
-            if (!$grouplookup && !$oAddr->mailbox) {
+            if (!$grouplookup && !strlen($oAddr->mailbox)) {
                 $oAddr->mailbox = trim($sEmail);
-                if ($sHost && $oAddr->mailbox) {
+                if ($sHost && strlen($oAddr->mailbox)) {
                     $oAddr->host = $sHost;
                 }
             } else if (!$grouplookup && !$oAddr->host) {
-                if ($sHost && $oAddr->mailbox) {
+                if ($sHost && strlen($oAddr->mailbox)) {
                     $oAddr->host = $sHost;
                 }
             }
           }
-          if (!$aAddrBookAddress && $oAddr->mailbox) {
+          if (!$aAddrBookAddress && strlen($oAddr->mailbox)) {
               $aProcessedAddress[] = $oAddr;
           } else {
               $aProcessedAddress = array_merge($aProcessedAddress,$aAddrBookAddress);
@@ -637,7 +642,10 @@ class Rfc822Header {
         if ($ar) {
             return $aProcessedAddress;
         } else {
-            return $aProcessedAddress[0];
+            if (isset($aProcessedAddress[0]))
+                return $aProcessedAddress[0];
+            else
+                return '';
         }
     }
 
@@ -854,14 +862,20 @@ class Rfc822Header {
      * @param mixed $arr string or array of strings
      * @param string $separator
      * @param boolean $encoded (since 1.4.0) return encoded or plain text addresses
+     * @param boolean $unconditionally_quote (since 1.4.21/1.5.2) When TRUE, always
+     *                                                      quote the personal part,
+     *                                                      whether or not it is
+     *                                                      encoded, otherwise quoting
+     *                                                      is only added if the
+     *                                                      personal part is not encoded
      * @return string
      */
-    function getAddr_s($arr, $separator = ',',$encoded=false) {
+    function getAddr_s($arr, $separator = ', ', $encoded=false, $unconditionally_quote=FALSE) {
         $s = '';
 
         if (is_array($arr)) {
             foreach($arr as $arg) {
-                if ($this->getAddr_s($arg, $separator, $encoded)) {
+                if ($this->getAddr_s($arg, $separator, $encoded, $unconditionally_quote)) {
                     $s .= $separator;
                 }
             }
@@ -872,9 +886,9 @@ class Rfc822Header {
                 foreach ($addr as $addr_o) {
                     if (is_object($addr_o)) {
                         if ($encoded) {
-                            $s .= $addr_o->getEncodedAddress() . $separator;
+                            $s .= $addr_o->getEncodedAddress($unconditionally_quote) . $separator;
                         } else {
-                            $s .= $addr_o->getAddress() . $separator;
+                            $s .= $addr_o->getAddress(TRUE, FALSE, $unconditionally_quote) . $separator;
                         }
                     }
                 }
@@ -882,9 +896,9 @@ class Rfc822Header {
             } else {
                 if (is_object($addr)) {
                     if ($encoded) {
-                        $s .= $addr->getEncodedAddress();
+                        $s .= $addr->getEncodedAddress($unconditionally_quote);
                     } else {
-                        $s .= $addr->getAddress();
+                        $s .= $addr->getAddress(TRUE, FALSE, $unconditionally_quote);
                     }
                 }
             }
@@ -958,6 +972,7 @@ class Rfc822Header {
             }
         } else {
             if (!is_array($this->cc)) $this->cc = array();
+            if (!is_array($this->to)) $this->to = array();
             $srch_addr = $this->parseAddress($address);
             $results = array();
             foreach ($this->to as $to) {