Allow more liberal reuse of tokens to avoid cross-frame conflicts

[squirrelmail.git] / functions / imap_general.php

diff --git a/functions/imap_general.php b/functions/imap_general.php
index 3bf9885c4f959ca9ecbf6eca44eb7bffaf2cf822..227bce28627f0c22783fb635f0a1cfa5678d8453 100755 (executable)
--- a/functions/imap_general.php
+++ b/functions/imap_general.php
@@ -5,7 +5,7 @@
  *
  * This implements all functions that do general IMAP functions.
  *
- * @copyright © 1999-2007 The SquirrelMail Project Team
+ * @copyright 1999-2012 The SquirrelMail Project Team
  * @license http://opensource.org/licenses/gpl-license.php GNU Public License
  * @version $Id$
  * @package squirrelmail
@@ -109,10 +109,26 @@ function sqimap_run_command ($imap_stream, $query, $handle_errors, &$response,
         $message  = $message[$tag];
 
         if (!empty($read[$tag])) {
+            /* sqimap_read_data should be called for one response
+               but since it just calls sqimap_retrieve_imap_response
+               which handles multiple responses we need to check for
+               that and merge the $read[$tag] array IF they are
+               separated and IF it was a FETCH response. */
+
+            if (isset($read[$tag][1]) && is_array($read[$tag][1]) && isset($read[$tag][1][0])
+                && preg_match('/^\* \d+ FETCH/', $read[$tag][1][0])) {
+                $result = array();
+                foreach($read[$tag] as $index => $value) {
+                    $result = array_merge($result, $read[$tag]["$index"]);
+                }
+                return $result;
+            }
+
             return $read[$tag][0];
         } else {
             return $read[$tag];
         }
+//FIXME: obey $handle_errors below!
     } else {
         global $squirrelmail_language, $color;
         set_up_language($squirrelmail_language);
@@ -333,7 +349,7 @@ function sqimap_read_data_list($imap_stream, $tag, $handle_errors,
           'sqimap_run_command or sqimap_run_command_list instead<br /><br />'.
           'The following query was issued:<br />'.
 //FIXME: NO HTML IN CORE!
-           htmlspecialchars($query) . '<br />' . "</font><br />\n";
+           sm_encode_html_special_chars($query) . '<br />' . "</font><br />\n";
     error_box($string);
     $oTemplate->display('footer.tpl');
     exit;
@@ -360,11 +376,11 @@ function sqimap_error_box($title, $query = '', $message_title = '', $message = '
     $cmd= strtolower($cmd[0]);
 
     if ($query != '' &&  $cmd != 'login')
-        $string .= _("Query:") . ' ' . htmlspecialchars($query) . '<br />';
+        $string .= _("Query:") . ' ' . sm_encode_html_special_chars($query) . '<br />';
     if ($message_title != '')
         $string .= $message_title;
     if ($message != '')
-        $string .= htmlspecialchars($message);
+        $string .= sm_encode_html_special_chars($message);
 //FIXME: NO HTML IN CORE!
     $string .= "</font><br />\n";
     if ($link != '')
@@ -925,7 +941,7 @@ function sqimap_login ($username, $password, $imap_server_address, $imap_port, $
 //FIXME: UUURG... We don't want HTML in error messages, should also do html sanitizing of error messages elsewhere; should't assume output is destined for an HTML browser here
             if ($response != 'NO') {
                 /* "BAD" and anything else gets reported here. */
-                $message = htmlspecialchars($message);
+                $message = sm_encode_html_special_chars($message);
                 set_up_language($squirrelmail_language, true);
                 if ($response == 'BAD') {
                     if ($hide == 3) return sprintf(_("Bad request: %s"), $message);
@@ -937,7 +953,7 @@ function sqimap_login ($username, $password, $imap_server_address, $imap_port, $
                 if (isset($read) && is_array($read)) {
                     $string .= '<br />' . _("Read data:") . "<br />\n";
                     foreach ($read as $line) {
-                        $string .= htmlspecialchars($line) . "<br />\n";
+                        $string .= sm_encode_html_special_chars($line) . "<br />\n";
                     }
                 }
                 error_box($string);
@@ -1063,7 +1079,7 @@ function sqimap_get_delimiter ($imap_stream = false) {
 
     /* Do some caching here */
     if (!$sqimap_delimiter) {
-        if (sqimap_capability($imap_stream, 'NAMESPACE')) {
+        if (sqimap_capability($imap_stream, 'NAMESPACE')
             /*
              * According to something that I can't find, this is supposed to work on all systems
              * OS: This won't work in Courier IMAP.
@@ -1073,22 +1089,21 @@ function sqimap_get_delimiter ($imap_stream = false) {
              *
              * TODO: remove this in favour of the information from sqimap_get_namespace()
              */
-            $read = sqimap_run_command($imap_stream, 'NAMESPACE', true, $a, $b);
-            if (eregi('\\* NAMESPACE +(\\( *\\(.+\\) *\\)|NIL) +(\\( *\\(.+\\) *\\)|NIL) +(\\( *\\(.+\\) *\\)|NIL)', $read[0], $data)) {
-                if (eregi('^\\( *\\((.*)\\) *\\)', $data[1], $data2)) {
-                    $pn = $data2[1];
-                }
-                $pna = explode(')(', $pn);
-                while (list($k, $v) = each($pna)) {
-                    $lst = explode('"', $v);
-                    if (isset($lst[3])) {
-                        $pn[$lst[1]] = $lst[3];
-                    } else {
-                        $pn[$lst[1]] = '';
-                    }
+         && ($read = sqimap_run_command($imap_stream, 'NAMESPACE', true, $a, $b))
+         && preg_match('/\* NAMESPACE +(\( *\(.+\) *\)|NIL) +(\( *\(.+\) *\)|NIL) +(\( *\(.+\) *\)|NIL)/i', $read[0], $data)
+         && preg_match('/^\( *\((.*)\) *\)/', $data[1], $data2)) {
+            $pn = $data2[1];
+            $pna = explode(')(', $pn);
+            $delnew = array();
+            while (list($k, $v) = each($pna)) {
+                $lst = explode('"', $v);
+                if (isset($lst[3])) {
+                    $delnew[$lst[1]] = $lst[3];
+                } else {
+                    $delnew[$lst[1]] = '';
                 }
             }
-            $sqimap_delimiter = $pn[0];
+            $sqimap_delimiter = array_shift($delnew);
         } else {
             fputs ($imap_stream, ". LIST \"INBOX\" \"\"\r\n");
             $read = sqimap_read_data($imap_stream, '.', true, $a, $b);
@@ -1137,7 +1152,7 @@ function sqimap_parse_namespace(&$input) {
     $ns_strings = array(1=>'personal', 2=>'users', 3=>'shared');
     $namespace = array();
 
-    if(ereg('NAMESPACE (\(\(.*\)\)|NIL) (\(\(.*\)\)|NIL) (\(\(.*\)\)|NIL)', $input, $regs) !== false) {
+    if (preg_match('/NAMESPACE (\(\(.*\)\)|NIL) (\(\(.*\)\)|NIL) (\(\(.*\)\)|NIL)/', $input, $regs)) {
         for($i=1; $i<=3; $i++) {
             if($regs[$i] == 'NIL') {
                 $namespace[$ns_strings[$i]] = array();
@@ -1173,7 +1188,7 @@ function sqimap_parse_namespace(&$input) {
  */
 function sqimap_encode_mailbox_name($what)
 {
-    if (ereg("[\"\\\r\n]", $what))
+    if (preg_match('/["\\\r\n]/', $what))
         return '{' . strlen($what) . "}\r\n" . $what;        /* 4.3 literal form */
     return '"' . $what . '"';        /* 4.3 quoted string form */
 }
@@ -1366,7 +1381,8 @@ function sqimap_append_checkresponse($response, $sMailbox, $sid='', $query='') {
                 if ($sRsp == 'NO' || $sRsp == 'BAD') {
                     // for the moment disabled. Enable after 1.5.1 release.
                     // Notices could give valueable information about the mailbox
-                    // sqm_trigger_imap_error('SQM_IMAP_APPEND_NOTICE',$imapquery,$sRsp,$sMsg);
+                    // Update: seems this was forgotten, but now it is finally enabled
+                    sqm_trigger_imap_error('SQM_IMAP_APPEND_NOTICE',$imapquery,$sRsp,$sMsg);
                 }
                 $bDone = false;
             case $imapsid:
@@ -1434,6 +1450,7 @@ function sqimap_get_user_server ($imap_server, $username) {
  * @since 1.3.0
  */
 function map_yp_alias($username) {
-   $yp = `ypmatch $username aliases`;
+   $safe_username = escapeshellarg($username);
+   $yp = `ypmatch $safe_username aliases`;
    return chop(substr($yp, strlen($username)+1));
 }