/**
* mime.php
*
- * Copyright (c) 1999-2005 The SquirrelMail Project Team
- * Licensed under the GNU GPL. For full terms see the file COPYING.
- *
* This contains the functions necessary to detect and decode MIME
* messages.
*
+ * @copyright © 1999-2005 The SquirrelMail Project Team
+ * @license http://opensource.org/licenses/gpl-license.php GNU Public License
* @version $Id$
* @package squirrelmail
*/
* @param string $ent_num (since 1.3.0) message part id
* @param integer $id (since 1.3.0) message id
* @param string $mailbox (since 1.3.0) imap folder name
- * @param boolean $clean (since 1.5.1 and 1.4.6) Do not output stuff that's irrelevant for the printable version.
+ * @param boolean $clean (since 1.5.1) Do not output stuff that's irrelevant for the printable version.
* @return string html formated message text
*/
function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $mailbox='INBOX', $clean=FALSE) {
* If we don't add html message between iframe tags,
* we must detect unsafe images and modify $has_unsafe_images.
*/
- $html_body = magicHTML($body, $id, $message, $mailbox);
+ $html_body = magicHTML($body, $id, $message, $mailbox);
+ // Convert character set in order to display html mails in different character set
+ $html_body = charset_decode($body_message->header->getParameter('charset'),$html_body,false,true);
// creating iframe url
$iframeurl=sqm_baseuri().'src/view_html.php?'
} else {
// old way of html rendering
$body = magicHTML($body, $id, $message, $mailbox);
+ /**
+ * convert character set. charset_decode does not remove html special chars
+ * applied by magicHTML functions and does not sanitize them second time if
+ * fourth argument is true.
+ */
+ $body = charset_decode($body_message->header->getParameter('charset'),$body,false,true);
}
} else {
translateText($body, $wrap_at,
return $sStringRem;
}
-
-/* This function decodes the body depending on the encoding type. */
+/**
+ * Decodes encoded message body
+ *
+ * This function decodes the body depending on the encoding type.
+ * Currently quoted-printable and base64 encodings are supported.
+ * decode_body hook was added to this function in 1.4.2/1.5.0
+ * @param string $body encoded message body
+ * @param string $encoding used encoding
+ * @return string decoded string
+ * @since 1.0
+ */
function decodeBody($body, $encoding) {
- global $show_html_default;
$body = str_replace("\r\n", "\n", $body);
$encoding = strtolower($encoding);
if (!empty($encoding_handler) && function_exists($encoding_handler)) {
$body = $encoding_handler('decode', $body);
- } else if ($encoding == 'quoted-printable' ||
+ } elseif ($encoding == 'quoted-printable' ||
$encoding == 'quoted_printable') {
+ /**
+ * quoted_printable_decode() function is broken in older
+ * php versions. Text with \r\n decoding was fixed only
+ * in php 4.3.0. Minimal code requirement 4.0.4 +
+ * str_replace("\r\n", "\n", $body); call.
+ */
$body = quoted_printable_decode($body);
-
- while (ereg("=\n", $body)) {
- $body = ereg_replace ("=\n", '', $body);
- }
-
- } else if ($encoding == 'base64') {
+ } elseif ($encoding == 'base64') {
$body = base64_decode($body);
}
* Encodes header
*
* Function uses XTRA_CODE _encodeheader function, if such function exists.
- *
- * mb_encode_mimeheader is used, if function is present, 50% or more bytes
- * are 8bit and multibyte character set is used.
*
- * Function uses Q encoding by default and encodes a string according to RFC
- * 1522 for use in headers if it contains 8-bit characters or anything that
+ * Function uses Q encoding by default and encodes a string according to RFC
+ * 1522 for use in headers if it contains 8-bit characters or anything that
* looks like it should be encoded.
*
+ * Function switches to B encoding and encodeHeaderBase64() function, if
+ * string is 8bit and multibyte character set supported by mbstring extension
+ * is used. It can cause E_USER_NOTICE errors, if interface is used with
+ * multibyte character set unsupported by mbstring extension.
+ *
* @param string $string header string, that has to be encoded
* @return string quoted-printable encoded string
+ * @todo make $mb_charsets system wide constant
*/
function encodeHeader ($string) {
global $default_charset, $languages, $squirrelmail_language;
}
// Use B encoding for multibyte charsets
- /*
- $mb_charsets = array('utf-8','big-5','gb2313','euc-kr');
- if (function_exists('mb_encode_mimeheader') &&
- in_array($default_charset,$mb_charsets) &&
- in_array($default_charset,sq_mb_list_encodings())) {
- return mb_encode_mimeheader($string,$default_charset,'B',"\r\n");
- }*/
+ $mb_charsets = array('utf-8','big5','gb2313','euc-kr');
+ if (in_array($default_charset,$mb_charsets) &&
+ in_array($default_charset,sq_mb_list_encodings()) &&
+ sq_is8bit($string)) {
+ return encodeHeaderBase64($string,$default_charset);
+ } elseif (in_array($default_charset,$mb_charsets) &&
+ sq_is8bit($string) &&
+ ! in_array($default_charset,sq_mb_list_encodings())) {
+ // Add E_USER_NOTICE error here (can cause 'Cannot add header information' warning in compose.php)
+ // trigger_error('encodeHeader: Multibyte character set unsupported by mbstring extension.',E_USER_NOTICE);
+ }
// Encode only if the string contains 8-bit characters or =?
$j = strlen($string);
return $string;
}
+/**
+ * Encodes string according to rfc2047 B encoding header formating rules
+ *
+ * It is recommended way to encode headers with character sets that store
+ * symbols in more than one byte.
+ *
+ * Function requires mbstring support. If required mbstring functions are missing,
+ * function returns false and sets E_USER_WARNING level error message.
+ *
+ * Minimal requirements - php 4.0.6 with mbstring extension. Please note,
+ * that mbstring functions will generate E_WARNING errors, if unsupported
+ * character set is used. mb_encode_mimeheader function provided by php
+ * mbstring extension is not used in order to get better control of header
+ * encoding.
+ *
+ * Used php code functions - function_exists(), trigger_error(), strlen()
+ * (is used with charset names and base64 strings). Used php mbstring
+ * functions - mb_strlen and mb_substr.
+ *
+ * Related documents: rfc 2045 (BASE64 encoding), rfc 2047 (mime header
+ * encoding), rfc 2822 (header folding)
+ *
+ * @param string $string header string that must be encoded
+ * @param string $charset character set. Must be supported by mbstring extension.
+ * Use sq_mb_list_encodings() to detect supported charsets.
+ * @return string string encoded according to rfc2047 B encoding formating rules
+ * @since 1.5.1
+ * @todo First header line can be wrapped to $iMaxLength - $HeaderFieldLength - 1
+ * @todo Do we want to control max length of header?
+ * @todo Do we want to control EOL (end-of-line) marker?
+ * @todo Do we want to translate error message?
+ */
+function encodeHeaderBase64($string,$charset) {
+ /**
+ * Check mbstring function requirements.
+ */
+ if (! function_exists('mb_strlen') ||
+ ! function_exists('mb_substr')) {
+ // set E_USER_WARNING
+ trigger_error('encodeHeaderBase64: Required mbstring functions are missing.',E_USER_WARNING);
+ // return false
+ return false;
+ }
+
+ // initial return array
+ $aRet = array();
+
+ /**
+ * header length = 75 symbols max (same as in encodeHeader)
+ * remove $charset length
+ * remove =? ? ?= (5 chars)
+ * remove 2 more chars (\r\n ?)
+ */
+ $iMaxLength = 75 - strlen($charset) - 7;
+
+ // set first character position
+ $iStartCharNum = 0;
+
+ // loop through all characters. count characters and not bytes.
+ for ($iCharNum=1; $iCharNum<=mb_strlen($string,$charset); $iCharNum++) {
+ // encode string from starting character to current character.
+ $encoded_string = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum,$charset));
+
+ // Check encoded string length
+ if(strlen($encoded_string)>$iMaxLength) {
+ // if string exceeds max length, reduce number of encoded characters and add encoded string part to array
+ $aRet[] = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum-1,$charset));
+
+ // set new starting character
+ $iStartCharNum = $iCharNum-1;
+
+ // encode last char (in case it is last character in string)
+ $encoded_string = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum,$charset));
+ } // if string is shorter than max length - add next character
+ }
+
+ // add last encoded string to array
+ $aRet[] = $encoded_string;
+
+ // set initial return string
+ $sRet = '';
+
+ // loop through encoded strings
+ foreach($aRet as $string) {
+ // TODO: Do we want to control EOL (end-of-line) marker
+ if ($sRet!='') $sRet.= " ";
+
+ // add header tags and encoded string to return string
+ $sRet.= '=?'.$charset.'?B?'.$string.'?=';
+ }
+
+ return $sRet;
+}
+
/* This function trys to locate the entity_id of a specific mime element */
function find_ent_id($id, $message) {
for ($i = 0, $ret = ''; $ret == '' && $i < count($message->entities); $i++) {
// "url(\\1$secremoveimg\\2)", $content);
// remove NUL
$content = str_replace("\0", "", $content);
+
// NB I insert NUL characters to keep to avoid an infinite loop. They are removed after the loop.
while (preg_match("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si", $content, $matches)) {
$sProto = strtolower($matches[1]);
switch ($sProto) {
- /**
- * Fix url('https*://.*) declarations but only if $view_unsafe_images
- * is false.
- */
- case 'https':
- case 'http':
- if (!$view_unsafe_images){
- $sExpr = "/url\s*\(\s*([\'\"])\s*$sProto*:.*?([\'\"])\s*\)/si";
- $content = preg_replace($sExpr, "u\0r\0l(\\1$secremoveimg\\2)", $content);
- }
- break;
- /**
- * Fix urls that refer to cid:
- */
- case 'cid':
- $cidurl = 'cid:'. $matches[2];
- $httpurl = sq_cid2http($message, $id, $cidurl, $mailbox);
- $content = preg_replace("|url\s*\(\s*$cidurl\s*\)|si",
- "u\0r\0l($httpurl)", $content);
- break;
- default:
/**
- * replace url with protocol other then the white list
- * http,https and cid by an empty string.
+ * Fix url('https*://.*) declarations but only if $view_unsafe_images
+ * is false.
*/
- $content = preg_replace("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si",
- "", $content);
- break;
+ case 'https':
+ case 'http':
+ if (!$view_unsafe_images){
+
+ $sExpr = "/url\s*\(\s*[\'\"]?\s*$sProto*:.*[\'\"]?\s*\)/si";
+ $content = preg_replace($sExpr, "u\0r\0l(\\1$secremoveimg\\2)", $content);
+
+ } else {
+ $content = preg_replace('/url/i',"u\0r\0l",$content);
+ }
+ break;
+ /**
+ * Fix urls that refer to cid:
+ */
+ case 'cid':
+ $cidurl = 'cid:'. $matches[2];
+ $httpurl = sq_cid2http($message, $id, $cidurl, $mailbox);
+ // escape parentheses that can modify the regular expression
+ $cidurl = str_replace(array('(',')'),array('\\(','\\)'),$cidurl);
+ $content = preg_replace("|url\s*\(\s*$cidurl\s*\)|si",
+ "u\0r\0l($httpurl)", $content);
+ break;
+ default:
+ /**
+ * replace url with protocol other then the white list
+ * http,https and cid by an empty string.
+ */
+ $content = preg_replace("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si",
+ "", $content);
+ break;
}
- break;
}
// remove NUL
$content = str_replace("\0", "", $content);
-
/**
* Remove any backslashes, entities, and extraneous whitespace.
*/
"\\1$secremoveimg\\2",
"\\1$secremoveimg\\2",
"\\1$secremoveimg\\2",
- "\\1$secremoveimg\\2"
)
),
"/^href|action/i" =>
"/^([\'\"])\s*about\s*:.*([\'\"])/si"
),
Array(
- "\\1#\\1",
"\\1#\\1",
"\\1#\\1",
"\\1#\\1"
"url(\\1#\\1)",
"url(\\1#\\1)",
"url(\\1#\\1)",
- "url(\\1#\\1)",
- "url(\\1#\\1)",
"\\1:url(\\2#\\3)"
)
)
array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[1],
"\\1$secremoveimg\\1");
array_push($bad_attvals{'/.*/'}{'/^style/i'}[0],
- '/url\(([\'\"])\s*https*:.*([\'\"])\)/si');
+ '/url\([\'\"]?https?:[^\)]*[\'\"]?\)/si');
array_push($bad_attvals{'/.*/'}{'/^style/i'}[1],
"url(\\1$secremoveimg\\1)");
}
projects / squirrelmail.git / blobdiff