Happy New Year

[squirrelmail.git] / plugins / newmail / newmail_opt.php

diff --git a/plugins/newmail/newmail_opt.php b/plugins/newmail/newmail_opt.php
index eacb66f14fb034f7315858b409ca5937cbd2614a..54e2952b6b80aa7313e09dbd30e0748e7a7ef31b 100644 (file)
--- a/plugins/newmail/newmail_opt.php
+++ b/plugins/newmail/newmail_opt.php
@@ -5,7 +5,7 @@
  *
  * Displays all options relating to new mail sounds
  *
- * @copyright 1999-2009 The SquirrelMail Project Team
+ * @copyright 1999-2020 The SquirrelMail Project Team
  * @license http://opensource.org/licenses/gpl-license.php GNU Public License
  * @version $Id$
  * @package plugins
@@ -18,7 +18,7 @@
  */
 require('../../include/init.php');
 
-/** 
+/**
  * Make sure plugin is activated!
  */
 global $plugins;
@@ -41,7 +41,7 @@ echo html_tag( 'table', '', 'center', $color[0], 'width="95%" cellpadding="1" ce
                     html_tag( 'tr' ) . "\n" .
                         html_tag( 'td', '', 'left', $color[4] ) . "<br />\n";
 
-echo html_tag( 'p',_("Based on the Folder Preferences option &quot;Enable Unread Message Notification&quot;, you can be notified when new messages arrive in your account.")) . "\n" .
+echo html_tag( 'p', sprintf(_("Based on the Folder Preferences option %s, you can be notified when new messages arrive in your account."), '&quot;' . _("Enable Unread Message Notification") . '&quot;')) . "\n" .
      html_tag( 'p',
         sprintf(_("Selecting the %s option will enable the showing of a popup window when unseen mail is in one of your folders (requires JavaScript)."), '&quot;'._("Show popup window on new mail").'&quot;')
      ) . "\n" .
@@ -65,6 +65,7 @@ echo '</td></tr>' .
             html_tag( 'td', '', 'center', $color[4] ) . "\n" . '<hr style="width: 25%; height: 1px;" />' . "\n";
 
 echo '<form action="'.sqm_baseuri().'src/options.php" method="post" enctype="multipart/form-data">' . "\n" .
+        '<input type="hidden" name="smtoken" value="' . sm_generate_security_token() . '">' . "\n" .
         html_tag( 'table', '', '', '', 'width="100%" cellpadding="5" cellspacing="0" border="0"' ) . "\n";
 
 /* newmail_unseen_notify */
@@ -145,18 +146,20 @@ if ($newmail_allowsound) {
     echo '>' . _("(none)") . '</option>' .  "\n";
     // Iterate sound files for options
     $d = dir(SM_PATH . 'plugins/newmail/sounds');
-    while($entry=$d->read()) {
-        // $fname = get_location () . '/sounds/' . $entry;
-        if ($entry != '..' && $entry != '.' && $entry != 'CVS' && $entry != 'index.php') {
-            echo '<option ';
-            if ($entry == $newmail_media) {
-                echo 'selected="selected" ';
+    if ($d) {
+        while($entry=$d->read()) {
+            // $fname = get_location () . '/sounds/' . $entry;
+            if ($entry != '..' && $entry != '.' && $entry != 'CVS' && $entry != 'index.php') {
+                echo '<option ';
+                if ($entry == $newmail_media) {
+                    echo 'selected="selected" ';
+                }
+                echo 'value="' . sm_encode_html_special_chars($entry) . '">' .
+                    sm_encode_html_special_chars($entry) . "</option>\n";
             }
-            echo 'value="' . htmlspecialchars($entry) . '">' .
-                htmlspecialchars($entry) . "</option>\n";
         }
+        $d->close();
     }
-    $d->close();
     // display media selection
     foreach($newmail_mmedia as $newmail_mm_name => $newmail_mm_data) {
         echo '<option ';
@@ -164,7 +167,7 @@ if ($newmail_allowsound) {
             echo 'selected="selected" ';
         }
         echo 'value="mmedia_' . $newmail_mm_name . '">'
-            .htmlspecialchars($newmail_mm_name) . "</option>\n";
+            .sm_encode_html_special_chars($newmail_mm_name) . "</option>\n";
     }
 
     if($newmail_uploadsounds) {
@@ -204,9 +207,9 @@ if ($newmail_allowsound) {
         // display currently uploaded file information
         echo  html_tag('tr')
             . html_tag('td',_("Uploaded Media File:"),'right','','style="white-space: nowrap;"')
-            . html_tag('td',($newmail_userfile_name!='' ? htmlspecialchars($newmail_userfile_name) : _("unavailable")))
+            . html_tag('td',($newmail_userfile_name!='' ? sm_encode_html_special_chars($newmail_userfile_name) : _("unavailable")))
             ."</tr>\n";
-    
+
         if ($newmail_userfile_name!='') {
             echo '<tr>'
                 .'<td colspan="2" align="center">'
@@ -217,8 +220,8 @@ if ($newmail_allowsound) {
     echo html_tag( 'tr', "\n" .
                 html_tag( 'td', _("Current File:"), 'right', '', 'style="white-space: nowrap;"' ) .
                     html_tag( 'td', '<input type="hidden" value="' .
-                        htmlspecialchars($newmail_media) . '" name="media_default" />' .
-                        htmlspecialchars($media_output) . '', 'left' )
+                        sm_encode_html_special_chars($newmail_media) . '" name="media_default" />' .
+                        sm_encode_html_special_chars($media_output) . '', 'left' )
              ) . "\n";
 }
 echo html_tag( 'tr', "\n" .
@@ -226,6 +229,7 @@ echo html_tag( 'tr', "\n" .
         html_tag( 'td',
             '<input type="hidden" name="optmode" value="submit" />' .
             '<input type="hidden" name="optpage" value="newmail" />' .
+               '<input type="hidden" name="smtoken" value="' . sm_generate_security_token() . '" />' .
             '<input type="submit" value="' . _("Submit") . '" name="submit_newmail" />',
         'left' )
      ) . "\n";