/**
* addressbook.php
*
- * Copyright (c) 1999-2002 The SquirrelMail Project Team
+ * Copyright (c) 1999-2003 The SquirrelMail Project Team
* Licensed under the GNU GPL. For full terms see the file COPYING.
*
* Manage personal address book.
/* SquirrelMail required files. */
require_once(SM_PATH . 'include/validate.php');
-require_once(SM_PATH . 'functions/array.php');
require_once(SM_PATH . 'functions/display_messages.php');
require_once(SM_PATH . 'functions/addressbook.php');
require_once(SM_PATH . 'functions/strings.php');
require_once(SM_PATH . 'functions/html.php');
+/* lets get the global vars we may need */
+$key = $_COOKIE['key'];
+
+$username = $_SESSION['username'];
+$onetimepad = $_SESSION['onetimepad'];
+$base_uri = $_SESSION['base_uri'];
+$delimiter = $_SESSION['delimiter'];
+
+/* From the address form */
+if ( isset($_POST['addaddr']) ) {
+ $addaddr = &$_POST['addaddr'];
+}
+if ( isset($_POST['editaddr']) ) {
+ $editaddr = &$_POST['editaddr'];
+}
+if ( isset($_POST['deladdr']) ) {
+ $deladdr = &$_POST['deladdr'];
+}
+$sel = &$_POST['sel'];
+
+if (isset($_POST['oldnick'])) {
+ $oldnick = $_POST['oldnick'];
+}
+if (isset($_POST['backend'])) {
+ $backend = $_POST['backend'];
+}
+if (isset($_POST['doedit'])) {
+ $doedit = $_POST['doedit'];
+}
+
/* Make an input field */
function adressbook_inp_field($label, $field, $name, $size, $values, $add) {
global $color;
$td_str = '<INPUT NAME="' . $name . '[' . $field . ']" SIZE="' . $size . '" VALUE="';
if (isset($values[$field])) {
- $td_str .= htmlspecialchars($values[$field]);
+ $td_str .= htmlspecialchars( strip_tags( $values[$field] ) );
}
$td_str .= '">' . $add . '';
return html_tag( 'tr' ,
/* Output form to add and modify address data */
function address_form($name, $submittext, $values = array()) {
global $color;
+
echo html_tag( 'table',
adressbook_inp_field(_("Nickname"), 'nickname', $name, 15, $values,
- '<SMALL>' . _("Must be unique") . '</SMALL>') .
+ ' <SMALL>' . _("Must be unique") . '</SMALL>') .
adressbook_inp_field(_("E-mail address"), 'email', $name, 45, $values, '') .
adressbook_inp_field(_("First name"), 'firstname', $name, 45, $values, '') .
adressbook_inp_field(_("Last name"), 'lastname', $name, 45, $values, '') .
, 'center', '', 'border="0" cellpadding="1" width="90%"') ."\n";
}
-
/* Open addressbook, with error messages on but without LDAP (the *
* second "true"). Don't need LDAP here anyway */
$abook = addressbook_init(true, true);
displayPageHeader($color, 'None');
-
$defdata = array();
$formerror = '';
$abortform = false;
$showaddrlist = true;
$defselected = array();
+$form_url = 'addressbook.php';
/* Handle user's actions */
-if($REQUEST_METHOD == 'POST') {
+if($_SERVER['REQUEST_METHOD'] == 'POST') {
/**************************************************
* Add new address *
**************************************************/
if (!empty($addaddr['nickname'])) {
-
+ foreach( $addaddr as $k => $adr ) {
+ $addaddr[$k] = strip_tags( $adr );
+ }
$r = $abook->add($addaddr, $abook->localbackend);
/* Handle error messages */
$showaddrlist = false;
$defdata = $addaddr;
}
-
} else {
/************************************************
$olddata = $abook->lookup($enick, $ebackend);
/* Display the "new address" form */
- echo '<FORM ACTION="' . $PHP_SELF . '" METHOD="POST">' .
+ echo '<FORM ACTION="' . $form_url . '" METHOD="POST">' .
"\n" .
html_tag( 'table',
html_tag( 'tr',
"\n". '<strong>' . _("Update address") . '</strong>' ."\n",
'center', $color[0] )
),
- 'center', '', 'width="100%" ' ) .
+ 'center', '', 'width="100%" ' );
address_form("editaddr", _("Update address"), $olddata);
echo '<INPUT TYPE=hidden NAME=oldnick VALUE="' .
htmlspecialchars($olddata["nickname"]) . "\">\n" .
'center', '', 'width="100%"' );
/* Display the "new address" form again */
- echo '<FORM ACTION="' . $PHP_SELF .
+ echo '<FORM ACTION="' . $form_url .
'" METHOD="POST">' . "\n" .
html_tag( 'table',
html_tag( 'tr',
/* List addresses */
if (count($alist) > 0) {
- echo '<FORM ACTION="' . $PHP_SELF . '" METHOD="POST">' . "\n";
+ echo '<FORM ACTION="' . $form_url . '" METHOD="POST">' . "\n";
while(list($undef,$row) = each($alist)) {
/* New table header for each backend */
/* Display the "new address" form */
echo '<a name="AddAddress"></a>' . "\n" .
- '<FORM ACTION="' . $PHP_SELF . '" NAME=f_add METHOD="POST">' . "\n" .
- html_tag( 'table',
+ '<FORM ACTION="' . $form_url . '" NAME=f_add METHOD="POST">' . "\n" .
+ html_tag( 'table',
html_tag( 'tr',
html_tag( 'td', "\n". '<strong>' . sprintf(_("Add to %s"), $abook->localbackendname) . '</strong>' . "\n",
'center', $color[0]