* modifications in order to use ent_id=0 for downloading full messages

[squirrelmail.git] / src / addressbook.php

diff --git a/src/addressbook.php b/src/addressbook.php
index 5742cdb28b8b032a0d9555aa57adc2aecaf0f4ef..0cd1f24a075c9364da2831e6d099f239c2a3a079 100644 (file)
--- a/src/addressbook.php
+++ b/src/addressbook.php
@@ -3,7 +3,7 @@
 /**
  * addressbook.php
  *
- * Copyright (c) 1999-2002 The SquirrelMail Project Team
+ * Copyright (c) 1999-2003 The SquirrelMail Project Team
  * Licensed under the GNU GPL. For full terms see the file COPYING.
  *
  * Manage personal address book.
@@ -16,18 +16,47 @@ define('SM_PATH','../');
 
 /* SquirrelMail required files. */
 require_once(SM_PATH . 'include/validate.php');
-require_once(SM_PATH . 'functions/array.php');
 require_once(SM_PATH . 'functions/display_messages.php');
 require_once(SM_PATH . 'functions/addressbook.php');
 require_once(SM_PATH . 'functions/strings.php');
 require_once(SM_PATH . 'functions/html.php');
 
+/* lets get the global vars we may need */
+$key  = $_COOKIE['key'];
+
+$username = $_SESSION['username'];
+$onetimepad = $_SESSION['onetimepad'];
+$base_uri = $_SESSION['base_uri'];
+$delimiter = $_SESSION['delimiter'];
+
+/* From the address form */
+if ( isset($_POST['addaddr']) ) {
+    $addaddr = &$_POST['addaddr'];
+}
+if ( isset($_POST['editaddr']) ) {
+    $editaddr = &$_POST['editaddr'];
+}
+if ( isset($_POST['deladdr']) ) {
+    $deladdr = &$_POST['deladdr'];
+}
+$sel = &$_POST['sel'];
+
+if (isset($_POST['oldnick'])) {
+    $oldnick = $_POST['oldnick'];
+}
+if (isset($_POST['backend'])) {
+    $backend = $_POST['backend'];
+}
+if (isset($_POST['doedit'])) {
+    $doedit = $_POST['doedit'];
+}
+
 /* Make an input field */
 function adressbook_inp_field($label, $field, $name, $size, $values, $add) {
     global $color;
     $td_str = '<INPUT NAME="' . $name . '[' . $field . ']" SIZE="' . $size . '" VALUE="';
     if (isset($values[$field])) {
-        $td_str .= htmlspecialchars($values[$field]);
+        $td_str .= htmlspecialchars( strip_tags( $values[$field] ) );
     }
     $td_str .= '">' . $add . '';
     return html_tag( 'tr' ,
@@ -40,9 +69,10 @@ function adressbook_inp_field($label, $field, $name, $size, $values, $add) {
 /* Output form to add and modify address data */
 function address_form($name, $submittext, $values = array()) {
     global $color;
+    
     echo html_tag( 'table',
                        adressbook_inp_field(_("Nickname"),     'nickname', $name, 15, $values,
-                           '<SMALL>' . _("Must be unique") . '</SMALL>') .
+                           ' <SMALL>' . _("Must be unique") . '</SMALL>') .
                        adressbook_inp_field(_("E-mail address"),  'email', $name, 45, $values, '') .
                        adressbook_inp_field(_("First name"),  'firstname', $name, 45, $values, '') .
                        adressbook_inp_field(_("Last name"),    'lastname', $name, 45, $values, '') .
@@ -56,7 +86,6 @@ function address_form($name, $submittext, $values = array()) {
     , 'center', '', 'border="0" cellpadding="1" width="90%"') ."\n";
 }
 
-
 /* Open addressbook, with error messages on but without LDAP (the *
  * second "true"). Don't need LDAP here anyway                    */
 $abook = addressbook_init(true, true);
@@ -69,7 +98,6 @@ if($abook->localbackend == 0) {
 
 displayPageHeader($color, 'None');
 
-
 $defdata   = array();
 $formerror = '';
 $abortform = false;
@@ -79,13 +107,15 @@ $form_url = 'addressbook.php';
 
 
 /* Handle user's actions */
-if($REQUEST_METHOD == 'POST') {
+if($_SERVER['REQUEST_METHOD'] == 'POST') {
 
     /**************************************************
      * Add new address                                *
      **************************************************/
     if (!empty($addaddr['nickname'])) {
-
+        foreach( $addaddr as $k => $adr ) {
+            $addaddr[$k] = strip_tags( $adr );
+        }
         $r = $abook->add($addaddr, $abook->localbackend);
 
         /* Handle error messages */
@@ -98,7 +128,6 @@ if($REQUEST_METHOD == 'POST') {
             $showaddrlist = false;
             $defdata = $addaddr;
         }
-
     } else {
 
         /************************************************
@@ -369,7 +398,7 @@ if ($showaddrlist) {
 /* Display the "new address" form */
 echo '<a name="AddAddress"></a>' . "\n" .
     '<FORM ACTION="' . $form_url . '" NAME=f_add METHOD="POST">' . "\n" .
-    html_tag( 'table',
+    html_tag( 'table',  
         html_tag( 'tr',
             html_tag( 'td', "\n". '<strong>' . sprintf(_("Add to %s"), $abook->localbackendname) . '</strong>' . "\n",
                 'center', $color[0]