/**
* addressbook.php
*
- * Copyright (c) 1999-2002 The SquirrelMail Project Team
+ * Copyright (c) 1999-2003 The SquirrelMail Project Team
* Licensed under the GNU GPL. For full terms see the file COPYING.
*
* Manage personal address book.
/* SquirrelMail required files. */
require_once(SM_PATH . 'include/validate.php');
-require_once(SM_PATH . 'functions/array.php');
+require_once(SM_PATH . 'functions/global.php');
require_once(SM_PATH . 'functions/display_messages.php');
require_once(SM_PATH . 'functions/addressbook.php');
require_once(SM_PATH . 'functions/strings.php');
require_once(SM_PATH . 'functions/html.php');
+/* lets get the global vars we may need */
+sqgetGlobalVar('key', $key, SQ_COOKIE);
+
+sqgetGlobalVar('username', $username, SQ_SESSION);
+sqgetGlobalVar('onetimepad',$onetimepad, SQ_SESSION);
+sqgetGlobalVar('base_uri', $base_uri, SQ_SESSION);
+sqgetGlobalVar('delimiter', $delimiter, SQ_SESSION);
+
+/* From the address form */
+sqgetGlobalVar('addaddr', $addaddr, SQ_POST);
+sqgetGlobalVar('editaddr', $editaddr, SQ_POST);
+sqgetGlobalVar('deladdr', $deladdr, SQ_POST);
+sqgetGlobalVar('sel', $sel, SQ_POST);
+sqgetGlobalVar('oldnick', $oldnick, SQ_POST);
+sqgetGlobalVar('backend', $backend, SQ_POST);
+sqgetGlobalVar('doedit', $doedit, SQ_POST);
+
/* Make an input field */
function adressbook_inp_field($label, $field, $name, $size, $values, $add) {
global $color;
$td_str = '<INPUT NAME="' . $name . '[' . $field . ']" SIZE="' . $size . '" VALUE="';
if (isset($values[$field])) {
- $td_str .= htmlspecialchars($values[$field]);
+ $td_str .= htmlspecialchars( strip_tags( $values[$field] ) );
}
$td_str .= '">' . $add . '';
return html_tag( 'tr' ,
/* Output form to add and modify address data */
function address_form($name, $submittext, $values = array()) {
global $color;
+
echo html_tag( 'table',
adressbook_inp_field(_("Nickname"), 'nickname', $name, 15, $values,
- '<SMALL>' . _("Must be unique") . '</SMALL>') .
+ ' <SMALL>' . _("Must be unique") . '</SMALL>') .
adressbook_inp_field(_("E-mail address"), 'email', $name, 45, $values, '') .
adressbook_inp_field(_("First name"), 'firstname', $name, 45, $values, '') .
adressbook_inp_field(_("Last name"), 'lastname', $name, 45, $values, '') .
, 'center', '', 'border="0" cellpadding="1" width="90%"') ."\n";
}
-
/* Open addressbook, with error messages on but without LDAP (the *
* second "true"). Don't need LDAP here anyway */
$abook = addressbook_init(true, true);
displayPageHeader($color, 'None');
-
$defdata = array();
$formerror = '';
$abortform = false;
/* Handle user's actions */
-if($REQUEST_METHOD == 'POST') {
+if(sqgetGlobalVar('REQUEST_METHOD', $req_method, SQ_SERVER) && $req_method == 'POST') {
/**************************************************
* Add new address *
**************************************************/
if (!empty($addaddr['nickname'])) {
-
+ foreach( $addaddr as $k => $adr ) {
+ $addaddr[$k] = strip_tags( $adr );
+ }
$r = $abook->add($addaddr, $abook->localbackend);
/* Handle error messages */
$showaddrlist = false;
$defdata = $addaddr;
}
-
} else {
/************************************************
/* Display the "new address" form */
echo '<a name="AddAddress"></a>' . "\n" .
'<FORM ACTION="' . $form_url . '" NAME=f_add METHOD="POST">' . "\n" .
- html_tag( 'table',
+ html_tag( 'table',
html_tag( 'tr',
html_tag( 'td', "\n". '<strong>' . sprintf(_("Add to %s"), $abook->localbackendname) . '</strong>' . "\n",
'center', $color[0]