5) XSS in addressbook (different):

[squirrelmail.git] / src / addressbook.php

diff --git a/src/addressbook.php b/src/addressbook.php
index 9f8e039e6da044b11671ad102b4e8bb96bef1813..91f833924493f525f5866bff4e9ca9875aa1b325 100644 (file)
--- a/src/addressbook.php
+++ b/src/addressbook.php
@@ -11,19 +11,23 @@
  * $Id$
  */
 
-require_once('../src/validate.php');
-require_once('../functions/array.php');
-require_once('../functions/display_messages.php');
-require_once('../functions/addressbook.php');
-require_once('../functions/strings.php');
-require_once('../functions/html.php');
+/* Path for SquirrelMail required files. */
+define('SM_PATH','../');
+
+/* SquirrelMail required files. */
+require_once(SM_PATH . 'include/validate.php');
+require_once(SM_PATH . 'functions/array.php');
+require_once(SM_PATH . 'functions/display_messages.php');
+require_once(SM_PATH . 'functions/addressbook.php');
+require_once(SM_PATH . 'functions/strings.php');
+require_once(SM_PATH . 'functions/html.php');
 
 /* Make an input field */
 function adressbook_inp_field($label, $field, $name, $size, $values, $add) {
     global $color;
     $td_str = '<INPUT NAME="' . $name . '[' . $field . ']" SIZE="' . $size . '" VALUE="';
     if (isset($values[$field])) {
-        $td_str .= htmlspecialchars($values[$field]);
+        $td_str .= htmlspecialchars( strip_tags( $values[$field] ) );
     }
     $td_str .= '">' . $add . '';
     return html_tag( 'tr' ,
@@ -36,9 +40,10 @@ function adressbook_inp_field($label, $field, $name, $size, $values, $add) {
 /* Output form to add and modify address data */
 function address_form($name, $submittext, $values = array()) {
     global $color;
+    
     echo html_tag( 'table',
                        adressbook_inp_field(_("Nickname"),     'nickname', $name, 15, $values,
-                           '<SMALL>' . _("Must be unique") . '</SMALL>') .
+                           ' <SMALL>' . _("Must be unique") . '</SMALL>') .
                        adressbook_inp_field(_("E-mail address"),  'email', $name, 45, $values, '') .
                        adressbook_inp_field(_("First name"),  'firstname', $name, 45, $values, '') .
                        adressbook_inp_field(_("Last name"),    'lastname', $name, 45, $values, '') .
@@ -49,10 +54,9 @@ function address_form($name, $submittext, $values = array()) {
                                        $submittext . '">',
                                    'center', $color[4], 'colspan="2"')
                        )
-    , 'center', '', 'border="0" cellpadding="1" cols="2" width="90%"') ."\n";
+    , 'center', '', 'border="0" cellpadding="1" width="90%"') ."\n";
 }
 
-
 /* Open addressbook, with error messages on but without LDAP (the *
  * second "true"). Don't need LDAP here anyway                    */
 $abook = addressbook_init(true, true);
@@ -65,12 +69,12 @@ if($abook->localbackend == 0) {
 
 displayPageHeader($color, 'None');
 
-
 $defdata   = array();
 $formerror = '';
 $abortform = false;
 $showaddrlist = true;
 $defselected  = array();
+$form_url = 'addressbook.php';
 
 
 /* Handle user's actions */
@@ -80,7 +84,9 @@ if($REQUEST_METHOD == 'POST') {
      * Add new address                                *
      **************************************************/
     if (!empty($addaddr['nickname'])) {
-
+        foreach( $addaddr as $k => $adr ) {
+            $addaddr[$k] = strip_tags( $adr );
+        }
         $r = $abook->add($addaddr, $abook->localbackend);
 
         /* Handle error messages */
@@ -93,7 +99,6 @@ if($REQUEST_METHOD == 'POST') {
             $showaddrlist = false;
             $defdata = $addaddr;
         }
-
     } else {
 
         /************************************************
@@ -163,7 +168,7 @@ if($REQUEST_METHOD == 'POST') {
                         $olddata = $abook->lookup($enick, $ebackend);
 
                         /* Display the "new address" form */
-                        echo '<FORM ACTION="' . $PHP_SELF . '" METHOD="POST">' .
+                        echo '<FORM ACTION="' . $form_url . '" METHOD="POST">' .
                              "\n" .
                              html_tag( 'table',
                                 html_tag( 'tr',
@@ -171,7 +176,7 @@ if($REQUEST_METHOD == 'POST') {
                                       "\n". '<strong>' . _("Update address") . '</strong>' ."\n",
                                       'center', $color[0] )
                                    ),
-                             'center', '', 'width="100%" cols="1"' ) .
+                             'center', '', 'width="100%" ' );
                         address_form("editaddr", _("Update address"), $olddata);
                         echo '<INPUT TYPE=hidden NAME=oldnick VALUE="' . 
                              htmlspecialchars($olddata["nickname"]) . "\">\n" .
@@ -197,10 +202,10 @@ if($REQUEST_METHOD == 'POST') {
                                       '">' . _("ERROR") . ': ' . $abook->error . '</font></strong>' ."\n",
                                       'center' )
                                    ),
-                             'center', '', 'width="100%" cols="1"' );
+                             'center', '', 'width="100%"' );
 
                             /* Display the "new address" form again */
-                            echo '<FORM ACTION="' . $PHP_SELF .
+                            echo '<FORM ACTION="' . $form_url .
                                  '" METHOD="POST">' . "\n" .
                                  html_tag( 'table',
                                      html_tag( 'tr',
@@ -208,7 +213,7 @@ if($REQUEST_METHOD == 'POST') {
                                                     "\n". '<br><strong>' . _("Update address") . '</strong>' ."\n",
                                          'center', $color[0] )
                                      ),
-                                 'center', '', 'width="100%" cols="1"' ) .
+                                 'center', '', 'width="100%"' ) .
                             address_form("editaddr", _("Update address"), $newdata);
                             echo '<INPUT TYPE=hidden NAME=oldnick VALUE="' .
                                  htmlspecialchars($oldnick) . "\">\n" .
@@ -251,7 +256,7 @@ if (!empty($formerror)) {
                    '">' . _("ERROR") . ': ' . $formerror . '</font></strong>' ."\n",
             'center' )
         ),
-    'center', '', 'width="100%" cols="1"' );
+    'center', '', 'width="100%"' );
 }
 
 
@@ -272,7 +277,7 @@ if ($showaddrlist) {
 
     /* List addresses */
     if (count($alist) > 0) {
-        echo '<FORM ACTION="' . $PHP_SELF . '" METHOD="POST">' . "\n";
+        echo '<FORM ACTION="' . $form_url . '" METHOD="POST">' . "\n";
         while(list($undef,$row) = each($alist)) {
     
             /* New table header for each backend */
@@ -297,8 +302,8 @@ if ($showaddrlist) {
                                 html_tag( 'tr',
                                     html_tag( 'td', "\n" . '<strong>' . $row['source'] . '</strong>' . "\n", 'center', $color[0] )
                                 ) ,
-                        'center', '', 'width="95%" cols="1"' ) ."\n"
-                . html_tag( 'table', '', 'center', '', 'cols="5" border="0" cellpadding="1" cellspacing="0" width="90%"' ) .
+                        'center', '', 'width="95%"' ) ."\n"
+                . html_tag( 'table', '', 'center', '', 'border="0" cellpadding="1" cellspacing="0" width="90%"' ) .
                       html_tag( 'tr', "\n" .
                           html_tag( 'th', '&nbsp;', 'left', '', 'width="1%"' ) .
                           html_tag( 'th', _("Nickname"), 'left', '', 'width="1%"' ) .
@@ -363,14 +368,14 @@ if ($showaddrlist) {
 
 /* Display the "new address" form */
 echo '<a name="AddAddress"></a>' . "\n" .
-    '<FORM ACTION="' . $PHP_SELF . '" NAME=f_add METHOD="POST">' . "\n" .
-    html_tag( 'table',
+    '<FORM ACTION="' . $form_url . '" NAME=f_add METHOD="POST">' . "\n" .
+    html_tag( 'table',  
         html_tag( 'tr',
             html_tag( 'td', "\n". '<strong>' . sprintf(_("Add to %s"), $abook->localbackendname) . '</strong>' . "\n",
                 'center', $color[0]
             )
         )
-    , 'center', '', 'width="100%" cols="1"' ) ."\n";
+    , 'center', '', 'width="100%"' ) ."\n";
 address_form('addaddr', _("Add address"), $defdata);
 echo '</FORM>';
 
@@ -378,4 +383,4 @@ echo '</FORM>';
 do_hook('addressbook_bottom');
 ?>
 
-</BODY></HTML>
+</BODY></HTML>
\ No newline at end of file