Add accesskey to the From drop-down too
[squirrelmail.git] / src / compose.php
index c2ed4e2254a47dc927ce1412610b63d5b345b584..c42266a254874a3ca742a03b6e91b1105b567142 100644 (file)
@@ -1,5 +1,4 @@
 <?php
-
 /**
  * compose.php
  *
  *    - Send mail
  *    - Save As Draft
  *
- * @copyright &copy; 1999-2006 The SquirrelMail Project Team
+ * @copyright &copy; 1999-2007 The SquirrelMail Project Team
  * @license http://opensource.org/licenses/gpl-license.php GNU Public License
  * @version $Id$
  * @package squirrelmail
  */
 
+/** This is the compose page */
+define('PAGE_NAME', 'compose');
+
 /**
- * Path for SquirrelMail required files.
- * @ignore
+ * Include the SquirrelMail initialization file.
  */
-define('SM_PATH','../');
+require('../include/init.php');
+
+/* If email_address not set and admin wants us to ask user for it,
+ * redirect to options page. */
+if ( $ask_user_info && getPref($data_dir, $username,'email_address') == "" ) {
+    header("Location: " . get_location() . "/options.php?optpage=personal");
+    exit;
+}
 
 /* SquirrelMail required files. */
-include_once(SM_PATH . 'include/validate.php');
-require_once(SM_PATH . 'functions/global.php');
-require_once(SM_PATH . 'functions/imap.php');
+require_once(SM_PATH . 'functions/imap_general.php');
+require_once(SM_PATH . 'functions/imap_messages.php');
 require_once(SM_PATH . 'functions/date.php');
 require_once(SM_PATH . 'functions/mime.php');
-require_once(SM_PATH . 'functions/plugin.php');
-require_once(SM_PATH . 'functions/display_messages.php');
+require_once(SM_PATH . 'functions/compose.php');
 require_once(SM_PATH . 'class/deliver/Deliver.class.php');
 require_once(SM_PATH . 'functions/addressbook.php');
 require_once(SM_PATH . 'functions/forms.php');
 require_once(SM_PATH . 'functions/identity.php');
 
 /* --------------------- Get globals ------------------------------------- */
-/** COOKIE VARS */
-sqgetGlobalVar('key',       $key,           SQ_COOKIE);
 
 /** SESSION VARS */
-sqgetGlobalVar('username',  $username,      SQ_SESSION);
-sqgetGlobalVar('onetimepad',$onetimepad,    SQ_SESSION);
-sqgetGlobalVar('base_uri',  $base_uri,      SQ_SESSION);
 sqgetGlobalVar('delimiter', $delimiter,     SQ_SESSION);
 
+sqgetGlobalVar('delayed_errors',  $delayed_errors,  SQ_SESSION);
 sqgetGlobalVar('composesession',    $composesession,    SQ_SESSION);
 sqgetGlobalVar('compose_messages',  $compose_messages,  SQ_SESSION);
 
+// compose_messages only useful in SESSION when a forward-as-attachment
+// has been preconstructed for us and passed in via that mechanism; once
+// we have it, we can clear it from the SESSION
+sqsession_unregister('compose_messages');
+
+// Turn on delayed error handling in case we wind up redirecting below
+$oErrorHandler->setDelayedErrors(true);
+
 /** SESSION/POST/GET VARS */
-sqgetGlobalVar('session',$session);
-sqgetGlobalVar('mailbox',$mailbox);
-if(!sqgetGlobalVar('identity',$identity)) {
+sqgetGlobalVar('send_button_count', $send_button_count, SQ_POST, 1, SQ_TYPE_INT);
+for ($i = 1; $i <= $send_button_count; $i++)
+   if (sqgetGlobalVar('send' . $i, $send, SQ_POST)) break;
+// Send can only be achieved by setting $_POST var. If Send = true then
+// retrieve other form fields from $_POST
+if (isset($send) && $send) {
+    $SQ_GLOBAL = SQ_POST;
+} else {
+    $SQ_GLOBAL = SQ_FORM;
+}
+sqgetGlobalVar('session',$session, $SQ_GLOBAL);
+sqgetGlobalVar('mailbox',$mailbox, $SQ_GLOBAL);
+if(!sqgetGlobalVar('identity',$identity, $SQ_GLOBAL)) {
     $identity=0;
 }
-sqgetGlobalVar('send_to',$send_to);
-sqgetGlobalVar('send_to_cc',$send_to_cc);
-sqgetGlobalVar('send_to_bcc',$send_to_bcc);
-sqgetGlobalVar('subject',$subject);
-sqgetGlobalVar('body',$body);
-sqgetGlobalVar('mailprio',$mailprio);
-sqgetGlobalVar('request_mdn',$request_mdn);
-sqgetGlobalVar('request_dr',$request_dr);
-sqgetGlobalVar('html_addr_search',$html_addr_search);
-sqgetGlobalVar('mail_sent',$mail_sent);
-sqgetGlobalVar('passed_id',$passed_id);
-sqgetGlobalVar('passed_ent_id',$passed_ent_id);
-sqgetGlobalVar('send',$send);
-
-sqgetGlobalVar('attach',$attach);
-
-sqgetGlobalVar('draft',$draft);
-sqgetGlobalVar('draft_id',$draft_id);
-sqgetGlobalVar('ent_num',$ent_num);
-sqgetGlobalVar('saved_draft',$saved_draft);
-sqgetGlobalVar('delete_draft',$delete_draft);
+sqgetGlobalVar('send_to',$send_to, $SQ_GLOBAL);
+sqgetGlobalVar('send_to_cc',$send_to_cc, $SQ_GLOBAL);
+sqgetGlobalVar('send_to_bcc',$send_to_bcc, $SQ_GLOBAL);
+sqgetGlobalVar('subject',$subject, $SQ_GLOBAL);
+sqgetGlobalVar('body',$body, $SQ_GLOBAL);
+sqgetGlobalVar('mailprio',$mailprio, $SQ_GLOBAL);
+sqgetGlobalVar('request_mdn',$request_mdn, $SQ_GLOBAL);
+sqgetGlobalVar('request_dr',$request_dr, $SQ_GLOBAL);
+sqgetGlobalVar('html_addr_search',$html_addr_search, $SQ_GLOBAL);
+sqgetGlobalVar('mail_sent',$mail_sent, $SQ_GLOBAL);
+sqgetGlobalVar('passed_id',$passed_id, $SQ_GLOBAL, NULL, SQ_TYPE_BIGINT);
+sqgetGlobalVar('passed_ent_id',$passed_ent_id, $SQ_GLOBAL);
+
+sqgetGlobalVar('attach',$attach, SQ_POST);
+sqgetGlobalVar('draft',$draft, SQ_POST);
+sqgetGlobalVar('draft_id',$draft_id, $SQ_GLOBAL);
+sqgetGlobalVar('ent_num',$ent_num, $SQ_GLOBAL);
+sqgetGlobalVar('saved_draft',$saved_draft, SQ_FORM);
+
+if ( sqgetGlobalVar('delete_draft',$delete_draft) ) {
+    $delete_draft = (int)$delete_draft;
+}
+
 if ( sqgetGlobalVar('startMessage',$startMessage) ) {
     $startMessage = (int)$startMessage;
 } else {
@@ -84,19 +106,19 @@ if ( sqgetGlobalVar('startMessage',$startMessage) ) {
 
 
 /** POST VARS */
-sqgetGlobalVar('sigappend',             $sigappend,             SQ_POST);
-sqgetGlobalVar('from_htmladdr_search',  $from_htmladdr_search,  SQ_POST);
-sqgetGlobalVar('addr_search_done',      $html_addr_search_done, SQ_POST);
-sqgetGlobalVar('send_to_search',        $send_to_search,        SQ_POST);
-sqgetGlobalVar('do_delete',             $do_delete,             SQ_POST);
-sqgetGlobalVar('delete',                $delete,                SQ_POST);
-sqgetGlobalVar('restoremessages',       $restoremessages,       SQ_POST);
+sqgetGlobalVar('sigappend',             $sigappend,                 SQ_POST);
+sqgetGlobalVar('from_htmladdr_search',  $from_htmladdr_search,      SQ_POST);
+sqgetGlobalVar('addr_search_done',      $html_addr_search_done,     SQ_POST);
+sqgetGlobalVar('addr_search_cancel',    $html_addr_search_cancel,   SQ_POST);
+sqgetGlobalVar('send_to_search',        $send_to_search,            SQ_POST);
+sqgetGlobalVar('do_delete',             $do_delete,                 SQ_POST);
+sqgetGlobalVar('delete',                $delete,                    SQ_POST);
+sqgetGlobalVar('attachments',           $attachments,               SQ_POST);
 if ( sqgetGlobalVar('return', $temp, SQ_POST) ) {
     $html_addr_search_done = 'Use Addresses';
 }
 
 /** GET VARS */
-sqgetGlobalVar('attachedmessages', $attachedmessages, SQ_GET);
 if ( sqgetGlobalVar('account', $temp,  SQ_GET) ) {
     $iAccount = (int) $temp;
 } else {
@@ -115,7 +137,26 @@ if ( !sqgetGlobalVar('smaction',$action) )
     if ( sqgetGlobalVar('smaction_edit_new',$tmp) )   $action = 'edit_as_new';
 }
 
-/* Location (For HTTP 1.1 Header("Location: ...") redirects) */
+/**
+ * Here we decode the data passed in from mailto.php.
+ */
+if ( sqgetGlobalVar('mailtodata', $mailtodata, SQ_GET) ) {
+    $trtable = array('to'       => 'send_to',
+                 'cc'           => 'send_to_cc',
+                 'bcc'          => 'send_to_bcc',
+                 'body'         => 'body',
+                 'subject'      => 'subject');
+    $mtdata = unserialize($mailtodata);
+
+    foreach ($trtable as $f => $t) {
+        if ( !empty($mtdata[$f]) ) {
+            $$t = $mtdata[$f];
+        }
+    }
+    unset($mailtodata,$mtdata, $trtable);
+}
+
+/* Location (For HTTP 1.1 header("Location: ...") redirects) */
 $location = get_location();
 /* Identities (fetch only once) */
 $idents = get_identities();
@@ -128,8 +169,8 @@ function replyAllString($header) {
     /**
      * 1) Remove the addresses we'll be sending the message 'to'
      */
-    if (isset($header->replyto)) {
-        $excl_ar = $header->getAddr_a('replyto');
+    if (isset($header->reply_to)) {
+        $excl_ar = $header->getAddr_a('reply_to');
     }
     /**
      * 2) Remove our identities from the CC list (they still can be in the
@@ -198,9 +239,7 @@ function getReplyCitation($orig_from, $orig_date) {
     /* Otherwise, try to select the desired citation style. */
     switch ($reply_citation_style) {
     case 'author_said':
-        /**
-         * To translators: %s is for author's name
-         */
+        // i18n: %s is for author's name
         $full_reply_citation = sprintf(_("%s wrote:"),$sOrig_from);
         break;
     case 'quote_who':
@@ -209,15 +248,14 @@ function getReplyCitation($orig_from, $orig_date) {
         $full_reply_citation = $start . $sOrig_from . $end;
         break;
     case 'date_time_author':
-        /**
-         * To translators:
-         *  first %s is for date string, second %s is for author's name. Date uses
-         *  formating from "D, F j, Y g:i a" and "D, F j, Y H:i" translations.
-         * Example string:
-         *  "On Sat, December 24, 2004 23:59, Santa wrote:"
-         * If you have to put author's name in front of date string, check comments about
-         * argument swapping at http://www.php.net/sprintf
-         */
+        // i18n:
+        // The first %s is for date string, the second %s is for author's name.
+        // The date uses formating from "D, F j, Y g:i a" and "D, F j, Y H:i"
+        // translations.
+        // Example string:
+        // "On Sat, December 24, 2004 23:59, Santa wrote:"
+        // If you have to put author's name in front of date string, check comments about
+        // argument swapping at http://php.net/sprintf
         $full_reply_citation = sprintf(_("On %s, %s wrote:"), getLongDateString($orig_date), $sOrig_from);
         break;
     case 'user-defined':
@@ -266,7 +304,7 @@ function getforwardHeader($orig_header) {
     $bodyTop =  sq_str_pad(' '._("Original Message").' ',$editor_size -2,'-',STR_PAD_BOTH,$default_charset) .
         "\n". $display[_("Subject")] . $subject . "\n" .
         $display[_("From")] . $from . "\n" .
-        $display[_("Date")] . getLongDateString( $orig_header->date ). "\n" .
+        $display[_("Date")] . getLongDateString( $orig_header->date, $orig_header->date_unparsed ). "\n" .
         $display[_("To")] . $to . "\n";
     if ($orig_header->cc != array() && $orig_header->cc !='') {
         $cc = decodeHeader($orig_header->getAddr_s('cc',"\n$indent"),false,false,true);
@@ -283,27 +321,34 @@ function getforwardHeader($orig_header) {
  * If the session is expired during a post this restores the compose session
  * vars.
  */
+$session_expired = false;
 if (sqsession_is_registered('session_expired_post')) {
     sqgetGlobalVar('session_expired_post', $session_expired_post, SQ_SESSION);
     /*
      * extra check for username so we don't display previous post data from
      * another user during this session.
      */
-    if ($session_expired_post['username'] != $username) {
-        unset($session_expired_post);
-        sqsession_unregister('session_expired_post');
-        session_write_close();
-    } else {
-        foreach ($session_expired_post as $postvar => $val) {
-            if (isset($val)) {
-                $$postvar = $val;
-            } else {
-                $$postvar = '';
+    if (!empty($session_expired_post['username']) 
+     && $session_expired_post['username'] == $username) {
+        // these are the vars that we can set from the expired composed session
+        $compo_var_list = array ('send_to', 'send_to_cc', 'body',
+            'startMessage', 'passed_body', 'use_signature', 'signature',
+            'subject', 'newmail', 'send_to_bcc', 'passed_id', 'mailbox', 
+            'from_htmladdr_search', 'identity', 'draft_id', 'delete_draft', 
+            'mailprio', 'edit_as_new', 'attachments', 'composesession', 
+            'request_mdn', 'request_dr');
+
+        foreach ($compo_var_list as $var) {
+            if ( isset($session_expired_post[$var]) && !isset($$var) ) {
+                $$var = $session_expired_post[$var];
             }
         }
-        $compose_messages = unserialize(urldecode($restoremessages));
-        sqsession_register($compose_messages,'compose_messages');
+
+        if (!empty($attachments))
+            $attachments = unserialize(urldecode($attachments));
+
         sqsession_register($composesession,'composesession');
+
         if (isset($send)) {
             unset($send);
         }
@@ -320,18 +365,21 @@ if (sqsession_is_registered('session_expired_post')) {
     } else {
         $sHeaderJs = (isset($sHeaderJs)) ? $sHeaderJs : '';
         if (strpos($action, 'reply') !== false && $reply_focus) {
-            $sBodyTagJs = 'onload="checkForm(\''.$replyfocus.'\');"';
+            $sOnload = 'checkForm(\''.$replyfocus.'\');';
         } else {
-            $sBodyTagJs = 'onload="checkForm();"';
+            $sOnload = 'checkForm();';
         }
-        displayPageHeader($color, $mailbox,$sHeaderJs,$sBodyTagJs);
+        displayPageHeader($color, $mailbox,$sHeaderJs,$sOnload);
     }
     showInputForm($session, false);
     exit();
 }
+
 if (!isset($composesession)) {
     $composesession = 0;
     sqsession_register(0,'composesession');
+} else {
+    $composesession = (int)$composesession;
 }
 
 if (!isset($session) || (isset($newmessage) && $newmessage)) {
@@ -340,23 +388,25 @@ if (!isset($session) || (isset($newmessage) && $newmessage)) {
     $composesession = $session;
     sqsession_register($composesession,'composesession');
 }
-if (!isset($compose_messages)) {
-    $compose_messages = array();
-}
-
-if (!isset($compose_messages[$session]) || ($compose_messages[$session] == NULL)) {
+if (!empty($compose_messages[$session])) {
+    $composeMessage = $compose_messages[$session];
+} else {
     $composeMessage = new Message();
     $rfc822_header = new Rfc822Header();
     $composeMessage->rfc822_header = $rfc822_header;
     $composeMessage->reply_rfc822_header = '';
-    $compose_messages[$session] = $composeMessage;
+}
 
-    sqsession_register($compose_messages,'compose_messages');
-} else {
-    $composeMessage=$compose_messages[$session];
+// re-add attachments that were already in this message
+// FIXME: note that technically this is very bad form -
+// should never directly manipulate an object like this
+if (!empty($attachments)) {
+    $attachments = unserialize(urldecode($attachments));
+    if (!empty($attachments) && is_array($attachments))
+        $composeMessage->entities = $attachments;
 }
 
-if (!isset($mailbox) || $mailbox == '' || ($mailbox == 'None')) {
+if (empty($mailbox)) {
     $mailbox = 'INBOX';
 }
 
@@ -366,16 +416,14 @@ if ($draft) {
      * of language interface.
      */
     set_my_charset();
-    $composeMessage=$compose_messages[$session];
     if (! deliverMessage($composeMessage, true)) {
         showInputForm($session);
         exit();
     } else {
-        unset($compose_messages[$session]);
         $draft_message = _("Draft Email Saved");
         /* If this is a resumed draft, then delete the original */
         if(isset($delete_draft)) {
-            $imap_stream = sqimap_login($username, $key, $imapServerAddress, $imapPort, false);
+            $imap_stream = sqimap_login($username, false, $imapServerAddress, $imapPort, false);
             sqimap_mailbox_select($imap_stream, $draft_folder);
             // force bypass_trash=true because message should be saved when deliverMessage() returns true.
             // in current implementation of sqimap_msgs_list_flag() single message id can
@@ -386,11 +434,15 @@ if ($draft) {
             }
             sqimap_logout($imap_stream);
         }
+
+        $oErrorHandler->saveDelayedErrors();
         session_write_close();
+
         if ($compose_new_win == '1') {
             if ( !isset($pageheader_sent) || !$pageheader_sent ) {
-                Header("Location: $location/compose.php?saved_draft=yes&session=$composesession");
+                header("Location: $location/compose.php?saved_draft=yes&session=$composesession");
             } else {
+//FIXME: DON'T ECHO HTML FROM CORE!
                 echo '   <br><br><div style="text-align: center;"><a href="' . $location
                     . '/compose.php?saved_sent=yes&amp;session=' . $composesession . '">'
                     . _("Return") . '</a></div>';
@@ -398,9 +450,10 @@ if ($draft) {
             exit();
         } else {
             if ( !isset($pageheader_sent) || !$pageheader_sent ) {
-                Header("Location: $location/right_main.php?mailbox=" . urlencode($draft_folder) .
+                header("Location: $location/right_main.php?mailbox=" . urlencode($draft_folder) .
                    "&startMessage=1&note=".urlencode($draft_message));
             } else {
+//FIXME: DON'T ECHO HTML FROM CORE!
                 echo '   <br><br><div style="text-align: center;"><a href="' . $location
                     . '/right_main.php?mailbox=' . urlencode($draft_folder)
                     . '&amp;startMessage=1&amp;note=' . urlencode($draft_message) .'">'
@@ -422,7 +475,7 @@ if ($send) {
             /* We entered compose via the search results page */
             $mailbox = 'INBOX'; /* Send 'em to INBOX, that's safe enough */
         }
-        $urlMailbox = urlencode (trim($mailbox));
+        $urlMailbox = urlencode($mailbox);
         if (! isset($passed_id)) {
             $passed_id = 0;
         }
@@ -447,10 +500,10 @@ if ($send) {
             if( $line <> '-- ' ) {
                 $line = rtrim($line);
             }
-            if (sq_strlen($line,$default_charset) <= $editor_size + 1) {
+            if (sq_strlen($line, $default_charset) <= $editor_size + 1) {
                 $newBody .= $line . "\n";
             } else {
-                sqWordWrap($line, $editor_size,$default_charset);
+                sqWordWrap($line, $editor_size, $default_charset);
                 $newBody .= $line . "\n";
 
             }
@@ -458,19 +511,26 @@ if ($send) {
         }
         $body = $newBody;
 
-        $composeMessage=$compose_messages[$session];
-
         $Result = deliverMessage($composeMessage);
-        do_hook('compose_send_after', $Result, $composeMessage);
+
+        if ($Result)
+            $mail_sent = 'yes';
+        else
+            $mail_sent = 'no';
+
+        // NOTE: this hook changed in 1.5.2 from sending $Result and
+        //       $composeMessage as args #2 and #3 to being in an array
+        //       under arg #2
+        $temp = array(&$Result, &$composeMessage, &$mail_sent);
+        do_hook('compose_send_after', $temp);
         if (! $Result) {
             showInputForm($session);
             exit();
         }
-        unset($compose_messages[$session]);
 
         /* if it is resumed draft, delete draft message */
         if ( isset($delete_draft)) {
-            $imap_stream = sqimap_login($username, $key, $imapServerAddress, $imapPort, false);
+            $imap_stream = sqimap_login($username, false, $imapServerAddress, $imapPort, false);
             sqimap_mailbox_select($imap_stream, $draft_folder);
             // bypass_trash=true because message should be saved when deliverMessage() returns true.
             // in current implementation of sqimap_msgs_list_flag() single message id can
@@ -481,24 +541,31 @@ if ($send) {
             }
             sqimap_logout($imap_stream);
         }
+        /*
+         * Store the error array in the session because they will be lost on a redirect
+         */
+        $oErrorHandler->saveDelayedErrors();
         session_write_close();
+
         if ($compose_new_win == '1') {
             if ( !isset($pageheader_sent) || !$pageheader_sent ) {
-                Header("Location: $location/compose.php?mail_sent=yes");
+                header("Location: $location/compose.php?mail_sent=$mail_sent");
             } else {
+//FIXME: DON'T ECHO HTML FROM CORE!
                 echo '   <br><br><div style="text-align: center;"><a href="' . $location
-                    . '/compose.php?mail_sent=yes">'
+                    . '/compose.php?mail_sent=$mail_sent">'
                     . _("Return") . '</a></div>';
             }
             exit();
         } else {
             if ( !isset($pageheader_sent) || !$pageheader_sent ) {
-                Header("Location: $location/right_main.php?mailbox=$urlMailbox".
-                    "&startMessage=$startMessage&mail_sent=yes");
+                header("Location: $location/right_main.php?mailbox=$urlMailbox".
+                    "&startMessage=$startMessage&mail_sent=$mail_sent");
             } else {
+//FIXME: DON'T ECHO HTML FROM CORE!
                 echo '   <br><br><div style="text-align: center;"><a href="' . $location
                     . "/right_main.php?mailbox=$urlMailbox"
-                    . "&amp;startMessage=$startMessage&amp;mail_sent=yes\">"
+                    . "&amp;startMessage=$startMessage&amp;mail_sent=$mail_sent\">"
                     . _("Return") . '</a></div>';
             }
             exit();
@@ -549,12 +616,12 @@ if ($send) {
         }
     }
     showInputForm($session);
-} elseif (isset($html_addr_search)) {
+} elseif (isset($html_addr_search) && !isset($html_addr_search_cancel)) {
     if (isset($_FILES['attachfile']) &&
             $_FILES['attachfile']['tmp_name'] &&
             $_FILES['attachfile']['tmp_name'] != 'none') {
         if(saveAttachedFiles($session)) {
-            plain_error_message(_("Could not move/copy file. File not attached"), $color);
+            plain_error_message(_("Could not move/copy file. File not attached"));
         }
     }
     /*
@@ -563,14 +630,14 @@ if ($send) {
      */
     include_once('./addrbook_search_html.php');
 } elseif (isset($attach)) {
-    if (saveAttachedFiles($session)) {
-        plain_error_message(_("Could not move/copy file. File not attached"), $color);
-    }
     if ($compose_new_win == '1') {
         compose_Header($color, $mailbox);
     } else {
         displayPageHeader($color, $mailbox);
     }
+    if (saveAttachedFiles($session)) {
+        plain_error_message(_("Could not move/copy file. File not attached"));
+    }
     showInputForm($session);
 }
 elseif (isset($sigappend)) {
@@ -591,10 +658,11 @@ elseif (isset($sigappend)) {
     }
 
     if (isset($delete) && is_array($delete)) {
-        $composeMessage = $compose_messages[$session];
         foreach($delete as $index) {
             if (!empty($composeMessage->entities) && isset($composeMessage->entities[$index])) {
                 $composeMessage->entities[$index]->purgeAttachments();
+                // FIXME: one person reported that unset() didn't do anything at all here, so this is a work-around... but it triggers PHP notices if the unset() doesn't work, which should be fixed... but bigger question is if unset() doesn't work here, what about everywhere else? Anyway, uncomment this if you think you need it
+                //$composeMessage->entities[$index] = NULL;
                 unset ($composeMessage->entities[$index]);
             }
         }
@@ -603,8 +671,6 @@ elseif (isset($sigappend)) {
             $new_entities[] = $entity;
         }
         $composeMessage->entities = $new_entities;
-        $compose_messages[$session] = $composeMessage;
-        sqsession_register($compose_messages, 'compose_messages');
     }
     showInputForm($session);
 } else {
@@ -670,9 +736,10 @@ function getforwardSubject($subject)
 function newMail ($mailbox='', $passed_id='', $passed_ent_id='', $action='', $session='') {
     global $editor_size, $default_use_priority, $body, $idents,
         $use_signature, $data_dir, $username,
-        $username, $key, $imapServerAddress, $imapPort, $compose_messages,
-        $composeMessage, $body_quote;
-    global $languages, $squirrelmail_language, $default_charset;
+        $key, $imapServerAddress, $imapPort, 
+        $composeMessage, $body_quote, $request_mdn, $request_dr,
+        $mdn_user_support, $languages, $squirrelmail_language,
+        $default_charset;
 
     /*
      * Set $default_charset to correspond with the user's selection
@@ -685,7 +752,7 @@ function newMail ($mailbox='', $passed_id='', $passed_ent_id='', $action='', $se
     $mailprio = 3;
 
     if ($passed_id) {
-        $imapConnection = sqimap_login($username, $key, $imapServerAddress,
+        $imapConnection = sqimap_login($username, false, $imapServerAddress,
                 $imapPort, 0);
 
         sqimap_mailbox_select($imapConnection, $mailbox);
@@ -704,7 +771,7 @@ function newMail ($mailbox='', $passed_id='', $passed_ent_id='', $action='', $se
                 (array(), $alt_order = array('text/plain'));
             if (!count($entities)) {
                 $entities = $message->entities[0]->findDisplayEntity
-                    (array(), $alt_order = array('text/plain','html/plain'));
+                    (array(), $alt_order = array('text/plain','text/html'));
             }
             $orig_header = $message->rfc822_header; /* here is the envelope located */
             /* redefine the message for picking up the attachments */
@@ -713,7 +780,7 @@ function newMail ($mailbox='', $passed_id='', $passed_ent_id='', $action='', $se
         } else {
             $entities = $message->findDisplayEntity (array(), $alt_order = array('text/plain'));
             if (!count($entities)) {
-                $entities = $message->findDisplayEntity (array(), $alt_order = array('text/plain','html/plain'));
+                $entities = $message->findDisplayEntity (array(), $alt_order = array('text/plain','text/html'));
             }
             $orig_header = $message->rfc822_header;
         }
@@ -764,7 +831,6 @@ function newMail ($mailbox='', $passed_id='', $passed_ent_id='', $action='', $se
             $mailprio = '';
         }
 
-        $identity = '';
         $from_o = $orig_header->from;
         if (is_array($from_o)) {
             if (isset($from_o[0])) {
@@ -781,9 +847,10 @@ function newMail ($mailbox='', $passed_id='', $passed_ent_id='', $action='', $se
         if (count($idents) > 1) {
             foreach($idents as $nr=>$data) {
                 $enc_from_name = '"'.$data['full_name'].'" <'. $data['email_address'].'>';
-                if($enc_from_name == $orig_from) {
+                if(strtolower($enc_from_name) == strtolower($orig_from)) {
                     $identity = $nr;
-                    break;
+                    // don't stop!  need to build $identities array for idents match below
+                    //break;
                 }
                 $identities[] = $enc_from_name;
             }
@@ -805,17 +872,15 @@ function newMail ($mailbox='', $passed_id='', $passed_ent_id='', $action='', $se
                 $send_from_parts = new AddressStructure();
                 $send_from_parts = $orig_header->parseAddress($send_from);
                 $send_from_add = $send_from_parts->mailbox . '@' . $send_from_parts->host;
-                $identities = get_identities();
-                if (count($identities) > 0) {
-                    foreach($identities as $iddata) {
-                        if ($send_from_add == $iddata['email_address']) {
-                            $identity = $iddata['index'];
-                            break;
-                        }
-                    }
-                }
+                $identity = find_identity(array($send_from_add));
                 $subject = decodeHeader($orig_header->subject,false,false,true);
+
+                // Remember the receipt settings
+                $request_mdn = $mdn_user_support && !empty($orig_header->dnt) ? '1' : '0';
+                $request_dr = $mdn_user_support && !empty($orig_header->drnt) ? '1' : '0';
+
                 /* remember the references and in-reply-to headers in case of an reply */
+//FIXME: it would be better to fiddle with headers inside of the message object or possibly when delivering the message to its destination (drafts folder?); is this possible?
                 $composeMessage->rfc822_header->more_headers['References'] = $orig_header->references;
                 $composeMessage->rfc822_header->more_headers['In-Reply-To'] = $orig_header->in_reply_to;
                 // rewrap the body to clean up quotations and line lengths
@@ -878,7 +943,7 @@ function newMail ($mailbox='', $passed_id='', $passed_ent_id='', $action='', $se
                 }
                 /* this corrects some wrapping/quoting problems on replies */
                 $rewrap_body = explode("\n", $body);
-                $from =  (is_array($orig_header->from)) ? $orig_header->from[0] : $orig_header->from;
+                $from = (is_array($orig_header->from) && !empty($orig_header->from)) ? $orig_header->from[0] : $orig_header->from;
                 $body = '';
                 $strip_sigs = getPref($data_dir, $username, 'strip_sigs');
                 foreach ($rewrap_body as $line) {
@@ -903,8 +968,7 @@ function newMail ($mailbox='', $passed_id='', $passed_ent_id='', $action='', $se
             default:
                 break;
         }
-        $compose_messages[$session] = $composeMessage;
-        sqsession_register($compose_messages, 'compose_messages');
+//FIXME: we used to register $compose_messages in the session here, but not any more - so do we still need the session_write_close() and sqimap_logout() here?  We probably need the IMAP logout, but what about the session closure?
         session_write_close();
         sqimap_logout($imapConnection);
     }
@@ -930,8 +994,8 @@ function newMail ($mailbox='', $passed_id='', $passed_ent_id='', $action='', $se
  * @return object
  */
 function getAttachments($message, &$composeMessage, $passed_id, $entities, $imapConnection) {
-    global $attachment_dir, $username, $data_dir, $squirrelmail_language, $languages;
-    $hashed_attachment_dir = getHashedDir($username, $attachment_dir);
+    global $squirrelmail_language, $languages, $username, $attachment_dir;
+
     if (!count($message->entities) ||
             ($message->type0 == 'message' && $message->type1 == 'rfc822')) {
         if ( !in_array($message->entity_id, $entities) && $message->entity_id) {
@@ -942,7 +1006,7 @@ function getAttachments($message, &$composeMessage, $passed_id, $entities, $imap
                         if ($filename == "") {
                             $filename = "untitled-".$message->entity_id;
                         }
-                        $filename .= '.msg';
+                        $filename .= '.eml';
                     } else {
                         $filename = $message->getFilename();
                     }
@@ -959,19 +1023,16 @@ function getAttachments($message, &$composeMessage, $passed_id, $entities, $imap
                     function_exists($languages[$squirrelmail_language]['XTRA_CODE'] . '_encode')) {
                 $filename =  call_user_func($languages[$squirrelmail_language]['XTRA_CODE'] . '_encode', $filename);
             }
-            $localfilename = GenerateRandomString(32, '', 7);
-            $full_localfilename = "$hashed_attachment_dir/$localfilename";
-            while (file_exists($full_localfilename)) {
-                $localfilename = GenerateRandomString(32, '', 7);
-                $full_localfilename = "$hashed_attachment_dir/$localfilename";
-            }
-            $message->att_local_name = $full_localfilename;
+
+            $hashed_attachment_dir = getHashedDir($username, $attachment_dir);
+            $localfilename = sq_get_attach_tempfile();
+            $message->att_local_name = $localfilename;
 
             $composeMessage->initAttachment($message->type0.'/'.$message->type1,$filename,
-                    $full_localfilename);
+                    $localfilename);
 
             /* Write Attachment to file */
-            $fp = fopen ("$hashed_attachment_dir/$localfilename", 'wb');
+            $fp = fopen ($hashed_attachment_dir . '/' . $localfilename, 'wb');
             mime_print_body_lines ($imapConnection, $passed_id, $message->entity_id, $message->header->encoding, $fp);
             fclose ($fp);
         }
@@ -985,8 +1046,6 @@ function getAttachments($message, &$composeMessage, $passed_id, $entities, $imap
 
 function getMessage_RFC822_Attachment($message, $composeMessage, $passed_id,
         $passed_ent_id='', $imapConnection) {
-    global $attachment_dir, $username, $data_dir;
-    $hashed_attachment_dir = getHashedDir($username, $attachment_dir);
     if (!$passed_ent_id) {
         $body_a = sqimap_run_command($imapConnection,
                 'FETCH '.$passed_id.' RFC822',
@@ -1004,28 +1063,29 @@ function getMessage_RFC822_Attachment($message, $composeMessage, $passed_id,
         array_pop($body_a);
         $body = implode('', $body_a) . "\r\n";
 
-        $localfilename = GenerateRandomString(32, 'FILE', 7);
-        $full_localfilename = "$hashed_attachment_dir/$localfilename";
-
-        $fp = fopen($full_localfilename, 'w');
+        global $username, $attachment_dir;
+        $hashed_attachment_dir = getHashedDir($username, $attachment_dir);
+        $localfilename = sq_get_attach_tempfile();
+        $fp = fopen($hashed_attachment_dir . '/' . $localfilename, 'wb');
         fwrite ($fp, $body);
         fclose($fp);
-        $composeMessage->initAttachment('message/rfc822',$subject.'.msg',
-                $full_localfilename);
+        $composeMessage->initAttachment('message/rfc822',$subject.'.eml',
+                $localfilename);
     }
     return $composeMessage;
 }
 
 function showInputForm ($session, $values=false) {
-    global $send_to, $send_to_cc, $body, $startMessage, $action,
-        $color, $use_signature, $signature, $prefix_sig,
+    global $send_to, $send_to_cc, $send_to_bcc,
+        $body, $startMessage, $action, $attachments,
+        $use_signature, $signature, $prefix_sig, $session_expired,
         $editor_size, $editor_height, $subject, $newmail,
-        $use_javascript_addr_book, $send_to_bcc, $passed_id, $mailbox,
+        $use_javascript_addr_book, $passed_id, $mailbox,
         $from_htmladdr_search, $location_of_buttons, $attachment_dir,
         $username, $data_dir, $identity, $idents, $delete_draft,
         $mailprio, $compose_new_win, $saved_draft, $mail_sent, $sig_first,
-        $username, $compose_messages, $composesession, $default_charset,
-        $compose_onsubmit, $oTemplate;
+        $composeMessage, $composesession, $default_charset,
+        $compose_onsubmit, $oTemplate, $oErrorHandler;
 
     if (checkForJavascript()) {
         $onfocus = ' onfocus="alreadyFocused=true;"';
@@ -1036,7 +1096,6 @@ function showInputForm ($session, $values=false) {
         $onfocus_array = array();
     }
 
-    $composeMessage = $compose_messages[$session];
     if ($values) {
         $send_to = $values['send_to'];
         $send_to_cc = $values['send_to_cc'];
@@ -1052,6 +1111,7 @@ function showInputForm ($session, $values=false) {
     }
 
     if ($use_javascript_addr_book) {
+//FIXME: NO HTML IN CORE!
         echo "\n". '<script type="text/javascript">'."\n<!--\n" .
             'function open_abook() { ' . "\n" .
             '  var nwin = window.open("addrbook_popup.php","abookpopup",' .
@@ -1062,11 +1122,13 @@ function showInputForm ($session, $values=false) {
             "// -->\n</script>\n\n";
     }
 
+//FIXME: NO HTML IN CORE!
     echo "\n" . '<form name="compose" action="compose.php" method="post" ' .
         'enctype="multipart/form-data"';
 
     $compose_onsubmit = array();
-    do_hook('compose_form');
+    global $null;
+    do_hook('compose_form', $null);
 
     // Plugins that use compose_form hook can add an array entry
     // to the globally scoped $compose_onsubmit; we add them up
@@ -1091,111 +1153,88 @@ function showInputForm ($session, $values=false) {
             $onsubmit_text .= $text;
         }
 
+//FIXME: DON'T ECHO HTML FROM CORE!
         echo $onsubmit_text . ' return true;"';
     }
 
 
+//FIXME: NO HTML IN CORE!
     echo ">\n";
 
+//FIXME: DON'T ECHO HTML FROM CORE!
     echo addHidden('startMessage', $startMessage);
 
     if ($action == 'draft') {
+//FIXME: DON'T ECHO HTML FROM CORE!
         echo addHidden('delete_draft', $passed_id);
     }
     if (isset($delete_draft)) {
+//FIXME: DON'T ECHO HTML FROM CORE!
         echo addHidden('delete_draft', $delete_draft);
     }
     if (isset($session)) {
+//FIXME: DON'T ECHO HTML FROM CORE!
         echo addHidden('session', $session);
     }
 
     if (isset($passed_id)) {
+//FIXME: DON'T ECHO HTML FROM CORE!
         echo addHidden('passed_id', $passed_id);
     }
 
     if ($saved_draft == 'yes') {
-        echo '<br /><div style="text-align: center;"><b>'. _("Draft Saved").'</div></b>';
+        $oTemplate->assign('note', _("Your draft has been saved."));
+        $oTemplate->display('note.tpl');
     }
     if ($mail_sent == 'yes') {
-        echo '<br /><div style="text-align: center;"><b>'. _("Your Message has been sent.").'</div></b>';
+        $oTemplate->assign('note', _("Your mail has been sent."));
+        $oTemplate->display('note.tpl');
     }
     if ($compose_new_win == '1') {
-        echo '<table align="center" bgcolor="'.$color[0].'" width="100%" border="0">'."\n" .
-            '   <tr><td></td>'.html_tag( 'td', '', 'right' ).
-            '<input type="button" name="Close" onclick="return self.close()" value="'.
-            _("Close").'" /></td></tr>'."\n";
-    } else {
-        echo '<table align="center" cellspacing="0" border="0">' . "\n";
+        $oTemplate->display('compose_newwin_close.tpl');
     }
+
     if ($location_of_buttons == 'top') {
+//FIXME: DON'T ECHO HTML FROM CORE!
         showComposeButtonRow();
     }
 
-    /* display select list for identities */
+    $identities = array();
     if (count($idents) > 1) {
-        $ident_list = array();
+        reset($idents);
         foreach($idents as $id => $data) {
-            $ident_list[$id] =
-                $data['full_name'].' <'.$data['email_address'].'>';
+            $identities[$id] = $data['full_name'].' &lt;'.$data['email_address'].'&gt;';
         }
-        echo '   <tr>' . "\n" .
-            html_tag( 'td', '', 'right', $color[4], 'width="10%"' ) .
-            _("From:") . '</td>' . "\n" .
-            html_tag( 'td', '', 'left', $color[4], 'width="90%"' ) .
-            '         '.
-            addSelect('identity', $ident_list, $identity, TRUE);
-
-        echo '      </td>' . "\n" .
-            '   </tr>' . "\n";
-    }
-
-    echo '   <tr>' . "\n" .
-        html_tag( 'td', '', 'right', $color[4], 'width="10%"' ) .
-        _("To") . ':</td>' . "\n" .
-        html_tag( 'td', '', 'left', $color[4], 'width="90%"' ) .
-        addInput('send_to', $send_to, 60, 0, $onfocus_array). '<br />' . "\n" .
-        '      </td>' . "\n" .
-        '   </tr>' . "\n" .
-        '   <tr>' . "\n" .
-        html_tag( 'td', '', 'right', $color[4] ) .
-        _("Cc") . ':</td>' . "\n" .
-        html_tag( 'td', '', 'left', $color[4] ) .
-        addInput('send_to_cc', $send_to_cc, 60, 0, $onfocus_array). '<br />' . "\n" .
-        '      </td>' . "\n" .
-        '   </tr>' . "\n" .
-        '   <tr>' . "\n" .
-        html_tag( 'td', '', 'right', $color[4] ) .
-        _("Bcc") . ':</td>' . "\n" .
-        html_tag( 'td', '', 'left', $color[4] ) .
-        addInput('send_to_bcc', $send_to_bcc, 60, 0, $onfocus_array).'<br />' . "\n" .
-        '      </td>' . "\n" .
-        '   </tr>' . "\n" .
-        '   <tr>' . "\n" .
-        html_tag( 'td', '', 'right', $color[4] ) .
-        _("Subject") . ':</td>' . "\n" .
-        html_tag( 'td', '', 'left', $color[4] ) . "\n";
-    echo '         '.addInput('subject', $subject, 60, 0, $onfocus_array).
-        '      </td>' . "\n" .
-        '   </tr>' . "\n\n";
+    }
+
+    $oTemplate->assign('identities', $identities);
+    $oTemplate->assign('identity_def', $identity);
+    $oTemplate->assign('input_onfocus', 'onfocus="'.join(' ', $onfocus_array).'"');
+
+    $oTemplate->assign('to', htmlspecialchars($send_to));
+    $oTemplate->assign('cc', htmlspecialchars($send_to_cc));
+    $oTemplate->assign('bcc', htmlspecialchars($send_to_bcc));
+    $oTemplate->assign('subject', htmlspecialchars($subject));
+
+    // access keys...
+    //
+    global $accesskey_compose_to, $accesskey_compose_cc,
+           $accesskey_compose_identity, $accesskey_compose_bcc,
+           $accesskey_compose_subject;
+    $oTemplate->assign('accesskey_compose_identity', $accesskey_compose_identity);
+    $oTemplate->assign('accesskey_compose_to', $accesskey_compose_to);
+    $oTemplate->assign('accesskey_compose_cc', $accesskey_compose_cc);
+    $oTemplate->assign('accesskey_compose_bcc', $accesskey_compose_bcc);
+    $oTemplate->assign('accesskey_compose_subject', $accesskey_compose_subject);
+
+    $oTemplate->display('compose_header.tpl');
 
     if ($location_of_buttons == 'between') {
+//FIXME: DON'T ECHO HTML FROM CORE!
         showComposeButtonRow();
     }
 
-    /* why this distinction? */
-    if ($compose_new_win == '1') {
-        echo '   <tr>' . "\n" .
-            '      <td bgcolor="' . $color[0] . '" colspan="2" align="center">' . "\n" .
-            '         <textarea name="body" id="body" rows="' . (int)$editor_height .
-            '" cols="' . (int)$editor_size . '" wrap="virtual"' . $onfocus . '>';
-    }
-    else {
-        echo '   <tr>' . "\n" .
-            '      <td bgcolor="' . $color[4] . '" colspan="2">' . "\n" .
-            '         &nbsp;&nbsp;<textarea name="body" id="body" rows="' . (int)$editor_height .
-            '" cols="' . (int)$editor_size . '" wrap="virtual"' . $onfocus . '>';
-    }
-
+    $body_str = '';
     if ($use_signature == true && $newmail == true && !isset($from_htmladdr_search)) {
         $signature = $idents[$identity]['signature'];
 
@@ -1207,40 +1246,49 @@ function showInputForm ($session, $values=false) {
              * issues too.
              */
             if ($default_charset == 'iso-2022-jp') {
-                echo "\n\n".($prefix_sig==true? "-- \n":'').mb_convert_encoding($signature, 'EUC-JP');
+                $body_str = "\n\n".($prefix_sig==true? "-- \n":'').mb_convert_encoding($signature, 'EUC-JP');
             } else {
-                echo "\n\n".($prefix_sig==true? "-- \n":'').decodeHeader($signature,false,false);
+                $body_str = "\n\n".($prefix_sig==true? "-- \n":'').decodeHeader($signature,false,false);
             }
-            echo "\n\n".htmlspecialchars(decodeHeader($body,false,false));
-        }
-        else {
-            echo "\n\n".htmlspecialchars(decodeHeader($body,false,false));
+            $body_str .= "\n\n".htmlspecialchars(decodeHeader($body,false,false));
+        } else {
+            $body_str = "\n\n".htmlspecialchars(decodeHeader($body,false,false));
             // FIXME: test is specific to ja_JP translation implementation. See above comments.
             if ($default_charset == 'iso-2022-jp') {
-                echo "\n\n".($prefix_sig==true? "-- \n":'').mb_convert_encoding($signature, 'EUC-JP');
-            }else{
-                echo "\n\n".($prefix_sig==true? "-- \n":'').decodeHeader($signature,false,false);
+                $body_str .= "\n\n".($prefix_sig==true? "-- \n":'').mb_convert_encoding($signature, 'EUC-JP');
+            } else {
+                $body_str .= "\n\n".($prefix_sig==true? "-- \n":'').decodeHeader($signature,false,false);
             }
         }
     } else {
-        echo htmlspecialchars(decodeHeader($body,false,false));
+        $body_str = htmlspecialchars(decodeHeader($body,false,false));
     }
-    echo '</textarea><br />' . "\n" .
-        '      </td>' . "\n" .
-        '   </tr>' . "\n";
 
+    $oTemplate->assign('editor_width', (int)$editor_size);
+    $oTemplate->assign('editor_height', (int)$editor_height);
+    $oTemplate->assign('input_onfocus', 'onfocus="'.join(' ', $onfocus_array).'"');
+    $oTemplate->assign('body', $body_str);
+    $oTemplate->assign('show_bottom_send', $location_of_buttons!='bottom');
+
+    // access keys...
+    //
+    global $accesskey_compose_body, $accesskey_compose_send;
+    $oTemplate->assign('accesskey_compose_body', $accesskey_compose_body);
+    $oTemplate->assign('accesskey_compose_send', $accesskey_compose_send);
+
+    $oTemplate->display ('compose_body.tpl');
 
     if ($location_of_buttons == 'bottom') {
+//FIXME: DON'T ECHO HTML FROM CORE!
         showComposeButtonRow();
-    } else {
-        echo '   <tr>' . "\n" .
-            html_tag( 'td', '', 'right', '', 'colspan="2"' ) . "\n" .
-            '         ' . addSubmit(_("Send"), 'send').
-            '         &nbsp;&nbsp;&nbsp;&nbsp;<br /><br />' . "\n" .
-            '      </td>' . "\n" .
-            '   </tr>' . "\n";
     }
 
+    // composeMessage can be empty when coming from a restored session
+    if (is_object($composeMessage) && $composeMessage->entities)
+        $attach_array = $composeMessage->entities;
+    if ($session_expired && !empty($attachments) && is_array($attachments))
+        $attach_array = $attachments;
+
     /* This code is for attachments */
     if ((bool) ini_get('file_uploads')) {
 
@@ -1259,87 +1307,70 @@ function showInputForm ($session, $values=false) {
             }
         }
 
-        if(count($sizes) > 0) {
-            $maxsize = '(max.&nbsp;' . show_readable_size( min( $sizes ) ) . ')';
-            echo addHidden('MAX_FILE_SIZE', min( $sizes ));
-        } else {
-            $maxsize = '';
-        }
-        echo '   <tr>' . "\n" .
-            '      <td colspan="2">' . "\n" .
-            '         <table width="100%" cellpadding="1" cellspacing="0" align="center"'.
-            ' border="0" bgcolor="'.$color[9].'">' . "\n" .
-            '            <tr>' . "\n" .
-            '               <td>' . "\n" .
-            '                 <table width="100%" cellpadding="3" cellspacing="0" align="center"'.
-            ' border="0">' . "\n" .
-            '                    <tr>' . "\n" .
-            html_tag( 'td', '', 'right', '', 'valign="middle"' ) .
-            _("Attach:") . '</td>' . "\n" .
-            html_tag( 'td', '', 'left', '', 'valign="middle"' ) .
-            '                          <input name="attachfile" size="48" type="file" />' . "\n" .
-            '                          &nbsp;&nbsp;<input type="submit" name="attach"' .
-            ' value="' . _("Add") .'" />' . "\n" .
-            $maxsize .
-            '                       </td>' . "\n" .
-            '                    </tr>' . "\n";
-
-        $s_a = array();
-        if ($composeMessage->entities) {
-            foreach ($composeMessage->entities as $key => $attachment) {
+        $attach = array();
+        global $username, $attachment_dir;
+        $hashed_attachment_dir = getHashedDir($username, $attachment_dir);
+        if (!empty($attach_array)) {
+            foreach ($attach_array as $key => $attachment) {
                 $attached_file = $attachment->att_local_name;
                 if ($attachment->att_local_name || $attachment->body_part) {
                     $attached_filename = decodeHeader($attachment->mime_header->getParameter('name'));
                     $type = $attachment->mime_header->type0.'/'.
                         $attachment->mime_header->type1;
 
-                    $s_a[] = '<table bgcolor="'.$color[0].
-                        '" border="0"><tr><td>'.
-                        addCheckBox('delete[]', FALSE, $key).
-                        "</td><td>\n" . $attached_filename .
-                        '</td><td>-</td><td> ' . $type . '</td><td>('.
-                        show_readable_size( filesize( $attached_file ) ) . ')</td></tr></table>'."\n";
+                    $a = array();
+                    $a['Key'] = $key;
+                    $a['FileName'] = $attached_filename;
+                    $a['ContentType'] = $type;
+                    $a['Size'] = filesize($hashed_attachment_dir . '/' . $attached_file);
+                    $attach[$key] = $a;
                 }
             }
         }
-        if (count($s_a)) {
-            foreach ($s_a as $s) {
-                echo '<tr>' . html_tag( 'td', '', 'left', $color[0], 'colspan="2"' ) . $s .'</td></tr>';
-            }
-            echo '<tr><td colspan="2"><input type="submit" name="do_delete" value="' .
-                _("Delete selected attachments") . "\" />\n" .
-                '</td></tr>';
-        }
-        echo '                  </table>' . "\n" .
-            '               </td>' . "\n" .
-            '            </tr>' . "\n" .
-            '         </table>' . "\n" .
-            '      </td>' . "\n" .
-            '   </tr>' . "\n";
+
+        $max = min($sizes);
+        $oTemplate->assign('max_file_size', empty($max) ? -1 : $max);
+        $oTemplate->assign('attachments', $attach);
+
+        // access keys...
+        //
+        global $accesskey_compose_attach_browse, $accesskey_compose_attach,
+               $accesskey_compose_delete_attach;
+        $oTemplate->assign('accesskey_compose_attach_browse', $accesskey_compose_attach_browse);
+        $oTemplate->assign('accesskey_compose_attach', $accesskey_compose_attach);
+        $oTemplate->assign('accesskey_compose_delete_attach', $accesskey_compose_delete_attach);
+
+        $oTemplate->display('compose_attachments.tpl');
     } // End of file_uploads if-block
     /* End of attachment code */
-    echo '</table>' . "\n" .
-        addHidden('username', $username).
-        addHidden('smaction', $action).
-        addHidden('mailbox', $mailbox);
-    /*
-       store the complete ComposeMessages array in a hidden input value
-       so we can restore them in case of a session timeout.
-     */
+
+//FIXME: no direct echoing to browser, no HTML output in core!
+    echo addHidden('username', $username).
+         addHidden('smaction', $action).
+         addHidden('mailbox', $mailbox);
     sqgetGlobalVar('QUERY_STRING', $queryString, SQ_SERVER);
-    echo addHidden('restoremessages', serialize($compose_messages)).
-        addHidden('composesession', $composesession).
+//FIXME: no direct echoing to browser, no HTML output in core!
+    echo addHidden('composesession', $composesession).
         addHidden('querystring', $queryString).
+        (!empty($attach_array) ?
+         addHidden('attachments', urlencode(serialize($attach_array))) : '').
         "</form>\n";
     if (!(bool) ini_get('file_uploads')) {
         /* File uploads are off, so we didn't show that part of the form.
            To avoid bogus bug reports, tell the user why. */
+//FIXME: no direct echoing to browser, no HTML output in core!
         echo '<p style="text-align:center">'
             . _("Because PHP file uploads are turned off, you can not attach files to this message. Please see your system administrator for details.")
             . "</p>\r\n";
     }
 
-    do_hook('compose_bottom');
+    if ($compose_new_win=='1') {
+        $oTemplate->display('compose_newwin_close.tpl');
+    }
+
+    do_hook('compose_bottom', $null);
+
+    $oErrorHandler->setDelayedErrors(false);
     $oTemplate->display('footer.tpl');
 }
 
@@ -1350,56 +1381,54 @@ function showComposeButtonRow() {
         $request_mdn, $request_dr,
         $data_dir, $username;
 
-    echo '   <tr>' . "\n" .
-        '      <td></td>' . "\n" .
-        '      <td>' . "\n";
+    global $oTemplate, $buffer_hook;
+
     if ($default_use_priority) {
-        if(!isset($mailprio)) {
-            $mailprio = '3';
-        }
-        echo '          ' . _("Priority") .
-            addSelect('mailprio', array(
-                        '1' => _("High"),
-                        '3' => _("Normal"),
-                        '5' => _("Low") ), $mailprio, TRUE);
+        $priorities = array('1'=>_("High"), '3'=>_("Normal"), '5'=>_("Low"));
+        $priority = isset($mailprio) ? $mailprio : 3;
+    } else {
+        $priorities = array();
+        $priority = NULL;
     }
+
     $mdn_user_support=getPref($data_dir, $username, 'mdn_user_support',$default_use_mdn);
-    if ($default_use_mdn) {
-        if ($mdn_user_support) {
-            echo '          ' . _("Receipt") .': '.
-                addCheckBox('request_mdn', $request_mdn == '1', '1'). _("On Read").
-                addCheckBox('request_dr',  $request_dr  == '1', '1'). _("On Delivery");
-        }
-    }
 
-    echo '      </td>' . "\n" .
-        '   </tr>' . "\n" .
-        '   <tr>'  . "\n" .
-        '      <td></td>' . "\n" .
-        '      <td>' . "\n" .
-        '         <input type="submit" name="sigappend" value="' . _("Signature") . '" />' . "\n";
-    if ($use_javascript_addr_book) {
-        echo "         <script type=\"text/javascript\"><!--\n document.write(\"".
-            "            <input type=button value=\\\""._("Addresses").
-            "\\\" onclick=\\\"javascript:open_abook();\\\" />\");".
-            "            // --></script><noscript>\n".
-            '            <input type="submit" name="html_addr_search" value="'.
-            _("Addresses").'" />'.
-            "         </noscript>\n";
+    $address_book_button_attribs = array();
+    global $accesskey_compose_addresses;
+    if ($accesskey_compose_addresses != 'NONE')
+        $address_book_button_attribs['accesskey'] = $accesskey_compose_addresses;
+    if ($use_javascript_addr_book && checkForJavascript()) {
+        $addr_book = addButton(_("Addresses"),
+                               null,
+                               array_merge($address_book_button_attribs, array('onclick' => 'javascript:open_abook();')));
     } else {
-        echo '         <input type="submit" name="html_addr_search" value="'.
-            _("Addresses").'" />' . "\n";
+        $addr_book = addSubmit(_("Addresses"), 'html_addr_search', $address_book_button_attribs);
     }
 
-    if ($save_as_draft) {
-        echo '         <input type="submit" name ="draft" value="' . _("Save Draft") . "\" />\n";
-    }
+    $oTemplate->assign('allow_priority', $default_use_priority==1);
+    $oTemplate->assign('priority_list', $priorities);
+    $oTemplate->assign('current_priority', $priority);
 
-    echo '         <input type="submit" name="send" value="'. _("Send") . '" />' . "\n";
-    do_hook('compose_button_row');
+    $oTemplate->assign('notifications_enabled', $mdn_user_support==1);
+    $oTemplate->assign('read_receipt', $request_mdn=='1');
+    $oTemplate->assign('delivery_receipt', $request_dr=='1');
 
-    echo '      </td>' . "\n" .
-        '   </tr>' . "\n\n";
+    $oTemplate->assign('drafts_enabled', $save_as_draft);
+    $oTemplate->assign('address_book_button', $addr_book);
+
+    // access keys...
+    //
+    global $accesskey_compose_priority, $accesskey_compose_on_read,
+           $accesskey_compose_on_delivery, $accesskey_compose_signature,
+           $accesskey_compose_save_draft, $accesskey_compose_send;
+    $oTemplate->assign('accesskey_compose_priority', $accesskey_compose_priority);
+    $oTemplate->assign('accesskey_compose_on_read', $accesskey_compose_on_read);
+    $oTemplate->assign('accesskey_compose_on_delivery', $accesskey_compose_on_delivery);
+    $oTemplate->assign('accesskey_compose_signature', $accesskey_compose_signature);
+    $oTemplate->assign('accesskey_compose_save_draft', $accesskey_compose_save_draft);
+    $oTemplate->assign('accesskey_compose_send', $accesskey_compose_send);
+
+    $oTemplate->display('compose_buttons.tpl');
 }
 
 function checkInput ($show) {
@@ -1409,11 +1438,14 @@ function checkInput ($show) {
      * using $show=false, and then when i'm ready to display the error
      * message, show=true
      */
-    global $body, $send_to, $send_to_bcc, $subject, $color;
+    global $send_to, $send_to_cc, $send_to_bcc;
 
-    if ($send_to == '' && $send_to_bcc == '') {
+    $send_to = trim($send_to);
+    $send_to_cc = trim($send_to_cc);
+    $send_to_bcc = trim($send_to_bcc);
+    if (empty($send_to) && empty($send_to_cc) && empty($send_to_bcc)) {
         if ($show) {
-            plain_error_message(_("You have not filled in the \"To:\" field."), $color);
+            plain_error_message(_("You have not filled in the \"To:\" field."));
         }
         return false;
     }
@@ -1423,8 +1455,7 @@ function checkInput ($show) {
 
 /* True if FAILURE */
 function saveAttachedFiles($session) {
-    global $_FILES, $attachment_dir, $username,
-        $data_dir, $compose_messages;
+    global $composeMessage, $username, $attachment_dir;
 
     /* get out of here if no file was attached at all */
     if (! is_uploaded_file($_FILES['attachfile']['tmp_name']) ) {
@@ -1432,26 +1463,19 @@ function saveAttachedFiles($session) {
     }
 
     $hashed_attachment_dir = getHashedDir($username, $attachment_dir);
-    $localfilename = GenerateRandomString(32, '', 7);
-    $full_localfilename = "$hashed_attachment_dir/$localfilename";
-    while (file_exists($full_localfilename)) {
-        $localfilename = GenerateRandomString(32, '', 7);
-        $full_localfilename = "$hashed_attachment_dir/$localfilename";
-    }
+    $localfilename = sq_get_attach_tempfile();
+    $fullpath = $hashed_attachment_dir . '/' . $localfilename;
 
     // m_u_f works better with restricted PHP installs (safe_mode, open_basedir),
     // if that doesn't work, try a simple rename.
-    if (!@move_uploaded_file($_FILES['attachfile']['tmp_name'],$full_localfilename)) {
-        if (!@rename($_FILES['attachfile']['tmp_name'], $full_localfilename)) {
+    if (!sq_call_function_suppress_errors('move_uploaded_file', array($_FILES['attachfile']['tmp_name'], $fullpath))) {
+        if (!sq_call_function_suppress_errors('rename', array($_FILES['attachfile']['tmp_name'], $fullpath))) {
             return true;
         }
     }
-    $message = $compose_messages[$session];
     $type = strtolower($_FILES['attachfile']['type']);
     $name = $_FILES['attachfile']['name'];
-    $message->initAttachment($type, $name, $full_localfilename);
-    $compose_messages[$session] = $message;
-    sqsession_register($compose_messages , 'compose_messages');
+    $composeMessage->initAttachment($type, $name, $localfilename);
 }
 
 /* parse values like 8M and 2k into bytes */
@@ -1490,13 +1514,23 @@ function getByteSize($ini_size) {
  * In the future the responsible backend should be automaticly loaded
  * and conf.pl should show a list of available backends.
  * The message also should be constructed by the message class.
+ *
+ * @param object $composeMessage The message being sent.  Please note
+ *                               that it is passed by reference and
+ *                               will be returned modified, with additional
+ *                               headers, such as Message-ID, Date, In-Reply-To,
+ *                               References, and so forth.
+ *
+ * @return boolean FALSE if delivery failed, or some non-FALSE value
+ *                 upon success.
+ *
  */
-function deliverMessage($composeMessage, $draft=false) {
+function deliverMessage(&$composeMessage, $draft=false) {
     global $send_to, $send_to_cc, $send_to_bcc, $mailprio, $subject, $body,
-        $username, $popuser, $usernamedata, $identity, $idents, $data_dir,
-        $request_mdn, $request_dr, $default_charset, $color, $useSendmail,
-        $domain, $action, $default_move_to_sent, $move_to_sent;
-    global $imapServerAddress, $imapPort, $sent_folder, $key;
+        $username, $identity, $idents, $data_dir,
+        $request_mdn, $request_dr, $default_charset, $useSendmail,
+        $domain, $action, $default_move_to_sent, $move_to_sent,
+        $imapServerAddress, $imapPort, $sent_folder, $key;
 
     $rfc822_header = $composeMessage->rfc822_header;
 
@@ -1518,43 +1552,29 @@ function deliverMessage($composeMessage, $draft=false) {
     }
     $composeMessage->setBody($body);
 
-    if (ereg("^([^@%/]+)[@%/](.+)$", $username, $usernamedata)) {
-        $popuser = $usernamedata[1];
-        $domain  = $usernamedata[2];
-        unset($usernamedata);
-    } else {
-        $popuser = $username;
-    }
     $reply_to = '';
-    $from_mail = $idents[$identity]['email_address'];
-    $full_name = $idents[$identity]['full_name'];
     $reply_to  = $idents[$identity]['reply_to'];
-    if (!$from_mail) {
-        $from_mail = "$popuser@$domain";
-    }
-    $rfc822_header->from = $rfc822_header->parseAddress($from_mail,true);
-    if ($full_name) {
-        $from = $rfc822_header->from[0];
-        if (!$from->host) $from->host = $domain;
-        $full_name_encoded = encodeHeader($full_name);
-        if ($full_name_encoded != $full_name) {
-            $from_addr = $full_name_encoded .' <'.$from->mailbox.'@'.$from->host.'>';
-        } else {
-            $from_addr = '"'.$full_name .'" <'.$from->mailbox.'@'.$from->host.'>';
-        }
-        $rfc822_header->from = $rfc822_header->parseAddress($from_addr,true);
-    }
+    
+    $from_addr = build_from_header($identity);
+    $rfc822_header->from = $rfc822_header->parseAddress($from_addr,true);
     if ($reply_to) {
         $rfc822_header->reply_to = $rfc822_header->parseAddress($reply_to,true);
     }
     /* Receipt: On Read */
     if (isset($request_mdn) && $request_mdn) {
-        $rfc822_header->dnt = $rfc822_header->parseAddress($from_mail,true);
+        $rfc822_header->dnt = $rfc822_header->parseAddress($from_addr,true);
+    } elseif (isset($rfc822_header->dnt)) {
+        unset($rfc822_header->dnt);
     }
+
     /* Receipt: On Delivery */
-    if (isset($request_dr) && $request_dr) {
-        $rfc822_header->more_headers['Return-Receipt-To'] = $from_mail;
+    if (!empty($request_dr)) {
+//FIXME: it would be better to fiddle with headers inside of the message object or possibly when delivering the message to its destination; is this possible?
+        $rfc822_header->more_headers['Return-Receipt-To'] = $from_addr;
+    } elseif (isset($rfc822_header->more_headers['Return-Receipt-To'])) {
+        unset($rfc822_header->more_headers['Return-Receipt-To']);
     }
+
     /* multipart messages */
     if (count($composeMessage->entities)) {
         $message_body = new Message();
@@ -1588,59 +1608,70 @@ function deliverMessage($composeMessage, $draft=false) {
 
     $rfc822_header->content_type = $content_type;
     $composeMessage->rfc822_header = $rfc822_header;
+    if ($action == 'reply' || $action == 'reply_all') {
+        global $passed_id, $passed_ent_id;
+        $reply_id = $passed_id;
+        $reply_ent_id = $passed_ent_id;
+    } else {
+        $reply_id = '';
+        $reply_ent_id = '';
+    }
 
     /* Here you can modify the message structure just before we hand
-       it over to deliver */
-    $hookReturn = do_hook('compose_send', $composeMessage);
-    /* Get any changes made by plugins to $composeMessage. */
-    if ( is_object($hookReturn[1]) ) {
-        $composeMessage = $hookReturn[1];
-    }
+       it over to deliver; plugin authors note that $composeMessage
+       is sent and modified by reference since 1.5.2 */
+    do_hook('compose_send', $composeMessage);
 
     if (!$useSendmail && !$draft) {
         require_once(SM_PATH . 'class/deliver/Deliver_SMTP.class.php');
         $deliver = new Deliver_SMTP();
-        global $smtpServerAddress, $smtpPort, $pop_before_smtp;
+        global $smtpServerAddress, $smtpPort, $pop_before_smtp, $pop_before_smtp_host;
 
         $authPop = (isset($pop_before_smtp) && $pop_before_smtp) ? true : false;
+        if (empty($pop_before_smtp_host)) $pop_before_smtp_host = $smtpServerAddress;
         get_smtp_user($user, $pass);
         $stream = $deliver->initStream($composeMessage,$domain,0,
-                $smtpServerAddress, $smtpPort, $user, $pass, $authPop);
+                $smtpServerAddress, $smtpPort, $user, $pass, $authPop, $pop_before_smtp_host);
     } elseif (!$draft) {
         require_once(SM_PATH . 'class/deliver/Deliver_SendMail.class.php');
         global $sendmail_path, $sendmail_args;
+        // Check for outdated configuration
+        if (!isset($sendmail_args)) {
+            if ($sendmail_path=='/var/qmail/bin/qmail-inject') {
+                $sendmail_args = '';
+            } else {
+                $sendmail_args = '-i -t';
+            }
+        }
         $deliver = new Deliver_SendMail(array('sendmail_args'=>$sendmail_args));
         $stream = $deliver->initStream($composeMessage,$sendmail_path);
     } elseif ($draft) {
         global $draft_folder;
-        require_once(SM_PATH . 'class/deliver/Deliver_IMAP.class.php');
-        $imap_stream = sqimap_login($username, $key, $imapServerAddress,
+        $imap_stream = sqimap_login($username, false, $imapServerAddress,
                 $imapPort, 0);
         if (sqimap_mailbox_exists ($imap_stream, $draft_folder)) {
             require_once(SM_PATH . 'class/deliver/Deliver_IMAP.class.php');
             $imap_deliver = new Deliver_IMAP();
-            $length = $imap_deliver->mail($composeMessage);
-            sqimap_append ($imap_stream, $draft_folder, $length);
-            $imap_deliver->mail($composeMessage, $imap_stream);
-            sqimap_append_done ($imap_stream, $draft_folder);
+            $success = $imap_deliver->mail($composeMessage, $imap_stream, $reply_id, $reply_ent_id, $imap_stream, $draft_folder);
             sqimap_logout($imap_stream);
             unset ($imap_deliver);
             $composeMessage->purgeAttachments();
-            return $length;
+            return $success;
         } else {
             $msg  = '<br />'.sprintf(_("Error: Draft folder %s does not exist."), htmlspecialchars($draft_folder));
-            plain_error_message($msg, $color);
+            plain_error_message($msg);
             return false;
         }
     }
     $success = false;
     if ($stream) {
-        $length = $deliver->mail($composeMessage, $stream);
+        $deliver->mail($composeMessage, $stream, $reply_id, $reply_ent_id);
         $success = $deliver->finalizeStream($stream);
     }
     if (!$success) {
         // $deliver->dlv_server_msg is not always server's reply
-        $msg  = $deliver->dlv_msg;
+        $msg = _("Message not sent.") . "<br />\n" .
+            $deliver->dlv_msg;
         if (!empty($deliver->dlv_server_msg)) {
             // add 'server replied' part only when it is not empty.
             // Delivery error can be generated by delivery class itself
@@ -1648,13 +1679,66 @@ function deliverMessage($composeMessage, $draft=false) {
                 _("Server replied:") . ' ' . $deliver->dlv_ret_nr . ' ' .
                 nl2br(htmlspecialchars($deliver->dlv_server_msg));
         }
-        plain_error_message($msg, $color);
+        plain_error_message($msg);
     } else {
         unset ($deliver);
-        $move_to_sent = getPref($data_dir,$username,'move_to_sent');
-        $imap_stream = sqimap_login($username, $key, $imapServerAddress, $imapPort, 0);
+        $imap_stream = sqimap_login($username, false, $imapServerAddress, $imapPort, 0);
+
+
+        // mark as replied or forwarded if applicable
+        //
+        global $what, $iAccount, $startMessage, $passed_id, $mailbox;
+
+        if ($action=='reply' || $action=='reply_all' || $action=='forward' || $action=='forward_as_attachment') {
+            require(SM_PATH . 'functions/mailbox_display.php');
+            $aMailbox = sqm_api_mailbox_select($imap_stream, $iAccount, $mailbox,array('setindex' => $what, 'offset' => $startMessage),array());
+            switch($action) {
+            case 'reply':
+            case 'reply_all':
+                // check if we are allowed to set the \\Answered flag
+                if (in_array('\\answered',$aMailbox['PERMANENTFLAGS'], true)) {
+                    $aUpdatedMsgs = sqimap_toggle_flag($imap_stream, array($passed_id), '\\Answered', true, false);
+                    if (isset($aUpdatedMsgs[$passed_id]['FLAGS'])) {
+                        /**
+                        * Only update the cached headers if the header is
+                        * cached.
+                        */
+                        if (isset($aMailbox['MSG_HEADERS'][$passed_id])) {
+                            $aMailbox['MSG_HEADERS'][$passed_id]['FLAGS'] = $aMsg['FLAGS'];
+                        }
+                    }
+                }
+                break;
+            case 'forward':
+            case 'forward_as_attachment':
+                // check if we are allowed to set the $Forwarded flag (RFC 4550 paragraph 2.8)
+                if (in_array('$forwarded',$aMailbox['PERMANENTFLAGS'], true) ||
+                    in_array('\\*',$aMailbox['PERMANENTFLAGS'])) {
+
+                    $aUpdatedMsgs = sqimap_toggle_flag($imap_stream, array($passed_id), '$Forwarded', true, false);
+                    if (isset($aUpdatedMsgs[$passed_id]['FLAGS'])) {
+                        if (isset($aMailbox['MSG_HEADERS'][$passed_id])) {
+                            $aMailbox['MSG_HEADERS'][$passed_id]['FLAGS'] = $aMsg['FLAGS'];
+                        }
+                    }
+                }
+                break;
+            }
 
-        /* Move to sent code */
+            /**
+             * Write mailbox with updated seen flag information back to cache.
+             */
+            if(isset($aUpdatedMsgs[$passed_id])) {
+                $mailbox_cache[$iAccount.'_'.$aMailbox['NAME']] = $aMailbox;
+                sqsession_register($mailbox_cache,'mailbox_cache');
+            }
+
+        }
+
+
+        // move to sent folder
+        //
+        $move_to_sent = getPref($data_dir,$username,'move_to_sent');
         if (isset($default_move_to_sent) && ($default_move_to_sent != 0)) {
             $svr_allow_sent = true;
         } else {
@@ -1675,46 +1759,24 @@ function deliverMessage($composeMessage, $draft=false) {
         }
 
         if (($fld_sent && $svr_allow_sent && !$lcl_allow_sent) || ($fld_sent && $lcl_allow_sent)) {
-            global $passed_id, $mailbox, $action;
             if ($action == 'reply' || $action == 'reply_all') {
                 $save_reply_with_orig=getPref($data_dir,$username,'save_reply_with_orig');
                 if ($save_reply_with_orig) {
                     $sent_folder = $mailbox;
                 }
             }
-            sqimap_append ($imap_stream, $sent_folder, $length);
             require_once(SM_PATH . 'class/deliver/Deliver_IMAP.class.php');
             $imap_deliver = new Deliver_IMAP();
-            $imap_deliver->mail($composeMessage, $imap_stream);
-            sqimap_append_done ($imap_stream, $sent_folder);
+            $imap_deliver->mail($composeMessage, $imap_stream, $reply_id, $reply_ent_id, $imap_stream, $sent_folder);
             unset ($imap_deliver);
         }
 
-        global $passed_id, $mailbox, $action, $what, $iAccount,$startMessage;
 
+        // final cleanup
+        //
         $composeMessage->purgeAttachments();
-        if ($action == 'reply' || $action == 'reply_all') {
-            $aMailbox = sqm_api_mailbox_select($imap_stream, $iAccount, $mailbox,array('setindex' => $what, 'offset' => $startMessage),array());
-            //sqimap_mailbox_select ($imap_stream, $mailbox);
-            $aUpdatedMsgs = sqimap_toggle_flag($imap_stream, array($passed_id), '\\Answered', true, false);
-             if (isset($aUpdatedMsgs[$passed_id]['FLAGS'])) {
-                /**
-                 * Only update the cached headers if the header is
-                 * cached.
-                 */
-                if (isset($aMailbox['MSG_HEADERS'][$passed_id])) {
-                    $aMailbox['MSG_HEADERS'][$passed_id]['FLAGS'] = $aMsg['FLAGS'];
-                }
-            }
-            /**
-             * Write mailbox with updated seen flag information back to cache.
-             */
-            $mailbox_cache[$iAccount.'_'.$aMailbox['NAME']] = $aMailbox;
-            sqsession_register($mailbox_cache,'mailbox_cache');
-        }
         sqimap_logout($imap_stream);
+
     }
     return $success;
 }
-
-?>
\ No newline at end of file