4) XSS in help.php:

[squirrelmail.git] / src / help.php

diff --git a/src/help.php b/src/help.php
index b60902b5ff88d97f18decdf1f8613903825412ba..88b92f197c116fcca25400aa117bf16e730957e4 100644 (file)
--- a/src/help.php
+++ b/src/help.php
@@ -11,10 +11,14 @@
  * $Id$
  */
 
-require_once('../src/validate.php');
-require_once('../functions/display_messages.php');
-require_once('../functions/imap.php');
-require_once('../functions/array.php');
+/* Path for SquirrelMail required files. */
+define('SM_PATH','../');
+
+/* SquirrelMail required files. */
+require_once(SM_PATH . 'include/validate.php');
+require_once(SM_PATH . 'functions/display_messages.php');
+require_once(SM_PATH . 'functions/imap.php');
+require_once(SM_PATH . 'functions/array.php');
 
 displayPageHeader($color, 'None' );
 
@@ -37,6 +41,7 @@ $helpdir[8] = 'FAQ.hlp';
  */
 
 function get_info($doc, $pos) {
+
     for ($n=$pos; $n < count($doc); $n++) {
         if (trim(strtolower($doc[$n])) == '<chapter>'
             || trim(strtolower($doc[$n])) == '<section>') {
@@ -66,39 +71,37 @@ function get_info($doc, $pos) {
             }
             if (isset($ary)) {
                 $ary[3] = $n;
-                return $ary;
             } else {
-                $ary[0] = 'ERROR: Help files are not in the right format!';
-                $ary[1] = 'ERROR: Help files are not in the right format!';
-                $ary[2] = 'ERROR: Help files are not in the right format!';
-                return $ary;
+                $ary[0] = _("ERROR: Help files are not in the right format!");
+                $ary[1] = $ary[0];
+                $ary[2] = $ary[0];
             }
+           return( $ary );
         }
     }
-    $ary[0] = 'ERROR: Help files are not in the right format!';
-    $ary[1] = 'ERROR: Help files are not in the right format!';
-    return $ary;
+    
+    $ary[0] = _("ERROR: Help files are not in the right format!");
+    $ary[1] = $ary[0];
+
+    return( $ary );
 }
 
 /**************[ END HELP FUNCTIONS ]******************/
 
-?>
 
-<br>
-<table width="95%" align="center" cellpadding="2" cellspacing="2" border="0">
- <tr>
-  <td bgcolor="<?php echo $color[0] ?>">
-   <center><b><?php echo _("Help") ?></b></center>
-  </td>
- </tr>
-</table>
-
-<?php do_hook("help_top") ?>
-
-<table width="90%" cellpadding="0" cellspacing="10" border="0" align="center">
-<tr>
-<td>
-<?php 
+
+echo html_tag( 'table',
+        html_tag( 'tr',
+            html_tag( 'td','<center><b>' . _("Help") .'</b></center>', 'center', $color[0] )
+        ) ,
+    'center', '', 'width="95%" cellpadding="1" cellspacing="2" border="0"' );
+
+do_hook("help_top");
+
+echo html_tag( 'table', '', 'center', '', 'width="90%" cellpadding="0" cellspacing="10" border="0"' ) .
+        html_tag( 'tr' ) .
+            html_tag( 'td' );
+
 if (isset($HTTP_REFERER)) {
     $ref = strtolower($HTTP_REFERER);
     if (strpos($ref, 'src/compose')){
@@ -162,19 +165,25 @@ if ($help_exists == true) {
         $chapter = 3;
     } else if ($context == 'search'){
         $chapter = 8;
+    } else if ( isset( $_GET['chapter'] ) ) {
+       $chapter = intval( $_GET['chapter']);
+    } else {
+       $chapter = 0;
     }
 
-    if (!isset($chapter)) {
-        echo '<table cellpadding="0" cellspacing="0" border="0" align="center"><tr><td>' .
-             '<b><center>' . _("Table of Contents") . '</center></b><br>';
+    if ( $chapter == 0 || !isset( $helpdir[$chapter] ) ) {
+        echo html_tag( 'table', '', 'center', '', 'cellpadding="0" cellspacing="0" border="0"' );
+                   html_tag( 'tr' ) .
+                        html_tag( 'td' ) .
+                             '<b><center>' . _("Table of Contents") . '</center></b><br>';
         do_hook('help_chapter');
-        echo '<ol>';
+        echo html_tag( 'ol' );
         for ($i=0; $i < count($helpdir); $i++) {
             $doc = file("../help/$user_language/$helpdir[$i]");
             $help_info = get_info($doc, 0);
             echo '<li><a href="../src/help.php?chapter=' . ($i+1)
-                 . '">' . $help_info[0] . '</a>';
-                 echo '<ul>' . $help_info[2] . '</ul>';
+                 . '">' . $help_info[0] . '</a>' .
+                 html_tag( 'ul', $help_info[2] );
         }
         echo '</ol></td></tr></table>';
     } else {
@@ -202,17 +211,15 @@ if ($help_exists == true) {
         if (isset($help_info[1])){
             echo $help_info[1];
         } else {
-            echo '<p>' . $help_info[2] . '</p>';
+            echo html_tag( 'p', $help_info[2], 'left' );
         }
              
         $section = 0;
         for ($n = $help_info[3]; $n < count($doc); $n++) {
             $section++;
             $help_info = get_info($doc, $n);
-            echo "<b>$chapter.$section - $help_info[0]</b>";
-            echo '<ul>';
-            echo $help_info[1];
-            echo '</ul>';
+            echo "<b>$chapter.$section - $help_info[0]</b>" .
+                html_tag( 'ul', $help_info[1] );
             $n = $help_info[3];
         }
 
@@ -220,7 +227,9 @@ if ($help_exists == true) {
     }
 }
 do_hook('help_bottom');
+
+echo html_tag( 'tr',
+            html_tag( 'td', '&nbsp;', 'left', $color[0] )
+        ).
+       '</table></body></html>';
 ?>
-<tr><td bgcolor="<?php echo $color[0] ?>">&nbsp;</td></tr></table>
-<td></tr></table>
-</body></html>