XSS fix based on Jason's fix

[squirrelmail.git] / src / search.php

diff --git a/src/search.php b/src/search.php
index 3acc5b1262274dc0fea371b4eb4e21e19dcd48c4..4a074871e36e9aad6a8f07c60fda963a38e302a4 100644 (file)
--- a/src/search.php
+++ b/src/search.php
@@ -9,17 +9,20 @@
  * $Id$
  */
 
-require_once('../src/validate.php');
-require_once('../functions/imap.php');
-require_once('../functions/imap_search.php');
-require_once('../functions/imap_mailbox.php');
-require_once('../functions/array.php');
-require_once('../functions/strings.php');
+/* Path for SquirrelMail required files. */
+define('SM_PATH','../');
+
+/* SquirrelMail required files. */
+require_once(SM_PATH . 'include/validate.php');
+require_once(SM_PATH . 'functions/imap.php');
+require_once(SM_PATH . 'functions/imap_search.php');
+require_once(SM_PATH . 'functions/imap_mailbox.php');
+require_once(SM_PATH . 'functions/array.php');
+require_once(SM_PATH . 'functions/strings.php');
 
 global $allow_thread_sort;
 
 /*  here are some functions, could go in imap_search.php
-
     this was here, pretty handy  */
 function s_opt( $val, $sel, $tit ) {
     echo "            <option value=\"$val\"";
@@ -102,7 +105,7 @@ function forget_recent($forget_index, $username, $data_dir) {
     $attributes = get_recent( $username, $data_dir);
     reset($types);
     foreach ($types as $key) {
-        array_splice($attributes[$key], $forget_index, 1);
+        array_splice($attributes[$key], $forget_index - 1, 1);
         array_unshift($attributes[$key], '');
     }
     reset($types);
@@ -173,9 +176,11 @@ function printSearchMessages($msgs,$mailbox, $cnt, $imapConnection, $where, $wha
 
 
        $msg_cnt_str = get_msgcnt_str(1, $cnt, $cnt);
+       $toggle_all = get_selectall_link(1, $sort);
 
+       echo '<table bgcolor="' . $color[0] . '" border="0" width="100%" cellpadding="1" cellspacing="0"><tr><td>';
        mail_message_listing_beginning($imapConnection, $mailbox, $sort, 
-                                       $msg_cnt_str, '', 1);
+                                       $msg_cnt_str, $toggle_all, 1);
 
 
        printHeader($mailbox, 6, $color, false);
@@ -184,6 +189,8 @@ function printSearchMessages($msgs,$mailbox, $cnt, $imapConnection, $where, $wha
                          $msort, $mailbox, $sort, $color, $cnt, $where, $what);
 
        mail_message_listing_end($cnt, '', $msg_cnt_str, $color); 
+       echo '</td></tr></table>';
+       
     }
 }                            
 
@@ -196,6 +203,31 @@ $search_all = 'none';
 $perbox_count = array ();
 $recent_count = getPref($data_dir, $username, 'search_memory', 0);
 
+/* get globals we may need */
+
+$key = $_COOKIE['key'];
+$username = $_SESSION['username'];
+$onetimepad = $_SESSION['onetimepad'];
+$delimiter = $_SESSION['delimiter'];
+
+if (isset($_GET['mailbox'])) {
+    $mailbox = strip_tags($_GET['mailbox']);
+}
+if (isset($_GET['submit'])) {
+    $submit = strip_tags($_GET['submit']);
+}
+if (isset($_GET['what'])) {
+    $what = $_GET['what'];
+}
+if (isset($_GET['where'])) {
+    $where = strip_tags($_GET['where']);
+}
+if (isset($_GET['checkall'])) {
+    $checkall = strip_tags($_GET['checkall']);
+}
+if (isset($_GET['count'])) {
+    $count = strip_tags($_GET['count']);
+}
 
 /*  get mailbox names  */
 $imapConnection = sqimap_login($username, $key, $imapServerAddress, $imapPort, 0);
@@ -240,8 +272,7 @@ elseif ($submit == 'delete') {
 
 do_hook('search_before_form');
 
-echo "<br>\n".
-     html_tag( 'table',
+echo html_tag( 'table',
          html_tag( 'tr', "\n" .
              html_tag( 'td', '<b>' . _("Search") . '</b>', 'center', $color[0] )
          ) ,
@@ -274,9 +305,9 @@ if ($saved_count > 0) {
         . html_tag( 'td', $saved_attributes['saved_where'][$i], 'center' )
         . html_tag( 'td', '', 'right' )
         .   '<a href=search.php'
-        .     '?mailbox=' . urlencode($saved_attributes['saved_folder'][$i])
-        .     '&amp;what=' . urlencode($saved_attributes['saved_what'][$i])
-        .     '&amp;where=' . urlencode($saved_attributes['saved_where'][$i])
+        .     '?mailbox=' . htmlentities($saved_attributes['saved_folder'][$i])
+        .     '&amp;what=' . htmlentities($saved_attributes['saved_what'][$i])
+        .     '&amp;where=' . htmlentities($saved_attributes['saved_where'][$i])
         .   '>' . _("edit") . '</a>'
         .   '&nbsp;|&nbsp;'
         .   '<a href=search.php'