X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=config%2Fconf.pl;h=2d32e2507ea2fe30956518794f8f917729fbba1b;hp=771289b5ea7f0342d36dc8524939b67c55f22319;hb=fbd01364c19ae4bf20d152c11f25b3f865443e11;hpb=775a1f52b3e6224cba9fe8f32c9ff0527c6076e7

diff --git a/config/conf.pl b/config/conf.pl
index 771289b5..2d32e250 100755
--- a/config/conf.pl
+++ b/config/conf.pl
@@ -1,7 +1,7 @@
 #!/usr/bin/env perl
 # conf.pl
 #
-# Copyright (c) 1999-2007 The SquirrelMail Project Team
+# Copyright (c) 1999-2009 The SquirrelMail Project Team
 # Licensed under the GNU GPL. For full terms see COPYING.
 #
 # A simple configure script to configure SquirrelMail
@@ -435,6 +435,8 @@ $use_iframe = 'false'                   if ( !$use_iframe );
 $lossy_encoding = 'false'               if ( !$lossy_encoding );
 $allow_remote_configtest = 'false'      if ( !$allow_remote_configtest );
 $secured_config = 'true'                if ( !$secured_config );
+$sq_https_port = 443                    if ( !$sq_https_port );
+$sq_ignore_http_x_forwarded_headers = 'true' if ( !$sq_ignore_http_x_forwarded_headers );
 
 $sm_debug_mode = 'SM_DEBUG_MODE_MODERATE' if ( !$sm_debug_mode );
 #FIXME: When this is STABLE software, remove the line above and uncomment the one below:
@@ -545,7 +547,7 @@ $list_supported_imap_servers =
 
 #####################################################################################
 if ( $config_use_color == 1 ) {
-    $WHT = "\x1B[37;1m";
+    $WHT = "\x1B[1m";
     $NRM = "\x1B[0m";
 } else {
     $WHT              = "";
@@ -862,6 +864,8 @@ while ( ( $command ne "q" ) && ( $command ne "Q" ) && ( $command ne ":q" ) ) {
         print "7.  Allow remote configtest     : $WHT$allow_remote_configtest$NRM\n";
         print "8.  Debug mode                  : $WHT$sm_debug_mode$NRM\n";
         print "9.  Secured configuration mode  : $WHT$secured_config$NRM\n";
+        print "10. HTTPS port                  : $WHT$sq_https_port$NRM\n";
+        print "11. Ignore HTTP_X_FORWARDED headers: $WHT$sq_ignore_http_x_forwarded_headers$NRM\n";
         print "\n";
         print "R   Return to Main Menu\n";
     }
@@ -902,7 +906,7 @@ while ( ( $command ne "q" ) && ( $command ne "Q" ) && ( $command ne ":q" ) ) {
             $NRM              = "";
         } else {
             $config_use_color = 1;
-            $WHT              = "\x1B[37;1m";
+            $WHT              = "\x1B[1m";
             $NRM              = "\x1B[0m";
         }
     } elsif ( $command =~ /^w([0-9]+)/ ) {
@@ -1040,6 +1044,8 @@ while ( ( $command ne "q" ) && ( $command ne "Q" ) && ( $command ne ":q" ) ) {
             elsif ( $command == 7 ) { $allow_remote_configtest = commandB7(); }
             elsif ( $command == 8 ) { $sm_debug_mode = commandB8(); }
             elsif ( $command == 9 ) { $secured_config = commandB9(); }
+            elsif ( $command == 10 ) { $sq_https_port = commandB10(); }
+            elsif ( $command == 11 ) { $sq_ignore_http_x_forwarded_headers = commandB11(); }
         }
     }
 }
@@ -1741,17 +1747,22 @@ sub display_use_tls($) {
 
 # $encode_header_key
 sub command114 {
-    print "Encryption key allows to hide SquirrelMail Received: headers\n";
-    print "in outbound messages. Interface uses encryption key to encode\n";
-    print "username, remote address and proxied address, then stores encoded\n";
-    print "information in X-Squirrel-* headers.\n";
+    print "This encryption key allows the hiding of SquirrelMail Received:\n";
+    print "headers in outbound messages.  SquirrelMail uses the encryption\n";
+    print "key to encode the username, remote address, and proxied address\n";
+    print "and then stores that encoded information in X-Squirrel-* headers.\n";
     print "\n";
-    print "Warning: used encryption function is not bulletproof. When used\n";
-    print "with static encryption keys, it provides only minimal security\n";
-    print "measures and information can be decoded quickly.\n";
+    print "Warning: the encryption function used to accomplish this is not\n";
+    print "bulletproof. When used with a static encryption key as it is here,\n";
+    print "it provides only minimal security and the encoded user information\n";
+    print "in the X-Squirrel-* headers can be decoded quickly by a skilled\n";
+    print "attacker.\n";
     print "\n";
-    print "Encoded information can be decoded with decrypt_headers.php script\n";
-    print "from SquirrelMail contrib/ directory.\n";
+    print "When you need to inspect an email sent from your system with the\n";
+    print "X-Squirrel-* headers, you can decode the user information therein\n";
+    print "by using the decrypt_headers.php script found in the SquirrelMail\n";
+    print "contrib/ directory. You'll need the encryption key that you\n";
+    print "defined here when doing so.\n";
     print "\n";
     print "Enter encryption key: ";
     $new_encode_header_key = <STDIN>;
@@ -2533,7 +2544,8 @@ sub command310 {
 }
 
 sub command311 {
-    print "  Given that users are not allowed to modify their
+    print "$NRM";
+    print "\n  Given that users are not allowed to modify their
   email address, can they edit their full name?
 
   ";
@@ -2554,17 +2566,23 @@ sub command311 {
 }
 
 sub command311b {
-    print "  SquirrelMail adds username information to every sent email
-  in order to prevent possible sender forging when users are allowed
-  to change their email and/or full name.
+    print "$NRM";
+    print "\n  SquirrelMail adds username information to every outgoing
+  email in order to prevent possible sender forging when users are
+  allowed to change their email and/or full name.
 
-  You can remove user information from this header (y), if you think that
+  You can remove user information from this header (y) if you think that
   it violates privacy or security.
 
   Note: If users are allowed to change their email addresses,
   this setting will make it difficult to determine who sent what where.
   Use at your own risk.
 
+  Note: If you have defined a header encryption key in your SMTP or
+  Sendmail settings (see the \"Server Settings\" option page), this
+  setting is ignored because all user information in outgoing messages
+  is encoded.
+
   ";
 
     if ( lc($hide_auth_header) eq "true" ) {
@@ -4626,6 +4644,65 @@ sub commandB9 {
     return $secured_config;
 }
 
+# Set a (non-standard) HTTPS port
+sub commandB10 {
+    print "If you run HTTPS (SSL-secured HTTP) on a non-standard port, you should\n";
+    print "indicate that port here.  Even if you do not, SquirrelMail may still\n";
+    print "auto-detect secure connections, but it is safer and also very useful\n";
+    print "for third party plugins if you specify the port number here.\n";
+    print "\n";
+    print "Most SquirrelMail administrators will not need to use this setting\n";
+    print "because most all web servers use port 443 for HTTPS connections, and\n";
+    print "SquirrelMail assumes 443 unless something else is given here.\n";
+    print "\n";
+
+    print "Enter your HTTPS port [$sq_https_port]: ";
+    my $tmp = <STDIN>;
+    $tmp = trim($tmp);
+    # value is not modified, if user hits Enter or enters space
+    if ($tmp ne '') {
+        # make sure that input is numeric
+        if ($tmp =~ /^\d+$/) {
+            $sq_https_port = $tmp;
+        } else {
+            print "\n";
+            print "--- INPUT ERROR ---\n";
+            print "\n";
+            print "If you want to change this setting, you must enter a number.\n";
+            print "If you want to keep the original value, just press Enter.\n\n";
+            print "Press Enter to continue...";
+            $tmp = <STDIN>;
+        }
+    }
+    return $sq_https_port;
+}
+
+# Ignore HTTP_X_FORWARDED_* headers?
+sub commandB11 {
+
+    if ( lc($sq_ignore_http_x_forwarded_headers) eq 'true' ) {
+        $default_value = "y";
+    } else {
+        $default_value = "n";
+    }
+
+    print "Because HTTP_X_FORWARDED_* headers can be sent by the client and\n";
+    print "therefore possibly exploited by an outsider, SquirrelMail ignores\n";
+    print "them by default. If a proxy server or other machine sits between\n";
+    print "clients and your SquirrelMail server, you can turn this off to\n";
+    print "tell SquirrelMail to use such headers.\n";
+    print "\n";
+
+    print "Ignore HTTP_X_FORWARDED headers? (y/n) [$WHT$default_value$NRM]: $WHT";
+    $sq_ignore_http_x_forwarded_headers = <STDIN>;
+    if ( ( $sq_ignore_http_x_forwarded_headers =~ /^y\n/i ) || ( ( $sq_ignore_http_x_forwarded_headers =~ /^\n/ ) && ( $default_value eq "y" ) ) ) {
+        $sq_ignore_http_x_forwarded_headers = 'true';
+    } else {
+        $sq_ignore_http_x_forwarded_headers = 'false';
+    }
+    return $sq_ignore_http_x_forwarded_headers;
+}
+
 sub save_data {
     $tab = "    ";
     if ( open( CF, ">config.php" ) ) {
@@ -5035,6 +5112,10 @@ sub save_data {
         # boolean
         print CF "\$allow_remote_configtest = $allow_remote_configtest;\n";
         print CF "\$secured_config = $secured_config;\n";
+        # integer
+        print CF "\$sq_https_port = $sq_https_port;\n";
+        # boolean
+        print CF "\$sq_ignore_http_x_forwarded_headers = $sq_ignore_http_x_forwarded_headers;\n";
         # (binary) integer or constant - convert integer 
         # values to constants before output
         $sm_debug_mode = convert_debug_binary_integer_to_constants($sm_debug_mode);
@@ -5254,12 +5335,13 @@ sub set_defaults {
 # the SM directory tree, the SM_PATH variable will be
 # prepended to the path, if not, then the path will be
 # converted to an absolute path, e.g.
-#   '../images/logo.gif'      --> SM_PATH . 'images/logo.gif'
-#   '../../someplace/data'    --> '/absolute/path/someplace/data'
-#   'images/logo.gif'         --> SM_PATH . 'config/images/logo.gif'
-#   '/absolute/path/logo.gif' --> '/absolute/path/logo.gif'
-#   'http://whatever/'        --> 'http://whatever'
-#   $some_var/path            --> "$some_var/path"
+#   '../images/logo.gif'        --> SM_PATH . 'images/logo.gif'
+#   '../../someplace/data'      --> '/absolute/path/someplace/data'
+#   'images/logo.gif'           --> SM_PATH . 'config/images/logo.gif'
+#   '/absolute/path/logo.gif'   --> '/absolute/path/logo.gif'
+#   'C:\absolute\path\logo.gif' --> 'C:\absolute\path\logo.gif'
+#   'http://whatever/'          --> 'http://whatever'
+#   $some_var/path              --> "$some_var/path"
 sub change_to_SM_path() {
     my ($old_path) = @_;
     my $new_path = '';
@@ -5270,7 +5352,7 @@ sub change_to_SM_path() {
     # If the path is absolute, don't bother.
     return "\'" . $old_path . "\'"  if ( $old_path eq '');
     return "\'" . $old_path . "\'"  if ( $old_path =~ /^(\/|http)/ );
-    return "\'" . $old_path . "\'"  if ( $old_path =~ /^\w:\// );
+    return "\'" . $old_path . "\'"  if ( $old_path =~ /^\w:(\\|\/)/ );
     return $old_path                if ( $old_path =~ /^\'(\/|http)/ );
     return $old_path                if ( $old_path =~ /^\'\w:\// );
     return $old_path                if ( $old_path =~ /^SM_PATH/);