X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=functions%2Fimap_general.php;h=227bce28627f0c22783fb635f0a1cfa5678d8453;hp=5a025a887ef7f1031eac5f14578cb2d382f706d7;hb=2cefa62ab30cc730b8683ee47ec69728ab89d773;hpb=9c093ecf9121449c903f091697b7ab65f8d2e4b0

diff --git a/functions/imap_general.php b/functions/imap_general.php
index 5a025a88..227bce28 100755
--- a/functions/imap_general.php
+++ b/functions/imap_general.php
@@ -5,7 +5,7 @@
  *
  * This implements all functions that do general IMAP functions.
  *
- * @copyright © 1999-2006 The SquirrelMail Project Team
+ * @copyright 1999-2012 The SquirrelMail Project Team
  * @license http://opensource.org/licenses/gpl-license.php GNU Public License
  * @version $Id$
  * @package squirrelmail
@@ -60,11 +60,14 @@ function sqimap_run_command_list ($imap_stream, $query, $handle_errors, &$respon
         $message = $message[$tag];
         $response = $response[$tag];
         return $read[$tag];
+//FIXME: obey $handle_errors below!
     } else {
         global $squirrelmail_language, $color;
         set_up_language($squirrelmail_language);
+//FIXME: NO HTML IN CORE!
         $string = "<b><font color=\"$color[2]\">\n" .
                 _("ERROR: No available IMAP stream.") .
+//FIXME: NO HTML IN CORE!
                 "</b></font>\n";
         error_box($string);
         return false;
@@ -106,15 +109,33 @@ function sqimap_run_command ($imap_stream, $query, $handle_errors, &$response,
         $message  = $message[$tag];
 
         if (!empty($read[$tag])) {
+            /* sqimap_read_data should be called for one response
+               but since it just calls sqimap_retrieve_imap_response
+               which handles multiple responses we need to check for
+               that and merge the $read[$tag] array IF they are
+               separated and IF it was a FETCH response. */
+
+            if (isset($read[$tag][1]) && is_array($read[$tag][1]) && isset($read[$tag][1][0])
+                && preg_match('/^\* \d+ FETCH/', $read[$tag][1][0])) {
+                $result = array();
+                foreach($read[$tag] as $index => $value) {
+                    $result = array_merge($result, $read[$tag]["$index"]);
+                }
+                return $result;
+            }
+
             return $read[$tag][0];
         } else {
             return $read[$tag];
         }
+//FIXME: obey $handle_errors below!
     } else {
         global $squirrelmail_language, $color;
         set_up_language($squirrelmail_language);
+//FIXME: NO HTML IN CORE!
         $string = "<b><font color=\"$color[2]\">\n" .
                 _("ERROR: No available IMAP stream.") .
+//FIXME: NO HTML IN CORE!
                 "</b></font>\n";
         error_box($string);
         return false;
@@ -316,8 +337,10 @@ function sqimap_read_data_list($imap_stream, $tag, $handle_errors,
           &$response, &$message, $query = '') {
     global $color, $oTemplate, $squirrelmail_language;
     set_up_language($squirrelmail_language);
+//FIXME: NO HTML IN CORE!
     $string = "<b><font color=\"$color[2]\">\n" .
         _("ERROR: Bad function call.") .
+//FIXME: NO HTML IN CORE!
         "</b><br />\n" .
         _("Reason:") . ' '.
           'There is a plugin installed which make use of the  <br />' .
@@ -325,7 +348,8 @@ function sqimap_read_data_list($imap_stream, $tag, $handle_errors,
           'Please adapt the installed plugin and let it use<br />'.
           'sqimap_run_command or sqimap_run_command_list instead<br /><br />'.
           'The following query was issued:<br />'.
-           htmlspecialchars($query) . '<br />' . "</font><br />\n";
+//FIXME: NO HTML IN CORE!
+           sm_encode_html_special_chars($query) . '<br />' . "</font><br />\n";
     error_box($string);
     $oTemplate->display('footer.tpl');
     exit;
@@ -346,16 +370,18 @@ function sqimap_error_box($title, $query = '', $message_title = '', $message = '
     global $color, $squirrelmail_language;
 
     set_up_language($squirrelmail_language);
+//FIXME: NO HTML IN CORE!
     $string = "<font color=\"$color[2]\"><b>\n" . $title . "</b><br />\n";
     $cmd = explode(' ',$query);
     $cmd= strtolower($cmd[0]);
 
     if ($query != '' &&  $cmd != 'login')
-        $string .= _("Query:") . ' ' . htmlspecialchars($query) . '<br />';
+        $string .= _("Query:") . ' ' . sm_encode_html_special_chars($query) . '<br />';
     if ($message_title != '')
         $string .= $message_title;
     if ($message != '')
-        $string .= htmlspecialchars($message);
+        $string .= sm_encode_html_special_chars($message);
+//FIXME: NO HTML IN CORE!
     $string .= "</font><br />\n";
     if ($link != '')
         $string .= $link;
@@ -466,6 +492,7 @@ function sqimap_retrieve_imap_response($imap_stream, $tag, $handle_errors,
                             we prohibid that literal responses appear in the
                             outer loop so we can trust the untagged and
                             tagged info provided by $read */
+                        $read_literal = false;
                         if ($s === "}\r\n") {
                             $j = strrpos($read,'{');
                             $iLit = substr($read,$j+1,-3);
@@ -490,7 +517,9 @@ function sqimap_retrieve_imap_response($imap_stream, $tag, $handle_errors,
                             if ($read === false) { /* error */
                                 break 4; /* while while switch while */
                             }
-                            $fetch_data[] = $read;
+                            $s = substr($read,-3);
+                            $read_literal = true;
+                            continue;
                         } else {
                             $fetch_data[] = $read;
                         }
@@ -503,7 +532,7 @@ function sqimap_retrieve_imap_response($imap_stream, $tag, $handle_errors,
                         /* check for next untagged reponse and break */
                         if ($read{0} == '*') break 2;
                         $s = substr($read,-3);
-                    } while ($s === "}\r\n");
+                    } while ($s === "}\r\n" || $read_literal);
                     $s = substr($read,-3);
                 } while ($read{0} !== '*' &&
                          substr($read,0,strlen($tag)) !== $tag);
@@ -558,6 +587,7 @@ function sqimap_retrieve_imap_response($imap_stream, $tag, $handle_errors,
                 $query = '';
             }
             sqimap_error_box(_("ERROR: IMAP server closed the connection."), $query, _("Server responded:"),$sResponse);
+//FIXME: NO HTML IN CORE!
             echo '</body></html>';
             exit;
         } else if ($handle_errors) {
@@ -593,10 +623,12 @@ function sqimap_retrieve_imap_response($imap_stream, $tag, $handle_errors,
         break;
     case 'BAD':
         sqimap_error_box(_("ERROR: Bad or malformed request."), $query, _("Server responded:") . ' ', $message[$tag]);
+//FIXME: NO HTML IN CORE!
         echo '</body></html>';
         exit;
     case 'BYE':
         sqimap_error_box(_("ERROR: IMAP server closed the connection."), $query, _("Server responded:") . ' ', $message[$tag]);
+//FIXME: NO HTML IN CORE!
         echo '</body></html>';
         exit;
     default:
@@ -671,6 +703,7 @@ function sqimap_create_stream($server,$port,$tls=0) {
         set_up_language($squirrelmail_language, true);
         require_once(SM_PATH . 'functions/display_messages.php');
         logout_error( sprintf(_("Error connecting to IMAP server: %s."), $server).
+//FIXME: NO HTML IN CORE!
             "<br />\r\n$error_number : $error_string<br />\r\n",
                       sprintf(_("Error connecting to IMAP server: %s."), $server) );
         exit;
@@ -748,20 +781,51 @@ function sqimap_create_stream($server,$port,$tls=0) {
 
 /**
  * Logs the user into the IMAP server.  If $hide is set, no error messages
- * will be displayed.  This function returns the IMAP connection handle.
+ * will be displayed (if set to 1, just exits, if set to 2, returns FALSE).
+ * This function returns the IMAP connection handle.
  * @param string $username user name
  * @param string $password password encrypted with onetimepad. Since 1.5.2
  *  function can use internal password functions, if parameter is set to
  *  boolean false.
  * @param string $imap_server_address address of imap server
  * @param integer $imap_port port of imap server
- * @param boolean $hide controls display connection errors
- * @return stream
+ * @param int $hide controls display connection errors:
+ *                  0 = do not hide
+ *                  1 = show no errors (just exit)
+ *                  2 = show no errors (return FALSE)
+ *                  3 = show no errors (return error string)
+ * @return mixed The IMAP connection stream, or if the connection fails,
+ *               FALSE if $hide is set to 2 or an error string if $hide
+ *               is set to 3.
  */
 function sqimap_login ($username, $password, $imap_server_address, $imap_port, $hide) {
     global $color, $squirrelmail_language, $onetimepad, $use_imap_tls,
            $imap_auth_mech, $sqimap_capabilities;
 
+    // Note/TODO: This hack grabs the $authz argument from the session. In the short future,
+    // a new argument in function sqimap_login() will be used instead.
+    $authz = '';
+    global $authz;
+    sqgetglobalvar('authz' , $authz , SQ_SESSION);
+
+    if(!empty($authz)) {
+        /* authz plugin - specific:
+         * Get proxy login parameters from authz plugin configuration. If they
+         * exist, they will override the current ones.
+         * This is useful if we want to use different SASL authentication mechanism
+         * and/or different TLS settings for proxy logins. */
+        global $authz_imap_auth_mech, $authz_use_imap_tls, $authz_imapPort_tls;
+        $imap_auth_mech = !empty($authz_imap_auth_mech) ? strtolower($authz_imap_auth_mech) : $imap_auth_mech;
+        $use_imap_tls = !empty($authz_use_imap_tls)? $authz_use_imap_tls : $use_imap_tls;
+        $imap_port = !empty($authz_use_imap_tls)? $authz_imapPort_tls : $imap_port;
+
+        if($imap_auth_mech == 'login' || $imap_auth_mech == 'cram-md5') {
+            logout_error("Misconfigured Plugin (authz or equivalent):<br/>".
+            "The LOGIN and CRAM-MD5 authentication mechanisms cannot be used when attempting proxy login.");
+            exit;
+        }
+    }
+
     /* get imap login password */
     if ($password===false) {
         /* standard functions */
@@ -800,7 +864,7 @@ function sqimap_login ($username, $password, $imap_server_address, $imap_port, $
             // Got a challenge back
             $challenge=$response[1];
             if ($imap_auth_mech == 'digest-md5') {
-                $reply = digest_md5_response($username,$password,$challenge,'imap',$host);
+                $reply = digest_md5_response($username,$password,$challenge,'imap',$host,$authz);
             } elseif ($imap_auth_mech == 'cram-md5') {
                 $reply = cram_md5_response($username,$password,$challenge);
             }
@@ -828,22 +892,25 @@ function sqimap_login ($username, $password, $imap_server_address, $imap_port, $
         $read = sqimap_run_command ($imap_stream, $query, false, $response, $message);
     } elseif ($imap_auth_mech == 'plain') {
         /***
-         * SASL PLAIN
-         *
-         *  RFC 2595 Chapter 6
-         *
-         *  The mechanism consists of a single message from the client to the
-         *  server.  The client sends the authorization identity (identity to
-         *  login as), followed by a US-ASCII NUL character, followed by the
-         *  authentication identity (identity whose password will be used),
-         *  followed by a US-ASCII NUL character, followed by the clear-text
-         *  password.  The client may leave the authorization identity empty to
-         *  indicate that it is the same as the authentication identity.
+         * SASL PLAIN, RFC 4616 (updates 2595)
          *
-         **/
+         * The mechanism consists of a single message, a string of [UTF-8]
+         * encoded [Unicode] characters, from the client to the server.  The
+         * client presents the authorization identity (identity to act as),
+         * followed by a NUL (U+0000) character, followed by the authentication
+         * identity (identity whose password will be used), followed by a NUL
+         * (U+0000) character, followed by the clear-text password.  As with
+         * other SASL mechanisms, the client does not provide an authorization
+         * identity when it wishes the server to derive an identity from the
+         * credentials and use that as the authorization identity.
+         */
         $tag=sqimap_session_id(false);
         $sasl = (isset($sqimap_capabilities['SASL-IR']) && $sqimap_capabilities['SASL-IR']) ? true : false;
-        $auth = base64_encode("$username\0$username\0$password");
+        if(!empty($authz)) {
+            $auth = base64_encode("$username\0$authz\0$password");
+        } else {
+            $auth = base64_encode("$username\0$username\0$password");
+        }
         if ($sasl) {
             // IMAP Extension for SASL Initial Client Response
             // <draft-siemborski-imap-sasl-initial-response-01b.txt>
@@ -862,6 +929,7 @@ function sqimap_login ($username, $password, $imap_server_address, $imap_port, $
         $results=explode(" ",$read,3);
         $response=$results[1];
         $message=$results[2];
+
     } else {
         $response="BAD";
         $message="Internal SquirrelMail error - unknown IMAP authentication method chosen.  Please contact the developers.";
@@ -869,20 +937,23 @@ function sqimap_login ($username, $password, $imap_server_address, $imap_port, $
 
     /* If the connection was not successful, lets see why */
     if ($response != 'OK') {
-        if (!$hide) {
+        if (!$hide || $hide == 3) {
+//FIXME: UUURG... We don't want HTML in error messages, should also do html sanitizing of error messages elsewhere; should't assume output is destined for an HTML browser here
             if ($response != 'NO') {
                 /* "BAD" and anything else gets reported here. */
-                $message = htmlspecialchars($message);
+                $message = sm_encode_html_special_chars($message);
                 set_up_language($squirrelmail_language, true);
                 if ($response == 'BAD') {
+                    if ($hide == 3) return sprintf(_("Bad request: %s"), $message);
                     $string = sprintf (_("Bad request: %s")."<br />\r\n", $message);
                 } else {
+                    if ($hide == 3) return sprintf(_("Unknown error: %s"), $message);
                     $string = sprintf (_("Unknown error: %s") . "<br />\n", $message);
                 }
                 if (isset($read) && is_array($read)) {
                     $string .= '<br />' . _("Read data:") . "<br />\n";
                     foreach ($read as $line) {
-                        $string .= htmlspecialchars($line) . "<br />\n";
+                        $string .= sm_encode_html_special_chars($line) . "<br />\n";
                     }
                 }
                 error_box($string);
@@ -901,13 +972,15 @@ function sqimap_login ($username, $password, $imap_server_address, $imap_port, $
 
                 set_up_language($squirrelmail_language, true);
                 sqsession_destroy();
-                sqsetcookieflush();
+
                 /* terminate the session nicely */
                 sqimap_logout($imap_stream);
+                if ($hide == 3) return _("Unknown user or password incorrect.");
                 logout_error( _("Unknown user or password incorrect.") );
                 exit;
             }
         } else {
+            if ($hide == 2) return FALSE;
             exit;
         }
     }
@@ -1006,30 +1079,31 @@ function sqimap_get_delimiter ($imap_stream = false) {
 
     /* Do some caching here */
     if (!$sqimap_delimiter) {
-        if (sqimap_capability($imap_stream, 'NAMESPACE')) {
+        if (sqimap_capability($imap_stream, 'NAMESPACE')
             /*
              * According to something that I can't find, this is supposed to work on all systems
              * OS: This won't work in Courier IMAP.
              * OS: According to rfc2342 response from NAMESPACE command is:
              * OS: * NAMESPACE (PERSONAL NAMESPACES) (OTHER_USERS NAMESPACE) (SHARED NAMESPACES)
              * OS: We want to lookup all personal NAMESPACES...
+             *
+             * TODO: remove this in favour of the information from sqimap_get_namespace()
              */
-            $read = sqimap_run_command($imap_stream, 'NAMESPACE', true, $a, $b);
-            if (eregi('\\* NAMESPACE +(\\( *\\(.+\\) *\\)|NIL) +(\\( *\\(.+\\) *\\)|NIL) +(\\( *\\(.+\\) *\\)|NIL)', $read[0], $data)) {
-                if (eregi('^\\( *\\((.*)\\) *\\)', $data[1], $data2)) {
-                    $pn = $data2[1];
-                }
-                $pna = explode(')(', $pn);
-                while (list($k, $v) = each($pna)) {
-                    $lst = explode('"', $v);
-                    if (isset($lst[3])) {
-                        $pn[$lst[1]] = $lst[3];
-                    } else {
-                        $pn[$lst[1]] = '';
-                    }
+         && ($read = sqimap_run_command($imap_stream, 'NAMESPACE', true, $a, $b))
+         && preg_match('/\* NAMESPACE +(\( *\(.+\) *\)|NIL) +(\( *\(.+\) *\)|NIL) +(\( *\(.+\) *\)|NIL)/i', $read[0], $data)
+         && preg_match('/^\( *\((.*)\) *\)/', $data[1], $data2)) {
+            $pn = $data2[1];
+            $pna = explode(')(', $pn);
+            $delnew = array();
+            while (list($k, $v) = each($pna)) {
+                $lst = explode('"', $v);
+                if (isset($lst[3])) {
+                    $delnew[$lst[1]] = $lst[3];
+                } else {
+                    $delnew[$lst[1]] = '';
                 }
             }
-            $sqimap_delimiter = $pn[0];
+            $sqimap_delimiter = array_shift($delnew);
         } else {
             fputs ($imap_stream, ". LIST \"INBOX\" \"\"\r\n");
             $read = sqimap_read_data($imap_stream, '.', true, $a, $b);
@@ -1041,6 +1115,71 @@ function sqimap_get_delimiter ($imap_stream = false) {
     return $sqimap_delimiter;
 }
 
+/**
+ * Retrieves the namespaces from the IMAP server.
+ * NAMESPACE is an IMAP extension defined in RFC 2342.
+ *
+ * @param stream $imap_stream
+ * @return array
+ */
+function sqimap_get_namespace($imap_stream) {
+    $read = sqimap_run_command($imap_stream, 'NAMESPACE', true, $a, $b);
+    return sqimap_parse_namespace($read[0]);
+}
+
+/**
+ * Parses a NAMESPACE response and returns an array with the available
+ * personal, users and shared namespaces.
+ *
+ * @param string $input
+ * @return array The returned array has the following format:
+ * <pre>
+ * array(
+ *   'personal' => array(
+ *       0 => array('prefix'=>'INBOX.','delimiter' =>'.'),
+ *       1 => ...
+ *    ),
+ *    'users' => array(..
+ *    ),
+ *    'shared' => array( ..
+ *    )
+ * )
+ * </pre>
+ * Note that if a namespace is not defined in the server, then the corresponding
+ * array will be empty.
+ */
+function sqimap_parse_namespace(&$input) {
+    $ns_strings = array(1=>'personal', 2=>'users', 3=>'shared');
+    $namespace = array();
+
+    if (preg_match('/NAMESPACE (\(\(.*\)\)|NIL) (\(\(.*\)\)|NIL) (\(\(.*\)\)|NIL)/', $input, $regs)) {
+        for($i=1; $i<=3; $i++) {
+            if($regs[$i] == 'NIL') {
+                $namespace[$ns_strings[$i]] = array();
+            } else {
+                // Pop-out the first ( and last ) for easier parsing
+                $ns = substr($regs[$i], 1, sizeof($regs[$i])-2);
+                if($c = preg_match_all('/\((?:(.*?)\s*?)\)/', $ns, $regs2)) {
+                    $namespace[$ns_strings[$i]] = array();
+                    for($j=0; $j<sizeof($regs2[1]); $j++) {
+                        preg_match('/"(.*)"\s+("(.*)"|NIL)/', $regs2[1][$j], $regs3);
+                        $namespace[$ns_strings[$i]][$j]['prefix'] = $regs3[1];
+                        if($regs3[2] == 'NIL') {
+                            $namespace[$ns_strings[$i]][$j]['delimiter'] = null;
+                        } else {
+                            // $regs[3] is $regs[2] without the quotes
+                            $namespace[$ns_strings[$i]][$j]['delimiter'] = $regs3[3];
+                        }
+                        unset($regs3);
+                    }
+                }
+                unset($ns);
+            }
+        }
+    }
+    return($namespace);
+}
+
 /**
  * This encodes a mailbox name for use in IMAP commands.
  * @param string $what the mailbox to encode
@@ -1049,7 +1188,7 @@ function sqimap_get_delimiter ($imap_stream = false) {
  */
 function sqimap_encode_mailbox_name($what)
 {
-    if (ereg("[\"\\\r\n]", $what))
+    if (preg_match('/["\\\r\n]/', $what))
         return '{' . strlen($what) . "}\r\n" . $what;        /* 4.3 literal form */
     return '"' . $what . '"';        /* 4.3 quoted string form */
 }
@@ -1172,7 +1311,7 @@ function sqimap_status_messages ($imap_stream, $mailbox,
     if (!empty($hook_status)) {
          $hook_status['MAILBOX']=$mailbox;
          $hook_status['CALLER']='sqimap_status_messages';
-         do_hook_function('folder_status',$hook_status);
+         do_hook('folder_status', $hook_status);
     }
     return $status;
 }
@@ -1242,7 +1381,8 @@ function sqimap_append_checkresponse($response, $sMailbox, $sid='', $query='') {
                 if ($sRsp == 'NO' || $sRsp == 'BAD') {
                     // for the moment disabled. Enable after 1.5.1 release.
                     // Notices could give valueable information about the mailbox
-                    // sqm_trigger_imap_error('SQM_IMAP_APPEND_NOTICE',$imapquery,$sRsp,$sMsg);
+                    // Update: seems this was forgotten, but now it is finally enabled
+                    sqm_trigger_imap_error('SQM_IMAP_APPEND_NOTICE',$imapquery,$sRsp,$sMsg);
                 }
                 $bDone = false;
             case $imapsid:
@@ -1310,6 +1450,7 @@ function sqimap_get_user_server ($imap_server, $username) {
  * @since 1.3.0
  */
 function map_yp_alias($username) {
-   $yp = `ypmatch $username aliases`;
+   $safe_username = escapeshellarg($username);
+   $yp = `ypmatch $safe_username aliases`;
    return chop(substr($yp, strlen($username)+1));
 }