tag since we * can't really have a body-within-body. * - * @param $attary an array of attributes and values of - * @return a modified array of attributes to be set for

+ * @param $attary an array of attributes and values of + * @param $mailbox mailbox we're currently reading (for cid2http) + * @param $message current message (for cid2http) + * @param $id current message id (for cid2http) + * @return a modified array of attributes to be set for

*/ -function sq_body2div($attary){ +function sq_body2div($attary, $mailbox, $message, $id){ $me = 'sq_body2div'; $divattary = Array('class' => "'bodyclass'"); $bgcolor = '#ffffff'; $text = '#000000'; + $has_bgc_stl = $has_txt_stl = false; $styledef = ''; if (is_array($attary) && sizeof($attary) > 0){ foreach ($attary as $attname=>$attvalue){ @@ -1286,16 +1558,25 @@ function sq_body2div($attary){ $attvalue = str_replace($quotchar, "", $attvalue); switch ($attname){ case 'background': + $attvalue = sq_cid2http($message, $id, + $attvalue, $mailbox); $styledef .= "background-image: url('$attvalue'); "; break; case 'bgcolor': + $has_bgc_stl = true; $styledef .= "background-color: $attvalue; "; break; case 'text': + $has_txt_stl = true; $styledef .= "color: $attvalue; "; break; } } + // Outlook defines a white bgcolor and no text color. This can lead to + // white text on a white bg with certain themes. + if ($has_bgc_stl && !$has_txt_stl) { + $styledef .= "color: $text; "; + } if (strlen($styledef) > 0){ $divattary{"style"} = "\"$styledef\""; } @@ -1323,8 +1604,8 @@ function sq_body2div($attary){ * @param $id message id * @return sanitized html safe to show on your pages. */ -function sq_sanitize($body, - $tag_list, +function sq_sanitize($body, + $tag_list, $rm_tags_with_content, $self_closing_tags, $force_tag_closing, @@ -1336,10 +1617,11 @@ function sq_sanitize($body, $mailbox ){ $me = 'sq_sanitize'; + $rm_tags = array_shift($tag_list); /** * Normalize rm_tags and rm_tags_with_content. */ - @array_walk($rm_tags, 'sq_casenormalize'); + @array_walk($tag_list, 'sq_casenormalize'); @array_walk($rm_tags_with_content, 'sq_casenormalize'); @array_walk($self_closing_tags, 'sq_casenormalize'); /** @@ -1347,10 +1629,9 @@ function sq_sanitize($body, * false means remove these tags * true means allow these tags */ - $rm_tags = array_shift($tag_list); $curpos = 0; $open_tags = Array(); - $trusted = "\n"; + $trusted = "\n\n"; $skip_content = false; /** * Take care of netscape's stupid javascript entities like @@ -1358,18 +1639,21 @@ function sq_sanitize($body, */ $body = preg_replace("/&(\{.*?\};)/si", "&\\1", $body); - while (($curtag=sq_getnxtag($body, $curpos)) != FALSE){ + while (($curtag = sq_getnxtag($body, $curpos)) != FALSE){ list($tagname, $attary, $tagtype, $lt, $gt) = $curtag; $free_content = substr($body, $curpos, $lt-$curpos); /** * Take care of . Edit the - * content before we apply it. - */ - $free_content = sq_fixstyle($message, $id, $free_content); + if ($tagname == "style" && $tagtype == 1){ + list($free_content, $curpos) = + sq_fixstyle($body, $gt+1, $message, $id, $mailbox); + if ($free_content != FALSE){ + $trusted .= sq_tagprint($tagname, $attary, $tagtype); + $trusted .= $free_content; + $trusted .= sq_tagprint($tagname, false, 2); + } + continue; } if ($skip_content == false){ $trusted .= $free_content; @@ -1386,13 +1670,12 @@ function sq_sanitize($body, if ($skip_content == false){ if ($tagname == "body"){ $tagname = "div"; + } + if (isset($open_tags{$tagname}) && + $open_tags{$tagname} > 0){ + $open_tags{$tagname}--; } else { - if (isset($open_tags{$tagname}) && - $open_tags{$tagname} > 0){ - $open_tags{$tagname}--; - } else { - $tagname = false; - } + $tagname = false; } } } @@ -1407,7 +1690,7 @@ function sq_sanitize($body, */ if ($tagtype == 1 && in_array($tagname, $self_closing_tags)){ - $tagtype=3; + $tagtype = 3; } /** * See if we should skip this tag and any content @@ -1417,12 +1700,20 @@ function sq_sanitize($body, in_array($tagname, $rm_tags_with_content)){ $skip_content = $tagname; } else { - if (($rm_tags == false + if (($rm_tags == false && in_array($tagname, $tag_list)) || ($rm_tags == true && !in_array($tagname, $tag_list))){ $tagname = false; } else { + /** + * Convert body into div. + */ + if ($tagname == "body"){ + $tagname = "div"; + $attary = sq_body2div($attary, $mailbox, + $message, $id); + } if ($tagtype == 1){ if (isset($open_tags{$tagname})){ $open_tags{$tagname}++; @@ -1444,13 +1735,6 @@ function sq_sanitize($body, $mailbox ); } - /** - * Convert body into div. - */ - if ($tagname == "body"){ - $tagname = "div"; - $attary = sq_body2div($attary, $message, $id); - } } } } @@ -1482,7 +1766,7 @@ function sq_sanitize($body, * @param $id the id of the message * @return a string with html safe to display in the browser. */ -function magicHTML($body, $id, $message, $mailbox = 'INBOX'){ +function magicHTML($body, $id, $message, $mailbox = 'INBOX') { global $attachment_common_show_images, $view_unsafe_images, $has_unsafe_images; /** @@ -1497,15 +1781,19 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX'){ "head", "base", "link", - "frame", - "iframe" + "frame", + "iframe", + "plaintext", + "marquee" ); $rm_tags_with_content = Array( "script", "applet", "embed", - "title" + "title", + "frameset", + "xml" ); $self_closing_tags = Array( @@ -1515,15 +1803,16 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX'){ "input" ); - $force_tag_closing = false; + $force_tag_closing = true; $rm_attnames = Array( "/.*/" => Array( - "/target/si", - "/^on.*/si", - "/^dynsrc/si", - "/^data.*/si" + "/target/i", + "/^on.*/i", + "/^dynsrc/i", + "/^data.*/i", + "/^lowsrc.*/i" ) ); @@ -1534,7 +1823,6 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX'){ "/^src|background/i" => Array( Array( - "|^([\'\"])\s*\.\./.*([\'\"])|si", "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si", "/^([\'\"])\s*mocha\s*:*.*([\'\"])/si", "/^([\'\"])\s*about\s*:.*([\'\"])/si" @@ -1549,41 +1837,44 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX'){ "/^href|action/i" => Array( Array( - "|^([\'\"])\s*\.\./.*([\'\"])|si", "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si", "/^([\'\"])\s*mocha\s*:*.*([\'\"])/si", "/^([\'\"])\s*about\s*:.*([\'\"])/si" ), Array( - "\\1#\\2", - "\\1#\\2", - "\\1#\\2", - "\\1#\\2" + "\\1#\\1", + "\\1#\\1", + "\\1#\\1", + "\\1#\\1" ) ), - "/^style/si" => + "/^style/i" => Array( Array( - "/expression/si", - "/binding/si", - "/behaviou*r/si", - "|url$([\'\"])\s*\.\./.*([\'\"])$|si", - "/url$([\'\"])\s*\S+script\s*:.*([\'\"])$/si", - "/url$([\'\"])\s*mocha\s*:.*([\'\"])$/si", - "/url$([\'\"])\s*about\s*:.*([\'\"])$/si" + "/expression/i", + "/binding/i", + "/behaviou*r/i", + "/include-source/i", + "/url\s*$\s*([\'\"])\s*\S+script\s*:.*([\'\"])\s*$/si", + "/url\s*$\s*([\'\"])\s*mocha\s*:.*([\'\"])\s*$/si", + "/url\s*$\s*([\'\"])\s*about\s*:.*([\'\"])\s*$/si" ), Array( "idiocy", "idiocy", "idiocy", - "url(\\1#\\2)", - "url(\\1#\\2)", - "url(\\1#\\2)", - "url(\\1#\\2)" + "idiocy", + "url(\\1#\\1)", + "url(\\1#\\1)", + "url(\\1#\\1)", + "url(\\1#\\1)" ) ) ) ); + if( !sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET) ) { + $view_unsafe_images = false; + } if (!$view_unsafe_images){ /** * Remove any references to http/https if view_unsafe_images set @@ -1592,18 +1883,21 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX'){ array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[0], '/^([\'\"])\s*https*:.*([\'\"])/si'); array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[1], - "\\1$secremoveimg\\2"); - array_push($bad_attvals{'/.*/'}{'/^style/si'}[0], + "\\1$secremoveimg\\1"); + array_push($bad_attvals{'/.*/'}{'/^style/i'}[0], '/url$([\'\"])\s*https*:.*([\'\"])$/si'); - array_push($bad_attvals{'/.*/'}{'/^style/si'}[1], - "url(\\1$secremoveimg\\2)"); + array_push($bad_attvals{'/.*/'}{'/^style/i'}[1], + "url(\\1$secremoveimg\\1)"); } $add_attr_to_tag = Array( - "/^a$/si" => Array('target'=>'"_new"') - ); - $trusted = sq_sanitize($body, - $tag_list, + "/^a$/i" => + Array('target'=>'"_new"', + 'title'=>'"'._("This external link will open in a new window").'"' + ) + ); + $trusted = sq_sanitize($body, + $tag_list, $rm_tags_with_content, $self_closing_tags, $force_tag_closing, @@ -1614,10 +1908,93 @@ function magicHTML($body, $id, $message, $mailbox = 'INBOX'){ $id, $mailbox ); - if (preg_match("|$secremoveimg|si", $trusted)){ + if (preg_match("|$secremoveimg|i", $trusted)){ $has_unsafe_images = true; - } + } return $trusted; } +/** + * function SendDownloadHeaders - send file to the browser + * + * Original Source: SM core src/download.php + * moved here to make it available to other code, and separate + * front end from back end functionality. + * + * @param string $type0 first half of mime type + * @param string $type1 second half of mime type + * @param string $filename filename to tell the browser for downloaded file + * @param boolean $force whether to force the download dialog to pop + * @param integer $filesize optional, send the Content-Header and length to the browser + * @return void + */ + function SendDownloadHeaders($type0, $type1, $filename, $force, $filesize=0) { + global $languages, $squirrelmail_language; + $isIE = $isIE6 = 0; + + sqgetGlobalVar('HTTP_USER_AGENT', $HTTP_USER_AGENT, SQ_SERVER); + + if (strstr($HTTP_USER_AGENT, 'compatible; MSIE ') !== false && + strstr($HTTP_USER_AGENT, 'Opera') === false) { + $isIE = 1; + } + + if (strstr($HTTP_USER_AGENT, 'compatible; MSIE 6') !== false && + strstr($HTTP_USER_AGENT, 'Opera') === false) { + $isIE6 = 1; + } + + if (isset($languages[$squirrelmail_language]['XTRA_CODE']) && + function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) { + $filename = + $languages[$squirrelmail_language]['XTRA_CODE']('downloadfilename', $filename, $HTTP_USER_AGENT); + } else { + $filename = ereg_replace('[\\/:\*\?"<>\|;]', '_', str_replace(' ', ' ', $filename)); + } + + // A Pox on Microsoft and it's Office! + if (!$force) { + // Try to show in browser window + header("Content-Disposition: inline; filename=\"$filename\""); + header("Content-Type: $type0/$type1; name=\"$filename\""); + } else { + // Try to pop up the "save as" box + // IE makes this hard. It pops up 2 save boxes, or none. + // http://support.microsoft.com/support/kb/articles/Q238/5/88.ASP + // But, accordint to Microsoft, it is "RFC compliant but doesn't + // take into account some deviations that allowed within the + // specification." Doesn't that mean RFC non-compliant? + // http://support.microsoft.com/support/kb/articles/Q258/4/52.ASP + // + // The best thing you can do for IE is to upgrade to the latest + // version + if ($isIE && !$isIE6) { + // http://support.microsoft.com/support/kb/articles/Q182/3/15.asp + // Do not have quotes around filename, but that applied to + // "attachment"... does it apply to inline too? + // + // This combination seems to work mostly. IE 5.5 SP 1 has + // known issues (see the Microsoft Knowledge Base) + header("Content-Disposition: inline; filename=$filename"); + // This works for most types, but doesn't work with Word files + header("Content-Type: application/download; name=\"$filename\""); + + // These are spares, just in case. :-) + //header("Content-Type: $type0/$type1; name=\"$filename\""); + //header("Content-Type: application/x-msdownload; name=\"$filename\""); + //header("Content-Type: application/octet-stream; name=\"$filename\""); + } else { + header("Content-Disposition: attachment; filename=\"$filename\""); + // application/octet-stream forces download for Netscape + header("Content-Type: application/octet-stream; name=\"$filename\""); + } + } + + //send the content-length header if the calling function provides it + if ($filesize > 0) { + header("Content-Length: $filesize"); + } + + } // end fn SendDownlaodHeaders + ?>

' . - _("Body retrieval error. The reason for this is most probably that the message is malformed. Please help us making future versions better by submitting this message to the developers knowledgebase!") . - " " . - _("Submit message") . ' ' . + _("Body retrieval error. The reason for this is most probably that the message is malformed.") . '
' . _("Command:") . "	$cmd
' . _("Response:") . "	$response
' . _("Message:") . "	$message
' . _("FETCH line:") . "	$topline
' . _("Command:") . "	$cmd
' . _("Response:") . "	$response
' . _("Message:") . "	$message
' . _("FETCH line:") . "	$topline