X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=functions%2Fpage_header.php;h=0cf4fb725cc160bd0dfa98975189b6ecf8400f3d;hp=510b4f56937c3e605bfd9cf30323cb660efe15de;hb=6881bcbd08b766c0f234b0207279f2fcd0b34aa1;hpb=dd268e20666b3470933b645964c982ecf0de43a3 diff --git a/functions/page_header.php b/functions/page_header.php index 510b4f56..0cf4fb72 100644 --- a/functions/page_header.php +++ b/functions/page_header.php @@ -5,7 +5,7 @@ * * Prints the page header (duh) * - * @copyright © 1999-2006 The SquirrelMail Project Team + * @copyright 1999-2017 The SquirrelMail Project Team * @license http://opensource.org/licenses/gpl-license.php GNU Public License * @version $Id$ * @package squirrelmail @@ -24,55 +24,114 @@ include_once(SM_PATH . 'functions/imap_mailbox.php'); * @param string xtra extra HTML to insert into the header * @param bool do_hook whether to execute hooks, default true * @param bool frames generate html frameset doctype (since 1.5.1) + * @param bool $browser_cache_ok When TRUE, it's OK to leave out the + * no-cache browser headers (OPTIONAL; + * default = FALSE, send no-cache headers) * @return void */ -function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE, $frames = FALSE ) { - global $squirrelmail_language, $sTplDir, $oErrorHandler, $oTemplate; +function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE, $frames = FALSE, $browser_cache_ok=FALSE ) { + global $squirrelmail_language, $sTemplateID, $oErrorHandler, $oTemplate; if ( !sqgetGlobalVar('base_uri', $base_uri, SQ_SESSION) ) { global $base_uri; } - global $theme_css, $custom_css, $pageheader_sent, $theme, $theme_default, $text_direction, - $default_fontset, $chosen_fontset, $default_fontsize, $chosen_fontsize, $chosen_theme; + global $custom_css, $pageheader_sent, $theme, $theme_default, $text_direction, + $default_fontset, $chosen_fontset, $default_fontsize, $chosen_fontsize, + $chosen_theme, $chosen_theme_path, $user_themes, $user_theme_default; - /* add no cache headers here */ - header('Pragma: no-cache'); // http 1.0 (rfc1945) - header('Cache-Control: private, no-cache, no-store'); // http 1.1 (rfc2616) - - if ($frames) { - echo ''; - } else { - echo ''; + // add no cache headers here + // + if (!$browser_cache_ok) { +//FIXME: should change all header() calls in SM core to use $oTemplate->header()!! + $oTemplate->header('Pragma: no-cache'); // http 1.0 (rfc1945) + $oTemplate->header('Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0'); // http 1.1 (rfc2616) + $oTemplate->header('Expires: Sat, 1 Jan 2000 00:00:00 GMT'); +//TODO: is this needed? $oTemplate->header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . 'GMT'); } - echo "\n" . html_tag( 'html' ,'' , '', '', 'lang="'.$squirrelmail_language.'"' ) . - "\n\n"; + /* prevent information leakage about read emails by forbidding Firefox + * to do preemptive DNS requests for any links in the message body. */ + $oTemplate->header('X-DNS-Prefetch-Control: off'); + + // don't show version as a security measure + //$oTemplate->header('X-Powered-By: SquirrelMail/' . SM_VERSION, FALSE); + $oTemplate->header('X-Powered-By: SquirrelMail', FALSE); + + // prevent clickjack attempts +// FIXME: should we use DENY instead? We can also make this a configurable value, including giving the admin the option of removing this entirely in case they WANT to be framed by an external domain + $oTemplate->header('X-Frame-Options: SAMEORIGIN'); + + // prevent clickjack attempts using JavaScript for browsers that + // don't support the X-Frame-Options header... + // we check to see if we are *not* the top page, and if not, check + // whether or not the top page is in the same domain as we are... + // if not, log out immediately -- this is an attempt to do the same + // thing that the X-Frame-Options does using JavaScript (never a good + // idea to rely on JavaScript-based solutions, though) +//FIXME: is it a problem that we still force the clickjack protection code whether or not JavaScript is supported or desired by the user? + $header_tags = '\n"; + + $oTemplate->assign('frames', $frames); + $oTemplate->assign('lang', $squirrelmail_language); + + $header_tags .= "\n"; $used_fontset = (!empty($chosen_fontset) ? $chosen_fontset : $default_fontset); $used_fontsize = (!empty($chosen_fontsize) ? $chosen_fontsize : $default_fontsize); - $used_theme = basename((!empty($chosen_theme) ? $chosen_theme : $theme[$theme_default]['PATH']),'.php'); - - /* - * Add closing / to link and meta elements only after switching to xhtml 1.0 Transitional. - * It is not compatible with html 4.01 Transitional + $used_theme = !isset($chosen_theme) && $user_theme_default != 'none' && is_dir($chosen_theme) && is_readable($chosen_theme)? $user_themes[$user_theme_default]['PATH'].'/default.css' : $chosen_theme_path; + + /** + * Stylesheets are loaded in the following order: + * 1) All stylesheets provided by the template. Normally, these are + * stylsheets in templates/