X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=functions%2Fpage_header.php;h=7c09c6f745de5478f8d92ee50c87a48466b36a48;hp=3436a9aaba1e06ceb206d0dbac9352ae9854814c;hb=ba6d2a963accba3b98fff1d9acb5f1626705d832;hpb=ca14ebb7e80fd0e5704fd75fe14adf165be6dea4

diff --git a/functions/page_header.php b/functions/page_header.php
index 3436a9aa..7c09c6f7 100644
--- a/functions/page_header.php
+++ b/functions/page_header.php
@@ -5,7 +5,7 @@
  *
  * Prints the page header (duh)
  *
- * @copyright © 1999-2007 The SquirrelMail Project Team
+ * @copyright 1999-2011 The SquirrelMail Project Team
  * @license http://opensource.org/licenses/gpl-license.php GNU Public License
  * @version $Id$
  * @package squirrelmail
@@ -24,9 +24,12 @@ include_once(SM_PATH . 'functions/imap_mailbox.php');
  * @param string xtra extra HTML to insert into the header
  * @param bool do_hook whether to execute hooks, default true
  * @param bool frames generate html frameset doctype (since 1.5.1)
+ * @param bool $browser_cache_ok When TRUE, it's OK to leave out the
+ *                               no-cache browser headers (OPTIONAL;
+ *                               default = FALSE, send no-cache headers)
  * @return void
  */
-function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE, $frames = FALSE ) {
+function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE, $frames = FALSE, $browser_cache_ok=FALSE ) {
     global $squirrelmail_language, $sTemplateID, $oErrorHandler, $oTemplate;
 
     if ( !sqgetGlobalVar('base_uri', $base_uri, SQ_SESSION) ) {
@@ -36,20 +39,46 @@ function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE
         $default_fontset, $chosen_fontset, $default_fontsize, $chosen_fontsize, 
         $chosen_theme, $chosen_theme_path, $user_themes, $user_theme_default;
 
-    /* add no cache headers here */
+    // add no cache headers here
+    //
+    if (!$browser_cache_ok) {
 //FIXME: should change all header() calls in SM core to use $oTemplate->header()!!
-    $oTemplate->header('Pragma: no-cache'); // http 1.0 (rfc1945)
-    $oTemplate->header('Cache-Control: private, no-cache, no-store'); // http 1.1 (rfc2616)
+        $oTemplate->header('Pragma: no-cache'); // http 1.0 (rfc1945)
+        $oTemplate->header('Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0'); // http 1.1 (rfc2616)
+        $oTemplate->header('Expires: Sat, 1 Jan 2000 00:00:00 GMT');
+//TODO: is this needed? $oTemplate->header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . 'GMT');
+    }
+    /* prevent information leakage about read emails by forbidding Firefox
+     * to do preemptive DNS requests for any links in the message body. */
+    $oTemplate->header('X-DNS-Prefetch-Control: off');
 
     // don't show version as a security measure
     //$oTemplate->header('X-Powered-By: SquirrelMail/' . SM_VERSION, FALSE);
     $oTemplate->header('X-Powered-By: SquirrelMail', FALSE);
 
+    // prevent clickjack attempts
+// FIXME: should we use DENY instead?  We can also make this a configurable value, including giving the admin the option of removing this entirely in case they WANT to be framed by an external domain
+    $oTemplate->header('X-Frame-Options: SAMEORIGIN');
+
+    // prevent clickjack attempts using JavaScript for browsers that
+    // don't support the X-Frame-Options header...
+    // we check to see if we are *not* the top page, and if not, check
+    // whether or not the top page is in the same domain as we are...
+    // if not, log out immediately -- this is an attempt to do the same
+    // thing that the X-Frame-Options does using JavaScript (never a good
+    // idea to rely on JavaScript-based solutions, though)
+//FIXME: is it a problem that we still force the clickjack protection code whether or not JavaScript is supported or desired by the user?
+    $header_tags = '<script type="text/javascript" language="JavaScript">'
+       . "\n<!--\n"
+       . 'if (self != top) { try { if (document.domain != top.document.domain) {'
+       . ' throw "Clickjacking security violation! Please log out immediately!"; /* this code should never execute - exception should already have been thrown since it\'s a security violation in this case to even try to access top.document.domain (but it\'s left here just to be extra safe) */ } } catch (e) { self.location = "'
+       . sqm_baseuri() . 'src/signout.php"; top.location = "'
+       . sqm_baseuri() . 'src/signout.php" } }'
+       . "\n// -->\n</script>\n";
+
     $oTemplate->assign('frames', $frames);
     $oTemplate->assign('lang', $squirrelmail_language);
 
-    $header_tags = '';
-
     $header_tags .= "<meta name=\"robots\" content=\"noindex,nofollow\" />\n";
 
     $used_fontset = (!empty($chosen_fontset) ? $chosen_fontset : $default_fontset);
@@ -165,13 +194,14 @@ EOS;
 /**
  * Given a path to a SquirrelMail file, return a HTML link to it
  *
- * @param string path the SquirrelMail file to link to
- *               (should start with something like "src/..." or
- *               "functions/..." or "plugins/..." etc.)
- * @param string text the link text
- * @param string target the target frame for this link
+ * @param string $path      The SquirrelMail file to link to
+ *                          (should start with something like "src/..." or
+ *                          "functions/..." or "plugins/..." etc.)
+ * @param string $text      The link text
+ * @param string $target    The target frame for this link
+ * @param string $accesskey The access key to be used, if any
  */
-function makeInternalLink($path, $text, $target='') {
+function makeInternalLink($path, $text, $target='', $accesskey='NONE') {
     global $base_uri, $oTemplate;
 //    sqgetGlobalVar('base_uri', $base_uri, SQ_SESSION);
 
@@ -184,7 +214,11 @@ function makeInternalLink($path, $text, $target='') {
     //
     //do_hook('internal_link', $text);
 
-    return create_hyperlink($base_uri . $path, $text, $target);
+    return create_hyperlink($base_uri . $path, $text, $target,
+                            '', '', '', '',
+                            ($accesskey == 'NONE'
+                            ? array()
+                            : array('accesskey' => $accesskey)));
 }
 
 /**
@@ -253,7 +287,13 @@ function displayPageHeader($color, $mailbox='', $sHeaderJs='', $sOnload = '') {
         $shortBoxName = htmlspecialchars(imap_utf7_decode_local(
                     readShortMailboxName($mailbox, $delimiter)));
         if (getPref($data_dir, $username, 'translate_special_folders')) {
-            $shortBoxName = _($shortBoxName);
+            global $sent_folder, $trash_folder, $draft_folder;
+            if ($mailbox == $sent_folder)
+                $shortBoxName = _("Sent");
+            else if ($mailbox == $trash_folder)
+                $shortBoxName = _("Trash");
+            else if ($mailbox == $sent_folder)
+                $shortBoxName = _("Drafts");
         }
         $urlMailbox = urlencode($mailbox);
     } else {
@@ -273,6 +313,21 @@ function displayPageHeader($color, $mailbox='', $sHeaderJs='', $sOnload = '') {
     $oTemplate->assign('urlMailbox', $urlMailbox);
     $oTemplate->assign('startMessage', $startMessage);
     $oTemplate->assign('hide_sm_attributions', $hide_sm_attributions);
+
+    // access keys
+    //
+    global $accesskey_menubar_compose, $accesskey_menubar_addresses,
+           $accesskey_menubar_folders, $accesskey_menubar_options,
+           $accesskey_menubar_search, $accesskey_menubar_help,
+           $accesskey_menubar_signout;
+    $oTemplate->assign('accesskey_menubar_compose', $accesskey_menubar_compose);
+    $oTemplate->assign('accesskey_menubar_addresses', $accesskey_menubar_addresses);
+    $oTemplate->assign('accesskey_menubar_folders', $accesskey_menubar_folders);
+    $oTemplate->assign('accesskey_menubar_options', $accesskey_menubar_options);
+    $oTemplate->assign('accesskey_menubar_search', $accesskey_menubar_search);
+    $oTemplate->assign('accesskey_menubar_help', $accesskey_menubar_help);
+    $oTemplate->assign('accesskey_menubar_signout', $accesskey_menubar_signout);
+
     $oTemplate->display('page_header.tpl');
 
     global $null;