X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=functions%2Fpage_header.php;h=f3fc1e68199275df4e51ef05a11c3009f4f88164;hp=9c4e9365248b1275017c579eb6c875b20bad959d;hb=c4faef335b2362c81b8ebf026d4066c12d70536c;hpb=acd7fdf263929e876918bc434086626ec871afb1 diff --git a/functions/page_header.php b/functions/page_header.php index 9c4e9365..f3fc1e68 100644 --- a/functions/page_header.php +++ b/functions/page_header.php @@ -5,7 +5,7 @@ * * Prints the page header (duh) * - * @copyright © 1999-2006 The SquirrelMail Project Team + * @copyright 1999-2020 The SquirrelMail Project Team * @license http://opensource.org/licenses/gpl-license.php GNU Public License * @version $Id$ * @package squirrelmail @@ -24,9 +24,12 @@ include_once(SM_PATH . 'functions/imap_mailbox.php'); * @param string xtra extra HTML to insert into the header * @param bool do_hook whether to execute hooks, default true * @param bool frames generate html frameset doctype (since 1.5.1) + * @param bool $browser_cache_ok When TRUE, it's OK to leave out the + * no-cache browser headers (OPTIONAL; + * default = FALSE, send no-cache headers) * @return void */ -function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE, $frames = FALSE ) { +function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE, $frames = FALSE, $browser_cache_ok=FALSE ) { global $squirrelmail_language, $sTemplateID, $oErrorHandler, $oTemplate; if ( !sqgetGlobalVar('base_uri', $base_uri, SQ_SESSION) ) { @@ -34,23 +37,65 @@ function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE } global $custom_css, $pageheader_sent, $theme, $theme_default, $text_direction, $default_fontset, $chosen_fontset, $default_fontsize, $chosen_fontsize, - $chosen_theme, $chosen_theme_path, $user_themes, $user_theme_default; + $chosen_theme, $chosen_theme_path, $user_themes, $user_theme_default, + $head_tag_extra; - /* add no cache headers here */ + // add no cache headers here + // + if (!$browser_cache_ok) { //FIXME: should change all header() calls in SM core to use $oTemplate->header()!! - $oTemplate->header('Pragma: no-cache'); // http 1.0 (rfc1945) - $oTemplate->header('Cache-Control: private, no-cache, no-store'); // http 1.1 (rfc2616) + $oTemplate->header('Pragma: no-cache'); // http 1.0 (rfc1945) + $oTemplate->header('Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0'); // http 1.1 (rfc2616) + $oTemplate->header('Expires: Sat, 1 Jan 2000 00:00:00 GMT'); +//TODO: is this needed? $oTemplate->header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . 'GMT'); + } + /* prevent information leakage about read emails by forbidding Firefox + * to do preemptive DNS requests for any links in the message body. */ + $oTemplate->header('X-DNS-Prefetch-Control: off'); + + // don't show version as a security measure + //$oTemplate->header('X-Powered-By: SquirrelMail/' . SM_VERSION, FALSE); + $oTemplate->header('X-Powered-By: SquirrelMail', FALSE); + + // prevent clickjack attempts +// FIXME: should we use DENY instead? We can also make this a configurable value, including giving the admin the option of removing this entirely in case they WANT to be framed by an external domain + $oTemplate->header('X-Frame-Options: SAMEORIGIN'); + + // prevent clickjack attempts using JavaScript for browsers that + // don't support the X-Frame-Options header... + // we check to see if we are *not* the top page, and if not, check + // whether or not the top page is in the same domain as we are... + // if not, log out immediately -- this is an attempt to do the same + // thing that the X-Frame-Options does using JavaScript (never a good + // idea to rely on JavaScript-based solutions, though) +//FIXME: is it a problem that we still force the clickjack protection code whether or not JavaScript is supported or desired by the user? + $header_tags = '\n"; $oTemplate->assign('frames', $frames); $oTemplate->assign('lang', $squirrelmail_language); - $header_tags = ''; + $header_tags .= "\n" - $header_tags .= "\n"; + // For adding a favicon or anything else that should be inserted in *ALL* for *ALL* documents, + // define $head_tag_extra in config/config_local.php + // The string "###SM BASEURI###" will be replaced with the base URI for this SquirrelMail installation. + // When not defined, a default is provided that displays the default favicon.ico. + // If you override this and still want to use the default favicon.ico, you'll have to include the following + // following in your $head_tag_extra string: + // $head_tag_extra = '......'; + // + . (empty($head_tag_extra) ? '' + : str_replace('###SM BASEURI###', sqm_baseuri(), $head_tag_extra)); $used_fontset = (!empty($chosen_fontset) ? $chosen_fontset : $default_fontset); $used_fontsize = (!empty($chosen_fontsize) ? $chosen_fontsize : $default_fontsize); - $used_theme = !isset($chosen_theme) && $user_theme_default != 'none' ? 'u_'.$user_themes[$user_theme_default]['PATH'] : $chosen_theme_path; + $used_theme = !isset($chosen_theme) && $user_theme_default != 'none' && is_dir($chosen_theme) && is_readable($chosen_theme)? $user_themes[$user_theme_default]['PATH'].'/default.css' : $chosen_theme_path; /** * Stylesheets are loaded in the following order: @@ -70,28 +115,25 @@ function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE $aUserStyles = array(); // 2. Option user-defined stylesheet from preferences. -// FIXME: the following user pref ("sUserStyle"; rename as necessary) will have to be populated by the display prefs screen from a widget similar to the color themes widget (which it replaces) where its values should be full relative paths (from SM_PATH) to the selected css "themes" (either in template css/alternates dir or SM_PATH/css/alternates dir) -// FIXME: uhhh, getPref() is not available yet here. (at least on login page) Ugh. Nor has load_prefs been included yet -- how do we fix this? -// $aUserStyles[] = getPref($data_dir, $username, 'sUserStyle', ''); -// Steve, can you please document what u_ means? Will it work with the -// new template inheritance system and auto-detection of alternate sheets? -/** - * Stylesheets beginning with a "u_" == user provided stylesheets, e.g. those - * in SM_PATH/css/. Template provided stylesheets (TEMPLATE_DIR/css/alternatives/) - * should begin with 't_'. This was the initial path I took to get it working - * since I wasn't sure what mods to the Template class would be used to handle - * template-provided alt stylesheets. - * - * TODO: Re-evaluate this naming convetion. - */ - if (!empty($used_theme) && substr($used_theme, 0, 2) == 'u_') { - $aUserStyles[] = substr($used_theme, 2) .'default.css'; + if (!empty($used_theme) && $used_theme != 'none') { + /** + * All styles (except "none" - ugh) just point to a directory, + * so we need to include all .css files in that directory. + */ +//FIXME: rid ourselves of "none" strings! I didn't do it here because I think the problem is that the theme itself should never be "none" (? well, what else would it be? if "none" theme is actually OK, then is there a constant to use below in stead of a hard-coded string?) + $styles = $used_theme == 'none' ? array() + : list_files($used_theme, '.css'); + foreach ($styles as $sheet) { + $aUserStyles[] = $used_theme .'/'.$sheet; + } } // 3. src/style.php $aUserStyles[] = $base_uri .'src/style.php?' . (!empty($used_fontset) ? '&fontset='.$used_fontset : '') . (!empty($used_fontsize) ? '&fontsize='.$used_fontsize : ''); + + // 3.1. Load the stylesheets we have already $header_tags .= $oTemplate->fetch_external_stylesheet_links($aUserStyles); // 4. Optional rtl.css stylesheet @@ -99,6 +141,9 @@ function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE $header_tags .= $oTemplate->fetch_right_to_left_stylesheet_link(); } + // 5. Printer friendly stylesheet + $header_tags .= create_css_link($base_uri . 'css/print.css', 'printerfriendly', false, 'print'); + if ($squirrelmail_language == 'ja_JP') { /* * force correct detection of charset, when browser does not follow @@ -108,12 +153,27 @@ function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE * recommendations and switch to unicode. */ $header_tags .= "\n"; - $header_tags .= '' . "\n"; + $header_tags .= '' . "\n"; } if ($do_hook) { - // NOTE! plugins here must assign output to template - // and NOT echo anything directly!! - do_hook('generic_header'); + // NOTE! plugins here MUST assign output to template + // and NOT echo anything directly!! A common + // approach is if a plugin decides it needs to + // put something at page-top after the standard + // SM page header, to dynamically add itself to + // the page_header_bottom and/or compose_header_bottom + // hooks for the current page request. See + // the Sent Confirmation v1.7 or Restrict Senders v1.2 + // plugins for examples of this approach. + ob_start(); + $temp = array(&$header_tags); + do_hook('generic_header', $temp); + $output = ob_get_contents(); + ob_end_clean(); + // plugin authors can debug their errors with one of the following: + //sm_print_r($output); + //echo $output; + if (!empty($output)) trigger_error('A plugin on the "generic_header" hook has attempted to output directly to the browser', E_USER_ERROR); } $header_tags .= $xtra; @@ -146,16 +206,16 @@ EOS; /** * Given a path to a SquirrelMail file, return a HTML link to it * - * @param string path the SquirrelMail file to link to - * @param string text the link text - * @param string target the target frame for this link + * @param string $path The SquirrelMail file to link to + * (should start with something like "src/..." or + * "functions/..." or "plugins/..." etc.) + * @param string $text The link text + * @param string $target The target frame for this link + * @param string $accesskey The access key to be used, if any */ -function makeInternalLink($path, $text, $target='') { - global $base_uri; +function makeInternalLink($path, $text, $target='', $accesskey='NONE') { + global $base_uri, $oTemplate; // sqgetGlobalVar('base_uri', $base_uri, SQ_SESSION); - if ($target != '') { - $target = " target=\"$target\""; - } // This is an inefficient hook and is only used by // one plugin that still needs to patch this code, @@ -164,19 +224,13 @@ function makeInternalLink($path, $text, $target='') { // here just in case we find a good (non-visual?) // use for the internal_link hook. // - //$hooktext = do_hook_function('internal_link',$text); - //if ($hooktext != '') - // $text = $hooktext; + //do_hook('internal_link', $text); - return ''.$text.''; -} - -/** - * Same as makeInternalLink, but echoes it too - */ -function displayInternalLink($path, $text, $target='') { -// FIXME: should let the template echo all these kinds of things - echo makeInternalLink($path, $text, $target); + return create_hyperlink($base_uri . $path, $text, $target, + '', '', '', '', + ($accesskey == 'NONE' + ? array() + : array('accesskey' => $accesskey))); } /** @@ -187,30 +241,30 @@ function displayInternalLink($path, $text, $target='') { * @param array color the array of theme colors * @param string mailbox the current mailbox name to display * @param string sHeaderJs javascipt code to be inserted in a script block in the header - * @param string sBodyTagJs js events to be inserted in the body tag + * @param string sOnload JavaScript code to be added inside the body's onload handler + * as of 1.5.2, this replaces $sBodyTagJs argument * @return void */ - -function displayPageHeader($color, $mailbox, $sHeaderJs='', $sBodyTagJs = '') { +function displayPageHeader($color, $mailbox='', $sHeaderJs='', $sOnload = '') { global $reply_focus, $hide_sm_attributions, $frame_top, $provider_name, $provider_uri, $startMessage, - $javascript_on, $action, $oTemplate; + $action, $oTemplate, $org_title, $base_uri, + $data_dir, $username; - if (empty($sBodyTagJs)) { + if (empty($sOnload)) { if (strpos($action, 'reply') !== FALSE && $reply_focus) { - if ($reply_focus == 'select') - $sBodyTagJs = 'onload="checkForm(\'select\');"'; - else if ($reply_focus == 'focus') - $sBodyTagJs = 'onload="checkForm(\'focus\');"'; - else if ($reply_focus != 'none') - $sBodyTagJs = 'onload="checkForm();"'; + if ($reply_focus == 'select') + $sOnload = 'checkForm(\'select\');'; + else if ($reply_focus == 'focus') + $sOnload = 'checkForm(\'focus\');'; + else if ($reply_focus != 'none') + $sOnload = 'checkForm();'; } else - $sBodyTagJs = 'onload="checkForm();"'; + $sOnload = 'checkForm();'; } - $urlMailbox = urlencode($mailbox); $startMessage = (int)$startMessage; sqgetGlobalVar('delimiter', $delimiter, SQ_SESSION ); @@ -219,7 +273,8 @@ function displayPageHeader($color, $mailbox, $sHeaderJs='', $sBodyTagJs = '') { $frame_top = '_top'; } - if( $javascript_on || strpos($sHeaderJs, 'new_js_autodetect_results.value') ) { +//FIXME: does checkForJavascript() make the 2nd part of the if() below unneccessary?? (that is, I think checkForJavascript() might already look for new_js_autodetect_results...(?)) + if( checkForJavascript() || strpos($sHeaderJs, 'new_js_autodetect_results.value') ) { $js_includes = $oTemplate->get_javascript_includes(TRUE); $sJsBlock = ''; foreach ($js_includes as $js_file) { @@ -230,42 +285,65 @@ function displayPageHeader($color, $mailbox, $sHeaderJs='', $sBodyTagJs = '') { "\n\n\n"; } - displayHtmlHeader ('SquirrelMail', $sJsBlock); + displayHtmlHeader ($org_title, $sJsBlock); } else { /* do not use JavaScript */ - displayHtmlHeader ('SquirrelMail'); - $sBodyTagJs = ''; + displayHtmlHeader ($org_title); + $sOnload = ''; } - /* - * this explains the imap_mailbox.php dependency. We should instead store - * the selected mailbox in the session and fallback to the session var. - */ - $shortBoxName = htmlspecialchars(imap_utf7_decode_local( - readShortMailboxName($mailbox, $delimiter))); - if ( $shortBoxName == 'INBOX' ) { - $shortBoxName = _("INBOX"); + if ($mailbox) { + /* + * this explains the imap_mailbox.php dependency. We should instead store + * the selected mailbox in the session and fallback to the session var. + */ + $shortBoxName = sm_encode_html_special_chars(imap_utf7_decode_local( + readShortMailboxName($mailbox, $delimiter))); + if (getPref($data_dir, $username, 'translate_special_folders')) { + global $sent_folder, $trash_folder, $draft_folder; + if ($mailbox == $sent_folder) + $shortBoxName = _("Sent"); + else if ($mailbox == $trash_folder) + $shortBoxName = _("Trash"); + else if ($mailbox == $sent_folder) + $shortBoxName = _("Drafts"); + } + $urlMailbox = urlencode($mailbox); + } else { + $shortBoxName = ''; + $urlMailbox = ''; } - $sm_attributes = ''; - if (!$hide_sm_attributions) { - $sm_attributes .= '' ."\n"; - if (empty($provider_uri)) { - $sm_attributes .= ' SquirrelMail'; - } else { - if (empty($provider_name)) $provider_name= 'SquirrelMail'; - $sm_attributes .= ' '.$provider_name.''."\n"; - } - $sm_attributes .= " \n"; + $provider_link = ''; + if (!empty($provider_uri) && !empty($provider_name) && $provider_name != 'SquirrelMail') { + $provider_link = create_hyperlink($provider_uri, $provider_name, '_blank'); } - $oTemplate->assign('body_tag_js', $sBodyTagJs); + $oTemplate->assign('onload', $sOnload); $oTemplate->assign('shortBoxName', $shortBoxName); - $oTemplate->assign('sm_attribute_str', $sm_attributes); + $oTemplate->assign('provider_link', $provider_link); $oTemplate->assign('frame_top', $frame_top); $oTemplate->assign('urlMailbox', $urlMailbox); $oTemplate->assign('startMessage', $startMessage); $oTemplate->assign('hide_sm_attributions', $hide_sm_attributions); + + // access keys + // + global $accesskey_menubar_compose, $accesskey_menubar_addresses, + $accesskey_menubar_folders, $accesskey_menubar_options, + $accesskey_menubar_search, $accesskey_menubar_help, + $accesskey_menubar_signout; + $oTemplate->assign('accesskey_menubar_compose', $accesskey_menubar_compose); + $oTemplate->assign('accesskey_menubar_addresses', $accesskey_menubar_addresses); + $oTemplate->assign('accesskey_menubar_folders', $accesskey_menubar_folders); + $oTemplate->assign('accesskey_menubar_options', $accesskey_menubar_options); + $oTemplate->assign('accesskey_menubar_search', $accesskey_menubar_search); + $oTemplate->assign('accesskey_menubar_help', $accesskey_menubar_help); + $oTemplate->assign('accesskey_menubar_signout', $accesskey_menubar_signout); + $oTemplate->display('page_header.tpl'); + + global $null; + do_hook('page_header_bottom', $null); } /** @@ -275,31 +353,32 @@ function displayPageHeader($color, $mailbox, $sHeaderJs='', $sBodyTagJs = '') { * @param array color the array of theme colors * @param string mailbox the current mailbox name to display * @param string sHeaderJs javascipt code to be inserted in a script block in the header - * @param string sBodyTagJs js events to be inserted in the body tag + * @param string sOnload JavaScript code to be added inside the body's onload handler + * as of 1.5.2, this replaces $sBodyTagJs argument * @return void */ -function compose_Header($color, $mailbox, $sHeaderJs='', $sBodyTagJs = '') { +function compose_Header($color, $mailbox, $sHeaderJs='', $sOnload = '') { - global $reply_focus, $javascript_on, $action, $oTemplate; + global $reply_focus, $action, $oTemplate; - if (empty($sBodyTagJs)) { + if (empty($sOnload)) { if (strpos($action, 'reply') !== FALSE && $reply_focus) { - if ($reply_focus == 'select') - $sBodyTagJs = 'onload="checkForm(\'select\');"'; - else if ($reply_focus == 'focus') - $sBodyTagJs = 'onload="checkForm(\'focus\');"'; - else if ($reply_focus != 'none') - $sBodyTagJs = 'onload="checkForm();"'; + if ($reply_focus == 'select') + $sOnload = 'checkForm(\'select\');'; + else if ($reply_focus == 'focus') + $sOnload = 'checkForm(\'focus\');'; + else if ($reply_focus != 'none') + $sOnload = 'checkForm();'; } else - $sBodyTagJs = 'onload="checkForm();"'; + $sOnload = 'checkForm();'; } /* * Locate the first displayable form element (only when JavaScript on) */ - if($javascript_on) { + if(checkForJavascript()) { if ($sHeaderJs) { $sJsBlock = "\n