X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=functions%2Fpage_header.php;h=f3fc1e68199275df4e51ef05a11c3009f4f88164;hp=f0d129b2c151373c5968eb93f739fb969eb9edde;hb=adc3ea746a7853859d1e17cf60550992ccba011a;hpb=b8292491d0c6526f3a39dca305f7283c23a1d137 diff --git a/functions/page_header.php b/functions/page_header.php index f0d129b2..f3fc1e68 100644 --- a/functions/page_header.php +++ b/functions/page_header.php @@ -5,7 +5,7 @@ * * Prints the page header (duh) * - * @copyright © 1999-2006 The SquirrelMail Project Team + * @copyright 1999-2020 The SquirrelMail Project Team * @license http://opensource.org/licenses/gpl-license.php GNU Public License * @version $Id$ * @package squirrelmail @@ -24,52 +24,125 @@ include_once(SM_PATH . 'functions/imap_mailbox.php'); * @param string xtra extra HTML to insert into the header * @param bool do_hook whether to execute hooks, default true * @param bool frames generate html frameset doctype (since 1.5.1) + * @param bool $browser_cache_ok When TRUE, it's OK to leave out the + * no-cache browser headers (OPTIONAL; + * default = FALSE, send no-cache headers) * @return void */ -function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE, $frames = FALSE ) { +function displayHtmlHeader( $title = 'SquirrelMail', $xtra = '', $do_hook = TRUE, $frames = FALSE, $browser_cache_ok=FALSE ) { global $squirrelmail_language, $sTemplateID, $oErrorHandler, $oTemplate; if ( !sqgetGlobalVar('base_uri', $base_uri, SQ_SESSION) ) { global $base_uri; } - global $theme_css, $custom_css, $pageheader_sent, $theme, $theme_default, $text_direction, - $default_fontset, $chosen_fontset, $default_fontsize, $chosen_fontsize, $chosen_theme; + global $custom_css, $pageheader_sent, $theme, $theme_default, $text_direction, + $default_fontset, $chosen_fontset, $default_fontsize, $chosen_fontsize, + $chosen_theme, $chosen_theme_path, $user_themes, $user_theme_default, + $head_tag_extra; - /* add no cache headers here */ + // add no cache headers here + // + if (!$browser_cache_ok) { //FIXME: should change all header() calls in SM core to use $oTemplate->header()!! - $oTemplate->header('Pragma: no-cache'); // http 1.0 (rfc1945) - $oTemplate->header('Cache-Control: private, no-cache, no-store'); // http 1.1 (rfc2616) + $oTemplate->header('Pragma: no-cache'); // http 1.0 (rfc1945) + $oTemplate->header('Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0'); // http 1.1 (rfc2616) + $oTemplate->header('Expires: Sat, 1 Jan 2000 00:00:00 GMT'); +//TODO: is this needed? $oTemplate->header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . 'GMT'); + } + /* prevent information leakage about read emails by forbidding Firefox + * to do preemptive DNS requests for any links in the message body. */ + $oTemplate->header('X-DNS-Prefetch-Control: off'); + + // don't show version as a security measure + //$oTemplate->header('X-Powered-By: SquirrelMail/' . SM_VERSION, FALSE); + $oTemplate->header('X-Powered-By: SquirrelMail', FALSE); + + // prevent clickjack attempts +// FIXME: should we use DENY instead? We can also make this a configurable value, including giving the admin the option of removing this entirely in case they WANT to be framed by an external domain + $oTemplate->header('X-Frame-Options: SAMEORIGIN'); + + // prevent clickjack attempts using JavaScript for browsers that + // don't support the X-Frame-Options header... + // we check to see if we are *not* the top page, and if not, check + // whether or not the top page is in the same domain as we are... + // if not, log out immediately -- this is an attempt to do the same + // thing that the X-Frame-Options does using JavaScript (never a good + // idea to rely on JavaScript-based solutions, though) +//FIXME: is it a problem that we still force the clickjack protection code whether or not JavaScript is supported or desired by the user? + $header_tags = '\n"; $oTemplate->assign('frames', $frames); $oTemplate->assign('lang', $squirrelmail_language); - $header_tags = ''; + $header_tags .= "\n" - $header_tags .= "\n"; + // For adding a favicon or anything else that should be inserted in *ALL* for *ALL* documents, + // define $head_tag_extra in config/config_local.php + // The string "###SM BASEURI###" will be replaced with the base URI for this SquirrelMail installation. + // When not defined, a default is provided that displays the default favicon.ico. + // If you override this and still want to use the default favicon.ico, you'll have to include the following + // following in your $head_tag_extra string: + // $head_tag_extra = '......'; + // + . (empty($head_tag_extra) ? '' + : str_replace('###SM BASEURI###', sqm_baseuri(), $head_tag_extra)); $used_fontset = (!empty($chosen_fontset) ? $chosen_fontset : $default_fontset); $used_fontsize = (!empty($chosen_fontsize) ? $chosen_fontsize : $default_fontsize); - $used_theme = basename((!empty($chosen_theme) ? $chosen_theme : $theme[$theme_default]['PATH']),'.php'); + $used_theme = !isset($chosen_theme) && $user_theme_default != 'none' && is_dir($chosen_theme) && is_readable($chosen_theme)? $user_themes[$user_theme_default]['PATH'].'/default.css' : $chosen_theme_path; + + /** + * Stylesheets are loaded in the following order: + * 1) All stylesheets provided by the template. Normally, these are + * stylsheets in templates/