Do not use mixed get/post forms as this is broken in some browsers

(they only submit the post forms and skip the get forms).

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@4532 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/functions/mailbox_display.php b/functions/mailbox_display.php
index c8211ee08372e109f6ae7d2f606a6de0154d9daf..c862dbca8fbc3d3f87a129426650db1779c4b2a4 100644 (file)
--- a/functions/mailbox_display.php
+++ b/functions/mailbox_display.php
@@ -669,13 +669,18 @@ function mail_message_listing_beginning ($imapConnection,
     if (!isset($msg)) {
         $msg = '';
     }
-    $moveURL = "move_messages.php?msg=$msg&mailbox=$urlMailbox"
-             . "&startMessage=$start_msg";
+    $moveFields = '<input type="hidden" name="msg" value="'.htmlspecialchars($msg).'">' .
+                 '<input type="hidden" name="mailbox" value="'.htmlspecialchars($mailbox).'">' .
+                 '<input type="hidden" name="startMessage" value="'.htmlspecialchars($start_msg).'">';
+
+//    $moveURL = "move_messages.php?msg=$msg&amp;mailbox=$urlMailbox"
+//             . "&amp;startMessage=$start_msg";
     /*
      * This is the beginning of the message list table.
      * It wraps around all messages
      */
-    echo "<FORM name=\"messageList\" method=post action=\"$moveURL\">\n"
+    echo '<form name="messageList" method="post" action="move_messages.php">' ."\n"
+       . $moveFields
         . html_tag( 'table' ,
             html_tag( 'tr',
                 html_tag( 'td' ,

diff --git a/src/move_messages.php b/src/move_messages.php
index 943538656cc62e5d0fddac3b2db9e2c88a763d9e..c7c159f2ed93454454c41169ede08dfc82f64f75 100644 (file)
--- a/src/move_messages.php
+++ b/src/move_messages.php
@@ -125,21 +125,14 @@ $key  = $_COOKIE['key'];
 $onetimepad = $_SESSION['onetimepad'];
 $base_uri = $_SESSION['base_uri'];
 $delimiter = $_SESSION['delimiter'];
-if (isset($_GET['mailbox'])) {
-    $mailbox = $_GET['mailbox'];
-}
-if (isset($_GET['startMessage'])) {
-    $startMessage = $_GET['startMessage'];
-}
+
+sqGetGlobalVar('mailbox', $mailbox);
+sqGetGlobalVar('startMessage', $startMessage);
+sqGetGlobalVar('msg', $msg);
+
 if (isset($_POST['moveButton'])) {
     $moveButton = $_POST['moveButton'];
 }
-if (isset($_POST['msg'])) {
-    $msg = $_POST['msg'];
-}
-elseif (isset($_GET['msg'])) {
-    $msg = $_GET['msg'];
-}
 
 if (isset($_SESSION['msgs'])) {
     $msgs = $_SESSION['msgs'];