* All incoming form values now have stripslashes() ran on them automatically

  (if PHP escaped them) if you include strings.php
* Removed sqStripSlahes (no need anymore)
* Completely fixed problem with some data needing escapes, some not, and some
  accidentally getting escaped twice (often in compose.php).

To use:
* Load strings.php at the beginning of your script
* All form variables are accessable as globals (as usual), but are without
  the escape backslashes (if PHP put any in).

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@1050 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/functions/mime.php b/functions/mime.php
index 2af69c78fff7b2ed0d551bb31eac5d6f626f6d47..0731f7ba100ac269f4bcb6ef24af7218bdf031bf 100644 (file)
--- a/functions/mime.php
+++ b/functions/mime.php
@@ -509,7 +509,7 @@
       if (($body_message->header->type0 == "text") || 
           ($body_message->header->type0 == "rfc822")) {
    
       if (($body_message->header->type0 == "text") || 
           ($body_message->header->type0 == "rfc822")) {
    

-         $body = mime_fetch_body ($imap_stream, $id, $ent_num); 
+         $body = mime_fetch_body ($imap_stream, $id, $ent_num);

          $body = decodeBody($body, $body_message->header->encoding);
    
          // If there are other types that shouldn't be formatted, add
          $body = decodeBody($body, $body_message->header->encoding);
    
          // If there are other types that shouldn't be formatted, add

diff --git a/functions/page_header.php b/functions/page_header.php
index 28852d5dba3440df5a73ab8dd7cca06cbd49b493..0a9e40ba018b00bee0508c765f051dab70ac405a 100644 (file)
--- a/functions/page_header.php
+++ b/functions/page_header.php
@@ -62,7 +62,6 @@
 
       /** Here is the header and wrapping table **/
       $shortBoxName = readShortMailboxName($mailbox, ".");
 
       /** Here is the header and wrapping table **/
       $shortBoxName = readShortMailboxName($mailbox, ".");

-      $shortBoxName = sqStripSlashes($shortBoxName);

       echo "<A NAME=pagetop></A>\n";
       echo "<TABLE BGCOLOR=\"$color[4]\" BORDER=0 WIDTH=\"100%\" CELLSPACING=0 CELLPADDING=2>\n";
       echo "   <TR BGCOLOR=\"$color[9]\">\n";
       echo "<A NAME=pagetop></A>\n";
       echo "<TABLE BGCOLOR=\"$color[4]\" BORDER=0 WIDTH=\"100%\" CELLSPACING=0 CELLPADDING=2>\n";
       echo "   <TR BGCOLOR=\"$color[9]\">\n";

diff --git a/functions/smtp.php b/functions/smtp.php
index a6057f78b1100f4c715d9065e0e8e3c611722731..7fe5e285085c64573cc5d93e82e946c9c346ac85 100644 (file)
--- a/functions/smtp.php
+++ b/functions/smtp.php
@@ -146,7 +146,7 @@
          $bcc_list = getLineOfAddrs($bcc);
 
          /* Encoding 8-bit characters and making from line */
          $bcc_list = getLineOfAddrs($bcc);
 
          /* Encoding 8-bit characters and making from line */

-         $subject = sqStripSlashes(encodeHeader($subject));
+         $subject = encodeHeader($subject);

          if ($from == '')
             $from = "<$from_addr>";
          else
          if ($from == '')
             $from = "<$from_addr>";
          else


@@ -247,7 +247,7 @@
             $body .= "Content-Type: text/plain\r\n";
 
          $body .= "Content-Transfer-Encoding: 8bit\r\n\r\n";
             $body .= "Content-Type: text/plain\r\n";
 
          $body .= "Content-Transfer-Encoding: 8bit\r\n\r\n";

-         $body .= sqStripSlashes($passedBody) . "\r\n\r\n";
+         $body .= $passedBody . "\r\n\r\n";

          fputs ($fp, $body);
 
          $attachmentlength = attachFiles($fp);
          fputs ($fp, $body);
 
          $attachmentlength = attachFiles($fp);


@@ -256,7 +256,7 @@
          $postbody .= "\r\n--".mimeBoundary()."--\r\n\r\n";
          fputs ($fp, $postbody);
       } else {
          $postbody .= "\r\n--".mimeBoundary()."--\r\n\r\n";
          fputs ($fp, $postbody);
       } else {

-         $body = sqStripSlashes($passedBody) . "\r\n";
+         $body = $passedBody . "\r\n";

          fputs ($fp, $body);
          $postbody = "\r\n";
          fputs ($fp, $postbody);
          fputs ($fp, $body);
          $postbody = "\r\n";
          fputs ($fp, $postbody);

diff --git a/functions/strings.php b/functions/strings.php
index f9f258507ba018dd512f7955641a03399a2ab381..b089620ba05ba90926301bc29d461f7bd78a43d2 100644 (file)
--- a/functions/strings.php
+++ b/functions/strings.php
@@ -3,6 +3,44 @@
    /* $Id$ */
 
    $strings_php = true;
    /* $Id$ */
 
    $strings_php = true;

+   
+   // Remove all slashes for form values
+   if (get_magic_quotes_gpc())
+   {
+       global $REQUEST_METHOD;
+       if ($REQUEST_METHOD == "POST")
+       {
+           global $HTTP_POST_VARS;
+          RemoveSlashes($HTTP_POST_VARS);
+       }
+       elseif ($REQUEST_METHOD == "GET")
+       {
+           global $HTTP_GET_VARS;
+          RemoveSlashes($HTTP_GET_VARS);
+       }
+   }
+   
+   
+   function RemoveSlashes($array)
+   {
+       foreach ($array as $k => $v)
+       {
+           global $$k;
+          if (is_array($$k))
+          {
+              foreach ($$k as $k2 => $v2)
+              {
+                  $newArray[stripslashes($k2)] = stripslashes($v2);
+              }
+              $$k = $newArray;
+          }
+          else
+          {
+              $$k = stripslashes($v);
+          }
+       }
+   }
+

 
    //*************************************************************************
    // Count the number of occurances of $needle are in $haystack.
 
    //*************************************************************************
    // Count the number of occurances of $needle are in $haystack.


@@ -285,13 +323,6 @@
       return $path;    
    }   
 
       return $path;    
    }   
 

-   function sqStripSlashes($string) {
-      if (get_magic_quotes_gpc()) {
-         $string = stripslashes($string);
-      }
-      return $string;
-   }
-

 
    // These functions are used to encrypt the passowrd before it is
    // stored in a cookie.
 
    // These functions are used to encrypt the passowrd before it is
    // stored in a cookie.

diff --git a/src/addrbook_search_html.php b/src/addrbook_search_html.php
index 2fee39e987eee6ccae5dabbf091c016fda9eb2cd..fae1d4f3207e18d42148a92c7230084ac53a356b 100644 (file)
--- a/src/addrbook_search_html.php
+++ b/src/addrbook_search_html.php
@@ -113,12 +113,6 @@
    // Initialize addressbook
    $abook = addressbook_init();
 
    // Initialize addressbook
    $abook = addressbook_init();
 

-   $body = sqStripSlashes($body);
-   $send_to = sqStripSlashes($send_to);
-   $send_to_cc = sqStripSlashes($send_to_cc);
-   $send_to_bcc = sqStripSlashes($send_to_bcc);
-   $subject = sqStripSlashes($subject);
-

 ?>
 
 <br>
 ?>
 
 <br>

diff --git a/src/compose.php b/src/compose.php
index 302cab44e2a522ffde92cdbbdbbeff7962255beb..8495f7eb7a8b89b12a6fb2194bc47b8a986a9029 100644 (file)
--- a/src/compose.php
+++ b/src/compose.php
@@ -14,7 +14,7 @@
     **
     ** $Id$
     **/
     **
     ** $Id$
     **/

-
+    

    session_start();
 
    if (!isset($strings_php))
    session_start();
 
    if (!isset($strings_php))


@@ -48,9 +48,9 @@
       global $forward_id, $imapConnection, $msg, $ent_num, $body_ary, $body,
          $reply_id, $send_to, $send_to_cc, $mailbox, $send_to_bcc, $editor_size;
 
       global $forward_id, $imapConnection, $msg, $ent_num, $body_ary, $body,
          $reply_id, $send_to, $send_to_cc, $mailbox, $send_to_bcc, $editor_size;
 

-      $send_to = sqStripSlashes(decodeHeader($send_to));
-      $send_to_cc = sqStripSlashes(decodeHeader($send_to_cc));
-      $send_to_bcc = sqStripSlashes(decodeHeader($send_to_bcc));
+      $send_to = decodeHeader($send_to);
+      $send_to_cc = decodeHeader($send_to_cc);
+      $send_to_bcc = decodeHeader($send_to_bcc);

 
       if ($forward_id)
          $id = $forward_id;
 
       if ($forward_id)
          $id = $forward_id;


@@ -197,7 +197,7 @@
          $send_to_bcc, $reply_id, $mailbox, $from_htmladdr_search,
          $location_of_buttons;
 
          $send_to_bcc, $reply_id, $mailbox, $from_htmladdr_search,
          $location_of_buttons;
 

-      $subject = sqStripSlashes(decodeHeader($subject));
+      $subject = decodeHeader($subject);

       $reply_subj = decodeHeader($reply_subj);
       $forward_subj = decodeHeader($forward_subj);
       
       $reply_subj = decodeHeader($reply_subj);
       $forward_subj = decodeHeader($forward_subj);
       


@@ -253,7 +253,6 @@
       echo "      </TD><TD BGCOLOR=\"$color[4]\" ALIGN=LEFT>\n";
       if ($reply_subj) {
          $reply_subj = str_replace("\"", "'", $reply_subj);
       echo "      </TD><TD BGCOLOR=\"$color[4]\" ALIGN=LEFT>\n";
       if ($reply_subj) {
          $reply_subj = str_replace("\"", "'", $reply_subj);

-         $reply_subj = sqStripSlashes($reply_subj);

          $reply_subj = trim($reply_subj);
          if (substr(strtolower($reply_subj), 0, 3) != "re:")
             $reply_subj = "Re: $reply_subj";
          $reply_subj = trim($reply_subj);
          if (substr(strtolower($reply_subj), 0, 3) != "re:")
             $reply_subj = "Re: $reply_subj";


@@ -261,7 +260,6 @@
                 htmlspecialchars($reply_subj));
       } else if ($forward_subj) {
          $forward_subj = str_replace("\"", "'", $forward_subj);
                 htmlspecialchars($reply_subj));
       } else if ($forward_subj) {
          $forward_subj = str_replace("\"", "'", $forward_subj);

-         $forward_subj = sqStripSlashes($forward_subj);

          $forward_subj = trim($forward_subj);
          if ((substr(strtolower($forward_subj), 0, 4) != "fwd:") &&
              (substr(strtolower($forward_subj), 0, 5) != "[fwd:") &&
          $forward_subj = trim($forward_subj);
          if ((substr(strtolower($forward_subj), 0, 4) != "fwd:") &&
              (substr(strtolower($forward_subj), 0, 5) != "[fwd:") &&


@@ -429,10 +427,6 @@
       is_logged_in();
       displayPageHeader($color, $mailbox);
 
       is_logged_in();
       displayPageHeader($color, $mailbox);
 

-      $send_to = sqStripSlashes($send_to);
-      $send_to_cc = sqStripSlashes($send_to_cc);
-      $send_to_bcc = sqStripSlashes($send_to_bcc);
-      

       for ($i=0; $i < count($send_to_search); $i++) {
          if ($send_to)
             $send_to .= ", ";
       for ($i=0; $i < count($send_to_search); $i++) {
          if ($send_to)
             $send_to .= ", ";

diff --git a/src/download.php b/src/download.php
index a5b0382a13ac9011286fc6671cb5116cf4e512cc..4a1b061d7805b3ec6cf8c4bef5cf0c4a351ade9b 100644 (file)
--- a/src/download.php
+++ b/src/download.php
@@ -117,9 +117,9 @@
             header("Content-type: application/octet-stream; name=\"$filename\"");
             set_up_language(getPref($data_dir, $username, "language"));
             if ($type1 == "plain") {
             header("Content-type: application/octet-stream; name=\"$filename\"");
             set_up_language(getPref($data_dir, $username, "language"));
             if ($type1 == "plain") {

-               echo _("Subject") . ": " . decodeHeader(sqStripSlashes($top_header->subject)) . "\n";
-               echo "   " . _("From") . ": " . decodeHeader(sqStripSlashes($top_header->from)) . "\n";
-               echo "     " . _("To") . ": " . decodeHeader(sqStripSlashes(getLineOfAddrs($top_header->to))) . "\n";
+               echo _("Subject") . ": " . decodeHeader($top_header->subject) . "\n";
+               echo "   " . _("From") . ": " . decodeHeader($top_header->from) . "\n";
+               echo "     " . _("To") . ": " . decodeHeader(getLineOfAddrs($top_header->to)) . "\n";

                echo "   " . _("Date") . ": " . getLongDateString($top_header->date) . "\n\n";
             }
             echo trim($body);
                echo "   " . _("Date") . ": " . getLongDateString($top_header->date) . "\n\n";
             }
             echo trim($body);

diff --git a/src/folders_create.php b/src/folders_create.php
index 2f4975b88c59a32b3ec5d55ca082a7a906cde1fd..da1460468b5ea5bf717f52c885ac4ee0c81d04e3 100644 (file)
--- a/src/folders_create.php
+++ b/src/folders_create.php
@@ -50,7 +50,7 @@
       $subfolder_orig = $subfolder;
    }
 
       $subfolder_orig = $subfolder;
    }
 

-   if ((trim($subfolder_orig) == "[ None ]") || (trim(sqStripSlashes($subfolder_orig)) == "[ None ]")) {
+   if ((trim($subfolder_orig) == "[ None ]") || (trim($subfolder_orig) == "[ None ]")) {

       sqimap_mailbox_create ($imapConnection, $folder_prefix.$folder_name, "");
    } else {
       sqimap_mailbox_create ($imapConnection, $subfolder.$dm.$folder_name, "");
       sqimap_mailbox_create ($imapConnection, $folder_prefix.$folder_name, "");
    } else {
       sqimap_mailbox_create ($imapConnection, $subfolder.$dm.$folder_name, "");

diff --git a/src/folders_delete.php b/src/folders_delete.php
index f2b245d66fb6c9cff81c3b8d5d29bc6f0595202b..d49be2d31abaaa839112e2a3eeca34a83faac41c 100644 (file)
--- a/src/folders_delete.php
+++ b/src/folders_delete.php
@@ -37,7 +37,6 @@
    $imap_stream = sqimap_login($username, $key, $imapServerAddress, $imapPort, 0);
    $boxes = sqimap_mailbox_list ($imap_stream);
    $dm = sqimap_get_delimiter($imap_stream);
    $imap_stream = sqimap_login($username, $key, $imapServerAddress, $imapPort, 0);
    $boxes = sqimap_mailbox_list ($imap_stream);
    $dm = sqimap_get_delimiter($imap_stream);

-   $mailbox = sqStripSlashes($mailbox);

    
    if (substr($mailbox, -1) == $dm)
       $mailbox_no_dm = substr($mailbox, 0, strlen($mailbox) - 1); 
    
    if (substr($mailbox, -1) == $dm)
       $mailbox_no_dm = substr($mailbox, 0, strlen($mailbox) - 1); 

diff --git a/src/folders_rename_do.php b/src/folders_rename_do.php
index 740a96dafcdd4ba4bdd3a66b34af50f7b35a66a5..7c8bb47ba8f53f664d1972588565f53d99b27267 100644 (file)
--- a/src/folders_rename_do.php
+++ b/src/folders_rename_do.php
@@ -44,9 +44,6 @@
    else
       $newone = "$new_name";
 
    else
       $newone = "$new_name";
 

-   $orig = sqStripSlashes($orig);
-   $newone = sqStripSlashes($newone);
-

    fputs ($imapConnection, ". RENAME \"$orig\" \"$newone\"\r\n");
    $data = sqimap_read_data($imapConnection, ".", true, $a, $b);
 
    fputs ($imapConnection, ". RENAME \"$orig\" \"$newone\"\r\n");
    $data = sqimap_read_data($imapConnection, ".", true, $a, $b);
 

diff --git a/src/folders_rename_getname.php b/src/folders_rename_getname.php
index 087391bc130c0d2223f394679a07aeb7742cb0e9..ca143f9b7fac91115e2f5f29b659d7fb79bfca55 100644 (file)
--- a/src/folders_rename_getname.php
+++ b/src/folders_rename_getname.php
@@ -40,8 +40,6 @@
       $old_parent = "";
    }
 
       $old_parent = "";
    }
 

-   $old_name = sqStripSlashes($old_name);
-

    displayPageHeader($color, "None");
    echo "<br><TABLE align=center border=0 WIDTH=95% COLS=1>";
    echo "<TR><TD BGCOLOR=\"$color[0]\" ALIGN=CENTER><B>";
    displayPageHeader($color, "None");
    echo "<br><TABLE align=center border=0 WIDTH=95% COLS=1>";
    echo "<TR><TD BGCOLOR=\"$color[0]\" ALIGN=CENTER><B>";

diff --git a/src/options.php b/src/options.php
index 8b38ad2ba57a669eda76a91b95132f492172fabd..f37155fe2bb57ddc3874e72e2688a2dbc9282c55 100644 (file)
--- a/src/options.php
+++ b/src/options.php
@@ -49,11 +49,11 @@
 <?php
    if (isset($submit_personal)) {
       # Save personal information
 <?php
    if (isset($submit_personal)) {
       # Save personal information

-      if (isset($full_name)) setPref($data_dir, $username, "full_name", sqStripSlashes($full_name));
-      if (isset($email_address)) setPref($data_dir, $username, "email_address", sqStripSlashes($email_address));
-      if (isset($reply_to)) setPref($data_dir, $username, "reply_to", sqStripSlashes($reply_to));  
-      setPref($data_dir, $username, "use_signature", sqStripSlashes($usesignature));  
-      if (isset($signature_edit)) setSig($data_dir, $username, sqStripSlashes($signature_edit)); 
+      if (isset($full_name)) setPref($data_dir, $username, "full_name", $full_name);
+      if (isset($email_address)) setPref($data_dir, $username, "email_address", $email_address);
+      if (isset($reply_to)) setPref($data_dir, $username, "reply_to", $reply_to);  
+      setPref($data_dir, $username, "use_signature", $usesignature);  
+      if (isset($signature_edit)) setSig($data_dir, $username, $signature_edit);

       
       do_hook("options_personal_save");
       
       
       do_hook("options_personal_save");
       

diff --git a/src/read_body.php b/src/read_body.php
index 46dac94fde31905a57074388859a1412abf43b1e..cdc15075d935653ba85807dec49d646da380ddf3 100644 (file)
--- a/src/read_body.php
+++ b/src/read_body.php
@@ -156,9 +156,9 @@
    // $message contains all information about the message
    // including header and body
    $message = sqimap_get_message($imapConnection, $passed_id, $mailbox);
    // $message contains all information about the message
    // including header and body
    $message = sqimap_get_message($imapConnection, $passed_id, $mailbox);

-
+   

    /** translate the subject and mailbox into url-able text **/
    /** translate the subject and mailbox into url-able text **/

-   $url_subj = urlencode(trim(sqStripSlashes($message->header->subject)));
+   $url_subj = urlencode(trim($message->header->subject));

    $urlMailbox = urlencode($mailbox);
    $url_replyto = urlencode($message->header->replyto);
 
    $urlMailbox = urlencode($mailbox);
    $url_replyto = urlencode($message->header->replyto);