* I really didn't like the old attachment code

* Information is now saved in the session instead of .info files
* Local filenames are no longer transferred to the client (YEAY)
* The client can no longer delete arbitrary files on the system
  (by setting a   delete[] = "username.pref"   or   delete[] = "../index.php")
  (Untested, but the code looked like it would happily oblige)
* Attachments are now cleared when a new mail message is started
* Attachments are now cleared when a new mail message is forwarded
* No more silly errors when deleting a single attachment

Food for Thought:
* If the attachment information was saved in the preferences, the next time
  the user logs in, old un-deleted attachments could be trashed (or a very
  simple cron job could be made)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@1207 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/functions/smtp.php b/functions/smtp.php
index 4c15c2c96f6c2d2cc6f40edd21a0e189d5d3a736..0c66f44e96779aecea0d956e03ef2925b49ed5d9 100644 (file)
--- a/functions/smtp.php
+++ b/functions/smtp.php
@@ -62,27 +62,22 @@
       $length = 0;
 
       if (isMultipart()) {
-         reset($attachments);
-         while (list($localname, $remotename) = each($attachments)) {
-            // This is to make sure noone is giving a filename in another
-            // directory
-            $localname = ereg_replace ("\\/", '', $localname);
-            
-            $fileinfo = fopen ($attachment_dir.$localname.'.info', 'r');
-            $filetype = fgets ($fileinfo, 8192);
-            fclose ($fileinfo);
-            $filetype = trim ($filetype);
-            if ($filetype=='')
+         foreach ($attachments as $info)
+        {
+           $filetype = $info['type'];
+            if ($filetype == '')
                $filetype = 'application/octet-stream';
             
             $header = '--'.mimeBoundary()."\r\n";
-            $header .= "Content-Type: $filetype;name=\"$remotename\"\r\n";
-            $header .= "Content-Disposition: attachment; filename=\"$remotename\"\r\n";
+            $header .= "Content-Type: $filetype; name=\"" .
+               $info['remotefilename'] . "\"\r\n";
+            $header .= "Content-Disposition: attachment; filename=\"" .
+               $info['remotefilename'] . "\"\r\n";
             $header .= "Content-Transfer-Encoding: base64\r\n\r\n";
             fputs ($fp, $header);
             $length += strlen($header);
             
-            $file = fopen ($attachment_dir.$localname, 'r');
+            $file = fopen ($attachment_dir . $info['localfilename'], 'r');
             while ($tmp = fread($file, 570)) {
                $encoded = chunk_split(base64_encode($tmp));
                $length += strlen($encoded);
@@ -556,7 +551,7 @@
       }
       sqimap_logout($imap_stream);
       // Delete the files uploaded for attaching (if any).
-      deleteAttachments();
+      ClearAttachments();
    }
 
 ?>

diff --git a/src/compose.php b/src/compose.php
index 078acf6662930429dd9493f6672ed8c884a1a622..80a62db6126266eb509fe702ccecb03770316ebb 100644 (file)
--- a/src/compose.php
+++ b/src/compose.php
@@ -41,7 +41,10 @@
    include("../src/load_prefs.php");
 
    if (!isset($attachments))
+   {
        $attachments = array();
+       session_register('attachments');
+   }
 
    // This function is used when not sending or adding attachments
    function newMail () {
@@ -155,7 +158,7 @@
    function getAttachments($message) {
       global $mailbox, $attachments, $attachment_dir, $imapConnection,
              $ent_num, $forward_id;
-      
+
       if (!$message) {
            sqimap_mailbox_select($imapConnection, $mailbox);
            $message = sqimap_get_message($imapConnection, $forward_id, 
@@ -170,23 +173,22 @@
                   $filename = "untitled-".$message->header->entity_id;
       
               $localfilename = GenerateRandomString(32, '', 7);
-             while (isset($attachments[$localfilename]))
+             while (file_exists($attachment_dir . $localfilename))
                  $localfilename = GenerateRandomString(32, '', 7);
-      
-              // Write File Info
-              $fp = fopen ($attachment_dir.$localfilename.".info", "w");
-              fputs ($fp, strtolower($message->header->type0)."/".
-                 strtolower($message->header->type1)."\n".$filename."\n");
-              fclose ($fp);
+
+              $newAttachment['localfilename'] = $localfilename;
+             $newAttachment['remotefilename'] = $filename;
+             $newAttachment['type0'] = strtolower($message->header->type0 .
+                '/' . $message->header->type1);
 
               // Write Attachment to file
-              $fp = fopen ($attachment_dir.$localfilename, "w");
+              $fp = fopen ($attachment_dir.$localfilename, 'w');
               fputs ($fp, decodeBody(mime_fetch_body($imapConnection, 
                  $forward_id, $message->header->entity_id), 
                  $message->header->encoding));
               fclose ($fp);
       
-              $attachments[$localfilename] = $filename;
+              $attachments[] = $newAttachment;
           }
       } else {
           for ($i = 0; $i < count($message->entities); $i++) {
@@ -265,11 +267,10 @@
          printf("         <INPUT TYPE=text NAME=subject SIZE=60 VALUE=\"%s\">",
                 htmlspecialchars($reply_subj));
       } else if ($forward_subj) {
-         $forward_subj = str_replace("\"", "'", $forward_subj);
          $forward_subj = trim($forward_subj);
-         if ((substr(strtolower($forward_subj), 0, 4) != "fwd:") &&
-             (substr(strtolower($forward_subj), 0, 5) != "[fwd:") &&
-             (substr(strtolower($forward_subj), 0, 6) != "[ fwd:"))
+         if ((substr(strtolower($forward_subj), 0, 4) != 'fwd:') &&
+             (substr(strtolower($forward_subj), 0, 5) != '[fwd:') &&
+             (substr(strtolower($forward_subj), 0, 6) != '[ fwd:'))
             $forward_subj = "[Fwd: $forward_subj]";
          printf("         <INPUT TYPE=text NAME=subject SIZE=60 VALUE=\"%s\">",
                 htmlspecialchars($forward_subj));
@@ -311,13 +312,14 @@
       echo " value=\"" . _("Add") ."\">\n";
       echo "     </td>\n";
       echo "   </tr>\n";
-      if (count($attachments) > 0) {
+      if (count($attachments))
+      {
          echo "<tr><td bgcolor=\"$color[0]\" align=right>\n";
          echo "&nbsp;";
          echo "</td><td align=left bgcolor=\"$color[0]\">";
-         while (list($localname, $remotename) = each($attachments)) {
-            echo "<input type=\"checkbox\" name=\"delete[]\" value=\"$localname\">\n";
-            echo "$remotename <input type=\"hidden\" name=\"attachments[$localname]\" value=\"$remotename\"><br>\n";
+        foreach ($attachments as $key => $info) {
+            echo "<input type=\"checkbox\" name=\"delete[]\" value=\"$key\">\n";
+           echo $info['remotefilename'] . "<br>\n";
          }
          
          echo "<input type=\"submit\" name=\"do_delete\" value=\""._("Delete selected attachments")."\">\n";
@@ -332,6 +334,7 @@
    
    function showComposeButtonRow() {
       global $use_javascript_addr_book;
+      
       echo "   <TR><td>\n   </td><td>\n";
       if ($use_javascript_addr_book) {
          echo "      <SCRIPT LANGUAGE=JavaScript><!--\n document.write(\"";
@@ -350,12 +353,6 @@
       echo "   </TR>\n\n";
    }
 
-   function showSentForm () {
-      echo "<BR><BR><BR><CENTER><B>Message Sent!</B><BR><BR>";
-      echo "You will be automatically forwarded.<BR>If not, <A HREF=\"right_main.php\">click here</A>";
-      echo "</CENTER>";
-   }
-
    function checkInput ($show) {
       /** I implemented the $show variable because the error messages
           were getting sent before the page header.  So, I check once
@@ -378,23 +375,21 @@
       
       is_logged_in();
       $localfilename = GenerateRandomString(32, '', 7);
-      while (isset($attachments[$localfilename]))
+      while (file_exists($attachment_dir . $localfilename))
           $localfilename = GenerateRandomString(32, '', 7);
-      
+
       if (!@rename($HTTP_POST_FILES['attachfile']['tmp_name'], $attachment_dir.$localfilename)) {
          if (!@copy($HTTP_POST_FILES['attachfile']['tmp_name'], $attachment_dir.$localfilename)) {
             return true;
          }
       }
+   
+      $newAttachment['localfilename'] = $localfilename;
+      $newAttachment['remotefilename'] = $HTTP_POST_FILES['attachfile']['name'];
+      $newAttachment['type'] = 
+         strtolower($HTTP_POST_FILES['attachfile']['type']);
       
-      if (!isset($failed) || !$failed) {
-         // Write information about the file
-         $fp = fopen ($attachment_dir.$localfilename.".info", "w");
-         fputs ($fp, $HTTP_POST_FILES['attachfile']['type']."\n".$HTTP_POST_FILES['attachfile']['name']."\n");
-         fclose ($fp);
-
-         $attachments[$localfilename] = $HTTP_POST_FILES['attachfile']['name'];
-      }
+      $attachments[] = $newAttachment;
     }
   
    function SqConvertRussianCharsets(){
@@ -428,7 +423,7 @@
    if (!isset($mailbox) || $mailbox == "" || ($mailbox == "None"))
       $mailbox = "INBOX";
 
-   if(isset($send)) {
+   if (isset($send)) {
       if (isset($HTTP_POST_FILES['attachfile']) &&
           $HTTP_POST_FILES['attachfile']['tmp_name'] &&
           $HTTP_POST_FILES['attachfile']['tmp_name'] != 'none')
@@ -490,10 +485,13 @@
       is_logged_in();
       displayPageHeader($color, $mailbox);
 
-      while (list($lkey, $localname) = each($delete)) {
-         unset ($attachments[$localname]);
-         unlink ($attachment_dir.$localname);
-         unlink ($attachment_dir.$localname.".info");
+      if (isset($delete) && is_array($delete))
+      {
+         foreach($delete as $index)
+         {
+            unlink ($attachment_dir.$attachments[$index]['localfilename']);
+            unset ($attachments[$index]);
+        }
       }
 
       showInputForm();
@@ -505,6 +503,9 @@
       displayPageHeader($color, $mailbox);
 
       $newmail = true;
+
+      ClearAttachments();
+
       if (isset($forward_id) && $forward_id && isset($ent_num) && $ent_num)
           getAttachments(0);
               
@@ -512,4 +513,23 @@
       showInputForm();
       sqimap_logout($imapConnection);
    }
+   
+   
+   
+   
+   function ClearAttachments()
+   {
+       global $attachments, $attachment_dir;
+       
+       foreach ($attachments as $info)
+       {
+           if (file_exists($attachment_dir . $info['localfilename']))
+          {
+               unlink($attachment_dir . $info['localfilename']);
+          }
+       }
+       
+       $attachments = array();
+   }
+   
 ?>