Change anti-CSRF security token lifetime to be session-based

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14772 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add hidden configuration variables for anti-CSRF security token features

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14771 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add session-based security token functionality (enabled by default)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14770 7612ce4b-ef26-0410-bec9-ea0150e637f0

Allow more advanced element focusing

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14765 7612ce4b-ef26-0410-bec9-ea0150e637f0

TLS settings were not working

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14762 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix link

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14756 7612ce4b-ef26-0410-bec9-ea0150e637f0

Correct CVE number

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14755 7612ce4b-ef26-0410-bec9-ea0150e637f0

Sanitize user-supplied attachment filename [CVE-2018-8741]

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14753 7612ce4b-ef26-0410-bec9-ea0150e637f0

Happy New Year

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14750 7612ce4b-ef26-0410-bec9-ea0150e637f0

Seriously? The variable is named as an array and initialized as a string? Well, I hope no callers were expecting a potentially empty string, because now they will get an empty array instead. empty() should handle this fine, hopefully callers do something sane like that.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14748 7612ce4b-ef26-0410-bec9-ea0150e637f0

Document bad assumption

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14747 7612ce4b-ef26-0410-bec9-ea0150e637f0

Make return-to-message work for forwards

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14745 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add option to allow returning to the message one had been replying to after sending

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14742 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add option to allow returning to the message one had been replying to after sending

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14741 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add ability for saved drafts to indicate if they are a reply or forward and if so, to which message, and mark that message as replied or forwarded when the draft is finally sent

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14737 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add ability for saved drafts to indicate if they are a reply or forward and if so, to which message, and mark that message as replied or forwarded when the draft is finally sent

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14736 7612ce4b-ef26-0410-bec9-ea0150e637f0

Minor fix and clarify return types

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14735 7612ce4b-ef26-0410-bec9-ea0150e637f0

Minor fix and clarify return types

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14734 7612ce4b-ef26-0410-bec9-ea0150e637f0

Allow callers of sqm_api_mailbox_select() to determine if errors should be handled internally or just returned

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14733 7612ce4b-ef26-0410-bec9-ea0150e637f0

Make drafts send with in-reply-to headers (fix regression from long ago)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14732 7612ce4b-ef26-0410-bec9-ea0150e637f0

Allow callers of sqimap_mailbox_select() to determine if errors should be handled internally or just returned

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14727 7612ce4b-ef26-0410-bec9-ea0150e637f0

May as well grab offset info too

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14724 7612ce4b-ef26-0410-bec9-ea0150e637f0

Minor change

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14722 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add trailing text display to edit list widget types

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14720 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add docs for function

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14719 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add trailing text to boolean-radio widgets

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14715 7612ce4b-ef26-0410-bec9-ea0150e637f0

Remove outdated headers

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14713 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add title to folder names

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14711 7612ce4b-ef26-0410-bec9-ea0150e637f0

Allow options to use HTML in trailing text

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14706 7612ce4b-ef26-0410-bec9-ea0150e637f0

Allow options to use HTML in trailing text

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14705 7612ce4b-ef26-0410-bec9-ea0150e637f0

Legacy code was probably wrong

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14702 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add newline after <textarea> because it is always removed by the browser per spec: https://w3.org/TR/html401/appendix/notes.html#notes-line-breaks

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14699 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add note about squirrelspell plugin change

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14687 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add ability to control the display of the "Check Spelling" button. Allows administrators to offer this plugin but keep it out of the way for users who do not want it. Put sqspell_show_button=0 in default preferences if it should be hidden by default.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14686 7612ce4b-ef26-0410-bec9-ea0150e637f0

Missing close form tag

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14683 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add "trailing_text_small" flag for option widgets

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14676 7612ce4b-ef26-0410-bec9-ea0150e637f0

Better white space and wrapping

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14675 7612ce4b-ef26-0410-bec9-ea0150e637f0

Better white space and wrapping

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14674 7612ce4b-ef26-0410-bec9-ea0150e637f0

SM doesn't know how to log in again on the same connection, so best to actually close the file handle as well

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14662 7612ce4b-ef26-0410-bec9-ea0150e637f0

Allow HTML in option info

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14658 7612ce4b-ef26-0410-bec9-ea0150e637f0

Make server TZ available after it is changed

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14656 7612ce4b-ef26-0410-bec9-ea0150e637f0

Change credits

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14654 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add one more person

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14651 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix insufficient sendmail command argument escaping (thanks to Mitchel Sahertian, Maor Shwartz and Dawid Golunski for bringing this to our attention). [CVE-2017-7692]

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14650 7612ce4b-ef26-0410-bec9-ea0150e637f0

Note future change

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14648 7612ce4b-ef26-0410-bec9-ea0150e637f0

Happy 2017

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14643 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add PHP5-style constructor

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14635 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add PHP5-style constructor

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14632 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add PHP5-style constructor

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14631 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add PHP5-style constructor

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14628 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add PHP5-style constructor

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14627 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add PHP5-style constructor

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14625 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add PHP5-style constructor

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14622 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix variable name typo

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14620 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add PHP5-style constructor

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14618 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add PHP5-style constructor

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14616 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add PHP5-style constructor

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14613 7612ce4b-ef26-0410-bec9-ea0150e637f0

Label static functions as such; callers won't get deprecated warnings in PHP7

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14611 7612ce4b-ef26-0410-bec9-ea0150e637f0

PHP7 fix. Thanks to Kevin Buckley for reporting

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14608 7612ce4b-ef26-0410-bec9-ea0150e637f0

More sensible identity selection

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14606 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add support for socket-based database connections

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14601 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add support for socket-based database connections

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14600 7612ce4b-ef26-0410-bec9-ea0150e637f0

Update docs

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14598 7612ce4b-ef26-0410-bec9-ea0150e637f0

Update change log

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14593 7612ce4b-ef26-0410-bec9-ea0150e637f0

New config_local settings

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14592 7612ce4b-ef26-0410-bec9-ea0150e637f0

Use PDO for database access if available (adds PHP 7 compatibility)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14591 7612ce4b-ef26-0410-bec9-ea0150e637f0

Use PDO for database access if available (adds PHP 7 compatibility)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14587 7612ce4b-ef26-0410-bec9-ea0150e637f0

Squash bugs

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14586 7612ce4b-ef26-0410-bec9-ea0150e637f0

Use PDO for database access if available (adds PHP 7 compatibility)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14585 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix bad assumptions about parallel arrays - see it explode by removing folders without unsubscribing them, which is legal per RFC

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14577 7612ce4b-ef26-0410-bec9-ea0150e637f0

Syntax error. Thanks to Jean-Jacques Puig

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14574 7612ce4b-ef26-0410-bec9-ea0150e637f0

Allow priority and identity selections to be given by callers. Looks to have been intended to work this way, but never tested.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14556 7612ce4b-ef26-0410-bec9-ea0150e637f0

Per comments in the commit - setting the session cookie over and over can be troublesome, but doing the obvious and defaulting to *replace* cookies causes logins to fail due to something I don't care to debug - session cookie is complex through all the pages involved in a login request - instead we use a simple static cache to prevent useless duplicate cookie headers

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14552 7612ce4b-ef26-0410-bec9-ea0150e637f0

Happy New Year

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14539 7612ce4b-ef26-0410-bec9-ea0150e637f0

Update defaults

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14533 7612ce4b-ef26-0410-bec9-ea0150e637f0

Minor correction

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14532 7612ce4b-ef26-0410-bec9-ea0150e637f0

Minor code organization

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14531 7612ce4b-ef26-0410-bec9-ea0150e637f0

Adding "smtp_helo_override" hook

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14528 7612ce4b-ef26-0410-bec9-ea0150e637f0

Adding "smtp_helo_override" hook

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14527 7612ce4b-ef26-0410-bec9-ea0150e637f0

Check for error opening directory

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14524 7612ce4b-ef26-0410-bec9-ea0150e637f0

Minor fix

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14519 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add new login_before_page_header (boolean) hook; allows plugins to have more explicit control over login page header

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14518 7612ce4b-ef26-0410-bec9-ea0150e637f0

Always show subject tooltip rollover

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14515 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add a couple sensible defaults

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14513 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add a couple sensible defaults

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14510 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add ability for administrator to control whether or not users can edit their reply-to address

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14509 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add MD5 alternative to directory hash calculation

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14506 7612ce4b-ef26-0410-bec9-ea0150e637f0

Sync configtest with core

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14502 7612ce4b-ef26-0410-bec9-ea0150e637f0

Replace invalid characters with a symbol instead of returning empty string for the
entire to be encoded string.

Currently, if an email contains such an invalid character, the whole line will be
left out, which is rather confusing. Even more when it's the email subject. This
constant is only available in PHP 5.4 and up.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14501 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix uninitialized client IP address.  Thanks to Wuerr Marcus

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14499 7612ce4b-ef26-0410-bec9-ea0150e637f0

Fix PHP notice - this function is called statically, so needs to be declared as such.  Thanks to Juergen Nickelsen for reporting

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14494 7612ce4b-ef26-0410-bec9-ea0150e637f0

Make sure the correct identity is used for list command mailto actions

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14492 7612ce4b-ef26-0410-bec9-ea0150e637f0

Ah, I see - the stuff after the ? needs to be handed to src/compose.php as-is, no encoding.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14490 7612ce4b-ef26-0410-bec9-ea0150e637f0

Unsubscribe addresses with characters like + in them need to be url-encoded if they are going to be used in a query string. Not sure what the ? to &amp; replacement was doing (was it broken?), but it is possible I broke something by removing it.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14487 7612ce4b-ef26-0410-bec9-ea0150e637f0

Happy new year

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14485 7612ce4b-ef26-0410-bec9-ea0150e637f0

Happy 2015

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14484 7612ce4b-ef26-0410-bec9-ea0150e637f0

Prevent session lock-up caused by filters plugin trying to move messages in an account that is over quota

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14474 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add session variables that store information about most recent fatal IMAP error

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14472 7612ce4b-ef26-0410-bec9-ea0150e637f0

If filtering fails, say due to account quota issues, disable for remaineder of login session.  This plugin appears to have a more serious issue that corrupts folder cache in subfolders of INBOX

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14469 7612ce4b-ef26-0410-bec9-ea0150e637f0

Add hook in 1.5.2 for attachments_top as with 1.4.23

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14451 7612ce4b-ef26-0410-bec9-ea0150e637f0