From 0037f04821b088de88f51ee46a34f8b7fbdf7d63 Mon Sep 17 00:00:00 2001
From: teepe <teepe@7612ce4b-ef26-0410-bec9-ea0150e637f0>
Date: Sun, 3 Mar 2002 10:56:41 +0000
Subject: [PATCH] patch #514208 + input checking of polders page

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@2537 7612ce4b-ef26-0410-bec9-ea0150e637f0
---
 ChangeLog                      |  4 +-
 src/folders.php                | 67 ++++++++++++++++++----------------
 src/folders_create.php         |  4 +-
 src/folders_delete.php         | 24 ++++++++----
 src/folders_rename_getname.php | 10 ++++-
 5 files changed, 67 insertions(+), 42 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 540f9abf..c9d6a18d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,10 +5,12 @@
 Version 1.2.6 -- CVS
 --------------------
   - Fixed resume draft bug #513521, #514639
-  - Newmail plugin: admin can disablethe use of audio (patch #517698)
+  - Newmail plugin: admin can disable the use of audio (patch #517698)
   - Fixed quoting problem in safe html (patch #516542)
   - SPAM folder no longer special folder (filters plugin)
   - Filtering now happens on folder list refresh (filters plugin)
+  - Added checking of input of the folders page
+  - Made erronous deleting of folders harder (patch #514208)
 	
 Version 1.2.5 -- 22 February 2002
 ---------------------------------
diff --git a/src/folders.php b/src/folders.php
index f2589fb0..5abf8b26 100644
--- a/src/folders.php
+++ b/src/folders.php
@@ -103,14 +103,43 @@ echo "</FORM></TD></TR>\n";
 
 echo "<tr><td bgcolor=\"$color[4]\">&nbsp;</td></tr>\n";
 
+
+/** count special folders **/
+$count_special_folders = 0;
+$num_max = 1;
+if (strtolower($imap_server_type) == "courier" || $move_to_trash) {
+        $num_max++;
+}
+if ($move_to_sent) {
+        $num_max++;
+}
+if ($save_as_draft) {
+        $num_max++;
+}
+for ($p = 0; $p < count($boxes) && $count_special_folders < $num_max; $p++) {
+    if (strtolower($boxes[$p]['unformatted']) == 'inbox')
+        $count_special_folders++;
+    else if (strtolower($imap_server_type) == 'courier' &&
+            strtolower($boxes[$p]['unformatted']) == 'inbox.trash')
+        $count_special_folders++;
+    else if ($boxes[$p]['unformatted'] == $trash_folder && $trash_folder)
+        $count_special_folders++;
+    else if ($boxes[$p]['unformatted'] == $sent_folder && $sent_folder)
+        $count_special_folders++;
+    else if ($boxes[$p]['unformatted'] == $draft_folder && $draft_folder)
+        $count_special_folders++;
+}
+
+
 /** RENAMING FOLDERS **/
 echo "<TR><TD BGCOLOR=\"$color[9]\" ALIGN=CENTER><B>".
      _("Rename a Folder").
      "</B></TD></TR>".
      "<TR><TD BGCOLOR=\"$color[0]\" ALIGN=CENTER>";
-if (count($boxes)) {
-    echo "<FORM ACTION=\"folders_rename_getname.php\" METHOD=\"POST\">\n".
-         "<TT><SELECT NAME=old>\n";
+if ($count_special_folders < count($boxes)) {
+    echo "<FORM ACTION=\"folders_rename_getname.php\" METHOD=\"POST\">\n"
+       . "<TT><SELECT NAME=old>\n"
+       . '         <OPTION VALUE="">[ ' . _("Select a folder") . " ]</OPTION>\n";
     for ($i = 0; $i < count($boxes); $i++) {
         $use_folder = true;
 
@@ -144,34 +173,10 @@ echo _("Delete Folder");
 echo "</B></TD></TR>";
 echo "<TR><TD BGCOLOR=\"$color[0]\" ALIGN=CENTER>";
 
-$count_special_folders = 0;
-$num_max = 1;
-if (strtolower($imap_server_type) == "courier" || $move_to_trash) {
-        $num_max++;
-}
-if ($move_to_sent) {
-        $num_max++;
-}
-if ($save_as_draft) {
-        $num_max++;
-}
-for ($p = 0; $p < count($boxes) && $count_special_folders < $num_max; $p++) {
-    if (strtolower($boxes[$p]['unformatted']) == 'inbox')
-        $count_special_folders++;
-    else if (strtolower($imap_server_type) == 'courier' &&
-            strtolower($boxes[$p]['unformatted']) == 'inbox.trash')
-        $count_special_folders++;
-    else if ($boxes[$p]['unformatted'] == $trash_folder && $trash_folder)
-        $count_special_folders++;
-    else if ($boxes[$p]['unformatted'] == $sent_folder && $sent_folder)
-        $count_special_folders++;
-    else if ($boxes[$p]['unformatted'] == $draft_folder && $draft_folder)
-        $count_special_folders++;
-}
-
 if ($count_special_folders < count($boxes)) {
-    echo "<FORM ACTION=\"folders_delete.php\" METHOD=\"POST\">\n";
-    echo "<TT><SELECT NAME=mailbox>\n";
+    echo "<FORM ACTION=\"folders_delete.php\" METHOD=\"POST\">\n"
+       . "<TT><SELECT NAME=mailbox>\n"
+       . '         <OPTION VALUE="">[ ' . _("Select a folder") . " ]</OPTION>\n";
     for ($i = 0; $i < count($boxes); $i++) {
         $use_folder = true;
         if ((strtolower($boxes[$i]['unformatted']) != 'inbox') &&
@@ -278,4 +283,4 @@ do_hook("folders_bottom");
    sqimap_logout($imapConnection);
 ?>
 
-</body></html>
\ No newline at end of file
+</body></html>
diff --git a/src/folders_create.php b/src/folders_create.php
index a28e2248..d3309f68 100644
--- a/src/folders_create.php
+++ b/src/folders_create.php
@@ -22,7 +22,9 @@ global $delimiter;
 $folder_name = trim($folder_name);
 
 if (strpos($folder_name, "\"") || strpos($folder_name, "\\") ||
-    strpos($folder_name, "'") || strpos($folder_name, "$delimiter")) {
+    strpos($folder_name, "'") || strpos($folder_name, "$delimiter") ||
+    ($folder_name == '')) {
+    displayPageHeader($color, 'None');
     echo "<html><body bgcolor=$color[4]>";
     plain_error_message(_("Illegal folder name.  Please select a different name.")."<BR><A HREF=\"../src/folders.php\">"._("Click here to go back")."</A>.", $color);
     sqimap_logout($imapConnection);
diff --git a/src/folders_delete.php b/src/folders_delete.php
index 40c2ca2f..d24eb9a8 100644
--- a/src/folders_delete.php
+++ b/src/folders_delete.php
@@ -23,6 +23,14 @@ require_once('../functions/tree.php');
 *     $mailbox - selected mailbox from the form
 */
 
+if ($mailbox == '') {
+    displayPageHeader($color, 'None');
+    echo "<html><body bgcolor=$color[4]>";
+    plain_error_message(_("You have not selected a folder to delete. Please do so.")."<BR><A HREF=\"../src/folders.php\">"._("Click here to go back")."</A>.", $color);
+    exit;
+}
+
+
 $imap_stream = sqimap_login($username, $key, $imapServerAddress, $imapPort, 0);
 $boxes = sqimap_mailbox_list ($imap_stream);
 global $delimiter, $delete_folder;
@@ -35,24 +43,24 @@ else
 /** lets see if we CAN move folders to the trash.. otherwise,
     ** just delete them **/
 
-// Courier IMAP doesn't like subfolders of Trash
+/* Courier IMAP doesn't like subfolders of Trash */
 if (strtolower($imap_server_type) == "courier") {
     $can_move_to_trash = false;
 }
 
-// If global options say we can't move it into Trash
+/* If global options say we can't move it into Trash */
 else if(isset($delete_folder) && $delete_folder == true) {
     $can_move_to_trash = false;
 }
 
-// If it's already a subfolder of trash, we'll have to delete it
+/* If it's already a subfolder of trash, we'll have to delete it */
 else if(eregi("^".$trash_folder.".+", $mailbox)) {
 
     $can_move_to_trash = false;
 
 }
 
-// Otherwise, check if trash folder exits and support sub-folders
+/* Otherwise, check if trash folder exits and support sub-folders */
 else {
     for ($i = 0; $i < count($boxes); $i++) {
         if ($boxes[$i]["unformatted"] == $trash_folder) {
@@ -69,16 +77,16 @@ for ($i = 0;$i < count($boxes);$i++) {
         continue;
     }
 }
-// Now create the nodes for subfolders of the parent folder
-// You can tell that it is a subfolder by tacking the mailbox delimiter
-//    on the end of the $mailbox string, and compare to that.
+/* Now create the nodes for subfolders of the parent folder
+   You can tell that it is a subfolder by tacking the mailbox delimiter
+   on the end of the $mailbox string, and compare to that.  */
 $j = 0;
 for ($i = 0;$i < count($boxes);$i++) {
     if (substr($boxes[$i]["unformatted"], 0, strlen($mailbox_no_dm . $delimiter)) == ($mailbox_no_dm . $delimiter)) {
         addChildNodeToTree($boxes[$i]["unformatted"], $boxes[$i]["unformatted-dm"], $foldersTree);
     }
 }
-//   simpleWalkTreePre(0, $foldersTree);
+/*   simpleWalkTreePre(0, $foldersTree); */
 
 /** Lets start removing the folders and messages **/
 if (($move_to_trash == true) && ($can_move_to_trash == true)) { /** if they wish to move messages to the trash **/
diff --git a/src/folders_rename_getname.php b/src/folders_rename_getname.php
index f6e42250..682a94d7 100644
--- a/src/folders_rename_getname.php
+++ b/src/folders_rename_getname.php
@@ -17,6 +17,14 @@ global $delimiter;
 require_once('../src/validate.php');
 require_once('../functions/imap.php');
 
+if ($old == '') {
+    displayPageHeader($color, 'None');
+    echo "<html><body bgcolor=$color[4]>";
+    plain_error_message(_("You have not selected a folder to rename. Please do so.")."<BR><A HREF=\"../src/folders.php\">"._("Click here to go back")."</A>.", $color);
+    exit;
+}
+
+
 $imapConnection = sqimap_login($username, $key, $imapServerAddress, $imapPort, 0);
 
 if (substr($old, strlen($old) - strlen($delimiter)) == $delimiter) {
@@ -54,4 +62,4 @@ echo "<INPUT TYPE=SUBMIT VALUE=\""._("Submit")."\">\n".
 
 /** Log out this session **/
 sqimap_logout($imapConnection);
-?>
\ No newline at end of file
+?>
-- 
2.25.1