diff options
Diffstat (limited to 'program/include/rcmail_output_html.php')
| -rw-r--r-- | program/include/rcmail_output_html.php | 129 |
1 files changed, 55 insertions, 74 deletions
diff --git a/program/include/rcmail_output_html.php b/program/include/rcmail_output_html.php index 6100269b9..998779509 100644 --- a/program/include/rcmail_output_html.php +++ b/program/include/rcmail_output_html.php @@ -67,11 +67,12 @@ class rcmail_output_html extends rcmail_output //$this->framed = $framed; $this->set_env('task', $task); $this->set_env('x_frame_options', $this->config->get('x_frame_options', 'sameorigin')); + $this->set_env('standard_windows', (bool) $this->config->get('standard_windows')); // add cookie info $this->set_env('cookie_domain', ini_get('session.cookie_domain')); $this->set_env('cookie_path', ini_get('session.cookie_path')); - $this->set_env('cookie_secure', ini_get('session.cookie_secure')); + $this->set_env('cookie_secure', filter_var(ini_get('session.cookie_secure'), FILTER_VALIDATE_BOOLEAN)); // load the correct skin (in case user-defined) $skin = $this->config->get('skin'); @@ -105,7 +106,6 @@ class rcmail_output_html extends rcmail_output )); } - /** * Set environment variable * @@ -121,7 +121,6 @@ class rcmail_output_html extends rcmail_output } } - /** * Getter for the current page title * @@ -145,17 +144,17 @@ class rcmail_output_html extends rcmail_output return $title; } - /** * Set skin */ public function set_skin($skin) { $valid = false; + $path = RCUBE_INSTALL_PATH . 'skins/'; - if (!empty($skin) && is_dir('skins/'.$skin) && is_readable('skins/'.$skin)) { - $skin_path = 'skins/'.$skin; - $valid = true; + if (!empty($skin) && is_dir($path . $skin) && is_readable($path . $skin)) { + $skin_path = 'skins/' . $skin; + $valid = true; } else { $skin_path = $this->config->get('skin_path'); @@ -183,13 +182,16 @@ class rcmail_output_html extends rcmail_output $this->skin_paths[] = $skin_path; // read meta file and check for dependecies - $meta = @json_decode(@file_get_contents($skin_path.'/meta.json'), true); - if ($meta['extends'] && is_dir('skins/' . $meta['extends'])) { - $this->load_skin('skins/' . $meta['extends']); + $meta = @file_get_contents(RCUBE_INSTALL_PATH . $skin_path . '/meta.json'); + $meta = @json_decode($meta, true); + if ($meta['extends']) { + $path = RCUBE_INSTALL_PATH . 'skins/'; + if (is_dir($path . $meta['extends']) && is_readable($path . $meta['extends'])) { + $this->load_skin('skins/' . $meta['extends']); + } } } - /** * Check if a specific template exists * @@ -198,16 +200,17 @@ class rcmail_output_html extends rcmail_output */ public function template_exists($name) { - $found = false; foreach ($this->skin_paths as $skin_path) { - $filename = $skin_path . '/templates/' . $name . '.html'; - $found = (is_file($filename) && is_readable($filename)) || ($this->deprecated_templates[$name] && $this->template_exists($this->deprecated_templates[$name])); - if ($found) - break; + $filename = RCUBE_INSTALL_PATH . $skin_path . '/templates/' . $name . '.html'; + if ((is_file($filename) && is_readable($filename)) + || ($this->deprecated_templates[$name] && $this->template_exists($this->deprecated_templates[$name])) + ) { + return true; + } } - return $found; - } + return false; + } /** * Find the given file in the current skin path stack @@ -233,7 +236,6 @@ class rcmail_output_html extends rcmail_output return false; } - /** * Register a GUI object to the client script * @@ -246,7 +248,6 @@ class rcmail_output_html extends rcmail_output $this->add_script(self::JS_OBJECT_NAME.".gui_object('$obj', '$id');"); } - /** * Call a client method * @@ -262,7 +263,6 @@ class rcmail_output_html extends rcmail_output $this->js_commands[] = $cmd; } - /** * Add a localized label to the client environment */ @@ -277,7 +277,6 @@ class rcmail_output_html extends rcmail_output } } - /** * Invoke display_message command * @@ -304,7 +303,6 @@ class rcmail_output_html extends rcmail_output } } - /** * Delete all stored env variables and commands * @@ -327,7 +325,6 @@ class rcmail_output_html extends rcmail_output $this->body = ''; } - /** * Redirect to a certain url * @@ -343,7 +340,6 @@ class rcmail_output_html extends rcmail_output exit; } - /** * Send the request output to the client. * This will either parse a skin tempalte or send an AJAX response @@ -377,7 +373,6 @@ class rcmail_output_html extends rcmail_output } } - /** * Process template and write to stdOut * @@ -413,7 +408,6 @@ class rcmail_output_html extends rcmail_output $this->_write($template, $this->config->get('skin_path')); } - /** * Parse a specific skin template and deliver to stdout (or return) * @@ -538,7 +532,6 @@ class rcmail_output_html extends rcmail_output } } - /** * Return executable javascript code for all registered commands * @@ -570,7 +563,6 @@ class rcmail_output_html extends rcmail_output return $out; } - /** * Make URLs starting with a slash point to skin directory * @@ -590,7 +582,6 @@ class rcmail_output_html extends rcmail_output return $str; } - /** * Show error page and terminate script execution * @@ -625,7 +616,6 @@ class rcmail_output_html extends rcmail_output array($this, 'globals_callback'), $input); } - /** * Callback funtion for preg_replace_callback() in parse_with_globals() */ @@ -634,7 +624,6 @@ class rcmail_output_html extends rcmail_output return $GLOBALS[$matches[1]]; } - /** * Correct absolute paths in images and other tags * add timestamp to .js and .css filename @@ -646,7 +635,6 @@ class rcmail_output_html extends rcmail_output array($this, 'file_callback'), $output); } - /** * Callback function for preg_replace_callback in write() * @@ -655,7 +643,7 @@ class rcmail_output_html extends rcmail_output protected function file_callback($matches) { $file = $matches[3]; - $file[0] = preg_replace('!^/this/!', '/', $file[0]); + $file = preg_replace('!^/this/!', '/', $file); // correct absolute paths if ($file[0] == '/') { @@ -672,7 +660,6 @@ class rcmail_output_html extends rcmail_output return $matches[1] . '=' . $matches[2] . $file . $matches[4]; } - /** * Public wrapper to dipp into template parsing. * @@ -689,7 +676,6 @@ class rcmail_output_html extends rcmail_output return $input; } - /** * Parse for conditional tags * @@ -727,21 +713,18 @@ class rcmail_output_html extends rcmail_output return $input; } - /** * Determines if a given condition is met * - * @todo Get rid off eval() once I understand what this does. * @todo Extend this to allow real conditions, not just "set" * @param string Condition statement * @return boolean True if condition is met, False if not */ protected function check_condition($condition) { - return eval("return (".$this->parse_expression($condition).");"); + return $this->eval_expression($condition); } - /** * Inserts hidden field with CSRF-prevention-token into POST forms */ @@ -758,16 +741,16 @@ class rcmail_output_html extends rcmail_output return $out; } - /** - * Parses expression and replaces variables + * Parse & evaluate a given expression and return its result. + * + * @param string Expression statement * - * @param string Expression statement - * @return string Expression value + * @return mixed Expression result */ - protected function parse_expression($expression) + protected function eval_expression ($expression) { - return preg_replace( + $expression = preg_replace( array( '/session:([a-z0-9_]+)/i', '/config:([a-z0-9_]+)(:([a-z0-9_]+))?/i', @@ -779,16 +762,30 @@ class rcmail_output_html extends rcmail_output ), array( "\$_SESSION['\\1']", - "\$this->app->config->get('\\1',rcube_utils::get_boolean('\\3'))", - "\$this->env['\\1']", + "\$app->config->get('\\1',rcube_utils::get_boolean('\\3'))", + "\$env['\\1']", "rcube_utils::get_input_value('\\1', rcube_utils::INPUT_GPC)", "\$_COOKIE['\\1']", - "\$this->browser->{'\\1'}", + "\$browser->{'\\1'}", $this->template_name, ), - $expression); - } + $expression + ); + + $fn = create_function('$app,$browser,$env', "return ($expression);"); + if (!$fn) { + rcube::raise_error(array( + 'code' => 505, + 'type' => 'php', + 'file' => __FILE__, + 'line' => __LINE__, + 'message' => "Expression parse error on: ($expression)"), true, false); + return null; + } + + return $fn($this->app, $this->browser, $this->env); + } /** * Search for special tags in input and replace them @@ -804,7 +801,6 @@ class rcmail_output_html extends rcmail_output return preg_replace_callback('/<roundcube:([-_a-z]+)\s+((?:[^>]|\\\\>)+)(?<!\\\\)>/Ui', array($this, 'xml_command'), $input); } - /** * Callback function for parsing an xml command tag * and turn it into real html content @@ -839,7 +835,7 @@ class rcmail_output_html extends rcmail_output // show a label case 'label': if ($attrib['expression']) - $attrib['name'] = eval("return " . $this->parse_expression($attrib['expression']) .";"); + $attrib['name'] = $this->eval_expression($attrib['expression']); if ($attrib['name'] || $attrib['command']) { // @FIXME: 'noshow' is useless, remove? @@ -873,6 +869,7 @@ class rcmail_output_html extends rcmail_output // include a file case 'include': $old_base_path = $this->base_path; + if (!empty($attrib['skin_path'])) $attrib['skinpath'] = $attrib['skin_path']; if ($path = $this->get_skin_file($attrib['file'], $skin_path, $attrib['skinpath'])) { $this->base_path = preg_replace('!plugins/\w+/!', '', $skin_path); // set base_path to core skin directory (not plugin's skin) $path = realpath($path); @@ -970,8 +967,7 @@ class rcmail_output_html extends rcmail_output // return code for a specified eval expression case 'exp': - $value = $this->parse_expression($attrib['expression']); - return eval("return html::quote($value);"); + return html::quote($this->eval_expression($attrib['expression'])); // return variable case 'var': @@ -1008,12 +1004,13 @@ class rcmail_output_html extends rcmail_output } return html::quote($value); - break; + + case 'form': + return $this->form_tag($attrib); } return ''; } - /** * Include a specific file and return it's contents * @@ -1030,7 +1027,6 @@ class rcmail_output_html extends rcmail_output return $out; } - /** * Create and register a button * @@ -1186,7 +1182,6 @@ class rcmail_output_html extends rcmail_output return $out; } - /** * Link an external script file * @@ -1217,7 +1212,6 @@ class rcmail_output_html extends rcmail_output $this->script_files[$position][] = $file; } - /** * Add inline javascript code * @@ -1234,7 +1228,6 @@ class rcmail_output_html extends rcmail_output } } - /** * Link an external css file * @@ -1245,7 +1238,6 @@ class rcmail_output_html extends rcmail_output $this->css_files[] = $file; } - /** * Add HTML code to the page header * @@ -1256,7 +1248,6 @@ class rcmail_output_html extends rcmail_output $this->header .= "\n" . $str; } - /** * Add HTML code to the page footer * To be added right befor </body> @@ -1268,7 +1259,6 @@ class rcmail_output_html extends rcmail_output $this->footer .= "\n" . $str; } - /** * Process template and write to stdOut * @@ -1393,7 +1383,6 @@ class rcmail_output_html extends rcmail_output } } - /** * Returns iframe object, registers some related env variables * @@ -1424,7 +1413,6 @@ class rcmail_output_html extends rcmail_output /* ************* common functions delivering gui objects ************** */ - /** * Create a form tag with the necessary hidden fields * @@ -1446,12 +1434,11 @@ class rcmail_output_html extends rcmail_output $attrib['noclose'] = true; return html::tag('form', - $attrib + array('action' => "./", 'method' => "get"), + $attrib + array('action' => $this->app->comm_path, 'method' => "get"), $hidden . $content, array('id','class','style','name','method','action','enctype','onsubmit')); } - /** * Build a form tag with a unique request token * @@ -1482,7 +1469,6 @@ class rcmail_output_html extends rcmail_output return $this->form_tag($attrib, $hidden->show() . $content); } - /** * GUI object 'username' * Showing IMAP username of the current session @@ -1514,7 +1500,6 @@ class rcmail_output_html extends rcmail_output return rcube_utils::idn_to_utf8($username); } - /** * GUI object 'loginform' * Returns code for the webmail login form @@ -1614,7 +1599,6 @@ class rcmail_output_html extends rcmail_output return $out; } - /** * GUI object 'preloader' * Loads javascript code for images preloading @@ -1637,7 +1621,6 @@ class rcmail_output_html extends rcmail_output }', 'docready'); } - /** * GUI object 'searchform' * Returns code for search function @@ -1676,7 +1659,6 @@ class rcmail_output_html extends rcmail_output return $out; } - /** * Builder for GUI object 'message' * @@ -1694,7 +1676,6 @@ class rcmail_output_html extends rcmail_output return html::div($attrib, ''); } - /** * GUI object 'charsetselector' * |