diff options
Diffstat (limited to 'program/include')
| -rw-r--r-- | program/include/bc.php | 18 | ||||
| -rw-r--r-- | program/include/iniset.php | 22 | ||||
| -rw-r--r-- | program/include/rcmail.php | 295 | ||||
| -rw-r--r-- | program/include/rcmail_html_page.php | 2 | ||||
| -rw-r--r-- | program/include/rcmail_output_html.php | 78 |
5 files changed, 130 insertions, 285 deletions
diff --git a/program/include/bc.php b/program/include/bc.php index 3d9d46289..a7d7b5ac1 100644 --- a/program/include/bc.php +++ b/program/include/bc.php @@ -62,7 +62,7 @@ function rcmail_url($action, $p=array(), $task=null) function rcmail_temp_gc() { - $rcmail = rcmail::get_instance()->temp_gc(); + rcmail::get_instance()->gc_temp(); } function rcube_charset_convert($str, $from, $to=NULL) @@ -205,9 +205,9 @@ function rcmail_quota_content($attrib = null) return rcmail::get_instance()->quota_content($attrib); } -function rcmail_display_server_error($fallback=null, $fallback_args=null) +function rcmail_display_server_error($fallback=null, $fallback_args=null, $suffix='') { - rcmail::get_instance()->display_server_error($fallback, $fallback_args); + rcmail::get_instance()->display_server_error($fallback, $fallback_args, $suffix); } function rcmail_filetype2classname($mimetype, $filename) @@ -287,7 +287,7 @@ function rcmail_remote_ip() function rcube_check_referer() { - return rcmail::check_referer(); + return rcube_utils::check_referer(); } function rcube_timer() @@ -405,6 +405,16 @@ function enriched_to_html($data) return rcube_enriched::to_html($data); } +function strip_quotes($str) +{ + return str_replace(array("'", '"'), '', $str); +} + +function strip_newlines($str) +{ + return preg_replace('/[\r\n]/', '', $str); +} + class rcube_html_page extends rcmail_html_page { } diff --git a/program/include/iniset.php b/program/include/iniset.php index 35b5522fc..919cc7682 100644 --- a/program/include/iniset.php +++ b/program/include/iniset.php @@ -21,24 +21,9 @@ */ // application constants -define('RCMAIL_VERSION', '0.9-git'); +define('RCMAIL_VERSION', '1.0-git'); define('RCMAIL_START', microtime(true)); -$config = array( - // Some users are not using Installer, so we'll check some - // critical PHP settings here. Only these, which doesn't provide - // an error/warning in the logs later. See (#1486307). - 'suhosin.session.encrypt' => 0, - 'session.auto_start' => 0, - 'file_uploads' => 1, -); -foreach ($config as $optname => $optval) { - if ($optval != ini_get($optname) && @ini_set($optname, $optval) === false) { - die("ERROR: Wrong '$optname' option value and it wasn't possible to set it to required value ($optval).\n" - ."Check your PHP configuration (including php_admin_flag)."); - } -} - if (!defined('INSTALL_PATH')) { define('INSTALL_PATH', dirname($_SERVER['SCRIPT_FILENAME']).'/'); } @@ -75,6 +60,11 @@ require_once 'Roundcube/bootstrap.php'; // register autoloader for rcmail app classes spl_autoload_register('rcmail_autoload'); +// include composer autoloader (if available) +if (file_exists('vendor/autoload.php')) { + require 'vendor/autoload.php'; +} + // backward compatybility (to be removed) require_once INSTALL_PATH . 'program/include/bc.php'; diff --git a/program/include/rcmail.php b/program/include/rcmail.php index a149db1f6..eff0425c8 100644 --- a/program/include/rcmail.php +++ b/program/include/rcmail.php @@ -98,7 +98,10 @@ class rcmail extends rcube // reset some session parameters when changing task if ($this->task != 'utils') { - if ($this->session && $_SESSION['task'] != $this->task) + // we reset list page when switching to another task + // but only to the main task interface - empty action (#1489076) + // this will prevent from unintentional page reset on cross-task requests + if ($this->session && $_SESSION['task'] != $this->task && empty($this->action)) $this->session->remove('page'); // set current task to session $_SESSION['task'] = $this->task; @@ -123,7 +126,7 @@ class rcmail extends rcube */ public function set_task($task) { - $task = asciiwords($task); + $task = asciiwords($task, true); if ($this->user && $this->user->ID) $task = !$task ? 'mail' : $task; @@ -225,6 +228,11 @@ class rcmail extends rcube } if (!$contacts) { + // there's no default, just return + if ($default) { + return null; + } + self::raise_error(array( 'code' => 700, 'type' => 'php', 'file' => __FILE__, 'line' => __LINE__, @@ -258,13 +266,13 @@ class rcmail extends rcube */ public function get_address_sources($writeable = false, $skip_hidden = false) { - $abook_type = strtolower($this->config->get('address_book_type')); - $ldap_config = $this->config->get('ldap_public'); + $abook_type = (string) $this->config->get('address_book_type'); + $ldap_config = (array) $this->config->get('ldap_public'); $autocomplete = (array) $this->config->get('autocomplete_addressbooks'); - $list = array(); + $list = array(); // We are using the DB address book or a plugin address book - if ($abook_type != 'ldap' && $abook_type != '') { + if (!empty($abook_type) && strtolower($abook_type) != 'ldap') { if (!isset($this->address_books['0'])) $this->address_books['0'] = new rcube_contacts($this->db, $this->get_user_id()); $list['0'] = array( @@ -277,8 +285,7 @@ class rcmail extends rcube ); } - if ($ldap_config) { - $ldap_config = (array) $ldap_config; + if (!empty($ldap_config)) { foreach ($ldap_config as $id => $prop) { // handle misconfiguration if (empty($prop) || !is_array($prop)) { @@ -594,7 +601,7 @@ class rcmail extends rcube $post_host = rcube_utils::get_input_value('_host', rcube_utils::INPUT_POST); $post_user = rcube_utils::get_input_value('_user', rcube_utils::INPUT_POST); - list($user, $domain) = explode('@', $post_user); + list(, $domain) = explode('@', $post_user); // direct match in default_host array if ($default_host[$post_host] || in_array($post_host, array_values($default_host))) { @@ -698,28 +705,6 @@ class rcmail extends rcube /** - * Create unique authorization hash - * - * @param string Session ID - * @param int Timestamp - * @return string The generated auth hash - */ - private function get_auth_hash($sess_id, $ts) - { - $auth_string = sprintf('rcmail*sess%sR%s*Chk:%s;%s', - $sess_id, - $ts, - $this->config->get('ip_check') ? $_SERVER['REMOTE_ADDR'] : '***.***.***.***', - $_SERVER['HTTP_USER_AGENT']); - - if (function_exists('sha1')) - return sha1($auth_string); - else - return md5($auth_string); - } - - - /** * Build a valid URL to this instance of Roundcube * * @param mixed Either a string with the action or url parameters as key-value pairs @@ -764,11 +749,6 @@ class rcmail extends rcube $book->close(); } - // before closing the database connection, write session data - if ($_SERVER['REMOTE_ADDR'] && is_object($this->session)) { - session_write_close(); - } - // write performance stats to logs/console if ($this->config->get('devel_mode')) { if (function_exists('memory_get_usage')) @@ -929,189 +909,6 @@ class rcmail extends rcube /** - * Send the given message using the configured method. - * - * @param object $message Reference to Mail_MIME object - * @param string $from Sender address string - * @param array $mailto Array of recipient address strings - * @param array $error SMTP error array (reference) - * @param string $body_file Location of file with saved message body (reference), - * used when delay_file_io is enabled - * @param array $options SMTP options (e.g. DSN request) - * - * @return boolean Send status. - */ - public function deliver_message(&$message, $from, $mailto, &$error, &$body_file = null, $options = null) - { - $plugin = $this->plugins->exec_hook('message_before_send', array( - 'message' => $message, - 'from' => $from, - 'mailto' => $mailto, - 'options' => $options, - )); - - $from = $plugin['from']; - $mailto = $plugin['mailto']; - $options = $plugin['options']; - $message = $plugin['message']; - $headers = $message->headers(); - - // send thru SMTP server using custom SMTP library - if ($this->config->get('smtp_server')) { - // generate list of recipients - $a_recipients = array($mailto); - - if (strlen($headers['Cc'])) - $a_recipients[] = $headers['Cc']; - if (strlen($headers['Bcc'])) - $a_recipients[] = $headers['Bcc']; - - // clean Bcc from header for recipients - $send_headers = $headers; - unset($send_headers['Bcc']); - // here too, it because txtHeaders() below use $message->_headers not only $send_headers - unset($message->_headers['Bcc']); - - $smtp_headers = $message->txtHeaders($send_headers, true); - - if ($message->getParam('delay_file_io')) { - // use common temp dir - $temp_dir = $this->config->get('temp_dir'); - $body_file = tempnam($temp_dir, 'rcmMsg'); - if (PEAR::isError($mime_result = $message->saveMessageBody($body_file))) { - self::raise_error(array('code' => 650, 'type' => 'php', - 'file' => __FILE__, 'line' => __LINE__, - 'message' => "Could not create message: ".$mime_result->getMessage()), - TRUE, FALSE); - return false; - } - $msg_body = fopen($body_file, 'r'); - } - else { - $msg_body = $message->get(); - } - - // send message - if (!is_object($this->smtp)) { - $this->smtp_init(true); - } - - $sent = $this->smtp->send_mail($from, $a_recipients, $smtp_headers, $msg_body, $options); - $response = $this->smtp->get_response(); - $error = $this->smtp->get_error(); - - // log error - if (!$sent) { - self::raise_error(array('code' => 800, 'type' => 'smtp', - 'line' => __LINE__, 'file' => __FILE__, - 'message' => "SMTP error: ".join("\n", $response)), TRUE, FALSE); - } - } - // send mail using PHP's mail() function - else { - // unset some headers because they will be added by the mail() function - $headers_enc = $message->headers($headers); - $headers_php = $message->_headers; - unset($headers_php['To'], $headers_php['Subject']); - - // reset stored headers and overwrite - $message->_headers = array(); - $header_str = $message->txtHeaders($headers_php); - - // #1485779 - if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') { - if (preg_match_all('/<([^@]+@[^>]+)>/', $headers_enc['To'], $m)) { - $headers_enc['To'] = implode(', ', $m[1]); - } - } - - $msg_body = $message->get(); - - if (PEAR::isError($msg_body)) { - self::raise_error(array('code' => 650, 'type' => 'php', - 'file' => __FILE__, 'line' => __LINE__, - 'message' => "Could not create message: ".$msg_body->getMessage()), - TRUE, FALSE); - } - else { - $delim = $this->config->header_delimiter(); - $to = $headers_enc['To']; - $subject = $headers_enc['Subject']; - $header_str = rtrim($header_str); - - if ($delim != "\r\n") { - $header_str = str_replace("\r\n", $delim, $header_str); - $msg_body = str_replace("\r\n", $delim, $msg_body); - $to = str_replace("\r\n", $delim, $to); - $subject = str_replace("\r\n", $delim, $subject); - } - - if (ini_get('safe_mode')) - $sent = mail($to, $subject, $msg_body, $header_str); - else - $sent = mail($to, $subject, $msg_body, $header_str, "-f$from"); - } - } - - if ($sent) { - $this->plugins->exec_hook('message_sent', array('headers' => $headers, 'body' => $msg_body)); - - // remove MDN headers after sending - unset($headers['Return-Receipt-To'], $headers['Disposition-Notification-To']); - - // get all recipients - if ($headers['Cc']) - $mailto .= $headers['Cc']; - if ($headers['Bcc']) - $mailto .= $headers['Bcc']; - if (preg_match_all('/<([^@]+@[^>]+)>/', $mailto, $m)) - $mailto = implode(', ', array_unique($m[1])); - - if ($this->config->get('smtp_log')) { - self::write_log('sendmail', sprintf("User %s [%s]; Message for %s; %s", - $this->user->get_username(), - $_SERVER['REMOTE_ADDR'], - $mailto, - !empty($response) ? join('; ', $response) : '')); - } - } - - if (is_resource($msg_body)) { - fclose($msg_body); - } - - $message->_headers = array(); - $message->headers($headers); - - return $sent; - } - - - /** - * Unique Message-ID generator. - * - * @return string Message-ID - */ - public function gen_message_id() - { - $local_part = md5(uniqid('rcmail'.mt_rand(),true)); - $domain_part = $this->user->get_username('domain'); - - // Try to find FQDN, some spamfilters doesn't like 'localhost' (#1486924) - if (!preg_match('/\.[a-z]+$/i', $domain_part)) { - foreach (array($_SERVER['HTTP_HOST'], $_SERVER['SERVER_NAME']) as $host) { - $host = preg_replace('/:[0-9]+$/', '', $host); - if ($host && preg_match('/\.[a-z]+$/i', $host)) { - $domain_part = $host; - } - } - } - - return sprintf('<%s@%s>', $local_part, $domain_part); - } - - - /** * Returns RFC2822 formatted current date in user's timezone * * @return string Date @@ -1165,7 +962,7 @@ class rcmail extends rcube */ public function table_output($attrib, $table_data, $a_show_cols, $id_col) { - $table = new html_table(/*array('cols' => count($a_show_cols))*/); + $table = new html_table($attrib); // add table header if (!$attrib['noheader']) { @@ -1528,9 +1325,10 @@ class rcmail extends rcube $realnames = (bool)$attrib['realnames']; $msgcounts = $this->storage->get_cache('messagecount'); $collapsed = $this->config->get('collapsed_folders'); + $realnames = $this->config->get('show_real_foldernames'); $out = ''; - foreach ($arrFolders as $key => $folder) { + foreach ($arrFolders as $folder) { $title = null; $folder_class = $this->folder_classname($folder['id']); $is_collapsed = strpos($collapsed, '&'.rawurlencode($folder['id']).'&') !== false; @@ -1616,7 +1414,7 @@ class rcmail extends rcube { $out = ''; - foreach ($arrFolders as $key => $folder) { + foreach ($arrFolders as $folder) { // skip exceptions (and its subfolders) if (!empty($opts['exceptions']) && in_array($folder['id'], $opts['exceptions'])) { continue; @@ -1684,8 +1482,10 @@ class rcmail extends rcube */ public function localize_foldername($name, $with_path = true) { + $realnames = $this->config->get('show_real_foldernames'); + // try to localize path of the folder - if ($with_path) { + if ($with_path && !$realnames) { $storage = $this->get_storage(); $delimiter = $storage->get_hierarchy_delimiter(); $path = explode($delimiter, $name); @@ -1702,12 +1502,11 @@ class rcmail extends rcube } } - if ($folder_class = $this->folder_classname($name)) { + if (!$realnames && ($folder_class = $this->folder_classname($name))) { return $this->gettext($folder_class); } - else { - return rcube_charset::convert($name, 'UTF7-IMAP'); - } + + return rcube_charset::convert($name, 'UTF7-IMAP'); } @@ -1762,11 +1561,7 @@ class rcmail extends rcube $quota_result = (array) $quota; $quota_result['type'] = isset($_SESSION['quota_display']) ? $_SESSION['quota_display'] : ''; - if (!$quota['total'] && $this->config->get('quota_zero_as_unlimited')) { - $quota_result['title'] = $this->gettext('unlimited'); - $quota_result['percent'] = 0; - } - else if ($quota['total']) { + if ($quota['total'] > 0) { if (!isset($quota['percent'])) { $quota_result['percent'] = min(100, round(($quota['used']/max(1,$quota['total']))*100)); } @@ -1785,7 +1580,8 @@ class rcmail extends rcube } } else { - $quota_result['title'] = $this->gettext('unknown'); + $unlimited = $this->config->get('quota_zero_as_unlimited'); + $quota_result['title'] = $this->gettext($unlimited ? 'unlimited' : 'unknown'); $quota_result['percent'] = 0; } @@ -1798,32 +1594,51 @@ class rcmail extends rcube * * @param string $fallback Fallback message label * @param array $fallback_args Fallback message label arguments + * @param string $suffix Message label suffix */ - public function display_server_error($fallback = null, $fallback_args = null) + public function display_server_error($fallback = null, $fallback_args = null, $suffix = '') { $err_code = $this->storage->get_error_code(); $res_code = $this->storage->get_response_code(); + $args = array(); if ($res_code == rcube_storage::NOPERM) { - $this->output->show_message('errornoperm', 'error'); + $error = 'errornoperm'; } else if ($res_code == rcube_storage::READONLY) { - $this->output->show_message('errorreadonly', 'error'); + $error = 'errorreadonly'; + } + else if ($res_code == rcube_storage::OVERQUOTA) { + $error = 'errorroverquota'; } else if ($err_code && ($err_str = $this->storage->get_error_str())) { // try to detect access rights problem and display appropriate message if (stripos($err_str, 'Permission denied') !== false) { - $this->output->show_message('errornoperm', 'error'); + $error = 'errornoperm'; + } + // try to detect full mailbox problem and display appropriate message + // there can be e.g. "Quota exceeded" or "quotum would exceed" + else if (stripos($err_str, 'quot') !== false && stripos($err_str, 'exceed') !== false) { + $error = 'erroroverquota'; } else { - $this->output->show_message('servererrormsg', 'error', array('msg' => $err_str)); + $error = 'servererrormsg'; + $args = array('msg' => $err_str); } } else if ($err_code < 0) { - $this->output->show_message('storageerror', 'error'); + $error = 'storageerror'; } else if ($fallback) { - $this->output->show_message($fallback, 'error', $fallback_args); + $error = $fallback; + $args = $fallback_args; + } + + if ($error) { + if ($suffix && $this->text_exists($error . $suffix)) { + $error .= $suffix; + } + $this->output->show_message($error, 'error', $args); } } diff --git a/program/include/rcmail_html_page.php b/program/include/rcmail_html_page.php index 1d8391580..5d07b8d04 100644 --- a/program/include/rcmail_html_page.php +++ b/program/include/rcmail_html_page.php @@ -30,7 +30,7 @@ class rcmail_html_page extends rcmail_output_html { public function write($contents = '') { - self::reset(); + self::reset(true); // load embed.css from skin folder (if exists) if ($embed_css = $this->get_skin_file('/embed.css')) { diff --git a/program/include/rcmail_output_html.php b/program/include/rcmail_output_html.php index 88af550ed..29a86b9f7 100644 --- a/program/include/rcmail_output_html.php +++ b/program/include/rcmail_output_html.php @@ -67,6 +67,7 @@ class rcmail_output_html extends rcmail_output //$this->framed = $framed; $this->set_env('task', $task); $this->set_env('x_frame_options', $this->config->get('x_frame_options', 'sameorigin')); + $this->set_env('standard_windows', (bool) $this->config->get('standard_windows')); // add cookie info $this->set_env('cookie_domain', ini_get('session.cookie_domain')); @@ -80,6 +81,8 @@ class rcmail_output_html extends rcmail_output if (!empty($_REQUEST['_extwin'])) $this->set_env('extwin', 1); + if ($this->framed || !empty($_REQUEST['_framed'])) + $this->set_env('framed', 1); // add common javascripts $this->add_script('var '.self::JS_OBJECT_NAME.' = new rcube_webmail();', 'head_top'); @@ -305,13 +308,19 @@ class rcmail_output_html extends rcmail_output /** * Delete all stored env variables and commands + * + * @param bool $all Reset all env variables (including internal) */ - public function reset() + public function reset($all = false) { + $env = $all ? null : array_intersect_key($this->env, array('extwin'=>1, 'framed'=>1)); + parent::reset(); - $this->js_env = array(); - $this->js_labels = array(); - $this->js_commands = array(); + + // let some env variables survive + $this->env = $this->js_env = $env; + $this->js_labels = array(); + $this->js_commands = array(); $this->script_files = array(); $this->scripts = array(); $this->header = ''; @@ -356,7 +365,7 @@ class rcmail_output_html extends rcmail_output $this->parse($templ, false); } else { - $this->framed = $templ == 'iframe' ? true : $this->framed; + $this->framed = true; $this->write(); } @@ -390,9 +399,11 @@ class rcmail_output_html extends rcmail_output $this->set_env('request_token', $this->app->get_request_token()); // write all env variables to client - $js = $this->framed ? "if(window.parent) {\n" : ''; - $js .= $this->get_js_commands() . ($this->framed ? ' }' : ''); - $this->add_script($js, 'head_top'); + if ($commands = $this->get_js_commands()) { + $js = $this->framed ? "if (window.parent) {\n" : ''; + $js .= $commands . ($this->framed ? ' }' : ''); + $this->add_script($js, 'head_top'); + } // send clickjacking protection headers $iframe = $this->framed || !empty($_REQUEST['_framed']); @@ -645,7 +656,7 @@ class rcmail_output_html extends rcmail_output protected function file_callback($matches) { $file = $matches[3]; - $file[0] = preg_replace('!^/this/!', '/', $file[0]); + $file = preg_replace('!^/this/!', '/', $file); // correct absolute paths if ($file[0] == '/') { @@ -668,7 +679,7 @@ class rcmail_output_html extends rcmail_output * * @param string $input * @return string - * @uses rcube_output_html::parse_xml() + * @uses rcmail_output_html::parse_xml() * @since 0.1-rc1 */ public function just_parse($input) @@ -721,14 +732,13 @@ class rcmail_output_html extends rcmail_output /** * Determines if a given condition is met * - * @todo Get rid off eval() once I understand what this does. * @todo Extend this to allow real conditions, not just "set" * @param string Condition statement * @return boolean True if condition is met, False if not */ protected function check_condition($condition) { - return eval("return (".$this->parse_expression($condition).");"); + return $this->eval_expression($condition); } @@ -750,14 +760,15 @@ class rcmail_output_html extends rcmail_output /** - * Parses expression and replaces variables + * Parse & evaluate a given expression and return its result. * - * @param string Expression statement - * @return string Expression value + * @param string Expression statement + * + * @return mixed Expression result */ - protected function parse_expression($expression) + protected function eval_expression ($expression) { - return preg_replace( + $expression = preg_replace( array( '/session:([a-z0-9_]+)/i', '/config:([a-z0-9_]+)(:([a-z0-9_]+))?/i', @@ -769,14 +780,29 @@ class rcmail_output_html extends rcmail_output ), array( "\$_SESSION['\\1']", - "\$this->app->config->get('\\1',rcube_utils::get_boolean('\\3'))", - "\$this->env['\\1']", + "\$app->config->get('\\1',rcube_utils::get_boolean('\\3'))", + "\$env['\\1']", "rcube_utils::get_input_value('\\1', rcube_utils::INPUT_GPC)", "\$_COOKIE['\\1']", - "\$this->browser->{'\\1'}", + "\$browser->{'\\1'}", $this->template_name, ), - $expression); + $expression + ); + + $fn = create_function('$app,$browser,$env', "return ($expression);"); + if (!$fn) { + rcube::raise_error(array( + 'code' => 505, + 'type' => 'php', + 'file' => __FILE__, + 'line' => __LINE__, + 'message' => "Expression parse error on: ($expression)"), true, false); + + return null; + } + + return $fn($this->app, $this->browser, $this->env); } @@ -829,7 +855,7 @@ class rcmail_output_html extends rcmail_output // show a label case 'label': if ($attrib['expression']) - $attrib['name'] = eval("return " . $this->parse_expression($attrib['expression']) .";"); + $attrib['name'] = $this->eval_expression($attrib['expression']); if ($attrib['name'] || $attrib['command']) { // @FIXME: 'noshow' is useless, remove? @@ -863,6 +889,7 @@ class rcmail_output_html extends rcmail_output // include a file case 'include': $old_base_path = $this->base_path; + if (!empty($attrib['skin_path'])) $attrib['skinpath'] = $attrib['skin_path']; if ($path = $this->get_skin_file($attrib['file'], $skin_path, $attrib['skinpath'])) { $this->base_path = preg_replace('!plugins/\w+/!', '', $skin_path); // set base_path to core skin directory (not plugin's skin) $path = realpath($path); @@ -960,8 +987,7 @@ class rcmail_output_html extends rcmail_output // return code for a specified eval expression case 'exp': - $value = $this->parse_expression($attrib['expression']); - return eval("return html::quote($value);"); + return html::quote($this->eval_expression($attrib['expression'])); // return variable case 'var': @@ -1169,6 +1195,10 @@ class rcmail_output_html extends rcmail_output $out = sprintf('<a%s>%s</a>', $attrib_str, $btn_content); } + if ($attrib['wrapper']) { + $out = html::tag($attrib['wrapper'], null, $out); + } + return $out; } |