From 6ab9369eb194e4dde0cc830a84466dd240e95b23 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Wed, 15 Aug 2012 16:21:34 +0200 Subject: Fix lower-casing email address on replies (#1488598) --- CHANGELOG | 1 + program/include/rcube_shared.inc | 23 +++++++++++++++++++++++ program/steps/mail/compose.inc | 9 +++++---- 3 files changed, 29 insertions(+), 4 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 4cbaa6ece..192ecce91 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,7 @@ CHANGELOG Roundcube Webmail =========================== +- Fix lower-casing email address on replies (#1488598) - Fix line separator in exported messages (#1488603) - Fix XSS issue where plain signatures wasn't secured in HTML mode (#1488613) - Fix XSS issue where href="javascript:" wasn't secured (#1488613) diff --git a/program/include/rcube_shared.inc b/program/include/rcube_shared.inc index 85f278432..5b839d8d2 100644 --- a/program/include/rcube_shared.inc +++ b/program/include/rcube_shared.inc @@ -305,6 +305,29 @@ function format_email_recipient($email, $name = '') } +/** + * Format e-mail address + * + * @param string $email E-mail address + * + * @return string Formatted e-mail address + */ +function format_email($email) +{ + $email = trim($email); + $parts = explode('@', $email); + $count = count($parts); + + if ($count > 1) { + $parts[$count-1] = mb_strtolower($parts[$count-1]); + + $email = implode('@', $parts); + } + + return $email; +} + + /** * mbstring replacement functions */ diff --git a/program/steps/mail/compose.inc b/program/steps/mail/compose.inc index 1a1d244e1..56f4a052b 100644 --- a/program/steps/mail/compose.inc +++ b/program/steps/mail/compose.inc @@ -252,7 +252,8 @@ $MESSAGE->identities = $RCMAIL->user->list_identities(); if (count($MESSAGE->identities)) { foreach ($MESSAGE->identities as $idx => $ident) { - $email = mb_strtolower(rcube_idn_to_utf8($ident['email'])); + $ident['email'] = format_email($ident['email']); + $email = format_email(rcube_idn_to_utf8($ident['email'])); $MESSAGE->identities[$idx]['email_ascii'] = $ident['email']; $MESSAGE->identities[$idx]['ident'] = format_email_recipient($ident['email'], $ident['name']); @@ -277,7 +278,7 @@ else if (count($MESSAGE->identities)) { $a_to = rcube_mime::decode_address_list($MESSAGE->headers->to, null, true, $MESSAGE->headers->charset); foreach ($a_to as $addr) { if (!empty($addr['mailto'])) { - $a_recipients[] = strtolower($addr['mailto']); + $a_recipients[] = format_email($addr['mailto']); $a_names[] = $addr['name']; } } @@ -286,7 +287,7 @@ else if (count($MESSAGE->identities)) { $a_cc = rcube_mime::decode_address_list($MESSAGE->headers->cc, null, true, $MESSAGE->headers->charset); foreach ($a_cc as $addr) { if (!empty($addr['mailto'])) { - $a_recipients[] = strtolower($addr['mailto']); + $a_recipients[] = format_email($addr['mailto']); $a_names[] = $addr['name']; } } @@ -433,7 +434,7 @@ foreach ($parts as $header) { if (empty($addr_part['mailto'])) continue; - $mailto = mb_strtolower(rcube_idn_to_utf8($addr_part['mailto'])); + $mailto = format_email(rcube_idn_to_utf8($addr_part['mailto'])); if (!in_array($mailto, $a_recipients) && ($header == 'to' || empty($MESSAGE->compose['from_email']) || $mailto != $MESSAGE->compose['from_email']) -- cgit v1.2.3 From 287eff030a7c6437495dc15badb125640cc4c3d3 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Thu, 16 Aug 2012 09:36:49 +0200 Subject: Make $inline_parts property publicly available --- program/include/rcube_message.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/program/include/rcube_message.php b/program/include/rcube_message.php index 9d36acf38..f550b574e 100644 --- a/program/include/rcube_message.php +++ b/program/include/rcube_message.php @@ -50,13 +50,13 @@ class rcube_message */ private $mime; private $opt = array(); - private $inline_parts = array(); private $parse_alternative = false; public $uid = null; public $headers; public $parts = array(); public $mime_parts = array(); + public $inline_parts = array(); public $attachments = array(); public $subject = ''; public $sender = null; -- cgit v1.2.3 From fb001f851f60e99b4ba9d2f837a76a46dfd3fd5f Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Thu, 16 Aug 2012 12:00:35 +0200 Subject: Force at least one subtype of address to be specified. Fixes issue where contact address wasn't displayed at all. --- program/include/rcube_ldap.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/program/include/rcube_ldap.php b/program/include/rcube_ldap.php index dbab0fd06..ad2ccddeb 100644 --- a/program/include/rcube_ldap.php +++ b/program/include/rcube_ldap.php @@ -139,6 +139,11 @@ class rcube_ldap extends rcube_addressbook unset($this->coltypes[$childcol]); // remove address child col from global coltypes list } } + + // at least one address type must be specified + if (empty($this->coltypes['address']['subtypes'])) { + $this->coltypes['address']['subtypes'] = array('home'); + } } else if ($this->coltypes['address']) { $this->coltypes['address'] += array('type' => 'textarea', 'childs' => null, 'size' => 40); -- cgit v1.2.3 From e824925290a0fdf3852f4562dc459a4cbd4e5768 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Thu, 16 Aug 2012 19:44:28 +0200 Subject: Rewritten test scripts for PHPUnit --- CHANGELOG | 1 + tests/HtmlToText.php | 59 +++++++++++++++++ tests/MailDecode.php | 123 +++++++++++++++++++++++++++++++++++ tests/MailFunc.php | 172 ++++++++++++++++++++++++++++++++++++++++++++++++ tests/ModCss.php | 39 +++++++++++ tests/VCards.php | 59 +++++++++++++++++ tests/bootstrap.php | 33 ++++++++++ tests/html_to_text.php | 61 ----------------- tests/maildecode.php | 130 ------------------------------------- tests/mailfunc.php | 173 ------------------------------------------------- tests/modcss.php | 45 ------------- tests/phpunit.xml | 13 ++++ tests/runtests.sh | 54 --------------- tests/vcards.php | 65 ------------------- 14 files changed, 499 insertions(+), 528 deletions(-) create mode 100644 tests/HtmlToText.php create mode 100644 tests/MailDecode.php create mode 100644 tests/MailFunc.php create mode 100644 tests/ModCss.php create mode 100644 tests/VCards.php create mode 100644 tests/bootstrap.php delete mode 100644 tests/html_to_text.php delete mode 100644 tests/maildecode.php delete mode 100644 tests/mailfunc.php delete mode 100644 tests/modcss.php create mode 100644 tests/phpunit.xml delete mode 100755 tests/runtests.sh delete mode 100644 tests/vcards.php diff --git a/CHANGELOG b/CHANGELOG index 192ecce91..3edbdd494 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,7 @@ CHANGELOG Roundcube Webmail =========================== +- Rewritten test scripts for PHPUnit - Fix lower-casing email address on replies (#1488598) - Fix line separator in exported messages (#1488603) - Fix XSS issue where plain signatures wasn't secured in HTML mode (#1488613) diff --git a/tests/HtmlToText.php b/tests/HtmlToText.php new file mode 100644 index 000000000..34e2d1a63 --- /dev/null +++ b/tests/HtmlToText.php @@ -0,0 +1,59 @@ + array( + 'title' => 'Test entry', + 'in' => '', + 'out' => '', + ), + 1 => array( + 'title' => 'Basic HTML entities', + 'in' => '"&', + 'out' => '"&', + ), + 2 => array( + 'title' => 'HTML entity string', + 'in' => '&quot;', + 'out' => '"', + ), + 3 => array( + 'title' => 'HTML entity in STRONG tag', + 'in' => 'ś', // ś + 'out' => 'Ś', // upper ś + ), + 4 => array( + 'title' => 'STRONG tag to upper-case conversion', + 'in' => 'ś', + 'out' => 'Ś', + ), + 5 => array( + 'title' => 'STRONG inside B tag', + 'in' => 'ś', + 'out' => 'Ś', + ), + ); + } + + /** + * @dataProvider data + */ + function test_html2text($title, $in, $out) + { + $ht = new html2text(null, false, false); + + $ht->set_html($in); + $res = $ht->get_text(); + + $this->assertEquals($out, $res, $title); + } +} diff --git a/tests/MailDecode.php b/tests/MailDecode.php new file mode 100644 index 000000000..7969603dd --- /dev/null +++ b/tests/MailDecode.php @@ -0,0 +1,123 @@ + 'test@domain.tld', + 1 => '', + 2 => 'Test ', + 3 => 'Test Test ', + 4 => 'Test Test', + 5 => '"Test Test" ', + 6 => '"Test Test"', + 7 => '"Test \\" Test" ', + 8 => '"Test', + 9 => '=?ISO-8859-1?B?VGVzdAo=?= ', + 10 => '=?ISO-8859-1?B?VGVzdAo=?=', // #1487068 + // comments in address (#1487673) + 11 => 'Test (comment) ', + 12 => '"Test" (comment) ', + 13 => '"Test (comment)" (comment) ', + 14 => '(comment) ', + 15 => 'Test ', + 16 => 'Test Test ((comment)) ', + 17 => 'test@domain.tld (comment)', + 18 => '"Test,Test" ', + // 1487939 + 19 => 'Test <"test test"@domain.tld>', + 20 => '<"test test"@domain.tld>', + 21 => '"test test"@domain.tld', + ); + + $results = array( + 0 => array(1, '', 'test@domain.tld'), + 1 => array(1, '', 'test@domain.tld'), + 2 => array(1, 'Test', 'test@domain.tld'), + 3 => array(1, 'Test Test', 'test@domain.tld'), + 4 => array(1, 'Test Test', 'test@domain.tld'), + 5 => array(1, 'Test Test', 'test@domain.tld'), + 6 => array(1, 'Test Test', 'test@domain.tld'), + 7 => array(1, 'Test " Test', 'test@domain.tld'), + 8 => array(1, 'Test array(1, 'Test', 'test@domain.tld'), + 10 => array(1, 'Test', 'test@domain.tld'), + 11 => array(1, 'Test', 'test@domain.tld'), + 12 => array(1, 'Test', 'test@domain.tld'), + 13 => array(1, 'Test (comment)', 'test@domain.tld'), + 14 => array(1, '', 'test@domain.tld'), + 15 => array(1, 'Test', 'test@domain.tld'), + 16 => array(1, 'Test Test', 'test@domain.tld'), + 17 => array(1, '', 'test@domain.tld'), + 18 => array(1, 'Test,Test', 'test@domain.tld'), + 19 => array(1, 'Test', '"test test"@domain.tld'), + 20 => array(1, '', '"test test"@domain.tld'), + 21 => array(1, '', '"test test"@domain.tld'), + ); + + foreach ($headers as $idx => $header) { + $res = rcube_mime::decode_address_list($header); + + $this->assertEquals($results[$idx][0], count($res), "Rows number in result for header: " . $header); + $this->assertEquals($results[$idx][1], $res[1]['name'], "Name part decoding for header: " . $header); + $this->assertEquals($results[$idx][2], $res[1]['mailto'], "Email part decoding for header: " . $header); + } + } + + /** + * Test decoding of header values + * Uses rcube_mime::decode_mime_string() + */ + function test_header_decode_qp() + { + $test = array( + // #1488232: invalid character "?" + 'quoted-printable (1)' => array( + 'in' => '=?utf-8?Q?Certifica=C3=A7=C3=A3??=', + 'out' => 'Certifica=C3=A7=C3=A3?', + ), + 'quoted-printable (2)' => array( + 'in' => '=?utf-8?Q?Certifica=?= =?utf-8?Q?C3=A7=C3=A3?=', + 'out' => 'Certifica=C3=A7=C3=A3', + ), + 'quoted-printable (3)' => array( + 'in' => '=?utf-8?Q??= =?utf-8?Q??=', + 'out' => '', + ), + 'quoted-printable (4)' => array( + 'in' => '=?utf-8?Q??= a =?utf-8?Q??=', + 'out' => ' a ', + ), + 'quoted-printable (5)' => array( + 'in' => '=?utf-8?Q?a?= =?utf-8?Q?b?=', + 'out' => 'ab', + ), + 'quoted-printable (6)' => array( + 'in' => '=?utf-8?Q? ?= =?utf-8?Q?a?=', + 'out' => ' a', + ), + 'quoted-printable (7)' => array( + 'in' => '=?utf-8?Q?___?= =?utf-8?Q?a?=', + 'out' => ' a', + ), + ); + + foreach ($test as $idx => $item) { + $res = rcube_mime::decode_mime_string($item['in'], 'UTF-8'); + $res = quoted_printable_encode($res); + + $this->assertEquals($item['out'], $res, "Header decoding for: " . $idx); + } + } +} diff --git a/tests/MailFunc.php b/tests/MailFunc.php new file mode 100644 index 000000000..57a6b9d10 --- /dev/null +++ b/tests/MailFunc.php @@ -0,0 +1,172 @@ +load_gui(); + $RCMAIL->action = 'autocomplete'; + $RCMAIL->storage_init(false); + + require_once INSTALL_PATH . 'program/steps/mail/func.inc'; + + $GLOBALS['EMAIL_ADDRESS_PATTERN'] = $EMAIL_ADDRESS_PATTERN; + } + + /** + * Helper method to create a HTML message part object + */ + function get_html_part($body) + { + $part = new rcube_message_part; + $part->ctype_primary = 'text'; + $part->ctype_secondary = 'html'; + $part->body = file_get_contents(TESTS_DIR . $body); + $part->replaces = array(); + return $part; + } + + + /** + * Test sanitization of a "normal" html message + */ + function test_html() + { + $part = $this->get_html_part('src/htmlbody.txt'); + $part->replaces = array('ex1.jpg' => 'part_1.2.jpg', 'ex2.jpg' => 'part_1.2.jpg'); + + // render HTML in normal mode + $html = rcmail_html4inline(rcmail_print_body($part, array('safe' => false)), 'foo'); + + $this->assertRegExp('/src="'.$part->replaces['ex1.jpg'].'"/', $html, "Replace reference to inline image"); + $this->assertRegExp('#background="./program/resources/blocked.gif"#', $html, "Replace external background image"); + $this->assertNotRegExp('/ex3.jpg/', $html, "No references to external images"); + $this->assertNotRegExp('/]+>/', $html, "No meta tags allowed"); + //$this->assertNoPattern('/