Improve system security by using optional special URL with security token A...

Aleksander Machniak

2014-12-16 681ba6fc3c296cd6cd11050531b8f4e785141786

 program/steps/mail/compose.inc

@@ -131,8 +131,10 @@
    $compose_mode = RCUBE_COMPOSE_EDIT;
}

$COMPOSE['mode'] = $compose_mode;
$OUTPUT->set_env('compose_mode', $compose_mode);
if ($compose_mode) {
    $COMPOSE['mode'] = $compose_mode;
    $OUTPUT->set_env('compose_mode', $compose_mode);
}

if ($compose_mode == RCUBE_COMPOSE_EDIT || $compose_mode == RCUBE_COMPOSE_DRAFT) {
    // don't add signature in draft/edit mode, we'll also not remove the old-one
@@ -949,7 +951,7 @@
            "googie.setCurrentLanguage('%s');\n".
            "googie.setDecoration(false);\n".
            "googie.decorateTextarea('%s');\n",
            $RCMAIL->output->get_skin_path(),
            $RCMAIL->output->asset_url($RCMAIL->output->get_skin_path()),
            $RCMAIL->url(array('_task' => 'utils', '_action' => 'spell', '_remote' => 1)),
                !empty($dictionary) ? 'true' : 'false',
            rcube::JQ(rcube::Q($RCMAIL->gettext('checkspelling'))),
@@ -1309,7 +1311,6 @@
        }
        else {
            $data = $storage->get_raw_body($message->uid);
            $curr_mem += $message->size;
        }

        $attachment = array(
@@ -1452,6 +1453,9 @@
    if (isset($_POST['_subject'])) {
        $subject = rcube_utils::get_input_value('_subject', rcube_utils::INPUT_POST, TRUE);
    }
    else if (!empty($COMPOSE['param']['subject'])) {
        $subject = $COMPOSE['param']['subject'];
    }
    // create a reply-subject
    else if ($compose_mode == RCUBE_COMPOSE_REPLY) {
        if (preg_match('/^re:/i', $MESSAGE->subject))
@@ -1472,9 +1476,6 @@
    // creeate a draft-subject
    else if ($compose_mode == RCUBE_COMPOSE_DRAFT || $compose_mode == RCUBE_COMPOSE_EDIT) {
        $subject = $MESSAGE->subject;
    }
    else if (!empty($COMPOSE['param']['subject'])) {
        $subject = $COMPOSE['param']['subject'];
    }

    $out = $form_start ? "$form_start\n" : '';