Don't show fake address - phishing prevention (#1488981)

Aleksander Machniak

2013-03-12 ff7542bfb9648a8970bd6ff767bb62a647f705ad

 program/steps/mail/func.inc

@@ -89,11 +89,12 @@
  }

  $threading = (bool) $RCMAIL->storage->get_threading();
  $delimiter = $RCMAIL->storage->get_hierarchy_delimiter();

  // set current mailbox and some other vars in client environment
  $OUTPUT->set_env('mailbox', $mbox_name);
  $OUTPUT->set_env('pagesize', $RCMAIL->storage->get_pagesize());
  $OUTPUT->set_env('delimiter', $RCMAIL->storage->get_hierarchy_delimiter());
  $OUTPUT->set_env('delimiter', $delimiter);
  $OUTPUT->set_env('threading', $threading);
  $OUTPUT->set_env('threads', $threading || $RCMAIL->storage->get_capability('THREAD'));
  $OUTPUT->set_env('preview_pane_mark_read', $RCMAIL->config->get('preview_pane_mark_read', 0));
@@ -121,7 +122,10 @@
      'movingmessage', 'copyingmessage', 'deletingmessage', 'markingmessage',
      'copy', 'move', 'quota');

  $OUTPUT->set_pagetitle(rcmail_localize_foldername($RCMAIL->storage->mod_folder($mbox_name)));
  $pagetitle = $RCMAIL->localize_foldername($RCMAIL->storage->mod_folder($mbox_name), true);
  $pagetitle = str_replace($delimiter, " \xC2\xBB ", $pagetitle);

  $OUTPUT->set_pagetitle($pagetitle);
}

/**
@@ -1079,9 +1083,9 @@
        $out .= html::div('message-partheaders', rcmail_message_headers(sizeof($header_attrib) ? $header_attrib : null, $part->headers));
      }
      else if ($part->type == 'content') {
        // unsapported
        // unsupported (e.g. encrypted)
        if ($part->realtype) {
          if ($part->realtype == 'multipart/encrypted') {
          if ($part->realtype == 'multipart/encrypted' || $part->realtype == 'application/pkcs7-mime') {
            $out .= html::span('part-notice', rcube_label('encryptedmessage'));
          }
          continue;
@@ -1439,6 +1443,11 @@
    $name   = $part['name'];
    $mailto = $part['mailto'];
    $string = $part['string'];

    // phishing email prevention (#1488981), e.g. "valid@email.addr <phishing@email.addr>"
    if ($name && $name != $mailto && strpos($name, '@')) {
      $name = '';
    }

    // IDNA ASCII to Unicode
    if ($name == $mailto)
@@ -1850,7 +1859,7 @@
            $filename = rcube_label('htmlmessage');
        }
        else {
            $ext      = rcube_mime::get_mime_extensions($attachment->mimetype);
            $ext      = (array) rcube_mime::get_mime_extensions($attachment->mimetype);
            $ext      = array_shift($ext);
            $filename = rcube_label('messagepart') . ' ' . $attachment->mime_id;
            if ($ext) {