Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 197203727417a03d87053a47e5aa5175a76e3e0b

 program/steps/mail/compose.inc

@@ -5,7 +5,7 @@
 | program/steps/mail/compose.inc                                        |
 |                                                                       |
 | This file is part of the Roundcube Webmail client                     |
 | Copyright (C) 2005-2009, The Roundcube Dev Team                       |
 | Copyright (C) 2005-2011, The Roundcube Dev Team                       |
 | Licensed under the GNU GPL                                            |
 |                                                                       |
 | PURPOSE:                                                              |
@@ -25,47 +25,60 @@
define('RCUBE_COMPOSE_DRAFT', 0x0108);
define('RCUBE_COMPOSE_EDIT', 0x0109);

$MESSAGE_FORM = NULL;
$MESSAGE = NULL;
$MESSAGE_FORM = null;
$MESSAGE      = null;
$COMPOSE_ID   = get_input_value('_id', RCUBE_INPUT_GET);
$COMPOSE      = null;

$COMPOSE_ID = get_input_value('_id', RCUBE_INPUT_GET);
$_SESSION['compose'] = $_SESSION['compose_data'][$COMPOSE_ID];
if ($COMPOSE_ID && $_SESSION['compose_data_'.$COMPOSE_ID])
  $COMPOSE =& $_SESSION['compose_data_'.$COMPOSE_ID];

// give replicated session storage some time to synchronize
$retries = 0;
while ($COMPOSE_ID && !is_array($COMPOSE) && $RCMAIL->db->is_replicated() && $retries++ < 5) {
  usleep(500000);
  $RCMAIL->session->reload();
  if ($_SESSION['compose_data_'.$COMPOSE_ID])
    $COMPOSE =& $_SESSION['compose_data_'.$COMPOSE_ID];
}

// Nothing below is called during message composition, only at "new/forward/reply/draft" initialization or
// if a compose-ID is given (i.e. when the compose step is opened in a new window/tab).
if (!is_array($_SESSION['compose']))
if (!is_array($COMPOSE))
{
  // Infinite redirect prevention in case of broken session (#1487028)
  if ($COMPOSE_ID)
    raise_error(array('code' => 500, 'type' => 'php',
      'file' => __FILE__, 'line' => __LINE__,
      'message' => "Invalid session"), true, true);
      'message' => "Invalid compose ID"), true, true);

  $_SESSION['compose'] = array(
    'id' => uniqid(mt_rand()),
    'param' => request2param(RCUBE_INPUT_GET),
  $COMPOSE_ID = uniqid(mt_rand());
  $_SESSION['compose_data_'.$COMPOSE_ID] = array(
    'id'      => $COMPOSE_ID,
    'param'   => request2param(RCUBE_INPUT_GET),
    'mailbox' => $IMAP->get_mailbox_name(),
  );
  
  $COMPOSE =& $_SESSION['compose_data_'.$COMPOSE_ID];

  // process values like "mailto:foo@bar.com?subject=new+message&cc=another"
  if ($_SESSION['compose']['param']['to']) {
  if ($COMPOSE['param']['to']) {
    // #1486037: remove "mailto:" prefix
    $_SESSION['compose']['param']['to'] = preg_replace('/^mailto:/i', '', $_SESSION['compose']['param']['to']);
    $mailto = explode('?', $_SESSION['compose']['param']['to']);
    $COMPOSE['param']['to'] = preg_replace('/^mailto:/i', '', $COMPOSE['param']['to']);
    $mailto = explode('?', $COMPOSE['param']['to']);
    if (count($mailto) > 1) {
      $_SESSION['compose']['param']['to'] = $mailto[0];
      $COMPOSE['param']['to'] = $mailto[0];
      parse_str($mailto[1], $query);
      foreach ($query as $f => $val)
        $_SESSION['compose']['param'][$f] = $val;
        $COMPOSE['param'][$f] = $val;
    }
  }
  

  // select folder where to save the sent message
  $_SESSION['compose']['param']['sent_mbox'] = $RCMAIL->config->get('sent_mbox');
  
  $COMPOSE['param']['sent_mbox'] = $RCMAIL->config->get('sent_mbox');

  // pipe compose parameters thru plugins
  $plugin = $RCMAIL->plugins->exec_hook('message_compose', $_SESSION['compose']);
  $_SESSION['compose']['param'] = array_merge($_SESSION['compose']['param'], $plugin['param']);
  $plugin = $RCMAIL->plugins->exec_hook('message_compose', $COMPOSE);
  $COMPOSE['param'] = array_merge($COMPOSE['param'], $plugin['param']);

  // add attachments listed by message_compose hook
  if (is_array($plugin['attachments'])) {
@@ -84,26 +97,26 @@
          'path' => $attach,
        );
      }
      

      // save attachment if valid
      if (($attachment['data'] && $attachment['name']) || ($attachment['path'] && file_exists($attachment['path']))) {
        $attachment = rcmail::get_instance()->plugins->exec_hook('attachment_save', $attachment);
      }
      

      if ($attachment['status'] && !$attachment['abort']) {
        unset($attachment['data'], $attachment['status'], $attachment['abort']);
        $_SESSION['compose']['attachments'][$attachment['id']] = $attachment;
        $COMPOSE['attachments'][$attachment['id']] = $attachment;
      }
    }
  }

  // check if folder for saving sent messages exists and is subscribed (#1486802)
  if ($sent_folder = $_SESSION['compose']['param']['sent_mbox']) {
  if ($sent_folder = $COMPOSE['param']['sent_mbox']) {
    rcmail_check_sent_folder($sent_folder, true);
  }

  // redirect to a unique URL with all parameters stored in session
  $OUTPUT->redirect(array('_action' => 'compose', '_id' => $_SESSION['compose']['id']));
  $OUTPUT->redirect(array('_action' => 'compose', '_id' => $COMPOSE['id']));
}


@@ -111,9 +124,9 @@
$OUTPUT->add_label('nosubject', 'nosenderwarning', 'norecipientwarning', 'nosubjectwarning', 'cancel',
    'nobodywarning', 'notsentwarning', 'notuploadedwarning', 'savingmessage', 'sendingmessage', 
    'messagesaved', 'converting', 'editorwarning', 'searching', 'uploading', 'uploadingmany',
    'fileuploaderror');
    'fileuploaderror', 'sendmessage');

$OUTPUT->set_env('compose_id', $COMPOSE_ID);
$OUTPUT->set_env('compose_id', $COMPOSE['id']);

// add config parameters to client script
if (!empty($CONFIG['drafts_mbox'])) {
@@ -122,19 +135,23 @@
}
// set current mailbox in client environment
$OUTPUT->set_env('mailbox', $IMAP->get_mailbox_name());
$OUTPUT->set_env('sig_above', $CONFIG['sig_above']);
$OUTPUT->set_env('top_posting', $CONFIG['top_posting']);
$OUTPUT->set_env('sig_above', $RCMAIL->config->get('sig_above', false));
$OUTPUT->set_env('top_posting', $RCMAIL->config->get('top_posting', false));
$OUTPUT->set_env('recipients_separator', trim($RCMAIL->config->get('recipients_separator', ',')));

// use jquery UI for showing prompt() dialogs
$RCMAIL->plugins->load_plugin('jqueryui');

// get reference message and set compose mode
if ($msg_uid = $_SESSION['compose']['param']['draft_uid']) {
if ($msg_uid = $COMPOSE['param']['draft_uid']) {
  $RCMAIL->imap->set_mailbox($CONFIG['drafts_mbox']);
  $compose_mode = RCUBE_COMPOSE_DRAFT;
}
else if ($msg_uid = $_SESSION['compose']['param']['reply_uid'])
else if ($msg_uid = $COMPOSE['param']['reply_uid'])
  $compose_mode = RCUBE_COMPOSE_REPLY;
else if ($msg_uid = $_SESSION['compose']['param']['forward_uid'])
else if ($msg_uid = $COMPOSE['param']['forward_uid'])
  $compose_mode = RCUBE_COMPOSE_FORWARD;
else if ($msg_uid = $_SESSION['compose']['param']['uid'])
else if ($msg_uid = $COMPOSE['param']['uid'])
  $compose_mode = RCUBE_COMPOSE_EDIT;

$config_show_sig = $RCMAIL->config->get('show_sig', 1);
@@ -156,30 +173,30 @@
  // re-set 'prefer_html' to have possibility to use html part for compose
  $CONFIG['prefer_html'] = $CONFIG['prefer_html'] || $CONFIG['htmleditor'] || $compose_mode == RCUBE_COMPOSE_DRAFT || $compose_mode == RCUBE_COMPOSE_EDIT;
  $MESSAGE = new rcube_message($msg_uid);
  

  // make sure message is marked as read
  if ($MESSAGE && $MESSAGE->headers && !$MESSAGE->headers->seen)
  if ($MESSAGE && $MESSAGE->headers && empty($MESSAGE->headers->flags['SEEN']))
    $IMAP->set_flag($msg_uid, 'SEEN');

  if (!empty($MESSAGE->headers->charset))
    $IMAP->set_charset($MESSAGE->headers->charset);
    

  if ($compose_mode == RCUBE_COMPOSE_REPLY)
  {
    $_SESSION['compose']['reply_uid'] = $msg_uid;
    $_SESSION['compose']['reply_msgid'] = $MESSAGE->headers->messageID;
    $_SESSION['compose']['references']  = trim($MESSAGE->headers->references . " " . $MESSAGE->headers->messageID);
    $COMPOSE['reply_uid'] = $msg_uid;
    $COMPOSE['reply_msgid'] = $MESSAGE->headers->messageID;
    $COMPOSE['references']  = trim($MESSAGE->headers->references . " " . $MESSAGE->headers->messageID);

    if (!empty($_SESSION['compose']['param']['all']))
      $MESSAGE->reply_all = $_SESSION['compose']['param']['all'];
    if (!empty($COMPOSE['param']['all']))
      $MESSAGE->reply_all = $COMPOSE['param']['all'];

    $OUTPUT->set_env('compose_mode', 'reply');

    // Save the sent message in the same folder of the message being replied to
    if ($RCMAIL->config->get('reply_same_folder') && ($sent_folder = $_SESSION['compose']['mailbox'])
    if ($RCMAIL->config->get('reply_same_folder') && ($sent_folder = $COMPOSE['mailbox'])
      && rcmail_check_sent_folder($sent_folder, false)
    ) {
      $_SESSION['compose']['param']['sent_mbox'] = $sent_folder;
      $COMPOSE['param']['sent_mbox'] = $sent_folder;
    }
  }
  else if ($compose_mode == RCUBE_COMPOSE_DRAFT)
@@ -190,31 +207,31 @@
      $info = rcmail_draftinfo_decode($MESSAGE->headers->others['x-draft-info']);

      if ($info['type'] == 'reply')
        $_SESSION['compose']['reply_uid'] = $info['uid'];
        $COMPOSE['reply_uid'] = $info['uid'];
      else if ($info['type'] == 'forward')
        $_SESSION['compose']['forward_uid'] = $info['uid'];
        $COMPOSE['forward_uid'] = $info['uid'];

      $_SESSION['compose']['mailbox'] = $info['folder'];
      $COMPOSE['mailbox'] = $info['folder'];

      // Save the sent message in the same folder of the message being replied to
      if ($RCMAIL->config->get('reply_same_folder') && ($sent_folder = $info['folder'])
        && rcmail_check_sent_folder($sent_folder, false)
      ) {
        $_SESSION['compose']['param']['sent_mbox'] = $sent_folder;
        $COMPOSE['param']['sent_mbox'] = $sent_folder;
      }
    }

    if ($MESSAGE->headers->in_reply_to)
      $_SESSION['compose']['reply_msgid'] = '<'.$MESSAGE->headers->in_reply_to.'>';
      $COMPOSE['reply_msgid'] = '<'.$MESSAGE->headers->in_reply_to.'>';

    $_SESSION['compose']['references']  = $MESSAGE->headers->references;
    $COMPOSE['references']  = $MESSAGE->headers->references;
  }
  else if ($compose_mode == RCUBE_COMPOSE_FORWARD)
  {
    $_SESSION['compose']['forward_uid'] = $msg_uid;
    $COMPOSE['forward_uid'] = $msg_uid;
    $OUTPUT->set_env('compose_mode', 'forward');

    if (!empty($_SESSION['compose']['param']['attachment']))
    if (!empty($COMPOSE['param']['attachment']))
      $MESSAGE->forward_attachment = true;
  }
}
@@ -226,7 +243,8 @@
if (count($MESSAGE->identities))
{
  foreach ($MESSAGE->identities as $idx => $ident) {
    $email = mb_strtolower(rcube_idn_to_utf8($ident['email']));
    $ident['email'] = format_email($ident['email']);
    $email = format_email(rcube_idn_to_utf8($ident['email']));

    $MESSAGE->identities[$idx]['email_ascii'] = $ident['email'];
    $MESSAGE->identities[$idx]['ident']       = format_email_recipient($ident['email'], $ident['name']);
@@ -238,25 +256,31 @@
if (!empty($_POST['_from'])) {
  $MESSAGE->compose['from'] = get_input_value('_from', RCUBE_INPUT_POST);
}
else if (!empty($_SESSION['compose']['param']['from'])) {
  $MESSAGE->compose['from'] = $_SESSION['compose']['param']['from'];
else if (!empty($COMPOSE['param']['from'])) {
  $MESSAGE->compose['from'] = $COMPOSE['param']['from'];
}
else if (count($MESSAGE->identities)) {
  // extract all recipients of the reply-message
  $a_recipients = array();
  $a_names      = array();

  // extract all recipients of the reply-message
  if (is_object($MESSAGE->headers) && in_array($compose_mode, array(RCUBE_COMPOSE_REPLY, RCUBE_COMPOSE_FORWARD)))
  {
    $a_to = $IMAP->decode_address_list($MESSAGE->headers->to);
    foreach ($a_to as $addr) {
      if (!empty($addr['mailto']))
        $a_recipients[] = strtolower($addr['mailto']);
      if (!empty($addr['mailto'])) {
        $a_recipients[] = format_email($addr['mailto']);
        $a_names[]      = $addr['name'];
      }
    }

    if (!empty($MESSAGE->headers->cc)) {
      $a_cc = $IMAP->decode_address_list($MESSAGE->headers->cc);
      foreach ($a_cc as $addr) {
        if (!empty($addr['mailto']))
          $a_recipients[] = strtolower($addr['mailto']);
        if (!empty($addr['mailto'])) {
          $a_recipients[] = format_email($addr['mailto']);
          $a_names[]      = $addr['name'];
        }
      }
    }
  }
@@ -285,8 +309,11 @@
      break;
    }
    // use replied message recipients
    else if (in_array($ident['email_ascii'], $a_recipients)) {
      $from_idx = $idx;
    else if (($found = array_search($ident['email_ascii'], $a_recipients)) !== false) {
      // match identity name, prefer default identity
      if ($from_idx === null || ($a_names[$found] && $ident['name'] && $a_names[$found] == $ident['name'])) {
        $from_idx = $idx;
      }
    }
  }

@@ -315,23 +342,28 @@
// Set other headers
$a_recipients = array();
$parts        = array('to', 'cc', 'bcc', 'replyto', 'followupto');
$separator    = trim($RCMAIL->config->get('recipients_separator', ',')) . ' ';

foreach ($parts as $header) {
  $fvalue = '';
  $decode_header = true;

  // we have a set of recipients stored is session
  if ($header == 'to' && ($mailto_id = $_SESSION['compose']['param']['mailto'])
  if ($header == 'to' && ($mailto_id = $COMPOSE['param']['mailto'])
      && $_SESSION['mailto'][$mailto_id]
  ) {
    $fvalue = urldecode($_SESSION['mailto'][$mailto_id]);
    $decode_header = false;

    // make session to not grow up too much
    unset($_SESSION['mailto'][$mailto_id]);
    $COMPOSE['param']['to'] = $fvalue;
  }
  else if (!empty($_POST['_'.$header])) {
    $fvalue = get_input_value('_'.$header, RCUBE_INPUT_POST, TRUE);
  }
  else if (!empty($_SESSION['compose']['param'][$header])) {
    $fvalue = $_SESSION['compose']['param'][$header];
  else if (!empty($COMPOSE['param'][$header])) {
    $fvalue = $COMPOSE['param'][$header];
  }
  else if ($compose_mode == RCUBE_COMPOSE_REPLY) {
    // get recipent address(es) out of the message headers
@@ -339,11 +371,13 @@
      $mailfollowup = $MESSAGE->headers->others['mail-followup-to'];
      $mailreplyto  = $MESSAGE->headers->others['mail-reply-to'];

      // Reply to mailing list...
      if ($MESSAGE->reply_all == 'list' && $mailfollowup)
        $fvalue = $mailfollowup;
      else if ($MESSAGE->reply_all == 'list'
        && preg_match('/<mailto:([^>]+)>/i', $MESSAGE->headers->others['list-post'], $m))
        $fvalue = $m[1];
      // Reply to...
      else if ($MESSAGE->reply_all && $mailfollowup)
        $fvalue = $mailfollowup;
      else if ($mailreplyto)
@@ -352,13 +386,18 @@
        $fvalue = $MESSAGE->headers->replyto;
      else if (!empty($MESSAGE->headers->from))
        $fvalue = $MESSAGE->headers->from;

      // Reply to message sent by yourself (#1487074)
      if (!empty($ident) && $fvalue == $ident['ident']) {
        $fvalue = $MESSAGE->headers->to;
      }
    }
    // add recipient of original message if reply to all
    else if ($header == 'cc' && !empty($MESSAGE->reply_all) && $MESSAGE->reply_all != 'list') {
      if ($v = $MESSAGE->headers->to)
        $fvalue .= $v;
      if ($v = $MESSAGE->headers->cc)
        $fvalue .= (!empty($fvalue) ? ', ' : '') . $v;
        $fvalue .= (!empty($fvalue) ? $separator : '') . $v;
    }
  }
  else if (in_array($compose_mode, array(RCUBE_COMPOSE_DRAFT, RCUBE_COMPOSE_EDIT))) {
@@ -386,7 +425,7 @@
      if (empty($addr_part['mailto']))
        continue;

      $mailto = mb_strtolower(rcube_idn_to_utf8($addr_part['mailto']));
      $mailto = format_email(rcube_idn_to_utf8($addr_part['mailto']));

      if (!in_array($mailto, $a_recipients)
        && ($header == 'to' || empty($MESSAGE->compose['from_email']) || $mailto != $MESSAGE->compose['from_email'])
@@ -401,7 +440,7 @@
      }
    }

    $fvalue = implode(', ', $fvalue);
    $fvalue = implode($separator, $fvalue);
  }

  $MESSAGE->compose[$header] = $fvalue;
@@ -504,7 +543,7 @@
      $select_from->add(format_email_recipient($sql_arr['email'], $sql_arr['name']), $identity_id);

      // add signature to array
      if (!empty($sql_arr['signature']) && empty($_SESSION['compose']['param']['nosig']))
      if (!empty($sql_arr['signature']) && empty($COMPOSE['param']['nosig']))
      {
        $a_signatures[$identity_id]['text'] = $sql_arr['signature'];
        $a_signatures[$identity_id]['is_html'] = ($sql_arr['html_signature'] == 1) ? true : false;
@@ -558,22 +597,22 @@

function rcmail_prepare_message_body()
{
  global $RCMAIL, $MESSAGE, $compose_mode, $LINE_LENGTH, $HTML_MODE;
  global $RCMAIL, $MESSAGE, $COMPOSE, $compose_mode, $LINE_LENGTH, $HTML_MODE;

  // use posted message body
  if (!empty($_POST['_message'])) {
    $body = get_input_value('_message', RCUBE_INPUT_POST, true);
    $isHtml = (bool) get_input_value('_is_html', RCUBE_INPUT_POST);
  }
  else if ($_SESSION['compose']['param']['body']) {
    $body = $_SESSION['compose']['param']['body'];
  else if ($COMPOSE['param']['body']) {
    $body = $COMPOSE['param']['body'];
    $isHtml = false;
  }
  // forward as attachment
  else if ($compose_mode == RCUBE_COMPOSE_FORWARD && $MESSAGE->forward_attachment) {
    $isHtml = rcmail_compose_editor_mode();
    $body = '';
    if (empty($_SESSION['compose']['attachments']))
    if (empty($COMPOSE['attachments']))
      rcmail_write_forward_attachment($MESSAGE);
  }
  // reply/edit/draft/forward
@@ -636,9 +675,9 @@
  // add blocked.gif attachment (#1486516)
  if ($isHtml && preg_match('#<img src="\./program/blocked\.gif"#', $body)) {
    if ($attachment = rcmail_save_image('program/blocked.gif', 'image/gif')) {
      $_SESSION['compose']['attachments'][$attachment['id']] = $attachment;
      $COMPOSE['attachments'][$attachment['id']] = $attachment;
      $body = preg_replace('#\./program/blocked\.gif#',
        $RCMAIL->comm_path.'&_action=display-attachment&_file=rcmfile'.$attachment['id'].'&_id='.$_SESSION['compose']['id'],
        $RCMAIL->comm_path.'&_action=display-attachment&_file=rcmfile'.$attachment['id'].'&_id='.$COMPOSE['id'],
        $body);
    }
  }
@@ -677,7 +716,7 @@
  if ($isHtml) {
    $attrib['class'] = 'mce_editor';
    $textarea = new html_textarea($attrib);
    $out .= $textarea->show($MESSAGE_BODY);
    $out .= $textarea->show(htmlentities($MESSAGE_BODY, ENT_NOQUOTES, RCMAIL_CHARSET));
  }
  else {
    $textarea = new html_textarea($attrib);
@@ -697,8 +736,8 @@

  // include GoogieSpell
  if (!empty($CONFIG['enable_spellcheck'])) {

    $engine = $RCMAIL->config->get('spellcheck_engine','googie');
    $engine           = $RCMAIL->config->get('spellcheck_engine','googie');
    $dictionary       = (bool) $RCMAIL->config->get('spellcheck_dictionary');
    $spellcheck_langs = (array) $RCMAIL->config->get('spellcheck_languages',
      array('da'=>'Dansk', 'de'=>'Deutsch', 'en' => 'English', 'es'=>'Español',
            'fr'=>'Français', 'it'=>'Italiano', 'nl'=>'Nederlands', 'pl'=>'Polski',
@@ -728,25 +767,28 @@
    foreach ($spellcheck_langs as $key => $name) {
      $editor_lang_set[] = ($key == $lang ? '+' : '') . JQ($name).'='.JQ($key);
    }
    

    $OUTPUT->include_script('googiespell.js');
    $OUTPUT->add_script(sprintf(
      "var googie = new GoogieSpell('\$__skin_path/images/googiespell/','?_task=utils&_action=spell&lang=');\n".
      "var googie = new GoogieSpell('\$__skin_path/images/googiespell/','?_task=utils&_action=spell&lang=', %s);\n".
      "googie.lang_chck_spell = \"%s\";\n".
      "googie.lang_rsm_edt = \"%s\";\n".
      "googie.lang_close = \"%s\";\n".
      "googie.lang_revert = \"%s\";\n".
      "googie.lang_no_error_found = \"%s\";\n".
      "googie.lang_learn_word = \"%s\";\n".
      "googie.setLanguages(%s);\n".
      "googie.setCurrentLanguage('%s');\n".
      "googie.setSpellContainer('spellcheck-control');\n".
      "googie.decorateTextarea('%s');\n".
      "%s.set_env('spellcheck', googie);",
      !empty($dictionary) ? 'true' : 'false',
      JQ(Q(rcube_label('checkspelling'))),
      JQ(Q(rcube_label('resumeediting'))),
      JQ(Q(rcube_label('close'))),
      JQ(Q(rcube_label('revertto'))),
      JQ(Q(rcube_label('nospellerrors'))),
      JQ(Q(rcube_label('addtodict'))),
      json_serialize($spellcheck_langs),
      $lang,
      $attrib['id'],
@@ -819,24 +861,27 @@

function rcmail_create_forward_body($body, $bodyIsHtml)
{
  global $IMAP, $MESSAGE, $OUTPUT;
  global $RCMAIL, $MESSAGE, $COMPOSE;

  // add attachments
  if (!isset($_SESSION['compose']['forward_attachments']) && is_array($MESSAGE->mime_parts))
  if (!isset($COMPOSE['forward_attachments']) && is_array($MESSAGE->mime_parts))
    $cid_map = rcmail_write_compose_attachments($MESSAGE, $bodyIsHtml);

  $date    = format_date($MESSAGE->headers->date, $RCMAIL->config->get('date_long'));
  $charset = $RCMAIL->output->get_charset();

  if (!$bodyIsHtml)
  {
    $prefix = "\n\n\n-------- " . rcube_label('originalmessage') . " --------\n";
    $prefix .= 'Subject: ' . $MESSAGE->subject . "\n";
    $prefix .= 'Date: ' . $MESSAGE->headers->date . "\n";
    $prefix .= 'From: ' . $MESSAGE->get_header('from') . "\n";
    $prefix .= 'To: ' . $MESSAGE->get_header('to') . "\n";
    $prefix .= rcube_label('subject') . ': ' . $MESSAGE->subject . "\n";
    $prefix .= rcube_label('date')    . ': ' . $date . "\n";
    $prefix .= rcube_label('from')    . ': ' . $MESSAGE->get_header('from') . "\n";
    $prefix .= rcube_label('to')      . ': ' . $MESSAGE->get_header('to') . "\n";

    if ($MESSAGE->headers->cc)
      $prefix .= 'Cc: ' . $MESSAGE->get_header('cc') . "\n";
      $prefix .= rcube_label('cc') . ': ' . $MESSAGE->get_header('cc') . "\n";
    if ($MESSAGE->headers->replyto && $MESSAGE->headers->replyto != $MESSAGE->headers->from)
      $prefix .= 'Reply-To: ' . $MESSAGE->get_header('replyto') . "\n";
      $prefix .= rcube_label('replyto') . ': ' . $MESSAGE->get_header('replyto') . "\n";

    $prefix .= "\n";
  }
@@ -850,22 +895,24 @@
    $prefix = sprintf(
      "<br /><p>-------- " . rcube_label('originalmessage') . " --------</p>" .
        "<table border=\"0\" cellpadding=\"0\" cellspacing=\"0\"><tbody>" .
        "<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">Subject: </th><td>%s</td></tr>" .
        "<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">Date: </th><td>%s</td></tr>" .
        "<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">From: </th><td>%s</td></tr>" .
        "<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">To: </th><td>%s</td></tr>",
      Q($MESSAGE->subject),
      Q($MESSAGE->headers->date),
      htmlspecialchars(Q($MESSAGE->get_header('from'), 'replace'), ENT_COMPAT, $OUTPUT->get_charset()),
      htmlspecialchars(Q($MESSAGE->get_header('to'), 'replace'), ENT_COMPAT, $OUTPUT->get_charset()));
        "<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">%s: </th><td>%s</td></tr>" .
        "<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">%s: </th><td>%s</td></tr>" .
        "<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">%s: </th><td>%s</td></tr>" .
        "<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">%s: </th><td>%s</td></tr>",
      rcube_label('subject'), Q($MESSAGE->subject),
      rcube_label('date'), Q($date),
      rcube_label('from'), Q($MESSAGE->get_header('from'), 'replace'),
      rcube_label('to'), Q($MESSAGE->get_header('to'), 'replace'));

    if ($MESSAGE->headers->cc)
      $prefix .= sprintf("<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">Cc: </th><td>%s</td></tr>",
        htmlspecialchars(Q($MESSAGE->get_header('cc'), 'replace'), ENT_COMPAT, $OUTPUT->get_charset()));
      $prefix .= sprintf("<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">%s: </th><td>%s</td></tr>",
        rcube_label('cc'),
        Q($MESSAGE->get_header('cc'), 'replace'));

    if ($MESSAGE->headers->replyto && $MESSAGE->headers->replyto != $MESSAGE->headers->from)
      $prefix .= sprintf("<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">Reply-To: </th><td>%s</td></tr>",
        htmlspecialchars(Q($MESSAGE->get_header('replyto'), 'replace'), ENT_COMPAT, $OUTPUT->get_charset()));
      $prefix .= sprintf("<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">%s: </th><td>%s</td></tr>",
        rcube_label('replyto'),
        Q($MESSAGE->get_header('replyto'), 'replace'));

    $prefix .= "</tbody></table><br>";
  }
@@ -876,13 +923,13 @@

function rcmail_create_draft_body($body, $bodyIsHtml)
{
  global $MESSAGE, $OUTPUT;
  global $MESSAGE, $OUTPUT, $COMPOSE;

  /**
   * add attachments
   * sizeof($MESSAGE->mime_parts can be 1 - e.g. attachment, but no text!
   */
  if (empty($_SESSION['compose']['forward_attachments'])
  if (empty($COMPOSE['forward_attachments'])
      && is_array($MESSAGE->mime_parts)
      && count($MESSAGE->mime_parts) > 0)
  {
@@ -920,7 +967,7 @@

function rcmail_write_compose_attachments(&$message, $bodyIsHtml)
{
  global $RCMAIL;
  global $RCMAIL, $COMPOSE;

  $cid_map = $messages = array();
  foreach ((array)$message->mime_parts as $pid => $part)
@@ -942,9 +989,9 @@
      }

      if (!$skip && ($attachment = rcmail_save_attachment($message, $pid))) {
        $_SESSION['compose']['attachments'][$attachment['id']] = $attachment;
        $COMPOSE['attachments'][$attachment['id']] = $attachment;
        if ($bodyIsHtml && ($part->content_id || $part->content_location)) {
          $url = $RCMAIL->comm_path.'&_action=display-attachment&_file=rcmfile'.$attachment['id'].'&_id='.$_SESSION['compose']['id'];
          $url = $RCMAIL->comm_path.'&_action=display-attachment&_file=rcmfile'.$attachment['id'].'&_id='.$COMPOSE['id'];
          if ($part->content_id)
            $cid_map['cid:'.$part->content_id] = $url;
          else
@@ -954,7 +1001,7 @@
    }
  }

  $_SESSION['compose']['forward_attachments'] = true;
  $COMPOSE['forward_attachments'] = true;

  return $cid_map;
}
@@ -962,14 +1009,14 @@

function rcmail_write_inline_attachments(&$message)
{
  global $RCMAIL;
  global $RCMAIL, $COMPOSE;

  $cid_map = array();
  foreach ((array)$message->mime_parts as $pid => $part) {
    if (($part->content_id || $part->content_location) && $part->filename) {
      if ($attachment = rcmail_save_attachment($message, $pid)) {
        $_SESSION['compose']['attachments'][$attachment['id']] = $attachment;
        $url = $RCMAIL->comm_path.'&_action=display-attachment&_file=rcmfile'.$attachment['id'].'&_id='.$_SESSION['compose']['id'];
        $COMPOSE['attachments'][$attachment['id']] = $attachment;
        $url = $RCMAIL->comm_path.'&_action=display-attachment&_file=rcmfile'.$attachment['id'].'&_id='.$COMPOSE['id'];
        if ($part->content_id)
          $cid_map['cid:'.$part->content_id] = $url;
        else
@@ -984,7 +1031,7 @@
// Creates an attachment from the forwarded message
function rcmail_write_forward_attachment(&$message)
{
  global $RCMAIL;
  global $RCMAIL, $COMPOSE;

  if (strlen($message->subject)) {
    $name = mb_substr($message->subject, 0, 64) . '.eml';
@@ -1011,7 +1058,7 @@
  }

  $attachment = array(
    'group' => $_SESSION['compose']['id'],
    'group' => $COMPOSE['id'],
    'name' => $name,
    'mimetype' => 'message/rfc822',
    'data' => $data,
@@ -1023,7 +1070,7 @@

  if ($attachment['status']) {
    unset($attachment['data'], $attachment['status'], $attachment['content_id'], $attachment['abort']);
    $_SESSION['compose']['attachments'][$attachment['id']] = $attachment;
    $COMPOSE['attachments'][$attachment['id']] = $attachment;
    return true;
  } else if ($path) {
    @unlink($path);
@@ -1035,6 +1082,8 @@

function rcmail_save_attachment(&$message, $pid)
{
  global $COMPOSE;

  $rcmail = rcmail::get_instance();
  $part = $message->mime_parts[$pid];
  $mem_limit = parse_bytes(ini_get('memory_limit'));
@@ -1055,7 +1104,7 @@
  }

  $attachment = array(
    'group' => $_SESSION['compose']['id'],
    'group' => $COMPOSE['id'],
    'name' => $part->filename ? $part->filename : 'Part_'.$pid.'.'.$part->ctype_secondary,
    'mimetype' => $part->ctype_primary . '/' . $part->ctype_secondary,
    'content_id' => $part->content_id,
@@ -1078,11 +1127,13 @@

function rcmail_save_image($path, $mimetype='')
{
  global $COMPOSE;

  // handle attachments in memory
  $data = file_get_contents($path);

  $attachment = array(
    'group' => $_SESSION['compose']['id'],
    'group' => $COMPOSE['id'],
    'name' => rcmail_basename($path),
    'mimetype' => $mimetype ? $mimetype : rc_mime_content_type($path, $name),
    'data' => $data,
@@ -1111,11 +1162,11 @@

function rcmail_compose_subject($attrib)
{
  global $MESSAGE, $compose_mode;
  
  global $MESSAGE, $COMPOSE, $compose_mode;

  list($form_start, $form_end) = get_form_tags($attrib);
  unset($attrib['form']);
  

  $attrib['name'] = '_subject';
  $attrib['spellcheck'] = 'true';
  $textfield = new html_inputfield($attrib);
@@ -1144,10 +1195,10 @@
  else if ($compose_mode == RCUBE_COMPOSE_DRAFT || $compose_mode == RCUBE_COMPOSE_EDIT) {
    $subject = $MESSAGE->subject;
  }
  else if (!empty($_SESSION['compose']['param']['subject'])) {
    $subject = $_SESSION['compose']['param']['subject'];
  else if (!empty($COMPOSE['param']['subject'])) {
    $subject = $COMPOSE['param']['subject'];
  }
  

  $out = $form_start ? "$form_start\n" : '';
  $out .= $textfield->show($subject);
  $out .= $form_end ? "\n$form_end" : '';
@@ -1158,17 +1209,16 @@

function rcmail_compose_attachment_list($attrib)
{
  global $OUTPUT, $CONFIG;
  
  global $OUTPUT, $CONFIG, $COMPOSE;

  // add ID if not given
  if (!$attrib['id'])
    $attrib['id'] = 'rcmAttachmentList';
  

  $out = "\n";
  $jslist = array();

  if (is_array($_SESSION['compose']['attachments']))
  {
  if (is_array($COMPOSE['attachments'])) {
    if ($attrib['deleteicon']) {
      $button = html::img(array(
        'src' => $CONFIG['skin_path'] . $attrib['deleteicon'],
@@ -1178,24 +1228,24 @@
    else
      $button = Q(rcube_label('delete'));

    foreach ($_SESSION['compose']['attachments'] as $id => $a_prop)
    foreach ($COMPOSE['attachments'] as $id => $a_prop)
    {
      if (empty($a_prop))
        continue;
      

      $out .= html::tag('li', array('id' => 'rcmfile'.$id),
        html::a(array(
            'href' => "#delete",
            'title' => rcube_label('delete'),
            'onclick' => sprintf("return %s.command('remove-attachment','rcmfile%s', this)", JS_OBJECT_NAME, $id)),
          $button) . Q($a_prop['name']));
        

        $jslist['rcmfile'.$id] = array('name' => $a_prop['name'], 'complete' => true, 'mimetype' => $a_prop['mimetype']);
    }
  }

  if ($attrib['deleteicon'])
    $_SESSION['compose']['deleteicon'] = $CONFIG['skin_path'] . $attrib['deleteicon'];
    $COMPOSE['deleteicon'] = $CONFIG['skin_path'] . $attrib['deleteicon'];
  if ($attrib['cancelicon'])
    $OUTPUT->set_env('cancelicon', $CONFIG['skin_path'] . $attrib['cancelicon']);
  if ($attrib['loadingicon'])
@@ -1203,14 +1253,14 @@

  $OUTPUT->set_env('attachments', $jslist);
  $OUTPUT->add_gui_object('attachmentlist', $attrib['id']);
    

  return html::tag('ul', $attrib, $out, html::$common_attrib);
}


function rcmail_compose_attachment_form($attrib)
{
  global $RCMAIL, $OUTPUT;
  global $OUTPUT;

  // add ID if not given
  if (!$attrib['id'])
@@ -1251,7 +1301,7 @@
function rcmail_priority_selector($attrib)
{
  global $MESSAGE;
  

  list($form_start, $form_end) = get_form_tags($attrib);
  unset($attrib['form']);

@@ -1288,7 +1338,7 @@
  unset($attrib['form']);

  if (!isset($attrib['id']))
    $attrib['id'] = 'receipt';  
    $attrib['id'] = 'receipt';

  $attrib['name'] = '_receipt';
  $attrib['value'] = '1';
@@ -1331,8 +1381,6 @@

function rcmail_editor_selector($attrib)
{
  global $CONFIG, $MESSAGE, $compose_mode;

  // determine whether HTML or plain text should be checked
  $useHtml = rcmail_compose_editor_mode();

@@ -1363,12 +1411,15 @@

function rcmail_store_target_selection($attrib)
{
  global $COMPOSE;

  $attrib['name'] = '_store_target';
  $select = rcmail_mailbox_select(array_merge($attrib, array(
    'noselection' => '- '.rcube_label('dontsave').' -',
    'folder_filter' => 'mail'
    'folder_filter' => 'mail',
    'folder_rights' => 'w',
  )));
  return $select->show($_SESSION['compose']['param']['sent_mbox'], $attrib);
  return $select->show($COMPOSE['param']['sent_mbox'], $attrib);
}


@@ -1394,14 +1445,14 @@

function get_form_tags($attrib)
{
  global $RCMAIL, $MESSAGE_FORM;
  global $RCMAIL, $MESSAGE_FORM, $COMPOSE;

  $form_start = '';
  if (!$MESSAGE_FORM)
  {
    $hiddenfields = new html_hiddenfield(array('name' => '_task', 'value' => $RCMAIL->task));
    $hiddenfields->add(array('name' => '_action', 'value' => 'send'));
    $hiddenfields->add(array('name' => '_id', 'value' => $_SESSION['compose']['id']));
    $hiddenfields->add(array('name' => '_id', 'value' => $COMPOSE['id']));

    $form_start = empty($attrib['form']) ? $RCMAIL->output->form_tag(array('name' => "form", 'method' => "post")) : '';
    $form_start .= $hiddenfields->show();