githubFork/roundcubemail.git

			@@ -26,17 +26,14 @@
			$updated = $default_id = false;

			// check input
			if (IDENTITIES_LEVEL != 4 && (empty($_POST['_name']) \|\| (empty($_POST['_email']) && IDENTITIES_LEVEL != 1 && IDENTITIES_LEVEL != 3)))
			{
			if (IDENTITIES_LEVEL != 4 && (empty($_POST['_name']) \|\| (empty($_POST['_email']) && IDENTITIES_LEVEL != 1 && IDENTITIES_LEVEL != 3))) {
			$OUTPUT->show_message('formincomplete', 'warning');
			rcmail_overwrite_action('edit-identity');
			return;
			}


			$save_data = array();
			foreach ($a_save_cols as $col)
			{
			foreach ($a_save_cols as $col) {
			$fname = '_'.$col;
			if (isset($_POST[$fname]))
			$save_data[$col] = get_input_value($fname, RCUBE_INPUT_POST, true);
			@@ -44,24 +41,23 @@

			// set "off" values for checkboxes that were not checked, and therefore
			// not included in the POST body.
			foreach ($a_boolean_cols as $col)
			{
			foreach ($a_boolean_cols as $col) {
			$fname = '_' . $col;
			if (!isset($_POST[$fname]))
			$save_data[$col] = 0;
			}

			// unset email address if user has no rights to change it
			if (IDENTITIES_LEVEL == 1 \|\| IDENTITIES_LEVEL == 3 )
			if (IDENTITIES_LEVEL == 1 \|\| IDENTITIES_LEVEL == 3) {
			unset($save_data['email']);

			if (IDENTITIES_LEVEL == 4 ){
			unset($save_data['name']);
			unset($save_data['email']);
			unset($save_data['organization']);
			unset($save_data['reply-to']);
			unset($save_data['bcc']);
			unset($save_data['standard']);
			}
			// unset all fields except signature
			else if (IDENTITIES_LEVEL == 4) {
			foreach ($save_data as $idx => $value) {
			if ($idx != 'signature' && $idx != 'html_signature') {
			unset($save_data[$idx]);
			}
			}
			}

			// Validate e-mail addresses
			@@ -80,10 +76,26 @@
			}
			}

			// XSS protection in HTML signature (#1489251)
			if (!empty($save_data['signature']) && !empty($save_data['html_signature'])) {
			$save_data['signature'] = rcmail_wash_html($save_data['signature']);

			// clear POST data of signature, we want to use safe content
			// when the form is displayed again
			unset($_POST['_signature']);
			}

			// update an existing contact
			if ($_POST['_iid'])
			{
			if ($_POST['_iid']) {
			$iid = get_input_value('_iid', RCUBE_INPUT_POST);

			if (in_array(IDENTITIES_LEVEL, array(1,3,4))) {
			// merge with old identity data, fixes #1488834
			$identity = $RCMAIL->user->get_identity($iid);
			$save_data = array_merge($identity, $save_data);
			unset($save_data['changed'], $save_data['del'], $save_data['user_id'], $save_data['identity_id']);
			}

			$plugin = $RCMAIL->plugins->exec_hook('identity_update', array('id' => $iid, 'record' => $save_data));
			$save_data = $plugin['record'];

			@@ -97,8 +109,8 @@
			if ($updated) {
			$OUTPUT->show_message('successfullysaved', 'confirmation');

			if (!empty($_POST['_standard']))
			$default_id = get_input_value('_iid', RCUBE_INPUT_POST);
			if (!empty($save_data['standard']))
			$default_id = $iid;

			if ($_POST['_framed']) {
			// update the changed col in list
			@@ -114,10 +126,10 @@
			}

			// insert a new identity record
			else if (IDENTITIES_LEVEL < 2)
			{
			if (IDENTITIES_LEVEL == 1)
			$save_data['email'] = $RCMAIL->user->get_username();
			else if (IDENTITIES_LEVEL < 2) {
			if (IDENTITIES_LEVEL == 1) {
			$save_data['email'] = $RCMAIL->get_user_email();
			}

			$plugin = $RCMAIL->plugins->exec_hook('identity_create', array('record' => $save_data));
			$save_data = $plugin['record'];
			@@ -135,7 +147,7 @@

			$_GET['_iid'] = $insert_id;

			if (!empty($_POST['_standard']))
			if (!empty($save_data['standard']))
			$default_id = $insert_id;

			if ($_POST['_framed']) {
			@@ -164,3 +176,40 @@
			}
			else
			rcmail_overwrite_action('identities');


			/**
			* Sanity checks/cleanups on HTML body of signature
			*/
			function rcmail_wash_html($html)
			{
			// Add header with charset spec., washtml cannot work without that
			$html = '<html><head>'
			. '<meta http-equiv="Content-Type" content="text/html; charset='.RCMAIL_CHARSET.'" />'
			. '</head><body>' . $html . '</body></html>';

			// clean HTML with washhtml by Frederic Motte
			$wash_opts = array(
			'show_washed' => false,
			'allow_remote' => 1,
			'charset' => RCMAIL_CHARSET,
			'html_elements' => array('body', 'link'),
			'html_attribs' => array('rel', 'type'),
			);

			// initialize HTML washer
			$washer = new rcube_washtml($wash_opts);

			//$washer->add_callback('form', 'rcmail_washtml_callback');
			//$washer->add_callback('style', 'rcmail_washtml_callback');

			// Remove non-UTF8 characters (#1487813)
			$html = rc_utf8_clean($html);

			$html = $washer->wash($html);

			// remove unwanted comments and tags (produced by washtml)
			$html = preg_replace(array('/<!--[^>]+-->/', '/<\/?body>/'), '', $html);

			return $html;
			}