From 19138ef7a9687ab45cdb495ac7c7668d571ff939 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Mon, 09 Jun 2014 04:35:32 -0400
Subject: [PATCH] Make sure set_env and add_label commands are always sent first - other commands might depend on them. Fixes loading message in managesieve filters frame.

---
 program/include/rcmail_output_html.php |  467 +++++++++++++++++++++++++++++++++++----------------------
 1 files changed, 287 insertions(+), 180 deletions(-)

diff --git a/program/include/rcmail_output_html.php b/program/include/rcmail_output_html.php
index ade2bd4..f5430d9 100644
--- a/program/include/rcmail_output_html.php
+++ b/program/include/rcmail_output_html.php
@@ -5,7 +5,7 @@
  | program/include/rcmail_output_html.php                                |
  |                                                                       |
  | This file is part of the Roundcube Webmail client                     |
- | Copyright (C) 2006-2012, The Roundcube Dev Team                       |
+ | Copyright (C) 2006-2014, The Roundcube Dev Team                       |
  |                                                                       |
  | Licensed under the GNU General Public License version 3 or            |
  | any later version with exceptions for skins & plugins.                |
@@ -23,28 +23,29 @@
 /**
  * Class to create HTML page output using a skin template
  *
- * @package    Core
+ * @package Webmail
  * @subpackage View
  */
 class rcmail_output_html extends rcmail_output
 {
     public $type = 'html';
 
-    protected $message = null;
-    protected $js_env = array();
-    protected $js_labels = array();
-    protected $js_commands = array();
-    protected $skin_paths = array();
+    protected $message;
     protected $template_name;
+    protected $js_env       = array();
+    protected $js_labels    = array();
+    protected $js_commands  = array();
+    protected $skin_paths   = array();
     protected $scripts_path = '';
     protected $script_files = array();
-    protected $css_files = array();
-    protected $scripts = array();
+    protected $css_files    = array();
+    protected $scripts      = array();
     protected $default_template = "<html>\n<head><title></title></head>\n<body></body>\n</html>";
     protected $header = '';
     protected $footer = '';
     protected $body = '';
     protected $base_path = '';
+    protected $devel_mode = false;
 
     // deprecated names of templates used before 0.5
     protected $deprecated_templates = array(
@@ -57,21 +58,22 @@
 
     /**
      * Constructor
-     *
-     * @todo   Replace $this->config with the real rcube_config object
      */
     public function __construct($task = null, $framed = false)
     {
         parent::__construct();
 
-        //$this->framed = $framed;
+        $this->devel_mode = $this->config->get('devel_mode');
+
         $this->set_env('task', $task);
         $this->set_env('x_frame_options', $this->config->get('x_frame_options', 'sameorigin'));
+        $this->set_env('standard_windows', (bool) $this->config->get('standard_windows'));
+        $this->set_env('locale', $_SESSION['language']);
 
         // add cookie info
         $this->set_env('cookie_domain', ini_get('session.cookie_domain'));
         $this->set_env('cookie_path', ini_get('session.cookie_path'));
-        $this->set_env('cookie_secure', ini_get('session.cookie_secure'));
+        $this->set_env('cookie_secure', filter_var(ini_get('session.cookie_secure'), FILTER_VALIDATE_BOOLEAN));
 
         // load the correct skin (in case user-defined)
         $skin = $this->config->get('skin');
@@ -79,11 +81,32 @@
         $this->set_env('skin', $skin);
 
         if (!empty($_REQUEST['_extwin']))
-          $this->set_env('extwin', 1);
-        if ($this->framed || !empty($_REQUEST['_framed']))
-          $this->set_env('framed', 1);
+            $this->set_env('extwin', 1);
+        if ($this->framed || $framed)
+            $this->set_env('framed', 1);
 
+        $lic = <<<EOF
+/*
+        @licstart  The following is the entire license notice for the 
+        JavaScript code in this page.
+
+        Copyright (C) 2005-2014 The Roundcube Dev Team
+
+        The JavaScript code in this page is free software: you can redistribute
+        it and/or modify it under the terms of the GNU General Public License
+        as published by the Free Software Foundation, either version 3 of
+        the License, or (at your option) any later version.
+
+        The code is distributed WITHOUT ANY WARRANTY; without even the implied
+        warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+        See the GNU GPL for more details.
+
+        @licend  The above is the entire license notice
+        for the JavaScript code in this page.
+*/
+EOF;
         // add common javascripts
+        $this->add_script($lic, 'head_top');
         $this->add_script('var '.self::JS_OBJECT_NAME.' = new rcube_webmail();', 'head_top');
 
         // don't wait for page onload. Call init at the bottom of the page (delayed)
@@ -105,7 +128,6 @@
         ));
     }
 
-
     /**
      * Set environment variable
      *
@@ -116,11 +138,11 @@
     public function set_env($name, $value, $addtojs = true)
     {
         $this->env[$name] = $value;
+
         if ($addtojs || isset($this->js_env[$name])) {
             $this->js_env[$name] = $value;
         }
     }
-
 
     /**
      * Getter for the current page title
@@ -145,17 +167,17 @@
         return $title;
     }
 
-
     /**
      * Set skin
      */
     public function set_skin($skin)
     {
         $valid = false;
+        $path  = RCUBE_INSTALL_PATH . 'skins/';
 
-        if (!empty($skin) && is_dir('skins/'.$skin) && is_readable('skins/'.$skin)) {
-            $skin_path = 'skins/'.$skin;
-            $valid = true;
+        if (!empty($skin) && is_dir($path . $skin) && is_readable($path . $skin)) {
+            $skin_path = 'skins/' . $skin;
+            $valid     = true;
         }
         else {
             $skin_path = $this->config->get('skin_path');
@@ -183,12 +205,23 @@
         $this->skin_paths[] = $skin_path;
 
         // read meta file and check for dependecies
-        $meta = @json_decode(@file_get_contents($skin_path.'/meta.json'), true);
-        if ($meta['extends'] && is_dir('skins/' . $meta['extends'])) {
-            $this->load_skin('skins/' . $meta['extends']);
+        $meta = @file_get_contents(RCUBE_INSTALL_PATH . $skin_path . '/meta.json');
+        $meta = @json_decode($meta, true);
+
+        $meta['path'] = $skin_path;
+        $skin_id = end(explode('/', $skin_path));
+        if (!$meta['name']) {
+            $meta['name'] = $skin_id;
+        }
+        $this->skins[$skin_id] = $meta;
+
+        if ($meta['extends']) {
+            $path = RCUBE_INSTALL_PATH . 'skins/';
+            if (is_dir($path . $meta['extends']) && is_readable($path . $meta['extends'])) {
+                $this->load_skin('skins/' . $meta['extends']);
+            }
         }
     }
-
 
     /**
      * Check if a specific template exists
@@ -198,16 +231,17 @@
      */
     public function template_exists($name)
     {
-        $found = false;
         foreach ($this->skin_paths as $skin_path) {
-            $filename = $skin_path . '/templates/' . $name . '.html';
-            $found = (is_file($filename) && is_readable($filename)) || ($this->deprecated_templates[$name] && $this->template_exists($this->deprecated_templates[$name]));
-            if ($found)
-                break;
+            $filename = RCUBE_INSTALL_PATH . $skin_path . '/templates/' . $name . '.html';
+            if ((is_file($filename) && is_readable($filename))
+                || ($this->deprecated_templates[$name] && $this->template_exists($this->deprecated_templates[$name]))
+            ) {
+                return true;
+            }
         }
-        return $found;
-    }
 
+        return false;
+    }
 
     /**
      * Find the given file in the current skin path stack
@@ -220,8 +254,9 @@
     public function get_skin_file($file, &$skin_path = null, $add_path = null)
     {
         $skin_paths = $this->skin_paths;
-        if ($add_path)
+        if ($add_path) {
             array_unshift($skin_paths, $add_path);
+        }
 
         foreach ($skin_paths as $skin_path) {
             $path = realpath($skin_path . $file);
@@ -232,7 +267,6 @@
 
         return false;
     }
-
 
     /**
      * Register a GUI object to the client script
@@ -246,7 +280,6 @@
         $this->add_script(self::JS_OBJECT_NAME.".gui_object('$obj', '$id');");
     }
 
-
     /**
      * Call a client method
      *
@@ -257,11 +290,10 @@
     {
         $cmd = func_get_args();
         if (strpos($cmd[0], 'plugin.') !== false)
-          $this->js_commands[] = array('triggerEvent', $cmd[0], $cmd[1]);
+            $this->js_commands[] = array('triggerEvent', $cmd[0], $cmd[1]);
         else
-          $this->js_commands[] = $cmd;
+            $this->js_commands[] = $cmd;
     }
-
 
     /**
      * Add a localized label to the client environment
@@ -270,13 +302,12 @@
     {
         $args = func_get_args();
         if (count($args) == 1 && is_array($args[0]))
-          $args = $args[0];
+            $args = $args[0];
 
         foreach ($args as $name) {
             $this->js_labels[$name] = $this->app->gettext($name);
         }
     }
-
 
     /**
      * Invoke display_message command
@@ -304,27 +335,34 @@
         }
     }
 
-
     /**
      * Delete all stored env variables and commands
+     *
+     * @param bool $all Reset all env variables (including internal)
      */
-    public function reset()
+    public function reset($all = false)
     {
-        $env = array_intersect_key($this->env, array('extwin'=>1, 'framed'=>1));
+        $framed = $this->framed;
+        $env    = $all ? null : array_intersect_key($this->env, array('extwin'=>1, 'framed'=>1));
 
         parent::reset();
 
         // let some env variables survive
-        $this->env = $this->js_env = $env;
-        $this->js_labels = array();
-        $this->js_commands = array();
+        $this->env          = $this->js_env = $env;
+        $this->framed       = $framed || $this->env['framed'];
+        $this->js_labels    = array();
+        $this->js_commands  = array();
         $this->script_files = array();
         $this->scripts      = array();
         $this->header       = '';
         $this->footer       = '';
         $this->body         = '';
-    }
 
+        // load defaults
+        if (!$all) {
+            $this->__construct();
+        }
+    }
 
     /**
      * Redirect to a certain url
@@ -340,7 +378,6 @@
         header('Location: ' . $location);
         exit;
     }
-
 
     /**
      * Send the request output to the client.
@@ -362,7 +399,7 @@
             $this->parse($templ, false);
         }
         else {
-            $this->framed = $templ == 'iframe' ? true : $this->framed;
+            $this->framed = true;
             $this->write();
         }
 
@@ -375,7 +412,6 @@
         }
     }
 
-
     /**
      * Process template and write to stdOut
      *
@@ -383,32 +419,31 @@
      */
     public function write($template = '')
     {
-        // unlock interface after iframe load
-        $unlock = preg_replace('/[^a-z0-9]/i', '', $_REQUEST['_unlock']);
-        if ($this->framed) {
-            array_unshift($this->js_commands, array('iframe_loaded', $unlock));
-        }
-        else if ($unlock) {
-            array_unshift($this->js_commands, array('hide_message', $unlock));
+        if (!empty($this->script_files)) {
+            $this->set_env('request_token', $this->app->get_request_token());
         }
 
-        if (!empty($this->script_files))
-          $this->set_env('request_token', $this->app->get_request_token());
+        $commands = $this->get_js_commands($framed);
 
-        // write all env variables to client
-        $js = $this->framed ? "if(window.parent) {\n" : '';
-        $js .= $this->get_js_commands() . ($this->framed ? ' }' : '');
-        $this->add_script($js, 'head_top');
+        // if all js commands go to parent window we can ignore all
+        // script files and skip rcube_webmail initialization (#1489792)
+        if ($framed) {
+            $this->scripts      = array();
+            $this->script_files = array();
+        }
+
+        // write all javascript commands
+        $this->add_script($commands, 'head_top');
 
         // send clickjacking protection headers
-        $iframe = $this->framed || !empty($_REQUEST['_framed']);
-        if (!headers_sent() && ($xframe = $this->app->config->get('x_frame_options', 'sameorigin')))
+        $iframe = $this->framed || $this->env['framed'];
+        if (!headers_sent() && ($xframe = $this->app->config->get('x_frame_options', 'sameorigin'))) {
             header('X-Frame-Options: ' . ($iframe && $xframe == 'deny' ? 'sameorigin' : $xframe));
+        }
 
         // call super method
         $this->_write($template, $this->config->get('skin_path'));
     }
-
 
     /**
      * Parse a specific skin template and deliver to stdout (or return)
@@ -421,15 +456,15 @@
      */
     function parse($name = 'main', $exit = true, $write = true)
     {
-        $plugin    = false;
-        $realname  = $name;
+        $plugin   = false;
+        $realname = $name;
         $this->template_name = $realname;
 
         $temp = explode('.', $name, 2);
         if (count($temp) > 1) {
-            $plugin    = $temp[0];
-            $name      = $temp[1];
-            $skin_dir  = $plugin . '/skins/' . $this->config->get('skin');
+            $plugin   = $temp[0];
+            $name     = $temp[1];
+            $skin_dir = $plugin . '/skins/' . $this->config->get('skin');
 
             // apply skin search escalation list to plugin directory
             $plugin_skin_paths = array();
@@ -510,62 +545,80 @@
         $output = preg_replace_callback('/<form\s+([^>]+)>/Ui', array($this, 'alter_form_tag'), $output);
         $this->footer = preg_replace_callback('/<form\s+([^>]+)>/Ui', array($this, 'alter_form_tag'), $this->footer);
 
-        if ($write) {
-            // add debug console
-            if ($realname != 'error' && ($this->config->get('debug_level') & 8)) {
-                $this->add_footer('<div id="console" style="position:absolute;top:5px;left:5px;width:405px;padding:2px;background:white;z-index:9000;display:none">
-                    <a href="#toggle" onclick="con=$(\'#dbgconsole\');con[con.is(\':visible\')?\'hide\':\'show\']();return false">console</a>
-                    <textarea name="console" id="dbgconsole" rows="20" cols="40" style="display:none;width:400px;border:none;font-size:10px" spellcheck="false"></textarea></div>'
-                );
-                $this->add_script(
-                    "if (!window.console || !window.console.log) {\n".
-                    "  window.console = new rcube_console();\n".
-                    "  $('#console').show();\n".
-                    "}", 'foot');
-            }
-            $this->write(trim($output));
-        }
-        else {
+        if (!$write) {
             return $output;
         }
+
+        $this->write(trim($output));
 
         if ($exit) {
             exit;
         }
     }
 
-
     /**
      * Return executable javascript code for all registered commands
      *
      * @return string $out
      */
-    protected function get_js_commands()
+    protected function get_js_commands(&$framed = null)
     {
-        $out = '';
+        $out             = '';
+        $parent_commands = 0;
+        $top_commands    = array();
+
+        // these should be always on top,
+        // e.g. hide_message() below depends on env.framed
         if (!$this->framed && !empty($this->js_env)) {
-            $out .= self::JS_OBJECT_NAME . '.set_env('.self::json_serialize($this->js_env).");\n";
+            $top_commands[] = array('set_env', $this->js_env);
         }
         if (!empty($this->js_labels)) {
-            $this->command('add_label', $this->js_labels);
+            $top_commands[] = array('add_label', $this->js_labels);
         }
-        foreach ($this->js_commands as $i => $args) {
+
+        // unlock interface after iframe load
+        $unlock = preg_replace('/[^a-z0-9]/i', '', $_REQUEST['_unlock']);
+        if ($this->framed) {
+            $top_commands[] = array('iframe_loaded', $unlock);
+        }
+        else if ($unlock) {
+            $top_commands[] = array('hide_message', $unlock);
+        }
+
+        $commands = array_merge($top_commands, $this->js_commands);
+
+        foreach ($commands as $i => $args) {
             $method = array_shift($args);
+            $parent = $this->framed || preg_match('/^parent\./', $method);
+
             foreach ($args as $i => $arg) {
                 $args[$i] = self::json_serialize($arg);
             }
-            $parent = $this->framed || preg_match('/^parent\./', $method);
-            $out .= sprintf(
-                "%s.%s(%s);\n",
-                ($parent ? 'if(window.parent && parent.'.self::JS_OBJECT_NAME.') parent.' : '') . self::JS_OBJECT_NAME,
-                preg_replace('/^parent\./', '', $method),
-                implode(',', $args)
-            );
+
+            if ($parent) {
+                $parent_commands++;
+                $method        = preg_replace('/^parent\./', '', $method);
+                $parent_prefix = 'if (window.parent && parent.' . self::JS_OBJECT_NAME . ') parent.';
+                $method        = $parent_prefix . self::JS_OBJECT_NAME . '.' . $method;
+            }
+            else {
+                $method = self::JS_OBJECT_NAME . '.' . $method;
+            }
+
+            $out .= sprintf("%s(%s);\n", $method, implode(',', $args));
+        }
+
+        $framed = $parent_prefix && $parent_commands == count($commands);
+
+        // make the output more compact if all commands go to parent window
+        if ($framed) {
+            $out = "if (window.parent && parent." . self::JS_OBJECT_NAME . ") {\n"
+                . str_replace($parent_prefix, "\tparent.", $out)
+                . "}\n";
         }
 
         return $out;
     }
-
 
     /**
      * Make URLs starting with a slash point to skin directory
@@ -577,15 +630,15 @@
     public function abs_url($str, $search_path = false)
     {
         if ($str[0] == '/') {
-            if ($search_path && ($file_url = $this->get_skin_file($str, $skin_path)))
+            if ($search_path && ($file_url = $this->get_skin_file($str, $skin_path))) {
                 return $file_url;
+            }
 
             return $this->base_path . $str;
         }
-        else
-            return $str;
-    }
 
+        return $str;
+    }
 
     /**
      * Show error page and terminate script execution
@@ -621,7 +674,6 @@
             array($this, 'globals_callback'), $input);
     }
 
-
     /**
      * Callback funtion for preg_replace_callback() in parse_with_globals()
      */
@@ -629,7 +681,6 @@
     {
         return $GLOBALS[$matches[1]];
     }
-
 
     /**
      * Correct absolute paths in images and other tags
@@ -642,7 +693,6 @@
             array($this, 'file_callback'), $output);
     }
 
-
     /**
      * Callback function for preg_replace_callback in write()
      *
@@ -651,7 +701,7 @@
     protected function file_callback($matches)
     {
         $file = $matches[3];
-        $file[0] = preg_replace('!^/this/!', '/', $file[0]);
+        $file = preg_replace('!^/this/!', '/', $file);
 
         // correct absolute paths
         if ($file[0] == '/') {
@@ -659,15 +709,35 @@
         }
 
         // add file modification timestamp
-        if (preg_match('/\.(js|css)$/', $file)) {
-            if ($fs = @filemtime($file)) {
-                $file .= '?s=' . $fs;
-            }
+        if (preg_match('/\.(js|css)$/', $file, $m)) {
+            $file = $this->file_mod($file);
         }
 
         return $matches[1] . '=' . $matches[2] . $file . $matches[4];
     }
 
+    /**
+     * Modify file by adding mtime indicator
+     */
+    protected function file_mod($file)
+    {
+        $fs  = false;
+        $ext = substr($file, strrpos($file, '.') + 1);
+
+        // use minified file if exists (not in development mode)
+        if (!$this->devel_mode && !preg_match('/\.min\.' . $ext . '$/', $file)) {
+            $minified_file = substr($file, 0, strlen($ext) * -1) . 'min.' . $ext;
+            if ($fs = @filemtime($minified_file)) {
+                return $minified_file . '?s=' . $fs;
+            }
+        }
+
+        if ($fs = @filemtime($file)) {
+            $file .= '?s=' . $fs;
+        }
+
+        return $file;
+    }
 
     /**
      * Public wrapper to dipp into template parsing.
@@ -684,7 +754,6 @@
 
         return $input;
     }
-
 
     /**
      * Parse for conditional tags
@@ -723,20 +792,17 @@
         return $input;
     }
 
-
     /**
      * Determines if a given condition is met
      *
-     * @todo   Get rid off eval() once I understand what this does.
      * @todo   Extend this to allow real conditions, not just "set"
      * @param  string Condition statement
      * @return boolean True if condition is met, False if not
      */
     protected function check_condition($condition)
     {
-        return eval("return (".$this->parse_expression($condition).");");
+        return $this->eval_expression($condition);
     }
-
 
     /**
      * Inserts hidden field with CSRF-prevention-token into POST forms
@@ -754,16 +820,16 @@
         return $out;
     }
 
-
     /**
-     * Parses expression and replaces variables
+     * Parse & evaluate a given expression and return its result.
      *
-     * @param  string Expression statement
-     * @return string Expression value
+     * @param string Expression statement
+     *
+     * @return mixed Expression result
      */
-    protected function parse_expression($expression)
+    protected function eval_expression ($expression)
     {
-        return preg_replace(
+        $expression = preg_replace(
             array(
                 '/session:([a-z0-9_]+)/i',
                 '/config:([a-z0-9_]+)(:([a-z0-9_]+))?/i',
@@ -775,16 +841,30 @@
             ),
             array(
                 "\$_SESSION['\\1']",
-                "\$this->app->config->get('\\1',rcube_utils::get_boolean('\\3'))",
-                "\$this->env['\\1']",
+                "\$app->config->get('\\1',rcube_utils::get_boolean('\\3'))",
+                "\$env['\\1']",
                 "rcube_utils::get_input_value('\\1', rcube_utils::INPUT_GPC)",
                 "\$_COOKIE['\\1']",
-                "\$this->browser->{'\\1'}",
+                "\$browser->{'\\1'}",
                 $this->template_name,
             ),
-            $expression);
-    }
+            $expression
+        );
 
+        $fn = create_function('$app,$browser,$env', "return ($expression);");
+        if (!$fn) {
+            rcube::raise_error(array(
+                'code' => 505,
+                'type' => 'php',
+                'file' => __FILE__,
+                'line' => __LINE__,
+                'message' => "Expression parse error on: ($expression)"), true, false);
+
+            return null;
+        }
+
+        return $fn($this->app, $this->browser, $this->env);
+    }
 
     /**
      * Search for special tags in input and replace them
@@ -799,7 +879,6 @@
     {
         return preg_replace_callback('/<roundcube:([-_a-z]+)\s+((?:[^>]|\\\\>)+)(?<!\\\\)>/Ui', array($this, 'xml_command'), $input);
     }
-
 
     /**
      * Callback function for parsing an xml command tag
@@ -816,6 +895,14 @@
         // empty output if required condition is not met
         if (!empty($attrib['condition']) && !$this->check_condition($attrib['condition'])) {
             return '';
+        }
+
+        // localize title and summary attributes
+        if ($command != 'button' && !empty($attrib['title']) && $this->app->text_exists($attrib['title'])) {
+            $attrib['title'] = $this->app->gettext($attrib['title']);
+        }
+        if ($command != 'button' && !empty($attrib['summary']) && $this->app->text_exists($attrib['summary'])) {
+            $attrib['summary'] = $this->app->gettext($attrib['summary']);
         }
 
         // execute command
@@ -835,7 +922,7 @@
             // show a label
             case 'label':
                 if ($attrib['expression'])
-                    $attrib['name'] = eval("return " . $this->parse_expression($attrib['expression']) .";");
+                    $attrib['name'] = $this->eval_expression($attrib['expression']);
 
                 if ($attrib['name'] || $attrib['command']) {
                     // @FIXME: 'noshow' is useless, remove?
@@ -869,6 +956,7 @@
             // include a file
             case 'include':
                 $old_base_path = $this->base_path;
+                if (!empty($attrib['skin_path'])) $attrib['skinpath'] = $attrib['skin_path'];
                 if ($path = $this->get_skin_file($attrib['file'], $skin_path, $attrib['skinpath'])) {
                     $this->base_path = preg_replace('!plugins/\w+/!', '', $skin_path);  // set base_path to core skin directory (not plugin's skin)
                     $path = realpath($path);
@@ -923,8 +1011,21 @@
                 }
                 else if ($object == 'logo') {
                     $attrib += array('alt' => $this->xml_command(array('', 'object', 'name="productname"')));
-                    if ($logo = $this->config->get('skin_logo'))
-                        $attrib['src'] = $logo;
+
+                    if ($logo = $this->config->get('skin_logo')) {
+                        if (is_array($logo)) {
+                            if ($template_logo = $logo[$this->template_name]) {
+                                $attrib['src'] = $template_logo;
+                            }
+                            elseif ($template_logo = $logo['*']) {
+                                $attrib['src'] = $template_logo;
+                            }
+                        }
+                        else {
+                            $attrib['src'] = $logo;
+                        }
+                    }
+
                     $content = html::img($attrib);
                 }
                 else if ($object == 'productname') {
@@ -950,7 +1051,7 @@
                   $content = html::quote($this->get_pagetitle());
                 }
                 else if ($object == 'pagetitle') {
-                    if ($this->config->get('devel_mode') && !empty($_SESSION['username']))
+                    if ($this->devel_mode && !empty($_SESSION['username']))
                         $title = $_SESSION['username'].' :: ';
                     else if ($prod_name = $this->config->get('product_name'))
                         $title = $prod_name . ' :: ';
@@ -966,8 +1067,7 @@
 
             // return code for a specified eval expression
             case 'exp':
-                $value = $this->parse_expression($attrib['expression']);
-                return eval("return html::quote($value);");
+                return html::quote($this->eval_expression($attrib['expression']));
 
             // return variable
             case 'var':
@@ -1004,11 +1104,12 @@
                 }
 
                 return html::quote($value);
-                break;
+
+            case 'form':
+                return $this->form_tag($attrib);
         }
         return '';
     }
-
 
     /**
      * Include a specific file and return it's contents
@@ -1026,7 +1127,6 @@
         return $out;
     }
 
-
     /**
      * Create and register a button
      *
@@ -1042,7 +1142,7 @@
         // these commands can be called directly via url
         $a_static_commands = array('compose', 'list', 'preferences', 'folders', 'identities');
 
-        if (!($attrib['command'] || $attrib['name'])) {
+        if (!($attrib['command'] || $attrib['name'] || $attrib['href'])) {
             return '';
         }
 
@@ -1075,6 +1175,17 @@
         }
         if ($attrib['alt']) {
             $attrib['alt'] = html::quote($this->app->gettext($attrib['alt'], $attrib['domain']));
+        }
+
+        // set accessibility attributes
+        if (!$attrib['role']) {
+            $attrib['role'] = 'button';
+        }
+        if (!empty($attrib['class']) && !empty($attrib['classact']) || !empty($attrib['imagepas']) && !empty($attrib['imageact'])) {
+            if (array_key_exists('tabindex', $attrib))
+                $attrib['data-tabindex'] = $attrib['tabindex'];
+            $attrib['tabindex'] = '-1';  // disable button by default
+            $attrib['aria-disabled'] = 'true';
         }
 
         // set title to alt attribute for IE browsers
@@ -1152,7 +1263,7 @@
         }
         else if ($attrib['type'] == 'link') {
             $btn_content = isset($attrib['content']) ? $attrib['content'] : ($attrib['label'] ? $attrib['label'] : $attrib['command']);
-            $link_attrib = array('href', 'onclick', 'title', 'id', 'class', 'style', 'tabindex', 'target');
+            $link_attrib = array_merge(html::$common_attrib, array('href', 'onclick', 'tabindex', 'target'));
             if ($attrib['innerclass'])
                 $btn_content = html::span($attrib['innerclass'], $btn_content);
         }
@@ -1182,7 +1293,6 @@
         return $out;
     }
 
-
     /**
      * Link an external script file
      *
@@ -1191,28 +1301,18 @@
      */
     public function include_script($file, $position='head')
     {
-        static $sa_files = array();
-
         if (!preg_match('|^https?://|i', $file) && $file[0] != '/') {
-            $file = $this->scripts_path . $file;
-            if ($fs = @filemtime($file)) {
-                $file .= '?s=' . $fs;
-            }
+            $file = $this->file_mod($this->scripts_path . $file);
         }
-
-        if (in_array($file, $sa_files)) {
-            return;
-        }
-
-        $sa_files[] = $file;
 
         if (!is_array($this->script_files[$position])) {
             $this->script_files[$position] = array();
         }
 
-        $this->script_files[$position][] = $file;
+        if (!in_array($file, $this->script_files[$position])) {
+            $this->script_files[$position][] = $file;
+        }
     }
-
 
     /**
      * Add inline javascript code
@@ -1230,7 +1330,6 @@
         }
     }
 
-
     /**
      * Link an external css file
      *
@@ -1241,7 +1340,6 @@
         $this->css_files[] = $file;
     }
 
-
     /**
      * Add HTML code to the page header
      *
@@ -1251,7 +1349,6 @@
     {
         $this->header .= "\n" . $str;
     }
-
 
     /**
      * Add HTML code to the page footer
@@ -1264,7 +1361,6 @@
         $this->footer .= "\n" . $str;
     }
 
-
     /**
      * Process template and write to stdOut
      *
@@ -1273,11 +1369,25 @@
      */
     public function _write($templ = '', $base_path = '')
     {
-        $output = empty($templ) ? $this->default_template : trim($templ);
+        $output = trim($templ);
+
+        if (empty($output)) {
+            $output   = html::doctype('html5') . "\n" . $this->default_template;
+            $is_empty = true;
+        }
 
         // set default page title
         if (empty($this->pagetitle)) {
             $this->pagetitle = 'Roundcube Mail';
+        }
+
+        // declare page language
+        if (!empty($_SESSION['language'])) {
+            $lang = substr($_SESSION['language'], 0, 2);
+            $output = preg_replace('/<html/', '<html lang="' . html::quote($lang) . '"', $output, 1);
+            if (!headers_sent()) {
+                header('Content-Language: ' . $lang);
+            }
         }
 
         // replace specialchars in content
@@ -1364,8 +1474,8 @@
         }
 
         // add css files in head, before scripts, for speed up with parallel downloads
-        if (!empty($this->css_files) && 
-            (($pos = stripos($output, '<script ')) || ($pos = stripos($output, '</head>')))
+        if (!empty($this->css_files) && !$is_empty
+            && (($pos = stripos($output, '<script ')) || ($pos = stripos($output, '</head>')))
         ) {
             $css = '';
             foreach ($this->css_files as $file) {
@@ -1388,7 +1498,6 @@
             }
         }
     }
-
 
     /**
      * Returns iframe object, registers some related env variables
@@ -1420,7 +1529,6 @@
 
     /*  ************* common functions delivering gui objects **************  */
 
-
     /**
      * Create a form tag with the necessary hidden fields
      *
@@ -1429,7 +1537,7 @@
      */
     public function form_tag($attrib, $content = null)
     {
-      if ($this->framed || !empty($_REQUEST['_framed'])) {
+      if ($this->framed || $this->env['framed']) {
         $hiddenfield = new html_hiddenfield(array('name' => '_framed', 'value' => '1'));
         $hidden = $hiddenfield->show();
       }
@@ -1442,11 +1550,10 @@
         $attrib['noclose'] = true;
 
       return html::tag('form',
-        $attrib + array('action' => "./", 'method' => "get"),
+        $attrib + array('action' => $this->app->comm_path, 'method' => "get"),
         $hidden . $content,
         array('id','class','style','name','method','action','enctype','onsubmit'));
     }
-
 
     /**
      * Build a form tag with a unique request token
@@ -1470,14 +1577,13 @@
 
         // we already have a <form> tag
         if ($attrib['form']) {
-            if ($this->framed || !empty($_REQUEST['_framed']))
+            if ($this->framed || $this->env['framed'])
                 $hidden->add(array('name' => '_framed', 'value' => '1'));
             return $hidden->show() . $content;
         }
         else
             return $this->form_tag($attrib, $hidden->show() . $content);
     }
-
 
     /**
      * GUI object 'username'
@@ -1510,7 +1616,6 @@
         return rcube_utils::idn_to_utf8($username);
     }
 
-
     /**
      * GUI object 'loginform'
      * Returns code for the webmail login form
@@ -1542,9 +1647,9 @@
         $input_action = new html_hiddenfield(array('name' => '_action', 'value' => 'login'));
         $input_tzone  = new html_hiddenfield(array('name' => '_timezone', 'id' => 'rcmlogintz', 'value' => '_default_'));
         $input_url    = new html_hiddenfield(array('name' => '_url', 'id' => 'rcmloginurl', 'value' => $url));
-        $input_user   = new html_inputfield(array('name' => '_user', 'id' => 'rcmloginuser')
+        $input_user   = new html_inputfield(array('name' => '_user', 'id' => 'rcmloginuser', 'required' => 'required')
             + $attrib + $user_attrib);
-        $input_pass   = new html_passwordfield(array('name' => '_pass', 'id' => 'rcmloginpwd')
+        $input_pass   = new html_passwordfield(array('name' => '_pass', 'id' => 'rcmloginpwd', 'required' => 'required')
             + $attrib + $pass_attrib);
         $input_host   = null;
 
@@ -1599,6 +1704,12 @@
             $out .= $input_host->show();
         }
 
+        if (rcube_utils::get_boolean($attrib['submit'])) {
+            $submit = new html_inputfield(array('type' => 'submit', 'id' => 'rcmloginsubmit',
+                'class' => 'button mainaction', 'value' => $this->app->gettext('login')));
+            $out .= html::p('formbuttons', $submit->show());
+        }
+
         // surround html output with a form tag
         if (empty($attrib['form'])) {
             $out = $this->form_tag(array('name' => $form_name, 'method' => 'post'), $out);
@@ -1609,7 +1720,6 @@
 
         return $out;
     }
-
 
     /**
      * GUI object 'preloader'
@@ -1632,7 +1742,6 @@
                 img.src = images[i];
             }', 'docready');
     }
-
 
     /**
      * GUI object 'searchform'
@@ -1663,15 +1772,14 @@
         // add form tag around text field
         if (empty($attrib['form'])) {
             $out = $this->form_tag(array(
-                'name' => "rcmqsearchform",
+                'name'     => "rcmqsearchform",
                 'onsubmit' => self::JS_OBJECT_NAME . ".command('search'); return false",
-                'style' => "display:inline"),
+                'style'    => "display:inline"),
                 $out);
         }
 
         return $out;
     }
-
 
     /**
      * Builder for GUI object 'message'
@@ -1689,7 +1797,6 @@
 
         return html::div($attrib, '');
     }
-
 
     /**
      * GUI object 'charsetselector'

--
Gitblit v1.9.1