From a8ca51718b7652d3351978a622a2302f3daae91c Mon Sep 17 00:00:00 2001
From: Thomas Bruederli <thomas@roundcube.net>
Date: Wed, 27 Mar 2013 12:07:28 -0400
Subject: [PATCH] Sanity check the file path for generic message footer before adding it
---
program/steps/mail/sendmail.inc | 58 +++++++++++++++++++++++++++++++++++++++++-----------------
1 files changed, 41 insertions(+), 17 deletions(-)
diff --git a/program/steps/mail/sendmail.inc b/program/steps/mail/sendmail.inc
index 562f155..25537f3 100644
--- a/program/steps/mail/sendmail.inc
+++ b/program/steps/mail/sendmail.inc
@@ -75,13 +75,18 @@
// get identity record
function rcmail_get_identity($id)
{
- global $RCMAIL, $OUTPUT;
+ global $RCMAIL, $message_charset;
if ($sql_arr = $RCMAIL->user->get_identity($id)) {
$out = $sql_arr;
+
+ if ($message_charset != RCMAIL_CHARSET) {
+ foreach ($out as $k => $v)
+ $out[$k] = rcube_charset_convert($v, RCMAIL_CHARSET, $message_charset);
+ }
+
$out['mailto'] = $sql_arr['email'];
- $out['string'] = format_email_recipient($sql_arr['email'],
- rcube_charset_convert($sql_arr['name'], RCMAIL_CHARSET, $OUTPUT->get_charset()));
+ $out['string'] = format_email_recipient($sql_arr['email'], $sql_arr['name']);
return $out;
}
@@ -100,7 +105,7 @@
*/
function rcmail_fix_emoticon_paths(&$mime_message)
{
- global $CONFIG;
+ global $RCMAIL;
$body = $mime_message->getHTMLBody();
@@ -125,8 +130,9 @@
if (! in_array($image_name, $included_images)) {
// add the image to the MIME message
- if (! $mime_message->addHTMLImage($img_file, 'image/gif', '', true, $image_name))
- $OUTPUT->show_message("emoticonerror", 'error');
+ if (!$mime_message->addHTMLImage($img_file, 'image/gif', '', true, $image_name)) {
+ $RCMAIL->output->show_message("emoticonerror", 'error');
+ }
array_push($included_images, $image_name);
}
@@ -204,6 +210,33 @@
}
return implode(', ', $result);
+}
+
+
+function rcmail_generic_message_footer($isHtml)
+{
+ global $CONFIG;
+
+ if ($isHtml && !empty($CONFIG['generic_message_footer_html'])) {
+ $file = $CONFIG['generic_message_footer_html'];
+ $html_footer = true;
+ }
+ else {
+ $file = $CONFIG['generic_message_footer'];
+ $html_footer = false;
+ }
+
+ if ($file && realpath($file)) {
+ // sanity check
+ if (!preg_match('/\.(php|ini|conf)$/', $file) && strpos($file, '/etc/') === false) {
+ $footer = file_get_contents($file);
+ if ($isHtml && !$html_footer)
+ $footer = '<pre>' . $footer . '</pre>';
+ return $footer;
+ }
+ }
+
+ return false;
}
@@ -443,19 +476,10 @@
}
// generic footer for all messages
- if ($isHtml && !empty($CONFIG['generic_message_footer_html'])) {
- $footer = file_get_contents(realpath($CONFIG['generic_message_footer_html']));
- $footer = rcube_charset_convert($footer, RCMAIL_CHARSET, $message_charset);
- }
- else if (!empty($CONFIG['generic_message_footer'])) {
- $footer = file_get_contents(realpath($CONFIG['generic_message_footer']));
+ if ($footer = rcmail_generic_message_footer($isHtml)) {
$footer = rcube_charset_convert($footer, RCMAIL_CHARSET, $message_charset);
- if ($isHtml)
- $footer = '<pre>'.$footer.'</pre>';
- }
-
- if ($footer)
$message_body .= "\r\n" . $footer;
+ }
}
if ($isHtml) {
--
Gitblit v1.9.1