From b48d9bf5d412a6f56f3f9ba4bad141ddfe175727 Mon Sep 17 00:00:00 2001
From: alecpl <alec@alec.pl>
Date: Mon, 07 Sep 2009 08:51:21 -0400
Subject: [PATCH] - Use faster/secure mt_rand() (#1486094)
---
program/steps/mail/compose.inc | 203 +++++++++++++++++++++++++++++++++++---------------
1 files changed, 141 insertions(+), 62 deletions(-)
diff --git a/program/steps/mail/compose.inc b/program/steps/mail/compose.inc
index f167053..8b821c8 100644
--- a/program/steps/mail/compose.inc
+++ b/program/steps/mail/compose.inc
@@ -23,6 +23,7 @@
define('RCUBE_COMPOSE_REPLY', 0x0106);
define('RCUBE_COMPOSE_FORWARD', 0x0107);
define('RCUBE_COMPOSE_DRAFT', 0x0108);
+define('RCUBE_COMPOSE_EDIT', 0x0109);
$MESSAGE_FORM = NULL;
$MESSAGE = NULL;
@@ -36,25 +37,59 @@
{
rcmail_compose_cleanup();
$_SESSION['compose'] = array(
- 'id' => uniqid(rand()),
- 'param' => array_map('strip_tags', $_GET),
- 'mailbox' => $IMAP->get_mailbox_name()
+ 'id' => uniqid(mt_rand()),
+ 'param' => request2param(RCUBE_INPUT_GET),
+ 'mailbox' => $IMAP->get_mailbox_name(),
);
// process values like "mailto:foo@bar.com?subject=new+message&cc=another"
- if ($_SESSION['compose']['param']['_to']) {
- $mailto = explode('?', $_SESSION['compose']['param']['_to']);
+ if ($_SESSION['compose']['param']['to']) {
+ $mailto = explode('?', $_SESSION['compose']['param']['to']);
if (count($mailto) > 1) {
- $_SESSION['compose']['param']['_to'] = $mailto[0];
+ $_SESSION['compose']['param']['to'] = $mailto[0];
parse_str($mailto[1], $query);
foreach ($query as $f => $val)
- $_SESSION['compose']['param']["_$f"] = $val;
+ $_SESSION['compose']['param'][$f] = $val;
+ }
+ }
+
+ // pipe compose parameters thru plugins
+ $plugin = $RCMAIL->plugins->exec_hook('message_compose', $_SESSION['compose']);
+ $_SESSION['compose']['param'] = $plugin['param'];
+
+ // add attachments listed by message_compose hook
+ if (is_array($plugin['attachments'])) {
+ foreach ($plugin['attachments'] as $attach) {
+ // we have structured data
+ if (is_array($attach)) {
+ $attachment = $attach;
+ }
+ // only a file path is given
+ else {
+ $filename = basename($attach);
+ $attachment = array(
+ 'name' => $filename,
+ 'mimetype' => rc_mime_content_type($attach, $filename),
+ 'path' => $attach
+ );
+ }
+
+ // save attachment if valid
+ if (($attachment['data'] && $attachment['name']) || ($attachment['path'] && file_exists($attachment['path']))) {
+ $attachment = rcmail::get_instance()->plugins->exec_hook('save_attachment', $attachment);
+ }
+
+ if ($attachment['status'] && !$attachment['abort']) {
+ unset($attachment['data'], $attachment['status'], $attachment['abort']);
+ $_SESSION['compose']['attachments'][$attachment['id']] = $attachment;
+ }
}
}
// redirect to a unique URL with all parameters stored in session
$OUTPUT->redirect(array('_action' => 'compose', '_id' => $_SESSION['compose']['id']));
}
+
// add some labels to client
$OUTPUT->add_label('nosubject', 'nosenderwarning', 'norecipientwarning', 'nosubjectwarning',
@@ -70,11 +105,13 @@
$OUTPUT->set_env('mailbox', $IMAP->get_mailbox_name());
// get reference message and set compose mode
-if ($msg_uid = $_SESSION['compose']['param']['_reply_uid'])
+if ($msg_uid = $_SESSION['compose']['param']['reply_uid'])
$compose_mode = RCUBE_COMPOSE_REPLY;
-else if ($msg_uid = $_SESSION['compose']['param']['_forward_uid'])
+else if ($msg_uid = $_SESSION['compose']['param']['forward_uid'])
$compose_mode = RCUBE_COMPOSE_FORWARD;
-else if ($msg_uid = $_SESSION['compose']['param']['_draft_uid']) {
+else if ($msg_uid = $_SESSION['compose']['param']['uid'])
+ $compose_mode = RCUBE_COMPOSE_EDIT;
+else if ($msg_uid = $_SESSION['compose']['param']['draft_uid']) {
$RCMAIL->imap->set_mailbox($CONFIG['drafts_mbox']);
$compose_mode = RCUBE_COMPOSE_DRAFT;
}
@@ -82,6 +119,8 @@
if (!empty($msg_uid))
{
// similar as in program/steps/mail/show.inc
+ // re-set 'prefer_html' to have possibility to use html part for compose
+ $CONFIG['prefer_html'] = $CONFIG['htmleditor'] || $compose_mode == RCUBE_COMPOSE_DRAFT || $compose_mode == RCUBE_COMPOSE_EDIT;
$MESSAGE = new rcube_message($msg_uid);
if (!empty($MESSAGE->headers->charset))
@@ -93,7 +132,7 @@
$_SESSION['compose']['reply_msgid'] = $MESSAGE->headers->messageID;
$_SESSION['compose']['references'] = trim($MESSAGE->headers->references . " " . $MESSAGE->headers->messageID);
- if (!empty($_SESSION['compose']['param']['_all']))
+ if (!empty($_SESSION['compose']['param']['all']))
$MESSAGE->reply_all = 1;
}
else if ($compose_mode == RCUBE_COMPOSE_DRAFT)
@@ -133,23 +172,23 @@
case 'to':
$fname = '_to';
- $header = 'to';
+ $header = $param = 'to';
// we have a set of recipients stored is session
- if (($mailto_id = $_SESSION['compose']['param']['_mailto']) && $_SESSION['mailto'][$mailto_id])
+ if (($mailto_id = $_SESSION['compose']['param']['mailto']) && $_SESSION['mailto'][$mailto_id])
$fvalue = urldecode($_SESSION['mailto'][$mailto_id]);
case 'cc':
if (!$fname)
{
$fname = '_cc';
- $header = 'cc';
+ $header = $param = 'cc';
}
case 'bcc':
if (!$fname)
{
$fname = '_bcc';
- $header = 'bcc';
+ $header = $param = 'bcc';
}
$allow_attrib = array('id', 'class', 'style', 'cols', 'rows', 'tabindex');
@@ -159,18 +198,19 @@
case 'replyto':
case 'reply-to':
$fname = '_replyto';
+ $param = 'replyto';
$allow_attrib = array('id', 'class', 'style', 'size', 'tabindex');
$field_type = 'html_inputfield';
break;
}
- if ($fname && !empty($_POST[$fname]))
+ if ($fname && !empty($_POST[$fname])) {
$fvalue = get_input_value($fname, RCUBE_INPUT_POST, TRUE);
- else if ($fname && !$fvalue && !empty($_SESSION['compose']['param'][$fname]))
- $fvalue = $_SESSION['compose']['param'][$fname];
-
- else if ($header && $compose_mode == RCUBE_COMPOSE_REPLY)
- {
+ }
+ else if ($fname && !$fvalue && !empty($_SESSION['compose']['param'][$param])) {
+ $fvalue = $_SESSION['compose']['param'][$param];
+ }
+ else if ($header && $compose_mode == RCUBE_COMPOSE_REPLY) {
// get recipent address(es) out of the message headers
if ($header=='to' && !empty($MESSAGE->headers->replyto))
$fvalue = $MESSAGE->headers->replyto;
@@ -208,7 +248,7 @@
}
}
}
- else if ($header && $compose_mode == RCUBE_COMPOSE_DRAFT)
+ else if ($header && in_array($compose_mode, array(RCUBE_COMPOSE_DRAFT, RCUBE_COMPOSE_EDIT)))
{
// get drafted headers
if ($header=='to' && !empty($MESSAGE->headers->to))
@@ -263,7 +303,7 @@
foreach ($a_to as $addr)
{
if (!empty($addr['mailto']))
- $a_recipients[] = rc_strtolower($addr['mailto']);
+ $a_recipients[] = mb_strtolower($addr['mailto']);
}
if (!empty($MESSAGE->headers->cc))
@@ -272,15 +312,15 @@
foreach ($a_cc as $addr)
{
if (!empty($addr['mailto']))
- $a_recipients[] = rc_strtolower($addr['mailto']);
+ $a_recipients[] = mb_strtolower($addr['mailto']);
}
}
}
// get this user's identities
- $sql_result = $USER->list_identities();
+ $user_identities = $USER->list_identities();
- if ($DB->num_rows($sql_result))
+ if (count($user_identities))
{
$from_id = 0;
$a_signatures = array();
@@ -288,13 +328,13 @@
$field_attrib['onchange'] = JS_OBJECT_NAME.".change_identity(this)";
$select_from = new html_select($field_attrib);
- while ($sql_arr = $DB->fetch_assoc($sql_result))
+ foreach ($user_identities as $sql_arr)
{
$identity_id = $sql_arr['identity_id'];
$select_from->add(format_email_recipient($sql_arr['email'], $sql_arr['name']), $identity_id);
// add signature to array
- if (!empty($sql_arr['signature']) && empty($_SESSION['compose']['param']['_nosig']))
+ if (!empty($sql_arr['signature']) && empty($_SESSION['compose']['param']['nosig']))
{
$a_signatures[$identity_id]['text'] = $sql_arr['signature'];
$a_signatures[$identity_id]['is_html'] = ($sql_arr['html_signature'] == 1) ? true : false;
@@ -314,7 +354,7 @@
if ($compose_mode == RCUBE_COMPOSE_DRAFT && strstr($MESSAGE->headers->from, $sql_arr['email']))
$from_id = $sql_arr['identity_id'];
// set identity if it's one of the reply-message recipients (with prio for default identity)
- else if (in_array(rc_strtolower($sql_arr['email']), $a_recipients) && (empty($from_id) || $sql_arr['standard']))
+ else if (in_array(mb_strtolower($sql_arr['email']), $a_recipients) && (empty($from_id) || $sql_arr['standard']))
$from_id = $sql_arr['identity_id'];
}
}
@@ -349,11 +389,11 @@
unset($attrib['form']);
if (empty($attrib['id']))
- $attrib['id'] = 'rcmComposeMessage';
+ $attrib['id'] = 'rcmComposeBody';
$attrib['name'] = '_message';
- if ($CONFIG['htmleditor'])
+ if ($CONFIG['htmleditor'] || (($compose_mode == RCUBE_COMPOSE_DRAFT || $compose_mode == RCUBE_COMPOSE_EDIT) && $MESSAGE->has_html_part()))
$isHtml = true;
else
$isHtml = false;
@@ -364,6 +404,11 @@
if (!empty($_POST['_message']))
{
$body = get_input_value('_message', RCUBE_INPUT_POST, true);
+ }
+ else if ($_SESSION['compose']['param']['body'])
+ {
+ $body = $_SESSION['compose']['param']['body'];
+ $isHtml = false;
}
else if ($compose_mode)
{
@@ -377,7 +422,7 @@
$body = $MESSAGE->first_text_part();
$isHtml = false;
}
-
+
// compose reply-body
if ($compose_mode == RCUBE_COMPOSE_REPLY)
$body = rcmail_create_reply_body($body, $isHtml);
@@ -385,12 +430,12 @@
else if ($compose_mode == RCUBE_COMPOSE_FORWARD)
$body = rcmail_create_forward_body($body, $isHtml);
// load draft message body
- else if ($compose_mode == RCUBE_COMPOSE_DRAFT)
+ else if ($compose_mode == RCUBE_COMPOSE_DRAFT || $compose_mode == RCUBE_COMPOSE_EDIT)
$body = rcmail_create_draft_body($body, $isHtml);
}
- else if (!empty($_SESSION['compose']['param']['_body']))
+ else if (!empty($_SESSION['compose']['param']['body']))
{
- $body = $_SESSION['compose']['param']['_body'];
+ $body = $_SESSION['compose']['param']['body'];
}
$out = $form_start ? "$form_start\n" : '';
@@ -409,6 +454,8 @@
$textarea = new html_textarea($attrib);
$out .= $textarea->show($body);
$out .= $form_end ? "\n$form_end" : '';
+
+ $OUTPUT->set_env('composebody', $attrib['id']);
// include HTML editor
rcube_html_editor();
@@ -558,11 +605,11 @@
Q($MESSAGE->subject),
Q($MESSAGE->headers->date),
htmlspecialchars(Q($MESSAGE->get_header('from'), 'replace'), ENT_COMPAT, $OUTPUT->get_charset()),
- htmlspecialchars(Q($MESSAGE->get_header('to'), 'replace'), ENT_COMPAT, $OUTPUT->get_charset()));
+ htmlspecialchars(Q($MESSAGE->get_header('to'), 'replace'), ENT_COMPAT, $OUTPUT->get_charset()));
if ($MESSAGE->headers->replyto && $MESSAGE->headers->replyto != $MESSAGE->headers->from)
$prefix .= sprintf("<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">Reply-To: </th><td>%s</td></tr>",
- htmlspecialchars(Q($MESSAGE->get_header('replyto'), 'replace'), ENT_COMPAT, $OUTPUT->get_charset()));
+ htmlspecialchars(Q($MESSAGE->get_header('replyto'), 'replace'), ENT_COMPAT, $OUTPUT->get_charset()));
$prefix .= "</tbody></table><br>";
}
@@ -579,7 +626,7 @@
* add attachments
* sizeof($MESSAGE->mime_parts can be 1 - e.g. attachment, but no text!
*/
- if (!isset($_SESSION['compose']['forward_attachments'])
+ if (empty($_SESSION['compose']['forward_attachments'])
&& is_array($MESSAGE->mime_parts)
&& count($MESSAGE->mime_parts) > 0)
{
@@ -597,17 +644,16 @@
function rcmail_write_compose_attachments(&$message, $bodyIsHtml)
{
global $OUTPUT;
-
+
$cid_map = array();
foreach ((array)$message->mime_parts as $pid => $part)
{
- if (($part->ctype_primary != 'message' || !$bodyIsHtml) &&
- ($part->disposition=='attachment' || $part->disposition=='inline' || $part->headers['content-id']
- || (empty($part->disposition) && $part->filename)))
+ if (($part->ctype_primary != 'message' || !$bodyIsHtml) && $part->ctype_primary != 'multipart' &&
+ ($part->disposition == 'attachment' || ($part->disposition == 'inline' && $bodyIsHtml) || $part->filename))
{
if ($attachment = rcmail_save_attachment($message, $pid)) {
$_SESSION['compose']['attachments'][$attachment['id']] = $attachment;
- if ($bodyIsHtml && $part->filename && $part->content_id) {
+ if ($bodyIsHtml && $part->content_id) {
$cid_map['cid:'.$part->content_id] = $OUTPUT->app->comm_path.'&_action=display-attachment&_file=rcmfile'.$attachment['id'];
}
}
@@ -640,20 +686,41 @@
function rcmail_save_attachment(&$message, $pid)
{
$part = $message->mime_parts[$pid];
-
+ $mem_limit = parse_bytes(ini_get('memory_limit'));
+ $curr_mem = function_exists('memory_get_usage') ? memory_get_usage() : 16*1024*1024; // safe value: 16MB
+ $data = $path = null;
+
+ // don't load too big attachments into memory
+ if ($mem_limit > 0 && $part->size > $mem_limit - $curr_mem) {
+ $rcmail = rcmail::get_instance();
+ $temp_dir = unslashify($rcmail->config->get('temp_dir'));
+ $path = tempnam($temp_dir, 'rcmAttmnt');
+ if ($fp = fopen($path, 'w')) {
+ $message->get_part_content($pid, $fp);
+ fclose($fp);
+ } else
+ return false;
+ } else {
+ $data = $message->get_part_content($pid);
+ }
+
$attachment = array(
- 'name' => $part->filename,
+ 'name' => $part->filename ? $part->filename : 'Part_'.$pid.'.'.$part->ctype_secondary,
'mimetype' => $part->ctype_primary . '/' . $part->ctype_secondary,
'content_id' => $part->content_id,
- 'data' => $message->get_part_content($pid),
+ 'data' => $data,
+ 'path' => $path
);
$attachment = rcmail::get_instance()->plugins->exec_hook('save_attachment', $attachment);
- if ($attachment['status']) {
- unset($attachment['data'], $attachment['status']);
- return $attachment;
- }
+ if ($attachment['status']) {
+ unset($attachment['data'], $attachment['status'], $attachment['content_id'], $attachment['abort']);
+ return $attachment;
+ } else if ($path) {
+ @unlink($path);
+ }
+
return false;
}
@@ -690,11 +757,11 @@
$subject = 'Fwd: '.$MESSAGE->subject;
}
// creeate a draft-subject
- else if ($compose_mode == RCUBE_COMPOSE_DRAFT) {
+ else if ($compose_mode == RCUBE_COMPOSE_DRAFT || $compose_mode == RCUBE_COMPOSE_EDIT) {
$subject = $MESSAGE->subject;
}
- else if (!empty($_SESSION['compose']['param']['_subject'])) {
- $subject = $_SESSION['compose']['param']['_subject'];
+ else if (!empty($_SESSION['compose']['param']['subject'])) {
+ $subject = $_SESSION['compose']['param']['subject'];
}
$out = $form_start ? "$form_start\n" : '';
@@ -717,11 +784,12 @@
if (is_array($_SESSION['compose']['attachments']))
{
- if ($attrib['deleteicon'])
+ if ($attrib['deleteicon']) {
$button = html::img(array(
'src' => $CONFIG['skin_path'] . $attrib['deleteicon'],
'alt' => rcube_label('delete')
- ));
+ ));
+ }
else
$button = Q(rcube_label('delete'));
@@ -739,6 +807,9 @@
}
}
+ if ($attrib['deleteicon'])
+ $_SESSION['compose']['deleteicon'] = $CONFIG['skin_path'] . $attrib['deleteicon'];
+
$OUTPUT->add_gui_object('attachmentlist', $attrib['id']);
return html::tag('ul', $attrib, $out, html::$common_attrib);
@@ -752,13 +823,20 @@
// add ID if not given
if (!$attrib['id'])
$attrib['id'] = 'rcmUploadbox';
+
+ // find max filesize value
+ $max_filesize = parse_bytes(ini_get('upload_max_filesize'));
+ $max_postsize = parse_bytes(ini_get('post_max_size'));
+ if ($max_postsize && $max_postsize < $max_filesize)
+ $max_filesize = $max_postsize;
+ $max_filesize = show_bytes($max_filesize);
$button = new html_inputfield(array('type' => 'button', 'class' => 'button'));
$out = html::div($attrib,
$OUTPUT->form_tag(array('name' => 'form', 'method' => 'post', 'enctype' => 'multipart/form-data'),
html::div(null, rcmail_compose_attachment_field(array())) .
- html::div('hint', rcube_label(array('name' => 'maxuploadsize', 'vars' => array('size' => show_bytes(parse_bytes(ini_get('upload_max_filesize'))))))) .
+ html::div('hint', rcube_label(array('name' => 'maxuploadsize', 'vars' => array('size' => $max_filesize)))) .
html::div('buttons',
$button->show(rcube_label('close'), array('onclick' => "document.getElementById('$attrib[id]').style.visibility='hidden'")) . ' ' .
$button->show(rcube_label('upload'), array('onclick' => JS_OBJECT_NAME . ".command('send-attachment', this.form)"))
@@ -827,8 +905,8 @@
$checkbox = new html_checkbox($attrib);
$out = $form_start ? "$form_start\n" : '';
- $out .= $checkbox->show(
- $compose_mode == RCUBE_COMPOSE_DRAFT && $MESSAGE->headers->mdn_to ? 1 : 0);
+ $out .= $checkbox->show(in_array($compose_mode, array(RCUBE_COMPOSE_DRAFT, RCUBE_COMPOSE_EDIT))
+ && $MESSAGE->headers->mdn_to ? 1 : 0);
$out .= $form_end ? "\n$form_end" : '';
return $out;
@@ -840,13 +918,14 @@
global $CONFIG, $MESSAGE, $compose_mode;
// determine whether HTML or plain text should be checked
- $useHtml = $CONFIG['htmleditor'] ? true : false;
-
if ($compose_mode)
- $useHtml = ($useHtml && $MESSAGE->has_html_part());
+ $useHtml = (($CONFIG['htmleditor'] || $compose_mode == RCUBE_COMPOSE_DRAFT || $compose_mode == RCUBE_COMPOSE_EDIT)
+ && $MESSAGE->has_html_part());
+ else
+ $useHtml = $CONFIG['htmleditor'] ? true : false;
if (empty($attrib['editorid']))
- $attrib['editorid'] = 'rcmComposeMessage';
+ $attrib['editorid'] = 'rcmComposeBody';
if (empty($attrib['name']))
$attrib['name'] = 'editorSelect';
--
Gitblit v1.9.1