From 197203727417a03d87053a47e5aa5175a76e3e0b Mon Sep 17 00:00:00 2001 From: Aleksander Machniak <alec@alec.pl> Date: Thu, 17 Oct 2013 04:24:53 -0400 Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382) --- program/lib/Mail/mime.php | 1206 ++++++++++++++++++++++++++++++++++++-------------------- 1 files changed, 770 insertions(+), 436 deletions(-) diff --git a/program/lib/Mail/mime.php b/program/lib/Mail/mime.php index 7641b0c..cc72f5b 100644 --- a/program/lib/Mail/mime.php +++ b/program/lib/Mail/mime.php @@ -45,6 +45,7 @@ * @author Tomas V.V. Cox <cox@idecnet.com> * @author Cipriano Groenendal <cipri@php.net> * @author Sean Coates <sean@php.net> + * @author Aleksander Machniak <alec@php.net> * @copyright 2003-2006 PEAR <pear-group@php.net> * @license http://www.opensource.org/licenses/bsd-license.php BSD License * @version CVS: $Id$ @@ -110,22 +111,6 @@ var $_htmlbody; /** - * contains the mime encoded text - * - * @var string - * @access private - */ - var $_mime; - - /** - * contains the multipart content - * - * @var string - * @access private - */ - var $_multipart; - - /** * list of the attached images * * @var array @@ -142,14 +127,6 @@ var $_parts = array(); /** - * Build parameters - * - * @var array - * @access private - */ - var $_build_params = array(); - - /** * Headers for the mail * * @var array @@ -158,49 +135,88 @@ var $_headers = array(); /** - * End Of Line sequence (for serialize) + * Build parameters * - * @var string + * @var array * @access private */ - var $_eol; - + var $_build_params = array( + // What encoding to use for the headers + // Options: quoted-printable or base64 + 'head_encoding' => 'quoted-printable', + // What encoding to use for plain text + // Options: 7bit, 8bit, base64, or quoted-printable + 'text_encoding' => 'quoted-printable', + // What encoding to use for html + // Options: 7bit, 8bit, base64, or quoted-printable + 'html_encoding' => 'quoted-printable', + // The character set to use for html + 'html_charset' => 'ISO-8859-1', + // The character set to use for text + 'text_charset' => 'ISO-8859-1', + // The character set to use for headers + 'head_charset' => 'ISO-8859-1', + // End-of-line sequence + 'eol' => "\r\n", + // Delay attachment files IO until building the message + 'delay_file_io' => false + ); /** - * Constructor function. + * Constructor function * - * @param string $crlf what type of linebreak to use. - * Defaults to "\r\n" + * @param mixed $params Build parameters that change the way the email + * is built. Should be an associative array. + * See $_build_params. * * @return void - * * @access public */ - function Mail_mime($crlf = "\r\n") + function Mail_mime($params = array()) { - $this->_setEOL($crlf); - $this->_build_params = array( - 'head_encoding' => 'quoted-printable', - 'text_encoding' => '7bit', - 'html_encoding' => 'quoted-printable', - '7bit_wrap' => 998, - 'html_charset' => 'ISO-8859-1', - 'text_charset' => 'ISO-8859-1', - 'head_charset' => 'ISO-8859-1' - ); + // Backward-compatible EOL setting + if (is_string($params)) { + $this->_build_params['eol'] = $params; + } else if (defined('MAIL_MIME_CRLF') && !isset($params['eol'])) { + $this->_build_params['eol'] = MAIL_MIME_CRLF; + } + + // Update build parameters + if (!empty($params) && is_array($params)) { + while (list($key, $value) = each($params)) { + $this->_build_params[$key] = $value; + } + } } /** - * wakeup function called by unserialize. It re-sets the EOL constant + * Set build parameter value * - * @access private + * @param string $name Parameter name + * @param string $value Parameter value + * * @return void + * @access public + * @since 1.6.0 */ - function __wakeup() + function setParam($name, $value) { - $this->_setEOL($this->_eol); + $this->_build_params[$name] = $value; } + /** + * Get build parameter value + * + * @param string $name Parameter name + * + * @return mixed Parameter value + * @access public + * @since 1.6.0 + */ + function getParam($name) + { + return isset($this->_build_params[$name]) ? $this->_build_params[$name] : null; + } /** * Accessor function to set the body text. Body text is used if @@ -209,14 +225,14 @@ * html should show. * * @param string $data Either a string or - * the file name with the contents + * the file name with the contents * @param bool $isfile If true the first param should be treated - * as a file name, else as a string (default) + * as a file name, else as a string (default) * @param bool $append If true the text or file is appended to - * the existing body, else the old body is - * overwritten + * the existing body, else the old body is + * overwritten * - * @return mixed true on success or PEAR_Error object + * @return mixed True on success or PEAR_Error object * @access public */ function setTXTBody($data, $isfile = false, $append = false) @@ -242,14 +258,26 @@ } /** + * Get message text body + * + * @return string Text body + * @access public + * @since 1.6.0 + */ + function getTXTBody() + { + return $this->_txtbody; + } + + /** * Adds a html part to the mail. * - * @param string $data either a string or the file name with the - * contents - * @param bool $isfile a flag that determines whether $data is a - * filename, or a string(false, default) + * @param string $data Either a string or the file name with the + * contents + * @param bool $isfile A flag that determines whether $data is a + * filename, or a string(false, default) * - * @return bool true on success + * @return bool True on success * @access public */ function setHTMLBody($data, $isfile = false) @@ -268,37 +296,68 @@ } /** + * Get message HTML body + * + * @return string HTML body + * @access public + * @since 1.6.0 + */ + function getHTMLBody() + { + return $this->_htmlbody; + } + + /** * Adds an image to the list of embedded images. * - * @param string $file the image file name OR image data itself - * @param string $c_type the content type - * @param string $name the filename of the image. - * Only used if $file is the image data. - * @param bool $isfile whether $file is a filename or not. - * Defaults to true + * @param string $file The image file name OR image data itself + * @param string $c_type The content type + * @param string $name The filename of the image. + * Only used if $file is the image data. + * @param bool $isfile Whether $file is a filename or not. + * Defaults to true + * @param string $content_id Desired Content-ID of MIME part + * Defaults to generated unique ID * - * @return bool true on success + * @return bool True on success * @access public */ - function addHTMLImage($file, $c_type='application/octet-stream', - $name = '', $isfile = true) - { - $filedata = ($isfile === true) ? $this->_file2str($file) - : $file; - if ($isfile === true) { - $filename = ($name == '' ? $file : $name); + function addHTMLImage($file, + $c_type='application/octet-stream', + $name = '', + $isfile = true, + $content_id = null + ) { + $bodyfile = null; + + if ($isfile) { + // Don't load file into memory + if ($this->_build_params['delay_file_io']) { + $filedata = null; + $bodyfile = $file; + } else { + if (PEAR::isError($filedata = $this->_file2str($file))) { + return $filedata; + } + } + $filename = ($name ? $name : $file); } else { + $filedata = $file; $filename = $name; } - if (PEAR::isError($filedata)) { - return $filedata; + + if (!$content_id) { + $content_id = md5(uniqid(time())); } + $this->_html_images[] = array( - 'body' => $filedata, - 'name' => $filename, - 'c_type' => $c_type, - 'cid' => md5(uniqid(time())) - ); + 'body' => $filedata, + 'body_file' => $bodyfile, + 'name' => $filename, + 'c_type' => $c_type, + 'cid' => $content_id + ); + return true; } @@ -306,79 +365,102 @@ * Adds a file to the list of attachments. * * @param string $file The file name of the file to attach - * OR the file contents itself + * or the file contents itself * @param string $c_type The content type * @param string $name The filename of the attachment - * Only use if $file is the contents - * @param bool $isfile Whether $file is a filename or not - * Defaults to true - * @param string $encoding The type of encoding to use. - * Defaults to base64. - * Possible values: 7bit, 8bit, base64, - * or quoted-printable. + * Only use if $file is the contents + * @param bool $isfile Whether $file is a filename or not. Defaults to true + * @param string $encoding The type of encoding to use. Defaults to base64. + * Possible values: 7bit, 8bit, base64 or quoted-printable. * @param string $disposition The content-disposition of this file - * Defaults to attachment. - * Possible values: attachment, inline. - * @param string $charset The character set used in the filename - * of this attachment. + * Defaults to attachment. + * Possible values: attachment, inline. + * @param string $charset The character set of attachment's content. * @param string $language The language of the attachment * @param string $location The RFC 2557.4 location of the attachment + * @param string $n_encoding Encoding of the attachment's name in Content-Type + * By default filenames are encoded using RFC2231 method + * Here you can set RFC2047 encoding (quoted-printable + * or base64) instead + * @param string $f_encoding Encoding of the attachment's filename + * in Content-Disposition header. + * @param string $description Content-Description header + * @param string $h_charset The character set of the headers e.g. filename + * If not specified, $charset will be used * - * @return mixed true on success or PEAR_Error object + * @return mixed True on success or PEAR_Error object * @access public */ function addAttachment($file, - $c_type = 'application/octet-stream', - $name = '', - $isfile = true, - $encoding = 'base64', - $disposition = 'attachment', - $charset = '', - $language = '', - $location = '') - { - $filedata = ($isfile === true) ? $this->_file2str($file) - : $file; - if ($isfile === true) { + $c_type = 'application/octet-stream', + $name = '', + $isfile = true, + $encoding = 'base64', + $disposition = 'attachment', + $charset = '', + $language = '', + $location = '', + $n_encoding = null, + $f_encoding = null, + $description = '', + $h_charset = null + ) { + $bodyfile = null; + + if ($isfile) { + // Don't load file into memory + if ($this->_build_params['delay_file_io']) { + $filedata = null; + $bodyfile = $file; + } else { + if (PEAR::isError($filedata = $this->_file2str($file))) { + return $filedata; + } + } // Force the name the user supplied, otherwise use $file - $filename = (strlen($name)) ? $name : $file; + $filename = ($name ? $name : $file); } else { + $filedata = $file; $filename = $name; } + if (!strlen($filename)) { $msg = "The supplied filename for the attachment can't be empty"; $err = PEAR::raiseError($msg); return $err; } $filename = $this->_basename($filename); - if (PEAR::isError($filedata)) { - return $filedata; - } $this->_parts[] = array( - 'body' => $filedata, - 'name' => $filename, - 'c_type' => $c_type, - 'encoding' => $encoding, - 'charset' => $charset, - 'language' => $language, - 'location' => $location, - 'disposition' => $disposition - ); + 'body' => $filedata, + 'body_file' => $bodyfile, + 'name' => $filename, + 'c_type' => $c_type, + 'charset' => $charset, + 'encoding' => $encoding, + 'language' => $language, + 'location' => $location, + 'disposition' => $disposition, + 'description' => $description, + 'name_encoding' => $n_encoding, + 'filename_encoding' => $f_encoding, + 'headers_charset' => $h_charset, + ); + return true; } /** * Get the contents of the given file name as string * - * @param string $file_name path of file to process + * @param string $file_name Path of file to process * - * @return string contents of $file_name + * @return string Contents of $file_name * @access private */ function &_file2str($file_name) { - //Check state of file and raise an error properly + // Check state of file and raise an error properly if (!file_exists($file_name)) { $err = PEAR::raiseError('File not found: ' . $file_name); return $err; @@ -391,16 +473,16 @@ $err = PEAR::raiseError('File is not readable: ' . $file_name); return $err; } - - //Temporarily reset magic_quotes_runtime and read file contents + + // Temporarily reset magic_quotes_runtime and read file contents if ($magic_quote_setting = get_magic_quotes_runtime()) { - set_magic_quotes_runtime(0); + @ini_set('magic_quotes_runtime', 0); } - $cont = file_get_contents($file_name); + $cont = file_get_contents($file_name); if ($magic_quote_setting) { - set_magic_quotes_runtime($magic_quote_setting); + @ini_set('magic_quotes_runtime', $magic_quote_setting); } - + return $cont; } @@ -409,10 +491,10 @@ * returns it during the build process. * * @param mixed &$obj The object to add the part to, or - * null if a new object is to be created. + * null if a new object is to be created. * @param string $text The text to add. * - * @return object The text mimePart object + * @return object The text mimePart object * @access private */ function &_addTextPart(&$obj, $text) @@ -420,6 +502,8 @@ $params['content_type'] = 'text/plain'; $params['encoding'] = $this->_build_params['text_encoding']; $params['charset'] = $this->_build_params['text_charset']; + $params['eol'] = $this->_build_params['eol']; + if (is_object($obj)) { $ret = $obj->addSubpart($text, $params); return $ret; @@ -434,9 +518,9 @@ * returns it during the build process. * * @param mixed &$obj The object to add the part to, or - * null if a new object is to be created. + * null if a new object is to be created. * - * @return object The html mimePart object + * @return object The html mimePart object * @access private */ function &_addHtmlPart(&$obj) @@ -444,6 +528,8 @@ $params['content_type'] = 'text/html'; $params['encoding'] = $this->_build_params['html_encoding']; $params['charset'] = $this->_build_params['html_charset']; + $params['eol'] = $this->_build_params['eol']; + if (is_object($obj)) { $ret = $obj->addSubpart($this->_htmlbody, $params); return $ret; @@ -465,8 +551,9 @@ { $params = array(); $params['content_type'] = 'multipart/mixed'; - - //Create empty multipart/mixed Mail_mimePart object to return + $params['eol'] = $this->_build_params['eol']; + + // Create empty multipart/mixed Mail_mimePart object to return $ret = new Mail_mimePart('', $params); return $ret; } @@ -477,14 +564,16 @@ * the build process. * * @param mixed &$obj The object to add the part to, or - * null if a new object is to be created. + * null if a new object is to be created. * - * @return object The multipart/mixed mimePart object + * @return object The multipart/mixed mimePart object * @access private */ function &_addAlternativePart(&$obj) { $params['content_type'] = 'multipart/alternative'; + $params['eol'] = $this->_build_params['eol']; + if (is_object($obj)) { return $obj->addSubpart('', $params); } else { @@ -499,14 +588,16 @@ * the build process. * * @param mixed &$obj The object to add the part to, or - * null if a new object is to be created + * null if a new object is to be created * - * @return object The multipart/mixed mimePart object + * @return object The multipart/mixed mimePart object * @access private */ function &_addRelatedPart(&$obj) { $params['content_type'] = 'multipart/related'; + $params['eol'] = $this->_build_params['eol']; + if (is_object($obj)) { return $obj->addSubpart('', $params); } else { @@ -522,7 +613,7 @@ * @param object &$obj The mimePart to add the image to * @param array $value The image information * - * @return object The image mimePart object + * @return object The image mimePart object * @access private */ function &_addHtmlImagePart(&$obj, $value) @@ -530,12 +621,20 @@ $params['content_type'] = $value['c_type']; $params['encoding'] = 'base64'; $params['disposition'] = 'inline'; - $params['dfilename'] = $value['name']; + $params['filename'] = $value['name']; $params['cid'] = $value['cid']; - + $params['body_file'] = $value['body_file']; + $params['eol'] = $this->_build_params['eol']; + + if (!empty($value['name_encoding'])) { + $params['name_encoding'] = $value['name_encoding']; + } + if (!empty($value['filename_encoding'])) { + $params['filename_encoding'] = $value['filename_encoding']; + } + $ret = $obj->addSubpart($value['body'], $params); return $ret; - } /** @@ -545,25 +644,43 @@ * @param object &$obj The mimePart to add the image to * @param array $value The attachment information * - * @return object The image mimePart object + * @return object The image mimePart object * @access private */ function &_addAttachmentPart(&$obj, $value) { - $params['dfilename'] = $value['name']; - $params['encoding'] = $value['encoding']; - if ($value['charset']) { - $params['charset'] = $value['charset']; - } - if ($value['language']) { - $params['language'] = $value['language']; - } - if ($value['location']) { - $params['location'] = $value['location']; - } + $params['eol'] = $this->_build_params['eol']; + $params['filename'] = $value['name']; + $params['encoding'] = $value['encoding']; $params['content_type'] = $value['c_type']; + $params['body_file'] = $value['body_file']; $params['disposition'] = isset($value['disposition']) ? $value['disposition'] : 'attachment'; + + // content charset + if (!empty($value['charset'])) { + $params['charset'] = $value['charset']; + } + // headers charset (filename, description) + if (!empty($value['headers_charset'])) { + $params['headers_charset'] = $value['headers_charset']; + } + if (!empty($value['language'])) { + $params['language'] = $value['language']; + } + if (!empty($value['location'])) { + $params['location'] = $value['location']; + } + if (!empty($value['name_encoding'])) { + $params['name_encoding'] = $value['name_encoding']; + } + if (!empty($value['filename_encoding'])) { + $params['filename_encoding'] = $value['filename_encoding']; + } + if (!empty($value['description'])) { + $params['description'] = $value['description']; + } + $ret = $obj->addSubpart($value['body'], $params); return $ret; } @@ -573,87 +690,178 @@ * mail delivery method. Note that only the mailpart that is made * with Mail_Mime is created. This means that, * YOU WILL HAVE NO TO: HEADERS UNLESS YOU SET IT YOURSELF - * using the $xtra_headers parameter! + * using the $headers parameter! * - * @param string $separation The separation etween these two parts. - * @param array $build_params The Build parameters passed to the - * &get() function. See &get for more info. - * @param array $xtra_headers The extra headers that should be passed - * to the &headers() function. - * See that function for more info. - * @param bool $overwrite Overwrite the existing headers with new. + * @param string $separation The separation between these two parts. + * @param array $params The Build parameters passed to the + * &get() function. See &get for more info. + * @param array $headers The extra headers that should be passed + * to the &headers() function. + * See that function for more info. + * @param bool $overwrite Overwrite the existing headers with new. * - * @return string The complete e-mail. + * @return mixed The complete e-mail or PEAR error object * @access public */ - function getMessage( - $separation = null, - $build_params = null, - $xtra_headers = null, - $overwrite = false - ) - { + function getMessage($separation = null, $params = null, $headers = null, + $overwrite = false + ) { if ($separation === null) { - $separation = MAIL_MIME_CRLF; + $separation = $this->_build_params['eol']; } - $body = $this->get($build_params); - $head = $this->txtHeaders($xtra_headers, $overwrite); + + $body = $this->get($params); + + if (PEAR::isError($body)) { + return $body; + } + + $head = $this->txtHeaders($headers, $overwrite); $mail = $head . $separation . $body; return $mail; } + /** + * Returns the complete e-mail body, ready to send using an alternative + * mail delivery method. + * + * @param array $params The Build parameters passed to the + * &get() function. See &get for more info. + * + * @return mixed The e-mail body or PEAR error object + * @access public + * @since 1.6.0 + */ + function getMessageBody($params = null) + { + return $this->get($params, null, true); + } + + /** + * Writes (appends) the complete e-mail into file. + * + * @param string $filename Output file location + * @param array $params The Build parameters passed to the + * &get() function. See &get for more info. + * @param array $headers The extra headers that should be passed + * to the &headers() function. + * See that function for more info. + * @param bool $overwrite Overwrite the existing headers with new. + * + * @return mixed True or PEAR error object + * @access public + * @since 1.6.0 + */ + function saveMessage($filename, $params = null, $headers = null, $overwrite = false) + { + // Check state of file and raise an error properly + if (file_exists($filename) && !is_writable($filename)) { + $err = PEAR::raiseError('File is not writable: ' . $filename); + return $err; + } + + // Temporarily reset magic_quotes_runtime and read file contents + if ($magic_quote_setting = get_magic_quotes_runtime()) { + @ini_set('magic_quotes_runtime', 0); + } + + if (!($fh = fopen($filename, 'ab'))) { + $err = PEAR::raiseError('Unable to open file: ' . $filename); + return $err; + } + + // Write message headers into file (skipping Content-* headers) + $head = $this->txtHeaders($headers, $overwrite, true); + if (fwrite($fh, $head) === false) { + $err = PEAR::raiseError('Error writing to file: ' . $filename); + return $err; + } + + fclose($fh); + + if ($magic_quote_setting) { + @ini_set('magic_quotes_runtime', $magic_quote_setting); + } + + // Write the rest of the message into file + $res = $this->get($params, $filename); + + return $res ? $res : true; + } + + /** + * Writes (appends) the complete e-mail body into file. + * + * @param string $filename Output file location + * @param array $params The Build parameters passed to the + * &get() function. See &get for more info. + * + * @return mixed True or PEAR error object + * @access public + * @since 1.6.0 + */ + function saveMessageBody($filename, $params = null) + { + // Check state of file and raise an error properly + if (file_exists($filename) && !is_writable($filename)) { + $err = PEAR::raiseError('File is not writable: ' . $filename); + return $err; + } + + // Temporarily reset magic_quotes_runtime and read file contents + if ($magic_quote_setting = get_magic_quotes_runtime()) { + @ini_set('magic_quotes_runtime', 0); + } + + if (!($fh = fopen($filename, 'ab'))) { + $err = PEAR::raiseError('Unable to open file: ' . $filename); + return $err; + } + + // Write the rest of the message into file + $res = $this->get($params, $filename, true); + + return $res ? $res : true; + } /** * Builds the multipart message from the list ($this->_parts) and * returns the mime content. * - * @param array $build_params Build parameters that change the way the email - * is built. Should be associative. Can contain: - * head_encoding - What encoding to use for the headers. - * Options: quoted-printable or base64 - * Default is quoted-printable - * text_encoding - What encoding to use for plain text - * Options: 7bit, 8bit, - * base64, or quoted-printable - * Default is 7bit - * html_encoding - What encoding to use for html - * Options: 7bit, 8bit, - * base64, or quoted-printable - * Default is quoted-printable - * 7bit_wrap - Number of characters before text is - * wrapped in 7bit encoding - * Default is 998 - * html_charset - The character set to use for html. - * Default is iso-8859-1 - * text_charset - The character set to use for text. - * Default is iso-8859-1 - * head_charset - The character set to use for headers. - * Default is iso-8859-1 + * @param array $params Build parameters that change the way the email + * is built. Should be associative. See $_build_params. + * @param resource $filename Output file where to save the message instead of + * returning it + * @param boolean $skip_head True if you want to return/save only the message + * without headers * - * @return string The mime content + * @return mixed The MIME message content string, null or PEAR error object * @access public */ - function &get($build_params = null) + function &get($params = null, $filename = null, $skip_head = false) { - if (isset($build_params)) { - while (list($key, $value) = each($build_params)) { + if (isset($params)) { + while (list($key, $value) = each($params)) { $this->_build_params[$key] = $value; } } - - if (isset($this->_headers['From'])){ - //Bug #11381: Illegal characters in domain ID - if (preg_match("|(@[0-9a-zA-Z\-\.]+)|", $this->_headers['From'], $matches)){ + + if (isset($this->_headers['From'])) { + // Bug #11381: Illegal characters in domain ID + if (preg_match('#(@[0-9a-zA-Z\-\.]+)#', $this->_headers['From'], $matches)) { $domainID = $matches[1]; - }else{ - $domainID = "@localhost"; + } else { + $domainID = '@localhost'; } - foreach($this->_html_images as $i => $img){ - $this->_html_images[$i]['cid'] = $this->_html_images[$i]['cid'] . $domainID; + foreach ($this->_html_images as $i => $img) { + $cid = $this->_html_images[$i]['cid']; + if (!preg_match('#'.preg_quote($domainID).'$#', $cid)) { + $this->_html_images[$i]['cid'] = $cid . $domainID; + } } } - - if (count($this->_html_images) AND isset($this->_htmlbody)) { + + if (count($this->_html_images) && isset($this->_htmlbody)) { foreach ($this->_html_images as $key => $value) { $regex = array(); $regex[] = '#(\s)((?i)src|background|href(?-i))\s*=\s*(["\']?)' . @@ -666,30 +874,32 @@ $rep[] = 'url(\1cid:' . $value['cid'] . '\1)'; $this->_htmlbody = preg_replace($regex, $rep, $this->_htmlbody); - $this->_html_images[$key]['name'] = - $this->_basename($this->_html_images[$key]['name']); + $this->_html_images[$key]['name'] + = $this->_basename($this->_html_images[$key]['name']); } } + + $this->_checkParams(); $null = null; $attachments = count($this->_parts) ? true : false; $html_images = count($this->_html_images) ? true : false; $html = strlen($this->_htmlbody) ? true : false; - $text = (!$html AND strlen($this->_txtbody)) ? true : false; + $text = (!$html && strlen($this->_txtbody)) ? true : false; switch (true) { - case $text AND !$attachments: + case $text && !$attachments: $message =& $this->_addTextPart($null, $this->_txtbody); break; - case !$text AND !$html AND $attachments: + case !$text && !$html && $attachments: $message =& $this->_addMixedPart(); for ($i = 0; $i < count($this->_parts); $i++) { $this->_addAttachmentPart($message, $this->_parts[$i]); } break; - case $text AND $attachments: + case $text && $attachments: $message =& $this->_addMixedPart(); $this->_addTextPart($message, $this->_txtbody); for ($i = 0; $i < count($this->_parts); $i++) { @@ -697,7 +907,7 @@ } break; - case $html AND !$attachments AND !$html_images: + case $html && !$attachments && !$html_images: if (isset($this->_txtbody)) { $message =& $this->_addAlternativePart($null); $this->_addTextPart($message, $this->_txtbody); @@ -707,7 +917,38 @@ } break; - case $html AND !$attachments AND $html_images: + case $html && !$attachments && $html_images: + // * Content-Type: multipart/alternative; + // * text + // * Content-Type: multipart/related; + // * html + // * image... + if (isset($this->_txtbody)) { + $message =& $this->_addAlternativePart($null); + $this->_addTextPart($message, $this->_txtbody); + + $ht =& $this->_addRelatedPart($message); + $this->_addHtmlPart($ht); + for ($i = 0; $i < count($this->_html_images); $i++) { + $this->_addHtmlImagePart($ht, $this->_html_images[$i]); + } + } else { + // * Content-Type: multipart/related; + // * html + // * image... + $message =& $this->_addRelatedPart($null); + $this->_addHtmlPart($message); + for ($i = 0; $i < count($this->_html_images); $i++) { + $this->_addHtmlImagePart($message, $this->_html_images[$i]); + } + } + /* + // #13444, #9725: the code below was a non-RFC compliant hack + // * Content-Type: multipart/related; + // * Content-Type: multipart/alternative; + // * text + // * html + // * image... $message =& $this->_addRelatedPart($null); if (isset($this->_txtbody)) { $alt =& $this->_addAlternativePart($message); @@ -719,9 +960,10 @@ for ($i = 0; $i < count($this->_html_images); $i++) { $this->_addHtmlImagePart($message, $this->_html_images[$i]); } + */ break; - case $html AND $attachments AND !$html_images: + case $html && $attachments && !$html_images: $message =& $this->_addMixedPart(); if (isset($this->_txtbody)) { $alt =& $this->_addAlternativePart($message); @@ -735,7 +977,7 @@ } break; - case $html AND $attachments AND $html_images: + case $html && $attachments && $html_images: $message =& $this->_addMixedPart(); if (isset($this->_txtbody)) { $alt =& $this->_addAlternativePart($message); @@ -755,17 +997,36 @@ } - if (isset($message)) { - $output = $message->encode(); - - $this->_headers = array_merge($this->_headers, - $output['headers']); + if (!isset($message)) { + $ret = null; + return $ret; + } + + // Use saved boundary + if (!empty($this->_build_params['boundary'])) { + $boundary = $this->_build_params['boundary']; + } else { + $boundary = null; + } + + // Write output to file + if ($filename) { + // Append mimePart message headers and body into file + $headers = $message->encodeToFile($filename, $boundary, $skip_head); + if (PEAR::isError($headers)) { + return $headers; + } + $this->_headers = array_merge($this->_headers, $headers); + $ret = null; + return $ret; + } else { + $output = $message->encode($boundary, $skip_head); + if (PEAR::isError($output)) { + return $output; + } + $this->_headers = array_merge($this->_headers, $output['headers']); $body = $output['body']; return $body; - - } else { - $ret = false; - return $ret; } } @@ -774,28 +1035,49 @@ * (MIME-Version and Content-Type). Format of argument is: * $array['header-name'] = 'header-value'; * - * @param array $xtra_headers Assoc array with any extra headers. - * Optional. + * @param array $xtra_headers Assoc array with any extra headers (optional) + * (Don't set Content-Type for multipart messages here!) * @param bool $overwrite Overwrite already existing headers. + * @param bool $skip_content Don't return content headers: Content-Type, + * Content-Disposition and Content-Transfer-Encoding * - * @return array Assoc array with the mime headers + * @return array Assoc array with the mime headers * @access public */ - function &headers($xtra_headers = null, $overwrite = false) + function &headers($xtra_headers = null, $overwrite = false, $skip_content = false) { - // Content-Type header should already be present, - // So just add mime version header + // Add mime version header $headers['MIME-Version'] = '1.0'; - if (isset($xtra_headers)) { + + // Content-Type and Content-Transfer-Encoding headers should already + // be present if get() was called, but we'll re-set them to make sure + // we got them when called before get() or something in the message + // has been changed after get() [#14780] + if (!$skip_content) { + $headers += $this->_contentHeaders(); + } + + if (!empty($xtra_headers)) { $headers = array_merge($headers, $xtra_headers); } + if ($overwrite) { $this->_headers = array_merge($this->_headers, $headers); } else { $this->_headers = array_merge($headers, $this->_headers); } - $encodedHeaders = $this->_encodeHeaders($this->_headers); + $headers = $this->_headers; + + if ($skip_content) { + unset($headers['Content-Type']); + unset($headers['Content-Transfer-Encoding']); + unset($headers['Content-Disposition']); + } else if (!empty($this->_build_params['ctype'])) { + $headers['Content-Type'] = $this->_build_params['ctype']; + } + + $encodedHeaders = $this->_encodeHeaders($headers); return $encodedHeaders; } @@ -803,22 +1085,89 @@ * Get the text version of the headers * (usefull if you want to use the PHP mail() function) * - * @param array $xtra_headers Assoc array with any extra headers. - * Optional. - * @param bool $overwrite Overwrite the existing heaers with new. + * @param array $xtra_headers Assoc array with any extra headers (optional) + * (Don't set Content-Type for multipart messages here!) + * @param bool $overwrite Overwrite the existing headers with new. + * @param bool $skip_content Don't return content headers: Content-Type, + * Content-Disposition and Content-Transfer-Encoding * - * @return string Plain text headers + * @return string Plain text headers * @access public */ - function txtHeaders($xtra_headers = null, $overwrite = false) + function txtHeaders($xtra_headers = null, $overwrite = false, $skip_content = false) { - $headers = $this->headers($xtra_headers, $overwrite); - - $ret = ''; - foreach ($headers as $key => $val) { - $ret .= "$key: $val" . MAIL_MIME_CRLF; + $headers = $this->headers($xtra_headers, $overwrite, $skip_content); + + // Place Received: headers at the beginning of the message + // Spam detectors often flag messages with it after the Subject: as spam + if (isset($headers['Received'])) { + $received = $headers['Received']; + unset($headers['Received']); + $headers = array('Received' => $received) + $headers; } + + $ret = ''; + $eol = $this->_build_params['eol']; + + foreach ($headers as $key => $val) { + if (is_array($val)) { + foreach ($val as $value) { + $ret .= "$key: $value" . $eol; + } + } else { + $ret .= "$key: $val" . $eol; + } + } + return $ret; + } + + /** + * Sets message Content-Type header. + * Use it to build messages with various content-types e.g. miltipart/raport + * not supported by _contentHeaders() function. + * + * @param string $type Type name + * @param array $params Hash array of header parameters + * + * @return void + * @access public + * @since 1.7.0 + */ + function setContentType($type, $params = array()) + { + $header = $type; + + $eol = !empty($this->_build_params['eol']) + ? $this->_build_params['eol'] : "\r\n"; + + // add parameters + $token_regexp = '#([^\x21\x23-\x27\x2A\x2B\x2D' + . '\x2E\x30-\x39\x41-\x5A\x5E-\x7E])#'; + if (is_array($params)) { + foreach ($params as $name => $value) { + if ($name == 'boundary') { + $this->_build_params['boundary'] = $value; + } + if (!preg_match($token_regexp, $value)) { + $header .= ";$eol $name=$value"; + } else { + $value = addcslashes($value, '\\"'); + $header .= ";$eol $name=\"$value\""; + } + } + } + + // add required boundary parameter if not defined + if (preg_match('/^multipart\//i', $type)) { + if (empty($this->_build_params['boundary'])) { + $this->_build_params['boundary'] = '=_' . md5(rand() . microtime()); + } + + $header .= ";$eol boundary=\"".$this->_build_params['boundary']."\""; + } + + $this->_build_params['ctype'] = $header; } /** @@ -845,6 +1194,24 @@ function setFrom($email) { $this->_headers['From'] = $email; + } + + /** + * Add an email to the To header + * (multiple calls to this method are allowed) + * + * @param string $email The email direction to add + * + * @return void + * @access public + */ + function addTo($email) + { + if (isset($this->_headers['To'])) { + $this->_headers['To'] .= ", $email"; + } else { + $this->_headers['To'] = $email; + } } /** @@ -884,7 +1251,7 @@ } /** - * Since the PHP send function requires you to specifiy + * Since the PHP send function requires you to specify * recipients (To: header) separately from the other * headers, the To: header is not properly encoded. * To fix this, you can use this public method to @@ -893,7 +1260,7 @@ * * @param string $recipients A comma-delimited list of recipients * - * @return string Encoded data + * @return string Encoded data * @access public */ function encodeRecipients($recipients) @@ -904,231 +1271,198 @@ } /** - * Encodes a header as per RFC2047 + * Encodes headers as per RFC2047 * * @param array $input The header data to encode * @param array $params Extra build parameters * - * @return array Encoded data + * @return array Encoded data * @access private */ function _encodeHeaders($input, $params = array()) { - $build_params = $this->_build_params; while (list($key, $value) = each($params)) { $build_params[$key] = $value; } - //$hdr_name: Name of the heaer - //$hdr_value: Full line of header value. - //$atoms: The $hdr_value split into atoms* - //$atom: A single atom to encode.* - //$hdr_value_out: The recombined $hdr_val-atoms, or the encoded string. - //Note: Atom as specified here is not exactly the same as an RFC822 atom, - //as $atom's may contain just a single space. - - $useIconv = true; - if (isset($build_params['ignore-iconv'])) { - $useIconv = !$build_params['ignore-iconv']; - } + foreach ($input as $hdr_name => $hdr_value) { - /* - $parts = preg_split('/([ ])/', $hdr_value, -1, PREG_SPLIT_DELIM_CAPTURE); - $atoms = array(); - foreach ($parts as $part){ - $atom .= $part; - $quoteMatch = preg_match_all('|"|', $atom, $matches) % 2; - if (!$quoteMatch){ - $atoms[] = $atom; - $atom = null; + if (is_array($hdr_value)) { + foreach ($hdr_value as $idx => $value) { + $input[$hdr_name][$idx] = $this->encodeHeader( + $hdr_name, $value, + $build_params['head_charset'], $build_params['head_encoding'] + ); } + } else { + $input[$hdr_name] = $this->encodeHeader( + $hdr_name, $hdr_value, + $build_params['head_charset'], $build_params['head_encoding'] + ); } - if ($atom){ - $atoms[] = $atom; - } - foreach ($atoms as $atom){ - */ - if (preg_match('#([\x80-\xFF]){1}#', $hdr_value)) { - if (function_exists('iconv_mime_encode') && $useIconv) { - $imePrefs = array(); - if ($build_params['head_encoding'] == 'base64') { - $imePrefs['scheme'] = 'B'; - } else { - $imePrefs['scheme'] = 'Q'; - } - $imePrefs['input-charset'] = $build_params['head_charset']; - $imePrefs['output-charset'] = $build_params['head_charset']; - $imePrefs['line-length'] = 74; - $imePrefs['line-break-chars'] = "\r\n"; //Specified in RFC2047 - - $hdr_value = iconv_mime_encode($hdr_name, $hdr_value, $imePrefs); - $hdr_value = preg_replace("#^{$hdr_name}\:\ #", "", $hdr_value); - } elseif ($build_params['head_encoding'] == 'base64') { - //Base64 encoding has been selected. - //Base64 encode the entire string - $hdr_value = base64_encode($hdr_value); - - //Generate the header using the specified params and dynamicly - //determine the maximum length of such strings. - //75 is the value specified in the RFC. The first -2 is there so - //the later regexp doesn't break any of the translated chars. - //The -2 on the first line-regexp is to compensate for the ": " - //between the header-name and the header value - $prefix = '=?' . $build_params['head_charset'] . '?B?'; - $suffix = '?='; - $maxLength = 75 - strlen($prefix . $suffix) - 2; - $maxLength1stLine = $maxLength - strlen($hdr_name) - 2; - - //We can cut base4 every 4 characters, so the real max - //we can get must be rounded down. - $maxLength = $maxLength - ($maxLength % 4); - $maxLength1stLine = $maxLength1stLine - ($maxLength1stLine % 4); - - $cutpoint = $maxLength1stLine; - $hdr_value_out = $hdr_value; - $output = ""; - while ($hdr_value_out) { - //Split translated string at every $maxLength - $part = substr($hdr_value_out, 0, $cutpoint); - $hdr_value_out = substr($hdr_value_out, $cutpoint); - $cutpoint = $maxLength; - //RFC 2047 specifies that any split header should - //be seperated by a CRLF SPACE. - if ($output) { - $output .= "\r\n "; - } - $output .= $prefix . $part . $suffix; - } - $hdr_value = $output; - } else { - //quoted-printable encoding has been selected - - //Fix for Bug #10298, Ota Mares <om@viazenetti.de> - //Check if there is a double quote at beginning or end of - //the string to prevent that an open or closing quote gets - //ignored because it is encapsuled by an encoding pre/suffix. - //Remove the double quote and set the specific prefix or - //suffix variable so that we can concat the encoded string and - //the double quotes back together to get the intended string. - $quotePrefix = $quoteSuffix = ''; - if ($hdr_value{0} == '"') { - $hdr_value = substr($hdr_value, 1); - $quotePrefix = '"'; - } - if ($hdr_value{strlen($hdr_value)-1} == '"') { - $hdr_value = substr($hdr_value, 0, -1); - $quoteSuffix = '"'; - } - - //Generate the header using the specified params and dynamicly - //determine the maximum length of such strings. - //75 is the value specified in the RFC. The -2 is there so - //the later regexp doesn't break any of the translated chars. - //The -2 on the first line-regexp is to compensate for the ": " - //between the header-name and the header value - $prefix = '=?' . $build_params['head_charset'] . '?Q?'; - $suffix = '?='; - $maxLength = 75 - strlen($prefix . $suffix) - 2 - 1; - $maxLength1stLine = $maxLength - strlen($hdr_name) - 2; - $maxLength = $maxLength - 1; - - //Replace all special characters used by the encoder. - $search = array('=', '_', '?', ' '); - $replace = array('=3D', '=5F', '=3F', '_'); - $hdr_value = str_replace($search, $replace, $hdr_value); - - //Replace all extended characters (\x80-xFF) with their - //ASCII values. - $hdr_value = preg_replace('#([\x80-\xFF])#e', - '"=" . strtoupper(dechex(ord("\1")))', - $hdr_value); - - //This regexp will break QP-encoded text at every $maxLength - //but will not break any encoded letters. - $reg1st = "|(.{0,$maxLength1stLine}[^\=][^\=])|"; - $reg2nd = "|(.{0,$maxLength}[^\=][^\=])|"; - //Fix for Bug #10298, Ota Mares <om@viazenetti.de> - //Concat the double quotes and encoded string together - $hdr_value = $quotePrefix . $hdr_value . $quoteSuffix; - - - $hdr_value_out = $hdr_value; - $realMax = $maxLength1stLine + strlen($prefix . $suffix); - if (strlen($hdr_value_out) >= $realMax) { - //Begin with the regexp for the first line. - $reg = $reg1st; - $output = ""; - while ($hdr_value_out) { - //Split translated string at every $maxLength - //But make sure not to break any translated chars. - $found = preg_match($reg, $hdr_value_out, $matches); - - //After this first line, we need to use a different - //regexp for the first line. - $reg = $reg2nd; - - //Save the found part and encapsulate it in the - //prefix & suffix. Then remove the part from the - //$hdr_value_out variable. - if ($found) { - $part = $matches[0]; - $len = strlen($matches[0]); - $hdr_value_out = substr($hdr_value_out, $len); - } else { - $part = $hdr_value_out; - $hdr_value_out = ""; - } - - //RFC 2047 specifies that any split header should - //be seperated by a CRLF SPACE - if ($output) { - $output .= "\r\n "; - } - $output .= $prefix . $part . $suffix; - } - $hdr_value_out = $output; - } else { - $hdr_value_out = $prefix . $hdr_value_out . $suffix; - } - $hdr_value = $hdr_value_out; - } - } - $input[$hdr_name] = $hdr_value; } + return $input; } /** - * Set the object's end-of-line and define the constant if applicable. + * Encodes a header as per RFC2047 * - * @param string $eol End Of Line sequence + * @param string $name The header name + * @param string $value The header data to encode + * @param string $charset Character set name + * @param string $encoding Encoding name (base64 or quoted-printable) * - * @return void - * @access private + * @return string Encoded header data (without a name) + * @access public + * @since 1.5.3 */ - function _setEOL($eol) + function encodeHeader($name, $value, $charset, $encoding) { - $this->_eol = $eol; - if (!defined('MAIL_MIME_CRLF')) { - define('MAIL_MIME_CRLF', $this->_eol, true); - } + return Mail_mimePart::encodeHeader( + $name, $value, $charset, $encoding, $this->_build_params['eol'] + ); } /** * Get file's basename (locale independent) * - * @param string Filename + * @param string $filename Filename * - * @return string Basename + * @return string Basename * @access private */ function _basename($filename) { - // basename() is not unicode safe and locale dependent - if (stristr(PHP_OS, 'win') || stristr(PHP_OS, 'netware')) - return preg_replace('/^.*[\\\\\\/]/', '', $filename); - else - return preg_replace('/^.*[\/]/', '', $filename); + // basename() is not unicode safe and locale dependent + if (stristr(PHP_OS, 'win') || stristr(PHP_OS, 'netware')) { + return preg_replace('/^.*[\\\\\\/]/', '', $filename); + } else { + return preg_replace('/^.*[\/]/', '', $filename); + } + } + + /** + * Get Content-Type and Content-Transfer-Encoding headers of the message + * + * @return array Headers array + * @access private + */ + function _contentHeaders() + { + $attachments = count($this->_parts) ? true : false; + $html_images = count($this->_html_images) ? true : false; + $html = strlen($this->_htmlbody) ? true : false; + $text = (!$html && strlen($this->_txtbody)) ? true : false; + $headers = array(); + + // See get() + switch (true) { + case $text && !$attachments: + $headers['Content-Type'] = 'text/plain'; + break; + + case !$text && !$html && $attachments: + case $text && $attachments: + case $html && $attachments && !$html_images: + case $html && $attachments && $html_images: + $headers['Content-Type'] = 'multipart/mixed'; + break; + + case $html && !$attachments && !$html_images && isset($this->_txtbody): + case $html && !$attachments && $html_images && isset($this->_txtbody): + $headers['Content-Type'] = 'multipart/alternative'; + break; + + case $html && !$attachments && !$html_images && !isset($this->_txtbody): + $headers['Content-Type'] = 'text/html'; + break; + + case $html && !$attachments && $html_images && !isset($this->_txtbody): + $headers['Content-Type'] = 'multipart/related'; + break; + + default: + return $headers; + } + + $this->_checkParams(); + + $eol = !empty($this->_build_params['eol']) + ? $this->_build_params['eol'] : "\r\n"; + + if ($headers['Content-Type'] == 'text/plain') { + // single-part message: add charset and encoding + $charset = 'charset=' . $this->_build_params['text_charset']; + // place charset parameter in the same line, if possible + // 26 = strlen("Content-Type: text/plain; ") + $headers['Content-Type'] + .= (strlen($charset) + 26 <= 76) ? "; $charset" : ";$eol $charset"; + $headers['Content-Transfer-Encoding'] + = $this->_build_params['text_encoding']; + } else if ($headers['Content-Type'] == 'text/html') { + // single-part message: add charset and encoding + $charset = 'charset=' . $this->_build_params['html_charset']; + // place charset parameter in the same line, if possible + $headers['Content-Type'] + .= (strlen($charset) + 25 <= 76) ? "; $charset" : ";$eol $charset"; + $headers['Content-Transfer-Encoding'] + = $this->_build_params['html_encoding']; + } else { + // multipart message: and boundary + if (!empty($this->_build_params['boundary'])) { + $boundary = $this->_build_params['boundary']; + } else if (!empty($this->_headers['Content-Type']) + && preg_match('/boundary="([^"]+)"/', $this->_headers['Content-Type'], $m) + ) { + $boundary = $m[1]; + } else { + $boundary = '=_' . md5(rand() . microtime()); + } + + $this->_build_params['boundary'] = $boundary; + $headers['Content-Type'] .= ";$eol boundary=\"$boundary\""; + } + + return $headers; + } + + /** + * Validate and set build parameters + * + * @return void + * @access private + */ + function _checkParams() + { + $encodings = array('7bit', '8bit', 'base64', 'quoted-printable'); + + $this->_build_params['text_encoding'] + = strtolower($this->_build_params['text_encoding']); + $this->_build_params['html_encoding'] + = strtolower($this->_build_params['html_encoding']); + + if (!in_array($this->_build_params['text_encoding'], $encodings)) { + $this->_build_params['text_encoding'] = '7bit'; + } + if (!in_array($this->_build_params['html_encoding'], $encodings)) { + $this->_build_params['html_encoding'] = '7bit'; + } + + // text body + if ($this->_build_params['text_encoding'] == '7bit' + && !preg_match('/ascii/i', $this->_build_params['text_charset']) + && preg_match('/[^\x00-\x7F]/', $this->_txtbody) + ) { + $this->_build_params['text_encoding'] = 'quoted-printable'; + } + // html body + if ($this->_build_params['html_encoding'] == '7bit' + && !preg_match('/ascii/i', $this->_build_params['html_charset']) + && preg_match('/[^\x00-\x7F]/', $this->_htmlbody) + ) { + $this->_build_params['html_encoding'] = 'quoted-printable'; + } } } // End of class -- Gitblit v1.9.1