From f06aa8058b7e32ba32d4551074b6e0b8a300f751 Mon Sep 17 00:00:00 2001
From: Thomas Bruederli <thomas@roundcube.net>
Date: Mon, 21 Oct 2013 15:02:40 -0400
Subject: [PATCH] Bump version after security fix

---
 program/js/list.js |  323 ++++++++++++++++++++++++++++++-----------------------
 1 files changed, 185 insertions(+), 138 deletions(-)

diff --git a/program/js/list.js b/program/js/list.js
index 22c8080..f101804 100644
--- a/program/js/list.js
+++ b/program/js/list.js
@@ -3,8 +3,11 @@
  | Roundcube List Widget                                                 |
  |                                                                       |
  | This file is part of the Roundcube Webmail client                     |
- | Copyright (C) 2006-2009, Roundcube Dev, - Switzerland                 |
- | Licensed under the GNU GPL                                            |
+ | Copyright (C) 2006-2009, The Roundcube Dev Team                       |
+ |                                                                       |
+ | Licensed under the GNU General Public License version 3 or            |
+ | any later version with exceptions for skins & plugins.                |
+ | See the README file for a full license statement.                     |
  |                                                                       |
  +-----------------------------------------------------------------------+
  | Authors: Thomas Bruederli <roundcube@gmail.com>                       |
@@ -36,7 +39,7 @@
   this.colcount = 0;
 
   this.subject_col = -1;
-  this.shiftkey = false;
+  this.modkey = 0;
   this.multiselect = false;
   this.multiexpand = false;
   this.multi_selecting = false;
@@ -58,7 +61,7 @@
   this.row_init = function(){};
 
   // overwrite default paramaters
-  if (p && typeof(p) == 'object')
+  if (p && typeof p === 'object')
     for (var n in p)
       this[n] = p[n];
 };
@@ -87,10 +90,8 @@
     this.frame = this.list.parentNode;
 
     // set body events
-    if (this.keyboard) {
-      rcube_event.add_listener({event:bw.opera?'keypress':'keydown', object:this, method:'key_press'});
-      rcube_event.add_listener({event:'keydown', object:this, method:'key_down'});
-    }
+    if (this.keyboard)
+      rcube_event.add_listener({event:'keydown', object:this, method:'key_press'});
   }
 },
 
@@ -101,16 +102,16 @@
 init_row: function(row)
 {
   // make references in internal array and set event handlers
-  if (row && String(row.id).match(/rcmrow([a-z0-9\-_=\+\/]+)/i)) {
-    var self = this;
-    var uid = RegExp.$1;
+  if (row && String(row.id).match(/^rcmrow([a-z0-9\-_=\+\/]+)/i)) {
+    var self = this,
+      uid = RegExp.$1;
     row.uid = uid;
     this.rows[uid] = {uid:uid, id:row.id, obj:row};
 
     // set eventhandlers to table row
     row.onmousedown = function(e){ return self.drag_row(e, this.uid); };
     row.onmouseup = function(e){ return self.click_row(e, this.uid); };
-    
+
     if (bw.iphone || bw.ipad) {
       row.addEventListener('touchstart', function(e) {
         if (e.touches.length == 1) {
@@ -170,6 +171,10 @@
 
   if (sel)
     this.clear_selection();
+
+  // reset scroll position (in Opera)
+  if (this.frame)
+    this.frame.scrollTop = 0;
 },
 
 
@@ -178,8 +183,12 @@
  */
 remove_row: function(uid, sel_next)
 {
-  if (this.rows[uid].obj)
-    this.rows[uid].obj.style.display = 'none';
+  var obj = this.rows[uid] ? this.rows[uid].obj : null;
+
+  if (!obj)
+    return;
+
+  obj.style.display = 'none';
 
   if (sel_next)
     this.select_next();
@@ -212,14 +221,19 @@
  */
 focus: function(e)
 {
-  var id;
+  var n, id;
   this.focused = true;
-  for (var n in this.selection) {
+
+  for (n in this.selection) {
     id = this.selection[n];
     if (this.rows[id] && this.rows[id].obj) {
       $(this.rows[id].obj).addClass('selected').removeClass('unfocused');
     }
   }
+
+  // Un-focus already focused elements (#1487123, #1487316, #1488600, #1488620)
+  $(':focus:not(body)').blur();
+  $('iframe').each(function() { this.blur(); });
 
   if (e || (e = window.event))
     rcube_event.cancel(e);
@@ -231,12 +245,12 @@
  */
 blur: function()
 {
-  var id;
+  var n, id;
   this.focused = false;
-  for (var n in this.selection) {
+  for (n in this.selection) {
     id = this.selection[n];
     if (this.rows[id] && this.rows[id].obj) {
-      $(this.rows[id].obj).removeClass('selected').addClass('unfocused');
+      $(this.rows[id].obj).removeClass('selected focused').addClass('unfocused');
     }
   }
 },
@@ -341,8 +355,10 @@
   this.in_selection_before = false;
 
   // row was double clicked
-  if (this.rows && dblclicked && this.in_selection(id))
+  if (this.rows && dblclicked && this.in_selection(id)) {
     this.triggerEvent('dblclick');
+    now = 0;
+  }
   else
     this.triggerEvent('click');
 
@@ -401,7 +417,7 @@
 collapse: function(row)
 {
   row.expanded = false;
-  this.triggerEvent('expandcollapse', { uid:row.uid, expanded:row.expanded });
+  this.triggerEvent('expandcollapse', { uid:row.uid, expanded:row.expanded, obj:row.obj });
   var depth = row.depth;
   var new_row = row ? row.obj.nextSibling : null;
   var r;
@@ -414,7 +430,7 @@
       $(new_row).css('display', 'none');
       if (r.expanded) {
         r.expanded = false;
-        this.triggerEvent('expandcollapse', { uid:r.uid, expanded:r.expanded });
+        this.triggerEvent('expandcollapse', { uid:r.uid, expanded:r.expanded, obj:new_row });
       }
     }
     new_row = new_row.nextSibling;
@@ -425,15 +441,14 @@
 
 expand: function(row)
 {
-  var depth, new_row;
-  var last_expanded_parent_depth;
+  var r, p, depth, new_row, last_expanded_parent_depth;
 
   if (row) {
     row.expanded = true;
     depth = row.depth;
     new_row = row.obj.nextSibling;
     this.update_expando(row.uid, true);
-    this.triggerEvent('expandcollapse', { uid:row.uid, expanded:row.expanded });
+    this.triggerEvent('expandcollapse', { uid:row.uid, expanded:row.expanded, obj:row.obj });
   }
   else {
     var tbody = this.list.tBodies[0];
@@ -444,19 +459,19 @@
 
   while (new_row) {
     if (new_row.nodeType == 1) {
-      var r = this.rows[new_row.uid];
+      r = this.rows[new_row.uid];
       if (r) {
         if (row && (!r.depth || r.depth <= depth))
           break;
 
         if (r.parent_uid) {
-          var p = this.rows[r.parent_uid];
+          p = this.rows[r.parent_uid];
           if (p && p.expanded) {
             if ((row && p == row) || last_expanded_parent_depth >= p.depth - 1) {
               last_expanded_parent_depth = p.depth;
               $(new_row).css('display', '');
               r.expanded = true;
-              this.triggerEvent('expandcollapse', { uid:r.uid, expanded:r.expanded });
+              this.triggerEvent('expandcollapse', { uid:r.uid, expanded:r.expanded, obj:new_row });
             }
           }
           else
@@ -481,7 +496,7 @@
     depth = row.depth;
     new_row = row.obj.nextSibling;
     this.update_expando(row.uid);
-    this.triggerEvent('expandcollapse', { uid:row.uid, expanded:row.expanded });
+    this.triggerEvent('expandcollapse', { uid:row.uid, expanded:row.expanded, obj:row.obj });
 
     // don't collapse sub-root tree in multiexpand mode 
     if (depth && this.multiexpand)
@@ -503,7 +518,7 @@
         if (r.has_children && r.expanded) {
           r.expanded = false;
           this.update_expando(r.uid, false);
-          this.triggerEvent('expandcollapse', { uid:r.uid, expanded:r.expanded });
+          this.triggerEvent('expandcollapse', { uid:r.uid, expanded:r.expanded, obj:new_row });
         }
       }
     }
@@ -512,6 +527,7 @@
 
   return false;
 },
+
 
 expand_all: function(row)
 {
@@ -522,7 +538,7 @@
     depth = row.depth;
     new_row = row.obj.nextSibling;
     this.update_expando(row.uid, true);
-    this.triggerEvent('expandcollapse', { uid:row.uid, expanded:row.expanded });
+    this.triggerEvent('expandcollapse', { uid:row.uid, expanded:row.expanded, obj:row.obj });
   }
   else {
     new_row = this.list.tBodies[0].firstChild;
@@ -539,7 +555,7 @@
         if (r.has_children && !r.expanded) {
           r.expanded = true;
           this.update_expando(r.uid, true);
-          this.triggerEvent('expandcollapse', { uid:r.uid, expanded:r.expanded });
+          this.triggerEvent('expandcollapse', { uid:r.uid, expanded:r.expanded, obj:new_row });
         }
       }
     }
@@ -547,6 +563,7 @@
   }
   return false;
 },
+
 
 update_expando: function(uid, expanded)
 {
@@ -593,8 +610,8 @@
     var i, len, rows = this.list.tBodies[0].rows;
 
     for (i=0, len=rows.length-1; i<len; i++)
-      if (rows[i].id && String(rows[i].id).match(/rcmrow([a-z0-9\-_=\+\/]+)/i) && this.rows[RegExp.$1] != null)
-	    return RegExp.$1;
+      if (rows[i].id && String(rows[i].id).match(/^rcmrow([a-z0-9\-_=\+\/]+)/i) && this.rows[RegExp.$1] != null)
+        return RegExp.$1;
   }
 
   return null;
@@ -606,7 +623,7 @@
     var i, rows = this.list.tBodies[0].rows;
 
     for (i=rows.length-1; i>=0; i--)
-      if (rows[i].id && String(rows[i].id).match(/rcmrow([a-z0-9\-_=\+\/]+)/i) && this.rows[RegExp.$1] != null)
+      if (rows[i].id && String(rows[i].id).match(/^rcmrow([a-z0-9\-_=\+\/]+)/i) && this.rows[RegExp.$1] != null)
         return RegExp.$1;
   }
 
@@ -640,7 +657,7 @@
       case CONTROL_KEY:
         if (!with_mouse)
           this.highlight_row(id, true);
-        break; 
+        break;
 
       case CONTROL_SHIFT_KEY:
         this.shift_select(id, true);
@@ -691,11 +708,12 @@
  */
 select_next: function()
 {
-  var next_row = this.get_next_row();
-  var prev_row = this.get_prev_row();
-  var new_row = (next_row) ? next_row : prev_row;
+  var next_row = this.get_next_row(),
+    prev_row = this.get_prev_row(),
+    new_row = (next_row) ? next_row : prev_row;
+
   if (new_row)
-    this.select_row(new_row.uid, false, false);  
+    this.select_row(new_row.uid, false, false);
 },
 
 
@@ -705,53 +723,48 @@
 select_first: function(mod_key)
 {
   var row = this.get_first_row();
-  if (row && mod_key) {
-    this.shift_select(row, mod_key);
-    this.triggerEvent('select');
-    this.scrollto(row);
+  if (row) {
+    if (mod_key) {
+      this.shift_select(row, mod_key);
+      this.triggerEvent('select');
+      this.scrollto(row);
+    }
+    else {
+      this.select(row);
+    }
   }
-  else if (row)
-    this.select(row);
 },
 
 
 /**
- * Select last row 
+ * Select last row
  */
 select_last: function(mod_key)
 {
   var row = this.get_last_row();
-  if (row && mod_key) {
-    this.shift_select(row, mod_key);
-    this.triggerEvent('select');
-    this.scrollto(row);    
+  if (row) {
+    if (mod_key) {
+      this.shift_select(row, mod_key);
+      this.triggerEvent('select');
+      this.scrollto(row);
+    }
+    else {
+      this.select(row);
+    }
   }
-  else if (row)
-    this.select(row);
 },
 
 
 /**
  * Add all childs of the given row to selection
  */
-select_childs: function(uid)
+select_children: function(uid)
 {
-  if (!this.rows[uid] || !this.rows[uid].has_children)
-    return;
+  var i, children = this.row_children(uid), len = children.length;
 
-  var depth = this.rows[uid].depth;
-  var row = this.rows[uid].obj.nextSibling;
-  while (row) {
-    if (row.nodeType == 1) {
-      if ((r = this.rows[row.uid])) {
-        if (!r.depth || r.depth <= depth)
-          break;
-        if (!this.in_selection(r.uid))
-          this.select_row(r.uid, CONTROL_KEY);
-      }
-    }
-    row = row.nextSibling;
-  }
+  for (i=0; i<len; i++)
+    if (!this.in_selection(children[i]))
+      this.select_row(children[i], CONTROL_KEY);
 },
 
 
@@ -763,20 +776,20 @@
   if (!this.rows[this.shift_start] || !this.selection.length)
     this.shift_start = id;
 
-  var from_rowIndex = this.rows[this.shift_start].obj.rowIndex,
+  var n, from_rowIndex = this.rows[this.shift_start].obj.rowIndex,
     to_rowIndex = this.rows[id].obj.rowIndex,
     i = ((from_rowIndex < to_rowIndex)? from_rowIndex : to_rowIndex),
     j = ((from_rowIndex > to_rowIndex)? from_rowIndex : to_rowIndex);
 
   // iterate through the entire message list
-  for (var n in this.rows) {
+  for (n in this.rows) {
     if (this.rows[n].obj.rowIndex >= i && this.rows[n].obj.rowIndex <= j) {
       if (!this.in_selection(n)) {
         this.highlight_row(n, true);
       }
     }
     else {
-      if  (this.in_selection(n) && !control) {
+      if (this.in_selection(n) && !control) {
         this.highlight_row(n, true);
       }
     }
@@ -789,7 +802,7 @@
  */
 in_selection: function(id)
 {
-  for(var n in this.selection)
+  for (var n in this.selection)
     if (this.selection[n]==id)
       return true;
 
@@ -806,10 +819,10 @@
     return false;
 
   // reset but remember selection first
-  var select_before = this.selection.join(',');
+  var n, select_before = this.selection.join(',');
   this.selection = [];
 
-  for (var n in this.rows) {
+  for (n in this.rows) {
     if (!filter || this.rows[n][filter] == true) {
       this.last_selected = n;
       this.highlight_row(n, true);
@@ -838,9 +851,9 @@
     return false;
 
   // remember old selection
-  var select_before = this.selection.join(',');
+  var n, select_before = this.selection.join(',');
 
-  for (var n in this.rows)
+  for (n in this.rows)
     this.highlight_row(n, true);
 
   // trigger event if selection changed
@@ -858,11 +871,11 @@
  */
 clear_selection: function(id)
 {
-  var num_select = this.selection.length;
+  var n, num_select = this.selection.length;
 
   // one row
   if (id) {
-    for (var n=0 in this.selection)
+    for (n in this.selection)
       if (this.selection[n] == id) {
         this.selection.splice(n,1);
         break;
@@ -870,7 +883,7 @@
   }
   // all rows
   else {
-    for (var n in this.selection)
+    for (n in this.selection)
       if (this.rows[this.selection[n]]) {
         $(this.rows[this.selection[n]].obj).removeClass('selected').removeClass('unfocused');
       }
@@ -909,25 +922,49 @@
  */
 highlight_row: function(id, multiple)
 {
-  if (this.rows[id] && !multiple) {
+  if (!this.rows[id])
+    return;
+
+  if (!multiple) {
     if (this.selection.length > 1 || !this.in_selection(id)) {
       this.clear_selection();
       this.selection[0] = id;
       $(this.rows[id].obj).addClass('selected');
     }
   }
-  else if (this.rows[id]) {
+  else {
     if (!this.in_selection(id)) { // select row
-      this.selection[this.selection.length] = id;
+      this.selection.push(id);
       $(this.rows[id].obj).addClass('selected');
+      if (!this.rows[id].expanded)
+        this.highlight_children(id, true);
     }
     else { // unselect row
-      var p = $.inArray(id, this.selection);
-      var a_pre = this.selection.slice(0, p);
-      var a_post = this.selection.slice(p+1, this.selection.length);
+      var p = $.inArray(id, this.selection),
+        a_pre = this.selection.slice(0, p),
+        a_post = this.selection.slice(p+1, this.selection.length);
+
       this.selection = a_pre.concat(a_post);
       $(this.rows[id].obj).removeClass('selected').removeClass('unfocused');
+      if (!this.rows[id].expanded)
+        this.highlight_children(id, false);
     }
+  }
+},
+
+
+/**
+ * Highlight/unhighlight all childs of the given row
+ */
+highlight_children: function(id, status)
+{
+  var i, selected,
+    children = this.row_children(id), len = children.length;
+
+  for (i=0; i<len; i++) {
+    selected = this.in_selection(children[i]);
+    if ((status && !selected) || (!status && selected))
+      this.highlight_row(children[i], true);
   }
 },
 
@@ -937,15 +974,16 @@
  */
 key_press: function(e)
 {
-  if (this.focused != true)
+  var target = e.target || {};
+  if (this.focused != true || target.nodeName == 'INPUT' || target.nodeName == 'TEXTAREA' || target.nodeName == 'SELECT')
     return true;
 
-  var keyCode = rcube_event.get_keycode(e);
-  var mod_key = rcube_event.get_modifier(e);
+  var keyCode = rcube_event.get_keycode(e),
+    mod_key = rcube_event.get_modifier(e);
 
   switch (keyCode) {
     case 40:
-    case 38: 
+    case 38:
     case 63233: // "down", in safari keypress
     case 63232: // "up", in safari keypress
       // Stop propagation so that the browser doesn't scroll
@@ -959,7 +997,9 @@
       rcube_event.cancel(e);
       var ret = this.use_plusminus_key(keyCode, mod_key);
       this.key_pressed = keyCode;
+      this.modkey = mod_key;
       this.triggerEvent('keypress');
+      this.modkey = 0;
       return ret;
     case 36: // Home
       this.select_first(mod_key);
@@ -967,44 +1007,22 @@
     case 35: // End
       this.select_last(mod_key);
       return rcube_event.cancel(e);
+    case 27:
+      if (this.drag_active)
+        return this.drag_mouse_up(e);
+      if (this.col_drag_active) {
+        this.selected_column = null;
+        return this.column_drag_mouse_up(e);
+      }
+      return rcube_event.cancel(e);
     default:
-      this.shiftkey = e.shiftKey;
       this.key_pressed = keyCode;
+      this.modkey = mod_key;
       this.triggerEvent('keypress');
+      this.modkey = 0;
 
       if (this.key_pressed == this.BACKSPACE_KEY)
         return rcube_event.cancel(e);
-  }
-
-  return true;
-},
-
-/**
- * Handler for keydown events
- */
-key_down: function(e)
-{
-  switch (rcube_event.get_keycode(e)) {
-    case 27:
-      if (this.drag_active)
-	    return this.drag_mouse_up(e);
-      if (this.col_drag_active) {
-        this.selected_column = null;
-	    return this.column_drag_mouse_up(e);
-      }
-
-    case 40:
-    case 38: 
-    case 63233:
-    case 63232:
-    case 61:
-    case 107:
-    case 109:
-    case 32:
-      if (!rcube_event.get_modifier(e) && this.focused)
-        return rcube_event.cancel(e);
-
-    default:
   }
 
   return true;
@@ -1025,7 +1043,7 @@
     new_row = this.get_prev_row();
 
   if (new_row) {
-    this.select_row(new_row.uid, mod_key, true);
+    this.select_row(new_row.uid, mod_key, false);
     this.scrollto(new_row.uid);
   }
 
@@ -1097,7 +1115,7 @@
     else
       return rcube_event.cancel(e);
   }
-  
+
   if (this.drag_start) {
     // check mouse movement, of less than 3 pixels, don't start dragging
     var m = rcube_event.get_mouse_pos(e);
@@ -1114,17 +1132,19 @@
     var n, uid, selection = $.merge([], this.selection);
     for (n in selection) {
       uid = selection[n];
-      if (this.rows[uid].has_children && !this.rows[uid].expanded)
-        this.select_childs(uid);
+      if (!this.rows[uid].expanded)
+        this.select_children(uid);
     }
 
+    // reset content
+    this.draglayer.html('');
+
     // get subjects of selected messages
-    var names = '';
-    var c, i, subject, obj;
-    for (var n=0; n<this.selection.length; n++) {
+    var c, i, n, subject, obj;
+    for (n=0; n<this.selection.length; n++) {
       // only show 12 lines
       if (n>12) {
-        names += '...';
+        this.draglayer.append('...');
         break;
       }
 
@@ -1137,7 +1157,7 @@
 	          this.drag_start_pos = $(obj.childNodes[i]).offset();
 
 	        if (this.subject_col < 0 || (this.subject_col >= 0 && this.subject_col == c)) {
-	          var node, tmp_node, nodes = obj.childNodes[i].childNodes;
+	          var entry, node, tmp_node, nodes = obj.childNodes[i].childNodes;
 	          // find text node
 	          for (m=0; m<nodes.length; m++) {
 	            if ((tmp_node = obj.childNodes[i].childNodes[m]) && (tmp_node.nodeType==3 || tmp_node.nodeName=='A'))
@@ -1147,11 +1167,14 @@
 	          if (!node)
 	            break;
 
-              subject = node.nodeType==3 ? node.data : node.innerHTML;
+              subject = $(node).text();
 	          // remove leading spaces
-	          subject = subject.replace(/^\s+/i, '');
+              subject = $.trim(subject);
               // truncate line to 50 characters
-	          names += (subject.length > 50 ? subject.substring(0, 50)+'...' : subject) + '<br />';
+              subject = (subject.length > 50 ? subject.substring(0, 50) + '...' : subject);
+
+              entry = $('<div>').text(subject);
+	          this.draglayer.append(entry);
               break;
             }
             c++;
@@ -1160,9 +1183,7 @@
       }
     }
 
-    this.draglayer.html(names);
     this.draglayer.show();
-
     this.drag_active = true;
     this.triggerEvent('dragstart');
   }
@@ -1333,6 +1354,32 @@
 
 
 /**
+ * Returns IDs of all rows in a thread (except root) for specified root
+ */
+row_children: function(uid)
+{
+  if (!this.rows[uid] || !this.rows[uid].has_children)
+    return [];
+
+  var res = [], depth = this.rows[uid].depth,
+    row = this.rows[uid].obj.nextSibling;
+
+  while (row) {
+    if (row.nodeType == 1) {
+      if ((r = this.rows[row.uid])) {
+        if (!r.depth || r.depth <= depth)
+          break;
+        res.push(r.uid);
+      }
+    }
+    row = row.nextSibling;
+  }
+
+  return res;
+},
+
+
+/**
  * Creates a layer for drag&drop over iframes
  */
 add_dragfix: function()
@@ -1363,7 +1410,7 @@
  */
 column_replace: function(from, to)
 {
-  var cells = this.list.tHead.rows[0].cells,
+  var len, cells = this.list.tHead.rows[0].cells,
     elem = cells[from],
     before = cells[to],
     td = document.createElement('td');
@@ -1376,7 +1423,7 @@
   cells[0].parentNode.replaceChild(elem, td);
 
   // replace list cells
-  for (r=0; r<this.list.tBodies[0].rows.length; r++) {
+  for (r=0, len=this.list.tBodies[0].rows.length; r<len; r++) {
     row = this.list.tBodies[0].rows[r];
 
     elem = row.cells[from];

--
Gitblit v1.9.1