From 4af76d20cafcd456bf3ce0fcb17b25a888c45160 Mon Sep 17 00:00:00 2001
From: Thomas <thomas@roundcube.net>
Date: Mon, 21 Oct 2013 15:14:46 -0400
Subject: [PATCH] Bump version
---
program/steps/settings/save_identity.inc | 132 ++++++++++++++++++++++++++++++--------------
1 files changed, 90 insertions(+), 42 deletions(-)
diff --git a/program/steps/settings/save_identity.inc b/program/steps/settings/save_identity.inc
index af0e6af..d3b132f 100644
--- a/program/steps/settings/save_identity.inc
+++ b/program/steps/settings/save_identity.inc
@@ -17,75 +17,90 @@
+-----------------------------------------------------------------------+
| Author: Thomas Bruederli <roundcube@gmail.com> |
+-----------------------------------------------------------------------+
-
- $Id$
-
*/
define('IDENTITIES_LEVEL', intval($RCMAIL->config->get('identities_level', 0)));
$a_save_cols = array('name', 'email', 'organization', 'reply-to', 'bcc', 'standard', 'signature', 'html_signature');
-$a_html_cols = array('signature', 'name', 'organization');
$a_boolean_cols = array('standard', 'html_signature');
$updated = $default_id = false;
// check input
-if (empty($_POST['_name']) || (empty($_POST['_email']) && IDENTITIES_LEVEL != 1 && IDENTITIES_LEVEL != 3))
-{
+if (IDENTITIES_LEVEL != 4 && (empty($_POST['_name']) || (empty($_POST['_email']) && IDENTITIES_LEVEL != 1 && IDENTITIES_LEVEL != 3))) {
$OUTPUT->show_message('formincomplete', 'warning');
rcmail_overwrite_action('edit-identity');
return;
}
-
$save_data = array();
-foreach ($a_save_cols as $col)
-{
+foreach ($a_save_cols as $col) {
$fname = '_'.$col;
if (isset($_POST[$fname]))
- $save_data[$col] = get_input_value($fname, RCUBE_INPUT_POST, in_array($col, $a_html_cols));
+ $save_data[$col] = get_input_value($fname, RCUBE_INPUT_POST, true);
}
// set "off" values for checkboxes that were not checked, and therefore
// not included in the POST body.
-foreach ($a_boolean_cols as $col)
-{
+foreach ($a_boolean_cols as $col) {
$fname = '_' . $col;
if (!isset($_POST[$fname]))
$save_data[$col] = 0;
}
// unset email address if user has no rights to change it
-if (IDENTITIES_LEVEL == 1 || IDENTITIES_LEVEL == 3)
+if (IDENTITIES_LEVEL == 1 || IDENTITIES_LEVEL == 3) {
unset($save_data['email']);
-
-// Validate e-mail addresses
-foreach (array('email', 'reply-to', 'bcc') as $item) {
- if ($email = $save_data[$item]) {
- $ascii_email = rcube_idn_to_ascii($email);
- if (!check_email($ascii_email)) {
- // show error message
- $OUTPUT->show_message('emailformaterror', 'error', array('email' => $email), false);
- rcmail_overwrite_action('edit-identity');
- return;
+}
+// unset all fields except signature
+else if (IDENTITIES_LEVEL == 4) {
+ foreach ($save_data as $idx => $value) {
+ if ($idx != 'signature' && $idx != 'html_signature') {
+ unset($save_data[$idx]);
}
}
}
+// Validate e-mail addresses
+$email_checks = array(rcube_idn_to_ascii($save_data['email']));
+foreach (array('reply-to', 'bcc') as $item) {
+ foreach (rcube_mime::decode_address_list($save_data[$item], null, false) as $rcpt)
+ $email_checks[] = rcube_idn_to_ascii($rcpt['mailto']);
+}
+
+foreach ($email_checks as $email) {
+ if ($email && !check_email($email)) {
+ // show error message
+ $OUTPUT->show_message('emailformaterror', 'error', array('email' => rcube_idn_to_utf8($email)), false);
+ rcmail_overwrite_action('edit-identity');
+ return;
+ }
+}
+
+// XSS protection in HTML signature (#1489251)
+if (!empty($save_data['signature']) && !empty($save_data['html_signature'])) {
+ $save_data['signature'] = rcmail_wash_html($save_data['signature']);
+
+ // clear POST data of signature, we want to use safe content
+ // when the form is displayed again
+ unset($_POST['_signature']);
+}
+
// update an existing contact
-if ($_POST['_iid'])
-{
+if ($_POST['_iid']) {
$iid = get_input_value('_iid', RCUBE_INPUT_POST);
+
+ if (in_array(IDENTITIES_LEVEL, array(1,3,4))) {
+ // merge with old identity data, fixes #1488834
+ $identity = $RCMAIL->user->get_identity($iid);
+ $save_data = array_merge($identity, $save_data);
+ unset($save_data['changed'], $save_data['del'], $save_data['user_id'], $save_data['identity_id']);
+ }
+
$plugin = $RCMAIL->plugins->exec_hook('identity_update', array('id' => $iid, 'record' => $save_data));
$save_data = $plugin['record'];
if ($save_data['email'])
$save_data['email'] = rcube_idn_to_ascii($save_data['email']);
- if ($save_data['bcc'])
- $save_data['bcc'] = rcube_idn_to_ascii($save_data['bcc']);
- if ($save_data['reply-to'])
- $save_data['reply-to'] = rcube_idn_to_ascii($save_data['reply-to']);
-
if (!$plugin['abort'])
$updated = $RCMAIL->user->update_identity($iid, $save_data);
else
@@ -94,8 +109,8 @@
if ($updated) {
$OUTPUT->show_message('successfullysaved', 'confirmation');
- if (!empty($_POST['_standard']))
- $default_id = get_input_value('_iid', RCUBE_INPUT_POST);
+ if (!empty($save_data['standard']))
+ $default_id = $iid;
if ($_POST['_framed']) {
// update the changed col in list
@@ -111,20 +126,16 @@
}
// insert a new identity record
-else if (IDENTITIES_LEVEL < 2)
-{
- if (IDENTITIES_LEVEL == 1)
- $save_data['email'] = $RCMAIL->user->get_username();
+else if (IDENTITIES_LEVEL < 2) {
+ if (IDENTITIES_LEVEL == 1) {
+ $save_data['email'] = $RCMAIL->get_user_email();
+ }
$plugin = $RCMAIL->plugins->exec_hook('identity_create', array('record' => $save_data));
$save_data = $plugin['record'];
if ($save_data['email'])
- $save_data['email'] = rcube_idn_to_ascii($save_data['email']);
- if ($save_data['bcc'])
- $save_data['bcc'] = rcube_idn_to_ascii($save_data['bcc']);
- if ($save_data['reply-to'])
- $save_data['reply-to'] = rcube_idn_to_ascii($save_data['reply-to']);
+ $save_data['email'] = rcube_idn_to_ascii($save_data['email']);
if (!$plugin['abort'])
$insert_id = $save_data['email'] ? $RCMAIL->user->insert_identity($save_data) : null;
@@ -136,7 +147,7 @@
$_GET['_iid'] = $insert_id;
- if (!empty($_POST['_standard']))
+ if (!empty($save_data['standard']))
$default_id = $insert_id;
if ($_POST['_framed']) {
@@ -165,3 +176,40 @@
}
else
rcmail_overwrite_action('identities');
+
+
+/**
+ * Sanity checks/cleanups on HTML body of signature
+ */
+function rcmail_wash_html($html)
+{
+ // Add header with charset spec., washtml cannot work without that
+ $html = '<html><head>'
+ . '<meta http-equiv="Content-Type" content="text/html; charset='.RCMAIL_CHARSET.'" />'
+ . '</head><body>' . $html . '</body></html>';
+
+ // clean HTML with washhtml by Frederic Motte
+ $wash_opts = array(
+ 'show_washed' => false,
+ 'allow_remote' => 1,
+ 'charset' => RCMAIL_CHARSET,
+ 'html_elements' => array('body', 'link'),
+ 'html_attribs' => array('rel', 'type'),
+ );
+
+ // initialize HTML washer
+ $washer = new rcube_washtml($wash_opts);
+
+ //$washer->add_callback('form', 'rcmail_washtml_callback');
+ //$washer->add_callback('style', 'rcmail_washtml_callback');
+
+ // Remove non-UTF8 characters (#1487813)
+ $html = rc_utf8_clean($html);
+
+ $html = $washer->wash($html);
+
+ // remove unwanted comments and tags (produced by washtml)
+ $html = preg_replace(array('/<!--[^>]+-->/', '/<\/?body>/'), '', $html);
+
+ return $html;
+}
--
Gitblit v1.9.1