From 4af76d20cafcd456bf3ce0fcb17b25a888c45160 Mon Sep 17 00:00:00 2001
From: Thomas <thomas@roundcube.net>
Date: Mon, 21 Oct 2013 15:14:46 -0400
Subject: [PATCH] Bump version

---
 program/steps/settings/save_identity.inc |   92 +++++++++++++++++++++++++++++++++++++--------
 1 files changed, 75 insertions(+), 17 deletions(-)

diff --git a/program/steps/settings/save_identity.inc b/program/steps/settings/save_identity.inc
index 7ca54a1..d3b132f 100644
--- a/program/steps/settings/save_identity.inc
+++ b/program/steps/settings/save_identity.inc
@@ -26,17 +26,14 @@
 $updated = $default_id = false;
 
 // check input
-if (IDENTITIES_LEVEL != 4 && (empty($_POST['_name']) || (empty($_POST['_email']) && IDENTITIES_LEVEL != 1 && IDENTITIES_LEVEL != 3)))
-{
+if (IDENTITIES_LEVEL != 4 && (empty($_POST['_name']) || (empty($_POST['_email']) && IDENTITIES_LEVEL != 1 && IDENTITIES_LEVEL != 3))) {
   $OUTPUT->show_message('formincomplete', 'warning');
   rcmail_overwrite_action('edit-identity');
   return;
 }
 
-
 $save_data = array();
-foreach ($a_save_cols as $col)
-{
+foreach ($a_save_cols as $col) {
   $fname = '_'.$col;
   if (isset($_POST[$fname]))
     $save_data[$col] = get_input_value($fname, RCUBE_INPUT_POST, true);
@@ -44,16 +41,24 @@
 
 // set "off" values for checkboxes that were not checked, and therefore
 // not included in the POST body.
-foreach ($a_boolean_cols as $col)
-{
+foreach ($a_boolean_cols as $col) {
   $fname = '_' . $col;
   if (!isset($_POST[$fname]))
     $save_data[$col] = 0;
 }
 
 // unset email address if user has no rights to change it
-if (IDENTITIES_LEVEL == 1 || IDENTITIES_LEVEL == 3)
+if (IDENTITIES_LEVEL == 1 || IDENTITIES_LEVEL == 3) {
   unset($save_data['email']);
+}
+// unset all fields except signature
+else if (IDENTITIES_LEVEL == 4) {
+  foreach ($save_data as $idx => $value) {
+    if ($idx != 'signature' && $idx != 'html_signature') {
+      unset($save_data[$idx]);
+    }
+  }
+}
 
 // Validate e-mail addresses
 $email_checks = array(rcube_idn_to_ascii($save_data['email']));
@@ -71,10 +76,26 @@
   }
 }
 
+// XSS protection in HTML signature (#1489251)
+if (!empty($save_data['signature']) && !empty($save_data['html_signature'])) {
+  $save_data['signature'] = rcmail_wash_html($save_data['signature']);
+
+  // clear POST data of signature, we want to use safe content
+  // when the form is displayed again
+  unset($_POST['_signature']);
+}
+
 // update an existing contact
-if ($_POST['_iid'])
-{
+if ($_POST['_iid']) {
   $iid = get_input_value('_iid', RCUBE_INPUT_POST);
+
+  if (in_array(IDENTITIES_LEVEL, array(1,3,4))) {
+    // merge with old identity data, fixes #1488834
+    $identity  = $RCMAIL->user->get_identity($iid);
+    $save_data = array_merge($identity, $save_data);
+    unset($save_data['changed'], $save_data['del'], $save_data['user_id'], $save_data['identity_id']);
+  }
+
   $plugin = $RCMAIL->plugins->exec_hook('identity_update', array('id' => $iid, 'record' => $save_data));
   $save_data = $plugin['record'];
 
@@ -88,8 +109,8 @@
   if ($updated) {
     $OUTPUT->show_message('successfullysaved', 'confirmation');
 
-    if (!empty($_POST['_standard']))
-      $default_id = get_input_value('_iid', RCUBE_INPUT_POST);
+    if (!empty($save_data['standard']))
+      $default_id = $iid;
 
     if ($_POST['_framed']) {
       // update the changed col in list
@@ -105,10 +126,10 @@
 }
 
 // insert a new identity record
-else if (IDENTITIES_LEVEL < 2)
-{
-  if (IDENTITIES_LEVEL == 1)
-    $save_data['email'] = $RCMAIL->user->get_username();
+else if (IDENTITIES_LEVEL < 2) {
+  if (IDENTITIES_LEVEL == 1) {
+    $save_data['email'] = $RCMAIL->get_user_email();
+  }
 
   $plugin = $RCMAIL->plugins->exec_hook('identity_create', array('record' => $save_data));
   $save_data = $plugin['record'];
@@ -126,7 +147,7 @@
 
     $_GET['_iid'] = $insert_id;
 
-    if (!empty($_POST['_standard']))
+    if (!empty($save_data['standard']))
       $default_id = $insert_id;
 
     if ($_POST['_framed']) {
@@ -155,3 +176,40 @@
 }
 else
   rcmail_overwrite_action('identities');
+
+
+/**
+ * Sanity checks/cleanups on HTML body of signature
+ */
+function rcmail_wash_html($html)
+{
+    // Add header with charset spec., washtml cannot work without that
+    $html = '<html><head>'
+        . '<meta http-equiv="Content-Type" content="text/html; charset='.RCMAIL_CHARSET.'" />'
+        . '</head><body>' . $html . '</body></html>';
+
+    // clean HTML with washhtml by Frederic Motte
+    $wash_opts = array(
+        'show_washed' => false,
+        'allow_remote' => 1,
+        'charset' => RCMAIL_CHARSET,
+        'html_elements' => array('body', 'link'),
+        'html_attribs' => array('rel', 'type'),
+    );
+
+    // initialize HTML washer
+    $washer = new rcube_washtml($wash_opts);
+
+    //$washer->add_callback('form', 'rcmail_washtml_callback');
+    //$washer->add_callback('style', 'rcmail_washtml_callback');
+
+    // Remove non-UTF8 characters (#1487813)
+    $html = rc_utf8_clean($html);
+
+    $html = $washer->wash($html);
+
+    // remove unwanted comments and tags (produced by washtml)
+    $html = preg_replace(array('/<!--[^>]+-->/', '/<\/?body>/'), '', $html);
+
+  return $html;
+}

--
Gitblit v1.9.1