apply code-formating-cleanup-convert-DOS-to-UNIX-text-form from https://github.com/zedzedtop/mailzu
This commit is contained in:
Mario Fetka
@@ -20,11 +20,10 @@ include_once('lib/CmnFns.class.php');
|
||||
* Pear::DB
|
||||
*/
|
||||
if ($GLOBALS['conf']['app']['safeMode']) {
|
||||
ini_set('include_path', ( dirname(__FILE__) . '/pear/' . PATH_SEPARATOR . ini_get('include_path') ));
|
||||
include_once('pear/Mail/mimeDecode.php');
|
||||
}
|
||||
else {
|
||||
include_once('Mail/mimeDecode.php');
|
||||
ini_set('include_path', ( dirname(__FILE__) . '/pear/' . PATH_SEPARATOR . ini_get('include_path') ));
|
||||
include_once('pear/Mail/mimeDecode.php');
|
||||
} else {
|
||||
include_once('Mail/mimeDecode.php');
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -42,10 +41,10 @@ include_once('lib/htmlfilter.php');
|
||||
* $param The mime structure object
|
||||
*/
|
||||
function GetCtype($struct) {
|
||||
$ctype_p = strtolower(trim($struct->ctype_primary));
|
||||
$ctype_s = strtolower(trim($struct->ctype_secondary));
|
||||
$type = $ctype_p . '/' . $ctype_s;
|
||||
return $type;
|
||||
$ctype_p = strtolower(trim($struct->ctype_primary));
|
||||
$ctype_s = strtolower(trim($struct->ctype_secondary));
|
||||
$type = $ctype_p . '/' . $ctype_s;
|
||||
return $type;
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -56,71 +55,68 @@ $filelist = array ();
|
||||
$errors = array ();
|
||||
|
||||
function MsgParseBody($struct) {
|
||||
global $filelist;
|
||||
global $errors;
|
||||
$ctype_p = strtolower(trim($struct->ctype_primary));
|
||||
$ctype_s = strtolower(trim($struct->ctype_secondary));
|
||||
|
||||
global $filelist;
|
||||
global $errors;
|
||||
$ctype_p = strtolower(trim($struct->ctype_primary));
|
||||
$ctype_s = strtolower(trim($struct->ctype_secondary));
|
||||
|
||||
switch ($ctype_p) {
|
||||
case "multipart":
|
||||
switch ($ctype_s) {
|
||||
case "alternative":
|
||||
// Handle multipart/alternative parts
|
||||
$alt_entity = FindMultiAlt($struct->parts);
|
||||
// Ignore if we return false NEEDS WORK
|
||||
if ($alt_entity) MsgParseBody($alt_entity);
|
||||
break;
|
||||
case "related":
|
||||
// Handle multipart/related parts
|
||||
$rel_entities = FindMultiRel($struct);
|
||||
foreach ($rel_entities as $ent) {
|
||||
MsgParseBody($ent);
|
||||
}
|
||||
break;
|
||||
default:
|
||||
// Probably multipart/mixed here
|
||||
// Recursively process nested mime entities
|
||||
if ( is_array($struct->parts) || is_object($struct->parts) ) {
|
||||
foreach ($struct->parts as $cur_part) {
|
||||
MsgParseBody($cur_part);
|
||||
}
|
||||
} else {
|
||||
$errors['Invalid or Corrupt MIME Detected.'] = true;
|
||||
}
|
||||
break;
|
||||
}
|
||||
break;
|
||||
case "text":
|
||||
// Do not display attached text types
|
||||
if (property_exists($struct, "d_parameters")) {
|
||||
if ($attachment = $struct->d_parameters['filename'] or $attachment = $struct->d_parameters['name']) {
|
||||
array_push($filelist, $attachment);
|
||||
break;
|
||||
}
|
||||
}
|
||||
switch ($ctype_s) {
|
||||
// Plain text
|
||||
case "plain":
|
||||
MsgBodyPlainText($struct->body);
|
||||
break;
|
||||
// HTML text
|
||||
case "html":
|
||||
MsgBodyHtmlText($struct->body);
|
||||
break;
|
||||
// Text type we do not support
|
||||
default:
|
||||
$errors['Portions of text could not be displayed'] = true;
|
||||
}
|
||||
break;
|
||||
|
||||
default:
|
||||
// Save the listed filename or notify the
|
||||
// reader that this mail is not displayed completely
|
||||
$attachment = $struct->d_parameters['filename'];
|
||||
$attachment ? array_push($filelist, $attachment) : $errors['Unsupported MIME objects present'] = true;
|
||||
|
||||
}
|
||||
switch ($ctype_p) {
|
||||
case "multipart":
|
||||
switch ($ctype_s) {
|
||||
case "alternative":
|
||||
// Handle multipart/alternative parts
|
||||
$alt_entity = FindMultiAlt($struct->parts);
|
||||
// Ignore if we return false NEEDS WORK
|
||||
if ($alt_entity) MsgParseBody($alt_entity);
|
||||
break;
|
||||
case "related":
|
||||
// Handle multipart/related parts
|
||||
$rel_entities = FindMultiRel($struct);
|
||||
foreach ($rel_entities as $ent) {
|
||||
MsgParseBody($ent);
|
||||
}
|
||||
break;
|
||||
default:
|
||||
// Probably multipart/mixed here
|
||||
// Recursively process nested mime entities
|
||||
if ( is_array($struct->parts) || is_object($struct->parts) ) {
|
||||
foreach ($struct->parts as $cur_part) {
|
||||
MsgParseBody($cur_part);
|
||||
}
|
||||
} else {
|
||||
$errors['Invalid or Corrupt MIME Detected.'] = true;
|
||||
}
|
||||
break;
|
||||
}
|
||||
break;
|
||||
case "text":
|
||||
// Do not display attached text types
|
||||
if (property_exists($struct, "d_parameters")) {
|
||||
if ($attachment = $struct->d_parameters['filename'] or $attachment = $struct->d_parameters['name']) {
|
||||
array_push($filelist, $attachment);
|
||||
break;
|
||||
}
|
||||
}
|
||||
switch ($ctype_s) {
|
||||
// Plain text
|
||||
case "plain":
|
||||
MsgBodyPlainText($struct->body);
|
||||
break;
|
||||
// HTML text
|
||||
case "html":
|
||||
MsgBodyHtmlText($struct->body);
|
||||
break;
|
||||
// Text type we do not support
|
||||
default:
|
||||
$errors['Portions of text could not be displayed'] = true;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
// Save the listed filename or notify the
|
||||
// reader that this mail is not displayed completely
|
||||
$attachment = $struct->d_parameters['filename'];
|
||||
$attachment ? array_push($filelist, $attachment) : $errors['Unsupported MIME objects present'] = true;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -130,29 +126,29 @@ function MsgParseBody($struct) {
|
||||
* $return Single MIME entity
|
||||
*/
|
||||
function FindMultiAlt($parts) {
|
||||
$alt_pref = array ('text/plain', 'text/html');
|
||||
$best_view = 0;
|
||||
// Bad Headers sometimes have invalid MIME....
|
||||
if ( is_array($parts) || is_object($parts) ) {
|
||||
foreach ($parts as $cur_part) {
|
||||
$type = GetCtype($cur_part);
|
||||
if ($type == 'multipart/related') {
|
||||
$type = $cur_part->d_parameters['type'];
|
||||
// Mozilla bug. Mozilla does not provide the parameter type.
|
||||
if (!$type) $type = 'text/html';
|
||||
}
|
||||
$altCount = count($alt_pref);
|
||||
for ($j = $best_view; $j < $altCount; ++$j) {
|
||||
if (($alt_pref[$j] == $type) && ($j >= $best_view)) {
|
||||
$best_view = $j;
|
||||
$struct = $cur_part;
|
||||
}
|
||||
}
|
||||
}
|
||||
return $struct;
|
||||
} else {
|
||||
$errors['Invalid or Corrupt MIME Detected.'] = true;
|
||||
}
|
||||
$alt_pref = array ('text/plain', 'text/html');
|
||||
$best_view = 0;
|
||||
// Bad Headers sometimes have invalid MIME....
|
||||
if ( is_array($parts) || is_object($parts) ) {
|
||||
foreach ($parts as $cur_part) {
|
||||
$type = GetCtype($cur_part);
|
||||
if ($type == 'multipart/related') {
|
||||
$type = $cur_part->d_parameters['type'];
|
||||
// Mozilla bug. Mozilla does not provide the parameter type.
|
||||
if (!$type) $type = 'text/html';
|
||||
}
|
||||
$altCount = count($alt_pref);
|
||||
for ($j = $best_view; $j < $altCount; ++$j) {
|
||||
if (($alt_pref[$j] == $type) && ($j >= $best_view)) {
|
||||
$best_view = $j;
|
||||
$struct = $cur_part;
|
||||
}
|
||||
}
|
||||
}
|
||||
return $struct;
|
||||
} else {
|
||||
$errors['Invalid or Corrupt MIME Detected.'] = true;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -162,155 +158,151 @@ function FindMultiAlt($parts) {
|
||||
* @return List of MIME entities
|
||||
*/
|
||||
function FindMultiRel($struct) {
|
||||
$entities = array();
|
||||
$type = $struct->d_parameters['type'];
|
||||
// Mozilla bug. Mozilla does not provide the parameter type.
|
||||
if (!$type) $type = 'text/html';
|
||||
// Bad Headers sometimes have invalid MIME....
|
||||
if ( is_array($struct->parts) || is_object($struct->parts) ) {
|
||||
foreach ($struct->parts as $part) {
|
||||
if (GetCtype($part) == $type || GetCtype($part) == "multipart/alternative") {
|
||||
array_push($entities,$part);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
$errors['Invalid or Corrupt MIME Detected.'] = true;
|
||||
}
|
||||
return $entities;
|
||||
$entities = array();
|
||||
$type = $struct->d_parameters['type'];
|
||||
// Mozilla bug. Mozilla does not provide the parameter type.
|
||||
if (!$type) $type = 'text/html';
|
||||
// Bad Headers sometimes have invalid MIME....
|
||||
if ( is_array($struct->parts) || is_object($struct->parts) ) {
|
||||
foreach ($struct->parts as $part) {
|
||||
if (GetCtype($part) == $type || GetCtype($part) == "multipart/alternative") {
|
||||
array_push($entities,$part);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
$errors['Invalid or Corrupt MIME Detected.'] = true;
|
||||
}
|
||||
return $entities;
|
||||
}
|
||||
|
||||
// Wrapper script for htmlfilter. Settings taken
|
||||
// from SquirrelMail
|
||||
function sanitizeHTML($body) {
|
||||
if (isset($_COOKIE['lang']) &&
|
||||
file_exists("img/".substr($_COOKIE['lang'],0,2).".blocked_img.png")) {
|
||||
$secremoveimg = "img/".substr($_COOKIE['lang'],0,2).".blocked_img.png";
|
||||
} else {
|
||||
$secremoveimg = "img/blocked_img.png";
|
||||
}
|
||||
$tag_list = Array(
|
||||
false,
|
||||
"object",
|
||||
"meta",
|
||||
"html",
|
||||
"head",
|
||||
"base",
|
||||
"link",
|
||||
"frame",
|
||||
"iframe",
|
||||
"plaintext",
|
||||
"marquee"
|
||||
);
|
||||
if (isset($_COOKIE['lang']) && file_exists("img/".substr($_COOKIE['lang'],0,2).".blocked_img.png")) {
|
||||
$secremoveimg = "img/".substr($_COOKIE['lang'],0,2).".blocked_img.png";
|
||||
} else {
|
||||
$secremoveimg = "img/blocked_img.png";
|
||||
}
|
||||
$tag_list = Array(
|
||||
false,
|
||||
"object",
|
||||
"meta",
|
||||
"html",
|
||||
"head",
|
||||
"base",
|
||||
"link",
|
||||
"frame",
|
||||
"iframe",
|
||||
"plaintext",
|
||||
"marquee"
|
||||
);
|
||||
|
||||
$rm_tags_with_content = Array(
|
||||
"script",
|
||||
"applet",
|
||||
"embed",
|
||||
"title",
|
||||
"frameset",
|
||||
"xml",
|
||||
"style"
|
||||
);
|
||||
$rm_tags_with_content = Array(
|
||||
"script",
|
||||
"applet",
|
||||
"embed",
|
||||
"title",
|
||||
"frameset",
|
||||
"xml",
|
||||
"style"
|
||||
);
|
||||
|
||||
$self_closing_tags = Array(
|
||||
"img",
|
||||
"br",
|
||||
"hr",
|
||||
"input"
|
||||
);
|
||||
$self_closing_tags = Array(
|
||||
"img",
|
||||
"br",
|
||||
"hr",
|
||||
"input"
|
||||
);
|
||||
|
||||
$force_tag_closing = true;
|
||||
$force_tag_closing = true;
|
||||
|
||||
$rm_attnames = Array(
|
||||
"/.*/" =>
|
||||
Array(
|
||||
"/target/i",
|
||||
"/^on.*/i",
|
||||
"/^dynsrc/i",
|
||||
"/^data.*/i",
|
||||
"/^lowsrc.*/i"
|
||||
)
|
||||
);
|
||||
$rm_attnames = Array(
|
||||
"/.*/" =>
|
||||
Array(
|
||||
"/target/i",
|
||||
"/^on.*/i",
|
||||
"/^dynsrc/i",
|
||||
"/^data.*/i",
|
||||
"/^lowsrc.*/i"
|
||||
)
|
||||
);
|
||||
|
||||
$bad_attvals = Array(
|
||||
"/.*/" =>
|
||||
Array(
|
||||
"/^src|background/i" =>
|
||||
Array(
|
||||
Array(
|
||||
"/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
|
||||
"/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
|
||||
"/^([\'\"])\s*about\s*:.*([\'\"])/si",
|
||||
"/^([\'\"])\s*https*:.*([\'\"])/si",
|
||||
"/^([\'\"])\s*cid*:.*([\'\"])/si"
|
||||
),
|
||||
Array(
|
||||
"\\1$secremoveimg\\2",
|
||||
"\\1$secremoveimg\\2",
|
||||
"\\1$secremoveimg\\2",
|
||||
"\\1$secremoveimg\\2",
|
||||
"\\1$secremoveimg\\2"
|
||||
)
|
||||
),
|
||||
"/^href|action/i" =>
|
||||
Array(
|
||||
Array(
|
||||
"/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
|
||||
"/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
|
||||
"/^([\'\"])\s*about\s*:.*([\'\"])/si"
|
||||
),
|
||||
Array(
|
||||
"\\1#\\1",
|
||||
"\\1#\\1",
|
||||
"\\1#\\1",
|
||||
"\\1#\\1"
|
||||
)
|
||||
),
|
||||
"/^style/i" =>
|
||||
Array(
|
||||
Array(
|
||||
"/expression/i",
|
||||
"/binding/i",
|
||||
"/behaviou*r/i",
|
||||
"/include-source/i",
|
||||
"/url\s*\(\s*([\'\"])\s*\S+script\s*:.*([\'\"])\s*\)/si",
|
||||
"/url\s*\(\s*([\'\"])\s*mocha\s*:.*([\'\"])\s*\)/si",
|
||||
"/url\s*\(\s*([\'\"])\s*about\s*:.*([\'\"])\s*\)/si",
|
||||
"/(.*)\s*:\s*url\s*\(\s*([\'\"]*)\s*\S+script\s*:.*([\'\"]*)\s*\)/si",
|
||||
"/url\(([\'\"])\s*https*:.*([\'\"])\)/si"
|
||||
),
|
||||
Array(
|
||||
"idiocy",
|
||||
"idiocy",
|
||||
"idiocy",
|
||||
"idiocy",
|
||||
"url(\\1#\\1)",
|
||||
"url(\\1#\\1)",
|
||||
"url(\\1#\\1)",
|
||||
"url(\\1#\\1)",
|
||||
"url(\\1#\\1)",
|
||||
"\\1:url(\\2#\\3)",
|
||||
"url(\\1$secremoveimg\\1)"
|
||||
)
|
||||
)
|
||||
)
|
||||
);
|
||||
$bad_attvals = Array(
|
||||
"/.*/" =>
|
||||
Array(
|
||||
"/^src|background/i" =>
|
||||
Array(
|
||||
Array(
|
||||
"/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
|
||||
"/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
|
||||
"/^([\'\"])\s*about\s*:.*([\'\"])/si",
|
||||
"/^([\'\"])\s*https*:.*([\'\"])/si",
|
||||
"/^([\'\"])\s*cid*:.*([\'\"])/si"
|
||||
),
|
||||
Array(
|
||||
"\\1$secremoveimg\\2",
|
||||
"\\1$secremoveimg\\2",
|
||||
"\\1$secremoveimg\\2",
|
||||
"\\1$secremoveimg\\2",
|
||||
"\\1$secremoveimg\\2"
|
||||
)
|
||||
),
|
||||
"/^href|action/i" =>
|
||||
Array(
|
||||
Array(
|
||||
"/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
|
||||
"/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
|
||||
"/^([\'\"])\s*about\s*:.*([\'\"])/si"
|
||||
),
|
||||
Array(
|
||||
"\\1#\\1",
|
||||
"\\1#\\1",
|
||||
"\\1#\\1",
|
||||
"\\1#\\1"
|
||||
)
|
||||
),
|
||||
"/^style/i" =>
|
||||
Array(
|
||||
Array(
|
||||
"/expression/i",
|
||||
"/binding/i",
|
||||
"/behaviou*r/i",
|
||||
"/include-source/i",
|
||||
"/url\s*\(\s*([\'\"])\s*\S+script\s*:.*([\'\"])\s*\)/si",
|
||||
"/url\s*\(\s*([\'\"])\s*mocha\s*:.*([\'\"])\s*\)/si",
|
||||
"/url\s*\(\s*([\'\"])\s*about\s*:.*([\'\"])\s*\)/si",
|
||||
"/(.*)\s*:\s*url\s*\(\s*([\'\"]*)\s*\S+script\s*:.*([\'\"]*)\s*\)/si",
|
||||
"/url\(([\'\"])\s*https*:.*([\'\"])\)/si"
|
||||
),
|
||||
Array(
|
||||
"idiocy",
|
||||
"idiocy",
|
||||
"idiocy",
|
||||
"idiocy",
|
||||
"url(\\1#\\1)",
|
||||
"url(\\1#\\1)",
|
||||
"url(\\1#\\1)",
|
||||
"url(\\1#\\1)",
|
||||
"url(\\1#\\1)",
|
||||
"\\1:url(\\2#\\3)",
|
||||
"url(\\1$secremoveimg\\1)"
|
||||
)
|
||||
)
|
||||
)
|
||||
);
|
||||
|
||||
$add_attr_to_tag = Array(
|
||||
"/^a$/i" =>
|
||||
Array('target'=>'"_new"'
|
||||
)
|
||||
);
|
||||
$add_attr_to_tag = Array("/^a$/i" => Array('target'=>'"_new"'));
|
||||
|
||||
$trusted_html = sanitize($body,
|
||||
$tag_list,
|
||||
$rm_tags_with_content,
|
||||
$self_closing_tags,
|
||||
$force_tag_closing,
|
||||
$rm_attnames,
|
||||
$bad_attvals,
|
||||
$add_attr_to_tag
|
||||
);
|
||||
$trusted_html = sanitize($body,
|
||||
$tag_list,
|
||||
$rm_tags_with_content,
|
||||
$self_closing_tags,
|
||||
$force_tag_closing,
|
||||
$rm_attnames,
|
||||
$bad_attvals,
|
||||
$add_attr_to_tag
|
||||
);
|
||||
|
||||
return $trusted_html;
|
||||
return $trusted_html;
|
||||
}
|
||||
?>
|
||||
|
||||
Reference in New Issue
Block a user