PageRenderTime 31ms CodeModel.GetById 20ms RepoModel.GetById 0ms app.codeStats 1ms

/tags/rel-1_4_13/functions/mime.php

#
PHP | 2514 lines | 1651 code | 168 blank | 695 comment | 400 complexity | 2b3f2c25c64f233cc22c733a482068af MD5 | raw file
Possible License(s): AGPL-1.0, GPL-2.0

Large files files are truncated, but you can click here to view the full file

    

  1. <?php
    2. 

  2. 

  3. /**
    4. 

  4.  * mime.php
    5. 

  5.  *
    6. 

  6.  * This contains the functions necessary to detect and decode MIME
    7. 

  7.  * messages.
    8. 

  8.  *
    9. 

  9.  * @copyright &copy; 1999-2007 The SquirrelMail Project Team
    10. 

  10.  * @license http://opensource.org/licenses/gpl-license.php GNU Public License
    11. 

  11.  * @version $Id: mime.php 12803 2007-12-05 20:21:46Z jangliss $
    12. 

  12.  * @package squirrelmail
    13. 

  13.  */
    14. 

  14. 

  15. /** The typical includes... */
    16. 

  16. require_once(SM_PATH . 'functions/imap.php');
    17. 

  17. require_once(SM_PATH . 'functions/attachment_common.php');
    18. 

  18. 

  19. /* -------------------------------------------------------------------------- */
    20. 

  20. /* MIME DECODING                                                              */
    21. 

  21. /* -------------------------------------------------------------------------- */
    22. 

  22. 

  23. /**
    24. 

  24.  * Get the MIME structure
    25. 

  25.  *
    26. 

  26.  * This function gets the structure of a message and stores it in the "message" class.
    27. 

  27.  * It will return this object for use with all relevant header information and
    28. 

  28.  * fully parsed into the standard "message" object format.
    29. 

  29.  */
    30. 

  30. function mime_structure ($bodystructure, $flags=array()) {
    31. 

  31. 

  32.     /* Isolate the body structure and remove beginning and end parenthesis. */
    33. 

  33.     $read = trim(substr ($bodystructure, strpos(strtolower($bodystructure), 'bodystructure') + 13));
    34. 

  34.     $read = trim(substr ($read, 0, -1));
    35. 

  35.     $i = 0;
    36. 

  36.     $msg = Message::parseStructure($read,$i);
    37. 

  37.     if (!is_object($msg)) {
    38. 

  38.         include_once(SM_PATH . 'functions/display_messages.php');
    39. 

  39.         global $color, $mailbox;
    40. 

  40.         /* removed urldecode because $_GET is auto urldecoded ??? */
    41. 

  41.         displayPageHeader( $color, $mailbox );
    42. 

  42.         echo "<body text=\"$color[8]\" bgcolor=\"$color[4]\" link=\"$color[7]\" vlink=\"$color[7]\" alink=\"$color[7]\">\n\n" .
    43. 

  43.          '<center>';
    44. 

  44.         $errormessage  = _("SquirrelMail could not decode the bodystructure of the message");
    45. 

  45.         $errormessage .= '<br />'._("The bodystructure provided by your IMAP server:").'<br /><br />';
    46. 

  46.         $errormessage .= '<table><tr><td>' . htmlspecialchars($read) . '</td></tr></table>';
    47. 

  47.         plain_error_message( $errormessage, $color );
    48. 

  48.         echo '</body></html>';
    49. 

  49.         exit;
    50. 

  50.     }
    51. 

  51.     if (count($flags)) {
    52. 

  52.         foreach ($flags as $flag) {
    53. 

  53.             $char = strtoupper($flag{1});
    54. 

  54.             switch ($char) {
    55. 

  55.                 case 'S':
    56. 

  56.                     if (strtolower($flag) == '\\seen') {
    57. 

  57.                         $msg->is_seen = true;
    58. 

  58.                     }
    59. 

  59.                     break;
    60. 

  60.                 case 'A':
    61. 

  61.                     if (strtolower($flag) == '\\answered') {
    62. 

  62.                         $msg->is_answered = true;
    63. 

  63.                     }
    64. 

  64.                     break;
    65. 

  65.                 case 'D':
    66. 

  66.                     if (strtolower($flag) == '\\deleted') {
    67. 

  67.                         $msg->is_deleted = true;
    68. 

  68.                     }
    69. 

  69.                     break;
    70. 

  70.                 case 'F':
    71. 

  71.                     if (strtolower($flag) == '\\flagged') {
    72. 

  72.                         $msg->is_flagged = true;
    73. 

  73.                     }
    74. 

  74.                     break;
    75. 

  75.                 case 'M':
    76. 

  76.                     if (strtolower($flag) == '$mdnsent') {
    77. 

  77.                         $msg->is_mdnsent = true;
    78. 

  78.                     }
    79. 

  79.                     break;
    80. 

  80.                 default:
    81. 

  81.                     break;
    82. 

  82.             }
    83. 

  83.         }
    84. 

  84.     }
    85. 

  85.     //    listEntities($msg);
    86. 

  86.     return $msg;
    87. 

  87. }
    88. 

  88. 

  89. 

  90. 

  91. /* This starts the parsing of a particular structure.  It is called recursively,
    92. 

  92.  * so it can be passed different structures.  It returns an object of type
    93. 

  93.  * $message.
    94. 

  94.  * First, it checks to see if it is a multipart message.  If it is, then it
    95. 

  95.  * handles that as it sees is necessary.  If it is just a regular entity,
    96. 

  96.  * then it parses it and adds the necessary header information (by calling out
    97. 

  97.  * to mime_get_elements()
    98. 

  98.  */
    99. 

  99. 

  100. function mime_fetch_body($imap_stream, $id, $ent_id=1, $fetch_size=0) {
    101. 

  101.     global $uid_support;
    102. 

  102.     /* Do a bit of error correction.  If we couldn't find the entity id, just guess
    103. 

  103.      * that it is the first one.  That is usually the case anyway.
    104. 

  104.      */
    105. 

  105. 

  106.     if (!$ent_id) {
    107. 

  107.         $cmd = "FETCH $id BODY[]";
    108. 

  108.     } else {
    109. 

  109.         $cmd = "FETCH $id BODY[$ent_id]";
    110. 

  110.     }
    111. 

  111. 

  112.     if ($fetch_size!=0) $cmd .= "<0.$fetch_size>";
    113. 

  113. 

  114.     $data = sqimap_run_command ($imap_stream, $cmd, true, $response, $message, $uid_support);
    115. 

  115.     do {
    116. 

  116.         $topline = trim(array_shift($data));
    117. 

  117.     } while($topline && ($topline[0] == '*') && !preg_match('/\* [0-9]+ FETCH.*/i', $topline)) ;
    118. 

  118. 

  119.     $wholemessage = implode('', $data);
    120. 

  120.     if (ereg('\\{([^\\}]*)\\}', $topline, $regs)) {
    121. 

  121.         $ret = substr($wholemessage, 0, $regs[1]);
    122. 

  122.         /* There is some information in the content info header that could be important
    123. 

  123.          * in order to parse html messages. Let's get them here.
    124. 

  124.          */
    125. 

  125. //        if ($ret{0} == '<') {
    126. 

  126. //            $data = sqimap_run_command ($imap_stream, "FETCH $id BODY[$ent_id.MIME]", true, $response, $message, $uid_support);
    127. 

  127. //        }
    128. 

  128.     } else if (ereg('"([^"]*)"', $topline, $regs)) {
    129. 

  129.         $ret = $regs[1];
    130. 

  130.     } else if ((stristr($topline, 'nil') !== false) && (empty($wholemessage))) {
    131. 

  131.         $ret = $wholemessage;
    132. 

  132.     } else {
    133. 

  133.         global $where, $what, $mailbox, $passed_id, $startMessage;
    134. 

  134.         $par = 'mailbox=' . urlencode($mailbox) . '&amp;passed_id=' . $passed_id;
    135. 

  135.         if (isset($where) && isset($what)) {
    136. 

  136.             $par .= '&amp;where=' . urlencode($where) . '&amp;what=' . urlencode($what);
    137. 

  137.         } else {
    138. 

  138.             $par .= '&amp;startMessage=' . $startMessage . '&amp;show_more=0';
    139. 

  139.         }
    140. 

  140.         $par .= '&amp;response=' . urlencode($response) .
    141. 

  141.             '&amp;message='  . urlencode($message)  .
    142. 

  142.             '&amp;topline='  . urlencode($topline);
    143. 

  143. 

  144.         echo '<tt><br />' .
    145. 

  145.             '<table width="80%"><tr>' .
    146. 

  146.             '<tr><td colspan="2">' .
    147. 

  147.             _("Body retrieval error. The reason for this is most probably that the message is malformed.") .
    148. 

  148.             '</td></tr>' .
    149. 

  149.             '<tr><td><b>' . _("Command:") . "</td><td>$cmd</td></tr>" .
    150. 

  150.             '<tr><td><b>' . _("Response:") . "</td><td>$response</td></tr>" .
    151. 

  151.             '<tr><td><b>' . _("Message:") . "</td><td>$message</td></tr>" .
    152. 

  152.             '<tr><td><b>' . _("FETCH line:") . "</td><td>$topline</td></tr>" .
    153. 

  153.             "</table><br /></tt></font><hr />";
    154. 

  154. 

  155.         $data = sqimap_run_command ($imap_stream, "FETCH $passed_id BODY[]", true, $response, $message, $uid_support);
    156. 

  156.         array_shift($data);
    157. 

  157.         $wholemessage = implode('', $data);
    158. 

  158. 

  159.         $ret = $wholemessage;
    160. 

  160.     }
    161. 

  161.     return $ret;
    162. 

  162. }
    163. 

  163. 

  164. function mime_print_body_lines ($imap_stream, $id, $ent_id=1, $encoding, $rStream='php://stdout') {
    165. 

  165.     global $uid_support;
    166. 

  166. 

  167.     /* Don't kill the connection if the browser is over a dialup
    168. 

  168.      * and it would take over 30 seconds to download it.
    169. 

  169.      * Don't call set_time_limit in safe mode.
    170. 

  170.      */
    171. 

  171. 

  172.     if (!ini_get('safe_mode')) {
    173. 

  173.         set_time_limit(0);
    174. 

  174.     }
    175. 

  175.     /* in case of base64 encoded attachments, do not buffer them.
    176. 

  176.        Instead, echo the decoded attachment directly to screen */
    177. 

  177.     if (strtolower($encoding) == 'base64') {
    178. 

  178.         if (!$ent_id) {
    179. 

  179.             $query = "FETCH $id BODY[]";
    180. 

  180.         } else {
    181. 

  181.             $query = "FETCH $id BODY[$ent_id]";
    182. 

  182.         }
    183. 

  183.         sqimap_run_command($imap_stream,$query,true,$response,$message,$uid_support,'sqimap_base64_decode',$rStream,true);
    184. 

  184.    } else {
    185. 

  185.         $body = mime_fetch_body ($imap_stream, $id, $ent_id);
    186. 

  186.         if ($rStream !== 'php://stdout') {
    187. 

  187.             fwrite($rStream, decodeBody($body, $encoding));
    188. 

  188.         } else {
    189. 

  189.             echo decodeBody($body, $encoding);
    190. 

  190.         }
    191. 

  191.     }
    192. 

  192.     return;
    193. 

  193. }
    194. 

  194. 

  195. /* -[ END MIME DECODING ]----------------------------------------------------------- */
    196. 

  196. 

  197. /* This is here for debugging purposes.  It will print out a list
    198. 

  198.  * of all the entity IDs that are in the $message object.
    199. 

  199.  */
    200. 

  200. function listEntities ($message) {
    201. 

  201.     if ($message) {
    202. 

  202.         echo "<tt>" . $message->entity_id . ' : ' . $message->type0 . '/' . $message->type1 . ' parent = '. $message->parent->entity_id. '<br />';
    203. 

  203.         for ($i = 0; isset($message->entities[$i]); $i++) {
    204. 

  204.             echo "$i : ";
    205. 

  205.             $msg = listEntities($message->entities[$i]);
    206. 

  206. 

  207.             if ($msg) {
    208. 

  208.                 echo "return: ";
    209. 

  209.                 return $msg;
    210. 

  210.             }
    211. 

  211.         }
    212. 

  212.     }
    213. 

  213. }
    214. 

  214. 

  215. function getPriorityStr($priority) {
    216. 

  216.     $priority_level = substr($priority,0,1);
    217. 

  217. 

  218.     switch($priority_level) {
    219. 

  219.         /* Check for a higher then normal priority. */
    220. 

  220.         case '1':
    221. 

  221.         case '2':
    222. 

  222.             $priority_string = _("High");
    223. 

  223.             break;
    224. 

  224. 

  225.         /* Check for a lower then normal priority. */
    226. 

  226.         case '4':
    227. 

  227.         case '5':
    228. 

  228.             $priority_string = _("Low");
    229. 

  229.             break;
    230. 

  230. 

  231.         /* Check for a normal priority. */
    232. 

  232.         case '3':
    233. 

  233.         default:
    234. 

  234.             $priority_level = '3';
    235. 

  235.             $priority_string = _("Normal");
    236. 

  236.             break;
    237. 

  237. 

  238.     }
    239. 

  239.     return $priority_string;
    240. 

  240. }
    241. 

  241. 

  242. /* returns a $message object for a particular entity id */
    243. 

  243. function getEntity ($message, $ent_id) {
    244. 

  244.     return $message->getEntity($ent_id);
    245. 

  245. }
    246. 

  246. 

  247. /* translateText
    248. 

  248.  * Extracted from strings.php 23/03/2002
    249. 

  249.  */
    250. 

  250. 

  251. function translateText(&$body, $wrap_at, $charset) {
    252. 

  252.     global $where, $what;   /* from searching */
    253. 

  253.     global $color;          /* color theme */
    254. 

  254. 

  255.     require_once(SM_PATH . 'functions/url_parser.php');
    256. 

  256. 

  257.     $body_ary = explode("\n", $body);
    258. 

  258.     for ($i=0; $i < count($body_ary); $i++) {
    259. 

  259.         $line = $body_ary[$i];
    260. 

  260.         if (strlen($line) - 2 >= $wrap_at) {
    261. 

  261.             sqWordWrap($line, $wrap_at, $charset);
    262. 

  262.         }
    263. 

  263.         $line = charset_decode($charset, $line);
    264. 

  264.         $line = str_replace("\t", '        ', $line);
    265. 

  265. 

  266.         parseUrl ($line);
    267. 

  267. 

  268.         $quotes = 0;
    269. 

  269.         $pos = 0;
    270. 

  270.         $j = strlen($line);
    271. 

  271. 

  272.         while ($pos < $j) {
    273. 

  273.             if ($line[$pos] == ' ') {
    274. 

  274.                 $pos++;
    275. 

  275.             } else if (strpos($line, '&gt;', $pos) === $pos) {
    276. 

  276.                 $pos += 4;
    277. 

  277.                 $quotes++;
    278. 

  278.             } else {
    279. 

  279.                 break;
    280. 

  280.             }
    281. 

  281.         }
    282. 

  282. 

  283.         if ($quotes % 2) {
    284. 

  284.             if (!isset($color[13])) {
    285. 

  285.                 $color[13] = '#800000';
    286. 

  286.             }
    287. 

  287.             $line = '<font color="' . $color[13] . '">' . $line . '</font>';
    288. 

  288.         } elseif ($quotes) {
    289. 

  289.             if (!isset($color[14])) {
    290. 

  290.                 $color[14] = '#FF0000';
    291. 

  291.             }
    292. 

  292.             $line = '<font color="' . $color[14] . '">' . $line . '</font>';
    293. 

  293.         }
    294. 

  294. 

  295.         $body_ary[$i] = $line;
    296. 

  296.     }
    297. 

  297.     $body = '<pre>' . implode("\n", $body_ary) . '</pre>';
    298. 

  298. }
    299. 

  299. 

  300. /**
    301. 

  301.  * This returns a parsed string called $body. That string can then
    302. 

  302.  * be displayed as the actual message in the HTML. It contains
    303. 

  303.  * everything needed, including HTML Tags, Attachments at the
    304. 

  304.  * bottom, etc.
    305. 

  305.  */
    306. 

  306. function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $mailbox='INBOX',$clean=false) {
    307. 

  307.     /* This if statement checks for the entity to show as the
    308. 

  308.      * primary message. To add more of them, just put them in the
    309. 

  309.      * order that is their priority.
    310. 

  310.      */
    311. 

  311.     global $startMessage, $languages, $squirrelmail_language,
    312. 

  312.            $show_html_default, $sort, $has_unsafe_images, $passed_ent_id,
    313. 

  313.            $username, $key, $imapServerAddress, $imapPort,
    314. 

  314.            $download_and_unsafe_link;
    315. 

  315. 

  316.     if( !sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET) ) {
    317. 

  317.         $view_unsafe_images = false;
    318. 

  318.     }
    319. 

  319. 

  320.     $body = '';
    321. 

  321.     $urlmailbox = urlencode($mailbox);
    322. 

  322.     $body_message = getEntity($message, $ent_num);
    323. 

  323.     if (($body_message->header->type0 == 'text') ||
    324. 

  324.             ($body_message->header->type0 == 'rfc822')) {
    325. 

  325.         $body = mime_fetch_body ($imap_stream, $id, $ent_num);
    326. 

  326.         $body = decodeBody($body, $body_message->header->encoding);
    327. 

  327. 

  328.         if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
    329. 

  329.                 function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
    330. 

  330.             if (mb_detect_encoding($body) != 'ASCII') {
    331. 

  331.                 $body = $languages[$squirrelmail_language]['XTRA_CODE']('decode', $body);
    332. 

  332.             }
    333. 

  333.         }
    334. 

  334.         $hookResults = do_hook("message_body", $body);
    335. 

  335.         $body = $hookResults[1];
    336. 

  336. 

  337.         /* If there are other types that shouldn't be formatted, add
    338. 

  338.          * them here.
    339. 

  339.          */
    340. 

  340. 

  341.         if ($body_message->header->type1 == 'html') {
    342. 

  342.             if ($show_html_default <> 1) {
    343. 

  343.                 $entity_conv = array('&nbsp;' => ' ',
    344. 

  344.                                      '<p>'    => "\n",
    345. 

  345.                                      '<P>'    => "\n",
    346. 

  346.                                      '<br>'   => "\n",
    347. 

  347.                                      '<BR>'   => "\n",
    348. 

  348.                                      '<br />' => "\n",
    349. 

  349.                                      '<BR />' => "\n",
    350. 

  350.                                      '&gt;'   => '>',
    351. 

  351.                                      '&lt;'   => '<');
    352. 

  352.                 $body = strtr($body, $entity_conv);
    353. 

  353.                 $body = strip_tags($body);
    354. 

  354.                 $body = trim($body);
    355. 

  355.                 translateText($body, $wrap_at,
    356. 

  356.                         $body_message->header->getParameter('charset'));
    357. 

  357.             } else {
    358. 

  358.                 $charset = $body_message->header->getParameter('charset');
    359. 

  359.                 if (!empty($charset))
    360. 

  360.                     $body = charset_decode($charset,$body,false,true);
    361. 

  361.                 $body = magicHTML($body, $id, $message, $mailbox);
    362. 

  362.             }
    363. 

  363.         } else {
    364. 

  364.             translateText($body, $wrap_at,
    365. 

  365.                     $body_message->header->getParameter('charset'));
    366. 

  366.         }
    367. 

  367. 

  368.         // if this is the clean display (i.e. printer friendly), stop here.
    369. 

  369.         if ( $clean ) {
    370. 

  370.             return $body;
    371. 

  371.         }
    372. 

  372. 

  373.         $download_and_unsafe_link = '';
    374. 

  374. 

  375.         $link = 'passed_id=' . $id . '&amp;ent_id='.$ent_num.
    376. 

  376.             '&amp;mailbox=' . $urlmailbox .'&amp;sort=' . $sort .
    377. 

  377.             '&amp;startMessage=' . $startMessage . '&amp;show_more=0';
    378. 

  378.         if (isset($passed_ent_id)) {
    379. 

  379.             $link .= '&amp;passed_ent_id='.$passed_ent_id;
    380. 

  380.         }
    381. 

  381.         $download_and_unsafe_link .= '&nbsp;|&nbsp;<a href="download.php?absolute_dl=true&amp;' .
    382. 

  382.             $link . '">' . _("Download this as a file") .  '</a>';
    383. 

  383.         if ($view_unsafe_images) {
    384. 

  384.             $text = _("Hide Unsafe Images");
    385. 

  385.         } else {
    386. 

  386.             if (isset($has_unsafe_images) && $has_unsafe_images) {
    387. 

  387.                 $link .= '&amp;view_unsafe_images=1';
    388. 

  388.                 $text = _("View Unsafe Images");
    389. 

  389.             } else {
    390. 

  390.                 $text = '';
    391. 

  391.             }
    392. 

  392.         }
    393. 

  393.         if($text != '') {
    394. 

  394.             $download_and_unsafe_link .= '&nbsp;|&nbsp;<a href="read_body.php?' . $link . '">' . $text . '</a>';
    395. 

  395.         }
    396. 

  396.     }
    397. 

  397.     return $body;
    398. 

  398. }
    399. 

  399. 

  400. 

  401. function formatAttachments($message, $exclude_id, $mailbox, $id) {
    402. 

  402.     global $where, $what, $startMessage, $color, $passed_ent_id;
    403. 

  403.     static $ShownHTML = 0;
    404. 

  404. 

  405.     $att_ar = $message->getAttachments($exclude_id);
    406. 

  406. 

  407.     if (!count($att_ar)) return '';
    408. 

  408. 

  409.     $attachments = '';
    410. 

  410. 

  411.     $urlMailbox = urlencode($mailbox);
    412. 

  412. 

  413.     foreach ($att_ar as $att) {
    414. 

  414.         $ent = $att->entity_id;
    415. 

  415.         $header = $att->header;
    416. 

  416.         $type0 = strtolower($header->type0);
    417. 

  417.         $type1 = strtolower($header->type1);
    418. 

  418.         $name = '';
    419. 

  419.         $links['download link']['text'] = _("Download");
    420. 

  420.         $links['download link']['href'] = SM_PATH .
    421. 

  421.             "src/download.php?absolute_dl=true&amp;passed_id=$id&amp;mailbox=$urlMailbox&amp;ent_id=$ent";
    422. 

  422.         $ImageURL = '';
    423. 

  423.         if ($type0 =='message' && $type1 == 'rfc822') {
    424. 

  424.             $default_page = SM_PATH . 'src/read_body.php';
    425. 

  425.             $rfc822_header = $att->rfc822_header;
    426. 

  426.             $filename = $rfc822_header->subject;
    427. 

  427.             if (trim( $filename ) == '') {
    428. 

  428.                 $filename = 'untitled-[' . $ent . ']' ;
    429. 

  429.             }
    430. 

  430.             $from_o = $rfc822_header->from;
    431. 

  431.             if (is_object($from_o)) {
    432. 

  432.                 $from_name = $from_o->getAddress(false);
    433. 

  433.             } elseif (is_array($from_o) && count($from_o) && is_object($from_o[0])) {
    434. 

  434.                 // when a digest message is opened and you return to the digest
    435. 

  435.                 // now the from object is part of an array. This is a workaround.
    436. 

  436.                 $from_name = $from_o[0]->getAddress(false);
    437. 

  437.             } else {
    438. 

  438.                 $from_name = _("Unknown sender");
    439. 

  439.             }
    440. 

  440.             $from_name = decodeHeader(($from_name));
    441. 

  441.             $description = $from_name;
    442. 

  442.         } else {
    443. 

  443.             $default_page = SM_PATH . 'src/download.php';
    444. 

  444.             if (is_object($header->disposition)) {
    445. 

  445.                 $filename = $header->disposition->getProperty('filename');
    446. 

  446.                 if (trim($filename) == '') {
    447. 

  447.                     $name = decodeHeader($header->disposition->getProperty('name'));
    448. 

  448.                     if (trim($name) == '') {
    449. 

  449.                         $name = $header->getParameter('name');
    450. 

  450.                         if(trim($name) == '') {
    451. 

  451.                             if (trim( $header->id ) == '') {
    452. 

  452.                                 $filename = 'untitled-[' . $ent . ']' ;
    453. 

  453.                             } else {
    454. 

  454.                                 $filename = 'cid: ' . $header->id;
    455. 

  455.                             }
    456. 

  456.                         } else {
    457. 

  457.                             $filename = $name;
    458. 

  458.                         }
    459. 

  459.                     } else {
    460. 

  460.                         $filename = $name;
    461. 

  461.                     }
    462. 

  462.                 }
    463. 

  463.             } else {
    464. 

  464.                 $filename = $header->getParameter('name');
    465. 

  465.                 if (!trim($filename)) {
    466. 

  466.                     if (trim( $header->id ) == '') {
    467. 

  467.                         $filename = 'untitled-[' . $ent . ']' ;
    468. 

  468.                     } else {
    469. 

  469.                         $filename = 'cid: ' . $header->id;
    470. 

  470.                     }
    471. 

  471.                 }
    472. 

  472.             }
    473. 

  473.             if ($header->description) {
    474. 

  474.                 $description = decodeHeader($header->description);
    475. 

  475.             } else {
    476. 

  476.                 $description = '';
    477. 

  477.             }
    478. 

  478.         }
    479. 

  479. 

  480.         $display_filename = $filename;
    481. 

  481.         if (isset($passed_ent_id)) {
    482. 

  482.             $passed_ent_id_link = '&amp;passed_ent_id='.$passed_ent_id;
    483. 

  483.         } else {
    484. 

  484.             $passed_ent_id_link = '';
    485. 

  485.         }
    486. 

  486.         $defaultlink = $default_page . "?startMessage=$startMessage"
    487. 

  487.             . "&amp;passed_id=$id&amp;mailbox=$urlMailbox"
    488. 

  488.             . '&amp;ent_id='.$ent.$passed_ent_id_link;
    489. 

  489.         if ($where && $what) {
    490. 

  490.            $defaultlink .= '&amp;where='. urlencode($where).'&amp;what='.urlencode($what);
    491. 

  491.         }
    492. 

  492.         // IE does make use of mime content sniffing. Forcing a download
    493. 

  493.         // prohibit execution of XSS inside an application/octet-stream attachment
    494. 

  494.         if ($type0 == 'application' && $type1 == 'octet-stream') {
    495. 

  495.             $defaultlink .= '&amp;absolute_dl=true';
    496. 

  496.         }
    497. 

  497.         /* This executes the attachment hook with a specific MIME-type.
    498. 

  498.          * If that doesn't have results, it tries if there's a rule
    499. 

  499.          * for a more generic type. Finally, a hook for ALL attachment
    500. 

  500.          * types is run as well.
    501. 

  501.          */
    502. 

  502.         $hookresults = do_hook("attachment $type0/$type1", $links,
    503. 

  503.                 $startMessage, $id, $urlMailbox, $ent, $defaultlink,
    504. 

  504.                 $display_filename, $where, $what);
    505. 

  505.         if(count($hookresults[1]) <= 1) {
    506. 

  506.             $hookresults = do_hook("attachment $type0/*", $links,
    507. 

  507.                     $startMessage, $id, $urlMailbox, $ent, $defaultlink,
    508. 

  508.                     $display_filename, $where, $what);
    509. 

  509.         }
    510. 

  510.         $hookresults = do_hook("attachment */*", $hookresults[1],
    511. 

  511.                 $startMessage, $id, $urlMailbox, $ent, $hookresults[6],
    512. 

  512.                 $display_filename, $where, $what);
    513. 

  513. 

  514.         $links = $hookresults[1];
    515. 

  515.         $defaultlink = $hookresults[6];
    516. 

  516. 

  517.         $attachments .= '<tr><td>' .
    518. 

  518.             '<a href="'.$defaultlink.'">'.decodeHeader($display_filename).'</a>&nbsp;</td>' .
    519. 

  519.             '<td><small><b>' . show_readable_size($header->size) .
    520. 

  520.             '</b>&nbsp;&nbsp;</small></td>' .
    521. 

  521.             '<td><small>[ '.htmlspecialchars($type0).'/'.htmlspecialchars($type1).' ]&nbsp;</small></td>' .
    522. 

  522.             '<td><small>';
    523. 

  523.         $attachments .= '<b>' . $description . '</b>';
    524. 

  524.         $attachments .= '</small></td><td><small>&nbsp;';
    525. 

  525. 

  526.         $skipspaces = 1;
    527. 

  527.         foreach ($links as $val) {
    528. 

  528.             if ($skipspaces) {
    529. 

  529.                 $skipspaces = 0;
    530. 

  530.             } else {
    531. 

  531.                 $attachments .= '&nbsp;&nbsp;|&nbsp;&nbsp;';
    532. 

  532.             }
    533. 

  533.             $attachments .= '<a href="' . $val['href'] . '">' .  $val['text'] . '</a>';
    534. 

  534.         }
    535. 

  535.         unset($links);
    536. 

  536.         $attachments .= "</td></tr>\n";
    537. 

  537.     }
    538. 

  538.     return $attachments;
    539. 

  539. }
    540. 

  540. 

  541. function sqimap_base64_decode(&$string) {
    542. 

  542. 

  543.     // Base64 encoded data goes in pairs of 4 bytes. To achieve on the
    544. 

  544.     // fly decoding (to reduce memory usage) you have to check if the
    545. 

  545.     // data has incomplete pairs
    546. 

  546. 

  547.     // Remove the noise in order to check if the 4 bytes pairs are complete
    548. 

  548.     $string = str_replace(array("\r\n","\n", "\r", " "),array('','','',''),$string);
    549. 

  549. 

  550.     $sStringRem = '';
    551. 

  551.     $iMod = strlen($string) % 4;
    552. 

  552.     if ($iMod) {
    553. 

  553.         $sStringRem = substr($string,-$iMod);
    554. 

  554.         // Check if $sStringRem contains padding characters
    555. 

  555.         if (substr($sStringRem,-1) != '=') {
    556. 

  556.             $string = substr($string,0,-$iMod);
    557. 

  557.         } else {
    558. 

  558.             $sStringRem = '';
    559. 

  559.         }
    560. 

  560.     }
    561. 

  561.     $string = base64_decode($string);
    562. 

  562.     return $sStringRem;
    563. 

  563. }
    564. 

  564. 

  565. /**
    566. 

  566.  * Decodes encoded message body
    567. 

  567.  *
    568. 

  568.  * This function decodes the body depending on the encoding type.
    569. 

  569.  * Currently quoted-printable and base64 encodings are supported.
    570. 

  570.  * decode_body hook was added to this function in 1.4.2/1.5.0
    571. 

  571.  * @param string $body encoded message body
    572. 

  572.  * @param string $encoding used encoding
    573. 

  573.  * @return string decoded string
    574. 

  574.  * @since 1.0
    575. 

  575.  */
    576. 

  576. function decodeBody($body, $encoding) {
    577. 

  577. 

  578.     $body = str_replace("\r\n", "\n", $body);
    579. 

  579.     $encoding = strtolower($encoding);
    580. 

  580. 

  581.     $encoding_handler = do_hook_function('decode_body', $encoding);
    582. 

  582. 

  583.     // plugins get first shot at decoding the body
    584. 

  584.     if (!empty($encoding_handler) && function_exists($encoding_handler)) {
    585. 

  585.         $body = $encoding_handler('decode', $body);
    586. 

  586. 

  587.     } elseif ($encoding == 'quoted-printable' ||
    588. 

  588.             $encoding == 'quoted_printable') {
    589. 

  589.         /**
    590. 

  590.          * quoted_printable_decode() function is broken in older
    591. 

  591.          * php versions. Text with \r\n decoding was fixed only
    592. 

  592.          * in php 4.3.0. Minimal code requirement 4.0.4 +
    593. 

  593.          * str_replace("\r\n", "\n", $body); call.
    594. 

  594.          */
    595. 

  595.         $body = quoted_printable_decode($body);
    596. 

  596.     } elseif ($encoding == 'base64') {
    597. 

  597.         $body = base64_decode($body);
    598. 

  598.     }
    599. 

  599. 

  600.     // All other encodings are returned raw.
    601. 

  601.     return $body;
    602. 

  602. }
    603. 

  603. 

  604. /**
    605. 

  605.  * Decodes headers
    606. 

  606.  *
    607. 

  607.  * This functions decode strings that is encoded according to
    608. 

  608.  * RFC1522 (MIME Part Two: Message Header Extensions for Non-ASCII Text).
    609. 

  609.  * Patched by Christian Schmidt <christian@ostenfeld.dk>  23/03/2002
    610. 

  610.  */
    611. 

  611. function decodeHeader ($string, $utfencode=true,$htmlsave=true,$decide=false) {
    612. 

  612.     global $languages, $squirrelmail_language,$default_charset;
    613. 

  613.     if (is_array($string)) {
    614. 

  614.         $string = implode("\n", $string);
    615. 

  615.     }
    616. 

  616. 

  617.     if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
    618. 

  618.             function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
    619. 

  619.         $string = $languages[$squirrelmail_language]['XTRA_CODE']('decodeheader', $string);
    620. 

  620.         // Do we need to return at this point?
    621. 

  621.         // return $string;
    622. 

  622.     }
    623. 

  623.     $i = 0;
    624. 

  624.     $iLastMatch = -2;
    625. 

  625.     $encoded = false;
    626. 

  626. 

  627.     $aString = explode(' ',$string);
    628. 

  628.     $ret = '';
    629. 

  629.     foreach ($aString as $chunk) {
    630. 

  630.         if ($encoded && $chunk === '') {
    631. 

  631.             continue;
    632. 

  632.         } elseif ($chunk === '') {
    633. 

  633.             $ret .= ' ';
    634. 

  634.             continue;
    635. 

  635.         }
    636. 

  636.         $encoded = false;
    637. 

  637.         /* if encoded words are not separated by a linear-space-white we still catch them */
    638. 

  638.         $j = $i-1;
    639. 

  639. 

  640.         while ($match = preg_match('/^(.*)=\?([^?]*)\?(Q|B)\?([^?]*)\?=(.*)$/Ui',$chunk,$res)) {
    641. 

  641.             /* if the last chunk isn't an encoded string then put back the space, otherwise don't */
    642. 

  642.             if ($iLastMatch !== $j) {
    643. 

  643.                 if ($htmlsave) {
    644. 

  644.                     $ret .= '&#32;';
    645. 

  645.                 } else {
    646. 

  646.                     $ret .= ' ';
    647. 

  647.                 }
    648. 

  648.             }
    649. 

  649.             $iLastMatch = $i;
    650. 

  650.             $j = $i;
    651. 

  651.             if ($htmlsave) {
    652. 

  652.                 $ret .= htmlspecialchars($res[1]);
    653. 

  653.             } else {
    654. 

  654.                 $ret .= $res[1];
    655. 

  655.             }
    656. 

  656.             $encoding = ucfirst($res[3]);
    657. 

  657. 

  658.             /* decide about valid decoding */
    659. 

  659.             if ($decide && is_conversion_safe($res[2])) {
    660. 

  660.                 $can_be_encoded=true;
    661. 

  661.             } else {
    662. 

  662.                 $can_be_encoded=false;
    663. 

  663.             }
    664. 

  664. 

  665.             switch ($encoding)
    666. 

  666.             {
    667. 

  667.                 case 'B':
    668. 

  668.                     $replace = base64_decode($res[4]);
    669. 

  669.                     if ($can_be_encoded) {
    670. 

  670.                         // string is converted from one charset to another. sanitizing depends on $htmlsave
    671. 

  671.                         $replace =  charset_convert($res[2],$replace,$default_charset,$htmlsave);
    672. 

  672.                     } elseif ($utfencode) {
    673. 

  673.                         // string is converted to htmlentities and sanitized
    674. 

  674.                         $replace = charset_decode($res[2],$replace);
    675. 

  675.                     } elseif ($htmlsave) {
    676. 

  676.                         // string is not converted, but still sanitized
    677. 

  677.                         $replace = htmlspecialchars($replace);
    678. 

  678.                     }
    679. 

  679.                     $ret.= $replace;
    680. 

  680.                     break;
    681. 

  681.                 case 'Q':
    682. 

  682.                     $replace = str_replace('_', ' ', $res[4]);
    683. 

  683.                     $replace = preg_replace('/=([0-9a-f]{2})/ie', 'chr(hexdec("\1"))',
    684. 

  684.                             $replace);
    685. 

  685.                     if ($can_be_encoded) {
    686. 

  686.                         // string is converted from one charset to another. sanitizing depends on $htmlsave
    687. 

  687.                         $replace = charset_convert($res[2], $replace,$default_charset,$htmlsave);
    688. 

  688.                     } elseif ($utfencode) {
    689. 

  689.                         // string is converted to html entities and sanitized
    690. 

  690.                         $replace = charset_decode($res[2], $replace);
    691. 

  691.                     } elseif ($htmlsave) {
    692. 

  692.                         // string is not converted, but still sanizited
    693. 

  693.                         $replace = htmlspecialchars($replace);
    694. 

  694.                     }
    695. 

  695.                     $ret .= $replace;
    696. 

  696.                     break;
    697. 

  697.                 default:
    698. 

  698.                     break;
    699. 

  699.             }
    700. 

  700.             $chunk = $res[5];
    701. 

  701.             $encoded = true;
    702. 

  702.         }
    703. 

  703.         if (!$encoded) {
    704. 

  704.             if ($htmlsave) {
    705. 

  705.                 $ret .= '&#32;';
    706. 

  706.             } else {
    707. 

  707.                 $ret .= ' ';
    708. 

  708.             }
    709. 

  709.         }
    710. 

  710. 

  711.         if (!$encoded && $htmlsave) {
    712. 

  712.             $ret .= htmlspecialchars($chunk);
    713. 

  713.         } else {
    714. 

  714.             $ret .= $chunk;
    715. 

  715.         }
    716. 

  716.         ++$i;
    717. 

  717.     }
    718. 

  718.     /* remove the first added space */
    719. 

  719.     if ($ret) {
    720. 

  720.         if ($htmlsave) {
    721. 

  721.             $ret = substr($ret,5);
    722. 

  722.         } else {
    723. 

  723.             $ret = substr($ret,1);
    724. 

  724.         }
    725. 

  725.     }
    726. 

  726. 

  727.     return $ret;
    728. 

  728. }
    729. 

  729. 

  730. /**
    731. 

  731.  * Encodes header as quoted-printable
    732. 

  732.  *
    733. 

  733.  * Encode a string according to RFC 1522 for use in headers if it
    734. 

  734.  * contains 8-bit characters or anything that looks like it should
    735. 

  735.  * be encoded.
    736. 

  736.  */
    737. 

  737. function encodeHeader ($string) {
    738. 

  738.     global $default_charset, $languages, $squirrelmail_language;
    739. 

  739. 

  740.     if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
    741. 

  741.             function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
    742. 

  742.         return  $languages[$squirrelmail_language]['XTRA_CODE']('encodeheader', $string);
    743. 

  743.     }
    744. 

  744. 

  745.     // Use B encoding for multibyte charsets
    746. 

  746.     $mb_charsets = array('utf-8','big5','gb2313','euc-kr');
    747. 

  747.     if (in_array($default_charset,$mb_charsets) &&
    748. 

  748.         in_array($default_charset,sq_mb_list_encodings()) &&
    749. 

  749.         sq_is8bit($string)) {
    750. 

  750.         return encodeHeaderBase64($string,$default_charset);
    751. 

  751.     } elseif (in_array($default_charset,$mb_charsets) &&
    752. 

  752.               sq_is8bit($string) &&
    753. 

  753.               ! in_array($default_charset,sq_mb_list_encodings())) {
    754. 

  754.         // Add E_USER_NOTICE error here (can cause 'Cannot add header information' warning in compose.php)
    755. 

  755.         // trigger_error('encodeHeader: Multibyte character set unsupported by mbstring extension.',E_USER_NOTICE);
    756. 

  756.     }
    757. 

  757. 

  758.     // Encode only if the string contains 8-bit characters or =?
    759. 

  759.     $j = strlen($string);
    760. 

  760.     $max_l = 75 - strlen($default_charset) - 7;
    761. 

  761.     $aRet = array();
    762. 

  762.     $ret = '';
    763. 

  763.     $iEncStart = $enc_init = false;
    764. 

  764.     $cur_l = $iOffset = 0;
    765. 

  765.     for($i = 0; $i < $j; ++$i) {
    766. 

  766.         switch($string{$i})
    767. 

  767.         {
    768. 

  768.             case '=':
    769. 

  769.             case '<':
    770. 

  770.             case '>':
    771. 

  771.             case ',':
    772. 

  772.             case '?':
    773. 

  773.             case '_':
    774. 

  774.                 if ($iEncStart === false) {
    775. 

  775.                     $iEncStart = $i;
    776. 

  776.                 }
    777. 

  777.                 $cur_l+=3;
    778. 

  778.                 if ($cur_l > ($max_l-2)) {
    779. 

  779.                     /* if there is an stringpart that doesn't need encoding, add it */
    780. 

  780.                     $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
    781. 

  781.                     $aRet[] = "=?$default_charset?Q?$ret?=";
    782. 

  782.                     $iOffset = $i;
    783. 

  783.                     $cur_l = 0;
    784. 

  784.                     $ret = '';
    785. 

  785.                     $iEncStart = false;
    786. 

  786.                 } else {
    787. 

  787.                     $ret .= sprintf("=%02X",ord($string{$i}));
    788. 

  788.                 }
    789. 

  789.                 break;
    790. 

  790.             case '(':
    791. 

  791.             case ')':
    792. 

  792.                 if ($iEncStart !== false) {
    793. 

  793.                     $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
    794. 

  794.                     $aRet[] = "=?$default_charset?Q?$ret?=";
    795. 

  795.                     $iOffset = $i;
    796. 

  796.                     $cur_l = 0;
    797. 

  797.                     $ret = '';
    798. 

  798.                     $iEncStart = false;
    799. 

  799.                 }
    800. 

  800.                 break;
    801. 

  801.             case ' ':
    802. 

  802.                 if ($iEncStart !== false) {
    803. 

  803.                     $cur_l++;
    804. 

  804.                     if ($cur_l > $max_l) {
    805. 

  805.                         $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
    806. 

  806.                         $aRet[] = "=?$default_charset?Q?$ret?=";
    807. 

  807.                         $iOffset = $i;
    808. 

  808.                         $cur_l = 0;
    809. 

  809.                         $ret = '';
    810. 

  810.                         $iEncStart = false;
    811. 

  811.                     } else {
    812. 

  812.                         $ret .= '_';
    813. 

  813.                     }
    814. 

  814.                 }
    815. 

  815.                 break;
    816. 

  816.             default:
    817. 

  817.                 $k = ord($string{$i});
    818. 

  818.                 if ($k > 126) {
    819. 

  819.                     if ($iEncStart === false) {
    820. 

  820.                         // do not start encoding in the middle of a string, also take the rest of the word.
    821. 

  821.                         $sLeadString = substr($string,0,$i);
    822. 

  822.                         $aLeadString = explode(' ',$sLeadString);
    823. 

  823.                         $sToBeEncoded = array_pop($aLeadString);
    824. 

  824.                         $iEncStart = $i - strlen($sToBeEncoded);
    825. 

  825.                         $ret .= $sToBeEncoded;
    826. 

  826.                         $cur_l += strlen($sToBeEncoded);
    827. 

  827.                     }
    828. 

  828.                     $cur_l += 3;
    829. 

  829.                     /* first we add the encoded string that reached it's max size */
    830. 

  830.                     if ($cur_l > ($max_l-2)) {
    831. 

  831.                         $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
    832. 

  832.                         $aRet[] = "=?$default_charset?Q?$ret?= "; /* the next part is also encoded => separate by space */
    833. 

  833.                         $cur_l = 3;
    834. 

  834.                         $ret = '';
    835. 

  835.                         $iOffset = $i;
    836. 

  836.                         $iEncStart = $i;
    837. 

  837.                     }
    838. 

  838.                     $enc_init = true;
    839. 

  839.                     $ret .= sprintf("=%02X", $k);
    840. 

  840.                 } else {
    841. 

  841.                     if ($iEncStart !== false) {
    842. 

  842.                         $cur_l++;
    843. 

  843.                         if ($cur_l > $max_l) {
    844. 

  844.                             $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
    845. 

  845.                             $aRet[] = "=?$default_charset?Q?$ret?=";
    846. 

  846.                             $iEncStart = false;
    847. 

  847.                             $iOffset = $i;
    848. 

  848.                             $cur_l = 0;
    849. 

  849.                             $ret = '';
    850. 

  850.                         } else {
    851. 

  851.                             $ret .= $string{$i};
    852. 

  852.                         }
    853. 

  853.                     }
    854. 

  854.                 }
    855. 

  855.                 break;
    856. 

  856.         }
    857. 

  857.     }
    858. 

  858. 

  859.     if ($enc_init) {
    860. 

  860.         if ($iEncStart !== false) {
    861. 

  861.             $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
    862. 

  862.             $aRet[] = "=?$default_charset?Q?$ret?=";
    863. 

  863.         } else {
    864. 

  864.             $aRet[] = substr($string,$iOffset);
    865. 

  865.         }
    866. 

  866.         $string = implode('',$aRet);
    867. 

  867.     }
    868. 

  868.     return $string;
    869. 

  869. }
    870. 

  870. 

  871. /**
    872. 

  872.  * Encodes string according to rfc2047 B encoding header formating rules
    873. 

  873.  *
    874. 

  874.  * It is recommended way to encode headers with character sets that store
    875. 

  875.  * symbols in more than one byte.
    876. 

  876.  *
    877. 

  877.  * Function requires mbstring support. If required mbstring functions are missing,
    878. 

  878.  * function returns false and sets E_USER_WARNING level error message.
    879. 

  879.  *
    880. 

  880.  * Minimal requirements - php 4.0.6 with mbstring extension. Please note,
    881. 

  881.  * that mbstring functions will generate E_WARNING errors, if unsupported
    882. 

  882.  * character set is used. mb_encode_mimeheader function provided by php
    883. 

  883.  * mbstring extension is not used in order to get better control of header
    884. 

  884.  * encoding.
    885. 

  885.  *
    886. 

  886.  * Used php code functions - function_exists(), trigger_error(), strlen()
    887. 

  887.  * (is used with charset names and base64 strings). Used php mbstring
    888. 

  888.  * functions - mb_strlen and mb_substr.
    889. 

  889.  *
    890. 

  890.  * Related documents: rfc 2045 (BASE64 encoding), rfc 2047 (mime header
    891. 

  891.  * encoding), rfc 2822 (header folding)
    892. 

  892.  *
    893. 

  893.  * @param string $string header string that must be encoded
    894. 

  894.  * @param string $charset character set. Must be supported by mbstring extension.
    895. 

  895.  * Use sq_mb_list_encodings() to detect supported charsets.
    896. 

  896.  * @return string string encoded according to rfc2047 B encoding formating rules
    897. 

  897.  * @since 1.5.1 and 1.4.6
    898. 

  898.  */
    899. 

  899. function encodeHeaderBase64($string,$charset) {
    900. 

  900.     /**
    901. 

  901.      * Check mbstring function requirements.
    902. 

  902.      */
    903. 

  903.     if (! function_exists('mb_strlen') ||
    904. 

  904.         ! function_exists('mb_substr')) {
    905. 

  905.         // set E_USER_WARNING
    906. 

  906.         trigger_error('encodeHeaderBase64: Required mbstring functions are missing.',E_USER_WARNING);
    907. 

  907.         // return false
    908. 

  908.         return false;
    909. 

  909.     }
    910. 

  910. 

  911.     // initial return array
    912. 

  912.     $aRet = array();
    913. 

  913. 

  914.     /**
    915. 

  915.      * header length = 75 symbols max (same as in encodeHeader)
    916. 

  916.      * remove $charset length
    917. 

  917.      * remove =? ? ?= (5 chars)
    918. 

  918.      * remove 2 more chars (\r\n ?)
    919. 

  919.      */
    920. 

  920.     $iMaxLength = 75 - strlen($charset) - 7;
    921. 

  921. 

  922.     // set first character position
    923. 

  923.     $iStartCharNum = 0;
    924. 

  924. 

  925.     // loop through all characters. count characters and not bytes.
    926. 

  926.     for ($iCharNum=1; $iCharNum<=mb_strlen($string,$charset); $iCharNum++) {
    927. 

  927.         // encode string from starting character to current character.
    928. 

  928.         $encoded_string = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum,$charset));
    929. 

  929. 

  930.         // Check encoded string length
    931. 

  931.         if(strlen($encoded_string)>$iMaxLength) {
    932. 

  932.             // if string exceeds max length, reduce number of encoded characters and add encoded string part to array
    933. 

  933.             $aRet[] = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum-1,$charset));
    934. 

  934. 

  935.             // set new starting character
    936. 

  936.             $iStartCharNum = $iCharNum-1;
    937. 

  937. 

  938.             // encode last char (in case it is last character in string)
    939. 

  939.             $encoded_string = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum,$charset));
    940. 

  940.         } // if string is shorter than max length - add next character
    941. 

  941.     }
    942. 

  942. 

  943.     // add last encoded string to array
    944. 

  944.     $aRet[] = $encoded_string;
    945. 

  945. 

  946.     // set initial return string
    947. 

  947.     $sRet = '';
    948. 

  948. 

  949.     // loop through encoded strings
    950. 

  950.     foreach($aRet as $string) {
    951. 

  951.         // TODO: Do we want to control EOL (end-of-line) marker
    952. 

  952.         if ($sRet!='') $sRet.= " ";
    953. 

  953. 

  954.         // add header tags and encoded string to return string
    955. 

  955.         $sRet.= '=?'.$charset.'?B?'.$string.'?=';
    956. 

  956.     }
    957. 

  957. 

  958.     return $sRet;
    959. 

  959. }
    960. 

  960. 

  961. /* This function trys to locate the entity_id of a specific mime element */
    962. 

  962. function find_ent_id($id, $message) {
    963. 

  963.     for ($i = 0, $ret = ''; $ret == '' && $i < count($message->entities); $i++) {
    964. 

  964.         if ($message->entities[$i]->header->type0 == 'multipart')  {
    965. 

  965.             $ret = find_ent_id($id, $message->entities[$i]);
    966. 

  966.         } else {
    967. 

  967.             if (strcasecmp($message->entities[$i]->header->id, $id) == 0) {
    968. 

  968. //                if (sq_check_save_extension($message->entities[$i])) {
    969. 

  969.                 return $message->entities[$i]->entity_id;
    970. 

  970. //                }
    971. 

  971.             } elseif (!empty($message->entities[$i]->header->parameters['name'])) {
    972. 

  972.                 /**
    973. 

  973.                  * This is part of a fix for Outlook Express 6.x generating
    974. 

  974.                  * cid URLs without creating content-id headers
    975. 

  975.                  * @@JA - 20050207
    976. 

  976.                  */
    977. 

  977.                 if (strcasecmp($message->entities[$i]->header->parameters['name'], $id) == 0) {
    978. 

  978.                     return $message->entities[$i]->entity_id;
    979. 

  979.                 }
    980. 

  980.             }
    981. 

  981.         }
    982. 

  982.     }
    983. 

  983.     return $ret;
    984. 

  984. }
    985. 

  985. 

  986. function sq_check_save_extension($message) {
    987. 

  987.     $filename = $message->getFilename();
    988. 

  988.     $ext = substr($filename, strrpos($filename,'.')+1);
    989. 

  989.     $save_extensions = array('jpg','jpeg','gif','png','bmp');
    990. 

  990.     return in_array($ext, $save_extensions);
    991. 

  991. }
    992. 

  992. 

  993. 

  994. /**
    995. 

  995.  ** HTMLFILTER ROUTINES
    996. 

  996.  */
    997. 

  997. 

  998. /**
    999. 

  999.  * This function checks attribute values for entity-encoded values
    1000. 

  1000.  * and returns them translated into 8-bit strings so we can run
    1001. 

  1001.  * checks on them.
    1002. 

  1002.  *
    1003. 

  1003.  * @param  $attvalue A string to run entity check against.
    1004. 

  1004.  * @return           Nothing, modifies a reference value.
    1005. 

  1005.  */
    1006. 

  1006. function sq_defang(&$attvalue){
    1007. 

  1007.     $me = 'sq_defang';
    1008. 

  1008.     /**
    1009. 

  1009.      * Skip this if there aren't ampersands or backslashes.
    1010. 

  1010.      */
    1011. 

  1011.     if (strpos($attvalue, '&') === false
    1012. 

  1012.         && strpos($attvalue, '\\') === false){
    1013. 

  1013.         return;
    1014. 

  1014.     }
    1015. 

  1015.     $m = false;
    1016. 

  1016.     do {
    1017. 

  1017.         $m = false;
    1018. 

  1018.         $m = $m || sq_deent($attvalue, '/\&#0*(\d+);*/s');
    1019. 

  1019.         $m = $m || sq_deent($attvalue, '/\&#x0*((\d|[a-f])+);*/si', true);
    1020. 

  1020.         $m = $m || sq_deent($attvalue, '/\\\\(\d+)/s', true);
    1021. 

  1021.     } while ($m == true);
    1022. 

  1022.     $attvalue = stripslashes($attvalue);
    1023. 

  1023. }
    1024. 

  1024. 

  1025. /**
    1026. 

  1026.  * Kill any tabs, newlines, or carriage returns. Our friends the
    1027. 

  1027.  * makers of the browser with 95% market value decided that it'd
    1028. 

  1028.  * be funny to make "java[tab]script" be just as good as "javascript".
    1029. 

  1029.  *
    1030. 

  1030.  * @param  attvalue  The attribute value before extraneous spaces removed.
    1031. 

  1031.  * @return attvalue  Nothing, modifies a reference value.
    1032. 

  1032.  */
    1033. 

  1033. function sq_unspace(&$attvalue){
    1034. 

  1034.     $me = 'sq_unspace';
    1035. 

  1035.     if (strcspn($attvalue, "\t\r\n\0 ") != strlen($attvalue)){
    1036. 

  1036.         $attvalue = str_replace(Array("\t", "\r", "\n", "\0", " "),
    1037. 

  1037.                                 Array('',   '',   '',   '',   ''), $attvalue);
    1038. 

  1038.     }
    1039. 

  1039. }
    1040. 

  1040. 

  1041. /**
    1042. 

  1042.  * Translate all dangerous Unicode or Shift_JIS characters which are accepted by
    1043. 

  1043.  * IE as regular characters.
    1044. 

  1044.  *
    1045. 

  1045.  * @param  attvalue  The attribute value before dangerous characters are translated.
    1046. 

  1046.  * @return attvalue  Nothing, modifies a reference value.
    1047. 

  1047.  * @author Marc Groot Koerkamp.
    1048. 

  1048.  */
    1049. 

  1049. function sq_fixIE_idiocy(&$attvalue) {
    1050. 

  1050.     // remove NUL
    1051. 

  1051.     $attvalue = str_replace("\0", "", $attvalue);
    1052. 

  1052.     // remove comments
    1053. 

  1053.     $attvalue = preg_replace("/(\/\*.*?\*\/)/","",$attvalue);
    1054. 

  1054. 

  1055.     // IE has the evil habit of accepting every possible value for the attribute expression.
    1056. 

  1056.     // The table below contains characters which are parsed by IE if they are used in the "expression"
    1057. 

  1057.     // attribute value.
    1058. 

  1058.     $aDangerousCharsReplacementTable = array(
    1059. 

  1059.                         array('&#x029F;', '&#0671;' ,/* L UNICODE IPA Extension */
    1060. 

  1060.                               '&#x0280;', '&#0640;' ,/* R UNICODE IPA Extension */
    1061. 

  1061.                               '&#x0274;', '&#0628;' ,/* N UNICODE IPA Extension */
    1062. 

  1062.                               '&#xFF25;', '&#65317;' ,/* Unicode FULLWIDTH LATIN CAPITAL LETTER E */
    1063. 

  1063.                               '&#xFF45;', '&#65349;' ,/* Unicode FULLWIDTH LATIN SMALL LETTER E */
    1064. 

  1064.                               '&#xFF38;', '&#65336;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER X */
    1065. 

  1065.                               '&#xFF58;', '&#65368;',/* Unicode FULLWIDTH LATIN SMALL LETTER X */
    1066. 

  1066.                               '&#xFF30;', '&#65328;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER P */
    1067. 

  1067.                               '&#xFF50;', '&#65360;',/* Unicode FULLWIDTH LATIN SMALL LETTER P */
    1068. 

  1068.                               '&#xFF32;', '&#65330;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER R */
    1069. 

  1069.                               '&#xFF52;', '&#65362;',/* Unicode FULLWIDTH LATIN SMALL LETTER R */
    1070. 

  1070.                               '&#xFF33;', '&#65331;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER S */
    1071. 

  1071.                               '&#xFF53;', '&#65363;',/* Unicode FULLWIDTH LATIN SMALL LETTER S */
    1072. 

  1072.                               '&#xFF29;', '&#65321;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER I */
    1073. 

  1073.                               '&#xFF49;', '&#65353;',/* Unicode FULLWIDTH LATIN SMALL LETTER I */
    1074. 

  1074.                               '&#xFF2F;', '&#65327;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER O */
    1075. 

  1075.                               '&#xFF4F;', '&#65359;',/* Unicode FULLWIDTH LATIN SMALL LETTER O */
    1076. 

  1076.                               '&#xFF2E;', '&#65326;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER N */
    1077. 

  1077.                               '&#xFF4E;', '&#65358;',/* Unicode FULLWIDTH LATIN SMALL LETTER N */
    1078. 

  1078.                               '&#xFF2C;', '&#65324;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER L */
    1079. 

  1079.                               '&#xFF4C;', '&#65356;',/* Unicode FULLWIDTH LATIN SMALL LETTER L */
    1080. 

  1080.                               '&#xFF35;', '&#65333;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER U */
    1081. 

  1081.                               '&#xFF55;', '&#65365;',/* Unicode FULLWIDTH LATIN SMALL LETTER U */
    1082. 

  1082.                               '&#x207F;', '&#8319;' ,/* Unicode SUPERSCRIPT LATIN SMALL LETTER N */
    1083. 

  1083.                               "\xEF\xBC\xA5", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER E */   // in unicode this is some Chinese char range
    1084. 

  1084.                               "\xEF\xBD\x85", /* Shift JIS FULLWIDTH LATIN SMALL LETTER E */
    1085. 

  1085.                               "\xEF\xBC\xB8", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER X */
    1086. 

  1086.                               "\xEF\xBD\x98", /* Shift JIS FULLWIDTH LATIN SMALL LETTER X */
    1087. 

  1087.                               "\xEF\xBC\xB0", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER P */
    1088. 

  1088.                               "\xEF\xBD\x90", /* Shift JIS FULLWIDTH LATIN SMALL LETTER P */
    1089. 

  1089.                               "\xEF\xBC\xB2", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER R */
    1090. 

  1090.                               "\xEF\xBD\x92", /* Shift JIS FULLWIDTH LATIN SMALL LETTER R */
    1091. 

  1091.                               "\xEF\xBC\xB3", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER S */
    1092. 

  1092.                               "\xEF\xBD\x93", /* Shift JIS FULLWIDTH LATIN SMALL LETTER S */
    1093. 

  1093.                               "\xEF\xBC\xA9", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER I */
    1094. 

  1094.                               "\xEF\xBD\x89", /* Shift JIS FULLWIDTH LATIN SMALL LETTER I */
    1095. 

  1095.                               "\xEF\xBC\xAF", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER O */
    1096. 

  1096.                               "\xEF\xBD\x8F", /* Shift JIS FULLWIDTH LATIN SMALL LETTER O */
    1097. 

  1097.                               "\xEF\xBC\xAE", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER N */
    1098. 

  1098.                               "\xEF\xBD\x8E", /* Shift JIS FULLWIDTH LATIN SMALL LETTER N */
    1099. 

  1099.                               "\xEF\xBC\xAC", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER L */
    1100. 

  1100.                               "\xEF\xBD\x8C", /* Shift JIS FULLWIDTH LATIN SMALL LETTER L */
    1101. 

  1101.                               "\xEF\xBC\xB5", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER U */
    1102. 

  1102.                               "\xEF\xBD\x95", /* Shift JIS FULLWIDTH LATIN SMALL LETTER U */
    1103. 

  1103.                               "\xE2\x81\xBF", /* Shift JIS FULLWIDTH SUPERSCRIPT N */
    1104. 

  1104.                               "\xCA\x9F", /* L UNICODE IPA Extension */
    1105. 

  1105.                               "\xCA\x80", /* R UNICODE IPA Extension */
    1106. 

  1106.                               "\xC9\xB4"),  /* N UNICODE IPA Extension */
    1107. 

  1107.                        array('l', 'l', 'r','r','n','n',
    1108. 

  1108.                              'E','E','e','e','X','X','x','x','P','P','p','p','R','R','r','r','S','S','s','s','I','I',
    1109. 

  1109.                              'i','i','O','O','o','o','N','N','n','n','L','L','l','l','U','U','u','u','n','n',
    1110. 

  1110.                              'E','e','X','x','P','p','R','r','S','s','I','i','O','o','N','n','L','l','U','u','n','l','r','n'));
    1111. 

  1111.     $attvalue = str_replace($aDangerousCharsReplacementTable[0],$aDangerousCharsReplacementTable[1],$attvalue);
    1112. 

  1112. 

  1113.     // Escapes are useful for special characters like "{}[]()'&. In other cases they are
    1114. 

  1114.     // used for XSS.
    1115. 

  1115.     $attvalue = preg_replace("/(\\\\)([a-zA-Z]{1})/",'$2',$attvalue);
    1116. 

  1116. }
    1117. 

  1117. 

  1118. /**
    1119. 

  1119.  * This function returns the final tag out of the tag name, an array
    1120. 

  1120.  * of attributes, and the type of the tag. This function is called by
    1121. 

  1121.  * sq_sanitize internally.
    1122. 

  1122.  *
    1123. 

  1123.  * @param  $tagname  the name of the tag.
    1124. 

  1124.  * @param  $attary   the array of attributes and their values
    1125. 

  1125.  * @param  $tagtype  The type of the tag (see in comments).
    1126. 

  1126.  * @return           a string with the final tag representation.
    1127. 

  1127.  */
    1128. 

  1128. function sq_tagprint($tagname, $attary, $tagtype){
    1129. 

  1129.     $me = 'sq_tagprint';
    1130. 

  1130. 

  1131.     if ($tagtype == 2){
    1132. 

  1132.         $fulltag = '</' . $tagname . '>';
    1133. 

  1133.     } else {
    1134. 

  1134.         $fulltag = '<' . $tagname;
    1135. 

  1135.         if (is_array($attary) && sizeof($attary)){
    1136. 

  1136.             $atts = Array();
    1137. 

  1137.             while (list($attname, $attvalue) = each($attary)){
    1138. 

  1138.                 array_push($atts, "$attname=$attvalue");
    1139. 

  1139.             }
    1140. 

  1140.             $fulltag .= ' ' . join(" ", $atts);
    1141. 

  1141.         }
    1142. 

  1142.         if ($tagtype == 3){
    1143. 

  1143.             $fulltag .= ' /';
    1144. 

  1144.         }
    1145. 

  1145.         $fulltag .= '>';
    1146. 

  1146.     }
    1147. 

  1147.     return $fulltag;
    1148. 

  1148. }
    1149. 

  1149. 

  1150. /**
    1151. 

  1151.  * A small helper function to use with array_walk. Modifies a by-ref
    1152. 

  1152.  * value and makes it lowercase.
    1153. 

  1153.  *
    1154. 

  1154.  * @param  $val a value passed by-ref.
    1155. 

  1155.  * @return      void since it modifies a by-ref value.
    1156. 

  1156.  */
    1157. 

  1157. function sq_casenormalize(&$val){
    1158. 

  1158.     $val = strtolower($val);
    1159. 

  1159. }
    1160. 

  1160. 

  1161. /**
    1162. 

  1162.  * This function skips any whitespace from the current position within
    1163. 

  1163.  * a string and to the next non-whitespace value.
    1164. 

  1164.  *
    1165. 

  1165.  * @param  $body   the string
    1166. 

  1166.  * @param  $offset the offset within the string where we should start
    1167. 

  1167.  *                 looking for the next non-whitespace character.
    1168. 

  1168.  * @return         the location within the $body where the next
    1169. 

  1169.  *                 non-whitespace char is located.
    1170. 

  1170.  */
    1171. 

  1171. function sq_skipspace($body, $offset){
    1172. 

  1172.     $me = 'sq_skipspace';
    1173. 

  1173.     preg_match('/^(\s*)/s', substr($body, $offset), $matches);
    1174. 

  1174.     if (sizeof($matches{1})){
    1175. 

  1175.         $count = strlen($matches{1});
    1176. 

  1176.         $offset += $count;
    1177. 

  1177.     }
    1178. 

  1178.     return $offset;
    1179. 

  1179. }
    1180. 

  1180. 

  1181. /**
    1182. 

  1182.  * This function looks for the next character within a string.  It's
    1183. 

  1183.  * really just a glorified "strpos", except it catches if failures
    1184. 

  1184.  * nicely.
    1185. 

  1185.  *
    1186. 

  1186.  * @param  $body   The string to look for needle in.
    1187. 

  1187.  * @param  $offset Start looking from this position.
    1188. 

  1188.  * @param  $needle The character/string to look for.
    1189. 

  1189.  * @return         location of the next occurance of the needle, or
    1190. 

  1190.  *                 strlen($body) if needle wasn't found.
    1191. 

  1191.  */
    1192. 

  1192. function sq_findnxstr($body, $offset, $needle){
    1193. 

  1193.     $me  = 'sq_findnxstr';
    1194. 

  1194.     $pos = strpos($body, $needle, $offset);
    1195. 

  1195.     if ($pos === FALSE){
    1196. 

  1196.         $pos = strlen($body);
    1197. 

  1197.     }
    1198. 

  1198.     return $pos;
    1199. 

  1199. }
    1200. 

  1200. 

  1201. /**
    1202. 

  1202.  * This function takes a PCRE-style regexp and tries to match it
    1203. 

  1203.  * within the string.
    1204. 

  1204.  *
    1205. 

  1205.  * @param  $body   The string to look for needle in.
    1206. 

  1206.  * @param  $offset Start looking from here.
    1207. 

  1207.  * @param  $reg    A PCRE-style regex to match.
    1208. 

  1208.  * @return         Returns a false if no matches found, or an array
    1209. 

  1209.  *                 with the following members:
    1210. 

  1210.  *                 - integer with the location of the match within $body
    1211. 

  1211.  *                 - string with whatever content between offset and the match
    1212. 

  1212.  *                 - string with whatever it is we matched
    1213. 

  1213.  */
    1214. 

  1214. function sq_findnxreg($body, $offset, $reg){
    1215. 

  1215.     $me = 'sq_findnxreg';
    1216. 

  1216.     $matches = Array();
    1217. 

  1217.     $retarr = Array();
    1218. 

  1218.     preg_match("%^(.*?)($reg)%si", substr($body, $offset), $matches);
    1219. 

  1219.     if (!isset($matches{0}) || !$matches{0}){
    1220. 

  1220.         $retarr = false;
    1221. 

  1221.     } else {
    1222. 

  1222.         $retarr{0} = $offset + strlen($matches{1});
    1223. 

  1223.         $retarr{1} = $matches{1};
    1224. 

  1224.         $retarr{2} = $matches{2};
    1225. 

  1225.     }
    1226. 

  1226.     return $retarr;
    1227. 

  1227. }
    1228. 

  1228. 

  1229. /**
    1230. 

  1230.  * This function looks for the next tag.
    1231. 

  1231.  *
    1232. 

  1232.  * @param  $body   String where to look for the next tag.
    1233. 

  1233.  * @param  $offset Start looking from here.
    1234. 

  1234.  * @return         false if no more tags exist in the body, or
    1235. 

  1235.  *                 an array with the following members:
    1236. 

  1236.  *                 - string with the name of the tag
    1237. 

  1237.  *                 - array with attributes and their values
    1238. 

  1238.  *                 - integer with tag type (1, 2, or 3)
    1239. 

  1239.  *                 - integer where the tag starts (starting "<")
    1240. 

  1240.  *                 - integer where the tag ends (ending ">")
    1241. 

  1241.  *                 first three members will be false, if the tag is invalid.
    1242. 

  1242.  */
    1243. 

  1243. function sq_getnxtag($body, $offset){
    1244. 

  1244.     $me = 'sq_getnxtag';
    1245. 

  1245.     if ($offset > strlen($body)){
    1246. 

  1246.         return false;
    1247. 

  1247.     }
    1248. 

  1248.     $lt = sq_findnxstr($body, $offset, "<");
    1249. 

  1249.     if ($lt == strlen($body)){
    1250. 

  1250.         return false;
    1251. 

  1251.     }
    1252. 

  1252.     /**
    1253. 

  1253.      * We are here:
    1254. 

  1254.      * blah blah <tag attribute="value">
    1255. 

  1255.      * \---------^
    1256. 

  1256.      */
    1257. 

  1257.     $pos = sq_skipspace($body, $lt+1);
    1258. 

  1258.     if ($pos >= strlen($body)){
    1259. 

  1259.         return Array(false, false, false, $lt, strlen($body));
    1260. 

  1260.     }
    1261. 

  1261.     /**
    1262. 

  1262.      * There are 3 kinds of tags:
    1263. 

  1263.      * 1. Opening tag, e.g.:
    1264. 

  1264.      *    <a href="blah">
    1265. 

  1265.      * 2. Closing tag, e.g.:
    1266. 

  1266.      *    </a>
    1267. 

  1267.      * 3. XHTML-style content-less tag, e.g.:
    1268. 

  1268.      *    <img src="blah" />
    1269. 

  1269.      */
    1270. 

  1270.     $tagtype = false;
    1271. 

  1271.     switch (substr($body, $pos, 1)){
    1272. 

  1272.         case '/':
    1273. 

  1273.             $tagtype = 2;
    1274. 

  1274.             $pos++;
    1275. 

  1275.             break;
    1276. 

  1276.         case '!…
    1277.

Large files files are truncated, but you can click here to view the full file