PageRenderTime 72ms CodeModel.GetById 26ms RepoModel.GetById 0ms app.codeStats 0ms

/tags/rel-1_4_10a/functions/mime.php

#
PHP | 2451 lines | 1615 code | 160 blank | 676 comment | 385 complexity | 022af079ad4cf0c442dc12889b24bdbe MD5 | raw file
Possible License(s): AGPL-1.0, GPL-2.0 
    

  1. <?php
    2. 

  2. 

  3. /**
    4. 

  4.  * mime.php
    5. 

  5.  *
    6. 

  6.  * This contains the functions necessary to detect and decode MIME
    7. 

  7.  * messages.
    8. 

  8.  *
    9. 

  9.  * @copyright &copy; 1999-2007 The SquirrelMail Project Team
    10. 

  10.  * @license http://opensource.org/licenses/gpl-license.php GNU Public License
    11. 

  11.  * @version $Id: mime.php 12370 2007-05-09 13:46:30Z kink $
    12. 

  12.  * @package squirrelmail
    13. 

  13.  */
    14. 

  14. 

  15. /** The typical includes... */
    16. 

  16. require_once(SM_PATH . 'functions/imap.php');
    17. 

  17. require_once(SM_PATH . 'functions/attachment_common.php');
    18. 

  18. 

  19. /* -------------------------------------------------------------------------- */
    20. 

  20. /* MIME DECODING                                                              */
    21. 

  21. /* -------------------------------------------------------------------------- */
    22. 

  22. 

  23. /**
    24. 

  24.  * Get the MIME structure
    25. 

  25.  *
    26. 

  26.  * This function gets the structure of a message and stores it in the "message" class.
    27. 

  27.  * It will return this object for use with all relevant header information and
    28. 

  28.  * fully parsed into the standard "message" object format.
    29. 

  29.  */
    30. 

  30. function mime_structure ($bodystructure, $flags=array()) {
    31. 

  31. 

  32.     /* Isolate the body structure and remove beginning and end parenthesis. */
    33. 

  33.     $read = trim(substr ($bodystructure, strpos(strtolower($bodystructure), 'bodystructure') + 13));
    34. 

  34.     $read = trim(substr ($read, 0, -1));
    35. 

  35.     $i = 0;
    36. 

  36.     $msg = Message::parseStructure($read,$i);
    37. 

  37.     if (!is_object($msg)) {
    38. 

  38.         include_once(SM_PATH . 'functions/display_messages.php');
    39. 

  39.         global $color, $mailbox;
    40. 

  40.         /* removed urldecode because $_GET is auto urldecoded ??? */
    41. 

  41.         displayPageHeader( $color, $mailbox );
    42. 

  42.         echo "<body text=\"$color[8]\" bgcolor=\"$color[4]\" link=\"$color[7]\" vlink=\"$color[7]\" alink=\"$color[7]\">\n\n" .
    43. 

  43.          '<center>';
    44. 

  44.         $errormessage  = _("SquirrelMail could not decode the bodystructure of the message");
    45. 

  45.         $errormessage .= '<br />'._("The bodystructure provided by your IMAP server:").'<br /><br />';
    46. 

  46.         $errormessage .= '<table><tr><td>' . htmlspecialchars($read) . '</td></tr></table>';
    47. 

  47.         plain_error_message( $errormessage, $color );
    48. 

  48.         echo '</body></html>';
    49. 

  49.         exit;
    50. 

  50.     }
    51. 

  51.     if (count($flags)) {
    52. 

  52.         foreach ($flags as $flag) {
    53. 

  53.             $char = strtoupper($flag{1});
    54. 

  54.             switch ($char) {
    55. 

  55.                 case 'S':
    56. 

  56.                     if (strtolower($flag) == '\\seen') {
    57. 

  57.                         $msg->is_seen = true;
    58. 

  58.                     }
    59. 

  59.                     break;
    60. 

  60.                 case 'A':
    61. 

  61.                     if (strtolower($flag) == '\\answered') {
    62. 

  62.                         $msg->is_answered = true;
    63. 

  63.                     }
    64. 

  64.                     break;
    65. 

  65.                 case 'D':
    66. 

  66.                     if (strtolower($flag) == '\\deleted') {
    67. 

  67.                         $msg->is_deleted = true;
    68. 

  68.                     }
    69. 

  69.                     break;
    70. 

  70.                 case 'F':
    71. 

  71.                     if (strtolower($flag) == '\\flagged') {
    72. 

  72.                         $msg->is_flagged = true;
    73. 

  73.                     }
    74. 

  74.                     break;
    75. 

  75.                 case 'M':
    76. 

  76.                     if (strtolower($flag) == '$mdnsent') {
    77. 

  77.                         $msg->is_mdnsent = true;
    78. 

  78.                     }
    79. 

  79.                     break;
    80. 

  80.                 default:
    81. 

  81.                     break;
    82. 

  82.             }
    83. 

  83.         }
    84. 

  84.     }
    85. 

  85.     //    listEntities($msg);
    86. 

  86.     return $msg;
    87. 

  87. }
    88. 

  88. 

  89. 

  90. 

  91. /* This starts the parsing of a particular structure.  It is called recursively,
    92. 

  92.  * so it can be passed different structures.  It returns an object of type
    93. 

  93.  * $message.
    94. 

  94.  * First, it checks to see if it is a multipart message.  If it is, then it
    95. 

  95.  * handles that as it sees is necessary.  If it is just a regular entity,
    96. 

  96.  * then it parses it and adds the necessary header information (by calling out
    97. 

  97.  * to mime_get_elements()
    98. 

  98.  */
    99. 

  99. 

  100. function mime_fetch_body($imap_stream, $id, $ent_id=1, $fetch_size=0) {
    101. 

  101.     global $uid_support;
    102. 

  102.     /* Do a bit of error correction.  If we couldn't find the entity id, just guess
    103. 

  103.      * that it is the first one.  That is usually the case anyway.
    104. 

  104.      */
    105. 

  105. 

  106.     if (!$ent_id) {
    107. 

  107.         $cmd = "FETCH $id BODY[]";
    108. 

  108.     } else {
    109. 

  109.         $cmd = "FETCH $id BODY[$ent_id]";
    110. 

  110.     }
    111. 

  111. 

  112.     if ($fetch_size!=0) $cmd .= "<0.$fetch_size>";
    113. 

  113. 

  114.     $data = sqimap_run_command ($imap_stream, $cmd, true, $response, $message, $uid_support);
    115. 

  115.     do {
    116. 

  116.         $topline = trim(array_shift($data));
    117. 

  117.     } while($topline && ($topline[0] == '*') && !preg_match('/\* [0-9]+ FETCH.*/i', $topline)) ;
    118. 

  118. 

  119.     $wholemessage = implode('', $data);
    120. 

  120.     if (ereg('\\{([^\\}]*)\\}', $topline, $regs)) {
    121. 

  121.         $ret = substr($wholemessage, 0, $regs[1]);
    122. 

  122.         /* There is some information in the content info header that could be important
    123. 

  123.          * in order to parse html messages. Let's get them here.
    124. 

  124.          */
    125. 

  125. //        if ($ret{0} == '<') {
    126. 

  126. //            $data = sqimap_run_command ($imap_stream, "FETCH $id BODY[$ent_id.MIME]", true, $response, $message, $uid_support);
    127. 

  127. //        }
    128. 

  128.     } else if (ereg('"([^"]*)"', $topline, $regs)) {
    129. 

  129.         $ret = $regs[1];
    130. 

  130.     } else {
    131. 

  131.         global $where, $what, $mailbox, $passed_id, $startMessage;
    132. 

  132.         $par = 'mailbox=' . urlencode($mailbox) . '&amp;passed_id=' . $passed_id;
    133. 

  133.         if (isset($where) && isset($what)) {
    134. 

  134.             $par .= '&amp;where=' . urlencode($where) . '&amp;what=' . urlencode($what);
    135. 

  135.         } else {
    136. 

  136.             $par .= '&amp;startMessage=' . $startMessage . '&amp;show_more=0';
    137. 

  137.         }
    138. 

  138.         $par .= '&amp;response=' . urlencode($response) .
    139. 

  139.             '&amp;message='  . urlencode($message)  .
    140. 

  140.             '&amp;topline='  . urlencode($topline);
    141. 

  141. 

  142.         echo '<tt><br />' .
    143. 

  143.             '<table width="80%"><tr>' .
    144. 

  144.             '<tr><td colspan="2">' .
    145. 

  145.             _("Body retrieval error. The reason for this is most probably that the message is malformed.") .
    146. 

  146.             '</td></tr>' .
    147. 

  147.             '<tr><td><b>' . _("Command:") . "</td><td>$cmd</td></tr>" .
    148. 

  148.             '<tr><td><b>' . _("Response:") . "</td><td>$response</td></tr>" .
    149. 

  149.             '<tr><td><b>' . _("Message:") . "</td><td>$message</td></tr>" .
    150. 

  150.             '<tr><td><b>' . _("FETCH line:") . "</td><td>$topline</td></tr>" .
    151. 

  151.             "</table><br /></tt></font><hr />";
    152. 

  152. 

  153.         $data = sqimap_run_command ($imap_stream, "FETCH $passed_id BODY[]", true, $response, $message, $uid_support);
    154. 

  154.         array_shift($data);
    155. 

  155.         $wholemessage = implode('', $data);
    156. 

  156. 

  157.         $ret = $wholemessage;
    158. 

  158.     }
    159. 

  159.     return $ret;
    160. 

  160. }
    161. 

  161. 

  162. function mime_print_body_lines ($imap_stream, $id, $ent_id=1, $encoding, $rStream='php://stdout') {
    163. 

  163.     global $uid_support;
    164. 

  164. 

  165.     /* Don't kill the connection if the browser is over a dialup
    166. 

  166.      * and it would take over 30 seconds to download it.
    167. 

  167.      * Don't call set_time_limit in safe mode.
    168. 

  168.      */
    169. 

  169. 

  170.     if (!ini_get('safe_mode')) {
    171. 

  171.         set_time_limit(0);
    172. 

  172.     }
    173. 

  173.     /* in case of base64 encoded attachments, do not buffer them.
    174. 

  174.        Instead, echo the decoded attachment directly to screen */
    175. 

  175.     if (strtolower($encoding) == 'base64') {
    176. 

  176.         if (!$ent_id) {
    177. 

  177.             $query = "FETCH $id BODY[]";
    178. 

  178.         } else {
    179. 

  179.             $query = "FETCH $id BODY[$ent_id]";
    180. 

  180.         }
    181. 

  181.         sqimap_run_command($imap_stream,$query,true,$response,$message,$uid_support,'sqimap_base64_decode',$rStream,true);
    182. 

  182.    } else {
    183. 

  183.         $body = mime_fetch_body ($imap_stream, $id, $ent_id);
    184. 

  184.         if ($rStream !== 'php://stdout') {
    185. 

  185.             fwrite($rStream, decodeBody($body, $encoding));
    186. 

  186.         } else {
    187. 

  187.             echo decodeBody($body, $encoding);
    188. 

  188.         }
    189. 

  189.     }
    190. 

  190.     return;
    191. 

  191. }
    192. 

  192. 

  193. /* -[ END MIME DECODING ]----------------------------------------------------------- */
    194. 

  194. 

  195. /* This is here for debugging purposes.  It will print out a list
    196. 

  196.  * of all the entity IDs that are in the $message object.
    197. 

  197.  */
    198. 

  198. function listEntities ($message) {
    199. 

  199.     if ($message) {
    200. 

  200.         echo "<tt>" . $message->entity_id . ' : ' . $message->type0 . '/' . $message->type1 . ' parent = '. $message->parent->entity_id. '<br />';
    201. 

  201.         for ($i = 0; isset($message->entities[$i]); $i++) {
    202. 

  202.             echo "$i : ";
    203. 

  203.             $msg = listEntities($message->entities[$i]);
    204. 

  204. 

  205.             if ($msg) {
    206. 

  206.                 echo "return: ";
    207. 

  207.                 return $msg;
    208. 

  208.             }
    209. 

  209.         }
    210. 

  210.     }
    211. 

  211. }
    212. 

  212. 

  213. function getPriorityStr($priority) {
    214. 

  214.     $priority_level = substr($priority,0,1);
    215. 

  215. 

  216.     switch($priority_level) {
    217. 

  217.         /* Check for a higher then normal priority. */
    218. 

  218.         case '1':
    219. 

  219.         case '2':
    220. 

  220.             $priority_string = _("High");
    221. 

  221.             break;
    222. 

  222. 

  223.         /* Check for a lower then normal priority. */
    224. 

  224.         case '4':
    225. 

  225.         case '5':
    226. 

  226.             $priority_string = _("Low");
    227. 

  227.             break;
    228. 

  228. 

  229.         /* Check for a normal priority. */
    230. 

  230.         case '3':
    231. 

  231.         default:
    232. 

  232.             $priority_level = '3';
    233. 

  233.             $priority_string = _("Normal");
    234. 

  234.             break;
    235. 

  235. 

  236.     }
    237. 

  237.     return $priority_string;
    238. 

  238. }
    239. 

  239. 

  240. /* returns a $message object for a particular entity id */
    241. 

  241. function getEntity ($message, $ent_id) {
    242. 

  242.     return $message->getEntity($ent_id);
    243. 

  243. }
    244. 

  244. 

  245. /* translateText
    246. 

  246.  * Extracted from strings.php 23/03/2002
    247. 

  247.  */
    248. 

  248. 

  249. function translateText(&$body, $wrap_at, $charset) {
    250. 

  250.     global $where, $what;   /* from searching */
    251. 

  251.     global $color;          /* color theme */
    252. 

  252. 

  253.     require_once(SM_PATH . 'functions/url_parser.php');
    254. 

  254. 

  255.     $body_ary = explode("\n", $body);
    256. 

  256.     for ($i=0; $i < count($body_ary); $i++) {
    257. 

  257.         $line = $body_ary[$i];
    258. 

  258.         if (strlen($line) - 2 >= $wrap_at) {
    259. 

  259.             sqWordWrap($line, $wrap_at, $charset);
    260. 

  260.         }
    261. 

  261.         $line = charset_decode($charset, $line);
    262. 

  262.         $line = str_replace("\t", '        ', $line);
    263. 

  263. 

  264.         parseUrl ($line);
    265. 

  265. 

  266.         $quotes = 0;
    267. 

  267.         $pos = 0;
    268. 

  268.         $j = strlen($line);
    269. 

  269. 

  270.         while ($pos < $j) {
    271. 

  271.             if ($line[$pos] == ' ') {
    272. 

  272.                 $pos++;
    273. 

  273.             } else if (strpos($line, '&gt;', $pos) === $pos) {
    274. 

  274.                 $pos += 4;
    275. 

  275.                 $quotes++;
    276. 

  276.             } else {
    277. 

  277.                 break;
    278. 

  278.             }
    279. 

  279.         }
    280. 

  280. 

  281.         if ($quotes % 2) {
    282. 

  282.             if (!isset($color[13])) {
    283. 

  283.                 $color[13] = '#800000';
    284. 

  284.             }
    285. 

  285.             $line = '<font color="' . $color[13] . '">' . $line . '</font>';
    286. 

  286.         } elseif ($quotes) {
    287. 

  287.             if (!isset($color[14])) {
    288. 

  288.                 $color[14] = '#FF0000';
    289. 

  289.             }
    290. 

  290.             $line = '<font color="' . $color[14] . '">' . $line . '</font>';
    291. 

  291.         }
    292. 

  292. 

  293.         $body_ary[$i] = $line;
    294. 

  294.     }
    295. 

  295.     $body = '<pre>' . implode("\n", $body_ary) . '</pre>';
    296. 

  296. }
    297. 

  297. 

  298. /**
    299. 

  299.  * This returns a parsed string called $body. That string can then
    300. 

  300.  * be displayed as the actual message in the HTML. It contains
    301. 

  301.  * everything needed, including HTML Tags, Attachments at the
    302. 

  302.  * bottom, etc.
    303. 

  303.  */
    304. 

  304. function formatBody($imap_stream, $message, $color, $wrap_at, $ent_num, $id, $mailbox='INBOX',$clean=false) {
    305. 

  305.     /* This if statement checks for the entity to show as the
    306. 

  306.      * primary message. To add more of them, just put them in the
    307. 

  307.      * order that is their priority.
    308. 

  308.      */
    309. 

  309.     global $startMessage, $languages, $squirrelmail_language,
    310. 

  310.            $show_html_default, $sort, $has_unsafe_images, $passed_ent_id,
    311. 

  311.            $username, $key, $imapServerAddress, $imapPort,
    312. 

  312.            $download_and_unsafe_link;
    313. 

  313. 

  314.     if( !sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET) ) {
    315. 

  315.         $view_unsafe_images = false;
    316. 

  316.     }
    317. 

  317. 

  318.     $body = '';
    319. 

  319.     $urlmailbox = urlencode($mailbox);
    320. 

  320.     $body_message = getEntity($message, $ent_num);
    321. 

  321.     if (($body_message->header->type0 == 'text') ||
    322. 

  322.             ($body_message->header->type0 == 'rfc822')) {
    323. 

  323.         $body = mime_fetch_body ($imap_stream, $id, $ent_num);
    324. 

  324.         $body = decodeBody($body, $body_message->header->encoding);
    325. 

  325. 

  326.         if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
    327. 

  327.                 function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
    328. 

  328.             if (mb_detect_encoding($body) != 'ASCII') {
    329. 

  329.                 $body = $languages[$squirrelmail_language]['XTRA_CODE']('decode', $body);
    330. 

  330.             }
    331. 

  331.         }
    332. 

  332.         $hookResults = do_hook("message_body", $body);
    333. 

  333.         $body = $hookResults[1];
    334. 

  334. 

  335.         /* If there are other types that shouldn't be formatted, add
    336. 

  336.          * them here.
    337. 

  337.          */
    338. 

  338. 

  339.         if ($body_message->header->type1 == 'html') {
    340. 

  340.             if ($show_html_default <> 1) {
    341. 

  341.                 $entity_conv = array('&nbsp;' => ' ',
    342. 

  342.                                      '<p>'    => "\n",
    343. 

  343.                                      '<P>'    => "\n",
    344. 

  344.                                      '<br>'   => "\n",
    345. 

  345.                                      '<BR>'   => "\n",
    346. 

  346.                                      '<br />' => "\n",
    347. 

  347.                                      '<BR />' => "\n",
    348. 

  348.                                      '&gt;'   => '>',
    349. 

  349.                                      '&lt;'   => '<');
    350. 

  350.                 $body = strtr($body, $entity_conv);
    351. 

  351.                 $body = strip_tags($body);
    352. 

  352.                 $body = trim($body);
    353. 

  353.                 translateText($body, $wrap_at,
    354. 

  354.                         $body_message->header->getParameter('charset'));
    355. 

  355.             } else {
    356. 

  356.                 $charset = $body_message->header->getParameter('charset');
    357. 

  357.                 if (!empty($charset))
    358. 

  358.                     $body = charset_decode($charset,$body,false,true);
    359. 

  359.                 $body = magicHTML($body, $id, $message, $mailbox);
    360. 

  360.             }
    361. 

  361.         } else {
    362. 

  362.             translateText($body, $wrap_at,
    363. 

  363.                     $body_message->header->getParameter('charset'));
    364. 

  364.         }
    365. 

  365. 

  366.         // if this is the clean display (i.e. printer friendly), stop here.
    367. 

  367.         if ( $clean ) {
    368. 

  368.             return $body;
    369. 

  369.         }
    370. 

  370. 

  371.         $download_and_unsafe_link = '';
    372. 

  372. 

  373.         $link = 'passed_id=' . $id . '&amp;ent_id='.$ent_num.
    374. 

  374.             '&amp;mailbox=' . $urlmailbox .'&amp;sort=' . $sort .
    375. 

  375.             '&amp;startMessage=' . $startMessage . '&amp;show_more=0';
    376. 

  376.         if (isset($passed_ent_id)) {
    377. 

  377.             $link .= '&amp;passed_ent_id='.$passed_ent_id;
    378. 

  378.         }
    379. 

  379.         $download_and_unsafe_link .= '&nbsp;|&nbsp;<a href="download.php?absolute_dl=true&amp;' .
    380. 

  380.             $link . '">' . _("Download this as a file") .  '</a>';
    381. 

  381.         if ($view_unsafe_images) {
    382. 

  382.             $text = _("Hide Unsafe Images");
    383. 

  383.         } else {
    384. 

  384.             if (isset($has_unsafe_images) && $has_unsafe_images) {
    385. 

  385.                 $link .= '&amp;view_unsafe_images=1';
    386. 

  386.                 $text = _("View Unsafe Images");
    387. 

  387.             } else {
    388. 

  388.                 $text = '';
    389. 

  389.             }
    390. 

  390.         }
    391. 

  391.         if($text != '') {
    392. 

  392.             $download_and_unsafe_link .= '&nbsp;|&nbsp;<a href="read_body.php?' . $link . '">' . $text . '</a>';
    393. 

  393.         }
    394. 

  394.     }
    395. 

  395.     return $body;
    396. 

  396. }
    397. 

  397. 

  398. 

  399. function formatAttachments($message, $exclude_id, $mailbox, $id) {
    400. 

  400.     global $where, $what, $startMessage, $color, $passed_ent_id;
    401. 

  401.     static $ShownHTML = 0;
    402. 

  402. 

  403.     $att_ar = $message->getAttachments($exclude_id);
    404. 

  404. 

  405.     if (!count($att_ar)) return '';
    406. 

  406. 

  407.     $attachments = '';
    408. 

  408. 

  409.     $urlMailbox = urlencode($mailbox);
    410. 

  410. 

  411.     foreach ($att_ar as $att) {
    412. 

  412.         $ent = $att->entity_id;
    413. 

  413.         $header = $att->header;
    414. 

  414.         $type0 = strtolower($header->type0);
    415. 

  415.         $type1 = strtolower($header->type1);
    416. 

  416.         $name = '';
    417. 

  417.         $links['download link']['text'] = _("Download");
    418. 

  418.         $links['download link']['href'] = SM_PATH .
    419. 

  419.             "src/download.php?absolute_dl=true&amp;passed_id=$id&amp;mailbox=$urlMailbox&amp;ent_id=$ent";
    420. 

  420.         $ImageURL = '';
    421. 

  421.         if ($type0 =='message' && $type1 == 'rfc822') {
    422. 

  422.             $default_page = SM_PATH . 'src/read_body.php';
    423. 

  423.             $rfc822_header = $att->rfc822_header;
    424. 

  424.             $filename = $rfc822_header->subject;
    425. 

  425.             if (trim( $filename ) == '') {
    426. 

  426.                 $filename = 'untitled-[' . $ent . ']' ;
    427. 

  427.             }
    428. 

  428.             $from_o = $rfc822_header->from;
    429. 

  429.             if (is_object($from_o)) {
    430. 

  430.                 $from_name = $from_o->getAddress(false);
    431. 

  431.             } elseif (is_array($from_o) && count($from_o) && is_object($from_o[0])) {
    432. 

  432.                 // when a digest message is opened and you return to the digest
    433. 

  433.                 // now the from object is part of an array. This is a workaround.
    434. 

  434.                 $from_name = $from_o[0]->getAddress(false);
    435. 

  435.             } else {
    436. 

  436.                 $from_name = _("Unknown sender");
    437. 

  437.             }
    438. 

  438.             $from_name = decodeHeader(($from_name));
    439. 

  439.             $description = $from_name;
    440. 

  440.         } else {
    441. 

  441.             $default_page = SM_PATH . 'src/download.php';
    442. 

  442.             if (is_object($header->disposition)) {
    443. 

  443.                 $filename = $header->disposition->getProperty('filename');
    444. 

  444.                 if (trim($filename) == '') {
    445. 

  445.                     $name = decodeHeader($header->disposition->getProperty('name'));
    446. 

  446.                     if (trim($name) == '') {
    447. 

  447.                         $name = $header->getParameter('name');
    448. 

  448.                         if(trim($name) == '') {
    449. 

  449.                             if (trim( $header->id ) == '') {
    450. 

  450.                                 $filename = 'untitled-[' . $ent . ']' ;
    451. 

  451.                             } else {
    452. 

  452.                                 $filename = 'cid: ' . $header->id;
    453. 

  453.                             }
    454. 

  454.                         } else {
    455. 

  455.                             $filename = $name;
    456. 

  456.                         }
    457. 

  457.                     } else {
    458. 

  458.                         $filename = $name;
    459. 

  459.                     }
    460. 

  460.                 }
    461. 

  461.             } else {
    462. 

  462.                 $filename = $header->getParameter('name');
    463. 

  463.                 if (!trim($filename)) {
    464. 

  464.                     if (trim( $header->id ) == '') {
    465. 

  465.                         $filename = 'untitled-[' . $ent . ']' ;
    466. 

  466.                     } else {
    467. 

  467.                         $filename = 'cid: ' . $header->id;
    468. 

  468.                     }
    469. 

  469.                 }
    470. 

  470.             }
    471. 

  471.             if ($header->description) {
    472. 

  472.                 $description = decodeHeader($header->description);
    473. 

  473.             } else {
    474. 

  474.                 $description = '';
    475. 

  475.             }
    476. 

  476.         }
    477. 

  477. 

  478.         $display_filename = $filename;
    479. 

  479.         if (isset($passed_ent_id)) {
    480. 

  480.             $passed_ent_id_link = '&amp;passed_ent_id='.$passed_ent_id;
    481. 

  481.         } else {
    482. 

  482.             $passed_ent_id_link = '';
    483. 

  483.         }
    484. 

  484.         $defaultlink = $default_page . "?startMessage=$startMessage"
    485. 

  485.             . "&amp;passed_id=$id&amp;mailbox=$urlMailbox"
    486. 

  486.             . '&amp;ent_id='.$ent.$passed_ent_id_link;
    487. 

  487.         if ($where && $what) {
    488. 

  488.            $defaultlink .= '&amp;where='. urlencode($where).'&amp;what='.urlencode($what);
    489. 

  489.         }
    490. 

  490.         // IE does make use of mime content sniffing. Forcing a download
    491. 

  491.         // prohibit execution of XSS inside an application/octet-stream attachment
    492. 

  492.         if ($type0 == 'application' && $type1 == 'octet-stream') {
    493. 

  493.             $defaultlink .= '&amp;absolute_dl=true';
    494. 

  494.         }
    495. 

  495.         /* This executes the attachment hook with a specific MIME-type.
    496. 

  496.          * If that doesn't have results, it tries if there's a rule
    497. 

  497.          * for a more generic type. Finally, a hook for ALL attachment
    498. 

  498.          * types is run as well.
    499. 

  499.          */
    500. 

  500.         $hookresults = do_hook("attachment $type0/$type1", $links,
    501. 

  501.                 $startMessage, $id, $urlMailbox, $ent, $defaultlink,
    502. 

  502.                 $display_filename, $where, $what);
    503. 

  503.         if(count($hookresults[1]) <= 1) {
    504. 

  504.             $hookresults = do_hook("attachment $type0/*", $links,
    505. 

  505.                     $startMessage, $id, $urlMailbox, $ent, $defaultlink,
    506. 

  506.                     $display_filename, $where, $what);
    507. 

  507.         }
    508. 

  508.         $hookresults = do_hook("attachment */*", $hookresults[1],
    509. 

  509.                 $startMessage, $id, $urlMailbox, $ent, $hookresults[6],
    510. 

  510.                 $display_filename, $where, $what);
    511. 

  511. 

  512.         $links = $hookresults[1];
    513. 

  513.         $defaultlink = $hookresults[6];
    514. 

  514. 

  515.         $attachments .= '<tr><td>' .
    516. 

  516.             '<a href="'.$defaultlink.'">'.decodeHeader($display_filename).'</a>&nbsp;</td>' .
    517. 

  517.             '<td><small><b>' . show_readable_size($header->size) .
    518. 

  518.             '</b>&nbsp;&nbsp;</small></td>' .
    519. 

  519.             '<td><small>[ '.htmlspecialchars($type0).'/'.htmlspecialchars($type1).' ]&nbsp;</small></td>' .
    520. 

  520.             '<td><small>';
    521. 

  521.         $attachments .= '<b>' . $description . '</b>';
    522. 

  522.         $attachments .= '</small></td><td><small>&nbsp;';
    523. 

  523. 

  524.         $skipspaces = 1;
    525. 

  525.         foreach ($links as $val) {
    526. 

  526.             if ($skipspaces) {
    527. 

  527.                 $skipspaces = 0;
    528. 

  528.             } else {
    529. 

  529.                 $attachments .= '&nbsp;&nbsp;|&nbsp;&nbsp;';
    530. 

  530.             }
    531. 

  531.             $attachments .= '<a href="' . $val['href'] . '">' .  $val['text'] . '</a>';
    532. 

  532.         }
    533. 

  533.         unset($links);
    534. 

  534.         $attachments .= "</td></tr>\n";
    535. 

  535.     }
    536. 

  536.     return $attachments;
    537. 

  537. }
    538. 

  538. 

  539. function sqimap_base64_decode(&$string) {
    540. 

  540. 

  541.     // Base64 encoded data goes in pairs of 4 bytes. To achieve on the
    542. 

  542.     // fly decoding (to reduce memory usage) you have to check if the
    543. 

  543.     // data has incomplete pairs
    544. 

  544. 

  545.     // Remove the noise in order to check if the 4 bytes pairs are complete
    546. 

  546.     $string = str_replace(array("\r\n","\n", "\r", " "),array('','','',''),$string);
    547. 

  547. 

  548.     $sStringRem = '';
    549. 

  549.     $iMod = strlen($string) % 4;
    550. 

  550.     if ($iMod) {
    551. 

  551.         $sStringRem = substr($string,-$iMod);
    552. 

  552.         // Check if $sStringRem contains padding characters
    553. 

  553.         if (substr($sStringRem,-1) != '=') {
    554. 

  554.             $string = substr($string,0,-$iMod);
    555. 

  555.         } else {
    556. 

  556.             $sStringRem = '';
    557. 

  557.         }
    558. 

  558.     }
    559. 

  559.     $string = base64_decode($string);
    560. 

  560.     return $sStringRem;
    561. 

  561. }
    562. 

  562. 

  563. /**
    564. 

  564.  * Decodes encoded message body
    565. 

  565.  *
    566. 

  566.  * This function decodes the body depending on the encoding type.
    567. 

  567.  * Currently quoted-printable and base64 encodings are supported.
    568. 

  568.  * decode_body hook was added to this function in 1.4.2/1.5.0
    569. 

  569.  * @param string $body encoded message body
    570. 

  570.  * @param string $encoding used encoding
    571. 

  571.  * @return string decoded string
    572. 

  572.  * @since 1.0
    573. 

  573.  */
    574. 

  574. function decodeBody($body, $encoding) {
    575. 

  575. 

  576.     $body = str_replace("\r\n", "\n", $body);
    577. 

  577.     $encoding = strtolower($encoding);
    578. 

  578. 

  579.     $encoding_handler = do_hook_function('decode_body', $encoding);
    580. 

  580. 

  581.     // plugins get first shot at decoding the body
    582. 

  582.     if (!empty($encoding_handler) && function_exists($encoding_handler)) {
    583. 

  583.         $body = $encoding_handler('decode', $body);
    584. 

  584. 

  585.     } elseif ($encoding == 'quoted-printable' ||
    586. 

  586.             $encoding == 'quoted_printable') {
    587. 

  587.         /**
    588. 

  588.          * quoted_printable_decode() function is broken in older
    589. 

  589.          * php versions. Text with \r\n decoding was fixed only
    590. 

  590.          * in php 4.3.0. Minimal code requirement 4.0.4 +
    591. 

  591.          * str_replace("\r\n", "\n", $body); call.
    592. 

  592.          */
    593. 

  593.         $body = quoted_printable_decode($body);
    594. 

  594.     } elseif ($encoding == 'base64') {
    595. 

  595.         $body = base64_decode($body);
    596. 

  596.     }
    597. 

  597. 

  598.     // All other encodings are returned raw.
    599. 

  599.     return $body;
    600. 

  600. }
    601. 

  601. 

  602. /**
    603. 

  603.  * Decodes headers
    604. 

  604.  *
    605. 

  605.  * This functions decode strings that is encoded according to
    606. 

  606.  * RFC1522 (MIME Part Two: Message Header Extensions for Non-ASCII Text).
    607. 

  607.  * Patched by Christian Schmidt <christian@ostenfeld.dk>  23/03/2002
    608. 

  608.  */
    609. 

  609. function decodeHeader ($string, $utfencode=true,$htmlsave=true,$decide=false) {
    610. 

  610.     global $languages, $squirrelmail_language,$default_charset;
    611. 

  611.     if (is_array($string)) {
    612. 

  612.         $string = implode("\n", $string);
    613. 

  613.     }
    614. 

  614. 

  615.     if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
    616. 

  616.             function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
    617. 

  617.         $string = $languages[$squirrelmail_language]['XTRA_CODE']('decodeheader', $string);
    618. 

  618.         // Do we need to return at this point?
    619. 

  619.         // return $string;
    620. 

  620.     }
    621. 

  621.     $i = 0;
    622. 

  622.     $iLastMatch = -2;
    623. 

  623.     $encoded = false;
    624. 

  624. 

  625.     $aString = explode(' ',$string);
    626. 

  626.     $ret = '';
    627. 

  627.     foreach ($aString as $chunk) {
    628. 

  628.         if ($encoded && $chunk === '') {
    629. 

  629.             continue;
    630. 

  630.         } elseif ($chunk === '') {
    631. 

  631.             $ret .= ' ';
    632. 

  632.             continue;
    633. 

  633.         }
    634. 

  634.         $encoded = false;
    635. 

  635.         /* if encoded words are not separated by a linear-space-white we still catch them */
    636. 

  636.         $j = $i-1;
    637. 

  637. 

  638.         while ($match = preg_match('/^(.*)=\?([^?]*)\?(Q|B)\?([^?]*)\?=(.*)$/Ui',$chunk,$res)) {
    639. 

  639.             /* if the last chunk isn't an encoded string then put back the space, otherwise don't */
    640. 

  640.             if ($iLastMatch !== $j) {
    641. 

  641.                 if ($htmlsave) {
    642. 

  642.                     $ret .= '&#32;';
    643. 

  643.                 } else {
    644. 

  644.                     $ret .= ' ';
    645. 

  645.                 }
    646. 

  646.             }
    647. 

  647.             $iLastMatch = $i;
    648. 

  648.             $j = $i;
    649. 

  649.             if ($htmlsave) {
    650. 

  650.                 $ret .= htmlspecialchars($res[1]);
    651. 

  651.             } else {
    652. 

  652.                 $ret .= $res[1];
    653. 

  653.             }
    654. 

  654.             $encoding = ucfirst($res[3]);
    655. 

  655. 

  656.             /* decide about valid decoding */
    657. 

  657.             if ($decide && is_conversion_safe($res[2])) {
    658. 

  658.                 $can_be_encoded=true;
    659. 

  659.             } else {
    660. 

  660.                 $can_be_encoded=false;
    661. 

  661.             }
    662. 

  662. 

  663.             switch ($encoding)
    664. 

  664.             {
    665. 

  665.                 case 'B':
    666. 

  666.                     $replace = base64_decode($res[4]);
    667. 

  667.                     if ($can_be_encoded) {
    668. 

  668.                         // string is converted from one charset to another. sanitizing depends on $htmlsave
    669. 

  669.                         $replace =  charset_convert($res[2],$replace,$default_charset,$htmlsave);
    670. 

  670.                     } elseif ($utfencode) {
    671. 

  671.                         // string is converted to htmlentities and sanitized
    672. 

  672.                         $replace = charset_decode($res[2],$replace);
    673. 

  673.                     } elseif ($htmlsave) {
    674. 

  674.                         // string is not converted, but still sanitized
    675. 

  675.                         $replace = htmlspecialchars($replace);
    676. 

  676.                     }
    677. 

  677.                     $ret.= $replace;
    678. 

  678.                     break;
    679. 

  679.                 case 'Q':
    680. 

  680.                     $replace = str_replace('_', ' ', $res[4]);
    681. 

  681.                     $replace = preg_replace('/=([0-9a-f]{2})/ie', 'chr(hexdec("\1"))',
    682. 

  682.                             $replace);
    683. 

  683.                     if ($can_be_encoded) {
    684. 

  684.                         // string is converted from one charset to another. sanitizing depends on $htmlsave
    685. 

  685.                         $replace = charset_convert($res[2], $replace,$default_charset,$htmlsave);
    686. 

  686.                     } elseif ($utfencode) {
    687. 

  687.                         // string is converted to html entities and sanitized
    688. 

  688.                         $replace = charset_decode($res[2], $replace);
    689. 

  689.                     } elseif ($htmlsave) {
    690. 

  690.                         // string is not converted, but still sanizited
    691. 

  691.                         $replace = htmlspecialchars($replace);
    692. 

  692.                     }
    693. 

  693.                     $ret .= $replace;
    694. 

  694.                     break;
    695. 

  695.                 default:
    696. 

  696.                     break;
    697. 

  697.             }
    698. 

  698.             $chunk = $res[5];
    699. 

  699.             $encoded = true;
    700. 

  700.         }
    701. 

  701.         if (!$encoded) {
    702. 

  702.             if ($htmlsave) {
    703. 

  703.                 $ret .= '&#32;';
    704. 

  704.             } else {
    705. 

  705.                 $ret .= ' ';
    706. 

  706.             }
    707. 

  707.         }
    708. 

  708. 

  709.         if (!$encoded && $htmlsave) {
    710. 

  710.             $ret .= htmlspecialchars($chunk);
    711. 

  711.         } else {
    712. 

  712.             $ret .= $chunk;
    713. 

  713.         }
    714. 

  714.         ++$i;
    715. 

  715.     }
    716. 

  716.     /* remove the first added space */
    717. 

  717.     if ($ret) {
    718. 

  718.         if ($htmlsave) {
    719. 

  719.             $ret = substr($ret,5);
    720. 

  720.         } else {
    721. 

  721.             $ret = substr($ret,1);
    722. 

  722.         }
    723. 

  723.     }
    724. 

  724. 

  725.     return $ret;
    726. 

  726. }
    727. 

  727. 

  728. /**
    729. 

  729.  * Encodes header as quoted-printable
    730. 

  730.  *
    731. 

  731.  * Encode a string according to RFC 1522 for use in headers if it
    732. 

  732.  * contains 8-bit characters or anything that looks like it should
    733. 

  733.  * be encoded.
    734. 

  734.  */
    735. 

  735. function encodeHeader ($string) {
    736. 

  736.     global $default_charset, $languages, $squirrelmail_language;
    737. 

  737. 

  738.     if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
    739. 

  739.             function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
    740. 

  740.         return  $languages[$squirrelmail_language]['XTRA_CODE']('encodeheader', $string);
    741. 

  741.     }
    742. 

  742. 

  743.     // Use B encoding for multibyte charsets
    744. 

  744.     $mb_charsets = array('utf-8','big5','gb2313','euc-kr');
    745. 

  745.     if (in_array($default_charset,$mb_charsets) &&
    746. 

  746.         in_array($default_charset,sq_mb_list_encodings()) &&
    747. 

  747.         sq_is8bit($string)) {
    748. 

  748.         return encodeHeaderBase64($string,$default_charset);
    749. 

  749.     } elseif (in_array($default_charset,$mb_charsets) &&
    750. 

  750.               sq_is8bit($string) &&
    751. 

  751.               ! in_array($default_charset,sq_mb_list_encodings())) {
    752. 

  752.         // Add E_USER_NOTICE error here (can cause 'Cannot add header information' warning in compose.php)
    753. 

  753.         // trigger_error('encodeHeader: Multibyte character set unsupported by mbstring extension.',E_USER_NOTICE);
    754. 

  754.     }
    755. 

  755. 

  756.     // Encode only if the string contains 8-bit characters or =?
    757. 

  757.     $j = strlen($string);
    758. 

  758.     $max_l = 75 - strlen($default_charset) - 7;
    759. 

  759.     $aRet = array();
    760. 

  760.     $ret = '';
    761. 

  761.     $iEncStart = $enc_init = false;
    762. 

  762.     $cur_l = $iOffset = 0;
    763. 

  763.     for($i = 0; $i < $j; ++$i) {
    764. 

  764.         switch($string{$i})
    765. 

  765.         {
    766. 

  766.             case '=':
    767. 

  767.             case '<':
    768. 

  768.             case '>':
    769. 

  769.             case ',':
    770. 

  770.             case '?':
    771. 

  771.             case '_':
    772. 

  772.                 if ($iEncStart === false) {
    773. 

  773.                     $iEncStart = $i;
    774. 

  774.                 }
    775. 

  775.                 $cur_l+=3;
    776. 

  776.                 if ($cur_l > ($max_l-2)) {
    777. 

  777.                     /* if there is an stringpart that doesn't need encoding, add it */
    778. 

  778.                     $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
    779. 

  779.                     $aRet[] = "=?$default_charset?Q?$ret?=";
    780. 

  780.                     $iOffset = $i;
    781. 

  781.                     $cur_l = 0;
    782. 

  782.                     $ret = '';
    783. 

  783.                     $iEncStart = false;
    784. 

  784.                 } else {
    785. 

  785.                     $ret .= sprintf("=%02X",ord($string{$i}));
    786. 

  786.                 }
    787. 

  787.                 break;
    788. 

  788.             case '(':
    789. 

  789.             case ')':
    790. 

  790.                 if ($iEncStart !== false) {
    791. 

  791.                     $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
    792. 

  792.                     $aRet[] = "=?$default_charset?Q?$ret?=";
    793. 

  793.                     $iOffset = $i;
    794. 

  794.                     $cur_l = 0;
    795. 

  795.                     $ret = '';
    796. 

  796.                     $iEncStart = false;
    797. 

  797.                 }
    798. 

  798.                 break;
    799. 

  799.             case ' ':
    800. 

  800.                 if ($iEncStart !== false) {
    801. 

  801.                     $cur_l++;
    802. 

  802.                     if ($cur_l > $max_l) {
    803. 

  803.                         $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
    804. 

  804.                         $aRet[] = "=?$default_charset?Q?$ret?=";
    805. 

  805.                         $iOffset = $i;
    806. 

  806.                         $cur_l = 0;
    807. 

  807.                         $ret = '';
    808. 

  808.                         $iEncStart = false;
    809. 

  809.                     } else {
    810. 

  810.                         $ret .= '_';
    811. 

  811.                     }
    812. 

  812.                 }
    813. 

  813.                 break;
    814. 

  814.             default:
    815. 

  815.                 $k = ord($string{$i});
    816. 

  816.                 if ($k > 126) {
    817. 

  817.                     if ($iEncStart === false) {
    818. 

  818.                         // do not start encoding in the middle of a string, also take the rest of the word.
    819. 

  819.                         $sLeadString = substr($string,0,$i);
    820. 

  820.                         $aLeadString = explode(' ',$sLeadString);
    821. 

  821.                         $sToBeEncoded = array_pop($aLeadString);
    822. 

  822.                         $iEncStart = $i - strlen($sToBeEncoded);
    823. 

  823.                         $ret .= $sToBeEncoded;
    824. 

  824.                         $cur_l += strlen($sToBeEncoded);
    825. 

  825.                     }
    826. 

  826.                     $cur_l += 3;
    827. 

  827.                     /* first we add the encoded string that reached it's max size */
    828. 

  828.                     if ($cur_l > ($max_l-2)) {
    829. 

  829.                         $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
    830. 

  830.                         $aRet[] = "=?$default_charset?Q?$ret?= "; /* the next part is also encoded => separate by space */
    831. 

  831.                         $cur_l = 3;
    832. 

  832.                         $ret = '';
    833. 

  833.                         $iOffset = $i;
    834. 

  834.                         $iEncStart = $i;
    835. 

  835.                     }
    836. 

  836.                     $enc_init = true;
    837. 

  837.                     $ret .= sprintf("=%02X", $k);
    838. 

  838.                 } else {
    839. 

  839.                     if ($iEncStart !== false) {
    840. 

  840.                         $cur_l++;
    841. 

  841.                         if ($cur_l > $max_l) {
    842. 

  842.                             $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
    843. 

  843.                             $aRet[] = "=?$default_charset?Q?$ret?=";
    844. 

  844.                             $iEncStart = false;
    845. 

  845.                             $iOffset = $i;
    846. 

  846.                             $cur_l = 0;
    847. 

  847.                             $ret = '';
    848. 

  848.                         } else {
    849. 

  849.                             $ret .= $string{$i};
    850. 

  850.                         }
    851. 

  851.                     }
    852. 

  852.                 }
    853. 

  853.                 break;
    854. 

  854.         }
    855. 

  855.     }
    856. 

  856. 

  857.     if ($enc_init) {
    858. 

  858.         if ($iEncStart !== false) {
    859. 

  859.             $aRet[] = substr($string,$iOffset,$iEncStart-$iOffset);
    860. 

  860.             $aRet[] = "=?$default_charset?Q?$ret?=";
    861. 

  861.         } else {
    862. 

  862.             $aRet[] = substr($string,$iOffset);
    863. 

  863.         }
    864. 

  864.         $string = implode('',$aRet);
    865. 

  865.     }
    866. 

  866.     return $string;
    867. 

  867. }
    868. 

  868. 

  869. /**
    870. 

  870.  * Encodes string according to rfc2047 B encoding header formating rules
    871. 

  871.  *
    872. 

  872.  * It is recommended way to encode headers with character sets that store
    873. 

  873.  * symbols in more than one byte.
    874. 

  874.  *
    875. 

  875.  * Function requires mbstring support. If required mbstring functions are missing,
    876. 

  876.  * function returns false and sets E_USER_WARNING level error message.
    877. 

  877.  *
    878. 

  878.  * Minimal requirements - php 4.0.6 with mbstring extension. Please note,
    879. 

  879.  * that mbstring functions will generate E_WARNING errors, if unsupported
    880. 

  880.  * character set is used. mb_encode_mimeheader function provided by php
    881. 

  881.  * mbstring extension is not used in order to get better control of header
    882. 

  882.  * encoding.
    883. 

  883.  *
    884. 

  884.  * Used php code functions - function_exists(), trigger_error(), strlen()
    885. 

  885.  * (is used with charset names and base64 strings). Used php mbstring
    886. 

  886.  * functions - mb_strlen and mb_substr.
    887. 

  887.  *
    888. 

  888.  * Related documents: rfc 2045 (BASE64 encoding), rfc 2047 (mime header
    889. 

  889.  * encoding), rfc 2822 (header folding)
    890. 

  890.  *
    891. 

  891.  * @param string $string header string that must be encoded
    892. 

  892.  * @param string $charset character set. Must be supported by mbstring extension.
    893. 

  893.  * Use sq_mb_list_encodings() to detect supported charsets.
    894. 

  894.  * @return string string encoded according to rfc2047 B encoding formating rules
    895. 

  895.  * @since 1.5.1 and 1.4.6
    896. 

  896.  */
    897. 

  897. function encodeHeaderBase64($string,$charset) {
    898. 

  898.     /**
    899. 

  899.      * Check mbstring function requirements.
    900. 

  900.      */
    901. 

  901.     if (! function_exists('mb_strlen') ||
    902. 

  902.         ! function_exists('mb_substr')) {
    903. 

  903.         // set E_USER_WARNING
    904. 

  904.         trigger_error('encodeHeaderBase64: Required mbstring functions are missing.',E_USER_WARNING);
    905. 

  905.         // return false
    906. 

  906.         return false;
    907. 

  907.     }
    908. 

  908. 

  909.     // initial return array
    910. 

  910.     $aRet = array();
    911. 

  911. 

  912.     /**
    913. 

  913.      * header length = 75 symbols max (same as in encodeHeader)
    914. 

  914.      * remove $charset length
    915. 

  915.      * remove =? ? ?= (5 chars)
    916. 

  916.      * remove 2 more chars (\r\n ?)
    917. 

  917.      */
    918. 

  918.     $iMaxLength = 75 - strlen($charset) - 7;
    919. 

  919. 

  920.     // set first character position
    921. 

  921.     $iStartCharNum = 0;
    922. 

  922. 

  923.     // loop through all characters. count characters and not bytes.
    924. 

  924.     for ($iCharNum=1; $iCharNum<=mb_strlen($string,$charset); $iCharNum++) {
    925. 

  925.         // encode string from starting character to current character.
    926. 

  926.         $encoded_string = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum,$charset));
    927. 

  927. 

  928.         // Check encoded string length
    929. 

  929.         if(strlen($encoded_string)>$iMaxLength) {
    930. 

  930.             // if string exceeds max length, reduce number of encoded characters and add encoded string part to array
    931. 

  931.             $aRet[] = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum-1,$charset));
    932. 

  932. 

  933.             // set new starting character
    934. 

  934.             $iStartCharNum = $iCharNum-1;
    935. 

  935. 

  936.             // encode last char (in case it is last character in string)
    937. 

  937.             $encoded_string = base64_encode(mb_substr($string,$iStartCharNum,$iCharNum-$iStartCharNum,$charset));
    938. 

  938.         } // if string is shorter than max length - add next character
    939. 

  939.     }
    940. 

  940. 

  941.     // add last encoded string to array
    942. 

  942.     $aRet[] = $encoded_string;
    943. 

  943. 

  944.     // set initial return string
    945. 

  945.     $sRet = '';
    946. 

  946. 

  947.     // loop through encoded strings
    948. 

  948.     foreach($aRet as $string) {
    949. 

  949.         // TODO: Do we want to control EOL (end-of-line) marker
    950. 

  950.         if ($sRet!='') $sRet.= " ";
    951. 

  951. 

  952.         // add header tags and encoded string to return string
    953. 

  953.         $sRet.= '=?'.$charset.'?B?'.$string.'?=';
    954. 

  954.     }
    955. 

  955. 

  956.     return $sRet;
    957. 

  957. }
    958. 

  958. 

  959. /* This function trys to locate the entity_id of a specific mime element */
    960. 

  960. function find_ent_id($id, $message) {
    961. 

  961.     for ($i = 0, $ret = ''; $ret == '' && $i < count($message->entities); $i++) {
    962. 

  962.         if ($message->entities[$i]->header->type0 == 'multipart')  {
    963. 

  963.             $ret = find_ent_id($id, $message->entities[$i]);
    964. 

  964.         } else {
    965. 

  965.             if (strcasecmp($message->entities[$i]->header->id, $id) == 0) {
    966. 

  966. //                if (sq_check_save_extension($message->entities[$i])) {
    967. 

  967.                 return $message->entities[$i]->entity_id;
    968. 

  968. //                }
    969. 

  969.             } elseif (!empty($message->entities[$i]->header->parameters['name'])) {
    970. 

  970.                 /**
    971. 

  971.                  * This is part of a fix for Outlook Express 6.x generating
    972. 

  972.                  * cid URLs without creating content-id headers
    973. 

  973.                  * @@JA - 20050207
    974. 

  974.                  */
    975. 

  975.                 if (strcasecmp($message->entities[$i]->header->parameters['name'], $id) == 0) {
    976. 

  976.                     return $message->entities[$i]->entity_id;
    977. 

  977.                 }
    978. 

  978.             }
    979. 

  979.         }
    980. 

  980.     }
    981. 

  981.     return $ret;
    982. 

  982. }
    983. 

  983. 

  984. function sq_check_save_extension($message) {
    985. 

  985.     $filename = $message->getFilename();
    986. 

  986.     $ext = substr($filename, strrpos($filename,'.')+1);
    987. 

  987.     $save_extensions = array('jpg','jpeg','gif','png','bmp');
    988. 

  988.     return in_array($ext, $save_extensions);
    989. 

  989. }
    990. 

  990. 

  991. 

  992. /**
    993. 

  993.  ** HTMLFILTER ROUTINES
    994. 

  994.  */
    995. 

  995. 

  996. /**
    997. 

  997.  * This function checks attribute values for entity-encoded values
    998. 

  998.  * and returns them translated into 8-bit strings so we can run
    999. 

  999.  * checks on them.
    1000. 

  1000.  *
    1001. 

  1001.  * @param  $attvalue A string to run entity check against.
    1002. 

  1002.  * @return           Nothing, modifies a reference value.
    1003. 

  1003.  */
    1004. 

  1004. function sq_defang(&$attvalue){
    1005. 

  1005.     $me = 'sq_defang';
    1006. 

  1006.     /**
    1007. 

  1007.      * Skip this if there aren't ampersands or backslashes.
    1008. 

  1008.      */
    1009. 

  1009.     if (strpos($attvalue, '&') === false
    1010. 

  1010.         && strpos($attvalue, '\\') === false){
    1011. 

  1011.         return;
    1012. 

  1012.     }
    1013. 

  1013.     $m = false;
    1014. 

  1014.     do {
    1015. 

  1015.         $m = false;
    1016. 

  1016.         $m = $m || sq_deent($attvalue, '/\&#0*(\d+);*/s');
    1017. 

  1017.         $m = $m || sq_deent($attvalue, '/\&#x0*((\d|[a-f])+);*/si', true);
    1018. 

  1018.         $m = $m || sq_deent($attvalue, '/\\\\(\d+)/s', true);
    1019. 

  1019.     } while ($m == true);
    1020. 

  1020.     $attvalue = stripslashes($attvalue);
    1021. 

  1021. }
    1022. 

  1022. 

  1023. /**
    1024. 

  1024.  * Kill any tabs, newlines, or carriage returns. Our friends the
    1025. 

  1025.  * makers of the browser with 95% market value decided that it'd
    1026. 

  1026.  * be funny to make "java[tab]script" be just as good as "javascript".
    1027. 

  1027.  *
    1028. 

  1028.  * @param  attvalue  The attribute value before extraneous spaces removed.
    1029. 

  1029.  * @return attvalue  Nothing, modifies a reference value.
    1030. 

  1030.  */
    1031. 

  1031. function sq_unspace(&$attvalue){
    1032. 

  1032.     $me = 'sq_unspace';
    1033. 

  1033.     if (strcspn($attvalue, "\t\r\n\0 ") != strlen($attvalue)){
    1034. 

  1034.         $attvalue = str_replace(Array("\t", "\r", "\n", "\0", " "),
    1035. 

  1035.                                 Array('',   '',   '',   '',   ''), $attvalue);
    1036. 

  1036.     }
    1037. 

  1037. }
    1038. 

  1038. 

  1039. /**
    1040. 

  1040.  * Translate all dangerous Unicode or Shift_JIS characters which are accepted by
    1041. 

  1041.  * IE as regular characters.
    1042. 

  1042.  *
    1043. 

  1043.  * @param  attvalue  The attribute value before dangerous characters are translated.
    1044. 

  1044.  * @return attvalue  Nothing, modifies a reference value.
    1045. 

  1045.  * @author Marc Groot Koerkamp.
    1046. 

  1046.  */
    1047. 

  1047. function sq_fixIE_idiocy(&$attvalue) {
    1048. 

  1048.     // remove NUL
    1049. 

  1049.     $attvalue = str_replace("\0", "", $attvalue);
    1050. 

  1050.     // remove comments
    1051. 

  1051.     $attvalue = preg_replace("/(\/\*.*?\*\/)/","",$attvalue);
    1052. 

  1052. 

  1053.     // IE has the evil habit of accepting every possible value for the attribute expression.
    1054. 

  1054.     // The table below contains characters which are parsed by IE if they are used in the "expression"
    1055. 

  1055.     // attribute value.
    1056. 

  1056.     $aDangerousCharsReplacementTable = array(
    1057. 

  1057.                         array('&#x029F;', '&#0671;' ,/* L UNICODE IPA Extension */
    1058. 

  1058.                               '&#x0280;', '&#0640;' ,/* R UNICODE IPA Extension */
    1059. 

  1059.                               '&#x0274;', '&#0628;' ,/* N UNICODE IPA Extension */
    1060. 

  1060.                               '&#xFF25;', '&#65317;' ,/* Unicode FULLWIDTH LATIN CAPITAL LETTER E */
    1061. 

  1061.                               '&#xFF45;', '&#65349;' ,/* Unicode FULLWIDTH LATIN SMALL LETTER E */
    1062. 

  1062.                               '&#xFF38;', '&#65336;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER X */
    1063. 

  1063.                               '&#xFF58;', '&#65368;',/* Unicode FULLWIDTH LATIN SMALL LETTER X */
    1064. 

  1064.                               '&#xFF30;', '&#65328;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER P */
    1065. 

  1065.                               '&#xFF50;', '&#65360;',/* Unicode FULLWIDTH LATIN SMALL LETTER P */
    1066. 

  1066.                               '&#xFF32;', '&#65330;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER R */
    1067. 

  1067.                               '&#xFF52;', '&#65362;',/* Unicode FULLWIDTH LATIN SMALL LETTER R */
    1068. 

  1068.                               '&#xFF33;', '&#65331;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER S */
    1069. 

  1069.                               '&#xFF53;', '&#65363;',/* Unicode FULLWIDTH LATIN SMALL LETTER S */
    1070. 

  1070.                               '&#xFF29;', '&#65321;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER I */
    1071. 

  1071.                               '&#xFF49;', '&#65353;',/* Unicode FULLWIDTH LATIN SMALL LETTER I */
    1072. 

  1072.                               '&#xFF2F;', '&#65327;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER O */
    1073. 

  1073.                               '&#xFF4F;', '&#65359;',/* Unicode FULLWIDTH LATIN SMALL LETTER O */
    1074. 

  1074.                               '&#xFF2E;', '&#65326;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER N */
    1075. 

  1075.                               '&#xFF4E;', '&#65358;',/* Unicode FULLWIDTH LATIN SMALL LETTER N */
    1076. 

  1076.                               '&#xFF2C;', '&#65324;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER L */
    1077. 

  1077.                               '&#xFF4C;', '&#65356;',/* Unicode FULLWIDTH LATIN SMALL LETTER L */
    1078. 

  1078.                               '&#xFF35;', '&#65333;',/* Unicode FULLWIDTH LATIN CAPITAL LETTER U */
    1079. 

  1079.                               '&#xFF55;', '&#65365;',/* Unicode FULLWIDTH LATIN SMALL LETTER U */
    1080. 

  1080.                               '&#x207F;', '&#8319;' ,/* Unicode SUPERSCRIPT LATIN SMALL LETTER N */
    1081. 

  1081.                               "\xEF\xBC\xA5", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER E */   // in unicode this is some Chinese char range
    1082. 

  1082.                               "\xEF\xBD\x85", /* Shift JIS FULLWIDTH LATIN SMALL LETTER E */
    1083. 

  1083.                               "\xEF\xBC\xB8", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER X */
    1084. 

  1084.                               "\xEF\xBD\x98", /* Shift JIS FULLWIDTH LATIN SMALL LETTER X */
    1085. 

  1085.                               "\xEF\xBC\xB0", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER P */
    1086. 

  1086.                               "\xEF\xBD\x90", /* Shift JIS FULLWIDTH LATIN SMALL LETTER P */
    1087. 

  1087.                               "\xEF\xBC\xB2", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER R */
    1088. 

  1088.                               "\xEF\xBD\x92", /* Shift JIS FULLWIDTH LATIN SMALL LETTER R */
    1089. 

  1089.                               "\xEF\xBC\xB3", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER S */
    1090. 

  1090.                               "\xEF\xBD\x93", /* Shift JIS FULLWIDTH LATIN SMALL LETTER S */
    1091. 

  1091.                               "\xEF\xBC\xA9", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER I */
    1092. 

  1092.                               "\xEF\xBD\x89", /* Shift JIS FULLWIDTH LATIN SMALL LETTER I */
    1093. 

  1093.                               "\xEF\xBC\xAF", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER O */
    1094. 

  1094.                               "\xEF\xBD\x8F", /* Shift JIS FULLWIDTH LATIN SMALL LETTER O */
    1095. 

  1095.                               "\xEF\xBC\xAE", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER N */
    1096. 

  1096.                               "\xEF\xBD\x8E", /* Shift JIS FULLWIDTH LATIN SMALL LETTER N */
    1097. 

  1097.                               "\xEF\xBC\xAC", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER L */
    1098. 

  1098.                               "\xEF\xBD\x8C", /* Shift JIS FULLWIDTH LATIN SMALL LETTER L */
    1099. 

  1099.                               "\xEF\xBC\xB5", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER U */
    1100. 

  1100.                               "\xEF\xBD\x95", /* Shift JIS FULLWIDTH LATIN SMALL LETTER U */
    1101. 

  1101.                               "\xE2\x81\xBF", /* Shift JIS FULLWIDTH SUPERSCRIPT N */
    1102. 

  1102.                               "\xCA\x9F", /* L UNICODE IPA Extension */
    1103. 

  1103.                               "\xCA\x80", /* R UNICODE IPA Extension */
    1104. 

  1104.                               "\xC9\xB4"),  /* N UNICODE IPA Extension */
    1105. 

  1105.                        array('l', 'l', 'r','r','n','n',
    1106. 

  1106.                              'E','E','e','e','X','X','x','x','P','P','p','p','R','R','r','r','S','S','s','s','I','I',
    1107. 

  1107.                              'i','i','O','O','o','o','N','N','n','n','L','L','l','l','U','U','u','u','n','n',
    1108. 

  1108.                              'E','e','X','x','P','p','R','r','S','s','I','i','O','o','N','n','L','l','U','u','n','l','r','n'));
    1109. 

  1109.     $attvalue = str_replace($aDangerousCharsReplacementTable[0],$aDangerousCharsReplacementTable[1],$attvalue);
    1110. 

  1110. 

  1111.     // Escapes are useful for special characters like "{}[]()'&. In other cases they are
    1112. 

  1112.     // used for XSS.
    1113. 

  1113.     $attvalue = preg_replace("/(\\\\)([a-zA-Z]{1})/",'$2',$attvalue);
    1114. 

  1114. }
    1115. 

  1115. 

  1116. /**
    1117. 

  1117.  * This function returns the final tag out of the tag name, an array
    1118. 

  1118.  * of attributes, and the type of the tag. This function is called by
    1119. 

  1119.  * sq_sanitize internally.
    1120. 

  1120.  *
    1121. 

  1121.  * @param  $tagname  the name of the tag.
    1122. 

  1122.  * @param  $attary   the array of attributes and their values
    1123. 

  1123.  * @param  $tagtype  The type of the tag (see in comments).
    1124. 

  1124.  * @return           a string with the final tag representation.
    1125. 

  1125.  */
    1126. 

  1126. function sq_tagprint($tagname, $attary, $tagtype){
    1127. 

  1127.     $me = 'sq_tagprint';
    1128. 

  1128. 

  1129.     if ($tagtype == 2){
    1130. 

  1130.         $fulltag = '</' . $tagname . '>';
    1131. 

  1131.     } else {
    1132. 

  1132.         $fulltag = '<' . $tagname;
    1133. 

  1133.         if (is_array($attary) && sizeof($attary)){
    1134. 

  1134.             $atts = Array();
    1135. 

  1135.             while (list($attname, $attvalue) = each($attary)){
    1136. 

  1136.                 array_push($atts, "$attname=$attvalue");
    1137. 

  1137.             }
    1138. 

  1138.             $fulltag .= ' ' . join(" ", $atts);
    1139. 

  1139.         }
    1140. 

  1140.         if ($tagtype == 3){
    1141. 

  1141.             $fulltag .= ' /';
    1142. 

  1142.         }
    1143. 

  1143.         $fulltag .= '>';
    1144. 

  1144.     }
    1145. 

  1145.     return $fulltag;
    1146. 

  1146. }
    1147. 

  1147. 

  1148. /**
    1149. 

  1149.  * A small helper function to use with array_walk. Modifies a by-ref
    1150. 

  1150.  * value and makes it lowercase.
    1151. 

  1151.  *
    1152. 

  1152.  * @param  $val a value passed by-ref.
    1153. 

  1153.  * @return      void since it modifies a by-ref value.
    1154. 

  1154.  */
    1155. 

  1155. function sq_casenormalize(&$val){
    1156. 

  1156.     $val = strtolower($val);
    1157. 

  1157. }
    1158. 

  1158. 

  1159. /**
    1160. 

  1160.  * This function skips any whitespace from the current position within
    1161. 

  1161.  * a string and to the next non-whitespace value.
    1162. 

  1162.  *
    1163. 

  1163.  * @param  $body   the string
    1164. 

  1164.  * @param  $offset the offset within the string where we should start
    1165. 

  1165.  *                 looking for the next non-whitespace character.
    1166. 

  1166.  * @return         the location within the $body where the next
    1167. 

  1167.  *                 non-whitespace char is located.
    1168. 

  1168.  */
    1169. 

  1169. function sq_skipspace($body, $offset){
    1170. 

  1170.     $me = 'sq_skipspace';
    1171. 

  1171.     preg_match('/^(\s*)/s', substr($body, $offset), $matches);
    1172. 

  1172.     if (sizeof($matches{1})){
    1173. 

  1173.         $count = strlen($matches{1});
    1174. 

  1174.         $offset += $count;
    1175. 

  1175.     }
    1176. 

  1176.     return $offset;
    1177. 

  1177. }
    1178. 

  1178. 

  1179. /**
    1180. 

  1180.  * This function looks for the next character within a string.  It's
    1181. 

  1181.  * really just a glorified "strpos", except it catches if failures
    1182. 

  1182.  * nicely.
    1183. 

  1183.  *
    1184. 

  1184.  * @param  $body   The string to look for needle in.
    1185. 

  1185.  * @param  $offset Start looking from this position.
    1186. 

  1186.  * @param  $needle The character/string to look for.
    1187. 

  1187.  * @return         location of the next occurance of the needle, or
    1188. 

  1188.  *                 strlen($body) if needle wasn't found.
    1189. 

  1189.  */
    1190. 

  1190. function sq_findnxstr($body, $offset, $needle){
    1191. 

  1191.     $me  = 'sq_findnxstr';
    1192. 

  1192.     $pos = strpos($body, $needle, $offset);
    1193. 

  1193.     if ($pos === FALSE){
    1194. 

  1194.         $pos = strlen($body);
    1195. 

  1195.     }
    1196. 

  1196.     return $pos;
    1197. 

  1197. }
    1198. 

  1198. 

  1199. /**
    1200. 

  1200.  * This function takes a PCRE-style regexp and tries to match it
    1201. 

  1201.  * within the string.
    1202. 

  1202.  *
    1203. 

  1203.  * @param  $body   The string to look for needle in.
    1204. 

  1204.  * @param  $offset Start looking from here.
    1205. 

  1205.  * @param  $reg    A PCRE-style regex to match.
    1206. 

  1206.  * @return         Returns a false if no matches found, or an array
    1207. 

  1207.  *                 with the following members:
    1208. 

  1208.  *                 - integer with the location of the match within $body
    1209. 

  1209.  *                 - string with whatever content between offset and the match
    1210. 

  1210.  *                 - string with whatever it is we matched
    1211. 

  1211.  */
    1212. 

  1212. function sq_findnxreg($body, $offset, $reg){
    1213. 

  1213.     $me = 'sq_findnxreg';
    1214. 

  1214.     $matches = Array();
    1215. 

  1215.     $retarr = Array();
    1216. 

  1216.     preg_match("%^(.*?)($reg)%si", substr($body, $offset), $matches);
    1217. 

  1217.     if (!isset($matches{0}) || !$matches{0}){
    1218. 

  1218.         $retarr = false;
    1219. 

  1219.     } else {
    1220. 

  1220.         $retarr{0} = $offset + strlen($matches{1});
    1221. 

  1221.         $retarr{1} = $matches{1};
    1222. 

  1222.         $retarr{2} = $matches{2};
    1223. 

  1223.     }
    1224. 

  1224.     return $retarr;
    1225. 

  1225. }
    1226. 

  1226. 

  1227. /**
    1228. 

  1228.  * This function looks for the next tag.
    1229. 

  1229.  *
    1230. 

  1230.  * @param  $body   String where to look for the next tag.
    1231. 

  1231.  * @param  $offset Start looking from here.
    1232. 

  1232.  * @return         false if no more tags exist in the body, or
    1233. 

  1233.  *                 an array with the following members:
    1234. 

  1234.  *                 - string with the name of the tag
    1235. 

  1235.  *                 - array with attributes and their values
    1236. 

  1236.  *                 - integer with tag type (1, 2, or 3)
    1237. 

  1237.  *                 - integer where the tag starts (starting "<")
    1238. 

  1238.  *                 - integer where the tag ends (ending ">")
    1239. 

  1239.  *                 first three members will be false, if the tag is invalid.
    1240. 

  1240.  */
    1241. 

  1241. function sq_getnxtag($body, $offset){
    1242. 

  1242.     $me = 'sq_getnxtag';
    1243. 

  1243.     if ($offset > strlen($body)){
    1244. 

  1244.         return false;
    1245. 

  1245.     }
    1246. 

  1246.     $lt = sq_findnxstr($body, $offset, "<");
    1247. 

  1247.     if ($lt == strlen($body)){
    1248. 

  1248.         return false;
    1249. 

  1249.     }
    1250. 

  1250.     /**
    1251. 

  1251.      * We are here:
    1252. 

  1252.      * blah blah <tag attribute="value">
    1253. 

  1253.      * \---------^
    1254. 

  1254.      */
    1255. 

  1255.     $pos = sq_skipspace($body, $lt+1);
    1256. 

  1256.     if ($pos >= strlen($body)){
    1257. 

  1257.         return Array(false, false, false, $lt, strlen($body));
    1258. 

  1258.     }
    1259. 

  1259.     /**
    1260. 

  1260.      * There are 3 kinds of tags:
    1261. 

  1261.      * 1. Opening tag, e.g.:
    1262. 

  1262.      *    <a href="blah">
    1263. 

  1263.      * 2. Closing tag, e.g.:
    1264. 

  1264.      *    </a>
    1265. 

  1265.      * 3. XHTML-style content-less tag, e.g.:
    1266. 

  1266.      *    <img src="blah" />
    1267. 

  1267.      */
    1268. 

  1268.     $tagtype = false;
    1269. 

  1269.     switch (substr($body, $pos, 1)){
    1270. 

  1270.         case '/':
    1271. 

  1271.             $tagtype = 2;
    1272. 

  1272.             $pos++;
    1273. 

  1273.             break;
    1274. 

  1274.         case '!':
    1275. 

  1275.             /**
    1276. 

  1276.              * A comment or an SGML declaration.
    1277. 

  1277.              */
    1278. 

  1278.             if (substr($body, $pos+1, 2) == "--"){
    1279. 

  1279.                 $gt = strpos($body, "-->", $pos);
    1280. 

  1280.                 if ($gt === false){
    1281. 

  1281.                     $gt = strlen($body);
    1282. 

  1282.                 } else {
    1283. 

  1283.                     $gt += 2;
    1284. 

  1284.                 }
    1285. 

  1285.                 return Array(false, false, false, $lt, $gt);
    1286. 

  1286.             } else {
    1287. 

  1287.                 $gt = sq_findnxstr($body, $pos, ">");
    1288. 

  1288.                 return Array(false, false, false, $lt, $gt);
    1289. 

  1289.             }
    1290. 

  1290.             break;
    1291. 

  1291.         default:
    1292. 

  1292.             /**
    1293. 

  1293.              * Assume tagtype 1 for now. If it's type 3, we'll switch values
    1294. 

  1294.              * later.
    1295. 

  1295.              */
    1296. 

  1296.             $tagtype = 1;
    1297. 

  1297.             break;
    1298. 

  1298.     }
    1299. 

  1299. 

  1300.     $tag_start = $pos;
    1301. 

  1301.     $tagname = '';
    1302. 

  1302.     /**
    1303. 

  1303.      * Look for next [\W-_], which will indicate the end of the tag name.
    1304. 

  1304.      */
    1305. 

  1305.     $regary = sq_findnxreg($body, $pos, "[^\w\-_]");
    1306. 

  1306.     if ($regary == false){
    1307. 

  1307.         return Array(false, false, false, $lt, strlen($body));
    1308. 

  1308.     }
    1309. 

  1309.     list($pos, $tagname, $match) = $regary;
    1310. 

  1310.     $tagname = strtolower($tagname);
    1311. 

  1311. 

  1312.     /**
    1313. 

  1313.      * $match can be either of these:
    1314. 

  1314.      * '>'  indicating the end of the tag entirely.
    1315. 

  1315.      * '\s' indicating the end of the tag name.
    1316. 

  1316.      * '/'  indicating that this is type-3 xhtml tag.
    1317. 

  1317.      *
    1318. 

  1318.      * Whatever else we find there indicates an invalid tag.
    1319. 

  1319.      */
    1320. 

  1320.     switch ($match){
    1321. 

  1321.         case '/':
    1322. 

  1322.             /**
    1323. 

  1323.              * This is an xhtml-style tag with a closing / at the
    1324. 

  1324.              * end, like so: <img src="blah" />. Check if it's followed
    1325. 

  1325.              * by the closing bracket. If not, then this tag is invalid
    1326. 

  1326.              */
    1327. 

  1327.             if (substr($body, $pos, 2) == "/>"){
    1328. 

  1328.                 $pos++;
    1329. 

  1329.                 $tagtype = 3;
    1330. 

  1330.             } else {
    1331. 

  1331.                 $gt = sq_findnxstr($body, $pos, ">");
    1332. 

  1332.                 $retary = Array(false, false, false, $lt, $gt);
    1333. 

  1333.                 return $retary;
    1334. 

  1334.             }
    1335. 

  1335.         case '>':
    1336. 

  1336.             return Array($tagname, false, $tagtype, $lt, $pos);
    1337. 

  1337.             break;
    1338. 

  1338.         default:
    1339. 

  1339.             /**
    1340. 

  1340.              * Check if it's whitespace
    1341. 

  1341.              */
    1342. 

  1342.             if (!preg_match('/\s/', $match)){
    1343. 

  1343.                 /**
    1344. 

  1344.                  * This is an invalid tag! Look for the next closing ">".
    1345. 

  1345.                  */
    1346. 

  1346.                 $gt = sq_findnxstr($body, $lt, ">");
    1347. 

  1347.                 return Array(false, false, false, $lt, $gt);
    1348. 

  1348.             }
    1349. 

  1349.             break;
    1350. 

  1350.     }
    1351. 

  1351. 

  1352.     /**
    1353. 

  1353.      * At this point we're here:
    1354. 

  1354.      * <tagname  attribute='blah'>
    1355. 

  1355.      * \-------^
    1356. 

  1356.      *
    1357. 

  1357.      * At this point we loop in order to find all attributes.
    1358. 

  1358.      */
    1359. 

  1359.     $attname = '';
    1360. 

  1360.     $atttype = false;
    1361. 

  1361.     $attary = Array();
    1362. 

  1362. 

  1363.     while ($pos <= strlen($body)){
    1364. 

  1364.         $pos = sq_skipspace($body, $pos);
    1365. 

  1365.         if ($pos == strlen($body)){
    1366. 

  1366.             /**
    1367. 

  1367.              * Non-closed tag.
    1368. 

  1368.              */
    1369. 

  1369.             return Array(false, false, false, $lt, $pos);
    1370. 

  1370.         }
    1371. 

  1371.         /**
    1372. 

  1372.          * See if we arrived at a ">" or "/>", which means that we reached
    1373. 

  1373.          * the end of the tag.
    1374. 

  1374.          */
    1375. 

  1375.         $matches = Array();
    1376. 

  1376.         if (preg_match("%^(\s*)(>|/>)%s", substr($body, $pos), $matches)) {
    1377. 

  1377.             /**
    1378. 

  1378.              * Yep. So we did.
    1379. 

  1379.              */
    1380. 

  1380.             $pos += strlen($matches{1});
    1381. 

  1381.             if ($matches{2} == "/>"){
    1382. 

  1382.                 $tagtype = 3;
    1383. 

  1383.                 $pos++;
    1384. 

  1384.             }
    1385. 

  1385.             return Array($tagname, $attary, $tagtype, $lt, $pos);
    1386. 

  1386.         }
    1387. 

  1387. 

  1388.         /**
    1389. 

  1389.          * There are several types of attributes, with optional
    1390. 

  1390.          * [:space:] between members.
    1391. 

  1391.          * Type 1:
    1392. 

  1392.          *   attrname[:space:]=[:space:]'CDATA'
    1393. 

  1393.          * Type 2:
    1394. 

  1394.          *   attrname[:space:]=[:space:]"CDATA"
    1395. 

  1395.          * Type 3:
    1396. 

  1396.          *   attr[:space:]=[:space:]CDATA
    1397. 

  1397.          * Type 4:
    1398. 

  1398.          *   attrname
    1399. 

  1399.          *
    1400. 

  1400.          * We leave types 1 and 2 the same, type 3 we check for
    1401. 

  1401.          * '"' and convert to "&quot" if needed, then wrap in
    1402. 

  1402.          * double quotes. Type 4 we convert into:
    1403. 

  1403.          * attrname="yes".
    1404. 

  1404.          */
    1405. 

  1405.         $regary = sq_findnxreg($body, $pos, "[^:\w\-_]");
    1406. 

  1406.         if ($regary == false){
    1407. 

  1407.             /**
    1408. 

  1408.              * Looks like body ended before the end of tag.
    1409. 

  1409.              */
    1410. 

  1410.             return Array(false, false, false, $lt, strlen($body));
    1411. 

  1411.         }
    1412. 

  1412.         list($pos, $attname, $match) = $regary;
    1413. 

  1413.         $attname = strtolower($attname);
    1414. 

  1414.         /**
    1415. 

  1415.          * We arrived at the end of attribute name. Several things possible
    1416. 

  1416.          * here:
    1417. 

  1417.          * '>'  means the end of the tag and this is attribute type 4
    1418. 

  1418.          * '/'  if followed by '>' means the same thing as above
    1419. 

  1419.          * '\s' means a lot of things -- look what it's followed by.
    1420. 

  1420.          *      anything else means the attribute is invalid.
    1421. 

  1421.          */
    1422. 

  1422.         switch($match){
    1423. 

  1423.             case '/':
    1424. 

  1424.                 /**
    1425. 

  1425.                  * This is an xhtml-style tag with a closing / at the
    1426. 

  1426.                  * end, like so: <img src="blah" />. Check if it's followed
    1427. 

  1427.                  * by the closing bracket. If not, then this tag is invalid
    1428. 

  1428.                  */
    1429. 

  1429.                 if (substr($body, $pos, 2) == "/>"){
    1430. 

  1430.                     $pos++;
    1431. 

  1431.                     $tagtype = 3;
    1432. 

  1432.                 } else {
    1433. 

  1433.                     $gt = sq_findnxstr($body, $pos, ">");
    1434. 

  1434.                     $retary = Array(false, false, false, $lt, $gt);
    1435. 

  1435.                     return $retary;
    1436. 

  1436.                 }
    1437. 

  1437.             case '>':
    1438. 

  1438.                 $attary{$attname} = '"yes"';
    1439. 

  1439.                 return Array($tagname, $attary, $tagtype, $lt, $pos);
    1440. 

  1440.                 break;
    1441. 

  1441.             default:
    1442. 

  1442.                 /**
    1443. 

  1443.                  * Skip whitespace and see what we arrive at.
    1444. 

  1444.                  */
    1445. 

  1445.                 $pos = sq_skipspace($body, $pos);
    1446. 

  1446.                 $char = substr($body, $pos, 1);
    1447. 

  1447.                 /**
    1448. 

  1448.                  * Two things are valid here:
    1449. 

  1449.                  * '=' means this is attribute type 1 2 or 3.
    1450. 

  1450.                  * \w means this was attribute type 4.
    1451. 

  1451.                  * anything else we ignore and re-loop. End of tag and
    1452. 

  1452.                  * invalid stuff will be caught by our checks at the beginning
    1453. 

  1453.                  * of the loop.
    1454. 

  1454.                  */
    1455. 

  1455.                 if ($char == "="){
    1456. 

  1456.                     $pos++;
    1457. 

  1457.                     $pos = sq_skipspace($body, $pos);
    1458. 

  1458.                     /**
    1459. 

  1459.                      * Here are 3 possibilities:
    1460. 

  1460.                      * "'"  attribute type 1
    1461. 

  1461.                      * '"'  attribute type 2
    1462. 

  1462.                      * everything else is the content of tag type 3
    1463. 

  1463.                      */
    1464. 

  1464.                     $quot = substr($body, $pos, 1);
    1465. 

  1465.                     if ($quot == "'"){
    1466. 

  1466.                         $regary = sq_findnxreg($body, $pos+1, "\'");
    1467. 

  1467.                         if ($regary == false){
    1468. 

  1468.                             return Array(false, false, false, $lt, strlen($body));
    1469. 

  1469.                         }
    1470. 

  1470.                         list($pos, $attval, $match) = $regary;
    1471. 

  1471.                         $pos++;
    1472. 

  1472.                         $attary{$attname} = "'" . $attval . "'";
    1473. 

  1473.                     } else if ($quot == '"'){
    1474. 

  1474.                         $regary = sq_findnxreg($body, $pos+1, '\"');
    1475. 

  1475.                         if ($regary == false){
    1476. 

  1476.                             return Array(false, false, false, $lt, strlen($body));
    1477. 

  1477.                         }
    1478. 

  1478.                         list($pos, $attval, $match) = $regary;
    1479. 

  1479.                         $pos++;
    1480. 

  1480.                         $attary{$attname} = '"' . $attval . '"';
    1481. 

  1481.                     } else {
    1482. 

  1482.                         /**
    1483. 

  1483.                          * These are hateful. Look for \s, or >.
    1484. 

  1484.                          */
    1485. 

  1485.                         $regary = sq_findnxreg($body, $pos, "[\s>]");
    1486. 

  1486.                         if ($regary == false){
    1487. 

  1487.                             return Array(false, false, false, $lt, strlen($body));
    1488. 

  1488.                         }
    1489. 

  1489.                         list($pos, $attval, $match) = $regary;
    1490. 

  1490.                         /**
    1491. 

  1491.                          * If it's ">" it will be caught at the top.
    1492. 

  1492.                          */
    1493. 

  1493.                         $attval = preg_replace("/\"/s", "&quot;", $attval);
    1494. 

  1494.                         $attary{$attname} = '"' . $attval . '"';
    1495. 

  1495.                     }
    1496. 

  1496.                 } else if (preg_match("|[\w/>]|", $char)) {
    1497. 

  1497.                     /**
    1498. 

  1498.                      * That was attribute type 4.
    1499. 

  1499.                      */
    1500. 

  1500.                     $attary{$attname} = '"yes"';
    1501. 

  1501.                 } else {
    1502. 

  1502.                     /**
    1503. 

  1503.                      * An illegal character. Find next '>' and return.
    1504. 

  1504.                      */
    1505. 

  1505.                     $gt = sq_findnxstr($body, $pos, ">");
    1506. 

  1506.                     return Array(false, false, false, $lt, $gt);
    1507. 

  1507.                 }
    1508. 

  1508.                 break;
    1509. 

  1509.         }
    1510. 

  1510.     }
    1511. 

  1511.     /**
    1512. 

  1512.      * The fact that we got here indicates that the tag end was never
    1513. 

  1513.      * found. Return invalid tag indication so it gets stripped.
    1514. 

  1514.      */
    1515. 

  1515.     return Array(false, false, false, $lt, strlen($body));
    1516. 

  1516. }
    1517. 

  1517. 

  1518. /**
    1519. 

  1519.  * Translates entities into literal values so they can be checked.
    1520. 

  1520.  *
    1521. 

  1521.  * @param $attvalue the by-ref value to check.
    1522. 

  1522.  * @param $regex    the regular expression to check against.
    1523. 

  1523.  * @param $hex      whether the entites are hexadecimal.
    1524. 

  1524.  * @return          True or False depending on whether there were matches.
    1525. 

  1525.  */
    1526. 

  1526. function sq_deent(&$attvalue, $regex, $hex=false){
    1527. 

  1527.     $me = 'sq_deent';
    1528. 

  1528.     $ret_match = false;
    1529. 

  1529.     preg_match_all($regex, $attvalue, $matches);
    1530. 

  1530.     if (is_array($matches) && sizeof($matches[0]) > 0){
    1531. 

  1531.         $repl = Array();
    1532. 

  1532.         for ($i = 0; $i < sizeof($matches[0]); $i++){
    1533. 

  1533.             $numval = $matches[1][$i];
    1534. 

  1534.             if ($hex){
    1535. 

  1535.                 $numval = hexdec($numval);
    1536. 

  1536.             }
    1537. 

  1537.             $repl{$matches[0][$i]} = chr($numval);
    1538. 

  1538.         }
    1539. 

  1539.         $attvalue = strtr($attvalue, $repl);
    1540. 

  1540.         return true;
    1541. 

  1541.     } else {
    1542. 

  1542.         return false;
    1543. 

  1543.     }
    1544. 

  1544. }
    1545. 

  1545. 

  1546. /**
    1547. 

  1547.  * This function runs various checks against the attributes.
    1548. 

  1548.  *
    1549. 

  1549.  * @param  $tagname         String with the name of the tag.
    1550. 

  1550.  * @param  $attary          Array with all tag attributes.
    1551. 

  1551.  * @param  $rm_attnames     See description for sq_sanitize
    1552. 

  1552.  * @param  $bad_attvals     See description for sq_sanitize
    1553. 

  1553.  * @param  $add_attr_to_tag See description for sq_sanitize
    1554. 

  1554.  * @param  $message         message object
    1555. 

  1555.  * @param  $id              message id
    1556. 

  1556.  * @return                  Array with modified attributes.
    1557. 

  1557.  */
    1558. 

  1558. function sq_fixatts($tagname,
    1559. 

  1559.                     $attary,
    1560. 

  1560.                     $rm_attnames,
    1561. 

  1561.                     $bad_attvals,
    1562. 

  1562.                     $add_attr_to_tag,
    1563. 

  1563.                     $message,
    1564. 

  1564.                     $id,
    1565. 

  1565.                     $mailbox
    1566. 

  1566.                     ){
    1567. 

  1567.     $me = 'sq_fixatts';
    1568. 

  1568.     while (list($attname, $attvalue) = each($attary)){
    1569. 

  1569.         /**
    1570. 

  1570.          * See if this attribute should be removed.
    1571. 

  1571.          */
    1572. 

  1572.         foreach ($rm_attnames as $matchtag=>$matchattrs){
    1573. 

  1573.             if (preg_match($matchtag, $tagname)){
    1574. 

  1574.                 foreach ($matchattrs as $matchattr){
    1575. 

  1575.                     if (preg_match($matchattr, $attname)){
    1576. 

  1576.                         unset($attary{$attname});
    1577. 

  1577.                         continue;
    1578. 

  1578.                     }
    1579. 

  1579.                 }
    1580. 

  1580.             }
    1581. 

  1581.         }
    1582. 

  1582. 

  1583.         /**
    1584. 

  1584.          * Workaround for IE quirks
    1585. 

  1585.          */
    1586. 

  1586.         sq_fixIE_idiocy($attvalue);
    1587. 

  1587. 

  1588.         /**
    1589. 

  1589.          * Remove any backslashes, entities, and extraneous whitespace.
    1590. 

  1590.          */
    1591. 

  1591.         $oldattvalue = $attvalue;
    1592. 

  1592.         sq_defang($attvalue);
    1593. 

  1593.         if ($attname == 'style' && $attvalue !== $oldattvalue) {
    1594. 

  1594.             // entities are used in the attribute value. In 99% of the cases it's there as XSS
    1595. 

  1595.             // i.e.<div style="{ left:exp&#x0280;essio&#x0274;( alert('XSS') ) }">
    1596. 

  1596.             $attvalue = "idiocy";
    1597. 

  1597.             $attary{$attname} = $attvalue;
    1598. 

  1598.         }
    1599. 

  1599.         sq_unspace($attvalue);
    1600. 

  1600. 

  1601.         /**
    1602. 

  1602.          * Now let's run checks on the attvalues.
    1603. 

  1603.          * I don't expect anyone to comprehend this. If you do,
    1604. 

  1604.          * get in touch with me so I can drive to where you live and
    1605. 

  1605.          * shake your hand personally. :)
    1606. 

  1606.          */
    1607. 

  1607.         foreach ($bad_attvals as $matchtag=>$matchattrs){
    1608. 

  1608.             if (preg_match($matchtag, $tagname)){
    1609. 

  1609.                 foreach ($matchattrs as $matchattr=>$valary){
    1610. 

  1610.                     if (preg_match($matchattr, $attname)){
    1611. 

  1611.                         /**
    1612. 

  1612.                          * There are two arrays in valary.
    1613. 

  1613.                          * First is matches.
    1614. 

  1614.                          * Second one is replacements
    1615. 

  1615.                          */
    1616. 

  1616.                         list($valmatch, $valrepl) = $valary;
    1617. 

  1617.                         $newvalue =
    1618. 

  1618.                             preg_replace($valmatch, $valrepl, $attvalue);
    1619. 

  1619.                         if ($newvalue != $attvalue){
    1620. 

  1620.                             $attary{$attname} = $newvalue;
    1621. 

  1621.                             $attvalue = $newvalue;
    1622. 

  1622.                         }
    1623. 

  1623.                     }
    1624. 

  1624.                 }
    1625. 

  1625.             }
    1626. 

  1626.         }
    1627. 

  1627.         if ($attname == 'style') {
    1628. 

  1628.             if (preg_match('/[\0-\37\200-\377]+/',$attvalue)) {
    1629. 

  1629.                 // 8bit and control characters in style attribute values can be used for XSS, remove them
    1630. 

  1630.                 $attary{$attname} = '"disallowed character"';
    1631. 

  1631.             }
    1632. 

  1632.             preg_match_all("/url\s*\((.+)\)/si",$attvalue,$aMatch);
    1633. 

  1633.             if (count($aMatch)) {
    1634. 

  1634.                 foreach($aMatch[1] as $sMatch) {
    1635. 

  1635.                     // url value
    1636. 

  1636.                     $urlvalue = $sMatch;
    1637. 

  1637.                     sq_fix_url($attname, $urlvalue, $message, $id, $mailbox,"'");
    1638. 

  1638.                     $attary{$attname} = str_replace($sMatch,$urlvalue,$attvalue);
    1639. 

  1639.                 }
    1640. 

  1640.             }
    1641. 

  1641.         }
    1642. 

  1642.         /**
    1643. 

  1643.          * Use white list based filtering on attributes which can contain url's
    1644. 

  1644.          */
    1645. 

  1645.         else if ($attname == 'href' || $attname == 'src' || $attname == 'background') {
    1646. 

  1646.             sq_fix_url($attname, $attvalue, $message, $id, $mailbox);
    1647. 

  1647.             $attary{$attname} = $attvalue;
    1648. 

  1648.         }
    1649. 

  1649.     }
    1650. 

  1650.     /**
    1651. 

  1651.      * See if we need to append any attributes to this tag.
    1652. 

  1652.      */
    1653. 

  1653.     foreach ($add_attr_to_tag as $matchtag=>$addattary){
    1654. 

  1654.         if (preg_match($matchtag, $tagname)){
    1655. 

  1655.             $attary = array_merge($attary, $addattary);
    1656. 

  1656.         }
    1657. 

  1657.     }
    1658. 

  1658.     return $attary;
    1659. 

  1659. }
    1660. 

  1660. 

  1661. /**
    1662. 

  1662.  * This function filters url's
    1663. 

  1663.  *
    1664. 

  1664.  * @param  $attvalue        String with attribute value to filter
    1665. 

  1665.  * @param  $message         message object
    1666. 

  1666.  * @param  $id               message id
    1667. 

  1667.  * @param  $mailbox         mailbox
    1668. 

  1668.  * @param  $sQuote          quoting characters around url's
    1669. 

  1669.  */
    1670. 

  1670. function sq_fix_url($attname, &$attvalue, $message, $id, $mailbox,$sQuote = '"') {
    1671. 

  1671.     $attvalue = trim($attvalue);
    1672. 

  1672.     if ($attvalue && ($attvalue[0] =='"'|| $attvalue[0] == "'")) {
    1673. 

  1673.         // remove the double quotes
    1674. 

  1674.         $sQuote = $attvalue[0];
    1675. 

  1675.         $attvalue = trim(substr($attvalue,1,-1));
    1676. 

  1676.     }
    1677. 

  1677. 

  1678.     if( !sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET) ) {
    1679. 

  1679.         $view_unsafe_images = false;
    1680. 

  1680.     }
    1681. 

  1681.     $secremoveimg = '../images/' . _("sec_remove_eng.png");
    1682. 

  1682. 

  1683.     /**
    1684. 

  1684.      * Replace empty src tags with the blank image.  src is only used
    1685. 

  1685.      * for frames, images, and image inputs.  Doing a replace should
    1686. 

  1686.      * not affect them working as should be, however it will stop
    1687. 

  1687.      * IE from being kicked off when src for img tags are not set
    1688. 

  1688.      */
    1689. 

  1689.     if ($attvalue == '') {
    1690. 

  1690.         $attvalue = '"' . SM_PATH . 'images/blank.png"';
    1691. 

  1691.     } else {
    1692. 

  1692.         // first, disallow 8 bit characters and control characters
    1693. 

  1693.         if (preg_match('/[\0-\37\200-\377]+/',$attvalue)) {
    1694. 

  1694.             switch ($attname) {
    1695. 

  1695.                 case 'href':
    1696. 

  1696.                     $attvalue = $sQuote . 'http://invalid-stuff-detected.example.com' . $sQuote;
    1697. 

  1697.                     break;
    1698. 

  1698.                 default:
    1699. 

  1699.                     $attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote;
    1700. 

  1700.                     break;
    1701. 

  1701.             }
    1702. 

  1702.         } else {
    1703. 

  1703.             $aUrl = parse_url($attvalue);
    1704. 

  1704.             if (isset($aUrl['scheme'])) {
    1705. 

  1705.                 switch(strtolower($aUrl['scheme'])) {
    1706. 

  1706.                     case 'http':
    1707. 

  1707.                     case 'https':
    1708. 

  1708.                     case 'ftp':
    1709. 

  1709.                         if ($attname != 'href') {
    1710. 

  1710.                             if ($view_unsafe_images == false) {
    1711. 

  1711.                                 $attvalue = $sQuote . $secremoveimg . $sQuote;
    1712. 

  1712.                             } else {
    1713. 

  1713.                                 if (isset($aUrl['path'])) {
    1714. 

  1714.                                     // validate image extension.
    1715. 

  1715.                                     $ext = strtolower(substr($aUrl['path'],strrpos($aUrl['path'],'.')));
    1716. 

  1716.                                     if (!in_array($ext,array('.jpeg','.jpg','xjpeg','.gif','.bmp','.jpe','.png','.xbm'))) {
    1717. 

  1717.                                         $attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote;
    1718. 

  1718.                                     }
    1719. 

  1719.                                 } else {
    1720. 

  1720.                                     $attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote;
    1721. 

  1721.                                 }
    1722. 

  1722.                             }
    1723. 

  1723.                         }
    1724. 

  1724.                         break;
    1725. 

  1725.                     case 'outbind':
    1726. 

  1726.                         /**
    1727. 

  1727.                          * "Hack" fix for Outlook using propriatary outbind:// protocol in img tags.
    1728. 

  1728.                          * One day MS might actually make it match something useful, for now, falling
    1729. 

  1729.                          * back to using cid2http, so we can grab the blank.png.
    1730. 

  1730.                          */
    1731. 

  1731.                         $attvalue = sq_cid2http($message, $id, $attvalue, $mailbox);
    1732. 

  1732.                         break;
    1733. 

  1733.                     case 'cid':
    1734. 

  1734.                         /**
    1735. 

  1735.                             * Turn cid: urls into http-friendly ones.
    1736. 

  1736.                             */
    1737. 

  1737.                         $attvalue = sq_cid2http($message, $id, $attvalue, $mailbox);
    1738. 

  1738.                         break;
    1739. 

  1739.                     default:
    1740. 

  1740.                         $attvalue = $sQuote . SM_PATH . 'images/blank.png' . $sQuote;
    1741. 

  1741.                         break;
    1742. 

  1742.                 }
    1743. 

  1743.             } else {
    1744. 

  1744.                 if (!(isset($aUrl['path']) && $aUrl['path'] == $secremoveimg)) {
    1745. 

  1745.                     // parse_url did not lead to satisfying result
    1746. 

  1746.                     $attvalue = $sQuote . SM_PATH . 'images/blank.png' . $sQuote;
    1747. 

  1747.                 }
    1748. 

  1748.             }
    1749. 

  1749.         }
    1750. 

  1750.     }
    1751. 

  1751. }
    1752. 

  1752. 

  1753. /**
    1754. 

  1754.  * This function edits the style definition to make them friendly and
    1755. 

  1755.  * usable in SquirrelMail.
    1756. 

  1756.  *
    1757. 

  1757.  * @param  $message  the message object
    1758. 

  1758.  * @param  $id       the message id
    1759. 

  1759.  * @param  $content  a string with whatever is between <style> and </style>
    1760. 

  1760.  * @param  $mailbox  the message mailbox
    1761. 

  1761.  * @return           a string with edited content.
    1762. 

  1762.  */
    1763. 

  1763. function sq_fixstyle($body, $pos, $message, $id, $mailbox){
    1764. 

  1764.     global $view_unsafe_images;
    1765. 

  1765.     $me = 'sq_fixstyle';
    1766. 

  1766. 

  1767.     // workaround for </style> in between comments
    1768. 

  1768.     $iCurrentPos = $pos;
    1769. 

  1769.     $content = '';
    1770. 

  1770.     $sToken = '';
    1771. 

  1771.     $bSucces = false;
    1772. 

  1772.     $bEndTag = false;
    1773. 

  1773.     for ($i=$pos,$iCount=strlen($body);$i<$iCount;++$i) {
    1774. 

  1774.         $char = $body{$i};
    1775. 

  1775.         switch ($char) {
    1776. 

  1776.             case '<':
    1777. 

  1777.                 $sToken .= $char;
    1778. 

  1778.                 break;
    1779. 

  1779.             case '/':
    1780. 

  1780.                  if ($sToken == '<') {
    1781. 

  1781.                     $sToken .= $char;
    1782. 

  1782.                     $bEndTag = true;
    1783. 

  1783.                  } else {
    1784. 

  1784.                     $content .= $char;
    1785. 

  1785.                  }
    1786. 

  1786.                  break;
    1787. 

  1787.             case '>':
    1788. 

  1788.                  if ($bEndTag) {
    1789. 

  1789.                     $sToken .= $char;
    1790. 

  1790.                     if (preg_match('/\<\/\s*style\s*\>/i',$sToken,$aMatch)) {
    1791. 

  1791.                         $newpos = $i + 1;
    1792. 

  1792.                         $bSucces = true;
    1793. 

  1793.                         break 2;
    1794. 

  1794.                     } else {
    1795. 

  1795.                         $content .= $sToken;
    1796. 

  1796.                     }
    1797. 

  1797.                     $bEndTag = false;
    1798. 

  1798.                  } else {
    1799. 

  1799.                     $content .= $char;
    1800. 

  1800.                  }
    1801. 

  1801.                  break;
    1802. 

  1802.             case '!':
    1803. 

  1803.                 if ($sToken == '<') {
    1804. 

  1804.                     // possible comment
    1805. 

  1805.                     if (isset($body{$i+2}) && substr($body,$i,3) == '!--') {
    1806. 

  1806.                         $i = strpos($body,'-->',$i+3);
    1807. 

  1807.                         if ($i === false) { // no end comment
    1808. 

  1808.                             $i = strlen($body);
    1809. 

  1809.                         }
    1810. 

  1810.                         $sToken = '';
    1811. 

  1811.                     }
    1812. 

  1812.                 } else {
    1813. 

  1813.                     $content .= $char;
    1814. 

  1814.                 }
    1815. 

  1815.                 break;
    1816. 

  1816.             default:
    1817. 

  1817.                 if ($bEndTag) {
    1818. 

  1818.                     $sToken .= $char;
    1819. 

  1819.                 } else {
    1820. 

  1820.                     $content .= $char;
    1821. 

  1821.                 }
    1822. 

  1822.                 break;
    1823. 

  1823.         }
    1824. 

  1824.     }
    1825. 

  1825.     if ($bSucces == FALSE){
    1826. 

  1826.         return array(FALSE, strlen($body));
    1827. 

  1827.     }
    1828. 

  1828. 

  1829.     /**
    1830. 

  1830.      * First look for general BODY style declaration, which would be
    1831. 

  1831.      * like so:
    1832. 

  1832.      * body {background: blah-blah}
    1833. 

  1833.      * and change it to .bodyclass so we can just assign it to a <div>
    1834. 

  1834.      */
    1835. 

  1835.     $content = preg_replace("|body(\s*\{.*?\})|si", ".bodyclass\\1", $content);
    1836. 

  1836.     $secremoveimg = '../images/' . _("sec_remove_eng.png");
    1837. 

  1837. 

  1838.     // first check for 8bit sequences and disallowed control characters
    1839. 

  1839.     if (preg_match('/[\16-\37\200-\377]+/',$content)) {
    1840. 

  1840.         $content = '<!-- style block removed by html filter due to presence of 8bit characters -->';
    1841. 

  1841.         return array($content, $newpos);
    1842. 

  1842.     }
    1843. 

  1843. 

  1844.     // IE Sucks hard. We have a special function for it.
    1845. 

  1845.     sq_fixIE_idiocy($content);
    1846. 

  1846. 

  1847.     // remove @import line
    1848. 

  1848.     $content = preg_replace("/^\s*(@import.*)$/mi","\n<!-- @import rules forbidden -->\n",$content);
    1849. 

  1849. 

  1850.     /**
    1851. 

  1851.      * Fix url('blah') declarations.
    1852. 

  1852.      */
    1853. 

  1853.     // translate ur\l and variations into url (IE parses that)
    1854. 

  1854.     // TODO check if the sq_fixIE_idiocy function already handles this.
    1855. 

  1855.     $content = preg_replace("/(\\\\)?u(\\\\)?r(\\\\)?l(\\\\)?/i",'url', $content);
    1856. 

  1856.     preg_match_all("/url\s*\((.+)\)/si",$content,$aMatch);
    1857. 

  1857.     if (count($aMatch)) {
    1858. 

  1858.         $aValue = $aReplace = array();
    1859. 

  1859.         foreach($aMatch[1] as $sMatch) {
    1860. 

  1860.             // url value
    1861. 

  1861.             $urlvalue = $sMatch;
    1862. 

  1862.             sq_fix_url('style',$urlvalue, $message, $id, $mailbox,"'");
    1863. 

  1863.             $aValue[] = $sMatch;
    1864. 

  1864.             $aReplace[] = $urlvalue;
    1865. 

  1865.         }
    1866. 

  1866.         $content = str_replace($aValue,$aReplace,$content);
    1867. 

  1867.     }
    1868. 

  1868. 

  1869.     /**
    1870. 

  1870.      * Remove any backslashes, entities, and extraneous whitespace.
    1871. 

  1871.      */
    1872. 

  1872.      $contentTemp = $content;
    1873. 

  1873.      sq_defang($contentTemp);
    1874. 

  1874.      sq_unspace($contentTemp);
    1875. 

  1875. 

  1876.     /**
    1877. 

  1877.      * Fix stupid css declarations which lead to vulnerabilities
    1878. 

  1878.      * in IE.
    1879. 

  1879.      */
    1880. 

  1880.     $match   = Array('/\/\*.*\*\//',
    1881. 

  1881.                     '/expression/i',
    1882. 

  1882.                     '/behaviou*r/i',
    1883. 

  1883.                     '/binding/i',
    1884. 

  1884.                     '/include-source/i',
    1885. 

  1885.                     '/javascript/i',
    1886. 

  1886.                     '/script/i');
    1887. 

  1887.     $replace = Array('','idiocy', 'idiocy', 'idiocy', 'idiocy', 'idiocy', 'idiocy');
    1888. 

  1888.     $contentNew = preg_replace($match, $replace, $contentTemp);
    1889. 

  1889.     if ($contentNew !== $contentTemp) {
    1890. 

  1890.         // insecure css declarations are used. From now on we don't care
    1891. 

  1891.         // anymore if the css is destroyed by sq_deent, sq_unspace or sq_unbackslash
    1892. 

  1892.         $content = $contentNew;
    1893. 

  1893.     }
    1894. 

  1894.     return array($content, $newpos);
    1895. 

  1895. }
    1896. 

  1896. 

  1897. 

  1898. /**
    1899. 

  1899.  * This function converts cid: url's into the ones that can be viewed in
    1900. 

  1900.  * the browser.
    1901. 

  1901.  *
    1902. 

  1902.  * @param  $message  the message object
    1903. 

  1903.  * @param  $id       the message id
    1904. 

  1904.  * @param  $cidurl   the cid: url.
    1905. 

  1905.  * @param  $mailbox  the message mailbox
    1906. 

  1906.  * @return           a string with a http-friendly url
    1907. 

  1907.  */
    1908. 

  1908. function sq_cid2http($message, $id, $cidurl, $mailbox){
    1909. 

  1909.     /**
    1910. 

  1910.      * Get rid of quotes.
    1911. 

  1911.      */
    1912. 

  1912.     $quotchar = substr($cidurl, 0, 1);
    1913. 

  1913.     if ($quotchar == '"' || $quotchar == "'"){
    1914. 

  1914.         $cidurl = str_replace($quotchar, "", $cidurl);
    1915. 

  1915.     } else {
    1916. 

  1916.         $quotchar = '';
    1917. 

  1917.     }
    1918. 

  1918.     $cidurl = substr(trim($cidurl), 4);
    1919. 

  1919. 

  1920.     $match_str = '/\{.*?\}\//';
    1921. 

  1921.     $str_rep = '';
    1922. 

  1922.     $cidurl = preg_replace($match_str, $str_rep, $cidurl);
    1923. 

  1923. 

  1924.     $linkurl = find_ent_id($cidurl, $message);
    1925. 

  1925.     /* in case of non-safe cid links $httpurl should be replaced by a sort of
    1926. 

  1926.        unsafe link image */
    1927. 

  1927.     $httpurl = '';
    1928. 

  1928. 

  1929.     /**
    1930. 

  1930.      * This is part of a fix for Outlook Express 6.x generating
    1931. 

  1931.      * cid URLs without creating content-id headers. These images are
    1932. 

  1932.      * not part of the multipart/related html mail. The html contains
    1933. 

  1933.      * <img src="cid:{some_id}/image_filename.ext"> references to
    1934. 

  1934.      * attached images with as goal to render them inline although
    1935. 

  1935.      * the attachment disposition property is not inline.
    1936. 

  1936.      */
    1937. 

  1937. 

  1938.     if (empty($linkurl)) {
    1939. 

  1939.         if (preg_match('/{.*}\//', $cidurl)) {
    1940. 

  1940.             $cidurl = preg_replace('/{.*}\//','', $cidurl);
    1941. 

  1941.             if (!empty($cidurl)) {
    1942. 

  1942.                 $linkurl = find_ent_id($cidurl, $message);
    1943. 

  1943.             }
    1944. 

  1944.         }
    1945. 

  1945.     }
    1946. 

  1946. 

  1947.     if (!empty($linkurl)) {
    1948. 

  1948.         $httpurl = $quotchar . SM_PATH . 'src/download.php?absolute_dl=true&amp;' .
    1949. 

  1949.             "passed_id=$id&amp;mailbox=" . urlencode($mailbox) .
    1950. 

  1950.             '&amp;ent_id=' . $linkurl . $quotchar;
    1951. 

  1951.     } else {
    1952. 

  1952.         /**
    1953. 

  1953.          * If we couldn't generate a proper img url, drop in a blank image
    1954. 

  1954.          * instead of sending back empty, otherwise it causes unusual behaviour
    1955. 

  1955.          */
    1956. 

  1956.         $httpurl = $quotchar . SM_PATH . 'images/blank.png' . $quotchar;
    1957. 

  1957.     }
    1958. 

  1958. 

  1959.     return $httpurl;
    1960. 

  1960. }
    1961. 

  1961. 

  1962. /**
    1963. 

  1963.  * This function changes the <body> tag into a <div> tag since we
    1964. 

  1964.  * can't really have a body-within-body.
    1965. 

  1965.  *
    1966. 

  1966.  * @param  $attary   an array of attributes and values of <body>
    1967. 

  1967.  * @param  $mailbox  mailbox we're currently reading (for cid2http)
    1968. 

  1968.  * @param  $message  current message (for cid2http)
    1969. 

  1969.  * @param  $id       current message id (for cid2http)
    1970. 

  1970.  * @return           a modified array of attributes to be set for <div>
    1971. 

  1971.  */
    1972. 

  1972. function sq_body2div($attary, $mailbox, $message, $id){
    1973. 

  1973.     $me = 'sq_body2div';
    1974. 

  1974.     $divattary = Array('class' => "'bodyclass'");
    1975. 

  1975.     $bgcolor = '#ffffff';
    1976. 

  1976.     $text = '#000000';
    1977. 

  1977.     $styledef = '';
    1978. 

  1978.     if (is_array($attary) && sizeof($attary) > 0){
    1979. 

  1979.         foreach ($attary as $attname=>$attvalue){
    1980. 

  1980.             $quotchar = substr($attvalue, 0, 1);
    1981. 

  1981.             $attvalue = str_replace($quotchar, "", $attvalue);
    1982. 

  1982.             switch ($attname){
    1983. 

  1983.                 case 'background':
    1984. 

  1984.                     $attvalue = sq_cid2http($message, $id, $attvalue, $mailbox);
    1985. 

  1985.                     $styledef .= "background-image: url('$attvalue'); ";
    1986. 

  1986.                     break;
    1987. 

  1987.                 case 'bgcolor':
    1988. 

  1988.                     $styledef .= "background-color: $attvalue; ";
    1989. 

  1989.                     break;
    1990. 

  1990.                 case 'text':
    1991. 

  1991.                     $styledef .= "color: $attvalue; ";
    1992. 

  1992.                     break;
    1993. 

  1993.             }
    1994. 

  1994.         }
    1995. 

  1995.         if (strlen($styledef) > 0){
    1996. 

  1996.             $divattary{"style"} = "\"$styledef\"";
    1997. 

  1997.         }
    1998. 

  1998.     }
    1999. 

  1999.     return $divattary;
    2000. 

  2000. }
    2001. 

  2001. 

  2002. /**
    2003. 

  2003.  * This is the main function and the one you should actually be calling.
    2004. 

  2004.  * There are several variables you should be aware of an which need
    2005. 

  2005.  * special description.
    2006. 

  2006.  *
    2007. 

  2007.  * Since the description is quite lengthy, see it here:
    2008. 

  2008.  * http://linux.duke.edu/projects/mini/htmlfilter/
    2009. 

  2009.  *
    2010. 

  2010.  * @param $body                 the string with HTML you wish to filter
    2011. 

  2011.  * @param $tag_list             see description above
    2012. 

  2012.  * @param $rm_tags_with_content see description above
    2013. 

  2013.  * @param $self_closing_tags    see description above
    2014. 

  2014.  * @param $force_tag_closing    see description above
    2015. 

  2015.  * @param $rm_attnames          see description above
    2016. 

  2016.  * @param $bad_attvals          see description above
    2017. 

  2017.  * @param $add_attr_to_tag      see description above
    2018. 

  2018.  * @param $message              message object
    2019. 

  2019.  * @param $id                   message id
    2020. 

  2020.  * @return                      sanitized html safe to show on your pages.
    2021. 

  2021.  */
    2022. 

  2022. function sq_sanitize($body,
    2023. 

  2023.                      $tag_list,
    2024. 

  2024.                      $rm_tags_with_content,
    2025. 

  2025.                      $self_closing_tags,
    2026. 

  2026.                      $force_tag_closing,
    2027. 

  2027.                      $rm_attnames,
    2028. 

  2028.                      $bad_attvals,
    2029. 

  2029.                      $add_attr_to_tag,
    2030. 

  2030.                      $message,
    2031. 

  2031.                      $id,
    2032. 

  2032.                      $mailbox
    2033. 

  2033.                      ){
    2034. 

  2034.     $me = 'sq_sanitize';
    2035. 

  2035.     $rm_tags = array_shift($tag_list);
    2036. 

  2036.     /**
    2037. 

  2037.      * Normalize rm_tags and rm_tags_with_content.
    2038. 

  2038.      */
    2039. 

  2039.     @array_walk($tag_list, 'sq_casenormalize');
    2040. 

  2040.     @array_walk($rm_tags_with_content, 'sq_casenormalize');
    2041. 

  2041.     @array_walk($self_closing_tags, 'sq_casenormalize');
    2042. 

  2042.     /**
    2043. 

  2043.      * See if tag_list is of tags to remove or tags to allow.
    2044. 

  2044.      * false  means remove these tags
    2045. 

  2045.      * true   means allow these tags
    2046. 

  2046.      */
    2047. 

  2047.     $curpos = 0;
    2048. 

  2048.     $open_tags = Array();
    2049. 

  2049.     $trusted = "\n<!-- begin sanitized html -->\n";
    2050. 

  2050.     $skip_content = false;
    2051. 

  2051.     /**
    2052. 

  2052.      * Take care of netscape's stupid javascript entities like
    2053. 

  2053.      * &{alert('boo')};
    2054. 

  2054.      */
    2055. 

  2055.     $body = preg_replace("/&(\{.*?\};)/si", "&amp;\\1", $body);
    2056. 

  2056. 

  2057.     while (($curtag = sq_getnxtag($body, $curpos)) != FALSE){
    2058. 

  2058.         list($tagname, $attary, $tagtype, $lt, $gt) = $curtag;
    2059. 

  2059.         $free_content = substr($body, $curpos, $lt-$curpos);
    2060. 

  2060.         /**
    2061. 

  2061.          * Take care of <style>
    2062. 

  2062.          */
    2063. 

  2063.         if ($tagname == "style" && $tagtype == 1){
    2064. 

  2064.             list($free_content, $curpos) =
    2065. 

  2065.                 sq_fixstyle($body, $gt+1, $message, $id, $mailbox);
    2066. 

  2066.             if ($free_content != FALSE){
    2067. 

  2067.                 $trusted .= sq_tagprint($tagname, $attary, $tagtype);
    2068. 

  2068.                 $trusted .= $free_content;
    2069. 

  2069.                 $trusted .= sq_tagprint($tagname, false, 2);
    2070. 

  2070.             }
    2071. 

  2071.             continue;
    2072. 

  2072.         }
    2073. 

  2073.         if ($skip_content == false){
    2074. 

  2074.             $trusted .= $free_content;
    2075. 

  2075.         }
    2076. 

  2076.         if ($tagname != FALSE){
    2077. 

  2077.             if ($tagtype == 2){
    2078. 

  2078.                 if ($skip_content == $tagname){
    2079. 

  2079.                     /**
    2080. 

  2080.                      * Got to the end of tag we needed to remove.
    2081. 

  2081.                      */
    2082. 

  2082.                     $tagname = false;
    2083. 

  2083.                     $skip_content = false;
    2084. 

  2084.                 } else {
    2085. 

  2085.                     if ($skip_content == false){
    2086. 

  2086.                         if ($tagname == "body"){
    2087. 

  2087.                             $tagname = "div";
    2088. 

  2088.                         }
    2089. 

  2089.                         if (isset($open_tags{$tagname}) &&
    2090. 

  2090.                                 $open_tags{$tagname} > 0){
    2091. 

  2091.                             $open_tags{$tagname}--;
    2092. 

  2092.                         } else {
    2093. 

  2093.                             $tagname = false;
    2094. 

  2094.                         }
    2095. 

  2095.                     }
    2096. 

  2096.                 }
    2097. 

  2097.             } else {
    2098. 

  2098.                 /**
    2099. 

  2099.                  * $rm_tags_with_content
    2100. 

  2100.                  */
    2101. 

  2101.                 if ($skip_content == false){
    2102. 

  2102.                     /**
    2103. 

  2103.                      * See if this is a self-closing type and change
    2104. 

  2104.                      * tagtype appropriately.
    2105. 

  2105.                      */
    2106. 

  2106.                     if ($tagtype == 1
    2107. 

  2107.                             && in_array($tagname, $self_closing_tags)){
    2108. 

  2108.                         $tagtype = 3;
    2109. 

  2109.                     }
    2110. 

  2110.                     /**
    2111. 

  2111.                      * See if we should skip this tag and any content
    2112. 

  2112.                      * inside it.
    2113. 

  2113.                      */
    2114. 

  2114.                     if ($tagtype == 1 &&
    2115. 

  2115.                             in_array($tagname, $rm_tags_with_content)){
    2116. 

  2116.                         $skip_content = $tagname;
    2117. 

  2117.                     } else {
    2118. 

  2118.                         if (($rm_tags == false
    2119. 

  2119.                                     && in_array($tagname, $tag_list)) ||
    2120. 

  2120.                                 ($rm_tags == true &&
    2121. 

  2121.                                  !in_array($tagname, $tag_list))){
    2122. 

  2122.                             $tagname = false;
    2123. 

  2123.                         } else {
    2124. 

  2124.                             /**
    2125. 

  2125.                              * Convert body into div.
    2126. 

  2126.                              */
    2127. 

  2127.                             if ($tagname == "body"){
    2128. 

  2128.                                 $tagname = "div";
    2129. 

  2129.                                 $attary = sq_body2div($attary, $mailbox,
    2130. 

  2130.                                         $message, $id);
    2131. 

  2131.                             }
    2132. 

  2132.                             if ($tagtype == 1){
    2133. 

  2133.                                 if (isset($open_tags{$tagname})){
    2134. 

  2134.                                     $open_tags{$tagname}++;
    2135. 

  2135.                                 } else {
    2136. 

  2136.                                     $open_tags{$tagname}=1;
    2137. 

  2137.                                 }
    2138. 

  2138.                             }
    2139. 

  2139.                             /**
    2140. 

  2140.                              * This is where we run other checks.
    2141. 

  2141.                              */
    2142. 

  2142.                             if (is_array($attary) && sizeof($attary) > 0){
    2143. 

  2143.                                 $attary = sq_fixatts($tagname,
    2144. 

  2144.                                                      $attary,
    2145. 

  2145.                                                      $rm_attnames,
    2146. 

  2146.                                                      $bad_attvals,
    2147. 

  2147.                                                      $add_attr_to_tag,
    2148. 

  2148.                                                      $message,
    2149. 

  2149.                                                      $id,
    2150. 

  2150.                                                      $mailbox
    2151. 

  2151.                                                      );
    2152. 

  2152.                             }
    2153. 

  2153.                         }
    2154. 

  2154.                     }
    2155. 

  2155.                 }
    2156. 

  2156.             }
    2157. 

  2157.             if ($tagname != false && $skip_content == false){
    2158. 

  2158.                 $trusted .= sq_tagprint($tagname, $attary, $tagtype);
    2159. 

  2159.             }
    2160. 

  2160.         }
    2161. 

  2161.         $curpos = $gt+1;
    2162. 

  2162.     }
    2163. 

  2163.     $trusted .= substr($body, $curpos, strlen($body)-$curpos);
    2164. 

  2164.     if ($force_tag_closing == true){
    2165. 

  2165.         foreach ($open_tags as $tagname=>$opentimes){
    2166. 

  2166.             while ($opentimes > 0){
    2167. 

  2167.                 $trusted .= '</' . $tagname . '>';
    2168. 

  2168.                 $opentimes--;
    2169. 

  2169.             }
    2170. 

  2170.         }
    2171. 

  2171.         $trusted .= "\n";
    2172. 

  2172.     }
    2173. 

  2173.     $trusted .= "<!-- end sanitized html -->\n";
    2174. 

  2174.     return $trusted;
    2175. 

  2175. }
    2176. 

  2176. 

  2177. /**
    2178. 

  2178.  * This is a wrapper function to call html sanitizing routines.
    2179. 

  2179.  *
    2180. 

  2180.  * @param  $body  the body of the message
    2181. 

  2181.  * @param  $id    the id of the message
    2182. 

  2182.  * @return        a string with html safe to display in the browser.
    2183. 

  2183.  */
    2184. 

  2184. function magicHTML($body, $id, $message, $mailbox = 'INBOX') {
    2185. 

  2185.     global $attachment_common_show_images, $view_unsafe_images,
    2186. 

  2186.            $has_unsafe_images;
    2187. 

  2187.     /**
    2188. 

  2188.      * Don't display attached images in HTML mode.
    2189. 

  2189.      */
    2190. 

  2190.     $attachment_common_show_images = false;
    2191. 

  2191.     $tag_list = Array(
    2192. 

  2192.             false,
    2193. 

  2193.             "object",
    2194. 

  2194.             "meta",
    2195. 

  2195.             "html",
    2196. 

  2196.             "head",
    2197. 

  2197.             "base",
    2198. 

  2198.             "link",
    2199. 

  2199.             "frame",
    2200. 

  2200.             "iframe",
    2201. 

  2201.             "plaintext",
    2202. 

  2202.             "marquee"
    2203. 

  2203.             );
    2204. 

  2204. 

  2205.     $rm_tags_with_content = Array(
    2206. 

  2206.             "script",
    2207. 

  2207.             "applet",
    2208. 

  2208.             "embed",
    2209. 

  2209.             "title",
    2210. 

  2210.             "frameset",
    2211. 

  2211.             "xmp",
    2212. 

  2212.             "xml"
    2213. 

  2213.             );
    2214. 

  2214. 

  2215.     $self_closing_tags =  Array(
    2216. 

  2216.             "img",
    2217. 

  2217.             "br",
    2218. 

  2218.             "hr",
    2219. 

  2219.             "input",
    2220. 

  2220.             "outbind"
    2221. 

  2221.             );
    2222. 

  2222. 

  2223.     $force_tag_closing = true;
    2224. 

  2224. 

  2225.     $rm_attnames = Array(
    2226. 

  2226.             "/.*/" =>
    2227. 

  2227.             Array(
    2228. 

  2228.                 "/target/i",
    2229. 

  2229.                 "/^on.*/i",
    2230. 

  2230.                 "/^dynsrc/i",
    2231. 

  2231.                 "/^data.*/i",
    2232. 

  2232.                 "/^lowsrc.*/i"
    2233. 

  2233.                 )
    2234. 

  2234.             );
    2235. 

  2235. 

  2236.     $secremoveimg = "../images/" . _("sec_remove_eng.png");
    2237. 

  2237.     $bad_attvals = Array(
    2238. 

  2238.             "/.*/" =>
    2239. 

  2239.             Array(
    2240. 

  2240.                 "/^src|background/i" =>
    2241. 

  2241.                 Array(
    2242. 

  2242.                     Array(
    2243. 

  2243.                         "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
    2244. 

  2244.                         "/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
    2245. 

  2245.                         "/^([\'\"])\s*about\s*:.*([\'\"])/si"
    2246. 

  2246.                         ),
    2247. 

  2247.                     Array(
    2248. 

  2248.                         "\\1$secremoveimg\\2",
    2249. 

  2249.                         "\\1$secremoveimg\\2",
    2250. 

  2250.                         "\\1$secremoveimg\\2"
    2251. 

  2251.                         )
    2252. 

  2252.                     ),
    2253. 

  2253.                 "/^href|action/i" =>
    2254. 

  2254.                 Array(
    2255. 

  2255.                     Array(
    2256. 

  2256.                         "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si",
    2257. 

  2257.                         "/^([\'\"])\s*mocha\s*:*.*([\'\"])/si",
    2258. 

  2258.                         "/^([\'\"])\s*about\s*:.*([\'\"])/si"
    2259. 

  2259.                         ),
    2260. 

  2260.                     Array(
    2261. 

  2261.                         "\\1#\\1",
    2262. 

  2262.                         "\\1#\\1",
    2263. 

  2263.                         "\\1#\\1"
    2264. 

  2264.                         )
    2265. 

  2265.                     ),
    2266. 

  2266.         "/^style/i" =>
    2267. 

  2267.             Array(
    2268. 

  2268.                 Array(
    2269. 

  2269.                     "/\/\*.*\*\//",
    2270. 

  2270.                     "/expression/i",
    2271. 

  2271.                     "/binding/i",
    2272. 

  2272.                     "/behaviou*r/i",
    2273. 

  2273.                     "/include-source/i",
    2274. 

  2274.                     "/position\s*:\s*absolute/i",
    2275. 

  2275.                     "/(\\\\)?u(\\\\)?r(\\\\)?l(\\\\)?/i",
    2276. 

  2276.                     "/url\s*\(\s*([\'\"])\s*\S+script\s*:.*([\'\"])\s*\)/si",
    2277. 

  2277.                     "/url\s*\(\s*([\'\"])\s*mocha\s*:.*([\'\"])\s*\)/si",
    2278. 

  2278.                     "/url\s*\(\s*([\'\"])\s*about\s*:.*([\'\"])\s*\)/si",
    2279. 

  2279.                     "/(.*)\s*:\s*url\s*\(\s*([\'\"]*)\s*\S+script\s*:.*([\'\"]*)\s*\)/si"
    2280. 

  2280.                     ),
    2281. 

  2281.                 Array(
    2282. 

  2282.                     "",
    2283. 

  2283.                     "idiocy",
    2284. 

  2284.                     "idiocy",
    2285. 

  2285.                     "idiocy",
    2286. 

  2286.                     "idiocy",
    2287. 

  2287.                     "idiocy",
    2288. 

  2288.                     "url",
    2289. 

  2289.                     "url(\\1#\\1)",
    2290. 

  2290.                     "url(\\1#\\1)",
    2291. 

  2291.                     "url(\\1#\\1)",
    2292. 

  2292.                     "\\1:url(\\2#\\3)"
    2293. 

  2293.                     )
    2294. 

  2294.                 )
    2295. 

  2295.             )
    2296. 

  2296.         );
    2297. 

  2297.     if( !sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET) ) {
    2298. 

  2298.         $view_unsafe_images = false;
    2299. 

  2299.     }
    2300. 

  2300.     if (!$view_unsafe_images){
    2301. 

  2301.         /**
    2302. 

  2302.          * Remove any references to http/https if view_unsafe_images set
    2303. 

  2303.          * to false.
    2304. 

  2304.          */
    2305. 

  2305.         array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[0],
    2306. 

  2306.                 '/^([\'\"])\s*https*:.*([\'\"])/si');
    2307. 

  2307.         array_push($bad_attvals{'/.*/'}{'/^src|background/i'}[1],
    2308. 

  2308.                 "\\1$secremoveimg\\1");
    2309. 

  2309.         array_push($bad_attvals{'/.*/'}{'/^style/i'}[0],
    2310. 

  2310.                 '/url\([\'\"]?https?:[^\)]*[\'\"]?\)/si');
    2311. 

  2311.         array_push($bad_attvals{'/.*/'}{'/^style/i'}[1],
    2312. 

  2312.                 "url(\\1$secremoveimg\\1)");
    2313. 

  2313.     }
    2314. 

  2314. 

  2315.     $add_attr_to_tag = Array(
    2316. 

  2316.             "/^a$/i" =>
    2317. 

  2317.             Array('target'=>'"_blank"',
    2318. 

  2318.                 'title'=>'"'._("This external link will open in a new window").'"'
    2319. 

  2319.                 )
    2320. 

  2320.             );
    2321. 

  2321.     $trusted = sq_sanitize($body,
    2322. 

  2322.                            $tag_list,
    2323. 

  2323.                            $rm_tags_with_content,
    2324. 

  2324.                            $self_closing_tags,
    2325. 

  2325.                            $force_tag_closing,
    2326. 

  2326.                            $rm_attnames,
    2327. 

  2327.                            $bad_attvals,
    2328. 

  2328.                            $add_attr_to_tag,
    2329. 

  2329.                            $message,
    2330. 

  2330.                            $id,
    2331. 

  2331.                            $mailbox
    2332. 

  2332.                            );
    2333. 

  2333.     if (strpos($trusted,$secremoveimg)){
    2334. 

  2334.         $has_unsafe_images = true;
    2335. 

  2335.     }
    2336. 

  2336.     return $trusted;
    2337. 

  2337. }
    2338. 

  2338. 

  2339. /**
    2340. 

  2340.  * function SendDownloadHeaders - send file to the browser
    2341. 

  2341.  *
    2342. 

  2342.  * Original Source: SM core src/download.php
    2343. 

  2343.  * moved here to make it available to other code, and separate
    2344. 

  2344.  * front end from back end functionality.
    2345. 

  2345.  *
    2346. 

  2346.  * @param string $type0 first half of mime type
    2347. 

  2347.  * @param string $type1 second half of mime type
    2348. 

  2348.  * @param string $filename filename to tell the browser for downloaded file
    2349. 

  2349.  * @param boolean $force whether to force the download dialog to pop
    2350. 

  2350.  * @param optional integer $filesize send the Content-Header and length to the browser
    2351. 

  2351.  * @return void
    2352. 

  2352.  */
    2353. 

  2353. function SendDownloadHeaders($type0, $type1, $filename, $force, $filesize=0) {
    2354. 

  2354.     global $languages, $squirrelmail_language;
    2355. 

  2355.     $isIE = $isIE6plus = false;
    2356. 

  2356. 

  2357.     sqgetGlobalVar('HTTP_USER_AGENT', $HTTP_USER_AGENT, SQ_SERVER);
    2358. 

  2358. 

  2359.     if (strstr($HTTP_USER_AGENT, 'compatible; MSIE ') !== false &&
    2360. 

  2360.             strstr($HTTP_USER_AGENT, 'Opera') === false) {
    2361. 

  2361.         $isIE = true;
    2362. 

  2362.     }
    2363. 

  2363. 

  2364.     if (preg_match('/compatible; MSIE ([0-9]+)/', $HTTP_USER_AGENT, $match) &&
    2365. 

  2365.         ((int)$match[1]) >= 6 && strstr($HTTP_USER_AGENT, 'Opera') === false) {
    2366. 

  2366.         $isIE6plus = true;
    2367. 

  2367.     }
    2368. 

  2368. 

  2369.     if (isset($languages[$squirrelmail_language]['XTRA_CODE']) &&
    2370. 

  2370.             function_exists($languages[$squirrelmail_language]['XTRA_CODE'])) {
    2371. 

  2371.         $filename =
    2372. 

  2372.             $languages[$squirrelmail_language]['XTRA_CODE']('downloadfilename', $filename, $HTTP_USER_AGENT);
    2373. 

  2373.     } else {
    2374. 

  2374.         $filename = ereg_replace('[\\/:\*\?"<>\|;]', '_', str_replace('&#32;', ' ', $filename));
    2375. 

  2375.     }
    2376. 

  2376. 

  2377.     // A Pox on Microsoft and it's Internet Explorer!
    2378. 

  2378.     //
    2379. 

  2379.     // IE has lots of bugs with file downloads.
    2380. 

  2380.     // It also has problems with SSL.  Both of these cause problems
    2381. 

  2381.     // for us in this function.
    2382. 

  2382.     //
    2383. 

  2383.     // See this article on Cache Control headers and SSL
    2384. 

  2384.     // http://support.microsoft.com/default.aspx?scid=kb;en-us;323308
    2385. 

  2385.     //
    2386. 

  2386.     // The best thing you can do for IE is to upgrade to the latest
    2387. 

  2387.     // version
    2388. 

  2388.     //set all the Cache Control Headers for IE
    2389. 

  2389.     if ($isIE) {
    2390. 

  2390.         $filename=rawurlencode($filename);
    2391. 

  2391.         header ("Pragma: public");
    2392. 

  2392.         header ("Cache-Control: no-store, max-age=0, no-cache, must-revalidate"); // HTTP/1.1
    2393. 

  2393.         header ("Cache-Control: post-check=0, pre-check=0", false);
    2394. 

  2394.         header ("Cache-Control: private");
    2395. 

  2395. 

  2396.         //set the inline header for IE, we'll add the attachment header later if we need it
    2397. 

  2397.         header ("Content-Disposition: inline; filename=$filename");
    2398. 

  2398.     }
    2399. 

  2399. 

  2400.     if (!$force) {
    2401. 

  2401.         // Try to show in browser window
    2402. 

  2402.         header ("Content-Disposition: inline; filename=\"$filename\"");
    2403. 

  2403.         header ("Content-Type: $type0/$type1; name=\"$filename\"");
    2404. 

  2404.     } else {
    2405. 

  2405.         // Try to pop up the "save as" box
    2406. 

  2406. 

  2407.         // IE makes this hard.  It pops up 2 save boxes, or none.
    2408. 

  2408.         // http://support.microsoft.com/support/kb/articles/Q238/5/88.ASP
    2409. 

  2409.         // http://support.microsoft.com/default.aspx?scid=kb;EN-US;260519
    2410. 

  2410.         // But, according to Microsoft, it is "RFC compliant but doesn't
    2411. 

  2411.         // take into account some deviations that allowed within the
    2412. 

  2412.         // specification."  Doesn't that mean RFC non-compliant?
    2413. 

  2413.         // http://support.microsoft.com/support/kb/articles/Q258/4/52.ASP
    2414. 

  2414. 

  2415.         // all browsers need the application/octet-stream header for this
    2416. 

  2416.         header ("Content-Type: application/octet-stream; name=\"$filename\"");
    2417. 

  2417. 

  2418.         // http://support.microsoft.com/support/kb/articles/Q182/3/15.asp
    2419. 

  2419.         // Do not have quotes around filename, but that applied to
    2420. 

  2420.         // "attachment"... does it apply to inline too?
    2421. 

  2421.         header ("Content-Disposition: attachment; filename=\"$filename\"");
    2422. 

  2422. 

  2423.         if ($isIE && !$isIE6plus) {
    2424. 

  2424.             // This combination seems to work mostly.  IE 5.5 SP 1 has
    2425. 

  2425.             // known issues (see the Microsoft Knowledge Base)
    2426. 

  2426. 

  2427.             // This works for most types, but doesn't work with Word files
    2428. 

  2428.             header ("Content-Type: application/download; name=\"$filename\"");
    2429. 

  2429.             // This is to prevent IE for MIME sniffing and auto open a file in IE
    2430. 

  2430.             header ("Content-Type: application/force-download; name=\"$filename\"");
    2431. 

  2431.             // These are spares, just in case.  :-)
    2432. 

  2432.             //header("Content-Type: $type0/$type1; name=\"$filename\"");
    2433. 

  2433.             //header("Content-Type: application/x-msdownload; name=\"$filename\"");
    2434. 

  2434.             //header("Content-Type: application/octet-stream; name=\"$filename\"");
    2435. 

  2435.         } else if ($isIE) {
    2436. 

  2436.              // This is to prevent IE for MIME sniffing and auto open a file in IE
    2437. 

  2437.              header ("Content-Type: application/force-download; name=\"$filename\"");
    2438. 

  2438.         } else {
    2439. 

  2439.             // another application/octet-stream forces download for Netscape
    2440. 

  2440.             header ("Content-Type: application/octet-stream; name=\"$filename\"");
    2441. 

  2441.         }
    2442. 

  2442.     }
    2443. 

  2443. 

  2444.     //send the content-length header if the calling function provides it
    2445. 

  2445.     if ($filesize > 0) {
    2446. 

  2446.         header("Content-Length: $filesize");
    2447. 

  2447.     }
    2448. 

  2448. 

  2449. }  // end fn SendDownloadHeaders
    2450. 

  2450. 

  2451. ?>
    2452. 

  2452.