| 1 | <?php |
|---|
| 2 | |
|---|
| 3 | /* |
|---|
| 4 | +-----------------------------------------------------------------------+ |
|---|
| 5 | | program/steps/mail/get.inc | |
|---|
| 6 | | | |
|---|
| 7 | | This file is part of the Roundcube Webmail client | |
|---|
| 8 | | Copyright (C) 2005-2011, The Roundcube Dev Team | |
|---|
| 9 | | | |
|---|
| 10 | | Licensed under the GNU General Public License version 3 or | |
|---|
| 11 | | any later version with exceptions for skins & plugins. | |
|---|
| 12 | | See the README file for a full license statement. | |
|---|
| 13 | | | |
|---|
| 14 | | PURPOSE: | |
|---|
| 15 | | Delivering a specific part of a mail message | |
|---|
| 16 | | | |
|---|
| 17 | +-----------------------------------------------------------------------+ |
|---|
| 18 | | Author: Thomas Bruederli <roundcube@gmail.com> | |
|---|
| 19 | +-----------------------------------------------------------------------+ |
|---|
| 20 | |
|---|
| 21 | $Id$ |
|---|
| 22 | |
|---|
| 23 | */ |
|---|
| 24 | |
|---|
| 25 | |
|---|
| 26 | // show loading page |
|---|
| 27 | if (!empty($_GET['_preload'])) { |
|---|
| 28 | $url = preg_replace('/[&?]+_preload=1/', '', $_SERVER['REQUEST_URI']); |
|---|
| 29 | $message = rcube_label('loadingdata'); |
|---|
| 30 | |
|---|
| 31 | header('Content-Type: text/html; charset=' . RCMAIL_CHARSET); |
|---|
| 32 | print "<html>\n<head>\n" |
|---|
| 33 | . '<meta http-equiv="refresh" content="0; url='.Q($url).'">' . "\n" |
|---|
| 34 | . '<meta http-equiv="content-type" content="text/html; charset='.RCMAIL_CHARSET.'">' . "\n" |
|---|
| 35 | . "</head>\n<body>\n$message\n</body>\n</html>"; |
|---|
| 36 | exit; |
|---|
| 37 | } |
|---|
| 38 | |
|---|
| 39 | ob_end_clean(); |
|---|
| 40 | |
|---|
| 41 | // Now we need IMAP connection |
|---|
| 42 | if (!$RCMAIL->storage_connect()) { |
|---|
| 43 | // Get action is often executed simultanously. |
|---|
| 44 | // Some servers have MAXPERIP or other limits. |
|---|
| 45 | // To workaround this we'll wait for some time |
|---|
| 46 | // and try again (once). |
|---|
| 47 | // Note: Random sleep interval is used to minimize concurency |
|---|
| 48 | // in getting message parts |
|---|
| 49 | if (!isset($_GET['_redirected'])) { |
|---|
| 50 | usleep(rand(10,30)*100000); // 1-3 sec. |
|---|
| 51 | header('Location: ' . $_SERVER['REQUEST_URI'] . '&_redirected=1'); |
|---|
| 52 | } |
|---|
| 53 | else { |
|---|
| 54 | raise_error(array( |
|---|
| 55 | 'code' => 500, 'type' => 'php', |
|---|
| 56 | 'file' => __FILE__, 'line' => __LINE__, |
|---|
| 57 | 'message' => 'Unable to get/display message part. IMAP connection error'), |
|---|
| 58 | true, true); |
|---|
| 59 | } |
|---|
| 60 | // Don't kill session, just quit (#1486995) |
|---|
| 61 | exit; |
|---|
| 62 | } |
|---|
| 63 | |
|---|
| 64 | // similar code as in program/steps/mail/show.inc |
|---|
| 65 | if (!empty($_GET['_uid'])) { |
|---|
| 66 | $RCMAIL->config->set('prefer_html', true); |
|---|
| 67 | $MESSAGE = new rcube_message(get_input_value('_uid', RCUBE_INPUT_GET)); |
|---|
| 68 | } |
|---|
| 69 | |
|---|
| 70 | // show part page |
|---|
| 71 | if (!empty($_GET['_frame'])) { |
|---|
| 72 | if (($part_id = get_input_value('_part', RCUBE_INPUT_GPC)) && ($part = $MESSAGE->mime_parts[$part_id]) && $part->filename) |
|---|
| 73 | $OUTPUT->set_pagetitle($part->filename); |
|---|
| 74 | |
|---|
| 75 | $OUTPUT->send('messagepart'); |
|---|
| 76 | exit; |
|---|
| 77 | } |
|---|
| 78 | |
|---|
| 79 | else if (strlen($pid = get_input_value('_part', RCUBE_INPUT_GET))) { |
|---|
| 80 | |
|---|
| 81 | if ($part = $MESSAGE->mime_parts[$pid]) { |
|---|
| 82 | $ctype_primary = strtolower($part->ctype_primary); |
|---|
| 83 | $ctype_secondary = strtolower($part->ctype_secondary); |
|---|
| 84 | $mimetype = sprintf('%s/%s', $ctype_primary, $ctype_secondary); |
|---|
| 85 | |
|---|
| 86 | // allow post-processing of the message body |
|---|
| 87 | $plugin = $RCMAIL->plugins->exec_hook('message_part_get', |
|---|
| 88 | array('uid' => $MESSAGE->uid, 'id' => $part->mime_id, 'mimetype' => $mimetype, 'part' => $part, 'download' => !empty($_GET['_download']))); |
|---|
| 89 | |
|---|
| 90 | if ($plugin['abort']) |
|---|
| 91 | exit; |
|---|
| 92 | |
|---|
| 93 | // overwrite modified vars from plugin |
|---|
| 94 | $mimetype = $plugin['mimetype']; |
|---|
| 95 | list($ctype_primary, $ctype_secondary) = explode('/', $mimetype); |
|---|
| 96 | if ($plugin['body']) |
|---|
| 97 | $part->body = $plugin['body']; |
|---|
| 98 | |
|---|
| 99 | $browser = $RCMAIL->output->browser; |
|---|
| 100 | |
|---|
| 101 | // send download headers |
|---|
| 102 | if ($plugin['download']) { |
|---|
| 103 | header("Content-Type: application/octet-stream"); |
|---|
| 104 | if ($browser->ie) |
|---|
| 105 | header("Content-Type: application/force-download"); |
|---|
| 106 | } |
|---|
| 107 | else if ($ctype_primary == 'text') { |
|---|
| 108 | header("Content-Type: text/$ctype_secondary; charset=" . ($part->charset ? $part->charset : RCMAIL_CHARSET)); |
|---|
| 109 | } |
|---|
| 110 | else { |
|---|
| 111 | $mimetype = rcmail_fix_mimetype($mimetype); |
|---|
| 112 | header("Content-Type: $mimetype"); |
|---|
| 113 | header("Content-Transfer-Encoding: binary"); |
|---|
| 114 | } |
|---|
| 115 | |
|---|
| 116 | // deliver part content |
|---|
| 117 | if ($ctype_primary == 'text' && $ctype_secondary == 'html' && empty($plugin['download'])) { |
|---|
| 118 | // Check if we have enough memory to handle the message in it |
|---|
| 119 | // #1487424: we need up to 10x more memory than the body |
|---|
| 120 | if (!rcmail_mem_check($part->size * 10)) { |
|---|
| 121 | $out = '<body>' . rcube_label('messagetoobig'). ' ' |
|---|
| 122 | . html::a('?_task=mail&_action=get&_download=1&_uid='.$MESSAGE->uid.'&_part='.$part->mime_id |
|---|
| 123 | .'&_mbox='. urlencode($RCMAIL->storage->get_folder()), rcube_label('download')) . '</body></html>'; |
|---|
| 124 | } |
|---|
| 125 | else { |
|---|
| 126 | // get part body if not available |
|---|
| 127 | if (!$part->body) |
|---|
| 128 | $part->body = $MESSAGE->get_part_content($part->mime_id); |
|---|
| 129 | |
|---|
| 130 | $out = rcmail_print_body($part, array('safe' => $MESSAGE->is_safe, 'inline_html' => false)); |
|---|
| 131 | } |
|---|
| 132 | |
|---|
| 133 | $OUTPUT = new rcube_html_page(); |
|---|
| 134 | $OUTPUT->write($out); |
|---|
| 135 | } |
|---|
| 136 | else { |
|---|
| 137 | // don't kill the connection if download takes more than 30 sec. |
|---|
| 138 | @set_time_limit(0); |
|---|
| 139 | |
|---|
| 140 | $ext = '.' . ($mimetype == 'text/plain' ? 'txt' : $ctype_secondary); |
|---|
| 141 | $filename = $part->filename ? $part->filename : ($MESSAGE->subject ? $MESSAGE->subject : 'roundcube') . $ext; |
|---|
| 142 | $filename = preg_replace('[\r\n]', '', $filename); |
|---|
| 143 | |
|---|
| 144 | if ($browser->ie && $browser->ver < 7) |
|---|
| 145 | $filename = rawurlencode(abbreviate_string($filename, 55)); |
|---|
| 146 | else if ($browser->ie) |
|---|
| 147 | $filename = rawurlencode($filename); |
|---|
| 148 | else |
|---|
| 149 | $filename = addcslashes($filename, '"'); |
|---|
| 150 | |
|---|
| 151 | $disposition = !empty($plugin['download']) ? 'attachment' : 'inline'; |
|---|
| 152 | |
|---|
| 153 | header("Content-Disposition: $disposition; filename=\"$filename\""); |
|---|
| 154 | |
|---|
| 155 | // do content filtering to avoid XSS through fake images |
|---|
| 156 | if (!empty($_REQUEST['_embed']) && $browser->ie && $browser->ver <= 8) { |
|---|
| 157 | if ($part->body) |
|---|
| 158 | echo preg_match('/<(script|iframe|object)/i', $part->body) ? '' : $part->body; |
|---|
| 159 | else if ($part->size) { |
|---|
| 160 | $stdout = fopen('php://output', 'w'); |
|---|
| 161 | stream_filter_register('rcube_content', 'rcube_content_filter') or die('Failed to register content filter'); |
|---|
| 162 | stream_filter_append($stdout, 'rcube_content'); |
|---|
| 163 | $RCMAIL->storage->get_message_part($MESSAGE->uid, $part->mime_id, $part, false, $stdout); |
|---|
| 164 | } |
|---|
| 165 | } |
|---|
| 166 | else { |
|---|
| 167 | // turn off output buffering and print part content |
|---|
| 168 | if ($part->body) |
|---|
| 169 | echo $part->body; |
|---|
| 170 | else if ($part->size) |
|---|
| 171 | $RCMAIL->storage->get_message_part($MESSAGE->uid, $part->mime_id, $part, true); |
|---|
| 172 | } |
|---|
| 173 | } |
|---|
| 174 | |
|---|
| 175 | exit; |
|---|
| 176 | } |
|---|
| 177 | } |
|---|
| 178 | |
|---|
| 179 | // print message |
|---|
| 180 | else { |
|---|
| 181 | // send correct headers for content type |
|---|
| 182 | header("Content-Type: text/html"); |
|---|
| 183 | |
|---|
| 184 | $cont = "<html>\n<head><title></title>\n</head>\n<body>"; |
|---|
| 185 | $cont .= rcmail_message_body(array()); |
|---|
| 186 | $cont .= "\n</body>\n</html>"; |
|---|
| 187 | |
|---|
| 188 | $OUTPUT = new rcube_html_page(); |
|---|
| 189 | $OUTPUT->write($cont); |
|---|
| 190 | |
|---|
| 191 | exit; |
|---|
| 192 | } |
|---|
| 193 | |
|---|
| 194 | |
|---|
| 195 | // if we arrive here, the requested part was not found |
|---|
| 196 | header('HTTP/1.1 404 Not Found'); |
|---|
| 197 | exit; |
|---|
| 198 | |
|---|
| 199 | |
|---|
