Changeset 6a35c82 in github


Ignore:
Timestamp:
Nov 2, 2005 5:43:55 PM (8 years ago)
Author:
thomascube <thomas@…>
Branches:
master, HEAD, courier-fix, dev-browser-capabilities, pdo, release-0.6, release-0.7, release-0.8
Children:
317219d
Parents:
fd660ac
Message:

Added more XSS protection (Bug #1308236) and some visual enhancements

Files:
6 edited

Legend:

Unmodified
Added
Removed

  • program/js/app.js

    rfd660ac r6a35c82  
    20472047      { 
    20482048      var item, reg, text_obj; 
     2049      var s_current = this.env.mailbox.toLowerCase().replace(this.mbox_expression, ''); 
    20492050      var s_mbox = String(mbox).toLowerCase().replace(this.mbox_expression, ''); 
    20502051      var s_current = this.env.mailbox.toLowerCase().replace(this.mbox_expression, ''); 
    2051       var nodes = this.gui_objects.mailboxlist.getElementsByTagName('LI'); 
    2052        
    2053       for (var n=0; n<nodes.length; n++) 
    2054         { 
    2055         item = nodes[n]; 
    2056         if (item.className && item.className.indexOf('mailbox '+s_mbox+' ')>=0) 
    2057           this.set_classname(item, 'selected', true); 
    2058         else if (item.className && item.className.indexOf('mailbox '+s_current)>=0) 
    2059           this.set_classname(item, 'selected', false);           
    2060         } 
     2052       
     2053      var current_li = document.getElementById('rcmbx'+s_current); 
     2054      var mbox_li = document.getElementById('rcmbx'+s_mbox); 
     2055       
     2056      if (current_li) 
     2057        this.set_classname(current_li, 'selected', false); 
     2058      if (mbox_li) 
     2059        this.set_classname(mbox_li, 'selected', true); 
    20612060      } 
    20622061     

  • program/steps/mail/func.inc

    r7cc38e0 r6a35c82  
    4242 
    4343 
     44// set default sort col/order to session 
     45if (!isset($_SESSION['sort_col'])) 
     46  $_SESSION['sort_col'] = $CONFIG['message_sort_col']; 
     47if (!isset($_SESSION['sort_order'])) 
     48  $_SESSION['sort_order'] = $CONFIG['message_sort_order']; 
     49   
     50 
    4451// define url for getting message parts 
    4552if (strlen($_GET['_uid'])) 
    … …  
    148155function rcmail_render_folder_tree_html(&$arrFolders, &$special, &$mbox, $maxlength, $nestLevel=0) 
    149156  { 
    150   global $JS_OBJECT_NAME, $IMAP; 
     157  global $JS_OBJECT_NAME, $IMAP, $CONFIG; 
    151158 
    152159  $idx = 0; 
    … …  
    171178    if ($unread_count = $IMAP->messagecount($folder['id'], 'UNSEEN', ($folder['id']==$mbox))) 
    172179      $foldername .= sprintf(' (%d)', $unread_count); 
    173  
    174     $out .= sprintf('<li class="mailbox %s %s%s%s"><a href="#%s" onclick="return %s.command(\'list\',\'%s\')" onmouseup="return %s.mbox_mouse_up(\'%s\')">%s</a>'."\n", 
    175                     preg_replace('/[^a-z0-9\-_]/', '', $folder_lc), 
     180       
     181    // make folder name safe for ids and class names 
     182    $folder_css = $class_name = preg_replace('/[^a-z0-9\-_]/', '', $folder_lc); 
     183 
     184    // set special class for Sent, Drafts, Trash and Junk 
     185    if ($folder['id']==$CONFIG['sent_mbox']) 
     186      $class_name = 'sent'; 
     187    else if ($folder['id']==$CONFIG['drafts_mbox']) 
     188      $class_name = 'drafts'; 
     189    else if ($folder['id']==$CONFIG['trash_mbox']) 
     190      $class_name = 'trash'; 
     191    else if ($folder['id']==$CONFIG['junk_mbox']) 
     192      $class_name = 'junk'; 
     193 
     194    $out .= sprintf('<li id="rcmbx%s" class="mailbox %s %s%s%s"><a href="./#%s" onclick="return %s.command(\'list\',\'%s\')" onmouseup="return %s.mbox_mouse_up(\'%s\')">%s</a>', 
     195                    $folder_css, 
     196                    $class_name, 
    176197                    $zebra_class, 
    177198                    $unread_count ? ' unread' : '', 
    … …  
    185206 
    186207    if (!empty($folder['folders'])) 
    187       $out .= '<ul>' . rcmail_render_folder_tree_html($folder['folders'], $special, $mbox, $maxlength, $nestLevel+1) . "</ul>\n"; 
     208      $out .= "\n<ul>\n" . rcmail_render_folder_tree_html($folder['folders'], $special, $mbox, $maxlength, $nestLevel+1) . "</ul>\n"; 
    188209 
    189210    $out .= "</li>\n"; 
    … …  
    240261 
    241262  // check to see if we have some settings for sorting 
    242   $sort_col   = isset($_SESSION['sort_col'])   ? $_SESSION['sort_col']   : $CONFIG['message_sort_col']; 
    243   $sort_order = isset($_SESSION['sort_order']) ? $_SESSION['sort_order'] : $CONFIG['message_sort_order']; 
     263  $sort_col   = $_SESSION['sort_col']; 
     264  $sort_order = $_SESSION['sort_order']; 
    244265 
    245266  // get message headers 
    … …  
    9831004 
    9841005  // remove SCRIPT tags 
    985   while (($pos = strpos($body_lc, '<script')) && ($pos2 = strpos($body_lc, '</script>', $pos))) 
    986     { 
    987     $pos2 += 8; 
    988     $body = substr($body, 0, $pos) . substr($body, $pos2, strlen($body)-$pos2); 
    989     $body_lc = strtolower($body); 
    990     } 
    991    
     1006  foreach (array('script', 'applet', 'object', 'embed', 'iframe') as $tag) 
     1007    { 
     1008    while (($pos = strpos($body_lc, '<'.$tag)) && ($pos2 = strpos($body_lc, '</'.$tag.'>', $pos))) 
     1009      { 
     1010      $pos2 += 8; 
     1011      $body = substr($body, 0, $pos) . substr($body, $pos2, strlen($body)-$pos2); 
     1012      $body_lc = strtolower($body); 
     1013      } 
     1014    } 
     1015 
     1016  // replace event handlers on any object 
     1017  $body = preg_replace('/\s(on[a-z]+)=/im', ' __removed=', $body);   
    9921018 
    9931019  // resolve <base href> 
    … …  
    10001026    $body = preg_replace($base_reg, '', $body); 
    10011027    } 
    1002  
    10031028 
    10041029  // add comments arround html and other tags 

  • program/steps/mail/sendmail.inc

    rfd660ac r6a35c82  
    6666 
    6767 
    68 $mailto_regexp = '/,\s*$/'; 
    69  
    70 // trip ending ', ' from  
    71 $mailto = preg_replace($mailto_regexp, '', $_POST['_to']); 
     68$mailto_regexp = array('/,\s*[\r\n]+/', '/[\r\n]+/', '/,\s*$/m'); 
     69$mailto_replace = array(' ', ', ', ''); 
     70 
     71// repalce new lines and strip ending ', ' 
     72$mailto = preg_replace($mailto_regexp, $mailto_replace, stripslashes($_POST['_to'])); 
    7273 
    7374// decode address strings 
    … …  
    9192// additional recipients 
    9293if ($_POST['_cc']) 
    93   $headers['Cc'] = preg_replace($mailto_regexp, '', $_POST['_cc']); 
     94  $headers['Cc'] = preg_replace($mailto_regexp, $mailto_replace, stripslashes($_POST['_cc'])); 
    9495 
    9596if ($_POST['_bcc']) 
    96   $headers['Bcc'] = preg_replace($mailto_regexp, '', $_POST['_bcc']); 
     97  $headers['Bcc'] = preg_replace($mailto_regexp, $mailto_replace, stripslashes($_POST['_bcc'])); 
    9798   
    9899if (strlen($identity_arr['bcc'])) 

  • skins/default/mail.css

    rb076a46 r6a35c82  
    7676  top: 60px; 
    7777  right: 40px; 
    78   width: 250px; 
     78  width: 200px; 
    7979  height: 20px; 
    8080  text-align: right; 
    … …  
    413413  left: 200px; 
    414414  right: 40px; 
     415  bottom: 40px; 
     416  border: 1px solid #cccccc; 
     417  background-color: #FFFFFF; 
     418  overflow: auto; 
    415419  /* css hack for IE */ 
    416   margin-bottom: 10px; 
    417   width: expression(document.body.clientWidth-240); 
     420  /* margin-bottom: 10px; */ 
     421  width: expression((parseInt(document.documentElement.clientWidth)-240)+'px'); 
     422  height: expression((parseInt(document.documentElement.clientHeight)-125)+'px'); 
    418423} 
    419424 
    … …  
    434439table.headers-table td.header-title 
    435440{ 
    436   width: 70px;   
     441  width: 80px; 
    437442  color: #666666; 
    438443  font-weight: bold; 
    439444  text-align: right; 
     445  white-space: nowrap; 
    440446  padding-right: 4px; 
    441447} 
    … …  
    482488{ 
    483489  min-height: 300px; 
    484   margin-top: 10px; 
    485   margin-bottom: 10px; 
     490  padding-top: 10px; 
     491  padding-bottom: 10px; 
    486492  background-color: #FFFFFF; 
    487   border: 1px solid #cccccc; 
    488   border-top: none; 
    489493} 
    490494 
    … …  
    493497  padding: 8px; 
    494498  padding-top: 10px; 
    495   border-top: 1px solid #cccccc; 
    496499  overflow: hidden; 
    497500} 
    … …  
    514517  height: 20px; 
    515518  min-height: 20px; 
     519  margin: 8px 8px 0px 8px; 
    516520  padding: 10px 10px 6px 46px;   
    517   margin-top: 8px; 
    518521} 
    519522 
    … …  
    545548  left: 200px; 
    546549  right: 40px; 
    547   bottom: 20px; 
     550  bottom: 40px; 
    548551  padding: 0px; 
    549552  margin: 0px; 
    550553  /* css hack for IE */ 
    551554  width: expression(document.documentElement.clientWidth-240); 
    552   /* height: expression((parseInt(document.documentElement.clientHeight)-130)+'px'); */ 
     555  height: expression((parseInt(document.documentElement.clientHeight)-130)+'px'); 
    553556} 
    554557 
    … …  
    636639{ 
    637640  margin-top: 10px; 
    638   width: 100% !important; 
     641  width: 99% !important; 
    639642  width: 95%; 
    640643  height: 95%; 
    641   min-height: 400px; 
     644  min-height: 300px; 
    642645  font-size: 9pt; 
    643646  font-family: "Courier New", Courier, monospace; 

  • skins/default/templates/compose.html

    rb076a46 r6a35c82  
    8888</tr><tr> 
    8989 
    90 <td style="width:100%; height:100%;"> 
     90<td style="width:100%; height:100%; vertical-align:top;"> 
    9191<roundcube:object name="composeBody" id="compose-body" form="form" cols="80" rows="20" warp="virtual" /> 
    9292</td> 

  • skins/default/templates/message.html

    rb076a46 r6a35c82  
    1111<roundcube:include file="/includes/header.html" /> 
    1212 
     13<div id="messagecountbar"> 
     14<roundcube:button command="previousmessage" imageAct="/images/buttons/previous_act.png" imagePas="/images/buttons/previous_pas.png" width="11" height="11" title="previousmessages" /> 
     15&nbsp;<roundcube:object name="messageCountDisplay" />&nbsp; 
     16<roundcube:button command="nextmessage" imageAct="/images/buttons/next_act.png" imagePas="/images/buttons/next_pas.png" width="11" height="11" title="nextmessages" /> 
     17</div> 
     18 
    1319<div id="messagetoolbar"> 
    1420<roundcube:button command="list" image="/images/buttons/back_act.png" width="32" height="32" title="backtolist" /> 
    … …  
    1925<roundcube:button command="viewsource" imageAct="/images/buttons/source_act.png" imagePas="/images/buttons/source_pas.png" width="32" height="32" title="viewsource" /> 
    2026<roundcube:object name="mailboxlist" type="select" noSelection="moveto" maxlength="25" onchange="rcmail.command('moveto', this.options[this.selectedIndex].value)" class="mboxlist" /> 
    21 </div> 
    22  
    23 <div id="messagecountbar"> 
    24 <roundcube:button command="previousmessage" imageAct="/images/buttons/previous_act.png" imagePas="/images/buttons/previous_pas.png" width="11" height="11" title="previousmessages" /> 
    25 &nbsp;<roundcube:object name="messageCountDisplay" />&nbsp; 
    26 <roundcube:button command="nextmessage" imageAct="/images/buttons/next_act.png" imagePas="/images/buttons/next_pas.png" width="11" height="11" title="nextmessages" /> 
    2727</div> 
    2828 
Note: See TracChangeset for help on using the changeset viewer.