diff -Nru /tmp/5uJ3phgMuY/squirrelmail-1.4.6/debian/changelog /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/debian/changelog --- /tmp/5uJ3phgMuY/squirrelmail-1.4.6/debian/changelog 2007-05-16 16:05:39.000000000 -0600 +++ /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/debian/changelog 2007-05-16 16:05:51.000000000 -0600 @@ -1,3 +1,23 @@ +squirrelmail (2:1.4.6-1ubuntu0.1) dapper-security; urgency=low + + * SECURITY UPDATE: XSS and CSRF in various areas + * src/compose.php, src/right_main.php, src/login.php, src/mailto.php, + src/redirect.php, src/webmail.php, src/mime.php: back-ported fixes for + XSS in compose, draft and HTML mail. (CVE-2006-6142) + http://www.squirrelmail.org/security/issue/2006-12-02 + * fuctions/mime.php, src/compose.php, src/view_text.php: back-ported fixes + for XSS in HTML filter (CVE-2007-1262) + http://www.squirrelmail.org/security/issue/2007-05-09 + * Local File Inclusion functions/global.php (CVE-2006-2842) + http://www.squirrelmail.org/security/issue/2006-06-01 + * Variable overwriting in compose.php (CVE-2006-4019) + functions/auth.php, src/compose.php, src/login.php + src/redirect.php, src/webmail.php + http://www.squirrelmail.org/security/issue/2006-08-11 + + + -- Leonel Nunez Wed, 16 May 2007 13:02:10 -0600 + squirrelmail (2:1.4.6-1) unstable; urgency=high * New upstream release. diff -Nru /tmp/5uJ3phgMuY/squirrelmail-1.4.6/functions/auth.php /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/functions/auth.php --- /tmp/5uJ3phgMuY/squirrelmail-1.4.6/functions/auth.php 2006-02-03 15:27:47.000000000 -0700 +++ /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/functions/auth.php 2007-05-16 16:05:51.000000000 -0600 @@ -61,6 +61,9 @@ sqsession_register($session_expired_location,'session_expired_location'); } + session_write_close(); + + // signout page will deal with users who aren't logged // in on its own; don't show error here // @@ -230,4 +233,4 @@ return $hmac; } -?> \ No newline at end of file +?> diff -Nru /tmp/5uJ3phgMuY/squirrelmail-1.4.6/functions/global.php /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/functions/global.php --- /tmp/5uJ3phgMuY/squirrelmail-1.4.6/functions/global.php 2006-02-03 15:27:47.000000000 -0700 +++ /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/functions/global.php 2007-05-16 16:05:51.000000000 -0600 @@ -62,6 +62,48 @@ sqstripslashes($_POST); } +/** + * If register_globals are on, unregister globals. + * Code requires PHP 4.1.0 or newer. + * Second test covers boolean set as string (php_value register_globals off). + */ +if ((bool) @ini_get('register_globals') && + strtolower(ini_get('register_globals'))!='off') { + /** + * Remove all globals from $_GET, $_POST, and $_COOKIE. + */ + foreach ($_REQUEST as $key => $value) { + unset($GLOBALS[$key]); + } + /** + * Remove globalized $_FILES variables + * Before 4.3.0 $_FILES are included in $_REQUEST. + * Unglobalize them in separate call in order to remove dependency + * on PHP version. + */ + foreach ($_FILES as $key => $value) { + unset($GLOBALS[$key]); + // there are three undocumented $_FILES globals. + unset($GLOBALS[$key.'_type']); + unset($GLOBALS[$key.'_name']); + unset($GLOBALS[$key.'_size']); + } + /** + * Remove globalized environment variables. + */ + foreach ($_ENV as $key => $value) { + unset($GLOBALS[$key]); + } + /** + * Remove globalized server variables. + */ + foreach ($_SERVER as $key => $value) { + unset($GLOBALS[$key]); + } +} + + + /* strip any tags added to the url from PHP_SELF. This fixes hand crafted url XXS expoits for any page that uses PHP_SELF as the FORM action */ @@ -336,4 +378,4 @@ } // vim: et ts=4 -?> \ No newline at end of file +?> diff -Nru /tmp/5uJ3phgMuY/squirrelmail-1.4.6/functions/mime.php /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/functions/mime.php --- /tmp/5uJ3phgMuY/squirrelmail-1.4.6/functions/mime.php 2006-02-23 07:13:47.000000000 -0700 +++ /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/functions/mime.php 2007-05-16 16:05:51.000000000 -0600 @@ -349,8 +349,10 @@ translateText($body, $wrap_at, $body_message->header->getParameter('charset')); } else { + $charset = $body_message->header->getParameter('charset'); + if (!empty($charset)) + $body = charset_decode($charset,$body,false,true); $body = magicHTML($body, $id, $message, $mailbox); - $body = charset_decode($body_message->header->getParameter('charset'),$body,false,true); } } else { translateText($body, $wrap_at, @@ -477,6 +479,12 @@ $defaultlink .= '&where='. urlencode($where).'&what='.urlencode($what); } + // IE does make use of mime content sniffing. Forcing a download + // prohibit execution of XSS inside an application/octet-stream attachment + if ($type0 == 'application' && $type1 == 'octet-stream') { + $defaultlink .= '&absolute_dl=true'; + } + /* This executes the attachment hook with a specific MIME-type. * If that doesn't have results, it tries if there's a rule * for a more generic type. @@ -1017,6 +1025,85 @@ } } + +/** + * Translate all dangerous Unicode or Shift_JIS characters which are accepted by + * IE as regular characters. + * + * @param attvalue The attribute value before dangerous characters are translated. + * @return attvalue Nothing, modifies a reference value. + * @author Marc Groot Koerkamp. + */ +function sq_fixIE_idiocy(&$attvalue) { + // remove NUL + $attvalue = str_replace("\0", "", $attvalue); + // remove comments + $attvalue = preg_replace("/(\/\*.*?\*\/)/","",$attvalue); + + // IE has the evil habit of accepting every possible value for the attribute expression + // The table below contains characters which are parsed by IE if they are used in the "expression" + // attribute value. + $aDangerousCharsReplacementTable = array( + array('ʟ', 'ʟ' ,/* L UNICODE IPA Extension */ + 'ʀ', 'ʀ' ,/* R UNICODE IPA Extension */ + 'ɴ', 'ɴ' ,/* N UNICODE IPA Extension */ + 'Ｅ', 'Ｅ' ,/* Unicode FULLWIDTH LATIN CAPITAL LETTER E */ + 'ｅ', 'ｅ' ,/* Unicode FULLWIDTH LATIN SMALL LETTER E */ + 'Ｘ', 'Ｘ',/* Unicode FULLWIDTH LATIN CAPITAL LETTER X */ + 'ｘ', 'ｘ',/* Unicode FULLWIDTH LATIN SMALL LETTER X */ + 'Ｐ', 'Ｐ',/* Unicode FULLWIDTH LATIN CAPITAL LETTER P */ + 'ｐ', 'ｐ',/* Unicode FULLWIDTH LATIN SMALL LETTER P */ + 'Ｒ', 'Ｒ',/* Unicode FULLWIDTH LATIN CAPITAL LETTER R */ + 'ｒ', 'ｒ',/* Unicode FULLWIDTH LATIN SMALL LETTER R */ + 'Ｓ', 'Ｓ',/* Unicode FULLWIDTH LATIN CAPITAL LETTER S */ + 'ｓ', 'ｓ',/* Unicode FULLWIDTH LATIN SMALL LETTER S */ + 'Ｉ', 'Ｉ',/* Unicode FULLWIDTH LATIN CAPITAL LETTER I */ + 'ｉ', 'ｉ',/* Unicode FULLWIDTH LATIN SMALL LETTER I */ + 'Ｏ', 'Ｏ',/* Unicode FULLWIDTH LATIN CAPITAL LETTER O */ + 'ｏ', 'ｏ',/* Unicode FULLWIDTH LATIN SMALL LETTER O */ + 'Ｎ', 'Ｎ',/* Unicode FULLWIDTH LATIN CAPITAL LETTER N */ + 'ｎ', 'ｎ',/* Unicode FULLWIDTH LATIN SMALL LETTER N */ + 'Ｌ', 'Ｌ',/* Unicode FULLWIDTH LATIN CAPITAL LETTER L */ + 'ｌ', 'ｌ',/* Unicode FULLWIDTH LATIN SMALL LETTER L */ + 'Ｕ', 'Ｕ',/* Unicode FULLWIDTH LATIN CAPITAL LETTER U */ + 'ｕ', 'ｕ',/* Unicode FULLWIDTH LATIN SMALL LETTER U */ + 'ⁿ', 'ⁿ' ,/* Unicode SUPERSCRIPT LATIN SMALL LETTER N */ + "\xEF\xBC\xA5", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER E */ // in unicode this is some Chinese char range + "\xEF\xBD\x85", /* Shift JIS FULLWIDTH LATIN SMALL LETTER E */ + "\xEF\xBC\xB8", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER X */ + "\xEF\xBD\x98", /* Shift JIS FULLWIDTH LATIN SMALL LETTER X */ + "\xEF\xBC\xB0", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER P */ + "\xEF\xBD\x90", /* Shift JIS FULLWIDTH LATIN SMALL LETTER P */ + "\xEF\xBC\xB2", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER R */ + "\xEF\xBD\x92", /* Shift JIS FULLWIDTH LATIN SMALL LETTER R */ + "\xEF\xBC\xB3", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER S */ + "\xEF\xBD\x93", /* Shift JIS FULLWIDTH LATIN SMALL LETTER S */ + "\xEF\xBC\xA9", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER I */ + "\xEF\xBD\x89", /* Shift JIS FULLWIDTH LATIN SMALL LETTER I */ + "\xEF\xBC\xAF", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER O */ + "\xEF\xBD\x8F", /* Shift JIS FULLWIDTH LATIN SMALL LETTER O */ + "\xEF\xBC\xAE", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER N */ + "\xEF\xBD\x8E", /* Shift JIS FULLWIDTH LATIN SMALL LETTER N */ + "\xEF\xBC\xAC", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER L */ + "\xEF\xBD\x8C", /* Shift JIS FULLWIDTH LATIN SMALL LETTER L */ + "\xEF\xBC\xB5", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER U */ + "\xEF\xBD\x95", /* Shift JIS FULLWIDTH LATIN SMALL LETTER U */ + "\xE2\x81\xBF", /* Shift JIS FULLWIDTH SUPERSCRIPT N */ + "\xCA\x9F", /* L UNICODE IPA Extension */ + "\xCA\x80", /* R UNICODE IPA Extension */ + "\xC9\xB4"), /* N UNICODE IPA Extension */ + array('l', 'l', 'r','r','n','n', + 'E','E','e','e','X','X','x','x','P','P','p','p','R','R','r','r','S','S','s','s','I','I', + 'i','i','O','O','o','o','N','N','n','n','L','L','l','l','U','U','u','u','n','n', + 'E','e','X','x','P','p','R','r','S','s','I','i','O','o','N','n','L','l','U','u','n','l','r','n')); + $attvalue = str_replace($aDangerousCharsReplacementTable[0],$aDangerousCharsReplacementTable[1],$attvalue); + + // Escapes are useful for special characters like "{}[]()'&. In other cases they are + // used for XSS + $attvalue = preg_replace("/(\\\\)([a-zA-Z]{1})/",'$2',$attvalue); +} + + /** * This function returns the final tag out of the tag name, an array * of attributes, and the type of the tag. This function is called by @@ -1483,10 +1570,23 @@ } } } + + /** + * Workaround for IE quirks + */ + sq_fixIE_idiocy($attvalue); + /** * Remove any backslashes, entities, and extraneous whitespace. */ + $oldattvalue = $attvalue; sq_defang($attvalue); + if ($attname == 'style' && $attvalue !== $oldattvalue) { + // entities are used in the attribute value. In 99% of the cases it's there as XSS + // i.e.
+ $attvalue = "idiocy"; + $attary{$attname} = $attvalue; + } sq_unspace($attvalue); /** @@ -1508,37 +1608,35 @@ $newvalue = preg_replace($valmatch, $valrepl, $attvalue); if ($newvalue != $attvalue){ - $attary{$attname} = $newvalue; + $attvalue = $newvalue; } } } } } - /** - * Replace empty src tags with the blank image. src is only used - * for frames, images, and image inputs. Doing a replace should - * not affect them working as should be, however it will stop - * IE from being kicked off when src for img tags are not set - */ - if (($attname == 'src') && ($attvalue == '""')) { - $attary{$attname} = '"' . SM_PATH . 'images/blank.png"'; - } - - /** - * Turn cid: urls into http-friendly ones. - */ - if (preg_match("/^[\'\"]\s*cid:/si", $attvalue)){ - $attary{$attname} = sq_cid2http($message, $id, $attvalue, $mailbox); + if ($attname == 'style') { + if (preg_match('/[\0-\37\200-\377]+/',$attvalue)) { + // 8bit and control characters in style attribute values can be used for XSS, remove them + $attary{$attname} = '"disallowed character"'; + } + preg_match_all("/url\s*\((.+)\)/si",$attvalue,$aMatch); + if (count($aMatch)) { + foreach($aMatch[1] as $sMatch) { + // url value + $urlvalue = $sMatch; + sq_fix_url($attname, $urlvalue, $message, $id, $mailbox,"'"); + $attary{$attname} = str_replace($sMatch,$urlvalue,$attvalue); + } + } } /** - * "Hack" fix for Outlook using propriatary outbind:// protocol in img tags. - * One day MS might actually make it match something useful, for now, falling - * back to using cid2http, so we can grab the blank.png. + * Use white list based filtering on attributes which can contain url's */ - if (preg_match("/^[\'\"]\s*outbind:\/\//si", $attvalue)) { - $attary{$attname} = sq_cid2http($message, $id, $attvalue, $mailbox); + else if ($attname == 'href' || $attname == 'src' || $attname == 'background') { + sq_fix_url($attname, $attvalue, $message, $id, $mailbox); + $attary{$attname} = $attvalue; } } @@ -1554,6 +1652,97 @@ } /** + * This function filters url's + * + * @param $attvalue String with attribute value to filter + * @param $message message object + * @param $id message id + * @param $mailbox mailbox + * @param $sQuote quoting characters around url's +*/ +function sq_fix_url($attname, &$attvalue, $message, $id, $mailbox,$sQuote = '"') { + $attvalue = trim($attvalue); + if ($attvalue && ($attvalue[0] =='"'|| $attvalue[0] == "'")) { + // remove the double quotes + $sQuote = $attvalue[0]; + $attvalue = trim(substr($attvalue,1,-1)); + } + + if( !sqgetGlobalVar('view_unsafe_images', $view_unsafe_images, SQ_GET) ) { + $view_unsafe_images = false; + } + $secremoveimg = '../images/' . _("sec_remove_eng.png"); + + /** + * Replace empty src tags with the blank image. src is only used + * for frames, images, and image inputs. Doing a replace should + * not affect them working as should be, however it will stop + * IE from being kicked off when src for img tags are not set + */ + if ($attvalue == '') { + $attvalue = '"' . SM_PATH . 'images/blank.png"'; + } else { + // first, disallow 8 bit characters and control characters + if (preg_match('/[\0-\37\200-\377]+/',$attvalue)) { + switch ($attname) { + case 'href': + $attvalue = $sQuote . 'http://invalid-stuff-detected.example.com' . $sQuote; + break; + default: + $attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote; + break; + } + } else { + $aUrl = parse_url($attvalue); + if (isset($aUrl['scheme'])) { + switch(strtolower($aUrl['scheme'])) { + case 'http': + case 'https': + case 'ftp': + if ($attname != 'href') { + if ($view_unsafe_images == false) { + $attvalue = $sQuote . $secremoveimg . $sQuote; + } else { + if (isset($aUrl['path'])) { + // validate image extension. + $ext = strtolower(substr($aUrl['path'],strrpos($aUrl['path'],'.'))); + if (!in_array($ext,array('.jpeg','.jpg','xjpeg','.gif','.bmp','.jpe','.png','.xbm'))) { + $attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote; + } + } else { + $attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote; + } + } + } + break; + case 'outbind': + /** + * "Hack" fix for Outlook using propriatary outbind:// protocol in img tags. + * One day MS might actually make it match something useful, for now, falling + * back to using cid2http, so we can grab the blank.png. + */ + $attvalue = sq_cid2http($message, $id, $attvalue, $mailbox); + break; + case 'cid': + /** + * Turn cid: urls into http-friendly ones. + */ + $attvalue = sq_cid2http($message, $id, $attvalue, $mailbox); + break; + default: + $attvalue = $sQuote . SM_PATH . 'images/blank.png' . $sQuote; + break; + } + } else { + if (!(isset($aUrl['path']) && $aUrl['path'] == $secremoveimg)) { + // parse_url did not lead to satisfying result + $attvalue = $sQuote . SM_PATH . 'images/blank.png' . $sQuote; + } + } + } + } +} +/** * This function edits the style definition to make them friendly and * usable in SquirrelMail. * @@ -1580,57 +1769,38 @@ */ $content = preg_replace("|body(\s*\{.*?\})|si", ".bodyclass\\1", $content); $secremoveimg = '../images/' . _("sec_remove_eng.png"); + // first check for 8bit sequences and disallowed control characters + if (preg_match('/[\16-\37\200-\377]+/',$content)) { + $content = ''; + return array($content, $newpos); + } + + + // IE Sucks hard. We have a special function for it. + sq_fixIE_idiocy($content); + + // remove @import line + $content = preg_replace("/^\s*(@import.*)$/mi","\n\n",$content); + /** * Fix url('blah') declarations. */ - // remove NUL - $content = str_replace("\0", "", $content); // translate ur\l and variations into url (IE parses that) + // TODO check if the sq_fixIE_idiocy function already handles this. $content = preg_replace("/(\\\\)?u(\\\\)?r(\\\\)?l(\\\\)?/i",'url', $content); - // NB I insert NUL characters to keep to avoid an infinite loop. They are removed after the loop. - while (preg_match("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si", $content, $matches)) { - $sProto = strtolower($matches[1]); - switch ($sProto) { - /** - * Fix url('https*://.*) declarations but only if $view_unsafe_images - * is false. - */ - case 'https': - case 'http': - if (!$view_unsafe_images){ - - $sExpr = "/url\s*\(\s*[\'\"]?\s*$sProto*:.*[\'\"]?\s*\)/si"; - $content = preg_replace($sExpr, "u\0r\0l(\\1$secremoveimg\\2)", $content); - } else { - $content = preg_replace('/url/i',"u\0r\0l",$content); - } - break; - - /** - * Fix urls that refer to cid: - */ - case 'cid': - $cidurl = 'cid:'. $matches[2]; - $httpurl = sq_cid2http($message, $id, $cidurl, $mailbox); - // escape parentheses that can modify the regular expression - $cidurl = str_replace(array('(',')'),array('\\(','\\)'),$cidurl); - $content = preg_replace("|url\s*\(\s*$cidurl\s*\)|si", - "u\0r\0l($httpurl)", $content); - break; - default: - /** - * replace url with protocol other then the white list - * http,https and cid by an empty string. - */ - $content = preg_replace("/url\s*\(\s*[\'\"]?([^:]+):(.*)?[\'\"]?\s*\)/si", - "", $content); - break; + preg_match_all("/url\s*\((.+)\)/si",$content,$aMatch); + if (count($aMatch)) { + $aValue = $aReplace = array(); + foreach($aMatch[1] as $sMatch) { + // url value + $urlvalue = $sMatch; + sq_fix_url('style',$urlvalue, $message, $id, $mailbox,"'"); + $aValue[] = $sMatch; + $aReplace[] = $urlvalue; } - break; + $content = str_replace($aValue,$aReplace,$content); } - // remove NUL - $content = str_replace("\0", "", $content); /** * Remove any backslashes, entities, and extraneous whitespace. @@ -1647,8 +1817,10 @@ '/expression/i', '/behaviou*r/i', '/binding/i', - '/include-source/i'); - $replace = Array('', 'idiocy', 'idiocy', 'idiocy', 'idiocy'); + '/include-source/i', + '/javascript/i', + '/script/i'); + $replace = Array('','idiocy', 'idiocy', 'idiocy', 'idiocy', 'idiocy', 'idiocy'); $contentNew = preg_replace($match, $replace, $contentTemp); if ($contentNew !== $contentTemp) { // insecure css declarations are used. From now on we don't care @@ -2048,7 +2220,7 @@ "idiocy", "idiocy", "idiocy", - "", + "idiocy", "url", "url(\\1#\\1)", "url(\\1#\\1)", @@ -2094,7 +2266,7 @@ $id, $mailbox ); - if (preg_match("|$secremoveimg|i", $trusted)){ + if (strpos($trusted,$secremoveimg)){ $has_unsafe_images = true; } return $trusted; @@ -2191,10 +2363,16 @@ // This works for most types, but doesn't work with Word files header ("Content-Type: application/download; name=\"$filename\""); + // This is to prevent IE for MIME sniffing and auto open a file in IE + header ("Content-Type: application/force-download; name=\"$filename\""); + // These are spares, just in case. :-) //header("Content-Type: $type0/$type1; name=\"$filename\""); //header("Content-Type: application/x-msdownload; name=\"$filename\""); //header("Content-Type: application/octet-stream; name=\"$filename\""); + } else if ($isIE) { + // This is to prevent IE for MIME sniffing and auto open a file in IE + header ("Content-Type: application/force-download; name=\"$filename\""); } else { // another application/octet-stream forces download for Netscape header ("Content-Type: application/octet-stream; name=\"$filename\""); diff -Nru /tmp/5uJ3phgMuY/squirrelmail-1.4.6/src/compose.php /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/src/compose.php --- /tmp/5uJ3phgMuY/squirrelmail-1.4.6/src/compose.php 2006-02-03 15:27:55.000000000 -0700 +++ /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/src/compose.php 2007-05-16 16:05:51.000000000 -0600 @@ -51,31 +51,43 @@ sqgetGlobalVar('compose_messages', $compose_messages, SQ_SESSION); /** SESSION/POST/GET VARS */ -sqgetGlobalVar('smaction',$action); -sqgetGlobalVar('session',$session); -sqgetGlobalVar('mailbox',$mailbox); -sqgetGlobalVar('identity',$identity); -sqgetGlobalVar('send_to',$send_to); -sqgetGlobalVar('send_to_cc',$send_to_cc); -sqgetGlobalVar('send_to_bcc',$send_to_bcc); -sqgetGlobalVar('subject',$subject); -sqgetGlobalVar('body',$body); -sqgetGlobalVar('mailprio',$mailprio); -sqgetGlobalVar('request_mdn',$request_mdn); -sqgetGlobalVar('request_dr',$request_dr); -sqgetGlobalVar('html_addr_search',$html_addr_search); -sqgetGlobalVar('mail_sent',$mail_sent); -sqgetGlobalVar('passed_id',$passed_id); -sqgetGlobalVar('passed_ent_id',$passed_ent_id); -sqgetGlobalVar('send',$send); - -sqgetGlobalVar('attach',$attach); - -sqgetGlobalVar('draft',$draft); -sqgetGlobalVar('draft_id',$draft_id); -sqgetGlobalVar('ent_num',$ent_num); -sqgetGlobalVar('saved_draft',$saved_draft); -sqgetGlobalVar('delete_draft',$delete_draft); +sqgetGlobalVar('send', $send, SQ_POST); +// Send can only be achieved by setting $_POST var. If Send = true then +// retrieve other form fields from $_POST +if (isset($send) && $send) { + $SQ_GLOBAL = SQ_POST; +} else { + $SQ_GLOBAL = SQ_FORM; +} +sqgetGlobalVar('smaction',$action, $SQ_GLOBAL); +sqgetGlobalVar('session',$session, $SQ_GLOBAL); +sqgetGlobalVar('mailbox',$mailbox, $SQ_GLOBAL); +if ( !sqgetGlobalVar('identity',$identity, $SQ_GLOBAL) ) { + $identity = 0; +} +sqgetGlobalVar('send_to',$send_to, $SQ_GLOBAL); +sqgetGlobalVar('send_to_cc',$send_to_cc, $SQ_GLOBAL); +sqgetGlobalVar('send_to_bcc',$send_to_bcc, $SQ_GLOBAL); +sqgetGlobalVar('subject',$subject, $SQ_GLOBAL); +sqgetGlobalVar('body',$body, $SQ_GLOBAL); +sqgetGlobalVar('mailprio',$mailprio, $SQ_GLOBAL); +sqgetGlobalVar('request_mdn',$request_mdn, $SQ_GLOBAL); +sqgetGlobalVar('request_dr',$request_dr, $SQ_GLOBAL); +sqgetGlobalVar('html_addr_search',$html_addr_search, SQ_FORM); +sqgetGlobalVar('mail_sent',$mail_sent, SQ_FORM); +sqgetGlobalVar('passed_id',$passed_id, $SQ_GLOBAL); +sqgetGlobalVar('passed_ent_id',$passed_ent_id, $SQ_GLOBAL); + +sqgetGlobalVar('attach',$attach, SQ_POST); +sqgetGlobalVar('draft',$draft, SQ_POST); +sqgetGlobalVar('draft_id',$draft_id, $SQ_GLOBAL); +sqgetGlobalVar('ent_num',$ent_num, $SQ_GLOBAL); +sqgetGlobalVar('saved_draft',$saved_draft, SQ_FORM); + +if ( sqgetGlobalVar('delete_draft',$delete_draft) ) { + $delete_draft = (int)$delete_draft; +} + if ( sqgetGlobalVar('startMessage',$startMessage) ) { $startMessage = (int)$startMessage; } else { @@ -97,6 +109,26 @@ /** GET VARS */ sqgetGlobalVar('attachedmessages', $attachedmessages, SQ_GET); +/** + * Here we decode the data passed in from mailto.php. + */ +if ( sqgetGlobalVar('mailtodata', $mailtodata, SQ_GET) ) { + $trtable = array('to' => 'send_to', + 'cc' => 'send_to_cc', + 'bcc' => 'send_to_bcc', + 'body' => 'body', + 'subject' => 'subject'); + $mtdata = unserialize($mailtodata); + + foreach ($trtable as $f => $t) { + if ( !empty($mtdata[$f]) ) { + $$t = $mtdata[$f]; + } + } + unset($mailtodata,$mtdata, $trtable); +} + + /* Location (For HTTP 1.1 Header("Location: ...") redirects) */ $location = get_location(); @@ -259,13 +291,19 @@ sqsession_unregister('session_expired_post'); session_write_close(); } else { - foreach ($session_expired_post as $postvar => $val) { - if (isset($val)) { - $$postvar = $val; - } else { - $$postvar = ''; + // these are the vars that we can set from the expired composed session + $compo_var_list = array ( 'send_to', 'send_to_cc','body','startMessage', + 'passed_body','use_signature','signature','attachments','subject','newmail', + 'send_to_bcc', 'passed_id', 'mailbox', 'from_htmladdr_search', 'identity', + 'draft_id', 'delete_draft', 'mailprio', 'edit_as_new', 'compose_messsages', + 'composesession', 'request_mdn', 'request_dr'); + + foreach ($compo_var_list as $var) { + if ( isset($session_expired_post[$var]) && !isset($$var) ) { + $$var = $session_expired_post[$var]; } } + $compose_messages = unserialize(urldecode($restoremessages)); sqsession_register($compose_messages,'compose_messages'); sqsession_register($composesession,'composesession'); @@ -291,6 +329,8 @@ if (!isset($composesession)) { $composesession = 0; sqsession_register(0,'composesession'); +} else { + $composesession = (int)$composesession; } if (!isset($session) || (isset($newmessage) && $newmessage)) { @@ -1622,4 +1662,4 @@ return $succes; } -?> \ No newline at end of file +?> diff -Nru /tmp/5uJ3phgMuY/squirrelmail-1.4.6/src/login.php /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/src/login.php --- /tmp/5uJ3phgMuY/squirrelmail-1.4.6/src/login.php 2006-02-03 15:27:55.000000000 -0700 +++ /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/src/login.php 2007-05-16 16:05:51.000000000 -0600 @@ -49,7 +49,19 @@ * we get a new one. */ -sqsession_destroy(); +if ( !empty($_SESSION['session_expired_post']) && !empty($_SESSION['session_expired_location']) ) { + $sep = $_SESSION['session_expired_post']; + $sel = $_SESSION['session_expired_location']; + + sqsession_destroy(); + + sqsession_is_active(); + sqsession_register($sep, 'session_expired_post'); + sqsession_register($sel, 'session_expired_location'); +} else { + sqsession_destroy(); +} + header('Pragma: no-cache'); @@ -103,10 +115,10 @@ do_hook('login_top'); -if(sqgetGlobalVar('mailto', $mailto)) { - $rcptaddress = addHidden('mailto', $mailto); +if(sqgetGlobalVar('mailtodata', $mailtodata)) { + $mailtofield = addHidden('mailtodata', $mailtodata); } else { - $rcptaddress = ''; + $mailtofield = ''; } /* If they don't have a logo, don't bother.. */ @@ -159,7 +171,7 @@ html_tag( 'td', addPwField($password_form_name). addHidden('js_autodetect_results', SMPREF_JS_OFF). - $rcptaddress . + $mailtofield . addHidden('just_logged_in', '1'), 'left', '', 'width="*"' ) ) , @@ -180,4 +192,4 @@ do_hook('login_bottom'); ?> - \ No newline at end of file + diff -Nru /tmp/5uJ3phgMuY/squirrelmail-1.4.6/src/mailto.php /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/src/mailto.php --- /tmp/5uJ3phgMuY/squirrelmail-1.4.6/src/mailto.php 2006-02-03 15:27:55.000000000 -0700 +++ /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/src/mailto.php 2007-05-16 16:05:51.000000000 -0600 @@ -42,6 +42,8 @@ 'subject' => 'subject'); $url = ''; +$data = array(); + if(sqgetGlobalVar('emailaddress', $emailaddress)) { $emailaddress = trim($emailaddress); if(stristr($emailaddress, 'mailto:')) { @@ -51,33 +53,33 @@ list($emailaddress, $a) = explode('?', $emailaddress, 2); if(strlen(trim($a)) > 0) { $a = explode('=', $a, 2); - $url .= $trtable[strtolower($a[0])] . '=' . urlencode($a[1]) . '&'; + $data[strtolower($a[0])] = $a[1]; } } - $url = 'send_to=' . urlencode($emailaddress) . '&' . $url; + $data['to'] = $emailaddress; /* CC, BCC, etc could be any case, so we'll fix them here */ foreach($_GET as $k=>$g) { $k = strtolower($k); if(isset($trtable[$k])) { $k = $trtable[$k]; - $url .= $k . '=' . urlencode($g) . '&'; + $data[$k] = $g; } } - $url = substr($url, 0, -1); + } sqsession_is_active(); if($force_login == false && sqsession_is_registered('user_is_logged_in')) { if($compose_only == true) { - $redirect = 'compose.php?' . $url; + $redirect = 'compose.php?mailtodata=' . urlencode(serialize($data)); } else { - $redirect = 'webmail.php?right_frame=compose.php?' . urlencode($url); + $redirect = 'webmail.php?mailtodata=' . urlencode(serialize($data)); } } else { - $redirect = 'login.php?mailto=' . urlencode($url); + $redirect = 'login.php?mailtodata=' . urlencode(serialize($data)); } session_write_close(); header('Location: ' . get_location() . '/' . $redirect); -?> \ No newline at end of file +?> diff -Nru /tmp/5uJ3phgMuY/squirrelmail-1.4.6/src/redirect.php /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/src/redirect.php --- /tmp/5uJ3phgMuY/squirrelmail-1.4.6/src/redirect.php 2006-02-03 15:27:55.000000000 -0700 +++ /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/src/redirect.php 2007-05-16 16:05:51.000000000 -0600 @@ -54,8 +54,8 @@ $squirrelmail_language = $squirrelmail_default_language; } -if (!sqgetGlobalVar('mailto', $mailto)) { - $mailto = ''; +if (!sqgetGlobalVar('mailtodata', $mailtodata)) { + $mailtodata = ''; } @@ -148,18 +148,22 @@ if ( sqgetGlobalVar('session_expired_location', $session_expired_location, SQ_SESSION) ) { sqsession_unregister('session_expired_location'); - $compose_new_win = getPref($data_dir, $username, 'compose_new_win', 0); - if ($compose_new_win) { - $redirect_url = $session_expired_location; - } elseif ( strpos($session_expired_location, 'webmail.php') === FALSE ) { - $redirect_url = 'webmail.php?right_frame='.urldecode($session_expired_location); + if ( strpos($session_expired_location, 'compose.php') !== FALSE ) { + $compose_new_win = getPref($data_dir, $username, 'compose_new_win', 0); + if ($compose_new_win) { + $redirect_url = $session_expired_location; + } elseif ( strpos($session_expired_location, 'webmail.php') === FALSE ) { + $redirect_url = 'webmail.php?right_frame=compose.php'; + } + } else { + $redirect_url = 'webmail.php?right_frame=' . urldecode($session_expired_location); } unset($session_expired_location); } -if($mailto != '') { - $redirect_url = $location . '/webmail.php?right_frame=compose.php&mailto='; - $redirect_url .= urlencode($mailto); +if($mailtodata != '') { + $redirect_url = $location . '/webmail.php?right_frame=compose.php&mailtodata='; + $redirect_url .= urlencode($mailtodata); } @@ -196,4 +200,4 @@ sqsession_register($attachment_common_types, 'attachment_common_types'); } -?> \ No newline at end of file +?> diff -Nru /tmp/5uJ3phgMuY/squirrelmail-1.4.6/src/right_main.php /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/src/right_main.php --- /tmp/5uJ3phgMuY/squirrelmail-1.4.6/src/right_main.php 2006-02-03 15:27:55.000000000 -0700 +++ /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/src/right_main.php 2007-05-16 16:05:51.000000000 -0600 @@ -155,7 +155,7 @@ if ($composenew) { $comp_uri = SM_PATH . 'src/compose.php?mailbox='. urlencode($mailbox). - "&session=$session"; + "&session=" .urlencode($session); displayPageHeader($color, $mailbox, "comp_in_new('$comp_uri');", false); } else { displayPageHeader($color, $mailbox); @@ -239,4 +239,4 @@ echo ''; -?> \ No newline at end of file +?> diff -Nru /tmp/5uJ3phgMuY/squirrelmail-1.4.6/src/view_text.php /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/src/view_text.php --- /tmp/5uJ3phgMuY/squirrelmail-1.4.6/src/view_text.php 2006-02-03 15:27:55.000000000 -0700 +++ /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/src/view_text.php 2007-05-16 16:05:51.000000000 -0600 @@ -76,10 +76,10 @@ } if ($type1 == 'html' || (isset($override_type1) && $override_type1 == 'html')) { - $body = MagicHTML( $body, $passed_id, $message, $mailbox); // html attachment with character set information if (! empty($charset)) $body = charset_decode($charset,$body,false,true); + $body = magicHTML( $body, $passed_id, $message, $mailbox); } else { translateText($body, $wrap_at, $charset); } @@ -103,4 +103,4 @@ - \ No newline at end of file + diff -Nru /tmp/5uJ3phgMuY/squirrelmail-1.4.6/src/webmail.php /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/src/webmail.php --- /tmp/5uJ3phgMuY/squirrelmail-1.4.6/src/webmail.php 2006-02-13 11:18:37.000000000 -0700 +++ /tmp/ULP6Y0cnLq/squirrelmail-1.4.6/src/webmail.php 2007-05-16 16:05:51.000000000 -0600 @@ -53,12 +53,10 @@ $mailbox = 'INBOX'; } -if ( isset($_SESSION['session_expired_post']) ) { - sqsession_unregister('session_expired_post'); -} - -if(!sqgetGlobalVar('mailto', $mailto)) { - $mailto = ''; +if(sqgetGlobalVar('mailtodata', $mailtodata)) { + $mailtourl = 'mailtodata='.urlencode($mailtodata); +} else { + $mailtourl = ''; } @@ -156,7 +154,7 @@ $right_frame_url = 'folders.php'; break; case 'compose.php': - $right_frame_url = 'compose.php?' . $mailto; + $right_frame_url = 'compose.php?' . $mailtourl; break; case '': $right_frame_url = 'right_main.php';