Mercurial > hg > rc2

comparison program/steps/settings/save_identity.inc @ 0:4681f974d28b

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
vanilla 1.3.3 distro, I hope
author Charlie Root
date Thu, 04 Jan 2018 15:52:31 -0500
parents
children
comparison
equal deleted inserted replaced
-1:000000000000 0:4681f974d28b
1 <?php
2
3 /**
4 +-----------------------------------------------------------------------+
5 | program/steps/settings/save_identity.inc |
6 | |
7 | This file is part of the Roundcube Webmail client |
8 | Copyright (C) 2005-2013, The Roundcube Dev Team |
9 | |
10 | Licensed under the GNU General Public License version 3 or |
11 | any later version with exceptions for skins & plugins. |
12 | See the README file for a full license statement. |
13 | |
14 | PURPOSE: |
15 | Save an identity record or to add a new one |
16 | |
17 +-----------------------------------------------------------------------+
18 | Author: Thomas Bruederli <roundcube@gmail.com> |
19 +-----------------------------------------------------------------------+
20 */
21
22 define('IDENTITIES_LEVEL', intval($RCMAIL->config->get('identities_level', 0)));
23
24 $a_save_cols = array('name', 'email', 'organization', 'reply-to', 'bcc', 'standard', 'signature', 'html_signature');
25 $a_boolean_cols = array('standard', 'html_signature');
26 $updated = $default_id = false;
27
28 // check input
29 if (empty($_POST['_email']) && (IDENTITIES_LEVEL == 0 || IDENTITIES_LEVEL == 2)) {
30 $OUTPUT->show_message('noemailwarning', 'warning');
31 $RCMAIL->overwrite_action('edit-identity');
32 return;
33 }
34
35 $save_data = array();
36 foreach ($a_save_cols as $col) {
37 $fname = '_'.$col;
38 if (isset($_POST[$fname])) {
39 $save_data[$col] = rcube_utils::get_input_value($fname, rcube_utils::INPUT_POST, true);
40 }
41 }
42
43 // set "off" values for checkboxes that were not checked, and therefore
44 // not included in the POST body.
45 foreach ($a_boolean_cols as $col) {
46 $fname = '_' . $col;
47 if (!isset($_POST[$fname])) {
48 $save_data[$col] = 0;
49 }
50 }
51
52 // make the identity a "default" if only one identity is allowed
53 if (IDENTITIES_LEVEL > 1) {
54 $save_data['standard'] = 1;
55 }
56
57 // unset email address if user has no rights to change it
58 if (IDENTITIES_LEVEL == 1 || IDENTITIES_LEVEL == 3) {
59 unset($save_data['email']);
60 }
61 // unset all fields except signature
62 else if (IDENTITIES_LEVEL == 4) {
63 foreach ($save_data as $idx => $value) {
64 if ($idx != 'signature' && $idx != 'html_signature') {
65 unset($save_data[$idx]);
66 }
67 }
68 }
69
70 // Validate e-mail addresses
71 $email_checks = array(rcube_utils::idn_to_ascii($save_data['email']));
72 foreach (array('reply-to', 'bcc') as $item) {
73 foreach (rcube_mime::decode_address_list($save_data[$item], null, false) as $rcpt) {
74 $email_checks[] = rcube_utils::idn_to_ascii($rcpt['mailto']);
75 }
76 }
77
78 foreach ($email_checks as $email) {
79 if ($email && !rcube_utils::check_email($email)) {
80 // show error message
81 $OUTPUT->show_message('emailformaterror', 'error', array('email' => rcube_utils::idn_to_utf8($email)), false);
82 $RCMAIL->overwrite_action('edit-identity');
83 return;
84 }
85 }
86
87 if (!empty($save_data['signature']) && !empty($save_data['html_signature'])) {
88 // replace uploaded images with data URIs
89 $save_data['signature'] = rcmail_attach_images($save_data['signature']);
90
91 // XSS protection in HTML signature (#1489251)
92 $save_data['signature'] = rcmail_wash_html($save_data['signature']);
93
94 // clear POST data of signature, we want to use safe content
95 // when the form is displayed again
96 unset($_POST['_signature']);
97 }
98
99 // update an existing identity
100 if ($_POST['_iid']) {
101 $iid = rcube_utils::get_input_value('_iid', rcube_utils::INPUT_POST);
102
103 if (in_array(IDENTITIES_LEVEL, array(1,3,4))) {
104 // merge with old identity data, fixes #1488834
105 $identity = $RCMAIL->user->get_identity($iid);
106 $save_data = array_merge($identity, $save_data);
107
108 unset($save_data['changed'], $save_data['del'], $save_data['user_id'], $save_data['identity_id']);
109 }
110
111 $plugin = $RCMAIL->plugins->exec_hook('identity_update', array('id' => $iid, 'record' => $save_data));
112 $save_data = $plugin['record'];
113
114 if ($save_data['email']) {
115 $save_data['email'] = rcube_utils::idn_to_ascii($save_data['email']);
116 }
117
118 if (!$plugin['abort'])
119 $updated = $RCMAIL->user->update_identity($iid, $save_data);
120 else
121 $updated = $plugin['result'];
122
123 if ($updated) {
124 $OUTPUT->show_message('successfullysaved', 'confirmation');
125
126 if (!empty($save_data['standard'])) {
127 $default_id = $iid;
128 }
129
130 if ($_POST['_framed']) {
131 // update the changed col in list
132 $name = $save_data['name'] . ' <' . rcube_utils::idn_to_utf8($save_data['email']) .'>';
133 $OUTPUT->command('parent.update_identity_row', $iid, rcube::Q(trim($name)));
134 }
135 }
136 else {
137 // show error message
138 $OUTPUT->show_message($plugin['message'] ?: 'errorsaving', 'error', null, false);
139 $RCMAIL->overwrite_action('edit-identity');
140 return;
141 }
142 }
143 // insert a new identity record
144 else if (IDENTITIES_LEVEL < 2) {
145 if (IDENTITIES_LEVEL == 1) {
146 $save_data['email'] = $RCMAIL->get_user_email();
147 }
148
149 $plugin = $RCMAIL->plugins->exec_hook('identity_create', array('record' => $save_data));
150 $save_data = $plugin['record'];
151
152 if ($save_data['email']) {
153 $save_data['email'] = rcube_utils::idn_to_ascii($save_data['email']);
154 }
155
156 if (!$plugin['abort'])
157 $insert_id = $save_data['email'] ? $RCMAIL->user->insert_identity($save_data) : null;
158 else
159 $insert_id = $plugin['result'];
160
161 if ($insert_id) {
162 $RCMAIL->plugins->exec_hook('identity_create_after', array('id' => $insert_id, 'record' => $save_data));
163
164 $OUTPUT->show_message('successfullysaved', 'confirmation', null, false);
165
166 $_GET['_iid'] = $insert_id;
167
168 if (!empty($save_data['standard'])) {
169 $default_id = $insert_id;
170 }
171
172 if ($_POST['_framed']) {
173 // add a new row to the list
174 $name = $save_data['name'] . ' <' . rcube_utils::idn_to_utf8($save_data['email']) .'>';
175 $OUTPUT->command('parent.update_identity_row', $insert_id, rcube::Q(trim($name)), true);
176 }
177 }
178 else {
179 // show error message
180 $OUTPUT->show_message($plugin['message'] ?: 'errorsaving', 'error', null, false);
181 $RCMAIL->overwrite_action('edit-identity');
182 return;
183 }
184 }
185 else {
186 $OUTPUT->show_message('opnotpermitted', 'error');
187 }
188
189 // mark all other identities as 'not-default'
190 if ($default_id) {
191 $RCMAIL->user->set_default($default_id);
192 }
193
194 // go to next step
195 if (!empty($_REQUEST['_framed'])) {
196 $RCMAIL->overwrite_action('edit-identity');
197 }
198 else {
199 $RCMAIL->overwrite_action('identities');
200 }
201
202
203 /**
204 * Attach uploaded images into signature as data URIs
205 */
206 function rcmail_attach_images($html)
207 {
208 global $RCMAIL;
209
210 $offset = 0;
211 $regexp = '/\s(poster|src)\s*=\s*[\'"]*\S+upload-display\S+file=rcmfile(\w+)[\s\'"]*/';
212
213 while (preg_match($regexp, $html, $matches, 0, $offset)) {
214 $file_id = $matches[2];
215 $data_uri = ' ';
216
217 if ($file_id && ($file = $_SESSION['identity']['files'][$file_id])) {
218 $file = $RCMAIL->plugins->exec_hook('attachment_get', $file);
219
220 $data_uri .= 'src="data:' . $file['mimetype'] . ';base64,';
221 $data_uri .= base64_encode($file['data'] ?: file_get_contents($file['path']));
222 $data_uri .= '" ';
223 }
224
225 $html = str_replace($matches[0], $data_uri, $html);
226 $offset += strlen($data_uri) - strlen($matches[0]) + 1;
227 }
228
229 return $html;
230 }
231
232 /**
233 * Sanity checks/cleanups on HTML body of signature
234 */
235 function rcmail_wash_html($html)
236 {
237 // Add header with charset spec., washtml cannot work without that
238 $html = '<html><head>'
239 . '<meta http-equiv="Content-Type" content="text/html; charset='.RCUBE_CHARSET.'" />'
240 . '</head><body>' . $html . '</body></html>';
241
242 // clean HTML with washhtml by Frederic Motte
243 $wash_opts = array(
244 'show_washed' => false,
245 'allow_remote' => 1,
246 'charset' => RCUBE_CHARSET,
247 'html_elements' => array('body', 'link'),
248 'html_attribs' => array('rel', 'type'),
249 );
250
251 // initialize HTML washer
252 $washer = new rcube_washtml($wash_opts);
253
254 //$washer->add_callback('form', 'rcmail_washtml_callback');
255 //$washer->add_callback('style', 'rcmail_washtml_callback');
256
257 // Remove non-UTF8 characters (#1487813)
258 $html = rcube_charset::clean($html);
259
260 $html = $washer->wash($html);
261
262 // remove unwanted comments and tags (produced by washtml)
263 $html = preg_replace(array('/<!--[^>]+-->/', '/<\/?body>/'), '', $html);
264
265 return $html;
266 }