githubFork/roundcubemail.git

Disable installer by default; add config option to enable it again

thomascube

2008-03-28 967b342039261ab294fe85d806fe49ce16391ada

commit \| author \| age
4e17e6	1	<?php
T	2	/*
	3	+-----------------------------------------------------------------------+
	4	\| RoundCube Webmail IMAP Client \|
967b34	5	\| Version 0.1-20080328 \|
4e17e6	6	\| \|
0714b7	7	\| Copyright (C) 2005-2008, RoundCube Dev. - Switzerland \|
15fee7	8	\| Licensed under the GNU GPL \|
4e17e6	9	\| \|
T	10	\| Redistribution and use in source and binary forms, with or without \|
	11	\| modification, are permitted provided that the following conditions \|
	12	\| are met: \|
	13	\| \|
	14	\| o Redistributions of source code must retain the above copyright \|
	15	\| notice, this list of conditions and the following disclaimer. \|
	16	\| o Redistributions in binary form must reproduce the above copyright \|
	17	\| notice, this list of conditions and the following disclaimer in the \|
	18	\| documentation and/or other materials provided with the distribution.\|
	19	\| o The names of the authors may not be used to endorse or promote \|
	20	\| products derived from this software without specific prior written \|
	21	\| permission. \|
	22	\| \|
	23	\| THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \|
	24	\| "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT \|
	25	\| LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR \|
	26	\| A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT \|
	27	\| OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, \|
	28	\| SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT \|
	29	\| LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, \|
	30	\| DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY \|
	31	\| THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT \|
	32	\| (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE \|
	33	\| OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. \|
	34	\| \|
	35	+-----------------------------------------------------------------------+
	36	\| Author: Thomas Bruederli <roundcube@gmail.com> \|
	37	+-----------------------------------------------------------------------+
	38
	39	$Id$
	40
	41	*/
15a9d1	42
f11541	43	// application constants
23b870	44	define('RCMAIL_VERSION', '0.1-trunk');
f11541	45	define('RCMAIL_CHARSET', 'UTF-8');
T	46	define('JS_OBJECT_NAME', 'rcmail');
15a9d1	47
4e17e6	48	// define global vars
T	49	$OUTPUT_TYPE = 'html';
321302	50	$INSTALL_PATH = dirname(__FILE__);
8c2e58	51	$MAIN_TASKS = array('mail','settings','addressbook','logout');
4e17e6	52
7cc38e	53	if (empty($INSTALL_PATH))
T	54	$INSTALL_PATH = './';
	55	else
	56	$INSTALL_PATH .= '/';
bac7d1	57
T	58
	59	// make sure path_separator is defined
	60	if (!defined('PATH_SEPARATOR'))
	61	define('PATH_SEPARATOR', (eregi('win', PHP_OS) ? ';' : ':'));
	62
	63
d7cb77	64	// RC include folders MUST be included FIRST to avoid other
S	65	// possible not compatible libraries (i.e PEAR) to be included
	66	// instead the ones provided by RC
7cc38e	67	ini_set('include_path', $INSTALL_PATH.PATH_SEPARATOR.$INSTALL_PATH.'program'.PATH_SEPARATOR.$INSTALL_PATH.'program/lib'.PATH_SEPARATOR.ini_get('include_path'));
d7cb77	68
234c0d	69	ini_set('session.name', 'roundcube_sessid');
4e17e6	70	ini_set('session.use_cookies', 1);
977a29	71	ini_set('session.gc_maxlifetime', 21600);
T	72	ini_set('session.gc_divisor', 500);
	73	ini_set('error_reporting', E_ALL&~E_NOTICE);
969cef	74	set_magic_quotes_runtime(0);
4e17e6	75
T	76	// increase maximum execution time for php scripts
00fd33	77	// (does not work in safe mode)
024797	78	if (!ini_get('safe_mode')) @set_time_limit(120);
4e17e6	79
T	80	// include base files
	81	require_once('include/rcube_shared.inc');
	82	require_once('include/rcube_imap.inc');
	83	require_once('include/bugs.inc');
	84	require_once('include/main.inc');
7902df	85	require_once('PEAR.php');
T	86
	87
	88	// set PEAR error handling
	89	// PEAR::setErrorHandling(PEAR_ERROR_TRIGGER, E_USER_NOTICE);
4e17e6	90
T	91
	92	// catch some url/post parameters
e34ae1	93	$_task = strip_quotes(get_input_value('_task', RCUBE_INPUT_GPC));
T	94	$_action = strip_quotes(get_input_value('_action', RCUBE_INPUT_GPC));
597170	95	$_framed = (!empty($_GET['_framed']) \|\| !empty($_POST['_framed']));
42b113	96
e34ae1	97	// use main task if empty or invalid value
T	98	if (empty($_task) \|\| !in_array($_task, $MAIN_TASKS))
03f855	99	$_task = 'mail';
T	100
2f2f15	101
T	102	// set output buffering
	103	if ($_action != 'get' && $_action != 'viewsource')
f11541	104	{
2f2f15	105	// use gzip compression if supported
03fcc1	106	if (function_exists('ob_gzhandler')
T	107	&& !ini_get('zlib.output_compression')
	108	&& ini_get('output_handler') != 'ob_gzhandler')
	109	{
2f2f15	110	ob_start('ob_gzhandler');
03fcc1	111	}
2f2f15	112	else
T	113	ob_start();
f11541	114	}
2f2f15	115
42b113	116
4e17e6	117	// start session with requested task
T	118	rcmail_startup($_task);
	119
	120	// set session related variables
bac7d1	121	$COMM_PATH = sprintf('./?_task=%s', $_task);
T	122	$SESS_HIDDEN_FIELD = '';
4e17e6	123
T	124
	125	// add framed parameter
597170	126	if ($_framed)
f11541	127	{
T	128	$COMM_PATH .= '&_framed=1';
ccfda8	129	$SESS_HIDDEN_FIELD .= "\n".'<input type="hidden" name="_framed" value="1" />';
f11541	130	}
4e17e6	131
T	132
	133	// init necessary objects for GUI
f11541	134	rcmail_load_gui();
4e17e6	135
8affba	136
T	137	// check DB connections and exit on failure
	138	if ($err_str = $DB->is_error())
f11541	139	{
T	140	raise_error(array(
	141	'code' => 603,
	142	'type' => 'db',
	143	'message' => $err_str), FALSE, TRUE);
	144	}
8affba	145
T	146
4e17e6	147	// error steps
597170	148	if ($_action=='error' && !empty($_GET['_code']))
4e17e6	149	raise_error(array('code' => hexdec($_GET['_code'])), FALSE, TRUE);
570f0b	150
S	151
4e17e6	152	// try to log in
T	153	if ($_action=='login' && $_task=='mail')
f11541	154	{
0a020c	155	$host = rcmail_autoselect_host();
4e17e6	156
T	157	// check if client supports cookies
597170	158	if (empty($_COOKIE))
f11541	159	{
T	160	$OUTPUT->show_message("cookiesdisabled", 'warning');
	161	}
f15c26	162	else if ($_SESSION['temp'] && !empty($_POST['_user']) && isset($_POST['_pass']) &&
d7a287	163	rcmail_login(trim(get_input_value('_user', RCUBE_INPUT_POST), ' '),
0a020c	164	get_input_value('_pass', RCUBE_INPUT_POST, true, 'ISO-8859-1'), $host))
f11541	165	{
aad6e2	166	// create new session ID
T	167	unset($_SESSION['temp']);
	168	sess_regenerate_id();
	169
	170	// send auth cookie if necessary
	171	rcmail_authenticate_session();
	172
4e17e6	173	// send redirect
T	174	header("Location: $COMM_PATH");
	175	exit;
	176	}
f11541	177	else
T	178	{
fc6725	179	$OUTPUT->show_message($IMAP->error_code == -1 ? 'imaperror' : 'loginfailed', 'warning');
b9183e	180	rcmail_kill_session();
f11541	181	}
T	182	}
4e17e6	183
T	184	// end session
f11541	185	else if (($_task=='logout' \|\| $_action=='logout') && isset($_SESSION['user_id']))
T	186	{
	187	$OUTPUT->show_message('loggedout');
4e17e6	188	rcmail_kill_session();
f11541	189	}
4e17e6	190
bac7d1	191	// check session and auth cookie
86958f	192	else if ($_action != 'login' && $_SESSION['user_id'] && $_action != 'send')
f11541	193	{
aad6e2	194	if (!rcmail_authenticate_session())
f11541	195	{
T	196	$OUTPUT->show_message('sessionerror', 'error');
4e17e6	197	rcmail_kill_session();
T	198	}
f11541	199	}
4e17e6	200
T	201
	202	// log in to imap server
fba1f5	203	if (!empty($USER->ID) && $_task=='mail')
f11541	204	{
7902df	205	$conn = $IMAP->connect($_SESSION['imap_host'], $_SESSION['username'], decrypt_passwd($_SESSION['password']), $_SESSION['imap_port'], $_SESSION['imap_ssl']);
4e17e6	206	if (!$conn)
f11541	207	{
fc6725	208	$OUTPUT->show_message($IMAP->error_code == -1 ? 'imaperror' : 'sessionerror', 'error');
b9183e	209	rcmail_kill_session();
f11541	210	}
7902df	211	else
T	212	rcmail_set_imap_prop();
f11541	213	}
4e17e6	214
T	215
	216	// not logged in -> set task to 'login
fba1f5	217	if (empty($USER->ID))
f11541	218	{
T	219	if ($OUTPUT->ajax_call)
	220	$OUTPUT->remote_response("setTimeout(\"location.href='\"+this.env.comm_path+\"'\", 2000);");
42b113	221
4e17e6	222	$_task = 'login';
f11541	223	}
4e17e6	224
T	225
719a25	226	// check client X-header to verify request origin
T	227	if ($OUTPUT->ajax_call)
	228	{
88f66e	229	if (empty($CONFIG['devel_mode']) && !rc_request_header('X-RoundCube-Referer'))
719a25	230	{
T	231	header('HTTP/1.1 404 Not Found');
	232	die("Invalid Request");
	233	}
	234	}
	235
4e17e6	236
597170	237	// set task and action to client
f11541	238	$OUTPUT->set_env('task', $_task);
4e17e6	239	if (!empty($_action))
f11541	240	$OUTPUT->set_env('action', $_action);
4e17e6	241
T	242
	243
	244	// not logged in -> show login page
fba1f5	245	if (empty($USER->ID))
f11541	246	{
330127	247	// check if installer is still active
967b34	248	if ($CONFIG['enable_installer'] && is_readable('./installer/index.php'))
330127	249	$OUTPUT->add_footer('
T	250	<div style="background:#ef9398; border:2px solid #dc5757; padding:0.5em; margin:2em auto; width:50em">
	251	<h2 style="margin-top:0.2em">Installer script is still accessible</h2>
	252	<p>The install script of your RoundCube installation is still stored in its default location!</p>
	253	<p>Please <b>remove</b> the whole <tt>installer</tt> folder from the RoundCube directory because
	254	these files may expose sensitive configuration data like server passwords and encryption keys
	255	to the public. Make sure you cannot access the <a href="./installer/">installer script</a> from your browser.</p>
	256	</div>');
	257
f11541	258	$OUTPUT->task = 'login';
T	259	$OUTPUT->send('login');
4e17e6	260	exit;
f11541	261	}
4e17e6	262
T	263
1cded8	264	// handle keep-alive signal
T	265	if ($_action=='keep-alive')
f11541	266	{
T	267	$OUTPUT->reset();
	268	$OUTPUT->send('');
1cded8	269	exit;
f11541	270	}
4e17e6	271
T	272	// include task specific files
	273	if ($_task=='mail')
f11541	274	{
4e17e6	275	include_once('program/steps/mail/func.inc');
88375f	276
b19097	277	if ($_action=='show' \|\| $_action=='preview' \|\| $_action=='print')
4e17e6	278	include('program/steps/mail/show.inc');
T	279
	280	if ($_action=='get')
	281	include('program/steps/mail/get.inc');
	282
	283	if ($_action=='moveto' \|\| $_action=='delete')
	284	include('program/steps/mail/move_del.inc');
	285
	286	if ($_action=='mark')
	287	include('program/steps/mail/mark.inc');
	288
	289	if ($_action=='viewsource')
	290	include('program/steps/mail/viewsource.inc');
	291
fba1f5	292	if ($_action=='sendmdn')
T	293	include('program/steps/mail/sendmdn.inc');
	294
4e17e6	295	if ($_action=='send')
T	296	include('program/steps/mail/sendmail.inc');
	297
	298	if ($_action=='upload')
	299	include('program/steps/mail/upload.inc');
	300
4315b0	301	if ($_action=='compose' \|\| $_action=='remove-attachment' \|\| $_action=='display-attachment')
4e17e6	302	include('program/steps/mail/compose.inc');
T	303
	304	if ($_action=='addcontact')
	305	include('program/steps/mail/addcontact.inc');
15a9d1	306
5e3512	307	if ($_action=='expunge' \|\| $_action=='purge')
15a9d1	308	include('program/steps/mail/folders.inc');
T	309
	310	if ($_action=='check-recent')
	311	include('program/steps/mail/check_recent.inc');
	312
	313	if ($_action=='getunread')
	314	include('program/steps/mail/getunread.inc');
4e17e6	315
8d0758	316	if ($_action=='list' && isset($_REQUEST['_remote']))
4e17e6	317	include('program/steps/mail/list.inc');
T	318
4647e1	319	if ($_action=='search')
dd53e2	320	include('program/steps/mail/search.inc');
T	321
	322	if ($_action=='spell')
	323	include('program/steps/mail/spell.inc');
4647e1	324
88375f	325	if ($_action=='rss')
T	326	include('program/steps/mail/rss.inc');
3ea0e3	327
23796e	328	if ($_action=='quotadisplay')
S	329	include('program/steps/mail/quotadisplay.inc');
	330
aade7b	331
01c86f	332	// make sure the message count is refreshed
T	333	$IMAP->messagecount($_SESSION['mbox'], 'ALL', TRUE);
f11541	334	}
4e17e6	335
T	336
	337	// include task specific files
	338	if ($_task=='addressbook')
f11541	339	{
4e17e6	340	include_once('program/steps/addressbook/func.inc');
T	341
	342	if ($_action=='save')
	343	include('program/steps/addressbook/save.inc');
	344
	345	if ($_action=='edit' \|\| $_action=='add')
	346	include('program/steps/addressbook/edit.inc');
	347
	348	if ($_action=='delete')
	349	include('program/steps/addressbook/delete.inc');
	350
	351	if ($_action=='show')
	352	include('program/steps/addressbook/show.inc');
	353
8d0758	354	if ($_action=='list' && $_REQUEST['_remote'])
4e17e6	355	include('program/steps/addressbook/list.inc');
d1d2c4	356
f11541	357	if ($_action=='search')
T	358	include('program/steps/addressbook/search.inc');
	359
	360	if ($_action=='copy')
	361	include('program/steps/addressbook/copy.inc');
	362
	363	if ($_action=='mailto')
	364	include('program/steps/addressbook/mailto.inc');
	365	}
4e17e6	366
T	367
	368	// include task specific files
	369	if ($_task=='settings')
f11541	370	{
4e17e6	371	include_once('program/steps/settings/func.inc');
T	372
	373	if ($_action=='save-identity')
	374	include('program/steps/settings/save_identity.inc');
	375
	376	if ($_action=='add-identity' \|\| $_action=='edit-identity')
	377	include('program/steps/settings/edit_identity.inc');
	378
	379	if ($_action=='delete-identity')
	380	include('program/steps/settings/delete_identity.inc');
	381
	382	if ($_action=='identities')
	383	include('program/steps/settings/identities.inc');
	384
	385	if ($_action=='save-prefs')
	386	include('program/steps/settings/save_prefs.inc');
	387
aade7b	388	if ($_action=='folders' \|\| $_action=='subscribe' \|\| $_action=='unsubscribe' \|\|
T	389	$_action=='create-folder' \|\| $_action=='rename-folder' \|\| $_action=='delete-folder')
4e17e6	390	include('program/steps/settings/manage_folders.inc');
T	391
f11541	392	}
ecf759	393
T	394
539cd4	395	// parse main template
f11541	396	$OUTPUT->send($_task);
539cd4	397
T	398
	399	// if we arrive here, something went wrong
f11541	400	raise_error(array(
T	401	'code' => 404,
	402	'type' => 'php',
	403	'line' => __LINE__,
	404	'file' => __FILE__,
	405	'message' => "Invalid request"), TRUE, TRUE);
539cd4	406
d1d2c4	407	?>