Revert r2322; this is done in rcmail_html4inline() and now secured + fix tests

thomascube

2009-03-02 11526305f506245af55e8ae7ea31faec49dfd98d

 program/include/rcube_user.php

@@ -5,7 +5,7 @@
 | program/include/rcube_user.inc                                        |
 |                                                                       |
 | This file is part of the RoundCube Webmail client                     |
 | Copyright (C) 2005-2008, RoundCube Dev. - Switzerland                 |
 | Copyright (C) 2005-2009, RoundCube Dev. - Switzerland                 |
 | Licensed under the GNU GPL                                            |
 |                                                                       |
 | PURPOSE:                                                              |
@@ -78,7 +78,8 @@
   */
  function get_prefs()
  {
    $prefs = array('language' => $this->language);
    if (!empty($this->language))
      $prefs = array('language' => $this->language);
    
    if ($this->ID && $this->data['preferences'])
      $prefs += (array)unserialize($this->data['preferences']);
@@ -156,7 +157,7 @@
       WHERE  del<>1
       AND    user_id=?
       $sql_add
       ORDER BY ".$this->db->quoteIdentifier('standard')." DESC, name ASC",
       ORDER BY ".$this->db->quoteIdentifier('standard')." DESC, name ASC, identity_id ASC",
      $this->ID);
    
    return $sql_result;
@@ -372,19 +373,22 @@
      $user_name = $user != $user_email ? $user : '';

      // try to resolve the e-mail address from the virtuser table
      if ($virtuser_query = $rcmail->config->get('virtuser_query') &&
          ($sql_result = $dbh->query(preg_replace('/%u/', $dbh->escapeSimple($user), $virtuser_query))) &&
          ($dbh->num_rows() > 0))
      if (($virtuser_query = $rcmail->config->get('virtuser_query'))
       && ($sql_result = $dbh->query(preg_replace('/%u/', $dbh->escapeSimple($user), $virtuser_query)))
   && ($dbh->num_rows() > 0))
      {
        $standard = 1;
        while ($sql_arr = $dbh->fetch_array($sql_result))
        {
          $dbh->query(
            "INSERT INTO ".get_table_name('identities')."
              (user_id, del, standard, name, email)
             VALUES (?, 0, 1, ?, ?)",
             VALUES (?, 0, ?, ?, ?)",
            $user_id,
       $standard,
            strip_newlines($user_name),
            preg_replace('/^@/', $user . '@', $sql_arr[0]));
     $standard = 0;
        }
      }
      else