Skip filename suffix check for embedded images; return blocked.gif instead ...

Thomas Bruederli

2013-04-10 706d3f472f1607004ae35a155a80c63239509323

 program/lib/Roundcube/rcube_message.php

@@ -85,15 +85,16 @@

        $this->headers = $this->storage->get_message($uid);

        if (!$this->headers)
        if (!$this->headers) {
            return;
        }

        $this->mime = new rcube_mime($this->headers->charset);

        $this->subject = $this->mime->decode_mime_string($this->headers->subject);
        $this->subject = $this->headers->get('subject');
        list(, $this->sender) = each($this->mime->decode_address_list($this->headers->from, 1));

        $this->set_safe((intval($_GET['_safe']) || $_SESSION['safe_messages'][$uid]));
        $this->set_safe((intval($_GET['_safe']) || $_SESSION['safe_messages'][$this->folder.':'.$uid]));
        $this->opt = array(
            'safe' => $this->is_safe,
            'prefer_html' => $this->app->config->get('prefer_html'),
@@ -125,15 +126,11 @@
     */
    public function get_header($name, $raw = false)
    {
        if (empty($this->headers))
        if (empty($this->headers)) {
            return null;
        }

        if ($this->headers->$name)
            $value = $this->headers->$name;
        else if ($this->headers->others[$name])
            $value = $this->headers->others[$name];

        return $raw ? $value : $this->mime->decode_header($value);
        return $this->headers->get($name, !$raw);
    }


@@ -144,8 +141,7 @@
     */
    public function set_safe($safe = true)
    {
        $this->is_safe = $safe;
        $_SESSION['safe_messages'][$this->uid] = $this->is_safe;
        $_SESSION['safe_messages'][$this->folder.':'.$this->uid] = $this->is_safe = $safe;
    }


@@ -153,12 +149,13 @@
     * Compose a valid URL for getting a message part
     *
     * @param string $mime_id Part MIME-ID
     * @param mixed  $embed Mimetype class for parts to be embedded
     * @return string URL or false if part does not exist
     */
    public function get_part_url($mime_id, $embed = false)
    {
        if ($this->mime_parts[$mime_id])
            return $this->opt['get_url'] . '&_part=' . $mime_id . ($embed ? '&_embed=1' : '');
            return $this->opt['get_url'] . '&_part=' . $mime_id . ($embed ? '&_embed=1&_mimeclass=' . $embed : '');
        else
            return false;
    }
@@ -210,18 +207,20 @@
                if (!$recursive) {
                    $level = explode('.', $part->mime_id);

                    // Skip if level too deep or part has a file name
                    if (count($level) > 2 || $part->filename) {
                    // Skip if part is an attachment
                    if ($this->is_attachment($part)) {
                        continue;
                    }

                    // HTML part can be on the lower level, if not...
                    if (count($level) > 1) {
                        array_pop($level);
                    // Check if the part belongs to higher-level's alternative/related
                    while (array_pop($level) !== null) {
                        if (!count($level)) {
                            return true;
                        }

                        $parent = $this->mime_parts[join('.', $level)];
                        // ... parent isn't multipart/alternative or related
                        if ($parent->mimetype != 'multipart/alternative' && $parent->mimetype != 'multipart/related') {
                            continue;
                            continue 2;
                        }
                    }
                }
@@ -468,6 +467,17 @@

            $this->parts[] = $p;
        }
        // this is an S/MIME ecrypted message -> create a plaintext body with the according message
        else if ($mimetype == 'application/pkcs7-mime') {
            $p = new stdClass;
            $p->type            = 'content';
            $p->ctype_primary   = 'text';
            $p->ctype_secondary = 'plain';
            $p->mimetype        = 'text/plain';
            $p->realtype        = 'application/pkcs7-mime';

            $this->parts[] = $p;
        }
        // message contains multiple parts
        else if (is_array($structure->parts) && !empty($structure->parts)) {
            // iterate over parts
@@ -604,8 +614,8 @@
                $img_regexp = '/^image\/(gif|jpe?g|png|tiff|bmp|svg)/';

                foreach ($this->inline_parts as $inline_object) {
                    $part_url = $this->get_part_url($inline_object->mime_id, true);
                    if ($inline_object->content_id)
                    $part_url = $this->get_part_url($inline_object->mime_id, $inline_object->ctype_primary);
                    if (isset($inline_object->content_id))
                        $a_replaces['cid:'.$inline_object->content_id] = $part_url;
                    if ($inline_object->content_location) {
                        $a_replaces[$inline_object->content_location] = $part_url;