Skip filename suffix check for embedded images; return blocked.gif instead ...

Thomas Bruederli

2013-04-10 706d3f472f1607004ae35a155a80c63239509323

 program/lib/Roundcube/rcube_message.php

@@ -85,15 +85,16 @@

        $this->headers = $this->storage->get_message($uid);

        if (!$this->headers)
        if (!$this->headers) {
            return;
        }

        $this->mime = new rcube_mime($this->headers->charset);

        $this->subject = $this->mime->decode_mime_string($this->headers->subject);
        $this->subject = $this->headers->get('subject');
        list(, $this->sender) = each($this->mime->decode_address_list($this->headers->from, 1));

        $this->set_safe((intval($_GET['_safe']) || $_SESSION['safe_messages'][$uid]));
        $this->set_safe((intval($_GET['_safe']) || $_SESSION['safe_messages'][$this->folder.':'.$uid]));
        $this->opt = array(
            'safe' => $this->is_safe,
            'prefer_html' => $this->app->config->get('prefer_html'),
@@ -125,15 +126,11 @@
     */
    public function get_header($name, $raw = false)
    {
        if (empty($this->headers))
        if (empty($this->headers)) {
            return null;
        }

        if ($this->headers->$name)
            $value = $this->headers->$name;
        else if ($this->headers->others[$name])
            $value = $this->headers->others[$name];

        return $raw ? $value : $this->mime->decode_header($value);
        return $this->headers->get($name, !$raw);
    }


@@ -144,8 +141,7 @@
     */
    public function set_safe($safe = true)
    {
        $this->is_safe = $safe;
        $_SESSION['safe_messages'][$this->uid] = $this->is_safe;
        $_SESSION['safe_messages'][$this->folder.':'.$this->uid] = $this->is_safe = $safe;
    }


@@ -153,12 +149,13 @@
     * Compose a valid URL for getting a message part
     *
     * @param string $mime_id Part MIME-ID
     * @param mixed  $embed Mimetype class for parts to be embedded
     * @return string URL or false if part does not exist
     */
    public function get_part_url($mime_id, $embed = false)
    {
        if ($this->mime_parts[$mime_id])
            return $this->opt['get_url'] . '&_part=' . $mime_id . ($embed ? '&_embed=1' : '');
            return $this->opt['get_url'] . '&_part=' . $mime_id . ($embed ? '&_embed=1&_mimeclass=' . $embed : '');
        else
            return false;
    }
@@ -617,8 +614,8 @@
                $img_regexp = '/^image\/(gif|jpe?g|png|tiff|bmp|svg)/';

                foreach ($this->inline_parts as $inline_object) {
                    $part_url = $this->get_part_url($inline_object->mime_id, true);
                    if ($inline_object->content_id)
                    $part_url = $this->get_part_url($inline_object->mime_id, $inline_object->ctype_primary);
                    if (isset($inline_object->content_id))
                        $a_replaces['cid:'.$inline_object->content_id] = $part_url;
                    if ($inline_object->content_location) {
                        $a_replaces[$inline_object->content_location] = $part_url;