More input sanitizing

thomascube

2007-11-25 d5342aabcfeddb959cc286befe6de5bf35fe9d76

 program/steps/settings/func.inc

@@ -5,7 +5,7 @@
 | program/steps/settings/func.inc                                       |
 |                                                                       |
 | This file is part of the RoundCube Webmail client                     |
 | Copyright (C) 2005, RoundCube Dev. - Switzerland                      |
 | Copyright (C) 2005-2007, RoundCube Dev. - Switzerland                 |
 | Licensed under the GNU GPL                                            |
 |                                                                       |
 | PURPOSE:                                                              |
@@ -26,7 +26,9 @@
                          $_SESSION['user_id']);
                                 
if ($USER_DATA = $DB->fetch_assoc($sql_result))
  $PAGE_TITLE = sprintf('%s %s@%s', rcube_label('settingsfor'), $USER_DATA['username'], $USER_DATA['mail_host']);
{
  $OUTPUT->set_pagetitle(rcube_label('settingsfor') . " ". $USER_DATA['username'] . (!strpos($USER_DATA['username'], '@') ? '@'.$USER_DATA['mail_host'] : ''));
}



@@ -60,7 +62,7 @@
  
    $out .= sprintf("<tr><td class=\"title\"><label for=\"%s\">%s</label></td><td>%s</td></tr>\n",
                    $field_id,
                    rep_specialchars_output(rcube_label('language')),
                    Q(rcube_label('language')),
                    $select_lang->show($sess_user_lang));
    }

@@ -97,7 +99,7 @@
    $select_timezone->add('(GMT +8:00) Beijing, Perth, Singapore, Taipei', '8');
    $select_timezone->add('(GMT +9:00) Tokyo, Seoul, Yakutsk', '9');
    $select_timezone->add('(GMT +9:30) Adelaide, Darwin', '9.5');
    $select_timezone->add('(GMT +10:00) EAST/AEST: Guam, Vladivostok', '10');
    $select_timezone->add('(GMT +10:00) EAST/AEST: Sydney, Guam, Vladivostok', '10');
    $select_timezone->add('(GMT +11:00) Magadan, Solomon Islands', '11');
    $select_timezone->add('(GMT +12:00) Auckland, Wellington, Kamchatka', '12');
    $select_timezone->add('(GMT +13:00) Tonga, Pheonix Islands', '13');
@@ -106,7 +108,7 @@
  
    $out .= sprintf("<tr><td class=\"title\"><label for=\"%s\">%s</label></td><td>%s</td></tr>\n",
                    $field_id,
                    rep_specialchars_output(rcube_label('timezone')),
                    Q(rcube_label('timezone')),
                    $select_timezone->show($CONFIG['timezone']));
    }

@@ -117,7 +119,7 @@
    $input_dst = new checkbox(array('name' => '_dst_active', 'id' => $field_id, 'value' => 1));
    $out .= sprintf("<tr><td class=\"title\"><label for=\"%s\">%s</label></td><td>%s</td></tr>\n",
                    $field_id,
                    rep_specialchars_output(rcube_label('dstactive')),
                    Q(rcube_label('dstactive')),
                    $input_dst->show($CONFIG['dst_active']));
    }

@@ -129,7 +131,7 @@

    $out .= sprintf("<tr><td class=\"title\"><label for=\"%s\">%s</label></td><td>%s</td></tr>\n",
                    $field_id,
                    rep_specialchars_output(rcube_label('pagesize')),
                    Q(rcube_label('pagesize')),
                    $input_pagesize->show($CONFIG['pagesize']));
    }

@@ -141,7 +143,7 @@

    $out .= sprintf("<tr><td class=\"title\"><label for=\"%s\">%s</label></td><td>%s</td></tr>\n",
                    $field_id,
                    rep_specialchars_output(rcube_label('prettydate')),
                    Q(rcube_label('prettydate')),
                    $input_prettydate->show($CONFIG['prettydate']?1:0));
    }

@@ -153,7 +155,7 @@

    $out .= sprintf("<tr><td class=\"title\"><label for=\"%s\">%s</label></td><td>%s</td></tr>\n",
                    $field_id,
                    rep_specialchars_output(rcube_label('preferhtml')),
                    Q(rcube_label('preferhtml')),
                    $input_pagesize->show($CONFIG['prefer_html']?1:0));
    }

@@ -164,7 +166,7 @@
    $input_htmleditor = new checkbox(array('name' => '_htmleditor', 'id' => $field_id, 'value' => 1));
    $out .= sprintf("<tr><td class=\"title\"><label for=\"%s\">%s</label></td><td>%s</td></tr>\n",
                    $field_id,
                    rep_specialchars_output(rcube_label('htmleditor')),
                    Q(rcube_label('htmleditor')),
                    $input_htmleditor->show($CONFIG['htmleditor']?1:0));
    }

@@ -175,11 +177,11 @@
    $input_preview = new checkbox(array('name' => '_preview_pane', 'id' => $field_id, 'value' => 1));
    $out .= sprintf("<tr><td class=\"title\"><label for=\"%s\">%s</label></td><td>%s</td></tr>\n",
                    $field_id,
                    rep_specialchars_output(rcube_label('previewpane')),
                    Q(rcube_label('previewpane')),
                    $input_preview->show($CONFIG['preview_pane']?1:0));
    }
                  
  if (!empty($CONFIG['drafts_mbox']) && !isset($no_override['preview_pane']))
  if (!empty($CONFIG['drafts_mbox']) && !isset($no_override['draft_autosave']))
    {
    $field_id = 'rcmfd_autosave';
    $select_autosave = new select(array('name' => '_draft_autosave', 'id' => $field_id));
@@ -189,7 +191,7 @@

    $out .= sprintf("<tr><td class=\"title\"><label for=\"%s\">%s</label></td><td>%s</td></tr>\n",
                    $field_id,
                    rep_specialchars_output(rcube_label('autosavedraft')),
                    Q(rcube_label('autosavedraft')),
                    $select_autosave->show($CONFIG['draft_autosave']));
    }

@@ -202,7 +204,7 @@

function rcmail_identities_list($attrib)
  {
  global $DB, $CONFIG, $OUTPUT, $JS_OBJECT_NAME;
  global $DB, $CONFIG, $OUTPUT;


  // get contacts from DB
@@ -224,8 +226,7 @@
  $out = rcube_table_output($attrib, $sql_result, $a_show_cols, 'identity_id');
  
  // set client env
  $javascript = sprintf("%s.gui_object('identitieslist', '%s');\n", $JS_OBJECT_NAME, $attrib['id']);
  $OUTPUT->add_script($javascript);    
  $OUTPUT->add_gui_object('identitieslist', $attrib['id']);

  return $out;
  }
@@ -235,7 +236,7 @@
// similar function as in /steps/addressbook/edit.inc
function get_form_tags($attrib, $action, $add_hidden=array())
  {
  global $OUTPUT, $JS_OBJECT_NAME, $EDIT_FORM, $SESS_HIDDEN_FIELD;  
  global $OUTPUT, $EDIT_FORM, $SESS_HIDDEN_FIELD;  

  $form_start = '';
  if (!strlen($EDIT_FORM))
@@ -258,7 +259,7 @@
  $form_name = strlen($attrib['form']) ? $attrib['form'] : 'form';

  if (!strlen($EDIT_FORM))
    $OUTPUT->add_script("$JS_OBJECT_NAME.gui_object('editform', '$form_name');");
    $OUTPUT->add_gui_object('editform', $form_name);
  
  $EDIT_FORM = $form_name;

@@ -266,4 +267,11 @@
  }


?>
// register UI objects
$OUTPUT->add_handlers(array(
  'userprefs' => 'rcmail_user_prefs_form',
  'itentitieslist' => 'rcmail_identities_list'
));


?>