Marius Cramer
2013-10-14 d9bcf68e395d6156645a7974b1a992aa6e6c00aa
interface/web/mail/mail_get_edit.php
@@ -69,6 +69,12 @@
   function onSubmit() {
      global $app, $conf;
      
      //* Check if destination email belongs to user
      if(isset($_POST["destination"])) {
         $email = $app->db->queryOneRecord("SELECT email FROM mail_user WHERE email = '".$app->db->quote($app->functions->idn_encode($_POST["destination"]))."' AND ".$app->tform->getAuthSQL('r'));
         if($email["email"] != $app->functions->idn_encode($_POST["destination"])) $app->tform->errorMessage .= $app->tform->lng("no_destination_perm");
      }
      // Check the client limits, if user is not the admin
      if($_SESSION["s"]["user"]["typ"] != 'admin') { // if user is not admin
         // Get the limits of the client
@@ -85,11 +91,17 @@
         }
      } // end if user is not admin
      
      // Set the server ID according to the selected destination
      $tmp = $app->db->queryOneRecord("SELECT server_id FROM mail_user WHERE email = '".$app->db->quote($this->dataRecord["destination"])."'");
      $this->dataRecord["server_id"] = $tmp["server_id"];
      unset($tmp);
      
      //* Check that no illegal combination of options is set
      if((!isset($this->dataRecord['source_delete']) || @$this->dataRecord['source_delete'] == 'n') && $this->dataRecord['source_read_all'] == 'y') {
         $app->tform->errorMessage .= $app->tform->lng('error_delete_read_all_combination')."<br>";
      }
      parent::onSubmit();
   }