From 0b17277eaeebdee278230d7cd2550a1a9e2fcf9f Mon Sep 17 00:00:00 2001
From: till <till@php.net>
Date: Mon, 24 Mar 2008 20:52:33 -0400
Subject: [PATCH] * committing patch from #1484783

---
 program/steps/mail/func.inc |  937 ++++++++++++++++++++++++++++++----------------------------
 1 files changed, 484 insertions(+), 453 deletions(-)

diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
index 037e83f..79e0248 100644
--- a/program/steps/mail/func.inc
+++ b/program/steps/mail/func.inc
@@ -5,7 +5,7 @@
  | program/steps/mail/func.inc                                           |
  |                                                                       |
  | This file is part of the RoundCube Webmail client                     |
- | Copyright (C) 2005, RoundCube Dev. - Switzerland                      |
+ | Copyright (C) 2005-2007, RoundCube Dev. - Switzerland                 |
  | Licensed under the GNU GPL                                            |
  |                                                                       |
  | PURPOSE:                                                              |
@@ -21,26 +21,20 @@
 
 require_once('lib/html2text.inc');
 require_once('lib/enriched.inc');
+require_once('include/rcube_smtp.inc');
 
 
 $EMAIL_ADDRESS_PATTERN = '/([a-z0-9][a-z0-9\-\.\+\_]*@[a-z0-9]([a-z0-9\-][.]?)*[a-z0-9]\\.[a-z]{2,5})/i';
 
-if (empty($_SESSION['mbox'])){
+if (empty($_SESSION['mbox']))
   $_SESSION['mbox'] = $IMAP->get_mailbox_name();
-}
 
 // set imap properties and session vars
-if (strlen($mbox = get_input_value('_mbox', RCUBE_INPUT_GET)))
-  {
-  $IMAP->set_mailbox($mbox);
-  $_SESSION['mbox'] = $mbox;
-  }
+if ($mbox = get_input_value('_mbox', RCUBE_INPUT_GPC))
+  $IMAP->set_mailbox(($_SESSION['mbox'] = $mbox));
 
-if (strlen($_GET['_page']))
-  {
-  $IMAP->set_page($_GET['_page']);
-  $_SESSION['page'] = $_GET['_page'];
-  }
+if (!empty($_GET['_page']))
+  $IMAP->set_page(($_SESSION['page'] = intval($_GET['_page'])));
 
 // set mailbox to INBOX if not set
 if (empty($_SESSION['mbox']))
@@ -53,247 +47,43 @@
   $_SESSION['sort_order'] = $CONFIG['message_sort_order'];
 
 // set message set for search result
-if (!empty($_GET['_search']) && isset($_SESSION['search'][$_GET['_search']]))
-  $IMAP->set_search_set($_SESSION['search'][$_GET['_search']]);
+if (!empty($_REQUEST['_search']) && isset($_SESSION['search'][$_REQUEST['_search']]))
+  {
+  $IMAP->set_search_set($_SESSION['search'][$_REQUEST['_search']]);
+  $OUTPUT->set_env('search_request', $_REQUEST['_search']);
+  $OUTPUT->set_env('search_text', $_SESSION['last_text_search']);
+  }
 
 
 // define url for getting message parts
 if (strlen($_GET['_uid']))
-  $GET_URL = sprintf('%s&_action=get&_mbox=%s&_uid=%d', $COMM_PATH, $IMAP->get_mailbox_name(), $_GET['_uid']);
+  $GET_URL = rcmail_url('get', array('_mbox'=>$IMAP->get_mailbox_name(), '_uid'=>get_input_value('_uid', RCUBE_INPUT_GET)));
 
 
 // set current mailbox in client environment
-$OUTPUT->add_script(sprintf("%s.set_env('mailbox', '%s');", $JS_OBJECT_NAME, $IMAP->get_mailbox_name()));
+$OUTPUT->set_env('mailbox', $IMAP->get_mailbox_name());
+$OUTPUT->set_env('quota', $IMAP->get_capability('quota'));
 
 if ($CONFIG['trash_mbox'])
-  $OUTPUT->add_script(sprintf("%s.set_env('trash_mailbox', '%s');", $JS_OBJECT_NAME, $CONFIG['trash_mbox']));
-
+  $OUTPUT->set_env('trash_mailbox', $CONFIG['trash_mbox']);
 if ($CONFIG['drafts_mbox'])
-  $OUTPUT->add_script(sprintf("%s.set_env('drafts_mailbox', '%s');", $JS_OBJECT_NAME, $CONFIG['drafts_mbox']));
-
+  $OUTPUT->set_env('drafts_mailbox', $CONFIG['drafts_mbox']);
 if ($CONFIG['junk_mbox'])
-  $OUTPUT->add_script(sprintf("%s.set_env('junk_mailbox', '%s');", $JS_OBJECT_NAME, $CONFIG['junk_mbox']));
+  $OUTPUT->set_env('junk_mailbox', $CONFIG['junk_mbox']);
 
-// return the mailboxlist in HTML
-function rcmail_mailbox_list($attrib)
-  {
-  global $IMAP, $CONFIG, $OUTPUT, $JS_OBJECT_NAME, $COMM_PATH;
-  static $s_added_script = FALSE;
-  static $a_mailboxes;
+if (!$OUTPUT->ajax_call)
+  rcube_add_label('checkingmail', 'deletemessage', 'movemessagetotrash');
 
-  // add some labels to client
-  rcube_add_label('purgefolderconfirm');
-  rcube_add_label('deletemessagesconfirm');
-  
-// $mboxlist_start = rcube_timer();
-  
-  $type = $attrib['type'] ? $attrib['type'] : 'ul';
-  $add_attrib = $type=='select' ? array('style', 'class', 'id', 'name', 'onchange') :
-                                  array('style', 'class', 'id');
-                                  
-  if ($type=='ul' && !$attrib['id'])
-    $attrib['id'] = 'rcmboxlist';
+// set page title
+if (empty($_action) || $_action == 'list')
+  $OUTPUT->set_pagetitle(rcmail_localize_foldername($IMAP->get_mailbox_name()));
 
-  // allow the following attributes to be added to the <ul> tag
-  $attrib_str = create_attrib_string($attrib, $add_attrib);
- 
-  $out = '<' . $type . $attrib_str . ">\n";
-  
-  // add no-selection option
-  if ($type=='select' && $attrib['noselection'])
-    $out .= sprintf('<option value="0">%s</option>'."\n",
-                    rcube_label($attrib['noselection']));
-  
-  // get mailbox list
-  $mbox_name = $IMAP->get_mailbox_name();
-  
-  // for these mailboxes we have localized labels
-  $special_mailboxes = array('inbox', 'sent', 'drafts', 'trash', 'junk');
-
-
-  // build the folders tree
-  if (empty($a_mailboxes))
-    {
-    // get mailbox list
-    $a_folders = $IMAP->list_mailboxes();
-    $delimiter = $IMAP->get_hierarchy_delimiter();
-    $a_mailboxes = array();
-
-// rcube_print_time($mboxlist_start, 'list_mailboxes()');
-
-    foreach ($a_folders as $folder)
-      rcmail_build_folder_tree($a_mailboxes, $folder, $delimiter);
-    }
-
-// var_dump($a_mailboxes);
-
-  if ($type=='select')
-    $out .= rcmail_render_folder_tree_select($a_mailboxes, $special_mailboxes, $mbox_name, $attrib['maxlength']);
-   else
-    $out .= rcmail_render_folder_tree_html($a_mailboxes, $special_mailboxes, $mbox_name, $attrib['maxlength']);
-
-// rcube_print_time($mboxlist_start, 'render_folder_tree()');
-
-
-  if ($type=='ul')
-    $OUTPUT->add_script(sprintf("%s.gui_object('mailboxlist', '%s');", $JS_OBJECT_NAME, $attrib['id']));
-
-  return $out . "</$type>";
-  }
-
-
-
-
-// create a hierarchical array of the mailbox list
-function rcmail_build_folder_tree(&$arrFolders, $folder, $delm='/', $path='')
-  {
-  $pos = strpos($folder, $delm);
-  if ($pos !== false)
-    {
-    $subFolders = substr($folder, $pos+1);
-    $currentFolder = substr($folder, 0, $pos);
-    }
-  else
-    {
-    $subFolders = false;
-    $currentFolder = $folder;
-    }
-
-  $path .= $currentFolder;
-
-  if (!isset($arrFolders[$currentFolder]))
-    {
-    $arrFolders[$currentFolder] = array('id' => $path,
-                                        'name' => rcube_charset_convert($currentFolder, 'UTF-7'),
-                                        'folders' => array());
-    }
-
-  if (!empty($subFolders))
-    rcmail_build_folder_tree($arrFolders[$currentFolder]['folders'], $subFolders, $delm, $path.$delm);
-  }
-  
-
-// return html for a structured list <ul> for the mailbox tree
-function rcmail_render_folder_tree_html(&$arrFolders, &$special, &$mbox_name, $maxlength, $nestLevel=0)
-  {
-  global $JS_OBJECT_NAME, $COMM_PATH, $IMAP, $CONFIG, $OUTPUT;
-
-  $idx = 0;
-  $out = '';
-  foreach ($arrFolders as $key => $folder)
-    {
-    $zebra_class = ($nestLevel*$idx)%2 ? 'even' : 'odd';
-    $title = '';
-
-    $folder_lc = strtolower($folder['id']);
-    if (in_array($folder_lc, $special))
-      $foldername = rcube_label($folder_lc);
-    else
-      {
-      $foldername = $folder['name'];
-
-      // shorten the folder name to a given length
-      if ($maxlength && $maxlength>1)
-        {
-        $fname = abbrevate_string($foldername, $maxlength);
-        if ($fname != $foldername)
-          $title = ' title="'.Q($foldername).'"';
-        $foldername = $fname;
-        }
-      }
-
-    // add unread message count display
-    if ($unread_count = $IMAP->messagecount($folder['id'], 'RECENT', ($folder['id']==$mbox_name)))
-      $foldername .= sprintf(' (%d)', $unread_count);
-
-    // make folder name safe for ids and class names
-    $folder_css = $class_name = preg_replace('/[^a-z0-9\-_]/', '', $folder_lc);
-
-    // set special class for Sent, Drafts, Trash and Junk
-    if ($folder['id']==$CONFIG['sent_mbox'])
-      $class_name = 'sent';
-    else if ($folder['id']==$CONFIG['drafts_mbox'])
-      $class_name = 'drafts';
-    else if ($folder['id']==$CONFIG['trash_mbox'])
-      $class_name = 'trash';
-    else if ($folder['id']==$CONFIG['junk_mbox'])
-      $class_name = 'junk';
-
-    $js_name = htmlspecialchars(JQ($folder['id']));
-    $out .= sprintf('<li id="rcmbx%s" class="mailbox %s %s%s%s"><a href="%s&amp;_mbox=%s"'.
-                    ' onclick="return %s.command(\'list\',\'%s\')"'.
-                    ' onmouseover="return %s.focus_mailbox(\'%s\')"' .            
-                    ' onmouseout="return %s.unfocus_mailbox(\'%s\')"' .
-                    ' onmouseup="return %s.mbox_mouse_up(\'%s\')"%s>%s</a>',
-                    $folder_css,
-                    $class_name,
-                    $zebra_class,
-                    $unread_count ? ' unread' : '',
-                    $folder['id']==$mbox_name ? ' selected' : '',
-                    $COMM_PATH,
-                    urlencode($folder['id']),
-                    $JS_OBJECT_NAME,
-                    $js_name,
-                    $JS_OBJECT_NAME,
-                    $js_name,
-                    $JS_OBJECT_NAME,
-                    $js_name,
-                    $JS_OBJECT_NAME,
-                    $js_name,
-                    $title,
-                    Q($foldername));
-
-    if (!empty($folder['folders']))
-      $out .= "\n<ul>\n" . rcmail_render_folder_tree_html($folder['folders'], $special, $mbox_name, $maxlength, $nestLevel+1) . "</ul>\n";
-
-    $out .= "</li>\n";
-    $idx++;
-    }
-
-  return $out;
-  }
-
-
-// return html for a flat list <select> for the mailbox tree
-function rcmail_render_folder_tree_select(&$arrFolders, &$special, &$mbox_name, $maxlength, $nestLevel=0)
-  {
-  global $IMAP, $OUTPUT;
-
-  $idx = 0;
-  $out = '';
-  foreach ($arrFolders as $key=>$folder)
-    {
-    $folder_lc = strtolower($folder['id']);
-    if (in_array($folder_lc, $special))
-      $foldername = rcube_label($folder_lc);
-    else
-      {
-      $foldername = $folder['name'];
-      
-      // shorten the folder name to a given length
-      if ($maxlength && $maxlength>1)
-        $foldername = abbrevate_string($foldername, $maxlength);
-      }
-
-    $out .= sprintf('<option value="%s">%s%s</option>'."\n",
-                    htmlspecialchars($folder['id']),
-                    str_repeat('&nbsp;', $nestLevel*4),
-                    Q($foldername));
-
-    if (!empty($folder['folders']))
-      $out .= rcmail_render_folder_tree_select($folder['folders'], $special, $mbox_name, $maxlength, $nestLevel+1);
-
-    $idx++;
-    }
-
-  return $out;
-  }
 
 
 // return the message list as HTML table
 function rcmail_message_list($attrib)
   {
-  global $IMAP, $CONFIG, $COMM_PATH, $OUTPUT, $JS_OBJECT_NAME;
+  global $IMAP, $CONFIG, $COMM_PATH, $OUTPUT;
 
   $skin_path = $CONFIG['skin_path'];
   $image_tag = '<img src="%s%s" alt="%s" border="0" />';
@@ -321,9 +111,11 @@
   // define list of cols to be displayed
   $a_show_cols = is_array($CONFIG['list_cols']) ? $CONFIG['list_cols'] : array('subject');
   $a_sort_cols = array('subject', 'date', 'from', 'to', 'size');
+
+  $mbox = $IMAP->get_mailbox_name();
   
   // show 'to' instead of from in sent messages
-  if (($IMAP->get_mailbox_name()==$CONFIG['sent_mbox'] || $IMAP->get_mailbox_name()==$CONFIG['drafts_mbox']) && ($f = array_search('from', $a_show_cols))
+  if (($mbox==$CONFIG['sent_mbox'] || $mbox==$CONFIG['drafts_mbox']) && ($f = array_search('from', $a_show_cols))
       && !array_search('to', $a_show_cols))
     $a_show_cols[$f] = 'to';
   
@@ -358,31 +150,34 @@
         // asc link
         if (!empty($attrib['sortascbutton']))
           {
-          $sort .= rcube_button(array('command' => 'sort',
-                                      'prop' => $col.'_ASC',
-                                      'image' => $attrib['sortascbutton'],
-                                      'align' => 'absmiddle',
-                                      'title' => 'sortasc'));
+          $sort .= $OUTPUT->button(array(
+            'command' => 'sort',
+            'prop' => $col.'_ASC',
+            'image' => $attrib['sortascbutton'],
+            'align' => 'absmiddle',
+            'title' => 'sortasc'));
           }       
         
         // desc link
         if (!empty($attrib['sortdescbutton']))
           {
-          $sort .= rcube_button(array('command' => 'sort',
-                                      'prop' => $col.'_DESC',
-                                      'image' => $attrib['sortdescbutton'],
-                                      'align' => 'absmiddle',
-                                      'title' => 'sortdesc'));        
+          $sort .= $OUTPUT->button(array(
+            'command' => 'sort',
+            'prop' => $col.'_DESC',
+            'image' => $attrib['sortdescbutton'],
+            'align' => 'absmiddle',
+            'title' => 'sortdesc'));
           }
         }
       // just add a link tag to the header
       else
         {
-        $col_name = sprintf('<a href="./#sort" onclick="return %s.command(\'sort\',\'%s\',this)" title="%s">%s</a>',
-                            $JS_OBJECT_NAME,
-                            $col,
-                            rcube_label('sortby'),
-                            $col_name);
+        $col_name = sprintf(
+          '<a href="./#sort" onclick="return %s.command(\'sort\',\'%s\',this)" title="%s">%s</a>',
+          JS_OBJECT_NAME,
+          $col,
+          rcube_label('sortby'),
+          $col_name);
         }
       }
       
@@ -397,11 +192,7 @@
 
   // no messages in this mailbox
   if (!sizeof($a_headers))
-    {
-    $out .= sprintf('<tr><td colspan="%d">%s</td></tr>',
-                    sizeof($a_show_cols)+2,
-                    Q(rcube_label('nomessagesfound')));
-    }
+    $OUTPUT->show_message('nomessagesfound', 'notice');
 
 
   $a_js_message_arr = array();
@@ -430,7 +221,7 @@
     else if ($attrib['messageicon'])
       $message_icon = $attrib['messageicon'];
     
-	// set attachment icon
+    // set attachment icon
     if ($attrib['attachmenticon'] && preg_match("/multipart\/[mr]/i", $header->ctype))
       $attach_icon = $attrib['attachmenticon'];
         
@@ -441,7 +232,7 @@
                     $zebra_class);    
     
     $out .= sprintf("<td class=\"icon\">%s</td>\n", $message_icon ? sprintf($image_tag, $skin_path, $message_icon, '') : '');
-        
+    
     // format each col
     foreach ($a_show_cols as $col)
       {
@@ -449,14 +240,16 @@
         $cont = Q(rcmail_address_string($header->$col, 3, $attrib['addicon']), 'show');
       else if ($col=='subject')
         {
-        $cont = Q($IMAP->decode_header($header->$col));
-        // firefox/mozilla temporary workaround to pad subject with content so that whitespace in rows responds to drag+drop
-        $cont .= '<img src="./program/blank.gif" height="5" width="1000" alt="" />';
+        $action = $mbox==$CONFIG['drafts_mbox'] ? 'compose' : 'show';
+        $uid_param = $mbox==$CONFIG['drafts_mbox'] ? '_draf_uid' : '_uid';
+        $cont = Q(rcube_imap::decode_mime_string($header->$col, $header->charset));
+        if (empty($cont)) $cont = Q(rcube_label('nosubject'));
+        $cont = sprintf('<a href="%s" onclick="return rcube_event.cancel(event)">%s</a>', Q(rcmail_url($action, array($uid_param=>$header->uid, '_mbox'=>$mbox))), $cont);
         }
       else if ($col=='size')
         $cont = show_bytes($header->$col);
       else if ($col=='date')
-        $cont = format_date($header->date); //date('m.d.Y G:i:s', strtotime($header->date));
+        $cont = format_date($header->date);
       else
         $cont = Q($header->$col);
         
@@ -477,69 +270,75 @@
   $message_count = $IMAP->messagecount();
   
   // set client env
-  $javascript .= sprintf("%s.gui_object('mailcontframe', '%s');\n", $JS_OBJECT_NAME, 'mailcontframe');
-  $javascript .= sprintf("%s.gui_object('messagelist', '%s');\n", $JS_OBJECT_NAME, $attrib['id']);
-  $javascript .= sprintf("%s.set_env('messagecount', %d);\n", $JS_OBJECT_NAME, $message_count);
-  $javascript .= sprintf("%s.set_env('current_page', %d);\n", $JS_OBJECT_NAME, $IMAP->list_page);
-  $javascript .= sprintf("%s.set_env('pagecount', %d);\n", $JS_OBJECT_NAME, ceil($message_count/$IMAP->page_size));
-  $javascript .= sprintf("%s.set_env('sort_col', '%s');\n", $JS_OBJECT_NAME, $sort_col);
-  $javascript .= sprintf("%s.set_env('sort_order', '%s');\n", $JS_OBJECT_NAME, $sort_order);
+  $OUTPUT->add_gui_object('mailcontframe', 'mailcontframe');
+  $OUTPUT->add_gui_object('messagelist', $attrib['id']);
+  $OUTPUT->set_env('messagecount', $message_count);
+  $OUTPUT->set_env('current_page', $IMAP->list_page);
+  $OUTPUT->set_env('pagecount', ceil($message_count/$IMAP->page_size));
+  $OUTPUT->set_env('sort_col', $sort_col);
+  $OUTPUT->set_env('sort_order', $sort_order);
   
   if ($attrib['messageicon'])
-    $javascript .= sprintf("%s.set_env('messageicon', '%s%s');\n", $JS_OBJECT_NAME, $skin_path, $attrib['messageicon']);
+    $OUTPUT->set_env('messageicon', $skin_path . $attrib['messageicon']);
   if ($attrib['deletedicon'])
-    $javascript .= sprintf("%s.set_env('deletedicon', '%s%s');\n", $JS_OBJECT_NAME, $skin_path, $attrib['deletedicon']);
+    $OUTPUT->set_env('deletedicon', $skin_path . $attrib['deletedicon']);
   if ($attrib['unreadicon'])
-    $javascript .= sprintf("%s.set_env('unreadicon', '%s%s');\n", $JS_OBJECT_NAME, $skin_path, $attrib['unreadicon']);
+    $OUTPUT->set_env('unreadicon', $skin_path . $attrib['unreadicon']);
   if ($attrib['repliedicon'])
-    $javascript .= sprintf("%s.set_env('repliedicon', '%s%s');\n", $JS_OBJECT_NAME, $skin_path, $attrib['repliedicon']);
+    $OUTPUT->set_env('repliedicon', $skin_path . $attrib['repliedicon']);
   if ($attrib['attachmenticon'])
-    $javascript .= sprintf("%s.set_env('attachmenticon', '%s%s');\n", $JS_OBJECT_NAME, $skin_path, $attrib['attachmenticon']);
-    
-  $javascript .= sprintf("%s.set_env('messages', %s);", $JS_OBJECT_NAME, array2js($a_js_message_arr));
+    $OUTPUT->set_env('attachmenticon', $skin_path . $attrib['attachmenticon']);
   
-  $OUTPUT->add_script($javascript);  
+  $OUTPUT->set_env('messages', $a_js_message_arr);
+  $OUTPUT->set_env('coltypes', $a_show_cols);
+  
   $OUTPUT->include_script('list.js');
   
   return $out;
   }
 
 
-
-
 // return javascript commands to add rows to the message list
 function rcmail_js_message_list($a_headers, $insert_top=FALSE)
   {
-  global $CONFIG, $IMAP;
+  global $CONFIG, $IMAP, $OUTPUT;
 
-  $commands = '';
   $a_show_cols = is_array($CONFIG['list_cols']) ? $CONFIG['list_cols'] : array('subject');
+  $mbox = $IMAP->get_mailbox_name();
 
   // show 'to' instead of from in sent messages
-  if (($IMAP->get_mailbox_name()==$CONFIG['sent_mbox'] || $IMAP->get_mailbox_name()==$CONFIG['drafts_mbox'])
-      && ($f = array_search('from', $a_show_cols)) && !array_search('to', $a_show_cols))
+  if (($mbox == $CONFIG['sent_mbox'] || $mbox == $CONFIG['drafts_mbox'])
+      && (($f = array_search('from', $a_show_cols)) !== false) && array_search('to', $a_show_cols) === false)
     $a_show_cols[$f] = 'to';
 
-  $commands .= sprintf("this.set_message_coltypes(%s);\n", array2js($a_show_cols)); 
+  $OUTPUT->command('set_message_coltypes', $a_show_cols);
 
   // loop through message headers
-  for ($n=0; $a_headers[$n]; $n++)
+  foreach ($a_headers as $n => $header)
     {
-    $header = $a_headers[$n];
     $a_msg_cols = array();
     $a_msg_flags = array();
-      
+    
+    if (empty($header))
+      continue;
+
     // format each col; similar as in rcmail_message_list()
     foreach ($a_show_cols as $col)
       {
       if ($col=='from' || $col=='to')
         $cont = Q(rcmail_address_string($header->$col, 3), 'show');
       else if ($col=='subject')
-        $cont = Q($IMAP->decode_header($header->$col));
+        {
+        $action = $mbox==$CONFIG['drafts_mbox'] ? 'compose' : 'show';
+        $uid_param = $mbox==$CONFIG['drafts_mbox'] ? '_draf_uid' : '_uid';
+        $cont = Q(rcube_imap::decode_mime_string($header->$col, $header->charset));
+        if (!$cont) $cont = Q(rcube_label('nosubject'));
+        $cont = sprintf('<a href="%s" onclick="return rcube_event.cancel(event)">%s</a>', Q(rcmail_url($action, array($uid_param=>$header->uid, '_mbox'=>$mbox))), $cont);
+        }
       else if ($col=='size')
         $cont = show_bytes($header->$col);
       else if ($col=='date')
-        $cont = format_date($header->date); //date('m.d.Y G:i:s', strtotime($header->date));
+        $cont = format_date($header->date);
       else
         $cont = Q($header->$col);
           
@@ -549,22 +348,20 @@
     $a_msg_flags['deleted'] = $header->deleted ? 1 : 0;
     $a_msg_flags['unread'] = $header->seen ? 0 : 1;
     $a_msg_flags['replied'] = $header->answered ? 1 : 0;
-    $commands .= sprintf("this.add_message_row(%s, %s, %s, %b, %b);\n",
-                         $header->uid,
-                         array2js($a_msg_cols),
-                         array2js($a_msg_flags),
-                         preg_match("/multipart\/m/i", $header->ctype),
-                         $insert_top);
+    $OUTPUT->command('add_message_row',
+      $header->uid,
+      $a_msg_cols,
+      $a_msg_flags,
+      preg_match("/multipart\/m/i", $header->ctype),
+      $insert_top);
     }
-
-  return $commands;
   }
 
 
 // return an HTML iframe for loading mail content
 function rcmail_messagecontent_frame($attrib)
   {
-  global $OUTPUT, $JS_OBJECT_NAME;
+  global $OUTPUT;
   
   if (empty($attrib['id']))
     $attrib['id'] = 'rcmailcontentwindow';
@@ -577,52 +374,21 @@
          $framename,
          $attrib_str);
 
-  $OUTPUT->add_script("$JS_OBJECT_NAME.set_env('contentframe', '$framename');");
+  $OUTPUT->set_env('contentframe', $framename);
+  $OUTPUT->set_env('blankpage', $attrib['src'] ? $OUTPUT->abs_url($attrib['src']) : 'program/blank.gif');
 
   return $out;
   }
 
-// return code for search function
-function rcmail_search_form($attrib)
-  {
-  global $OUTPUT, $JS_OBJECT_NAME;
-
-  // add some labels to client
-  rcube_add_label('searching');
-
-  $attrib['name'] = '_q';
-  
-  if (empty($attrib['id']))
-    $attrib['id'] = 'rcmqsearchbox';
-  
-  $input_q = new textfield($attrib);
-  $out = $input_q->show();
-
-  $OUTPUT->add_script(sprintf("%s.gui_object('qsearchbox', '%s');",
-                              $JS_OBJECT_NAME,
-                              $attrib['id']));
-
-  // add form tag around text field
-  if (empty($attrib['form']))
-    $out = sprintf('<form name="rcmqsearchform" action="./" '.
-                   'onsubmit="%s.command(\'search\');return false" style="display:inline;">%s</form>',
-                   $JS_OBJECT_NAME,
-                   $out);
-
-  return $out;
-  } 
-
 
 function rcmail_messagecount_display($attrib)
   {
-  global $IMAP, $OUTPUT, $JS_OBJECT_NAME;
+  global $IMAP, $OUTPUT;
   
   if (!$attrib['id'])
     $attrib['id'] = 'rcmcountdisplay';
 
-  $OUTPUT->add_script(sprintf("%s.gui_object('countdisplay', '%s');",
-                              $JS_OBJECT_NAME,
-                              $attrib['id']));
+  $OUTPUT->add_gui_object('countdisplay', $attrib['id']);
 
   // allow the following attributes to be added to the <span> tag
   $attrib_str = create_attrib_string($attrib, array('style', 'class', 'id'));
@@ -637,12 +403,12 @@
 
 function rcmail_quota_display($attrib)
   {
-  global $OUTPUT, $JS_OBJECT_NAME, $COMM_PATH;
+  global $OUTPUT, $COMM_PATH;
 
   if (!$attrib['id'])
     $attrib['id'] = 'rcmquotadisplay';
 
-  $OUTPUT->add_script(sprintf("%s.gui_object('quotadisplay', '%s');", $JS_OBJECT_NAME, $attrib['id']));
+  $OUTPUT->add_gui_object('quotadisplay', $attrib['id']);
 
   // allow the following attributes to be added to the <span> tag
   $attrib_str = create_attrib_string($attrib, array('style', 'class', 'id'));
@@ -671,8 +437,7 @@
     if ($display == 'image' && function_exists('imagegif'))
       {
       $attrib = array('width' => 100, 'height' => 14);
-      $quota_text = sprintf('<img src="%s&amp;_action=quotaimg&amp;u=%s&amp;q=%d&amp;w=%d&amp;h=%d" width="%d" height="%d" alt="%s" title="%s / %s" />',
-                            $COMM_PATH,
+      $quota_text = sprintf('<img src="./bin/quotaimg.php?u=%s&amp;q=%d&amp;w=%d&amp;h=%d" width="%d" height="%d" alt="%s" title="%s / %s" />',
                             $quota['used'], $quota['total'],
                             $attrib['width'], $attrib['height'],
                             $attrib['width'], $attrib['height'],
@@ -717,12 +482,141 @@
   }
 
 
+/* Stolen from Squirrelmail */
+function sq_deent(&$attvalue, $regex, $hex=false)
+  {
+  $ret_match = false;
+  preg_match_all($regex, $attvalue, $matches);
+  if (is_array($matches) && sizeof($matches[0]) > 0)
+    {
+    $repl = Array();
+    for ($i = 0; $i < sizeof($matches[0]); $i++)
+      {
+      $numval = $matches[1][$i];
+      if ($hex)
+        $numval = hexdec($numval);
+      $repl{$matches[0][$i]} = chr($numval);
+      }
+    $attvalue = strtr($attvalue, $repl);
+    return true;
+    }
+  else
+    return false;
+  }
+
+
+/* Stolen verbatim from Squirrelmail */
+function sq_defang(&$attvalue)
+  {
+  /* Skip this if there aren't ampersands or backslashes. */
+  if ((strpos($attvalue, '&') === false) &&
+      (strpos($attvalue, '\\') === false))
+    return;
+  $m = false;
+  do
+    {
+    $m = false;
+    $m = $m || sq_deent($attvalue, '/\&#0*(\d+);*/s');
+    $m = $m || sq_deent($attvalue, '/\&#x0*((\d|[a-f])+);*/si', true);
+    $m = $m || sq_deent($attvalue, '/\\\\(\d+)/s', true);
+    } while ($m == true);
+  $attvalue = stripslashes($attvalue);
+  }
+
+
+function rcmail_html_filter($html)
+  {
+  preg_match_all('/<\/?\w+((\s+\w+(\s*=\s*(?:".*?"|\'.*?\'|[^\'">\s]+))?)+\s*|\s*)\/?>/', $html, $tags);
+
+  /* From Squirrelmail: Translate all dangerous Unicode or Shift_JIS characters which are accepted by
+   * IE as regular characters. */
+  $replace = array(array('&#x029F;', '&#0671;',  /* L UNICODE IPA Extension */
+                         '&#x0280;', '&#0640;',  /* R UNICODE IPA Extension */
+                         '&#x0274;', '&#0628;',  /* N UNICODE IPA Extension */
+                         '&#xFF25;', '&#65317;', /* Unicode FULLWIDTH LATIN CAPITAL LETTER E */
+                         '&#xFF45;', '&#65349;', /* Unicode FULLWIDTH LATIN SMALL LETTER E */
+                         '&#xFF38;', '&#65336;', /* Unicode FULLWIDTH LATIN CAPITAL LETTER X */
+                         '&#xFF58;', '&#65368;', /* Unicode FULLWIDTH LATIN SMALL LETTER X */
+                         '&#xFF30;', '&#65328;', /* Unicode FULLWIDTH LATIN CAPITAL LETTER P */
+                         '&#xFF50;', '&#65360;', /* Unicode FULLWIDTH LATIN SMALL LETTER P */
+                         '&#xFF32;', '&#65330;', /* Unicode FULLWIDTH LATIN CAPITAL LETTER R */
+                         '&#xFF52;', '&#65362;', /* Unicode FULLWIDTH LATIN SMALL LETTER R */
+                         '&#xFF33;', '&#65331;', /* Unicode FULLWIDTH LATIN CAPITAL LETTER S */
+                         '&#xFF53;', '&#65363;', /* Unicode FULLWIDTH LATIN SMALL LETTER S */
+                         '&#xFF29;', '&#65321;', /* Unicode FULLWIDTH LATIN CAPITAL LETTER I */
+                         '&#xFF49;', '&#65353;', /* Unicode FULLWIDTH LATIN SMALL LETTER I */
+                         '&#xFF2F;', '&#65327;', /* Unicode FULLWIDTH LATIN CAPITAL LETTER O */
+                         '&#xFF4F;', '&#65359;', /* Unicode FULLWIDTH LATIN SMALL LETTER O */
+                         '&#xFF2E;', '&#65326;', /* Unicode FULLWIDTH LATIN CAPITAL LETTER N */
+                         '&#xFF4E;', '&#65358;', /* Unicode FULLWIDTH LATIN SMALL LETTER N */
+                         '&#xFF2C;', '&#65324;', /* Unicode FULLWIDTH LATIN CAPITAL LETTER L */
+                         '&#xFF4C;', '&#65356;', /* Unicode FULLWIDTH LATIN SMALL LETTER L */
+                         '&#xFF35;', '&#65333;', /* Unicode FULLWIDTH LATIN CAPITAL LETTER U */
+                         '&#xFF55;', '&#65365;', /* Unicode FULLWIDTH LATIN SMALL LETTER U */
+                         '&#x207F;', '&#8319;' , /* Unicode SUPERSCRIPT LATIN SMALL LETTER N */
+                         "\xEF\xBC\xA5", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER E */
+                                         /* in unicode this is some Chinese char range */
+                         "\xEF\xBD\x85", /* Shift JIS FULLWIDTH LATIN SMALL LETTER E */
+                         "\xEF\xBC\xB8", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER X */
+                         "\xEF\xBD\x98", /* Shift JIS FULLWIDTH LATIN SMALL LETTER X */
+                         "\xEF\xBC\xB0", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER P */
+                         "\xEF\xBD\x90", /* Shift JIS FULLWIDTH LATIN SMALL LETTER P */
+                         "\xEF\xBC\xB2", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER R */
+                         "\xEF\xBD\x92", /* Shift JIS FULLWIDTH LATIN SMALL LETTER R */
+                         "\xEF\xBC\xB3", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER S */
+                         "\xEF\xBD\x93", /* Shift JIS FULLWIDTH LATIN SMALL LETTER S */
+                         "\xEF\xBC\xA9", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER I */
+                         "\xEF\xBD\x89", /* Shift JIS FULLWIDTH LATIN SMALL LETTER I */
+                         "\xEF\xBC\xAF", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER O */
+                         "\xEF\xBD\x8F", /* Shift JIS FULLWIDTH LATIN SMALL LETTER O */
+                         "\xEF\xBC\xAE", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER N */
+                         "\xEF\xBD\x8E", /* Shift JIS FULLWIDTH LATIN SMALL LETTER N */
+                         "\xEF\xBC\xAC", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER L */
+                         "\xEF\xBD\x8C", /* Shift JIS FULLWIDTH LATIN SMALL LETTER L */
+                         "\xEF\xBC\xB5", /* Shift JIS FULLWIDTH LATIN CAPITAL LETTER U */
+                         "\xEF\xBD\x95", /* Shift JIS FULLWIDTH LATIN SMALL LETTER U */
+                         "\xE2\x81\xBF", /* Shift JIS FULLWIDTH SUPERSCRIPT N */
+                         "\xCA\x9F",   /* L UNICODE IPA Extension */
+                         "\xCA\x80",   /* R UNICODE IPA Extension */
+                         "\xC9\xB4"),  /* N UNICODE IPA Extension */
+                   array('l', 'l', 'r', 'r', 'n', 'n', 'E', 'E', 'e', 'e', 'X', 'X', 'x', 'x',
+                         'P', 'P', 'p', 'p', 'R', 'R', 'r', 'r', 'S', 'S', 's', 's', 'I', 'I',
+                         'i', 'i', 'O', 'O', 'o', 'o', 'N', 'N', 'n', 'n', 'L', 'L', 'l', 'l',
+                         'U', 'U', 'u', 'u', 'n', 'n', 'E', 'e', 'X', 'x', 'P', 'p', 'R', 'r',
+                         'S', 's', 'I', 'i', 'O', 'o', 'N', 'n', 'L', 'l', 'U', 'u', 'n', 'l', 'r', 'n'));
+  if ((count($tags)>3) && (count($tags[3])>0))
+    foreach ($tags[3] as $nr=>$value)
+      {
+      /* Remove comments */
+      $newvalue = preg_replace('/(\/\*.*\*\/)/','$2',$value);
+      /* Translate dangerous characters */
+      $newvalue = str_replace($replace[0], $replace[1], $newvalue);
+      sq_defang($newvalue);
+      /* Rename dangerous CSS */
+      $newvalue = preg_replace('/expression/i', 'idiocy', $newvalue);
+      $newvalue = preg_replace('/url/i', 'idiocy', $newvalue);
+      $newattrs = preg_replace('/'.preg_quote($value, '/').'$/', $newvalue, $tags[1][$nr]);
+      $newtag = preg_replace('/'.preg_quote($tags[1][$nr], '/').'/', $newattrs, $tags[0][$nr]);
+      $html = preg_replace('/'.preg_quote($tags[0][$nr], '/').'/', $newtag, $html);
+      }
+  return $html;
+  }
+
+
 function rcmail_print_body($part, $safe=FALSE, $plain=FALSE)
   {
-  global $IMAP, $REMOTE_OBJECTS, $JS_OBJECT_NAME;
+  global $IMAP, $REMOTE_OBJECTS;
   
   $body = is_array($part->replaces) ? strtr($part->body, $part->replaces) : $part->body;
 
+  // convert html to text/plain
+  if ($part->ctype_secondary=='html' && $plain)
+    {
+    $txt = new html2text($body, false, true);
+    $body = $txt->get_text();
+    $part->ctype_secondary = 'plain';
+    }
+    
   // text/html
   if ($part->ctype_secondary=='html')
     {
@@ -760,7 +654,7 @@
       $body = preg_replace($remote_patterns, $remote_replaces, $body);
       }
 
-    return Q($body, 'show', FALSE);
+    return Q(rcmail_html_filter($body), 'show', FALSE);
     }
 
   // text/enriched
@@ -783,7 +677,7 @@
     $convert_replaces[] = "rcmail_str_replacement('\\1<a href=\"http://\\2\\3\" target=\"_blank\">\\2\\3</a>', \$replace_strings)";
     
     $convert_patterns[] = '/([a-z0-9][a-z0-9\-\.\+\_]*@[a-z0-9]([a-z0-9\-][.]?)*[a-z0-9]\\.[a-z]{2,5})/ie';
-    $convert_replaces[] = "rcmail_str_replacement('<a href=\"mailto:\\1\" onclick=\"return $JS_OBJECT_NAME.command(\'compose\',\'\\1\',this)\">\\1</a>', \$replace_strings)";
+    $convert_replaces[] = "rcmail_str_replacement('<a href=\"mailto:\\1\" onclick=\"return ".JS_OBJECT_NAME.".command(\'compose\',\'\\1\',this)\">\\1</a>', \$replace_strings)";
     
     if ($part->ctype_parameters['format'] != 'flowed')
       $body = wordwrap(trim($body), 80);
@@ -801,10 +695,10 @@
       $quotation = '';
       $q = 0;
       
-      if (preg_match('/^(>+\s*)/', $line, $regs))
+      if (preg_match('/^(>+\s*)+/', $line, $regs))
         {
-        $q = strlen(preg_replace('/\s/', '', $regs[1]));
-        $line = substr($line, strlen($regs[1]));
+        $q    = strlen(preg_replace('/\s/', '', $regs[0]));
+        $line = substr($line, strlen($regs[0]));
 
         if ($q > $quote_level)
           $quotation = str_repeat('<blockquote>', $q - $quote_level);
@@ -866,7 +760,7 @@
     $structure->type = 'content';
     $a_return_parts[] = &$structure;
     }
-
+    
   // message contains alternative parts
   else if ($message_ctype_primary=='multipart' && $message_ctype_secondary=='alternative' && is_array($structure->parts))
     {
@@ -875,6 +769,7 @@
     
     foreach ($structure->parts as $p => $sub_part)
       {
+      $rel_parts = $attachmnts = null;
       $sub_ctype_primary = strtolower($sub_part->ctype_primary);
       $sub_ctype_secondary = strtolower($sub_part->ctype_secondary);
 
@@ -885,19 +780,22 @@
         $html_part = $p;
       else if ($sub_ctype_primary=='text' && $sub_ctype_secondary=='enriched')
         $enriched_part = $p;
-      else if ($sub_ctype_primary=='multipart' && $sub_ctype_secondary=='related')
+      else if ($sub_ctype_primary=='multipart' && ($sub_ctype_secondary=='related' || $sub_ctype_secondary=='mixed'))
         $related_part = $p;
       }
-
+      
     // parse related part (alternative part could be in here)
-    if ($related_part!==NULL && $prefer_html)
-      {
-      list($parts, $attachmnts) = rcmail_parse_message($structure->parts[$related_part], $arg, TRUE);
-      $a_return_parts = array_merge($a_return_parts, $parts);
+    if ($related_part!==NULL)
+    {
+      list($rel_parts, $attachmnts) = rcmail_parse_message($structure->parts[$related_part], $arg, TRUE);
       $a_attachments = array_merge($a_attachments, $attachmnts);
-      }
+    }
+    
+    // merge related parts if any
+    if ($rel_parts && $prefer_html && !$html_part)
+      $a_return_parts = array_merge($a_return_parts, $rel_parts);
 
-    // print html/plain part
+    // choose html/plain part to print
     else if ($html_part!==NULL && $prefer_html)
       $print_part = &$structure->parts[$html_part];
     else if ($enriched_part!==NULL)
@@ -912,7 +810,7 @@
       $a_return_parts[] = $print_part;
       }
     // show plaintext warning
-    else if ($html_part!==NULL)
+    else if ($html_part!==NULL && empty($a_return_parts))
       {
       $c = new stdClass;
       $c->type = 'content';
@@ -954,7 +852,7 @@
 
       // part text/[plain|html] OR message/delivery-status
       else if (($primary_type=='text' && ($secondary_type=='plain' || $secondary_type=='html') && $mail_part->disposition!='attachment') ||
-               ($primary_type=='message' && $secondary_type=='delivery-status'))
+               ($primary_type=='message' && ($secondary_type=='delivery-status' || $secondary_type=='disposition-notification')))
         {
         $mail_part->type = 'content';
         $a_return_parts[] = $mail_part;
@@ -968,10 +866,14 @@
         $a_return_parts = array_merge($a_return_parts, $parts);
         $a_attachments = array_merge($a_attachments, $attachmnts);
         }
+        
+      // ignore "virtual" protocol parts
+      else if ($primary_type=='protocol')
+        continue;
 
       // part is file/attachment
       else if ($mail_part->disposition=='attachment' || $mail_part->disposition=='inline' || $mail_part->headers['content-id'] ||
-               (empty($mail_part->disposition) && ($mail_part->d_parameters['filename'] || $mail_part->ctype_parameters['name'])))
+               (empty($mail_part->disposition) && $mail_part->filename))
         {
         // skip apple resource forks
         if ($message_ctype_secondary=='appledouble' && $secondary_type=='applefile')
@@ -980,16 +882,14 @@
         // part belongs to a related message
         if ($message_ctype_secondary=='related' && $mail_part->headers['content-id'])
           {
-          $mail_part->filename = rcube_imap::decode_mime_string($mail_part->d_parameters['filename']);
           $mail_part->content_id = preg_replace(array('/^</', '/>$/'), '', $mail_part->headers['content-id']);
           $sa_inline_objects[] = $mail_part;
           }
         // is regular attachment
-        else if (($fname = $mail_part->d_parameters['filename']) ||
-                 ($fname = $mail_part->ctype_parameters['name']) ||
-                 ($fname = $mail_part->headers['content-description']))
+        else
           {
-          $mail_part->filename = rcube_imap::decode_mime_string($fname);
+          if (!$mail_part->filename)
+            $mail_part->filename = 'Part '.$mail_part->mime_id;
           $a_attachments[] = $mail_part;
           }
         }
@@ -1014,16 +914,8 @@
     }
 
   // message is single part non-text
-  else
-    {
-    if (($fname = $structure->d_parameters['filename']) ||
-        ($fname = $structure->ctype_parameters['name']) ||
-        ($fname = $structure->headers['content-description']))
-      {
-      $structure->filename = rcube_imap::decode_mime_string($fname);
-      $a_attachments[] = $structure;
-      }
-    }
+  else if ($structure->filename)
+    $a_attachments[] = $structure;
 
   return array($a_return_parts, $a_attachments);
   }
@@ -1050,7 +942,7 @@
   // get associative array of headers object
   if (!$headers)
     $headers = is_object($MESSAGE['headers']) ? get_object_vars($MESSAGE['headers']) : $MESSAGE['headers'];
-    
+  
   $header_count = 0;
   
   // allow the following attributes to be added to the <table> tag
@@ -1070,7 +962,7 @@
     else if (in_array($hkey, array('from', 'to', 'cc', 'bcc', 'reply-to')))
       $header_value = Q(rcmail_address_string($headers[$hkey], NULL, $attrib['addicon']), 'show');
     else
-      $header_value = Q($IMAP->decode_header($headers[$hkey]));
+      $header_value = Q(rcube_imap::decode_mime_string($headers[$hkey], $headers['charset']));
 
     $out .= "\n<tr>\n";
     $out .= '<td class="header-title">'.Q(rcube_label($hkey)).":&nbsp;</td>\n";
@@ -1087,7 +979,7 @@
 
 function rcmail_message_body($attrib)
   {
-  global $CONFIG, $OUTPUT, $MESSAGE, $IMAP, $GET_URL, $REMOTE_OBJECTS, $JS_OBJECT_NAME;
+  global $CONFIG, $OUTPUT, $MESSAGE, $IMAP, $GET_URL, $REMOTE_OBJECTS;
   
   if (!is_array($MESSAGE['parts']) && !$MESSAGE['body'])
     return '';
@@ -1095,7 +987,7 @@
   if (!$attrib['id'])
     $attrib['id'] = 'rcmailMsgBody';
 
-  $safe_mode = (bool)$_GET['_safe'];
+  $safe_mode = $MESSAGE['is_safe'] || intval($_GET['_safe']);
   $attrib_str = create_attrib_string($attrib, array('style', 'class', 'id'));
   $out = '<div '. $attrib_str . ">\n";
   
@@ -1132,11 +1024,11 @@
         if (!isset($part->body))
           $part->body = $IMAP->get_message_part($MESSAGE['UID'], $part->mime_id, $part);
 
-        $body = rcmail_print_body($part, $safe_mode);
+        $body = rcmail_print_body($part, $safe_mode, !$CONFIG['prefer_html']);
         $out .= '<div class="message-part">';
         
         if ($part->ctype_secondary != 'plain')
-          $out .= rcmail_mod_html_body($body, $attrib['id']);
+          $out .= rcmail_sanitize_html($body, $attrib['id']);
         else
           $out .= $body;
 
@@ -1152,8 +1044,8 @@
   $ctype_secondary = strtolower($MESSAGE['structure']->ctype_secondary);
   
   // list images after mail body
-  if (get_boolean($attrib['showimages']) && $ctype_primary=='multipart' && $ctype_secondary=='mixed' &&
-      sizeof($MESSAGE['attachments']) && !strstr($message_body, '<html') && strlen($GET_URL))
+  if (get_boolean($attrib['showimages']) && $ctype_primary=='multipart' &&
+      !empty($MESSAGE['attachments']) && !strstr($message_body, '<html') && strlen($GET_URL))
     {
     foreach ($MESSAGE['attachments'] as $attach_prop)
       {
@@ -1167,7 +1059,7 @@
   
   // tell client that there are blocked remote objects
   if ($REMOTE_OBJECTS && !$safe_mode)
-    $OUTPUT->add_script(sprintf("%s.set_env('blockedobjects', true);", $JS_OBJECT_NAME));
+    $OUTPUT->set_env('blockedobjects', true);
 
   $out .= "\n</div>";
   return $out;
@@ -1176,13 +1068,18 @@
 
 
 // modify a HTML message that it can be displayed inside a HTML page
-function rcmail_mod_html_body($body, $container_id)
+function rcmail_sanitize_html($body, $container_id)
   {
   // remove any null-byte characters before parsing
   $body = preg_replace('/\x00/', '', $body);
   
+  $base_url = "";
   $last_style_pos = 0;
   $body_lc = strtolower($body);
+  
+  // check for <base href>
+  if (preg_match(($base_reg = '/(<base.*href=["\']?)([hftps]{3,5}:\/{2}[^"\'\s]+)([^<]*>)/i'), $body, $base_regs))
+    $base_url = $base_regs[2];
   
   // find STYLE tags
   while (($pos = strpos($body_lc, '<style', $last_style_pos)) && ($pos2 = strpos($body_lc, '</style>', $pos)))
@@ -1190,7 +1087,7 @@
     $pos = strpos($body_lc, '>', $pos)+1;
 
     // replace all css definitions with #container [def]
-    $styles = rcmail_mod_css_styles(substr($body, $pos, $pos2-$pos), $container_id);
+    $styles = rcmail_mod_css_styles(substr($body, $pos, $pos2-$pos), $container_id, $base_url);
 
     $body = substr($body, 0, $pos) . $styles . substr($body, $pos2);
     $body_lc = strtolower($body);
@@ -1201,10 +1098,10 @@
   // remove SCRIPT tags
   foreach (array('script', 'applet', 'object', 'embed', 'iframe') as $tag)
     {
-    while (($pos = strpos($body_lc, '<'.$tag)) && ($pos2 = strpos($body_lc, '</'.$tag.'>', $pos)))
+    while (($pos = strpos($body_lc, '<'.$tag)) && (($pos2 = strpos($body_lc, '</'.$tag.'>', $pos)) || ($pos3 = strpos($body_lc, '>', $pos))))
       {
-      $pos2 += strlen('</'.$tag.'>');
-      $body = substr($body, 0, $pos) . substr($body, $pos2, strlen($body)-$pos2);
+      $end = $pos2 ? $pos2 + strlen('</'.$tag.'>') : $pos3 + 1;
+      $body = substr($body, 0, $pos) . substr($body, $end, strlen($body)-$end);
       $body_lc = strtolower($body);
       }
     }
@@ -1213,80 +1110,68 @@
   while ($body != $prev_body)
     {
     $prev_body = $body;
-    $body = preg_replace('/(<[^!][^>]*\s)(on[^=>]+)=([^>]+>)/im', '$1__removed=$3', $body);
+    $body = preg_replace('/(<[^!][^>]*\s)on(?:load|unload|click|dblclick|mousedown|mouseup|mouseover|mousemove|mouseout|focus|blur|keypress|keydown|keyup|submit|reset|select|change)=([^>]+>)/im', '$1__removed=$2', $body);
     $body = preg_replace('/(<[^!][^>]*\shref=["\']?)(javascript:)([^>]*?>)/im', '$1null:$3', $body);
     }
 
   // resolve <base href>
-  $base_reg = '/(<base.*href=["\']?)([hftps]{3,5}:\/{2}[^"\'\s]+)([^<]*>)/i';
-  if (preg_match($base_reg, $body, $regs))
+  if ($base_url)
     {
-    $base_url = $regs[2];
     $body = preg_replace('/(src|background|href)=(["\']?)([\.\/]+[^"\'\s]+)(\2|\s|>)/Uie', "'\\1=\"'.make_absolute_url('\\3', '$base_url').'\"'", $body);
     $body = preg_replace('/(url\s*\()(["\']?)([\.\/]+[^"\'\)\s]+)(\2)\)/Uie', "'\\1\''.make_absolute_url('\\3', '$base_url').'\')'", $body);
     $body = preg_replace($base_reg, '', $body);
     }
     
   // modify HTML links to open a new window if clicked
-  $body = preg_replace('/<a\s+([^>]+)>/Uie', "rcmail_alter_html_link('\\1');", $body);
+  $body = preg_replace('/<(a|link)\s+([^>]+)>/Uie', "rcmail_alter_html_link('\\1','\\2', '$container_id');", $body);
 
   // add comments arround html and other tags
-  $out = preg_replace(array('/(<\/?html[^>]*>)/i',
-                            '/(<\/?head[^>]*>)/i',
-                            '/(<title[^>]*>.*<\/title>)/Ui',
-                            '/(<\/?meta[^>]*>)/i'),
-                      '<!--\\1-->',
-                      $body);
+  $out = preg_replace(array(
+      '/(<!DOCTYPE.+)/i',
+      '/(<\/?html[^>]*>)/i',
+      '/(<\/?head[^>]*>)/i',
+      '/(<title[^>]*>.*<\/title>)/Ui',
+      '/(<\/?meta[^>]*>)/i'),
+    '<!--\\1-->',
+    $body);
 
-  $out = preg_replace(array('/(<body[^>]*>)/i',
-                            '/(<\/body>)/i'),
-                      array('<div class="rcmBody">',
-                            '</div>'),
-                      $out);
+  $out = preg_replace(
+    array(
+      '/<body([^>]*)>/i',
+      '/<\/body>/i',
+    ),
+    array(
+      '<div class="rcmBody"\\1>',
+      '</div>',
+    ),
+    $out);
+
+  // quote <? of php and xml files that are specified as text/html
+  $out = preg_replace(array('/<\?/', '/\?>/'), array('&lt;?', '?&gt;'), $out);
 
   return $out;
   }
 
 
 // parse link attributes and set correct target
-function rcmail_alter_html_link($in)
+function rcmail_alter_html_link($tag, $attrs, $container_id)
   {
-  $in = preg_replace('/=([^("|\s)]+)(\s|$)/', '="\1"', $in);
-  $attrib = parse_attrib_string($in);
+  $in = preg_replace('/=([^("|\'|\s)]+)(\s|$)/', '="\1"', $in);
+  $attrib = parse_attrib_string($attrs);
+  
+  if ($tag == 'link' && preg_match('/^https?:\/\//i', $attrib['href']))
+    $attrib['href'] = "./bin/modcss.php?u=" . urlencode($attrib['href']) . "&amp;c=" . urlencode($container_id);
 
-  if (stristr((string)$attrib['href'], 'mailto:'))
-    $attrib['onclick'] = sprintf("return %s.command('compose','%s',this)",
-                                 $GLOBALS['JS_OBJECT_NAME'],
-                                 JQ(substr($attrib['href'], 7)));
+  else if (stristr((string)$attrib['href'], 'mailto:'))
+    $attrib['onclick'] = sprintf(
+      "return %s.command('compose','%s',this)",
+      JS_OBJECT_NAME,
+      JQ(substr($attrib['href'], 7)));
+  
   else if (!empty($attrib['href']) && $attrib['href']{0}!='#')
     $attrib['target'] = '_blank';
-  
-  return '<a' . create_attrib_string($attrib, array('href', 'name', 'target', 'onclick', 'id', 'class', 'style', 'title')) . '>';
-  }
 
-
-// replace all css definitions with #container [def]
-function rcmail_mod_css_styles($source, $container_id)
-  {
-  $a_css_values = array();
-  $last_pos = 0;
-  
-  // cut out all contents between { and }
-  while (($pos = strpos($source, '{', $last_pos)) && ($pos2 = strpos($source, '}', $pos)))
-    {
-    $key = sizeof($a_css_values);
-    $a_css_values[$key] = substr($source, $pos+1, $pos2-($pos+1));
-    $source = substr($source, 0, $pos+1) . "<<str_replacement[$key]>>" . substr($source, $pos2, strlen($source)-$pos2);
-    $last_pos = $pos+2;
-    }
-
-  // remove html commends and add #container to each tag selector.
-  // also replace body definition because we also stripped off the <body> tag
-  $styles = preg_replace(array('/(^\s*<!--)|(-->\s*$)/', '/(^\s*|,\s*|\}\s*)([a-z0-9\._][a-z0-9\.\-_]*)/im', '/<<str_replacement\[([0-9]+)\]>>/e', "/$container_id\s+body/i"),
-                         array('', "\\1#$container_id \\2", "\$a_css_values[\\1]", "$container_id div.rcmBody"),
-                         $source);
-
-  return $styles;
+  return "<$tag" . create_attrib_string($attrib, array('href','name','target','onclick','id','class','style','title','rel','type','media')) . ' />';
   }
 
 
@@ -1378,7 +1263,7 @@
 // decode address string and re-format it as HTML links
 function rcmail_address_string($input, $max=NULL, $addicon=NULL)
   {
-  global $IMAP, $PRINT_MODE, $CONFIG, $OUTPUT, $JS_OBJECT_NAME, $EMAIL_ADDRESS_PATTERN;
+  global $IMAP, $PRINT_MODE, $CONFIG, $OUTPUT, $EMAIL_ADDRESS_PATTERN;
   
   $a_parts = $IMAP->decode_address_list($input);
 
@@ -1397,15 +1282,15 @@
     else if (preg_match($EMAIL_ADDRESS_PATTERN, $part['mailto']))
       {
       $out .= sprintf('<a href="mailto:%s" onclick="return %s.command(\'compose\',\'%s\',this)" class="rcmContactAddress" title="%s">%s</a>',
-                      $part['mailto'],
-                      $JS_OBJECT_NAME,
-                      $part['mailto'],
-                      $part['mailto'],
+                      Q($part['mailto']),
+                      JS_OBJECT_NAME,
+                      JQ($part['mailto']),
+                      Q($part['mailto']),
                       Q($part['name']));
                       
       if ($addicon)
         $out .= sprintf('&nbsp;<a href="#add" onclick="return %s.command(\'add-contact\',\'%s\',this)" title="%s"><img src="%s%s" alt="add" border="0" /></a>',
-                        $JS_OBJECT_NAME,
+                        JS_OBJECT_NAME,
                         urlencode($part['string']),
                         rcube_label('addtoaddressbook'),
                         $CONFIG['skin_path'],
@@ -1416,7 +1301,7 @@
       if ($part['name'])
         $out .= Q($part['name']);
       if ($part['mailto'])
-        $out .= (strlen($out) ? ' ' : '') . sprintf('&lt;%s&gt;', $part['mailto']);
+        $out .= (strlen($out) ? ' ' : '') . sprintf('&lt;%s&gt;', Q($part['mailto']));
       }
       
     if ($c>$j)
@@ -1437,30 +1322,27 @@
   {
   global $CONFIG, $IMAP, $MESSAGE;
   
-  if (!is_array($MESSAGE) || !is_array($MESSAGE['parts']) || !($_GET['_uid'] && $_GET['_part']) || !$MESSAGE['parts'][$_GET['_part']])
+  $part = asciiwords(get_input_value('_part', RCUBE_INPUT_GPC));
+  if (!is_array($MESSAGE) || !is_array($MESSAGE['parts']) || !($_GET['_uid'] && $_GET['_part']) || !$MESSAGE['parts'][$part])
     return '';
     
-  $part = &$MESSAGE['parts'][$_GET['_part']];
-  
+  $part = $MESSAGE['parts'][$part];
   $attrib_str = create_attrib_string($attrib, array('id', 'class', 'style', 'cellspacing', 'cellpadding', 'border', 'summary'));
   $out = '<table '. $attrib_str . ">\n";
   
-  $filename = $part->d_parameters['filename'] ? $part->d_parameters['filename'] : $part->ctype_parameters['name'];
-  $filesize = $part->size;
-  
-  if ($filename)
+  if ($part->filename)
     {
     $out .= sprintf('<tr><td class="title">%s</td><td>%s</td><td>[<a href="./?%s">%s</a>]</tr>'."\n",
                     Q(rcube_label('filename')),
-                    Q(rcube_imap::decode_mime_string($filename)),
+                    Q($part->filename),
                     str_replace('_frame=', '_download=', $_SERVER['QUERY_STRING']),
                     Q(rcube_label('download')));
     }
     
-  if ($filesize)
+  if ($part->size)
     $out .= sprintf('<tr><td class="title">%s</td><td>%s</td></tr>'."\n",
                     Q(rcube_label('filesize')),
-                    show_bytes($filesize));
+                    show_bytes($part->size));
   
   $out .= "\n</table>";
   
@@ -1473,10 +1355,10 @@
   {
   global $MESSAGE;
   
-  $part = $MESSAGE['parts'][$_GET['_part']];
+  $part = $MESSAGE['parts'][asciiwords(get_input_value('_part', RCUBE_INPUT_GPC))];
   $ctype_primary = strtolower($part->ctype_primary);
 
-  $attrib['src'] = './?'.str_replace('_frame=', ($ctype_primary=='text' ? '_show=' : '_preload='), $_SERVER['QUERY_STRING']);
+  $attrib['src'] = Q('./?'.str_replace('_frame=', ($ctype_primary=='text' ? '_show=' : '_preload='), $_SERVER['QUERY_STRING']));
 
   $attrib_str = create_attrib_string($attrib, array('id', 'class', 'style', 'src', 'width', 'height'));
   $out = '<iframe '. $attrib_str . "></iframe>";
@@ -1499,5 +1381,154 @@
   unset($_SESSION['compose']);
   }
   
+
+/**
+ * Send the given message compose object using the configured method
+ */
+function rcmail_deliver_message(&$message, $from, $mailto)
+{
+  global $CONFIG;
+
+  $headers = $message->headers();
+  $msg_body = $message->get();
   
-?>
\ No newline at end of file
+  // send thru SMTP server using custom SMTP library
+  if ($CONFIG['smtp_server'])
+    {
+    // generate list of recipients
+    $a_recipients = array($mailto);
+  
+    if (strlen($headers['Cc']))
+      $a_recipients[] = $headers['Cc'];
+    if (strlen($headers['Bcc']))
+      $a_recipients[] = $headers['Bcc'];
+  
+    // clean Bcc from header for recipients
+    $send_headers = $headers;
+    unset($send_headers['Bcc']);
+
+    // send message
+    $smtp_response = array();
+    $sent = smtp_mail($from, $a_recipients, ($foo = $message->txtHeaders($send_headers)), $msg_body, $smtp_response);
+
+    // log error
+    if (!$sent)
+      raise_error(array('code' => 800, 'type' => 'smtp', 'line' => __LINE__, 'file' => __FILE__,
+                        'message' => "SMTP error: ".join("\n", $smtp_response)), TRUE, FALSE);
+    }
+  
+  // send mail using PHP's mail() function
+  else
+    {
+    // unset some headers because they will be added by the mail() function
+    $headers_enc = $message->headers($headers);
+    $headers_php = $message->_headers;
+    unset($headers_php['To'], $headers_php['Subject']);
+    
+    // reset stored headers and overwrite
+    $message->_headers = array();
+    $header_str = $message->txtHeaders($headers_php);
+  
+    if (ini_get('safe_mode'))
+      $sent = mail($headers_enc['To'], $headers_enc['Subject'], $msg_body, $header_str);
+    else
+      $sent = mail($headers_enc['To'], $headers_enc['Subject'], $msg_body, $header_str, "-f$from");
+    }
+  
+  if ($sent)  // remove MDN headers after sending
+    unset($headers['Return-Receipt-To'], $headers['Disposition-Notification-To']);
+  
+  $message->_headers = array();
+  $message->headers($headers);
+  
+  return $sent;
+}
+
+
+function rcmail_send_mdn($uid)
+{
+  global $CONFIG, $USER, $IMAP;
+  
+  $message = array('UID' => $uid);
+  $message['headers'] = $IMAP->get_headers($message['UID']);
+  $message['subject'] = rcube_imap::decode_mime_string($message['headers']->subject, $message['headers']->charset);
+  
+  if ($message['headers']->mdn_to && !$message['headers']->mdn_sent)
+  {
+    $identity = $USER->get_identity();
+    $sender = format_email_recipient($identity['email'], $identity['name']);
+    $recipient = array_shift($IMAP->decode_address_list($message['headers']->mdn_to));
+    $mailto = $recipient['mailto'];
+
+    $compose = new rc_mail_mime(rcmail_header_delm());
+    $compose->setParam(array(
+      'text_encoding' => 'quoted-printable',
+      'html_encoding' => 'quoted-printable',
+      'head_encoding' => 'quoted-printable',
+      'head_charset'  => RCMAIL_CHARSET,
+      'html_charset'  => RCMAIL_CHARSET,
+      'text_charset'  => RCMAIL_CHARSET,
+    ));
+    
+    // compose headers array
+    $headers = array(
+      'Date' => date('r'),
+      'From' => $sender,
+      'To'   => $message['headers']->mdn_to,
+      'Subject' => rcube_label('receiptread') . ': ' . $message['subject'],
+      'Message-ID' => sprintf('<%s@%s>', md5(uniqid('rcmail'.rand(),true)), rcmail_mail_domain($_SESSION['imap_host'])),
+      'X-Sender' => $identity['email'],
+      'Content-Type' => 'multipart/report; report-type=disposition-notification',
+    );
+    
+    if (!empty($CONFIG['useragent']))
+      $headers['User-Agent'] = $CONFIG['useragent'];
+
+    $body = rcube_label("yourmessage") . "\r\n\r\n" .
+      "\t" . rcube_label("to") . ': ' . rcube_imap::decode_mime_string($message['headers']->to, $message['headers']->charset) . "\r\n" .
+      "\t" . rcube_label("subject") . ': ' . $message['subject'] . "\r\n" .
+      "\t" . rcube_label("sent") . ': ' . format_date(strtotime($message['headers']->date), $CONFIG['date_long']) . "\r\n" .
+      "\r\n" . rcube_label("receiptnote") . "\r\n";
+    
+    $ua = !empty($CONFIG['useragent']) ? $CONFIG['useragent'] : "RoundCube Webmail (Version ".RCMAIL_VERSION.")";
+    $report = "Reporting-UA: $ua\r\n";
+    
+    if ($message['headers']->to)
+        $report .= "Original-Recipient: {$message['headers']->to}\r\n";
+    
+    $report .= "Final-Recipient: rfc822; {$identity['email']}\r\n" .
+               "Original-Message-ID: {$message['headers']->messageID}\r\n" .
+               "Disposition: manual-action/MDN-sent-manually; displayed\r\n";
+    
+    $compose->headers($headers, true);
+    $compose->setTXTBody($body);
+    $compose->addAttachment($report, 'message/disposition-notification', 'MDNPart2.txt', false, '7bit', 'inline');
+
+    $sent = rcmail_deliver_message($compose, $identity['email'], $mailto);
+
+    if ($sent)
+    {
+      $IMAP->set_flag($message['UID'], 'MDNSENT');
+      return true;
+    }
+  }
+  
+  return false;
+}
+
+
+// register UI objects
+$OUTPUT->add_handlers(array(
+  'mailboxlist' => 'rcmail_mailbox_list',
+  'messages' => 'rcmail_message_list',
+  'messagecountdisplay' => 'rcmail_messagecount_display',
+  'quotadisplay' => 'rcmail_quota_display',
+  'messageheaders' => 'rcmail_message_headers',
+  'messagebody' => 'rcmail_message_body',
+  'messagecontentframe' => 'rcmail_messagecontent_frame',
+  'messagepartframe' => 'rcmail_message_part_frame',
+  'messagepartcontrols' => 'rcmail_message_part_controls',
+  'searchform' => 'rcmail_search_form'
+));
+
+?>

--
Gitblit v1.9.1