From 2bbc3da52aee81e920e46778d68278bd31f7bb6b Mon Sep 17 00:00:00 2001 From: Aleksander Machniak <alec@alec.pl> Date: Wed, 08 Aug 2012 02:44:46 -0400 Subject: [PATCH] - Check request tokens also in devel_mode --- program/include/rcube_shared.inc | 840 +++++++++++++++++++++++------------------------------------ 1 files changed, 333 insertions(+), 507 deletions(-) diff --git a/program/include/rcube_shared.inc b/program/include/rcube_shared.inc index d82b1fe..85f2784 100644 --- a/program/include/rcube_shared.inc +++ b/program/include/rcube_shared.inc @@ -2,467 +2,99 @@ /* +-----------------------------------------------------------------------+ - | rcube_shared.inc | + | program/include/rcube_shared.inc | | | - | This file is part of the RoundCube PHP suite | - | Copyright (C) 2005-2007, RoundCube Dev. - Switzerland | - | Licensed under the GNU GPL | + | This file is part of the Roundcube PHP suite | + | Copyright (C) 2005-2012, The Roundcube Dev Team | + | | + | Licensed under the GNU General Public License version 3 or | + | any later version with exceptions for skins & plugins. | + | See the README file for a full license statement. | | | | CONTENTS: | - | Shared functions and classes used in PHP projects | + | Shared functions used by Roundcube Framework | | | +-----------------------------------------------------------------------+ | Author: Thomas Bruederli <roundcube@gmail.com> | +-----------------------------------------------------------------------+ - - $Id$ - */ /** - * RoundCube shared functions - * + * Roundcube shared functions + * * @package Core */ /** - * Provide details about the client's browser - * - * @return array Key-value pairs of browser properties - */ -function rcube_browser() -{ - $HTTP_USER_AGENT = $_SERVER['HTTP_USER_AGENT']; - - $bw['ver'] = 0; - $bw['win'] = stristr($HTTP_USER_AGENT, 'win'); - $bw['mac'] = stristr($HTTP_USER_AGENT, 'mac'); - $bw['linux'] = stristr($HTTP_USER_AGENT, 'linux'); - $bw['unix'] = stristr($HTTP_USER_AGENT, 'unix'); - - $bw['ns4'] = stristr($HTTP_USER_AGENT, 'mozilla/4') && !stristr($HTTP_USER_AGENT, 'msie'); - $bw['ns'] = ($bw['ns4'] || stristr($HTTP_USER_AGENT, 'netscape')); - $bw['ie'] = stristr($HTTP_USER_AGENT, 'msie'); - $bw['mz'] = stristr($HTTP_USER_AGENT, 'mozilla/5'); - $bw['opera'] = stristr($HTTP_USER_AGENT, 'opera'); - $bw['safari'] = stristr($HTTP_USER_AGENT, 'safari'); - - if($bw['ns']) - { - $test = eregi("mozilla\/([0-9\.]+)", $HTTP_USER_AGENT, $regs); - $bw['ver'] = $test ? (float)$regs[1] : 0; - } - if($bw['mz']) - { - $test = ereg("rv:([0-9\.]+)", $HTTP_USER_AGENT, $regs); - $bw['ver'] = $test ? (float)$regs[1] : 0; - } - if($bw['ie']) - { - $test = eregi("msie ([0-9\.]+)", $HTTP_USER_AGENT, $regs); - $bw['ver'] = $test ? (float)$regs[1] : 0; - } - if($bw['opera']) - { - $test = eregi("opera ([0-9\.]+)", $HTTP_USER_AGENT, $regs); - $bw['ver'] = $test ? (float)$regs[1] : 0; - } - - if(eregi(" ([a-z]{2})-([a-z]{2})", $HTTP_USER_AGENT, $regs)) - $bw['lang'] = $regs[1]; - else - $bw['lang'] = 'en'; - - $bw['dom'] = ($bw['mz'] || $bw['safari'] || ($bw['ie'] && $bw['ver']>=5) || ($bw['opera'] && $bw['ver']>=7)); - $bw['pngalpha'] = $bw['mz'] || $bw['safari'] || ($bw['ie'] && $bw['ver']>=5.5) || - ($bw['ie'] && $bw['ver']>=5 && $bw['mac']) || ($bw['opera'] && $bw['ver']>=7) ? TRUE : FALSE; - - return $bw; -} - - -/** - * Send HTTP headers to prevent caching this page - */ -function send_nocacheing_headers() -{ - if (headers_sent()) - return; - - header("Expires: ".gmdate("D, d M Y H:i:s")." GMT"); - header("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT"); - header("Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0"); - header("Pragma: no-cache"); -} - - -/** - * Send header with expire date 30 days in future - * - * @param int Expiration time in seconds - */ -function send_future_expire_header($offset=2600000) -{ - if (headers_sent()) - return; - - header("Expires: ".gmdate("D, d M Y H:i:s", mktime()+$offset)." GMT"); - header("Cache-Control: max-age=$offset"); - header("Pragma: "); -} - - -/** - * Check request for If-Modified-Since and send an according response. - * This will terminate the current script if headers match the given values - * - * @param int Modified date as unix timestamp - * @param string Etag value for caching - */ -function send_modified_header($mdate, $etag=null, $skip_check=false) -{ - if (headers_sent()) - return; - - $iscached = false; - $etag = $etag ? "\"$etag\"" : null; - - if (!$skip_check) - { - if ($_SERVER['HTTP_IF_MODIFIED_SINCE'] && strtotime($_SERVER['HTTP_IF_MODIFIED_SINCE']) >= $mdate) - $iscached = true; - - if ($etag) - $iscached = ($_SERVER['HTTP_IF_NONE_MATCH'] == $etag); - } - - if ($iscached) - header("HTTP/1.x 304 Not Modified"); - else - header("Last-Modified: ".gmdate("D, d M Y H:i:s", $mdate)." GMT"); - - header("Cache-Control: max-age=0"); - header("Expires: "); - header("Pragma: "); - - if ($etag) - header("Etag: $etag"); - - if ($iscached) - { - ob_end_clean(); - exit; - } -} - - -/** - * Convert a variable into a javascript object notation - * - * @param mixed Input value - * @return string Serialized JSON string - */ -function json_serialize($var) -{ - if (is_object($var)) - $var = get_object_vars($var); - - if (is_array($var)) - { - // empty array - if (!sizeof($var)) - return '[]'; - else - { - $keys_arr = array_keys($var); - $is_assoc = $have_numeric = 0; - - for ($i=0; $i<sizeof($keys_arr); ++$i) - { - if (is_numeric($keys_arr[$i])) - $have_numeric = 1; - if (!is_numeric($keys_arr[$i]) || $keys_arr[$i] != $i) - $is_assoc = 1; - if ($is_assoc && $have_numeric) - break; - } - - $brackets = $is_assoc ? '{}' : '[]'; - $pairs = array(); - - foreach ($var as $key => $value) - { - // enclose key with quotes if it is not variable-name conform - if (!ereg("^[_a-zA-Z]{1}[_a-zA-Z0-9]*$", $key) /* || is_js_reserved_word($key) */) - $key = "'$key'"; - - $pairs[] = sprintf("%s%s", $is_assoc ? "$key:" : '', json_serialize($value)); - } - - return $brackets{0} . implode(',', $pairs) . $brackets{1}; - } - } - else if (is_numeric($var) && strval(intval($var)) === strval($var)) - return $var; - else if (is_bool($var)) - return $var ? '1' : '0'; - else - return "'".JQ($var)."'"; - -} - -/** - * Function to convert an array to a javascript array - * Actually an alias function for json_serialize() - * @deprecated - */ -function array2js($arr, $type='') -{ - return json_serialize($arr); -} - - -/** * Similar function as in_array() but case-insensitive * - * @param mixed Needle value - * @param array Array to search in + * @param string $needle Needle value + * @param array $heystack Array to search in + * * @return boolean True if found, False if not */ function in_array_nocase($needle, $haystack) { - foreach ($haystack as $value) - if (strtolower($needle)===strtolower($value)) - return true; - - return false; + $needle = mb_strtolower($needle); + foreach ((array)$haystack as $value) { + if ($needle === mb_strtolower($value)) { + return true; + } + } + + return false; } /** - * Find out if the string content means TRUE or FALSE + * Find out if the string content means true or false * - * @param string Input value - * @return boolean Imagine what! + * @param string $str Input value + * + * @return boolean Boolean value */ function get_boolean($str) { - $str = strtolower($str); - if(in_array($str, array('false', '0', 'no', 'nein', ''), TRUE)) - return FALSE; - else - return TRUE; + $str = strtolower($str); + + return !in_array($str, array('false', '0', 'no', 'off', 'nein', ''), true); } /** - * Parse a human readable string for a number of bytes + * Parse a human readable string for a number of bytes. * - * @param string Input string - * @return int Number of bytes + * @param string $str Input string + * + * @return float Number of bytes */ function parse_bytes($str) { - if (is_numeric($str)) - return intval($str); - - if (preg_match('/([0-9]+)([a-z])/i', $str, $regs)) - { - $bytes = floatval($regs[1]); - switch (strtolower($regs[2])) - { - case 'g': - $bytes *= 1073741824; - break; - case 'm': - $bytes *= 1048576; - break; - case 'k': - $bytes *= 1024; - break; + if (is_numeric($str)) { + return floatval($str); } - } - return intval($bytes); -} - -/** - * Create a human readable string for a number of bytes - * - * @param int Number of bytes - * @return string Byte string - */ -function show_bytes($bytes) -{ - if ($bytes > 1073741824) - { - $gb = $bytes/1073741824; - $str = sprintf($gb>=10 ? "%d GB" : "%.1f GB", $gb); - } - else if ($bytes > 1048576) - { - $mb = $bytes/1048576; - $str = sprintf($mb>=10 ? "%d MB" : "%.1f MB", $mb); - } - else if ($bytes > 1024) - $str = sprintf("%d KB", round($bytes/1024)); - else - $str = sprintf('%d B', $bytes); + if (preg_match('/([0-9\.]+)\s*([a-z]*)/i', $str, $regs)) { + $bytes = floatval($regs[1]); + switch (strtolower($regs[2])) { + case 'g': + case 'gb': + $bytes *= 1073741824; + break; + case 'm': + case 'mb': + $bytes *= 1048576; + break; + case 'k': + case 'kb': + $bytes *= 1024; + break; + } + } - return $str; -} - - -/** - * Convert paths like ../xxx to an absolute path using a base url - * - * @param string Relative path - * @param string Base URL - * @return string Absolute URL - */ -function make_absolute_url($path, $base_url) -{ - $host_url = $base_url; - $abs_path = $path; - - // check if path is an absolute URL - if (preg_match('/^[fhtps]+:\/\//', $path)) - return $path; - - // cut base_url to the last directory - if (strpos($base_url, '/')>7) - { - $host_url = substr($base_url, 0, strpos($base_url, '/')); - $base_url = substr($base_url, 0, strrpos($base_url, '/')); - } - - // $path is absolute - if ($path{0}=='/') - $abs_path = $host_url.$path; - else - { - // strip './' because its the same as '' - $path = preg_replace('/^\.\//', '', $path); - - if (preg_match_all('/\.\.\//', $path, $matches, PREG_SET_ORDER)) - foreach ($matches as $a_match) - { - if (strrpos($base_url, '/')) - $base_url = substr($base_url, 0, strrpos($base_url, '/')); - - $path = substr($path, 3); - } - - $abs_path = $base_url.'/'.$path; - } - - return $abs_path; -} - - -/** - * Wrapper function for strlen - */ -function rc_strlen($str) -{ - if (function_exists('mb_strlen')) - return mb_strlen($str); - else - return strlen($str); -} - -/** - * Wrapper function for strtolower - */ -function rc_strtolower($str) -{ - if (function_exists('mb_strtolower')) - return mb_strtolower($str); - else - return strtolower($str); -} - -/** - * Wrapper function for substr - */ -function rc_substr($str, $start, $len=null) -{ - if (function_exists('mb_substr')) - return mb_substr($str, $start, $len); - else - return substr($str, $start, $len); -} - -/** - * Wrapper function for strpos - */ -function rc_strpos($haystack, $needle, $offset=0) -{ - if (function_exists('mb_strpos')) - return mb_strpos($haystack, $needle, $offset); - else - return strpos($haystack, $needle, $offset); -} - -/** - * Wrapper function for strrpos - */ -function rc_strrpos($haystack, $needle, $offset=0) -{ - if (function_exists('mb_strrpos')) - return mb_strrpos($haystack, $needle, $offset); - else - return strrpos($haystack, $needle, $offset); -} - - -/** - * Read a specific HTTP request header - * - * @access static - * @param string $name Header name - * @return mixed Header value or null if not available - */ -function rc_request_header($name) -{ - if (function_exists('getallheaders')) - { - $hdrs = array_change_key_case(getallheaders(), CASE_UPPER); - $key = strtoupper($name); - } - else - { - $key = 'HTTP_' . strtoupper(strtr($name, '-', '_')); - $hdrs = array_change_key_case($_SERVER, CASE_UPPER); - } - - return $hdrs[$key]; - } - - -/** - * Replace the middle part of a string with ... - * if it is longer than the allowed length - * - * @param string Input string - * @param int Max. length - * @param string Replace removed chars with this - * @return string Abbreviated string - */ -function abbreviate_string($str, $maxlength, $place_holder='...') -{ - $length = rc_strlen($str); - $first_part_length = floor($maxlength/2) - rc_strlen($place_holder); - - if ($length > $maxlength) - { - $second_starting_location = $length - $maxlength + $first_part_length + 1; - $str = rc_substr($str, 0, $first_part_length) . $place_holder . rc_substr($str, $second_starting_location, $length); - } - - return $str; + return floatval($bytes); } @@ -482,131 +114,325 @@ { return preg_replace('/\/$/', '', $str); } - + /** * Delete all files within a folder * * @param string Path to directory + * * @return boolean True on success, False if directory was not found */ function clear_directory($dir_path) { - $dir = @opendir($dir_path); - if(!$dir) return FALSE; + $dir = @opendir($dir_path); + if (!$dir) { + return false; + } - while ($file = readdir($dir)) - if (strlen($file)>2) - unlink("$dir_path/$file"); + while ($file = readdir($dir)) { + if (strlen($file) > 2) { + unlink("$dir_path/$file"); + } + } - closedir($dir); - return TRUE; + closedir($dir); + + return true; } /** - * Create a unix timestamp with a specified offset from now + * Returns number of seconds for a specified offset string. * - * @param string String representation of the offset (e.g. 20min, 5h, 2days) - * @param int Factor to multiply with the offset + * @param string $str String representation of the offset (e.g. 20min, 5h, 2days, 1week) + * + * @return int Number of seconds + */ +function get_offset_sec($str) +{ + if (preg_match('/^([0-9]+)\s*([smhdw])/i', $str, $regs)) { + $amount = (int) $regs[1]; + $unit = strtolower($regs[2]); + } + else { + $amount = (int) $str; + $unit = 's'; + } + + switch ($unit) { + case 'w': + $amount *= 7; + case 'd': + $amount *= 24; + case 'h': + $amount *= 60; + case 'm': + $amount *= 60; + } + + return $amount; +} + + +/** + * Create a unix timestamp with a specified offset from now. + * + * @param string $offset_str String representation of the offset (e.g. 20min, 5h, 2days) + * @param int $factor Factor to multiply with the offset + * * @return int Unix timestamp */ function get_offset_time($offset_str, $factor=1) - { - if (preg_match('/^([0-9]+)\s*([smhdw])/i', $offset_str, $regs)) - { - $amount = (int)$regs[1]; - $unit = strtolower($regs[2]); - } - else - { - $amount = (int)$offset_str; - $unit = 's'; - } - - $ts = mktime(); - switch ($unit) - { - case 'w': - $amount *= 7; - case 'd': - $amount *= 24; - case 'h': - $amount *= 60; - case 'm': - $amount *= 60; - case 's': - $ts += $amount * $factor; - } - - return $ts; +{ + return time() + get_offset_sec($offset_str) * $factor; } /** - * A method to guess the mime_type of an attachment. + * Truncate string if it is longer than the allowed length. + * Replace the middle or the ending part of a string with a placeholder. * - * @param string $path Path to the file. - * @param string $failover Mime type supplied for failover. + * @param string $str Input string + * @param int $maxlength Max. length + * @param string $placeholder Replace removed chars with this + * @param bool $ending Set to True if string should be truncated from the end * - * @return string - * @author Till Klampaeckel <till@php.net> - * @see http://de2.php.net/manual/en/ref.fileinfo.php - * @see http://de2.php.net/mime_content_type + * @return string Abbreviated string */ -function rc_mime_content_type($path, $failover = 'unknown/unknown') +function abbreviate_string($str, $maxlength, $placeholder='...', $ending=false) { - $mime_type = null; - $mime_magic = rcmail::get_instance()->config->get('mime_magic'); + $length = mb_strlen($str); - if (!extension_loaded('fileinfo')) { - @dl('fileinfo.' . PHP_SHLIB_SUFFIX); + if ($length > $maxlength) { + if ($ending) { + return mb_substr($str, 0, $maxlength) . $placeholder; + } + + $placeholder_length = mb_strlen($placeholder); + $first_part_length = floor(($maxlength - $placeholder_length)/2); + $second_starting_location = $length - $maxlength + $first_part_length + $placeholder_length; + + $str = mb_substr($str, 0, $first_part_length) . $placeholder . mb_substr($str, $second_starting_location); } - if (function_exists('finfo_open')) { - if ($finfo = finfo_open(FILEINFO_MIME, $mime_magic)) { - $mime_type = finfo_file($finfo, $path); - finfo_close($finfo); + return $str; +} + + +/** + * Get all keys from array (recursive). + * + * @param array $array Input array + * + * @return array List of array keys + */ +function array_keys_recursive($array) +{ + $keys = array(); + + if (!empty($array)) { + foreach ($array as $key => $child) { + $keys[] = $key; + foreach (array_keys_recursive($child) as $val) { + $keys[] = $val; + } } } - if (!$mime_type && function_exists('mime_content_type')) { - $mime_type = mime_content_type($path); - } - - if (!$mime_type) { - $mime_type = $failover; - } - return $mime_type; + return $keys; } /** - * A method to guess encoding of a string. - * - * @param string $string String. - * @param string $failover Default result for failover. - * - * @return string + * Remove all non-ascii and non-word chars except ., -, _ */ -function rc_detect_encoding($string, $failover='') +function asciiwords($str, $css_id = false, $replace_with = '') { - if (!function_exists('mb_detect_encoding')) { - return $failover; - } - - // FIXME: the order is important, because sometimes - // iso string is detected as euc-jp and etc. - $enc = array( - 'UTF-8', 'ISO-8859-1', 'ISO-8859-2', 'ISO-8859-3', 'ISO-8859-4', - 'ISO-8859-5', 'ISO-8859-6', 'ISO-8859-7', 'ISO-8859-8', 'ISO-8859-9', - 'ISO-8859-10', 'ISO-8859-13', 'ISO-8859-14', 'ISO-8859-15', 'ISO-8859-16', - 'WINDOWS-1252', 'WINDOWS-1251', 'EUC-JP', 'EUC-TW', 'KOI8-R' - ); - - $result = mb_detect_encoding($string, join(',', $enc)); - - return $result ? $result : $failover; + $allowed = 'a-z0-9\_\-' . (!$css_id ? '\.' : ''); + return preg_replace("/[^$allowed]/i", $replace_with, $str); } -?> + +/** + * Remove single and double quotes from given string + * + * @param string Input value + * + * @return string Dequoted string + */ +function strip_quotes($str) +{ + return str_replace(array("'", '"'), '', $str); +} + + +/** + * Remove new lines characters from given string + * + * @param string $str Input value + * + * @return string Stripped string + */ +function strip_newlines($str) +{ + return preg_replace('/[\r\n]/', '', $str); +} + + +/** + * Compose a valid representation of name and e-mail address + * + * @param string $email E-mail address + * @param string $name Person name + * + * @return string Formatted string + */ +function format_email_recipient($email, $name = '') +{ + $email = trim($email); + + if ($name && $name != $email) { + // Special chars as defined by RFC 822 need to in quoted string (or escaped). + if (preg_match('/[\(\)\<\>\\\.\[\]@,;:"]/', $name)) { + $name = '"'.addcslashes($name, '"').'"'; + } + + return "$name <$email>"; + } + + return $email; +} + + +/** + * mbstring replacement functions + */ +if (!extension_loaded('mbstring')) +{ + function mb_strlen($str) + { + return strlen($str); + } + + function mb_strtolower($str) + { + return strtolower($str); + } + + function mb_strtoupper($str) + { + return strtoupper($str); + } + + function mb_substr($str, $start, $len=null) + { + return substr($str, $start, $len); + } + + function mb_strpos($haystack, $needle, $offset=0) + { + return strpos($haystack, $needle, $offset); + } + + function mb_strrpos($haystack, $needle, $offset=0) + { + return strrpos($haystack, $needle, $offset); + } +} + +/** + * intl replacement functions + */ + +if (!function_exists('idn_to_utf8')) +{ + function idn_to_utf8($domain, $flags=null) + { + static $idn, $loaded; + + if (!$loaded) { + $idn = new Net_IDNA2(); + $loaded = true; + } + + if ($idn && $domain && preg_match('/(^|\.)xn--/i', $domain)) { + try { + $domain = $idn->decode($domain); + } + catch (Exception $e) { + } + } + return $domain; + } +} + +if (!function_exists('idn_to_ascii')) +{ + function idn_to_ascii($domain, $flags=null) + { + static $idn, $loaded; + + if (!$loaded) { + $idn = new Net_IDNA2(); + $loaded = true; + } + + if ($idn && $domain && preg_match('/[^\x20-\x7E]/', $domain)) { + try { + $domain = $idn->encode($domain); + } + catch (Exception $e) { + } + } + return $domain; + } +} + +/** + * Use PHP5 autoload for dynamic class loading + * + * @todo Make Zend, PEAR etc play with this + * @todo Make our classes conform to a more straight forward CS. + */ +function rcube_autoload($classname) +{ + $filename = preg_replace( + array( + '/MDB2_(.+)/', + '/Mail_(.+)/', + '/Net_(.+)/', + '/Auth_(.+)/', + '/^html_.+/', + '/^utf8$/', + ), + array( + 'Mail/\\1', + 'Mail/\\1', + 'Net/\\1', + 'Auth/\\1', + 'html', + 'utf8.class', + ), + $classname + ); + + if ($fp = @fopen("$filename.php", 'r', true)) { + fclose($fp); + include_once "$filename.php"; + return true; + } + + return false; +} + +/** + * Local callback function for PEAR errors + */ +function rcube_pear_error($err) +{ + error_log(sprintf("%s (%s): %s", + $err->getMessage(), + $err->getCode(), + $err->getUserinfo()), 0); +} -- Gitblit v1.9.1