From 533e8602c0be3aed7becc74002c58a7d1cf400c3 Mon Sep 17 00:00:00 2001 From: thomascube <thomas@roundcube.net> Date: Tue, 09 Jun 2009 04:08:00 -0400 Subject: [PATCH] Add cache-buster to scripts and linked files in skin templates --- program/include/main.inc | 499 +++++++++++++++++++++++++++++++++++++++---------------- 1 files changed, 354 insertions(+), 145 deletions(-) diff --git a/program/include/main.inc b/program/include/main.inc index 75ad2b3..dbed2ba 100644 --- a/program/include/main.inc +++ b/program/include/main.inc @@ -5,7 +5,7 @@ | program/include/main.inc | | | | This file is part of the RoundCube Webmail client | - | Copyright (C) 2005-2008, RoundCube Dev, - Switzerland | + | Copyright (C) 2005-2009, RoundCube Dev, - Switzerland | | Licensed under the GNU GPL | | | | PURPOSE: | @@ -88,9 +88,9 @@ * @return string Localized text * @see rcmail::gettext() */ -function rcube_label($p) +function rcube_label($p, $domain=null) { - return rcmail::get_instance()->gettext($p); + return rcmail::get_instance()->gettext($p, $domain); } @@ -128,7 +128,9 @@ */ function rcmail_temp_gc() { - $tmp = unslashify($CONFIG['temp_dir']); + $rcmail = rcmail::get_instance(); + + $tmp = unslashify($rcmail->config->get('temp_dir')); $expire = mktime() - 172800; // expire in 48 hours if ($dir = opendir($tmp)) @@ -151,19 +153,19 @@ * Garbage collector for cache entries. * Remove all expired message cache records */ -function rcmail_message_cache_gc() +function rcmail_cache_gc() { - global $DB, $CONFIG; - - // no cache lifetime configured - if (empty($CONFIG['message_cache_lifetime'])) - return; + $rcmail = rcmail::get_instance(); + $db = $rcmail->get_dbh(); // get target timestamp - $ts = get_offset_time($CONFIG['message_cache_lifetime'], -1); + $ts = get_offset_time($rcmail->config->get('message_cache_lifetime', '30d'), -1); - $DB->query("DELETE FROM ".get_table_name('messages')." - WHERE created < ".$DB->fromunixtime($ts)); + $db->query("DELETE FROM ".get_table_name('messages')." + WHERE created < " . $db->fromunixtime($ts)); + + $db->query("DELETE FROM ".get_table_name('cache')." + WHERE created < " . $db->fromunixtime($ts)); } @@ -178,96 +180,256 @@ */ function rcube_charset_convert($str, $from, $to=NULL) { - static $mbstring_loaded = null, $convert_warning = false; + static $mbstring_loaded = null; + static $mbstring_list = null; + static $convert_warning = false; - $from = strtoupper($from); - $to = $to==NULL ? strtoupper(RCMAIL_CHARSET) : strtoupper($to); - $error = false; $conv = null; + $error = false; + $conv = null; - if ($from==$to || $str=='' || empty($from)) + $to = empty($to) ? $to = strtoupper(RCMAIL_CHARSET) : rcube_parse_charset($to); + $from = rcube_parse_charset($from); + + if ($from == $to || empty($str) || empty($from)) return $str; - - $aliases = array( - 'US-ASCII' => 'ISO-8859-1', - 'UNKNOWN-8BIT' => 'ISO-8859-15', - 'X-UNKNOWN' => 'ISO-8859-15', - 'X-USER-DEFINED' => 'ISO-8859-15', - 'ISO-8859-8-I' => 'ISO-8859-8', - 'KS_C_5601-1987' => 'EUC-KR', - ); // convert charset using iconv module - if (function_exists('iconv') && $from != 'UTF-7' && $to != 'UTF-7') - { - $aliases['GB2312'] = 'GB18030'; - $_iconv = iconv(($aliases[$from] ? $aliases[$from] : $from), ($aliases[$to] ? $aliases[$to] : $to) . "//IGNORE", $str); - if ($_iconv !== false) - { + if (function_exists('iconv') && $from != 'UTF-7' && $to != 'UTF-7') { + $_iconv = iconv($from, $to . '//IGNORE', $str); + if ($_iconv !== false) { return $_iconv; - } } - + } if (is_null($mbstring_loaded)) $mbstring_loaded = extension_loaded('mbstring'); // convert charset using mbstring module - if ($mbstring_loaded) - { - $aliases['UTF-7'] = 'UTF7-IMAP'; + if ($mbstring_loaded) { $aliases['WINDOWS-1257'] = 'ISO-8859-13'; - // return if convert succeeded - if (($out = mb_convert_encoding($str, ($aliases[$to] ? $aliases[$to] : $to), ($aliases[$from] ? $aliases[$from] : $from))) != '') - return $out; + if (is_null($mbstring_list)) { + $mbstring_list = mb_list_encodings(); + $mbstring_list = array_map('strtoupper', $mbstring_list); } + + $mb_from = $aliases[$from] ? $aliases[$from] : $from; + $mb_to = $aliases[$to] ? $aliases[$to] : $to; - + // return if encoding found, string matches encoding and convert succeeded + if (in_array($mb_from, $mbstring_list) && in_array($mb_to, $mbstring_list)) { + if (mb_check_encoding($str, $mb_from) && ($out = mb_convert_encoding($str, $mb_to, $mb_from))) + return $out; + } + } + + # try to convert with custom classes if (class_exists('utf8')) $conv = new utf8(); // convert string to UTF-8 - if ($from == 'UTF-7') - $str = utf7_to_utf8($str); - else if (($from == 'ISO-8859-1') && function_exists('utf8_encode')) - $str = utf8_encode($str); - else if ($from != 'UTF-8' && $conv) - { - $conv->loadCharset($from); - $str = $conv->strToUtf8($str); + if ($to == 'UTF-8') { + if ($from == 'UTF7-IMAP') { + if ($_str = utf7_to_utf8($str)) + $str = $_str; + else + $error = true; } - else if ($from != 'UTF-8') - $error = true; - + else if ($from == 'UTF-7') { + if ($_str = rcube_utf7_to_utf8($str)) + $str = $_str; + else + $error = true; + } + else if (($from == 'ISO-8859-1') && function_exists('utf8_encode')) { + $str = utf8_encode($str); + } + else if ($from != 'UTF-8' && $conv) { + $from = preg_replace(array('/^WINDOWS-*125([0-8])$/', '/^CP-/'), array('CP125\\1', 'CP'), $from); + $conv->loadCharset($from); + $str = $conv->strToUtf8($str); + } + else if ($from != 'UTF-8') + $error = true; + } + // encode string for output - if ($to == 'UTF-7') - return utf8_to_utf7($str); - else if ($to == 'ISO-8859-1' && function_exists('utf8_decode')) - return utf8_decode($str); - else if ($to != 'UTF-8' && $conv) - { - $conv->loadCharset($to); - return $conv->utf8ToStr($str); + if ($from == 'UTF-8') { + // @TODO: we need a function for UTF-7 (RFC2152) conversion + if ($to == 'UTF7-IMAP' || $to == 'UTF-7') { + if ($_str = utf8_to_utf7($str)) + $str = $_str; + else + $error = true; } - else if ($to != 'UTF-8') - $error = true; - + else if ($to == 'ISO-8859-1' && function_exists('utf8_decode')) { + return utf8_decode($str); + } + else if ($to != 'UTF-8' && $conv) { + $to = preg_replace(array('/^WINDOWS-*125([0-8])$/', '/^CP-/'), array('CP125\\1', 'CP'), $to); + $conv->loadCharset($to); + return $conv->utf8ToStr($str); + } + else if ($to != 'UTF-8') { + $error = true; + } + } + // report error - if ($error && !$convert_warning) - { + if ($error && !$convert_warning){ raise_error(array( 'code' => 500, 'type' => 'php', 'file' => __FILE__, - 'message' => "Could not convert string charset. Make sure iconv is installed or lib/utf8.class is available" + 'message' => "Could not convert string from $from to $to. Make sure iconv/mbstring is installed or lib/utf8.class is available." ), true, false); $convert_warning = true; - } + } // return UTF-8 string return $str; } + + +/** + * Parse and validate charset name string (see #1485758). + * Sometimes charset string is malformed, there are also charset aliases + * but we need strict names for charset conversion (specially utf8 class) + * + * @param string Input charset name + * @return The validated charset name + */ +function rcube_parse_charset($charset) + { + $charset = strtoupper($charset); + + # RFC1642 + $charset = str_replace('UNICODE-1-1-', '', $charset); + + # Aliases: some of them from HTML5 spec. + $aliases = array( + 'USASCII' => 'WINDOWS-1252', + 'ANSIX31101983' => 'WINDOWS-1252', + 'ANSIX341968' => 'WINDOWS-1252', + 'UNKNOWN8BIT' => 'ISO-8859-15', + 'XUNKNOWN' => 'ISO-8859-15', + 'XUSERDEFINED' => 'ISO-8859-15', + 'KSC56011987' => 'EUC-KR', + 'GB2312' => 'GBK', + 'GB231280' => 'GBK', + 'UNICODE' => 'UTF-8', + 'UTF7IMAP' => 'UTF7-IMAP', + 'XXBIG5' => 'BIG5', + 'TIS620' => 'WINDOWS-874', + 'ISO88599' => 'WINDOWS-1254', + 'ISO885911' => 'WINDOWS-874', + ); + + $str = preg_replace('/[^a-z0-9]/i', '', $charset); + + if (isset($aliases[$str])) + return $aliases[$str]; + + if (preg_match('/UTF(7|8|16|32)(BE|LE)*/', $str, $m)) + return 'UTF-' . $m[1] . $m[2]; + + if (preg_match('/ISO8859([0-9]{0,2})/', $str, $m)) { + $iso = 'ISO-8859-' . ($m[1] ? $m[1] : 1); + # some clients sends windows-1252 text as latin1, + # it is safe to use windows-1252 for all latin1 + return $iso == 'ISO-8859-1' ? 'WINDOWS-1252' : $iso; + } + + return $charset; + } + + +/** + * Converts string from standard UTF-7 (RFC 2152) to UTF-8. + * + * @param string Input string + * @return The converted string + */ +function rcube_utf7_to_utf8($str) +{ + $Index_64 = array( + 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, + 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, + 0,0,0,0, 0,0,0,0, 0,0,0,1, 0,0,0,0, + 1,1,1,1, 1,1,1,1, 1,1,0,0, 0,0,0,0, + 0,1,1,1, 1,1,1,1, 1,1,1,1, 1,1,1,1, + 1,1,1,1, 1,1,1,1, 1,1,1,0, 0,0,0,0, + 0,1,1,1, 1,1,1,1, 1,1,1,1, 1,1,1,1, + 1,1,1,1, 1,1,1,1, 1,1,1,0, 0,0,0,0, + ); + + $u7len = strlen($str); + $str = strval($str); + $res = ''; + + for ($i=0; $u7len > 0; $i++, $u7len--) + { + $u7 = $str[$i]; + if ($u7 == '+') + { + $i++; + $u7len--; + $ch = ''; + + for (; $u7len > 0; $i++, $u7len--) + { + $u7 = $str[$i]; + + if (!$Index_64[ord($u7)]) + break; + + $ch .= $u7; + } + + if ($ch == '') { + if ($u7 == '-') + $res .= '+'; + continue; + } + + $res .= rcube_utf16_to_utf8(base64_decode($ch)); + } + else + { + $res .= $u7; + } + } + + return $res; +} + +/** + * Converts string from UTF-16 to UTF-8 (helper for utf-7 to utf-8 conversion) + * + * @param string Input string + * @return The converted string + */ +function rcube_utf16_to_utf8($str) +{ + $len = strlen($str); + $dec = ''; + + for ($i = 0; $i < $len; $i += 2) { + $c = ord($str[$i]) << 8 | ord($str[$i + 1]); + if ($c >= 0x0001 && $c <= 0x007F) { + $dec .= chr($c); + } else if ($c > 0x07FF) { + $dec .= chr(0xE0 | (($c >> 12) & 0x0F)); + $dec .= chr(0x80 | (($c >> 6) & 0x3F)); + $dec .= chr(0x80 | (($c >> 0) & 0x3F)); + } else { + $dec .= chr(0xC0 | (($c >> 6) & 0x1F)); + $dec .= chr(0x80 | (($c >> 0) & 0x3F)); + } + } + return $dec; +} /** @@ -281,22 +443,12 @@ */ function rep_specialchars_output($str, $enctype='', $mode='', $newlines=TRUE) { - global $OUTPUT; static $html_encode_arr = false; static $js_rep_table = false; static $xml_rep_table = false; - $charset = $OUTPUT->get_charset(); - $is_iso_8859_1 = false; - if ($charset == 'ISO-8859-1') { - $is_iso_8859_1 = true; - } if (!$enctype) $enctype = $OUTPUT->type; - - // encode for plaintext - if ($enctype=='text') - return str_replace("\r\n", "\n", $mode=='remove' ? strip_tags($str) : $str); // encode for HTML output if ($enctype=='html') @@ -327,9 +479,6 @@ return $newlines ? nl2br($out) : $out; } - if ($enctype=='url') - return rawurlencode($str); - // if the replace tables for XML and JS are not yet defined if ($js_rep_table===false) { @@ -337,28 +486,28 @@ $xml_rep_table['&'] = '&'; for ($c=160; $c<256; $c++) // can be increased to support more charsets - { $xml_rep_table[Chr($c)] = "&#$c;"; - - if ($is_iso_8859_1) - $js_rep_table[Chr($c)] = sprintf("\\u%04x", $c); - } $xml_rep_table['"'] = '"'; + $js_rep_table['"'] = '\\"'; + $js_rep_table["'"] = "\\'"; + $js_rep_table["\\"] = "\\\\"; } + + // encode for javascript use + if ($enctype=='js') + return preg_replace(array("/\r?\n/", "/\r/", '/<\\//'), array('\n', '\n', '<\\/'), strtr($str, $js_rep_table)); + + // encode for plaintext + if ($enctype=='text') + return str_replace("\r\n", "\n", $mode=='remove' ? strip_tags($str) : $str); + + if ($enctype=='url') + return rawurlencode($str); // encode for XML if ($enctype=='xml') return strtr($str, $xml_rep_table); - - // encode for javascript use - if ($enctype=='js') - { - if ($charset!='UTF-8') - $str = rcube_charset_convert($str, RCMAIL_CHARSET,$charset); - - return preg_replace(array("/\r?\n/", "/\r/", '/<\\//'), array('\n', '\n', '<\\/'), addslashes(strtr($str, $js_rep_table))); - } // no encoding given -> return original string return $str; @@ -417,9 +566,15 @@ else if (isset($_COOKIE[$fname])) $value = $_COOKIE[$fname]; } - + + if (empty($value)) + return $value; + + // strip single quotes if magic_quotes_sybase is enabled + if (ini_get('magic_quotes_sybase')) + $value = str_replace("''", "'", $value); // strip slashes if magic_quotes enabled - if ((bool)get_magic_quotes_gpc()) + else if (get_magic_quotes_gpc() || get_magic_quotes_runtime()) $value = stripslashes($value); // remove HTML tags if not allowed @@ -567,43 +722,41 @@ * @param string Container ID to use as prefix * @return string Modified CSS source */ -function rcmail_mod_css_styles($source, $container_id, $base_url = '') +function rcmail_mod_css_styles($source, $container_id) { - $a_css_values = array(); $last_pos = 0; + $replacements = new rcube_string_replacer; // ignore the whole block if evil styles are detected - $stripped = preg_replace('/[^a-z\(:]/', '', rcmail_xss_entitiy_decode($source)); + $stripped = preg_replace('/[^a-z\(:]/', '', rcmail_xss_entity_decode($source)); if (preg_match('/expression|behavior|url\(|import/', $stripped)) - return ''; + return '/* evil! */'; // cut out all contents between { and } while (($pos = strpos($source, '{', $last_pos)) && ($pos2 = strpos($source, '}', $pos))) { - $key = sizeof($a_css_values); - $a_css_values[$key] = substr($source, $pos+1, $pos2-($pos+1)); - $source = substr($source, 0, $pos+1) . "<<str_replacement[$key]>>" . substr($source, $pos2, strlen($source)-$pos2); + $key = $replacements->add(substr($source, $pos+1, $pos2-($pos+1))); + $source = substr($source, 0, $pos+1) . $replacements->get_replacement($key) . substr($source, $pos2, strlen($source)-$pos2); $last_pos = $pos+2; } - + // remove html comments and add #container to each tag selector. // also replace body definition because we also stripped off the <body> tag $styles = preg_replace( array( '/(^\s*<!--)|(-->\s*$)/', '/(^\s*|,\s*|\}\s*)([a-z0-9\._#][a-z0-9\.\-_]*)/im', - '/@import\s+(url\()?[\'"]?([^\)\'"]+)[\'"]?(\))?/ime', - '/<<str_replacement\[([0-9]+)\]>>/e', - "/$container_id\s+body/i" + "/$container_id\s+body/i", ), array( '', "\\1#$container_id \\2", - "sprintf(\"@import url('./bin/modcss.php?u=%s&c=%s')\", urlencode(make_absolute_url('\\2','$base_url')), urlencode($container_id))", - "\$a_css_values[\\1]", - "$container_id div.rcmBody" + "$container_id div.rcmBody", ), $source); + + // put block contents back in + $styles = $replacements->resolve($styles); return $styles; } @@ -616,14 +769,25 @@ * @param string CSS content to decode * @return string Decoded string */ -function rcmail_xss_entitiy_decode($content) +function rcmail_xss_entity_decode($content) { $out = html_entity_decode(html_entity_decode($content)); - $out = preg_replace('/\\\([0-9a-f]{4})/ie', "chr(hexdec('\\1'))", $out); + $out = preg_replace_callback('/\\\([0-9a-f]{4})/i', 'rcmail_xss_entity_decode_callback', $out); $out = preg_replace('#/\*.*\*/#Um', '', $out); return $out; } + +/** + * preg_replace_callback callback for rcmail_xss_entity_decode_callback + * + * @param array matches result from preg_replace_callback + * @return string decoded entity + */ +function rcmail_xss_entity_decode_callback($matches) +{ + return chr(hexdec($matches[1])); +} /** * Compose a valid attribute string for HTML tags @@ -653,14 +817,14 @@ function parse_attrib_string($str) { $attrib = array(); - preg_match_all('/\s*([-_a-z]+)=(["\'])??(?(2)([^\2]+)\2|(\S+?))/Ui', stripslashes($str), $regs, PREG_SET_ORDER); + preg_match_all('/\s*([-_a-z]+)=(["\'])??(?(2)([^\2]*)\2|(\S+?))/Ui', stripslashes($str), $regs, PREG_SET_ORDER); // convert attributes to an associative array (name => value) - if ($regs) - foreach ($regs as $attr) - { - $attrib[strtolower($attr[1])] = $attr[3] . $attr[4]; - } + if ($regs) { + foreach ($regs as $attr) { + $attrib[strtolower($attr[1])] = html_entity_decode($attr[3] . $attr[4]); + } + } return $attrib; } @@ -684,10 +848,12 @@ $ts = $date; else if (!empty($date)) { - while (($ts = @strtotime($date))===false) + // support non-standard "GMTXXXX" literal + $date = preg_replace('/GMT\s*([+-][0-9]+)/', '\\1', $date); + // if date parsing fails, we have a date in non-rfc format. + // remove token from the end and try again + while ((($ts = @strtotime($date))===false) || ($ts < 0)) { - // if we have a date in non-rfc format - // remove token from the end and try again $d = explode(' ', $date); array_pop($d); if (!$d) break; @@ -791,8 +957,13 @@ */ function console() { + $args = func_get_args(); + + if (class_exists('rcmail', false)) + rcmail::get_instance()->plugins->exec_hook('console', $args); + $msg = array(); - foreach (func_get_args() as $arg) + foreach ($args as $arg) $msg[] = !is_string($arg) ? var_export($arg, true) : $arg; if (!($GLOBALS['CONFIG']['debug_level'] & 4)) @@ -821,11 +992,12 @@ if (!is_string($line)) $line = var_export($line, true); - - $log_entry = sprintf("[%s]: %s\n", - date("d-M-Y H:i:s O", mktime()), - $line); - + + if (empty($CONFIG['log_date_format'])) + $CONFIG['log_date_format'] = 'd-M-Y H:i:s O'; + + $log_entry = sprintf("[%s]: %s\n", date($CONFIG['log_date_format']), $line); + if ($CONFIG['log_driver'] == 'syslog') { if ($name == 'errors') $prio = LOG_ERR; @@ -836,10 +1008,11 @@ // log_driver == 'file' is assumed here if (empty($CONFIG['log_dir'])) $CONFIG['log_dir'] = INSTALL_PATH.'logs'; - + // try to open specific log file for writing if ($fp = @fopen($CONFIG['log_dir'].'/'.$name, 'a')) { fwrite($fp, $log_entry); + fflush($fp); fclose($fp); } } @@ -850,17 +1023,16 @@ * @access private */ function rcube_timer() - { - list($usec, $sec) = explode(" ", microtime()); - return ((float)$usec + (float)$sec); - } +{ + return microtime(true); +} /** * @access private */ function rcube_print_time($timer, $label='Timer') - { +{ static $print_count = 0; $print_count++; @@ -871,7 +1043,7 @@ $label = 'Timer '.$print_count; console(sprintf("%s: %0.4f sec", $label, $diff)); - } +} /** @@ -983,7 +1155,7 @@ if (!isset($arrFolders[$currentFolder])) { $arrFolders[$currentFolder] = array( 'id' => $path, - 'name' => rcube_charset_convert($currentFolder, 'UTF-7'), + 'name' => rcube_charset_convert($currentFolder, 'UTF7-IMAP'), 'virtual' => $virtual, 'folders' => array()); } @@ -1134,17 +1306,15 @@ { global $CONFIG; - $cname = null; - $folder_lc = strtolower($folder_id); - // for these mailboxes we have localized labels and css classes - foreach (array('inbox', 'sent', 'drafts', 'trash', 'junk') as $smbx) + foreach (array('sent', 'drafts', 'trash', 'junk') as $smbx) { - if ($folder_lc == $smbx || $folder_id == $CONFIG[$smbx.'_mbox']) - $cname = $smbx; + if ($folder_id == $CONFIG[$smbx.'_mbox']) + return $smbx; } - - return $cname; + + if ($folder_id == 'INBOX') + return 'inbox'; } @@ -1160,8 +1330,47 @@ if ($folder_class = rcmail_folder_classname($name)) return rcube_label($folder_class); else - return rcube_charset_convert($name, 'UTF-7'); + return rcube_charset_convert($name, 'UTF7-IMAP'); } +/** + * Output HTML editor scripts + * + * @param string Editor mode + */ +function rcube_html_editor($mode='') +{ + global $OUTPUT, $CONFIG; + + $lang = $tinylang = strtolower(substr($_SESSION['language'], 0, 2)); + if (!file_exists(INSTALL_PATH . 'program/js/tiny_mce/langs/'.$tinylang.'.js')) + $tinylang = 'en'; + + $OUTPUT->include_script('tiny_mce/tiny_mce.js'); + $OUTPUT->include_script('editor.js'); + $OUTPUT->add_script('rcmail_editor_init("$__skin_path", "'.JQ($tinylang).'", '.intval($CONFIG['enable_spellcheck']).', "'.$mode.'");'); +} + + + +/** + * Helper class to turn relative urls into absolute ones + * using a predefined base + */ +class rcube_base_replacer +{ + private $base_url; + + public function __construct($base) + { + $this->base_url = $base; + } + + public function callback($matches) + { + return $matches[1] . '="' . make_absolute_url($matches[3], $this->base_url) . '"'; + } +} + ?> -- Gitblit v1.9.1