From bd0551b22076b82a6d49e9f7a2b2e0c90a1b2326 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 05 Feb 2016 07:25:27 -0500
Subject: [PATCH] Secure also downloads of addressbook exports, managesieve script exports and Enigma keys exports

---
 plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php |  187 ++++++++++++++++++++++++++++++++++------------
 1 files changed, 138 insertions(+), 49 deletions(-)

diff --git a/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php b/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php
index 6ed8762..3fb1684 100644
--- a/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php
+++ b/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php
@@ -63,7 +63,7 @@
         1 => 'notifyimportancehigh'
     );
 
-    const VERSION  = '8.1';
+    const VERSION  = '8.5';
     const PROGNAME = 'Roundcube (Managesieve)';
     const PORT     = 4190;
 
@@ -122,9 +122,6 @@
                 case rcube_sieve::ERROR_CONNECTION:
                 case rcube_sieve::ERROR_LOGIN:
                     $this->rc->output->show_message('managesieve.filterconnerror', 'error');
-                    rcube::raise_error(array('code' => 403, 'type' => 'php',
-                        'file' => __FILE__, 'line' => __LINE__,
-                        'message' => "Unable to connect to managesieve on $host:$port"), true, false);
                     break;
 
                 default:
@@ -210,7 +207,18 @@
             $plugin['socket_options']
         );
 
-        return $this->sieve->error();
+        $error = $this->sieve->error();
+
+        if ($error) {
+            rcube::raise_error(array(
+                    'code'    => 403,
+                    'file'    => __FILE__,
+                    'line'    => __LINE__,
+                    'message' => "Unable to connect to managesieve on $host:$port"
+                ), true, false);
+        }
+
+        return $error;
     }
 
     /**
@@ -220,14 +228,14 @@
      *
      * @return int Connection status: 0 on success, >0 on failure
      */
-    public function load_script($script_name = null)
+    protected function load_script($script_name = null)
     {
         // Get list of scripts
         $list = $this->list_scripts();
 
         if ($script_name === null || $script_name === '') {
             // get (first) active script
-            if (!empty($this->active[0])) {
+            if (!empty($this->active)) {
                $script_name = $this->active[0];
             }
             else if ($list) {
@@ -389,11 +397,14 @@
                 }
             }
             else if ($action == 'setget') {
-                $script_name = rcube_utils::get_input_value('_set', rcube_utils::INPUT_GPC, true);
-                $script = $this->sieve->get_script($script_name);
+                $this->rc->request_security_check(rcube_utils::INPUT_GET);
 
-                if (PEAR::isError($script))
+                $script_name = rcube_utils::get_input_value('_set', rcube_utils::INPUT_GPC, true);
+                $script      = $this->sieve->get_script($script_name);
+
+                if (is_a($script, 'PEAR_Error')) {
                     exit;
+                }
 
                 $browser = new rcube_browser;
 
@@ -431,6 +442,11 @@
                 $content = $this->action_div($fid, $id, false);
 
                 $this->rc->output->command('managesieve_actionfill', $content, $id, $aid);
+            }
+            else if ($action == 'addresses') {
+                $aid = rcube_utils::get_input_value('_aid', rcube_utils::INPUT_POST);
+
+                $this->rc->output->command('managesieve_vacation_addresses_update', $aid, $this->user_emails());
             }
 
             $this->rc->output->send();
@@ -602,6 +618,7 @@
             $addresses      = rcube_utils::get_input_value('_action_addresses', rcube_utils::INPUT_POST, true);
             $intervals      = rcube_utils::get_input_value('_action_interval', rcube_utils::INPUT_POST);
             $interval_types = rcube_utils::get_input_value('_action_interval_type', rcube_utils::INPUT_POST);
+            $from           = rcube_utils::get_input_value('_action_from', rcube_utils::INPUT_POST);
             $subject        = rcube_utils::get_input_value('_action_subject', rcube_utils::INPUT_POST, true);
             $flags          = rcube_utils::get_input_value('_action_flags', rcube_utils::INPUT_POST);
             $varnames       = rcube_utils::get_input_value('_action_varname', rcube_utils::INPUT_POST);
@@ -618,8 +635,8 @@
             foreach ($sizeitems as $item)
                 $items[] = $item;
 
-            $this->form['disabled'] = $_POST['_disabled'] ? true : false;
-            $this->form['join']     = $join=='allof' ? true : false;
+            $this->form['disabled'] = !empty($_POST['_disabled']);
+            $this->form['join']     = $join == 'allof';
             $this->form['name']     = $name;
             $this->form['tests']    = array();
             $this->form['actions']  = array();
@@ -967,10 +984,11 @@
                     $interval_type = $interval_types[$idx] == 'seconds' ? 'seconds' : 'days';
 
                     $this->form['actions'][$i]['reason']    = str_replace("\r\n", "\n", $reason);
+                    $this->form['actions'][$i]['from']      = $from[$idx];
                     $this->form['actions'][$i]['subject']   = $subject[$idx];
                     $this->form['actions'][$i]['addresses'] = array_shift($addresses);
                     $this->form['actions'][$i][$interval_type] = $intervals[$idx];
-// @TODO: vacation :mime, :from, :handle
+// @TODO: vacation :mime, :handle
 
                     foreach ((array)$this->form['actions'][$i]['addresses'] as $aidx => $address) {
                         $this->form['actions'][$i]['addresses'][$aidx] = $address = trim($address);
@@ -982,6 +1000,10 @@
                             $this->errors['actions'][$i]['addresses'] = $this->plugin->gettext('noemailwarning');
                             break;
                         }
+                    }
+
+                    if (!empty($this->form['actions'][$i]['from']) && !rcube_utils::check_email($this->form['actions'][$i]['from'])) {
+                        $this->errors['actions'][$i]['from'] = $this->plugin->gettext('noemailwarning');
                     }
 
                     if ($this->form['actions'][$i]['reason'] == '')
@@ -1270,7 +1292,7 @@
         $out .= $hiddenfields->show();
 
         // 'any' flag
-        if ((!isset($this->form) && empty($scr['tests']) && !empty($src))
+        if ((!isset($this->form) && empty($scr['tests']) && !empty($scr))
             || (sizeof($scr['tests']) == 1 && $scr['tests'][0]['test'] == 'true' && !$scr['tests'][0]['not'])
         ) {
             $any = true;
@@ -1335,7 +1357,7 @@
         $out .= sprintf("%s<label for=\"%s\">%s</label>\n",
             $input_join, $field_id, rcube::Q($this->plugin->gettext('filterany')));
 
-        $rows_num = isset($scr) ? sizeof($scr['tests']) : 1;
+        $rows_num = !empty($scr['tests']) ? sizeof($scr['tests']) : 1;
 
         $out .= '<div id="rules"'.($any ? ' style="display: none"' : '').'>';
         for ($x=0; $x<$rows_num; $x++)
@@ -1393,19 +1415,21 @@
         }
 
         if (isset($rule['test'])) {
-            if (in_array($rule['test'], array('header', 'address', 'envelope'))
-                && !is_array($rule['arg1'])
-                && ($header = strtolower($rule['arg1']))
-                && isset($this->headers[$header])
-            ) {
-                $test = $header;
+            if (in_array($rule['test'], array('header', 'address', 'envelope'))) {
+                if (is_array($rule['arg1']) && count($rule['arg1']) == 1) {
+                    $rule['arg1'] = $rule['arg1'][0];
+                }
+
+                $matches = ($header = strtolower($rule['arg1'])) && isset($this->headers[$header]);
+                $test    = $matches ? $header : '...';
             }
-            else if ($rule['test'] == 'exists'
-                && !is_array($rule['arg'])
-                && ($header = strtolower($rule['arg']))
-                && isset($this->headers[$header])
-            ) {
-                $test = $header;
+            else if ($rule['test'] == 'exists') {
+                if (is_array($rule['arg']) && count($rule['arg']) == 1) {
+                    $rule['arg'] = $rule['arg'][0];
+                }
+
+                $matches = ($header = strtolower($rule['arg'])) && isset($this->headers[$header]);
+                $test    = $matches ? $header : '...';
             }
             else if (in_array($rule['test'], array('size', 'body', 'date', 'currentdate'))) {
                 $test = $rule['test'];
@@ -1466,30 +1490,25 @@
             $select_op->add(rcube::Q($this->plugin->gettext('valuenotequals')), 'value-ne');
         }
 
+        $test   = self::rule_test($rule);
+        $target = '';
+
         // target(s) input
         if (in_array($rule['test'], array('header', 'address', 'envelope'))) {
-            $test   = ($rule['not'] ? 'not' : '').($rule['type'] ? $rule['type'] : 'is');
             $target = $rule['arg2'];
         }
         else if (in_array($rule['test'], array('body', 'date', 'currentdate'))) {
-            $test   = ($rule['not'] ? 'not' : '').($rule['type'] ? $rule['type'] : 'is');
             $target = $rule['arg'];
         }
         else if ($rule['test'] == 'size') {
-            $test   = '';
-            $target = '';
             if (preg_match('/^([0-9]+)(K|M|G)?$/', $rule['arg'], $matches)) {
                 $sizetarget = $matches[1];
-                $sizeitem = $matches[2];
+                $sizeitem   = $matches[2];
             }
             else {
                 $sizetarget = $rule['arg'];
-                $sizeitem = $rule['item'];
+                $sizeitem   = $rule['item'];
             }
-        }
-        else {
-            $test   = ($rule['not'] ? 'not' : '').$rule['test'];
-            $target =  '';
         }
 
         // (current)date part select
@@ -1595,7 +1614,7 @@
             $mout .= '<div id="rule_date_header_div' .$id. '" class="adv"'. ($rule['test'] != 'date' ? ' style="display:none"' : '') .'>';
             $mout .= '<span class="label">' . rcube::Q($this->plugin->gettext('dateheader')) . '</span>';
             $mout .= '<input type="text" name="_rule_date_header[]" id="rule_date_header'.$id
-                . '" value="'. Q($rule['test'] == 'date' ? $rule['header'] : '')
+                . '" value="'. rcube::Q($rule['test'] == 'date' ? $rule['header'] : '')
                 . '" size="15"' . $this->error_class($id, 'test', 'dateheader', 'rule_date_header') .' />';
             $mout .= '</div>';
         }
@@ -1638,6 +1657,43 @@
         $out .= $div ? "</div>\n" : '';
 
         return $out;
+    }
+
+    private static function rule_test(&$rule)
+    {
+        // first modify value/count tests with 'not' keyword
+        // we'll revert the meaning of operators
+        if ($rule['not'] && preg_match('/^(count|value)-([gteqnl]{2})/', $rule['type'], $m)) {
+            $rule['not'] = false;
+
+            switch ($m[2]) {
+            case 'gt': $rule['type'] = $m[1] . '-le'; break;
+            case 'ge': $rule['type'] = $m[1] . '-lt'; break;
+            case 'lt': $rule['type'] = $m[1] . '-ge'; break;
+            case 'le': $rule['type'] = $m[1] . '-gt'; break;
+            case 'eq': $rule['type'] = $m[1] . '-ne'; break;
+            case 'ne': $rule['type'] = $m[1] . '-eq'; break;
+            }
+        }
+        else if ($rule['not'] && $rule['test'] == 'size') {
+            $rule['not']  = false;
+            $rule['type'] = $rule['type'] == 'over' ? 'under' : 'over';
+        }
+
+        $set = array('header', 'address', 'envelope', 'body', 'date', 'currentdate');
+
+        // build test string supported by select element
+        if ($rule['size']) {
+            $test = $rule['type'];
+        }
+        else if (in_array($rule['test'], $set)) {
+            $test = ($rule['not'] ? 'not' : '') . ($rule['type'] ?: 'is');
+        }
+        else {
+            $test = ($rule['not'] ? 'not' : '') . $rule['test'];
+        }
+
+        return $test;
     }
 
     function action_div($fid, $id, $div=true)
@@ -1726,22 +1782,31 @@
             . "</textarea>\n";
 
         // vacation
-        $vsec = in_array('vacation-seconds', $this->exts);
+        $vsec      = in_array('vacation-seconds', $this->exts);
+        $auto_addr = $this->rc->config->get('managesieve_vacation_addresses_init');
+        $addresses = isset($action['addresses']) || !$auto_addr ? (array) $action['addresses'] : $this->user_emails();
+
         $out .= '<div id="action_vacation' .$id.'" style="display:' .($action['type']=='vacation' ? 'inline' : 'none') .'">';
         $out .= '<span class="label">'. rcube::Q($this->plugin->gettext('vacationreason')) .'</span><br />'
             .'<textarea name="_action_reason['.$id.']" id="action_reason' .$id. '" '
             .'rows="3" cols="35" '. $this->error_class($id, 'action', 'reason', 'action_reason') . '>'
-            . Q($action['reason'], 'strict', false) . "</textarea>\n";
+            . rcube::Q($action['reason'], 'strict', false) . "</textarea>\n";
         $out .= '<br /><span class="label">' .rcube::Q($this->plugin->gettext('vacationsubject')) . '</span><br />'
             .'<input type="text" name="_action_subject['.$id.']" id="action_subject'.$id.'" '
             .'value="' . (is_array($action['subject']) ? rcube::Q(implode(', ', $action['subject']), 'strict', false) : $action['subject']) . '" size="35" '
             . $this->error_class($id, 'action', 'subject', 'action_subject') .' />';
+        $out .= '<br /><span class="label">' .rcube::Q($this->plugin->gettext('vacationfrom')) . '</span><br />'
+            .'<input type="text" name="_action_from['.$id.']" id="action_from'.$id.'" '
+            .'value="' . $action['from'] . '" size="35" '
+            . $this->error_class($id, 'action', 'from', 'action_from') .' />';
         $out .= '<br /><span class="label">' .rcube::Q($this->plugin->gettext('vacationaddr')) . '</span><br />'
-            . $this->list_input($id, 'action_addresses', $action['addresses'], true,
-                $this->error_class($id, 'action', 'addresses', 'action_addresses'), 30);
+            . $this->list_input($id, 'action_addresses', $addresses, true,
+                $this->error_class($id, 'action', 'addresses', 'action_addresses'), 30)
+            . html::a(array('href' => '#', 'onclick' => rcmail_output::JS_OBJECT_NAME . ".managesieve_vacation_addresses($id)"),
+                rcube::Q($this->plugin->gettext('filladdresses')));
         $out .= '<br /><span class="label">' . rcube::Q($this->plugin->gettext($vsec ? 'vacationinterval' : 'vacationdays')) . '</span><br />'
             .'<input type="text" name="_action_interval['.$id.']" id="action_interval'.$id.'" '
-            .'value="' .rcube::Q(isset($action['seconds']) ? $action['seconds'] : $action['days'], 'strict', false) . '" size="2" '
+            .'value="' .rcube::Q(rcube_sieve_vacation::vacation_interval($action), 'strict', false) . '" size="2" '
             . $this->error_class($id, 'action', 'interval', 'action_interval') .' />';
         if ($vsec) {
             $out .= '&nbsp;<label><input type="radio" name="_action_interval_type['.$id.']" value="days"'
@@ -2046,7 +2111,6 @@
 
         // Handle active script(s) and list of scripts according to Kolab's KEP:14
         if ($this->rc->config->get('managesieve_kolab_master')) {
-
             // Skip protected names
             foreach ((array)$this->list as $idx => $name) {
                 $_name = strtoupper($name);
@@ -2074,7 +2138,10 @@
                     foreach ($rules['actions'] as $action) {
                         if ($action['type'] == 'include' && empty($action['global'])) {
                             $name = preg_replace($filename_regex, '', $action['target']);
-                            $this->active[] = $name;
+                            // make sure the script exist
+                            if (in_array($name, $this->list)) {
+                                $this->active[] = $name;
+                            }
                         }
                     }
                 }
@@ -2106,6 +2173,11 @@
             if (!empty($exceptions)) {
                 $this->list = array_diff($this->list, (array)$exceptions);
             }
+        }
+
+        // reindex
+        if (!empty($this->list)) {
+            $this->list = array_values($this->list);
         }
 
         return $this->list;
@@ -2288,7 +2360,7 @@
             if (empty($filter['actions'])) {
                 continue;
             }
-            $fname = $filter['name'] ? $filter['name'] : "#$i";
+            $fname = $filter['name'] ?: "#$i";
             $result[] = array(
                 'id'    => $idx,
                 'name'  => $fname,
@@ -2305,11 +2377,11 @@
      */
     protected function init_script()
     {
-        $this->script = $this->sieve->script->as_array();
-
-        if (!$this->script) {
+        if (!$this->sieve->script) {
             return;
         }
+
+        $this->script = $this->sieve->script->as_array();
 
         $headers    = array();
         $exceptions = array('date', 'currentdate', 'size', 'body');
@@ -2339,4 +2411,21 @@
 
         $this->headers += $headers;
     }
+
+    /**
+     * Get all e-mail addresses of the user
+     */
+    protected function user_emails()
+    {
+        $addresses = $this->rc->user->list_emails();
+
+        foreach ($addresses as $idx => $email) {
+            $addresses[$idx] = $email['email'];
+        }
+
+        $addresses = array_unique($addresses);
+        sort($addresses);
+
+        return $addresses;
+    }
 }

--
Gitblit v1.9.1