From f78dab1c80c27cd64b5e1f967da20fd43c17006d Mon Sep 17 00:00:00 2001
From: thomascube <thomas@roundcube.net>
Date: Fri, 24 Jul 2009 04:29:24 -0400
Subject: [PATCH] Allow some recursion in reder_page hook (#1485977)
---
program/include/rcube_template.php | 76 ++++++++++++++++++++++++++++++++-----
1 files changed, 65 insertions(+), 11 deletions(-)
diff --git a/program/include/rcube_template.php b/program/include/rcube_template.php
index c4db040..ecb5a89 100755
--- a/program/include/rcube_template.php
+++ b/program/include/rcube_template.php
@@ -59,6 +59,7 @@
//$this->framed = $framed;
$this->set_env('task', $task);
+ $this->set_env('request_token', $this->app->get_request_token());
// load the correct skin (in case user-defined)
$this->set_skin($this->config['skin']);
@@ -287,6 +288,11 @@
public function send($templ = null, $exit = true)
{
if ($templ != 'iframe') {
+ // prevent from endless loops
+ if ($exit != 'recur' && $this->app->plugins->is_processing('render_page')) {
+ raise_error(array('code' => 505, 'type' => 'php', 'message' => 'Recursion alert: ignoring output->send()'), true, false);
+ return;
+ }
$this->parse($templ, false);
}
else {
@@ -320,6 +326,10 @@
$js = $this->framed ? "if(window.parent) {\n" : '';
$js .= $this->get_js_commands() . ($this->framed ? ' }' : '');
$this->add_script($js, 'head_top');
+
+ // make sure all <form> tags have a valid request token
+ $template = preg_replace_callback('/<form\s+([^>]+)>/Ui', array($this, 'alter_form_tag'), $template);
+ $this->footer = preg_replace_callback('/<form\s+([^>]+)>/Ui', array($this, 'alter_form_tag'), $this->footer);
// call super method
parent::write($template, $this->config['skin_path']);
@@ -509,7 +519,24 @@
*/
private function check_condition($condition)
{
- return eval("return (".$this->parse_expression($condition).");");
+ return eval("return (".$this->parse_expression($condition).");");
+ }
+
+
+ /**
+ *
+ */
+ private function alter_form_tag($matches)
+ {
+ $out = $matches[0];
+ $attrib = parse_attrib_string($matches[1]);
+
+ if (strtolower($attrib['method']) == 'post') {
+ $hidden = new html_hiddenfield(array('name' => '_token', 'value' => $this->app->get_request_token()));
+ $out .= "\n" . $hidden->show();
+ }
+
+ return $out;
}
@@ -784,8 +811,8 @@
}
// set title to alt attribute for IE browsers
- if ($this->browser->ie && $attrib['title'] && !$attrib['alt']) {
- $attrib['alt'] = $attrib['title'];
+ if ($this->browser->ie && !$attrib['title'] && $attrib['alt']) {
+ $attrib['title'] = $attrib['alt'];
}
// add empty alt attribute for XHTML compatibility
@@ -867,16 +894,15 @@
$attrib_str = html::attrib_string(
$attrib,
array(
- 'style', 'class', 'id', 'width',
- 'height', 'border', 'hspace',
- 'vspace', 'align', 'alt', 'tabindex'
+ 'style', 'class', 'id', 'width', 'height', 'border', 'hspace',
+ 'vspace', 'align', 'alt', 'tabindex', 'title'
)
);
$btn_content = sprintf('<img src="%s"%s />', $this->abs_url($attrib['image']), $attrib_str);
if ($attrib['label']) {
$btn_content .= ' '.$attrib['label'];
}
- $link_attrib = array('href', 'onclick', 'onmouseover', 'onmouseout', 'onmousedown', 'onmouseup', 'title', 'target');
+ $link_attrib = array('href', 'onclick', 'onmouseover', 'onmouseout', 'onmousedown', 'onmouseup', 'target');
}
else if ($attrib['type']=='link') {
$btn_content = $attrib['label'] ? $attrib['label'] : $attrib['command'];
@@ -892,8 +918,7 @@
$attrib_str = html::attrib_string(
$attrib,
array(
- 'type', 'value', 'onclick',
- 'id', 'class', 'style', 'tabindex'
+ 'type', 'value', 'onclick', 'id', 'class', 'style', 'tabindex'
)
);
$out = sprintf('<input%s disabled="disabled" />', $attrib_str);
@@ -920,7 +945,7 @@
*/
public function form_tag($attrib, $content = null)
{
- if ($this->framed) {
+ if ($this->framed || !empty($_REQUEST['_framed'])) {
$hiddenfield = new html_hiddenfield(array('name' => '_framed', 'value' => '1'));
$hidden = $hiddenfield->show();
}
@@ -930,7 +955,36 @@
return html::tag('form',
$attrib + array('action' => "./", 'method' => "get"),
- $hidden . $content);
+ $hidden . $content,
+ array('id','class','style','name','method','action','enctype','onsubmit'));
+ }
+
+
+ /**
+ * Build a form tag with a unique request token
+ *
+ * @param array Named tag parameters including 'action' and 'task' values which will be put into hidden fields
+ * @param string Form content
+ * @return string HTML code for the form
+ */
+ public function request_form($attrib, $content = '')
+ {
+ $hidden = new html_hiddenfield();
+ if ($attrib['task']) {
+ $hidden->add(array('name' => '_task', 'value' => $attrib['task']));
+ }
+ if ($attrib['action']) {
+ $hidden->add(array('name' => '_action', 'value' => $attrib['action']));
+ }
+
+ unset($attrib['task'], $attrib['request']);
+ $attrib['action'] = './';
+
+ // we already have a <form> tag
+ if ($attrib['form'])
+ return $hidden->show() . $content;
+ else
+ return $this->form_tag($attrib, $hidden->show() . $content);
}
--
Gitblit v1.9.1