No OneTemporary
Actions

Size

81 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/program/include/rcmail_html_page.php b/program/include/rcmail_html_page.php
	index 2624d590a..1d8391580 100644
	--- a/program/include/rcmail_html_page.php
	+++ b/program/include/rcmail_html_page.php
	@@ -1,36 +1,48 @@
	<?php

	/*
	+-----------------------------------------------------------------------+
	\| program/include/rcmail_html_page.php \|
	\| \|
	\| This file is part of the Roundcube Webmail client \|
	- \| Copyright (C) 2006-2012, The Roundcube Dev Team \|
	+ \| Copyright (C) 2006-2013, The Roundcube Dev Team \|
	\| \|
	\| Licensed under the GNU General Public License version 3 or \|
	\| any later version with exceptions for skins & plugins. \|
	\| See the README file for a full license statement. \|
	\| \|
	\| PURPOSE: \|
	\| Render a simple HTML page with the given contents \|
	\| \|
	+-----------------------------------------------------------------------+
	\| Author: Thomas Bruederli <roundcube@gmail.com> \|
	+-----------------------------------------------------------------------+
	*/


	/**
	- * Class to create HTML page output using a skin template
	+ * Class to create an empty HTML page with some default styles
	*
	* @package Core
	* @subpackage View
	*/
	class rcmail_html_page extends rcmail_output_html
	{
	public function write($contents = '')
	{
	self::reset();
	+
	+ // load embed.css from skin folder (if exists)
	+ if ($embed_css = $this->get_skin_file('/embed.css')) {
	+ $this->include_css($embed_css);
	+ }
	+ else { // set default styles for warning blocks inside the attachment part frame
	+ $this->add_header(html::tag('style', array('type' => 'text/css'),
	+ ".rcmail-inline-message { font-family: sans-serif; border:2px solid #ffdf0e; background:#fef893; padding:0.6em 1em; margin-bottom:0.6em }\n" .
	+ ".rcmail-inline-buttons { margin-bottom:0 }"
	+ ));
	+ }
	+
	parent::write($contents);
	}
	}
	\ No newline at end of file
	diff --git a/program/include/rcmail_output_html.php b/program/include/rcmail_output_html.php
	index cd5f4dddc6..f753bf8e1 100644
	--- a/program/include/rcmail_output_html.php
	+++ b/program/include/rcmail_output_html.php
	@@ -1,1780 +1,1781 @@
	<?php

	/*
	+-----------------------------------------------------------------------+
	\| program/include/rcmail_output_html.php \|
	\| \|
	\| This file is part of the Roundcube Webmail client \|
	\| Copyright (C) 2006-2012, The Roundcube Dev Team \|
	\| \|
	\| Licensed under the GNU General Public License version 3 or \|
	\| any later version with exceptions for skins & plugins. \|
	\| See the README file for a full license statement. \|
	\| \|
	\| PURPOSE: \|
	\| Class to handle HTML page output using a skin template. \|
	\| \|
	+-----------------------------------------------------------------------+
	\| Author: Thomas Bruederli <roundcube@gmail.com> \|
	+-----------------------------------------------------------------------+
	*/


	/**
	* Class to create HTML page output using a skin template
	*
	* @package Core
	* @subpackage View
	*/
	class rcmail_output_html extends rcmail_output
	{
	public $type = 'html';

	protected $message = null;
	protected $js_env = array();
	protected $js_labels = array();
	protected $js_commands = array();
	protected $skin_paths = array();
	protected $template_name;
	protected $scripts_path = '';
	protected $script_files = array();
	protected $css_files = array();
	protected $scripts = array();
	protected $default_template = "<html>\n<head><title></title></head>\n<body></body>\n</html>";
	protected $header = '';
	protected $footer = '';
	protected $body = '';
	protected $base_path = '';

	// deprecated names of templates used before 0.5
	protected $deprecated_templates = array(
	'contact' => 'showcontact',
	'contactadd' => 'addcontact',
	'contactedit' => 'editcontact',
	'identityedit' => 'editidentity',
	'messageprint' => 'printmessage',
	);

	/**
	* Constructor
	*
	* @todo Replace $this->config with the real rcube_config object
	*/
	public function __construct($task = null, $framed = false)
	{
	parent::__construct();

	//$this->framed = $framed;
	$this->set_env('task', $task);
	$this->set_env('x_frame_options', $this->config->get('x_frame_options', 'sameorigin'));

	// add cookie info
	$this->set_env('cookie_domain', ini_get('session.cookie_domain'));
	$this->set_env('cookie_path', ini_get('session.cookie_path'));
	$this->set_env('cookie_secure', ini_get('session.cookie_secure'));

	// load the correct skin (in case user-defined)
	$skin = $this->config->get('skin');
	$this->set_skin($skin);
	$this->set_env('skin', $skin);

	if (!empty($_REQUEST['_extwin']))
	$this->set_env('extwin', 1);

	// add common javascripts
	$this->add_script('var '.self::JS_OBJECT_NAME.' = new rcube_webmail();', 'head_top');

	// don't wait for page onload. Call init at the bottom of the page (delayed)
	$this->add_script(self::JS_OBJECT_NAME.'.init();', 'docready');

	$this->scripts_path = 'program/js/';
	$this->include_script('jquery.min.js');
	$this->include_script('common.js');
	$this->include_script('app.js');

	// register common UI objects
	$this->add_handlers(array(
	'loginform' => array($this, 'login_form'),
	'preloader' => array($this, 'preloader'),
	'username' => array($this, 'current_username'),
	'message' => array($this, 'message_container'),
	'charsetselector' => array($this, 'charset_selector'),
	'aboutcontent' => array($this, 'about_content'),
	));
	}


	/**
	* Set environment variable
	*
	* @param string Property name
	* @param mixed Property value
	* @param boolean True if this property should be added to client environment
	*/
	public function set_env($name, $value, $addtojs = true)
	{
	$this->env[$name] = $value;
	if ($addtojs \|\| isset($this->js_env[$name])) {
	$this->js_env[$name] = $value;
	}
	}


	/**
	* Getter for the current page title
	*
	* @return string The page title
	*/
	protected function get_pagetitle()
	{
	if (!empty($this->pagetitle)) {
	$title = $this->pagetitle;
	}
	else if ($this->env['task'] == 'login') {
	$title = $this->app->gettext(array(
	'name' => 'welcome',
	'vars' => array('product' => $this->config->get('product_name')
	)));
	}
	else {
	$title = ucfirst($this->env['task']);
	}

	return $title;
	}


	/**
	* Set skin
	*/
	public function set_skin($skin)
	{
	$valid = false;

	if (!empty($skin) && is_dir('skins/'.$skin) && is_readable('skins/'.$skin)) {
	$skin_path = 'skins/'.$skin;
	$valid = true;
	}
	else {
	$skin_path = $this->config->get('skin_path');
	if (!$skin_path) {
	$skin_path = 'skins/' . rcube_config::DEFAULT_SKIN;
	}
	$valid = !$skin;
	}

	$this->config->set('skin_path', $skin_path);
	+ $this->base_path = $skin_path;

	// register skin path(s)
	$this->skin_paths = array();
	$this->load_skin($skin_path);

	return $valid;
	}

	/**
	* Helper method to recursively read skin meta files and register search paths
	*/
	private function load_skin($skin_path)
	{
	$this->skin_paths[] = $skin_path;

	// read meta file and check for dependecies
	$meta = @json_decode(@file_get_contents($skin_path.'/meta.json'), true);
	if ($meta['extends'] && is_dir('skins/' . $meta['extends'])) {
	$this->load_skin('skins/' . $meta['extends']);
	}
	}


	/**
	* Check if a specific template exists
	*
	* @param string Template name
	* @return boolean True if template exists
	*/
	public function template_exists($name)
	{
	$found = false;
	foreach ($this->skin_paths as $skin_path) {
	$filename = $skin_path . '/templates/' . $name . '.html';
	$found = (is_file($filename) && is_readable($filename)) \|\| ($this->deprecated_templates[$name] && $this->template_exists($this->deprecated_templates[$name]));
	if ($found)
	break;
	}
	return $found;
	}


	/**
	* Find the given file in the current skin path stack
	*
	* @param string File name/path to resolve (starting with /)
	* @param string Reference to the base path of the matching skin
	* @param string Additional path to search in
	* @return mixed Relative path to the requested file or False if not found
	*/
	public function get_skin_file($file, &$skin_path, $add_path = null)
	{
	$skin_paths = $this->skin_paths;
	if ($add_path)
	array_unshift($skin_paths, $add_path);

	foreach ($skin_paths as $skin_path) {
	$path = realpath($skin_path . $file);
	if (is_file($path)) {
	return $skin_path . $file;
	}
	}

	return false;
	}


	/**
	* Register a GUI object to the client script
	*
	* @param string Object name
	* @param string Object ID
	* @return void
	*/
	public function add_gui_object($obj, $id)
	{
	$this->add_script(self::JS_OBJECT_NAME.".gui_object('$obj', '$id');");
	}


	/**
	* Call a client method
	*
	* @param string Method to call
	* @param ... Additional arguments
	*/
	public function command()
	{
	$cmd = func_get_args();
	if (strpos($cmd[0], 'plugin.') !== false)
	$this->js_commands[] = array('triggerEvent', $cmd[0], $cmd[1]);
	else
	$this->js_commands[] = $cmd;
	}


	/**
	* Add a localized label to the client environment
	*/
	public function add_label()
	{
	$args = func_get_args();
	if (count($args) == 1 && is_array($args[0]))
	$args = $args[0];

	foreach ($args as $name) {
	$this->js_labels[$name] = $this->app->gettext($name);
	}
	}


	/**
	* Invoke display_message command
	*
	* @param string $message Message to display
	* @param string $type Message type [notice\|confirm\|error]
	* @param array $vars Key-value pairs to be replaced in localized text
	* @param boolean $override Override last set message
	* @param int $timeout Message display time in seconds
	* @uses self::command()
	*/
	public function show_message($message, $type='notice', $vars=null, $override=true, $timeout=0)
	{
	if ($override \|\| !$this->message) {
	if ($this->app->text_exists($message)) {
	if (!empty($vars))
	$vars = array_map('Q', $vars);
	$msgtext = $this->app->gettext(array('name' => $message, 'vars' => $vars));
	}
	else
	$msgtext = $message;

	$this->message = $message;
	$this->command('display_message', $msgtext, $type, $timeout * 1000);
	}
	}


	/**
	* Delete all stored env variables and commands
	*/
	public function reset()
	{
	parent::reset();
	$this->js_env = array();
	$this->js_labels = array();
	$this->js_commands = array();
	$this->script_files = array();
	$this->scripts = array();
	$this->header = '';
	$this->footer = '';
	$this->body = '';
	}


	/**
	* Redirect to a certain url
	*
	* @param mixed $p Either a string with the action or url parameters as key-value pairs
	* @param int $delay Delay in seconds
	*/
	public function redirect($p = array(), $delay = 1)
	{
	if ($this->env['extwin'])
	$p['extwin'] = 1;
	$location = $this->app->url($p);
	header('Location: ' . $location);
	exit;
	}


	/**
	* Send the request output to the client.
	* This will either parse a skin tempalte or send an AJAX response
	*
	* @param string Template name
	* @param boolean True if script should terminate (default)
	*/
	public function send($templ = null, $exit = true)
	{
	if ($templ != 'iframe') {
	// prevent from endless loops
	if ($exit != 'recur' && $this->app->plugins->is_processing('render_page')) {
	rcube::raise_error(array('code' => 505, 'type' => 'php',
	'file' => __FILE__, 'line' => __LINE__,
	'message' => 'Recursion alert: ignoring output->send()'), true, false);
	return;
	}
	$this->parse($templ, false);
	}
	else {
	$this->framed = $templ == 'iframe' ? true : $this->framed;
	$this->write();
	}

	// set output asap
	ob_flush();
	flush();

	if ($exit) {
	exit;
	}
	}


	/**
	* Process template and write to stdOut
	*
	* @param string $template HTML template content
	*/
	public function write($template = '')
	{
	// unlock interface after iframe load
	$unlock = preg_replace('/[^a-z0-9]/i', '', $_REQUEST['_unlock']);
	if ($this->framed) {
	array_unshift($this->js_commands, array('set_busy', false, null, $unlock));
	}
	else if ($unlock) {
	array_unshift($this->js_commands, array('hide_message', $unlock));
	}

	if (!empty($this->script_files))
	$this->set_env('request_token', $this->app->get_request_token());

	// write all env variables to client
	$js = $this->framed ? "if(window.parent) {\n" : '';
	$js .= $this->get_js_commands() . ($this->framed ? ' }' : '');
	$this->add_script($js, 'head_top');

	// send clickjacking protection headers
	$iframe = $this->framed \|\| !empty($_REQUEST['_framed']);
	if (!headers_sent() && ($xframe = $this->app->config->get('x_frame_options', 'sameorigin')))
	header('X-Frame-Options: ' . ($iframe && $xframe == 'deny' ? 'sameorigin' : $xframe));

	// call super method
	$this->_write($template, $this->config->get('skin_path'));
	}


	/**
	* Parse a specific skin template and deliver to stdout (or return)
	*
	* @param string Template name
	* @param boolean Exit script
	* @param boolean Don't write to stdout, return parsed content instead
	*
	* @link http://php.net/manual/en/function.exit.php
	*/
	function parse($name = 'main', $exit = true, $write = true)
	{
	$plugin = false;
	$realname = $name;
	$this->template_name = $realname;

	$temp = explode('.', $name, 2);
	if (count($temp) > 1) {
	$plugin = $temp[0];
	$name = $temp[1];
	$skin_dir = $plugin . '/skins/' . $this->config->get('skin');

	// apply skin search escalation list to plugin directory
	$plugin_skin_paths = array();
	foreach ($this->skin_paths as $skin_path) {
	$plugin_skin_paths[] = $this->app->plugins->url . $plugin . '/' . $skin_path;
	}

	// add fallback to default skin
	if (is_dir($this->app->plugins->dir . $plugin . '/skins/default')) {
	$skin_dir = $plugin . '/skins/default';
	$plugin_skin_paths[] = $this->app->plugins->url . $skin_dir;
	}

	// add plugin skin paths to search list
	$this->skin_paths = array_merge($plugin_skin_paths, $this->skin_paths);
	}

	// find skin template
	$path = false;
	foreach ($this->skin_paths as $skin_path) {
	$path = "$skin_path/templates/$name.html";

	// fallback to deprecated template names
	if (!is_readable($path) && $this->deprecated_templates[$realname]) {
	$path = "$skin_path/templates/" . $this->deprecated_templates[$realname] . ".html";

	if (is_readable($path)) {
	rcube::raise_error(array(
	'code' => 502, 'type' => 'php',
	'file' => __FILE__, 'line' => __LINE__,
	'message' => "Using deprecated template '" . $this->deprecated_templates[$realname]
	. "' in $skin_path/templates. Please rename to '$realname'"),
	true, false);
	}
	}

	if (is_readable($path)) {
	$this->config->set('skin_path', $skin_path);
	$this->base_path = preg_replace('!plugins/\w+/!', '', $skin_path); // set base_path to core skin directory (not plugin's skin)
	$skin_dir = preg_replace('!^plugins/!', '', $skin_path);
	break;
	}
	else {
	$path = false;
	}
	}

	// read template file
	if (!$path \|\| ($templ = @file_get_contents($path)) === false) {
	rcube::raise_error(array(
	'code' => 501,
	'type' => 'php',
	'line' => __LINE__,
	'file' => __FILE__,
	'message' => 'Error loading template for '.$realname
	), true, $write);
	return false;
	}

	// replace all path references to plugins/... with the configured plugins dir
	// and /this/ to the current plugin skin directory
	if ($plugin) {
	$templ = preg_replace(array('/\bplugins\//', '/(["\']?)\/this\//'), array($this->app->plugins->url, '\\1'.$this->app->plugins->url.$skin_dir.'/'), $templ);
	}

	// parse for specialtags
	$output = $this->parse_conditions($templ);
	$output = $this->parse_xml($output);

	// trigger generic hook where plugins can put additional content to the page
	$hook = $this->app->plugins->exec_hook("render_page", array('template' => $realname, 'content' => $output));

	// save some memory
	$output = $hook['content'];
	unset($hook['content']);

	// make sure all <form> tags have a valid request token
	$output = preg_replace_callback('/<form\s+([^>]+)>/Ui', array($this, 'alter_form_tag'), $output);
	$this->footer = preg_replace_callback('/<form\s+([^>]+)>/Ui', array($this, 'alter_form_tag'), $this->footer);

	if ($write) {
	// add debug console
	if ($realname != 'error' && ($this->config->get('debug_level') & 8)) {
	$this->add_footer('<div id="console" style="position:absolute;top:5px;left:5px;width:405px;padding:2px;background:white;z-index:9000;display:none">
	<a href="#toggle" onclick="con=$(\'#dbgconsole\');con[con.is(\':visible\')?\'hide\':\'show\']();return false">console</a>
	<textarea name="console" id="dbgconsole" rows="20" cols="40" style="display:none;width:400px;border:none;font-size:10px" spellcheck="false"></textarea></div>'
	);
	$this->add_script(
	"if (!window.console \|\| !window.console.log) {\n".
	" window.console = new rcube_console();\n".
	" $('#console').show();\n".
	"}", 'foot');
	}
	$this->write(trim($output));
	}
	else {
	return $output;
	}

	if ($exit) {
	exit;
	}
	}


	/**
	* Return executable javascript code for all registered commands
	*
	* @return string $out
	*/
	protected function get_js_commands()
	{
	$out = '';
	if (!$this->framed && !empty($this->js_env)) {
	$out .= self::JS_OBJECT_NAME . '.set_env('.self::json_serialize($this->js_env).");\n";
	}
	if (!empty($this->js_labels)) {
	$this->command('add_label', $this->js_labels);
	}
	foreach ($this->js_commands as $i => $args) {
	$method = array_shift($args);
	foreach ($args as $i => $arg) {
	$args[$i] = self::json_serialize($arg);
	}
	$parent = $this->framed \|\| preg_match('/^parent\./', $method);
	$out .= sprintf(
	"%s.%s(%s);\n",
	($parent ? 'if(window.parent && parent.'.self::JS_OBJECT_NAME.') parent.' : '') . self::JS_OBJECT_NAME,
	preg_replace('/^parent\./', '', $method),
	implode(',', $args)
	);
	}

	return $out;
	}


	/**
	* Make URLs starting with a slash point to skin directory
	*
	* @param string Input string
	* @param boolean True if URL should be resolved using the current skin path stack
	* @return string
	*/
	public function abs_url($str, $search_path = false)
	{
	if ($str[0] == '/') {
	if ($search_path && ($file_url = $this->get_skin_file($str, $skin_path)))
	return $file_url;

	return $this->base_path . $str;
	}
	else
	return $str;
	}


	/**
	* Show error page and terminate script execution
	*
	* @param int $code Error code
	* @param string $message Error message
	*/
	public function raise_error($code, $message)
	{
	global $__page_content, $ERROR_CODE, $ERROR_MESSAGE;

	$ERROR_CODE = $code;
	$ERROR_MESSAGE = $message;

	include RCUBE_INSTALL_PATH . 'program/steps/utils/error.inc';
	exit;
	}


	/*** Template parsing methods ***/

	/**
	* Replace all strings ($varname)
	* with the content of the according global variable.
	*/
	protected function parse_with_globals($input)
	{
	$GLOBALS['__version'] = html::quote(RCMAIL_VERSION);
	$GLOBALS['__comm_path'] = html::quote($this->app->comm_path);
	$GLOBALS['__skin_path'] = html::quote($this->base_path);

	return preg_replace_callback('/\$(__[a-z0-9_\-]+)/',
	array($this, 'globals_callback'), $input);
	}


	/**
	* Callback funtion for preg_replace_callback() in parse_with_globals()
	*/
	protected function globals_callback($matches)
	{
	return $GLOBALS[$matches[1]];
	}


	/**
	* Correct absolute paths in images and other tags
	* add timestamp to .js and .css filename
	*/
	protected function fix_paths($output)
	{
	return preg_replace_callback(
	'!(src\|href\|background)=(["\']?)([a-z0-9/_.-]+)(["\'\s>])!i',
	array($this, 'file_callback'), $output);
	}


	/**
	* Callback function for preg_replace_callback in write()
	*
	* @return string Parsed string
	*/
	protected function file_callback($matches)
	{
	$file = $matches[3];
	$file[0] = preg_replace('!^/this/!', '/', $file[0]);

	// correct absolute paths
	if ($file[0] == '/') {
	$file = $this->base_path . $file;
	}

	// add file modification timestamp
	if (preg_match('/\.(js\|css)$/', $file)) {
	if ($fs = @filemtime($file)) {
	$file .= '?s=' . $fs;
	}
	}

	return $matches[1] . '=' . $matches[2] . $file . $matches[4];
	}


	/**
	* Public wrapper to dipp into template parsing.
	*
	* @param string $input
	* @return string
	* @uses rcube_output_html::parse_xml()
	* @since 0.1-rc1
	*/
	public function just_parse($input)
	{
	$input = $this->parse_conditions($input);
	$input = $this->parse_xml($input);

	return $input;
	}


	/**
	* Parse for conditional tags
	*
	* @param string $input
	* @return string
	*/
	protected function parse_conditions($input)
	{
	$matches = preg_split('/<roundcube:(if\|elseif\|else\|endif)\s+([^>]+)>\n?/is', $input, 2, PREG_SPLIT_DELIM_CAPTURE);
	if ($matches && count($matches) == 4) {
	if (preg_match('/^(else\|endif)$/i', $matches[1])) {
	return $matches[0] . $this->parse_conditions($matches[3]);
	}
	$attrib = html::parse_attrib_string($matches[2]);
	if (isset($attrib['condition'])) {
	$condmet = $this->check_condition($attrib['condition']);
	$submatches = preg_split('/<roundcube:(elseif\|else\|endif)\s+([^>]+)>\n?/is', $matches[3], 2, PREG_SPLIT_DELIM_CAPTURE);
	if ($condmet) {
	$result = $submatches[0];
	$result.= ($submatches[1] != 'endif' ? preg_replace('/.*<roundcube:endif\s+[^>]+>\n?/Uis', '', $submatches[3], 1) : $submatches[3]);
	}
	else {
	$result = "<roundcube:$submatches[1] $submatches[2]>" . $submatches[3];
	}
	return $matches[0] . $this->parse_conditions($result);
	}
	rcube::raise_error(array(
	'code' => 500,
	'type' => 'php',
	'line' => __LINE__,
	'file' => __FILE__,
	'message' => "Unable to parse conditional tag " . $matches[2]
	), true, false);
	}
	return $input;
	}


	/**
	* Determines if a given condition is met
	*
	* @todo Get rid off eval() once I understand what this does.
	* @todo Extend this to allow real conditions, not just "set"
	* @param string Condition statement
	* @return boolean True if condition is met, False if not
	*/
	protected function check_condition($condition)
	{
	return eval("return (".$this->parse_expression($condition).");");
	}


	/**
	* Inserts hidden field with CSRF-prevention-token into POST forms
	*/
	protected function alter_form_tag($matches)
	{
	$out = $matches[0];
	$attrib = html::parse_attrib_string($matches[1]);

	if (strtolower($attrib['method']) == 'post') {
	$hidden = new html_hiddenfield(array('name' => '_token', 'value' => $this->app->get_request_token()));
	$out .= "\n" . $hidden->show();
	}

	return $out;
	}


	/**
	* Parses expression and replaces variables
	*
	* @param string Expression statement
	* @return string Expression value
	*/
	protected function parse_expression($expression)
	{
	return preg_replace(
	array(
	'/session:([a-z0-9_]+)/i',
	'/config:([a-z0-9_]+)(:([a-z0-9_]+))?/i',
	'/env:([a-z0-9_]+)/i',
	'/request:([a-z0-9_]+)/i',
	'/cookie:([a-z0-9_]+)/i',
	'/browser:([a-z0-9_]+)/i',
	'/template:name/i',
	),
	array(
	"\$_SESSION['\\1']",
	"\$this->app->config->get('\\1',rcube_utils::get_boolean('\\3'))",
	"\$this->env['\\1']",
	"rcube_utils::get_input_value('\\1', rcube_utils::INPUT_GPC)",
	"\$_COOKIE['\\1']",
	"\$this->browser->{'\\1'}",
	$this->template_name,
	),
	$expression);
	}


	/**
	* Search for special tags in input and replace them
	* with the appropriate content
	*
	* @param string Input string to parse
	* @return string Altered input string
	* @todo Use DOM-parser to traverse template HTML
	* @todo Maybe a cache.
	*/
	protected function parse_xml($input)
	{
	return preg_replace_callback('/<roundcube:([-_a-z]+)\s+((?:[^>]\|\\\\>)+)(?<!\\\\)>/Ui', array($this, 'xml_command'), $input);
	}


	/**
	* Callback function for parsing an xml command tag
	* and turn it into real html content
	*
	* @param array Matches array of preg_replace_callback
	* @return string Tag/Object content
	*/
	protected function xml_command($matches)
	{
	$command = strtolower($matches[1]);
	$attrib = html::parse_attrib_string($matches[2]);

	// empty output if required condition is not met
	if (!empty($attrib['condition']) && !$this->check_condition($attrib['condition'])) {
	return '';
	}

	// execute command
	switch ($command) {
	// return a button
	case 'button':
	if ($attrib['name'] \|\| $attrib['command']) {
	return $this->button($attrib);
	}
	break;

	// frame
	case 'frame':
	return $this->frame($attrib);
	break;

	// show a label
	case 'label':
	if ($attrib['expression'])
	$attrib['name'] = eval("return " . $this->parse_expression($attrib['expression']) .";");

	if ($attrib['name'] \|\| $attrib['command']) {
	// @FIXME: 'noshow' is useless, remove?
	if ($attrib['noshow']) {
	return '';
	}

	$vars = $attrib + array('product' => $this->config->get('product_name'));
	unset($vars['name'], $vars['command']);

	$label = $this->app->gettext($attrib + array('vars' => $vars));
	$quoting = !empty($attrib['quoting']) ? strtolower($attrib['quoting']) : (rcube_utils::get_boolean((string)$attrib['html']) ? 'no' : '');

	switch ($quoting) {
	case 'no':
	case 'raw':
	break;
	case 'javascript':
	case 'js':
	$label = rcube::JQ($label);
	break;
	default:
	$label = html::quote($label);
	break;
	}

	return $label;
	}
	break;

	// include a file
	case 'include':
	$old_base_path = $this->base_path;
	if ($path = $this->get_skin_file($attrib['file'], $skin_path, $attrib['skinpath'])) {
	$this->base_path = preg_replace('!plugins/\w+/!', '', $skin_path); // set base_path to core skin directory (not plugin's skin)
	$path = realpath($path);
	}

	if (is_readable($path)) {
	if ($this->config->get('skin_include_php')) {
	$incl = $this->include_php($path);
	}
	else {
	$incl = file_get_contents($path);
	}
	$incl = $this->parse_conditions($incl);
	$incl = $this->parse_xml($incl);
	$incl = $this->fix_paths($incl);
	$this->base_path = $old_base_path;
	return $incl;
	}
	break;

	case 'plugin.include':
	$hook = $this->app->plugins->exec_hook("template_plugin_include", $attrib);
	return $hook['content'];

	// define a container block
	case 'container':
	if ($attrib['name'] && $attrib['id']) {
	$this->command('gui_container', $attrib['name'], $attrib['id']);
	// let plugins insert some content here
	$hook = $this->app->plugins->exec_hook("template_container", $attrib);
	return $hook['content'];
	}
	break;

	// return code for a specific application object
	case 'object':
	$object = strtolower($attrib['name']);
	$content = '';

	// we are calling a class/method
	if (($handler = $this->object_handlers[$object]) && is_array($handler)) {
	if ((is_object($handler[0]) && method_exists($handler[0], $handler[1])) \|\|
	(is_string($handler[0]) && class_exists($handler[0])))
	$content = call_user_func($handler, $attrib);
	}
	// execute object handler function
	else if (function_exists($handler)) {
	$content = call_user_func($handler, $attrib);
	}
	else if ($object == 'doctype') {
	$content = html::doctype($attrib['value']);
	}
	else if ($object == 'logo') {
	$attrib += array('alt' => $this->xml_command(array('', 'object', 'name="productname"')));
	if ($logo = $this->config->get('skin_logo'))
	$attrib['src'] = $logo;
	$content = html::img($attrib);
	}
	else if ($object == 'productname') {
	$name = $this->config->get('product_name', 'Roundcube Webmail');
	$content = html::quote($name);
	}
	else if ($object == 'version') {
	$ver = (string)RCMAIL_VERSION;
	if (is_file(RCUBE_INSTALL_PATH . '.svn/entries')) {
	if (preg_match('/Revision:\s(\d+)/', @shell_exec('svn info'), $regs))
	$ver .= ' [SVN r'.$regs[1].']';
	}
	else if (is_file(RCUBE_INSTALL_PATH . '.git/index')) {
	if (preg_match('/Date:\s+([^\n]+)/', @shell_exec('git log -1'), $regs)) {
	if ($date = date('Ymd.Hi', strtotime($regs[1]))) {
	$ver .= ' [GIT '.$date.']';
	}
	}
	}
	$content = html::quote($ver);
	}
	else if ($object == 'steptitle') {
	$content = html::quote($this->get_pagetitle());
	}
	else if ($object == 'pagetitle') {
	if ($this->config->get('devel_mode') && !empty($_SESSION['username']))
	$title = $_SESSION['username'].' :: ';
	else if ($prod_name = $this->config->get('product_name'))
	$title = $prod_name . ' :: ';
	else
	$title = '';
	$title .= $this->get_pagetitle();
	$content = html::quote($title);
	}

	// exec plugin hooks for this template object
	$hook = $this->app->plugins->exec_hook("template_object_$object", $attrib + array('content' => $content));
	return $hook['content'];

	// return code for a specified eval expression
	case 'exp':
	$value = $this->parse_expression($attrib['expression']);
	return eval("return html::quote($value);");

	// return variable
	case 'var':
	$var = explode(':', $attrib['name']);
	$name = $var[1];
	$value = '';

	switch ($var[0]) {
	case 'env':
	$value = $this->env[$name];
	break;
	case 'config':
	$value = $this->config->get($name);
	if (is_array($value) && $value[$_SESSION['storage_host']]) {
	$value = $value[$_SESSION['storage_host']];
	}
	break;
	case 'request':
	$value = rcube_utils::get_input_value($name, rcube_utils::INPUT_GPC);
	break;
	case 'session':
	$value = $_SESSION[$name];
	break;
	case 'cookie':
	$value = htmlspecialchars($_COOKIE[$name]);
	break;
	case 'browser':
	$value = $this->browser->{$name};
	break;
	}

	if (is_array($value)) {
	$value = implode(', ', $value);
	}

	return html::quote($value);
	break;
	}
	return '';
	}


	/**
	* Include a specific file and return it's contents
	*
	* @param string File path
	* @return string Contents of the processed file
	*/
	protected function include_php($file)
	{
	ob_start();
	include $file;
	$out = ob_get_contents();
	ob_end_clean();

	return $out;
	}


	/**
	* Create and register a button
	*
	* @param array Named button attributes
	* @return string HTML button
	* @todo Remove all inline JS calls and use jQuery instead.
	* @todo Remove all sprintf()'s - they are pretty, but also slow.
	*/
	public function button($attrib)
	{
	static $s_button_count = 100;

	// these commands can be called directly via url
	$a_static_commands = array('compose', 'list', 'preferences', 'folders', 'identities');

	if (!($attrib['command'] \|\| $attrib['name'])) {
	return '';
	}

	// try to find out the button type
	if ($attrib['type']) {
	$attrib['type'] = strtolower($attrib['type']);
	}
	else {
	$attrib['type'] = ($attrib['image'] \|\| $attrib['imagepas'] \|\| $attrib['imageact']) ? 'image' : 'link';
	}

	$command = $attrib['command'];

	if ($attrib['task'])
	$command = $attrib['task'] . '.' . $command;

	if (!$attrib['image']) {
	$attrib['image'] = $attrib['imagepas'] ? $attrib['imagepas'] : $attrib['imageact'];
	}

	if (!$attrib['id']) {
	$attrib['id'] = sprintf('rcmbtn%d', $s_button_count++);
	}
	// get localized text for labels and titles
	if ($attrib['title']) {
	$attrib['title'] = html::quote($this->app->gettext($attrib['title'], $attrib['domain']));
	}
	if ($attrib['label']) {
	$attrib['label'] = html::quote($this->app->gettext($attrib['label'], $attrib['domain']));
	}
	if ($attrib['alt']) {
	$attrib['alt'] = html::quote($this->app->gettext($attrib['alt'], $attrib['domain']));
	}

	// set title to alt attribute for IE browsers
	if ($this->browser->ie && !$attrib['title'] && $attrib['alt']) {
	$attrib['title'] = $attrib['alt'];
	}

	// add empty alt attribute for XHTML compatibility
	if (!isset($attrib['alt'])) {
	$attrib['alt'] = '';
	}

	// register button in the system
	if ($attrib['command']) {
	$this->add_script(sprintf(
	"%s.register_button('%s', '%s', '%s', '%s', '%s', '%s');",
	self::JS_OBJECT_NAME,
	$command,
	$attrib['id'],
	$attrib['type'],
	$attrib['imageact'] ? $this->abs_url($attrib['imageact']) : $attrib['classact'],
	$attrib['imagesel'] ? $this->abs_url($attrib['imagesel']) : $attrib['classsel'],
	$attrib['imageover'] ? $this->abs_url($attrib['imageover']) : ''
	));

	// make valid href to specific buttons
	if (in_array($attrib['command'], rcmail::$main_tasks)) {
	$attrib['href'] = $this->app->url(array('task' => $attrib['command']));
	$attrib['onclick'] = sprintf("return %s.command('switch-task','%s',this,event)", self::JS_OBJECT_NAME, $attrib['command']);
	}
	else if ($attrib['task'] && in_array($attrib['task'], rcmail::$main_tasks)) {
	$attrib['href'] = $this->app->url(array('action' => $attrib['command'], 'task' => $attrib['task']));
	}
	else if (in_array($attrib['command'], $a_static_commands)) {
	$attrib['href'] = $this->app->url(array('action' => $attrib['command']));
	}
	else if (($attrib['command'] == 'permaurl' \|\| $attrib['command'] == 'extwin') && !empty($this->env['permaurl'])) {
	$attrib['href'] = $this->env['permaurl'];
	}
	}

	// overwrite attributes
	if (!$attrib['href']) {
	$attrib['href'] = '#';
	}
	if ($attrib['task']) {
	if ($attrib['classact'])
	$attrib['class'] = $attrib['classact'];
	}
	else if ($command && !$attrib['onclick']) {
	$attrib['onclick'] = sprintf(
	"return %s.command('%s','%s',this,event)",
	self::JS_OBJECT_NAME,
	$command,
	$attrib['prop']
	);
	}

	$out = '';

	// generate image tag
	if ($attrib['type'] == 'image') {
	$attrib_str = html::attrib_string(
	$attrib,
	array(
	'style', 'class', 'id', 'width', 'height', 'border', 'hspace',
	'vspace', 'align', 'alt', 'tabindex', 'title'
	)
	);
	$btn_content = sprintf('<img src="%s"%s />', $this->abs_url($attrib['image']), $attrib_str);
	if ($attrib['label']) {
	$btn_content .= ' '.$attrib['label'];
	}
	$link_attrib = array('href', 'onclick', 'onmouseover', 'onmouseout', 'onmousedown', 'onmouseup', 'target');
	}
	else if ($attrib['type'] == 'link') {
	$btn_content = isset($attrib['content']) ? $attrib['content'] : ($attrib['label'] ? $attrib['label'] : $attrib['command']);
	$link_attrib = array('href', 'onclick', 'title', 'id', 'class', 'style', 'tabindex', 'target');
	if ($attrib['innerclass'])
	$btn_content = html::span($attrib['innerclass'], $btn_content);
	}
	else if ($attrib['type'] == 'input') {
	$attrib['type'] = 'button';

	if ($attrib['label']) {
	$attrib['value'] = $attrib['label'];
	}
	if ($attrib['command']) {
	$attrib['disabled'] = 'disabled';
	}

	$out = html::tag('input', $attrib, null, array('type', 'value', 'onclick', 'id', 'class', 'style', 'tabindex', 'disabled'));
	}

	// generate html code for button
	if ($btn_content) {
	$attrib_str = html::attrib_string($attrib, $link_attrib);
	$out = sprintf('<a%s>%s</a>', $attrib_str, $btn_content);
	}

	return $out;
	}


	/**
	* Link an external script file
	*
	* @param string File URL
	* @param string Target position [head\|foot]
	*/
	public function include_script($file, $position='head')
	{
	static $sa_files = array();

	if (!preg_match('\|^https?://\|i', $file) && $file[0] != '/') {
	$file = $this->scripts_path . $file;
	if ($fs = @filemtime($file)) {
	$file .= '?s=' . $fs;
	}
	}

	if (in_array($file, $sa_files)) {
	return;
	}

	$sa_files[] = $file;

	if (!is_array($this->script_files[$position])) {
	$this->script_files[$position] = array();
	}

	$this->script_files[$position][] = $file;
	}


	/**
	* Add inline javascript code
	*
	* @param string JS code snippet
	* @param string Target position [head\|head_top\|foot]
	*/
	public function add_script($script, $position='head')
	{
	if (!isset($this->scripts[$position])) {
	$this->scripts[$position] = "\n" . rtrim($script);
	}
	else {
	$this->scripts[$position] .= "\n" . rtrim($script);
	}
	}


	/**
	* Link an external css file
	*
	* @param string File URL
	*/
	public function include_css($file)
	{
	$this->css_files[] = $file;
	}


	/**
	* Add HTML code to the page header
	*
	* @param string $str HTML code
	*/
	public function add_header($str)
	{
	$this->header .= "\n" . $str;
	}


	/**
	* Add HTML code to the page footer
	* To be added right befor </body>
	*
	* @param string $str HTML code
	*/
	public function add_footer($str)
	{
	$this->footer .= "\n" . $str;
	}


	/**
	* Process template and write to stdOut
	*
	* @param string HTML template
	* @param string Base for absolute paths
	*/
	public function _write($templ = '', $base_path = '')
	{
	$output = empty($templ) ? $this->default_template : trim($templ);

	// set default page title
	if (empty($this->pagetitle)) {
	$this->pagetitle = 'Roundcube Mail';
	}

	// replace specialchars in content
	$page_title = html::quote($this->pagetitle);
	$page_header = '';
	$page_footer = '';

	// include meta tag with charset
	if (!empty($this->charset)) {
	if (!headers_sent()) {
	header('Content-Type: text/html; charset=' . $this->charset);
	}
	$page_header = '<meta http-equiv="content-type"';
	$page_header.= ' content="text/html; charset=';
	$page_header.= $this->charset . '" />'."\n";
	}

	// definition of the code to be placed in the document header and footer
	if (is_array($this->script_files['head'])) {
	foreach ($this->script_files['head'] as $file) {
	$page_header .= html::script($file);
	}
	}

	$head_script = $this->scripts['head_top'] . $this->scripts['head'];
	if (!empty($head_script)) {
	$page_header .= html::script(array(), $head_script);
	}

	if (!empty($this->header)) {
	$page_header .= $this->header;
	}

	// put docready commands into page footer
	if (!empty($this->scripts['docready'])) {
	$this->add_script('$(document).ready(function(){ ' . $this->scripts['docready'] . "\n});", 'foot');
	}

	if (is_array($this->script_files['foot'])) {
	foreach ($this->script_files['foot'] as $file) {
	$page_footer .= html::script($file);
	}
	}

	if (!empty($this->footer)) {
	$page_footer .= $this->footer . "\n";
	}

	if (!empty($this->scripts['foot'])) {
	$page_footer .= html::script(array(), $this->scripts['foot']);
	}

	// find page header
	if ($hpos = stripos($output, '</head>')) {
	$page_header .= "\n";
	}
	else {
	if (!is_numeric($hpos)) {
	$hpos = stripos($output, '<body');
	}
	if (!is_numeric($hpos) && ($hpos = stripos($output, '<html'))) {
	while ($output[$hpos] != '>') {
	$hpos++;
	}
	$hpos++;
	}
	$page_header = "<head>\n<title>$page_title</title>\n$page_header\n</head>\n";
	}

	// add page hader
	if ($hpos) {
	$output = substr_replace($output, $page_header, $hpos, 0);
	}
	else {
	$output = $page_header . $output;
	}

	// add page footer
	if (($fpos = strripos($output, '</body>')) \|\| ($fpos = strripos($output, '</html>'))) {
	$output = substr_replace($output, $page_footer."\n", $fpos, 0);
	}
	else {
	$output .= "\n".$page_footer;
	}

	// add css files in head, before scripts, for speed up with parallel downloads
	if (!empty($this->css_files) &&
	(($pos = stripos($output, '<script ')) \|\| ($pos = stripos($output, '</head>')))
	) {
	$css = '';
	foreach ($this->css_files as $file) {
	$css .= html::tag('link', array('rel' => 'stylesheet',
	'type' => 'text/css', 'href' => $file, 'nl' => true));
	}
	$output = substr_replace($output, $css, $pos, 0);
	}

	$output = $this->parse_with_globals($this->fix_paths($output));

	// trigger hook with final HTML content to be sent
	$hook = $this->app->plugins->exec_hook("send_page", array('content' => $output));
	if (!$hook['abort']) {
	if ($this->charset != RCUBE_CHARSET) {
	echo rcube_charset::convert($hook['content'], RCUBE_CHARSET, $this->charset);
	}
	else {
	echo $hook['content'];
	}
	}
	}


	/**
	* Returns iframe object, registers some related env variables
	*
	* @param array $attrib HTML attributes
	* @param boolean $is_contentframe Register this iframe as the 'contentframe' gui object
	* @return string IFRAME element
	*/
	public function frame($attrib, $is_contentframe = false)
	{
	static $idcount = 0;

	if (!$attrib['id']) {
	$attrib['id'] = 'rcmframe' . ++$idcount;
	}

	$attrib['name'] = $attrib['id'];
	$attrib['src'] = $attrib['src'] ? $this->abs_url($attrib['src'], true) : 'program/resources/blank.gif';

	// register as 'contentframe' object
	if ($is_contentframe \|\| $attrib['contentframe']) {
	$this->set_env('contentframe', $attrib['contentframe'] ? $attrib['contentframe'] : $attrib['name']);
	$this->set_env('blankpage', $attrib['src']);
	}

	return html::iframe($attrib);
	}


	/* *********** common functions delivering gui objects ************ */


	/**
	* Create a form tag with the necessary hidden fields
	*
	* @param array Named tag parameters
	* @return string HTML code for the form
	*/
	public function form_tag($attrib, $content = null)
	{
	if ($this->framed \|\| !empty($_REQUEST['_framed'])) {
	$hiddenfield = new html_hiddenfield(array('name' => '_framed', 'value' => '1'));
	$hidden = $hiddenfield->show();
	}
	if ($this->env['extwin']) {
	$hiddenfield = new html_hiddenfield(array('name' => '_extwin', 'value' => '1'));
	$hidden = $hiddenfield->show();
	}

	if (!$content)
	$attrib['noclose'] = true;

	return html::tag('form',
	$attrib + array('action' => "./", 'method' => "get"),
	$hidden . $content,
	array('id','class','style','name','method','action','enctype','onsubmit'));
	}


	/**
	* Build a form tag with a unique request token
	*
	* @param array Named tag parameters including 'action' and 'task' values which will be put into hidden fields
	* @param string Form content
	* @return string HTML code for the form
	*/
	public function request_form($attrib, $content = '')
	{
	$hidden = new html_hiddenfield();
	if ($attrib['task']) {
	$hidden->add(array('name' => '_task', 'value' => $attrib['task']));
	}
	if ($attrib['action']) {
	$hidden->add(array('name' => '_action', 'value' => $attrib['action']));
	}

	unset($attrib['task'], $attrib['request']);
	$attrib['action'] = './';

	// we already have a <form> tag
	if ($attrib['form']) {
	if ($this->framed \|\| !empty($_REQUEST['_framed']))
	$hidden->add(array('name' => '_framed', 'value' => '1'));
	return $hidden->show() . $content;
	}
	else
	return $this->form_tag($attrib, $hidden->show() . $content);
	}


	/**
	* GUI object 'username'
	* Showing IMAP username of the current session
	*
	* @param array Named tag parameters (currently not used)
	* @return string HTML code for the gui object
	*/
	public function current_username($attrib)
	{
	static $username;

	// alread fetched
	if (!empty($username)) {
	return $username;
	}

	// Current username is an e-mail address
	if (strpos($_SESSION['username'], '@')) {
	$username = $_SESSION['username'];
	}
	// get e-mail address from default identity
	else if ($sql_arr = $this->app->user->get_identity()) {
	$username = $sql_arr['email'];
	}
	else {
	$username = $this->app->user->get_username();
	}

	return rcube_utils::idn_to_utf8($username);
	}


	/**
	* GUI object 'loginform'
	* Returns code for the webmail login form
	*
	* @param array Named parameters
	* @return string HTML code for the gui object
	*/
	protected function login_form($attrib)
	{
	$default_host = $this->config->get('default_host');
	$autocomplete = (int) $this->config->get('login_autocomplete');

	$_SESSION['temp'] = true;

	// save original url
	$url = rcube_utils::get_input_value('_url', rcube_utils::INPUT_POST);
	if (empty($url) && !preg_match('/_(task\|action)=logout/', $_SERVER['QUERY_STRING']))
	$url = $_SERVER['QUERY_STRING'];

	// Disable autocapitalization on iPad/iPhone (#1488609)
	$attrib['autocapitalize'] = 'off';

	// set atocomplete attribute
	$user_attrib = $autocomplete > 0 ? array() : array('autocomplete' => 'off');
	$host_attrib = $autocomplete > 0 ? array() : array('autocomplete' => 'off');
	$pass_attrib = $autocomplete > 1 ? array() : array('autocomplete' => 'off');

	$input_task = new html_hiddenfield(array('name' => '_task', 'value' => 'login'));
	$input_action = new html_hiddenfield(array('name' => '_action', 'value' => 'login'));
	$input_tzone = new html_hiddenfield(array('name' => '_timezone', 'id' => 'rcmlogintz', 'value' => '_default_'));
	$input_url = new html_hiddenfield(array('name' => '_url', 'id' => 'rcmloginurl', 'value' => $url));
	$input_user = new html_inputfield(array('name' => '_user', 'id' => 'rcmloginuser')
	+ $attrib + $user_attrib);
	$input_pass = new html_passwordfield(array('name' => '_pass', 'id' => 'rcmloginpwd')
	+ $attrib + $pass_attrib);
	$input_host = null;

	if (is_array($default_host) && count($default_host) > 1) {
	$input_host = new html_select(array('name' => '_host', 'id' => 'rcmloginhost'));

	foreach ($default_host as $key => $value) {
	if (!is_array($value)) {
	$input_host->add($value, (is_numeric($key) ? $value : $key));
	}
	else {
	$input_host = null;
	break;
	}
	}
	}
	else if (is_array($default_host) && ($host = key($default_host)) !== null) {
	$hide_host = true;
	$input_host = new html_hiddenfield(array(
	'name' => '_host', 'id' => 'rcmloginhost', 'value' => is_numeric($host) ? $default_host[$host] : $host) + $attrib);
	}
	else if (empty($default_host)) {
	$input_host = new html_inputfield(array('name' => '_host', 'id' => 'rcmloginhost')
	+ $attrib + $host_attrib);
	}

	$form_name = !empty($attrib['form']) ? $attrib['form'] : 'form';
	$this->add_gui_object('loginform', $form_name);

	// create HTML table with two cols
	$table = new html_table(array('cols' => 2));

	$table->add('title', html::label('rcmloginuser', html::quote($this->app->gettext('username'))));
	$table->add('input', $input_user->show(rcube_utils::get_input_value('_user', rcube_utils::INPUT_GPC)));

	$table->add('title', html::label('rcmloginpwd', html::quote($this->app->gettext('password'))));
	$table->add('input', $input_pass->show());

	// add host selection row
	if (is_object($input_host) && !$hide_host) {
	$table->add('title', html::label('rcmloginhost', html::quote($this->app->gettext('server'))));
	$table->add('input', $input_host->show(rcube_utils::get_input_value('_host', rcube_utils::INPUT_GPC)));
	}

	$out = $input_task->show();
	$out .= $input_action->show();
	$out .= $input_tzone->show();
	$out .= $input_url->show();
	$out .= $table->show();

	if ($hide_host) {
	$out .= $input_host->show();
	}

	// surround html output with a form tag
	if (empty($attrib['form'])) {
	$out = $this->form_tag(array('name' => $form_name, 'method' => 'post'), $out);
	}

	// include script for timezone detection
	$this->include_script('jstz.min.js');

	return $out;
	}


	/**
	* GUI object 'preloader'
	* Loads javascript code for images preloading
	*
	* @param array Named parameters
	* @return void
	*/
	protected function preloader($attrib)
	{
	$images = preg_split('/[\s\t\n,]+/', $attrib['images'], -1, PREG_SPLIT_NO_EMPTY);
	$images = array_map(array($this, 'abs_url'), $images);

	if (empty($images) \|\| $this->app->task == 'logout')
	return;

	$this->add_script('var images = ' . self::json_serialize($images) .';
	for (var i=0; i<images.length; i++) {
	img = new Image();
	img.src = images[i];
	}', 'docready');
	}


	/**
	* GUI object 'searchform'
	* Returns code for search function
	*
	* @param array Named parameters
	* @return string HTML code for the gui object
	*/
	protected function search_form($attrib)
	{
	// add some labels to client
	$this->add_label('searching');

	$attrib['name'] = '_q';

	if (empty($attrib['id'])) {
	$attrib['id'] = 'rcmqsearchbox';
	}
	if ($attrib['type'] == 'search' && !$this->browser->khtml) {
	unset($attrib['type'], $attrib['results']);
	}

	$input_q = new html_inputfield($attrib);
	$out = $input_q->show();

	$this->add_gui_object('qsearchbox', $attrib['id']);

	// add form tag around text field
	if (empty($attrib['form'])) {
	$out = $this->form_tag(array(
	'name' => "rcmqsearchform",
	'onsubmit' => self::JS_OBJECT_NAME . ".command('search'); return false",
	'style' => "display:inline"),
	$out);
	}

	return $out;
	}


	/**
	* Builder for GUI object 'message'
	*
	* @param array Named tag parameters
	* @return string HTML code for the gui object
	*/
	protected function message_container($attrib)
	{
	if (isset($attrib['id']) === false) {
	$attrib['id'] = 'rcmMessageContainer';
	}

	$this->add_gui_object('message', $attrib['id']);

	return html::div($attrib, '');
	}


	/**
	* GUI object 'charsetselector'
	*
	* @param array Named parameters for the select tag
	* @return string HTML code for the gui object
	*/
	public function charset_selector($attrib)
	{
	// pass the following attributes to the form class
	$field_attrib = array('name' => '_charset');
	foreach ($attrib as $attr => $value) {
	if (in_array($attr, array('id', 'name', 'class', 'style', 'size', 'tabindex'))) {
	$field_attrib[$attr] = $value;
	}
	}

	$charsets = array(
	'UTF-8' => 'UTF-8 ('.$this->app->gettext('unicode').')',
	'US-ASCII' => 'ASCII ('.$this->app->gettext('english').')',
	'ISO-8859-1' => 'ISO-8859-1 ('.$this->app->gettext('westerneuropean').')',
	'ISO-8859-2' => 'ISO-8859-2 ('.$this->app->gettext('easterneuropean').')',
	'ISO-8859-4' => 'ISO-8859-4 ('.$this->app->gettext('baltic').')',
	'ISO-8859-5' => 'ISO-8859-5 ('.$this->app->gettext('cyrillic').')',
	'ISO-8859-6' => 'ISO-8859-6 ('.$this->app->gettext('arabic').')',
	'ISO-8859-7' => 'ISO-8859-7 ('.$this->app->gettext('greek').')',
	'ISO-8859-8' => 'ISO-8859-8 ('.$this->app->gettext('hebrew').')',
	'ISO-8859-9' => 'ISO-8859-9 ('.$this->app->gettext('turkish').')',
	'ISO-8859-10' => 'ISO-8859-10 ('.$this->app->gettext('nordic').')',
	'ISO-8859-11' => 'ISO-8859-11 ('.$this->app->gettext('thai').')',
	'ISO-8859-13' => 'ISO-8859-13 ('.$this->app->gettext('baltic').')',
	'ISO-8859-14' => 'ISO-8859-14 ('.$this->app->gettext('celtic').')',
	'ISO-8859-15' => 'ISO-8859-15 ('.$this->app->gettext('westerneuropean').')',
	'ISO-8859-16' => 'ISO-8859-16 ('.$this->app->gettext('southeasterneuropean').')',
	'WINDOWS-1250' => 'Windows-1250 ('.$this->app->gettext('easterneuropean').')',
	'WINDOWS-1251' => 'Windows-1251 ('.$this->app->gettext('cyrillic').')',
	'WINDOWS-1252' => 'Windows-1252 ('.$this->app->gettext('westerneuropean').')',
	'WINDOWS-1253' => 'Windows-1253 ('.$this->app->gettext('greek').')',
	'WINDOWS-1254' => 'Windows-1254 ('.$this->app->gettext('turkish').')',
	'WINDOWS-1255' => 'Windows-1255 ('.$this->app->gettext('hebrew').')',
	'WINDOWS-1256' => 'Windows-1256 ('.$this->app->gettext('arabic').')',
	'WINDOWS-1257' => 'Windows-1257 ('.$this->app->gettext('baltic').')',
	'WINDOWS-1258' => 'Windows-1258 ('.$this->app->gettext('vietnamese').')',
	'ISO-2022-JP' => 'ISO-2022-JP ('.$this->app->gettext('japanese').')',
	'ISO-2022-KR' => 'ISO-2022-KR ('.$this->app->gettext('korean').')',
	'ISO-2022-CN' => 'ISO-2022-CN ('.$this->app->gettext('chinese').')',
	'EUC-JP' => 'EUC-JP ('.$this->app->gettext('japanese').')',
	'EUC-KR' => 'EUC-KR ('.$this->app->gettext('korean').')',
	'EUC-CN' => 'EUC-CN ('.$this->app->gettext('chinese').')',
	'BIG5' => 'BIG5 ('.$this->app->gettext('chinese').')',
	'GB2312' => 'GB2312 ('.$this->app->gettext('chinese').')',
	);

	if (!empty($_POST['_charset'])) {
	$set = $_POST['_charset'];
	}
	else if (!empty($attrib['selected'])) {
	$set = $attrib['selected'];
	}
	else {
	$set = $this->get_charset();
	}

	$set = strtoupper($set);
	if (!isset($charsets[$set])) {
	$charsets[$set] = $set;
	}

	$select = new html_select($field_attrib);
	$select->add(array_values($charsets), array_keys($charsets));

	return $select->show($set);
	}

	/**
	* Include content from config/about.<LANG>.html if available
	*/
	protected function about_content($attrib)
	{
	$content = '';
	$filenames = array(
	'about.' . $_SESSION['language'] . '.html',
	'about.' . substr($_SESSION['language'], 0, 2) . '.html',
	'about.html',
	);
	foreach ($filenames as $file) {
	$fn = RCUBE_CONFIG_DIR . $file;
	if (is_readable($fn)) {
	$content = file_get_contents($fn);
	$content = $this->parse_conditions($content);
	$content = $this->parse_xml($content);
	break;
	}
	}

	return $content;
	}

	}
	diff --git a/program/steps/mail/get.inc b/program/steps/mail/get.inc
	index 6cda4e81d..fddb40ae8 100644
	--- a/program/steps/mail/get.inc
	+++ b/program/steps/mail/get.inc
	@@ -1,397 +1,393 @@
	<?php

	/*
	+-----------------------------------------------------------------------+
	\| program/steps/mail/get.inc \|
	\| \|
	\| This file is part of the Roundcube Webmail client \|
	\| Copyright (C) 2005-2011, The Roundcube Dev Team \|
	\| \|
	\| Licensed under the GNU General Public License version 3 or \|
	\| any later version with exceptions for skins & plugins. \|
	\| See the README file for a full license statement. \|
	\| \|
	\| PURPOSE: \|
	\| Delivering a specific part of a mail message \|
	\| \|
	+-----------------------------------------------------------------------+
	\| Author: Thomas Bruederli <roundcube@gmail.com> \|
	+-----------------------------------------------------------------------+
	*/


	// show loading page
	if (!empty($_GET['_preload'])) {
	$url = preg_replace('/([&?]+)_preload=/', '\\1_embed=', $_SERVER['REQUEST_URI']);
	$message = rcube_label('loadingdata');

	header('Content-Type: text/html; charset=' . RCMAIL_CHARSET);
	print "<html>\n<head>\n"
	. '<meta http-equiv="refresh" content="0; url='.Q($url).'">' . "\n"
	. '<meta http-equiv="content-type" content="text/html; charset='.RCMAIL_CHARSET.'">' . "\n"
	. "</head>\n<body>\n$message\n</body>\n</html>";
	exit;
	}

	ob_end_clean();


	-// define global style for warning blocks inside the attachment part frame
	-// TODO: get styles for this from skin (but we don't have a skin template here...)
	-$warning_css_style = 'border:2px solid #ffdf0e; background:#fef893; padding:0.6em 1em';
	-
	// similar code as in program/steps/mail/show.inc
	if (!empty($_GET['_uid'])) {
	$RCMAIL->config->set('prefer_html', true);
	$MESSAGE = new rcube_message(get_input_value('_uid', RCUBE_INPUT_GET));
	}

	// check connection status
	check_storage_status();

	// show part page
	if (!empty($_GET['_frame'])) {
	if (($part_id = get_input_value('_part', RCUBE_INPUT_GPC)) && ($part = $MESSAGE->mime_parts[$part_id])) {
	$OUTPUT->set_pagetitle(rcmail_attachment_name($part));
	}

	$OUTPUT->send('messagepart');
	exit;
	}

	// render thumbnail of an image attachment
	else if ($_GET['_thumb']) {
	$pid = get_input_value('_part', RCUBE_INPUT_GET);
	if ($part = $MESSAGE->mime_parts[$pid]) {
	$thumbnail_size = $RCMAIL->config->get('image_thumbnail_size', 240);
	$temp_dir = $RCMAIL->config->get('temp_dir');
	list(,$ext) = explode('/', $part->mimetype);
	$cache_basename = $temp_dir . '/' . md5($MESSAGE->headers->messageID . $part->mime_id . ':' . $RCMAIL->user->ID . ':' . $thumbnail_size);
	$cache_file = $cache_basename . '.' . $ext;
	$mimetype = $part->mimetype;

	// render thumbnail image if not done yet
	if (!is_file($cache_file)) {
	$fp = fopen(($orig_name = $cache_basename . '.orig.' . $ext), 'w');
	$MESSAGE->get_part_content($part->mime_id, $fp);
	fclose($fp);

	$image = new rcube_image($orig_name);
	if ($imgtype = $image->resize($RCMAIL->config->get('image_thumbnail_size', 240), $cache_file, true)) {
	$mimetype = 'image/' . $imgtype;
	unlink($orig_name);
	}
	else {
	rename($orig_name, $cache_file);
	}
	}

	if (is_file($cache_file)) {
	header('Content-Type: ' . $mimetype);
	readfile($cache_file);
	}
	}

	exit;
	}

	else if (strlen($pid = get_input_value('_part', RCUBE_INPUT_GET))) {

	if ($part = $MESSAGE->mime_parts[$pid]) {
	$ctype_primary = strtolower($part->ctype_primary);
	$ctype_secondary = strtolower($part->ctype_secondary);
	$mimetype = sprintf('%s/%s', $ctype_primary, $ctype_secondary);

	// allow post-processing of the message body
	$plugin = $RCMAIL->plugins->exec_hook('message_part_get',
	array('uid' => $MESSAGE->uid, 'id' => $part->mime_id, 'mimetype' => $mimetype, 'part' => $part, 'download' => !empty($_GET['_download'])));

	if ($plugin['abort'])
	exit;

	// overwrite modified vars from plugin
	$mimetype = $plugin['mimetype'];
	$extensions = rcube_mime::get_mime_extensions($mimetype);

	if ($plugin['body'])
	$part->body = $plugin['body'];


	// compare file mimetype with the stated content-type headers and file extension to avoid malicious operations
	if (!empty($_REQUEST['_embed']) && empty($_REQUEST['_nocheck'])) {
	$file_extension = strtolower(pathinfo($part->filename, PATHINFO_EXTENSION));

	// 1. compare filename suffix with expected suffix derived from mimetype
	$valid = $file_extension && in_array($file_extension, (array)$extensions);

	// 2. detect the real mimetype of the attachment part and compare it with the stated mimetype and filename extension
	if ($valid \|\| !$file_extension \|\| $mimetype == 'application/octet-stream') {
	if ($part->body) // part body is already loaded
	$body = $part->body;
	else if ($part->size && $part->size < 1024*1024) // load the entire part if it's small enough
	$body = $part->body = $MESSAGE->get_part_content($part->mime_id);
	else // fetch the first 2K of the message part
	$body = $MESSAGE->get_part_content($part->mime_id, null, true, 2048);

	// detect message part mimetype
	$real_mimetype = rcube_mime::file_content_type($body, $part->filename, $mimetype, true, true);
	list($real_ctype_primary, $real_ctype_secondary) = explode('/', $real_mimetype);

	// ignore differences in text/* mimetypes. Filetype detection isn't very reliable here
	if ($real_ctype_primary == 'text' && strpos($mimetype, $real_ctype_primary) === 0)
	$real_mimetype = $mimetype;

	// get valid file extensions
	$extensions = rcube_mime::get_mime_extensions($real_mimetype);
	$valid_extension = (!$file_extension \|\| in_array($file_extension, (array)$extensions));

	// fix mimetype for images wrongly declared as octet-stream
	if ($mimetype == 'application/octet-stream' && strpos($real_mimetype, 'image/') === 0 && $valid_extension)
	$mimetype = $real_mimetype;

	$valid = ($real_mimetype == $mimetype && $valid_extension);
	}
	else {
	$real_mimetype = $mimetype;
	}

	// show warning if validity checks failed
	if (!$valid) {
	$OUTPUT = new rcmail_html_page();
	- $OUTPUT->write(html::tag('html', null, html::tag('body', array('style' => 'font-family:sans-serif; margin:1em'),
	- html::div(array('class' => 'warning', 'style' => $warning_css_style),
	+ $OUTPUT->write(html::tag('html', null, html::tag('body', 'embed',
	+ html::div(array('class' => 'rcmail-inline-message rcmail-inline-warning'),
	rcube_label(array(
	'name' => 'attachmentvalidationerror',
	'vars' => array('expected' => "$mimetype (.$file_extension)", 'detected' => "$real_mimetype (.$extensions[0])")
	)) .
	- html::p(array('class' => 'buttons', 'style' => 'margin-bottom:0'),
	+ html::p(array('class' => 'rcmail-inline-buttons'),
	html::tag('button',
	array('onclick' => "location.href='" . $RCMAIL->url(array_merge($_GET, array('_nocheck' => 1))) . "'"),
	rcube_label('showanyway')))
	)
	)));
	exit;
	}
	}


	// TIFF to JPEG conversion, if needed
	$tiff_support = !empty($_SESSION['browser_caps']) && !empty($_SESSION['browser_caps']['tif']);
	if (!empty($_REQUEST['_embed']) && !$tiff_support
	&& $RCMAIL->config->get('im_convert_path')
	&& rcmail_part_image_type($part) == 'image/tiff'
	) {
	$tiff2jpeg = true;
	$mimetype = 'image/jpeg';
	}


	$browser = $RCMAIL->output->browser;
	list($ctype_primary, $ctype_secondary) = explode('/', $mimetype);

	// send download headers
	if ($plugin['download']) {
	header("Content-Type: application/octet-stream");
	if ($browser->ie)
	header("Content-Type: application/force-download");
	}
	else if ($ctype_primary == 'text') {
	header("Content-Type: text/$ctype_secondary; charset=" . ($part->charset ? $part->charset : RCMAIL_CHARSET));
	}
	else {
	$mimetype = rcmail_fix_mimetype($mimetype);
	header("Content-Type: $mimetype");
	header("Content-Transfer-Encoding: binary");
	}


	// deliver part content
	if ($ctype_primary == 'text' && $ctype_secondary == 'html' && empty($plugin['download'])) {
	// Check if we have enough memory to handle the message in it
	// #1487424: we need up to 10x more memory than the body
	if (!rcmail_mem_check($part->size * 10)) {
	$out = '<body>' . rcube_label('messagetoobig'). ' '
	. html::a('?_task=mail&_action=get&_download=1&_uid='.$MESSAGE->uid.'&_part='.$part->mime_id
	.'&_mbox='. urlencode($RCMAIL->storage->get_folder()), rcube_label('download')) . '</body></html>';
	}
	else {
	// get part body if not available
	if (!$part->body)
	$part->body = $MESSAGE->get_part_content($part->mime_id);

	// show images?
	rcmail_check_safe($MESSAGE);

	// render HTML body
	$out = rcmail_print_body($part, array('safe' => $MESSAGE->is_safe, 'inline_html' => false));

	// insert remote objects warning into HTML body
	if ($REMOTE_OBJECTS) {
	$body_start = 0;
	if ($body_pos = strpos($out, '<body')) {
	$body_start = strpos($out, '>', $body_pos) + 1;
	}
	$out = substr($out, 0, $body_start) .
	- html::div(array('class' => 'warning', 'style' => $warning_css_style),
	+ html::div(array('class' => 'rcmail-inline-message rcmail-inline-warning'),
	Q(rcube_label('blockedimages')) . ' ' .
	html::tag('button',
	array('onclick' => "location.href='" . $RCMAIL->url(array_merge($_GET, array('_safe' => 1))) . "'"),
	Q(rcube_label('showimages')))
	) .
	substr($out, $body_start);
	}
	}

	// check connection status
	if ($part->size && empty($part->body)) {
	check_storage_status();
	}

	$OUTPUT = new rcube_html_page();
	$OUTPUT->write($out);
	}
	else {
	// don't kill the connection if download takes more than 30 sec.
	@set_time_limit(0);

	$filename = rcmail_attachment_name($part);

	if ($browser->ie && $browser->ver < 7)
	$filename = rawurlencode(abbreviate_string($filename, 55));
	else if ($browser->ie)
	$filename = rawurlencode($filename);
	else
	$filename = addcslashes($filename, '"');

	$disposition = !empty($plugin['download']) ? 'attachment' : 'inline';

	// Workaround for nasty IE bug (#1488844)
	// If Content-Disposition header contains string "attachment" e.g. in filename
	// IE handles data as attachment not inline
	if ($disposition == 'inline' && $browser->ie && $browser->ver < 9) {
	$filename = str_ireplace('attachment', 'attach', $filename);
	}

	// add filename extension if missing
	if (!pathinfo($filename, PATHINFO_EXTENSION) && ($extensions = rcube_mime::get_mime_extensions($mimetype))) {
	$filename .= '.' . $extensions[0];
	}

	header("Content-Disposition: $disposition; filename=\"$filename\"");

	// handle tiff to jpeg conversion
	if (!empty($tiff2jpeg)) {
	$temp_dir = unslashify($RCMAIL->config->get('temp_dir'));
	$file_path = tempnam($temp_dir, 'rcmAttmnt');

	// write content to temp file
	if ($part->body) {
	$saved = file_put_contents($file_path, $part->body);
	}
	else if ($part->size) {
	$fd = fopen($file_path, 'w');
	$saved = $RCMAIL->storage->get_message_part($MESSAGE->uid, $part->mime_id, $part, false, $fd);
	fclose($fd);
	}

	// convert image to jpeg and send it to the browser
	if ($saved) {
	$image = new rcube_image($file_path);
	if ($image->convert(rcube_image::TYPE_JPG, $file_path)) {
	header("Content-Length: " . filesize($file_path));
	readfile($file_path);
	}
	unlink($file_path);
	}
	}
	// do content filtering to avoid XSS through fake images
	else if (!empty($_REQUEST['_embed']) && $browser->ie && $browser->ver <= 8) {
	if ($part->body) {
	echo preg_match('/<(script\|iframe\|object)/i', $part->body) ? '' : $part->body;
	$sent = true;
	}
	else if ($part->size) {
	$stdout = fopen('php://output', 'w');
	stream_filter_register('rcube_content', 'rcube_content_filter') or die('Failed to register content filter');
	stream_filter_append($stdout, 'rcube_content');
	$sent = $RCMAIL->storage->get_message_part($MESSAGE->uid, $part->mime_id, $part, false, $stdout);
	}
	}
	// send part as-it-is
	else {
	if ($part->body) {
	header("Content-Length: " . strlen($part->body));
	echo $part->body;
	$sent = true;
	}
	else if ($part->size) {
	if ($size = (int)$part->d_parameters['size']) {
	header("Content-Length: $size");
	}

	$sent = $RCMAIL->storage->get_message_part($MESSAGE->uid, $part->mime_id, $part, true);
	}
	}

	// check connection status
	if ($part->size && !$sent) {
	check_storage_status();
	}
	}

	exit;
	}
	}

	// print message
	else {
	// send correct headers for content type
	header("Content-Type: text/html");

	$cont = "<html>\n<head><title></title>\n</head>\n<body>";
	$cont .= rcmail_message_body(array());
	$cont .= "\n</body>\n</html>";

	$OUTPUT = new rcube_html_page();
	$OUTPUT->write($cont);

	exit;
	}


	// if we arrive here, the requested part was not found
	header('HTTP/1.1 404 Not Found');
	exit;


	function check_storage_status()
	{
	$error = rcmail::get_instance()->storage->get_error_code();

	// Check if we have a connection error
	if ($error == rcube_imap_generic::ERROR_BAD) {
	ob_end_clean();

	// Get action is often executed simultanously.
	// Some servers have MAXPERIP or other limits.
	// To workaround this we'll wait for some time
	// and try again (once).
	// Note: Random sleep interval is used to minimize concurency
	// in getting message parts

	if (!isset($_GET['_redirected'])) {
	usleep(rand(10,30)*100000); // 1-3 sec.
	header('Location: ' . $_SERVER['REQUEST_URI'] . '&_redirected=1');
	}
	else {
	raise_error(array(
	'code' => 500, 'type' => 'php',
	'file' => __FILE__, 'line' => __LINE__,
	'message' => 'Unable to get/display message part. IMAP connection error'),
	true, true);
	}

	// Don't kill session, just quit (#1486995)
	exit;
	}
	}
	diff --git a/skins/larry/embed.css b/skins/larry/embed.css
	new file mode 100644
	index 000000000..8c4e95d42
	--- /dev/null
	+++ b/skins/larry/embed.css
	@@ -0,0 +1,34 @@
	+/**
	+ * Roundcube webmail "embedded" stylesheets
	+ *
	+ * Copyright (c) 2012, The Roundcube Dev Team
	+ *
	+ * The contents are subject to the Creative Commons Attribution-ShareAlike
	+ * License. It is allowed to copy, distribute, transmit and to adapt the work
	+ * by keeping credits to the original autors in the README file.
	+ * See http://creativecommons.org/licenses/by-sa/3.0/ for details.
	+ */
	+
	+.rcmail-inline-message {
	+ font-family: sans-serif;
	+ font-size: 14px;
	+ color: #333;
	+ border: 1px solid #ffdf0e;
	+ background-color: #fef893;
	+ padding: 0.6em 1em;
	+ margin-bottom: 0.8em;
	+}
	+
	+.rcmail-inline-message > button {
	+ margin-left: 1em;
	+ vertical-align: baseline;
	+}
	+
	+.rcmail-inline-message em {
	+ font-size: 90%;
	+ color: #666;
	+}
	+
	+.rcmail-inline-buttons {
	+ margin-bottom: 0;
	+}

File Metadata

Mime Type: text/x-diff
Expires: Sat, Mar 1, 7:05 AM (1 d, 7 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 166217
Default Alt Text: (81 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions