You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

save_identity.inc 8.9KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266
  1. <?php
  2. /**
  3. +-----------------------------------------------------------------------+
  4. | program/steps/settings/save_identity.inc |
  5. | |
  6. | This file is part of the Roundcube Webmail client |
  7. | Copyright (C) 2005-2013, The Roundcube Dev Team |
  8. | |
  9. | Licensed under the GNU General Public License version 3 or |
  10. | any later version with exceptions for skins & plugins. |
  11. | See the README file for a full license statement. |
  12. | |
  13. | PURPOSE: |
  14. | Save an identity record or to add a new one |
  15. | |
  16. +-----------------------------------------------------------------------+
  17. | Author: Thomas Bruederli <roundcube@gmail.com> |
  18. +-----------------------------------------------------------------------+
  19. */
  20. define('IDENTITIES_LEVEL', intval($RCMAIL->config->get('identities_level', 0)));
  21. $a_save_cols = array('name', 'email', 'organization', 'reply-to', 'bcc', 'standard', 'signature', 'html_signature');
  22. $a_boolean_cols = array('standard', 'html_signature');
  23. $updated = $default_id = false;
  24. // check input
  25. if (empty($_POST['_email']) && (IDENTITIES_LEVEL == 0 || IDENTITIES_LEVEL == 2)) {
  26. $OUTPUT->show_message('noemailwarning', 'warning');
  27. $RCMAIL->overwrite_action('edit-identity');
  28. return;
  29. }
  30. $save_data = array();
  31. foreach ($a_save_cols as $col) {
  32. $fname = '_'.$col;
  33. if (isset($_POST[$fname])) {
  34. $save_data[$col] = rcube_utils::get_input_value($fname, rcube_utils::INPUT_POST, true);
  35. }
  36. }
  37. // set "off" values for checkboxes that were not checked, and therefore
  38. // not included in the POST body.
  39. foreach ($a_boolean_cols as $col) {
  40. $fname = '_' . $col;
  41. if (!isset($_POST[$fname])) {
  42. $save_data[$col] = 0;
  43. }
  44. }
  45. // make the identity a "default" if only one identity is allowed
  46. if (IDENTITIES_LEVEL > 1) {
  47. $save_data['standard'] = 1;
  48. }
  49. // unset email address if user has no rights to change it
  50. if (IDENTITIES_LEVEL == 1 || IDENTITIES_LEVEL == 3) {
  51. unset($save_data['email']);
  52. }
  53. // unset all fields except signature
  54. else if (IDENTITIES_LEVEL == 4) {
  55. foreach ($save_data as $idx => $value) {
  56. if ($idx != 'signature' && $idx != 'html_signature') {
  57. unset($save_data[$idx]);
  58. }
  59. }
  60. }
  61. // Validate e-mail addresses
  62. $email_checks = array(rcube_utils::idn_to_ascii($save_data['email']));
  63. foreach (array('reply-to', 'bcc') as $item) {
  64. foreach (rcube_mime::decode_address_list($save_data[$item], null, false) as $rcpt) {
  65. $email_checks[] = rcube_utils::idn_to_ascii($rcpt['mailto']);
  66. }
  67. }
  68. foreach ($email_checks as $email) {
  69. if ($email && !rcube_utils::check_email($email)) {
  70. // show error message
  71. $OUTPUT->show_message('emailformaterror', 'error', array('email' => rcube_utils::idn_to_utf8($email)), false);
  72. $RCMAIL->overwrite_action('edit-identity');
  73. return;
  74. }
  75. }
  76. if (!empty($save_data['signature']) && !empty($save_data['html_signature'])) {
  77. // replace uploaded images with data URIs
  78. $save_data['signature'] = rcmail_attach_images($save_data['signature']);
  79. // XSS protection in HTML signature (#1489251)
  80. $save_data['signature'] = rcmail_wash_html($save_data['signature']);
  81. // clear POST data of signature, we want to use safe content
  82. // when the form is displayed again
  83. unset($_POST['_signature']);
  84. }
  85. // update an existing contact
  86. if ($_POST['_iid']) {
  87. $iid = rcube_utils::get_input_value('_iid', rcube_utils::INPUT_POST);
  88. if (in_array(IDENTITIES_LEVEL, array(1,3,4))) {
  89. // merge with old identity data, fixes #1488834
  90. $identity = $RCMAIL->user->get_identity($iid);
  91. $save_data = array_merge($identity, $save_data);
  92. unset($save_data['changed'], $save_data['del'], $save_data['user_id'], $save_data['identity_id']);
  93. }
  94. $plugin = $RCMAIL->plugins->exec_hook('identity_update', array('id' => $iid, 'record' => $save_data));
  95. $save_data = $plugin['record'];
  96. if ($save_data['email']) {
  97. $save_data['email'] = rcube_utils::idn_to_ascii($save_data['email']);
  98. }
  99. if (!$plugin['abort'])
  100. $updated = $RCMAIL->user->update_identity($iid, $save_data);
  101. else
  102. $updated = $plugin['result'];
  103. if ($updated) {
  104. $OUTPUT->show_message('successfullysaved', 'confirmation');
  105. if (!empty($save_data['standard'])) {
  106. $default_id = $iid;
  107. }
  108. if ($_POST['_framed']) {
  109. // update the changed col in list
  110. $name = $save_data['name'] . ' <' . rcube_utils::idn_to_utf8($save_data['email']) .'>';
  111. $OUTPUT->command('parent.update_identity_row', $iid, rcube::Q(trim($name)));
  112. }
  113. }
  114. else {
  115. // show error message
  116. $OUTPUT->show_message($plugin['message'] ?: 'errorsaving', 'error', null, false);
  117. $RCMAIL->overwrite_action('edit-identity');
  118. return;
  119. }
  120. }
  121. // insert a new identity record
  122. else if (IDENTITIES_LEVEL < 2) {
  123. if (IDENTITIES_LEVEL == 1) {
  124. $save_data['email'] = $RCMAIL->get_user_email();
  125. }
  126. $plugin = $RCMAIL->plugins->exec_hook('identity_create', array('record' => $save_data));
  127. $save_data = $plugin['record'];
  128. if ($save_data['email']) {
  129. $save_data['email'] = rcube_utils::idn_to_ascii($save_data['email']);
  130. }
  131. if (!$plugin['abort'])
  132. $insert_id = $save_data['email'] ? $RCMAIL->user->insert_identity($save_data) : null;
  133. else
  134. $insert_id = $plugin['result'];
  135. if ($insert_id) {
  136. $RCMAIL->plugins->exec_hook('identity_create_after', array('id' => $insert_id, 'record' => $save_data));
  137. $OUTPUT->show_message('successfullysaved', 'confirmation', null, false);
  138. $_GET['_iid'] = $insert_id;
  139. if (!empty($save_data['standard'])) {
  140. $default_id = $insert_id;
  141. }
  142. if ($_POST['_framed']) {
  143. // add a new row to the list
  144. $name = $save_data['name'] . ' <' . rcube_utils::idn_to_utf8($save_data['email']) .'>';
  145. $OUTPUT->command('parent.update_identity_row', $insert_id, rcube::Q(trim($name)), true);
  146. }
  147. }
  148. else {
  149. // show error message
  150. $OUTPUT->show_message($plugin['message'] ?: 'errorsaving', 'error', null, false);
  151. $RCMAIL->overwrite_action('edit-identity');
  152. return;
  153. }
  154. }
  155. else {
  156. $OUTPUT->show_message('opnotpermitted', 'error');
  157. }
  158. // mark all other identities as 'not-default'
  159. if ($default_id) {
  160. $RCMAIL->user->set_default($default_id);
  161. }
  162. // go to next step
  163. if (!empty($_REQUEST['_framed'])) {
  164. $RCMAIL->overwrite_action('edit-identity');
  165. }
  166. else {
  167. $RCMAIL->overwrite_action('identities');
  168. }
  169. /**
  170. * Attach uploaded images into signature as data URIs
  171. */
  172. function rcmail_attach_images($html)
  173. {
  174. global $RCMAIL;
  175. $offset = 0;
  176. $regexp = '/\s(poster|src)\s*=\s*[\'"]*\S+upload-display\S+file=rcmfile(\w+)[\s\'"]*/';
  177. while (preg_match($regexp, $html, $matches, 0, $offset)) {
  178. $file_id = $matches[2];
  179. $data_uri = ' ';
  180. if ($file_id && ($file = $_SESSION['identity']['files'][$file_id])) {
  181. $file = $RCMAIL->plugins->exec_hook('attachment_get', $file);
  182. $data_uri .= 'src="data:' . $file['mimetype'] . ';base64,';
  183. $data_uri .= base64_encode($file['data'] ?: file_get_contents($file['path']));
  184. $data_uri .= '" ';
  185. }
  186. $html = str_replace($matches[0], $data_uri, $html);
  187. $offset += strlen($data_uri) - strlen($matches[0]) + 1;
  188. }
  189. return $html;
  190. }
  191. /**
  192. * Sanity checks/cleanups on HTML body of signature
  193. */
  194. function rcmail_wash_html($html)
  195. {
  196. // Add header with charset spec., washtml cannot work without that
  197. $html = '<html><head>'
  198. . '<meta http-equiv="Content-Type" content="text/html; charset='.RCUBE_CHARSET.'" />'
  199. . '</head><body>' . $html . '</body></html>';
  200. // clean HTML with washhtml by Frederic Motte
  201. $wash_opts = array(
  202. 'show_washed' => false,
  203. 'allow_remote' => 1,
  204. 'charset' => RCUBE_CHARSET,
  205. 'html_elements' => array('body', 'link'),
  206. 'html_attribs' => array('rel', 'type'),
  207. );
  208. // initialize HTML washer
  209. $washer = new rcube_washtml($wash_opts);
  210. //$washer->add_callback('form', 'rcmail_washtml_callback');
  211. //$washer->add_callback('style', 'rcmail_washtml_callback');
  212. // Remove non-UTF8 characters (#1487813)
  213. $html = rcube_charset::clean($html);
  214. $html = $washer->wash($html);
  215. // remove unwanted comments and tags (produced by washtml)
  216. $html = preg_replace(array('/<!--[^>]+-->/', '/<\/?body>/'), '', $html);
  217. return $html;
  218. }