From 2cb1563f63386b35a69e460051aa9b4a2851d104 Mon Sep 17 00:00:00 2001
From: ftimme <ft@falkotimme.com>
Date: Wed, 30 May 2012 07:30:44 -0400
Subject: [PATCH] - Added (clickable) placeholders to client messaging function. - Added check so that the client password isn't inserted into the message (for security reasons).
---
interface/web/mail/mail_user_edit.php | 18 +++++++++---------
1 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/interface/web/mail/mail_user_edit.php b/interface/web/mail/mail_user_edit.php
index f57a4e8..2c1ee3e 100644
--- a/interface/web/mail/mail_user_edit.php
+++ b/interface/web/mail/mail_user_edit.php
@@ -109,7 +109,7 @@
if($this->dataRecord["quota"] != -1) $app->tpl->setVar("quota",$this->dataRecord["quota"] / 1024 / 1024);
// Is autoresponder set?
- if ($this->dataRecord['autoresponder'] == 'y') {
+ if (!empty($this->dataRecord['autoresponder']) && $this->dataRecord['autoresponder'] == 'y') {
$app->tpl->setVar("ar_active", 'checked="checked"');
} else {
$app->tpl->setVar("ar_active", '');
@@ -175,7 +175,7 @@
$app->uses('getconf');
- $mail_config = $app->getconf->get_server_config($domain["server_id"],'mail');
+ $mail_config = $app->getconf->get_server_config(!empty($domain["server_id"]) ? $domain["server_id"] : '','mail');
//* compose the email field
if(isset($_POST["email_local_part"]) && isset($_POST["email_domain"])) {
@@ -210,7 +210,7 @@
if(!isset($_POST["login"])) $this->dataRecord["login"] = $this->dataRecord["email"];
elseif(strpos($_POST["login"], '@') !== false && $_POST["login"] != $this->dataRecord["email"]) $app->tform->errorMessage .= $app->tform->lng("error_login_email_txt")."<br>";
} else {
- $this->dataRecord["login"] = $this->dataRecord["email"];
+ $this->dataRecord["login"] = isset($this->dataRecord["email"]) ? $this->dataRecord["email"] : '';
}
//* if autoresponder checkbox not selected, do not save dates
if (!isset($_POST['autoresponder']) && array_key_exists('autoresponder_start_date', $_POST)) {
@@ -231,14 +231,14 @@
// Spamfilter policy
$policy_id = intval($this->dataRecord["policy"]);
if($policy_id > 0) {
- $tmp_user = $app->db->queryOneRecord("SELECT id FROM spamfilter_users WHERE email = '".mysql_real_escape_string($this->dataRecord["email"])."'");
+ $tmp_user = $app->db->queryOneRecord("SELECT id FROM spamfilter_users WHERE email = '".$app->db->quote($this->dataRecord["email"])."'");
if($tmp_user["id"] > 0) {
// There is already a record that we will update
$app->db->datalogUpdate('spamfilter_users', "policy_id = $policy_id", 'id', $tmp_user["id"]);
} else {
// We create a new record
$insert_data = "(`sys_userid`, `sys_groupid`, `sys_perm_user`, `sys_perm_group`, `sys_perm_other`, `server_id`, `priority`, `policy_id`, `email`, `fullname`, `local`)
- VALUES (".$_SESSION["s"]["user"]["userid"].", ".$domain["sys_groupid"].", 'riud', 'riud', '', ".$domain["server_id"].", 10, ".$policy_id.", '".mysql_real_escape_string($this->dataRecord["email"])."', '".mysql_real_escape_string($this->dataRecord["email"])."', 'Y')";
+ VALUES (".$_SESSION["s"]["user"]["userid"].", ".$domain["sys_groupid"].", 'riud', 'riud', '', ".$domain["server_id"].", 10, ".$policy_id.", '".$app->db->quote($this->dataRecord["email"])."', '".$app->db->quote($this->dataRecord["email"])."', 'Y')";
$app->db->datalogInsert('spamfilter_users', $insert_data, 'id');
}
} // endif spamfilter policy
@@ -266,7 +266,7 @@
// Spamfilter policy
$policy_id = intval($this->dataRecord["policy"]);
- $tmp_user = $app->db->queryOneRecord("SELECT id FROM spamfilter_users WHERE email = '".mysql_real_escape_string($this->dataRecord["email"])."'");
+ $tmp_user = $app->db->queryOneRecord("SELECT id FROM spamfilter_users WHERE email = '".$app->db->quote($this->dataRecord["email"])."'");
if($policy_id > 0) {
if($tmp_user["id"] > 0) {
// There is already a record that we will update
@@ -274,7 +274,7 @@
} else {
// We create a new record
$insert_data = "(`sys_userid`, `sys_groupid`, `sys_perm_user`, `sys_perm_group`, `sys_perm_other`, `server_id`, `priority`, `policy_id`, `email`, `fullname`, `local`)
- VALUES (".$_SESSION["s"]["user"]["userid"].", ".$domain["sys_groupid"].", 'riud', 'riud', '', ".$domain["server_id"].", 10, ".$policy_id.", '".mysql_real_escape_string($this->dataRecord["email"])."', '".mysql_real_escape_string($this->dataRecord["email"])."', 'Y')";
+ VALUES (".$_SESSION["s"]["user"]["userid"].", ".$domain["sys_groupid"].", 'riud', 'riud', '', ".$domain["server_id"].", 10, ".$policy_id.", '".$app->db->quote($this->dataRecord["email"])."', '".$app->db->quote($this->dataRecord["email"])."', 'Y')";
$app->db->datalogInsert('spamfilter_users', $insert_data, 'id');
}
}else {
@@ -287,8 +287,8 @@
// Set the fields for dovecot
if(isset($this->dataRecord["email"])) {
- $disableimap = ($this->dataRecord["disableimap"])?'y':'n';
- $disablepop3 = ($this->dataRecord["disablepop3"])?'y':'n';
+ $disableimap = (isset($this->dataRecord["disableimap"]) && $this->dataRecord["disableimap"])?'y':'n';
+ $disablepop3 = (isset($this->dataRecord["disablepop3"]) && $this->dataRecord["disablepop3"])?'y':'n';
$disabledeliver = ($this->dataRecord["postfix"] == 'y')?'n':'y';
$disablesmtp = ($this->dataRecord["postfix"] == 'y')?'n':'y';
--
Gitblit v1.9.1