From fe9a23f542bc56c1c0b6dc30257418e38ff7bd3a Mon Sep 17 00:00:00 2001
From: ftimme <ft@falkotimme.com>
Date: Sat, 08 Jun 2013 18:57:40 -0400
Subject: [PATCH] - Fixed FS#2936 - Please check and limit username input length.
---
interface/web/mail/mail_user_edit.php | 44 ++++++++++++++++++++++++++------------------
1 files changed, 26 insertions(+), 18 deletions(-)
diff --git a/interface/web/mail/mail_user_edit.php b/interface/web/mail/mail_user_edit.php
index 398bf12..ca973c5 100644
--- a/interface/web/mail/mail_user_edit.php
+++ b/interface/web/mail/mail_user_edit.php
@@ -73,7 +73,8 @@
$email = $this->dataRecord["email"];
$email_parts = explode("@",$email);
$app->tpl->setVar("email_local_part",$email_parts[0]);
-
+ $email_parts[1] = $app->functions->idn_decode($email_parts[1]);
+
// Getting Domains of the user
// $sql = "SELECT domain, server_id FROM mail_domain WHERE ".$app->tform->getAuthSQL('r').' ORDER BY domain';
$sql = "SELECT domain, server_id FROM mail_domain WHERE domain NOT IN (SELECT SUBSTR(source,2) FROM mail_forwarding WHERE type = 'aliasdomain') AND ".$app->tform->getAuthSQL('r')." ORDER BY domain";
@@ -81,6 +82,7 @@
$domain_select = '';
if(is_array($domains)) {
foreach( $domains as $domain) {
+ $domain['domain'] = $app->functions->idn_decode($domain['domain']);
$selected = ($domain["domain"] == @$email_parts[1])?'SELECTED':'';
$domain_select .= "<option value='$domain[domain]' $selected>$domain[domain]</option>\r\n";
}
@@ -109,10 +111,16 @@
if($this->dataRecord["quota"] != -1) $app->tpl->setVar("quota",$this->dataRecord["quota"] / 1024 / 1024);
// Is autoresponder set?
- if ($this->dataRecord['autoresponder'] == 'y') {
+ if (!empty($this->dataRecord['autoresponder']) && $this->dataRecord['autoresponder'] == 'y') {
$app->tpl->setVar("ar_active", 'checked="checked"');
} else {
$app->tpl->setVar("ar_active", '');
+ }
+
+ if($this->dataRecord['autoresponder_subject'] == '') {
+ $app->tpl->setVar('autoresponder_subject', $app->tform->lng('autoresponder_subject'));
+ } else {
+ $app->tpl->setVar('autoresponder_subject', $this->dataRecord['autoresponder_subject']);
}
$app->uses('getconf');
@@ -131,8 +139,8 @@
//* Check if Domain belongs to user
if(isset($_POST["email_domain"])) {
- $domain = $app->db->queryOneRecord("SELECT server_id, domain FROM mail_domain WHERE domain = '".$app->db->quote($_POST["email_domain"])."' AND ".$app->tform->getAuthSQL('r'));
- if($domain["domain"] != $_POST["email_domain"]) $app->tform->errorMessage .= $app->tform->lng("no_domain_perm");
+ $domain = $app->db->queryOneRecord("SELECT server_id, domain FROM mail_domain WHERE domain = '".$app->db->quote($app->functions->idn_encode($_POST["email_domain"]))."' AND ".$app->tform->getAuthSQL('r'));
+ if($domain["domain"] != $app->functions->idn_encode($_POST["email_domain"])) $app->tform->errorMessage .= $app->tform->lng("no_domain_perm");
}
@@ -159,9 +167,9 @@
// Check the quota and adjust
if(isset($_POST["quota"]) && $client["limit_mailquota"] >= 0) {
- $tmp = $app->db->queryOneRecord("SELECT sum(quota) as mailquota FROM mail_user WHERE mailuser_id != ".intval($this->id)." AND ".$app->tform->getAuthSQL('u'));
+ $tmp = $app->db->queryOneRecord("SELECT sum(quota) as mailquota FROM mail_user WHERE mailuser_id != ".$app->functions->intval($this->id)." AND ".$app->tform->getAuthSQL('u'));
$mailquota = $tmp["mailquota"] / 1024 / 1024;
- $new_mailbox_quota = intval($this->dataRecord["quota"]);
+ $new_mailbox_quota = $app->functions->intval($this->dataRecord["quota"]);
if(($mailquota + $new_mailbox_quota > $client["limit_mailquota"]) || ($new_mailbox_quota == 0 && $client["limit_mailquota"] != -1)) {
$max_free_quota = $client["limit_mailquota"] - $mailquota;
$app->tform->errorMessage .= $app->tform->lng("limit_mailquota_txt").": ".$max_free_quota."<br>";
@@ -175,11 +183,11 @@
$app->uses('getconf');
- $mail_config = $app->getconf->get_server_config($domain["server_id"],'mail');
+ $mail_config = $app->getconf->get_server_config(!empty($domain["server_id"]) ? $domain["server_id"] : '','mail');
//* compose the email field
if(isset($_POST["email_local_part"]) && isset($_POST["email_domain"])) {
- $this->dataRecord["email"] = strtolower($_POST["email_local_part"]."@".$_POST["email_domain"]);
+ $this->dataRecord["email"] = strtolower($_POST["email_local_part"]."@".$app->functions->idn_encode($_POST["email_domain"]));
// Set the server id of the mailbox = server ID of mail domain.
$this->dataRecord["server_id"] = $domain["server_id"];
@@ -207,10 +215,10 @@
$sys_config = $app->getconf->get_global_config('mail');
if($sys_config["enable_custom_login"] == "y") {
- if(!isset($_POST["login"])) $this->dataRecord["login"] = $this->dataRecord["email"];
+ if(!isset($_POST["login"]) || $_POST["login"] == '') $this->dataRecord["login"] = $this->dataRecord["email"];
elseif(strpos($_POST["login"], '@') !== false && $_POST["login"] != $this->dataRecord["email"]) $app->tform->errorMessage .= $app->tform->lng("error_login_email_txt")."<br>";
} else {
- $this->dataRecord["login"] = $this->dataRecord["email"];
+ $this->dataRecord["login"] = isset($this->dataRecord["email"]) ? $this->dataRecord["email"] : '';
}
//* if autoresponder checkbox not selected, do not save dates
if (!isset($_POST['autoresponder']) && array_key_exists('autoresponder_start_date', $_POST)) {
@@ -225,11 +233,11 @@
global $app, $conf;
// Set the domain owner as mailbox owner
- $domain = $app->db->queryOneRecord("SELECT sys_groupid, server_id FROM mail_domain WHERE domain = '".$app->db->quote($_POST["email_domain"])."' AND ".$app->tform->getAuthSQL('r'));
+ $domain = $app->db->queryOneRecord("SELECT sys_groupid, server_id FROM mail_domain WHERE domain = '".$app->db->quote($app->functions->idn_encode($_POST["email_domain"]))."' AND ".$app->tform->getAuthSQL('r'));
$app->db->query("UPDATE mail_user SET sys_groupid = ".$domain["sys_groupid"]." WHERE mailuser_id = ".$this->id);
// Spamfilter policy
- $policy_id = intval($this->dataRecord["policy"]);
+ $policy_id = $app->functions->intval($this->dataRecord["policy"]);
if($policy_id > 0) {
$tmp_user = $app->db->queryOneRecord("SELECT id FROM spamfilter_users WHERE email = '".$app->db->quote($this->dataRecord["email"])."'");
if($tmp_user["id"] > 0) {
@@ -251,7 +259,7 @@
$disabledeliver = ($this->dataRecord["postfix"] == 'y')?'n':'y';
$disablesmtp = ($this->dataRecord["postfix"] == 'y')?'n':'y';
- $sql = "UPDATE mail_user SET disableimap = '$disableimap', disablesieve = '$disableimap', disablepop3 = '$disablepop3', disablesmtp = '$disablesmtp', disabledeliver = '$disabledeliver', disablelda = '$disabledeliver' WHERE mailuser_id = ".$this->id;
+ $sql = "UPDATE mail_user SET disableimap = '$disableimap', disablesieve = '$disableimap', disablepop3 = '$disablepop3', disablesmtp = '$disablesmtp', disabledeliver = '$disabledeliver', disablelda = '$disabledeliver', disabledoveadm = '$disableimap' WHERE mailuser_id = ".$this->id;
$app->db->query($sql);
}
}
@@ -261,11 +269,11 @@
// Set the domain owner as mailbox owner
if(isset($_POST["email_domain"])) {
- $domain = $app->db->queryOneRecord("SELECT sys_groupid, server_id FROM mail_domain WHERE domain = '".$app->db->quote($_POST["email_domain"])."' AND ".$app->tform->getAuthSQL('r'));
+ $domain = $app->db->queryOneRecord("SELECT sys_groupid, server_id FROM mail_domain WHERE domain = '".$app->db->quote($app->functions->idn_encode($_POST["email_domain"]))."' AND ".$app->tform->getAuthSQL('r'));
$app->db->query("UPDATE mail_user SET sys_groupid = ".$domain["sys_groupid"]." WHERE mailuser_id = ".$this->id);
// Spamfilter policy
- $policy_id = intval($this->dataRecord["policy"]);
+ $policy_id = $app->functions->intval($this->dataRecord["policy"]);
$tmp_user = $app->db->queryOneRecord("SELECT id FROM spamfilter_users WHERE email = '".$app->db->quote($this->dataRecord["email"])."'");
if($policy_id > 0) {
if($tmp_user["id"] > 0) {
@@ -287,12 +295,12 @@
// Set the fields for dovecot
if(isset($this->dataRecord["email"])) {
- $disableimap = ($this->dataRecord["disableimap"])?'y':'n';
- $disablepop3 = ($this->dataRecord["disablepop3"])?'y':'n';
+ $disableimap = (isset($this->dataRecord["disableimap"]) && $this->dataRecord["disableimap"])?'y':'n';
+ $disablepop3 = (isset($this->dataRecord["disablepop3"]) && $this->dataRecord["disablepop3"])?'y':'n';
$disabledeliver = ($this->dataRecord["postfix"] == 'y')?'n':'y';
$disablesmtp = ($this->dataRecord["postfix"] == 'y')?'n':'y';
- $sql = "UPDATE mail_user SET disableimap = '$disableimap', disablesieve = '$disableimap', disablepop3 = '$disablepop3', disablesmtp = '$disablesmtp', disabledeliver = '$disabledeliver', disablelda = '$disabledeliver' WHERE mailuser_id = ".$this->id;
+ $sql = "UPDATE mail_user SET disableimap = '$disableimap', disablesieve = '$disableimap', disablepop3 = '$disablepop3', disablesmtp = '$disablesmtp', disabledeliver = '$disabledeliver', disablelda = '$disabledeliver', disabledoveadm = '$disableimap' WHERE mailuser_id = ".$this->id;
$app->db->query($sql);
}
--
Gitblit v1.9.1