From e20f50fafc314174a0c8a18c0756b4c6626ada34 Mon Sep 17 00:00:00 2001 From: andryyy Date: Sun, 17 Sep 2017 14:38:05 +0200 Subject: [PATCH 01/84] [Web] Fix spacing --- data/web/admin.php | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/data/web/admin.php b/data/web/admin.php index 714a31d2..1a84d410 100644 --- a/data/web/admin.php +++ b/data/web/admin.php @@ -149,10 +149,10 @@ $tfa_data = get_tfa();
-

Domain:
- - Selector '' - bit +

Domain: +

+

Selector ''

+

bit

@@ -179,10 +179,10 @@ $tfa_data = get_tfa();
-

↳ Alias-Domain:
- - Selector '' - bit +

↳ Alias-Domain: +

+

Selector ''

+

bit

@@ -211,10 +211,10 @@ $tfa_data = get_tfa();
-

Domain:
- - Selector '' - bit +

Domain: +

+

Selector ''

+

bit

From e07f84d0f0d3fe800b341581322ec619b072e80d Mon Sep 17 00:00:00 2001 From: andryyy Date: Sun, 17 Sep 2017 14:39:10 +0200 Subject: [PATCH 02/84] [Web] Update phpmailer, always use correct path for vars.inc.php --- data/web/inc/lib/composer.lock | 11 +- .../inc/lib/vendor/composer/installed.json | 13 +- .../phpmailer/.github/ISSUE_TEMPLATE.md | 1 + .../.github/PULL_REQUEST_TEMPLATE.md | 1 + .../lib/vendor/phpmailer/phpmailer/VERSION | 2 +- .../phpmailer/phpmailer/class.phpmailer.php | 23 +-- .../vendor/phpmailer/phpmailer/class.pop3.php | 2 +- .../vendor/phpmailer/phpmailer/class.smtp.php | 65 +++++--- .../vendor/phpmailer/phpmailer/composer.json | 1 + .../phpmailer/examples/code_generator.phps | 141 +++++++++--------- .../phpmailer/phpmailer/examples/gmail.phps | 24 +++ .../phpmailer/examples/gmail_xoauth.phps | 4 +- .../phpmailer/phpmailer/extras/README.md | 8 +- .../phpmailer/language/phpmailer.lang-ba.php | 26 ++++ .../phpmailer/language/phpmailer.lang-nb.php | 32 ++-- .../language/phpmailer.lang-pt_br.php | 3 +- ...iler.lang-sr.php => phpmailer.lang-rs.php} | 2 +- .../phpmailer/language/phpmailer.lang-tr.php | 3 +- .../language/phpmailer.lang-zh_cn.php | 7 +- data/web/inc/prerequisites.inc.php | 2 +- 20 files changed, 232 insertions(+), 139 deletions(-) create mode 100644 data/web/inc/lib/vendor/phpmailer/phpmailer/.github/ISSUE_TEMPLATE.md create mode 100644 data/web/inc/lib/vendor/phpmailer/phpmailer/.github/PULL_REQUEST_TEMPLATE.md create mode 100644 data/web/inc/lib/vendor/phpmailer/phpmailer/language/phpmailer.lang-ba.php rename data/web/inc/lib/vendor/phpmailer/phpmailer/language/{phpmailer.lang-sr.php => phpmailer.lang-rs.php} (96%) diff --git a/data/web/inc/lib/composer.lock b/data/web/inc/lib/composer.lock index b8f2c262..7199acc9 100644 --- a/data/web/inc/lib/composer.lock +++ b/data/web/inc/lib/composer.lock @@ -8,19 +8,20 @@ "packages": [ { "name": "phpmailer/phpmailer", - "version": "v5.2.23", + "version": "v5.2.25", "source": { "type": "git", "url": "https://github.com/PHPMailer/PHPMailer.git", - "reference": "7115df4a6f76281109ebe352900c42403b728bb4" + "reference": "2baf20b01690fba8cf720c1ebcf9b988eda50915" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/PHPMailer/PHPMailer/zipball/7115df4a6f76281109ebe352900c42403b728bb4", - "reference": "7115df4a6f76281109ebe352900c42403b728bb4", + "url": "https://api.github.com/repos/PHPMailer/PHPMailer/zipball/2baf20b01690fba8cf720c1ebcf9b988eda50915", + "reference": "2baf20b01690fba8cf720c1ebcf9b988eda50915", "shasum": "" }, "require": { + "ext-ctype": "*", "php": ">=5.0.0" }, "require-dev": { @@ -80,7 +81,7 @@ } ], "description": "PHPMailer is a full-featured email creation and transfer class for PHP", - "time": "2017-03-15T19:32:56+00:00" + "time": "2017-08-28T11:12:07+00:00" }, { "name": "robthree/twofactorauth", diff --git a/data/web/inc/lib/vendor/composer/installed.json b/data/web/inc/lib/vendor/composer/installed.json index 25c6c914..790d0662 100644 --- a/data/web/inc/lib/vendor/composer/installed.json +++ b/data/web/inc/lib/vendor/composer/installed.json @@ -91,20 +91,21 @@ }, { "name": "phpmailer/phpmailer", - "version": "v5.2.23", - "version_normalized": "5.2.23.0", + "version": "v5.2.25", + "version_normalized": "5.2.25.0", "source": { "type": "git", "url": "https://github.com/PHPMailer/PHPMailer.git", - "reference": "7115df4a6f76281109ebe352900c42403b728bb4" + "reference": "2baf20b01690fba8cf720c1ebcf9b988eda50915" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/PHPMailer/PHPMailer/zipball/7115df4a6f76281109ebe352900c42403b728bb4", - "reference": "7115df4a6f76281109ebe352900c42403b728bb4", + "url": "https://api.github.com/repos/PHPMailer/PHPMailer/zipball/2baf20b01690fba8cf720c1ebcf9b988eda50915", + "reference": "2baf20b01690fba8cf720c1ebcf9b988eda50915", "shasum": "" }, "require": { + "ext-ctype": "*", "php": ">=5.0.0" }, "require-dev": { @@ -130,7 +131,7 @@ "suggest": { "league/oauth2-google": "Needed for Google XOAUTH2 authentication" }, - "time": "2017-03-15T19:32:56+00:00", + "time": "2017-08-28T11:12:07+00:00", "type": "library", "installation-source": "dist", "autoload": { diff --git a/data/web/inc/lib/vendor/phpmailer/phpmailer/.github/ISSUE_TEMPLATE.md b/data/web/inc/lib/vendor/phpmailer/phpmailer/.github/ISSUE_TEMPLATE.md new file mode 100644 index 00000000..97776f1c --- /dev/null +++ b/data/web/inc/lib/vendor/phpmailer/phpmailer/.github/ISSUE_TEMPLATE.md @@ -0,0 +1 @@ +Non-security issues and pull requests are no longer being accepted for the legacy PHPMailer 5.2 branch. Migrate to PHPMailer 6.0 (or later) and report your issue there. \ No newline at end of file diff --git a/data/web/inc/lib/vendor/phpmailer/phpmailer/.github/PULL_REQUEST_TEMPLATE.md b/data/web/inc/lib/vendor/phpmailer/phpmailer/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 00000000..97776f1c --- /dev/null +++ b/data/web/inc/lib/vendor/phpmailer/phpmailer/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1 @@ +Non-security issues and pull requests are no longer being accepted for the legacy PHPMailer 5.2 branch. Migrate to PHPMailer 6.0 (or later) and report your issue there. \ No newline at end of file diff --git a/data/web/inc/lib/vendor/phpmailer/phpmailer/VERSION b/data/web/inc/lib/vendor/phpmailer/phpmailer/VERSION index 3ace8b4b..f23b9706 100644 --- a/data/web/inc/lib/vendor/phpmailer/phpmailer/VERSION +++ b/data/web/inc/lib/vendor/phpmailer/phpmailer/VERSION @@ -1 +1 @@ -5.2.23 +5.2.25 diff --git a/data/web/inc/lib/vendor/phpmailer/phpmailer/class.phpmailer.php b/data/web/inc/lib/vendor/phpmailer/phpmailer/class.phpmailer.php index 1b31ec14..8042b384 100644 --- a/data/web/inc/lib/vendor/phpmailer/phpmailer/class.phpmailer.php +++ b/data/web/inc/lib/vendor/phpmailer/phpmailer/class.phpmailer.php @@ -31,7 +31,7 @@ class PHPMailer * The PHPMailer Version number. * @var string */ - public $Version = '5.2.23'; + public $Version = '5.2.25'; /** * Email priority. @@ -440,9 +440,9 @@ class PHPMailer * * Parameters: * boolean $result result of the send action - * string $to email address of the recipient - * string $cc cc email addresses - * string $bcc bcc email addresses + * array $to email addresses of the recipients + * array $cc cc email addresses + * array $bcc bcc email addresses * string $subject the subject * string $body the email body * string $from email address of sender @@ -1622,8 +1622,13 @@ class PHPMailer foreach ($hosts as $hostentry) { $hostinfo = array(); - if (!preg_match('/^((ssl|tls):\/\/)*([a-zA-Z0-9\.-]*):?([0-9]*)$/', trim($hostentry), $hostinfo)) { + if (!preg_match( + '/^((ssl|tls):\/\/)*([a-zA-Z0-9\.-]*|\[[a-fA-F0-9:]+\]):?([0-9]*)$/', + trim($hostentry), + $hostinfo + )) { // Not a valid host entry + $this->edebug('Ignoring invalid host: ' . $hostentry); continue; } // $hostinfo[2]: optional ssl or tls prefix @@ -1742,6 +1747,7 @@ class PHPMailer 'dk' => 'da', 'no' => 'nb', 'se' => 'sv', + 'sr' => 'rs' ); if (isset($renamed_langcodes[$langcode])) { @@ -2024,10 +2030,7 @@ class PHPMailer { $result = ''; - if ($this->MessageDate == '') { - $this->MessageDate = self::rfcDate(); - } - $result .= $this->headerLine('Date', $this->MessageDate); + $result .= $this->headerLine('Date', $this->MessageDate == '' ? self::rfcDate() : $this->MessageDate); // To be created automatically by mail() if ($this->SingleTo) { @@ -4033,7 +4036,7 @@ class phpmailerException extends Exception */ public function errorMessage() { - $errorMsg = '' . $this->getMessage() . "
\n"; + $errorMsg = '' . htmlspecialchars($this->getMessage()) . "
\n"; return $errorMsg; } } diff --git a/data/web/inc/lib/vendor/phpmailer/phpmailer/class.pop3.php b/data/web/inc/lib/vendor/phpmailer/phpmailer/class.pop3.php index c464f90c..f2c4e374 100644 --- a/data/web/inc/lib/vendor/phpmailer/phpmailer/class.pop3.php +++ b/data/web/inc/lib/vendor/phpmailer/phpmailer/class.pop3.php @@ -34,7 +34,7 @@ class POP3 * @var string * @access public */ - public $Version = '5.2.23'; + public $Version = '5.2.25'; /** * Default POP3 port number. diff --git a/data/web/inc/lib/vendor/phpmailer/phpmailer/class.smtp.php b/data/web/inc/lib/vendor/phpmailer/phpmailer/class.smtp.php index 01cee820..d8af427e 100644 --- a/data/web/inc/lib/vendor/phpmailer/phpmailer/class.smtp.php +++ b/data/web/inc/lib/vendor/phpmailer/phpmailer/class.smtp.php @@ -30,7 +30,7 @@ class SMTP * The PHPMailer SMTP version number. * @var string */ - const VERSION = '5.2.23'; + const VERSION = '5.2.25'; /** * SMTP line break constant. @@ -81,7 +81,7 @@ class SMTP * @deprecated Use the `VERSION` constant instead * @see SMTP::VERSION */ - public $Version = '5.2.23'; + public $Version = '5.2.25'; /** * SMTP server port number. @@ -151,9 +151,8 @@ class SMTP public $Timelimit = 300; /** - * @var array patterns to extract smtp transaction id from smtp reply - * Only first capture group will be use, use non-capturing group to deal with it - * Extend this class to override this property to fulfil your needs. + * @var array Patterns to extract an SMTP transaction id from reply to a DATA command. + * The first capture group in each regex will be used as the ID. */ protected $smtp_transaction_id_patterns = array( 'exim' => '/[0-9]{3} OK id=(.*)/', @@ -161,6 +160,12 @@ class SMTP 'postfix' => '/[0-9]{3} 2.0.0 Ok: queued as (.*)/' ); + /** + * @var string The last transaction ID issued in response to a DATA command, + * if one was detected + */ + protected $last_smtp_transaction_id; + /** * The socket for the server connection. * @var resource @@ -227,7 +232,7 @@ class SMTP break; case 'html': //Cleans up output a bit for a better looking, HTML-safe output - echo htmlentities( + echo gmdate('Y-m-d H:i:s') . ' ' . htmlentities( preg_replace('/[\r\n]+/', '', $str), ENT_QUOTES, 'UTF-8' @@ -709,6 +714,7 @@ class SMTP $savetimelimit = $this->Timelimit; $this->Timelimit = $this->Timelimit * 2; $result = $this->sendCommand('DATA END', '.', 250); + $this->recordLastTransactionID(); //Restore timelimit $this->Timelimit = $savetimelimit; return $result; @@ -989,7 +995,10 @@ class SMTP public function client_send($data) { $this->edebug("CLIENT -> SERVER: $data", self::DEBUG_CLIENT); - return fwrite($this->smtp_conn, $data); + set_error_handler(array($this, 'errorHandler')); + $result = fwrite($this->smtp_conn, $data); + restore_error_handler(); + return $result; } /** @@ -1089,8 +1098,10 @@ class SMTP $this->edebug("SMTP -> get_lines(): \$data is \"$data\"", self::DEBUG_LOWLEVEL); $this->edebug("SMTP -> get_lines(): \$str is \"$str\"", self::DEBUG_LOWLEVEL); $data .= $str; - // If 4th character is a space, we are done reading, break the loop, micro-optimisation over strlen - if ((isset($str[3]) and $str[3] == ' ')) { + // If response is only 3 chars (not valid, but RFC5321 S4.2 says it must be handled), + // or 4th character is a space, we are done reading, break the loop, + // string array access is a micro-optimisation over strlen + if (!isset($str[3]) or (isset($str[3]) and $str[3] == ' ')) { break; } // Timed-out? Log and break @@ -1226,26 +1237,40 @@ class SMTP } /** - * Will return the ID of the last smtp transaction based on a list of patterns provided - * in SMTP::$smtp_transaction_id_patterns. + * Extract and return the ID of the last SMTP transaction based on + * a list of patterns provided in SMTP::$smtp_transaction_id_patterns. + * Relies on the host providing the ID in response to a DATA command. * If no reply has been received yet, it will return null. - * If no pattern has been matched, it will return false. + * If no pattern was matched, it will return false. * @return bool|null|string */ - public function getLastTransactionID() + protected function recordLastTransactionID() { $reply = $this->getLastReply(); if (empty($reply)) { - return null; - } - - foreach ($this->smtp_transaction_id_patterns as $smtp_transaction_id_pattern) { - if (preg_match($smtp_transaction_id_pattern, $reply, $matches)) { - return $matches[1]; + $this->last_smtp_transaction_id = null; + } else { + $this->last_smtp_transaction_id = false; + foreach ($this->smtp_transaction_id_patterns as $smtp_transaction_id_pattern) { + if (preg_match($smtp_transaction_id_pattern, $reply, $matches)) { + $this->last_smtp_transaction_id = $matches[1]; + } } } - return false; + return $this->last_smtp_transaction_id; + } + + /** + * Get the queue/transaction ID of the last SMTP transaction + * If no reply has been received yet, it will return null. + * If no pattern was matched, it will return false. + * @return bool|null|string + * @see recordLastTransactionID() + */ + public function getLastTransactionID() + { + return $this->last_smtp_transaction_id; } } diff --git a/data/web/inc/lib/vendor/phpmailer/phpmailer/composer.json b/data/web/inc/lib/vendor/phpmailer/phpmailer/composer.json index f3611470..a0ac2964 100644 --- a/data/web/inc/lib/vendor/phpmailer/phpmailer/composer.json +++ b/data/web/inc/lib/vendor/phpmailer/phpmailer/composer.json @@ -20,6 +20,7 @@ } ], "require": { + "ext-ctype": "*", "php": ">=5.0.0" }, "require-dev": { diff --git a/data/web/inc/lib/vendor/phpmailer/phpmailer/examples/code_generator.phps b/data/web/inc/lib/vendor/phpmailer/phpmailer/examples/code_generator.phps index 23458561..2182663d 100644 --- a/data/web/inc/lib/vendor/phpmailer/phpmailer/examples/code_generator.phps +++ b/data/web/inc/lib/vendor/phpmailer/phpmailer/examples/code_generator.phps @@ -58,46 +58,53 @@ class phpmailerAppException extends phpmailerException $example_code .= "\n\nclass phpmailerAppException extends phpmailerException {}"; $example_code .= "\n\ntry {"; +// Convert a string to its JavaScript representation. +function JSString($s) { + static $from = array("\\", "/", "\n", "\t", "\r", "\b", "\f", '"'); + static $to = array('\\\\', '\\/', '\\n', '\\t', '\\r', '\\b', '\\f', '\\"'); + return is_null($s)? 'null': '"' . str_replace($from, $to, "$s") . '"'; +} + try { if (isset($_POST["submit"]) && $_POST['submit'] == "Submit") { - $to = $_POST['To_Email']; + $to = $to_email; if (!PHPMailer::validateAddress($to)) { throw new phpmailerAppException("Email address " . $to . " is invalid -- aborting!"); } - $example_code .= "\n\$to = '{$_POST['To_Email']}';"; + $example_code .= "\n\$to = '" . addslashes($to_email) . "';"; $example_code .= "\nif(!PHPMailer::validateAddress(\$to)) {"; $example_code .= "\n throw new phpmailerAppException(\"Email address \" . " . "\$to . \" is invalid -- aborting!\");"; $example_code .= "\n}"; - switch ($_POST['test_type']) { + switch ($test_type) { case 'smtp': $mail->isSMTP(); // telling the class to use SMTP - $mail->SMTPDebug = (integer)$_POST['smtp_debug']; - $mail->Host = $_POST['smtp_server']; // SMTP server - $mail->Port = (integer)$_POST['smtp_port']; // set the SMTP port - if ($_POST['smtp_secure']) { - $mail->SMTPSecure = strtolower($_POST['smtp_secure']); + $mail->SMTPDebug = (integer)$smtp_debug; + $mail->Host = $smtp_server; // SMTP server + $mail->Port = (integer)$smtp_port; // set the SMTP port + if ($smtp_secure) { + $mail->SMTPSecure = strtolower($smtp_secure); } $mail->SMTPAuth = array_key_exists('smtp_authenticate', $_POST); // enable SMTP authentication? if (array_key_exists('smtp_authenticate', $_POST)) { - $mail->Username = $_POST['authenticate_username']; // SMTP account username - $mail->Password = $_POST['authenticate_password']; // SMTP account password + $mail->Username = $authenticate_username; // SMTP account username + $mail->Password = $authenticate_password; // SMTP account password } $example_code .= "\n\$mail->isSMTP();"; - $example_code .= "\n\$mail->SMTPDebug = " . $_POST['smtp_debug'] . ";"; - $example_code .= "\n\$mail->Host = \"" . $_POST['smtp_server'] . "\";"; - $example_code .= "\n\$mail->Port = \"" . $_POST['smtp_port'] . "\";"; - $example_code .= "\n\$mail->SMTPSecure = \"" . strtolower($_POST['smtp_secure']) . "\";"; + $example_code .= "\n\$mail->SMTPDebug = " . (integer) $smtp_debug . ";"; + $example_code .= "\n\$mail->Host = \"" . addslashes($smtp_server) . "\";"; + $example_code .= "\n\$mail->Port = \"" . addslashes($smtp_port) . "\";"; + $example_code .= "\n\$mail->SMTPSecure = \"" . addslashes(strtolower($smtp_secure)) . "\";"; $example_code .= "\n\$mail->SMTPAuth = " . (array_key_exists( 'smtp_authenticate', $_POST ) ? 'true' : 'false') . ";"; if (array_key_exists('smtp_authenticate', $_POST)) { - $example_code .= "\n\$mail->Username = \"" . $_POST['authenticate_username'] . "\";"; - $example_code .= "\n\$mail->Password = \"" . $_POST['authenticate_password'] . "\";"; + $example_code .= "\n\$mail->Username = \"" . addslashes($authenticate_username) . "\";"; + $example_code .= "\n\$mail->Password = \"" . addslashes($authenticate_password) . "\";"; } break; case 'mail': @@ -118,59 +125,59 @@ try { try { if ($_POST['From_Name'] != '') { - $mail->addReplyTo($_POST['From_Email'], $_POST['From_Name']); - $mail->setFrom($_POST['From_Email'], $_POST['From_Name']); + $mail->addReplyTo($from_email, $from_name); + $mail->setFrom($from_email, $from_name); $example_code .= "\n\$mail->addReplyTo(\"" . - $_POST['From_Email'] . "\", \"" . $_POST['From_Name'] . "\");"; + addslashes($from_email) . "\", \"" . addslashes($from_name) . "\");"; $example_code .= "\n\$mail->setFrom(\"" . - $_POST['From_Email'] . "\", \"" . $_POST['From_Name'] . "\");"; + addslashes($from_email) . "\", \"" . addslashes($from_name) . "\");"; } else { - $mail->addReplyTo($_POST['From_Email']); - $mail->setFrom($_POST['From_Email'], $_POST['From_Email']); + $mail->addReplyTo($from_email); + $mail->setFrom($from_email, $from_email); - $example_code .= "\n\$mail->addReplyTo(\"" . $_POST['From_Email'] . "\");"; + $example_code .= "\n\$mail->addReplyTo(\"" . addslashes($from_email) . "\");"; $example_code .= "\n\$mail->setFrom(\"" . - $_POST['From_Email'] . "\", \"" . $_POST['From_Email'] . "\");"; + addslashes($from_email) . "\", \"" . addslashes($from_email) . "\");"; } if ($_POST['To_Name'] != '') { - $mail->addAddress($to, $_POST['To_Name']); - $example_code .= "\n\$mail->addAddress(\"$to\", \"" . $_POST['To_Name'] . "\");"; + $mail->addAddress($to, $to_name); + $example_code .= "\n\$mail->addAddress(\"$to\", \"" . addslashes($to_name) . "\");"; } else { $mail->addAddress($to); $example_code .= "\n\$mail->addAddress(\"$to\");"; } if ($_POST['bcc_Email'] != '') { - $indiBCC = explode(" ", $_POST['bcc_Email']); + $indiBCC = explode(" ", $bcc_email); foreach ($indiBCC as $key => $value) { $mail->addBCC($value); - $example_code .= "\n\$mail->addBCC(\"$value\");"; + $example_code .= "\n\$mail->addBCC(\"" . addslashes($value) . "\");"; } } if ($_POST['cc_Email'] != '') { - $indiCC = explode(" ", $_POST['cc_Email']); + $indiCC = explode(" ", $cc_Email); foreach ($indiCC as $key => $value) { $mail->addCC($value); - $example_code .= "\n\$mail->addCC(\"$value\");"; + $example_code .= "\n\$mail->addCC(\"" . addslashes($value) . "\");"; } } } catch (phpmailerException $e) { //Catch all kinds of bad addressing throw new phpmailerAppException($e->getMessage()); } - $mail->Subject = $_POST['Subject'] . ' (PHPMailer test using ' . strtoupper($_POST['test_type']) . ')'; - $example_code .= "\n\$mail->Subject = \"" . $_POST['Subject'] . - ' (PHPMailer test using ' . strtoupper($_POST['test_type']) . ')";'; + $mail->Subject = $subject . ' (PHPMailer test using ' . strtoupper($test_type) . ')'; + $example_code .= "\n\$mail->Subject = \"" . addslashes($subject) . + ' (PHPMailer test using ' . addslashes(strtoupper($test_type)) . ')";'; if ($_POST['Message'] == '') { $body = file_get_contents('contents.html'); } else { - $body = $_POST['Message']; + $body = $message; } - $example_code .= "\n\$body = <<<'EOT'\n" . htmlentities($body) . "\nEOT;"; + $example_code .= "\n\$body = <<<'EOT'\n$body\nEOT;"; $mail->WordWrap = 78; // set word wrap to the RFC2822 limit $mail->msgHTML($body, dirname(__FILE__), true); //Create message bodies and embed images @@ -187,7 +194,7 @@ try { $example_code .= "\n\ntry {"; $example_code .= "\n \$mail->send();"; $example_code .= "\n \$results_messages[] = \"Message has been sent using " . - strtoupper($_POST['test_type']) . "\";"; + addslashes(strtoupper($test_type)) . "\";"; $example_code .= "\n}"; $example_code .= "\ncatch (phpmailerException \$e) {"; $example_code .= "\n throw new phpmailerAppException('Unable to send to: ' . \$to. ': '.\$e->getMessage());"; @@ -195,7 +202,7 @@ try { try { $mail->send(); - $results_messages[] = "Message has been sent using " . strtoupper($_POST["test_type"]); + $results_messages[] = "Message has been sent using " . strtoupper($test_type); } catch (phpmailerException $e) { throw new phpmailerAppException("Unable to send to: " . $to . ': ' . $e->getMessage()); } @@ -309,22 +316,22 @@ $example_code .= "\n}"; function startAgain() { var post_params = { - "From_Name": "", - "From_Email": "", - "To_Name": "", - "To_Email": "", - "cc_Email": "", - "bcc_Email": "", - "Subject": "", - "Message": "", - "test_type": "", - "smtp_debug": "", - "smtp_server": "", - "smtp_port": "", - "smtp_secure": "", - "smtp_authenticate": "", - "authenticate_username": "", - "authenticate_password": "" + "From_Name": , + "From_Email": , + "To_Name": , + "To_Email": , + "cc_Email": , + "bcc_Email": , + "Subject": , + "Message": , + "test_type": , + "smtp_debug": , + "smtp_server": , + "smtp_port": , + "smtp_secure": , + "smtp_authenticate": , + "authenticate_username": , + "authenticate_password": }; var resetForm = document.createElement("form"); @@ -374,7 +381,7 @@ if (isset($_POST["submit"]) && $_POST["submit"] == "Submit") { echo "
\n"; echo "
Script:\n"; echo "
\n";
-    echo $example_code;
+    echo htmlentities($example_code);
     echo "\n
\n"; echo "\n
\n"; } @@ -390,7 +397,7 @@ if (isset($_POST["submit"]) && $_POST["submit"] == "Submit") { - @@ -399,7 +406,7 @@ if (isset($_POST["submit"]) && $_POST["submit"] == "Submit") { - @@ -408,7 +415,7 @@ if (isset($_POST["submit"]) && $_POST["submit"] == "Submit") { - @@ -417,7 +424,7 @@ if (isset($_POST["submit"]) && $_POST["submit"] == "Submit") { - @@ -428,7 +435,7 @@ if (isset($_POST["submit"]) && $_POST["submit"] == "Submit") { - @@ -439,7 +446,7 @@ if (isset($_POST["submit"]) && $_POST["submit"] == "Submit") { - @@ -448,7 +455,7 @@ if (isset($_POST["submit"]) && $_POST["submit"] == "Submit") { - @@ -460,7 +467,7 @@ if (isset($_POST["submit"]) && $_POST["submit"] == "Submit") { + placeholder="Body of your email"> @@ -531,7 +538,7 @@ if (isset($_POST["submit"]) && $_POST["submit"] == "Submit") { @@ -539,7 +546,7 @@ if (isset($_POST["submit"]) && $_POST["submit"] == "Submit") { + value="" placeholder="Port"> @@ -560,14 +567,14 @@ if (isset($_POST["submit"]) && $_POST["submit"] == "Submit") { - value=""> + value="true"> @@ -575,7 +582,7 @@ if (isset($_POST["submit"]) && $_POST["submit"] == "Submit") { diff --git a/data/web/inc/lib/vendor/phpmailer/phpmailer/examples/gmail.phps b/data/web/inc/lib/vendor/phpmailer/phpmailer/examples/gmail.phps index b3cc02d5..121ca70a 100644 --- a/data/web/inc/lib/vendor/phpmailer/phpmailer/examples/gmail.phps +++ b/data/web/inc/lib/vendor/phpmailer/phpmailer/examples/gmail.phps @@ -1,6 +1,7 @@ send()) { echo "Mailer Error: " . $mail->ErrorInfo; } else { echo "Message sent!"; + //Section 2: IMAP + //Uncomment these to save your message in the 'Sent Mail' folder. + #if (save_mail($mail)) { + # echo "Message saved!"; + #} +} + +//Section 2: IMAP +//IMAP commands requires the PHP IMAP Extension, found at: https://php.net/manual/en/imap.setup.php +//Function to call which uses the PHP imap_*() functions to save messages: https://php.net/manual/en/book.imap.php +//You can use imap_getmailboxes($imapStream, '/imap/ssl') to get a list of available folders or labels, this can +//be useful if you are trying to get this working on a non-Gmail IMAP server. +function save_mail($mail) { + //You can change 'Sent Mail' to any other folder or tag + $path = "{imap.gmail.com:993/imap/ssl}[Gmail]/Sent Mail"; + + //Tell your server to open an IMAP connection using the same username and password as you used for SMTP + $imapStream = imap_open($path, $mail->Username, $mail->Password); + + $result = imap_append($imapStream, $path, $mail->getSentMIMEMessage()); + imap_close($imapStream); + + return $result; } diff --git a/data/web/inc/lib/vendor/phpmailer/phpmailer/examples/gmail_xoauth.phps b/data/web/inc/lib/vendor/phpmailer/phpmailer/examples/gmail_xoauth.phps index d64483a4..2aec1814 100644 --- a/data/web/inc/lib/vendor/phpmailer/phpmailer/examples/gmail_xoauth.phps +++ b/data/web/inc/lib/vendor/phpmailer/phpmailer/examples/gmail_xoauth.phps @@ -43,8 +43,8 @@ $mail->SMTPAuth = true; //Set AuthType $mail->AuthType = 'XOAUTH2'; -//User Email to use for SMTP authentication - Use the same Email used in Google Developer Console -$mail->oauthUserEmail = "someone@gmail.com"; +//User Email to use for SMTP authentication - user who gave consent to our app +$mail->oauthUserEmail = "from@gmail.com"; //Obtained From Google Developer Console $mail->oauthClientId = "RANDOMCHARS-----duv1n2.apps.googleusercontent.com"; diff --git a/data/web/inc/lib/vendor/phpmailer/phpmailer/extras/README.md b/data/web/inc/lib/vendor/phpmailer/phpmailer/extras/README.md index dac79e05..df8ca092 100644 --- a/data/web/inc/lib/vendor/phpmailer/phpmailer/extras/README.md +++ b/data/web/inc/lib/vendor/phpmailer/phpmailer/extras/README.md @@ -1,17 +1,17 @@ -#PHPMailer Extras +# PHPMailer Extras These classes provide optional additional functions to PHPMailer. These are not loaded by the PHPMailer autoloader, so in some cases you may need to `require` them yourself before using them. -##EasyPeasyICS +## EasyPeasyICS This class was originally written by Manuel Reinhard and provides a simple means of generating ICS/vCal files that are used in sending calendar events. PHPMailer does not use it directly, but you can use it to generate content appropriate for placing in the `Ical` property of PHPMailer. The PHPMailer project is now its official home as Manuel has given permission for that and is no longer maintaining it himself. -##htmlfilter +## htmlfilter This class by Konstantin Riabitsev and Jim Jagielski implements HTML filtering to remove potentially malicious tags, such as ` + diff --git a/data/web/inc/functions.customize.inc.php b/data/web/inc/functions.customize.inc.php new file mode 100644 index 00000000..231bc898 --- /dev/null +++ b/data/web/inc/functions.customize.inc.php @@ -0,0 +1,180 @@ + 'danger', + 'msg' => sprintf($lang['danger']['access_denied']) + ); + return false; + } + switch ($_item) { + case 'main_logo': + if (in_array($_data['main_logo']['type'], array('image/gif', 'image/jpeg', 'image/pjpeg', 'image/x-png', 'image/png', 'image/svg+xml'))) { + try { + if (file_exists($_data['main_logo']['tmp_name']) !== true) { + $_SESSION['return'] = array( + 'type' => 'danger', + 'msg' => 'Cannot validate image file: Temporary file not found' + ); + return false; + } + $image = new Imagick($_data['main_logo']['tmp_name']); + if ($image->valid() !== true) { + $_SESSION['return'] = array( + 'type' => 'danger', + 'msg' => 'Cannot validate image file' + ); + return false; + } + $image->destroy(); + } + catch (ImagickException $e) { + $image->destroy(); + $_SESSION['return'] = array( + 'type' => 'danger', + 'msg' => 'Cannot validate image file' + ); + return false; + } + } + else { + $_SESSION['return'] = array( + 'type' => 'danger', + 'msg' => 'Invalid mime type' + ); + return false; + } + try { + $redis->Set('MAIN_LOGO', 'data:' . $_data['main_logo']['type'] . ';base64,' . base64_encode(file_get_contents($_data['main_logo']['tmp_name']))); + } + catch (RedisException $e) { + $_SESSION['return'] = array( + 'type' => 'danger', + 'msg' => 'Redis: '.$e + ); + return false; + } + $_SESSION['return'] = array( + 'type' => 'success', + 'msg' => 'File uploaded successfully' + ); + break; + } + break; + case 'edit': + if ($_SESSION['mailcow_cc_role'] != "admin") { + $_SESSION['return'] = array( + 'type' => 'danger', + 'msg' => sprintf($lang['danger']['access_denied']) + ); + return false; + } + switch ($_item) { + case 'app_links': + $apps = (array)$_data['app']; + $links = (array)$_data['href']; + $out = array(); + if (count($apps) == count($links)) {; + for ($i = 0; $i < count($apps); $i++) { + $out[] = array($apps[$i] => $links[$i]); + } + try { + $redis->set('APP_LINKS', json_encode($out)); + } + catch (RedisException $e) { + $_SESSION['return'] = array( + 'type' => 'danger', + 'msg' => 'Redis: '.$e + ); + return false; + } + } + $_SESSION['return'] = array( + 'type' => 'success', + 'msg' => 'Saved changes to app links' + ); + break; + } + break; + case 'delete': + if ($_SESSION['mailcow_cc_role'] != "admin") { + $_SESSION['return'] = array( + 'type' => 'danger', + 'msg' => sprintf($lang['danger']['access_denied']) + ); + return false; + } + switch ($_item) { + case 'main_logo': + try { + if ($redis->del('MAIN_LOGO')) { + $_SESSION['return'] = array( + 'type' => 'success', + 'msg' => 'Reset default logo' + ); + return true; + } + } + catch (RedisException $e) { + $_SESSION['return'] = array( + 'type' => 'danger', + 'msg' => 'Redis: '.$e + ); + return false; + } + break; + } + break; + case 'get': + switch ($_item) { + case 'app_links': + try { + $app_links = json_decode($redis->get('APP_LINKS'), true); + } + catch (RedisException $e) { + $_SESSION['return'] = array( + 'type' => 'danger', + 'msg' => 'Redis: '.$e + ); + return false; + } + return ($app_links) ? $app_links : false; + break; + case 'main_logo': + try { + return $redis->get('MAIN_LOGO'); + } + catch (RedisException $e) { + $_SESSION['return'] = array( + 'type' => 'danger', + 'msg' => 'Redis: '.$e + ); + return false; + } + break; + case 'main_logo_specs': + try { + $image = new Imagick(); + $img_data = explode('base64,', customize('get', 'main_logo')); + if ($img_data[1]) { + $image->readImageBlob(base64_decode($img_data[1])); + } + return $image->identifyImage(); + } + catch (ImagickException $e) { + $_SESSION['return'] = array( + 'type' => 'danger', + 'msg' => 'Error: Imagick exception while reading image' + ); + return false; + } + break; + } + break; + } +} \ No newline at end of file diff --git a/data/web/inc/functions.mailbox.inc.php b/data/web/inc/functions.mailbox.inc.php index 9deb6ef0..209b4acc 100644 --- a/data/web/inc/functions.mailbox.inc.php +++ b/data/web/inc/functions.mailbox.inc.php @@ -1291,11 +1291,11 @@ function mailbox($_action, $_type, $_data = null) { $port1 = (!empty($_data['port1'])) ? $_data['port1'] : $is_now['port1']; $password1 = (!empty($_data['password1'])) ? $_data['password1'] : $is_now['password1']; $host1 = (!empty($_data['host1'])) ? $_data['host1'] : $is_now['host1']; - $subfolder2 = (!empty($_data['subfolder2'])) ? $_data['subfolder2'] : ''; + $subfolder2 = (isset($_data['subfolder2'])) ? $_data['subfolder2'] : $is_now['subfolder2']; $enc1 = (!empty($_data['enc1'])) ? $_data['enc1'] : $is_now['enc1']; $mins_interval = (!empty($_data['mins_interval'])) ? $_data['mins_interval'] : $is_now['mins_interval']; $exclude = (!empty($_data['exclude'])) ? $_data['exclude'] : ''; - $maxage = (!empty($_data['maxage'])) ? $_data['maxage'] : $is_now['maxage']; + $maxage = (isset($_data['maxage']) && $_data['maxage'] != "") ? intval($_data['maxage']) : $is_now['maxage']; } else { $_SESSION['return'] = array( diff --git a/data/web/inc/header.inc.php b/data/web/inc/header.inc.php index ccccc616..b64bd5a8 100644 --- a/data/web/inc/header.inc.php +++ b/data/web/inc/header.inc.php @@ -39,7 +39,7 @@ - mailcow-logo + mailcow-logo
+ +
+ +
+ +
+
diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php index 817b9c71..79a449eb 100644 --- a/data/web/inc/functions.inc.php +++ b/data/web/inc/functions.inc.php @@ -244,6 +244,23 @@ function set_acl() { return false; } } +function get_acl($username) { + global $pdo; + if ($_SESSION['mailcow_cc_role'] != "admin") { + return false; + } + $username = strtolower(trim($username)); + $stmt = $pdo->prepare("SELECT * FROM `user_acl` WHERE `username` = :username"); + $stmt->execute(array(':username' => $username)); + $acl = $stmt->fetch(PDO::FETCH_ASSOC); + unset($acl['username']); + if (!empty($acl)) { + return $acl; + } + else { + return false; + } +} function formatBytes($size, $precision = 2) { if(!is_numeric($size)) { return "0"; diff --git a/data/web/inc/init_db.inc.php b/data/web/inc/init_db.inc.php index e2d18517..16f3fdf2 100644 --- a/data/web/inc/init_db.inc.php +++ b/data/web/inc/init_db.inc.php @@ -3,7 +3,7 @@ function init_db_schema() { try { global $pdo; - $db_version = "02102017_0748"; + $db_version = "25102017_0748"; $stmt = $pdo->query("SHOW TABLES LIKE 'versions'"); $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC)); @@ -165,7 +165,6 @@ function init_db_schema() { "delimiter_action" => "TINYINT(1) NOT NULL DEFAULT '1'", "syncjobs" => "TINYINT(1) NOT NULL DEFAULT '1'", "eas_reset" => "TINYINT(1) NOT NULL DEFAULT '1'", - "eas_autoconfig" => "TINYINT(1) NOT NULL DEFAULT '1'" ), "keys" => array( "fkey" => array( diff --git a/data/web/lang/lang.en.php b/data/web/lang/lang.en.php index 527ded11..c29d8e17 100644 --- a/data/web/lang/lang.en.php +++ b/data/web/lang/lang.en.php @@ -141,9 +141,9 @@ $lang['user']['weeks'] = 'Weeks'; $lang['user']['spamfilter'] = 'Spam filter'; $lang['admin']['spamfilter'] = 'Spam filter'; $lang['user']['spamfilter_wl'] = 'Whitelist'; -$lang['user']['spamfilter_wl_desc'] = 'Whitelisted email addresses to never classify as spam. Wildcards maybe used.'; +$lang['user']['spamfilter_wl_desc'] = 'Whitelisted email addresses to never classify as spam. Wildcards may be used.'; $lang['user']['spamfilter_bl'] = 'Blacklist'; -$lang['user']['spamfilter_bl_desc'] = 'Blacklisted email addresses to always classify as spam and reject. Wildcards maybe used.'; +$lang['user']['spamfilter_bl_desc'] = 'Blacklisted email addresses to always classify as spam and reject. Wildcards may be used.'; $lang['user']['spamfilter_behavior'] = 'Rating'; $lang['user']['spamfilter_table_rule'] = 'Rule'; $lang['user']['spamfilter_table_action'] = 'Action'; @@ -537,3 +537,11 @@ $lang['admin']['remove_row'] = "Remove row"; $lang['admin']['add_row'] = "Add row"; $lang['admin']['reset_default'] = "Reset to default"; $lang['admin']['merged_vars_hint'] = 'Greyed out rows were merged from vars.inc.(local.)php and cannot be modified.'; + +$lang['edit']['tls_policy'] = "Change TLS policy"; +$lang['edit']['spam_score'] = "Set a custom spam score"; +$lang['edit']['spam_policy'] = "Add or remove items to white-/blacklist"; +$lang['edit']['delimiter_action'] = "Change delimiter action"; +$lang['edit']['syncjobs'] = "Add or change sync jobs"; +$lang['edit']['eas_reset'] = "Reset EAS devices"; +$lang['edit']['spam_alias'] = "Create or change time limited alias addresses"; diff --git a/data/web/user.php b/data/web/user.php index 0d95790d..50583515 100644 --- a/data/web/user.php +++ b/data/web/user.php @@ -268,8 +268,8 @@ elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == '

-
- + -
- +
@@ -349,7 +348,6 @@ elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == '
-
@@ -358,7 +356,7 @@ elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == ' - +
diff --git a/helper-scripts/nextcloud.sh b/helper-scripts/nextcloud.sh index b3c23e23..08aa652c 100755 --- a/helper-scripts/nextcloud.sh +++ b/helper-scripts/nextcloud.sh @@ -2,6 +2,10 @@ [[ -z ${1} ]] && { echo "No parameters given"; exit 1; } +for bin in curl dirmngr; do + if [[ -z $(which ${bin}) ]]; then echo "Cannot find ${bin}, exiting..."; exit 1; fi +done + while [ "$1" != '' ]; do case "${1}" in -p|--purge) NC_PURGE=y && shift;;