| @@ -406,9 +406,9 @@ | ||
| 406 | 406 | } |
| 407 | 407 | } else { |
| 408 | 408 | $this->_message->html .= ' '.trim(preg_replace('#(charset=".*?\r\n)|Content-(Type|ID|Disposition|Transfer-Encoding):.*?\r\n#is', "", $segment)); |
| 409 | 409 | } |
| 410 | - } elseif (preg_match("#Content-Type: .*?/(png|jpg|jpeg|gif)#i", $segment) !== false) { | |
| 410 | + } elseif (preg_match("#Content-Type: .*?/(png|jpg|jpeg|gif)#i", $segment) === 1) { | |
| 411 | 411 | preg_match('#name="([^"]+)"#i', $segment, $filename); |
| 412 | 412 | if (empty($filename) || empty($filename[1])) { |
| 413 | 413 | continue; |
| 414 | 414 | } |
| @@ -421,8 +421,12 @@ | ||
| 421 | 421 | } |
| 422 | 422 | |
| 423 | 423 | $extension = substr($filename, $extensionPos + 1); |
| 424 | 424 | |
| 425 | + if (!in_array(strtolower($extension), $this->allowed_extensions) || acym_isForbiddenFileExtension($filename)) { | |
| 426 | + continue; | |
| 427 | + } | |
| 428 | + | |
| 425 | 429 | // Make sure there is no double extension or space |
| 426 | 430 | $filename = preg_replace('#[^a-zA-Z0-9]#Uis', '_', substr($filename, 0, $extensionPos)); |
| 427 | 431 | |
| 428 | 432 | // Get the upload folder and create it if needed |
| @@ -437,9 +441,9 @@ | ||
| 437 | 441 | } |
| 438 | 442 | $filename = $filename.'_('.$fileNumber.')'; |
| 439 | 443 | } |
| 440 | 444 | |
| 441 | - if ($attachments && preg_match("#Content-Disposition: attachment;#i", $segment) !== false) { | |
| 445 | + if ($attachments && preg_match("#Content-Disposition: attachment;#i", $segment) === 1) { | |
| 442 | 446 | $data = trim(substr($segment, strpos($segment, "\r\n\r\n"))); |
| 443 | 447 | if (strpos($segment, 'Content-Transfer-Encoding: base64') !== false) { |
| 444 | 448 | $data = base64_decode($data); |
| 445 | 449 | } |
| @@ -558,14 +562,16 @@ | ||
| 558 | 562 | if (!empty($this->inlineImages)) { |
| 559 | 563 | $this->_message->html = str_replace(array_keys($this->inlineImages), $this->inlineImages, $this->_message->html); |
| 560 | 564 | } |
| 561 | 565 | } else { |
| 566 | + $body = $this->callImapFunction('imap_body', [$this->mailbox, $this->_message->messageNB]); | |
| 567 | + $decodedBody = empty($body) ? '' : $this->decodeContent($body, $this->_message->structure); | |
| 562 | 568 | if ($this->_message->structure->subtype === 'HTML') { |
| 563 | 569 | $this->_message->contentType = 1; |
| 564 | - $this->_message->html = $this->decodeContent($this->callImapFunction('imap_body', [$this->mailbox, $this->_message->messageNB]), $this->_message->structure); | |
| 570 | + $this->_message->html = $decodedBody; | |
| 565 | 571 | } else { |
| 566 | 572 | $this->_message->contentType = 0; |
| 567 | - $this->_message->text = $this->decodeContent($this->callImapFunction('imap_body', [$this->mailbox, $this->_message->messageNB]), $this->_message->structure); | |
| 573 | + $this->_message->text = $decodedBody; | |
| 568 | 574 | } |
| 569 | 575 | } |
| 570 | 576 | |
| 571 | 577 | //Decode the subject |
| @@ -608,11 +614,11 @@ | ||
| 608 | 614 | if ($extensionPos === false) { |
| 609 | 615 | return; |
| 610 | 616 | } |
| 611 | 617 | |
| 612 | - // Upload only allowed extensions in the configuration | |
| 618 | + // Upload only allowed extensions in the configuration, and never executable ones | |
| 613 | 619 | $extension = substr($filename, $extensionPos + 1); |
| 614 | - if (!in_array(strtolower($extension), $this->allowed_extensions)) { | |
| 620 | + if (!in_array(strtolower($extension), $this->allowed_extensions) || acym_isForbiddenFileExtension($filename)) { | |
| 615 | 621 | return; |
| 616 | 622 | } |
| 617 | 623 | |
| 618 | 624 | // Make sure there is no double extension or space |
| @@ -630,9 +636,16 @@ | ||
| 630 | 636 | } |
| 631 | 637 | $filename = $filename.'_('.$fileNumber.')'; |
| 632 | 638 | } |
| 633 | 639 | |
| 634 | - $data = $this->decodeContent($this->callImapFunction('imap_fetchbody', [$this->mailbox, $this->_message->messageNB, $num]), $attachment); | |
| 640 | + $content = $this->callImapFunction('imap_fetchbody', [$this->mailbox, $this->_message->messageNB, $num]); | |
| 641 | + | |
| 642 | + // We could not fetch the part, there is nothing to upload | |
| 643 | + if (empty($content)) { | |
| 644 | + return; | |
| 645 | + } | |
| 646 | + | |
| 647 | + $data = $this->decodeContent($content, $attachment); | |
| 635 | 648 | |
| 636 | 649 | try { |
| 637 | 650 | if (acym_writeFile($pathToUpload.$filename.'.'.$extension, $data)) { |
| 638 | 651 | if ( |
