Option to always allow external images

modules/core/message_functions.php

@@ -16,16 +16,26 @@
 if (!hm_exists('format_msg_html')) {
 function format_msg_html($str, $images=false) {
     $str = str_ireplace('</body>', '', $str);
+
     $config = HTMLPurifier_Config::createDefault();
+    $config->set('HTML.DefinitionID', 'hm-message');
+    $config->set('HTML.DefinitionRev', 1);
     $config->set('Cache.DefinitionImpl', null);
     $config->set('HTML.TargetBlank', true);
     $config->set('HTML.TargetNoopener', true);
-    $config->set('HTML.Allowed', 'a[href|target]');
+
     if (!$images) {
         $config->set('URI.DisableExternalResources', true);
     }
     $config->set('URI.AllowedSchemes', array('mailto' => true, 'data' => true, 'http' => true, 'https' => true));
     $config->set('Filter.ExtractStyleBlocks.TidyImpl', true);
+
+    $def = $config->getHTMLDefinition(true);
+    $html_tags = ['img', 'script', 'iframe', 'audio', 'embed', 'source', 'track', 'video'];
+    foreach ($html_tags as $tag) {
+        $def->addAttribute($tag, 'data-src', 'Text');
+    }
+
     try {
         $purifier = new HTMLPurifier($config);
         return $purifier->purify($str);

modules/imap/handler_modules.php

@@ -1829,9 +1829,7 @@ public function process() {
             elseif (isset($this->request->post['imap_prefetch']) && $this->request->post['imap_prefetch']) {
                 $prefetch = true;
             }
-            if (array_key_exists('imap_allow_images', $this->request->post) && $this->request->post['imap_allow_images']) {
-                $this->out('imap_allow_images', true);
-            }
+
             $this->out('header_allow_images', $this->config->get('allow_external_image_sources'));
 
             $cache = Hm_IMAP_List::get_cache($this->cache, $form['imap_server_id']);

modules/imap/output_modules.php

@@ -88,6 +88,7 @@ class Hm_Output_filter_message_body extends Hm_Output_Module {
     /**
      * Format html, text, or image content
      */
+
     protected function output() {
         $txt = '<div class="msg_text_inner">';
         if ($this->get('msg_text')) {
@@ -97,17 +98,17 @@ protected function output() {
             }
             if (isset($struct['subtype']) && strtolower($struct['subtype']) == 'html') {
                 $allowed = $this->get('header_allow_images');
-                $images = $this->get('imap_allow_images', false);
-                if ($allowed && stripos($this->get('msg_text'), 'img')) {
-                    if (!$images) {
-                        $id = $this->get('imap_msg_part');
-                        $txt .= '<div class="allow_image_link">'.
-                            '<a href="#" class="msg_part_link" data-allow-images="1" '.
-                            'data-message-part="'.$this->html_safe($id).'">'.
-                            $this->trans('Allow Images').'</a></div>';
-                    }
+                $msgText = $this->get('msg_text');
+                // Everything in the message starting with src="http:// or src="https:// or src='http:// or src='https://
+                $externalResRegexp = '/src="(https?:\/\/[^"]*)"|src=\'(https?:\/\/[^\']*)\'/i';
+
+                if ($allowed) {
+                    $msgText = preg_replace_callback($externalResRegexp, function ($matches) {
+                        return 'data-src="' . $matches[1] . '" ' . 'src="" ' . 'data-message-part="' . $this->html_safe($this->get('imap_msg_part')) . '"';
+                    }, $msgText);
                 }
-                $txt .= format_msg_html($this->get('msg_text'), $images);
+
+                $txt .= format_msg_html($msgText, $allowed);
             }
             elseif (isset($struct['type']) && strtolower($struct['type']) == 'image') {
                 $txt .= format_msg_image($this->get('msg_text'), strtolower($struct['subtype']));

modules/imap/site.css

@@ -1,6 +1,8 @@
 .imap_debug_data { margin-left: 10px; }
 .imap_connect { display: inline; }
-.allow_image_link { margin-right: 20px; float: right; margin-top: -10px; margin-bottom: 10px; }
+.notices { display: flex; gap: 20px; align-items: center; margin-bottom: 20px;}
+.mobile .notices { flex-direction: column; align-items: flex-start; }
+.external_notices { display: flex; gap: 20px; flex-wrap: wrap; }
 .imap_debug { border: solid 1px #aaa; float: left; padding: 10px; height: 300px; width: 300px; overflow: scroll; white-space: pre; margin-top: 50px; font-size: 75%; }
 .server_link { line-height: 10pt; margin: 2px; margin-left: 5px; display: block; padding: 5px; border: solid 1px #ddd; background-color: #fff; float: right; clear: none; color: #333; text-decoration: none; border-radius: 3px; }
 .hl { padding-right: 5px; color: #666; }

modules/imap/site.js

@@ -556,10 +556,7 @@ var expand_imap_folders = function(path) {
     return false;
 };
 
-var get_message_content = function(msg_part, uid, list_path, detail, callback, noupdate, images) {
-    if (!images) {
-        images = 0;
-    }
+var get_message_content = function(msg_part, uid, list_path, detail, callback, noupdate) {
     if (!uid) {
         uid = $('.msg_uid').val();
     }
@@ -574,7 +571,6 @@ var get_message_content = function(msg_part, uid, list_path, detail, callback, n
             [{'name': 'hm_ajax_hook', 'value': 'ajax_imap_message_content'},
             {'name': 'imap_msg_uid', 'value': uid},
             {'name': 'imap_msg_part', 'value': msg_part},
-            {'name': 'imap_allow_images', 'value': images},
             {'name': 'imap_server_id', 'value': detail.server_id},
             {'name': 'folder', 'value': detail.folder}],
             function(res) {
@@ -712,11 +708,6 @@ var imap_message_view_finished = function(msg_uid, detail, skip_links) {
     }
     $('.all_headers').on("click", function() { return Hm_Utils.toggle_long_headers(); });
     $('.small_headers').on("click", function() { return Hm_Utils.toggle_long_headers(); });
-    $('.msg_part_link').on("click", function() {
-        $('.header_subject')[0].scrollIntoView();
-        $('.msg_text_inner').css('visibility', 'hidden');
-        return get_message_content($(this).data('messagePart'), false, false, false, false, false, $(this).data('allowImages'));
-    });
     $('#flag_msg').on("click", function() { return imap_flag_message($(this).data('state')); });
     $('#unflag_msg').on("click", function() { return imap_flag_message($(this).data('state')); });
     $('#delete_message').on("click", function() { return imap_delete_message(); });
@@ -1257,3 +1248,130 @@ var imap_archive_message = function(state, supplied_uid, supplied_detail) {
     return false;
 };
 
+var imap_show_add_contact_popup = function() {
+    var popup = document.getElementById("contact_popup");
+    popup.classList.toggle("show");
+};
+
+var imap_hide_add_contact_popup = function(event) {
+    event.stopPropagation()
+    var popup = document.getElementById("contact_popup");
+    popup.classList.toggle("show");
+};
+
+/**
+ * Allow external resources for the provided element.
+ *
+ * @param {HTMLElement} element - The element containing the allow button.
+ * @param {string} messagePart - The message part associated with the resource.
+ * @returns {void}
+ */
+function handleAllowResource(element, messagePart) {
+    element.querySelector('a').addEventListener('click', function (e) {
+        e.preventDefault();
+        $('.msg_text_inner').remove();
+        const externalSources = $(this).data('src').split(',');
+        externalSources?.forEach((source) => Hm_Utils.save_to_local_storage(source, 1));
+        return get_message_content(messagePart, false, false, false, false, false);
+    });
+}
+
+/**
+ * Create and insert in the DOM an element containing a message and a button to allow the resource.
+ * 
+ * @param {HTMLElement} element - The element having the blocked resource.
+ * @returns {void}
+ */
+function handleInvisibleResource(element) {
+    const dataSrc = element.dataset.src;
+
+    const allowResource = document.createElement('div');
+    // allowResource.classList.add('allow_image_link');
+    allowResource.classList.add('alert', 'alert-warning', 'p-1');
+
+    const source = dataSrc.substring(0, 40) + (dataSrc.length > 40 ? '...' : '');
+    allowResource.innerHTML = `Source blocked: ${element.alt ? element.alt : source} 
+    <a href="#" data-src="${dataSrc}" class="btn btn-light btn-sm">
+    Allow</a></div>
+    `;
+
+    document.querySelector('.external_notices').insertAdjacentElement('beforeend', allowResource);
+    handleAllowResource(allowResource, element.dataset.messagePart);
+}
+
+const mutation = new MutationObserver(function (mutations) {
+    mutations.forEach(function (mutation) {
+        if (mutation.addedNodes.length > 0) {
+            mutation.addedNodes.forEach(function (node) {
+                if (node.classList.contains('msg_text_inner')) {
+
+                    //  Extarnal resources notice boxes container
+                    document.querySelector('.msg_text_inner').insertAdjacentHTML('afterbegin', '<div class="external_notices"></div>');
+
+                    const sender = document.querySelector('#contact_info').textContent.trim().replace(/\s/g, '_') + 'external_resources_allowed';
+                    const elements = node.querySelectorAll('[data-src]');
+                    const blockedResources = [];
+                    elements.forEach(function (element) {
+
+                        const dataSrc = element.dataset.src;
+                        const senderAllowed = Hm_Utils.get_from_local_storage(sender);
+                        const allowed = Hm_Utils.get_from_local_storage(dataSrc);
+
+                        switch (Number(allowed) || Number(senderAllowed)) {
+                            case 1:
+                                element.src = dataSrc;
+                                break;
+                            default:
+                                if ((allowed || senderAllowed) === null) {
+                                    Hm_Utils.save_to_local_storage(dataSrc, 0);
+                                }
+                                handleInvisibleResource(element);
+                                blockedResources.push(dataSrc);
+                                break;
+                        }
+                    });
+
+                    const noticesElement = document.createElement('div');
+                    noticesElement.classList.add('notices');
+
+                    if(blockedResources.length) {
+                        const allowAll = document.createElement('div');
+                        allowAll.classList.add('allow_image_link', 'all', 'fw-bold');
+                        allowAll.textContent = 'For security reasons, external resources have been blocked.';
+                        if (blockedResources.length > 1) {
+                            const allowAllLink = document.createElement('a');
+                            allowAllLink.classList.add('btn', 'btn-light', 'btn-sm');
+                            allowAllLink.href = '#';
+                            allowAllLink.dataset.src = blockedResources.join(',');
+                            allowAllLink.textContent = 'Allow all';
+                            allowAll.appendChild(allowAllLink);
+                            handleAllowResource(allowAll, elements[0].dataset.messagePart);
+                        }
+                        noticesElement.appendChild(allowAll);
+
+                        const button = document.createElement('a');
+                        button.classList.add('always_allow_image', 'btn', 'btn-light', 'btn-sm');
+                        button.textContent = 'Always allow from this sender';
+                        noticesElement.appendChild(button);
+
+                        button.addEventListener('click', function (e) {
+                            e.preventDefault();
+                            Hm_Utils.save_to_local_storage(sender, 1);
+                            $('.msg_text_inner').remove();
+                            get_message_content(elements[0].dataset.messagePart, false, false, false, false, false)
+                        });
+                    }
+
+                    document.querySelector('.external_notices').insertAdjacentElement('beforebegin', noticesElement);
+                }
+            });
+        }
+    });
+});
+
+const message = document.querySelector('.msg_text');
+if (message) {
+    mutation.observe(document.querySelector('.msg_text'), {
+        childList: true
+    });
+}

modules/ldap_contacts/modules.php

@@ -796,7 +796,9 @@ function fetch_ldap_contacts($config, $user_config, $contact_store, $session=fal
     $ldap_config = ldap_add_user_auth($ldap_config, $user_config->get('ldap_contacts_auth_setting', array()));
     if (count($ldap_config) > 0) {
         foreach ($ldap_config as $name => $vals) {
-            $vals['name'] = $name;
+            if (is_array($vals)) {
+                $vals['name'] = $name;
+            }
             $ldap = new Hm_LDAP_Contacts($vals);
             if ($ldap->connect()) {
                 $contacts = $ldap->fetch();