webinterface.git

@@ -59,7 +59,7 @@ Ihre E-Mail wird nicht weitergeleitet.',

 function get_vmail_id_by_emailaddr($emailaddr) 

 {

   $emailaddr = db_escape_string( $emailaddr );

-  $result = db_query("SELECT id FROM mail.v_vmail_accounts WHERE CONCAT(local, '@', domainname) = '{$emailaddr}'");

+  $result = db_query("SELECT id FROM mail.v_vmail_accounts WHERE CONCAT(local, '@', domainname) = ?", array($emailaddr));

   $entry = $result->fetch();

   return (int) $entry['id'];

 }

@@ -69,11 +69,13 @@ function get_account_details($id, $checkuid = true)

 	$id = (int) $id;

   $uid_check = '';

   DEBUG("checkuid: ".$checkuid);

+  $args = array(":id" => $id);

   if ($checkuid) {

     $uid = (int) $_SESSION['userinfo']['uid'];

-    $uid_check = "useraccount='{$uid}' AND ";

+    $uid_check = "useraccount=:uid AND ";

+    $args[":uid"] = $uid;

   }

-  $result = db_query("SELECT id, local, domain, password, spamfilter, forwards, autoresponder, server, quota, COALESCE(quota_used, 0) AS quota_used, quota_threshold from mail.v_vmail_accounts WHERE {$uid_check}id={$id} LIMIT 1");

+  $result = db_query("SELECT id, local, domain, password, spamfilter, forwards, autoresponder, server, quota, COALESCE(quota_used, 0) AS quota_used, quota_threshold from mail.v_vmail_accounts WHERE {$uid_check}id=:id LIMIT 1", $args);

 	if ($result->rowCount() == 0)

 		system_failure('Ungültige ID oder kein eigener Account');

 	$acc = empty_account();

@@ -84,13 +86,13 @@ function get_account_details($id, $checkuid = true)

 	  $acc[$key] = $value;

 	}

 	if ($acc['forwards'] > 0) {

-	  $result = db_query("SELECT id, spamfilter, destination FROM mail.vmail_forward WHERE account={$acc['id']};");

+	  $result = db_query("SELECT id, spamfilter, destination FROM mail.vmail_forward WHERE account=?", array($acc['id']));

 	  while ($item = $result->fetch()){

 	    array_push($acc['forwards'], array("id" => $item['id'], 'spamfilter' => $item['spamfilter'], 'destination' => $item['destination']));

 	  }

 	}

   if ($acc['autoresponder'] > 0) {

-    $result = db_query("SELECT id, IF(valid_from IS NULL OR valid_from > NOW() OR valid_until < NOW(), 0, 1) AS active, DATE(valid_from) AS valid_from, DATE(valid_until) AS valid_until, fromname, fromaddr, subject, message, quote FROM mail.vmail_autoresponder WHERE account={$acc['id']}");

+    $result = db_query("SELECT id, IF(valid_from IS NULL OR valid_from > NOW() OR valid_until < NOW(), 0, 1) AS active, DATE(valid_from) AS valid_from, DATE(valid_until) AS valid_until, fromname, fromaddr, subject, message, quote FROM mail.vmail_autoresponder WHERE account=?", array($acc['id']));

     $item = $result->fetch();

     DEBUG($item);

     $acc['autoresponder'] = $item;

@@ -106,7 +108,7 @@ function get_account_details($id, $checkuid = true)

 function get_vmail_accounts()

 {

 	$uid = (int) $_SESSION['userinfo']['uid'];

-	$result = db_query("SELECT * from mail.v_vmail_accounts WHERE useraccount='{$uid}' ORDER BY domainname,local ASC");

+	$result = db_query("SELECT * from mail.v_vmail_accounts WHERE useraccount=? ORDER BY domainname,local ASC", array($uid));

 	$ret = array();

 	while ($line = $result->fetch())

 	{

@@ -121,7 +123,7 @@ function get_vmail_accounts()

 function get_vmail_domains()

 {

 	$uid = (int) $_SESSION['userinfo']['uid'];

-	$result = db_query("SELECT id, domainname, server FROM mail.v_vmail_domains WHERE useraccount='{$uid}' ORDER BY domainname");

+	$result = db_query("SELECT id, domainname, server FROM mail.v_vmail_domains WHERE useraccount=? ORDER BY domainname", array($uid));

 	if ($result->rowCount() == 0)

 		system_failure('Sie haben keine Domains für virtuelle Mail-Verarbeitung');

 	$ret = array();

@@ -141,7 +143,7 @@ function find_account_id($accname)

     system_failure("Der Account hat nicht die korrekte Syntax");

   list( $local, $domainname) = $tmp;

-  $result = db_query("SELECT id FROM mail.v_vmail_accounts WHERE local='{$local}' AND domainname='{$domainname}' LIMIT 1");

+  $result = db_query("SELECT id FROM mail.v_vmail_accounts WHERE local=? AND domainname=? LIMIT 1", array($local, $domainname));

   if ($result->rowCount() == 0)

     system_failure("Der Account konnte nicht gefunden werden");

   $tmp = $result->fetch();

@@ -152,8 +154,8 @@ function find_account_id($accname)

 function change_vmail_password($accname, $newpass)

 {

   $accid = find_account_id($accname);

-  $encpw = db_escape_string(encrypt_mail_password($newpass));

-  db_query("UPDATE mail.vmail_accounts SET password='{$encpw}' WHERE id={$accid} LIMIT 1;");

+  $encpw = encrypt_mail_password($newpass);

+  db_query("UPDATE mail.vmail_accounts SET password=:encpw WHERE id=:accid", array(":encpw" => $encpw, ":accid" => $accid));

 }

@@ -176,7 +178,7 @@ function domainselect($selected = NULL, $selectattribute = '')

 function get_max_mailboxquota($server, $oldquota) {

   $uid = (int) $_SESSION['userinfo']['uid'];

   $server = (int) $server;

-  $result = db_query("SELECT systemquota - (COALESCE(systemquota_used,0) + COALESCE(mailquota,0)) AS free FROM system.v_quota WHERE uid='{$uid}' AND server='{$server}'");

+  $result = db_query("SELECT systemquota - (COALESCE(systemquota_used,0) + COALESCE(mailquota,0)) AS free FROM system.v_quota WHERE uid=:uid AND server=:server", array(":uid" => $uid, ":server" => $server));

   $item = $result->fetch();

   DEBUG("Free space: ".$item['free']." / Really: ".($item['free'] + ($oldquota - config('vmail_basequota'))));

   return $item['free'] + ($oldquota - config('vmail_basequota'));

@@ -256,7 +258,7 @@ function save_vmail_account($account)

     $password = NULL; 

     $set_password = false;

   } else {

-    $password='NULL';

+    $password= NULL;

     if ($account['password'] != '')

     {

       $account['password'] = stripslashes($account['password']);

@@ -266,25 +268,25 @@ function save_vmail_account($account)

         system_failure('Ihr Passwort ist zu einfach. bitte wählen Sie ein sicheres Passwort!'."\nDie Fehlermeldung lautet: »{$crack}«");

         return false;

       }

-      $password = "'".encrypt_mail_password($account['password'])."'";

+      $password = encrypt_mail_password($account['password']);

     }

-    $set_password = ($id == NULL || $password != 'NULL');

+    $set_password = ($id == NULL || $password != NULL);

     if ($account['password'] === NULL) {

       $set_password=true;

     }

   }  

-  $spam = 'NULL';

+  $spam = NULL;

   switch ($account['spamfilter'])

   {

     case 'folder':

-      $spam = "'folder'";

+      $spam = "folder";

       break;

     case 'tag':

-      $spam = "'tag'";

+      $spam = "tag";

       break;

     case 'delete':

-      $spam = "'delete'";

+      $spam = "delete";

       break;

   }

@@ -313,69 +315,69 @@ function save_vmail_account($account)

     $account['quota_threshold'] = min( (int) $account['quota_threshold'], (int) $account['quota'] );

   }

-  $account['local'] = db_escape_string(strtolower($account['local']));

-  $account['password'] = db_escape_string($account['password']);

+  $account['local'] = strtolower($account['local']);

   $account['spamexpire'] = (int) $account['spamexpire'];

+  $args = array(":local" => $account['local'],

+                ":domain" => $account['domain'],

+                ":password" => $password,

+                ":spamfilter" => $spam,

+                ":spamexpire" => $account['spamexpire'],

+                ":quota" => $account['quota'], 

+                ":quota_threshold" => $account['quota_threshold'],

+                ":id" => $id

+                );

   $query = '';

   if ($newaccount)

   {

-    $query = "INSERT INTO mail.vmail_accounts (local, domain, spamfilter, spamexpire, password, quota, quota_threshold) VALUES ";

-    $query .= "('{$account['local']}', {$account['domain']}, {$spam}, {$account['spamexpire']}, {$password}, {$account['quota']}, {$account['quota_threshold']});";

-    db_query($query); 

-    $id = mysql_insert_id();

-  }

-  else

-  {

+    unset($args[":id"]);

+    $query = "INSERT INTO mail.vmail_accounts (local, domain, spamfilter, spamexpire, password, quota, quota_threshold) VALUES (:local, :domain, :spamfilter, :spamexpire, :password, :quota, :quota_threshold)";

+  } else {

     if ($set_password)

-      $password=", password={$password}";

-    else

-      $password='';

-    $query = "UPDATE mail.vmail_accounts SET local='{$account['local']}', domain={$account['domain']}{$password}, ";

-    $query .= "spamfilter={$spam}, spamexpire={$account['spamexpire']}, quota={$account['quota']}, quota_threshold={$account['quota_threshold']} ";

-    $query .= "WHERE id={$id} LIMIT 1;";

-    db_query($query); 

+      $pw=", password=:password";

+    else {

+      unset($args[":password"]);

+      $pw='';

+    }

+    $query = "UPDATE mail.vmail_accounts SET local=:local, domain=:domain{$pw}, spamfilter=:spamfilter, spamexpire=:spamexpire, quota=:quota, quota_threshold=:quota_threshold WHERE id=:id";

+  }

+  db_query($query, $args); 

+  if ($newaccount) {

+    $id = db_insert_id();

   }

   if (is_array($account['autoresponder'])) {

     $ar = $account['autoresponder'];

-    $valid_from = maybe_null($ar['valid_from']);

-    $valid_until = maybe_null($ar['valid_until']);

-    $fromname = maybe_null( db_escape_string($ar['fromname']) );

-    $fromaddr = NULL;

-    if ($ar['fromaddr']) {

-      $fromaddr = db_escape_string(check_emailaddr($ar['fromaddr']));

-    }

-    $fromaddr = maybe_null( $fromaddr );

-    $subject = maybe_null( db_escape_string($ar['subject']));

-    $message = db_escape_string($ar['message']);

-    $quote = "'inline'";

+    $quote = "inline";

     if ($ar['quote'] == 'attach')

-      $quote = "'attach'";

+      $quote = "attach";

     elseif ($ar['quote'] == NULL)

-      $quote = 'NULL';

-    db_query("REPLACE INTO mail.vmail_autoresponder (account, valid_from, valid_until, fromname, fromaddr, subject, message, quote) ".

-             "VALUES ({$id}, {$valid_from}, {$valid_until}, {$fromname}, {$fromaddr}, {$subject}, '{$message}', {$quote})");

+      $quote = NULL;

+    $query = "REPLACE INTO mail.vmail_autoresponder (account, valid_from, valid_until, fromname, fromaddr, subject, message, quote) ".

+             "VALUES (:id, :valid_from, :valid_until, :fromname, :fromaddr, :subject, :message, :quote)";

+    $args = array(":id" => $id,

+                  ":valid_from" => $ar['valid_from'],

+                  ":valid_until" => $ar['valid_until'],

+                  ":fromname" => $ar['fromname'],

+                  ":fromaddr" => check_emailaddr($ar['fromaddr']),

+                  ":subject" => $ar['subject'],

+                  ":message" => $ar['message'],

+                  ":quote" => $quote);

+    db_query($query, $args);

   }

   if (! $newaccount)

-    db_query("DELETE FROM mail.vmail_forward WHERE account={$id}");

+    db_query("DELETE FROM mail.vmail_forward WHERE account=?", array($id));

   if (count($account['forwards']) > 0)

   {

-    $forward_query = "INSERT INTO mail.vmail_forward (account,spamfilter,destination) VALUES ";

-    $first = true;

+    $forward_query = "INSERT INTO mail.vmail_forward (account,spamfilter,destination) VALUES (:account, :spamfilter, :destination)";

     for ($i=0;$i < count($account['forwards']); $i++)

     { 

-      if ($first)

-        $first = false;

-      else

-        $forward_query .= ', ';

-      $forward_query .= "({$id}, ".maybe_null($account['forwards'][$i]['spamfilter']).", '{$account['forwards'][$i]['destination']}')";

+      db_query($forward_query, array(":id" => $id, ":spamfilter" => $account['forwards'][$i]['spamfilter'], ":destination" => $account['forwards'][$i]['destination']));

     }

-    db_query($forward_query);

   }

   if ($newaccount && $password != 'NULL')

   {

@@ -416,10 +418,10 @@ Wussten Sie schon, dass Sie auf mehrere Arten Ihre E-Mails abrufen können?

   // Update Mail-Quota-Cache

   if ($_SESSION['role'] == ROLE_SYSTEMUSER) {

     $uid = (int) $_SESSION['userinfo']['uid'];

-    $result = db_query("SELECT useraccount, server, SUM(quota-(SELECT value FROM misc.config WHERE `key`='vmail_basequota')) AS quota, SUM(GREATEST(quota_used-(SELECT value FROM misc.config WHERE `key`='vmail_basequota'), 0)) AS used FROM mail.v_vmail_accounts WHERE useraccount=".$uid." GROUP BY useraccount, server");

+    $result = db_query("SELECT useraccount, server, SUM(quota-(SELECT value FROM misc.config WHERE `key`='vmail_basequota')) AS quota, SUM(GREATEST(quota_used-(SELECT value FROM misc.config WHERE `key`='vmail_basequota'), 0)) AS used FROM mail.v_vmail_accounts WHERE useraccount=? GROUP BY useraccount, server", array($uid));

     while ($line = $result->fetch()) {

       if ($line['quota'] !== NULL) {

-        db_query("REPLACE INTO mail.vmailquota (uid, server, quota, used) VALUES ('{$line['useraccount']}', '{$line['server']}', '{$line['quota']}', '{$line['used']}')");

+        db_query("REPLACE INTO mail.vmailquota (uid, server, quota, used) VALUES (:uid, :server, :quota, :used)", array(":uid" => $line['useraccount'], ":server" => $line['server'], ":quota" => $line['quota'], ":used" => $line['used']));

       }

     }

   }

@@ -432,7 +434,7 @@ Wussten Sie schon, dass Sie auf mehrere Arten Ihre E-Mails abrufen können?

 function delete_account($id)

 {

   $account = get_account_details($id);

-  db_query("DELETE FROM mail.vmail_accounts WHERE id={$account['id']};");

+  db_query("DELETE FROM mail.vmail_accounts WHERE id=?", array($account['id']));

 }

@@ -445,7 +447,7 @@ function domainsettings($only_domain=NULL) {

   $subdomains = array();

   // Domains

-  $result = db_query("SELECT d.id, CONCAT_WS('.',d.domainname,d.tld) AS name, d.mail, d.mailserver_lock, m.id AS m_id, v.id AS v_id FROM kundendaten.domains AS d LEFT JOIN mail.virtual_mail_domains AS v ON (d.id=v.domain AND v.hostname IS NULL) LEFT JOIN mail.custom_mappings AS m ON (d.id=m.domain AND m.subdomain IS NULL) WHERE d.useraccount={$uid} OR m.uid={$uid} ORDER BY CONCAT_WS('.',d.domainname,d.tld);");

+  $result = db_query("SELECT d.id, CONCAT_WS('.',d.domainname,d.tld) AS name, d.mail, d.mailserver_lock, m.id AS m_id, v.id AS v_id FROM kundendaten.domains AS d LEFT JOIN mail.virtual_mail_domains AS v ON (d.id=v.domain AND v.hostname IS NULL) LEFT JOIN mail.custom_mappings AS m ON (d.id=m.domain AND m.subdomain IS NULL) WHERE d.useraccount=:uid OR m.uid=:uid ORDER BY CONCAT_WS('.',d.domainname,d.tld);", array(":uid" => $uid));

   while ($mydom = $result->fetch()) {

     if (! array_key_exists($mydom['id'], $domains)) {

@@ -462,7 +464,7 @@ function domainsettings($only_domain=NULL) {

   }      

   // Subdomains

-  $result = db_query("SELECT d.id, CONCAT_WS('.',d.domainname,d.tld) AS name, d.mail, m.id AS m_id, v.id AS v_id, IF(ISNULL(v.hostname),m.subdomain,v.hostname) AS hostname FROM kundendaten.domains AS d LEFT JOIN mail.virtual_mail_domains AS v ON (d.id=v.domain AND v.hostname IS NOT NULL) LEFT JOIN mail.custom_mappings AS m ON (d.id=m.domain AND m.subdomain IS NOT NULL) WHERE (m.id IS NOT NULL OR v.id IS NOT NULL) AND d.useraccount={$uid} OR m.uid={$uid};");

+  $result = db_query("SELECT d.id, CONCAT_WS('.',d.domainname,d.tld) AS name, d.mail, m.id AS m_id, v.id AS v_id, IF(ISNULL(v.hostname),m.subdomain,v.hostname) AS hostname FROM kundendaten.domains AS d LEFT JOIN mail.virtual_mail_domains AS v ON (d.id=v.domain AND v.hostname IS NOT NULL) LEFT JOIN mail.custom_mappings AS m ON (d.id=m.domain AND m.subdomain IS NOT NULL) WHERE (m.id IS NOT NULL OR v.id IS NOT NULL) AND d.useraccount=:uid OR m.uid=:uid;", array(":uid" => $uid));

   while ($mydom = $result->fetch()) {

     if (! array_key_exists($mydom['id'], $subdomains))

       $subdomains[$mydom['id']] = array();

@@ -482,7 +484,7 @@ function domainsettings($only_domain=NULL) {

 function domain_has_vmail_accounts($domid)

 {

   $domid = (int) $domid;

-  $result = db_query("SELECT dom.id FROM mail.vmail_accounts AS acc LEFT JOIN mail.virtual_mail_domains AS dom ON (dom.id=acc.domain) WHERE dom.domain={$domid}");

+  $result = db_query("SELECT dom.id FROM mail.vmail_accounts AS acc LEFT JOIN mail.virtual_mail_domains AS dom ON (dom.id=acc.domain) WHERE dom.domain=?", array($domid));

   return ($result->rowCount() > 0);

 }

@@ -502,20 +504,20 @@ function change_domain($id, $type)

     system_failure('Domain ist bereits so konfiguriert');

   if ($type == 'none') {

-    db_query("DELETE FROM mail.virtual_mail_domains WHERE domain={$id} AND hostname IS NULL LIMIT 1;");

-    db_query("DELETE FROM mail.custom_mappings WHERE domain={$id} AND subdomain IS NULL LIMIT 1;");

-    db_query("UPDATE kundendaten.domains SET mail='none', lastchange=NOW() WHERE id={$id} LIMIT 1;");

+    db_query("DELETE FROM mail.virtual_mail_domains WHERE domain=? AND hostname IS NULL", array($id));

+    db_query("DELETE FROM mail.custom_mappings WHERE domain=? AND subdomain IS NULL", array($id));

+    db_query("UPDATE kundendaten.domains SET mail='none', lastchange=NOW() WHERE id=?", array($id));

   }

   elseif ($type == 'virtual') {

     $vmailserver = (int) $_SESSION['userinfo']['server'];

-    db_query("DELETE FROM mail.custom_mappings WHERE domain={$id} AND subdomain IS NULL LIMIT 1;");

-    db_query("UPDATE kundendaten.domains SET mail='auto', lastchange=NOW() WHERE id={$id} LIMIT 1;");

-    db_query("INSERT INTO mail.virtual_mail_domains (domain, server) VALUES ({$id}, {$vmailserver});");

+    db_query("DELETE FROM mail.custom_mappings WHERE domain=? AND subdomain IS NULL", array($id));

+    db_query("UPDATE kundendaten.domains SET mail='auto', lastchange=NOW() WHERE id=?", array($id));

+    db_query("INSERT INTO mail.virtual_mail_domains (domain, server) VALUES (?, ?)", array($id, $vmailserver));

   }

   elseif ($type == 'auto') {

-    db_query("DELETE FROM mail.virtual_mail_domains WHERE domain={$id} AND hostname IS NULL LIMIT 1;");

-    db_query("DELETE FROM mail.custom_mappings WHERE domain={$id} AND subdomain IS NULL LIMIT 1;");

-    db_query("UPDATE kundendaten.domains SET mail='auto', lastchange=NOW() WHERE id={$id} LIMIT 1;");

+    db_query("DELETE FROM mail.virtual_mail_domains WHERE domain=? AND hostname IS NULL LIMIT 1;", array($id));

+    db_query("DELETE FROM mail.custom_mappings WHERE domain=? AND subdomain IS NULL LIMIT 1;", array($id));

+    db_query("UPDATE kundendaten.domains SET mail='auto', lastchange=NOW() WHERE id=? LIMIT 1;", array($id));

   }

 }