diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions.php index 7fb9f366d..a6552ae00 100644 --- a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions.php +++ b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions.php @@ -1110,9 +1110,15 @@ class Actions return $oAccount; } - protected function getDecodedRawKeyValue(string $sRawKey): array + protected function encodeRawKey(?Model\Account $oAccount, array $aValues): string { - return empty($sRawKey) ? array() : Utils::DecodeKeyValuesQ($sRawKey); + return \SnappyMail\Crypt::EncryptUrlSafe($aValues, \sha1(APP_SALT . ($oAccount ? $oAccount->Hash() : ''))); + } + + protected function decodeRawKey(?Model\Account $oAccount, string $sRawKey): array + { + return empty($sRawKey) ? [] + : (\SnappyMail\Crypt::DecryptUrlSafe($sRawKey, \sha1(APP_SALT . ($oAccount ? $oAccount->Hash() : ''))) ?: []); } public function StaticCache(): string diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Attachments.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Attachments.php index 9f0694461..1c48eb72a 100644 --- a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Attachments.php +++ b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Attachments.php @@ -107,8 +107,7 @@ trait Attachments if (!$bError) { $mResult = array( - 'FileHash' => Utils::EncodeKeyValuesQ(array( - 'Account' => $oAccount ? $oAccount->Hash() : '', + 'FileHash' => $this->encodeRawKey($oAccount, array( 'FileName' => ($sFolder ? 'messages' : 'attachments') . \date('-YmdHis') . '.zip', 'MimeType' => 'application/zip', 'FileHash' => $sZipHash @@ -135,7 +134,7 @@ trait Attachments private function getMimeFileByHash(\RainLoop\Model\Account $oAccount, string $sHash) : array { - $aValues = $this->getDecodedRawKeyValue($sHash); + $aValues = $this->decodeRawKey($oAccount, $sHash); $sFolder = isset($aValues['Folder']) ? (string) $aValues['Folder'] : ''; $iUid = isset($aValues['Uid']) ? (int) $aValues['Uid'] : 0; diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Messages.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Messages.php index 12d687d24..8ff9a918c 100644 --- a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Messages.php +++ b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Messages.php @@ -566,7 +566,7 @@ trait Messages $oFilesProvider = $this->FilesProvider(); foreach ($aAttachments as $mIndex => $sAttachment) { $aAttachments[$mIndex] = false; - if ($aValues = \RainLoop\Utils::DecodeKeyValuesQ($sAttachment)) { + if ($aValues = $this->encodeRawKey($oAccount, $sAttachment)) { $sFolder = isset($aValues['Folder']) ? (string) $aValues['Folder'] : ''; $iUid = isset($aValues['Uid']) ? (int) $aValues['Uid'] : 0; $sMimeIndex = isset($aValues['MimeIndex']) ? (string) $aValues['MimeIndex'] : ''; diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Raw.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Raw.php index f8ee81b02..7c133429f 100644 --- a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Raw.php +++ b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Raw.php @@ -9,10 +9,12 @@ trait Raw */ public function RawViewAsPlain() : bool { - $this->initMailClientConnection(); + $oAccount = $this->initMailClientConnection(); - $sRawKey = (string) $this->GetActionParam('RawKey', ''); - $aValues = $this->getDecodedRawKeyValue($sRawKey); + $aValues = $this->decodeRawKey( + $oAccount, + (string) $this->GetActionParam('RawKey', '') + ); $sFolder = isset($aValues['Folder']) ? (string) $aValues['Folder'] : ''; $iUid = isset($aValues['Uid']) ? (int) $aValues['Uid'] : 0; @@ -113,7 +115,8 @@ trait Raw { $sRawKey = (string) $this->GetActionParam('RawKey', ''); - $aValues = $this->getDecodedRawKeyValue($sRawKey); + $oAccount = $this->getAccountFromToken(); + $aValues = $this->decodeRawKey($oAccount, $sRawKey); $sRange = \MailSo\Base\Http::GetHeader('Range'); @@ -141,8 +144,6 @@ trait Raw if (!empty($sFileHashIn)) { $this->verifyCacheByKey($sRawKey); - $oAccount = $this->getAccountFromToken(); - // https://github.com/the-djmaze/snappymail/issues/144 if ('.pdf' === \substr($sFileNameIn,-4)) { $sContentTypeOut = 'application/pdf'; // application/octet-stream @@ -175,7 +176,7 @@ trait Raw $this->verifyCacheByKey($sRawKey); } - $oAccount = $this->initMailClientConnection(); + $this->initMailClientConnection(); $self = $this; return $this->MailClient()->MessageMimeStream( diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Response.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Response.php index 1cebd2b2b..26e0f06c7 100644 --- a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Response.php +++ b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Response.php @@ -130,8 +130,7 @@ trait Response $sSubject = $mResult['subject']; $mResult['Hash'] = \md5($mResult['Folder'].$mResult['Uid']); - $mResult['RequestHash'] = Utils::EncodeKeyValuesQ(array( - 'Account' => $oAccount->Hash(), + $mResult['RequestHash'] = $this->encodeRawKey($oAccount, array( 'Folder' => $mResult['Folder'], 'Uid' => $mResult['Uid'], 'MimeType' => 'message/rfc822', @@ -180,8 +179,7 @@ trait Response if ($mResponse instanceof \MailSo\Mail\Attachment) { $mResult = $mResponse->jsonSerialize(); $mResult['IsThumbnail'] = $this->GetCapa(Capa::ATTACHMENT_THUMBNAILS) && $this->isFileHasThumbnail($mResult['FileName']); - $mResult['Download'] = Utils::EncodeKeyValuesQ(array( - 'Account' => $this->getAccountFromToken()->Hash(), + $mResult['Download'] = $this->encodeRawKey($this->getAccountFromToken(), array( 'Folder' => $mResult['Folder'], 'Uid' => $mResult['Uid'], 'MimeIndex' => $mResult['MimeIndex'],