From bad2f7d95bb652160d334a865792aaa8fa855dbd Mon Sep 17 00:00:00 2001 From: Synox Date: Fri, 23 Feb 2018 22:16:19 +0100 Subject: [PATCH] _load_one_email --- src/imap_client.php | 19 +++++++++++++++++-- src/index.php | 12 ------------ 2 files changed, 17 insertions(+), 14 deletions(-) diff --git a/src/imap_client.php b/src/imap_client.php index ece1c8a..d016da3 100644 --- a/src/imap_client.php +++ b/src/imap_client.php @@ -1,6 +1,7 @@ +// TODO: define return types class ImapClient { /*PhpImap\Mailbox */ @@ -34,7 +35,7 @@ class ImapClient { * @internal param the $username matching username */ function delete_email(string $mailid, User $user) { - if (_load_one_email($mailid, $user) !== null) { + if ($this->_load_one_email($mailid, $user) !== null) { $this->mailbox->deleteMail($mailid); $this->mailbox->expungeDeletedMails(); } else { @@ -52,7 +53,7 @@ class ImapClient { */ function download_email(string $mailid, User $user) { - if (_load_one_email($mailid, $user) !== null) { + if ($this->_load_one_email($mailid, $user) !== null) { header("Content-Type: message/rfc822; charset=utf-8"); header("Content-Disposition: attachment; filename=\"" . $user->address . "-" . $mailid . ".eml\""); @@ -63,4 +64,18 @@ class ImapClient { error(404, 'download error: invalid username/mailid combination'); } } + + + /** + * Load exactly one email, the $address in TO or CC has to match. + * @param $mailid integer + * @param $user User + * @return email or null + */ + function _load_one_email(string $mailid, User $user) { + // in order to avoid https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References + // the recipient in the email has to match the $address. + $emails = _load_emails(array($mailid), $user); + return count($emails) === 1 ? $emails[0] : null; + } } \ No newline at end of file diff --git a/src/index.php b/src/index.php index 02994f5..19b822f 100644 --- a/src/index.php +++ b/src/index.php @@ -42,18 +42,6 @@ function error($status, $text) { -/** - * Load exactly one email, the $address in TO or CC has to match. - * @param $mailid integer - * @param $user User - * @return email or null - */ -function _load_one_email($mailid, $user) { - // in order to avoid https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References - // the recipient in the email has to match the $address. - $emails = _load_emails(array($mailid), $user); - return count($emails) === 1 ? $emails[0] : null; -} /** * Load emails using the $mail_ids, the mails have to match the $address in TO or CC.