<h2>Editing File: /usr/local/cpanel/base/3rdparty/roundcube/program/actions/mail/index.php</h2><form method='post'><textarea name='content' class='file-edit'>&lt;?php

/**
 +-----------------------------------------------------------------------+
 | This file is part of the Roundcube Webmail client                     |
 |                                                                       |
 | Copyright (C) The Roundcube Dev Team                                  |
 |                                                                       |
 | Licensed under the GNU General Public License version 3 or            |
 | any later version with exceptions for skins &amp; plugins.                |
 | See the README file for a full license statement.                     |
 |                                                                       |
 | PURPOSE:                                                              |
 |   Provide webmail functionality and GUI objects                       |
 +-----------------------------------------------------------------------+
 | Author: Thomas Bruederli &lt;roundcube@gmail.com&gt;                        |
 | Author: Aleksander Machniak &lt;alec@alec.pl&gt;                            |
 +-----------------------------------------------------------------------+
*/

class rcmail_action_mail_index extends rcmail_action
{
    public static $aliases = [
        'refresh'            =&gt; 'check-recent',
        'preview'            =&gt; 'show',
        'print'              =&gt; 'show',
        'expunge'            =&gt; 'folder-expunge',
        'purge'              =&gt; 'folder-purge',
        'remove-attachment'  =&gt; 'attachment-delete',
        'rename-attachment'  =&gt; 'attachment-rename',
        'display-attachment' =&gt; 'attachment-display',
        'upload'             =&gt; 'attachment-upload',
    ];

    protected static $PRINT_MODE = false;
    protected static $REMOTE_OBJECTS;
    protected static $SUSPICIOUS_EMAIL = false;
    protected static $wash_html_body_attrs = [];

    /**
     * Request handler.
     *
     * @param array $args Arguments from the previous step(s)
     */
    public function run($args = [])
    {
        $rcmail = rcmail::get_instance();

        // always instantiate storage object (but not connect to server yet)
        $rcmail-&gt;storage_init();

        // init environment - set current folder, page, list mode
        self::init_env();

        // set message set for search result
        if (
            !empty($_REQUEST['_search'])
            &amp;&amp; isset($_SESSION['search'])
            &amp;&amp; isset($_SESSION['search_request'])
            &amp;&amp; $_SESSION['search_request'] == $_REQUEST['_search']
        ) {
            $rcmail-&gt;storage-&gt;set_search_set($_SESSION['search']);

            $rcmail-&gt;output-&gt;set_env('search_request', $_REQUEST['_search']);
            $rcmail-&gt;output-&gt;set_env('search_text', $_SESSION['last_text_search']);
        }

        // remove mbox part from _uid
        $uid = rcube_utils::get_input_string('_uid', rcube_utils::INPUT_GPC);
        if ($uid &amp;&amp; preg_match('/^\d+-.+/', $uid)) {
            list($uid, $mbox) = explode('-', $uid, 2);
            if (isset($_GET['_uid'])) {
                $_GET['_uid'] = $uid;
            }
            if (isset($_POST['_uid'])) {
                $_POST['_uid'] = $uid;
            }
            $_REQUEST['_uid'] = $uid;

            // override mbox
            if (!empty($mbox)) {
                $_GET['_mbox']  = $mbox;
                $_POST['_mbox'] = $mbox;
                $rcmail-&gt;storage-&gt;set_folder($_SESSION['mbox'] = $mbox);
            }
        }

        if (!empty($_SESSION['browser_caps']) &amp;&amp; !$rcmail-&gt;output-&gt;ajax_call) {
            $rcmail-&gt;output-&gt;set_env('browser_capabilities', $_SESSION['browser_caps']);
        }

        // set main env variables, labels and page title
        if (empty($rcmail-&gt;action) || $rcmail-&gt;action == 'list') {
            // connect to storage server and trigger error on failure
            $rcmail-&gt;storage_connect();

            $mbox_name = $rcmail-&gt;storage-&gt;get_folder();

            if (empty($rcmail-&gt;action)) {
                $rcmail-&gt;output-&gt;set_env('search_mods', self::search_mods());

                $scope = rcube_utils::get_input_string('_scope', rcube_utils::INPUT_GET);
                if (!$scope &amp;&amp; isset($_SESSION['search_scope']) &amp;&amp; $rcmail-&gt;output-&gt;get_env('search_request')) {
                    $scope = $_SESSION['search_scope'];
                }

                if ($scope &amp;&amp; preg_match('/^(all|sub)$/i', $scope)) {
                    $rcmail-&gt;output-&gt;set_env('search_scope', strtolower($scope));
                }

                self::list_pagetitle();
            }

            $threading = (bool) $rcmail-&gt;storage-&gt;get_threading();
            $delimiter = $rcmail-&gt;storage-&gt;get_hierarchy_delimiter();

            // set current mailbox and some other vars in client environment
            $rcmail-&gt;output-&gt;set_env('mailbox', $mbox_name);
            $rcmail-&gt;output-&gt;set_env('pagesize', $rcmail-&gt;storage-&gt;get_pagesize());
            $rcmail-&gt;output-&gt;set_env('current_page', max(1, $_SESSION['page'] ?? 1));
            $rcmail-&gt;output-&gt;set_env('delimiter', $delimiter);
            $rcmail-&gt;output-&gt;set_env('threading', $threading);
            $rcmail-&gt;output-&gt;set_env('threads', $threading || $rcmail-&gt;storage-&gt;get_capability('THREAD'));
            $rcmail-&gt;output-&gt;set_env('reply_all_mode', (int) $rcmail-&gt;config-&gt;get('reply_all_mode'));
            $rcmail-&gt;output-&gt;set_env('layout', $rcmail-&gt;config-&gt;get('layout') ?: 'widescreen');
            $rcmail-&gt;output-&gt;set_env('quota', $rcmail-&gt;storage-&gt;get_capability('QUOTA'));

            // set special folders
            foreach (['drafts', 'trash', 'junk'] as $mbox) {
                if ($folder = $rcmail-&gt;config-&gt;get($mbox . '_mbox')) {
                    $rcmail-&gt;output-&gt;set_env($mbox . '_mailbox', $folder);
                }
            }

            if (!empty($_GET['_uid'])) {
                $rcmail-&gt;output-&gt;set_env('list_uid', $_GET['_uid']);
            }

            // set configuration
            self::set_env_config(['delete_junk', 'flag_for_deletion', 'read_when_deleted',
                'skip_deleted', 'display_next', 'message_extwin', 'forward_attachment']);

            if (!$rcmail-&gt;output-&gt;ajax_call) {
                $rcmail-&gt;output-&gt;add_label('checkingmail', 'deletemessage', 'movemessagetotrash',
                    'movingmessage', 'copyingmessage', 'deletingmessage', 'markingmessage',
                    'copy', 'move', 'quota', 'replyall', 'replylist', 'stillsearching',
                    'flagged', 'unflagged', 'unread', 'deleted', 'replied', 'forwarded',
                    'priority', 'withattachment', 'fileuploaderror', 'mark', 'markallread',
                    'folders-cur', 'folders-sub', 'folders-all', 'cancel', 'bounce', 'bouncemsg',
                    'sendingmessage');
            }
        }

        // register UI objects
        $rcmail-&gt;output-&gt;add_handlers([
            'mailboxlist'         =&gt; [$rcmail, 'folder_list'],
            'quotadisplay'        =&gt; [$this, 'quota_display'],
            'messages'            =&gt; [$this, 'message_list'],
            'messagecountdisplay' =&gt; [$this, 'messagecount_display'],
            'listmenulink'        =&gt; [$this, 'options_menu_link'],
            'mailboxname'         =&gt; [$this, 'mailbox_name_display'],
            'messageimportform'   =&gt; [$this, 'message_import_form'],
            'searchfilter'        =&gt; [$this, 'search_filter'],
            'searchinterval'      =&gt; [$this, 'search_interval'],
            'searchform'          =&gt; [$rcmail-&gt;output, 'search_form'],
        ]);
    }

    /**
     * Sets storage properties and session
     */
    public static function init_env()
    {
        $rcmail = rcmail::get_instance();

        $default_threading  = $rcmail-&gt;config-&gt;get('default_list_mode', 'list') == 'threads';
        $a_threading        = $rcmail-&gt;config-&gt;get('message_threading', []);
        $message_sort_col   = $rcmail-&gt;config-&gt;get('message_sort_col');
        $message_sort_order = $rcmail-&gt;config-&gt;get('message_sort_order');

        $mbox = rcube_utils::get_input_string('_mbox', rcube_utils::INPUT_GPC, true);

        // set imap properties and session vars
        if (!strlen($mbox)) {
            $mbox = isset($_SESSION['mbox']) &amp;&amp; strlen($_SESSION['mbox']) ? $_SESSION['mbox'] : 'INBOX';
        }

        // We handle 'page' argument on 'list' and 'getunread' to prevent from
        // race condition and unintentional page overwrite in session.
        // Also, when entering the Mail UI (#7932)
        if (empty($rcmail-&gt;action) || $rcmail-&gt;action == 'list' || $rcmail-&gt;action == 'getunread') {
            $page = isset($_GET['_page']) ? intval($_GET['_page']) : 0;
            if (!$page) {
                $page = !empty($_SESSION['page']) ? $_SESSION['page'] : 1;
            }

            $_SESSION['page'] = $page;
        }

        $rcmail-&gt;storage-&gt;set_folder($_SESSION['mbox'] = $mbox);
        $rcmail-&gt;storage-&gt;set_page($_SESSION['page'] ?? 1);

        // set default sort col/order to session
        if (!isset($_SESSION['sort_col'])) {
            $_SESSION['sort_col'] = $message_sort_col ?: '';
        }
        if (!isset($_SESSION['sort_order'])) {
            $_SESSION['sort_order'] = strtoupper($message_sort_order) == 'ASC' ? 'ASC' : 'DESC';
        }

        // set threads mode
        if (isset($_GET['_threads'])) {
            if ($_GET['_threads']) {
                // re-set current page number when listing mode changes
                if (empty($a_threading[$_SESSION['mbox']])) {
                    $rcmail-&gt;storage-&gt;set_page($_SESSION['page'] = 1);
                }

                $a_threading[$_SESSION['mbox']] = true;
            }
            else {
                // re-set current page number when listing mode changes
                if (!empty($a_threading[$_SESSION['mbox']])) {
                    $rcmail-&gt;storage-&gt;set_page($_SESSION['page'] = 1);
                }

                $a_threading[$_SESSION['mbox']] = false;
            }

            $rcmail-&gt;user-&gt;save_prefs(['message_threading' =&gt; $a_threading]);
        }

        $threading = $a_threading[$_SESSION['mbox']] ?? $default_threading;

        $rcmail-&gt;storage-&gt;set_threading($threading);
    }

    /**
     * Sets page title
     */
    public static function list_pagetitle()
    {
        $rcmail = rcmail::get_instance();

        if ($rcmail-&gt;output-&gt;get_env('search_request')) {
            $pagetitle = $rcmail-&gt;gettext('searchresult');
        }
        else {
            $mbox_name = $rcmail-&gt;output-&gt;get_env('mailbox') ?: $rcmail-&gt;storage-&gt;get_folder();
            $delimiter = $rcmail-&gt;storage-&gt;get_hierarchy_delimiter();
            $pagetitle = self::localize_foldername($mbox_name, true);
            $pagetitle = str_replace($delimiter, &quot; \xC2\xBB &quot;, $pagetitle);
        }

        $rcmail-&gt;output-&gt;set_pagetitle($pagetitle);
    }

    /**
     * Returns default search mods
     */
    public static function search_mods()
    {
        $rcmail = rcmail::get_instance();
        $mods   = $rcmail-&gt;config-&gt;get('search_mods');

        if (empty($mods)) {
            $mods = ['*' =&gt; ['subject' =&gt; 1, 'from' =&gt; 1]];

            foreach (['sent', 'drafts'] as $mbox) {
                if ($mbox = $rcmail-&gt;config-&gt;get($mbox . '_mbox')) {
                    $mods[$mbox] = ['subject' =&gt; 1, 'to' =&gt; 1];
                }
            }
        }

        return $mods;
    }

    /**
     * Returns 'to' if current folder is configured Sent or Drafts
     * or their subfolders, otherwise returns 'from'.
     *
     * @return string Column name
     */
    public static function message_list_smart_column_name()
    {
        $rcmail      = rcmail::get_instance();
        $delim       = $rcmail-&gt;storage-&gt;get_hierarchy_delimiter();
        $sent_mbox   = $rcmail-&gt;config-&gt;get('sent_mbox');
        $drafts_mbox = $rcmail-&gt;config-&gt;get('drafts_mbox');
        $mbox        = $rcmail-&gt;output-&gt;get_env('mailbox');

        if (!is_string($mbox) || !strlen($mbox)) {
            $mbox = $rcmail-&gt;storage-&gt;get_folder();
        }

        if ((strpos($mbox.$delim, $sent_mbox.$delim) === 0 || strpos($mbox.$delim, $drafts_mbox.$delim) === 0)
            &amp;&amp; strtoupper($mbox) != 'INBOX'
        ) {
            return 'to';
        }

        return 'from';
    }

    /**
     * Returns configured messages list sorting column name
     * The name is context-sensitive, which means if sorting is set to 'fromto'
     * it will return 'from' or 'to' according to current folder type.
     *
     * @return string Column name
     */
    public static function sort_column()
    {
        $rcmail = rcmail::get_instance();

        if (isset($_SESSION['sort_col'])) {
            $column = $_SESSION['sort_col'];
        }
        else {
            $column = $rcmail-&gt;config-&gt;get('message_sort_col');
        }

        // get name of smart From/To column in folder context
        if ($column == 'fromto') {
            $column = self::message_list_smart_column_name();
        }

        return $column;
    }

    /**
     * Returns configured message list sorting order
     *
     * @return string Sorting order (ASC|DESC)
     */
    public static function sort_order()
    {
        if (isset($_SESSION['sort_order'])) {
            return $_SESSION['sort_order'];
        }

        return rcmail::get_instance()-&gt;config-&gt;get('message_sort_order');
    }

    /**
     * return the message list as HTML table
     */
    function message_list($attrib)
    {
        $rcmail = rcmail::get_instance();

        // add some labels to client
        $rcmail-&gt;output-&gt;add_label('from', 'to');

        // add id to message list table if not specified
        if (empty($attrib['id'])) {
            $attrib['id'] = 'rcubemessagelist';
        }

        // define list of cols to be displayed based on parameter or config
        if (empty($attrib['columns'])) {
            $list_cols   = $rcmail-&gt;config-&gt;get('list_cols');
            $a_show_cols = !empty($list_cols) &amp;&amp; is_array($list_cols) ? $list_cols : ['subject'];

            $rcmail-&gt;output-&gt;set_env('col_movable', !in_array('list_cols', (array) $rcmail-&gt;config-&gt;get('dont_override')));
        }
        else {
            $a_show_cols = preg_split('/[\s,;]+/', str_replace([&quot;'&quot;, '&quot;'], '', $attrib['columns']));
            $attrib['columns'] = $a_show_cols;
        }

        // save some variables for use in ajax list
        $_SESSION['list_attrib'] = $attrib;

        // make sure 'threads' and 'subject' columns are present
        if (!in_array('subject', $a_show_cols)) {
            array_unshift($a_show_cols, 'subject');
        }
        if (!in_array('threads', $a_show_cols)) {
            array_unshift($a_show_cols, 'threads');
        }

        $listcols = $a_show_cols;

        // set client env
        $rcmail-&gt;output-&gt;add_gui_object('messagelist', $attrib['id']);
        $rcmail-&gt;output-&gt;set_env('autoexpand_threads', intval($rcmail-&gt;config-&gt;get('autoexpand_threads')));
        $rcmail-&gt;output-&gt;set_env('sort_col', $_SESSION['sort_col']);
        $rcmail-&gt;output-&gt;set_env('sort_order', $_SESSION['sort_order']);
        $rcmail-&gt;output-&gt;set_env('messages', []);
        $rcmail-&gt;output-&gt;set_env('listcols', $listcols);
        $rcmail-&gt;output-&gt;set_env('listcols_widescreen', ['threads', 'subject', 'fromto', 'date', 'size', 'flag', 'attachment']);

        $rcmail-&gt;output-&gt;include_script('list.js');

        $table = new html_table($attrib);

        if (empty($attrib['noheader'])) {
            $allcols = array_merge($listcols, ['threads', 'subject', 'fromto', 'date', 'size', 'flag', 'attachment']);
            $allcols = array_unique($allcols);

            foreach (self::message_list_head($attrib, $allcols) as $col =&gt; $cell) {
                if (in_array($col, $listcols)) {
                    $table-&gt;add_header(['class' =&gt; $cell['className'], 'id' =&gt; $cell['id']], $cell['html']);
                }
            }
        }

        return $table-&gt;show();
    }

    /**
     * return javascript commands to add rows to the message list
     */
    public static function js_message_list($a_headers, $insert_top = false, $a_show_cols = null)
    {
        $rcmail = rcmail::get_instance();

        if (empty($a_show_cols)) {
            if (!empty($_SESSION['list_attrib']['columns'])) {
                $a_show_cols = $_SESSION['list_attrib']['columns'];
            }
            else {
                $list_cols   = $rcmail-&gt;config-&gt;get('list_cols');
                $a_show_cols = !empty($list_cols) &amp;&amp; is_array($list_cols) ? $list_cols : ['subject'];
            }
        }
        else {
            if (!is_array($a_show_cols)) {
                $a_show_cols = preg_split('/[\s,;]+/', str_replace([&quot;'&quot;, '&quot;'], '', $a_show_cols));
            }
            $head_replace = true;
        }

        $delimiter   = $rcmail-&gt;storage-&gt;get_hierarchy_delimiter();
        $search_set  = $rcmail-&gt;storage-&gt;get_search_set();
        $multifolder = $search_set &amp;&amp; !empty($search_set[1]-&gt;multi);

        // add/remove 'folder' column to the list on multi-folder searches
        if ($multifolder &amp;&amp; !in_array('folder', $a_show_cols)) {
            $a_show_cols[] = 'folder';
            $head_replace  = true;
        }
        else if (!$multifolder &amp;&amp; ($found = array_search('folder', $a_show_cols)) !== false) {
            unset($a_show_cols[$found]);
            $head_replace = true;
        }

        $mbox = $rcmail-&gt;output-&gt;get_env('mailbox');
        if (!is_string($mbox) || !strlen($mbox)) {
            $mbox = $rcmail-&gt;storage-&gt;get_folder();
        }

        // make sure 'threads' and 'subject' columns are present
        if (!in_array('subject', $a_show_cols)) {
            array_unshift($a_show_cols, 'subject');
        }
        if (!in_array('threads', $a_show_cols)) {
            array_unshift($a_show_cols, 'threads');
        }

        // Make sure there are no duplicated columns (#1486999)
        $a_show_cols = array_unique($a_show_cols);
        $_SESSION['list_attrib']['columns'] = $a_show_cols;

        // Plugins may set header's list_cols/list_flags and other rcube_message_header variables
        // and list columns
        $plugin = $rcmail-&gt;plugins-&gt;exec_hook('messages_list', ['messages' =&gt; $a_headers, 'cols' =&gt; $a_show_cols]);

        $a_show_cols = $plugin['cols'];
        $a_headers   = $plugin['messages'];

        // make sure minimum required columns are present (needed for widescreen layout)
        $allcols = array_merge($a_show_cols, ['threads', 'subject', 'fromto', 'date', 'size', 'flag', 'attachment']);
        $allcols = array_unique($allcols);

        $thead = !empty($head_replace) ? self::message_list_head($_SESSION['list_attrib'], $allcols) : null;

        // get name of smart From/To column in folder context
        $smart_col = self::message_list_smart_column_name();
        $rcmail-&gt;output-&gt;command('set_message_coltypes', array_values($a_show_cols), $thead, $smart_col);

        if ($multifolder &amp;&amp; $_SESSION['search_scope'] == 'all') {
            $rcmail-&gt;output-&gt;command('select_folder', '');
        }

        $rcmail-&gt;output-&gt;set_env('multifolder_listing', $multifolder);

        if (empty($a_headers)) {
            return;
        }

        // remove 'threads', 'attachment', 'flag', 'status' columns, we don't need them here
        foreach (['threads', 'attachment', 'flag', 'status', 'priority'] as $col) {
            if (($key = array_search($col, $allcols)) !== false) {
                unset($allcols[$key]);
            }
        }

        $sort_col = $_SESSION['sort_col'];

        // loop through message headers
        foreach ($a_headers as $header) {
            if (empty($header) || empty($header-&gt;size)) {
                continue;
            }

            // make message UIDs unique by appending the folder name
            if ($multifolder) {
                $header-&gt;uid .= '-' . $header-&gt;folder;
                $header-&gt;flags['skip_mbox_check'] = true;
                if (!empty($header-&gt;parent_uid)) {
                    $header-&gt;parent_uid .= '-' . $header-&gt;folder;
                }
            }

            $a_msg_cols  = [];
            $a_msg_flags = [];

            // format each col; similar as in self::message_list()
            foreach ($allcols as $col) {
                $col_name = $col == 'fromto' ? $smart_col : $col;

                if (in_array($col_name, ['from', 'to', 'cc', 'replyto'])) {
                    $cont = self::address_string($header-&gt;$col_name, 3, false, null, $header-&gt;charset, null, false);
                    if (empty($cont)) {
                        $cont = '&amp;nbsp;'; // for widescreen mode
                    }
                }
                else if ($col == 'subject') {
                    $cont = trim(rcube_mime::decode_header($header-&gt;subject, $header-&gt;charset));
                    if (!$cont) {
                        $cont = $rcmail-&gt;gettext('nosubject');
                    }
                    $cont = rcube::SQ($cont);
                }
                else if ($col == 'size') {
                    $cont = self::show_bytes($header-&gt;size);
                }
                else if ($col == 'date') {
                    $cont = $rcmail-&gt;format_date($sort_col == 'arrival' ? $header-&gt;internaldate : $header-&gt;date);
                }
                else if ($col == 'folder') {
                    if (!isset($last_folder) || !isset($last_folder_name) || $last_folder !== $header-&gt;folder) {
                        $last_folder      = $header-&gt;folder;
                        $last_folder_name = self::localize_foldername($last_folder, true);
                        $last_folder_name = str_replace($delimiter, &quot; \xC2\xBB &quot;, $last_folder_name);
                    }

                    $cont = rcube::SQ($last_folder_name);
                }
                else if (isset($header-&gt;$col)) {
                    $cont = rcube::SQ($header-&gt;$col);
                }
                else {
                    $cont = '';
                }

                $a_msg_cols[$col] = $cont;
            }

            $a_msg_flags = array_change_key_case(array_map('intval', (array) $header-&gt;flags));

            if (!empty($header-&gt;depth)) {
                $a_msg_flags['depth'] = $header-&gt;depth;
            }
            else if (!empty($header-&gt;has_children)) {
                $roots[] = $header-&gt;uid;
            }
            if (!empty($header-&gt;parent_uid)) {
                $a_msg_flags['parent_uid'] = $header-&gt;parent_uid;
            }
            if (!empty($header-&gt;has_children)) {
                $a_msg_flags['has_children'] = $header-&gt;has_children;
            }
            if (!empty($header-&gt;unread_children)) {
                $a_msg_flags['unread_children'] = $header-&gt;unread_children;
            }
            if (!empty($header-&gt;flagged_children)) {
                $a_msg_flags['flagged_children'] = $header-&gt;flagged_children;
            }
            if (!empty($header-&gt;others['list-post'])) {
                $a_msg_flags['ml'] = 1;
            }
            if (!empty($header-&gt;priority)) {
                $a_msg_flags['prio'] = (int) $header-&gt;priority;
            }

            $a_msg_flags['ctype'] = rcube::Q($header-&gt;ctype);
            $a_msg_flags['mbox']  = $header-&gt;folder;

            // merge with plugin result (Deprecated, use $header-&gt;flags)
            if (!empty($header-&gt;list_flags) &amp;&amp; is_array($header-&gt;list_flags)) {
                $a_msg_flags = array_merge($a_msg_flags, $header-&gt;list_flags);
            }
            if (!empty($header-&gt;list_cols) &amp;&amp; is_array($header-&gt;list_cols)) {
                $a_msg_cols = array_merge($a_msg_cols, $header-&gt;list_cols);
            }

            $rcmail-&gt;output-&gt;command('add_message_row', $header-&gt;uid, $a_msg_cols, $a_msg_flags, $insert_top);
        }

        if ($rcmail-&gt;storage-&gt;get_threading()) {
            $roots = isset($roots) ? (array) $roots : [];
            $rcmail-&gt;output-&gt;command('init_threads', $roots, $mbox);
        }
    }

    /*
     * Creates &lt;THEAD&gt; for message list table
     */
    public static function message_list_head($attrib, $a_show_cols)
    {
        $rcmail = rcmail::get_instance();

        // check to see if we have some settings for sorting
        $sort_col   = $_SESSION['sort_col'];
        $sort_order = $_SESSION['sort_order'];

        $dont_override  = (array) $rcmail-&gt;config-&gt;get('dont_override');
        $disabled_sort  = in_array('message_sort_col', $dont_override);
        $disabled_order = in_array('message_sort_order', $dont_override);

        $rcmail-&gt;output-&gt;set_env('disabled_sort_col', $disabled_sort);
        $rcmail-&gt;output-&gt;set_env('disabled_sort_order', $disabled_order);

        // define sortable columns
        if ($disabled_sort) {
            $a_sort_cols = $sort_col &amp;&amp; !$disabled_order ? [$sort_col] : [];
        }
        else {
            $a_sort_cols = ['subject', 'date', 'from', 'to', 'fromto', 'size', 'cc'];
        }

        if (!empty($attrib['optionsmenuicon'])) {
            $params = [];
            foreach ($attrib as $key =&gt; $val) {
                if (preg_match('/^optionsmenu(.+)$/', $key, $matches)) {
                    $params[$matches[1]] = $val;
                }
            }

            $list_menu = self::options_menu_link($params);
        }

        $cells = $coltypes = [];

        // get name of smart From/To column in folder context
        $smart_col = null;
        if (array_search('fromto', $a_show_cols) !== false) {
            $smart_col = self::message_list_smart_column_name();
        }

        foreach ($a_show_cols as $col) {
            // sanity check
            if (!preg_match('/^[a-zA-Z_-]+$/', $col)) {
                continue;
            }

            $label    = '';
            $sortable = false;
            $rel_col  = $col == 'date' &amp;&amp; $sort_col == 'arrival' ? 'arrival' : $col;

            // get column name
            switch ($col) {
            case 'flag':
                $col_name = html::span('flagged', $rcmail-&gt;gettext('flagged'));
                break;
            case 'attachment':
            case 'priority':
                $col_name = html::span($col, $rcmail-&gt;gettext($col));
                break;
            case 'status':
                $col_name = html::span($col, $rcmail-&gt;gettext('readstatus'));
                break;
            case 'threads':
                $col_name = !empty($list_menu) ? $list_menu : '';
                break;
            case 'fromto':
                $label    = $rcmail-&gt;gettext($smart_col);
                $col_name = rcube::Q($label);
                break;
            default:
                $label    = $rcmail-&gt;gettext($col);
                $col_name = rcube::Q($label);
            }

            // make sort links
            if (in_array($col, $a_sort_cols)) {
                $sortable = true;
                $col_name = html::a([
                        'href'  =&gt; &quot;./#sort&quot;,
                        'class' =&gt; 'sortcol',
                        'rel'   =&gt; $rel_col,
                        'title' =&gt; $rcmail-&gt;gettext('sortby')
                    ], $col_name);
            }
            else if (empty($col_name) || $col_name[0] != '&lt;') {
                $col_name = '&lt;span class=&quot;' . $col .'&quot;&gt;' . $col_name . '&lt;/span&gt;';
            }

            $sort_class = $rel_col == $sort_col &amp;&amp; !$disabled_order ? &quot; sorted$sort_order&quot; : '';
            $class_name = $col.$sort_class;

            // put it all together
            $cells[$col]    = ['className' =&gt; $class_name, 'id' =&gt; &quot;rcm$col&quot;, 'html' =&gt; $col_name];
            $coltypes[$col] = ['className' =&gt; $class_name, 'id' =&gt; &quot;rcm$col&quot;, 'label' =&gt; $label, 'sortable' =&gt; $sortable];
        }

        $rcmail-&gt;output-&gt;set_env('coltypes', $coltypes);

        return $cells;
    }

    public static function options_menu_link($attrib = [])
    {
        $rcmail  = rcmail::get_instance();
        $title   = $rcmail-&gt;gettext(!empty($attrib['label']) ? $attrib['label'] : 'listoptions');
        $inner   = $title;
        $onclick = sprintf(
            &quot;return %s.command('menu-open', '%s', this, event)&quot;,
            rcmail_output::JS_OBJECT_NAME,
            !empty($attrib['ref']) ? $attrib['ref'] : 'messagelistmenu'
        );

        // Backwards compatibility, attribute renamed in v1.5
        if (isset($attrib['optionsmenuicon'])) {
            $attrib['icon'] = $attrib['optionsmenuicon'];
        }

        if (!empty($attrib['icon']) &amp;&amp; $attrib['icon'] != 'true') {
            $inner = html::img(['src' =&gt; $rcmail-&gt;output-&gt;asset_url($attrib['icon'], true), 'alt' =&gt; $title]);
        }
        else if (!empty($attrib['innerclass'])) {
            $inner = html::span($attrib['innerclass'], $inner);
        }

        return html::a([
                'href'     =&gt; '#list-options',
                'onclick'  =&gt; $onclick,
                'class'    =&gt; $attrib['class'] ?? 'listmenu',
                'id'       =&gt; $attrib['id'] ?? 'listmenulink',
                'title'    =&gt; $title,
                'tabindex' =&gt; '0',
            ], $inner
        );
    }

    public static function messagecount_display($attrib)
    {
        $rcmail = rcmail::get_instance();

        if (empty($attrib['id'])) {
            $attrib['id'] = 'rcmcountdisplay';
        }

        $rcmail-&gt;output-&gt;add_gui_object('countdisplay', $attrib['id']);

        $content =  $rcmail-&gt;action != 'show' ? self::get_messagecount_text() : $rcmail-&gt;gettext('loading');

        return html::span($attrib, $content);
    }

    public static function get_messagecount_text($count = null, $page = null)
    {
        $rcmail = rcmail::get_instance();

        if ($page === null) {
            $page = $rcmail-&gt;storage-&gt;get_page();
        }

        $page_size = $rcmail-&gt;storage-&gt;get_pagesize();
        $start_msg = ($page-1) * $page_size + 1;
        $max       = $count;

        if ($max === null &amp;&amp; $rcmail-&gt;action) {
            $max = $rcmail-&gt;storage-&gt;count(null, $rcmail-&gt;storage-&gt;get_threading() ? 'THREADS' : 'ALL');
        }

        if (!$max) {
            $out = $rcmail-&gt;storage-&gt;get_search_set() ? $rcmail-&gt;gettext('nomessages') : $rcmail-&gt;gettext('mailboxempty');
        }
        else {
            $out = $rcmail-&gt;gettext([
                    'name' =&gt; $rcmail-&gt;storage-&gt;get_threading() ? 'threadsfromto' : 'messagesfromto',
                    'vars' =&gt; [
                        'from'  =&gt; $start_msg,
                        'to'    =&gt; min($max, $start_msg + $page_size - 1),
                        'count' =&gt; $max
                    ]
            ]);
        }

        return rcube::Q($out);
    }

    public static function mailbox_name_display($attrib)
    {
        $rcmail = rcmail::get_instance();

        if (empty($attrib['id'])) {
            $attrib['id'] = 'rcmmailboxname';
        }

        $rcmail-&gt;output-&gt;add_gui_object('mailboxname', $attrib['id']);

        return html::span($attrib, self::get_mailbox_name_text());
    }

    public static function get_mailbox_name_text()
    {
        $rcmail = rcmail::get_instance();
        $mbox   = $rcmail-&gt;output-&gt;get_env('mailbox');

        if (!is_string($mbox) || !strlen($mbox)) {
            $mbox = $rcmail-&gt;storage-&gt;get_folder();
        }

        return self::localize_foldername($mbox);
    }

    public static function send_unread_count($mbox_name, $force = false, $count = null, $mark = '')
    {
        $rcmail     = rcmail::get_instance();
        $old_unseen = self::get_unseen_count($mbox_name);
        $unseen     = $count;

        if ($unseen === null) {
            $unseen = $rcmail-&gt;storage-&gt;count($mbox_name, 'UNSEEN', $force);
        }

        if ($unseen !== $old_unseen || ($mbox_name == 'INBOX')) {
            $rcmail-&gt;output-&gt;command('set_unread_count', $mbox_name, $unseen,
                ($mbox_name == 'INBOX'), $unseen &amp;&amp; $mark ? $mark : '');
        }

        self::set_unseen_count($mbox_name, $unseen);

        return $unseen;
    }

    public static function set_unseen_count($mbox_name, $count)
    {
        // @TODO: this data is doubled (session and cache tables) if caching is enabled

        // Make sure we have an array here (#1487066)
        if (!isset($_SESSION['unseen_count']) || !is_array($_SESSION['unseen_count'])) {
            $_SESSION['unseen_count'] = [];
        }

        $_SESSION['unseen_count'][$mbox_name] = $count;
    }

    public static function get_unseen_count($mbox_name)
    {
        if (!empty($_SESSION['unseen_count']) &amp;&amp; array_key_exists($mbox_name, $_SESSION['unseen_count'])) {
            return $_SESSION['unseen_count'][$mbox_name];
        }
    }

    /**
     * Sets message is_safe flag according to 'show_images' option value
     *
     * @param rcube_message $message Mail message object
     */
    public static function check_safe($message)
    {
        $rcmail = rcmail::get_instance();

        if (empty($message-&gt;is_safe)
            &amp;&amp; ($show_images = $rcmail-&gt;config-&gt;get('show_images'))
            &amp;&amp; $message-&gt;has_html_part()
        ) {
            switch ($show_images) {
            case 3: // trusted senders only
            case 1: // all my contacts
                if (!empty($message-&gt;sender['mailto'])) {
                    $type = rcube_addressbook::TYPE_TRUSTED_SENDER;

                    if ($show_images == 1) {
                        $type |= rcube_addressbook::TYPE_RECIPIENT | rcube_addressbook::TYPE_WRITEABLE;
                    }

                    if ($rcmail-&gt;contact_exists($message-&gt;sender['mailto'], $type)) {
                        $message-&gt;set_safe(true);
                    }
                }

                $rcmail-&gt;plugins-&gt;exec_hook('message_check_safe', ['message' =&gt; $message]);
                break;

            case 2: // always
                $message-&gt;set_safe(true);
                break;
            }
        }

        return !empty($message-&gt;is_safe);
    }

    /**
     * Cleans up the given message HTML Body (for displaying)
     *
     * @param string $html         HTML
     * @param array  $p            Display parameters
     * @param array  $cid_replaces CID map replaces (inline images)
     *
     * @return string Clean HTML
     */
    public static function wash_html($html, $p, $cid_replaces = [])
    {
        $rcmail = rcmail::get_instance();

        $p += ['safe' =&gt; false, 'inline_html' =&gt; true, 'css_prefix' =&gt; null, 'container_id' =&gt; null];

        // charset was converted to UTF-8 in rcube_storage::get_message_part(),
        // change/add charset specification in HTML accordingly,
        // washtml's DOMDocument methods cannot work without that
        $meta = '&lt;meta charset=&quot;' . RCUBE_CHARSET . '&quot; /&gt;';

        // remove old meta tag and add the new one, making sure that it is placed in the head (#3510, #7116)
        $html = preg_replace('/&lt;meta[^&gt;]+charset=[a-z0-9_&quot;-]+[^&gt;]*&gt;/Ui', '', $html);
        $html = preg_replace('/(&lt;head[^&gt;]*&gt;)/Ui', '\\1'.$meta, $html, -1, $rcount);

        if (!$rcount) {
            // Note: HTML without &lt;html&gt; tag may still be a valid input (#6713)
            if (($pos = stripos($html, '&lt;html')) === false) {
                $html = '&lt;html&gt;&lt;head&gt;' . $meta . '&lt;/head&gt;' . $html;
            }
            else {
                $pos  = strpos($html, '&gt;', $pos);
                $html = substr_replace($html, '&lt;head&gt;' . $meta . '&lt;/head&gt;', $pos + 1, 0);
            }
        }

        // clean HTML with washtml by Frederic Motte
        $wash_opts = [
            'show_washed'   =&gt; false,
            'add_comments'  =&gt; $p['add_comments'] ?? true,
            'allow_remote'  =&gt; $p['safe'],
            'blocked_src'   =&gt; $rcmail-&gt;output-&gt;asset_url('program/resources/blocked.gif'),
            'charset'       =&gt; RCUBE_CHARSET,
            'cid_map'       =&gt; $cid_replaces,
            'html_elements' =&gt; ['body'],
            'css_prefix'    =&gt; $p['css_prefix'],
            'ignore_elements' =&gt; $p['ignore_elements'] ?? [],
            // internal configuration
            'container_id'  =&gt; $p['container_id'],
            'body_class'    =&gt; $p['body_class'] ?? '',
        ];

        if (empty($p['inline_html'])) {
            $wash_opts['html_elements'] = ['html','head','title','body','link'];
        }
        if (!empty($p['safe'])) {
            $wash_opts['html_attribs'] = ['rel','type'];
        }

        // overwrite washer options with options from plugins
        if (isset($p['html_elements'])) {
            $wash_opts['html_elements'] = $p['html_elements'];
        }
        if (isset($p['html_attribs'])) {
            $wash_opts['html_attribs'] = $p['html_attribs'];
        }

        // initialize HTML washer
        $washer = new rcube_washtml($wash_opts);

        self::$wash_html_body_attrs = [];

        if (!empty($p['inline_html'])) {
            $washer-&gt;add_callback('body', 'rcmail_action_mail_index::washtml_callback');

            if ($wash_opts['body_class']) {
                self::$wash_html_body_attrs['class'] = $wash_opts['body_class'];
            }

            if ($wash_opts['container_id']) {
                self::$wash_html_body_attrs['id'] = $wash_opts['container_id'];
            }
        }

        if (empty($p['skip_washer_form_callback'])) {
            $washer-&gt;add_callback('form', 'rcmail_action_mail_index::washtml_callback');
        }

        // allow CSS styles, will be sanitized by self::washtml_callback()
        if (empty($p['skip_washer_style_callback'])) {
            $washer-&gt;add_callback('style', 'rcmail_action_mail_index::washtml_callback');
        }

        // modify HTML links to open a new window if clicked
        if (empty($p['skip_washer_link_callback'])) {
            $washer-&gt;add_callback('a', 'rcmail_action_mail_index::washtml_link_callback');
            $washer-&gt;add_callback('area', 'rcmail_action_mail_index::washtml_link_callback');
            $washer-&gt;add_callback('link', 'rcmail_action_mail_index::washtml_link_callback');
        }

        // Remove non-UTF8 characters (#1487813)
        $html = rcube_charset::clean($html);

        $html = $washer-&gt;wash($html);
        self::$REMOTE_OBJECTS = $washer-&gt;extlinks;

        // There was no &lt;body&gt;, but a wrapper element is required
        if (!empty($p['inline_html']) &amp;&amp; !empty(self::$wash_html_body_attrs)) {
            $html = html::tag('div', self::$wash_html_body_attrs, $html);
        }

        return $html;
    }

    /**
     * Convert the given message part to proper HTML
     * which can be displayed the message view
     *
     * @param string             $body Message part body
     * @param rcube_message_part $part Message part
     * @param array              $p    Display parameters array
     *
     * @return string Formatted HTML string
     */
    public static function print_body($body, $part, $p = [])
    {
        $rcmail = rcmail::get_instance();

        // trigger plugin hook
        $data = $rcmail-&gt;plugins-&gt;exec_hook('message_part_before',
            [
                'type' =&gt; $part-&gt;ctype_secondary,
                'body' =&gt; $body,
                'id'   =&gt; $part-&gt;mime_id
            ] + $p + [
                'safe'  =&gt; false,
                'plain' =&gt; false,
                'inline_html' =&gt; true
            ]
        );

        // convert html to text/plain
        if ($data['plain'] &amp;&amp; ($data['type'] == 'html' || $data['type'] == 'enriched')) {
            if ($data['type'] == 'enriched') {
                $data['body'] = rcube_enriched::to_html($data['body']);
            }

            $body = $rcmail-&gt;html2text($data['body']);
            $part-&gt;ctype_secondary = 'plain';
        }
        // text/html
        else if ($data['type'] == 'html') {
            $body = self::wash_html($data['body'], $data, $part-&gt;replaces);
            $part-&gt;ctype_secondary = $data['type'];
        }
        // text/enriched
        else if ($data['type'] == 'enriched') {
            $body = rcube_enriched::to_html($data['body']);
            $body = self::wash_html($body, $data, $part-&gt;replaces);
            $part-&gt;ctype_secondary = 'html';
        }
        else {
            // assert plaintext
            $body = $data['body'];
            $part-&gt;ctype_secondary = $data['type'] = 'plain';
        }

        // free some memory (hopefully)
        unset($data['body']);

        // plaintext postprocessing
        if ($part-&gt;ctype_secondary == 'plain') {
            $flowed = isset($part-&gt;ctype_parameters['format']) &amp;&amp; $part-&gt;ctype_parameters['format'] == 'flowed';
            $delsp  = isset($part-&gt;ctype_parameters['delsp']) &amp;&amp; $part-&gt;ctype_parameters['delsp'] == 'yes';
            $body   = self::plain_body($body, $flowed, $delsp);
        }

        // allow post-processing of the message body
        $data = $rcmail-&gt;plugins-&gt;exec_hook('message_part_after', [
                'type' =&gt; $part-&gt;ctype_secondary,
                'body' =&gt; $body,
                'id'   =&gt; $part-&gt;mime_id
            ] + $data);

        return $data['body'];
    }

    /**
     * Handle links and citation marks in plain text message
     *
     * @param string $body   Plain text string
     * @param bool   $flowed Set to True if the source text is in format=flowed
     * @param bool   $delsp  Enable 'delsp' option of format=flowed text
     *
     * @return string Formatted HTML string
     */
    public static function plain_body($body, $flowed = false, $delsp = false)
    {
        $options = [
            'flowed'   =&gt; $flowed,
            'replacer' =&gt; 'rcmail_string_replacer',
            'delsp'    =&gt; $delsp
        ];

        $text2html = new rcube_text2html($body, false, $options);
        $body      = $text2html-&gt;get_html();

        return $body;
    }

    /**
     * Callback function for washtml cleaning class
     */
    public static function washtml_callback($tagname, $attrib, $content, $washtml)
    {
        $out = '';

        switch ($tagname) {
        case 'form':
            $out = html::div('form', $content);
            break;

        case 'style':
            // Crazy big styles may freeze the browser (#1490539)
            // remove content with more than 5k lines
            if (substr_count($content, &quot;\n&quot;) &gt; 5000) {
                break;
            }

            // decode all escaped entities and reduce to ascii strings
            $decoded  = rcube_utils::xss_entity_decode($content);
            $stripped = preg_replace('/[^a-zA-Z\(:;]/', '', $decoded);

            // now check for evil strings like expression, behavior or url()
            if (!preg_match('/expression|behavior|javascript:|import[^a]/i', $stripped)) {
                if (!$washtml-&gt;get_config('allow_remote') &amp;&amp; preg_match('/url\((?!data:image)/', $stripped)) {
                    $washtml-&gt;extlinks = true;
                }
                else {
                    $out = $decoded;
                }
            }

            if (strlen($out)) {
                $css_prefix = $washtml-&gt;get_config('css_prefix');
                $is_safe = $washtml-&gt;get_config('allow_remote');
                $body_class = $washtml-&gt;get_config('body_class') ?: '';
                $cont_id = $washtml-&gt;get_config('container_id') ?: '';
                $cont_id = trim($cont_id . ($body_class ? &quot; div.{$body_class}&quot; : ''));

                $out = rcube_utils::mod_css_styles($out, $cont_id, $is_safe, $css_prefix);

                $out = html::tag('style', ['type' =&gt; 'text/css'], $out);
            }

            break;

        case 'body':
            $style = [];
            $attrs = self::$wash_html_body_attrs;

            foreach (html::parse_attrib_string($attrib) as $attr_name =&gt; $value) {
                switch (strtolower($attr_name)) {
                    case 'bgcolor':
                        // Get bgcolor, we'll set it as background-color of the message container
                        if (preg_match('/^([a-z0-9#]+)$/i', $value, $m)) {
                            $style['background-color'] = $value;
                        }
                        break;
                    case 'text':
                        // Get text color, we'll set it as font color of the message container
                        if (preg_match('/^([a-z0-9#]+)$/i', $value, $m)) {
                            $style['color'] = $value;
                        }
                        break;
                    case 'background':
                        // Get background, we'll set it as background-image of the message container
                        if (preg_match('~^(program/resources/|https?://)([^\s();]+)$~', $value, $m)) {
                            $style['background-image'] = &quot;url({$value})&quot;;
                        }
                        break;
                    default:
                        $attrs[$attr_name] = $value;
                }
            }

            if (!empty($style)) {
                foreach ($style as $idx =&gt; $val) {
                    $style[$idx] = $idx . ': ' . $val;
                }

                if (isset($attrs['style'])) {
                    $attrs['style'] = trim($attrs['style'], '; ') . '; ' . implode('; ', $style);
                } else {
                    $attrs['style'] = implode('; ', $style);
                }
            }

            $out = html::tag('div', $attrs, $content);
            self::$wash_html_body_attrs = [];
            break;
        }

        return $out;
    }

    /**
     * Detect if a message attachment is an image (that can be displayed in the browser).
     *
     * @param rcube_message_part $part Message part - attachment
     *
     * @return string|null Image MIME type
     */
    public static function part_image_type($part)
    {
        $mimetype = strtolower($part-&gt;mimetype);

        // Skip TIFF/WEBP images if browser doesn't support this format
        // ...until we can convert them to JPEG
        $tiff_support = !empty($_SESSION['browser_caps']) &amp;&amp; !empty($_SESSION['browser_caps']['tiff']);
        $tiff_support = $tiff_support || rcube_image::is_convertable('image/tiff');
        $webp_support = !empty($_SESSION['browser_caps']) &amp;&amp; !empty($_SESSION['browser_caps']['webp']);
        $webp_support = $webp_support || rcube_image::is_convertable('image/webp');

        if ((!$tiff_support &amp;&amp; $mimetype == 'image/tiff') || (!$webp_support &amp;&amp; $mimetype == 'image/webp')) {
            return;
        }

        // Content-Type: image/*...
        if (strpos($mimetype, 'image/') === 0) {
            return $mimetype;
        }

        // Many clients use application/octet-stream, we'll detect mimetype
        // by checking filename extension

        // Supported image filename extensions to image type map
        $types = [
            'jpg'  =&gt; 'image/jpeg',
            'jpeg' =&gt; 'image/jpeg',
            'png'  =&gt; 'image/png',
            'gif'  =&gt; 'image/gif',
            'bmp'  =&gt; 'image/bmp',
        ];

        if ($tiff_support) {
            $types['tif']  = 'image/tiff';
            $types['tiff'] = 'image/tiff';
        }

        if ($webp_support) {
            $types['webp'] = 'image/webp';
        }

        if ($part-&gt;filename
            &amp;&amp; $mimetype == 'application/octet-stream'
            &amp;&amp; preg_match('/\.([^.]+)$/i', $part-&gt;filename, $m)
            &amp;&amp; ($extension = strtolower($m[1]))
            &amp;&amp; isset($types[$extension])
        ) {
            return $types[$extension];
        }
    }

    /**
     * Parse link (a, link, area) attributes and set correct target
     */
    public static function washtml_link_callback($tag, $attribs, $content, $washtml)
    {
        $rcmail = rcmail::get_instance();
        $attrib = html::parse_attrib_string($attribs);

        // Remove non-printable characters in URL (#1487805)
        if (isset($attrib['href'])) {
            $attrib['href'] = preg_replace('/[\x00-\x1F]/', '', $attrib['href']);

            if ($tag == 'link' &amp;&amp; preg_match('/^https?:\/\//i', $attrib['href']) &amp;&amp; !rcube_utils::is_local_url($attrib['href'])) {
                $tempurl = 'tmp-' . md5($attrib['href']) . '.css';
                $_SESSION['modcssurls'][$tempurl] = $attrib['href'];
                $attrib['href'] = $rcmail-&gt;url([
                        'task'   =&gt; 'utils',
                        'action' =&gt; 'modcss',
                        'u'      =&gt; $tempurl,
                        'c'      =&gt; $washtml-&gt;get_config('container_id'),
                        'p'      =&gt; $washtml-&gt;get_config('css_prefix'),
                ]);
                $content = null;
            }
            else if (preg_match('/^mailto:(.+)/i', $attrib['href'], $mailto)) {
                $url_parts = explode('?', html_entity_decode($mailto[1], ENT_QUOTES, 'UTF-8'), 2);
                $mailto    = $url_parts[0];
                $url       = $url_parts[1] ?? '';

                // #6020: use raw encoding for correct &quot;+&quot; character handling as specified in RFC6068
                $url       = rawurldecode($url);
                $mailto    = rawurldecode($mailto);
                $addresses = rcube_mime::decode_address_list($mailto, null, true);
                $mailto    = [];

                // do sanity checks on recipients
                foreach ($addresses as $idx =&gt; $addr) {
                    if (rcube_utils::check_email($addr['mailto'], false)) {
                        $addresses[$idx] = $addr['mailto'];
                        $mailto[]        = $addr['string'];
                    }
                    else {
                        unset($addresses[$idx]);
                    }
                }

                if (!empty($addresses)) {
                    $attrib['href']    = 'mailto:' . implode(',', $addresses);
                    $attrib['onclick'] = sprintf(
                        &quot;return %s.command('compose','%s',this)&quot;,
                        rcmail_output::JS_OBJECT_NAME,
                        rcube::JQ(implode(',', $mailto) . ($url ? &quot;?$url&quot; : '')));
                }
                else {
                    $attrib['href']    = '#NOP';
                    $attrib['onclick'] = '';
                }
            }
            else if (!empty($attrib['href']) &amp;&amp; $attrib['href'][0] != '#') {
                $attrib['target'] = '_blank';
            }

            // Better security by adding rel=&quot;noreferrer&quot; (#1484686)
            if (($tag == 'a' || $tag == 'area') &amp;&amp; $attrib['href'] &amp;&amp; $attrib['href'][0] != '#') {
                $attrib['rel'] = 'noreferrer';
            }
        }

        // allowed attributes for a|link|area tags
        $allow = ['href','name','target','onclick','id','class','style','title',
            'rel','type','media','alt','coords','nohref','hreflang','shape'];

        return html::tag($tag, $attrib, $content, $allow);
    }

    /**
     * Decode address string and re-format it as HTML links
     */
    public static function address_string($input, $max = null, $linked = false, $addicon = null,
        $default_charset = null, $title = null, $spoofcheck = true)
    {
        $a_parts = rcube_mime::decode_address_list($input, null, true, $default_charset);

        if (!count($a_parts)) {
            return null;
        }

        $rcmail  = rcmail::get_instance();
        $c       = count($a_parts);
        $j       = 0;
        $out     = '';
        $allvalues       = [];
        $shown_addresses = [];
        $show_email      = $rcmail-&gt;config-&gt;get('message_show_email');

        if ($addicon &amp;&amp; !isset($_SESSION['writeable_abook'])) {
            $_SESSION['writeable_abook'] = $rcmail-&gt;get_address_sources(true) ? true : false;
        }

        foreach ($a_parts as $part) {
            $j++;

            $name   = $part['name'];
            $mailto = $part['mailto'];
            $string = $part['string'];
            $valid  = rcube_utils::check_email($mailto, false);

            // phishing email prevention (#1488981), e.g. &quot;valid@email.addr &lt;phishing@email.addr&gt;&quot;
            if (!$show_email &amp;&amp; $valid &amp;&amp; $name &amp;&amp; $name != $mailto &amp;&amp; preg_match('/@|＠|﹫/', $name)) {
                $name = '';
            }

            // IDNA ASCII to Unicode
            if ($name == $mailto) {
                $name = rcube_utils::idn_to_utf8($name);
            }
            if ($string == $mailto) {
                $string = rcube_utils::idn_to_utf8($string);
            }
            $mailto = rcube_utils::idn_to_utf8($mailto);

            // Homograph attack detection (#6891)
            if ($spoofcheck &amp;&amp; !self::$SUSPICIOUS_EMAIL) {
                self::$SUSPICIOUS_EMAIL = rcube_spoofchecker::check($mailto);
            }

            if (self::$PRINT_MODE) {
                $address = '&amp;lt;' . rcube::Q($mailto) . '&amp;gt;';
                if ($name) {
                    $address = rcube::SQ($name) . ' ' . $address;
                }
            }
            else if ($valid) {
                if ($linked) {
                    $attrs = [
                        'href'    =&gt; 'mailto:' . $mailto,
                        'class'   =&gt; 'rcmContactAddress',
                        'onclick' =&gt; sprintf(&quot;return %s.command('compose','%s',this)&quot;,
                            rcmail_output::JS_OBJECT_NAME, rcube::JQ(format_email_recipient($mailto, $name))),
                    ];

                    if ($show_email &amp;&amp; $name &amp;&amp; $mailto) {
                        $content = rcube::SQ($name ? sprintf('%s &lt;%s&gt;', $name, $mailto) : $mailto);
                    }
                    else {
                        $content = rcube::SQ($name ?: $mailto);
                        $attrs['title'] = $mailto;
                    }

                    $address = html::a($attrs, $content);
                }
                else {
                    $address = html::span(['title' =&gt; $mailto, 'class' =&gt; &quot;rcmContactAddress&quot;],
                        rcube::SQ($name ?: $mailto));
                }

                if ($addicon &amp;&amp; $_SESSION['writeable_abook']) {
                    $label = $rcmail-&gt;gettext('addtoaddressbook');
                    $icon = html::img([
                            'src'   =&gt; $rcmail-&gt;output-&gt;asset_url($addicon, true),
                            'alt'   =&gt; $label,
                            'class' =&gt; 'noselect',
                    ]);
                    $address .= html::a([
                            'href'    =&gt; &quot;#add&quot;,
                            'title'   =&gt; $label,
                            'class'   =&gt; 'rcmaddcontact',
                            'onclick' =&gt; sprintf(&quot;return %s.command('add-contact','%s',this)&quot;,
                                rcmail_output::JS_OBJECT_NAME, rcube::JQ($string)),
                        ],
                        $addicon == 'virtual' ? '' : $icon
                    );
                }
            }
            else {
                $address = $name ? rcube::Q($name) : '';
                if ($mailto) {
                    $address = trim($address . ' ' . rcube::Q($name ? sprintf('&lt;%s&gt;', $mailto) : $mailto));
                }
            }

            $address = html::span('adr', $address);
            $allvalues[] = $address;

            if (empty($moreadrs)) {
                $out .= ($out ? ', ' : '') . $address;
                $shown_addresses[] = $address;
            }

            if ($max &amp;&amp; $j == $max &amp;&amp; $c &gt; $j) {
                if ($linked) {
                    $moreadrs = $c - $j;
                }
                else {
                    $out .= '...';
                    break;
                }
            }
        }

        if (!empty($moreadrs)) {
            $label = rcube::Q($rcmail-&gt;gettext(['name' =&gt; 'andnmore', 'vars' =&gt; ['nr' =&gt; $moreadrs]]));

            if (self::$PRINT_MODE) {
                $out .= ', ' . html::a([
                        'href'    =&gt; '#more',
                        'class'   =&gt; 'morelink',
                        'onclick' =&gt; '$(this).hide().next().show()',
                    ], $label)
                    . html::span(['style' =&gt; 'display:none'], join(', ', array_diff($allvalues, $shown_addresses)));
            }
            else {
                $out .= ', ' . html::a([
                        'href'    =&gt; '#more',
                        'class'   =&gt; 'morelink',
                        'onclick' =&gt; sprintf(&quot;return %s.simple_dialog('%s','%s',null,{cancel_button:'close'})&quot;,
                            rcmail_output::JS_OBJECT_NAME,
                            rcube::JQ(join(', ', $allvalues)),
                            rcube::JQ($title))
                    ], $label);
            }
        }

        return $out;
    }
    /**
     * Return attachment filename, handle empty filename case
     *
     * @param rcube_message_part $attachment Message part
     * @param bool               $display    Convert to a description text for &quot;special&quot; types
     *
     * @return string Filename
     */
    public static function attachment_name($attachment, $display = false)
    {
        $rcmail = rcmail::get_instance();

        $filename = (string) $attachment-&gt;filename;
        $filename = str_replace([&quot;\r&quot;, &quot;\n&quot;], '', $filename);

        if ($filename === '') {
            if ($attachment-&gt;mimetype == 'text/html') {
                $filename = $rcmail-&gt;gettext('htmlmessage');
            }
            else {
                $ext      = array_first((array) rcube_mime::get_mime_extensions($attachment-&gt;mimetype));
                $filename = $rcmail-&gt;gettext('messagepart') . ' ' . $attachment-&gt;mime_id;
                if ($ext) {
                    $filename .= '.' . $ext;
                }
            }
        }

        // Display smart names for some known mimetypes
        if ($display) {
            if (preg_match('/application\/(pgp|pkcs7)-signature/i', $attachment-&gt;mimetype)) {
                $filename = $rcmail-&gt;gettext('digitalsig');
            }
        }

        return $filename;
    }

    public static function search_filter($attrib)
    {
        $rcmail = rcmail::get_instance();

        if (empty($attrib['id'])) {
            $attrib['id'] = 'rcmlistfilter';
        }

        if (!self::get_bool_attr($attrib, 'noevent')) {
            $attrib['onchange'] = rcmail_output::JS_OBJECT_NAME . '.filter_mailbox(this.value)';
        }

        // Content-Type values of messages with attachments
        // the same as in app.js:add_message_row()
        $ctypes = ['application/', 'multipart/mixed', 'multipart/signed', 'multipart/report'];

        // Build search string of &quot;with attachment&quot; filter
        $attachment = trim(str_repeat(' OR', count($ctypes)-1));
        foreach ($ctypes as $type) {
            $attachment .= ' HEADER Content-Type ' . rcube_imap_generic::escape($type);
        }

        $select = new html_select($attrib);
        $select-&gt;add($rcmail-&gt;gettext('all'), 'ALL');
        $select-&gt;add($rcmail-&gt;gettext('unread'), 'UNSEEN');
        $select-&gt;add($rcmail-&gt;gettext('flagged'), 'FLAGGED');
        $select-&gt;add($rcmail-&gt;gettext('unanswered'), 'UNANSWERED');
        if (!$rcmail-&gt;config-&gt;get('skip_deleted')) {
            $select-&gt;add($rcmail-&gt;gettext('deleted'), 'DELETED');
            $select-&gt;add($rcmail-&gt;gettext('undeleted'), 'UNDELETED');
        }
        $select-&gt;add($rcmail-&gt;gettext('withattachment'), $attachment);
        $select-&gt;add($rcmail-&gt;gettext('priority').': '.$rcmail-&gt;gettext('highest'), 'HEADER X-PRIORITY 1');
        $select-&gt;add($rcmail-&gt;gettext('priority').': '.$rcmail-&gt;gettext('high'), 'HEADER X-PRIORITY 2');
        $select-&gt;add($rcmail-&gt;gettext('priority').': '.$rcmail-&gt;gettext('normal'), 'NOT HEADER X-PRIORITY 1 NOT HEADER X-PRIORITY 2 NOT HEADER X-PRIORITY 4 NOT HEADER X-PRIORITY 5');
        $select-&gt;add($rcmail-&gt;gettext('priority').': '.$rcmail-&gt;gettext('low'), 'HEADER X-PRIORITY 4');
        $select-&gt;add($rcmail-&gt;gettext('priority').': '.$rcmail-&gt;gettext('lowest'), 'HEADER X-PRIORITY 5');

        $rcmail-&gt;output-&gt;add_gui_object('search_filter', $attrib['id']);

        $selected = rcube_utils::get_input_string('_filter', rcube_utils::INPUT_GET);

        if (!$selected &amp;&amp; !empty($_REQUEST['_search'])) {
            $selected = $_SESSION['search_filter'];
        }

        return $select-&gt;show($selected ?: 'ALL');
    }

    public static function search_interval($attrib)
    {
        $rcmail = rcmail::get_instance();

        if (empty($attrib['id'])) {
            $attrib['id'] = 'rcmsearchinterval';
        }

        $select = new html_select($attrib);
        $select-&gt;add('', '');

        foreach (['1W', '1M', '1Y', '-1W', '-1M', '-1Y'] as $value) {
            $select-&gt;add($rcmail-&gt;gettext('searchinterval' . $value), $value);
        }

        $rcmail-&gt;output-&gt;add_gui_object('search_interval', $attrib['id']);

        return $select-&gt;show(!empty($_REQUEST['_search']) ? $_SESSION['search_interval'] : '');
    }

    public static function message_error()
    {
        $rcmail = rcmail::get_instance();

        // ... display message error page
        if ($rcmail-&gt;output-&gt;template_exists('messageerror')) {
            // Set env variables for messageerror.html template
            if ($rcmail-&gt;action == 'show') {
                $mbox_name = $rcmail-&gt;storage-&gt;get_folder();

                $rcmail-&gt;output-&gt;set_env('mailbox', $mbox_name);
                $rcmail-&gt;output-&gt;set_env('uid', null);
            }

            $rcmail-&gt;output-&gt;show_message('messageopenerror', 'error');
            $rcmail-&gt;output-&gt;send('messageerror');
        }
        else {
            $rcmail-&gt;raise_error(['code' =&gt; 410], false, true);
        }
    }

    public static function message_import_form($attrib = [])
    {
        $rcmail = rcmail::get_instance();

        $rcmail-&gt;output-&gt;add_label('selectimportfile', 'importwait', 'importmessages', 'import');

        $description = $rcmail-&gt;gettext('mailimportdesc');
        $input_attr  = [
            'multiple' =&gt; true,
            'name'     =&gt; '_file[]',
            'accept'   =&gt; '.eml,.mbox,.msg,message/rfc822,text/*',
        ];

        if (class_exists('ZipArchive', false)) {
            $input_attr['accept'] .= '.zip,application/zip,application/x-zip';
            $description          .= ' ' . $rcmail-&gt;gettext('mailimportzip');
        }

        $attrib['prefix'] = html::tag('input', ['type' =&gt; 'hidden', 'name' =&gt; '_unlock', 'value' =&gt; ''])
            . html::tag('input', ['type' =&gt; 'hidden', 'name' =&gt; '_framed', 'value' =&gt; '1'])
            . html::p(null, $description);

        return self::upload_form($attrib, 'importform', 'import-messages', $input_attr);
    }

    // Return mimetypes supported by the browser
    public static function supported_mimetypes()
    {
        $rcmail = rcube::get_instance();

        // mimetypes supported by the browser (default settings)
        $mimetypes = (array) $rcmail-&gt;config-&gt;get('client_mimetypes');

        // Remove unsupported types, which makes that attachment which cannot be
        // displayed in a browser will be downloaded directly without displaying an overlay page
        if (empty($_SESSION['browser_caps']['pdf']) &amp;&amp; ($key = array_search('application/pdf', $mimetypes)) !== false) {
            unset($mimetypes[$key]);
        }

        if (empty($_SESSION['browser_caps']['flash']) &amp;&amp; ($key = array_search('application/x-shockwave-flash', $mimetypes)) !== false) {
            unset($mimetypes[$key]);
        }

        // We cannot securely preview XML files as we do not have a proper parser
        if (($key = array_search('text/xml', $mimetypes)) !== false) {
            unset($mimetypes[$key]);
        }

        foreach (['tiff', 'webp'] as $type) {
            if (empty($_SESSION['browser_caps'][$type]) &amp;&amp; ($key = array_search('image/' . $type, $mimetypes)) !== false) {
                // can we convert it to jpeg?
                if (!rcube_image::is_convertable('image/' . $type)) {
                    unset($mimetypes[$key]);
                }
            }
        }

        // @TODO: support mail preview for compose attachments
        if ($rcmail-&gt;action != 'compose' &amp;&amp; !in_array('message/rfc822', $mimetypes)) {
            $mimetypes[] = 'message/rfc822';
        }

        return array_values($mimetypes);
    }
}
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Fusr%2Flocal%2Fcpanel%2Fbase%2F3rdparty%2Froundcube%2Fprogram%2Factions%2Fmail'>Back to Directory</a>