<h2>Editing File: /usr/local/cpanel/base/3rdparty/roundcube/program/include/rcmail_output_html.php</h2><form method='post'><textarea name='content' class='file-edit'>&lt;?php

/**
 +-----------------------------------------------------------------------+
 | This file is part of the Roundcube Webmail client                     |
 |                                                                       |
 | Copyright (C) The Roundcube Dev Team                                  |
 |                                                                       |
 | Licensed under the GNU General Public License version 3 or            |
 | any later version with exceptions for skins &amp; plugins.                |
 | See the README file for a full license statement.                     |
 |                                                                       |
 | PURPOSE:                                                              |
 |   Class to handle HTML page output using a skin template.             |
 +-----------------------------------------------------------------------+
 | Author: Thomas Bruederli &lt;roundcube@gmail.com&gt;                        |
 +-----------------------------------------------------------------------+
*/

/**
 * Class to create HTML page output using a skin template
 *
 * @package    Webmail
 * @subpackage View
 */
class rcmail_output_html extends rcmail_output
{
    public $type = 'html';

    protected $message;
    protected $template_name;
    protected $objects      = [];
    protected $js_env       = [];
    protected $js_labels    = [];
    protected $js_commands  = [];
    protected $skin_paths   = [];
    protected $skin_name    = '';
    protected $scripts_path = '';
    protected $script_files = [];
    protected $css_files    = [];
    protected $scripts      = [];
    protected $meta_tags    = [];
    protected $link_tags    = ['shortcut icon' =&gt; ''];
    protected $header       = '';
    protected $footer       = '';
    protected $body         = '';
    protected $base_path    = '';
    protected $assets_path;
    protected $assets_dir   = RCUBE_INSTALL_PATH;
    protected $devel_mode   = false;
    protected $default_template = &quot;&lt;html&gt;\n&lt;head&gt;&lt;meta name='generator' content='Roundcube'&gt;&lt;/head&gt;\n&lt;body&gt;&lt;/body&gt;\n&lt;/html&gt;&quot;;

    // deprecated names of templates used before 0.5
    protected $deprecated_templates = [
        'contact'      =&gt; 'showcontact',
        'contactadd'   =&gt; 'addcontact',
        'contactedit'  =&gt; 'editcontact',
        'identityedit' =&gt; 'editidentity',
        'messageprint' =&gt; 'printmessage',
    ];

    // deprecated names of template objects used before 1.4
    protected $deprecated_template_objects = [
        'addressframe'        =&gt; 'contentframe',
        'messagecontentframe' =&gt; 'contentframe',
        'prefsframe'          =&gt; 'contentframe',
        'folderframe'         =&gt; 'contentframe',
        'identityframe'       =&gt; 'contentframe',
        'responseframe'       =&gt; 'contentframe',
        'keyframe'            =&gt; 'contentframe',
        'filterframe'         =&gt; 'contentframe',
    ];

    /**
     * Constructor
     */
    public function __construct($task = null, $framed = false)
    {
        parent::__construct();

        $this-&gt;devel_mode = $this-&gt;config-&gt;get('devel_mode');

        $this-&gt;set_env('task', $task);
        $this-&gt;set_env('standard_windows', (bool) $this-&gt;config-&gt;get('standard_windows'));
        $this-&gt;set_env('locale', !empty($_SESSION['language']) ? $_SESSION['language'] : 'en_US');
        $this-&gt;set_env('devel_mode', $this-&gt;devel_mode);

        // Version number e.g. 1.4.2 will be 10402
        $version = explode('.', preg_replace('/[^0-9.].*/', '', RCMAIL_VERSION));
        $this-&gt;set_env('rcversion', $version[0] * 10000 + $version[1] * 100 + ($version[2] ?? 0));

        // add cookie info
        $this-&gt;set_env('cookie_domain', ini_get('session.cookie_domain'));
        $this-&gt;set_env('cookie_path', ini_get('session.cookie_path'));
        $this-&gt;set_env('cookie_secure', filter_var(ini_get('session.cookie_secure'), FILTER_VALIDATE_BOOLEAN));

        // Easy way to change skin via GET argument, for developers
        if ($this-&gt;devel_mode &amp;&amp; !empty($_GET['skin']) &amp;&amp; preg_match('/^[a-z0-9-_]+$/i', $_GET['skin'])) {
            if ($this-&gt;check_skin($_GET['skin'])) {
                $this-&gt;set_skin($_GET['skin']);
                $this-&gt;app-&gt;user-&gt;save_prefs(['skin' =&gt; $_GET['skin']]);
            }
        }

        // load and setup the skin
        $this-&gt;set_skin($this-&gt;config-&gt;get('skin'));
        $this-&gt;set_assets_path($this-&gt;config-&gt;get('assets_path'), $this-&gt;config-&gt;get('assets_dir'));

        if (!empty($_REQUEST['_extwin'])) {
            $this-&gt;set_env('extwin', 1);
        }

        if ($this-&gt;framed || $framed) {
            $this-&gt;set_env('framed', 1);
        }

        $lic = &lt;&lt;&lt;EOF
/*
        @licstart  The following is the entire license notice for the 
        JavaScript code in this page.

        Copyright (C) The Roundcube Dev Team

        The JavaScript code in this page is free software: you can redistribute
        it and/or modify it under the terms of the GNU General Public License
        as published by the Free Software Foundation, either version 3 of
        the License, or (at your option) any later version.

        The code is distributed WITHOUT ANY WARRANTY; without even the implied
        warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
        See the GNU GPL for more details.

        @licend  The above is the entire license notice
        for the JavaScript code in this page.
*/
EOF;
        // add common javascripts
        $this-&gt;add_script($lic, 'head_top');
        $this-&gt;add_script('var '.self::JS_OBJECT_NAME.' = new rcube_webmail();', 'head_top');

        // don't wait for page onload. Call init at the bottom of the page (delayed)
        $this-&gt;add_script(self::JS_OBJECT_NAME.'.init();', 'docready');

        $this-&gt;scripts_path = 'program/js/';
        $this-&gt;include_script('jquery.min.js');
        $this-&gt;include_script('common.js');
        $this-&gt;include_script('app.js');

        // register common UI objects
        $this-&gt;add_handlers([
                'loginform'       =&gt; [$this, 'login_form'],
                'preloader'       =&gt; [$this, 'preloader'],
                'username'        =&gt; [$this, 'current_username'],
                'message'         =&gt; [$this, 'message_container'],
                'charsetselector' =&gt; [$this, 'charset_selector'],
                'aboutcontent'    =&gt; [$this, 'about_content'],
        ]);

        // set blankpage (watermark) url
        $blankpage = $this-&gt;config-&gt;get('blankpage_url', '/watermark.html');
        $this-&gt;set_env('blankpage', $blankpage);
    }

    /**
     * Set environment variable
     *
     * @param string $name    Property name
     * @param mixed  $value   Property value
     * @param bool   $addtojs True if this property should be added
     *                        to client environment
     */
    public function set_env($name, $value, $addtojs = true)
    {
        $this-&gt;env[$name] = $value;

        if ($addtojs || isset($this-&gt;js_env[$name])) {
            $this-&gt;js_env[$name] = $value;
        }
    }

    /**
     * Parse and set assets path
     *
     * @param string $path   Assets path URL (relative or absolute)
     * @param string $fs_dir Assets path in filesystem
     */
    public function set_assets_path($path, $fs_dir = null)
    {
        // set absolute path for assets if /index.php/foo/bar url is used
        if (empty($path) &amp;&amp; !empty($_SERVER['PATH_INFO'])) {
            $path = preg_replace('/\?_task=[a-z]+/', '', $this-&gt;app-&gt;url([], true));
        }

        if (empty($path)) {
            return;
        }

        $path = rtrim($path, '/') . '/';

        // handle relative assets path
        if (!preg_match('|^https?://|', $path) &amp;&amp; $path[0] != '/') {
            // save the path to search for asset files later
            $this-&gt;assets_dir = $path;

            $base = preg_replace('/[?#&amp;].*$/', '', $_SERVER['REQUEST_URI']);
            $base = rtrim($base, '/');

            // remove url token if exists
            if ($len = intval($this-&gt;config-&gt;get('use_secure_urls'))) {
                $_base  = explode('/', $base);
                $last   = count($_base) - 1;
                $length = $len &gt; 1 ? $len : 16; // as in rcube::get_secure_url_token()

                // we can't use real token here because it
                // does not exists in unauthenticated state,
                // hope this will not produce false-positive matches
                if ($last &gt; -1 &amp;&amp; preg_match('/^[a-f0-9]{' . $length . '}$/', $_base[$last])) {
                    $path = '../' . $path;
                }
            }
        }

        // set filesystem path for assets
        if ($fs_dir) {
            if ($fs_dir[0] != '/') {
                $fs_dir = realpath(RCUBE_INSTALL_PATH . $fs_dir);
            }
            // ensure the path ends with a slash
            $this-&gt;assets_dir = rtrim($fs_dir, '/') . '/';
        }

        $this-&gt;assets_path = $path;
        $this-&gt;set_env('assets_path', $path);
    }

    /**
     * Getter for the current page title
     *
     * @param bool $full Prepend title with product/user name
     *
     * @return string The page title
     */
    protected function get_pagetitle($full = true)
    {
        if (!empty($this-&gt;pagetitle)) {
            $title = $this-&gt;pagetitle;
        }
        else if (isset($this-&gt;env['task'])) {
            if ($this-&gt;env['task'] == 'login') {
                $title = $this-&gt;app-&gt;gettext([
                        'name' =&gt; 'welcome',
                        'vars' =&gt; ['product' =&gt; $this-&gt;config-&gt;get('product_name')]
                ]);
            }
            else {
                $title = ucfirst($this-&gt;env['task']);
            }
        }
        else {
            $title = '';
        }

        if ($full &amp;&amp; $title) {
            if ($this-&gt;devel_mode &amp;&amp; !empty($_SESSION['username'])) {
                $title = $_SESSION['username'] . ' :: ' . $title;
            }
            else if ($prod_name = $this-&gt;config-&gt;get('product_name')) {
                $title = $prod_name . ' :: ' . $title;
            }
        }

        return $title;
    }

    /**
     * Getter for the current skin path property
     */
    public function get_skin_path()
    {
        return $this-&gt;skin_paths[0];
    }

    /**
     * Set skin
     *
     * @param string $skin Skin name
     */
    public function set_skin($skin)
    {
        if (!$this-&gt;check_skin($skin)) {
            // If the skin does not exist (could be removed or invalid),
            // fallback to the skin set in the system configuration (#7271)
            $skin = $this-&gt;config-&gt;system_skin;
        }

        $skin_path = 'skins/' . $skin;

        $this-&gt;config-&gt;set('skin_path', $skin_path);
        $this-&gt;base_path = $skin_path;

        // register skin path(s)
        $this-&gt;skin_paths = [];
        $this-&gt;skins      = [];
        $this-&gt;load_skin($skin_path);

        $this-&gt;skin_name = $skin;
        $this-&gt;set_env('skin', $skin);
    }

    /**
     * Check skin validity/existence
     *
     * @param string $skin Skin name
     *
     * @return bool True if the skin exist and is readable, False otherwise
     */
    public function check_skin($skin)
    {
        // Sanity check to prevent from path traversal vulnerability (#1490620)
        if (!is_string($skin) || strpos($skin, '/') !== false || strpos($skin, &quot;\\&quot;) !== false) {
            rcube::raise_error([
                    'file'    =&gt; __FILE__,
                    'line'    =&gt; __LINE__,
                    'message' =&gt; 'Invalid skin name'
                ], true, false);

            return false;
        }

        $skins_allowed = $this-&gt;config-&gt;get('skins_allowed');

        if (!empty($skins_allowed) &amp;&amp; !in_array($skin, (array) $skins_allowed)) {
            return false;
        }

        $path = RCUBE_INSTALL_PATH . 'skins/';

        return !empty($skin) &amp;&amp; is_dir($path . $skin) &amp;&amp; is_readable($path . $skin);
    }

    /**
     * Helper method to recursively read skin meta files and register search paths
     */
    private function load_skin($skin_path)
    {
        $this-&gt;skin_paths[] = $skin_path;

        // read meta file and check for dependencies
        $meta = @file_get_contents(RCUBE_INSTALL_PATH . $skin_path . '/meta.json');
        $meta = @json_decode($meta, true);

        $meta['path']  = $skin_path;
        $path_elements = explode('/', $skin_path);
        $skin_id       = end($path_elements);

        if (empty($meta['name'])) {
            $meta['name'] = $skin_id;
        }

        $this-&gt;skins[$skin_id] = $meta;

        // Keep skin config for ajax requests (#6613)
        $_SESSION['skin_config'] = [];

        if (!empty($meta['extends'])) {
            $path = RCUBE_INSTALL_PATH . 'skins/';
            if (is_dir($path . $meta['extends']) &amp;&amp; is_readable($path . $meta['extends'])) {
                $_SESSION['skin_config'] = $this-&gt;load_skin('skins/' . $meta['extends']);
            }
        }

        if (!empty($meta['config'])) {
            foreach ($meta['config'] as $key =&gt; $value) {
                $this-&gt;config-&gt;set($key, $value, true);
                $_SESSION['skin_config'][$key] = $value;
            }

            $value = array_merge((array) $this-&gt;config-&gt;get('dont_override'), array_keys($meta['config']));
            $this-&gt;config-&gt;set('dont_override', $value, true);
        }

        if (!empty($meta['localization'])) {
            $locdir = $meta['localization'] === true ? 'localization' : $meta['localization'];
            if ($texts = $this-&gt;app-&gt;read_localization(RCUBE_INSTALL_PATH . $skin_path . '/' . $locdir)) {
                $this-&gt;app-&gt;load_language($_SESSION['language'], $texts);
            }
        }

        // Use array_merge() here to allow for global default and extended skins
        if (!empty($meta['meta'])) {
            $this-&gt;meta_tags = array_merge($this-&gt;meta_tags, (array) $meta['meta']);
        }
        if (!empty($meta['links'])) {
            $this-&gt;link_tags = array_merge($this-&gt;link_tags, (array) $meta['links']);
        }

        $this-&gt;set_env('dark_mode_support', (bool) $this-&gt;config-&gt;get('dark_mode_support'));

        return $_SESSION['skin_config'];
    }

    /**
     * Check if a specific template exists
     *
     * @param string $name Template name
     *
     * @return bool True if template exists, False otherwise
     */
    public function template_exists($name)
    {
        foreach ($this-&gt;skin_paths as $skin_path) {
            $filename = RCUBE_INSTALL_PATH . $skin_path . '/templates/' . $name . '.html';
            if (
                (is_file($filename) &amp;&amp; is_readable($filename))
                || (!empty($this-&gt;deprecated_templates[$name]) &amp;&amp; $this-&gt;template_exists($this-&gt;deprecated_templates[$name]))
            ) {
                return true;
            }
        }

        return false;
    }

    /**
     * Find the given file in the current skin path stack
     *
     * @param string $file       File name/path to resolve (starting with /)
     * @param string &amp;$skin_path Reference to the base path of the matching skin
     * @param string $add_path   Additional path to search in
     * @param bool   $minified   Fallback to a minified version of the file
     *
     * @return string|false Relative path to the requested file or False if not found
     */
    public function get_skin_file($file, &amp;$skin_path = null, $add_path = null, $minified = false)
    {
        $skin_paths = $this-&gt;skin_paths;

        if ($add_path) {
            array_unshift($skin_paths, $add_path);
            $skin_paths = array_unique($skin_paths);
        }

        if ($file[0] != '/') {
            $file = '/' . $file;
        }

        if ($skin_path = $this-&gt;find_file_path($file, $skin_paths)) {
            return $skin_path . $file;
        }

        if ($minified &amp;&amp; preg_match('/(?&lt;!\.min)\.(js|css)$/', $file)) {
            $file = preg_replace('/\.(js|css)$/', '.min.\\1', $file);

            if ($skin_path = $this-&gt;find_file_path($file, $skin_paths)) {
                return $skin_path . $file;
            }
        }

        return false;
    }

    /**
     * Find path of the asset file
     */
    protected function find_file_path($file, $skin_paths)
    {
        foreach ($skin_paths as $skin_path) {
            if ($this-&gt;assets_dir != RCUBE_INSTALL_PATH) {
                if (realpath($this-&gt;assets_dir . $skin_path . $file)) {
                    return $skin_path;
                }
            }

            if (realpath(RCUBE_INSTALL_PATH . $skin_path . $file)) {
                return $skin_path;
            }
        }
    }

    /**
     * Register a GUI object to the client script
     *
     * @param string $obj Object name
     * @param string $id  Object ID
     */
    public function add_gui_object($obj, $id)
    {
        $this-&gt;add_script(self::JS_OBJECT_NAME.&quot;.gui_object('$obj', '$id');&quot;);
    }

    /**
     * Call a client method
     *
     * @param string $cmd    Method to call
     * @param mixed ...$args Method arguments
     */
    public function command($cmd, ...$args)
    {
        if (strpos($cmd, 'plugin.') !== false) {
            $this-&gt;js_commands[] = ['triggerEvent', $cmd, $args[0]];
        }
        else {
            array_unshift($args, $cmd);

            $this-&gt;js_commands[] = $args;
        }
    }

    /**
     * Add a localized label to the client environment
     *
     * @param mixed ...$args Labels (an array of strings, or many string arguments)
     */
    public function add_label(...$args)
    {
        if (count($args) == 1 &amp;&amp; is_array($args[0])) {
            $args = $args[0];
        }

        foreach ($args as $name) {
            $this-&gt;js_labels[$name] = $this-&gt;app-&gt;gettext($name);
        }
    }

    /**
     * Invoke display_message command
     *
     * @param string  $message  Message to display
     * @param string  $type     Message type [notice|confirm|error]
     * @param array   $vars     Key-value pairs to be replaced in localized text
     * @param bool    $override Override last set message
     * @param int     $timeout  Message display time in seconds
     *
     * @uses self::command()
     */
    public function show_message($message, $type = 'notice', $vars = null, $override = true, $timeout = 0)
    {
        if ($override || !$this-&gt;message) {
            if ($this-&gt;app-&gt;text_exists($message)) {
                if (!empty($vars)) {
                    $vars = array_map(['rcube','Q'], $vars);
                }

                $msgtext = $this-&gt;app-&gt;gettext(['name' =&gt; $message, 'vars' =&gt; $vars]);
            }
            else {
                $msgtext = $message;
            }

            $this-&gt;message = $message;
            $this-&gt;command('display_message', $msgtext, $type, $timeout * 1000);
        }
    }

    /**
     * Delete all stored env variables and commands
     *
     * @param bool $all Reset all env variables (including internal)
     */
    public function reset($all = false)
    {
        $framed = $this-&gt;framed;
        $task   = $this-&gt;env['task'] ?? '';
        $env    = $all ? null : array_intersect_key($this-&gt;env, ['extwin' =&gt; 1, 'framed' =&gt; 1]);

        // keep jQuery-UI files
        $css_files = $script_files = [];

        foreach ($this-&gt;css_files as $file) {
            if (strpos($file, 'plugins/jqueryui') === 0) {
                $css_files[] = $file;
            }
        }

        foreach ($this-&gt;script_files as $position =&gt; $files) {
            foreach ($files as $file) {
                if (strpos($file, 'plugins/jqueryui') === 0) {
                    $script_files[$position][] = $file;
                }
            }
        }

        parent::reset();

        // let some env variables survive
        $this-&gt;env          = $this-&gt;js_env = $env;
        $this-&gt;framed       = $framed || !empty($this-&gt;env['framed']);
        $this-&gt;js_labels    = [];
        $this-&gt;js_commands  = [];
        $this-&gt;scripts      = [];
        $this-&gt;header       = '';
        $this-&gt;footer       = '';
        $this-&gt;body         = '';
        $this-&gt;css_files    = [];
        $this-&gt;script_files = [];

        // load defaults
        if (!$all) {
            $this-&gt;__construct();
        }

        // Note: we merge jQuery-UI scripts after jQuery...
        $this-&gt;css_files    = array_merge($this-&gt;css_files, $css_files);
        $this-&gt;script_files = array_merge_recursive($this-&gt;script_files, $script_files);

        $this-&gt;set_env('orig_task', $task);
    }

    /**
     * Redirect to a certain url
     *
     * @param mixed $p      Either a string with the action or url parameters as key-value pairs
     * @param int   $delay  Delay in seconds
     * @param bool  $secure Redirect to secure location (see rcmail::url())
     */
    public function redirect($p = [], $delay = 1, $secure = false)
    {
        if (!empty($this-&gt;env['extwin']) &amp;&amp; !(is_string($p) &amp;&amp; preg_match('#^https?://#', $p))) {
            if (!is_array($p)) {
                $p = ['_action' =&gt; $p];
            }

            $p['_extwin'] = 1;
        }

        $location = $this-&gt;app-&gt;url($p, false, false, $secure);
        $this-&gt;header('Location: ' . $location);
        exit;
    }

    /**
     * Send the request output to the client.
     * This will either parse a skin template.
     *
     * @param string $templ Template name
     * @param bool   $exit  True if script should terminate (default)
     */
    public function send($templ = null, $exit = true)
    {
        if ($templ != 'iframe') {
            // prevent from endless loops
            if ($exit != 'recur' &amp;&amp; $this-&gt;app-&gt;plugins-&gt;is_processing('render_page')) {
                rcube::raise_error([
                        'code'    =&gt; 505,
                        'file'    =&gt; __FILE__,
                        'line'    =&gt; __LINE__,
                        'message' =&gt; 'Recursion alert: ignoring output-&gt;send()'
                    ], true, false
                );

                return;
            }

            $this-&gt;parse($templ, false);
        }
        else {
            $this-&gt;framed = true;
            $this-&gt;write();
        }

        // set output asap
        ob_flush();
        flush();

        if ($exit) {
            exit;
        }
    }

    /**
     * Process template and write to stdOut
     *
     * @param string $template HTML template content
     */
    public function write($template = '')
    {
        if (!empty($this-&gt;script_files)) {
            $this-&gt;set_env('request_token', $this-&gt;app-&gt;get_request_token());
        }

        // Fix assets path on blankpage
        if (!empty($this-&gt;js_env['blankpage'])) {
            $this-&gt;js_env['blankpage'] = $this-&gt;asset_url($this-&gt;js_env['blankpage'], true);
        }

        $commands = $this-&gt;get_js_commands($framed);

        // if all js commands go to parent window we can ignore all
        // script files and skip rcube_webmail initialization (#1489792)
        // but not on error pages where skins may need jQuery, etc.
        if ($framed &amp;&amp; empty($this-&gt;js_env['server_error'])) {
            $this-&gt;scripts      = [];
            $this-&gt;script_files = [];
            $this-&gt;header       = '';
            $this-&gt;footer       = '';
        }

        // write all javascript commands
        if (!empty($commands)) {
            $this-&gt;add_script($commands, 'head_top');
        }

        $this-&gt;page_headers();

        // call super method
        $this-&gt;_write($template);
    }

    /**
     * Send common page headers
     * For now it only (re)sets X-Frame-Options when needed
     */
    public function page_headers()
    {
        if (headers_sent()) {
            return;
        }

        // allow (legal) iframe content to be loaded
        $framed = $this-&gt;framed || !empty($this-&gt;env['framed']);
        if ($framed &amp;&amp; ($xopt = $this-&gt;app-&gt;config-&gt;get('x_frame_options', 'sameorigin'))) {
            if (strtolower($xopt) === 'deny') {
                $this-&gt;header('X-Frame-Options: sameorigin', true);
            }
        }
    }

    /**
     * Parse a specific skin template and deliver to stdout (or return)
     *
     * @param string $name  Template name
     * @param bool   $exit  Exit script
     * @param bool   $write Don't write to stdout, return parsed content instead
     *
     * @see https://php.net/manual/en/function.exit.php
     */
    function parse($name = 'main', $exit = true, $write = true)
    {
        $plugin   = false;
        $realname = $name;
        $skin_dir = '';
        $plugin_skin_paths = [];

        $this-&gt;template_name = $realname;

        $temp = explode('.', $name, 2);
        if (count($temp) &gt; 1) {
            $plugin   = $temp[0];
            $name     = $temp[1];
            $skin_dir = $plugin . '/skins/' . $this-&gt;config-&gt;get('skin');

            // apply skin search escalation list to plugin directory
            foreach ($this-&gt;skin_paths as $skin_path) {
                // skin folder in plugin dir
                $plugin_skin_paths[] = $this-&gt;app-&gt;plugins-&gt;url . $plugin . '/' . $skin_path;
                // plugin folder in skin dir
                $plugin_skin_paths[] = $skin_path . '/plugins/' . $plugin;
            }

            // prepend plugin skin paths to search list
            $this-&gt;skin_paths = array_merge($plugin_skin_paths, $this-&gt;skin_paths);
        }

        // find skin template
        $path = false;
        foreach ($this-&gt;skin_paths as $skin_path) {
            // when requesting a plugin template ignore global skin path(s)
            if ($plugin &amp;&amp; strpos($skin_path, $this-&gt;app-&gt;plugins-&gt;url) === false) {
                continue;
            }

            $path = RCUBE_INSTALL_PATH . &quot;$skin_path/templates/$name.html&quot;;

            // fallback to deprecated template names
            if (!is_readable($path) &amp;&amp; !empty($this-&gt;deprecated_templates[$realname])) {
                $dname = $this-&gt;deprecated_templates[$realname];
                $path  = RCUBE_INSTALL_PATH . &quot;$skin_path/templates/$dname.html&quot;;

                if (is_readable($path)) {
                    rcube::raise_error([
                            'code' =&gt; 502, 'file' =&gt; __FILE__, 'line' =&gt; __LINE__,
                            'message' =&gt; &quot;Using deprecated template '$dname' in $skin_path/templates. Please rename to '$realname'&quot;
                        ], true, false
                    );
                }
            }

            if (is_readable($path)) {
                $this-&gt;config-&gt;set('skin_path', $skin_path);
                // set base_path to core skin directory (not plugin's skin)
                $this-&gt;base_path = preg_replace('!plugins/\w+/!', '', $skin_path);
                $skin_dir        = preg_replace('!^plugins/!', '', $skin_path);
                break;
            }
            else {
                $path = false;
            }
        }

        // read template file
        if (!$path || ($templ = @file_get_contents($path)) === false) {
            rcube::raise_error([
                    'code' =&gt; 404,
                    'line' =&gt; __LINE__,
                    'file' =&gt; __FILE__,
                    'message' =&gt; 'Error loading template for '.$realname
                ], true, $write);

            $this-&gt;skin_paths = array_slice($this-&gt;skin_paths, count($plugin_skin_paths));
            return false;
        }

        // replace all path references to plugins/... with the configured plugins dir
        // and /this/ to the current plugin skin directory
        if ($plugin) {
            $templ = preg_replace(
                ['/\bplugins\//', '/([&quot;\']?)\/this\//'],
                [$this-&gt;app-&gt;plugins-&gt;url, '\\1' . $this-&gt;app-&gt;plugins-&gt;url . $skin_dir . '/'],
                $templ
            );
        }

        // parse for special tags
        $output = $this-&gt;parse_conditions($templ);
        $output = $this-&gt;parse_xml($output);

        // trigger generic hook where plugins can put additional content to the page
        $hook = $this-&gt;app-&gt;plugins-&gt;exec_hook(&quot;render_page&quot;, [
                'template' =&gt; $realname,
                'content'  =&gt; $output,
                'write'    =&gt; $write
        ]);

        // save some memory
        $output = $hook['content'];
        unset($hook['content']);

        // remove plugin skin paths from current context
        $this-&gt;skin_paths = array_slice($this-&gt;skin_paths, count($plugin_skin_paths));

        if (!$write) {
            return $this-&gt;postrender($output);
        }

        $this-&gt;write(trim($output));

        if ($exit) {
            exit;
        }
    }

    /**
     * Return executable javascript code for all registered commands
     */
    protected function get_js_commands(&amp;$framed = null)
    {
        $out             = '';
        $parent_commands = 0;
        $parent_prefix   = '';
        $top_commands    = [];

        // these should be always on top,
        // e.g. hide_message() below depends on env.framed
        if (!$this-&gt;framed &amp;&amp; !empty($this-&gt;js_env)) {
            $top_commands[] = ['set_env', $this-&gt;js_env];
        }
        if (!empty($this-&gt;js_labels)) {
            $top_commands[] = ['add_label', $this-&gt;js_labels];
        }

        // unlock interface after iframe load
        $unlock = isset($_REQUEST['_unlock']) ? preg_replace('/[^a-z0-9]/i', '', $_REQUEST['_unlock']) : 0;
        if ($this-&gt;framed) {
            $top_commands[] = ['iframe_loaded', $unlock];
        }
        else if ($unlock) {
            $top_commands[] = ['hide_message', $unlock];
        }

        $commands = array_merge($top_commands, $this-&gt;js_commands);

        foreach ($commands as $i =&gt; $args) {
            $method = array_shift($args);
            $parent = $this-&gt;framed || preg_match('/^parent\./', $method);

            foreach ($args as $i =&gt; $arg) {
                $args[$i] = self::json_serialize($arg, $this-&gt;devel_mode);
            }

            if ($parent) {
                $parent_commands++;
                $method        = preg_replace('/^parent\./', '', $method);
                $parent_prefix = 'if (window.parent &amp;&amp; parent.' . self::JS_OBJECT_NAME . ') parent.';
                $method        = $parent_prefix . self::JS_OBJECT_NAME . '.' . $method;
            }
            else {
                $method = self::JS_OBJECT_NAME . '.' . $method;
            }

            $out .= sprintf(&quot;%s(%s);\n&quot;, $method, implode(',', $args));
        }

        $framed = $parent_prefix &amp;&amp; $parent_commands == count($commands);

        // make the output more compact if all commands go to parent window
        if ($framed) {
            $out = &quot;if (window.parent &amp;&amp; parent.&quot; . self::JS_OBJECT_NAME . &quot;) {\n&quot;
                . str_replace($parent_prefix, &quot;\tparent.&quot;, $out)
                . &quot;}\n&quot;;
        }

        return $out;
    }

    /**
     * Make URLs starting with a slash point to skin directory
     *
     * @param string $str         Input string
     * @param bool   $search_path True if URL should be resolved using the current skin path stack
     *
     * @return string URL
     */
    public function abs_url($str, $search_path = false)
    {
        if (isset($str[0]) &amp;&amp; $str[0] == '/') {
            if ($search_path &amp;&amp; ($file_url = $this-&gt;get_skin_file($str))) {
                return $file_url;
            }

            return $this-&gt;base_path . $str;
        }

        return $str;
    }

    /**
     * Show error page and terminate script execution
     *
     * @param int    $code    Error code
     * @param string $message Error message
     */
    public function raise_error($code, $message)
    {
        $args = [
            'code'    =&gt; $code,
            'message' =&gt; $message,
        ];

        $page = new rcmail_action_utils_error;
        $page-&gt;run($args);
    }

    /**
     * Modify path by adding URL prefix if configured
     *
     * @param string $path    Asset path
     * @param bool   $abs_url Pass to self::abs_url() first
     *
     * @return string Asset path
     */
    public function asset_url($path, $abs_url = false)
    {
        // iframe content can't be in a different domain
        // @TODO: check if assets are on a different domain

        if ($abs_url) {
            $path = $this-&gt;abs_url($path, true);
        }

        if (!$this-&gt;assets_path || in_array($path[0], ['?', '/', '.']) || strpos($path, '://')) {
            return $path;
        }

        return $this-&gt;assets_path . $path;
    }


    /*****  Template parsing methods  *****/

    /**
     * Replace all strings ($varname)
     * with the content of the according global variable.
     */
    protected function parse_with_globals($input)
    {
        $GLOBALS['__version']   = html::quote(RCMAIL_VERSION);
        $GLOBALS['__comm_path'] = html::quote($this-&gt;app-&gt;comm_path);
        $GLOBALS['__skin_path'] = html::quote($this-&gt;base_path);

        return preg_replace_callback('/\$(__[a-z0-9_\-]+)/', [$this, 'globals_callback'], $input);
    }

    /**
     * Callback function for preg_replace_callback() in parse_with_globals()
     */
    protected function globals_callback($matches)
    {
        return $GLOBALS[$matches[1]];
    }

    /**
     * Correct absolute paths in images and other tags (add cache busters)
     */
    protected function fix_paths($output)
    {
        $regexp = '!(src|href|background|data-src-[a-z]+)=([&quot;\']?)([a-z0-9/_.-]+)([&quot;\'\s&gt;])!i';

        return preg_replace_callback($regexp, [$this, 'file_callback'], $output);
    }

    /**
     * Callback function for preg_replace_callback in fix_paths()
     *
     * @return string Parsed string
     */
    protected function file_callback($matches)
    {
        $file = $matches[3];
        $file = preg_replace('!^/this/!', '/', $file);

        // correct absolute paths
        if ($file[0] == '/') {
            $this-&gt;get_skin_file($file, $skin_path, $this-&gt;base_path);
            $file = ($skin_path ?: $this-&gt;base_path) . $file;
        }

        // add file modification timestamp
        if (preg_match('/\.(js|css|less|ico|png|svg|jpeg)$/', $file)) {
            $file = $this-&gt;file_mod($file);
        }

        return $matches[1] . '=' . $matches[2] . $file . $matches[4];
    }

    /**
     * Correct paths of asset files according to assets_path
     */
    protected function fix_assets_paths($output)
    {
        $regexp = '!(src|href|background)=([&quot;\']?)([a-z0-9/_.?=-]+)([&quot;\'\s&gt;])!i';

        return preg_replace_callback($regexp, [$this, 'assets_callback'], $output);
    }

    /**
     * Callback function for preg_replace_callback in fix_assets_paths()
     *
     * @return string Parsed string
     */
    protected function assets_callback($matches)
    {
        $file = $this-&gt;asset_url($matches[3]);

        return $matches[1] . '=' . $matches[2] . $file . $matches[4];
    }

    /**
     * Modify file by adding mtime indicator
     */
    protected function file_mod($file)
    {
        $fs  = false;
        $ext = substr($file, strrpos($file, '.') + 1);

        // use minified file if exists (not in development mode)
        if (!$this-&gt;devel_mode &amp;&amp; !preg_match('/\.min\.' . $ext . '$/', $file)) {
            $minified_file = substr($file, 0, strlen($ext) * -1) . 'min.' . $ext;
            if ($fs = @filemtime($this-&gt;assets_dir . $minified_file)) {
                return $minified_file . '?s=' . $fs;
            }
        }

        if ($fs = @filemtime($this-&gt;assets_dir . $file)) {
            $file .= '?s=' . $fs;
        }

        return $file;
    }

    /**
     * Public wrapper to dip into template parsing.
     *
     * @param string $input Template content
     *
     * @return string
     * @uses   rcmail_output_html::parse_xml()
     * @since  0.1-rc1
     */
    public function just_parse($input)
    {
        $input = $this-&gt;parse_conditions($input);
        $input = $this-&gt;parse_xml($input);
        $input = $this-&gt;postrender($input);

        return $input;
    }

    /**
     * Parse for conditional tags
     */
    protected function parse_conditions($input)
    {
        $regexp1 = '/&lt;roundcube:if\s+([^&gt;]+)&gt;/is';
        $regexp2 = '/&lt;roundcube:(if|elseif|else|endif)\s*([^&gt;]*)&gt;/is';

        $pos = 0;

        // Find IF tags and process them
        while ($pos &lt; strlen($input) &amp;&amp; preg_match($regexp1, $input, $conditions, PREG_OFFSET_CAPTURE, $pos)) {
            $pos = $start = $conditions[0][1];

            // Process the 'condition' attribute
            $attrib  = html::parse_attrib_string($conditions[1][0]);
            $condmet = isset($attrib['condition']) &amp;&amp; $this-&gt;check_condition($attrib['condition']);

            // Define start/end position of the content to pass into the output
            $content_start = $condmet ? $pos + strlen($conditions[0][0]) : null;
            $content_end   = null;

            $level = 0;
            $endif = null;
            $n = $pos + 1;

            // Process the code until the closing tag (for the processed IF tag)
            while (preg_match($regexp2, $input, $matches, PREG_OFFSET_CAPTURE, $n)) {
                $tag_start = $matches[0][1];
                $tag_end   = $tag_start + strlen($matches[0][0]);
                $tag_name  = strtolower($matches[1][0]);

                switch ($tag_name) {
                case 'if':
                    $level++;
                    break;

                case 'endif':
                    if (!$level--) {
                        $endif = $tag_end;
                        if ($content_end === null) {
                            $content_end = $tag_start;
                        }
                        break 2;
                    }
                    break;

                case 'elseif':
                    if (!$level) {
                        if ($condmet) {
                            if ($content_end === null) {
                                $content_end = $tag_start;
                            }
                        }
                        else {
                            // Process the 'condition' attribute
                            $attrib  = html::parse_attrib_string($matches[2][0]);
                            $condmet = isset($attrib['condition']) &amp;&amp; $this-&gt;check_condition($attrib['condition']);

                            if ($condmet) {
                                $content_start = $tag_end;
                            }
                        }
                    }
                    break;

                case 'else':
                    if (!$level) {
                        if ($condmet) {
                            if ($content_end === null) {
                                $content_end = $tag_start;
                            }
                        }
                        else {
                            $content_start = $tag_end;
                        }
                    }
                    break;
                }

                $n = $tag_end;
            }

            // No ending tag found
            if ($endif === null) {
                $pos = strlen($input);
                if ($content_end === null) {
                    $content_end = $pos;
                }
            }

            if ($content_start === null) {
                $content = '';
            }
            else {
                $content = substr($input, $content_start, $content_end - $content_start);
            }

            // Replace the whole IF statement with the output content
            $input = substr_replace($input, $content, $start, max($endif, $content_end, $pos) - $start);
            $pos   = $start;
        }

        return $input;
    }

    /**
     * Determines if a given condition is met
     *
     * @param string $condition Condition statement
     *
     * @return bool True if condition is met, False if not
     * @todo Extend this to allow real conditions, not just &quot;set&quot;
     */
    protected function check_condition($condition)
    {
        return $this-&gt;eval_expression($condition);
    }

    /**
     * Inserts hidden field with CSRF-prevention-token into POST forms
     */
    protected function alter_form_tag($matches)
    {
        $out    = $matches[0];
        $attrib = html::parse_attrib_string($matches[1]);

        if (!empty($attrib['method']) &amp;&amp; strtolower($attrib['method']) == 'post') {
            $hidden = new html_hiddenfield(['name' =&gt; '_token', 'value' =&gt; $this-&gt;app-&gt;get_request_token()]);
            $out .= &quot;\n&quot; . $hidden-&gt;show();
        }

        return $out;
    }

    /**
     * Parse &amp; evaluate a given expression and return its result.
     *
     * @param string $expression Expression statement
     *
     * @return mixed Expression result
     */
    protected function eval_expression($expression)
    {
        $expression = preg_replace(
            [
                '/session:([a-z0-9_]+)/i',
                '/config:([a-z0-9_]+)(:([a-z0-9_]+))?/i',
                '/env:([a-z0-9_]+)/i',
                '/request:([a-z0-9_]+)/i',
                '/cookie:([a-z0-9_]+)/i',
                '/browser:([a-z0-9_]+)/i',
                '/template:name/i',
            ],
            [
                &quot;(\$_SESSION['\\1'] ?? null)&quot;,
                &quot;\$this-&gt;app-&gt;config-&gt;get('\\1',rcube_utils::get_boolean('\\3'))&quot;,
                &quot;(\$this-&gt;env['\\1'] ?? null)&quot;,
                &quot;rcube_utils::get_input_value('\\1', rcube_utils::INPUT_GPC)&quot;,
                &quot;(\$_COOKIE['\\1'] ?? null)&quot;,
                &quot;(\$this-&gt;browser-&gt;{'\\1'} ?? null)&quot;,
                &quot;'{$this-&gt;template_name}'&quot;,
            ],
            $expression
        );

        // Note: We used create_function() before but it's deprecated in PHP 7.2
        //       and really it was just a wrapper on eval().
        return eval(&quot;return ($expression);&quot;);
    }

    /**
     * Parse variable strings
     *
     * @param string $type Variable type (env, config etc)
     * @param string $name Variable name
     *
     * @return mixed Variable value
     */
    protected function parse_variable($type, $name)
    {
        $value = '';

        switch ($type) {
            case 'env':
                $value = $this-&gt;env[$name] ?? null;
                break;
            case 'config':
                $value = $this-&gt;config-&gt;get($name);
                if (is_array($value) &amp;&amp; !empty($value[$_SESSION['storage_host']])) {
                    $value = $value[$_SESSION['storage_host']];
                }
                break;
            case 'request':
                $value = rcube_utils::get_input_value($name, rcube_utils::INPUT_GPC);
                break;
            case 'session':
                $value = $_SESSION[$name] ?? '';
                break;
            case 'cookie':
                $value = htmlspecialchars($_COOKIE[$name], ENT_COMPAT | ENT_HTML401, RCUBE_CHARSET);
                break;
            case 'browser':
                $value = $this-&gt;browser-&gt;{$name} ?? '';
                break;
        }

        return $value;
    }

    /**
     * Search for special tags in input and replace them
     * with the appropriate content
     *
     * @param string $input Input string to parse
     *
     * @return string Altered input string
     * @todo   Use DOM-parser to traverse template HTML
     * @todo   Maybe a cache.
     */
    protected function parse_xml($input)
    {
        $regexp = '/&lt;roundcube:([-_a-z]+)\s+((?:[^&gt;]|\\\\&gt;)+)(?&lt;!\\\\)&gt;/Ui';

        return preg_replace_callback($regexp, [$this, 'xml_command'], $input);
    }

    /**
     * Callback function for parsing an xml command tag
     * and turn it into real html content
     *
     * @param array $matches Matches array of preg_replace_callback
     *
     * @return string Tag/Object content
     */
    protected function xml_command($matches)
    {
        $command = strtolower($matches[1]);
        $attrib  = html::parse_attrib_string($matches[2]);

        // empty output if required condition is not met
        if (!empty($attrib['condition']) &amp;&amp; !$this-&gt;check_condition($attrib['condition'])) {
            return '';
        }

        // localize title and summary attributes
        if ($command != 'button' &amp;&amp; !empty($attrib['title']) &amp;&amp; $this-&gt;app-&gt;text_exists($attrib['title'])) {
            $attrib['title'] = $this-&gt;app-&gt;gettext($attrib['title']);
        }
        if ($command != 'button' &amp;&amp; !empty($attrib['summary']) &amp;&amp; $this-&gt;app-&gt;text_exists($attrib['summary'])) {
            $attrib['summary'] = $this-&gt;app-&gt;gettext($attrib['summary']);
        }

        // execute command
        switch ($command) {
            // return a button
            case 'button':
                if (!empty($attrib['name']) || !empty($attrib['command'])) {
                    return $this-&gt;button($attrib);
                }
                break;

            // frame
            case 'frame':
                return $this-&gt;frame($attrib);
                break;

            // show a label
            case 'label':
                if (!empty($attrib['expression'])) {
                    $attrib['name'] = $this-&gt;eval_expression($attrib['expression']);
                }

                if (!empty($attrib['name']) || !empty($attrib['command'])) {
                    $vars = $attrib + ['product' =&gt; $this-&gt;config-&gt;get('product_name')];
                    unset($vars['name'], $vars['command']);

                    $label   = $this-&gt;app-&gt;gettext($attrib + ['vars' =&gt; $vars]);
                    $quoting = null;

                    if (!empty($attrib['quoting'])) {
                        $quoting = strtolower($attrib['quoting']);
                    }
                    else if (isset($attrib['html'])) {
                        $quoting = rcube_utils::get_boolean((string) $attrib['html']) ? 'no' : '';
                    }

                    // 'noshow' can be used in skins to define new labels
                    if (!empty($attrib['noshow'])) {
                        return '';
                    }

                    switch ($quoting) {
                        case 'no':
                        case 'raw':
                            break;
                        case 'javascript':
                        case 'js':
                            $label = rcube::JQ($label);
                            break;
                        default:
                            $label = html::quote($label);
                            break;
                    }

                    return $label;
                }
                break;

            case 'add_label':
                $this-&gt;add_label($attrib['name']);
                break;

            // include a file
            case 'include':
                if (!empty($attrib['condition']) &amp;&amp; !$this-&gt;check_condition($attrib['condition'])) {
                    break;
                }

                if ($attrib['file'][0] != '/') {
                    $attrib['file'] = '/templates/' . $attrib['file'];
                }

                $old_base_path   = $this-&gt;base_path;
                $include         = '';
                $attr_skin_path = !empty($attrib['skinpath']) ? $attrib['skinpath'] : null;

                if (!empty($attrib['skin_path'])) {
                    $attr_skin_path = $attrib['skin_path'];
                }

                if ($path = $this-&gt;get_skin_file($attrib['file'], $skin_path, $attr_skin_path)) {
                    // set base_path to core skin directory (not plugin's skin)
                    $this-&gt;base_path = preg_replace('!plugins/\w+/!', '', $skin_path);
                    $path = realpath(RCUBE_INSTALL_PATH . $path);
                }

                if (is_readable($path)) {
                    $allow_php = $this-&gt;config-&gt;get('skin_include_php');
                    $include   = $allow_php ? $this-&gt;include_php($path) : file_get_contents($path);
                    $include   = $this-&gt;parse_conditions($include);
                    $include   = $this-&gt;parse_xml($include);
                    $include   = $this-&gt;fix_paths($include);
                }

                $this-&gt;base_path = $old_base_path;

                return $include;

            case 'plugin.include':
                $hook = $this-&gt;app-&gt;plugins-&gt;exec_hook(&quot;template_plugin_include&quot;, $attrib + ['content' =&gt; '']);
                return $hook['content'];

            // define a container block
            case 'container':
                if (!empty($attrib['name']) &amp;&amp; !empty($attrib['id'])) {
                    $this-&gt;command('gui_container', $attrib['name'], $attrib['id']);
                    // let plugins insert some content here
                    $hook = $this-&gt;app-&gt;plugins-&gt;exec_hook(&quot;template_container&quot;, $attrib + ['content' =&gt; '']);
                    return $hook['content'];
                }
                break;

            // return code for a specific application object
            case 'object':
                $object  = strtolower($attrib['name']);
                $content = '';
                $handler = null;

                // correct deprecated object names
                if (!empty($this-&gt;deprecated_template_objects[$object])) {
                    $object = $this-&gt;deprecated_template_objects[$object];
                }

                if (!empty($this-&gt;object_handlers[$object])) {
                    $handler = $this-&gt;object_handlers[$object];
                }

                // execute object handler function
                if (is_callable($handler)) {
                    $this-&gt;prepare_object_attribs($attrib);

                    // We assume that objects with src attribute are internal (in most
                    // cases this is a watermark frame). We need this to make sure assets_path
                    // is added to the internal assets paths
                    $external = empty($attrib['src']);
                    $content  = call_user_func($handler, $attrib);
                }
                else if ($object == 'doctype') {
                    $content = html::doctype($attrib['value']);
                }
                else if ($object == 'logo') {
                    $attrib += ['alt' =&gt; $this-&gt;xml_command(['', 'object', 'name=&quot;productname&quot;'])];

                    // 'type' attribute added in 1.4 was renamed 'logo-type' in 1.5
                    // check both for backwards compatibility
                    $logo_type  = !empty($attrib['logo-type']) ? $attrib['logo-type'] : null;
                    $logo_match = !empty($attrib['logo-match']) ? $attrib['logo-match'] : null;
                    if (!empty($attrib['type']) &amp;&amp; empty($logo_type)) {
                        $logo_type = $attrib['type'];
                    }

                    if (($template_logo = $this-&gt;get_template_logo($logo_type, $logo_match)) !== null) {
                        $attrib['src'] = $template_logo;
                    }

                    if (($link = $this-&gt;get_template_logo('link')) !== null) {
                        $attrib['onclick'] = &quot;location.href='$link';&quot;;
                        $attrib['style'] = 'cursor:pointer;';
                    }

                    $additional_logos = [];
                    $logo_types       = (array) $this-&gt;config-&gt;get('additional_logo_types');

                    foreach ($logo_types as $type) {
                        if (($template_logo = $this-&gt;get_template_logo($type)) !== null) {
                            $additional_logos[$type] = $this-&gt;abs_url($template_logo);
                        }
                        else if (!empty($attrib['data-src-' . $type])) {
                            $additional_logos[$type] = $this-&gt;abs_url($attrib['data-src-' . $type]);
                        }
                    }

                    if (!empty($additional_logos)) {
                        $this-&gt;set_env('additional_logos', $additional_logos);
                    }

                    if (!empty($attrib['src'])) {
                        $content = html::img($attrib);
                    }
                }
                else if ($object == 'productname') {
                    $name    = $this-&gt;config-&gt;get('product_name', 'Roundcube Webmail');
                    $content = html::quote($name);
                }
                else if ($object == 'version') {
                    $ver = (string) RCMAIL_VERSION;
                    if (is_file(RCUBE_INSTALL_PATH . '.svn/entries')) {
                        if (preg_match('/Revision:\s(\d+)/', (string) @shell_exec('svn info'), $regs))
                          $ver .= ' [SVN r'.$regs[1].']';
                    }
                    else if (is_file(RCUBE_INSTALL_PATH . '.git/index')) {
                        if (preg_match('/Date:\s+([^\n]+)/', (string) @shell_exec('git log -1'), $regs)) {
                            if ($date = date('Ymd.Hi', strtotime($regs[1]))) {
                                $ver .= ' [GIT '.$date.']';
                            }
                        }
                    }
                    $content = html::quote($ver);
                }
                else if ($object == 'steptitle') {
                    $content = html::quote($this-&gt;get_pagetitle(false));
                }
                else if ($object == 'pagetitle') {
                    // Deprecated, &lt;title&gt; will be added automatically
                    $content = html::quote($this-&gt;get_pagetitle());
                }
                else if ($object == 'contentframe') {
                    if (empty($attrib['id'])) {
                        $attrib['id'] = 'rcm' . $this-&gt;env['task'] . 'frame';
                    }

                    // parse variables
                    if (preg_match('/^(config|env):([a-z0-9_]+)$/i', $attrib['src'], $matches)) {
                        $attrib['src'] = $this-&gt;parse_variable($matches[1], $matches[2]);
                    }

                    $content = $this-&gt;frame($attrib, true);
                }
                else if ($object == 'meta' || $object == 'links') {
                    if ($object == 'meta') {
                        $source = 'meta_tags';
                        $tag    = 'meta';
                        $key    = 'name';
                        $param  = 'content';
                    }
                    else {
                        $source = 'link_tags';
                        $tag    = 'link';
                        $key    = 'rel';
                        $param  = 'href';
                    }

                    foreach ($this-&gt;$source as $name =&gt; $vars) {
                        // $vars can be in many forms:
                        // - string
                        // - ['key' =&gt; 'val']
                        // - [string, string]
                        // - [[], string]
                        // - [['key' =&gt; 'val'], ['key' =&gt; 'val']]
                        // normalise this for processing by checking for string array keys
                        $vars = is_array($vars) ? (count(array_filter(array_keys($vars), 'is_string')) &gt; 0 ? [$vars] : $vars) : [$vars];

                        foreach ($vars as $args) {
                            // skip unset headers e.g. when extending a skin and removing a header defined in the parent
                            if ($args === false) {
                                continue;
                            }

                            $args = is_array($args) ? $args : [$param =&gt; $args];

                            // special handling for favicon
                            if ($object == 'links' &amp;&amp; $name == 'shortcut icon' &amp;&amp; empty($args[$param])) {
                                if ($href = $this-&gt;get_template_logo('favicon')) {
                                    $args[$param] = $href;
                                }
                                else if ($href = $this-&gt;config-&gt;get('favicon', '/images/favicon.ico')) {
                                    $args[$param] = $href;
                                }
                            }

                            $content .= html::tag($tag, [$key =&gt; $name, 'nl' =&gt; true] + $args);
                        }
                    }
                }

                // exec plugin hooks for this template object
                $hook = $this-&gt;app-&gt;plugins-&gt;exec_hook(&quot;template_object_$object&quot;, $attrib + ['content' =&gt; (string) $content]);

                if (strlen($hook['content']) &amp;&amp; !empty($external)) {
                    $object_id                 = uniqid('TEMPLOBJECT:', true);
                    $this-&gt;objects[$object_id] = $hook['content'];
                    $hook['content']           = $object_id;
                }

                return $hook['content'];

            // return &lt;link&gt; element
            case 'link':
                if ($attrib['condition'] &amp;&amp; !$this-&gt;check_condition($attrib['condition'])) {
                    break;
                }

                unset($attrib['condition']);

                return html::tag('link', $attrib);


            // return code for a specified eval expression
            case 'exp':
                return html::quote($this-&gt;eval_expression($attrib['expression']));

            // return variable
            case 'var':
                $var = explode(':', $attrib['name']);
                $value = $this-&gt;parse_variable($var[0], $var[1]);

                if (is_array($value)) {
                    $value = implode(', ', $value);
                }

                return html::quote($value);

            case 'form':
                return $this-&gt;form_tag($attrib);
        }

        return '';
    }

    /**
     * Prepares template object attributes
     *
     * @param array &amp;$attribs Attributes
     */
    protected function prepare_object_attribs(&amp;$attribs)
    {
        foreach ($attribs as $key =&gt; &amp;$value) {
            if (strpos($key, 'data-label-') === 0) {
                // Localize data-label-* attributes
                $value = $this-&gt;app-&gt;gettext($value);
            }
            elseif ($key[0] == ':') {
                // Evaluate attributes with expressions and remove special character from attribute name
                $attribs[substr($key, 1)] = $this-&gt;eval_expression($value);
                unset($attribs[$key]);
            }
        }
    }

    /**
     * Include a specific file and return it's contents
     *
     * @param string $file File path
     *
     * @return string Contents of the processed file
     */
    protected function include_php($file)
    {
        ob_start();
        include $file;
        $out = ob_get_contents();
        ob_end_clean();

        return $out;
    }

    /**
     * Put objects' content back into template output
     */
    protected function postrender($output)
    {
        // insert objects' contents
        foreach ($this-&gt;objects as $key =&gt; $val) {
            $output = str_replace($key, (string) $val, $output, $count);
            if ($count) {
                $this-&gt;objects[$key] = null;
            }
        }

        // make sure all &lt;form&gt; tags have a valid request token
        $output = preg_replace_callback('/&lt;form\s+([^&gt;]+)&gt;/Ui', [$this, 'alter_form_tag'], $output);

        return $output;
    }

    /**
     * Create and register a button
     *
     * @param array $attrib Named button attributes
     *
     * @return string HTML button
     * @todo   Remove all inline JS calls and use jQuery instead.
     * @todo   Remove all sprintf()'s - they are pretty, but also slow.
     */
    public function button($attrib)
    {
        static $s_button_count = 100;

        // these commands can be called directly via url
        $a_static_commands = ['compose', 'list', 'preferences', 'folders', 'identities'];

        if (empty($attrib['command']) &amp;&amp; empty($attrib['name']) &amp;&amp; empty($attrib['href'])) {
            return '';
        }

        $command = !empty($attrib['command']) ? $attrib['command'] : null;
        $action  = $command ?: (!empty($attrib['name']) ? $attrib['name'] : null);

        if (!empty($attrib['task'])) {
            $command = $attrib['task'] . '.' . $command;
            $element = $attrib['task'] . '.' . $action;
        }
        else {
            $element = (!empty($this-&gt;env['task']) ? $this-&gt;env['task'] . '.' : '') . $action;
        }

        $disabled_actions = (array) $this-&gt;config-&gt;get('disabled_actions');

        // remove buttons for disabled actions
        if (in_array($element, $disabled_actions) || in_array($action, $disabled_actions)) {
            return '';
        }

        // try to find out the button type
        if (!empty($attrib['type'])) {
            $attrib['type'] = strtolower($attrib['type']);
            if (strpos($attrib['type'], '-menuitem')) {
                $attrib['type'] = substr($attrib['type'], 0, -9);
                $menuitem = true;
            }
        }
        else if (!empty($attrib['image']) || !empty($attrib['imagepas']) || !empty($attrib['imageact'])) {
            $attrib['type'] = 'image';
        }
        else {
            $attrib['type'] = 'button';
        }

        if (empty($attrib['image'])) {
            if (!empty($attrib['imagepas'])) {
                $attrib['image'] = $attrib['imagepas'];
            }
            else if (!empty($attrib['imageact'])) {
                $attrib['image'] = $attrib['imageact'];
            }
        }

        if (empty($attrib['id'])) {
            // ensure auto generated IDs are unique between main window and content frame
            // Elastic skin duplicates buttons between the two on smaller screens (#7618)
            $prefix       = ($this-&gt;framed || !empty($this-&gt;env['framed'])) ? 'frm' : '';
            $attrib['id'] = sprintf('rcmbtn%s%d', $prefix, $s_button_count++);
        }

        // get localized text for labels and titles
        $domain = !empty($attrib['domain']) ? $attrib['domain'] : null;
        if (!empty($attrib['title'])) {
            $attrib['title'] = html::quote($this-&gt;app-&gt;gettext($attrib['title'], $domain));
        }
        if (!empty($attrib['label'])) {
            $attrib['label'] = html::quote($this-&gt;app-&gt;gettext($attrib['label'], $domain));
        }
        if (!empty($attrib['alt'])) {
            $attrib['alt'] = html::quote($this-&gt;app-&gt;gettext($attrib['alt'], $domain));
        }

        // set accessibility attributes
        if (empty($attrib['role'])) {
            $attrib['role'] = 'button';
        }

        if (!empty($attrib['class']) &amp;&amp; !empty($attrib['classact']) || !empty($attrib['imagepas']) &amp;&amp; !empty($attrib['imageact'])) {
            if (array_key_exists('tabindex', $attrib)) {
                $attrib['data-tabindex'] = $attrib['tabindex'];
            }
            $attrib['tabindex']      = '-1';  // disable button by default
            $attrib['aria-disabled'] = 'true';
        }

        // set title to alt attribute for IE browsers
        if ($this-&gt;browser-&gt;ie &amp;&amp; empty($attrib['title']) &amp;&amp; !empty($attrib['alt'])) {
            $attrib['title'] = $attrib['alt'];
        }

        // add empty alt attribute for XHTML compatibility
        if (!isset($attrib['alt'])) {
            $attrib['alt'] = '';
        }

        // register button in the system
        if (!empty($attrib['command'])) {
            $this-&gt;add_script(sprintf(
                &quot;%s.register_button('%s', '%s', '%s', '%s', '%s', '%s');&quot;,
                self::JS_OBJECT_NAME,
                $command,
                $attrib['id'],
                $attrib['type'],
                !empty($attrib['imageact']) ? $this-&gt;abs_url($attrib['imageact']) : (!empty($attrib['classact']) ? $attrib['classact'] : ''),
                !empty($attrib['imagesel']) ? $this-&gt;abs_url($attrib['imagesel']) : (!empty($attrib['classsel']) ? $attrib['classsel'] : ''),
                !empty($attrib['imageover']) ? $this-&gt;abs_url($attrib['imageover']) : ''
            ));

            // make valid href to specific buttons
            if (in_array($attrib['command'], rcmail::$main_tasks)) {
                $attrib['href']    = $this-&gt;app-&gt;url(['task' =&gt; $attrib['command']]);
                $attrib['onclick'] = sprintf(&quot;return %s.command('switch-task','%s',this,event)&quot;, self::JS_OBJECT_NAME, $attrib['command']);
            }
            else if (!empty($attrib['task']) &amp;&amp; in_array($attrib['task'], rcmail::$main_tasks)) {
                $attrib['href'] = $this-&gt;app-&gt;url(['action' =&gt; $attrib['command'], 'task' =&gt; $attrib['task']]);
            }
            else if (in_array($attrib['command'], $a_static_commands)) {
                $attrib['href'] = $this-&gt;app-&gt;url(['action' =&gt; $attrib['command']]);
            }
            else if (($attrib['command'] == 'permaurl' || $attrib['command'] == 'extwin') &amp;&amp; !empty($this-&gt;env['permaurl'])) {
              $attrib['href'] = $this-&gt;env['permaurl'];
            }
        }

        // overwrite attributes
        if (empty($attrib['href'])) {
            $attrib['href'] = '#';
        }

        if (!empty($attrib['task'])) {
            if (!empty($attrib['classact'])) {
                $attrib['class'] = $attrib['classact'];
            }
        }
        else if ($command &amp;&amp; empty($attrib['onclick'])) {
            $attrib['onclick'] = sprintf(
                &quot;return %s.command('%s','%s',this,event)&quot;,
                self::JS_OBJECT_NAME,
                $command,
                !empty($attrib['prop']) ? $attrib['prop'] : ''
            );
        }

        $out         = '';
        $btn_content = null;
        $link_attrib = [];

        // generate image tag
        if ($attrib['type'] == 'image') {
            $attrib_str = html::attrib_string(
                $attrib,
                [
                    'style', 'class', 'id', 'width', 'height', 'border', 'hspace',
                    'vspace', 'align', 'alt', 'tabindex', 'title'
                ]
            );
            $btn_content = sprintf('&lt;img src=&quot;%s&quot;%s /&gt;', $this-&gt;abs_url($attrib['image']), $attrib_str);
            if (!empty($attrib['label'])) {
                $btn_content .= ' '.$attrib['label'];
            }
            $link_attrib = ['href', 'onclick', 'onmouseover', 'onmouseout', 'onmousedown', 'onmouseup', 'target'];
        }
        else if ($attrib['type'] == 'link') {
            $btn_content = $attrib['content'] ?? (!empty($attrib['label']) ? $attrib['label'] : $attrib['command']);
            $link_attrib = array_merge(html::$common_attrib, ['href', 'onclick', 'tabindex', 'target', 'rel']);
            if (!empty($attrib['innerclass'])) {
                $btn_content = html::span($attrib['innerclass'], $btn_content);
            }
        }
        else if ($attrib['type'] == 'input') {
            $attrib['type'] = 'button';

            if (!empty($attrib['label'])) {
                $attrib['value'] = $attrib['label'];
            }
            if (!empty($attrib['command'])) {
                $attrib['disabled'] = 'disabled';
            }

            $out = html::tag('input', $attrib, null, ['type', 'value', 'onclick', 'id', 'class', 'style', 'tabindex', 'disabled']);
        }
        else {
            if (!empty($attrib['label'])) {
                $attrib['value'] = $attrib['label'];
            }
            if (!empty($attrib['command'])) {
                $attrib['disabled'] = 'disabled';
            }

            $content = $attrib['content'] ?? $attrib['label'];
            $out = html::tag('button', $attrib, $content, ['type', 'value', 'onclick', 'id', 'class', 'style', 'tabindex', 'disabled']);
        }

        // generate html code for button
        if ($btn_content) {
            $attrib_str = html::attrib_string($attrib, $link_attrib);
            $out = sprintf('&lt;a%s&gt;%s&lt;/a&gt;', $attrib_str, $btn_content);
        }

        if (!empty($attrib['wrapper'])) {
            $out = html::tag($attrib['wrapper'], null, $out);
        }

        if (!empty($menuitem)) {
            $class = !empty($attrib['menuitem-class']) ? ' class=&quot;' . $attrib['menuitem-class'] . '&quot;' : '';
            $out   = '&lt;li role=&quot;menuitem&quot;' . $class . '&gt;' . $out . '&lt;/li&gt;';
        }

        return $out;
    }

    /**
     * Link an external script file
     *
     * @param string $file     File URL
     * @param string $position Target position [head|head_bottom|foot]
     */
    public function include_script($file, $position = 'head', $add_path = true)
    {
        if ($add_path &amp;&amp; !preg_match('|^https?://|i', $file) &amp;&amp; $file[0] != '/') {
            $file = $this-&gt;file_mod($this-&gt;scripts_path . $file);
        }

        if (!isset($this-&gt;script_files[$position]) || !is_array($this-&gt;script_files[$position])) {
            $this-&gt;script_files[$position] = [];
        }

        if (!in_array($file, $this-&gt;script_files[$position])) {
            $this-&gt;script_files[$position][] = $file;
        }
    }

    /**
     * Add inline javascript code
     *
     * @param string $script   JS code snippet
     * @param string $position Target position [head|head_top|foot|docready]
     */
    public function add_script($script, $position = 'head')
    {
        if (!isset($this-&gt;scripts[$position])) {
            $this-&gt;scripts[$position] = rtrim($script);
        }
        else {
            $this-&gt;scripts[$position] .= &quot;\n&quot; . rtrim($script);
        }
    }

    /**
     * Link an external css file
     *
     * @param string $file File URL
     */
    public function include_css($file)
    {
        $this-&gt;css_files[] = $file;
    }

    /**
     * Add HTML code to the page header
     *
     * @param string $str HTML code
     */
    public function add_header($str)
    {
        $this-&gt;header .= &quot;\n&quot; . $str;
    }

    /**
     * Add HTML code to the page footer
     * To be added right before &lt;/body&gt;
     *
     * @param string $str HTML code
     */
    public function add_footer($str)
    {
        $this-&gt;footer .= &quot;\n&quot; . $str;
    }

    /**
     * Process template and write to stdOut
     *
     * @param string $output HTML output
     */
    protected function _write($output = '')
    {
        $output = trim($output);

        if (empty($output)) {
            $output   = html::doctype('html5') . &quot;\n&quot; . $this-&gt;default_template;
            $is_empty = true;
        }

        $merge_script_files = function($output, $script) {
            return $output . html::script($script);
        };

        $merge_scripts = function($output, $script) {
            return $output . html::script([], $script);
        };

        // put docready commands into page footer
        if (!empty($this-&gt;scripts['docready'])) {
            $this-&gt;add_script(&quot;\$(function() {\n&quot; . $this-&gt;scripts['docready'] . &quot;\n});&quot;, 'foot');
        }

        $page_header = '';
        $page_footer = '';
        $meta        = '';

        // declare page language
        if (!empty($_SESSION['language'])) {
            $lang   = substr($_SESSION['language'], 0, 2);
            $output = preg_replace('/&lt;html/', '&lt;html lang=&quot;' . html::quote($lang) . '&quot;', $output, 1);

            if (!headers_sent()) {
                $this-&gt;header('Content-Language: ' . $lang);
            }
        }

        // include meta tag with charset
        if (!empty($this-&gt;charset)) {
            if (!headers_sent()) {
                $this-&gt;header('Content-Type: text/html; charset=' . $this-&gt;charset);
            }

            $meta .= html::tag('meta', [
                    'http-equiv' =&gt; 'content-type',
                    'content'    =&gt; &quot;text/html; charset={$this-&gt;charset}&quot;,
                    'nl'         =&gt; true
            ]);
        }

        // include page title (after charset specification)
        $meta .= '&lt;title&gt;' . html::quote($this-&gt;get_pagetitle()) . &quot;&lt;/title&gt;\n&quot;;

        $output = preg_replace('/(&lt;head[^&gt;]*&gt;)\n*/i', &quot;\\1\n{$meta}&quot;, $output, 1, $count);
        if (!$count) {
            $page_header .= $meta;
        }

        // include scripts into header/footer
        if (!empty($this-&gt;script_files['head'])) {
            $page_header .= array_reduce((array) $this-&gt;script_files['head'], $merge_script_files);
        }

        $head  = $this-&gt;scripts['head_top'] ?? '';
        $head .= $this-&gt;scripts['head'] ?? '';

        $page_header .= array_reduce((array) $head, $merge_scripts);
        $page_header .= $this-&gt;header . &quot;\n&quot;;

        if (!empty($this-&gt;script_files['head_bottom'])) {
            $page_header .= array_reduce((array) $this-&gt;script_files['head_bottom'], $merge_script_files);
        }

        if (!empty($this-&gt;script_files['foot'])) {
            $page_footer .= array_reduce((array) $this-&gt;script_files['foot'], $merge_script_files);
        }

        $page_footer .= $this-&gt;footer . &quot;\n&quot;;

        if (!empty($this-&gt;scripts['foot'])) {
            $page_footer .= array_reduce((array) $this-&gt;scripts['foot'], $merge_scripts);
        }

        // find page header
        if ($hpos = stripos($output, '&lt;/head&gt;')) {
            $page_header .= &quot;\n&quot;;
        }
        else {
            if (!is_numeric($hpos)) {
                $hpos = stripos($output, '&lt;body');
            }
            if (!is_numeric($hpos) &amp;&amp; ($hpos = stripos($output, '&lt;html'))) {
                while ($output[$hpos] != '&gt;') {
                    $hpos++;
                }
                $hpos++;
            }
            $page_header = &quot;&lt;head&gt;\n$page_header\n&lt;/head&gt;\n&quot;;
        }

        // add page header
        if ($hpos) {
            $output = substr_replace($output, $page_header, $hpos, 0);
        }
        else {
            $output = $page_header . $output;
        }

        // add page footer
        if (($fpos = strripos($output, '&lt;/body&gt;')) || ($fpos = strripos($output, '&lt;/html&gt;'))) {
            // for Elastic: put footer content before &quot;footer scripts&quot;
            while (($npos = strripos($output, &quot;\n&quot;, -strlen($output) + $fpos - 1))
                &amp;&amp; $npos != $fpos
                &amp;&amp; ($chunk = substr($output, $npos, $fpos - $npos)) !== ''
                &amp;&amp; (trim($chunk) === '' || preg_match('/\s*&lt;script[^&gt;]+&gt;&lt;\/script&gt;\s*/', $chunk))
            ) {
                $fpos = $npos;
            }

            $output = substr_replace($output, $page_footer.&quot;\n&quot;, $fpos, 0);
        }
        else {
            $output .= &quot;\n&quot;.$page_footer;
        }

        // add css files in head, before scripts, for speed up with parallel downloads
        if (!empty($this-&gt;css_files) &amp;&amp; empty($is_empty)
            &amp;&amp; (($pos = stripos($output, '&lt;script ')) || ($pos = stripos($output, '&lt;/head&gt;')))
        ) {
            $css = '';
            foreach ($this-&gt;css_files as $file) {
                $is_less = substr_compare($file, '.less', -5, 5, true) === 0;
                $css    .= html::tag('link', [
                        'rel'  =&gt; $is_less ? 'stylesheet/less' : 'stylesheet',
                        'type' =&gt; 'text/css',
                        'href' =&gt; $file,
                        'nl'   =&gt; true,
                ]);
            }
            $output = substr_replace($output, $css, $pos, 0);
        }

        $output = $this-&gt;parse_with_globals($this-&gt;fix_paths($output));

        if ($this-&gt;assets_path) {
            $output = $this-&gt;fix_assets_paths($output);
        }

        $output = $this-&gt;postrender($output);

        // trigger hook with final HTML content to be sent
        $hook = $this-&gt;app-&gt;plugins-&gt;exec_hook(&quot;send_page&quot;, ['content' =&gt; $output]);
        if (!$hook['abort']) {
            if ($this-&gt;charset != RCUBE_CHARSET) {
                echo rcube_charset::convert($hook['content'], RCUBE_CHARSET, $this-&gt;charset);
            }
            else {
                echo $hook['content'];
            }
        }
    }

    /**
     * Returns iframe object, registers some related env variables
     *
     * @param array $attrib          HTML attributes
     * @param bool  $is_contentframe Register this iframe as the 'contentframe' gui object
     *
     * @return string IFRAME element
     */
    public function frame($attrib, $is_contentframe = false)
    {
        static $idcount = 0;

        if (empty($attrib['id'])) {
            $attrib['id'] = 'rcmframe' . ++$idcount;
        }

        $attrib['name'] = $attrib['id'];
        $attrib['src']  = !empty($attrib['src']) ? $this-&gt;abs_url($attrib['src'], true) : 'javascript:false;';

        // register as 'contentframe' object
        if ($is_contentframe || !empty($attrib['contentframe'])) {
            $this-&gt;set_env('contentframe', !empty($attrib['contentframe']) ? $attrib['contentframe'] : $attrib['name']);
        }

        return html::iframe($attrib);
    }


    /*  ************* common functions delivering gui objects **************  */

    /**
     * Create a form tag with the necessary hidden fields
     *
     * @param array  $attrib  Named tag parameters
     * @param string $content HTML content of the form
     *
     * @return string HTML code for the form
     */
    public function form_tag($attrib, $content = null)
    {
        $hidden = '';

        if (!empty($this-&gt;env['extwin'])) {
            $hiddenfield = new html_hiddenfield(['name' =&gt; '_extwin', 'value' =&gt; '1']);
            $hidden = $hiddenfield-&gt;show();
        }
        else if ($this-&gt;framed || !empty($this-&gt;env['framed'])) {
            $hiddenfield = new html_hiddenfield(['name' =&gt; '_framed', 'value' =&gt; '1']);
            $hidden = $hiddenfield-&gt;show();
        }

        if (!$content) {
            $attrib['noclose'] = true;
        }

        return html::tag('form',
            $attrib + ['action' =&gt; $this-&gt;app-&gt;comm_path, 'method' =&gt; 'get'],
            $hidden . $content,
            ['id', 'class', 'style', 'name', 'method', 'action', 'enctype', 'onsubmit']
        );
    }

    /**
     * Build a form tag with a unique request token
     *
     * @param array  $attrib  Named tag parameters including 'action' and 'task' values
     *                        which will be put into hidden fields
     * @param string $content Form content
     *
     * @return string HTML code for the form
     */
    public function request_form($attrib, $content = '')
    {
        $hidden = new html_hiddenfield();

        if (!empty($attrib['task'])) {
            $hidden-&gt;add(['name' =&gt; '_task', 'value' =&gt; $attrib['task']]);
        }

        if (!empty($attrib['action'])) {
            $hidden-&gt;add(['name' =&gt; '_action', 'value' =&gt; $attrib['action']]);
        }

        // we already have a &lt;form&gt; tag
        if (!empty($attrib['form'])) {
            if ($this-&gt;framed || !empty($this-&gt;env['framed'])) {
                $hidden-&gt;add(['name' =&gt; '_framed', 'value' =&gt; '1']);
            }

            return $hidden-&gt;show() . $content;
        }

        unset($attrib['task'], $attrib['request']);
        $attrib['action'] = './';

        return $this-&gt;form_tag($attrib, $hidden-&gt;show() . $content);
    }

    /**
     * GUI object 'username'
     * Showing IMAP username of the current session
     *
     * @param array $attrib Named tag parameters (currently not used)
     *
     * @return string HTML code for the gui object
     */
    public function current_username($attrib)
    {
        static $username;

        // already fetched
        if (!empty($username)) {
            return $username;
        }

        // Current username is an e-mail address
        if (isset($_SESSION['username']) &amp;&amp; strpos($_SESSION['username'], '@')) {
            $username = $_SESSION['username'];
        }
        // get e-mail address from default identity
        else if ($sql_arr = $this-&gt;app-&gt;user-&gt;get_identity()) {
            $username = $sql_arr['email'];
        }
        else {
            $username = $this-&gt;app-&gt;user-&gt;get_username();
        }

        $username = rcube_utils::idn_to_utf8($username);

        return html::quote($username);
    }

    /**
     * GUI object 'loginform'
     * Returns code for the webmail login form
     *
     * @param array $attrib Named parameters
     *
     * @return string HTML code for the gui object
     */
    protected function login_form($attrib)
    {
        $default_host     = $this-&gt;config-&gt;get('imap_host');
        $autocomplete     = (int) $this-&gt;config-&gt;get('login_autocomplete');
        $username_filter  = $this-&gt;config-&gt;get('login_username_filter');
        $_SESSION['temp'] = true;

        // save original url
        $url = rcube_utils::get_input_string('_url', rcube_utils::INPUT_POST);
        if (
            empty($url)
            &amp;&amp; !empty($_SERVER['QUERY_STRING'])
            &amp;&amp; !preg_match('/_(task|action)=logout/', $_SERVER['QUERY_STRING'])
        ) {
            $url = $_SERVER['QUERY_STRING'];
        }

        // Disable autocapitalization on iPad/iPhone (#1488609)
        $attrib['autocapitalize'] = 'off';

        $form_name = !empty($attrib['form']) ? $attrib['form'] : 'form';

        // set autocomplete attribute
        $user_attrib = $autocomplete &gt; 0 ? [] : ['autocomplete' =&gt; 'off'];
        $host_attrib = $autocomplete &gt; 0 ? [] : ['autocomplete' =&gt; 'off'];
        $pass_attrib = $autocomplete &gt; 1 ? [] : ['autocomplete' =&gt; 'off'];

        if ($username_filter &amp;&amp; strtolower($username_filter) == 'email') {
            $user_attrib['type'] = 'email';
        }

        $input_task   = new html_hiddenfield(['name' =&gt; '_task', 'value' =&gt; 'login']);
        $input_action = new html_hiddenfield(['name' =&gt; '_action', 'value' =&gt; 'login']);
        $input_tzone  = new html_hiddenfield(['name' =&gt; '_timezone', 'id' =&gt; 'rcmlogintz', 'value' =&gt; '_default_']);
        $input_url    = new html_hiddenfield(['name' =&gt; '_url', 'id' =&gt; 'rcmloginurl', 'value' =&gt; $url]);
        $input_user   = new html_inputfield(['name' =&gt; '_user', 'id' =&gt; 'rcmloginuser', 'required' =&gt; 'required']
            + $attrib + $user_attrib);
        $input_pass   = new html_passwordfield(['name' =&gt; '_pass', 'id' =&gt; 'rcmloginpwd', 'required' =&gt; 'required']
            + $attrib + $pass_attrib);
        $input_host   = null;

        $form_content = [
            'hidden' =&gt; [
                'task'   =&gt; $input_task-&gt;show(),
                'action' =&gt; $input_action-&gt;show(),
                'tzone'  =&gt; $input_tzone-&gt;show(),
                'url'    =&gt; $input_url-&gt;show(),
            ],
            'inputs' =&gt; [
                'user' =&gt; [
                    'title'   =&gt; html::label('rcmloginuser', html::quote($this-&gt;app-&gt;gettext('username'))),
                    'content' =&gt; $input_user-&gt;show(rcube_utils::get_input_string('_user', rcube_utils::INPUT_GPC))
                ],
                'password' =&gt; [
                    'title'   =&gt; html::label('rcmloginpwd', html::quote($this-&gt;app-&gt;gettext('password'))),
                    'content' =&gt; $input_pass-&gt;show()
                ],
            ],
            'buttons' =&gt; []
        ];

        if (is_array($default_host) &amp;&amp; count($default_host) &gt; 1) {
            $input_host = new html_select(['name' =&gt; '_host', 'id' =&gt; 'rcmloginhost', 'class' =&gt; 'custom-select']);

            foreach ($default_host as $key =&gt; $value) {
                if (!is_array($value)) {
                    $input_host-&gt;add($value, (is_numeric($key) ? $value : $key));
                }
                else {
                    $input_host = null;
                    break;
                }
            }
        }
        else if (is_array($default_host) &amp;&amp; ($host = key($default_host)) !== null) {
            $val = is_numeric($host) ? $default_host[$host] : $host;
            $input_host = new html_hiddenfield(['name' =&gt; '_host', 'id' =&gt; 'rcmloginhost', 'value' =&gt; $val] + $attrib);

            $form_content['hidden']['host'] = $input_host-&gt;show();
            $input_host = null;
        }
        else if (empty($default_host)) {
            $input_host = new html_inputfield(['name' =&gt; '_host', 'id' =&gt; 'rcmloginhost', 'class' =&gt; 'form-control']
                + $attrib + $host_attrib);
        }

        // add host selection row
        if (is_object($input_host)) {
            $form_content['inputs']['host'] = [
                'title'   =&gt; html::label('rcmloginhost', html::quote($this-&gt;app-&gt;gettext('server'))),
                'content' =&gt; $input_host-&gt;show(rcube_utils::get_input_string('_host', rcube_utils::INPUT_GPC))
            ];
        }

        if (rcube_utils::get_boolean($attrib['submit'])) {
            $button_attr = ['type' =&gt; 'submit', 'id' =&gt; 'rcmloginsubmit', 'class' =&gt; 'button mainaction submit'];
            $button      = html::tag('button', $button_attr, $this-&gt;app-&gt;gettext('login'));

            $form_content['buttons']['submit'] = ['outterclass' =&gt; 'formbuttons', 'content' =&gt; $button];
        }

        // add oauth login button
        if ($this-&gt;config-&gt;get('oauth_auth_uri') &amp;&amp; $this-&gt;config-&gt;get('oauth_provider')) {
            // hide login form fields when `oauth_login_redirect` is configured
            if ($this-&gt;config-&gt;get('oauth_login_redirect')) {
                $form_content['hidden']  = [];
                $form_content['inputs']  = [];
                $form_content['buttons'] = [];
            }

            $link_attr = [
                'href'  =&gt; $this-&gt;app-&gt;url(['action' =&gt; 'oauth']),
                'id'    =&gt; 'rcmloginoauth',
                'class' =&gt; 'button oauth ' . $this-&gt;config-&gt;get('oauth_provider')
            ];

            $provider = $this-&gt;config-&gt;get('oauth_provider_name', 'OAuth');
            $button   = html::a($link_attr, $this-&gt;app-&gt;gettext(['name' =&gt; 'oauthlogin', 'vars' =&gt; ['provider' =&gt; $provider]]));

            $form_content['buttons']['oauthlogin'] = ['outterclass' =&gt; 'oauthlogin', 'content' =&gt; $button];
        }

        $data = $this-&gt;app-&gt;plugins-&gt;exec_hook('loginform_content', $form_content);

        $this-&gt;add_gui_object('loginform', $form_name);

        // output login form contents
        $out = implode('', $data['hidden']);

        if (count($data['inputs']) &gt; 0) {
            // create HTML table with two cols
            $table = new html_table(['cols' =&gt; 2]);

            foreach ($data['inputs'] as $input) {
                if (isset($input['title'])) {
                    $table-&gt;add('title', $input['title']);
                    $table-&gt;add('input', $input['content']);
                }
                else {
                    $table-&gt;add(['colspan' =&gt; 2, 'class' =&gt; 'input'], $input['content']);
                }
            }

            $out .= $table-&gt;show();
        }

        foreach ($data['buttons'] as $button) {
            $out .= html::p($button['outterclass'], $button['content']);
        }

        // surround html output with a form tag
        if (empty($attrib['form'])) {
            $out = $this-&gt;form_tag(['name' =&gt; $form_name, 'method' =&gt; 'post'], $out);
        }

        // include script for timezone detection
        $this-&gt;include_script('jstz.min.js');

        return $out;
    }

    /**
     * GUI object 'preloader'
     * Loads javascript code for images preloading
     *
     * @param array $attrib Named parameters
     * @return void
     */
    protected function preloader($attrib)
    {
        $images = preg_split('/[\s\t\n,]+/', $attrib['images'], -1, PREG_SPLIT_NO_EMPTY);
        $images = array_map([$this, 'abs_url'], $images);
        $images = array_map([$this, 'asset_url'], $images);

        if (empty($images) || (isset($_REQUEST['_task']) &amp;&amp; $_REQUEST['_task'] == 'logout')) {
            return;
        }

        $this-&gt;add_script('var images = ' . self::json_serialize($images, $this-&gt;devel_mode) .';
            for (var i=0; i&lt;images.length; i++) {
                img = new Image();
                img.src = images[i];
            }', 'docready');
    }

    /**
     * GUI object 'searchform'
     * Returns code for search function
     *
     * @param array $attrib Named parameters
     *
     * @return string HTML code for the gui object
     */
    public function search_form($attrib)
    {
        // add some labels to client
        $this-&gt;add_label('searching');

        $attrib['name']  = '_q';
        $attrib['class'] = trim((!empty($attrib['class']) ? $attrib['class'] : '') . ' no-bs');

        if (empty($attrib['id'])) {
            $attrib['id'] = 'rcmqsearchbox';
        }
        if (isset($attrib['type']) &amp;&amp; $attrib['type'] == 'search' &amp;&amp; !$this-&gt;browser-&gt;khtml) {
            unset($attrib['type'], $attrib['results']);
        }
        if (empty($attrib['placeholder'])) {
            $attrib['placeholder'] = $this-&gt;app-&gt;gettext('searchplaceholder');
        }

        $label   = html::label(['for' =&gt; $attrib['id'], 'class' =&gt; 'voice'], rcube::Q($this-&gt;app-&gt;gettext('arialabelsearchterms')));
        $input_q = new html_inputfield($attrib);
        $out     = $label . $input_q-&gt;show();
        $name    = 'qsearchbox';

        // Support for multiple searchforms on the same page
        if (isset($attrib['gui-object']) &amp;&amp; $attrib['gui-object'] !== false &amp;&amp; $attrib['gui-object'] !== 'false') {
            $name = $attrib['gui-object'];
        }

        $this-&gt;add_gui_object($name, $attrib['id']);

        // add form tag around text field
        if (empty($attrib['form']) &amp;&amp; empty($attrib['no-form'])) {
            $out = $this-&gt;form_tag([
                    'name'     =&gt; !empty($attrib['form-name']) ? $attrib['form-name'] : 'rcmqsearchform',
                    'onsubmit' =&gt; sprintf(
                        &quot;%s.command('%s'); return false&quot;,
                        self::JS_OBJECT_NAME,
                        !empty($attrib['command']) ? $attrib['command'] : 'search'
                    ),
                    // 'style'    =&gt; &quot;display:inline&quot;
                ], $out);
        }

        if (!empty($attrib['wrapper'])) {
            $options_button = '';

            $ariatag = !empty($attrib['ariatag']) ? $attrib['ariatag'] : 'h2';
            $domain  = !empty($attrib['label-domain']) ? $attrib['label-domain'] : null;
            $options = !empty($attrib['options']) ? $attrib['options'] : null;

            $header_label = $this-&gt;app-&gt;gettext('arialabel' . $attrib['label'], $domain);
            $header_attrs = [
                'id'    =&gt; 'aria-label-' . $attrib['label'],
                'class' =&gt; 'voice'
            ];

            $header = html::tag($ariatag, $header_attrs, rcube::Q($header_label));

            if (!empty($attrib['options'])) {
                $options_button = $this-&gt;button([
                        'type'       =&gt; 'link',
                        'href'       =&gt; '#search-filter',
                        'class'      =&gt; 'button options',
                        'label'      =&gt; 'options',
                        'title'      =&gt; 'options',
                        'tabindex'   =&gt; '0',
                        'innerclass' =&gt; 'inner',
                        'data-target' =&gt; $options
                ]);
            }

            $search_button = $this-&gt;button([
                    'type'       =&gt; 'link',
                    'href'       =&gt; '#search',
                    'class'      =&gt; 'button search',
                    'label'      =&gt; $attrib['buttontitle'],
                    'title'      =&gt; $attrib['buttontitle'],
                    'tabindex'   =&gt; '0',
                    'innerclass' =&gt; 'inner',
            ]);

            $reset_button = $this-&gt;button([
                    'type'       =&gt; 'link',
                    'command'    =&gt; !empty($attrib['reset-command']) ? $attrib['reset-command'] : 'reset-search',
                    'class'      =&gt; 'button reset',
                    'label'      =&gt; 'resetsearch',
                    'title'      =&gt; 'resetsearch',
                    'tabindex'   =&gt; '0',
                    'innerclass' =&gt; 'inner',
            ]);

            $out = html::div([
                    'role'            =&gt; 'search',
                    'aria-labelledby' =&gt; !empty($attrib['label']) ? 'aria-label-' . $attrib['label'] : null,
                    'class'           =&gt; $attrib['wrapper'],
                ],
                &quot;$header$out\n$reset_button\n$options_button\n$search_button&quot;
            );
        }

        return $out;
    }

    /**
     * Builder for GUI object 'message'
     *
     * @param array $attrib Named tag parameters
     * @return string HTML code for the gui object
     */
    protected function message_container($attrib)
    {
        if (isset($attrib['id']) === false) {
            $attrib['id'] = 'rcmMessageContainer';
        }

        $this-&gt;add_gui_object('message', $attrib['id']);

        return html::div($attrib, '');
    }

    /**
     * GUI object 'charsetselector'
     *
     * @param array $attrib Named parameters for the select tag
     *
     * @return string HTML code for the gui object
     */
    public function charset_selector($attrib)
    {
        // pass the following attributes to the form class
        $field_attrib = ['name' =&gt; '_charset'];
        foreach ($attrib as $attr =&gt; $value) {
            if (in_array($attr, ['id', 'name', 'class', 'style', 'size', 'tabindex'])) {
                $field_attrib[$attr] = $value;
            }
        }

        $charsets = [
            'UTF-8'        =&gt; 'UTF-8 ('.$this-&gt;app-&gt;gettext('unicode').')',
            'US-ASCII'     =&gt; 'ASCII ('.$this-&gt;app-&gt;gettext('english').')',
            'ISO-8859-1'   =&gt; 'ISO-8859-1 ('.$this-&gt;app-&gt;gettext('westerneuropean').')',
            'ISO-8859-2'   =&gt; 'ISO-8859-2 ('.$this-&gt;app-&gt;gettext('easterneuropean').')',
            'ISO-8859-4'   =&gt; 'ISO-8859-4 ('.$this-&gt;app-&gt;gettext('baltic').')',
            'ISO-8859-5'   =&gt; 'ISO-8859-5 ('.$this-&gt;app-&gt;gettext('cyrillic').')',
            'ISO-8859-6'   =&gt; 'ISO-8859-6 ('.$this-&gt;app-&gt;gettext('arabic').')',
            'ISO-8859-7'   =&gt; 'ISO-8859-7 ('.$this-&gt;app-&gt;gettext('greek').')',
            'ISO-8859-8'   =&gt; 'ISO-8859-8 ('.$this-&gt;app-&gt;gettext('hebrew').')',
            'ISO-8859-9'   =&gt; 'ISO-8859-9 ('.$this-&gt;app-&gt;gettext('turkish').')',
            'ISO-8859-10'  =&gt; 'ISO-8859-10 ('.$this-&gt;app-&gt;gettext('nordic').')',
            'ISO-8859-11'  =&gt; 'ISO-8859-11 ('.$this-&gt;app-&gt;gettext('thai').')',
            'ISO-8859-13'  =&gt; 'ISO-8859-13 ('.$this-&gt;app-&gt;gettext('baltic').')',
            'ISO-8859-14'  =&gt; 'ISO-8859-14 ('.$this-&gt;app-&gt;gettext('celtic').')',
            'ISO-8859-15'  =&gt; 'ISO-8859-15 ('.$this-&gt;app-&gt;gettext('westerneuropean').')',
            'ISO-8859-16'  =&gt; 'ISO-8859-16 ('.$this-&gt;app-&gt;gettext('southeasterneuropean').')',
            'WINDOWS-1250' =&gt; 'Windows-1250 ('.$this-&gt;app-&gt;gettext('easterneuropean').')',
            'WINDOWS-1251' =&gt; 'Windows-1251 ('.$this-&gt;app-&gt;gettext('cyrillic').')',
            'WINDOWS-1252' =&gt; 'Windows-1252 ('.$this-&gt;app-&gt;gettext('westerneuropean').')',
            'WINDOWS-1253' =&gt; 'Windows-1253 ('.$this-&gt;app-&gt;gettext('greek').')',
            'WINDOWS-1254' =&gt; 'Windows-1254 ('.$this-&gt;app-&gt;gettext('turkish').')',
            'WINDOWS-1255' =&gt; 'Windows-1255 ('.$this-&gt;app-&gt;gettext('hebrew').')',
            'WINDOWS-1256' =&gt; 'Windows-1256 ('.$this-&gt;app-&gt;gettext('arabic').')',
            'WINDOWS-1257' =&gt; 'Windows-1257 ('.$this-&gt;app-&gt;gettext('baltic').')',
            'WINDOWS-1258' =&gt; 'Windows-1258 ('.$this-&gt;app-&gt;gettext('vietnamese').')',
            'ISO-2022-JP'  =&gt; 'ISO-2022-JP ('.$this-&gt;app-&gt;gettext('japanese').')',
            'ISO-2022-KR'  =&gt; 'ISO-2022-KR ('.$this-&gt;app-&gt;gettext('korean').')',
            'ISO-2022-CN'  =&gt; 'ISO-2022-CN ('.$this-&gt;app-&gt;gettext('chinese').')',
            'EUC-JP'       =&gt; 'EUC-JP ('.$this-&gt;app-&gt;gettext('japanese').')',
            'EUC-KR'       =&gt; 'EUC-KR ('.$this-&gt;app-&gt;gettext('korean').')',
            'EUC-CN'       =&gt; 'EUC-CN ('.$this-&gt;app-&gt;gettext('chinese').')',
            'BIG5'         =&gt; 'BIG5 ('.$this-&gt;app-&gt;gettext('chinese').')',
            'GB2312'       =&gt; 'GB2312 ('.$this-&gt;app-&gt;gettext('chinese').')',
            'KOI8-R'       =&gt; 'KOI8-R ('.$this-&gt;app-&gt;gettext('cyrillic').')',
        ];

        if ($post = rcube_utils::get_input_string('_charset', rcube_utils::INPUT_POST)) {
            $set = $post;
        }
        else if (!empty($attrib['selected'])) {
            $set = $attrib['selected'];
        }
        else {
            $set = $this-&gt;get_charset();
        }

        $set = strtoupper($set);
        if (!isset($charsets[$set]) &amp;&amp; preg_match('/^[A-Z0-9-]+$/', $set)) {
            $charsets[$set] = $set;
        }

        $select = new html_select($field_attrib);
        $select-&gt;add(array_values($charsets), array_keys($charsets));

        return $select-&gt;show($set);
    }

    /**
     * Include content from config/about.&lt;LANG&gt;.html if available
     */
    protected function about_content($attrib)
    {
        $content = '';
        $filenames = [
            'about.' . $_SESSION['language'] . '.html',
            'about.' . substr($_SESSION['language'], 0, 2) . '.html',
            'about.html',
        ];

        foreach ($filenames as $file) {
            $fn = RCUBE_CONFIG_DIR . $file;
            if (is_readable($fn)) {
                $content = file_get_contents($fn);
                $content = $this-&gt;parse_conditions($content);
                $content = $this-&gt;parse_xml($content);
                break;
            }
        }

        return $content;
    }

    /**
     * Get logo URL for current template based on skin_logo config option
     *
     * @param string $type   Type of the logo to check for (e.g. 'print' or 'small')
     *                       default is null (no special type)
     * @param string $match  (optional) 'all' = type, template or wildcard, 'template' = type or template
     *                       Note: when type is specified matches are limited to type only unless $match is defined
     *
     * @return string image URL
     */
    protected function get_template_logo($type = null, $match = null)
    {
        $template_logo = null;

        if ($logo = $this-&gt;config-&gt;get('skin_logo')) {
            if (is_array($logo)) {
                $template_names = [
                    $this-&gt;skin_name . ':' . $this-&gt;template_name . '[' . $type . ']',
                    $this-&gt;skin_name . ':' . $this-&gt;template_name,
                    $this-&gt;skin_name . ':*[' . $type . ']',
                    $this-&gt;skin_name . ':[' . $type . ']',
                    $this-&gt;skin_name . ':*',
                    '*:' . $this-&gt;template_name . '[' . $type . ']',
                    '*:' . $this-&gt;template_name,
                    '*:*[' . $type . ']',
                    '*:[' . $type . ']',
                    $this-&gt;template_name . '[' . $type . ']',
                    $this-&gt;template_name,
                    '*[' . $type . ']',
                    '[' . $type . ']',
                    '*',
                ];

                if (empty($type)) {
                    // If no type provided then remove those options from the list
                    $template_names = preg_grep(&quot;/\]$/&quot;, $template_names, PREG_GREP_INVERT);
                }
                elseif ($match === null) {
                    // Type specified with no special matching requirements so remove all none type specific options from the list
                    $template_names = preg_grep(&quot;/\]$/&quot;, $template_names);
                }

                if ($match == 'template') {
                    // Match only specific type or template name
                    $template_names = preg_grep(&quot;/\*$/&quot;, $template_names, PREG_GREP_INVERT);
                }

                foreach ($template_names as $key) {
                    if (isset($logo[$key])) {
                        $template_logo = $logo[$key];
                        break;
                    }
                }
            }
            else if ($type != 'link') {
                $template_logo = $logo;
            }
        }

        return $template_logo;
    }
}
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Fusr%2Flocal%2Fcpanel%2Fbase%2F3rdparty%2Froundcube%2Fprogram%2Finclude'>Back to Directory</a>