3 files changed, 52 insertions, 7 deletions

diff --git a/rfc2045/rfc2045.c b/rfc2045/rfc2045.c
index 40c2017..4e62e39 100644
--- a/rfc2045/rfc2045.c
+++ b/rfc2045/rfc2045.c
@@ -1,5 +1,5 @@
 /*
-** Copyright 1998 - 2004 Double Precision, Inc.  See COPYING for
+** Copyright 1998 - 2018 Double Precision, Inc.  See COPYING for
 ** distribution information.
 */
 
@@ -621,7 +621,7 @@ int	bit8=0;
 		*/
 
 		if (p->content_type &&
-			strcmp(p->content_type, "message/rfc822") == 0)
+		    rfc2045_message_content_type(p->content_type))
 		{
 			newp=append_part_noinherit(p, p->startbody);
 			newp->workinheader=1;
@@ -737,6 +737,36 @@ char	*p;
 	return (p);
 }
 
+/*
+** Whether this MIME content type is a nested MIME message.
+*/
+
+int rfc2045_message_content_type(const char *content_type)
+{
+	return strcmp(content_type, RFC2045_MIME_MESSAGE_RFC822) == 0 ||
+		strcmp(content_type, RFC2045_MIME_MESSAGE_GLOBAL) == 0;
+}
+
+/*
+** Whether this MIME content type is a delivery status notification.
+*/
+
+int rfc2045_delivery_status_content_type(const char *content_type)
+{
+	return strcmp(content_type,
+		      RFC2045_MIME_MESSAGE_DELIVERY_STATUS) == 0 ||
+		strcmp(content_type,
+		       RFC2045_MIME_MESSAGE_GLOBAL_DELIVERY_STATUS) == 0;
+}
+
+int rfc2045_message_headers_content_type(const char *content_type)
+{
+	return strcmp(content_type,
+		      RFC2045_MIME_MESSAGE_HEADERS) == 0 ||
+		strcmp(content_type,
+		       RFC2045_MIME_MESSAGE_GLOBAL_HEADERS) == 0;
+}
+
 /* Various permutations of the above, including forcing the string to
 ** lowercase
 */
diff --git a/rfc2045/rfc2045.h b/rfc2045/rfc2045.h
index 87773d9..4abdf2c 100644
--- a/rfc2045/rfc2045.h
+++ b/rfc2045/rfc2045.h
@@ -1,5 +1,5 @@
 /*
-** Copyright 1998 - 2011 Double Precision, Inc.  See COPYING for
+** Copyright 1998 - 2018 Double Precision, Inc.  See COPYING for
 ** distribution information.
 */
 
@@ -22,6 +22,20 @@ extern "C" {
 }
 #endif
 
+#define RFC2045_MIME_MESSAGE_RFC822 "message/rfc822"
+#define RFC2045_MIME_MESSAGE_GLOBAL "message/global"
+
+#define RFC2045_MIME_MESSAGE_DELIVERY_STATUS "message/delivery-status"
+#define RFC2045_MIME_MESSAGE_GLOBAL_DELIVERY_STATUS \
+	"message/global-delivery-status"
+
+#define RFC2045_MIME_MESSAGE_HEADERS "message/rfc822-headers"
+#define RFC2045_MIME_MESSAGE_GLOBAL_HEADERS "message/global-headers"
+
+int rfc2045_message_content_type(const char *);
+int rfc2045_delivery_status_content_type(const char *);
+int rfc2045_message_headers_content_type(const char *);
+
 #define	RFC2045_ISMIME1(p)	((p) && atoi(p) == 1)
 #define	RFC2045_ISMIME1DEF(p)	(!(p) || atoi(p) == 1)
 
diff --git a/sqwebmail/msg2html.c b/sqwebmail/msg2html.c
index 137cbae..a3025ae 100644
--- a/sqwebmail/msg2html.c
+++ b/sqwebmail/msg2html.c
@@ -1277,8 +1277,9 @@ off_t	dummy;
 
 		print_header_uc(info, header);
 		printf("<td><span class=\"message-rfc822-header-contents\">");
+
 		/* showmsgrfc822_addressheader(value); */
-		printf("%s", value);
+		html_escape(value, strlen(value));
 		printf("</span></td></tr>\n");
 		free(header);
 	}
@@ -2989,14 +2990,14 @@ const char	*content_type, *dummy;
 		return (0);
 
 	if (strcmp(content_type, "text/plain") == 0 ||
-	    strcmp(content_type, "text/rfc822-headers") == 0 ||
+	    rfc2045_message_headers_content_type(content_type) ||
 	    strcmp(content_type, "text/x-gpg-output") == 0)
 		return ( &showtextplain );
-	if (strcmp(content_type, "message/delivery-status") == 0)
+	if (rfc2045_delivery_status_content_type(content_type))
 		return ( &showdsn);
 	if (info->showhtml && strcmp(content_type, "text/html") == 0)
 		return ( &showtexthtml );
-	if (strcmp(content_type, "message/rfc822") == 0)
+	if (rfc2045_message_content_type(content_type))
 		return ( &showmsgrfc822);
 
 	return (0);