$id, 'uid' => $me['id']] ); if (!$msg) { http_response_code(404); exit('Message not found.'); } // ── POST handlers ─────────────────────────────────────────── if ($_SERVER['REQUEST_METHOD'] === 'POST') { csrf_verify(); $action = $_POST['action'] ?? ''; if ($action === 'whitelist_sender') { $sender = strtolower(trim((string)$msg['from_email'])); if ($sender) { $exists = db_row( 'SELECT id FROM email_sender_whitelist WHERE account_id=:a AND sender=:s', ['a' => $msg['account_id'], 's' => $sender] ); if (!$exists) { db_insert('email_sender_whitelist', [ 'account_id' => $msg['account_id'], 'sender' => $sender, 'note' => $msg['from_name'] ?: null, 'added_by' => $me['id'], ]); } } header('Location: email-message.php?id=' . $id); exit; } if ($action === 'mark_unseen') { db_exec('UPDATE email_messages SET is_seen=0 WHERE id=:id', ['id' => $id]); header('Location: email.php?account=' . (int)$msg['account_id']); exit; } if ($action === 'flag_toggle') { db_exec('UPDATE email_messages SET is_flagged = 1 - is_flagged WHERE id=:id', ['id' => $id]); header('Location: email-message.php?id=' . $id); exit; } } // Mark as seen on open (if not already) if (!$msg['is_seen']) { db_exec('UPDATE email_messages SET is_seen=1 WHERE id=:id', ['id' => $id]); $msg['is_seen'] = 1; } // Is the sender whitelisted? $is_whitelisted = false; if (!empty($msg['from_email'])) { $w = db_row( 'SELECT 1 FROM email_sender_whitelist WHERE account_id=:a AND sender=:s', ['a' => $msg['account_id'], 's' => strtolower($msg['from_email'])] ); $is_whitelisted = (bool)$w; } // Show images? Whitelist OR one-time ?show_images=1 OR explicit user override $show_images = $is_whitelisted || !empty($_GET['show_images']); // Body source $body_text = $msg['body_text']; $body_html = $msg['body_html']; $body_was_refetched = false; $refetch_error = ''; // Treat NULL and empty strings the same — "no body" $body_is_missing = (!is_string($body_text) || trim($body_text) === '') && (!is_string($body_html) || trim($body_html) === ''); // Diagnostic info — shown if ?debug=1 is in the URL $debug = !empty($_GET['debug']); $debug_info = []; $debug_info['initial body_text'] = $body_text === null ? 'NULL' : 'len=' . strlen((string)$body_text); $debug_info['initial body_html'] = $body_html === null ? 'NULL' : 'len=' . strlen((string)$body_html); $debug_info['body_evicted_at'] = $msg['body_evicted_at'] ?? 'NULL'; $debug_info['snippet'] = ($msg['snippet'] ?? '') === '' ? '(empty)' : 'len=' . strlen((string)$msg['snippet']); $debug_info['body_is_missing'] = $body_is_missing ? 'true' : 'false'; $debug_info['attachment_count'] = !empty($msg['has_attachments']) ? 'yes' : 'no'; if ($body_is_missing) { try { $acct_full = [ 'imap_host' => $msg['imap_host'], 'imap_port' => $msg['imap_port'], 'imap_encryption' => $msg['imap_encryption'], 'imap_username' => $msg['imap_username'], 'imap_password' => $msg['imap_password'], ]; $parts = email_fetch_body_on_demand($acct_full, $msg['folder'], (int)$msg['uid']); $body_text = $parts['text'] ?: null; $body_html = $parts['html'] ?: null; $body_was_refetched = true; $debug_info['refetch text'] = $body_text === null ? 'NULL' : 'len=' . strlen((string)$body_text); $debug_info['refetch html'] = $body_html === null ? 'NULL' : 'len=' . strlen((string)$body_html); $debug_info['refetch attachments'] = count($parts['attachments'] ?? []); // Save the recovered body back to the DB (only if not already evicted) if (empty($msg['body_evicted_at']) && ($body_text !== null || $body_html !== null)) { $update_set = []; $update_params = ['id' => $msg['id']]; if ($body_text !== null) { $update_set[] = 'body_text = :bt'; $update_params['bt'] = $body_text; } if ($body_html !== null) { $update_set[] = 'body_html = :bh'; $update_params['bh'] = $body_html; } try { db_exec("UPDATE email_messages SET " . implode(', ', $update_set) . " WHERE id = :id", $update_params); } catch (Throwable $_) { /* non-fatal */ } } } catch (Throwable $e) { $refetch_error = $e->getMessage(); $debug_info['refetch error'] = $e->getMessage(); } } // Render body $render_html = ''; $images_blocked = 0; if ($body_html !== null && $body_html !== '') { $r = email_sanitize_html($body_html, $show_images); $render_html = email_render_html($r['html']); $images_blocked = $r['images_blocked']; } elseif ($body_text !== null && $body_text !== '') { $render_html = email_render_plain($body_text); } // Attachments (metadata only — bytes fetched on download click) $attachments = !empty($msg['attachment_meta']) ? json_decode($msg['attachment_meta'], true) : []; if (!is_array($attachments)) $attachments = []; $page_title = 'Email · ' . ($msg['subject'] ?: '(no subject)'); require __DIR__ . '/_guard.php'; ?>
← Back to inbox

From:
<>
To:
Cc:
Date:
↩ Reply ↩↩ Reply all ↪ Forward
📥 This message body was fetched from IMAP just now (older than days). 📥 Body fetched from server — saved for next time.
⚠ Could not fetch message body:
0): ?>
🛡 remote image blocked for privacy. Show images this time
✓ Sender is on your whitelist — images shown.
🔧 DEBUG (remove ?debug=1 from URL to hide)
$v): ?> =

render_html length:
render_html (first 500 chars):

(This message has no readable body.)

📎 Attachments ()

$att): $size = (int)($att['size'] ?? 0); $size_disp = $size >= 1048576 ? round($size/1048576, 1) . ' MB' : ($size >= 1024 ? round($size/1024) . ' KB' : $size . ' B'); ?> 📄