Description:
------------
Some pages on http://news.php.net/ are vulnerable to XSS through special-crafted e-mail messages. A list of issues has been listen below.

article.php:
- (XSS) Unsanitized `Subject` header is inserted in the document title through `start_article()`
- (XSS) The filename and mimetypes of attachments are inserted directly through `echo`
- malformed HTML due to an invalid HTML href= attribute is possible because URL's are converted with htmlspecialchars($line,ENT_NOQUOTES).
- The `Date` header is passed directly to `strtotime`, which can lead to funny dates in the message, by using values like `yesterday` or `now` for example
- Possible denial of service on the news server because there is no limit set on the number of references
- (bug) mime headers are ignore
- (enh) do not quit if no connection could be made to the newsserver when looking for references
- (enh)
According to section 2.2.3 of RFC 2822 (Internet Message Format), a header may be split over multiple lines:
--quote--
   Each header field is logically a single line of characters comprising
   the field name, the colon, and the field body.  For convenience
   however, and to deal with the 998/78 character limitations per line,
   the field body portion of a header field can be split into a multiple
   line representation; this is called "folding".  The general rule is

   that wherever this standard allows for folding white space (not
   simply WSP characters), a CRLF may be inserted before any WSP.  For
   example, the header field:

           Subject: This is a test

   can be represented as:

           Subject: This
            is a test
--quote--
Currently, it's assumed that a new header field contains a colon (:), otherwise, it's a continuation of the previous header field.

common.inc:
- Function start_article() is defined here, the title is shown without escaping
- htmlspecialchars() is redundant when urlencode is called before

getpart.php:
- If the attachment contains malicious HTML code, it could steal php.net's cookies and make php.net possibly end up in malware databases
- (enh) see headers section in article.php
- (enh) clean up some unused variables and constructs

Test script:
---------------
First test:
http://news.php.net/php.test/879

Further posts:
http://news.php.net/php.test/880