This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | //------------------------------------------------------------------------- |
||
3 | // OVIDENTIA http://www.ovidentia.org |
||
4 | // Ovidentia is free software; you can redistribute it and/or modify |
||
5 | // it under the terms of the GNU General Public License as published by |
||
6 | // the Free Software Foundation; either version 2, or (at your option) |
||
7 | // any later version. |
||
8 | // |
||
9 | // This program is distributed in the hope that it will be useful, but |
||
10 | // WITHOUT ANY WARRANTY; without even the implied warranty of |
||
11 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||
12 | // See the GNU General Public License for more details. |
||
13 | // |
||
14 | // You should have received a copy of the GNU General Public License |
||
15 | // along with this program; if not, write to the Free Software |
||
16 | // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
||
17 | // USA. |
||
18 | //------------------------------------------------------------------------- |
||
19 | /** |
||
20 | * @license http://opensource.org/licenses/gpl-license.php GNU General Public License (GPL) |
||
21 | * @copyright Copyright (c) 2011 by CANTICO ({@link http://www.cantico.fr}) |
||
22 | */ |
||
23 | |||
24 | include_once dirname(__FILE__).'/functions.php'; |
||
25 | |||
26 | |||
27 | function absences_onDeleteAddon() |
||
28 | { |
||
29 | include_once $GLOBALS['babInstallPath'].'utilit/eventincl.php'; |
||
30 | require_once $GLOBALS['babInstallPath'].'utilit/functionalityincl.php'; |
||
31 | |||
32 | bab_removeAddonEventListeners('absences'); |
||
33 | |||
34 | $functionalities = new bab_functionalities(); |
||
35 | $functionalities->unregister('PortletBackend/Absences'); |
||
36 | $functionalities->unregister('AbsencesAgent'); |
||
37 | |||
38 | return true; |
||
39 | } |
||
40 | |||
41 | |||
42 | |||
43 | function absences_upgrade($version_base, $version_ini) |
||
44 | { |
||
45 | global $babDB; |
||
46 | |||
47 | include_once $GLOBALS['babInstallPath'].'utilit/eventincl.php'; |
||
48 | include_once $GLOBALS['babInstallPath'].'utilit/devtools.php'; |
||
49 | |||
50 | $addon = bab_getAddonInfosInstance('absences'); |
||
51 | |||
52 | |||
53 | bab_removeAddonEventListeners('absences'); |
||
54 | |||
55 | $addon->addEventListener('bab_eventUserDeleted' , 'absences_onUserDeleted' , 'events.php'); |
||
56 | $addon->addEventListener('bab_eventBeforeSiteMapCreated' , 'absences_onBeforeSiteMapCreated' , 'events.php'); |
||
57 | $addon->addEventListener('bab_eventUserModified' , 'absences_onUserModified' , 'events.php'); |
||
58 | $addon->addEventListener('bab_eventBeforeWaitingItemsDisplayed' , 'absences_onBeforeWaitingItemsDisplayed' , 'events.php'); |
||
59 | $addon->addEventListener('bab_eventConfirmMultipleWaitingItems' , 'absences_onConfirmMultipleWaitingItems' , 'events.php'); |
||
60 | $addon->addEventListener('bab_eventPeriodModified' , 'absences_onModifyPeriod' , 'events.php'); |
||
61 | $addon->addEventListener('bab_eventBeforePeriodsCreated' , 'absences_onBeforePeriodsCreated' , 'events.php'); |
||
62 | $addon->addEventListener('LibTimer_eventHourly' , 'absences_onHourly' , 'events.php'); |
||
63 | $addon->addEventListener('bab_eventAfterEventCategoryDeleted' , 'absences_onAfterEventCategoryDeleted' , 'events.php'); |
||
64 | $addon->addEventListener('bab_eventOrgChartEntityAfterDeleted' , 'absences_onOrgChartEntityAfterDeleted' , 'events.php'); |
||
65 | $addon->addEventListener('bab_eventDirectory' , 'absences_onDirectory' , 'events.php'); |
||
66 | |||
67 | |||
68 | |||
69 | $tables = new bab_synchronizeSql(dirname(__FILE__).'/sql/dump.sql'); |
||
70 | //var_dump($tables->getDifferences()); |
||
71 | |||
72 | if ($tables->isCreatedTable('absences_rights') && bab_isTable('bab_vac_managers')) |
||
73 | { |
||
74 | include_once dirname(__FILE__).'/olddata.php'; |
||
75 | |||
76 | absence_copy_table('bab_vac_managers' , ABSENCES_MANAGERS_TBL); |
||
77 | absence_copy_table('bab_vac_types' , ABSENCES_TYPES_TBL); |
||
78 | absence_copy_table('bab_vac_collections' , ABSENCES_COLLECTIONS_TBL); |
||
79 | absence_copy_table('bab_vac_coll_types' , ABSENCES_COLL_TYPES_TBL); |
||
80 | absence_copy_table('bab_vac_personnel' , ABSENCES_PERSONNEL_TBL); |
||
81 | absence_copy_table('bab_vac_rights' , ABSENCES_RIGHTS_TBL); |
||
82 | absence_copy_table('bab_vac_rights_rules' , ABSENCES_RIGHTS_RULES_TBL); |
||
83 | absence_copy_table('bab_vac_rights_inperiod', ABSENCES_RIGHTS_INPERIOD_TBL); |
||
84 | absence_copy_table('bab_vac_users_rights' , ABSENCES_USERS_RIGHTS_TBL); |
||
85 | absence_copy_table('bab_vac_entries' , ABSENCES_ENTRIES_TBL); |
||
86 | absence_copy_table('bab_vac_entries_elem' , ABSENCES_ENTRIES_ELEM_TBL); |
||
87 | absence_copy_table('bab_vac_planning' , ABSENCES_PLANNING_TBL); |
||
88 | absence_copy_table('bab_vac_options' , ABSENCES_OPTIONS_TBL); |
||
89 | absence_copy_table('bab_vac_calendar' , ABSENCES_CALENDAR_TBL); |
||
90 | absence_copy_table('bab_vac_rgroup' , ABSENCES_RGROUPS_TBL); |
||
91 | absence_copy_table('bab_vac_comanager' , ABSENCES_COMANAGER_TBL); |
||
92 | |||
93 | bab_installWindow::message(absences_translate('Import vacations data to addon... done.')); |
||
94 | } |
||
95 | |||
96 | |||
97 | // verifier les cles de la table absences_users_rights |
||
98 | |||
99 | if (bab_isKeyExists('absences_users_rights', 'id_user')) |
||
100 | { |
||
101 | $babDB->db_query('ALTER TABLE absences_users_rights DROP INDEX id_user'); |
||
102 | } |
||
103 | |||
104 | if (bab_isKeyExists('absences_users_rights', 'id_right')) |
||
105 | { |
||
106 | $babDB->db_query('ALTER TABLE absences_users_rights DROP INDEX id_right'); |
||
107 | } |
||
108 | |||
109 | if (!bab_isKeyExists('absences_users_rights', 'user_right')) |
||
110 | { |
||
111 | bab_installWindow::message(absences_translate('Error, the program was not able to create the unique key "user_right", duplicated entries in table absences_users_rights must be removed manually before continue')); |
||
112 | return false; |
||
113 | } |
||
114 | |||
115 | |||
116 | // fix the kind field if not set |
||
117 | |||
118 | $res = $babDB->db_query("SELECT id, kind, date_begin_fixed FROM absences_rights WHERE kind='0'"); |
||
119 | while ($arr = $babDB->db_fetch_assoc($res)) |
||
120 | { |
||
121 | View Code Duplication | if ($arr['date_begin_fixed'] !== '0000-00-00 00:00:00') |
|
122 | { |
||
123 | $babDB->db_query("UPDATE absences_rights SET kind='2' WHERE id=".$babDB->quote($arr['id'])); |
||
124 | } else { |
||
125 | $babDB->db_query("UPDATE absences_rights SET kind='1' WHERE id=".$babDB->quote($arr['id'])); |
||
126 | } |
||
127 | } |
||
128 | |||
129 | |||
130 | // mises a jour des demandes pour les droits a date fixe |
||
131 | |||
132 | $res = $babDB->db_query("SELECT e.id FROM |
||
133 | absences_entries e, |
||
134 | absences_entries_elem ee, |
||
135 | absences_rights r |
||
136 | WHERE |
||
137 | ee.id_entry=e.id |
||
138 | AND r.id=ee.id_right |
||
139 | AND r.kind='2' |
||
140 | GROUP BY e.id |
||
141 | "); |
||
142 | |||
143 | while ($arr = $babDB->db_fetch_assoc($res)) |
||
144 | { |
||
145 | $babDB->db_query("UPDATE absences_entries SET creation_type='1' WHERE id=".$babDB->quote($arr['id'])); |
||
146 | } |
||
147 | |||
148 | |||
149 | |||
150 | // correction des demandes n'ayant pas de date de creation |
||
151 | |||
152 | $res = $babDB->db_query("SELECT `id`, `date` FROM absences_entries WHERE createdOn='0000-00-00 00:00:00'"); |
||
153 | View Code Duplication | while ($arr = $babDB->db_fetch_assoc($res)) |
|
154 | { |
||
155 | $babDB->db_query("UPDATE absences_entries SET createdOn=".$babDB->quote($arr['date'])." WHERE id=".$babDB->quote($arr['id'])); |
||
156 | } |
||
157 | |||
158 | $typescount = 0; |
||
159 | $res = $babDB->db_query('SELECT COUNT(*) FROM '.$babDB->backTick('absences_types')); |
||
160 | if ($arr = $babDB->db_fetch_array($res)) |
||
161 | { |
||
162 | $typescount = (int) $arr[0]; |
||
163 | } |
||
164 | |||
165 | |||
166 | // default types |
||
167 | |||
168 | View Code Duplication | if (0 === $typescount) |
|
169 | { |
||
170 | bab_execSqlFile(dirname(__FILE__).'/sql/types.sql', 'UTF-8'); |
||
171 | bab_installWindow::message(absences_translate('Import vacations types... done.')); |
||
172 | } |
||
173 | |||
174 | |||
175 | |||
176 | $collectionscount = 0; |
||
177 | $res = $babDB->db_query('SELECT COUNT(*) FROM '.$babDB->backTick('absences_collections')); |
||
178 | if ($arr = $babDB->db_fetch_array($res)) |
||
179 | { |
||
180 | $collectionscount = (int) $arr[0]; |
||
181 | } |
||
182 | |||
183 | // default collections |
||
184 | |||
185 | View Code Duplication | if (0 === $collectionscount) |
|
186 | { |
||
187 | bab_execSqlFile(dirname(__FILE__).'/sql/collections.sql', 'UTF-8'); |
||
188 | bab_installWindow::message(absences_translate('Import collections... done.')); |
||
189 | } |
||
190 | |||
191 | |||
192 | |||
193 | // considerer toutes demandes anciennes deja notifiees, ne pas toucher aux demandes du jour pour si on notifie une fois par jour |
||
194 | |||
195 | $babDB->db_query("UPDATE absences_entries SET appr_notified='1' WHERE appr_notified='0' AND status='' AND createdOn<DATE_SUB(NOW(),INTERVAL 1 DAY)"); |
||
196 | |||
197 | |||
198 | |||
199 | // essayer de creer les liaisons droit-regimes a partir des liaisons types-regimes qui n'exisents plus dans l'application |
||
200 | // pour cela on a les liaisons utilisateur-droit, si tout les utilisateur d'un regime sont relie a un droit alors on peut crer la liaison regime-droit |
||
201 | // on effectue le test que si l'ancienne liaison regime-type-droit est presente |
||
202 | |||
203 | if ($tables->isCreatedTable('absences_coll_rights')) |
||
204 | { |
||
205 | |||
206 | $res = $babDB->db_query(' |
||
207 | SELECT |
||
208 | ct.id_coll, |
||
209 | r.id |
||
210 | FROM |
||
211 | absences_coll_types ct, |
||
212 | absences_rights r |
||
213 | WHERE |
||
214 | r.id_type=ct.id_type |
||
215 | |||
216 | '); |
||
217 | |||
218 | while ($link = $babDB->db_fetch_assoc($res)) |
||
219 | { |
||
220 | // chercher les membres du regime qui ne sont pas associes au droit |
||
221 | $res2 = $babDB->db_query('SELECT * FROM |
||
222 | absences_personnel p |
||
223 | LEFT JOIN absences_users_rights ur ON p.id_user=ur.id_user AND ur.id_right='.$babDB->quote($link['id']).' |
||
224 | WHERE |
||
225 | p.id_coll='.$babDB->quote($link['id_coll']).' |
||
226 | AND ur.id IS NULL |
||
227 | '); |
||
228 | |||
229 | View Code Duplication | if ($babDB->db_num_rows($res2) == 0) |
|
230 | { |
||
231 | $babDB->db_query('INSERT INTO absences_coll_rights (id_coll, id_right) VALUES ('.$babDB->quote($link['id_coll']).','.$babDB->quote($link['id']).')'); |
||
232 | } |
||
233 | } |
||
234 | } |
||
235 | |||
236 | |||
237 | |||
238 | |||
239 | if ($tables->isCreatedTable('absences_public_planning_groups')) { |
||
240 | // dans les version precedente, le planing public etait active par checkbox |
||
241 | $res = $babDB->db_query('SELECT public_calendar FROM absences_options'); |
||
242 | if ($arr = $babDB->db_fetch_assoc($res)) { |
||
243 | if ($arr['public_calendar']) { |
||
244 | require_once $GLOBALS['babInstallPath'].'admin/acl.php'; |
||
245 | aclSetGroups_all('absences_public_planning_groups', 1); |
||
246 | } |
||
247 | } |
||
248 | } |
||
249 | |||
250 | |||
251 | // add missing UUID |
||
252 | |||
253 | require_once $GLOBALS['babInstallPath'].'utilit/uuid.php'; |
||
254 | $res = $babDB->db_query("SELECT id FROM absences_rights WHERE uuid=''"); |
||
255 | View Code Duplication | while ($arr = $babDB->db_fetch_assoc($res)) |
|
256 | { |
||
257 | $babDB->db_query('UPDATE absences_rights SET uuid='.$babDB->quote(bab_uuid()).' WHERE id='.$babDB->quote($arr['id'])); |
||
258 | } |
||
259 | |||
260 | $res = $babDB->db_query("SELECT id FROM absences_rights_inperiod WHERE uuid=''"); |
||
261 | View Code Duplication | while ($arr = $babDB->db_fetch_assoc($res)) |
|
262 | { |
||
263 | $babDB->db_query('UPDATE absences_rights_inperiod SET uuid='.$babDB->quote(bab_uuid()).' WHERE id='.$babDB->quote($arr['id'])); |
||
264 | } |
||
265 | |||
266 | |||
267 | // reprise des gestionnaires en tant que groupe avec ACL, faire la reprise si la table absences_options contient des lignes |
||
268 | |||
269 | $res = $babDB->db_query("SELECT * FROM absences_managers"); |
||
270 | if ($babDB->db_num_rows($res) > 0) |
||
271 | { |
||
272 | require_once $GLOBALS['babInstallPath'].'admin/acl.php'; |
||
273 | |||
274 | $users = aclGetAccessUsers('absences_managers_groups', 1); |
||
275 | if (0 === count($users)) |
||
276 | { |
||
277 | $groupname = absences_translate('Vacations managers'); |
||
278 | $i = 1; |
||
279 | |||
280 | $rootgroups = bab_getGroups(BAB_REGISTERED_GROUP, false); |
||
281 | $names = array_flip($rootgroups['name']); |
||
282 | |||
283 | while(isset($names[$groupname])) { |
||
284 | $groupname .= ' '.$i; |
||
285 | $i++; |
||
286 | } |
||
287 | |||
288 | $id_group = bab_createGroup($groupname, absences_translate('Created automatically while upgrading to the new absences addon'), 0); |
||
289 | |||
290 | while ($arr = $babDB->db_fetch_assoc($res)) |
||
291 | { |
||
292 | bab_addUserToGroup($arr['id_user'], $id_group); |
||
293 | } |
||
294 | |||
295 | |||
296 | aclAdd('absences_managers_groups', $id_group, 1); |
||
297 | |||
298 | $babDB->db_query('TRUNCATE absences_managers'); |
||
299 | } |
||
300 | } |
||
301 | |||
302 | |||
303 | // selection de l'organigramme par defaut |
||
304 | require_once $GLOBALS['babInstallPath'].'utilit/ocapi.php'; |
||
305 | if ($idprimaryoc = bab_OCgetPrimaryOcId()) |
||
306 | { |
||
307 | $babDB->db_query('UPDATE absences_options SET id_chart='.$babDB->quote($idprimaryoc)." WHERE id_chart='0'"); |
||
308 | } |
||
309 | |||
310 | |||
311 | |||
312 | // reprise des dates lors de l'ajout des dates dans la table absences_entries_elem |
||
313 | require_once dirname(__FILE__).'/upgrade/entry_elem.php'; |
||
314 | absences_upgradeEntryElemDates::onUpgrade(); |
||
315 | |||
316 | |||
317 | $addon = bab_getAddonInfosInstance('absences'); |
||
318 | bab_functionality::includefile('PortletBackend'); |
||
0 ignored issues
–
show
|
|||
319 | |||
320 | if (class_exists('Func_PortletBackend')) { |
||
321 | $addon->registerFunctionality('PortletBackend/Absences', 'portletbackend.class.php'); |
||
322 | } |
||
323 | $addon->registerFunctionality('AbsencesAgent', 'utilit/agent.api.php'); |
||
324 | $addon->registerFunctionality('AbsencesRequest', 'utilit/request.api.php'); |
||
325 | |||
326 | |||
327 | |||
328 | |||
329 | |||
330 | // T8341 Reprise des droits de recuperation creer avec une date de fin= a la date de debut |
||
331 | |||
332 | $babDB->db_query("UPDATE absences_rights_inperiod SET period_end=DATE_ADD(period_end,INTERVAL 1 YEAR) |
||
333 | WHERE period_start = period_end AND id_right IN( |
||
334 | SELECT id FROM absences_rights WHERE kind='16')"); |
||
335 | $babDB->db_query("UPDATE absences_rights SET date_end=DATE_ADD(date_end,INTERVAL 1 YEAR) |
||
336 | WHERE kind='16' AND date_begin=date_end"); |
||
337 | |||
338 | |||
339 | // reprise des declaration de jours travaille approuvees par auto-approbation sans droit cree |
||
340 | // avant la version 2.67 id_right n'existait pas |
||
341 | // Utiliser ce code seulement si il y a des droit a recuperation manquant, il peut etre dangereux si le format du nom du droit change |
||
342 | // la method restoreMissingRight cree le droit manquant ou cree la liaison manquante |
||
343 | |||
344 | /* |
||
345 | $res = $babDB->db_query("SELECT * FROM absences_workperiod_recover_request WHERE id_right='0' AND status='Y' AND modifiedOn>'2015-05-30 00:00:00'"); |
||
346 | require_once dirname(__FILE__).'/utilit/workperiod_recover_request.class.php'; |
||
347 | while ($arr = $babDB->db_fetch_assoc($res)) { |
||
348 | $request = new absences_WorkperiodRecoverRequest(); |
||
349 | $request->setRow($arr); |
||
350 | $request->restoreMissingRight(); |
||
351 | } |
||
352 | */ |
||
353 | |||
354 | |||
355 | |||
356 | |||
357 | $babDB->db_query("UPDATE absences_cet_deposit_request SET firstconfirm='1' WHERE status='Y'"); |
||
358 | $babDB->db_query("UPDATE absences_workperiod_recover_request SET firstconfirm='1' WHERE status='Y'"); |
||
359 | $babDB->db_query("UPDATE absences_entries SET firstconfirm='1' WHERE status='Y'"); |
||
360 | |||
361 | |||
362 | // T9250 Export des soldes a une date donnee |
||
363 | |||
364 | $babDB->db_query("UPDATE absences_rights SET createdOn=date_entry WHERE createdOn='0000-00-00 00:00:00'"); |
||
365 | |||
366 | |||
367 | |||
368 | // verification de l'historique des status |
||
369 | |||
370 | absences_fixRequestLastMovement('absences_entries', 'absences_Entry'); |
||
371 | absences_fixRequestLastMovement('absences_workperiod_recover_request', 'absences_WorkperiodRecoverRequest'); |
||
372 | absences_fixRequestLastMovement('absences_cet_deposit_request', 'absences_CetDepositRequest'); |
||
373 | |||
374 | absences_deleteAgentsWithNoUser(); |
||
375 | absence_rePrimary(); |
||
376 | |||
377 | return true; |
||
378 | } |
||
379 |
Let’s take a look at an example:
In the above example, the authenticate() method works fine as long as you just pass instances of MyUser. However, if you now also want to pass a different sub-classes of User which does not have a getDisplayName() method, the code will break.
Available Fixes
Change the type-hint for the parameter:
Add an additional type-check:
Add the method to the parent class: