This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | //------------------------------------------------------------------------- |
||
| 3 | // OVIDENTIA http://www.ovidentia.org |
||
| 4 | // Ovidentia is free software; you can redistribute it and/or modify |
||
| 5 | // it under the terms of the GNU General Public License as published by |
||
| 6 | // the Free Software Foundation; either version 2, or (at your option) |
||
| 7 | // any later version. |
||
| 8 | // |
||
| 9 | // This program is distributed in the hope that it will be useful, but |
||
| 10 | // WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 11 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||
| 12 | // See the GNU General Public License for more details. |
||
| 13 | // |
||
| 14 | // You should have received a copy of the GNU General Public License |
||
| 15 | // along with this program; if not, write to the Free Software |
||
| 16 | // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
||
| 17 | // USA. |
||
| 18 | //------------------------------------------------------------------------- |
||
| 19 | /** |
||
| 20 | * @license http://opensource.org/licenses/gpl-license.php GNU General Public License (GPL) |
||
| 21 | * @copyright Copyright (c) 2011 by CANTICO ({@link http://www.cantico.fr}) |
||
| 22 | */ |
||
| 23 | |||
| 24 | include_once dirname(__FILE__).'/functions.php'; |
||
| 25 | |||
| 26 | |||
| 27 | function absences_onDeleteAddon() |
||
| 28 | { |
||
| 29 | include_once $GLOBALS['babInstallPath'].'utilit/eventincl.php'; |
||
| 30 | require_once $GLOBALS['babInstallPath'].'utilit/functionalityincl.php'; |
||
| 31 | |||
| 32 | bab_removeAddonEventListeners('absences'); |
||
| 33 | |||
| 34 | $functionalities = new bab_functionalities(); |
||
| 35 | $functionalities->unregister('PortletBackend/Absences'); |
||
| 36 | $functionalities->unregister('AbsencesAgent'); |
||
| 37 | |||
| 38 | return true; |
||
| 39 | } |
||
| 40 | |||
| 41 | |||
| 42 | |||
| 43 | function absences_upgrade($version_base, $version_ini) |
||
| 44 | { |
||
| 45 | global $babDB; |
||
| 46 | |||
| 47 | include_once $GLOBALS['babInstallPath'].'utilit/eventincl.php'; |
||
| 48 | include_once $GLOBALS['babInstallPath'].'utilit/devtools.php'; |
||
| 49 | |||
| 50 | $addon = bab_getAddonInfosInstance('absences'); |
||
| 51 | |||
| 52 | |||
| 53 | bab_removeAddonEventListeners('absences'); |
||
| 54 | |||
| 55 | $addon->addEventListener('bab_eventUserDeleted' , 'absences_onUserDeleted' , 'events.php'); |
||
| 56 | $addon->addEventListener('bab_eventBeforeSiteMapCreated' , 'absences_onBeforeSiteMapCreated' , 'events.php'); |
||
| 57 | $addon->addEventListener('bab_eventUserModified' , 'absences_onUserModified' , 'events.php'); |
||
| 58 | $addon->addEventListener('bab_eventBeforeWaitingItemsDisplayed' , 'absences_onBeforeWaitingItemsDisplayed' , 'events.php'); |
||
| 59 | $addon->addEventListener('bab_eventConfirmMultipleWaitingItems' , 'absences_onConfirmMultipleWaitingItems' , 'events.php'); |
||
| 60 | $addon->addEventListener('bab_eventPeriodModified' , 'absences_onModifyPeriod' , 'events.php'); |
||
| 61 | $addon->addEventListener('bab_eventBeforePeriodsCreated' , 'absences_onBeforePeriodsCreated' , 'events.php'); |
||
| 62 | $addon->addEventListener('LibTimer_eventHourly' , 'absences_onHourly' , 'events.php'); |
||
| 63 | $addon->addEventListener('bab_eventAfterEventCategoryDeleted' , 'absences_onAfterEventCategoryDeleted' , 'events.php'); |
||
| 64 | $addon->addEventListener('bab_eventOrgChartEntityAfterDeleted' , 'absences_onOrgChartEntityAfterDeleted' , 'events.php'); |
||
| 65 | $addon->addEventListener('bab_eventDirectory' , 'absences_onDirectory' , 'events.php'); |
||
| 66 | |||
| 67 | |||
| 68 | |||
| 69 | $tables = new bab_synchronizeSql(dirname(__FILE__).'/sql/dump.sql'); |
||
| 70 | //var_dump($tables->getDifferences()); |
||
| 71 | |||
| 72 | if ($tables->isCreatedTable('absences_rights') && bab_isTable('bab_vac_managers')) |
||
| 73 | { |
||
| 74 | include_once dirname(__FILE__).'/olddata.php'; |
||
| 75 | |||
| 76 | absence_copy_table('bab_vac_managers' , ABSENCES_MANAGERS_TBL); |
||
| 77 | absence_copy_table('bab_vac_types' , ABSENCES_TYPES_TBL); |
||
| 78 | absence_copy_table('bab_vac_collections' , ABSENCES_COLLECTIONS_TBL); |
||
| 79 | absence_copy_table('bab_vac_coll_types' , ABSENCES_COLL_TYPES_TBL); |
||
| 80 | absence_copy_table('bab_vac_personnel' , ABSENCES_PERSONNEL_TBL); |
||
| 81 | absence_copy_table('bab_vac_rights' , ABSENCES_RIGHTS_TBL); |
||
| 82 | absence_copy_table('bab_vac_rights_rules' , ABSENCES_RIGHTS_RULES_TBL); |
||
| 83 | absence_copy_table('bab_vac_rights_inperiod', ABSENCES_RIGHTS_INPERIOD_TBL); |
||
| 84 | absence_copy_table('bab_vac_users_rights' , ABSENCES_USERS_RIGHTS_TBL); |
||
| 85 | absence_copy_table('bab_vac_entries' , ABSENCES_ENTRIES_TBL); |
||
| 86 | absence_copy_table('bab_vac_entries_elem' , ABSENCES_ENTRIES_ELEM_TBL); |
||
| 87 | absence_copy_table('bab_vac_planning' , ABSENCES_PLANNING_TBL); |
||
| 88 | absence_copy_table('bab_vac_options' , ABSENCES_OPTIONS_TBL); |
||
| 89 | absence_copy_table('bab_vac_calendar' , ABSENCES_CALENDAR_TBL); |
||
| 90 | absence_copy_table('bab_vac_rgroup' , ABSENCES_RGROUPS_TBL); |
||
| 91 | absence_copy_table('bab_vac_comanager' , ABSENCES_COMANAGER_TBL); |
||
| 92 | |||
| 93 | bab_installWindow::message(absences_translate('Import vacations data to addon... done.')); |
||
| 94 | } |
||
| 95 | |||
| 96 | |||
| 97 | // verifier les cles de la table absences_users_rights |
||
| 98 | |||
| 99 | if (bab_isKeyExists('absences_users_rights', 'id_user')) |
||
| 100 | { |
||
| 101 | $babDB->db_query('ALTER TABLE absences_users_rights DROP INDEX id_user'); |
||
| 102 | } |
||
| 103 | |||
| 104 | if (bab_isKeyExists('absences_users_rights', 'id_right')) |
||
| 105 | { |
||
| 106 | $babDB->db_query('ALTER TABLE absences_users_rights DROP INDEX id_right'); |
||
| 107 | } |
||
| 108 | |||
| 109 | if (!bab_isKeyExists('absences_users_rights', 'user_right')) |
||
| 110 | { |
||
| 111 | bab_installWindow::message(absences_translate('Error, the program was not able to create the unique key "user_right", duplicated entries in table absences_users_rights must be removed manually before continue')); |
||
| 112 | return false; |
||
| 113 | } |
||
| 114 | |||
| 115 | |||
| 116 | // fix the kind field if not set |
||
| 117 | |||
| 118 | $res = $babDB->db_query("SELECT id, kind, date_begin_fixed FROM absences_rights WHERE kind='0'"); |
||
| 119 | while ($arr = $babDB->db_fetch_assoc($res)) |
||
| 120 | { |
||
| 121 | View Code Duplication | if ($arr['date_begin_fixed'] !== '0000-00-00 00:00:00') |
|
| 122 | { |
||
| 123 | $babDB->db_query("UPDATE absences_rights SET kind='2' WHERE id=".$babDB->quote($arr['id'])); |
||
| 124 | } else { |
||
| 125 | $babDB->db_query("UPDATE absences_rights SET kind='1' WHERE id=".$babDB->quote($arr['id'])); |
||
| 126 | } |
||
| 127 | } |
||
| 128 | |||
| 129 | |||
| 130 | // mises a jour des demandes pour les droits a date fixe |
||
| 131 | |||
| 132 | $res = $babDB->db_query("SELECT e.id FROM |
||
| 133 | absences_entries e, |
||
| 134 | absences_entries_elem ee, |
||
| 135 | absences_rights r |
||
| 136 | WHERE |
||
| 137 | ee.id_entry=e.id |
||
| 138 | AND r.id=ee.id_right |
||
| 139 | AND r.kind='2' |
||
| 140 | GROUP BY e.id |
||
| 141 | "); |
||
| 142 | |||
| 143 | while ($arr = $babDB->db_fetch_assoc($res)) |
||
| 144 | { |
||
| 145 | $babDB->db_query("UPDATE absences_entries SET creation_type='1' WHERE id=".$babDB->quote($arr['id'])); |
||
| 146 | } |
||
| 147 | |||
| 148 | |||
| 149 | |||
| 150 | // correction des demandes n'ayant pas de date de creation |
||
| 151 | |||
| 152 | $res = $babDB->db_query("SELECT `id`, `date` FROM absences_entries WHERE createdOn='0000-00-00 00:00:00'"); |
||
| 153 | View Code Duplication | while ($arr = $babDB->db_fetch_assoc($res)) |
|
| 154 | { |
||
| 155 | $babDB->db_query("UPDATE absences_entries SET createdOn=".$babDB->quote($arr['date'])." WHERE id=".$babDB->quote($arr['id'])); |
||
| 156 | } |
||
| 157 | |||
| 158 | $typescount = 0; |
||
| 159 | $res = $babDB->db_query('SELECT COUNT(*) FROM '.$babDB->backTick('absences_types')); |
||
| 160 | if ($arr = $babDB->db_fetch_array($res)) |
||
| 161 | { |
||
| 162 | $typescount = (int) $arr[0]; |
||
| 163 | } |
||
| 164 | |||
| 165 | |||
| 166 | // default types |
||
| 167 | |||
| 168 | View Code Duplication | if (0 === $typescount) |
|
| 169 | { |
||
| 170 | bab_execSqlFile(dirname(__FILE__).'/sql/types.sql', 'UTF-8'); |
||
| 171 | bab_installWindow::message(absences_translate('Import vacations types... done.')); |
||
| 172 | } |
||
| 173 | |||
| 174 | |||
| 175 | |||
| 176 | $collectionscount = 0; |
||
| 177 | $res = $babDB->db_query('SELECT COUNT(*) FROM '.$babDB->backTick('absences_collections')); |
||
| 178 | if ($arr = $babDB->db_fetch_array($res)) |
||
| 179 | { |
||
| 180 | $collectionscount = (int) $arr[0]; |
||
| 181 | } |
||
| 182 | |||
| 183 | // default collections |
||
| 184 | |||
| 185 | View Code Duplication | if (0 === $collectionscount) |
|
| 186 | { |
||
| 187 | bab_execSqlFile(dirname(__FILE__).'/sql/collections.sql', 'UTF-8'); |
||
| 188 | bab_installWindow::message(absences_translate('Import collections... done.')); |
||
| 189 | } |
||
| 190 | |||
| 191 | |||
| 192 | |||
| 193 | // considerer toutes demandes anciennes deja notifiees, ne pas toucher aux demandes du jour pour si on notifie une fois par jour |
||
| 194 | |||
| 195 | $babDB->db_query("UPDATE absences_entries SET appr_notified='1' WHERE appr_notified='0' AND status='' AND createdOn<DATE_SUB(NOW(),INTERVAL 1 DAY)"); |
||
| 196 | |||
| 197 | |||
| 198 | |||
| 199 | // essayer de creer les liaisons droit-regimes a partir des liaisons types-regimes qui n'exisents plus dans l'application |
||
| 200 | // pour cela on a les liaisons utilisateur-droit, si tout les utilisateur d'un regime sont relie a un droit alors on peut crer la liaison regime-droit |
||
| 201 | // on effectue le test que si l'ancienne liaison regime-type-droit est presente |
||
| 202 | |||
| 203 | if ($tables->isCreatedTable('absences_coll_rights')) |
||
| 204 | { |
||
| 205 | |||
| 206 | $res = $babDB->db_query(' |
||
| 207 | SELECT |
||
| 208 | ct.id_coll, |
||
| 209 | r.id |
||
| 210 | FROM |
||
| 211 | absences_coll_types ct, |
||
| 212 | absences_rights r |
||
| 213 | WHERE |
||
| 214 | r.id_type=ct.id_type |
||
| 215 | |||
| 216 | '); |
||
| 217 | |||
| 218 | while ($link = $babDB->db_fetch_assoc($res)) |
||
| 219 | { |
||
| 220 | // chercher les membres du regime qui ne sont pas associes au droit |
||
| 221 | $res2 = $babDB->db_query('SELECT * FROM |
||
| 222 | absences_personnel p |
||
| 223 | LEFT JOIN absences_users_rights ur ON p.id_user=ur.id_user AND ur.id_right='.$babDB->quote($link['id']).' |
||
| 224 | WHERE |
||
| 225 | p.id_coll='.$babDB->quote($link['id_coll']).' |
||
| 226 | AND ur.id IS NULL |
||
| 227 | '); |
||
| 228 | |||
| 229 | View Code Duplication | if ($babDB->db_num_rows($res2) == 0) |
|
| 230 | { |
||
| 231 | $babDB->db_query('INSERT INTO absences_coll_rights (id_coll, id_right) VALUES ('.$babDB->quote($link['id_coll']).','.$babDB->quote($link['id']).')'); |
||
| 232 | } |
||
| 233 | } |
||
| 234 | } |
||
| 235 | |||
| 236 | |||
| 237 | |||
| 238 | |||
| 239 | if ($tables->isCreatedTable('absences_public_planning_groups')) { |
||
| 240 | // dans les version precedente, le planing public etait active par checkbox |
||
| 241 | $res = $babDB->db_query('SELECT public_calendar FROM absences_options'); |
||
| 242 | if ($arr = $babDB->db_fetch_assoc($res)) { |
||
| 243 | if ($arr['public_calendar']) { |
||
| 244 | require_once $GLOBALS['babInstallPath'].'admin/acl.php'; |
||
| 245 | aclSetGroups_all('absences_public_planning_groups', 1); |
||
| 246 | } |
||
| 247 | } |
||
| 248 | } |
||
| 249 | |||
| 250 | |||
| 251 | // add missing UUID |
||
| 252 | |||
| 253 | require_once $GLOBALS['babInstallPath'].'utilit/uuid.php'; |
||
| 254 | $res = $babDB->db_query("SELECT id FROM absences_rights WHERE uuid=''"); |
||
| 255 | View Code Duplication | while ($arr = $babDB->db_fetch_assoc($res)) |
|
| 256 | { |
||
| 257 | $babDB->db_query('UPDATE absences_rights SET uuid='.$babDB->quote(bab_uuid()).' WHERE id='.$babDB->quote($arr['id'])); |
||
| 258 | } |
||
| 259 | |||
| 260 | $res = $babDB->db_query("SELECT id FROM absences_rights_inperiod WHERE uuid=''"); |
||
| 261 | View Code Duplication | while ($arr = $babDB->db_fetch_assoc($res)) |
|
| 262 | { |
||
| 263 | $babDB->db_query('UPDATE absences_rights_inperiod SET uuid='.$babDB->quote(bab_uuid()).' WHERE id='.$babDB->quote($arr['id'])); |
||
| 264 | } |
||
| 265 | |||
| 266 | |||
| 267 | // reprise des gestionnaires en tant que groupe avec ACL, faire la reprise si la table absences_options contient des lignes |
||
| 268 | |||
| 269 | $res = $babDB->db_query("SELECT * FROM absences_managers"); |
||
| 270 | if ($babDB->db_num_rows($res) > 0) |
||
| 271 | { |
||
| 272 | require_once $GLOBALS['babInstallPath'].'admin/acl.php'; |
||
| 273 | |||
| 274 | $users = aclGetAccessUsers('absences_managers_groups', 1); |
||
| 275 | if (0 === count($users)) |
||
| 276 | { |
||
| 277 | $groupname = absences_translate('Vacations managers'); |
||
| 278 | $i = 1; |
||
| 279 | |||
| 280 | $rootgroups = bab_getGroups(BAB_REGISTERED_GROUP, false); |
||
| 281 | $names = array_flip($rootgroups['name']); |
||
| 282 | |||
| 283 | while(isset($names[$groupname])) { |
||
| 284 | $groupname .= ' '.$i; |
||
| 285 | $i++; |
||
| 286 | } |
||
| 287 | |||
| 288 | $id_group = bab_createGroup($groupname, absences_translate('Created automatically while upgrading to the new absences addon'), 0); |
||
| 289 | |||
| 290 | while ($arr = $babDB->db_fetch_assoc($res)) |
||
| 291 | { |
||
| 292 | bab_addUserToGroup($arr['id_user'], $id_group); |
||
| 293 | } |
||
| 294 | |||
| 295 | |||
| 296 | aclAdd('absences_managers_groups', $id_group, 1); |
||
| 297 | |||
| 298 | $babDB->db_query('TRUNCATE absences_managers'); |
||
| 299 | } |
||
| 300 | } |
||
| 301 | |||
| 302 | |||
| 303 | // selection de l'organigramme par defaut |
||
| 304 | require_once $GLOBALS['babInstallPath'].'utilit/ocapi.php'; |
||
| 305 | if ($idprimaryoc = bab_OCgetPrimaryOcId()) |
||
| 306 | { |
||
| 307 | $babDB->db_query('UPDATE absences_options SET id_chart='.$babDB->quote($idprimaryoc)." WHERE id_chart='0'"); |
||
| 308 | } |
||
| 309 | |||
| 310 | |||
| 311 | |||
| 312 | // reprise des dates lors de l'ajout des dates dans la table absences_entries_elem |
||
| 313 | require_once dirname(__FILE__).'/upgrade/entry_elem.php'; |
||
| 314 | absences_upgradeEntryElemDates::onUpgrade(); |
||
| 315 | |||
| 316 | |||
| 317 | $addon = bab_getAddonInfosInstance('absences'); |
||
| 318 | bab_functionality::includefile('PortletBackend'); |
||
|
0 ignored issues
–
show
|
|||
| 319 | |||
| 320 | if (class_exists('Func_PortletBackend')) { |
||
| 321 | $addon->registerFunctionality('PortletBackend/Absences', 'portletbackend.class.php'); |
||
| 322 | } |
||
| 323 | $addon->registerFunctionality('AbsencesAgent', 'utilit/agent.api.php'); |
||
| 324 | $addon->registerFunctionality('AbsencesRequest', 'utilit/request.api.php'); |
||
| 325 | |||
| 326 | |||
| 327 | |||
| 328 | |||
| 329 | |||
| 330 | // T8341 Reprise des droits de recuperation creer avec une date de fin= a la date de debut |
||
| 331 | |||
| 332 | $babDB->db_query("UPDATE absences_rights_inperiod SET period_end=DATE_ADD(period_end,INTERVAL 1 YEAR) |
||
| 333 | WHERE period_start = period_end AND id_right IN( |
||
| 334 | SELECT id FROM absences_rights WHERE kind='16')"); |
||
| 335 | $babDB->db_query("UPDATE absences_rights SET date_end=DATE_ADD(date_end,INTERVAL 1 YEAR) |
||
| 336 | WHERE kind='16' AND date_begin=date_end"); |
||
| 337 | |||
| 338 | |||
| 339 | // reprise des declaration de jours travaille approuvees par auto-approbation sans droit cree |
||
| 340 | // avant la version 2.67 id_right n'existait pas |
||
| 341 | // Utiliser ce code seulement si il y a des droit a recuperation manquant, il peut etre dangereux si le format du nom du droit change |
||
| 342 | // la method restoreMissingRight cree le droit manquant ou cree la liaison manquante |
||
| 343 | |||
| 344 | /* |
||
| 345 | $res = $babDB->db_query("SELECT * FROM absences_workperiod_recover_request WHERE id_right='0' AND status='Y' AND modifiedOn>'2015-05-30 00:00:00'"); |
||
| 346 | require_once dirname(__FILE__).'/utilit/workperiod_recover_request.class.php'; |
||
| 347 | while ($arr = $babDB->db_fetch_assoc($res)) { |
||
| 348 | $request = new absences_WorkperiodRecoverRequest(); |
||
| 349 | $request->setRow($arr); |
||
| 350 | $request->restoreMissingRight(); |
||
| 351 | } |
||
| 352 | */ |
||
| 353 | |||
| 354 | |||
| 355 | |||
| 356 | |||
| 357 | $babDB->db_query("UPDATE absences_cet_deposit_request SET firstconfirm='1' WHERE status='Y'"); |
||
| 358 | $babDB->db_query("UPDATE absences_workperiod_recover_request SET firstconfirm='1' WHERE status='Y'"); |
||
| 359 | $babDB->db_query("UPDATE absences_entries SET firstconfirm='1' WHERE status='Y'"); |
||
| 360 | |||
| 361 | |||
| 362 | // T9250 Export des soldes a une date donnee |
||
| 363 | |||
| 364 | $babDB->db_query("UPDATE absences_rights SET createdOn=date_entry WHERE createdOn='0000-00-00 00:00:00'"); |
||
| 365 | |||
| 366 | |||
| 367 | |||
| 368 | // verification de l'historique des status |
||
| 369 | |||
| 370 | absences_fixRequestLastMovement('absences_entries', 'absences_Entry'); |
||
| 371 | absences_fixRequestLastMovement('absences_workperiod_recover_request', 'absences_WorkperiodRecoverRequest'); |
||
| 372 | absences_fixRequestLastMovement('absences_cet_deposit_request', 'absences_CetDepositRequest'); |
||
| 373 | |||
| 374 | absences_deleteAgentsWithNoUser(); |
||
| 375 | absence_rePrimary(); |
||
| 376 | |||
| 377 | return true; |
||
| 378 | } |
||
| 379 |
Let’s take a look at an example:
In the above example, the authenticate() method works fine as long as you just pass instances of MyUser. However, if you now also want to pass a different sub-classes of User which does not have a getDisplayName() method, the code will break.
Available Fixes
Change the type-hint for the parameter:
Add an additional type-check:
Add the method to the parent class: