This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | 1 | if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point'); |
|
3 | /********************************************************************************* |
||
4 | * SugarCRM Community Edition is a customer relationship management program developed by |
||
5 | * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc. |
||
6 | |||
7 | * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd. |
||
8 | * Copyright (C) 2011 - 2014 Salesagility Ltd. |
||
9 | * |
||
10 | * This program is free software; you can redistribute it and/or modify it under |
||
11 | * the terms of the GNU Affero General Public License version 3 as published by the |
||
12 | * Free Software Foundation with the addition of the following permission added |
||
13 | * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK |
||
14 | * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY |
||
15 | * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS. |
||
16 | * |
||
17 | * This program is distributed in the hope that it will be useful, but WITHOUT |
||
18 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS |
||
19 | * FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more |
||
20 | * details. |
||
21 | * |
||
22 | * You should have received a copy of the GNU Affero General Public License along with |
||
23 | * this program; if not, see http://www.gnu.org/licenses or write to the Free |
||
24 | * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
||
25 | * 02110-1301 USA. |
||
26 | * |
||
27 | * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road, |
||
28 | * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected]. |
||
29 | * |
||
30 | * The interactive user interfaces in modified source and object code versions |
||
31 | * of this program must display Appropriate Legal Notices, as required under |
||
32 | * Section 5 of the GNU Affero General Public License version 3. |
||
33 | * |
||
34 | * In accordance with Section 7(b) of the GNU Affero General Public License version 3, |
||
35 | * these Appropriate Legal Notices must retain the display of the "Powered by |
||
36 | * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not |
||
37 | * reasonably feasible for technical reasons, the Appropriate Legal Notices must |
||
38 | * display the words "Powered by SugarCRM" and "Supercharged by SuiteCRM". |
||
39 | ********************************************************************************/ |
||
40 | |||
41 | 1 | require_once('include/EditView/EditView2.php'); |
|
42 | /** |
||
43 | * Quick create form in the subpanel |
||
44 | * @api |
||
45 | */ |
||
46 | class SubpanelQuickCreate{ |
||
47 | public $defaultProcess = true; |
||
48 | |||
49 | /** |
||
50 | * The view type to use |
||
51 | * |
||
52 | * @var string |
||
53 | */ |
||
54 | public $viewType = 'QuickCreate'; |
||
55 | |||
56 | 1 | public function __construct($module, $view='QuickCreate', $proccessOverride = false) |
|
57 | { |
||
58 | 1 | $this->viewType = $view; |
|
59 | |||
60 | //treat quickedit and quickcreate views as the same |
||
61 | 1 | if($this->viewType == 'QuickEdit') { |
|
62 | $this->viewType = 'QuickCreate'; |
||
63 | } |
||
64 | |||
65 | // Get the viewdefs source file, called here to ensure proper viewType setting |
||
66 | 1 | $source = $this->getModuleViewDefsSourceFile($module, $this->viewType); |
|
67 | |||
68 | // locate the best viewdefs to use: 1. custom/module/quickcreatedefs.php 2. module/quickcreatedefs.php 3. custom/module/editviewdefs.php 4. module/editviewdefs.php |
||
69 | 1 | $base = 'modules/' . $module . '/metadata/'; |
|
70 | 1 | $source = 'custom/' . $base . strtolower($view) . 'defs.php'; |
|
71 | 1 | if (!file_exists( $source)) |
|
72 | { |
||
73 | 1 | $source = $base . strtolower($view) . 'defs.php'; |
|
74 | 1 | if (!file_exists($source)) |
|
75 | { |
||
76 | //if our view does not exist default to EditView |
||
77 | $view = 'EditView'; |
||
78 | $source = 'custom/' . $base . 'editviewdefs.php'; |
||
79 | if (!file_exists($source)) |
||
80 | { |
||
81 | $source = $base . 'editviewdefs.php'; |
||
82 | } |
||
83 | } |
||
84 | } |
||
85 | |||
86 | 1 | $this->ev = $this->getEditView(); |
|
87 | 1 | $this->ev->view = $this->viewType; |
|
88 | 1 | $this->ev->ss = new Sugar_Smarty(); |
|
89 | //$_REQUEST['return_action'] = 'SubPanelViewer'; |
||
90 | |||
91 | 1 | $class = $GLOBALS['beanList'][$module]; |
|
92 | 1 | $bean = new $class(); |
|
93 | 1 | if(!empty($_REQUEST['record'])) { |
|
94 | $bean->retrieve($_REQUEST['record']); |
||
95 | } |
||
96 | 1 | $this->ev->setup($module, $bean, $source); |
|
0 ignored issues
–
show
|
|||
97 | 1 | unset($bean); |
|
98 | |||
99 | |||
100 | // Bug 49219 - Check empty before set defaults, or the settings from viewdefs above will be overridden. |
||
101 | 1 | if (!isset($this->ev->defs['templateMeta']['form']['headerTpl'])) |
|
102 | { |
||
103 | 1 | $this->ev->defs['templateMeta']['form']['headerTpl'] = 'include/EditView/header.tpl'; |
|
104 | } |
||
105 | |||
106 | 1 | if (!isset($this->ev->defs['templateMeta']['form']['footerTpl'])) |
|
107 | { |
||
108 | 1 | $this->ev->defs['templateMeta']['form']['footerTpl'] = 'include/EditView/footer.tpl'; |
|
109 | } |
||
110 | // Comment below, breaks many out of the box viewdefs |
||
111 | /*if (empty($this->ev->defs['templateMeta']['form']['buttons'])) $this->ev->defs['templateMeta']['form']['buttons'] = array('SUBPANELSAVE', 'SUBPANELCANCEL', 'SUBPANELFULLFORM');*/ |
||
112 | 1 | $this->ev->defs['templateMeta']['form']['buttons'] = array('SUBPANELSAVE', 'SUBPANELCANCEL', 'SUBPANELFULLFORM'); |
|
113 | |||
114 | //Load the parent view class if it exists. Check for custom file first |
||
115 | 1 | loadParentView('edit'); |
|
116 | |||
117 | 1 | $viewEditSource = 'modules/'.$module.'/views/view.edit.php'; |
|
118 | 1 | if (file_exists('custom/'. $viewEditSource)) { |
|
119 | $viewEditSource = 'custom/'. $viewEditSource; |
||
120 | } |
||
121 | |||
122 | 1 | if(file_exists($viewEditSource) && !$proccessOverride) { |
|
123 | include($viewEditSource); |
||
124 | $c = $module . 'ViewEdit'; |
||
125 | |||
126 | $customClass = 'Custom' . $c; |
||
127 | if(class_exists($customClass)) { |
||
128 | $c = $customClass; |
||
129 | } |
||
130 | |||
131 | if(class_exists($c)) { |
||
132 | $view = new $c; |
||
133 | if($view->useForSubpanel) { |
||
134 | $this->defaultProcess = false; |
||
135 | |||
136 | // Check if we should use the module's QuickCreate.tpl file. |
||
137 | if($view->useModuleQuickCreateTemplate && file_exists('modules/'.$module.'/tpls/QuickCreate.tpl')) { |
||
138 | $this->ev->defs['templateMeta']['form']['headerTpl'] = 'modules/'.$module.'/tpls/QuickCreate.tpl'; |
||
139 | } |
||
140 | |||
141 | $view->ev = & $this->ev; |
||
142 | $view->ss = & $this->ev->ss; |
||
143 | $class = $GLOBALS['beanList'][$module]; |
||
144 | if(!empty($GLOBALS['beanFiles'][$class])){ |
||
145 | require_once($GLOBALS['beanFiles'][$class]); |
||
146 | $bean = new $class(); |
||
147 | $view->bean = $bean; |
||
148 | } |
||
149 | $this->ev->formName = 'form_Subpanel'.$this->ev->view .'_'.$module; |
||
150 | $view->showTitle = false; // Do not show title since this is for subpanel |
||
151 | $view->display(); |
||
152 | } |
||
153 | } |
||
154 | } //if |
||
155 | |||
156 | 1 | if($this->defaultProcess && !$proccessOverride) { |
|
157 | $this->process($module); |
||
158 | } |
||
159 | 1 | } |
|
160 | |||
161 | /** |
||
162 | * @deprecated deprecated since version 7.6, PHP4 Style Constructors are deprecated and will be remove in 7.8, please update your code, use __construct instead |
||
163 | */ |
||
164 | public function SubpanelQuickCreate($module, $view='QuickCreate', $proccessOverride = false){ |
||
165 | $deprecatedMessage = 'PHP4 Style Constructors are deprecated and will be remove in 7.8, please update your code'; |
||
166 | if(isset($GLOBALS['log'])) { |
||
167 | $GLOBALS['log']->deprecated($deprecatedMessage); |
||
168 | } |
||
169 | else { |
||
170 | trigger_error($deprecatedMessage, E_USER_DEPRECATED); |
||
171 | } |
||
172 | self::__construct($module, $view, $proccessOverride); |
||
173 | } |
||
174 | |||
175 | function process($module){ |
||
176 | if($_REQUEST['target_action'] == 'QuickCreate'){ |
||
177 | $this->ev->view = 'QuickCreate'; |
||
178 | } |
||
179 | $form_name = 'form_Subpanel'.$this->ev->view .'_'.$module; |
||
180 | $this->ev->formName = $form_name; |
||
181 | $this->ev->process(true, $form_name); |
||
182 | echo $this->ev->display(false, true); |
||
183 | } |
||
184 | |||
185 | /** |
||
186 | * Get EditView object |
||
187 | * @return EditView |
||
188 | */ |
||
189 | 1 | protected function getEditView() |
|
190 | { |
||
191 | 1 | return new EditView(); |
|
0 ignored issues
–
show
|
|||
192 | } |
||
193 | |||
194 | |||
195 | /** |
||
196 | * Finds and returns the best viewdefs to use: |
||
197 | * 1. custom/module/quickcreatedefs.php |
||
198 | * 2. module/quickcreatedefs.php |
||
199 | * 3. custom/module/editviewdefs.php |
||
200 | * 4. module/editviewdefs.php |
||
201 | * |
||
202 | * @param $module |
||
203 | * @param $view |
||
204 | * @return string The path to the viewdefs file to use |
||
205 | */ |
||
206 | 1 | public function getModuleViewDefsSourceFile($module, $view) { |
|
207 | 1 | $base = 'modules/' . $module . '/metadata/'; |
|
208 | 1 | $source = 'custom/' . $base . strtolower($view) . 'defs.php'; |
|
209 | 1 | if (!file_exists($source)) { |
|
210 | 1 | $source = $base . strtolower($view) . 'defs.php'; |
|
211 | 1 | if (!file_exists($source)) { |
|
212 | //if our view does not exist default to EditView |
||
213 | $this->viewType = 'EditView'; |
||
214 | $source = 'custom/' . $base . 'editviewdefs.php'; |
||
215 | if (!file_exists($source)) { |
||
216 | $source = $base . 'editviewdefs.php'; |
||
217 | } |
||
218 | } |
||
219 | } |
||
220 | |||
221 | 1 | return $source; |
|
222 | } |
||
223 | } |
||
224 |
Let’s take a look at an example:
In the above example, the authenticate() method works fine as long as you just pass instances of MyUser. However, if you now also want to pass a different sub-classes of User which does not have a getDisplayName() method, the code will break.
Available Fixes
Change the type-hint for the parameter:
Add an additional type-check:
Add the method to the parent class: