adamjakab /
SuiteCRM
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /********************************************************************************* |
||
| 3 | * SugarCRM Community Edition is a customer relationship management program developed by |
||
| 4 | * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc. |
||
| 5 | |||
| 6 | * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd. |
||
| 7 | * Copyright (C) 2011 - 2014 Salesagility Ltd. |
||
| 8 | * |
||
| 9 | * This program is free software; you can redistribute it and/or modify it under |
||
| 10 | * the terms of the GNU Affero General Public License version 3 as published by the |
||
| 11 | * Free Software Foundation with the addition of the following permission added |
||
| 12 | * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK |
||
| 13 | * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY |
||
| 14 | * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS. |
||
| 15 | * |
||
| 16 | * This program is distributed in the hope that it will be useful, but WITHOUT |
||
| 17 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS |
||
| 18 | * FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more |
||
| 19 | * details. |
||
| 20 | * |
||
| 21 | * You should have received a copy of the GNU Affero General Public License along with |
||
| 22 | * this program; if not, see http://www.gnu.org/licenses or write to the Free |
||
| 23 | * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
||
| 24 | * 02110-1301 USA. |
||
| 25 | * |
||
| 26 | * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road, |
||
| 27 | * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected]. |
||
| 28 | * |
||
| 29 | * The interactive user interfaces in modified source and object code versions |
||
| 30 | * of this program must display Appropriate Legal Notices, as required under |
||
| 31 | * Section 5 of the GNU Affero General Public License version 3. |
||
| 32 | * |
||
| 33 | * In accordance with Section 7(b) of the GNU Affero General Public License version 3, |
||
| 34 | * these Appropriate Legal Notices must retain the display of the "Powered by |
||
| 35 | * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not |
||
| 36 | * reasonably feasible for technical reasons, the Appropriate Legal Notices must |
||
| 37 | * display the words "Powered by SugarCRM" and "Supercharged by SuiteCRM". |
||
| 38 | ********************************************************************************/ |
||
| 39 | |||
| 40 | 1 | define('VCREND', '50'); |
|
| 41 | 1 | define('VCRSTART', '10'); |
|
| 42 | /** |
||
| 43 | * @api |
||
| 44 | */ |
||
| 45 | class SugarVCR{ |
||
| 46 | |||
| 47 | /** |
||
|
0 ignored issues
–
show
Coding Style
introduced
by
Loading history...
|
|||
| 48 | * records the query in the session for later retrieval |
||
| 49 | */ |
||
| 50 | 4 | static function store($module, $query){ |
|
| 51 | 4 | $_SESSION[$module .'2_QUERY'] = $query; |
|
| 52 | 4 | } |
|
| 53 | |||
| 54 | /** |
||
|
0 ignored issues
–
show
|
|||
| 55 | * This function retrieves a query from the session |
||
| 56 | */ |
||
| 57 | 5 | static function retrieve($module){ |
|
| 58 | 5 | return (!empty($_SESSION[$module .'2_QUERY']) ? $_SESSION[$module .'2_QUERY'] : ''); |
|
| 59 | } |
||
| 60 | |||
| 61 | /** |
||
|
0 ignored issues
–
show
|
|||
| 62 | * return the start, prev, next, end |
||
| 63 | */ |
||
| 64 | static function play($module, $offset){ |
||
| 65 | //given some global offset try to determine if we have this |
||
| 66 | //in our array. |
||
| 67 | $ids = array(); |
||
| 68 | if(!empty($_SESSION[$module.'QUERY_ARRAY'])) |
||
| 69 | $ids = $_SESSION[$module.'QUERY_ARRAY']; |
||
| 70 | if(empty($ids[$offset]) || empty($ids[$offset+1]) || empty($ids[$offset-1])) |
||
| 71 | $ids = SugarVCR::record($module, $offset); |
||
| 72 | $menu = array(); |
||
| 73 | if(!empty($ids[$offset])){ |
||
| 74 | //return the control given this id |
||
| 75 | $menu['PREV'] = ($offset > 1) ? $ids[$offset-1] : ''; |
||
| 76 | $menu['CURRENT'] = $ids[$offset]; |
||
| 77 | $menu['NEXT'] = !empty($ids[$offset+1]) ? $ids[$offset+1] : ''; |
||
| 78 | } |
||
| 79 | return $menu; |
||
| 80 | } |
||
| 81 | |||
| 82 | 5 | static function menu($module, $offset, $isAuditEnabled, $saveAndContinue = false ){ |
|
| 83 | 5 | $html_text = ""; |
|
| 84 | 5 | if ($offset < 0) |
|
| 85 | { |
||
| 86 | $offset = 0; |
||
| 87 | } |
||
| 88 | |||
| 89 | //this check if require in cases when you visit the edit view before visiting that modules list view. |
||
| 90 | //you can do this easily either from home, activities or sitemap. |
||
| 91 | 5 | $stored_vcr_query = SugarVCR::retrieve($module); |
|
| 92 | |||
| 93 | // bug 15893 - only show VCR if called as an element in a set of records |
||
| 94 | 5 | if (!empty($_REQUEST['record']) and !empty($stored_vcr_query) and isset($_REQUEST['offset']) and (empty($_REQUEST['isDuplicate']) or $_REQUEST['isDuplicate'] == 'false')) |
|
| 95 | { |
||
| 96 | //syncing with display offset; |
||
| 97 | $offset ++; |
||
| 98 | $action = (!empty($_REQUEST['action']) ? $_REQUEST['action'] : 'EditView'); |
||
| 99 | |||
| 100 | $menu = SugarVCR::play($module, $offset); |
||
| 101 | |||
| 102 | $list_link = ''; |
||
| 103 | if ($saveAndContinue && !empty($menu['NEXT'])) |
||
| 104 | { |
||
| 105 | $list_link = ajaxLink('index.php?action=' . $action . '&module=' . $module . '&record=' . $menu['NEXT'] . '&offset=' . ($offset + 1)); |
||
| 106 | } |
||
| 107 | |||
| 108 | $previous_link = ""; |
||
| 109 | if (!empty($menu['PREV'])) |
||
| 110 | { |
||
| 111 | $previous_link = ajaxLink('index.php?module=' . $module . '&action=' . $action . '&offset=' . ($offset - 1) . '&record=' . $menu['PREV']); |
||
| 112 | } |
||
| 113 | |||
| 114 | $next_link = ""; |
||
| 115 | if (!empty($menu['NEXT'])) |
||
| 116 | { |
||
| 117 | $next_link = ajaxLink('index.php?module=' . $module . '&action=' . $action . '&offset=' . ($offset + 1) . '&record=' . $menu['NEXT']); |
||
| 118 | } |
||
| 119 | |||
| 120 | $ss = new Sugar_Smarty(); |
||
| 121 | $ss->assign('app_strings', $GLOBALS['app_strings']); |
||
| 122 | $ss->assign('module', $module); |
||
| 123 | $ss->assign('action', $action); |
||
| 124 | $ss->assign('menu', $menu); |
||
| 125 | $ss->assign('list_link', $list_link); |
||
| 126 | $ss->assign('previous_link', $previous_link); |
||
| 127 | $ss->assign('next_link', $next_link); |
||
| 128 | |||
| 129 | $ss->assign('offset', $offset); |
||
| 130 | $ss->assign('total', ''); |
||
| 131 | $ss->assign('plus', ''); |
||
| 132 | |||
| 133 | if (!empty($_SESSION[$module . 'total'])) |
||
| 134 | { |
||
| 135 | $ss->assign('total', $_SESSION[$module . 'total']); |
||
| 136 | if ( |
||
| 137 | !empty($GLOBALS['sugar_config']['disable_count_query']) |
||
| 138 | && (($_SESSION[$module. 'total']-1) % $GLOBALS['sugar_config']['list_max_entries_per_page'] == 0) |
||
| 139 | ) |
||
| 140 | { |
||
| 141 | $ss->assign('plus', '+'); |
||
| 142 | } |
||
| 143 | } |
||
| 144 | |||
| 145 | if (is_file('custom/include/EditView/SugarVCR.tpl')) |
||
| 146 | { |
||
| 147 | $html_text .= $ss->fetch('custom/include/EditView/SugarVCR.tpl'); |
||
| 148 | } |
||
| 149 | else |
||
| 150 | { |
||
| 151 | $html_text .= $ss->fetch('include/EditView/SugarVCR.tpl'); |
||
| 152 | } |
||
| 153 | } |
||
| 154 | 5 | return $html_text; |
|
| 155 | } |
||
| 156 | |||
| 157 | static function record($module, $offset){ |
||
| 158 | $GLOBALS['log']->debug('SUGARVCR is recording more records'); |
||
| 159 | $start = max(0, $offset - VCRSTART); |
||
| 160 | $index = $start; |
||
| 161 | $db = DBManagerFactory::getInstance(); |
||
| 162 | |||
| 163 | $result = $db->limitQuery(SugarVCR::retrieve($module),$start,($offset+VCREND),false); |
||
| 164 | $index++; |
||
| 165 | |||
| 166 | $ids = array(); |
||
| 167 | while(($row = $db->fetchByAssoc($result)) != null){ |
||
| 168 | $ids[$index] = $row['id']; |
||
| 169 | $index++; |
||
| 170 | } |
||
| 171 | //now that we have the array of ids, store this in the session |
||
| 172 | $_SESSION[$module.'QUERY_ARRAY'] = $ids; |
||
| 173 | return $ids; |
||
| 174 | } |
||
| 175 | |||
| 176 | 4 | static function recordIDs($module, $rids, $offset, $totalCount){ |
|
| 177 | 4 | $index = $offset; |
|
| 178 | 4 | $index++; |
|
| 179 | 4 | $ids = array(); |
|
| 180 | 4 | foreach($rids as $id){ |
|
| 181 | 2 | $ids[$index] = $id; |
|
| 182 | 2 | $index++; |
|
| 183 | } |
||
| 184 | //now that we have the array of ids, store this in the session |
||
| 185 | 4 | $_SESSION[$module.'QUERY_ARRAY'] = $ids; |
|
| 186 | 4 | $_SESSION[$module.'total'] = $totalCount; |
|
| 187 | 4 | } |
|
| 188 | |||
| 189 | 4 | static function erase($module){ |
|
| 190 | 4 | unset($_SESSION[$module. 'QUERY_ARRAY']); |
|
| 191 | 4 | } |
|
| 192 | |||
| 193 | } |
||
| 194 | ?> |
||
| 195 |