Issues (4069)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

SugarWidgets/SugarWidgetSubPanelTopButton.php (6 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
3
/*********************************************************************************
4
 * SugarCRM Community Edition is a customer relationship management program developed by
5
 * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc.
6
7
 * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd.
8
 * Copyright (C) 2011 - 2014 Salesagility Ltd.
9
 *
10
 * This program is free software; you can redistribute it and/or modify it under
11
 * the terms of the GNU Affero General Public License version 3 as published by the
12
 * Free Software Foundation with the addition of the following permission added
13
 * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
14
 * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY
15
 * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
16
 *
17
 * This program is distributed in the hope that it will be useful, but WITHOUT
18
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
19
 * FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
20
 * details.
21
 *
22
 * You should have received a copy of the GNU Affero General Public License along with
23
 * this program; if not, see http://www.gnu.org/licenses or write to the Free
24
 * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
25
 * 02110-1301 USA.
26
 *
27
 * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road,
28
 * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected].
29
 *
30
 * The interactive user interfaces in modified source and object code versions
31
 * of this program must display Appropriate Legal Notices, as required under
32
 * Section 5 of the GNU Affero General Public License version 3.
33
 *
34
 * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
35
 * these Appropriate Legal Notices must retain the display of the "Powered by
36
 * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not
37
 * reasonably feasible for  technical reasons, the Appropriate Legal Notices must
38
 * display the words  "Powered by SugarCRM" and "Supercharged by SuiteCRM".
39
 ********************************************************************************/
40
41
42
43
44
45
46
class SugarWidgetSubPanelTopButton extends SugarWidget
47
{
48
    var $module;
49
	var $title;
50
	var $access_key;
51
	var $form_value;
52
	var $additional_form_fields;
53
	var $acl;
54
55
//TODO rename defines to layout defs and make it a member variable instead of passing it multiple layers with extra copying.
56
57
	/** Take the keys for the strings and look them up.  Module is literal, the rest are label keys
58
	*/
59
	function __construct($module='', $title='', $access_key='', $form_value='')
60
	{
61
		global $app_strings;
62
63
		if(is_array($module))
64
		{
65
			// it is really the class details from the mapping
66
			$class_details = $module;
67
68
			// If keys were passed into the constructor, translate them from keys to values.
69
			if(!empty($class_details['module']))
70
				$this->module = $class_details['module'];
71
			if(!empty($class_details['title']))
72
				$this->title = $app_strings[$class_details['title']];
73
			if(!empty($class_details['access_key']))
74
				$this->access_key = $app_strings[$class_details['access_key']];
75
			if(!empty($class_details['form_value']))
76
				$this->form_value = translate($class_details['form_value'], $this->module);
77
			if(!empty($class_details['additional_form_fields']))
78
				$this->additional_form_fields = $class_details['additional_form_fields'];
79
			if(!empty($class_details['ACL'])){
80
				$this->acl = $class_details['ACL'];
81
			}
82
		}
83
		else
84
		{
85
			$this->module = $module;
86
87
			// If keys were passed into the constructor, translate them from keys to values.
88
			if(!empty($title))
89
				$this->title = $app_strings[$title];
90
			if(!empty($access_key))
91
				$this->access_key = $app_strings[$access_key];
92
			if(!empty($form_value))
93
				$this->form_value = translate($form_value, $module);
94
		}
95
	}
96
97
    /**
98
     * @deprecated deprecated since version 7.6, PHP4 Style Constructors are deprecated and will be remove in 7.8, please update your code, use __construct instead
99
     */
100
    function SugarWidgetSubPanelTopButton($module='', $title='', $access_key='', $form_value=''){
101
        $deprecatedMessage = 'PHP4 Style Constructors are deprecated and will be remove in 7.8, please update your code';
102
        if(isset($GLOBALS['log'])) {
103
            $GLOBALS['log']->deprecated($deprecatedMessage);
104
        }
105
        else {
106
            trigger_error($deprecatedMessage, E_USER_DEPRECATED);
107
        }
108
        self::__construct($module, $title, $access_key, $form_value);
109
    }
110
111
    public function getWidgetId($buttonSuffix = true)
112
    {
113
    	$widgetID = parent::getWidgetId() . '_'.preg_replace('[ ]', '', mb_strtolower($this->form_value, 'UTF-8'));
114
    	if($buttonSuffix){
115
    		$widgetID .= '_button';
116
    	}
117
        return $widgetID;
118
    }
119
120
    function &_get_form($defines, $additionalFormFields = null, $asUrl = false)
121
    {
122
        global $app_strings;
123
        global $currentModule;
124
125
        // Create the additional form fields with real values if they were not passed in
126
        if(empty($additionalFormFields) && $this->additional_form_fields)
127
        {
128
            foreach($this->additional_form_fields as $key=>$value)
129
            {
130
                if(!empty($defines['focus']->$value))
131
                {
132
                    $additionalFormFields[$key] = $defines['focus']->$value;
133
                }
134
                else
135
                {
136
                    $additionalFormFields[$key] = '';
137
                }
138
            }
139
        }
140
141
142
		if(!empty($this->module))
143
        {
144
            $defines['child_module_name'] = $this->module;
145
        }
146
        else
147
        {
148
            $defines['child_module_name'] = $defines['module'];
149
        }
150
151
        $defines['parent_bean_name'] = get_class( $defines['focus']);
152
		$relationship_name = $this->get_subpanel_relationship_name($defines);
153
154
155
        $formValues = array();
156
157
        //module_button is used to override the value of module name
158
        $formValues['module'] = $defines['child_module_name'];
159
        $formValues[strtolower($defines['parent_bean_name'])."_id"] = $defines['focus']->id;
160
161
        if(isset($defines['focus']->name))
162
        {
163
            $formValues[strtolower($defines['parent_bean_name'])."_name"] = $defines['focus']->name;
164
            // #26451,add these fields for custom one-to-many relate field.
165
            if(!empty($defines['child_module_name'])){
166
                $formValues[$relationship_name."_name"] = $defines['focus']->name;
167
            	$childFocusName = !empty($GLOBALS['beanList'][$defines['child_module_name']]) ? $GLOBALS['beanList'][$defines['child_module_name']] : "";
168
            	if(!empty($GLOBALS['dictionary'][ $childFocusName ]["fields"][$relationship_name .'_name']['id_name'])){
169
            		$formValues[$GLOBALS['dictionary'][ $childFocusName ]["fields"][$relationship_name .'_name']['id_name']] = $defines['focus']->id;
170
            	}
171
            }
172
        }
173
174
        $formValues['return_module'] = $currentModule;
175
176
        if($currentModule == 'Campaigns'){
177
            $formValues['return_action'] = "DetailView";
178
        }else{
179
            $formValues['return_action'] = $defines['action'];
180
            if ( $formValues['return_action'] == 'SubPanelViewer' ) {
181
                $formValues['return_action'] = 'DetailView';
182
            }
183
        }
184
185
        $formValues['return_id'] = $defines['focus']->id;
186
        $formValues['return_relationship'] = $relationship_name;
187
        switch ( strtolower( $currentModule ) )
188
        {
189
            case 'prospects' :
0 ignored issues
show
There must be no space before the colon in a CASE statement

As per the PSR-2 coding standard, there must not be a space in front of the colon in case statements.

switch ($selector) {
    case "A": //right
        doSomething();
        break;
    case "B" : //wrong
        doSomethingElse();
        break;
}

To learn more about the PSR-2 coding standard, please refer to the PHP-Fig.

Loading history...
190
                $name = $defines['focus']->account_name ;
191
                break ;
192
            case 'documents' :
0 ignored issues
show
There must be no space before the colon in a CASE statement

As per the PSR-2 coding standard, there must not be a space in front of the colon in case statements.

switch ($selector) {
    case "A": //right
        doSomething();
        break;
    case "B" : //wrong
        doSomethingElse();
        break;
}

To learn more about the PSR-2 coding standard, please refer to the PHP-Fig.

Loading history...
193
                $name = $defines['focus']->document_name ;
194
                break ;
195
            case 'kbdocuments' :
0 ignored issues
show
There must be no space before the colon in a CASE statement

As per the PSR-2 coding standard, there must not be a space in front of the colon in case statements.

switch ($selector) {
    case "A": //right
        doSomething();
        break;
    case "B" : //wrong
        doSomethingElse();
        break;
}

To learn more about the PSR-2 coding standard, please refer to the PHP-Fig.

Loading history...
196
                $name = $defines['focus']->kbdocument_name ;
197
                break ;
198
            case 'leads' :
0 ignored issues
show
There must be no space before the colon in a CASE statement

As per the PSR-2 coding standard, there must not be a space in front of the colon in case statements.

switch ($selector) {
    case "A": //right
        doSomething();
        break;
    case "B" : //wrong
        doSomethingElse();
        break;
}

To learn more about the PSR-2 coding standard, please refer to the PHP-Fig.

Loading history...
199
            case 'contacts' :
0 ignored issues
show
There must be no space before the colon in a CASE statement

As per the PSR-2 coding standard, there must not be a space in front of the colon in case statements.

switch ($selector) {
    case "A": //right
        doSomething();
        break;
    case "B" : //wrong
        doSomethingElse();
        break;
}

To learn more about the PSR-2 coding standard, please refer to the PHP-Fig.

Loading history...
200
                $name = $defines['focus']->first_name . " " .$defines['focus']->last_name ;
201
                break ;
202
            default :
0 ignored issues
show
There must be no space before the colon in a DEFAULT statement

As per the PSR-2 coding standard, there must not be a space in front of the colon in the default statement.

switch ($expr) {
    default : //wrong
        doSomething();
        break;
}

switch ($expr) {
    default: //right
        doSomething();
        break;
}

To learn more about the PSR-2 coding standard, please refer to the PHP-Fig.

Loading history...
203
               $name = (isset($defines['focus']->name)) ? $defines['focus']->name : "";
204
        }
205
        $formValues['return_name'] = $name;
206
207
        // TODO: move this out and get $additionalFormFields working properly
208
        if(empty($additionalFormFields['parent_type']))
209
        {
210
            if($defines['focus']->object_name=='Contact') {
211
                $additionalFormFields['parent_type'] = 'Accounts';
212
            }
213
            else {
214
                $additionalFormFields['parent_type'] = $defines['focus']->module_dir;
215
            }
216
        }
217
        if(empty($additionalFormFields['parent_name']))
218
        {
219
            if($defines['focus']->object_name=='Contact') {
220
                $additionalFormFields['parent_name'] = $defines['focus']->account_name;
221
                $additionalFormFields['account_name'] = $defines['focus']->account_name;
222
            }
223
            else {
224
                $additionalFormFields['parent_name'] = $defines['focus']->name;
225
            }
226
        }
227
        if(empty($additionalFormFields['parent_id']))
228
        {
229
            if($defines['focus']->object_name=='Contact') {
230
                $additionalFormFields['parent_id'] = $defines['focus']->account_id;
231
                $additionalFormFields['account_id'] = $defines['focus']->account_id;
232
            } else if($defines['focus']->object_name=='Contract') {
233
            	$additionalFormFields['contract_id'] = $defines['focus']->id;
234
            } else {
235
                $additionalFormFields['parent_id'] = $defines['focus']->id;
236
            }
237
        }
238
239
        if ($defines['focus']->object_name=='Opportunity') {
240
            $additionalFormFields['account_id'] = $defines['focus']->account_id;
241
            $additionalFormFields['account_name'] = $defines['focus']->account_name;
242
        }
243
244
        if (!empty($defines['child_module_name']) and $defines['child_module_name']=='Contacts' and !empty($defines['parent_bean_name']) and $defines['parent_bean_name']=='contact' ) {
245
            if (!empty($defines['focus']->id ) and !empty($defines['focus']->name)) {
246
                $formValues['reports_to_id'] = $defines['focus']->id;
247
                $formValues['reports_to_name'] = $defines['focus']->name;
248
            }
249
        }
250
        $formValues['action'] = "EditView";
251
252
        if ( $asUrl ) {
253
            $returnLink = '';
254
            foreach($formValues as $key => $value ) {
255
                $returnLink .= $key.'='.$value.'&';
256
            }
257
            foreach($additionalFormFields as $key => $value ) {
258
                $returnLink .= $key.'='.$value.'&';
259
            }
260
            $returnLink = rtrim($returnLink,'&');
261
262
            return $returnLink;
263
        } else {
264
265
            $form = 'form' . $relationship_name;
266
            $button = '<form action="index.php" method="post" name="form" id="' . $form . "\">\n";
267
            foreach($formValues as $key => $value) {
268
                $button .= "<input type='hidden' name='" . $key . "' value='" . $value . "' />\n";
269
            }
270
271
            // fill in additional form fields for all but action
272
            foreach($additionalFormFields as $key => $value) {
273
                if($key != 'action') {
274
                    $button .= "<input type='hidden' name='" . $key . "' value='" . $value . "' />\n";
275
                }
276
            }
277
278
279
        return $button;
280
        }
281
    }
282
283
	/** This default function is used to create the HTML for a simple button */
284
	function display($defines, $additionalFormFields = null, $nonbutton = false)
285
	{
286
		$temp='';
287
		$inputID = $this->getWidgetId();
288
289
		if(!empty($this->acl) && ACLController::moduleSupportsACL($defines['module'])  &&  !ACLController::checkAccess($defines['module'], $this->acl, true)){
290
			return $temp;
291
		}
292
293
		global $app_strings;
294
295
        if ( isset($_REQUEST['layout_def_key']) && $_REQUEST['layout_def_key'] == 'UserEAPM' ) {
296
            // Subpanels generally don't go on the editview, so we have to handle this special
297
            $megaLink = $this->_get_form($defines, $additionalFormFields,true);
298
            $button = "<input title='$this->title' accesskey='$this->access_key' class='button' type='submit' name='$inputID' id='$inputID' value='$this->form_value' onclick='javascript:document.location=\"index.php?".$megaLink."\"; return false;'/>";
299
        } else {
300
            $button = $this->_get_form($defines, $additionalFormFields);
301
            $button .= "<input title='$this->title' accesskey='$this->access_key' class='button' type='submit' name='$inputID' id='$inputID' value='$this->form_value' />\n</form>";
302
        }
303
304
        if ($nonbutton) {
305
            $button = "<a onclick=''>$this->form_value";
306
        }
307
        return $button;
308
	}
309
310
	/**
311
	 * Returns a string that is the JSON encoded version of the popup request.
312
	 * Perhaps this function should be moved to a more globally accessible location?
313
	 */
314
	function _create_json_encoded_popup_request($popup_request_data)
315
	{
316
	    return json_encode($popup_request_data);
317
	}
318
319
	/**
320
	 * get_subpanel_relationship_name
321
	 * Get the relationship name based on the subapnel definition
322
	 * @param mixed $defines The subpanel definition
323
	 */
324
	function get_subpanel_relationship_name($defines) {
325
		 $relationship_name = '';
326
		 if(!empty($defines)) {
327
		 	$relationship_name = isset($defines['module']) ? $defines['module'] : '';
328
	     	$dataSource = $defines['subpanel_definition']->get_data_source_name(true);
329
         	if (!empty($dataSource)) {
330
				$relationship_name = $dataSource;
331
				//Try to set the relationship name to the real relationship, not the link.
332
				if (!empty($defines['subpanel_definition']->parent_bean->field_defs[$dataSource])
333
				 && !empty($defines['subpanel_definition']->parent_bean->field_defs[$dataSource]['relationship']))
334
				{
335
					$relationship_name = $defines['subpanel_definition']->parent_bean->field_defs[$dataSource]['relationship'];
336
				}
337
			}
338
		 }
339
		 return $relationship_name;
340
	}
341
342
}
343
?>
344