This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point'); |
||
3 | /********************************************************************************* |
||
4 | * SugarCRM Community Edition is a customer relationship management program developed by |
||
5 | * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc. |
||
6 | |||
7 | * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd. |
||
8 | * Copyright (C) 2011 - 2014 Salesagility Ltd. |
||
9 | * |
||
10 | * This program is free software; you can redistribute it and/or modify it under |
||
11 | * the terms of the GNU Affero General Public License version 3 as published by the |
||
12 | * Free Software Foundation with the addition of the following permission added |
||
13 | * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK |
||
14 | * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY |
||
15 | * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS. |
||
16 | * |
||
17 | * This program is distributed in the hope that it will be useful, but WITHOUT |
||
18 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS |
||
19 | * FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more |
||
20 | * details. |
||
21 | * |
||
22 | * You should have received a copy of the GNU Affero General Public License along with |
||
23 | * this program; if not, see http://www.gnu.org/licenses or write to the Free |
||
24 | * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
||
25 | * 02110-1301 USA. |
||
26 | * |
||
27 | * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road, |
||
28 | * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected]. |
||
29 | * |
||
30 | * The interactive user interfaces in modified source and object code versions |
||
31 | * of this program must display Appropriate Legal Notices, as required under |
||
32 | * Section 5 of the GNU Affero General Public License version 3. |
||
33 | * |
||
34 | * In accordance with Section 7(b) of the GNU Affero General Public License version 3, |
||
35 | * these Appropriate Legal Notices must retain the display of the "Powered by |
||
36 | * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not |
||
37 | * reasonably feasible for technical reasons, the Appropriate Legal Notices must |
||
38 | * display the words "Powered by SugarCRM" and "Supercharged by SuiteCRM". |
||
39 | ********************************************************************************/ |
||
40 | |||
41 | |||
42 | |||
43 | |||
44 | |||
45 | |||
46 | class SugarWidgetSubPanelTopButton extends SugarWidget |
||
47 | { |
||
48 | var $module; |
||
49 | var $title; |
||
50 | var $access_key; |
||
51 | var $form_value; |
||
52 | var $additional_form_fields; |
||
53 | var $acl; |
||
54 | |||
55 | //TODO rename defines to layout defs and make it a member variable instead of passing it multiple layers with extra copying. |
||
56 | |||
57 | /** Take the keys for the strings and look them up. Module is literal, the rest are label keys |
||
58 | */ |
||
59 | function __construct($module='', $title='', $access_key='', $form_value='') |
||
60 | { |
||
61 | global $app_strings; |
||
62 | |||
63 | if(is_array($module)) |
||
64 | { |
||
65 | // it is really the class details from the mapping |
||
66 | $class_details = $module; |
||
67 | |||
68 | // If keys were passed into the constructor, translate them from keys to values. |
||
69 | if(!empty($class_details['module'])) |
||
70 | $this->module = $class_details['module']; |
||
71 | if(!empty($class_details['title'])) |
||
72 | $this->title = $app_strings[$class_details['title']]; |
||
73 | if(!empty($class_details['access_key'])) |
||
74 | $this->access_key = $app_strings[$class_details['access_key']]; |
||
75 | if(!empty($class_details['form_value'])) |
||
76 | $this->form_value = translate($class_details['form_value'], $this->module); |
||
77 | if(!empty($class_details['additional_form_fields'])) |
||
78 | $this->additional_form_fields = $class_details['additional_form_fields']; |
||
79 | if(!empty($class_details['ACL'])){ |
||
80 | $this->acl = $class_details['ACL']; |
||
81 | } |
||
82 | } |
||
83 | else |
||
84 | { |
||
85 | $this->module = $module; |
||
86 | |||
87 | // If keys were passed into the constructor, translate them from keys to values. |
||
88 | if(!empty($title)) |
||
89 | $this->title = $app_strings[$title]; |
||
90 | if(!empty($access_key)) |
||
91 | $this->access_key = $app_strings[$access_key]; |
||
92 | if(!empty($form_value)) |
||
93 | $this->form_value = translate($form_value, $module); |
||
94 | } |
||
95 | } |
||
96 | |||
97 | /** |
||
98 | * @deprecated deprecated since version 7.6, PHP4 Style Constructors are deprecated and will be remove in 7.8, please update your code, use __construct instead |
||
99 | */ |
||
100 | function SugarWidgetSubPanelTopButton($module='', $title='', $access_key='', $form_value=''){ |
||
101 | $deprecatedMessage = 'PHP4 Style Constructors are deprecated and will be remove in 7.8, please update your code'; |
||
102 | if(isset($GLOBALS['log'])) { |
||
103 | $GLOBALS['log']->deprecated($deprecatedMessage); |
||
104 | } |
||
105 | else { |
||
106 | trigger_error($deprecatedMessage, E_USER_DEPRECATED); |
||
107 | } |
||
108 | self::__construct($module, $title, $access_key, $form_value); |
||
109 | } |
||
110 | |||
111 | public function getWidgetId($buttonSuffix = true) |
||
112 | { |
||
113 | $widgetID = parent::getWidgetId() . '_'.preg_replace('[ ]', '', mb_strtolower($this->form_value, 'UTF-8')); |
||
114 | if($buttonSuffix){ |
||
115 | $widgetID .= '_button'; |
||
116 | } |
||
117 | return $widgetID; |
||
118 | } |
||
119 | |||
120 | function &_get_form($defines, $additionalFormFields = null, $asUrl = false) |
||
121 | { |
||
122 | global $app_strings; |
||
123 | global $currentModule; |
||
124 | |||
125 | // Create the additional form fields with real values if they were not passed in |
||
126 | if(empty($additionalFormFields) && $this->additional_form_fields) |
||
127 | { |
||
128 | foreach($this->additional_form_fields as $key=>$value) |
||
129 | { |
||
130 | if(!empty($defines['focus']->$value)) |
||
131 | { |
||
132 | $additionalFormFields[$key] = $defines['focus']->$value; |
||
133 | } |
||
134 | else |
||
135 | { |
||
136 | $additionalFormFields[$key] = ''; |
||
137 | } |
||
138 | } |
||
139 | } |
||
140 | |||
141 | |||
142 | if(!empty($this->module)) |
||
143 | { |
||
144 | $defines['child_module_name'] = $this->module; |
||
145 | } |
||
146 | else |
||
147 | { |
||
148 | $defines['child_module_name'] = $defines['module']; |
||
149 | } |
||
150 | |||
151 | $defines['parent_bean_name'] = get_class( $defines['focus']); |
||
152 | $relationship_name = $this->get_subpanel_relationship_name($defines); |
||
153 | |||
154 | |||
155 | $formValues = array(); |
||
156 | |||
157 | //module_button is used to override the value of module name |
||
158 | $formValues['module'] = $defines['child_module_name']; |
||
159 | $formValues[strtolower($defines['parent_bean_name'])."_id"] = $defines['focus']->id; |
||
160 | |||
161 | if(isset($defines['focus']->name)) |
||
162 | { |
||
163 | $formValues[strtolower($defines['parent_bean_name'])."_name"] = $defines['focus']->name; |
||
164 | // #26451,add these fields for custom one-to-many relate field. |
||
165 | if(!empty($defines['child_module_name'])){ |
||
166 | $formValues[$relationship_name."_name"] = $defines['focus']->name; |
||
167 | $childFocusName = !empty($GLOBALS['beanList'][$defines['child_module_name']]) ? $GLOBALS['beanList'][$defines['child_module_name']] : ""; |
||
168 | if(!empty($GLOBALS['dictionary'][ $childFocusName ]["fields"][$relationship_name .'_name']['id_name'])){ |
||
169 | $formValues[$GLOBALS['dictionary'][ $childFocusName ]["fields"][$relationship_name .'_name']['id_name']] = $defines['focus']->id; |
||
170 | } |
||
171 | } |
||
172 | } |
||
173 | |||
174 | $formValues['return_module'] = $currentModule; |
||
175 | |||
176 | if($currentModule == 'Campaigns'){ |
||
177 | $formValues['return_action'] = "DetailView"; |
||
178 | }else{ |
||
179 | $formValues['return_action'] = $defines['action']; |
||
180 | if ( $formValues['return_action'] == 'SubPanelViewer' ) { |
||
181 | $formValues['return_action'] = 'DetailView'; |
||
182 | } |
||
183 | } |
||
184 | |||
185 | $formValues['return_id'] = $defines['focus']->id; |
||
186 | $formValues['return_relationship'] = $relationship_name; |
||
187 | switch ( strtolower( $currentModule ) ) |
||
188 | { |
||
189 | case 'prospects' : |
||
0 ignored issues
–
show
|
|||
190 | $name = $defines['focus']->account_name ; |
||
191 | break ; |
||
192 | case 'documents' : |
||
0 ignored issues
–
show
There must be no space before the colon in a CASE statement
As per the PSR-2 coding standard, there must not be a space in front of the colon in case statements. switch ($selector) {
case "A": //right
doSomething();
break;
case "B" : //wrong
doSomethingElse();
break;
}
To learn more about the PSR-2 coding standard, please refer to the PHP-Fig. ![]() |
|||
193 | $name = $defines['focus']->document_name ; |
||
194 | break ; |
||
195 | case 'kbdocuments' : |
||
0 ignored issues
–
show
There must be no space before the colon in a CASE statement
As per the PSR-2 coding standard, there must not be a space in front of the colon in case statements. switch ($selector) {
case "A": //right
doSomething();
break;
case "B" : //wrong
doSomethingElse();
break;
}
To learn more about the PSR-2 coding standard, please refer to the PHP-Fig. ![]() |
|||
196 | $name = $defines['focus']->kbdocument_name ; |
||
197 | break ; |
||
198 | case 'leads' : |
||
0 ignored issues
–
show
There must be no space before the colon in a CASE statement
As per the PSR-2 coding standard, there must not be a space in front of the colon in case statements. switch ($selector) {
case "A": //right
doSomething();
break;
case "B" : //wrong
doSomethingElse();
break;
}
To learn more about the PSR-2 coding standard, please refer to the PHP-Fig. ![]() |
|||
199 | case 'contacts' : |
||
0 ignored issues
–
show
There must be no space before the colon in a CASE statement
As per the PSR-2 coding standard, there must not be a space in front of the colon in case statements. switch ($selector) {
case "A": //right
doSomething();
break;
case "B" : //wrong
doSomethingElse();
break;
}
To learn more about the PSR-2 coding standard, please refer to the PHP-Fig. ![]() |
|||
200 | $name = $defines['focus']->first_name . " " .$defines['focus']->last_name ; |
||
201 | break ; |
||
202 | default : |
||
0 ignored issues
–
show
There must be no space before the colon in a DEFAULT statement
As per the PSR-2 coding standard, there must not be a space in front of the colon in the default statement. switch ($expr) {
default : //wrong
doSomething();
break;
}
switch ($expr) {
default: //right
doSomething();
break;
}
To learn more about the PSR-2 coding standard, please refer to the PHP-Fig. ![]() |
|||
203 | $name = (isset($defines['focus']->name)) ? $defines['focus']->name : ""; |
||
204 | } |
||
205 | $formValues['return_name'] = $name; |
||
206 | |||
207 | // TODO: move this out and get $additionalFormFields working properly |
||
208 | if(empty($additionalFormFields['parent_type'])) |
||
209 | { |
||
210 | if($defines['focus']->object_name=='Contact') { |
||
211 | $additionalFormFields['parent_type'] = 'Accounts'; |
||
212 | } |
||
213 | else { |
||
214 | $additionalFormFields['parent_type'] = $defines['focus']->module_dir; |
||
215 | } |
||
216 | } |
||
217 | if(empty($additionalFormFields['parent_name'])) |
||
218 | { |
||
219 | if($defines['focus']->object_name=='Contact') { |
||
220 | $additionalFormFields['parent_name'] = $defines['focus']->account_name; |
||
221 | $additionalFormFields['account_name'] = $defines['focus']->account_name; |
||
222 | } |
||
223 | else { |
||
224 | $additionalFormFields['parent_name'] = $defines['focus']->name; |
||
225 | } |
||
226 | } |
||
227 | if(empty($additionalFormFields['parent_id'])) |
||
228 | { |
||
229 | if($defines['focus']->object_name=='Contact') { |
||
230 | $additionalFormFields['parent_id'] = $defines['focus']->account_id; |
||
231 | $additionalFormFields['account_id'] = $defines['focus']->account_id; |
||
232 | } else if($defines['focus']->object_name=='Contract') { |
||
233 | $additionalFormFields['contract_id'] = $defines['focus']->id; |
||
234 | } else { |
||
235 | $additionalFormFields['parent_id'] = $defines['focus']->id; |
||
236 | } |
||
237 | } |
||
238 | |||
239 | if ($defines['focus']->object_name=='Opportunity') { |
||
240 | $additionalFormFields['account_id'] = $defines['focus']->account_id; |
||
241 | $additionalFormFields['account_name'] = $defines['focus']->account_name; |
||
242 | } |
||
243 | |||
244 | if (!empty($defines['child_module_name']) and $defines['child_module_name']=='Contacts' and !empty($defines['parent_bean_name']) and $defines['parent_bean_name']=='contact' ) { |
||
245 | if (!empty($defines['focus']->id ) and !empty($defines['focus']->name)) { |
||
246 | $formValues['reports_to_id'] = $defines['focus']->id; |
||
247 | $formValues['reports_to_name'] = $defines['focus']->name; |
||
248 | } |
||
249 | } |
||
250 | $formValues['action'] = "EditView"; |
||
251 | |||
252 | if ( $asUrl ) { |
||
253 | $returnLink = ''; |
||
254 | foreach($formValues as $key => $value ) { |
||
255 | $returnLink .= $key.'='.$value.'&'; |
||
256 | } |
||
257 | foreach($additionalFormFields as $key => $value ) { |
||
258 | $returnLink .= $key.'='.$value.'&'; |
||
259 | } |
||
260 | $returnLink = rtrim($returnLink,'&'); |
||
261 | |||
262 | return $returnLink; |
||
263 | } else { |
||
264 | |||
265 | $form = 'form' . $relationship_name; |
||
266 | $button = '<form action="index.php" method="post" name="form" id="' . $form . "\">\n"; |
||
267 | foreach($formValues as $key => $value) { |
||
268 | $button .= "<input type='hidden' name='" . $key . "' value='" . $value . "' />\n"; |
||
269 | } |
||
270 | |||
271 | // fill in additional form fields for all but action |
||
272 | foreach($additionalFormFields as $key => $value) { |
||
273 | if($key != 'action') { |
||
274 | $button .= "<input type='hidden' name='" . $key . "' value='" . $value . "' />\n"; |
||
275 | } |
||
276 | } |
||
277 | |||
278 | |||
279 | return $button; |
||
280 | } |
||
281 | } |
||
282 | |||
283 | /** This default function is used to create the HTML for a simple button */ |
||
284 | function display($defines, $additionalFormFields = null, $nonbutton = false) |
||
285 | { |
||
286 | $temp=''; |
||
287 | $inputID = $this->getWidgetId(); |
||
288 | |||
289 | if(!empty($this->acl) && ACLController::moduleSupportsACL($defines['module']) && !ACLController::checkAccess($defines['module'], $this->acl, true)){ |
||
290 | return $temp; |
||
291 | } |
||
292 | |||
293 | global $app_strings; |
||
294 | |||
295 | if ( isset($_REQUEST['layout_def_key']) && $_REQUEST['layout_def_key'] == 'UserEAPM' ) { |
||
296 | // Subpanels generally don't go on the editview, so we have to handle this special |
||
297 | $megaLink = $this->_get_form($defines, $additionalFormFields,true); |
||
298 | $button = "<input title='$this->title' accesskey='$this->access_key' class='button' type='submit' name='$inputID' id='$inputID' value='$this->form_value' onclick='javascript:document.location=\"index.php?".$megaLink."\"; return false;'/>"; |
||
299 | } else { |
||
300 | $button = $this->_get_form($defines, $additionalFormFields); |
||
301 | $button .= "<input title='$this->title' accesskey='$this->access_key' class='button' type='submit' name='$inputID' id='$inputID' value='$this->form_value' />\n</form>"; |
||
302 | } |
||
303 | |||
304 | if ($nonbutton) { |
||
305 | $button = "<a onclick=''>$this->form_value"; |
||
306 | } |
||
307 | return $button; |
||
308 | } |
||
309 | |||
310 | /** |
||
311 | * Returns a string that is the JSON encoded version of the popup request. |
||
312 | * Perhaps this function should be moved to a more globally accessible location? |
||
313 | */ |
||
314 | function _create_json_encoded_popup_request($popup_request_data) |
||
315 | { |
||
316 | return json_encode($popup_request_data); |
||
317 | } |
||
318 | |||
319 | /** |
||
320 | * get_subpanel_relationship_name |
||
321 | * Get the relationship name based on the subapnel definition |
||
322 | * @param mixed $defines The subpanel definition |
||
323 | */ |
||
324 | function get_subpanel_relationship_name($defines) { |
||
325 | $relationship_name = ''; |
||
326 | if(!empty($defines)) { |
||
327 | $relationship_name = isset($defines['module']) ? $defines['module'] : ''; |
||
328 | $dataSource = $defines['subpanel_definition']->get_data_source_name(true); |
||
329 | if (!empty($dataSource)) { |
||
330 | $relationship_name = $dataSource; |
||
331 | //Try to set the relationship name to the real relationship, not the link. |
||
332 | if (!empty($defines['subpanel_definition']->parent_bean->field_defs[$dataSource]) |
||
333 | && !empty($defines['subpanel_definition']->parent_bean->field_defs[$dataSource]['relationship'])) |
||
334 | { |
||
335 | $relationship_name = $defines['subpanel_definition']->parent_bean->field_defs[$dataSource]['relationship']; |
||
336 | } |
||
337 | } |
||
338 | } |
||
339 | return $relationship_name; |
||
340 | } |
||
341 | |||
342 | } |
||
343 | ?> |
||
344 |
As per the PSR-2 coding standard, there must not be a space in front of the colon in case statements.
To learn more about the PSR-2 coding standard, please refer to the PHP-Fig.