Issues in download_modules.php (scrutinizer-code-quality) - Issues in scrutinizer-code-quality - adamjakab/SuiteCRM - Measure and Improve Code Quality continuously with Scrutinizer

Issues (4069)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

install/download_modules.php (4 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
/*********************************************************************************
 * SugarCRM Community Edition is a customer relationship management program developed by
 * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc.

 * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd.
 * Copyright (C) 2011 - 2014 Salesagility Ltd.
 *
 * This program is free software; you can redistribute it and/or modify it under
 * the terms of the GNU Affero General Public License version 3 as published by the
 * Free Software Foundation with the addition of the following permission added
 * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
 * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY
 * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
 * FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
 * details.
 *
 * You should have received a copy of the GNU Affero General Public License along with
 * this program; if not, see http://www.gnu.org/licenses or write to the Free
 * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301 USA.
 *
 * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road,
 * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected].
 *
 * The interactive user interfaces in modified source and object code versions
 * of this program must display Appropriate Legal Notices, as required under
 * Section 5 of the GNU Affero General Public License version 3.
 *
 * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
 * these Appropriate Legal Notices must retain the display of the "Powered by
 * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not
 * reasonably feasible for  technical reasons, the Appropriate Legal Notices must
 * display the words  "Powered by SugarCRM" and "Supercharged by SuiteCRM".
 ********************************************************************************/

global $sugar_version, $js_custom_version;
$lang_curr = $_SESSION['language'];
require_once('ModuleInstall/PackageManager/PackageManagerDisplay.php');

if(!isset( $install_script ) || !$install_script || empty($_SESSION['setup_db_admin_user_name'])){
    die($mod_strings['ERR_NO_DIRECT_SCRIPT']);
}
///////////////////////////////////////////////////////////////////////////////
////    PREFILL $sugar_config VARS
if(empty($sugar_config['upload_dir'])) {
    $sugar_config['upload_dir'] = 'upload/';
}
if(empty($sugar_config['upload_maxsize'])) {
    $sugar_config['upload_maxsize'] = 8192000;
}
if(empty($sugar_config['upload_badext'])) {
    $sugar_config['upload_badext'] = array('php', 'php3', 'php4', 'php5', 'pl', 'cgi', 'py', 'asp', 'cfm', 'js', 'vbs', 'html', 'htm');
}
////    END PREFILL $sugar_config VARS
///////////////////////////////////////////////////////////////////////////////
require_once('include/utils/zip_utils.php');

require_once('include/upload_file.php');



$GLOBALS['log'] = LoggerManager::getLogger('SugarCRM');


///////////////////////////////////////////////////////////////////////////////
////    PREP VARS FOR LANG PACK
    $base_upgrade_dir       = sugar_cached("upgrades");
    $base_tmp_upgrade_dir   = $base_upgrade_dir."/temp";
///////////////////////////////////////////////////////////////////////////////

///////////////////////////////////////////////////////////////////////////////
////    HANDLE FILE UPLOAD AND PROCESSING
$errors = array();
$uploadResult = '';
//commitModules();
if(isset($_REQUEST['languagePackAction']) && !empty($_REQUEST['languagePackAction'])) {
    switch($_REQUEST['languagePackAction']) {
        case 'upload':
        $perform = false;
        $tempFile = '';
        if(isset($_REQUEST['release_id']) && $_REQUEST['release_id'] != ""){
            require_once('ModuleInstall/PackageManager/PackageManager.php');
            $pm = new PackageManager();
            $tempFile = $pm->download($_REQUEST['release_id']);

            $perform = true;
            //$base_filename = urldecode($tempFile);
        }else{
            $file = new UploadFile('language_pack');
            if($file->confirm_upload()){
            $perform = true;
             if(strpos($file->mime_type, 'zip') !== false) { // only .zip files
					$tempFile = $file->get_stored_filename();

					if($file->final_move($tempFile)) {
                        $perform = true;
                    }
                    else {
                        $errors[] = $mod_strings['ERR_LANG_UPLOAD_3'];
                    }
                } else {
                    $errors[] = $mod_strings['ERR_LANG_UPLOAD_2'];
                }
            }
        }


            if($perform) { // check for a real file
                        $uploadResult = $mod_strings['LBL_LANG_SUCCESS'];
                        $result = langPackUnpack('langpack', $tempFile);
            } else {
                $errors[] = $mod_strings['ERR_LANG_UPLOAD_1'];
            }

            if(count($errors) > 0) {
                foreach($errors as $error) {
                    $uploadResult .= $error."<br />";
                }
            }
            break; // end 'validate'
        case 'commit':
            $sugar_config = commitModules(false, 'langpack');
class A
{
    function getObject()
    {
        return null;
    }

}

$a = new A();
$object = $a->getObject();
            break;
        case 'uninstall': // leaves zip file in "uploaded" state
            $sugar_config = uninstallLanguagePack();
            break;
        case 'remove':
            removeLanguagePack();
            break;
        default:
            break;
    }
}
////    END HANDLE FILE UPLOAD AND PROCESSING
///////////////////////////////////////////////////////////////////////////////


///////////////////////////////////////////////////////////////////////////////
////    PRELOAD DISPLAY DATA
$upload_max_filesize = ini_get('upload_max_filesize');
$upload_max_filesize_bytes = return_bytes($upload_max_filesize);
$fileMaxSize ='';
if(!defined('SUGARCRM_MIN_UPLOAD_MAX_FILESIZE_BYTES')){
    define('SUGARCRM_MIN_UPLOAD_MAX_FILESIZE_BYTES', 6 * 1024 * 1024);
}

if($upload_max_filesize_bytes < constant('SUGARCRM_MIN_UPLOAD_MAX_FILESIZE_BYTES')) {
    $GLOBALS['log']->debug("detected upload_max_filesize: $upload_max_filesize");
    $fileMaxSize = '<p class="error">'.$mod_strings['ERR_UPLOAD_MAX_FILESIZE']."</p>\n";
}
$availablePatches = getLangPacks(true);
$installedLanguagePacks = getInstalledLangPacks();
$errs = '';
if(isset($validation_errors)) {
    if(count($validation_errors) > 0) {
        $errs  = '<div id="errorMsgs">';
        $errs .= "<p>{$mod_strings['LBL_SYSOPTS_ERRS_TITLE']}</p>";
        $errs .= '<ul>';

        foreach($validation_errors as $error) {
            $errs .= '<li>' . $error . '</li>';
        }

        $errs .= '</ul>';
        $errs .= '</div>';
    }
}



////    PRELOAD DISPLAY DATA
///////////////////////////////////////////////////////////////////////////////


///////////////////////////////////////////////////////////////////////////////
////    BEING PAGE OUTPUT
$disabled = "";
$result = "";
$langHeader = get_language_header();
$out =<<<EOQ
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html {$langHeader}>
<head>
   <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
   <meta http-equiv="Content-Script-Type" content="text/javascript">
   <meta http-equiv="Content-Style-Type" content="text/css">
   <title>{$mod_strings['LBL_WIZARD_TITLE']} {$mod_strings['LBL_MODULE_TITLE']}</title>
   <link REL="SHORTCUT ICON" HREF="include/images/sugar_icon.ico">
   <link rel="stylesheet" href="install/install.css" type="text/css">
   <script type="text/javascript" src="install/installCommon.js"></script>
   <link rel="stylesheet" type="text/css" media="all" href="jscalendar/calendar-win2k-cold-1.css?s={$sugar_version}&c={$js_custom_version}">
   <script>jscal_today = 1161698116000; if(typeof app_strings == "undefined") app_strings = new Array();</script>
   <script type="text/javascript" src="cache/include/javascript/sugar_grp1.js?s={$sugar_version}&c={$js_custom_version}"></script>
   <script type="text/javascript" src="cache/include/javascript/sugar_grp1_yui.js?s={$sugar_version}&c={$js_custom_version}"></script>
   <script type="text/javascript">
   <!--
   if ( YAHOO.env.ua )
        UA = YAHOO.env.ua;
   -->
   </script>
</head>

<body onLoad="document.getElementById('button_next2').focus();">
{$fileMaxSize}
  <table cellspacing="0" width="100%" cellpadding="0" border="0" align="center" class="shell">
      <tr><td colspan="2" id="help"><a href="{$help_url}" target='_blank'>{$mod_strings['LBL_HELP']} </a></td></tr>
    <tr>
      <th width="500">
		<p>
		<img src="{$sugar_md}" alt="SugarCRM" border="0">
		</p>{$mod_strings['LBL_MODULE_TITLE']}</th>
      <th width="200" style="text-align: right;">&nbsp;
        </th>
    </tr>

    <tr>
        <td colspan="2">
            <p>{$mod_strings['LBL_LANG_1']}</p>
            <table width="100%" cellspacing="0" cellpadding="0" border="0" align="center" class="StyleDottedHr">
                <tr>
                    <th colspan="2" align="left">{$mod_strings['LBL_LANG_TITLE']}</th>
                </tr>
                <tr>
                    <td colspan="2">
EOQ;
$form =<<<EOQ1
                    <form name="the_form" enctype="multipart/form-data"
                        action="install.php" method="post">
                        <input type="hidden" name="current_step" value="{$next_step}">
                        <input type="hidden" name="language" value="{$lang_curr}">
                        <input type="hidden" name="goto" value="{$mod_strings['LBL_CHECKSYS_RECHECK']}">
                        <input type="hidden" name="languagePackAction" value="upload">
						<input type="hidden" name="install_type" value="custom">
                    <table width="100%" border="0" cellspacing="0" cellpadding="0" class="edit view">
                        <tr>
                            <td>
                                <table width="450" border="0" cellspacing="0" cellpadding="0">
                                    <tr>
										<td colspan='2'>
											 {$mod_strings['LBL_LANG_UPLOAD']}:<br />
										</td>
									</tr>
									<tr>
                                        <td>

                                        <input type="file" name="language_pack" onchange="uploadCheck();" size="40" />
                                        </td>
                                        <td valign="bottom">
                                            <input class='button' id="upload_button" type=button value="{$mod_strings['LBL_LANG_BUTTON_UPLOAD']}"
                                                disabled="disabled"
                                                onClick="document.the_form.language_pack_escaped.value = escape( document.the_form.language_pack.value );
                                                         document.the_form.submit();"
                                            />
                                            <input type=hidden name="language_pack_escaped" value="" />
                                        </td>
                                    </tr>
                                </table>
                            </td>
                        </tr>
                        <tr>
                            <td>
                                {$uploadResult}
                            </td>
                        </tr>
                    </table>
                    </form>
<script>
 function uploadCheck(){
   var len = escape(document.the_form.language_pack.value).length;
   if(escape(document.the_form.language_pack.value).substr(len-3,len) !='zip'){
   		//document.the_form.upgrade_zip.value = '';
   		//document.getElementById("upgrade_zip").value = '';
   		alert('Not a zip file');
   		document.the_form.language_pack.value = '';
   		//document.getElementById("language_pack").value='';
   		document.getElementById("upload_button").disabled='disabled';
   }
   else{
	//AJAX call for checking the file size and comparing with php.ini settings.
	var callback = {
		 success:function(r) {
		 	document.the_form.upload_button.disabled='';
		 }
	}
    //var file_name = document.getElementById('upgrade_zip').value;
	var file_name = document.the_form.language_pack.value;
	postData = 'file_name=' + file_name + 'install&action=UploadLangFileCheck&to_pdf=1';
	YAHOO.util.Connect.asyncRequest('POST', 'index.php', callback, postData);
   }
}
</script>
EOQ1;
$out1 =<<<EOQ2
                  </td>
                </tr>
                <tr>
                    <td colspan=2>
                        {$result}
                    </td>
                </tr>
                <!--// Available Upgrades //-->
                <tr>
                    <td align="left" colspan="2">
                        <hr>
                        <table cellspacing="0" cellpadding="0" border="0" class="stdTable">
                            {$availablePatches}
                        </table>
                    </td>
                </tr>

                    <td align="left" colspan="2">
                        <hr>
                        <table cellspacing="0" cellpadding="0" border="0" class="stdTable">
                            {$installedLanguagePacks}
                        </table>
                    </td>
                </tr>
                <tr>
                    <td align="right" colspan="2">
                        <hr>
                        <form name="the_form1" action="install.php" method="post" id="form">
                        <input type="hidden" name="current_step" value="{$next_step}">
                        <input type="hidden" name="language" value="{$lang_curr}">
                        <input type="hidden" name="install_type" value="custom">
                        <table cellspacing="0" cellpadding="0" border="0" class="stdTable">
                            <tr>

                                <td>
                                   <input type="hidden" name="default_user_name" value="admin">
                                </td>
                                <td>
                                    <input class="button" type="submit" name="goto" value="{$mod_strings['LBL_NEXT']}" id="button_next2" {$disabled} />
                                </td>
                            </tr>
                        </table>
                        </form>
                    </td>
                </tr>
            </table>
        </td>
    </tr>
</table>

</body>
</html>
EOQ2;
$hidden_fields =  "<input type=\"hidden\" name=\"current_step\" value=\"{$next_step}\">";
$hidden_fields .=  "<input type=\"hidden\" name=\"goto\" value=\"{$mod_strings['LBL_CHECKSYS_RECHECK']}\">";
$hidden_fields .=  "<input type=\"hidden\" name=\"languagePackAction\" value=\"commit\">";
//$form2 = PackageManagerDisplay::buildPackageDisplay($form, $hidden_fields, 'install.php', array('langpack'), 'form1', true);
$form2 = PackageManagerDisplay::buildPatchDisplay($form, $hidden_fields, 'install.php', array('langpack'));

echo $out.$form2.$out1;

//unlinkTempFiles('','');
////    END PAGEOUTPUT
///////////////////////////////////////////////////////////////////////////////
?>


1			<?php
2			if(!defined('sugarEntry') \|\| !sugarEntry) die('Not A Valid Entry Point');
3			/*********************************************************************************
4			* SugarCRM Community Edition is a customer relationship management program developed by
5			* SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc.
6
7			* SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd.
8			* Copyright (C) 2011 - 2014 Salesagility Ltd.
9			*
10			* This program is free software; you can redistribute it and/or modify it under
11			* the terms of the GNU Affero General Public License version 3 as published by the
12			* Free Software Foundation with the addition of the following permission added
13			* to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
14			* IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY
15			* OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
16			*
17			* This program is distributed in the hope that it will be useful, but WITHOUT
18			* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
19			* FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
20			* details.
21			*
22			* You should have received a copy of the GNU Affero General Public License along with
23			* this program; if not, see http://www.gnu.org/licenses or write to the Free
24			* Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
25			* 02110-1301 USA.
26			*
27			* You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road,
28			* SW2-130, Cupertino, CA 95014, USA. or at email address [email protected].
29			*
30			* The interactive user interfaces in modified source and object code versions
31			* of this program must display Appropriate Legal Notices, as required under
32			* Section 5 of the GNU Affero General Public License version 3.
33			*
34			* In accordance with Section 7(b) of the GNU Affero General Public License version 3,
35			* these Appropriate Legal Notices must retain the display of the "Powered by
36			* SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not
37			* reasonably feasible for technical reasons, the Appropriate Legal Notices must
38			* display the words "Powered by SugarCRM" and "Supercharged by SuiteCRM".
39			********************************************************************************/
40
41			global $sugar_version, $js_custom_version;
42			$lang_curr = $_SESSION['language'];
43			require_once('ModuleInstall/PackageManager/PackageManagerDisplay.php');
44
45			if(!isset( $install_script ) \|\| !$install_script \|\| empty($_SESSION['setup_db_admin_user_name'])){
46			die($mod_strings['ERR_NO_DIRECT_SCRIPT']);
47			}
48			///////////////////////////////////////////////////////////////////////////////
49			//// PREFILL $sugar_config VARS
50			if(empty($sugar_config['upload_dir'])) {
51			$sugar_config['upload_dir'] = 'upload/';
52			}
53			if(empty($sugar_config['upload_maxsize'])) {
54			$sugar_config['upload_maxsize'] = 8192000;
55			}
56			if(empty($sugar_config['upload_badext'])) {
57			$sugar_config['upload_badext'] = array('php', 'php3', 'php4', 'php5', 'pl', 'cgi', 'py', 'asp', 'cfm', 'js', 'vbs', 'html', 'htm');
58			}
59			//// END PREFILL $sugar_config VARS
60			///////////////////////////////////////////////////////////////////////////////
61			require_once('include/utils/zip_utils.php');
62
63			require_once('include/upload_file.php');
64
65
66
67			$GLOBALS['log'] = LoggerManager::getLogger('SugarCRM');
			0 ignored issues – show Unused Code introduced 2016-03-07 17:58 UTC by Report Bug Copy Issue Report Show Similar Issues like this The call to `LoggerManager::getLogger()` has too many arguments starting with `'SugarCRM'`. This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue. If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. In this case you can add the `@ignore` PhpDoc annotation to the duplicate definition and it will be ignored. Loading history...
68
69			///////////////////////////////////////////////////////////////////////////////
70			//// PREP VARS FOR LANG PACK
71			$base_upgrade_dir = sugar_cached("upgrades");
72			$base_tmp_upgrade_dir = $base_upgrade_dir."/temp";
73			///////////////////////////////////////////////////////////////////////////////
74
75			///////////////////////////////////////////////////////////////////////////////
76			//// HANDLE FILE UPLOAD AND PROCESSING
77			$errors = array();
78			$uploadResult = '';
79			//commitModules();
80			if(isset($_REQUEST['languagePackAction']) && !empty($_REQUEST['languagePackAction'])) {
81			switch($_REQUEST['languagePackAction']) {
82			case 'upload':
83			$perform = false;
84			$tempFile = '';
85			if(isset($_REQUEST['release_id']) && $_REQUEST['release_id'] != ""){
86			require_once('ModuleInstall/PackageManager/PackageManager.php');
87			$pm = new PackageManager();
88			$tempFile = $pm->download($_REQUEST['release_id']);
			0 ignored issues – show Bug introduced 2016-03-07 17:58 UTC by Report Bug Copy Issue Report Show Similar Issues like this The call to `download()` misses some required arguments starting with `$package_id`. Loading history...
89			$perform = true;
90			//$base_filename = urldecode($tempFile);
91			}else{
92			$file = new UploadFile('language_pack');
93			if($file->confirm_upload()){
94			$perform = true;
95			if(strpos($file->mime_type, 'zip') !== false) { // only .zip files
96			$tempFile = $file->get_stored_filename();
			0 ignored issues – show Bug introduced 2016-03-07 17:58 UTC by Report Bug Copy Issue Report Show Similar Issues like this The method `get_stored_filename()` does not exist on `UploadFile`. Did you maybe mean `get_stored_file_name()`? This check marks calls to methods that do not seem to exist on an object. This is most likely the result of a method being renamed without all references to it being renamed likewise. Loading history...
97			if($file->final_move($tempFile)) {
98			$perform = true;
99			}
100			else {
101			$errors[] = $mod_strings['ERR_LANG_UPLOAD_3'];
102			}
103			} else {
104			$errors[] = $mod_strings['ERR_LANG_UPLOAD_2'];
105			}
106			}
107			}
108
109
110			if($perform) { // check for a real file
111			$uploadResult = $mod_strings['LBL_LANG_SUCCESS'];
112			$result = langPackUnpack('langpack', $tempFile);
113			} else {
114			$errors[] = $mod_strings['ERR_LANG_UPLOAD_1'];
115			}
116
117			if(count($errors) > 0) {
118			foreach($errors as $error) {
119			$uploadResult .= $error."<br />";
120			}
121			}
122			break; // end 'validate'
123			case 'commit':
124			$sugar_config = commitModules(false, 'langpack');
			0 ignored issues – show Bug introduced 2016-03-07 17:58 UTC by Report Bug Copy Issue Report Show Similar Issues like this Are you sure the assignment to `$sugar_config` is correct as `commitModules(false, 'langpack')` (which targets `commitModules()`) seems to always return null. This check looks for function or method calls that always return null and whose return value is assigned to a variable. class A { function getObject() { return null; } } $a = new A(); $object = $a->getObject(); The method `getObject()` can return nothing but null, so it makes no sense to assign that value to a variable. The reason is most likely that a function or method is imcomplete or has been reduced for debug purposes. Loading history...
125			break;
126			case 'uninstall': // leaves zip file in "uploaded" state
127			$sugar_config = uninstallLanguagePack();
128			break;
129			case 'remove':
130			removeLanguagePack();
131			break;
132			default:
133			break;
134			}
135			}
136			//// END HANDLE FILE UPLOAD AND PROCESSING
137			///////////////////////////////////////////////////////////////////////////////
138
139
140			///////////////////////////////////////////////////////////////////////////////
141			//// PRELOAD DISPLAY DATA
142			$upload_max_filesize = ini_get('upload_max_filesize');
143			$upload_max_filesize_bytes = return_bytes($upload_max_filesize);
144			$fileMaxSize ='';
145			if(!defined('SUGARCRM_MIN_UPLOAD_MAX_FILESIZE_BYTES')){
146			define('SUGARCRM_MIN_UPLOAD_MAX_FILESIZE_BYTES', 6 * 1024 * 1024);
147			}
148
149			if($upload_max_filesize_bytes < constant('SUGARCRM_MIN_UPLOAD_MAX_FILESIZE_BYTES')) {
150			$GLOBALS['log']->debug("detected upload_max_filesize: $upload_max_filesize");
151			$fileMaxSize = '<p class="error">'.$mod_strings['ERR_UPLOAD_MAX_FILESIZE']."</p>\n";
152			}
153			$availablePatches = getLangPacks(true);
154			$installedLanguagePacks = getInstalledLangPacks();
155			$errs = '';
156			if(isset($validation_errors)) {
157			if(count($validation_errors) > 0) {
158			$errs = '<div id="errorMsgs">';
159			$errs .= "<p>{$mod_strings['LBL_SYSOPTS_ERRS_TITLE']}</p>";
160			$errs .= '<ul>';
161
162			foreach($validation_errors as $error) {
163			$errs .= '<li>' . $error . '</li>';
164			}
165
166			$errs .= '</ul>';
167			$errs .= '</div>';
168			}
169			}
170
171
172
173			//// PRELOAD DISPLAY DATA
174			///////////////////////////////////////////////////////////////////////////////
175
176
177			///////////////////////////////////////////////////////////////////////////////
178			//// BEING PAGE OUTPUT
179			$disabled = "";
180			$result = "";
181			$langHeader = get_language_header();
182			$out =<<<EOQ
183			<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
184			<html {$langHeader}>
185			<head>
186			<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
187			<meta http-equiv="Content-Script-Type" content="text/javascript">
188			<meta http-equiv="Content-Style-Type" content="text/css">
189			<title>{$mod_strings['LBL_WIZARD_TITLE']} {$mod_strings['LBL_MODULE_TITLE']}</title>
190			<link REL="SHORTCUT ICON" HREF="include/images/sugar_icon.ico">
191			<link rel="stylesheet" href="install/install.css" type="text/css">
192			<script type="text/javascript" src="install/installCommon.js"></script>
193			<link rel="stylesheet" type="text/css" media="all" href="jscalendar/calendar-win2k-cold-1.css?s={$sugar_version}&c={$js_custom_version}">
194			<script>jscal_today = 1161698116000; if(typeof app_strings == "undefined") app_strings = new Array();</script>
195			<script type="text/javascript" src="cache/include/javascript/sugar_grp1.js?s={$sugar_version}&c={$js_custom_version}"></script>
196			<script type="text/javascript" src="cache/include/javascript/sugar_grp1_yui.js?s={$sugar_version}&c={$js_custom_version}"></script>
197			<script type="text/javascript">
198			<!--
199			if ( YAHOO.env.ua )
200			UA = YAHOO.env.ua;
201			-->
202			</script>
203			</head>
204
205			<body onLoad="document.getElementById('button_next2').focus();">
206			{$fileMaxSize}
207			<table cellspacing="0" width="100%" cellpadding="0" border="0" align="center" class="shell">
208			<tr><td colspan="2" id="help"><a href="{$help_url}" target='_blank'>{$mod_strings['LBL_HELP']} </a></td></tr>
209			<tr>
210			<th width="500">
211			<p>
212			<img src="{$sugar_md}" alt="SugarCRM" border="0">
213			</p>{$mod_strings['LBL_MODULE_TITLE']}</th>
214			<th width="200" style="text-align: right;">
215			</th>
216			</tr>
217
218			<tr>
219			<td colspan="2">
220			<p>{$mod_strings['LBL_LANG_1']}</p>
221			<table width="100%" cellspacing="0" cellpadding="0" border="0" align="center" class="StyleDottedHr">
222			<tr>
223			<th colspan="2" align="left">{$mod_strings['LBL_LANG_TITLE']}</th>
224			</tr>
225			<tr>
226			<td colspan="2">
227			EOQ;
228			$form =<<<EOQ1
229			<form name="the_form" enctype="multipart/form-data"
230			action="install.php" method="post">
231			<input type="hidden" name="current_step" value="{$next_step}">
232			<input type="hidden" name="language" value="{$lang_curr}">
233			<input type="hidden" name="goto" value="{$mod_strings['LBL_CHECKSYS_RECHECK']}">
234			<input type="hidden" name="languagePackAction" value="upload">
235			<input type="hidden" name="install_type" value="custom">
236			<table width="100%" border="0" cellspacing="0" cellpadding="0" class="edit view">
237			<tr>
238			<td>
239			<table width="450" border="0" cellspacing="0" cellpadding="0">
240			<tr>
241			<td colspan='2'>
242			{$mod_strings['LBL_LANG_UPLOAD']}:<br />
243			</td>
244			</tr>
245			<tr>
246			<td>
247
248			<input type="file" name="language_pack" onchange="uploadCheck();" size="40" />
249			</td>
250			<td valign="bottom">
251			<input class='button' id="upload_button" type=button value="{$mod_strings['LBL_LANG_BUTTON_UPLOAD']}"
252			disabled="disabled"
253			onClick="document.the_form.language_pack_escaped.value = escape( document.the_form.language_pack.value );
254			document.the_form.submit();"
255			/>
256			<input type=hidden name="language_pack_escaped" value="" />
257			</td>
258			</tr>
259			</table>
260			</td>
261			</tr>
262			<tr>
263			<td>
264			{$uploadResult}
265			</td>
266			</tr>
267			</table>
268			</form>
269			<script>
270			function uploadCheck(){
271			var len = escape(document.the_form.language_pack.value).length;
272			if(escape(document.the_form.language_pack.value).substr(len-3,len) !='zip'){
273			//document.the_form.upgrade_zip.value = '';
274			//document.getElementById("upgrade_zip").value = '';
275			alert('Not a zip file');
276			document.the_form.language_pack.value = '';
277			//document.getElementById("language_pack").value='';
278			document.getElementById("upload_button").disabled='disabled';
279			}
280			else{
281			//AJAX call for checking the file size and comparing with php.ini settings.
282			var callback = {
283			success:function(r) {
284			document.the_form.upload_button.disabled='';
285			}
286			}
287			//var file_name = document.getElementById('upgrade_zip').value;
288			var file_name = document.the_form.language_pack.value;
289			postData = 'file_name=' + file_name + 'install&action=UploadLangFileCheck&to_pdf=1';
290			YAHOO.util.Connect.asyncRequest('POST', 'index.php', callback, postData);
291			}
292			}
293			</script>
294			EOQ1;
295			$out1 =<<<EOQ2
296			</td>
297			</tr>
298			<tr>
299			<td colspan=2>
300			{$result}
301			</td>
302			</tr>
303			<!--// Available Upgrades //-->
304			<tr>
305			<td align="left" colspan="2">
306			<hr>
307			<table cellspacing="0" cellpadding="0" border="0" class="stdTable">
308			{$availablePatches}
309			</table>
310			</td>
311			</tr>
312
313			<td align="left" colspan="2">
314			<hr>
315			<table cellspacing="0" cellpadding="0" border="0" class="stdTable">
316			{$installedLanguagePacks}
317			</table>
318			</td>
319			</tr>
320			<tr>
321			<td align="right" colspan="2">
322			<hr>
323			<form name="the_form1" action="install.php" method="post" id="form">
324			<input type="hidden" name="current_step" value="{$next_step}">
325			<input type="hidden" name="language" value="{$lang_curr}">
326			<input type="hidden" name="install_type" value="custom">
327			<table cellspacing="0" cellpadding="0" border="0" class="stdTable">
328			<tr>
329
330			<td>
331			<input type="hidden" name="default_user_name" value="admin">
332			</td>
333			<td>
334			<input class="button" type="submit" name="goto" value="{$mod_strings['LBL_NEXT']}" id="button_next2" {$disabled} />
335			</td>
336			</tr>
337			</table>
338			</form>
339			</td>
340			</tr>
341			</table>
342			</td>
343			</tr>
344			</table>
345
346			</body>
347			</html>
348			EOQ2;
349			$hidden_fields = "<input type=\"hidden\" name=\"current_step\" value=\"{$next_step}\">";
350			$hidden_fields .= "<input type=\"hidden\" name=\"goto\" value=\"{$mod_strings['LBL_CHECKSYS_RECHECK']}\">";
351			$hidden_fields .= "<input type=\"hidden\" name=\"languagePackAction\" value=\"commit\">";
352			//$form2 = PackageManagerDisplay::buildPackageDisplay($form, $hidden_fields, 'install.php', array('langpack'), 'form1', true);
353			$form2 = PackageManagerDisplay::buildPatchDisplay($form, $hidden_fields, 'install.php', array('langpack'));
354
355			echo $out.$form2.$out1;
356
357			//unlinkTempFiles('','');
358			//// END PAGEOUTPUT
359			///////////////////////////////////////////////////////////////////////////////
360			?>
361

adamjakab / SuiteCRM

Issues (4069)

Security Analysis not enabled

install/download_modules.php (4 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like