Issues (4069)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

modules/Accounts/AccountFormBase.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2 1
if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
3
/*********************************************************************************
4
 * SugarCRM Community Edition is a customer relationship management program developed by
5
 * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc.
6
7
 * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd.
8
 * Copyright (C) 2011 - 2014 Salesagility Ltd.
9
 *
10
 * This program is free software; you can redistribute it and/or modify it under
11
 * the terms of the GNU Affero General Public License version 3 as published by the
12
 * Free Software Foundation with the addition of the following permission added
13
 * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
14
 * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY
15
 * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
16
 * 
17
 * This program is distributed in the hope that it will be useful, but WITHOUT
18
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
19
 * FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
20
 * details.
21
 * 
22
 * You should have received a copy of the GNU Affero General Public License along with
23
 * this program; if not, see http://www.gnu.org/licenses or write to the Free
24
 * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
25
 * 02110-1301 USA.
26
 * 
27
 * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road,
28
 * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected].
29
 * 
30
 * The interactive user interfaces in modified source and object code versions
31
 * of this program must display Appropriate Legal Notices, as required under
32
 * Section 5 of the GNU Affero General Public License version 3.
33
 * 
34
 * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
35
 * these Appropriate Legal Notices must retain the display of the "Powered by
36
 * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not
37
 * reasonably feasible for  technical reasons, the Appropriate Legal Notices must
38
 * display the words  "Powered by SugarCRM" and "Supercharged by SuiteCRM".
39
 ********************************************************************************/
40
41
/*********************************************************************************
42
43
 * Description:  base form for account
44
 * Portions created by SugarCRM are Copyright (C) SugarCRM, Inc.
45
 * All Rights Reserved.
46
 * Contributor(s): ______________________________________..
47
 ********************************************************************************/
48
49
class AccountFormBase{
50
51
52
function checkForDuplicates($prefix){
53
	require_once('include/formbase.php');
54
	
55
	$focus = new Account();
56
	$query = '';
57
	$baseQuery = 'select id, name, website, billing_address_city  from accounts where deleted!=1 and ';
58
	if(!empty($_POST[$prefix.'name'])){
59
		$query = $baseQuery ."  name like '".$_POST[$prefix.'name']."%'";
60
	}
61
62
	if(!empty($_POST[$prefix.'billing_address_city']) || !empty($_POST[$prefix.'shipping_address_city'])){
63
64
		$temp_query = '';
65
		if(!empty($_POST[$prefix.'billing_address_city'])){
66
			if(empty($temp_query)){
67
				$temp_query =  "  billing_address_city like '".$_POST[$prefix.'billing_address_city']."%'";
68
			}else {
69
				$temp_query .= "or billing_address_city like '".$_POST[$prefix.'billing_address_city']."%'";
70
			}
71
		}
72
		if(!empty($_POST[$prefix.'shipping_address_city'])){
73
			if(empty($temp_query)){
74
				$temp_query = "  shipping_address_city like '".$_POST[$prefix.'shipping_address_city']."%'";
75
			}else {
76
				$temp_query .= "or shipping_address_city like '".$_POST[$prefix.'shipping_address_city']."%'";
77
			}
78
		}
79
		if(empty($query)){
80
			$query .= $baseQuery;
81
		}else{
82
			$query .= ' AND ';
83
		}
84
		$query .=   ' ('. $temp_query . ' ) ';
85
86
	}
87
88
	if(!empty($query)){
89
		$rows = array();
90
		global $db;
91
		$result = $db->query($query);
92
		$i=-1;
93
		while(($row=$db->fetchByAssoc($result)) != null) {
94
			$i++;
95
			$rows[$i] = $row;
96
		}
97
		if ($i==-1) return null;
98
99
		return $rows;
100
	}
101
	return null;
102
}
103
104
105
function buildTableForm($rows, $mod='Accounts'){
106
	if(!ACLController::checkAccess('Accounts', 'edit', true)){
107
		return '';
108
	}
109
	global $action;
110
	if(!empty($mod)){
111
	global $current_language;
112
	$mod_strings = return_module_language($current_language, $mod);
113
	}else global $mod_strings;
114
	global $app_strings;
115
	$cols = sizeof($rows[0]) * 2 + 1;
116
	if ($action != 'ShowDuplicates')
117
	{
118
		$form = "<form action='index.php' method='post' id='dupAccounts'  name='dupAccounts'><input type='hidden' name='selectedAccount' value=''>";
119
		$form .= '<table width="100%"><tr><td>'.$mod_strings['MSG_DUPLICATE']. '</td></tr><tr><td height="20"></td></tr></table>';
120
		unset($_POST['selectedAccount']);
121
	}
122
	else
123
	{
124
		$form = '<table width="100%"><tr><td>'.$mod_strings['MSG_SHOW_DUPLICATES']. '</td></tr><tr><td height="20"></td></tr></table>';
125
	}
126
127
    if(isset($_POST['return_action']) && $_POST['return_action'] == 'SubPanelViewer') {
128
        $_POST['return_action'] = 'DetailView';
129
    }
130
131
    if(isset($_POST['return_action']) && $_POST['return_action'] == 'DetailView' && empty($_REQUEST['return_id'])) {
132
        unset($_POST['return_action']);
133
    }
134
135
	$form .= "<table width='100%' cellpadding='0' cellspacing='0' class='list view' border='0'><tr class='pagination'><td colspan='$cols'><table width='100%' cellspacing='0' cellpadding='0' border='0'><tr><td>";
136
	// handle buttons
137
	if ($action == 'ShowDuplicates') {
138
		$return_action = 'ListView'; // cn: bug 6658 - hardcoded return action break popup -> create -> duplicate -> cancel
139
		$return_action = (isset($_REQUEST['return_action']) && !empty($_REQUEST['return_action'])) ? $_REQUEST['return_action'] : $return_action;
140
		$form .= "<input type='hidden' name='selectedAccount' id='selectedAccount' value=''><input title='${app_strings['LBL_SAVE_BUTTON_TITLE']}' accessKey='${app_strings['LBL_SAVE_BUTTON_KEY']}' class='button' onclick=\"this.form.action.value='Save';\" type='submit' name='button' value='  ${app_strings['LBL_SAVE_BUTTON_LABEL']}  '>\n";
141
142
        if (!empty($_REQUEST['return_module']) && !empty($_REQUEST['return_action']) && !empty($_REQUEST['return_id']))
143
            $form .= "<input title='${app_strings['LBL_CANCEL_BUTTON_TITLE']}' accessKey='${app_strings['LBL_CANCEL_BUTTON_KEY']}' class='button' onclick=\"this.form.module.value='".$_REQUEST['return_module']."';this.form.action.value='".$_REQUEST['return_action']."';this.form.record.value='".$_REQUEST['return_id']."'\" type='submit' name='button' value='  ${app_strings['LBL_CANCEL_BUTTON_LABEL']}  '>";
144
        else if (!empty($_POST['return_module']) && !empty($_POST['return_action']))
145
            $form .= "<input title='${app_strings['LBL_CANCEL_BUTTON_TITLE']}' accessKey='${app_strings['LBL_CANCEL_BUTTON_KEY']}' class='button' onclick=\"this.form.module.value='".$_POST['return_module']."';this.form.action.value='". $_POST['return_action']."';\" type='submit' name='button' value='  ${app_strings['LBL_CANCEL_BUTTON_LABEL']}  '>";
146
        else
147
            $form .= "<input title='${app_strings['LBL_CANCEL_BUTTON_TITLE']}' accessKey='${app_strings['LBL_CANCEL_BUTTON_KEY']}' class='button' onclick=\"this.form.action.value='ListView';\" type='submit' type='submit' name='button' value='  ${app_strings['LBL_CANCEL_BUTTON_LABEL']}  '>";
148
	} else {
149
		$form .= "<input type='submit' class='button' name='ContinueAccount' value='${mod_strings['LNK_NEW_ACCOUNT']}'>\n";
150
	}
151
	$form .= "</td></tr></table></td></tr><tr>";
152
    if ($action != 'ShowDuplicates')
153
	{
154
		$form .= "<th> &nbsp;</th>";
155
	}
156
	require_once('include/formbase.php');
157
158
	$form .= getPostToForm();
159
	if(isset($rows[0])){
160
		foreach ($rows[0] as $key=>$value){
161
			if($key != 'id'){
162
163
					$form .= "<th>". $mod_strings[$mod_strings['db_'.$key]]. "</th>";
164
		}}
165
166
		$form .= "</tr>";
167
	}
168
169
	$rowColor = 'oddListRowS1';
170
	foreach($rows as $row){
171
172
		$form .= "<tr class='$rowColor'>";
173
		if ($action != 'ShowDuplicates')
174
		{
175
		$form .= "<td width='1%' nowrap><a href='javascript:void(0)' onclick='document.dupAccounts.selectedAccount.value=\"${row['id']}\"; document.dupAccounts.submit(); '>[${app_strings['LBL_SELECT_BUTTON_LABEL']}]</a>&nbsp;&nbsp;</td>\n";
176
		}
177
		foreach ($row as $key=>$value){
178
				if($key != 'id'){
179
                    if(isset($_POST['popup']) && $_POST['popup']==true){
0 ignored issues
show
Bug Best Practice introduced by
It seems like you are loosely comparing $_POST['popup'] of type string to the boolean true. If you are specifically checking for a non-empty string, consider using the more explicit !== '' instead.
Loading history...
180
                        $form .= "<td scope='row'><a  href='javascript:void(0)' onclick=\"window.opener.location='index.php?module=Accounts&action=DetailView&record=${row['id']}'\">$value</a></td>\n";
181
                    }   
182
                    else
183
					    $form .= "<td><a target='_blank' href='index.php?module=Accounts&action=DetailView&record=${row['id']}'>$value</a></td>\n";
184
185
				}}
186
187
		if($rowColor == 'evenListRowS1'){
188
			$rowColor = 'oddListRowS1';
189
		}else{
190
			 $rowColor = 'evenListRowS1';
191
		}
192
		$form .= "</tr>";
193
	}
194
	$form .= "<tr class='pagination'><td colspan='$cols'><table width='100%' cellspacing='0' cellpadding='0' border='0'><tr><td>";
195
196
	// handle buttons
197
	if ($action == 'ShowDuplicates') {
198
		$return_action = 'ListView'; // cn: bug 6658 - hardcoded return action break popup -> create -> duplicate -> cancel
199
		$return_action = (isset($_REQUEST['return_action']) && !empty($_REQUEST['return_action'])) ? $_REQUEST['return_action'] : $return_action;
200
		$form .= "<input type='hidden' name='selectedAccount' id='selectedAccount' value=''><input title='${app_strings['LBL_SAVE_BUTTON_TITLE']}' class='button' onclick=\"this.form.action.value='Save';\" type='submit' name='button' value='  ${app_strings['LBL_SAVE_BUTTON_LABEL']}  '>\n";
201
	    
202
        if (!empty($_REQUEST['return_module']) && !empty($_REQUEST['return_action']) && !empty($_REQUEST['return_id']))
203
            $form .= "<input title='${app_strings['LBL_CANCEL_BUTTON_TITLE']}' class='button' onclick=\"this.form.module.value='".$_REQUEST['return_module']."';this.form.action.value='".$_REQUEST['return_action']."';this.form.record.value='".$_REQUEST['return_id']."'\" type='submit' name='button' value='  ${app_strings['LBL_CANCEL_BUTTON_LABEL']}  '>";
204
        else if (!empty($_POST['return_module']) && !empty($_POST['return_action']))
205
            $form .= "<input title='${app_strings['LBL_CANCEL_BUTTON_TITLE']}' class='button' onclick=\"this.form.module.value='".$_POST['return_module']."';this.form.action.value='". $_POST['return_action']."';\" type='submit' name='button' value='  ${app_strings['LBL_CANCEL_BUTTON_LABEL']}  '>";
206
        else
207
            $form .= "<input title='${app_strings['LBL_CANCEL_BUTTON_TITLE']}'  class='button' onclick=\"this.form.action.value='ListView';\" type='submit' name='button' value='  ${app_strings['LBL_CANCEL_BUTTON_LABEL']}  '>";
208
	} else {
209
		$form .= "<input type='submit' class='button' name='ContinueAccount' value='${mod_strings['LNK_NEW_ACCOUNT']}'></form>\n";
210
	}
211
    $form .= "</td></tr></table></td></tr></table>";
212
	return $form;
213
214
215
216
}
217
218
function getForm($prefix, $mod='', $form=''){
219
	if(!ACLController::checkAccess('Accounts', 'edit', true)){
220
		return '';
221
	}
222
if(!empty($mod)){
223
	global $current_language;
224
	$mod_strings = return_module_language($current_language, $mod);
225
}else global $mod_strings;
226
global $app_strings;
227
$lbl_save_button_title = $app_strings['LBL_SAVE_BUTTON_TITLE'];
228
$lbl_save_button_key = $app_strings['LBL_SAVE_BUTTON_KEY'];
229
$lbl_save_button_label = $app_strings['LBL_SAVE_BUTTON_LABEL'];
230
231
232
$the_form = get_left_form_header($mod_strings['LBL_NEW_FORM_TITLE']);
233
$the_form .= <<<EOQ
234
		<form name="${prefix}AccountSave" onSubmit="return check_form('${prefix}AccountSave');" method="POST" action="index.php">
235
			<input type="hidden" name="${prefix}module" value="Accounts">
236
			<input type="hidden" name="${prefix}action" value="Save">
237
EOQ;
238
$the_form .= $this->getFormBody($prefix, $mod, $prefix."AccountSave");
239
$the_form .= <<<EOQ
240
		<p><input title="$lbl_save_button_title" accessKey="$lbl_save_button_key" class="button" type="submit" name="button" value="  $lbl_save_button_label  " ></p>
241
		</form>
242
243
EOQ;
244
$the_form .= get_left_form_footer();
245
$the_form .= get_validate_record_js();
246
247
return $the_form;
248
}
249
250
251
function getFormBody($prefix,$mod='', $formname=''){
252
	if(!ACLController::checkAccess('Accounts', 'edit', true)){
253
		return '';
254
	}
255
global $mod_strings;
256
$temp_strings = $mod_strings;
257
if(!empty($mod)){
258
	global $current_language;
259
	$mod_strings = return_module_language($current_language, $mod);
260
}
261
	global $app_strings;
262
global $current_user;
263
264
$lbl_required_symbol = $app_strings['LBL_REQUIRED_SYMBOL'];
265
$lbl_account_name = $mod_strings['LBL_ACCOUNT_NAME'];
266
$lbl_phone = $mod_strings['LBL_PHONE'];
267
$lbl_website = $mod_strings['LBL_WEBSITE'];
268
$lbl_save_button_title = $app_strings['LBL_SAVE_BUTTON_TITLE'];
269
$lbl_save_button_key = $app_strings['LBL_SAVE_BUTTON_KEY'];
270
$lbl_save_button_label = $app_strings['LBL_SAVE_BUTTON_LABEL'];
271
$user_id = $current_user->id;
272
273
	$form = <<<EOQ
274
			<p><input type="hidden" name="record" value="">
275
			<input type="hidden" name="email1" value="">
276
			<input type="hidden" name="email2" value="">
277
			<input type="hidden" name="assigned_user_id" value='${user_id}'>
278
			<input type="hidden" name="action" value="Save">
279
EOQ;
280
	$form .= "$lbl_account_name&nbsp;<span class='required'>$lbl_required_symbol</span><br><input name='name' type='text' value=''><br>";
281
	$form .= "$lbl_phone<br><input name='phone_office' type='text' value=''><br>";
282
		$form .= "$lbl_website<br><input name='website' type='text' value='http://'><br>";
283
$form .='</p>';
284
285
286
287
$javascript = new javascript();
288
$javascript->setFormName($formname);
289
$javascript->setSugarBean(new Account());
290
$javascript->addRequiredFields($prefix);
291
$form .=$javascript->getScript();
292
$mod_strings = $temp_strings;
293
return $form;
294
}
295
296
297
298
function getWideFormBody($prefix, $mod='',$formname='',  $contact=''){
299
	if(!ACLController::checkAccess('Accounts', 'edit', true)){
300
		return '';
301
	}
302
	
303
	if(empty($contact)){
304
		$contact = new Contact();
305
	}
306
global $mod_strings;
307
$temp_strings = $mod_strings;
308
if(!empty($mod)){
309
	global $current_language;
310
	$mod_strings = return_module_language($current_language, $mod);
311
}
312
global $app_strings;
313
global $current_user;
314
$account = new Account();
315
316
$lbl_required_symbol = $app_strings['LBL_REQUIRED_SYMBOL'];
317
$lbl_account_name = $mod_strings['LBL_ACCOUNT_NAME'];
318
$lbl_phone = $mod_strings['LBL_PHONE'];
319
$lbl_website = $mod_strings['LBL_WEBSITE'];
320
if (isset($contact->assigned_user_id)) {
321
	$user_id=$contact->assigned_user_id;
322
} else {
323
	$user_id = $current_user->id;
324
}
325
326
	//Retrieve Email address and set email1, email2
327
	$sugarEmailAddress = new SugarEmailAddress();
328
	$sugarEmailAddress->handleLegacyRetrieve($contact);
329
 	 if(!isset($contact->email1)){
330
    	$contact->email1 = '';
331
    }
332
    if(!isset($contact->email2)){
333
    	$contact->email2 = '';
334
    }
335
    if(!isset($contact->email_opt_out)){
336
    	$contact->email_opt_out = '';
337
    }
338
		$form="";
339
        $default_desc="";
340
        if (!empty($contact->description)) {
341
            $default_desc=$contact->description;
342
        }
343
	$form .= <<<EOQ
344
		<input type="hidden" name="${prefix}record" value="">
345
		<input type="hidden" name="${prefix}phone_fax" value="{$contact->phone_fax}">
346
		<input type="hidden" name="${prefix}phone_other" value="{$contact->phone_other}">
347
		<input type="hidden" name="${prefix}email1" value="{$contact->email1}">
348
		<input type="hidden" name="${prefix}email2" value="{$contact->email2}">
349
		<input type='hidden' name='${prefix}billing_address_street' value='{$contact->primary_address_street}'><input type='hidden' name='${prefix}billing_address_city' value='{$contact->primary_address_city}'><input type='hidden' name='${prefix}billing_address_state'   value='{$contact->primary_address_state}'><input type='hidden' name='${prefix}billing_address_postalcode'   value='{$contact->primary_address_postalcode}'><input type='hidden' name='${prefix}billing_address_country'  value='{$contact->primary_address_country}'>
350
		<input type='hidden' name='${prefix}shipping_address_street' value='{$contact->alt_address_street}'><input type='hidden' name='${prefix}shipping_address_city' value='{$contact->alt_address_city}'><input type='hidden' name='${prefix}shipping_address_state'   value='{$contact->alt_address_state}'><input type='hidden' name='${prefix}shipping_address_postalcode'   value='{$contact->alt_address_postalcode}'><input type='hidden' name='${prefix}shipping_address_country'  value='{$contact->alt_address_country}'>
351
		<input type="hidden" name="${prefix}assigned_user_id" value='${user_id}'>
352
		<input type='hidden' name='${prefix}do_not_call'  value='{$contact->do_not_call}'>
353
		<input type='hidden' name='${prefix}email_opt_out'  value='{$contact->email_opt_out}'>
354
		<table width='100%' border="0" cellpadding="0" cellspacing="0">
355
		<tr>
356
		<td width="20%" nowrap scope="row">$lbl_account_name&nbsp;<span class="required">$lbl_required_symbol</span></td>
357
		<TD width="80%" nowrap scope="row">{$mod_strings['LBL_DESCRIPTION']}</TD>
358
		</tr>
359
		<tr>
360
		<td nowrap ><input name='{$prefix}name' type="text" value="$contact->account_name"></td>
361
		<TD rowspan="5" ><textarea name='{$prefix}description' rows='6' cols='50' >$default_desc</textarea></TD>
362
		</tr>
363
		<tr>
364
		<td nowrap scope="row">$lbl_phone</td>
365
		</tr>
366
		<tr>
367
		<td nowrap ><input name='{$prefix}phone_office' type="text" value="$contact->phone_work"></td>
368
		</tr>
369
		<tr>
370
		<td nowrap scope="row">$lbl_website</td>
371
		</tr>
372
		<tr>
373
		<td nowrap ><input name='{$prefix}website' type="text" value="http://"></td>
374
		</tr>
375
EOQ;
376
	//carry forward custom lead fields common to accounts during Lead Conversion
377
	$tempAccount = new Account();
378
	if (method_exists($contact, 'convertCustomFieldsForm')) $contact->convertCustomFieldsForm($form, $tempAccount, $prefix);
379
	unset($tempAccount);
380
$form .= <<<EOQ
381
		</TABLE>
382
EOQ;
383
	
384
385
$javascript = new javascript();
386
$javascript->setFormName($formname);
387
$javascript->setSugarBean(new Account());
388
$javascript->addRequiredFields($prefix);
389
$form .=$javascript->getScript();
390
$mod_strings = $temp_strings;
391
	return $form;
392
}
393
394
395
function handleSave($prefix,$redirect=true, $useRequired=false){
396
	
397
    
398
	require_once('include/formbase.php');
399
400
	$focus = new Account();
401
402
	if($useRequired &&  !checkRequired($prefix, array_keys($focus->required_fields))){
403
		return null;
404
	}
405
	$focus = populateFromPost($prefix, $focus);
406
407
	if (isset($GLOBALS['check_notify'])) {
408
		$check_notify = $GLOBALS['check_notify'];
409
	}
410
	else {
411
		$check_notify = FALSE;
412
	}
413
414
	if (empty($_POST['record']) && empty($_POST['dup_checked'])) {
415
		$duplicateAccounts = $this->checkForDuplicates($prefix);
416
		if(isset($duplicateAccounts)){
417
			$location='module=Accounts&action=ShowDuplicates';
418
			$get = '';
419
420
			// Bug 25311 - Add special handling for when the form specifies many-to-many relationships
421
			if(isset($_POST['relate_to']) && !empty($_POST['relate_to'])) {
422
				$get .= '&Accountsrelate_to='.$_POST['relate_to'];
423
			}
424
			if(isset($_POST['relate_id']) && !empty($_POST['relate_id'])) {
425
				$get .= '&Accountsrelate_id='.$_POST['relate_id'];
426
			}
427
			
428
			//add all of the post fields to redirect get string
429
			foreach ($focus->column_fields as $field)
430
			{
431
				if (!empty($focus->$field) && !is_object($focus->$field))
432
				{
433
					$get .= "&Accounts$field=".urlencode($focus->$field);
434
				}
435
			}
436
437
			foreach ($focus->additional_column_fields as $field)
438
			{
439
				if (!empty($focus->$field))
440
				{
441
					$get .= "&Accounts$field=".urlencode($focus->$field);
442
				}
443
			}
444
            
445
			
446
			if($focus->hasCustomFields()) {
447
				foreach($focus->field_defs as $name=>$field) {	
448
					if (!empty($field['source']) && $field['source'] == 'custom_fields')
449
					{
450
						$get .= "&Accounts$name=".urlencode($focus->$name);
451
					}			    
452
				}
453
			}
454
			
455
			
456
			
457
			$emailAddress = new SugarEmailAddress();
458
			$get .= $emailAddress->getFormBaseURL($focus);
459
460
			
461
			
462
			//create list of suspected duplicate account id's in redirect get string
463
			$i=0;
464
			foreach ($duplicateAccounts as $account)
465
			{
466
				$get .= "&duplicate[$i]=".$account['id'];
467
				$i++;
468
			}
469
470
			//add return_module, return_action, and return_id to redirect get string
471
			$urlData = array('return_module' => 'Accounts', 'return_action' => '');
472
			foreach (array('return_module', 'return_action', 'return_id', 'popup', 'create') as $var) {
473
			    if (!empty($_POST[$var])) {
474
			        $urlData[$var] = $_POST[$var];
475
			    }
476
			}
477
			$get .= "&".http_build_query($urlData);
478
479
			$_SESSION['SHOW_DUPLICATES'] = $get;
480
			//now redirect the post to modules/Accounts/ShowDuplicates.php
481
            if (!empty($_POST['is_ajax_call']) && $_POST['is_ajax_call'] == '1')
482
            {
483
            	ob_clean();
484
                $json = getJSONobj();
485
                echo $json->encode(array('status' => 'dupe', 'get' => $location));
486
            }
487
            else if(!empty($_REQUEST['ajax_load']))
488
            {
489
                echo "<script>SUGAR.ajaxUI.loadContent('index.php?$location');</script>";
490
            }
491
            else {
492
                if(!empty($_POST['to_pdf']))
493
                    $location .= '&to_pdf='.urlencode($_POST['to_pdf']);
494
                header("Location: index.php?$location");
495
            }
496
			return null;
497
		}
498
	}
499
	if(!$focus->ACLAccess('Save')){
500
		ACLController::displayNoAccess(true);
501
		sugar_cleanup(true);
502
	}
503
504
	$focus->save($check_notify);
505
    $return_id = $focus->id;
506
    
507
	$GLOBALS['log']->debug("Saved record with id of ".$return_id);
508
509
510
    if (!empty($_POST['is_ajax_call']) && $_POST['is_ajax_call'] == '1') {
511
        $json = getJSONobj();
512
        echo $json->encode(array('status' => 'success',
513
                                 'get' => ''));
514
   	 	$trackerManager = TrackerManager::getInstance();
515
        $timeStamp = TimeDate::getInstance()->nowDb();
516
        if($monitor = $trackerManager->getMonitor('tracker')){ 
517
	        $monitor->setValue('action', 'detailview');
518
	        $monitor->setValue('user_id', $GLOBALS['current_user']->id);
519
	        $monitor->setValue('module_name', 'Accounts');
520
	        $monitor->setValue('date_modified', $timeStamp);
521
	        $monitor->setValue('visible', 1);
522
	
523
	        if (!empty($this->bean->id)) {
524
	            $monitor->setValue('item_id', $return_id);
525
	            $monitor->setValue('item_summary', $focus->get_summary_text());
526
	        }
527
			$trackerManager->saveMonitor($monitor, true, true);
528
		}
529
        return null;
530
    }
531
532
    if (isset($_POST['popup']) && $_POST['popup'] == 'true') {
533
	    $urlData = array("query" => true, "name" => $focus->name, "module" => 'Accounts', 'action' => 'Popup');
534
    	if (!empty($_POST['return_module'])) {
535
    	    $urlData['module'] = $_POST['return_module'];
536
    	}
537
        if (!empty($_POST['return_action'])) {
538
    	    $urlData['action'] = $_POST['return_action'];
539
    	}
540
    	foreach (array('return_id', 'popup', 'create', 'to_pdf') as $var) {
541
    	    if (!empty($_POST[$var])) {
542
    	        $urlData[$var] = $_POST[$var];
543
    	    }
544
    	}
545
		header("Location: index.php?".http_build_query($urlData));
546
		return;
547
	}
548
	if($redirect){
549
		handleRedirect($return_id,'Accounts');
550
	}else{
551
		return $focus;
552
	}
553
}
554
555
556 1
}
557
?>
558