This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point'); |
||
3 | /********************************************************************************* |
||
4 | * SugarCRM Community Edition is a customer relationship management program developed by |
||
5 | * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc. |
||
6 | |||
7 | * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd. |
||
8 | * Copyright (C) 2011 - 2014 Salesagility Ltd. |
||
9 | * |
||
10 | * This program is free software; you can redistribute it and/or modify it under |
||
11 | * the terms of the GNU Affero General Public License version 3 as published by the |
||
12 | * Free Software Foundation with the addition of the following permission added |
||
13 | * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK |
||
14 | * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY |
||
15 | * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS. |
||
16 | * |
||
17 | * This program is distributed in the hope that it will be useful, but WITHOUT |
||
18 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS |
||
19 | * FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more |
||
20 | * details. |
||
21 | * |
||
22 | * You should have received a copy of the GNU Affero General Public License along with |
||
23 | * this program; if not, see http://www.gnu.org/licenses or write to the Free |
||
24 | * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
||
25 | * 02110-1301 USA. |
||
26 | * |
||
27 | * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road, |
||
28 | * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected]. |
||
29 | * |
||
30 | * The interactive user interfaces in modified source and object code versions |
||
31 | * of this program must display Appropriate Legal Notices, as required under |
||
32 | * Section 5 of the GNU Affero General Public License version 3. |
||
33 | * |
||
34 | * In accordance with Section 7(b) of the GNU Affero General Public License version 3, |
||
35 | * these Appropriate Legal Notices must retain the display of the "Powered by |
||
36 | * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not |
||
37 | * reasonably feasible for technical reasons, the Appropriate Legal Notices must |
||
38 | * display the words "Powered by SugarCRM" and "Supercharged by SuiteCRM". |
||
39 | ********************************************************************************/ |
||
40 | |||
41 | |||
42 | require_once("modules/Calendar/CalendarUtils.php"); |
||
43 | |||
44 | class CalendarController extends SugarController |
||
45 | { |
||
46 | |||
47 | /** |
||
48 | * Bean that is being handled by the Calendar's current action. |
||
49 | * @var SugarBean $currentBean |
||
50 | */ |
||
51 | protected $currentBean = null; |
||
52 | |||
53 | |||
54 | /** |
||
55 | * Action SaveActivity |
||
56 | */ |
||
57 | protected function action_saveactivity() |
||
58 | { |
||
59 | $this->view = 'json'; |
||
60 | |||
61 | if (!$this->retrieveCurrentBean('Save')) { |
||
62 | return; |
||
63 | } |
||
64 | |||
65 | $module = $this->currentBean->module_dir; |
||
66 | $bean = $this->currentBean; |
||
67 | |||
68 | if (empty($_REQUEST['edit_all_recurrences'])) { |
||
69 | |||
70 | $repeat_fields = array('type', 'interval', 'count', 'until', 'dow', 'parent_id'); |
||
71 | foreach ($repeat_fields as $suffix) { |
||
72 | unset($_POST['repeat_' . $suffix]); |
||
73 | } |
||
74 | |||
75 | }else if (!empty($_REQUEST['repeat_type']) && !empty($_REQUEST['date_start'])) { |
||
76 | |||
77 | $params = array( |
||
78 | 'type' => $_REQUEST['repeat_type'], |
||
79 | 'interval' => $_REQUEST['repeat_interval'], |
||
80 | 'count' => $_REQUEST['repeat_count'], |
||
81 | 'until' => $_REQUEST['repeat_until'], |
||
82 | 'dow' => $_REQUEST['repeat_dow'], |
||
83 | ); |
||
84 | |||
85 | $repeatArr = CalendarUtils::build_repeat_sequence($_REQUEST['date_start'], $params); |
||
86 | $limit = SugarConfig::getInstance()->get('calendar.max_repeat_count', 1000); |
||
87 | |||
88 | if (count($repeatArr) > ($limit - 1)) { |
||
89 | ob_clean(); |
||
90 | $jsonData = array( |
||
91 | 'access' => 'yes', |
||
92 | 'limit_error' => 'true', |
||
93 | 'limit' => $limit, |
||
94 | ); |
||
95 | $this->view_object_map['jsonData'] = $jsonData; |
||
96 | return; |
||
97 | } |
||
98 | } |
||
99 | |||
100 | |||
101 | |||
102 | $path = "modules/{$bean->module_dir}/{$bean->object_name}FormBase.php"; |
||
103 | if (!file_exists($path)) { |
||
104 | $GLOBALS['log']->fatal("File {$bean->object_name}FormBase.php doesn't exist"); |
||
105 | sugar_cleanup(true); |
||
106 | } |
||
107 | |||
108 | require_once($path); |
||
109 | |||
110 | $FBObjectName = "{$bean->object_name}FormBase"; |
||
111 | |||
112 | if (!class_exists($FBObjectName)) { |
||
113 | $GLOBALS['log']->fatal("Class {$bean->object_name}FormBase doesn't exist"); |
||
114 | sugar_cleanup(true); |
||
115 | } |
||
116 | |||
117 | $formBase = new $FBObjectName(); |
||
118 | $bean = $formBase->handleSave('', false, false); |
||
119 | unset($_REQUEST['send_invites'], $_POST['send_invites']); // prevent invites sending for recurring activities |
||
120 | |||
121 | if ($record = $bean->id) { |
||
122 | |||
123 | if ($module == "Meetings" || $module == "Calls") { |
||
124 | if (!empty($_REQUEST['edit_all_recurrences'])) { |
||
125 | CalendarUtils::markRepeatDeleted($bean); |
||
126 | } |
||
127 | if (isset($repeatArr) && is_array($repeatArr) && count($repeatArr) > 0) { |
||
128 | $repeatCreated = CalendarUtils::save_repeat_activities($bean, $repeatArr); |
||
129 | } |
||
130 | } |
||
131 | |||
132 | $bean->retrieve($record); |
||
133 | $jsonData = CalendarUtils::get_sendback_array($bean); |
||
134 | |||
135 | if (isset($repeatCreated) && is_array($repeatCreated)) { |
||
136 | $jsonData = array_merge($jsonData, array('repeat' => $repeatCreated)); |
||
137 | } |
||
138 | |||
139 | if (!empty($_REQUEST['edit_all_recurrences'])) { |
||
140 | $jsonData['edit_all_recurrences'] = 'true'; |
||
141 | } |
||
142 | |||
143 | } else { |
||
144 | $jsonData = array( |
||
145 | 'access' => 'no', |
||
146 | ); |
||
147 | } |
||
148 | |||
149 | $this->view_object_map['jsonData'] = $jsonData; |
||
150 | } |
||
151 | |||
152 | |||
153 | /** |
||
154 | * Action QuickEdit |
||
155 | */ |
||
156 | protected function action_quickedit() |
||
157 | { |
||
158 | $this->view = 'quickedit'; |
||
159 | |||
160 | if (!$this->retrieveCurrentBean('Detail')) { |
||
161 | return; |
||
162 | } |
||
163 | |||
164 | $this->view_object_map['currentModule'] = $this->currentBean->module_dir; |
||
165 | $this->view_object_map['currentBean'] = $this->currentBean; |
||
166 | |||
167 | } |
||
168 | |||
169 | /** |
||
170 | * Action Reschedule |
||
171 | * Used for drag & drop |
||
172 | */ |
||
173 | protected function action_reschedule() |
||
174 | { |
||
175 | $this->view = 'json'; |
||
176 | |||
177 | $commit = true; |
||
178 | |||
179 | if (!$this->retrieveCurrentBean('Save')) { |
||
180 | return; |
||
181 | } |
||
182 | |||
183 | $_REQUEST['parent_name'] = $this->currentBean->parent_name; |
||
184 | |||
185 | $dateField = "date_start"; |
||
186 | if ($this->currentBean->module_dir == "Tasks") { |
||
187 | $dateField = "date_due"; |
||
188 | } |
||
189 | |||
190 | if (!empty($_REQUEST['calendar_style']) && $_REQUEST['calendar_style'] == "basic") { |
||
191 | list($tmp, $time) = explode(" ", $this->currentBean->$dateField); |
||
0 ignored issues
–
show
|
|||
192 | list($date, $tmp) = explode(" ", $_REQUEST['datetime']); |
||
0 ignored issues
–
show
The assignment to
$tmp is unused. Consider omitting it like so list($first,,$third) .
This checks looks for assignemnts to variables using the Consider the following code example. <?php
function returnThreeValues() {
return array('a', 'b', 'c');
}
list($a, $b, $c) = returnThreeValues();
print $a . " - " . $c;
Only the variables Instead, the list call could have been. list($a,, $c) = returnThreeValues();
![]() |
|||
193 | $_REQUEST['datetime'] = $date . " " . $time; |
||
194 | } |
||
195 | $_POST[$dateField] = $_REQUEST['datetime']; |
||
196 | |||
197 | if ($this->currentBean->module_dir == "Tasks" && !empty($this->currentBean->date_start)) { |
||
198 | if ($GLOBALS['timedate']->fromUser($_POST['date_due'])->ts < $GLOBALS['timedate']->fromUser($this->currentBean->date_start)->ts) { |
||
199 | $this->view_object_map['jsonData'] = array( |
||
200 | 'access' => 'no', |
||
201 | 'errorMessage' => $GLOBALS['mod_strings']['LBL_DATE_END_ERROR'], |
||
202 | ); |
||
203 | $commit = false; |
||
204 | } |
||
205 | } |
||
206 | |||
207 | if ($commit) { |
||
208 | require_once('include/formbase.php'); |
||
209 | $this->currentBean = populateFromPost("", $this->currentBean); |
||
210 | $this->currentBean->save(); |
||
211 | $this->currentBean->retrieve($_REQUEST['record']); |
||
212 | |||
213 | $this->view_object_map['jsonData'] = CalendarUtils::get_sendback_array($this->currentBean); |
||
214 | } |
||
215 | } |
||
216 | |||
217 | /** |
||
218 | * Action Remove |
||
219 | */ |
||
220 | protected function action_remove() |
||
221 | { |
||
222 | $this->view = 'json'; |
||
223 | |||
224 | if (!$this->retrieveCurrentBean('Delete')) { |
||
225 | return; |
||
226 | } |
||
227 | |||
228 | if ($this->currentBean->module_dir == "Meetings" || $this->currentBean->module_dir == "Calls") { |
||
229 | if (!empty($_REQUEST['remove_all_recurrences']) && $_REQUEST['remove_all_recurrences']) { |
||
230 | CalendarUtils::markRepeatDeleted($this->currentBean); |
||
231 | } |
||
232 | } |
||
233 | |||
234 | $this->currentBean->mark_deleted($_REQUEST['record']); |
||
235 | |||
236 | $this->view_object_map['jsonData'] = array( |
||
237 | 'access' => 'yes', |
||
238 | ); |
||
239 | |||
240 | } |
||
241 | |||
242 | /** |
||
243 | * Action Resize |
||
244 | * Used for drag & drop resizing |
||
245 | */ |
||
246 | protected function action_resize() |
||
247 | { |
||
248 | $this->view = 'json'; |
||
249 | |||
250 | if (!$this->retrieveCurrentBean('Save')) { |
||
251 | return; |
||
252 | } |
||
253 | |||
254 | require_once('include/formbase.php'); |
||
255 | $this->currentBean = populateFromPost("", $this->currentBean); |
||
256 | $this->currentBean->save(); |
||
257 | |||
258 | $this->view_object_map['jsonData'] = array( |
||
259 | 'access' => 'yes', |
||
260 | ); |
||
261 | } |
||
262 | |||
263 | |||
264 | /** |
||
265 | * Retrieves current activity bean and checks access to action |
||
266 | * |
||
267 | * @param string $actionToCheck |
||
268 | * @return bool Result of check |
||
269 | */ |
||
270 | protected function retrieveCurrentBean($actionToCheck = false) |
||
271 | { |
||
272 | $module = $_REQUEST['current_module']; |
||
273 | $record = null; |
||
274 | if (!empty($_REQUEST['record'])) { |
||
275 | $record = $_REQUEST['record']; |
||
276 | } |
||
277 | |||
278 | require_once("data/BeanFactory.php"); |
||
279 | $this->currentBean = BeanFactory::getBean($module, $record); |
||
280 | |||
281 | if (!empty($actionToCheck)) { |
||
282 | if (!$this->currentBean->ACLAccess($actionToCheck)) { |
||
283 | $this->view = 'json'; |
||
284 | $jsonData = array( |
||
285 | 'access' => 'no', |
||
286 | ); |
||
287 | $this->view_object_map['jsonData'] = $jsonData; |
||
288 | return false; |
||
289 | } |
||
290 | } |
||
291 | |||
292 | return true; |
||
293 | } |
||
294 | |||
295 | protected function action_getActivities() |
||
296 | { |
||
297 | $this->view = 'json'; |
||
298 | |||
299 | if(!ACLController::checkAccess('Calendar', 'list', true)){ |
||
300 | ACLController::displayNoAccess(true); |
||
301 | } |
||
302 | |||
303 | require_once('modules/Calendar/Calendar.php'); |
||
304 | $cal = new Calendar($_REQUEST['view']); |
||
305 | |||
306 | if (in_array($cal->view, array('day', 'week', 'month'))){ |
||
307 | $cal->add_activities($GLOBALS['current_user']); |
||
308 | |||
309 | } else if ($cal->view == 'shared') { |
||
310 | $cal->init_shared(); |
||
311 | $sharedUser = new User(); |
||
312 | foreach ($cal->shared_ids as $member) { |
||
313 | $sharedUser->retrieve($member); |
||
314 | $cal->add_activities($sharedUser); |
||
315 | } |
||
316 | } |
||
317 | $cal->load_activities(); |
||
318 | $this->view_object_map['jsonData'] = $cal->items; |
||
319 | } |
||
320 | |||
321 | } |
||
322 |
This checks looks for assignemnts to variables using the
list(...)
function, where not all assigned variables are subsequently used.Consider the following code example.
Only the variables
$a
and$c
are used. There was no need to assign$b
.Instead, the list call could have been.