This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point'); |
||
3 | /********************************************************************************* |
||
4 | * SugarCRM Community Edition is a customer relationship management program developed by |
||
5 | * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc. |
||
6 | |||
7 | * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd. |
||
8 | * Copyright (C) 2011 - 2014 Salesagility Ltd. |
||
9 | * |
||
10 | * This program is free software; you can redistribute it and/or modify it under |
||
11 | * the terms of the GNU Affero General Public License version 3 as published by the |
||
12 | * Free Software Foundation with the addition of the following permission added |
||
13 | * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK |
||
14 | * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY |
||
15 | * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS. |
||
16 | * |
||
17 | * This program is distributed in the hope that it will be useful, but WITHOUT |
||
18 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS |
||
19 | * FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more |
||
20 | * details. |
||
21 | * |
||
22 | * You should have received a copy of the GNU Affero General Public License along with |
||
23 | * this program; if not, see http://www.gnu.org/licenses or write to the Free |
||
24 | * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
||
25 | * 02110-1301 USA. |
||
26 | * |
||
27 | * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road, |
||
28 | * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected]. |
||
29 | * |
||
30 | * The interactive user interfaces in modified source and object code versions |
||
31 | * of this program must display Appropriate Legal Notices, as required under |
||
32 | * Section 5 of the GNU Affero General Public License version 3. |
||
33 | * |
||
34 | * In accordance with Section 7(b) of the GNU Affero General Public License version 3, |
||
35 | * these Appropriate Legal Notices must retain the display of the "Powered by |
||
36 | * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not |
||
37 | * reasonably feasible for technical reasons, the Appropriate Legal Notices must |
||
38 | * display the words "Powered by SugarCRM" and "Supercharged by SuiteCRM". |
||
39 | ********************************************************************************/ |
||
40 | |||
41 | /********************************************************************************* |
||
42 | |||
43 | * Description: TODO: To be written. |
||
44 | * Portions created by SugarCRM are Copyright (C) SugarCRM, Inc. |
||
45 | * All Rights Reserved. |
||
46 | * Contributor(s): ______________________________________.. |
||
47 | ********************************************************************************/ |
||
48 | require_once('include/formbase.php'); |
||
49 | |||
50 | global $mod_strings; |
||
51 | |||
52 | //create new campaign bean and populate |
||
53 | $campaign_focus = new Campaign(); |
||
54 | if(isset($_REQUEST['record']) && $_REQUEST['record'] && !(isset($_REQUEST['campaign_id']) && $_REQUEST['campaign_id'])) { |
||
55 | $campaign_focus->retrieve($_REQUEST['record']); |
||
56 | } |
||
57 | else if(isset($_REQUEST['campaign_id']) && $_REQUEST['campaign_id']) { |
||
58 | $campaign_focus->retrieve($_REQUEST['campaign_id']); |
||
59 | } |
||
60 | |||
61 | $camp_steps[] = 'wiz_step1_'; |
||
62 | $camp_steps[] = 'wiz_step2_'; |
||
63 | |||
64 | $campaign_focus = populateFromPost('', $campaign_focus); |
||
65 | |||
66 | foreach($camp_steps as $step){ |
||
67 | $campaign_focus = populate_wizard_bean_from_request($campaign_focus,$step); |
||
68 | } |
||
69 | |||
70 | //save here so we can link relationships |
||
71 | $campaign_focus->save(); |
||
72 | $GLOBALS['log']->debug("Saved record with id of ".$campaign_focus->id); |
||
73 | |||
74 | //process prospect lists |
||
75 | |||
76 | //process subscription lists if this is a newsletter |
||
77 | if($campaign_focus->campaign_type =='NewsLetter'){ |
||
78 | $pl_list = process_subscriptions_from_request($campaign_focus->name); |
||
79 | |||
80 | $campaign_focus->load_relationship('prospectlists'); |
||
81 | $existing_pls = $campaign_focus->prospectlists->get(); |
||
82 | $ui_ids = array(); |
||
83 | |||
84 | //for each list returned, add the list to the relationship |
||
85 | foreach($pl_list as $pl){ |
||
86 | $campaign_focus->prospectlists->add($pl->id); |
||
87 | //populate array with id's from UI' |
||
88 | $ui_ids[] = $pl->id; |
||
89 | } |
||
90 | |||
91 | //now remove the lists that may have existed before, but were not specified in UI. |
||
92 | //this will enforce that Newsletters only have 3 available target lists. |
||
93 | foreach($existing_pls as $pl_del){ |
||
94 | if (!in_array($pl_del, $ui_ids)){ |
||
95 | $campaign_focus->prospectlists->delete($campaign_focus->id, $pl_del); |
||
96 | } |
||
97 | } |
||
98 | }else{ |
||
99 | //process target lists if this is not a newsletter |
||
100 | //remove Target Lists if defined |
||
101 | |||
102 | if(isset($_REQUEST['wiz_remove_target_list'])){ |
||
103 | |||
104 | $remove_target_strings = explode(",", $_REQUEST['wiz_remove_target_list']); |
||
105 | foreach($remove_target_strings as $remove_trgt_string){ |
||
106 | if(!empty($remove_trgt_string)){ |
||
107 | //load relationship and add to the list |
||
108 | $campaign_focus->load_relationship('prospectlists'); |
||
109 | $campaign_focus->prospectlists->delete($campaign_focus->id,$remove_trgt_string); |
||
110 | } |
||
111 | } |
||
112 | } |
||
113 | |||
114 | |||
115 | //create new campaign tracker and save if defined |
||
116 | if(isset($_REQUEST['wiz_list_of_targets'])){ |
||
117 | $target_strings = explode(",", $_REQUEST['wiz_list_of_targets']); |
||
118 | foreach($target_strings as $trgt_string){ |
||
119 | $target_values = explode("@@", $trgt_string); |
||
120 | if(count($target_values)==3){ |
||
121 | |||
122 | if(!empty($target_values[0])){ |
||
123 | //this is a selected target, as the id is already populated, retrieve and link |
||
124 | $trgt_focus = new ProspectList(); |
||
125 | $trgt_focus->retrieve($target_values[0]); |
||
126 | |||
127 | //load relationship and add to the list |
||
128 | $campaign_focus->load_relationship('prospectlists'); |
||
129 | $campaign_focus->prospectlists->add($trgt_focus ->id); |
||
130 | }else{ |
||
131 | |||
132 | //this is a new target, as the id is not populated, need to create and link |
||
133 | $trgt_focus = new ProspectList(); |
||
134 | $trgt_focus->name = $target_values[1]; |
||
135 | $trgt_focus->list_type = $target_values[2]; |
||
136 | $trgt_focus->save(); |
||
137 | |||
138 | //load relationship and add to the list |
||
139 | $campaign_focus->load_relationship('prospectlists'); |
||
140 | $campaign_focus->prospectlists->add($trgt_focus->id); |
||
141 | } |
||
142 | |||
143 | } |
||
144 | |||
145 | |||
146 | } |
||
147 | } |
||
148 | |||
149 | |||
150 | } |
||
151 | |||
152 | |||
153 | |||
154 | //remove campaign trackers if defined |
||
155 | if(isset($_REQUEST['wiz_remove_tracker_list'])){ |
||
156 | |||
157 | $remove_tracker_strings = explode(",", $_REQUEST['wiz_remove_tracker_list']); |
||
158 | foreach($remove_tracker_strings as $remove_trkr_string){ |
||
159 | if(!empty($remove_trkr_string)){ |
||
160 | //load relationship and add to the list |
||
161 | $campaign_focus->load_relationship('tracked_urls'); |
||
162 | $campaign_focus->tracked_urls->delete($campaign_focus->id,$remove_trkr_string); |
||
163 | } |
||
164 | } |
||
165 | } |
||
166 | |||
167 | |||
168 | //save campaign trackers and save if defined |
||
169 | if(isset($_REQUEST['wiz_list_of_existing_trackers'])){ |
||
170 | $tracker_strings = explode(",", $_REQUEST['wiz_list_of_existing_trackers']); |
||
171 | foreach($tracker_strings as $trkr_string){ |
||
172 | $tracker_values = explode("@@", $trkr_string); |
||
173 | $ct_focus = new CampaignTracker(); |
||
174 | $ct_focus->retrieve($tracker_values[0]); |
||
175 | if(!empty($ct_focus->tracker_name)){ |
||
176 | $ct_focus->tracker_name = $tracker_values[1]; |
||
177 | $ct_focus->is_optout = $tracker_values[2]; |
||
178 | $ct_focus->tracker_url = $tracker_values[3]; |
||
179 | $ct_focus->save(); |
||
180 | |||
181 | //load relationship and add to the list |
||
182 | $campaign_focus->load_relationship('tracked_urls'); |
||
183 | $campaign_focus->tracked_urls->add($ct_focus->id); |
||
184 | } |
||
185 | } |
||
186 | } |
||
187 | |||
188 | |||
189 | //create new campaign tracker and save if defined |
||
190 | if(isset($_REQUEST['wiz_list_of_trackers'])){ |
||
191 | $tracker_strings = explode(",", $_REQUEST['wiz_list_of_trackers']); |
||
192 | foreach($tracker_strings as $trkr_string){ |
||
193 | $tracker_values = explode("@@", $trkr_string); |
||
194 | if(count($tracker_values)==3){ |
||
195 | $ct_focus = new CampaignTracker(); |
||
196 | $ct_focus->tracker_name = $tracker_values[0]; |
||
197 | $ct_focus->is_optout = $tracker_values[1]; |
||
198 | $ct_focus->tracker_url = $tracker_values[2]; |
||
199 | $ct_focus->save(); |
||
200 | |||
201 | //load relationship and add to the list |
||
202 | $campaign_focus->load_relationship('tracked_urls'); |
||
203 | $campaign_focus->tracked_urls->add($ct_focus->id); |
||
204 | // save campaign_trkrs after populating campaign id |
||
205 | $ct_focus->save(); |
||
206 | } |
||
207 | } |
||
208 | } |
||
209 | |||
210 | //set navigation details |
||
211 | $_REQUEST['return_id'] = $campaign_focus->id; |
||
212 | $_REQUEST['return_module'] = $campaign_focus->module_dir; |
||
213 | $_REQUEST['return_action'] = "WizardNewsLetter"; |
||
214 | $_REQUEST['action'] = "WizardMarketing"; |
||
215 | $_REQUEST['record'] = $campaign_focus->id;; |
||
216 | |||
217 | $action = ''; |
||
218 | $redirectToTargetList = ''; |
||
219 | if(isset($_REQUEST['wiz_direction'])){ |
||
220 | if($_REQUEST['wiz_direction']== 'continue') { |
||
221 | $action = 'WizardMarketing'; |
||
222 | } |
||
223 | else if($_REQUEST['wiz_direction'] == 'continue_targetList') { |
||
224 | $action = 'WizardMarketing'; |
||
225 | $redirectToTargetList = '&redirectToTargetList=1'; |
||
226 | } |
||
227 | }else{ |
||
228 | $action = 'WizardHome&record='.$campaign_focus->id; |
||
229 | } |
||
230 | //require_once('modules/Campaigns/WizardMarketing.php'); |
||
231 | $header_URL = "Location: index.php?return_module=Campaigns&module=Campaigns&action=".$action.$redirectToTargetList."&campaign_id=".$campaign_focus->id."&return_action=WizardNewsLetter&return_id=".$campaign_focus->id; |
||
232 | $GLOBALS['log']->debug("about to post header URL of: $header_URL"); |
||
233 | header($header_URL); |
||
234 | |||
235 | |||
236 | |||
237 | /* |
||
238 | * This function will populate the passed in bean with the post variables |
||
239 | * that contain the specified prefix |
||
240 | */ |
||
241 | function populate_wizard_bean_from_request($bean,$prefix){ |
||
242 | foreach($_REQUEST as $key=> $val){ |
||
243 | $key = trim($key); |
||
244 | if((strstr($key, $prefix )) && (strpos($key, $prefix )== 0)){ |
||
245 | $field =substr($key, strlen($prefix)) ; |
||
246 | if(isset($_REQUEST[$key]) && !empty($_REQUEST[$key])){ |
||
247 | //echo "prefix is $prefix, field is $field, key is $key, and value is $val<br>"; |
||
248 | $value = $_REQUEST[$key]; |
||
249 | $bean->$field = $value; |
||
250 | } |
||
251 | } |
||
252 | } |
||
253 | |||
254 | return $bean; |
||
255 | } |
||
256 | |||
257 | |||
258 | /* |
||
259 | * This function will process any specified prospect lists and attach them to current campaign |
||
260 | * If no prospect lists have been specified, then it will create one for you. A total of 3 prospect lists |
||
261 | * will be created for you (Subscription, Unsubscription, and test) |
||
262 | */ |
||
263 | function process_subscriptions_from_request($campaign_name){ |
||
264 | global $mod_strings; |
||
265 | $pl_list = array(); |
||
266 | |||
267 | //process default target list |
||
268 | $create_new = true; |
||
269 | $pl_subs = new ProspectList($campaign_name); |
||
0 ignored issues
–
show
|
|||
270 | if(!empty($_REQUEST['wiz_step3_subscription_list_id'])){ |
||
271 | //if subscription list is specified then attach |
||
272 | $pl_subs->retrieve($_REQUEST['wiz_step3_subscription_list_id']); |
||
273 | //check to see name matches the bean, if not, then the user has chosen to create new bean |
||
274 | if($pl_subs->name == $_REQUEST['wiz_step3_subscription_name']){ |
||
275 | $pl_list[] = $pl_subs; |
||
276 | $create_new = false; |
||
277 | } |
||
278 | |||
279 | } |
||
280 | //create new bio if one was not retrieved successfully |
||
281 | if($create_new){ |
||
282 | //use default name if one has not been specified |
||
283 | $name = $campaign_name . " ".$mod_strings['LBL_SUBSCRIPTION_LIST']; |
||
284 | if(isset($_REQUEST['wiz_step3_subscription_name']) && !empty($_REQUEST['wiz_step3_subscription_name'])){ |
||
285 | $name = $_REQUEST['wiz_step3_subscription_name']; |
||
286 | } |
||
287 | //if subscription list is not specified then create and attach default one |
||
288 | $pl_subs->name = $name; |
||
289 | $pl_subs->list_type = 'default'; |
||
290 | $pl_subs->assigned_user_id= $GLOBALS['current_user']->id; |
||
291 | $pl_subs->save(); |
||
292 | $pl_list[] = $pl_subs; |
||
293 | } |
||
294 | |||
295 | //process exempt target list |
||
296 | $create_new = true; |
||
297 | $pl_un_subs = new ProspectList(); |
||
298 | if(!empty($_REQUEST['wiz_step3_unsubscription_list_id'])){ |
||
299 | //if unsubscription list is specified then attach |
||
300 | $pl_un_subs->retrieve($_REQUEST['wiz_step3_unsubscription_list_id']); |
||
301 | //check to see name matches the bean, if not, then the user has chosen to create new bean |
||
302 | if($pl_un_subs->name == $_REQUEST['wiz_step3_unsubscription_name']){ |
||
303 | $pl_list[] = $pl_un_subs; |
||
304 | $create_new = false; |
||
305 | } |
||
306 | |||
307 | } |
||
308 | //create new bean if one was not retrieved successfully |
||
309 | if($create_new){ |
||
310 | //use default name if one has not been specified |
||
311 | $name = $campaign_name . " ".$mod_strings['LBL_UNSUBSCRIPTION_LIST']; |
||
312 | if(isset($_REQUEST['wiz_step3_unsubscription_name']) && !empty($_REQUEST['wiz_step3_unsubscription_name'])){ |
||
313 | $name = $_REQUEST['wiz_step3_unsubscription_name']; |
||
314 | } |
||
315 | //if unsubscription list is not specified then create and attach default one |
||
316 | $pl_un_subs->name = $name; |
||
317 | $pl_un_subs->list_type = 'exempt'; |
||
318 | $pl_un_subs->assigned_user_id= $GLOBALS['current_user']->id; |
||
319 | $pl_un_subs->save(); |
||
320 | $pl_list[] = $pl_un_subs; |
||
321 | } |
||
322 | |||
323 | //process test target list |
||
324 | $pl_test = new ProspectList(); |
||
325 | $create_new = true; |
||
326 | if(!empty($_REQUEST['wiz_step3_test_list_id'])){ |
||
327 | //if test list is specified then attach |
||
328 | $pl_test->retrieve($_REQUEST['wiz_step3_test_list_id']); |
||
329 | //check to see name matches the bean, if not, then the user has chosen to create new bean |
||
330 | if($pl_test->name == $_REQUEST['wiz_step3_test_name']){ |
||
331 | $pl_list[] = $pl_test; |
||
332 | $create_new = false; |
||
333 | } |
||
334 | } |
||
335 | //create new bio if one was not retrieved successfully |
||
336 | if($create_new){ |
||
337 | //use default name if one has not been specified |
||
338 | $name = $campaign_name . " ".$mod_strings['LBL_TEST_LIST']; |
||
339 | if(isset($_REQUEST['wiz_step3_test_name']) && !empty($_REQUEST['wiz_step3_test_name'])){ |
||
340 | $name = $_REQUEST['wiz_step3_test_name']; |
||
341 | } |
||
342 | //if test list is not specified then create and attach default one |
||
343 | $pl_test->name = $name; |
||
344 | $pl_test->list_type = 'test'; |
||
345 | $pl_test->assigned_user_id= $GLOBALS['current_user']->id; |
||
346 | $pl_test->save(); |
||
347 | $pl_list[] = $pl_test; |
||
348 | } |
||
349 | |||
350 | return $pl_list; |
||
351 | } |
||
352 | ?> |
||
353 |
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.
If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.
In this case you can add the
@ignore
PhpDoc annotation to the duplicate definition and it will be ignored.