Issues in Popup_picker.php (scrutinizer-code-quality) - Issues in scrutinizer-code-quality - adamjakab/SuiteCRM - Measure and Improve Code Quality continuously with Scrutinizer

Issues (4069)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

modules/Contacts/Popup_picker.php (1 issue)

Labels

Severity

Minor 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
/*********************************************************************************
 * SugarCRM Community Edition is a customer relationship management program developed by
 * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc.

 * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd.
 * Copyright (C) 2011 - 2014 Salesagility Ltd.
 *
 * This program is free software; you can redistribute it and/or modify it under
 * the terms of the GNU Affero General Public License version 3 as published by the
 * Free Software Foundation with the addition of the following permission added
 * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
 * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY
 * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
 * FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
 * details.
 *
 * You should have received a copy of the GNU Affero General Public License along with
 * this program; if not, see http://www.gnu.org/licenses or write to the Free
 * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301 USA.
 *
 * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road,
 * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected].
 *
 * The interactive user interfaces in modified source and object code versions
 * of this program must display Appropriate Legal Notices, as required under
 * Section 5 of the GNU Affero General Public License version 3.
 *
 * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
 * these Appropriate Legal Notices must retain the display of the "Powered by
 * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not
 * reasonably feasible for  technical reasons, the Appropriate Legal Notices must
 * display the words  "Powered by SugarCRM" and "Supercharged by SuiteCRM".
 ********************************************************************************/


require_once('modules/Contacts/ContactFormBase.php');

class Popup_Picker

{
	/*
	 *
	 */
	function _get_where_clause()
	{
		$where = '';
		if(isset($_REQUEST['query']))
		{
			$where_clauses = array();
			append_where_clause($where_clauses, "first_name", "contacts.first_name");
			append_where_clause($where_clauses, "last_name", "contacts.last_name");
			append_where_clause($where_clauses, "account_name", "accounts.name");
			append_where_clause($where_clauses, "account_id", "accounts.id");
			$where = generate_where_statement($where_clauses);
		}
		return $where;
	}

	/**
	 *
	 */
	function process_page_for_address()
	{
		global $theme;
		global $mod_strings;
		global $app_strings;
		global $currentModule;
		global $sugar_version, $sugar_config;

		$output_html = '';
		$where = '';

		$where = $this->_get_where_clause();


		$formBase = new ContactFormBase();
		if(isset($_REQUEST['doAction']) && $_REQUEST['doAction'] == 'save')
		{
			$formBase->handleSave('', false, true);
		}

		$first_name = empty($_REQUEST['first_name']) ? '' : $_REQUEST['first_name'];
		$last_name = empty($_REQUEST['last_name']) ? '' : $_REQUEST['last_name'];
		$account_name = empty($_REQUEST['account_name']) ? '' : $_REQUEST['account_name'];
		$request_data = empty($_REQUEST['request_data']) ? '' : $_REQUEST['request_data'];
		$hide_clear_button = empty($_REQUEST['hide_clear_button']) ? false : true;
		$lbl_save_button_title = $app_strings['LBL_SAVE_BUTTON_TITLE'];
		$lbl_save_button_key = $app_strings['LBL_SAVE_BUTTON_KEY'];
		$lbl_save_button_label = $app_strings['LBL_SAVE_BUTTON_LABEL'];

		// TODO: cleanup the construction of $addform
		$formbody = $formBase->getFormBody('','','EmailEditView');
		$addform = '<table><tr><td nowrap="nowrap" valign="top">'
			.str_replace('<br>', '</td><td nowrap="nowrap" valign="top">&nbsp;', $formbody)
			. '</td></tr></table>'
			. '<input type="hidden" name="action" value="Popup" />';
		$formSave = <<<EOQ
		<input type="submit" name="button" class="button" title="$lbl_save_button_title" value="  $lbl_save_button_label  " />
		<input type="button" name="button" class="button" title="{$app_strings['LBL_CANCEL_BUTTON_TITLE']}" accesskey="{$app_strings['LBL_CANCEL_BUTTON_KEY']}" value="{$app_strings['LBL_CANCEL_BUTTON_LABEL']}" onclick="toggleDisplay('addform');" />
EOQ;
		$createContact = <<<EOQ
		<input type="button" id="showAdd" name="showAdd" class="button" value="{$mod_strings['LNK_NEW_CONTACT']}" onclick="toggleDisplay('addform');" />
EOQ;
		$addformheader = get_form_header($mod_strings['LNK_NEW_CONTACT'], $formSave, false);
		$button  = "<form action='index.php' method='post' name='form' id='form'>\n";
		if(!$hide_clear_button)
		{
			$button .= "<input type='button' name='button' class='button' onclick=\"send_back('','');\" title='"
				.$app_strings['LBL_CLEAR_BUTTON_TITLE']."' value='  "
				.$app_strings['LBL_CLEAR_BUTTON_LABEL']."  ' />\n";
		}
		$button .= "<input type='submit' name='button' class='button' onclick=\"window.close();\" title='"
			.$app_strings['LBL_CANCEL_BUTTON_TITLE']."' accesskey='"
			.$app_strings['LBL_CANCEL_BUTTON_KEY']."' value='  "
			.$app_strings['LBL_CANCEL_BUTTON_LABEL']."  ' />\n";
		$button .= "</form>\n";

		$form = new XTemplate('modules/Contacts/Address_picker.html');
		$form->assign('MOD', $mod_strings);
		$form->assign('APP', $app_strings);
		$form->assign('ADDFORMHEADER', $addformheader);
		$form->assign('ADDFORM', $addform);
		$form->assign('THEME', $theme);
		$form->assign('MODULE_NAME', $currentModule);
		$form->assign('FIRST_NAME', $first_name);
		$form->assign('LAST_NAME', $last_name);
		$form->assign('ACCOUNT_NAME', $account_name);
		$form->assign('request_data', $request_data);

		// fill in for mass update
		$button = "<input type='hidden' name='module' value='Contacts'>".
		          "<input type='hidden' id='form_action' name='action' value='CloseContactAddressPopup'>".
		          "<input type='hidden' name='massupdate' value='true'>".
		          "<input type='hidden' name='delete' value='false'>".
		          "<input type='hidden' name='mass' value='Array'>".
		          "<input type='hidden' name='Update' value='Update'>";

		if(isset($_REQUEST['mass']) && is_array($_REQUEST['mass'])) {
			foreach(array_unique($_REQUEST['mass']) as $record) {
				$button .= "<input style='display: none' checked type='checkbox' name='mass[]' value='$record'>\n";
			}
		}

		$button .= "<input type='hidden' name='query' value='true'>";
		$button .= "<input type='hidden' name='saved_associated_data' value=''>";
		$button .= "<input type='hidden' name='close_window' value='true'>";
		$button .= "<input type='hidden' name='html' value='change_address'>";
		$button .= "<input type='hidden' name='account_name' value='$account_name'>";
        // Added ID attribute to each element to use getElementById. To give ID attribute to an element is a good practice.
		$button .= "<span style='display: none'><textarea name='primary_address_street' id='primary_address_street'>" . str_replace("&lt;br&gt;", "\n", $_REQUEST["primary_address_street"]) . "</textarea></span>";
		$button .= "<input type='hidden' name='primary_address_city' id='primary_address_city' value='". $_REQUEST["primary_address_city"] ."'>";
		$button .= "<input type='hidden' name='primary_address_state' id='primary_address_state' value='". $_REQUEST["primary_address_state"] ."'>";
		$button .= "<input type='hidden' name='primary_address_postalcode' id='primary_address_postalcode' value='". $_REQUEST["primary_address_postalcode"] ."'>";
		$button .= "<input type='hidden' name='primary_address_country' id='primary_address_country' value='". $_REQUEST["primary_address_country"] ."'>";
		// Adding an onclick event to remove address for alternate address, as user has selected copy address to primary address
		$button .= "<input title='".$mod_strings['LBL_COPY_ADDRESS_CHECKED_PRIMARY']."'  class='button' LANGUAGE=javascript type='submit' name='button' value='  ".$mod_strings['LBL_COPY_ADDRESS_CHECKED_PRIMARY']."  ' onclick='clearAddress(\"alt\");'>\n";
		// Adding a new block of code copy the address to alternate address for contacts
		$button .= "<span style='display: none'><textarea name='alt_address_street' id='alt_address_street'>" . str_replace("&lt;br&gt;", "\n", $_REQUEST["primary_address_street"]) . "</textarea></span>";
		$button .= "<input type='hidden' name='alt_address_city' id='alt_address_city' value='". $_REQUEST["primary_address_city"] ."'>";
		$button .= "<input type='hidden' name='alt_address_state' id='alt_address_state' value='". $_REQUEST["primary_address_state"] ."'>";
		$button .= "<input type='hidden' name='alt_address_postalcode' id='alt_address_postalcode' value='". $_REQUEST["primary_address_postalcode"] ."'>";
		$button .= "<input type='hidden' name='alt_address_country' id='alt_address_country' value='". $_REQUEST["primary_address_country"] ."'>";
		// Adding an onclick event to remove address for primary address, as user has selected copy address to alternate address
		// NOTE => You need to change the label as as per SugarCRM way..
		$button .= "<input title='".$mod_strings['LBL_COPY_ADDRESS_CHECKED_ALT']."'  class='button' LANGUAGE=javascript type='submit' name='button' value='  ".$mod_strings['LBL_COPY_ADDRESS_CHECKED_ALT']."  ' onclick='clearAddress(\"primary\");'>\n";
		$button .= "<input title='".$app_strings['LBL_CANCEL_BUTTON_TITLE']."' accessKey='".$app_strings['LBL_CANCEL_BUTTON_KEY']."' class='button' LANGUAGE=javascript onclick=\"window.close()\" type='submit' name='button' value='  ".$app_strings['LBL_CANCEL_BUTTON_LABEL']."  '>\n";
		ob_start();
		insert_popup_header($theme);
		$output_html .= ob_get_contents();
		ob_end_clean();

		// Reset the sections that are already in the page so that they do not print again later.
		$form->reset('main.SearchHeader');

		// create the listview
		$seed_bean = new Contact();
		$ListView = new ListView();
		$ListView->show_export_button = false;
		$ListView->process_for_popups = true;
		$ListView->show_delete_button = false;
		$ListView->show_select_menu = false;
		$ListView->setXTemplate($form);
		$ListView->setHeaderTitle($mod_strings['LBL_LIST_FORM_TITLE']);
		$ListView->setHeaderText($button);
		$ListView->setQuery($where, '', '', 'CONTACT');
		$ListView->setModStrings($mod_strings);

		ob_start();
		$ListView->processListViewMulti($seed_bean, 'main', 'CONTACT');
		$output_html .= ob_get_contents();
		ob_end_clean();

        // Regular Expression to override sListView
        $exp = '/sListView.save_checks/si';
        $change = 'save_checks';
        $output_html = preg_replace(array($exp), array($change), $output_html);

		$output_html .= <<<EOJS
        <script type="text/javascript">
        <!--
        // Function to clear address according to the buttons clicked.
        function clearAddress(key)
        {
            document.getElementById(key+"_address_street").value = "";
            document.getElementById(key+"_address_city").value = "";
            document.getElementById(key+"_address_state").value = "";
            document.getElementById(key+"_address_postalcode").value = "";
            document.getElementById(key+"_address_country").value = "";
        }
        checked_items = Array();
        inputs_array = document.MassUpdate.elements;

        for(wp = 0 ; wp < inputs_array.length; wp++) {
            if(inputs_array[wp].name == "mass[]" && inputs_array[wp].style.display == "none") {
                checked_items.push(inputs_array[wp].value);
            }
        }
        for(i in checked_items) {
            for(wp = 0 ; wp < inputs_array.length; wp++) {
                if(inputs_array[wp].name == "mass[]" && inputs_array[wp].value == checked_items[i]) {
                    inputs_array[wp].checked = true;
                }
            }
        }
        -->
        </script>
EOJS;

		$output_html .= insert_popup_footer();
		return $output_html;
	}

	function process_page_for_merge()
	{
		global $theme;
		global $mod_strings;
		global $app_strings;
		global $currentModule;
		global $sugar_version, $sugar_config;

		$output_html = '';
		$where = '';

		$where = $this->_get_where_clause();

		$first_name = empty($_REQUEST['first_name']) ? '' : $_REQUEST['first_name'];
		$last_name = empty($_REQUEST['last_name']) ? '' : $_REQUEST['last_name'];
		$account_name = empty($_REQUEST['account_name']) ? '' : $_REQUEST['account_name'];
		$hide_clear_button = empty($_REQUEST['hide_clear_button']) ? false : true;
		$button  = "<form action='index.php' method='post' name='form' id='form'>\n";
		//START:FOR MULTI-SELECT
		$multi_select=false;
		if (!empty($_REQUEST['mode']) && strtoupper($_REQUEST['mode']) == 'MULTISELECT') {
			$multi_select=true;
			$button .= "<input type='button' name='button' class='button' onclick=\"send_back_selected('Contacts',document.MassUpdate,'mass[]','" .$app_strings['ERR_NOTHING_SELECTED']."');\" title='"
				.$app_strings['LBL_SELECT_BUTTON_TITLE']."' accesskey='"
				.$app_strings['LBL_SELECT_BUTTON_KEY']."' value='  "
				.$app_strings['LBL_SELECT_BUTTON_LABEL']."  ' />\n";
		}
		//END:FOR MULTI-SELECT
		if(!$hide_clear_button)
		{
			$button .= "<input type='button' name='button' class='button' onclick=\"send_back('','');\" title='"
				.$app_strings['LBL_CLEAR_BUTTON_TITLE']."' value='  "
				.$app_strings['LBL_CLEAR_BUTTON_LABEL']."  ' />\n";
		}
		$button .= "<input type='submit' name='button' class='button' onclick=\"window.close();\" title='"
			.$app_strings['LBL_CANCEL_BUTTON_TITLE']."' accesskey='"
			.$app_strings['LBL_CANCEL_BUTTON_KEY']."' value='  "
			.$app_strings['LBL_CANCEL_BUTTON_LABEL']."  ' />\n";
		$button .= "</form>\n";

		$form = new XTemplate('modules/Contacts/MailMergePicker.html');
		$form->assign('MOD', $mod_strings);
		$form->assign('APP', $app_strings);
		$form->assign('THEME', $theme);
		$form->assign('MODULE_NAME', $currentModule);
		$form->assign('FIRST_NAME', $first_name);
		$form->assign('LAST_NAME', $last_name);
		$form->assign('ACCOUNT_NAME', $account_name);
		$request_data = empty($_REQUEST['request_data']) ? '' : $_REQUEST['request_data'];
		$form->assign('request_data', $request_data);

		ob_start();
		insert_popup_header($theme);
		$output_html .= ob_get_contents();
		ob_end_clean();

		$output_html .= get_form_header($mod_strings['LBL_SEARCH_FORM_TITLE'], '', false);

		$form->parse('main.SearchHeader');
		$output_html .= $form->text('main.SearchHeader');

		// Reset the sections that are already in the page so that they do not print again later.
		$form->reset('main.SearchHeader');

		// create the listview
		$seed_bean = new Contact();
		$ListView = new ListView();
		$ListView->display_header_and_footer=false;
		$ListView->show_export_button = false;
		$ListView->process_for_popups = true;
		$ListView->setXTemplate($form);
		$ListView->multi_select_popup=$multi_select;
		if ($multi_select) $ListView->xTemplate->assign("TAG_TYPE","SPAN"); else  $ListView->xTemplate->assign("TAG_TYPE","A");
		$ListView->setHeaderTitle($mod_strings['LBL_LIST_FORM_TITLE']);
		$ListView->setQuery($where, '', 'contacts.last_name, contacts.first_name', 'CONTACT');
		$ListView->setModStrings($mod_strings);

		ob_start();
		$output_html .= get_form_header($mod_strings['LBL_LIST_FORM_TITLE'], $button, false);
				//BEGIN ATHENA CUSTOMIZATION - rsmith
        require_once('modules/MailMerge/merge_query.php');
        $rel_module = empty($_REQUEST['rel_module'])?'': $_REQUEST['rel_module'];
        $id = empty($_REQUEST['id'])?'': $_REQUEST['id'];

		$query = get_merge_query($seed_bean, $rel_module, $id);
		$result = $seed_bean->db->query($query,true,"Error retrieving $seed_bean->object_name list: ");

			$list = Array();
				while(($row = $seed_bean->db->fetchByAssoc($result)) != null)
			    	{
						$seed_bean = new Contact();
						foreach($seed_bean->field_defs as $field=>$value)
						{
							if (isset($row[$field]))
							{
								$seed_bean->$field = $row[$field];
							}
							else if (isset($row[$seed_bean->table_name .'.'.$field]))
							{
								$seed_bean->$field = $row[$seed_bean->table_name .'.'.$field];
							}
							else
							{
								$seed_bean->$field = "";
							}
						}
						$seed_bean->fill_in_additional_list_fields();

						$list[] = $seed_bean;
			    	}

			$ListView->processListViewTwo($list, 'main', 'CONTACT');

		//END ATHENA CUSTOMIZATION - rsmith
		$output_html .= ob_get_contents();
		ob_end_clean();

		$output_html .= insert_popup_footer();
		return $output_html;

	}
}


1			<?php
2			if(!defined('sugarEntry') \|\| !sugarEntry) die('Not A Valid Entry Point');
3			/*********************************************************************************
4			* SugarCRM Community Edition is a customer relationship management program developed by
5			* SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc.
6
7			* SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd.
8			* Copyright (C) 2011 - 2014 Salesagility Ltd.
9			*
10			* This program is free software; you can redistribute it and/or modify it under
11			* the terms of the GNU Affero General Public License version 3 as published by the
12			* Free Software Foundation with the addition of the following permission added
13			* to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
14			* IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY
15			* OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
16			*
17			* This program is distributed in the hope that it will be useful, but WITHOUT
18			* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
19			* FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
20			* details.
21			*
22			* You should have received a copy of the GNU Affero General Public License along with
23			* this program; if not, see http://www.gnu.org/licenses or write to the Free
24			* Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
25			* 02110-1301 USA.
26			*
27			* You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road,
28			* SW2-130, Cupertino, CA 95014, USA. or at email address [email protected].
29			*
30			* The interactive user interfaces in modified source and object code versions
31			* of this program must display Appropriate Legal Notices, as required under
32			* Section 5 of the GNU Affero General Public License version 3.
33			*
34			* In accordance with Section 7(b) of the GNU Affero General Public License version 3,
35			* these Appropriate Legal Notices must retain the display of the "Powered by
36			* SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not
37			* reasonably feasible for technical reasons, the Appropriate Legal Notices must
38			* display the words "Powered by SugarCRM" and "Supercharged by SuiteCRM".
39			********************************************************************************/
40
41
42			require_once('modules/Contacts/ContactFormBase.php');
43
44			class Popup_Picker
			0 ignored issues – show Comprehensibility Best Practice introduced 2016-03-07 17:58 UTC by Report Bug Copy Issue Report Show Similar Issues like this The type `Popup_Picker` has been defined more than once; this definition is ignored, only the first definition in `include/Popups/Popup_picker.php` (L47-356) is considered. This check looks for classes that have been defined more than once. If you can, we would recommend to use standard object-oriented programming techniques. For example, to avoid multiple types, it might make sense to create a common interface, and then multiple, different implementations for that interface. This also has the side-effect of providing you with better IDE auto-completion, static analysis and also better OPCode caching from PHP. Loading history...
45			{
46			/*
47			*
48			*/
49			function _get_where_clause()
50			{
51			$where = '';
52			if(isset($_REQUEST['query']))
53			{
54			$where_clauses = array();
55			append_where_clause($where_clauses, "first_name", "contacts.first_name");
56			append_where_clause($where_clauses, "last_name", "contacts.last_name");
57			append_where_clause($where_clauses, "account_name", "accounts.name");
58			append_where_clause($where_clauses, "account_id", "accounts.id");
59			$where = generate_where_statement($where_clauses);
60			}
61			return $where;
62			}
63
64			/**
65			*
66			*/
67			function process_page_for_address()
68			{
69			global $theme;
70			global $mod_strings;
71			global $app_strings;
72			global $currentModule;
73			global $sugar_version, $sugar_config;
74
75			$output_html = '';
76			$where = '';
77
78			$where = $this->_get_where_clause();
79
80
81			$formBase = new ContactFormBase();
82			if(isset($_REQUEST['doAction']) && $_REQUEST['doAction'] == 'save')
83			{
84			$formBase->handleSave('', false, true);
85			}
86
87			$first_name = empty($_REQUEST['first_name']) ? '' : $_REQUEST['first_name'];
88			$last_name = empty($_REQUEST['last_name']) ? '' : $_REQUEST['last_name'];
89			$account_name = empty($_REQUEST['account_name']) ? '' : $_REQUEST['account_name'];
90			$request_data = empty($_REQUEST['request_data']) ? '' : $_REQUEST['request_data'];
91			$hide_clear_button = empty($_REQUEST['hide_clear_button']) ? false : true;
92			$lbl_save_button_title = $app_strings['LBL_SAVE_BUTTON_TITLE'];
93			$lbl_save_button_key = $app_strings['LBL_SAVE_BUTTON_KEY'];
94			$lbl_save_button_label = $app_strings['LBL_SAVE_BUTTON_LABEL'];
95
96			// TODO: cleanup the construction of $addform
97			$formbody = $formBase->getFormBody('','','EmailEditView');
98			$addform = '<table><tr><td nowrap="nowrap" valign="top">'
99			.str_replace('<br>', '</td><td nowrap="nowrap" valign="top"> ', $formbody)
100			. '</td></tr></table>'
101			. '<input type="hidden" name="action" value="Popup" />';
102			$formSave = <<<EOQ
103			<input type="submit" name="button" class="button" title="$lbl_save_button_title" value=" $lbl_save_button_label " />
104			<input type="button" name="button" class="button" title="{$app_strings['LBL_CANCEL_BUTTON_TITLE']}" accesskey="{$app_strings['LBL_CANCEL_BUTTON_KEY']}" value="{$app_strings['LBL_CANCEL_BUTTON_LABEL']}" onclick="toggleDisplay('addform');" />
105			EOQ;
106			$createContact = <<<EOQ
107			<input type="button" id="showAdd" name="showAdd" class="button" value="{$mod_strings['LNK_NEW_CONTACT']}" onclick="toggleDisplay('addform');" />
108			EOQ;
109			$addformheader = get_form_header($mod_strings['LNK_NEW_CONTACT'], $formSave, false);
110			$button = "<form action='index.php' method='post' name='form' id='form'>\n";
111			if(!$hide_clear_button)
112			{
113			$button .= "<input type='button' name='button' class='button' onclick=\"send_back('','');\" title='"
114			.$app_strings['LBL_CLEAR_BUTTON_TITLE']."' value=' "
115			.$app_strings['LBL_CLEAR_BUTTON_LABEL']." ' />\n";
116			}
117			$button .= "<input type='submit' name='button' class='button' onclick=\"window.close();\" title='"
118			.$app_strings['LBL_CANCEL_BUTTON_TITLE']."' accesskey='"
119			.$app_strings['LBL_CANCEL_BUTTON_KEY']."' value=' "
120			.$app_strings['LBL_CANCEL_BUTTON_LABEL']." ' />\n";
121			$button .= "</form>\n";
122
123			$form = new XTemplate('modules/Contacts/Address_picker.html');
124			$form->assign('MOD', $mod_strings);
125			$form->assign('APP', $app_strings);
126			$form->assign('ADDFORMHEADER', $addformheader);
127			$form->assign('ADDFORM', $addform);
128			$form->assign('THEME', $theme);
129			$form->assign('MODULE_NAME', $currentModule);
130			$form->assign('FIRST_NAME', $first_name);
131			$form->assign('LAST_NAME', $last_name);
132			$form->assign('ACCOUNT_NAME', $account_name);
133			$form->assign('request_data', $request_data);
134
135			// fill in for mass update
136			$button = "<input type='hidden' name='module' value='Contacts'>".
137			"<input type='hidden' id='form_action' name='action' value='CloseContactAddressPopup'>".
138			"<input type='hidden' name='massupdate' value='true'>".
139			"<input type='hidden' name='delete' value='false'>".
140			"<input type='hidden' name='mass' value='Array'>".
141			"<input type='hidden' name='Update' value='Update'>";
142
143			if(isset($_REQUEST['mass']) && is_array($_REQUEST['mass'])) {
144			foreach(array_unique($_REQUEST['mass']) as $record) {
145			$button .= "<input style='display: none' checked type='checkbox' name='mass[]' value='$record'>\n";
146			}
147			}
148
149			$button .= "<input type='hidden' name='query' value='true'>";
150			$button .= "<input type='hidden' name='saved_associated_data' value=''>";
151			$button .= "<input type='hidden' name='close_window' value='true'>";
152			$button .= "<input type='hidden' name='html' value='change_address'>";
153			$button .= "<input type='hidden' name='account_name' value='$account_name'>";
154			// Added ID attribute to each element to use getElementById. To give ID attribute to an element is a good practice.
155			$button .= "<span style='display: none'><textarea name='primary_address_street' id='primary_address_street'>" . str_replace("<br>", "\n", $_REQUEST["primary_address_street"]) . "</textarea></span>";
156			$button .= "<input type='hidden' name='primary_address_city' id='primary_address_city' value='". $_REQUEST["primary_address_city"] ."'>";
157			$button .= "<input type='hidden' name='primary_address_state' id='primary_address_state' value='". $_REQUEST["primary_address_state"] ."'>";
158			$button .= "<input type='hidden' name='primary_address_postalcode' id='primary_address_postalcode' value='". $_REQUEST["primary_address_postalcode"] ."'>";
159			$button .= "<input type='hidden' name='primary_address_country' id='primary_address_country' value='". $_REQUEST["primary_address_country"] ."'>";
160			// Adding an onclick event to remove address for alternate address, as user has selected copy address to primary address
161			$button .= "<input title='".$mod_strings['LBL_COPY_ADDRESS_CHECKED_PRIMARY']."' class='button' LANGUAGE=javascript type='submit' name='button' value=' ".$mod_strings['LBL_COPY_ADDRESS_CHECKED_PRIMARY']." ' onclick='clearAddress(\"alt\");'>\n";
162			// Adding a new block of code copy the address to alternate address for contacts
163			$button .= "<span style='display: none'><textarea name='alt_address_street' id='alt_address_street'>" . str_replace("<br>", "\n", $_REQUEST["primary_address_street"]) . "</textarea></span>";
164			$button .= "<input type='hidden' name='alt_address_city' id='alt_address_city' value='". $_REQUEST["primary_address_city"] ."'>";
165			$button .= "<input type='hidden' name='alt_address_state' id='alt_address_state' value='". $_REQUEST["primary_address_state"] ."'>";
166			$button .= "<input type='hidden' name='alt_address_postalcode' id='alt_address_postalcode' value='". $_REQUEST["primary_address_postalcode"] ."'>";
167			$button .= "<input type='hidden' name='alt_address_country' id='alt_address_country' value='". $_REQUEST["primary_address_country"] ."'>";
168			// Adding an onclick event to remove address for primary address, as user has selected copy address to alternate address
169			// NOTE => You need to change the label as as per SugarCRM way..
170			$button .= "<input title='".$mod_strings['LBL_COPY_ADDRESS_CHECKED_ALT']."' class='button' LANGUAGE=javascript type='submit' name='button' value=' ".$mod_strings['LBL_COPY_ADDRESS_CHECKED_ALT']." ' onclick='clearAddress(\"primary\");'>\n";
171			$button .= "<input title='".$app_strings['LBL_CANCEL_BUTTON_TITLE']."' accessKey='".$app_strings['LBL_CANCEL_BUTTON_KEY']."' class='button' LANGUAGE=javascript onclick=\"window.close()\" type='submit' name='button' value=' ".$app_strings['LBL_CANCEL_BUTTON_LABEL']." '>\n";
172			ob_start();
173			insert_popup_header($theme);
174			$output_html .= ob_get_contents();
175			ob_end_clean();
176
177			// Reset the sections that are already in the page so that they do not print again later.
178			$form->reset('main.SearchHeader');
179
180			// create the listview
181			$seed_bean = new Contact();
182			$ListView = new ListView();
183			$ListView->show_export_button = false;
184			$ListView->process_for_popups = true;
185			$ListView->show_delete_button = false;
186			$ListView->show_select_menu = false;
187			$ListView->setXTemplate($form);
188			$ListView->setHeaderTitle($mod_strings['LBL_LIST_FORM_TITLE']);
189			$ListView->setHeaderText($button);
190			$ListView->setQuery($where, '', '', 'CONTACT');
191			$ListView->setModStrings($mod_strings);
192
193			ob_start();
194			$ListView->processListViewMulti($seed_bean, 'main', 'CONTACT');
195			$output_html .= ob_get_contents();
196			ob_end_clean();
197
198			// Regular Expression to override sListView
199			$exp = '/sListView.save_checks/si';
200			$change = 'save_checks';
201			$output_html = preg_replace(array($exp), array($change), $output_html);
202
203			$output_html .= <<<EOJS
204			<script type="text/javascript">
205			<!--
206			// Function to clear address according to the buttons clicked.
207			function clearAddress(key)
208			{
209			document.getElementById(key+"_address_street").value = "";
210			document.getElementById(key+"_address_city").value = "";
211			document.getElementById(key+"_address_state").value = "";
212			document.getElementById(key+"_address_postalcode").value = "";
213			document.getElementById(key+"_address_country").value = "";
214			}
215			checked_items = Array();
216			inputs_array = document.MassUpdate.elements;
217
218			for(wp = 0 ; wp < inputs_array.length; wp++) {
219			if(inputs_array[wp].name == "mass[]" && inputs_array[wp].style.display == "none") {
220			checked_items.push(inputs_array[wp].value);
221			}
222			}
223			for(i in checked_items) {
224			for(wp = 0 ; wp < inputs_array.length; wp++) {
225			if(inputs_array[wp].name == "mass[]" && inputs_array[wp].value == checked_items[i]) {
226			inputs_array[wp].checked = true;
227			}
228			}
229			}
230			-->
231			</script>
232			EOJS;
233
234			$output_html .= insert_popup_footer();
235			return $output_html;
236			}
237
238			function process_page_for_merge()
239			{
240			global $theme;
241			global $mod_strings;
242			global $app_strings;
243			global $currentModule;
244			global $sugar_version, $sugar_config;
245
246			$output_html = '';
247			$where = '';
248
249			$where = $this->_get_where_clause();
250
251			$first_name = empty($_REQUEST['first_name']) ? '' : $_REQUEST['first_name'];
252			$last_name = empty($_REQUEST['last_name']) ? '' : $_REQUEST['last_name'];
253			$account_name = empty($_REQUEST['account_name']) ? '' : $_REQUEST['account_name'];
254			$hide_clear_button = empty($_REQUEST['hide_clear_button']) ? false : true;
255			$button = "<form action='index.php' method='post' name='form' id='form'>\n";
256			//START:FOR MULTI-SELECT
257			$multi_select=false;
258			if (!empty($_REQUEST['mode']) && strtoupper($_REQUEST['mode']) == 'MULTISELECT') {
259			$multi_select=true;
260			$button .= "<input type='button' name='button' class='button' onclick=\"send_back_selected('Contacts',document.MassUpdate,'mass[]','" .$app_strings['ERR_NOTHING_SELECTED']."');\" title='"
261			.$app_strings['LBL_SELECT_BUTTON_TITLE']."' accesskey='"
262			.$app_strings['LBL_SELECT_BUTTON_KEY']."' value=' "
263			.$app_strings['LBL_SELECT_BUTTON_LABEL']." ' />\n";
264			}
265			//END:FOR MULTI-SELECT
266			if(!$hide_clear_button)
267			{
268			$button .= "<input type='button' name='button' class='button' onclick=\"send_back('','');\" title='"
269			.$app_strings['LBL_CLEAR_BUTTON_TITLE']."' value=' "
270			.$app_strings['LBL_CLEAR_BUTTON_LABEL']." ' />\n";
271			}
272			$button .= "<input type='submit' name='button' class='button' onclick=\"window.close();\" title='"
273			.$app_strings['LBL_CANCEL_BUTTON_TITLE']."' accesskey='"
274			.$app_strings['LBL_CANCEL_BUTTON_KEY']."' value=' "
275			.$app_strings['LBL_CANCEL_BUTTON_LABEL']." ' />\n";
276			$button .= "</form>\n";
277
278			$form = new XTemplate('modules/Contacts/MailMergePicker.html');
279			$form->assign('MOD', $mod_strings);
280			$form->assign('APP', $app_strings);
281			$form->assign('THEME', $theme);
282			$form->assign('MODULE_NAME', $currentModule);
283			$form->assign('FIRST_NAME', $first_name);
284			$form->assign('LAST_NAME', $last_name);
285			$form->assign('ACCOUNT_NAME', $account_name);
286			$request_data = empty($_REQUEST['request_data']) ? '' : $_REQUEST['request_data'];
287			$form->assign('request_data', $request_data);
288
289			ob_start();
290			insert_popup_header($theme);
291			$output_html .= ob_get_contents();
292			ob_end_clean();
293
294			$output_html .= get_form_header($mod_strings['LBL_SEARCH_FORM_TITLE'], '', false);
295
296			$form->parse('main.SearchHeader');
297			$output_html .= $form->text('main.SearchHeader');
298
299			// Reset the sections that are already in the page so that they do not print again later.
300			$form->reset('main.SearchHeader');
301
302			// create the listview
303			$seed_bean = new Contact();
304			$ListView = new ListView();
305			$ListView->display_header_and_footer=false;
306			$ListView->show_export_button = false;
307			$ListView->process_for_popups = true;
308			$ListView->setXTemplate($form);
309			$ListView->multi_select_popup=$multi_select;
310			if ($multi_select) $ListView->xTemplate->assign("TAG_TYPE","SPAN"); else $ListView->xTemplate->assign("TAG_TYPE","A");
311			$ListView->setHeaderTitle($mod_strings['LBL_LIST_FORM_TITLE']);
312			$ListView->setQuery($where, '', 'contacts.last_name, contacts.first_name', 'CONTACT');
313			$ListView->setModStrings($mod_strings);
314
315			ob_start();
316			$output_html .= get_form_header($mod_strings['LBL_LIST_FORM_TITLE'], $button, false);
317			//BEGIN ATHENA CUSTOMIZATION - rsmith
318			require_once('modules/MailMerge/merge_query.php');
319			$rel_module = empty($_REQUEST['rel_module'])?'': $_REQUEST['rel_module'];
320			$id = empty($_REQUEST['id'])?'': $_REQUEST['id'];
321
322			$query = get_merge_query($seed_bean, $rel_module, $id);
323			$result = $seed_bean->db->query($query,true,"Error retrieving $seed_bean->object_name list: ");
324
325			$list = Array();
326			while(($row = $seed_bean->db->fetchByAssoc($result)) != null)
327			{
328			$seed_bean = new Contact();
329			foreach($seed_bean->field_defs as $field=>$value)
330			{
331			if (isset($row[$field]))
332			{
333			$seed_bean->$field = $row[$field];
334			}
335			else if (isset($row[$seed_bean->table_name .'.'.$field]))
336			{
337			$seed_bean->$field = $row[$seed_bean->table_name .'.'.$field];
338			}
339			else
340			{
341			$seed_bean->$field = "";
342			}
343			}
344			$seed_bean->fill_in_additional_list_fields();
345
346			$list[] = $seed_bean;
347			}
348
349			$ListView->processListViewTwo($list, 'main', 'CONTACT');
350
351			//END ATHENA CUSTOMIZATION - rsmith
352			$output_html .= ob_get_contents();
353			ob_end_clean();
354
355			$output_html .= insert_popup_footer();
356			return $output_html;
357
358			}
359			}
360

adamjakab / SuiteCRM

Issues (4069)

Security Analysis not enabled

modules/Contacts/Popup_picker.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like