This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | 1 | if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point'); |
|
3 | /********************************************************************************* |
||
4 | * SugarCRM Community Edition is a customer relationship management program developed by |
||
5 | * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc. |
||
6 | |||
7 | * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd. |
||
8 | * Copyright (C) 2011 - 2014 Salesagility Ltd. |
||
9 | * |
||
10 | * This program is free software; you can redistribute it and/or modify it under |
||
11 | * the terms of the GNU Affero General Public License version 3 as published by the |
||
12 | * Free Software Foundation with the addition of the following permission added |
||
13 | * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK |
||
14 | * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY |
||
15 | * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS. |
||
16 | * |
||
17 | * This program is distributed in the hope that it will be useful, but WITHOUT |
||
18 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS |
||
19 | * FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more |
||
20 | * details. |
||
21 | * |
||
22 | * You should have received a copy of the GNU Affero General Public License along with |
||
23 | * this program; if not, see http://www.gnu.org/licenses or write to the Free |
||
24 | * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
||
25 | * 02110-1301 USA. |
||
26 | * |
||
27 | * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road, |
||
28 | * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected]. |
||
29 | * |
||
30 | * The interactive user interfaces in modified source and object code versions |
||
31 | * of this program must display Appropriate Legal Notices, as required under |
||
32 | * Section 5 of the GNU Affero General Public License version 3. |
||
33 | * |
||
34 | * In accordance with Section 7(b) of the GNU Affero General Public License version 3, |
||
35 | * these Appropriate Legal Notices must retain the display of the "Powered by |
||
36 | * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not |
||
37 | * reasonably feasible for technical reasons, the Appropriate Legal Notices must |
||
38 | * display the words "Powered by SugarCRM" and "Supercharged by SuiteCRM". |
||
39 | ********************************************************************************/ |
||
40 | |||
41 | /********************************************************************************* |
||
42 | |||
43 | * Description: TODO: To be written. |
||
44 | * Portions created by SugarCRM are Copyright (C) SugarCRM, Inc. |
||
45 | * All Rights Reserved. |
||
46 | * Contributor(s): ______________________________________.. |
||
47 | ********************************************************************************/ |
||
48 | |||
49 | |||
50 | |||
51 | |||
52 | 1 | require_once('include/upload_file.php'); |
|
53 | |||
54 | // User is used to store Forecast information. |
||
55 | class DocumentRevision extends SugarBean { |
||
56 | |||
57 | var $id; |
||
58 | var $document_id; |
||
59 | var $doc_id; |
||
60 | var $doc_type; |
||
61 | var $doc_url; |
||
62 | var $date_entered; |
||
63 | var $created_by; |
||
64 | var $filename; |
||
65 | var $file_mime_type; |
||
66 | var $revision; |
||
67 | var $change_log; |
||
68 | var $document_name; |
||
69 | var $latest_revision; |
||
70 | var $file_url; |
||
71 | var $file_ext; |
||
72 | var $created_by_name; |
||
73 | |||
74 | var $img_name; |
||
75 | var $img_name_bare; |
||
76 | |||
77 | var $table_name = "document_revisions"; |
||
78 | var $object_name = "DocumentRevision"; |
||
79 | var $module_dir = 'DocumentRevisions'; |
||
80 | var $new_schema = true; |
||
81 | var $latest_revision_id; |
||
82 | |||
83 | /*var $column_fields = Array("id" |
||
84 | ,"document_id" |
||
85 | ,"date_entered" |
||
86 | ,"created_by" |
||
87 | ,"filename" |
||
88 | ,"file_mime_type" |
||
89 | ,"revision" |
||
90 | ,"change_log" |
||
91 | ,"file_ext" |
||
92 | ); |
||
93 | */ |
||
94 | var $encodeFields = Array(); |
||
95 | |||
96 | // This is used to retrieve related fields from form posts. |
||
97 | var $additional_column_fields = Array(''); |
||
98 | |||
99 | // This is the list of fields that are in the lists. |
||
100 | var $list_fields = Array("id" |
||
101 | ,"document_id" |
||
102 | ,"date_entered" |
||
103 | ,"created_by" |
||
104 | ,"filename" |
||
105 | ,"file_mime_type" |
||
106 | ,"revision" |
||
107 | ,"file_url" |
||
108 | ,"change_log" |
||
109 | ,"file_ext" |
||
110 | ,"created_by_name" |
||
111 | ); |
||
112 | |||
113 | var $required_fields = Array("revision"); |
||
114 | |||
115 | |||
116 | |||
117 | 20 | public function __construct() { |
|
118 | 20 | parent::__construct(); |
|
119 | 20 | $this->setupCustomFields('DocumentRevisions'); //parameter is module name |
|
120 | 20 | $this->disable_row_level_security =true; //no direct access to this module. |
|
121 | 20 | } |
|
122 | |||
123 | /** |
||
124 | * @deprecated deprecated since version 7.6, PHP4 Style Constructors are deprecated and will be remove in 7.8, please update your code, use __construct instead |
||
125 | */ |
||
126 | public function DocumentRevision(){ |
||
127 | $deprecatedMessage = 'PHP4 Style Constructors are deprecated and will be remove in 7.8, please update your code'; |
||
128 | if(isset($GLOBALS['log'])) { |
||
129 | $GLOBALS['log']->deprecated($deprecatedMessage); |
||
130 | } |
||
131 | else { |
||
132 | trigger_error($deprecatedMessage, E_USER_DEPRECATED); |
||
133 | } |
||
134 | self::__construct(); |
||
135 | } |
||
136 | |||
137 | |||
138 | 1 | function save($check_notify = false){ |
|
139 | 1 | $saveRet = parent::save($check_notify); |
|
140 | |||
141 | //update documents table. (not through save, because it causes a loop) |
||
142 | // If we don't have a document_id, find it. |
||
143 | 1 | if ( empty($this->document_id) ) { |
|
144 | $query = "SELECT document_id FROM document_revisions WHERE id = '".$this->db->quote($this->id)."'"; |
||
145 | $ret = $this->db->query($query,true); |
||
146 | $row = $this->db->fetchByAssoc($ret); |
||
147 | $this->document_id = $row['document_id']; |
||
148 | } |
||
149 | 1 | $query = "UPDATE documents set document_revision_id='".$this->db->quote($this->id)."', doc_type='".$this->db->quote($this->doc_type)."', doc_url='".$this->db->quote($this->doc_url)."', doc_id='".$this->db->quote($this->doc_id)."' where id = '".$this->db->quote($this->document_id)."'"; |
|
150 | 1 | $this->db->query($query,true); |
|
151 | |||
152 | 1 | return $saveRet; |
|
153 | } |
||
154 | 2 | function get_summary_text() |
|
155 | { |
||
156 | 2 | return "$this->filename"; |
|
157 | } |
||
158 | |||
159 | 1 | function retrieve($id = -1, $encode=false, $deleted=true){ |
|
160 | 1 | $ret = parent::retrieve($id, $encode,$deleted); |
|
161 | |||
162 | 1 | return $ret; |
|
163 | } |
||
164 | |||
165 | 1 | function is_authenticated() |
|
166 | { |
||
167 | 1 | return $this->authenticated; |
|
168 | } |
||
169 | |||
170 | 1 | function fill_in_additional_list_fields() { |
|
171 | 1 | $this->fill_in_additional_detail_fields(); |
|
172 | 1 | } |
|
173 | |||
174 | 3 | function fill_in_additional_detail_fields() |
|
175 | { |
||
176 | 3 | global $theme; |
|
177 | 3 | global $current_language; |
|
178 | |||
179 | 3 | parent::fill_in_additional_detail_fields(); |
|
180 | |||
181 | 3 | if ( empty($this->id) && empty($this->document_id) && isset($_REQUEST['return_id']) && !empty($_REQUEST['return_id']) ) { |
|
182 | $this->document_id = $_REQUEST['return_id']; |
||
183 | } |
||
184 | |||
185 | //find the document name and current version. |
||
186 | 3 | $query = "SELECT document_name, revision, document_revision_id FROM documents, document_revisions where documents.id = '".$this->db->quote($this->document_id)."' AND document_revisions.id = documents.document_revision_id"; |
|
187 | 3 | $result = $this->db->query($query,true,"Error fetching document details...:"); |
|
188 | 3 | $row = $this->db->fetchByAssoc($result); |
|
189 | 3 | if ($row != null) { |
|
190 | $this->document_name = $row['document_name']; |
||
191 | $this->document_name = '<a href="index.php?module=Documents&action=DetailView&record='.$this->document_id.'">'.$row['document_name'].'</a>'; |
||
192 | $this->latest_revision = $row['revision']; |
||
193 | $this->latest_revision_id = $row['document_revision_id']; |
||
194 | |||
195 | if ( empty($this->revision) ) { |
||
196 | $this->revision = $this->latest_revision + 1; |
||
197 | } |
||
198 | } |
||
199 | 3 | } |
|
200 | |||
201 | /** |
||
202 | * Returns a filename based off of the logical (Sugar-side) Document name and combined with the revision. Tailor |
||
203 | * this to needs created by email RFCs, filesystem name conventions, charset conventions etc. |
||
204 | * @param string revId Revision ID if not latest |
||
205 | * @return string formatted name |
||
206 | */ |
||
207 | 1 | function getDocumentRevisionNameForDisplay($revId='') { |
|
208 | 1 | global $sugar_config; |
|
209 | 1 | global $current_language; |
|
210 | |||
211 | 1 | $localLabels = return_module_language($current_language, 'DocumentRevisions'); |
|
212 | |||
213 | // prep - get source Document |
||
214 | 1 | $document = new Document(); |
|
215 | |||
216 | // use passed revision ID |
||
217 | 1 | if(!empty($revId)) { |
|
218 | $tempDoc = new DocumentRevision(); |
||
219 | $tempDoc->retrieve($revId); |
||
220 | } else { |
||
221 | 1 | $tempDoc = $this; |
|
222 | } |
||
223 | |||
224 | // get logical name |
||
225 | 1 | $document->retrieve($tempDoc->document_id); |
|
226 | 1 | $logicalName = $document->document_name; |
|
227 | |||
228 | // get revision string |
||
229 | 1 | $revString = ''; |
|
230 | 1 | if(!empty($tempDoc->revision)) { |
|
231 | 1 | $revString = "-{$localLabels['LBL_REVISION']}_{$tempDoc->revision}"; |
|
232 | } |
||
233 | |||
234 | // get extension |
||
235 | 1 | $realFilename = $tempDoc->filename; |
|
236 | 1 | $fileExtension_beg = strrpos($realFilename, "."); |
|
237 | 1 | $fileExtension = ""; |
|
238 | |||
239 | 1 | if($fileExtension_beg > 0) { |
|
240 | 1 | $fileExtension = substr($realFilename, $fileExtension_beg + 1); |
|
241 | } |
||
242 | //check to see if this is a file with extension located in "badext" |
||
243 | 1 | foreach($sugar_config['upload_badext'] as $badExt) { |
|
244 | 1 | if(strtolower($fileExtension) == strtolower($badExt)) { |
|
245 | //if found, then append with .txt to filename and break out of lookup |
||
246 | //this will make sure that the file goes out with right extension, but is stored |
||
247 | //as a text in db. |
||
248 | $fileExtension .= ".txt"; |
||
249 | 1 | break; // no need to look for more |
|
250 | } |
||
251 | } |
||
252 | 1 | $fileExtension = ".".$fileExtension; |
|
253 | |||
254 | 1 | $return = $logicalName.$revString.$fileExtension; |
|
255 | |||
256 | // apply RFC limitations here |
||
257 | 1 | if(mb_strlen($return) > 1024) { |
|
0 ignored issues
–
show
|
|||
258 | // do something if we find a real RFC issue |
||
259 | } |
||
260 | |||
261 | 1 | return $return; |
|
262 | } |
||
263 | |||
264 | 1 | function fill_document_name_revision($doc_id) { |
|
265 | |||
266 | //find the document name and current version. |
||
267 | 1 | $query = "SELECT documents.document_name, revision FROM documents, document_revisions where documents.id = '$doc_id'"; |
|
268 | 1 | $query .= " AND document_revisions.id = documents.document_revision_id"; |
|
269 | 1 | $result = $this->db->query($query,true,"Error fetching document details...:"); |
|
270 | 1 | $row = $this->db->fetchByAssoc($result); |
|
271 | 1 | if ($row != null) { |
|
272 | $this->name = $row['document_name']; |
||
273 | $this->latest_revision = $row['revision']; |
||
274 | } |
||
275 | 1 | } |
|
276 | |||
277 | 1 | function list_view_parse_additional_sections(&$list_form/*, $xTemplateSection*/){ |
|
278 | 1 | return $list_form; |
|
279 | } |
||
280 | |||
281 | 1 | function get_list_view_data(){ |
|
282 | 1 | $revision_fields = $this->get_list_view_array(); |
|
283 | |||
284 | 1 | $forecast_fields['FILE_URL'] = $this->file_url; |
|
285 | 1 | return $revision_fields; |
|
286 | } |
||
287 | |||
288 | //static function.. |
||
289 | 1 | function get_document_revision_name($doc_revision_id){ |
|
290 | 1 | if (empty($doc_revision_id)) return null; |
|
291 | |||
292 | 1 | $db = DBManagerFactory::getInstance(); |
|
293 | 1 | $query="select revision from document_revisions where id='$doc_revision_id' AND deleted=0"; |
|
294 | 1 | $result=$db->query($query); |
|
295 | 1 | if (!empty($result)) { |
|
296 | 1 | $row=$db->fetchByAssoc($result); |
|
297 | 1 | if (!empty($row)) { |
|
298 | return $row['revision']; |
||
299 | } |
||
300 | } |
||
301 | 1 | return null; |
|
302 | } |
||
303 | |||
304 | //static function. |
||
305 | 1 | function get_document_revisions($doc_id){ |
|
306 | 1 | $return_array= Array(); |
|
307 | 1 | if (empty($doc_id)) return $return_array; |
|
308 | |||
309 | 1 | $db = DBManagerFactory::getInstance(); |
|
310 | 1 | $query="select id, revision from document_revisions where document_id='$doc_id' and deleted=0"; |
|
311 | 1 | $result=$db->query($query); |
|
312 | 1 | if (!empty($result)) { |
|
313 | 1 | while (($row=$db->fetchByAssoc($result)) != null) { |
|
314 | $return_array[$row['id']]=$row['revision']; |
||
315 | } |
||
316 | } |
||
317 | 1 | return $return_array; |
|
318 | } |
||
319 | |||
320 | 20 | public function bean_implements($interface) { |
|
321 | switch($interface) { |
||
322 | 20 | case 'FILE' : return true; |
|
0 ignored issues
–
show
There must be no space before the colon in a CASE statement
As per the PSR-2 coding standard, there must not be a space in front of the colon in case statements. switch ($selector) {
case "A": //right
doSomething();
break;
case "B" : //wrong
doSomethingElse();
break;
}
To learn more about the PSR-2 coding standard, please refer to the PHP-Fig. ![]() The case body in a switch statement must start on the line following the statement.
According to the PSR-2, the body of a case statement must start on the line immediately following the case statement. switch ($expr) {
case "A":
doSomething(); //right
break;
case "B":
doSomethingElse(); //wrong
break;
} To learn more about the PSR-2 coding standard, please refer to the PHP-Fig. ![]() Terminating statement must be on a line by itself
As per the PSR-2 coding standard, the switch ($expr) {
case "A":
doSomething();
break; //wrong
case "B":
doSomething();
break; //right
case "C:":
doSomething();
return true; //right
}
To learn more about the PSR-2 coding standard, please refer to the PHP-Fig. ![]() |
|||
323 | } |
||
324 | 20 | return parent::bean_implements($interface); |
|
325 | } |
||
326 | } |
||
327 | |||
328 | require_once('modules/Documents/DocumentExternalApiDropDown.php'); |
This check looks for the bodies of
if
statements that have no statements or where all statements have been commented out. This may be the result of changes for debugging or the code may simply be obsolete.These
if
bodies can be removed. If you have an empty if but statements in theelse
branch, consider inverting the condition.could be turned into
This is much more concise to read.