Issues (4069)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

modules/EmailTemplates/EditView.php (1 issue)

Labels
Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
if (!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
3
4
require_once('modules/Campaigns/utils.php');
5
6
//if campaign_id is passed then we assume this is being invoked from the campaign module and in a popup.
7
$has_campaign = true;
8
$inboundEmail = true;
9
if (!isset($_REQUEST['campaign_id']) || empty($_REQUEST['campaign_id'])) {
10
    $has_campaign = false;
11
}
12
if (!isset($_REQUEST['inboundEmail']) || empty($_REQUEST['inboundEmail'])) {
13
    $inboundEmail = false;
14
}
15
$focus = new EmailTemplate();
16
17
if (isset($_REQUEST['record'])) {
18
    $focus->retrieve($_REQUEST['record']);
19
}
20
21
$old_id = '';
22
if (isset($_REQUEST['isDuplicate']) && $_REQUEST['isDuplicate'] == 'true') {
23
    $old_id = $focus->id; // for attachments down below
24
    $focus->id = "";
25
}
26
27
28
//setting default flag value so due date and time not required
29
if (!isset($focus->id)) $focus->date_due_flag = 1;
30
31
//needed when creating a new case with default values passed in
32
if (isset($_REQUEST['contact_name']) && is_null($focus->contact_name)) {
33
    $focus->contact_name = htmlspecialchars($_REQUEST['contact_name'], ENT_QUOTES);
34
}
35
if (isset($_REQUEST['contact_id']) && is_null($focus->contact_id)) {
36
    $focus->contact_id = htmlspecialchars($_REQUEST['contact_id'], ENT_QUOTES);
37
}
38
if (isset($_REQUEST['parent_name']) && is_null($focus->parent_name)) {
39
    $focus->parent_name = htmlspecialchars($_REQUEST['parent_name'], ENT_QUOTES);
40
}
41
if (isset($_REQUEST['parent_id']) && is_null($focus->parent_id)) {
42
    $focus->parent_id = htmlspecialchars($_REQUEST['parent_id'], ENT_QUOTES);
43
}
44
if (isset($_REQUEST['parent_type'])) {
45
    $focus->parent_type = htmlspecialchars($_REQUEST['parent_type'], ENT_QUOTES);
46
} elseif (!isset($focus->parent_type)) {
47
    $focus->parent_type = $app_list_strings['record_type_default_key'];
48
}
49
if (isset($_REQUEST['filename']) && $_REQUEST['isDuplicate'] != 'true') {
50
    $focus->filename = htmlspecialchars($_REQUEST['filename'], ENT_QUOTES);
51
}
52
53
if ($has_campaign || $inboundEmail) {
54
    insert_popup_header($theme);
55
}
56
57
58
$params = array();
59
60
if (empty($focus->id)) {
61
    $params[] = $GLOBALS['app_strings']['LBL_CREATE_BUTTON_LABEL'];
62
} else {
63
    $params[] = "<a href='index.php?module={$focus->module_dir}&action=DetailView&record={$focus->id}'>{$focus->name}</a>";
64
    $params[] = $GLOBALS['app_strings']['LBL_EDIT_BUTTON_LABEL'];
65
}
66
67
echo getClassicModuleTitle($focus->module_dir, $params, true);
68
69
if (!$focus->ACLAccess('EditView')) {
70
    ACLController::displayNoAccess(true);
71
    sugar_cleanup(true);
72
}
73
74
$GLOBALS['log']->info("EmailTemplate detail view");
75
76
if ($has_campaign || $inboundEmail) {
77
    $xtpl = new XTemplate ('modules/EmailTemplates/EditView.html');
78
} else {
79
    $xtpl = new XTemplate ('modules/EmailTemplates/EditViewMain.html');
80
} // else
81
$xtpl->assign("MOD", $mod_strings);
82
$xtpl->assign("APP", $app_strings);
83
84
$xtpl->assign("LBL_ACCOUNT", $app_list_strings['moduleList']['Accounts']);
85
$xtpl->parse("main.variable_option");
86
87
$returnAction = 'index';
88
if (isset($_REQUEST['return_module'])) $xtpl->assign("RETURN_MODULE", $_REQUEST['return_module']);
89
if (isset($_REQUEST['return_action'])) {
90
    $xtpl->assign("RETURN_ACTION", $_REQUEST['return_action']);
91
    $returnAction = $_REQUEST['return_action'];
92
}
93
if (isset($_REQUEST['return_id'])) $xtpl->assign("RETURN_ID", $_REQUEST['return_id']);
94
// handle Create $module then Cancel
95
if (empty($_REQUEST['return_id'])) {
96
    $xtpl->assign("RETURN_ACTION", 'index');
97
}
98
99
if ($has_campaign || $inboundEmail) {
100
    $cancel_script = "window.close();";
101
} else {
102
    $cancel_script = "this.form.action.value='{$returnAction}'; this.form.module.value='{$_REQUEST['return_module']}';
103
    this.form.record.value=";
104
    if (empty($_REQUEST['return_id'])) {
105
        $cancel_script = "this.form.action.value='index'; this.form.module.value='{$_REQUEST['return_module']}';this.form.name.value='';this.form.description.value=''";
106
    } else {
107
        $cancel_script .= "'{$_REQUEST['return_id']}'";
108
    }
109
}
110
111
//Setup assigned user name
112
$popup_request_data = array(
113
    'call_back_function' => 'set_return',
114
    'form_name' => 'EditView',
115
    'field_to_name_array' => array(
116
        'id' => 'assigned_user_id',
117
        'user_name' => 'assigned_user_name',
118
    ),
119
);
120
$json = getJSONobj();
121
$xtpl->assign('encoded_assigned_users_popup_request_data', $json->encode($popup_request_data));
122
if (!empty($focus->assigned_user_name))
123
    $xtpl->assign("ASSIGNED_USER_NAME", $focus->assigned_user_name);
124
125
$xtpl->assign("assign_user_select", SugarThemeRegistry::current()->getImage('id-ff-select', '', null, null, '.png', $mod_strings['LBL_SELECT']));
126
$xtpl->assign("assign_user_clear", SugarThemeRegistry::current()->getImage('id-ff-clear', '', null, null, '.gif', $mod_strings['LBL_ID_FF_CLEAR']));
127
//Assign qsd script
128
require_once('include/QuickSearchDefaults.php');
129
$qsd = QuickSearchDefaults::getQuickSearchDefaults();
130
$sqs_objects = array('EditView_assigned_user_name' => $qsd->getQSUser());
131
$quicksearch_js = '<script type="text/javascript" language="javascript">sqs_objects = ' . $json->encode($sqs_objects) . '; enableQS();</script>';
132
133
$xtpl->assign("CANCEL_SCRIPT", $cancel_script);
134
$xtpl->assign("PRINT_URL", "index.php?" . $GLOBALS['request_string']);
135
$xtpl->assign("JAVASCRIPT", get_set_focus_js() . $quicksearch_js);
136
137
if (!is_file(sugar_cached('jsLanguage/') . $GLOBALS['current_language'] . '.js')) {
138
    require_once('include/language/jsLanguage.php');
139
    jsLanguage::createAppStringsCache($GLOBALS['current_language']);
140
}
141
$jsLang = getVersionedScript("cache/jsLanguage/{$GLOBALS['current_language']}.js", $GLOBALS['sugar_config']['js_lang_version']);
142
$xtpl->assign("JSLANG", $jsLang);
143
144
$xtpl->assign("ID", $focus->id);
145
if (isset($focus->name)) $xtpl->assign("NAME", $focus->name); else $xtpl->assign("NAME", "");
146
147
//Bug45632
148
/* BEGIN - SECURITY GROUPS */
149
/**
150
 * if(isset($focus->assigned_user_id)) $xtpl->assign("ASSIGNED_USER_ID", $focus->assigned_user_id); else $xtpl->assign("ASSIGNED_USER_ID", "");
151
 */
152
if (isset($focus->assigned_user_id)) $xtpl->assign("ASSIGNED_USER_ID", $focus->assigned_user_id);
153
else if (empty($focus->id) && empty($focus->assigned_user_id)) {
154
    global $current_user;
155
    $xtpl->assign("ASSIGNED_USER_ID", $current_user->id);
156
    $xtpl->assign("ASSIGNED_USER_NAME", get_assigned_user_name($current_user->id));
157
} else $xtpl->assign("ASSIGNED_USER_ID", "");
158
/* END - SECURITY GROUPS */
159
//Bug45632
160
161
if (isset($focus->description)) $xtpl->assign("DESCRIPTION", $focus->description); else $xtpl->assign("DESCRIPTION", "");
162
if (isset($focus->subject)) $xtpl->assign("SUBJECT", $focus->subject); else $xtpl->assign("SUBJECT", "");
163
if ($focus->published == 'on') {
164
    $xtpl->assign("PUBLISHED", "CHECKED");
165
}
166
//if text only is set to true, then make sure input is checked and value set to 1
167
if (isset($focus->text_only) && $focus->text_only) {
168
    $xtpl->assign("TEXTONLY_CHECKED", "CHECKED");
169
    $xtpl->assign("TEXTONLY_VALUE", "1");
170
} else {//set value to 0
171
    $xtpl->assign("TEXTONLY_VALUE", "0");
172
}
173
174
require_once("modules/EmailTemplates/templateFields.php");
175
176
$xtpl->assign("FIELD_DEFS_JS", generateFieldDefsJS2());
177
$xtpl->assign("LBL_CONTACT", $app_list_strings['moduleList']['Contacts']);
178
179
global $current_user;
180
if (is_admin($current_user) && $_REQUEST['module'] != 'DynamicLayout' && !empty($_SESSION['editinplace'])) {
181
    $record = '';
182
    if (!empty($_REQUEST['record'])) {
183
        $record = $_REQUEST['record'];
184
    }
185
186
    $xtpl->assign("ADMIN_EDIT", "<a href='index.php?action=index&module=DynamicLayout&from_action=" . $_REQUEST['action'] . "&from_module=" . $_REQUEST['module'] . "&record=" . $record . "'>" . SugarThemeRegistry::current()->getImage("EditLayout", "border='0' align='bottom'", null, null, '.gif', $mod_strings['LBL_EDIT_LAYOUT']) . "</a>");
187
188
}
189
if (isset($focus->parent_type) && $focus->parent_type != "") {
190
    $change_parent_button = "<input title='" . $app_strings['LBL_SELECT_BUTTON_TITLE'] . "'
191
tabindex='3' type='button' class='button' value='" . $app_strings['LBL_SELECT_BUTTON_LABEL'] . "' name='button' LANGUAGE=javascript onclick='return
192
window.open(\"index.php?module=\"+ document.EditView.parent_type.value +
193
\"&action=Popup&html=Popup_picker&form=TasksEditView\",\"test\",\"width=600,height=400,resizable=1,scrollbars=1\");'>";
194
    $xtpl->assign("CHANGE_PARENT_BUTTON", $change_parent_button);
195
}
196
if ($focus->parent_type == "Account") {
197
    $xtpl->assign("DEFAULT_SEARCH", "&query=true&account_id=$focus->parent_id&account_name=" . urlencode($focus->parent_name));
198
}
199
200
$xtpl->assign("DESCRIPTION", $focus->description);
201
$xtpl->assign("TYPE_OPTIONS", get_select_options_with_id($app_list_strings['record_type_display'], $focus->parent_type));
202
//$xtpl->assign("DEFAULT_MODULE","Accounts");
203
204
if (isset($focus->body)) $xtpl->assign("BODY", $focus->body); else $xtpl->assign("BODY", "");
205
if (isset($focus->body_html)) $xtpl->assign("BODY_HTML", $focus->body_html); else $xtpl->assign("BODY_HTML", "");
206
207
require_once('include/SuiteMozaik.php');
208
$mozaik = new SuiteMozaik();
209
$xtpl->assign('BODY_MOZAIK', $mozaik->getAllHTML(isset($focus->body_html) ? html_entity_decode($focus->body_html) : '', 'body_text'));
210
211
212
if (true) {
0 ignored issues
show
Avoid IF statements that are always true or false
Loading history...
213
    if (!isTouchScreen()) {
214
        require_once("include/SugarTinyMCE.php");
215
        $tiny = new SugarTinyMCE();
216
        $tiny->defaultConfig['cleanup_on_startup'] = true;
217
        $tiny->defaultConfig['height'] = 600;
218
        $tiny->defaultConfig['plugins'] .= ",fullpage";
219
        $tinyHtml = $tiny->getInstance();
220
        $xtpl->assign("tiny", $tinyHtml);
221
    }
222
    ///////////////////////////////////////
223
    ////	MACRO VARS
224
    $xtpl->assign("INSERT_VARIABLE_ONCLICK", "insert_variable(document.EditView.variable_text.value)");
225
226
    // bug 37255, included without condition
227
    $xtpl->parse("main.NoInbound.variable_button");
228
229
    ///////////////////////////////////////
230
    ////	CAMPAIGNS
231
    if ($has_campaign || $inboundEmail) {
232
        $xtpl->assign("INPOPUPWINDOW", 'true');
233
        $xtpl->assign("INSERT_URL_ONCLICK", "insert_variable_html_link(document.EditView.tracker_url.value)");
234
        if ($has_campaign) {
235
            $campaign_urls = get_campaign_urls($_REQUEST['campaign_id']);
236
        }
237
        if (!empty($campaign_urls)) {
238
            $xtpl->assign("DEFAULT_URL_TEXT", key($campaign_urls));
239
        }
240
        if ($has_campaign) {
241
            $xtpl->assign("TRACKER_KEY_OPTIONS", get_select_options_with_id($campaign_urls, null));
242
            $xtpl->parse("main.NoInbound.tracker_url");
243
        }
244
    }
245
246
    // create option of "Contact/Lead/Task" from corresponding module
247
    // translations
248
    $lblContactAndOthers = implode('/', array(
249
        isset($app_list_strings['moduleListSingular']['Contacts']) ? $app_list_strings['moduleListSingular']['Contacts'] : 'Contact',
250
        isset($app_list_strings['moduleListSingular']['Leads']) ? $app_list_strings['moduleListSingular']['Leads'] : 'Lead',
251
        isset($app_list_strings['moduleListSingular']['Prospects']) ? $app_list_strings['moduleListSingular']['Prospects'] : 'Target',
252
    ));
253
254
    // The insert variable drodown should be conditionally displayed.
255
    // If it's campaign then hide the Account.
256
    if ($has_campaign) {
257
        $dropdown = "<option value='Contacts'>
258
						" . $lblContactAndOthers . "
259
			       </option>";
260
        $xtpl->assign("DROPDOWN", $dropdown);
261
        $xtpl->assign("DEFAULT_MODULE", 'Contacts');
262
        //$xtpl->assign("CAMPAIGN_POPUP_JS", '<script type="text/javascript" src="include/javascript/sugar_3.js"></script>');
263
    } else {
264
        $xtpl->assign("DROPDOWN", genDropDownJS2());
265
        $xtpl->assign("DEFAULT_MODULE", 'Accounts');
266
    }
267
    ////	END CAMPAIGNS
268
    ///////////////////////////////////////
269
270
    ///////////////////////////////////////
271
    ////    ATTACHMENTS
272
    $attachments = '';
273
    if (!empty($focus->id)) {
274
        $etid = $focus->id;
275
    } elseif (!empty($old_id)) {
276
        $xtpl->assign('OLD_ID', $old_id);
277
        $etid = $old_id;
278
    }
279
    if (!empty($etid)) {
280
        $note = new Note();
281
        $where = "notes.parent_id='{$etid}' AND notes.filename IS NOT NULL";
282
        $notes_list = $note->get_full_list("", $where, true);
283
284
        if (!isset($notes_list)) {
285
            $notes_list = array();
286
        }
287
        for ($i = 0; $i < count($notes_list); $i++) {
288
            $the_note = $notes_list[$i];
289
            if (empty($the_note->filename)) {
290
                continue;
291
            }
292
            $secureLink = 'index.php?entryPoint=download&id=' . $the_note->id . '&type=Notes';
293
            $attachments .= '<input type="checkbox" name="remove_attachment[]" value="' . $the_note->id . '"> ' . $app_strings['LNK_REMOVE'] . '&nbsp;&nbsp;';
294
            $attachments .= '<a href="' . $secureLink . '" target="_blank">' . $the_note->filename . '</a><br>';
295
        }
296
    }
297
    $attJs = '<script type="text/javascript">';
298
    $attJs .= 'var lnk_remove = "' . $app_strings['LNK_REMOVE'] . '";';
299
    $attJs .= '</script>';
300
    $xtpl->assign('ATTACHMENTS', $attachments);
301
    $xtpl->assign('ATTACHMENTS_JAVASCRIPT', $attJs);
302
303
    ////    END ATTACHMENTS
304
    ///////////////////////////////////////
305
    $templateType = !empty($focus->type) ? $focus->type : '';
306
    if ($has_campaign) {
307
        if (empty($_REQUEST['record'])) {
308
            // new record, default to campaign
309
            $xtpl->assign("TYPEDROPDOWN", get_select_options_with_id($app_list_strings['emailTemplates_type_list_campaigns'], 'campaign'));
310
        } else {
311
            $xtpl->assign("TYPEDROPDOWN", get_select_options_with_id($app_list_strings['emailTemplates_type_list_campaigns'], $templateType));
312
        }
313
    } else {
314
        // if the type is workflow, we will show it
315
        // otherwise we don't allow user to select workflow type because workflow type email template
316
        // should be created from within workflow module because it requires more fields (such as base module, etc)
317
        if ($templateType == 'workflow') {
318
            $xtpl->assign("TYPEDROPDOWN", get_select_options_with_id($app_list_strings['emailTemplates_type_list'], $templateType));
319
        } else {
320
            $xtpl->assign("TYPEDROPDOWN", get_select_options_with_id($app_list_strings['emailTemplates_type_list_no_workflow'], $templateType));
321
        }
322
    }
323
    // done and parse
324
    $xtpl->parse("main.textarea");
325
}
326
327
//Add Custom Fields
328
require_once('modules/DynamicFields/templates/Files/EditView.php');
329
$xtpl->parse("main.NoInbound");
330
if (!$inboundEmail) {
331
    $xtpl->parse("main.NoInbound1");
332
    $xtpl->parse("main.NoInbound2");
333
    $xtpl->parse("main.NoInbound3");
334
}
335
$xtpl->parse("main.NoInbound4");
336
$xtpl->parse("main.NoInbound5");
337
$xtpl->parse("main");
338
339
$xtpl->out("main");
340
341
$javascript = new javascript();
342
$javascript->setFormName('EditView');
343
$javascript->setSugarBean($focus);
344
$javascript->addAllFields('');
345
echo $javascript->getScript();
346
?>
347