This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | if (!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point'); |
||
3 | |||
4 | require_once('modules/Campaigns/utils.php'); |
||
5 | |||
6 | //if campaign_id is passed then we assume this is being invoked from the campaign module and in a popup. |
||
7 | $has_campaign = true; |
||
8 | $inboundEmail = true; |
||
9 | if (!isset($_REQUEST['campaign_id']) || empty($_REQUEST['campaign_id'])) { |
||
10 | $has_campaign = false; |
||
11 | } |
||
12 | if (!isset($_REQUEST['inboundEmail']) || empty($_REQUEST['inboundEmail'])) { |
||
13 | $inboundEmail = false; |
||
14 | } |
||
15 | $focus = new EmailTemplate(); |
||
16 | |||
17 | if (isset($_REQUEST['record'])) { |
||
18 | $focus->retrieve($_REQUEST['record']); |
||
19 | } |
||
20 | |||
21 | $old_id = ''; |
||
22 | if (isset($_REQUEST['isDuplicate']) && $_REQUEST['isDuplicate'] == 'true') { |
||
23 | $old_id = $focus->id; // for attachments down below |
||
24 | $focus->id = ""; |
||
25 | } |
||
26 | |||
27 | |||
28 | //setting default flag value so due date and time not required |
||
29 | if (!isset($focus->id)) $focus->date_due_flag = 1; |
||
30 | |||
31 | //needed when creating a new case with default values passed in |
||
32 | if (isset($_REQUEST['contact_name']) && is_null($focus->contact_name)) { |
||
33 | $focus->contact_name = htmlspecialchars($_REQUEST['contact_name'], ENT_QUOTES); |
||
34 | } |
||
35 | if (isset($_REQUEST['contact_id']) && is_null($focus->contact_id)) { |
||
36 | $focus->contact_id = htmlspecialchars($_REQUEST['contact_id'], ENT_QUOTES); |
||
37 | } |
||
38 | if (isset($_REQUEST['parent_name']) && is_null($focus->parent_name)) { |
||
39 | $focus->parent_name = htmlspecialchars($_REQUEST['parent_name'], ENT_QUOTES); |
||
40 | } |
||
41 | if (isset($_REQUEST['parent_id']) && is_null($focus->parent_id)) { |
||
42 | $focus->parent_id = htmlspecialchars($_REQUEST['parent_id'], ENT_QUOTES); |
||
43 | } |
||
44 | if (isset($_REQUEST['parent_type'])) { |
||
45 | $focus->parent_type = htmlspecialchars($_REQUEST['parent_type'], ENT_QUOTES); |
||
46 | } elseif (!isset($focus->parent_type)) { |
||
47 | $focus->parent_type = $app_list_strings['record_type_default_key']; |
||
48 | } |
||
49 | if (isset($_REQUEST['filename']) && $_REQUEST['isDuplicate'] != 'true') { |
||
50 | $focus->filename = htmlspecialchars($_REQUEST['filename'], ENT_QUOTES); |
||
51 | } |
||
52 | |||
53 | if ($has_campaign || $inboundEmail) { |
||
54 | insert_popup_header($theme); |
||
55 | } |
||
56 | |||
57 | |||
58 | $params = array(); |
||
59 | |||
60 | if (empty($focus->id)) { |
||
61 | $params[] = $GLOBALS['app_strings']['LBL_CREATE_BUTTON_LABEL']; |
||
62 | } else { |
||
63 | $params[] = "<a href='index.php?module={$focus->module_dir}&action=DetailView&record={$focus->id}'>{$focus->name}</a>"; |
||
64 | $params[] = $GLOBALS['app_strings']['LBL_EDIT_BUTTON_LABEL']; |
||
65 | } |
||
66 | |||
67 | echo getClassicModuleTitle($focus->module_dir, $params, true); |
||
68 | |||
69 | if (!$focus->ACLAccess('EditView')) { |
||
70 | ACLController::displayNoAccess(true); |
||
71 | sugar_cleanup(true); |
||
72 | } |
||
73 | |||
74 | $GLOBALS['log']->info("EmailTemplate detail view"); |
||
75 | |||
76 | if ($has_campaign || $inboundEmail) { |
||
77 | $xtpl = new XTemplate ('modules/EmailTemplates/EditView.html'); |
||
78 | } else { |
||
79 | $xtpl = new XTemplate ('modules/EmailTemplates/EditViewMain.html'); |
||
80 | } // else |
||
81 | $xtpl->assign("MOD", $mod_strings); |
||
82 | $xtpl->assign("APP", $app_strings); |
||
83 | |||
84 | $xtpl->assign("LBL_ACCOUNT", $app_list_strings['moduleList']['Accounts']); |
||
85 | $xtpl->parse("main.variable_option"); |
||
86 | |||
87 | $returnAction = 'index'; |
||
88 | if (isset($_REQUEST['return_module'])) $xtpl->assign("RETURN_MODULE", $_REQUEST['return_module']); |
||
89 | if (isset($_REQUEST['return_action'])) { |
||
90 | $xtpl->assign("RETURN_ACTION", $_REQUEST['return_action']); |
||
91 | $returnAction = $_REQUEST['return_action']; |
||
92 | } |
||
93 | if (isset($_REQUEST['return_id'])) $xtpl->assign("RETURN_ID", $_REQUEST['return_id']); |
||
94 | // handle Create $module then Cancel |
||
95 | if (empty($_REQUEST['return_id'])) { |
||
96 | $xtpl->assign("RETURN_ACTION", 'index'); |
||
97 | } |
||
98 | |||
99 | if ($has_campaign || $inboundEmail) { |
||
100 | $cancel_script = "window.close();"; |
||
101 | } else { |
||
102 | $cancel_script = "this.form.action.value='{$returnAction}'; this.form.module.value='{$_REQUEST['return_module']}'; |
||
103 | this.form.record.value="; |
||
104 | if (empty($_REQUEST['return_id'])) { |
||
105 | $cancel_script = "this.form.action.value='index'; this.form.module.value='{$_REQUEST['return_module']}';this.form.name.value='';this.form.description.value=''"; |
||
106 | } else { |
||
107 | $cancel_script .= "'{$_REQUEST['return_id']}'"; |
||
108 | } |
||
109 | } |
||
110 | |||
111 | //Setup assigned user name |
||
112 | $popup_request_data = array( |
||
113 | 'call_back_function' => 'set_return', |
||
114 | 'form_name' => 'EditView', |
||
115 | 'field_to_name_array' => array( |
||
116 | 'id' => 'assigned_user_id', |
||
117 | 'user_name' => 'assigned_user_name', |
||
118 | ), |
||
119 | ); |
||
120 | $json = getJSONobj(); |
||
121 | $xtpl->assign('encoded_assigned_users_popup_request_data', $json->encode($popup_request_data)); |
||
122 | if (!empty($focus->assigned_user_name)) |
||
123 | $xtpl->assign("ASSIGNED_USER_NAME", $focus->assigned_user_name); |
||
124 | |||
125 | $xtpl->assign("assign_user_select", SugarThemeRegistry::current()->getImage('id-ff-select', '', null, null, '.png', $mod_strings['LBL_SELECT'])); |
||
126 | $xtpl->assign("assign_user_clear", SugarThemeRegistry::current()->getImage('id-ff-clear', '', null, null, '.gif', $mod_strings['LBL_ID_FF_CLEAR'])); |
||
127 | //Assign qsd script |
||
128 | require_once('include/QuickSearchDefaults.php'); |
||
129 | $qsd = QuickSearchDefaults::getQuickSearchDefaults(); |
||
130 | $sqs_objects = array('EditView_assigned_user_name' => $qsd->getQSUser()); |
||
131 | $quicksearch_js = '<script type="text/javascript" language="javascript">sqs_objects = ' . $json->encode($sqs_objects) . '; enableQS();</script>'; |
||
132 | |||
133 | $xtpl->assign("CANCEL_SCRIPT", $cancel_script); |
||
134 | $xtpl->assign("PRINT_URL", "index.php?" . $GLOBALS['request_string']); |
||
135 | $xtpl->assign("JAVASCRIPT", get_set_focus_js() . $quicksearch_js); |
||
136 | |||
137 | if (!is_file(sugar_cached('jsLanguage/') . $GLOBALS['current_language'] . '.js')) { |
||
138 | require_once('include/language/jsLanguage.php'); |
||
139 | jsLanguage::createAppStringsCache($GLOBALS['current_language']); |
||
140 | } |
||
141 | $jsLang = getVersionedScript("cache/jsLanguage/{$GLOBALS['current_language']}.js", $GLOBALS['sugar_config']['js_lang_version']); |
||
142 | $xtpl->assign("JSLANG", $jsLang); |
||
143 | |||
144 | $xtpl->assign("ID", $focus->id); |
||
145 | if (isset($focus->name)) $xtpl->assign("NAME", $focus->name); else $xtpl->assign("NAME", ""); |
||
146 | |||
147 | //Bug45632 |
||
148 | /* BEGIN - SECURITY GROUPS */ |
||
149 | /** |
||
150 | * if(isset($focus->assigned_user_id)) $xtpl->assign("ASSIGNED_USER_ID", $focus->assigned_user_id); else $xtpl->assign("ASSIGNED_USER_ID", ""); |
||
151 | */ |
||
152 | if (isset($focus->assigned_user_id)) $xtpl->assign("ASSIGNED_USER_ID", $focus->assigned_user_id); |
||
153 | else if (empty($focus->id) && empty($focus->assigned_user_id)) { |
||
154 | global $current_user; |
||
155 | $xtpl->assign("ASSIGNED_USER_ID", $current_user->id); |
||
156 | $xtpl->assign("ASSIGNED_USER_NAME", get_assigned_user_name($current_user->id)); |
||
157 | } else $xtpl->assign("ASSIGNED_USER_ID", ""); |
||
158 | /* END - SECURITY GROUPS */ |
||
159 | //Bug45632 |
||
160 | |||
161 | if (isset($focus->description)) $xtpl->assign("DESCRIPTION", $focus->description); else $xtpl->assign("DESCRIPTION", ""); |
||
162 | if (isset($focus->subject)) $xtpl->assign("SUBJECT", $focus->subject); else $xtpl->assign("SUBJECT", ""); |
||
163 | if ($focus->published == 'on') { |
||
164 | $xtpl->assign("PUBLISHED", "CHECKED"); |
||
165 | } |
||
166 | //if text only is set to true, then make sure input is checked and value set to 1 |
||
167 | if (isset($focus->text_only) && $focus->text_only) { |
||
168 | $xtpl->assign("TEXTONLY_CHECKED", "CHECKED"); |
||
169 | $xtpl->assign("TEXTONLY_VALUE", "1"); |
||
170 | } else {//set value to 0 |
||
171 | $xtpl->assign("TEXTONLY_VALUE", "0"); |
||
172 | } |
||
173 | |||
174 | require_once("modules/EmailTemplates/templateFields.php"); |
||
175 | |||
176 | $xtpl->assign("FIELD_DEFS_JS", generateFieldDefsJS2()); |
||
177 | $xtpl->assign("LBL_CONTACT", $app_list_strings['moduleList']['Contacts']); |
||
178 | |||
179 | global $current_user; |
||
180 | if (is_admin($current_user) && $_REQUEST['module'] != 'DynamicLayout' && !empty($_SESSION['editinplace'])) { |
||
181 | $record = ''; |
||
182 | if (!empty($_REQUEST['record'])) { |
||
183 | $record = $_REQUEST['record']; |
||
184 | } |
||
185 | |||
186 | $xtpl->assign("ADMIN_EDIT", "<a href='index.php?action=index&module=DynamicLayout&from_action=" . $_REQUEST['action'] . "&from_module=" . $_REQUEST['module'] . "&record=" . $record . "'>" . SugarThemeRegistry::current()->getImage("EditLayout", "border='0' align='bottom'", null, null, '.gif', $mod_strings['LBL_EDIT_LAYOUT']) . "</a>"); |
||
187 | |||
188 | } |
||
189 | if (isset($focus->parent_type) && $focus->parent_type != "") { |
||
190 | $change_parent_button = "<input title='" . $app_strings['LBL_SELECT_BUTTON_TITLE'] . "' |
||
191 | tabindex='3' type='button' class='button' value='" . $app_strings['LBL_SELECT_BUTTON_LABEL'] . "' name='button' LANGUAGE=javascript onclick='return |
||
192 | window.open(\"index.php?module=\"+ document.EditView.parent_type.value + |
||
193 | \"&action=Popup&html=Popup_picker&form=TasksEditView\",\"test\",\"width=600,height=400,resizable=1,scrollbars=1\");'>"; |
||
194 | $xtpl->assign("CHANGE_PARENT_BUTTON", $change_parent_button); |
||
195 | } |
||
196 | if ($focus->parent_type == "Account") { |
||
197 | $xtpl->assign("DEFAULT_SEARCH", "&query=true&account_id=$focus->parent_id&account_name=" . urlencode($focus->parent_name)); |
||
198 | } |
||
199 | |||
200 | $xtpl->assign("DESCRIPTION", $focus->description); |
||
201 | $xtpl->assign("TYPE_OPTIONS", get_select_options_with_id($app_list_strings['record_type_display'], $focus->parent_type)); |
||
202 | //$xtpl->assign("DEFAULT_MODULE","Accounts"); |
||
203 | |||
204 | if (isset($focus->body)) $xtpl->assign("BODY", $focus->body); else $xtpl->assign("BODY", ""); |
||
205 | if (isset($focus->body_html)) $xtpl->assign("BODY_HTML", $focus->body_html); else $xtpl->assign("BODY_HTML", ""); |
||
206 | |||
207 | require_once('include/SuiteMozaik.php'); |
||
208 | $mozaik = new SuiteMozaik(); |
||
209 | $xtpl->assign('BODY_MOZAIK', $mozaik->getAllHTML(isset($focus->body_html) ? html_entity_decode($focus->body_html) : '', 'body_text')); |
||
210 | |||
211 | |||
212 | if (true) { |
||
0 ignored issues
–
show
Bug
introduced
by
![]() |
|||
213 | if (!isTouchScreen()) { |
||
214 | require_once("include/SugarTinyMCE.php"); |
||
215 | $tiny = new SugarTinyMCE(); |
||
216 | $tiny->defaultConfig['cleanup_on_startup'] = true; |
||
217 | $tiny->defaultConfig['height'] = 600; |
||
218 | $tiny->defaultConfig['plugins'] .= ",fullpage"; |
||
219 | $tinyHtml = $tiny->getInstance(); |
||
220 | $xtpl->assign("tiny", $tinyHtml); |
||
221 | } |
||
222 | /////////////////////////////////////// |
||
223 | //// MACRO VARS |
||
224 | $xtpl->assign("INSERT_VARIABLE_ONCLICK", "insert_variable(document.EditView.variable_text.value)"); |
||
225 | |||
226 | // bug 37255, included without condition |
||
227 | $xtpl->parse("main.NoInbound.variable_button"); |
||
228 | |||
229 | /////////////////////////////////////// |
||
230 | //// CAMPAIGNS |
||
231 | if ($has_campaign || $inboundEmail) { |
||
232 | $xtpl->assign("INPOPUPWINDOW", 'true'); |
||
233 | $xtpl->assign("INSERT_URL_ONCLICK", "insert_variable_html_link(document.EditView.tracker_url.value)"); |
||
234 | if ($has_campaign) { |
||
235 | $campaign_urls = get_campaign_urls($_REQUEST['campaign_id']); |
||
236 | } |
||
237 | if (!empty($campaign_urls)) { |
||
238 | $xtpl->assign("DEFAULT_URL_TEXT", key($campaign_urls)); |
||
239 | } |
||
240 | if ($has_campaign) { |
||
241 | $xtpl->assign("TRACKER_KEY_OPTIONS", get_select_options_with_id($campaign_urls, null)); |
||
242 | $xtpl->parse("main.NoInbound.tracker_url"); |
||
243 | } |
||
244 | } |
||
245 | |||
246 | // create option of "Contact/Lead/Task" from corresponding module |
||
247 | // translations |
||
248 | $lblContactAndOthers = implode('/', array( |
||
249 | isset($app_list_strings['moduleListSingular']['Contacts']) ? $app_list_strings['moduleListSingular']['Contacts'] : 'Contact', |
||
250 | isset($app_list_strings['moduleListSingular']['Leads']) ? $app_list_strings['moduleListSingular']['Leads'] : 'Lead', |
||
251 | isset($app_list_strings['moduleListSingular']['Prospects']) ? $app_list_strings['moduleListSingular']['Prospects'] : 'Target', |
||
252 | )); |
||
253 | |||
254 | // The insert variable drodown should be conditionally displayed. |
||
255 | // If it's campaign then hide the Account. |
||
256 | if ($has_campaign) { |
||
257 | $dropdown = "<option value='Contacts'> |
||
258 | " . $lblContactAndOthers . " |
||
259 | </option>"; |
||
260 | $xtpl->assign("DROPDOWN", $dropdown); |
||
261 | $xtpl->assign("DEFAULT_MODULE", 'Contacts'); |
||
262 | //$xtpl->assign("CAMPAIGN_POPUP_JS", '<script type="text/javascript" src="include/javascript/sugar_3.js"></script>'); |
||
263 | } else { |
||
264 | $xtpl->assign("DROPDOWN", genDropDownJS2()); |
||
265 | $xtpl->assign("DEFAULT_MODULE", 'Accounts'); |
||
266 | } |
||
267 | //// END CAMPAIGNS |
||
268 | /////////////////////////////////////// |
||
269 | |||
270 | /////////////////////////////////////// |
||
271 | //// ATTACHMENTS |
||
272 | $attachments = ''; |
||
273 | if (!empty($focus->id)) { |
||
274 | $etid = $focus->id; |
||
275 | } elseif (!empty($old_id)) { |
||
276 | $xtpl->assign('OLD_ID', $old_id); |
||
277 | $etid = $old_id; |
||
278 | } |
||
279 | if (!empty($etid)) { |
||
280 | $note = new Note(); |
||
281 | $where = "notes.parent_id='{$etid}' AND notes.filename IS NOT NULL"; |
||
282 | $notes_list = $note->get_full_list("", $where, true); |
||
283 | |||
284 | if (!isset($notes_list)) { |
||
285 | $notes_list = array(); |
||
286 | } |
||
287 | for ($i = 0; $i < count($notes_list); $i++) { |
||
288 | $the_note = $notes_list[$i]; |
||
289 | if (empty($the_note->filename)) { |
||
290 | continue; |
||
291 | } |
||
292 | $secureLink = 'index.php?entryPoint=download&id=' . $the_note->id . '&type=Notes'; |
||
293 | $attachments .= '<input type="checkbox" name="remove_attachment[]" value="' . $the_note->id . '"> ' . $app_strings['LNK_REMOVE'] . ' '; |
||
294 | $attachments .= '<a href="' . $secureLink . '" target="_blank">' . $the_note->filename . '</a><br>'; |
||
295 | } |
||
296 | } |
||
297 | $attJs = '<script type="text/javascript">'; |
||
298 | $attJs .= 'var lnk_remove = "' . $app_strings['LNK_REMOVE'] . '";'; |
||
299 | $attJs .= '</script>'; |
||
300 | $xtpl->assign('ATTACHMENTS', $attachments); |
||
301 | $xtpl->assign('ATTACHMENTS_JAVASCRIPT', $attJs); |
||
302 | |||
303 | //// END ATTACHMENTS |
||
304 | /////////////////////////////////////// |
||
305 | $templateType = !empty($focus->type) ? $focus->type : ''; |
||
306 | if ($has_campaign) { |
||
307 | if (empty($_REQUEST['record'])) { |
||
308 | // new record, default to campaign |
||
309 | $xtpl->assign("TYPEDROPDOWN", get_select_options_with_id($app_list_strings['emailTemplates_type_list_campaigns'], 'campaign')); |
||
310 | } else { |
||
311 | $xtpl->assign("TYPEDROPDOWN", get_select_options_with_id($app_list_strings['emailTemplates_type_list_campaigns'], $templateType)); |
||
312 | } |
||
313 | } else { |
||
314 | // if the type is workflow, we will show it |
||
315 | // otherwise we don't allow user to select workflow type because workflow type email template |
||
316 | // should be created from within workflow module because it requires more fields (such as base module, etc) |
||
317 | if ($templateType == 'workflow') { |
||
318 | $xtpl->assign("TYPEDROPDOWN", get_select_options_with_id($app_list_strings['emailTemplates_type_list'], $templateType)); |
||
319 | } else { |
||
320 | $xtpl->assign("TYPEDROPDOWN", get_select_options_with_id($app_list_strings['emailTemplates_type_list_no_workflow'], $templateType)); |
||
321 | } |
||
322 | } |
||
323 | // done and parse |
||
324 | $xtpl->parse("main.textarea"); |
||
325 | } |
||
326 | |||
327 | //Add Custom Fields |
||
328 | require_once('modules/DynamicFields/templates/Files/EditView.php'); |
||
329 | $xtpl->parse("main.NoInbound"); |
||
330 | if (!$inboundEmail) { |
||
331 | $xtpl->parse("main.NoInbound1"); |
||
332 | $xtpl->parse("main.NoInbound2"); |
||
333 | $xtpl->parse("main.NoInbound3"); |
||
334 | } |
||
335 | $xtpl->parse("main.NoInbound4"); |
||
336 | $xtpl->parse("main.NoInbound5"); |
||
337 | $xtpl->parse("main"); |
||
338 | |||
339 | $xtpl->out("main"); |
||
340 | |||
341 | $javascript = new javascript(); |
||
342 | $javascript->setFormName('EditView'); |
||
343 | $javascript->setSugarBean($focus); |
||
344 | $javascript->addAllFields(''); |
||
345 | echo $javascript->getScript(); |
||
346 | ?> |
||
347 |