adamjakab /
SuiteCRM
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | if (!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point'); |
||
| 3 | |||
| 4 | require_once('modules/Campaigns/utils.php'); |
||
| 5 | |||
| 6 | //if campaign_id is passed then we assume this is being invoked from the campaign module and in a popup. |
||
| 7 | $has_campaign = true; |
||
| 8 | $inboundEmail = true; |
||
| 9 | if (!isset($_REQUEST['campaign_id']) || empty($_REQUEST['campaign_id'])) { |
||
| 10 | $has_campaign = false; |
||
| 11 | } |
||
| 12 | if (!isset($_REQUEST['inboundEmail']) || empty($_REQUEST['inboundEmail'])) { |
||
| 13 | $inboundEmail = false; |
||
| 14 | } |
||
| 15 | $focus = new EmailTemplate(); |
||
| 16 | |||
| 17 | if (isset($_REQUEST['record'])) { |
||
| 18 | $focus->retrieve($_REQUEST['record']); |
||
| 19 | } |
||
| 20 | |||
| 21 | $old_id = ''; |
||
| 22 | if (isset($_REQUEST['isDuplicate']) && $_REQUEST['isDuplicate'] == 'true') { |
||
| 23 | $old_id = $focus->id; // for attachments down below |
||
| 24 | $focus->id = ""; |
||
| 25 | } |
||
| 26 | |||
| 27 | |||
| 28 | //setting default flag value so due date and time not required |
||
| 29 | if (!isset($focus->id)) $focus->date_due_flag = 1; |
||
| 30 | |||
| 31 | //needed when creating a new case with default values passed in |
||
| 32 | if (isset($_REQUEST['contact_name']) && is_null($focus->contact_name)) { |
||
| 33 | $focus->contact_name = htmlspecialchars($_REQUEST['contact_name'], ENT_QUOTES); |
||
| 34 | } |
||
| 35 | if (isset($_REQUEST['contact_id']) && is_null($focus->contact_id)) { |
||
| 36 | $focus->contact_id = htmlspecialchars($_REQUEST['contact_id'], ENT_QUOTES); |
||
| 37 | } |
||
| 38 | if (isset($_REQUEST['parent_name']) && is_null($focus->parent_name)) { |
||
| 39 | $focus->parent_name = htmlspecialchars($_REQUEST['parent_name'], ENT_QUOTES); |
||
| 40 | } |
||
| 41 | if (isset($_REQUEST['parent_id']) && is_null($focus->parent_id)) { |
||
| 42 | $focus->parent_id = htmlspecialchars($_REQUEST['parent_id'], ENT_QUOTES); |
||
| 43 | } |
||
| 44 | if (isset($_REQUEST['parent_type'])) { |
||
| 45 | $focus->parent_type = htmlspecialchars($_REQUEST['parent_type'], ENT_QUOTES); |
||
| 46 | } elseif (!isset($focus->parent_type)) { |
||
| 47 | $focus->parent_type = $app_list_strings['record_type_default_key']; |
||
| 48 | } |
||
| 49 | if (isset($_REQUEST['filename']) && $_REQUEST['isDuplicate'] != 'true') { |
||
| 50 | $focus->filename = htmlspecialchars($_REQUEST['filename'], ENT_QUOTES); |
||
| 51 | } |
||
| 52 | |||
| 53 | if ($has_campaign || $inboundEmail) { |
||
| 54 | insert_popup_header($theme); |
||
| 55 | } |
||
| 56 | |||
| 57 | |||
| 58 | $params = array(); |
||
| 59 | |||
| 60 | if (empty($focus->id)) { |
||
| 61 | $params[] = $GLOBALS['app_strings']['LBL_CREATE_BUTTON_LABEL']; |
||
| 62 | } else { |
||
| 63 | $params[] = "<a href='index.php?module={$focus->module_dir}&action=DetailView&record={$focus->id}'>{$focus->name}</a>"; |
||
| 64 | $params[] = $GLOBALS['app_strings']['LBL_EDIT_BUTTON_LABEL']; |
||
| 65 | } |
||
| 66 | |||
| 67 | echo getClassicModuleTitle($focus->module_dir, $params, true); |
||
| 68 | |||
| 69 | if (!$focus->ACLAccess('EditView')) { |
||
| 70 | ACLController::displayNoAccess(true); |
||
| 71 | sugar_cleanup(true); |
||
| 72 | } |
||
| 73 | |||
| 74 | $GLOBALS['log']->info("EmailTemplate detail view"); |
||
| 75 | |||
| 76 | if ($has_campaign || $inboundEmail) { |
||
| 77 | $xtpl = new XTemplate ('modules/EmailTemplates/EditView.html'); |
||
| 78 | } else { |
||
| 79 | $xtpl = new XTemplate ('modules/EmailTemplates/EditViewMain.html'); |
||
| 80 | } // else |
||
| 81 | $xtpl->assign("MOD", $mod_strings); |
||
| 82 | $xtpl->assign("APP", $app_strings); |
||
| 83 | |||
| 84 | $xtpl->assign("LBL_ACCOUNT", $app_list_strings['moduleList']['Accounts']); |
||
| 85 | $xtpl->parse("main.variable_option"); |
||
| 86 | |||
| 87 | $returnAction = 'index'; |
||
| 88 | if (isset($_REQUEST['return_module'])) $xtpl->assign("RETURN_MODULE", $_REQUEST['return_module']); |
||
| 89 | if (isset($_REQUEST['return_action'])) { |
||
| 90 | $xtpl->assign("RETURN_ACTION", $_REQUEST['return_action']); |
||
| 91 | $returnAction = $_REQUEST['return_action']; |
||
| 92 | } |
||
| 93 | if (isset($_REQUEST['return_id'])) $xtpl->assign("RETURN_ID", $_REQUEST['return_id']); |
||
| 94 | // handle Create $module then Cancel |
||
| 95 | if (empty($_REQUEST['return_id'])) { |
||
| 96 | $xtpl->assign("RETURN_ACTION", 'index'); |
||
| 97 | } |
||
| 98 | |||
| 99 | if ($has_campaign || $inboundEmail) { |
||
| 100 | $cancel_script = "window.close();"; |
||
| 101 | } else { |
||
| 102 | $cancel_script = "this.form.action.value='{$returnAction}'; this.form.module.value='{$_REQUEST['return_module']}'; |
||
| 103 | this.form.record.value="; |
||
| 104 | if (empty($_REQUEST['return_id'])) { |
||
| 105 | $cancel_script = "this.form.action.value='index'; this.form.module.value='{$_REQUEST['return_module']}';this.form.name.value='';this.form.description.value=''"; |
||
| 106 | } else { |
||
| 107 | $cancel_script .= "'{$_REQUEST['return_id']}'"; |
||
| 108 | } |
||
| 109 | } |
||
| 110 | |||
| 111 | //Setup assigned user name |
||
| 112 | $popup_request_data = array( |
||
| 113 | 'call_back_function' => 'set_return', |
||
| 114 | 'form_name' => 'EditView', |
||
| 115 | 'field_to_name_array' => array( |
||
| 116 | 'id' => 'assigned_user_id', |
||
| 117 | 'user_name' => 'assigned_user_name', |
||
| 118 | ), |
||
| 119 | ); |
||
| 120 | $json = getJSONobj(); |
||
| 121 | $xtpl->assign('encoded_assigned_users_popup_request_data', $json->encode($popup_request_data)); |
||
| 122 | if (!empty($focus->assigned_user_name)) |
||
| 123 | $xtpl->assign("ASSIGNED_USER_NAME", $focus->assigned_user_name); |
||
| 124 | |||
| 125 | $xtpl->assign("assign_user_select", SugarThemeRegistry::current()->getImage('id-ff-select', '', null, null, '.png', $mod_strings['LBL_SELECT'])); |
||
| 126 | $xtpl->assign("assign_user_clear", SugarThemeRegistry::current()->getImage('id-ff-clear', '', null, null, '.gif', $mod_strings['LBL_ID_FF_CLEAR'])); |
||
| 127 | //Assign qsd script |
||
| 128 | require_once('include/QuickSearchDefaults.php'); |
||
| 129 | $qsd = QuickSearchDefaults::getQuickSearchDefaults(); |
||
| 130 | $sqs_objects = array('EditView_assigned_user_name' => $qsd->getQSUser()); |
||
| 131 | $quicksearch_js = '<script type="text/javascript" language="javascript">sqs_objects = ' . $json->encode($sqs_objects) . '; enableQS();</script>'; |
||
| 132 | |||
| 133 | $xtpl->assign("CANCEL_SCRIPT", $cancel_script); |
||
| 134 | $xtpl->assign("PRINT_URL", "index.php?" . $GLOBALS['request_string']); |
||
| 135 | $xtpl->assign("JAVASCRIPT", get_set_focus_js() . $quicksearch_js); |
||
| 136 | |||
| 137 | if (!is_file(sugar_cached('jsLanguage/') . $GLOBALS['current_language'] . '.js')) { |
||
| 138 | require_once('include/language/jsLanguage.php'); |
||
| 139 | jsLanguage::createAppStringsCache($GLOBALS['current_language']); |
||
| 140 | } |
||
| 141 | $jsLang = getVersionedScript("cache/jsLanguage/{$GLOBALS['current_language']}.js", $GLOBALS['sugar_config']['js_lang_version']); |
||
| 142 | $xtpl->assign("JSLANG", $jsLang); |
||
| 143 | |||
| 144 | $xtpl->assign("ID", $focus->id); |
||
| 145 | if (isset($focus->name)) $xtpl->assign("NAME", $focus->name); else $xtpl->assign("NAME", ""); |
||
| 146 | |||
| 147 | //Bug45632 |
||
| 148 | /* BEGIN - SECURITY GROUPS */ |
||
| 149 | /** |
||
| 150 | * if(isset($focus->assigned_user_id)) $xtpl->assign("ASSIGNED_USER_ID", $focus->assigned_user_id); else $xtpl->assign("ASSIGNED_USER_ID", ""); |
||
| 151 | */ |
||
| 152 | if (isset($focus->assigned_user_id)) $xtpl->assign("ASSIGNED_USER_ID", $focus->assigned_user_id); |
||
| 153 | else if (empty($focus->id) && empty($focus->assigned_user_id)) { |
||
| 154 | global $current_user; |
||
| 155 | $xtpl->assign("ASSIGNED_USER_ID", $current_user->id); |
||
| 156 | $xtpl->assign("ASSIGNED_USER_NAME", get_assigned_user_name($current_user->id)); |
||
| 157 | } else $xtpl->assign("ASSIGNED_USER_ID", ""); |
||
| 158 | /* END - SECURITY GROUPS */ |
||
| 159 | //Bug45632 |
||
| 160 | |||
| 161 | if (isset($focus->description)) $xtpl->assign("DESCRIPTION", $focus->description); else $xtpl->assign("DESCRIPTION", ""); |
||
| 162 | if (isset($focus->subject)) $xtpl->assign("SUBJECT", $focus->subject); else $xtpl->assign("SUBJECT", ""); |
||
| 163 | if ($focus->published == 'on') { |
||
| 164 | $xtpl->assign("PUBLISHED", "CHECKED"); |
||
| 165 | } |
||
| 166 | //if text only is set to true, then make sure input is checked and value set to 1 |
||
| 167 | if (isset($focus->text_only) && $focus->text_only) { |
||
| 168 | $xtpl->assign("TEXTONLY_CHECKED", "CHECKED"); |
||
| 169 | $xtpl->assign("TEXTONLY_VALUE", "1"); |
||
| 170 | } else {//set value to 0 |
||
| 171 | $xtpl->assign("TEXTONLY_VALUE", "0"); |
||
| 172 | } |
||
| 173 | |||
| 174 | require_once("modules/EmailTemplates/templateFields.php"); |
||
| 175 | |||
| 176 | $xtpl->assign("FIELD_DEFS_JS", generateFieldDefsJS2()); |
||
| 177 | $xtpl->assign("LBL_CONTACT", $app_list_strings['moduleList']['Contacts']); |
||
| 178 | |||
| 179 | global $current_user; |
||
| 180 | if (is_admin($current_user) && $_REQUEST['module'] != 'DynamicLayout' && !empty($_SESSION['editinplace'])) { |
||
| 181 | $record = ''; |
||
| 182 | if (!empty($_REQUEST['record'])) { |
||
| 183 | $record = $_REQUEST['record']; |
||
| 184 | } |
||
| 185 | |||
| 186 | $xtpl->assign("ADMIN_EDIT", "<a href='index.php?action=index&module=DynamicLayout&from_action=" . $_REQUEST['action'] . "&from_module=" . $_REQUEST['module'] . "&record=" . $record . "'>" . SugarThemeRegistry::current()->getImage("EditLayout", "border='0' align='bottom'", null, null, '.gif', $mod_strings['LBL_EDIT_LAYOUT']) . "</a>"); |
||
| 187 | |||
| 188 | } |
||
| 189 | if (isset($focus->parent_type) && $focus->parent_type != "") { |
||
| 190 | $change_parent_button = "<input title='" . $app_strings['LBL_SELECT_BUTTON_TITLE'] . "' |
||
| 191 | tabindex='3' type='button' class='button' value='" . $app_strings['LBL_SELECT_BUTTON_LABEL'] . "' name='button' LANGUAGE=javascript onclick='return |
||
| 192 | window.open(\"index.php?module=\"+ document.EditView.parent_type.value + |
||
| 193 | \"&action=Popup&html=Popup_picker&form=TasksEditView\",\"test\",\"width=600,height=400,resizable=1,scrollbars=1\");'>"; |
||
| 194 | $xtpl->assign("CHANGE_PARENT_BUTTON", $change_parent_button); |
||
| 195 | } |
||
| 196 | if ($focus->parent_type == "Account") { |
||
| 197 | $xtpl->assign("DEFAULT_SEARCH", "&query=true&account_id=$focus->parent_id&account_name=" . urlencode($focus->parent_name)); |
||
| 198 | } |
||
| 199 | |||
| 200 | $xtpl->assign("DESCRIPTION", $focus->description); |
||
| 201 | $xtpl->assign("TYPE_OPTIONS", get_select_options_with_id($app_list_strings['record_type_display'], $focus->parent_type)); |
||
| 202 | //$xtpl->assign("DEFAULT_MODULE","Accounts"); |
||
| 203 | |||
| 204 | if (isset($focus->body)) $xtpl->assign("BODY", $focus->body); else $xtpl->assign("BODY", ""); |
||
| 205 | if (isset($focus->body_html)) $xtpl->assign("BODY_HTML", $focus->body_html); else $xtpl->assign("BODY_HTML", ""); |
||
| 206 | |||
| 207 | require_once('include/SuiteMozaik.php'); |
||
| 208 | $mozaik = new SuiteMozaik(); |
||
| 209 | $xtpl->assign('BODY_MOZAIK', $mozaik->getAllHTML(isset($focus->body_html) ? html_entity_decode($focus->body_html) : '', 'body_text')); |
||
| 210 | |||
| 211 | |||
| 212 | if (true) { |
||
|
0 ignored issues
–
show
Bug
introduced
by
Loading history...
|
|||
| 213 | if (!isTouchScreen()) { |
||
| 214 | require_once("include/SugarTinyMCE.php"); |
||
| 215 | $tiny = new SugarTinyMCE(); |
||
| 216 | $tiny->defaultConfig['cleanup_on_startup'] = true; |
||
| 217 | $tiny->defaultConfig['height'] = 600; |
||
| 218 | $tiny->defaultConfig['plugins'] .= ",fullpage"; |
||
| 219 | $tinyHtml = $tiny->getInstance(); |
||
| 220 | $xtpl->assign("tiny", $tinyHtml); |
||
| 221 | } |
||
| 222 | /////////////////////////////////////// |
||
| 223 | //// MACRO VARS |
||
| 224 | $xtpl->assign("INSERT_VARIABLE_ONCLICK", "insert_variable(document.EditView.variable_text.value)"); |
||
| 225 | |||
| 226 | // bug 37255, included without condition |
||
| 227 | $xtpl->parse("main.NoInbound.variable_button"); |
||
| 228 | |||
| 229 | /////////////////////////////////////// |
||
| 230 | //// CAMPAIGNS |
||
| 231 | if ($has_campaign || $inboundEmail) { |
||
| 232 | $xtpl->assign("INPOPUPWINDOW", 'true'); |
||
| 233 | $xtpl->assign("INSERT_URL_ONCLICK", "insert_variable_html_link(document.EditView.tracker_url.value)"); |
||
| 234 | if ($has_campaign) { |
||
| 235 | $campaign_urls = get_campaign_urls($_REQUEST['campaign_id']); |
||
| 236 | } |
||
| 237 | if (!empty($campaign_urls)) { |
||
| 238 | $xtpl->assign("DEFAULT_URL_TEXT", key($campaign_urls)); |
||
| 239 | } |
||
| 240 | if ($has_campaign) { |
||
| 241 | $xtpl->assign("TRACKER_KEY_OPTIONS", get_select_options_with_id($campaign_urls, null)); |
||
| 242 | $xtpl->parse("main.NoInbound.tracker_url"); |
||
| 243 | } |
||
| 244 | } |
||
| 245 | |||
| 246 | // create option of "Contact/Lead/Task" from corresponding module |
||
| 247 | // translations |
||
| 248 | $lblContactAndOthers = implode('/', array( |
||
| 249 | isset($app_list_strings['moduleListSingular']['Contacts']) ? $app_list_strings['moduleListSingular']['Contacts'] : 'Contact', |
||
| 250 | isset($app_list_strings['moduleListSingular']['Leads']) ? $app_list_strings['moduleListSingular']['Leads'] : 'Lead', |
||
| 251 | isset($app_list_strings['moduleListSingular']['Prospects']) ? $app_list_strings['moduleListSingular']['Prospects'] : 'Target', |
||
| 252 | )); |
||
| 253 | |||
| 254 | // The insert variable drodown should be conditionally displayed. |
||
| 255 | // If it's campaign then hide the Account. |
||
| 256 | if ($has_campaign) { |
||
| 257 | $dropdown = "<option value='Contacts'> |
||
| 258 | " . $lblContactAndOthers . " |
||
| 259 | </option>"; |
||
| 260 | $xtpl->assign("DROPDOWN", $dropdown); |
||
| 261 | $xtpl->assign("DEFAULT_MODULE", 'Contacts'); |
||
| 262 | //$xtpl->assign("CAMPAIGN_POPUP_JS", '<script type="text/javascript" src="include/javascript/sugar_3.js"></script>'); |
||
| 263 | } else { |
||
| 264 | $xtpl->assign("DROPDOWN", genDropDownJS2()); |
||
| 265 | $xtpl->assign("DEFAULT_MODULE", 'Accounts'); |
||
| 266 | } |
||
| 267 | //// END CAMPAIGNS |
||
| 268 | /////////////////////////////////////// |
||
| 269 | |||
| 270 | /////////////////////////////////////// |
||
| 271 | //// ATTACHMENTS |
||
| 272 | $attachments = ''; |
||
| 273 | if (!empty($focus->id)) { |
||
| 274 | $etid = $focus->id; |
||
| 275 | } elseif (!empty($old_id)) { |
||
| 276 | $xtpl->assign('OLD_ID', $old_id); |
||
| 277 | $etid = $old_id; |
||
| 278 | } |
||
| 279 | if (!empty($etid)) { |
||
| 280 | $note = new Note(); |
||
| 281 | $where = "notes.parent_id='{$etid}' AND notes.filename IS NOT NULL"; |
||
| 282 | $notes_list = $note->get_full_list("", $where, true); |
||
| 283 | |||
| 284 | if (!isset($notes_list)) { |
||
| 285 | $notes_list = array(); |
||
| 286 | } |
||
| 287 | for ($i = 0; $i < count($notes_list); $i++) { |
||
| 288 | $the_note = $notes_list[$i]; |
||
| 289 | if (empty($the_note->filename)) { |
||
| 290 | continue; |
||
| 291 | } |
||
| 292 | $secureLink = 'index.php?entryPoint=download&id=' . $the_note->id . '&type=Notes'; |
||
| 293 | $attachments .= '<input type="checkbox" name="remove_attachment[]" value="' . $the_note->id . '"> ' . $app_strings['LNK_REMOVE'] . ' '; |
||
| 294 | $attachments .= '<a href="' . $secureLink . '" target="_blank">' . $the_note->filename . '</a><br>'; |
||
| 295 | } |
||
| 296 | } |
||
| 297 | $attJs = '<script type="text/javascript">'; |
||
| 298 | $attJs .= 'var lnk_remove = "' . $app_strings['LNK_REMOVE'] . '";'; |
||
| 299 | $attJs .= '</script>'; |
||
| 300 | $xtpl->assign('ATTACHMENTS', $attachments); |
||
| 301 | $xtpl->assign('ATTACHMENTS_JAVASCRIPT', $attJs); |
||
| 302 | |||
| 303 | //// END ATTACHMENTS |
||
| 304 | /////////////////////////////////////// |
||
| 305 | $templateType = !empty($focus->type) ? $focus->type : ''; |
||
| 306 | if ($has_campaign) { |
||
| 307 | if (empty($_REQUEST['record'])) { |
||
| 308 | // new record, default to campaign |
||
| 309 | $xtpl->assign("TYPEDROPDOWN", get_select_options_with_id($app_list_strings['emailTemplates_type_list_campaigns'], 'campaign')); |
||
| 310 | } else { |
||
| 311 | $xtpl->assign("TYPEDROPDOWN", get_select_options_with_id($app_list_strings['emailTemplates_type_list_campaigns'], $templateType)); |
||
| 312 | } |
||
| 313 | } else { |
||
| 314 | // if the type is workflow, we will show it |
||
| 315 | // otherwise we don't allow user to select workflow type because workflow type email template |
||
| 316 | // should be created from within workflow module because it requires more fields (such as base module, etc) |
||
| 317 | if ($templateType == 'workflow') { |
||
| 318 | $xtpl->assign("TYPEDROPDOWN", get_select_options_with_id($app_list_strings['emailTemplates_type_list'], $templateType)); |
||
| 319 | } else { |
||
| 320 | $xtpl->assign("TYPEDROPDOWN", get_select_options_with_id($app_list_strings['emailTemplates_type_list_no_workflow'], $templateType)); |
||
| 321 | } |
||
| 322 | } |
||
| 323 | // done and parse |
||
| 324 | $xtpl->parse("main.textarea"); |
||
| 325 | } |
||
| 326 | |||
| 327 | //Add Custom Fields |
||
| 328 | require_once('modules/DynamicFields/templates/Files/EditView.php'); |
||
| 329 | $xtpl->parse("main.NoInbound"); |
||
| 330 | if (!$inboundEmail) { |
||
| 331 | $xtpl->parse("main.NoInbound1"); |
||
| 332 | $xtpl->parse("main.NoInbound2"); |
||
| 333 | $xtpl->parse("main.NoInbound3"); |
||
| 334 | } |
||
| 335 | $xtpl->parse("main.NoInbound4"); |
||
| 336 | $xtpl->parse("main.NoInbound5"); |
||
| 337 | $xtpl->parse("main"); |
||
| 338 | |||
| 339 | $xtpl->out("main"); |
||
| 340 | |||
| 341 | $javascript = new javascript(); |
||
| 342 | $javascript->setFormName('EditView'); |
||
| 343 | $javascript->setSugarBean($focus); |
||
| 344 | $javascript->addAllFields(''); |
||
| 345 | echo $javascript->getScript(); |
||
| 346 | ?> |
||
| 347 |