Issues (4069)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

modules/Meetings/MeetingFormBase.php (1 issue)

Labels
Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
3
/*********************************************************************************
4
 * SugarCRM Community Edition is a customer relationship management program developed by
5
 * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc.
6
7
 * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd.
8
 * Copyright (C) 2011 - 2014 Salesagility Ltd.
9
 *
10
 * This program is free software; you can redistribute it and/or modify it under
11
 * the terms of the GNU Affero General Public License version 3 as published by the
12
 * Free Software Foundation with the addition of the following permission added
13
 * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
14
 * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY
15
 * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
16
 *
17
 * This program is distributed in the hope that it will be useful, but WITHOUT
18
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
19
 * FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
20
 * details.
21
 *
22
 * You should have received a copy of the GNU Affero General Public License along with
23
 * this program; if not, see http://www.gnu.org/licenses or write to the Free
24
 * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
25
 * 02110-1301 USA.
26
 *
27
 * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road,
28
 * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected].
29
 *
30
 * The interactive user interfaces in modified source and object code versions
31
 * of this program must display Appropriate Legal Notices, as required under
32
 * Section 5 of the GNU Affero General Public License version 3.
33
 *
34
 * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
35
 * these Appropriate Legal Notices must retain the display of the "Powered by
36
 * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not
37
 * reasonably feasible for  technical reasons, the Appropriate Legal Notices must
38
 * display the words  "Powered by SugarCRM" and "Supercharged by SuiteCRM".
39
 ********************************************************************************/
40
41
/*********************************************************************************
42
43
 * Description:  Base Form For Meetings
44
 * Portions created by SugarCRM are Copyright(C) SugarCRM, Inc.
45
 * All Rights Reserved.
46
 * Contributor(s): ______________________________________..
47
 ********************************************************************************/
48
49
require_once('include/SugarObjects/forms/FormBase.php');
50
51
class MeetingFormBase extends FormBase {
52
53
	function getFormBody($prefix, $mod='', $formname=''){
54
		if(!ACLController::checkAccess('Meetings', 'edit', true)){
55
		return '';
56
	}
57
		global $mod_strings;
58
		global $app_strings;
59
		global $app_list_strings;
60
		global $current_user;
61
		global $theme;
62
		global $timedate;
63
64
		$temp_strings = $mod_strings;
65
		if(!empty($mod)){
66
			global $current_language;
67
			$mod_strings = return_module_language($current_language, $mod);
68
		}
69
			// Unimplemented until jscalendar language files are fixed
70
			// global $current_language;
71
			// global $default_language;
72
			// global $cal_codes;
73
74
	$cal_lang = "en";
75
$cal_dateformat = $timedate->get_cal_date_format();
76
77
$lbl_required_symbol = $app_strings['LBL_REQUIRED_SYMBOL'];
78
$lbl_date = $mod_strings['LBL_DATE'];
79
$lbl_time = $mod_strings['LBL_TIME'];
80
$ntc_date_format = $timedate->get_user_date_format();
81
$ntc_time_format = '('.$timedate->get_user_time_format().')';
82
83
	$user_id = $current_user->id;
84
$default_status = $app_list_strings['meeting_status_default'];
85
$default_parent_type= $app_list_strings['record_type_default_key'];
86
$default_date_start = $timedate->nowDbDate();
87
$default_time_start = $timedate->nowDbTime();
88
$time_ampm = $timedate->AMPMMenu($prefix, $timedate->nowDbTime());
89
			// Unimplemented until jscalendar language files are fixed
90
			// $cal_lang =(empty($cal_codes[$current_language])) ? $cal_codes[$default_language] : $cal_codes[$current_language];
91
$jsCalendarImage = SugarThemeRegistry::current()->getImageURL('jscalendar.gif');
92
			$form = <<<EOF
93
					<input type="hidden" name="${prefix}record" value="">
94
					<input type="hidden" name="${prefix}status" value="${default_status}">
95
					<input type="hidden" name="${prefix}parent_type" value="${default_parent_type}">
96
					<input type="hidden" name="${prefix}assigned_user_id" value='${user_id}'>
97
					<input type="hidden" name="${prefix}duration_hours" value="1">
98
					<input type="hidden" name="${prefix}duration_minutes" value="00">
99
					<p>$lbl_subject<span class="required">$lbl_required_symbol</span><br>
100
					<input name='${prefix}name' size='25' maxlength='255' type="text"><br>
101
					$lbl_date&nbsp;<span class="required">$lbl_required_symbol</span>&nbsp;<span class="dateFormat">$ntc_date_format</span><br>
102
					<input name='${prefix}date_start' id='jscal_field' onblur="parseDate(this, '$cal_dateformat');" type="text" maxlength="10" value="${default_date_start}"> <!--not_in_theme!--><img src="{$jscalendarImage}" alt="{$app_strings['LBL_ENTER_DATE']}"  id="jscal_trigger" align="absmiddle"><br>
0 ignored issues
show
The variable $jscalendarImage does not exist. Did you mean $jsCalendarImage?

This check looks for variables that are accessed but have not been defined. It raises an issue if it finds another variable that has a similar name.

The variable may have been renamed without also renaming all references.

Loading history...
103
					$lbl_time&nbsp;<span class="required">$lbl_required_symbol</span>&nbsp;<span class="dateFormat">$ntc_time_format</span><br>
104
					<input name='${prefix}time_start' type="text" maxlength='5' value="${default_time_start}">{$time_ampm}</p>
105
					<script type="text/javascript">
106
					Calendar.setup({
107
						inputField : "jscal_field", daFormat : "$cal_dateformat", ifFormat : "$cal_dateformat", showsTime : false, button : "jscal_trigger", singleClick : true, step : 1, weekNumbers:false
108
					});
109
					</script>
110
EOF;
111
112
113
$javascript = new javascript();
114
$javascript->setFormName($formname);
115
$javascript->setSugarBean(new Meeting());
116
$javascript->addRequiredFields($prefix);
117
$form .=$javascript->getScript();
118
$mod_strings = $temp_strings;
119
return $form;
120
}
121
122
123
124
function getForm($prefix, $mod='Meetings'){
125
	if(!ACLController::checkAccess('Meetings', 'edit', true)){
126
		return '';
127
	}
128
129
		global $app_strings;
130
		global $app_list_strings;
131
132
		if(!empty($mod)){
133
	global $current_language;
134
	$mod_strings = return_module_language($current_language, $mod);
135
		} else {
136
			global $mod_strings;
137
		}
138
139
		$lbl_save_button_title = $app_strings['LBL_SAVE_BUTTON_TITLE'];
140
		$lbl_save_button_key = $app_strings['LBL_SAVE_BUTTON_KEY'];
141
		$lbl_save_button_label = $app_strings['LBL_SAVE_BUTTON_LABEL'];
142
143
144
$the_form = get_left_form_header($mod_strings['LBL_NEW_FORM_TITLE']);
145
$the_form .= <<<EOQ
146
147
148
		<form name="${prefix}MeetingSave" onSubmit="return check_form('${prefix}MeetingSave')" method="POST" action="index.php">
149
			<input type="hidden" name="${prefix}module" value="Meetings">
150
151
			<input type="hidden" name="${prefix}action" value="Save">
152
153
EOQ;
154
$the_form	.= $this->getFormBody($prefix, 'Meetings',"{$prefix}MeetingSave" );
155
$the_form .= <<<EOQ
156
		<p><input title="$lbl_save_button_title" accessKey="$lbl_save_button_key" class="button" type="submit" name="button" value="  $lbl_save_button_label  " ></p>
157
		</form>
158
EOQ;
159
160
$the_form .= get_left_form_footer();
161
$the_form .= get_validate_record_js();
162
163
return $the_form;
164
}
165
166
167
/**
168
 * handles save functionality for meetings
169
 * @param	string prefix
170
 * @param	bool redirect default True
171
 * @param	bool useRequired default True
172
 */
173
function handleSave($prefix,$redirect=true, $useRequired=false) {
174
175
176
	require_once('include/formbase.php');
177
178
	global $current_user;
179
	global $timedate;
180
181
	$focus = new Meeting();
182
183
	if($useRequired && !checkRequired($prefix, array_keys($focus->required_fields))) {
184
		return null;
185
	}
186
187
	if( !isset($_POST['reminder_checked']) or ( isset($_POST['reminder_checked']) && $_POST['reminder_checked'] == '0')) {
188
		$_POST['reminder_time'] = -1;
189
	}
190
	if(!isset($_POST['reminder_time'])) {
191
		$_POST['reminder_time'] = $current_user->getPreference('reminder_time');
192
		$_POST['reminder_checked']=1;
193
	}
194
	
195
	if(!isset($_POST['email_reminder_checked']) || (isset($_POST['email_reminder_checked']) && $_POST['email_reminder_checked'] == '0')) {
196
		$_POST['email_reminder_time'] = -1;
197
	}
198
	if(!isset($_POST['email_reminder_time'])){
199
		$_POST['email_reminder_time'] = $current_user->getPreference('email_reminder_time');
200
		$_POST['email_reminder_checked'] = 1;
201
	}
202
	
203
	// don't allow to set recurring_source from a form
204
	unset($_POST['recurring_source']);
205
	
206
	$time_format = $timedate->get_user_time_format();
207
    $time_separator = ":";
208
    if(preg_match('/\d+([^\d])\d+([^\d]*)/s', $time_format, $match)) {
209
       $time_separator = $match[1];
210
    }
211
212
	if(!empty($_POST[$prefix.'time_hour_start']) && empty($_POST['time_start'])) {
213
		$_POST[$prefix.'time_start'] = $_POST[$prefix.'time_hour_start']. $time_separator .$_POST[$prefix.'time_minute_start'];
214
	}
215
216
	if(isset($_POST[$prefix.'meridiem']) && !empty($_POST[$prefix.'meridiem'])) {
217
		$_POST[$prefix.'time_start'] = $timedate->merge_time_meridiem($_POST[$prefix.'time_start'],$timedate->get_time_format(), $_POST[$prefix.'meridiem']);
218
	}
219
220
	if(isset($_POST[$prefix.'time_start']) && strlen($_POST[$prefix.'date_start']) == 10) {
221
       $_POST[$prefix.'date_start'] = $_POST[$prefix.'date_start'] . ' ' . $_POST[$prefix.'time_start'];
222
	}
223
224
	// retrieve happens here
225
	$focus = populateFromPost($prefix, $focus);
226
	if(!$focus->ACLAccess('Save')) {
227
	   ACLController::displayNoAccess(true);
228
	   sugar_cleanup(true);
229
	}
230
231
    // if dates changed
232
    if (!empty($focus->id)) {
233
        $oldBean = new Meeting();
234
        $oldBean->retrieve($focus->id);
235
        if (($focus->date_start != $oldBean->date_start) || ($focus->date_end != $oldBean->date_end)) {
236
            $focus->date_changed = true;
237
        } else {
238
            $focus->date_changed = false;
239
        }
240
    }
241
242
    $newBean = true;
243
    if (!empty($focus->id)) {
244
        $newBean = false;
245
    }
246
247
	//add assigned user and current user if this is the first time bean is saved
248
  	if(empty($focus->id) && !empty($_REQUEST['return_module']) && $_REQUEST['return_module'] =='Meetings' && !empty($_REQUEST['return_action']) && $_REQUEST['return_action'] =='DetailView'){
249
		//if return action is set to detail view and return module to meeting, then this is from the long form, do not add the assigned user (only the current user)
250
		//The current user is already added to UI and we want to give the current user the option of opting out of meeting.
251
  	 	//add current user if the assigned to user is different than current user.
252
	  	if($current_user->id != $_POST['assigned_user_id']){
253
	  		$_POST['user_invitees'] .= ','.$_POST['assigned_user_id'].', ';
254
    		$_POST['user_invitees'] = str_replace(',,', ',', $_POST['user_invitees']);
255
	  	}
256
  	}elseif (empty($focus->id) ){
257
	  	//this is not from long form so add assigned and current user automatically as there is no invitee list UI.
258
	  	//This call could be through an ajax call from subpanels or shortcut bar
259
        if(!isset($_POST['user_invitees']))
260
        {
261
           $_POST['user_invitees'] = '';
262
        }
263
264
	  	$_POST['user_invitees'] .= ','.$_POST['assigned_user_id'].', ';
265
266
	  	//add current user if the assigned to user is different than current user.
267
	  	if($current_user->id != $_POST['assigned_user_id'] && $_REQUEST['module'] != "Calendar"){
268
	  		$_POST['user_invitees'] .= ','.$current_user->id.', ';
269
	  	}
270
271
	  	//remove any double comma's introduced during appending
272
	    $_POST['user_invitees'] = str_replace(',,', ',', $_POST['user_invitees']);
273
  	}
274
275
276
	if( (isset($_POST['isSaveFromDetailView']) && $_POST['isSaveFromDetailView'] == 'true') ||
277
        (isset($_POST['is_ajax_call']) && !empty($_POST['is_ajax_call']) && !empty($focus->id) ||
278
        (isset($_POST['return_action']) && $_POST['return_action'] == 'SubPanelViewer') && !empty($focus->id))||
279
         !isset($_POST['user_invitees']) // we need to check that user_invitees exists before processing, it is ok to be empty
280
    ){
281
        $focus->save(true);
282
        $return_id = $focus->id;
283
	}else{
284
		if($focus->status == 'Held' && $this->isEmptyReturnModuleAndAction() && !$this->isSaveFromDCMenu()){
285
    		//if we are closing the meeting, and the request does not have a return module AND return action set and it is not a save
286
            //being triggered by the DCMenu (shortcut bar) then the request is coming from a dashlet or subpanel close icon and there is no
287
            //need to process user invitees, just save the current values.
288
    		$focus->save(true);
289
	    }else{
290
	    	///////////////////////////////////////////////////////////////////////////
291
	    	////	REMOVE INVITEE RELATIONSHIPS
292
	    	if(!empty($_POST['user_invitees'])) {
293
	    	   $userInvitees = explode(',', trim($_POST['user_invitees'], ','));
294
	    	} else {
295
	    	   $userInvitees = array();
296
	    	}
297
298
	        // Calculate which users to flag as deleted and which to add
299
	        $deleteUsers = array();
300
	    	$focus->load_relationship('users');
301
	    	// Get all users for the meeting
302
	    	$q = 'SELECT mu.user_id, mu.accept_status FROM meetings_users mu WHERE mu.meeting_id = \''.$focus->id.'\' AND mu.deleted=0';
303
	    	$r = $focus->db->query($q);
304
	    	$acceptStatusUsers = array();
305
	    	while($a = $focus->db->fetchByAssoc($r)) {
306
	    		  if(!in_array($a['user_id'], $userInvitees)) {
307
	    		  	 $deleteUsers[$a['user_id']] = $a['user_id'];
308
	    		  } else {
309
	    		     $acceptStatusUsers[$a['user_id']] = $a['accept_status'];
310
	    		  }
311
	    	}
312
313
	    	if(count($deleteUsers) > 0) {
314
	    		$sql = '';
315
	    		foreach($deleteUsers as $u) {
316
	    		        $sql .= ",'" . $u . "'";
317
	    		}
318
	    		$sql = substr($sql, 1);
319
	    		// We could run a delete SQL statement here, but will just mark as deleted instead
320
	    		$sql = "UPDATE meetings_users set deleted = 1 where user_id in ($sql) AND meeting_id = '". $focus->id . "'";
321
	    		$focus->db->query($sql);
322
	    	}
323
324
	        // Get all contacts for the meeting
325
	    	if(!empty($_POST['contact_invitees'])) {
326
	    	   $contactInvitees = explode(',', trim($_POST['contact_invitees'], ','));
327
	    	} else {
328
	    	   $contactInvitees = array();
329
	    	}
330
331
	        $deleteContacts = array();
332
	    	$focus->load_relationship('contacts');
333
	    	$q = 'SELECT mu.contact_id, mu.accept_status FROM meetings_contacts mu WHERE mu.meeting_id = \''.$focus->id.'\' AND mu.deleted=0';
334
	    	$r = $focus->db->query($q);
335
	    	$acceptStatusContacts = array();
336
	    	while($a = $focus->db->fetchByAssoc($r)) {
337
	    		  if(!in_array($a['contact_id'], $contactInvitees)) {
338
	    		  	 $deleteContacts[$a['contact_id']] = $a['contact_id'];
339
	    		  }	else {
340
	    		  	 $acceptStatusContacts[$a['contact_id']] = $a['accept_status'];
341
	    		  }
342
	    	}
343
344
	    	if(count($deleteContacts) > 0) {
345
	    		$sql = '';
346
	    		foreach($deleteContacts as $u) {
347
	    		        $sql .= ",'" . $u . "'";
348
	    		}
349
	    		$sql = substr($sql, 1);
350
	    		// We could run a delete SQL statement here, but will just mark as deleted instead
351
	    		$sql = "UPDATE meetings_contacts set deleted = 1 where contact_id in ($sql) AND meeting_id = '". $focus->id . "'";
352
	    		$focus->db->query($sql);
353
	    	}
354
	        if(!empty($_POST['lead_invitees'])) {
355
	    	   $leadInvitees = explode(',', trim($_POST['lead_invitees'], ','));
356
	    	} else {
357
	    	   $leadInvitees = array();
358
	    	}
359
360
	        $deleteLeads = array();
361
	    	$focus->load_relationship('leads');
362
	    	$q = 'SELECT mu.lead_id, mu.accept_status FROM meetings_leads mu WHERE mu.meeting_id = \''.$focus->id.'\' AND mu.deleted=0';
363
	    	$r = $focus->db->query($q);
364
	    	$acceptStatusLeads = array();
365
	    	while($a = $focus->db->fetchByAssoc($r)) {
366
	    		  if(!in_array($a['lead_id'], $leadInvitees)) {
367
	    		  	 $deleteLeads[$a['lead_id']] = $a['lead_id'];
368
	    		  }	else {
369
	    		  	 $acceptStatusLeads[$a['lead_id']] = $a['accept_status'];
370
	    		  }
371
	    	}
372
373
	    	if(count($deleteLeads) > 0) {
374
	    		$sql = '';
375
	    		foreach($deleteLeads as $u) {
376
	    		        $sql .= ",'" . $u . "'";
377
	    		}
378
	    		$sql = substr($sql, 1);
379
	    		// We could run a delete SQL statement here, but will just mark as deleted instead
380
	    		$sql = "UPDATE meetings_leads set deleted = 1 where lead_id in ($sql) AND meeting_id = '". $focus->id . "'";
381
	    		$focus->db->query($sql);
382
	    	}
383
	    	////	END REMOVE
384
	    	///////////////////////////////////////////////////////////////////////////
385
386
387
	    	///////////////////////////////////////////////////////////////////////////
388
	    	////	REBUILD INVITEE RELATIONSHIPS
389
	    	$focus->users_arr = array();
390
	    	$focus->users_arr = $userInvitees;
391
	    	$focus->contacts_arr = array();
392
	    	$focus->contacts_arr = $contactInvitees;
393
	        $focus->leads_arr = array();
394
	    	$focus->leads_arr = $leadInvitees;
395
396
	    	if(!empty($_POST['parent_id']) && $_POST['parent_type'] == 'Contacts') {
397
	    		$focus->contacts_arr[] = $_POST['parent_id'];
398
	    	}
399
	        if(!empty($_POST['parent_id']) && $_POST['parent_type'] == 'Leads') {
400
	    		$focus->leads_arr[] = $_POST['parent_id'];
401
	    	}
402
	    	// Call the Meeting module's save function to handle saving other fields besides
403
	    	// the users and contacts relationships
404
            $focus->update_vcal = false;    // Bug #49195 : don't update vcal b/s related users aren't saved yet, create vcal cache below
405
	    	$focus->save(true);
406
	    	$return_id = $focus->id;
407
	    	if(empty($return_id)){
408
                //this is to handle the situation where the save fails, most likely because of a failure
409
                //in the external api. bug: 42200
410
                $_REQUEST['action'] = 'EditView';
411
                $_REQUEST['return_action'] = 'EditView';
412
                handleRedirect('', 'Meetings');
413
            }
414
	    	// Process users
415
	    	$existing_users = array();
416
	    	if(!empty($_POST['existing_invitees'])) {
417
	    	   $existing_users =  explode(",", trim($_POST['existing_invitees'], ','));
418
	    	}
419
420
	    	foreach($focus->users_arr as $user_id) {
421
	    	    if(empty($user_id) || isset($existing_users[$user_id]) || isset($deleteUsers[$user_id])) {
422
	    			continue;
423
	    		}
424
425
	    		if(!isset($acceptStatusUsers[$user_id])) {
426
	    			$focus->users->add($user_id);
427
	    		} else if (!$focus->date_changed) {
428
	    			// update query to preserve accept_status
429
	    			$qU  = 'UPDATE meetings_users SET deleted = 0, accept_status = \''.$acceptStatusUsers[$user_id].'\' ';
430
	    			$qU .= 'WHERE meeting_id = \''.$focus->id.'\' ';
431
	    			$qU .= 'AND user_id = \''.$user_id.'\'';
432
	    			$focus->db->query($qU);
433
	    		}
434
	    	}
435
436
	        // Process contacts
437
	    	$existing_contacts =  array();
438
	    	if(!empty($_POST['existing_contact_invitees'])) {
439
	    	   $existing_contacts =  explode(",", trim($_POST['existing_contact_invitees'], ','));
440
	    	}
441
442
	    	foreach($focus->contacts_arr as $contact_id) {
443
	    		if(empty($contact_id) || isset($existing_contacts[$contact_id]) || isset($deleteContacts[$contact_id])) {
444
	    			continue;
445
	    		}
446
447
	    		if(!isset($acceptStatusContacts[$contact_id])) {
448
	    		    $focus->contacts->add($contact_id);
449
	    		} else if (!$focus->date_changed) {
450
	    			// update query to preserve accept_status
451
	    			$qU  = 'UPDATE meetings_contacts SET deleted = 0, accept_status = \''.$acceptStatusContacts[$contact_id].'\' ';
452
	    			$qU .= 'WHERE meeting_id = \''.$focus->id.'\' ';
453
	    			$qU .= 'AND contact_id = \''.$contact_id.'\'';
454
	    			$focus->db->query($qU);
455
	    		}
456
	    	}
457
	        // Process leads
458
	    	$existing_leads =  array();
459
	    	if(!empty($_POST['existing_lead_invitees'])) {
460
	    	   $existing_leads =  explode(",", trim($_POST['existing_lead_invitees'], ','));
461
	    	}
462
463
	    	foreach($focus->leads_arr as $lead_id) {
464
	    		if(empty($lead_id) || isset($existing_leads[$lead_id]) || isset($deleteLeads[$lead_id])) {
465
	    			continue;
466
	    		}
467
468
	    		if(!isset($acceptStatusLeads[$lead_id])) {
469
	    		    $focus->leads->add($lead_id);
470
	    		} else if (!$focus->date_changed) {
471
	    			// update query to preserve accept_status
472
	    			$qU  = 'UPDATE meetings_leads SET deleted = 0, accept_status = \''.$acceptStatusLeads[$lead_id].'\' ';
473
	    			$qU .= 'WHERE meeting_id = \''.$focus->id.'\' ';
474
	    			$qU .= 'AND lead_id = \''.$lead_id.'\'';
475
	    			$focus->db->query($qU);
476
	    		}
477
	    	}
478
479
            // Bug #49195 : update vcal
480
            vCal::cache_sugar_vcal($current_user);
481
            
482
	    	// CCL - Comment out call to set $current_user as invitee
483
	    	// set organizer to auto-accept
484
            if ($focus->assigned_user_id == $current_user->id && $newBean) {
485
	    	$focus->set_accept_status($current_user, 'accept');
486
            }
487
488
	    	////	END REBUILD INVITEE RELATIONSHIPS
489
	    	///////////////////////////////////////////////////////////////////////////
490
		}
491
	}
492
493
	if(!empty($_POST['is_ajax_call']))
494
	{
495
		$json = getJSONobj();
496
		echo $json->encode(array('status' => 'success', 'get' => ''));
497
		exit;
498
	}
499
500
	if (isset($_REQUEST['return_module']) && $_REQUEST['return_module'] == 'Home'){
501
		header("Location: index.php?module=Home&action=index");
502
	}
503
	else if($redirect) {
504
		handleRedirect($return_id, 'Meetings');
505
	} else {
506
		return $focus;
507
	}
508
509
} // end handleSave();
510
511
} // end Class def
512
?>
513