Issues (4069)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

modules/Relationships/RelationshipHandler.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2 1
if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
3
/*********************************************************************************
4
 * SugarCRM Community Edition is a customer relationship management program developed by
5
 * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc.
6
7
 * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd.
8
 * Copyright (C) 2011 - 2014 Salesagility Ltd.
9
 *
10
 * This program is free software; you can redistribute it and/or modify it under
11
 * the terms of the GNU Affero General Public License version 3 as published by the
12
 * Free Software Foundation with the addition of the following permission added
13
 * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
14
 * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY
15
 * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
16
 *
17
 * This program is distributed in the hope that it will be useful, but WITHOUT
18
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
19
 * FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
20
 * details.
21
 *
22
 * You should have received a copy of the GNU Affero General Public License along with
23
 * this program; if not, see http://www.gnu.org/licenses or write to the Free
24
 * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
25
 * 02110-1301 USA.
26
 *
27
 * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road,
28
 * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected].
29
 *
30
 * The interactive user interfaces in modified source and object code versions
31
 * of this program must display Appropriate Legal Notices, as required under
32
 * Section 5 of the GNU Affero General Public License version 3.
33
 *
34
 * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
35
 * these Appropriate Legal Notices must retain the display of the "Powered by
36
 * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not
37
 * reasonably feasible for  technical reasons, the Appropriate Legal Notices must
38
 * display the words  "Powered by SugarCRM" and "Supercharged by SuiteCRM".
39
 ********************************************************************************/
40
41
42
43
44
45
46
47
48
49
class RelationshipHandler extends Relationship {
50
51
	var $db;							//Database link by reference
52
53
	var $base_module;					//name of module
54
	var $base_bean;						//actual object
55
	var $base_vardef_field;				//base's vardef field name of relationship with rel1
56
57
	var $rel1_module;					//name of related module
58
	var $rel1_bean;						//actual related object
59
	var $rel1_relationship_name;		//Relationship name between base and rel1
60
	var $rel1_vardef_field;				//rel1's vardef field name of relationship with rel2
61
	var $rel1_vardef_field_base;		//rel1's vardef field name of relationship with base
62
63
	var $rel2_module;					//name of related related module
64
	var $rel2_bean;						//actual related related object
65
	var $rel2_relationship_name;		//Relationship name between rel1 and rel2
66
	var $rel2_vardef_field;				//rel2's vardef field name of relationship with rel1
67
68
69
	var $base_array;					//Info array
70
	var $rel1_array;					//Info array
71
	var $rel2_array;					//Info array
72
73
74
	/*
75
76
	info arrays contain:
77
78
		'slabel' ->		singular module name in correct language
79
		'plabel' ->  	plural module name in correct language
80
81
82
83
	*/
84
85
86
///////////////////////////Setup and populate functions//////////////////////////////
87
88 1
	function __construct(& $db, $base_module=""){
89
90 1
		$this->db = $db;
91 1
		$this->base_module = $base_module;
92
93
	//end function RelationshipHandler
94 1
	}
95
96
    /**
97
     * @deprecated deprecated since version 7.6, PHP4 Style Constructors are deprecated and will be remove in 7.8, please update your code, use __construct instead
98
     */
99
    function RelationshipHandler(& $db, $base_module=""){
100
        $deprecatedMessage = 'PHP4 Style Constructors are deprecated and will be remove in 7.8, please update your code';
101
        if(isset($GLOBALS['log'])) {
102
            $GLOBALS['log']->deprecated($deprecatedMessage);
103
        }
104
        else {
105
            trigger_error($deprecatedMessage, E_USER_DEPRECATED);
106
        }
107
        self::__construct( $db, $base_module);
108
    }
109
110
111
	function set_rel_vardef_fields($base_vardef_field, $rel1_vardef_field=""){
112
113
		$this->base_vardef_field = $base_vardef_field;
114
		$this->rel1_vardef_field = $rel1_vardef_field;
115
116
	//end function set_rel_vardef_fields
117
	}
118
119
120
	function set_rel_relationship_names($build_rel2=false){
121
122
		$this->rel1_relationship_name = $this->base_bean->field_defs[$this->base_vardef_field]['relationship'];
123
124
	if($build_rel2==true){
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
125
		$this->rel2_relationship_name = $this->rel1_bean->field_defs[$this->rel1_vardef_field]['relationship'];
126
	}
127
128
	//end function set_rel_relationship_names
129
	}
130
131
132
133
134
///////////////////////////////END Setup and populate functions/////////////////////
135
136
137
	/*
138
	set the build_rel2 to true if you want the rel2 info array as well
139
	This function will build all the relationship info it can based on values set in the setup functions
140
	When you use the info arrays (rel1_array) or (rel2_array), make sure you always check for empty values
141
	*/
142 1
	function build_info($build_rel2=false){
143 1
		if($this->base_bean == null){
144 1
			$this->base_bean = get_module_info($this->base_module);
145
		}
146
147 1
		if(empty($this->rel1_bean)){
148
			$this->build_rel1_info();
149
			$this->rel1_module = $this->rel1_bean->module_dir;
150
		}
151
152 1
		if($build_rel2==true && $this->rel2_bean==""){
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
153
			$this->build_rel2_info();
154
			$this->rel2_module = $this->rel2_bean->module_dir;
155
		}
156
157
		//translate the module titles to the proper language
158 1
		$this->build_module_labels($build_rel2);
159
160
	//end function build_info
161 1
	}
162
163
	function build_rel1_info(){
164
165
			$this->rel1_bean = $this->trace_relationship_module($this->base_module, $this->base_vardef_field);
166
167
	//end function build_rel1_info
168
	}
169
170
	function build_rel2_info(){
171
172
			$this->rel2_bean = $this->trace_relationship_module($this->base_module, $this->base_vardef_field, $this->rel1_vardef_field);
173
174
	//end function build_rel1_info
175
	}
176
177
	/*
178
	Translates the module names to their singular and plural label and puts them in
179
	the info arrays.  Does it for base, rel1, and rel2 if specified
180
	*/
181
182 1
	function build_module_labels($build_rel2=false){
183 1
		global $app_list_strings;
184
185
		///Base Module Labels
186 1
		if(!empty($app_list_strings['moduleList'][$this->base_bean->module_dir])){
187 1
			$this->base_array['plabel'] = $app_list_strings['moduleList'][$this->base_bean->module_dir];
188
		} else {
189
			$this->base_array['plabel'] = $this->base_bean->module_dir;
190
		}
191 1
		if(!empty($app_list_strings['moduleListSingular'][$this->base_bean->module_dir])){
192 1
			$this->base_array['slabel'] = $app_list_strings['moduleListSingular'][$this->base_bean->module_dir];
193
		} else {
194 1
			$this->base_array['slabel'] = $this->base_bean->object_name;
195
		}
196
197
		///Rel1 Module Labels
198 1
		if(!empty($app_list_strings['moduleList'][$this->rel1_bean->module_dir])){
199 1
			$this->rel1_array['plabel'] = $app_list_strings['moduleList'][$this->rel1_bean->module_dir];
200
		} else {
201
			$this->rel1_array['plabel'] = $this->rel1_bean->module_dir;
202
		}
203
204 1
		if(!empty($app_list_strings['moduleListSingular'][$this->rel1_bean->module_dir])){
205 1
			$this->rel1_array['slabel'] = $app_list_strings['moduleListSingular'][$this->rel1_bean->module_dir];
206
		} else {
207 1
			$this->rel1_array['slabel'] = $this->rel1_bean->object_name;
208
		}
209
210
211
		//Rel2 Module Labels
212 1
		if($build_rel2==true){
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
213
214
			if(!empty($app_list_strings['moduleList'][$this->rel2_bean->module_dir])){
215
				$this->rel2_array['plabel'] = $app_list_strings['moduleList'][$this->rel2_bean->module_dir];
216
			} else {
217
				$this->rel2_array['plabel'] = $this->rel2_bean->module_dir;
218
			}
219
			if(!empty($app_list_strings['moduleListSingular'][$this->rel2_bean->module_dir])){
220
				$this->rel2_array['slabel'] = $app_list_strings['moduleListSingular'][$this->rel2_bean->module_dir];
221
			} else {
222
				$this->rel2_array['slabel'] = $this->rel2_bean->module_dir;
223
			}
224
		//end if build_rel2 is true
225
		}
226
227
	//end function buld_module_lables
228 1
	}
229
230
231
232
233
234
	function build_related_list($type="base"){
235
		//type can be base, rel1
236
237
		$target_list = "";
238
239
		if($type=="base"){
240
			$target_list = $this->base_bean->get_linked_beans($this->base_vardef_field, $this->rel1_bean->object_name);
241
		//Possibility exists that this is a new relationship, so capture via relationship fields
242
			if(empty($target_list)){
243
				$target_list = search_filter_rel_info($this->base_bean, $this->rel1_bean->module_dir, $this->base_vardef_field);
244
			//end if the target list is empty
245
			}
246
		}
247
248
		if($type=="rel1"){
249
			$target_list = $this->rel1_bean->get_linked_beans($this->rel1_vardef_field, $this->rel2_bean->object_name);
250
251
			//Possibility exists that this is a new relationship, so capture via relationship fields
252
			if(empty($target_list)){
253
				$target_list = search_filter_rel_info($this->rel1_bean, $this->rel2_bean->module_dir, $this->rel1_vardef_field);
254
			//end if the target list is empty
255
			}
256
		}
257
258
		return $target_list;
259
260
	//end function build_related_list
261
	}
262
263
264
265
266
///////BEGIN Functions to find relationships/////////////////////////////////
267
268
function get_relationship_information(& $target_bean, $get_upstream_rel_field_name = false){
269
270
	$target_module_name = $target_bean->module_dir;
271
	$current_module_name = $this->base_module;
272
273
	//Look for downstream connection
274
	$rel_array = $this->retrieve_by_sides($current_module_name, $target_module_name, $this->db);
275
276
277
	//Does a downstream relationship exist
278
	if($rel_array!=null){
279
		if($rel_array['relationship_type']=="many-to-many"){
280
			$joinKeyLHS = $rel_array['join_key_lhs'];
281
			$target_bean->$joinKeyLHS = $this->base_bean->id;
282
			if($rel_array['relationship_role_column']!=""){
283
				$relRole = $rel_array['relationship_role_column'];
284
				$target_bean->$relRole = $rel_array['relationship_role_column_value'];
285
			}				
286
		//end if many-to-many	
287
		}	
288
		
289
		if($rel_array['relationship_type']=="one-to-many"){
290
			$RHSKey = $rel_array['rhs_key'];
291
			$target_bean->$RHSKey = $this->base_bean->id;
292
			if($rel_array['relationship_role_column']!=""){
293
				$relRole = $rel_array['relationship_role_column'];
294
				$target_bean->$relRole = $rel_array['relationship_role_column_value'];
295
			}
296
		//end if one-to-many
297
		}
298
299
		return;
300
	//end if downstream relationship exists
301
	}
302
303
304
305
	//Look for upstream connection
306
	$rel_array = $this->retrieve_by_sides($target_module_name, $current_module_name, $this->db);
307
308
	//Does an upstream relationship exist
309
	if($rel_array!=null){
310
		if($rel_array['relationship_type']=="many-to-many"){
311
			$joinKeyRHS = $rel_array['join_key_rhs'];
312
			$target_bean->$joinKeyRHS = $this->base_bean->id;
313
			if($rel_array['relationship_role_column']!=""){
314
				$relRole = $rel_array['relationship_role_column'];
315
				$target_bean->$relRole = $rel_array['relationship_role_column_value'];
316
			}				
317
		//end if many-to-many	
318
		}	
319
		
320
		if($rel_array['relationship_type']=="one-to-many"){
321
			$RHSKey = $rel_array['rhs_key'];
322
			$target_bean->$RHSKey = $this->base_bean->id;
323
			if($rel_array['relationship_role_column']!=""){
324
				$relRole = $rel_array['relationship_role_column'];
325
				$target_bean->$relRole = $rel_array['relationship_role_column_value'];
326
			}
327
		//end if one-to-many
328
		}
329
330
331
		///Fill additional id field if necessary
332
		if(($id_name = $this->traverse_rel_meta($current_module_name, $target_bean, $rel_array['relationship_name'])) != null){
333
			$target_bean->$id_name = $this->base_bean->id;
334
            if($get_upstream_rel_field_name) {
335
                $target_bean->new_rel_relname = $id_name;
336
                $target_bean->new_rel_id = $this->base_bean->id;
337
            }
338
		}
339
340
	//end if an upstream relationship exists
341
	}
342
343
//end function get_relationship_information
344
}
345
346
function traverse_rel_meta($base_module, & $target_bean, $target_rel_name){
347
	$id_name = null;
348
349
	//returns name of variable to store id in
350
	//if none exists, then returns null
351
	foreach($target_bean->field_defs as $field_array){
352
353
		if(!empty($field_array['relationship']) && $field_array['relationship']==$target_rel_name){
354
355
			$id_name = $this->get_id_name($target_bean, $field_array['name']);
356
			return $id_name;
357
		//end if rel name match
358
		}
359
360
	//end foreach field def
361
	}
362
363
	return null;
364
365
//end function traverse_rel_meta
366
}
367
368
369
function get_id_name(& $target_bean, $field_name){
370
371
	foreach($target_bean->relationship_fields as $target_id => $rel_name){
372
373
		if($rel_name == $field_name){
374
			//relationship id found
375
			return $target_id;
376
		//end if match
377
		}
378
	//end foreach
379
	}
380
381
	return null;
382
//end function get_id_name
383
}
384
385
///////////////////////////END functions to find relationships //////////////////////
386
387
388 1
function process_by_rel_bean($rel1_module){
389
390 1
	$this->rel1_relationship_name = $this::retrieve_by_modules($this->base_module, $rel1_module, $this->db);
391 1
	$this->rel1_module = $rel1_module;
392 1
	$this->rel1_bean = get_module_info($this->rel1_module);
393
394
//end function process_by_rel_bean
395 1
}
396
397
398 1
function get_rel1_vardef_field_base($field_defs){
399 1
	foreach($field_defs as $field_array){
400
401 1
		if(!empty($field_array['relationship']) && $field_array['relationship']==$this->rel1_relationship_name){
402
403 1
			$this->rel1_vardef_field_base = $field_array['name'];
404
		//end if rel name match
405
		}
406
407
	//end foreach field def
408
	}
409
410 1
	return null;
411
412
413
//end get_rel1_vardef_field_base
414
}
415
416
417
function get_farthest_reach(){
418
419
	if($this->rel1_vardef_field!=""){
420
		//the farthest reach is rel2
421
		$this->build_info(true);
422
		return $this->rel2_bean;
423
	}
424
425
	//the farthest reach is rel1
426
	$this->build_info(false);
427
	return $this->rel1_bean;
428
429
//end function get_farthest_reach
430
}
431
432
//end class RelationshipHandler
433
}
434
435
?>
436