adamjakab /
SuiteCRM
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point'); |
||
| 3 | /********************************************************************************* |
||
| 4 | * SugarCRM Community Edition is a customer relationship management program developed by |
||
| 5 | * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc. |
||
| 6 | |||
| 7 | * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd. |
||
| 8 | * Copyright (C) 2011 - 2014 Salesagility Ltd. |
||
| 9 | * |
||
| 10 | * This program is free software; you can redistribute it and/or modify it under |
||
| 11 | * the terms of the GNU Affero General Public License version 3 as published by the |
||
| 12 | * Free Software Foundation with the addition of the following permission added |
||
| 13 | * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK |
||
| 14 | * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY |
||
| 15 | * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS. |
||
| 16 | * |
||
| 17 | * This program is distributed in the hope that it will be useful, but WITHOUT |
||
| 18 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS |
||
| 19 | * FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more |
||
| 20 | * details. |
||
| 21 | * |
||
| 22 | * You should have received a copy of the GNU Affero General Public License along with |
||
| 23 | * this program; if not, see http://www.gnu.org/licenses or write to the Free |
||
| 24 | * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
||
| 25 | * 02110-1301 USA. |
||
| 26 | * |
||
| 27 | * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road, |
||
| 28 | * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected]. |
||
| 29 | * |
||
| 30 | * The interactive user interfaces in modified source and object code versions |
||
| 31 | * of this program must display Appropriate Legal Notices, as required under |
||
| 32 | * Section 5 of the GNU Affero General Public License version 3. |
||
| 33 | * |
||
| 34 | * In accordance with Section 7(b) of the GNU Affero General Public License version 3, |
||
| 35 | * these Appropriate Legal Notices must retain the display of the "Powered by |
||
| 36 | * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not |
||
| 37 | * reasonably feasible for technical reasons, the Appropriate Legal Notices must |
||
| 38 | * display the words "Powered by SugarCRM" and "Supercharged by SuiteCRM". |
||
| 39 | ********************************************************************************/ |
||
| 40 | |||
| 41 | |||
| 42 | // this is a list of what values are expected for a given custom field type |
||
| 43 | // will eventually be moved to the SugarFields classes |
||
| 44 | $custom_field_meta = array( |
||
| 45 | 'address' => array( |
||
| 46 | 'default', |
||
| 47 | 'duplicate_merge', |
||
| 48 | 'help', |
||
| 49 | 'label', |
||
| 50 | 'label_value', |
||
| 51 | 'len', |
||
| 52 | 'name', |
||
| 53 | 'reportable' |
||
| 54 | ), |
||
| 55 | 'bool' => array( |
||
| 56 | 'duplicate_merge', |
||
| 57 | 'help', |
||
| 58 | 'label', |
||
| 59 | 'label_value', |
||
| 60 | 'name', |
||
| 61 | 'reportable' |
||
| 62 | ), |
||
| 63 | 'currency' => array( |
||
| 64 | 'duplicate_merge', |
||
| 65 | 'help', |
||
| 66 | 'label', |
||
| 67 | 'label_value', |
||
| 68 | 'name', |
||
| 69 | 'reportable' |
||
| 70 | ), |
||
| 71 | 'date' => array( |
||
| 72 | 'audited', |
||
| 73 | 'default_value', |
||
| 74 | 'duplicate_merge', |
||
| 75 | 'help', |
||
| 76 | 'label', |
||
| 77 | 'label_value', |
||
| 78 | 'massupdate', |
||
| 79 | 'name', |
||
| 80 | 'reportable', |
||
| 81 | 'required' |
||
| 82 | ), |
||
| 83 | 'enum' => array( |
||
| 84 | 'audited', |
||
| 85 | 'default', |
||
| 86 | 'duplicate_merge', |
||
| 87 | 'help', |
||
| 88 | 'label', |
||
| 89 | 'label_value', |
||
| 90 | 'massupdate', |
||
| 91 | 'name', |
||
| 92 | 'options', |
||
| 93 | 'reportable', |
||
| 94 | 'required' |
||
| 95 | ), |
||
| 96 | 'float' => array( |
||
| 97 | 'audited', |
||
| 98 | 'default', |
||
| 99 | 'duplicate_merge', |
||
| 100 | 'help', |
||
| 101 | 'label', |
||
| 102 | 'label_value', |
||
| 103 | 'len', |
||
| 104 | 'name', |
||
| 105 | 'precision', |
||
| 106 | 'reportable', |
||
| 107 | 'required' |
||
| 108 | ), |
||
| 109 | 'html' => array( |
||
| 110 | 'audited', |
||
| 111 | 'duplicate_merge', |
||
| 112 | 'ext4', |
||
| 113 | 'help', |
||
| 114 | 'label', |
||
| 115 | 'label_value', |
||
| 116 | 'name', |
||
| 117 | 'reportable', |
||
| 118 | 'required' |
||
| 119 | ), |
||
| 120 | 'int' => array( |
||
| 121 | 'audited', |
||
| 122 | 'default', |
||
| 123 | 'duplicate_merge', |
||
| 124 | 'help', |
||
| 125 | 'label', |
||
| 126 | 'label_value', |
||
| 127 | 'len', |
||
| 128 | 'max', |
||
| 129 | 'min', |
||
| 130 | 'name', |
||
| 131 | 'reportable', |
||
| 132 | 'required' |
||
| 133 | ), |
||
| 134 | 'multienum' => array( |
||
| 135 | 'audited', |
||
| 136 | 'default', |
||
| 137 | 'duplicate_merge', |
||
| 138 | 'help', |
||
| 139 | 'label', |
||
| 140 | 'label_value', |
||
| 141 | 'massupdate', |
||
| 142 | 'name', |
||
| 143 | 'options', |
||
| 144 | 'reportable', |
||
| 145 | 'required' |
||
| 146 | ), |
||
| 147 | 'phone' => array( |
||
| 148 | 'audited', |
||
| 149 | 'default', |
||
| 150 | 'duplicate_merge', |
||
| 151 | 'help', |
||
| 152 | 'label', |
||
| 153 | 'label_value', |
||
| 154 | 'len', |
||
| 155 | 'name', |
||
| 156 | 'reportable', |
||
| 157 | 'required' |
||
| 158 | ), |
||
| 159 | 'radioenum' => array( |
||
| 160 | 'audited', |
||
| 161 | 'default', |
||
| 162 | 'duplicate_merge', |
||
| 163 | 'help', |
||
| 164 | 'label', |
||
| 165 | 'label_value', |
||
| 166 | 'massupdate', |
||
| 167 | 'name', |
||
| 168 | 'options', |
||
| 169 | 'reportable', |
||
| 170 | 'required' |
||
| 171 | ), |
||
| 172 | 'relate' => array( |
||
| 173 | 'audited', |
||
| 174 | 'duplicate_merge', |
||
| 175 | 'ext2', |
||
| 176 | 'help', |
||
| 177 | 'label', |
||
| 178 | 'label_value', |
||
| 179 | 'name', |
||
| 180 | 'reportable', |
||
| 181 | 'required' |
||
| 182 | ), |
||
| 183 | 'text' => array( |
||
| 184 | 'audited', |
||
| 185 | 'default', |
||
| 186 | 'duplicate_merge', |
||
| 187 | 'help', |
||
| 188 | 'label', |
||
| 189 | 'label_value', |
||
| 190 | 'name', |
||
| 191 | 'reportable', |
||
| 192 | 'required' |
||
| 193 | ), |
||
| 194 | 'varchar' => array( |
||
| 195 | 'audited', |
||
| 196 | 'default', |
||
| 197 | 'duplicate_merge', |
||
| 198 | 'help', |
||
| 199 | 'label', |
||
| 200 | 'label_value', |
||
| 201 | 'len', |
||
| 202 | 'name', |
||
| 203 | 'reportable', |
||
| 204 | 'required' |
||
| 205 | ) |
||
| 206 | ); |
||
| 207 | |||
| 208 | // create or update an existing custom field |
||
| 209 | $server->register( |
||
| 210 | 'set_custom_field', |
||
| 211 | array( |
||
| 212 | 'session' => 'xsd:string', |
||
| 213 | 'module_name' => 'xsd:string', |
||
| 214 | 'type' => 'xsd:string', |
||
| 215 | 'properties' => 'tns:name_value_list', |
||
| 216 | 'add_to_layout' => 'xsd:int', |
||
| 217 | ), |
||
| 218 | array( |
||
| 219 | 'return' => 'tns:error_value' |
||
| 220 | ), |
||
| 221 | $NAMESPACE |
||
| 222 | ); |
||
| 223 | |||
| 224 | function set_custom_field($session, $module_name, $type, $properties, $add_to_layout) { |
||
| 225 | global $current_user; |
||
| 226 | global $beanList, $beanFiles; |
||
| 227 | global $custom_field_meta; |
||
| 228 | |||
| 229 | $error = new SoapError(); |
||
| 230 | |||
| 231 | $request_arr = array( |
||
| 232 | 'action' => 'SaveField', |
||
| 233 | 'is_update' => 'true', |
||
| 234 | 'module' => 'ModuleBuilder', |
||
| 235 | 'view_module' => $module_name, |
||
| 236 | 'view_package' => 'studio' |
||
| 237 | ); |
||
| 238 | |||
| 239 | // ERROR CHECKING |
||
| 240 | if(!validate_authenticated($session)) { |
||
| 241 | $error->set_error('invalid_login'); |
||
| 242 | return $error->get_soap_array(); |
||
| 243 | } |
||
| 244 | |||
| 245 | if (!is_admin($current_user)) { |
||
| 246 | $error->set_error('no_admin'); |
||
| 247 | return $error->get_soap_array(); |
||
| 248 | } |
||
| 249 | |||
| 250 | if(empty($beanList[$module_name])){ |
||
| 251 | $error->set_error('no_module'); |
||
| 252 | return $error->get_soap_array(); |
||
| 253 | } |
||
| 254 | |||
| 255 | if (empty($custom_field_meta[$type])) { |
||
| 256 | $error->set_error('custom_field_type_not_supported'); |
||
| 257 | return $error->get_soap_array(); |
||
| 258 | } |
||
| 259 | |||
| 260 | $new_properties = array(); |
||
| 261 | foreach($properties as $value) { |
||
| 262 | $new_properties[$value['name']] = $value['value']; |
||
| 263 | } |
||
| 264 | |||
| 265 | foreach ($custom_field_meta[$type] as $property) { |
||
| 266 | if (!isset($new_properties[$property])) { |
||
| 267 | $error->set_error('custom_field_property_not_supplied'); |
||
| 268 | return $error->get_soap_array(); |
||
| 269 | } |
||
| 270 | |||
| 271 | $request_arr[$property] = $new_properties[$property]; |
||
| 272 | } |
||
| 273 | |||
| 274 | // $request_arr should now contain all the necessary information to create a custom field |
||
| 275 | // merge $request_arr with $_POST/$_REQUEST, where the action_saveField() method expects them |
||
| 276 | $_REQUEST = array_merge($_REQUEST, $request_arr); |
||
| 277 | $_POST = array_merge($_POST, $request_arr); |
||
| 278 | |||
| 279 | require_once('include/MVC/Controller/SugarController.php'); |
||
| 280 | require_once('modules/ModuleBuilder/controller.php'); |
||
| 281 | require_once('modules/ModuleBuilder/parsers/ParserFactory.php'); |
||
| 282 | |||
| 283 | $mbc = new ModuleBuilderController(); |
||
| 284 | $mbc->setup(); |
||
| 285 | $mbc->action_SaveField(); |
||
| 286 | |||
| 287 | // add the field to the given module's EditView and DetailView layouts |
||
| 288 | if ($add_to_layout == 1) { |
||
| 289 | $layout_properties = array( |
||
| 290 | 'name' => $new_properties['name'], |
||
| 291 | 'label' => $new_properties['label'] |
||
| 292 | ); |
||
| 293 | |||
| 294 | if (isset($new_properties['customCode'])) { |
||
| 295 | $layout_properties['customCode'] = $new_properties['customCode']; |
||
| 296 | } |
||
| 297 | if (isset($new_properties['customLabel'])) { |
||
| 298 | $layout_properties['customLabel'] = $new_properties['customLabel']; |
||
| 299 | } |
||
| 300 | |||
| 301 | // add the field to the DetailView |
||
| 302 | $parser = ParserFactory::getParser('layoutview', FALSE); |
||
| 303 | $parser->init($module_name, 'DetailView', FALSE); |
||
|
0 ignored issues
–
show
|
|||
| 304 | |||
| 305 | $parser->_addField($layout_properties); |
||
|
0 ignored issues
–
show
The method
_addField() does not seem to exist on object<AbstractMetaDataParser>.
This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces. This is most likely a typographical error or the method has been renamed. Loading history...
|
|||
| 306 | $parser->writeWorkingFile(); |
||
| 307 | $parser->handleSave(); |
||
| 308 | |||
| 309 | unset($parser); |
||
| 310 | |||
| 311 | // add the field to the EditView |
||
| 312 | $parser = ParserFactory::getParser('layoutview', FALSE); |
||
| 313 | $parser->init($module_name, 'EditView', FALSE); |
||
|
0 ignored issues
–
show
The method
init() does not seem to exist on object<AbstractMetaDataParser>.
This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces. This is most likely a typographical error or the method has been renamed. Loading history...
|
|||
| 314 | |||
| 315 | $parser->_addField($layout_properties); |
||
|
0 ignored issues
–
show
The method
_addField() does not seem to exist on object<AbstractMetaDataParser>.
This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces. This is most likely a typographical error or the method has been renamed. Loading history...
|
|||
| 316 | $parser->writeWorkingFile(); |
||
| 317 | $parser->handleSave(); |
||
| 318 | } |
||
| 319 | |||
| 320 | return $error->get_soap_array(); |
||
| 321 | } |
||
| 322 | ?> |
This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces.
This is most likely a typographical error or the method has been renamed.