fernando/luos
1
0
Fork 0
Code Releases Activity

Merge remote-tracking branch 'origin/feature/HOR-3559' into bugfix/HOR-3485-A

Browse Source
This commit is contained in:
hjonathan
2017-08-10 12:29:51 -04:00
parent 7d33ea2a96 1c0fed9062
commit 04d0ef2f41
52 changed files with 1415 additions and 1541 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
framework/src/Maveriks/Util/Common.php
View File

@@ -52,58 +52,43 @@ class Common
}
$files = glob("$path/$singlePattern", $flags);
$dirs = glob("$path/*", GLOB_MARK|GLOB_ONLYDIR|GLOB_NOSORT);
$dirs = glob("$path/*", GLOB_MARK | GLOB_ONLYDIR | GLOB_NOSORT);
if(is_array($dirs)){
if (is_array($dirs)) {
foreach ($dirs as $dir) {
$files = array_merge($files, self::rglob("$dir/$singlePattern", $flags));
}
}
if ($onlyFiles) {
$files = array_filter($files, function($v) { return is_dir($v) ? false : true;});
$files = array_filter($files, function ($v) {
return is_dir($v) ? false : true;
});
}
return $files;
}
/**
* Returns the last version given a pattern of file name
*
* @param string $pattern a valid pattern for glob(...) native function
* @param int $flag php flags for glob(...) native function
* @return int|string
*
* Example:
* - Given the following files inside a directory:
* /example/path/myApplication-v1.tar
* /example/path/myApplication-v2.tar
* /example/path/myApplication-v3.tar
* /example/path/myApplication-v5.tar
* /example/path/myApplication-v7.tar
*
* $lastVer = ProcessMaker\Util\Common::getLastVersion("/example/path/myApplication-*.tar");
*
* It will returns: 7
* This method get the last version of file when exists a special characters
* @param $pattern
* @param $extension
* @param int $flag
* @return int
*/
public static function getLastVersion($pattern, $flag = 0)
public static function getLastVersionSpecialCharacters($dir, $pattern, $extension, $flag = 0)
{
$files = glob($pattern, $flag);
$files = glob($dir . quotemeta($pattern) . "-*." . $extension, $flag);
$maxVersion = 0;
$pattern = str_replace("*", '([0-9\.]+)', basename($pattern));
$pattern = preg_quote(basename($pattern)) . '-([0-9\.]+)pmx';
foreach ($files as $file) {
$filename = basename($file);
if (preg_match('/'.$pattern.'/', $filename, $match)) {
if (preg_match('/' . $pattern . '/', $filename, $match)) {
if ($maxVersion < $match[1]) {
$maxVersion = $match[1];
}
}
}
return $maxVersion;
}
@@ -141,8 +126,8 @@ class Common
}
while ($parent_folder_path = array_pop($folder_path)) {
if (! @is_dir($parent_folder_path)) {
if (! @mkdir($parent_folder_path, $rights)) {
if (!@is_dir($parent_folder_path)) {
if (!@mkdir($parent_folder_path, $rights)) {
umask($oldumask);
}
}

2
gulliver/bin/gulliver.php
View File

@@ -35,6 +35,8 @@
/**
* require_once pakeFunction.php
*/
require_once( PATH_THIRDPARTY . 'pake' . PATH_SEP . 'pakeFunction.php');
require_once( PATH_THIRDPARTY . 'pake' . PATH_SEP . 'pakeGetopt.class.php');
require_once( PATH_CORE . 'config' . PATH_SEP . 'environments.php');
// trap -V before pake

1
gulliver/bin/tasks/templates/pluginClass.tpl
View File

@@ -83,7 +83,6 @@
$_DBArray['users'] = $aUsers;
$_SESSION['_DBArray'] = $_DBArray;
;
$oCriteria = new Criteria('dbarray');
$oCriteria->setDBArrayTable('users');
$oCriteria->addDescendingOrderByColumn('USR_USERNAME');

1
gulliver/bin/tasks/templates/pluginMainFile.tpl
View File

@@ -1,5 +1,4 @@
<?php
;
class {className}Plugin extends PMPlugin
{

2
gulliver/bin/tasks/templates/pluginOnTransitList.php.tpl
View File

@@ -8,8 +8,6 @@
//if (($RBAC_Response = $RBAC->userCanAccess("PM_CASES"))!=1) return $RBAC_Response;
/* Includes */
;
;
/* GET , POST & $_SESSION Vars */
$conf = new Configurations();

1
gulliver/bin/tasks/templates/pluginStep.tpl
View File

@@ -1,5 +1,4 @@
<?php
;
print "this is a default step for {className}";
krumo::session ();

2
gulliver/bin/tasks/templates/pluginStepApplicationAjax.php.tpl
View File

@@ -1,7 +1,5 @@
<?php
;
try {
//SYS_SYS //Workspace name
//PROCESS //Process UID

1
gulliver/bin/tasks/templates/pluginWelcome.php.tpl
View File

@@ -23,7 +23,6 @@ $_DBArray['user'] = $rows;
$_SESSION['_DBArray'] = $_DBArray;
//krumo ( $_DBArray );
;
$c = new Criteria ('dbarray');
$c->setDBArrayTable('user');
//$c->add ( 'user.age', 122 , Criteria::GREATER_EQUAL );

2
gulliver/bin/tasks/templates/skinPluginMainClass.tpl
View File

@@ -4,8 +4,6 @@
*
*/
;
class {className}Plugin extends PMPlugin {
function {className}Plugin($sNamespace, $sFilename = null) {

2
gulliver/bin/tasks/templates/sysGeneric.php.tpl
View File

@@ -198,7 +198,7 @@ $docuroot = explode ( PATH_SEP , $_SERVER['DOCUMENT_ROOT'] );
//***************** Plugins **************************
;
// //here we are loading all plugins registered
// //the singleton has a list of enabled plugins

2
gulliver/bin/tasks/templates/usersList.php.tpl
View File

@@ -21,7 +21,7 @@ $G_ID_SUB_MENU_SELECTED = 'USERS';
$_DBArray['user'] = $rows;
$_SESSION['_DBArray'] = $_DBArray;
;
$c = new Criteria ('dbarray');
$c->setDBArrayTable('user');

1
gulliver/bin/tasks/templates/welcome.php.tpl
View File

@@ -23,7 +23,6 @@ $_DBArray['user'] = $rows;
$_SESSION['_DBArray'] = $_DBArray;
//krumo ( $_DBArray );
;
$c = new Criteria ('dbarray');
$c->setDBArrayTable('user');
//$c->add ( 'user.age', 122 , Criteria::GREATER_EQUAL );

1
gulliver/js/grid/core/grid.js
View File

@@ -563,6 +563,7 @@ var G_Grid = function(oForm, sGridName){
case 'textarea': //TEXTAREA
aObjects = oNewRow.getElementsByTagName('td')[i].getElementsByTagName('textarea');
if (aObjects){
aObjects[0].value = '';
aObjects[0].className = "module_app_input___gray";
newID = aObjects[0].id.replace(/\[1\]/g, '\[' + currentRow + '\]');

2
gulliver/methods/errors/block.php
View File

@@ -3,7 +3,7 @@ if (function_exists("http_response_code")) {
http_response_code(200);
}
$http = (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on") ? "https" : "http";
$http = G::is_https() ? "https" : "http";
$host = $_SERVER["SERVER_NAME"] . (($_SERVER["SERVER_PORT"] != "80") ? ":" . $_SERVER["SERVER_PORT"] : "");
$urlLogin = $http . "://" . $host . "/sys/en/neoclassic/login/login";

2
gulliver/methods/errors/error403.php
View File

@@ -1,6 +1,6 @@
<?php
$http = (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on")? "https" : "http";
$http = G::is_https() ? "https" : "http";
$host = $_SERVER["SERVER_NAME"] . (($_SERVER["SERVER_PORT"] != "80")? ":" . $_SERVER["SERVER_PORT"] : "");
$urlLogin = $http . "://" . $host . "/sys/en/neoclassic/login/login";

14
gulliver/system/class.database_mysql.php
View File

@@ -207,12 +207,16 @@ class database extends database_base
}
}
if (isset( $aParameters['AutoIncrement'] ) && $aParameters['AutoIncrement']) {
$sSQL .= ' AUTO_INCREMENT PRIMARY KEY';
$sSQL .= ' AUTO_INCREMENT';
}
/*if ($aParameters['Key'] == 'PRI') {
$sKeys .= 'ALTER TABLE ' . $this->sQuoteCharacter . $sTable . $this->sQuoteCharacter .
' ADD PRIMARY KEY (' . $this->sQuoteCharacter . $sColumn . $this->sQuoteCharacter . ')' . $this->sEndLine;
}*/
if (isset( $aParameters['PrimaryKey'] ) && $aParameters['PrimaryKey']) {
$sSQL .= ' PRIMARY KEY';
}
if (isset( $aParameters['Unique'] ) && $aParameters['Unique']) {
$sSQL .= ' UNIQUE';
}
//we need to check the property AI
if (isset( $aParameters['AI'] )) {
if ($aParameters['AI'] == 1) {
$sSQL .= ' AUTO_INCREMENT';

63
gulliver/system/class.dbMaintenance.php
View File

@@ -49,6 +49,7 @@ class DataBaseMaintenance
protected $tmpDir;
protected $outfile;
protected $infile;
protected $isWindows;
/**
* __construct
@@ -64,7 +65,7 @@ class DataBaseMaintenance
$this->tmpDir = './';
$this->link = null;
$this->dbName = null;
$this->isWindows = strtoupper(substr(PHP_OS, 0, 3)) === 'WIN';
if (isset( $host ) && isset( $user ) && isset( $passwd )) {
$this->host = $host;
$this->user = $user;
@@ -399,13 +400,22 @@ class DataBaseMaintenance
*/
function backupDataBase ($outfile)
{
$password = escapeshellarg($this->passwd);
//On Windows, escapeshellarg() instead replaces percent signs, exclamation
//marks (delayed variable substitution) and double quotes with spaces and
//adds double quotes around the string.
//See: http://php.net/manual/en/function.escapeshellarg.php
if ($this->isWindows) {
$password = $this->escapeshellargCustom($this->passwd);
}
$aHost = explode(':', $this->host);
$dbHost = $aHost[0];
if (isset($aHost[1])) {
$dbPort = $aHost[1];
$command = 'mysqldump'
. ' --user=' . $this->user
. ' --password=' . escapeshellarg($this->passwd)
. ' --password=' . $password
. ' --host=' . $dbHost
. ' --port=' . $dbPort
. ' --opt'
@@ -418,13 +428,60 @@ class DataBaseMaintenance
. ' --user=' . $this->user
. ' --opt'
. ' --skip-comments'
. ' --password=' . escapeshellarg($this->passwd)
. ' --password=' . $password
. ' ' . $this->dbName
. ' > ' . $outfile;
}
shell_exec($command);
}
/**
* string escapeshellargCustom ( string $arg , character $quotes)
*
* escapeshellarg() adds single quotes around a string and quotes/escapes any
* existing single quotes allowing you to pass a string directly to a shell
* function and having it be treated as a single safe argument. This function
* should be used to escape individual arguments to shell functions coming
* from user input. The shell functions include exec(), system() and the
* backtick operator.
*
* On Windows, escapeshellarg() instead replaces percent signs, exclamation
* marks (delayed variable substitution) and double quotes with spaces and
* adds double quotes around the string.
*/
private function escapeshellargCustom($string, $quotes = "")
{
if ($quotes === "") {
$quotes = $this->isWindows ? "\"" : "'";
}
$n = strlen($string);
$special = ["!", "%", "\""];
$substring = "";
$result1 = [];
$result2 = [];
for ($i = 0; $i < $n; $i++) {
if (in_array($string[$i], $special, true)) {
$result2[] = $string[$i];
$result1[] = $substring;
$substring = "";
} else {
$substring = $substring . $string[$i];
}
}
$result1[] = $substring;
//Rebuild the password string
$n = count($result1);
for ($i = 0; $i < $n; $i++) {
$result1[$i] = trim(escapeshellarg($result1[$i]), $quotes);
if (isset($result2[$i])) {
$result1[$i] = $result1[$i] . $result2[$i];
}
}
//add simple quotes, see escapeshellarg function
$newString = $quotes . implode("", $result1) . $quotes;
return $newString;
}
/**
* restoreFromSql
*

85
gulliver/system/class.g.php
View File

@@ -187,7 +187,7 @@ class G
* @param string $symbol
* @return string
*/
public function generate_password($length = 15, $availableSets = "luns", $symbol = "_-+=!@#$%*&,.")
public function generate_password($length = 15, $availableSets = "luns", $symbol = "_-$!")
{
$chars = "";
if (strpos($availableSets, "l") !== false) {
@@ -638,7 +638,7 @@ class G
* @param string $strSkin
* @return void
*/
public function RenderPage ($strTemplate = "default", $strSkin = SYS_SKIN, $objContent = null, $layout = '')
public static function RenderPage ($strTemplate = "default", $strSkin = SYS_SKIN, $objContent = null, $layout = '')
{
global $G_CONTENT;
global $G_TEMPLATE;
@@ -1825,6 +1825,14 @@ class G
$arrayGrid = array_unique($arrayGrid);
//Given the set: 'valueOne', 'valueOneTwo', where the second string
//contains the first string, this causes the larger string to take
//the second, resulting in a delimitation error, to avoid this problem
//we first search the string larger size.
usort($arrayGrid, function($a, $b) {
return strlen($b) - strlen($a);
});
foreach ($arrayGrid as $index => $value) {
if($value !== "") {
$grdName = $value;
@@ -1981,7 +1989,7 @@ class G
*
* @return void
*/
public function SendTemporalMessage ($msgID, $strType, $sType = 'LABEL', $time = null, $width = null, $customLabels = null)
public static function SendTemporalMessage ($msgID, $strType, $sType = 'LABEL', $time = null, $width = null, $customLabels = null)
{
if (isset( $width )) {
$_SESSION['G_MESSAGE_WIDTH'] = $width;
@@ -2912,6 +2920,16 @@ class G
return (bool) preg_match( '/^[0-9A-Za-z]{14,}/', $uid );
}
/**
* Verify if the input string is a valid UID of size 32
* @param string $uid
* @return boolean
*/
public static function verifyUniqueID32($uid)
{
return (bool) preg_match('/^[0-9A-Za-z]{32,32}$/', $uid);
}
/**
* is_utf8
*
@@ -2921,11 +2939,10 @@ class G
*/
public function is_utf8 ($string)
{
if (is_array( $string )) {
$enc = implode( '', $string );
return @! ((ord( $enc[0] ) != 239) && (ord( $enc[1] ) != 187) && (ord( $enc[2] ) != 191));
if (preg_match('//u', $string)) {
return true;
} else {
return (utf8_encode( utf8_decode( $string ) ) == $string);
return false;
}
}
@@ -3221,20 +3238,34 @@ class G
* @param (array) additional characteres map
*
*/
public function inflect ($string, $replacement = '_', $map = array())
public function inflect($string, $replacement = '_', $map = array())
{
if (is_array( $replacement )) {
if (is_array($replacement)) {
$map = $replacement;
$replacement = '_';
}
$quotedReplacement = preg_quote( $replacement, '/' );
$quotedReplacement = preg_quote($replacement, '/');
$default = array ('/à|á|å|â/' => 'a','/è|é|ê|ẽ|ë/' => 'e','/ì|í|î/' => 'i','/ò|ó|ô|ø/' => 'o','/ù|ú|ů|û/' => 'u','/ç/' => 'c','/ñ/' => 'n','/ä|æ/' => 'ae','/ö/' => 'oe','/ü/' => 'ue','/Ä/' => 'Ae','/Ü/' => 'Ue','/Ö/' => 'Oe','/ß/' => 'ss','/\.|\,|\:|\-|\\|\//' => " ",'/\\s+/' => $replacement
);
$default = array('/à|á|å|â/' => 'a',
'/è|é|ê|ẽ|ë/' => 'e',
'/ì|í|î/' => 'i',
'/ò|ó|ô|ø/' => 'o',
'/ù|ú|ů|û/' => 'u',
'/ç/' => 'c',
'/ñ/' => 'n',
'/ä|æ/' => 'ae',
'/ö/' => 'oe',
'/ü/' => 'ue',
'/Ä/' => 'Ae',
'/Ü/' => 'Ue',
'/Ö/' => 'Oe',
'/ß/' => 'ss',
'/[\.|\,|\+|\"|\:|\;|\-|\\|\/]/' => " ",
'/\\s+/' => $replacement);
$map = array_merge( $default, $map );
return preg_replace( array_keys( $map ), array_values( $map ), $string );
$map = array_merge($default, $map);
return preg_replace(array_keys($map), array_values($map), $string);
}
/**
@@ -5408,6 +5439,12 @@ class G
}
/**
* This function save history about some actions in the file audit.log
* The data is used in the Audit Log functionality
*
* @param string $actionToLog
* @param string $valueToLog
* @return void
*/
public static function auditLog($actionToLog, $valueToLog = "")
{
@@ -5416,13 +5453,25 @@ class G
$sflag = $conf->getConfiguration('AUDIT_LOG', 'log');
$sflagAudit = $sflag == 'true' ? true : false;
$ipClient = G::getIpAddress();
$userUid = 'Unknow User';
$fullName = '-';
/*----------------------------------********---------------------------------*/
$licensedFeatures = PMLicensedFeatures::getSingleton();
if ($sflagAudit && $licensedFeatures->verifyfeature('vtSeHNhT0JnSmo1bTluUVlTYUxUbUFSVStEeXVqc1pEUG5EeXc0MGd2Q3ErYz0=')) {
$username = isset($_SESSION['USER_LOGGED']) && $_SESSION['USER_LOGGED'] != '' ? $_SESSION['USER_LOGGED'] : 'Unknow User';
$fullname = isset($_SESSION['USR_FULLNAME']) && $_SESSION['USR_FULLNAME'] != '' ? $_SESSION['USR_FULLNAME'] : '-';
G::log("|". $workspace ."|". $ipClient ."|". $username . "|" . $fullname ."|" . $actionToLog . "|" . $valueToLog, PATH_DATA, "audit.log");
if (isset($_SESSION['USER_LOGGED']) && $_SESSION['USER_LOGGED'] != '') {
$userUid = $_SESSION['USER_LOGGED'];
} else {
//Get the usrUid related to the accessToken
$userUid = \ProcessMaker\Services\OAuth2\Server::getUserId();
if (!empty($userUid)) {
$oUserLogged = new \Users();
$user = $oUserLogged->loadDetails($userUid);
$fullName = $user['USR_FULLNAME'];
}
}
$fullName = isset($_SESSION['USR_FULLNAME']) && $_SESSION['USR_FULLNAME'] != '' ? $_SESSION['USR_FULLNAME'] : $fullName;
G::log("|". $workspace ."|". $ipClient ."|". $userUid . "|" . $fullName ."|" . $actionToLog . "|" . $valueToLog, PATH_DATA, "audit.log");
}
/*----------------------------------********---------------------------------*/
}
@@ -5701,7 +5750,7 @@ class G
*
* @return showRes($string)
*/
public function outRes ($sInfVar)
public static function outRes ($sInfVar)
{
echo $sInfVar;
}

2
gulliver/system/class.menu.php
View File

@@ -283,7 +283,7 @@ class Menu
*/
public function DisableOptionId($id)
{
if (array_search($id, $this->Id)) {
if (array_search($id, $this->Id) !== FALSE) {
$this->Enabled[array_search($id, $this->Id)] = 0;
}
}

2
gulliver/system/class.monologProvider.php
View File

@@ -106,11 +106,13 @@ class MonologProvider
break;
case 400://ERROR
$this->registerLogger->addError($message, $context);
break;
case 500://CRITICAL
$this->registerLogger->addCritical($message, $context);
break;
case 550://ALERT
$this->registerLogger->addAlert($message, $context);
break;
case 600://EMERGENCY
$this->registerLogger->addEmergency($message, $context);
break;

2
gulliver/system/class.pmException.php
View File

@@ -20,7 +20,7 @@ class PMException extends Exception
return __CLASS__ . ": [{$this->code}]: {$this->message}\n";
}
public function registerErrorLog($error, $token){
public static function registerErrorLog($error, $token){
$ws = (defined("SYS_SYS"))? SYS_SYS : "Wokspace Undefined";
Bootstrap::registerMonolog('ExceptionCron', 400, $error->getMessage(), array('token'=>$token), $ws, 'processmaker.log');
}

29
gulliver/system/class.rbac.php
View File

@@ -25,6 +25,9 @@
* Coral Gables, FL, 33134, USA, or email info@colosa.com.
*
*/
use ProcessMaker\Exception\RBACException;
/**
* File: $Id$
*
@@ -70,6 +73,7 @@ class RBAC
public $singleSignOn = false;
private static $instance = null;
public $authorizedActions = array();
public function __construct ()
{
@@ -147,8 +151,28 @@ class RBAC
),
'newSite.php' => array(
'newSite.php' => array('PM_SETUP_ADVANCE')
),
'emailsAjax.php' => array(
'MessageList' => array('PM_SETUP', 'PM_SETUP_LOGS'),
'updateStatusMessage' => array('PM_SETUP', 'PM_SETUP_LOGS'),
),
'processCategory_Ajax.php' => array(
'processCategoryList' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'updatePageSize' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'checkCategoryName' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'saveNewCategory' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'checkEditCategoryName' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'updateCategory' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'canDeleteCategory' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'deleteCategory' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES')
),
'emailServerAjax.php' => array(
'INS' => array('PM_SETUP'),
'UPD' => array('PM_SETUP'),
'DEL' => array('PM_SETUP'),
'LST' => array('PM_SETUP'),
'TEST' => array('PM_SETUP')
)
);
}
@@ -1545,8 +1569,7 @@ class RBAC
}
if (!$access) {
G::header('Location: /errors/error403.php');
die();
throw new RBACException('ID_ACCESS_DENIED', 403);
}
}
}

22
rbac/engine/classes/model/RbacUsers.php
View File

@@ -75,12 +75,13 @@ class RbacUsers extends BaseRbacUsers
try {
$c = new Criteria('rbac');
$c->add(RbacUsersPeer::USR_USERNAME, $sUsername);
/* @var $rs RbacUsers[] */
$rs = RbacUsersPeer::doSelect($c, Propel::getDbConnection('rbac_ro'));
if (is_array($rs) && isset($rs[0]) && is_object($rs[0]) && get_class($rs[0]) == 'RbacUsers') {
$aFields = $rs[0]->toArray(BasePeer::TYPE_FIELDNAME);
//verify password with md5, and md5 format
if (mb_strtoupper($sUsername, 'utf-8') === mb_strtoupper($aFields['USR_USERNAME'], 'utf-8')) {
if( Bootstrap::verifyHashPassword($sPassword, $aFields['USR_PASSWORD']) ) {
if( Bootstrap::verifyHashPassword($sPassword, $rs[0]->getUsrPassword()) ) {
if ($aFields['USR_DUE_DATE'] < date('Y-m-d')) {
return -4;
}
@@ -317,6 +318,25 @@ class RbacUsers extends BaseRbacUsers
throw($oError);
}
}
/**
* {@inheritdoc} except USR_PASSWORD, for security reasons.
*
* @param string $keyType One of the class type constants TYPE_PHPNAME,
* TYPE_COLNAME, TYPE_FIELDNAME, TYPE_NUM
* @return an associative array containing the field names (as keys) and field values
*/
public function toArray($keyType = BasePeer::TYPE_PHPNAME)
{
$key = RbacUsersPeer::translateFieldName(
RbacUsersPeer::USR_PASSWORD,
BasePeer::TYPE_COLNAME,
$keyType
);
$array = parent::toArray($keyType);
unset($array[$key]);
return $array;
}
}
// Users

2
workflow/engine/classes/Calendar.php
View File

@@ -828,7 +828,7 @@ class Calendar extends CalendarDefinition
$newDate = $onlyDate;
$hoursDuration -= (float)($secondRes/3600);
} else {
$newDate = date('Y-m-d H:i:s', strtotime('+' . (((float)$hoursDuration)*3600) . ' seconds', strtotime($newDate)));
$newDate = date('Y-m-d H:i:s', strtotime('+' . round((((float)$hoursDuration)*3600), 5) . ' seconds', strtotime($newDate)));
$hoursDuration = 0;
}
}

53
workflow/engine/classes/model/ListParticipatedLast.php
View File

@@ -49,19 +49,24 @@ class ListParticipatedLast extends BaseListParticipatedLast
$data['DEL_CURRENT_USR_FIRSTNAME'] = $aRow['USR_FIRSTNAME'];
$data['DEL_CURRENT_USR_LASTNAME'] = $aRow['USR_LASTNAME'];
$data['DEL_CURRENT_TAS_TITLE'] = $data['APP_TAS_TITLE'];
$currentInformation = array(
'DEL_CURRENT_USR_USERNAME' => $data['DEL_CURRENT_USR_USERNAME'],
'DEL_CURRENT_USR_FIRSTNAME' => $data['DEL_CURRENT_USR_FIRSTNAME'],
'DEL_CURRENT_USR_LASTNAME' => $data['DEL_CURRENT_USR_LASTNAME'],
'DEL_CURRENT_TAS_TITLE' => $data['APP_TAS_TITLE']
);
}
} else {
$getData['USR_UID'] = $data['USR_UID_CURRENT'];
$getData['APP_UID'] = $data['APP_UID'];
$row = $this->getRowFromList($getData);
if (is_array($row) && sizeof($row)) {
$set = array(
$currentInformation = array(
'DEL_CURRENT_USR_USERNAME' => '',
'DEL_CURRENT_USR_FIRSTNAME' => '',
'DEL_CURRENT_USR_LASTNAME' => '',
'APP_TAS_TITLE' => $data['APP_TAS_TITLE'],
'DEL_CURRENT_TAS_TITLE' => $data['APP_TAS_TITLE'], );
$this->updateCurrentUser($row, $set);
'DEL_CURRENT_TAS_TITLE' => $data['APP_TAS_TITLE']
);
}
}
@@ -84,6 +89,9 @@ class ListParticipatedLast extends BaseListParticipatedLast
if (!empty($data['APP_STATUS'])) {
$data['APP_STATUS_ID'] = Application::$app_status_values[$data['APP_STATUS']];
}
//We will update the current information
$this->updateCurrentInfoByAppUid($data['APP_UID'], $currentInformation);
$con = Propel::getConnection(ListParticipatedLastPeer::DATABASE_NAME);
try {
$this->fromArray($data, BasePeer::TYPE_FIELDNAME);
@@ -103,6 +111,27 @@ class ListParticipatedLast extends BaseListParticipatedLast
}
}
/**
* This function update the row related to the appUid with the current information
* @param string $appUid
* @param array $currentInformation
* @return void
*/
private function updateCurrentInfoByAppUid($appUid, $currentInformation)
{
//Update - WHERE
$criteriaWhere = new Criteria('workflow');
$criteriaWhere->add(ListParticipatedLastPeer::APP_UID, $appUid, Criteria::EQUAL);
//Update - SET
$criteriaSet = new Criteria('workflow');
$criteriaSet->add(ListParticipatedLastPeer::DEL_CURRENT_USR_USERNAME, $currentInformation['DEL_CURRENT_USR_USERNAME']);
$criteriaSet->add(ListParticipatedLastPeer::DEL_CURRENT_USR_FIRSTNAME, $currentInformation['DEL_CURRENT_USR_FIRSTNAME']);
$criteriaSet->add(ListParticipatedLastPeer::DEL_CURRENT_USR_LASTNAME, $currentInformation['DEL_CURRENT_USR_LASTNAME']);
$criteriaSet->add(ListParticipatedLastPeer::DEL_CURRENT_TAS_TITLE, $currentInformation['DEL_CURRENT_TAS_TITLE']);
BasePeer::doUpdate($criteriaWhere, $criteriaSet, Propel::getConnection('workflow'));
}
/**
* Update List Participated History Table.
*
@@ -448,22 +477,6 @@ class ListParticipatedLast extends BaseListParticipatedLast
return false;
}
public function updateCurrentUser($where, $set)
{
$con = Propel::getConnection('workflow');
//Update - WHERE
$criteriaWhere = new Criteria('workflow');
$criteriaWhere->add(ListParticipatedLastPeer::APP_UID, $where['APP_UID'], Criteria::EQUAL);
$criteriaWhere->add(ListParticipatedLastPeer::USR_UID, $where['USR_UID'], Criteria::EQUAL);
$criteriaWhere->add(ListParticipatedLastPeer::DEL_INDEX, $where['DEL_INDEX'], Criteria::EQUAL);
//Update - SET
$criteriaSet = new Criteria('workflow');
foreach ($set as $k => $v) {
eval('$criteriaSet->add( ListParticipatedLastPeer::'.$k.',$v, Criteria::EQUAL);');
}
BasePeer::doUpdate($criteriaWhere, $criteriaSet, $con);
}
/**
* Returns the number of cases of a user.
*

19
workflow/engine/classes/model/Users.php
View File

@@ -490,4 +490,23 @@ class Users extends BaseUsers
$criteria->add(UsersPeer::USR_ID, $id);
return UsersPeer::doSelect($criteria)[0];
}
/**
* {@inheritdoc} except USR_PASSWORD, for security reasons.
*
* @param string $keyType One of the class type constants TYPE_PHPNAME,
* TYPE_COLNAME, TYPE_FIELDNAME, TYPE_NUM
* @return an associative array containing the field names (as keys) and field values
*/
public function toArray($keyType = BasePeer::TYPE_PHPNAME)
{
$key = UsersPeer::translateFieldName(
UsersPeer::USR_PASSWORD,
BasePeer::TYPE_COLNAME,
$keyType
);
$array = parent::toArray($keyType);
unset($array[$key]);
return $array;
}
}

32
workflow/engine/controllers/pmTables.php
View File

@@ -152,6 +152,11 @@ class pmTables extends Controller
$sFileName = $httpData->f;
$realPath = $PUBLIC_ROOT_PATH . $sFileName;
if ($this->isValidFileToBeStreamed($sFileName) === false) {
throw new Exception("You are trying to access an unauthorized resource.");
}
G::streamFile( $realPath, true );
unlink( $realPath );
}
@@ -206,5 +211,32 @@ class pmTables extends Controller
$tableSize = $tableSize - 8; // Prefix PMT_
return $tableSize;
}
/**
* Validates if the file with the $fileName is a valid one,
* that is, it must be a file without relative references that
* can open a door to get some unauthorized system file and
* must have one of the valid file extensions.
*
* @param $fileName, emporal file name that will be streamed
* @return bool
*/
private function isValidFileToBeStreamed($fileName)
{
$result = true;
$validExtensionsForExporting = ['csv', 'pmt'];
$pathInfo = pathinfo($fileName);
if ($pathInfo['dirname'] !== '.') {
$result = false;
}
if (!in_array($pathInfo['extension'], $validExtensionsForExporting)) {
$result = false;
}
return $result;
}
}

2
workflow/engine/methods/emailServer/emailServerAjax.php
View File

@@ -1,8 +1,8 @@
<?php
$option = (isset($_POST["option"]))? $_POST["option"] : "";
$response = array();
$RBAC->allows(basename(__FILE__), $option);
switch ($option) {
case "INS":
$arrayData = array();

21
workflow/engine/methods/login/login.php
View File

@@ -33,10 +33,23 @@ if ($browserSupported==false){
/*----------------------------------********---------------------------------*/
$aFields = array();
if (!isset($_GET['u'])) {
$aFields['URL'] = '';
} else {
$aFields['URL'] = htmlspecialchars(addslashes(stripslashes(strip_tags(trim(urldecode($_GET['u']))))));
//Validated redirect url
$aFields['URL'] = '';
if (!empty($_GET['u'])) {
//clean url with protocols
$flagUrl = true;
//Most used protocols
$protocols = ['https://', 'http://', 'ftp://', 'sftp://','smb://', 'file:', 'mailto:'];
foreach ($protocols as $protocol) {
if (strpos($_GET['u'], $protocol) !== false) {
$_GET['u'] = '';
$flagUrl = false;
break;
}
}
if ($flagUrl) {
$aFields['URL'] = htmlspecialchars(addslashes(stripslashes(strip_tags(trim(urldecode($_GET['u']))))));
}
}
if (!isset($_SESSION['G_MESSAGE'])) {

147
workflow/engine/methods/mails/emailsAjax.php
View File

@@ -1,23 +1,33 @@
<?php
$req = (isset($_POST['request']))? $_POST['request']:((isset($_REQUEST['request']))? $_REQUEST['request'] : 'No hayyy tal');
require_once 'classes/model/Content.php';
require_once 'classes/model/AppMessage.php';
require_once 'classes/model/AppDelegation.php';
require_once 'classes/model/Application.php';
use ProcessMaker\Exception\RBACException;
switch($req){
$req = (isset($_REQUEST['request']) ? $_REQUEST['request'] : '');
/** @var RBAC $RBAC */
global $RBAC;
switch ($RBAC->userCanAccess('PM_LOGIN')) {
case -2:
throw new RBACException('ID_USER_HAVENT_RIGHTS_SYSTEM', -2);
break;
case -1:
throw new RBACException('ID_USER_HAVENT_RIGHTS_PAGE', -1);
break;
}
$RBAC->allows(basename(__FILE__), $req);
switch ($req) {
case 'MessageList':
$start = (isset($_REQUEST['start']))? $_REQUEST['start'] : '0';
$limit = (isset($_REQUEST['limit']))? $_REQUEST['limit'] : '25';
$proUid = (isset($_REQUEST['process']))? $_REQUEST['process'] : '';
$eventype = (isset($_REQUEST['type']))? $_REQUEST['type'] : '';
$emailStatus = (isset($_REQUEST['status']))? $_REQUEST['status'] : '';
$sort = isset($_REQUEST['sort']) ? $_REQUEST['sort'] : '';
$dir = isset($_REQUEST['dir']) ? $_REQUEST['dir'] : 'ASC';
$dateFrom = isset( $_POST["dateFrom"] ) ? substr( $_POST["dateFrom"], 0, 10 ) : "";
$dateTo = isset( $_POST["dateTo"] ) ? substr( $_POST["dateTo"], 0, 10 ) : "";
$filterBy = (isset($_REQUEST['filterBy']))? $_REQUEST['filterBy'] : 'ALL';
$start = (isset($_REQUEST['start'])) ? $_REQUEST['start'] : '0';
$limit = (isset($_REQUEST['limit'])) ? $_REQUEST['limit'] : '25';
$proUid = (isset($_REQUEST['process'])) ? $_REQUEST['process'] : '';
$eventype = (isset($_REQUEST['type'])) ? $_REQUEST['type'] : '';
$emailStatus = (isset($_REQUEST['status'])) ? $_REQUEST['status'] : '';
$sort = isset($_REQUEST['sort']) ? $_REQUEST['sort'] : '';
$dir = isset($_REQUEST['dir']) ? $_REQUEST['dir'] : 'ASC';
$dateFrom = isset($_POST["dateFrom"]) ? substr($_POST["dateFrom"], 0, 10) : "";
$dateTo = isset($_POST["dateTo"]) ? substr($_POST["dateTo"], 0, 10) : "";
$filterBy = (isset($_REQUEST['filterBy'])) ? $_REQUEST['filterBy'] : 'ALL';
$response = new stdclass();
$response->status = 'OK';
@@ -28,10 +38,10 @@ switch($req){
$criteria->addJoin(AppMessagePeer::APP_UID, ApplicationPeer::APP_UID, Criteria::LEFT_JOIN);
if ($emailStatus != '') {
$criteria->add( AppMessagePeer::APP_MSG_STATUS, $emailStatus);
$criteria->add(AppMessagePeer::APP_MSG_STATUS, $emailStatus);
}
if ($proUid != '') {
$criteria->add( ApplicationPeer::PRO_UID, $proUid);
$criteria->add(ApplicationPeer::PRO_UID, $proUid);
}
$arrayType = [];
@@ -39,7 +49,7 @@ switch($req){
$pluginRegistry = PMPluginRegistry::getSingleton();
$statusEr = $pluginRegistry->getStatusPlugin('externalRegistration');
$flagEr = (preg_match('/^enabled$/', $statusEr))? 1 : 0;
$flagEr = (preg_match('/^enabled$/', $statusEr)) ? 1 : 0;
if ($flagEr == 0) {
$arrayType[] = 'EXTERNAL_REGISTRATION';
@@ -73,14 +83,14 @@ switch($req){
$dateTo = $dateTo . " 23:59:59";
}
$criteria->add( $criteria->getNewCriterion( AppMessagePeer::APP_MSG_DATE, $dateFrom, Criteria::GREATER_EQUAL )->addAnd( $criteria->getNewCriterion( AppMessagePeer::APP_MSG_DATE, $dateTo, Criteria::LESS_EQUAL ) ) );
$criteria->add($criteria->getNewCriterion(AppMessagePeer::APP_MSG_DATE, $dateFrom, Criteria::GREATER_EQUAL)->addAnd($criteria->getNewCriterion(AppMessagePeer::APP_MSG_DATE, $dateTo, Criteria::LESS_EQUAL)));
} else {
$dateFrom = $dateFrom . " 00:00:00";
$criteria->add( AppMessagePeer::APP_MSG_DATE, $dateFrom, Criteria::GREATER_EQUAL );
$criteria->add(AppMessagePeer::APP_MSG_DATE, $dateFrom, Criteria::GREATER_EQUAL);
}
} elseif ($dateTo != "") {
$dateTo = $dateTo . " 23:59:59";
$criteria->add( AppMessagePeer::APP_MSG_DATE, $dateTo, Criteria::LESS_EQUAL );
$criteria->add(AppMessagePeer::APP_MSG_DATE, $dateTo, Criteria::LESS_EQUAL);
}
//Number records total
@@ -118,10 +128,10 @@ switch($req){
$criteria->addSelectColumn(ProcessPeer::PRO_TITLE);
if ($emailStatus != '') {
$criteria->add( AppMessagePeer::APP_MSG_STATUS, $emailStatus);
$criteria->add(AppMessagePeer::APP_MSG_STATUS, $emailStatus);
}
if ($proUid != '') {
$criteria->add( ApplicationPeer::PRO_UID, $proUid);
$criteria->add(ApplicationPeer::PRO_UID, $proUid);
}
switch ($filterBy) {
@@ -152,24 +162,27 @@ switch($req){
$dateTo = $dateTo . " 23:59:59";
}
$criteria->add( $criteria->getNewCriterion( AppMessagePeer::APP_MSG_DATE, $dateFrom, Criteria::GREATER_EQUAL )->addAnd( $criteria->getNewCriterion( AppMessagePeer::APP_MSG_DATE, $dateTo, Criteria::LESS_EQUAL ) ) );
$criteria->add($criteria->getNewCriterion(AppMessagePeer::APP_MSG_DATE, $dateFrom, Criteria::GREATER_EQUAL)->addAnd($criteria->getNewCriterion(AppMessagePeer::APP_MSG_DATE, $dateTo, Criteria::LESS_EQUAL)));
} else {
$dateFrom = $dateFrom . " 00:00:00";
$criteria->add( AppMessagePeer::APP_MSG_DATE, $dateFrom, Criteria::GREATER_EQUAL );
$criteria->add(AppMessagePeer::APP_MSG_DATE, $dateFrom, Criteria::GREATER_EQUAL);
}
} elseif ($dateTo != "") {
$dateTo = $dateTo . " 23:59:59";
$criteria->add( AppMessagePeer::APP_MSG_DATE, $dateTo, Criteria::LESS_EQUAL );
$criteria->add(AppMessagePeer::APP_MSG_DATE, $dateTo, Criteria::LESS_EQUAL);
}
if ($sort != '') {
if (!in_array($sort, AppMessagePeer::getFieldNames(BasePeer::TYPE_FIELDNAME))) {
throw new Exception(G::LoadTranslation('ID_INVALID_VALUE_FOR', array('$sort')));
}
if ($dir == 'ASC') {
$criteria->addAscendingOrderByColumn($sort);
} else {
$criteria->addDescendingOrderByColumn($sort);
}
} else {
$oCriteria->addDescendingOrderByColumn(AppMessagePeer::APP_MSG_SEND_DATE );
$oCriteria->addDescendingOrderByColumn(AppMessagePeer::APP_MSG_SEND_DATE);
}
if ($limit != '') {
$criteria->setLimit($limit);
@@ -187,60 +200,60 @@ switch($req){
$index = 1;
$content = new Content();
$tasTitleDefault = G::LoadTranslation('ID_TASK_NOT_RELATED');
while ( $result->next() ) {
while ($result->next()) {
$row = $result->getRow();
$row['APP_MSG_FROM'] =htmlentities($row['APP_MSG_FROM'], ENT_QUOTES, "UTF-8");
$row['APP_MSG_STATUS'] = ucfirst ( $row['APP_MSG_STATUS']);
$row['APP_MSG_FROM'] = htmlentities($row['APP_MSG_FROM'], ENT_QUOTES, "UTF-8");
$row['APP_MSG_STATUS'] = ucfirst($row['APP_MSG_STATUS']);
switch ($filterBy) {
case 'CASES':
if ($row['DEL_INDEX'] != 0) {
$index = $row['DEL_INDEX'];
}
case 'CASES':
if ($row['DEL_INDEX'] != 0) {
$index = $row['DEL_INDEX'];
}
$criteria = new Criteria();
$criteria = new Criteria();
$criteria->addSelectColumn(AppCacheViewPeer::APP_TITLE);
$criteria->addSelectColumn(AppCacheViewPeer::APP_TAS_TITLE);
$criteria->add(AppCacheViewPeer::APP_UID, $row['APP_UID'], Criteria::EQUAL);
$criteria->add(AppCacheViewPeer::DEL_INDEX, $index, Criteria::EQUAL);
$criteria->addSelectColumn(AppCacheViewPeer::APP_TITLE);
$criteria->addSelectColumn(AppCacheViewPeer::APP_TAS_TITLE);
$criteria->add(AppCacheViewPeer::APP_UID, $row['APP_UID'], Criteria::EQUAL);
$criteria->add(AppCacheViewPeer::DEL_INDEX, $index, Criteria::EQUAL);
$resultCacheView = AppCacheViewPeer::doSelectRS($criteria);
$resultCacheView->setFetchmode(ResultSet::FETCHMODE_ASSOC);
$resultCacheView = AppCacheViewPeer::doSelectRS($criteria);
$resultCacheView->setFetchmode(ResultSet::FETCHMODE_ASSOC);
$row['APP_TITLE'] = '-';
$row['APP_TITLE'] = '-';
while ($resultCacheView->next()) {
$rowCacheView = $resultCacheView->getRow();
$row['APP_TITLE'] = $rowCacheView['APP_TITLE'];
$row['TAS_TITLE'] = $rowCacheView['APP_TAS_TITLE'];
}
while ($resultCacheView->next()) {
$rowCacheView = $resultCacheView->getRow();
$row['APP_TITLE'] = $rowCacheView['APP_TITLE'];
$row['TAS_TITLE'] = $rowCacheView['APP_TAS_TITLE'];
}
if ($row['DEL_INDEX'] == 0) {
$row['TAS_TITLE'] = $tasTitleDefault;
}
break;
case 'TEST':
$row['PRO_UID'] = '';
$row['APP_NUMBER'] = '';
$row['PRO_TITLE'] = '';
$row['APP_TITLE'] = '';
$row['TAS_TITLE'] = '';
break;
case 'EXTERNAL-REGISTRATION':
$row['PRO_UID'] = '';
$row['APP_NUMBER'] = '';
$row['PRO_TITLE'] = '';
$row['APP_TITLE'] = '';
$row['TAS_TITLE'] = '';
break;
if ($row['DEL_INDEX'] == 0) {
$row['TAS_TITLE'] = $tasTitleDefault;
}
break;
case 'TEST':
$row['PRO_UID'] = '';
$row['APP_NUMBER'] = '';
$row['PRO_TITLE'] = '';
$row['APP_TITLE'] = '';
$row['TAS_TITLE'] = '';
break;
case 'EXTERNAL-REGISTRATION':
$row['PRO_UID'] = '';
$row['APP_NUMBER'] = '';
$row['PRO_TITLE'] = '';
$row['APP_TITLE'] = '';
$row['TAS_TITLE'] = '';
break;
}
$data[] = $row;
}
$response = array();
$response['totalCount'] = $totalCount;
$response['data'] = $data;
$response['data'] = $data;
die(G::json_encode($response));
break;
case 'updateStatusMessage':

Some files were not shown because too many files have changed in this diff Show More