diff --git a/gulliver/system/class.g.php b/gulliver/system/class.g.php
index cac52823d..b70a5d488 100644
--- a/gulliver/system/class.g.php
+++ b/gulliver/system/class.g.php
@@ -2950,6 +2950,16 @@ class G
{
return (bool) preg_match( '/^[0-9A-Za-z]{14,}/', $uid );
}
+
+ /**
+ * Verify if the input string is a valid UID of size 32
+ * @param string $uid
+ * @return boolean
+ */
+ public static function verifyUniqueID32($uid)
+ {
+ return (bool) preg_match('/^[0-9A-Za-z]{32,32}$/', $uid);
+ }
/**
* is_utf8
diff --git a/workflow/engine/classes/class.wsBase.php b/workflow/engine/classes/class.wsBase.php
index 94996c8d6..e7ace313e 100644
--- a/workflow/engine/classes/class.wsBase.php
+++ b/workflow/engine/classes/class.wsBase.php
@@ -2447,7 +2447,7 @@ class wsBase
}
$res = $result->getPayloadArray();
-
+
//Now fill the array of AppDelegationPeer
$oCriteria = new Criteria( 'workflow' );
$oCriteria->addSelectColumn( AppDelegationPeer::DEL_INDEX );
@@ -2486,7 +2486,7 @@ class wsBase
}
//Execute events
- $eventPro = $_SESSION["PROCESS"];
+ $eventPro = $appFields['PRO_UID'];
$eventApp = $caseId;
$eventInd = $aAppDel['DEL_INDEX'];
$eventTas = $aAppDel['TAS_UID'];
diff --git a/workflow/engine/methods/services/ActionsByEmailDataFormPost.php b/workflow/engine/methods/services/ActionsByEmailDataFormPost.php
index 41627bdf9..7655a4d04 100644
--- a/workflow/engine/methods/services/ActionsByEmailDataFormPost.php
+++ b/workflow/engine/methods/services/ActionsByEmailDataFormPost.php
@@ -1,8 +1,8 @@
verifyfeature('zLhSk5TeEQrNFI2RXFEVktyUGpnczV1WEJNWVp6cjYxbTU3R29mVXVZNWhZQT0=')) {
+ ::getSingleton()
+ ->verifyfeature('zLhSk5TeEQrNFI2RXFEVktyUGpnczV1WEJNWVp6cjYxbTU3R29mVXVZNWhZQT0=')) {
$G_PUBLISH = new Publisher();
try {
/**
@@ -28,46 +28,46 @@ if (PMLicensedFeatures
* In 'b' is reflected the output of 'a'.
*/
$backupSession = serialize($_SESSION);
-
- if ($_REQUEST['APP_UID'] == '') {
- if($_GET['APP_UID'] == ''){
- throw new Exception('The parameter APP_UID is empty.');
- } else {
- $_REQUEST['APP_UID'] = $_GET['APP_UID'];
+
+ if (empty($_GET['APP_UID'])) {
+ $sw = empty($_REQUEST['APP_UID']);
+ if (!$sw && !G::verifyUniqueID32($_REQUEST['APP_UID'])) {
+ $_GET['APP_UID'] = $_REQUEST['APP_UID'];
+ }
+ if ($sw) {
+ throw new Exception('The parameter APP_UID is empty.');
}
}
- if ($_REQUEST['DEL_INDEX'] == '') {
+ if (empty($_REQUEST['DEL_INDEX'])) {
throw new Exception('The parameter DEL_INDEX is empty.');
}
- if ($_REQUEST['ABER'] == '') {
+ if (empty($_REQUEST['ABER'])) {
throw new Exception('The parameter ABER is empty.');
}
- if (!isset($_REQUEST['form'])) {
- $_REQUEST['form'] = array();
- }
+ $appUid = G::decrypt($_GET['APP_UID'], URL_KEY);
+ $delIndex = G::decrypt($_REQUEST['DEL_INDEX'], URL_KEY);
+ $aber = G::decrypt($_REQUEST['ABER'], URL_KEY);
+ $forms = isset($_REQUEST['form']) ? $_REQUEST['form'] : [];
- $_REQUEST['APP_UID'] = G::decrypt($_REQUEST['APP_UID'], URL_KEY);
- $_REQUEST['DEL_INDEX'] = G::decrypt($_REQUEST['DEL_INDEX'], URL_KEY);
- $_REQUEST['ABER'] = G::decrypt($_REQUEST['ABER'], URL_KEY);
G::LoadClass('case');
$case = new Cases();
- $casesFields = $case->loadCase($_REQUEST['APP_UID'], $_REQUEST['DEL_INDEX']);
+ $casesFields = $case->loadCase($appUid, $delIndex);
- $casesFields['APP_DATA'] = array_merge($casesFields['APP_DATA'], $_REQUEST['form']);
+ $casesFields['APP_DATA'] = array_merge($casesFields['APP_DATA'], $forms);
//Get user info
$current_user_uid = null;
- $currentUsrName = null;
+ $currentUsrName = null;
$criteria = new Criteria("workflow");
$criteria->addSelectColumn(AppDelegationPeer::USR_UID);
- $criteria->add(AppDelegationPeer::APP_UID, $_REQUEST["APP_UID"]);
- $criteria->add(AppDelegationPeer::DEL_INDEX, $_REQUEST["DEL_INDEX"]);
+ $criteria->add(AppDelegationPeer::APP_UID, $appUid);
+ $criteria->add(AppDelegationPeer::DEL_INDEX, $delIndex);
$rsSQL = AppDelegationPeer::doSelectRS($criteria);
$rsSQL->setFetchmode(ResultSet::FETCHMODE_ASSOC);
@@ -92,7 +92,7 @@ if (PMLicensedFeatures
$row = $rsSQL->getRow();
$currentUsrName = $row["USR_USERNAME"];
- $casesFields["APP_DATA"]["USER_LOGGED"] = $current_user_uid;
+ $casesFields["APP_DATA"]["USER_LOGGED"] = $current_user_uid;
$casesFields["APP_DATA"]["USR_USERNAME"] = $currentUsrName;
}
@@ -101,18 +101,18 @@ if (PMLicensedFeatures
}
//Update case info
- $case->updateCase($_REQUEST['APP_UID'], $casesFields);
+ $case->updateCase($appUid, $casesFields);
G::LoadClass('wsBase');
$wsBaseInstance = new wsBase();
- $result = $wsBaseInstance->derivateCase($casesFields['CURRENT_USER_UID'], $_REQUEST['APP_UID'], $_REQUEST ['DEL_INDEX'], true);
+ $result = $wsBaseInstance->derivateCase($casesFields['CURRENT_USER_UID'], $appUid, $delIndex, true);
$code = (is_array($result) ? $result['status_code'] : $result->status_code);
$dataResponses = array();
- $dataResponses['ABE_REQ_UID'] = $_REQUEST['ABER'];
+ $dataResponses['ABE_REQ_UID'] = $aber;
$dataResponses['ABE_RES_CLIENT_IP'] = $_SERVER['REMOTE_ADDR'];
- $dataResponses['ABE_RES_DATA'] = serialize($_REQUEST['form']);
+ $dataResponses['ABE_RES_DATA'] = serialize($forms);
$dataResponses['ABE_RES_STATUS'] = 'PENDING';
$dataResponses['ABE_RES_MESSAGE'] = '';
@@ -129,13 +129,13 @@ if (PMLicensedFeatures
//Save Cases Notes
include_once 'utils.php';
- $dataAbeRequests = loadAbeRequest($_REQUEST['ABER']);
+ $dataAbeRequests = loadAbeRequest($aber);
$dataAbeConfiguration = loadAbeConfiguration($dataAbeRequests['ABE_UID']);
if ($dataAbeConfiguration['ABE_CASE_NOTE_IN_RESPONSE'] == 1) {
$response = new stdclass();
$response->usrUid = $casesFields['APP_DATA']['USER_LOGGED'];
- $response->appUid = $_REQUEST['APP_UID'];
+ $response->appUid = $appUid;
$response->noteText = "Check the information that was sent for the receiver: " . $dataAbeRequests['ABE_REQ_SENT_TO'];
postNote($response);
@@ -144,10 +144,10 @@ if (PMLicensedFeatures
$dataAbeRequests['ABE_REQ_ANSWERED'] = 1;
$code == 0 ? uploadAbeRequest($dataAbeRequests) : '';
- if (isset ( $_FILES ['form'] )) {
- if (isset( $_FILES["form"]["name"] ) && count( $_FILES["form"]["name"] ) > 0) {
+ if (isset($_FILES ['form'])) {
+ if (isset($_FILES["form"]["name"]) && count($_FILES["form"]["name"]) > 0) {
$oInputDocument = new \ProcessMaker\BusinessModel\Cases\InputDocument();
- $oInputDocument->uploadFileCase($_FILES, $case, $casesFields, $current_user_uid, $_REQUEST['APP_UID'], $_REQUEST["DEL_INDEX"]);
+ $oInputDocument->uploadFileCase($_FILES, $case, $casesFields, $current_user_uid, $appUid, $delIndex);
}
}
@@ -155,8 +155,8 @@ if (PMLicensedFeatures
$aMessage['MESSAGE'] = 'The information was submitted. Thank you.';
} else {
throw new Exception('An error occurred while the application was being processed.
- Error code: '.$result->status_code.'
- Error message: '.$result->message.'
');
+ Error code: ' . $result->status_code . '
+ Error message: ' . $result->message . '
');
}
// Update
@@ -173,7 +173,7 @@ if (PMLicensedFeatures
$_SESSION = unserialize($backupSession);
$G_PUBLISH->AddContent('xmlform', 'xmlform', 'login/showInfo', '', $aMessage);
} catch (Exception $error) {
- $G_PUBLISH->AddContent('xmlform', 'xmlform', 'login/showMessage', '', array('MESSAGE' => $error->getMessage().' Please contact to your system administrator.'));
+ $G_PUBLISH->AddContent('xmlform', 'xmlform', 'login/showMessage', '', array('MESSAGE' => $error->getMessage() . ' Please contact to your system administrator.'));
}
$_SESSION = unserialize($backupSession);
G::RenderPage('publish', 'blank');