diff --git a/gulliver/system/class.g.php b/gulliver/system/class.g.php index cac52823d..b70a5d488 100644 --- a/gulliver/system/class.g.php +++ b/gulliver/system/class.g.php @@ -2950,6 +2950,16 @@ class G { return (bool) preg_match( '/^[0-9A-Za-z]{14,}/', $uid ); } + + /** + * Verify if the input string is a valid UID of size 32 + * @param string $uid + * @return boolean + */ + public static function verifyUniqueID32($uid) + { + return (bool) preg_match('/^[0-9A-Za-z]{32,32}$/', $uid); + } /** * is_utf8 diff --git a/workflow/engine/classes/class.wsBase.php b/workflow/engine/classes/class.wsBase.php index 94996c8d6..e7ace313e 100644 --- a/workflow/engine/classes/class.wsBase.php +++ b/workflow/engine/classes/class.wsBase.php @@ -2447,7 +2447,7 @@ class wsBase } $res = $result->getPayloadArray(); - + //Now fill the array of AppDelegationPeer $oCriteria = new Criteria( 'workflow' ); $oCriteria->addSelectColumn( AppDelegationPeer::DEL_INDEX ); @@ -2486,7 +2486,7 @@ class wsBase } //Execute events - $eventPro = $_SESSION["PROCESS"]; + $eventPro = $appFields['PRO_UID']; $eventApp = $caseId; $eventInd = $aAppDel['DEL_INDEX']; $eventTas = $aAppDel['TAS_UID']; diff --git a/workflow/engine/methods/services/ActionsByEmailDataFormPost.php b/workflow/engine/methods/services/ActionsByEmailDataFormPost.php index 41627bdf9..7655a4d04 100644 --- a/workflow/engine/methods/services/ActionsByEmailDataFormPost.php +++ b/workflow/engine/methods/services/ActionsByEmailDataFormPost.php @@ -1,8 +1,8 @@ verifyfeature('zLhSk5TeEQrNFI2RXFEVktyUGpnczV1WEJNWVp6cjYxbTU3R29mVXVZNWhZQT0=')) { + ::getSingleton() + ->verifyfeature('zLhSk5TeEQrNFI2RXFEVktyUGpnczV1WEJNWVp6cjYxbTU3R29mVXVZNWhZQT0=')) { $G_PUBLISH = new Publisher(); try { /** @@ -28,46 +28,46 @@ if (PMLicensedFeatures * In 'b' is reflected the output of 'a'. */ $backupSession = serialize($_SESSION); - - if ($_REQUEST['APP_UID'] == '') { - if($_GET['APP_UID'] == ''){ - throw new Exception('The parameter APP_UID is empty.'); - } else { - $_REQUEST['APP_UID'] = $_GET['APP_UID']; + + if (empty($_GET['APP_UID'])) { + $sw = empty($_REQUEST['APP_UID']); + if (!$sw && !G::verifyUniqueID32($_REQUEST['APP_UID'])) { + $_GET['APP_UID'] = $_REQUEST['APP_UID']; + } + if ($sw) { + throw new Exception('The parameter APP_UID is empty.'); } } - if ($_REQUEST['DEL_INDEX'] == '') { + if (empty($_REQUEST['DEL_INDEX'])) { throw new Exception('The parameter DEL_INDEX is empty.'); } - if ($_REQUEST['ABER'] == '') { + if (empty($_REQUEST['ABER'])) { throw new Exception('The parameter ABER is empty.'); } - if (!isset($_REQUEST['form'])) { - $_REQUEST['form'] = array(); - } + $appUid = G::decrypt($_GET['APP_UID'], URL_KEY); + $delIndex = G::decrypt($_REQUEST['DEL_INDEX'], URL_KEY); + $aber = G::decrypt($_REQUEST['ABER'], URL_KEY); + $forms = isset($_REQUEST['form']) ? $_REQUEST['form'] : []; - $_REQUEST['APP_UID'] = G::decrypt($_REQUEST['APP_UID'], URL_KEY); - $_REQUEST['DEL_INDEX'] = G::decrypt($_REQUEST['DEL_INDEX'], URL_KEY); - $_REQUEST['ABER'] = G::decrypt($_REQUEST['ABER'], URL_KEY); G::LoadClass('case'); $case = new Cases(); - $casesFields = $case->loadCase($_REQUEST['APP_UID'], $_REQUEST['DEL_INDEX']); + $casesFields = $case->loadCase($appUid, $delIndex); - $casesFields['APP_DATA'] = array_merge($casesFields['APP_DATA'], $_REQUEST['form']); + $casesFields['APP_DATA'] = array_merge($casesFields['APP_DATA'], $forms); //Get user info $current_user_uid = null; - $currentUsrName = null; + $currentUsrName = null; $criteria = new Criteria("workflow"); $criteria->addSelectColumn(AppDelegationPeer::USR_UID); - $criteria->add(AppDelegationPeer::APP_UID, $_REQUEST["APP_UID"]); - $criteria->add(AppDelegationPeer::DEL_INDEX, $_REQUEST["DEL_INDEX"]); + $criteria->add(AppDelegationPeer::APP_UID, $appUid); + $criteria->add(AppDelegationPeer::DEL_INDEX, $delIndex); $rsSQL = AppDelegationPeer::doSelectRS($criteria); $rsSQL->setFetchmode(ResultSet::FETCHMODE_ASSOC); @@ -92,7 +92,7 @@ if (PMLicensedFeatures $row = $rsSQL->getRow(); $currentUsrName = $row["USR_USERNAME"]; - $casesFields["APP_DATA"]["USER_LOGGED"] = $current_user_uid; + $casesFields["APP_DATA"]["USER_LOGGED"] = $current_user_uid; $casesFields["APP_DATA"]["USR_USERNAME"] = $currentUsrName; } @@ -101,18 +101,18 @@ if (PMLicensedFeatures } //Update case info - $case->updateCase($_REQUEST['APP_UID'], $casesFields); + $case->updateCase($appUid, $casesFields); G::LoadClass('wsBase'); $wsBaseInstance = new wsBase(); - $result = $wsBaseInstance->derivateCase($casesFields['CURRENT_USER_UID'], $_REQUEST['APP_UID'], $_REQUEST ['DEL_INDEX'], true); + $result = $wsBaseInstance->derivateCase($casesFields['CURRENT_USER_UID'], $appUid, $delIndex, true); $code = (is_array($result) ? $result['status_code'] : $result->status_code); $dataResponses = array(); - $dataResponses['ABE_REQ_UID'] = $_REQUEST['ABER']; + $dataResponses['ABE_REQ_UID'] = $aber; $dataResponses['ABE_RES_CLIENT_IP'] = $_SERVER['REMOTE_ADDR']; - $dataResponses['ABE_RES_DATA'] = serialize($_REQUEST['form']); + $dataResponses['ABE_RES_DATA'] = serialize($forms); $dataResponses['ABE_RES_STATUS'] = 'PENDING'; $dataResponses['ABE_RES_MESSAGE'] = ''; @@ -129,13 +129,13 @@ if (PMLicensedFeatures //Save Cases Notes include_once 'utils.php'; - $dataAbeRequests = loadAbeRequest($_REQUEST['ABER']); + $dataAbeRequests = loadAbeRequest($aber); $dataAbeConfiguration = loadAbeConfiguration($dataAbeRequests['ABE_UID']); if ($dataAbeConfiguration['ABE_CASE_NOTE_IN_RESPONSE'] == 1) { $response = new stdclass(); $response->usrUid = $casesFields['APP_DATA']['USER_LOGGED']; - $response->appUid = $_REQUEST['APP_UID']; + $response->appUid = $appUid; $response->noteText = "Check the information that was sent for the receiver: " . $dataAbeRequests['ABE_REQ_SENT_TO']; postNote($response); @@ -144,10 +144,10 @@ if (PMLicensedFeatures $dataAbeRequests['ABE_REQ_ANSWERED'] = 1; $code == 0 ? uploadAbeRequest($dataAbeRequests) : ''; - if (isset ( $_FILES ['form'] )) { - if (isset( $_FILES["form"]["name"] ) && count( $_FILES["form"]["name"] ) > 0) { + if (isset($_FILES ['form'])) { + if (isset($_FILES["form"]["name"]) && count($_FILES["form"]["name"]) > 0) { $oInputDocument = new \ProcessMaker\BusinessModel\Cases\InputDocument(); - $oInputDocument->uploadFileCase($_FILES, $case, $casesFields, $current_user_uid, $_REQUEST['APP_UID'], $_REQUEST["DEL_INDEX"]); + $oInputDocument->uploadFileCase($_FILES, $case, $casesFields, $current_user_uid, $appUid, $delIndex); } } @@ -155,8 +155,8 @@ if (PMLicensedFeatures $aMessage['MESSAGE'] = 'The information was submitted. Thank you.'; } else { throw new Exception('An error occurred while the application was being processed.

- Error code: '.$result->status_code.'
- Error message: '.$result->message.'

'); + Error code: ' . $result->status_code . '
+ Error message: ' . $result->message . '

'); } // Update @@ -173,7 +173,7 @@ if (PMLicensedFeatures $_SESSION = unserialize($backupSession); $G_PUBLISH->AddContent('xmlform', 'xmlform', 'login/showInfo', '', $aMessage); } catch (Exception $error) { - $G_PUBLISH->AddContent('xmlform', 'xmlform', 'login/showMessage', '', array('MESSAGE' => $error->getMessage().' Please contact to your system administrator.')); + $G_PUBLISH->AddContent('xmlform', 'xmlform', 'login/showMessage', '', array('MESSAGE' => $error->getMessage() . ' Please contact to your system administrator.')); } $_SESSION = unserialize($backupSession); G::RenderPage('publish', 'blank');