Merged in bugfix/HOR-3465 (pull request #5869)

Bugfix/HOR-3465

Approved-by: Julio Cesar Laura Avendaño <contact@julio-laura.com>
Approved-by: Paula Quispe <paula.quispe@processmaker.com>

gulliver/system/class.g.php

@@ -1989,7 +1989,7 @@ class G
      *
      * @return void
      */
-    public function SendTemporalMessage ($msgID, $strType, $sType = 'LABEL', $time = null, $width = null, $customLabels = null)
+    public static function SendTemporalMessage ($msgID, $strType, $sType = 'LABEL', $time = null, $width = null, $customLabels = null)
     {
         if (isset( $width )) {
             $_SESSION['G_MESSAGE_WIDTH'] = $width;

gulliver/system/class.rbac.php

@@ -25,6 +25,9 @@
  * Coral Gables, FL, 33134, USA, or email info@colosa.com.
  *
  */
+
+use ProcessMaker\Exception\RBACException;
+
 /**
  * File: $Id$
  *
@@ -148,8 +151,11 @@ class RBAC
             ),
             'newSite.php' => array(
                 'newSite.php' => array('PM_SETUP_ADVANCE')
+            ),
+            'emailsAjax.php' => array(
+                'MessageList' => array('PM_SETUP', 'PM_SETUP_LOGS'),
+                'updateStatusMessage' => array('PM_SETUP', 'PM_SETUP_LOGS'),
             )
-
         );
     }
 
@@ -1546,8 +1552,7 @@ class RBAC
         }
 
         if (!$access) {
-            G::header('Location: /errors/error403.php');
-            die();
+            throw new RBACException('ID_ACCESS_DENIED', 403);
         }
     }
 }

workflow/engine/methods/mails/emailsAjax.php

@@ -1,10 +1,20 @@
 <?php
-$req = (isset($_POST['request']))? $_POST['request']:((isset($_REQUEST['request']))? $_REQUEST['request'] : 'No hayyy tal');
 
-require_once 'classes/model/Content.php';
-require_once 'classes/model/AppMessage.php';
-require_once 'classes/model/AppDelegation.php';
-require_once 'classes/model/Application.php';
+use ProcessMaker\Exception\RBACException;
+
+$req = (isset($_REQUEST['request']) ? $_REQUEST['request'] : '');
+
+/** @var RBAC $RBAC */
+global $RBAC;
+switch ($RBAC->userCanAccess('PM_LOGIN')) {
+    case -2:
+        throw new RBACException('ID_USER_HAVENT_RIGHTS_SYSTEM', -2);
+        break;
+    case -1:
+        throw new RBACException('ID_USER_HAVENT_RIGHTS_PAGE', -1);
+        break;
+}
+$RBAC->allows(basename(__FILE__), $req);
 
 switch ($req) {
     case 'MessageList':
@@ -163,6 +173,9 @@ switch($req){
         }
 
         if ($sort != '') {
+            if (!in_array($sort, AppMessagePeer::getFieldNames(BasePeer::TYPE_FIELDNAME))) {
+                throw new Exception(G::LoadTranslation('ID_INVALID_VALUE_FOR', array('$sort')));
+            }
             if ($dir == 'ASC') {
                 $criteria->addAscendingOrderByColumn($sort);
             } else {

workflow/engine/src/ProcessMaker/Exception/RBACException.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace ProcessMaker\Exception;
+
+use G;
+
+/**
+ * Class PMException
+ * @package ProcessMaker\Exception
+ */
+class RBACException extends \Exception
+{
+    const PM_LOGIN = '../login/login';
+    const PM_403 = '/errors/error403.php';
+
+    /**
+     * RBACException constructor.
+     * @param string $message
+     * @param null $code
+     */
+    public function __construct($message, $code=NULL)
+    {
+        parent::__construct($message, $code);
+    }
+
+    /**
+     * Displays the entire exception as a string
+     * @return string
+     */
+    public function __toString()
+    {
+        switch ($this->getCode()) {
+            case -1:
+                G::SendTemporalMessage($this->getMessage(), 'error', 'labels');
+                $message = self::PM_LOGIN;
+                break;
+            case -2:
+                G::SendTemporalMessage($this->getMessage(), 'error', 'labels');
+                $message = self::PM_LOGIN;
+                break;
+            case 403:
+                $message = self::PM_403;
+                break;
+            default:
+                $message = self::PM_LOGIN;
+                break;
+        }
+        return $message;
+    }
+
+    /**
+     * Returns the path to which to redirect
+     * @return $this
+     */
+    public function getPath()
+    {
+        return $this;
+    }
+}

workflow/public_html/app.php

@@ -53,6 +53,8 @@ try {
             break;
     }
 
+} catch (ProcessMaker\Exception\RBACException $e) {
+    G::header('location: ' . $e->getPath());
 } catch (Exception $e) {
     $view = new Maveriks\Pattern\Mvc\PhtmlView($rootDir . "framework/src/templates/Exception.phtml");
     $view->set("message", $e->getMessage());