From b4ff11ddecc7cc2ede19862956d50ea19dc27470 Mon Sep 17 00:00:00 2001 From: Marco Antonio Nina Date: Thu, 3 Jul 2014 16:37:24 -0400 Subject: [PATCH 01/48] BUG-14986 Authorization Bypass via Forceful Browsing IMPROVEMENT --- workflow/engine/methods/users/usersNew.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/workflow/engine/methods/users/usersNew.php b/workflow/engine/methods/users/usersNew.php index a81603d06..dff07aee6 100644 --- a/workflow/engine/methods/users/usersNew.php +++ b/workflow/engine/methods/users/usersNew.php @@ -1,4 +1,6 @@ requirePermissions( 'PM_USERS' ); //calculating the max upload file size; $POST_MAX_SIZE = ini_get( 'post_max_size' ); From 692a1917e2cd369aa493056b848a6e2d4b586e4f Mon Sep 17 00:00:00 2001 From: Julio Cesar Laura Date: Tue, 8 Jul 2014 10:46:55 -0400 Subject: [PATCH 02/48] Initializing vars correctly to avoid warnings messages --- workflow/engine/classes/class.case.php | 2 +- workflow/engine/classes/model/AppDelegation.php | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/workflow/engine/classes/class.case.php b/workflow/engine/classes/class.case.php index 8285ba92d..c0b58a134 100755 --- a/workflow/engine/classes/class.case.php +++ b/workflow/engine/classes/class.case.php @@ -577,7 +577,7 @@ class Cases if ($jump != '') { $aCases = $oAppDel->LoadParallel($sAppUid); $aFields['TAS_UID'] = ''; - $aFields['CURRENT_USER'] = ''; + $aFields['CURRENT_USER'] = array(); foreach ($aCases as $key => $value) { $oCurUser->load($value['USR_UID']); $aFields['CURRENT_USER'][]= $oCurUser->getUsrFirstname() . ' ' . $oCurUser->getUsrLastname(); diff --git a/workflow/engine/classes/model/AppDelegation.php b/workflow/engine/classes/model/AppDelegation.php index c0aba5826..4fcaf98d4 100755 --- a/workflow/engine/classes/model/AppDelegation.php +++ b/workflow/engine/classes/model/AppDelegation.php @@ -211,6 +211,8 @@ class AppDelegation extends BaseAppDelegation public function LoadParallel ($AppUid) { + $aCases = array(); + $c = new Criteria( 'workflow' ); $c->addSelectColumn( AppDelegationPeer::APP_UID ); $c->addSelectColumn( AppDelegationPeer::DEL_INDEX ); From ff6ff61c00920df8a8c39ef08d08c326aa6c92ca Mon Sep 17 00:00:00 2001 From: Julio Cesar Laura Date: Fri, 11 Jul 2014 12:07:24 -0400 Subject: [PATCH 03/48] BUG 15419 Notificaciones incorrectas aplicando PPP_FAILED_LOGINS SOLVED - The message was overwrited with the standard message - Now the message is displayed correctly and I made some improvements in the PPP functionality --- .../engine/methods/login/authentication.php | 23 ++++++------------- 1 file changed, 7 insertions(+), 16 deletions(-) diff --git a/workflow/engine/methods/login/authentication.php b/workflow/engine/methods/login/authentication.php index c25eb35e5..be9903e58 100755 --- a/workflow/engine/methods/login/authentication.php +++ b/workflow/engine/methods/login/authentication.php @@ -93,7 +93,7 @@ try { } if (!isset($uid) || $uid < 0) { - if (isset($_SESSION['FAILED_LOGINS'])) { + if (isset($_SESSION['FAILED_LOGINS']) && ($uid == -1 || $uid == -2)) { $_SESSION['FAILED_LOGINS']++; } if (!defined('PPP_FAILED_LOGINS')) { @@ -113,8 +113,13 @@ try { $oStatement = $oConnection->prepareStatement("UPDATE USERS SET USR_STATUS = 'INACTIVE' WHERE USR_UID = '" . $sUserUID . "'"); $oStatement->executeQuery(); unset($_SESSION['FAILED_LOGINS']); - G::SendMessageText(G::LoadTranslation('ID_ACCOUNT') . ' "' . $usr . '" ' . G::LoadTranslation('ID_ACCOUNT_DISABLED_CONTACT_ADMIN'), 'warning'); + $errLabel = G::LoadTranslation('ID_ACCOUNT') . ' "' . $usr . '" ' . G::LoadTranslation('ID_ACCOUNT_DISABLED_CONTACT_ADMIN'); } + //Log failed authentications + $message = "| Many failed authentication attempts for USER: " . $usr . " | IP: " . G::getIpAddress() . " | WS: " . SYS_SYS; + $message .= " | BROWSER: " . $_SERVER['HTTP_USER_AGENT'] ." | \n" ; + + G::log($message, PATH_DATA, 'loginFailed.log'); } } @@ -131,20 +136,6 @@ try { } } - //LOG Filed authentications - $filedTimes = (defined(PPP_FAILED_LOGINS)) ? PPP_FAILED_LOGINS : 3; - - if($_SESSION['FAILED_LOGINS'] > $filedTimes){ - $ip = G::getIpAddress(); - $browser = $_SERVER['HTTP_USER_AGENT']; - - $path = PATH_DATA; - $message = "| Many failed authentication attempts for USER: " . $usr . " | IP: " . $ip . " | WS: " . SYS_SYS . " | BROWSER: " .$browser ." | \n" ; - $file = "loginFailed.log"; - - G::log($message, $path, $file); - } - G::header("location: $loginUrl"); die; } From 904819f15f6e274fdcf8896759095e4428bf5197 Mon Sep 17 00:00:00 2001 From: Julio Cesar Laura Date: Fri, 11 Jul 2014 12:36:20 -0400 Subject: [PATCH 04/48] BUG 15400 La opcion Process Information del Case Information Menu no funciona SOLVED - "Configuration" class not included - Include "Configuration" class in the requested function --- workflow/engine/methods/cases/ajaxListener.php | 1 + 1 file changed, 1 insertion(+) diff --git a/workflow/engine/methods/cases/ajaxListener.php b/workflow/engine/methods/cases/ajaxListener.php index f3a5f210d..534dd0063 100755 --- a/workflow/engine/methods/cases/ajaxListener.php +++ b/workflow/engine/methods/cases/ajaxListener.php @@ -334,6 +334,7 @@ class Ajax $processData['PRO_AUTHOR'] = '(USER DELETED)'; } + G::LoadClass('configuration'); $conf = new Configurations(); $conf->getFormats(); $processData['PRO_CREATE_DATE'] = $conf->getSystemDate($processData['PRO_CREATE_DATE']); From cd1e1886ff7a0bf9b949f9245182ad7f17858fa2 Mon Sep 17 00:00:00 2001 From: Julio Cesar Laura Date: Fri, 11 Jul 2014 15:30:27 -0400 Subject: [PATCH 05/48] Improvemenet in the preview of forms in case history --- workflow/engine/methods/cases/ajaxListener.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/workflow/engine/methods/cases/ajaxListener.php b/workflow/engine/methods/cases/ajaxListener.php index 534dd0063..9b99f8e98 100755 --- a/workflow/engine/methods/cases/ajaxListener.php +++ b/workflow/engine/methods/cases/ajaxListener.php @@ -810,7 +810,7 @@ class Ajax public function dynaformViewFromHistory() { ?> - +