fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merged in mcuiza/processmaker/veracode-18-04-15_correcciones (pull request #2028)

Browse Source 
correcciones incidencias veracode
This commit is contained in:
Julio Cesar Laura Avendaño
2015-04-29 13:23:54 -04:00
parent 4ac5555fc4 ffdddddcd7
commit 2e23d17e0a
29 changed files with 431 additions and 150 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
workflow/engine/bin/cron.php
View File

@@ -33,6 +33,12 @@ $e_all = defined('E_DEPRECATED') ? E_ALL & ~E_DEPRECATED : E_ALL;
$e_all = defined('E_STRICT') ? $e_all & ~E_STRICT : $e_all;
$e_all = $config['debug'] ? $e_all : $e_all & ~E_NOTICE;
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$config['debug'] = $filter->validateInput($config['debug']);
$config['memory_limit'] = $filter->validateInput($config['memory_limit']);
$config['wsdl_cache'] = $filter->validateInput($config['wsdl_cache'],'int');
$config['time_zone'] = $filter->validateInput($config['time_zone']);
// Do not change any of these settings directly, use env.ini instead
ini_set('display_errors', $config['debug']);
ini_set('error_reporting', $e_all);

200
workflow/engine/bin/cron_single.php
View File

@@ -90,6 +90,12 @@ if (!defined('PATH_HOME')) {
$e_all = defined('E_STRICT') ? $e_all & ~E_STRICT : $e_all;
$e_all = $config['debug'] ? $e_all : $e_all & ~E_NOTICE;
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$config['debug'] = $filter->validateInput($config['debug']);
$config['memory_limit'] = $filter->validateInput($config['memory_limit']);
$config['wsdl_cache'] = $filter->validateInput($config['wsdl_cache'],'int');
$config['time_zone'] = $filter->validateInput($config['time_zone']);
// Do not change any of these settings directly, use env.ini instead
ini_set('display_errors', $config['debug']);
ini_set('error_reporting', $e_all);
@@ -355,8 +361,8 @@ Bootstrap::registerClass('wsResponse', PATH_HOME . "engine/classes/clas
Bootstrap::registerClass("PMLicensedFeatures", PATH_HOME . "engine" . PATH_SEP . "classes" . PATH_SEP . "class.licensedFeatures.php");
Bootstrap::registerClass("AddonsManagerPeer", PATH_HOME . "engine" . PATH_SEP . "classes" . PATH_SEP . "model" . PATH_SEP . "AddonsManagerPeer.php");
/*----------------------------------********---------------------------------*/
Bootstrap::registerClass('dashboards', PATH_HOME . "engine/classes/class.dashboards.php");
/*----------------------------------********---------------------------------*/
Bootstrap::registerClass('dashboards', PATH_HOME . "engine/classes/class.dashboards.php");
/*----------------------------------********---------------------------------*/
$arrayClass = array("Configuration", "EmailServer", "ListInbox", "ListParticipatedHistory");
@@ -371,18 +377,18 @@ foreach ($arrayClass as $value) {
G::LoadClass("serverConfiguration");
G::LoadClass("dates"); //Load Criteria
/*----------------------------------********---------------------------------*/
global $dateInit;
global $dateFinish;
/*----------------------------------********---------------------------------*/
global $dateInit;
global $dateFinish;
/*----------------------------------********---------------------------------*/
if (!defined('SYS_SYS')) {
$sObject = $argv[1];
$sNow = $argv[2];
$dateSystem = $argv[3];
/*----------------------------------********---------------------------------*/
$dateInit = null;
$dateFinish = null;
/*----------------------------------********---------------------------------*/
$dateInit = null;
$dateFinish = null;
/*----------------------------------********---------------------------------*/
$sFilter = '';
@@ -527,17 +533,17 @@ function processWorkspace()
resendEmails();
unpauseApplications();
calculateDuration();
/*----------------------------------********---------------------------------*/
calculateAppDuration();
/*----------------------------------********---------------------------------*/
calculateAppDuration();
/*----------------------------------********---------------------------------*/
executeEvents($sLastExecution);
executeScheduledCases();
executeUpdateAppTitle();
executeCaseSelfService();
executePlugins();
/*----------------------------------********---------------------------------*/
fillReportByUser();
fillReportByProcess();
/*----------------------------------********---------------------------------*/
fillReportByUser();
fillReportByProcess();
/*----------------------------------********---------------------------------*/
} catch (Exception $oError) {
saveLog("main", "error", "Error processing workspace : " . $oError->getMessage() . "\n");
@@ -728,29 +734,29 @@ function calculateDuration()
}
}
/*----------------------------------********---------------------------------*/
function calculateAppDuration()
{
global $sFilter;
if ($sFilter != '' && strpos($sFilter, 'calculateapp') === false) {
return false;
}
setExecutionMessage("Calculating Duration by Application");
try {
$oApplication = new Application();
$oApplication->calculateAppDuration(1);
setExecutionResultMessage('DONE');
saveLog('calculateDurationByApp', 'action', 'Calculating Duration by Application');
} catch (Exception $oError) {
setExecutionResultMessage('WITH ERRORS', 'error');
eprintln(" '-".$oError->getMessage(), 'red');
saveLog('calculateDurationByApp', 'error', 'Error Calculating Duration: ' . $oError->getMessage());
}
}
/*----------------------------------********---------------------------------*/
function calculateAppDuration()
{
global $sFilter;
if ($sFilter != '' && strpos($sFilter, 'calculateapp') === false) {
return false;
}
setExecutionMessage("Calculating Duration by Application");
try {
$oApplication = new Application();
$oApplication->calculateAppDuration(1);
setExecutionResultMessage('DONE');
saveLog('calculateDurationByApp', 'action', 'Calculating Duration by Application');
} catch (Exception $oError) {
setExecutionResultMessage('WITH ERRORS', 'error');
eprintln(" '-".$oError->getMessage(), 'red');
saveLog('calculateDurationByApp', 'error', 'Error Calculating Duration: ' . $oError->getMessage());
}
}
/*----------------------------------********---------------------------------*/
function executeEvents($sLastExecution, $sNow=null)
@@ -1095,66 +1101,66 @@ function setExecutionResultMessage($m, $t='')
eprintln("[$m]", $c);
}
/*----------------------------------********---------------------------------*/
function fillReportByUser ()
{
try {
global $sFilter;
global $dateInit;
global $dateFinish;
if (strpos($sFilter, 'report_by_user') === false) {
return false;
}
if ($dateInit == null) {
eprintln("You must enter the starting date.", "red");
eprintln('Example: +init-date"YYYY-MM-DD HH:MM:SS" +finish-date"YYYY-MM-DD HH:MM:SS"', "red");
return false;
}
$dateFinish = ($dateFinish != null) ? $dateFinish : date("Y-m-d H:i:s");
$appcv = new AppCacheView();
$appcv->setPathToAppCacheFiles( PATH_METHODS . 'setup' . PATH_SEP . 'setupSchemas' . PATH_SEP );
setExecutionMessage("Calculating data to fill the 'User Reporting'...");
$appcv->fillReportByUser($dateInit, $dateFinish);
setExecutionResultMessage("DONE");
} catch (Exception $e) {
setExecutionResultMessage("WITH ERRORS", "error");
eprintln(" '-" . $e->getMessage(), "red");
saveLog("fillReportByUser", "error", "Error in fill report by user: " . $e->getMessage());
}
}
function fillReportByProcess ()
{
try {
global $sFilter;
global $dateInit;
global $dateFinish;
if (strpos($sFilter, 'report_by_process') === false) {
return false;
}
if ($dateInit == null) {
eprintln("You must enter the starting date.", "red");
eprintln('Example: +init-date"YYYY-MM-DD HH:MM:SS" +finish-date"YYYY-MM-DD HH:MM:SS"', "red");
return false;
}
$dateFinish = ($dateFinish != null) ? $dateFinish : date("Y-m-d H:i:s");
$appcv = new AppCacheView();
$appcv->setPathToAppCacheFiles( PATH_METHODS . 'setup' . PATH_SEP . 'setupSchemas' . PATH_SEP );
setExecutionMessage("Calculating data to fill the 'Process Reporting'...");
$appcv->fillReportByProcess($dateInit, $dateFinish);
setExecutionResultMessage("DONE");
} catch (Exception $e) {
setExecutionResultMessage("WITH ERRORS", "error");
eprintln(" '-" . $e->getMessage(), "red");
saveLog("fillReportByProcess", "error", "Error in fill report by process: " . $e->getMessage());
}
}
/*----------------------------------********---------------------------------*/
function fillReportByUser ()
{
try {
global $sFilter;
global $dateInit;
global $dateFinish;
if (strpos($sFilter, 'report_by_user') === false) {
return false;
}
if ($dateInit == null) {
eprintln("You must enter the starting date.", "red");
eprintln('Example: +init-date"YYYY-MM-DD HH:MM:SS" +finish-date"YYYY-MM-DD HH:MM:SS"', "red");
return false;
}
$dateFinish = ($dateFinish != null) ? $dateFinish : date("Y-m-d H:i:s");
$appcv = new AppCacheView();
$appcv->setPathToAppCacheFiles( PATH_METHODS . 'setup' . PATH_SEP . 'setupSchemas' . PATH_SEP );
setExecutionMessage("Calculating data to fill the 'User Reporting'...");
$appcv->fillReportByUser($dateInit, $dateFinish);
setExecutionResultMessage("DONE");
} catch (Exception $e) {
setExecutionResultMessage("WITH ERRORS", "error");
eprintln(" '-" . $e->getMessage(), "red");
saveLog("fillReportByUser", "error", "Error in fill report by user: " . $e->getMessage());
}
}
function fillReportByProcess ()
{
try {
global $sFilter;
global $dateInit;
global $dateFinish;
if (strpos($sFilter, 'report_by_process') === false) {
return false;
}
if ($dateInit == null) {
eprintln("You must enter the starting date.", "red");
eprintln('Example: +init-date"YYYY-MM-DD HH:MM:SS" +finish-date"YYYY-MM-DD HH:MM:SS"', "red");
return false;
}
$dateFinish = ($dateFinish != null) ? $dateFinish : date("Y-m-d H:i:s");
$appcv = new AppCacheView();
$appcv->setPathToAppCacheFiles( PATH_METHODS . 'setup' . PATH_SEP . 'setupSchemas' . PATH_SEP );
setExecutionMessage("Calculating data to fill the 'Process Reporting'...");
$appcv->fillReportByProcess($dateInit, $dateFinish);
setExecutionResultMessage("DONE");
} catch (Exception $e) {
setExecutionResultMessage("WITH ERRORS", "error");
eprintln(" '-" . $e->getMessage(), "red");
saveLog("fillReportByProcess", "error", "Error in fill report by process: " . $e->getMessage());
}
}
/*----------------------------------********---------------------------------*/

6
workflow/engine/bin/messageeventcron.php
View File

@@ -43,7 +43,11 @@ try {
G::LoadClass("system");
$config = System::getSystemConfiguration();
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$config['time_zone'] = $filter->validateInput($config['time_zone']);
ini_set("date.timezone", $config["time_zone"]);
//CRON command options

5
workflow/engine/bin/messageeventcron_single.php
View File

@@ -91,6 +91,11 @@ try {
$e_all = (defined("E_STRICT"))? $e_all & ~E_STRICT : $e_all;
$e_all = ($config["debug"])? $e_all : $e_all & ~E_NOTICE;
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$config['debug'] = $filter->validateInput($config['debug']);
$config['wsdl_cache'] = $filter->validateInput($config['wsdl_cache'],'int');
$config['time_zone'] = $filter->validateInput($config['time_zone']);
//Do not change any of these settings directly, use env.ini instead
ini_set("display_errors", $config["debug"]);
ini_set("error_reporting", $e_all);

13
workflow/engine/bin/reindex_solr.php
View File

@@ -207,9 +207,16 @@ if (! defined ('SYS_SYS')) {
define ('TIME_ZONE', $config ['time_zone']);
date_default_timezone_set (TIME_ZONE);
print "TIME_ZONE: " . TIME_ZONE . "\n";
print "MEMCACHED_ENABLED: " . MEMCACHED_ENABLED . "\n";
print "MEMCACHED_SERVER: " . MEMCACHED_SERVER . "\n";
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$TIME_ZONE = $filter->xssFilterHard(TIME_ZONE);
$MEMCACHED_ENABLED = $filter->xssFilterHard(MEMCACHED_ENABLED);
$MEMCACHED_SERVER = $filter->xssFilterHard(MEMCACHED_SERVER);
print "TIME_ZONE: " . $TIME_ZONE . "\n";
print "MEMCACHED_ENABLED: " . $MEMCACHED_ENABLED . "\n";
print "MEMCACHED_SERVER: " . $MEMCACHED_SERVER . "\n";
// ****************************************
include_once (PATH_HOME . 'engine' . PATH_SEP . 'config' . PATH_SEP . 'paths_installed.php');

14
workflow/engine/bin/verify_solr.php
View File

@@ -139,13 +139,21 @@ if (! defined ('SYS_SYS')) {
define ('TIME_ZONE', $config ['time_zone']);
date_default_timezone_set (TIME_ZONE);
print "TIME_ZONE: " . TIME_ZONE . "\n";
print "MEMCACHED_ENABLED: " . MEMCACHED_ENABLED . "\n";
print "MEMCACHED_SERVER: " . MEMCACHED_SERVER . "\n";
// ****************************************
include_once (PATH_HOME . 'engine' . PATH_SEP . 'config' . PATH_SEP . 'paths_installed.php');
include_once (PATH_HOME . 'engine' . PATH_SEP . 'config' . PATH_SEP . 'paths.php');
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$TIME_ZONE = $filter->xssFilterHard(TIME_ZONE);
$MEMCACHED_ENABLED = $filter->xssFilterHard(MEMCACHED_ENABLED);
$MEMCACHED_SERVER = $filter->xssFilterHard(MEMCACHED_SERVER);
print "TIME_ZONE: " . $TIME_ZONE . "\n";
print "MEMCACHED_ENABLED: " . $MEMCACHED_ENABLED . "\n";
print "MEMCACHED_SERVER: " . $MEMCACHED_SERVER . "\n";
// ***************** PM Paths DATA **************************
define ('PATH_DATA_SITE', PATH_DATA . 'sites/' . SYS_SYS . '/');

12
workflow/engine/controllers/installer.php
View File

@@ -699,6 +699,9 @@ class Installer extends Controller
try {
$db_host = ($db_port != '' && $db_port != 3306) ? $db_hostname . ':' . $db_port : $db_hostname;
$db_host = $filter->validateInput($db_host);
$db_username = $filter->validateInput($db_username);
$db_password = $filter->validateInput($db_password);
$this->link = @mysql_connect( $db_host, $db_username, $db_password );
$this->installLog( G::LoadTranslation('ID_CONNECT_TO_SERVER', SYS_LANG, Array($db_hostname, $db_port, $db_username ) ));
@@ -1032,6 +1035,9 @@ class Installer extends Controller
try {
$db_host = ($db_port != '' && $db_port != 1433) ? $db_hostname . ':' . $db_port : $db_hostname;
$db_host = $filter->validateInput($db_host);
$db_username = $filter->validateInput($db_username);
$db_password = $filter->validateInput($db_password);
$this->link = @mssql_connect( $db_host, $db_username, $db_password );
$this->installLog( G::LoadTranslation('ID_CONNECT_TO_SERVER', SYS_LANG, Array( $db_hostname, $db_port, $db_username )) );
@@ -1231,6 +1237,9 @@ class Installer extends Controller
$info = new stdclass();
if ($_REQUEST['db_engine'] == 'mysql') {
$_REQUEST['db_hostname'] = $filter->validateInput($_REQUEST['db_hostname']);
$_REQUEST['db_username'] = $filter->validateInput($_REQUEST['db_username']);
$_REQUEST['db_password'] = $filter->validateInput($_REQUEST['db_password']);
$link = @mysql_connect( $_REQUEST['db_hostname'], $_REQUEST['db_username'], $_REQUEST['db_password'] );
$_REQUEST['wfDatabase'] = $filter->validateInput($_REQUEST['wfDatabase'], 'nosql');
$query = "show databases like '%s' ";
@@ -1296,6 +1305,7 @@ class Installer extends Controller
}
$db_host = ($db_port != '' && $db_port != 1433) ? $db_hostname . ':' . $db_port : $db_hostname;
$link = @mysql_connect( $db_host, $db_username, $db_password );
if (! $link) {
$info->message .= G::LoadTranslation('ID_MYSQL_CREDENTIALS_WRONG');
@@ -1348,6 +1358,7 @@ class Installer extends Controller
}
$db_host = ($db_port != '' && $db_port != 1433) ? $db_hostname . ':' . $db_port : $db_hostname;
$link = @mssql_connect( $db_host, $db_username, $db_password );
if (! $link) {
$info->message .= G::LoadTranslation('ID_MYSQL_CREDENTIALS_WRONG');
@@ -1661,6 +1672,7 @@ class Installer extends Controller
$wf = trim( $_REQUEST['wfDatabase'] );
$db_host = ($db_port != '' && $db_port != 3306) ? $db_hostname . ':' . $db_port : $db_hostname;
$link = @mysql_connect( $db_host, $db_username, $db_password );
@mysql_select_db($wf, $link);
$res = mysql_query( "SELECT STORE_ID FROM ADDONS_MANAGER WHERE ADDON_NAME = '" . $namePlugin . "'", $link );

5
workflow/engine/methods/setup/setup.php
View File

@@ -33,7 +33,6 @@ G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_GET['i18'] = $filter->xssFilterHard($_GET['i18']);
$_GET['newSite'] = $filter->xssFilterHard($_GET['newSite']);
$_GET['module'] = $filter->xssFilterHard($_GET['module']);
if (($RBAC_Response = $RBAC->userCanAccess( "PM_SETUP" )) != 1)
return $RBAC_Response;
@@ -78,10 +77,10 @@ foreach ($toolItems as $item) {
$G_PUBLISH->AddContent( 'template', '', '', '', $template );
G::RenderPage( 'publish' );
if (isset( $_GET['module'] )) {
$module = $filter->xssFilterHard($_GET['module']);
print "
<script>
admToolsContent.location='" . $_GET['module'] . "';
admToolsContent.location='" . $module . "';
</script>
";
}

13
workflow/engine/methods/setup/skin_Ajax.php
View File

@@ -319,9 +319,9 @@ function importSkin ()
function exportSkin ($skinToExport = "")
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
try {
G::LoadSystem('inputfilter');
$filter = new InputFilter();
if (! isset( $_REQUEST['SKIN_FOLDER_ID'] )) {
throw (new Exception( G::LoadTranslation( 'ID_SKIN_NAME_REQUIRED' ) ));
}
@@ -356,19 +356,23 @@ function exportSkin ($skinToExport = "")
$response['success'] = true;
$response['message'] = $skinTar;
G::auditLog("ExportSkin", "Skin Name: ".$skinName);
$response = $filter->xssFilterHard($response);
print_r( G::json_encode( $response ) );
} catch (Exception $e) {
$response['success'] = false;
$response['message'] = $e->getMessage();
$response = $filter->xssFilterHard($response);
print_r( G::json_encode( $response ) );
}
}
function deleteSkin ()
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
try {
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_REQUEST['SKIN_FOLDER_ID'] = $filter->xssFilterHard($_REQUEST['SKIN_FOLDER_ID']);
if (! (isset( $_REQUEST['SKIN_FOLDER_ID'] ))) {
@@ -389,6 +393,7 @@ function deleteSkin ()
} catch (Exception $e) {
$response['success'] = false;
$response['error'] = $response['message'] = $e->getMessage();
$response = $filter->xssFilterHard($response);
print_r( G::json_encode( $response ) );
}
}

6
workflow/engine/src/ProcessMaker/BusinessModel/Consolidated.php
View File

@@ -323,11 +323,15 @@ class Consolidated
$oCriteria->add($oCriteria->getNewCriterion(AppCacheViewPeer::APP_NUMBER, $search, Criteria::LIKE));
}
}
G::LoadSystem('inputfilter');
$filter = new \InputFilter();
if ($sort != "") {
$reportTable = new ReportTables();
$arrayReportTableVar = $reportTable->getTableVars($tableUid);
$tableName = $filter->validateInput($tableName);
$sort = $filter->validateInput($sort);
if (in_array($sort, $arrayReportTableVar)) {
$sort = strtoupper($sort);
eval("\$field = " . $tableName . "Peer::" . $sort . ";");

5
workflow/engine/test/bootstrap/unit.php
View File

@@ -61,8 +61,9 @@
//$_test_dir = realpath(dirname(__FILE__).'/..');
//require_once( 'lime/lime.php');
require_once (PATH_GULLIVER . "class.bootstrap.php");
if(file_exists(PATH_GULLIVER . "class.bootstrap.php")) {
require_once (PATH_GULLIVER . "class.bootstrap.php");
}
spl_autoload_register(array('Bootstrap', 'autoloadClass'));
Bootstrap::registerClass('G', PATH_GULLIVER . "class.g.php");
Bootstrap::registerClass('System', PATH_HOME . "engine/classes/class.system.php");