fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merged in bugfix/HOR-3858 (pull request #6106)

Browse Source 
HOR-3858

Approved-by: Julio Cesar Laura Avendaño <contact@julio-laura.com>
Approved-by: Paula Quispe <paula.quispe@processmaker.com>
This commit is contained in:
Marco Antonio Nina Mena
2017-10-19 22:01:43 +00:00
committed by Paula Quispe
parent 9cf97125e0 313103f591
commit 37b2a39c9f
2 changed files with 26 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
gulliver/system/class.rbac.php
View File

@@ -178,7 +178,11 @@ class RBAC
'DEL' => array('PM_SETUP'), 'DEL' => array('PM_SETUP'),
'LST' => array('PM_SETUP'), 'LST' => array('PM_SETUP'),
'TEST' => array('PM_SETUP') 'TEST' => array('PM_SETUP')
) ),
'processes_GetFile.php' => [
'mailTemplates' => ['PM_FACTORY'],
'public' => ['PM_FACTORY']
]
); );
} }

28
workflow/engine/methods/processes/processes_GetFile.php
View File

@@ -1,18 +1,32 @@
<?php <?php
switch ($_GET['MAIN_DIRECTORY']) { global $RBAC;
$RBAC->allows(basename(__FILE__), $_GET['MAIN_DIRECTORY']);
$mainDirectory = !empty($_GET['MAIN_DIRECTORY']) ? $_GET['MAIN_DIRECTORY'] : '';
$proUid = !empty($_GET['PRO_UID']) ? $_GET['PRO_UID'] : '';
$currentDirectory = !empty($_GET['CURRENT_DIRECTORY']) ? realpath($_GET['CURRENT_DIRECTORY']) . PATH_SEP : '';
$file = !empty($_GET['FILE']) ? realpath($_GET['FILE']) : '';
$extension = (!empty($_GET['sFilextension']) && $_GET['sFilextension'] === 'javascript') ? '.js' : '';
//validated process exists, return throw if not exists.
$process = new Process();
$process->load($proUid);
switch ($mainDirectory) {
case 'mailTemplates': case 'mailTemplates':
$sDirectory = PATH_DATA_MAILTEMPLATES . $_GET['PRO_UID'] . PATH_SEP . ($_GET['CURRENT_DIRECTORY'] != '' ? $_GET['CURRENT_DIRECTORY'] . PATH_SEP : ''); $directory = PATH_DATA_MAILTEMPLATES;
break; break;
case 'public': case 'public':
$sDirectory = PATH_DATA_PUBLIC . $_GET['PRO_UID'] . PATH_SEP . ($_GET['CURRENT_DIRECTORY'] != '' ? $_GET['CURRENT_DIRECTORY'] . PATH_SEP : ''); $directory = PATH_DATA_PUBLIC;
break; break;
default: default:
die(); die();
break; break;
} }
//fixed: added a file extension when is a javascript file by krlos
$_GET['FILE'] .= ($_GET['sFilextension'] != '' && $_GET['sFilextension'] == 'javascript') ? '.js' : '';
if (file_exists( $sDirectory . $_GET['FILE'] )) { $directory .= $proUid . PATH_SEP . $currentDirectory;
G::streamFile( $sDirectory . $_GET['FILE'], true ); $file .= $extension;
if (file_exists($directory . $file)) {
G::streamFile($directory . $file, true);
} }