BUG 13436 ProcessMaker 2.x Authenticated PHP Code Execution SOLVED

- The function sent in the variable $_REQUEST['action'] was always executed
- A new method was implemented to validate if is a user custom function or a system function (G::isUserFunction)

workflow/engine/methods/cases/caseNotesAjax.php

@@ -5,7 +5,7 @@ if (! isset( $_REQUEST['action'] )) {
     print G::json_encode( $res );
     die();
 }
-if (! function_exists( $_REQUEST['action'] )) {
+if (! function_exists( $_REQUEST['action'] ) || !G::isUserFunction($_REQUEST['action'])) {
     $res['success'] = 'failure';
     $res['message'] = 'The requested action does not exist';
     header( "Content-Type: application/json" );