fernando/luos
1
0
Fork 0
Code Releases Activity

add validation for sort and up observations

Browse Source
This commit is contained in:
Ronald Quenta
2017-08-08 14:46:01 -04:00
parent 04a8b6561a
commit 61f9f9f7c4
5 changed files with 88 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
gulliver/system/class.g.php
View File

@@ -638,7 +638,7 @@ class G
* @param string $strSkin
* @return void
*/
public function RenderPage ($strTemplate = "default", $strSkin = SYS_SKIN, $objContent = null, $layout = '')
public static function RenderPage ($strTemplate = "default", $strSkin = SYS_SKIN, $objContent = null, $layout = '')
{
global $G_CONTENT;
global $G_TEMPLATE;
@@ -5701,7 +5701,7 @@ class G
*
* @return showRes($string)
*/
public function outRes ($sInfVar)
public static function outRes ($sInfVar)
{
echo $sInfVar;
}

2
gulliver/system/class.pmException.php
View File

@@ -20,7 +20,7 @@ class PMException extends Exception
return __CLASS__ . ": [{$this->code}]: {$this->message}\n";
}
public function registerErrorLog($error, $token){
public static function registerErrorLog($error, $token){
$ws = (defined("SYS_SYS"))? SYS_SYS : "Wokspace Undefined";
Bootstrap::registerMonolog('ExceptionCron', 400, $error->getMessage(), array('token'=>$token), $ws, 'processmaker.log');
}

16
gulliver/system/class.rbac.php
View File

@@ -149,14 +149,14 @@ class RBAC
'newSite.php' => array('PM_SETUP_ADVANCE')
),
'processCategory_Ajax.php' => array(
'processCategoryList' => array('PM_SETUP', 'PM_SETUP_ADVANCE'),
'updatePageSize' => array('PM_SETUP', 'PM_SETUP_ADVANCE'),
'checkCategoryName' => array('PM_SETUP', 'PM_SETUP_ADVANCE'),
'saveNewCategory' => array('PM_SETUP', 'PM_SETUP_ADVANCE'),
'checkEditCategoryName' => array('PM_SETUP', 'PM_SETUP_ADVANCE'),
'updateCategory' => array('PM_SETUP', 'PM_SETUP_ADVANCE'),
'canDeleteCategory' => array('PM_SETUP', 'PM_SETUP_ADVANCE'),
'deleteCategory' => array('PM_SETUP', 'PM_SETUP_ADVANCE')
'processCategoryList' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'updatePageSize' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'checkCategoryName' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'saveNewCategory' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'checkEditCategoryName' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'updateCategory' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'canDeleteCategory' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'deleteCategory' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES')
)
);
}

19
workflow/engine/methods/processCategory/processCategoryList.php
View File

@@ -21,17 +21,18 @@
* For more information, contact Colosa Inc, 2566 Le Jeune Rd.,
* Coral Gables, FL, 33134, USA, or email info@colosa.com.
*/
use ProcessMaker\Exception\RBACException;
/** @var RBAC $RBAC */
global $RBAC;
if ($RBAC->userCanAccess( 'PM_SETUP' ) != 1 && $RBAC->userCanAccess( 'PM_SETUP_ADVANCE' ) != 1) {
if ($RBAC->userCanAccess('PM_SETUP') != 1 && $RBAC->userCanAccess('PM_SETUP_PROCESS_CATEGORIES') != 1) {
throw new RBACException('ID_USER_HAVENT_RIGHTS_PAGE', -1);
}
$c = new Configurations();
$configPage = $c->getConfiguration( 'processCategoryList', 'pageSize', '', $_SESSION['USER_LOGGED'] );
$Config['pageSize'] = isset( $configPage['pageSize'] ) ? $configPage['pageSize'] : 20;
$configPage = $c->getConfiguration('processCategoryList', 'pageSize', '', $_SESSION['USER_LOGGED']);
$Config['pageSize'] = isset($configPage['pageSize']) ? $configPage['pageSize'] : 20;
$G_MAIN_MENU = 'workflow';
$G_SUB_MENU = 'processCategory';
@@ -40,9 +41,9 @@ $G_ID_SUB_MENU_SELECTED = '';
$G_PUBLISH = new Publisher();
$oHeadPublisher = & headPublisher::getSingleton();
$oHeadPublisher->addExtJsScript( 'processCategory/processCategoryList', false ); //adding a javascript file .js
$oHeadPublisher->addContent( 'processCategory/processCategoryList' ); //adding a html file .html.
$oHeadPublisher->assign( 'FORMATS', $c->getFormats() );
$oHeadPublisher->assign( 'CONFIG', $Config );
G::RenderPage( 'publish', 'extJs' );
$oHeadPublisher = &headPublisher::getSingleton();
$oHeadPublisher->addExtJsScript('processCategory/processCategoryList', false); //adding a javascript file .js
$oHeadPublisher->addContent('processCategory/processCategoryList'); //adding a html file .html.
$oHeadPublisher->assign('FORMATS', $c->getFormats());
$oHeadPublisher->assign('CONFIG', $Config);
G::RenderPage('publish', 'extJs');

135
workflow/engine/methods/processCategory/processCategory_Ajax.php
View File

@@ -36,158 +36,157 @@ switch ($RBAC->userCanAccess('PM_LOGIN')) {
}
$RBAC->allows(basename(__FILE__), $_REQUEST['action']);
if (isset( $_REQUEST['action'] )) {
if (isset($_REQUEST['action'])) {
switch ($_REQUEST['action']) {
case 'processCategoryList':
$co = new Configurations();
$config = $co->getConfiguration( 'processCategoryList', 'pageSize', '', $_SESSION['USER_LOGGED'] );
$limit_size = isset( $config['pageSize'] ) ? $config['pageSize'] : 20;
$config = $co->getConfiguration('processCategoryList', 'pageSize', '', $_SESSION['USER_LOGGED']);
$limit_size = isset($config['pageSize']) ? $config['pageSize'] : 20;
$start = isset( $_POST['start'] ) ? $_POST['start'] : 0;
$limit = isset( $_POST['limit'] ) ? $_POST['limit'] : $limit_size;
$filter = isset( $_REQUEST['textFilter'] ) ? $_REQUEST['textFilter'] : '';
$dir = isset( $_POST['dir'] ) ? $_POST['dir'] : 'ASC';
$sort = isset( $_POST['sort'] ) ? $_POST['sort'] : 'CATEGORY_NAME';
$start = isset($_POST['start']) ? $_POST['start'] : 0;
$limit = isset($_POST['limit']) ? $_POST['limit'] : $limit_size;
$filter = isset($_REQUEST['textFilter']) ? $_REQUEST['textFilter'] : '';
$dir = isset($_POST['dir']) ? $_POST['dir'] : 'ASC';
$sort = isset($_POST['sort']) ? $_POST['sort'] : 'CATEGORY_NAME';
$oCriteria = new Criteria( 'workflow' );
$oCriteria->addSelectColumn( 'COUNT(*) AS CNT' );
$oCriteria->add( ProcessCategoryPeer::CATEGORY_UID, '', Criteria::NOT_EQUAL );
$oCriteria = new Criteria('workflow');
$oCriteria->addSelectColumn('COUNT(*) AS CNT');
$oCriteria->add(ProcessCategoryPeer::CATEGORY_UID, '', Criteria::NOT_EQUAL);
if ($filter != '') {
$oCriteria->add( ProcessCategoryPeer::CATEGORY_NAME, '%' . $filter . '%', Criteria::LIKE );
$oCriteria->add(ProcessCategoryPeer::CATEGORY_NAME, '%' . $filter . '%', Criteria::LIKE);
}
$oDat = ProcessCategoryPeer::doSelectRS( $oCriteria );
$oDat->setFetchmode( ResultSet::FETCHMODE_ASSOC );
$oDat = ProcessCategoryPeer::doSelectRS($oCriteria);
$oDat->setFetchmode(ResultSet::FETCHMODE_ASSOC);
$oDat->next();
$row = $oDat->getRow();
$total_categories = $row['CNT'];
$oCriteria->clear();
$oCriteria->addSelectColumn( ProcessCategoryPeer::CATEGORY_UID );
$oCriteria->addSelectColumn( ProcessCategoryPeer::CATEGORY_NAME );
$oCriteria->add( ProcessCategoryPeer::CATEGORY_UID, '', Criteria::NOT_EQUAL );
$oCriteria->addSelectColumn(ProcessCategoryPeer::CATEGORY_UID);
$oCriteria->addSelectColumn(ProcessCategoryPeer::CATEGORY_NAME);
$oCriteria->add(ProcessCategoryPeer::CATEGORY_UID, '', Criteria::NOT_EQUAL);
if ($filter != '') {
$oCriteria->add( ProcessCategoryPeer::CATEGORY_NAME, '%' . $filter . '%', Criteria::LIKE );
$oCriteria->add(ProcessCategoryPeer::CATEGORY_NAME, '%' . $filter . '%', Criteria::LIKE);
}
//SQL Injection via 'sort' parameter
if (!in_array($sort, array_merge(ProcessCategoryPeer::getFieldNames(BasePeer::TYPE_FIELDNAME), ['TOTAL_PROCESSES']))) {
throw new Exception(G::LoadTranslation('ID_INVALID_VALUE_FOR', array('$sort')));
}
if ($dir == "DESC") {
$oCriteria->addDescendingOrderByColumn($sort);
} else {
$oCriteria->addAscendingOrderByColumn($sort);
}
$oCriteria->setLimit( $limit );
$oCriteria->setOffset( $start );
$oDataset = ProcessCategoryPeer::doSelectRS( $oCriteria );
$oDataset->setFetchmode( ResultSet::FETCHMODE_ASSOC );
$oCriteria->setLimit($limit);
$oCriteria->setOffset($start);
$oDataset = ProcessCategoryPeer::doSelectRS($oCriteria);
$oDataset->setFetchmode(ResultSet::FETCHMODE_ASSOC);
$proc = new Process();
$aProcess = $proc->getAllProcessesByCategory();
$result = "";
$aCat = array ();
$result = [];
$aCat = array();
while ($oDataset->next()) {
$aCat[] = $oDataset->getRow();
$index = sizeof( $aCat ) - 1;
$aCat[$index]['TOTAL_PROCESSES'] = isset( $aProcess[$aCat[$index]['CATEGORY_UID']] ) ? $aProcess[$aCat[$index]['CATEGORY_UID']] : 0;
$index = sizeof($aCat) - 1;
$aCat[$index]['TOTAL_PROCESSES'] = isset($aProcess[$aCat[$index]['CATEGORY_UID']]) ? $aProcess[$aCat[$index]['CATEGORY_UID']] : 0;
}
$result['data'] = $aCat;
$result['totalCount'] = $total_categories;
echo G::json_encode( $result );
echo G::json_encode($result);
break;
case 'updatePageSize':
$c = new Configurations();
$arr['pageSize'] = $_REQUEST['size'];
$arr['dateSave'] = date( 'Y-m-d H:i:s' );
$config = Array ();
$arr['dateSave'] = date('Y-m-d H:i:s');
$config = Array();
$config[] = $arr;
$c->aConfig = $config;
$c->saveConfig( 'processCategoryList', 'pageSize', '', $_SESSION['USER_LOGGED'] );
$c->saveConfig('processCategoryList', 'pageSize', '', $_SESSION['USER_LOGGED']);
echo '{success: true}';
break;
case 'checkCategoryName':
require_once 'classes/model/ProcessCategory.php';
$catName = $_REQUEST['cat_name'];
$oCriteria = new Criteria( 'workflow' );
$oCriteria->addSelectColumn( ProcessCategoryPeer::CATEGORY_NAME );
$oCriteria->add( ProcessCategoryPeer::CATEGORY_NAME, $catName );
$oDataset = ProcessCategoryPeer::doSelectRS( $oCriteria );
$oDataset->setFetchmode( ResultSet::FETCHMODE_ASSOC );
$oCriteria = new Criteria('workflow');
$oCriteria->addSelectColumn(ProcessCategoryPeer::CATEGORY_NAME);
$oCriteria->add(ProcessCategoryPeer::CATEGORY_NAME, $catName);
$oDataset = ProcessCategoryPeer::doSelectRS($oCriteria);
$oDataset->setFetchmode(ResultSet::FETCHMODE_ASSOC);
$oDataset->next();
$row = $oDataset->getRow();
$response = isset( $row['CATEGORY_NAME'] ) ? 'false' : 'true';
$response = isset($row['CATEGORY_NAME']) ? 'false' : 'true';
echo $response;
break;
case 'saveNewCategory':
try {
require_once 'classes/model/ProcessCategory.php';
$catName = trim( $_REQUEST['category'] );
$catName = trim($_REQUEST['category']);
$pcat = new ProcessCategory();
$pcat->setNew( true );
$pcat->setCategoryUid( G::GenerateUniqueID() );
$pcat->setCategoryName( $catName );
$pcat->setNew(true);
$pcat->setCategoryUid(G::GenerateUniqueID());
$pcat->setCategoryName($catName);
$pcat->save();
G::auditLog("CreateCategory", "Category Name: ".$catName);
G::auditLog("CreateCategory", "Category Name: " . $catName);
echo '{success: true}';
} catch (Exception $ex) {
$varEcho = '{success: false, error: ' . $ex->getMessage() . '}';
G::outRes( $varEcho );
G::outRes($varEcho);
}
break;
case 'checkEditCategoryName':
require_once 'classes/model/ProcessCategory.php';
$catUID = $_REQUEST['cat_uid'];
$catName = $_REQUEST['cat_name'];
$oCriteria = new Criteria( 'workflow' );
$oCriteria->addSelectColumn( ProcessCategoryPeer::CATEGORY_NAME );
$oCriteria->add( ProcessCategoryPeer::CATEGORY_NAME, $catName );
$oCriteria->add( ProcessCategoryPeer::CATEGORY_UID, $catUID, Criteria::NOT_EQUAL );
$oDataset = ProcessCategoryPeer::doSelectRS( $oCriteria );
$oDataset->setFetchmode( ResultSet::FETCHMODE_ASSOC );
$oCriteria = new Criteria('workflow');
$oCriteria->addSelectColumn(ProcessCategoryPeer::CATEGORY_NAME);
$oCriteria->add(ProcessCategoryPeer::CATEGORY_NAME, $catName);
$oCriteria->add(ProcessCategoryPeer::CATEGORY_UID, $catUID, Criteria::NOT_EQUAL);
$oDataset = ProcessCategoryPeer::doSelectRS($oCriteria);
$oDataset->setFetchmode(ResultSet::FETCHMODE_ASSOC);
$oDataset->next();
$row = $oDataset->getRow();
$response = isset( $row['CATEGORY_NAME'] ) ? 'false' : 'true';
$response = isset($row['CATEGORY_NAME']) ? 'false' : 'true';
echo $response;
break;
case 'updateCategory':
try {
require_once 'classes/model/ProcessCategory.php';
$catUID = $_REQUEST['cat_uid'];
$catName = trim( $_REQUEST['category'] );
$catName = trim($_REQUEST['category']);
$pcat = new ProcessCategory();
$pcat->setNew( false );
$pcat->setCategoryUid( $catUID );
$pcat->setCategoryName( $catName );
$pcat->setNew(false);
$pcat->setCategoryUid($catUID);
$pcat->setCategoryName($catName);
$pcat->save();
g::auditLog("UpdateCategory", "Category Name: ".$catName." Category ID: (".$catUID.") ");
g::auditLog("UpdateCategory", "Category Name: " . $catName . " Category ID: (" . $catUID . ") ");
echo '{success: true}';
} catch (Exception $ex) {
$varEcho = '{success: false, error: ' . $ex->getMessage() . '}';
G::outRes( $varEcho );
G::outRes($varEcho);
}
break;
case 'canDeleteCategory':
require_once 'classes/model/Process.php';
$proc = new Process();
$aProcess = $proc->getAllProcessesByCategory();
$catUID = $_REQUEST['CAT_UID'];
$response = isset( $aProcess[$catUID] ) ? 'false' : 'true';
$response = isset($aProcess[$catUID]) ? 'false' : 'true';
echo $response;
break;
case 'deleteCategory':
try {
require_once 'classes/model/ProcessCategory.php';
$catUID = $_REQUEST['cat_uid'];
$cat = new ProcessCategory();
$cat->setCategoryUid( $catUID );
$catName = $cat->loadByCategoryId( $catUID );
$cat->setCategoryUid($catUID);
$catName = $cat->loadByCategoryId($catUID);
$cat->delete();
G::auditLog("DeleteCategory", "Category Name: ".$catName." Category ID: (".$catUID.") ");
G::auditLog("DeleteCategory", "Category Name: " . $catName . " Category ID: (" . $catUID . ") ");
$varEcho = '{success: true}';
G::outRes( $varEcho );
G::outRes($varEcho);
} catch (Exception $ex) {
$token = strtotime("now");
PMException::registerErrorLog($ex, $token);
$resJson = '{success: false, error: ' . G::LoadTranslation("ID_EXCEPTION_LOG_INTERFAZ", array($token)) . '}';
G::outRes( $resJson );
G::outRes($resJson);
}
break;
default: