fernando/luos
1
0
Fork 0
Code Releases Activity

Merge remote-tracking branch 'origin/feature/HOR-3559' into bugfix/HOR-3633-C

Browse Source
This commit is contained in:
hjonathan
2017-08-09 10:32:34 -04:00
parent 6991839309 158a3c05a3
commit 6b42d59c2b
12 changed files with 814 additions and 667 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
gulliver/system/class.g.php
View File

@@ -638,7 +638,7 @@ class G
* @param string $strSkin
* @return void
*/
public function RenderPage ($strTemplate = "default", $strSkin = SYS_SKIN, $objContent = null, $layout = '')
public static function RenderPage ($strTemplate = "default", $strSkin = SYS_SKIN, $objContent = null, $layout = '')
{
global $G_CONTENT;
global $G_TEMPLATE;
@@ -1989,7 +1989,7 @@ class G
*
* @return void
*/
public function SendTemporalMessage ($msgID, $strType, $sType = 'LABEL', $time = null, $width = null, $customLabels = null)
public static function SendTemporalMessage ($msgID, $strType, $sType = 'LABEL', $time = null, $width = null, $customLabels = null)
{
if (isset( $width )) {
$_SESSION['G_MESSAGE_WIDTH'] = $width;
@@ -5736,7 +5736,7 @@ class G
*
* @return showRes($string)
*/
public function outRes ($sInfVar)
public static function outRes ($sInfVar)
{
echo $sInfVar;
}

2
gulliver/system/class.pmException.php
View File

@@ -20,7 +20,7 @@ class PMException extends Exception
return __CLASS__ . ": [{$this->code}]: {$this->message}\n";
}
public function registerErrorLog($error, $token){
public static function registerErrorLog($error, $token){
$ws = (defined("SYS_SYS"))? SYS_SYS : "Wokspace Undefined";
Bootstrap::registerMonolog('ExceptionCron', 400, $error->getMessage(), array('token'=>$token), $ws, 'processmaker.log');
}

21
gulliver/system/class.rbac.php
View File

@@ -25,6 +25,9 @@
* Coral Gables, FL, 33134, USA, or email info@colosa.com.
*
*/
use ProcessMaker\Exception\RBACException;
/**
* File: $Id$
*
@@ -148,8 +151,21 @@ class RBAC
),
'newSite.php' => array(
'newSite.php' => array('PM_SETUP_ADVANCE')
),
'emailsAjax.php' => array(
'MessageList' => array('PM_SETUP', 'PM_SETUP_LOGS'),
'updateStatusMessage' => array('PM_SETUP', 'PM_SETUP_LOGS'),
),
'processCategory_Ajax.php' => array(
'processCategoryList' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'updatePageSize' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'checkCategoryName' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'saveNewCategory' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'checkEditCategoryName' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'updateCategory' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'canDeleteCategory' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES'),
'deleteCategory' => array('PM_SETUP', 'PM_SETUP_PROCESS_CATEGORIES')
)
);
}
@@ -1546,8 +1562,7 @@ class RBAC
}
if (!$access) {
G::header('Location: /errors/error403.php');
die();
throw new RBACException('ID_ACCESS_DENIED', 403);
}
}
}

53
workflow/engine/classes/model/ListParticipatedLast.php
View File

@@ -49,19 +49,24 @@ class ListParticipatedLast extends BaseListParticipatedLast
$data['DEL_CURRENT_USR_FIRSTNAME'] = $aRow['USR_FIRSTNAME'];
$data['DEL_CURRENT_USR_LASTNAME'] = $aRow['USR_LASTNAME'];
$data['DEL_CURRENT_TAS_TITLE'] = $data['APP_TAS_TITLE'];
$currentInformation = array(
'DEL_CURRENT_USR_USERNAME' => $data['DEL_CURRENT_USR_USERNAME'],
'DEL_CURRENT_USR_FIRSTNAME' => $data['DEL_CURRENT_USR_FIRSTNAME'],
'DEL_CURRENT_USR_LASTNAME' => $data['DEL_CURRENT_USR_LASTNAME'],
'DEL_CURRENT_TAS_TITLE' => $data['APP_TAS_TITLE']
);
}
} else {
$getData['USR_UID'] = $data['USR_UID_CURRENT'];
$getData['APP_UID'] = $data['APP_UID'];
$row = $this->getRowFromList($getData);
if (is_array($row) && sizeof($row)) {
$set = array(
$currentInformation = array(
'DEL_CURRENT_USR_USERNAME' => '',
'DEL_CURRENT_USR_FIRSTNAME' => '',
'DEL_CURRENT_USR_LASTNAME' => '',
'APP_TAS_TITLE' => $data['APP_TAS_TITLE'],
'DEL_CURRENT_TAS_TITLE' => $data['APP_TAS_TITLE'], );
$this->updateCurrentUser($row, $set);
'DEL_CURRENT_TAS_TITLE' => $data['APP_TAS_TITLE']
);
}
}
@@ -84,6 +89,9 @@ class ListParticipatedLast extends BaseListParticipatedLast
if (!empty($data['APP_STATUS'])) {
$data['APP_STATUS_ID'] = Application::$app_status_values[$data['APP_STATUS']];
}
//We will update the current information
$this->updateCurrentInfoByAppUid($data['APP_UID'], $currentInformation);
$con = Propel::getConnection(ListParticipatedLastPeer::DATABASE_NAME);
try {
$this->fromArray($data, BasePeer::TYPE_FIELDNAME);
@@ -103,6 +111,27 @@ class ListParticipatedLast extends BaseListParticipatedLast
}
}
/**
* This function update the row related to the appUid with the current information
* @param string $appUid
* @param array $currentInformation
* @return void
*/
private function updateCurrentInfoByAppUid($appUid, $currentInformation)
{
//Update - WHERE
$criteriaWhere = new Criteria('workflow');
$criteriaWhere->add(ListParticipatedLastPeer::APP_UID, $appUid, Criteria::EQUAL);
//Update - SET
$criteriaSet = new Criteria('workflow');
$criteriaSet->add(ListParticipatedLastPeer::DEL_CURRENT_USR_USERNAME, $currentInformation['DEL_CURRENT_USR_USERNAME']);
$criteriaSet->add(ListParticipatedLastPeer::DEL_CURRENT_USR_FIRSTNAME, $currentInformation['DEL_CURRENT_USR_FIRSTNAME']);
$criteriaSet->add(ListParticipatedLastPeer::DEL_CURRENT_USR_LASTNAME, $currentInformation['DEL_CURRENT_USR_LASTNAME']);
$criteriaSet->add(ListParticipatedLastPeer::DEL_CURRENT_TAS_TITLE, $currentInformation['DEL_CURRENT_TAS_TITLE']);
BasePeer::doUpdate($criteriaWhere, $criteriaSet, Propel::getConnection('workflow'));
}
/**
* Update List Participated History Table.
*
@@ -448,22 +477,6 @@ class ListParticipatedLast extends BaseListParticipatedLast
return false;
}
public function updateCurrentUser($where, $set)
{
$con = Propel::getConnection('workflow');
//Update - WHERE
$criteriaWhere = new Criteria('workflow');
$criteriaWhere->add(ListParticipatedLastPeer::APP_UID, $where['APP_UID'], Criteria::EQUAL);
$criteriaWhere->add(ListParticipatedLastPeer::USR_UID, $where['USR_UID'], Criteria::EQUAL);
$criteriaWhere->add(ListParticipatedLastPeer::DEL_INDEX, $where['DEL_INDEX'], Criteria::EQUAL);
//Update - SET
$criteriaSet = new Criteria('workflow');
foreach ($set as $k => $v) {
eval('$criteriaSet->add( ListParticipatedLastPeer::'.$k.',$v, Criteria::EQUAL);');
}
BasePeer::doUpdate($criteriaWhere, $criteriaSet, $con);
}
/**
* Returns the number of cases of a user.
*

32
workflow/engine/controllers/pmTables.php
View File

@@ -152,6 +152,11 @@ class pmTables extends Controller
$sFileName = $httpData->f;
$realPath = $PUBLIC_ROOT_PATH . $sFileName;
if ($this->isValidFileToBeStreamed($sFileName) === false) {
throw new Exception("You are trying to access an unauthorized resource.");
}
G::streamFile( $realPath, true );
unlink( $realPath );
}
@@ -206,5 +211,32 @@ class pmTables extends Controller
$tableSize = $tableSize - 8; // Prefix PMT_
return $tableSize;
}
/**
* Validates if the file with the $fileName is a valid one,
* that is, it must be a file without relative references that
* can open a door to get some unauthorized system file and
* must have one of the valid file extensions.
*
* @param $fileName, emporal file name that will be streamed
* @return bool
*/
private function isValidFileToBeStreamed($fileName)
{
$result = true;
$validExtensionsForExporting = ['csv', 'pmt'];
$pathInfo = pathinfo($fileName);
if ($pathInfo['dirname'] !== '.') {
$result = false;
}
if (!in_array($pathInfo['extension'], $validExtensionsForExporting)) {
$result = false;
}
return $result;
}
}

17
workflow/engine/methods/login/login.php
View File

@@ -33,11 +33,24 @@ if ($browserSupported==false){
/*----------------------------------********---------------------------------*/
$aFields = array();
if (!isset($_GET['u'])) {
//Validated redirect url
$aFields['URL'] = '';
} else {
if (!empty($_GET['u'])) {
//clean url with protocols
$flagUrl = true;
//Most used protocols
$protocols = ['https://', 'http://', 'ftp://', 'sftp://','smb://', 'file:', 'mailto:'];
foreach ($protocols as $protocol) {
if (strpos($_GET['u'], $protocol) !== false) {
$_GET['u'] = '';
$flagUrl = false;
break;
}
}
if ($flagUrl) {
$aFields['URL'] = htmlspecialchars(addslashes(stripslashes(strip_tags(trim(urldecode($_GET['u']))))));
}
}
if (!isset($_SESSION['G_MESSAGE'])) {
$_SESSION['G_MESSAGE'] = '';

23
workflow/engine/methods/mails/emailsAjax.php
View File

@@ -1,10 +1,20 @@
<?php
$req = (isset($_POST['request']))? $_POST['request']:((isset($_REQUEST['request']))? $_REQUEST['request'] : 'No hayyy tal');
require_once 'classes/model/Content.php';
require_once 'classes/model/AppMessage.php';
require_once 'classes/model/AppDelegation.php';
require_once 'classes/model/Application.php';
use ProcessMaker\Exception\RBACException;
$req = (isset($_REQUEST['request']) ? $_REQUEST['request'] : '');
/** @var RBAC $RBAC */
global $RBAC;
switch ($RBAC->userCanAccess('PM_LOGIN')) {
case -2:
throw new RBACException('ID_USER_HAVENT_RIGHTS_SYSTEM', -2);
break;
case -1:
throw new RBACException('ID_USER_HAVENT_RIGHTS_PAGE', -1);
break;
}
$RBAC->allows(basename(__FILE__), $req);
switch ($req) {
case 'MessageList':
@@ -163,6 +173,9 @@ switch($req){
}
if ($sort != '') {
if (!in_array($sort, AppMessagePeer::getFieldNames(BasePeer::TYPE_FIELDNAME))) {
throw new Exception(G::LoadTranslation('ID_INVALID_VALUE_FOR', array('$sort')));
}
if ($dir == 'ASC') {
$criteria->addAscendingOrderByColumn($sort);
} else {

10
workflow/engine/methods/processCategory/processCategoryList.php
View File

@@ -21,9 +21,13 @@
* For more information, contact Colosa Inc, 2566 Le Jeune Rd.,
* Coral Gables, FL, 33134, USA, or email info@colosa.com.
*/
if ($RBAC->userCanAccess( 'PM_SETUP' ) != 1 && $RBAC->userCanAccess( 'PM_SETUP_ADVANCE' ) != 1) {
G::SendTemporalMessage( 'krlos', 'error', 'labels' );
die();
use ProcessMaker\Exception\RBACException;
/** @var RBAC $RBAC */
global $RBAC;
if ($RBAC->userCanAccess('PM_SETUP') != 1 && $RBAC->userCanAccess('PM_SETUP_PROCESS_CATEGORIES') != 1) {
throw new RBACException('ID_USER_HAVENT_RIGHTS_PAGE', -1);
}
$c = new Configurations();

27
workflow/engine/methods/processCategory/processCategory_Ajax.php
View File

@@ -22,6 +22,20 @@
* Coral Gables, FL, 33134, USA, or email info@colosa.com.
*/
use ProcessMaker\Exception\RBACException;
/** @var RBAC $RBAC */
global $RBAC;
switch ($RBAC->userCanAccess('PM_LOGIN')) {
case -2:
throw new RBACException('ID_USER_HAVENT_RIGHTS_SYSTEM', -2);
break;
case -1:
throw new RBACException('ID_USER_HAVENT_RIGHTS_PAGE', -1);
break;
}
$RBAC->allows(basename(__FILE__), $_REQUEST['action']);
if (isset($_REQUEST['action'])) {
switch ($_REQUEST['action']) {
case 'processCategoryList':
@@ -55,6 +69,11 @@ if (isset( $_REQUEST['action'] )) {
$oCriteria->add(ProcessCategoryPeer::CATEGORY_NAME, '%' . $filter . '%', Criteria::LIKE);
}
//SQL Injection via 'sort' parameter
if (!in_array($sort, array_merge(ProcessCategoryPeer::getFieldNames(BasePeer::TYPE_FIELDNAME), ['TOTAL_PROCESSES']))) {
throw new Exception(G::LoadTranslation('ID_INVALID_VALUE_FOR', array('$sort')));
}
if ($dir == "DESC") {
$oCriteria->addDescendingOrderByColumn($sort);
} else {
@@ -68,7 +87,7 @@ if (isset( $_REQUEST['action'] )) {
$proc = new Process();
$aProcess = $proc->getAllProcessesByCategory();
$result = "";
$result = [];
$aCat = array();
while ($oDataset->next()) {
$aCat[] = $oDataset->getRow();
@@ -90,7 +109,6 @@ if (isset( $_REQUEST['action'] )) {
echo '{success: true}';
break;
case 'checkCategoryName':
require_once 'classes/model/ProcessCategory.php';
$catName = $_REQUEST['cat_name'];
$oCriteria = new Criteria('workflow');
$oCriteria->addSelectColumn(ProcessCategoryPeer::CATEGORY_NAME);
@@ -104,7 +122,6 @@ if (isset( $_REQUEST['action'] )) {
break;
case 'saveNewCategory':
try {
require_once 'classes/model/ProcessCategory.php';
$catName = trim($_REQUEST['category']);
$pcat = new ProcessCategory();
$pcat->setNew(true);
@@ -119,7 +136,6 @@ if (isset( $_REQUEST['action'] )) {
}
break;
case 'checkEditCategoryName':
require_once 'classes/model/ProcessCategory.php';
$catUID = $_REQUEST['cat_uid'];
$catName = $_REQUEST['cat_name'];
$oCriteria = new Criteria('workflow');
@@ -135,7 +151,6 @@ if (isset( $_REQUEST['action'] )) {
break;
case 'updateCategory':
try {
require_once 'classes/model/ProcessCategory.php';
$catUID = $_REQUEST['cat_uid'];
$catName = trim($_REQUEST['category']);
$pcat = new ProcessCategory();
@@ -151,7 +166,6 @@ if (isset( $_REQUEST['action'] )) {
}
break;
case 'canDeleteCategory':
require_once 'classes/model/Process.php';
$proc = new Process();
$aProcess = $proc->getAllProcessesByCategory();
$catUID = $_REQUEST['CAT_UID'];
@@ -160,7 +174,6 @@ if (isset( $_REQUEST['action'] )) {
break;
case 'deleteCategory':
try {
require_once 'classes/model/ProcessCategory.php';
$catUID = $_REQUEST['cat_uid'];
$cat = new ProcessCategory();
$cat->setCategoryUid($catUID);

649
workflow/engine/src/ProcessMaker/BusinessModel/User.php
View File

File diff suppressed because it is too large Load Diff

59
workflow/engine/src/ProcessMaker/Exception/RBACException.php Normal file
View File

@@ -0,0 +1,59 @@
<?php
namespace ProcessMaker\Exception;
use G;
/**
* Class PMException
* @package ProcessMaker\Exception
*/
class RBACException extends \Exception
{
const PM_LOGIN = '../login/login';
const PM_403 = '/errors/error403.php';
/**
* RBACException constructor.
* @param string $message
* @param null $code
*/
public function __construct($message, $code=NULL)
{
parent::__construct($message, $code);
}
/**
* Displays the entire exception as a string
* @return string
*/
public function __toString()
{
switch ($this->getCode()) {
case -1:
G::SendTemporalMessage($this->getMessage(), 'error', 'labels');
$message = self::PM_LOGIN;
break;
case -2:
G::SendTemporalMessage($this->getMessage(), 'error', 'labels');
$message = self::PM_LOGIN;
break;
case 403:
$message = self::PM_403;
break;
default:
$message = self::PM_LOGIN;
break;
}
return $message;
}
/**
* Returns the path to which to redirect
* @return $this
*/
public function getPath()
{
return $this;
}
}

2
workflow/public_html/app.php
View File

@@ -53,6 +53,8 @@ try {
break;
}
} catch (ProcessMaker\Exception\RBACException $e) {
G::header('location: ' . $e->getPath());
} catch (Exception $e) {
$view = new Maveriks\Pattern\Mvc\PhtmlView($rootDir . "framework/src/templates/Exception.phtml");
$view->set("message", $e->getMessage());