Merged in develop (pull request #5762)

Develop

Approved-by: Paula Quispe <paula.quispe@processmaker.com>

gulliver/system/class.menu.php

@@ -283,7 +283,7 @@ class Menu
      */
     public function DisableOptionId($id)
     {
-        if (array_search($id, $this->Id)) {
+        if (array_search($id, $this->Id) !== FALSE) {
             $this->Enabled[array_search($id, $this->Id)] = 0;
         }
     }

gulliver/system/class.rbac.php

@@ -70,9 +70,66 @@ class RBAC
     public $singleSignOn = false;
 
     private static $instance = null;
+    public $authorizedActions = array();
 
     public function __construct ()
     {
+        $this->authorizedActions = array(
+            'users_Ajax.php' => array(
+                'availableUsers' => array('PM_FACTORY'),
+                'assign' => array('PM_FACTORY'),
+                'changeView' => array(),
+                'ofToAssign' => array('PM_FACTORY'),
+                'usersGroup' => array('PM_FACTORY'),
+                'canDeleteUser' => array('PM_USERS'),
+                'deleteUser' => array('PM_USERS'),
+                'changeUserStatus' => array('PM_USERS'),
+                'availableGroups' => array('PM_USERS'),
+                'assignedGroups' => array('PM_USERS'),
+                'assignGroupsToUserMultiple' => array('PM_USERS'),
+                'deleteGroupsToUserMultiple' => array('PM_USERS'),
+                'authSources' => array('PM_USERS'),
+                'loadAuthSourceByUID' => array('PM_USERS'),
+                'updateAuthServices' => array('PM_USERS'),
+                'usersList' => array('PM_USERS'),
+                'updatePageSize' => array(),
+                'summaryUserData' => array('PM_USERS'),
+                'verifyIfUserAssignedAsSupervisor' => array('PM_USERS')
+            ),
+            'skin_Ajax.php' => array(
+                'updatePageSize' => array(),
+                'skinList' => array('PM_SETUP_SKIN'),
+                'newSkin' => array('PM_SETUP_SKIN'),
+                'importSkin' => array('PM_SETUP_SKIN'),
+                'exportSkin' => array('PM_SETUP_SKIN'),
+                'deleteSkin' => array('PM_SETUP_SKIN'),
+                'addTarFolder' => array('PM_SETUP_SKIN'),
+                'copy_skin_folder' => array('PM_SETUP_SKIN'),
+                'deleteSkin' => array('PM_SETUP_SKIN')
+            ),
+            'processes_DownloadFile.php' => array(
+                'downloadFileHash' => array('PM_FACTORY')
+            ),
+            'processProxy.php' => array(
+                'categoriesList' => array(),
+                'getCategoriesList' => array(),
+                'saveProcess' => array('PM_FACTORY'),
+                'changeStatus' => array(),
+                'changeDebugMode' => array(),
+                'getUsers' => array(),
+                'getGroups' => array(),
+                'assignActorsTask' => array(),
+                'removeActorsTask' => array(),
+                'getActorsTask' => array(),
+                'getProcessDetail' => array(),
+                'getProperties' => array(),
+                'saveProperties' => array(),
+                'getCaledarList' => array(),
+                'getPMVariables' => array(),
+                'generateBpmn' => array()
+            )
+
+        );
     }
 
     /**
@@ -1445,5 +1502,36 @@ class RBAC
             }
         }
     }
+    /**
+     * This function verify if the user allows to the file with a specific action
+     * If the action is not defined in the authorizedActions we give the allow
+     * @param string $file
+     * @param string $action
+     *
+     * @return void
+     */
+    public function allows($file, $action)
+    {
+        $access = false;
+        if (isset($this->authorizedActions[$file][$action])) {
+            $permissions = $this->authorizedActions[$file][$action];
+            $totalPermissions = count($permissions);
+            $countAccess = 0;
+            foreach ($permissions as $key => $value) {
+                if ($this->userCanAccess($value) == 1) {
+                    $countAccess++;
+                }
+            }
+            //Check if the user has all permissions that needed
+            if ($countAccess == $totalPermissions) {
+                $access = true;
+            }
+        }
+
+        if (!$access) {
+            G::header('Location: /errors/error403.php');
+            die();
+        }
+    }
 }
 

workflow/engine/classes/class.AppSolr.php

@@ -2915,13 +2915,14 @@ class AppSolr
     private function getCurrentTraceInfo()
     {
         $resultTraceString = "";
-
-    //
         $traceData = debug_backtrace();
         foreach ($traceData as $key => $value) {
-      if($value['function'] != 'getCurrentTraceInfo' && $value['function'] != 'require_once')
+            if ($value['function'] != 'getCurrentTraceInfo' && $value['function'] != 'require_once') {
+                if (isset($value['file']) && isset($value['line']) && isset($value['function'])) {
                     $resultTraceString .= $value['file'] . " (" . $value['line'] . ") " . $value['function'] . "\n";
                 }
+            }
+        }
         return $resultTraceString;
     }
 

workflow/engine/classes/class.case.php

@@ -1152,8 +1152,10 @@ class Cases
             //Logger deleteCase
             $nameFiles = '';
             foreach (debug_backtrace() as $node) {
+                if (isset($node['file']) && isset($node['function']) && isset($node['line'])) {
                     $nameFiles .= $node['file'] . ":" . $node['function'] . "(" . $node['line'] . ")\n";
                 }
+            }
             $dataLog = \Bootstrap::getDefaultContextLog();
             $dataLog['usrUid'] = isset($_SESSION['USER_LOGGED']) ? $_SESSION['USER_LOGGED'] : G::LoadTranslation('UID_UNDEFINED_USER');
             $dataLog['appUid'] = $sAppUid;
@@ -3348,7 +3350,7 @@ class Cases
      * @return integer
      */
 
-    public function getCurrentDelegation($sApplicationUID = '', $sUserUID = '')
+    public function getCurrentDelegation($sApplicationUID = '', $sUserUID = '', $onlyOpenThreads = false)
     {
         $oCriteria = new Criteria();
         $oCriteria->add(AppDelegationPeer::APP_UID, $sApplicationUID);
@@ -3363,12 +3365,15 @@ class Cases
         //if the user is not in the task, we need to return a valid del index, so we are returning the latest delindex
         $oCriteria = new Criteria();
         $oCriteria->add(AppDelegationPeer::APP_UID, $sApplicationUID);
+        if ($onlyOpenThreads) {
+            $oCriteria->add(AppDelegationPeer::DEL_THREAD_STATUS, 'OPEN');
+        }
         $oCriteria->addDescendingOrderByColumn(AppDelegationPeer::DEL_DELEGATE_DATE);
         $oApplication = AppDelegationPeer::doSelectOne($oCriteria);
         if (!is_null($oApplication)) {
             return $oApplication->getDelIndex();
         }
-        throw ( new Exception('this case has 0 delegations') );
+        throw ( new Exception('This case has 0 current delegations') );
     }
 
     /*

workflow/engine/classes/class.pmDynaform.php

@@ -1357,7 +1357,7 @@ class pmDynaform
                 "var sysLang = '" . SYS_LANG . "';\n" .
                 "var isRTL = " . $this->isRTL . ";\n" .
                 "var pathRTLCss = '" . $this->pathRTLCss . "';\n" .
-                "var delIndex = " . (isset($this->fields["DEL_INDEX"]) ? $this->fields["DEL_INDEX"] : "0") . ";\n" .
+                "var delIndex = " . (isset($this->fields["DEL_INDEX"]) ? G::decrypt($this->fields["DEL_INDEX"], URL_KEY) : "0") . ";\n" .
                 "var leaveCaseWarning = " . $this->getLeaveCaseWarning() . ";\n" .
                 "</script>\n" .
                 "<script type='text/javascript' src='/jscore/cases/core/pmDynaform.js'></script>\n" .

workflow/engine/classes/class.pmTable.php

@@ -54,6 +54,7 @@ class PmTable
     private $db;
     private $alterTable = true;
     private $keepData = false;
+    public $tableClassName = '';
 
     public function __construct ($tableName = null)
     {
@@ -955,6 +956,7 @@ class PmTable
 
             $additionalTable = AdditionalTablesPeer::retrieveByPK($additionalTableUid);
             $tableName = $additionalTable->getAddTabName();
+            $this->tableClassName = $additionalTable->getAddTabClassName();
 
             $additionalTable = new AdditionalTables();
             $tableData = $additionalTable->load($additionalTableUid, true);
@@ -990,9 +992,13 @@ class PmTable
                     $listTablePeer = 'ListInboxPeer';
                     break;
             }
-            
+            //Some PM tables don’t have the APP NUMBER column; but if exists, we must use it
+            if (in_array($tableName.'.APP_NUMBER', $oCriteria->getSelectColumns())) {
+                $oCriteria->addJoin($listTablePeer::APP_NUMBER, $tableName.'.APP_NUMBER', Criteria::LEFT_JOIN);
+            } else {
                 $oCriteria->addJoin($listTablePeer::APP_UID, $tableName.'.APP_UID', Criteria::LEFT_JOIN);
             }
+        }
         return $oCriteria;
     }
 }

workflow/engine/classes/model/ListInbox.php

@@ -16,7 +16,8 @@ require_once 'classes/model/om/BaseListInbox.php';
 // @codingStandardsIgnoreStart
 class ListInbox extends BaseListInbox
 {
-    // @codingStandardsIgnoreEnd
+    private $additionalClassName = '';
+
     /**
      * Create List Inbox Table
      *
@@ -384,17 +385,25 @@ class ListInbox extends BaseListInbox
         self::create($data, $isSelfService);
     }
 
-    public function loadFilters(&$criteria, $filters)
+    /**
+     * This function add restriction in the query related to the filters
+     * @param Criteria $criteria, must be contain only select of columns
+     * @param array $filters
+     * @param array $additionalColumns information about the new columns related to custom cases list
+     * @throws PropelException
+     */
+    public function loadFilters(&$criteria, $filters, $additionalColumns = array())
     {
-        $action         = isset($filters['action']) ? $filters['action'] : "";
+        $action = isset($filters['action']) ? $filters['action'] : '';
-        $usrUid         = isset($filters['usr_uid']) ? $filters['usr_uid'] : "";
+        $usrUid = isset($filters['usr_uid']) ? $filters['usr_uid'] : '';
-        $filter         = isset($filters['filter']) ? $filters['filter'] : "";
+        $filter = isset($filters['filter']) ? $filters['filter'] : '';
-        $search         = isset($filters['search']) ? $filters['search'] : "";
+        $search = isset($filters['search']) ? $filters['search'] : '';
-        $process        = isset($filters['process']) ? $filters['process'] : "";
+        $caseLink = isset($filters['caseLink']) ? $filters['caseLink'] : '';
-        $category       = isset($filters['category']) ? $filters['category'] : "";
+        $process = isset($filters['process']) ? $filters['process'] : '';
-        $dateFrom       = isset($filters['dateFrom']) ? $filters['dateFrom'] : "";
+        $category = isset($filters['category']) ? $filters['category'] : '';
-        $dateTo         = isset($filters['dateTo']) ? $filters['dateTo'] : "";
+        $dateFrom = isset($filters['dateFrom']) ? $filters['dateFrom'] : '';
-        $filterStatus   = isset($filters['filterStatus']) ? $filters['filterStatus'] : "";
+        $dateTo = isset($filters['dateTo']) ? $filters['dateTo'] : '';
+        $filterStatus = isset($filters['filterStatus']) ? $filters['filterStatus'] : '';
         $newestthan = isset($filters['newestthan']) ? $filters['newestthan'] : '';
         $oldestthan = isset($filters['oldestthan']) ? $filters['oldestthan'] : '';
 
@@ -463,21 +472,14 @@ class ListInbox extends BaseListInbox
 
         //Filter Search
         if ($search != '') {
-            $criteria->add(
+            //Check if we need to search to the APP_UID
-                $criteria->getNewCriterion(ListInboxPeer::APP_TITLE, '%' . $search . '%', Criteria::LIKE)
+            if (!empty($caseLink)) {
-                ->addOr(
+                $criteria->add(ListInboxPeer::APP_UID, $search, Criteria::EQUAL);
-                    $criteria->getNewCriterion(ListInboxPeer::APP_TAS_TITLE, '%' . $search . '%', Criteria::LIKE)
+            } else {
-                    ->addOr(
+                //If we have additional tables configured in the custom cases list, prepare the variables for search
-                        $criteria->getNewCriterion(ListInboxPeer::APP_PRO_TITLE, '%' . $search . '%', Criteria::LIKE)
+                $casesList = new \ProcessMaker\BusinessModel\Cases();
-                        ->addOr(
+                $casesList->getSearchCriteriaListCases($criteria, __CLASS__ . 'Peer', $search, $this->additionalClassName, $additionalColumns);
-                            $criteria->getNewCriterion(ListInboxPeer::APP_UID, $search, Criteria::EQUAL)
+            }
-                            ->addOr(
-                                $criteria->getNewCriterion(ListInboxPeer::APP_NUMBER, $search, Criteria::EQUAL)
-                            )
-                        )
-                    )
-                )
-            );
         }
 
         //Filter Process Id
@@ -504,17 +506,20 @@ class ListInbox extends BaseListInbox
     }
 
     /**
-     * @param $usr_uid
+     * This function get the information in the corresponding cases list
-     * @param array $filters
+     * @param string $usr_uid, must be show cases related to this user
+     * @param array $filters for apply in the result
      * @param null $callbackRecord
-     * @return array
+     * @return array $data
      * @throws PropelException
      */
     public function loadList($usr_uid, $filters = array(), $callbackRecord = null)
     {
         $pmTable = new PmTable();
-        $criteria = $pmTable->addPMFieldsToList('todo');
+        $list = isset($filters['action']) ? $filters['action'] : "";
-
+        $criteria = $pmTable->addPMFieldsToList($list);
+        $this->additionalClassName = $pmTable->tableClassName;
+        $additionalColumns = $criteria->getSelectColumns();
         $filters['usr_uid'] = $usr_uid;
 
         $criteria->addSelectColumn(ListInboxPeer::APP_UID);
@@ -542,7 +547,7 @@ class ListInbox extends BaseListInbox
         $criteria->addSelectColumn(UsersPeer::USR_LASTNAME);
         $criteria->addSelectColumn(UsersPeer::USR_USERNAME);
         $criteria->addJoin(ListInboxPeer::USR_UID, UsersPeer::USR_UID, Criteria::LEFT_JOIN);
-        self::loadFilters($criteria, $filters);
+        self::loadFilters($criteria, $filters, $additionalColumns);
 
         $sort  = (!empty($filters['sort'])) ?
             ListInboxPeer::TABLE_NAME.'.'.$filters['sort'] :

workflow/engine/classes/model/ListParticipatedLast.php

@@ -14,7 +14,8 @@ require_once 'classes/model/om/BaseListParticipatedLast.php';
  */
 class ListParticipatedLast extends BaseListParticipatedLast
 {
-    // @codingStandardsIgnoreEnd
+    private $additionalClassName = '';
+
     /**
      * Create List Participated History Table.
      *
@@ -234,10 +235,18 @@ class ListParticipatedLast extends BaseListParticipatedLast
         }
     }
 
-    public function loadFilters(&$criteria, $filters)
+    /**
+     * This function add restriction in the query related to the filters
+     * @param Criteria $criteria, must be contain only select of columns
+     * @param array $filters
+     * @param array $additionalColumns information about the new columns related to custom cases list
+     * @throws PropelException
+     */
+    public function loadFilters(&$criteria, $filters, $additionalColumns = array())
     {
         $filter = isset($filters['filter']) ? $filters['filter'] : '';
         $search = isset($filters['search']) ? $filters['search'] : '';
+        $caseLink = isset($filters['caseLink']) ? $filters['caseLink'] : '';
         $process = isset($filters['process']) ? $filters['process'] : '';
         $category = isset($filters['category']) ? $filters['category'] : '';
         $dateFrom = isset($filters['dateFrom']) ? $filters['dateFrom'] : '';
@@ -271,25 +280,24 @@ class ListParticipatedLast extends BaseListParticipatedLast
                 break;
         }
 
+        //Filter Search
         if ($search != '') {
-            $criteria->add(
+            //Check if we need to search to the APP_UID
-                $criteria->getNewCriterion(ListParticipatedLastPeer::APP_TITLE, '%'.$search.'%', Criteria::LIKE)
+            if (!empty($caseLink)) {
-                ->addOr(
+                $criteria->add(ListParticipatedLastPeer::APP_UID, $search, Criteria::EQUAL);
-                    $criteria->getNewCriterion(ListParticipatedLastPeer::APP_TAS_TITLE, '%'.$search.'%', Criteria::LIKE)
+            } else {
-                    ->addOr(
+                //If we have additional tables configured in the custom cases list, prepare the variables for search
-                        $criteria->getNewCriterion(ListParticipatedLastPeer::APP_UID, $search, Criteria::EQUAL)
+                $casesList = new \ProcessMaker\BusinessModel\Cases();
-                        ->addOr(
+                $casesList->getSearchCriteriaListCases($criteria, __CLASS__ . 'Peer', $search, $this->additionalClassName, $additionalColumns);
-                            $criteria->getNewCriterion(ListParticipatedLastPeer::APP_NUMBER, $search, Criteria::EQUAL)
+            }
-                        )
-                    )
-                )
-            );
         }
 
+        //Filter Process Id
         if ($process != '') {
             $criteria->add(ListParticipatedLastPeer::PRO_UID, $process, Criteria::EQUAL);
         }
 
+        //Filter Category
         if ($category != '') {
             $criteria->addSelectColumn(ProcessPeer::PRO_CATEGORY);
             $aConditions = array();
@@ -308,10 +316,21 @@ class ListParticipatedLast extends BaseListParticipatedLast
         }
     }
 
+    /**
+     * This function get the information in the corresponding cases list
+     * @param string $usr_uid, must be show cases related to this user
+     * @param array $filters for apply in the result
+     * @param null $callbackRecord
+     * @param string $appUid related to the specific case
+     * @return array $data
+     * @throws PropelException
+     */
     public function loadList($usr_uid, $filters = array(), $callbackRecord = null, $appUid = '')
     {
         $pmTable = new PmTable();
         $criteria = $pmTable->addPMFieldsToList('sent');
+        $this->additionalClassName = $pmTable->tableClassName;
+        $additionalColumns = $criteria->getSelectColumns();
 
         $criteria->addSelectColumn(ListParticipatedLastPeer::APP_UID);
         $criteria->addSelectColumn(ListParticipatedLastPeer::DEL_INDEX);
@@ -343,7 +362,7 @@ class ListParticipatedLast extends BaseListParticipatedLast
             $criteria->add(ListParticipatedLastPeer::APP_UID, $appUid, Criteria::EQUAL);
         }
 
-        self::loadFilters($criteria, $filters);
+        self::loadFilters($criteria, $filters, $additionalColumns);
 
         $sort = (!empty($filters['sort'])) ?
             ListParticipatedLastPeer::TABLE_NAME.'.'.$filters['sort'] :

workflow/engine/classes/model/ListPaused.php

@@ -17,7 +17,8 @@ require_once 'classes/model/om/BaseListPaused.php';
 // @codingStandardsIgnoreStart
 class ListPaused extends BaseListPaused
 {
-    // @codingStandardsIgnoreEnd
+    private $additionalClassName = '';
+
     /**
      * Create List Paused Table
      *
@@ -212,13 +213,21 @@ class ListPaused extends BaseListPaused
         }
     }
 
-    public function loadFilters(&$criteria, $filters)
+    /**
+     * This function add restriction in the query related to the filters
+     * @param Criteria $criteria, must be contain only select of columns
+     * @param array $filters
+     * @param array $additionalColumns information about the new columns related to custom cases list
+     * @throws PropelException
+     */
+    public function loadFilters(&$criteria, $filters, $additionalColumns = array())
     {
-        $filter = isset($filters['filter']) ? $filters['filter'] : "";
+        $filter = isset($filters['filter']) ? $filters['filter'] : '';
-        $search = isset($filters['search']) ? $filters['search'] : "";
+        $search = isset($filters['search']) ? $filters['search'] : '';
-        $process = isset($filters['process']) ? $filters['process'] : "";
+        $caseLink = isset($filters['caseLink']) ? $filters['caseLink'] : '';
-        $category = isset($filters['category']) ? $filters['category'] : "";
+        $process = isset($filters['process']) ? $filters['process'] : '';
-        $filterStatus   = isset($filters['filterStatus']) ? $filters['filterStatus'] : "";
+        $category = isset($filters['category']) ? $filters['category'] : '';
+        $filterStatus = isset($filters['filterStatus']) ? $filters['filterStatus'] : '';
 
         //Filter Read Unread All
         switch ($filter) {
@@ -230,25 +239,24 @@ class ListPaused extends BaseListPaused
                 break;
         }
 
+        //Filter Search
         if ($search != '') {
-            $criteria->add(
+            //Check if we need to search to the APP_UID
-                $criteria->getNewCriterion(ListPausedPeer::APP_TITLE, '%' . $search . '%', Criteria::LIKE)
+            if (!empty($caseLink)) {
-                ->addOr(
+                $criteria->add(ListPausedPeer::APP_UID, $search, Criteria::EQUAL);
-                    $criteria->getNewCriterion(ListPausedPeer::APP_TAS_TITLE, '%' . $search . '%', Criteria::LIKE)
+            } else {
-                    ->addOr(
+                //If we have additional tables configured in the custom cases list, prepare the variables for search
-                        $criteria->getNewCriterion(ListPausedPeer::APP_UID, $search, Criteria::EQUAL)
+                $casesList = new \ProcessMaker\BusinessModel\Cases();
-                        ->addOr(
+                $casesList->getSearchCriteriaListCases($criteria, __CLASS__ . 'Peer', $search, $this->additionalClassName, $additionalColumns);
-                            $criteria->getNewCriterion(ListPausedPeer::APP_NUMBER, $search, Criteria::EQUAL)
+            }
-                        )
-                    )
-                )
-            );
         }
 
+        //Filter Process Id
         if ($process != '') {
             $criteria->add(ListPausedPeer::PRO_UID, $process, Criteria::EQUAL);
         }
 
+        //Filter Category
         if ($category != '') {
             $criteria->addSelectColumn(ProcessPeer::PRO_CATEGORY);
             $aConditions   = array();
@@ -258,11 +266,21 @@ class ListPaused extends BaseListPaused
         }
     }
 
+    /**
+     * This function get the information in the corresponding cases list
+     * @param string $usr_uid, must be show cases related to this user
+     * @param array $filters for apply in the result
+     * @param null $callbackRecord
+     * @return array $data
+     * @throws PropelException
+     */
     public function loadList($usr_uid, $filters = array(), $callbackRecord = null)
     {
         $resp = array();
         $pmTable = new PmTable();
         $criteria = $pmTable->addPMFieldsToList('paused');
+        $this->additionalClassName = $pmTable->tableClassName;
+        $additionalColumns = $criteria->getSelectColumns();
 
         $criteria->addSelectColumn(ListPausedPeer::APP_UID);
         $criteria->addSelectColumn(ListPausedPeer::USR_UID);
@@ -287,7 +305,7 @@ class ListPaused extends BaseListPaused
         $criteria->addSelectColumn(ListPausedPeer::DEL_DUE_DATE);
         $criteria->addSelectColumn(ListPausedPeer::DEL_PRIORITY);
         $criteria->add(ListPausedPeer::USR_UID, $usr_uid, Criteria::EQUAL);
-        self::loadFilters($criteria, $filters);
+        self::loadFilters($criteria, $filters, $additionalColumns);
 
         $sort  = (!empty($filters['sort'])) ? ListPausedPeer::TABLE_NAME.'.'.$filters['sort'] : "APP_PAUSED_DATE";
         $dir   = isset($filters['dir']) ? $filters['dir'] : "ASC";

workflow/engine/classes/model/ListUnassigned.php

@@ -17,8 +17,9 @@ require_once 'classes/model/om/BaseListUnassigned.php';
 // @codingStandardsIgnoreStart
 class ListUnassigned extends BaseListUnassigned
 {
-    // @codingStandardsIgnoreEnd
+    private $additionalClassName = '';
     private $total = 0;
+
     /**
      * Create List Unassigned Table
      *
@@ -165,34 +166,41 @@ class ListUnassigned extends BaseListUnassigned
         return true;
     }
 
-    public function loadFilters(&$criteria, $filters)
+    /**
+     * This function add restriction in the query related to the filters
+     * @param Criteria $criteria, must be contain only select of columns
+     * @param array $filters
+     * @param array $additionalColumns information about the new columns related to custom cases list
+     * @throws PropelException
+     */
+    public function loadFilters(&$criteria, $filters, $additionalColumns = array())
     {
-        $filter = isset($filters['filter']) ? $filters['filter'] : "";
+        $filter = isset($filters['filter']) ? $filters['filter'] : '';
-        $search = isset($filters['search']) ? $filters['search'] : "";
+        $search = isset($filters['search']) ? $filters['search'] : '';
-        $process = isset($filters['process']) ? $filters['process'] : "";
+        $caseLink = isset($filters['caseLink']) ? $filters['caseLink'] : '';
-        $category = isset($filters['category']) ? $filters['category'] : "";
+        $process = isset($filters['process']) ? $filters['process'] : '';
-        $dateFrom = isset($filters['dateFrom']) ? $filters['dateFrom'] : "";
+        $category = isset($filters['category']) ? $filters['category'] : '';
-        $dateTo = isset($filters['dateTo']) ? $filters['dateTo'] : "";
+        $dateFrom = isset($filters['dateFrom']) ? $filters['dateFrom'] : '';
+        $dateTo = isset($filters['dateTo']) ? $filters['dateTo'] : '';
 
+        //Filter Search
         if ($search != '') {
-            $criteria->add(
+            //Check if we need to search to the APP_UID
-                $criteria->getNewCriterion(ListUnassignedPeer::APP_TITLE, '%' . $search . '%', Criteria::LIKE)
+            if (!empty($caseLink)) {
-                ->addOr(
+                $criteria->add(ListUnassignedPeer::APP_UID, $search, Criteria::EQUAL);
-                    $criteria->getNewCriterion(ListUnassignedPeer::APP_TAS_TITLE, '%' . $search . '%', Criteria::LIKE)
+            } else {
-                    ->addOr(
+                //If we have additional tables configured in the custom cases list, prepare the variables for search
-                        $criteria->getNewCriterion(ListUnassignedPeer::APP_UID, $search, Criteria::EQUAL)
+                $casesList = new \ProcessMaker\BusinessModel\Cases();
-                        ->addOr(
+                $casesList->getSearchCriteriaListCases($criteria, __CLASS__ . 'Peer', $search, $this->additionalClassName, $additionalColumns);
-                            $criteria->getNewCriterion(ListUnassignedPeer::APP_NUMBER, $search, Criteria::EQUAL)
+            }
-                        )
-                    )
-                )
-            );
         }
 
+        //Filter Process Id
         if ($process != '') {
             $criteria->add(ListUnassignedPeer::PRO_UID, $process, Criteria::EQUAL);
         }
 
+        //Filter Category
         if ($category != '') {
             $criteria->addSelectColumn(ProcessPeer::PRO_CATEGORY);
             $aConditions   = array();
@@ -202,12 +210,22 @@ class ListUnassigned extends BaseListUnassigned
         }
     }
 
+    /**
+     * This function get the information in the corresponding cases list
+     * @param string $usr_uid, must be show cases related to this user
+     * @param array $filters for apply in the result
+     * @param null $callbackRecord
+     * @return array $data
+     * @throws PropelException
+     */
     public function loadList($usr_uid, $filters = array(), $callbackRecord = null)
     {
         $resp = array();
         $pmTable = new PmTable();
         $tasks = $this->getSelfServiceTasks($usr_uid);
         $criteria = $pmTable->addPMFieldsToList('unassigned');
+        $this->additionalClassName = $pmTable->tableClassName;
+        $additionalColumns = $criteria->getSelectColumns();
 
         $criteria->addSelectColumn(ListUnassignedPeer::APP_UID);
         $criteria->addSelectColumn(ListUnassignedPeer::DEL_INDEX);
@@ -282,7 +300,7 @@ class ListUnassigned extends BaseListUnassigned
         }
 
         //Apply some filters
-        self::loadFilters($criteria, $filters);
+        self::loadFilters($criteria, $filters, $additionalColumns);
         $sort  = (!empty($filters['sort'])) ?
             ListUnassignedPeer::TABLE_NAME.'.'.$filters['sort'] :
             "LIST_UNASSIGNED.DEL_DELEGATE_DATE";

workflow/engine/classes/model/ObjectPermission.php

@@ -409,5 +409,39 @@ class ObjectPermission extends BaseObjectPermission
         }
         return $result;
     }
+
+    /**
+     * Verify if the user has a objectPermission for some process
+     *
+     * @param string $usrUid the uid of the user
+     * @param int $typeRelation
+     *
+     * @return array
+     */
+    public function objectPermissionPerUser($usrUid, $typeRelation = 1)
+    {
+        $criteria = new Criteria("workflow");
+        $criteria->addSelectColumn(ObjectPermissionPeer::USR_UID);
+        $criteria->addSelectColumn(ObjectPermissionPeer::PRO_UID);
+        $criteria->add(ObjectPermissionPeer::OP_USER_RELATION, $typeRelation, Criteria::EQUAL);
+        $criteria->add(ObjectPermissionPeer::USR_UID, $usrUid, Criteria::EQUAL);
+        $doSelectRS = ObjectPermissionPeer::doSelectRS($criteria);
+        $doSelectRS->setFetchmode(ResultSet::FETCHMODE_ASSOC);
+        $doSelectRS->next();
+        $objectPermision = $doSelectRS->getRow();
+        $data = array();
+        if (isset($objectPermision["USR_UID"])) {
+            $criteria = new Criteria("workflow");
+            $criteria->addSelectColumn(ProcessPeer::PRO_TITLE);
+            $criteria->add(ProcessPeer::PRO_UID, $objectPermision["PRO_UID"], Criteria::EQUAL);
+            $doSelectRS = ProcessPeer::doSelectRS($criteria);
+            $doSelectRS->setFetchmode(ResultSet::FETCHMODE_ASSOC);
+            $doSelectRS->next();
+            $content = $doSelectRS->getRow();
+            $data['PRO_TITLE'] = $content["PRO_TITLE"];
+            $data['PRO_UID'] = $objectPermision["PRO_UID"];
+        }
+        return $data;
+    }
 }
 

workflow/engine/content/translations/english/processmaker.en.po

@@ -4042,8 +4042,8 @@ msgstr "Invalid syntax"
 # TRANSLATION
 # LABEL/ID_NO_PERMISSION_NO_PARTICIPATED
 #: LABEL/ID_NO_PERMISSION_NO_PARTICIPATED
-msgid "You do not have permission to see this case or you have not participated in it."
+msgid "You cannot open this case because on the reason below: <br> You do not have permission to see this case. <br> You have not participated in this case. <br> Case is already claimed."
-msgstr "You do not have permission to see this case or you have not participated in it."
+msgstr "You cannot open this case because on the reason below: <br> You do not have permission to see this case. <br> You have not participated in this case. <br> Case is already claimed."
 
 # TRANSLATION
 # JAVASCRIPT/ID_EMPTY_NODENAME
@@ -15187,6 +15187,12 @@ msgstr "SYSTEM INSTALLATION FAILED"
 msgid "A problem occurred during the installation of the system. Please, uninstall the partial installation and try again."
 msgstr "A problem occurred during the installation of the system. Please, uninstall the partial installation and try again."
 
+# TRANSLATION
+# LABEL/ID_PROCESSMAKER_ALREADY_INSTALLED
+#: LABEL/ID_PROCESSMAKER_ALREADY_INSTALLED
+msgid "ProcessMaker is already installed."
+msgstr "ProcessMaker is already installed."
+
 # TRANSLATION
 # LABEL/ID_LICENSE_EMPTY
 #: LABEL/ID_LICENSE_EMPTY

workflow/engine/controllers/designer.php

@@ -29,6 +29,18 @@ class Designer extends Controller
         $client = $this->getClientCredentials();
 
         if (isset($httpData->tracker_designer) && $httpData->tracker_designer == 1) {
+            try {
+                if (!isset($_SESSION['CASE']) && !isset($_SESSION['PIN'])) {
+                    throw (new \Exception(
+                        \G::LoadTranslation('ID_CASE_NOT_EXISTS') . "\n" . \G::LoadTranslation('ID_PIN_INVALID')
+                    ));
+                }
+                \ProcessMaker\BusinessModel\Light\Tracker::authentication($_SESSION['CASE'], $_SESSION['PIN']);
+            } catch (\Exception $e) {
+                Bootstrap::registerMonolog('CaseTracker', 400, $e->getMessage(), [], SYS_SYS, 'processmaker.log');
+                \G::header('Location: /errors/error403.php');
+                die();
+            }
             $client["tracker_designer"] = 1;
         }
 

workflow/engine/controllers/installer.php

@@ -38,10 +38,18 @@ class Installer extends Controller
 
     public function index ($httpData)
     {
+        if (file_exists(FILE_PATHS_INSTALLED)) {
+            $this->setJSVar('messageError', G::LoadTranslation('ID_PROCESSMAKER_ALREADY_INSTALLED'));
+            $this->includeExtJS('installer/stopInstall');
+            $this->setView('installer/mainStopInstall');
+            G::RenderPage('publish', 'extJs');
+            return;
+        }
         if ((strtoupper(substr(PHP_OS, 0, 3)) == 'WIN') && (file_exists($this->path_shared . 'partner.info'))) {
-            $this->includeExtJS( 'installer/stopInstall');
+            $this->setJSVar('messageError', G::LoadTranslation('ID_NO_INSTALL'));
-            $this->setView( 'installer/mainStopInstall' );
+            $this->includeExtJS('installer/stopInstall');
-            G::RenderPage( 'publish', 'extJs' );
+            $this->setView('installer/mainStopInstall');
+            G::RenderPage('publish', 'extJs');
             return;
         }
 

workflow/engine/controllers/processProxy.php

@@ -3,6 +3,12 @@
 class ProcessProxy extends HttpProxyController
 {
 
+    public function call ($name)
+    {
+        global $RBAC;
+        $RBAC->allows(basename(__FILE__), $name);
+        parent::call($name);
+    }
     /**
      * get Process Categories List with defailt value (empty option) and -All- aoption
      */
@@ -50,53 +56,6 @@ class ProcessProxy extends HttpProxyController
             }
 
             $sProUid = $project->getUid();
-
-
-//        require_once 'classes/model/Task.php';
-//        G::LoadClass( 'processMap' );
-//        $oProcessMap = new ProcessMap();
-//
-//        $httpData->PRO_TITLE = trim( $httpData->PRO_TITLE );
-//
-//        try {
-//            if (! isset( $httpData->PRO_UID )) {
-//                if (Process::existsByProTitle( $httpData->PRO_TITLE )) {
-//                    $result = array ('success' => false,'msg' => G::LoadTranslation( 'ID_SAVE_PROCESS_ERROR' ),'errors' => array ('PRO_TITLE' => G::LoadTranslation( 'ID_PROCESSTITLE_ALREADY_EXISTS', SYS_LANG, Array ('PRO_TITLE' => $httpData->PRO_TITLE
-//                    ) )
-//                    )
-//                    );
-//                    print G::json_encode( $result );
-//                    exit( 0 );
-//                }
-//
-//                $processData['USR_UID'] = $_SESSION['USER_LOGGED'];
-//                $processData['PRO_TITLE'] = $httpData->PRO_TITLE;
-//                $processData['PRO_DESCRIPTION'] = $httpData->PRO_DESCRIPTION;
-//                $processData['PRO_CATEGORY'] = $httpData->PRO_CATEGORY;
-//
-//                $sProUid = $oProcessMap->createProcess( $processData );
-//
-//                //call pluginsx
-//                $oData['PRO_UID'] = $sProUid;
-//                $oData['PRO_TEMPLATE'] = isset( $httpData->PRO_TEMPLATE ) && $httpData->PRO_TEMPLATE != '' ? $httpData->PRO_TEMPLATE : '';
-//                $oData['PROCESSMAP'] = $oProcessMap;
-//
-//                $oPluginRegistry = & PMPluginRegistry::getSingleton();
-//                $oPluginRegistry->executeTriggers( PM_NEW_PROCESS_SAVE, $oData );
-//
-//            } else {
-//                //$oProcessMap->updateProcess($_POST['form']);
-//                $sProUid = $httpData->PRO_UID;
-//            }
-//
-//            //Save Calendar ID for this process
-//            if (isset( $httpData->PRO_CALENDAR )) {
-//                G::LoadClass( "calendar" );
-//                $calendarObj = new Calendar();
-//                $calendarObj->assignCalendarTo( $sProUid, $httpData->PRO_CALENDAR, 'PROCESS' );
-//            }
-//
-
             $this->success = true;
             $this->PRO_UID = $sProUid;
             $this->msg = G::LoadTranslation( 'ID_CREATE_PROCESS_SUCCESS' );

workflow/engine/data/mysql/insert.sql

@@ -2122,7 +2122,7 @@ INSERT INTO TRANSLATION (TRN_CATEGORY,TRN_ID,TRN_LANG,TRN_VALUE,TRN_UPDATE_DATE
 ( 'LABEL','ID_UNASSIGNED','en','Unassigned','2014-01-15') ,
 ( 'LABEL','ID_CLAIM','en','Claim','2014-01-15') ,
 ( 'LABEL','ID_TABLE_INVALID_SYNTAX','en','Invalid syntax','2014-01-15') ,
-( 'LABEL','ID_NO_PERMISSION_NO_PARTICIPATED','en','You do not have permission to see this case or you have not participated in it.','2014-01-15') ,
+( 'LABEL','ID_NO_PERMISSION_NO_PARTICIPATED','en','You cannot open this case because on the reason below: <br> You do not have permission to see this case. <br> You have not participated in this case. <br> Case is already claimed.','2017-06-05') ,
 ( 'JAVASCRIPT','ID_EMPTY_NODENAME','en','The field name contains spaces or it''s empty!','2014-01-15') ,
 ( 'JAVASCRIPT','ID_SUGGEST_NEW_ENTRIES_ALERT','en','You should set all options for new entries.','2014-01-15') ,
 ( 'LABEL','ID_ISNT_LICENSE','en','This isn''t the correct license.','2014-01-15') ,
@@ -4027,6 +4027,7 @@ INSERT INTO TRANSLATION (TRN_CATEGORY,TRN_ID,TRN_LANG,TRN_VALUE,TRN_UPDATE_DATE
 ( 'LABEL','ID_ROLE_NAME_NOT_EMPTY','en','The ''Name'' field can not be empty.','2014-01-15') ,
 ( 'LABEL','ID_TITLE_NO_INSTALL','en','SYSTEM INSTALLATION FAILED','2014-01-15') ,
 ( 'LABEL','ID_NO_INSTALL','en','A problem occurred during the installation of the system. Please, uninstall the partial installation and try again.','2014-01-15') ,
+( 'LABEL','ID_PROCESSMAKER_ALREADY_INSTALLED','en','ProcessMaker is already installed.','2017-05-31') ,
 ( 'LABEL','ID_LICENSE_EMPTY','en','Can not find any license','2014-01-15') ,
 ( 'LABEL','ID_ADD_LICENSE','en','Please add a new license','2014-01-15') ,
 ( 'LABEL','ID_DEFAULT_CALENDAR','en','Default Calendar','2014-01-15') ,

workflow/engine/methods/cases/cases_Ajax.php

@@ -560,7 +560,14 @@ switch (($_POST['action']) ? $_POST['action'] : $_REQUEST['action']) {
         $oCase = new Cases();
         $aProcesses = Array();
         $G_PUBLISH = new Publisher();
-        $criteria = $oCase->getAllUploadedDocumentsCriteria($_SESSION['PROCESS'], $_SESSION['APPLICATION'], $_SESSION['CURRENT_TASK'], $_SESSION['USER_LOGGED'], $_SESSION['INDEX']);
+        $tasUid = isset($_SESSION['CURRENT_TASK']) ? $_SESSION['CURRENT_TASK'] : $_SESSION['TASK'];
+        $criteria = $oCase->getAllUploadedDocumentsCriteria(
+            $_SESSION['PROCESS'],
+            $_SESSION['APPLICATION'],
+            $tasUid,
+            $_SESSION['USER_LOGGED'],
+            $_SESSION['INDEX']
+        );
         if ($criteria->getDbName() == 'dbarray') {
             $rs = ArrayBasePeer::doSelectRs($criteria);
         } else {
@@ -601,8 +608,14 @@ switch (($_POST['action']) ? $_POST['action'] : $_REQUEST['action']) {
         $oCase = new Cases();
         $aProcesses = Array ();
         $G_PUBLISH = new Publisher();
-        $c = $oCase->getAllGeneratedDocumentsCriteria($_SESSION['PROCESS'], $_SESSION['APPLICATION'],
+        $tasUid = isset($_SESSION['CURRENT_TASK']) ? $_SESSION['CURRENT_TASK'] : $_SESSION['TASK'];
-            $_SESSION['CURRENT_TASK'], $_SESSION['USER_LOGGED'], $_SESSION['INDEX']);
+        $c = $oCase->getAllGeneratedDocumentsCriteria(
+            $_SESSION['PROCESS'],
+            $_SESSION['APPLICATION'],
+            $tasUid,
+            $_SESSION['USER_LOGGED'],
+            $_SESSION['INDEX']
+        );
 
         if ($c->getDbName() == 'dbarray') {
             $rs = ArrayBasePeer::doSelectRs( $c );

workflow/engine/methods/groups/groups_Ajax.php

@@ -125,7 +125,7 @@ switch ($_POST['action']) {
         $result->success = true;
         $result->groups = $arrData;
         $result->total_groups = $data['totalCount'];
-
+        G::header('Content-Type: application/json');
         echo G::json_encode( $result );
         break;
     case 'exitsGroupName':
@@ -253,6 +253,7 @@ switch ($_POST['action']) {
         while ($oDataset->next()) {
             $arrData[] = $oDataset->getRow();
         }
+        G::header('Content-Type: application/json');
         echo '{success: true, members: ' . G::json_encode( $arrData ) . ', total_users: ' . $totalRows . '}';
         break;
     case 'availableMembers':
@@ -311,6 +312,7 @@ switch ($_POST['action']) {
         while ($oDataset->next()) {
             $arrData[] = $oDataset->getRow();
         }
+        G::header('Content-Type: application/json');
         echo '{success: true, members: ' . G::json_encode( $arrData ) . ', total_users: ' . $totalRows . '}';
         break;
     case 'assignUsersToGroupsMultiple':

workflow/engine/methods/processes/processes_DownloadFile.php

@@ -1,26 +1,5 @@
 <?php
-/**
+$RBAC->allows(basename(__FILE__), 'downloadFileHash');
- * processes_DownloadFile.php
- *
- * ProcessMaker Open Source Edition
- * Copyright (C) 2004 - 2008 Colosa Inc.23
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
- * For more information, contact Colosa Inc, 2566 Le Jeune Rd.,
- * Coral Gables, FL, 33134, USA, or email info@colosa.com.
- */
 
 if (!isset($_GET["file_hash"])) {
     throw new Exception("Invalid Request, param 'file_hash' was not sent.");
@@ -28,26 +7,16 @@ if (!isset($_GET["file_hash"])) {
 
 $httpStream = new \ProcessMaker\Util\IO\HttpStream();
 $outputDir = PATH_DATA . "sites" . PATH_SEP . SYS_SYS . PATH_SEP . "files" . PATH_SEP . "output" . PATH_SEP;
-$filename = urldecode(base64_decode($_GET["file_hash"]));
+$fileName = urldecode(base64_decode($_GET["file_hash"]));
-$fileExtension = pathinfo($outputDir . $filename, PATHINFO_EXTENSION);
+$processFile = $outputDir . $fileName;
 
-if (!file_exists($outputDir . $filename)) {
+//Verify if the file related to process exist in the corresponding path
-    throw new Exception("Error, couldn't find request file: $filename");
+$fileInformation = pathinfo($processFile);
+$processFile = $outputDir . $fileInformation['basename'];
+if (!file_exists($processFile)) {
+    throw new Exception("Error, couldn't find request file: $fileName");
 }
-
+$fileExtension = $fileInformation['extension'];
-$httpStream->loadFromFile($outputDir . $filename);
+$httpStream->loadFromFile($processFile);
 $httpStream->setHeader("Content-Type", "application/$fileExtension");
 $httpStream->send();
-
-//  ************* DEPRECATED (it will be removed soon) *********************************
-//add more security, and catch any error or exception
-//$sFileName = $_GET['p'] . '.pm';
-//$file = PATH_DOCUMENT . 'output' . PATH_SEP . $sFileName . 'tpm';
-//$filex = PATH_DOCUMENT . 'output' . PATH_SEP . $sFileName;
-//
-//if (file_exists( $file )) {
-//    rename( $file, $filex );
-//}
-//
-//$realPath = PATH_DOCUMENT . 'output' . PATH_SEP . $sFileName;
-//G::streamFile( $realPath, true );

workflow/engine/methods/processes/processes_Export.php

@@ -39,7 +39,8 @@ try {
         if (sizeof($_GET['objects']) == 0) {
         /*----------------------------------********---------------------------------*/
             $exporter = new ProcessMaker\Exporter\XmlExporter($_GET["pro_uid"]);
-            $getProjectName = $exporter->truncateName($exporter->getProjectName(), false);
+            $projectName = $exporter->getProjectName();
+            $getProjectName = $exporter->truncateName($projectName, false);
 
             $version = ProcessMaker\Util\Common::getLastVersion($outputDir . $getProjectName . "-*.pmx") + 1;
             $outputFilename = sprintf("%s-%s.%s", str_replace(" ", "_", $getProjectName), $version, "pmx");
@@ -48,8 +49,10 @@ try {
         }else{
             $granularExporter = new \ProcessMaker\BusinessModel\Migrator\GranularExporter($_GET['pro_uid']);
             $outputFilename = $granularExporter->export($_GET['objects']);
+            $projectName = $granularExporter->getProjectName();
         }
         /*----------------------------------********---------------------------------*/
+        G::auditLog('ExportProcess','Export process "' . $projectName . '"');
     } else {
         $oProcess = new Processes();
         $proFields = $oProcess->serializeProcess($_GET["pro_uid"]);
@@ -57,6 +60,7 @@ try {
         $outputFilename = $result["FILENAME"];
 
         rename($outputDir . $outputFilename . "tpm", $outputDir . $outputFilename);
+        G::auditLog('ExportProcess','Export process "' . $result["PRO_TITLE"] . '"');
     }
     $response->file_hash = base64_encode($outputFilename);
     $response->success = true;

workflow/engine/methods/setup/skin_Ajax.php

@@ -1,8 +1,4 @@
 <?php
-G::LoadSystem('inputfilter');
-$filter = new InputFilter();
-$_REQUEST = $filter->xssFilterHard($_REQUEST);
-
 if (! isset( $_REQUEST['action'] )) {
     $res['success'] = false;
     $res['error'] = $res['message'] = G::LoadTranslation('ID_REQUEST_ACTION');
@@ -17,8 +13,7 @@ if (! function_exists( $_REQUEST['action'] ) || !G::isUserFunction($_REQUEST['ac
     print G::json_encode( $res );
     die();
 }
-$restrictedFunctions = array ('copy_skin_folder','addTarFolder'
+$restrictedFunctions = array ('copy_skin_folder','addTarFolder');
-);
 if (in_array( $_REQUEST['action'], $restrictedFunctions )) {
     $res['success'] = false;
     $res['error'] = $res['message'] = G::LoadTranslation('ID_REQUEST_ACTION_NOT_EXIST');
@@ -28,7 +23,7 @@ if (in_array( $_REQUEST['action'], $restrictedFunctions )) {
 
 $functionName = $_REQUEST['action'];
 $functionParams = isset( $_REQUEST['params'] ) ? $_REQUEST['params'] : array ();
-
+$RBAC->allows(basename(__FILE__), $functionName);
 $functionName();
 
 function updatePageSize ()
@@ -400,9 +395,9 @@ function deleteSkin ()
 
 function streamSkin ()
 {
-    $skinTar = $_REQUEST['file'];
+    $skinTar = basename($_REQUEST['file']);
     $bDownload = true;
-    G::streamFile( $skinTar, $bDownload, basename( $skinTar ) );
+    G::streamFile(PATH_CUSTOM_SKINS . $skinTar, $bDownload, $skinTar);
     @unlink( $fileTar );
 }
 

workflow/engine/methods/users/users_Ajax.php

@@ -1,34 +1,6 @@
 <?php
 
-/**
- * users_Ajax.php
- *
- * ProcessMaker Open Source Edition
- * Copyright (C) 2004 - 2008 Colosa Inc.23
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
- * For more information, contact Colosa Inc, 2566 Le Jeune Rd.,
- * Coral Gables, FL, 33134, USA, or email info@colosa.com.
- */
 try {
-    G::LoadSystem('inputfilter');
-    $filter = new InputFilter();
-    $_GET = $filter->xssFilterHard($_GET);
-    $_POST = $filter->xssFilterHard($_POST);
-    $_REQUEST = $filter->xssFilterHard($_REQUEST);
-
     global $RBAC;
     switch ($RBAC->userCanAccess('PM_LOGIN')) {
         case - 2:
@@ -47,38 +19,15 @@ try {
         $_POST = $_POST['form'];
     }
     if (isset($_REQUEST['function'])) {
-        //$value= $_POST['function'];
         $value = get_ajax_value('function');
     } else {
-        //$value= $_POST['functions'];
         $value = get_ajax_value('functions');
     }
+
+    $RBAC->allows(basename(__FILE__), $value);
     switch ($value) {
-        case 'verifyUsername':
-            //print_r($_POST); die;
-            $_POST['sOriginalUsername'] = get_ajax_value('sOriginalUsername');
-            $_POST['sUsername'] = get_ajax_value('sUsername');
-            if ($_POST['sOriginalUsername'] == $_POST['sUsername']) {
-                echo '0';
-            } else {
-                require_once 'classes/model/Users.php';
-                G::LoadClass('Users');
-                $oUser = new Users();
-                $oCriteria = $oUser->loadByUsername($_POST['sUsername']);
-                $oDataset = UsersPeer::doSelectRs($oCriteria, Propel::getDbConnection('workflow_ro'));
-                $oDataset->setFetchmode(ResultSet::FETCHMODE_ASSOC);
-                $oDataset->next();
-                $aRow = $oDataset->getRow();
-                //print_r($aRow); die;
-                //if (!$aRow)
-                if (!is_array($aRow)) {
-                    echo '0';
-                } else {
-                    echo '1';
-                }
-            }
-            break;
         case 'availableUsers':
+            //Classic process: list of users to assign in the task
             G::LoadClass('processMap');
             $oProcessMap = new ProcessMap();
             global $G_PUBLISH;
@@ -87,6 +36,7 @@ try {
             G::RenderPage('publish', 'raw');
             break;
         case 'assign':
+            //Classic process: assign users and groups in the task
             G::LoadClass('tasks');
             $oTasks = new Tasks();
             switch ((int) $_POST['TU_RELATION']) {
@@ -103,6 +53,7 @@ try {
             }
             break;
         case 'ofToAssign':
+            //Classic process: remove users and groups related a task
             G::LoadClass('tasks');
             $oTasks = new Tasks();
             switch ((int) $_POST['TU_RELATION']) {
@@ -117,36 +68,11 @@ try {
             }
             break;
         case 'changeView':
+            //Classic process: set variable for users and groups Ad hoc
             $_SESSION['iType'] = $_POST['TU_TYPE'];
             break;
-        case 'deleteGroup':
-            G::LoadClass('groups');
-            $oGroup = new Groups();
-            $oGroup->removeUserOfGroup($_POST['GRP_UID'], $_POST['USR_UID']);
-            $_GET['sUserUID'] = $_POST['USR_UID'];
-            $G_PUBLISH = new Publisher();
-            $G_PUBLISH->AddContent('view', 'users/users_Tree');
-            G::RenderPage('publish', 'raw');
-            break;
-        case 'showUserGroupInterface':
-            $_GET['sUserUID'] = $_POST['sUserUID'];
-            $G_PUBLISH = new Publisher();
-            $G_PUBLISH->AddContent('view', 'users/users_AssignGroup');
-            G::RenderPage('publish', 'raw');
-            break;
-        case 'showUserGroups':
-            $_GET['sUserUID'] = $_POST['sUserUID'];
-            $G_PUBLISH = new Publisher();
-            $G_PUBLISH->AddContent('view', 'users/users_Tree');
-            G::RenderPage('publish', 'raw');
-            break;
-        case 'assignUserToGroup':
-            G::LoadClass('groups');
-            $oGroup = new Groups();
-            $oGroup->addUserToGroup($_POST['GRP_UID'], $_POST['USR_UID']);
-            echo '<div align="center"><h2><font color="blue">' . G::LoadTranslation('ID_MSG_ASSIGN_DONE') . '</font></h2></div>';
-            break;
         case 'usersGroup':
+            //Classic process: list of users in a group related a task
             G::LoadClass('groups');
             $oGroup = new Groups();
             $aGroup = $oGroup->getUsersOfGroup($_POST['GRP_UID']);
@@ -154,29 +80,8 @@ try {
                 echo $aValues['USR_FIRSTNAME'] . ' ' . $aValues['USR_LASTNAME'] . '<br>';
             }
             break;
-
-        //This case is used to check if any of the user group has as role 'PROCESSMAKER_ADMIN',
-        case 'usersAdminGroupExtJS':
-            G::LoadClass('groups');
-            $oGroup = new Groups();
-            $aGroup = $oGroup->getUsersOfGroup($_POST['GRP_UID']);
-            $responseUser = 'false';
-            $usersAdmin = '';
-            foreach ($aGroup as $iIndex => $aValues) {
-                if ($aValues['USR_ROLE'] == 'PROCESSMAKER_ADMIN') {
-                    $responseUser = 'true';
-                    $usersAdmin .= $aValues['USR_FIRSTNAME'] . ' ' . $aValues['USR_LASTNAME'] . ', ';
-                }
-            }
-            $usersAdmin = substr($usersAdmin, 0, - 2);
-
-            $result = new stdClass();
-            $result->reponse = $responseUser;
-            $result->users = $usersAdmin;
-
-            echo G::json_encode($result);
-            break;
         case 'canDeleteUser':
+            //Check before delete a user
             G::LoadClass('case');
             $oProcessMap = new Cases();
             $userUid = $_POST['uUID'];
@@ -204,44 +109,31 @@ try {
             echo $response;
             break;
         case 'deleteUser':
-            $UID = $_POST['USR_UID'];
+            //Check if the user was defined in a process permissions
-
+            $oObjectPermission = new ObjectPermission();
-            //process permissions
+            $aProcess = $oObjectPermission->objectPermissionPerUser($_POST['USR_UID'], 1);
-            $criteria = new Criteria("workflow");
+            if (count($aProcess) > 0) {
-            $criteria->addSelectColumn(ObjectPermissionPeer::USR_UID);
-            $criteria->addSelectColumn(ObjectPermissionPeer::PRO_UID);
-            $criteria->add(ObjectPermissionPeer::OP_USER_RELATION, 1, Criteria::EQUAL);
-            $criteria->add(ObjectPermissionPeer::USR_UID, $UID, Criteria::EQUAL);
-            $doSelectRS = DynaformPeer::doSelectRS($criteria);
-            $doSelectRS->setFetchmode(ResultSet::FETCHMODE_ASSOC);
-            $doSelectRS->next();
-            $objectPermision = $doSelectRS->getRow();
-            if (isset($objectPermision["USR_UID"])) {
-                $criteria = new Criteria("workflow");
-                $criteria->addSelectColumn(ProcessPeer::PRO_TITLE);
-                $criteria->add(ProcessPeer::PRO_UID, $objectPermision["PRO_UID"], Criteria::EQUAL);
-                $doSelectRS = ProcessPeer::doSelectRS($criteria);
-                $doSelectRS->setFetchmode(ResultSet::FETCHMODE_ASSOC);
-                $doSelectRS->next();
-                $content = $doSelectRS->getRow();
                 echo G::json_encode(array(
                     "status" => 'ERROR',
-                    "message" => G::LoadTranslation('ID_USER_CANT_BE_DELETED_FOR_THE_PROCESS', array('processTitle' => isset($content["PRO_TITLE"]) ? $content["PRO_TITLE"] : $objectPermision['PRO_UID']))
+                    "message" => G::LoadTranslation('ID_USER_CANT_BE_DELETED_FOR_THE_PROCESS', array('processTitle' => isset($aProcess["PRO_TITLE"]) ? $aProcess["PRO_TITLE"] : $aProcess['PRO_UID']))
                 ));
                 break;
             }
 
+            //Remove from tasks
             G::LoadClass('tasks');
             $oTasks = new Tasks();
             $oTasks->ofToAssignUserOfAllTasks($UID);
+
+            //Remove from groups
             G::LoadClass('groups');
             $oGroups = new Groups();
             $oGroups->removeUserOfAllGroups($UID);
-            $RBAC->changeUserStatus($UID, 'CLOSED');
+
-            $_GET['USR_USERNAME'] = '';
+            //Update the table Users
-            $RBAC->updateUser(array('USR_UID' => $UID, 'USR_USERNAME' => $_GET['USR_USERNAME']
-                    ), '');
             require_once 'classes/model/Users.php';
+            $RBAC->changeUserStatus($UID, 'CLOSED');
+            $RBAC->updateUser(array('USR_UID' => $UID,'USR_USERNAME' => ''), '');
             $oUser = new Users();
             $aFields = $oUser->load($UID);
             $aFields['USR_STATUS'] = 'CLOSED';
@@ -258,13 +150,13 @@ try {
 
             //Delete users as supervisor
             $criteria = new Criteria("workflow");
-
             $criteria->add(ProcessUserPeer::USR_UID, $UID, Criteria::EQUAL);
             $criteria->add(ProcessUserPeer::PU_TYPE, "SUPERVISOR", Criteria::EQUAL);
             ProcessUserPeer::doDelete($criteria);
             G::auditLog("DeleteUser", "User Name: ". $userName." User ID: (".$UID.") ");
             break;
         case 'changeUserStatus':
+            //When the user change the status: ACTIVE, INACTIVE, VACATION
             $response = new stdclass();
             if (isset($_REQUEST['USR_UID']) && isset($_REQUEST['NEW_USR_STATUS'])) {
                 $RBAC->changeUserStatus($_REQUEST['USR_UID'], ($_REQUEST['NEW_USR_STATUS'] == 'ACTIVE' ? 1 : 0));
@@ -284,6 +176,7 @@ try {
             die(G::json_encode($response));
             break;
         case 'availableGroups':
+            //Get the available groups for assign to user
             G::LoadClass('groups');
             $filter = (isset($_POST['textFilter'])) ? $_POST['textFilter'] : '';
             $groups = new Groups();
@@ -297,6 +190,7 @@ try {
             echo '{groups: ' . G::json_encode($arr) . '}';
             break;
         case 'assignedGroups':
+            //Get the groups related to user
             G::LoadClass('groups');
             $filter = (isset($_POST['textFilter'])) ? $_POST['textFilter'] : '';
             $groups = new Groups();
@@ -310,6 +204,7 @@ try {
             echo '{groups: ' . G::json_encode($arr) . '}';
             break;
         case 'assignGroupsToUserMultiple':
+            //Assign user in a group
             $USR_UID = $_POST['USR_UID'];
             $gUIDs = explode(',', $_POST['GRP_UID']);
             G::LoadClass('groups');
@@ -319,6 +214,7 @@ try {
             }
             break;
         case 'deleteGroupsToUserMultiple':
+            //Remove a user from a group
             $USR_UID = $_POST['USR_UID'];
             $gUIDs = explode(',', $_POST['GRP_UID']);
             G::LoadClass('groups');
@@ -328,6 +224,7 @@ try {
             }
             break;
         case 'authSources':
+            //Get the authentication information
             $criteria = $RBAC->getAllAuthSources();
             $objects = AuthenticationSourcePeer::doSelectRS($criteria);
             $objects->setFetchmode(ResultSet::FETCHMODE_ASSOC);
@@ -342,22 +239,19 @@ try {
             }
             $started = Array();
             $started['AUTH_SOURCE_UID'] = '00000000000000000000000000000000';
-            //$started['AUTH_SOURCE_NAME'] = 'ProcessMaker';
-            //$started['AUTH_SOURCE_TYPE'] = 'MYSQL';
             $started['AUTH_SOURCE_SHOW'] = 'ProcessMaker (MYSQL)';
             $arr[] = $started;
             while ($objects->next()) {
                 $row = $objects->getRow();
                 $aux = Array();
                 $aux['AUTH_SOURCE_UID'] = $row['AUTH_SOURCE_UID'];
-                //$aux['AUTH_SOURCE_NAME'] =  $row['AUTH_SOURCE_NAME'];
-                //$aux['AUTH_SOURCE_TYPE'] =  $row['AUTH_SOURCE_TYPE'];
                 $aux['AUTH_SOURCE_SHOW'] = $row['AUTH_SOURCE_NAME'] . ' (' . $row['AUTH_SOURCE_PROVIDER'] . ')';
                 $arr[] = $aux;
             }
             echo '{sources: ' . G::json_encode($arr) . '}';
             break;
         case 'loadAuthSourceByUID':
+            //Get the authentication source assignment
             require_once 'classes/model/Users.php';
             $oCriteria = $RBAC->load($_POST['uUID']);
             $UID_AUTH = $oCriteria['UID_AUTH_SOURCE'];
@@ -379,6 +273,7 @@ try {
             echo G::json_encode($res);
             break;
         case 'updateAuthServices':
+            //Update the information related to user's autentication
             $aData = $RBAC->load($_POST['usr_uid']);
             unset($aData['USR_ROLE']);
             $auth_uid = $_POST['auth_source'];
@@ -399,127 +294,31 @@ try {
                 $aData['USR_AUTH_USER_DN'] = $auth_dn;
             }
             $RBAC->updateUser($aData);
-            G::auditLog("AssignAuthenticationSource", "User Name: ".$aData['USR_USERNAME'].' User ID: ('.$aData['USR_UID'].') assign to '.$aData['USR_AUTH_TYPE']);
+            G::auditLog(
+                "AssignAuthenticationSource",
+                "User Name: ".$aData['USR_USERNAME'].' User ID: ('.$aData['USR_UID'].') assign to '.$aData['USR_AUTH_TYPE']
+            );
             echo '{success: true}';
             break;
         case 'usersList':
-            require_once 'classes/model/Users.php';
+            //Get the list of users
-            require_once 'classes/model/LoginLog.php';
+            //Read the configurations related to enviroments
-            require_once 'classes/model/Department.php';
-            require_once 'classes/model/AppCacheView.php';
-            require_once PATH_RBAC . 'model/Roles.php';
-            global $RBAC;
             G::LoadClass('configuration');
             $co = new Configurations();
             $config = $co->getConfiguration('usersList', 'pageSize', '', $_SESSION['USER_LOGGED']);
             $limit_size = isset($config['pageSize']) ? $config['pageSize'] : 20;
-            $start = isset($_REQUEST['start']) ? $_REQUEST['start'] : 0;
             $limit = isset($_REQUEST['limit']) ? $_REQUEST['limit'] : $limit_size;
+            $start = isset($_REQUEST['start']) ? $_REQUEST['start'] : 0;
             $filter = isset($_REQUEST['textFilter']) ? $_REQUEST['textFilter'] : '';
-            $auths = isset($_REQUEST['auths']) ? $_REQUEST['auths'] : '';
+            $authSource = isset($_REQUEST['auths']) ? $_REQUEST['auths'] : '';
             $sort = isset($_REQUEST['sort']) ? $_REQUEST['sort'] : '';
             $dir = isset($_REQUEST['dir']) ? $_REQUEST['dir'] : 'ASC';
-            $aUsers = Array();
-            if ($auths != '') {
-                $aUsers = $RBAC->getListUsersByAuthSource($auths);
-            }
-            $oCriteria = new Criteria('workflow');
-            $oCriteria->addSelectColumn('COUNT(*) AS CNT');
-            if ($filter != '') {
-                $cc = $oCriteria->getNewCriterion(UsersPeer::USR_USERNAME, '%' . $filter . '%', Criteria::LIKE)->addOr($oCriteria->getNewCriterion(UsersPeer::USR_FIRSTNAME, '%' . $filter . '%', Criteria::LIKE)->addOr($oCriteria->getNewCriterion(UsersPeer::USR_LASTNAME, '%' . $filter . '%', Criteria::LIKE)->addOr($oCriteria->getNewCriterion(UsersPeer::USR_EMAIL, '%' . $filter . '%', Criteria::LIKE))));
-                $oCriteria->add($cc);
-            }
-            $oCriteria->add(UsersPeer::USR_STATUS, array('CLOSED'), Criteria::NOT_IN);
-            if ($auths != '') {
-                $totalRows = sizeof($aUsers);
-            } else {
-                $oDataset = UsersPeer::DoSelectRs($oCriteria);
-                $oDataset->setFetchmode(ResultSet::FETCHMODE_ASSOC);
-                $oDataset->next();
-                $row = $oDataset->getRow();
-                $totalRows = $row['CNT'];
-            }
-            $oCriteria->clearSelectColumns();
-            $oCriteria->addSelectColumn(UsersPeer::USR_UID);
-            $oCriteria->addSelectColumn(UsersPeer::USR_USERNAME);
-            $oCriteria->addSelectColumn(UsersPeer::USR_FIRSTNAME);
-            $oCriteria->addSelectColumn(UsersPeer::USR_LASTNAME);
-            $oCriteria->addSelectColumn(UsersPeer::USR_EMAIL);
-            $oCriteria->addSelectColumn(UsersPeer::USR_ROLE);
-            $oCriteria->addSelectColumn(UsersPeer::USR_DUE_DATE);
-            $oCriteria->addSelectColumn(UsersPeer::USR_STATUS);
-            $oCriteria->addSelectColumn(UsersPeer::USR_UX);
-            $oCriteria->addSelectColumn(UsersPeer::DEP_UID);
-            $oCriteria->addSelectColumn(UsersPeer::USR_LAST_LOGIN);
-            $oCriteria->addAsColumn('LAST_LOGIN', 0);
-            $oCriteria->addAsColumn('DEP_TITLE', 0);
-            $oCriteria->addAsColumn('TOTAL_CASES', 0);
-            $oCriteria->addAsColumn('DUE_DATE_OK', 1);
-            $sep = "'";
-            $oCriteria->add(UsersPeer::USR_STATUS, array('CLOSED'), Criteria::NOT_IN);
-            if ($filter != '') {
-                $cc = $oCriteria->getNewCriterion(UsersPeer::USR_USERNAME, '%' . $filter . '%', Criteria::LIKE)->addOr($oCriteria->getNewCriterion(UsersPeer::USR_FIRSTNAME, '%' . $filter . '%', Criteria::LIKE)->addOr($oCriteria->getNewCriterion(UsersPeer::USR_LASTNAME, '%' . $filter . '%', Criteria::LIKE)->addOr($oCriteria->getNewCriterion(UsersPeer::USR_EMAIL, '%' . $filter . '%', Criteria::LIKE))));
-                $oCriteria->add($cc);
-            }
-            if (sizeof($aUsers) > 0) {
-                $oCriteria->add(UsersPeer::USR_UID, $aUsers, Criteria::IN);
-            } elseif ($totalRows == 0 && $auths != '') {
-                $oCriteria->add(UsersPeer::USR_UID, '', Criteria::IN);
-            }
-            if ($sort != '') {
-                if ($dir == 'ASC') {
-                    $oCriteria->addAscendingOrderByColumn($sort);
-                } else {
-                    $oCriteria->addDescendingOrderByColumn($sort);
-                }
-            }
-            $oCriteria->setOffset($start);
-            $oCriteria->setLimit($limit);
-            $oDataset = UsersPeer::DoSelectRs($oCriteria);
-            $oDataset->setFetchmode(ResultSet::FETCHMODE_ASSOC);
-            $Department = new Department();
-            $aDepart = $Department->getAllDepartmentsByUser();
-            $aAuthSources = $RBAC->getAllAuthSourcesByUser();
 
-            require_once PATH_CONTROLLERS . 'adminProxy.php';
+            //Get all list of users with the additional information related to department, role, authentication, cases
-            $uxList = adminProxy::getUxTypesList();
+            $oUser = new \ProcessMaker\BusinessModel\User();
-
+            $oDatasetUsers = $oUser->getAllUsersWithAuthSource($authSource, $filter, $sort, $start, $limit, $dir);
-            $oRoles = new Roles();
+            $rows = $oUser->getAdditionalInfoFromUsers($oDatasetUsers);
-            $oParticipated = new ListParticipatedLast();
+            echo '{users: ' . G::json_encode($rows['data']) . ', total_users: ' . $rows['totalCount'] . '}';
-            $oAppCache = new AppCacheView();
-            $rows = Array();
-            $uRole = Array();
-            while ($oDataset->next()) {
-                $row = $oDataset->getRow();
-
-                try {
-                    $uRole = $oRoles->loadByCode($row['USR_ROLE']);
-                } catch (exception $oError) {
-                    $uRole['ROL_NAME'] = G::loadTranslation('ID_DELETED');
-                }
-                /*----------------------------------********---------------------------------*/
-                if (true) {
-                    $total = $oParticipated->getCountList($row['USR_UID']);
-                } else {
-                /*----------------------------------********---------------------------------*/
-                    $total = $oAppCache->getListCounters('sent', $row['USR_UID'], false);
-                /*----------------------------------********---------------------------------*/
-                }
-                /*----------------------------------********---------------------------------*/
-                $row['USR_ROLE_ID'] = $row['USR_ROLE'];
-                $row['USR_ROLE'] = isset($uRole['ROL_NAME']) ? ($uRole['ROL_NAME'] != '' ? $uRole['ROL_NAME'] : $uRole['ROL_CODE']) : $uRole['ROL_CODE'];
-
-                $row['DUE_DATE_OK'] = (date('Y-m-d') > date('Y-m-d', strtotime($row['USR_DUE_DATE']))) ? 0 : 1;
-                $row['LAST_LOGIN'] = isset($row['USR_LAST_LOGIN']) ? \ProcessMaker\Util\DateTime::convertUtcToTimeZone($row['USR_LAST_LOGIN']) : '';
-                $row['TOTAL_CASES'] = $total;
-                $row['DEP_TITLE'] = isset($aDepart[$row['USR_UID']]) ? $aDepart[$row['USR_UID']] : '';
-                $row['USR_UX'] = isset($uxList[$row['USR_UX']]) ? $uxList[$row['USR_UX']] : $uxList['NORMAL'];
-                $row['USR_AUTH_SOURCE'] = isset($aAuthSources[$row['USR_UID']]) ? $aAuthSources[$row['USR_UID']] : 'ProcessMaker (MYSQL)';
-
-                $rows[] = $row;
-            }
-
-            echo '{users: ' . G::json_encode($rows) . ', total_users: ' . $totalRows . '}';
             break;
         case 'updatePageSize':
             G::LoadClass('configuration');
@@ -533,6 +332,7 @@ try {
             echo '{success: true}';
             break;
         case 'summaryUserData':
+            //Get all information for the summary
             require_once 'classes/model/Users.php';
             require_once 'classes/model/Department.php';
             require_once 'classes/model/AppCacheView.php';
@@ -574,25 +374,16 @@ try {
             break;
 
         case "verifyIfUserAssignedAsSupervisor":
+            //Before delete we check if is supervisor
+            $supervisor = new \ProcessMaker\BusinessModel\ProcessSupervisor();
+            $isSupervisor = $supervisor->isUserSupervisor($_POST["supervisorUserUid"]);
             $supervisorUserUid = $_POST["supervisorUserUid"];
-            $message = "OK";
+            $message = 'OK';
-
+            if ($isSupervisor) {
-            $criteria = new Criteria("workflow");
+                $message = 'ERROR';
-
-            $criteria->addSelectColumn(ProcessUserPeer::PU_UID);
-            $criteria->add(ProcessUserPeer::USR_UID, $supervisorUserUid, Criteria::EQUAL);
-            $criteria->add(ProcessUserPeer::PU_TYPE, "SUPERVISOR", Criteria::EQUAL);
-
-            $rsCriteria = ProcessUserPeer::doSelectRS($criteria);
-            $rsCriteria->setFetchmode(ResultSet::FETCHMODE_ASSOC);
-
-            if ($rsCriteria->next()) {
-                $message = "ERROR";
             }
-
             $response = array();
             $response["result"] = $message;
-
             echo G::json_encode($response);
             break;
     }

workflow/engine/src/ProcessMaker/BusinessModel/Cases.php

@@ -3283,4 +3283,50 @@ class Cases
         }
         return $delIndex;
     }
+    /**
+     * This function will be return the criteria for the search filter
+     *
+     * We considered in the search criteria the custom cases list,
+     * the titles related to: caseTitle taskTitle processTitle and
+     * the case number
+     * @param Criteria $criteria, must be contain the initial criteria for search
+     * @param string $listPeer, name of the list class
+     * @param string $search, the parameter for search in the table
+     * @param string $additionalClassName, name of the className of pmtable
+     * @param array $additionalColumns, columns related to the custom cases list
+     * @throws PropelException
+     */
+    public function getSearchCriteriaListCases(&$criteria, $listPeer ,$search, $additionalClassName = '', $additionalColumns = array() )
+    {
+        $oTmpCriteria = '';
+        //If we have additional tables configured in the custom cases list, prepare the variables for search
+        if (count($additionalColumns) > 0) {
+            require_once(PATH_DATA_SITE . 'classes' . PATH_SEP . $additionalClassName . '.php');
+            $oNewCriteria = new \Criteria("workflow");
+            $oTmpCriteria = $oNewCriteria->getNewCriterion(current($additionalColumns), "%" . $search . "%", \Criteria::LIKE);
+
+            //We prepare the query related to the custom cases list
+            foreach (array_slice($additionalColumns, 1) as $value) {
+                $oTmpCriteria = $oNewCriteria->getNewCriterion($value, "%" . $search . "%", \Criteria::LIKE)->addOr($oTmpCriteria);
+            }
+        }
+
+        if (!empty($oTmpCriteria)) {
+            $criteria->add(
+                $criteria->getNewCriterion($listPeer::APP_TITLE, '%' . $search . '%', \Criteria::LIKE)->addOr(
+                $criteria->getNewCriterion($listPeer::APP_TAS_TITLE, '%' . $search . '%', \Criteria::LIKE)->addOr(
+                $criteria->getNewCriterion($listPeer::APP_PRO_TITLE, '%' . $search . '%', \Criteria::LIKE)->addOr(
+                $criteria->getNewCriterion($listPeer::APP_NUMBER, $search, \Criteria::EQUAL)->addOr(
+                    $oTmpCriteria
+                ))))
+            );
+        } else {
+            $criteria->add(
+                $criteria->getNewCriterion($listPeer::APP_TITLE, '%' . $search . '%', \Criteria::LIKE)->addOr(
+                $criteria->getNewCriterion($listPeer::APP_TAS_TITLE, '%' . $search . '%', \Criteria::LIKE)->addOr(
+                $criteria->getNewCriterion($listPeer::APP_PRO_TITLE, '%' . $search . '%', \Criteria::LIKE)->addOr(
+                $criteria->getNewCriterion($listPeer::APP_NUMBER, $search, \Criteria::EQUAL))))
+            );
+        }
+    }
 }

workflow/engine/src/ProcessMaker/BusinessModel/Light.php

@@ -1017,7 +1017,7 @@ class Light
     {
         $response = array("status" => "fail");
         $oCase = new \Cases();
-        $iDelIndex = $oCase->getCurrentDelegation( $sAppUid, $userUid );
+        $iDelIndex = $oCase->getCurrentDelegation( $sAppUid, '', true );
 
         $oAppDelegation = new \AppDelegation();
         $aDelegation = $oAppDelegation->load( $sAppUid, $iDelIndex );

workflow/engine/src/ProcessMaker/BusinessModel/Light/Tracker.php

@@ -13,14 +13,14 @@ class Tracker
     }
 
     /**
-     * authenticaction for case tracker
+     * Authentication for case tracker
      *
-     * @param $case numbre case
+     * @param int $case number case
-     * @param $pin code pin access for case tracek
+     * @param int $pin code pin access for case track
      * @return array
      * @throws \Exception
      */
-    public function authentication($case, $pin)
+    public static function authentication($case, $pin)
     {
         $cases = new \Cases();
         $response = array();

workflow/engine/src/ProcessMaker/BusinessModel/Migrator/GranularExporter.php

@@ -12,6 +12,7 @@ class GranularExporter
     protected $generator;
     protected $data;
     protected $prjuid;
+    protected $prjName = '';
     /**
      * GranularExporter constructor.
      */
@@ -60,6 +61,7 @@ class GranularExporter
         $objectList = func_get_args()[0];
         $bpmnProject = Project\Bpmn::load($this->prjuid);
         $projectData = $bpmnProject->getProject();
+        $this->prjName = $projectData['PRJ_NAME'];
         $getProjectName = $this->publisher->truncateName($projectData['PRJ_NAME'], false);
         $outputDir = PATH_DATA . "sites" . PATH_SEP . SYS_SYS . PATH_SEP . "files" . PATH_SEP . "output" . PATH_SEP;
         $version = \ProcessMaker\Util\Common::getLastVersion($outputDir . $getProjectName . "-*.pmx2") + 1;
@@ -184,4 +186,12 @@ class GranularExporter
             )
         );
     }
+    /**
+    * Get the project name
+    */
+    public function getProjectName()
+    {
+        return $this->prjName;
+    }
+
 }

workflow/engine/src/ProcessMaker/BusinessModel/ProcessSupervisor.php

@@ -1461,4 +1461,37 @@ class ProcessSupervisor
             throw $e;
         }
     }
+    /**
+     * Check if the user is supervisor for some process
+     *
+     * @param string $userUid Unique id of User
+     *
+     * @return bool Return
+     */
+    public function isUserSupervisor($userUid)
+    {
+        //Check if the user is defined as supervisor
+        $criteria = new \Criteria('workflow');
+        $criteria->add(\ProcessUserPeer::USR_UID, $userUid, \Criteria::EQUAL);
+        $criteria->add(\ProcessUserPeer::PU_TYPE, 'SUPERVISOR', \Criteria::EQUAL);
+        $rsCriteria = \ProcessUserPeer::doSelectRS($criteria);
+        $rsCriteria->setFetchmode(\ResultSet::FETCHMODE_ASSOC);
+
+        if ($rsCriteria->next()) {
+            return true;
+        }
+        //Check if the user is in a group defined as supervisor
+        $criteria = new \Criteria('workflow');
+        $criteria->addSelectColumn(\ProcessUserPeer::USR_UID);
+        $criteria->addJoin(\ProcessUserPeer::USR_UID, \GroupUserPeer::GRP_UID, \Criteria::LEFT_JOIN);
+        $criteria->add(\ProcessUserPeer::PU_TYPE, 'GROUP_SUPERVISOR', \Criteria::EQUAL);
+        $criteria->add(\GroupUserPeer::USR_UID, $userUid, \Criteria::EQUAL);
+        $rsCriteria = \ProcessUserPeer::doSelectRS($criteria);
+        $rsCriteria->setFetchmode(\ResultSet::FETCHMODE_ASSOC);
+
+        if ($rsCriteria->next()) {
+            return true;
+        }
+        return false;
+    }
 }

workflow/engine/src/ProcessMaker/BusinessModel/User.php

@@ -1544,5 +1544,163 @@ class User
             throw $e;
         }
     }
+    /**
+     * This function get the list of users
+     *
+     * @param string $authSource, authentication source
+     * @param string $filter
+     * @param string $sort
+     * @param integer $start
+     * @param integer $limit
+     * @param string $dir related to order the column
+     *
+     * @return void
+     */
+    public function getAllUsersWithAuthSource(
+        $authSource = '',
+        $filter = '',
+        $sort = '',
+        $start = 0,
+        $limit = 20,
+        $dir = 'ASC'
+    )
+    {
+        global $RBAC;
+        $aUsers = array();
+        if ($authSource != '') {
+            $aUsers = $RBAC->getListUsersByAuthSource($authSource);
+        }
+        $oCriteria = new \Criteria('workflow');
+        $oCriteria->addSelectColumn('COUNT(*) AS CNT');
+        if ($filter != '') {
+            $cc = $oCriteria->getNewCriterion(\UsersPeer::USR_USERNAME, '%' . $filter . '%', \Criteria::LIKE)
+            ->addOr($oCriteria->getNewCriterion(\UsersPeer::USR_FIRSTNAME, '%' . $filter . '%', \Criteria::LIKE)
+            ->addOr($oCriteria->getNewCriterion(\UsersPeer::USR_LASTNAME, '%' . $filter . '%', \Criteria::LIKE)
+            ->addOr($oCriteria->getNewCriterion(\UsersPeer::USR_EMAIL, '%' . $filter . '%', \Criteria::LIKE))));
+            $oCriteria->add($cc);
+        }
+        $oCriteria->add(\UsersPeer::USR_STATUS, array('CLOSED'), \Criteria::NOT_IN);
+
+        if ($authSource != '') {
+            $totalRows = sizeof($aUsers);
+        } else {
+            $oDataset = \UsersPeer::DoSelectRs($oCriteria);
+            $oDataset->setFetchmode(\ResultSet::FETCHMODE_ASSOC);
+            $oDataset->next();
+            $row = $oDataset->getRow();
+            $totalRows = $row['CNT'];
+        }
+        $oCriteria->clearSelectColumns();
+        $oCriteria->addSelectColumn(\UsersPeer::USR_UID);
+        $oCriteria->addSelectColumn(\UsersPeer::USR_USERNAME);
+        $oCriteria->addSelectColumn(\UsersPeer::USR_FIRSTNAME);
+        $oCriteria->addSelectColumn(\UsersPeer::USR_LASTNAME);
+        $oCriteria->addSelectColumn(\UsersPeer::USR_EMAIL);
+        $oCriteria->addSelectColumn(\UsersPeer::USR_ROLE);
+        $oCriteria->addSelectColumn(\UsersPeer::USR_DUE_DATE);
+        $oCriteria->addSelectColumn(\UsersPeer::USR_STATUS);
+        $oCriteria->addSelectColumn(\UsersPeer::USR_UX);
+        $oCriteria->addSelectColumn(\UsersPeer::DEP_UID);
+        $oCriteria->addSelectColumn(\UsersPeer::USR_LAST_LOGIN);
+        $oCriteria->addAsColumn('LAST_LOGIN', 0);
+        $oCriteria->addAsColumn('DEP_TITLE', 0);
+        $oCriteria->addAsColumn('TOTAL_CASES', 0);
+        $oCriteria->addAsColumn('DUE_DATE_OK', 1);
+        $sep = "'";
+        $oCriteria->add(\UsersPeer::USR_STATUS, array('CLOSED'), \Criteria::NOT_IN);
+        if ($filter != '') {
+            $cc = $oCriteria->getNewCriterion(\UsersPeer::USR_USERNAME, '%' . $filter . '%', \Criteria::LIKE)
+            ->addOr($oCriteria->getNewCriterion(\UsersPeer::USR_FIRSTNAME, '%' . $filter . '%', \Criteria::LIKE)
+            ->addOr($oCriteria->getNewCriterion(\UsersPeer::USR_LASTNAME, '%' . $filter . '%', \Criteria::LIKE)
+            ->addOr($oCriteria->getNewCriterion(\UsersPeer::USR_EMAIL, '%' . $filter . '%', \Criteria::LIKE))));
+            $oCriteria->add($cc);
+        }
+        if (sizeof($aUsers) > 0) {
+            $oCriteria->add(\UsersPeer::USR_UID, $aUsers, \Criteria::IN);
+        } elseif ($totalRows == 0 && $authSource != '') {
+            $oCriteria->add(\UsersPeer::USR_UID, '', \Criteria::IN);
+        }
+        if ($sort != '') {
+            if ($dir == 'ASC') {
+                $oCriteria->addAscendingOrderByColumn($sort);
+            } else {
+                $oCriteria->addDescendingOrderByColumn($sort);
+            }
+        }
+        $oCriteria->setOffset($start);
+        $oCriteria->setLimit($limit);
+        $oDataset = \UsersPeer::DoSelectRs($oCriteria);
+        $oDataset->setFetchmode(\ResultSet::FETCHMODE_ASSOC);
+
+        return $oDataset;
+    }
+    /**
+     * This function get additional information related to the user
+     * Information about the department, rol, cases, authentication
+     *
+     * @param criteria $oDatasetUsers, criteria for search users
+     *
+     * @return array $dataUsers array of users with the additional information
+     */
+    public function getAdditionalInfoFromUsers($oDatasetUsers)
+    {
+        global $RBAC;
+        //Get the information about the department
+        $Department = new \Department();
+        $aDepart = $Department->getAllDepartmentsByUser();
+
+        //Get the authentication sources
+        $aAuthSources = $RBAC->getAllAuthSourcesByUser();
+
+        //Get roles
+        $oRoles = new \Roles();
+
+        //Get cases
+        $oParticipated = new \ListParticipatedLast();
+        $oAppCache = new \AppCacheView();
+
+        $rows = array();
+        $uRole = array();
+        $totalRows = 0;
+        $dataUsers = array();
+        while ($oDatasetUsers->next()) {
+            $totalRows++;
+            $row = $oDatasetUsers->getRow();
+
+            //Add the role information related to the user
+            try {
+                $uRole = $oRoles->loadByCode($row['USR_ROLE']);
+            } catch (\exception $oError) {
+                $uRole['ROL_NAME'] = G::loadTranslation('ID_DELETED');
+            }
+            $row['USR_ROLE_ID'] = $row['USR_ROLE'];
+            $row['USR_ROLE'] = isset($uRole['ROL_NAME']) ? ($uRole['ROL_NAME'] != '' ? $uRole['ROL_NAME'] : $uRole['ROL_CODE']) : $uRole['ROL_CODE'];
+
+            /*----------------------------------********---------------------------------*/
+            if (true) {
+                $total = $oParticipated->getCountList($row['USR_UID']);
+            } else {
+            /*----------------------------------********---------------------------------*/
+                $total = $oAppCache->getListCounters('sent', $row['USR_UID'], false);
+            /*----------------------------------********---------------------------------*/
+            }
+            /*----------------------------------********---------------------------------*/
+            $row['TOTAL_CASES'] = $total;
+
+            $row['DUE_DATE_OK'] = (date('Y-m-d') > date('Y-m-d', strtotime($row['USR_DUE_DATE']))) ? 0 : 1;
+            $row['LAST_LOGIN'] = isset($row['USR_LAST_LOGIN']) ? \ProcessMaker\Util\DateTime::convertUtcToTimeZone($row['USR_LAST_LOGIN']) : '';
+            //Add the department information related to the user
+            $row['DEP_TITLE'] = isset($aDepart[$row['USR_UID']]) ? $aDepart[$row['USR_UID']] : '';
+            //Add the authentication information related to the user
+            $row['USR_AUTH_SOURCE'] = isset($aAuthSources[$row['USR_UID']]) ? $aAuthSources[$row['USR_UID']] : 'ProcessMaker (MYSQL)';
+
+            $rows[] = $row;
+        }
+        $dataUsers['data'] = $rows;
+        $dataUsers['totalCount'] = $totalRows;
+
+        return $dataUsers;
+    }
+
 }
 

workflow/engine/src/ProcessMaker/Services/Api/Light/Tracker.php

@@ -21,8 +21,7 @@ class Tracker extends Api
     public function Authentication($case, $pin)
     {
         try {
-            $oMobile = new \ProcessMaker\BusinessModel\Light\Tracker();
+            $response = \ProcessMaker\BusinessModel\Light\Tracker::authentication($case, $pin);
-            $response = $oMobile->authentication($case, $pin);
         } catch (\Exception $e) {
             throw new RestException(Api::STAT_APP_EXCEPTION, $e->getMessage());
         }

workflow/engine/src/ProcessMaker/Services/Api/Project.php

@@ -163,6 +163,9 @@ class Project extends Api
             PATH_SEP . $outputFilename;
         $httpStream = new HttpStream();
         $fileExtension = pathinfo($outputFilename, PATHINFO_EXTENSION);
+
+        \G::auditLog('ExportProcess','Export process "' . $granularExporter->getProjectName() . '"');
+
         $httpStream->loadFromFile($outputFilename);
         $httpStream->setHeader("Content-Type", "application/xml; charset=UTF-8");
         $httpStream->send();
@@ -188,6 +191,8 @@ class Project extends Api
         $httpStream = new \ProcessMaker\Util\IO\HttpStream();
         $fileExtension = pathinfo($outputFilename, PATHINFO_EXTENSION);
 
+        \G::auditLog('ExportProcess','Export process "' . $exporter->getProjectName() . '"');
+
         $httpStream->loadFromFile($outputFilename);
         $httpStream->setHeader("Content-Type", "application/xml; charset=UTF-8");
         $httpStream->send();

workflow/engine/templates/installer/stopInstall.js

@@ -9,7 +9,7 @@ Ext.onReady(function() {
         title : _('ID_TITLE_NO_INSTALL'),
 
         items:[
-            {html: _('ID_NO_INSTALL')}
+            {html: messageError}
         ]
     });
 });

workflow/engine/templates/processes/main.js

@@ -408,9 +408,8 @@ Ext.onReady(function(){
   processesGrid = new Ext.grid.GridPanel( {
     region: 'center',
     layout: 'fit',
-    id: 'processesGrid',
+    id: 'granularGridPanel',
-    height:500,
+    height: 500,
-    //autoWidth : true,
     width:'',
     title : '',
     stateful : true,
@@ -421,13 +420,6 @@ Ext.onReady(function(){
     plugins: expander,
     cls : 'grid_with_checkbox',
     columnLines: true,
-
-
-    /*view: new Ext.grid.GroupingView({
-        //forceFit:true,
-        //groupTextTpl: '{text} ({[values.rs.length]} {[values.rs.length > 1 ? "Items" : "Item"]})'
-        groupTextTpl: '{text}'
-    }),*/
     viewConfig: {
       forceFit:true,
       cls:"x-grid-empty",