Merge remote branch 'pm/master'

2015-04-28 09:29:34 -04:00
parent d732c1eef5 6fdb3308af
commit b9e107d0ae
50 changed files with 331 additions and 156 deletions
--- a/workflow/engine/methods/authSources/authSources_Ajax.php
+++ b/workflow/engine/methods/authSources/authSources_Ajax.php
@@ -149,16 +149,30 @@ try {
            }
            break;
        case 'authSourcesNew':
+            $pluginRegistry = &PMPluginRegistry::getSingleton();
+
            $arr = Array ();
            $oDirectory = dir( PATH_RBAC . 'plugins' . PATH_SEP );
-            $aAuthSourceTypes = array ();
+
            while ($sObject = $oDirectory->read()) {
                if (($sObject != '.') && ($sObject != '..') && ($sObject != '.svn') && ($sObject != 'ldap')) {
                    if (is_file( PATH_RBAC . 'plugins' . PATH_SEP . $sObject )) {
-                        $sType = trim( str_replace( 'class.', '', str_replace( '.php', '', $sObject ) ) );
-                        $aAuthSourceTypes['sType'] = $sType;
-                        $aAuthSourceTypes['sLabel'] = $sType;
-                        $arr[] = $aAuthSourceTypes;
+                        $sType = trim(str_replace(array("class.", ".php"), "", $sObject));
+
+                        $statusPlugin = $pluginRegistry->getStatusPlugin($sType);
+                        $flagAdd = false;
+
+                        if (preg_match("/^(?:enabled|disabled)$/", $statusPlugin)) {
+                            if ($statusPlugin == "enabled") {
+                                $flagAdd = true;
+                            }
+                        } else {
+                            $flagAdd = true;
+                        }
+
+                        if ($flagAdd) {
+                            $arr[] = array("sType" => $sType, "sLabel" => $sType);
+                        }
                    }
                }
            }
--- a/workflow/engine/methods/cases/caseHistory_Ajax.php
+++ b/workflow/engine/methods/cases/caseHistory_Ajax.php
@@ -137,7 +137,7 @@ if ($actionAjax == "showDynaformHistoryGetNomDynaform_JXP") {
        $dynTitle = $contentObjeto->getConValue();
    }

-    $md5Hash = md5( $idDin . $dynDate );
+    $md5Hash = G::encryptOld( $idDin . $dynDate );

    //assign task
    $result = new stdClass();
--- a/workflow/engine/methods/cases/casesListExtJs.php
+++ b/workflow/engine/methods/cases/casesListExtJs.php
@@ -42,6 +42,12 @@ switch ($action) {
        $urlProxy = 'proxyCasesList';
        $action = 'unassigned';
        break;
+    case 'to_revise':
+        $urlProxy = 'proxyCasesList';
+        break;
+    case 'to_reassign':
+        $urlProxy = 'proxyCasesList';
+        break;
 }
 /*----------------------------------********---------------------------------*/

--- a/workflow/engine/methods/cases/cases_StepToRevise.php
+++ b/workflow/engine/methods/cases/cases_StepToRevise.php
@@ -138,7 +138,7 @@ if (! isset( $_GET['ex'] )) {
 // DEPRECATED this JS section is marked for removal
 function setSelect()
 {
-  var ex=<?php echo $_GET['ex']?>;
+  var ex=<?php echo $filter->xssFilterHard($_GET['ex'])?>;
  try {
    for(i=1; i<50; i++) {
      if (i == ex) {
--- a/workflow/engine/methods/cases/cases_StepToReviseInputs.php
+++ b/workflow/engine/methods/cases/cases_StepToReviseInputs.php
@@ -140,7 +140,7 @@ G::RenderPage( 'publish', 'blank' );
 //Deprecated Section since the interface are now movig to ExtJS
 function setSelect()
 {
-    var ex=<?php echo $_GET['ex']?>;
+    var ex=<?php echo $filter->xssFilterHard($_GET['ex'])?>;
    try {
        for (i=1; i<50; i++) {
            if (i == ex) {
--- a/workflow/engine/methods/cases/cases_StepToReviseOutputs.php
+++ b/workflow/engine/methods/cases/cases_StepToReviseOutputs.php
@@ -84,7 +84,7 @@ if (! isset( $_GET['ex'] )) {
 //Deprecated Section since the interface are now movig to ExtJS
 function setSelect()
 {
-    var ex=<?php echo $_GET['ex']?>;
+    var ex=<?php echo $filter->xssFilterHard($_GET['ex'])?>;
    try{
        for (i=1; i<50; i++) {
            if (i == ex) {
--- a/workflow/engine/methods/cases/cases_ToReviseOutputDocView.php
+++ b/workflow/engine/methods/cases/cases_ToReviseOutputDocView.php
@@ -104,7 +104,7 @@ if (! isset( $_GET['ex'] )) {
 /*------------------------------ To Revise Routines ---------------------------*/
 function setSelect()
 {
-  var ex=<?php echo $_GET['ex']?>;
+  var ex=<?php echo $filter->xssFilterHard($_GET['ex'])?>;
  try{
    for(i=1; i<50; i++)
    {
--- a/workflow/engine/methods/dynaforms/dynaforms_FlatEditor.php
+++ b/workflow/engine/methods/dynaforms/dynaforms_FlatEditor.php
@@ -170,12 +170,12 @@ G::RenderPage( "publish", "raw" );
 <script>
  var toolbar = document.getElementById('fields_Toolbar')
  var fieldsList = document.getElementById('dynaformEditor[0]')
-  var tableHeight=<?php echo $config['FieldsList']['height'] ?>;
-  var tableWidth=<?php echo $config['FieldsList']['width'] ?>;
-  var toolbarTop=<?php echo $config['Toolbar']['top'] ?>;
-  var toolbarLeft=<?php echo $config['Toolbar']['left'] ?>;
-  var fieldsListTop=<?php echo $config['FieldsList']['top'] ?>//(toolbarTop+toolbar.clientHeight+44+8 );
-  var fieldsListLeft=<?php echo $config['FieldsList']['left'] ?>;
+  var tableHeight=<?php echo $filter->xssFilterHard($config['FieldsList']['height']) ?>;
+  var tableWidth=<?php echo $filter->xssFilterHard($config['FieldsList']['width']) ?>;
+  var toolbarTop=<?php echo $filter->xssFilterHard($config['Toolbar']['top']) ?>;
+  var toolbarLeft=<?php echo $filter->xssFilterHard($config['Toolbar']['left']) ?>;
+  var fieldsListTop=<?php echo $filter->xssFilterHard($config['FieldsList']['top']) ?>//(toolbarTop+toolbar.clientHeight+44+8 );
+  var fieldsListLeft=<?php echo $filter->xssFilterHard($config['FieldsList']['left']) ?>;
  mainPanel.elements.headerBar.style.backgroundColor='#CBDAEF';
  mainPanel.elements.headerBar.style.borderBottom='1px solid #808080';
  mainPanel.elements.headerBar.appendChild(toolbar);
--- a/workflow/engine/methods/enterprise/addonsStoreAction.php
+++ b/workflow/engine/methods/enterprise/addonsStoreAction.php
@@ -269,7 +269,7 @@ try {
                }

                ///////
-                $boundary = "---------------------" . substr(md5(rand(0, 32000)), 0, 10);
+                $boundary = "---------------------" . substr(G::encryptOld(rand(0, 32000)), 0, 10);
                $data = null;

                $data = $data . "--$boundary\n";
--- a/workflow/engine/methods/install/r.php
+++ b/workflow/engine/methods/install/r.php
@@ -2,25 +2,25 @@
 G::LoadSystem('inputfilter');
 $filter = new InputFilter();
 if(isset($_GET['srv'])) {
-    $_GET['srv'] = $filter->xssFilterHard($_GET['srv']);
+    $srv = $filter->xssFilterHard($_GET['srv']);
 }
 if(isset($_GET['usr'])) {
-    $_GET['usr'] = $filter->xssFilterHard($_GET['usr']);
+    $usr = $filter->xssFilterHard($_GET['usr']);
 }
 if(isset($_GET['pass'])) {
-    $_GET['pass'] = $filter->xssFilterHard($_GET['pass']);
+    $pass = $filter->xssFilterHard($_GET['pass']);
 }
 if(isset($_GET['gen'])) {
-    $_GET['gen'] = $filter->xssFilterHard($_GET['gen']);
+    $gen = $filter->xssFilterHard($_GET['gen']);
 }
 ?>
 <form action="r">
 	Server: <input type="text" name="srv"
-		value="<?php echo isset($_GET['srv'])?$_GET['srv']:'';?>"> User: <input
+		value="<?php echo isset($srv)? $srv:'';?>"> User: <input
 		type="text" name="usr"
-		value="<?php echo isset($_GET['usr'])?$_GET['usr']:'';?>" /> Passwd: <input
+		value="<?php echo isset($usr)? $usr:'';?>" /> Passwd: <input
 		type="text" name="pass"
-		value="<?php echo isset($_GET['pass'])?$_GET['pass']:'';?>" /> <input
+		value="<?php echo isset($pass)? $pass:'';?>" /> <input
 		type="submit" value="Gen" name="gen" /> <input type="submit"
 		value="Regenerate paths_installed" name="reg" /><br />
 </form>
@@ -28,14 +28,18 @@ if(isset($_GET['gen'])) {

 if (isset( $_GET['gen'] )) {
    $sh = G::encryptOld( filemtime( PATH_GULLIVER . "/class.g.php" ) );
+    $sh = $filter->xssFilterHard($sh);
    $h = G::encrypt( $_GET['srv'] . $sh . $_GET['usr'] . $sh . $_GET['pass'] . $sh . (1), $sh );
+    $h = $filter->xssFilterHard($h);
    echo "HASH_INSTALLATION<br/>";
    echo "<textarea cols=120>$h</textarea><br/>";
    echo "SYSTEM_HASH<br/>";
    echo "<textarea cols=120>$sh</textarea>";
 } elseif (isset( $_GET['reg'] )) {
    $sh = G::encryptOld( filemtime( PATH_GULLIVER . "/class.g.php" ) );
+    $sh = $filter->xssFilterHard($sh);
    $h = G::encrypt( $_GET['srv'] . $sh . $_GET['usr'] . $sh . $_GET['pass'] . $sh . (1), $sh );
+    $h = $filter->xssFilterHard($h);
    echo "HASH_INSTALLATION<br/>";
    echo "<textarea cols=120>$h</textarea><br/>";
    echo "SYSTEM_HASH<br/>";
--- a/workflow/engine/methods/setup/appCacheViewAjax.php
+++ b/workflow/engine/methods/setup/appCacheViewAjax.php
@@ -302,7 +302,7 @@ switch ($request) {
        list($sucess, $msgErr) = testConnection(DB_ADAPTER, $serverName, $user, $passwd, $port);

        if ($sucess) {
-            $sh = md5( filemtime( PATH_GULLIVER . "/class.g.php" ) );
+            $sh = G::encryptOld( filemtime( PATH_GULLIVER . "/class.g.php" ) );
            $h = G::encrypt( $_POST['host'] . $sh . $_POST['user'] . $sh . $_POST['password'] . $sh . (1), $sh );
            $insertStatements = "define ( 'HASH_INSTALLATION','{$h}' );  \ndefine ( 'SYSTEM_HASH', '{$sh}' ); \n";
            $lines = array ();
--- a/workflow/engine/methods/setup/pluginsRemove.php
+++ b/workflow/engine/methods/setup/pluginsRemove.php
@@ -39,7 +39,8 @@ switch ($RBAC->userCanAccess('PM_SETUP_ADVANCE'))
 }*/

 G::LoadClass( "plugin" );
-
+G::LoadSystem('inputfilter');
+$filter = new InputFilter();
 $pluginName = $_REQUEST["pluginUid"];

 if (file_exists( PATH_PLUGINS . $pluginName . ".php" )) {
@@ -50,5 +51,5 @@ if (file_exists( PATH_PLUGINS . $pluginName . ".php" )) {
    $pluginRegistry->unSerializeInstance( file_get_contents( PATH_DATA_SITE . "plugin.singleton" ) );
 }
 G::auditLog("RemovePlugin","Plugin Name: ".$pluginName);
-echo $pluginName . " " . nl2br( G::LoadTranslation( "ID_MSG_REMOVE_PLUGIN_SUCCESS" ) );
+echo $pluginName . " " . nl2br( $filter->xssFilterHard(G::LoadTranslation( "ID_MSG_REMOVE_PLUGIN_SUCCESS" )) );