Merge remote branch 'upstream/master' into PM-2633

gulliver/system/class.g.php

@@ -463,10 +463,17 @@ class G
      * @return void
      */
     public static function LoadSystem ($strClass)
-    {   require_once (PATH_GULLIVER . 'class.inputfilter.php');
+    {   
-        $filter = new InputFilter();
         $path  = PATH_GULLIVER . 'class.' . $strClass . '.php';
-        $path  = $filter->validateInput($path, 'path');
+        if(file_exists(PATH_GULLIVER . 'class.inputfilter.php')) {  
+            require_once (PATH_GULLIVER . 'class.inputfilter.php');
+            $filter = new InputFilter();
+            $path  = $filter->validateInput($path, 'path');
+        } else {
+            if(!file_exists($path)) {
+                $path = '';
+            }
+        }
         require_once ($path);
     }
 
@@ -2656,6 +2663,7 @@ class G
             $path = $filter->validateInput($path, "path");
 
             move_uploaded_file( $file, $path . "/" . $nameToSave );
+            $nameToSave = $filter->validateInput($nameToSave, "path");
             @chmod( $path . "/" . $nameToSave, $permission );
             umask( $oldumask );
 

gulliver/thirdparty/pear/HTTP/WebDAV/Server/Filesystem.php

@@ -634,15 +634,29 @@
             $dir = dirname($path)."/";
             $base = basename($path);
             
+            if (!class_exists('G')) {
+                $realdocuroot = str_replace( '\\', '/', $_SERVER['DOCUMENT_ROOT'] );
+                $docuroot = explode( '/', $realdocuroot );
+                array_pop( $docuroot );
+                $pathhome = implode( '/', $docuroot ) . '/';  
+                array_pop( $docuroot );
+                $pathTrunk = implode( '/', $docuroot ) . '/';  
+                require_once($pathTrunk.'gulliver/system/class.g.php');
+            }
+            G::LoadSystem('inputfilter');
+            $filter = new InputFilter();
+            
             foreach($options["props"] as $key => $prop) {
                 if ($prop["ns"] == "DAV:") {
                     $options["props"][$key]['status'] = "403 Forbidden";
                 } else {
                     if (isset($prop["val"])) {
-                        $query = "REPLACE INTO properties SET path = '$options[path]', name = '$prop[name]', ns= '$prop[ns]', value = '$prop[val]'";
+                        $query = "REPLACE INTO properties SET path = '%s', name = '%s', ns= '%s', value = '%s'";
+                        $query = $filter->preventSqlInjection($query, Array($options['path'],$prop['name'],$prop['ns'],$prop['val']));
                         error_log($query);
                     } else {
-                        $query = "DELETE FROM properties WHERE path = '$options[path]' AND name = '$prop[name]' AND ns = '$prop[ns]'";
+                        $query = "DELETE FROM properties WHERE path = '%s' AND name = '%s' AND ns = '%s'";
+                        $query = $filter->preventSqlInjection($query, Array($options['path'],$prop['name'],$prop['ns']));
                     }       
                     mysql_query($query);
                 }

workflow/engine/classes/class.processes.php

@@ -969,6 +969,18 @@ class Processes
             }
         }
 
+        if (isset($oData->taskExtraProperties)) {
+            foreach ($oData->taskExtraProperties as $key => $value) {
+                $record = $value;
+
+                if (isset($map[$record["OBJ_UID"]])) {
+                    $newUid = $map[$record["OBJ_UID"]];
+
+                    $oData->taskExtraProperties[$key]["OBJ_UID"] = $newUid;
+                }
+            }
+        }
+
         if (isset($oData->webEntry)) {
             foreach ($oData->webEntry as $key => $value) {
                 $record = $value;

workflow/engine/classes/class.tasks.php

@@ -391,12 +391,23 @@ class Tasks
             $oCriteria = new Criteria('workflow');
             $oCriteria->add(ObjectPermissionPeer::OP_TASK_SOURCE, $sTaskUID);
             ObjectPermissionPeer::doDelete($oCriteria);
+
+            //Delete Cases Schedulers
+            $criteria = new Criteria("workflow");
+
+            $criteria->add(CaseSchedulerPeer::TAS_UID, $sTaskUID, Criteria::EQUAL);
+
+            $result = CaseSchedulerPeer::doDelete($criteria);
+
+            //Delete Configuration
+            $criteria = new Criteria("workflow");
+
+            $criteria->add(ConfigurationPeer::OBJ_UID, $sTaskUID, Criteria::EQUAL);
+
+            $result = ConfigurationPeer::doDelete($criteria);
+
             //Delete task
             $oTask->remove($sTaskUID);
-            //Delete cases schedulers added by krlos
-            $oCriteria = new Criteria('workflow');
-            $oCriteria->add(CaseSchedulerPeer::TAS_UID, $sTaskUID);
-            CaseSchedulerPeer::doDelete($oCriteria);
         } catch (Exception $oError) {
             throw ($oError);
         }
@@ -855,4 +866,4 @@ class Tasks
         }
     }
 }
- 
+

workflow/engine/classes/class.webdav.php

@@ -902,16 +902,21 @@ class ProcessMakerWebDav extends HTTP_WebDAV_Server
 
         $dir = dirname($path) . "/";
         $base = basename($path);
+        
+        G::LoadSystem('inputfilter');
+        $filter = new InputFilter();
 
         foreach ($options["props"] as $key => $prop) {
             if ($prop["ns"] == "DAV:") {
                 $options["props"][$key]['status'] = "403 Forbidden";
             } else {
                 if (isset($prop["val"])) {
-                    $query = "REPLACE INTO properties SET path = '$options[path]', name = '$prop[name]', ns= '$prop[ns]', value = '$prop[val]'";
+                    $query = "REPLACE INTO properties SET path = '%s', name = '%s', ns= '%s', value = '%s'";
+                    $query = $filter->preventSqlInjection($query, Array($options['path'],$prop['name'],$prop['ns'],$prop['val']));
                     error_log($query);
                 } else {
-                    $query = "DELETE FROM properties WHERE path = '$options[path]' AND name = '$prop[name]' AND ns = '$prop[ns]'";
+                    $query = "DELETE FROM properties WHERE path = '%s' AND name = '%s' AND ns = '%s'";
+                    $query = $filter->preventSqlInjection($query, Array($options['path'],$prop['name'],$prop['ns']));
                 }
                 mysql_query($query);
             }

workflow/engine/classes/model/Configuration.php

@@ -1,28 +1,42 @@
 <?php
 class Configuration extends BaseConfiguration
 {
-    public function create($aData)
+    public function create(array $arrayData)
     {
-        $con = Propel::getConnection(ConfigurationPeer::DATABASE_NAME);
+        $cnn = Propel::getConnection(ConfigurationPeer::DATABASE_NAME);
+
         try {
-            $con->begin();
+            $configuration = new Configuration();
-            $this->setCfgUid($aData['CFG_UID']);
+
-            $this->setObjUid($aData['OBJ_UID']);
+            $configuration->setCfgUid($arrayData["CFG_UID"]);
-            $this->setCfgValue(isset($aData['CFG_VALUE'])?$aData['CFG_VALUE']:'');
+            $configuration->setObjUid($arrayData["OBJ_UID"]);
-            $this->setProUid($aData['PRO_UID']);
+            $configuration->setCfgValue((isset($arrayData["CFG_VALUE"]))? $arrayData["CFG_VALUE"] : "");
-            $this->setUsrUid($aData['USR_UID']);
+            $configuration->setProUid($arrayData["PRO_UID"]);
-            $this->setAppUid($aData['APP_UID']);
+            $configuration->setUsrUid($arrayData["USR_UID"]);
-            if ($this->validate()) {
+            $configuration->setAppUid($arrayData["APP_UID"]);
-                $result=$this->save();
+
-                $con->commit();
+            if ($configuration->validate()) {
+                $cnn->begin();
+
+                $result = $configuration->save();
+
+                $cnn->commit();
+
+                //Return
                 return $result;
             } else {
-                $con->rollback();
+                $msg = "";
-                throw(new Exception("Failed Validation in class ".get_class($this)."."));
+
+                foreach ($configuration->getValidationFailures() as $validationFailure) {
+                    $msg = $msg . (($msg != "")? "\n" : "") . $validationFailure->getMessage();
+                }
+
+                throw new Exception(G::LoadTranslation("ID_RECORD_CANNOT_BE_CREATED") . (($msg != "")? "\n" . $msg : ""));
             }
         } catch (Exception $e) {
-            $con->rollback();
+            $cnn->rollback();
-            throw($e);
+
+            throw $e;
         }
     }
 

workflow/engine/controllers/installer.php

@@ -315,6 +315,10 @@ class Installer extends Controller
                 $info->success = false;
             }
         }
+        
+        G::LoadSystem('inputfilter');
+        $filter = new InputFilter();
+        $pathShared = $filter->validateInput($_REQUEST['pathShared'], 'path');
 
         if ($info->pathShared->result) {
             $aux = pathinfo( $_REQUEST['pathLogFile'] );
@@ -322,7 +326,7 @@ class Installer extends Controller
             if (is_dir( $aux['dirname'] )) {
                 if (! file_exists( $_REQUEST['pathLogFile'] )) {
                     @file_put_contents( $_REQUEST['pathLogFile'], '' );
-                    @chmod($_REQUEST['pathShared'], 0770);
+                    @chmod($pathShared , 0770);
                 }
             }
         }
@@ -388,7 +392,11 @@ class Installer extends Controller
                 return $false;
             }
         }
-
+        
+        G::LoadSystem('inputfilter');
+        $filter = new InputFilter();
+        $logFile = $filter->validateInput($logFile, 'path');
+        
         $fpt = fopen( $logFile, 'a' );
         fwrite( $fpt, sprintf( "%s %s\n", date( 'Y:m:d H:i:s' ), trim( $text ) ) );
         fclose( $fpt );

workflow/engine/src/ProcessMaker/BusinessModel/CaseScheduler.php

@@ -1005,9 +1005,7 @@ class CaseScheduler
                 case "UPD":
                     $arrayDataAux = $caseScheduler->load($caseSchedulerUid);
 
-                    if ($arrayData["SCH_END_DATE"] != "") {
+                    $arrayCaseSchedulerData["SCH_END_DATE"] = $arrayData["SCH_END_DATE"];
-                        $arrayCaseSchedulerData["SCH_END_DATE"] = $arrayData["SCH_END_DATE"];
-                    }
 
                     //If the start date has changed then recalculate the next run time
                     $recalculateDate = ($arrayData["SCH_START_DATE"] == $arrayData["PREV_SCH_START_DATE"])? false : true;