SuiteCRM 7.13.1 Release

salesagility · Jan 23, 2023 · 3dc487a · 3dc487a
1 parent b3381b2
commit 3dc487a
Show file tree

Hide file tree

Showing 21 changed files with 354 additions and 109 deletions.
diff --git a/Api/V8/JsonApi/Helper/AttributeObjectHelper.php b/Api/V8/JsonApi/Helper/AttributeObjectHelper.php
@@ -29,6 +29,24 @@ public function getAttributes(\SugarBean $bean, $fields = null)
     {
         $bean->fixUpFormatting();
 
+        $allowedField = [];
+
+        $fieldsToParse = $fields;
+        if (empty($fields)) {
+            $fieldsToParse =  array_keys($bean->field_defs);
+        }
+
+        foreach ($fieldsToParse ?? [] as $index => $field) {
+            $isSensitive = isTrue($bean->field_defs[$field]['sensitive'] ?? false);
+            $notApiVisible = isFalse($bean->field_defs[$field]['api-visible'] ?? true);
+
+            if ($isSensitive || $notApiVisible){
+                continue;
+            }
+
+            $allowedField[$index] = $field;
+        }
+
         // using the ISO 8601 format for dates
         $attributes = array_map(function ($value) {
             return is_string($value)
@@ -38,8 +56,8 @@ public function getAttributes(\SugarBean $bean, $fields = null)
                 : $value;
         }, $bean->toArray());
 
-        if ($fields !== null) {
-            $attributes = array_intersect_key($attributes, array_flip($fields));
+        if ($allowedField !== null) {
+            $attributes = array_intersect_key($attributes, array_flip($allowedField));
         }
 
         unset($attributes['id']);

diff --git a/README.md b/README.md
@@ -2,7 +2,7 @@
   <img width="180px" height="41px" src="https://suitecrm.com/wp-content/uploads/2017/12/logo.png" align="right" />
 </a>
 
-# SuiteCRM 7.13.0
+# SuiteCRM 7.13.1
 
 [![Build Status](https://travis-ci.org/salesagility/SuiteCRM.svg?branch=hotfix)](https://travis-ci.org/salesagility/SuiteCRM)
 [![codecov](https://codecov.io/gh/salesagility/SuiteCRM/branch/hotfix/graph/badge.svg)](https://codecov.io/gh/salesagility/SuiteCRM/branch/hotfix)

diff --git a/data/BeanFactory.php b/data/BeanFactory.php
@@ -151,6 +151,51 @@ public static function getBean($module, $id = null, $params = [], $deleted = tru
         return $bean;
     }
 
+    /**
+     * Returns a SugarBean object by id.
+     *
+     * @static
+     *
+     * @param string $module
+     * @param string $id
+     * @param array $params
+     *        A name/value array of parameters. Names: encode, deleted.
+     *        If $params is boolean we revert to the old arguments (encode, deleted), and use $params as $encode.
+     *        This will be changed to using only $params in later versions.
+     * @param bool $deleted
+     *        @see SugarBean::retrieve
+     *
+     * @return SugarBean|bool
+     */
+    public static function getReloadedBean($module, $id = null, $params = [], $deleted = true)
+    {
+        $params = self::convertParams($params);
+        $encode = self::hasEncodeFlag($params);
+        $deleted = self::hasDeletedFlag($params, $deleted);
+
+        $beanClass = self::getBeanClass($module);
+
+        if (!self::loadBeanFile($module)) {
+            return false;
+        }
+
+        if (empty($id)) {
+            return new $beanClass();
+        }
+
+        /* @var SugarBean $bean */
+        $bean = new $beanClass();
+
+        $result = $bean->retrieve($id, $encode, $deleted);
+
+        if ($result === null) {
+            return false;
+        }
+
+        return $bean;
+    }
+
+
     /**
      * Shallow beans are created by SugarBean during the fill_in_relationship_fields method, and they differ from
      * 'complete' bean in that they do not have their own relate fields completed.

diff --git a/files.md5 b/files.md5
diff --git a/include/InlineEditing/InlineEditing.php b/include/InlineEditing/InlineEditing.php
@@ -52,6 +52,11 @@ function getEditFieldHTML($module, $fieldname, $aow_field, $view = 'EditView', $
         return false;
     }
 
+    $vardef = $bean->getFieldDefinition($fieldname);
+
+    if (isTrue($vardef['sensitive'] ?? false) || isFalse($vardef['api-visible'] ?? true)){
+        return false;
+    }
 
     $value = getFieldValueFromModule($fieldname, $module, $id);
     // use the mod_strings for this module
@@ -126,7 +131,7 @@ function getEditFieldHTML($module, $fieldname, $aow_field, $view = 'EditView', $
         if (isset($vardef['name']) && ($vardef['name'] == 'date_modified')) {
             $vardef['name'] = 'aow_temp_date';
         }
-        
+
         if (isset($vardef['help'])) {
             $vardef['help'] = htmlspecialchars($vardef['help'],ENT_QUOTES);
         }

diff --git a/include/MySugar/MySugar.php b/include/MySugar/MySugar.php
@@ -95,6 +95,11 @@ public function addDashlet()
 
             $dashlets = $current_user->getPreference('dashlets', $this->type);
 
+            if (!empty($_POST['type_module']) && stripos($_POST['type_module'], 'phar://') !== false) {
+                LoggerManager::getLogger()->security('MySugar:addDashlet unsecure type_module received: ' . $_POST['type_module']);
+                throw new RuntimeException('Invalid type_module');
+            }
+
             $guid = create_guid();
             $options = array();
             if (isset($_POST['type'], $_POST['type_module']) && $_POST['type'] == 'web') {

diff --git a/include/utils.php b/include/utils.php
@@ -206,6 +206,9 @@ function make_sugar_config(&$sugar_config)
             'php3',
             'php4',
             'php5',
+            'php6',
+            'php7',
+            'php8',
             'pl',
             'cgi',
             'py',
@@ -469,6 +472,9 @@ function get_sugar_config_defaults(): array
             'php3',
             'php4',
             'php5',
+            'php6',
+            'php7',
+            'php8',
             'pl',
             'cgi',
             'py',
@@ -486,7 +492,8 @@ function get_sugar_config_defaults(): array
             'png',
             'jpg',
             'jpeg',
-            'svg'
+            'svg',
+            'bmp'
         ],
         'allowed_preview' => [
             'pdf',
@@ -1353,7 +1360,7 @@ function return_module_language($language, $module, $refresh = false)
     global $currentModule;
 
     // Jenny - Bug 8119: Need to check if $module is not empty
-    if (empty($module)) {
+    if (empty($module) || !isAllowedModuleName($module)) {
         $GLOBALS['log']->warn('Variable module is not in return_module_language, see more info: debug_backtrace()');
 
         return array();
@@ -6076,3 +6083,22 @@ function isSmtp($value): bool {
 
     return strtolower($value)  === 'smtp';
 }
+
+/**
+ * Check if is string is an allowed module name
+ * @param string $value
+ * @return bool
+ */
+function isAllowedModuleName(string $value): bool {
+    if (empty($value)) {
+        return false;
+    }
+
+    $result = preg_match("/^[\w\-\_\.]+$/", $value);
+
+    if (!empty($result)) {
+        return true;
+    }
+
+    return false;
+}
diff --git a/install/install_utils.php b/install/install_utils.php
@@ -994,7 +994,7 @@ function handleHtaccess()
     $restrict_str .= <<<EOQ
 RedirectMatch 403 {$ignoreCase}.*\.log$
 RedirectMatch 403 {$ignoreCase}/+not_imported_.*\.txt
-RedirectMatch 403 {$ignoreCase}/+(soap|cache|xtemplate|data|examples|include|log4php|metadata|modules|vendor)/+.*\.(php|tpl)
+RedirectMatch 403 {$ignoreCase}/+(soap|cache|xtemplate|data|examples|include|log4php|metadata|modules|vendor)/+.*\.(php|tpl|phar)
 RedirectMatch 403 {$ignoreCase}/+emailmandelivery\.php
 RedirectMatch 403 {$ignoreCase}/+.git
 RedirectMatch 403 {$ignoreCase}/+.{$cacheDir}
@@ -1043,7 +1043,7 @@ function handleHtaccess()
 
  # CSS
  ExpiresByType text/css "access plus 1 year"
- 
+
  # Data
  ExpiresByType application/atom+xml "access plus 1 hour"
  ExpiresByType application/rdf+xml "access plus 1 hour"
@@ -1296,7 +1296,7 @@ function create_default_users()
     global $sugar_config;
 
     require_once('install/UserDemoData.php');
-    
+
     //Create default admin user
     $user = BeanFactory::newBean('Users');
     $user->id = 1;

diff --git a/lib/API/JsonApi/v1/Resource/SuiteBeanResource.php b/lib/API/JsonApi/v1/Resource/SuiteBeanResource.php
@@ -115,6 +115,13 @@ public function fromSugarBean($sugarBean, $source = ResourceEnum::DEFAULT_SOURCE
                 throw $exception;
             }
 
+            $isSensitive = isTrue($definition['sensitive'] ?? false);
+            $notApiVisible = isFalse($definition['api-visible'] ?? true);
+
+            if ($isSensitive || $notApiVisible){
+                continue;
+            }
+
             if ($definition['type'] === 'datetime' && isset($sugarBean->$fieldName)) {
                 // Convert to DB date
                 $datetime = $dateTimeConverter->fromUser($sugarBean->$fieldName);

diff --git a/modules/AOS_Products/AOS_Products.php b/modules/AOS_Products/AOS_Products.php
@@ -64,6 +64,12 @@ public function save($check_notify = false)
         require_once('include/upload_file.php');
         $GLOBALS['log']->debug('UPLOADING PRODUCT IMAGE');
 
+        $imageFileName = $_FILES['uploadimage']['name'] ?? '';
+        if (!has_valid_image_extension('AOS_Products Uploaded image file: ' . $imageFileName , $imageFileName)) {
+            LoggerManager::getLogger()->fatal("AOS_Products save - Invalid image file ext : '$imageFileName'.");
+            throw new RuntimeException('Invalid request');
+        }
+
         if (!empty($_FILES['uploadimage']['tmp_name']) && verify_uploaded_image($_FILES['uploadimage']['tmp_name'])) {
             if ($_FILES['uploadimage']['size'] > $sugar_config['upload_maxsize']) {
                 die($mod_strings['LBL_IMAGE_UPLOAD_FAIL'] . $sugar_config['upload_maxsize']);

diff --git a/modules/Administration/UpgradeWizard.php b/modules/Administration/UpgradeWizard.php
@@ -106,9 +106,15 @@ function unlinkTempFiles()
             $perform = true;
             $base_filename = urldecode($tempFile);
         } elseif (!empty($_REQUEST['load_module_from_dir'])) {
-            $moduleDir = $_REQUEST['load_module_from_dir'];
-            if (strpos($moduleDir, 'phar://') !== false) {
-                die();
+            $moduleDir = $_REQUEST['load_module_from_dir'] ?? '';
+            if (stripos($moduleDir, 'phar://') !== false) {
+                LoggerManager::getLogger()->fatal("UpgradeWizard - invalid load_module_from_dir: " . $moduleDir);
+                throw new RuntimeException('Invalid request');
+            }
+
+            if (strtolower(pathinfo(urldecode($_REQUEST['upgrade_zip_escaped'] ?? ''), PATHINFO_EXTENSION)) !== 'zip'){
+                LoggerManager::getLogger()->fatal("UpgradeWizard - invalid upgrade_zip_escaped: " . $_REQUEST['upgrade_zip_escaped'] ?? '');
+                throw new RuntimeException("Invalid request");
             }
             //copy file to proper location then call performSetup
             copy($moduleDir . '/' . $_REQUEST['upgrade_zip_escaped'], "upload://" . $_REQUEST['upgrade_zip_escaped']);

diff --git a/modules/Campaigns/WebToPersonCapture.php b/modules/Campaigns/WebToPersonCapture.php
@@ -54,6 +54,11 @@
     die('Not a valid module directory');
 }
 
+if (!isValidWebToPersonModule($moduleDir)) {
+    LoggerManager::getLogger()->fatal('Trying to run WepToPersonCapture for invalid module: ' . $moduleDir);
+    throw new RuntimeException('Not a valid module');
+}
+
 global $app_strings, $sugar_config, $timedate, $current_user;
 
 $mod_strings = return_module_language($sugar_config['default_language'], $moduleDir);
@@ -120,7 +125,7 @@
 
         //As form base items are not necessarily in place for the custom classes that extend Person, cannot use
         //the hendleSave method of the formbase
-        
+
         $optInEmailFields = array();
         $optInPrefix = 'opt_in_';
 
@@ -209,8 +214,8 @@
                 $sea->AddUpdateEmailAddress($person->email2, 0, 1);
             }
         }
-        
-        
+
+
         if (!empty($optInEmailFields)) {
             // Look for opted out
             $optedOut = array();
@@ -342,7 +347,7 @@
                     $log = LoggerManager::getLogger();
                     $log->error('Success but some error occurred: ' . implode(', ', $errors));
                 }
-                
+
                 //If the custom module does not have a LBL_THANKS_FOR_SUBMITTING label, default to this general one
                 echo $app_strings['LBL_THANKS_FOR_SUBMITTING'];
             }