SuiteCRM 7.12.9 Release

Api/V8/JsonApi/Helper/AttributeObjectHelper.php

@@ -29,6 +29,24 @@ public function getAttributes(\SugarBean $bean, $fields = null)
     {
         $bean->fixUpFormatting();
 
+        $allowedField = [];
+
+        $fieldsToParse = $fields;
+        if (empty($fields)) {
+            $fieldsToParse =  array_keys($bean->field_defs);
+        }
+
+        foreach ($fieldsToParse ?? [] as $index => $field) {
+            $isSensitive = isTrue($bean->field_defs[$field]['sensitive'] ?? false);
+            $notApiVisible = isFalse($bean->field_defs[$field]['api-visible'] ?? true);
+
+            if ($isSensitive || $notApiVisible){
+                continue;
+            }
+
+            $allowedField[$index] = $field;
+        }
+
         // using the ISO 8601 format for dates
         $attributes = array_map(function ($value) {
             return is_string($value)
@@ -38,8 +56,8 @@ public function getAttributes(\SugarBean $bean, $fields = null)
                 : $value;
         }, $bean->toArray());
 
-        if ($fields !== null) {
-            $attributes = array_intersect_key($attributes, array_flip($fields));
+        if ($allowedField !== null) {
+            $attributes = array_intersect_key($attributes, array_flip($allowedField));
         }
 
         unset($attributes['id']);

README.md

@@ -2,7 +2,7 @@
   <img width="180px" height="41px" src="https://suitecrm.com/wp-content/uploads/2017/12/logo.png" align="right" />
 </a>
 
-# SuiteCRM 7.12.8
+# SuiteCRM 7.12.9
 
 [![Build Status](https://travis-ci.org/salesagility/SuiteCRM.svg?branch=hotfix)](https://travis-ci.org/salesagility/SuiteCRM)
 [![codecov](https://codecov.io/gh/salesagility/SuiteCRM/branch/hotfix/graph/badge.svg)](https://codecov.io/gh/salesagility/SuiteCRM/branch/hotfix)

data/BeanFactory.php

@@ -151,6 +151,51 @@ public static function getBean($module, $id = null, $params = [], $deleted = tru
         return $bean;
     }
 
+    /**
+     * Returns a SugarBean object by id.
+     *
+     * @static
+     *
+     * @param string $module
+     * @param string $id
+     * @param array $params
+     *        A name/value array of parameters. Names: encode, deleted.
+     *        If $params is boolean we revert to the old arguments (encode, deleted), and use $params as $encode.
+     *        This will be changed to using only $params in later versions.
+     * @param bool $deleted
+     *        @see SugarBean::retrieve
+     *
+     * @return SugarBean|bool
+     */
+    public static function getReloadedBean($module, $id = null, $params = [], $deleted = true)
+    {
+        $params = self::convertParams($params);
+        $encode = self::hasEncodeFlag($params);
+        $deleted = self::hasDeletedFlag($params, $deleted);
+
+        $beanClass = self::getBeanClass($module);
+
+        if (!self::loadBeanFile($module)) {
+            return false;
+        }
+
+        if (empty($id)) {
+            return new $beanClass();
+        }
+
+        /* @var SugarBean $bean */
+        $bean = new $beanClass();
+
+        $result = $bean->retrieve($id, $encode, $deleted);
+
+        if ($result === null) {
+            return false;
+        }
+
+        return $bean;
+    }
+
+
     /**
      * Shallow beans are created by SugarBean during the fill_in_relationship_fields method, and they differ from
      * 'complete' bean in that they do not have their own relate fields completed.

include/InlineEditing/InlineEditing.php

@@ -52,6 +52,11 @@ function getEditFieldHTML($module, $fieldname, $aow_field, $view = 'EditView', $
         return false;
     }
 
+    $vardef = $bean->getFieldDefinition($fieldname);
+
+    if (isTrue($vardef['sensitive'] ?? false) || isFalse($vardef['api-visible'] ?? true)){
+        return false;
+    }
 
     $value = getFieldValueFromModule($fieldname, $module, $id);
     // use the mod_strings for this module
@@ -126,7 +131,7 @@ function getEditFieldHTML($module, $fieldname, $aow_field, $view = 'EditView', $
         if (isset($vardef['name']) && ($vardef['name'] == 'date_modified')) {
             $vardef['name'] = 'aow_temp_date';
         }
-        
+
         if (isset($vardef['help'])) {
             $vardef['help'] = htmlspecialchars($vardef['help'],ENT_QUOTES);
         }

include/MySugar/MySugar.php

@@ -95,6 +95,11 @@ public function addDashlet()
 
             $dashlets = $current_user->getPreference('dashlets', $this->type);
 
+            if (!empty($_POST['type_module']) && stripos($_POST['type_module'], 'phar://') !== false) {
+                LoggerManager::getLogger()->security('MySugar:addDashlet unsecure type_module received: ' . $_POST['type_module']);
+                throw new RuntimeException('Invalid type_module');
+            }
+
             $guid = create_guid();
             $options = array();
             if (isset($_POST['type'], $_POST['type_module']) && $_POST['type'] == 'web') {

include/utils.php

@@ -206,6 +206,9 @@ function make_sugar_config(&$sugar_config)
             'php3',
             'php4',
             'php5',
+            'php6',
+            'php7',
+            'php8',
             'pl',
             'cgi',
             'py',
@@ -468,6 +471,9 @@ function get_sugar_config_defaults(): array
             'php3',
             'php4',
             'php5',
+            'php6',
+            'php7',
+            'php8',
             'pl',
             'cgi',
             'py',
@@ -485,7 +491,8 @@ function get_sugar_config_defaults(): array
             'png',
             'jpg',
             'jpeg',
-            'svg'
+            'svg',
+            'bmp'
         ],
         'allowed_preview' => [
             'pdf',
@@ -1351,7 +1358,7 @@ function return_module_language($language, $module, $refresh = false)
     global $currentModule;
 
     // Jenny - Bug 8119: Need to check if $module is not empty
-    if (empty($module)) {
+    if (empty($module) || !isAllowedModuleName($module)) {
         $GLOBALS['log']->warn('Variable module is not in return_module_language, see more info: debug_backtrace()');
 
         return array();
@@ -6025,3 +6032,22 @@ function get_id_validation_pattern(): string {
 
     return $pattern;
 }
+
+/**
+ * Check if is string is an allowed module name
+ * @param string $value
+ * @return bool
+ */
+function isAllowedModuleName(string $value): bool {
+    if (empty($value)) {
+        return false;
+    }
+
+    $result = preg_match("/^[\w\-\_\.]+$/", $value);
+
+    if (!empty($result)) {
+        return true;
+    }
+
+    return false;
+}

install/install_utils.php

@@ -994,7 +994,7 @@ function handleHtaccess()
     $restrict_str .= <<<EOQ
 RedirectMatch 403 {$ignoreCase}.*\.log$
 RedirectMatch 403 {$ignoreCase}/+not_imported_.*\.txt
-RedirectMatch 403 {$ignoreCase}/+(soap|cache|xtemplate|data|examples|include|log4php|metadata|modules|vendor)/+.*\.(php|tpl)
+RedirectMatch 403 {$ignoreCase}/+(soap|cache|xtemplate|data|examples|include|log4php|metadata|modules|vendor)/+.*\.(php|tpl|phar)
 RedirectMatch 403 {$ignoreCase}/+emailmandelivery\.php
 RedirectMatch 403 {$ignoreCase}/+.git
 RedirectMatch 403 {$ignoreCase}/+.{$cacheDir}
@@ -1043,7 +1043,7 @@ function handleHtaccess()
 
  # CSS
  ExpiresByType text/css "access plus 1 year"
- 
+
  # Data
  ExpiresByType application/atom+xml "access plus 1 hour"
  ExpiresByType application/rdf+xml "access plus 1 hour"
@@ -1296,7 +1296,7 @@ function create_default_users()
     global $sugar_config;
 
     require_once('install/UserDemoData.php');
-    
+
     //Create default admin user
     $user = BeanFactory::newBean('Users');
     $user->id = 1;

lib/API/JsonApi/v1/Resource/SuiteBeanResource.php

@@ -115,6 +115,13 @@ public function fromSugarBean($sugarBean, $source = ResourceEnum::DEFAULT_SOURCE
                 throw $exception;
             }
 
+            $isSensitive = isTrue($definition['sensitive'] ?? false);
+            $notApiVisible = isFalse($definition['api-visible'] ?? true);
+
+            if ($isSensitive || $notApiVisible){
+                continue;
+            }
+
             if ($definition['type'] === 'datetime' && isset($sugarBean->$fieldName)) {
                 // Convert to DB date
                 $datetime = $dateTimeConverter->fromUser($sugarBean->$fieldName);

modules/AOS_Products/AOS_Products.php

@@ -64,6 +64,12 @@ public function save($check_notify = false)
         require_once('include/upload_file.php');
         $GLOBALS['log']->debug('UPLOADING PRODUCT IMAGE');
 
+        $imageFileName = $_FILES['uploadimage']['name'] ?? '';
+        if (!has_valid_image_extension('AOS_Products Uploaded image file: ' . $imageFileName , $imageFileName)) {
+            LoggerManager::getLogger()->fatal("AOS_Products save - Invalid image file ext : '$imageFileName'.");
+            throw new RuntimeException('Invalid request');
+        }
+
         if (!empty($_FILES['uploadimage']['tmp_name']) && verify_uploaded_image($_FILES['uploadimage']['tmp_name'])) {
             if ($_FILES['uploadimage']['size'] > $sugar_config['upload_maxsize']) {
                 die($mod_strings['LBL_IMAGE_UPLOAD_FAIL'] . $sugar_config['upload_maxsize']);

modules/Administration/UpgradeWizard.php

@@ -106,9 +106,15 @@ function unlinkTempFiles()
             $perform = true;
             $base_filename = urldecode($tempFile);
         } elseif (!empty($_REQUEST['load_module_from_dir'])) {
-            $moduleDir = $_REQUEST['load_module_from_dir'];
-            if (strpos($moduleDir, 'phar://') !== false) {
-                die();
+            $moduleDir = $_REQUEST['load_module_from_dir'] ?? '';
+            if (stripos($moduleDir, 'phar://') !== false) {
+                LoggerManager::getLogger()->fatal("UpgradeWizard - invalid load_module_from_dir: " . $moduleDir);
+                throw new RuntimeException('Invalid request');
+            }
+
+            if (strtolower(pathinfo(urldecode($_REQUEST['upgrade_zip_escaped'] ?? ''), PATHINFO_EXTENSION)) !== 'zip'){
+                LoggerManager::getLogger()->fatal("UpgradeWizard - invalid upgrade_zip_escaped: " . $_REQUEST['upgrade_zip_escaped'] ?? '');
+                throw new RuntimeException("Invalid request");
             }
             //copy file to proper location then call performSetup
             copy($moduleDir . '/' . $_REQUEST['upgrade_zip_escaped'], "upload://" . $_REQUEST['upgrade_zip_escaped']);

modules/Campaigns/WebToPersonCapture.php

@@ -54,6 +54,11 @@
     die('Not a valid module directory');
 }
 
+if (!isValidWebToPersonModule($moduleDir)) {
+    LoggerManager::getLogger()->fatal('Trying to run WepToPersonCapture for invalid module: ' . $moduleDir);
+    throw new RuntimeException('Not a valid module');
+}
+
 global $app_strings, $sugar_config, $timedate, $current_user;
 
 $mod_strings = return_module_language($sugar_config['default_language'], $moduleDir);
@@ -120,7 +125,7 @@
 
         //As form base items are not necessarily in place for the custom classes that extend Person, cannot use
         //the hendleSave method of the formbase
-        
+
         $optInEmailFields = array();
         $optInPrefix = 'opt_in_';
 
@@ -209,8 +214,8 @@
                 $sea->AddUpdateEmailAddress($person->email2, 0, 1);
             }
         }
-        
-        
+
+
         if (!empty($optInEmailFields)) {
             // Look for opted out
             $optedOut = array();
@@ -342,7 +347,7 @@
                     $log = LoggerManager::getLogger();
                     $log->error('Success but some error occurred: ' . implode(', ', $errors));
                 }
-                
+
                 //If the custom module does not have a LBL_THANKS_FOR_SUBMITTING label, default to this general one
                 echo $app_strings['LBL_THANKS_FOR_SUBMITTING'];
             }

modules/Campaigns/utils.php

@@ -54,7 +54,7 @@
  *name and list of all prospects associated with this campaign..
  *
  */
-function get_message_scope_dom($campaign_id, $campaign_name, $db=null, $mod_strings=array())
+function get_message_scope_dom($campaign_id, $campaign_name, $db = null, $mod_strings = array())
 {
     if (empty($db)) {
         $db = DBManagerFactory::getInstance();
@@ -65,7 +65,7 @@ function get_message_scope_dom($campaign_id, $campaign_name, $db=null, $mod_stri
     }
 
     //find prospect list attached to this campaign..
-    $query =  "SELECT prospect_list_id, prospect_lists.name ";
+    $query = "SELECT prospect_list_id, prospect_lists.name ";
     $query .= "FROM prospect_list_campaigns ";
     $query .= "INNER join prospect_lists on prospect_lists.id = prospect_list_campaigns.prospect_list_id ";
     $query .= "WHERE prospect_lists.deleted = 0 ";
@@ -297,21 +297,21 @@ function log_campaign_activity($identifier, $activity, $update = true, $clicked_
             //values for return array..
             $return_array['target_id'] = $row['target_id'];
             $return_array['target_type'] = $row['target_type'];
-            
+
             // quote variable first
             $dataArrayKeys = array_keys($data);
             $dataArrayKeysQuoted = array();
             foreach ($dataArrayKeys as $dataArrayKey) {
                 $dataArrayKeysQuoted[] = $db->quote($dataArrayKey);
             }
             $dataArrayKeysQuotedImplode = implode(', ', $dataArrayKeysQuoted);
-            
+
             $insert_query = "INSERT into campaign_log (" . $dataArrayKeysQuotedImplode . ")";
-            
+
             $dataArrayValuesQuotedImplode = implode(', ', array_values($data));
-            
+
             $insert_query .= " VALUES  (" . $dataArrayValuesQuotedImplode . ")";
-            
+
             $db->query($insert_query);
         }
     } else {
@@ -331,7 +331,7 @@ function log_campaign_activity($identifier, $activity, $update = true, $clicked_
         $rowCampaignIdQuoted = $db->quote($row['campaign_id']);
         $query = "SELECT campaigns.* FROM campaigns WHERE campaigns.id = '" . $rowCampaignIdQuoted . "' ";
         $result = $db->query($query);
-        
+
         if (!empty($result)) {
             $c_row = $db->fetchByAssoc($result);
 
@@ -1160,3 +1160,33 @@ function filterFieldsFromBeans($beans)
     }
     return $formattedBeans;
 }
+
+/**
+ * Get valid web to person modules
+ * @return array
+ */
+function getValidWebToPersonModules(): array
+{
+    $superclass = 'Person';
+    $modules = [];
+    foreach ($GLOBALS['moduleList'] as $mod) {
+        $item = BeanFactory::getBean($mod);
+        if ($item && is_subclass_of($item, $superclass)) {
+            $modules[] = $item->module_name;
+        }
+    }
+
+    return $modules;
+}
+
+/**
+ * Check if it is a valid WebToPerson module
+ * @param string $module
+ * @return bool
+ */
+function isValidWebToPersonModule(string $module): bool
+{
+    $validModules = getValidWebToPersonModules();
+
+    return in_array($module, $validModules, true);
+}