| [ Index ] |
|
Code source de vtiger CRM 5.0.2 |
1 <?php 2 /********************************************************************************* 3 * The contents of this file are subject to the SugarCRM Public License Version 1.1.2 4 * ("License"); You may not use this file except in compliance with the 5 * License. You may obtain a copy of the License at http://www.sugarcrm.com/SPL 6 * Software distributed under the License is distributed on an "AS IS" basis, 7 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for 8 * the specific language governing rights and limitations under the License. 9 * The Original Code is: SugarCRM Open Source 10 * The Initial Developer of the Original Code is SugarCRM, Inc. 11 * Portions created by SugarCRM are Copyright (C) SugarCRM, Inc.; 12 * All Rights Reserved. 13 * Contributor(s): ______________________________________. 14 ********************************************************************************/ 15 /********************************************************************************* 16 * $Header: /advent/projects/wesat/vtiger_crm/sugarcrm/index.php,v 1.93 2005/04/21 16:17:25 ray Exp $ 17 * Description: Main file and starting point for the application. Calls the 18 * theme header and footer files defined for the user as well as the module as 19 * defined by the input parameters. 20 ********************************************************************************/ 21 22 global $entityDel; 23 global $display; 24 global $category; 25 require_once ('include/utils/utils.php'); 26 27 28 if (version_compare(phpversion(), '5.0') < 0) { 29 eval(' 30 function clone($object) { 31 return $object; 32 } 33 '); 34 } 35 36 global $currentModule; 37 38 /** Function to return a string with backslashes stripped off 39 * @param $value -- value:: Type string 40 * @returns $value -- value:: Type string array 41 */ 42 43 function stripslashes_checkstrings($value){ 44 if(is_string($value)){ 45 return stripslashes($value); 46 } 47 return $value; 48 49 } 50 if(get_magic_quotes_gpc() == 1){ 51 $_REQUEST = array_map("stripslashes_checkstrings", $_REQUEST); 52 $_POST = array_map("stripslashes_checkstrings", $_POST); 53 $_GET = array_map("stripslashes_checkstrings", $_GET); 54 55 } 56 57 // Allow for the session information to be passed via the URL for printing. 58 if(isset($_REQUEST['PHPSESSID'])) 59 { 60 session_id($_REQUEST['PHPSESSID']); 61 //Setting the same session id to Forums as in CRM 62 $sid=$_REQUEST['PHPSESSID']; 63 } 64 65 /** Function to set, character set in the header, as given in include/language/*_lang.php 66 */ 67 68 function insert_charset_header() 69 { 70 global $app_strings, $default_charset; 71 $charset = $default_charset; 72 73 if(isset($app_strings['LBL_CHARSET'])) 74 { 75 $charset = $app_strings['LBL_CHARSET']; 76 } 77 header('Content-Type: text/html; charset='. $charset); 78 } 79 80 insert_charset_header(); 81 // Create or reestablish the current session 82 session_start(); 83 84 if (!is_file('config.inc.php')) { 85 header("Location: install.php"); 86 exit(); 87 } 88 89 require_once ('config.inc.php'); 90 if (!isset($dbconfig['db_hostname']) || $dbconfig['db_status']=='_DB_STAT_') { 91 header("Location: install.php"); 92 exit(); 93 } 94 95 // load up the config_override.php file. This is used to provide default user settings 96 if (is_file('config_override.php')) 97 { 98 require_once('config_override.php'); 99 } 100 $default_config_values = Array( "allow_exports"=>"all","upload_maxsize"=>"3000000" ); 101 102 set_default_config($default_config_values); 103 require_once ('include/logging.php'); 104 require_once ('modules/Users/Users.php'); 105 106 global $currentModule; 107 108 //if($calculate_response_time) $startTime = microtime(); 109 110 $log =& LoggerManager::getLogger('index'); 111 112 global $seclog; 113 $seclog =& LoggerManager::getLogger('SECURITY'); 114 115 if (isset($_REQUEST['PHPSESSID'])) $log->debug("****Starting for session ".$_REQUEST['PHPSESSID']); 116 else $log->debug("****Starting for new session"); 117 118 // We use the REQUEST_URI later to construct dynamic URLs. IIS does not pass this field 119 // to prevent an error, if it is not set, we will assign it to '' 120 if(!isset($_SERVER['REQUEST_URI'])) 121 { 122 $_SERVER['REQUEST_URI'] = ''; 123 } 124 125 $action = ''; 126 if(isset($_REQUEST['action'])) 127 { 128 $action = $_REQUEST['action']; 129 } 130 131 //Code added for 'Path Traversal/File Disclosure' security fix - Philip 132 $is_module = false; 133 if(isset($_REQUEST['module'])) 134 { 135 $module = $_REQUEST['module']; 136 137 if ($dir = @opendir($root_directory."modules")) 138 { 139 while (($file = readdir($dir)) !== false) 140 { 141 if ($file != ".." && $file != "." && $file != "CVS" && $file != "Attic") 142 { 143 if(is_dir($root_directory."modules/".$file)) 144 { 145 if(!($file[0] == '.')) 146 { 147 if($file=="$module") 148 { 149 $is_module = true; 150 } 151 } 152 } 153 } 154 } 155 } 156 if(!$is_module) 157 { 158 die("Module name is missing. Please check the module name."); 159 } 160 } 161 if($action == 'Export') 162 { 163 include ('include/utils/export.php'); 164 } 165 166 //Code added for 'Multiple SQL Injection Vulnerabilities & XSS issue' fixes - Philip 167 if(isset($_REQUEST['record']) && !is_numeric($_REQUEST['record']) && $_REQUEST['record']!='') 168 { 169 die("An invalid record number specified to view details."); 170 } 171 172 // Check to see if there is an authenticated user in the session. 173 $use_current_login = false; 174 if(isset($_SESSION["authenticated_user_id"]) && (isset($_SESSION["app_unique_key"]) && $_SESSION["app_unique_key"] == $application_unique_key)) 175 { 176 $use_current_login = true; 177 } 178 179 if($use_current_login) 180 { 181 $log->debug("We have an authenticated user id: ".$_SESSION["authenticated_user_id"]); 182 } 183 else if(isset($action) && isset($module) && $action=="Authenticate" && $module=="Users") 184 { 185 $log->debug("We are authenticating user now"); 186 } 187 else 188 { 189 $log->debug("The current user does not have a session. Going to the login page"); 190 $action = "Login"; 191 $module = "Users"; 192 } 193 194 195 $log->debug($_REQUEST); 196 $skipHeaders=false; 197 $skipFooters=false; 198 $viewAttachment = false; 199 $skipSecurityCheck= false; 200 //echo $module; 201 // echo $action; 202 203 if(isset($action) && isset($module)) 204 { 205 $log->info("About to take action ".$action); 206 $log->debug("in $action"); 207 if(ereg("^Save", $action) || 208 ereg("^Delete", $action) || 209 ereg("^Choose", $action) || 210 ereg("^Popup", $action) || 211 ereg("^ChangePassword", $action) || 212 ereg("^Authenticate", $action) || 213 ereg("^Logout", $action) || 214 ereg("^Export",$action) || 215 ereg("^add2db", $action) || 216 ereg("^result", $action) || 217 ereg("^LeadConvertToEntities", $action) || 218 ereg("^downloadfile", $action) || 219 ereg("^massdelete", $action) || 220 ereg("^updateLeadDBStatus",$action) || 221 ereg("^AddCustomFieldToDB", $action) || 222 ereg("^updateRole",$action) || 223 ereg("^UserInfoUtil",$action) || 224 ereg("^deleteRole",$action) || 225 ereg("^UpdateComboValues",$action) || 226 ereg("^fieldtypes",$action) || 227 ereg("^app_ins",$action) || 228 ereg("^minical",$action) || 229 ereg("^minitimer",$action) || 230 ereg("^app_del",$action) || 231 ereg("^send_mail",$action) || 232 ereg("^populatetemplate",$action) || 233 ereg("^TemplateMerge",$action) || 234 ereg("^testemailtemplateusage",$action) || 235 ereg("^saveemailtemplate",$action) || 236 ereg("^lookupemailtemplate",$action) || 237 ereg("^deletewordtemplate",$action) || 238 ereg("^deleteemailtemplate",$action) || 239 ereg("^CurrencyDelete",$action) || 240 ereg("^deleteattachments",$action) || 241 ereg("^MassDeleteUsers",$action) || 242 ereg("^UpdateFieldLevelAccess",$action) || 243 ereg("^UpdateDefaultFieldLevelAccess",$action) || 244 ereg("^UpdateProfile",$action) || 245 ereg("^updateRelations",$action) || 246 ereg("^updateNotificationSchedulers",$action) || 247 ereg("^Star",$action) || 248 ereg("^addPbProductRelToDB",$action) || 249 ereg("^UpdateListPrice",$action) || 250 ereg("^PriceListPopup",$action) || 251 ereg("^SalesOrderPopup",$action) || 252 ereg("^CreatePDF",$action) || 253 ereg("^CreateSOPDF",$action) || 254 ereg("^redirect",$action) || 255 ereg("^webmail",$action) || 256 ereg("^left_main",$action) || 257 ereg("^delete_message",$action) || 258 ereg("^mime",$action) || 259 ereg("^move_messages",$action) || 260 ereg("^folders_create",$action) || 261 ereg("^imap_general",$action) || 262 ereg("^mime",$action) || 263 ereg("^download",$action) || 264 ereg("^about_us",$action) || 265 ereg("^SendMailAction",$action) || 266 ereg("^CreateXL",$action) || 267 ereg("^savetermsandconditions",$action) || 268 ereg("^home_rss",$action) || 269 ereg("^ConvertAsFAQ",$action) || 270 ereg("^Tickerdetail",$action) || 271 ereg("^".$module."Ajax",$action) || 272 ereg("^ActivityAjax",$action) || 273 ereg("^chat",$action) || 274 ereg("^vtchat",$action) || 275 ereg("^updateCalendarSharing",$action) || 276 ereg("^disable_sharing",$action) || 277 ereg("^HeadLines",$action) || 278 ereg("^TodoSave",$action) || 279 ereg("^RecalculateSharingRules",$action) || 280 (ereg("^body",$action) && 281 ereg("^Webmails",$module)) || 282 (ereg("^DetailView",$action) && 283 ereg("^Webmails",$module) )) 284 { 285 $skipHeaders=true; 286 //skip headers for all these invocations as they are mostly popups 287 if(ereg("^Popup", $action) || 288 ereg("^ChangePassword", $action) || 289 ereg("^Export", $action) || 290 ereg("^downloadfile", $action) || 291 ereg("^fieldtypes",$action) || 292 ereg("^lookupemailtemplate",$action) || 293 ereg("^about_us",$action) || 294 ereg("^home_rss",$action) || 295 ereg("^".$module."Ajax",$action) || 296 ereg("^chat",$action) || 297 ereg("^vtchat",$action) || 298 ereg("^massdelete", $action)) 299 $skipFooters=true; 300 //skip footers for all these invocations as they are mostly popups 301 if(ereg("^downloadfile", $action) || ereg("^fieldtypes",$action)) 302 { 303 $viewAttachment = true; 304 } 305 if(($action == ' Delete ') && (!$entityDel)) 306 { 307 $skipHeaders=false; 308 } 309 } 310 311 if($action == 'Save') 312 { 313 header( "Expires: Mon, 20 Dec 1998 01:00:00 GMT" ); 314 header( "Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT" ); 315 header( "Cache-Control: no-cache, must-revalidate" ); 316 header( "Pragma: no-cache" ); 317 } 318 319 if($module == 'Users' || $module == 'Home' || $module == 'uploads') 320 { 321 $skipSecurityCheck=true; 322 } 323 324 $currentModuleFile = 'modules/'.$module.'/'.$action.'.php'; 325 $currentModule = $module; 326 327 328 } 329 elseif(isset($module)) 330 { 331 332 $currentModule = $module; 333 $currentModuleFile = $moduleDefaultFile[$currentModule]; 334 } 335 else { 336 // use $default_module and $default_action as set in config.php 337 // Redirect to the correct module with the correct action. We need the URI to include these fields. 338 339 340 header("Location: index.php?action=$default_action&module=$default_module"); 341 exit(); 342 } 343 344 $log->info("current page is $currentModuleFile"); 345 $log->info("current module is $currentModule "); 346 347 348 // for printing 349 $module = (isset($_REQUEST['module'])) ? $_REQUEST['module'] : ""; 350 $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ""; 351 $record = (isset($_REQUEST['record'])) ? $_REQUEST['record'] : ""; 352 $lang_crm = (isset($_SESSION['authenticated_user_language'])) ? $_SESSION['authenticated_user_language'] : ""; 353 $GLOBALS['request_string'] = "&module=$module&action=$action&record=$record&lang_crm=$lang_crm"; 354 355 $current_user = new Users(); 356 357 if($use_current_login) 358 { 359 //$result = $current_user->retrieve($_SESSION['authenticated_user_id']); 360 //getting the current user info from flat file 361 $result = $current_user->retrieveCurrentUserInfoFromFile($_SESSION['authenticated_user_id']); 362 if($result == null) 363 { 364 session_destroy(); 365 header("Location: index.php?action=Login&module=Users"); 366 } 367 368 $moduleList = getPermittedModuleNames(); 369 370 foreach ($moduleList as $mod) { 371 $moduleDefaultFile[$mod] = "modules/".$currentModule."/index.php"; 372 } 373 374 //auditing 375 376 require_once ('user_privileges/audit_trail.php'); 377 378 if($audit_trail == 'true') 379 { 380 if($record == '') 381 $auditrecord = ''; 382 else 383 $auditrecord = $record; 384 385 $date_var = $adb->formatDate(date('YmdHis')); 386 if ($action != 'chat') 387 { 388 $query = "insert into vtiger_audit_trial values(".$adb->getUniqueID('vtiger_audit_trial').",".$current_user->id.",'".$module."','".$action."','".$auditrecord."',$date_var)"; 389 $adb->query($query); 390 } 391 } 392 393 $log->debug('Current user is: '.$current_user->user_name); 394 } 395 396 if(isset($_SESSION['authenticated_user_theme']) && $_SESSION['authenticated_user_theme'] != '') 397 { 398 $theme = $_SESSION['authenticated_user_theme']; 399 } 400 else 401 { 402 $theme = $default_theme; 403 } 404 $log->debug('Current theme is: '.$theme); 405 406 //Used for current record focus 407 $focus = ""; 408 409 // if the language is not set yet, then set it to the default language. 410 if(isset($_SESSION['authenticated_user_language']) && $_SESSION['authenticated_user_language'] != '') 411 { 412 $current_language = $_SESSION['authenticated_user_language']; 413 } 414 else 415 { 416 $current_language = $default_language; 417 } 418 $log->debug('current_language is: '.$current_language); 419 420 //set module and application string arrays based upon selected language 421 $app_strings = return_application_language($current_language); 422 $app_list_strings = return_app_list_strings_language($current_language); 423 $mod_strings = return_module_language($current_language, $currentModule); 424 425 //If DetailView, set focus to record passed in 426 if($action == "DetailView") 427 { 428 if(!isset($_REQUEST['record'])) 429 die("A record number must be specified to view details."); 430 431 // If we are going to a detail form, load up the record now. 432 // Use the record to track the viewing. 433 // todo - Have a record of modules and thier primary object names. 434 //Getting the actual module 435 switch($currentModule) 436 { 437 case 'Calendar': 438 require_once("modules/$currentModule/Activity.php"); 439 $focus = new Activity(); 440 break; 441 default: 442 require_once("modules/$currentModule/$currentModule.php"); 443 $focus = new $currentModule(); 444 break; 445 } 446 447 if(isset($_REQUEST['record']) && $_REQUEST['record']!='' && $_REQUEST["module"] != "Webmails") 448 { 449 // Only track a viewing if the record was retrieved. 450 $focus->track_view($current_user->id, $currentModule,$_REQUEST['record']); 451 } 452 453 } 454 455 // set user, theme and language cookies so that login screen defaults to last values 456 if (isset($_SESSION['authenticated_user_id'])) { 457 $log->debug("setting cookie ck_login_id_vtiger to ".$_SESSION['authenticated_user_id']); 458 setcookie('ck_login_id_vtiger', $_SESSION['authenticated_user_id']); 459 } 460 if (isset($_SESSION['authenticated_user_theme'])) { 461 $log->debug("setting cookie ck_login_theme_vtiger to ".$_SESSION['authenticated_user_theme']); 462 setcookie('ck_login_theme_vtiger', $_SESSION['authenticated_user_theme']); 463 } 464 if (isset($_SESSION['authenticated_user_language'])) { 465 $log->debug("setting cookie ck_login_language_vtiger to ".$_SESSION['authenticated_user_language']); 466 setcookie('ck_login_language_vtiger', $_SESSION['authenticated_user_language']); 467 } 468 469 //skip headers for popups, deleting, saving, importing and other actions 470 if(!$skipHeaders) { 471 $log->debug("including headers"); 472 if($use_current_login) 473 { 474 if(isset($_REQUEST['category']) && $_REQUEST['category'] !='') 475 { 476 $category = $_REQUEST['category']; 477 } 478 else 479 { 480 $category = getParentTabFromModule($currentModule); 481 } 482 include('themes/'.$theme.'/header.php'); 483 } 484 else 485 include('themes/'.$theme.'/loginheader.php'); 486 487 if(isset($_SESSION['administrator_error'])) 488 { 489 // only print DB errors once otherwise they will still look broken after they are fixed. 490 // Only print the errors for admin users. 491 if(is_admin($current_user)) 492 echo $_SESSION['administrator_error']; 493 unset($_SESSION['administrator_error']); 494 } 495 496 echo "<!-- startscrmprint -->"; 497 } 498 else { 499 $log->debug("skipping headers"); 500 } 501 502 503 504 //fetch the permission set from session and search it for the requisite data 505 506 if(isset($_SESSION['authenticated_user_theme']) && $_SESSION['authenticated_user_theme'] != '') 507 { 508 $theme = $_SESSION['authenticated_user_theme']; 509 } 510 else 511 { 512 $theme = $default_theme; 513 } 514 515 516 //logging the security Information 517 $seclog->debug('######## Module --> '.$module.' :: Action --> '.$action.' :: UserID --> '.$current_user->id.' :: RecordID --> '.$record.' #######'); 518 519 if(!$skipSecurityCheck) 520 { 521 522 523 require_once ('include/utils/UserInfoUtil.php'); 524 if(ereg('Ajax',$action)) 525 { 526 $now_action=$_REQUEST['file']; 527 } 528 else 529 { 530 $now_action=$action; 531 } 532 533 534 if(isset($_REQUEST['record']) && $_REQUEST['record'] != '') 535 { 536 $display = isPermitted($module,$now_action,$_REQUEST['record']); 537 } 538 else 539 { 540 $display = isPermitted($module,$now_action); 541 } 542 $seclog->debug('########### Pemitted ---> '.$display.' ##############'); 543 544 } 545 else 546 { 547 $seclog->debug('########### Pemitted ---> yes ##############'); 548 } 549 550 551 if($display == "no") 552 { 553 echo "<table border='0' cellpadding='5' cellspacing='0' width='100%' height='450px'><tr><td align='center'>"; 554 echo "<div style='border: 3px solid rgb(153, 153, 153); background-color: rgb(255, 255, 255); width: 55%; position: relative; z-index: 10000000;'> 555 556 <table border='0' cellpadding='5' cellspacing='0' width='98%'> 557 <tbody><tr> 558 <td rowspan='2' width='11%'><img src='themes/$theme/images/denied.gif' ></td> 559 <td style='border-bottom: 1px solid rgb(204, 204, 204);' nowrap='nowrap' width='70%'><span class='genHeaderSmall'>$app_strings[LBL_PERMISSION]</span></td> 560 </tr> 561 <tr> 562 <td class='small' align='right' nowrap='nowrap'> 563 <a href='javascript:window.history.back();'>$app_strings[LBL_GO_BACK]</a><br> </td> 564 </tr> 565 </tbody></table> 566 </div>"; 567 echo "</td></tr></table>"; 568 } 569 else 570 { 571 include($currentModuleFile); 572 } 573 574 if((!$viewAttachment) && (!$viewAttachment && $action != 'home_rss' && $action != $module."Ajax" && $action != "chat" && $action != 'massdelete' && $action != "body") ) 575 { 576 echo "<!-- stopscrmprint -->"; 577 } 578 579 //added to get the theme . This is a bad fix as we need to know where the problem lies yet 580 if(isset($_SESSION['authenticated_user_theme']) && $_SESSION['authenticated_user_theme'] != '') 581 { 582 $theme = $_SESSION['authenticated_user_theme']; 583 } 584 else 585 { 586 $theme = $default_theme; 587 } 588 $Ajx_module= $module; 589 if($module == 'Events') 590 $Ajx_module = 'Calendar'; 591 if((!$viewAttachment) && (!$viewAttachment && $action != 'home_rss') && $action != 'Tickerdetail' && $action != $Ajx_module."Ajax" && $action != "chat" && $action != "HeadLines" && $action != 'massdelete' && $action != "DashboardAjax" && $action != "ActivityAjax") 592 { 593 // Under the SPL you do not have the right to remove this copyright statement. 594 $copyrightstatement="<style> 595 .bggray 596 { 597 background-color: #dfdfdf; 598 } 599 .bgwhite 600 { 601 background-color: #FFFFFF; 602 } 603 .copy 604 { 605 font-size:9px; 606 font-family: Verdana, Arial, Helvetica, Sans-serif; 607 } 608 </style> 609 <script language=javascript> 610 function LogOut(e) 611 { 612 var nav4 = window.Event ? true : false; 613 var iX,iY; 614 if (nav4) 615 { 616 iX = e.pageX; 617 iY = e.pageY; 618 } 619 else 620 { 621 iX = event.clientX + document.body.scrollLeft; 622 iY = event.clientY + document.body.scrollTop; 623 624 } 625 if (iX <= 30 && iY < 0 ) 626 { 627 w=window.open(\"index.php?action=Logout&module=Users\"); 628 w.close(); 629 } 630 } 631 //window.onunload=LogOut 632 </script> 633 "; 634 635 if($action != "about_us" && $action != "vtchat" && $action != "ChangePassword" && $action != "body" && $action != $module."Ajax" && $action!='Popup' && $action != 'ImportStep3' && $action != 'ActivityAjax') 636 637 { 638 echo $copyrightstatement; 639 echo "<script language = 'JavaScript' type='text/javascript' src = 'include/js/popup.js'></script>"; 640 echo '<style type="text/css">@import url("themes/'.$theme.'/style.css"); </style>'; 641 echo "<br><br><br><table border=0 cellspacing=0 cellpadding=5 width=100% class=settingsSelectedUI >"; 642 echo "<tr><td class=small align=left>vtiger CRM 5.0.2 | Visit <a href='http://www.vtiger.com'>www.vtiger.com</a> for more information </td>"; 643 echo "<td class=small align=right> © <a href='javascript:mypopup()'>Copyright Details</a></td></tr></table>"; 644 645 // echo "<table align='center'><tr><td align='center'>"; 646 // Under the Sugar Public License referenced above, you are required to leave in all copyright statements 647 // in both the code and end-user application. 648 // if($calculate_response_time) 649 // { 650 // $endTime = microtime(); 651 652 // $deltaTime = microtime_diff($startTime, $endTime); 653 // echo(' Server response time: '.$deltaTime.' seconds.'); 654 // } 655 // echo "</td></tr></table>\n"; 656 } 657 if(($action != 'mytkt_rss') && ($action != 'home_rss') && ($action != $module."Ajax") && ($action != "body") && ($action != 'ActivityAjax')) 658 { 659 ?> 660 <script> 661 var userDateFormat = "<?php echo $current_user->date_format ?>"; 662 </script> 663 <?php 664 } 665 if((!$skipFooters) && ($action != "body") && ($action != $module."Ajax") && ($action != "ActivityAjax")) 666 include('themes/'.$theme.'/footer.php'); 667 } 668 ?>
titre
Description
Corps
titre
Description
Corps
titre
Description
Corps
titre
Corps
| Généré le : Sun Feb 25 10:22:19 2007 | par Balluche grâce à PHPXref 0.7 |