Merge next into suite 8

Merge commit '588534d02218bc8538011b15e0e3ba3d3ce8270a' into release/8.0.2 # Conflicts: # public/legacy/include/Services/NormalizeRecords/NormalizeRecordsSchedulerJob.php # public/legacy/modules/Administration/templates/RepairUtfEncoding.tpl # public/legacy/modules/Administration/templates/RepairUtfEncodingStatus.tpl # public/legacy/modules/Administration/templates/RepairUtfEncodingSyncStatus.tpl # public/legacy/suitecrm_version.php # public/legacy/themes/suite8/css/Dawn/style.scss # public/legacy/themes/suite8/css/suitep-base/admin-backup.scss # public/legacy/themes/suite8/css/suitep-base/editview.scss # public/legacy/themes/suite8/css/suitep-base/meetings.scss # public/legacy/themes/suite8/css/suitep-base/scheduler.scss
salesagility · Jan 26, 2022 · 5d69939 · 5d69939
2 parents 961536b + 588534d
commit 5d69939
Show file tree

Hide file tree

Showing 43 changed files with 1,891 additions and 249 deletions.
diff --git a/public/legacy/Api/V8/Service/ModuleService.php b/public/legacy/Api/V8/Service/ModuleService.php
@@ -146,12 +146,12 @@ public function getRecords(GetModulesParams $params, Request $request)
                 = 'FROM email_addresses JOIN email_addr_bean_rel ON email_addresses.id = email_addr_bean_rel.email_address_id JOIN '
                 . $selectedModule . ' ON ' . $selectedModule
                 . '.id = email_addr_bean_rel.bean_id ';
-            $modifiedWhere = str_replace('accounts.email1',
+            $modifiedWhere = str_replace($selectedModule.'.email1',
                 'email_addresses.email_address', $where);
             $where = $modifiedWhere;
 
             // Sets and adds deleted to the query
-            if ($deleted === 0) {
+            if ($deleted === false) {
                 $whereAuto = '' . $bean->table_name . ' .deleted=0';
             } else {
                 $whereAuto = '' . $bean->table_name . ' .deleted=1';

diff --git a/public/legacy/README.md b/public/legacy/README.md
@@ -2,7 +2,7 @@
   <img width="180px" height="41px" src="https://suitecrm.com/wp-content/uploads/2017/12/logo.png" align="right" />
 </a>
 
-# SuiteCRM 7.12.2
+# SuiteCRM 7.12.3
 
 [![LICENSE](https://img.shields.io/github/license/suitecrm/suitecrm.svg)](https://github.com/salesagility/suitecrm/blob/hotfix/LICENSE.txt)
 [![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/salesagility/SuiteCRM-Core/issues)

diff --git a/public/legacy/files.md5 b/public/legacy/files.md5
diff --git a/public/legacy/include/InlineEditing/InlineEditing.php b/public/legacy/include/InlineEditing/InlineEditing.php
@@ -345,6 +345,9 @@ function saveField($field, $id, $module, $value)
             require_once('modules/Leads/LeadFormBase.php');
             $bean->$field = $value;
             $bean->account_id = LeadFormBase::handleLeadAccountName($bean);
+        // Fix #9408 Allow deleting an email address from inline Edit
+        } else if($bean->field_defs[$field]['function']['name']=='getEmailAddressWidget'){
+            $bean->$field = empty($value) ? ' ' : $value;
         } else {
             $bean->$field = $value;
         }
@@ -384,13 +387,27 @@ function saveField($field, $id, $module, $value)
 
 function getDisplayValue($bean, $field, $method = "save")
 {
+    global $log;
+
     if (file_exists("custom/modules/Accounts/metadata/listviewdefs.php")) {
         $metadata = require("custom/modules/Accounts/metadata/listviewdefs.php");
     } else {
         $metadata = require("modules/Accounts/metadata/listviewdefs.php");
     }
 
+    if (!$bean->ACLAccess('view')) {
+        $log->security("getDisplayValue - trying to access unauthorized view/module");
+        throw new BadMethodCallException('Unauthorized');
+    }
+
     $fieldlist[$field] = $bean->getFieldDefinition($field);
+    $isSensitive = !empty($fieldlist[$field]['sensitive']);
+    $notApiVisible = !empty($fieldlist[$field]['api-visible']);
+
+    if ($isSensitive || $notApiVisible){
+        $log->security("getDisplayValue - trying to access sensitive field");
+        throw new BadMethodCallException('Unauthorized');
+    }
 
     if (is_array($listViewDefs)) {
         $fieldlist[$field] = array_merge($fieldlist[$field], $listViewDefs);

diff --git a/public/legacy/include/ListView/ListViewDisplay.php b/public/legacy/include/ListView/ListViewDisplay.php
@@ -52,11 +52,6 @@ class ListViewDisplay
     public $show_mass_update_form = false;
     public $show_action_dropdown = true;
 
-    /**
-     * @var bool Show Bulk Action button as Delete link
-     */
-    public $show_action_dropdown_as_delete = false;
-
     public $rowCount;
     public $mass = null;
     public $seed;
@@ -341,17 +336,8 @@ protected function buildActionsLink($id = 'actions_link', $location = 'top')
                 }
             }
         } else {
-            // delete
-            if (
-                ACLController::checkAccess($this->seed->module_dir, 'delete', true)
-                && $this->delete
-            ) {
-                if ($this->show_action_dropdown_as_delete) {
-                    $menuItems[] = $this->buildDeleteLink($location);
-                } else {
-                    $menuItems[] = $this->buildBulkActionButton($location);
-                }
-            }
+            // Bulk Action label
+            $menuItems[] = $this->buildBulkActionButton($location);
 
             // Compose email
             if (isset($this->email) && $this->email === true) {
@@ -402,10 +388,12 @@ protected function buildActionsLink($id = 'actions_link', $location = 'top')
 
 
             if (
-                $this->delete
-                && !$this->show_action_dropdown_as_delete
+                $this->delete &&
+                ACLController::checkAccess($this->seed->module_dir, 'delete', true)
             ) {
                 $menuItems[] = $this->buildDeleteLink($location);
+            } else {
+                $menuItems[] = "<a style='display:none'></a>";
             }
         }
         $link = array(

diff --git a/public/legacy/include/Popups/PopupSmarty.php b/public/legacy/include/Popups/PopupSmarty.php
@@ -249,6 +249,7 @@ public function display($end = true)
         $this->th->ss->assign('footerTpl', $this->footerTpl);
         $this->th->ss->assign('ASSOCIATED_JAVASCRIPT_DATA', 'var associated_javascript_data = '.$json->encode($associated_row_data). '; var is_show_fullname = '.$is_show_fullname.';');
         $this->th->ss->assign('module', $this->seed->module_dir);
+        $this->th->ss->assign('metadata', empty($_REQUEST['metadata']) ? '' : $_REQUEST['metadata']);
         $request_data = empty($_REQUEST['request_data']) ? '' : $_REQUEST['request_data'];
 
         $this->th->ss->assign('request_data', $request_data);

diff --git a/public/legacy/include/Popups/tpls/header.tpl b/public/legacy/include/Popups/tpls/header.tpl
@@ -72,6 +72,7 @@ function clearAll() {
 <input type="hidden" name="module" value="{$module}" />
 <input type="hidden" name="action" value="Popup" />
 <input type="hidden" name="query" value="true" />
+<input type="hidden" name="metadata" value="{$metadata}" />
 <input type="hidden" name="func_name" value="" />
 <input type="hidden" name="request_data" value="{$request_data}" />
 <input type="hidden" name="populate_parent" value="false" />