diff --git a/data/CRMEntity.php b/data/CRMEntity.php index 472ca4710d8724aec36cc6790797fa94844c3a9d..c5fcbae1ddc9432d07c244136c2b0f9893b40421 100644 --- a/data/CRMEntity.php +++ b/data/CRMEntity.php @@ -3125,6 +3125,7 @@ class TrackableObject implements ArrayAccess, IteratorAggregate { } function offsetSet($key, $value) { + if(is_array($value)) $value = empty($value) ? "" : $value[0]; if($this->tracking && $this->trackingEnabled) { $olderValue = $this->offsetGet($key); // decode_html only expects string diff --git a/includes/http/Request.php b/includes/http/Request.php index 43f0805243a246cf733852acf68f576160a6484d..c8282f7512a3350ca04c9e56351fa226f79db351 100644 --- a/includes/http/Request.php +++ b/includes/http/Request.php @@ -72,7 +72,8 @@ class Vtiger_Request implements ArrayAccess { } } if($isJSON) { - $value = json_decode($value, true); + $decodeValue = json_decode($value, true); + $value = json_last_error() ? $value : $decodeValue; } //Handled for null because vtlib_purify returns empty string diff --git a/modules/Vtiger/handlers/CheckDuplicateHandler.php b/modules/Vtiger/handlers/CheckDuplicateHandler.php index db45150109d852acfb7f67e8c81aa065e600c21a..45bafffb449882bbdb1af64760e956928de6c9d5 100644 --- a/modules/Vtiger/handlers/CheckDuplicateHandler.php +++ b/modules/Vtiger/handlers/CheckDuplicateHandler.php @@ -139,6 +139,7 @@ class CheckDuplicateHandler extends VTEventHandler { $fieldValue = $uniqueFieldsData[$fieldName]; if (isset($fieldValue)) { + if(is_array($fieldValue)) $fieldValue = empty($fieldValue) ? "" : $fieldValue; array_push($conditions, "$fieldTableName.$fieldColumnName = ?"); } else { $fieldValue = ''; diff --git a/modules/Vtiger/helpers/ShowFile.php b/modules/Vtiger/helpers/ShowFile.php index e321f7e00437f28a37094da6dda5637a3a16806c..f40217121a409ec12bc71a29e8d4ffc777f14424 100644 --- a/modules/Vtiger/helpers/ShowFile.php +++ b/modules/Vtiger/helpers/ShowFile.php @@ -68,7 +68,7 @@ class Vtiger_ShowFile_Helper { $handle = fopen($finalFilePath, "rb"); $contents = fread($handle, filesize($finalFilePath)); fclose($handle); - + //added since other than image files we need file names, other wise it downloads with public.php extension which is treated as dangerous if($sanitizedFileName) { header("Content-Disposition: attachment; filename=\"$sanitizedFileName\"");