includes/http/Request.php

@@ -8,28 +8,13 @@
  * All Rights Reserved.
  ************************************************************************************/
 
-class Vtiger_Request implements ArrayAccess {
+class Vtiger_Request {
 
 	// Datastore
 	private $valuemap;
 	private $rawvaluemap;
 	private $defaultmap = array();
 
-	// ArrayAccess Start
-	public function offsetExists($key) {
-		return $this->has($key);
-	}
-	public function offsetSet($key, $value) {
-		$this->set($key, $value);
-	}
-	public function offsetGet($key) {
-		return $this->get($key);
-	}
-	public function offsetUnset($key) {
-		// Ignore
-	}
-	// ArrayAccess End
-
 	/**
 	 * Default constructor
 	 */
@@ -72,13 +57,19 @@ class Vtiger_Request implements ArrayAccess {
 			}
 		}
 		if($isJSON) {
-			$value = json_decode($value, true);
+                    $oldValue = Zend_Json::$useBuiltinEncoderDecoder;
+                    Zend_Json::$useBuiltinEncoderDecoder = false;
+                    $decodeValue = Zend_Json::decode($value);
+                    if(isset($decodeValue)) {
+                            $value = $decodeValue;
+                    }
+                    Zend_Json::$useBuiltinEncoderDecoder  = $oldValue;
 		}
 
-        //Handled for null because vtlib_purify returns empty string
-        if(!empty($value)){
-            $value = vtlib_purify($value);
-        }
+                //Handled for null because vtlib_purify returns empty string
+                if(!empty($value)){
+                    $value = vtlib_purify($value);
+                }
 		return $value;
 	}
 

includes/main/WebUI.php

@@ -24,7 +24,7 @@ class Vtiger_WebUI extends Vtiger_EntryPoint {
 	protected function checkLogin (Vtiger_Request $request) {
 		if (!$this->hasLogin()) {
 			$return_params = $_SERVER['QUERY_STRING'];
-			if($return_params && !$_SESSION['return_params']) {
+			if(isset($return_params) && $return_params && !$_SESSION['return_params']) {
 				//Take the url that user would like to redirect after they have successfully logged in.
 				$return_params = urlencode($return_params);
 				Vtiger_Session::set('return_params', $return_params);

includes/runtime/BaseModel.php

@@ -11,6 +11,7 @@
 /**
  * Base Model Class
  */
+#[\AllowDynamicProperties]
 class Vtiger_Base_Model {
 	protected $valueMap;
 
@@ -37,7 +38,7 @@ class Vtiger_Base_Model {
 	* @return Raw Value for the given key
 	*/
 	public function getRaw($key){
-		return $this->rawData[$key];
+		return isset($this->rawData[$key]) ? $this->rawData[$key] : '';
 	}
 
 	/**
@@ -84,7 +85,7 @@ class Vtiger_Base_Model {
 	 * @param String $key
 	 */
 	public function has($key) {
-		return array_key_exists($key, $this->valueMap);
+		return array_key_exists($key, (array)$this->valueMap); // valueMap can be array or TrackableObject
 	}
 
 	/**
@@ -95,4 +96,4 @@ class Vtiger_Base_Model {
 		return (!isset($this->valueMap[$key]) || empty($this->valueMap[$key]));
 	}
 
-}
\ No newline at end of file
+}

includes/runtime/Controller.php

@@ -11,6 +11,7 @@
 /**
  * Abstract Controller Class
  */
+#[\AllowDynamicProperties]
 abstract class Vtiger_Controller {
 
 	function __construct() { }
@@ -181,7 +182,10 @@ abstract class Vtiger_View_Controller extends Vtiger_Action_Controller {
 			$viewer->assign('PARENT_MODULE', '');
 			$viewer->assign('EXTENSION_MODULE', '');
 			$viewer->assign('moduleName', '');
+			$viewer->assign('CURRENT_USER_MODEL', Users_Record_Model::getCurrentUserModel());
 			$viewer->assign('CURRENT_USER_ID', $current_user ? $current_user->id : "");
+			$viewer->assign('USER_CURRENCY_SYMBOL', ''); // will be initialized later
+			$viewer->assign('INVENTORY_MODULES', array());
 
 			$viewer->assign('NOTIFIER_URL', '');
 			$viewer->assign('GLOBAL_SEARCH_VALUE', '');
@@ -197,13 +201,14 @@ abstract class Vtiger_View_Controller extends Vtiger_Action_Controller {
 			$viewer->assign('NO_EDIT', '');
 			$viewer->assign('SOURCE_MODULE', '');
 			$viewer->assign('OPERATOR', '');
-			$viewer->assign('LISTVIEW_COUNT', 0);
+			$viewer->assign('LISTVIEW_COUNT', '');
 			$viewer->assign('FOLDER_ID', 0);
 			$viewer->assign('FOLDER_VALUE', '');
 			$viewer->assign('VIEWTYPE', '');
 			$viewer->assign('PRINT_TEMPLATE', '');
 			$viewer->assign('CLASS_VIEW_ACTION', '');
 			$viewer->assign('RELATED_MODULE_NAME', '');
+			$viewer->assign('MODULE_BASIC_ACTIONS', array());
 
 			// Editview
 			$viewer->assign('LEFTPANELHIDE', false);
@@ -227,6 +232,11 @@ abstract class Vtiger_View_Controller extends Vtiger_Action_Controller {
 
 			// Popupview
 			$viewer->assign('IS_MODULE_DISABLED', false);
+
+			// Widgets
+			$viewer->assign('SCRIPTS', array());
+			$viewer->assign('STYLES', array());
+			$viewer->assign('SETTING_EXIST', false);
 		}
 		return $this->viewer;
 	}

includes/runtime/LanguageHandler.php

@@ -58,7 +58,9 @@ class Vtiger_Language_Handler {
 	public static function getLanguageTranslatedString($language, $key, $module = '') {
 		$moduleStrings = array();
 
-		$module = str_replace(':', '.', $module);
+		if ($module !== null) {
+			$module = str_replace(':', '.', $module);
+		}
 		if (is_array($module))
 			return null;
 		$moduleStrings = self::getModuleStringsFromFile($language, $module);
@@ -66,7 +68,7 @@ class Vtiger_Language_Handler {
 			return $moduleStrings['languageStrings'][$key];
 		}
 		// Lookup for the translation in base module, in case of sub modules, before ending up with common strings
-		if (strpos($module, '.') > 0) {
+		if ($module != null && strpos($module, '.') > 0) {
 			$baseModule = substr($module, 0, strpos($module, '.'));
 			if ($baseModule == 'Settings') {
 				$baseModule = 'Settings.Vtiger';
@@ -124,7 +126,7 @@ class Vtiger_Language_Handler {
 	 * @return <array> - array if module has language strings else returns empty array
 	 */
 	public static function getModuleStringsFromFile($language, $module='Vtiger'){
-		$module = str_replace(':', '.', $module);
+		if($module !== null) $module = str_replace(':', '.', $module);
 		if (!empty(self::$languageContainer[$language][$module])) {
 		    return self::$languageContainer[$language][$module];
 		}
@@ -132,7 +134,7 @@ class Vtiger_Language_Handler {
 			$qualifiedName = 'languages.'.$language.'.'.$module;
 			$file = Vtiger_Loader::resolveNameToPath($qualifiedName);
 			$languageStrings = $jsLanguageStrings = array();
-			if (!self::$fileExists[$file]) {
+			if (!isset(self::$fileExists[$file])) {
 				self::$fileExists[$file] = file_exists($file) ? 'yes' : 'no';
 			}
 			if (self::$fileExists[$file] == 'yes') {
@@ -147,7 +149,7 @@ class Vtiger_Language_Handler {
         $file = Vtiger_Loader::resolveNameToPath($qualifiedCustomName);
 
         $languageStrings = $jsLanguageStrings = array();
-		if (!self::$fileExists[$file]) {
+		if (!isset(self::$fileExists[$file])) {
 			self::$fileExists[$file] = file_exists($file) ? 'yes' : 'no';
 		}
 		if (self::$fileExists[$file] == 'yes') {            

includes/runtime/Theme.php

@@ -65,7 +65,18 @@ class Vtiger_Theme extends Vtiger_Viewer {
 	 * @return <string> - theme folder
 	 */
 	public static function getBaseThemePath(){
-		return 'layouts'. '/' . self::getLayoutName(). '/skins';
+		$basepath = 'layouts'. '/' . self::getLayoutName();
+		$useskin = static::DEFAULTSKIN;
+
+		// do we have any override valid custom skin?
+		$customskin = isset($_SESSION) && isset($_SESSION['authenticated_user_skin']) ?  $_SESSION['authenticated_user_skin'] : '';
+		if ($customskin && !preg_match("/[^a-zA-Z0-9_-]/", $customskin)) { // strict-check to avoid file-inclusion attack.
+			$customskin = "custom_skins/" . $customskin;      // lookup path
+			if (file_exists($basepath . '/' . $customskin)) { // ensure validity
+				$useskin = $customskin;
+			}
+		}
+		return $basepath . '/' . $useskin;
 	}
 
 	/**
@@ -108,7 +119,11 @@ class Vtiger_Theme extends Vtiger_Viewer {
 	 * @return <Array>
 	 */
 	public static function getAllSkins(){
-		return Vtiger_Util_Helper::getAllSkins();
+		$dirs = glob("layouts/". static::DEFAULTLAYOUT . "/custom_skins/*", GLOB_ONLYDIR);
+		if (!empty($dirs)) {
+			$dirs = array_map('basename', $dirs);
+		}
+		return $dirs;
 	}
 
 	/**

includes/runtime/Viewer.php

@@ -11,6 +11,7 @@
 class Vtiger_Viewer extends Smarty {
 
 	const DEFAULTLAYOUT = 'v7';
+	const DEFAULTSKIN   = 'skins';
 	const DEFAULTTHEME  = 'softed';
 	static $currentLayout;
 	
@@ -70,6 +71,46 @@ class Vtiger_Viewer extends Smarty {
 			
 			$this->log("URI: $debugViewerURI, TYPE: " . $_SERVER['REQUEST_METHOD']);
 		}
+
+		// TODO: Refactor to specific module dependency.
+		$inSettings = isset($_REQUEST["parent"]) && $_REQUEST["parent"] == "Settings";
+
+		$classes = array('Vtiger_MenuStructure_Model', 'Users_Privileges_Model', 
+			'Vtiger_Module_Model', 'Settings_MenuEditor_Module_Model', 'Vtiger_Util_Helper', 
+			'ZEND_JSON', 'Zend_Json', 'Zend_JSON', 'ZEND_json',
+			'Vtiger_Theme', 'Users_Record_Model', 'Vtiger_Module_Model', 'Vtiger_Field_Model', 'Vtiger_Record_Model',
+			'Settings_Picklist_Module_Model', 'CustomView_Record_Model', 'Vtiger_Extension_View',
+			'Vtiger_Tag_Model', 'Settings_Vtiger_Module_Model', 'PBXManager_Server_Model',
+			'Vtiger_Functions', 'Users', 'CurrencyField', 'Reports_Field_Model', 
+			'DateTimeField', 'Calendar_Time_UIType', 'Calendar_Field_Model',
+			'Vtiger_Date_UIType', 'Vtiger_Time_UIType', 'Vtiger_RelationListView_Model',
+			'Inventory_TaxRegion_Model', 'EmailTemplates_Module_Model');
+
+		if ($inSettings) {
+			$classes = array_merge($classes, array(
+				'getInventoryModules', 'Settings_Vtiger_MenuItem_Model', 'Settings_Webforms_Record_Model',
+				'Settings_Vtiger_CompanyDetails_Model', 'Inventory_Charges_Model', 'Settings_PBXManager_Module_Model',
+				'PBXManager_PBXManager_Connector', 'Settings_Webforms_Record_Model', 'Google_Config_Connector'
+			));
+		}
+
+		foreach ($classes as $clazz) {
+			if (class_exists($clazz)) {
+				$this->registerClass($clazz, $clazz);
+			}
+		}
+
+		$modifiers = array('vtranslate', 'vtlib_isModuleActive', 'vimage_path', 'strstr', 'stripos', 'strpos', 'date', 'vtemplate_path', 'vresource_url', 
+			'html_entity_decode', 'decode_html', 'vtlib_purify', 'php7_count', 'getUserFullName', 'array_flip', 'explode', 'trim', 'array_push', 'array_merge',
+			'array_map', 'array_key_exists', 'get_class', 'vtlib_array', 'getDuplicatesPreventionMessage', 'htmlentities', 'purifyHtmlEventAttributes',
+			'getCurrencySymbolandCRate', 'getProductBaseCurrency', 'mb_substr', 'isPermitted', 'getOwnerName', 'getEntityName', 'function_exists', 'php7_trim', 'php7_htmlentities',
+			'strtolower', 'strtoupper', 'str_replace', 'urlencode', 'getTranslatedCurrencyString', 'getTranslatedString', 'is_object', 'is_numeric','preg_match',
+			'php7_sizeof', 'method_exists','implode','mt_rand','substr','in_array','array_keys', 'json_decode', 'getCurrencyDecimalPlaces', 'number_format', 'isRecordExists');
+		foreach ($modifiers as $modifier) {
+			if (function_exists($modifier)) {
+				$this->registerPlugin('modifier', $modifier, $modifier);
+			}
+		}
 	}
 
 	// Backward compatible to SmartyBC
@@ -110,7 +151,7 @@ class Vtiger_Viewer extends Smarty {
 	 * @return <String> - Module specific template path if exists, otherwise default template path for the given template name
 	 */
 	public function getTemplatePath($templateName, $moduleName='') {
-		$moduleName = str_replace(':', '/', $moduleName);
+		$moduleName = isset($moduleName) ? str_replace(':', '/', $moduleName) : '';
 		$completeFilePath = $this->getTemplateDir(0). DIRECTORY_SEPARATOR . "modules/$moduleName/$templateName";
 		if(!empty($moduleName) && file_exists($completeFilePath)) {
 			return "modules/$moduleName/$templateName";

includes/runtime/cache/Connectors.php

@@ -8,6 +8,7 @@
  * All Rights Reserved.
  *************************************************************************************/
 
+#[\AllowDynamicProperties]
 class Vtiger_Cache_Connector_Memory {
 	function set($key, $value) {
 		$this->$key = $value;

kcfinder/lib/class_gd.php

@@ -52,8 +52,13 @@ class gd {
             $height = @imagesy($image);
 
         } elseif (is_array($image)) {
-            list($key, $width) = each($image);
-            list($key, $height) = each($image);
+            $key = key($image);
+            $width = current($image);
+            next($image);
+
+            $key = key($image);
+            $height = current($image);
+            next($image);
             $image = imagecreatetruecolor($width, $height);
 
         } elseif (false !== (list($width, $height, $type) = @getimagesize($image))) {
@@ -71,8 +76,8 @@ class gd {
         }
 
         $return = (
-            is_resource($image) &&
-            (get_resource_type($image) == "gd") &&
+            ((is_resource($image) && get_resource_type($image) === 'gd') ||
+            (is_object($image) && $image instanceof \GDImage)) &&
             isset($width) &&
             isset($height) &&
             (preg_match('/^[1-9][0-9]*$/', $width) !== false) &&

languages/en_us/Settings/CronTasks.php

@@ -24,4 +24,5 @@ $languageStrings = array(
 	'LBL_RUNNING' => 'Running',
 	'LBL_ACTIVE' => 'Active',
 	'LBL_INACTIVE' => 'In Active',
+    'LBL_ERROR' => 'ERROR',
 );

languages/en_us/Settings/Roles.php

@@ -35,6 +35,7 @@ $languageStrings = array(
 	'LBL_ALL_USERS' => 'All Users',
 	'LBL_USERS_WITH_LOWER_LEVEL' => 'Users having Subordinate Role',
 	'LBL_USERS_WITH_SAME_OR_LOWER_LEVEL' => 'Users having Same Role or Subordinate Role',
+        'LBL_USERS_WITH_SAME_LEVEL_AND_SUBORDINATES' => 'Users having Same Level or Subordinate Role',
     
     /*Vtiger7 String*/
     'LBL_EDIT_ROLE' => 'Edit Role',

languages/en_us/Vtiger.php

@@ -447,6 +447,8 @@ $languageStrings = array(
 	'LBL_LAST_60_DAYS' => 'Last 60 Days',
 	'LBL_LAST_90_DAYS' => 'Last 90 Days',
 	'LBL_LAST_120_DAYS' => 'Last 120 Days',
+	'LBL_NEXT_7_DAYS' => 'Next 7 Days',
+	'LBL_NEXT_14_DAYS' => 'Next 14 Days',
 	'LBL_NEXT_30_DAYS' => 'Next 30 Days',
 	'LBL_NEXT_60_DAYS' => 'Next 60 Days',
 	'LBL_NEXT_90_DAYS' => 'Next 90 Days',
@@ -1393,6 +1395,7 @@ $languageStrings = array(
 	'LBL_RELATED_MODULES_PERMISSION_DENIED' => 'Related modules permission is denied',
 	'LBL_RECORD_PERMISSION_DENIED' => 'Record permissions denied',
 	'LBL_MASS_SELECT' => 'Mass Select',
+	'LBL_DASHBOARD_TAB_INVALID' => 'Invalid Tab Name ',
 );
 
 $jsLanguageStrings = array(
@@ -1420,7 +1423,7 @@ $jsLanguageStrings = array(
 	'JS_SUBJECT_VALUE_CANT_BE_EMPTY' => 'Subject value cannot be empty',
 	'JS_PERCENTAGE_SHOULD_BE_LESS_THAN_100' => 'Percentage should be less than 100',
 
-
+	'INVALID PICKLIST'  => 'Invalid value for Picklist field',
 	'INVALID_NUMBER_OF' => 'Invalid number of',
 	'INVALID_NUMBER' => 'Invalid number',
 	'JS_LBL_ARE_YOU_SURE_YOU_WANT_TO_DELETE' => 'Are you sure that you want to delete?',