Merge branch 'release/4.0.3.1'

minthcm · May 20, 2024 · d13bf26 · d13bf26
2 parents c7ba6ff + 479116c
commit d13bf26
Show file tree

Hide file tree

Showing 5 changed files with 15 additions and 4 deletions.
diff --git a/legacy/Api/V8/Config/services/beanAliases.php b/legacy/Api/V8/Config/services/beanAliases.php
@@ -53,7 +53,6 @@
             User::class => 'Users',
             UserPreference::class => 'UserPreferences',
             vCal::class => 'vCals',
-            'Contracts' => AOS_Contracts::class,
             'Invoices' => AOS_Invoices::class,
             'ProductQuotes' => AOS_Products_Quotes::class,
             'Quotes' => AOS_Quotes::class,

diff --git a/legacy/Api/V8/Service/MetaService.php b/legacy/Api/V8/Service/MetaService.php
@@ -332,12 +332,22 @@ protected function mergeSubpanelFields($array, $module_fields)
 
     protected function getSubpanelSetup(\SubPanelDefinitions $sb)
     {
+        // MintHCM #87119 start
+        global $current_user;
+        $visible_modules = query_module_access_list($current_user);
+        \ACLController::filterModuleList($visible_modules, false);
+        // MintHCM #87119 end
         $array = [];
         $hidden_subpanels = $sb->get_hidden_subpanels();
         foreach ($sb->layout_defs['subpanel_setup'] as $name => $defs) {
             if (in_array(strtolower($defs['module'] ?? ''), $hidden_subpanels)) {
                 continue;
             }
+            // MintHCM #87119 start
+            if (!in_array($defs['module'], $visible_modules)) {
+                continue;
+            }
+            // MintHCM #87119 end
             $module_bean = \BeanFactory::newBean($defs['module']);
             $array[$name]['properties'] = $defs;
             if (!empty($module_bean) && $module_bean instanceof \SugarBean) {

diff --git a/legacy/include/MVC/Controller/SugarController.php b/legacy/include/MVC/Controller/SugarController.php
@@ -1181,6 +1181,7 @@ public function action_kanbanView()
         if (method_exists($object, $action)) {
             return json_encode($object->$action($_REQUEST));
         } else {
+            $action = htmlspecialchars($action);
             sugar_die('Class does not have function: '.$class_name.'->'.$action);
         }
     }
@@ -1225,6 +1226,7 @@ public function action_ESList()
             echo json_encode($object->$action($data));
             exit;
         } else {
+            $action = htmlspecialchars($action);
             sugar_die('Class does not have function: '.$class_name.'->'.$action);
         }
     }

diff --git a/legacy/minthcm_version.php b/legacy/minthcm_version.php
@@ -46,5 +46,5 @@
     die('Not A Valid Entry Point');
 }
 
-$minthcm_version = '4.0.3';
-$minthcm_timestamp = '2024-05-10 09:00:00';
+$minthcm_version = '4.0.3.1';
+$minthcm_timestamp = '2024-05-20 09:00:00';
diff --git a/legacy/modules/Dictionaries/Dictionaries.php b/legacy/modules/Dictionaries/Dictionaries.php
@@ -75,7 +75,7 @@ public function bean_implements($interface)
     public function ACLAccess($view, $is_owner = 'not_set', $in_group = 'not_set')
     {
         global $current_user;
-        if ($current_user->isAdmin()) {
+        if ($current_user->isAdmin() || in_array($view, ['view'])) { // MintHCM #98749
             return true;
         }
         return false;