Improved worflow panel

YetiForceCompany · Aug 26, 2022 · cd82ecc · cd82ecc
1 parent 2f1b29d
commit cd82ecc
Show file tree

Hide file tree

Showing 16 changed files with 129 additions and 356 deletions.
diff --git a/config/version.php b/config/version.php
@@ -1,7 +1,7 @@
 <?php
 
 return [
-	'appVersion' => '6.4.13',
+	'appVersion' => '6.4.14',
 	'patchVersion' => '2022.08.26',
 	'lib_roundcube' => '0.3.1',
 ];
diff --git a/layouts/basic/modules/Settings/Workflows/AdvanceFilterCondition.tpl b/layouts/basic/modules/Settings/Workflows/AdvanceFilterCondition.tpl
@@ -6,7 +6,7 @@
 * The Initial Developer of the Original Code is vtiger.
 * Portions created by vtiger are Copyright (C) vtiger.
 * All Rights Reserved.
-*
+* Contributor(s): YetiForce S.A.
 ********************************************************************************/
 -->*}
 {strip}
@@ -33,7 +33,7 @@
 							{else}
 								{assign var=FIELD_VALUE value=""}
 							{/if}
-							<option value="{$FIELD_MODEL->$columnNameApi()}"
+							<option value="{$FIELD_MODEL->$columnNameApi()|escape}"
 								data-fieldtype="{$FIELD_MODEL->getFieldType()}" data-field-name="{$FIELD_NAME}"
 								{if !empty($CONDITION_INFO['columnname']) && App\Purifier::decodeHtml($FIELD_MODEL->$columnNameApi()) eq $CONDITION_INFO['columnname']}
 									{assign var=FIELD_TYPE value=$FIELD_MODEL->getFieldDataType()}
@@ -73,15 +73,15 @@
 				</select>
 			</div>
 			<div class="col-md-4 fieldUiHolder">
-				<input name="{if !empty($SELECTED_FIELD_MODEL)}{$SELECTED_FIELD_MODEL->get('name')}{/if}" data-value="value"
+				<input name="{if !empty($SELECTED_FIELD_MODEL)}{$SELECTED_FIELD_MODEL->get('name')|escape}{/if}" data-value="value"
 					class="form-control" type="text"
 					value="{if !empty($CONDITION_INFO['value'])}{$CONDITION_INFO['value']|escape}{/if}" />
 			</div>
 			<span class="d-none">
 				{if empty($CONDITION)}
 					{assign var=CONDITION value="and"}
 				{/if}
-				<input type="hidden" name="column_condition" value="{$CONDITION}" />
+				<input type="hidden" name="column_condition" value="{$CONDITION|escape}" />
 			</span>
 			<span class="col-md-1">
 				<button class="btn btn-danger js-condition-delete" type="button" data-js="click">

diff --git a/layouts/basic/modules/Settings/Workflows/CreateEntity.tpl b/layouts/basic/modules/Settings/Workflows/CreateEntity.tpl
@@ -17,7 +17,7 @@
 <input type="hidden" id="workflowModuleName" value="{$SOURCE_MODULE}">
 <input type="hidden" id="fieldValueMapping" name="field_value_mapping"
 	value="{if !empty($TASK_OBJECT->field_value_mapping)}{\App\Purifier::encodeHtml($TASK_OBJECT->field_value_mapping)}{/if}" />
-<input type="hidden" value="{$REFERENCE_FIELD_NAME}" name="reference_field" id="reference_field" />
+<input type="hidden" value="{$REFERENCE_FIELD_NAME|escape}" name="reference_field" id="reference_field" />
 <div class="js-conditions-container" id="save_fieldvaluemapping" data-js="container">
 	{if $RELATED_MODULE_MODEL_NAME neq ''}
 		<div>
@@ -42,23 +42,23 @@
 							{assign var=FIELD_INFO value=$FIELD_MODEL->getFieldInfo()}
 							{if $FIELD_MODEL->getFieldDataType() == 'owner'}
 								{$SPECIAL_OPTION = [\App\Language::translate('LBL_SPECIAL_OPTIONS') => [
-																	'assigned_user_id' => \App\Language::translate('LBL_PARENT_OWNER'),
-																	'triggerUser' => \App\Language::translate('LBL_TRIGGER_USER',$QUALIFIED_MODULE)
-																	]
-																]}
+												'assigned_user_id' => \App\Language::translate('LBL_PARENT_OWNER'),
+												'triggerUser' => \App\Language::translate('LBL_TRIGGER_USER',$QUALIFIED_MODULE)
+												]
+											]}
 								{$FIELD_INFO['picklistvalues'] = array_merge($FIELD_INFO['picklistvalues'], $SPECIAL_OPTION)}
 							{/if}
-							<option value="{$FIELD_MODEL->getName()}"
+							<option value="{$FIELD_MODEL->getName()|escape}"
 								{if $FIELD_MAP['fieldname'] eq $FIELD_MODEL->getName()}
 									{assign var=MANDATORY_FIELD value=$FIELD_MODEL->isMandatory()}
 									{assign var=FIELD_TYPE value=$FIELD_MODEL->getFieldDataType()}
 									{assign var=IS_REFERENCE value=$FIELD_MODEL->isReferenceField()}
 									selected=""
 								{/if}
-								data-fieldtype="{$FIELD_MODEL->getFieldType()}"
-								data-field-name="{$FIELD_MODEL->getName()}"
+								data-fieldtype="{$FIELD_MODEL->getFieldType()|escape}"
+								data-field-name="{$FIELD_MODEL->getName()|escape}"
 								data-fieldinfo="{\App\Purifier::encodeHtml(\App\Json::encode($FIELD_INFO))}"
-								data-reference="{$FIELD_MODEL->isReferenceField()}">
+								data-reference="{$FIELD_MODEL->isReferenceField()|escape}">
 								{\App\Language::translate($FIELD_MODEL->getFieldLabel(), $RELATED_MODULE_MODEL_NAME)}{if $FIELD_MODEL->isMandatory()}
 									<span class="redColor">*</span>
 								{/if}
@@ -70,15 +70,15 @@
 					<select name="modulename"
 						class="select2 form-control" {if ($FIELD_TYPE eq 'picklist' || $FIELD_TYPE eq 'multipicklist' || $IS_REFERENCE)} disabled="" {/if}>
 						<option {if $FIELD_MAP['modulename'] eq $SOURCE_MODULE} selected="" {/if}
-							value="{$SOURCE_MODULE}">{\App\Language::translate('LBL_SOURCE_MODULE', $QUALIFIED_MODULE)}: {\App\Language::translate($SOURCE_MODULE, $SOURCE_MODULE)}</option>
+							value="{$SOURCE_MODULE|escape}">{\App\Language::translate('LBL_SOURCE_MODULE', $QUALIFIED_MODULE)}: {\App\Language::translate($SOURCE_MODULE, $SOURCE_MODULE)}</option>
 						<option {if $FIELD_MAP['modulename'] eq {'destinyModule::'|cat:$RELATED_MODULE_MODEL_NAME} || ($FIELD_MAP['modulename'] eq $RELATED_MODULE_MODEL_NAME && $SOURCE_MODULE neq $RELATED_MODULE_MODEL_NAME)} selected="" {/if}
-							value="destinyModule::{$RELATED_MODULE_MODEL_NAME}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL_NAME, $RELATED_MODULE_MODEL_NAME)}</option>
+							value="destinyModule::{$RELATED_MODULE_MODEL_NAME|escape}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL_NAME, $RELATED_MODULE_MODEL_NAME)}</option>
 					</select>
 				</div>
 				<div class="fieldUiHolder col-md-4">
 					<input type="text" class="getPopupUi form-control" readonly="" name="fieldValue"
-						value="{$FIELD_MAP['value']}" />
-					<input type="hidden" name="valuetype" value="{$FIELD_MAP['valuetype']}" />
+						value="{$FIELD_MAP['value']|escape}" />
+					<input type="hidden" name="valuetype" value="{$FIELD_MAP['valuetype']|escape}" />
 				</div>
 				{if $MANDATORY_FIELD neq true || $MAPPING_PANEL}
 					<button type="button" class="btn btn-danger js-condition-delete" data-js="click">
@@ -113,22 +113,22 @@
 							{assign var=FIELD_INFO value=$FIELD_MODEL->getFieldInfo()}
 							{if $FIELD_MODEL->getFieldDataType() == 'owner'}
 								{$SPECIAL_OPTION = [\App\Language::translate('LBL_SPECIAL_OPTIONS') => [
-														'assigned_user_id' => \App\Language::translate('LBL_PARENT_OWNER'),
-														'triggerUser' => \App\Language::translate('LBL_TRIGGER_USER',$QUALIFIED_MODULE)
-														]
-													]}
+												'assigned_user_id' => \App\Language::translate('LBL_PARENT_OWNER'),
+												'triggerUser' => \App\Language::translate('LBL_TRIGGER_USER',$QUALIFIED_MODULE)
+												]
+											]}
 								{$FIELD_INFO['picklistvalues'] = array_merge($FIELD_INFO['picklistvalues'], $SPECIAL_OPTION)}
 							{/if}
-							<option value="{$FIELD_MODEL->getName()}"
+							<option value="{$FIELD_MODEL->getName()|escape}"
 								data-fieldtype="{$FIELD_MODEL->getFieldType()}"
 								{if $FIELD_MODEL->getName() eq $MANDATORY_FIELD_MODEL->getName()}
 									{assign var=FIELD_TYPE value=$FIELD_MODEL->getFieldDataType()}
 									{assign var=IS_REFERENCE value=$FIELD_MODEL->isReferenceField()}
 									selected=""
 								{/if}
-								data-field-name="{$FIELD_MODEL->getName()}"
+								data-field-name="{$FIELD_MODEL->getName()|escape}"
 								data-fieldinfo="{\App\Purifier::encodeHtml(\App\Json::encode($FIELD_INFO))}"
-								data-reference="{$FIELD_MODEL->isReferenceField()}">
+								data-reference="{$FIELD_MODEL->isReferenceField()|escape}">
 								{\App\Language::translate($FIELD_MODEL->getFieldLabel(), $RELATED_MODULE_MODEL->getName())}
 								<span class="redColor">*</span>
 							</option>
@@ -140,7 +140,7 @@
 						class="select2 form-control" {if ($FIELD_TYPE eq 'picklist' || $FIELD_TYPE eq 'multipicklist' || $IS_REFERENCE)} disabled="" {/if}>
 						<option value="{$SOURCE_MODULE}">{\App\Language::translate('LBL_SOURCE_MODULE', $QUALIFIED_MODULE)}: {\App\Language::translate($SOURCE_MODULE, $SOURCE_MODULE)}</option>
 						<option {if ($FIELD_TYPE eq 'picklist' || $FIELD_TYPE eq 'multipicklist')} selected="" {/if}
-							value="destinyModule::{$RELATED_MODULE_MODEL->get('name')}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL->get('name'),$RELATED_MODULE_MODEL->get('name'))}</option>
+							value="destinyModule::{$RELATED_MODULE_MODEL->get('name')|escape}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL->get('name'),$RELATED_MODULE_MODEL->get('name'))}</option>
 					</select>
 				</span>
 				<span class="fieldUiHolder col-md-4">
@@ -162,10 +162,10 @@
 					{if $REFERENCE_FIELD_NAME eq $FIELD_MODEL->getName()} {continue} {/if}
 					{assign var=FIELD_INFO value=$FIELD_MODEL->getFieldInfo()}
 					{if $FIELD_MODEL->isWritable() && ($MAPPING_PANEL || (!$FIELD_MODEL->isMandatory() && !$MAPPING_PANEL))}
-						<option value="{$FIELD_MODEL->getName()}" data-fieldtype="{$FIELD_MODEL->getFieldType()}"
-							data-field-name="{$FIELD_MODEL->getName()}"
+						<option value="{$FIELD_MODEL->getName()|escape}" data-fieldtype="{$FIELD_MODEL->getFieldType()|escape}"
+							data-field-name="{$FIELD_MODEL->getName()|escape}"
 							data-fieldinfo="{\App\Purifier::encodeHtml(\App\Json::encode($FIELD_INFO))}"
-							data-reference="{$FIELD_MODEL->isReferenceField()}">
+							data-reference="{$FIELD_MODEL->isReferenceField()|escape}">
 							{\App\Language::translate($FIELD_MODEL->getFieldLabel(), $RELATED_MODULE_MODEL_NAME)}
 						</option>
 					{/if}
@@ -175,7 +175,7 @@
 		<div class="col-md-3">
 			<select name="modulename" class="form-control">
 				<option value="{$SOURCE_MODULE}">{\App\Language::translate('LBL_SOURCE_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($SOURCE_MODULE, $SOURCE_MODULE)}</option>
-				<option value="destinyModule::{$RELATED_MODULE_MODEL->get('name')}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL->get('name'), $RELATED_MODULE_MODEL->get('name'))}</option>
+				<option value="destinyModule::{$RELATED_MODULE_MODEL->get('name')|escape}">{\App\Language::translate('LBL_DESTINY_MODULE', $QUALIFIED_MODULE)} {\App\Language::translate($RELATED_MODULE_MODEL->get('name'), $RELATED_MODULE_MODEL->get('name'))}</option>
 			</select>
 		</div>
 		<div class="fieldUiHolder col-md-4">

diff --git a/layouts/basic/modules/Settings/Workflows/EditTask.tpl b/layouts/basic/modules/Settings/Workflows/EditTask.tpl
@@ -21,13 +21,13 @@
 					</button>
 				</div>
 				<form class="form-horizontal" id="saveTask" method="post" action="index.php">
-					<input type="hidden" name="module" value="{$MODULE}" />
+					<input type="hidden" name="module" value="{$MODULE|escape}" />
 					<input type="hidden" name="parent" value="Settings" />
 					<input type="hidden" name="action" value="TaskAjax" />
 					<input type="hidden" name="mode" value="save" />
 					<input type="hidden" name="for_workflow" value="{$WORKFLOW_ID}" />
 					<input type="hidden" name="task_id" value="{$TASK_ID}" />
-					<input type="hidden" name="taskType" id="taskType" value="{$TASK_TYPE_MODEL->get('tasktypename')}" />
+					<input type="hidden" name="taskType" id="taskType" value="{\App\Purifier::encodeHtml($TASK_TYPE_MODEL->get('tasktypename'))}" />
 					<div class="modal-body tabbable">
 						<div class="form-row pb-3">
 							<div class="col-md-2">
@@ -38,7 +38,7 @@
 							</div>
 							<div class="col-md-5">
 								<input name="summary" class="form-control" data-validation-engine='validate[required]'
-									type="text" value="{$TASK_MODEL->get('summary')}" />
+									type="text" value="{\App\Purifier::encodeHtml($TASK_MODEL->get('summary'))}" />
 							</div>
 							<div class="col-md-4 form-control-plaintext">
 								<div class="float-left">{\App\Language::translate('LBL_STATUS',$QUALIFIED_MODULE)}</div>
@@ -77,7 +77,7 @@
 									id="checkSelectDateContainer">
 									<div class="col-md-2">
 										<input class="form-control" type="text" name="select_date_days"
-											value="{if !empty($DAYS)}{$DAYS}{/if}"
+											value="{if !empty($DAYS)}{$DAYS|escape}{/if}"
 											data-validation-engine="validate[funcCall[Vtiger_WholeNumber_Validator_Js.invokeValidation]]">
 									</div>
 									<div class="col-form-label float-left alignMiddle">{\App\Language::translate('LBL_DAYS',$QUALIFIED_MODULE)}</div>
@@ -93,7 +93,7 @@
 										<select class="select2" name="select_date_field">
 											{foreach from=$DATETIME_FIELDS item=DATETIME_FIELD}
 												<option {if !empty($TRIGGER['field']) && ($TRIGGER['field'] eq $DATETIME_FIELD->get('name'))} selected="" {/if}
-													value="{$DATETIME_FIELD->get('name')}">{\App\Language::translate($DATETIME_FIELD->get('label'), $DATETIME_FIELD->getModuleName())}</option>
+													value="{$DATETIME_FIELD->get('name')|escape}">{\App\Language::translate($DATETIME_FIELD->get('label'), $DATETIME_FIELD->getModuleName())}</option>
 											{/foreach}
 										</select>
 									</div>

diff --git a/layouts/basic/modules/Settings/Workflows/FieldExpressions.tpl b/layouts/basic/modules/Settings/Workflows/FieldExpressions.tpl
@@ -6,7 +6,7 @@
 * The Initial Developer of the Original Code is vtiger.
 * Portions created by vtiger are Copyright (C) vtiger.
 * All Rights Reserved.
-*
+* Contributor(s): YetiForce S.A.
 ********************************************************************************/
 -->*}
 {strip}
@@ -37,27 +37,27 @@
 							</select>
 						</span>
 						<span class="col-md-4 d-none useFieldContainer">
-							<span name="{$MODULE_MODEL->get('name')}" class="useFieldElement">
+							<span name="{$MODULE_MODEL->get('name')|escape}" class="useFieldElement">
 								{assign var=MODULE_FIELDS value=$MODULE_MODEL->getFields()}
 								<select class="useField form-control"
-										data-placeholder="{\App\Language::translate('LBL_USE_FIELD',$QUALIFIED_MODULE)}">
+									data-placeholder="{\App\Language::translate('LBL_USE_FIELD',$QUALIFIED_MODULE)}">
 									<option></option>
 									<optgroup>
 										{foreach from=$MODULE_FIELDS item=MODULE_FIELD}
-											<option value="{$MODULE_FIELD->getName()}">{\App\Language::translate($MODULE_FIELD->get('label'),$MODULE_MODEL->getName())}</option>
+											<option value="{$MODULE_FIELD->getName()|escape}">{\App\Language::translate($MODULE_FIELD->get('label'),$MODULE_MODEL->getName())}</option>
 										{/foreach}
 									</optgroup>
 								</select>
 							</span>
 							{if !empty($RELATED_MODULE_MODEL)}
-								<span name="{$RELATED_MODULE_MODEL->get('name')}" class="useFieldElement">
+								<span name="{$RELATED_MODULE_MODEL->get('name')|escape}" class="useFieldElement">
 									{assign var=MODULE_FIELDS value=$RELATED_MODULE_MODEL->getFields()}
 									<select class="useField form-control"
-											data-placeholder="{\App\Language::translate('LBL_USE_FIELD',$QUALIFIED_MODULE)}">
+										data-placeholder="{\App\Language::translate('LBL_USE_FIELD',$QUALIFIED_MODULE)}">
 										<option></option>
 										<optgroup>
 											{foreach from=$MODULE_FIELDS item=MODULE_FIELD}
-												<option value="{$MODULE_FIELD->getName()}">{\App\Language::translate($MODULE_FIELD->get('label'), $MODULE_FIELD->getModuleName())}</option>
+												<option value="{$MODULE_FIELD->getName()|escape}">{\App\Language::translate($MODULE_FIELD->get('label'), $MODULE_FIELD->getModuleName())}</option>
 											{/foreach}
 										</optgroup>
 									</select>
@@ -66,33 +66,39 @@
 						</span>
 						<span class="col-md-4 d-none useFunctionContainer">
 							<select class="useFunction form-control"
-									data-placeholder="{\App\Language::translate('LBL_USE_FUNCTION',$QUALIFIED_MODULE)}">
+								data-placeholder="{\App\Language::translate('LBL_USE_FUNCTION',$QUALIFIED_MODULE)}">
 								<option></option>
 								<optgroup>
 									{foreach from=$FIELD_EXPRESSIONS key=FIELD_EXPRESSION_VALUE item=FIELD_EXPRESSIONS_KEY}
-										<option value="{$FIELD_EXPRESSIONS_KEY}">{\App\Language::translate($FIELD_EXPRESSION_VALUE,$QUALIFIED_MODULE)}</option>
+										<option value="{$FIELD_EXPRESSIONS_KEY|escape}">{\App\Language::translate($FIELD_EXPRESSION_VALUE,$QUALIFIED_MODULE)}</option>
 									{/foreach}
 								</optgroup>
 							</select>
 						</span>
 					</div>
-					<br/>
+					<br />
 					<div class="fieldValueContainer">
 						<textarea data-textarea="true" class="fieldValue form-control"></textarea>
 					</div>
-					<br/>
+					<br />
 					<div id="rawtext_help" class="alert alert-info helpmessagebox d-none">
-						<p><h5>{\App\Language::translate('LBL_RAW_TEXT',$QUALIFIED_MODULE)}</h5></p>
+						<p>
+						<h5>{\App\Language::translate('LBL_RAW_TEXT',$QUALIFIED_MODULE)}</h5>
+						</p>
 						<p>2000</p>
 						<p>{\App\Language::translate('LBL_VTIGER',$QUALIFIED_MODULE)}</p>
 					</div>
 					<div id="fieldname_help" class="helpmessagebox alert alert-info d-none">
-						<p><h5>{\App\Language::translate('LBL_EXAMPLE_FIELD_NAME',$QUALIFIED_MODULE)}</h5></p>
+						<p>
+						<h5>{\App\Language::translate('LBL_EXAMPLE_FIELD_NAME',$QUALIFIED_MODULE)}</h5>
+						</p>
 						<p>{\App\Language::translate('LBL_ANNUAL_REVENUE',$QUALIFIED_MODULE)}</p>
 						<p>{\App\Language::translate('LBL_NOTIFY_OWNER',$QUALIFIED_MODULE)}</p>
 					</div>
 					<div id="expression_help" class="alert alert-info helpmessagebox d-none">
-						<p><h5>{\App\Language::translate('LBL_EXAMPLE_EXPRESSION',$QUALIFIED_MODULE)}</h5></p>
+						<p>
+						<h5>{\App\Language::translate('LBL_EXAMPLE_EXPRESSION',$QUALIFIED_MODULE)}</h5>
+						</p>
 						<p>{\App\Language::translate('LBL_ANNUAL_REVENUE',$QUALIFIED_MODULE)}/12</p>
 						<p>{\App\Language::translate('LBL_EXPRESSION_EXAMPLE2',$QUALIFIED_MODULE)}</p>
 					</div>