CVE-2022-0756 (published 2022-03-07T13:15Z)

Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/salesagility/suitecrm
commit_details: repo_url: https://github.com/salesagility/suitecrm
author: Matt Lorimer
author_date: 2022-03-01 12:32:15+00:00
msg: SuiteCRM 7.12.5 Release
repository: repo_url: https://github.com/salesagility/suitecrm
repo_name: salesagility/SuiteCRM
description: SuiteCRM - Open source CRM for the world
repo_language: PHP
owner: salesagility
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,7 @@
   <img width="180px" height="41px" src="https://suitecrm.com/wp-content/uploads/2017/12/logo.png" align="right" />
 </a>
 
-# SuiteCRM 7.12.4
+# SuiteCRM 7.12.5
 
 [![Build Status](https://travis-ci.org/salesagility/SuiteCRM.svg?branch=hotfix)](https://travis-ci.org/salesagility/SuiteCRM)
 [![codecov](https://codecov.io/gh/salesagility/SuiteCRM/branch/hotfix/graph/badge.svg)](https://codecov.io/gh/salesagility/SuiteCRM/branch/hotfix)

programming_language: Markdown
filename: files.md5
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 <?php
-// created: 2022-02-10 17:00:00
+// created: 2022-03-01 17:00:00
 $md5_string = array (
   './Api/Core/Config/ApiConfig.php' => '69a1e7b3d7755a2a63499a16ddae81cf',
   './Api/Core/Config/slim.php' => 'b134e68765e6a1403577e2a5a06322b8',
@@ -40,7 +40,7 @@ $md5_string = array (
   './Api/V8/JsonApi/Helper/AttributeObjectHelper.php' => '8c2e2f889cefdc7912fd62da3e6a6f71',
   './Api/V8/JsonApi/Helper/PaginationObjectHelper.php' => 'dbeb8f36cc7b70ff9459443c26bdfb70',
   './Api/V8/JsonApi/Helper/RelationshipObjectHelper.php' => '6681a3fc26e420f12875d4239532946e',
-  './Api/V8/JsonApi/Repository/Filter.php' => 'cc024de98508d60c0d091a58a49fa879',
+  './Api/V8/JsonApi/Repository/Filter.php' => '21279c505e18aacd9f6aea51cc62a3bc',
   './Api/V8/JsonApi/Repository/Sort.php' => '7e9fb4704a056bc944840def1482042d',
   './Api/V8/JsonApi/Response/AttributeResponse.php' => '84318e63e42f0062c8f8231fd4c230d5',
   './Api/V8/JsonApi/Response/DataResponse.php' => '08239b06a911f9d0bd46a28a28d11eda',
@@ -116,7 +116,7 @@ $md5_string = array (
   './ModuleInstall/PackageManager/tpls/PackageManagerLicense.tpl' => 'df5e267d1df5ce08fb9406e42d5b4816',
   './ModuleInstall/PackageManager/tpls/PackageManagerScripts.tpl' => '98e396c0aa57329731fda19c790fffb2',
   './ModuleInstall/extensions.php' => '094f4650261f6efbab1b90b119829388',
-  './README.md' => '3851c72e794004a8dea5141835e9f67f',
+  './README.md' => 'b9189e1dc12fb6ee741b6057b9e70147',
   './RoboFile.php' => '045b82c1df69553824d0e4ffcce6e03c',
   './SugarSecurity.php' => '47e316b2d408e8c5192c8ea4a4f921b3',
   './TreeData.php' => '32873e20cb5fd33f9d1cdaf18c3cac5c',
@@ -1064,10 +1064,11 @@ $md5_string = array (
   './include/SugarObjects/templates/basic/metadata/detailviewdefs.php' => '5e50674a38a33a6a32e0ccaf452901cf',
   './include/SugarObjects/templates/basic/metadata/editviewdefs.php' => 'a72fc3bcb6c8d3af8c7e2fd5a16b449e',
   './include/SugarObjects/templates/basic/metadata/listviewdefs.php' => '12c67a104a6f959be11749ba807adf8a',
-  './include/SugarObjects/templates/basic/metadata/metafiles.php' => '5dc7c77d1e65d8f0e5dafa6f5d4b3969',
+  './include/SugarObjects/templates/basic/metadata/metafiles.php' => '80e1c107fcf93fe0a78cf5dd7146b3f5',
   './include/SugarObjects/templates/basic/metadata/popupdefs.php' => '853844b094d4dfe9a29d59759b21ce1b',
   './include/SugarObjects/templates/basic/metadata/quickcreatedefs.php' => '4b0e405788feef127942e060963a7ee8',
   './include/SugarObjects/templates/basic/metadata/searchdefs.php' => '94bf8c5a3bbffdfb32a1415dd9328587',
+  './include/SugarObjects/templates/basic/metadata/subpaneldefs.php' => 'decf6423acb6b44f331f9f8b54c19ff0',
   './include/SugarObjects/templates/basic/metadata/subpanels/default.php' => 'eef3e143d70cb857fdc15b0014bcbf2d',
   './include/SugarObjects/templates/basic/vardefs.php' => '0c874ef332c71fca9a1255b24ff3a9c8',
   './include/SugarObjects/templates/company/Company.php' => 'b39fc86fb36507f7eb9dcaa95e58e295',
@@ -1086,10 +1087,11 @@ $md5_string = array (
   './include/SugarObjects/templates/company/metadata/detailviewdefs.php' => '6b9f79584faeb9de6b3ea8e1b7773390',
   './include/SugarObjects/templates/company/metadata/editviewdefs.php' => '9149a6f92ca93c9f77d6dcfa74b36f6a',
   './include/SugarObjects/templates/company/metadata/listviewdefs.php' => 'ceae1760bc12932b69ab3f35f68f1998',
-  './include/SugarObjects/templates/company/metadata/metafiles.php' => '5dc7c77d1e65d8f0e5dafa6f5d4b3969',
+  './include/SugarObjects/templates/company/metadata/metafiles.php' => '80e1c107fcf93fe0a78cf5dd7146b3f5',
   './include/SugarObjects/templates/company/metadata/popupdefs.php' => 'e59bf2a176a15e758c982d110b876ab3',
   './include/SugarObjects/templates/company/metadata/quickcreatedefs.php' => '26986647ae09963d834ca32deedf04c7',
   './include/SugarObjects/templates/company/metadata/searchdefs.php' => '32412c1a5d2bec1928b8c1e750308e25',
+  './include/SugarObjects/templates/company/metadata/subpaneldefs.php' => '50acf29d6c53bd5a58dac8b21971d94b',
   './include/SugarObjects/templates/company/metadata/subpanels/default.php' => 'd572c5b3d3492d77bc86949f62fb9a5e',
   './include/SugarObjects/templates/company/vardefs.php' => 'e8c82088efe99f717f63a02b5dc83b29',
   './include/SugarObjects/templates/file/File.php' => 'ea3b3d8394cfac726b77e699597c6370',
@@ -1110,9 +1112,10 @@ $md5_string = array (
   './include/SugarObjects/templates/file/metadata/detailviewdefs.php' => '38ba4302edc39bde885cd3fbd23cef46',
   './include/SugarObjects/templates/file/metadata/editviewdefs.php' => '4e01916bccc26dd18213c486af79339f',
   './include/SugarObjects/templates/file/metadata/listviewdefs.php' => 'ba627c916655ab0e7086aaafba0a2278',
-  './include/SugarObjects/templates/file/metadata/metafiles.php' => '30b981844f4f61f7120cc6fd71e6df2b',
+  './include/SugarObjects/templates/file/metadata/metafiles.php' => 'c44b4a1bae97f1d29608af2aaf3e931d',
   './include/SugarObjects/templates/file/metadata/quickcreatedefs.php' => '6d473036b76f6d6fcc6bf754c8d28748',
   './include/SugarObjects/templates/file/metadata/searchdefs.php' => '968d0e10883675aae697ac2a4915bfcd',
+  './include/SugarObjects/templates/file/metadata/subpaneldefs.php' => 'decf6423acb6b44f331f9f8b54c19ff0',
   './include/SugarObjects/templates/file/metadata/subpanels/default.php' => '1843a1eea57d11427483b4e8760a9c8e',
   './include/SugarObjects/templates/file/vardefs.php' => 'b9cd2c914907a6d18c30117a0ac07b66',
   './include/SugarObjects/templates/file/views/view.edit.php' => 'c6ad729501b57cb2d1c567277a706ee2',
@@ -1134,10 +1137,11 @@ $md5_string = array (
   './include/SugarObjects/templates/issue/metadata/detailviewdefs.php' => '3f99f9fd8ae0b8fc67b635e33b2c69e3',
   './include/SugarObjects/templates/issue/metadata/editviewdefs.php' => 'b0df2be5daf35ad78b51a1bb085e2c36',
   './include/SugarObjects/templates/issue/metadata/listviewdefs.php' => 'fdfc52d80121c3bb7b769955abefd892',
-  './include/SugarObjects/templates/issue/metadata/metafiles.php' => '5dc7c77d1e65d8f0e5dafa6f5d4b3969',
+  './include/SugarObjects/templates/issue/metadata/metafiles.php' => '80e1c107fcf93fe0a78cf5dd7146b3f5',
   './include/SugarObjects/templates/issue/metadata/popupdefs.php' => '0d8e904d55dd66a7a90d38f1d0664bd8',
   './include/SugarObjects/templates/issue/metadata/quickcreatedefs.php' => '368961ada69c8553e7137b604a877f09',
   './include/SugarObjects/templates/issue/metadata/searchdefs.php' => '79c07472d9392384942e22bc6132c8fa',
+  './include/SugarObjects/templates/issue/metadata/subpaneldefs.php' => 'decf6423acb6b44f331f9f8b54c19ff0',
   './include/SugarObjects/templates/issue/metadata/subpanels/default.php' => '11ea1311363e3db9a0b077d21f84f257',
   './include/SugarObjects/templates/issue/vardefs.php' => 'cec1c24e9ae386c840dda523c65ecd77',
   './include/SugarObjects/templates/person/Person.php' => '5586b56db82db3b6a69d31f4cd46d1d9',
@@ -1157,10 +1161,11 @@ $md5_string = array (
   './include/SugarObjects/templates/person/metadata/detailviewdefs.php' => '298b0c970095d044eb0977c8e5ee0376',
   './include/SugarObjects/templates/person/metadata/editviewdefs.php' => '955ed57a59f08bbd8cbb0b7459b2fdb3',
   './include/SugarObjects/templates/person/metadata/listviewdefs.php' => '693f66188d1665c8e410b6bf5be15d27',
-  './include/SugarObjects/templates/person/metadata/metafiles.php' => '5dc7c77d1e65d8f0e5dafa6f5d4b3969',
+  './include/SugarObjects/templates/person/metadata/metafiles.php' => '80e1c107fcf93fe0a78cf5dd7146b3f5',
   './include/SugarObjects/templates/person/metadata/popupdefs.php' => '94cac00bca2eecc5ad30c6169147aa2b',
   './include/SugarObjects/templates/person/metadata/quickcreatedefs.php' => 'a720ca8346a61cb442fa6ad93a51d1b3',
   './include/SugarObjects/templates/person/metadata/searchdefs.php' => '21606aab371fa03e267883d902d944be',
+  './include/SugarObjects/templates/person/metadata/subpaneldefs.php' => 'decf6423acb6b44f331f9f8b54c19ff0',
   './include/SugarObjects/templates/person/metadata/subpanels/default.php' => '552bbb8e4bdecc081ea5567effb05c6b',
   './include/SugarObjects/templates/person/vardefs.php' => '0ff81025316998a27fd5b63f678fa2e4',
   './include/SugarObjects/templates/sale/Chance.php' => 'a22453ee390a8e4f4fe89cde6b7f937c',
@@ -1184,10 +1189,11 @@ $md5_string = array (
   './include/SugarObjects/templates/sale/metadata/detailviewdefs.php' => '3f1afa19a4c3d714e132f69c9d6e7cfa',
   './include/SugarObjects/templates/sale/metadata/editviewdefs.php' => '767b86f216ab3624cb51bebc36c7b79e',
   './include/SugarObjects/templates/sale/metadata/listviewdefs.php' => 'b8a70bd4bc2da7021120f6c92a914acd',
-  './include/SugarObjects/templates/sale/metadata/metafiles.php' => 'c66eca250effcffa927a528e55be1420',
+  './include/SugarObjects/templates/sale/metadata/metafiles.php' => 'c44b4a1bae97f1d29608af2aaf3e931d',
   './include/SugarObjects/templates/sale/metadata/popupdefs.php' => 'dd08f5844bddaf9c47b2323388ae8f00',
   './include/SugarObjects/templates/sale/metadata/quickcreatedefs.php' => '40de9275a19046c346932a467511d903',
   './include/SugarObjects/templates/sale/metadata/searchdefs.php' => '259ca47ed60f67f3fcc5ff9b21487022',
+  './include/SugarObjects/templates/sale/metadata/subpaneldefs.php' => 'decf6423acb6b44f331f9f8b54c19ff0',
   './include/SugarObjects/templates/sale/metadata/subpanels/default.php' => '933ed06ff0fd822b455b6c05d3526b35',
   './include/SugarObjects/templates/sale/vardefs.php' => '0594cbe418f268edf893cced47b022f3',
   './include/SugarObjects/translated_prefix.php' => 'ba8e90a225dfa38f779119b10c366d40',
@@ -2336,7 +2342,7 @@ $md5_string = array (
   './include/javascript/yui/build/yuitest/yuitest_core.js' => 'ed5230a0f4a885d8ea51c2fe78895d07',
   './include/javascript/yui/ygDDList.js' => '0cd9051a220de7e8c79bf5b9cccce10f',
   './include/json_config.php' => 'ba7fb6f2fb1df51bc367835406ef7ba5',
-  './include/language/en_us.lang.php' => 'b3e2e4ddf37fa8614a55749c8f22aea6',
+  './include/language/en_us.lang.php' => '9b8bee2691bda327f6b973fa789de805',
   './include/language/en_us.notify_template.html' => 'c6a897ace7af46a44889dfab1a9d44c5',
   './include/language/getJSLanguage.php' => '1bc910bd5a9953fbf443d3d97fddbffa',
   './include/language/jsLanguage.php' => '3d27819dc00f2fe5426f72733a7edca1',
@@ -2875,7 +2881,7 @@ $md5_string = array (
   './lib/Search/UI/MVC/View.php' => '060017bf23671e429cca7187b72ddd2a',
   './lib/Search/UI/SearchFormController.php' => '2cf159703562da6348ece57ef68313b4',
   './lib/Search/UI/SearchFormView.php' => '15662e4bd9237044fe1b74f41632660d',
-  './lib/Search/UI/SearchResultsController.php' => '5c3be29f03a58a39dea00393c1dfc01e',
+  './lib/Search/UI/SearchResultsController.php' => '21c2ecf52498c7e3109464e4fddd32a7',
   './lib/Search/UI/SearchResultsView.php' => 'ce2615a6390cfe62924d44fdfc7a18fa',
   './lib/Search/UI/SearchThrowableHandler.php' => '14cd2232a5a73df32a755e85a52cd7fd',
   './lib/Search/UI/templates/search.form.tpl' => '8a03f27dd8860270f7c91d64c211fffe',
@@ -3397,7 +3403,7 @@ $md5_string = array (
   './modules/AOR_Reports/vardefs.php' => 'bf0ea6c174abbb8e242b4d6963b8686f',
   './modules/AOR_Reports/views/view.detail.php' => '4b9c8598d6e8a76aa6ec470227012cbc',
   './modules/AOR_Reports/views/view.edit.php' => '0e078b86d2078fc47e4ccf24b3b5d8d4',
-  './modules/AOR_Scheduled_Reports/AOR_Scheduled_Reports.php' => '1d67cfee23f2da1d546578bc27545a74',
+  './modules/AOR_Scheduled_Reports/AOR_Scheduled_Reports.php' => '37085ac71ea851fc00d66dbf569885f7',
   './modules/AOR_Scheduled_Reports/Menu.php' => '5a02efb3ec80ffcb5044e33ac30338c7',
   './modules/AOR_Scheduled_Reports/emailRecipients.js' => '30056240ca6885b19bac0dffe6a15b06',
   './modules/AOR_Scheduled_Reports/emailRecipients.php' => '7859bbf38e5016778fc56495e7d4e177',
@@ -3892,7 +3898,7 @@ $md5_string = array (
   './modules/Bugs/views/view.edit.php' => 'f406f3c7f19e15cd646373151994fa1c',
   './modules/Calendar/Cal.js' => '106379c83260c2472f7c65114d7a9fdb',
   './modules/Calendar/Calendar.php' => '8b5970e1adbf735e0d7f5222012f48ec',
-  './modules/Calendar/CalendarActivity.php' => '0cead97402da329cb1f4748058f3dd0a',
+  './modules/Calendar/CalendarActivity.php' => '9e55048969b6abcb58443296057f8fce',
   './modules/Calendar/CalendarDisplay.php' => 'fd05f849dff1db7bb47713be26e6a3d2',
   './modules/Calendar/CalendarGrid.php' => 'a77c39c149c93a681a75e91f889f9b2c',
   './modules/Calendar/CalendarUtils.php' => '295ad053fe74484ae3943b9fb4487ae1',
@@ -4653,10 +4659,10 @@ $md5_string = array (
   './modules/Emails/controller.php' => '65d6d5ad5e977930403a2b89cb15004a',
   './modules/Emails/field_arrays.php' => 'f8ad985446f13141ea7365aa8565c500',
   './modules/Emails/include/ComposeView/ComposeView.php' => '45b1a69671ca5c5f2a8ab1455e9f730c',
-  './modules/Emails/include/ComposeView/ComposeView.tpl' => '1ec29fbb9803c24e5ed8a12155668e58',
+  './modules/Emails/include/ComposeView/ComposeView.tpl' => 'aee5736e992aecc485afbb5973d9e535',
   './modules/Emails/include/ComposeView/ComposeViewBlank.tpl' => '22365ce6727ffb560e5ad3fc187f13f2',
   './modules/Emails/include/ComposeView/ComposeViewToolbar.tpl' => '656b26827857375278124e4610b9ff06',
-  './modules/Emails/include/ComposeView/EmailsComposeView.js' => '65624a5e5985e5f9deee1e4725533462',
+  './modules/Emails/include/ComposeView/EmailsComposeView.js' => '8ed14ba39eff3d7ec030538431ad3999',
   './modules/Emails/include/DetailView/EmailsDetailView.php' => 'f95937f398f37afe3927ecc035b8b743',
   './modules/Emails/include/DetailView/EmailsDraftDetailView.php' => 'baafca815e89a4c0ec3df8b6192552ea',
   './modules/Emails/include/DetailView/EmailsNonImportedDetailView.php' => 'ef9ecbcf65fa6f03e32f94b6a9805b2f',
@@ -4755,7 +4761,7 @@ $md5_string = array (
   './modules/Emails/templates/outboundDialogTest.tpl' => '6d9e938d23d33fb7fa5582fa15c65662',
   './modules/Emails/templates/overlay.tpl' => '2e323ca505c0e45a3c660f993a20ba29',
   './modules/Emails/templates/successMessage.tpl' => 'dcafb0a92cfae5ffd539a75cb82db2b7',
-  './modules/Emails/vardefs.php' => '3b7cf8c8a768bd5c4d1bcdb5bd05e7d2',
+  './modules/Emails/vardefs.php' => 'dae3869d4728b0bc63a3afe2532ee0cb',
   './modules/Emails/views/view.compose.php' => '655ace129db29e568d901f3223b8afbb',
   './modules/Emails/views/view.deletedraftemail.php' => '4a14718938a8577c683466fbbfec9b23',
   './modules/Emails/views/view.detail.php' => '1dd813258abcba95f09418ef063f0fa7',
@@ -4767,7 +4773,7 @@ $md5_string = array (
   './modules/Emails/views/view.popup.php' => '4ff1e52f105970c29fed966e2f058dd3',
   './modules/Emails/views/view.savedraftemail.php' => '000c8d786c87e0ad997fc5de443d9b2c',
   './modules/Emails/views/view.sendemail.php' => '78784b11ddb5257b0f3f5c59c9db17a1',
-  './modules/Employees/Employee.php' => 'c837db1f7627ee68383a041c51bb8b9c',
+  './modules/Employees/Employee.php' => '2a70486e775ccc8e4c36176855d5c1e7',
   './modules/Employees/EmployeeStatus.php' => 'a2be5cfeb49ef4f8deec01de9686edb9',
   './modules/Employees/EmployeesSearchForm.php' => '0437d91e2221d02c38e0db6830fef057',
   './modules/Employees/EmployeesStudioModule.php' => '5b71bea7b6e7b7a77bc5a48d4fb10a55',
@@ -5171,7 +5177,7 @@ $md5_string = array (
   './modules/ModuleBuilder/MB/header.php' => 'de67588e0b8d859dc2d9fc71709036b4',
   './modules/ModuleBuilder/Module/DropDownBrowser.php' => '3f1698938d776a91255703c257049fac',
   './modules/ModuleBuilder/Module/DropDownTree.php' => '3685a4b70a81e30fccf6c6b2f770c9d8',
-  './modules/ModuleBuilder/Module/IconRepository.php' => '20cd01f8300b411bacffb53361ed6f08',
+  './modules/ModuleBuilder/Module/IconRepository.php' => '5fbd04824f79784669ba38326a18096f',
   './modules/ModuleBuilder/Module/MainTree.php' => '3122ae95f6c9a62db7c6eec12b2581f0',
   './modules/ModuleBuilder/Module/StudioBrowser.php' => '32112741c23435fe2794f797933cfacc',
   './modules/ModuleBuilder/Module/StudioModule.php' => '35525c18e7b1e00379f7d766b9001af5',
@@ -5189,7 +5195,7 @@ $md5_string = array (
   './modules/ModuleBuilder/javascript/studio2RowDD.js' => 'ce2a4bfa3dbaca4249d73df0bc5dfaad',
   './modules/ModuleBuilder/javascript/studiotabgroups.js' => 'c3d48dec838914e457aa099d9225d174',
   './modules/ModuleBuilder/javascript/wizardTemplate.js' => '92c65dce9153db13c20731de44d14d87',
-  './modules/ModuleBuilder/language/en_us.lang.php' => '9171bfd805fcedff0bbc38266d6395b5',
+  './modules/ModuleBuilder/language/en_us.lang.php' => 'b73ec441c51179efa58d1a65e2160252',
   './modules/ModuleBuilder/parsers/ModuleBuilderParser.php' => '1a5d8c3c8c7736c4e9011960732c4647',
   './modules/ModuleBuilder/parsers/ParserFactory.php' => '9f49fbae9d8aadc97257d4cf18672978',
   './modules/ModuleBuilder/parsers/StandardField.php' => '4cbf549bc313959427dc126e9afe01e7',
@@ -5548,7 +5554,7 @@ $md5_string = array (
   './modules/ProjectTask/vardefs.php' => 'd1966d1060fcc2f8245f83e983f4a477',
   './modules/ProjectTask/views/view.list.php' => '8beeb6373e9925ea68b4f1d2121abf06',
   './modules/ProspectLists/Delete.php' => '49e5493083f478e993c36e0941d16bcd',
-  './modules/ProspectLists/Duplicate.php' => '51ef701820dbf25644722d961ed1121f',
+  './modules/ProspectLists/Duplicate.php' => 'f73bdc77dd9e63b24e69897105947500',
   './modules/ProspectLists/Forms.html' => 'f2cb6003b845b3ae60c954c3543c6fe8',
   './modules/ProspectLists/Forms.php' => '304e40b1231cb7dcc58dd49612680582',
   './modules/ProspectLists/Menu.php' => '353995ef7f262ec1186a49f0425f21c0',
@@ -6049,7 +6055,7 @@ $md5_string = array (
   './modules/Users/SetTimezone.tpl' => 'f0fb5ed64fae81a5657ebc8f167967c9',
   './modules/Users/UpdateTourStatus.php' => 'cc111e28e6df1d96b98678661dd42490',
   './modules/Users/User.js' => '351f8d8e74bd1bd0a56dcc2bae31b147',
-  './modules/Users/User.php' => 'e0e65bf73d91fcc730b923eb95fe37c2',
+  './modules/Users/User.php' => 'a75ad79197349bc156f9365ef3830b9c',
   './modules/Users/UserEditView.js' => '421e1c38f1ee78933134b987b7c3c251',
   './modules/Users/UserEmailOptions.tpl' => '96b848efbf7f6d4fee7b6bf13a1a1aee',
   './modules/Users/UserEmailSettings.tpl' => '5d9ff3379f63dcf7c5efbbcc3e88d8ed',
@@ -6266,7 +6272,7 @@ $md5_string = array (
   './modules/vCals/HTTP_WebDAV_Server_vCal.php' => '966b7f0c7c2297ce1bea3a944e4cbd91',
   './modules/vCals/Server.php' => '42c9c6a727bca02d7f1a6c6f4591257b',
   './modules/vCals/field_arrays.php' => 'a1a41e8dd4710a3671fa359dcb8267ba',
-  './modules/vCals/vCal.php' => '11257a95accc06fa64afc8d60425d663',
+  './modules/vCals/vCal.php' => 'e20c0d7ec2b900ce37c8d621db8835ad',
   './modules/vCals/vardefs.php' => 'aa722f4d5a1fa352bc808da9fce072bd',
   './pdf.php' => '9c17ce70f633f699b8f5accd104f7e67',
   './php_version.php' => '928257f676637cf31a03032c3e661e27',
@@ -6336,32 +6342,32 @@ $md5_string = array (
   './soap.php' => 'e28988c2e0b8e2c484587b537a710525',
   './sugar_version.json' => 'bdfbcefae2f9af559bef6a36367df7bb',
   './sugar_version.php' => 'db7b6c8d51f87879fce1e6172eedfbed',
-  './suitecrm_version.php' => '14057aacc3f8a801fddbfd87976aec77',
+  './suitecrm_version.php' => '44698d65949ec2aaa3489747310fb8be',
   './themes/SuiteP/css/Dawn/color-palette.scss' => 'e64677d79e1d68c069bdc2dc661c4f99',
   './themes/SuiteP/css/Dawn/icons.scss' => 'd59f8c5855e7a8df09542a663835a196',
   './themes/SuiteP/css/Dawn/select.ico' => '22393ad23f16c3f1462455bae8f20279',
-  './themes/SuiteP/css/Dawn/style.css' => '4b00f6c1bbea501b7b2d100b7b11e556',
+  './themes/SuiteP/css/Dawn/style.css' => 'fa371bfc0663c488d723ce828d1e7171',
   './themes/SuiteP/css/Dawn/style.scss' => '2fe759bc1c69865732f0ae0cca88916c',
   './themes/SuiteP/css/Dawn/variables.scss' => 'f8f8acf976e6cb0f1d27ea46891ead2e',
   './themes/SuiteP/css/Day/color-palette.scss' => '91bed2ed878a141ccdc521512f0daa33',
   './themes/SuiteP/css/Day/icons.scss' => '7a77bb17a810866e1ec4e0667e58e536',
-  './themes/SuiteP/css/Day/style.css' => 'aa909eb7a2ec2772a66ca0707fe8d419',
+  './themes/SuiteP/css/Day/style.css' => '6d2e8777837f4a3c9c673b403b95eef2',
   './themes/SuiteP/css/Day/style.scss' => '9cdabde7436f1037e691c81017972b8f',
   './themes/SuiteP/css/Day/variables.scss' => '31b6e279ea974581ad42f95a3bb694a4',
   './themes/SuiteP/css/Dusk/color-palette.scss' => '3fa059d1033bfd1bfa342ec0bc4ffe25',
   './themes/SuiteP/css/Dusk/icons.scss' => '7a77bb17a810866e1ec4e0667e58e536',
-  './themes/SuiteP/css/Dusk/style.css' => 'c948f679584e96d3ce39050d36b82e8b',
+  './themes/SuiteP/css/Dusk/style.css' => '5bfde54ca4e8a9315b384a4ae0cdc7f7',
   './themes/SuiteP/css/Dusk/style.scss' => '2fe759bc1c69865732f0ae0cca88916c',
   './themes/SuiteP/css/Dusk/variables.scss' => 'ac38ee874a0668e1d3b86972a850f91d',
   './themes/SuiteP/css/Night/color-palette.scss' => '25653200b97822a2d0f2594b180858c8',
   './themes/SuiteP/css/Night/icons.scss' => '2adfbf917fd7f0748090ef79ec4657c9',
-  './themes/SuiteP/css/Night/style.css' => 'b08ab4c6a46bca69b8b5affc3c108f24',
+  './themes/SuiteP/css/Night/style.css' => 'ee55328617a2cfa5a1a7583db1afd6b6',
   './themes/SuiteP/css/Night/style.scss' => '4b811594274100e02331d7bace01a687',
   './themes/SuiteP/css/Night/variables.scss' => '4fc04d66ddb30f18da508b82e71a6cde',
   './themes/SuiteP/css/Noon/color-palette.scss' => '952a2c7a3fb020ca2232b24a9ac58fe4',
   './themes/SuiteP/css/Noon/icons.scss' => 'b5d0e65cf55142e8591bfcd792b6bed6',
   './themes/SuiteP/css/Noon/select.ico' => '09333d8f426c1a4743e9b977a67d1d1f',
-  './themes/SuiteP/css/Noon/style.css' => '5f0a4b744c3057d5efc137791411aa2a',
+  './themes/SuiteP/css/Noon/style.css' => '504a6fcca636cdbad859ac6a8d1b47c8',
   './themes/SuiteP/css/Noon/style.scss' => '2fe759bc1c69865732f0ae0cca88916c',
   './themes/SuiteP/css/Noon/variables.scss' => 'bea284c3121762d58279aca24c873d9e',
   './themes/SuiteP/css/bootstrap/alerts.scss' => 'c0e5396555dd4c70b9eeb314e4c4613d',
@@ -6461,7 +6467,7 @@ $md5_string = array (
   './themes/SuiteP/css/suitep-base/email.scss' => '4b0a570ce4cdac8bb449f31bccb0ee72',
   './themes/SuiteP/css/suitep-base/forms.scss' => 'e1626b89c1cf4ac8fc16c5f5532c8ac0',
   './themes/SuiteP/css/suitep-base/jstree.scss' => '946510970bb0774a31a01c2fb57a9552',
-  './themes/SuiteP/css/suitep-base/listview.scss' => '083c62124b7f3c7dbf32a3f10e06cf35',
+  './themes/SuiteP/css/suitep-base/listview.scss' => '46898f8372bdd796e5ddeed167bd0c30',
   './themes/SuiteP/css/suitep-base/login.scss' => '25d85a91770e80b7b0357cece6eb5c4b',
   './themes/SuiteP/css/suitep-base/main.scss' => '0ddf085214424ea1f19a13f7930f1c9a',
   './themes/SuiteP/css/suitep-base/mixins.scss' => '9edffdf421f6277979bd76df64d34fad',
@@ -7741,15 +7747,15 @@ $md5_string = array (
   './themes/SuiteP/images/wizmenu/left-start.png' => '85bb13bfd189a2c3e306e7c08753434d',
   './themes/SuiteP/images/wizmenu/right-empty.png' => 'd3037d7c75385e7d5a5708092e8cb94c',
   './themes/SuiteP/images/wizmenu/right-full.png' => '2f6f9936252b8c9dfd7bb71b140061e5',
-  './themes/SuiteP/include/Dashlets/DashletHeader.tpl' => '83586d72dbd43540f4d71b6b5db354f5',
-  './themes/SuiteP/include/DetailView/DetailView.tpl' => '4829a5f5b6ac00c01c321948b4481a95',
+  './themes/SuiteP/include/Dashlets/DashletHeader.tpl' => '09e4767d1ff01a830c0de2706e833a11',
+  './themes/SuiteP/include/DetailView/DetailView.tpl' => 'ff62ab3dc8d5b6e91a4c1041c043592e',
   './themes/SuiteP/include/DetailView/actions_buttons.tpl' => '8a6fff7933b92178c28f5a58feddef75',
   './themes/SuiteP/include/DetailView/actions_menu.tpl' => '43988446570fc2820b7b0fb3da42e199',
   './themes/SuiteP/include/DetailView/footer.tpl' => '74cd1da7edd3386ee51db3e8ba8bb53b',
   './themes/SuiteP/include/DetailView/header.tpl' => 'ba7fbc5faa2a0e336373aae9b1e52a8e',
   './themes/SuiteP/include/DetailView/tab_panel_content.tpl' => '6d222e6e0637382cff40a4dff5dbb851',
   './themes/SuiteP/include/DetailView/test.tpl' => 'fcf838f4139733066cc727fc7f3818ae',
-  './themes/SuiteP/include/EditView/EditView.tpl' => '5e279ffcc56b22f3c2d6032247fa288e',
+  './themes/SuiteP/include/EditView/EditView.tpl' => '7ad41f35fa8b0aa7dbaae48189c38edb',
   './themes/SuiteP/include/EditView/QuickCreate.tpl' => '3acca81ef6a983731de021c1943f4c0b',
   './themes/SuiteP/include/EditView/SugarVCR.tpl' => 'eed25c746ed4a7ffeeaaae25a36f49c4',
   './themes/SuiteP/include/EditView/actions_buttons.tpl' => '3ccfac667a36f3f67706deb6de2f9a77',
@@ -9260,4 +9266,4 @@ $md5_string = array (
   './themes/default/less/wells.less' => '07cc7d04d7f7f344742f23886cbe5683',
   './vCard.php' => '3f5273501c464563e5b1247be28b69de',
   './vcal_server.php' => 'ce4752597ba62a99f791c467339d2500',
-);
+);
\ No newline at end of file

programming_language: TypeScript
filename: AOR_Scheduled_Reports.php
change_type: ModificationType.MODIFY
diff: @@ -83,9 +83,7 @@ class AOR_Scheduled_Reports extends basic
 
     public function save($check_notify = false)
     {
-        if (isset($_POST['email_recipients']) && is_array($_POST['email_recipients'])) {
-            $this->email_recipients = base64_encode(serialize($_POST['email_recipients']));
-        }
+        $this->parseRecipients();
 
         return parent::save($check_notify);
     }
@@ -180,7 +178,7 @@ class AOR_Scheduled_Reports extends basic
         }
 
         $lastRun = $this->last_run ? $timedate->fromDb($this->last_run) : $timedate->fromDb($this->date_entered);
-        
+
         $this->handleTimeZone($lastRun);
         $next = $cron->getNextRunDate($lastRun);
 
@@ -200,4 +198,26 @@ class AOR_Scheduled_Reports extends basic
         $date->modify($offset . 'second');
     }
 
+    /**
+     * Parse and set recipients
+     * @return void
+     */
+    protected function parseRecipients(): void
+    {
+        $recipients = $_POST['email_recipients'] ?? null;
+        unset($_POST['email_recipients'], $_REQUEST['email_recipients'], $_GET['email_recipients']);
+        $this->email_recipients = null;
+
+        if (is_array($recipients)) {
+            $types = $recipients['email_target_type'] ?? [];
+            $emailInfo = $recipients['email'] ?? [];
+            $recipients = [
+                'email_target_type' => $types,
+                'email' => $emailInfo,
+            ];
+
+            $this->email_recipients = base64_encode(serialize($recipients));
+        }
+    }
+
 }

programming_language: PHP
filename: CalendarActivity.php
change_type: ModificationType.MODIFY
diff: @@ -266,11 +266,12 @@ class CalendarActivity
                 }
 
                 $focus_list = build_related_list_by_user_id($bean, $user_id, $where);
-                require_once 'modules/SecurityGroups/SecurityGroup.php';
+                //require_once 'modules/SecurityGroups/SecurityGroup.php';
                 foreach ($focus_list as $focusBean) {
                     if (isset($seen_ids[$focusBean->id])) {
                         continue;
                     }
+                    /* TODO update currently unused functionality, disabled as expensive
                     $in_group = SecurityGroup::groupHasAccess($key, $focusBean->id, 'list');
                     $show_as_busy = !ACLController::checkAccess(
                         $key,
@@ -279,7 +280,7 @@ class CalendarActivity
                         'module',
                         $in_group
                     );
-                    $focusBean->show_as_busy = $show_as_busy;
+                    $focusBean->show_as_busy = $show_as_busy;*/
 
                     $seen_ids[$focusBean->id] = 1;
                     $act = new CalendarActivity($focusBean);

programming_language: PHP
filename: Employee.php
change_type: ModificationType.MODIFY
diff: @@ -186,6 +186,11 @@ class Employee extends Person
 
     public function create_export_query($order_by, $where, $relate_link_join = '')
     {
+        global $current_user;
+        if (!is_admin($current_user)) {
+            throw new RuntimeException('Not authorized');
+        }
+
         include('modules/Employees/field_arrays.php');
 
         $cols = '';

programming_language: PHP
filename: IconRepository.php
change_type: ModificationType.MODIFY
diff: @@ -14,14 +14,13 @@ class IconRepository
      */
     private static $iconNames = [
         AOS_Contracts::class => 'aos-contracts-signature',
+        AOR_Scheduled_Reports::class => 'aor-reports',
         'EmailTemplates' => 'emails',
         'Employees' => 'users',
         jjwg_Address_Cache::class => 'jjwg-markers',
         'ProjectTask' => 'am-tasktemplates',
         AM_ProjectTemplates::class => 'am-tasktemplates',
-        'SurveyQuestionOptions' => self::DEFAULT_ICON,
-        'SurveyQuestionResponses' =>  self::DEFAULT_ICON,
-        'SurveyQuestions' => self::DEFAULT_ICON,
+        'SurveyQuestionResponses' =>  'survey-responses',
         'SurveyResponses' => 'survey-responses',
         'Prospects' => 'targets'
     ];
@@ -33,8 +32,6 @@ class IconRepository
      */
     public static function getIconName($module)
     {
-        return isset(static::$iconNames[$module])
-            ? static::$iconNames[$module]
-            : strtolower(str_replace('_', '-', $module));
+        return static::$iconNames[$module] ?? strtolower(str_replace('_', '-', $module));
     }
 }

programming_language: PHP
filename: Duplicate.php
change_type: ModificationType.MODIFY
diff: @@ -55,11 +55,11 @@ $focus->retrieve($_POST['record']);
 if (isset($_POST['isDuplicate']) && $_POST['isDuplicate'] == true) {
     $focus->id='';
     $focus->name=$mod_strings['LBL_COPY_PREFIX'].' '.$focus->name;
-    
+
     $focus->save();
     $return_id=$focus->id;
     //duplicate the linked items.
-    $query  = "select * from prospect_lists_prospects where prospect_list_id = '".$_POST['record']."'";
+    $query  = "select * from prospect_lists_prospects where prospect_list_id = '". $focus->db->quote($_POST['record']) ."'";
     $result = $focus->db->query($query);
     if ($result != null) {
         while (($row = $focus->db->fetchByAssoc($result)) != null) {

programming_language: PHP
filename: User.php
change_type: ModificationType.MODIFY
diff: @@ -606,6 +606,10 @@ class User extends Person implements EmailInterface
     {
         global $current_user, $mod_strings;
 
+        if (!$this->hasSaveAccess()) {
+           throw new RuntimeException('Not authorized');
+        }
+
         $msg = '';
 
         $isUpdate = !empty($this->id) && !$this->new_with_id;
@@ -1591,6 +1595,11 @@ EOQ;
 
     public function create_export_query($order_by, $where, $relate_link_join = '')
     {
+        global $current_user;
+        if (!is_admin($current_user)) {
+            throw new RuntimeException('Not authorized');
+        }
+
         include('modules/Users/field_arrays.php');
 
         $cols = '';
@@ -2437,4 +2446,25 @@ EOQ;
         }
         return $subTheme;
     }
+
+    /**
+     * Check if current user can save the current user record
+     * @return bool
+     */
+    protected function hasSaveAccess(): bool
+    {
+        global $current_user;
+
+        if (empty($this->id)) {
+            return true;
+        }
+
+        if (empty($current_user->id)) {
+            return true;
+        }
+
+        $sameUser = $current_user->id === $this->id;
+
+        return $sameUser || is_admin($current_user);
+    }
 }

programming_language: PHP
filename: vCal.php
change_type: ModificationType.MODIFY
diff: @@ -123,7 +123,7 @@
         public function create_sugar_freebusy($user_bean, $start_date_time, $end_date_time)
         {
             $ical_array = array();
-            global $DO_USER_TIME_OFFSET, $timedate, $current_user;
+            global $DO_USER_TIME_OFFSET, $timedate;
 
             $DO_USER_TIME_OFFSET = true;
             if (empty($GLOBALS['current_user']) || empty($GLOBALS['current_user']->id)) {
@@ -138,11 +138,11 @@
             // loop thru each activity, get start/end time in UTC, and return FREEBUSY strings
             foreach ($acts_arr as $act) {
                 if (empty($act->start_time)) {
-                    $startTime = $timedate->fromUser($act->sugar_bean->date_start, $user_bean);
+                    $act->start_time = $timedate->fromUser($act->sugar_bean->date_start, $user_bean);
                 }
 
                 if (empty($act->end_time)) {
-                    $endTime = $timedate->fromUser($act->sugar_bean->date_finish, $user_bean);
+                    $act->end_time = $timedate->fromUser($act->sugar_bean->date_finish, $user_bean);
                 }
 
                 $ID = $act->sugar_bean->id;

programming_language: PHP
filename: suitecrm_version.php
change_type: ModificationType.MODIFY
diff: @@ -3,5 +3,5 @@ if (!defined('sugarEntry') || !sugarEntry) {
     die('Not A Valid Entry Point');
 }
 
-$suitecrm_version = '7.12.4';
-$suitecrm_timestamp = '2022-02-10 12:00:00';
+$suitecrm_version = '7.12.5';
+$suitecrm_timestamp = '2022-03-01 12:00:00';

programming_language: PHP
filename: EmployeeTest.php
change_type: ModificationType.MODIFY
diff: @@ -128,6 +128,8 @@ class EmployeeTest extends SuitePHPUnitFrameworkTestCase
     {
         $employee = BeanFactory::newBean('Employees');
 
+        global $current_user;
+        $current_user->is_admin = '1';
         //test with empty string params
         $expected = "SELECT id, user_name, first_name, last_name, description, date_entered, date_modified, modified_user_id, created_by, title, department, is_admin, phone_home, phone_mobile, phone_work, phone_other, phone_fax, address_street, address_city, address_state, address_postalcode, address_country, reports_to_id, portal_only, status, receive_notifications, employee_status, messenger_id, messenger_type, is_group FROM users  WHERE  users.deleted = 0 ORDER BY users.user_name";
         $actual = $employee->create_export_query('', '');
@@ -137,6 +139,11 @@ class EmployeeTest extends SuitePHPUnitFrameworkTestCase
         $expected = "SELECT id, user_name, first_name, last_name, description, date_entered, date_modified, modified_user_id, created_by, title, department, is_admin, phone_home, phone_mobile, phone_work, phone_other, phone_fax, address_street, address_city, address_state, address_postalcode, address_country, reports_to_id, portal_only, status, receive_notifications, employee_status, messenger_id, messenger_type, is_group FROM users  WHERE users.user_name=\"\" AND  users.deleted = 0 ORDER BY users.id";
         $actual = $employee->create_export_query('users.id', 'users.user_name=""');
         self::assertSame($expected, $actual);
+
+        $current_user->is_admin = '0';
+        $this->expectException(RuntimeException::class);
+        $employee->create_export_query('', '');
+
     }
 
     public function testpreprocess_fields_on_save(): void

programming_language: PHP
filename: UserTest.php
change_type: ModificationType.MODIFY
diff: @@ -683,16 +683,22 @@ class UserTest extends SuitePHPUnitFrameworkTestCase
     {
         $user = BeanFactory::newBean('Users');
 
+        global $current_user;
+        $current_user->is_admin = '1';
         //test with empty string params
-        $expected = "SELECT id, user_name, first_name, last_name, description, date_entered, date_modified, modified_user_id, created_by, title, department, is_admin, phone_home, phone_mobile, phone_work, phone_other, phone_fax, address_street, address_city, address_state, address_postalcode, address_country, reports_to_id, portal_only, status, receive_notifications, employee_status, messenger_id, messenger_type, is_group FROM users  WHERE  users.deleted = 0 AND users.is_admin=0 ORDER BY users.user_name";
+        $expected = "SELECT id, user_name, first_name, last_name, description, date_entered, date_modified, modified_user_id, created_by, title, department, is_admin, phone_home, phone_mobile, phone_work, phone_other, phone_fax, address_street, address_city, address_state, address_postalcode, address_country, reports_to_id, portal_only, status, receive_notifications, employee_status, messenger_id, messenger_type, is_group FROM users  WHERE  users.deleted = 0 ORDER BY users.user_name";
         $actual = $user->create_export_query('', '');
         self::assertSame($expected, $actual);
 
 
         //test with valid string params
-        $expected = "SELECT id, user_name, first_name, last_name, description, date_entered, date_modified, modified_user_id, created_by, title, department, is_admin, phone_home, phone_mobile, phone_work, phone_other, phone_fax, address_street, address_city, address_state, address_postalcode, address_country, reports_to_id, portal_only, status, receive_notifications, employee_status, messenger_id, messenger_type, is_group FROM users  WHERE user_name=\"\" AND  users.deleted = 0 AND users.is_admin=0 ORDER BY id";
+        $expected = "SELECT id, user_name, first_name, last_name, description, date_entered, date_modified, modified_user_id, created_by, title, department, is_admin, phone_home, phone_mobile, phone_work, phone_other, phone_fax, address_street, address_city, address_state, address_postalcode, address_country, reports_to_id, portal_only, status, receive_notifications, employee_status, messenger_id, messenger_type, is_group FROM users  WHERE user_name=\"\" AND  users.deleted = 0 ORDER BY id";
         $actual = $user->create_export_query('id', 'user_name=""');
         self::assertSame($expected, $actual);
+
+        $current_user->is_admin = '0';
+        $this->expectException(RuntimeException::class);
+        $user->create_export_query('', '');
     }
 
 

programming_language: PHP