SecuritySuite - SuiteCRM and CE Teams

We found that there is missing SecuritySuite protection of the list of email templates available to users in the drop-down box labeled "Email Templates:" in the Email Marketing module. Users are able to select all Email Templates, even if we've tried to protect the Email Templates with SecuritySuite. We patched it on our own installation, but we'd like to see a proper patch added to an upcoming version.

Below we're including the patch file we used. We'd also appreciate any feedback on this solution.

Thank you! KTSI

diff -c modules/EmailMarketing/EditView.php custom/modules/EmailMarketing/EditView.php *** modules/EmailMarketing/EditView.php 2013-03-28 01:27:08.679449492 -0400 --- custom/modules/EmailMarketing/EditView.php 2013-03-28 21:57:00.461443092 -0400

*** 121,127 **** $xtpl->assign("TIME_START", $time_start); $xtpl->assign("TIME_FORMAT", '('. $timedate->get_user_time_format().')');

! $email_templates_arr = get_bean_select_array(true, 'EmailTemplate','name',"(type IS NULL OR type='' OR type='campaign')",'name'); if($focus->template_id) { $xtpl->assign("TEMPLATE_ID", $focus->template_id); $xtpl->assign("EMAIL_TEMPLATE_OPTIONS", get_select_options_with_id($email_templates_arr, $focus->template_id)); --- 121,156 ---- $xtpl->assign("TIME_START", $time_start); $xtpl->assign("TIME_FORMAT", '('. $timedate->get_user_time_format().')');

! $where = "(type IS NULL OR type='' OR type='campaign')"; ! ! /* BEGIN - SECURITY GROUPS / ! global $beanFiles; ! require_once($beanFiles['EmailTemplate']); ! $email_templates_bean = new EmailTemplate(); ! ! if($email_templates_bean->bean_implements('ACL') && ACLController::requireSecurityGroup($email_templates_bean->module_dir, 'list') ) ! { ! require_once('modules/SecurityGroups/SecurityGroup.php'); ! $owner_where = " email_templates.created_by ='$current_user->id' "; ! $group_where = SecurityGroup::getGroupWhere($email_templates_bean->table_name,$email_templates_bean->module_dir,$current_user->id); ! ! if(!empty($owner_where)){ ! if(empty($where)) ! { ! $where = " (". $owner_where." or ".$group_where.") "; ! } else { ! $where .= " AND (". $owner_where." or ".$group_where.") "; ! } ! } else { ! $where .= ' AND '. $group_where; ! } ! ! } ! / END - SECURITY GROUPS */ ! ! ! $email_templates_arr = get_bean_select_array(true, 'EmailTemplate','name',$where,'name'); ! if($focus->template_id) { $xtpl->assign("TEMPLATE_ID", $focus->template_id); $xtpl->assign("EMAIL_TEMPLATE_OPTIONS", get_select_options_with_id($email_templates_arr, $focus->template_id));