fix list

Typo in variable name

.gitignore

@@ -6,11 +6,15 @@
 /data/config.php
 /build
 /node_modules
-/client
 /test.php
 /main.html
-/frontend/client/css/bootstrap.css
+/client/css/espo.css
+/client/css/espo-vertical.css
+/client/css/sakura.css
+/client/css/sakura-vertical.css
+/client/css/violet.css
+/client/css/violet-vertical.css
 /tests/testData/cache/*
 composer.phar
 vendor/
-/custom/Espo/Custom/Resources/*
+/custom/Espo/Custom/*

.htaccess

@@ -15,6 +15,7 @@ DirectoryIndex index.php index.html
   RewriteRule ^/?data/logs/ - [F]
   RewriteRule ^/?data/cache/ - [F]
   RewriteRule ^/?data/upload/ - [F]
+  RewriteRule ^/?data/\.backup/ - [F]
   RewriteRule ^/?application/ - [F]
   RewriteRule ^/?custom/ - [F]
   RewriteRule ^/?vendor/ - [F]

CONTRIBUTING.md

@@ -0,0 +1,3 @@
+Before we can merge your pull request you need to accept our CLA [here](https://github.com/espocrm/cla). It's very simple to do.
+
+[Code Style Guidelines](https://github.com/espocrm/espocrm/wiki/Code-Style-Guidelines).

Gruntfile.js

@@ -21,8 +21,9 @@
 module.exports = function (grunt) {
 
     var jsFilesToMinify = [
-        'client/lib/jquery-2.0.2.min.js',
+        'client/lib/jquery-2.1.4.min.js',
         'client/lib/underscore-min.js',
+        'client/lib/es6-promise.min.js',
         'client/lib/backbone-min.js',
         'client/lib/handlebars.js',
         'client/lib/base64.js',
@@ -36,34 +37,8 @@ module.exports = function (grunt) {
         'client/lib/bull.min.js',
         'client/src/namespace.js',
         'client/src/exceptions.js',
-        'client/src/app.js',
-        'client/src/utils.js',
-        'client/src/storage.js',
         'client/src/loader.js',
-        'client/src/pre-loader.js',
-        'client/src/ui.js',
-        'client/src/acl.js',
-        'client/src/model.js',
-        'client/src/model-offline.js',
-        'client/src/metadata.js',
-        'client/src/language.js',
-        'client/src/cache.js',
-        'client/src/controller.js',
-        'client/src/router.js',
-        'client/src/date-time.js',
-        'client/src/field-manager.js',
-        'client/src/search-manager.js',
-        'client/src/collection.js',
-        'client/src/multi-collection.js',
-        'client/src/view-helper.js',
-        'client/src/layout-manager.js',
-        'client/src/model-factory.js',
-        'client/src/collection-factory.js',
-        'client/src/models/settings.js',
-        'client/src/models/user.js',
-        'client/src/models/preferences.js',
-        'client/src/controllers/base.js',
-        'client/src/view.js',
+        'client/src/utils.js'
     ];
 
     grunt.initConfig({
@@ -72,7 +47,7 @@ module.exports = function (grunt) {
         mkdir: {
             tmp: {
                 options: {
-                    mode: 0775,
+                    mode: 0755,
                     create: [
                         'build/tmp',
                     ]
@@ -85,22 +60,60 @@ module.exports = function (grunt) {
             final: ['build/tmp'],
         },
         less: {
-            bootstrap: {
+            espo: {
                 options: {
                     yuicompress: true,
                 },
                 files: {
-                    'frontend/client/css/bootstrap.css': 'frontend/less/espo/main.less',
-                },
+                    'client/css/espo.css': 'frontend/less/espo/main.less',
+                }
             },
+            espoVertical: {
+                options: {
+                    yuicompress: true,
+                },
+                files: {
+                    'client/css/espo-vertical.css': 'frontend/less/espo-vertical/main.less',
+                }
+            },
+            sakura: {
+                options: {
+                    yuicompress: true,
+                },
+                files: {
+                    'client/css/sakura.css': 'frontend/less/sakura/main.less',
+                }
+            },
+            sakuraVertical: {
+                options: {
+                    yuicompress: true,
+                },
+                files: {
+                    'client/css/sakura-vertical.css': 'frontend/less/sakura-vertical/main.less',
+                }
+            },
+            violet: {
+                options: {
+                    yuicompress: true,
+                },
+                files: {
+                    'client/css/violet.css': 'frontend/less/violet/main.less',
+                }
+            },
+            violetVertical: {
+                options: {
+                    yuicompress: true,
+                },
+                files: {
+                    'client/css/violet-vertical.css': 'frontend/less/violet-vertical/main.less',
+                }
+            }
         },
         cssmin: {
             minify: {
                 files: {
-                    'build/tmp/client/css/espo.min.css': [
-                        'frontend/client/css/bootstrap.css',
-                        'frontend/client/css/datepicker.css',
-                        'frontend/client/css/jquery.timepicker.css',
+                    'build/tmp/client/css/espo.css': [
+                        'client/css/espo.css',
                     ]
                 }
             },
@@ -111,13 +124,13 @@ module.exports = function (grunt) {
                 banner: '/*! <%= pkg.name %> <%= grunt.template.today("yyyy-mm-dd") %> */\n',
             },
             'build/tmp/client/espo.min.js': jsFilesToMinify.map(function (item) {
-                return 'frontend/' + item;
+                return '' + item;
             })
         },
         copy: {
             frontendFolders: {
                 expand: true,
-                cwd: 'frontend/client',
+                cwd: 'client',
                 src: [
                     'src/**',
                     'res/**',
@@ -132,13 +145,13 @@ module.exports = function (grunt) {
                 dest: 'build/tmp/client',
             },
             frontendHtml: {
-                src: 'frontend/html/reset.html',
+                src: 'frontend/reset.html',
                 dest: 'build/tmp/reset.html'
             },
             frontendLib: {
                 expand: true,
                 dot: true,
-                cwd: 'frontend/client/lib',
+                cwd: 'client/lib',
                 src: '**',
                 dest: 'build/tmp/client/lib/',
             },
@@ -151,11 +164,15 @@ module.exports = function (grunt) {
                     'custom/**',
                     'data/.data',
                     'install/**',
+                    'portal/**',
                     'vendor/**',
+                    'html/**',
                     'bootstrap.php',
                     'cron.php',
                     'rebuild.php',
+                    'clear_cache.php',
                     'upgrade.php',
+                    'extension.php',
                     'index.php',
                     'LICENSE.txt',
                     '.htaccess',
@@ -190,6 +207,19 @@ module.exports = function (grunt) {
                     'build/EspoCRM-<%= pkg.version %>/**/*.html',
                     'build/EspoCRM-<%= pkg.version %>/**/*.txt',
                 ]
+            },
+            folders: {
+                options: {
+                    mode: '755'
+                },
+                src: [
+                    'build/EspoCRM-<%= pkg.version %>/install',
+                    'build/EspoCRM-<%= pkg.version %>/portal',
+                    'build/EspoCRM-<%= pkg.version %>/api',
+                    'build/EspoCRM-<%= pkg.version %>/api/v1',
+                    'build/EspoCRM-<%= pkg.version %>/api/v1/portal-access',
+                    'build/EspoCRM-<%= pkg.version %>',
+                ]
             }
         },
         replace: {
@@ -204,8 +234,12 @@ module.exports = function (grunt) {
                 },
                 files: [
                     {
-                        src: 'frontend/html/main.html',
-                        dest: 'build/tmp/main.html'
+                        src: 'build/tmp/html/main.html',
+                        dest: 'build/tmp/html/main.html'
+                    },
+                    {
+                        src: 'build/tmp/html/portal.html',
+                        dest: 'build/tmp/html/portal.html'
                     }
                 ]
             },

LICENSE.txt

@@ -631,29 +631,29 @@ to attach them to the start of each source file to most effectively
 state the exclusion of warranty; and each file should have at least
 the "copyright" line and a pointer to where the full notice is found.
 
-    EspoCRM - Open Source CRM
-    Copyright (C) 2014  Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
 
-    EspoCRM is free software: you can redistribute it and/or modify
+    This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
     the Free Software Foundation, either version 3 of the License, or
     (at your option) any later version.
 
-    EspoCRM is distributed in the hope that it will be useful,
+    This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with EspoCRM.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 Also add information on how to contact you by electronic and paper mail.
 
   If the program does terminal interaction, make it output a short
 notice like this when it starts in an interactive mode:
 
-    EspoCRM  Copyright (C) 2014  Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
-    EspoCRM comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
     This is free software, and you are welcome to redistribute it
     under certain conditions; type `show c' for details.
 

README.md

@@ -6,6 +6,13 @@ It's a web application with a frontend designed as a single page application bas
 
 Download the latest release from our [website](http://www.espocrm.com).
 
+### Requirements
+
+* PHP 5.4 or above (with pdo, json, gd, mcrypt extensions);
+* MySQL 5.1 or above.
+
+For more information about server configuration see [this article](http://blog.espocrm.com/administration/server-configuration-for-espocrm/).
+
 ### How to report bug
 
 Create an issue [here](https://github.com/espocrm/espocrm/issues) or post on our [forum](http://forum.espocrm.com/bug-reports?routestring=forum/bug-reports).
@@ -19,9 +26,9 @@ Create an issue [here](https://github.com/espocrm/espocrm/issues) or post on our
 
 Never update composer dependencies if you are going to contribute code back.
 
-Now you can build.
+Now you can build. Build will create compiled css files.
 
-If your repository is accessible via a web server then you can run EspoCRM by url `http://PROJECT_URL/frontend`. To compose a proper config.php and populate database you can run install by opening `http(s)://{YOUR_CRM_URL}/install` location in a browser. Also you need to run build before to have compiled css.
+To compose a proper config.php and populate database you can run install by opening `http(s)://{YOUR_CRM_URL}/install` location in a browser. Then open `data/config.php` file and add `isDeveloperMode => true`.
 
 ### How to build
 
@@ -33,20 +40,24 @@ You need to have nodejs and Grunt CLI installed.
 
 The build will be created in the `build` directory.
 
-### How to make translation
+### How to contribute
+
+Before we can merge your pull request you need to accept our CLA [here](https://github.com/espocrm/cla). It's very simple to do.
+
+### How to make a translation
 
 Build po file with command:
 `node po.js en_EN`
 (specify needed language instead of en_EN)
 
-After that tranlate the generated po file.
+After that translate the generated po file.
 
 Build json files from the translated po file:
 
-1. Put your po file espocrm-en_EN.po to the `build` directory
+1. Put your po file espocrm-en_EN.po into `build` directory
 2. Run `node lang.js en_EN`
 
-The files will be created in build directory.
+Json files will be created in build directory grouped by folders.
 
 ### License
 

api/v1/index.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 require_once('../../bootstrap.php');

api/v1/portal-access/.htaccess

@@ -0,0 +1,12 @@
+RewriteEngine On
+
+# Some hosts may require you to use the `RewriteBase` directive.
+# If you need to use the `RewriteBase` directive, it should be the
+# absolute physical path to the directory that contains this htaccess file.
+#
+# RewriteBase /
+
+RewriteRule .* - [E=HTTP_ESPO_CGI_AUTH:%{HTTP:Authorization}]
+
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteRule ^ index.php [QSA,L]

api/v1/portal-access/index.php

@@ -0,0 +1,39 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+require_once('../../../bootstrap.php');
+
+if (!empty($_GET['portalId'])) {
+    $portalId = $_GET['portalId'];
+} else {
+    $portalId = explode('/', $_SERVER['REQUEST_URI'])[count(explode('/', $_SERVER['SCRIPT_NAME'])) - 1];
+}
+
+$app = new \Espo\Core\Portal\Application($portalId);
+$app->run();

api/v1/portal-access/web.config

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+
+    <system.webServer>
+        <rewrite>
+            <rules>
+                <rule name="rule 1G" stopProcessing="true">
+                    <match url="^"  />
+                    <action type="Rewrite" url="index.php"  appendQueryString="true" />
+				</rule>
+            </rules>
+        </rewrite>
+    </system.webServer>
+
+</configuration>

application/Espo/Acl/Attachment.php

@@ -0,0 +1,93 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Acl;
+
+use \Espo\Entities\User;
+use \Espo\ORM\Entity;
+
+class Attachment extends \Espo\Core\Acl\Base
+{
+    public function checkEntityRead(User $user, Entity $entity, $data)
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if ($entity->get('parentType') === 'Settings') {
+            return true;
+        }
+
+        $parent = null;
+        $hasParent = false;
+        if ($entity->get('parentId') && $entity->get('parentType')) {
+            $hasParent = true;
+            $parent = $this->getEntityManager()->getEntity($entity->get('parentType'), $entity->get('parentId'));
+        } else if ($entity->get('relatedId') && $entity->get('relatedType')) {
+            $hasParent = true;
+            $parent = $this->getEntityManager()->getEntity($entity->get('relatedType'), $entity->get('relatedId'));
+        }
+
+        if ($hasParent) {
+            if ($parent) {
+                if ($parent->getEntityType() === 'Note') {
+                    if ($parent->get('parentId') && $parent->get('parentType')) {
+                        $parentOfParent = $this->getEntityManager()->getEntity($parent->get('parentType'), $parent->get('parentId'));
+                        if ($parentOfParent && $this->getAclManager()->checkEntity($user, $parentOfParent)) {
+                            return true;
+                        }
+                    } else {
+                        return true;
+                    }
+                } else {
+                    if ($this->getAclManager()->checkEntity($user, $parent)) {
+                        return true;
+                    }
+                }
+            }
+        } else {
+            return true;
+        }
+
+        if ($this->checkEntity($user, $entity, $data, 'read')) {
+            return true;
+        }
+
+        return false;
+    }
+
+    public function checkIsOwner(User $user, Entity $entity)
+    {
+        if ($user->id === $entity->get('createdById')) {
+            return true;
+        }
+        return false;
+    }
+}
+

application/Espo/Acl/Email.php

@@ -0,0 +1,80 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Acl;
+
+use \Espo\Entities\User;
+use \Espo\ORM\Entity;
+
+class Email extends \Espo\Core\Acl\Base
+{
+
+    public function checkEntityRead(User $user, Entity $entity, $data)
+    {
+        if ($this->checkEntity($user, $entity, $data, 'read')) {
+            return true;
+        }
+
+        if ($data === false) {
+            return false;
+        }
+        if (is_object($data)) {
+            if ($data->read === false || $data->read === 'no') {
+                return false;
+            }
+        }
+
+        if (!$entity->has('usersIds')) {
+            $entity->loadLinkMultipleField('users');
+        }
+        $userIdList = $entity->get('usersIds');
+        if (is_array($userIdList) && in_array($user->id, $userIdList)) {
+            return true;
+        }
+        return false;
+    }
+
+    public function checkIsOwner(User $user, Entity $entity)
+    {
+        if ($user->id === $entity->get('assignedUserId')) {
+            return true;
+        }
+
+        if ($user->id === $entity->get('createdById')) {
+            return true;
+        }
+
+        if ($entity->hasLinkMultipleId('assignedUsers', $user->id)) {
+            return true;
+        }
+
+        return false;
+    }
+}
+

application/Espo/Acl/EmailFilter.php

@@ -0,0 +1,53 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Acl;
+
+use \Espo\Entities\User;
+use \Espo\ORM\Entity;
+
+class EmailFilter extends \Espo\Core\Acl\Base
+{
+    public function checkIsOwner(User $user, Entity $entity)
+    {
+        if ($entity->has('parentId') && $entity->has('parentType')) {
+            $parentType = $entity->get('parentType');
+            $parentId = $entity->get('parentId');
+            if (!$parentType || !$parentId) return;
+
+            $parent = $this->getEntityManager()->getEntity($parentType, $parentId);
+            if ($parent && $parent->has('assignedUserId') && $parent->get('assignedUserId') === $user->id) {
+                return true;
+            }
+        }
+
+        return;
+    }
+}
+

application/Espo/Acl/Notification.php

@@ -0,0 +1,45 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Acl;
+
+use \Espo\Entities\User;
+use \Espo\ORM\Entity;
+
+class Notification extends \Espo\Core\Acl\Base
+{
+    public function checkIsOwner(User $user, Entity $entity)
+    {
+        if ($user->id === $entity->get('userId')) {
+            return true;
+        }
+        return false;
+    }
+}
+

application/Espo/Acl/User.php

@@ -0,0 +1,41 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Acl;
+
+use \Espo\ORM\Entity;
+
+class User extends \Espo\Core\Acl\Base
+{
+    public function checkIsOwner(\Espo\Entities\User $user, Entity $entity)
+    {
+        return $user->id === $entity->id;
+    }
+}
+

application/Espo/AclPortal/Attachment.php

@@ -0,0 +1,93 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\AclPortal;
+
+use \Espo\Entities\User;
+use \Espo\ORM\Entity;
+
+class Attachment extends \Espo\Core\AclPortal\Base
+{
+    public function checkEntityRead(User $user, Entity $entity, $data)
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if ($entity->get('parentType') === 'Settings') {
+            return true;
+        }
+
+        $parent = null;
+        $hasParent = false;
+        if ($entity->get('parentId') && $entity->get('parentType')) {
+            $hasParent = true;
+            $parent = $this->getEntityManager()->getEntity($entity->get('parentType'), $entity->get('parentId'));
+        } else if ($entity->get('relatedId') && $entity->get('relatedType')) {
+            $hasParent = true;
+            $parent = $this->getEntityManager()->getEntity($entity->get('relatedType'), $entity->get('relatedId'));
+        }
+
+        if ($hasParent) {
+            if ($parent) {
+                if ($parent->getEntityType() === 'Note') {
+                    if ($parent->get('parentId') && $parent->get('parentType')) {
+                        $parentOfParent = $this->getEntityManager()->getEntity($parent->get('parentType'), $parent->get('parentId'));
+                        if ($parentOfParent && $this->getAclManager()->checkEntity($user, $parentOfParent)) {
+                            return true;
+                        }
+                    } else {
+                        return true;
+                    }
+                } else {
+                    if ($this->getAclManager()->checkEntity($user, $parent)) {
+                        return true;
+                    }
+                }
+            }
+        } else {
+            return true;
+        }
+
+        if ($this->checkEntity($user, $entity, $data, 'read')) {
+            return true;
+        }
+
+        return false;
+    }
+
+    public function checkIsOwner(User $user, Entity $entity)
+    {
+        if ($user->id === $entity->get('createdById')) {
+            return true;
+        }
+        return false;
+    }
+}
+

application/Espo/AclPortal/Email.php

@@ -0,0 +1,71 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\AclPortal;
+
+use \Espo\Entities\User;
+use \Espo\ORM\Entity;
+
+class Email extends \Espo\Core\AclPortal\Base
+{
+
+    public function checkEntityRead(User $user, Entity $entity, $data)
+    {
+        if ($this->checkEntity($user, $entity, $data, 'read')) {
+            return true;
+        }
+
+        if ($data === false) {
+            return false;
+        }
+        if (is_object($data)) {
+            if ($data->read === false || $data->read === 'no') {
+                return false;
+            }
+        }
+
+        if (!$entity->has('usersIds')) {
+            $entity->loadLinkMultipleField('users');
+        }
+        $userIdList = $entity->get('usersIds');
+        if (is_array($userIdList) && in_array($user->id, $userIdList)) {
+            return true;
+        }
+        return false;
+    }
+
+    public function checkIsOwner(User $user, Entity $entity)
+    {
+        if ($user->id === $entity->get('createdById')) {
+            return true;
+        }
+        return false;
+    }
+}
+

application/Espo/AclPortal/Notification.php

@@ -0,0 +1,45 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\AclPortal;
+
+use \Espo\Entities\User;
+use \Espo\ORM\Entity;
+
+class Notification extends \Espo\Core\AclPortal\Base
+{
+    public function checkIsOwner(User $user, Entity $entity)
+    {
+        if ($user->id === $entity->get('userId')) {
+            return true;
+        }
+        return false;
+    }
+}
+

application/Espo/AclPortal/User.php

@@ -0,0 +1,41 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\AclPortal;
+
+use \Espo\ORM\Entity;
+
+class User extends \Espo\Core\AclPortal\Base
+{
+    public function checkIsOwner(\Espo\Entities\User $user, Entity $entity)
+    {
+        return $user->id === $entity->id;
+    }
+}
+

application/Espo/Controllers/Admin.php

@@ -18,12 +18,21 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Controllers;
 
-use \Espo\Core\Exceptions\Error,
-    \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\NotFound;
+use \Espo\Core\Exceptions\Error;
+use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\BadRequest;
 
 class Admin extends \Espo\Core\Controllers\Base
 {
@@ -34,17 +43,19 @@ class Admin extends \Espo\Core\Controllers\Base
         }
     }
 
-    public function actionRebuild($params, $data)
+    public function postActionRebuild($params, $data, $request)
     {
+        if (!$request->isPost()) {
+            throw new BadRequest();
+        }
         $result = $this->getContainer()->get('dataManager')->rebuild();
 
         return $result;
     }
 
-    public function actionClearCache($params, $data)
+    public function postActionClearCache($params, $data)
     {
         $result = $this->getContainer()->get('dataManager')->clearCache();
-
         return $result;
     }
 
@@ -55,8 +66,13 @@ class Admin extends \Espo\Core\Controllers\Base
         return $scheduledJob->getAllNamesOnly();
     }
 
-    public function actionUploadUpgradePackage($params, $data)
+    public function postActionUploadUpgradePackage($params, $data)
     {
+        if ($this->getConfig()->get('restrictedMode')) {
+            if (!$this->getUser()->get('isSuperAdmin')) {
+                throw new Forbidden();
+            }
+        }
         $upgradeManager = new \Espo\Core\UpgradeManager($this->getContainer());
 
         $upgradeId = $upgradeManager->upload($data);
@@ -68,10 +84,15 @@ class Admin extends \Espo\Core\Controllers\Base
         );
     }
 
-    public function actionRunUpgrade($params, $data)
+    public function postActionRunUpgrade($params, $data)
     {
-        $upgradeManager = new \Espo\Core\UpgradeManager($this->getContainer());
+        if ($this->getConfig()->get('restrictedMode')) {
+            if (!$this->getUser()->get('isSuperAdmin')) {
+                throw new Forbidden();
+            }
+        }
 
+        $upgradeManager = new \Espo\Core\UpgradeManager($this->getContainer());
         $upgradeManager->install($data);
 
         return true;

application/Espo/Controllers/App.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Controllers;
@@ -28,18 +35,27 @@ class App extends \Espo\Core\Controllers\Base
 {
     public function actionUser()
     {
-        $preferences = $this->getPreferences()->toArray();
+        $preferences = $this->getPreferences()->getValues();
         unset($preferences['smtpPassword']);
 
+        $user = $this->getUser();
+        if (!$user->has('teamsIds')) {
+            $user->loadLinkMultipleField('teams');
+        }
+        if ($user->get('isPortalUser')) {
+            $user->loadAccountField();
+            $user->loadLinkMultipleField('accounts');
+        }
+
         return array(
-            'user' => $this->getUser()->toArray(),
-            'acl' => $this->getAcl()->toArray(),
+            'user' => $user->getValues(),
+            'acl' => $this->getAcl()->getMap(),
             'preferences' => $preferences,
             'token' => $this->getUser()->get('token')
         );
     }
 
-    public function actionDestroyAuthToken($params, $data)
+    public function postActionDestroyAuthToken($params, $data)
     {
         $token = $data['token'];
         if (empty($token)) {

application/Espo/Controllers/Attachment.php

@@ -18,25 +18,42 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- ************************************************************************/ 
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
 
 namespace Espo\Controllers;
 
+use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\BadRequest;
+
 class Attachment extends \Espo\Core\Controllers\Record
 {
+    public function actionUpload($params, $data, $request)
+    {
+        if (!$request->isPost()) {
+            throw new BadRequest();
+        }
+
+        if (!$this->getAcl()->checkScope('Attachment', 'create')) {
+            throw new Forbidden();
+        }
 
-    public function actionUpload($params, $data)
-    {        
         list($prefix, $contents) = explode(',', $data);
         $contents = base64_decode($contents);
-        
+
         $attachment = $this->getEntityManager()->getEntity('Attachment');
-        $this->getEntityManager()->saveEntity($attachment);        
+        $this->getEntityManager()->saveEntity($attachment);
         $this->getContainer()->get('fileManager')->putContents('data/upload/' . $attachment->id, $contents);
-        
+
         return array(
             'attachmentId' => $attachment->id
-        );    
+        );
     }
 
 }

application/Espo/Controllers/AuthToken.php

@@ -18,49 +18,56 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- ************************************************************************/ 
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
 
 namespace Espo\Controllers;
 
 use \Espo\Core\Exceptions\Forbidden;
 
 class AuthToken extends \Espo\Core\Controllers\Record
-{    
+{
     protected function checkControllerAccess()
     {
         if (!$this->getUser()->isAdmin()) {
             throw new Forbidden();
         }
     }
-    
+
     public function actionUpdate($params, $data)
     {
         throw new Forbidden();
-    }    
-    
+    }
+
     public function actionCreate($params, $data)
     {
         throw new Forbidden();
     }
-    
+
     public function actionListLinked($params, $data)
     {
         throw new Forbidden();
     }
-    
+
     public function actionMassUpdate($params, $data)
     {
         throw new Forbidden();
     }
-    
+
     public function actionCreateLink($params, $data)
     {
         throw new Forbidden();
     }
-    
+
     public function actionRemoveLink($params, $data)
     {
         throw new Forbidden();
-    }    
+    }
 }
 

application/Espo/Controllers/Email.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Controllers;
@@ -28,9 +35,12 @@ use \Espo\Core\Exceptions\Error;
 
 class Email extends \Espo\Core\Controllers\Record
 {
-    public function actionGetCopiedAttachments($params, $data, $request)
+    public function postActionGetCopiedAttachments($params, $data, $request)
     {
-        $id = $request->get('id');
+        if (empty($data['id'])) {
+            throw new BadRequest();
+        }
+        $id = $data['id'];
 
         return $this->getRecordService()->getCopiedAttachments($id);
     }
@@ -41,7 +51,7 @@ class Email extends \Espo\Core\Controllers\Record
             throw new BadRequest();
         }
 
-        if (empty($data['password'])) {
+        if (is_null($data['password'])) {
             if ($data['type'] == 'preferences') {
                 if (!$this->getUser()->isAdmin() && $data['id'] != $this->getUser()->id) {
                     throw new Forbidden();
@@ -63,25 +73,93 @@ class Email extends \Espo\Core\Controllers\Record
         return $this->getRecordService()->sendTestEmail($data);
     }
 
-    public function actionMarkAsRead($params, $data, $request)
+    public function postActionMarkAsRead($params, $data, $request)
     {
-        if (!$request->isPost()) {
-            throw new BadRequest();
+        if (!empty($data['ids'])) {
+            $ids = $data['ids'];
+        } else {
+            if (!empty($data['id'])) {
+                $ids = [$data['id']];
+            } else {
+                throw new BadRequest();
+            }
         }
-        if (empty($data['ids']) || !is_array($data['ids'])) {
-            throw new BadRequest();
-        }
-        $ids = $data['ids'];
-
-        return $this->getRecordService()->markAsReadByIds($ids);
+        return $this->getRecordService()->markAsReadByIdList($ids);
     }
 
-    public function actionMarkAllAsRead($params, $data, $request)
+    public function postActionMarkAsNotRead($params, $data, $request)
     {
-        if (!$request->isPost()) {
-            throw new BadRequest();
+        if (!empty($data['ids'])) {
+            $ids = $data['ids'];
+        } else {
+            if (!empty($data['id'])) {
+                $ids = [$data['id']];
+            } else {
+                throw new BadRequest();
+            }
         }
+        return $this->getRecordService()->markAsNotReadByIdList($ids);
+    }
+
+    public function postActionMarkAllAsRead($params, $data, $request)
+    {
         return $this->getRecordService()->markAllAsRead();
     }
+
+    public function postActionMarkAsImportant($params, $data, $request)
+    {
+        if (!empty($data['ids'])) {
+            $ids = $data['ids'];
+        } else {
+            if (!empty($data['id'])) {
+                $ids = [$data['id']];
+            } else {
+                throw new BadRequest();
+            }
+        }
+        return $this->getRecordService()->markAsImportantByIdList($ids);
+    }
+
+    public function postActionMarkAsNotImportant($params, $data, $request)
+    {
+        if (!empty($data['ids'])) {
+            $ids = $data['ids'];
+        } else {
+            if (!empty($data['id'])) {
+                $ids = [$data['id']];
+            } else {
+                throw new BadRequest();
+            }
+        }
+        return $this->getRecordService()->markAsNotImportantByIdList($ids);
+    }
+
+    public function postActionMoveToTrash($params, $data)
+    {
+        if (!empty($data['ids'])) {
+            $ids = $data['ids'];
+        } else {
+            if (!empty($data['id'])) {
+                $ids = [$data['id']];
+            } else {
+                throw new BadRequest();
+            }
+        }
+        return $this->getRecordService()->moveToTrashByIdList($ids);
+    }
+
+    public function postActionRetrieveFromTrash($params, $data)
+    {
+        if (!empty($data['ids'])) {
+            $ids = $data['ids'];
+        } else {
+            if (!empty($data['id'])) {
+                $ids = [$data['id']];
+            } else {
+                throw new BadRequest();
+            }
+        }
+        return $this->getRecordService()->retrieveFromTrashByIdList($ids);
+    }
 }
 

application/Espo/Controllers/EmailAccount.php

@@ -18,11 +18,19 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Controllers;
 
 use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\BadRequest;
 
 class EmailAccount extends \Espo\Core\Controllers\Record
 {
@@ -31,7 +39,7 @@ class EmailAccount extends \Espo\Core\Controllers\Record
         return $this->getRecordService()->getFolders(array(
             'host' => $request->get('host'),
             'port' => $request->get('port'),
-            'ssl' => $request->get('ssl'),
+            'ssl' => $request->get('ssl') === 'true',
             'username' => $request->get('username'),
             'password' => $request->get('password'),
             'id' => $request->get('id')
@@ -44,5 +52,27 @@ class EmailAccount extends \Espo\Core\Controllers\Record
             throw new Forbidden();
         }
     }
+
+    public function actionTestConnection($params, $data, $request)
+    {
+        if (!$request->isPost()) {
+            throw new BadRequest();
+        }
+
+        if (is_null($data['password'])) {
+            $emailAccount = $this->getEntityManager()->getEntity('EmailAccount', $data['id']);
+            if (!$emailAccount) {
+                throw new Error();
+            }
+
+            if ($emailAccount->get('assignedUserId') != $this->getUser()->id && !$this->getUser()->isAdmin()) {
+                throw new Forbidden();
+            }
+
+            $data['password'] = $this->getContainer()->get('crypt')->decrypt($emailAccount->get('password'));
+        }
+
+        return $this->getRecordService()->testConnection($data);
+    }
 }
 

application/Espo/Controllers/EmailAddress.php

@@ -18,14 +18,29 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- ************************************************************************/ 
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
 
 namespace Espo\Controllers;
 
+use \Espo\Core\Exceptions\Forbidden;
+
 class EmailAddress extends \Espo\Core\Controllers\Record
 {
     public function actionSearchInAddressBook($params, $data, $request)
     {
+        if (!$this->getAcl()->checkScope('Email')) {
+            throw new Forbidden();
+        }
+        if (!$this->getAcl()->checkScope('Email', 'create')) {
+            throw new Forbidden();
+        }
         $q = $request->get('q');
         $limit = intval($request->get('limit'));
         if (empty($limit) || $limit > 30) {

application/Espo/Controllers/EmailFilter.php

@@ -0,0 +1,36 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+class EmailFilter extends \Espo\Core\Controllers\Record
+{
+
+}
+

application/Espo/Controllers/EmailTemplate.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/ 
 
 namespace Espo\Controllers;

application/Espo/Controllers/EntityManager.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Controllers;
@@ -62,6 +69,15 @@ class EntityManager extends \Espo\Core\Controllers\Base
         if (!empty($data['stream'])) {
             $params['stream'] = $data['stream'];
         }
+        if (!empty($data['disabled'])) {
+            $params['disabled'] = $data['disabled'];
+        }
+        if (!empty($data['sortBy'])) {
+            $params['sortBy'] = $data['sortBy'];
+        }
+        if (!empty($data['sortDirection'])) {
+            $params['asc'] = $data['sortDirection'] === 'asc';
+        }
 
         $result = $this->getContainer()->get('entityManagerUtil')->create($name, $type, $params);
 
@@ -90,6 +106,10 @@ class EntityManager extends \Espo\Core\Controllers\Base
         $name = $data['name'];
         $name = filter_var($name, \FILTER_SANITIZE_STRING);
 
+        if (!empty($data['sortDirection'])) {
+            $data['asc'] = $data['sortDirection'] === 'asc';
+        }
+
         $result = $this->getContainer()->get('entityManagerUtil')->update($name, $data);
 
         if ($result) {
@@ -148,15 +168,31 @@ class EntityManager extends \Espo\Core\Controllers\Base
         	'linkType'
         ];
 
-        $d = array();
+        $additionalParamList = [
+            'relationName',
+        ];
+
+        $params = array();
+
         foreach ($paramList as $item) {
         	if (empty($data[$item])) {
         		throw new BadRequest();
         	}
-        	$d[$item] = filter_var($data[$item], \FILTER_SANITIZE_STRING);
+        	$params[$item] = filter_var($data[$item], \FILTER_SANITIZE_STRING);
         }
 
-        $result = $this->getContainer()->get('entityManagerUtil')->createLink($d);
+        foreach ($additionalParamList as $item) {
+            $params[$item] = filter_var($data[$item], \FILTER_SANITIZE_STRING);
+        }
+
+        if (array_key_exists('linkMultipleField', $data)) {
+            $params['linkMultipleField'] = $data['linkMultipleField'];
+        }
+        if (array_key_exists('linkMultipleFieldForeign', $data)) {
+            $params['linkMultipleFieldForeign'] = $data['linkMultipleFieldForeign'];
+        }
+
+        $result = $this->getContainer()->get('entityManagerUtil')->createLink($params);
 
         if ($result) {
             $this->getContainer()->get('dataManager')->rebuild();
@@ -182,12 +218,25 @@ class EntityManager extends \Espo\Core\Controllers\Base
         	'labelForeign'
         ];
 
-        $d = array();
+        $additionalParamList = [];
+
+        $params = array();
         foreach ($paramList as $item) {
-        	$d[$item] = filter_var($data[$item], \FILTER_SANITIZE_STRING);
+        	$params[$item] = filter_var($data[$item], \FILTER_SANITIZE_STRING);
         }
 
-        $result = $this->getContainer()->get('entityManagerUtil')->updateLink($d);
+        foreach ($additionalParamList as $item) {
+            $params[$item] = filter_var($data[$item], \FILTER_SANITIZE_STRING);
+        }
+
+        if (array_key_exists('linkMultipleField', $data)) {
+            $params['linkMultipleField'] = $data['linkMultipleField'];
+        }
+        if (array_key_exists('linkMultipleFieldForeign', $data)) {
+            $params['linkMultipleFieldForeign'] = $data['linkMultipleFieldForeign'];
+        }
+
+        $result = $this->getContainer()->get('entityManagerUtil')->updateLink($params);
 
         if ($result) {
             $this->getContainer()->get('dataManager')->clearCache();

application/Espo/Controllers/Extension.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Controllers;
@@ -58,6 +65,11 @@ class Extension extends \Espo\Core\Controllers\Record
         if (!$request->isPost()) {
             throw new Forbidden();
         }
+        if ($this->getConfig()->get('restrictedMode')) {
+            if (!$this->getUser()->get('isSuperAdmin')) {
+                throw new Forbidden();
+            }
+        }
 
         $manager = new \Espo\Core\ExtensionManager($this->getContainer());
 
@@ -71,11 +83,14 @@ class Extension extends \Espo\Core\Controllers\Record
         if (!$request->isPost()) {
             throw new Forbidden();
         }
+        if ($this->getConfig()->get('restrictedMode')) {
+            if (!$this->getUser()->get('isSuperAdmin')) {
+                throw new Forbidden();
+            }
+        }
 
         $manager = new \Espo\Core\ExtensionManager($this->getContainer());
-
         $manager->uninstall($data);
-
         return true;
     }
 
@@ -99,12 +114,18 @@ class Extension extends \Espo\Core\Controllers\Record
         throw new Forbidden();
     }
 
-    public function actionDelete($params)
+    public function actionDelete($params, $data, $request)
     {
+        if (!$request->isDelete()) {
+            throw BadRequest();
+        }
+        if ($this->getConfig()->get('restrictedMode')) {
+            if (!$this->getUser()->get('isSuperAdmin')) {
+                throw new Forbidden();
+            }
+        }
         $manager = new \Espo\Core\ExtensionManager($this->getContainer());
-
         $manager->delete($params);
-
         return true;
     }
 

application/Espo/Controllers/ExternalAccount.php

@@ -18,23 +18,38 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- ************************************************************************/ 
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
 
 namespace Espo\Controllers;
 
 use \Espo\Core\Exceptions\Error;
 use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\BadRequest;
 
 class ExternalAccount extends \Espo\Core\Controllers\Record
 {
     public static $defaultAction = 'list';
 
+    protected function checkControllerAccess()
+    {
+        if (!$this->getAcl()->checkScope('ExternalAccount')) {
+            throw new Forbidden();
+        }
+    }
+
     public function actionList($params, $data, $request)
     {
         $integrations = $this->getEntityManager()->getRepository('Integration')->find();
         $arr = array();
         foreach ($integrations as $entity) {
-            if ($entity->get('enabled') && $this->getMetadata()->get('integrations.' . $entity->id .'.allowUserAccounts')) {                
+            if ($entity->get('enabled') && $this->getMetadata()->get('integrations.' . $entity->id .'.allowUserAccounts')) {
                 $arr[] = array(
                     'id' => $entity->id
                 );
@@ -77,15 +92,18 @@ class ExternalAccount extends \Espo\Core\Controllers\Record
         return $entity->toArray();
     }
 
-    public function actionUpdate($params, $data)
+    public function actionUpdate($params, $data, $request)
     {
-        return $this->actionPatch($params, $data);
+        return $this->actionPatch($params, $data, $request);
     }
 
-    public function actionPatch($params, $data)
+    public function actionPatch($params, $data, $request)
     {
-        list($integration, $userId) = explode('__', $params['id']);
+        if (!$request->isPut() && !$request->isPost() && !$request->isPatch()) {
+            throw new BadRequest();
+        }
 
+        list($integration, $userId) = explode('__', $params['id']);
 
         if ($this->getUser()->id != $userId) {
             throw new Forbidden();

application/Espo/Controllers/FieldManager.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Controllers;

application/Espo/Controllers/GlobalSearch.php

@@ -18,7 +18,14 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- ************************************************************************/ 
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
 
 namespace Espo\Controllers;
 
@@ -29,11 +36,11 @@ class GlobalSearch extends \Espo\Core\Controllers\Base
 {
     public function actionSearch($params, $data, $request)
     {
-        $query = $params['query'];
-        
-        $offset = $request->get('offset');
-        $maxSize = $request->get('maxSize');        
-        
+        $query = $request->get('q');
+
+        $offset = intval($request->get('offset'));
+        $maxSize = intval($request->get('maxSize'));
+
         return $this->getService('GlobalSearch')->find($query, $offset, $maxSize);
     }
 }

application/Espo/Controllers/I18n.php

@@ -18,13 +18,19 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Controllers;
 
 class I18n extends \Espo\Core\Controllers\Base
 {
-
     public function actionRead($params, $data)
     {
         return $this->getContainer()->get('language')->getAll();

application/Espo/Controllers/Import.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Controllers;
@@ -71,10 +78,14 @@ class Import extends \Espo\Core\Controllers\Record
         return $this->getContainer()->get('entityManager');
     }
 
-    public function actionUploadFile($params, $data)
+    public function actionUploadFile($params, $data, $request)
     {
         $contents = $data;
 
+        if (!$request->isPost()) {
+            throw new BadRequest();
+        }
+
         $attachment = $this->getEntityManager()->getEntity('Attachment');
         $attachment->set('type', 'text/csv');
         $attachment->set('role', 'Import File');
@@ -88,24 +99,34 @@ class Import extends \Espo\Core\Controllers\Record
         );
     }
 
-    public function actionRevert($params, $data)
+    public function actionRevert($params, $data, $request)
     {
         if (empty($data['id'])) {
             throw new BadRequest();
         }
+        if (!$request->isPost()) {
+            throw new BadRequest();
+        }
         return $this->getService('Import')->revert($data['id']);
     }
 
-    public function actionRemoveDuplicates($params, $data)
+    public function actionRemoveDuplicates($params, $data, $request)
     {
         if (empty($data['id'])) {
             throw new BadRequest();
         }
+        if (!$request->isPost()) {
+            throw new BadRequest();
+        }
         return $this->getService('Import')->removeDuplicates($data['id']);
     }
 
-    public function actionCreate($params, $data)
+    public function actionCreate($params, $data, $request)
     {
+        if (!$request->isPost() && !$request->isPut()) {
+            throw new BadRequest();
+        }
+
         $importParams = array(
             'headerRow' => $data['headerRow'],
             'fieldDelimiter' => $data['fieldDelimiter'],
@@ -119,6 +140,10 @@ class Import extends \Espo\Core\Controllers\Record
             'action' => $data['action'],
         );
 
+        if (array_key_exists('updateBy', $data)) {
+            $importParams['updateBy'] = $data['updateBy'];
+        }
+
         $attachmentId = $data['attachmentId'];
 
         if (!$this->getAcl()->check($data['entityType'], 'edit')) {
@@ -127,5 +152,14 @@ class Import extends \Espo\Core\Controllers\Record
 
         return $this->getService('Import')->import($data['entityType'], $data['fields'], $attachmentId, $importParams);
     }
+
+    public function postActionUnmarkAsDuplicate($params, $data)
+    {
+        if (empty($data['id']) || empty($data['entityType']) || empty($data['entityId'])) {
+            throw new BadRequest();
+        }
+        $this->getService('Import')->unmarkAsDuplicate($data['id'], $data['entityType'], $data['entityId']);
+        return true;
+    }
 }
 

application/Espo/Controllers/InboundEmail.php

@@ -0,0 +1,73 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\BadRequest;
+
+class InboundEmail extends \Espo\Core\Controllers\Record
+{
+    protected function checkControllerAccess()
+    {
+        if (!$this->getUser()->isAdmin()) {
+            throw new Forbidden();
+        }
+    }
+
+    public function actionGetFolders($params, $data, $request)
+    {
+        return $this->getRecordService()->getFolders(array(
+            'host' => $request->get('host'),
+            'port' => $request->get('port'),
+            'ssl' => $request->get('ssl') === 'true',
+            'username' => $request->get('username'),
+            'password' => $request->get('password'),
+            'id' => $request->get('id')
+        ));
+    }
+
+    public function actionTestConnection($params, $data, $request)
+    {
+        if (!$request->isPost()) {
+            throw new BadRequest();
+        }
+
+        if (is_null($data['password'])) {
+            $inboundEmail = $this->getEntityManager()->getEntity('InboundEmail', $data['id']);
+            if (!$inboundEmail) {
+                throw new Error();
+            }
+            $data['password'] = $this->getContainer()->get('crypt')->decrypt($inboundEmail->get('password'));
+        }
+
+        return $this->getRecordService()->testConnection($data);
+    }
+
+}

application/Espo/Controllers/Integration.php

@@ -18,21 +18,30 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- ************************************************************************/ 
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
 
 namespace Espo\Controllers;
 
 use \Espo\Core\Exceptions\Error;
+use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\BadRequest;
 
 class Integration extends \Espo\Core\Controllers\Record
-{    
+{
     protected function checkControllerAccess()
     {
         if (!$this->getUser()->isAdmin()) {
             throw new Forbidden();
         }
     }
-    
+
     public function actionIndex($params, $data, $request)
     {
         return false;
@@ -40,22 +49,25 @@ class Integration extends \Espo\Core\Controllers\Record
 
     public function actionRead($params, $data, $request)
     {
-        $entity = $this->getEntityManager()->getEntity('Integration', $params['id']);        
+        $entity = $this->getEntityManager()->getEntity('Integration', $params['id']);
         return $entity->toArray();
     }
-    
-    public function actionUpdate($params, $data)
+
+    public function actionUpdate($params, $data, $request)
     {
-        return $this->actionPatch($params, $data);
+        return $this->actionPatch($params, $data, $request);
     }
-    
-    public function actionPatch($params, $data)
+
+    public function actionPatch($params, $data, $request)
     {
+        if (!$request->isPut() && !$request->isPatch()) {
+            throw new BadRequest();
+        }
         $entity = $this->getEntityManager()->getEntity('Integration', $params['id']);
         $entity->set($data);
         $this->getEntityManager()->saveEntity($entity);
-        
-        return $entity->toArray();        
+
+        return $entity->toArray();
     }
 }
 

application/Espo/Controllers/Job.php

@@ -0,0 +1,79 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\Error;
+use \Espo\Core\Exceptions\Forbidden;
+
+class Job extends \Espo\Core\Controllers\Record
+{
+    protected function checkControllerAccess()
+    {
+        if (!$this->getUser()->isAdmin()) {
+            throw new Forbidden();
+        }
+    }
+
+    public function actionCreate($params, $data, $request)
+    {
+        throw new Forbidden();
+    }
+
+    public function actionUpdate($params, $data, $request)
+    {
+        throw new Forbidden();
+    }
+
+    public function actionPatch($params, $data, $request)
+    {
+        throw new Forbidden();
+    }
+
+    public function actionListLinked($params, $data, $request)
+    {
+        throw new Forbidden();
+    }
+
+    public function actionMassUpdate($params, $data, $request)
+    {
+        throw new Forbidden();
+    }
+
+    public function actionCreateLink($params, $data, $request)
+    {
+        throw new Forbidden();
+    }
+
+    public function actionRemoveLink($params, $data, $request)
+    {
+        throw new Forbidden();
+    }
+}
+

application/Espo/Controllers/Layout.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Controllers;
@@ -26,6 +33,7 @@ use Espo\Core\Utils as Utils;
 use \Espo\Core\Exceptions\NotFound;
 use \Espo\Core\Exceptions\Error;
 use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\BadRequest;
 
 class Layout extends \Espo\Core\Controllers\Base
 {
@@ -38,12 +46,16 @@ class Layout extends \Espo\Core\Controllers\Base
         return $data;
     }
 
-    public function actionUpdate($params, $data)
+    public function actionUpdate($params, $data, $request)
     {
         if (!$this->getUser()->isAdmin()) {
             throw new Forbidden();
         }
 
+        if (!$request->isPut() && !$request->isPatch()) {
+            throw new BadRequest();
+        }
+
         $layoutManager = $this->getContainer()->get('layout');
         $layoutManager->set($data, $params['scope'], $params['name']);
         $result = $layoutManager->save();
@@ -57,8 +69,20 @@ class Layout extends \Espo\Core\Controllers\Base
         return $layoutManager->get($params['scope'], $params['name']);
     }
 
-    public function actionPatch($params, $data)
+    public function actionPatch($params, $data, $request)
     {
-        return $this->actionUpdate($params, $data);
+        return $this->actionUpdate($params, $data, $request);
+    }
+
+    public function actionResetToDefault($params, $data, $request)
+    {
+        if (!$request->isPost()) {
+            throw new BadRequest();
+        }
+        if (empty($data['scope']) || empty($data['name'])) {
+            throw new BadRequest();
+        }
+
+        return $this->getContainer()->get('layout')->resetToDefault($data['scope'], $data['name']);
     }
 }

application/Espo/Controllers/Metadata.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/ 
 
 namespace Espo\Controllers;

application/Espo/Controllers/Note.php

@@ -18,7 +18,14 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- ************************************************************************/ 
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
 
 namespace Espo\Controllers;
 

application/Espo/Controllers/Notification.php

@@ -18,49 +18,80 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- ************************************************************************/ 
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
 
 namespace Espo\Controllers;
 
 use \Espo\Core\Exceptions\Error;
 
-class Notification extends \Espo\Core\Controllers\Base
+class Notification extends \Espo\Core\Controllers\Record
 {
     public static $defaultAction = 'list';
 
     public function actionList($params, $data, $request)
     {
-        $scope = $params['scope'];
-        $id = $params['id'];
-        
         $userId = $this->getUser()->id;
-        
+
         $offset = intval($request->get('offset'));
-        $maxSize = intval($request->get('maxSize'));        
-        
+        $maxSize = intval($request->get('maxSize'));
+        $after = $request->get('after');
+
         $params = array(
             'offset' => $offset,
             'maxSize' => $maxSize,
+            'after' => $after
         );
-        
-        $result = $this->getService('Notification')->getList($userId, $params);    
-        
+
+        $result = $this->getService('Notification')->getList($userId, $params);
+
         return array(
             'total' => $result['total'],
             'list' => $result['collection']->toArray()
         );
     }
-    
+
     public function actionNotReadCount()
     {
         $userId = $this->getUser()->id;
         return $this->getService('Notification')->getNotReadCount($userId);
     }
-    
-    public function actionMarkAllRead($params, $data, $request)
+
+    public function postActionMarkAllRead($params, $data, $request)
     {
         $userId = $this->getUser()->id;
         return $this->getService('Notification')->markAllRead($userId);
     }
+
+    public function actionExport($params, $data, $request)
+    {
+        throw new Error();
+    }
+
+    public function actionMassUpdate($params, $data, $request)
+    {
+        throw new Error();
+    }
+
+    public function actionCreateLink($params, $data, $request)
+    {
+        throw new Error();
+    }
+
+    public function actionRemoveLink($params, $data, $request)
+    {
+        throw new Error();
+    }
+
+    public function actionMerge($params, $data, $request)
+    {
+        throw new Error();
+    }
 }
 

application/Espo/Controllers/Portal.php

@@ -0,0 +1,43 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\Forbidden;
+
+class Portal extends \Espo\Core\Controllers\Record
+{
+    protected function checkControllerAccess()
+    {
+        $portalPermission = $this->getAcl()->get('portalPermission');
+        if (!$portalPermission || $portalPermission === 'no') {
+            throw new Forbidden();
+        }
+    }
+}

application/Espo/Controllers/PortalRole.php

@@ -0,0 +1,34 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+class PortalRole extends \Espo\Core\Controllers\Record
+{
+}

application/Espo/Controllers/Preferences.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Controllers;
@@ -53,27 +60,42 @@ class Preferences extends \Espo\Core\Controllers\Base
         }
     }
 
-    public function actionDelete($params, $data)
+    public function actionDelete($params, $data, $request)
     {
         $userId = $params['id'];
         if (empty($userId)) {
             throw new BadRequest();
         }
+        if (!$request->isDelete()) {
+            throw new BadRequest();
+        }
         $this->handleUserAccess($userId);
 
         return $this->getEntityManager()->getRepository('Preferences')->resetToDefaults($userId);
     }
 
-    public function actionPatch($params, $data)
+    public function actionPatch($params, $data, $request)
     {
-        return $this->actionUpdate($params, $data);
+        return $this->actionUpdate($params, $data, $request);
     }
 
-    public function actionUpdate($params, $data)
+    public function actionUpdate($params, $data, $request)
     {
         $userId = $params['id'];
         $this->handleUserAccess($userId);
 
+        if (!$request->isPost() && !$request->isPatch() && !$request->isPut()) {
+            throw new BadRequest();
+        }
+
+        if ($this->getAcl()->getLevel('Preferences', 'read') === 'no') {
+            throw new Forbidden();
+        }
+
+        foreach ($this->getAcl()->getScopeForbiddenAttributeList('Preferences', 'edit') as $attribute) {
+            unset($data[$attribute]);
+        }
+
         if (array_key_exists('smtpPassword', $data)) {
             $data['smtpPassword'] = $this->getCrypt()->encrypt($data['smtpPassword']);
         }
@@ -113,6 +135,10 @@ class Preferences extends \Espo\Core\Controllers\Base
 
         $entity->clear('smtpPassword');
 
+        foreach ($this->getAcl()->getScopeForbiddenAttributeList('Preferences', 'read') as $attribute) {
+            $entity->clear($attribute);
+        }
+
         return $entity->toArray();
     }
 }

application/Espo/Controllers/Role.php

@@ -18,12 +18,17 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- ************************************************************************/ 
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
 
 namespace Espo\Controllers;
 
 class Role extends \Espo\Core\Controllers\Record
 {
-
 }
-

application/Espo/Controllers/ScheduledJob.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/ 
 
 namespace Espo\Controllers;

application/Espo/Controllers/ScheduledJobLogRecord.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/ 
 
 namespace Espo\Controllers;

application/Espo/Controllers/Settings.php

@@ -18,12 +18,20 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Controllers;
 
 use \Espo\Core\Exceptions\Error;
 use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\BadRequest;
 
 class Settings extends \Espo\Core\Controllers\Base
 {
@@ -38,6 +46,9 @@ class Settings extends \Espo\Core\Controllers\Base
                 unset($data[$field]);
             }
         }
+
+        $data['jsLibs'] = $this->getMetadata()->get('app.jsLibs');
+
         return $data;
     }
 
@@ -46,17 +57,21 @@ class Settings extends \Espo\Core\Controllers\Base
         return $this->getConfigData();
     }
 
-    public function actionUpdate($params, $data)
+    public function actionUpdate($params, $data, $request)
     {
-        return $this->actionPatch($params, $data);
+        return $this->actionPatch($params, $data, $request);
     }
 
-    public function actionPatch($params, $data)
+    public function actionPatch($params, $data, $request)
     {
         if (!$this->getUser()->isAdmin()) {
             throw new Forbidden();
         }
 
+        if (!$request->isPut() && !$request->isPatch()) {
+            throw new BadRequest();
+        }
+
         if (isset($data['useCache']) && $data['useCache'] != $this->getConfig()->get('useCache')) {
             $this->getContainer()->get('dataManager')->clearCache();
         }

application/Espo/Controllers/Stream.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Controllers;
@@ -26,7 +33,7 @@ use \Espo\Core\Exceptions\Error;
 
 class Stream extends \Espo\Core\Controllers\Base
 {
-    const MAX_SIZE_LIMIT = 400;
+    const MAX_SIZE_LIMIT = 200;
 
     public static $defaultAction = 'list';
 
@@ -38,6 +45,7 @@ class Stream extends \Espo\Core\Controllers\Base
         $offset = intval($request->get('offset'));
         $maxSize = intval($request->get('maxSize'));
         $after = $request->get('after');
+        $filter = $request->get('filter');
 
         $service = $this->getService('Stream');
 
@@ -52,6 +60,7 @@ class Stream extends \Espo\Core\Controllers\Base
             'offset' => $offset,
             'maxSize' => $maxSize,
             'after' => $after,
+            'filter' => $filter
         ));
 
         return array(

application/Espo/Controllers/Team.php

@@ -18,12 +18,19 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- ************************************************************************/ 
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
 
 namespace Espo\Controllers;
 
 class Team extends \Espo\Core\Controllers\Record
 {
-    
+
 
 }

application/Espo/Controllers/Template.php

@@ -0,0 +1,38 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\Error;
+
+class Template extends \Espo\Core\Controllers\Record
+{
+
+}
+

application/Espo/Controllers/User.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Controllers;
@@ -45,24 +52,19 @@ class User extends \Espo\Core\Controllers\Record
             throw new NotFound();
         }
 
-        $acl = new \Espo\Core\Acl($user, $this->getConfig(), $this->getContainer()->get('fileManager'), $this->getMetadata());
-
-        return $acl->toArray();
+        return $this->getAclManager()->getMap($user);
     }
 
-    public function actionChangeOwnPassword($params, $data, $request)
+    public function postActionChangeOwnPassword($params, $data, $request)
     {
-        if (!$request->isPost()) {
+        if (!array_key_exists('password', $data) || !array_key_exists('currentPassword', $data)) {
             throw new BadRequest();
         }
-        return $this->getService('User')->changePassword($this->getUser()->id, $data['password']);
+        return $this->getService('User')->changePassword($this->getUser()->id, $data['password'], true, $data['currentPassword']);
     }
 
-    public function actionChangePasswordByRequest($params, $data, $request)
+    public function postActionChangePasswordByRequest($params, $data, $request)
     {
-        if (!$request->isPost()) {
-            throw new BadRequest();
-        }
         if (empty($data['requestId']) || empty($data['password'])) {
             throw new BadRequest();
         }
@@ -81,23 +83,27 @@ class User extends \Espo\Core\Controllers\Record
 
         $this->getEntityManager()->removeEntity($p);
 
-        return $this->getService('User')->changePassword($userId, $data['password']);
+        if ($this->getService('User')->changePassword($userId, $data['password'])) {
+            return array(
+                'url' => $p->get('url')
+            );
+        }
     }
 
-    public function actionPasswordChangeRequest($params, $data, $request)
+    public function postActionPasswordChangeRequest($params, $data, $request)
     {
-        if (!$request->isPost()) {
-            throw new Forbidden();
-        }
-        
         if (empty($data['userName']) || empty($data['emailAddress'])) {
             throw new BadRequest();
         }
 
         $userName = $data['userName'];
         $emailAddress = $data['emailAddress'];
+        $url = null;
+        if (!empty($data['url'])) {
+            $url = $data['url'];
+        }
 
-        return $this->getService('User')->passwordChangeRequest($userName, $emailAddress);
+        return $this->getService('User')->passwordChangeRequest($userName, $emailAddress, $url);
     }
 }
 

application/Espo/Core/Acl.php

@@ -18,309 +18,105 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core;
 
-use \Espo\Core\Exceptions\Error;
-
 use \Espo\ORM\Entity;
+use \Espo\Entities\User;
 
 class Acl
 {
-    private $data = array(
-        'table' => array()
-    );
+    private $user;
 
-    private $cacheFile;
+    private $aclManager;
 
-    private $actionList = array('read', 'edit', 'delete');
-
-    private $levelList = array('all', 'team', 'own', 'no');
-
-    protected $fileManager;
-
-    protected $metadata;
-
-    public function __construct(\Espo\Entities\User $user, $config = null, $fileManager = null, $metadata = null)
+    public function __construct(AclManager $aclManager, User $user)
     {
+        $this->aclManager = $aclManager;
         $this->user = $user;
-
-        $this->metadata = $metadata;
-
-        if (!$this->user->isFetched()) {
-            throw new Error();
-        }
-
-        $this->user->loadLinkMultipleField('teams');
-
-        if ($fileManager) {
-            $this->fileManager = $fileManager;
-        }
-
-        $this->cacheFile = 'data/cache/application/acl/' . $user->id . '.php';
-
-        if ($config && $config->get('useCache') && file_exists($this->cacheFile)) {
-            $cached = include $this->cacheFile;
-            $this->data = $cached;
-            $this->initSolid();
-        } else {
-            $this->load();
-            $this->initSolid();
-            if ($config && $fileManager && $config->get('useCache')) {
-                $this->buildCache();
-            }
-        }
-
     }
 
-    public function checkScope($scope, $action = null, $isOwner = null, $inTeam = null, $entity = null)
+    protected function getAclManager()
     {
-        if (array_key_exists($scope, $this->data['table'])) {
-            if ($this->data['table'][$scope] === false) {
-                return false;
-            }
-            if ($this->data['table'][$scope] === true) {
-                return true;
-            }
-            if (!is_null($action)) {
-                if (array_key_exists($action, $this->data['table'][$scope])) {
-                    $value = $this->data['table'][$scope][$action];
-
-                    if ($value === 'all' || $value === true) {
-                        return true;
-                    }
-
-                    if (!$value || $value === 'no') {
-                        return false;
-                    }
-
-                    if (is_null($isOwner)) {
-                        return true;
-                    }
-
-                    if ($isOwner) {
-                        if ($value === 'own' || $value === 'team') {
-                            return true;
-                        }
-                    }
-                    if ($inTeam === null && $entity) {
-                        $inTeam = $this->checkInTeam($entity);
-                    }
-
-                    if ($inTeam) {
-                        if ($value === 'team') {
-                            return true;
-                        }
-                    }
-
-                    return false;
-                }
-            }
-            return true;
-        }
-        return true;
+        return $this->aclManager;
     }
 
-    public function toArray()
+    protected function getUser()
     {
-        return $this->data;
+        return $this->user;
     }
 
-    public function get($permission)
+    public function getMap()
     {
-        if ($this->user->isAdmin()) {
-            return true;
-        }
-        if ($permission == 'table') {
-            return null;
-        }
-
-        if (array_key_exists($permission, $this->data)) {
-            return $this->data[$permission];
-        }
-        return null;
+        return $this->getAclManager()->getMap($this->getUser());
     }
 
     public function getLevel($scope, $action)
     {
-        if ($this->user->isAdmin()) {
-            return 'all';
-        }
-        if (array_key_exists($scope, $this->data['table'])) {
-            if (array_key_exists($action, $this->data['table'][$scope])) {
-                return $this->data['table'][$scope][$action];
-            }
-        }
-        return false;
+        return $this->getAclManager()->getLevel($this->getUser(), $scope, $action);
     }
 
-    public function check($subject, $action = null, $isOwner = null, $inTeam = null)
+    public function get($permission)
     {
-        if ($this->user->isAdmin()) {
-            return true;
-        }
-        if (is_string($subject)) {
-            return $this->checkScope($subject, $action, $isOwner, $inTeam);
-        } else {
-            $entity = $subject;
-            if ($entity instanceof Entity) {
-                $entityName = $entity->getEntityName();
-                return $this->checkScope($entityName, $action, $this->checkIsOwner($entity), $inTeam, $entity);
-            }
-        }
+        return $this->getAclManager()->get($this->getUser(), $permission);
     }
 
     public function checkReadOnlyTeam($scope)
     {
-        if (isset($this->data['table'][$scope]) && isset($this->data['table'][$scope]['read'])) {
-            return $this->data['table'][$scope]['read'] === 'team';
-        }
-        return false;
+        return $this->getAclManager()->checkReadOnlyTeam($this->getUser(), $scope);
     }
 
     public function checkReadOnlyOwn($scope)
     {
-        if ($this->user->isAdmin()) {
-            return false;
-        }
-        if (isset($this->data['table'][$scope]) && isset($this->data['table'][$scope]['read'])) {
-            return $this->data['table'][$scope]['read'] === 'own';
-        }
-        return false;
+        return $this->getAclManager()->checkReadOnlyOwn($this->getUser(), $scope);
     }
 
-    public function checkIsOwner($entity)
+    public function check($subject, $action = null)
     {
-        if ($this->user->isAdmin()) {
-            return false;
-        }
-        $userId = $this->user->id;
-        if ($userId === $entity->get('assignedUserId') || $userId === $entity->get('createdById')) {
-            return true;
-        }
-        return false;
+        return $this->getAclManager()->check($this->getUser(), $subject, $action);
     }
 
-    public function checkInTeam($entity)
+    public function checkScope($scope, $action = null)
     {
-        $userTeamIds = $this->user->get('teamsIds');
-
-        if (!$entity->hasRelation('teams') || !$entity->hasField('teamsIds')) {
-            return false;
-        }
-
-        if (!$entity->has('teamsIds')) {
-            $entity->loadLinkMultipleField('teams');
-        }
-
-        $teamIds = $entity->get('teamsIds');
-
-        if (empty($teamIds)) {
-            return false;
-        }
-
-        foreach ($userTeamIds as $id) {
-            if (in_array($id, $teamIds)) {
-                return true;
-            }
-        }
-        return false;
+        return $this->getAclManager()->checkScope($this->getUser(), $scope, $action);
     }
 
-    private function load()
+    public function checkEntity(Entity $entity, $action = 'read')
     {
-        $aclTables = [];
-        $assignmentPermissionList = [];
-
-        $userRoles = $this->user->get('roles');
-
-        foreach ($userRoles as $role) {
-            $aclTables[] = $role->get('data');
-            $assignmentPermissionList[] = $role->get('assignmentPermission');
-        }
-
-        $teams = $this->user->get('teams');
-        foreach ($teams as $team) {
-            $teamRoles = $team->get('roles');
-            foreach ($teamRoles as $role) {
-                $aclTables[] = $role->get('data');
-                $assignmentPermissionList[] = $role->get('assignmentPermission');
-            }
-        }
-
-        $this->data['table'] = $this->merge($aclTables);
-        $this->data['assignmentPermission'] = $this->mergeValues($assignmentPermissionList, 'all');
+        return $this->getAclManager()->checkEntity($this->getUser(), $entity, $action);
     }
 
-    private function initSolid()
+    public function checkUser($permission, User $entity)
     {
-        if (!$this->metadata) {
-            return;
-        }
-
-        $data = $this->metadata->get('app.acl.solid', array());
-
-        foreach ($data as $entityName => $item) {
-            $this->data['table'][$entityName] = $item;
-        }
+        return $this->getAclManager()->checkUser($this->getUser(), $permission, $entity);
     }
 
-    private function mergeValues(array $list, $defaultValue)
+    public function checkIsOwner(Entity $entity)
     {
-        $result = null;
-        foreach ($list as $level) {
-            if ($level != 'not-set') {
-                if (is_null($result)) {
-                    $result = $level;
-                    continue;
-                }
-                if (array_search($result, $this->levelList) > array_search($level, $this->levelList)) {
-                    $result = $level;
-                }
-            }
-        }
-        if (is_null($result)) {
-            $result = $defaultValue;
-        }
-        return $result;
+        return $this->getAclManager()->checkIsOwner($this->getUser(), $entity);
     }
 
-    private function merge($tables)
+    public function checkInTeam(Entity $entity)
     {
-        $data = array();
-        foreach ($tables as $table) {
-            foreach ($table as $scope => $row) {
-                if ($row == false) {
-                    if (!isset($data[$scope])) {
-                        $data[$scope] = false;
-                    }
-                } else {
-                    if (!isset($data[$scope])) {
-                        $data[$scope] = array();
-                    }
-                    if ($data[$scope] == false) {
-                        $data[$scope] = array();
-                    }
-                    foreach ($row as $action => $level) {
-                        if (!isset($data[$scope][$action])) {
-                            $data[$scope][$action] = $level;
-                        } else {
-                            if (array_search($data[$scope][$action], $this->levelList) > array_search($level, $this->levelList)) {
-                                $data[$scope][$action] = $level;
-                            }
-                        }
-                    }
-                }
-            }
-        }
-        return $data;
+        return $this->getAclManager()->checkInTeam($this->getUser(), $entity);
     }
 
-    private function buildCache()
+    public function getScopeForbiddenAttributeList($scope, $action = 'read', $thresholdLevel = 'no')
     {
-        $contents = '<' . '?'. 'php return ' .  var_export($this->data, true)  . ';';
-        $this->fileManager->putContents($this->cacheFile, $contents);
+        return $this->getAclManager()->getScopeForbiddenAttributeList($this->getUser(), $scope, $action, $thresholdLevel);
+    }
+
+    public function getScopeForbiddenFieldList($scope, $action = 'read', $thresholdLevel = 'no')
+    {
+        return $this->getAclManager()->getScopeForbiddenFieldList($this->getUser(), $scope, $action, $thresholdLevel);
     }
 }
 

application/Espo/Core/Acl/Base.php

@@ -0,0 +1,266 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Acl;
+
+use \Espo\Core\Interfaces\Injectable;
+
+use \Espo\Entities\User;
+use \Espo\ORM\Entity;
+
+class Base implements Injectable
+{
+    protected $dependencies = array(
+        'config',
+        'entityManager',
+        'aclManager'
+    );
+
+    protected $scope;
+
+    protected $injections = array();
+
+    public function inject($name, $object)
+    {
+        $this->injections[$name] = $object;
+    }
+
+    public function __construct($scope)
+    {
+        $this->init();
+        $this->scope = $scope;
+    }
+
+    protected function init()
+    {
+    }
+
+    protected function getInjection($name)
+    {
+        return $this->injections[$name];
+    }
+
+    protected function addDependency($name)
+    {
+        $this->dependencies[] = $name;
+    }
+
+    public function getDependencyList()
+    {
+        return $this->dependencies;
+    }
+
+    protected function getConfig()
+    {
+        return $this->getInjection('config');
+    }
+
+    protected function getEntityManager()
+    {
+        return $this->getInjection('entityManager');
+    }
+
+    protected function getAclManager()
+    {
+        return $this->getInjection('aclManager');
+    }
+
+    public function checkReadOnlyTeam(User $user, $data)
+    {
+        if (empty($data) || !is_object($data) || !isset($data->read)) {
+            return false;
+        }
+        return $data->read === 'team';
+    }
+
+    public function checkReadOnlyOwn(User $user, $data)
+    {
+        if (empty($data) || !is_object($data) || !isset($data->read)) {
+            return false;
+        }
+        return $data->read === 'own';
+    }
+
+    public function checkEntity(User $user, Entity $entity, $data, $action)
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+        return $this->checkScope($user, $data, $action, $entity);
+    }
+
+    public function checkScope(User $user, $data, $action = null, Entity $entity = null, $entityAccessData = array())
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if (is_null($data)) {
+            return false;
+        }
+        if ($data === false) {
+            return false;
+        }
+        if ($data === true) {
+            return true;
+        }
+        if (is_string($data)) {
+            return true;
+        }
+
+        $isOwner = null;
+        if (isset($entityAccessData['isOwner'])) {
+            $isOwner = $entityAccessData['isOwner'];
+        }
+        $inTeam = null;
+        if (isset($entityAccessData['inTeam'])) {
+            $inTeam = $entityAccessData['inTeam'];
+        }
+
+        if (is_null($action)) {
+            return true;
+        }
+
+        if (!isset($data->$action)) {
+            return true;
+        }
+
+        $value = $data->$action;
+
+        if ($value === 'all' || $value === 'yes' || $value === true) {
+            return true;
+        }
+
+        if (!$value || $value === 'no') {
+            return false;
+        }
+
+        if (is_null($isOwner)) {
+            if ($entity) {
+                $isOwner = $this->checkIsOwner($user, $entity);
+            } else {
+                return true;
+            }
+        }
+
+        if ($isOwner) {
+            if ($value === 'own' || $value === 'team') {
+                return true;
+            }
+        }
+        if (is_null($inTeam) && $entity) {
+            $inTeam = $this->checkInTeam($user, $entity);
+        }
+
+        if ($inTeam) {
+            if ($value === 'team') {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    public function checkIsOwner(User $user, Entity $entity)
+    {
+        if ($entity->hasAttribute('assignedUserId')) {
+            if ($entity->has('assignedUserId')) {
+                if ($user->id === $entity->get('assignedUserId')) {
+                    return true;
+                }
+            }
+        } else if ($entity->hasAttribute('createdById')) {
+            if ($entity->has('createdById')) {
+                if ($user->id === $entity->get('createdById')) {
+                    return true;
+                }
+            }
+        }
+
+        if ($entity->hasAttribute('assignedUsersIds') && $entity->hasRelation('assignedUsers')) {
+            if ($entity->hasLinkMultipleId('assignedUsers', $user->id)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    public function checkInTeam(User $user, Entity $entity)
+    {
+        $userTeamIdList = $user->getLinkMultipleIdList('teams');
+
+        if (!$entity->hasRelation('teams') || !$entity->hasAttribute('teamsIds')) {
+            return false;
+        }
+
+        $entityTeamIdList = $entity->getLinkMultipleIdList('teams');
+
+        if (empty($entityTeamIdList)) {
+            return false;
+        }
+
+        foreach ($userTeamIdList as $id) {
+            if (in_array($id, $entityTeamIdList)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    public function checkEntityDelete(User $user, Entity $entity, $data)
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if ($this->checkEntity($user, $entity, $data, 'delete')) {
+            return true;
+        }
+
+        if (is_object($data)) {
+            if ($data->edit !== 'no' || $data->create !== 'no') {
+                if ($entity->has('createdById') && $entity->get('createdById') == $user->id) {
+                    if (!$entity->has('assignedUserId')) {
+                        return true;
+                    } else {
+                        if (!$entity->get('assignedUserId')) {
+                            return true;
+                        }
+                        if ($entity->get('assignedUserId') == $entity->get('createdById')) {
+                            return true;
+                        }
+                    }
+                }
+            }
+        }
+
+        return false;
+    }
+}
+

application/Espo/Core/Acl/Table.php

@@ -0,0 +1,690 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Acl;
+
+use \Espo\Core\Exceptions\Error;
+
+use \Espo\ORM\Entity;
+use \Espo\Entities\User;
+
+use \Espo\Core\Utils\Config;
+use \Espo\Core\Utils\Metadata;
+use \Espo\Core\Utils\FieldManager;
+use \Espo\Core\Utils\File\Manager as FileManager;
+
+class Table
+{
+    protected $type = 'acl';
+
+    protected $defaultAclType = 'recordAllTeamOwnNo';
+
+    private $data = null;
+
+    protected $cacheFilePath;
+
+    protected $actionList = ['read', 'stream', 'edit', 'delete', 'create'];
+
+    protected $booleanActionList = ['create'];
+
+    protected $levelList = ['yes', 'all', 'team', 'own', 'no'];
+
+    protected $fieldActionList = ['read', 'edit'];
+
+    protected $fieldLevelList = ['yes', 'no'];
+
+    protected $valuePermissionList = ['assignmentPermission', 'userPermission', 'portalPermission'];
+
+    protected $valuePrtmissionHighestLevels = array(
+        'assignmentPermission' => 'all',
+        'userPermission' => 'all',
+        'portalPermission' => 'yes'
+    );
+
+    private $fileManager;
+
+    private $metadata;
+
+    private $fieldManager;
+
+    protected $forbiddenAttributesCache = array();
+
+    protected $forbiddenFieldsCache = array();
+
+    public function __construct(User $user, Config $config = null, FileManager $fileManager = null, Metadata $metadata = null, FieldManager $fieldManager = null)
+    {
+        $this->data = (object) [
+            'table' => (object) [],
+            'fieldTable' => (object) [],
+            'fieldTableQuickAccess' => (object) [],
+        ];
+
+        $this->user = $user;
+
+        $this->metadata = $metadata;
+
+        if ($fieldManager) {
+            $this->fieldManager = $fieldManager;
+        }
+
+        if (!$this->user->isFetched()) {
+            throw new Error('User must be fetched before ACL check.');
+        }
+
+        $this->user->loadLinkMultipleField('teams');
+
+        if ($fileManager) {
+            $this->fileManager = $fileManager;
+        }
+        $this->valuePermissionList = $this->metadata->get('app.' . $this->type . '.defs.valuePermissionList', $this->valuePermissionList);
+
+        $this->initCacheFilePath();
+
+        if ($config && $config->get('useCache') && file_exists($this->cacheFilePath)) {
+            $cached = include $this->cacheFilePath;
+            $this->data = $cached;
+        } else {
+            $this->load();
+            if ($config && $fileManager && $config->get('useCache')) {
+                $this->buildCache();
+            }
+        }
+    }
+
+    protected function initCacheFilePath()
+    {
+        $this->cacheFilePath = 'data/cache/application/acl/' . $this->user->id . '.php';
+    }
+
+    protected function getUser()
+    {
+        return $this->user;
+    }
+
+    protected function getMetadata()
+    {
+        return $this->metadata;
+    }
+
+    protected function getFieldManager()
+    {
+        return $this->fieldManager;
+    }
+
+    protected function getConfig()
+    {
+        return $this->config;
+    }
+
+    public function getMap()
+    {
+        return $this->data;
+    }
+
+    public function getScopeData($scope)
+    {
+        if (isset($this->data->table->$scope)) {
+            $data = $this->data->table->$scope;
+            if (is_string($data)) {
+                $data = $this->getScopeData($data);
+                return $data;
+            }
+            return $data;
+        }
+        return null;
+    }
+
+    public function get($permission)
+    {
+        if ($permission == 'table') {
+            return null;
+        }
+
+        if (isset($this->data->$permission)) {
+            return $this->data->$permission;
+        }
+        return null;
+    }
+
+    public function getLevel($scope, $action)
+    {
+        if (isset($this->data->table->$scope)) {
+            if (isset($this->data->table->$scope->$action)) {
+                return $this->data->table->$scope->$action;
+            }
+        }
+        return false;
+    }
+
+    private function load()
+    {
+        $valuePermissionLists = (object)[];
+        foreach ($this->valuePermissionList as $permission) {
+            $valuePermissionLists->$permission = [];
+        }
+
+        $aclTableList = [];
+        $fieldTableList = [];
+
+        if (!$this->user->isAdmin()) {
+            $roleList = $this->getRoleList();
+
+            foreach ($roleList as $role) {
+                $aclTableList[] = $role->get('data');
+                $fieldTableList[] = $role->get('fieldData');
+                foreach ($this->valuePermissionList as $permission) {
+                    $valuePermissionLists->{$permission}[] = $role->get($permission);
+                }
+            }
+
+            $aclTable = $this->mergeTableList($aclTableList);
+            $fieldTable = $this->mergeFieldTableList($fieldTableList);
+
+            $this->applyDefault($aclTable, $fieldTable);
+            $this->applyDisabled($aclTable, $fieldTable);
+            $this->applyMandatory($aclTable, $fieldTable);
+        } else {
+            $aclTable = (object) [];
+            foreach ($this->getScopeList() as $scope) {
+                if ($this->metadata->get("scopes.{$scope}.{$this->type}") === 'boolean') {
+                    $aclTable->$scope = true;
+                } else {
+                    if ($this->metadata->get("scopes.{$scope}.entity")) {
+                        $aclTable->$scope = (object) [];
+                        foreach ($this->actionList as $action) {
+                            $aclTable->$scope->$action = 'all';
+                            if (in_array($action, $this->booleanActionList)) {
+                                $aclTable->$scope->$action = 'yes';
+                            }
+                        }
+                    }
+                }
+            }
+            $fieldTable = (object) [];
+        }
+
+        foreach ($aclTable as $scope => $data) {
+            if (is_string($data)) {
+                if (isset($aclTable->$data)) {
+                    $aclTable->$scope = $aclTable->$data;
+                }
+            }
+        }
+
+        $this->data->table = $aclTable;
+        $this->data->fieldTable = $fieldTable;
+
+        $this->fillFieldTableQuickAccess();
+
+        if (!$this->user->isAdmin()) {
+            foreach ($this->valuePermissionList as $permission) {
+                $this->data->$permission = $this->mergeValueList($valuePermissionLists->$permission, $this->metadata->get('app.'.$this->type.'.default.' . $permission, 'yes'));
+                if ($this->metadata->get('app.'.$this->type.'.mandatory.' . $permission)) {
+                    $this->data->$permission = $this->metadata->get('app.'.$this->type.'.mandatory.' . $permission);
+                }
+            }
+
+        } else {
+            foreach ($this->valuePermissionList as $permission) {
+                if (isset($this->valuePrtmissionHighestLevels[$permission])) {
+                    $this->data->$permission = $this->valuePrtmissionHighestLevels[$permission];
+                    continue;
+                }
+                $this->data->$permission = 'all';
+            }
+        }
+    }
+
+    protected function getRoleList()
+    {
+        $roleList = [];
+
+        $userRoleList = $this->getUser()->get('roles');
+        foreach ($userRoleList as $role) {
+            $roleList[] = $role;
+        }
+
+        $teamList = $this->getUser()->get('teams');
+        foreach ($teamList as $team) {
+            $teamRoleList = $team->get('roles');
+            foreach ($teamRoleList as $role) {
+                $roleList[] = $role;
+            }
+        }
+
+        return $roleList;
+    }
+
+    public function getScopeForbiddenAttributeList($scope, $action = 'read', $thresholdLevel = 'no')
+    {
+        $key = $scope . '_'. $action . '_' . $thresholdLevel;
+        if (isset($this->forbiddenAttributesCache[$key])) {
+            return $this->forbiddenAttributesCache[$key];
+        }
+
+        $fieldTableQuickAccess = $this->data->fieldTableQuickAccess;
+
+        if (!isset($fieldTableQuickAccess->$scope) || !isset($fieldTableQuickAccess->$scope->attributes) || !isset($fieldTableQuickAccess->$scope->attributes->$action)) {
+            $this->forbiddenAttributesCache[$key] = [];
+            return [];
+        }
+
+        $levelList = [];
+        foreach ($this->fieldLevelList as $level) {
+            if (array_search($level, $this->fieldLevelList) >= array_search($thresholdLevel, $this->fieldLevelList)) {
+                $levelList[] = $level;
+            }
+        }
+
+        $attributeList = [];
+
+        foreach ($levelList as $level) {
+            if (!isset($fieldTableQuickAccess->$scope->attributes->$action->$level)) continue;
+            foreach ($fieldTableQuickAccess->$scope->attributes->$action->$level as $attribute) {
+                if (in_array($attribute, $attributeList)) continue;
+                $attributeList[] = $attribute;
+            }
+        }
+
+        $this->forbiddenAttributesCache[$key] = $attributeList;
+
+        return $attributeList;
+    }
+
+    public function getScopeForbiddenFieldList($scope, $action = 'read', $thresholdLevel = 'no')
+    {
+        $key = $scope . '_'. $action . '_' . $thresholdLevel;
+        if (isset($this->forbiddenFieldsCache[$key])) {
+            return $this->forbiddenFieldsCache[$key];
+        }
+
+        $fieldTableQuickAccess = $this->data->fieldTableQuickAccess;
+
+        if (!isset($fieldTableQuickAccess->$scope) || !isset($fieldTableQuickAccess->$scope->fields) || !isset($fieldTableQuickAccess->$scope->fields->$action)) {
+            $this->forbiddenFieldsCache[$key] = [];
+            return [];
+        }
+
+        $levelList = [];
+        foreach ($this->fieldLevelList as $level) {
+            if (array_search($level, $this->fieldLevelList) >= array_search($thresholdLevel, $this->fieldLevelList)) {
+                $levelList[] = $level;
+            }
+        }
+
+        $fieldList = [];
+
+        foreach ($levelList as $level) {
+            if (!isset($fieldTableQuickAccess->$scope->fields->$action->$level)) continue;
+            foreach ($fieldTableQuickAccess->$scope->fields->$action->$level as $field) {
+                if (in_array($field, $fieldList)) continue;
+                $fieldList[] = $field;
+            }
+        }
+
+        $this->forbiddenFieldsCache[$key] = $fieldList;
+
+        return $fieldList;
+    }
+
+    protected function fillFieldTableQuickAccess()
+    {
+        $fieldTable = $this->data->fieldTable;
+
+        $fieldTableQuickAccess = (object) [];
+
+        foreach (get_object_vars($fieldTable) as $scope => $scopeData) {
+            $fieldTableQuickAccess->$scope = (object) [
+                'attributes' => (object) [],
+                'fields' => (object) []
+            ];
+
+            foreach ($this->fieldActionList as $action) {
+                $fieldTableQuickAccess->$scope->attributes->$action = (object) [];
+                $fieldTableQuickAccess->$scope->fields->$action = (object) [];
+                foreach ($this->fieldLevelList as $level) {
+                    $fieldTableQuickAccess->$scope->attributes->$action->$level = [];
+                    $fieldTableQuickAccess->$scope->fields->$action->$level = [];
+                }
+            }
+
+            foreach (get_object_vars($scopeData) as $field => $fieldData) {
+                $attributeList = $this->getFieldManager()->getAttributeList($scope, $field);
+
+                foreach ($this->fieldActionList as $action) {
+                    if (!isset($fieldData->$action)) continue;
+                    foreach ($this->fieldLevelList as $level) {
+                        if ($fieldData->$action === $level) {
+                            $fieldTableQuickAccess->$scope->fields->$action->{$level}[] = $field;
+                            foreach ($attributeList as $attribute) {
+                                $fieldTableQuickAccess->$scope->attributes->$action->{$level}[] = $attribute;
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        $this->data->fieldTableQuickAccess = $fieldTableQuickAccess;
+    }
+
+    protected function applyDefault(&$table, &$fieldTable)
+    {
+        if ($this->user->isAdmin()) {
+            return;
+        }
+
+        $data = $this->metadata->get('app.'.$this->type.'.default.scopeLevel', array());
+
+        foreach ($data as $scope => $item) {
+            if (isset($table->$scope)) continue;
+            $value = $item;
+            if (is_array($item)) {
+                $value = (object) $item;
+            }
+            $table->$scope = $value;
+        }
+
+        $defaultFieldData = $this->metadata->get('app.'.$this->type.'.default.fieldLevel', array());
+
+        foreach ($this->getScopeList() as $scope) {
+            if (isset($table->$scope) && $table->$scope === false) continue;
+            if (!$this->getMetadata()->get('scopes.' . $scope . '.entity')) continue;
+
+            $fieldList = array_keys($this->getMetadata()->get("entityDefs.{$scope}.fields", []));
+
+            $defaultScopeFieldData = $this->metadata->get('app.'.$this->type.'.default.scopeFieldLevel.' . $scope, array());
+
+            foreach (array_merge($defaultFieldData, $defaultScopeFieldData) as $field => $f) {
+                if (!in_array($field, $fieldList)) continue;
+                if (!isset($fieldTable->$scope)) {
+                    $fieldTable->$scope = (object) [];
+                }
+                if (isset($fieldTable->$scope->$field)) continue;
+                $fieldTable->$scope->$field = (object) [];
+                foreach ($this->fieldActionList as $action) {
+                    $level = 'no';
+                    if ($f === true) {
+                        $level = 'yes';
+                    } else {
+                        if (is_array($f) && isset($f[$action])) {
+                            $level = $f[$action];
+                        }
+                    }
+                    $fieldTable->$scope->$field->$action = $level;
+                }
+            }
+        }
+
+        foreach ($this->getScopeWithAclList() as $scope) {
+            if (!isset($table->$scope)) {
+                $aclType = $this->metadata->get('scopes.' . $scope . '.' . $this->type);
+                if ($aclType === true) {
+                    $aclType = $this->defaultAclType;
+                }
+                if (!empty($aclType)) {
+                    $defaultValue = $this->metadata->get('app.'.$this->type.'.scopeLevelTypesDefaults.' . $aclType, $this->metadata->get('app.'.$this->type.'.scopeLevelTypesDefaults.record'));
+                    if (is_array($defaultValue)) {
+                        $defaultValue = (object) $defaultValue;
+                    }
+                    $table->$scope = $defaultValue;
+                }
+            }
+        }
+    }
+
+    protected function applyMandatory(&$table, &$fieldTable)
+    {
+        if ($this->user->isAdmin()) {
+            return;
+        }
+
+        $data = $this->metadata->get('app.'.$this->type.'.mandatory.scopeLevel', array());
+
+        foreach ($data as $scope => $item) {
+            $value = $item;
+            if (is_array($item)) {
+                $value = (object) $item;
+            }
+            $table->$scope = $value;
+        }
+
+        $mandatoryFieldData = $this->metadata->get('app.'.$this->type.'.mandatory.fieldLevel', array());
+
+        foreach ($this->getScopeList() as $scope) {
+            if (isset($table->$scope) && $table->$scope === false) continue;
+            if (!$this->getMetadata()->get('scopes.' . $scope . '.entity')) continue;
+
+            $fieldList = array_keys($this->getMetadata()->get("entityDefs.{$scope}.fields", []));
+
+            $mandatoryScopeFieldData = $this->metadata->get('app.'.$this->type.'.mandatory.scopeFieldLevel.' . $scope, array());
+
+            foreach (array_merge($mandatoryFieldData, $mandatoryScopeFieldData) as $field => $f) {
+                if (!in_array($field, $fieldList)) continue;
+                if (!isset($fieldTable->$scope)) {
+                    $fieldTable->$scope = (object) [];
+                }
+                $fieldTable->$scope->$field = (object) [];
+                foreach ($this->fieldActionList as $action) {
+                    $level = 'no';
+                    if ($f === true) {
+                        $level = 'yes';
+                    } else {
+                        if (is_array($f) && isset($f[$action])) {
+                            $level = $f[$action];
+                        }
+                    }
+                    $fieldTable->$scope->$field->$action = $level;
+                }
+            }
+        }
+    }
+
+    protected function applyDisabled(&$table, &$fieldTable)
+    {
+        if ($this->user->isAdmin()) {
+            return;
+        }
+
+        foreach ($this->getScopeList() as $scope) {
+            if ($this->getMetadata()->get('scopes.' . $scope . '.disabled')) {
+                $table->$scope = false;
+                unset($fieldTable->$scope);
+            }
+        }
+    }
+
+    private function mergeValueList(array $list, $defaultValue)
+    {
+        $result = null;
+        foreach ($list as $level) {
+            if ($level != 'not-set') {
+                if (is_null($result)) {
+                    $result = $level;
+                    continue;
+                }
+                if (array_search($result, $this->levelList) > array_search($level, $this->levelList)) {
+                    $result = $level;
+                }
+            }
+        }
+        if (is_null($result)) {
+            $result = $defaultValue;
+        }
+        return $result;
+    }
+
+    protected function getScopeWithAclList()
+    {
+        $scopeList = [];
+        $scopes = $this->metadata->get('scopes');
+        foreach ($scopes as $scope => $d) {
+        	if (empty($d['acl'])) continue;
+        	$scopeList[] = $scope;
+        }
+        return $scopeList;
+    }
+
+    protected function getScopeList()
+    {
+        $scopeList = [];
+        $scopes = $this->metadata->get('scopes');
+        foreach ($scopes as $scope => $d) {
+            $scopeList[] = $scope;
+        }
+        return $scopeList;
+    }
+
+    private function mergeTableList(array $tableList)
+    {
+        $data = (object) [];
+        $scopeList = $this->getScopeWithAclList();
+
+        foreach ($tableList as $table) {
+            foreach ($scopeList as $scope) {
+            	if (!isset($table->$scope)) continue;
+
+            	$row = $table->$scope;
+
+                if ($row == false) {
+                    if (!isset($data->$scope)) {
+                        $data->$scope = false;
+                    }
+                } else if ($row === true) {
+                    $data->$scope = true;
+                } else {
+                    if (!isset($data->$scope)) {
+                        $data->$scope = (object) [];
+                    }
+                    if ($data->$scope === false) {
+                        $data->$scope = (object) [];
+                    }
+
+                    if (!is_object($row)) continue;
+
+                    foreach ($this->actionList as $i => $action) {
+                        if (isset($row->$action)) {
+                            $level = $row->$action;
+                            if (!isset($data->$scope->$action)) {
+                                $data->$scope->$action = $level;
+                            } else {
+                                if (array_search($data->$scope->$action, $this->levelList) > array_search($level, $this->levelList)) {
+                                    $data->$scope->$action = $level;
+                                }
+                            }
+                        } else {
+                            if ($i > 0) {
+                                // TODO remove it
+                                $previousAction = $this->actionList[$i - 1];
+                                if (in_array($action, $this->booleanActionList)) {
+                                    $data->$scope->$action = 'yes';
+                                } else {
+                                    if (isset($data->$scope->$previousAction)) {
+                                        $data->$scope->$action = $data->$scope->$previousAction;
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        return $data;
+    }
+
+    private function mergeFieldTableList(array $tableList)
+    {
+        $data = (object) [];
+        $scopeList = $this->getScopeWithAclList();
+
+        foreach ($tableList as $table) {
+            foreach ($scopeList as $scope) {
+                if (!isset($table->$scope)) continue;
+
+                if (!isset($data->$scope)) {
+                    $data->$scope = (object) [];
+                }
+
+                if (!is_object($table->$scope)) continue;
+
+                $fieldList = array_keys($this->getMetadata()->get("entityDefs.{$scope}.fields", []));
+
+                foreach (get_object_vars($table->$scope) as $field => $row) {
+                    if (!is_object($row)) continue;
+
+                    if (!in_array($field, $fieldList)) continue;
+
+                    if (!isset($data->$scope->$field)) {
+                        $data->$scope->$field = (object) [];
+                    }
+
+                    foreach ($this->fieldActionList as $i => $action) {
+                        if (!isset($row->$action)) continue;
+
+                        $level = $row->$action;
+                        if (!isset($data->$scope->$field->$action)) {
+                            $data->$scope->$field->$action = $level;
+                        } else {
+                            if (array_search($data->$scope->$field->$action, $this->fieldLevelList) > array_search($level, $this->fieldLevelList)) {
+                                $data->$scope->$field->$action = $level;
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        return $data;
+    }
+
+    private function buildCache()
+    {
+        $contents = '<' . '?'. 'php return ' .  $this->varExport($this->data)  . ';';
+        $this->fileManager->putContents($this->cacheFilePath, $contents);
+    }
+
+    private function varExport($variable)
+    {
+        if ($variable instanceof \StdClass) {
+            $result = '(object) ' . $this->varExport(get_object_vars($variable), true);
+        } else if (is_array($variable)) {
+            $array = array();
+            foreach ($variable as $key => $value) {
+                $array[] = var_export($key, true).' => ' . $this->varExport($value, true);
+            }
+            $result = '['.implode(', ', $array).']';
+        } else {
+            $result = var_export($variable, true);
+        }
+
+        return $result;
+    }
+}
+

application/Espo/Core/AclManager.php

@@ -0,0 +1,236 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core;
+
+use \Espo\Core\Exceptions\Error;
+
+use \Espo\ORM\Entity;
+use \Espo\Entities\User;
+use \Espo\Core\Utils\Util;
+
+class AclManager
+{
+    private $container;
+
+    private $metadata;
+
+    private $implementationHashMap = array();
+
+    private $tableHashMap = array();
+
+    protected $tableClassName = '\\Espo\\Core\\Acl\\Table';
+
+    public function __construct(Container $container)
+    {
+        $this->container = $container;
+        $this->metadata = $container->get('metadata');
+    }
+
+    protected function getContainer()
+    {
+        return $this->container;
+    }
+
+    protected function getMetadata()
+    {
+        return $this->metadata;
+    }
+
+    public function getImplementation($scope)
+    {
+        if (empty($this->implementationHashMap[$scope])) {
+            $normalizedName = Util::normilizeClassName($scope);
+
+            $className = '\\Espo\\Custom\\Acl\\' . $normalizedName;
+            if (!class_exists($className)) {
+                $moduleName = $this->metadata->getScopeModuleName($scope);
+                if ($moduleName) {
+                    $className = '\\Espo\\Modules\\' . $moduleName . '\\Acl\\' . $normalizedName;
+                } else {
+                    $className = '\\Espo\\Acl\\' . $normalizedName;
+                }
+                if (!class_exists($className)) {
+                    $className = '\\Espo\\Core\\Acl\\Base';
+                }
+            }
+
+            if (class_exists($className)) {
+                $acl = new $className($scope);
+                $dependencies = $acl->getDependencyList();
+                foreach ($dependencies as $name) {
+                    $acl->inject($name, $this->getContainer()->get($name));
+                }
+                $this->implementationHashMap[$scope] = $acl;
+            } else {
+                throw new Error();
+            }
+        }
+
+        return $this->implementationHashMap[$scope];
+    }
+
+    protected function getTable(User $user)
+    {
+        $key = spl_object_hash($user);
+
+        if (empty($this->tableHashMap[$key])) {
+            $config = $this->getContainer()->get('config');
+            $fileManager = $this->getContainer()->get('fileManager');
+            $metadata = $this->getContainer()->get('metadata');
+            $fieldManager = $this->getContainer()->get('fieldManager');
+
+            $this->tableHashMap[$key] = new $this->tableClassName($user, $config, $fileManager, $metadata, $fieldManager);
+        }
+
+        return $this->tableHashMap[$key];
+    }
+
+    public function getMap(User $user)
+    {
+        return $this->getTable($user)->getMap();
+    }
+
+    public function getLevel(User $user, $scope, $action)
+    {
+        if ($user->isAdmin()) {
+            return 'all';
+        }
+        return $this->getTable($user)->getLevel($scope, $action);
+    }
+
+    public function get(User $user, $permission)
+    {
+        return $this->getTable($user)->get($permission);
+    }
+
+    public function checkReadOnlyTeam(User $user, $scope)
+    {
+        if ($user->isAdmin()) {
+            return false;
+        }
+        $data = $this->getTable($user)->getScopeData($scope);
+        return $this->getImplementation($scope)->checkReadOnlyTeam($user, $data);
+    }
+
+    public function checkReadOnlyOwn(User $user, $scope)
+    {
+        if ($user->isAdmin()) {
+            return false;
+        }
+        $data = $this->getTable($user)->getScopeData($scope);
+        return $this->getImplementation($scope)->checkReadOnlyOwn($user, $data);
+    }
+
+    public function check(User $user, $subject, $action = null)
+    {
+        if (is_string($subject)) {
+            return $this->checkScope($user, $subject, $action);
+        } else {
+            $entity = $subject;
+            if ($entity instanceof Entity) {
+                return $this->checkEntity($user, $entity, $action);
+            }
+        }
+    }
+
+    public function checkEntity(User $user, Entity $entity, $action = 'read')
+    {
+        $scope = $entity->getEntityType();
+
+        $data = $this->getTable($user)->getScopeData($scope);
+
+        $impl = $this->getImplementation($scope);
+
+        $methodName = 'checkEntity' . ucfirst($action);
+        if (method_exists($impl, $methodName)) {
+            return $impl->$methodName($user, $entity, $data);
+        }
+
+        return $impl->checkEntity($user, $entity, $data, $action);
+    }
+
+    public function checkIsOwner(User $user, Entity $entity)
+    {
+        return $this->getImplementation($entity->getEntityType())->checkIsOwner($user, $entity);
+    }
+
+    public function checkInTeam(User $user, Entity $entity, $action)
+    {
+        return $this->getImplementation($entity->getEntityType())->checkInTeam($user, $entity);
+    }
+
+    public function checkScope(User $user, $scope, $action = null)
+    {
+        $data = $this->getTable($user)->getScopeData($scope);
+        return $this->getImplementation($scope)->checkScope($user, $data, $action);
+    }
+
+    public function checkUser(User $user, $permission, User $entity)
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+        if ($this->get($user, $permission) === 'no') {
+            if ($entity->id !== $user->id) {
+                return false;
+            }
+        } else if ($this->get($user, $permission) === 'team') {
+            if ($entity->id != $user->id) {
+                $teamIdList1 = $user->getTeamIdList();
+                $teamIdList2 = $entity->getTeamIdList();
+
+                $inTeam = false;
+                foreach ($teamIdList1 as $id) {
+                    if (in_array($id, $teamIdList2)) {
+                        $inTeam = true;
+                        break;
+                    }
+                }
+                if (!$inTeam) {
+                    return false;
+                }
+            }
+        }
+        return true;
+    }
+
+    public function getScopeForbiddenAttributeList(User $user, $scope, $action = 'read', $thresholdLevel = 'no')
+    {
+        if ($user->isAdmin()) return [];
+        return $this->getTable($user)->getScopeForbiddenAttributeList($scope, $action, $thresholdLevel);
+    }
+
+    public function getScopeForbiddenFieldList(User $user, $scope, $action = 'read', $thresholdLevel = 'no')
+    {
+        if ($user->isAdmin()) return [];
+        return $this->getTable($user)->getScopeForbiddenFieldList($scope, $action, $thresholdLevel);
+    }
+}
+

application/Espo/Core/AclPortal/Base.php

@@ -0,0 +1,212 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\AclPortal;
+
+use \Espo\Entities\User;
+use \Espo\ORM\Entity;
+
+class Base extends \Espo\Core\Acl\Base
+{
+    public function checkScope(User $user, $data, $action = null, Entity $entity = null, $entityAccessData = array())
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if (is_null($data)) {
+            return false;
+        }
+        if ($data === false) {
+            return false;
+        }
+        if ($data === true) {
+            return true;
+        }
+        if (is_string($data)) {
+            return true;
+        }
+
+        $isOwner = null;
+        if (isset($entityAccessData['isOwner'])) {
+            $isOwner = $entityAccessData['isOwner'];
+        }
+        $inAccount = null;
+        if (isset($entityAccessData['inAccount'])) {
+            $inAccount = $entityAccessData['inAccount'];
+        }
+        $isOwnContact = null;
+        if (isset($entityAccessData['isOwnContact'])) {
+            $isOwnContact = $entityAccessData['isOwnContact'];
+        }
+
+        if (is_null($action)) {
+            return true;
+        }
+
+        if (!isset($data->$action)) {
+            return true;
+        }
+
+        $value = $data->$action;
+
+        if ($value === 'all' || $value === 'yes' || $value === true) {
+            return true;
+        }
+
+        if (!$value || $value === 'no') {
+            return false;
+        }
+
+        if (is_null($isOwner)) {
+            if ($entity) {
+                $isOwner = $this->checkIsOwner($user, $entity);
+            } else {
+                return true;
+            }
+        }
+
+        if ($isOwner) {
+            if ($value === 'own' || $value === 'account' || $value === 'contact') {
+                return true;
+            }
+        }
+
+        if ($value === 'account') {
+            if (is_null($inAccount) && $entity) {
+                $inAccount = $this->checkInAccount($user, $entity);
+            }
+            if ($inAccount) {
+                return true;
+            }
+        }
+
+        if ($value === 'contact') {
+            if (is_null($isOwnContact) && $entity) {
+                $isOwnContact = $this->checkIsOwnContact($user, $entity);
+            }
+            if ($isOwnContact) {
+                return true;
+            }
+        }
+
+        return false;
+
+    }
+
+    public function checkReadOnlyAccount(User $user, $data)
+    {
+        if (empty($data) || !is_object($data) || !isset($data->read)) {
+            return false;
+        }
+        return $data->read === 'account';
+    }
+
+    public function checkReadOnlyContact(User $user, $data)
+    {
+        if (empty($data) || !is_object($data) || !isset($data->read)) {
+            return false;
+        }
+        return $data->read === 'contact';
+    }
+
+    public function checkIsOwner(User $user, Entity $entity)
+    {
+        if ($entity->hasAttribute('createdById')) {
+            if ($entity->has('createdById')) {
+                if ($user->id === $entity->get('createdById')) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
+    public function checkInAccount(User $user, Entity $entity)
+    {
+        $accountIdList = $user->getLinkMultipleIdList('accounts');
+        if (count($accountIdList)) {
+            if ($entity->hasAttribute('accountId')) {
+                if (in_array($entity->get('accountId'), $accountIdList)) {
+                    return true;
+                }
+            }
+
+            if ($entity->hasRelation('accounts')) {
+                $repository = $this->getEntityManager()->getRepository($entity->getEntityType());
+                foreach ($accountIdList as $accountId) {
+                    if ($repository->isRelated($entity, 'accounts', $accountId)) {
+                        return true;
+                    }
+                }
+            }
+
+            if ($entity->hasAttribute('parentId') && $entity->hasRelation('parent')) {
+                if ($entity->get('parentType') === 'Account') {
+                    if (in_array($entity->get('parentId'), $accountIdList)) {
+                        return true;
+                    }
+                }
+            }
+        }
+
+        return false;
+    }
+
+    public function checkIsOwnContact(User $user, Entity $entity)
+    {
+        $contactId = $user->get('contactId');
+        if ($contactId) {
+            if ($entity->hasAttribute('contactId')) {
+                if ($entity->get('contactId') === $contactId) {
+                    return true;
+                }
+            }
+
+            if ($entity->hasRelation('contacts')) {
+                $repository = $this->getEntityManager()->getRepository($entity->getEntityType());
+                if ($repository->isRelated($entity, 'contacts', $contactId)) {
+                    return true;
+                }
+            }
+
+            if ($entity->hasAttribute('parentId') && $entity->hasRelation('parent')) {
+                if ($entity->get('parentType') === 'Contact') {
+                    if ($entity->get('parentId') === $contactId) {
+                        return true;
+                    }
+                }
+            }
+        }
+
+        return false;
+    }
+
+}
+

application/Espo/Core/AclPortal/Table.php

@@ -0,0 +1,125 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\AclPortal;
+
+use \Espo\Core\Exceptions\Error;
+
+use \Espo\ORM\Entity;
+use \Espo\Entities\User;
+use \Espo\Entities\Portal;
+
+use \Espo\Core\Utils\Config;
+use \Espo\Core\Utils\Metadata;
+use \Espo\Core\Utils\FieldManager;
+use \Espo\Core\Utils\File\Manager as FileManager;
+
+class Table extends \Espo\Core\Acl\Table
+{
+    protected $type = 'aclPortal';
+
+    protected $portal;
+
+    protected $defaultAclType = 'recordAllOwnNo';
+
+    protected $levelList = ['yes', 'all', 'account', 'contact', 'own', 'no'];
+
+    protected $valuePermissionList = [];
+
+    public function __construct(User $user, Portal $portal, Config $config = null, FileManager $fileManager = null, Metadata $metadata = null, FieldManager $fieldManager = null)
+    {
+        if (empty($portal)) {
+            throw new Error("No portal was passed to AclPortal\\Table constructor.");
+        }
+        $this->portal = $portal;
+        parent::__construct($user, $config, $fileManager, $metadata, $fieldManager);
+    }
+
+    protected function getPortal()
+    {
+        return $this->portal;
+    }
+
+    protected function initCacheFilePath()
+    {
+        $this->cacheFilePath = 'data/cache/application/acl-portal/'.$this->getPortal()->id.'/' . $this->getUser()->id . '.php';
+    }
+
+    protected function getRoleList()
+    {
+        $roleList = [];
+
+        $userRoleList = $this->getUser()->get('portalRoles');
+        foreach ($userRoleList as $role) {
+            $roleList[] = $role;
+        }
+
+        $portalRoleList = $this->getPortal()->get('portalRoles');
+        foreach ($portalRoleList as $role) {
+            $roleList[] = $role;
+        }
+
+        return $roleList;
+    }
+
+    protected function getScopeWithAclList()
+    {
+        $scopeList = [];
+        $scopes = $this->getMetadata()->get('scopes');
+        foreach ($scopes as $scope => $d) {
+            if (empty($d['acl'])) continue;
+            if (empty($d['aclPortal'])) continue;
+            $scopeList[] = $scope;
+        }
+        return $scopeList;
+    }
+
+    protected function applyDefault(&$table, &$fieldTable)
+    {
+        parent::applyDefault($table, $fieldTable);
+
+        foreach ($this->getScopeList() as $scope) {
+            if (!isset($table->$scope)) {
+                $table->$scope = false;
+            }
+        }
+    }
+
+    protected function applyDisabled(&$table, &$fieldTable)
+    {
+        foreach ($this->getScopeList() as $scope) {
+            $d = $this->getMetadata()->get('scopes.' . $scope);
+            if ($d['disabled'] || $d['portalDisabled']) {
+                $table->$scope = false;
+                unset($fieldTable->$scope);
+            }
+        }
+    }
+}
+

application/Espo/Core/Application.php

@@ -18,35 +18,43 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core;
 
-
 class Application
 {
     private $metadata;
 
-    private $container;
+    protected $container;
 
     private $slim;
 
     private $auth;
 
-    /**
-     * Constructor
-     */
     public function __construct()
     {
-        $this->container = new Container();
-
         date_default_timezone_set('UTC');
 
-        $GLOBALS['log'] = $this->container->get('log');
+        $this->initContainer();
+
+        $GLOBALS['log'] = $this->getContainer()->get('log');
 
         $this->initAutoloads();
     }
 
+    protected function initContainer()
+    {
+        $this->container = new Container();
+    }
+
     public function getSlim()
     {
         if (empty($this->slim)) {
@@ -63,12 +71,9 @@ class Application
         return $this->metadata;
     }
 
-    protected function getAuth()
+    protected function createAuth()
     {
-        if (empty($this->auth)) {
-            $this->auth = new \Espo\Core\Utils\Auth($this->container);
-        }
-        return $this->auth;
+        return new \Espo\Core\Utils\Auth($this->container);
     }
 
     public function getContainer()
@@ -85,17 +90,10 @@ class Application
 
     public function runClient()
     {
-        $config = $this->getContainer()->get('config');
-
-        $html = file_get_contents('main.html');
-        $html = str_replace('{{cacheTimestamp}}', $config->get('cacheTimestamp', 0), $html);
-        $html = str_replace('{{useCache}}', $config->get('useCache') ? 'true' : 'false' , $html);
-        $html = str_replace('{{runScript}}', 'app.start();' , $html);
-        echo $html;
-        exit;
+        $this->getContainer()->get('clientManager')->display();
     }
 
-    public function runEntryPoint($entryPoint)
+    public function runEntryPoint($entryPoint, $data = array(), $final = false)
     {
         if (empty($entryPoint)) {
             throw new \Error();
@@ -104,28 +102,38 @@ class Application
         $slim = $this->getSlim();
         $container = $this->getContainer();
 
-        $slim->get('/', function() {});
+        $slim->any('.*', function() {});
 
         $entryPointManager = new \Espo\Core\EntryPointManager($container);
 
-        $auth = $this->getAuth();
-        $apiAuth = new \Espo\Core\Utils\Api\Auth($auth, $entryPointManager->checkAuthRequired($entryPoint), true);
-        $slim->add($apiAuth);
-
-        $slim->hook('slim.before.dispatch', function () use ($entryPoint, $entryPointManager, $container) {
-            try {
-                $entryPointManager->run($entryPoint);
-            } catch (\Exception $e) {
-                $container->get('output')->processError($e->getMessage(), $e->getCode(), true);
+        try {
+            $authRequired = $entryPointManager->checkAuthRequired($entryPoint);
+            $authNotStrict = $entryPointManager->checkNotStrictAuth($entryPoint);
+            if ($authRequired && !$authNotStrict) {
+                if (!$final && $portalId = $this->detectedPortalId()) {
+                    $app = new \Espo\Core\Portal\Application($portalId);
+                    $app->setBasePath($this->getBasePath());
+                    $app->runEntryPoint($entryPoint, $data, true);
+                    exit;
+                }
             }
-        });
+            $auth = new \Espo\Core\Utils\Auth($this->container, $authNotStrict);
+            $apiAuth = new \Espo\Core\Utils\Api\Auth($auth, $authRequired, true);
+            $slim->add($apiAuth);
 
-        $slim->run();
+            $slim->hook('slim.before.dispatch', function () use ($entryPoint, $entryPointManager, $container, $data) {
+                $entryPointManager->run($entryPoint, $data);
+            });
+
+            $slim->run();
+        } catch (\Exception $e) {
+            $container->get('output')->processError($e->getMessage(), $e->getCode(), true);
+        }
     }
 
     public function runCron()
     {
-        $auth = $this->getAuth();
+        $auth = $this->createAuth();
         $auth->useNoAuth(true);
 
         $cronManager = new \Espo\Core\CronManager($this->container);
@@ -138,6 +146,12 @@ class Application
         $dataManager->rebuild();
     }
 
+    public function runClearCache()
+    {
+        $dataManager = $this->getContainer()->get('dataManager');
+        $dataManager->clearCache();
+    }
+
     public function isInstalled()
     {
         $config = $this->getContainer()->get('config');
@@ -149,20 +163,25 @@ class Application
         return false;
     }
 
+    protected function createApiAuth($auth)
+    {
+        return new \Espo\Core\Utils\Api\Auth($auth);
+    }
+
     protected function routeHooks()
     {
         $container = $this->getContainer();
         $slim = $this->getSlim();
 
         try {
-            $auth = $this->getAuth();
+            $auth = $this->createAuth();
         } catch (\Exception $e) {
             $container->get('output')->processError($e->getMessage(), $e->getCode());
         }
 
-        $apiAuth = new \Espo\Core\Utils\Api\Auth($auth);
-        $this->getSlim()->add($apiAuth);
+        $apiAuth = $this->createApiAuth($auth);
 
+        $this->getSlim()->add($apiAuth);
         $this->getSlim()->hook('slim.before.dispatch', function () use ($slim, $container) {
 
             $route = $slim->router()->getCurrentRoute();
@@ -222,13 +241,19 @@ class Application
         });
     }
 
-    protected function initRoutes()
+    protected function getRouteList()
     {
         $routes = new \Espo\Core\Utils\Route($this->getContainer()->get('config'), $this->getMetadata(), $this->getContainer()->get('fileManager'));
-        $crudList = array_keys( $this->getContainer()->get('config')->get('crud') );
 
-        foreach ($routes->getAll() as $route) {
 
+        return $routes->getAll();
+    }
+
+    protected function initRoutes()
+    {
+        $crudList = array_keys($this->getContainer()->get('config')->get('crud'));
+
+        foreach ($this->getRouteList() as $route) {
             $method = strtolower($route['method']);
             if (!in_array($method, $crudList)) {
                 $GLOBALS['log']->error('Route: Method ['.$method.'] does not exist. Please check your route ['.$route['route'].']');
@@ -273,5 +298,30 @@ class Application
 
         $classLoader->register(true);
     }
+
+    public function setBasePath($basePath)
+    {
+        $this->getContainer()->get('clientManager')->setBasePath($basePath);
+    }
+
+    public function getBasePath()
+    {
+        return $this->getContainer()->get('clientManager')->getBasePath();
+    }
+
+    public function detectedPortalId()
+    {
+        if (!empty($_GET['portalId'])) {
+            return $_GET['portalId'];
+        }
+        if (!empty($_COOKIE['auth-token'])) {
+            $token = $this->getContainer()->get('entityManager')->getRepository('AuthToken')->where(array('token'=>$_COOKIE['auth-token']))->findOne();
+
+            if ($token && $token->get('portalId')) {
+                return $token->get('portalId');
+            }
+        }
+        return null;
+    }
 }
 

application/Espo/Core/Container.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core;
@@ -33,7 +40,6 @@ class Container
      */
     public function __construct()
     {
-
     }
 
     public function get($name)
@@ -41,7 +47,15 @@ class Container
         if (empty($this->data[$name])) {
             $this->load($name);
         }
-        return $this->data[$name];
+        if (isset($this->data[$name])) {
+            return $this->data[$name];
+        }
+        return null;
+    }
+
+    protected function set($name, $obj)
+    {
+        $this->data[$name] = $obj;
     }
 
     private function load($name)
@@ -81,16 +95,19 @@ class Container
 
     protected function loadLog()
     {
-        $logConfig = $this->get('config')->get('logger');
+        $config = $this->get('config');
+
+        $path = $config->get('logger.path', 'data/logs/espo.log');
+        $rotation = $config->get('logger.rotation', true);
 
         $log = new \Espo\Core\Utils\Log('Espo');
+        $levelCode = $log->getLevelCode($config->get('logger.level', 'WARNING'));
 
-        $levelCode = $log->getLevelCode($logConfig['level']);
-
-        if ($logConfig['isRotate']) {
-            $handler = new \Espo\Core\Utils\Log\Monolog\Handler\RotatingFileHandler($logConfig['path'], $logConfig['maxRotateFiles'], $levelCode);
+        if ($rotation) {
+            $maxFileNumber = $config->get('logger.maxFileNumber', 30);
+            $handler = new \Espo\Core\Utils\Log\Monolog\Handler\RotatingFileHandler($path, $maxFileNumber, $levelCode);
         } else {
-            $handler = new \Espo\Core\Utils\Log\Monolog\Handler\StreamHandler($logConfig['path'], $levelCode);
+            $handler = new \Espo\Core\Utils\Log\Monolog\Handler\StreamHandler($path, $levelCode);
         }
         $log->pushHandler($handler);
 
@@ -106,53 +123,54 @@ class Container
         return $this;
     }
 
-    private function loadSlim()
+    protected function loadSlim()
     {
         return new \Espo\Core\Utils\Api\Slim();
     }
 
-    private function loadFileManager()
+    protected function loadFileManager()
     {
         return new \Espo\Core\Utils\File\Manager(
             $this->get('config')
         );
     }
 
-    private function loadPreferences()
+    protected function loadPreferences()
     {
         return $this->get('entityManager')->getEntity('Preferences', $this->get('user')->id);
     }
 
-    private function loadConfig()
+    protected function loadConfig()
     {
         return new \Espo\Core\Utils\Config(
             new \Espo\Core\Utils\File\Manager()
         );
     }
 
-    private function loadHookManager()
+    protected function loadHookManager()
     {
         return new \Espo\Core\HookManager(
             $this
         );
     }
 
-    private function loadOutput()
+    protected function loadOutput()
     {
         return new \Espo\Core\Utils\Api\Output(
             $this->get('slim')
         );
     }
 
-    private function loadMailSender()
+    protected function loadMailSender()
     {
         $className = $this->getServiceClassName('mailSernder', '\\Espo\\Core\\Mail\\Sender');
         return new $className(
-            $this->get('config')
+            $this->get('config'),
+            $this->get('entityManager')
         );
     }
 
-    private function loadDateTime()
+    protected function loadDateTime()
     {
         return new \Espo\Core\Utils\DateTime(
             $this->get('config')->get('dateFormat'),
@@ -161,14 +179,22 @@ class Container
         );
     }
 
-    private function loadServiceFactory()
+    protected function loadNumber()
+    {
+        return new \Espo\Core\Utils\Number(
+            $this->get('config')->get('decimalMark'),
+            $this->get('config')->get('thousandSeparator')
+        );
+    }
+
+    protected function loadServiceFactory()
     {
         return new \Espo\Core\ServiceFactory(
             $this
         );
     }
 
-    private function loadSelectManagerFactory()
+    protected function loadSelectManagerFactory()
     {
         return new \Espo\Core\SelectManagerFactory(
             $this->get('entityManager'),
@@ -178,7 +204,7 @@ class Container
         );
     }
 
-    private function loadMetadata()
+    protected function loadMetadata()
     {
         return new \Espo\Core\Utils\Metadata(
             $this->get('config'),
@@ -186,26 +212,33 @@ class Container
         );
     }
 
-    private function loadLayout()
+    protected function loadLayout()
     {
         return new \Espo\Core\Utils\Layout(
             $this->get('fileManager'),
-            $this->get('metadata')
+            $this->get('metadata'),
+            $this->get('user')
         );
     }
 
-    private function loadAcl()
+    protected function loadAclManager()
+    {
+        $className = $this->getServiceClassName('acl', '\\Espo\\Core\\AclManager');
+        return new $className(
+            $this->get('container')
+        );
+    }
+
+    protected function loadAcl()
     {
         $className = $this->getServiceClassName('acl', '\\Espo\\Core\\Acl');
         return new $className(
-            $this->get('user'),
-            $this->get('config'),
-            $this->get('fileManager'),
-            $this->get('metadata')
+            $this->get('aclManager'),
+            $this->get('user')
         );
     }
 
-    private function loadSchema()
+    protected function loadSchema()
     {
         return new \Espo\Core\Utils\Database\Schema\Schema(
             $this->get('config'),
@@ -216,7 +249,7 @@ class Container
         );
     }
 
-    private function loadClassParser()
+    protected function loadClassParser()
     {
         return new \Espo\Core\Utils\File\ClassParser(
             $this->get('fileManager'),
@@ -225,37 +258,38 @@ class Container
         );
     }
 
-    private function loadLanguage()
+    protected function loadLanguage()
     {
         return new \Espo\Core\Utils\Language(
             $this->get('fileManager'),
             $this->get('config'),
+            $this->get('metadata'),
             $this->get('preferences')
         );
     }
 
-    private function loadCrypt()
+    protected function loadCrypt()
     {
         return new \Espo\Core\Utils\Crypt(
             $this->get('config')
         );
     }
 
-    private function loadScheduledJob()
+    protected function loadScheduledJob()
     {
         return new \Espo\Core\Utils\ScheduledJob(
             $this
         );
     }
 
-    private function loadDataManager()
+    protected function loadDataManager()
     {
         return new \Espo\Core\DataManager(
             $this
         );
     }
 
-    private function loadFieldManager()
+    protected function loadFieldManager()
     {
         return new \Espo\Core\Utils\FieldManager(
             $this->get('metadata'),
@@ -263,9 +297,25 @@ class Container
         );
     }
 
-    public function setUser($user)
+    protected function loadThemeManager()
     {
-        $this->data['user'] = $user;
+        return new \Espo\Core\Utils\ThemeManager(
+            $this->get('config'),
+            $this->get('metadata')
+        );
+    }
+
+    protected function loadClientManager()
+    {
+        return new \Espo\Core\Utils\ClientManager(
+            $this->get('config'),
+            $this->get('themeManager')
+        );
+    }
+
+    public function setUser(\Espo\Entities\User $user)
+    {
+        $this->set('user', $user);
     }
 }
 

application/Espo/Core/ControllerManager.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core;
@@ -87,23 +94,32 @@ class ControllerManager
         $actionNameUcfirst = ucfirst($actionName);
 
         $beforeMethodName = 'before' . $actionNameUcfirst;
+        $actionMethodName = 'action' . $actionNameUcfirst;
+        $afterMethodName = 'after' . $actionNameUcfirst;
+
+        $fullActionMethodName = strtolower($request->getMethod()) . ucfirst($actionMethodName);
+
+        if (method_exists($controller, $fullActionMethodName)) {
+            $primaryActionMethodName = $fullActionMethodName;
+        } else {
+            $primaryActionMethodName = $actionMethodName;
+        }
+
+        if (!method_exists($controller, $primaryActionMethodName)) {
+            throw new NotFound("Action '$actionName' (".$request->getMethod().") does not exist in controller '$controllerName'");
+        }
+
         if (method_exists($controller, $beforeMethodName)) {
             $controller->$beforeMethodName($params, $data, $request);
         }
-        $actionMethodName = 'action' . $actionNameUcfirst;
 
-        if (!method_exists($controller, $actionMethodName)) {
-            throw new NotFound("Action '$actionMethodName' does not exist in controller '$controller'");
-        }
+        $result = $controller->$primaryActionMethodName($params, $data, $request);
 
-        $result = $controller->$actionMethodName($params, $data, $request);
-
-        $afterMethodName = 'after' . $actionNameUcfirst;
         if (method_exists($controller, $afterMethodName)) {
             $controller->$afterMethodName($params, $data, $request);
         }
 
-        if (is_array($result) || is_bool($result)) {
+        if (is_array($result) || is_bool($result) || $result instanceof \StdClass) {
             return \Espo\Core\Utils\Json::encode($result);
         }
 

application/Espo/Core/Controllers/Base.php

@@ -18,10 +18,16 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\Controllers;
-
 use \Espo\Core\Container;
 use \Espo\Core\ServiceFactory;
 use \Espo\Core\Utils\Util;
@@ -90,6 +96,11 @@ abstract class Base
         return $this->container->get('acl');
     }
 
+    protected function getAclManager()
+    {
+        return $this->container->get('aclManager');
+    }
+
     protected function getConfig()
     {
         return $this->container->get('config');

application/Espo/Core/Controllers/Record.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\Controllers;
@@ -34,6 +41,8 @@ class Record extends Base
 
     public static $defaultAction = 'list';
 
+    protected $defaultRecordServiceName = 'Record';
+
     protected function getEntityManager()
     {
         return $this->getContainer()->get('entityManager');
@@ -48,8 +57,8 @@ class Record extends Base
         if ($this->getServiceFactory()->checkExists($name)) {
             $service = $this->getServiceFactory()->create($name);
         } else {
-            $service = $this->getServiceFactory()->create('Record');
-            $service->setEntityName($name);
+            $service = $this->getServiceFactory()->create($this->defaultRecordServiceName);
+            $service->setEntityType($name);
         }
 
         return $service;
@@ -67,14 +76,18 @@ class Record extends Base
         return $entity->toArray();
     }
 
-    public function actionPatch($params, $data)
+    public function actionPatch($params, $data, $request)
     {
-        return $this->actionUpdate($params, $data);
+        return $this->actionUpdate($params, $data, $request);
     }
 
-    public function actionCreate($params, $data)
+    public function actionCreate($params, $data, $request)
     {
-        if (!$this->getAcl()->check($this->name, 'edit')) {
+        if (!$request->isPost()) {
+            throw new BadRequest();
+        }
+
+        if (!$this->getAcl()->check($this->name, 'create')) {
             throw new Forbidden();
         }
 
@@ -87,8 +100,12 @@ class Record extends Base
         throw new Error();
     }
 
-    public function actionUpdate($params, $data)
+    public function actionUpdate($params, $data, $request)
     {
+        if (!$request->isPut() && !$request->isPatch()) {
+            throw new BadRequest();
+        }
+
         if (!$this->getAcl()->check($this->name, 'edit')) {
             throw new Forbidden();
         }
@@ -111,29 +128,41 @@ class Record extends Base
         $where = $request->get('where');
         $offset = $request->get('offset');
         $maxSize = $request->get('maxSize');
-        $asc = $request->get('asc') === 'true';
+        $asc = $request->get('asc', 'true') === 'true';
         $sortBy = $request->get('sortBy');
         $q = $request->get('q');
+        $primaryFilter = $request->get('primaryFilter');
+        $textFilter = $request->get('textFilter');
+        $boolFilterList = $request->get('boolFilterList');
 
         if (empty($maxSize)) {
             $maxSize = self::MAX_SIZE_LIMIT;
         }
         if (!empty($maxSize) && $maxSize > self::MAX_SIZE_LIMIT) {
-            throw new Forbidden();
+            throw new Forbidden("Max should should not exceed " . self::MAX_SIZE_LIMIT . ". Use pagination (offset, limit).");
         }
 
-        $result = $this->getRecordService()->findEntities(array(
+        $params = array(
             'where' => $where,
             'offset' => $offset,
             'maxSize' => $maxSize,
             'asc' => $asc,
             'sortBy' => $sortBy,
             'q' => $q,
-        ));
+            'textFilter' => $textFilter
+        );
+        if ($request->get('primaryFilter')) {
+            $params['primaryFilter'] = $request->get('primaryFilter');
+        }
+        if ($request->get('boolFilterList')) {
+            $params['boolFilterList'] = $request->get('boolFilterList');
+        }
+
+        $result = $this->getRecordService()->findEntities($params);
 
         return array(
             'total' => $result['total'],
-            'list' => $result['collection']->toArray()
+            'list' => isset($result['collection']) ? $result['collection']->toArray() : $result['list']
         );
     }
 
@@ -145,9 +174,10 @@ class Record extends Base
         $where = $request->get('where');
         $offset = $request->get('offset');
         $maxSize = $request->get('maxSize');
-        $asc = $request->get('asc') === 'true';
+        $asc = $request->get('asc', 'true') === 'true';
         $sortBy = $request->get('sortBy');
         $q = $request->get('q');
+        $textFilter = $request->get('textFilter');
 
         if (empty($maxSize)) {
             $maxSize = self::MAX_SIZE_LIMIT;
@@ -156,24 +186,36 @@ class Record extends Base
             throw new Forbidden();
         }
 
-        $result = $this->getRecordService()->findLinkedEntities($id, $link, array(
+        $params = array(
             'where' => $where,
             'offset' => $offset,
             'maxSize' => $maxSize,
             'asc' => $asc,
             'sortBy' => $sortBy,
             'q' => $q,
-        ));
+            'textFilter' => $textFilter
+        );
+        if ($request->get('primaryFilter')) {
+            $params['primaryFilter'] = $request->get('primaryFilter');
+        }
+        if ($request->get('boolFilterList')) {
+            $params['boolFilterList'] = $request->get('boolFilterList');
+        }
 
+        $result = $this->getRecordService()->findLinkedEntities($id, $link, $params);
 
         return array(
             'total' => $result['total'],
-            'list' => $result['collection']->toArray()
+            'list' => isset($result['collection']) ? $result['collection']->toArray() : $result['list']
         );
     }
 
-    public function actionDelete($params)
+    public function actionDelete($params, $data, $request)
     {
+        if (!$request->isDelete()) {
+            throw new BadRequest();
+        }
+
         $id = $params['id'];
 
         if ($this->getRecordService()->deleteEntity($id)) {
@@ -184,7 +226,7 @@ class Record extends Base
 
     public function actionExport($params, $data, $request)
     {
-        if ($this->getConfig()->get('disableExport') && !$this->getUser()->isAdmin()) {
+        if ($this->getConfig()->get('exportDisabled') && !$this->getUser()->isAdmin()) {
             throw new Forbidden();
         }
 
@@ -210,6 +252,10 @@ class Record extends Base
 
     public function actionMassUpdate($params, $data, $request)
     {
+        if (!$request->isPut()) {
+            throw new BadRequest();
+        }
+
         if (!$this->getAcl()->check($this->name, 'edit')) {
             throw new Forbidden();
         }
@@ -233,6 +279,9 @@ class Record extends Base
 
     public function actionMassDelete($params, $data, $request)
     {
+        if (!$request->isPost()) {
+            throw new BadRequest();
+        }
         if (!$this->getAcl()->check($this->name, 'delete')) {
             throw new Forbidden();
         }
@@ -243,7 +292,6 @@ class Record extends Base
             $params['where'] = $where;
         }
         if (array_key_exists('ids', $data)) {
-            $where = json_decode(json_encode($data['where']), true);
             $params['ids'] = $data['ids'];
         }
 
@@ -252,10 +300,14 @@ class Record extends Base
         return $idsRemoved;
     }
 
-    public function actionCreateLink($params, $data)
+    public function actionCreateLink($params, $data, $request)
     {
+        if (!$request->isPost()) {
+            throw new BadRequest();
+        }
+
         if (empty($params['id']) || empty($params['link'])) {
-            throw BadRequest();
+            throw new BadRequest();
         }
 
         $id = $params['id'];
@@ -268,18 +320,18 @@ class Record extends Base
             $where = json_decode(json_encode($data['where']), true);
             return $this->getRecordService()->linkEntityMass($id, $link, $where);
         } else {
-            $foreignIds = array();
+            $foreignIdList = array();
             if (isset($data['id'])) {
-                $foreignIds[] = $data['id'];
+                $foreignIdList[] = $data['id'];
             }
             if (isset($data['ids']) && is_array($data['ids'])) {
                 foreach ($data['ids'] as $foreignId) {
-                    $foreignIds[] = $foreignId;
+                    $foreignIdList[] = $foreignId;
                 }
             }
 
             $result = false;
-            foreach ($foreignIds as $foreignId) {
+            foreach ($foreignIdList as $foreignId) {
                 if ($this->getRecordService()->linkEntity($id, $link, $foreignId)) {
                     $result = true;
                 }
@@ -292,13 +344,17 @@ class Record extends Base
         throw new Error();
     }
 
-    public function actionRemoveLink($params, $data)
+    public function actionRemoveLink($params, $data, $request)
     {
+        if (!$request->isDelete()) {
+            throw new BadRequest();
+        }
+
         $id = $params['id'];
         $link = $params['link'];
 
         if (empty($params['id']) || empty($params['link'])) {
-            throw BadRequest();
+            throw new BadRequest();
         }
 
         $foreignIds = array();
@@ -324,17 +380,23 @@ class Record extends Base
         throw new Error();
     }
 
-    public function actionFollow($params)
+    public function actionFollow($params, $data, $request)
     {
-        if (!$this->getAcl()->check($this->name, 'read')) {
+        if (!$request->isPut()) {
+            throw new BadRequest();
+        }
+        if (!$this->getAcl()->check($this->name, 'stream')) {
             throw new Forbidden();
         }
         $id = $params['id'];
         return $this->getRecordService()->follow($id);
     }
 
-    public function actionUnfollow($params)
+    public function actionUnfollow($params, $data, $request)
     {
+        if (!$request->isDelete()) {
+            throw new BadRequest();
+        }
         if (!$this->getAcl()->check($this->name, 'read')) {
             throw new Forbidden();
         }

application/Espo/Core/Controllers/RecordTree.php

@@ -0,0 +1,65 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Controllers;
+
+use \Espo\Core\Exceptions\Error;
+use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\NotFound;
+use \Espo\Core\Exceptions\BadRequest;
+use \Espo\Core\Utils\Util;
+
+class RecordTree extends Record
+{
+    public static $defaultAction = 'list';
+
+    protected $defaultRecordServiceName = 'RecordTree';
+
+    public function actionListTree($params, $data, $request)
+    {
+        if (!$this->getAcl()->check($this->name, 'read')) {
+            throw new Forbidden();
+        }
+
+        $where = $request->get('where');
+        $parentId = $request->get('parentId');
+        $maxDepth = $request->get('maxDepth');
+        $onlyNotEmpty = $request->get('onlyNotEmpty');
+
+        $collection = $this->getRecordService()->getTree($parentId, array(
+            'where' => $where,
+            'onlyNotEmpty' => $onlyNotEmpty
+        ), 0, $maxDepth);
+        return array(
+            'list' => $collection->toArray(),
+            'path' => $this->getRecordService()->getTreeItemPath($parentId)
+        );
+    }
+}
+

application/Espo/Core/CronManager.php

@@ -18,10 +18,16 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core;
-
 use \PDO;
 use Espo\Core\Utils\Json;
 use Espo\Core\Exceptions\NotFound;

application/Espo/Core/DataManager.php

@@ -18,10 +18,16 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core;
-
 class DataManager
 {
     private $container;

application/Espo/Core/Entities/CategoryTreeItem.php

@@ -0,0 +1,50 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Entities;
+
+class CategoryTreeItem extends \Espo\Core\ORM\Entity
+{
+    public function toArray()
+    {
+        $data = parent::toArray();
+        $childList = $this->get('childList');
+        if (is_null($childList)) {
+            $data['childList'] = null;
+        } else {
+            $arr = [];
+            foreach ($childList as $entity) {
+                $arr[] = $entity->toArray();
+            }
+            $data['childList'] = $arr;
+        }
+        return $data;
+    }
+}
+

application/Espo/Core/Entities/Person.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\Entities;

application/Espo/Core/EntryPointManager.php

@@ -18,19 +18,25 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/ 
 
 namespace Espo\Core;
-
 use \Espo\Core\Exceptions\NotFound,
     \Espo\Core\Utils\Util;
 
 
 class EntryPointManager
 {
-    private $container;    
-    
-    private $fileManager;    
+    private $container;
+
+    private $fileManager;
 
     protected $data = null;
 
@@ -38,7 +44,7 @@ class EntryPointManager
 
     protected $allowedMethods = array(
         'run',
-    );    
+    );
 
     /**
      * @var array - path to entryPoint files
@@ -46,14 +52,14 @@ class EntryPointManager
     private $paths = array(
         'corePath' => 'application/Espo/EntryPoints',
         'modulePath' => 'application/Espo/Modules/{*}/EntryPoints',
-        'customPath' => 'custom/Espo/Custom/EntryPoints',                                              
+        'customPath' => 'custom/Espo/Custom/EntryPoints',
     );
 
 
     public function __construct(\Espo\Core\Container $container)
     {
-        $this->container = $container;        
-        $this->fileManager = $container->get('fileManager');        
+        $this->container = $container;
+        $this->fileManager = $container->get('fileManager');
     }
 
     protected function getContainer()
@@ -69,27 +75,36 @@ class EntryPointManager
     public function checkAuthRequired($name)
     {
         $className = $this->getClassName($name);
-        if ($className === false) {
+        if (!$className) {
             throw new NotFound();
         }
-        return $className::$authRequired;        
+        return $className::$authRequired;
     }
 
-    public function run($name) 
+    public function checkNotStrictAuth($name)
     {
         $className = $this->getClassName($name);
-        if ($className === false) {
+        if (!$className) {
+            throw new NotFound();
+        }
+        return $className::$notStrictAuth;
+    }
+
+    public function run($name, $data = array())
+    {
+        $className = $this->getClassName($name);
+        if (!$className) {
             throw new NotFound();
         }
         $entryPoint = new $className($this->container);
 
-        $entryPoint->run();
+        $entryPoint->run($data);
     }
 
     protected function getClassName($name)
     {
         $name = Util::normilizeClassName($name);
-        
+
         if (!isset($this->data)) {
             $this->init();
         }
@@ -98,8 +113,8 @@ class EntryPointManager
         if (isset($this->data[$name])) {
             return $this->data[$name];
         }
-        
-        return false; 
+
+        return false;
     }
 
 
@@ -108,8 +123,7 @@ class EntryPointManager
         $classParser = $this->getContainer()->get('classParser');
         $classParser->setAllowedMethods($this->allowedMethods);
         $this->data = $classParser->getData($this->paths, $this->cacheFile);
-    }    
-     
+    }
 
 }
 

application/Espo/Core/EntryPoints/Base.php

@@ -18,7 +18,14 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
- ************************************************************************/ 
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
 
 namespace Espo\Core\EntryPoints;
 
@@ -29,50 +36,75 @@ use \Espo\Core\Exceptions\Forbidden;
 abstract class Base
 {
     private $container;
-    
+
     public static $authRequired = true;
-    
+
+    public static $notStrictAuth = false;
+
     protected function getContainer()
     {
         return $this->container;
     }
-    
+
     protected function getUser()
     {
         return $this->getContainer()->get('user');
     }
-    
+
     protected function getAcl()
     {
         return $this->getContainer()->get('acl');
     }
-    
+
     protected function getEntityManager()
     {
         return $this->getContainer()->get('entityManager');
     }
-    
+
     protected function getServiceFactory()
     {
         return $this->getContainer()->get('serviceFactory');
-    }    
-    
+    }
+
     protected function getConfig()
     {
         return $this->getContainer()->get('config');
     }
-    
+
     protected function getMetadata()
     {
         return $this->getContainer()->get('metadata');
-    }    
-    
+    }
+
+    protected function getDateTime()
+    {
+        return $this->getContainer()->get('dateTime');
+    }
+
+    protected function getNumber()
+    {
+        return $this->getContainer()->get('number');
+    }
+
+    protected function getFileManager()
+    {
+        return $this->getContainer()->get('fileManager');
+    }
+
+    protected function getLanguage()
+    {
+        return $this->getContainer()->get('language');
+    }
+
+    protected function getClientManager()
+    {
+        return $this->getContainer()->get('clientManager');
+    }
+
     public function __construct(Container $container)
     {
         $this->container = $container;
     }
-    
-    abstract public function run();    
 
 }
 

application/Espo/Core/Exceptions/BadRequest.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/ 
 
 namespace Espo\Core\Exceptions;

application/Espo/Core/Exceptions/Conflict.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/ 
 
 namespace Espo\Core\Exceptions;

application/Espo/Core/Exceptions/Error.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/ 
 
 namespace Espo\Core\Exceptions;

application/Espo/Core/Exceptions/Forbidden.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/ 
 
 namespace Espo\Core\Exceptions;

application/Espo/Core/Exceptions/InternalServerError.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/ 
 
 namespace Espo\Core\Exceptions;

application/Espo/Core/Exceptions/NotFound.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/ 
 
 namespace Espo\Core\Exceptions;

application/Espo/Core/Exceptions/Unauthorized.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/ 
 
 namespace Espo\Core\Exceptions;

application/Espo/Core/ExtensionManager.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core;

application/Espo/Core/ExternalAccount/ClientManager.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\ExternalAccount;

application/Espo/Core/ExternalAccount/Clients/Google.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\ExternalAccount\Clients;

application/Espo/Core/ExternalAccount/Clients/IClient.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\ExternalAccount\Clients;

application/Espo/Core/ExternalAccount/Clients/OAuth2Abstract.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\ExternalAccount\Clients;

application/Espo/Core/ExternalAccount/OAuth2/Client.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\ExternalAccount\OAuth2;

application/Espo/Core/HookManager.php

@@ -18,10 +18,16 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core;
-
 use \Espo\Core\Exceptions\Error,
     \Espo\Core\Utils\Util;
 
@@ -104,6 +110,9 @@ class HookManager
                 foreach ($this->data[$scope][$hookName] as $className) {
                     if (empty($this->hooks[$className])) {
                         $this->hooks[$className] = $this->createHookByClassName($className);
+                        if (empty($this->hooks[$className])) {
+                            continue;
+                        }
                     }
                     $hook = $this->hooks[$className];
                     $hook->$hookName($injection, $options);
@@ -122,7 +131,7 @@ class HookManager
             }
             return $hook;
         }
-        throw new Error("Class '$className' does not exist");
+        $GLOBALS['log']->error("Hook class '{$name}' does not exist.");
     }
 
     /**

application/Espo/Core/Hooks/Base.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\Hooks;

application/Espo/Core/Htmlizer/Htmlizer.php

@@ -0,0 +1,147 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Htmlizer;
+
+use Espo\ORM\Entity;
+use Espo\Core\Exceptions\Error;
+
+use Espo\Core\Utils\File\Manager as FileManager;
+use Espo\Core\Utils\DateTime;
+use Espo\Core\Utils\Number;
+
+require('vendor/zordius/lightncandy/src/lightncandy.php');
+
+class Htmlizer
+{
+    protected $fileManager;
+
+    protected $dateTime;
+
+    protected $config;
+
+    public function __construct(FileManager $fileManager, DateTime $dateTime, Number $number)
+    {
+        $this->fileManager = $fileManager;
+        $this->dateTime = $dateTime;
+        $this->number = $number;
+    }
+
+    protected function formatNumber($value)
+    {
+        return $this->number->format($value);
+    }
+
+    protected function format($value)
+    {
+        if (is_float($value) || is_int($value)) {
+            $value = $this->formatNumber($value);
+        } else if (is_string($value)) {
+            $value = nl2br($value);
+        }
+        return $value;
+    }
+
+    protected function getDataFromEntity(Entity $entity)
+    {
+        $data = $entity->toArray();
+
+
+
+        $fieldDefs = $entity->getFields();
+        $fieldList = array_keys($fieldDefs);
+
+        foreach ($fieldList as $field) {
+            $type = null;
+            if (!empty($fieldDefs[$field]['type'])) {
+                $type = $fieldDefs[$field]['type'];
+            }
+            if ($type == Entity::DATETIME) {
+                if (!empty($data[$field])) {
+                    $data[$field] = $this->dateTime->convertSystemDateTime($data[$field]);
+                }
+            } else if ($type == Entity::DATE) {
+                if (!empty($data[$field])) {
+                    $data[$field] = $this->dateTime->convertSystemDate($data[$field]);
+                }
+            } else if ($type == Entity::JSON_ARRAY) {
+                if (!empty($data[$field])) {
+                    $list = $data[$field];
+                    $newList = [];
+                    foreach ($list as $item) {
+                        $v = $item;
+                        if ($item instanceof \StdClass) {
+                            $v = get_object_vars($v);
+                        }
+                        foreach ($v as $k => $w) {
+                            $v[$k] = $this->format($v[$k]);
+                        }
+                        $newList[] = $v;
+                    }
+                    $data[$field] = $newList;
+                }
+            } else if ($type == Entity::JSON_OBJECT) {
+                if (!empty($data[$field])) {
+                    $value = $data[$field];
+                    if ($value instanceof \StdClass) {
+                        $data[$field] = get_object_vars($value);
+                    }
+                    foreach ($data[$field] as $k => $w) {
+                        $data[$field][$k] = $this->format($data[$field][$k]);
+                    }
+                }
+            }
+
+            if (array_key_exists($field, $data)) {
+               $data[$field] = $this->format($data[$field]);
+            }
+        }
+
+        return $data;
+    }
+
+    public function render(Entity $entity, $template)
+    {
+        $code = \LightnCandy::compile($template);
+        $id = uniqid('', true);
+        $fileName = 'data/cache/template-' . $id;
+        $this->fileManager->putContents($fileName, $code);
+        $renderer = include($fileName);
+        $this->fileManager->removeFile($fileName);
+
+        $data = $this->getDataFromEntity($entity);
+
+        $html = $renderer($data);
+
+        $html = str_replace('?entryPoint=attachment&amp;', '?entryPoint=attachment&', $html);
+        $html = preg_replace('/\?entryPoint=attachment\&id=(.*)/', 'data/upload/$1', $html);
+
+        return $html;
+    }
+}

application/Espo/Core/Interfaces/Injectable.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/ 
 
 namespace Espo\Core\Interfaces;

application/Espo/Core/Interfaces/Loader.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\Interfaces;

application/Espo/Core/Jobs/Base.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\Jobs;

application/Espo/Core/Loaders/Base.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\Loaders;

application/Espo/Core/Loaders/EntityManager.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\Loaders;

application/Espo/Core/Loaders/EntityManagerUtil.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\Loaders;

application/Espo/Core/Mail/FiltersMatcher.php

@@ -0,0 +1,101 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Mail;
+
+
+use \Espo\Entities\Email;
+
+class FiltersMatcher
+{
+    public function __construct()
+    {
+
+    }
+
+    public function match(Email $email, $filterList = [])
+    {
+        foreach ($filterList as $filter) {
+            if ($filter->get('from')) {
+                if ($this->matchString(strtolower($filter->get('from')), strtolower($email->get('from')))) {
+                    return true;
+                }
+            }
+            if ($filter->get('to')) {
+                if ($email->get('to')) {
+                    $toArr = explode(';', $email->get('to'));
+                    foreach ($toArr as $to) {
+                        if ($this->matchString(strtolower($filter->get('to')), strtolower($to))) {
+                            return true;
+                        }
+                    }
+                }
+            }
+            if ($filter->get('subject')) {
+                if ($this->matchString($filter->get('subject'), $email->get('name'))) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
+    public function matchBody(Email $email, $filterList = [])
+    {
+        foreach ($filterList as $filter) {
+            if ($filter->get('bodyContains')) {
+                $phraseList = $filter->get('bodyContains');
+                $body = $email->get('body');
+                $bodyPlain = $email->get('bodyPlain');
+                foreach ($phraseList as $phrase) {
+                    if (stripos($bodyPlain, $phrase) !== false) {
+                        return true;
+                    }
+                    if (stripos($body, $phrase) !== false) {
+                        return true;
+                    }
+                }
+            }
+        }
+        return false;
+    }
+
+    protected function matchString($pattern, $value)
+    {
+        if ($pattern == $value) {
+            return true;
+        }
+        $pattern = preg_quote($pattern, '#');
+        $pattern = str_replace('\*', '.*', $pattern).'\z';
+        if (preg_match('#^'.$pattern.'#', $value)) {
+            return true;
+        }
+        return false;
+    }
+}

application/Espo/Core/Mail/Importer.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\Mail;
@@ -25,6 +32,7 @@ namespace Espo\Core\Mail;
 use \Zend\Mime\Mime as Mime;
 
 use \Espo\ORM\Entity;
+use \Espo\ORM\Email;
 
 class Importer
 {
@@ -34,11 +42,14 @@ class Importer
 
     private $config;
 
+    private $filtersMatcher;
+
     public function __construct($entityManager, $fileManager, $config)
     {
         $this->entityManager = $entityManager;
         $this->fileManager = $fileManager;
         $this->config = $config;
+        $this->filtersMatcher = new FiltersMatcher();
     }
 
     protected function getEntityManager()
@@ -55,7 +66,12 @@ class Importer
         return $this->fileManager;
     }
 
-    public function importMessage($message, $userId, $teamsIds = array())
+    protected function getFiltersMatcher()
+    {
+        return $this->filtersMatcher;
+    }
+
+    public function importMessage($message, $assignedUserId = null, $teamsIdList = [], $userIdList = [], $filterList = [])
     {
         try {
             $email = $this->getEntityManager()->getEntity('Email');
@@ -68,9 +84,16 @@ class Importer
             $email->set('isHtml', false);
             $email->set('name', $subject);
             $email->set('status', 'Archived');
-            $email->set('attachmentsIds', array());
-            $email->set('assignedUserId', $userId);
-            $email->set('teamsIds', $teamsIds);
+            $email->set('attachmentsIds', []);
+            if ($assignedUserId) {
+                $email->set('assignedUserId', $assignedUserId);
+                $email->set('assignedUsersIds', [$assignedUserId]);
+            }
+            $email->set('teamsIds', $teamsIdList);
+
+            if (!empty($userIdList)) {
+                $email->set('usersIds', $userIdList);
+            }
 
             $fromArr = $this->getAddressListFromMessage($message, 'from');
             if (isset($message->from)) {
@@ -82,26 +105,46 @@ class Importer
 
             $toArr = $this->getAddressListFromMessage($message, 'to');
             $ccArr = $this->getAddressListFromMessage($message, 'cc');
+            $replyToArr = $this->getAddressListFromMessage($message, 'replyTo');
 
             $email->set('from', $fromArr[0]);
             $email->set('to', implode(';', $toArr));
             $email->set('cc', implode(';', $ccArr));
+            $email->set('replyTo', implode(';', $replyToArr));
+
+            if ($this->getFiltersMatcher()->match($email, $filterList)) {
+                return false;
+            }
 
             if (isset($message->messageId) && !empty($message->messageId)) {
                 $email->set('messageId', $message->messageId);
                 if (isset($message->deliveredTo)) {
                     $email->set('messageIdInternal', $message->messageId . '-' . $message->deliveredTo);
                 }
+                if (stripos($message->messageId, '@espo-system') !== false) {
+                    return;
+                }
             }
 
             if ($duplicate = $this->findDuplicate($email)) {
-                $this->getEntityManager()->getRepository('Email')->relate($duplicate, 'users', $userId);
-                if (!empty($teamsIds)) {
-                    foreach ($teamsIds as $teamId) {
+                if ($assignedUserId) {
+                    $duplicate->addLinkMultipleId('users', $assignedUserId);
+                    $duplicate->addLinkMultipleId('assignedUsers', $assignedUserId);
+                }
+                if (!empty($userIdList)) {
+                    foreach ($userIdList as $uId) {
+                        $duplicate->addLinkMultipleId('users', $uId);
+                    }
+                }
+
+            	$this->getEntityManager()->saveEntity($duplicate);
+
+                if (!empty($teamsIdList)) {
+                    foreach ($teamsIdList as $teamId) {
                         $this->getEntityManager()->getRepository('Email')->relate($duplicate, 'teams', $teamId);
                     }
                 }
-                return false;
+                return $duplicate;
             }
 
             if (isset($message->date)) {
@@ -110,7 +153,9 @@ class Importer
                     $dateSent = $dt->setTimezone(new \DateTimeZone('UTC'))->format('Y-m-d H:i:s');
                     $email->set('dateSent', $dateSent);
                 }
-            }
+            } else {
+				$email->set('dateSent', date('Y-m-d H:i:s'));
+			}
             if (isset($message->deliveryDate)) {
                 $dt = new \DateTime($message->deliveryDate);
                 if ($dt) {
@@ -129,6 +174,10 @@ class Importer
                 $this->importPartDataToEmail($email, $message, $inlineIds, 'text/plain');
             }
 
+            if (!$email->get('body') && $email->get('bodyPlain')) {
+                $email->set('body', $email->get('bodyPlain'));
+            }
+
             $body = $email->get('body');
             if (!empty($body)) {
                 foreach ($inlineIds as $cid => $attachmentId) {
@@ -137,15 +186,54 @@ class Importer
                 $email->set('body', $body);
             }
 
+            if ($this->getFiltersMatcher()->matchBody($email, $filterList)) {
+                return false;
+            }
+
             $parentFound = false;
 
+            if (isset($message->inReplyTo) && !empty($message->inReplyTo)) {
+                $arr = explode(' ', $message->inReplyTo);
+                $inReplyTo = $arr[0];
+                $replied = $this->getEntityManager()->getRepository('Email')->where(array(
+                    'messageId' => $inReplyTo
+                ))->findOne();
+                if ($replied) {
+                    $email->set('repliedId', $replied->id);
+                }
+            }
+
             if (isset($message->references) && !empty($message->references)) {
-                $reference = str_replace(array('/', '@'), " ", trim($message->references, '<>'));
+                $arr = explode(' ', $message->references);
+                $reference = $arr[0];
+                $reference = str_replace(array('/', '@'), " ", trim($reference, '<>'));
                 $parentType = $parentId = null;
                 $emailSent = PHP_INT_MAX;
                 $n = sscanf($reference, '%s %s %d %d espo', $parentType, $parentId, $emailSent, $number);
                 if ($n == 4 && $emailSent < time()) {
                     if (!empty($parentType) && !empty($parentId)) {
+                        if ($parentType == 'Lead') {
+                            $parent = $this->getEntityManager()->getEntity('Lead', $parentId);
+                            if ($parent && $parent->get('status') == 'Converted') {
+                                if ($parent->get('createdAccountId')) {
+                                    $account = $this->getEntityManager()->getEntity('Account', $parent->get('createdAccountId'));
+                                    if ($account) {
+                                        $parentType = 'Account';
+                                        $parentId = $account->id;
+                                    }
+                                } else {
+                                    if ($this->getConfig()->get('b2cMode')) {
+                                        if ($parent->get('createdContactId')) {
+                                            $contact = $this->getEntityManager()->getEntity('Contact', $parent->get('createdContactId'));
+                                            if ($contact) {
+                                                $parentType = 'Contact';
+                                                $parentId = $contact->id;
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
                         $email->set('parentType', $parentType);
                         $email->set('parentId', $parentId);
                         $parentFound = true;
@@ -158,10 +246,15 @@ class Importer
                 if ($from) {
                     $parentFound = $this->findParent($email, $from);
                 }
-                if (!$parentFound) {
-                    if (!empty($toArr)) {
-                        $parentFound = $this->findParent($email, $toArr[0]);
-                    }
+            }
+            if (!$parentFound) {
+                if (!empty($replyToArr)) {
+                    $parentFound = $this->findParent($email, $replyToArr[0]);
+                }
+            }
+            if (!$parentFound) {
+                if (!empty($toArr)) {
+                    $parentFound = $this->findParent($email, $toArr[0]);
                 }
             }
 
@@ -222,12 +315,20 @@ class Importer
         }
     }
 
+    protected function normilizeHeader($header)
+    {
+        if (is_a($header, 'ArrayIterator')) {
+            return $header->current();
+        } else {
+            return $header;
+        }
+    }
+
     protected function getAddressListFromMessage($message, $type)
     {
         $addressList = array();
         if (isset($message->$type)) {
-
-            $list = $message->getHeader($type)->getAddressList();
+            $list = $this->normilizeHeader($message->getHeader($type))->getAddressList();
             foreach ($list as $address) {
                 $addressList[] = $address->getEmail();
             }
@@ -244,6 +345,15 @@ class Importer
                 $type = strtok($part->contentType, ';');
             }
 
+            $contentDisposition = false;
+            if (isset($part->ContentDisposition)) {
+                if (strpos(strtolower($part->ContentDisposition), 'attachment') === 0) {
+                    $contentDisposition = 'attachment';
+                } else if (strpos(strtolower($part->ContentDisposition), 'inline') === 0) {
+                    $contentDisposition = 'inline';
+                }
+            }
+
             if (empty($type)) {
                 if (!empty($defaultContentType)) {
                     $type = $defaultContentType;
@@ -253,28 +363,26 @@ class Importer
             }
 
             $encoding = null;
-
             $isAttachment = true;
-
             if ($type == 'text/plain' || $type == 'text/html') {
-
-                $isAttachment = false;
-                $content = $this->getContentFromPart($part);
-                if ($type == 'text/plain') {
-                    if ($email->get('bodyPlain')) {
-                        $isAttachment = true;
-                    } else {
-                        $email->set('bodyPlain', $content);
-                        if (!$email->get('body')) {
-                            $email->set('body', $content);
+                if ($contentDisposition !== 'attachment') {
+                    $isAttachment = false;
+                    $content = $this->getContentFromPart($part);
+                    if ($type == 'text/plain') {
+                        $bodyPlain = '';
+                        if ($email->get('bodyPlain')) {
+                            $bodyPlain .= $email->get('bodyPlain') . "\n";
                         }
-                    }
-                } else if ($type == 'text/html') {
-                    if ($email->get('isHtml')) {
-                        $isAttachment = true;
-                    } else {
-                        $email->set('body', $content);
+                        $bodyPlain .= $content;
+                        $email->set('bodyPlain', $bodyPlain);
+                    } else if ($type == 'text/html') {
+                        $body = '';
+                        if ($email->get('body')) {
+                            $body .= $email->get('body') . "<br>";
+                        }
+                        $body .= $content;
                         $email->set('isHtml', true);
+                        $email->set('body', $body);
                     }
                 }
             }
@@ -286,21 +394,32 @@ class Importer
                 $fileName = null;
                 $contentId = null;
 
-                if (isset($part->ContentDisposition)) {
-                    if (strpos($part->ContentDisposition, 'attachment') === 0) {
-                        if (preg_match('/filename="?([^"]+)"?/i', $part->ContentDisposition, $m)) {
-                            $fileName = $m[1];
+                if ($contentDisposition) {
+
+                    if ($contentDisposition === 'attachment') {
+                        $fileName = $this->fetchFileNameFromContentDisposition($part->ContentDisposition);
+                        if ($fileName) {
                             $disposition = 'attachment';
                         }
-                    } else if (strpos($part->ContentDisposition, 'inline') === 0) {
-                        $contentId = trim($part->contentID, '<>');
-                        $fileName = $contentId;
-                        $disposition = 'inline';
+                    } else if ($contentDisposition ===  'inline') {
+                        if (isset($part->contentID)) {
+                            $contentId = trim($part->contentID, '<>');
+                            $fileName = $contentId;
+                            $disposition = 'inline';
+                        } else {
+                            // for iOS attachments
+                            if (empty($fileName)) {
+                                $fileName = $this->fetchFileNameFromContentDisposition($part->ContentDisposition);
+                                if ($fileName) {
+                                    $disposition = 'attachment';
+                                }
+                            }
+                        }
                     }
                 }
 
                 if (isset($part->contentTransferEncoding)) {
-                    $encoding = strtolower($part->getHeader('Content-Transfer-Encoding')->getTransferEncoding());
+                    $encoding = strtolower($this->normilizeHeader($part->getHeader('Content-Transfer-Encoding'))->getTransferEncoding());
                 }
 
                 $attachment = $this->getEntityManager()->getEntity('Attachment');
@@ -321,7 +440,7 @@ class Importer
 
                 $this->getEntityManager()->saveEntity($attachment);
 
-                $path = 'data/upload/' . $attachment->id;
+                $path = $this->getEntityManager()->getRepository('Attachment')->getFilePath($attachment);
                 $this->getFileManager()->putContents($path, $content);
 
                 if ($disposition == 'attachment') {
@@ -335,6 +454,28 @@ class Importer
         } catch (\Exception $e) {}
     }
 
+    protected function fetchFileNameFromContentDisposition($contentDisposition)
+    {
+        $m = array();
+        if (preg_match('/filename="?([^"]+)"?/i', $contentDisposition, $m)) {
+            $fileName = $m[1];
+            return $fileName;
+        } else if (preg_match('/filename\*[01]?="?([^"]+)"?/i', $contentDisposition, $m)) {
+            $fileName = $m[1];
+            if ($fileName) {
+                if (stripos($fileName, "''") !== false) {
+                    list($encoding, $fileName) = explode("''", $fileName);
+                    $fileName = rawurldecode($fileName);
+                    if (strtoupper($encoding) !== 'UTF-8') {
+                        $fileName = mb_convert_encoding($fileName, 'UTF-8', $encoding);
+                    }
+                }
+                return $fileName;
+            }
+        }
+        return false;
+    }
+
     protected function getContentFromPart($part)
     {
         if ($part instanceof \Zend\Mime\Part) {
@@ -348,7 +489,7 @@ class Importer
             $encoding = null;
 
             if (isset($part->contentTransferEncoding)) {
-                $cteHeader = $part->getHeader('Content-Transfer-Encoding');
+                $cteHeader = $this->normilizeHeader($part->getHeader('Content-Transfer-Encoding'));
                 $encoding = strtolower($cteHeader->getTransferEncoding());
             }
 
@@ -359,7 +500,7 @@ class Importer
             $charset = 'UTF-8';
 
             if (isset($part->contentType)) {
-                $ctHeader = $part->getHeader('Content-Type');
+                $ctHeader = $this->normilizeHeader($part->getHeader('Content-Type'));
                 $charsetParamValue = $ctHeader->getParameter('charset');
                 if (!empty($charsetParamValue)) {
                     $charset = strtoupper($charsetParamValue);
@@ -367,7 +508,7 @@ class Importer
             }
 
             if (isset($part->contentTransferEncoding)) {
-                $cteHeader = $part->getHeader('Content-Transfer-Encoding');
+                $cteHeader = $this->normilizeHeader($part->getHeader('Content-Transfer-Encoding'));
                 if ($cteHeader->getTransferEncoding() == 'quoted-printable') {
                     $content = quoted_printable_decode($content);
                 }

application/Espo/Core/Mail/Mail/Header/XQueueItemId.php

@@ -0,0 +1,102 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+/**
+ * Zend Framework (http://framework.zend.com/)
+ *
+ * @link      http://github.com/zendframework/zf2 for the canonical source repository
+ * @copyright Copyright (c) 2005-2015 Zend Technologies USA Inc. (http://www.zend.com)
+ * @license   http://framework.zend.com/license/new-bsd New BSD License
+ */
+
+namespace Espo\Core\Mail\Mail\Header;
+
+use \Zend\Mail\Header;
+use Zend\Mime\Mime;
+
+class XQueueItemId implements Header\HeaderInterface
+{
+    protected $fieldName = 'X-QueueItemId';
+
+    protected $id = null;
+
+    public static function fromString($headerLine)
+    {
+        list($name, $value) = Header\GenericHeader::splitHeaderLine($headerLine);
+        $value = Header\HeaderWrap::mimeDecodeValue($value);
+
+        if (strtolower($name) !== 'x-queue-item-id') {
+            throw new Header\Exception\InvalidArgumentException('Invalid header line for Message-ID string');
+        }
+
+        $header = new static();
+        $header->setId($value);
+
+        return $header;
+    }
+
+    public function getFieldName()
+    {
+        return $this->fieldName;
+    }
+
+    public function setFieldName($value)
+    {
+    }
+
+    public function setEncoding($encoding)
+    {
+        return $this;
+    }
+
+    public function setId($id)
+    {
+        $this->id = $id;
+    }
+
+    public function getEncoding()
+    {
+        return 'ASCII';
+    }
+
+    public function toString()
+    {
+        return $this->fieldName . ': ' . $this->getFieldValue();
+    }
+
+    public function getFieldValue($format = Header\HeaderInterface::FORMAT_RAW)
+    {
+        return $this->id;
+    }
+}

application/Espo/Core/Mail/Mail/Headers.php

@@ -1,4 +1,38 @@
-<?php
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
 
 namespace Espo\Core\Mail\Mail;
 
@@ -10,37 +44,5 @@ use Zend\Loader\PluginClassLocator;
 
 class Headers extends \Zend\Mail\Headers
 {
-    public static function fromString($string, $EOL = self::EOL)
-    {
-        $headers     = new static();
-        $currentLine = '';
 
-        // iterate the header lines, some might be continuations
-        foreach (explode($EOL, $string) as $line) {
-            // check if a header name is present
-            if (preg_match('/^(?P<name>[\x21-\x39\x3B-\x7E]+):.*$/', $line, $matches)) {
-                if ($currentLine) {
-                    // a header name was present, then store the current complete line
-                    $headers->addHeaderLine($currentLine);
-                }
-                $currentLine = trim($line);
-            } elseif (preg_match('/^\s+.*$/', $line, $matches)) {
-                // continuation: append to current line
-                $currentLine .= $line;
-            } elseif (preg_match('/^\s*$/', $line)) {
-                // empty line indicates end of headers
-                break;
-            } else {
-                // Line does not match header format!
-                throw new Exception\RuntimeException(sprintf(
-                    'Line "%s"does not match header format!',
-                    $line
-                ));
-            }
-        }
-        if ($currentLine) {
-            $headers->addHeaderLine($currentLine);
-        }
-        return $headers;
-    }
 }

application/Espo/Core/Mail/Mail/Storage/Imap.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\Mail\Mail\Storage;

application/Espo/Core/Mail/Mail/Storage/Message.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\Mail\Mail\Storage;

application/Espo/Core/Mail/Sender.php

@@ -18,6 +18,13 @@
  *
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
  ************************************************************************/
 
 namespace Espo\Core\Mail;
@@ -38,18 +45,31 @@ class Sender
 {
     protected $config;
 
+    protected $entityManager;
+
     protected $transport;
 
     protected $isGlobal = false;
 
     protected $params = array();
 
-    public function __construct($config)
+    public function __construct($config, $entityManager)
     {
         $this->config = $config;
+        $this->entityManager = $entityManager;
         $this->useGlobal();
     }
 
+    protected function getConfig()
+    {
+        return $this->config;
+    }
+
+    protected function getEntityManager()
+    {
+        return $this->entityManager;
+    }
+
     public function resetParams()
     {
         $this->params = array();
@@ -131,9 +151,11 @@ class Sender
         return $this;
     }
 
-    public function send(Email $email, $params = array())
+    public function send(Email $email, $params = array(), &$message = null, $attachmetList = [])
     {
-        $message = new Message();
+        if (!$message) {
+            $message = new Message();
+        }
         $config = $this->config;
         $params = $this->params + $params;
 
@@ -164,6 +186,10 @@ class Sender
             $message->addFrom($fromAddress, $fromName);
         }
 
+        if (!$email->get('from')) {
+            $email->set('from', $fromAddress);
+        }
+
         if (!empty($params['replyToAddress'])) {
             $replyToName = null;
             if (!empty($params['replyToName'])) {
@@ -202,13 +228,27 @@ class Sender
             }
         }
 
+        $value = $email->get('replyTo');
+        if ($value) {
+            $arr = explode(';', $value);
+            if (is_array($arr)) {
+                foreach ($arr as $address) {
+                    $message->addReplyTo(trim($address));
+                }
+            }
+        }
+
         $attachmentPartList = array();
         $attachmentCollection = $email->get('attachments');
         $attachmentInlineCollection = $email->getInlineAttachments();
 
+        foreach ($attachmetList as $attachment) {
+            $attachmentCollection[] = $attachment;
+        }
+
         if (!empty($attachmentCollection)) {
             foreach ($attachmentCollection as $a) {
-                $fileName = 'data/upload/' . $a->id;
+                $fileName = $this->getEntityManager()->getRepository('Attachment')->getFilePath($a);
                 $attachment = new MimePart(file_get_contents($fileName));
                 $attachment->disposition = Mime::DISPOSITION_ATTACHMENT;
                 $attachment->encoding = Mime::ENCODING_BASE64;
@@ -222,7 +262,7 @@ class Sender
 
         if (!empty($attachmentInlineCollection)) {
             foreach ($attachmentInlineCollection as $a) {
-                $fileName = 'data/upload/' . $a->id;
+                $fileName = $this->getEntityManager()->getRepository('Attachment')->getFilePath($a);
                 $attachment = new MimePart(file_get_contents($fileName));
                 $attachment->disposition = Mime::DISPOSITION_INLINE;
                 $attachment->encoding = Mime::ENCODING_BASE64;
@@ -284,11 +324,18 @@ class Sender
 
         $message->setBody($body);
 
-        if (!$message->getHeaders()->has('content-type')) {
-            $contentTypeHeader = new \Zend\Mail\Header\ContentType();
-            $message->getHeaders()->addHeader($contentTypeHeader);
+        if ($messageType == 'text/plain') {
+            if ($message->getHeaders()->has('content-type')) {
+                $message->getHeaders()->removeHeader('content-type');
+            }
+            $message->getHeaders()->addHeaderLine('Content-Type', 'text/plain; charset=UTF-8');
+        } else {
+            if (!$message->getHeaders()->has('content-type')) {
+                $contentTypeHeader = new \Zend\Mail\Header\ContentType();
+                $message->getHeaders()->addHeader($contentTypeHeader);
+            }
+            $message->getHeaders()->get('content-type')->setType($messageType);
         }
-        $message->getHeaders()->get('content-type')->setType($messageType);
 
         $message->setEncoding('UTF-8');
 
@@ -300,6 +347,9 @@ class Sender
             } else {
                 $messageId = '' . md5($email->get('name')) . '/' . time() . '/' . $rand .  '@espo';
             }
+            if ($email->get('isSystem')) {
+                $messageId .= '-system';
+            }
 
             $messageIdHeader = new \Zend\Mail\Header\MessageId();
             $messageIdHeader->setId($messageId);
@@ -307,7 +357,7 @@ class Sender
 
             $this->transport->send($message);
 
-            $email->set('messageId', $messageId);
+            $email->set('messageId', '<' . $messageId . '>');
             $email->set('status', 'Sent');
             $email->set('dateSent', date("Y-m-d H:i:s"));
         } catch (\Exception $e) {