fix mail sender

* Implementing feature "Skip rebuild".

* fixes

.editorconfig

@@ -0,0 +1,11 @@
+# editorconfig.org
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+

.gitignore

@@ -4,17 +4,18 @@
 /data/preferences/*
 /data/.backup/*
 /data/config.php
+/data/tmp/*
 /build
 /node_modules
+npm-debug.log
 /test.php
 /main.html
-/client/css/espo.css
-/client/css/espo-vertical.css
-/client/css/sakura.css
-/client/css/sakura-vertical.css
-/client/css/violet.css
-/client/css/violet-vertical.css
-/tests/testData/cache/*
+
+/tests/unit/testData/cache/*
+!/tests/unit/testData/cache/.data
+/tests/integration/config.php
+.phpunit.result.cache
 composer.phar
 vendor/
-/custom/Espo/Custom/*
+/custom/Espo/Custom/*
+/install/config.php

.htaccess

@@ -9,19 +9,16 @@ DirectoryIndex index.php index.html
 
   # PROTECTED DIRECTORIES
   RewriteCond %{REQUEST_FILENAME} -d
-  RewriteRule ^/?(data|api)/ - [F]
+  RewriteRule ^/?(api|client)/ - [F]
 
-  RewriteRule ^/?data/config\.php$ - [F]
-  RewriteRule ^/?data/logs/ - [F]
-  RewriteRule ^/?data/cache/ - [F]
-  RewriteRule ^/?data/upload/ - [F]
-  RewriteRule ^/?data/\.backup/ - [F]
+  RewriteRule ^/?data/ - [F]
   RewriteRule ^/?application/ - [F]
   RewriteRule ^/?custom/ - [F]
   RewriteRule ^/?vendor/ - [F]
+  RewriteRule ^/?client/?$ - [F]
   #END PROTECTED DIRECTORIES
 
   RewriteRule .* - [E=HTTP_ESPO_CGI_AUTH:%{HTTP:Authorization}]
 
-  RewriteRule reset/?$ reset.html [QSA,L]
+  RewriteRule /?web\.config - [F]
 </IfModule>

CONTRIBUTING.md

@@ -1,3 +1,15 @@
+## Pull Requests
+
 Before we can merge your pull request you need to accept our CLA [here](https://github.com/espocrm/cla). It's very simple to do.
 
-[Code Style Guidelines](https://github.com/espocrm/espocrm/wiki/Code-Style-Guidelines).
+[Code Style Guidelines](https://github.com/espocrm/espocrm/wiki/Code-Style-Guidelines).
+
+Branches:
+
+* *hotfix/** – upcoming maintenance release; fixes should be pushed to this branch;
+* *master* – develop branch; new features should be pushed to this branch;
+* *stable* – last stable release.
+
+## Issues
+
+We don't provide developer help or any kind of support on github. Please use our [forum](https://forum.espocrm.com) for this.

Gruntfile.js

@@ -2,8 +2,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -18,6 +18,16 @@
  * You should have received a copy of the GNU General Public License
  * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
  ************************************************************************/
+
+ /**
+  * * `grunt` - full build
+  * * `grunt dev` - build only items needed for development (takes less time)
+  * * `grunt offline` - build but skip *composer install*
+  * * `grant release` - full build plus upgrade packages`
+  * * `grant test` - build for test running
+  * * `grant run-tests` - build and run unit and integratino tests
+  */
+
 module.exports = function (grunt) {
 
     var jsFilesToMinify = [
@@ -28,21 +38,95 @@ module.exports = function (grunt) {
         'client/lib/handlebars.js',
         'client/lib/base64.js',
         'client/lib/jquery-ui.min.js',
+        'client/lib/jquery.ui.touch-punch.min.js',
         'client/lib/moment.min.js',
-        'client/lib/moment-timezone-with-data.min.js',
+        'client/lib/moment-timezone.min.js',
+        'client/lib/moment-timezone-data.js',
         'client/lib/jquery.timepicker.min.js',
         'client/lib/jquery.autocomplete.js',
         'client/lib/bootstrap.min.js',
         'client/lib/bootstrap-datepicker.js',
-        'client/lib/bull.min.js',
+        'client/lib/bull.js',
+        'client/lib/marked.min.js',
+        'client/lib/autobahn.js',
+
         'client/src/namespace.js',
         'client/src/exceptions.js',
         'client/src/loader.js',
-        'client/src/utils.js'
+        'client/src/utils.js',
+
+        'client/src/acl.js',
+        'client/src/model.js',
+        'client/src/model-offline.js',
+        'client/src/ajax.js',
+        'client/src/controller.js',
+
+        'client/src/ui.js',
+        'client/src/acl-manager.js',
+        'client/src/cache.js',
+        'client/src/storage.js',
+        'client/src/models/settings.js',
+        'client/src/language.js',
+        'client/src/metadata.js',
+        'client/src/field-manager.js',
+        'client/src/models/user.js',
+        'client/src/models/preferences.js',
+        'client/src/model-factory.js',
+        'client/src/collection-factory.js',
+        'client/src/pre-loader.js',
+        'client/src/controllers/base.js',
+        'client/src/router.js',
+        'client/src/date-time.js',
+        'client/src/layout-manager.js',
+        'client/src/theme-manager.js',
+        'client/src/session-storage.js',
+        'client/src/view-helper.js',
+        'client/src/page-title.js',
+
+        'client/src/app.js'
     ];
 
+    function camelCaseToHyphen (string){
+        if (string == null) {
+            return string;
+        }
+        return string.replace(/([a-z])([A-Z])/g, '$1-$2').toLowerCase();
+    }
+
+    var fs = require('fs');
+    var cp = require('child_process');
+    var path = require('path');
+
+    var currentPath = path.dirname(fs.realpathSync(__filename));
+
+    var themeList = [];
+    fs.readdirSync('application/Espo/Resources/metadata/themes').forEach(function (file) {
+        themeList.push(file.substr(0, file.length - 5));
+    });
+
+    var cssminFilesData = {};
+    var lessData = {};
+    themeList.forEach(function (theme) {
+        var name = camelCaseToHyphen(theme);
+        var files = {};
+        files['client/css/espo/'+name+'.css'] = 'frontend/less/'+name+'/main.less';
+        files['client/css/espo/'+name+'-iframe.css'] = 'frontend/less/'+name+'/iframe/main.less';
+
+        cssminFilesData['client/css/espo/'+name+'.css'] = 'client/css/espo/'+name+'.css';
+        cssminFilesData['client/css/espo/'+name+'-iframe.css'] = 'client/css/espo/'+name+'-iframe.css';
+        var o = {
+            options: {
+                yuicompress: true,
+            },
+            files: files
+        };
+        lessData[theme] = o;
+    });
+
+    var pkg = grunt.file.readJSON('package.json');
+
     grunt.initConfig({
-        pkg: grunt.file.readJSON('package.json'),
+        pkg: pkg,
 
         mkdir: {
             tmp: {
@@ -56,71 +140,27 @@ module.exports = function (grunt) {
             }
         },
         clean: {
-            start: ['build/*'],
+            start: ['build/EspoCRM-*'],
             final: ['build/tmp'],
-        },
-        less: {
-            espo: {
-                options: {
-                    yuicompress: true,
-                },
-                files: {
-                    'client/css/espo.css': 'frontend/less/espo/main.less',
-                }
-            },
-            espoVertical: {
-                options: {
-                    yuicompress: true,
-                },
-                files: {
-                    'client/css/espo-vertical.css': 'frontend/less/espo-vertical/main.less',
-                }
-            },
-            sakura: {
-                options: {
-                    yuicompress: true,
-                },
-                files: {
-                    'client/css/sakura.css': 'frontend/less/sakura/main.less',
-                }
-            },
-            sakuraVertical: {
-                options: {
-                    yuicompress: true,
-                },
-                files: {
-                    'client/css/sakura-vertical.css': 'frontend/less/sakura-vertical/main.less',
-                }
-            },
-            violet: {
-                options: {
-                    yuicompress: true,
-                },
-                files: {
-                    'client/css/violet.css': 'frontend/less/violet/main.less',
-                }
-            },
-            violetVertical: {
-                options: {
-                    yuicompress: true,
-                },
-                files: {
-                    'client/css/violet-vertical.css': 'frontend/less/violet-vertical/main.less',
-                }
+            release: ['build/EspoCRM-' + pkg.version],
+            beforeFinal: {
+                src: [
+                    'build/tmp/custom/Espo/Custom/*',
+                    '!build/tmp/custom/Espo/Custom/.htaccess',
+                    'build/tmp/install/config.php',
+                ]
             }
         },
+        less: lessData,
         cssmin: {
-            minify: {
-                files: {
-                    'build/tmp/client/css/espo.css': [
-                        'client/css/espo.css',
-                    ]
-                }
-            },
+            themes: {
+                files: cssminFilesData
+            }
         },
         uglify: {
             options: {
                 mangle: false,
+                sourceMap: true,
                 banner: '/*! <%= pkg.name %> <%= grunt.template.today("yyyy-mm-dd") %> */\n',
             },
             'build/tmp/client/espo.min.js': jsFilesToMinify.map(function (item) {
@@ -128,6 +168,9 @@ module.exports = function (grunt) {
             })
         },
         copy: {
+            options: {
+                mode: true,
+            },
             frontendFolders: {
                 expand: true,
                 cwd: 'client',
@@ -144,10 +187,6 @@ module.exports = function (grunt) {
                 ],
                 dest: 'build/tmp/client',
             },
-            frontendHtml: {
-                src: 'frontend/reset.html',
-                dest: 'build/tmp/reset.html'
-            },
             frontendLib: {
                 expand: true,
                 dot: true,
@@ -169,10 +208,14 @@ module.exports = function (grunt) {
                     'html/**',
                     'bootstrap.php',
                     'cron.php',
+                    'daemon.php',
                     'rebuild.php',
                     'clear_cache.php',
                     'upgrade.php',
                     'extension.php',
+                    'websocket.php',
+                    'command.php',
+                    'oauth-callback.php',
                     'index.php',
                     'LICENSE.txt',
                     '.htaccess',
@@ -189,9 +232,6 @@ module.exports = function (grunt) {
             },
         },
         chmod: {
-            options: {
-                mode: '755'
-            },
             php: {
                 options: {
                     mode: '644'
@@ -214,32 +254,29 @@ module.exports = function (grunt) {
                 },
                 src: [
                     'build/EspoCRM-<%= pkg.version %>/install',
+                    'build/EspoCRM-<%= pkg.version %>/portal',
                     'build/EspoCRM-<%= pkg.version %>/api',
                     'build/EspoCRM-<%= pkg.version %>/api/v1',
-                ]
-            }
-        },
-        replace: {
-            timestamp: {
-                options: {
-                    patterns: [
-                        {
-                            match: 'timestamp',
-                            replacement: '<%= new Date().getTime() %>'
-                        }
-                    ]
-                },
-                files: [
-                    {
-                        src: 'build/tmp/html/main.html',
-                        dest: 'build/tmp/html/main.html'
-                    },
-                    {
-                        src: 'build/tmp/html/portal.html',
-                        dest: 'build/tmp/html/portal.html'
-                    }
+                    'build/EspoCRM-<%= pkg.version %>/api/v1/portal-access',
+                    'build/EspoCRM-<%= pkg.version %>',
                 ]
             },
+            foldersWritable: {
+                options: {
+                    mode: '775'
+                },
+                src: [
+                    'build/EspoCRM-<%= pkg.version %>/data',
+                    'build/EspoCRM-<%= pkg.version %>/custom',
+                    'build/EspoCRM-<%= pkg.version %>/custom/Espo',
+                    'build/EspoCRM-<%= pkg.version %>/custom/Espo/Custom',
+                    'build/EspoCRM-<%= pkg.version %>/client/custom',
+                    'build/EspoCRM-<%= pkg.version %>/client/modules',
+                    'build/EspoCRM-<%= pkg.version %>/application/Espo/Modules',
+                ]
+            },
+        },
+        replace: {
             version: {
                 options: {
                     patterns: [
@@ -257,17 +294,57 @@ module.exports = function (grunt) {
                 ]
             }
         },
-        compress: {
-            final: {
-                options: {
-                    archive: 'build/EspoCRM-<%= pkg.version %>.zip',
-                    mode: 'zip'
-                },
-                src: ['**'],
-                cwd: 'build/EspoCRM-<%= pkg.version %>',
-                dest: 'EspoCRM-<%= pkg.version %>'
-            }
-        }
+    });
+
+    grunt.registerTask("chmod-folders", function() {
+        cp.execSync("find . -type d -exec chmod 755 {} + ", {stdio: 'ignore', cwd: 'build/EspoCRM-' + pkg.version});
+    });
+
+    grunt.registerTask("composer", function() {
+        cp.execSync("composer install --ignore-platform-reqs --no-dev", {stdio: 'ignore'});
+    });
+
+    grunt.registerTask("composer-dev", function() {
+        cp.execSync("composer install --ignore-platform-reqs", {stdio: 'ignore'});
+    });
+
+    grunt.registerTask("upgrade", function() {
+        cp.execSync("node diff --all --vendor", {stdio: 'inherit'});
+    });
+
+    grunt.registerTask("unit-tests-run", function() {
+        cp.execSync("vendor/bin/phpunit --bootstrap=./vendor/autoload.php tests/unit", {stdio: 'inherit'});
+    });
+
+    grunt.registerTask("integration-tests-run", function() {
+        cp.execSync("vendor/bin/phpunit --bootstrap=./vendor/autoload.php tests/integration", {stdio: 'inherit'});
+    });
+
+    grunt.registerTask("zip", function() {
+        var fs = require('fs');
+
+        var resolve = this.async();
+
+        var folder = 'EspoCRM-' + pkg.version;
+
+        var zipPath = 'build/' + folder +'.zip';
+        if (fs.existsSync(zipPath)) fs.unlinkSync(zipPath);
+
+        var archiver = require('archiver');
+        var archive = archiver('zip');
+
+        archive.on('error', function (err) {
+            grunt.fail.warn(err);
+        });
+        var zipOutput = fs.createWriteStream(zipPath);
+        zipOutput.on('close', function () {
+            console.log("EspoCRM package has been built.");
+            resolve();
+        });
+
+        archive.directory(currentPath + '/build/' + folder, folder).pipe(zipOutput);
+
+        archive.finalize();
     });
 
     grunt.loadNpmTasks('grunt-contrib-clean');
@@ -277,23 +354,62 @@ module.exports = function (grunt) {
     grunt.loadNpmTasks('grunt-contrib-uglify');
     grunt.loadNpmTasks('grunt-contrib-copy');
     grunt.loadNpmTasks('grunt-replace');
-    grunt.loadNpmTasks('grunt-contrib-compress');
     grunt.loadNpmTasks('grunt-chmod');
 
-    grunt.registerTask('default', [
+    grunt.registerTask('offline', [
         'clean:start',
         'mkdir:tmp',
         'less',
         'cssmin',
         'uglify',
         'copy:frontendFolders',
-        'copy:frontendHtml',
         'copy:frontendLib',
         'copy:backend',
         'replace',
+        'clean:beforeFinal',
         'copy:final',
-        'chmod',
+        'chmod-folders',
+        'chmod:php',
+        'chmod:folders',
+        'chmod:foldersWritable',
         'clean:final',
     ]);
 
+    grunt.registerTask('default', [
+        'composer',
+        'offline',
+    ]);
+
+    grunt.registerTask('release', [
+        'default',
+        'upgrade',
+        'zip',
+        'clean:release',
+    ]);
+
+    grunt.registerTask('run-tests', [
+        'test',
+        'unit-tests-run',
+        'integration-tests-run',
+    ]);
+
+    grunt.registerTask('run-unit-tests', [
+        'composer-dev',
+        'unit-tests-run',
+    ]);
+
+    grunt.registerTask('run-integration-tests', [
+        'test',
+        'integration-tests-run',
+    ]);
+
+    grunt.registerTask('dev', [
+        'composer-dev',
+        'less',
+    ]);
+
+    grunt.registerTask('test', [
+        'composer-dev',
+        'offline',
+    ]);
 };

README.md

@@ -1,65 +1,46 @@
 ## EspoCRM
 
-<a href='http://www.espocrm.com'>EspoCRM is an Open Source CRM</a> (Customer Relationship Management) software that allows you to see, enter and evaluate all your company relationships regardless of the type. People, companies or opportunities - all in an easy and intuitive interface.
+[EspoCRM is an Open Source CRM](https://www.espocrm.com) (Customer Relationship Management) software that allows you to see, enter and evaluate all your company relationships regardless of the type. People, companies or opportunities - all in an easy and intuitive interface.
 
-It's a web application with a frontend designed as a single page application based on backbone.js and a REST API backend written in PHP.
+It's a web application with a frontend designed as a single page application and REST API backend written in PHP.
 
-Download the latest release from our [website](http://www.espocrm.com).
+[Download](https://www.espocrm.com/download/) the latest release from our website.
 
 ### Requirements
 
-* PHP 5.4 or above (with pdo, json, gd, mcrypt extensions);
-* MySQL 5.1 or above.
+* PHP 7.2 and later (with pdo, json, gd, openssl, zip, imap, mbstring, curl extensions);
+* MySQL 5.7 (and later), or MariaDB 10.1 (and later).
 
-For more information about server configuration see [this article](http://blog.espocrm.com/administration/server-configuration-for-espocrm/).
+For more information about server configuration see [this article](https://docs.espocrm.com/administration/server-configuration/).
 
-### How to report bug
+### Documentation
 
-Create an issue [here](https://github.com/espocrm/espocrm/issues) or post on our [forum](http://forum.espocrm.com/bug-reports?routestring=forum/bug-reports).
+Documentation for administrators, users and developers is available [here](https://docs.espocrm.com).
 
-### How to get started (for developers)
+### How to report a bug
 
-1. Clone repository to your local computer.
-2. Change to the project's root directory.
-3. Install [composer](https://getcomposer.org/doc/00-intro.md).
-4. Run `composer install` if composer is installed globally or `php composer.phar install` if locally.
+Create an issue [here](https://github.com/espocrm/espocrm/issues) or post on our [forum](http://forum.espocrm.com/forum/bug-reports).
 
-Never update composer dependencies if you are going to contribute code back.
+### How to install a stable version
 
-Now you can build. Build will create compiled css files.
+[Download](https://www.espocrm.com/download/) the latest version. See the [instructions](https://docs.espocrm.com/administration/installation/) about installation.
 
-To compose a proper config.php and populate database you can run install by opening `http(s)://{YOUR_CRM_URL}/install` location in a browser. Then open `data/config.php` file and add `isDeveloperMode => true`.
+### Development
 
-### How to build
-
-You need to have nodejs and Grunt CLI installed.
-
-1. Change to the project's root directory.
-2. Install project dependencies with `npm install`.
-3. Run Grunt with `grunt`.
-
-The build will be created in the `build` directory.
+* [Getting started](https://docs.espocrm.com/development/how-to-start)
+* [Running tests](https://docs.espocrm.com/development/tests)
+* [Making translation](https://docs.espocrm.com/development/translation)
 
 ### How to contribute
 
 Before we can merge your pull request you need to accept our CLA [here](https://github.com/espocrm/cla). It's very simple to do.
 
-### How to make a translation
+Branches:
 
-Build po file with command:
-`node po.js en_EN`
-(specify needed language instead of en_EN)
-
-After that translate the generated po file.
-
-Build json files from the translated po file:
-
-1. Put your po file espocrm-en_EN.po into `build` directory
-2. Run `node lang.js en_EN`
-
-Json files will be created in build directory grouped by folders.
+* *hotfix/** – upcoming maintenance release; fixes should be pushed to this branch;
+* *master* – develop branch; new features should be pushed to this branch;
+* *stable* – last stable release.
 
 ### License
 
 EspoCRM is published under the GNU GPLv3 [license](https://raw.githubusercontent.com/espocrm/espocrm/master/LICENSE.txt).
-

SECURITY.md

@@ -0,0 +1,9 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+If you believe you have discovered a vulnerability in EspoCRM please contacts us via [this](https://www.espocrm.com/contacts/) or [this](https://www.espocrm.com/support/) forms.
+
+## Supported versions
+
+For severe vulnerabilities we provide fixes for 2 minor versions (the second number in the version string) back from the current stable version. Separate patches or manual fix guidelines will be provided for more old versions.

api/v1/.htaccess

@@ -9,4 +9,6 @@ RewriteEngine On
 RewriteRule .* - [E=HTTP_ESPO_CGI_AUTH:%{HTTP:Authorization}]
 
 RewriteCond %{REQUEST_FILENAME} !-f
-RewriteRule ^ index.php [QSA,L]
+RewriteRule ^ index.php [QSA,L]
+
+RewriteRule /?web\.config - [F]

api/v1/index.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

api/v1/portal-access/.htaccess

@@ -9,4 +9,6 @@ RewriteEngine On
 RewriteRule .* - [E=HTTP_ESPO_CGI_AUTH:%{HTTP:Authorization}]
 
 RewriteCond %{REQUEST_FILENAME} !-f
-RewriteRule ^ index.php [QSA,L]
+RewriteRule ^ index.php [QSA,L]
+
+RewriteRule /?web\.config - [F]

api/v1/portal-access/index.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

application/Espo/Acl/ActionHistoryRecord.php

@@ -0,0 +1,42 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Acl;
+
+use \Espo\Entities\User as EntityUser;
+use \Espo\ORM\Entity;
+
+class ActionHistoryRecord extends \Espo\Core\Acl\Base
+{
+    public function checkIsOwner(EntityUser $user, Entity $entity)
+    {
+        return $entity->get('userId') === $user->id;
+    }
+}
+

application/Espo/Acl/Attachment.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -29,12 +29,12 @@
 
 namespace Espo\Acl;
 
-use \Espo\Entities\User;
+use \Espo\Entities\User as EntityUser;
 use \Espo\ORM\Entity;
 
 class Attachment extends \Espo\Core\Acl\Base
 {
-    public function checkEntityRead(User $user, Entity $entity, $data)
+    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
     {
         if ($user->isAdmin()) {
             return true;
@@ -82,7 +82,7 @@ class Attachment extends \Espo\Core\Acl\Base
         return false;
     }
 
-    public function checkIsOwner(User $user, Entity $entity)
+    public function checkIsOwner(EntityUser $user, Entity $entity)
     {
         if ($user->id === $entity->get('createdById')) {
             return true;

application/Espo/Acl/Email.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -29,13 +29,14 @@
 
 namespace Espo\Acl;
 
-use \Espo\Entities\User;
+use \Espo\Entities\User as EntityUser;
 use \Espo\ORM\Entity;
 
 class Email extends \Espo\Core\Acl\Base
 {
+    protected $ownerUserIdAttribute = 'usersIds';
 
-    public function checkEntityRead(User $user, Entity $entity, $data)
+    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
     {
         if ($this->checkEntity($user, $entity, $data, 'read')) {
             return true;
@@ -60,7 +61,7 @@ class Email extends \Espo\Core\Acl\Base
         return false;
     }
 
-    public function checkIsOwner(User $user, Entity $entity)
+    public function checkIsOwner(EntityUser $user, Entity $entity)
     {
         if ($user->id === $entity->get('assignedUserId')) {
             return true;
@@ -76,5 +77,45 @@ class Email extends \Espo\Core\Acl\Base
 
         return false;
     }
-}
 
+    public function checkEntityDelete(EntityUser $user, Entity $entity, $data)
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if ($data === false) {
+            return false;
+        }
+
+        if ($data->delete === 'own') {
+            if ($user->id === $entity->get('assignedUserId')) {
+                return true;
+            }
+
+            if ($user->id === $entity->get('createdById')) {
+                return true;
+            }
+
+            $assignedUserIdList = $entity->getLinkMultipleIdList('assignedUsers');
+            if (count($assignedUserIdList) === 1 && $entity->hasLinkMultipleId('assignedUsers', $user->id)) {
+                return true;
+            }
+            return false;
+        }
+
+        if ($this->checkEntity($user, $entity, $data, 'delete')) {
+            return true;
+        }
+
+        if ($data->edit !== 'no' || $data->create !== 'no') {
+            if ($entity->get('createdById') === $user->id) {
+                if ($entity->get('status') !== 'Sent' && $entity->get('status') !== 'Archived') {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+}

application/Espo/Acl/EmailAddress.php

@@ -0,0 +1,65 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Acl;
+
+use \Espo\Entities\User as EntityUser;
+use \Espo\ORM\Entity;
+
+class EmailAddress extends \Espo\Core\Acl\Base
+{
+    public function checkEditInEntity(EntityUser $user, Entity $entity, Entity $excludeEntity)
+    {
+        $id = $entity->id;
+
+        $isFobidden = false;
+
+        $repository = $this->getEntityManager()->getRepository('EmailAddress');
+
+        if (!$user->isAdmin()) {
+            $entityWithSameAddressList = $repository->getEntityListByAddressId($id, $excludeEntity);
+            foreach ($entityWithSameAddressList as $e) {
+                if (!$this->getAclManager()->check($user, $e, 'edit')) {
+                    $isFobidden = true;
+                    if (
+                        $e->getEntityType() === 'User' &&
+                        $e->isPortal() &&
+                        $excludeEntity->getEntityType() === 'Contact' &&
+                        $e->get('contactId') === $excludeEntity->id
+                    ) {
+                        $isFobidden = false;
+                    }
+                    if ($isFobidden) break;
+                }
+            }
+        }
+        return !$isFobidden;
+    }
+}
+

application/Espo/Acl/EmailFilter.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -29,12 +29,12 @@
 
 namespace Espo\Acl;
 
-use \Espo\Entities\User;
+use \Espo\Entities\User as EntityUser;
 use \Espo\ORM\Entity;
 
 class EmailFilter extends \Espo\Core\Acl\Base
 {
-    public function checkIsOwner(User $user, Entity $entity)
+    public function checkIsOwner(EntityUser $user, Entity $entity)
     {
         if ($entity->has('parentId') && $entity->has('parentType')) {
             $parentType = $entity->get('parentType');
@@ -42,11 +42,14 @@ class EmailFilter extends \Espo\Core\Acl\Base
             if (!$parentType || !$parentId) return;
 
             $parent = $this->getEntityManager()->getEntity($parentType, $parentId);
+
+            if ($parent->getEntityType() === 'User') {
+                return $parent->id === $user->id;
+            }
             if ($parent && $parent->has('assignedUserId') && $parent->get('assignedUserId') === $user->id) {
                 return true;
             }
         }
-
         return;
     }
 }

application/Espo/Acl/Import.php

@@ -0,0 +1,53 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Acl;
+
+use \Espo\Entities\User as EntityUser;
+use \Espo\ORM\Entity;
+
+class Import extends \Espo\Core\Acl\Base
+{
+
+    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
+    {
+        if ($user->isAdmin()) return true;
+        if ($user->id === $entity->get('createdById')) return true;
+
+        return false;
+    }
+
+    public function checkEntityDelete(EntityUser $user, Entity $entity, $data)
+    {
+        if ($user->isAdmin()) return true;
+        if ($user->id === $entity->get('createdById')) return true;
+
+        return false;
+    }
+}

application/Espo/Acl/Note.php

@@ -0,0 +1,119 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Acl;
+
+use \Espo\Entities\User as EntityUser;
+use \Espo\ORM\Entity;
+
+class Note extends \Espo\Core\Acl\Base
+{
+    protected $deleteThresholdPeriod = '1 month';
+
+    protected $editThresholdPeriod = '7 days';
+
+    public function checkIsOwner(EntityUser $user, Entity $entity)
+    {
+        if ($entity->get('type') === 'Post' && $user->id === $entity->get('createdById')) {
+            return true;
+        }
+        return false;
+    }
+
+    public function checkEntityCreate(EntityUser $user, Entity $entity, $data)
+    {
+        if ($entity->get('parentId') && $entity->get('parentType')) {
+            $parent = $this->getEntityManager()->getEntity($entity->get('parentType'), $entity->get('parentId'));
+            if ($parent) {
+                if ($this->getAclManager()->checkEntity($user, $parent, 'stream')) {
+                    return true;
+                }
+            }
+            return false;
+        }
+
+        return true;
+    }
+
+    public function checkEntityEdit(EntityUser $user, Entity $entity, $data)
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if ($this->checkEntity($user, $entity, $data, 'edit')) {
+            if ($this->checkIsOwner($user, $entity)) {
+                $createdAt = $entity->get('createdAt');
+                if ($createdAt) {
+                    $noteEditThresholdPeriod = '-' . $this->getConfig()->get('noteEditThresholdPeriod', $this->editThresholdPeriod);
+                    $dt = new \DateTime();
+                    $dt->modify($noteEditThresholdPeriod);
+                    try {
+                        if ($dt->format('U') > (new \DateTime($createdAt))->format('U')) {
+                            return false;
+                        }
+                    } catch (\Exception $e) {
+                        return false;
+                    }
+                }
+            }
+            return true;
+        }
+
+        return false;
+    }
+
+    public function checkEntityDelete(EntityUser $user, Entity $entity, $data)
+    {
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        if ($this->checkEntity($user, $entity, $data, 'delete')) {
+            if ($this->checkIsOwner($user, $entity)) {
+                $createdAt = $entity->get('createdAt');
+                if ($createdAt) {
+                    $deleteThresholdPeriod = '-' . $this->getConfig()->get('noteDeleteThresholdPeriod', $this->deleteThresholdPeriod);
+                    $dt = new \DateTime();
+                    $dt->modify($deleteThresholdPeriod);
+                    try {
+                        if ($dt->format('U') > (new \DateTime($createdAt))->format('U')) {
+                            return false;
+                        }
+                    } catch (\Exception $e) {
+                        return false;
+                    }
+                }
+            }
+            return true;
+        }
+
+        return false;
+    }
+}

application/Espo/Acl/Notification.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -29,12 +29,12 @@
 
 namespace Espo\Acl;
 
-use \Espo\Entities\User;
+use \Espo\Entities\User as EntityUser;
 use \Espo\ORM\Entity;
 
 class Notification extends \Espo\Core\Acl\Base
 {
-    public function checkIsOwner(User $user, Entity $entity)
+    public function checkIsOwner(EntityUser $user, Entity $entity)
     {
         if ($user->id === $entity->get('userId')) {
             return true;

application/Espo/Acl/PhoneNumber.php

@@ -0,0 +1,65 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Acl;
+
+use \Espo\Entities\User as EntityUser;
+use \Espo\ORM\Entity;
+
+class PhoneNumber extends \Espo\Core\Acl\Base
+{
+    public function checkEditInEntity(EntityUser $user, Entity $entity, Entity $excludeEntity)
+    {
+        $id = $entity->id;
+
+        $isFobidden = false;
+
+        $repository = $this->getEntityManager()->getRepository('PhoneNumber');
+
+        if (!$user->isAdmin()) {
+            $entityWithSameNumberList = $repository->getEntityListByPhoneNumberId($id, $excludeEntity);
+            foreach ($entityWithSameNumberList as $e) {
+                if (!$this->getAclManager()->check($user, $e, 'edit')) {
+                    $isFobidden = true;
+                    if (
+                        $e->getEntityType() === 'User' &&
+                        $e->isPortal() &&
+                        $excludeEntity->getEntityType() === 'Contact' &&
+                        $e->get('contactId') === $excludeEntity->id
+                    ) {
+                        $isFobidden = false;
+                    }
+                    if ($isFobidden) break;
+                }
+            }
+        }
+
+        return !$isFobidden;
+    }
+}

application/Espo/Acl/ScheduledJob.php

@@ -0,0 +1,61 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Acl;
+
+use \Espo\Entities\User as EntityUser;
+use \Espo\ORM\Entity;
+
+class ScheduledJob extends \Espo\Core\Acl\Base
+{
+    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
+    {
+        if ($entity->get('isInternal')) return false;
+        return $this->checkEntity($user, $entity, $data, 'read');
+    }
+
+    public function checkEntityEdit(EntityUser $user, Entity $entity, $data)
+    {
+        if ($entity->get('isInternal')) return false;
+        return $this->checkEntity($user, $entity, $data, 'edit');
+    }
+
+    public function checkEntityDelete(EntityUser $user, Entity $entity, $data)
+    {
+        if ($entity->get('isInternal')) return false;
+        return $this->checkEntity($user, $entity, $data, 'delete');
+    }
+
+    public function checkEntityCreate(EntityUser $user, Entity $entity, $data)
+    {
+        if ($entity->get('isInternal')) return false;
+        return $this->checkEntity($user, $entity, $data, 'create');
+    }
+}
+

application/Espo/Acl/Team.php

@@ -0,0 +1,41 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Acl;
+
+use \Espo\ORM\Entity;
+
+class Team extends \Espo\Core\Acl\Base
+{
+    public function checkInTeam(\Espo\Entities\User $user, Entity $entity)
+    {
+        $userTeamIdList = $user->getLinkMultipleIdList('teams');
+        return in_array($entity->id, $userTeamIdList);
+    }
+}

application/Espo/Acl/User.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -30,6 +30,7 @@
 namespace Espo\Acl;
 
 use \Espo\ORM\Entity;
+use \Espo\Entities\User as EntityUser;
 
 class User extends \Espo\Core\Acl\Base
 {
@@ -37,5 +38,61 @@ class User extends \Espo\Core\Acl\Base
     {
         return $user->id === $entity->id;
     }
-}
 
+    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
+    {
+        if (!$user->isAdmin() && $entity->isPortal()) {
+            if ($this->getAclManager()->get($user, 'portalPermission') === 'yes') {
+                return true;
+            }
+        }
+        return $this->checkEntity($user, $entity, $data, 'read');
+    }
+
+    public function checkEntityCreate(EntityUser $user, Entity $entity, $data)
+    {
+        if (!$user->isAdmin()) {
+            return false;
+        }
+        if ($entity->isSuperAdmin() && !$user->isSuperAdmin()) {
+            return false;
+        }
+        return $this->checkEntity($user, $entity, $data, 'create');
+    }
+
+    public function checkEntityDelete(EntityUser $user, Entity $entity, $data)
+    {
+        if ($entity->id === 'system') {
+            return false;
+        }
+        if (!$user->isAdmin()) {
+            return false;
+        }
+        if ($entity->isSystem()) {
+            return false;
+        }
+        if ($entity->isSuperAdmin() && !$user->isSuperAdmin()) {
+            return false;
+        }
+        return parent::checkEntityDelete($user, $entity, $data);
+    }
+
+    public function checkEntityEdit(EntityUser $user, Entity $entity, $data)
+    {
+        if ($entity->id === 'system') {
+            return false;
+        }
+        if ($entity->isSystem()) {
+            return false;
+        }
+        if (!$user->isAdmin()) {
+            if ($user->id !== $entity->id) {
+                return false;
+            }
+        }
+        if ($entity->isSuperAdmin() && !$user->isSuperAdmin()) {
+            return false;
+        }
+        return $this->checkEntity($user, $entity, $data, 'edit');
+    }
+}

application/Espo/Acl/Webhook.php

@@ -0,0 +1,73 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Acl;
+
+use \Espo\Entities\User as EntityUser;
+use \Espo\ORM\Entity;
+
+class Webhook extends \Espo\Core\Acl\Base
+{
+    public function checkIsOwner(EntityUser $user, Entity $entity)
+    {
+        return $user->id === $entity->get('userId') && $user->isApi();
+    }
+
+    public function checkEntityCreate(EntityUser $user, Entity $entity, $data)
+    {
+        if ($user->isAdmin()) return true;
+        if (!$data) return false;
+        if ($user->isApi() && $user->id === $entity->get('userId')) return true;
+        return false;
+    }
+
+    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
+    {
+        if ($user->isAdmin()) return true;
+        if (!$data) return false;
+        if ($user->isApi() && $user->id === $entity->get('userId')) return true;
+        return false;
+    }
+
+    public function checkEntityDelete(EntityUser $user, Entity $entity, $data)
+    {
+        if ($user->isAdmin()) return true;
+        if (!$data) return false;
+        if ($user->isApi() && $user->id === $entity->get('userId')) return true;
+        return false;
+    }
+
+    public function checkEntityEdit(EntityUser $user, Entity $entity, $data)
+    {
+        if ($user->isAdmin()) return true;
+        if (!$data) return false;
+        if ($user->isApi() && $user->id === $entity->get('userId')) return true;
+        return false;
+    }
+}

application/Espo/AclPortal/Attachment.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -29,12 +29,12 @@
 
 namespace Espo\AclPortal;
 
-use \Espo\Entities\User;
+use \Espo\Entities\User as EntityUser;
 use \Espo\ORM\Entity;
 
 class Attachment extends \Espo\Core\AclPortal\Base
 {
-    public function checkEntityRead(User $user, Entity $entity, $data)
+    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
     {
         if ($user->isAdmin()) {
             return true;
@@ -82,7 +82,7 @@ class Attachment extends \Espo\Core\AclPortal\Base
         return false;
     }
 
-    public function checkIsOwner(User $user, Entity $entity)
+    public function checkIsOwner(EntityUser $user, Entity $entity)
     {
         if ($user->id === $entity->get('createdById')) {
             return true;

application/Espo/AclPortal/Email.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -29,13 +29,14 @@
 
 namespace Espo\AclPortal;
 
-use \Espo\Entities\User;
+use \Espo\Entities\User as EntityUser;
 use \Espo\ORM\Entity;
 
 class Email extends \Espo\Core\AclPortal\Base
 {
+    protected $ownerUserIdAttribute = 'usersIds';
 
-    public function checkEntityRead(User $user, Entity $entity, $data)
+    public function checkEntityRead(EntityUser $user, Entity $entity, $data)
     {
         if ($this->checkEntity($user, $entity, $data, 'read')) {
             return true;
@@ -60,7 +61,7 @@ class Email extends \Espo\Core\AclPortal\Base
         return false;
     }
 
-    public function checkIsOwner(User $user, Entity $entity)
+    public function checkIsOwner(EntityUser $user, Entity $entity)
     {
         if ($user->id === $entity->get('createdById')) {
             return true;

application/Espo/AclPortal/EmailAddress.php

@@ -0,0 +1,56 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\AclPortal;
+
+use \Espo\Entities\User as EntityUser;
+use \Espo\ORM\Entity;
+
+class EmailAddress extends \Espo\Core\AclPortal\Base
+{
+    public function checkEditInEntity(EntityUser $user, Entity $entity, Entity $excludeEntity)
+    {
+        $id = $entity->id;
+
+        $isFobidden = false;
+
+        $repository = $this->getEntityManager()->getRepository('EmailAddress');
+
+        if (!$user->isAdmin()) {
+            $entityWithSameAddressList = $repository->getEntityListByAddressId($id, $excludeEntity);
+            foreach ($entityWithSameAddressList as $e) {
+                if (!$this->getAclManager()->check($user, $e, 'edit')) {
+                    $isFobidden = true;
+                    break;
+                }
+            }
+        }
+        return !$isFobidden;
+    }
+}

application/Espo/AclPortal/Note.php

@@ -0,0 +1,66 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\AclPortal;
+
+use \Espo\Entities\User as EntityUser;
+use \Espo\ORM\Entity;
+
+class Note extends \Espo\Core\AclPortal\Base
+{
+    public function checkIsOwner(EntityUser $user, Entity $entity)
+    {
+        if ($entity->get('type') === 'Post' && $user->id === $entity->get('createdById')) {
+            return true;
+        }
+        return false;
+    }
+
+    public function checkEntityCreate(EntityUser $user, Entity $entity, $data)
+    {
+        if ($entity->get('type') !== 'Post') return false;
+
+        if ($entity->get('type') === 'Post' && $entity->get('targetType')) {
+            return false;
+        }
+
+        if (!$entity->get('parentId') || !$entity->get('parentType')) {
+            return false;
+        }
+
+        $parent = $this->getEntityManager()->getEntity($entity->get('parentType'), $entity->get('parentId'));
+        if ($parent) {
+            if ($this->getAclManager()->checkEntity($user, $parent, 'stream')) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}

application/Espo/AclPortal/Notification.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -29,12 +29,12 @@
 
 namespace Espo\AclPortal;
 
-use \Espo\Entities\User;
+use \Espo\Entities\User as EntityUser;
 use \Espo\ORM\Entity;
 
 class Notification extends \Espo\Core\AclPortal\Base
 {
-    public function checkIsOwner(User $user, Entity $entity)
+    public function checkIsOwner(EntityUser $user, Entity $entity)
     {
         if ($user->id === $entity->get('userId')) {
             return true;

application/Espo/AclPortal/PhoneNumber.php

@@ -0,0 +1,57 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\AclPortal;
+
+use \Espo\Entities\User as EntityUser;
+use \Espo\ORM\Entity;
+
+class PhoneNumber extends \Espo\Core\AclPortal\Base
+{
+    public function checkEditInEntity(EntityUser $user, Entity $entity, Entity $excludeEntity)
+    {
+        $id = $entity->id;
+
+        $isFobidden = false;
+
+        $repository = $this->getEntityManager()->getRepository('PhoneNumber');
+
+        if (!$user->isAdmin()) {
+            $entityWithSameNumberList = $repository->getEntityListByPhoneNumberId($id, $excludeEntity);
+            foreach ($entityWithSameNumberList as $e) {
+                if (!$this->getAclManager()->check($user, $e, 'edit')) {
+                    $isFobidden = true;
+                    break;
+                }
+            }
+        }
+
+        return !$isFobidden;
+    }
+}

application/Espo/AclPortal/User.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

application/Espo/Controllers/ActionHistoryRecord.php

@@ -0,0 +1,70 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\Forbidden;
+
+class ActionHistoryRecord extends \Espo\Core\Controllers\Record
+{
+    public function beforeUpdate()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeCreate()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeListLinked()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeMassUpdate()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeCreateLink()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeRemoveLink()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeMassConvertCurrency()
+    {
+        throw new Forbidden();
+    }
+}

application/Espo/Controllers/Admin.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -53,7 +53,7 @@ class Admin extends \Espo\Core\Controllers\Base
         return $result;
     }
 
-    public function postActionClearCache($params, $data)
+    public function postActionClearCache($params)
     {
         $result = $this->getContainer()->get('dataManager')->clearCache();
         return $result;
@@ -63,13 +63,13 @@ class Admin extends \Espo\Core\Controllers\Base
     {
         $scheduledJob = $this->getContainer()->get('scheduledJob');
 
-        return $scheduledJob->getAllNamesOnly();
+        return $scheduledJob->getAvailableList();
     }
 
     public function postActionUploadUpgradePackage($params, $data)
     {
         if ($this->getConfig()->get('restrictedMode')) {
-            if (!$this->getUser()->get('isSuperAdmin')) {
+            if (!$this->getUser()->isSuperAdmin()) {
                 throw new Forbidden();
             }
         }
@@ -87,21 +87,31 @@ class Admin extends \Espo\Core\Controllers\Base
     public function postActionRunUpgrade($params, $data)
     {
         if ($this->getConfig()->get('restrictedMode')) {
-            if (!$this->getUser()->get('isSuperAdmin')) {
+            if (!$this->getUser()->isSuperAdmin()) {
                 throw new Forbidden();
             }
         }
 
         $upgradeManager = new \Espo\Core\UpgradeManager($this->getContainer());
-        $upgradeManager->install($data);
+        $upgradeManager->install(get_object_vars($data));
 
         return true;
     }
 
-    public function actionCronMessage($params, $data)
+    public function actionCronMessage($params)
     {
         return $this->getContainer()->get('scheduledJob')->getSetupMessage();
     }
 
-}
+    public function actionAdminNotificationList($params)
+    {
+        $adminNotificationManager = new \Espo\Core\Utils\AdminNotificationManager($this->getContainer());
+        return $adminNotificationManager->getNotificationList();
+    }
 
+    public function actionSystemRequirementList($params)
+    {
+        $systemRequirementManager = new \Espo\Core\Utils\SystemRequirements($this->getContainer());
+        return $systemRequirementManager->getAllRequiredList();
+    }
+}

application/Espo/Controllers/App.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -35,35 +35,16 @@ class App extends \Espo\Core\Controllers\Base
 {
     public function actionUser()
     {
-        $preferences = $this->getPreferences()->getValues();
-        unset($preferences['smtpPassword']);
-
-        $user = $this->getUser();
-        if (!$user->has('teamsIds')) {
-            $user->loadLinkMultipleField('teams');
-        }
-        if ($user->get('isPortalUser')) {
-            $user->loadAccountField();
-            $user->loadLinkMultipleField('accounts');
-        }
-
-        return array(
-            'user' => $user->getValues(),
-            'acl' => $this->getAcl()->getMap(),
-            'preferences' => $preferences,
-            'token' => $this->getUser()->get('token')
-        );
+        return $this->getServiceFactory()->create('App')->getUserData();
     }
 
     public function postActionDestroyAuthToken($params, $data)
     {
-        $token = $data['token'];
-        if (empty($token)) {
+        if (empty($data->token)) {
             throw new BadRequest();
         }
 
         $auth = new \Espo\Core\Utils\Auth($this->getContainer());
-        return $auth->destroyAuthToken($token);
+        return $auth->destroyAuthToken($data->token);
     }
 }
-

application/Espo/Controllers/Attachment.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -34,27 +34,44 @@ use \Espo\Core\Exceptions\BadRequest;
 
 class Attachment extends \Espo\Core\Controllers\Record
 {
-    public function actionUpload($params, $data, $request)
+    public function actionList($params, $data, $request)
     {
-        if (!$request->isPost()) {
-            throw new BadRequest();
-        }
-
-        if (!$this->getAcl()->checkScope('Attachment', 'create')) {
+        if (!$this->getUser()->isAdmin()) {
             throw new Forbidden();
         }
-
-        list($prefix, $contents) = explode(',', $data);
-        $contents = base64_decode($contents);
-
-        $attachment = $this->getEntityManager()->getEntity('Attachment');
-        $this->getEntityManager()->saveEntity($attachment);
-        $this->getContainer()->get('fileManager')->putContents('data/upload/' . $attachment->id, $contents);
-
-        return array(
-            'attachmentId' => $attachment->id
-        );
+        return parent::actionList($params, $data, $request);
     }
 
-}
+    public function postActionGetAttachmentFromImageUrl($params, $data)
+    {
+        if (empty($data->url)) throw new BadRequest();
+        if (empty($data->field)) throw new BadRequest('postActionGetAttachmentFromImageUrl: No field specified');
 
+        return $this->getRecordService()->getAttachmentFromImageUrl($data)->getValueMap();
+    }
+
+    public function postActionGetCopiedAttachment($params, $data)
+    {
+        if (empty($data->id)) throw new BadRequest();
+        if (empty($data->field)) throw new BadRequest('postActionGetCopiedAttachment copy: No field specified');
+
+        return $this->getRecordService()->getCopiedAttachment($data)->getValueMap();
+    }
+
+    public function getActionFile($params, $data, $request, $response)
+    {
+        $id = $params['id'] ?? null;
+
+        if (!$id) throw new BadRequest();
+
+        $fileData = $this->getRecordService()->getFileData($id);
+
+        $response->headers->set('Content-Type', $fileData->type);
+        $response->headers->set('Content-Disposition', 'Content-Disposition: attachment; filename="'.$fileData->name.'"');
+        if ($fileData->size) {
+            $response->headers->set('Content-Length', $fileData->size);
+        }
+
+        return $fileData->contents;
+    }
+}

application/Espo/Controllers/AuthLogRecord.php

@@ -0,0 +1,72 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\Forbidden;
+
+class AuthLogRecord extends \Espo\Core\Controllers\Record
+{
+    protected function checkControllerAccess()
+    {
+        if (!$this->getUser()->isAdmin()) {
+            throw new Forbidden();
+        }
+    }
+
+    public function beforeUpdate()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeMassUpdate()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeCreate()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeCreateLink()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeRemoveLink()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeMassConvertCurrency()
+    {
+        throw new Forbidden();
+    }
+}

application/Espo/Controllers/AuthToken.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -40,34 +40,63 @@ class AuthToken extends \Espo\Core\Controllers\Record
         }
     }
 
-    public function actionUpdate($params, $data)
+    public function actionUpdate($params, $data, $request)
+    {
+        $dataAr = get_object_vars($data);
+
+        if (
+            is_object($data)
+            &&
+            isset($data->isActive)
+            &&
+            $data->isActive === false
+            &&
+            count(array_keys($dataAr)) === 1
+        ) {
+            return parent::actionUpdate($params, $data, $request);
+        }
+        throw new Forbidden();
+    }
+
+    public function actionMassUpdate($params, $data, $request)
+    {
+        if (empty($data->attributes)) {
+            throw new BadRequest();
+        }
+
+        $attributes = $data->attributes;
+
+        if (
+            is_object($attributes)
+            &&
+            isset($attributes->isActive)
+            &&
+            $attributes->isActive === false
+            &&
+            count(array_keys(get_object_vars($attributes))) === 1
+        ) {
+            return parent::actionMassUpdate($params, $data, $request);
+        }
+        throw new Forbidden();
+    }
+
+    public function beforeCreate()
     {
         throw new Forbidden();
     }
 
-    public function actionCreate($params, $data)
+    public function beforeCreateLink()
     {
         throw new Forbidden();
     }
 
-    public function actionListLinked($params, $data)
+    public function beforeRemoveLink()
     {
         throw new Forbidden();
     }
 
-    public function actionMassUpdate($params, $data)
-    {
-        throw new Forbidden();
-    }
-
-    public function actionCreateLink($params, $data)
-    {
-        throw new Forbidden();
-    }
-
-    public function actionRemoveLink($params, $data)
+    public function beforeMassConvertCurrency()
     {
         throw new Forbidden();
     }
 }
-

application/Espo/Controllers/CurrencyRate.php

@@ -0,0 +1,59 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Exceptions\BadRequest;
+
+class CurrencyRate extends \Espo\Core\Controllers\Base
+{
+    protected function checkControllerAccess()
+    {
+        if (!$this->getAcl()->check('Currency')) {
+            throw new Forbidden();
+        }
+    }
+
+    public function getActionIndex()
+    {
+        if ($this->getAcl()->getLevel('Currency', 'read') !== 'yes') throw new Forbidden();
+
+        return $this->getService('CurrencyRate')->get();
+    }
+
+    public function putActionUpdate($params, $data)
+    {
+        if ($this->getAcl()->getLevel('Currency', 'edit') !== 'yes') throw new Forbidden();
+
+        if (empty($data) || !is_object($data)) throw new BadRequest();
+
+        return $this->getService('CurrencyRate')->set($data);
+    }
+}

application/Espo/Controllers/DashboardTemplate.php

@@ -0,0 +1,67 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\BadRequest;
+
+class DashboardTemplate extends \Espo\Core\Controllers\Record
+{
+    protected function checkControllerAccess()
+    {
+        if (!$this->getUser()->isAdmin()) {
+            throw new Forbidden();
+        }
+    }
+
+    public function postActionDeployToUsers($params, $data)
+    {
+        if (empty($data->id)) throw new BadRequest();
+        if (empty($data->userIdList)) throw new BadRequest();
+
+        return $this->getServiceFactory()->create('DashboardTemplate')->deployToUsers(
+            $data->id,
+            $data->userIdList,
+            !empty($data->append)
+        );
+    }
+
+    public function postActionDeployToTeam($params, $data)
+    {
+        if (empty($data->id)) throw new BadRequest();
+        if (empty($data->teamId)) throw new BadRequest();
+
+        return $this->getServiceFactory()->create('DashboardTemplate')->deployToTeam(
+            $data->id,
+            $data->teamId,
+            !empty($data->append)
+        );
+    }
+}

application/Espo/Controllers/DataPrivacy.php

@@ -0,0 +1,55 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use Espo\Core\Exceptions\Error;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Exceptions\NotFound;
+use Espo\Core\Exceptions\BadRequest;
+
+class DataPrivacy extends \Espo\Core\Controllers\Base
+{
+    protected function checkControllerAccess()
+    {
+        if ($this->getAcl()->get('dataPrivacyPermission') === 'no') {
+            throw new Forbidden();
+        }
+    }
+
+    public function postActionErase($params, $data)
+    {
+        if (empty($data->entityType) || empty($data->id) || empty($data->fieldList) || !is_array($data->fieldList)) {
+            throw new BadRequest();
+        }
+
+        return $this->getServiceFactory()->create('DataPrivacy')->erase($data->entityType, $data->id, $data->fieldList);
+    }
+
+}

application/Espo/Controllers/Email.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -32,73 +32,109 @@ namespace Espo\Controllers;
 use \Espo\Core\Exceptions\BadRequest;
 use \Espo\Core\Exceptions\Forbidden;
 use \Espo\Core\Exceptions\Error;
+use \Espo\Core\Exceptions\NotFound;
 
 class Email extends \Espo\Core\Controllers\Record
 {
     public function postActionGetCopiedAttachments($params, $data, $request)
     {
-        if (empty($data['id'])) {
+        if (empty($data->id)) {
             throw new BadRequest();
         }
-        $id = $data['id'];
+        $id = $data->id;
 
         return $this->getRecordService()->getCopiedAttachments($id);
     }
 
-    public function actionSendTestEmail($params, $data, $request)
+    public function postActionSendTestEmail($params, $data, $request)
     {
-        if (!$request->isPost()) {
-            throw new BadRequest();
+        if (!$this->getAcl()->checkScope('Email')) {
+            throw new Forbidden();
         }
 
-        if (is_null($data['password'])) {
-            if ($data['type'] == 'preferences') {
-                if (!$this->getUser()->isAdmin() && $data['id'] != $this->getUser()->id) {
+        if (is_null($data->password)) {
+            if ($data->type == 'preferences') {
+                if (!$this->getUser()->isAdmin() && $data->id !== $this->getUser()->id) {
                     throw new Forbidden();
                 }
-                $preferences = $this->getEntityManager()->getEntity('Preferences', $data['id']);
+                $preferences = $this->getEntityManager()->getEntity('Preferences', $data->id);
                 if (!$preferences) {
-                    throw new Error();
+                    throw new NotFound();
                 }
 
-                $data['password'] = $this->getContainer()->get('crypt')->decrypt($preferences->get('smtpPassword'));
+                if (is_null($data->password)) {
+                    $data->password = $this->getContainer()->get('crypt')->decrypt($preferences->get('smtpPassword'));
+                }
+            } else if ($data->type == 'emailAccount') {
+                if (!$this->getAcl()->checkScope('EmailAccount')) {
+                    throw new Forbidden();
+                }
+                if (!empty($data->id)) {
+                    $emailAccount = $this->getEntityManager()->getEntity('EmailAccount', $data->id);
+                    if (!$emailAccount) {
+                        throw new NotFound();
+                    }
+                    if (!$this->getUser()->isAdmin()) {
+                        if ($emailAccount->get('assignedUserId') !== $this->getUser()->id) {
+                            throw new Forbidden();
+                        }
+                    }
+                    if (is_null($data->password)) {
+                        $data->password = $this->getContainer()->get('crypt')->decrypt($emailAccount->get('smtpPassword'));
+                    }
+                }
+            } else if ($data->type == 'inboundEmail') {
+                if (!$this->getUser()->isAdmin()) {
+                    throw new Forbidden();
+                }
+                if (!empty($data->id)) {
+                    $emailAccount = $this->getEntityManager()->getEntity('InboundEmail', $data->id);
+                    if (!$emailAccount) {
+                        throw new NotFound();
+                    }
+                    if (is_null($data->password)) {
+                        $data->password = $this->getContainer()->get('crypt')->decrypt($emailAccount->get('smtpPassword'));
+                    }
+                }
             } else {
                 if (!$this->getUser()->isAdmin()) {
                     throw new Forbidden();
                 }
-                $data['password'] = $this->getConfig()->get('smtpPassword');
+                if (is_null($data->password)) {
+                    $data->password = $this->getConfig()->get('smtpPassword');
+                }
             }
         }
 
-        return $this->getRecordService()->sendTestEmail($data);
+        return $this->getRecordService()->sendTestEmail(get_object_vars($data));
     }
 
     public function postActionMarkAsRead($params, $data, $request)
     {
-        if (!empty($data['ids'])) {
-            $ids = $data['ids'];
+        if (!empty($data->ids)) {
+            $idList = $data->ids;
         } else {
-            if (!empty($data['id'])) {
-                $ids = [$data['id']];
+            if (!empty($data->id)) {
+                $idList = [$data->id];
             } else {
                 throw new BadRequest();
             }
         }
-        return $this->getRecordService()->markAsReadByIdList($ids);
+        return $this->getRecordService()->markAsReadByIdList($idList);
     }
 
     public function postActionMarkAsNotRead($params, $data, $request)
     {
-        if (!empty($data['ids'])) {
-            $ids = $data['ids'];
+        if (!empty($data->ids)) {
+            $idList = $data->ids;
         } else {
-            if (!empty($data['id'])) {
-                $ids = [$data['id']];
+            if (!empty($data->id)) {
+                $idList = [$data->id];
             } else {
                 throw new BadRequest();
             }
         }
-        return $this->getRecordService()->markAsNotReadByIdList($ids);
+        return $this->getRecordService()->markAsNotReadByIdList($idList);
     }
 
     public function postActionMarkAllAsRead($params, $data, $request)
@@ -108,58 +144,90 @@ class Email extends \Espo\Core\Controllers\Record
 
     public function postActionMarkAsImportant($params, $data, $request)
     {
-        if (!empty($data['ids'])) {
-            $ids = $data['ids'];
+        if (!empty($data->ids)) {
+            $idList = $data->ids;
         } else {
-            if (!empty($data['id'])) {
-                $ids = [$data['id']];
+            if (!empty($data->id)) {
+                $idList = [$data->id];
             } else {
                 throw new BadRequest();
             }
         }
-        return $this->getRecordService()->markAsImportantByIdList($ids);
+        return $this->getRecordService()->markAsImportantByIdList($idList);
     }
 
     public function postActionMarkAsNotImportant($params, $data, $request)
     {
-        if (!empty($data['ids'])) {
-            $ids = $data['ids'];
+        if (!empty($data->ids)) {
+            $idList = $data->ids;
         } else {
-            if (!empty($data['id'])) {
-                $ids = [$data['id']];
+            if (!empty($data->id)) {
+                $idList = [$data->id];
             } else {
                 throw new BadRequest();
             }
         }
-        return $this->getRecordService()->markAsNotImportantByIdList($ids);
+        return $this->getRecordService()->markAsNotImportantByIdList($idList);
     }
 
     public function postActionMoveToTrash($params, $data)
     {
-        if (!empty($data['ids'])) {
-            $ids = $data['ids'];
+        if (!empty($data->ids)) {
+            $idList = $data->ids;
         } else {
-            if (!empty($data['id'])) {
-                $ids = [$data['id']];
+            if (!empty($data->id)) {
+                $idList = [$data->id];
             } else {
                 throw new BadRequest();
             }
         }
-        return $this->getRecordService()->moveToTrashByIdList($ids);
+        return $this->getRecordService()->moveToTrashByIdList($idList);
     }
 
     public function postActionRetrieveFromTrash($params, $data)
     {
-        if (!empty($data['ids'])) {
-            $ids = $data['ids'];
+        if (!empty($data->ids)) {
+            $idList = $data->ids;
         } else {
-            if (!empty($data['id'])) {
-                $ids = [$data['id']];
+            if (!empty($data->id)) {
+                $idList = [$data->id];
             } else {
                 throw new BadRequest();
             }
         }
-        return $this->getRecordService()->retrieveFromTrashByIdList($ids);
+        return $this->getRecordService()->retrieveFromTrashByIdList($idList);
+    }
+
+    public function getActionGetFoldersNotReadCounts(&$params, $request, $data)
+    {
+        return $this->getRecordService()->getFoldersNotReadCounts();
+    }
+
+    protected function fetchListParamsFromRequest(&$params, $request, $data)
+    {
+        parent::fetchListParamsFromRequest($params, $request, $data);
+
+        $folderId = $request->get('folderId');
+        if ($folderId) {
+            $params['folderId'] = $request->get('folderId');
+        }
+    }
+
+    public function postActionMoveToFolder($params, $data)
+    {
+        if (!empty($data->ids)) {
+            $idList = $data->ids;
+        } else {
+            if (!empty($data->id)) {
+                $idList = [$data->id];
+            } else {
+                throw new BadRequest();
+            }
+        }
+
+        if (empty($data->folderId)) {
+            throw new BadRequest();
+        }
+        return $this->getRecordService()->moveToFolderByIdList($idList, $data->folderId);
     }
 }
-

application/Espo/Controllers/EmailAccount.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -31,19 +31,22 @@ namespace Espo\Controllers;
 
 use \Espo\Core\Exceptions\Forbidden;
 use \Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Exceptions\Error;
 
 class EmailAccount extends \Espo\Core\Controllers\Record
 {
-    public function actionGetFolders($params, $data, $request)
+    public function postActionGetFolders($params, $data)
     {
-        return $this->getRecordService()->getFolders(array(
-            'host' => $request->get('host'),
-            'port' => $request->get('port'),
-            'ssl' => $request->get('ssl') === 'true',
-            'username' => $request->get('username'),
-            'password' => $request->get('password'),
-            'id' => $request->get('id')
-        ));
+        return $this->getRecordService()->getFolders([
+            'host' => $data->host ?? null,
+            'port' => $data->port ?? null,
+            'ssl' =>  $data->ssl ?? false,
+            'username' => $data->username ?? null,
+            'password' => $data->password ?? null,
+            'id' => $data->id ?? null,
+            'emailAddress' => $data->emailAddress ?? null,
+            'userId' => $data->userId ?? null,
+        ]);
     }
 
     protected function checkControllerAccess()
@@ -53,15 +56,11 @@ class EmailAccount extends \Espo\Core\Controllers\Record
         }
     }
 
-    public function actionTestConnection($params, $data, $request)
+    public function postActionTestConnection($params, $data, $request)
     {
-        if (!$request->isPost()) {
-            throw new BadRequest();
-        }
-
-        if (is_null($data['password'])) {
-            $emailAccount = $this->getEntityManager()->getEntity('EmailAccount', $data['id']);
-            if (!$emailAccount) {
+        if (is_null($data->password)) {
+            $emailAccount = $this->getEntityManager()->getEntity('EmailAccount', $data->id);
+            if (!$emailAccount || !$emailAccount->id) {
                 throw new Error();
             }
 
@@ -69,10 +68,9 @@ class EmailAccount extends \Espo\Core\Controllers\Record
                 throw new Forbidden();
             }
 
-            $data['password'] = $this->getContainer()->get('crypt')->decrypt($emailAccount->get('password'));
+            $data->password = $this->getContainer()->get('crypt')->decrypt($emailAccount->get('password'));
         }
 
-        return $this->getRecordService()->testConnection($data);
+        return $this->getRecordService()->testConnection(get_object_vars($data));
     }
 }
-

application/Espo/Controllers/EmailAddress.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -42,11 +42,13 @@ class EmailAddress extends \Espo\Core\Controllers\Record
             throw new Forbidden();
         }
         $q = $request->get('q');
-        $limit = intval($request->get('limit'));
-        if (empty($limit) || $limit > 30) {
-            $limit = 5;
+        $maxSize = intval($request->get('maxSize'));
+        if (empty($maxSize) || $maxSize > 50) {
+            $maxSize = $this->getConfig()->get('recordsPerPage', 20);
         }
-        return $this->getRecordService()->searchInAddressBook($q, $limit);
+
+        $onlyActual = $request->get('onlyActual') === 'true';
+
+        return $this->getRecordService()->searchInAddressBook($q, $maxSize, $onlyActual);
     }
 }
-

application/Espo/Controllers/EmailFilter.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

application/Espo/Controllers/EmailFolder.php

@@ -0,0 +1,62 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\BadRequest;
+
+class EmailFolder extends \Espo\Core\Controllers\Record
+{
+    public function postActionMoveUp($params, $data, $request)
+    {
+        if (empty($data->id)) {
+            throw new BadRequest();
+        }
+
+        $this->getRecordService()->moveUp($data->id);
+
+        return true;
+    }
+
+    public function postActionMoveDown($params, $data, $request)
+    {
+        if (empty($data->id)) {
+            throw new BadRequest();
+        }
+
+        $this->getRecordService()->moveDown($data->id);
+
+        return true;
+    }
+
+    public function getActionListAll()
+    {
+        return $this->getRecordService()->listAll();
+    }
+}

application/Espo/Controllers/EmailTemplate.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -25,7 +25,7 @@
  *
  * In accordance with Section 7(b) of the GNU General Public License version 3,
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
- ************************************************************************/ 
+ ************************************************************************/
 
 namespace Espo\Controllers;
 
@@ -34,17 +34,19 @@ use \Espo\Core\Exceptions\Error;
 class EmailTemplate extends \Espo\Core\Controllers\Record
 {
     public function actionParse($params, $data, $request)
-    {        
+    {
         $id = $request->get('id');
         $emailAddress = $request->get('emailAddress');
         if (empty($id)) {
             throw new Error();
         }
-        
+
         return $this->getRecordService()->parse($id, array(
             'emailAddress' => $request->get('emailAddress'),
             'parentType' => $request->get('parentType'),
             'parentId' => $request->get('parentId'),
+            'relatedType' => $request->get('relatedType'),
+            'relatedId' => $request->get('relatedId')
         ), true);
     }
 

application/Espo/Controllers/EmailTemplateCategory.php

@@ -0,0 +1,35 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+class EmailTemplateCategory extends \Espo\Core\Templates\Controllers\CategoryTree
+{
+
+}

application/Espo/Controllers/EntityManager.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -44,6 +44,8 @@ class EntityManager extends \Espo\Core\Controllers\Base
 
     public function actionCreateEntity($params, $data, $request)
     {
+        $data = get_object_vars($data);
+
         if (!$request->isPost()) {
             throw new BadRequest();
         }
@@ -58,7 +60,7 @@ class EntityManager extends \Espo\Core\Controllers\Base
         $name = filter_var($name, \FILTER_SANITIZE_STRING);
         $type = filter_var($type, \FILTER_SANITIZE_STRING);
 
-        $params = array();
+        $params = [];
 
         if (!empty($data['labelSingular'])) {
             $params['labelSingular'] = $data['labelSingular'];
@@ -78,14 +80,37 @@ class EntityManager extends \Espo\Core\Controllers\Base
         if (!empty($data['sortDirection'])) {
             $params['asc'] = $data['sortDirection'] === 'asc';
         }
+        if (isset($data['textFilterFields']) && is_array($data['textFilterFields'])) {
+            $params['textFilterFields'] = $data['textFilterFields'];
+        }
+        if (!empty($data['color'])) {
+            $params['color'] = $data['color'];
+        }
+        if (!empty($data['iconClass'])) {
+            $params['iconClass'] = $data['iconClass'];
+        }
+        if (isset($data['fullTextSearch'])) {
+            $params['fullTextSearch'] = $data['fullTextSearch'];
+        }
+        if (isset($data['countDisabled'])) {
+            $params['countDisabled'] = $data['countDisabled'];
+        }
+
+        $params['kanbanViewMode'] = !empty($data['kanbanViewMode']);
+        if (!empty($data['kanbanStatusIgnoreList'])) {
+            $params['kanbanStatusIgnoreList'] = $data['kanbanStatusIgnoreList'];
+        }
 
         $result = $this->getContainer()->get('entityManagerUtil')->create($name, $type, $params);
 
         if ($result) {
             $tabList = $this->getConfig()->get('tabList', []);
-            $tabList[] = $name;
-            $this->getConfig()->set('tabList', $tabList);
-            $this->getConfig()->save();
+
+            if (!in_array($name, $tabList)) {
+                $tabList[] = $name;
+                $this->getConfig()->set('tabList', $tabList);
+                $this->getConfig()->save();
+            }
 
             $this->getContainer()->get('dataManager')->rebuild();
         } else {
@@ -97,6 +122,8 @@ class EntityManager extends \Espo\Core\Controllers\Base
 
     public function actionUpdateEntity($params, $data, $request)
     {
+        $data = get_object_vars($data);
+
         if (!$request->isPost()) {
             throw new BadRequest();
         }
@@ -106,10 +133,6 @@ class EntityManager extends \Espo\Core\Controllers\Base
         $name = $data['name'];
         $name = filter_var($name, \FILTER_SANITIZE_STRING);
 
-        if (!empty($data['sortDirection'])) {
-            $data['asc'] = $data['sortDirection'] === 'asc';
-        }
-
         $result = $this->getContainer()->get('entityManagerUtil')->update($name, $data);
 
         if ($result) {
@@ -123,6 +146,8 @@ class EntityManager extends \Espo\Core\Controllers\Base
 
     public function actionRemoveEntity($params, $data, $request)
     {
+        $data = get_object_vars($data);
+
         if (!$request->isPost()) {
             throw new BadRequest();
         }
@@ -154,25 +179,27 @@ class EntityManager extends \Espo\Core\Controllers\Base
 
     public function actionCreateLink($params, $data, $request)
     {
+        $data = get_object_vars($data);
+
         if (!$request->isPost()) {
             throw new BadRequest();
         }
 
         $paramList = [
         	'entity',
-        	'entityForeign',
         	'link',
         	'linkForeign',
         	'label',
-        	'labelForeign',
-        	'linkType'
+        	'linkType',
         ];
 
         $additionalParamList = [
+            'entityForeign',
             'relationName',
+            'labelForeign',
         ];
 
-        $params = array();
+        $params = [];
 
         foreach ($paramList as $item) {
         	if (empty($data[$item])) {
@@ -182,9 +209,11 @@ class EntityManager extends \Espo\Core\Controllers\Base
         }
 
         foreach ($additionalParamList as $item) {
-            $params[$item] = filter_var($data[$item], \FILTER_SANITIZE_STRING);
+            $params[$item] = filter_var($data[$item] ?? null, \FILTER_SANITIZE_STRING);
         }
 
+        $params['labelForeign'] = $params['labelForeign'] ?? $params['linkForeign'];
+
         if (array_key_exists('linkMultipleField', $data)) {
             $params['linkMultipleField'] = $data['linkMultipleField'];
         }
@@ -192,6 +221,19 @@ class EntityManager extends \Espo\Core\Controllers\Base
             $params['linkMultipleFieldForeign'] = $data['linkMultipleFieldForeign'];
         }
 
+        if (array_key_exists('audited', $data)) {
+            $params['audited'] = $data['audited'];
+        }
+        if (array_key_exists('auditedForeign', $data)) {
+            $params['auditedForeign'] = $data['auditedForeign'];
+        }
+        if (array_key_exists('parentEntityTypeList', $data)) {
+            $params['parentEntityTypeList'] = $data['parentEntityTypeList'];
+        }
+        if (array_key_exists('foreignLinkEntityTypeList', $data)) {
+            $params['foreignLinkEntityTypeList'] = $data['foreignLinkEntityTypeList'];
+        }
+
         $result = $this->getContainer()->get('entityManagerUtil')->createLink($params);
 
         if ($result) {
@@ -205,6 +247,8 @@ class EntityManager extends \Espo\Core\Controllers\Base
 
     public function actionUpdateLink($params, $data, $request)
     {
+        $data = get_object_vars($data);
+
         if (!$request->isPost()) {
             throw new BadRequest();
         }
@@ -215,14 +259,16 @@ class EntityManager extends \Espo\Core\Controllers\Base
         	'link',
         	'linkForeign',
         	'label',
-        	'labelForeign'
+        	'labelForeign',
         ];
 
         $additionalParamList = [];
 
-        $params = array();
+        $params = [];
         foreach ($paramList as $item) {
-        	$params[$item] = filter_var($data[$item], \FILTER_SANITIZE_STRING);
+            if (array_key_exists($item, $data)) {
+                $params[$item] = filter_var($data[$item], \FILTER_SANITIZE_STRING);
+            }
         }
 
         foreach ($additionalParamList as $item) {
@@ -236,6 +282,19 @@ class EntityManager extends \Espo\Core\Controllers\Base
             $params['linkMultipleFieldForeign'] = $data['linkMultipleFieldForeign'];
         }
 
+        if (array_key_exists('audited', $data)) {
+            $params['audited'] = $data['audited'];
+        }
+        if (array_key_exists('auditedForeign', $data)) {
+            $params['auditedForeign'] = $data['auditedForeign'];
+        }
+        if (array_key_exists('parentEntityTypeList', $data)) {
+            $params['parentEntityTypeList'] = $data['parentEntityTypeList'];
+        }
+        if (array_key_exists('foreignLinkEntityTypeList', $data)) {
+            $params['foreignLinkEntityTypeList'] = $data['foreignLinkEntityTypeList'];
+        }
+
         $result = $this->getContainer()->get('entityManagerUtil')->updateLink($params);
 
         if ($result) {
@@ -249,6 +308,8 @@ class EntityManager extends \Espo\Core\Controllers\Base
 
     public function actionRemoveLink($params, $data, $request)
     {
+        $data = get_object_vars($data);
+
         if (!$request->isPost()) {
             throw new BadRequest();
         }
@@ -272,5 +333,34 @@ class EntityManager extends \Espo\Core\Controllers\Base
 
         return true;
     }
-}
 
+    public function postActionFormula($params, $data, $request)
+    {
+        if (empty($data->scope)) {
+            throw new BadRequest();
+        }
+        if (!property_exists($data, 'data')) {
+            throw new BadRequest();
+        }
+
+        $formulaData = get_object_vars($data->data);
+
+        $this->getContainer()->get('entityManagerUtil')->setFormulaData($data->scope, $formulaData);
+
+        $this->getContainer()->get('dataManager')->clearCache();
+
+        return true;
+    }
+
+    public function postActionResetToDefault($params, $data, $request)
+    {
+        if (empty($data->scope)) {
+            throw new BadRequest();
+        }
+
+        $this->getContainer()->get('entityManagerUtil')->resetToDefaults($data->scope);
+        $this->getContainer()->get('dataManager')->clearCache();
+
+        return true;
+    }
+}

application/Espo/Controllers/Extension.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -66,14 +66,14 @@ class Extension extends \Espo\Core\Controllers\Record
             throw new Forbidden();
         }
         if ($this->getConfig()->get('restrictedMode')) {
-            if (!$this->getUser()->get('isSuperAdmin')) {
+            if (!$this->getUser()->isSuperAdmin()) {
                 throw new Forbidden();
             }
         }
 
         $manager = new \Espo\Core\ExtensionManager($this->getContainer());
 
-        $manager->install($data);
+        $manager->install(get_object_vars($data));
 
         return true;
     }
@@ -84,35 +84,16 @@ class Extension extends \Espo\Core\Controllers\Record
             throw new Forbidden();
         }
         if ($this->getConfig()->get('restrictedMode')) {
-            if (!$this->getUser()->get('isSuperAdmin')) {
+            if (!$this->getUser()->isSuperAdmin()) {
                 throw new Forbidden();
             }
         }
 
         $manager = new \Espo\Core\ExtensionManager($this->getContainer());
-        $manager->uninstall($data);
+        $manager->uninstall(get_object_vars($data));
         return true;
     }
 
-    public function actionCreate($params, $data)
-    {
-        throw new Forbidden();
-    }
-
-    public function actionUpdate($params, $data)
-    {
-        throw new Forbidden();
-    }
-
-    public function actionPatch($params, $data)
-    {
-        throw new Forbidden();
-    }
-
-    public function actionListLinked($params, $data, $request)
-    {
-        throw new Forbidden();
-    }
 
     public function actionDelete($params, $data, $request)
     {
@@ -120,7 +101,7 @@ class Extension extends \Espo\Core\Controllers\Record
             throw BadRequest();
         }
         if ($this->getConfig()->get('restrictedMode')) {
-            if (!$this->getUser()->get('isSuperAdmin')) {
+            if (!$this->getUser()->isSuperAdmin()) {
                 throw new Forbidden();
             }
         }
@@ -129,24 +110,43 @@ class Extension extends \Espo\Core\Controllers\Record
         return true;
     }
 
-    public function actionMassUpdate($params, $data, $request)
+    public function beforeCreate()
     {
         throw new Forbidden();
     }
 
-    public function actionMassDelete($params, $data, $request)
+    public function beforeUpdate()
     {
         throw new Forbidden();
     }
 
-    public function actionCreateLink($params, $data)
+    public function beforePatch()
     {
         throw new Forbidden();
     }
 
-    public function actionRemoveLink($params, $data)
+    public function beforeListLinked()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeMassUpdate()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeMassDelete()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeCreateLink()
+    {
+        throw new Forbidden();
+    }
+
+    public function beforeRemoveLink()
     {
         throw new Forbidden();
     }
 }
-

application/Espo/Controllers/ExternalAccount.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -47,17 +47,27 @@ class ExternalAccount extends \Espo\Core\Controllers\Record
     public function actionList($params, $data, $request)
     {
         $integrations = $this->getEntityManager()->getRepository('Integration')->find();
-        $arr = array();
+
+        $list = [];
         foreach ($integrations as $entity) {
             if ($entity->get('enabled') && $this->getMetadata()->get('integrations.' . $entity->id .'.allowUserAccounts')) {
-                $arr[] = array(
+
+                $userAccountAclScope = $this->getMetadata()->get(['integrations', $entity->id, 'userAccountAclScope']);
+
+                if ($userAccountAclScope) {
+                    if (!$this->getAcl()->checkScope($userAccountAclScope)) {
+                        continue;
+                    }
+                }
+
+                $list[] = [
                     'id' => $entity->id
-                );
+                ];
             }
         }
-        return array(
-            'list' => $arr
-        );
+        return [
+            'list' => $list
+        ];
     }
 
     public function actionGetOAuth2Info($params, $data, $request)
@@ -65,8 +75,7 @@ class ExternalAccount extends \Espo\Core\Controllers\Record
         $id = $request->get('id');
         list($integration, $userId) = explode('__', $id);
 
-
-        if ($this->getUser()->id != $userId) {
+        if ($this->getUser()->id != $userId && !$this->getUser()->isAdmin()) {
             throw new Forbidden();
         }
 
@@ -84,12 +93,7 @@ class ExternalAccount extends \Espo\Core\Controllers\Record
     {
         list($integration, $userId) = explode('__', $params['id']);
 
-        if ($this->getUser()->id != $userId) {
-            throw new Forbidden();
-        }
-
-        $entity = $this->getEntityManager()->getEntity('ExternalAccount', $params['id']);
-        return $entity->toArray();
+        return $this->getRecordService()->read($params['id'])->getValueMap();
     }
 
     public function actionUpdate($params, $data, $request)
@@ -105,12 +109,12 @@ class ExternalAccount extends \Espo\Core\Controllers\Record
 
         list($integration, $userId) = explode('__', $params['id']);
 
-        if ($this->getUser()->id != $userId) {
+        if ($this->getUser()->id != $userId && !$this->getUser()->isAdmin()) {
             throw new Forbidden();
         }
 
-        if (isset($data['enabled']) && !$data['enabled']) {
-            $data['data'] = null;
+        if (isset($data->enabled) && !$data->enabled) {
+            $data->data = null;
         }
 
         $entity = $this->getEntityManager()->getEntity('ExternalAccount', $params['id']);
@@ -126,12 +130,12 @@ class ExternalAccount extends \Espo\Core\Controllers\Record
             throw new Error('Bad HTTP method type.');
         }
 
-        $id = $data['id'];
-        $code = $data['code'];
+        $id = $data->id;
+        $code = $data->code;
 
         list($integration, $userId) = explode('__', $id);
 
-        if ($this->getUser()->id != $userId) {
+        if ($this->getUser()->id != $userId && !$this->getUser()->isAdmin()) {
             throw new Forbidden();
         }
 
@@ -139,4 +143,3 @@ class ExternalAccount extends \Espo\Core\Controllers\Record
         return $service->authorizationCode($integration, $userId, $code);
     }
 }
-

application/Espo/Controllers/FieldManager.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -29,9 +29,10 @@
 
 namespace Espo\Controllers;
 
-use \Espo\Core\Exceptions\Error,
-    \Espo\Core\Exceptions\Forbidden,
-    \Espo\Core\Exceptions\NotFound;
+use Espo\Core\Exceptions\Error;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Exceptions\NotFound;
+use Espo\Core\Exceptions\BadRequest;
 
 class FieldManager extends \Espo\Core\Controllers\Base
 {
@@ -44,38 +45,51 @@ class FieldManager extends \Espo\Core\Controllers\Base
 
     public function actionRead($params, $data)
     {
-        $data = $this->getContainer()->get('fieldManager')->read($params['name'], $params['scope']);
+        if (empty($params['scope']) || empty($params['name'])) {
+            throw new BadRequest();
+        }
+
+        $data = $this->getContainer()->get('fieldManager')->read($params['scope'], $params['name']);
 
         if (!isset($data)) {
-            throw new NotFound();
+            throw new BadRequest();
         }
 
         return $data;
     }
 
-    public function actionCreate($params, $data)
+    public function postActionCreate($params, $data)
     {
-        if (empty($data['name'])) {
-            throw new Error("Field 'name' cannnot be empty");
+        if (empty($params['scope']) || empty($data->name)) {
+            throw new BadRequest();
         }
 
         $fieldManager = $this->getContainer()->get('fieldManager');
-        $fieldManager->create($data['name'], $data, $params['scope']);
+        $fieldManager->create($params['scope'], $data->name, get_object_vars($data));
 
         try {
             $this->getContainer()->get('dataManager')->rebuild($params['scope']);
         } catch (Error $e) {
-            $fieldManager->delete($data['name'], $params['scope']);
+            $fieldManager->delete($params['scope'], $data->name);
             throw new Error($e->getMessage());
         }
 
-        return $fieldManager->read($data['name'], $params['scope']);
+        return $fieldManager->read($params['scope'], $data->name);
     }
 
-    public function actionUpdate($params, $data)
+    public function patchActionUpdate($params, $data)
     {
+        return $this->putActionUpdate($params, $data);
+    }
+
+    public function putActionUpdate($params, $data)
+    {
+        if (empty($params['scope']) || empty($params['name'])) {
+            throw new BadRequest();
+        }
+
         $fieldManager = $this->getContainer()->get('fieldManager');
-        $fieldManager->update($params['name'], $data, $params['scope']);
+        $fieldManager->update($params['scope'], $params['name'], get_object_vars($data));
 
         if ($fieldManager->isChanged()) {
             $this->getContainer()->get('dataManager')->rebuild($params['scope']);
@@ -83,17 +97,34 @@ class FieldManager extends \Espo\Core\Controllers\Base
             $this->getContainer()->get('dataManager')->clearCache();
         }
 
-        return $fieldManager->read($params['name'], $params['scope']);
+        return $fieldManager->read($params['scope'], $params['name']);
     }
 
-    public function actionDelete($params, $data)
+    public function deleteActionDelete($params, $data)
     {
-        $res = $this->getContainer()->get('fieldManager')->delete($params['name'], $params['scope']);
+        if (empty($params['scope']) || empty($params['name'])) {
+            throw new BadRequest();
+        }
+
+        $result = $this->getContainer()->get('fieldManager')->delete($params['scope'], $params['name']);
 
         $this->getContainer()->get('dataManager')->rebuildMetadata();
 
-        return $res;
+        return $result;
     }
 
-}
+    public function postActionResetToDefault($params, $data)
+    {
+        if (empty($data->scope) || empty($data->name)) {
+            throw new BadRequest();
+        }
 
+        $this->getContainer()->get('fieldManager')->resetToDefault($data->scope, $data->name);
+
+        $this->getContainer()->get('dataManager')->clearCache();
+
+        $this->getContainer()->get('dataManager')->rebuildMetadata();
+
+        return true;
+    }
+}

application/Espo/Controllers/GlobalSearch.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

application/Espo/Controllers/I18n.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -31,8 +31,15 @@ namespace Espo\Controllers;
 
 class I18n extends \Espo\Core\Controllers\Base
 {
-    public function actionRead($params, $data)
+    public function actionRead($params, $data, $request)
     {
-        return $this->getContainer()->get('language')->getAll();
+        $default = $request->get('default') === 'true';
+
+        return $this->getServiceFactory()->create('Language')->getDataForFrontend($default);
+
+        /*if ($request->get('default')) {
+            return $this->getContainer()->get('defaultLanguage')->getAll();
+        }
+        return $this->getContainer()->get('language')->getAll();*/
     }
 }

application/Espo/Controllers/Import.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -38,39 +38,39 @@ class Import extends \Espo\Core\Controllers\Record
 {
     protected function checkControllerAccess()
     {
-        if (!$this->getUser()->isAdmin()) {
+        if (!$this->getAcl()->check('Import')) {
             throw new Forbidden();
         }
     }
 
-    public function actionPatch($params, $data)
+    public function beforePatch()
     {
         throw new BadRequest();
     }
 
-    public function actionUpdate($params, $data)
+    public function beforeUpdate()
     {
         throw new BadRequest();
     }
 
-    public function actionMassUpdate($params, $data, $request)
+    public function beforeMassUpdate()
     {
         throw new BadRequest();
     }
 
-    public function actionCreateLink($params, $data)
+    public function beforeCreateLink()
     {
         throw new BadRequest();
     }
 
-    public function actionRemoveLink($params, $data)
+    public function beforeRemoveLink()
     {
         throw new BadRequest();
     }
 
-    protected function getFileManager()
+    protected function getFileStorageManager()
     {
-        return $this->getContainer()->get('fileManager');
+        return $this->getContainer()->get('fileStorageManager');
     }
 
     protected function getEntityManager()
@@ -90,35 +90,34 @@ class Import extends \Espo\Core\Controllers\Record
         $attachment->set('type', 'text/csv');
         $attachment->set('role', 'Import File');
         $attachment->set('name', 'import-file.csv');
+        $attachment->set('contents', $contents);
         $this->getEntityManager()->saveEntity($attachment);
 
-        $this->getFileManager()->putContents('data/upload/' . $attachment->id, $contents);
-
-        return array(
+        return [
             'attachmentId' => $attachment->id
-        );
+        ];
     }
 
     public function actionRevert($params, $data, $request)
     {
-        if (empty($data['id'])) {
+        if (empty($data->id)) {
             throw new BadRequest();
         }
         if (!$request->isPost()) {
             throw new BadRequest();
         }
-        return $this->getService('Import')->revert($data['id']);
+        return $this->getService('Import')->revert($data->id);
     }
 
     public function actionRemoveDuplicates($params, $data, $request)
     {
-        if (empty($data['id'])) {
+        if (empty($data->id)) {
             throw new BadRequest();
         }
         if (!$request->isPost()) {
             throw new BadRequest();
         }
-        return $this->getService('Import')->removeDuplicates($data['id']);
+        return $this->getService('Import')->removeDuplicates($data->id);
     }
 
     public function actionCreate($params, $data, $request)
@@ -127,39 +126,91 @@ class Import extends \Espo\Core\Controllers\Record
             throw new BadRequest();
         }
 
-        $importParams = array(
-            'headerRow' => $data['headerRow'],
-            'fieldDelimiter' => $data['fieldDelimiter'],
-            'textQualifier' => $data['textQualifier'],
-            'dateFormat' => $data['dateFormat'],
-            'timeFormat' => $data['timeFormat'],
-            'personNameFormat' => $data['personNameFormat'],
-            'decimalMark' => $data['decimalMark'],
-            'currency' => $data['currency'],
-            'defaultValues' => $data['defaultValues'],
-            'action' => $data['action'],
-        );
-
-        if (array_key_exists('updateBy', $data)) {
-            $importParams['updateBy'] = $data['updateBy'];
+        if (!isset($data->delimiter)) {
+            throw new BadRequest();
         }
 
-        $attachmentId = $data['attachmentId'];
+        if (!isset($data->textQualifier)) {
+            throw new BadRequest();
+        }
 
-        if (!$this->getAcl()->check($data['entityType'], 'edit')) {
+        if (!isset($data->dateFormat)) {
+            throw new BadRequest();
+        }
+
+        if (!isset($data->timeFormat)) {
+            throw new BadRequest();
+        }
+
+        if (!isset($data->personNameFormat)) {
+            throw new BadRequest();
+        }
+
+        if (!isset($data->decimalMark)) {
+            throw new BadRequest();
+        }
+
+        if (!isset($data->defaultValues)) {
+            throw new BadRequest();
+        }
+
+        if (!isset($data->action)) {
+            throw new BadRequest();
+        }
+
+        if (!isset($data->attachmentId)) {
+            throw new BadRequest();
+        }
+
+        if (!isset($data->entityType)) {
+            throw new BadRequest();
+        }
+
+        if (!isset($data->attributeList)) {
+            throw new BadRequest();
+        }
+
+        $timezone = 'UTC';
+        if (isset($data->timezone)) {
+           $timezone = $data->timezone;
+        }
+
+        $importParams = [
+            'headerRow' => !empty($data->headerRow),
+            'delimiter' => $data->delimiter,
+            'textQualifier' => $data->textQualifier,
+            'dateFormat' => $data->dateFormat,
+            'timeFormat' => $data->timeFormat,
+            'timezone' => $timezone,
+            'personNameFormat' => $data->personNameFormat,
+            'decimalMark' => $data->decimalMark,
+            'currency' => $data->currency,
+            'defaultValues' => $data->defaultValues,
+            'action' => $data->action,
+            'skipDuplicateChecking' => !empty($data->skipDuplicateChecking),
+            'idleMode' => !empty($data->idleMode),
+            'silentMode' => !empty($data->silentMode),
+        ];
+
+        if (property_exists($data, 'updateBy')) {
+            $importParams['updateBy'] = $data->updateBy;
+        }
+
+        $attachmentId = $data->attachmentId;
+
+        if (!$this->getAcl()->check($data->entityType, 'edit')) {
             throw new Forbidden();
         }
 
-        return $this->getService('Import')->import($data['entityType'], $data['fields'], $attachmentId, $importParams);
+        return $this->getService('Import')->import($data->entityType, $data->attributeList, $attachmentId, $importParams);
     }
 
     public function postActionUnmarkAsDuplicate($params, $data)
     {
-        if (empty($data['id']) || empty($data['entityType']) || empty($data['entityId'])) {
+        if (empty($data->id) || empty($data->entityType) || empty($data->entityId)) {
             throw new BadRequest();
         }
-        $this->getService('Import')->unmarkAsDuplicate($data['id'], $data['entityType'], $data['entityId']);
+        $this->getService('Import')->unmarkAsDuplicate($data->id, $data->entityType, $data->entityId);
         return true;
     }
 }
-

application/Espo/Controllers/InboundEmail.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -41,33 +41,28 @@ class InboundEmail extends \Espo\Core\Controllers\Record
         }
     }
 
-    public function actionGetFolders($params, $data, $request)
+    public function postActionGetFolders($params, $data, $request)
     {
-        return $this->getRecordService()->getFolders(array(
-            'host' => $request->get('host'),
-            'port' => $request->get('port'),
-            'ssl' => $request->get('ssl') === 'true',
-            'username' => $request->get('username'),
-            'password' => $request->get('password'),
-            'id' => $request->get('id')
-        ));
+        return $this->getRecordService()->getFolders([
+            'host' => $data->host ?? null,
+            'port' => $data->port ?? null,
+            'ssl' =>  $data->ssl ?? false,
+            'username' => $data->username ?? null,
+            'password' => $data->password ?? null,
+            'id' => $data->id ?? null,
+        ]);
     }
 
-    public function actionTestConnection($params, $data, $request)
+    public function postActionTestConnection($params, $data, $request)
     {
-        if (!$request->isPost()) {
-            throw new BadRequest();
-        }
-
-        if (is_null($data['password'])) {
-            $inboundEmail = $this->getEntityManager()->getEntity('InboundEmail', $data['id']);
-            if (!$inboundEmail) {
+        if (is_null($data->password)) {
+            $inboundEmail = $this->getEntityManager()->getEntity('InboundEmail', $data->id);
+            if (!$inboundEmail || !$inboundEmail->id) {
                 throw new Error();
             }
-            $data['password'] = $this->getContainer()->get('crypt')->decrypt($inboundEmail->get('password'));
+            $data->password = $this->getContainer()->get('crypt')->decrypt($inboundEmail->get('password'));
         }
 
-        return $this->getRecordService()->testConnection($data);
+        return $this->getRecordService()->testConnection(get_object_vars($data));
     }
-
 }

application/Espo/Controllers/Integration.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -67,6 +67,18 @@ class Integration extends \Espo\Core\Controllers\Record
         $entity->set($data);
         $this->getEntityManager()->saveEntity($entity);
 
+        $integrationsConfigData = $this->getConfig()->get('integrations');
+
+        if (!$integrationsConfigData || !($integrationsConfigData instanceof \StdClass)) {
+            $integrationsConfigData = (object)[];
+        }
+        $integrationName = $params['id'];
+
+        $integrationsConfigData->$integrationName = $entity->get('enabled');
+        $this->getConfig()->set('integrations', $integrationsConfigData);
+
+        $this->getConfig()->save();
+
         return $entity->toArray();
     }
 }

application/Espo/Controllers/Job.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -41,39 +41,38 @@ class Job extends \Espo\Core\Controllers\Record
         }
     }
 
-    public function actionCreate($params, $data)
+    public function beforeCreate()
     {
         throw new Forbidden();
     }
 
-    public function actionUpdate($params, $data)
+    public function beforeUpdate()
     {
         throw new Forbidden();
     }
 
-    public function actionPatch($params, $data)
+    public function beforePatch()
     {
         throw new Forbidden();
     }
 
-    public function actionListLinked($params, $data, $request)
+    public function beforeListLinked()
     {
         throw new Forbidden();
     }
 
-    public function actionMassUpdate($params, $data, $request)
+    public function beforeMassUpdate()
     {
         throw new Forbidden();
     }
 
-    public function actionCreateLink($params, $data)
+    public function beforeCreateLink()
     {
         throw new Forbidden();
     }
 
-    public function actionRemoveLink($params, $data)
+    public function beforeRemoveLink()
     {
         throw new Forbidden();
     }
 }
-

application/Espo/Controllers/LabelManager.php

@@ -0,0 +1,78 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use Espo\Core\Utils as Utils;
+use \Espo\Core\Exceptions\NotFound;
+use \Espo\Core\Exceptions\Error;
+use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\BadRequest;
+
+class LabelManager extends \Espo\Core\Controllers\Base
+{
+    protected function checkControllerAccess()
+    {
+        if (!$this->getUser()->isAdmin()) {
+            throw new Forbidden();
+        }
+    }
+
+    public function postActionGetScopeList($params)
+    {
+        $labelManager = $this->getContainer()->get('injectableFactory')->createByClassName('\\Espo\\Core\\Utils\\LabelManager');
+
+        return $labelManager->getScopeList();
+    }
+
+    public function postActionGetScopeData($params, $data, $request)
+    {
+        if (empty($data->scope) || empty($data->language)) {
+            throw new BadRequest();
+        }
+        $labelManager = $this->getContainer()->get('injectableFactory')->createByClassName('\\Espo\\Core\\Utils\\LabelManager');
+        return $labelManager->getScopeData($data->language, $data->scope);
+    }
+
+    public function postActionSaveLabels($params, $data)
+    {
+        if (empty($data->scope) || empty($data->language) || !isset($data->labels)) {
+            throw new BadRequest();
+        }
+
+        $labels = get_object_vars($data->labels);
+
+        $labelManager = $this->getContainer()->get('injectableFactory')->createByClassName('\\Espo\\Core\\Utils\\LabelManager');
+        $returnData = $labelManager->saveLabels($data->language, $data->scope, $labels);
+
+        $this->getContainer()->get('dataManager')->clearCache();
+
+        return $returnData;
+    }
+}

application/Espo/Controllers/LastViewed.php

@@ -0,0 +1,58 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\Forbidden;
+
+class LastViewed extends \Espo\Core\Controllers\Base
+{
+    public function getActionIndex($params, $data, $request)
+    {
+        $params = [];
+
+        $params['offset'] = $request->get('offset', 0);
+        $params['maxSize'] = $request->get('maxSize');
+
+        $maxSizeLimit = $this->getConfig()->get('recordListMaxSizeLimit', \Espo\Core\Controllers\Record::MAX_SIZE_LIMIT);
+        if (empty($params['maxSize'])) {
+            $params['maxSize'] = $maxSizeLimit;
+        }
+        if (!empty($params['maxSize']) && $params['maxSize'] > $maxSizeLimit) {
+            throw new Forbidden("Max size should should not exceed " . $maxSizeLimit . ". Use offset and limit.");
+        }
+
+        $result = $this->getServiceFactory()->create('LastViewed')->getList($params);
+
+        return (object) [
+            'total' => $result->total,
+            'list' => $result->collection->getValueMapList()
+        ];
+    }
+}

application/Espo/Controllers/Layout.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -30,59 +30,49 @@
 namespace Espo\Controllers;
 
 use Espo\Core\Utils as Utils;
-use \Espo\Core\Exceptions\NotFound;
-use \Espo\Core\Exceptions\Error;
-use \Espo\Core\Exceptions\Forbidden;
-use \Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Exceptions\NotFound;
+use Espo\Core\Exceptions\Error;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Exceptions\BadRequest;
 
 class Layout extends \Espo\Core\Controllers\Base
 {
-    public function actionRead($params, $data)
+    public function getActionRead($params, $data)
     {
-        $data = $this->getContainer()->get('layout')->get($params['scope'], $params['name']);
-        if (empty($data)) {
-            throw new NotFound("Layout " . $params['scope'] . ":" . $params['name'] . ' is not found.');
-        }
-        return $data;
+        $scope = $params['scope'] ?? null;
+        $name = $params['name'] ?? null;
+
+        return $this->getServiceFactory()->create('Layout')->getForFrontend($scope, $name);
     }
 
-    public function actionUpdate($params, $data, $request)
+    public function putActionUpdate($params, $data, $request)
     {
-        if (!$this->getUser()->isAdmin()) {
-            throw new Forbidden();
-        }
+        if (is_object($data)) $data = get_object_vars($data);
 
-        if (!$request->isPut() && !$request->isPatch()) {
-            throw new BadRequest();
-        }
+        if (!$this->getUser()->isAdmin()) throw new Forbidden();
 
-        $layoutManager = $this->getContainer()->get('layout');
-        $layoutManager->set($data, $params['scope'], $params['name']);
-        $result = $layoutManager->save();
+        $scope = $params['scope'] ?? null;
+        $name = $params['name'] ?? null;
+        $setId = $params['setId'] ?? null;
 
-        if ($result === false) {
-            throw new Error("Error while saving layout.");
-        }
-
-        $this->getContainer()->get('dataManager')->updateCacheTimestamp();
-
-        return $layoutManager->get($params['scope'], $params['name']);
+        return $this->getServiceFactory()->create('Layout')->update($scope, $name, $setId, $data);
     }
 
-    public function actionPatch($params, $data, $request)
+    public function postActionResetToDefault($params, $data, $request)
     {
-        return $this->actionUpdate($params, $data, $request);
+        if (!$this->getUser()->isAdmin()) throw new Forbidden();
+
+        if (empty($data->scope) || empty($data->name)) throw new BadRequest();
+
+        return $this->getServiceFactory()->create('Layout')->resetToDefault($data->scope, $data->name, $data->setId ?? null);
     }
 
-    public function actionResetToDefault($params, $data, $request)
+    public function getActionGetOriginal($params, $data, $request)
     {
-        if (!$request->isPost()) {
-            throw new BadRequest();
-        }
-        if (empty($data['scope']) || empty($data['name'])) {
-            throw new BadRequest();
-        }
+        if (!$this->getUser()->isAdmin()) throw new Forbidden();
 
-        return $this->getContainer()->get('layout')->resetToDefault($data['scope'], $data['name']);
+        return $this->getServiceFactory()->create('Layout')->getOriginal(
+            $request->get('scope'), $request->get('name'), $request->get('setId')
+        );
     }
 }

application/Espo/Controllers/LayoutSet.php

@@ -0,0 +1,42 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use Espo\Core\Exceptions\Forbidden;
+
+class LayoutSet extends \Espo\Core\Controllers\Record
+{
+    protected function checkControllerAccess()
+    {
+        if (!$this->getUser()->isAdmin()) {
+            throw new Forbidden();
+        }
+    }
+}

application/Espo/Controllers/LeadCapture.php

@@ -0,0 +1,79 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\BadRequest;
+use \Espo\Core\Exceptions\NotFound;
+
+class LeadCapture extends \Espo\Core\Controllers\Record
+{
+    public function postActionLeadCapture($params, $data, $request, $response)
+    {
+        if (empty($params['apiKey'])) throw new BadRequest('No API key provided.');
+        if (empty($data)) throw new BadRequest('No payload provided.');
+
+        $allowOrigin = $this->getConfig()->get('leadCaptureAllowOrigin', '*');
+        $response->headers->set('Access-Control-Allow-Origin', $allowOrigin);
+
+        return $this->getRecordService()->leadCapture($params['apiKey'], $data);
+    }
+
+    public function optionsActionLeadCapture($params, $data, $request, $response)
+    {
+        if (empty($params['apiKey'])) throw new BadRequest('No API key provided.');
+
+        if (!$this->getRecordService()->isApiKeyValid($params['apiKey'])) {
+            throw new NotFound();
+        }
+
+        $allowOrigin = $this->getConfig()->get('leadCaptureAllowOrigin', '*');
+
+        $response->headers->set('Access-Control-Allow-Headers', 'Content-Type, Accept');
+        $response->headers->set('Access-Control-Allow-Origin', $allowOrigin);
+        $response->headers->set('Access-Control-Allow-Methods', 'POST');
+
+        return true;
+    }
+
+    public function postActionGenerateNewApiKey($params, $data, $request)
+    {
+        if (empty($data->id)) throw new BadRequest();
+
+        return $this->getRecordService()->generateNewApiKeyForEntity($data->id)->getValueMap();
+    }
+
+    public function getActionSmtpAccountDataList()
+    {
+        if (!$this->getUser()->isAdmin()) throw new Forbidden();
+
+        return $this->getServiceFactory()->create('LeadCapture')->getSmtpAccountDataList();
+    }
+}

application/Espo/Controllers/LeadCaptureLogRecord.php

@@ -0,0 +1,38 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\BadRequest;
+
+class LeadCaptureLogRecord extends \Espo\Core\Controllers\Record
+{
+
+}

application/Espo/Controllers/Metadata.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -25,15 +25,27 @@
  *
  * In accordance with Section 7(b) of the GNU General Public License version 3,
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
- ************************************************************************/ 
+ ************************************************************************/
 
 namespace Espo\Controllers;
 
+use \Espo\Core\Exceptions\Forbidden;
+
 class Metadata extends \Espo\Core\Controllers\Base
 {
 
     public function actionRead($params, $data)
     {
-        return $this->getMetadata()->getAll(true);
+        return $this->getServiceFactory()->create('Metadata')->getDataForFrontend();
+    }
+
+    public function getActionGet($params, $data, $request)
+    {
+        if (!$this->getUser()->isAdmin()) {
+            throw new \Forbidden();
+        }
+        $key = $request->get('key');
+
+        return $this->getMetadata()->get($key, false);
     }
 }

application/Espo/Controllers/Note.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

application/Espo/Controllers/Notification.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -35,17 +35,18 @@ class Notification extends \Espo\Core\Controllers\Record
 {
     public static $defaultAction = 'list';
 
-    public function actionList($params, $data, $request)
+    public function getActionList($params, $data, $request, $response)
     {
-        $scope = $params['scope'];
-        $id = $params['id'];
-
         $userId = $this->getUser()->id;
 
         $offset = intval($request->get('offset'));
         $maxSize = intval($request->get('maxSize'));
         $after = $request->get('after');
 
+        if (empty($maxSize)) {
+            $maxSize = self::MAX_SIZE_LIMIT;
+        }
+
         $params = array(
             'offset' => $offset,
             'maxSize' => $maxSize,
@@ -72,29 +73,28 @@ class Notification extends \Espo\Core\Controllers\Record
         return $this->getService('Notification')->markAllRead($userId);
     }
 
-    public function actionExport($params, $data, $request)
+    public function beforeExport()
     {
         throw new Error();
     }
 
-    public function actionMassUpdate($params, $data, $request)
+    public function beforeMassUpdate()
     {
         throw new Error();
     }
 
-    public function actionCreateLink($params, $data, $request)
+    public function beforeCreateLink()
     {
         throw new Error();
     }
 
-    public function actionRemoveLink($params, $data, $request)
+    public function beforeRemoveLink()
     {
         throw new Error();
     }
 
-    public function actionMerge($params, $data, $request)
+    public function beforeMerge()
     {
         throw new Error();
     }
 }
-

application/Espo/Controllers/Pdf.php

@@ -0,0 +1,60 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\BadRequest;
+use \Espo\Core\Exceptions\Error;
+
+class Pdf extends \Espo\Core\Controllers\Base
+{
+    public function postActionMassPrint($params, $data)
+    {
+        if (empty($data->idList) || !is_array($data->idList)) {
+            throw new BadRequest();
+        }
+        if (empty($data->entityType)) {
+            throw new BadRequest();
+        }
+        if (empty($data->templateId)) {
+            throw new BadRequest();
+        }
+        if (!$this->getAcl()->checkScope('Template')) {
+            throw new Forbidden();
+        }
+        if (!$this->getAcl()->checkScope($data->entityType)) {
+            throw new Forbidden();
+        }
+
+        return [
+            'id' => $this->getServiceFactory()->create('Pdf')->massGenerate($data->entityType, $data->idList, $data->templateId, true)
+        ];
+    }
+}

application/Espo/Controllers/PhoneNumber.php

@@ -0,0 +1,37 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\Forbidden;
+
+class PhoneNumber extends \Espo\Core\Controllers\Record
+{
+
+}

application/Espo/Controllers/Portal.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

application/Espo/Controllers/PortalRole.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

application/Espo/Controllers/Preferences.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -88,16 +88,16 @@ class Preferences extends \Espo\Core\Controllers\Base
             throw new BadRequest();
         }
 
-        if ($this->getAcl()->getLevel('Preferences', 'read') === 'no') {
+        if ($this->getAcl()->getLevel('Preferences', 'edit') === 'no') {
             throw new Forbidden();
         }
 
         foreach ($this->getAcl()->getScopeForbiddenAttributeList('Preferences', 'edit') as $attribute) {
-            unset($data[$attribute]);
+            unset($data->$attribute);
         }
 
-        if (array_key_exists('smtpPassword', $data)) {
-            $data['smtpPassword'] = $this->getCrypt()->encrypt($data['smtpPassword']);
+        if (property_exists($data, 'smtpPassword')) {
+            $data->smtpPassword = $this->getCrypt()->encrypt($data->smtpPassword);
         }
 
         $user = $this->getEntityManager()->getEntity('User', $userId);
@@ -113,7 +113,7 @@ class Preferences extends \Espo\Core\Controllers\Base
 
             $entity->clear('smtpPassword');
 
-            return $entity->toArray();
+            return $entity->getValueMap();
         }
         throw new Error();
     }
@@ -132,6 +132,7 @@ class Preferences extends \Espo\Core\Controllers\Base
 
         $entity->set('smtpEmailAddress', $user->get('emailAddress'));
         $entity->set('name', $user->get('name'));
+        $entity->set('isPortalUser', $user->isPortal());
 
         $entity->clear('smtpPassword');
 
@@ -139,7 +140,47 @@ class Preferences extends \Espo\Core\Controllers\Base
             $entity->clear($attribute);
         }
 
-        return $entity->toArray();
+        return $entity->getValueMap();
+    }
+
+    public function postActionResetDashboard($params, $data)
+    {
+        if (empty($data->id)) throw new BadRequest();
+
+        $userId = $data->id;
+
+        $this->handleUserAccess($userId);
+
+        $user = $this->getEntityManager()->getEntity('User', $userId);
+        $preferences = $this->getEntityManager()->getEntity('Preferences', $userId);
+        if (!$user)  throw new NotFound();
+        if (!$preferences)  throw new NotFound();
+
+        if ($user->isPortal()) throw new Forbidden();
+
+        if ($this->getAcl()->getLevel('Preferences', 'edit') === 'no') {
+            throw new Forbidden();
+        }
+
+        $forbiddenAttributeList = $this->getAcl()->getScopeForbiddenAttributeList('Preferences', 'edit');
+
+        if (in_array('dashboardLayout', $forbiddenAttributeList)) {
+            throw new Forbidden();
+        }
+
+        $dashboardLayout = $this->getConfig()->get('dashboardLayout');
+        $dashletsOptions = $this->getConfig()->get('dashletsOptions');
+
+        $preferences->set([
+            'dashboardLayout' => $dashboardLayout,
+            'dashletsOptions' => $dashletsOptions
+        ]);
+
+        $this->getEntityManager()->saveEntity($preferences);
+
+        return (object) [
+            'dashboardLayout' => $preferences->get('dashboardLayout'),
+            'dashletsOptions' => $preferences->get('dashletsOptions')
+        ];
     }
 }
-

application/Espo/Controllers/Role.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

application/Espo/Controllers/ScheduledJob.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -25,10 +25,12 @@
  *
  * In accordance with Section 7(b) of the GNU General Public License version 3,
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
- ************************************************************************/ 
+ ************************************************************************/
 
 namespace Espo\Controllers;
 
+use Espo\Core\Exceptions\Forbidden;
+
 class ScheduledJob extends \Espo\Core\Controllers\Record
 {
     protected function checkControllerAccess()
@@ -38,4 +40,3 @@ class ScheduledJob extends \Espo\Core\Controllers\Record
         }
     }
 }
-

application/Espo/Controllers/ScheduledJobLogRecord.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -25,10 +25,12 @@
  *
  * In accordance with Section 7(b) of the GNU General Public License version 3,
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
- ************************************************************************/ 
+ ************************************************************************/
 
 namespace Espo\Controllers;
 
+use Espo\Core\Exceptions\Forbidden;
+
 class ScheduledJobLogRecord extends \Espo\Core\Controllers\Record
 {
     protected function checkControllerAccess()
@@ -38,4 +40,3 @@ class ScheduledJobLogRecord extends \Espo\Core\Controllers\Record
         }
     }
 }
-

application/Espo/Controllers/Settings.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -29,26 +29,23 @@
 
 namespace Espo\Controllers;
 
-use \Espo\Core\Exceptions\Error;
-use \Espo\Core\Exceptions\Forbidden;
-use \Espo\Core\Exceptions\BadRequest;
+use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Exceptions\BadRequest;
 
 class Settings extends \Espo\Core\Controllers\Base
 {
     protected function getConfigData()
     {
-        $data = $this->getConfig()->getData($this->getUser()->isAdmin());
+        $data = $this->getServiceFactory()->create('Settings')->getConfigData();
 
-        $fieldDefs = $this->getMetadata()->get('entityDefs.Settings.fields');
+        $data->jsLibs = $this->getMetadata()->get(['app', 'jsLibs']);
 
-        foreach ($fieldDefs as $field => $d) {
-            if ($d['type'] == 'password') {
-                unset($data[$field]);
-            }
+        unset($data->loginView);
+        $loginView = $this->getMetadata()->get(['clientDefs', 'App', 'loginView']);
+        if ($loginView) {
+            $data->loginView = $loginView;
         }
 
-        $data['jsLibs'] = $this->getMetadata()->get('app.jsLibs');
-
         return $data;
     }
 
@@ -72,22 +69,29 @@ class Settings extends \Espo\Core\Controllers\Base
             throw new BadRequest();
         }
 
-        if (isset($data['useCache']) && $data['useCache'] != $this->getConfig()->get('useCache')) {
-            $this->getContainer()->get('dataManager')->clearCache();
-        }
-
-        $this->getConfig()->setData($data, $this->getUser()->isAdmin());
-        $result = $this->getConfig()->save();
-        if ($result === false) {
-            throw new Error('Cannot save settings');
-        }
-
-        /** Rebuild for Currency Settings */
-        if (isset($data['baseCurrency']) || isset($data['currencyRates'])) {
-            $this->getContainer()->get('dataManager')->rebuildDatabase(array());
-        }
-        /** END Rebuild for Currency Settings */
+        $this->getServiceFactory()->create('Settings')->setConfigData($data);
 
         return $this->getConfigData();
     }
+
+    public function postActionTestLdapConnection($params, $data)
+    {
+        if (!$this->getUser()->isAdmin()) {
+            throw new Forbidden();
+        }
+
+        if (!isset($data->password)) {
+            $data->password = $this->getConfig()->get('ldapPassword');
+        }
+
+        $data = get_object_vars($data);
+
+        $ldapUtils = new \Espo\Core\Utils\Authentication\LDAP\Utils();
+        $options = $ldapUtils->normalizeOptions($data);
+
+        $ldapClient = new \Espo\Core\Utils\Authentication\LDAP\Client($options);
+        $ldapClient->bind(); //an exception if no connection
+
+        return true;
+    }
 }

application/Espo/Controllers/Stream.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -46,27 +46,64 @@ class Stream extends \Espo\Core\Controllers\Base
         $maxSize = intval($request->get('maxSize'));
         $after = $request->get('after');
         $filter = $request->get('filter');
+        $skipOwn = $request->get('skipOwn') === 'true';
 
         $service = $this->getService('Stream');
 
+        $maxSizeLimit = $this->getConfig()->get('recordListMaxSizeLimit', self::MAX_SIZE_LIMIT);
         if (empty($maxSize)) {
-            $maxSize = self::MAX_SIZE_LIMIT;
+            $maxSize = $maxSizeLimit;
         }
-        if (!empty($maxSize) && $maxSize > self::MAX_SIZE_LIMIT) {
-            throw new Forbidden();
+        if (!empty($maxSize) && $maxSize > $maxSizeLimit) {
+            throw new Forbidden("Max size should should not exceed " . $maxSizeLimit . ". Use offset and limit.");
         }
 
-        $result = $service->find($scope, $id, array(
+        $result = $service->find($scope, $id, [
             'offset' => $offset,
             'maxSize' => $maxSize,
             'after' => $after,
-            'filter' => $filter
-        ));
+            'filter' => $filter,
+            'skipOwn' => $skipOwn,
+        ]);
 
-        return array(
-            'total' => $result['total'],
-            'list' => $result['collection']->toArray()
-        );
+        return (object) [
+            'total' => $result->total,
+            'list' => $result->collection->getValueMapList()
+        ];
+    }
+
+    public function getActionListPosts($params, $data, $request)
+    {
+        $scope = $params['scope'];
+        $id = isset($params['id']) ? $params['id'] : null;
+
+        $offset = intval($request->get('offset'));
+        $maxSize = intval($request->get('maxSize'));
+        $after = $request->get('after');
+
+        $where = $request->get('where');
+
+        $service = $this->getService('Stream');
+
+        $maxSizeLimit = $this->getConfig()->get('recordListMaxSizeLimit', self::MAX_SIZE_LIMIT);
+        if (empty($maxSize)) {
+            $maxSize = $maxSizeLimit;
+        }
+        if (!empty($maxSize) && $maxSize > $maxSizeLimit) {
+            throw new Forbidden("Max size should should not exceed " . $maxSizeLimit . ". Use offset and limit.");
+        }
+
+        $result = $service->find($scope, $id, [
+            'offset' => $offset,
+            'maxSize' => $maxSize,
+            'after' => $after,
+            'filter' => 'posts',
+            'where' => $where,
+        ]);
+
+        return (object) [
+            'total' => $result->total,
+            'list' => $result->collection->getValueMapList()
+        ];
     }
 }
-

application/Espo/Controllers/Team.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -31,6 +31,4 @@ namespace Espo\Controllers;
 
 class Team extends \Espo\Core\Controllers\Record
 {
-
-
 }

application/Espo/Controllers/Template.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -35,4 +35,3 @@ class Template extends \Espo\Core\Controllers\Record
 {
 
 }
-

application/Espo/Controllers/TemplateManager.php

@@ -0,0 +1,122 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use Espo\Core\Utils as Utils;
+use \Espo\Core\Exceptions\NotFound;
+use \Espo\Core\Exceptions\Error;
+use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\BadRequest;
+
+class TemplateManager extends \Espo\Core\Controllers\Base
+{
+    protected function checkControllerAccess()
+    {
+        if (!$this->getUser()->isAdmin()) {
+            throw new Forbidden();
+        }
+    }
+
+    public function getActionGetTemplate($params, $data, $request)
+    {
+        $name = $request->get('name');
+        if (empty($name)) throw new BadRequest();
+        $scope = $request->get('scope');
+        $module = null;
+        $module = $this->getMetadata()->get(['app', 'templates', $name, 'module']);
+        $hasSubject = !$this->getMetadata()->get(['app', 'templates', $name, 'noSubject']);
+
+        $templateFileManager = $this->getContainer()->get('templateFileManager');
+
+        $returnData = (object) [];
+        $returnData->body = $templateFileManager->getTemplate($name, 'body', $scope, $module);
+
+        if ($hasSubject) {
+            $returnData->subject = $templateFileManager->getTemplate($name, 'subject', $scope, $module);
+        }
+
+        return $returnData;
+    }
+
+    public function postActionSaveTemplate($params, $data)
+    {
+        $scope = null;
+        if (empty($data->name)) {
+            throw new BadRequest();
+        }
+        if (!empty($data->scope)) {
+            $scope = $data->scope;
+        }
+
+        $templateFileManager = $this->getContainer()->get('templateFileManager');
+
+        if (isset($data->subject)) {
+            $templateFileManager->saveTemplate($data->name, 'subject', $data->subject, $scope);
+        }
+
+        if (isset($data->body)) {
+            $templateFileManager->saveTemplate($data->name, 'body', $data->body, $scope);
+        }
+
+        return true;
+    }
+
+    public function postActionResetTemplate($params, $data)
+    {
+        $scope = null;
+        if (empty($data->name)) {
+            throw new BadRequest();
+        }
+        if (!empty($data->scope)) {
+            $scope = $data->scope;
+        }
+
+        $module = null;
+        $module = $this->getMetadata()->get(['app', 'templates', $data->name, 'module']);
+        $hasSubject = !$this->getMetadata()->get(['app', 'templates', $data->name, 'noSubject']);
+
+        $templateFileManager = $this->getContainer()->get('templateFileManager');
+
+        if ($hasSubject) {
+            $templateFileManager->resetTemplate($data->name, 'subject', $scope);
+        }
+
+        $templateFileManager->resetTemplate($data->name, 'body', $scope);
+
+        $returnData = (object) [];
+        $returnData->body = $templateFileManager->getTemplate($data->name, 'body', $scope, $module);
+
+        if ($hasSubject) {
+            $returnData->subject = $templateFileManager->getTemplate($data->name, 'subject', $scope, $module);
+        }
+
+        return $returnData;
+    }
+}

application/Espo/Controllers/User.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -57,53 +57,59 @@ class User extends \Espo\Core\Controllers\Record
 
     public function postActionChangeOwnPassword($params, $data, $request)
     {
-        if (!array_key_exists('password', $data) || !array_key_exists('currentPassword', $data)) {
+        if (!property_exists($data, 'password') || !property_exists($data, 'currentPassword')) {
             throw new BadRequest();
         }
-        return $this->getService('User')->changePassword($this->getUser()->id, $data['password'], true, $data['currentPassword']);
+        return $this->getService('User')->changePassword($this->getUser()->id, $data->password, true, $data->currentPassword);
     }
 
     public function postActionChangePasswordByRequest($params, $data, $request)
     {
-        if (empty($data['requestId']) || empty($data['password'])) {
+        if (empty($data->requestId) || empty($data->password)) {
             throw new BadRequest();
         }
 
-        $p = $this->getEntityManager()->getRepository('PasswordChangeRequest')->where(array(
-            'requestId' => $data['requestId']
-        ))->findOne();
-
-        if (!$p) {
-            throw new Forbidden();
-        }
-        $userId = $p->get('userId');
-        if (!$userId) {
-            throw new Error();
-        }
-
-        $this->getEntityManager()->removeEntity($p);
-
-        if ($this->getService('User')->changePassword($userId, $data['password'])) {
-            return array(
-                'url' => $p->get('url')
-            );
-        }
+        return $this->getService('User')->changePasswordByRequest($data->requestId, $data->password);
     }
 
     public function postActionPasswordChangeRequest($params, $data, $request)
     {
-        if (empty($data['userName']) || empty($data['emailAddress'])) {
+        if (empty($data->userName) || empty($data->emailAddress)) {
             throw new BadRequest();
         }
 
-        $userName = $data['userName'];
-        $emailAddress = $data['emailAddress'];
+        $userName = $data->userName;
+        $emailAddress = $data->emailAddress;
         $url = null;
-        if (!empty($data['url'])) {
-            $url = $data['url'];
+        if (!empty($data->url)) {
+            $url = $data->url;
         }
 
         return $this->getService('User')->passwordChangeRequest($userName, $emailAddress, $url);
     }
-}
 
+    public function postActionGenerateNewApiKey($params, $data, $request)
+    {
+        if (empty($data->id)) throw new BadRequest();
+        if (!$this->getUser()->isAdmin()) throw new Forbidden();
+        return $this->getRecordService()->generateNewApiKeyForEntity($data->id)->getValueMap();
+    }
+
+    public function postActionGenerateNewPassword($params, $data, $request)
+    {
+        if (empty($data->id)) throw new BadRequest();
+        if (!$this->getUser()->isAdmin()) throw new Forbidden();
+        $this->getRecordService()->generateNewPasswordForUser($data->id);
+        return true;
+    }
+
+    public function beforeCreateLink()
+    {
+        if (!$this->getUser()->isAdmin()) throw new Forbidden();
+    }
+
+    public function beforeRemoveLink($params, $data, $request)
+    {
+        if (!$this->getUser()->isAdmin()) throw new Forbidden();
+    }
+}

application/Espo/Controllers/UserSecurity.php

@@ -0,0 +1,77 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\Error;
+use \Espo\Core\Exceptions\Forbidden;
+use \Espo\Core\Exceptions\NotFound;
+use \Espo\Core\Exceptions\BadRequest;
+
+class UserSecurity extends \Espo\Core\Controllers\Base
+{
+    protected function checkControllerAccess()
+    {
+        if (!$this->getUser()->isAdmin() && !$this->getUser()->isRegular()) {
+            throw new Forbidden();
+        }
+    }
+
+    public function getActionRead($params, $data, $request)
+    {
+        $id = $params['id'] ?? null;
+
+        if (!$id) throw new BadRequest();
+        if (!$this->getUser()->isAdmin() && $id !== $this->getUser()->id) throw new Forbidden();
+
+        return $this->getService('UserSecurity')->read($id);
+    }
+
+    public function postActionGenerate2FAData($params, $data)
+    {
+        $data = $data ?? (object) [];
+        $id = $data->id;
+
+        if (!$id) throw new BadRequest();
+        if (!$this->getUser()->isAdmin() && $id !== $this->getUser()->id) throw new Forbidden();
+
+        return $this->getService('UserSecurity')->generate2FAData($id, $data);
+    }
+
+    public function putActionUpdate($params, $data)
+    {
+        $id = $params['id'] ?? null;
+        $data = $data ?? (object) [];
+
+        if (!$id) throw new BadRequest();
+        if (!$this->getUser()->isAdmin() && $id !== $this->getUser()->id) throw new Forbidden();
+
+        return $this->getService('UserSecurity')->update($id, $data);
+    }
+}

application/Espo/Controllers/Webhook.php

@@ -0,0 +1,50 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+use \Espo\Core\Exceptions\Error;
+use \Espo\Core\Exceptions\Forbidden;
+
+class Webhook extends \Espo\Core\Controllers\Record
+{
+    protected function checkControllerAccess()
+    {
+        if (!$this->getUser()->isAdmin() && !$this->getUser()->isApi()) {
+            throw new Forbidden();
+        }
+    }
+
+    public function actionCreate($params, $data, $request, $response = null)
+    {
+        $result = parent::actionCreate($params, $data, $request, $response);
+        if ($response) $response->setStatus(201);
+        return $result;
+    }
+}

application/Espo/Core/Acl.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -69,6 +69,11 @@ class Acl
         return $this->getAclManager()->get($this->getUser(), $permission);
     }
 
+    public function checkReadNo($scope)
+    {
+        return $this->getAclManager()->checkReadNo($this->getUser(), $scope);
+    }
+
     public function checkReadOnlyTeam($scope)
     {
         return $this->getAclManager()->checkReadOnlyTeam($this->getUser(), $scope);
@@ -118,5 +123,34 @@ class Acl
     {
         return $this->getAclManager()->getScopeForbiddenFieldList($this->getUser(), $scope, $action, $thresholdLevel);
     }
-}
 
+    public function getScopeForbiddenLinkList($scope, $action = 'read', $thresholdLevel = 'no')
+    {
+        return $this->getAclManager()->getScopeForbiddenLinkList($this->getUser(), $scope, $action, $thresholdLevel);
+    }
+
+    public function checkUserPermission($target, $permissionType = 'userPermission')
+    {
+        return $this->getAclManager()->checkUserPermission($this->getUser(), $target, $permissionType);
+    }
+
+    public function checkAssignmentPermission($target)
+    {
+        return $this->getAclManager()->checkAssignmentPermission($this->getUser(), $target);
+    }
+
+    public function getScopeRestrictedFieldList($scope, $type)
+    {
+        return $this->getAclManager()->getScopeRestrictedFieldList($scope, $type);
+    }
+
+    public function getScopeRestrictedAttributeList($scope, $type)
+    {
+        return $this->getAclManager()->getScopeRestrictedAttributeList($scope, $type);
+    }
+
+    public function getScopeRestrictedLinkList($scope, $type)
+    {
+        return $this->getAclManager()->getScopeRestrictedLinkList($scope, $type);
+    }
+}

application/Espo/Core/Acl/Base.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -36,15 +36,21 @@ use \Espo\ORM\Entity;
 
 class Base implements Injectable
 {
-    protected $dependencies = array(
+    protected $dependencyList = [
         'config',
         'entityManager',
-        'aclManager'
-    );
+        'aclManager',
+    ];
+
+    protected $dependencies = []; // for backward compatibility
 
     protected $scope;
 
-    protected $injections = array();
+    protected $injections = [];
+
+    protected $ownerUserIdAttribute = null;
+
+    protected $allowDeleteCreatedThresholdPeriod = '24 hours';
 
     public function inject($name, $object)
     {
@@ -66,14 +72,21 @@ class Base implements Injectable
         return $this->injections[$name];
     }
 
+    protected function addDependencyList(array $list)
+    {
+        foreach ($list as $item) {
+            $this->addDependency($item);
+        }
+    }
+
     protected function addDependency($name)
     {
-        $this->dependencies[] = $name;
+        $this->dependencyList[] = $name;
     }
 
     public function getDependencyList()
     {
-        return $this->dependencies;
+        return array_merge($this->dependencyList, $this->dependencies);
     }
 
     protected function getConfig()
@@ -99,6 +112,14 @@ class Base implements Injectable
         return $data->read === 'team';
     }
 
+    public function checkReadNo(User $user, $data)
+    {
+        if (empty($data) || !is_object($data) || !isset($data->read)) {
+            return false;
+        }
+        return $data->read === 'no';
+    }
+
     public function checkReadOnlyOwn(User $user, $data)
     {
         if (empty($data) || !is_object($data) || !isset($data->read)) {
@@ -148,7 +169,7 @@ class Base implements Injectable
         }
 
         if (!isset($data->$action)) {
-            return true;
+            return false;
         }
 
         $value = $data->$action;
@@ -202,7 +223,7 @@ class Base implements Injectable
             }
         }
 
-        if ($entity->hasAttribute('assignedUsersIds') && $entity->hasRelation('assignedUsers')) {
+        if ($entity->hasLinkMultipleField('assignedUsers')) {
             if ($entity->hasLinkMultipleId('assignedUsers', $user->id)) {
                 return true;
             }
@@ -245,16 +266,31 @@ class Base implements Injectable
 
         if (is_object($data)) {
             if ($data->edit !== 'no' || $data->create !== 'no') {
-                if ($entity->has('createdById') && $entity->get('createdById') == $user->id) {
+                if (
+                    $this->getConfig()->get('aclAllowDeleteCreated')
+                    &&
+                    $entity->has('createdById') && $entity->get('createdById') == $user->id
+                ) {
+                    $isDeletedAllowed = false;
                     if (!$entity->has('assignedUserId')) {
-                        return true;
+                        $isDeletedAllowed = true;
                     } else {
                         if (!$entity->get('assignedUserId')) {
-                            return true;
+                            $isDeletedAllowed = true;
+                        } else if ($entity->get('assignedUserId') == $entity->get('createdById')) {
+                            $isDeletedAllowed = true;
                         }
-                        if ($entity->get('assignedUserId') == $entity->get('createdById')) {
-                            return true;
+                    }
+
+                    if ($isDeletedAllowed) {
+                        $createdAt = $entity->get('createdAt');
+                        if ($createdAt) {
+                            $deleteThresholdPeriod = $this->getConfig()->get('aclAllowDeleteCreatedThresholdPeriod', $this->allowDeleteCreatedThresholdPeriod);
+                            if (\Espo\Core\Utils\DateTime::isAfterThreshold($createdAt, $deleteThresholdPeriod)) {
+                                return false;
+                            }
                         }
+                        return true;
                     }
                 }
             }
@@ -262,5 +298,23 @@ class Base implements Injectable
 
         return false;
     }
-}
 
+    public function getOwnerUserIdAttribute(Entity $entity)
+    {
+        if ($this->ownerUserIdAttribute) {
+            return $this->ownerUserIdAttribute;
+        }
+
+        if ($entity->hasLinkMultipleField('assignedUsers')) {
+            return 'assignedUsersIds';
+        }
+
+        if ($entity->hasAttribute('assignedUserId')) {
+            return 'assignedUserId';
+        }
+
+        if ($entity->hasAttribute('createdById')) {
+            return 'createdById';
+        }
+    }
+}

application/Espo/Core/Acl/GlobalRestricton.php

@@ -0,0 +1,197 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Acl;
+
+class GlobalRestricton
+{
+    protected $fieldTypeList = [
+        'forbidden', // totally forbidden
+        'internal', // reading forbidden, writing allowed
+        'onlyAdmin', // forbidden for non admin users
+        'readOnly', // read-only for all users
+        'nonAdminReadOnly' // read-only for non-admin users
+    ];
+
+    protected $linkTypeList = [
+        'forbidden', // totally forbidden
+        'internal', // reading forbidden, writing allowed
+        'onlyAdmin', // forbidden for non admin users
+        'readOnly', // read-only for all users
+        'nonAdminReadOnly' // read-only for non-admin users
+    ];
+
+    protected $cacheFilePath = 'data/cache/application/entityAcl.php';
+
+    private $metadata;
+
+    private $fileManager;
+
+    private $fieldManagerUtil;
+
+    private $data;
+
+    public function __construct(
+        \Espo\Core\Utils\Metadata $metadata,
+        \Espo\Core\Utils\File\Manager $fileManager,
+        \Espo\Core\Utils\FieldManagerUtil $fieldManagerUtil,
+        bool $useCache = true
+    )
+    {
+        $this->metadata = $metadata;
+        $this->fileManager = $fileManager;
+        $this->fieldManagerUtil = $fieldManagerUtil;
+
+        $isFromCache = false;
+
+        if ($useCache) {
+            if (file_exists($this->cacheFilePath)) {
+                $this->data = include($this->cacheFilePath);
+                $isFromCache = true;
+
+                if (!($this->data instanceof \StdClass)) {
+                    $GLOBALS['log']->error("ACL GlobalRestricton: Bad data fetched from cache.");
+                    $this->data = null;
+                }
+            }
+        }
+
+        if (!$this->data) {
+            $this->buildData();
+        }
+
+        if ($useCache) {
+            if (!$isFromCache) {
+                $this->storeCacheFile();
+            }
+        }
+    }
+
+    protected function storeCacheFile()
+    {
+        $this->getFileManager()->putPhpContents($this->cacheFilePath, $this->data, true);
+    }
+
+    protected function buildData()
+    {
+        $scopeList = array_keys($this->getMetadata()->get(['entityDefs'], []));
+
+        $data = (object) [];
+
+        foreach ($scopeList as $scope) {
+            $fieldList = array_keys($this->getMetadata()->get(['entityDefs', $scope, 'fields'], []));
+            $linkList = array_keys($this->getMetadata()->get(['entityDefs', $scope, 'links'], []));
+
+            $isNotEmpty = false;
+
+            $scopeData = (object) [
+                'fields' => (object) [],
+                'attributes' => (object) [],
+                'links' => (object) []
+            ];
+
+            foreach ($this->fieldTypeList as $type) {
+                $resultFieldList = [];
+                $resultAttributeList = [];
+
+                foreach ($fieldList as $field) {
+                    if ($this->getMetadata()->get(['entityAcl', $scope, 'fields', $field, $type])) {
+                        $isNotEmpty = true;
+                        $resultFieldList[] = $field;
+                        $fieldAttributeList = $this->getFieldManagerUtil()->getAttributeList($scope, $field);
+                        foreach ($fieldAttributeList as $attribute) {
+                            $resultAttributeList[] = $attribute;
+                        }
+                    }
+                }
+
+                $scopeData->fields->$type = $resultFieldList;
+                $scopeData->attributes->$type = $resultAttributeList;
+            }
+            foreach ($this->linkTypeList as $type) {
+                $resultLinkList = [];
+                foreach ($linkList as $link) {
+                    if ($this->getMetadata()->get(['entityAcl', $scope, 'links', $link, $type])) {
+                        $isNotEmpty = true;
+                        $resultLinkList[] = $link;
+                    }
+                }
+                $scopeData->links->$type = $resultLinkList;
+            }
+
+            if ($isNotEmpty) {
+                $data->$scope = $scopeData;
+            }
+        }
+
+        $this->data = $data;
+    }
+
+    protected function getMetadata()
+    {
+        return $this->metadata;
+    }
+
+    protected function getFileManager()
+    {
+        return $this->fileManager;
+    }
+
+    protected function getFieldManagerUtil()
+    {
+        return $this->fieldManagerUtil;
+    }
+
+    public function getScopeRestrictedFieldList($scope, $type)
+    {
+        if (!property_exists($this->data, $scope)) return [];
+        if (!property_exists($this->data->$scope, 'fields')) return [];
+        if (!property_exists($this->data->$scope->fields, $type)) return [];
+
+        return $this->data->$scope->fields->$type;
+    }
+
+    public function getScopeRestrictedAttributeList($scope, $type)
+    {
+        if (!property_exists($this->data, $scope)) return [];
+        if (!property_exists($this->data->$scope, 'attributes')) return [];
+        if (!property_exists($this->data->$scope->attributes, $type)) return [];
+
+        return $this->data->$scope->attributes->$type;
+    }
+
+    public function getScopeRestrictedLinkList($scope, $type)
+    {
+        if (!property_exists($this->data, $scope)) return [];
+        if (!property_exists($this->data->$scope, 'links')) return [];
+        if (!property_exists($this->data->$scope->links, $type)) return [];
+
+        return $this->data->$scope->links->$type;
+    }
+}

application/Espo/Core/Acl/Table.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -36,7 +36,7 @@ use \Espo\Entities\User;
 
 use \Espo\Core\Utils\Config;
 use \Espo\Core\Utils\Metadata;
-use \Espo\Core\Utils\FieldManager;
+use \Espo\Core\Utils\FieldManagerUtil;
 use \Espo\Core\Utils\File\Manager as FileManager;
 
 class Table
@@ -59,13 +59,9 @@ class Table
 
     protected $fieldLevelList = ['yes', 'no'];
 
-    protected $valuePermissionList = ['assignmentPermission', 'userPermission', 'portalPermission'];
+    protected $valuePermissionHighestLevels = array();
 
-    protected $valuePrtmissionHighestLevels = array(
-        'assignmentPermission' => 'all',
-        'userPermission' => 'all',
-        'portalPermission' => 'yes'
-    );
+    protected $valuePermissionList = [];
 
     private $fileManager;
 
@@ -77,7 +73,11 @@ class Table
 
     protected $forbiddenFieldsCache = array();
 
-    public function __construct(User $user, Config $config = null, FileManager $fileManager = null, Metadata $metadata = null, FieldManager $fieldManager = null)
+    protected $isStrictModeForced = false;
+
+    protected $isStrictMode = false;
+
+    public function __construct(User $user, Config $config = null, FileManager $fileManager = null, Metadata $metadata = null, FieldManagerUtil $fieldManager = null)
     {
         $this->data = (object) [
             'table' => (object) [],
@@ -85,6 +85,12 @@ class Table
             'fieldTableQuickAccess' => (object) [],
         ];
 
+        if ($this->isStrictModeForced) {
+            $this->isStrictMode = true;
+        } else {
+            $this->isStrictMode = $config->get('aclStrictMode', true);
+        }
+
         $this->user = $user;
 
         $this->metadata = $metadata;
@@ -97,12 +103,11 @@ class Table
             throw new Error('User must be fetched before ACL check.');
         }
 
-        $this->user->loadLinkMultipleField('teams');
-
         if ($fileManager) {
             $this->fileManager = $fileManager;
         }
-        $this->valuePermissionList = $this->metadata->get('app.' . $this->type . '.defs.valuePermissionList', $this->valuePermissionList);
+        $this->valuePermissionList = $this->metadata->get(['app', $this->type, 'valuePermissionList'], []);
+        $this->valuePermissionHighestLevels = $this->metadata->get(['app', $this->type, 'valuePermissionHighestLevels'], array());
 
         $this->initCacheFilePath();
 
@@ -119,7 +124,7 @@ class Table
 
     protected function initCacheFilePath()
     {
-        $this->cacheFilePath = 'data/cache/application/acl/' . $this->user->id . '.php';
+        $this->cacheFilePath = 'data/cache/application/acl/' . $this->getUser()->id . '.php';
     }
 
     protected function getUser()
@@ -137,11 +142,6 @@ class Table
         return $this->fieldManager;
     }
 
-    protected function getConfig()
-    {
-        return $this->config;
-    }
-
     public function getMap()
     {
         return $this->data;
@@ -169,7 +169,7 @@ class Table
         if (isset($this->data->$permission)) {
             return $this->data->$permission;
         }
-        return null;
+        return 'no';
     }
 
     public function getLevel($scope, $action)
@@ -179,7 +179,17 @@ class Table
                 return $this->data->table->$scope->$action;
             }
         }
-        return false;
+        return 'no';
+    }
+
+    public function getHighestLevel($scope, $action)
+    {
+        if (in_array($action, $this->booleanActionList)) {
+            return 'yes';
+        } else {
+            $level = $this->metadata->get(['scopes', $scope, $this->type . 'HighestLevel']);
+            return $level ?? 'all';
+        }
     }
 
     private function load()
@@ -192,7 +202,7 @@ class Table
         $aclTableList = [];
         $fieldTableList = [];
 
-        if (!$this->user->isAdmin()) {
+        if (!$this->getUser()->isAdmin()) {
             $roleList = $this->getRoleList();
 
             foreach ($roleList as $role) {
@@ -209,6 +219,8 @@ class Table
             $this->applyDefault($aclTable, $fieldTable);
             $this->applyDisabled($aclTable, $fieldTable);
             $this->applyMandatory($aclTable, $fieldTable);
+            $this->applyAdditional($aclTable, $fieldTable, $valuePermissionLists);
+            $this->applyReadOnlyFields($fieldTable);
         } else {
             $aclTable = (object) [];
             foreach ($this->getScopeList() as $scope) {
@@ -242,9 +254,13 @@ class Table
 
         $this->fillFieldTableQuickAccess();
 
-        if (!$this->user->isAdmin()) {
+        if (!$this->getUser()->isAdmin()) {
+            $permissionsDefaultsGroupName = 'permissionsDefaults';
+            if ($this->isStrictMode) {
+                $permissionsDefaultsGroupName = 'permissionsStrictDefaults';
+            }
             foreach ($this->valuePermissionList as $permission) {
-                $this->data->$permission = $this->mergeValueList($valuePermissionLists->$permission, $this->metadata->get('app.'.$this->type.'.default.' . $permission, 'yes'));
+                $this->data->$permission = $this->mergeValueList($valuePermissionLists->$permission, $this->metadata->get(['app', $this->type, $permissionsDefaultsGroupName, $permission, 'yes']));
                 if ($this->metadata->get('app.'.$this->type.'.mandatory.' . $permission)) {
                     $this->data->$permission = $this->metadata->get('app.'.$this->type.'.mandatory.' . $permission);
                 }
@@ -252,8 +268,8 @@ class Table
 
         } else {
             foreach ($this->valuePermissionList as $permission) {
-                if (isset($this->valuePrtmissionHighestLevels[$permission])) {
-                    $this->data->$permission = $this->valuePrtmissionHighestLevels[$permission];
+                if (isset($this->valuePermissionHighestLevels[$permission])) {
+                    $this->data->$permission = $this->valuePermissionHighestLevels[$permission];
                     continue;
                 }
                 $this->data->$permission = 'all';
@@ -266,11 +282,17 @@ class Table
         $roleList = [];
 
         $userRoleList = $this->getUser()->get('roles');
+        if (!(is_array($userRoleList) || $userRoleList instanceof \Traversable)) {
+            throw new Error();
+        }
         foreach ($userRoleList as $role) {
             $roleList[] = $role;
         }
 
         $teamList = $this->getUser()->get('teams');
+        if (!(is_array($teamList) || $teamList instanceof \Traversable)) {
+            throw new Error();
+        }
         foreach ($teamList as $team) {
             $teamRoleList = $team->get('roles');
             foreach ($teamRoleList as $role) {
@@ -396,11 +418,16 @@ class Table
 
     protected function applyDefault(&$table, &$fieldTable)
     {
-        if ($this->user->isAdmin()) {
+        if ($this->getUser()->isAdmin()) {
             return;
         }
 
-        $data = $this->metadata->get('app.'.$this->type.'.default.scopeLevel', array());
+        $defaultsGroupName = 'default';
+        if ($this->isStrictMode) {
+            $defaultsGroupName = 'strictDefault';
+        }
+
+        $data = $this->metadata->get(['app', $this->type, $defaultsGroupName, 'scopeLevel'], []);
 
         foreach ($data as $scope => $item) {
             if (isset($table->$scope)) continue;
@@ -411,7 +438,7 @@ class Table
             $table->$scope = $value;
         }
 
-        $defaultFieldData = $this->metadata->get('app.'.$this->type.'.default.fieldLevel', array());
+        $defaultFieldData = $this->metadata->get(['app', $this->type, $defaultsGroupName, 'fieldLevel'], []);
 
         foreach ($this->getScopeList() as $scope) {
             if (isset($table->$scope) && $table->$scope === false) continue;
@@ -419,7 +446,7 @@ class Table
 
             $fieldList = array_keys($this->getMetadata()->get("entityDefs.{$scope}.fields", []));
 
-            $defaultScopeFieldData = $this->metadata->get('app.'.$this->type.'.default.scopeFieldLevel.' . $scope, array());
+            $defaultScopeFieldData = $this->metadata->get('app.'.$this->type.'.'.$defaultsGroupName.'.scopeFieldLevel.' . $scope, []);
 
             foreach (array_merge($defaultFieldData, $defaultScopeFieldData) as $field => $f) {
                 if (!in_array($field, $fieldList)) continue;
@@ -449,11 +476,26 @@ class Table
                     $aclType = $this->defaultAclType;
                 }
                 if (!empty($aclType)) {
-                    $defaultValue = $this->metadata->get('app.'.$this->type.'.scopeLevelTypesDefaults.' . $aclType, $this->metadata->get('app.'.$this->type.'.scopeLevelTypesDefaults.record'));
+                    $paramDefaultsName = 'scopeLevelTypesDefaults';
+                    if ($this->isStrictMode) {
+                        $paramDefaultsName = 'scopeLevelTypesStrictDefaults';
+                    }
+                    $defaultValue = $this->metadata->get(['app', $this->type, $paramDefaultsName, $aclType], $this->metadata->get(['app', $this->type, $paramDefaultsName, 'record']));
                     if (is_array($defaultValue)) {
                         $defaultValue = (object) $defaultValue;
                     }
                     $table->$scope = $defaultValue;
+
+                    if (is_object($table->$scope)) {
+                        $actionList = $this->getMetadata()->get(['scopes', $scope, $this->type . 'ActionList']);
+                        if ($actionList) {
+                            foreach (get_object_vars($table->$scope) as $action => $level) {
+                                if (!in_array($action, $actionList)) {
+                                    unset($table->$scope->$action);
+                                }
+                            }
+                        }
+                    }
                 }
             }
         }
@@ -461,7 +503,7 @@ class Table
 
     protected function applyMandatory(&$table, &$fieldTable)
     {
-        if ($this->user->isAdmin()) {
+        if ($this->getUser()->isAdmin()) {
             return;
         }
 
@@ -508,7 +550,7 @@ class Table
 
     protected function applyDisabled(&$table, &$fieldTable)
     {
-        if ($this->user->isAdmin()) {
+        if ($this->getUser()->isAdmin()) {
             return;
         }
 
@@ -520,6 +562,19 @@ class Table
         }
     }
 
+    protected function applyAdditional(&$table, &$fieldTable, &$valuePermissionLists)
+    {
+        if ($this->getUser()->isPortal()) {
+            foreach ($this->getScopeList() as $scope) {
+                $table->$scope = false;
+                unset($fieldTable->$scope);
+            }
+            foreach ($this->valuePermissionList as $permission) {
+                $valuePermissionLists->{$permission}[] = 'no';
+            }
+        }
+    }
+
     private function mergeValueList(array $list, $defaultValue)
     {
         $result = null;
@@ -588,7 +643,9 @@ class Table
 
                     if (!is_object($row)) continue;
 
-                    foreach ($this->actionList as $i => $action) {
+                    $actionList = $this->getMetadata()->get(['scopes', $scope, $this->type . 'ActionList'], $this->actionList);
+
+                    foreach ($actionList as $i => $action) {
                         if (isset($row->$action)) {
                             $level = $row->$action;
                             if (!isset($data->$scope->$action)) {
@@ -605,7 +662,7 @@ class Table
                                 if (in_array($action, $this->booleanActionList)) {
                                     $data->$scope->$action = 'yes';
                                 } else {
-                                    if (isset($data->$scope->$previousAction)) {
+                                    if ($action === 'stream' && isset($data->$scope->$previousAction)) {
                                         $data->$scope->$action = $data->$scope->$previousAction;
                                     }
                                 }
@@ -666,25 +723,30 @@ class Table
 
     private function buildCache()
     {
-        $contents = '<' . '?'. 'php return ' .  $this->varExport($this->data)  . ';';
-        $this->fileManager->putContents($this->cacheFilePath, $contents);
+        $this->fileManager->putPhpContents($this->cacheFilePath, $this->data, true);
     }
 
-    private function varExport($variable)
+    protected function applyReadOnlyFields(&$fieldTable)
     {
-        if ($variable instanceof \StdClass) {
-            $result = '(object) ' . $this->varExport(get_object_vars($variable), true);
-        } else if (is_array($variable)) {
-            $array = array();
-            foreach ($variable as $key => $value) {
-                $array[] = var_export($key, true).' => ' . $this->varExport($value, true);
+        // TODO Enable in 5.4.0
+        return;
+        $scopeList = $this->getScopeWithAclList();
+        foreach ($scopeList as $scope) {
+            if (!property_exists($fieldTable, $scope)) continue;
+            $fieldList = array_keys($this->getMetadata()->get(['entityDefs', $scope, 'fields'], []));
+            foreach ($fieldList as $field) {
+                if ($this->getMetadata()->get(['entityDefs', $scope, 'fields', $field, 'readOnly'])) {
+                    if (property_exists($fieldTable->$scope, $field)) {
+                        $fieldTable->$scope->$field->edit = 'no';
+                    } else {
+                        $fieldTable->$scope->$field = (object) [];
+                        foreach ($this->fieldActionList as $action) {
+                            $fieldTable->$scope->$field->$action = 'yes';
+                        }
+                        $fieldTable->$scope->$field->edit = 'no';
+                    }
+                }
             }
-            $result = '['.implode(', ', $array).']';
-        } else {
-            $result = var_export($variable, true);
         }
-
-        return $result;
     }
 }
-

application/Espo/Core/AclManager.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -41,16 +41,27 @@ class AclManager
 
     private $metadata;
 
-    private $implementationHashMap = array();
+    private $implementationHashMap = [];
 
-    private $tableHashMap = array();
+    private $tableHashMap = [];
 
     protected $tableClassName = '\\Espo\\Core\\Acl\\Table';
 
+    protected $userAclClassName = '\\Espo\\Core\\Acl';
+
+    protected $globalRestricton;
+
     public function __construct(Container $container)
     {
         $this->container = $container;
         $this->metadata = $container->get('metadata');
+
+        $this->globalRestricton = new \Espo\Core\Acl\GlobalRestricton(
+            $container->get('metadata'),
+            $container->get('fileManager'),
+            $container->get('fieldManagerUtil'),
+            $container->get('config')->get('useCache')
+        );
     }
 
     protected function getContainer()
@@ -83,8 +94,8 @@ class AclManager
 
             if (class_exists($className)) {
                 $acl = new $className($scope);
-                $dependencies = $acl->getDependencyList();
-                foreach ($dependencies as $name) {
+                $dependencyList = $acl->getDependencyList();
+                foreach ($dependencyList as $name) {
                     $acl->inject($name, $this->getContainer()->get($name));
                 }
                 $this->implementationHashMap[$scope] = $acl;
@@ -98,13 +109,16 @@ class AclManager
 
     protected function getTable(User $user)
     {
-        $key = spl_object_hash($user);
+        $key = $user->id;
+        if (empty($key)) {
+            $key = spl_object_hash($user);
+        }
 
         if (empty($this->tableHashMap[$key])) {
             $config = $this->getContainer()->get('config');
             $fileManager = $this->getContainer()->get('fileManager');
             $metadata = $this->getContainer()->get('metadata');
-            $fieldManager = $this->getContainer()->get('fieldManager');
+            $fieldManager = $this->getContainer()->get('fieldManagerUtil');
 
             $this->tableHashMap[$key] = new $this->tableClassName($user, $config, $fileManager, $metadata, $fieldManager);
         }
@@ -120,7 +134,7 @@ class AclManager
     public function getLevel(User $user, $scope, $action)
     {
         if ($user->isAdmin()) {
-            return 'all';
+            return $this->getTable($user)->getHighestLevel($scope, $action);
         }
         return $this->getTable($user)->getLevel($scope, $action);
     }
@@ -130,6 +144,15 @@ class AclManager
         return $this->getTable($user)->get($permission);
     }
 
+    public function checkReadNo(User $user, $scope)
+    {
+        if ($user->isAdmin()) {
+            return false;
+        }
+        $data = $this->getTable($user)->getScopeData($scope);
+        return $this->getImplementation($scope)->checkReadNo($user, $data);
+    }
+
     public function checkReadOnlyTeam(User $user, $scope)
     {
         if ($user->isAdmin()) {
@@ -168,9 +191,15 @@ class AclManager
 
         $impl = $this->getImplementation($scope);
 
-        $methodName = 'checkEntity' . ucfirst($action);
-        if (method_exists($impl, $methodName)) {
-            return $impl->$methodName($user, $entity, $data);
+        if (!$action) {
+            $action = 'read';
+        }
+
+        if ($action) {
+            $methodName = 'checkEntity' . ucfirst($action);
+            if (method_exists($impl, $methodName)) {
+                return $impl->$methodName($user, $entity, $data);
+            }
         }
 
         return $impl->checkEntity($user, $entity, $data, $action);
@@ -181,7 +210,7 @@ class AclManager
         return $this->getImplementation($entity->getEntityType())->checkIsOwner($user, $entity);
     }
 
-    public function checkInTeam(User $user, Entity $entity, $action)
+    public function checkInTeam(User $user, Entity $entity)
     {
         return $this->getImplementation($entity->getEntityType())->checkInTeam($user, $entity);
     }
@@ -221,16 +250,163 @@ class AclManager
         return true;
     }
 
+    protected function getGlobalRestrictionTypeList(User $user, $action = 'read')
+    {
+        $typeList = ['forbidden'];
+
+        if ($action === 'read') {
+            $typeList[] = 'internal';
+        }
+
+        if (!$user->isAdmin()) {
+            $typeList[] = 'onlyAdmin';
+        }
+
+        if ($action === 'edit') {
+            $typeList[] = 'readOnly';
+            if (!$user->isAdmin()) {
+                $typeList[] = 'nonAdminReadOnly';
+            }
+        }
+
+        return $typeList;
+    }
+
     public function getScopeForbiddenAttributeList(User $user, $scope, $action = 'read', $thresholdLevel = 'no')
     {
-        if ($user->isAdmin()) return [];
-        return $this->getTable($user)->getScopeForbiddenAttributeList($scope, $action, $thresholdLevel);
+        $list = [];
+
+        if (!$user->isAdmin()) {
+            $list = $this->getTable($user)->getScopeForbiddenAttributeList($scope, $action, $thresholdLevel);
+        }
+
+        if ($thresholdLevel === 'no') {
+            $list = array_merge(
+                $list,
+                $this->getScopeRestrictedAttributeList($scope, $this->getGlobalRestrictionTypeList($user, $action))
+            );
+            $list = array_values($list);
+        }
+
+        return $list;
     }
 
     public function getScopeForbiddenFieldList(User $user, $scope, $action = 'read', $thresholdLevel = 'no')
     {
-        if ($user->isAdmin()) return [];
-        return $this->getTable($user)->getScopeForbiddenFieldList($scope, $action, $thresholdLevel);
+        $list = [];
+
+        if (!$user->isAdmin()) {
+            $list = $this->getTable($user)->getScopeForbiddenFieldList($scope, $action, $thresholdLevel);
+        }
+
+        if ($thresholdLevel === 'no') {
+            $list = array_merge(
+                $list,
+                $this->getScopeRestrictedFieldList($scope, $this->getGlobalRestrictionTypeList($user, $action))
+            );
+            $list = array_values($list);
+        }
+
+        return $list;
+    }
+
+
+    public function getScopeForbiddenLinkList(User $user, $scope, $action = 'read', $thresholdLevel = 'no')
+    {
+        $list = [];
+
+        if ($thresholdLevel === 'no') {
+            $list = array_merge(
+                $list,
+                $this->getScopeRestrictedLinkList($scope, $this->getGlobalRestrictionTypeList($user, $action))
+            );
+            $list = array_values($list);
+        }
+
+        return $list;
+    }
+
+    public function checkUserPermission(User $user, $target, $permissionType = 'userPermission')
+    {
+        $permission = $this->get($user, $permissionType);
+
+        if (is_object($target)) {
+            $userId = $target->id;
+        } else {
+            $userId = $target;
+        }
+
+        if ($user->id === $userId) return true;
+
+        if ($permission === 'no') {
+            return false;
+        }
+
+        if ($permission === 'yes') {
+            return true;
+        }
+
+        if ($permission === 'team') {
+            $teamIdList = $user->getLinkMultipleIdList('teams');
+            if (!$this->getContainer()->get('entityManager')->getRepository('User')->checkBelongsToAnyOfTeams($userId, $teamIdList)) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    public function checkAssignmentPermission(User $user, $target)
+    {
+        return $this->checkUserPermission($user, $target, 'assignmentPermission');
+    }
+
+    public function createUserAcl(User $user)
+    {
+        $className = $this->userAclClassName;
+        $acl = new $className($this, $user);
+        return $acl;
+    }
+
+    public function getScopeRestrictedFieldList($scope, $type)
+    {
+        if (is_array($type)) {
+            $typeList = $type;
+            $list = [];
+            foreach ($typeList as $type) {
+                $list = array_merge($list, $this->globalRestricton->getScopeRestrictedFieldList($scope, $type));
+            }
+            $list = array_values($list);
+            return $list;
+        }
+        return $this->globalRestricton->getScopeRestrictedFieldList($scope, $type);
+    }
+
+    public function getScopeRestrictedAttributeList($scope, $type)
+    {
+        if (is_array($type)) {
+            $typeList = $type;
+            $list = [];
+            foreach ($typeList as $type) {
+                $list = array_merge($list, $this->globalRestricton->getScopeRestrictedAttributeList($scope, $type));
+            }
+            $list = array_values($list);
+            return $list;
+        }
+        return $this->globalRestricton->getScopeRestrictedAttributeList($scope, $type);
+    }
+
+    public function getScopeRestrictedLinkList($scope, $type)
+    {
+        if (is_array($type)) {
+            $typeList = $type;
+            $list = [];
+            foreach ($typeList as $type) {
+                $list = array_merge($list, $this->globalRestricton->getScopeRestrictedLinkList($scope, $type));
+            }
+            $list = array_values($list);
+            return $list;
+        }
+        return $this->globalRestricton->getScopeRestrictedLinkList($scope, $type);
     }
 }
-

application/Espo/Core/AclPortal/Base.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -71,7 +71,7 @@ class Base extends \Espo\Core\Acl\Base
         }
 
         if (!isset($data->$action)) {
-            return true;
+            return false;
         }
 
         $value = $data->$action;
@@ -104,6 +104,13 @@ class Base extends \Espo\Core\Acl\Base
             }
             if ($inAccount) {
                 return true;
+            } else {
+                if (is_null($isOwnContact) && $entity) {
+                    $isOwnContact = $this->checkIsOwnContact($user, $entity);
+                }
+                if ($isOwnContact) {
+                    return true;
+                }
             }
         }
 
@@ -117,7 +124,6 @@ class Base extends \Espo\Core\Acl\Base
         }
 
         return false;
-
     }
 
     public function checkReadOnlyAccount(User $user, $data)
@@ -152,13 +158,13 @@ class Base extends \Espo\Core\Acl\Base
     {
         $accountIdList = $user->getLinkMultipleIdList('accounts');
         if (count($accountIdList)) {
-            if ($entity->hasAttribute('accountId')) {
+            if ($entity->hasAttribute('accountId') && $entity->getRelationParam('account', 'entity') === 'Account') {
                 if (in_array($entity->get('accountId'), $accountIdList)) {
                     return true;
                 }
             }
 
-            if ($entity->hasRelation('accounts')) {
+            if ($entity->hasRelation('accounts') && $entity->getRelationParam('accounts', 'entity') === 'Account') {
                 $repository = $this->getEntityManager()->getRepository($entity->getEntityType());
                 foreach ($accountIdList as $accountId) {
                     if ($repository->isRelated($entity, 'accounts', $accountId)) {
@@ -183,13 +189,13 @@ class Base extends \Espo\Core\Acl\Base
     {
         $contactId = $user->get('contactId');
         if ($contactId) {
-            if ($entity->hasAttribute('contactId')) {
+            if ($entity->hasAttribute('contactId') && $entity->getRelationParam('contact', 'entity') === 'Contact') {
                 if ($entity->get('contactId') === $contactId) {
                     return true;
                 }
             }
 
-            if ($entity->hasRelation('contacts')) {
+            if ($entity->hasRelation('contacts') && $entity->getRelationParam('contacts', 'entity') === 'Contact') {
                 $repository = $this->getEntityManager()->getRepository($entity->getEntityType());
                 if ($repository->isRelated($entity, 'contacts', $contactId)) {
                     return true;
@@ -207,6 +213,4 @@ class Base extends \Espo\Core\Acl\Base
 
         return false;
     }
-
 }
-

application/Espo/Core/AclPortal/Table.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -37,7 +37,7 @@ use \Espo\Entities\Portal;
 
 use \Espo\Core\Utils\Config;
 use \Espo\Core\Utils\Metadata;
-use \Espo\Core\Utils\FieldManager;
+use \Espo\Core\Utils\FieldManagerUtil;
 use \Espo\Core\Utils\File\Manager as FileManager;
 
 class Table extends \Espo\Core\Acl\Table
@@ -50,9 +50,9 @@ class Table extends \Espo\Core\Acl\Table
 
     protected $levelList = ['yes', 'all', 'account', 'contact', 'own', 'no'];
 
-    protected $valuePermissionList = [];
+    protected $isStrictModeForced = true;
 
-    public function __construct(User $user, Portal $portal, Config $config = null, FileManager $fileManager = null, Metadata $metadata = null, FieldManager $fieldManager = null)
+    public function __construct(User $user, Portal $portal, Config $config = null, FileManager $fileManager = null, Metadata $metadata = null, FieldManagerUtil $fieldManager = null)
     {
         if (empty($portal)) {
             throw new Error("No portal was passed to AclPortal\\Table constructor.");
@@ -76,11 +76,17 @@ class Table extends \Espo\Core\Acl\Table
         $roleList = [];
 
         $userRoleList = $this->getUser()->get('portalRoles');
+        if (!(is_array($userRoleList) || $userRoleList instanceof \Traversable)) {
+            throw new Error();
+        }
         foreach ($userRoleList as $role) {
             $roleList[] = $role;
         }
 
         $portalRoleList = $this->getPortal()->get('portalRoles');
+        if (!(is_array($portalRoleList) || $portalRoleList instanceof \Traversable)) {
+            throw new Error();
+        }
         foreach ($portalRoleList as $role) {
             $roleList[] = $role;
         }
@@ -115,11 +121,15 @@ class Table extends \Espo\Core\Acl\Table
     {
         foreach ($this->getScopeList() as $scope) {
             $d = $this->getMetadata()->get('scopes.' . $scope);
-            if ($d['disabled'] || $d['portalDisabled']) {
+            if (!empty($d['disabled']) || !empty($d['portalDisabled'])) {
                 $table->$scope = false;
                 unset($fieldTable->$scope);
             }
         }
     }
+
+    protected function applyAdditional(&$table, &$fieldTable, &$valuePermissionLists)
+    {
+    }
 }
 

application/Espo/Core/AppParams/TemplateEntityTypeList.php

@@ -0,0 +1,65 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\AppParams;
+
+class TemplateEntityTypeList extends \Espo\Core\Injectable
+{
+    protected function init()
+    {
+        $this->addDependency('acl');
+        $this->addDependency('selectManagerFactory');
+        $this->addDependency('entityManager');
+    }
+
+    public function get()
+    {
+        if (!$this->getInjection('acl')->checkScope('Template')) {
+            return [];
+        }
+
+        $list = [];
+
+        $selectManager = $this->getInjection('selectManagerFactory')->create('Template');
+
+        $selectParams = $selectManager->getEmptySelectParams();
+        $selectManager->applyAccess($selectParams);
+
+        $templateList = $this->getInjection('entityManager')->getRepository('Template')
+            ->select(['entityType'])
+            ->groupBy(['entityType'])
+            ->find($selectParams);
+
+        foreach ($templateList as $template) {
+            $list[] = $template->get('entityType');
+        }
+
+        return $list;
+    }
+}

application/Espo/Core/Application.php

@@ -3,8 +3,8 @@
  * This file is part of EspoCRM.
  *
  * EspoCRM - Open Source CRM application.
- * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
- * Website: http://www.espocrm.com
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
  *
  * EspoCRM is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -48,6 +48,7 @@ class Application
         $GLOBALS['log'] = $this->getContainer()->get('log');
 
         $this->initAutoloads();
+        $this->initPreloads();
     }
 
     protected function initContainer()
@@ -81,6 +82,11 @@ class Application
         return $this->container;
     }
 
+    protected function getConfig()
+    {
+        return $this->getContainer()->get('config');
+    }
+
     public function run($name = 'default')
     {
         $this->routeHooks();
@@ -91,9 +97,10 @@ class Application
     public function runClient()
     {
         $this->getContainer()->get('clientManager')->display();
+        exit;
     }
 
-    public function runEntryPoint($entryPoint, $data = array(), $final = false)
+    public function runEntryPoint($entryPoint, $data = [], $final = false)
     {
         if (empty($entryPoint)) {
             throw new \Error();
@@ -127,19 +134,76 @@ class Application
 
             $slim->run();
         } catch (\Exception $e) {
-            $container->get('output')->processError($e->getMessage(), $e->getCode(), true);
+            try {
+                $container->get('output')->processError($e->getMessage(), $e->getCode(), true, $e);
+            } catch (\Slim\Exception\Stop $e) {}
         }
     }
 
     public function runCron()
     {
+        if ($this->getConfig()->get('cronDisabled')) {
+            $GLOBALS['log']->warning("Cron is not run because it's disabled with 'cronDisabled' param.");
+            return;
+        }
+
         $auth = $this->createAuth();
-        $auth->useNoAuth(true);
+        $auth->useNoAuth();
 
         $cronManager = new \Espo\Core\CronManager($this->container);
         $cronManager->run();
     }
 
+    public function runDaemon()
+    {
+        $maxProcessNumber = $this->getConfig()->get('daemonMaxProcessNumber');
+        $interval = $this->getConfig()->get('daemonInterval');
+        $timeout = $this->getConfig()->get('daemonProcessTimeout');
+
+        $phpExecutablePath = $this->getConfig()->get('phpExecutablePath');
+        if (!$phpExecutablePath) {
+            $phpExecutablePath = (new \Symfony\Component\Process\PhpExecutableFinder)->find();
+        }
+
+        if (!$maxProcessNumber || !$interval) {
+            $GLOBALS['log']->error("Daemon config params are not set.");
+            return;
+        }
+
+        $processList = [];
+        while (true) {
+            $toSkip = false;
+            $runningCount = 0;
+            foreach ($processList as $i => $process) {
+                if ($process->isRunning()) {
+                    $runningCount++;
+                } else {
+                    unset($processList[$i]);
+                }
+            }
+            $processList = array_values($processList);
+            if ($runningCount >= $maxProcessNumber) {
+                $toSkip = true;
+            }
+            if (!$toSkip) {
+                $process = new \Symfony\Component\Process\Process([$phpExecutablePath, 'cron.php']);
+                $process->setTimeout($timeout);
+                $process->run();
+                $processList[] = $process;
+            }
+            sleep($interval);
+        }
+    }
+
+    public function runJob($id)
+    {
+        $auth = $this->createAuth();
+        $auth->useNoAuth();
+
+        $cronManager = new \Espo\Core\CronManager($this->container);
+        $cronManager->runJobById($id);
+    }
+
     public function runRebuild()
     {
         $dataManager = $this->getContainer()->get('dataManager');
@@ -152,9 +216,18 @@ class Application
         $dataManager->clearCache();
     }
 
+    public function runCommand(string $command)
+    {
+        $auth = $this->createAuth();
+        $auth->useNoAuth();
+
+        $consoleCommandManager = $this->getContainer()->get('consoleCommandManager');
+        return $consoleCommandManager->run($command);
+    }
+
     public function isInstalled()
     {
-        $config = $this->getContainer()->get('config');
+        $config = $this->getConfig();
 
         if (file_exists($config->getConfigPath()) && $config->get('isInstalled')) {
             return true;
@@ -176,7 +249,7 @@ class Application
         try {
             $auth = $this->createAuth();
         } catch (\Exception $e) {
-            $container->get('output')->processError($e->getMessage(), $e->getCode());
+            $container->get('output')->processError($e->getMessage(), $e->getCode(), false, $e);
         }
 
         $apiAuth = $this->createApiAuth($auth);
@@ -187,12 +260,15 @@ class Application
             $route = $slim->router()->getCurrentRoute();
             $conditions = $route->getConditions();
 
+            $response = $slim->response();
+            $response->headers->set('Content-Type', 'application/json');
+
             if (isset($conditions['useController']) && $conditions['useController'] == false) {
                 return;
             }
 
             $routeOptions = call_user_func($route->getCallable());
-            $routeKeys = is_array($routeOptions) ? array_keys($routeOptions) : array();
+            $routeKeys = is_array($routeOptions) ? array_keys($routeOptions) : [];
 
             if (!in_array('controller', $routeKeys, true)) {
                 return $container->get('output')->render($routeOptions);
@@ -222,45 +298,46 @@ class Application
             }
 
             try {
-                $controllerManager = new \Espo\Core\ControllerManager($container);
-                $result = $controllerManager->process($controllerName, $actionName, $params, $data, $slim->request());
+                $controllerManager = $this->getContainer()->get('controllerManager');
+                $result = $controllerManager->process($controllerName, $actionName, $params, $data, $slim->request(), $slim->response());
                 $container->get('output')->render($result);
             } catch (\Exception $e) {
-                $container->get('output')->processError($e->getMessage(), $e->getCode());
+                $container->get('output')->processError($e->getMessage(), $e->getCode(), false, $e);
             }
         });
 
         $this->getSlim()->hook('slim.after.router', function () use (&$slim) {
-            $slim->contentType('application/json');
+            $response = $slim->response();
 
-            $res = $slim->response();
-            $res->header('Expires', '0');
-            $res->header('Last-Modified', gmdate("D, d M Y H:i:s") . " GMT");
-            $res->header('Cache-Control', 'no-store, no-cache, must-revalidate, post-check=0, pre-check=0');
-            $res->header('Pragma', 'no-cache');
+            if (!$response->headers->has('Content-Type')) {
+                $response->headers->set('Content-Type', 'application/json');
+            }
+
+            $response->headers->set('Expires', '0');
+            $response->headers->set('Last-Modified', gmdate("D, d M Y H:i:s") . " GMT");
+            $response->headers->set('Cache-Control', 'no-store, no-cache, must-revalidate, post-check=0, pre-check=0');
+            $response->headers->set('Pragma', 'no-cache');
         });
     }
 
     protected function getRouteList()
     {
-        $routes = new \Espo\Core\Utils\Route($this->getContainer()->get('config'), $this->getMetadata(), $this->getContainer()->get('fileManager'));
-
-
+        $routes = new \Espo\Core\Utils\Route($this->getConfig(), $this->getMetadata(), $this->getContainer()->get('fileManager'));
         return $routes->getAll();
     }
 
     protected function initRoutes()
     {
-        $crudList = array_keys($this->getContainer()->get('config')->get('crud'));
+        $crudList = array_keys($this->getConfig()->get('crud'));
 
         foreach ($this->getRouteList() as $route) {
             $method = strtolower($route['method']);
-            if (!in_array($method, $crudList)) {
+            if (!in_array($method, $crudList) && $method !== 'options') {
                 $GLOBALS['log']->error('Route: Method ['.$method.'] does not exist. Please check your route ['.$route['route'].']');
                 continue;
             }
 
-            $currentRoute = $this->getSlim()->$method($route['route'], function() use ($route) {   //todo change "use" for php 5.4
+            $currentRoute = $this->getSlim()->$method($route['route'], function() use ($route) {
                 return $route['params'];
             });
 
@@ -272,31 +349,17 @@ class Application
 
     protected function initAutoloads()
     {
-        $autoload = new \Espo\Core\Utils\Autoload($this->getContainer()->get('config'), $this->getMetadata(), $this->getContainer()->get('fileManager'));
+        $autoload = new \Espo\Core\Utils\Autoload($this->getConfig(), $this->getMetadata(), $this->getContainer()->get('fileManager'));
+        $autoload->register();
+    }
 
-        try {
-            $autoloadList = $autoload->getAll();
-        } catch (\Exception $e) {} //bad permissions
-
-        if (empty($autoloadList)) {
-            return;
-        }
-
-        $namespacesPath = 'vendor/composer/autoload_namespaces.php';
-        $existingNamespaces = file_exists($namespacesPath) ? include($namespacesPath) : array();
-        if (!empty($existingNamespaces) && is_array($existingNamespaces)) {
-            $existingNamespaces = array_keys($existingNamespaces);
-        }
-
-        $classLoader = new \Composer\Autoload\ClassLoader();
-
-        foreach ($autoloadList as $prefix => $path) {
-            if (!in_array($prefix, $existingNamespaces)) {
-                $classLoader->add($prefix, $path);
+    protected function initPreloads()
+    {
+        foreach ($this->getMetadata()->get(['app', 'containerServices']) ?? [] as $name => $defs) {
+            if ($defs['preload'] ?? false) {
+                $this->getContainer()->get($name);
             }
         }
-
-        $classLoader->register(true);
     }
 
     public function setBasePath($basePath)
@@ -315,7 +378,9 @@ class Application
             return $_GET['portalId'];
         }
         if (!empty($_COOKIE['auth-token'])) {
-            $token = $this->getContainer()->get('entityManager')->getRepository('AuthToken')->where(array('token'=>$_COOKIE['auth-token']))->findOne();
+            $token =
+                $this->getContainer()->get('entityManager')
+                    ->getRepository('AuthToken')->where(['token' => $_COOKIE['auth-token']])->findOne();
 
             if ($token && $token->get('portalId')) {
                 return $token->get('portalId');
@@ -323,5 +388,13 @@ class Application
         }
         return null;
     }
-}
 
+    public function setupSystemUser()
+    {
+        $user = $this->getContainer()->get('entityManager')->getEntity('User', 'system');
+        $user->set('isAdmin', true); // TODO remove in 5.7
+        $user->set('type', 'system');
+        $this->getContainer()->setUser($user);
+        $this->getContainer()->get('entityManager')->setUser($user);
+    }
+}

application/Espo/Core/Cleanup/Base.php

@@ -0,0 +1,63 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Cleanup;
+
+abstract class Base extends \Espo\Core\Injectable
+{
+    protected function init()
+    {
+        $this->addDependency('config');
+        $this->addDependency('metadata');
+        $this->addDependency('entityManager');
+        $this->addDependency('fileManager');
+    }
+
+    protected function getConfig()
+    {
+        return $this->getInjection('config');
+    }
+
+    protected function getMetadata()
+    {
+        return $this->getInjection('metadata');
+    }
+
+    protected function getEntityManager()
+    {
+        return $this->getInjection('entityManager');
+    }
+
+    protected function getFileManager()
+    {
+        return $this->getInjection('fileManager');
+    }
+
+    abstract public function process();
+}

application/Espo/Core/Cleanup/Reminders.php

@@ -0,0 +1,50 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Cleanup;
+
+class Reminders extends Base
+{
+    protected $cleanupRemindersPeriod = '15 days';
+
+    public function process()
+    {
+        $period = '-' . $this->getConfig()->get('cleanupRemindersPeriod', $this->cleanupRemindersPeriod);
+
+        $datetime = new \DateTime();
+        $datetime->modify($period);
+
+        $pdo = $this->getEntityManager()->getPDO();
+
+        $query = "DELETE FROM `reminder` WHERE DATE(remind_at) < " . $pdo->quote($datetime->format('Y-m-d'));
+
+        $sth = $pdo->prepare($query);
+        $sth->execute();
+    }
+}

application/Espo/Core/Cleanup/WebhookQueue.php

@@ -0,0 +1,59 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Cleanup;
+
+class WebhookQueue extends Base
+{
+    protected $cleanupWebhookQueuePeriod = '10 days';
+
+    public function process()
+    {
+        $pdo = $this->getEntityManager()->getPDO();
+
+        $period = '-' . $this->getConfig()->get('cleanupWebhookQueuePeriod', $this->cleanupWebhookQueuePeriod);
+        $datetime = new \DateTime();
+        $datetime->modify($period);
+        $from = $datetime->format('Y-m-d H:i:s');
+
+        $query = "
+            DELETE FROM `webhook_queue_item`
+            WHERE
+                DATE(created_at) < ".$pdo->quote($from)." AND
+                (status <> 'Pending' OR deleted = 1)
+        ";
+        $pdo->query($query);
+
+        $query = "
+            DELETE FROM `webhook_event_queue_item`
+            WHERE DATE(created_at) < ".$pdo->quote($from)." AND (is_processed = 1 OR deleted = 1)
+        ";
+        $pdo->query($query);
+    }
+}

application/Espo/Core/Console/CommandManager.php

@@ -0,0 +1,78 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Console;
+
+class CommandManager
+{
+    private $container;
+
+    public function __construct(\Espo\Core\Container $container)
+    {
+        $this->container = $container;
+    }
+
+    public function run(string $command)
+    {
+        $command = ucfirst(\Espo\Core\Utils\Util::hyphenToCamelCase($command));
+
+        $argumentList = [];
+        $options = [];
+        $flagList = [];
+
+        $skipIndex = 1;
+        if (isset($_SERVER['argv'][0]) && $_SERVER['argv'][0] === 'command.php') {
+            $skipIndex = 2;
+        }
+
+        foreach ($_SERVER['argv'] as $i => $item) {
+            if ($i < $skipIndex) continue;
+
+            if (strpos($item, '--') === 0 && strpos($item, '=') > 2) {
+                list($name, $value) = explode('=', substr($item, 2));
+                $name = \Espo\Core\Utils\Util::hyphenToCamelCase($name);
+                $options[$name] = $value;
+            } else if (strpos($item, '-') === 0) {
+                $flagList[] = substr($item, 1);
+            } else {
+                $argumentList[] = $item;
+            }
+        }
+
+        $className = '\\Espo\\Core\\Console\\Commands\\' . $command;
+        $className = $this->container->get('metadata')->get(['app', 'consoleCommands', $command, 'className'], $className);
+        if (!class_exists($className)) {
+            $msg = "Command '{$command}' does not exist.";
+            echo $msg . "\n";
+            throw new \Espo\Core\Exceptions\Error($msg);
+        }
+        $impl = new $className($this->container);
+        return $impl->run($options, $flagList, $argumentList);
+    }
+}

application/Espo/Core/Console/Commands/AclCheck.php

@@ -0,0 +1,87 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Console\Commands;
+
+class AclCheck extends Base
+{
+    public function run($options)
+    {
+        $userId = $options['userId'] ?? null;
+        $scope = $options['scope'] ?? null;
+        $id = $options['id'] ?? null;
+        $action = $options['action'] ?? null;
+
+        if (empty($userId)) return;
+        if (empty($scope)) return;
+        if (empty($id)) return;
+
+        $container = $this->getContainer();
+        $entityManager = $container->get('entityManager');
+
+        $user = $entityManager->getEntity('User', $userId);
+        if (!$user) return;
+
+        if ($user->isPortal()) {
+            $portalIdList = $user->getLinkMultipleIdList('portals');
+            foreach ($portalIdList as $portalId) {
+                $application = new \Espo\Core\Portal\Application($portalId);
+                $containerPortal = $application->getContainer();
+                $entityManager = $containerPortal->get('entityManager');
+
+                $user = $entityManager->getEntity('User', $userId);
+                if (!$user) return;
+
+                $result = $this->check($user, $scope, $id, $action, $containerPortal);
+                if ($result) {
+                    return 'true';
+                }
+            }
+            return;
+        }
+
+        if ($this->check($user, $scope, $id, $action, $container)) {
+            return 'true';
+        }
+    }
+
+    protected function check($user, $scope, $id, $action, $container)
+    {
+        $entityManager = $container->get('entityManager');
+
+        $entity = $entityManager->getEntity($scope, $id);
+        if (!$entity) return;
+
+        $aclManager = $container->get('aclManager');
+
+        if ($aclManager->check($user, $entity, $action)) {
+            return true;
+        }
+    }
+}

application/Espo/Core/Console/Commands/AuthTokenCheck.php

@@ -0,0 +1,56 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Console\Commands;
+
+class AuthTokenCheck extends Base
+{
+    public function run($options, $flagList, $argumentList)
+    {
+        $token = $argumentList[0] ?? null;
+        if (empty($token)) return;
+
+        $entityManager = $this->getContainer()->get('entityManager');
+
+        $authToken = $entityManager->getRepository('AuthToken')->where([
+            'token' => $token,
+            'isActive' => true,
+        ])->findOne();
+
+        if (!$authToken) return;
+        if (!$authToken->get('userId')) return;
+
+        $userId = $authToken->get('userId');
+
+        $user = $entityManager->getEntity('User', $userId);
+        if (!$user) return;
+
+        return $user->id;
+    }
+}

application/Espo/Core/Console/Commands/Base.php

@@ -0,0 +1,45 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2020 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: https://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Core\Console\Commands;
+
+abstract class Base
+{
+    private $container;
+
+    public function __construct(\Espo\Core\Container $container)
+    {
+        $this->container = $container;
+    }
+
+    protected function getContainer()
+    {
+        return $this->container;
+    }
+}