engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

suitecrm+dolibarr: 5-MOAD scan — 3 new defects, MOADs 0002/0003/0005 CLEAN

Browse source 
suitecrm-0004: SugarBean.php subpanel union field dedup in_array($field, $all_fields)
inside nested foreach over subpanel queries — O(S*F^2), 4.3x at S=40 F=60.
Fix: parallel hash set for O(1) isset() check.

dolibarr-0004: emailcollector_card.php line 575 — IMAP password logged verbatim
unconditionally in dol_syslog(). CWE-312 HIGH. Fix: replace with literal ***.

dolibarr-0005: functions_ldap.php line 98 — LDAP admin searchPassword first 3 chars
leaked via dol_trunc() in dol_syslog() and browser print when $ldapdebug=true.
CWE-312 MEDIUM. Fix: replace dol_trunc(...) with literal *** in both sinks.

All 4 SuiteCRM tests PASS. All 5 Dolibarr tests PASS.
MOADs 0002/0003/0005 CLEAN for both targets (PHP single-threaded, architectural globals).
This commit is contained in:
russell@unturf.com 2026-03-31 20:27:34 -04:00
parent 14c3a92bab
commit fc7fdad2dc
9 changed files with 301 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

19
defects/suitecrm/patch/suitecrm-0004-sugarbean-allfields-in_array.patch Normal file
View file

@ -0,0 +1,19 @@
--- a/data/SugarBean.php
+++ b/data/SugarBean.php
@@ -883,12 +883,13 @@
//If final_query is still empty, its time to build the sub-queries
if (empty($final_query)) {
$subqueries = SugarBean::build_sub_queries_for_union($subpanel_list, $subpanel_def, $parentbean, $order_by);
$all_fields = array();
+ $all_fields_set = array(); // O(1) lookup instead of O(N) in_array
foreach ($subqueries as $i => $subquery) {
$query_fields = DBManagerFactory::getInstance()->getSelectFieldsFromQuery($subquery['select']);
foreach ($query_fields as $field => $select) {
- if (!in_array($field, $all_fields)) {
+ if (!isset($all_fields_set[$field])) {
$all_fields[] = $field;
+ $all_fields_set[$field] = true;
}
}
$subqueries[$i]['query_fields'] = $query_fields;
}