Fix/10029

.github/SECURITY.md

@@ -2,20 +2,8 @@
 
 ## Supported Versions
 
-For a complete compatibility matrix, please see the documentation [here](https://docs.suitecrm.com/admin/compatibility-matrix/).
-
-| Version | Supported          |
-| ------- | ------------------ |
-| 7.11.x   | :heavy_check_mark: |
-| 7.10.x   | :heavy_check_mark: |
-| ≤7.8.x   | :x: |
+For a list of supported versions, please see the documentation [Supported Versions](https://docs.suitecrm.com/community/supported-versions/) page.
 
 ## Reporting a Vulnerability
 
-We take Security seriously here at SuiteCRM so if you have discovered a security risk report it by
-emailing [[email protected]](mailto:[email protected]). This will be delivered to the product team who handle security issues.
-Please don't disclose security bugs publicly until they have been handled by the security team.
-
-Your email will be acknowledged within 24 hours during the business week (Mon - Fri), and you’ll receive a more
-detailed response to your email within 72 hours during the business week (Mon - Fri) indicating the next steps in
-handling your report.
+For details on how to report a vulnerability please check our [Security Policy](https://docs.suitecrm.com/community/security-policy/) page. 

Api/V8/JsonApi/Helper/AttributeObjectHelper.php

@@ -29,6 +29,24 @@ public function getAttributes(\SugarBean $bean, $fields = null)
     {
         $bean->fixUpFormatting();
 
+        $allowedField = [];
+
+        $fieldsToParse = $fields;
+        if (empty($fields)) {
+            $fieldsToParse =  array_keys($bean->field_defs);
+        }
+
+        foreach ($fieldsToParse ?? [] as $index => $field) {
+            $isSensitive = isTrue($bean->field_defs[$field]['sensitive'] ?? false);
+            $notApiVisible = isFalse($bean->field_defs[$field]['api-visible'] ?? true);
+
+            if ($isSensitive || $notApiVisible){
+                continue;
+            }
+
+            $allowedField[$index] = $field;
+        }
+
         // using the ISO 8601 format for dates
         $attributes = array_map(function ($value) {
             return is_string($value)
@@ -38,8 +56,8 @@ public function getAttributes(\SugarBean $bean, $fields = null)
                 : $value;
         }, $bean->toArray());
 
-        if ($fields !== null) {
-            $attributes = array_intersect_key($attributes, array_flip($fields));
+        if ($allowedField !== null) {
+            $attributes = array_intersect_key($attributes, array_flip($allowedField));
         }
 
         unset($attributes['id']);

ModuleInstall/ModuleInstaller.php

@@ -61,6 +61,8 @@
 require_once('ModuleInstall/ModuleScanner.php');
 define('DISABLED_PATH', 'Disabled');
 
+require_once 'include/SugarCache/SugarCache.php';
+
 class ModuleInstaller
 {
     public $modules = array();
@@ -2026,6 +2028,9 @@ public function copy_recursive_with_backup($source, $dest, $backup_path, $uninst
                     if (is_writable($dest)) {
                         sugar_touch($dest, filemtime($source));
                     }
+                    if ((new SplFileInfo($dest))->getExtension() == 'php') {
+                        SugarCache::cleanFile($dest);
+                    }
                     return(unlink($source));
                 } else {
                     $GLOBALS['log']->debug("Can't restore file: " . $source);
@@ -2043,11 +2048,18 @@ public function copy_recursive_with_backup($source, $dest, $backup_path, $uninst
                         if (is_writable($rest)) {
                             sugar_touch($rest, filemtime($dest));
                         }
+                        if ((new SplFileInfo($rest))->getExtension() == 'php') {
+                            SugarCache::cleanFile($rest);
+                        }
                     } else {
                         $GLOBALS['log']->debug("Can't backup file: " . $dest);
                     }
                 }
-                return(copy($source, $dest));
+                $result = copy($source, $dest);
+                if ((new SplFileInfo($dest))->getExtension() == 'php') {
+                    SugarCache::cleanFile($dest);
+                }
+                return $result;
             }
         } elseif (!is_dir($source)) {
             if ($uninstall) {

README.md

@@ -2,7 +2,7 @@
   <img width="180px" height="41px" src="https://suitecrm.com/wp-content/uploads/2017/12/logo.png" align="right" />
 </a>
 
-# SuiteCRM 7.12.8
+# SuiteCRM 7.12.11
 
 [![Build Status](https://travis-ci.org/salesagility/SuiteCRM.svg?branch=hotfix)](https://travis-ci.org/salesagility/SuiteCRM)
 [![codecov](https://codecov.io/gh/salesagility/SuiteCRM/branch/hotfix/graph/badge.svg)](https://codecov.io/gh/salesagility/SuiteCRM/branch/hotfix)