InsideView - a connector that to me is a security issue

fraxx · 3 March 2021 18:12

You may be aware of this issue: https://github.com/salesagility/SuiteCRM/issues/8752

As I wrote there, it is important to me that a pristine installation of suitecrm does not have that connector enabled: can someone help me to spot what, in the installation process, enable it so we are able to fire a pull request to disable it by default?

pgr · 3 March 2021 18:37

It seems to be this,

github.com

salesagility/SuiteCRM/blob/master/modules/UpgradeWizard/uw_utils.php#L4268


    if (file_exists('include/externalAPI/LinkedIn')) {
        deleteDirectory('include/externalAPI/LinkedIn');
    }
}
/**
 * Enable the InsideView connector for the four default modules.
 */
function upgradeEnableInsideViewConnector($path='')
{
    logThis('Begin upgradeEnableInsideViewConnector', $path);
    // Load up the existing mapping and hand it to the InsideView connector to have it setup the correct logic hooks
    $mapFile = 'modules/Connectors/connectors/sources/ext/rest/insideview/mapping.php';
    if (file_exists('custom/'.$mapFile)) {
        logThis('Found CUSTOM mappings', $path);
        require('custom/'.$mapFile);
    } else {
        logThis('Used default mapping', $path);

… but i couldn’t find anything that calls it.

I’ve never seen that connector enabled or doing anything in all my experience with SuiteCRM… are you sure it defaults to on, and shows stuff on screen?

fraxx · 3 March 2021 18:55

zuuuuper!

I just fired the pull request Remove instructions that enable InsideView Connector by francescor · Pull Request #9052 · salesagility/SuiteCRM · GitHub

pgr · 3 March 2021 19:00

Wait… you can’t just remove it. It will bring a FATAL error if some code is calling it (and it seems you have a case where some code is calling it!).

You need to figure out some more things about how it becomes active…

fraxx · 3 March 2021 19:16

omg!

any advice on how to?

pgr · 3 March 2021 19:42

actually, in your system, if you provoke the error by running the upgrade with that code removed, the error message in the PHP log (preferably after turning on stack trace, but not strictly necessary) should lead you to to source of the issue.