upload package failed - "Code attempted dynamically-named method call"

I've just tried to update a package on Sugar 12.2 and hit this error on upload:

custom/src/cloudtech/ctsync/handler/connection/ConnectionAbstract.php
Code attempted dynamically-named method call on line 141
Code attempted dynamically-named method call on line 162
Code attempted dynamically-named method call on line 183
Code attempted dynamically-named method call on line 217

I tested uploading on sugarondemand versions 12.0.1 and 12.1.0 and they also exhibit this behaviour.
A local version of 12.0.1 does not complain about the dynamic methods.

I was unaware that this was functionality going to be black-listed, and I'm pretty sure that it was working on 12.x until recently.

There doesn't seem to be any mention in sugarclub.sugarcrm.com/.../sugar-12-0-q2-2022-customization-guide or the 12.1 and 12.2 guides.

Was it a security patch?

  • Hi ,

    Dynamically Named method call checks have been around since 2020 as far as I can tell from our version control (Sugar version 10+).

    You are correct, it was a security patch that has been backported to all cloud instances and is available to download in our portal.

    I will report them in our 12.3 customization guide as well.

    SugarCRM | Principal Developer Advocate

  • Thanks Rafael. Yes you are correct, dynamic methods were removed a while ago.

    Somehow the scanner was missing the calls in this particular package until recently. I'm very sure about that because we have been loading the package into sugarondemand up until a month ago without issue.
    Perhaps the method of invocation...

    $this->{__FUNCTION__ . 'Impl'}($module)

    ...was missed by the scanner until recently as it did not use a $variable.

    Anyway, it was easy to change to static method invocation.