ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added filtering of hash sign on some input variables in both api scripts, Issue #851

Browse Source 
git-svn-id: svn://192.168.202.10@2318 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2015-05-13 00:30:56 +00:00
parent ece5a1248f
commit 001594e346
3 changed files with 23 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/docs/NON-AGENT_API.txt
+2 -1
View File
@@ -1,4 +1,4 @@
NON-AGENT API DOCUMENT Started: 2008-07-24 Updated: 2015-04-30
NON-AGENT API DOCUMENT Started: 2008-07-24 Updated: 2015-05-12
This document describes the functions of an API(Application Programming
Interface) for all functions NOT directly relating to the VICIDIAL Agent screen.
@@ -103,6 +103,7 @@ Changes:
150313-0818 - Allow for single quotes in vicidial_list and custom data fields
150428-1720 - Added web_form_address_three to add_list/update_list functions
150430-0644 - Added API allowed function restrictions and allowed list restrictions
150512-2028 - Added filtering of hash sign on some input variables, Issue #851
API Functions use the 'function' variable
agc_2-X/trunk/www/agc/api.php
+11 -11
View File
@@ -81,10 +81,10 @@
# 150108-1039 - Added transfer_conf-ID of epoch to help prevent double-execution of transfer commands
# 150313-0825 - Allow for single quotes in vicidial_list and custom data fields
# 150429-1717 - Added user allowed function restrictions
#
# 150512-2027 - Added filtering of hash sign on some input variables, Issue #851
$version = '2.12-47';
$build = '150429-1717';
$version = '2.12-48';
$build = '150512-2027';
$startMS = microtime();
@@ -278,13 +278,13 @@ if ($non_latin < 1)
$phone_code = preg_replace("/[^0-9X]/","",$phone_code);
$phone_number = preg_replace("/[^0-9]/","",$phone_number);
$lead_id = preg_replace("/[^0-9]/","",$lead_id);
$vendor_id = preg_replace('/;/','',$vendor_id);
$vendor_id = preg_replace('/;|#/','',$vendor_id);
$vendor_id = preg_replace('/\+/',' ',$vendor_id);
$vendor_lead_code = preg_replace('/;/','',$vendor_lead_code);
$vendor_lead_code = preg_replace('/;|#/','',$vendor_lead_code);
$vendor_lead_code = preg_replace('/\+/',' ',$vendor_lead_code);
$source_id = preg_replace('/;/','',$source_id);
$source_id = preg_replace('/;|#/','',$source_id);
$source_id = preg_replace('/\+/',' ',$source_id);
$gmt_offset_now = preg_replace('/-\_\.0-9/','',$gmt_offset_now);
$gmt_offset_now = preg_replace('/[^-\_\.0-9]/','',$gmt_offset_now);
$title = preg_replace('/[^- \'\_\.0-9a-zA-Z]/','',$title);
$first_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$first_name);
$first_name = preg_replace('/\+/',' ',$first_name);
@@ -313,7 +313,7 @@ if ($non_latin < 1)
$email = preg_replace('/\+/',' ',$email);
$security_phrase = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$security_phrase);
$security_phrase = preg_replace('/\+/',' ',$security_phrase);
$comments = preg_replace('/;/','',$comments);
$comments = preg_replace('/;|#/','',$comments);
$comments = preg_replace('/\+/',' ',$comments);
$rank = preg_replace('/[^0-9]/','',$rank);
$owner = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$owner);
@@ -331,9 +331,9 @@ if ($non_latin < 1)
}
else
{
$source = preg_replace("/'|\"|\\\\|;/","",$source);
$agent_user = preg_replace("/'|\"|\\\\|;/","",$agent_user);
$alt_user = preg_replace("/'|\"|\\\\|;/","",$alt_user);
$source = preg_replace("/'|\"|\\\\|;|#/","",$source);
$agent_user = preg_replace("/'|\"|\\\\|;|#/","",$agent_user);
$alt_user = preg_replace("/'|\"|\\\\|;|#/","",$alt_user);
}
### date and fixed variables
agc_2-X/trunk/www/vicidial/non_agent_api.php
+10 -9
View File
@@ -97,10 +97,11 @@
# 150313-0818 - Allow for single quotes in vicidial_list and custom data fields
# 150428-1720 - Added web_form_address_three to add_list/update_list functions
# 150430-0644 - Added API allowed function restrictions and allowed list restrictions
# 150512-2028 - Added filtering of hash sign on some input variables, Issue #851
#
$version = '2.12-73';
$build = '150430-0644';
$version = '2.12-74';
$build = '150512-2028';
$api_url_log = 0;
$startMS = microtime();
@@ -401,11 +402,11 @@ if ($non_latin < 1)
$phone_code = preg_replace('/[^0-9]/','',$phone_code);
$update_phone_number=preg_replace('/[^A-Z]/','',$update_phone_number);
$phone_number = preg_replace('/[^0-9]/','',$phone_number);
$vendor_lead_code = preg_replace('/;/','',$vendor_lead_code);
$vendor_lead_code = preg_replace('/;|#/','',$vendor_lead_code);
$vendor_lead_code = preg_replace('/\+/',' ',$vendor_lead_code);
$source_id = preg_replace('/;/','',$source_id);
$source_id = preg_replace('/;|#/','',$source_id);
$source_id = preg_replace('/\+/',' ',$source_id);
$gmt_offset_now = preg_replace('/-\_\.0-9/','',$gmt_offset_now);
$gmt_offset_now = preg_replace('/[^-\_\.0-9]/','',$gmt_offset_now);
$title = preg_replace('/[^- \'\_\.0-9a-zA-Z]/','',$title);
$first_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$first_name);
$first_name = preg_replace('/\+/',' ',$first_name);
@@ -434,7 +435,7 @@ if ($non_latin < 1)
$email = preg_replace('/\+/',' ',$email);
$security_phrase = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$security_phrase);
$security_phrase = preg_replace('/\+/',' ',$security_phrase);
$comments = preg_replace('/;/','',$comments);
$comments = preg_replace('/;|#/','',$comments);
$comments = preg_replace('/\+/',' ',$comments);
$dnc_check = preg_replace('/[^A-Z]/','',$dnc_check);
$campaign_dnc_check = preg_replace('/[^A-Z]/','',$campaign_dnc_check);
@@ -534,9 +535,9 @@ if ($non_latin < 1)
}
else
{
$user = preg_replace("/'|\"|\\\\|;/","",$user);
$pass = preg_replace("/'|\"|\\\\|;/","",$pass);
$source = preg_replace("/'|\"|\\\\|;/","",$source);
$user = preg_replace("/'|\"|\\\\|;|#/","",$user);
$pass = preg_replace("/'|\"|\\\\|;|#/","",$pass);
$source = preg_replace("/'|\"|\\\\|;|#/","",$source);
}
$USarea = substr($phone_number, 0, 3);