From 001594e34643268af2b808b00769338c166f1a8a Mon Sep 17 00:00:00 2001 From: mattf Date: Wed, 13 May 2015 00:30:56 +0000 Subject: [PATCH] Added filtering of hash sign on some input variables in both api scripts, Issue #851 git-svn-id: svn://192.168.202.10@2318 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/trunk/docs/NON-AGENT_API.txt | 3 ++- agc_2-X/trunk/www/agc/api.php | 22 ++++++++++---------- agc_2-X/trunk/www/vicidial/non_agent_api.php | 19 +++++++++-------- 3 files changed, 23 insertions(+), 21 deletions(-) diff --git a/agc_2-X/trunk/docs/NON-AGENT_API.txt b/agc_2-X/trunk/docs/NON-AGENT_API.txt index 7e9930b1..c9577d64 100644 --- a/agc_2-X/trunk/docs/NON-AGENT_API.txt +++ b/agc_2-X/trunk/docs/NON-AGENT_API.txt @@ -1,4 +1,4 @@ -NON-AGENT API DOCUMENT Started: 2008-07-24 Updated: 2015-04-30 +NON-AGENT API DOCUMENT Started: 2008-07-24 Updated: 2015-05-12 This document describes the functions of an API(Application Programming Interface) for all functions NOT directly relating to the VICIDIAL Agent screen. @@ -103,6 +103,7 @@ Changes: 150313-0818 - Allow for single quotes in vicidial_list and custom data fields 150428-1720 - Added web_form_address_three to add_list/update_list functions 150430-0644 - Added API allowed function restrictions and allowed list restrictions +150512-2028 - Added filtering of hash sign on some input variables, Issue #851 API Functions use the 'function' variable diff --git a/agc_2-X/trunk/www/agc/api.php b/agc_2-X/trunk/www/agc/api.php index 028fd1b1..028b7fcc 100644 --- a/agc_2-X/trunk/www/agc/api.php +++ b/agc_2-X/trunk/www/agc/api.php @@ -81,10 +81,10 @@ # 150108-1039 - Added transfer_conf-ID of epoch to help prevent double-execution of transfer commands # 150313-0825 - Allow for single quotes in vicidial_list and custom data fields # 150429-1717 - Added user allowed function restrictions -# +# 150512-2027 - Added filtering of hash sign on some input variables, Issue #851 -$version = '2.12-47'; -$build = '150429-1717'; +$version = '2.12-48'; +$build = '150512-2027'; $startMS = microtime(); @@ -278,13 +278,13 @@ if ($non_latin < 1) $phone_code = preg_replace("/[^0-9X]/","",$phone_code); $phone_number = preg_replace("/[^0-9]/","",$phone_number); $lead_id = preg_replace("/[^0-9]/","",$lead_id); - $vendor_id = preg_replace('/;/','',$vendor_id); + $vendor_id = preg_replace('/;|#/','',$vendor_id); $vendor_id = preg_replace('/\+/',' ',$vendor_id); - $vendor_lead_code = preg_replace('/;/','',$vendor_lead_code); + $vendor_lead_code = preg_replace('/;|#/','',$vendor_lead_code); $vendor_lead_code = preg_replace('/\+/',' ',$vendor_lead_code); - $source_id = preg_replace('/;/','',$source_id); + $source_id = preg_replace('/;|#/','',$source_id); $source_id = preg_replace('/\+/',' ',$source_id); - $gmt_offset_now = preg_replace('/-\_\.0-9/','',$gmt_offset_now); + $gmt_offset_now = preg_replace('/[^-\_\.0-9]/','',$gmt_offset_now); $title = preg_replace('/[^- \'\_\.0-9a-zA-Z]/','',$title); $first_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$first_name); $first_name = preg_replace('/\+/',' ',$first_name); @@ -313,7 +313,7 @@ if ($non_latin < 1) $email = preg_replace('/\+/',' ',$email); $security_phrase = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$security_phrase); $security_phrase = preg_replace('/\+/',' ',$security_phrase); - $comments = preg_replace('/;/','',$comments); + $comments = preg_replace('/;|#/','',$comments); $comments = preg_replace('/\+/',' ',$comments); $rank = preg_replace('/[^0-9]/','',$rank); $owner = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$owner); @@ -331,9 +331,9 @@ if ($non_latin < 1) } else { - $source = preg_replace("/'|\"|\\\\|;/","",$source); - $agent_user = preg_replace("/'|\"|\\\\|;/","",$agent_user); - $alt_user = preg_replace("/'|\"|\\\\|;/","",$alt_user); + $source = preg_replace("/'|\"|\\\\|;|#/","",$source); + $agent_user = preg_replace("/'|\"|\\\\|;|#/","",$agent_user); + $alt_user = preg_replace("/'|\"|\\\\|;|#/","",$alt_user); } ### date and fixed variables diff --git a/agc_2-X/trunk/www/vicidial/non_agent_api.php b/agc_2-X/trunk/www/vicidial/non_agent_api.php index adf0b8ce..d9a22d0e 100644 --- a/agc_2-X/trunk/www/vicidial/non_agent_api.php +++ b/agc_2-X/trunk/www/vicidial/non_agent_api.php @@ -97,10 +97,11 @@ # 150313-0818 - Allow for single quotes in vicidial_list and custom data fields # 150428-1720 - Added web_form_address_three to add_list/update_list functions # 150430-0644 - Added API allowed function restrictions and allowed list restrictions +# 150512-2028 - Added filtering of hash sign on some input variables, Issue #851 # -$version = '2.12-73'; -$build = '150430-0644'; +$version = '2.12-74'; +$build = '150512-2028'; $api_url_log = 0; $startMS = microtime(); @@ -401,11 +402,11 @@ if ($non_latin < 1) $phone_code = preg_replace('/[^0-9]/','',$phone_code); $update_phone_number=preg_replace('/[^A-Z]/','',$update_phone_number); $phone_number = preg_replace('/[^0-9]/','',$phone_number); - $vendor_lead_code = preg_replace('/;/','',$vendor_lead_code); + $vendor_lead_code = preg_replace('/;|#/','',$vendor_lead_code); $vendor_lead_code = preg_replace('/\+/',' ',$vendor_lead_code); - $source_id = preg_replace('/;/','',$source_id); + $source_id = preg_replace('/;|#/','',$source_id); $source_id = preg_replace('/\+/',' ',$source_id); - $gmt_offset_now = preg_replace('/-\_\.0-9/','',$gmt_offset_now); + $gmt_offset_now = preg_replace('/[^-\_\.0-9]/','',$gmt_offset_now); $title = preg_replace('/[^- \'\_\.0-9a-zA-Z]/','',$title); $first_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$first_name); $first_name = preg_replace('/\+/',' ',$first_name); @@ -434,7 +435,7 @@ if ($non_latin < 1) $email = preg_replace('/\+/',' ',$email); $security_phrase = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$security_phrase); $security_phrase = preg_replace('/\+/',' ',$security_phrase); - $comments = preg_replace('/;/','',$comments); + $comments = preg_replace('/;|#/','',$comments); $comments = preg_replace('/\+/',' ',$comments); $dnc_check = preg_replace('/[^A-Z]/','',$dnc_check); $campaign_dnc_check = preg_replace('/[^A-Z]/','',$campaign_dnc_check); @@ -534,9 +535,9 @@ if ($non_latin < 1) } else { - $user = preg_replace("/'|\"|\\\\|;/","",$user); - $pass = preg_replace("/'|\"|\\\\|;/","",$pass); - $source = preg_replace("/'|\"|\\\\|;/","",$source); + $user = preg_replace("/'|\"|\\\\|;|#/","",$user); + $pass = preg_replace("/'|\"|\\\\|;|#/","",$pass); + $source = preg_replace("/'|\"|\\\\|;|#/","",$source); } $USarea = substr($phone_number, 0, 3);