From 00224c7e9502ce46c004644230916c2a7a05e7f4 Mon Sep 17 00:00:00 2001 From: mattf Date: Thu, 24 Feb 2022 03:57:19 +0000 Subject: [PATCH] Added allow_web_debug system setting for more admin PHP scripts git-svn-id: svn://192.168.202.10@3571 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/trunk/www/vicidial/KHOMP_admin.php | 99 +++- agc_2-X/trunk/www/vicidial/audio_store.php | 44 +- .../trunk/www/vicidial/force_agent_logout.php | 24 +- .../www/vicidial/manager_chat_actions.php | 29 +- .../www/vicidial/manager_chat_interface.php | 35 +- agc_2-X/trunk/www/vicidial/non_agent_api.php | 422 ++++++++++++------ agc_2-X/trunk/www/vicidial/remote_dispo.php | 48 +- .../trunk/www/vicidial/reset_agent_pass.php | 23 +- .../www/vicidial/reset_campaign_lists.php | 35 +- agc_2-X/trunk/www/vicidial/send_CID_call.php | 23 +- .../www/vicidial/user_group_bulk_change.php | 24 +- .../trunk/www/vicidial/user_territories.php | 53 ++- 12 files changed, 579 insertions(+), 280 deletions(-) diff --git a/agc_2-X/trunk/www/vicidial/KHOMP_admin.php b/agc_2-X/trunk/www/vicidial/KHOMP_admin.php index 06c74f30..0a2bbf49 100644 --- a/agc_2-X/trunk/www/vicidial/KHOMP_admin.php +++ b/agc_2-X/trunk/www/vicidial/KHOMP_admin.php @@ -1,12 +1,13 @@ , Joe Johnson LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell , Joe Johnson LICENSE: AGPLv2 # # Interface for defining KHOMP codes for the dialer # # 200210-1604 - First build -# +# 220223-1109 - Added allow_web_debug system setting +# $startMS = microtime(); @@ -71,15 +72,13 @@ $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $QUERY_STRING = getenv("QUERY_STRING"); $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); - - if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["query_date"])) {$query_date=$_GET["query_date"];} elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];} -if (isset($_GET["end_date"])) {$end_date=$_GET["end_date"];} +if (isset($_GET["end_date"])) {$end_date=$_GET["end_date"];} elseif (isset($_POST["end_date"])) {$end_date=$_POST["end_date"];} -if (isset($_GET["submit_khomp"])) {$submit_khomp=$_GET["submit_khomp"];} +if (isset($_GET["submit_khomp"])) {$submit_khomp=$_GET["submit_khomp"];} elseif (isset($_POST["submit_khomp"])) {$submit_khomp=$_POST["submit_khomp"];} if (isset($_GET["new_conclusion"])) {$new_conclusion=$_GET["new_conclusion"];} elseif (isset($_POST["new_conclusion"])) {$new_conclusion=$_POST["new_conclusion"];} @@ -91,15 +90,15 @@ if (isset($_GET["new_status"])) {$new_status=$_GET["new_status"];} elseif (isset($_POST["new_status"])) {$new_status=$_POST["new_status"];} if (isset($_GET["new_dialstatus"])) {$new_dialstatus=$_GET["new_dialstatus"];} elseif (isset($_POST["new_dialstatus"])) {$new_dialstatus=$_POST["new_dialstatus"];} -if (isset($_GET["update_conclusion"])) {$update_conclusion=$_GET["update_conclusion"];} +if (isset($_GET["update_conclusion"])) {$update_conclusion=$_GET["update_conclusion"];} elseif (isset($_POST["update_conclusion"])) {$update_conclusion=$_POST["update_conclusion"];} if (isset($_GET["update_pattern"])) {$update_pattern=$_GET["update_pattern"];} elseif (isset($_POST["update_pattern"])) {$update_pattern=$_POST["update_pattern"];} -if (isset($_GET["update_action"])) {$update_action=$_GET["update_action"];} +if (isset($_GET["update_action"])) {$update_action=$_GET["update_action"];} elseif (isset($_POST["update_action"])) {$update_action=$_POST["update_action"];} -if (isset($_GET["update_status"])) {$update_status=$_GET["update_status"];} +if (isset($_GET["update_status"])) {$update_status=$_GET["update_status"];} elseif (isset($_POST["update_status"])) {$update_status=$_POST["update_status"];} -if (isset($_GET["update_dialstatus"])) {$update_dialstatus=$_GET["update_dialstatus"];} +if (isset($_GET["update_dialstatus"])) {$update_dialstatus=$_GET["update_dialstatus"];} elseif (isset($_POST["update_dialstatus"])) {$update_dialstatus=$_POST["update_dialstatus"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); @@ -109,6 +108,54 @@ $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$stmt = "SELECT use_non_latin,allow_chats,enable_languages,language_method,default_language,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSallow_chats = $row[1]; + $SSenable_languages = $row[2]; + $SSlanguage_method = $row[3]; + $SSdefault_language = $row[4]; + $SSallow_web_debug = $row[5]; + } +if ($SSallow_web_debug < 1) {$DB=0;} +$VUselected_language = $SSdefault_language; +##### END SETTINGS LOOKUP ##### +########################################### + +$query_date = preg_replace("/[^-_0-9a-zA-Z]/", "",$query_date); +$end_date = preg_replace("/[^-_0-9a-zA-Z]/", "",$end_date); +$submit_khomp = preg_replace("/[^-_0-9a-zA-Z]/", "",$submit_khomp); +$new_conclusion=trim(preg_replace('/[^- \_0-9a-zA-Z]/', "", $new_conclusion)); +$new_pattern=trim(preg_replace('/[^- \_0-9a-zA-Z]/', "", $new_pattern)); +$new_action=trim(preg_replace('/[^a-zA-Z]/', "", $new_action)); +$new_status=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $new_status))); +$new_dialstatus=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $new_dialstatus))); +$update_action=trim(preg_replace('/[^a-zA-Z]/', "", $update_action)); +$update_status=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $update_status))); +$update_dialstatus=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $update_dialstatus))); +$update_conclusion=trim(preg_replace('/[^- \_0-9a-zA-Z]/', "", $update_conclusion)); +$update_pattern=trim(preg_replace('/[^- \_0-9a-zA-Z]/', "", $update_pattern)); + +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_PW); + } # end of non_latin +else + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + } + +$auth=0; +$user_auth=0; $auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1,0); if ( ($auth_message == 'GOOD') or ($auth_message == '2FA') ) { @@ -138,11 +185,31 @@ if ($user_auth > 0) } } +if ($auth < 1) + { + $VDdisplayMESSAGE = _QXZ("Login incorrect, please try again"); + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = _QXZ("Too many login attempts, try again in 15 minutes"); + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ($auth_message == 'IPBLOCK') + { + $VDdisplayMESSAGE = _QXZ("Your IP Address is not allowed") . ": $ip"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + if ($submit_khomp=="UPDATE") { - $update_action=trim(preg_replace('/[^a-zA-Z]/', "", $update_action)); - $update_status=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $update_status))); - $update_dialstatus=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $update_dialstatus))); if($update_conclusion) { $update_khomp_string="\"$update_conclusion\""; @@ -214,12 +281,6 @@ if ($submit_khomp=="UPDATE") } else if ($submit_khomp=="ADD") { - $new_conclusion=trim(preg_replace('/[^- \_0-9a-zA-Z]/', "", $new_conclusion)); - $new_pattern=trim(preg_replace('/[^- \_0-9a-zA-Z]/', "", $new_pattern)); - $new_action=trim(preg_replace('/[^a-zA-Z]/', "", $new_action)); - $new_status=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $new_status))); - $new_dialstatus=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $new_dialstatus))); - if($new_conclusion) { $new_khomp_string="\"$new_conclusion\""; diff --git a/agc_2-X/trunk/www/vicidial/audio_store.php b/agc_2-X/trunk/www/vicidial/audio_store.php index a27c4db8..e9f24ef0 100644 --- a/agc_2-X/trunk/www/vicidial/audio_store.php +++ b/agc_2-X/trunk/www/vicidial/audio_store.php @@ -34,10 +34,11 @@ # 210321-0131 - Added classAudioFile PHP library for WAV file format validation # 210322-1220 - Added checking of .wav files for asterisk-compatible format # 220120-0927 - Added audio_store_GSM_allowed option. Disable GSM file uploads by default +# 220222-2348 - Added allow_web_debug system setting # -$version = '2.14-26'; -$build = '220120-0927'; +$version = '2.14-27'; +$build = '220222-2348'; $MT[0]=''; @@ -91,9 +92,9 @@ header ("Pragma: no-cache"); // HTTP/1.0 ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,sounds_central_control_active,sounds_web_server,sounds_web_directory,outbound_autodial_active,enable_languages,language_method,active_modules,contacts_enabled,allow_emails,qc_features_active FROM system_settings;"; +$stmt = "SELECT use_non_latin,sounds_central_control_active,sounds_web_server,sounds_web_directory,outbound_autodial_active,enable_languages,language_method,active_modules,contacts_enabled,allow_emails,qc_features_active,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $ss_conf_ct = mysqli_num_rows($rslt); if ($ss_conf_ct > 0) { @@ -109,10 +110,39 @@ if ($ss_conf_ct > 0) $SScontacts_enabled = $row[8]; $SSemail_enabled = $row[9]; $SSqc_features_active = $row[10]; + $SSallow_web_debug = $row[11]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT); +$overwrite = preg_replace('/[^-_0-9a-zA-Z]/','',$overwrite); +$force_allow = preg_replace('/[^-_0-9a-zA-Z]/','',$force_allow); + +# Variables filter further down in the code +# $audiofile_name + +if ($non_latin < 1) + { + $delete_file = preg_replace('/[^-\._0-9a-zA-Z]/','',$delete_file); + $submit_file = preg_replace('/[^-\._0-9a-zA-Z]/','',$submit_file); + $master_audiofile = preg_replace('/[^-\._0-9a-zA-Z]/','',$master_audiofile); + $new_audiofile = preg_replace('/[^-\._0-9a-zA-Z]/','',$new_audiofile); + $lead_file = preg_replace('/[^-\._0-9a-zA-Z]/','',$lead_file); + $audio_server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$audio_server_ip); + } +else + { + $delete_file = preg_replace('/[^-\._0-9\p{L}]/u','',$delete_file); + $submit_file = preg_replace('/[^-\._0-9\p{L}]/u','',$submit_file); + $master_audiofile = preg_replace('/[^-\._0-9\p{L}]/u','',$master_audiofile); + $new_audiofile = preg_replace('/[^-\._0-9\p{L}]/u','',$new_audiofile); + $lead_file = preg_replace('/[^-\._0-9\p{L}]/u','',$lead_file); + $audio_server_ip = preg_replace('/[^-\.\:\_0-9\p{L}]/u','',$audio_server_ip); + } + ### check if sounds server matches this server IP, if not then exit with an error $sounds_web_server = str_replace(array('http://','https://'), '', $sounds_web_server); if ( ( ( (strlen($sounds_web_server)) != (strlen($server_name)) ) or (!preg_match("/$sounds_web_server/i",$server_name) ) ) and ($force_allow!='FORCED') ) @@ -177,6 +207,7 @@ if (strlen($audio_server_ip) > 6) {$formIPvalid=1;} } $ip = getenv("REMOTE_ADDR"); + if ( (!preg_match("/\|$ip\|/", $server_ips)) and ($formIPvalid < 1) ) { $user_set=1; @@ -189,10 +220,9 @@ if ( (!preg_match("/\|$ip\|/", $server_ips)) and ($formIPvalid < 1) ) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } - $delete_file = preg_replace('/[^-\._0-9a-zA-Z]/','',$delete_file); $stmt="SELECT selected_language,qc_enabled from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} diff --git a/agc_2-X/trunk/www/vicidial/force_agent_logout.php b/agc_2-X/trunk/www/vicidial/force_agent_logout.php index 282870c3..536c7983 100644 --- a/agc_2-X/trunk/www/vicidial/force_agent_logout.php +++ b/agc_2-X/trunk/www/vicidial/force_agent_logout.php @@ -11,6 +11,7 @@ # CHANGES # 201025-2320 - First build # 220124-2127 - Changed to allow user_level 7 users with the proper permissions to use this page +# 220223-2155 - Added allow_web_debug system setting # $startMS = microtime(); @@ -27,8 +28,6 @@ $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); $ip = getenv("REMOTE_ADDR"); if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} -if (isset($_GET["group"])) {$group=$_GET["group"];} - elseif (isset($_POST["group"])) {$group=$_POST["group"];} if (isset($_GET["logout_agent"])) {$logout_agent=$_GET["logout_agent"];} elseif (isset($_POST["logout_agent"])) {$logout_agent=$_POST["logout_agent"];} if (isset($_GET["list_id"])) {$list_id=$_GET["list_id"];} @@ -44,9 +43,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,pass_hash_enabled FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,pass_hash_enabled,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -58,10 +57,17 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $SSpass_hash_enabled = $row[6]; + $SSallow_web_debug = $row[7]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$list_id = preg_replace('/[^0-9]/', '', $list_id); +$server_ip = preg_replace('/[^-._0-9a-zA-Z]/', '', $server_ip); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -70,15 +76,11 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $logout_agent = preg_replace("/'|\"|\\\\|;/","",$logout_agent); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $logout_agent = preg_replace('/[^-_0-9\p{L}]/u',"",$logout_agent); } -$list_id = preg_replace('/[^0-9]/', '', $list_id); -$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); -$server_ip = preg_replace('/[^-._0-9a-zA-Z]/', '', $server_ip); - $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); diff --git a/agc_2-X/trunk/www/vicidial/manager_chat_actions.php b/agc_2-X/trunk/www/vicidial/manager_chat_actions.php index 7e330405..53feaa75 100644 --- a/agc_2-X/trunk/www/vicidial/manager_chat_actions.php +++ b/agc_2-X/trunk/www/vicidial/manager_chat_actions.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Joe Johnson, Matt Florell LICENSE: AGPLv2 # # Contains PHP actions for manager_chat_interface.php - works with vicidial_chat.js # @@ -13,10 +13,11 @@ # 160108-2300 - Changed some mysqli_query to mysql_to_mysqli for consistency # 161217-0821 - Added chat-type to allow for multi-user internal chat sessions # 170409-1550 - Added IP List validation code +# 220223-0934 - Added allow_web_debug system setting # -$admin_version = '2.14-7'; -$build = '170409-1550'; +$admin_version = '2.14-8'; +$build = '220223-0934'; $sh="managerchats"; @@ -48,9 +49,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,allow_chats,enable_languages,language_method,default_language FROM system_settings;"; +$stmt = "SELECT use_non_latin,allow_chats,enable_languages,language_method,default_language,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -60,11 +61,22 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[2]; $SSlanguage_method = $row[3]; $SSdefault_language = $row[4]; + $SSallow_web_debug = $row[5]; } +if ($SSallow_web_debug < 1) {$DB=0;} $VUselected_language = $SSdefault_language; ##### END SETTINGS LOOKUP ##### ########################################### +$action = preg_replace("/[^-_0-9a-zA-Z]/", "",$action); +$manager_chat_id = preg_replace("/[^-_0-9a-zA-Z]/", "",$manager_chat_id); +$chat_sub_id = preg_replace("/[^-_0-9a-zA-Z]/", "",$chat_sub_id); +$reload_chat_span = preg_replace("/[^-_0-9a-zA-Z]/", "",$reload_chat_span); + +### Variables filtered further down in the code +# $chat_sub_ids +# $chat_message + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_USER); @@ -73,9 +85,9 @@ if ($non_latin < 1) } # end of non_latin else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $user = preg_replace("/'|\"|\\\\|;/","",$user); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9\p{L}]/u',"",$user); } $auth=0; @@ -191,6 +203,7 @@ if ($action=="CheckEndedChats" && $manager_chat_id) { if ($action=="PrintSubChatText") { for ($i=0; $i<$chat_sub_id_ct; $i++) { + $chat_sub_ids[$i] = preg_replace("/[^-_0-9a-zA-Z]/", "",$chat_sub_ids[$i]); $chat_sub_id=$chat_sub_ids[$i]; $span_name="manager_chat_".$manager_chat_id."_".$chat_sub_id; diff --git a/agc_2-X/trunk/www/vicidial/manager_chat_interface.php b/agc_2-X/trunk/www/vicidial/manager_chat_interface.php index db87b571..497247d2 100644 --- a/agc_2-X/trunk/www/vicidial/manager_chat_interface.php +++ b/agc_2-X/trunk/www/vicidial/manager_chat_interface.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Joe Johnson, Matt Florell LICENSE: AGPLv2 # # This page is for managers (level 8 or higher) to chat with live agents # @@ -16,10 +16,11 @@ # 170409-1551 - Added IP List validation code # 180508-2215 - Added new help display # 210114-1338 - Fixed user group permission bug, Issue #1240 +# 220223-0933 - Added allow_web_debug system setting # -$admin_version = '2.14-10'; -$build = '210114-1338'; +$admin_version = '2.14-11'; +$build = '220223-0933'; $sh="managerchats"; @@ -59,9 +60,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $VUselected_language = ''; -$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,allow_emails,allow_emails,level_8_disable_add,allow_chats,enable_languages,language_method,default_language FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,allow_emails,allow_emails,level_8_disable_add,allow_chats,enable_languages,language_method,default_language,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -104,11 +105,27 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[35]; $SSlanguage_method = $row[36]; $SSdefault_language = $row[37]; + $SSallow_web_debug = $row[38]; } +if ($SSallow_web_debug < 1) {$DB=0;} $VUselected_language = $SSdefault_language; ##### END SETTINGS LOOKUP ##### ########################################### +$list_id = preg_replace("/[^0-9]/","",$list_id); +$action = preg_replace("/[^-_0-9a-zA-Z]/", "",$action); +$SUBMIT = preg_replace("/[^-_0-9a-zA-Z]/", "",$SUBMIT); +$manager_chat_id = preg_replace("/[^-_0-9a-zA-Z]/", "",$manager_chat_id); +$allow_replies = preg_replace("/[^-_0-9a-zA-Z]/", "",$allow_replies); +$end_all_chats = preg_replace("/[^-_0-9a-zA-Z]/", "",$end_all_chats); +$submit_chat = preg_replace("/[^- \.\_0-9a-zA-Z]/", "",$submit_chat); + +### Variables filtered further down in the code +# $available_chat_agents +# $available_chat_groups +# $available_chat_campaigns +# $manager_message + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_USER); @@ -116,10 +133,9 @@ if ($non_latin < 1) } # end of non_latin else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$list_id = preg_replace("/[^0-9]/","",$list_id); $STARTtime = date("U"); $TODAY = date("Y-m-d"); @@ -210,6 +226,7 @@ else if ($submit_chat) $chat_agents_SQL_OR="vicidial_live_agents.user in ('',"; while($i < $available_chat_agents_ct) { + $available_chat_agents[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$available_chat_agents[$i]); $available_chat_agents_string .= "$available_chat_agents[$i]|"; $chat_agents_SQL_OR.="'$available_chat_agents[$i]',"; $i++; @@ -223,6 +240,7 @@ else if ($submit_chat) $chat_groups_SQL_OR="vicidial_users.user_group in ('',"; while($i < $available_chat_groups_ct) { + $available_chat_groups[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$available_chat_groups[$i]); $available_chat_groups_string .= "$available_chat_groups[$i]|"; $chat_groups_SQL_OR.="'$available_chat_groups[$i]',"; $i++; @@ -236,6 +254,7 @@ else if ($submit_chat) $chat_campaigns_SQL_OR="vicidial_live_agents.campaign_id in ('',"; while($i < $available_chat_campaigns_ct) { + $available_chat_campaigns[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$available_chat_campaigns[$i]); $available_chat_campaigns_string .= "$available_chat_campaigns[$i]|"; $chat_campaigns_SQL_OR.="'$available_chat_campaigns[$i]',"; $i++; diff --git a/agc_2-X/trunk/www/vicidial/non_agent_api.php b/agc_2-X/trunk/www/vicidial/non_agent_api.php index 584dba9f..544f7d59 100644 --- a/agc_2-X/trunk/www/vicidial/non_agent_api.php +++ b/agc_2-X/trunk/www/vicidial/non_agent_api.php @@ -190,10 +190,11 @@ # 211217-0733 - Fixes for PHP8, issue #1341 # 220120-0914 - Added download_invalid_files user function for audio store file listings # 220126-2116 - Added dispo_call_url and alt URL options for update_campaign. Added 'update_alt_url' function +# 220223-0838 - Added allow_web_debug system setting # -$version = '2.14-167'; -$build = '220126-2116'; +$version = '2.14-168'; +$build = '220223-0838'; $php_script='non_agent_api.php'; $api_url_log = 0; @@ -567,10 +568,6 @@ if (isset($_GET["leads_counts"])) {$leads_counts=$_GET["leads_counts"];} elseif (isset($_POST["leads_counts"])) {$leads_counts=$_POST["leads_counts"];} if (isset($_GET["remove_from_hopper"])) {$remove_from_hopper=$_GET["remove_from_hopper"];} elseif (isset($_POST["remove_from_hopper"])) {$remove_from_hopper=$_POST["remove_from_hopper"];} -if (isset($_GET["dedupe_statuses"])) {$dedupe_statuses=$_GET["dedupe_statuses"];} - elseif (isset($_POST["dedupe_statuses"])) {$dedupe_statuses=$_POST["dedupe_statuses"];} -if (isset($_GET["status_mismatch_action"])) {$status_mismatch_action=$_GET["status_mismatch_action"];} - elseif (isset($_POST["status_mismatch_action"])) {$status_mismatch_action=$_POST["status_mismatch_action"];} if (isset($_GET["custom_order"])) {$custom_order=$_GET["custom_order"];} elseif (isset($_POST["custom_order"])) {$custom_order=$_POST["custom_order"];} if (isset($_GET["custom_copy_method"])) {$custom_copy_method=$_GET["custom_copy_method"];} @@ -629,8 +626,6 @@ if (isset($_GET["field_max"])) {$field_max=$_GET["field_max"];} elseif (isset($_POST["field_max"])) {$field_max=$_POST["field_max"];} if (isset($_GET["field_default"])) {$field_default=$_GET["field_default"];} elseif (isset($_POST["field_default"])) {$field_default=$_POST["field_default"];} -if (isset($_GET["field_cost"])) {$field_cost=$_GET["field_cost"];} - elseif (isset($_POST["field_cost"])) {$field_cost=$_POST["field_cost"];} if (isset($_GET["field_required"])) {$field_required=$_GET["field_required"];} elseif (isset($_POST["field_required"])) {$field_required=$_POST["field_required"];} if (isset($_GET["name_position"])) {$name_position=$_GET["name_position"];} @@ -693,6 +688,8 @@ if (isset($_GET["url_call_length"])) {$url_call_length=$_GET["url_call_length" elseif (isset($_POST["url_call_length"])) {$url_call_length=$_POST["url_call_length"];} +$DB=preg_replace('/[^0-9]/','',$DB); + if (file_exists('options.php')) {require('options.php');} @@ -702,7 +699,7 @@ header ("Pragma: no-cache"); // HTTP/1.0 ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,custom_fields_enabled,pass_hash_enabled,agent_whisper_enabled,active_modules,auto_dial_limit,enable_languages,language_method,admin_web_directory,sounds_web_server FROM system_settings;"; +$stmt = "SELECT use_non_latin,custom_fields_enabled,pass_hash_enabled,agent_whisper_enabled,active_modules,auto_dial_limit,enable_languages,language_method,admin_web_directory,sounds_web_server,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) @@ -720,40 +717,142 @@ if ($qm_conf_ct > 0) $SSlanguage_method = $row[7]; $SSadmin_web_directory = $row[8]; $SSsounds_web_server = $row[9]; + $SSallow_web_debug = $row[10]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### -$DB=preg_replace('/[^0-9]/','',$DB); +$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id); +$list_id_field = preg_replace('/[^0-9]/','',$list_id_field); +$lead_id = preg_replace('/[^0-9]/','',$lead_id); +$lead_ids = preg_replace('/[^\,0-9]/','',$lead_ids); +$list_exists_check = preg_replace('/[^0-9a-zA-Z]/','',$list_exists_check); +$use_internal_webserver = preg_replace('/[^0-9a-zA-Z]/','',$use_internal_webserver); +$field_rerank = preg_replace('/[^_0-9a-zA-Z]/','',$field_rerank); +$custom_fields_add = preg_replace('/[^_0-9a-zA-Z]/','',$custom_fields_add); +$custom_fields_update = preg_replace('/[^_0-9a-zA-Z]/','',$custom_fields_update); +$custom_fields_delete = preg_replace('/[^_0-9a-zA-Z]/','',$custom_fields_delete); +$dialable_count = preg_replace('/[^_0-9a-zA-Z]/','',$dialable_count); +$call_handle_method = preg_replace('/[^_0-9a-zA-Z]/','',$call_handle_method); +$agent_search_method = preg_replace('/[^_0-9a-zA-Z]/','',$agent_search_method); +$delete_cf_data = preg_replace('/[^A-Z]/','',$delete_cf_data); +$entry_type = preg_replace('/[^_0-9a-zA-Z]/','',$entry_type); +$alt_url_id = preg_replace('/[^0-9A-Z]/','',$alt_url_id); +$url_type = preg_replace('/[^_0-9a-zA-Z]/','',$url_type); +$url_rank = preg_replace('/[^0-9]/','',$url_rank); +$url_lists = preg_replace('/[^- 0-9A-Z]/', '',$url_lists); +$url_call_length = preg_replace('/[^0-9]/','',$url_call_length); +$status_breakdown = preg_replace('/[^1Y]/','',$status_breakdown); +$show_percentages = preg_replace('/[^1Y]/','',$show_percentages); +$function = preg_replace('/[^-_0-9a-zA-Z]/', '',$function); +$format = preg_replace('/[^0-9a-zA-Z]/','',$format); +$session_id = preg_replace('/[^0-9]/','',$session_id); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); +$stage = preg_replace('/[^-_0-9a-zA-Z]/','',$stage); +$rank = preg_replace('/[^0-9]/','',$rank); +$did_ids=preg_replace('/[^\,\+0-9a-zA-Z]/','',$did_ids); +$did_patterns = preg_replace('/[^\,\:\+\*\#\.\_0-9a-zA-Z]/','',$did_patterns); +$end_date=preg_replace('/[^-0-9]/','',$end_date); +$end_time=preg_replace('/[^:0-9]/','',$end_time); +$entry_list_id = preg_replace('/[^0-9]/','',$entry_list_id); +$phone_code = preg_replace('/[^0-9]/','',$phone_code); +$update_phone_number=preg_replace('/[^A-Z]/','',$update_phone_number); +$date_of_birth = preg_replace('/[^-0-9]/','',$date_of_birth); +$gender = preg_replace('/[^A-Z]/','',$gender); +$dnc_check = preg_replace('/[^A-Z]/','',$dnc_check); +$campaign_dnc_check = preg_replace('/[^A-Z]/','',$campaign_dnc_check); +$add_to_hopper = preg_replace('/[^A-Z]/','',$add_to_hopper); +$hopper_priority = preg_replace("/[^-0-9]/", "",$hopper_priority); +$hopper_local_call_time_check = preg_replace('/[^A-Z]/','',$hopper_local_call_time_check); +$custom_fields = preg_replace('/[^0-9a-zA-Z]/','',$custom_fields); +$search_method = preg_replace('/[^-_0-9a-zA-Z]/','',$search_method); +$duplicate_check = preg_replace('/[^-_0-9a-zA-Z]/','',$duplicate_check); +$insert_if_not_found = preg_replace('/[^A-Z]/','',$insert_if_not_found); +$records = preg_replace('/[^0-9]/','',$records); +$search_location = preg_replace('/[^A-Z]/','',$search_location); +$no_update = preg_replace('/[^A-Z]/','',$no_update); +$delete_lead = preg_replace('/[^A-Z]/','',$delete_lead); +$called_count=preg_replace('/[^0-9]/','',$called_count); +$agent_user_level=preg_replace('/[^0-9]/','',$agent_user_level); +$hotkeys_active=preg_replace('/[^0-9]/','',$hotkeys_active); +$protocol=preg_replace('/[^0-9a-zA-Z]/','',$protocol); +$local_gmt=preg_replace('/[^-\.0-9]/','',$local_gmt); +$active=preg_replace('/[^A-Z]/','',$active); +$reset_list=preg_replace('/[^A-Z]/','',$reset_list); +$delete_list=preg_replace('/[^A-Z]/','',$delete_list); +$delete_leads=preg_replace('/[^A-Z]/','',$delete_leads); +$reset_time=preg_replace('/[^-_0-9]/', '',$reset_time); +$tz_method = preg_replace('/[^-\_0-9a-zA-Z]/', '',$tz_method); +$reset_lead = preg_replace('/[^A-Z]/','',$reset_lead); +$usacan_areacode_check = preg_replace('/[^A-Z]/','',$usacan_areacode_check); +$usacan_prefix_check = preg_replace('/[^A-Z]/','',$usacan_prefix_check); +$delete_phone = preg_replace('/[^A-Z]/','',$delete_phone); +$callback_datetime = preg_replace('/[^- \+\.\:\/\@\_0-9a-zA-Z]/','',$callback_datetime); +$callback = preg_replace('/[^A-Z]/','',$callback); +$callback_type = preg_replace('/[^A-Z]/','',$callback_type); +$datetime_start = preg_replace('/[^- \+\:\_0-9]/','',$datetime_start); +$datetime_end = preg_replace('/[^- \+\:\_0-9]/','',$datetime_end); +$time_format = preg_replace('/[^A-Z]/','',$time_format); +$nanpa_ac_prefix_check = preg_replace('/[^A-Z]/','',$nanpa_ac_prefix_check); +$delete_user = preg_replace('/[^A-Z]/','',$delete_user); +$campaign_rank = preg_replace('/[^-_0-9]/','',$campaign_rank); +$campaign_grade = preg_replace('/[^0-9]/','',$campaign_grade); +$camp_rg_only = preg_replace('/[^0-9]/','',$camp_rg_only); +$wrapup_seconds_override = preg_replace('/[^-0-9]/','',$wrapup_seconds_override); +$show_sub_status = preg_replace('/[^A-Z]/','',$show_sub_status); +$auto_dial_level = preg_replace('/[^\.0-9]/','',$auto_dial_level); +$adaptive_maximum_level = preg_replace('/[^\.0-9]/','',$adaptive_maximum_level); +$campaign_vdad_exten = preg_replace('/[^0-9]/','',$campaign_vdad_exten); +$hopper_level = preg_replace('/[^0-9]/','',$hopper_level); +$reset_hopper = preg_replace('/[^NY]/','',$reset_hopper); +$dial_method = preg_replace('/[^-_0-9a-zA-Z]/','',$dial_method); +$dial_timeout = preg_replace('/[^0-9]/','',$dial_timeout); +$lookup_state = preg_replace('/[^A-Z]/','',$lookup_state); +$detail = preg_replace('/[^A-Z]/','',$detail); +$type = preg_replace('/[^A-Z]/','',$type); +$force_entry_list_id = preg_replace('/[^0-9]/','',$force_entry_list_id); +$file_download = preg_replace('/[^0-9]/','',$file_download); +$agent_choose_ingroups = preg_replace('/[^0-9]/','',$agent_choose_ingroups); +$agent_choose_blended = preg_replace('/[^0-9]/','',$agent_choose_blended); +$closer_default_blended = preg_replace('/[^0-9]/','',$closer_default_blended); +$phone_ring_timeout = preg_replace('/[^0-9]/','',$phone_ring_timeout); +$delete_vm_after_email = preg_replace('/[^a-zA-Z]/','',$delete_vm_after_email); +$field_rank = preg_replace('/[^0-9]/','',$field_rank); +$field_size = preg_replace('/[^0-9]/','',$field_size); +$field_max = preg_replace('/[^0-9]/','',$field_max); +$field_order = preg_replace('/[^0-9]/','',$field_order); +$field_required = preg_replace('/[^_A-Z]/','',$field_required); +$field_encrypt = preg_replace('/[^NY]/','',$field_encrypt); +$field_duplicate = preg_replace('/[^_A-Z]/','',$field_duplicate); +$field_type = preg_replace('/[^0-9a-zA-Z]/','',$field_type); +$name_position = preg_replace('/[^0-9a-zA-Z]/','',$name_position); +$multi_position = preg_replace('/[^0-9a-zA-Z]/','',$multi_position); +$ingroup_rank = preg_replace('/[^-_0-9]/','',$ingroup_rank); +$ingroup_grade = preg_replace('/[^0-9]/','',$ingroup_grade); +$ingrp_rg_only = preg_replace('/[^0-9]/','',$ingrp_rg_only); +$query_date=preg_replace('/[^-0-9]/','',$query_date); +$query_time=preg_replace('/[^:0-9]/','',$query_time); +$gmt_offset_now = preg_replace('/[^-\_\.0-9]/','',$gmt_offset_now); +$date=preg_replace('/[^-0-9]/','',$date); +$header = preg_replace('/[^0-9a-zA-Z]/','',$header); if ($non_latin < 1) { - $users=preg_replace('/[^-_0-9a-zA-Z\,]/','',$users); - $did_patterns = preg_replace('/[^:\+\*\#\.\_0-9a-zA-Z\,]/','',$did_patterns); - $did_ids=preg_replace('/[^0-9\,]/','',$did_ids); - $query_date=preg_replace('/[^-0-9]/','',$query_date); - $query_time=preg_replace('/[^:0-9]/','',$query_time); - $end_date=preg_replace('/[^-0-9]/','',$end_date); - $end_time=preg_replace('/[^:0-9]/','',$end_time); + $status = preg_replace('/[^-_0-9a-zA-Z]/','',$status); + $ingroups = preg_replace('/[^-_0-9a-zA-Z]/','',$ingroups); + $phone_extension = preg_replace('/[^-_0-9a-zA-Z]/','',$phone_extension); + $users=preg_replace('/[^-\,\_0-9a-zA-Z]/','',$users); $statuses = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$statuses); - $categories = preg_replace('/[^-_0-9a-zA-Z\,]/','',$categories); - $status_breakdown = preg_replace('/[^1Y]/','',$status_breakdown); - $show_percentages = preg_replace('/[^1Y]/','',$show_percentages); - + $categories = preg_replace('/[^-\,\_0-9a-zA-Z]/','',$categories); $user=preg_replace('/[^-_0-9a-zA-Z]/','',$user); $pass=preg_replace('/[^-_0-9a-zA-Z]/','',$pass); $agent_user=preg_replace('/[^-_0-9a-zA-Z]/','',$agent_user); - $function = preg_replace('/[^-\_0-9a-zA-Z]/', '',$function); - $format = preg_replace('/[^0-9a-zA-Z]/','',$format); - $entry_list_id = preg_replace('/[^0-9]/','',$entry_list_id); - $phone_code = preg_replace('/[^0-9]/','',$phone_code); - $update_phone_number=preg_replace('/[^A-Z]/','',$update_phone_number); $phone_number = preg_replace('/[^\,0-9]/','',$phone_number); - $vendor_lead_code = preg_replace('/;|#/','',$vendor_lead_code); + $vendor_lead_code = preg_replace('/;|#|\"/','',$vendor_lead_code); $vendor_lead_code = preg_replace('/\+/',' ',$vendor_lead_code); - $source_id = preg_replace('/;|#/','',$source_id); + $source_id = preg_replace('/;|#|\"/','',$source_id); $source_id = preg_replace('/\+/',' ',$source_id); - $gmt_offset_now = preg_replace('/[^-\_\.0-9]/','',$gmt_offset_now); $title = preg_replace('/[^- \'\_\.0-9a-zA-Z]/','',$title); $first_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$first_name); $first_name = preg_replace('/\+/',' ',$first_name); @@ -773,46 +872,24 @@ if ($non_latin < 1) $province = preg_replace('/\+/',' ',$province); $postal_code = preg_replace('/[^- \'\+0-9a-zA-Z]/','',$postal_code); $postal_code = preg_replace('/\+/',' ',$postal_code); - $country_code = preg_replace('/[^A-Z]/','',$country_code); - $gender = preg_replace('/[^A-Z]/','',$gender); - $date_of_birth = preg_replace('/[^-0-9]/','',$date_of_birth); + $country_code = preg_replace('/[^-_0-9a-zA-Z]/','',$country_code); $alt_phone = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$alt_phone); $alt_phone = preg_replace('/\+/',' ',$alt_phone); $email = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9a-zA-Z]/','',$email); $email = preg_replace('/\+/',' ',$email); $security_phrase = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$security_phrase); $security_phrase = preg_replace('/\+/',' ',$security_phrase); - $comments = preg_replace('/;|#/','',$comments); + $comments = preg_replace('/;|#|\"/','',$comments); $comments = preg_replace('/\+/',' ',$comments); - $dnc_check = preg_replace('/[^A-Z]/','',$dnc_check); - $campaign_dnc_check = preg_replace('/[^A-Z]/','',$campaign_dnc_check); - $add_to_hopper = preg_replace('/[^A-Z]/','',$add_to_hopper); - $hopper_priority = preg_replace("/[^-0-9]/", "",$hopper_priority); - $hopper_local_call_time_check = preg_replace('/[^A-Z]/','',$hopper_local_call_time_check); $campaign_id = preg_replace('/[^-\_0-9a-zA-Z]/', '',$campaign_id); $multi_alt_phones = preg_replace('/[^- \+\!\:\_0-9a-zA-Z]/','',$multi_alt_phones); $multi_alt_phones = preg_replace('/\+/',' ',$multi_alt_phones); $source = preg_replace('/[^0-9a-zA-Z]/','',$source); $phone_login = preg_replace('/[^-\_0-9a-zA-Z]/', '',$phone_login); - $session_id = preg_replace('/[^0-9]/','',$session_id); - $server_ip = preg_replace('/[^\.0-9]/','',$server_ip); - $stage = preg_replace('/[^a-zA-Z]/','',$stage); - $rank = preg_replace('/[^0-9]/','',$rank); $owner = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$owner); $owner = preg_replace('/\+/',' ',$owner); - $duplicate_check = preg_replace('/[^-_0-9a-zA-Z]/','',$duplicate_check); - $custom_fields = preg_replace('/[^0-9a-zA-Z]/','',$custom_fields); - $search_method = preg_replace('/[^-_0-9a-zA-Z]/','',$search_method); - $insert_if_not_found = preg_replace('/[^A-Z]/','',$insert_if_not_found); - $records = preg_replace('/[^0-9]/','',$records); - $search_location = preg_replace('/[^A-Z]/','',$search_location); $user_field = preg_replace('/[^-_0-9a-zA-Z]/','',$user_field); - $no_update = preg_replace('/[^A-Z]/','',$no_update); - $delete_lead = preg_replace('/[^A-Z]/','',$delete_lead); - $called_count=preg_replace('/[^0-9]/','',$called_count); - $agent_user_level=preg_replace('/[^0-9]/','',$agent_user_level); - $hotkeys_active=preg_replace('/[^0-9]/','',$hotkeys_active); - $voicemail_id=preg_replace('/[^0-9]/','',$voicemail_id); + $voicemail_id=preg_replace('/[^0-9a-zA-Z]/','',$voicemail_id); $agent_pass=preg_replace('/[^-_0-9a-zA-Z]/','',$agent_pass); $agent_full_name=preg_replace('/[^- \+\.\:\/\@\_0-9a-zA-Z]/','',$agent_full_name); $agent_user_group=preg_replace('/[^-_0-9a-zA-Z]/','',$agent_user_group); @@ -824,82 +901,43 @@ if ($non_latin < 1) $custom_five=preg_replace('/[^- \+\.\:\/\@\_0-9a-zA-Z]/','',$custom_five); $extension=preg_replace('/[^-_0-9a-zA-Z]/','',$extension); $dialplan_number=preg_replace('/[^\*\#0-9a-zA-Z]/','',$dialplan_number); - $protocol=preg_replace('/[^0-9a-zA-Z]/','',$protocol); $registration_password=preg_replace('/[^-_0-9a-zA-Z]/','',$registration_password); $phone_full_name=preg_replace('/[^- \+\.\_0-9a-zA-Z]/','',$phone_full_name); - $local_gmt=preg_replace('/[^-\.0-9]/','',$local_gmt); $outbound_cid=preg_replace('/[^-_0-9a-zA-Z]/','',$outbound_cid); $phone_context=preg_replace('/[^-_0-9a-zA-Z]/','',$phone_context); $list_name=preg_replace('/[^- \+\.\:\/\@\?\&\_0-9a-zA-Z]/','',$list_name); - $active=preg_replace('/[^A-Z]/','',$active); $script=preg_replace('/[^-_0-9a-zA-Z]/','',$script); $am_message=preg_replace('/[^-_0-9a-zA-Z]/','',$am_message); $drop_inbound_group=preg_replace('/[^-_0-9a-zA-Z]/','',$drop_inbound_group); $web_form_address=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9a-zA-Z]/','',$web_form_address); $web_form_address_two=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9a-zA-Z]/','',$web_form_address_two); - $reset_list=preg_replace('/[^A-Z]/','',$reset_list); - $delete_list=preg_replace('/[^A-Z]/','',$delete_list); - $delete_leads=preg_replace('/[^A-Z]/','',$delete_leads); - $reset_time=preg_replace('/[^-_0-9]/', '',$reset_time); + $web_form_address_three=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9a-zA-Z]/','',$web_form_address_three); + $dispo_call_url=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9a-zA-Z]/','',$dispo_call_url); + $url_address=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9a-zA-Z]/','',$url_address); $uniqueid=preg_replace('/[^- \.\_0-9a-zA-Z]/','',$uniqueid); - $tz_method = preg_replace('/[^-\_0-9a-zA-Z]/', '',$tz_method); - $reset_lead = preg_replace('/[^A-Z]/','',$reset_lead); - $usacan_areacode_check = preg_replace('/[^A-Z]/','',$usacan_areacode_check); - $usacan_prefix_check = preg_replace('/[^A-Z]/','',$usacan_prefix_check); - $delete_phone = preg_replace('/[^A-Z]/','',$delete_phone); $alias_id = preg_replace('/[^-\_0-9a-zA-Z]/', '',$alias_id); $phone_logins = preg_replace('/[^-\,\_0-9a-zA-Z]/','',$phone_logins); $alias_name = preg_replace('/[^- \+\.\:\/\@\_0-9a-zA-Z]/','',$alias_name); $delete_alias = preg_replace('/[^A-Z]/','',$delete_alias); - $callback = preg_replace('/[^A-Z]/','',$callback); $callback_status = preg_replace('/[^-\_0-9a-zA-Z]/', '',$callback_status); - $callback_datetime = preg_replace('/[^- \+\.\:\/\@\_0-9a-zA-Z]/','',$callback_datetime); - $callback_type = preg_replace('/[^A-Z]/','',$callback_type); $callback_user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$callback_user); $callback_comments = preg_replace('/[^- \+\.\:\/\@\_0-9a-zA-Z]/','',$callback_comments); $admin_user_group = preg_replace('/[^-\_0-9a-zA-Z]/', '',$admin_user_group); - $datetime_start = preg_replace('/[^- \+\:\_0-9]/','',$datetime_start); - $datetime_end = preg_replace('/[^- \+\:\_0-9]/','',$datetime_end); - $time_format = preg_replace('/[^A-Z]/','',$time_format); $group_alias_id = preg_replace('/[^\_0-9a-zA-Z]/','',$group_alias_id); $group_alias_name = preg_replace('/[^- \+\_0-9a-zA-Z]/','',$group_alias_name); $caller_id_number = preg_replace('/[^0-9]/','',$caller_id_number); $caller_id_name = preg_replace('/[^- \+\_0-9a-zA-Z]/','',$caller_id_name); - $user_groups = preg_replace('/[^-\|\_0-9a-zA-Z\,]/','',$user_groups); #JCJ - $in_groups = preg_replace('/[^-\|\_0-9a-zA-Z\,]/','',$in_groups); #JCJ - $call_id = preg_replace('/[^0-9a-zA-Z]/','',$call_id); + $user_groups = preg_replace('/[^-\|\,\_0-9a-zA-Z]/','',$user_groups); #JCJ + $in_groups = preg_replace('/[^-\|\,\_0-9a-zA-Z]/','',$in_groups); #JCJ $group = preg_replace('/[^-\|\_0-9a-zA-Z]/','',$group); + $call_id = preg_replace('/[^0-9a-zA-Z]/','',$call_id); $expiration_date = preg_replace('/[^-_0-9a-zA-Z]/','',$expiration_date); - $nanpa_ac_prefix_check = preg_replace('/[^A-Z]/','',$nanpa_ac_prefix_check); - $delete_user = preg_replace('/[^A-Z]/','',$delete_user); - $campaign_rank = preg_replace('/[^-_0-9]/','',$campaign_rank); - $campaign_grade = preg_replace('/[^0-9]/','',$campaign_grade); $local_call_time = preg_replace('/[^-_0-9a-zA-Z]/','',$local_call_time); - $camp_rg_only = preg_replace('/[^0-9]/','',$camp_rg_only); - $wrapup_seconds_override = preg_replace('/[^-0-9]/','',$wrapup_seconds_override); - $show_sub_status = preg_replace('/[^A-Z]/','',$show_sub_status); - $campaigns = preg_replace('/[^-\|\_0-9a-zA-Z\,]/','',$campaigns); # JCJ + $campaigns = preg_replace('/[^-\,\|\_0-9a-zA-Z]/','',$campaigns); # JCJ $campaign_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$campaign_name); - $auto_dial_level = preg_replace('/[^\.0-9]/','',$auto_dial_level); - $adaptive_maximum_level = preg_replace('/[^\.0-9]/','',$adaptive_maximum_level); - $campaign_vdad_exten = preg_replace('/[^0-9]/','',$campaign_vdad_exten); - $hopper_level = preg_replace('/[^0-9]/','',$hopper_level); - $reset_hopper = preg_replace('/[^NY]/','',$reset_hopper); - $dial_method = preg_replace('/[^-_0-9a-zA-Z]/','',$dial_method); - $dial_timeout = preg_replace('/[^0-9]/','',$dial_timeout); $field_name = preg_replace('/[^-_0-9a-zA-Z]/','',$field_name); - $lookup_state = preg_replace('/[^A-Z]/','',$lookup_state); - $detail = preg_replace('/[^A-Z]/','',$detail); - $type = preg_replace('/[^A-Z]/','',$type); - $force_entry_list_id = preg_replace('/[^0-9]/','',$force_entry_list_id); - $file_download = preg_replace('/[^0-9]/','',$file_download); $lead_filter_id = preg_replace('/[^-_0-9a-zA-Z]/','',$lead_filter_id); - $agent_choose_ingroups = preg_replace('/[^0-9]/','',$agent_choose_ingroups); - $agent_choose_blended = preg_replace('/[^0-9]/','',$agent_choose_blended); - $closer_default_blended = preg_replace('/[^0-9]/','',$closer_default_blended); $outbound_alt_cid = preg_replace('/[^0-9a-zA-Z]/','',$outbound_alt_cid); - $phone_ring_timeout = preg_replace('/[^0-9]/','',$phone_ring_timeout); - $delete_vm_after_email = preg_replace('/[^a-zA-Z]/','',$delete_vm_after_email); $did_pattern = preg_replace('/[^:\+\*\#\.\_0-9a-zA-Z]/','',$did_pattern); $did_description = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$did_description); $did_route = preg_replace('/[^-_0-9a-zA-Z]/','',$did_route); @@ -937,16 +975,6 @@ if ($non_latin < 1) $xferconf_three=preg_replace('/[^-_0-9a-zA-Z]/','',$xferconf_three); $xferconf_four=preg_replace('/[^-_0-9a-zA-Z]/','',$xferconf_four); $xferconf_five=preg_replace('/[^-_0-9a-zA-Z]/','',$xferconf_five); - $field_rank = preg_replace('/[^0-9]/','',$field_rank); - $field_size = preg_replace('/[^0-9]/','',$field_size); - $field_max = preg_replace('/[^0-9]/','',$field_max); - $field_order = preg_replace('/[^0-9]/','',$field_order); - $field_required = preg_replace('/[^_A-Z]/','',$field_required); - $field_encrypt = preg_replace('/[^NY]/','',$field_encrypt); - $field_duplicate = preg_replace('/[^_A-Z]/','',$field_duplicate); - $field_type = preg_replace('/[^0-9a-zA-Z]/','',$field_type); - $name_position = preg_replace('/[^0-9a-zA-Z]/','',$name_position); - $multi_position = preg_replace('/[^0-9a-zA-Z]/','',$multi_position); $field_label = preg_replace('/[^_0-9a-zA-Z]/','',$field_label); $field_show_hide = preg_replace('/[^_0-9a-zA-Z]/','',$field_show_hide); $field_name = preg_replace('/[^ \.\,-\_0-9a-zA-Z]/','',$field_name); @@ -956,47 +984,161 @@ if ($non_latin < 1) {$field_options = preg_replace('/[^ \.\n\|\,-\_0-9a-zA-Z]/', '',$field_options);} $field_help = preg_replace('/[^ \'\&\.\n\|\,-\_0-9a-zA-Z]/', '',$field_help); $field_default = preg_replace('/[^ \.\n\,-\_0-9a-zA-Z]/', '',$field_default); - $ingroup_rank = preg_replace('/[^-_0-9]/','',$ingroup_rank); - $ingroup_grade = preg_replace('/[^0-9]/','',$ingroup_grade); $group_id = preg_replace('/[^_0-9a-zA-Z]/','',$group_id); - $ingrp_rg_only = preg_replace('/[^0-9]/','',$ingrp_rg_only); $url_statuses = preg_replace('/[^- 0-9a-zA-Z]/', '',$url_statuses); $url_description = preg_replace('/[^ \.\,-\_0-9a-zA-Z]/','',$url_description); } else { - $user = preg_replace('/[^-_0-9\p{L}]/u',"",$user); - $pass = preg_replace('/[^-_0-9\p{L}]/u',"",$pass); + $status = preg_replace('/[^-_0-9\p{L}]/u','',$status); + $ingroups = preg_replace('/[^-_0-9\p{L}]/u','',$ingroups); + $phone_extension = preg_replace('/[^-_0-9\p{L}]/u','',$phone_extension); + $users=preg_replace('/[^-\,\_0-9\p{L}]/u','',$users); + $statuses = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$statuses); + $categories = preg_replace('/[^-\,\_0-9\p{L}]/u','',$categories); + $user=preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass=preg_replace('/[^-_0-9\p{L}]/u','',$pass); $agent_user=preg_replace('/[^-_0-9\p{L}]/u','',$agent_user); - $source = preg_replace('/[^-_0-9\p{L}]/u',"",$source); - $source_user = preg_replace('/[^-_0-9\p{L}]/u',"",$source_user); - $menu_id = preg_replace('/[^-_0-9\p{L}]/u','',$menu_id); $phone_number = preg_replace('/[^\,0-9]/','',$phone_number); - $vendor_lead_code = preg_replace('/;|#/','',$vendor_lead_code); + $vendor_lead_code = preg_replace('/;|#|\"/','',$vendor_lead_code); $vendor_lead_code = preg_replace('/\+/',' ',$vendor_lead_code); + $source_id = preg_replace('/;|#|\"/','',$source_id); + $source_id = preg_replace('/\+/',' ',$source_id); + $title = preg_replace('/[^- \'\_\.0-9\p{L}]/u','',$title); + $first_name = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$first_name); + $first_name = preg_replace('/\+/',' ',$first_name); + $middle_initial = preg_replace('/[^-_0-9\p{L}]/u','',$middle_initial); + $last_name = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$last_name); + $last_name = preg_replace('/\+/',' ',$last_name); + $address1 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address1); + $address2 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address2); + $address3 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address3); + $address1 = preg_replace('/\+/',' ',$address1); + $address2 = preg_replace('/\+/',' ',$address2); + $address3 = preg_replace('/\+/',' ',$address3); + $city = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$city); + $city = preg_replace('/\+/',' ',$city); + $state = preg_replace('/[^- 0-9\p{L}]/u','',$state); + $province = preg_replace('/[^- \'\+\.\_0-9\p{L}]/u','',$province); + $province = preg_replace('/\+/',' ',$province); + $postal_code = preg_replace('/[^- \'\+0-9\p{L}]/u','',$postal_code); + $postal_code = preg_replace('/\+/',' ',$postal_code); + $country_code = preg_replace('/[^-_0-9\p{L}]/u','',$country_code); + $alt_phone = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$alt_phone); + $alt_phone = preg_replace('/\+/',' ',$alt_phone); + $email = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9\p{L}]/u','',$email); + $email = preg_replace('/\+/',' ',$email); + $security_phrase = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$security_phrase); + $security_phrase = preg_replace('/\+/',' ',$security_phrase); + $comments = preg_replace('/;|#|\"/','',$comments); + $comments = preg_replace('/\+/',' ',$comments); + $campaign_id = preg_replace('/[^-\_0-9\p{L}]/u', '',$campaign_id); + $multi_alt_phones = preg_replace('/[^- \+\!\:\_0-9\p{L}]/u','',$multi_alt_phones); + $multi_alt_phones = preg_replace('/\+/',' ',$multi_alt_phones); + $source = preg_replace('/[^0-9\p{L}]/u','',$source); + $phone_login = preg_replace('/[^-\_0-9\p{L}]/u', '',$phone_login); + $owner = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$owner); + $owner = preg_replace('/\+/',' ',$owner); + $user_field = preg_replace('/[^-_0-9\p{L}]/u','',$user_field); + $voicemail_id=preg_replace('/[^0-9\p{L}]/u','',$voicemail_id); + $agent_pass=preg_replace('/[^-_0-9\p{L}]/u','',$agent_pass); + $agent_full_name=preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$agent_full_name); + $agent_user_group=preg_replace('/[^-_0-9\p{L}]/u','',$agent_user_group); + $phone_pass=preg_replace('/[^-_0-9\p{L}]/u','',$phone_pass); + $custom_one=preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$custom_one); + $custom_two=preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$custom_two); + $custom_three=preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$custom_three); + $custom_four=preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$custom_four); + $custom_five=preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$custom_five); + $extension=preg_replace('/[^-_0-9\p{L}]/u','',$extension); + $dialplan_number=preg_replace('/[^\*\#0-9\p{L}]/u','',$dialplan_number); + $registration_password=preg_replace('/[^-_0-9\p{L}]/u','',$registration_password); + $phone_full_name=preg_replace('/[^- \+\.\_0-9\p{L}]/u','',$phone_full_name); + $outbound_cid=preg_replace('/[^-_0-9\p{L}]/u','',$outbound_cid); + $phone_context=preg_replace('/[^-_0-9\p{L}]/u','',$phone_context); + $list_name=preg_replace('/[^- \+\.\:\/\@\?\&\_0-9\p{L}]/u','',$list_name); + $script=preg_replace('/[^-_0-9\p{L}]/u','',$script); + $am_message=preg_replace('/[^-_0-9\p{L}]/u','',$am_message); + $drop_inbound_group=preg_replace('/[^-_0-9\p{L}]/u','',$drop_inbound_group); + $web_form_address=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9\p{L}]/u','',$web_form_address); + $web_form_address_two=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9\p{L}]/u','',$web_form_address_two); + $web_form_address_three=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9\p{L}]/u','',$web_form_address_three); + $dispo_call_url=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9\p{L}]/u','',$dispo_call_url); + $url_address=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9\p{L}]/u','',$url_address); + $uniqueid=preg_replace('/[^- \.\_0-9\p{L}]/u','',$uniqueid); + $alias_id = preg_replace('/[^-\_0-9\p{L}]/u', '',$alias_id); + $phone_logins = preg_replace('/[^-\,\_0-9\p{L}]/u','',$phone_logins); + $alias_name = preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$alias_name); + $delete_alias = preg_replace('/[^A-Z]/','',$delete_alias); + $callback_status = preg_replace('/[^-\_0-9\p{L}]/u', '',$callback_status); + $callback_user = preg_replace('/[^-\_0-9\p{L}]/u', '',$callback_user); + $callback_comments = preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$callback_comments); + $admin_user_group = preg_replace('/[^-\_0-9\p{L}]/u', '',$admin_user_group); + $group_alias_id = preg_replace('/[^\_0-9\p{L}]/u','',$group_alias_id); + $group_alias_name = preg_replace('/[^- \+\_0-9\p{L}]/u','',$group_alias_name); + $caller_id_number = preg_replace('/[^0-9]/','',$caller_id_number); + $caller_id_name = preg_replace('/[^- \+\_0-9\p{L}]/u','',$caller_id_name); + $user_groups = preg_replace('/[^-\|\,\_0-9\p{L}]/u','',$user_groups); #JCJ + $in_groups = preg_replace('/[^-\|\,\_0-9\p{L}]/u','',$in_groups); #JCJ + $group = preg_replace('/[^-\|\_0-9\p{L}]/u','',$group); + $call_id = preg_replace('/[^0-9\p{L}]/u','',$call_id); + $expiration_date = preg_replace('/[^-_0-9\p{L}]/u','',$expiration_date); + $local_call_time = preg_replace('/[^-_0-9\p{L}]/u','',$local_call_time); + $campaigns = preg_replace('/[^-\,\|\_0-9\p{L}]/u','',$campaigns); # JCJ + $campaign_name = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$campaign_name); + $field_name = preg_replace('/[^-_0-9\p{L}]/u','',$field_name); + $lead_filter_id = preg_replace('/[^-_0-9\p{L}]/u','',$lead_filter_id); + $outbound_alt_cid = preg_replace('/[^0-9\p{L}]/u','',$outbound_alt_cid); + $did_pattern = preg_replace('/[^:\+\*\#\.\_0-9\p{L}]/u','',$did_pattern); + $did_description = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$did_description); + $did_route = preg_replace('/[^-_0-9\p{L}]/u','',$did_route); + $record_call = preg_replace('/[^-_0-9\p{L}]/u','',$record_call); + $exten_context = preg_replace('/[^-_0-9\p{L}]/u','',$exten_context); + $voicemail_ext = preg_replace('/[^\*\#\.\_0-9\p{L}]/u','',$voicemail_ext); + $extension = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$extension); + $filter_clean_cid_number = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$filter_clean_cid_number); + $ignore_agentdirect = preg_replace('/[^A-Z]/','',$ignore_agentdirect); + $areacode = preg_replace('/[^-_0-9\p{L}]/u','',$areacode); + $cid_group_id = preg_replace('/[^-_0-9\p{L}]/u','',$cid_group_id); + $cid_description = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$cid_description); + $custom_fields_copy = preg_replace('/[^0-9]/','',$custom_fields_copy); + if ($outbound_cid != '---ALL---') + {$outbound_cid=preg_replace('/[^0-9]/','',$outbound_cid);} + if ($areacode != '---ALL---') + {$areacode=preg_replace('/[^0-9\p{L}]/u','',$areacode);} + $leads_counts = preg_replace('/[^-_0-9\p{L}]/u','',$leads_counts); + $remove_from_hopper=preg_replace('/[^0-9\p{L}]/u','',$remove_from_hopper); + $list_description=preg_replace('/[^- \+\.\:\/\@\?\&\_0-9\p{L}]/u','',$list_description); + $custom_order = preg_replace('/[^-_0-9\p{L}]/u','',$custom_order); + $custom_copy_method = preg_replace('/[^-_0-9\p{L}]/u','',$custom_copy_method); + $duration = preg_replace('/[^-_0-9\p{L}]/u','',$duration); + $is_webphone = preg_replace('/[^-_0-9\p{L}]/u','',$is_webphone); + $webphone_auto_answer = preg_replace('/[^-_0-9\p{L}]/u','',$webphone_auto_answer); + $use_external_server_ip = preg_replace('/[^-_0-9\p{L}]/u','',$use_external_server_ip); + $template_id = preg_replace('/[^-_0-9\p{L}]/u','',$template_id); + $on_hook_agent = preg_replace('/[^-_0-9\p{L}]/u','',$on_hook_agent); + $delete_did = preg_replace('/[^0-9\p{L}]/u','',$delete_did); + $group_by_campaign = preg_replace('/[^0-9\p{L}]/u','',$group_by_campaign); + $source_user = preg_replace('/[^-_0-9\p{L}]/u','',$source_user); + $menu_id = preg_replace('/[^-_0-9\p{L}]/u','',$menu_id); + $xferconf_one=preg_replace('/[^-_0-9\p{L}]/u','',$xferconf_one); + $xferconf_two=preg_replace('/[^-_0-9\p{L}]/u','',$xferconf_two); + $xferconf_three=preg_replace('/[^-_0-9\p{L}]/u','',$xferconf_three); + $xferconf_four=preg_replace('/[^-_0-9\p{L}]/u','',$xferconf_four); + $xferconf_five=preg_replace('/[^-_0-9\p{L}]/u','',$xferconf_five); + $field_label = preg_replace('/[^_0-9\p{L}]/u','',$field_label); + $field_show_hide = preg_replace('/[^_0-9\p{L}]/u','',$field_show_hide); + $field_name = preg_replace('/[^ \.\,-\_0-9\p{L}]/u','',$field_name); + $field_description = preg_replace('/[^ \.\,-\_0-9\p{L}]/u','',$field_description); + $field_options = preg_replace('/[^ \'\&\.\n\|\,-\_0-9\p{L}]/u', '',$field_options); + if ($field_type != 'SCRIPT') + {$field_options = preg_replace('/[^ \.\n\|\,-\_0-9\p{L}]/u', '',$field_options);} + $field_help = preg_replace('/[^ \'\&\.\n\|\,-\_0-9\p{L}]/u', '',$field_help); + $field_default = preg_replace('/[^ \.\n\,-\_0-9\p{L}]/u', '',$field_default); + $group_id = preg_replace('/[^_0-9\p{L}]/u','',$group_id); $url_statuses = preg_replace('/[^- 0-9\p{L}]/u', '',$url_statuses); $url_description = preg_replace('/[^ \.\,-\_0-9\p{L}]/u','',$url_description); } -$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id); -$list_id_field = preg_replace('/[^0-9]/','',$list_id_field); -$lead_id = preg_replace('/[^0-9]/','',$lead_id); -$lead_ids = preg_replace('/[^\,0-9]/','',$lead_ids); -$list_exists_check = preg_replace('/[^0-9a-zA-Z]/','',$list_exists_check); -$use_internal_webserver = preg_replace('/[^0-9a-zA-Z]/','',$use_internal_webserver); -$field_rerank = preg_replace('/[^_0-9a-zA-Z]/','',$field_rerank); -$custom_fields_add = preg_replace('/[^_0-9a-zA-Z]/','',$custom_fields_add); -$custom_fields_update = preg_replace('/[^_0-9a-zA-Z]/','',$custom_fields_update); -$custom_fields_delete = preg_replace('/[^_0-9a-zA-Z]/','',$custom_fields_delete); -$dialable_count = preg_replace('/[^_0-9a-zA-Z]/','',$dialable_count); -$call_handle_method = preg_replace('/[^_0-9a-zA-Z]/','',$call_handle_method); -$agent_search_method = preg_replace('/[^_0-9a-zA-Z]/','',$agent_search_method); -$delete_cf_data = preg_replace('/[^A-Z]/','',$delete_cf_data); -$entry_type = preg_replace('/[^_0-9a-zA-Z]/','',$entry_type); -$alt_url_id = preg_replace('/[^0-9A-Z]/','',$alt_url_id); -$url_type = preg_replace('/[^_0-9a-zA-Z]/','',$url_type); -$url_rank = preg_replace('/[^0-9]/','',$url_rank); -$url_lists = preg_replace('/[^- 0-9A-Z]/', '',$url_lists); -$url_call_length = preg_replace('/[^0-9]/','',$url_call_length); $USarea = substr($phone_number, 0, 3); $USprefix = substr($phone_number, 3, 3); @@ -12839,7 +12981,7 @@ if ($function == 'lead_search') if (strlen($find_vendor_lead_codeARY[$tc]) > 0) { if ($pc > 0) {$vendor_lead_code_SQL .= ",";} - $vendor_lead_code_SQL .= "'$find_vendor_lead_codeARY[$tc]'"; + $vendor_lead_code_SQL .= "\"$find_vendor_lead_codeARY[$tc]\""; $find_vendor_lead_codeARYx[$pc] = $find_vendor_lead_codeARY[$tc]; $pc++; } diff --git a/agc_2-X/trunk/www/vicidial/remote_dispo.php b/agc_2-X/trunk/www/vicidial/remote_dispo.php index 98cb04d3..c2032523 100644 --- a/agc_2-X/trunk/www/vicidial/remote_dispo.php +++ b/agc_2-X/trunk/www/vicidial/remote_dispo.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # this is the remote agent disposition screen for calls sent to remote agents. # This allows the remote agent to modify customer information and disposition @@ -17,6 +17,7 @@ # 130901-0854 - Changed to mysqli PHP functions # 141007-2137 - Finalized adding QXZ translation to all admin files # 141229-2012 - Added code for on-the-fly language translations display +# 220223-0832 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -48,12 +49,8 @@ if (isset($_GET["comments"])) {$comments=$_GET["comments"];} elseif (isset($_POST["comments"])) {$comments=$_POST["comments"];} if (isset($_GET["country_code"])) {$country_code=$_GET["country_code"];} elseif (isset($_POST["country_code"])) {$country_code=$_POST["country_code"];} -if (isset($_GET["customer_zap_channel"])) {$customer_zap_channel=$_GET["customer_zap_channel"];} - elseif (isset($_POST["customer_zap_channel"])) {$customer_zap_channel=$_POST["customer_zap_channel"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} -if (isset($_GET["dispo"])) {$dispo=$_GET["dispo"];} - elseif (isset($_POST["dispo"])) {$dispo=$_POST["dispo"];} if (isset($_GET["email"])) {$email=$_GET["email"];} elseif (isset($_POST["email"])) {$email=$_POST["email"];} if (isset($_GET["end_call"])) {$end_call=$_GET["end_call"];} @@ -88,18 +85,10 @@ if (isset($_GET["security"])) {$security=$_GET["security"];} elseif (isset($_POST["security"])) {$security=$_POST["security"];} if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];} elseif (isset($_POST["server_ip"])) {$server_ip=$_POST["server_ip"];} -if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];} - elseif (isset($_POST["server_ip"])) {$server_ip=$_POST["server_ip"];} -if (isset($_GET["session_id"])) {$session_id=$_GET["session_id"];} - elseif (isset($_POST["session_id"])) {$session_id=$_POST["session_id"];} if (isset($_GET["state"])) {$state=$_GET["state"];} elseif (isset($_POST["state"])) {$state=$_POST["state"];} if (isset($_GET["status"])) {$status=$_GET["status"];} elseif (isset($_POST["status"])) {$status=$_POST["status"];} -if (isset($_GET["tsr"])) {$tsr=$_GET["tsr"];} - elseif (isset($_POST["tsr"])) {$tsr=$_POST["tsr"];} -if (isset($_GET["user"])) {$user=$_GET["user"];} - elseif (isset($_POST["user"])) {$user=$_POST["user"];} if (isset($_GET["vendor_id"])) {$vendor_id=$_GET["vendor_id"];} elseif (isset($_POST["vendor_id"])) {$vendor_id=$_POST["vendor_id"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} @@ -111,9 +100,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -124,10 +113,26 @@ if ($qm_conf_ct > 0) $user_territories_active = $row[3]; $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; + $SSallow_web_debug = $row[6]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); + +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + } + $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); @@ -138,17 +143,6 @@ $browser = getenv("HTTP_USER_AGENT"); $ext_context = 'demo'; -if ($non_latin < 1) - { - $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); - } -else - { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - } - $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -196,7 +190,7 @@ echo "\n" "; +if ($DB) {echo "";} if ($end_call > 0) { diff --git a/agc_2-X/trunk/www/vicidial/reset_agent_pass.php b/agc_2-X/trunk/www/vicidial/reset_agent_pass.php index 7ccf5a9f..e4541dae 100644 --- a/agc_2-X/trunk/www/vicidial/reset_agent_pass.php +++ b/agc_2-X/trunk/www/vicidial/reset_agent_pass.php @@ -12,6 +12,7 @@ # CHANGES # 201020-2305 - First build # 220124-2250 - Changed to allow user_level 7 users with the proper permissions to use this page +# 220223-0828 - Added allow_web_debug system setting # $startMS = microtime(); @@ -45,9 +46,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,pass_hash_enabled FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,pass_hash_enabled,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -59,10 +60,18 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $SSpass_hash_enabled = $row[6]; + $SSallow_web_debug = $row[7]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$list_id = preg_replace('/[^0-9]/', '', $list_id); +$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -71,15 +80,11 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $reset_agent = preg_replace("/'|\"|\\\\|;/","",$reset_agent); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $reset_agent = preg_replace('/[^-_0-9\p{L}]/u',"",$reset_agent); } -$list_id = preg_replace('/[^0-9]/', '', $list_id); -$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); -$server_ip = preg_replace('/[^-._0-9a-zA-Z]/', '', $server_ip); - $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); diff --git a/agc_2-X/trunk/www/vicidial/reset_campaign_lists.php b/agc_2-X/trunk/www/vicidial/reset_campaign_lists.php index f3abc53e..aed5cc03 100644 --- a/agc_2-X/trunk/www/vicidial/reset_campaign_lists.php +++ b/agc_2-X/trunk/www/vicidial/reset_campaign_lists.php @@ -1,7 +1,7 @@ , Joe Johnson LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell , Joe Johnson LICENSE: AGPLv2 # # CHANGES # 130711-2051 - First build @@ -11,10 +11,11 @@ # 160508-2301 - Added colors features, fixed allowed campaigns bug # 170409-1541 - Added IP List validation code # 180916-1027 - Added per-list daily reset limit +# 220223-0822 - Added allow_web_debug system setting # -$admin_version = '2.14-7'; -$build = '180916-1027'; +$admin_version = '2.14-8'; +$build = '220223-0822'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -26,14 +27,20 @@ $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} +if (isset($_GET["reset_lead_called_campaigns"])) {$reset_lead_called_campaigns=$_GET["reset_lead_called_campaigns"];} + elseif (isset($_POST["reset_lead_called_campaigns"])) {$reset_lead_called_campaigns=$_POST["reset_lead_called_campaigns"];} +if (isset($_GET["all_or_active_only"])) {$all_or_active_only=$_GET["all_or_active_only"];} + elseif (isset($_POST["all_or_active_only"])) {$all_or_active_only=$_POST["all_or_active_only"];} +if (isset($_GET["submit_campaign_reset"])) {$submit_campaign_reset=$_GET["submit_campaign_reset"];} + elseif (isset($_POST["submit_campaign_reset"])) {$submit_campaign_reset=$_POST["submit_campaign_reset"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,allow_emails,hosted_settings,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,allow_emails,hosted_settings,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -50,19 +57,26 @@ if ($qm_conf_ct > 0) $SShosted_settings = $row[9]; $SSenable_languages = $row[10]; $SSlanguage_method = $row[11]; + $SSallow_web_debug = $row[12]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$all_or_active_only = preg_replace('/[^- \_0-9a-zA-Z]/', '', $all_or_active_only); +$submit_campaign_reset = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit_campaign_reset); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $reset_lead_called_campaigns = preg_replace('/[^-_0-9a-zA-Z]/', '', $reset_lead_called_campaigns); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $reset_lead_called_campaigns = preg_replace('/[^-_0-9\p{L}]/u', '', $reset_lead_called_campaigns); } $NOW_DATE = date("Y-m-d"); @@ -225,13 +239,6 @@ if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) } $regexLOGallowed_campaigns = " $LOGallowed_campaigns "; -if (isset($_GET["reset_lead_called_campaigns"])) {$reset_lead_called_campaigns=$_GET["reset_lead_called_campaigns"];} - elseif (isset($_POST["reset_lead_called_campaigns"])) {$reset_lead_called_campaigns=$_POST["reset_lead_called_campaigns"];} -if (isset($_GET["all_or_active_only"])) {$all_or_active_only=$_GET["all_or_active_only"];} - elseif (isset($_POST["all_or_active_only"])) {$all_or_active_only=$_POST["all_or_active_only"];} -if (isset($_GET["submit_campaign_reset"])) {$submit_campaign_reset=$_GET["submit_campaign_reset"];} - elseif (isset($_POST["submit_campaign_reset"])) {$submit_campaign_reset=$_POST["submit_campaign_reset"];} - ?> diff --git a/agc_2-X/trunk/www/vicidial/send_CID_call.php b/agc_2-X/trunk/www/vicidial/send_CID_call.php index c60f9139..3610a37a 100644 --- a/agc_2-X/trunk/www/vicidial/send_CID_call.php +++ b/agc_2-X/trunk/www/vicidial/send_CID_call.php @@ -3,7 +3,7 @@ # # Send calls with custom callerID numbers from web form # -# Copyright (C) 2017 Matt Florell LICENSE: GPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: GPLv2 # # CHANGES # @@ -16,6 +16,7 @@ # 141007-2151 - Finalized adding QXZ translation to all admin files # 141229-2008 - Added code for on-the-fly language translations display # 170409-1533 - Added IP List validation code +# 220223-0820 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -43,9 +44,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -53,10 +54,18 @@ if ($qm_conf_ct > 0) $non_latin = $row[0]; $SSenable_languages = $row[1]; $SSlanguage_method = $row[2]; + $SSallow_web_debug = $row[3]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$sender = preg_replace('/[^0-9]/','',$sender); +$receiver = preg_replace('/[^0-9]/','',$receiver); +$cid_number = preg_replace('/[^0-9]/','',$cid_number); +$server_ip = preg_replace('/[^-\:\.\_0-9a-zA-Z]/','',$server_ip); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -64,13 +73,9 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$sender = preg_replace('/[^0-9]/','',$sender); -$receiver = preg_replace('/[^0-9]/','',$receiver); -$cid_number = preg_replace('/[^0-9]/','',$cid_number); -$server_ip = preg_replace('/[^\.0-9]/','',$server_ip); $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); diff --git a/agc_2-X/trunk/www/vicidial/user_group_bulk_change.php b/agc_2-X/trunk/www/vicidial/user_group_bulk_change.php index 4689ed27..4e49e03a 100644 --- a/agc_2-X/trunk/www/vicidial/user_group_bulk_change.php +++ b/agc_2-X/trunk/www/vicidial/user_group_bulk_change.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # 81119-0918 - First build @@ -20,6 +20,7 @@ # 160325-1429 - Changes for sidebar update # 170217-1213 - Fixed non-latin auth issue #995 # 170409-1553 - Added IP List validation code +# 220223-0815 - Added allow_web_debug system setting # header ("Content-type: text/html; charset=utf-8"); @@ -48,9 +49,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -60,23 +61,30 @@ if ($qm_conf_ct > 0) $SSoutbound_autodial_active = $row[2]; $SSenable_languages = $row[3]; $SSlanguage_method = $row[4]; + $SSallow_web_debug = $row[5]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$stage = preg_replace('/[^-_0-9a-zA-Z]/',"",$stage); +$submit = preg_replace('/[^-_0-9a-zA-Z]/',"",$submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/',"",$SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); + $old_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $old_group); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9\p{L}]/u', '', $group); + $old_group = preg_replace('/[^-_0-9\p{L}]/u', '', $old_group); } -$old_group = preg_replace("/'|\"|\\\\|;/","",$old_group); -$group = preg_replace("/'|\"|\\\\|;/","",$group); -$stage = preg_replace("/'|\"|\\\\|;/","",$stage); $StarTtimE = date("U"); $TODAY = date("Y-m-d"); diff --git a/agc_2-X/trunk/www/vicidial/user_territories.php b/agc_2-X/trunk/www/vicidial/user_territories.php index 691fa0da..9827eb7b 100644 --- a/agc_2-X/trunk/www/vicidial/user_territories.php +++ b/agc_2-X/trunk/www/vicidial/user_territories.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This territories script is for use with custom tables in Vtiger which is why # it is separate from the standard admin.php script. user_territories_active in @@ -24,10 +24,11 @@ # 160508-0211 - Added screen colors feature # 161101-2126 - Fixed missing menu items # 180508-2215 - Added new help display +# 220223-0808 - Added allow_web_debug system setting # -$version = '2.14-16'; -$build = '180508-2215'; +$version = '2.14-17'; +$build = '220223-0808'; $MT[0]=''; @@ -65,9 +66,9 @@ header ("Pragma: no-cache"); // HTTP/1.0 ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,user_territories_active,enable_vtiger_integration,outbound_autodial_active,vtiger_server_ip,vtiger_dbname,vtiger_login,vtiger_pass,vtiger_url,enable_languages,language_method,qc_features_active,user_new_lead_limit FROM system_settings;"; +$stmt = "SELECT use_non_latin,user_territories_active,enable_vtiger_integration,outbound_autodial_active,vtiger_server_ip,vtiger_dbname,vtiger_login,vtiger_pass,vtiger_url,enable_languages,language_method,qc_features_active,user_new_lead_limit,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $ss_conf_ct = mysqli_num_rows($rslt); if ($ss_conf_ct > 0) { @@ -85,7 +86,9 @@ if ($ss_conf_ct > 0) $SSlanguage_method = $row[10]; $SSqc_features_active = $row[11]; $SSuser_new_lead_limit = $row[12]; + $SSallow_web_debug = $row[13]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -95,29 +98,31 @@ if ($user_territories_active < 1) exit; } +### Filter Variable Values ### +$DB = preg_replace('/[^0-9]/','',$DB); +$action = preg_replace('/[^\_0-9a-zA-Z]/','',$action); +$level = preg_replace('/[^\_A-Z]/','',$level); +$batch = preg_replace('/[^-_0-9a-zA-Z]/', '',$batch); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '',$SUBMIT); +$vl_owner = preg_replace('/[^-_0-9a-zA-Z]/', '',$vl_owner); + if ($non_latin < 1) { - ### Clean Variable Values ### - $DB = preg_replace('/[^0-9]/','',$DB); - $action = preg_replace('/[^\_0-9a-zA-Z]/','',$action); + $user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$user); $territory = preg_replace('/[^-\_0-9a-zA-Z]/', '',$territory); $territory_description = preg_replace('/[^- \_\.\,0-9a-zA-Z]/','',$territory_description); - $user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$user); - $level = preg_replace('/[^\_A-Z]/','',$level); $old_territory = preg_replace('/[^-\_0-9a-zA-Z]/', '',$old_territory); $old_user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$old_user); $accountid = preg_replace('/[^-\_0-9a-zA-Z]/', '',$accountid); } else { - $action = preg_replace("/'|\"|\\\\|;/","",$action); - $territory = preg_replace("/'|\"|\\\\|;/","",$territory); - $territory_description = preg_replace("/'|\"|\\\\|;/","",$territory_description); - $user = preg_replace("/'|\"|\\\\|;/","",$user); - $level = preg_replace("/'|\"|\\\\|;/","",$level); - $old_territory = preg_replace("/'|\"|\\\\|;/","",$old_territory); - $old_user = preg_replace("/'|\"|\\\\|;/","",$old_user); - $accountid = preg_replace("/'|\"|\\\\|;/","",$accountid); + $user = preg_replace('/[^-_0-9\p{L}]/u',"",$user); + $territory = preg_replace('/[^-\_0-9\p{L}]/u', '',$territory); + $territory_description = preg_replace('/[^- \_\.\,0-9\p{L}]/u','',$territory_description); + $old_territory = preg_replace('/[^-\_0-9\p{L}]/u', '',$old_territory); + $old_user = preg_replace('/[^-\_0-9\p{L}]/u', '',$old_user); + $accountid = preg_replace('/[^-\_0-9\p{L}]/u', '',$accountid); } if (preg_match("/YES/i",$batch)) @@ -129,8 +134,16 @@ else { $USER=$_SERVER['PHP_AUTH_USER']; $PASS=$_SERVER['PHP_AUTH_PW']; - $USER = preg_replace('/[^-_0-9a-zA-Z]/','',$USER); - $PASS = preg_replace('/[^-_0-9a-zA-Z]/','',$PASS); + if ($non_latin < 1) + { + $USER = preg_replace('/[^-_0-9a-zA-Z]/','',$USER); + $PASS = preg_replace('/[^-_0-9a-zA-Z]/','',$PASS); + } + else + { + $USER = preg_replace('/[^-_0-9\p{L}]/u', '', $USER); + $PASS = preg_replace('/[^-_0-9\p{L}]/u', '', $PASS); + } } $stmt="SELECT selected_language,qc_enabled from vicidial_users where user='$USER';";