Added allow_web_debug system setting for more admin PHP scripts

git-svn-id: svn://192.168.202.10@3571 3d104415-ff17-0410-8863-d5cf3c621b8a

agc_2-X/trunk/www/vicidial/KHOMP_admin.php

@@ -1,11 +1,12 @@
 <?php
 # KHOMP_admin.php - KHOMP carrier definition administration page
 #
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
 #
 # Interface for defining KHOMP codes for the dialer
 #
 # 200210-1604 - First build
+# 220223-1109 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -71,8 +72,6 @@ $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
 $QUERY_STRING = getenv("QUERY_STRING");
 $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
-
-
 if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
 if (isset($_GET["query_date"]))				{$query_date=$_GET["query_date"];}
@@ -109,6 +108,54 @@ $date = date("r");
 $ip = getenv("REMOTE_ADDR");
 $browser = getenv("HTTP_USER_AGENT");
 
+#############################################
+##### START SYSTEM_SETTINGS LOOKUP #####
+$stmt = "SELECT use_non_latin,allow_chats,enable_languages,language_method,default_language,allow_web_debug FROM system_settings;";
+$rslt=mysql_to_mysqli($stmt, $link);
+#if ($DB) {echo "$stmt\n";}
+$qm_conf_ct = mysqli_num_rows($rslt);
+if ($qm_conf_ct > 0)
+	{
+	$row=mysqli_fetch_row($rslt);
+	$non_latin =			$row[0];
+	$SSallow_chats =		$row[1];
+    $SSenable_languages =	$row[2];
+    $SSlanguage_method =	$row[3];
+	$SSdefault_language =	$row[4];
+	$SSallow_web_debug =	$row[5];
+	}
+if ($SSallow_web_debug < 1) {$DB=0;}
+$VUselected_language = $SSdefault_language;
+##### END SETTINGS LOOKUP #####
+###########################################
+
+$query_date = preg_replace("/[^-_0-9a-zA-Z]/", "",$query_date);
+$end_date = preg_replace("/[^-_0-9a-zA-Z]/", "",$end_date);
+$submit_khomp = preg_replace("/[^-_0-9a-zA-Z]/", "",$submit_khomp);
+$new_conclusion=trim(preg_replace('/[^- \_0-9a-zA-Z]/', "", $new_conclusion));
+$new_pattern=trim(preg_replace('/[^- \_0-9a-zA-Z]/', "", $new_pattern));
+$new_action=trim(preg_replace('/[^a-zA-Z]/', "", $new_action));
+$new_status=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $new_status)));
+$new_dialstatus=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $new_dialstatus)));
+$update_action=trim(preg_replace('/[^a-zA-Z]/', "", $update_action));
+$update_status=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $update_status)));
+$update_dialstatus=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $update_dialstatus)));
+$update_conclusion=trim(preg_replace('/[^- \_0-9a-zA-Z]/', "", $update_conclusion));
+$update_pattern=trim(preg_replace('/[^- \_0-9a-zA-Z]/', "", $update_pattern));
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_PW);
+	}	# end of non_latin
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
+
+$auth=0;
+$user_auth=0;
 $auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1,0);
 if ( ($auth_message == 'GOOD') or ($auth_message == '2FA') )
 	{
@@ -138,11 +185,31 @@ if ($user_auth > 0)
 		}
 	}
 
+if ($auth < 1)
+	{
+	$VDdisplayMESSAGE = _QXZ("Login incorrect, please try again");
+	if ($auth_message == 'LOCK')
+		{
+		$VDdisplayMESSAGE = _QXZ("Too many login attempts, try again in 15 minutes");
+		Header ("Content-type: text/html; charset=utf-8");
+		echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
+		exit;
+		}
+	if ($auth_message == 'IPBLOCK')
+		{
+		$VDdisplayMESSAGE = _QXZ("Your IP Address is not allowed") . ": $ip";
+		Header ("Content-type: text/html; charset=utf-8");
+		echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
+		exit;
+		}
+	Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
+	Header("HTTP/1.0 401 Unauthorized");
+	echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
+	exit;
+	}
+
 if ($submit_khomp=="UPDATE") 
 	{
-	$update_action=trim(preg_replace('/[^a-zA-Z]/', "", $update_action));
-	$update_status=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $update_status)));
-	$update_dialstatus=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $update_dialstatus)));
 	if($update_conclusion) 
 		{
 		$update_khomp_string="\"$update_conclusion\"";
@@ -214,12 +281,6 @@ if ($submit_khomp=="UPDATE")
 	} 
 else if ($submit_khomp=="ADD") 
 	{
-	$new_conclusion=trim(preg_replace('/[^- \_0-9a-zA-Z]/', "", $new_conclusion));
-	$new_pattern=trim(preg_replace('/[^- \_0-9a-zA-Z]/', "", $new_pattern));
-	$new_action=trim(preg_replace('/[^a-zA-Z]/', "", $new_action));
-	$new_status=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $new_status)));
-	$new_dialstatus=trim(strtoupper(preg_replace('/[^0-9a-zA-Z]/', "", $new_dialstatus)));
-
 	if($new_conclusion) 
 		{
 		$new_khomp_string="\"$new_conclusion\"";

agc_2-X/trunk/www/vicidial/audio_store.php

@@ -34,10 +34,11 @@
 # 210321-0131 - Added classAudioFile PHP library for WAV file format validation
 # 210322-1220 - Added checking of .wav files for asterisk-compatible format
 # 220120-0927 - Added audio_store_GSM_allowed option. Disable GSM file uploads by default
+# 220222-2348 - Added allow_web_debug system setting
 #
 
-$version = '2.14-26';
+$version = '2.14-27';
-$build = '220120-0927';
+$build = '220222-2348';
 
 $MT[0]='';
 
@@ -91,9 +92,9 @@ header ("Pragma: no-cache");                          // HTTP/1.0
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,sounds_central_control_active,sounds_web_server,sounds_web_directory,outbound_autodial_active,enable_languages,language_method,active_modules,contacts_enabled,allow_emails,qc_features_active FROM system_settings;";
+$stmt = "SELECT use_non_latin,sounds_central_control_active,sounds_web_server,sounds_web_directory,outbound_autodial_active,enable_languages,language_method,active_modules,contacts_enabled,allow_emails,qc_features_active,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $ss_conf_ct = mysqli_num_rows($rslt);
 if ($ss_conf_ct > 0)
 	{
@@ -109,10 +110,39 @@ if ($ss_conf_ct > 0)
 	$SScontacts_enabled =				$row[8];
 	$SSemail_enabled =					$row[9];
 	$SSqc_features_active =				$row[10];
+	$SSallow_web_debug =				$row[11];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT);
+$overwrite = preg_replace('/[^-_0-9a-zA-Z]/','',$overwrite);
+$force_allow = preg_replace('/[^-_0-9a-zA-Z]/','',$force_allow);
+
+# Variables filter further down in the code
+#	$audiofile_name
+
+if ($non_latin < 1)
+	{
+	$delete_file = preg_replace('/[^-\._0-9a-zA-Z]/','',$delete_file);
+	$submit_file = preg_replace('/[^-\._0-9a-zA-Z]/','',$submit_file);
+	$master_audiofile = preg_replace('/[^-\._0-9a-zA-Z]/','',$master_audiofile);
+	$new_audiofile = preg_replace('/[^-\._0-9a-zA-Z]/','',$new_audiofile);
+	$lead_file = preg_replace('/[^-\._0-9a-zA-Z]/','',$lead_file);
+	$audio_server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$audio_server_ip);
+	}
+else
+	{
+	$delete_file = preg_replace('/[^-\._0-9\p{L}]/u','',$delete_file);
+	$submit_file = preg_replace('/[^-\._0-9\p{L}]/u','',$submit_file);
+	$master_audiofile = preg_replace('/[^-\._0-9\p{L}]/u','',$master_audiofile);
+	$new_audiofile = preg_replace('/[^-\._0-9\p{L}]/u','',$new_audiofile);
+	$lead_file = preg_replace('/[^-\._0-9\p{L}]/u','',$lead_file);
+	$audio_server_ip = preg_replace('/[^-\.\:\_0-9\p{L}]/u','',$audio_server_ip);
+	}
+
 ### check if sounds server matches this server IP, if not then exit with an error
 $sounds_web_server = str_replace(array('http://','https://'), '', $sounds_web_server);
 if ( ( ( (strlen($sounds_web_server)) != (strlen($server_name)) ) or (!preg_match("/$sounds_web_server/i",$server_name) ) ) and ($force_allow!='FORCED') )
@@ -177,6 +207,7 @@ if (strlen($audio_server_ip) > 6)
 		{$formIPvalid=1;}
 	}
 $ip = getenv("REMOTE_ADDR");
+
 if ( (!preg_match("/\|$ip\|/", $server_ips)) and ($formIPvalid < 1) )
 	{
 	$user_set=1;
@@ -189,10 +220,9 @@ if ( (!preg_match("/\|$ip\|/", $server_ips)) and ($formIPvalid < 1) )
 		}
 	else
 		{
-		$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+		$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-		$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+		$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 		}
-	$delete_file = preg_replace('/[^-\._0-9a-zA-Z]/','',$delete_file);
 
 	$stmt="SELECT selected_language,qc_enabled from vicidial_users where user='$PHP_AUTH_USER';";
 	if ($DB) {echo "|$stmt|\n";}

agc_2-X/trunk/www/vicidial/force_agent_logout.php

@@ -11,6 +11,7 @@
 # CHANGES
 # 201025-2320 - First build
 # 220124-2127 - Changed to allow user_level 7 users with the proper permissions to use this page
+# 220223-2155 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -27,8 +28,6 @@ $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
 $ip = getenv("REMOTE_ADDR");
 if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
-if (isset($_GET["group"]))				{$group=$_GET["group"];}
-	elseif (isset($_POST["group"]))		{$group=$_POST["group"];}
 if (isset($_GET["logout_agent"]))			{$logout_agent=$_GET["logout_agent"];}
 	elseif (isset($_POST["logout_agent"]))	{$logout_agent=$_POST["logout_agent"];}
 if (isset($_GET["list_id"]))			{$list_id=$_GET["list_id"];}
@@ -44,9 +43,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,pass_hash_enabled FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,pass_hash_enabled,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -58,10 +57,17 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
 	$SSpass_hash_enabled =			$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$list_id = preg_replace('/[^0-9]/', '', $list_id);
+$server_ip = preg_replace('/[^-._0-9a-zA-Z]/', '', $server_ip);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -70,15 +76,11 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
-	$logout_agent = preg_replace("/'|\"|\\\\|;/","",$logout_agent);
+	$logout_agent = preg_replace('/[^-_0-9\p{L}]/u',"",$logout_agent);
 	}
 
-$list_id = preg_replace('/[^0-9]/', '', $list_id);
-$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
-$server_ip = preg_replace('/[^-._0-9a-zA-Z]/', '', $server_ip);
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);

agc_2-X/trunk/www/vicidial/manager_chat_actions.php

@@ -1,7 +1,7 @@
 <?php
 # manager_chat_actions.php
 # 
-# Copyright (C) 2017  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # Contains PHP actions for manager_chat_interface.php - works with vicidial_chat.js
 #
@@ -13,10 +13,11 @@
 # 160108-2300 - Changed some mysqli_query to mysql_to_mysqli for consistency
 # 161217-0821 - Added chat-type to allow for multi-user internal chat sessions
 # 170409-1550 - Added IP List validation code
+# 220223-0934 - Added allow_web_debug system setting
 #
 
-$admin_version = '2.14-7';
+$admin_version = '2.14-8';
-$build = '170409-1550';
+$build = '220223-0934';
 
 $sh="managerchats"; 
 
@@ -48,9 +49,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,allow_chats,enable_languages,language_method,default_language FROM system_settings;";
+$stmt = "SELECT use_non_latin,allow_chats,enable_languages,language_method,default_language,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -60,11 +61,22 @@ if ($qm_conf_ct > 0)
     $SSenable_languages =	$row[2];
     $SSlanguage_method =	$row[3];
 	$SSdefault_language =	$row[4];
+	$SSallow_web_debug =	$row[5];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 $VUselected_language = $SSdefault_language;
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$action = preg_replace("/[^-_0-9a-zA-Z]/", "",$action);
+$manager_chat_id = preg_replace("/[^-_0-9a-zA-Z]/", "",$manager_chat_id);
+$chat_sub_id = preg_replace("/[^-_0-9a-zA-Z]/", "",$chat_sub_id);
+$reload_chat_span = preg_replace("/[^-_0-9a-zA-Z]/", "",$reload_chat_span);
+
+### Variables filtered further down in the code
+# $chat_sub_ids
+# $chat_message
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_USER);
@@ -73,9 +85,9 @@ if ($non_latin < 1)
 	}	# end of non_latin
 else
 	{
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
-	$user = preg_replace("/'|\"|\\\\|;/","",$user);
+	$user = preg_replace('/[^-_0-9\p{L}]/u',"",$user);
 	}
 
 $auth=0;
@@ -191,6 +203,7 @@ if ($action=="CheckEndedChats" && $manager_chat_id) {
 
 if ($action=="PrintSubChatText") {
 	for ($i=0; $i<$chat_sub_id_ct; $i++) {
+		$chat_sub_ids[$i] = preg_replace("/[^-_0-9a-zA-Z]/", "",$chat_sub_ids[$i]);
 		$chat_sub_id=$chat_sub_ids[$i];
 		$span_name="manager_chat_".$manager_chat_id."_".$chat_sub_id;
 

agc_2-X/trunk/www/vicidial/manager_chat_interface.php

@@ -1,7 +1,7 @@
 <?php
 # manager_chat_interface.php
 # 
-# Copyright (C) 2018  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This page is for managers (level 8 or higher) to chat with live agents
 #
@@ -16,10 +16,11 @@
 # 170409-1551 - Added IP List validation code
 # 180508-2215 - Added new help display
 # 210114-1338 - Fixed user group permission bug, Issue #1240
+# 220223-0933 - Added allow_web_debug system setting
 #
 
-$admin_version = '2.14-10';
+$admin_version = '2.14-11';
-$build = '210114-1338';
+$build = '220223-0933';
 
 $sh="managerchats"; 
 
@@ -59,9 +60,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $VUselected_language = '';
-$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,allow_emails,allow_emails,level_8_disable_add,allow_chats,enable_languages,language_method,default_language FROM system_settings;";
+$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,allow_emails,allow_emails,level_8_disable_add,allow_chats,enable_languages,language_method,default_language,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -104,11 +105,27 @@ if ($qm_conf_ct > 0)
     $SSenable_languages =					$row[35];
     $SSlanguage_method =					$row[36];
 	$SSdefault_language =					$row[37];
+	$SSallow_web_debug =					$row[38];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 $VUselected_language = $SSdefault_language;
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$list_id = preg_replace("/[^0-9]/","",$list_id);
+$action = preg_replace("/[^-_0-9a-zA-Z]/", "",$action);
+$SUBMIT = preg_replace("/[^-_0-9a-zA-Z]/", "",$SUBMIT);
+$manager_chat_id = preg_replace("/[^-_0-9a-zA-Z]/", "",$manager_chat_id);
+$allow_replies = preg_replace("/[^-_0-9a-zA-Z]/", "",$allow_replies);
+$end_all_chats = preg_replace("/[^-_0-9a-zA-Z]/", "",$end_all_chats);
+$submit_chat = preg_replace("/[^- \.\_0-9a-zA-Z]/", "",$submit_chat);
+
+### Variables filtered further down in the code
+# $available_chat_agents
+# $available_chat_groups
+# $available_chat_campaigns
+# $manager_message
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_USER);
@@ -116,10 +133,9 @@ if ($non_latin < 1)
 	}	# end of non_latin
 else
 	{
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
-$list_id = preg_replace("/[^0-9]/","",$list_id);
 
 $STARTtime = date("U");
 $TODAY = date("Y-m-d");
@@ -210,6 +226,7 @@ else if ($submit_chat)
 	$chat_agents_SQL_OR="vicidial_live_agents.user in ('',";
 	while($i < $available_chat_agents_ct)
 		{
+		$available_chat_agents[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$available_chat_agents[$i]);
 		$available_chat_agents_string .= "$available_chat_agents[$i]|";
 		$chat_agents_SQL_OR.="'$available_chat_agents[$i]',";
 		$i++;
@@ -223,6 +240,7 @@ else if ($submit_chat)
 	$chat_groups_SQL_OR="vicidial_users.user_group in ('',";
 	while($i < $available_chat_groups_ct)
 		{
+		$available_chat_groups[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$available_chat_groups[$i]);
 		$available_chat_groups_string .= "$available_chat_groups[$i]|";
 		$chat_groups_SQL_OR.="'$available_chat_groups[$i]',";
 		$i++;
@@ -236,6 +254,7 @@ else if ($submit_chat)
 	$chat_campaigns_SQL_OR="vicidial_live_agents.campaign_id in ('',";
 	while($i < $available_chat_campaigns_ct)
 		{
+		$available_chat_campaigns[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$available_chat_campaigns[$i]);
 		$available_chat_campaigns_string .= "$available_chat_campaigns[$i]|";
 		$chat_campaigns_SQL_OR.="'$available_chat_campaigns[$i]',";
 		$i++;

agc_2-X/trunk/www/vicidial/non_agent_api.php

@@ -190,10 +190,11 @@
 # 211217-0733 - Fixes for PHP8, issue #1341
 # 220120-0914 - Added download_invalid_files user function for audio store file listings
 # 220126-2116 - Added dispo_call_url and alt URL options for update_campaign. Added 'update_alt_url' function
+# 220223-0838 - Added allow_web_debug system setting
 #
 
-$version = '2.14-167';
+$version = '2.14-168';
-$build = '220126-2116';
+$build = '220223-0838';
 $php_script='non_agent_api.php';
 $api_url_log = 0;
 
@@ -567,10 +568,6 @@ if (isset($_GET["leads_counts"]))			{$leads_counts=$_GET["leads_counts"];}
 	elseif (isset($_POST["leads_counts"]))	{$leads_counts=$_POST["leads_counts"];}
 if (isset($_GET["remove_from_hopper"]))				{$remove_from_hopper=$_GET["remove_from_hopper"];}
 	elseif (isset($_POST["remove_from_hopper"]))	{$remove_from_hopper=$_POST["remove_from_hopper"];}
-if (isset($_GET["dedupe_statuses"]))				{$dedupe_statuses=$_GET["dedupe_statuses"];}
-	elseif (isset($_POST["dedupe_statuses"]))		{$dedupe_statuses=$_POST["dedupe_statuses"];}
-if (isset($_GET["status_mismatch_action"]))				{$status_mismatch_action=$_GET["status_mismatch_action"];}
-	elseif (isset($_POST["status_mismatch_action"]))	{$status_mismatch_action=$_POST["status_mismatch_action"];}
 if (isset($_GET["custom_order"]))				{$custom_order=$_GET["custom_order"];}
 	elseif (isset($_POST["custom_order"]))		{$custom_order=$_POST["custom_order"];}
 if (isset($_GET["custom_copy_method"]))				{$custom_copy_method=$_GET["custom_copy_method"];}
@@ -629,8 +626,6 @@ if (isset($_GET["field_max"]))					{$field_max=$_GET["field_max"];}
 	elseif (isset($_POST["field_max"]))			{$field_max=$_POST["field_max"];}
 if (isset($_GET["field_default"]))				{$field_default=$_GET["field_default"];}
 	elseif (isset($_POST["field_default"]))		{$field_default=$_POST["field_default"];}
-if (isset($_GET["field_cost"]))					{$field_cost=$_GET["field_cost"];}
-	elseif (isset($_POST["field_cost"]))		{$field_cost=$_POST["field_cost"];}
 if (isset($_GET["field_required"]))				{$field_required=$_GET["field_required"];}
 	elseif (isset($_POST["field_required"]))	{$field_required=$_POST["field_required"];}
 if (isset($_GET["name_position"]))				{$name_position=$_GET["name_position"];}
@@ -693,6 +688,8 @@ if (isset($_GET["url_call_length"]))			{$url_call_length=$_GET["url_call_length"
 	elseif (isset($_POST["url_call_length"]))	{$url_call_length=$_POST["url_call_length"];}
 
 
+$DB=preg_replace('/[^0-9]/','',$DB);
+
 if (file_exists('options.php'))
 	{require('options.php');}
 
@@ -702,7 +699,7 @@ header ("Pragma: no-cache");                          // HTTP/1.0
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,custom_fields_enabled,pass_hash_enabled,agent_whisper_enabled,active_modules,auto_dial_limit,enable_languages,language_method,admin_web_directory,sounds_web_server FROM system_settings;";
+$stmt = "SELECT use_non_latin,custom_fields_enabled,pass_hash_enabled,agent_whisper_enabled,active_modules,auto_dial_limit,enable_languages,language_method,admin_web_directory,sounds_web_server,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
@@ -720,40 +717,142 @@ if ($qm_conf_ct > 0)
 	$SSlanguage_method =		$row[7];
 	$SSadmin_web_directory =	$row[8];
 	$SSsounds_web_server =		$row[9];
+	$SSallow_web_debug =		$row[10];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
-$DB=preg_replace('/[^0-9]/','',$DB);
+$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id);
-
+$list_id_field = preg_replace('/[^0-9]/','',$list_id_field);
-if ($non_latin < 1)
+$lead_id = preg_replace('/[^0-9]/','',$lead_id);
-	{
+$lead_ids = preg_replace('/[^\,0-9]/','',$lead_ids);
-	$users=preg_replace('/[^-_0-9a-zA-Z\,]/','',$users);
+$list_exists_check = preg_replace('/[^0-9a-zA-Z]/','',$list_exists_check);
-	$did_patterns = preg_replace('/[^:\+\*\#\.\_0-9a-zA-Z\,]/','',$did_patterns);
+$use_internal_webserver = preg_replace('/[^0-9a-zA-Z]/','',$use_internal_webserver);
-	$did_ids=preg_replace('/[^0-9\,]/','',$did_ids);
+$field_rerank = preg_replace('/[^_0-9a-zA-Z]/','',$field_rerank);
-	$query_date=preg_replace('/[^-0-9]/','',$query_date);
+$custom_fields_add = preg_replace('/[^_0-9a-zA-Z]/','',$custom_fields_add);
-	$query_time=preg_replace('/[^:0-9]/','',$query_time);
+$custom_fields_update = preg_replace('/[^_0-9a-zA-Z]/','',$custom_fields_update);
-	$end_date=preg_replace('/[^-0-9]/','',$end_date);
+$custom_fields_delete = preg_replace('/[^_0-9a-zA-Z]/','',$custom_fields_delete);
-	$end_time=preg_replace('/[^:0-9]/','',$end_time);
+$dialable_count = preg_replace('/[^_0-9a-zA-Z]/','',$dialable_count);
-	$statuses = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$statuses);
+$call_handle_method = preg_replace('/[^_0-9a-zA-Z]/','',$call_handle_method);
-	$categories = preg_replace('/[^-_0-9a-zA-Z\,]/','',$categories);
+$agent_search_method = preg_replace('/[^_0-9a-zA-Z]/','',$agent_search_method);
+$delete_cf_data = preg_replace('/[^A-Z]/','',$delete_cf_data);
+$entry_type = preg_replace('/[^_0-9a-zA-Z]/','',$entry_type);
+$alt_url_id = preg_replace('/[^0-9A-Z]/','',$alt_url_id);
+$url_type = preg_replace('/[^_0-9a-zA-Z]/','',$url_type);
+$url_rank = preg_replace('/[^0-9]/','',$url_rank);
+$url_lists = preg_replace('/[^- 0-9A-Z]/', '',$url_lists);
+$url_call_length = preg_replace('/[^0-9]/','',$url_call_length);
 $status_breakdown = preg_replace('/[^1Y]/','',$status_breakdown);
 $show_percentages = preg_replace('/[^1Y]/','',$show_percentages);
-
+$function = preg_replace('/[^-_0-9a-zA-Z]/', '',$function);
-	$user=preg_replace('/[^-_0-9a-zA-Z]/','',$user);
-	$pass=preg_replace('/[^-_0-9a-zA-Z]/','',$pass);
-	$agent_user=preg_replace('/[^-_0-9a-zA-Z]/','',$agent_user);
-	$function = preg_replace('/[^-\_0-9a-zA-Z]/', '',$function);
 $format = preg_replace('/[^0-9a-zA-Z]/','',$format);
+$session_id = preg_replace('/[^0-9]/','',$session_id);
+$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
+$stage = preg_replace('/[^-_0-9a-zA-Z]/','',$stage);
+$rank = preg_replace('/[^0-9]/','',$rank);
+$did_ids=preg_replace('/[^\,\+0-9a-zA-Z]/','',$did_ids);
+$did_patterns = preg_replace('/[^\,\:\+\*\#\.\_0-9a-zA-Z]/','',$did_patterns);
+$end_date=preg_replace('/[^-0-9]/','',$end_date);
+$end_time=preg_replace('/[^:0-9]/','',$end_time);
 $entry_list_id = preg_replace('/[^0-9]/','',$entry_list_id);
 $phone_code = preg_replace('/[^0-9]/','',$phone_code);
 $update_phone_number=preg_replace('/[^A-Z]/','',$update_phone_number);
-	$phone_number = preg_replace('/[^\,0-9]/','',$phone_number);
+$date_of_birth = preg_replace('/[^-0-9]/','',$date_of_birth);
-	$vendor_lead_code = preg_replace('/;|#/','',$vendor_lead_code);
+$gender = preg_replace('/[^A-Z]/','',$gender);
-		$vendor_lead_code = preg_replace('/\+/',' ',$vendor_lead_code);
+$dnc_check = preg_replace('/[^A-Z]/','',$dnc_check);
-	$source_id = preg_replace('/;|#/','',$source_id);
+$campaign_dnc_check = preg_replace('/[^A-Z]/','',$campaign_dnc_check);
-		$source_id = preg_replace('/\+/',' ',$source_id);
+$add_to_hopper = preg_replace('/[^A-Z]/','',$add_to_hopper);
+$hopper_priority = preg_replace("/[^-0-9]/", "",$hopper_priority);
+$hopper_local_call_time_check = preg_replace('/[^A-Z]/','',$hopper_local_call_time_check);
+$custom_fields = preg_replace('/[^0-9a-zA-Z]/','',$custom_fields);
+$search_method = preg_replace('/[^-_0-9a-zA-Z]/','',$search_method);
+$duplicate_check = preg_replace('/[^-_0-9a-zA-Z]/','',$duplicate_check);
+$insert_if_not_found = preg_replace('/[^A-Z]/','',$insert_if_not_found);
+$records = preg_replace('/[^0-9]/','',$records);
+$search_location = preg_replace('/[^A-Z]/','',$search_location);
+$no_update = preg_replace('/[^A-Z]/','',$no_update);
+$delete_lead = preg_replace('/[^A-Z]/','',$delete_lead);
+$called_count=preg_replace('/[^0-9]/','',$called_count);
+$agent_user_level=preg_replace('/[^0-9]/','',$agent_user_level);
+$hotkeys_active=preg_replace('/[^0-9]/','',$hotkeys_active);
+$protocol=preg_replace('/[^0-9a-zA-Z]/','',$protocol);
+$local_gmt=preg_replace('/[^-\.0-9]/','',$local_gmt);
+$active=preg_replace('/[^A-Z]/','',$active);
+$reset_list=preg_replace('/[^A-Z]/','',$reset_list);
+$delete_list=preg_replace('/[^A-Z]/','',$delete_list);
+$delete_leads=preg_replace('/[^A-Z]/','',$delete_leads);
+$reset_time=preg_replace('/[^-_0-9]/', '',$reset_time);
+$tz_method = preg_replace('/[^-\_0-9a-zA-Z]/', '',$tz_method);
+$reset_lead = preg_replace('/[^A-Z]/','',$reset_lead);
+$usacan_areacode_check = preg_replace('/[^A-Z]/','',$usacan_areacode_check);
+$usacan_prefix_check = preg_replace('/[^A-Z]/','',$usacan_prefix_check);
+$delete_phone = preg_replace('/[^A-Z]/','',$delete_phone);
+$callback_datetime = preg_replace('/[^- \+\.\:\/\@\_0-9a-zA-Z]/','',$callback_datetime);
+$callback = preg_replace('/[^A-Z]/','',$callback);
+$callback_type = preg_replace('/[^A-Z]/','',$callback_type);
+$datetime_start = preg_replace('/[^- \+\:\_0-9]/','',$datetime_start);
+$datetime_end = preg_replace('/[^- \+\:\_0-9]/','',$datetime_end);
+$time_format = preg_replace('/[^A-Z]/','',$time_format);
+$nanpa_ac_prefix_check = preg_replace('/[^A-Z]/','',$nanpa_ac_prefix_check);
+$delete_user = preg_replace('/[^A-Z]/','',$delete_user);
+$campaign_rank = preg_replace('/[^-_0-9]/','',$campaign_rank);
+$campaign_grade = preg_replace('/[^0-9]/','',$campaign_grade);
+$camp_rg_only = preg_replace('/[^0-9]/','',$camp_rg_only);
+$wrapup_seconds_override = preg_replace('/[^-0-9]/','',$wrapup_seconds_override);
+$show_sub_status = preg_replace('/[^A-Z]/','',$show_sub_status);
+$auto_dial_level = preg_replace('/[^\.0-9]/','',$auto_dial_level);
+$adaptive_maximum_level = preg_replace('/[^\.0-9]/','',$adaptive_maximum_level);
+$campaign_vdad_exten = preg_replace('/[^0-9]/','',$campaign_vdad_exten);
+$hopper_level = preg_replace('/[^0-9]/','',$hopper_level);
+$reset_hopper = preg_replace('/[^NY]/','',$reset_hopper);
+$dial_method = preg_replace('/[^-_0-9a-zA-Z]/','',$dial_method);
+$dial_timeout = preg_replace('/[^0-9]/','',$dial_timeout);
+$lookup_state = preg_replace('/[^A-Z]/','',$lookup_state);
+$detail = preg_replace('/[^A-Z]/','',$detail);
+$type = preg_replace('/[^A-Z]/','',$type);
+$force_entry_list_id = preg_replace('/[^0-9]/','',$force_entry_list_id);
+$file_download = preg_replace('/[^0-9]/','',$file_download);
+$agent_choose_ingroups = preg_replace('/[^0-9]/','',$agent_choose_ingroups);
+$agent_choose_blended = preg_replace('/[^0-9]/','',$agent_choose_blended);
+$closer_default_blended = preg_replace('/[^0-9]/','',$closer_default_blended);
+$phone_ring_timeout = preg_replace('/[^0-9]/','',$phone_ring_timeout);
+$delete_vm_after_email = preg_replace('/[^a-zA-Z]/','',$delete_vm_after_email);
+$field_rank = preg_replace('/[^0-9]/','',$field_rank);
+$field_size = preg_replace('/[^0-9]/','',$field_size);
+$field_max = preg_replace('/[^0-9]/','',$field_max);
+$field_order = preg_replace('/[^0-9]/','',$field_order);
+$field_required = preg_replace('/[^_A-Z]/','',$field_required);
+$field_encrypt = preg_replace('/[^NY]/','',$field_encrypt);
+$field_duplicate = preg_replace('/[^_A-Z]/','',$field_duplicate);
+$field_type = preg_replace('/[^0-9a-zA-Z]/','',$field_type);
+$name_position = preg_replace('/[^0-9a-zA-Z]/','',$name_position);
+$multi_position = preg_replace('/[^0-9a-zA-Z]/','',$multi_position);
+$ingroup_rank = preg_replace('/[^-_0-9]/','',$ingroup_rank);
+$ingroup_grade = preg_replace('/[^0-9]/','',$ingroup_grade);
+$ingrp_rg_only = preg_replace('/[^0-9]/','',$ingrp_rg_only);
+$query_date=preg_replace('/[^-0-9]/','',$query_date);
+$query_time=preg_replace('/[^:0-9]/','',$query_time);
 $gmt_offset_now = preg_replace('/[^-\_\.0-9]/','',$gmt_offset_now);
+$date=preg_replace('/[^-0-9]/','',$date);
+$header = preg_replace('/[^0-9a-zA-Z]/','',$header);
+
+if ($non_latin < 1)
+	{
+	$status = preg_replace('/[^-_0-9a-zA-Z]/','',$status);
+	$ingroups = preg_replace('/[^-_0-9a-zA-Z]/','',$ingroups);
+	$phone_extension = preg_replace('/[^-_0-9a-zA-Z]/','',$phone_extension);
+	$users=preg_replace('/[^-\,\_0-9a-zA-Z]/','',$users);
+	$statuses = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$statuses);
+	$categories = preg_replace('/[^-\,\_0-9a-zA-Z]/','',$categories);
+	$user=preg_replace('/[^-_0-9a-zA-Z]/','',$user);
+	$pass=preg_replace('/[^-_0-9a-zA-Z]/','',$pass);
+	$agent_user=preg_replace('/[^-_0-9a-zA-Z]/','',$agent_user);
+	$phone_number = preg_replace('/[^\,0-9]/','',$phone_number);
+	$vendor_lead_code = preg_replace('/;|#|\"/','',$vendor_lead_code);
+		$vendor_lead_code = preg_replace('/\+/',' ',$vendor_lead_code);
+	$source_id = preg_replace('/;|#|\"/','',$source_id);
+		$source_id = preg_replace('/\+/',' ',$source_id);
 	$title = preg_replace('/[^- \'\_\.0-9a-zA-Z]/','',$title);
 	$first_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$first_name);
 		$first_name = preg_replace('/\+/',' ',$first_name);
@@ -773,46 +872,24 @@ if ($non_latin < 1)
 		$province = preg_replace('/\+/',' ',$province);
 	$postal_code = preg_replace('/[^- \'\+0-9a-zA-Z]/','',$postal_code);
 		$postal_code = preg_replace('/\+/',' ',$postal_code);
-	$country_code = preg_replace('/[^A-Z]/','',$country_code);
+	$country_code = preg_replace('/[^-_0-9a-zA-Z]/','',$country_code);
-	$gender = preg_replace('/[^A-Z]/','',$gender);
-	$date_of_birth = preg_replace('/[^-0-9]/','',$date_of_birth);
 	$alt_phone = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$alt_phone);
 		$alt_phone = preg_replace('/\+/',' ',$alt_phone);
 	$email = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9a-zA-Z]/','',$email);
 		$email = preg_replace('/\+/',' ',$email);
 	$security_phrase = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$security_phrase);
 		$security_phrase = preg_replace('/\+/',' ',$security_phrase);
-	$comments = preg_replace('/;|#/','',$comments);
+	$comments = preg_replace('/;|#|\"/','',$comments);
 		$comments = preg_replace('/\+/',' ',$comments);
-	$dnc_check = preg_replace('/[^A-Z]/','',$dnc_check);
-	$campaign_dnc_check = preg_replace('/[^A-Z]/','',$campaign_dnc_check);
-	$add_to_hopper = preg_replace('/[^A-Z]/','',$add_to_hopper);
-	$hopper_priority = preg_replace("/[^-0-9]/", "",$hopper_priority);
-	$hopper_local_call_time_check = preg_replace('/[^A-Z]/','',$hopper_local_call_time_check);
 	$campaign_id = preg_replace('/[^-\_0-9a-zA-Z]/', '',$campaign_id);
 	$multi_alt_phones = preg_replace('/[^- \+\!\:\_0-9a-zA-Z]/','',$multi_alt_phones);
 		$multi_alt_phones = preg_replace('/\+/',' ',$multi_alt_phones);
 	$source = preg_replace('/[^0-9a-zA-Z]/','',$source);
 	$phone_login = preg_replace('/[^-\_0-9a-zA-Z]/', '',$phone_login);
-	$session_id = preg_replace('/[^0-9]/','',$session_id);
-	$server_ip = preg_replace('/[^\.0-9]/','',$server_ip);
-	$stage = preg_replace('/[^a-zA-Z]/','',$stage);
-	$rank = preg_replace('/[^0-9]/','',$rank);
 	$owner = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$owner);
 		$owner = preg_replace('/\+/',' ',$owner);
-	$duplicate_check = preg_replace('/[^-_0-9a-zA-Z]/','',$duplicate_check);
-	$custom_fields = preg_replace('/[^0-9a-zA-Z]/','',$custom_fields);
-	$search_method = preg_replace('/[^-_0-9a-zA-Z]/','',$search_method);
-	$insert_if_not_found = preg_replace('/[^A-Z]/','',$insert_if_not_found);
-	$records = preg_replace('/[^0-9]/','',$records);
-	$search_location = preg_replace('/[^A-Z]/','',$search_location);
 	$user_field = preg_replace('/[^-_0-9a-zA-Z]/','',$user_field);
-	$no_update = preg_replace('/[^A-Z]/','',$no_update);
+	$voicemail_id=preg_replace('/[^0-9a-zA-Z]/','',$voicemail_id);
-	$delete_lead = preg_replace('/[^A-Z]/','',$delete_lead);
-	$called_count=preg_replace('/[^0-9]/','',$called_count);
-	$agent_user_level=preg_replace('/[^0-9]/','',$agent_user_level);
-	$hotkeys_active=preg_replace('/[^0-9]/','',$hotkeys_active);
-	$voicemail_id=preg_replace('/[^0-9]/','',$voicemail_id);
 	$agent_pass=preg_replace('/[^-_0-9a-zA-Z]/','',$agent_pass);
 	$agent_full_name=preg_replace('/[^- \+\.\:\/\@\_0-9a-zA-Z]/','',$agent_full_name);
 	$agent_user_group=preg_replace('/[^-_0-9a-zA-Z]/','',$agent_user_group);
@@ -824,82 +901,43 @@ if ($non_latin < 1)
 	$custom_five=preg_replace('/[^- \+\.\:\/\@\_0-9a-zA-Z]/','',$custom_five);
 	$extension=preg_replace('/[^-_0-9a-zA-Z]/','',$extension);
 	$dialplan_number=preg_replace('/[^\*\#0-9a-zA-Z]/','',$dialplan_number);
-	$protocol=preg_replace('/[^0-9a-zA-Z]/','',$protocol);
 	$registration_password=preg_replace('/[^-_0-9a-zA-Z]/','',$registration_password);
 	$phone_full_name=preg_replace('/[^- \+\.\_0-9a-zA-Z]/','',$phone_full_name);
-	$local_gmt=preg_replace('/[^-\.0-9]/','',$local_gmt);
 	$outbound_cid=preg_replace('/[^-_0-9a-zA-Z]/','',$outbound_cid);
 	$phone_context=preg_replace('/[^-_0-9a-zA-Z]/','',$phone_context);
 	$list_name=preg_replace('/[^- \+\.\:\/\@\?\&\_0-9a-zA-Z]/','',$list_name);
-	$active=preg_replace('/[^A-Z]/','',$active);
 	$script=preg_replace('/[^-_0-9a-zA-Z]/','',$script);
 	$am_message=preg_replace('/[^-_0-9a-zA-Z]/','',$am_message);
 	$drop_inbound_group=preg_replace('/[^-_0-9a-zA-Z]/','',$drop_inbound_group);
 	$web_form_address=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9a-zA-Z]/','',$web_form_address);
 	$web_form_address_two=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9a-zA-Z]/','',$web_form_address_two);
-	$reset_list=preg_replace('/[^A-Z]/','',$reset_list);
+	$web_form_address_three=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9a-zA-Z]/','',$web_form_address_three);
-	$delete_list=preg_replace('/[^A-Z]/','',$delete_list);
+	$dispo_call_url=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9a-zA-Z]/','',$dispo_call_url);
-	$delete_leads=preg_replace('/[^A-Z]/','',$delete_leads);
+	$url_address=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9a-zA-Z]/','',$url_address);
-	$reset_time=preg_replace('/[^-_0-9]/', '',$reset_time);
 	$uniqueid=preg_replace('/[^- \.\_0-9a-zA-Z]/','',$uniqueid);
-	$tz_method = preg_replace('/[^-\_0-9a-zA-Z]/', '',$tz_method);
-	$reset_lead = preg_replace('/[^A-Z]/','',$reset_lead);
-	$usacan_areacode_check = preg_replace('/[^A-Z]/','',$usacan_areacode_check);
-	$usacan_prefix_check = preg_replace('/[^A-Z]/','',$usacan_prefix_check);
-	$delete_phone = preg_replace('/[^A-Z]/','',$delete_phone);
 	$alias_id = preg_replace('/[^-\_0-9a-zA-Z]/', '',$alias_id);
 	$phone_logins = preg_replace('/[^-\,\_0-9a-zA-Z]/','',$phone_logins);
 	$alias_name = preg_replace('/[^- \+\.\:\/\@\_0-9a-zA-Z]/','',$alias_name);
 	$delete_alias = preg_replace('/[^A-Z]/','',$delete_alias);
-	$callback = preg_replace('/[^A-Z]/','',$callback);
 	$callback_status = preg_replace('/[^-\_0-9a-zA-Z]/', '',$callback_status);
-	$callback_datetime = preg_replace('/[^- \+\.\:\/\@\_0-9a-zA-Z]/','',$callback_datetime);
-	$callback_type = preg_replace('/[^A-Z]/','',$callback_type);
 	$callback_user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$callback_user);
 	$callback_comments = preg_replace('/[^- \+\.\:\/\@\_0-9a-zA-Z]/','',$callback_comments);
 	$admin_user_group = preg_replace('/[^-\_0-9a-zA-Z]/', '',$admin_user_group);
-	$datetime_start = preg_replace('/[^- \+\:\_0-9]/','',$datetime_start);
-	$datetime_end = preg_replace('/[^- \+\:\_0-9]/','',$datetime_end);
-	$time_format = preg_replace('/[^A-Z]/','',$time_format);
 	$group_alias_id = preg_replace('/[^\_0-9a-zA-Z]/','',$group_alias_id);
 	$group_alias_name = preg_replace('/[^- \+\_0-9a-zA-Z]/','',$group_alias_name);
 	$caller_id_number = preg_replace('/[^0-9]/','',$caller_id_number);
 	$caller_id_name = preg_replace('/[^- \+\_0-9a-zA-Z]/','',$caller_id_name);
-	$user_groups = preg_replace('/[^-\|\_0-9a-zA-Z\,]/','',$user_groups); #JCJ
+	$user_groups = preg_replace('/[^-\|\,\_0-9a-zA-Z]/','',$user_groups); #JCJ
-	$in_groups = preg_replace('/[^-\|\_0-9a-zA-Z\,]/','',$in_groups); #JCJ
+	$in_groups = preg_replace('/[^-\|\,\_0-9a-zA-Z]/','',$in_groups); #JCJ
-	$call_id = preg_replace('/[^0-9a-zA-Z]/','',$call_id);
 	$group = preg_replace('/[^-\|\_0-9a-zA-Z]/','',$group);
+	$call_id = preg_replace('/[^0-9a-zA-Z]/','',$call_id);
 	$expiration_date = preg_replace('/[^-_0-9a-zA-Z]/','',$expiration_date);
-	$nanpa_ac_prefix_check = preg_replace('/[^A-Z]/','',$nanpa_ac_prefix_check);
-	$delete_user = preg_replace('/[^A-Z]/','',$delete_user);
-	$campaign_rank = preg_replace('/[^-_0-9]/','',$campaign_rank);
-	$campaign_grade = preg_replace('/[^0-9]/','',$campaign_grade);
 	$local_call_time = preg_replace('/[^-_0-9a-zA-Z]/','',$local_call_time);
-	$camp_rg_only = preg_replace('/[^0-9]/','',$camp_rg_only);
+	$campaigns = preg_replace('/[^-\,\|\_0-9a-zA-Z]/','',$campaigns); # JCJ
-	$wrapup_seconds_override = preg_replace('/[^-0-9]/','',$wrapup_seconds_override);
-	$show_sub_status = preg_replace('/[^A-Z]/','',$show_sub_status);
-	$campaigns = preg_replace('/[^-\|\_0-9a-zA-Z\,]/','',$campaigns); # JCJ
 	$campaign_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$campaign_name);
-	$auto_dial_level = preg_replace('/[^\.0-9]/','',$auto_dial_level);
-	$adaptive_maximum_level = preg_replace('/[^\.0-9]/','',$adaptive_maximum_level);
-	$campaign_vdad_exten = preg_replace('/[^0-9]/','',$campaign_vdad_exten);
-	$hopper_level = preg_replace('/[^0-9]/','',$hopper_level);
-	$reset_hopper = preg_replace('/[^NY]/','',$reset_hopper);
-	$dial_method = preg_replace('/[^-_0-9a-zA-Z]/','',$dial_method);
-	$dial_timeout = preg_replace('/[^0-9]/','',$dial_timeout);
 	$field_name = preg_replace('/[^-_0-9a-zA-Z]/','',$field_name);
-	$lookup_state = preg_replace('/[^A-Z]/','',$lookup_state);
-	$detail = preg_replace('/[^A-Z]/','',$detail);
-	$type = preg_replace('/[^A-Z]/','',$type);
-	$force_entry_list_id = preg_replace('/[^0-9]/','',$force_entry_list_id);
-	$file_download = preg_replace('/[^0-9]/','',$file_download);
 	$lead_filter_id = preg_replace('/[^-_0-9a-zA-Z]/','',$lead_filter_id);
-	$agent_choose_ingroups = preg_replace('/[^0-9]/','',$agent_choose_ingroups);
-	$agent_choose_blended = preg_replace('/[^0-9]/','',$agent_choose_blended);
-	$closer_default_blended = preg_replace('/[^0-9]/','',$closer_default_blended);
 	$outbound_alt_cid = preg_replace('/[^0-9a-zA-Z]/','',$outbound_alt_cid);
-	$phone_ring_timeout = preg_replace('/[^0-9]/','',$phone_ring_timeout);
-	$delete_vm_after_email = preg_replace('/[^a-zA-Z]/','',$delete_vm_after_email);
 	$did_pattern = preg_replace('/[^:\+\*\#\.\_0-9a-zA-Z]/','',$did_pattern);
 	$did_description = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$did_description);
 	$did_route = preg_replace('/[^-_0-9a-zA-Z]/','',$did_route);
@@ -937,16 +975,6 @@ if ($non_latin < 1)
 	$xferconf_three=preg_replace('/[^-_0-9a-zA-Z]/','',$xferconf_three);
 	$xferconf_four=preg_replace('/[^-_0-9a-zA-Z]/','',$xferconf_four);
 	$xferconf_five=preg_replace('/[^-_0-9a-zA-Z]/','',$xferconf_five);
-	$field_rank = preg_replace('/[^0-9]/','',$field_rank);
-	$field_size = preg_replace('/[^0-9]/','',$field_size);
-	$field_max = preg_replace('/[^0-9]/','',$field_max);
-	$field_order = preg_replace('/[^0-9]/','',$field_order);
-	$field_required = preg_replace('/[^_A-Z]/','',$field_required);
-	$field_encrypt = preg_replace('/[^NY]/','',$field_encrypt);
-	$field_duplicate = preg_replace('/[^_A-Z]/','',$field_duplicate);
-	$field_type = preg_replace('/[^0-9a-zA-Z]/','',$field_type);
-	$name_position = preg_replace('/[^0-9a-zA-Z]/','',$name_position);
-	$multi_position = preg_replace('/[^0-9a-zA-Z]/','',$multi_position);
 	$field_label = preg_replace('/[^_0-9a-zA-Z]/','',$field_label);
 	$field_show_hide = preg_replace('/[^_0-9a-zA-Z]/','',$field_show_hide);
 	$field_name = preg_replace('/[^ \.\,-\_0-9a-zA-Z]/','',$field_name);
@@ -956,47 +984,161 @@ if ($non_latin < 1)
 		{$field_options = preg_replace('/[^ \.\n\|\,-\_0-9a-zA-Z]/', '',$field_options);}
 	$field_help = preg_replace('/[^ \'\&\.\n\|\,-\_0-9a-zA-Z]/', '',$field_help);
 	$field_default = preg_replace('/[^ \.\n\,-\_0-9a-zA-Z]/', '',$field_default);
-	$ingroup_rank = preg_replace('/[^-_0-9]/','',$ingroup_rank);
-	$ingroup_grade = preg_replace('/[^0-9]/','',$ingroup_grade);
 	$group_id = preg_replace('/[^_0-9a-zA-Z]/','',$group_id);
-	$ingrp_rg_only = preg_replace('/[^0-9]/','',$ingrp_rg_only);
 	$url_statuses = preg_replace('/[^- 0-9a-zA-Z]/', '',$url_statuses);
 	$url_description = preg_replace('/[^ \.\,-\_0-9a-zA-Z]/','',$url_description);
 	}
 else
 	{
-	$user = preg_replace('/[^-_0-9\p{L}]/u',"",$user);
+	$status = preg_replace('/[^-_0-9\p{L}]/u','',$status);
-	$pass = preg_replace('/[^-_0-9\p{L}]/u',"",$pass);
+	$ingroups = preg_replace('/[^-_0-9\p{L}]/u','',$ingroups);
+	$phone_extension = preg_replace('/[^-_0-9\p{L}]/u','',$phone_extension);
+	$users=preg_replace('/[^-\,\_0-9\p{L}]/u','',$users);
+	$statuses = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$statuses);
+	$categories = preg_replace('/[^-\,\_0-9\p{L}]/u','',$categories);
+	$user=preg_replace('/[^-_0-9\p{L}]/u','',$user);
+	$pass=preg_replace('/[^-_0-9\p{L}]/u','',$pass);
 	$agent_user=preg_replace('/[^-_0-9\p{L}]/u','',$agent_user);
-	$source = preg_replace('/[^-_0-9\p{L}]/u',"",$source);
-	$source_user = preg_replace('/[^-_0-9\p{L}]/u',"",$source_user);
-	$menu_id = preg_replace('/[^-_0-9\p{L}]/u','',$menu_id);
 	$phone_number = preg_replace('/[^\,0-9]/','',$phone_number);
-	$vendor_lead_code = preg_replace('/;|#/','',$vendor_lead_code);
+	$vendor_lead_code = preg_replace('/;|#|\"/','',$vendor_lead_code);
 		$vendor_lead_code = preg_replace('/\+/',' ',$vendor_lead_code);
+	$source_id = preg_replace('/;|#|\"/','',$source_id);
+		$source_id = preg_replace('/\+/',' ',$source_id);
+	$title = preg_replace('/[^- \'\_\.0-9\p{L}]/u','',$title);
+	$first_name = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$first_name);
+		$first_name = preg_replace('/\+/',' ',$first_name);
+	$middle_initial = preg_replace('/[^-_0-9\p{L}]/u','',$middle_initial);
+	$last_name = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$last_name);
+		$last_name = preg_replace('/\+/',' ',$last_name);
+	$address1 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address1);
+	$address2 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address2);
+	$address3 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address3);
+		$address1 = preg_replace('/\+/',' ',$address1);
+		$address2 = preg_replace('/\+/',' ',$address2);
+		$address3 = preg_replace('/\+/',' ',$address3);
+	$city = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$city);
+		$city = preg_replace('/\+/',' ',$city);
+	$state = preg_replace('/[^- 0-9\p{L}]/u','',$state);
+	$province = preg_replace('/[^- \'\+\.\_0-9\p{L}]/u','',$province);
+		$province = preg_replace('/\+/',' ',$province);
+	$postal_code = preg_replace('/[^- \'\+0-9\p{L}]/u','',$postal_code);
+		$postal_code = preg_replace('/\+/',' ',$postal_code);
+	$country_code = preg_replace('/[^-_0-9\p{L}]/u','',$country_code);
+	$alt_phone = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$alt_phone);
+		$alt_phone = preg_replace('/\+/',' ',$alt_phone);
+	$email = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9\p{L}]/u','',$email);
+		$email = preg_replace('/\+/',' ',$email);
+	$security_phrase = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$security_phrase);
+		$security_phrase = preg_replace('/\+/',' ',$security_phrase);
+	$comments = preg_replace('/;|#|\"/','',$comments);
+		$comments = preg_replace('/\+/',' ',$comments);
+	$campaign_id = preg_replace('/[^-\_0-9\p{L}]/u', '',$campaign_id);
+	$multi_alt_phones = preg_replace('/[^- \+\!\:\_0-9\p{L}]/u','',$multi_alt_phones);
+		$multi_alt_phones = preg_replace('/\+/',' ',$multi_alt_phones);
+	$source = preg_replace('/[^0-9\p{L}]/u','',$source);
+	$phone_login = preg_replace('/[^-\_0-9\p{L}]/u', '',$phone_login);
+	$owner = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$owner);
+		$owner = preg_replace('/\+/',' ',$owner);
+	$user_field = preg_replace('/[^-_0-9\p{L}]/u','',$user_field);
+	$voicemail_id=preg_replace('/[^0-9\p{L}]/u','',$voicemail_id);
+	$agent_pass=preg_replace('/[^-_0-9\p{L}]/u','',$agent_pass);
+	$agent_full_name=preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$agent_full_name);
+	$agent_user_group=preg_replace('/[^-_0-9\p{L}]/u','',$agent_user_group);
+	$phone_pass=preg_replace('/[^-_0-9\p{L}]/u','',$phone_pass);
+	$custom_one=preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$custom_one);
+	$custom_two=preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$custom_two);
+	$custom_three=preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$custom_three);
+	$custom_four=preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$custom_four);
+	$custom_five=preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$custom_five);
+	$extension=preg_replace('/[^-_0-9\p{L}]/u','',$extension);
+	$dialplan_number=preg_replace('/[^\*\#0-9\p{L}]/u','',$dialplan_number);
+	$registration_password=preg_replace('/[^-_0-9\p{L}]/u','',$registration_password);
+	$phone_full_name=preg_replace('/[^- \+\.\_0-9\p{L}]/u','',$phone_full_name);
+	$outbound_cid=preg_replace('/[^-_0-9\p{L}]/u','',$outbound_cid);
+	$phone_context=preg_replace('/[^-_0-9\p{L}]/u','',$phone_context);
+	$list_name=preg_replace('/[^- \+\.\:\/\@\?\&\_0-9\p{L}]/u','',$list_name);
+	$script=preg_replace('/[^-_0-9\p{L}]/u','',$script);
+	$am_message=preg_replace('/[^-_0-9\p{L}]/u','',$am_message);
+	$drop_inbound_group=preg_replace('/[^-_0-9\p{L}]/u','',$drop_inbound_group);
+	$web_form_address=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9\p{L}]/u','',$web_form_address);
+	$web_form_address_two=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9\p{L}]/u','',$web_form_address_two);
+	$web_form_address_three=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9\p{L}]/u','',$web_form_address_three);
+	$dispo_call_url=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9\p{L}]/u','',$dispo_call_url);
+	$url_address=preg_replace('/[^- %=\+\.\:\/\@\?\&\_0-9\p{L}]/u','',$url_address);
+	$uniqueid=preg_replace('/[^- \.\_0-9\p{L}]/u','',$uniqueid);
+	$alias_id = preg_replace('/[^-\_0-9\p{L}]/u', '',$alias_id);
+	$phone_logins = preg_replace('/[^-\,\_0-9\p{L}]/u','',$phone_logins);
+	$alias_name = preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$alias_name);
+	$delete_alias = preg_replace('/[^A-Z]/','',$delete_alias);
+	$callback_status = preg_replace('/[^-\_0-9\p{L}]/u', '',$callback_status);
+	$callback_user = preg_replace('/[^-\_0-9\p{L}]/u', '',$callback_user);
+	$callback_comments = preg_replace('/[^- \+\.\:\/\@\_0-9\p{L}]/u','',$callback_comments);
+	$admin_user_group = preg_replace('/[^-\_0-9\p{L}]/u', '',$admin_user_group);
+	$group_alias_id = preg_replace('/[^\_0-9\p{L}]/u','',$group_alias_id);
+	$group_alias_name = preg_replace('/[^- \+\_0-9\p{L}]/u','',$group_alias_name);
+	$caller_id_number = preg_replace('/[^0-9]/','',$caller_id_number);
+	$caller_id_name = preg_replace('/[^- \+\_0-9\p{L}]/u','',$caller_id_name);
+	$user_groups = preg_replace('/[^-\|\,\_0-9\p{L}]/u','',$user_groups); #JCJ
+	$in_groups = preg_replace('/[^-\|\,\_0-9\p{L}]/u','',$in_groups); #JCJ
+	$group = preg_replace('/[^-\|\_0-9\p{L}]/u','',$group);
+	$call_id = preg_replace('/[^0-9\p{L}]/u','',$call_id);
+	$expiration_date = preg_replace('/[^-_0-9\p{L}]/u','',$expiration_date);
+	$local_call_time = preg_replace('/[^-_0-9\p{L}]/u','',$local_call_time);
+	$campaigns = preg_replace('/[^-\,\|\_0-9\p{L}]/u','',$campaigns); # JCJ
+	$campaign_name = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$campaign_name);
+	$field_name = preg_replace('/[^-_0-9\p{L}]/u','',$field_name);
+	$lead_filter_id = preg_replace('/[^-_0-9\p{L}]/u','',$lead_filter_id);
+	$outbound_alt_cid = preg_replace('/[^0-9\p{L}]/u','',$outbound_alt_cid);
+	$did_pattern = preg_replace('/[^:\+\*\#\.\_0-9\p{L}]/u','',$did_pattern);
+	$did_description = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$did_description);
+	$did_route = preg_replace('/[^-_0-9\p{L}]/u','',$did_route);
+	$record_call = preg_replace('/[^-_0-9\p{L}]/u','',$record_call);
+	$exten_context = preg_replace('/[^-_0-9\p{L}]/u','',$exten_context);
+	$voicemail_ext = preg_replace('/[^\*\#\.\_0-9\p{L}]/u','',$voicemail_ext);
+	$extension = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$extension);
+	$filter_clean_cid_number = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$filter_clean_cid_number);
+	$ignore_agentdirect = preg_replace('/[^A-Z]/','',$ignore_agentdirect);
+	$areacode = preg_replace('/[^-_0-9\p{L}]/u','',$areacode);
+	$cid_group_id = preg_replace('/[^-_0-9\p{L}]/u','',$cid_group_id);
+	$cid_description = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$cid_description);
+	$custom_fields_copy = preg_replace('/[^0-9]/','',$custom_fields_copy);
+	if ($outbound_cid != '---ALL---')
+		{$outbound_cid=preg_replace('/[^0-9]/','',$outbound_cid);}
+	if ($areacode != '---ALL---')
+		{$areacode=preg_replace('/[^0-9\p{L}]/u','',$areacode);}
+	$leads_counts = preg_replace('/[^-_0-9\p{L}]/u','',$leads_counts);
+	$remove_from_hopper=preg_replace('/[^0-9\p{L}]/u','',$remove_from_hopper);
+	$list_description=preg_replace('/[^- \+\.\:\/\@\?\&\_0-9\p{L}]/u','',$list_description);
+	$custom_order = preg_replace('/[^-_0-9\p{L}]/u','',$custom_order);
+	$custom_copy_method = preg_replace('/[^-_0-9\p{L}]/u','',$custom_copy_method);
+	$duration = preg_replace('/[^-_0-9\p{L}]/u','',$duration);
+	$is_webphone = preg_replace('/[^-_0-9\p{L}]/u','',$is_webphone);
+	$webphone_auto_answer = preg_replace('/[^-_0-9\p{L}]/u','',$webphone_auto_answer);
+	$use_external_server_ip = preg_replace('/[^-_0-9\p{L}]/u','',$use_external_server_ip);
+	$template_id = preg_replace('/[^-_0-9\p{L}]/u','',$template_id);
+	$on_hook_agent = preg_replace('/[^-_0-9\p{L}]/u','',$on_hook_agent);
+	$delete_did = preg_replace('/[^0-9\p{L}]/u','',$delete_did);
+	$group_by_campaign = preg_replace('/[^0-9\p{L}]/u','',$group_by_campaign);
+	$source_user = preg_replace('/[^-_0-9\p{L}]/u','',$source_user);
+	$menu_id = preg_replace('/[^-_0-9\p{L}]/u','',$menu_id);
+	$xferconf_one=preg_replace('/[^-_0-9\p{L}]/u','',$xferconf_one);
+	$xferconf_two=preg_replace('/[^-_0-9\p{L}]/u','',$xferconf_two);
+	$xferconf_three=preg_replace('/[^-_0-9\p{L}]/u','',$xferconf_three);
+	$xferconf_four=preg_replace('/[^-_0-9\p{L}]/u','',$xferconf_four);
+	$xferconf_five=preg_replace('/[^-_0-9\p{L}]/u','',$xferconf_five);
+	$field_label = preg_replace('/[^_0-9\p{L}]/u','',$field_label);
+	$field_show_hide = preg_replace('/[^_0-9\p{L}]/u','',$field_show_hide);
+	$field_name = preg_replace('/[^ \.\,-\_0-9\p{L}]/u','',$field_name);
+	$field_description = preg_replace('/[^ \.\,-\_0-9\p{L}]/u','',$field_description);
+	$field_options = preg_replace('/[^ \'\&\.\n\|\,-\_0-9\p{L}]/u', '',$field_options);
+	if ($field_type != 'SCRIPT')
+		{$field_options = preg_replace('/[^ \.\n\|\,-\_0-9\p{L}]/u', '',$field_options);}
+	$field_help = preg_replace('/[^ \'\&\.\n\|\,-\_0-9\p{L}]/u', '',$field_help);
+	$field_default = preg_replace('/[^ \.\n\,-\_0-9\p{L}]/u', '',$field_default);
+	$group_id = preg_replace('/[^_0-9\p{L}]/u','',$group_id);
 	$url_statuses = preg_replace('/[^- 0-9\p{L}]/u', '',$url_statuses);
 	$url_description = preg_replace('/[^ \.\,-\_0-9\p{L}]/u','',$url_description);
 	}
-$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id);
-$list_id_field = preg_replace('/[^0-9]/','',$list_id_field);
-$lead_id = preg_replace('/[^0-9]/','',$lead_id);
-$lead_ids = preg_replace('/[^\,0-9]/','',$lead_ids);
-$list_exists_check = preg_replace('/[^0-9a-zA-Z]/','',$list_exists_check);
-$use_internal_webserver = preg_replace('/[^0-9a-zA-Z]/','',$use_internal_webserver);
-$field_rerank = preg_replace('/[^_0-9a-zA-Z]/','',$field_rerank);
-$custom_fields_add = preg_replace('/[^_0-9a-zA-Z]/','',$custom_fields_add);
-$custom_fields_update = preg_replace('/[^_0-9a-zA-Z]/','',$custom_fields_update);
-$custom_fields_delete = preg_replace('/[^_0-9a-zA-Z]/','',$custom_fields_delete);
-$dialable_count = preg_replace('/[^_0-9a-zA-Z]/','',$dialable_count);
-$call_handle_method = preg_replace('/[^_0-9a-zA-Z]/','',$call_handle_method);
-$agent_search_method = preg_replace('/[^_0-9a-zA-Z]/','',$agent_search_method);
-$delete_cf_data = preg_replace('/[^A-Z]/','',$delete_cf_data);
-$entry_type = preg_replace('/[^_0-9a-zA-Z]/','',$entry_type);
-$alt_url_id = preg_replace('/[^0-9A-Z]/','',$alt_url_id);
-$url_type = preg_replace('/[^_0-9a-zA-Z]/','',$url_type);
-$url_rank = preg_replace('/[^0-9]/','',$url_rank);
-$url_lists = preg_replace('/[^- 0-9A-Z]/', '',$url_lists);
-$url_call_length = preg_replace('/[^0-9]/','',$url_call_length);
 
 $USarea = 			substr($phone_number, 0, 3);
 $USprefix = 		substr($phone_number, 3, 3);
@@ -12839,7 +12981,7 @@ if ($function == 'lead_search')
 						if (strlen($find_vendor_lead_codeARY[$tc]) > 0)
 							{
 							if ($pc > 0) {$vendor_lead_code_SQL .= ",";}
-							$vendor_lead_code_SQL .= "'$find_vendor_lead_codeARY[$tc]'";
+							$vendor_lead_code_SQL .= "\"$find_vendor_lead_codeARY[$tc]\"";
 							$find_vendor_lead_codeARYx[$pc] = $find_vendor_lead_codeARY[$tc];
 							$pc++;
 							}

agc_2-X/trunk/www/vicidial/remote_dispo.php

@@ -1,7 +1,7 @@
 <?php
 # remote_dispo.php
 # 
-# Copyright (C) 2014  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # this is the remote agent disposition screen for calls sent to remote agents. 
 # This allows the remote agent to modify customer information and disposition 
@@ -17,6 +17,7 @@
 # 130901-0854 - Changed to mysqli PHP functions
 # 141007-2137 - Finalized adding QXZ translation to all admin files
 # 141229-2012 - Added code for on-the-fly language translations display
+# 220223-0832 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -48,12 +49,8 @@ if (isset($_GET["comments"]))				{$comments=$_GET["comments"];}
 	elseif (isset($_POST["comments"]))		{$comments=$_POST["comments"];}
 if (isset($_GET["country_code"]))				{$country_code=$_GET["country_code"];}
 	elseif (isset($_POST["country_code"]))		{$country_code=$_POST["country_code"];}
-if (isset($_GET["customer_zap_channel"]))				{$customer_zap_channel=$_GET["customer_zap_channel"];}
-	elseif (isset($_POST["customer_zap_channel"]))		{$customer_zap_channel=$_POST["customer_zap_channel"];}
 if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
-if (isset($_GET["dispo"]))				{$dispo=$_GET["dispo"];}
-	elseif (isset($_POST["dispo"]))		{$dispo=$_POST["dispo"];}
 if (isset($_GET["email"]))				{$email=$_GET["email"];}
 	elseif (isset($_POST["email"]))		{$email=$_POST["email"];}
 if (isset($_GET["end_call"]))				{$end_call=$_GET["end_call"];}
@@ -88,18 +85,10 @@ if (isset($_GET["security"]))				{$security=$_GET["security"];}
 	elseif (isset($_POST["security"]))		{$security=$_POST["security"];}
 if (isset($_GET["server_ip"]))				{$server_ip=$_GET["server_ip"];}
 	elseif (isset($_POST["server_ip"]))		{$server_ip=$_POST["server_ip"];}
-if (isset($_GET["server_ip"]))				{$server_ip=$_GET["server_ip"];}
-	elseif (isset($_POST["server_ip"]))		{$server_ip=$_POST["server_ip"];}
-if (isset($_GET["session_id"]))				{$session_id=$_GET["session_id"];}
-	elseif (isset($_POST["session_id"]))		{$session_id=$_POST["session_id"];}
 if (isset($_GET["state"]))				{$state=$_GET["state"];}
 	elseif (isset($_POST["state"]))		{$state=$_POST["state"];}
 if (isset($_GET["status"]))				{$status=$_GET["status"];}
 	elseif (isset($_POST["status"]))		{$status=$_POST["status"];}
-if (isset($_GET["tsr"]))				{$tsr=$_GET["tsr"];}
-	elseif (isset($_POST["tsr"]))		{$tsr=$_POST["tsr"];}
-if (isset($_GET["user"]))				{$user=$_GET["user"];}
-	elseif (isset($_POST["user"]))		{$user=$_POST["user"];}
 if (isset($_GET["vendor_id"]))				{$vendor_id=$_GET["vendor_id"];}
 	elseif (isset($_POST["vendor_id"]))		{$vendor_id=$_POST["vendor_id"];}
 if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
@@ -111,9 +100,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -124,10 +113,26 @@ if ($qm_conf_ct > 0)
 	$user_territories_active =		$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
+
 $STARTtime = date("U");
 $TODAY = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
@@ -138,17 +143,6 @@ $browser = getenv("HTTP_USER_AGENT");
 
 $ext_context = 'demo';
 
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -196,7 +190,7 @@ echo "<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n"
 
 <?php 
 
-echo "<!-- $call_began $lead_id -->";
+if ($DB) {echo "<!-- $call_began $lead_id -->";}
 
 if ($end_call > 0)
 	{

agc_2-X/trunk/www/vicidial/reset_agent_pass.php

@@ -12,6 +12,7 @@
 # CHANGES
 # 201020-2305 - First build
 # 220124-2250 - Changed to allow user_level 7 users with the proper permissions to use this page
+# 220223-0828 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -45,9 +46,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,pass_hash_enabled FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,pass_hash_enabled,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -59,10 +60,18 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
 	$SSpass_hash_enabled =			$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$list_id = preg_replace('/[^0-9]/', '', $list_id);
+$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -71,15 +80,11 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
-	$reset_agent = preg_replace("/'|\"|\\\\|;/","",$reset_agent);
+	$reset_agent = preg_replace('/[^-_0-9\p{L}]/u',"",$reset_agent);
 	}
 
-$list_id = preg_replace('/[^0-9]/', '', $list_id);
-$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
-$server_ip = preg_replace('/[^-._0-9a-zA-Z]/', '', $server_ip);
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);

agc_2-X/trunk/www/vicidial/reset_campaign_lists.php

@@ -1,7 +1,7 @@
 <?php
 # reset_campaign_lists.php - VICIDIAL administration page
 #
-# Copyright (C) 2018  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 130711-2051 - First build
@@ -11,10 +11,11 @@
 # 160508-2301 - Added colors features, fixed allowed campaigns bug
 # 170409-1541 - Added IP List validation code
 # 180916-1027 - Added per-list daily reset limit
+# 220223-0822 - Added allow_web_debug system setting
 #
 
-$admin_version = '2.14-7';
+$admin_version = '2.14-8';
-$build = '180916-1027';
+$build = '220223-0822';
 
 require("dbconnect_mysqli.php");
 require("functions.php");
@@ -26,14 +27,20 @@ $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
 if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
+if (isset($_GET["reset_lead_called_campaigns"]))			{$reset_lead_called_campaigns=$_GET["reset_lead_called_campaigns"];}
+	elseif (isset($_POST["reset_lead_called_campaigns"]))	{$reset_lead_called_campaigns=$_POST["reset_lead_called_campaigns"];}
+if (isset($_GET["all_or_active_only"]))			{$all_or_active_only=$_GET["all_or_active_only"];}
+	elseif (isset($_POST["all_or_active_only"]))	{$all_or_active_only=$_POST["all_or_active_only"];}
+if (isset($_GET["submit_campaign_reset"]))			{$submit_campaign_reset=$_GET["submit_campaign_reset"];}
+	elseif (isset($_POST["submit_campaign_reset"]))	{$submit_campaign_reset=$_POST["submit_campaign_reset"];}
 
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,allow_emails,hosted_settings,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,allow_emails,hosted_settings,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -50,19 +57,26 @@ if ($qm_conf_ct > 0)
 	$SShosted_settings =			$row[9];
 	$SSenable_languages =			$row[10];
 	$SSlanguage_method =			$row[11];
+	$SSallow_web_debug =			$row[12];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$all_or_active_only = preg_replace('/[^- \_0-9a-zA-Z]/', '', $all_or_active_only);
+$submit_campaign_reset = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit_campaign_reset);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$reset_lead_called_campaigns = preg_replace('/[^-_0-9a-zA-Z]/', '', $reset_lead_called_campaigns);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$reset_lead_called_campaigns = preg_replace('/[^-_0-9\p{L}]/u', '', $reset_lead_called_campaigns);
 	}
 
 $NOW_DATE = date("Y-m-d");
@@ -225,13 +239,6 @@ if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) )
 	}
 $regexLOGallowed_campaigns = " $LOGallowed_campaigns ";
 
-if (isset($_GET["reset_lead_called_campaigns"]))			{$reset_lead_called_campaigns=$_GET["reset_lead_called_campaigns"];}
-	elseif (isset($_POST["reset_lead_called_campaigns"]))	{$reset_lead_called_campaigns=$_POST["reset_lead_called_campaigns"];}
-if (isset($_GET["all_or_active_only"]))			{$all_or_active_only=$_GET["all_or_active_only"];}
-	elseif (isset($_POST["all_or_active_only"]))	{$all_or_active_only=$_POST["all_or_active_only"];}
-if (isset($_GET["submit_campaign_reset"]))			{$submit_campaign_reset=$_GET["submit_campaign_reset"];}
-	elseif (isset($_POST["submit_campaign_reset"]))	{$submit_campaign_reset=$_POST["submit_campaign_reset"];}
-
 ?>
 
 <html>

agc_2-X/trunk/www/vicidial/send_CID_call.php

@@ -3,7 +3,7 @@
 #
 # Send calls with custom callerID numbers from web form
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: GPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: GPLv2
 #
 # CHANGES
 #
@@ -16,6 +16,7 @@
 # 141007-2151 - Finalized adding QXZ translation to all admin files
 # 141229-2008 - Added code for on-the-fly language translations display
 # 170409-1533 - Added IP List validation code
+# 220223-0820 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -43,9 +44,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -53,10 +54,18 @@ if ($qm_conf_ct > 0)
 	$non_latin =				$row[0];
 	$SSenable_languages =		$row[1];
 	$SSlanguage_method =		$row[2];
+	$SSallow_web_debug =		$row[3];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$sender = preg_replace('/[^0-9]/','',$sender);
+$receiver = preg_replace('/[^0-9]/','',$receiver);
+$cid_number = preg_replace('/[^0-9]/','',$cid_number);
+$server_ip = preg_replace('/[^-\:\.\_0-9a-zA-Z]/','',$server_ip);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -64,13 +73,9 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
-$sender = preg_replace('/[^0-9]/','',$sender);
-$receiver = preg_replace('/[^0-9]/','',$receiver);
-$cid_number = preg_replace('/[^0-9]/','',$cid_number);
-$server_ip = preg_replace('/[^\.0-9]/','',$server_ip);
 
 $NOW_DATE = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");

agc_2-X/trunk/www/vicidial/user_group_bulk_change.php

@@ -1,7 +1,7 @@
 <?php
 # user_group_bulk_change.php
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 81119-0918 - First build
@@ -20,6 +20,7 @@
 # 160325-1429 - Changes for sidebar update
 # 170217-1213 - Fixed non-latin auth issue #995
 # 170409-1553 - Added IP List validation code
+# 220223-0815 - Added allow_web_debug system setting
 #
 
 header ("Content-type: text/html; charset=utf-8");
@@ -48,9 +49,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -60,23 +61,30 @@ if ($qm_conf_ct > 0)
 	$SSoutbound_autodial_active =	$row[2];
 	$SSenable_languages =			$row[3];
 	$SSlanguage_method =			$row[4];
+	$SSallow_web_debug =			$row[5];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$stage = preg_replace('/[^-_0-9a-zA-Z]/',"",$stage);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/',"",$submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/',"",$SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
+	$old_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $old_group);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$group = preg_replace('/[^-_0-9\p{L}]/u', '', $group);
+	$old_group = preg_replace('/[^-_0-9\p{L}]/u', '', $old_group);
 	}
-$old_group = preg_replace("/'|\"|\\\\|;/","",$old_group);
-$group = preg_replace("/'|\"|\\\\|;/","",$group);
-$stage = preg_replace("/'|\"|\\\\|;/","",$stage);
 
 $StarTtimE = date("U");
 $TODAY = date("Y-m-d");

agc_2-X/trunk/www/vicidial/user_territories.php

@@ -1,7 +1,7 @@
 <?php
 # user_territories.php
 # 
-# Copyright (C) 2018  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This territories script is for use with custom tables in Vtiger which is why
 # it is separate from the standard admin.php script. user_territories_active in
@@ -24,10 +24,11 @@
 # 160508-0211 - Added screen colors feature
 # 161101-2126 - Fixed missing menu items
 # 180508-2215 - Added new help display
+# 220223-0808 - Added allow_web_debug system setting
 #
 
-$version = '2.14-16';
+$version = '2.14-17';
-$build = '180508-2215';
+$build = '220223-0808';
 
 $MT[0]='';
 
@@ -65,9 +66,9 @@ header ("Pragma: no-cache");                          // HTTP/1.0
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,user_territories_active,enable_vtiger_integration,outbound_autodial_active,vtiger_server_ip,vtiger_dbname,vtiger_login,vtiger_pass,vtiger_url,enable_languages,language_method,qc_features_active,user_new_lead_limit FROM system_settings;";
+$stmt = "SELECT use_non_latin,user_territories_active,enable_vtiger_integration,outbound_autodial_active,vtiger_server_ip,vtiger_dbname,vtiger_login,vtiger_pass,vtiger_url,enable_languages,language_method,qc_features_active,user_new_lead_limit,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $ss_conf_ct = mysqli_num_rows($rslt);
 if ($ss_conf_ct > 0)
 	{
@@ -85,7 +86,9 @@ if ($ss_conf_ct > 0)
 	$SSlanguage_method =				$row[10];
 	$SSqc_features_active =				$row[11];
 	$SSuser_new_lead_limit =			$row[12];
+	$SSallow_web_debug =				$row[13];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
@@ -95,29 +98,31 @@ if ($user_territories_active < 1)
 	exit;
 	}
 
-if ($non_latin < 1)
+### Filter Variable Values ###
-	{
-	### Clean Variable Values ###
 $DB = preg_replace('/[^0-9]/','',$DB);
 $action = preg_replace('/[^\_0-9a-zA-Z]/','',$action);
+$level = preg_replace('/[^\_A-Z]/','',$level);
+$batch = preg_replace('/[^-_0-9a-zA-Z]/', '',$batch);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '',$SUBMIT);
+$vl_owner = preg_replace('/[^-_0-9a-zA-Z]/', '',$vl_owner);
+
+if ($non_latin < 1)
+	{
+	$user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$user);
 	$territory = preg_replace('/[^-\_0-9a-zA-Z]/', '',$territory);
 	$territory_description = preg_replace('/[^- \_\.\,0-9a-zA-Z]/','',$territory_description);
-	$user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$user);
-	$level = preg_replace('/[^\_A-Z]/','',$level);
 	$old_territory = preg_replace('/[^-\_0-9a-zA-Z]/', '',$old_territory);
 	$old_user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$old_user);
 	$accountid = preg_replace('/[^-\_0-9a-zA-Z]/', '',$accountid);
 	}
 else
 	{
-	$action = preg_replace("/'|\"|\\\\|;/","",$action);
+	$user = preg_replace('/[^-_0-9\p{L}]/u',"",$user);
-	$territory = preg_replace("/'|\"|\\\\|;/","",$territory);
+	$territory = preg_replace('/[^-\_0-9\p{L}]/u', '',$territory);
-	$territory_description = preg_replace("/'|\"|\\\\|;/","",$territory_description);
+	$territory_description = preg_replace('/[^- \_\.\,0-9\p{L}]/u','',$territory_description);
-	$user = preg_replace("/'|\"|\\\\|;/","",$user);
+	$old_territory = preg_replace('/[^-\_0-9\p{L}]/u', '',$old_territory);
-	$level = preg_replace("/'|\"|\\\\|;/","",$level);
+	$old_user = preg_replace('/[^-\_0-9\p{L}]/u', '',$old_user);
-	$old_territory = preg_replace("/'|\"|\\\\|;/","",$old_territory);
+	$accountid = preg_replace('/[^-\_0-9\p{L}]/u', '',$accountid);
-	$old_user = preg_replace("/'|\"|\\\\|;/","",$old_user);
-	$accountid = preg_replace("/'|\"|\\\\|;/","",$accountid);
 	}
 
 if (preg_match("/YES/i",$batch))
@@ -129,9 +134,17 @@ else
 	{
 	$USER=$_SERVER['PHP_AUTH_USER'];
 	$PASS=$_SERVER['PHP_AUTH_PW'];
+	if ($non_latin < 1)
+		{
 		$USER = preg_replace('/[^-_0-9a-zA-Z]/','',$USER);
 		$PASS = preg_replace('/[^-_0-9a-zA-Z]/','',$PASS);
 		}
+	else
+		{
+		$USER = preg_replace('/[^-_0-9\p{L}]/u', '', $USER);
+		$PASS = preg_replace('/[^-_0-9\p{L}]/u', '', $PASS);
+		}
+	}
 
 $stmt="SELECT selected_language,qc_enabled from vicidial_users where user='$USER';";
 if ($DB) {echo "|$stmt|\n";}