diff --git a/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php b/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php index 7306d3d2..20b3babf 100644 --- a/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php +++ b/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell,Joe Johnson LICENSE: AGPLv2 # # CHANGES # 120402-2132 - First Build @@ -18,6 +18,7 @@ # 180503-2215 - Added new help display # 180927-0633 - Fix for deleted template function in alternate language, issue #1127 # 210312-1700 - Added layout editing functionality +# 220222-1100 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -51,7 +52,7 @@ if (isset($_GET["submit_template"])) {$submit_template=$_GET["submit_template elseif (isset($_POST["submit_template"])) {$submit_template=$_POST["submit_template"];} if (isset($_GET["submit_edited_template"])) {$submit_edited_template=$_GET["submit_edited_template"];} elseif (isset($_POST["submit_edited_template"])) {$submit_edited_template=$_POST["submit_edited_template"];} -if (isset($_GET["edit_standard_fields_layout"])) {$edit_standard_fields_layout=$_GET["edit_standard_fields_layout"];} +if (isset($_GET["edit_standard_fields_layout"])) {$edit_standard_fields_layout=$_GET["edit_standard_fields_layout"];} elseif (isset($_POST["edit_standard_fields_layout"])) {$edit_standard_fields_layout=$_POST["edit_standard_fields_layout"];} if (isset($_GET["edit_custom_fields_layout"])) {$edit_custom_fields_layout=$_GET["edit_custom_fields_layout"];} elseif (isset($_POST["edit_custom_fields_layout"])) {$edit_custom_fields_layout=$_POST["edit_custom_fields_layout"];} @@ -71,9 +72,9 @@ $vicidial_listloader_fields = '|vendor_lead_code|source_id|phone_code|phone_numb $US='_'; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method,admin_screen_colors FROM system_settings;"; +$stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method,admin_screen_colors,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -85,10 +86,31 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $SSadmin_screen_colors = $row[6]; + $SSallow_web_debug = $row[7]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$list_id_override = preg_replace('/[^0-9]/','',$list_id_override); +$template_list_id = preg_replace('/[^0-9]/','',$template_list_id); +$template_id = preg_replace("/\<|\>|'|\"|\\\\|;/","",$template_id); +$template_name = preg_replace("/\<|\>|'|\"|\\\\|;/","",$template_name); +$template_description = preg_replace("/\<|\>|'|\"|\\\\|;/","",$template_description); +$standard_fields_layout = preg_replace("/\<|\>|'|\"|\\\\|;/","",$standard_fields_layout); +$custom_table = preg_replace("/\<|\>|'|\"|\\\\|;/","",$custom_table); +$custom_fields_layout = preg_replace("/\<|\>|'|\"|\\\\|;/","",$custom_fields_layout); +$edit_standard_fields_layout = preg_replace("/\<|\>|'|\"|\\\\|;/","",$edit_standard_fields_layout); +$edit_custom_fields_layout = preg_replace("/\<|\>|'|\"|\\\\|;/","",$edit_custom_fields_layout); +$delete_template = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $delete_template); +$submit_template = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $submit_template); +$submit_edited_template = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $submit_edited_template); +$file_format = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$file_format); +$file_delimiter = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$file_delimiter); + +# Variables filtered further down in the code +# $template_statuses + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -96,19 +118,9 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$list_id_override = preg_replace('/[^0-9]/','',$list_id_override); -$template_list_id = preg_replace('/[^0-9]/','',$template_list_id); -$template_id = preg_replace("/'|\"|\\\\|;/","",$template_id); -$template_name = preg_replace("/'|\"|\\\\|;/","",$template_name); -$template_description = preg_replace("/'|\"|\\\\|;/","",$template_description); -$standard_fields_layout = preg_replace("/'|\"|\\\\|;/","",$standard_fields_layout); -$custom_table = preg_replace("/'|\"|\\\\|;/","",$custom_table); -$custom_fields_layout = preg_replace("/'|\"|\\\\|;/","",$custom_fields_layout); -$edit_standard_fields_layout = preg_replace("/'|\"|\\\\|;/","",$edit_standard_fields_layout); -$edit_custom_fields_layout = preg_replace("/'|\"|\\\\|;/","",$edit_custom_fields_layout); if ($submit_edited_template) { @@ -197,11 +209,14 @@ if ($submit_template==_QXZ("SUBMIT TEMPLATE") && $template_id && $template_name $status_str=""; $status_count=count($template_statuses); - for ($q=0; $q\n"; + for ($q=0; $q|\'|\"|\\\\|;/",'',$template_statuses[$q]); + + echo "\n"; $status_str.="$template_statuses[$q]|"; - } + } echo ""; $status_str=preg_replace('/\|$/', '', $status_str); if (preg_match('/\-\-ALL\-\-/', $status_str)) {$status_str="";} diff --git a/agc_2-X/trunk/www/vicidial/AST_rt_whiteboard_rpt.php b/agc_2-X/trunk/www/vicidial/AST_rt_whiteboard_rpt.php index eac1968c..aa772d31 100644 --- a/agc_2-X/trunk/www/vicidial/AST_rt_whiteboard_rpt.php +++ b/agc_2-X/trunk/www/vicidial/AST_rt_whiteboard_rpt.php @@ -1,7 +1,7 @@ , Joe Johnson LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell , Joe Johnson LICENSE: AGPLv2 # # Real-time report that allows users to create a customized, graphical display of various data sets # @@ -11,6 +11,7 @@ # 180512-0000 - Fixed slave server capability # 190927-1758 - Fixed PHP7 array issue # 210827-1818 - Fix for security issue +# 220221-1505 - Added allow_web_debug system setting # $startMS = microtime(); @@ -56,6 +57,12 @@ if (isset($_GET["DB"])) {$DB=$_GET["DB"];} if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];} +if (!$query_date) {$query_date=date("Y-m-d");} +if (!$end_date) {$end_date=date("Y-m-d");} +if (!$query_time) {$query_time="08:00:00";} +if (!$end_time) {$end_time="17:00:00";} +if (strlen($shift)<2) {$shift='ALL';} + $query_date = preg_replace('/[^-0-9]/','',$query_date); $end_date = preg_replace('/[^-0-9]/','',$end_date); $query_time=preg_replace("/[^0-9\:]/", "", $query_time); @@ -71,19 +78,13 @@ $SUBMIT=preg_replace('/[^-_0-9\p{L}]/u','',$SUBMIT); $DB = preg_replace('/[^0-9]/','',$DB); $report_display_type=preg_replace('/[^_\p{L}]/u','',$report_display_type); -if (!$query_date) {$query_date=date("Y-m-d");} -if (!$end_date) {$end_date=date("Y-m-d");} -if (!$query_time) {$query_time="08:00:00";} -if (!$end_time) {$end_time="17:00:00";} - -if (strlen($shift)<2) {$shift='ALL';} $report_name="Real-Time Whiteboard Report"; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,admin_screen_colors FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,admin_screen_colors,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {$MAIN.="$stmt\n";} +#if ($DB) {$MAIN.="$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -95,10 +96,23 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $admin_screen_colors = $row[6]; + $SSallow_web_debug = $row[7]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + } + if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) ) { mysqli_close($link); @@ -120,17 +134,6 @@ if ($gmt_conf_ct > 0) $epoch_offset = (($local_gmt + $dst) * 3600); } -if ($non_latin < 1) - { - $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); - } -else - { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - } - $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); diff --git a/agc_2-X/trunk/www/vicidial/AST_rt_whiteboard_rpt_mobile.php b/agc_2-X/trunk/www/vicidial/AST_rt_whiteboard_rpt_mobile.php index a4dc6a08..587adf42 100644 --- a/agc_2-X/trunk/www/vicidial/AST_rt_whiteboard_rpt_mobile.php +++ b/agc_2-X/trunk/www/vicidial/AST_rt_whiteboard_rpt_mobile.php @@ -1,13 +1,14 @@ , Joe Johnson LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell , Joe Johnson LICENSE: AGPLv2 # # Mobile version of real-time report that allows users to create a customized, graphical display of various data sets # # 190227-1259 - Initial build # 200309-1819 - Modifications for display formatting # 210827-1818 - Fix for security issue +# 220221-1513 - Added allow_web_debug system setting # $startMS = microtime(); @@ -78,9 +79,9 @@ $report_name="Real-Time Whiteboard Report"; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,admin_screen_colors FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,admin_screen_colors,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {$MAIN.="$stmt\n";} +#if ($DB) {$MAIN.="$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -92,10 +93,23 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $admin_screen_colors = $row[6]; + $SSallow_web_debug = $row[7]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + } + if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) ) { mysqli_close($link); @@ -117,17 +131,6 @@ if ($gmt_conf_ct > 0) $epoch_offset = (($local_gmt + $dst) * 3600); } -if ($non_latin < 1) - { - $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); - } -else - { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - } - $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); diff --git a/agc_2-X/trunk/www/vicidial/AST_timeonVDADall.php b/agc_2-X/trunk/www/vicidial/AST_timeonVDADall.php index 441ec2a5..726a8797 100644 --- a/agc_2-X/trunk/www/vicidial/AST_timeonVDADall.php +++ b/agc_2-X/trunk/www/vicidial/AST_timeonVDADall.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # live real-time stats for the VICIDIAL Auto-Dialer all servers # @@ -126,10 +126,11 @@ # 210618-1011 - Added CORS support # 210625-1432 - Added options.php RS_BargeSwap variable # 220217-2045 - Added input variable filters +# 220221-1535 - Added allow_web_debug system setting # -$version = '2.14-111'; -$build = '220217-2045'; +$version = '2.14-112'; +$build = '220221-1536'; $php_script='AST_timeonVDADall.php'; require("dbconnect_mysqli.php"); @@ -270,9 +271,9 @@ $db_source = 'M'; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,allow_chats,cache_carrier_stats_realtime,report_default_format,ofcom_uk_drop_calc,enable_pause_code_limits,timeclock_end_of_day FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,allow_chats,cache_carrier_stats_realtime,report_default_format,ofcom_uk_drop_calc,enable_pause_code_limits,timeclock_end_of_day,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -290,7 +291,9 @@ if ($qm_conf_ct > 0) $SSofcom_uk_drop_calc = $row[10]; $SSenable_pause_code_limits = $row[11]; $SStimeclock_end_of_day = $row[12]; + $SSallow_web_debug = $row[13]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) ) @@ -413,8 +416,8 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } $RR = preg_replace('/[^0-9]/', '', $RR); $inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $inbound); @@ -457,6 +460,10 @@ $server_ip = preg_replace('/[^-\._0-9a-zA-Z]/', '', $server_ip); $SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); $submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +# Variables filtered further down in the code +# $user_group_filter +# $ingroup_filter + $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); diff --git a/agc_2-X/trunk/www/vicidial/AST_timeonVDADall_mobile.php b/agc_2-X/trunk/www/vicidial/AST_timeonVDADall_mobile.php index 36bc94ff..48d6653d 100644 --- a/agc_2-X/trunk/www/vicidial/AST_timeonVDADall_mobile.php +++ b/agc_2-X/trunk/www/vicidial/AST_timeonVDADall_mobile.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # live real-time stats for the VICIDIAL Auto-Dialer all servers # @@ -9,10 +9,11 @@ # # CHANGELOG: # 200318-1124 - First build, based upon AST_timeonVDADall.php +# 220221-1536 - Added allow_web_debug system setting # -$version = '2.14-1'; -$build = '200318-1124'; +$version = '2.14-2'; +$build = '220221-1536'; header ("Content-type: text/html; charset=utf-8"); @@ -95,10 +96,10 @@ if (isset($_GET["droppedOFtotal"])) {$droppedOFtotal=$_GET["droppedOFtotal"]; elseif (isset($_POST["droppedOFtotal"])) {$droppedOFtotal=$_POST["droppedOFtotal"];} if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];} -if (isset($_GET["RTdisplay_type"])) {$RTdisplay_type=$_GET["RTdisplay_type"];} +if (isset($_GET["RTdisplay_type"])) {$RTdisplay_type=$_GET["RTdisplay_type"];} elseif (isset($_POST["RTdisplay_type"])) {$RTdisplay_type=$_POST["RTdisplay_type"];} if (isset($_GET["mobile_device"])) {$mobile_device=$_GET["mobile_device"];} - elseif (isset($_POST["mobile_device"])) {$mobile_device=$_POST["mobile_device"];} + elseif (isset($_POST["mobile_device"])) {$mobile_device=$_POST["mobile_device"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); @@ -107,9 +108,9 @@ $db_source = 'M'; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,allow_chats,cache_carrier_stats_realtime,report_default_format,ofcom_uk_drop_calc,enable_pause_code_limits FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,allow_chats,cache_carrier_stats_realtime,report_default_format,ofcom_uk_drop_calc,enable_pause_code_limits,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -126,10 +127,12 @@ if ($qm_conf_ct > 0) $SSreport_default_format = $row[9]; $SSofcom_uk_drop_calc = $row[10]; $SSenable_pause_code_limits = $row[11]; + $SSallow_web_debug = $row[12]; } +if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;} +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### -if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;} if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) ) { @@ -247,9 +250,54 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } +$RR = preg_replace('/[^0-9]/', '', $RR); +$inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $inbound); +$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); +$groups[0] = preg_replace('/[^-_0-9a-zA-Z]/', '', $groups[0]); +$usergroup = preg_replace('/[^-_0-9a-zA-Z]/', '', $usergroup); +$DB = preg_replace('/[^0-9]/', '', $DB); +$adastats = preg_replace('/[^-_0-9a-zA-Z]/', '', $adastats); +$SIPmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $SIPmonitorLINK); +$IAXmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $IAXmonitorLINK); +$UGdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $UGdisplay); +$UidORname = preg_replace('/[^-_0-9a-zA-Z]/', '', $UidORname); +$orderby = preg_replace('/[^-_0-9a-zA-Z]/', '', $orderby); +$SERVdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $SERVdisplay); +$CALLSdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CALLSdisplay); +$PHONEdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHONEdisplay); +$CUSTPHONEdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CUSTPHONEdisplay); +$CUSTINFOdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CUSTINFOdisplay); +if ($CUSTINFOdisplay==1) {$CUSTPHONEdisplay=0;} # only one of these should be on at one time +if ($CUSTPHONEdisplay==1) {$CUSTINFOdisplay=0;} # only one of these should be on at one time +$NOLEADSalert = preg_replace('/[^-_0-9a-zA-Z]/', '', $NOLEADSalert); +$DROPINGROUPstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $DROPINGROUPstats); +$ALLINGROUPstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $ALLINGROUPstats); +$with_inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $with_inbound); +$monitor_active = preg_replace('/[^-_0-9a-zA-Z]/', '', $monitor_active); +$monitor_phone = preg_replace('/[^-_0-9a-zA-Z]/', '', $monitor_phone); +$CARRIERstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $CARRIERstats); +$PRESETstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $PRESETstats); +$AGENTtimeSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $AGENTtimeSTATS); +$parkSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $parkSTATS); +$SLAinSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $SLAinSTATS); +$INGROUPcolorOVERRIDE = preg_replace('/[^-_0-9a-zA-Z]/', '', $INGROUPcolorOVERRIDE); +$droppedOFtotal = preg_replace('/[^-_0-9a-zA-Z]/', '', $droppedOFtotal); +$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type); +$mobile_device = preg_replace('/[^-_0-9a-zA-Z]/', '', $mobile_device); +$RTdisplay_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTdisplay_type); +$RTajax = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTajax); +$RTpass = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTpass); +$RTuser = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTuser); +$server_ip = preg_replace('/[^-\._0-9a-zA-Z]/', '', $server_ip); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); + +# Variables filtered further down in the code +# $user_group_filter +# $ingroup_filter $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} diff --git a/agc_2-X/trunk/www/vicidial/NANPA_running_processes.php b/agc_2-X/trunk/www/vicidial/NANPA_running_processes.php index 027e93fe..f510e1fa 100644 --- a/agc_2-X/trunk/www/vicidial/NANPA_running_processes.php +++ b/agc_2-X/trunk/www/vicidial/NANPA_running_processes.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script shows running NANPA filter batch proccesses # @@ -12,10 +12,11 @@ # 160108-2300 - Changed some mysqli_query to mysql_to_mysqli for consistency # 170409-1537 - Added IP List validation code # 170822-2230 - Added screen color settings +# 220222-1917 - Added allow_web_debug system setting # -$version = '2.14-5'; -$build = '170409-1537'; +$version = '2.14-6'; +$build = '220222-1917'; $startMS = microtime(); require("dbconnect_mysqli.php"); @@ -34,7 +35,7 @@ if (isset($_GET["process_limit"])) {$process_limit=$_GET["process_limit"];} ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($DB) {$MAIN.="$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); @@ -47,10 +48,18 @@ if ($qm_conf_ct > 0) $reports_use_slave_db = $row[3]; $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; + $SSallow_web_debug = $row[6]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$process_limit = preg_replace('/[^-_0-9a-zA-Z]/', '', $process_limit); +$show_history = preg_replace('/[^-_0-9a-zA-Z]/', '', $show_history); + +# Variables filtered further down in the code +# $output_codes_to_display + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -58,12 +67,10 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$process_limit = preg_replace('/[^-_0-9a-zA-Z]/', '', $process_limit); - $NOW_DATE = date("Y-m-d"); $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; @@ -197,6 +204,7 @@ $url_str=""; for ($i=0; $i<$oc_ct; $i++) { + $output_codes_to_display[$i] = preg_replace("/\'|\"|\\\\|;/","",$output_codes_to_display[$i]); $oc_SQL.="'$output_codes_to_display[$i]',"; $url_str.="output_codes_to_display[]=".$output_codes_to_display[$i]; } diff --git a/agc_2-X/trunk/www/vicidial/admin_NANPA_updater.php b/agc_2-X/trunk/www/vicidial/admin_NANPA_updater.php index e2aadf1f..9c0a7f51 100644 --- a/agc_2-X/trunk/www/vicidial/admin_NANPA_updater.php +++ b/agc_2-X/trunk/www/vicidial/admin_NANPA_updater.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed to launch NANPA filter batch proccesses through the # triggering process @@ -17,10 +17,11 @@ # 170822-2230 - Added screen color settings # 180503-2015 - Added new help display # 191013-0814 - Fixes for PHP7 +# 220222-1753 - Added allow_web_debug system setting # -$version = '2.14-8'; -$build = '191013-0814'; +$version = '2.14-9'; +$build = '220222-1753'; $startMS = microtime(); require("dbconnect_mysqli.php"); @@ -61,9 +62,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,active_voicemail_server,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,active_voicemail_server,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {$MAIN.="$stmt\n";} +#if ($DB) {$MAIN.="$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -75,10 +76,27 @@ if ($qm_conf_ct > 0) $active_voicemail_server = $row[4]; $SSenable_languages = $row[5]; $SSlanguage_method = $row[6]; + $SSallow_web_debug = $row[7]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$cellphone_list_id=preg_replace('/[^0-9]/', '', $cellphone_list_id); +$landline_list_id=preg_replace('/[^0-9]/', '', $landline_list_id); +$invalid_list_id=preg_replace('/[^0-9]/', '', $invalid_list_id); +$exclusion_value=preg_replace('/[\'\"\\\\]/', '', $exclusion_value); +$exclusion_value=preg_replace('/\s/', '\\\\\ ', $exclusion_value); +$submit_form = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit_form); +$delete_trigger_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $delete_trigger_id); +$vl_field_update = preg_replace('/[^-_0-9a-zA-Z]/', '', $vl_field_update); +$vl_field_exclude = preg_replace('/[^-_0-9a-zA-Z]/', '', $vl_field_exclude); +$activation_delay = preg_replace('/[^- \.\_0-9a-zA-Z]/', '', $activation_delay); +$fields_to_update = preg_replace('/[^- \,\.\_0-9a-zA-Z]/', '', $fields_to_update); + +# Variables filtered further down in the code +# $lists + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -86,8 +104,8 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } $NOW_DATE = date("Y-m-d"); @@ -222,18 +240,12 @@ if ($submit_form=="SUBMIT" && $list_ct>0 && (strlen($vl_field_update)>0 || strle } $list_ct=count($lists); - $cellphone_list_id=preg_replace('/[^0-9]/', '', $cellphone_list_id); - $landline_list_id=preg_replace('/[^0-9]/', '', $landline_list_id); - $invalid_list_id=preg_replace('/[^0-9]/', '', $invalid_list_id); - $exclusion_value=preg_replace('/[\'\"\\\\]/', '', $exclusion_value); - $exclusion_value=preg_replace('/\s/', '\\\\\ ', $exclusion_value); - - $options="--user=$PHP_AUTH_USER --pass=$PHP_AUTH_PW "; $list_id_str=""; for ($i=0; $i<$list_ct; $i++) { + $lists[$i] = preg_replace('/[^0-9]/','',$lists[$i]); $list_id_str.=$lists[$i]."--"; } $list_id_str=substr($list_id_str, 0, -2); diff --git a/agc_2-X/trunk/www/vicidial/admin_amm_multi.php b/agc_2-X/trunk/www/vicidial/admin_amm_multi.php index c38b5f05..cf80c96d 100644 --- a/agc_2-X/trunk/www/vicidial/admin_amm_multi.php +++ b/agc_2-X/trunk/www/vicidial/admin_amm_multi.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # this screen will control the *amd* settings needed when the Campaign setting # "AM Message Wildcards" is enabled. This screen allows for multiple messages @@ -15,10 +15,11 @@ # 180502-2115 - Added new help display # 180618-2300 - Modified calls to audio file chooser function # 180924-1606 - Added called_count as field +# 220222-0817 - Added allow_web_debug system setting # -$admin_version = '2.14-6'; -$build = '180924-1606'; +$admin_version = '2.14-7'; +$build = '220222-0817'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -60,9 +61,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,qc_features_active FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,qc_features_active,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $ss_conf_ct = mysqli_num_rows($rslt); if ($ss_conf_ct > 0) { @@ -72,28 +73,39 @@ if ($ss_conf_ct > 0) $SSenable_languages = $row[2]; $SSlanguage_method = $row[3]; $SSqc_features_active = $row[4]; + $SSallow_web_debug = $row[5]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$amm_id = preg_replace('/[^0-9]/','',$amm_id); +$amm_rank = preg_replace('/[^-0-9]/','',$amm_rank); +$active = preg_replace('/[^A-Z]/','',$active); +$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); - $amm_id = preg_replace('/[^0-9]/','',$amm_id); $campaign_id = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign_id); $entry_type = preg_replace('/[^_0-9a-zA-Z]/','',$entry_type); - $active = preg_replace('/[^A-Z]/','',$active); $amm_field = preg_replace('/[^_0-9a-zA-Z]/','',$amm_field); - $amm_rank = preg_replace('/[^-0-9]/','',$amm_rank); $amm_wildcard = preg_replace('/[^- _0-9a-zA-Z]/','',$amm_wildcard); $amm_description = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$amm_description); $amm_filename = preg_replace('/[^- \|\.\,\_0-9a-zA-Z]/','',$amm_filename); } # end of non_latin else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $campaign_id = preg_replace('/[^-_0-9\p{L}]/u','',$campaign_id); + $entry_type = preg_replace('/[^_0-9\p{L}]/u','',$entry_type); + $amm_field = preg_replace('/[^_0-9\p{L}]/u','',$amm_field); + $amm_wildcard = preg_replace('/[^- _0-9\p{L}]/u','',$amm_wildcard); + $amm_description = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$amm_description); + $amm_filename = preg_replace('/[^- \|\.\,\_0-9\p{L}]/u','',$amm_filename); } $STARTtime = date("U"); diff --git a/agc_2-X/trunk/www/vicidial/admin_bulk_tools.php b/agc_2-X/trunk/www/vicidial/admin_bulk_tools.php index 5eeab797..4ef16be7 100644 --- a/agc_2-X/trunk/www/vicidial/admin_bulk_tools.php +++ b/agc_2-X/trunk/www/vicidial/admin_bulk_tools.php @@ -31,13 +31,14 @@ # 210312-1429 - Added DID bulk delete text area, filtered out did_system_filter as selectable # 210315-1644 - Added CID bulk delete text area and ---ALL-- option # 220112-1806 - Added CAN(Canadian) states lookup for STATEFILL feature and CID-STATE feature +# 220222-0821 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); require("functions.php"); -$version = '2.14-25'; -$build = '220112-1806'; +$version = '2.14-26'; +$build = '220222-0821'; $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -91,6 +92,33 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); if ($DB) {echo "$form_to_run|";} +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$sys_settings_stmt = "SELECT use_non_latin,enable_languages,language_method,campaign_cid_areacodes_enabled,sounds_central_control_active,contacts_enabled,enable_auto_reports,allow_web_debug FROM system_settings;"; +$sys_settings_rslt=mysql_to_mysqli($sys_settings_stmt, $link); +#if ($DB) {echo "$sys_settings_stmt|";} +$num_rows = mysqli_num_rows($sys_settings_rslt); +if ($num_rows > 0) + { + $sys_settings_row=mysqli_fetch_row($sys_settings_rslt); + $non_latin = $sys_settings_row[0]; + $SSenable_languages = $sys_settings_row[1]; + $SSlanguage_method = $sys_settings_row[2]; + $SScampaign_cid_areacodes_enabled = $sys_settings_row[3]; + $SSsounds_central_control_active = $sys_settings_row[4]; + $SScontacts_enabled = $sys_settings_row[5]; + $SSenable_auto_reports = $sys_settings_row[6]; + $SSallow_web_debug = $sys_settings_row[7]; + } +else + { + echo _QXZ("There are no system settings. You might want to look into that."); + exit; + } +if ($SSallow_web_debug < 1) {$DB=0;} +##### END SETTINGS LOOKUP ##### +########################################### + $ACCIDto_insert_raw = explode("\n", $ACCIDto_insert_raw); if ($ACCIDmethod == "CSV") { @@ -115,16 +143,58 @@ else $ACCIDto_insert_raw = preg_replace('/[^0-9]/','',$ACCIDto_insert_raw); $ACCIDto_insert_raw_ArFilter = array_filter($ACCIDto_insert_raw); } +$DIDto_insert_raw = preg_replace('/[^0-9\n]/','',$DIDto_insert_raw); $DIDto_insert_raw = explode("\n", $DIDto_insert_raw); -$DIDto_insert_raw = preg_replace('/[^0-9]/','',$DIDto_insert_raw); -if ( $form_to_run == "BULKDIDSDELETETB" ) { +if ( $form_to_run == "BULKDIDSDELETETB" ) + { $DIDdelete_from = explode("\n", $DIDto_delete_TB); $DIDdelete_from = preg_replace('/[^0-9]/','',$DIDdelete_from); -} + } $DIDto_insert_raw_ArFilter = array_filter($DIDto_insert_raw); $USERstart = preg_replace('/[^0-9]/','',$USERstart); $USERstop = preg_replace('/[^0-9]/','',$USERstop); $USERfull_name = preg_replace('/[^-_0-9a-zA-Z]/','',$USERfull_name); +if ( $form_to_run == "ACCIDDELETEconfirmTB" ) + { + $ACCIDdelete_from = explode("\n", $ACCIDdelete_from); + $ACCIDdelete_from = preg_replace('/[^0-9]/','',$ACCIDdelete_from); + } + +$ACCIDclear_all = preg_replace('/[^-_0-9a-zA-Z]/','',$ACCIDclear_all); +$ACCIDclear_all_CONFIRMED = preg_replace('/[^-_0-9a-zA-Z]/','',$ACCIDclear_all_CONFIRMED); +$DIDcopy_from = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$DIDcopy_from); +$USERforce_pw = preg_replace('/[^-_0-9a-zA-Z]/','',$USERforce_pw); + +# Variables filter further down in the code +# $ACCIDareacode +# $ACCIDto_insert_CONFIRMED +# $ACCIDdescription +# $ACCIDactive +# $ACCIDactiveinput +# $DIDto_insert_CONFIRMED +# $USERto_insert +# $ACCIDdelete_from_CONFIRMED +# $DIDdelete_from_CONFIRMED +# $USERdelete_from +# $USERdelete_from_CONFIRMED + +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $ACCIDcampaign = preg_replace('/[^-_0-9a-zA-Z]/', '', $ACCIDcampaign); + $ACCIDdelete_campaign = preg_replace('/[^-_0-9a-zA-Z]/', '', $ACCIDdelete_campaign); + $USERcopy_from = preg_replace('/[^-_0-9a-zA-Z]/', '', $USERcopy_from); + } +else + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $ACCIDcampaign = preg_replace('/[^-_0-9\p{L}]/u', '', $ACCIDcampaign); + $ACCIDdelete_campaign = preg_replace('/[^-_0-9\p{L}]/u', '', $ACCIDdelete_campaign); + $USERcopy_from = preg_replace('/[^-_0-9\p{L}]/u', '', $USERcopy_from); + } + if (empty($USERfull_name)) {$USERfull_name = "BLANK";} if (empty($USERdelete_from)) {$USERdelete_from="BLANK";} if (empty($ACCIDto_insert_raw_ArFilter)) {$CIDcheck = "BLANK";} @@ -132,50 +202,10 @@ if (empty($DIDto_insert_raw_ArFilter)) {$DIDcheck = "BLANK";} if (empty($DIDdelete_from)) {$DIDdelete_from="BLANK";} if (empty($USERstart)) {$USERstart = "BLANK";} if (empty($USERstop)) {$USERstop = "BLANK";} -if ( $form_to_run == "ACCIDDELETEconfirmTB" ) { - $ACCIDdelete_from = explode("\n", $ACCIDdelete_from); - $ACCIDdelete_from = preg_replace('/[^0-9]/','',$ACCIDdelete_from); -} if (empty($ACCIDdelete_from)) {$ACCIDdelete_from = "BLANK";} if (empty($ACCIDdelete_campaign)) {$ACCIDdelete_campaign = "BLANK";} if ($ACCIDclear_all == "Y") {$form_to_run="ACCIDDELETEconfirm";} -############################################# -##### START SYSTEM_SETTINGS LOOKUP ##### -$sys_settings_stmt = "SELECT use_non_latin,enable_languages,language_method,campaign_cid_areacodes_enabled,sounds_central_control_active,contacts_enabled,enable_auto_reports FROM system_settings;"; -$sys_settings_rslt=mysql_to_mysqli($sys_settings_stmt, $link); -if ($DB) {echo "$sys_settings_stmt|";} -$num_rows = mysqli_num_rows($sys_settings_rslt); -if ($num_rows > 0) - { - $sys_settings_row=mysqli_fetch_row($sys_settings_rslt); - $non_latin = $sys_settings_row[0]; - $SSenable_languages = $sys_settings_row[1]; - $SSlanguage_method = $sys_settings_row[2]; - $SScampaign_cid_areacodes_enabled = $sys_settings_row[3]; - $SSsounds_central_control_active = $sys_settings_row[4]; - $SScontacts_enabled = $sys_settings_row[5]; - $SSenable_auto_reports = $sys_settings_row[6]; - } -else - { - echo _QXZ("There are no system settings. You might want to look into that."); - exit; - } -##### END SETTINGS LOOKUP ##### -########################################### - -if ($non_latin < 1) - { - $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); - } -else - { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - } - $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "$stmt|";} $rslt=mysql_to_mysqli($stmt, $link); @@ -593,6 +623,7 @@ elseif ($form_to_run == "ACCIDconfirmed") $i = 0; while ($i < count($ACCIDto_insert_CONFIRMED)) { + $ACCIDareacode[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $ACCIDareacode[$i]); if (!preg_match("/[A-Z]/i",$ACCIDareacode[$i])) { $SQL="SELECT state FROM vicidial_phone_codes WHERE areacode='$ACCIDareacode[$i]';"; @@ -659,6 +690,11 @@ elseif ($form_to_run == "ACCIDconfirmed") if (strlen($ACCIDactiveinput[$INSERTindex]) > 0) {$tempACCIDactive = $ACCIDactiveinput[$INSERTindex];} else {$tempACCIDactive='N';} } + $ACCIDareacode[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDareacode[$INSERTindex]); + $ACCIDto_insert_CONFIRMED[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDto_insert_CONFIRMED[$INSERTindex]); + $ACCIDdescription[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDdescription[$INSERTindex]); + $tempACCIDactive = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $tempACCIDactive); + if ($DB) {echo "|ACCIDactive: $ACCIDactive|$ACCIDactiveinput[$INSERTindex]|$tempACCIDactive|";} $SQL = "INSERT IGNORE INTO vicidial_campaign_cid_areacodes (campaign_id,areacode,outbound_cid,active,cid_description) VALUES ('$ACCIDcampaign','$ACCIDareacode[$INSERTindex]','$ACCIDto_insert_CONFIRMED[$INSERTindex]','$tempACCIDactive','$ACCIDdescription[$INSERTindex]')"; @@ -674,6 +710,11 @@ elseif ($form_to_run == "ACCIDconfirmed") if (strlen($ACCIDactiveinput[$INSERTindex]) > 0) {$tempACCIDactive = $ACCIDactiveinput[$INSERTindex];} else {$tempACCIDactive='N';} } + $ACCIDareacode[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDareacode[$INSERTindex]); + $ACCIDto_insert_CONFIRMED[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDto_insert_CONFIRMED[$INSERTindex]); + $ACCIDdescription[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDdescription[$INSERTindex]); + $tempACCIDactive = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $tempACCIDactive); + if ($DB) {echo "|ACCIDactive: $ACCIDactive|$ACCIDactiveinput[$INSERTindex]|$tempACCIDactive|";} $SQL.= ",('" . $ACCIDcampaign . "','" . $ACCIDareacode[$INSERTindex] . "','" . $ACCIDto_insert_CONFIRMED[$INSERTindex] . "','" . $tempACCIDactive . "','" . $ACCIDdescription[$INSERTindex] . "')"; $SQL_sentence.= " |$ACCIDareacode[$INSERTindex]|$ACCIDto_insert_CONFIRMED[$INSERTindex]|$ACCIDdescription[$INSERTindex]|$tempACCIDactive"; @@ -693,6 +734,11 @@ elseif ($form_to_run == "ACCIDconfirmed") if (strlen($ACCIDactiveinput[$INSERTindex]) > 0) {$tempACCIDactive = $ACCIDactiveinput[$INSERTindex];} else {$tempACCIDactive='N';} } + $ACCIDareacode[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDareacode[$INSERTindex]); + $ACCIDto_insert_CONFIRMED[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDto_insert_CONFIRMED[$INSERTindex]); + $ACCIDdescription[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDdescription[$INSERTindex]); + $tempACCIDactive = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $tempACCIDactive); + if ($DB) {echo "|ACCIDactive: $ACCIDactive|$ACCIDactiveinput[$INSERTindex]|$tempACCIDactive|";} $SQL.= ",('" . $ACCIDcampaign . "','" . $ACCIDareacode[$INSERTindex] . "','" . $ACCIDto_insert_CONFIRMED[$INSERTindex] . "','" . $tempACCIDactive . "','" . $ACCIDdescription[$INSERTindex] . "')"; $SQL_sentence.= " |$ACCIDareacode[$INSERTindex]|$ACCIDto_insert_CONFIRMED[$INSERTindex]|$ACCIDdescription[$INSERTindex]|$tempACCIDactive"; @@ -863,6 +909,7 @@ elseif ($form_to_run == "ACCIDDELETEconfirmed" || $form_to_run == "ACCIDDELETEco $i = 1; # loop counter while ($i < count($ACCIDdelete_from_CONFIRMED)) { + $ACCIDdelete_from_CONFIRMED[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDdelete_from_CONFIRMED[$i]); $SQL_sentence.= "$ACCIDdelete_from_CONFIRMED[$i] |"; $i++; } @@ -896,6 +943,7 @@ elseif ($form_to_run == "ACCIDDELETEconfirmed" || $form_to_run == "ACCIDDELETEco $k = 1; # areacode index counter while ($i < count($ACCIDdelete_from_CONFIRMED)) { + $ACCIDdelete_from_CONFIRMED[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDdelete_from_CONFIRMED[$i]); if ($i & 1) { $ACCIDdelete_cid[$j] = $ACCIDdelete_from_CONFIRMED[$i]; @@ -914,6 +962,9 @@ elseif ($form_to_run == "ACCIDDELETEconfirmed" || $form_to_run == "ACCIDDELETEco $i = 0; while ($i < count($ACCIDdelete_areacode)) { + $ACCIDdelete_cid[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDdelete_cid[$i]); + $ACCIDdelete_areacode[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDdelete_areacode[$i]); + $SQL = "DELETE FROM vicidial_campaign_cid_areacodes WHERE campaign_id='$ACCIDdelete_campaign' AND outbound_cid='$ACCIDdelete_cid[$i]' AND areacode='$ACCIDdelete_areacode[$i]';"; $i++; if ($DB) {echo "$SQL|";} @@ -1155,6 +1206,8 @@ elseif ($form_to_run == "DIDADDconfirmed") $INSERTsqlLOG=''; while ($INSERTloopflag == "TRUE") { + $DIDto_insert_CONFIRMED[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $DIDto_insert_CONFIRMED[$INSERTindex]); + $SQL = "INSERT IGNORE INTO vicidial_inbound_dids (did_pattern,did_description,did_active,did_route,extension,exten_context,voicemail_ext,phone,server_ip,user,user_unavailable_action,user_route_settings_ingroup,group_id,call_handle_method,agent_search_method,list_id,campaign_id,phone_code,menu_id,record_call,filter_inbound_number,filter_phone_group_id,filter_url,filter_action,filter_extension,filter_exten_context,filter_voicemail_ext,filter_phone,filter_server_ip,filter_user,filter_user_unavailable_action,filter_user_route_settings_ingroup,filter_group_id,filter_call_handle_method,filter_agent_search_method,filter_list_id,filter_campaign_id,filter_phone_code,filter_menu_id,filter_clean_cid_number,custom_one,custom_two,custom_three,custom_four,custom_five,user_group,filter_dnc_campaign,filter_url_did_redirect,no_agent_ingroup_redirect,no_agent_ingroup_id,no_agent_ingroup_extension,pre_filter_phone_group_id,pre_filter_extension,entry_list_id,filter_entry_list_id,max_queue_ingroup_calls,max_queue_ingroup_id,max_queue_ingroup_extension,did_carrier_description) VALUES ('$DIDto_insert_CONFIRMED[$INSERTindex]','$did_description','$did_active','$did_route','$extension','$exten_context','$voicemail_ext','$phone','$server_ip','$user','$user_unavailable_action','$user_route_settings_ingroup','$group_id','$call_handle_method','$agent_search_method','$list_id','$ACCIDcampaign_id','$phone_code','$menu_id','$record_call','$filter_inbound_number','$filter_phone_group_id','$filter_url','$filter_action','$filter_extension','$filter_exten_context','$filter_voicemail_ext','$filter_phone','$filter_server_ip','$filter_user','$filter_user_unavailable_action','$filter_user_route_settings_ingroup','$filter_group_id','$filter_call_handle_method','$filter_agent_search_method','$filter_list_id','$filter_campaign_id','$filter_phone_code','$filter_menu_id','$filter_clean_cid_number','$custom_one','$custom_two','$custom_three','$custom_four','$custom_five','$user_group','$filter_dnc_campaign','$filter_url_did_redirect','$no_agent_ingroup_redirect','$no_agent_ingroup_id','$no_agent_ingroup_extension','$pre_filter_phone_group_id','$pre_filter_extension','$entry_list_id','$filter_entry_list_id','$max_queue_ingroup_calls','$max_queue_ingroup_id','$max_queue_ingroup_extension','$did_carrier_description')"; $INSERTindex++; if ($INSERTgroup_counter > 0) @@ -1162,6 +1215,8 @@ elseif ($form_to_run == "DIDADDconfirmed") $i = 1; while ($i < $INSERTgroup_limit) { + $DIDto_insert_CONFIRMED[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $DIDto_insert_CONFIRMED[$INSERTindex]); + $SQL.= ",('" . $DIDto_insert_CONFIRMED[$INSERTindex] . "','" . $did_description . "','" . $did_active . "','" . $did_route . "','" . $extension . "','" . $exten_context . "','" . $voicemail_ext . "','" . $phone . "','" . $server_ip . "','" . $user . "','" . $user_unavailable_action . "','" . $user_route_settings_ingroup . "','" . $group_id . "','" . $call_handle_method . "','" . $agent_search_method . "','" . $list_id . "','" . $ACCIDcampaign_id . "','" . $phone_code . "','" . $menu_id . "','" . $record_call . "','" . $filter_inbound_number . "','" . $filter_phone_group_id . "','" . $filter_url . "','" . $filter_action . "','" . $filter_extension . "','" . $filter_exten_context . "','" . $filter_voicemail_ext . "','" . $filter_phone . "','" . $filter_server_ip . "','" . $filter_user . "','" . $filter_user_unavailable_action . "','" . $filter_user_route_settings_ingroup . "','" . $filter_group_id . "','" . $filter_call_handle_method . "','" . $filter_agent_search_method . "','" . $filter_list_id . "','" . $filter_campaign_id . "','" . $filter_phone_code . "','" . $filter_menu_id . "','" . $filter_clean_cid_number . "','" . $custom_one . "','" . $custom_two . "','" . $custom_three . "','" . $custom_four . "','" . $custom_five . "','" . $user_group . "','" . $filter_dnc_campaign . "','" . $filter_url_did_redirect . "','" . $no_agent_ingroup_redirect . "','" . $no_agent_ingroup_id . "','" . $no_agent_ingroup_extension . "','" . $pre_filter_phone_group_id . "','" . $pre_filter_extension . "','" . $entry_list_id . "','" . $filter_entry_list_id . "','" . $max_queue_ingroup_calls . "','" . $max_queue_ingroup_id . "','" . $max_queue_ingroup_extension . "','" . $did_carrier_description . "')"; $SQL_sentence.= " |$DIDto_insert_CONFIRMED[$i]"; $i++; @@ -1174,6 +1229,8 @@ elseif ($form_to_run == "DIDADDconfirmed") $i = 1; while ($i < $INSERTremainder) { + $DIDto_insert_CONFIRMED[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $DIDto_insert_CONFIRMED[$INSERTindex]); + $SQL.= ",('" . $DIDto_insert_CONFIRMED[$INSERTindex] . "','" . $did_description . "','" . $did_active . "','" . $did_route . "','" . $extension . "','" . $exten_context . "','" . $voicemail_ext . "','" . $phone . "','" . $server_ip . "','" . $user . "','" . $user_unavailable_action . "','" . $user_route_settings_ingroup . "','" . $group_id . "','" . $call_handle_method . "','" . $agent_search_method . "','" . $list_id . "','" . $ACCIDcampaign_id . "','" . $phone_code . "','" . $menu_id . "','" . $record_call . "','" . $filter_inbound_number . "','" . $filter_phone_group_id . "','" . $filter_url . "','" . $filter_action . "','" . $filter_extension . "','" . $filter_exten_context . "','" . $filter_voicemail_ext . "','" . $filter_phone . "','" . $filter_server_ip . "','" . $filter_user . "','" . $filter_user_unavailable_action . "','" . $filter_user_route_settings_ingroup . "','" . $filter_group_id . "','" . $filter_call_handle_method . "','" . $filter_agent_search_method . "','" . $filter_list_id . "','" . $filter_campaign_id . "','" . $filter_phone_code . "','" . $filter_menu_id . "','" . $filter_clean_cid_number . "','" . $custom_one . "','" . $custom_two . "','" . $custom_three . "','" . $custom_four . "','" . $custom_five . "','" . $user_group . "','" . $filter_dnc_campaign . "','" . $filter_url_did_redirect . "','" . $no_agent_ingroup_redirect . "','" . $no_agent_ingroup_id . "','" . $no_agent_ingroup_extension . "','" . $pre_filter_phone_group_id . "','" . $pre_filter_extension . "','" . $entry_list_id . "','" . $filter_entry_list_id . "','" . $max_queue_ingroup_calls . "','" . $max_queue_ingroup_id . "','" . $max_queue_ingroup_extension . "','" . $did_carrier_description . "')"; $SQL_sentence.= " |$DIDto_insert_CONFIRMED[$i]"; $i++; @@ -1224,6 +1281,7 @@ elseif ($form_to_run == "BULKDIDSDELETE" || $form_to_run == "BULKDIDSDELETETB") $i = 0; while ($i < count($DIDdelete_from)) { + $DIDdelete_from[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $DIDdelete_from[$i]); echo "
$DIDdelete_from[$i]"; $i++; } @@ -1242,10 +1300,12 @@ elseif ($form_to_run == "BULKDIDSDELETE" || $form_to_run == "BULKDIDSDELETETB") elseif ($form_to_run == "BULKDIDSDELETEconfirmed") { $DIDdelete_from_CONFIRMED = unserialize($DIDdelete_from_CONFIRMED); + $DIDdelete_from_CONFIRMED[0] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $DIDdelete_from_CONFIRMED[0]); $SQL = "DELETE FROM vicidial_inbound_dids WHERE did_pattern IN ('$DIDdelete_from_CONFIRMED[0]'"; $i = 1; while ($i < count($DIDdelete_from_CONFIRMED)) { + $DIDdelete_from_CONFIRMED[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $DIDdelete_from_CONFIRMED[$i]); $SQL.= ",'" . $DIDdelete_from_CONFIRMED[$i] . "'"; $i++; } @@ -1565,6 +1625,8 @@ elseif ($form_to_run == "BULKUSERSconfirmed") $INSERTsqlLOG=''; while ($INSERTloopflag == "TRUE") { + $USERto_insert[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $USERto_insert[$INSERTindex]); + $SQL = "INSERT IGNORE INTO vicidial_users (user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,agent_choose_territories,custom_one,custom_two,custom_three,custom_four,custom_five,voicemail_id,agent_call_log_view_override,callcard_admin,agent_choose_blended,realtime_block_user_info,custom_fields_modify,force_change_password,agent_lead_search_override,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,preset_contact_search,modify_contacts,modify_same_user_level,admin_hide_lead_data,admin_hide_phone_data,agentcall_email,modify_email_accounts,failed_login_count,last_login_date,last_ip,pass_hash,alter_admin_interface_options,max_inbound_calls,modify_custom_dialplans,wrapup_seconds_override,modify_languages,selected_language,user_choose_language,ignore_group_on_search,api_list_restrict,api_allowed_functions,lead_filter_id,admin_cf_show_hidden,agentcall_chat,user_hide_realtime,access_recordings,modify_colors,user_nickname,user_new_lead_limit,api_only_user,modify_auto_reports,modify_ip_lists,ignore_ip_list,ready_max_logout,export_gdpr_leads) VALUES ('$USERto_insert[$INSERTindex]','$USERto_insert[$INSERTindex]','$USERto_insert[$INSERTindex]','$user_level','$user_group','$phone_login','$phone_pass','$delete_users','$delete_user_groups','$delete_lists','$delete_campaigns','$delete_ingroups','$delete_remote_agents','$load_leads','$ACCIDcampaign_detail','$ast_admin_access','$ast_delete_phones','$delete_scripts','$modify_leads','$hotkeys_active','$change_agent_campaign','$agent_choose_ingroups','$closer_campaigns','$scheduled_callbacks','$agentonly_callbacks','$agentcall_manual','$vicidial_recording','$vicidial_transfers','$delete_filters','$alter_agent_interface_options','$closer_default_blended','$delete_call_times','$modify_call_times','$modify_users','$modify_campaigns','$modify_lists','$modify_scripts','$modify_filters','$modify_ingroups','$modify_usergroups','$modify_remoteagents','$modify_servers','$view_reports','$vicidial_recording_override','$alter_custdata_override','$qc_enabled','$qc_user_level','$qc_pass','$qc_finish','$qc_commit','$add_timeclock_log','$modify_timeclock_log','$delete_timeclock_log','$alter_custphone_override','$vdc_agent_api_access','$modify_inbound_dids','$delete_inbound_dids','$user_active','$alert_enabled','$download_lists','$agent_shift_enforcement_override','$manager_shift_enforcement_override','$shift_override_flag','$export_reports','$delete_from_dnc','$email','$user_code','$territory','$allow_alerts','$agent_choose_territories','$custom_one','$custom_two','$custom_three','$custom_four','$custom_five','$voicemail_id','$agent_call_log_view_override','$callcard_admin','$agent_choose_blended','$realtime_block_user_info','$custom_fields_modify','$USERforce_pw','$agent_lead_search_override','$modify_shifts','$modify_phones','$modify_carriers','$modify_labels','$modify_statuses','$modify_voicemail','$modify_audiostore','$modify_moh','$modify_tts','$preset_contact_search','$modify_contacts','$modify_same_user_level','$admin_hide_lead_data','$admin_hide_phone_data','$agentcall_email','$modify_email_accounts','$failed_login_count','$last_login_date','$last_ip','$pass_hash','$alter_admin_interface_options','$max_inbound_calls','$modify_custom_dialplans','$wrapup_seconds_override','$modify_languages','$selected_language','$user_choose_language','$ignore_group_on_search','$api_list_restrict','$api_allowed_functions','$lead_filter_id','$admin_cf_show_hidden','$agentcall_chat','$user_hide_realtime','$access_recordings','$modify_colors','$user_nickname','$user_new_lead_limit','$api_only_user','$modify_auto_reports','$modify_ip_lists','$ignore_ip_list','$ready_max_logout','$export_gdpr_leads')"; $INSERTindex++; if ($INSERTgroup_counter > 0) @@ -1572,6 +1634,8 @@ elseif ($form_to_run == "BULKUSERSconfirmed") $i = 1; while ($i < $INSERTgroup_limit) { + $USERto_insert[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $USERto_insert[$INSERTindex]); + $SQL.= ",('$USERto_insert[$INSERTindex]','$USERto_insert[$INSERTindex]','$USERto_insert[$INSERTindex]','$user_level','$user_group','$phone_login','$phone_pass','$delete_users','$delete_user_groups','$delete_lists','$delete_campaigns','$delete_ingroups','$delete_remote_agents','$load_leads','$ACCIDcampaign_detail','$ast_admin_access','$ast_delete_phones','$delete_scripts','$modify_leads','$hotkeys_active','$change_agent_campaign','$agent_choose_ingroups','$closer_campaigns','$scheduled_callbacks','$agentonly_callbacks','$agentcall_manual','$vicidial_recording','$vicidial_transfers','$delete_filters','$alter_agent_interface_options','$closer_default_blended','$delete_call_times','$modify_call_times','$modify_users','$modify_campaigns','$modify_lists','$modify_scripts','$modify_filters','$modify_ingroups','$modify_usergroups','$modify_remoteagents','$modify_servers','$view_reports','$vicidial_recording_override','$alter_custdata_override','$qc_enabled','$qc_user_level','$qc_pass','$qc_finish','$qc_commit','$add_timeclock_log','$modify_timeclock_log','$delete_timeclock_log','$alter_custphone_override','$vdc_agent_api_access','$modify_inbound_dids','$delete_inbound_dids','$user_active','$alert_enabled','$download_lists','$agent_shift_enforcement_override','$manager_shift_enforcement_override','$shift_override_flag','$export_reports','$delete_from_dnc','$email','$user_code','$territory','$allow_alerts','$agent_choose_territories','$custom_one','$custom_two','$custom_three','$custom_four','$custom_five','$voicemail_id','$agent_call_log_view_override','$callcard_admin','$agent_choose_blended','$realtime_block_user_info','$custom_fields_modify','$USERforce_pw','$agent_lead_search_override','$modify_shifts','$modify_phones','$modify_carriers','$modify_labels','$modify_statuses','$modify_voicemail','$modify_audiostore','$modify_moh','$modify_tts','$preset_contact_search','$modify_contacts','$modify_same_user_level','$admin_hide_lead_data','$admin_hide_phone_data','$agentcall_email','$modify_email_accounts','$failed_login_count','$last_login_date','$last_ip','$pass_hash','$alter_admin_interface_options','$max_inbound_calls','$modify_custom_dialplans','$wrapup_seconds_override','$modify_languages','$selected_language','$user_choose_language','$ignore_group_on_search','$api_list_restrict','$api_allowed_functions','$lead_filter_id','$admin_cf_show_hidden','$agentcall_chat','$user_hide_realtime','$access_recordings','$modify_colors','$user_nickname','$user_new_lead_limit','$api_only_user','$modify_auto_reports','$modify_ip_lists','$ignore_ip_list','$ready_max_logout','$export_gdpr_leads')"; $SQL_sentence.= " |$USERto_insert[$INSERTindex]"; $i++; @@ -1584,6 +1648,8 @@ elseif ($form_to_run == "BULKUSERSconfirmed") $i = 1; while ($i < $INSERTremainder) { + $USERto_insert[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $USERto_insert[$INSERTindex]); + $SQL.= ",('$USERto_insert[$INSERTindex]','$USERto_insert[$INSERTindex]','$USERto_insert[$INSERTindex]','$user_level','$user_group','$phone_login','$phone_pass','$delete_users','$delete_user_groups','$delete_lists','$delete_campaigns','$delete_ingroups','$delete_remote_agents','$load_leads','$ACCIDcampaign_detail','$ast_admin_access','$ast_delete_phones','$delete_scripts','$modify_leads','$hotkeys_active','$change_agent_campaign','$agent_choose_ingroups','$closer_campaigns','$scheduled_callbacks','$agentonly_callbacks','$agentcall_manual','$vicidial_recording','$vicidial_transfers','$delete_filters','$alter_agent_interface_options','$closer_default_blended','$delete_call_times','$modify_call_times','$modify_users','$modify_campaigns','$modify_lists','$modify_scripts','$modify_filters','$modify_ingroups','$modify_usergroups','$modify_remoteagents','$modify_servers','$view_reports','$vicidial_recording_override','$alter_custdata_override','$qc_enabled','$qc_user_level','$qc_pass','$qc_finish','$qc_commit','$add_timeclock_log','$modify_timeclock_log','$delete_timeclock_log','$alter_custphone_override','$vdc_agent_api_access','$modify_inbound_dids','$delete_inbound_dids','$user_active','$alert_enabled','$download_lists','$agent_shift_enforcement_override','$manager_shift_enforcement_override','$shift_override_flag','$export_reports','$delete_from_dnc','$email','$user_code','$territory','$allow_alerts','$agent_choose_territories','$custom_one','$custom_two','$custom_three','$custom_four','$custom_five','$voicemail_id','$agent_call_log_view_override','$callcard_admin','$agent_choose_blended','$realtime_block_user_info','$custom_fields_modify','$USERforce_pw','$agent_lead_search_override','$modify_shifts','$modify_phones','$modify_carriers','$modify_labels','$modify_statuses','$modify_voicemail','$modify_audiostore','$modify_moh','$modify_tts','$preset_contact_search','$modify_contacts','$modify_same_user_level','$admin_hide_lead_data','$admin_hide_phone_data','$agentcall_email','$modify_email_accounts','$failed_login_count','$last_login_date','$last_ip','$pass_hash','$alter_admin_interface_options','$max_inbound_calls','$modify_custom_dialplans','$wrapup_seconds_override','$modify_languages','$selected_language','$user_choose_language','$ignore_group_on_search','$api_list_restrict','$api_allowed_functions','$lead_filter_id','$admin_cf_show_hidden','$agentcall_chat','$user_hide_realtime','$access_recordings','$modify_colors','$user_nickname','$user_new_lead_limit','$api_only_user','$modify_auto_reports','$modify_ip_lists','$ignore_ip_list','$ready_max_logout','$export_gdpr_leads')"; $SQL_sentence.= " |$USERto_insert[$INSERTindex]"; $i++; @@ -1626,6 +1692,7 @@ elseif ($form_to_run == "BULKUSERSDELETE") ### BULK USER DELETE $i = 0; while ($i < count($USERdelete_from)) { + $USERdelete_from[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $USERdelete_from[$i]); echo "
$USERdelete_from[$i]"; $i++; } @@ -1645,10 +1712,12 @@ elseif ($form_to_run == "BULKUSERSDELETE") ### BULK USER DELETE elseif ($form_to_run == "BULKUSERSDELETEconfirmed")### BULK USER DELETE CONFIRM { $USERdelete_from_CONFIRMED = unserialize($USERdelete_from_CONFIRMED); + $USERdelete_from_CONFIRMED[0] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $USERdelete_from_CONFIRMED[0]); $SQL = "DELETE FROM vicidial_users WHERE user IN ('$USERdelete_from_CONFIRMED[0]'"; $i = 1; while ($i < count($USERdelete_from_CONFIRMED)) { + $USERdelete_from_CONFIRMED[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $USERdelete_from_CONFIRMED[$i]); $SQL.= ",'" . $USERdelete_from_CONFIRMED[$i] . "'"; $i++; } diff --git a/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php b/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php index 11f511f8..179eb094 100644 --- a/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php +++ b/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # this screen will control the campaign settings needed for alternate number # dialing using multiple leads with the same account number and different phone @@ -21,10 +21,11 @@ # 150728-1046 - Added option for secondary sorting by vendor_lead_code, Issue #833 # 170409-1535 - Added IP List validation code # 180329-1344 - Added screen colors +# 220222-0902 - Added allow_web_debug system setting # -$admin_version = '2.14-11'; -$build = '180329-1344'; +$admin_version = '2.14-12'; +$build = '220222-0902'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -54,9 +55,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $ss_conf_ct = mysqli_num_rows($rslt); if ($ss_conf_ct > 0) { @@ -65,22 +66,28 @@ if ($ss_conf_ct > 0) $webroot_writable = $row[1]; $SSenable_languages = $row[2]; $SSlanguage_method = $row[3]; + $SSallow_web_debug = $row[4]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$lead_order_randomize = preg_replace('/[^-_0-9a-zA-Z]/','',$lead_order_randomize); +$lead_order_secondary = preg_replace('/[^-_0-9a-zA-Z]/','',$lead_order_secondary); +$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); $campaign_id = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign_id); - $lead_order_randomize = preg_replace('/[^-_0-9a-zA-Z]/','',$lead_order_randomize); - $lead_order_secondary = preg_replace('/[^-_0-9a-zA-Z]/','',$lead_order_secondary); } # end of non_latin else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $campaign_id = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign_id); } $STARTtime = date("U"); diff --git a/agc_2-X/trunk/www/vicidial/admin_email_accounts.php b/agc_2-X/trunk/www/vicidial/admin_email_accounts.php index d74e57dc..58dbec2d 100644 --- a/agc_2-X/trunk/www/vicidial/admin_email_accounts.php +++ b/agc_2-X/trunk/www/vicidial/admin_email_accounts.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Joe Johnson, Matt Florell LICENSE: AGPLv2 # # This page manages the inbound email accounts in ViciDial # @@ -24,10 +24,11 @@ # 170409-1540 - Added IP List validation code # 180219-1233 - Fixed translation issue #1069 # 180502-2215 - Added new help display +# 220222-0906 - Added allow_web_debug system setting # -$admin_version = '2.14-18'; -$build = '180502-2215'; +$admin_version = '2.14-19'; +$build = '220222-0906'; $sh="emails"; @@ -99,9 +100,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,allow_emails,allow_emails,level_8_disable_add,enable_languages,language_method,active_modules,enable_auto_reports FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,allow_emails,allow_emails,level_8_disable_add,enable_languages,language_method,active_modules,enable_auto_reports,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -144,30 +145,56 @@ if ($qm_conf_ct > 0) $SSlanguage_method = $row[35]; $SSactive_modules = $row[36]; $SSenable_auto_reports = $row[37]; + $SSallow_web_debug = $row[38]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$list_id = preg_replace("/[^0-9]/","",$list_id); +$default_list_id = preg_replace("/[^0-9]/","",$default_list_id); +$email_frequency_check_mins = preg_replace("/[^0-9]/","",$email_frequency_check_mins); +$active = preg_replace("/[^_0-9a-zA-Z]/","",$active); +$protocol = preg_replace("/[^_0-9a-zA-Z]/","",$protocol); +$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT); +$stage = preg_replace('/[^-_0-9a-zA-Z]/','',$stage); +$eact = preg_replace('/[^-_0-9a-zA-Z]/','',$eact); +$email_account_user = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$email_account_user); +$email_account_pass = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$email_account_pass); +$pop3_auth_mode = preg_replace('/[^-_0-9a-zA-Z]/','',$pop3_auth_mode); +$email_account_type = preg_replace('/[^-_0-9a-zA-Z]/','',$email_account_type); +$call_handle_method = preg_replace('/[^-_0-9a-zA-Z]/','',$call_handle_method); +$agent_search_method = preg_replace('/[^-_0-9a-zA-Z]/','',$agent_search_method); +$confirm_deletion = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm_deletion); +$new_account_id = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_account_id); +$source_email_account = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$source_email_account); +$email_replyto_address = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$email_replyto_address); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_PW); - $email_account_id = preg_replace("/[^_0-9a-zA-Z]/","",$email_account_id); $email_account_name = preg_replace("/[^ \.\,-\_0-9a-zA-Z]/","",$email_account_name); $email_account_description = preg_replace("/[^ \.\,-\_0-9a-zA-Z]/","",$email_account_description); - $user_group = preg_replace("/[^_0-9a-zA-Z]/","",$user_group); - $protocol = preg_replace("/[^_0-9a-zA-Z]/","",$protocol); + $user_group = preg_replace("/[^-_0-9a-zA-Z]/","",$user_group); $email_account_server = preg_replace("/[^\.\-\_0-9a-zA-Z]/","",$email_account_server); - $active = preg_replace("/[^_0-9a-zA-Z]/","",$active); - $email_frequency_check_mins = preg_replace("/[^0-9]/","",$email_frequency_check_mins); + $group_id = preg_replace("/[^-_0-9a-zA-Z]/", "",$group_id); + $campaign_id = preg_replace("/[^-_0-9a-zA-Z]/", "",$campaign_id); } # end of non_latin else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $email_account_id = preg_replace("/[^_0-9\p{L}]/u","",$email_account_id); + $email_account_name = preg_replace("/[^ \.\,-\_0-9\p{L}]/u","",$email_account_name); + $email_account_description = preg_replace("/[^ \.\,-\_0-9\p{L}]/u","",$email_account_description); + $user_group = preg_replace("/[^-_0-9\p{L}]/u","",$user_group); + $email_account_server = preg_replace("/[^\.\-\_0-9\p{L}]/u","",$email_account_server); + $group_id = preg_replace('/[^-_0-9\p{L}]/u', '', $group_id); + $campaign_id = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign_id); } -$list_id = preg_replace("/[^0-9]/","",$list_id); $STARTtime = date("U"); $TODAY = date("Y-m-d"); diff --git a/agc_2-X/trunk/www/vicidial/admin_languages.php b/agc_2-X/trunk/www/vicidial/admin_languages.php index 8daba5c2..d1726233 100644 --- a/agc_2-X/trunk/www/vicidial/admin_languages.php +++ b/agc_2-X/trunk/www/vicidial/admin_languages.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # this screen manages the optional language tables in ViciDial # @@ -19,10 +19,11 @@ # 170409-1547 - Added IP List validation code # 180502-2215 - Added new help display # 200828-1628 - Fix for early permissions message, Issue #1227 +# 220222-0949 - Added allow_web_debug system setting # -$admin_version = '2.14-12'; -$build = '200828-1628'; +$admin_version = '2.14-13'; +$build = '220222-0949'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -43,7 +44,6 @@ if (isset($_GET["user"])) {$user=$_GET["user"];} elseif (isset($_POST["user"])) {$user=$_POST["user"];} if (isset($_GET["pass"])) {$pass=$_GET["pass"];} elseif (isset($_POST["pass"])) {$pass=$_POST["pass"];} - if (isset($_GET["language_id"])) {$language_id=$_GET["language_id"];} elseif (isset($_POST["language_id"])) {$language_id=$_POST["language_id"];} if (isset($_GET["language_code"])) {$language_code=$_GET["language_code"];} @@ -62,7 +62,6 @@ if (isset($_GET["import_data"])) {$import_data=$_GET["import_data"];} elseif (isset($_POST["import_data"])) {$import_data=$_POST["import_data"];} if (isset($_GET["active"])) {$active=$_GET["active"];} elseif (isset($_POST["active"])) {$active=$_POST["active"];} - if (isset($_GET["copy_option"])) {$copy_option=$_GET["copy_option"];} elseif (isset($_POST["copy_option"])) {$copy_option=$_POST["copy_option"];} if (isset($_GET["ConFiRm"])) {$ConFiRm=$_GET["ConFiRm"];} @@ -86,9 +85,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,allow_emails,active_modules,sounds_central_control_active,qc_features_active,contacts_enabled,enable_languages,language_method,admin_web_directory,admin_screen_colors,enable_auto_reports,campaign_cid_areacodes_enabled FROM system_settings;"; +$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,allow_emails,active_modules,sounds_central_control_active,qc_features_active,contacts_enabled,enable_languages,language_method,admin_web_directory,admin_screen_colors,enable_auto_reports,campaign_cid_areacodes_enabled,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -112,7 +111,9 @@ if ($qm_conf_ct > 0) $SSadmin_screen_colors = $row[16]; $SSenable_auto_reports = $row[17]; $SScampaign_cid_areacodes_enabled = $row[18]; + $SSallow_web_debug = $row[19]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -122,45 +123,46 @@ $modify_refresh_set=0; $import_with_missing_periods=1; $gif='.gif'; +$DB = preg_replace('/[^0-9]/','',$DB); +$rank = preg_replace('/[^0-9]/','',$rank); +$level = preg_replace('/[^0-9]/','',$level); +$parent_rank = preg_replace('/[^0-9]/','',$parent_rank); +$phrase_id = preg_replace('/[^0-9]/','',$phrase_id); +$active = preg_replace('/[^NY]/','',$active); +$ConFiRm = preg_replace('/[^0-9a-zA-Z]/','',$ConFiRm); +$copy_option = preg_replace('/[^_0-9a-zA-Z]/','',$copy_option); +$stage = preg_replace('/[^-_0-9a-zA-Z]/', '',$stage); +$import_data = preg_replace("/\\\\|;|\r/","",$import_data); +$english_text = preg_replace("/\\\\|;|\n|\r/","",$english_text); +$translated_text = preg_replace("/\\\\|;|\n|\r/","",$translated_text); +$ADD = preg_replace('/[^-_0-9a-zA-Z]/', '',$ADD); +$action = preg_replace('/[^-_0-9a-zA-Z]/', '',$action); +$session_name = preg_replace('/[^-_0-9a-zA-Z]/', '',$session_name); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '',$SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); $user = preg_replace('/[^-_0-9a-zA-Z]/','',$user); $pass = preg_replace('/[^-_0-9a-zA-Z]/','',$pass); - - $DB = preg_replace('/[^0-9]/','',$DB); - $rank = preg_replace('/[^0-9]/','',$rank); - $level = preg_replace('/[^0-9]/','',$level); - $parent_rank = preg_replace('/[^0-9]/','',$parent_rank); - $phrase_id = preg_replace('/[^0-9]/','',$phrase_id); - - $active = preg_replace('/[^NY]/','',$active); - - $ConFiRm = preg_replace('/[^0-9a-zA-Z]/','',$ConFiRm); - $language_id = preg_replace('/[^-_0-9a-zA-Z]/','',$language_id); $source_language_id = preg_replace('/[^-_0-9a-zA-Z]/','',$source_language_id); $language_code = preg_replace('/[^-_0-9a-zA-Z]/','',$language_code); $language_description = preg_replace('/[^- _0-9a-zA-Z]/','',$language_description); - $english_text = preg_replace("/\\\\|;|\n|\r/","",$english_text); - $translated_text = preg_replace("/\\\\|;|\n|\r/","",$translated_text); - $import_data = preg_replace("/\\\\|;|\r/","",$import_data); - - $copy_option = preg_replace('/[^_0-9a-zA-Z]/','',$copy_option); - $stage = preg_replace('/[^-_0-9a-zA-Z]/', '',$stage); $user_group = preg_replace('/[^-_0-9a-zA-Z]/', '',$user_group); } # end of non_latin else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $user = preg_replace("/'|\"|\\\\|;/","",$user); - $pass = preg_replace("/'|\"|\\\\|;/","",$pass); - $language_id = preg_replace("/'|\"|\\\\|;/","",$language_id); - $english_text = preg_replace("/\\\\|;|\n|\r/","",$english_text); - $translated_text = preg_replace("/\\\\|;|\n|\r/","",$translated_text); - $import_data = preg_replace("/\\\\|;|\r/","",$import_data); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-_0-9\p{L}]/u','',$pass); + $language_id = preg_replace('/[^-_0-9\p{L}]/u','',$language_id); + $source_language_id = preg_replace('/[^-_0-9\p{L}]/u','',$source_language_id); + $language_code = preg_replace('/[^-_0-9\p{L}]/u','',$language_code); + $language_description = preg_replace('/[^- _0-9\p{L}]/u','',$language_description); + $user_group = preg_replace('/[^-_0-9\p{L}]/u', '',$user_group); } $STARTtime = date("U"); diff --git a/agc_2-X/trunk/www/vicidial/admin_launch_trigger.php b/agc_2-X/trunk/www/vicidial/admin_launch_trigger.php index 94c88827..999a0a6b 100644 --- a/agc_2-X/trunk/www/vicidial/admin_launch_trigger.php +++ b/agc_2-X/trunk/www/vicidial/admin_launch_trigger.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed to launch a CLI script on the voicemail server through # the triggering process @@ -9,10 +9,11 @@ # CHANGELOG: # 161016-2014 - First build of script based upon admin_NANPA_updater.php # 170409-1543 - Added IP List validation code +# 220222-0957 - Added allow_web_debug system setting, if disabled, this script is disabled # -$version = '2.14-2'; -$build = '170409-1543'; +$version = '2.14-3'; +$build = '220222-0957'; $startMS = microtime(); require("dbconnect_mysqli.php"); @@ -35,7 +36,7 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,active_voicemail_server,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,active_voicemail_server,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($DB) {$MAIN.="$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); @@ -49,23 +50,27 @@ if ($qm_conf_ct > 0) $active_voicemail_server = $row[4]; $SSenable_languages = $row[5]; $SSlanguage_method = $row[6]; + $SSallow_web_debug = $row[7]; } +if ($SSallow_web_debug < 1) {$DB=0; $stage='';} ##### END SETTINGS LOOKUP ##### ########################################### +$stage = preg_replace('/[^-_0-9a-zA-Z]/','',$stage); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $container_id = preg_replace('/[^-_0-9a-zA-Z]/','',$container_id); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $container_id = preg_replace('/[^-_0-9\p{L}]/u', '', $container_id); } -$container_id = preg_replace('/[^-_0-9a-zA-Z]/','',$container_id); - $NOW_DATE = date("Y-m-d"); $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; @@ -177,7 +182,7 @@ if ($SSnocache_admin=='1') echo "\n"; echo "\n"; -echo "\n"; +echo "\n"; echo "\n"; echo "\n"; echo "\n"; diff --git a/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php b/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php index 67829279..c2cb06da 100644 --- a/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php +++ b/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php @@ -2,7 +2,7 @@ # admin_listloader_fourth_gen.php - version 2.14 # (based upon - new_listloader_superL.php script) # -# Copyright (C) 2021 Matt Florell,Joe Johnson LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell,Joe Johnson LICENSE: AGPLv2 # # ViciDial web-based lead loader from formatted file # @@ -79,10 +79,11 @@ # 200812-1745 - Added international DNC scrub option # 200922-1013 - Added web_loader_phone_strip system setting feature # 210210-1602 - Added duplicate check with more X-day options +# 220222-1002 - Added allow_web_debug system setting # -$version = '2.14-77'; -$build = '210210-1602'; +$version = '2.14-78'; +$build = '220222-1002'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -152,7 +153,7 @@ if (isset($_GET["postal_code_field"])) {$postal_code_field=$_GET["postal_code if (isset($_GET["country_code_field"])) {$country_code_field=$_GET["country_code_field"];} elseif (isset($_POST["country_code_field"])) {$country_code_field=$_POST["country_code_field"];} if (isset($_GET["gender_field"])) {$gender_field=$_GET["gender_field"];} - elseif (isset($_POST["gender_field"])) {$gender_field=$_POST["gender_field"];} + elseif (isset($_POST["gender_field"])) {$gender_field=$_POST["gender_field"];} if (isset($_GET["date_of_birth_field"])) {$date_of_birth_field=$_GET["date_of_birth_field"];} elseif (isset($_POST["date_of_birth_field"])) {$date_of_birth_field=$_POST["date_of_birth_field"];} if (isset($_GET["alt_phone_field"])) {$alt_phone_field=$_GET["alt_phone_field"];} @@ -178,10 +179,10 @@ if (isset($_GET["dupcheck"])) {$dupcheck=$_GET["dupcheck"];} elseif (isset($_POST["dupcheck"])) {$dupcheck=$_POST["dupcheck"];} if (isset($_GET["dedupe_statuses"])) {$dedupe_statuses=$_GET["dedupe_statuses"];} elseif (isset($_POST["dedupe_statuses"])) {$dedupe_statuses=$_POST["dedupe_statuses"];} -if (isset($_GET["dedupe_statuses_override"])) {$dedupe_statuses_override=$_GET["dedupe_statuses_override"];} - elseif (isset($_POST["dedupe_statuses_override"])) {$dedupe_statuses_override=$_POST["dedupe_statuses_override"];} +if (isset($_GET["dedupe_statuses_override"])) {$dedupe_statuses_override=$_GET["dedupe_statuses_override"];} + elseif (isset($_POST["dedupe_statuses_override"])) {$dedupe_statuses_override=$_POST["dedupe_statuses_override"];} if (isset($_GET["status_mismatch_action"])) {$status_mismatch_action=$_GET["status_mismatch_action"];} - elseif (isset($_POST["status_mismatch_action"])) {$status_mismatch_action=$_POST["status_mismatch_action"];} + elseif (isset($_POST["status_mismatch_action"])) {$status_mismatch_action=$_POST["status_mismatch_action"];} if (isset($_GET["postalgmt"])) {$postalgmt=$_GET["postalgmt"];} elseif (isset($_POST["postalgmt"])) {$postalgmt=$_POST["postalgmt"];} if (isset($_GET["phone_code_override"])) {$phone_code_override=$_GET["phone_code_override"];} @@ -189,8 +190,8 @@ if (isset($_GET["phone_code_override"])) {$phone_code_override=$_GET["phone_co $phone_code_override = (preg_replace("/\D/","",$phone_code_override)); if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} -if (isset($_GET["template_id"])) {$template_id=$_GET["template_id"];} - elseif (isset($_POST["template_id"])) {$template_id=$_POST["template_id"];} +if (isset($_GET["template_id"])) {$template_id=$_GET["template_id"];} + elseif (isset($_POST["template_id"])) {$template_id=$_POST["template_id"];} if (isset($_GET["usacan_check"])) {$usacan_check=$_GET["usacan_check"];} elseif (isset($_POST["usacan_check"])) {$usacan_check=$_POST["usacan_check"];} if (isset($_GET["state_conversion"])) {$state_conversion=$_GET["state_conversion"];} @@ -200,10 +201,6 @@ if (isset($_GET["web_loader_phone_length"])) {$web_loader_phone_length=$_GET[" if (isset($_GET["international_dnc_scrub"])) {$international_dnc_scrub=$_GET["international_dnc_scrub"];} elseif (isset($_POST["international_dnc_scrub"])) {$international_dnc_scrub=$_POST["international_dnc_scrub"];} - -if (strlen($dedupe_statuses_override)>0) { - $dedupe_statuses=explode(",", $dedupe_statuses_override); -} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); # if the didnt select an over ride wipe out in_file @@ -219,11 +216,11 @@ $vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_ ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method,active_modules,admin_screen_colors,web_loader_phone_length,enable_international_dncs,web_loader_phone_strip FROM system_settings;"; +$stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method,active_modules,admin_screen_colors,web_loader_phone_length,enable_international_dncs,web_loader_phone_strip,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) +#if ($qm_conf_ct > 0) { $row=mysqli_fetch_row($rslt); $non_latin = $row[0]; @@ -237,22 +234,75 @@ if ($qm_conf_ct > 0) $SSweb_loader_phone_length = $row[8]; $SSenable_international_dncs = $row[9]; $SSweb_loader_phone_strip = $row[10]; + $SSallow_web_debug = $row[11]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$list_id_override = preg_replace('/[^0-9]/','',$list_id_override); +$phone_code_override = preg_replace('/[^0-9]/','',$phone_code_override); +$web_loader_phone_length = preg_replace('/[^0-9]/','',$web_loader_phone_length); +$international_dnc_scrub = preg_replace('/[^-_0-9a-zA-Z]/', '', $international_dnc_scrub); +$master_list_override = preg_replace('/[^-_0-9a-zA-Z]/', '', $master_list_override); +$usacan_check = preg_replace('/[^-_0-9a-zA-Z]/', '', $usacan_check); +$state_conversion = preg_replace('/[^-_0-9a-zA-Z]/', '', $state_conversion); +$status_mismatch_action = preg_replace('/[^- \_0-9a-zA-Z]/', '', $status_mismatch_action); +$postalgmt = preg_replace('/[^- \_0-9a-zA-Z]/', '', $postalgmt); +$dupcheck = preg_replace('/[^- \_0-9a-zA-Z]/', '', $dupcheck); +$lead_file = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$lead_file); +$vendor_lead_code_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$vendor_lead_code_field); +$source_id_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$source_id_field); +$list_id_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$list_id_field); +$phone_code_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$phone_code_field); +$phone_number_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$phone_number_field); +$title_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$title_field); +$first_name_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$first_name_field); +$middle_initial_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$middle_initial_field); +$last_name_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$last_name_field); +$address1_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$address1_field); +$address2_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$address2_field); +$address3_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$address3_field); +$city_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$city_field); +$state_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$state_field); +$province_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$province_field); +$postal_code_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$postal_code_field); +$country_code_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$country_code_field); +$gender_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$gender_field); +$date_of_birth_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$date_of_birth_field); +$alt_phone_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$alt_phone_field); +$email_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$email_field); +$security_phrase_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$security_phrase_field); +$comments_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$comments_field); +$rank_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$rank_field); +$owner_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$owner_field); +$submit_file = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit_file); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); +$file_layout = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_layout); +$OK_to_process = preg_replace('/[^- \_0-9a-zA-Z]/', '', $OK_to_process); + +# Variables filter further down in the code +# $dedupe_statuses + +if (strlen($dedupe_statuses_override)>0) + { + $dedupe_statuses_override = preg_replace('/[^- \,\_0-9a-zA-Z]/', '', $dedupe_statuses_override); + $dedupe_statuses=explode(",", $dedupe_statuses_override); + } + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $template_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $template_id); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $template_id = preg_replace('/[^-_0-9\p{L}]/u', '', $template_id); } -$list_id_override = preg_replace('/[^0-9]/','',$list_id_override); -$web_loader_phone_length = preg_replace('/[^0-9]/','',$web_loader_phone_length); $STARTtime = date("U"); $TODAY = date("Y-m-d"); @@ -962,6 +1012,7 @@ if ($OK_to_process) $status_dedupe_str=""; for($ds=0; $ds0) {echo "$A_field_label[$o]|$A_field_type[$o]\n";} - if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') ) + if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') and ($A_field_type[$o]!='SWITCH') and ($A_field_type[$o]!='BUTTON') ) { if (!preg_match("/\|$A_field_label[$o]\|/",$vicidial_list_fields)) { @@ -2570,6 +2621,7 @@ if (($leadfile) && ($LF_path)) $statuses_clause=" and status in ("; $status_dedupe_str=""; for($ds=0; $ds0) {echo "$A_field_label[$o]|$A_field_type[$o]\n";} - if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') ) + if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') and ($A_field_type[$o]!='SWITCH') and ($A_field_type[$o]!='BUTTON') ) { if (!preg_match("/\|$A_field_label[$o]\|/",$vicidial_list_fields)) { @@ -3292,6 +3344,7 @@ if (($leadfile) && ($LF_path)) if (count($dedupe_statuses)>0) { $status_dedupe_str=""; for($ds=0; $ds, Joe Johnson LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell , Joe Johnson LICENSE: AGPLv2 # # CHANGES # 190205-1702 - First Build # 200210-1618 - Added links to more mobile-compatible reports # 200309-1819 - Modifications for display formatting +# 220222-1451 - Added allow_web_debug system setting # -$admin_version = '2.14-3a'; -$build = '200309-1819'; +$admin_version = '2.14-4a'; +$build = '220222-1451'; $startMS = microtime(); @@ -159,9 +160,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,allow_emails,level_8_disable_add,pass_key,pass_hash_enabled,disable_auto_dial,country_code_list_stats,frozen_server_call_clear,active_modules,allow_chats,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,enable_did_entry_list_id,enable_third_webform,default_language,user_hide_realtime_enabled,log_recording_access,alt_ivr_logging,admin_row_click,admin_screen_colors,ofcom_uk_drop_calc,agent_screen_colors,script_remove_js,manual_auto_next,user_new_lead_limit,agent_xfer_park_3way,agent_soundboards,web_loader_phone_length,agent_script,enable_auto_reports,enable_pause_code_limits,enable_drop_lists,allow_ip_lists,system_ip_blacklist,hide_inactive_lists,allow_manage_active_lists,expired_lists_inactive,did_system_filter,enable_gdpr_download_deletion FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,allow_emails,level_8_disable_add,pass_key,pass_hash_enabled,disable_auto_dial,country_code_list_stats,frozen_server_call_clear,active_modules,allow_chats,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,enable_did_entry_list_id,enable_third_webform,default_language,user_hide_realtime_enabled,log_recording_access,alt_ivr_logging,admin_row_click,admin_screen_colors,ofcom_uk_drop_calc,agent_screen_colors,script_remove_js,manual_auto_next,user_new_lead_limit,agent_xfer_park_3way,agent_soundboards,web_loader_phone_length,agent_script,enable_auto_reports,enable_pause_code_limits,enable_drop_lists,allow_ip_lists,system_ip_blacklist,hide_inactive_lists,allow_manage_active_lists,expired_lists_inactive,did_system_filter,enable_gdpr_download_deletion,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -241,7 +242,9 @@ if ($qm_conf_ct > 0) $SSexpired_lists_inactive = $row[72]; $SSdid_system_filter = $row[73]; $SSenable_gdpr_download_deletion = $row[74]; + $SSallow_web_debug = $row[75]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### diff --git a/agc_2-X/trunk/www/vicidial/admin_modify_lead.php b/agc_2-X/trunk/www/vicidial/admin_modify_lead.php index 6b9e4f25..f0545b9f 100644 --- a/agc_2-X/trunk/www/vicidial/admin_modify_lead.php +++ b/agc_2-X/trunk/www/vicidial/admin_modify_lead.php @@ -8,7 +8,7 @@ # just needs to enter the leadID and then they can view and modify the # information in the record for that lead # -# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # @@ -107,6 +107,7 @@ # 210421-2120 - Added more screen labels # 210629-1545 - Added KHOMP stats display # 210630-0838 - Added display of vicidial_vmm_counts data, if $CIDdisplay=="Yes" +# 220222-1454 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -120,8 +121,6 @@ if (isset($_GET["vendor_id"])) {$vendor_id=$_GET["vendor_id"];} elseif (isset($_POST["vendor_id"])) {$vendor_id=$_POST["vendor_id"];} if (isset($_GET["source_id"])) {$source_id=$_GET["source_id"];} elseif (isset($_POST["source_id"])) {$source_id=$_POST["source_id"];} -if (isset($_GET["phone"])) {$phone=$_GET["phone"];} - elseif (isset($_POST["phone"])) {$phone=$_POST["phone"];} if (isset($_GET["old_phone"])) {$old_phone=$_GET["old_phone"];} elseif (isset($_POST["old_phone"])) {$old_phone=$_POST["old_phone"];} if (isset($_GET["lead_id"])) {$lead_id=$_GET["lead_id"];} @@ -269,9 +268,9 @@ if ($nonselectable_statuses > 0) ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,custom_fields_enabled,webroot_writable,allow_emails,enable_languages,language_method,active_modules,log_recording_access,admin_screen_colors,enable_gdpr_download_deletion,source_id_display,mute_recordings,sip_event_logging FROM system_settings;"; +$stmt = "SELECT use_non_latin,custom_fields_enabled,webroot_writable,allow_emails,enable_languages,language_method,active_modules,log_recording_access,admin_screen_colors,enable_gdpr_download_deletion,source_id_display,mute_recordings,sip_event_logging,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -289,7 +288,9 @@ if ($qm_conf_ct > 0) $SSsource_id_display = $row[10]; $SSmute_recordings = $row[11]; $SSsip_event_logging = $row[12]; + $SSallow_web_debug = $row[13]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ### See if KHOMP is set up $stmt = "SELECT container_id FROM vicidial_settings_containers where container_id IN('KHOMPSETTINGS','KHOMPSTATUSMAP');"; @@ -322,6 +323,31 @@ $called_count=preg_replace('/[^0-9]/','',$called_count); $local_gmt=preg_replace('/[^-\.0-9]/','',$local_gmt); $callback = preg_replace('/[^A-Z]/','',$callback); $callback_type = preg_replace('/[^A-Z]/','',$callback_type); +$end_call=preg_replace('/[^0-9]/','',$end_call); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); +$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$extension); +$channel = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$channel); +$submit = preg_replace('/[^- \.\_0-9a-zA-Z]/','',$submit); +$SUBMIT = preg_replace('/[^- \.\_0-9a-zA-Z]/','',$SUBMIT); +$modify_logs=preg_replace('/[^0-9]/','',$modify_logs); +$modify_closer_logs=preg_replace('/[^0-9]/','',$modify_closer_logs); +$modify_agent_logs=preg_replace('/[^0-9]/','',$modify_agent_logs); +$add_closer_record=preg_replace('/[^0-9]/','',$add_closer_record); +$call_began = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$call_began); +$parked_time = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$parked_time); +$callback_id = preg_replace('/[^-_0-9a-zA-Z]/','',$callback_id); +$CBchangeUSERtoANY = preg_replace('/[^-_0-9a-zA-Z]/','',$CBchangeUSERtoANY); +$CBchangeANYtoUSER = preg_replace('/[^-_0-9a-zA-Z]/','',$CBchangeANYtoUSER); +$CBchangeDATE = preg_replace('/[^-_0-9a-zA-Z]/','',$CBchangeDATE); +$archive_search = preg_replace('/[^-_0-9a-zA-Z]/','',$archive_search); +$archive_log = preg_replace('/[^-_0-9a-zA-Z]/','',$archive_log); +$gdpr_action = preg_replace('/[^-_0-9a-zA-Z]/','',$gdpr_action); +$CIDdisplay = preg_replace('/[^-_0-9a-zA-Z]/','',$CIDdisplay); +$appointment_date = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$appointment_date); +$appointment_time = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$appointment_time); + +# Variables filtered further down in the code +# $vendor_id if ($non_latin < 1) { @@ -345,6 +371,7 @@ if ($non_latin < 1) $alt_phone = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$alt_phone); $email = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9a-zA-Z]/','',$email); $security_phrase = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$security_phrase); + $security = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$security); $campaign_id = preg_replace('/[^-\_0-9a-zA-Z]/', '',$campaign_id); $multi_alt_phones = preg_replace('/[^- \+\!\:\_0-9a-zA-Z]/','',$multi_alt_phones); $source = preg_replace('/[^0-9a-zA-Z]/','',$source); @@ -361,6 +388,11 @@ if ($non_latin < 1) $modify_log_submit = preg_replace('/[^-_0-9a-zA-Z]/','',$modify_log_submit); $modify_log_table = preg_replace('/[^-_0-9a-zA-Z]/','',$modify_log_table); $vicidial_id = preg_replace('/[^-\+\.\:\_0-9a-zA-Z]/','',$vicidial_id); + $dispo = preg_replace('/[^-_0-9a-zA-Z]/','',$dispo); + $status = preg_replace('/[^-_0-9a-zA-Z]/','',$status); + $CBstatus = preg_replace('/[^-_0-9a-zA-Z]/','',$CBstatus); + $tsr = preg_replace('/[^-_0-9a-zA-Z]/','',$tsr); + $CBuser = preg_replace('/[^-_0-9a-zA-Z]/','',$CBuser); } else { @@ -384,6 +416,7 @@ else $alt_phone = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$alt_phone); $email = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9\p{L}]/u','',$email); $security_phrase = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$security_phrase); + $security = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$security); $campaign_id = preg_replace('/[^-\_0-9\p{L}]/u', '',$campaign_id); $multi_alt_phones = preg_replace('/[^- \+\!\:\_0-9\p{L}]/u','',$multi_alt_phones); $source = preg_replace('/[^0-9\p{L}]/u','',$source); @@ -400,6 +433,11 @@ else $modify_log_submit = preg_replace('/[^-_0-9\p{L}]/u','',$modify_log_submit); $modify_log_table = preg_replace('/[^-_0-9\p{L}]/u','',$modify_log_table); $vicidial_id = preg_replace('/[^-\+\.\:\_0-9\p{L}]/u','',$vicidial_id); + $dispo = preg_replace('/[^-_0-9\p{L}]/u','',$dispo); + $status = preg_replace('/[^-_0-9\p{L}]/u','',$status); + $CBstatus = preg_replace('/[^-_0-9\p{L}]/u','',$CBstatus); + $tsr = preg_replace('/[^-_0-9\p{L}]/u','',$tsr); + $CBuser = preg_replace('/[^-_0-9\p{L}]/u','',$CBuser); } $first_name = preg_replace('/\+/',' ',$first_name); diff --git a/agc_2-X/trunk/www/vicidial/admin_phones_bulk_insert.php b/agc_2-X/trunk/www/vicidial/admin_phones_bulk_insert.php index f016c8c2..91bf311a 100644 --- a/agc_2-X/trunk/www/vicidial/admin_phones_bulk_insert.php +++ b/agc_2-X/trunk/www/vicidial/admin_phones_bulk_insert.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # this screen will insert phones into your multi-server system with aliases # @@ -22,10 +22,11 @@ # 181130-1304 - Added template option # 201112-1017 - Fix for side menu issue #1223 # 210827-0907 - Added PJSIP support +# 220222-1942 - Added allow_web_debug system setting # -$admin_version = '2.14-15'; -$build = '210827-0907'; +$admin_version = '2.14-16'; +$build = '220222-1942'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -77,9 +78,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,admin_screen_colors,campaign_cid_areacodes_enabled,sounds_central_control_active,contacts_enabled,enable_auto_reports,allowed_sip_stacks FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,admin_screen_colors,campaign_cid_areacodes_enabled,sounds_central_control_active,contacts_enabled,enable_auto_reports,allowed_sip_stacks,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $ss_conf_ct = mysqli_num_rows($rslt); if ($ss_conf_ct > 0) { @@ -94,7 +95,9 @@ if ($ss_conf_ct > 0) $SScontacts_enabled = $row[7]; $SSenable_auto_reports = $row[8]; $SSallowed_sip_stacks = $row[9]; + $SSallow_web_debug = $row[10]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -105,31 +108,37 @@ $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); +$servers = preg_replace("/'|\"|\\\\|;/","",$servers); +$phones = preg_replace("/'|\"|\\\\|;/","",$phones); +$action = preg_replace("/[^-_0-9a-zA-Z]/", "",$action); +$alias_option = preg_replace("/[^-_0-9a-zA-Z]/", "",$alias_option); +$protocol = preg_replace("/[^-_0-9a-zA-Z]/", "",$protocol); +$local_gmt = preg_replace("/[^- \.\,\_0-9a-zA-Z]/","",$local_gmt); +$is_webphone = preg_replace("/[^-_0-9a-zA-Z]/", "",$is_webphone); +$webphone_dialpad = preg_replace("/[^-_0-9a-zA-Z]/", "",$webphone_dialpad); +$webphone_auto_answer = preg_replace("/[^NY]/","",$webphone_auto_answer); +$use_external_server_ip = preg_replace("/[^NY]/","",$use_external_server_ip); +$SUBMIT = preg_replace("/[^-_0-9a-zA-Z]/", "",$SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_PW); - - $servers = preg_replace("/'|\"|\\\\|;/","",$servers); - $phones = preg_replace("/'|\"|\\\\|;/","",$phones); - $action = preg_replace("/[^-_0-9a-zA-Z]/", "",$action); $conf_secret = preg_replace("/[^-_0-9a-zA-Z]/", "",$conf_secret); $pass = preg_replace("/[^-_0-9a-zA-Z]/", "",$pass); - $alias_option = preg_replace("/[^-_0-9a-zA-Z]/", "",$alias_option); $alias_suffix = preg_replace("/[^0-9a-zA-Z]/","",$alias_suffix); - $protocol = preg_replace("/[^-_0-9a-zA-Z]/", "",$protocol); - $local_gmt = preg_replace("/[^- \.\,\_0-9a-zA-Z]/","",$local_gmt); - $is_webphone = preg_replace("/[^-_0-9a-zA-Z]/", "",$is_webphone); - $webphone_dialpad = preg_replace("/[^-_0-9a-zA-Z]/", "",$webphone_dialpad); - $webphone_auto_answer = preg_replace("/[^NY]/","",$webphone_auto_answer); - $use_external_server_ip = preg_replace("/[^NY]/","",$use_external_server_ip); $phone_context = preg_replace("/[^-\_0-9a-zA-Z]/","",$phone_context); $template_id = preg_replace('/[^-_0-9a-zA-Z]/','',$template_id); } # end of non_latin else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $conf_secret = preg_replace("/[^-_0-9\p{L}]/u", "",$conf_secret); + $pass = preg_replace("/[^-_0-9\p{L}]/u", "",$pass); + $alias_suffix = preg_replace("/[^0-9\p{L}]/u","",$alias_suffix); + $phone_context = preg_replace("/[^-\_0-9\p{L}]/u","",$phone_context); + $template_id = preg_replace('/[^-_0-9\p{L}]/u','',$template_id); } $user = $PHP_AUTH_USER; diff --git a/agc_2-X/trunk/www/vicidial/admin_search_lead.php b/agc_2-X/trunk/www/vicidial/admin_search_lead.php index d80be39a..07239bc4 100644 --- a/agc_2-X/trunk/www/vicidial/admin_search_lead.php +++ b/agc_2-X/trunk/www/vicidial/admin_search_lead.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # AST GUI database administration search for lead info # admin_modify_lead.php @@ -52,6 +52,7 @@ # 201111-1957 - Fix for side menu issue #1233 # 201117-2353 - Changes for better compatibility with non-latin data input # 210316-2344 - Changed lead-modify page links to javascript because of Chrome +# 220222-1947 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -102,13 +103,27 @@ if (isset($_GET["archive_search"])) {$archive_search=$_GET["archive_search"];} if (isset($_GET["called_count"])) {$called_count=$_GET["called_count"];} elseif (isset($_POST["called_count"])) {$called_count=$_POST["called_count"];} +$report_name = 'Search Leads Logs'; + $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); +$vicidial_list_fields = 'lead_id,entry_date,modify_date,status,user,vendor_lead_code,source_id,list_id,gmt_offset_now,called_since_last_reset,phone_code,phone_number,title,first_name,middle_initial,last_name,address1,address2,address3,city,state,province,postal_code,country_code,gender,date_of_birth,alt_phone,email,security_phrase,comments,called_count,last_local_call_time,rank,owner'; + +if (strlen($alt_phone_search) < 2) {$alt_phone_search='No';} + +$STARTtime = date("U"); +$TODAY = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$date = date("r"); +$ip = getenv("REMOTE_ADDR"); +$browser = getenv("HTTP_USER_AGENT"); +$log_archive_link=0; + ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,qc_features_active FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,qc_features_active,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -122,38 +137,46 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[6]; $SSlanguage_method = $row[7]; $SSqc_features_active = $row[8]; + $SSallow_web_debug = $row[9]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### -$report_name = 'Search Leads Logs'; - if ($archive_search=="Yes") {$vl_table="vicidial_list_archive";} else {$vl_table="vicidial_list"; $archive_search="No";} -$vicidial_list_fields = 'lead_id,entry_date,modify_date,status,user,vendor_lead_code,source_id,list_id,gmt_offset_now,called_since_last_reset,phone_code,phone_number,title,first_name,middle_initial,last_name,address1,address2,address3,city,state,province,postal_code,country_code,gender,date_of_birth,alt_phone,email,security_phrase,comments,called_count,last_local_call_time,rank,owner'; - -$STARTtime = date("U"); -$TODAY = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); -$date = date("r"); -$ip = getenv("REMOTE_ADDR"); -$browser = getenv("HTTP_USER_AGENT"); -$log_archive_link=0; - -if (strlen($alt_phone_search) < 2) {$alt_phone_search='No';} +$phone = preg_replace('/[^-_0-9a-zA-Z]/','',$phone); +$log_phone = preg_replace('/[^-_0-9a-zA-Z]/', '', $log_phone); +$log_phone_archive = preg_replace('/[^-_0-9a-zA-Z]/', '', $log_phone_archive); +$list_id = preg_replace('/[^0-9]/','',$list_id); +$lead_id = preg_replace('/[^0-9]/','',$lead_id); +$log_lead_id = preg_replace('/[^0-9]/','',$log_lead_id); +$log_lead_id_archive = preg_replace('/[^0-9]/','',$log_lead_id_archive); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); +$vendor_id = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$status); +$first_name = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$first_name); +$last_name = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$last_name); +$email = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$email); +$user = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$user); +$owner = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$owner); +$alt_phone_search = preg_replace('/[^-_0-9a-zA-Z]/', '', $alt_phone_search); +$archive_search = preg_replace('/[^-_0-9a-zA-Z]/', '', $archive_search); +$called_count = preg_replace('/[^0-9]/','',$called_count); if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $status = preg_replace('/[^-_0-9a-zA-Z]/', '', $status); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $status = preg_replace('/[^-_0-9\p{L}]/u', '', $status); } -$phone = preg_replace('/[^0-9]/','',$phone); $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} diff --git a/agc_2-X/trunk/www/vicidial/admin_soundboard.php b/agc_2-X/trunk/www/vicidial/admin_soundboard.php index be3976c6..4df4d150 100644 --- a/agc_2-X/trunk/www/vicidial/admin_soundboard.php +++ b/agc_2-X/trunk/www/vicidial/admin_soundboard.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # this screen manages the optional soundboard tables in ViciDial # @@ -20,10 +20,11 @@ # 170409-1549 - Added IP List validation code # 180503-2215 - Added new help display # 180618-2300 - Modified calls to audio file chooser function +# 220222-1512 - Added allow_web_debug system setting # -$admin_version = '2.14-13'; -$build = '180503-2215'; +$admin_version = '2.14-14'; +$build = '220222-1512'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -89,9 +90,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,allow_emails,active_modules,sounds_central_control_active,qc_features_active,contacts_enabled,enable_languages,active_modules,agent_soundboards,language_method,enable_auto_reports,campaign_cid_areacodes_enabled FROM system_settings;"; +$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,allow_emails,active_modules,sounds_central_control_active,qc_features_active,contacts_enabled,enable_languages,active_modules,agent_soundboards,language_method,enable_auto_reports,campaign_cid_areacodes_enabled,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -115,7 +116,9 @@ if ($qm_conf_ct > 0) $SSlanguage_method = $row[16]; $SSenable_auto_reports = $row[17]; $SScampaign_cid_areacodes_enabled = $row[18]; + $SSallow_web_debug = $row[19]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -123,25 +126,26 @@ if (strlen($DB) < 1) {$DB=0;} $modify_refresh_set=0; +$DB = preg_replace('/[^0-9]/','',$DB); +$rank = preg_replace('/[^0-9]/','',$rank); +$level = preg_replace('/[^0-9]/','',$level); +$parent_rank = preg_replace('/[^0-9]/','',$parent_rank); +$columns_limit = preg_replace('/[^0-9]/','',$columns_limit); +$active = preg_replace('/[^NY]/','',$active); +$ConFiRm = preg_replace('/[^0-9a-zA-Z]/','',$ConFiRm); +$name_position = preg_replace('/[^0-9a-zA-Z]/','',$name_position); +$multi_position = preg_replace('/[^0-9a-zA-Z]/','',$multi_position); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT); +$ADD = preg_replace('/[^-_0-9a-zA-Z]/','',$ADD); +$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); - - $DB = preg_replace('/[^0-9]/','',$DB); - $rank = preg_replace('/[^0-9]/','',$rank); - $level = preg_replace('/[^0-9]/','',$level); - $parent_rank = preg_replace('/[^0-9]/','',$parent_rank); - $columns_limit = preg_replace('/[^0-9]/','',$columns_limit); - - $active = preg_replace('/[^NY]/','',$active); - $avatar_api_user = preg_replace('/[^-_0-9a-zA-Z]/','',$avatar_api_user); $avatar_api_pass = preg_replace('/[^-_0-9a-zA-Z]/','',$avatar_api_pass); - $ConFiRm = preg_replace('/[^0-9a-zA-Z]/','',$ConFiRm); - $name_position = preg_replace('/[^0-9a-zA-Z]/','',$name_position); - $multi_position = preg_replace('/[^0-9a-zA-Z]/','',$multi_position); - + $source_avatar_id = preg_replace('/[^-_0-9a-zA-Z]/','',$source_avatar_id); $soundboard_id = preg_replace('/[^_0-9a-zA-Z]/','',$soundboard_id); $copy_option = preg_replace('/[^_0-9a-zA-Z]/','',$copy_option); $audio_functions = preg_replace('/[^-_0-9a-zA-Z]/', '',$audio_functions); @@ -149,18 +153,33 @@ if ($non_latin < 1) $stage = preg_replace('/[^-_0-9a-zA-Z]/', '',$stage); $user_group = preg_replace('/[^-_0-9a-zA-Z]/', '',$user_group); $soundboard_layout = preg_replace('/[^-_0-9a-zA-Z]/', '',$soundboard_layout); - $avatar_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$avatar_name); $avatar_notes = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$avatar_notes); $audio_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$audio_name); - $audio_filename = preg_replace('/[^-\|\,\_0-9a-zA-Z]/', '',$audio_filename); $parent_audio_filename = preg_replace('/[^-\|\,\_0-9a-zA-Z]/', '',$parent_audio_filename); + $parent_filename = preg_replace('/[^-\|\,\_0-9a-zA-Z]/', '',$parent_filename); } # end of non_latin else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $avatar_api_user = preg_replace('/[^-_0-9\p{L}]/u','',$avatar_api_user); + $avatar_api_pass = preg_replace('/[^-_0-9\p{L}]/u','',$avatar_api_pass); + $source_avatar_id = preg_replace('/[^-_0-9\p{L}]/u','',$source_avatar_id); + $soundboard_id = preg_replace('/[^_0-9\p{L}]/u','',$soundboard_id); + $copy_option = preg_replace('/[^_0-9\p{L}]/u','',$copy_option); + $audio_functions = preg_replace('/[^-_0-9\p{L}]/u', '',$audio_functions); + $audio_display = preg_replace('/[^-_0-9\p{L}]/u', '',$audio_display); + $stage = preg_replace('/[^-_0-9\p{L}]/u', '',$stage); + $user_group = preg_replace('/[^-_0-9\p{L}]/u', '',$user_group); + $soundboard_layout = preg_replace('/[^-_0-9\p{L}]/u', '',$soundboard_layout); + $avatar_name = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$avatar_name); + $avatar_notes = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$avatar_notes); + $audio_name = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$audio_name); + $audio_filename = preg_replace('/[^-\|\,\_0-9\p{L}]/u', '',$audio_filename); + $parent_audio_filename = preg_replace('/[^-\|\,\_0-9\p{L}]/u', '',$parent_audio_filename); + $parent_filename = preg_replace('/[^-\|\,\_0-9\p{L}]/u', '',$parent_filename); } $STARTtime = date("U"); @@ -540,7 +559,7 @@ if ($ADD==162111111111) echo ""._QXZ("Soundboard Name").": $NWB#soundboard-avatar_name$NWE\n"; echo ""._QXZ("Soundboard Notes").": $NWB#soundboard-avatar_name$NWE\n"; echo ""._QXZ("Soundboard API User").": $NWB#soundboard-avatar_api_user$NWE\n"; - echo ""._QXZ("Soundboard API Pass").": $NWB#soundboard-avatar_api_pass$NWE\n"; + echo ""._QXZ("Soundboard API Pass").": $NWB#soundboard-avatar_api_pass$NWE\n"; echo ""._QXZ("Admin User Group").": $NWB#soundboard-avatar_name$NWE\n"; echo ""._QXZ("Soundboard Notes").": $NWB#soundboard-avatar_notes$NWE\n"; echo ""._QXZ("Soundboard API User").": $NWB#soundboard-avatar_api_user$NWE\n"; - echo ""._QXZ("Soundboard API Pass").": $NWB#soundboard-avatar_api_pass$NWE\n"; + echo ""._QXZ("Soundboard API Pass").": $NWB#soundboard-avatar_api_pass$NWE\n"; echo ""._QXZ("Active").": $NWB#soundboard-active$NWE\n"; echo ""._QXZ("Audio Functions").": $NWB#soundboard-audio_functions$NWE\n"; echo ""._QXZ("Audio Display").": $NWB#soundboard-audio_display$NWE\n"; diff --git a/agc_2-X/trunk/www/vicidial/admin_url_multi.php b/agc_2-X/trunk/www/vicidial/admin_url_multi.php index e65d68b4..717ba826 100644 --- a/agc_2-X/trunk/www/vicidial/admin_url_multi.php +++ b/agc_2-X/trunk/www/vicidial/admin_url_multi.php @@ -18,10 +18,11 @@ # 180503-2215 - Added new help display # 211117-2006 - Added minimum call length field # 220127-1900 - Added display of the URL ID +# 220222-1959 - Added allow_web_debug system setting # -$admin_version = '2.14-8'; -$build = '220127-1900'; +$admin_version = '2.14-9'; +$build = '220222-1959'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -67,9 +68,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,qc_features_active FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,qc_features_active,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $ss_conf_ct = mysqli_num_rows($rslt); if ($ss_conf_ct > 0) { @@ -79,39 +80,41 @@ if ($ss_conf_ct > 0) $SSenable_languages = $row[2]; $SSlanguage_method = $row[3]; $SSqc_features_active = $row[4]; + $SSallow_web_debug = $row[5]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$url_id = preg_replace('/[^0-9]/','',$url_id); +$active = preg_replace('/[^A-Z]/','',$active); +$url_call_length = preg_replace('/[^0-9]/','',$url_call_length); +$url_rank = preg_replace('/[^-0-9]/','',$url_rank); +$SUBMIT = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$SUBMIT); +$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action); +$url_address = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$url_address); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); - $url_id = preg_replace('/[^0-9]/','',$url_id); $campaign_id = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign_id); $entry_type = preg_replace('/[^_0-9a-zA-Z]/','',$entry_type); - $active = preg_replace('/[^A-Z]/','',$active); $url_type = preg_replace('/[^_0-9a-zA-Z]/','',$url_type); - $url_rank = preg_replace('/[^-0-9]/','',$url_rank); $url_statuses = preg_replace('/[^- _0-9a-zA-Z]/','',$url_statuses); $url_lists = preg_replace('/[^- _0-9]/','',$url_lists); $url_description = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$url_description); - $url_call_length = preg_replace('/[^0-9]/','',$url_call_length); } # end of non_latin else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $url_id = preg_replace('/[^0-9]/','',$url_id); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); $campaign_id = preg_replace('/[^-_0-9\p{L}]/u','',$campaign_id); $entry_type = preg_replace('/[^_0-9\p{L}]/u','',$entry_type); - $active = preg_replace('/[^A-Z]/','',$active); $url_type = preg_replace('/[^_0-9\p{L}]/u','',$url_type); - $url_rank = preg_replace('/[^-0-9]/','',$url_rank); $url_statuses = preg_replace('/[^- _0-9\p{L}]/u','',$url_statuses); $url_lists = preg_replace('/[^- _0-9]/','',$url_lists); $url_description = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$url_description); - $url_call_length = preg_replace('/[^0-9]/','',$url_call_length); } $STARTtime = date("U"); diff --git a/agc_2-X/trunk/www/vicidial/admin_user_list_new.php b/agc_2-X/trunk/www/vicidial/admin_user_list_new.php index 59fcd422..89ee75fe 100644 --- a/agc_2-X/trunk/www/vicidial/admin_user_list_new.php +++ b/agc_2-X/trunk/www/vicidial/admin_user_list_new.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # this screen will control the optional user list new limit override settings # @@ -11,10 +11,11 @@ # 161031-1500 - Added overall user option # 170409-1546 - Added IP List validation code # 180503-2215 - Added new help display +# 220222-2008 - Added allow_web_debug system setting # -$admin_version = '2.14-3'; -$build = '170409-1546'; +$admin_version = '2.14-5'; +$build = '220222-2008'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -46,9 +47,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,qc_features_active,user_territories_active,user_new_lead_limit FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,qc_features_active,user_territories_active,user_new_lead_limit,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $ss_conf_ct = mysqli_num_rows($rslt); if ($ss_conf_ct > 0) { @@ -60,22 +61,29 @@ if ($ss_conf_ct > 0) $SSqc_features_active = $row[4]; $SSuser_territories_active = $row[5]; $SSuser_new_lead_limit = $row[6]; + $SSallow_web_debug = $row[7]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id); +$user_override = preg_replace('/[^-0-9]/','',$user_override); +$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action); +$stage = preg_replace('/[^-_0-9a-zA-Z]/','',$stage); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); $user = preg_replace('/[^-_0-9a-zA-Z]/','',$user); - $list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id); - $user_override = preg_replace('/[^-0-9]/','',$user_override); } # end of non_latin else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); } $STARTtime = date("U"); diff --git a/agc_2-X/trunk/www/vicidial/leadloader_template_display.php b/agc_2-X/trunk/www/vicidial/leadloader_template_display.php index f2451b81..69aa9329 100644 --- a/agc_2-X/trunk/www/vicidial/leadloader_template_display.php +++ b/agc_2-X/trunk/www/vicidial/leadloader_template_display.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell,Joe Johnson LICENSE: AGPLv2 # # CHANGES # 120402-2238 - First Build @@ -18,6 +18,7 @@ # 170409-1534 - Added IP List validation code # 171204-1518 - Fix for custom field duplicate issue, removed link to old lead loader # 210312-1700 - Added layout editing functionality +# 220222-1059 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -52,9 +53,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -65,22 +66,35 @@ if ($qm_conf_ct > 0) $webroot_writable = $row[3]; $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; + $SSallow_web_debug = $row[6]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$list_id = preg_replace('/in_file/', '0', $list_id); +$list_id = preg_replace('/[^0-9]/', '', $list_id); +$form_action = preg_replace('/[^- \_0-9a-zA-Z]/', '', $form_action); +$custom_fields_enabled = preg_replace('/[^- \_0-9a-zA-Z]/', '', $custom_fields_enabled); +$delimiter = preg_replace("/\<|\>|\'|\"|;/",'',$delimiter); + +# Variables filtered further down in the code +# $buffer +# $sample_template_file +# $sample_template_file_name + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $template_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $template_id); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $template_id = preg_replace('/[^-_0-9\p{L}]/u', '', $template_id); } -$list_id = preg_replace('/in_file/', '0', $list_id); -$list_id = preg_replace('/[^0-9]/', '', $list_id); $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} @@ -343,7 +357,7 @@ else if ($form_action=="update_template" && $template_id) if ($DB>0) {echo "$A_field_label[$o]|$A_field_type[$o]\n";} - if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') and ($A_field_type[$o]!='SWITCH') ) + if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') and ($A_field_type[$o]!='SWITCH') and ($A_field_type[$o]!='BUTTON') ) { if (!preg_match("/\|$A_field_label[$o]\|/",$vicidial_list_fields)) { @@ -498,7 +512,7 @@ else if ($DB>0) {echo "$A_field_label[$o]|$A_field_type[$o]\n";} - if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') and ($A_field_type[$o]!='SWITCH') ) + if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') and ($A_field_type[$o]!='SWITCH') and ($A_field_type[$o]!='BUTTON') ) { if (!preg_match("/\|$A_field_label[$o]\|/",$vicidial_list_fields)) { diff --git a/agc_2-X/trunk/www/vicidial/nanpa_type.php b/agc_2-X/trunk/www/vicidial/nanpa_type.php index 17348b5b..997deb98 100644 --- a/agc_2-X/trunk/www/vicidial/nanpa_type.php +++ b/agc_2-X/trunk/www/vicidial/nanpa_type.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed to work with the NANPA exchange(NPA-NXX-X) data and # the wireless-to-wired and wired-to-wireless number portability data from @@ -31,10 +31,11 @@ # 140702-2251 - Added prefix phone type of V as landline # 170409-1531 - Added IP List validation code # 210618-1012 - Added CORS support +# 220222-1917 - Added allow_web_debug system setting # -$version = '2.14-4'; -$build = '210618-1012'; +$version = '2.14-5'; +$build = '220222-1917'; $php_script='nanpa_type.php'; $startMS = microtime(); @@ -63,25 +64,35 @@ header ("Pragma: no-cache"); // HTTP/1.0 ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT pass_hash_enabled FROM system_settings;"; +$stmt = "SELECT use_non_latin,pass_hash_enabled,allow_web_debug FROM system_settings;"; $rslt=mysqli_query($link, $stmt); $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { $row=mysqli_fetch_row($rslt); - $SSpass_hash_enabled = $row[0]; + $non_latin = $row[0]; + $SSpass_hash_enabled = $row[1]; + $SSallow_web_debug = $row[2]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### $DB=preg_replace('/[^0-9]/','',$DB); -$user = preg_replace("/'|\"|\\\\|;/","",$user); -$pass = preg_replace("/'|\"|\\\\|;/","",$pass); -$user=preg_replace('/[^-_0-9a-zA-Z]/','',$user); -$pass=preg_replace('/[^-_0-9a-zA-Z]/','',$pass); $function = preg_replace('/[^-\_0-9a-zA-Z]/', '',$function); $phone_number = preg_replace('/[^\|0-9]/','',$phone_number); +if ($non_latin < 1) + { + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); + $pass = preg_replace('/[^-_0-9a-zA-Z]/', '', $pass); + } +else + { + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); + $pass = preg_replace('/[^-_0-9\p{L}]/u', '', $pass); + } + ################################################################################ diff --git a/agc_2-X/trunk/www/vicidial/realtime_report.php b/agc_2-X/trunk/www/vicidial/realtime_report.php index 7aec9991..da52f6ab 100644 --- a/agc_2-X/trunk/www/vicidial/realtime_report.php +++ b/agc_2-X/trunk/www/vicidial/realtime_report.php @@ -55,12 +55,13 @@ # 210314-2039 - Added DID Description for inbound calls # 211216-0846 - Added new User Group options # 220217-2046 - Added input variable filters +# 220221-1514 - Added allow_web_debug system setting # $startMS = microtime(); -$version = '2.14-42'; -$build = '220217-2046'; +$version = '2.14-43'; +$build = '220221-1514'; header ("Content-type: text/html; charset=utf-8"); @@ -151,9 +152,9 @@ $db_source = 'M'; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,report_default_format,enable_pause_code_limits FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,report_default_format,enable_pause_code_limits,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -167,7 +168,9 @@ if ($qm_conf_ct > 0) $agent_whisper_enabled = $row[6]; $SSreport_default_format = $row[7]; $SSenable_pause_code_limits = $row[8]; + $SSallow_web_debug = $row[9]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -339,8 +342,8 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } $RR = preg_replace('/[^0-9]/', '', $RR); $inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $inbound); @@ -383,6 +386,10 @@ $server_ip = preg_replace('/[^-\._0-9a-zA-Z]/', '', $server_ip); $SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); $submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +# Variables filtered further down in the code +# $user_group_filter +# $ingroup_filter + $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -669,7 +676,7 @@ $group_string='|'; $group_ct = count($groups); while($i < $group_ct) { - $groups[$i] = preg_replace('/[^-_0-9a-zA-Z]/', '', $groups[$i]); + $groups[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $groups[$i]); if ( (preg_match("/ $groups[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/ALL-/",$LOGallowed_campaigns)) ) { $group_string .= "$groups[$i]|"; @@ -686,7 +693,7 @@ $user_group_string='|'; $user_group_ct = count($user_group_filter); while($i < $user_group_ct) { - $user_group_filter[$i] = preg_replace('/[^-_0-9a-zA-Z]/', '', $user_group_filter[$i]); + $user_group_filter[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group_filter[$i]); # if ( (preg_match("/ $user_group_filter[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/ALL-/",$LOGallowed_campaigns)) ) # { $user_group_string .= "$user_group_filter[$i]|"; @@ -703,7 +710,7 @@ $ingroup_string='|'; $ingroup_ct = count($ingroup_filter); while($i < $ingroup_ct) { - $ingroup_filter[$i] = preg_replace('/[^-_0-9a-zA-Z]/', '', $ingroup_filter[$i]); + $ingroup_filter[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $ingroup_filter[$i]); $ingroup_string .= "$ingroup_filter[$i]|"; $ingroup_SQL .= "'$ingroup_filter[$i]',"; $usergroupQS .= "&ingroup_filter[]=$ingroup_filter[$i]"; diff --git a/agc_2-X/trunk/www/vicidial/realtime_report_mobile.php b/agc_2-X/trunk/www/vicidial/realtime_report_mobile.php index 20a80031..9fbd55ad 100644 --- a/agc_2-X/trunk/www/vicidial/realtime_report_mobile.php +++ b/agc_2-X/trunk/www/vicidial/realtime_report_mobile.php @@ -1,7 +1,7 @@ , Joe Johnson LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell , Joe Johnson LICENSE: AGPLv2 # # streamlined mobile version of live real-time stats for the VICIDIAL Auto-Dialer all servers # @@ -15,12 +15,13 @@ # 190228-1535 - Minor pre-release changes # 200309-1819 - Modifications for display formatting # 210827-1818 - Fix for security issue +# 220221-1522 - Added allow_web_debug system setting # $startMS = microtime(); -$version = '2.14-3'; -$build = '200309-1819'; +$version = '2.14-4'; +$build = '220221-1522'; header ("Content-type: text/html; charset=utf-8"); @@ -89,7 +90,7 @@ if (isset($_GET["PRESETstats"])) {$PRESETstats=$_GET["PRESETstats"];} elseif (isset($_POST["PRESETstats"])) {$PRESETstats=$_POST["PRESETstats"];} if (isset($_GET["AGENTtimeSTATS"])) {$AGENTtimeSTATS=$_GET["AGENTtimeSTATS"];} elseif (isset($_POST["AGENTtimeSTATS"])) {$AGENTtimeSTATS=$_POST["AGENTtimeSTATS"];} -if (isset($_GET["INGROUPcolorOVERRIDE"])) {$INGROUPcolorOVERRIDE=$_GET["INGROUPcolorOVERRIDE"];} +if (isset($_GET["INGROUPcolorOVERRIDE"])) {$INGROUPcolorOVERRIDE=$_GET["INGROUPcolorOVERRIDE"];} elseif (isset($_POST["INGROUPcolorOVERRIDE"])) {$INGROUPcolorOVERRIDE=$_POST["INGROUPcolorOVERRIDE"];} if (isset($_GET["droppedOFtotal"])) {$droppedOFtotal=$_GET["droppedOFtotal"];} elseif (isset($_POST["droppedOFtotal"])) {$droppedOFtotal=$_POST["droppedOFtotal"];} @@ -101,9 +102,9 @@ $db_source = 'M'; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,report_default_format,enable_pause_code_limits FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,report_default_format,enable_pause_code_limits,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -117,7 +118,9 @@ if ($qm_conf_ct > 0) $agent_whisper_enabled = $row[6]; $SSreport_default_format = $row[7]; $SSenable_pause_code_limits = $row[8]; + $SSallow_web_debug = $row[9]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -263,8 +266,8 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } $RR = preg_replace('/[^0-9]/', '', $RR); $inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $inbound); @@ -295,6 +298,8 @@ $INGROUPcolorOVERRIDE = preg_replace('/[^-_0-9a-zA-Z]/', '', $INGROUPcolorOVERRI $droppedOFtotal = preg_replace('/[^-_0-9a-zA-Z]/', '', $droppedOFtotal); $server_ip=preg_replace("/[^0-9\.]/", "", $server_ip); $user_group_filter=preg_replace('/[^-_0-9\p{L}]/u','',$user_group_filter); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); $TOTALdisplay+=$ALLINGROUPstats; $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; diff --git a/agc_2-X/trunk/www/vicidial/vicidial_custom_reports_admin.php b/agc_2-X/trunk/www/vicidial/vicidial_custom_reports_admin.php index 06333ef2..8c47e88f 100644 --- a/agc_2-X/trunk/www/vicidial/vicidial_custom_reports_admin.php +++ b/agc_2-X/trunk/www/vicidial/vicidial_custom_reports_admin.php @@ -5,7 +5,7 @@ # custom reports and make them available to user groups # of their choosing # -# Copyright (C) 2018 Joseph Johnson LICENSE: AGPLv2 +# Copyright (C) 2022 Joseph Johnson LICENSE: AGPLv2 # # CHANGES # @@ -16,6 +16,7 @@ # 170829-0040 - Added screen color settings # 171002-2140 - Added capability to add/modify preset variables # 180508-2215 - Added new help display +# 220221-1926 - Added allow_web_debug system setting # $startMS = microtime(); @@ -66,9 +67,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -81,9 +82,32 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[5]; $SSlanguage_method = $row[6]; $active_modules = $row[7]; + $SSallow_web_debug = $row[8]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### + +$report_name = preg_replace('/[^- \,\|\_0-9a-zA-Z]/', '', $report_name); +$upd_report_name = preg_replace('/[^- \,\|\_0-9a-zA-Z]/', '', $upd_report_name); +$domain = preg_replace('/[^-\:\.\/\_0-9a-zA-Z]/', '', $domain); +$upd_domain = preg_replace('/[^-\:\.\/\_0-9a-zA-Z]/', '', $upd_domain); +$path_name = preg_replace('/[^-\[\]\:\.\/\_0-9a-zA-Z]/', '', $path_name); +$upd_path_name = preg_replace('/[^-\[\]\:\.\/\_0-9a-zA-Z]/', '', $upd_path_name); +$presets_string = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$presets_string); +$upd_presets_string = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$upd_presets_string); +$slave = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$slave); +$upd_slave = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$upd_slave); +$add_custom_report = preg_replace('/[^- \,\|\_0-9a-zA-Z]/', '', $add_custom_report); +$delete_custom_report = preg_replace('/[^- \,\|\_0-9a-zA-Z]/', '', $delete_custom_report); +$update_custom_report = preg_replace('/[^- \,\|\_0-9a-zA-Z]/', '', $update_custom_report); +$upd_custom_report_id = preg_replace('/[^- \,\|\_0-9a-zA-Z]/', '', $upd_custom_report_id); +$upd_report_name = preg_replace('/[^- \,\|\_0-9a-zA-Z]/', '', $upd_report_name); + +# Variables filtered further down in the code +# $custom_reports_user_groups +# $upd_custom_reports_user_groups + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -91,8 +115,8 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; @@ -242,7 +266,9 @@ if ($add_custom_report) { if (mysqli_affected_rows($link)<1) { $error_msg="
"._QXZ("INSERT FAILED")."
"; } else { - $user_group_stmt="select user_group, allowed_custom_reports from vicidial_user_groups where user_group in ('".implode("','", $custom_reports_user_groups)."') $LOGadmin_viewable_groupsSQL"; + $temp_custom_reports_user_groups = implode("','", $custom_reports_user_groups); + $temp_custom_reports_user_groups = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$temp_custom_reports_user_groups); + $user_group_stmt="select user_group, allowed_custom_reports from vicidial_user_groups where user_group in ('".$temp_custom_reports_user_groups."') $LOGadmin_viewable_groupsSQL"; # echo $user_group_stmt."
\n"; $user_group_rslt=mysql_to_mysqli($user_group_stmt, $link); while ($user_group_row=mysqli_fetch_array($user_group_rslt)) { diff --git a/agc_2-X/trunk/www/vicidial/vicidial_sales_viewer.php b/agc_2-X/trunk/www/vicidial/vicidial_sales_viewer.php index f60ed679..294bcc43 100644 --- a/agc_2-X/trunk/www/vicidial/vicidial_sales_viewer.php +++ b/agc_2-X/trunk/www/vicidial/vicidial_sales_viewer.php @@ -3,7 +3,7 @@ # vicidial_sales_viewer.php - VICIDIAL administration page # # -# Copyright (C) 2017 Joe Johnson,Matt Florell LICENSE: AGPLv2 +# Copyright (C) 2022 Joe Johnson,Matt Florell LICENSE: AGPLv2 # # CHANGES # 80310-1500 - first build @@ -15,6 +15,7 @@ # 141007-2147 - Finalized adding QXZ translation to all admin files # 170217-1213 - Fixed non-latin auth issue #995 # 170526-2044 - Fixed unfilter variables issue #1015 +# 220221-1921 - Added allow_web_debug system setting # if (isset($_GET["dcampaign"])) {$dcampaign=$_GET["dcampaign"];} @@ -43,9 +44,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -55,10 +56,19 @@ if ($qm_conf_ct > 0) $SSoutbound_autodial_active = $row[2]; $SSenable_languages = $row[3]; $SSlanguage_method = $row[4]; + $SSallow_web_debug = $row[5]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$dcampaign = preg_replace('/[^0-9a-zA-Z]/', '', $dcampaign); +$list_ids = preg_replace('/[^\,0-9a-zA-Z]/', '', $list_ids); +$forc = preg_replace('/[^0-9a-zA-Z]/', '', $forc); +$submit_report = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit_report); +$sales_number = preg_replace('/[^-_0-9a-zA-Z]/', '', $sales_number); +$sales_time_frame = preg_replace('/[^-_0-9a-zA-Z]/', '', $sales_time_frame); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -66,12 +76,9 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$dcampaign = preg_replace('/[^0-9a-zA-Z]/', '', $dcampaign); -$list_ids = preg_replace('/[^\,0-9a-zA-Z]/', '', $list_ids); -$forc = preg_replace('/[^0-9a-zA-Z]/', '', $forc); $auth=0; $reports_auth=0; diff --git a/agc_2-X/trunk/www/vicidial/whiteboard_reports.php b/agc_2-X/trunk/www/vicidial/whiteboard_reports.php index a1631faf..636d80e4 100644 --- a/agc_2-X/trunk/www/vicidial/whiteboard_reports.php +++ b/agc_2-X/trunk/www/vicidial/whiteboard_reports.php @@ -1,7 +1,7 @@ , Joe Johnson LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell , Joe Johnson LICENSE: AGPLv2 # # A PHP file that is for generating the stats that are displayed in the whiteboard report. Returns values. # @@ -9,6 +9,7 @@ # 190302-1707 - Added code to exclude active calls from being counted with some stats # 200427-2225 - Added use of slave database, if activated, fixes Issue #1207 # 210823-0948 - Fix for security issue +# 220221-1452 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -60,13 +61,20 @@ if (isset($_GET["rpt_type"])) {$rpt_type=$_GET["rpt_type"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); +if (!$query_date) {$query_date=date("Y-m-d");} +if (!$query_time) {$query_time="08:00:00";} + +if (!$end_date) {$end_date=date("Y-m-d");} +if (!$end_time) {$end_time=date("H:i:00");} + + $report_name="Real-Time Whiteboard Report"; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,admin_screen_colors FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,admin_screen_colors,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {$MAIN.="$stmt\n";} +#if ($DB) {$MAIN.="$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -78,39 +86,12 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $admin_screen_colors = $row[6]; + $SSallow_web_debug = $row[7]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### -if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) ) - { - mysqli_close($link); - $use_slave_server=1; - $db_source = 'S'; - require("dbconnect_mysqli.php"); - $MAIN.="\n"; - } - - -if (!$query_date) {$query_date=date("Y-m-d");} -if (!$query_time) {$query_time="08:00:00";} - -if (!$end_date) {$end_date=date("Y-m-d");} -if (!$end_time) {$end_time=date("H:i:00");} - -if ($hourly_display) - { - $query_date=date("Y-m-d", date("U")-(3600*$hourly_display)); - $query_time=date("H:i:00", date("U")-(3600*$hourly_display)); - $end_date=date("Y-m-d"); - $end_time=date("H:i:00"); - } - -$rpt_string=""; - -$exclude_statuses=array("INCALL", "DISPO", "QUEUE", "DONEM"); -$exc_status_SQL=" and status not in ('".implode("','", $exclude_statuses)."') "; - $query_date=preg_replace("/[^0-9\-]/", "", $query_date); $end_date=preg_replace("/[^0-9\-]/", "", $end_date); $query_time=preg_replace("/[^0-9\:]/", "", $query_time); @@ -128,6 +109,97 @@ $groups=preg_replace('/[^-_0-9\p{L}]/u','',$groups); $dids=preg_replace('/[^-_0-9\p{L}]/u','',$dids); $status_flags=preg_replace('/[^-_0-9\p{L}]/u','',$status_flags); +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$PHP_AUTH_PW); + } +else + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$PHP_AUTH_PW); + } + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1,0); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports='1';"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_to_mysqli($stmt, $link); + $row=mysqli_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports='1';"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_to_mysqli($stmt, $link); + $row=mysqli_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = _QXZ("You are not allowed to view reports"); + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = _QXZ("Login incorrect, please try again"); + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = _QXZ("Too many login attempts, try again in 15 minutes"); + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ($auth_message == 'IPBLOCK') + { + $VDdisplayMESSAGE = _QXZ("Your IP Address is not allowed") . ": $ip"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) ) + { + mysqli_close($link); + $use_slave_server=1; + $db_source = 'S'; + require("dbconnect_mysqli.php"); + $MAIN.="\n"; + } + +if ($hourly_display) + { + $query_date=date("Y-m-d", date("U")-(3600*$hourly_display)); + $query_time=date("H:i:00", date("U")-(3600*$hourly_display)); + $end_date=date("Y-m-d"); + $end_time=date("H:i:00"); + } + +$rpt_string=""; + +$exclude_statuses=array("INCALL", "DISPO", "QUEUE", "DONEM"); +$exc_status_SQL=" and status not in ('".implode("','", $exclude_statuses)."') "; + + if (preg_match("/status_performance/", $rpt_type)) { if (!$campaigns || in_array("--ALL--", $campaigns)) { $campaign_id_SQL="";