Added allow_web_debug system setting to more admin web scripts

git-svn-id: svn://192.168.202.10@3570 3d104415-ff17-0410-8863-d5cf3c621b8a
2022-02-23 04:51:07 +00:00
parent 9f546e9970
commit 0497f0c32f
28 changed files with 922 additions and 406 deletions
@@ -1,7 +1,7 @@
 <?php
 # AST_admin_template_maker.php - version 2.14
 # 
-# Copyright (C) 2021  Matt Florell,Joe Johnson <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell,Joe Johnson <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 120402-2132 - First Build
@@ -18,6 +18,7 @@
 # 180503-2215 - Added new help display
 # 180927-0633 - Fix for deleted template function in alternate language, issue #1127
 # 210312-1700 - Added layout editing functionality
+# 220222-1100 - Added allow_web_debug system setting
 #

 require("dbconnect_mysqli.php");
@@ -51,7 +52,7 @@ if (isset($_GET["submit_template"]))				{$submit_template=$_GET["submit_template
 	elseif (isset($_POST["submit_template"]))		{$submit_template=$_POST["submit_template"];}
 if (isset($_GET["submit_edited_template"]))				{$submit_edited_template=$_GET["submit_edited_template"];}
 	elseif (isset($_POST["submit_edited_template"]))		{$submit_edited_template=$_POST["submit_edited_template"];}
-if (isset($_GET["edit_standard_fields_layout"]))				{$edit_standard_fields_layout=$_GET["edit_standard_fields_layout"];}
+if (isset($_GET["edit_standard_fields_layout"]))			{$edit_standard_fields_layout=$_GET["edit_standard_fields_layout"];}
 	elseif (isset($_POST["edit_standard_fields_layout"]))	{$edit_standard_fields_layout=$_POST["edit_standard_fields_layout"];}
 if (isset($_GET["edit_custom_fields_layout"]))				{$edit_custom_fields_layout=$_GET["edit_custom_fields_layout"];}
 	elseif (isset($_POST["edit_custom_fields_layout"]))		{$edit_custom_fields_layout=$_POST["edit_custom_fields_layout"];}
@@ -71,9 +72,9 @@ $vicidial_listloader_fields = '|vendor_lead_code|source_id|phone_code|phone_numb
 $US='_';
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method,admin_screen_colors FROM system_settings;";
+$stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method,admin_screen_colors,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -85,10 +86,31 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =		$row[4];
 	$SSlanguage_method =		$row[5];
 	$SSadmin_screen_colors =	$row[6];
+	$SSallow_web_debug =		$row[7];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

+$list_id_override = preg_replace('/[^0-9]/','',$list_id_override);
+$template_list_id = preg_replace('/[^0-9]/','',$template_list_id);
+$template_id = preg_replace("/\<|\>|'|\"|\\\\|;/","",$template_id);
+$template_name = preg_replace("/\<|\>|'|\"|\\\\|;/","",$template_name);
+$template_description = preg_replace("/\<|\>|'|\"|\\\\|;/","",$template_description);
+$standard_fields_layout = preg_replace("/\<|\>|'|\"|\\\\|;/","",$standard_fields_layout);
+$custom_table = preg_replace("/\<|\>|'|\"|\\\\|;/","",$custom_table);
+$custom_fields_layout = preg_replace("/\<|\>|'|\"|\\\\|;/","",$custom_fields_layout);
+$edit_standard_fields_layout = preg_replace("/\<|\>|'|\"|\\\\|;/","",$edit_standard_fields_layout);
+$edit_custom_fields_layout = preg_replace("/\<|\>|'|\"|\\\\|;/","",$edit_custom_fields_layout);
+$delete_template = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $delete_template);
+$submit_template = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $submit_template);
+$submit_edited_template = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $submit_edited_template);
+$file_format = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$file_format);
+$file_delimiter = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$file_delimiter);
+
+# Variables filtered further down in the code
+# $template_statuses
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -96,19 +118,9 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
-$list_id_override = preg_replace('/[^0-9]/','',$list_id_override);
-$template_list_id = preg_replace('/[^0-9]/','',$template_list_id);
-$template_id = preg_replace("/'|\"|\\\\|;/","",$template_id);
-$template_name = preg_replace("/'|\"|\\\\|;/","",$template_name);
-$template_description = preg_replace("/'|\"|\\\\|;/","",$template_description);
-$standard_fields_layout = preg_replace("/'|\"|\\\\|;/","",$standard_fields_layout);
-$custom_table = preg_replace("/'|\"|\\\\|;/","",$custom_table);
-$custom_fields_layout = preg_replace("/'|\"|\\\\|;/","",$custom_fields_layout);
-$edit_standard_fields_layout = preg_replace("/'|\"|\\\\|;/","",$edit_standard_fields_layout);
-$edit_custom_fields_layout = preg_replace("/'|\"|\\\\|;/","",$edit_custom_fields_layout);

 if ($submit_edited_template)
 	{
@@ -197,11 +209,14 @@ if ($submit_template==_QXZ("SUBMIT TEMPLATE") && $template_id && $template_name

 	$status_str="";
 	$status_count=count($template_statuses);
-	for ($q=0; $q<count($template_statuses); $q++) {
-			echo "<!-- $template_statuses[$q] //-->\n";
+	for ($q=0; $q<count($template_statuses); $q++) 
+		{
+		$template_statuses[$q] = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$template_statuses[$q]);
+
+		echo "<!-- $template_statuses[$q] //-->\n";

 		$status_str.="$template_statuses[$q]|";
-	}
+		}
 	echo "<!-- $status_str //-->";
 	$status_str=preg_replace('/\|$/', '', $status_str);
 	if (preg_match('/\-\-ALL\-\-/', $status_str)) {$status_str="";}
@@ -1,7 +1,7 @@
 <?php
 # AST_rt_whiteboard_rpt.php
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
 #
 # Real-time report that allows users to create a customized, graphical display of various data sets
 #
@@ -11,6 +11,7 @@
 # 180512-0000 - Fixed slave server capability
 # 190927-1758 - Fixed PHP7 array issue
 # 210827-1818 - Fix for security issue
+# 220221-1505 - Added allow_web_debug system setting
 #

 $startMS = microtime();
@@ -56,6 +57,12 @@ if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_display_type"];}
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}

+if (!$query_date) {$query_date=date("Y-m-d");}
+if (!$end_date) {$end_date=date("Y-m-d");}
+if (!$query_time) {$query_time="08:00:00";}
+if (!$end_time) {$end_time="17:00:00";}
+if (strlen($shift)<2) {$shift='ALL';}
+
 $query_date = preg_replace('/[^-0-9]/','',$query_date);
 $end_date = preg_replace('/[^-0-9]/','',$end_date);
 $query_time=preg_replace("/[^0-9\:]/", "", $query_time);
@@ -71,19 +78,13 @@ $SUBMIT=preg_replace('/[^-_0-9\p{L}]/u','',$SUBMIT);
 $DB = preg_replace('/[^0-9]/','',$DB);
 $report_display_type=preg_replace('/[^_\p{L}]/u','',$report_display_type);

-if (!$query_date) {$query_date=date("Y-m-d");}
-if (!$end_date) {$end_date=date("Y-m-d");}
-if (!$query_time) {$query_time="08:00:00";}
-if (!$end_time) {$end_time="17:00:00";}
-
-if (strlen($shift)<2) {$shift='ALL';}
 $report_name="Real-Time Whiteboard Report";

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,admin_screen_colors FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,admin_screen_colors,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$MAIN.="$stmt\n";}
+#if ($DB) {$MAIN.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -95,10 +96,23 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
 	$admin_screen_colors =			$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
+
 if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) )
 	{
 	mysqli_close($link);
@@ -120,17 +134,6 @@ if ($gmt_conf_ct > 0)
 	$epoch_offset =		(($local_gmt + $dst) * 3600);
 	}

-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -1,13 +1,14 @@
 <?php
 # AST_rt_whiteboard_rpt_mobile.php
 # 
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>, Joe Johnson <joej@vicidial.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>, Joe Johnson <joej@vicidial.com>    LICENSE: AGPLv2
 #
 # Mobile version of real-time report that allows users to create a customized, graphical display of various data sets
 #
 # 190227-1259 - Initial build
 # 200309-1819 - Modifications for display formatting
 # 210827-1818 - Fix for security issue
+# 220221-1513 - Added allow_web_debug system setting
 #

 $startMS = microtime();
@@ -78,9 +79,9 @@ $report_name="Real-Time Whiteboard Report";

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,admin_screen_colors FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,admin_screen_colors,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$MAIN.="$stmt\n";}
+#if ($DB) {$MAIN.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -92,10 +93,23 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
 	$admin_screen_colors =			$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
+
 if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) )
 	{
 	mysqli_close($link);
@@ -117,17 +131,6 @@ if ($gmt_conf_ct > 0)
 	$epoch_offset =		(($local_gmt + $dst) * 3600);
 	}

-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -1,7 +1,7 @@
 <?php 
 # AST_timeonVDADall.php
 # 
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # live real-time stats for the VICIDIAL Auto-Dialer all servers
 #
@@ -126,10 +126,11 @@
 # 210618-1011 - Added CORS support
 # 210625-1432 - Added options.php RS_BargeSwap variable
 # 220217-2045 - Added input variable filters
+# 220221-1535 - Added allow_web_debug system setting
 #

-$version = '2.14-111';
-$build = '220217-2045';
+$version = '2.14-112';
+$build = '220221-1536';
 $php_script='AST_timeonVDADall.php';

 require("dbconnect_mysqli.php");
@@ -270,9 +271,9 @@ $db_source = 'M';

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,allow_chats,cache_carrier_stats_realtime,report_default_format,ofcom_uk_drop_calc,enable_pause_code_limits,timeclock_end_of_day FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,allow_chats,cache_carrier_stats_realtime,report_default_format,ofcom_uk_drop_calc,enable_pause_code_limits,timeclock_end_of_day,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -290,7 +291,9 @@ if ($qm_conf_ct > 0)
 	$SSofcom_uk_drop_calc =			$row[10];
 	$SSenable_pause_code_limits =	$row[11];
 	$SStimeclock_end_of_day =		$row[12];
+	$SSallow_web_debug =			$row[13];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) )
@@ -413,8 +416,8 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
 $RR = preg_replace('/[^0-9]/', '', $RR);
 $inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $inbound);
@@ -457,6 +460,10 @@ $server_ip = preg_replace('/[^-\._0-9a-zA-Z]/', '', $server_ip);
 $SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
 $submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);

+# Variables filtered further down in the code
+# $user_group_filter
+# $ingroup_filter
+
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -1,7 +1,7 @@
 <?php 
 # AST_timeonVDADall_mobile.php
 # 
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # live real-time stats for the VICIDIAL Auto-Dialer all servers
 #
@@ -9,10 +9,11 @@
 # 
 # CHANGELOG:
 # 200318-1124 - First build, based upon AST_timeonVDADall.php
+# 220221-1536 - Added allow_web_debug system setting
 #

-$version = '2.14-1';
-$build = '200318-1124';
+$version = '2.14-2';
+$build = '220221-1536';

 header ("Content-type: text/html; charset=utf-8");

@@ -95,10 +96,10 @@ if (isset($_GET["droppedOFtotal"]))				{$droppedOFtotal=$_GET["droppedOFtotal"];
 	elseif (isset($_POST["droppedOFtotal"]))	{$droppedOFtotal=$_POST["droppedOFtotal"];}
 if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_display_type"];}
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
-if (isset($_GET["RTdisplay_type"]))			{$RTdisplay_type=$_GET["RTdisplay_type"];}
+if (isset($_GET["RTdisplay_type"]))				{$RTdisplay_type=$_GET["RTdisplay_type"];}
 	elseif (isset($_POST["RTdisplay_type"]))	{$RTdisplay_type=$_POST["RTdisplay_type"];}
 if (isset($_GET["mobile_device"]))				{$mobile_device=$_GET["mobile_device"];}
-	elseif (isset($_POST["mobile_device"]))	{$mobile_device=$_POST["mobile_device"];}
+	elseif (isset($_POST["mobile_device"]))		{$mobile_device=$_POST["mobile_device"];}

 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

@@ -107,9 +108,9 @@ $db_source = 'M';

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,allow_chats,cache_carrier_stats_realtime,report_default_format,ofcom_uk_drop_calc,enable_pause_code_limits FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,allow_chats,cache_carrier_stats_realtime,report_default_format,ofcom_uk_drop_calc,enable_pause_code_limits,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -126,10 +127,12 @@ if ($qm_conf_ct > 0)
 	$SSreport_default_format =		$row[9];
 	$SSofcom_uk_drop_calc =			$row[10];
 	$SSenable_pause_code_limits =	$row[11];
+	$SSallow_web_debug =			$row[12];
 	}
+if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
-if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;}

 if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) )
 	{
@@ -247,9 +250,54 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
+$RR = preg_replace('/[^0-9]/', '', $RR);
+$inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $inbound);
+$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
+$groups[0] = preg_replace('/[^-_0-9a-zA-Z]/', '', $groups[0]);
+$usergroup = preg_replace('/[^-_0-9a-zA-Z]/', '', $usergroup);
+$DB = preg_replace('/[^0-9]/', '', $DB);
+$adastats = preg_replace('/[^-_0-9a-zA-Z]/', '', $adastats);
+$SIPmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $SIPmonitorLINK);
+$IAXmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $IAXmonitorLINK);
+$UGdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $UGdisplay);
+$UidORname = preg_replace('/[^-_0-9a-zA-Z]/', '', $UidORname);
+$orderby = preg_replace('/[^-_0-9a-zA-Z]/', '', $orderby);
+$SERVdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $SERVdisplay);
+$CALLSdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CALLSdisplay);
+$PHONEdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHONEdisplay);
+$CUSTPHONEdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CUSTPHONEdisplay);
+$CUSTINFOdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CUSTINFOdisplay);
+if ($CUSTINFOdisplay==1)	{$CUSTPHONEdisplay=0;}	# only one of these should be on at one time
+if ($CUSTPHONEdisplay==1)	{$CUSTINFOdisplay=0;}	# only one of these should be on at one time
+$NOLEADSalert = preg_replace('/[^-_0-9a-zA-Z]/', '', $NOLEADSalert);
+$DROPINGROUPstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $DROPINGROUPstats);
+$ALLINGROUPstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $ALLINGROUPstats);
+$with_inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $with_inbound);
+$monitor_active = preg_replace('/[^-_0-9a-zA-Z]/', '', $monitor_active);
+$monitor_phone = preg_replace('/[^-_0-9a-zA-Z]/', '', $monitor_phone);
+$CARRIERstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $CARRIERstats);
+$PRESETstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $PRESETstats);
+$AGENTtimeSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $AGENTtimeSTATS);
+$parkSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $parkSTATS);
+$SLAinSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $SLAinSTATS);
+$INGROUPcolorOVERRIDE = preg_replace('/[^-_0-9a-zA-Z]/', '', $INGROUPcolorOVERRIDE);
+$droppedOFtotal = preg_replace('/[^-_0-9a-zA-Z]/', '', $droppedOFtotal);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+$mobile_device = preg_replace('/[^-_0-9a-zA-Z]/', '', $mobile_device);
+$RTdisplay_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTdisplay_type);
+$RTajax = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTajax);
+$RTpass = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTpass);
+$RTuser = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTuser);
+$server_ip = preg_replace('/[^-\._0-9a-zA-Z]/', '', $server_ip);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+
+# Variables filtered further down in the code
+# $user_group_filter
+# $ingroup_filter

 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
@@ -1,7 +1,7 @@
 <?php
 # NANPA_running_processes.php
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script shows running NANPA filter batch proccesses
 #
@@ -12,10 +12,11 @@
 # 160108-2300 - Changed some mysqli_query to mysql_to_mysqli for consistency
 # 170409-1537 - Added IP List validation code
 # 170822-2230 - Added screen color settings
+# 220222-1917 - Added allow_web_debug system setting
 #

-$version = '2.14-5';
-$build = '170409-1537';
+$version = '2.14-6';
+$build = '220222-1917';
 $startMS = microtime();

 require("dbconnect_mysqli.php");
@@ -34,7 +35,7 @@ if (isset($_GET["process_limit"]))			{$process_limit=$_GET["process_limit"];}

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
 if ($DB) {$MAIN.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
@@ -47,10 +48,18 @@ if ($qm_conf_ct > 0)
 	$reports_use_slave_db =			$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

+$process_limit = preg_replace('/[^-_0-9a-zA-Z]/', '', $process_limit);
+$show_history = preg_replace('/[^-_0-9a-zA-Z]/', '', $show_history);
+
+# Variables filtered further down in the code
+# $output_codes_to_display
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -58,12 +67,10 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}

-$process_limit = preg_replace('/[^-_0-9a-zA-Z]/', '', $process_limit);
-
 $NOW_DATE = date("Y-m-d");

 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -197,6 +204,7 @@ $url_str="";

 for ($i=0; $i<$oc_ct; $i++) 
 	{
+	$output_codes_to_display[$i] = preg_replace("/\'|\"|\\\\|;/","",$output_codes_to_display[$i]);
 	$oc_SQL.="'$output_codes_to_display[$i]',";
 	$url_str.="output_codes_to_display[]=".$output_codes_to_display[$i];
 	}
@@ -1,7 +1,7 @@
 <?php
 # admin_NANPA_updater.php
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed to launch NANPA filter batch proccesses through the
 # triggering process
@@ -17,10 +17,11 @@
 # 170822-2230 - Added screen color settings
 # 180503-2015 - Added new help display
 # 191013-0814 - Fixes for PHP7
+# 220222-1753 - Added allow_web_debug system setting
 #

-$version = '2.14-8';
-$build = '191013-0814';
+$version = '2.14-9';
+$build = '220222-1753';
 $startMS = microtime();

 require("dbconnect_mysqli.php");
@@ -61,9 +62,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,active_voicemail_server,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,active_voicemail_server,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$MAIN.="$stmt\n";}
+#if ($DB) {$MAIN.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -75,10 +76,27 @@ if ($qm_conf_ct > 0)
 	$active_voicemail_server =		$row[4];
 	$SSenable_languages =			$row[5];
 	$SSlanguage_method =			$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

+$cellphone_list_id=preg_replace('/[^0-9]/', '', $cellphone_list_id);
+$landline_list_id=preg_replace('/[^0-9]/', '', $landline_list_id);
+$invalid_list_id=preg_replace('/[^0-9]/', '', $invalid_list_id);
+$exclusion_value=preg_replace('/[\'\"\\\\]/', '', $exclusion_value);
+$exclusion_value=preg_replace('/\s/', '\\\\\ ', $exclusion_value);
+$submit_form = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit_form);
+$delete_trigger_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $delete_trigger_id);
+$vl_field_update = preg_replace('/[^-_0-9a-zA-Z]/', '', $vl_field_update);
+$vl_field_exclude = preg_replace('/[^-_0-9a-zA-Z]/', '', $vl_field_exclude);
+$activation_delay = preg_replace('/[^- \.\_0-9a-zA-Z]/', '', $activation_delay);
+$fields_to_update = preg_replace('/[^- \,\.\_0-9a-zA-Z]/', '', $fields_to_update);
+
+# Variables filtered further down in the code
+# $lists
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -86,8 +104,8 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}

 $NOW_DATE = date("Y-m-d");
@@ -222,18 +240,12 @@ if ($submit_form=="SUBMIT" && $list_ct>0 && (strlen($vl_field_update)>0 || strle
 		}
 	$list_ct=count($lists);

-	$cellphone_list_id=preg_replace('/[^0-9]/', '', $cellphone_list_id);
-	$landline_list_id=preg_replace('/[^0-9]/', '', $landline_list_id);
-	$invalid_list_id=preg_replace('/[^0-9]/', '', $invalid_list_id);
-	$exclusion_value=preg_replace('/[\'\"\\\\]/', '', $exclusion_value);
-	$exclusion_value=preg_replace('/\s/', '\\\\\ ', $exclusion_value);
-	
-
 	$options="--user=$PHP_AUTH_USER --pass=$PHP_AUTH_PW ";
 	
 	$list_id_str="";
 	for ($i=0; $i<$list_ct; $i++) 
 		{
+		$lists[$i] = preg_replace('/[^0-9]/','',$lists[$i]);
 		$list_id_str.=$lists[$i]."--";
 		}
 	$list_id_str=substr($list_id_str, 0, -2);
@@ -1,7 +1,7 @@
 <?php
 # admin_amm_multi.php
 # 
-# Copyright (C) 2018  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # this screen will control the *amd* settings needed when the Campaign setting 
 # "AM Message Wildcards" is enabled. This screen allows for multiple messages 
@@ -15,10 +15,11 @@
 # 180502-2115 - Added new help display
 # 180618-2300 - Modified calls to audio file chooser function
 # 180924-1606 - Added called_count as field
+# 220222-0817 - Added allow_web_debug system setting
 #

-$admin_version = '2.14-6';
-$build = '180924-1606';
+$admin_version = '2.14-7';
+$build = '220222-0817';

 require("dbconnect_mysqli.php");
 require("functions.php");
@@ -60,9 +61,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,qc_features_active FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,qc_features_active,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $ss_conf_ct = mysqli_num_rows($rslt);
 if ($ss_conf_ct > 0)
 	{
@@ -72,28 +73,39 @@ if ($ss_conf_ct > 0)
 	$SSenable_languages =			$row[2];
 	$SSlanguage_method =			$row[3];
 	$SSqc_features_active =			$row[4];
+	$SSallow_web_debug =			$row[5];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

+$amm_id = preg_replace('/[^0-9]/','',$amm_id);
+$amm_rank = preg_replace('/[^-0-9]/','',$amm_rank);
+$active = preg_replace('/[^A-Z]/','',$active);
+$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
-	$amm_id = preg_replace('/[^0-9]/','',$amm_id);
 	$campaign_id = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign_id);
 	$entry_type = preg_replace('/[^_0-9a-zA-Z]/','',$entry_type);
-	$active = preg_replace('/[^A-Z]/','',$active);
 	$amm_field = preg_replace('/[^_0-9a-zA-Z]/','',$amm_field);
-	$amm_rank = preg_replace('/[^-0-9]/','',$amm_rank);
 	$amm_wildcard = preg_replace('/[^- _0-9a-zA-Z]/','',$amm_wildcard);
 	$amm_description = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$amm_description);
 	$amm_filename = preg_replace('/[^- \|\.\,\_0-9a-zA-Z]/','',$amm_filename);
 	}	# end of non_latin
 else
 	{
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$campaign_id = preg_replace('/[^-_0-9\p{L}]/u','',$campaign_id);
+	$entry_type = preg_replace('/[^_0-9\p{L}]/u','',$entry_type);
+	$amm_field = preg_replace('/[^_0-9\p{L}]/u','',$amm_field);
+	$amm_wildcard = preg_replace('/[^- _0-9\p{L}]/u','',$amm_wildcard);
+	$amm_description = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$amm_description);
+	$amm_filename = preg_replace('/[^- \|\.\,\_0-9\p{L}]/u','',$amm_filename);
 	}

 $STARTtime = date("U");
@@ -31,13 +31,14 @@
 # 210312-1429 - Added DID bulk delete text area, filtered out did_system_filter as selectable
 # 210315-1644 - Added CID bulk delete text area and ---ALL-- option
 # 220112-1806 - Added CAN(Canadian) states lookup for STATEFILL feature and CID-STATE feature
+# 220222-0821 - Added allow_web_debug system setting
 #

 require("dbconnect_mysqli.php");
 require("functions.php");

-$version = '2.14-25';
-$build = '220112-1806';
+$version = '2.14-26';
+$build = '220222-0821';

 $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
 $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -91,6 +92,33 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 if ($DB) {echo "$form_to_run|";}

+#############################################
+##### START SYSTEM_SETTINGS LOOKUP #####
+$sys_settings_stmt = "SELECT use_non_latin,enable_languages,language_method,campaign_cid_areacodes_enabled,sounds_central_control_active,contacts_enabled,enable_auto_reports,allow_web_debug FROM system_settings;";
+$sys_settings_rslt=mysql_to_mysqli($sys_settings_stmt, $link);
+#if ($DB) {echo "$sys_settings_stmt|";}
+$num_rows = mysqli_num_rows($sys_settings_rslt);
+if ($num_rows > 0)
+	{
+	$sys_settings_row=mysqli_fetch_row($sys_settings_rslt);
+	$non_latin =						$sys_settings_row[0];
+	$SSenable_languages =				$sys_settings_row[1];
+	$SSlanguage_method =				$sys_settings_row[2];
+	$SScampaign_cid_areacodes_enabled = $sys_settings_row[3];
+	$SSsounds_central_control_active =	$sys_settings_row[4];
+	$SScontacts_enabled =				$sys_settings_row[5];
+	$SSenable_auto_reports =			$sys_settings_row[6];
+	$SSallow_web_debug =				$sys_settings_row[7];
+	}
+else
+	{
+	echo _QXZ("There are no system settings. You might want to look into that.");
+	exit;
+	}
+if ($SSallow_web_debug < 1) {$DB=0;}
+##### END SETTINGS LOOKUP #####
+###########################################
+
 $ACCIDto_insert_raw = explode("\n", $ACCIDto_insert_raw);
 if ($ACCIDmethod == "CSV") 
 	{
@@ -115,16 +143,58 @@ else
 	$ACCIDto_insert_raw = preg_replace('/[^0-9]/','',$ACCIDto_insert_raw);
 	$ACCIDto_insert_raw_ArFilter = array_filter($ACCIDto_insert_raw);
 	}
+$DIDto_insert_raw = preg_replace('/[^0-9\n]/','',$DIDto_insert_raw);
 $DIDto_insert_raw = explode("\n", $DIDto_insert_raw);
-$DIDto_insert_raw = preg_replace('/[^0-9]/','',$DIDto_insert_raw);
-if ( $form_to_run == "BULKDIDSDELETETB" ) {
+if ( $form_to_run == "BULKDIDSDELETETB" ) 
+	{
 	$DIDdelete_from = explode("\n", $DIDto_delete_TB);
 	$DIDdelete_from = preg_replace('/[^0-9]/','',$DIDdelete_from);
-}
+	}
 $DIDto_insert_raw_ArFilter = array_filter($DIDto_insert_raw);
 $USERstart = preg_replace('/[^0-9]/','',$USERstart);
 $USERstop = preg_replace('/[^0-9]/','',$USERstop);
 $USERfull_name = preg_replace('/[^-_0-9a-zA-Z]/','',$USERfull_name);
+if ( $form_to_run == "ACCIDDELETEconfirmTB" ) 
+	{
+	$ACCIDdelete_from = explode("\n", $ACCIDdelete_from);
+	$ACCIDdelete_from = preg_replace('/[^0-9]/','',$ACCIDdelete_from);
+	}
+
+$ACCIDclear_all = preg_replace('/[^-_0-9a-zA-Z]/','',$ACCIDclear_all);
+$ACCIDclear_all_CONFIRMED = preg_replace('/[^-_0-9a-zA-Z]/','',$ACCIDclear_all_CONFIRMED);
+$DIDcopy_from = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$DIDcopy_from);
+$USERforce_pw = preg_replace('/[^-_0-9a-zA-Z]/','',$USERforce_pw);
+
+# Variables filter further down in the code
+#	$ACCIDareacode
+#	$ACCIDto_insert_CONFIRMED
+#	$ACCIDdescription
+#	$ACCIDactive
+#	$ACCIDactiveinput
+#	$DIDto_insert_CONFIRMED
+#	$USERto_insert
+#	$ACCIDdelete_from_CONFIRMED
+#	$DIDdelete_from_CONFIRMED
+#	$USERdelete_from
+#	$USERdelete_from_CONFIRMED
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$ACCIDcampaign = preg_replace('/[^-_0-9a-zA-Z]/', '', $ACCIDcampaign);
+	$ACCIDdelete_campaign = preg_replace('/[^-_0-9a-zA-Z]/', '', $ACCIDdelete_campaign);
+	$USERcopy_from = preg_replace('/[^-_0-9a-zA-Z]/', '', $USERcopy_from);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$ACCIDcampaign = preg_replace('/[^-_0-9\p{L}]/u', '', $ACCIDcampaign);
+	$ACCIDdelete_campaign = preg_replace('/[^-_0-9\p{L}]/u', '', $ACCIDdelete_campaign);
+	$USERcopy_from = preg_replace('/[^-_0-9\p{L}]/u', '', $USERcopy_from);
+	}
+
 if (empty($USERfull_name)) 					{$USERfull_name = "BLANK";}
 if (empty($USERdelete_from))				{$USERdelete_from="BLANK";}
 if (empty($ACCIDto_insert_raw_ArFilter)) 	{$CIDcheck = "BLANK";}
@@ -132,50 +202,10 @@ if (empty($DIDto_insert_raw_ArFilter)) 		{$DIDcheck = "BLANK";}
 if (empty($DIDdelete_from)) 				{$DIDdelete_from="BLANK";}
 if (empty($USERstart)) 						{$USERstart = "BLANK";}
 if (empty($USERstop)) 						{$USERstop = "BLANK";}
-if ( $form_to_run == "ACCIDDELETEconfirmTB" ) {
-	$ACCIDdelete_from = explode("\n", $ACCIDdelete_from);
-	$ACCIDdelete_from = preg_replace('/[^0-9]/','',$ACCIDdelete_from);
-}
 if (empty($ACCIDdelete_from)) 				{$ACCIDdelete_from = "BLANK";}
 if (empty($ACCIDdelete_campaign)) 			{$ACCIDdelete_campaign = "BLANK";}
 if ($ACCIDclear_all == "Y")					{$form_to_run="ACCIDDELETEconfirm";}

-#############################################
-##### START SYSTEM_SETTINGS LOOKUP #####
-$sys_settings_stmt = "SELECT use_non_latin,enable_languages,language_method,campaign_cid_areacodes_enabled,sounds_central_control_active,contacts_enabled,enable_auto_reports FROM system_settings;";
-$sys_settings_rslt=mysql_to_mysqli($sys_settings_stmt, $link);
-if ($DB) {echo "$sys_settings_stmt|";}
-$num_rows = mysqli_num_rows($sys_settings_rslt);
-if ($num_rows > 0)
-	{
-	$sys_settings_row=mysqli_fetch_row($sys_settings_rslt);
-	$non_latin =						$sys_settings_row[0];
-	$SSenable_languages =				$sys_settings_row[1];
-	$SSlanguage_method =				$sys_settings_row[2];
-	$SScampaign_cid_areacodes_enabled = $sys_settings_row[3];
-	$SSsounds_central_control_active =	$sys_settings_row[4];
-	$SScontacts_enabled =				$sys_settings_row[5];
-	$SSenable_auto_reports =			$sys_settings_row[6];
-	}
-else
-	{
-	echo _QXZ("There are no system settings. You might want to look into that.");
-	exit;
-	}
-##### END SETTINGS LOOKUP #####
-###########################################
-
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-	}
-else
-	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	}
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "$stmt|";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -593,6 +623,7 @@ elseif ($form_to_run == "ACCIDconfirmed")
 		$i = 0;
 		while ($i < count($ACCIDto_insert_CONFIRMED))
 			{
+			$ACCIDareacode[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $ACCIDareacode[$i]);
 			if (!preg_match("/[A-Z]/i",$ACCIDareacode[$i]))
 				{
 				$SQL="SELECT state FROM vicidial_phone_codes WHERE areacode='$ACCIDareacode[$i]';";
@@ -659,6 +690,11 @@ elseif ($form_to_run == "ACCIDconfirmed")
 			if (strlen($ACCIDactiveinput[$INSERTindex]) > 0) {$tempACCIDactive = $ACCIDactiveinput[$INSERTindex];}
 			else {$tempACCIDactive='N';}
 			}
+		$ACCIDareacode[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDareacode[$INSERTindex]);
+		$ACCIDto_insert_CONFIRMED[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDto_insert_CONFIRMED[$INSERTindex]);
+		$ACCIDdescription[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDdescription[$INSERTindex]);
+		$tempACCIDactive = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $tempACCIDactive);
+
 		if ($DB) {echo "|ACCIDactive: $ACCIDactive|$ACCIDactiveinput[$INSERTindex]|$tempACCIDactive|";}

 		$SQL = "INSERT IGNORE INTO vicidial_campaign_cid_areacodes (campaign_id,areacode,outbound_cid,active,cid_description) VALUES ('$ACCIDcampaign','$ACCIDareacode[$INSERTindex]','$ACCIDto_insert_CONFIRMED[$INSERTindex]','$tempACCIDactive','$ACCIDdescription[$INSERTindex]')";
@@ -674,6 +710,11 @@ elseif ($form_to_run == "ACCIDconfirmed")
 					if (strlen($ACCIDactiveinput[$INSERTindex]) > 0) {$tempACCIDactive = $ACCIDactiveinput[$INSERTindex];}
 					else {$tempACCIDactive='N';}
 					}
+				$ACCIDareacode[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDareacode[$INSERTindex]);
+				$ACCIDto_insert_CONFIRMED[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDto_insert_CONFIRMED[$INSERTindex]);
+				$ACCIDdescription[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDdescription[$INSERTindex]);
+				$tempACCIDactive = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $tempACCIDactive);
+
 				if ($DB) {echo "|ACCIDactive: $ACCIDactive|$ACCIDactiveinput[$INSERTindex]|$tempACCIDactive|";}
 				$SQL.= ",('" . $ACCIDcampaign . "','" . $ACCIDareacode[$INSERTindex] . "','" . $ACCIDto_insert_CONFIRMED[$INSERTindex] . "','" . $tempACCIDactive . "','" . $ACCIDdescription[$INSERTindex] . "')";
 				$SQL_sentence.= " |$ACCIDareacode[$INSERTindex]|$ACCIDto_insert_CONFIRMED[$INSERTindex]|$ACCIDdescription[$INSERTindex]|$tempACCIDactive";
@@ -693,6 +734,11 @@ elseif ($form_to_run == "ACCIDconfirmed")
 					if (strlen($ACCIDactiveinput[$INSERTindex]) > 0) {$tempACCIDactive = $ACCIDactiveinput[$INSERTindex];}
 					else {$tempACCIDactive='N';}
 					}
+				$ACCIDareacode[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDareacode[$INSERTindex]);
+				$ACCIDto_insert_CONFIRMED[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDto_insert_CONFIRMED[$INSERTindex]);
+				$ACCIDdescription[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDdescription[$INSERTindex]);
+				$tempACCIDactive = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $tempACCIDactive);
+
 				if ($DB) {echo "|ACCIDactive: $ACCIDactive|$ACCIDactiveinput[$INSERTindex]|$tempACCIDactive|";}
 				$SQL.= ",('" . $ACCIDcampaign . "','" . $ACCIDareacode[$INSERTindex] . "','" . $ACCIDto_insert_CONFIRMED[$INSERTindex] . "','" . $tempACCIDactive . "','" . $ACCIDdescription[$INSERTindex] . "')";
 				$SQL_sentence.= " |$ACCIDareacode[$INSERTindex]|$ACCIDto_insert_CONFIRMED[$INSERTindex]|$ACCIDdescription[$INSERTindex]|$tempACCIDactive";
@@ -863,6 +909,7 @@ elseif ($form_to_run == "ACCIDDELETEconfirmed" || $form_to_run == "ACCIDDELETEco
 			$i = 1; # loop counter
 			while ($i < count($ACCIDdelete_from_CONFIRMED))
 				{
+				$ACCIDdelete_from_CONFIRMED[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDdelete_from_CONFIRMED[$i]);
 				$SQL_sentence.= "$ACCIDdelete_from_CONFIRMED[$i] |";
 				$i++;
 				}
@@ -896,6 +943,7 @@ elseif ($form_to_run == "ACCIDDELETEconfirmed" || $form_to_run == "ACCIDDELETEco
 			$k = 1; # areacode index counter
 			while ($i < count($ACCIDdelete_from_CONFIRMED))
 				{
+				$ACCIDdelete_from_CONFIRMED[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDdelete_from_CONFIRMED[$i]);
 				if ($i & 1)
 					{
 					$ACCIDdelete_cid[$j] = $ACCIDdelete_from_CONFIRMED[$i];
@@ -914,6 +962,9 @@ elseif ($form_to_run == "ACCIDDELETEconfirmed" || $form_to_run == "ACCIDDELETEco
 			$i = 0;
 			while ($i < count($ACCIDdelete_areacode))
 				{
+				$ACCIDdelete_cid[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDdelete_cid[$i]);
+				$ACCIDdelete_areacode[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $ACCIDdelete_areacode[$i]);
+
 				$SQL = "DELETE FROM vicidial_campaign_cid_areacodes WHERE campaign_id='$ACCIDdelete_campaign' AND outbound_cid='$ACCIDdelete_cid[$i]' AND areacode='$ACCIDdelete_areacode[$i]';";
 				$i++;
 				if ($DB) {echo "$SQL|";}
@@ -1155,6 +1206,8 @@ elseif ($form_to_run == "DIDADDconfirmed")
 	$INSERTsqlLOG='';
 	while ($INSERTloopflag == "TRUE")
 		{
+		$DIDto_insert_CONFIRMED[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $DIDto_insert_CONFIRMED[$INSERTindex]);
+
 		$SQL = "INSERT IGNORE INTO vicidial_inbound_dids (did_pattern,did_description,did_active,did_route,extension,exten_context,voicemail_ext,phone,server_ip,user,user_unavailable_action,user_route_settings_ingroup,group_id,call_handle_method,agent_search_method,list_id,campaign_id,phone_code,menu_id,record_call,filter_inbound_number,filter_phone_group_id,filter_url,filter_action,filter_extension,filter_exten_context,filter_voicemail_ext,filter_phone,filter_server_ip,filter_user,filter_user_unavailable_action,filter_user_route_settings_ingroup,filter_group_id,filter_call_handle_method,filter_agent_search_method,filter_list_id,filter_campaign_id,filter_phone_code,filter_menu_id,filter_clean_cid_number,custom_one,custom_two,custom_three,custom_four,custom_five,user_group,filter_dnc_campaign,filter_url_did_redirect,no_agent_ingroup_redirect,no_agent_ingroup_id,no_agent_ingroup_extension,pre_filter_phone_group_id,pre_filter_extension,entry_list_id,filter_entry_list_id,max_queue_ingroup_calls,max_queue_ingroup_id,max_queue_ingroup_extension,did_carrier_description) VALUES ('$DIDto_insert_CONFIRMED[$INSERTindex]','$did_description','$did_active','$did_route','$extension','$exten_context','$voicemail_ext','$phone','$server_ip','$user','$user_unavailable_action','$user_route_settings_ingroup','$group_id','$call_handle_method','$agent_search_method','$list_id','$ACCIDcampaign_id','$phone_code','$menu_id','$record_call','$filter_inbound_number','$filter_phone_group_id','$filter_url','$filter_action','$filter_extension','$filter_exten_context','$filter_voicemail_ext','$filter_phone','$filter_server_ip','$filter_user','$filter_user_unavailable_action','$filter_user_route_settings_ingroup','$filter_group_id','$filter_call_handle_method','$filter_agent_search_method','$filter_list_id','$filter_campaign_id','$filter_phone_code','$filter_menu_id','$filter_clean_cid_number','$custom_one','$custom_two','$custom_three','$custom_four','$custom_five','$user_group','$filter_dnc_campaign','$filter_url_did_redirect','$no_agent_ingroup_redirect','$no_agent_ingroup_id','$no_agent_ingroup_extension','$pre_filter_phone_group_id','$pre_filter_extension','$entry_list_id','$filter_entry_list_id','$max_queue_ingroup_calls','$max_queue_ingroup_id','$max_queue_ingroup_extension','$did_carrier_description')";
 		$INSERTindex++;
 		if ($INSERTgroup_counter > 0)
@@ -1162,6 +1215,8 @@ elseif ($form_to_run == "DIDADDconfirmed")
 			$i = 1;
 			while ($i < $INSERTgroup_limit)
 				{
+				$DIDto_insert_CONFIRMED[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $DIDto_insert_CONFIRMED[$INSERTindex]);
+
 				$SQL.= ",('" . $DIDto_insert_CONFIRMED[$INSERTindex] . "','" . $did_description . "','" . $did_active . "','" . $did_route . "','" . $extension . "','" . $exten_context . "','" . $voicemail_ext . "','" . $phone . "','" . $server_ip . "','" . $user . "','" . $user_unavailable_action . "','" . $user_route_settings_ingroup . "','" . $group_id . "','" . $call_handle_method . "','" . $agent_search_method . "','" . $list_id . "','" . $ACCIDcampaign_id . "','" . $phone_code . "','" . $menu_id . "','" . $record_call . "','" . $filter_inbound_number . "','" . $filter_phone_group_id . "','" . $filter_url . "','" . $filter_action . "','" . $filter_extension . "','" . $filter_exten_context . "','" . $filter_voicemail_ext . "','" . $filter_phone . "','" . $filter_server_ip . "','" . $filter_user . "','" . $filter_user_unavailable_action . "','" . $filter_user_route_settings_ingroup . "','" . $filter_group_id . "','" . $filter_call_handle_method . "','" . $filter_agent_search_method . "','" . $filter_list_id . "','" . $filter_campaign_id . "','" . $filter_phone_code . "','" . $filter_menu_id . "','" . $filter_clean_cid_number . "','" . $custom_one . "','" . $custom_two . "','" . $custom_three . "','" . $custom_four . "','" . $custom_five . "','" . $user_group . "','" . $filter_dnc_campaign . "','" . $filter_url_did_redirect . "','" . $no_agent_ingroup_redirect . "','" . $no_agent_ingroup_id . "','" . $no_agent_ingroup_extension . "','" . $pre_filter_phone_group_id . "','" . $pre_filter_extension . "','" . $entry_list_id . "','" . $filter_entry_list_id . "','" . $max_queue_ingroup_calls . "','" . $max_queue_ingroup_id . "','" . $max_queue_ingroup_extension . "','" . $did_carrier_description . "')";
 				$SQL_sentence.= " |$DIDto_insert_CONFIRMED[$i]";
 				$i++;
@@ -1174,6 +1229,8 @@ elseif ($form_to_run == "DIDADDconfirmed")
 			$i = 1;
 			while ($i < $INSERTremainder)
 				{
+				$DIDto_insert_CONFIRMED[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $DIDto_insert_CONFIRMED[$INSERTindex]);
+
 				$SQL.= ",('" . $DIDto_insert_CONFIRMED[$INSERTindex] . "','" . $did_description . "','" . $did_active . "','" . $did_route . "','" . $extension . "','" . $exten_context . "','" . $voicemail_ext . "','" . $phone . "','" . $server_ip . "','" . $user . "','" . $user_unavailable_action . "','" . $user_route_settings_ingroup . "','" . $group_id . "','" . $call_handle_method . "','" . $agent_search_method . "','" . $list_id . "','" . $ACCIDcampaign_id . "','" . $phone_code . "','" . $menu_id . "','" . $record_call . "','" . $filter_inbound_number . "','" . $filter_phone_group_id . "','" . $filter_url . "','" . $filter_action . "','" . $filter_extension . "','" . $filter_exten_context . "','" . $filter_voicemail_ext . "','" . $filter_phone . "','" . $filter_server_ip . "','" . $filter_user . "','" . $filter_user_unavailable_action . "','" . $filter_user_route_settings_ingroup . "','" . $filter_group_id . "','" . $filter_call_handle_method . "','" . $filter_agent_search_method . "','" . $filter_list_id . "','" . $filter_campaign_id . "','" . $filter_phone_code . "','" . $filter_menu_id . "','" . $filter_clean_cid_number . "','" . $custom_one . "','" . $custom_two . "','" . $custom_three . "','" . $custom_four . "','" . $custom_five . "','" . $user_group . "','" . $filter_dnc_campaign . "','" . $filter_url_did_redirect . "','" . $no_agent_ingroup_redirect . "','" . $no_agent_ingroup_id . "','" . $no_agent_ingroup_extension . "','" . $pre_filter_phone_group_id . "','" . $pre_filter_extension . "','" . $entry_list_id . "','" . $filter_entry_list_id . "','" . $max_queue_ingroup_calls . "','" . $max_queue_ingroup_id . "','" . $max_queue_ingroup_extension . "','" . $did_carrier_description . "')";
 				$SQL_sentence.= " |$DIDto_insert_CONFIRMED[$i]";
 				$i++;
@@ -1224,6 +1281,7 @@ elseif ($form_to_run == "BULKDIDSDELETE" || $form_to_run == "BULKDIDSDELETETB")
 	$i = 0;
 	while ($i < count($DIDdelete_from))
 		{
+		$DIDdelete_from[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $DIDdelete_from[$i]);
 		echo "<br> $DIDdelete_from[$i]";
 		$i++;
 		}
@@ -1242,10 +1300,12 @@ elseif ($form_to_run == "BULKDIDSDELETE" || $form_to_run == "BULKDIDSDELETETB")
 elseif ($form_to_run == "BULKDIDSDELETEconfirmed")
 	{		
 	$DIDdelete_from_CONFIRMED = unserialize($DIDdelete_from_CONFIRMED);
+	$DIDdelete_from_CONFIRMED[0] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $DIDdelete_from_CONFIRMED[0]);
 	$SQL = "DELETE FROM vicidial_inbound_dids WHERE did_pattern IN ('$DIDdelete_from_CONFIRMED[0]'";
 	$i = 1;
 	while ($i < count($DIDdelete_from_CONFIRMED))
 		{
+		$DIDdelete_from_CONFIRMED[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $DIDdelete_from_CONFIRMED[$i]);
 		$SQL.= ",'" . $DIDdelete_from_CONFIRMED[$i] . "'";
 		$i++;
 		}
@@ -1565,6 +1625,8 @@ elseif ($form_to_run == "BULKUSERSconfirmed")
 	$INSERTsqlLOG='';
 	while ($INSERTloopflag == "TRUE")
 		{
+		$USERto_insert[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $USERto_insert[$INSERTindex]);
+
 		$SQL = "INSERT IGNORE INTO vicidial_users (user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,agent_choose_territories,custom_one,custom_two,custom_three,custom_four,custom_five,voicemail_id,agent_call_log_view_override,callcard_admin,agent_choose_blended,realtime_block_user_info,custom_fields_modify,force_change_password,agent_lead_search_override,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,preset_contact_search,modify_contacts,modify_same_user_level,admin_hide_lead_data,admin_hide_phone_data,agentcall_email,modify_email_accounts,failed_login_count,last_login_date,last_ip,pass_hash,alter_admin_interface_options,max_inbound_calls,modify_custom_dialplans,wrapup_seconds_override,modify_languages,selected_language,user_choose_language,ignore_group_on_search,api_list_restrict,api_allowed_functions,lead_filter_id,admin_cf_show_hidden,agentcall_chat,user_hide_realtime,access_recordings,modify_colors,user_nickname,user_new_lead_limit,api_only_user,modify_auto_reports,modify_ip_lists,ignore_ip_list,ready_max_logout,export_gdpr_leads) VALUES ('$USERto_insert[$INSERTindex]','$USERto_insert[$INSERTindex]','$USERto_insert[$INSERTindex]','$user_level','$user_group','$phone_login','$phone_pass','$delete_users','$delete_user_groups','$delete_lists','$delete_campaigns','$delete_ingroups','$delete_remote_agents','$load_leads','$ACCIDcampaign_detail','$ast_admin_access','$ast_delete_phones','$delete_scripts','$modify_leads','$hotkeys_active','$change_agent_campaign','$agent_choose_ingroups','$closer_campaigns','$scheduled_callbacks','$agentonly_callbacks','$agentcall_manual','$vicidial_recording','$vicidial_transfers','$delete_filters','$alter_agent_interface_options','$closer_default_blended','$delete_call_times','$modify_call_times','$modify_users','$modify_campaigns','$modify_lists','$modify_scripts','$modify_filters','$modify_ingroups','$modify_usergroups','$modify_remoteagents','$modify_servers','$view_reports','$vicidial_recording_override','$alter_custdata_override','$qc_enabled','$qc_user_level','$qc_pass','$qc_finish','$qc_commit','$add_timeclock_log','$modify_timeclock_log','$delete_timeclock_log','$alter_custphone_override','$vdc_agent_api_access','$modify_inbound_dids','$delete_inbound_dids','$user_active','$alert_enabled','$download_lists','$agent_shift_enforcement_override','$manager_shift_enforcement_override','$shift_override_flag','$export_reports','$delete_from_dnc','$email','$user_code','$territory','$allow_alerts','$agent_choose_territories','$custom_one','$custom_two','$custom_three','$custom_four','$custom_five','$voicemail_id','$agent_call_log_view_override','$callcard_admin','$agent_choose_blended','$realtime_block_user_info','$custom_fields_modify','$USERforce_pw','$agent_lead_search_override','$modify_shifts','$modify_phones','$modify_carriers','$modify_labels','$modify_statuses','$modify_voicemail','$modify_audiostore','$modify_moh','$modify_tts','$preset_contact_search','$modify_contacts','$modify_same_user_level','$admin_hide_lead_data','$admin_hide_phone_data','$agentcall_email','$modify_email_accounts','$failed_login_count','$last_login_date','$last_ip','$pass_hash','$alter_admin_interface_options','$max_inbound_calls','$modify_custom_dialplans','$wrapup_seconds_override','$modify_languages','$selected_language','$user_choose_language','$ignore_group_on_search','$api_list_restrict','$api_allowed_functions','$lead_filter_id','$admin_cf_show_hidden','$agentcall_chat','$user_hide_realtime','$access_recordings','$modify_colors','$user_nickname','$user_new_lead_limit','$api_only_user','$modify_auto_reports','$modify_ip_lists','$ignore_ip_list','$ready_max_logout','$export_gdpr_leads')";
 		$INSERTindex++;
 		if ($INSERTgroup_counter > 0)
@@ -1572,6 +1634,8 @@ elseif ($form_to_run == "BULKUSERSconfirmed")
 			$i = 1;
 			while ($i < $INSERTgroup_limit)
 				{
+				$USERto_insert[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $USERto_insert[$INSERTindex]);
+
 				$SQL.= ",('$USERto_insert[$INSERTindex]','$USERto_insert[$INSERTindex]','$USERto_insert[$INSERTindex]','$user_level','$user_group','$phone_login','$phone_pass','$delete_users','$delete_user_groups','$delete_lists','$delete_campaigns','$delete_ingroups','$delete_remote_agents','$load_leads','$ACCIDcampaign_detail','$ast_admin_access','$ast_delete_phones','$delete_scripts','$modify_leads','$hotkeys_active','$change_agent_campaign','$agent_choose_ingroups','$closer_campaigns','$scheduled_callbacks','$agentonly_callbacks','$agentcall_manual','$vicidial_recording','$vicidial_transfers','$delete_filters','$alter_agent_interface_options','$closer_default_blended','$delete_call_times','$modify_call_times','$modify_users','$modify_campaigns','$modify_lists','$modify_scripts','$modify_filters','$modify_ingroups','$modify_usergroups','$modify_remoteagents','$modify_servers','$view_reports','$vicidial_recording_override','$alter_custdata_override','$qc_enabled','$qc_user_level','$qc_pass','$qc_finish','$qc_commit','$add_timeclock_log','$modify_timeclock_log','$delete_timeclock_log','$alter_custphone_override','$vdc_agent_api_access','$modify_inbound_dids','$delete_inbound_dids','$user_active','$alert_enabled','$download_lists','$agent_shift_enforcement_override','$manager_shift_enforcement_override','$shift_override_flag','$export_reports','$delete_from_dnc','$email','$user_code','$territory','$allow_alerts','$agent_choose_territories','$custom_one','$custom_two','$custom_three','$custom_four','$custom_five','$voicemail_id','$agent_call_log_view_override','$callcard_admin','$agent_choose_blended','$realtime_block_user_info','$custom_fields_modify','$USERforce_pw','$agent_lead_search_override','$modify_shifts','$modify_phones','$modify_carriers','$modify_labels','$modify_statuses','$modify_voicemail','$modify_audiostore','$modify_moh','$modify_tts','$preset_contact_search','$modify_contacts','$modify_same_user_level','$admin_hide_lead_data','$admin_hide_phone_data','$agentcall_email','$modify_email_accounts','$failed_login_count','$last_login_date','$last_ip','$pass_hash','$alter_admin_interface_options','$max_inbound_calls','$modify_custom_dialplans','$wrapup_seconds_override','$modify_languages','$selected_language','$user_choose_language','$ignore_group_on_search','$api_list_restrict','$api_allowed_functions','$lead_filter_id','$admin_cf_show_hidden','$agentcall_chat','$user_hide_realtime','$access_recordings','$modify_colors','$user_nickname','$user_new_lead_limit','$api_only_user','$modify_auto_reports','$modify_ip_lists','$ignore_ip_list','$ready_max_logout','$export_gdpr_leads')";
 				$SQL_sentence.= " |$USERto_insert[$INSERTindex]";
 				$i++;
@@ -1584,6 +1648,8 @@ elseif ($form_to_run == "BULKUSERSconfirmed")
 			$i = 1;
 			while ($i < $INSERTremainder)
 				{
+				$USERto_insert[$INSERTindex] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $USERto_insert[$INSERTindex]);
+
 				$SQL.= ",('$USERto_insert[$INSERTindex]','$USERto_insert[$INSERTindex]','$USERto_insert[$INSERTindex]','$user_level','$user_group','$phone_login','$phone_pass','$delete_users','$delete_user_groups','$delete_lists','$delete_campaigns','$delete_ingroups','$delete_remote_agents','$load_leads','$ACCIDcampaign_detail','$ast_admin_access','$ast_delete_phones','$delete_scripts','$modify_leads','$hotkeys_active','$change_agent_campaign','$agent_choose_ingroups','$closer_campaigns','$scheduled_callbacks','$agentonly_callbacks','$agentcall_manual','$vicidial_recording','$vicidial_transfers','$delete_filters','$alter_agent_interface_options','$closer_default_blended','$delete_call_times','$modify_call_times','$modify_users','$modify_campaigns','$modify_lists','$modify_scripts','$modify_filters','$modify_ingroups','$modify_usergroups','$modify_remoteagents','$modify_servers','$view_reports','$vicidial_recording_override','$alter_custdata_override','$qc_enabled','$qc_user_level','$qc_pass','$qc_finish','$qc_commit','$add_timeclock_log','$modify_timeclock_log','$delete_timeclock_log','$alter_custphone_override','$vdc_agent_api_access','$modify_inbound_dids','$delete_inbound_dids','$user_active','$alert_enabled','$download_lists','$agent_shift_enforcement_override','$manager_shift_enforcement_override','$shift_override_flag','$export_reports','$delete_from_dnc','$email','$user_code','$territory','$allow_alerts','$agent_choose_territories','$custom_one','$custom_two','$custom_three','$custom_four','$custom_five','$voicemail_id','$agent_call_log_view_override','$callcard_admin','$agent_choose_blended','$realtime_block_user_info','$custom_fields_modify','$USERforce_pw','$agent_lead_search_override','$modify_shifts','$modify_phones','$modify_carriers','$modify_labels','$modify_statuses','$modify_voicemail','$modify_audiostore','$modify_moh','$modify_tts','$preset_contact_search','$modify_contacts','$modify_same_user_level','$admin_hide_lead_data','$admin_hide_phone_data','$agentcall_email','$modify_email_accounts','$failed_login_count','$last_login_date','$last_ip','$pass_hash','$alter_admin_interface_options','$max_inbound_calls','$modify_custom_dialplans','$wrapup_seconds_override','$modify_languages','$selected_language','$user_choose_language','$ignore_group_on_search','$api_list_restrict','$api_allowed_functions','$lead_filter_id','$admin_cf_show_hidden','$agentcall_chat','$user_hide_realtime','$access_recordings','$modify_colors','$user_nickname','$user_new_lead_limit','$api_only_user','$modify_auto_reports','$modify_ip_lists','$ignore_ip_list','$ready_max_logout','$export_gdpr_leads')";
 				$SQL_sentence.= " |$USERto_insert[$INSERTindex]";
 				$i++;
@@ -1626,6 +1692,7 @@ elseif ($form_to_run == "BULKUSERSDELETE") ### BULK USER DELETE
 	$i = 0;
 	while ($i < count($USERdelete_from))
 		{
+		$USERdelete_from[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $USERdelete_from[$i]);
 		echo "<br> $USERdelete_from[$i]";
 		$i++;
 		}
@@ -1645,10 +1712,12 @@ elseif ($form_to_run == "BULKUSERSDELETE") ### BULK USER DELETE
 elseif ($form_to_run == "BULKUSERSDELETEconfirmed")### BULK USER DELETE CONFIRM
 	{
 	$USERdelete_from_CONFIRMED = unserialize($USERdelete_from_CONFIRMED);
+	$USERdelete_from_CONFIRMED[0] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $USERdelete_from_CONFIRMED[0]);
 	$SQL = "DELETE FROM vicidial_users WHERE user IN ('$USERdelete_from_CONFIRMED[0]'";
 	$i = 1;
 	while ($i < count($USERdelete_from_CONFIRMED))
 		{
+		$USERdelete_from_CONFIRMED[$i] = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $USERdelete_from_CONFIRMED[$i]);
 		$SQL.= ",'" . $USERdelete_from_CONFIRMED[$i] . "'";
 		$i++;
 		}
@@ -1,7 +1,7 @@
 <?php
 # admin_campaign_multi_alt.php
 # 
-# Copyright (C) 2018  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # this screen will control the campaign settings needed for alternate number 
 # dialing using multiple leads with the same account number and different phone 
@@ -21,10 +21,11 @@
 # 150728-1046 - Added option for secondary sorting by vendor_lead_code, Issue #833
 # 170409-1535 - Added IP List validation code
 # 180329-1344 - Added screen colors
+# 220222-0902 - Added allow_web_debug system setting
 #

-$admin_version = '2.14-11';
-$build = '180329-1344';
+$admin_version = '2.14-12';
+$build = '220222-0902';

 require("dbconnect_mysqli.php");
 require("functions.php");
@@ -54,9 +55,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $ss_conf_ct = mysqli_num_rows($rslt);
 if ($ss_conf_ct > 0)
 	{
@@ -65,22 +66,28 @@ if ($ss_conf_ct > 0)
 	$webroot_writable =				$row[1];
 	$SSenable_languages =			$row[2];
 	$SSlanguage_method =			$row[3];
+	$SSallow_web_debug =			$row[4];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

+$lead_order_randomize = preg_replace('/[^-_0-9a-zA-Z]/','',$lead_order_randomize);
+$lead_order_secondary = preg_replace('/[^-_0-9a-zA-Z]/','',$lead_order_secondary);
+$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
 	$campaign_id = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign_id);
-	$lead_order_randomize = preg_replace('/[^-_0-9a-zA-Z]/','',$lead_order_randomize);
-	$lead_order_secondary = preg_replace('/[^-_0-9a-zA-Z]/','',$lead_order_secondary);
 	}	# end of non_latin
 else
 	{
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$campaign_id = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign_id);
 	}

 $STARTtime = date("U");
@@ -1,7 +1,7 @@
 <?php
 # admin_email_accounts.php
 # 
-# Copyright (C) 2018  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This page manages the inbound email accounts in ViciDial
 #
@@ -24,10 +24,11 @@
 # 170409-1540 - Added IP List validation code
 # 180219-1233 - Fixed translation issue #1069
 # 180502-2215 - Added new help display
+# 220222-0906 - Added allow_web_debug system setting
 #

-$admin_version = '2.14-18';
-$build = '180502-2215';
+$admin_version = '2.14-19';
+$build = '220222-0906';

 $sh="emails"; 

@@ -99,9 +100,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,allow_emails,allow_emails,level_8_disable_add,enable_languages,language_method,active_modules,enable_auto_reports FROM system_settings;";
+$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,allow_emails,allow_emails,level_8_disable_add,enable_languages,language_method,active_modules,enable_auto_reports,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -144,30 +145,56 @@ if ($qm_conf_ct > 0)
 	$SSlanguage_method =					$row[35];
 	$SSactive_modules =						$row[36];
 	$SSenable_auto_reports =				$row[37];
+	$SSallow_web_debug =					$row[38];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

+$list_id = preg_replace("/[^0-9]/","",$list_id);
+$default_list_id = preg_replace("/[^0-9]/","",$default_list_id);
+$email_frequency_check_mins = preg_replace("/[^0-9]/","",$email_frequency_check_mins);
+$active = preg_replace("/[^_0-9a-zA-Z]/","",$active);
+$protocol = preg_replace("/[^_0-9a-zA-Z]/","",$protocol);
+$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT);
+$stage = preg_replace('/[^-_0-9a-zA-Z]/','',$stage);
+$eact = preg_replace('/[^-_0-9a-zA-Z]/','',$eact);
+$email_account_user = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$email_account_user);
+$email_account_pass = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$email_account_pass);
+$pop3_auth_mode = preg_replace('/[^-_0-9a-zA-Z]/','',$pop3_auth_mode);
+$email_account_type = preg_replace('/[^-_0-9a-zA-Z]/','',$email_account_type);
+$call_handle_method = preg_replace('/[^-_0-9a-zA-Z]/','',$call_handle_method);
+$agent_search_method = preg_replace('/[^-_0-9a-zA-Z]/','',$agent_search_method);
+$confirm_deletion = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm_deletion);
+$new_account_id = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_account_id);
+$source_email_account = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$source_email_account);
+$email_replyto_address = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$email_replyto_address);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_PW);
-
 	$email_account_id = preg_replace("/[^_0-9a-zA-Z]/","",$email_account_id);
 	$email_account_name = preg_replace("/[^ \.\,-\_0-9a-zA-Z]/","",$email_account_name);
 	$email_account_description = preg_replace("/[^ \.\,-\_0-9a-zA-Z]/","",$email_account_description);
-	$user_group = preg_replace("/[^_0-9a-zA-Z]/","",$user_group);
-	$protocol = preg_replace("/[^_0-9a-zA-Z]/","",$protocol);
+	$user_group = preg_replace("/[^-_0-9a-zA-Z]/","",$user_group);
 	$email_account_server = preg_replace("/[^\.\-\_0-9a-zA-Z]/","",$email_account_server);
-	$active = preg_replace("/[^_0-9a-zA-Z]/","",$active);
-	$email_frequency_check_mins = preg_replace("/[^0-9]/","",$email_frequency_check_mins);
+	$group_id = preg_replace("/[^-_0-9a-zA-Z]/", "",$group_id);
+	$campaign_id = preg_replace("/[^-_0-9a-zA-Z]/", "",$campaign_id);
 	}	# end of non_latin
 else
 	{
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$email_account_id = preg_replace("/[^_0-9\p{L}]/u","",$email_account_id);
+	$email_account_name = preg_replace("/[^ \.\,-\_0-9\p{L}]/u","",$email_account_name);
+	$email_account_description = preg_replace("/[^ \.\,-\_0-9\p{L}]/u","",$email_account_description);
+	$user_group = preg_replace("/[^-_0-9\p{L}]/u","",$user_group);
+	$email_account_server = preg_replace("/[^\.\-\_0-9\p{L}]/u","",$email_account_server);
+	$group_id = preg_replace('/[^-_0-9\p{L}]/u', '', $group_id);
+	$campaign_id = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign_id);
 	}
-$list_id = preg_replace("/[^0-9]/","",$list_id);

 $STARTtime = date("U");
 $TODAY = date("Y-m-d");
@@ -1,7 +1,7 @@
 <?php
 # admin_languages.php
 # 
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # this screen manages the optional language tables in ViciDial
 #
@@ -19,10 +19,11 @@
 # 170409-1547 - Added IP List validation code
 # 180502-2215 - Added new help display
 # 200828-1628 - Fix for early permissions message, Issue #1227
+# 220222-0949 - Added allow_web_debug system setting
 #

-$admin_version = '2.14-12';
-$build = '200828-1628';
+$admin_version = '2.14-13';
+$build = '220222-0949';

 require("dbconnect_mysqli.php");
 require("functions.php");
@@ -43,7 +44,6 @@ if (isset($_GET["user"]))						{$user=$_GET["user"];}
 	elseif (isset($_POST["user"]))				{$user=$_POST["user"];}
 if (isset($_GET["pass"]))						{$pass=$_GET["pass"];}
 	elseif (isset($_POST["pass"]))				{$pass=$_POST["pass"];}
-
 if (isset($_GET["language_id"]))				{$language_id=$_GET["language_id"];}
 	elseif (isset($_POST["language_id"]))		{$language_id=$_POST["language_id"];}
 if (isset($_GET["language_code"]))				{$language_code=$_GET["language_code"];}
@@ -62,7 +62,6 @@ if (isset($_GET["import_data"]))				{$import_data=$_GET["import_data"];}
 	elseif (isset($_POST["import_data"]))		{$import_data=$_POST["import_data"];}
 if (isset($_GET["active"]))						{$active=$_GET["active"];}
 	elseif (isset($_POST["active"]))			{$active=$_POST["active"];}
-
 if (isset($_GET["copy_option"]))				{$copy_option=$_GET["copy_option"];}
 	elseif (isset($_POST["copy_option"]))		{$copy_option=$_POST["copy_option"];}
 if (isset($_GET["ConFiRm"]))					{$ConFiRm=$_GET["ConFiRm"];}
@@ -86,9 +85,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,allow_emails,active_modules,sounds_central_control_active,qc_features_active,contacts_enabled,enable_languages,language_method,admin_web_directory,admin_screen_colors,enable_auto_reports,campaign_cid_areacodes_enabled FROM system_settings;";
+$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,allow_emails,active_modules,sounds_central_control_active,qc_features_active,contacts_enabled,enable_languages,language_method,admin_web_directory,admin_screen_colors,enable_auto_reports,campaign_cid_areacodes_enabled,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -112,7 +111,9 @@ if ($qm_conf_ct > 0)
 	$SSadmin_screen_colors =		$row[16];
 	$SSenable_auto_reports =		$row[17];
 	$SScampaign_cid_areacodes_enabled = $row[18];
+	$SSallow_web_debug =			$row[19];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

@@ -122,45 +123,46 @@ $modify_refresh_set=0;
 $import_with_missing_periods=1;
 $gif='.gif';

+$DB = preg_replace('/[^0-9]/','',$DB);
+$rank = preg_replace('/[^0-9]/','',$rank);
+$level = preg_replace('/[^0-9]/','',$level);
+$parent_rank = preg_replace('/[^0-9]/','',$parent_rank);
+$phrase_id = preg_replace('/[^0-9]/','',$phrase_id);
+$active = preg_replace('/[^NY]/','',$active);
+$ConFiRm = preg_replace('/[^0-9a-zA-Z]/','',$ConFiRm);
+$copy_option = preg_replace('/[^_0-9a-zA-Z]/','',$copy_option);
+$stage = preg_replace('/[^-_0-9a-zA-Z]/', '',$stage);
+$import_data = preg_replace("/\\\\|;|\r/","",$import_data);
+$english_text = preg_replace("/\\\\|;|\n|\r/","",$english_text);
+$translated_text = preg_replace("/\\\\|;|\n|\r/","",$translated_text);
+$ADD = preg_replace('/[^-_0-9a-zA-Z]/', '',$ADD);
+$action = preg_replace('/[^-_0-9a-zA-Z]/', '',$action);
+$session_name = preg_replace('/[^-_0-9a-zA-Z]/', '',$session_name);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '',$SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
 	$user = preg_replace('/[^-_0-9a-zA-Z]/','',$user);
 	$pass = preg_replace('/[^-_0-9a-zA-Z]/','',$pass);
-
-	$DB = preg_replace('/[^0-9]/','',$DB);
-	$rank = preg_replace('/[^0-9]/','',$rank);
-	$level = preg_replace('/[^0-9]/','',$level);
-	$parent_rank = preg_replace('/[^0-9]/','',$parent_rank);
-	$phrase_id = preg_replace('/[^0-9]/','',$phrase_id);
-
-	$active = preg_replace('/[^NY]/','',$active);
-
-	$ConFiRm = preg_replace('/[^0-9a-zA-Z]/','',$ConFiRm);
-
 	$language_id = preg_replace('/[^-_0-9a-zA-Z]/','',$language_id);
 	$source_language_id = preg_replace('/[^-_0-9a-zA-Z]/','',$source_language_id);
 	$language_code = preg_replace('/[^-_0-9a-zA-Z]/','',$language_code);
 	$language_description = preg_replace('/[^- _0-9a-zA-Z]/','',$language_description);
-	$english_text = preg_replace("/\\\\|;|\n|\r/","",$english_text);
-	$translated_text = preg_replace("/\\\\|;|\n|\r/","",$translated_text);
-	$import_data = preg_replace("/\\\\|;|\r/","",$import_data);
-
-	$copy_option = preg_replace('/[^_0-9a-zA-Z]/','',$copy_option);
-	$stage = preg_replace('/[^-_0-9a-zA-Z]/', '',$stage);
 	$user_group = preg_replace('/[^-_0-9a-zA-Z]/', '',$user_group);
 	}	# end of non_latin
 else
 	{
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$user = preg_replace("/'|\"|\\\\|;/","",$user);
-	$pass = preg_replace("/'|\"|\\\\|;/","",$pass);
-	$language_id = preg_replace("/'|\"|\\\\|;/","",$language_id);
-	$english_text = preg_replace("/\\\\|;|\n|\r/","",$english_text);
-	$translated_text = preg_replace("/\\\\|;|\n|\r/","",$translated_text);
-	$import_data = preg_replace("/\\\\|;|\r/","",$import_data);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9\p{L}]/u','',$user);
+	$pass = preg_replace('/[^-_0-9\p{L}]/u','',$pass);
+	$language_id = preg_replace('/[^-_0-9\p{L}]/u','',$language_id);
+	$source_language_id = preg_replace('/[^-_0-9\p{L}]/u','',$source_language_id);
+	$language_code = preg_replace('/[^-_0-9\p{L}]/u','',$language_code);
+	$language_description = preg_replace('/[^- _0-9\p{L}]/u','',$language_description);
+	$user_group = preg_replace('/[^-_0-9\p{L}]/u', '',$user_group);
 	}

 $STARTtime = date("U");
@@ -1,7 +1,7 @@
 <?php
 # admin_launch_trigger.php
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed to launch a CLI script on the voicemail server through
 # the triggering process
@@ -9,10 +9,11 @@
 # CHANGELOG:
 # 161016-2014 - First build of script based upon admin_NANPA_updater.php
 # 170409-1543 - Added IP List validation code
+# 220222-0957 - Added allow_web_debug system setting, if disabled, this script is disabled
 #

-$version = '2.14-2';
-$build = '170409-1543';
+$version = '2.14-3';
+$build = '220222-0957';
 $startMS = microtime();

 require("dbconnect_mysqli.php");
@@ -35,7 +36,7 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,active_voicemail_server,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,active_voicemail_server,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
 if ($DB) {$MAIN.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
@@ -49,23 +50,27 @@ if ($qm_conf_ct > 0)
 	$active_voicemail_server =		$row[4];
 	$SSenable_languages =			$row[5];
 	$SSlanguage_method =			$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;   $stage='';}
 ##### END SETTINGS LOOKUP #####
 ###########################################

+$stage = preg_replace('/[^-_0-9a-zA-Z]/','',$stage);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$container_id = preg_replace('/[^-_0-9a-zA-Z]/','',$container_id);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$container_id = preg_replace('/[^-_0-9\p{L}]/u', '', $container_id);
 	}

-$container_id = preg_replace('/[^-_0-9a-zA-Z]/','',$container_id);
-
 $NOW_DATE = date("Y-m-d");

 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -177,7 +182,7 @@ if ($SSnocache_admin=='1')

 echo "<html>\n";
 echo "<head>\n";
-echo "<!-- VERSION: $admin_version   BUILD: $build   ADD: $ADD   PHP_SELF: $PHP_SELF-->\n";
+echo "<!-- VERSION: $version   BUILD: $build   PHP_SELF: $PHP_SELF-->\n";
 echo "<META NAME=\"ROBOTS\" CONTENT=\"NONE\">\n";
 echo "<META NAME=\"COPYRIGHT\" CONTENT=\"&copy; 2016 ViciDial Group\">\n";
 echo "<META NAME=\"AUTHOR\" CONTENT=\"ViciDial Group\">\n";
@@ -2,7 +2,7 @@
 # admin_listloader_fourth_gen.php - version 2.14
 #  (based upon - new_listloader_superL.php script)
 # 
-# Copyright (C) 2021  Matt Florell,Joe Johnson <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell,Joe Johnson <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # ViciDial web-based lead loader from formatted file
 # 
@@ -79,10 +79,11 @@
 # 200812-1745 - Added international DNC scrub option
 # 200922-1013 - Added web_loader_phone_strip system setting feature
 # 210210-1602 - Added duplicate check with more X-day options
+# 220222-1002 - Added allow_web_debug system setting
 #

-$version = '2.14-77';
-$build = '210210-1602';
+$version = '2.14-78';
+$build = '220222-1002';

 require("dbconnect_mysqli.php");
 require("functions.php");
@@ -152,7 +153,7 @@ if (isset($_GET["postal_code_field"]))				{$postal_code_field=$_GET["postal_code
 if (isset($_GET["country_code_field"]))				{$country_code_field=$_GET["country_code_field"];}
 	elseif (isset($_POST["country_code_field"]))	{$country_code_field=$_POST["country_code_field"];}
 if (isset($_GET["gender_field"]))			{$gender_field=$_GET["gender_field"];}
-	elseif (isset($_POST["gender_field"]))		{$gender_field=$_POST["gender_field"];}
+	elseif (isset($_POST["gender_field"]))	{$gender_field=$_POST["gender_field"];}
 if (isset($_GET["date_of_birth_field"]))			{$date_of_birth_field=$_GET["date_of_birth_field"];}
 	elseif (isset($_POST["date_of_birth_field"]))	{$date_of_birth_field=$_POST["date_of_birth_field"];}
 if (isset($_GET["alt_phone_field"]))			{$alt_phone_field=$_GET["alt_phone_field"];}
@@ -178,10 +179,10 @@ if (isset($_GET["dupcheck"]))				{$dupcheck=$_GET["dupcheck"];}
 	elseif (isset($_POST["dupcheck"]))		{$dupcheck=$_POST["dupcheck"];}
 if (isset($_GET["dedupe_statuses"]))				{$dedupe_statuses=$_GET["dedupe_statuses"];}
 	elseif (isset($_POST["dedupe_statuses"]))		{$dedupe_statuses=$_POST["dedupe_statuses"];}
-if (isset($_GET["dedupe_statuses_override"]))				{$dedupe_statuses_override=$_GET["dedupe_statuses_override"];}
-	elseif (isset($_POST["dedupe_statuses_override"]))		{$dedupe_statuses_override=$_POST["dedupe_statuses_override"];}
+if (isset($_GET["dedupe_statuses_override"]))			{$dedupe_statuses_override=$_GET["dedupe_statuses_override"];}
+	elseif (isset($_POST["dedupe_statuses_override"]))	{$dedupe_statuses_override=$_POST["dedupe_statuses_override"];}
 if (isset($_GET["status_mismatch_action"]))				{$status_mismatch_action=$_GET["status_mismatch_action"];}
-	elseif (isset($_POST["status_mismatch_action"]))		{$status_mismatch_action=$_POST["status_mismatch_action"];}
+	elseif (isset($_POST["status_mismatch_action"]))	{$status_mismatch_action=$_POST["status_mismatch_action"];}
 if (isset($_GET["postalgmt"]))				{$postalgmt=$_GET["postalgmt"];}
 	elseif (isset($_POST["postalgmt"]))		{$postalgmt=$_POST["postalgmt"];}
 if (isset($_GET["phone_code_override"]))			{$phone_code_override=$_GET["phone_code_override"];}
@@ -189,8 +190,8 @@ if (isset($_GET["phone_code_override"]))			{$phone_code_override=$_GET["phone_co
 	$phone_code_override = (preg_replace("/\D/","",$phone_code_override));
 if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
-if (isset($_GET["template_id"]))					{$template_id=$_GET["template_id"];}
-	elseif (isset($_POST["template_id"]))		{$template_id=$_POST["template_id"];}
+if (isset($_GET["template_id"]))			{$template_id=$_GET["template_id"];}
+	elseif (isset($_POST["template_id"]))	{$template_id=$_POST["template_id"];}
 if (isset($_GET["usacan_check"]))			{$usacan_check=$_GET["usacan_check"];}
 	elseif (isset($_POST["usacan_check"]))	{$usacan_check=$_POST["usacan_check"];}
 if (isset($_GET["state_conversion"]))			{$state_conversion=$_GET["state_conversion"];}
@@ -200,10 +201,6 @@ if (isset($_GET["web_loader_phone_length"]))			{$web_loader_phone_length=$_GET["
 if (isset($_GET["international_dnc_scrub"]))			{$international_dnc_scrub=$_GET["international_dnc_scrub"];}
 	elseif (isset($_POST["international_dnc_scrub"]))	{$international_dnc_scrub=$_POST["international_dnc_scrub"];}

-
-if (strlen($dedupe_statuses_override)>0) {
-	$dedupe_statuses=explode(",", $dedupe_statuses_override);
-}
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 # if the didnt select an over ride wipe out in_file
@@ -219,11 +216,11 @@ $vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method,active_modules,admin_screen_colors,web_loader_phone_length,enable_international_dncs,web_loader_phone_strip FROM system_settings;";
+$stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method,active_modules,admin_screen_colors,web_loader_phone_length,enable_international_dncs,web_loader_phone_strip,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
 if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
-if ($qm_conf_ct > 0)
+#if ($qm_conf_ct > 0)
 	{
 	$row=mysqli_fetch_row($rslt);
 	$non_latin =					$row[0];
@@ -237,22 +234,75 @@ if ($qm_conf_ct > 0)
 	$SSweb_loader_phone_length =	$row[8];
 	$SSenable_international_dncs =	$row[9];
 	$SSweb_loader_phone_strip =		$row[10];
+	$SSallow_web_debug =			$row[11];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

+$list_id_override = preg_replace('/[^0-9]/','',$list_id_override);
+$phone_code_override = preg_replace('/[^0-9]/','',$phone_code_override);
+$web_loader_phone_length = preg_replace('/[^0-9]/','',$web_loader_phone_length);
+$international_dnc_scrub = preg_replace('/[^-_0-9a-zA-Z]/', '', $international_dnc_scrub);
+$master_list_override = preg_replace('/[^-_0-9a-zA-Z]/', '', $master_list_override);
+$usacan_check = preg_replace('/[^-_0-9a-zA-Z]/', '', $usacan_check);
+$state_conversion = preg_replace('/[^-_0-9a-zA-Z]/', '', $state_conversion);
+$status_mismatch_action = preg_replace('/[^- \_0-9a-zA-Z]/', '', $status_mismatch_action);
+$postalgmt = preg_replace('/[^- \_0-9a-zA-Z]/', '', $postalgmt);
+$dupcheck = preg_replace('/[^- \_0-9a-zA-Z]/', '', $dupcheck);
+$lead_file = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$lead_file);
+$vendor_lead_code_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$vendor_lead_code_field);
+$source_id_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$source_id_field);
+$list_id_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$list_id_field);
+$phone_code_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$phone_code_field);
+$phone_number_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$phone_number_field);
+$title_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$title_field);
+$first_name_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$first_name_field);
+$middle_initial_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$middle_initial_field);
+$last_name_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$last_name_field);
+$address1_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$address1_field);
+$address2_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$address2_field);
+$address3_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$address3_field);
+$city_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$city_field);
+$state_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$state_field);
+$province_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$province_field);
+$postal_code_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$postal_code_field);
+$country_code_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$country_code_field);
+$gender_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$gender_field);
+$date_of_birth_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$date_of_birth_field);
+$alt_phone_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$alt_phone_field);
+$email_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$email_field);
+$security_phrase_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$security_phrase_field);
+$comments_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$comments_field);
+$rank_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$rank_field);
+$owner_field = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$owner_field);
+$submit_file = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit_file);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$file_layout = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_layout);
+$OK_to_process = preg_replace('/[^- \_0-9a-zA-Z]/', '', $OK_to_process);
+
+# Variables filter further down in the code
+# $dedupe_statuses
+
+if (strlen($dedupe_statuses_override)>0) 
+	{
+	$dedupe_statuses_override = preg_replace('/[^- \,\_0-9a-zA-Z]/', '', $dedupe_statuses_override);
+	$dedupe_statuses=explode(",", $dedupe_statuses_override);
+	}
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$template_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $template_id);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$template_id = preg_replace('/[^-_0-9\p{L}]/u', '', $template_id);
 	}
-$list_id_override = preg_replace('/[^0-9]/','',$list_id_override);
-$web_loader_phone_length = preg_replace('/[^0-9]/','',$web_loader_phone_length);

 $STARTtime = date("U");
 $TODAY = date("Y-m-d");
@@ -962,6 +1012,7 @@ if ($OK_to_process)
 			$status_dedupe_str="";
 			for($ds=0; $ds<count($dedupe_statuses); $ds++) 
 				{
+				$dedupe_statuses[$ds] = preg_replace('/[^-_0-9\p{L}]/u', '', $dedupe_statuses[$ds]);
 				$statuses_clause.="'$dedupe_statuses[$ds]',";
 				$status_dedupe_str.="$dedupe_statuses[$ds], ";
 				if (preg_match('/\-\-ALL\-\-/', $dedupe_statuses[$ds])) 
@@ -1204,7 +1255,7 @@ if ($OK_to_process)

 							#	if ($DB>0) {echo "$A_field_label[$o]|$A_field_type[$o]\n";}

-								if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') )
+								if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') and ($A_field_type[$o]!='SWITCH') and ($A_field_type[$o]!='BUTTON') )
 									{
 									if (!preg_match("/\|$A_field_label[$o]\|/",$vicidial_list_fields))
 										{
@@ -2570,6 +2621,7 @@ if (($leadfile) && ($LF_path))
 				$statuses_clause=" and status in (";
 				$status_dedupe_str="";
 				for($ds=0; $ds<count($dedupe_statuses); $ds++) {
+					$dedupe_statuses[$ds] = preg_replace('/[^-_0-9\p{L}]/u', '', $dedupe_statuses[$ds]);
 					$statuses_clause.="'$dedupe_statuses[$ds]',";
 					$status_dedupe_str.="$dedupe_statuses[$ds], ";
 					if (preg_match('/\-\-ALL\-\-/', $dedupe_statuses[$ds])) {
@@ -3223,7 +3275,7 @@ if (($leadfile) && ($LF_path))

 						if ($DB>0) {echo "$A_field_label[$o]|$A_field_type[$o]\n";}

-						if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') )
+						if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') and ($A_field_type[$o]!='SWITCH') and ($A_field_type[$o]!='BUTTON') )
 							{
 							if (!preg_match("/\|$A_field_label[$o]\|/",$vicidial_list_fields))
 								{
@@ -3292,6 +3344,7 @@ if (($leadfile) && ($LF_path))
 		if (count($dedupe_statuses)>0) {
 			$status_dedupe_str="";
 			for($ds=0; $ds<count($dedupe_statuses); $ds++) {
+				$dedupe_statuses[$ds] = preg_replace('/[^-_0-9\p{L}]/u', '', $dedupe_statuses[$ds]);
 				$status_dedupe_str.="$dedupe_statuses[$ds],";
 				if (preg_match('/\-\-ALL\-\-/', $dedupe_statuses[$ds])) {
 					$status_mismatch_action=""; # Important - if ALL statuses are selected there's no need for this feature
@@ -1,16 +1,17 @@
 <?php
 # admin_mobile.php - VICIDIAL administration page, reduced functions for mobile app
 #
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>, Joe Johnson <joej@vicidial.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>, Joe Johnson <joej@vicidial.com>    LICENSE: AGPLv2
 # 
 # CHANGES
 # 190205-1702 - First Build
 # 200210-1618 - Added links to more mobile-compatible reports
 # 200309-1819 - Modifications for display formatting
+# 220222-1451 - Added allow_web_debug system setting
 #

-$admin_version = '2.14-3a';
-$build = '200309-1819';
+$admin_version = '2.14-4a';
+$build = '220222-1451';

 $startMS = microtime();

@@ -159,9 +160,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,allow_emails,level_8_disable_add,pass_key,pass_hash_enabled,disable_auto_dial,country_code_list_stats,frozen_server_call_clear,active_modules,allow_chats,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,enable_did_entry_list_id,enable_third_webform,default_language,user_hide_realtime_enabled,log_recording_access,alt_ivr_logging,admin_row_click,admin_screen_colors,ofcom_uk_drop_calc,agent_screen_colors,script_remove_js,manual_auto_next,user_new_lead_limit,agent_xfer_park_3way,agent_soundboards,web_loader_phone_length,agent_script,enable_auto_reports,enable_pause_code_limits,enable_drop_lists,allow_ip_lists,system_ip_blacklist,hide_inactive_lists,allow_manage_active_lists,expired_lists_inactive,did_system_filter,enable_gdpr_download_deletion FROM system_settings;";
+$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,allow_emails,level_8_disable_add,pass_key,pass_hash_enabled,disable_auto_dial,country_code_list_stats,frozen_server_call_clear,active_modules,allow_chats,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,enable_did_entry_list_id,enable_third_webform,default_language,user_hide_realtime_enabled,log_recording_access,alt_ivr_logging,admin_row_click,admin_screen_colors,ofcom_uk_drop_calc,agent_screen_colors,script_remove_js,manual_auto_next,user_new_lead_limit,agent_xfer_park_3way,agent_soundboards,web_loader_phone_length,agent_script,enable_auto_reports,enable_pause_code_limits,enable_drop_lists,allow_ip_lists,system_ip_blacklist,hide_inactive_lists,allow_manage_active_lists,expired_lists_inactive,did_system_filter,enable_gdpr_download_deletion,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -241,7 +242,9 @@ if ($qm_conf_ct > 0)
 	$SSexpired_lists_inactive =				$row[72];
 	$SSdid_system_filter =					$row[73];
 	$SSenable_gdpr_download_deletion =		$row[74];
+	$SSallow_web_debug =					$row[75];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

@@ -8,7 +8,7 @@
 # just needs to enter the leadID and then they can view and modify the 
 # information in the record for that lead
 #
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -107,6 +107,7 @@
 # 210421-2120 - Added more screen labels
 # 210629-1545 - Added KHOMP stats display
 # 210630-0838 - Added display of vicidial_vmm_counts data, if $CIDdisplay=="Yes"
+# 220222-1454 - Added allow_web_debug system setting
 #

 require("dbconnect_mysqli.php");
@@ -120,8 +121,6 @@ if (isset($_GET["vendor_id"]))				{$vendor_id=$_GET["vendor_id"];}
 	elseif (isset($_POST["vendor_id"]))		{$vendor_id=$_POST["vendor_id"];}
 if (isset($_GET["source_id"]))				{$source_id=$_GET["source_id"];}
 	elseif (isset($_POST["source_id"]))		{$source_id=$_POST["source_id"];}
-if (isset($_GET["phone"]))				{$phone=$_GET["phone"];}
-	elseif (isset($_POST["phone"]))		{$phone=$_POST["phone"];}
 if (isset($_GET["old_phone"]))				{$old_phone=$_GET["old_phone"];}
 	elseif (isset($_POST["old_phone"]))		{$old_phone=$_POST["old_phone"];}
 if (isset($_GET["lead_id"]))				{$lead_id=$_GET["lead_id"];}
@@ -269,9 +268,9 @@ if ($nonselectable_statuses > 0)

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,custom_fields_enabled,webroot_writable,allow_emails,enable_languages,language_method,active_modules,log_recording_access,admin_screen_colors,enable_gdpr_download_deletion,source_id_display,mute_recordings,sip_event_logging FROM system_settings;";
+$stmt = "SELECT use_non_latin,custom_fields_enabled,webroot_writable,allow_emails,enable_languages,language_method,active_modules,log_recording_access,admin_screen_colors,enable_gdpr_download_deletion,source_id_display,mute_recordings,sip_event_logging,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -289,7 +288,9 @@ if ($qm_conf_ct > 0)
 	$SSsource_id_display =		$row[10];
 	$SSmute_recordings =		$row[11];
 	$SSsip_event_logging =		$row[12];
+	$SSallow_web_debug =		$row[13];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ### See if KHOMP is set up
 $stmt = "SELECT container_id FROM vicidial_settings_containers where container_id IN('KHOMPSETTINGS','KHOMPSTATUSMAP');";
@@ -322,6 +323,31 @@ $called_count=preg_replace('/[^0-9]/','',$called_count);
 $local_gmt=preg_replace('/[^-\.0-9]/','',$local_gmt);
 $callback = preg_replace('/[^A-Z]/','',$callback);
 $callback_type = preg_replace('/[^A-Z]/','',$callback_type);
+$end_call=preg_replace('/[^0-9]/','',$end_call);
+$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
+$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$extension);
+$channel = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$channel);
+$submit = preg_replace('/[^- \.\_0-9a-zA-Z]/','',$submit);
+$SUBMIT = preg_replace('/[^- \.\_0-9a-zA-Z]/','',$SUBMIT);
+$modify_logs=preg_replace('/[^0-9]/','',$modify_logs);
+$modify_closer_logs=preg_replace('/[^0-9]/','',$modify_closer_logs);
+$modify_agent_logs=preg_replace('/[^0-9]/','',$modify_agent_logs);
+$add_closer_record=preg_replace('/[^0-9]/','',$add_closer_record);
+$call_began = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$call_began);
+$parked_time = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$parked_time);
+$callback_id = preg_replace('/[^-_0-9a-zA-Z]/','',$callback_id);
+$CBchangeUSERtoANY = preg_replace('/[^-_0-9a-zA-Z]/','',$CBchangeUSERtoANY);
+$CBchangeANYtoUSER = preg_replace('/[^-_0-9a-zA-Z]/','',$CBchangeANYtoUSER);
+$CBchangeDATE = preg_replace('/[^-_0-9a-zA-Z]/','',$CBchangeDATE);
+$archive_search = preg_replace('/[^-_0-9a-zA-Z]/','',$archive_search);
+$archive_log = preg_replace('/[^-_0-9a-zA-Z]/','',$archive_log);
+$gdpr_action = preg_replace('/[^-_0-9a-zA-Z]/','',$gdpr_action);
+$CIDdisplay = preg_replace('/[^-_0-9a-zA-Z]/','',$CIDdisplay);
+$appointment_date = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$appointment_date);
+$appointment_time = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$appointment_time);
+
+# Variables filtered further down in the code
+# $vendor_id

 if ($non_latin < 1)
 	{
@@ -345,6 +371,7 @@ if ($non_latin < 1)
 	$alt_phone = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$alt_phone);
 	$email = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9a-zA-Z]/','',$email);
 	$security_phrase = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$security_phrase);
+	$security = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$security);
 	$campaign_id = preg_replace('/[^-\_0-9a-zA-Z]/', '',$campaign_id);
 	$multi_alt_phones = preg_replace('/[^- \+\!\:\_0-9a-zA-Z]/','',$multi_alt_phones);
 	$source = preg_replace('/[^0-9a-zA-Z]/','',$source);
@@ -361,6 +388,11 @@ if ($non_latin < 1)
 	$modify_log_submit = preg_replace('/[^-_0-9a-zA-Z]/','',$modify_log_submit);
 	$modify_log_table = preg_replace('/[^-_0-9a-zA-Z]/','',$modify_log_table);
 	$vicidial_id = preg_replace('/[^-\+\.\:\_0-9a-zA-Z]/','',$vicidial_id);
+	$dispo = preg_replace('/[^-_0-9a-zA-Z]/','',$dispo);
+	$status = preg_replace('/[^-_0-9a-zA-Z]/','',$status);
+	$CBstatus = preg_replace('/[^-_0-9a-zA-Z]/','',$CBstatus);
+	$tsr = preg_replace('/[^-_0-9a-zA-Z]/','',$tsr);
+	$CBuser = preg_replace('/[^-_0-9a-zA-Z]/','',$CBuser);
 	}
 else
 	{
@@ -384,6 +416,7 @@ else
 	$alt_phone = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$alt_phone);
 	$email = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9\p{L}]/u','',$email);
 	$security_phrase = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$security_phrase);
+	$security = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$security);
 	$campaign_id = preg_replace('/[^-\_0-9\p{L}]/u', '',$campaign_id);
 	$multi_alt_phones = preg_replace('/[^- \+\!\:\_0-9\p{L}]/u','',$multi_alt_phones);
 	$source = preg_replace('/[^0-9\p{L}]/u','',$source);
@@ -400,6 +433,11 @@ else
 	$modify_log_submit = preg_replace('/[^-_0-9\p{L}]/u','',$modify_log_submit);
 	$modify_log_table = preg_replace('/[^-_0-9\p{L}]/u','',$modify_log_table);
 	$vicidial_id = preg_replace('/[^-\+\.\:\_0-9\p{L}]/u','',$vicidial_id);
+	$dispo = preg_replace('/[^-_0-9\p{L}]/u','',$dispo);
+	$status = preg_replace('/[^-_0-9\p{L}]/u','',$status);
+	$CBstatus = preg_replace('/[^-_0-9\p{L}]/u','',$CBstatus);
+	$tsr = preg_replace('/[^-_0-9\p{L}]/u','',$tsr);
+	$CBuser = preg_replace('/[^-_0-9\p{L}]/u','',$CBuser);
 	}

 $first_name = preg_replace('/\+/',' ',$first_name);
@@ -1,7 +1,7 @@
 <?php
 # admin_phones_bulk_insert.php
 # 
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # this screen will insert phones into your multi-server system with aliases
 #
@@ -22,10 +22,11 @@
 # 181130-1304 - Added template option
 # 201112-1017 - Fix for side menu issue #1223
 # 210827-0907 - Added PJSIP support
+# 220222-1942 - Added allow_web_debug system setting
 #

-$admin_version = '2.14-15';
-$build = '210827-0907';
+$admin_version = '2.14-16';
+$build = '220222-1942';

 require("dbconnect_mysqli.php");
 require("functions.php");
@@ -77,9 +78,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,admin_screen_colors,campaign_cid_areacodes_enabled,sounds_central_control_active,contacts_enabled,enable_auto_reports,allowed_sip_stacks FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,admin_screen_colors,campaign_cid_areacodes_enabled,sounds_central_control_active,contacts_enabled,enable_auto_reports,allowed_sip_stacks,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $ss_conf_ct = mysqli_num_rows($rslt);
 if ($ss_conf_ct > 0)
 	{
@@ -94,7 +95,9 @@ if ($ss_conf_ct > 0)
 	$SScontacts_enabled =				$row[7];
 	$SSenable_auto_reports =			$row[8];
 	$SSallowed_sip_stacks =				$row[9];
+	$SSallow_web_debug =				$row[10];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

@@ -105,31 +108,37 @@ $date = date("r");
 $ip = getenv("REMOTE_ADDR");
 $browser = getenv("HTTP_USER_AGENT");

+$servers = preg_replace("/'|\"|\\\\|;/","",$servers);
+$phones = preg_replace("/'|\"|\\\\|;/","",$phones);
+$action = preg_replace("/[^-_0-9a-zA-Z]/", "",$action);
+$alias_option = preg_replace("/[^-_0-9a-zA-Z]/", "",$alias_option);
+$protocol = preg_replace("/[^-_0-9a-zA-Z]/", "",$protocol);
+$local_gmt = preg_replace("/[^- \.\,\_0-9a-zA-Z]/","",$local_gmt);
+$is_webphone = preg_replace("/[^-_0-9a-zA-Z]/", "",$is_webphone);
+$webphone_dialpad = preg_replace("/[^-_0-9a-zA-Z]/", "",$webphone_dialpad);
+$webphone_auto_answer = preg_replace("/[^NY]/","",$webphone_auto_answer);
+$use_external_server_ip = preg_replace("/[^NY]/","",$use_external_server_ip);
+$SUBMIT = preg_replace("/[^-_0-9a-zA-Z]/", "",$SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_PW);
-
-	$servers = preg_replace("/'|\"|\\\\|;/","",$servers);
-	$phones = preg_replace("/'|\"|\\\\|;/","",$phones);
-	$action = preg_replace("/[^-_0-9a-zA-Z]/", "",$action);
 	$conf_secret = preg_replace("/[^-_0-9a-zA-Z]/", "",$conf_secret);
 	$pass = preg_replace("/[^-_0-9a-zA-Z]/", "",$pass);
-	$alias_option = preg_replace("/[^-_0-9a-zA-Z]/", "",$alias_option);
 	$alias_suffix = preg_replace("/[^0-9a-zA-Z]/","",$alias_suffix);
-	$protocol = preg_replace("/[^-_0-9a-zA-Z]/", "",$protocol);
-	$local_gmt = preg_replace("/[^- \.\,\_0-9a-zA-Z]/","",$local_gmt);
-	$is_webphone = preg_replace("/[^-_0-9a-zA-Z]/", "",$is_webphone);
-	$webphone_dialpad = preg_replace("/[^-_0-9a-zA-Z]/", "",$webphone_dialpad);
-	$webphone_auto_answer = preg_replace("/[^NY]/","",$webphone_auto_answer);
-	$use_external_server_ip = preg_replace("/[^NY]/","",$use_external_server_ip);
 	$phone_context = preg_replace("/[^-\_0-9a-zA-Z]/","",$phone_context);
 	$template_id = preg_replace('/[^-_0-9a-zA-Z]/','',$template_id);
 	}	# end of non_latin
 else
 	{
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$conf_secret = preg_replace("/[^-_0-9\p{L}]/u", "",$conf_secret);
+	$pass = preg_replace("/[^-_0-9\p{L}]/u", "",$pass);
+	$alias_suffix = preg_replace("/[^0-9\p{L}]/u","",$alias_suffix);
+	$phone_context = preg_replace("/[^-\_0-9\p{L}]/u","",$phone_context);
+	$template_id = preg_replace('/[^-_0-9\p{L}]/u','',$template_id);
 	}

 $user = $PHP_AUTH_USER;
@@ -1,7 +1,7 @@
 <?php
 # admin_search_lead.php   version 2.14
 #
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # AST GUI database administration search for lead info
 # admin_modify_lead.php
@@ -52,6 +52,7 @@
 # 201111-1957 - Fix for side menu issue #1233
 # 201117-2353 - Changes for better compatibility with non-latin data input
 # 210316-2344 - Changed lead-modify page links to javascript because of Chrome
+# 220222-1947 - Added allow_web_debug system setting
 #

 require("dbconnect_mysqli.php");
@@ -102,13 +103,27 @@ if (isset($_GET["archive_search"]))			{$archive_search=$_GET["archive_search"];}
 if (isset($_GET["called_count"]))			{$called_count=$_GET["called_count"];}
 	elseif (isset($_POST["called_count"]))	{$called_count=$_POST["called_count"];}

+$report_name = 'Search Leads Logs';
+
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

+$vicidial_list_fields = 'lead_id,entry_date,modify_date,status,user,vendor_lead_code,source_id,list_id,gmt_offset_now,called_since_last_reset,phone_code,phone_number,title,first_name,middle_initial,last_name,address1,address2,address3,city,state,province,postal_code,country_code,gender,date_of_birth,alt_phone,email,security_phrase,comments,called_count,last_local_call_time,rank,owner';
+
+if (strlen($alt_phone_search) < 2) {$alt_phone_search='No';}
+
+$STARTtime = date("U");
+$TODAY = date("Y-m-d");
+$NOW_TIME = date("Y-m-d H:i:s");
+$date = date("r");
+$ip = getenv("REMOTE_ADDR");
+$browser = getenv("HTTP_USER_AGENT");
+$log_archive_link=0;
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,qc_features_active FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,qc_features_active,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -122,38 +137,46 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[6];
 	$SSlanguage_method =			$row[7];
 	$SSqc_features_active =			$row[8];
+	$SSallow_web_debug =			$row[9];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

-$report_name = 'Search Leads Logs';
-
 if ($archive_search=="Yes") {$vl_table="vicidial_list_archive";} 
 else {$vl_table="vicidial_list"; $archive_search="No";}

-$vicidial_list_fields = 'lead_id,entry_date,modify_date,status,user,vendor_lead_code,source_id,list_id,gmt_offset_now,called_since_last_reset,phone_code,phone_number,title,first_name,middle_initial,last_name,address1,address2,address3,city,state,province,postal_code,country_code,gender,date_of_birth,alt_phone,email,security_phrase,comments,called_count,last_local_call_time,rank,owner';
-
-$STARTtime = date("U");
-$TODAY = date("Y-m-d");
-$NOW_TIME = date("Y-m-d H:i:s");
-$date = date("r");
-$ip = getenv("REMOTE_ADDR");
-$browser = getenv("HTTP_USER_AGENT");
-$log_archive_link=0;
-
-if (strlen($alt_phone_search) < 2) {$alt_phone_search='No';}
+$phone = preg_replace('/[^-_0-9a-zA-Z]/','',$phone);
+$log_phone = preg_replace('/[^-_0-9a-zA-Z]/', '', $log_phone);
+$log_phone_archive = preg_replace('/[^-_0-9a-zA-Z]/', '', $log_phone_archive);
+$list_id = preg_replace('/[^0-9]/','',$list_id);
+$lead_id = preg_replace('/[^0-9]/','',$lead_id);
+$log_lead_id = preg_replace('/[^0-9]/','',$log_lead_id);
+$log_lead_id_archive = preg_replace('/[^0-9]/','',$log_lead_id_archive);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$vendor_id = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$status);
+$first_name = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$first_name);
+$last_name = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$last_name);
+$email = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$email);
+$user = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$user);
+$owner = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$owner);
+$alt_phone_search = preg_replace('/[^-_0-9a-zA-Z]/', '', $alt_phone_search);
+$archive_search = preg_replace('/[^-_0-9a-zA-Z]/', '', $archive_search);
+$called_count = preg_replace('/[^0-9]/','',$called_count);

 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$status = preg_replace('/[^-_0-9a-zA-Z]/', '', $status);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$status = preg_replace('/[^-_0-9\p{L}]/u', '', $status);
 	}
-$phone = preg_replace('/[^0-9]/','',$phone);

 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
@@ -1,7 +1,7 @@
 <?php
 # admin_soundboard.php
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # this screen manages the optional soundboard tables in ViciDial
 #
@@ -20,10 +20,11 @@
 # 170409-1549 - Added IP List validation code
 # 180503-2215 - Added new help display
 # 180618-2300 - Modified calls to audio file chooser function
+# 220222-1512 - Added allow_web_debug system setting
 #

-$admin_version = '2.14-13';
-$build = '180503-2215';
+$admin_version = '2.14-14';
+$build = '220222-1512';

 require("dbconnect_mysqli.php");
 require("functions.php");
@@ -89,9 +90,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,allow_emails,active_modules,sounds_central_control_active,qc_features_active,contacts_enabled,enable_languages,active_modules,agent_soundboards,language_method,enable_auto_reports,campaign_cid_areacodes_enabled FROM system_settings;";
+$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,allow_emails,active_modules,sounds_central_control_active,qc_features_active,contacts_enabled,enable_languages,active_modules,agent_soundboards,language_method,enable_auto_reports,campaign_cid_areacodes_enabled,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -115,7 +116,9 @@ if ($qm_conf_ct > 0)
 	$SSlanguage_method =			$row[16];
 	$SSenable_auto_reports =		$row[17];
 	$SScampaign_cid_areacodes_enabled = $row[18];
+	$SSallow_web_debug =			$row[19];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

@@ -123,25 +126,26 @@ if (strlen($DB) < 1)
 	{$DB=0;}
 $modify_refresh_set=0;

+$DB = preg_replace('/[^0-9]/','',$DB);
+$rank = preg_replace('/[^0-9]/','',$rank);
+$level = preg_replace('/[^0-9]/','',$level);
+$parent_rank = preg_replace('/[^0-9]/','',$parent_rank);
+$columns_limit = preg_replace('/[^0-9]/','',$columns_limit);
+$active = preg_replace('/[^NY]/','',$active);
+$ConFiRm = preg_replace('/[^0-9a-zA-Z]/','',$ConFiRm);
+$name_position = preg_replace('/[^0-9a-zA-Z]/','',$name_position);
+$multi_position = preg_replace('/[^0-9a-zA-Z]/','',$multi_position);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT);
+$ADD = preg_replace('/[^-_0-9a-zA-Z]/','',$ADD);
+$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
-
-	$DB = preg_replace('/[^0-9]/','',$DB);
-	$rank = preg_replace('/[^0-9]/','',$rank);
-	$level = preg_replace('/[^0-9]/','',$level);
-	$parent_rank = preg_replace('/[^0-9]/','',$parent_rank);
-	$columns_limit = preg_replace('/[^0-9]/','',$columns_limit);
-
-	$active = preg_replace('/[^NY]/','',$active);
-
 	$avatar_api_user = preg_replace('/[^-_0-9a-zA-Z]/','',$avatar_api_user);
 	$avatar_api_pass = preg_replace('/[^-_0-9a-zA-Z]/','',$avatar_api_pass);
-	$ConFiRm = preg_replace('/[^0-9a-zA-Z]/','',$ConFiRm);
-	$name_position = preg_replace('/[^0-9a-zA-Z]/','',$name_position);
-	$multi_position = preg_replace('/[^0-9a-zA-Z]/','',$multi_position);
-
+	$source_avatar_id = preg_replace('/[^-_0-9a-zA-Z]/','',$source_avatar_id);
 	$soundboard_id = preg_replace('/[^_0-9a-zA-Z]/','',$soundboard_id);
 	$copy_option = preg_replace('/[^_0-9a-zA-Z]/','',$copy_option);
 	$audio_functions = preg_replace('/[^-_0-9a-zA-Z]/', '',$audio_functions);
@@ -149,18 +153,33 @@ if ($non_latin < 1)
 	$stage = preg_replace('/[^-_0-9a-zA-Z]/', '',$stage);
 	$user_group = preg_replace('/[^-_0-9a-zA-Z]/', '',$user_group);
 	$soundboard_layout = preg_replace('/[^-_0-9a-zA-Z]/', '',$soundboard_layout);
-
 	$avatar_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$avatar_name);
 	$avatar_notes = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$avatar_notes);
 	$audio_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$audio_name);
-
 	$audio_filename = preg_replace('/[^-\|\,\_0-9a-zA-Z]/', '',$audio_filename);
 	$parent_audio_filename = preg_replace('/[^-\|\,\_0-9a-zA-Z]/', '',$parent_audio_filename);
+	$parent_filename = preg_replace('/[^-\|\,\_0-9a-zA-Z]/', '',$parent_filename);
 	}	# end of non_latin
 else
 	{
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$avatar_api_user = preg_replace('/[^-_0-9\p{L}]/u','',$avatar_api_user);
+	$avatar_api_pass = preg_replace('/[^-_0-9\p{L}]/u','',$avatar_api_pass);
+	$source_avatar_id = preg_replace('/[^-_0-9\p{L}]/u','',$source_avatar_id);
+	$soundboard_id = preg_replace('/[^_0-9\p{L}]/u','',$soundboard_id);
+	$copy_option = preg_replace('/[^_0-9\p{L}]/u','',$copy_option);
+	$audio_functions = preg_replace('/[^-_0-9\p{L}]/u', '',$audio_functions);
+	$audio_display = preg_replace('/[^-_0-9\p{L}]/u', '',$audio_display);
+	$stage = preg_replace('/[^-_0-9\p{L}]/u', '',$stage);
+	$user_group = preg_replace('/[^-_0-9\p{L}]/u', '',$user_group);
+	$soundboard_layout = preg_replace('/[^-_0-9\p{L}]/u', '',$soundboard_layout);
+	$avatar_name = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$avatar_name);
+	$avatar_notes = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$avatar_notes);
+	$audio_name = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$audio_name);
+	$audio_filename = preg_replace('/[^-\|\,\_0-9\p{L}]/u', '',$audio_filename);
+	$parent_audio_filename = preg_replace('/[^-\|\,\_0-9\p{L}]/u', '',$parent_audio_filename);
+	$parent_filename = preg_replace('/[^-\|\,\_0-9\p{L}]/u', '',$parent_filename);
 	}

 $STARTtime = date("U");
@@ -540,7 +559,7 @@ if ($ADD==162111111111)
 		echo "<tr bgcolor=#". $SSstd_row2_background ."><td align=right>"._QXZ("Soundboard Name").": </td><td align=left><input type=text name=avatar_name size=70 maxlength=255>$NWB#soundboard-avatar_name$NWE</td></tr>\n";
 		echo "<tr bgcolor=#". $SSstd_row2_background ."><td align=right>"._QXZ("Soundboard Notes").": </td><td align=left><input type=text name=avatar_notes size=70 maxlength=1000>$NWB#soundboard-avatar_name$NWE</td></tr>\n";
 		echo "<tr bgcolor=#". $SSstd_row2_background ."><td align=right>"._QXZ("Soundboard API User").": </td><td align=left><input type=text name=avatar_api_user size=20 maxlength=20>$NWB#soundboard-avatar_api_user$NWE</td></tr>\n";
-		echo "<tr bgcolor=#". $SSstd_row2_background ."><td align=right>"._QXZ("Soundboard API Pass").": </td><td align=left><input type=password name=avatar_api_pass size=20 maxlength=20>$NWB#soundboard-avatar_api_pass$NWE</td></tr>\n";
+		echo "<tr bgcolor=#". $SSstd_row2_background ."><td align=right>"._QXZ("Soundboard API Pass").": </td><td align=left><input type=password name=avatar_api_pass size=40 maxlength=100>$NWB#soundboard-avatar_api_pass$NWE</td></tr>\n";
 		echo "<tr bgcolor=#". $SSstd_row2_background ."><td align=right>"._QXZ("Admin User Group").": </td><td align=left><select size=1 name=user_group>\n";
 		echo "$UUgroups_list";
 		echo "<option SELECTED value=\"---ALL---\">"._QXZ("All Admin User Groups")."</option>\n";
@@ -1014,7 +1033,7 @@ if ($ADD==362111111111)
 		echo "<tr bgcolor=#". $SSstd_row2_background ."><td align=right>"._QXZ("Soundboard Name").": </td><td align=left><input type=text name=avatar_name size=70 maxlength=100 value=\"$avatar_name\">$NWB#soundboard-avatar_name$NWE</td></tr>\n";
 		echo "<tr bgcolor=#". $SSstd_row2_background ."><td align=right>"._QXZ("Soundboard Notes").": </td><td align=left><input type=text name=avatar_notes size=70 maxlength=1000 value=\"$avatar_notes\">$NWB#soundboard-avatar_notes$NWE</td></tr>\n";
 		echo "<tr bgcolor=#". $SSstd_row2_background ."><td align=right>"._QXZ("Soundboard API User").": </td><td align=left><input type=text name=avatar_api_user size=20 maxlength=20 value=\"$avatar_api_user\">$NWB#soundboard-avatar_api_user$NWE</td></tr>\n";
-		echo "<tr bgcolor=#". $SSstd_row2_background ."><td align=right>"._QXZ("Soundboard API Pass").": </td><td align=left><input type=password name=avatar_api_pass size=20 maxlength=20 value=\"$avatar_api_pass\">$NWB#soundboard-avatar_api_pass$NWE</td></tr>\n";
+		echo "<tr bgcolor=#". $SSstd_row2_background ."><td align=right>"._QXZ("Soundboard API Pass").": </td><td align=left><input type=password name=avatar_api_pass size=40 maxlength=100 value=\"$avatar_api_pass\">$NWB#soundboard-avatar_api_pass$NWE</td></tr>\n";
 		echo "<tr bgcolor=#". $SSstd_row2_background ."><td align=right>"._QXZ("Active").": </td><td align=left><select size=1 name=active><option value='N'>"._QXZ("N")."</option><option value='Y'>"._QXZ("Y")."</option><option value='$active' SELECTED>"._QXZ("$active")."</option></select>$NWB#soundboard-active$NWE</td></tr>\n";
 		echo "<tr bgcolor=#". $SSstd_row2_background ."><td align=right>"._QXZ("Audio Functions").": </td><td align=left><input type=text name=audio_functions size=70 maxlength=100 value=\"$audio_functions\">$NWB#soundboard-audio_functions$NWE</td></tr>\n";
 		echo "<tr bgcolor=#". $SSstd_row2_background ."><td align=right>"._QXZ("Audio Display").": </td><td align=left><input type=text name=audio_display size=70 maxlength=100 value=\"$audio_display\">$NWB#soundboard-audio_display$NWE</td></tr>\n";
@@ -18,10 +18,11 @@
 # 180503-2215 - Added new help display
 # 211117-2006 - Added minimum call length field
 # 220127-1900 - Added display of the URL ID
+# 220222-1959 - Added allow_web_debug system setting
 #

-$admin_version = '2.14-8';
-$build = '220127-1900';
+$admin_version = '2.14-9';
+$build = '220222-1959';

 require("dbconnect_mysqli.php");
 require("functions.php");
@@ -67,9 +68,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,qc_features_active FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,qc_features_active,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $ss_conf_ct = mysqli_num_rows($rslt);
 if ($ss_conf_ct > 0)
 	{
@@ -79,39 +80,41 @@ if ($ss_conf_ct > 0)
 	$SSenable_languages =			$row[2];
 	$SSlanguage_method =			$row[3];
 	$SSqc_features_active =			$row[4];
+	$SSallow_web_debug =			$row[5];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

+$url_id = preg_replace('/[^0-9]/','',$url_id);
+$active = preg_replace('/[^A-Z]/','',$active);
+$url_call_length = preg_replace('/[^0-9]/','',$url_call_length);
+$url_rank = preg_replace('/[^-0-9]/','',$url_rank);
+$SUBMIT = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$SUBMIT);
+$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action);
+$url_address = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$url_address);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
-	$url_id = preg_replace('/[^0-9]/','',$url_id);
 	$campaign_id = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign_id);
 	$entry_type = preg_replace('/[^_0-9a-zA-Z]/','',$entry_type);
-	$active = preg_replace('/[^A-Z]/','',$active);
 	$url_type = preg_replace('/[^_0-9a-zA-Z]/','',$url_type);
-	$url_rank = preg_replace('/[^-0-9]/','',$url_rank);
 	$url_statuses = preg_replace('/[^- _0-9a-zA-Z]/','',$url_statuses);
 	$url_lists = preg_replace('/[^- _0-9]/','',$url_lists);
 	$url_description = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$url_description);
-	$url_call_length = preg_replace('/[^0-9]/','',$url_call_length);
 	}	# end of non_latin
 else
 	{
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$url_id = preg_replace('/[^0-9]/','',$url_id);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	$campaign_id = preg_replace('/[^-_0-9\p{L}]/u','',$campaign_id);
 	$entry_type = preg_replace('/[^_0-9\p{L}]/u','',$entry_type);
-	$active = preg_replace('/[^A-Z]/','',$active);
 	$url_type = preg_replace('/[^_0-9\p{L}]/u','',$url_type);
-	$url_rank = preg_replace('/[^-0-9]/','',$url_rank);
 	$url_statuses = preg_replace('/[^- _0-9\p{L}]/u','',$url_statuses);
 	$url_lists = preg_replace('/[^- _0-9]/','',$url_lists);
 	$url_description = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$url_description);
-	$url_call_length = preg_replace('/[^0-9]/','',$url_call_length);
 	}

 $STARTtime = date("U");
@@ -1,7 +1,7 @@
 <?php
 # admin_user_list_new.php
 # 
-# Copyright (C) 2018  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # this screen will control the optional user list new limit override settings 
 #
@@ -11,10 +11,11 @@
 # 161031-1500 - Added overall user option
 # 170409-1546 - Added IP List validation code
 # 180503-2215 - Added new help display
+# 220222-2008 - Added allow_web_debug system setting
 #

-$admin_version = '2.14-3';
-$build = '170409-1546';
+$admin_version = '2.14-5';
+$build = '220222-2008';

 require("dbconnect_mysqli.php");
 require("functions.php");
@@ -46,9 +47,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,qc_features_active,user_territories_active,user_new_lead_limit FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,qc_features_active,user_territories_active,user_new_lead_limit,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $ss_conf_ct = mysqli_num_rows($rslt);
 if ($ss_conf_ct > 0)
 	{
@@ -60,22 +61,29 @@ if ($ss_conf_ct > 0)
 	$SSqc_features_active =			$row[4];
 	$SSuser_territories_active =	$row[5];
 	$SSuser_new_lead_limit =		$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

+$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id);
+$user_override = preg_replace('/[^-0-9]/','',$user_override);
+$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action);
+$stage = preg_replace('/[^-_0-9a-zA-Z]/','',$stage);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
 	$user = preg_replace('/[^-_0-9a-zA-Z]/','',$user);
-	$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id);
-	$user_override = preg_replace('/[^-0-9]/','',$user_override);
 	}	# end of non_latin
 else
 	{
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9\p{L}]/u', '', $user);
 	}

 $STARTtime = date("U");
@@ -1,7 +1,7 @@
 <?php
 # leadloader_template_display.php - version 2.14
 # 
-# Copyright (C) 2021  Matt Florell,Joe Johnson <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell,Joe Johnson <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 120402-2238 - First Build
@@ -18,6 +18,7 @@
 # 170409-1534 - Added IP List validation code
 # 171204-1518 - Fix for custom field duplicate issue, removed link to old lead loader
 # 210312-1700 - Added layout editing functionality
+# 220222-1059 - Added allow_web_debug system setting
 #

 require("dbconnect_mysqli.php");
@@ -52,9 +53,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -65,22 +66,35 @@ if ($qm_conf_ct > 0)
 	$webroot_writable =			$row[3];
 	$SSenable_languages =		$row[4];
 	$SSlanguage_method =		$row[5];
+	$SSallow_web_debug =		$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

+$list_id = preg_replace('/in_file/', '0', $list_id);
+$list_id = preg_replace('/[^0-9]/', '', $list_id);
+$form_action = preg_replace('/[^- \_0-9a-zA-Z]/', '', $form_action);
+$custom_fields_enabled = preg_replace('/[^- \_0-9a-zA-Z]/', '', $custom_fields_enabled);
+$delimiter = preg_replace("/\<|\>|\'|\"|;/",'',$delimiter);
+
+# Variables filtered further down in the code
+# $buffer
+# $sample_template_file
+# $sample_template_file_name
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$template_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $template_id);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$template_id = preg_replace('/[^-_0-9\p{L}]/u', '', $template_id);
 	}
-$list_id = preg_replace('/in_file/', '0', $list_id);
-$list_id = preg_replace('/[^0-9]/', '', $list_id);

 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
@@ -343,7 +357,7 @@ else if ($form_action=="update_template" && $template_id)

 						if ($DB>0) {echo "$A_field_label[$o]|$A_field_type[$o]\n";}

-						if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') and ($A_field_type[$o]!='SWITCH') )
+						if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') and ($A_field_type[$o]!='SWITCH') and ($A_field_type[$o]!='BUTTON') )
 							{
 							if (!preg_match("/\|$A_field_label[$o]\|/",$vicidial_list_fields))
 								{
@@ -498,7 +512,7 @@ else

 					if ($DB>0) {echo "$A_field_label[$o]|$A_field_type[$o]\n";}

-					if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') and ($A_field_type[$o]!='SWITCH') )
+					if ( ($A_field_type[$o]!='DISPLAY') and ($A_field_type[$o]!='SCRIPT') and ($A_field_type[$o]!='SWITCH') and ($A_field_type[$o]!='BUTTON') )
 						{
 						if (!preg_match("/\|$A_field_label[$o]\|/",$vicidial_list_fields))
 							{
@@ -1,7 +1,7 @@
 <?php
 # nanpa_type.php
 # 
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed to work with the NANPA exchange(NPA-NXX-X) data and
 # the wireless-to-wired and wired-to-wireless number portability data from
@@ -31,10 +31,11 @@
 # 140702-2251 - Added prefix phone type of V as landline
 # 170409-1531 - Added IP List validation code
 # 210618-1012 - Added CORS support
+# 220222-1917 - Added allow_web_debug system setting
 #

-$version = '2.14-4';
-$build = '210618-1012';
+$version = '2.14-5';
+$build = '220222-1917';
 $php_script='nanpa_type.php';

 $startMS = microtime();
@@ -63,25 +64,35 @@ header ("Pragma: no-cache");                          // HTTP/1.0

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT pass_hash_enabled FROM system_settings;";
+$stmt = "SELECT use_non_latin,pass_hash_enabled,allow_web_debug FROM system_settings;";
 $rslt=mysqli_query($link, $stmt);
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
 	$row=mysqli_fetch_row($rslt);
-	$SSpass_hash_enabled =		$row[0];
+	$non_latin =				$row[0];
+	$SSpass_hash_enabled =		$row[1];
+	$SSallow_web_debug =		$row[2];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

 $DB=preg_replace('/[^0-9]/','',$DB);
-$user = preg_replace("/'|\"|\\\\|;/","",$user);
-$pass = preg_replace("/'|\"|\\\\|;/","",$pass);
-$user=preg_replace('/[^-_0-9a-zA-Z]/','',$user);
-$pass=preg_replace('/[^-_0-9a-zA-Z]/','',$pass);
 $function = preg_replace('/[^-\_0-9a-zA-Z]/', '',$function);
 $phone_number = preg_replace('/[^\|0-9]/','',$phone_number);

+if ($non_latin < 1)
+	{
+	$user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user);
+	$pass = preg_replace('/[^-_0-9a-zA-Z]/', '', $pass);
+	}
+else
+	{
+	$user = preg_replace('/[^-_0-9\p{L}]/u', '', $user);
+	$pass = preg_replace('/[^-_0-9\p{L}]/u', '', $pass);
+	}
+


 ################################################################################
@@ -55,12 +55,13 @@
 # 210314-2039 - Added DID Description for inbound calls
 # 211216-0846 - Added new User Group options
 # 220217-2046 - Added input variable filters
+# 220221-1514 - Added allow_web_debug system setting
 #

 $startMS = microtime();

-$version = '2.14-42';
-$build = '220217-2046';
+$version = '2.14-43';
+$build = '220221-1514';

 header ("Content-type: text/html; charset=utf-8");

@@ -151,9 +152,9 @@ $db_source = 'M';

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,report_default_format,enable_pause_code_limits FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,report_default_format,enable_pause_code_limits,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -167,7 +168,9 @@ if ($qm_conf_ct > 0)
 	$agent_whisper_enabled =		$row[6];
 	$SSreport_default_format =		$row[7];
 	$SSenable_pause_code_limits =	$row[8];
+	$SSallow_web_debug =			$row[9];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

@@ -339,8 +342,8 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
 $RR = preg_replace('/[^0-9]/', '', $RR);
 $inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $inbound);
@@ -383,6 +386,10 @@ $server_ip = preg_replace('/[^-\._0-9a-zA-Z]/', '', $server_ip);
 $SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
 $submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);

+# Variables filtered further down in the code
+# $user_group_filter
+# $ingroup_filter
+
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -669,7 +676,7 @@ $group_string='|';
 $group_ct = count($groups);
 while($i < $group_ct)
 	{
-	$groups[$i] = preg_replace('/[^-_0-9a-zA-Z]/', '', $groups[$i]);
+	$groups[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $groups[$i]);
 	if ( (preg_match("/ $groups[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/ALL-/",$LOGallowed_campaigns)) )
 		{
 		$group_string .= "$groups[$i]|";
@@ -686,7 +693,7 @@ $user_group_string='|';
 $user_group_ct = count($user_group_filter);
 while($i < $user_group_ct)
 	{
-	$user_group_filter[$i] = preg_replace('/[^-_0-9a-zA-Z]/', '', $user_group_filter[$i]);
+	$user_group_filter[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group_filter[$i]);
 #	if ( (preg_match("/ $user_group_filter[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/ALL-/",$LOGallowed_campaigns)) )
 #		{
 		$user_group_string .= "$user_group_filter[$i]|";
@@ -703,7 +710,7 @@ $ingroup_string='|';
 $ingroup_ct = count($ingroup_filter);
 while($i < $ingroup_ct)
 	{
-	$ingroup_filter[$i] = preg_replace('/[^-_0-9a-zA-Z]/', '', $ingroup_filter[$i]);
+	$ingroup_filter[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $ingroup_filter[$i]);
 	$ingroup_string .= "$ingroup_filter[$i]|";
 	$ingroup_SQL .= "'$ingroup_filter[$i]',";
 	$usergroupQS .= "&ingroup_filter[]=$ingroup_filter[$i]";
@@ -1,7 +1,7 @@
 <?php 
 # realtime_report_mobile.php
 # 
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>, Joe Johnson <joej@vicidial.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>, Joe Johnson <joej@vicidial.com>    LICENSE: AGPLv2
 #
 # streamlined mobile version of live real-time stats for the VICIDIAL Auto-Dialer all servers
 #
@@ -15,12 +15,13 @@
 # 190228-1535 - Minor pre-release changes
 # 200309-1819 - Modifications for display formatting
 # 210827-1818 - Fix for security issue
+# 220221-1522 - Added allow_web_debug system setting
 #

 $startMS = microtime();

-$version = '2.14-3';
-$build = '200309-1819';
+$version = '2.14-4';
+$build = '220221-1522';

 header ("Content-type: text/html; charset=utf-8");

@@ -89,7 +90,7 @@ if (isset($_GET["PRESETstats"]))			{$PRESETstats=$_GET["PRESETstats"];}
 	elseif (isset($_POST["PRESETstats"]))	{$PRESETstats=$_POST["PRESETstats"];}
 if (isset($_GET["AGENTtimeSTATS"]))				{$AGENTtimeSTATS=$_GET["AGENTtimeSTATS"];}
 	elseif (isset($_POST["AGENTtimeSTATS"]))	{$AGENTtimeSTATS=$_POST["AGENTtimeSTATS"];}
-if (isset($_GET["INGROUPcolorOVERRIDE"]))				{$INGROUPcolorOVERRIDE=$_GET["INGROUPcolorOVERRIDE"];}
+if (isset($_GET["INGROUPcolorOVERRIDE"]))			{$INGROUPcolorOVERRIDE=$_GET["INGROUPcolorOVERRIDE"];}
 	elseif (isset($_POST["INGROUPcolorOVERRIDE"]))	{$INGROUPcolorOVERRIDE=$_POST["INGROUPcolorOVERRIDE"];}
 if (isset($_GET["droppedOFtotal"]))				{$droppedOFtotal=$_GET["droppedOFtotal"];}
 	elseif (isset($_POST["droppedOFtotal"]))	{$droppedOFtotal=$_POST["droppedOFtotal"];}
@@ -101,9 +102,9 @@ $db_source = 'M';

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,report_default_format,enable_pause_code_limits FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,agent_whisper_enabled,report_default_format,enable_pause_code_limits,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -117,7 +118,9 @@ if ($qm_conf_ct > 0)
 	$agent_whisper_enabled =		$row[6];
 	$SSreport_default_format =		$row[7];
 	$SSenable_pause_code_limits =	$row[8];
+	$SSallow_web_debug =			$row[9];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

@@ -263,8 +266,8 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
 $RR = preg_replace('/[^0-9]/', '', $RR);
 $inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $inbound);
@@ -295,6 +298,8 @@ $INGROUPcolorOVERRIDE = preg_replace('/[^-_0-9a-zA-Z]/', '', $INGROUPcolorOVERRI
 $droppedOFtotal = preg_replace('/[^-_0-9a-zA-Z]/', '', $droppedOFtotal);
 $server_ip=preg_replace("/[^0-9\.]/", "", $server_ip);
 $user_group_filter=preg_replace('/[^-_0-9\p{L}]/u','',$user_group_filter);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
 $TOTALdisplay+=$ALLINGROUPstats;

 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -5,7 +5,7 @@
 # custom reports and make them available to user groups
 # of their choosing
 #
-# Copyright (C) 2018 Joseph Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022 Joseph Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -16,6 +16,7 @@
 # 170829-0040 - Added screen color settings
 # 171002-2140 - Added capability to add/modify preset variables
 # 180508-2215 - Added new help display
+# 220221-1926 - Added allow_web_debug system setting
 #

 $startMS = microtime();
@@ -66,9 +67,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -81,9 +82,32 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[5];
 	$SSlanguage_method =			$row[6];
 	$active_modules =				$row[7];
+	$SSallow_web_debug =			$row[8];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
+
+$report_name = preg_replace('/[^- \,\|\_0-9a-zA-Z]/', '', $report_name);
+$upd_report_name = preg_replace('/[^- \,\|\_0-9a-zA-Z]/', '', $upd_report_name);
+$domain = preg_replace('/[^-\:\.\/\_0-9a-zA-Z]/', '', $domain);
+$upd_domain = preg_replace('/[^-\:\.\/\_0-9a-zA-Z]/', '', $upd_domain);
+$path_name = preg_replace('/[^-\[\]\:\.\/\_0-9a-zA-Z]/', '', $path_name);
+$upd_path_name = preg_replace('/[^-\[\]\:\.\/\_0-9a-zA-Z]/', '', $upd_path_name);
+$presets_string = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$presets_string);
+$upd_presets_string = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$upd_presets_string);
+$slave = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$slave);
+$upd_slave = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$upd_slave);
+$add_custom_report = preg_replace('/[^- \,\|\_0-9a-zA-Z]/', '', $add_custom_report);
+$delete_custom_report = preg_replace('/[^- \,\|\_0-9a-zA-Z]/', '', $delete_custom_report);
+$update_custom_report = preg_replace('/[^- \,\|\_0-9a-zA-Z]/', '', $update_custom_report);
+$upd_custom_report_id = preg_replace('/[^- \,\|\_0-9a-zA-Z]/', '', $upd_custom_report_id);
+$upd_report_name = preg_replace('/[^- \,\|\_0-9a-zA-Z]/', '', $upd_report_name);
+
+# Variables filtered further down in the code
+# $custom_reports_user_groups
+# $upd_custom_reports_user_groups
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -91,8 +115,8 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}

 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
@@ -242,7 +266,9 @@ if ($add_custom_report) {
 			if (mysqli_affected_rows($link)<1) {
 				$error_msg="<BR><B>"._QXZ("INSERT FAILED")."</B><BR>";
 			} else {
-				$user_group_stmt="select user_group, allowed_custom_reports from vicidial_user_groups where user_group in ('".implode("','", $custom_reports_user_groups)."') $LOGadmin_viewable_groupsSQL";
+				$temp_custom_reports_user_groups = implode("','", $custom_reports_user_groups);
+				$temp_custom_reports_user_groups = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$temp_custom_reports_user_groups);
+				$user_group_stmt="select user_group, allowed_custom_reports from vicidial_user_groups where user_group in ('".$temp_custom_reports_user_groups."') $LOGadmin_viewable_groupsSQL";
 				#		echo $user_group_stmt."<BR>\n";
 				$user_group_rslt=mysql_to_mysqli($user_group_stmt, $link);
 				while ($user_group_row=mysqli_fetch_array($user_group_rslt)) {
@@ -3,7 +3,7 @@
 # vicidial_sales_viewer.php - VICIDIAL administration page
 # 
 # 
-# Copyright (C) 2017  Joe Johnson,Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Joe Johnson,Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 80310-1500 - first build
@@ -15,6 +15,7 @@
 # 141007-2147 - Finalized adding QXZ translation to all admin files
 # 170217-1213 - Fixed non-latin auth issue #995
 # 170526-2044 - Fixed unfilter variables issue #1015
+# 220221-1921 - Added allow_web_debug system setting
 #

 if (isset($_GET["dcampaign"]))					{$dcampaign=$_GET["dcampaign"];}
@@ -43,9 +44,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -55,10 +56,19 @@ if ($qm_conf_ct > 0)
 	$SSoutbound_autodial_active =	$row[2];
 	$SSenable_languages =			$row[3];
 	$SSlanguage_method =			$row[4];
+	$SSallow_web_debug =			$row[5];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

+$dcampaign = preg_replace('/[^0-9a-zA-Z]/', '', $dcampaign);
+$list_ids = preg_replace('/[^\,0-9a-zA-Z]/', '', $list_ids);
+$forc = preg_replace('/[^0-9a-zA-Z]/', '', $forc);
+$submit_report = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit_report);
+$sales_number = preg_replace('/[^-_0-9a-zA-Z]/', '', $sales_number);
+$sales_time_frame = preg_replace('/[^-_0-9a-zA-Z]/', '', $sales_time_frame);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -66,12 +76,9 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
-$dcampaign = preg_replace('/[^0-9a-zA-Z]/', '', $dcampaign);
-$list_ids = preg_replace('/[^\,0-9a-zA-Z]/', '', $list_ids);
-$forc = preg_replace('/[^0-9a-zA-Z]/', '', $forc);

 $auth=0;
 $reports_auth=0;
@@ -1,7 +1,7 @@
 <?php
 # whiteboard_reports.php
 # 
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
 #
 # A PHP file that is for generating the stats that are displayed in the whiteboard report.  Returns values.
 #
@@ -9,6 +9,7 @@
 # 190302-1707 - Added code to exclude active calls from being counted with some stats
 # 200427-2225 - Added use of slave database, if activated, fixes Issue #1207
 # 210823-0948 - Fix for security issue
+# 220221-1452 - Added allow_web_debug system setting
 #

 require("dbconnect_mysqli.php");
@@ -60,13 +61,20 @@ if (isset($_GET["rpt_type"]))					{$rpt_type=$_GET["rpt_type"];}

 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);

+if (!$query_date) {$query_date=date("Y-m-d");}
+if (!$query_time) {$query_time="08:00:00";}
+
+if (!$end_date) {$end_date=date("Y-m-d");}
+if (!$end_time) {$end_time=date("H:i:00");}
+
+
 $report_name="Real-Time Whiteboard Report";

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,admin_screen_colors FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,admin_screen_colors,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {$MAIN.="$stmt\n";}
+#if ($DB) {$MAIN.="$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -78,39 +86,12 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
 	$admin_screen_colors =			$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################

-if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) )
-	{
-	mysqli_close($link);
-	$use_slave_server=1;
-	$db_source = 'S';
-	require("dbconnect_mysqli.php");
-	$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
-	}
-
-
-if (!$query_date) {$query_date=date("Y-m-d");}
-if (!$query_time) {$query_time="08:00:00";}
-
-if (!$end_date) {$end_date=date("Y-m-d");}
-if (!$end_time) {$end_time=date("H:i:00");}
-
-if ($hourly_display) 
-	{	
-	$query_date=date("Y-m-d", date("U")-(3600*$hourly_display));
-	$query_time=date("H:i:00", date("U")-(3600*$hourly_display));
-	$end_date=date("Y-m-d");
-	$end_time=date("H:i:00");
-	} 
-
-$rpt_string="";
-
-$exclude_statuses=array("INCALL", "DISPO", "QUEUE", "DONEM");
-$exc_status_SQL=" and status not in ('".implode("','", $exclude_statuses)."') ";
-
 $query_date=preg_replace("/[^0-9\-]/", "", $query_date);
 $end_date=preg_replace("/[^0-9\-]/", "", $end_date);
 $query_time=preg_replace("/[^0-9\:]/", "", $query_time);
@@ -128,6 +109,97 @@ $groups=preg_replace('/[^-_0-9\p{L}]/u','',$groups);
 $dids=preg_replace('/[^-_0-9\p{L}]/u','',$dids);
 $status_flags=preg_replace('/[^-_0-9\p{L}]/u','',$status_flags);

+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$PHP_AUTH_PW);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$PHP_AUTH_PW);
+	}
+
+$auth=0;
+$reports_auth=0;
+$admin_auth=0;
+$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1,0);
+if ($auth_message == 'GOOD')
+	{$auth=1;}
+
+if ($auth > 0)
+	{
+	$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports='1';";
+	if ($DB) {echo "|$stmt|\n";}
+	$rslt=mysql_to_mysqli($stmt, $link);
+	$row=mysqli_fetch_row($rslt);
+	$admin_auth=$row[0];
+
+	$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports='1';";
+	if ($DB) {echo "|$stmt|\n";}
+	$rslt=mysql_to_mysqli($stmt, $link);
+	$row=mysqli_fetch_row($rslt);
+	$reports_auth=$row[0];
+
+	if ($reports_auth < 1)
+		{
+		$VDdisplayMESSAGE = _QXZ("You are not allowed to view reports");
+		Header ("Content-type: text/html; charset=utf-8");
+		echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
+		exit;
+		}
+	if ( ($reports_auth > 0) and ($admin_auth < 1) )
+		{
+		$ADD=999999;
+		$reports_only_user=1;
+		}
+	}
+else
+	{
+	$VDdisplayMESSAGE = _QXZ("Login incorrect, please try again");
+	if ($auth_message == 'LOCK')
+		{
+		$VDdisplayMESSAGE = _QXZ("Too many login attempts, try again in 15 minutes");
+		Header ("Content-type: text/html; charset=utf-8");
+		echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
+		exit;
+		}
+	if ($auth_message == 'IPBLOCK')
+		{
+		$VDdisplayMESSAGE = _QXZ("Your IP Address is not allowed") . ": $ip";
+		Header ("Content-type: text/html; charset=utf-8");
+		echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
+		exit;
+		}
+	Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
+	Header("HTTP/1.0 401 Unauthorized");
+	echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
+	exit;
+	}
+
+if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) )
+	{
+	mysqli_close($link);
+	$use_slave_server=1;
+	$db_source = 'S';
+	require("dbconnect_mysqli.php");
+	$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
+	}
+
+if ($hourly_display) 
+	{	
+	$query_date=date("Y-m-d", date("U")-(3600*$hourly_display));
+	$query_time=date("H:i:00", date("U")-(3600*$hourly_display));
+	$end_date=date("Y-m-d");
+	$end_time=date("H:i:00");
+	} 
+
+$rpt_string="";
+
+$exclude_statuses=array("INCALL", "DISPO", "QUEUE", "DONEM");
+$exc_status_SQL=" and status not in ('".implode("','", $exclude_statuses)."') ";
+
+
 if (preg_match("/status_performance/", $rpt_type)) {
 	if (!$campaigns || in_array("--ALL--", $campaigns)) {
 		$campaign_id_SQL="";