Another batch of Added allow_web_debug system setting updates

git-svn-id: svn://192.168.202.10@3572 3d104415-ff17-0410-8863-d5cf3c621b8a

agc_2-X/trunk/www/vicidial/DNCcom_inbound_filter.php

@@ -1,7 +1,7 @@
 <?php
 # DNCcom_inbound_filter.php
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script searches DNC.COM's scrub service for incoming DID phone numbers
 # and returns a blocking match of '1' that will send the call to the Filter route
@@ -28,6 +28,7 @@
 # 170923-1905 - First Build
 # 170926-1016 - Added in_filter_override option and cache searching option
 # 170927-2127 - Changed to log flags that are not used to filter, added in_cache_override option, added connect retry if rejected
+# 220224-1051 - Added allow_web_debug system setting
 #
 
 header ("Content-type: text/html; charset=utf-8");
@@ -48,29 +49,33 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
 	$row=mysqli_fetch_row($rslt);
 	$non_latin =				$row[0];
 	$webroot_writable =			$row[1];
+	$SSallow_web_debug =		$row[2];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$in_filter_override=preg_replace('/[^-_0-9a-zA-Z]/','',$in_filter_override);
+$in_cache_override=preg_replace('/[^-_0-9a-zA-Z]/','',$in_cache_override);
+
 if ($non_latin < 1)
 	{
 	$phone=preg_replace('/[^-_0-9a-zA-Z]/','',$phone);
 	}
 else
 	{
-	$phone = preg_replace("/'|\"|\\\\|;/","",$phone);
+	$phone = preg_replace('/[^-_0-9\p{L}]/u', '', $phone);
 	}
-$in_filter_override=preg_replace('/[^-_0-9a-zA-Z]/','',$in_filter_override);
+
-$in_cache_override=preg_replace('/[^-_0-9a-zA-Z]/','',$in_cache_override);
 $filter_count=0;
 $ENTRYdate = date("mdHis");
 

agc_2-X/trunk/www/vicidial/bench_agent_assign.php

@@ -1,10 +1,11 @@
 <?php 
 # bench_agent_assign.php
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 190815-2242 - First build
+# 220224-1753 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -40,9 +41,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -53,29 +54,34 @@ if ($qm_conf_ct > 0)
 	$user_territories_active =		$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$list_id = preg_replace('/[^0-9]/', '', $list_id);
+$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
 	$absent_agent = preg_replace('/[^-_0-9a-zA-Z]/', '', $absent_agent);
 	$bench_agent = preg_replace('/[^-_0-9a-zA-Z]/', '', $bench_agent);
+	$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
-	$absent_agent = preg_replace("/'|\"|\\\\|;/","",$absent_agent);
+	$absent_agent = preg_replace('/[^-_0-9\p{L}]/u', '', $absent_agent);
-	$bench_agent = preg_replace("/'|\"|\\\\|;/","",$bench_agent);
+	$bench_agent = preg_replace('/[^-_0-9\p{L}]/u', '', $bench_agent);
+	$group = preg_replace('/[^-_0-9\p{L}]/u', '', $group);
 	}
 
-$list_id = preg_replace('/[^0-9]/', '', $list_id);
-$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
-$server_ip = preg_replace('/[^-._0-9a-zA-Z]/', '', $server_ip);
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);

agc_2-X/trunk/www/vicidial/callbacks_bulk_change.php

@@ -16,6 +16,7 @@
 # 170822-2255 - Added screen color settings
 # 170829-0040 - Added screen color settings
 # 220217-2220 - Added input variable filtering
+# 220224-1752 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -33,8 +34,8 @@ if (isset($_GET["group"]))				{$group=$_GET["group"];}
 	elseif (isset($_POST["group"]))		{$group=$_POST["group"];}
 if (isset($_GET["stage"]))				{$stage=$_GET["stage"];}
 	elseif (isset($_POST["stage"]))		{$stage=$_POST["stage"];}
-if (isset($_GET["confirm_transfer"]))				{$confirm_transfer=$_GET["confirm_transfer"];}
+if (isset($_GET["confirm_transfer"]))			{$confirm_transfer=$_GET["confirm_transfer"];}
-	elseif (isset($_POST["confirm_transfer"]))		{$confirm_transfer=$_POST["confirm_transfer"];}
+	elseif (isset($_POST["confirm_transfer"]))	{$confirm_transfer=$_POST["confirm_transfer"];}
 if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
 if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
@@ -48,9 +49,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -60,10 +61,17 @@ if ($qm_conf_ct > 0)
 	$SSoutbound_autodial_active =	$row[2];
 	$SSenable_languages =			$row[3];
 	$SSlanguage_method =			$row[4];
+	$SSallow_web_debug =			$row[5];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$convert_to_anyone = preg_replace('/[^-_0-9a-zA-Z]/', '', $convert_to_anyone);
+$confirm_transfer = preg_replace('/[^-_0-9a-zA-Z]/', '', $confirm_transfer);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -75,9 +83,9 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
-	$old_user = preg_replace('/[^-_0-9a-zA-Z]/', '', $old_user);
+	$old_user = preg_replace('/[^-_0-9\p{L}]/u', '', $old_user);
 	$new_user = preg_replace('/[^-_0-9\p{L}]/u', '', $new_user);
 	$group = preg_replace('/[^-_0-9\p{L}]/u', '', $group);
 	$stage = preg_replace('/[^-_0-9\p{L}]/u', '', $stage);

agc_2-X/trunk/www/vicidial/callbacks_bulk_move.php

@@ -1,7 +1,7 @@
 <?php
 # callbacks_bulk_move.php
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 # 150218-0923 - First build based on callbacks_bulk_change.php
@@ -10,6 +10,7 @@
 # 170409-1548 - Added IP List validation code
 # 180508-0115 - Added new help display
 # 191013-0853 - Fixes for PHP7
+# 220224-1656 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -39,7 +40,6 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 	elseif (isset($_POST["submit"]))	{$submit=$_POST["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
-
 if (isset($_GET["new_list_id"]))			{$new_list_id=$_GET["new_list_id"];}
 	elseif (isset($_POST["new_list_id"]))	{$new_list_id=$_POST["new_list_id"];}
 if (isset($_GET["new_status"]))				{$new_status=$_GET["new_status"];}
@@ -65,9 +65,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method,qc_features_active FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method,qc_features_active,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -78,19 +78,48 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[3];
 	$SSlanguage_method =			$row[4];
 	$SSqc_features_active =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$list_id = preg_replace('/[^0-9a-zA-Z]/', '', $list_id);
+$new_list_id = preg_replace('/[^0-9a-zA-Z]/', '', $new_list_id);
+$days = preg_replace('/[^-0-9]/', '', $days);
+$days_uncalled = preg_replace('/[^-0-9]/', '', $days_uncalled);
+$stage = preg_replace('/[^-_0-9a-zA-Z]/', '', $stage);
+$confirm_transfer = preg_replace('/[^-_0-9a-zA-Z]/', '', $confirm_transfer);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$purge_called_records = preg_replace('/[^-_0-9a-zA-Z]/', '', $purge_called_records);
+$purge_uncalled_records = preg_replace('/[^-_0-9a-zA-Z]/', '', $purge_uncalled_records);
+
+# Variables filtered further down in the code
+# $cb_lists
+# $cb_groups
+# $cb_user_groups
+# $cb_users
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$revert_status = preg_replace('/[^-_0-9a-zA-Z]/', '', $revert_status);
+	$new_status = preg_replace('/[^-_0-9a-zA-Z]/', '', $new_status);
+	$campaign_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $campaign_id);
+	$user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user);
+	$user_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $user_group);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$revert_status = preg_replace('/[^-_0-9\p{L}]/u', '', $revert_status);
+	$new_status = preg_replace('/[^-_0-9\p{L}]/u', '', $new_status);
+	$campaign_id = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign_id);
+	$user = preg_replace('/[^-_0-9\p{L}]/u', '', $user);
+	$user_group = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group);
 	}
 
 $StarTtimE = date("U");
@@ -121,6 +150,7 @@ if (strlen($user) < 1)			{$category='USERS';			$record_id=$user;}
 if (strlen($user_group) < 1)	{$category='USERGROUPS';	$record_id=$user_group;}
 if (strlen($list_id) < 1)		{$category='LISTS';			$record_id=$list_id;}
 if (strlen($campaign_id) < 1)	{$category='CAMPAIGNS';		$record_id=$campaign_id;}
+$cb_dispos=array("CALLBK","CBHOLD");
 
 $auth=0;
 $auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1,0);
@@ -549,12 +579,16 @@ if ($SUBMIT && $new_list_id && ($new_status || $revert_status))
 			}
 		else 
 			{
-			$usersSQL=" and vc.user in ('".implode("','", $cb_users)."') ";
+			$usersSQLx="";
 			$usersQS="";
 			for ($i=0; $i<count($cb_users); $i++) 
 				{
+				$cb_users[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $cb_users[$i]);
 				$usersQS.="&cb_users[]=".$cb_users[$i];
+				if ($i > 0) {$usersSQL.="','";}
+				$usersSQLx.="$cb_users[$i]";
 				}
+			$usersSQL=" and vc.user in ('".$usersSQLx."') ";
 			}
 		}
 
@@ -576,12 +610,16 @@ if ($SUBMIT && $new_list_id && ($new_status || $revert_status))
 			}
 		else 
 			{
-			$user_groupsSQL=" and vc.user_group in ('".implode("','", $cb_user_groups)."') ";
+			$user_groupsSQLx="";
 			$user_groupsQS="";
 			for ($i=0; $i<count($cb_user_groups); $i++) 
 				{
+				$cb_user_groups[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $cb_user_groups[$i]);
 				$user_groupsQS.="&cb_user_groups[]=".$cb_user_groups[$i];
+				if ($i > 0) {$user_groupsSQL.="','";}
+				$user_groupsSQLx.="$cb_user_groups[$i]";
 				}
+			$user_groupsSQL=" and vc.user_group in ('".$user_groupsSQLx."') ";
 			}
 		}
 
@@ -612,12 +650,16 @@ if ($SUBMIT && $new_list_id && ($new_status || $revert_status))
 			}
 		else 
 			{
-			$listsSQL=" and vc.list_id in ('".implode("','", $cb_lists)."') ";
+			$listsSQLx="";
 			$listsQS="";
 			for ($i=0; $i<count($cb_lists); $i++) 
 				{
+				$cb_lists[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $cb_lists[$i]);
 				$listsQS.="&cb_lists[]=".$cb_lists[$i];
+				if ($i > 0) {$listsSQL.="','";}
+				$listsSQLx.="$cb_lists[$i]";
 				}
+			$listsSQL=" and vc.list_id in ('".$listsSQLx."') ";
 			}
 		}
 
@@ -639,12 +681,16 @@ if ($SUBMIT && $new_list_id && ($new_status || $revert_status))
 			}
 		else
 			{
-			$groupsSQL=" and vc.campaign_id in ('".implode("','", $cb_groups)."') ";
+			$groupsSQLx="";
 			$groupsQS="";
 			for ($i=0; $i<count($cb_groups); $i++) 
 				{
+				$cb_groups[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $cb_groups[$i]);
 				$groupsQS.="&cb_groups[]=".$cb_groups[$i];
+				if ($i > 0) {$groupsSQL.="','";}
+				$groupsSQLx.="$cb_groups[$i]";
 				}
+			$groupsSQL=" and vc.campaign_id in ('".$groupsSQLx."') ";
 			}
 		}
 
@@ -658,7 +704,6 @@ if ($SUBMIT && $new_list_id && ($new_status || $revert_status))
 	$callback_dispo_stmt="SELECT distinct status from vicidial_statuses where scheduled_callback='Y' UNION SELECT distinct status from vicidial_campaign_statuses where scheduled_callback='Y' ".preg_replace("/vc\./", "", $groupsSQL);
 	if ($DB) {echo $callback_dispo_stmt."<BR>";}
 	$callback_dispo_rslt=mysql_to_mysqli($callback_dispo_stmt, $link);
-	$cb_dispos=array("CALLBK","CBHOLD");
 	while ($cb_dispo_row=mysqli_fetch_row($callback_dispo_rslt)) 
 		{
 		array_push($cb_dispos, "$cb_dispo_row[0]");
@@ -854,10 +899,30 @@ else if ($SUBMIT && $new_list_id  && ($new_status || $revert_status) && (count($
 
 	echo "<table width='500' align='center'><tr><td align='left'>";
 	echo _QXZ("You are about to transfer")." $callback_ct "._QXZ("callbacks from")."<BR><UL>\n";
-	if (count($cb_groups)>0) {echo "<LI>"._QXZ("campaigns")." ".implode(",", $cb_groups)."</LI>\n";}
+	if (count($cb_groups)>0) 
-	if (count($cb_lists)>0) {echo "<LI>"._QXZ("lists")." ".implode(",", $cb_lists)."</LI>\n";}
+		{
-	if (count($cb_user_groups)>0) {echo"<LI>". _QXZ("user groups")." ".implode(",", $cb_user_groups)."</LI>\n";}
+		$temp_groups = implode(",", $cb_groups);
-	if (count($cb_users)>0) {echo "<LI>"._QXZ("users")." ".implode(",", $cb_users)."</LI>\n";}
+		$temp_groups = preg_replace('/[^-\,\_0-9\p{L}]/u', '', $temp_groups);
+		echo "<LI>"._QXZ("campaigns")." ".$temp_groups."</LI>\n";
+		}
+	if (count($cb_lists)>0) 
+		{
+		$temp_lists = implode(",", $cb_lists);
+		$temp_lists = preg_replace('/[^-\,\_0-9\p{L}]/u', '', $temp_lists);
+		echo "<LI>"._QXZ("lists")." ".$temp_lists."</LI>\n";
+		}
+	if (count($cb_user_groups)>0) 
+		{
+		$temp_groups = implode(",", $cb_user_groups);
+		$temp_groups = preg_replace('/[^-\,\_0-9\p{L}]/u', '', $temp_groups);
+		echo"<LI>". _QXZ("user groups")." ".$temp_groups."</LI>\n";
+		}
+	if (count($cb_users)>0) 
+		{
+		$temp_users = implode(",", $cb_users);
+		$temp_users = preg_replace('/[^-\,\_0-9\p{L}]/u', '', $temp_users);
+		echo "<LI>"._QXZ("users")." ".$temp_users."</LI>\n";
+		}
 	if ($days_uncalled) {echo "<LI>"._QXZ("where leads have been LIVE and uncalled for ")." $days_uncalled "._QXZ("days")."</LI>\n";}
 	echo "</UL><BR>";
 

agc_2-X/trunk/www/vicidial/callcard_admin.php

@@ -1,7 +1,7 @@
 <?php
 # callcard_admin.php
 # 
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This callcard script is to administer the callcard accounts in ViciDial
 # it is separate from the standard admin.php script. callcard_enabled in
@@ -23,10 +23,11 @@
 # 170829-0040 - Added screen color settings
 # 180508-0115 - Added new help display
 # 201111-1615 - Fix for Issue #1230
+# 220224-1631 - Added allow_web_debug system setting
 #
 
-$version = '2.14-13';
+$version = '2.14-14';
-$build = '201111-1615';
+$build = '220224-1631';
 
 $MT[0]='';
 
@@ -91,9 +92,9 @@ $SEARCHONLY=0;
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,callcard_enabled,enable_languages,language_method,active_modules,contacts_enabled,allow_emails,outbound_autodial_active,enable_tts_integration,sounds_central_control_active,qc_features_active,enable_auto_reports,campaign_cid_areacodes_enabled FROM system_settings;";
+$stmt = "SELECT use_non_latin,callcard_enabled,enable_languages,language_method,active_modules,contacts_enabled,allow_emails,outbound_autodial_active,enable_tts_integration,sounds_central_control_active,qc_features_active,enable_auto_reports,campaign_cid_areacodes_enabled,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $ss_conf_ct = mysqli_num_rows($rslt);
 if ($ss_conf_ct > 0)
 	{
@@ -111,27 +112,51 @@ if ($ss_conf_ct > 0)
 	$SSqc_features_active =				$row[10];
 	$SSenable_auto_reports =			$row[11];
 	$SScampaign_cid_areacodes_enabled = $row[12];
+	$SSallow_web_debug =				$row[13];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$DB = preg_replace('/[^0-9]/','',$DB);
+$action = preg_replace('/[^\_0-9a-zA-Z]/','',$action);
+$card_id = preg_replace('/[^-\_0-9]/','',$card_id);
+$run = preg_replace('/[^0-9]/','',$run);
+$batch = preg_replace('/[^0-9a-zA-Z]/','',$batch);
+$pack = preg_replace('/[^0-9]/','',$pack);
+$sequence = preg_replace('/[^0-9]/','',$sequence);
+$pin = preg_replace('/[^0-9a-zA-Z]/','',$pin);
+$starting_batch = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$starting_batch);
+$status = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$status);
+$total = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$total);
+$comment = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$comment);
+$balance_minutes = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$balance_minutes);
+$initial_value = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$initial_value);
+$initial_minutes = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$initial_minutes);
+$note_purchase_order = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_purchase_order);
+$note_printer = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_printer);
+$note_did = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_did);
+$inbound_group_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$inbound_group_id);
+$note_language = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_language);
+$note_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_name);
+$note_comments = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_comments);
+$SUBMIT = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$SUBMIT);
 
 if ($non_latin < 1)
 	{
-	### Clean Variable Values ###
-	$DB = preg_replace('/[^0-9]/','',$DB);
-	$action = preg_replace('/[^\_0-9a-zA-Z]/','',$action);
-	$card_id = preg_replace('/[^-\_0-9]/','',$card_id);
-	$run = preg_replace('/[^0-9]/','',$run);
-	$batch = preg_replace('/[^0-9a-zA-Z]/','',$batch);
-	$pack = preg_replace('/[^0-9]/','',$pack);
-	$sequence = preg_replace('/[^0-9]/','',$sequence);
 	$territory_description = preg_replace('/[^- \_\.\,0-9a-zA-Z]/','',$territory_description);
-	$user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$user);
+	$user = preg_replace('/[^-_0-9a-zA-Z]/', '',$user);
-	$old_territory = preg_replace('/[^-\_0-9a-zA-Z]/', '',$old_territory);
+	$old_territory = preg_replace('/[^-_0-9a-zA-Z]/', '',$old_territory);
-	$old_user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$old_user);
+	$old_user = preg_replace('/[^-_0-9a-zA-Z]/', '',$old_user);
-	$accountid = preg_replace('/[^-\_0-9a-zA-Z]/', '',$accountid);
+	$accountid = preg_replace('/[^-_0-9a-zA-Z]/', '',$accountid);
-	$pin = preg_replace('/[^0-9a-zA-Z]/','',$pin);
+	}
+else
+	{
+	$territory_description = preg_replace('/[^- \_\.\,0-9\p{L}]/u','',$territory_description);
+	$user = preg_replace('/[^-_0-9\p{L}]/u', '',$user);
+	$old_territory = preg_replace('/[^-_0-9\p{L}]/u', '',$old_territory);
+	$old_user = preg_replace('/[^-_0-9\p{L}]/u', '',$old_user);
+	$accountid = preg_replace('/[^-_0-9\p{L}]/u', '',$accountid);
 	}
 
 if (preg_match("/YES/i",$batch))
@@ -156,10 +181,10 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PASS = preg_replace("/'|\"|\\\\|;/","",$PASS);
+	$PASS = preg_replace('/[^-_0-9\p{L}]/u', '', $PASS);
-	$USER = preg_replace("/'|\"|\\\\|;/","",$USER);
+	$USER = preg_replace('/[^-_0-9\p{L}]/u', '', $USER);
-	$user = preg_replace("/'|\"|\\\\|;/","",$user);
+	$user = preg_replace('/[^-_0-9\p{L}]/u', '', $user);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
 	}
 
 $stmt="SELECT selected_language from vicidial_users where user='$user';";

agc_2-X/trunk/www/vicidial/closer-fronter_popup.php

@@ -1,7 +1,7 @@
 <?php
 # closer-fronter_popup.php
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # this is the closer popup of a specific call that starts recording the call and allows you to go and fetch info on that caller in the local CRM system.
 # CHANGES
@@ -16,6 +16,7 @@
 # 141007-2210 - Finalized adding QXZ translation to all admin files
 # 141229-2040 - Added code for on-the-fly language translations display
 # 170409-1532 - Added IP List validation code
+# 220224-1626 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -110,9 +111,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -123,19 +124,73 @@ if ($qm_conf_ct > 0)
 	$user_territories_active =		$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip);
+$dialplan_number = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$dialplan_number);
+$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$extension);
+$PHONE_LOGIN = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$PHONE_LOGIN);
+$channel = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$channel);
+$parked_time = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_time);
+$debugvars = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$debugvars);
+$parked_by = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_by);
+$submit = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$submit);
+$SUBMIT = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$SUBMIT);
+$vendor_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$vendor_id);
+$phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone);
+$lead_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$lead_id);
+$first_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$first_name);
+$last_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$last_name);
+$phone_number = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_number);
+$end_call = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$end_call);
+$DB = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$DB);
+$dispo = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$dispo);
+$list_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$list_id);
+$campaign_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$campaign_id);
+$phone_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_code);
+$call_began = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$call_began);
+$tsr = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$tsr);
+$address1 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address1);
+$address2 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address2);
+$address3 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address3);
+$city = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$city);
+$state = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$state);
+$postal_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$postal_code);
+$province = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$province);
+$country_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$country_code);
+$alt_phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$alt_phone);
+$email = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$email);
+$security = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$security);
+$comments = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$comments);
+$status  = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$status);
+$customer_zap_channel  = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$customer_zap_channel);
+$session_id  = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$session_id);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user);
+	$pass = preg_replace('/[^-_0-9a-zA-Z]/', '', $pass);
+	$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
+	$group_selected = preg_replace('/[^-_0-9a-zA-Z]/', '', $group_selected);
+	$groupselect = preg_replace('/[^-_0-9a-zA-Z]/', '', $groupselect);
+	$channel_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $channel_group);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9\p{L}]/u', '', $user);
+	$pass = preg_replace('/[^-_0-9\p{L}]/u', '', $pass);
+	$group = preg_replace('/[^-_0-9\p{L}]/u', '', $group);
+	$group_selected = preg_replace('/[^-_0-9\p{L}]/u', '', $group_selected);
+	$groupselect = preg_replace('/[^-_0-9\p{L}]/u', '', $groupselect);
+	$channel_group = preg_replace('/[^-_0-9\p{L}]/u', '', $channel_group);
 	}
 
 #$DB = '1';	# DEBUG override

agc_2-X/trunk/www/vicidial/closer-fronter_popup2.php

@@ -1,7 +1,7 @@
 <?php
 # closer-fronter_popup2.php
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # this is the closer popup of a specific call that starts recording the call and allows you to go and fetch info on that caller in the local CRM system.
 # CHANGES
@@ -16,6 +16,7 @@
 # 141007-2211 - Finalized adding QXZ translation to all admin files
 # 141229-2038 - Added code for on-the-fly language translations display
 # 170409-1532 - Added IP List validation code
+# 220224-1622 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -110,9 +111,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -123,19 +124,73 @@ if ($qm_conf_ct > 0)
 	$user_territories_active =		$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip);
+$dialplan_number = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$dialplan_number);
+$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$extension);
+$PHONE_LOGIN = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$PHONE_LOGIN);
+$channel = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$channel);
+$parked_time = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_time);
+$debugvars = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$debugvars);
+$parked_by = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_by);
+$submit = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$submit);
+$SUBMIT = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$SUBMIT);
+$vendor_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$vendor_id);
+$phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone);
+$lead_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$lead_id);
+$first_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$first_name);
+$last_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$last_name);
+$phone_number = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_number);
+$end_call = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$end_call);
+$DB = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$DB);
+$dispo = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$dispo);
+$list_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$list_id);
+$campaign_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$campaign_id);
+$phone_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_code);
+$call_began = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$call_began);
+$tsr = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$tsr);
+$address1 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address1);
+$address2 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address2);
+$address3 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address3);
+$city = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$city);
+$state = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$state);
+$postal_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$postal_code);
+$province = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$province);
+$country_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$country_code);
+$alt_phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$alt_phone);
+$email = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$email);
+$security = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$security);
+$comments = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$comments);
+$status  = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$status);
+$customer_zap_channel  = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$customer_zap_channel);
+$session_id  = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$session_id);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user);
+	$pass = preg_replace('/[^-_0-9a-zA-Z]/', '', $pass);
+	$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
+	$group_selected = preg_replace('/[^-_0-9a-zA-Z]/', '', $group_selected);
+	$groupselect = preg_replace('/[^-_0-9a-zA-Z]/', '', $groupselect);
+	$channel_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $channel_group);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9\p{L}]/u', '', $user);
+	$pass = preg_replace('/[^-_0-9\p{L}]/u', '', $pass);
+	$group = preg_replace('/[^-_0-9\p{L}]/u', '', $group);
+	$group_selected = preg_replace('/[^-_0-9\p{L}]/u', '', $group_selected);
+	$groupselect = preg_replace('/[^-_0-9\p{L}]/u', '', $groupselect);
+	$channel_group = preg_replace('/[^-_0-9\p{L}]/u', '', $channel_group);
 	}
 
 #$DB = '1';	# DEBUG override

agc_2-X/trunk/www/vicidial/closer.php

@@ -1,7 +1,7 @@
 <?php
 # closer.php
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # the purpose of this script and webpage is to allow for remote or local users of the system to log in and grab phone calls that are coming inbound into the Asterisk server and being put in the parked_channels table while they hear a soundfile for a limited amount of time before being forwarded on to either a set extension or a voicemail box. This gives remote or local agents a way to grab calls without tying up their phone lines all day. The agent sees the refreshing screen of calls on park and when they want to take one they just click on it, and a small window opens that will allow them to grab the call and/or look up more information on the caller through the callerID that is given(if available)
 # CHANGES
@@ -16,6 +16,7 @@
 # 141007-2212 - Finalized adding QXZ translation to all admin files
 # 141229-2041 - Added code for on-the-fly language translations display
 # 170409-1532 - Added IP List validation code
+# 220224-1629 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -62,9 +63,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -75,24 +76,75 @@ if ($qm_conf_ct > 0)
 	$user_territories_active =		$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip);
+$dialplan_number = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$dialplan_number);
+$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$extension);
+$PHONE_LOGIN = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$PHONE_LOGIN);
+$channel = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$channel);
+$parked_time = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_time);
+$debugvars = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$debugvars);
+$parked_by = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_by);
+$submit = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$submit);
+$SUBMIT = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$SUBMIT);
+$vendor_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$vendor_id);
+$phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone);
+$lead_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$lead_id);
+$first_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$first_name);
+$last_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$last_name);
+$phone_number = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_number);
+$end_call = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$end_call);
+$DB = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$DB);
+$dispo = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$dispo);
+$list_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$list_id);
+$campaign_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$campaign_id);
+$phone_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_code);
+$call_began = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$call_began);
+$tsr = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$tsr);
+$address1 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address1);
+$address2 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address2);
+$address3 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address3);
+$city = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$city);
+$state = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$state);
+$postal_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$postal_code);
+$province = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$province);
+$country_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$country_code);
+$alt_phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$alt_phone);
+$email = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$email);
+$security = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$security);
+$comments = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$comments);
+$status  = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$status);
+$customer_zap_channel  = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$customer_zap_channel);
+$session_id  = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$session_id);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user);
+	$pass = preg_replace('/[^-_0-9a-zA-Z]/', '', $pass);
+	$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
+	$group_selected = preg_replace('/[^-_0-9a-zA-Z]/', '', $group_selected);
+	$groupselect = preg_replace('/[^-_0-9a-zA-Z]/', '', $groupselect);
+	$channel_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $channel_group);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9\p{L}]/u', '', $user);
+	$pass = preg_replace('/[^-_0-9\p{L}]/u', '', $pass);
+	$group = preg_replace('/[^-_0-9\p{L}]/u', '', $group);
+	$group_selected = preg_replace('/[^-_0-9\p{L}]/u', '', $group_selected);
+	$groupselect = preg_replace('/[^-_0-9\p{L}]/u', '', $groupselect);
+	$channel_group = preg_replace('/[^-_0-9\p{L}]/u', '', $channel_group);
 	}
 
-$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
-$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
-
 $STARTtime = date("U");
 $TODAY = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
@@ -385,7 +437,6 @@ echo "<font size=0>\n\n\n<br><br><br>\n"._QXZ("script runtime").": $RUNtime "._Q
 
 ?>
 
-
 </body>
 </html>
 
@@ -393,11 +444,4 @@ echo "<font size=0>\n\n\n<br><br><br>\n"._QXZ("script runtime").": $RUNtime "._Q
 	
 exit; 
 
-
-
 ?>
-
-
-
-
-

agc_2-X/trunk/www/vicidial/closer_dispo.php

@@ -1,7 +1,7 @@
 <?php
 # closer_dispo.php
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # this is the closer disposition screen of a call that has been grabbed. This 
 # allows the closer to modify customer information and disposition the call
@@ -17,6 +17,7 @@
 # 141007-2138 - Finalized adding QXZ translation to all admin files
 # 141229-2037 - Added code for on-the-fly language translations display
 # 170409-1532 - Added IP List validation code
+# 220224-1611 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -41,7 +42,7 @@ if (isset($_GET["phone_number"]))				{$phone_number=$_GET["phone_number"];}
 if (isset($_GET["end_call"]))				{$end_call=$_GET["end_call"];}
 	elseif (isset($_POST["end_call"]))		{$end_call=$_POST["end_call"];}
 if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
-	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
+	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
 if (isset($_GET["dispo"]))				{$dispo=$_GET["dispo"];}
 	elseif (isset($_POST["dispo"]))		{$dispo=$_POST["dispo"];}
 if (isset($_GET["list_id"]))				{$list_id=$_GET["list_id"];}
@@ -97,9 +98,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -110,19 +111,69 @@ if ($qm_conf_ct > 0)
 	$user_territories_active =		$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip);
+$dialplan_number = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$dialplan_number);
+$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$extension);
+$PHONE_LOGIN = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$PHONE_LOGIN);
+$channel = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$channel);
+$parked_time = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_time);
+$debugvars = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$debugvars);
+$parked_by = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_by);
+$submit = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$submit);
+$SUBMIT = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$SUBMIT);
+$vendor_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$vendor_id);
+$phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone);
+$lead_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$lead_id);
+$first_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$first_name);
+$last_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$last_name);
+$phone_number = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_number);
+$end_call = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$end_call);
+$DB = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$DB);
+$dispo = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$dispo);
+$list_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$list_id);
+$campaign_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$campaign_id);
+$phone_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_code);
+$call_began = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$call_began);
+$tsr = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$tsr);
+$address1 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address1);
+$address2 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address2);
+$address3 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address3);
+$city = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$city);
+$state = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$state);
+$postal_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$postal_code);
+$province = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$province);
+$country_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$country_code);
+$alt_phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$alt_phone);
+$email = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$email);
+$security = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$security);
+$comments = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$comments);
+$status  = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$status );
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user);
+	$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
+	$group_selected = preg_replace('/[^-_0-9a-zA-Z]/', '', $group_selected);
+	$groupselect = preg_replace('/[^-_0-9a-zA-Z]/', '', $groupselect);
+	$channel_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $channel_group);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9\p{L}]/u', '', $user);
+	$group = preg_replace('/[^-_0-9\p{L}]/u', '', $group);
+	$group_selected = preg_replace('/[^-_0-9\p{L}]/u', '', $group_selected);
+	$groupselect = preg_replace('/[^-_0-9\p{L}]/u', '', $groupselect);
+	$channel_group = preg_replace('/[^-_0-9\p{L}]/u', '', $channel_group);
 	}
 
 $STARTtime = date("U");

agc_2-X/trunk/www/vicidial/closer_popup.php

@@ -1,7 +1,7 @@
 <?php
 # closer_popup.php
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # this is the closer popup of a specific call that grabs the call and allows you
 # to go and fetch info on that caller in the local CRM system.
@@ -17,6 +17,7 @@
 # 141007-2213 - Finalized adding QXZ translation to all admin files
 # 141229-2035 - Added code for on-the-fly language translations display
 # 170409-1532 - Added IP List validation code
+# 220224-1554 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -63,9 +64,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -76,19 +77,42 @@ if ($qm_conf_ct > 0)
 	$user_territories_active =		$row[3];
 	$SSenable_languages =			$row[4];
 	$SSlanguage_method =			$row[5];
+	$SSallow_web_debug =			$row[6];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip);
+$dialplan_number = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$dialplan_number);
+$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$extension);
+$PHONE_LOGIN = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$PHONE_LOGIN);
+$channel = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$channel);
+$parked_time = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_time);
+$debugvars = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$debugvars);
+$parked_by = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_by);
+$submit = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$submit);
+$SUBMIT = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user);
+	$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
+	$group_selected = preg_replace('/[^-_0-9a-zA-Z]/', '', $group_selected);
+	$groupselect = preg_replace('/[^-_0-9a-zA-Z]/', '', $groupselect);
+	$channel_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $channel_group);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9\p{L}]/u', '', $user);
+	$group = preg_replace('/[^-_0-9\p{L}]/u', '', $group);
+	$group_selected = preg_replace('/[^-_0-9\p{L}]/u', '', $group_selected);
+	$groupselect = preg_replace('/[^-_0-9\p{L}]/u', '', $groupselect);
+	$channel_group = preg_replace('/[^-_0-9\p{L}]/u', '', $channel_group);
 	}
 
 #$DB=1;

agc_2-X/trunk/www/vicidial/display_help.php

@@ -1,13 +1,14 @@
 <?php
 # display_help.php
 #
-# Copyright (C) 2018  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com>    LICENSE: AGPLv2
 #
 # pulls help text to display on the screen when the appropriate help link is clicked
 #
 # CHANGELOG:
 # 180501-0045 - First build
 # 180512-1055 - Added update of help_documentation.txt file if modified
+# 220224-1053 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -20,19 +21,20 @@ if ( file_exists($help_file) )
 require("dbconnect_mysqli.php");
 require("functions.php");
 
+$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
+$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
 if (isset($_GET["help_id"]))			{$help_id=$_GET["help_id"];}
 	elseif (isset($_POST["help_id"]))	{$help_id=$_POST["help_id"];}
 if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
 
-$help_id = preg_replace('/[^-\_0-9a-zA-Z]/', '',$help_id);
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,enable_languages,language_method,help_modification_date FROM system_settings;";
+$stmt = "SELECT use_non_latin,enable_languages,language_method,help_modification_date,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -41,12 +43,13 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[1];
 	$SSlanguage_method =			$row[2];
 	$help_modification_date =		$row[3];
+	$SSallow_web_debug =			$row[4];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
-$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
+$help_id = preg_replace('/[^-_0-9a-zA-Z]/', '',$help_id);
-$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
 
 if ($non_latin < 1)
 	{
@@ -55,8 +58,8 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace('/\'|\"|\\\\|;/', '',$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace('/\'|\"|\\\\|;/', '',$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";

agc_2-X/trunk/www/vicidial/list_download.php

@@ -4,7 +4,7 @@
 # downloads the entire contents of a vicidial list ID to a flat text file
 # that is tab delimited
 #
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGES
 #
@@ -38,6 +38,7 @@
 # 190926-1015 - Fix for PHP7
 # 201208-1630 - Fix for custom fields issue when downloading list with no custom fields itself
 # 210308-0939 - Fix for ALL_DNC_CAMPAIGNS dnc download
+# 220224-1041 - Added allow_web_debug system setting
 #
 
 $startMS = microtime();
@@ -71,9 +72,9 @@ $db_source = 'M';
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -86,10 +87,18 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =			$row[5];
 	$SSlanguage_method =			$row[6];
 	$active_modules =				$row[7];
+	$SSallow_web_debug =			$row[8];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id);
+$group_id = preg_replace('/[^-_0-9a-zA-Z]/','',$group_id);
+$download_type = preg_replace('/[^-_0-9a-zA-Z]/','',$download_type);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/','',$submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT);
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -97,12 +106,9 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	}
-$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id);
-$group_id = preg_replace('/[^-_0-9a-zA-Z]/','',$group_id);
-$download_type = preg_replace('/[^-_0-9a-zA-Z]/','',$download_type);
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}

agc_2-X/trunk/www/vicidial/qc_api.php

@@ -2,7 +2,7 @@
 # qc_api.php
 # 
 # Copyright (C) 2012  poundteam.com    LICENSE: AGPLv2
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed to allow API functions for QC applications, contributed by poundteam.com
 #
@@ -16,10 +16,11 @@
 # 141229-2015 - Added code for on-the-fly language translations display
 # 150626-2120 - Modified mysqli_error() to mysqli_connect_error() where appropriate
 # 210306-1051 - Changes for new QC module
+# 220224-1021 - Added allow_web_debug system setting
 #
 
-$version = '2.14-8';
+$version = '2.14-9';
-$build = '210306-1051';
+$build = '220224-1021';
 
 require("dbconnect_mysqli.php");
 require("functions.php");
@@ -142,9 +143,9 @@ header ("Pragma: no-cache");                          // HTTP/1.0
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -152,12 +153,28 @@ if ($qm_conf_ct > 0)
 	$non_latin =					$row[0];
 	$SSenable_languages =			$row[1];
 	$SSlanguage_method =			$row[2];
+	$SSallow_web_debug =			$row[3];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
 $ingroup_choices = preg_replace("/\+/"," ",$ingroup_choices);
 $query_string = preg_replace("/'|\"|\\\\|;/","",$query_string);
+$dial_override = preg_replace("/[^A-Z]/","",$dial_override);
+$consultative = preg_replace("/[^A-Z]/","",$consultative);
+$phone_code = preg_replace("/[^0-9X]/","",$phone_code);
+$format = preg_replace("/[^0-9a-zA-Z]/","",$format);
+$set_as_default = preg_replace("/[^A-Z]/","",$set_as_default);
+$phone_number = preg_replace("/[^0-9]/","",$phone_number);
+$blended = preg_replace("/[^A-Z]/","",$blended);
+$vtiger_callback = preg_replace("/[^A-Z]/","",$vtiger_callback);
+$alt_dial = preg_replace("/[^0-9A-Z]/","",$alt_dial);
+$rank = preg_replace("/[^-0-9]/","",$rank);
+$stage = preg_replace("/[^-_0-9a-zA-Z]/","",$stage);
+$close_window_link = preg_replace("/[^-_0-9a-zA-Z]/","",$close_window_link);
+$dnc_check = preg_replace("/[^-_0-9a-zA-Z]/","",$dnc_check);
+$campaign_dnc_check = preg_replace("/[^-_0-9a-zA-Z]/","",$campaign_dnc_check);
 
 if ($non_latin < 1)
 	{
@@ -165,24 +182,18 @@ if ($non_latin < 1)
 	$pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass);
 	$agent_user=preg_replace("/[^0-9a-zA-Z]/","",$agent_user);
 	$function = preg_replace("/[^-\_0-9a-zA-Z]/","",$function);
+	$status = preg_replace("/[^-_0-9a-zA-Z]/","",$status);
 	$value = preg_replace("/[^-\_0-9a-zA-Z]/","",$value);
 	$vendor_id = preg_replace("/[^-\.\_0-9a-zA-Z]/","",$vendor_id);
 	$focus = preg_replace("/[^-\_0-9a-zA-Z]/","",$focus);
 	$preview = preg_replace("/[^-\_0-9a-zA-Z]/","",$preview);
 		$notes = preg_replace("/\+/"," ",$notes);
 	$notes = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$notes);
-	$phone_code = preg_replace("/[^0-9X]/","",$phone_code);
 	$search = preg_replace("/[^-\_0-9a-zA-Z]/","",$search);
 	$group_alias = preg_replace("/[^0-9a-zA-Z]/","",$group_alias);
 	$dial_prefix = preg_replace("/[^0-9a-zA-Z]/","",$dial_prefix);
 	$source = preg_replace("/[^0-9a-zA-Z]/","",$source);
-	$format = preg_replace("/[^0-9a-zA-Z]/","",$format);
-	$vtiger_callback = preg_replace("/[^A-Z]/","",$vtiger_callback);
-	$alt_dial = preg_replace("/[^0-9A-Z]/","",$alt_dial);
-	$blended = preg_replace("/[^A-Z]/","",$blended);
 	$ingroup_choices = preg_replace("/[^- \_0-9a-zA-Z]/","",$ingroup_choices);
-	$set_as_default = preg_replace("/[^A-Z]/","",$set_as_default);
-	$phone_number = preg_replace("/[^0-9]/","",$phone_number);
 	$address1 = preg_replace("/[^- \_0-9a-zA-Z]/","",$address1);
 	$address2 = preg_replace("/[^- \_0-9a-zA-Z]/","",$address2);
 	$address3 = preg_replace("/[^- \_0-9a-zA-Z]/","",$address3);
@@ -204,10 +215,7 @@ if ($non_latin < 1)
 	$state = preg_replace("/[^- \_0-9a-zA-Z]/","",$state);
 	$title = preg_replace("/[^- \_0-9a-zA-Z]/","",$title);
 	$vendor_lead_code = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$vendor_lead_code);
-	$rank = preg_replace("/[^-0-9]/","",$rank);
 	$owner = preg_replace("/[^-\.\:\/\@\_0-9a-zA-Z]/","",$owner);
-	$dial_override = preg_replace("/[^A-Z]/","",$dial_override);
-	$consultative = preg_replace("/[^A-Z]/","",$consultative);
 		$callback_datetime = preg_replace("/\+/"," ",$callback_datetime);
 	$callback_datetime = preg_replace("/[^- \:\.\_0-9a-zA-Z]/","",$callback_datetime);
 	$callback_type = preg_replace("/[^A-Z]/","",$callback_type);
@@ -219,11 +227,51 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$user = preg_replace("/'|\"|\\\\|;/","",$user);
+	$user=preg_replace("/[^-_0-9\p{L}]/u","",$user);
-	$pass = preg_replace("/'|\"|\\\\|;/","",$pass);
+	$pass=preg_replace("/[^-_0-9\p{L}]/u","",$pass);
-	$source = preg_replace("/'|\"|\\\\|;/","",$source);
+	$agent_user=preg_replace("/[^0-9\p{L}]/u","",$agent_user);
-	$agent_user = preg_replace("/'|\"|\\\\|;/","",$agent_user);
+	$function = preg_replace("/[^-\_0-9\p{L}]/u","",$function);
-	$alt_user = preg_replace("/'|\"|\\\\|;/","",$alt_user);
+	$value = preg_replace("/[^-\_0-9\p{L}]/u","",$value);
+	$vendor_id = preg_replace("/[^-\.\_0-9\p{L}]/u","",$vendor_id);
+	$focus = preg_replace("/[^-\_0-9\p{L}]/u","",$focus);
+	$preview = preg_replace("/[^-\_0-9\p{L}]/u","",$preview);
+		$notes = preg_replace("/\+/"," ",$notes);
+	$notes = preg_replace("/[^- \.\_0-9\p{L}]/u","",$notes);
+	$search = preg_replace("/[^-\_0-9\p{L}]/u","",$search);
+	$group_alias = preg_replace("/[^0-9\p{L}]/u","",$group_alias);
+	$dial_prefix = preg_replace("/[^0-9\p{L}]/u","",$dial_prefix);
+	$source = preg_replace("/[^0-9\p{L}]/u","",$source);
+	$ingroup_choices = preg_replace("/[^- \_0-9\p{L}]/u","",$ingroup_choices);
+	$address1 = preg_replace("/[^- \_0-9\p{L}]/u","",$address1);
+	$address2 = preg_replace("/[^- \_0-9\p{L}]/u","",$address2);
+	$address3 = preg_replace("/[^- \_0-9\p{L}]/u","",$address3);
+	$alt_phone = preg_replace("/[^- \_0-9\p{L}]/u","",$alt_phone);
+	$city = preg_replace("/[^- \_0-9\p{L}]/u","",$city);
+	$comments = preg_replace("/[^- \_0-9\p{L}]/u","",$comments);
+	$country_code = preg_replace("/[^A-Z]/","",$country_code);
+	$date_of_birth = preg_replace("/[^- \_0-9]/","",$date_of_birth);
+	$email = preg_replace("/[^-\.\:\/\@\_0-9\p{L}]/u","",$email);
+	$first_name = preg_replace("/[^- \_0-9\p{L}]/u","",$first_name);
+	$gender = preg_replace("/[^A-Z]/","",$gender);
+	$gmt_offset_now = preg_replace("/[^- \.\_0-9]/","",$gmt_offset_now);
+	$last_name = preg_replace("/[^- \_0-9\p{L}]/u","",$last_name);
+	$lead_id = preg_replace("/[^0-9]/","",$lead_id);
+	$middle_initial = preg_replace("/[^- \_0-9\p{L}]/u","",$middle_initial);
+	$province = preg_replace("/[^- \.\_0-9\p{L}]/u","",$province);
+	$security_phrase = preg_replace("/[^- \.\_0-9\p{L}]/u","",$security_phrase);
+	$source_id = preg_replace("/[^- \.\_0-9\p{L}]/u","",$source_id);
+	$state = preg_replace("/[^- \_0-9\p{L}]/u","",$state);
+	$title = preg_replace("/[^- \_0-9\p{L}]/u","",$title);
+	$vendor_lead_code = preg_replace("/[^- \.\_0-9\p{L}]/u","",$vendor_lead_code);
+	$owner = preg_replace("/[^-\.\:\/\@\_0-9\p{L}]/u","",$owner);
+		$callback_datetime = preg_replace("/\+/"," ",$callback_datetime);
+	$callback_datetime = preg_replace("/[^- \:\.\_0-9\p{L}]/u","",$callback_datetime);
+	$callback_type = preg_replace("/[^A-Z]/","",$callback_type);
+		$callback_comments = preg_replace("/\+/"," ",$callback_comments);
+	$callback_comments = preg_replace("/[^- \.\_0-9\p{L}]/u","",$callback_comments);
+	$qm_dispo_code = preg_replace("/[^-\.\_0-9\p{L}]/u","",$qm_dispo_code);
+	$alt_user = preg_replace("/[^0-9\p{L}]/u","",$alt_user);
+	$postal_code = preg_replace("/[^- \.\_0-9\p{L}]/u","",$postal_code);
 	}
 
 ### date and fixed variables

agc_2-X/trunk/www/vicidial/qc_call_client_iframe.php

@@ -4,7 +4,7 @@
 # ViciDial database administration modify lead in vicidial_list
 # 
 # Copyright (C) 2012  poundteam.com    LICENSE: AGPLv2
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed to allow QC review and modification of leads, contributed by poundteam.com
 #
@@ -20,6 +20,7 @@
 # 210306-1052 - Changes for new QC module
 # 210825-0937 - Removed custom fields, unused here.
 # 210827-1818 - Fix for security issue
+# 220224-0947 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -137,12 +138,15 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 $STARTtime = date("U");
 $TODAY = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
+$date = date("r");
+$ip = getenv("REMOTE_ADDR");
+$browser = getenv("HTTP_USER_AGENT");
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,custom_fields_enabled,enable_languages,language_method,qc_features_active FROM system_settings;";
+$stmt = "SELECT use_non_latin,custom_fields_enabled,enable_languages,language_method,qc_features_active,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -152,33 +156,98 @@ if ($qm_conf_ct > 0)
 	$SSenable_languages =		$row[2];
 	$SSlanguage_method =		$row[3];
 	$SSqc_features_active =		$row[4];
+	$SSallow_web_debug =		$row[5];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
-$date = date("r");
+$old_phone = preg_replace('/[^0-9]/','',$old_phone);
-$ip = getenv("REMOTE_ADDR");
+$phone_number = preg_replace('/[^0-9]/','',$phone_number);
-$browser = getenv("HTTP_USER_AGENT");
+	if (strlen($phone_number)<6) {$phone_number=$old_phone;}
+$alt_phone = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$alt_phone);
+$list_id = preg_replace('/[^0-9]/','',$list_id);
+$lead_id = preg_replace('/[^0-9a-zA-Z]/','',$lead_id);
+$entry_list_id = preg_replace('/[^0-9]/','',$entry_list_id);
+$phone_code = preg_replace('/[^0-9]/','',$phone_code);
+$update_phone_number=preg_replace('/[^A-Z]/','',$update_phone_number);
+$vendor_lead_code = preg_replace('/;|#/','',$vendor_lead_code);
+	$vendor_lead_code = preg_replace('/\+/',' ',$vendor_lead_code);
+$source_id = preg_replace('/;|#/','',$source_id);
+	$source_id = preg_replace('/\+/',' ',$source_id);
+$gmt_offset_now = preg_replace('/[^-\_\.0-9]/','',$gmt_offset_now);
+$country_code = preg_replace('/[^A-Z]/','',$country_code);
+$gender = preg_replace('/[^A-Z]/','',$gender);
+$date_of_birth = preg_replace('/[^-0-9]/','',$date_of_birth);
+$comments = preg_replace('/;|#/','',$comments);
+	$comments = preg_replace('/\+/',' ',$comments);
+$rank = preg_replace('/[^0-9]/','',$rank);
+$no_update = preg_replace('/[^A-Z]/','',$no_update);
+$called_count=preg_replace('/[^0-9]/','',$called_count);
+$local_gmt=preg_replace('/[^-\.0-9]/','',$local_gmt);
+$callback = preg_replace('/[^A-Z]/','',$callback);
+$callback_type = preg_replace('/[^A-Z]/','',$callback_type);
+$end_call=preg_replace('/[^0-9]/','',$end_call);
+$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
+$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$extension);
+$channel = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$channel);
+$submit = preg_replace('/[^- \.\_0-9a-zA-Z]/','',$submit);
+$SUBMIT = preg_replace('/[^- \.\_0-9a-zA-Z]/','',$SUBMIT);
+$modify_logs=preg_replace('/[^0-9]/','',$modify_logs);
+$modify_closer_logs=preg_replace('/[^0-9]/','',$modify_closer_logs);
+$modify_agent_logs=preg_replace('/[^0-9]/','',$modify_agent_logs);
+$add_closer_record=preg_replace('/[^0-9]/','',$add_closer_record);
+$call_began = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$call_began);
+$parked_time = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$parked_time);
+$callback_id = preg_replace('/[^-_0-9a-zA-Z]/','',$callback_id);
+$CBchangeUSERtoANY = preg_replace('/[^-_0-9a-zA-Z]/','',$CBchangeUSERtoANY);
+$CBchangeANYtoUSER = preg_replace('/[^-_0-9a-zA-Z]/','',$CBchangeANYtoUSER);
+$CBchangeUSERtoUSER = preg_replace('/[^-_0-9a-zA-Z]/','',$CBchangeUSERtoUSER);
+$CBchangeDATE = preg_replace('/[^-_0-9a-zA-Z]/','',$CBchangeDATE);
+$archive_search = preg_replace('/[^-_0-9a-zA-Z]/','',$archive_search);
+$archive_log = preg_replace('/[^-_0-9a-zA-Z]/','',$archive_log);
+$gdpr_action = preg_replace('/[^-_0-9a-zA-Z]/','',$gdpr_action);
+$CIDdisplay = preg_replace('/[^-_0-9a-zA-Z]/','',$CIDdisplay);
+$appointment_date = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$appointment_date);
+$appointment_time = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$appointment_time);
+$vendor_id = preg_replace("/\<|\>|\"|\\\\|;/",'-',$vendor_id);
+$phone = preg_replace("/\<|\>|\"|\\\\|;/",'-',$phone);
+$title = preg_replace("/\<|\>|\"|\\\\|;/",'-',$title);
+$first_name = preg_replace("/\<|\>|\"|\\\\|;/",'-',$first_name);
+$middle_initial = preg_replace("/\<|\>|\"|\\\\|;/",'-',$middle_initial);
+$last_name = preg_replace("/\<|\>|\"|\\\\|;/",'-',$last_name);
+$lead_name = preg_replace("/\<|\>|\"|\\\\|;/",'-',$lead_name);
+$tsr = preg_replace("/\<|\>|\"|\\\\|;/",'-',$tsr);
+$address1 = preg_replace("/\<|\>|\"|\\\\|;/",'-',$address1);
+$address2 = preg_replace("/\<|\>|\"|\\\\|;/",'-',$address2);
+$address3 = preg_replace("/\<|\>|\"|\\\\|;/",'-',$address3);
+$city = preg_replace("/\<|\>|\"|\\\\|;/",'-',$city);
+$state = preg_replace("/\<|\>|\"|\\\\|;/",'-',$state);
+$postal_code = preg_replace("/\<|\>|\"|\\\\|;/",'-',$postal_code);
+$province = preg_replace("/\<|\>|\"|\\\\|;/",'-',$province);
+$email = preg_replace("/\<|\>|\"|\\\\|;/",'-',$email);
+$security = preg_replace("/\<|\>|\"|\\\\|;/",'-',$security);
+$owner = preg_replace("/\<|\>|\"|\\\\|;/",'-',$owner);
 
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
+	$campaign_id = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign_id);
+	$dispo = preg_replace('/[^-_0-9a-zA-Z]/','',$dispo);
+	$status = preg_replace('/[^-_0-9a-zA-Z]/','',$status);
+	$CBuser = preg_replace('/[^-_0-9a-zA-Z]/','',$CBuser);
 	}	# end of non_latin
 else
 	{
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$campaign_id = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign_id);
+	$dispo = preg_replace('/[^-_0-9\p{L}]/u', '', $dispo);
+	$status = preg_replace('/[^-_0-9\p{L}]/u', '', $status);
+	$CBuser = preg_replace('/[^-_0-9\p{L}]/u', '', $CBuser);
 	}
 
-$old_phone = preg_replace('/[^0-9]/','',$old_phone);
-$phone_number = preg_replace('/[^0-9]/','',$phone_number);
-$alt_phone = preg_replace('/[^0-9]/','',$alt_phone);
-$lead_id = preg_replace('/[^0-9]/','',$lead_id);
-$list_id = preg_replace('/[^0-9]/','',$list_id);
-
-if (strlen($phone_number)<6) {$phone_number=$old_phone;}
-
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
@@ -276,6 +345,6 @@ else
 	{
     echo "$qc_user_logged_in<BR><BR>";
 	}
-echo "&nbsp;<A HREF=$PHP_SELF?lead_id=$lead_id&list_id=$CLlist_id&stage=DISPLAY&submit_button=YES&user=$PHP_AUTH_USER&pass=$PHP_AUTH_PW&bgcolor=E6E6E6>"._QXZ("Refresh")."</A>";
+echo "&nbsp;<A HREF=$PHP_SELF?phone_number=$phone_number&phone_code=$phone_code&lead_id=$lead_id&list_id=$CLlist_id&stage=DISPLAY&submit_button=YES&user=$PHP_AUTH_USER&pass=$PHP_AUTH_PW&bgcolor=E6E6E6>"._QXZ("Refresh")."</A>";
 
 ?>

agc_2-X/trunk/www/vicidial/qc_modify_lead.php

@@ -6,7 +6,7 @@
 # qc_modify_lead.php
 # 
 # Copyright (C) 2012  poundteam.com    LICENSE: AGPLv2
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed to allow QC review and modification of leads, contributed by poundteam.com
 #
@@ -31,6 +31,7 @@
 # 210304-1650 - Added modify_leads=5 read-only option
 # 210306-0854 - Redesign of QC module
 # 210827-1818 - Fix for security issue
+# 220224-2143 - Added allow_web_debug system setting
 #
 
 require("dbconnect_mysqli.php");
@@ -167,13 +168,36 @@ if (isset($_POST["referring_section"]))			{$referring_section=$_POST["referring_
 if (isset($_POST["referring_element"]))			{$referring_element=$_POST["referring_element"];}
 	elseif (isset($_GET["referring_element"]))	{$referring_element=$_GET["referring_element"];}
 
+$DB=preg_replace('/[^0-9]/','',$DB);
+
+#############################################
+##### START SYSTEM_SETTINGS LOOKUP #####
+$stmt = "SELECT use_non_latin,custom_fields_enabled,enable_languages,language_method,active_modules,log_recording_access,allow_web_debug FROM system_settings;";
+$rslt=mysql_to_mysqli($stmt, $link);
+#if ($DB) {echo "$stmt\n";}
+$qm_conf_ct = mysqli_num_rows($rslt);
+if ($qm_conf_ct > 0)
+	{
+	$row=mysqli_fetch_row($rslt);
+	$non_latin =				$row[0];
+	$custom_fields_enabled =	$row[1];
+	$SSenable_languages =		$row[2];
+	$SSlanguage_method =		$row[3];
+	$active_modules =			$row[4];
+	$log_recording_access =		$row[5];
+	$SSallow_web_debug =		$row[6];
+	}
+if ($SSallow_web_debug < 1) {$DB=0;}
+##### END SETTINGS LOOKUP #####
+###########################################
+
 $CBchangeANYtoUSER=preg_replace('/[^A-Z]/','',$CBchangeANYtoUSER);
 $CBchangeDATE=preg_replace('/[^A-Z]/','',$CBchangeDATE);
 $CBchangeUSERtoANY=preg_replace('/[^A-Z]/','',$CBchangeUSERtoANY);
 $CBchangeUSERtoUSER=preg_replace('/[^A-Z]/','',$CBchangeUSERtoUSER);
 $claim_QC=preg_replace('/[^A-Z]/','',$claim_QC);
 $referring_section=preg_replace('/[^A-Z]/','',$referring_section);
-$DB=preg_replace('/[^0-9]/','',$DB);
+$call_began = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$call_began);
 
 if ($non_latin < 1)
 	{
@@ -215,8 +239,8 @@ if ($non_latin < 1)
 	}
 else
 	{
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
 	$user=preg_replace('/[^-_0-9\p{L}]/u','',$user);
 	$tsr=preg_replace('/[^-_0-9\p{L}]/u','',$tsr);
 	$CBuser=preg_replace('/[^-_0-9\p{L}]/u','',$CBuser);
@@ -265,7 +289,6 @@ $email = preg_replace('/\+/',' ',$email);
 $security_phrase = preg_replace('/\+/',' ',$security_phrase);
 $owner = preg_replace('/\+/',' ',$owner);
 
-
 $list_id = preg_replace('/[^0-9]/','',$list_id);
 $lead_id = preg_replace('/[^0-9a-zA-Z]/','',$lead_id);
 $entry_list_id = preg_replace('/[^0-9]/','',$entry_list_id);
@@ -324,40 +347,6 @@ switch($referring_section) # was $scorecard_source
 		break;
 	}
 
-#############################################
-##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,custom_fields_enabled,enable_languages,language_method,active_modules,log_recording_access FROM system_settings;";
-$rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
-$qm_conf_ct = mysqli_num_rows($rslt);
-if ($qm_conf_ct > 0)
-	{
-	$row=mysqli_fetch_row($rslt);
-	$non_latin =				$row[0];
-	$custom_fields_enabled =	$row[1];
-	$SSenable_languages =		$row[2];
-	$SSlanguage_method =		$row[3];
-	$active_modules =			$row[4];
-	$log_recording_access =			$row[5];
-	}
-##### END SETTINGS LOOKUP #####
-###########################################
-
-if ($non_latin < 1)
-	{
-	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
-
-	$old_phone = preg_replace('/[^0-9]/','',$old_phone);
-	$phone_number = preg_replace('/[^0-9]/','',$phone_number);
-	$alt_phone = preg_replace('/[^0-9]/','',$alt_phone);
-	}	# end of non_latin
-else
-	{
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
-	}
-
 $rights_stmt = "SELECT modify_leads,qc_enabled,full_name,modify_leads,user_group,selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rights_rslt=mysql_to_mysqli($rights_stmt, $link);

agc_2-X/trunk/www/vicidial/qc_module_actions.php

@@ -1,4 +1,15 @@
 <?php
+# qc_module_actions.php
+#
+# For as part of new enhanced QC system within VICIdial
+#
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+#
+# CHANGES:
+# 210309-1645 - First build
+# 220224-0836 - Added allow_web_debug system setting
+#
+
 header ("Content-type: text/html; charset=utf-8");
 
 require("dbconnect_mysqli.php");
@@ -12,39 +23,11 @@ if ( file_exists("/etc/mysql_enc.conf") ) {
 	}
 }
 
-
 $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
 $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
 $QUERY_STRING = getenv("QUERY_STRING");
 $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
-
-#############################################
-##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,admin_screen_colors,qc_features_active FROM system_settings;";
-$rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
-$qm_conf_ct = mysqli_num_rows($rslt);
-if ($qm_conf_ct > 0)
-	{
-	$row=mysqli_fetch_row($rslt);
-	$non_latin =					$row[0];
-	$SSauto_dial_limit =			$row[1];
-	$SSuser_territories_active =	$row[2];
-	$SSallow_custom_dialplan =		$row[3];
-	$SScallcard_enabled =			$row[4];
-	$SSadmin_modify_refresh =		$row[5];
-	$SSnocache_admin =				$row[6];
-	$SSwebroot_writable =			$row[7];
-	$SSadmin_screen_colors =		$row[8];
-	$SSqc_features_active =			$row[9];
-
-	# slightly increase limit value, because PHP somehow thinks 2.8 > 2.8
-	$SSauto_dial_limit = ($SSauto_dial_limit + 0.001);
-	}
-##### END SETTINGS LOOKUP #####
-###########################################
-
 if (isset($_GET["DB"]))	{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
 if (isset($_GET["end_date"]))	{$end_date=$_GET["end_date"];}
@@ -71,12 +54,10 @@ if (isset($_GET["qc_agent_comments"]))	{$qc_agent_comments=$_GET["qc_agent_comme
 	elseif (isset($_POST["qc_agent_comments"]))	{$qc_agent_comments=$_POST["qc_agent_comments"];}
 if (isset($_GET["qc_manager_comments"]))	{$qc_manager_comments=$_GET["qc_manager_comments"];}
 	elseif (isset($_POST["qc_manager_comments"]))	{$qc_manager_comments=$_POST["qc_manager_comments"];}
-
 if (isset($_GET["field_name"]))	{$field_name=$_GET["field_name"];}
 	elseif (isset($_POST["field_name"]))	{$field_name=$_POST["field_name"];}
 if (isset($_GET["field_value"]))	{$field_value=$_GET["field_value"];}
 	elseif (isset($_POST["field_value"]))	{$field_value=$_POST["field_value"];}
-
 if (isset($_GET["lead_id"]))	{$lead_id=$_GET["lead_id"];}
 	elseif (isset($_POST["lead_id"]))	{$lead_id=$_POST["lead_id"];}
 if (isset($_GET["callback_id"]))	{$callback_id=$_GET["callback_id"];}
@@ -89,8 +70,6 @@ if (isset($_GET["callback_time"]))	{$callback_time=$_GET["callback_time"];}
 	elseif (isset($_POST["callback_time"]))	{$callback_time=$_POST["callback_time"];}
 if (isset($_GET["callback_comments"]))	{$callback_comments=$_GET["callback_comments"];}
 	elseif (isset($_POST["callback_comments"]))	{$callback_comments=$_POST["callback_comments"];}
-
-
 if (isset($_GET["qc_checkpoint_log_id"]))	{$qc_checkpoint_log_id=$_GET["qc_checkpoint_log_id"];}
 	elseif (isset($_POST["qc_checkpoint_log_id"]))	{$qc_checkpoint_log_id=$_POST["qc_checkpoint_log_id"];}
 if (isset($_GET["qc_level"]))	{$qc_level=$_GET["qc_level"];}
@@ -152,6 +131,92 @@ $defaultappointment = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
 $STARTtime = date("U");
 
+#############################################
+##### START SYSTEM_SETTINGS LOOKUP #####
+$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,admin_screen_colors,qc_features_active,allow_web_debug FROM system_settings;";
+$rslt=mysql_to_mysqli($stmt, $link);
+#if ($DB) {echo "$stmt\n";}
+$qm_conf_ct = mysqli_num_rows($rslt);
+if ($qm_conf_ct > 0)
+	{
+	$row=mysqli_fetch_row($rslt);
+	$non_latin =					$row[0];
+	$SSauto_dial_limit =			$row[1];
+	$SSuser_territories_active =	$row[2];
+	$SSallow_custom_dialplan =		$row[3];
+	$SScallcard_enabled =			$row[4];
+	$SSadmin_modify_refresh =		$row[5];
+	$SSnocache_admin =				$row[6];
+	$SSwebroot_writable =			$row[7];
+	$SSadmin_screen_colors =		$row[8];
+	$SSqc_features_active =			$row[9];
+	# slightly increase limit value, because PHP somehow thinks 2.8 > 2.8
+	$SSauto_dial_limit = ($SSauto_dial_limit + 0.001);
+	$SSallow_web_debug =			$row[10];
+	}
+if ($SSallow_web_debug < 1) {$DB=0;}
+##### END SETTINGS LOOKUP #####
+###########################################
+
+$lead_id = preg_replace('/[^0-9]/', '', $lead_id);
+$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date);
+$modify_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $modify_date);
+$recording_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $recording_id);
+$qc_action = preg_replace('/[^-_0-9a-zA-Z]/', '', $qc_action);
+$claim_rec = preg_replace('/[^-_0-9a-zA-Z]/', '', $claim_rec);
+$mgr_override = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$mgr_override);
+$scorecard_id = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$scorecard_id);
+$qc_row_id = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$qc_row_id);
+$qc_log_id = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$qc_log_id);
+$qc_status = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$qc_status);
+$qc_agent_comments = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$qc_agent_comments);
+$qc_manager_comments = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$qc_manager_comments);
+$field_name = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$field_name);
+$field_value = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$field_value);
+$callback_id = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$callback_id);
+$recipient = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$recipient);
+$CBuser = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$CBuser);
+$callback_time = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$callback_time);
+$callback_comments = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$callback_comments);
+$qc_checkpoint_log_id = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$qc_checkpoint_log_id);
+$qc_level = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$qc_level);
+$checkpoint_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$checkpoint_rank);
+$checkpoint_points = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$checkpoint_points);
+$checkpoint_points_earned = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$checkpoint_points_earned);
+$new_checkpoint_points = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$new_checkpoint_points);
+$checkpoint_points_failed = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$checkpoint_points_failed);
+$old_checkpoint_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$old_checkpoint_rank);
+$new_checkpoint_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$new_checkpoint_rank);
+$new_active = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$new_active);
+$new_commission_loss = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$new_commission_loss);
+$new_instant_fail = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$new_instant_fail);
+$new_checkpoint_text = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$new_checkpoint_text);
+$new_checkpoint_text_presets = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$new_checkpoint_text_presets);
+$checkpoint_row_id = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$checkpoint_row_id);
+$checkpoint_comment_agent = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$checkpoint_comment_agent);
+$checkpoint_answer = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$checkpoint_answer);
+$instant_fail = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$instant_fail);
+$instant_fail_value = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$instant_fail_value);
+$commission_loss = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$commission_loss);
+$parameter = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parameter);
+$parameter_value = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parameter_value);
+$recording_timestamp = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$recording_timestamp);
+$upd_customer = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$upd_customer);
+$view_epoch = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$view_epoch);
+$new_admin_notes = preg_replace("/\<|\>|\"|\\\\|;/",'-',$new_admin_notes);
+$admin_notes = preg_replace("/\<|\>|\"|\\\\|;/",'-',$admin_notes);
+
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	}
+
 $rights_stmt = "SELECT modify_leads,qc_enabled,full_name,modify_leads,user_group,selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}
 $rights_rslt=mysql_to_mysqli($rights_stmt, $link);

agc_2-X/trunk/www/vicidial/qc_scorecards.php

@@ -1,17 +1,18 @@
 <?php
 # qc_scorecards.php
 # 
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # this screen manages QC Scorecards within VICIdial
 #
 # changes:
 # 210306-1532 - First Build
 # 210827-1818 - Fix for security issue
+# 220224-2144 - Added allow_web_debug system setting
 #
 
-$admin_version = '2.14-1';
+$admin_version = '2.14-2';
-$build = '210306-1532';
+$build = '220224-2144';
 
 header ("Content-type: text/html; charset=utf-8");
 
@@ -28,45 +29,7 @@ $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
 $QUERY_STRING = getenv("QUERY_STRING");
 $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
-
+if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
-#############################################
-##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,admin_screen_colors,qc_features_active,hosted_settings FROM system_settings;";
-$rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
-$qm_conf_ct = mysqli_num_rows($rslt);
-if ($qm_conf_ct > 0)
-	{
-	$row=mysqli_fetch_row($rslt);
-	$non_latin =					$row[0];
-	$SSauto_dial_limit =			$row[1];
-	$SSuser_territories_active =	$row[2];
-	$SSallow_custom_dialplan =		$row[3];
-	$SScallcard_enabled =			$row[4];
-	$SSadmin_modify_refresh =		$row[5];
-	$SSnocache_admin =				$row[6];
-	$SSwebroot_writable =			$row[7];
-	$SSadmin_screen_colors =		$row[8];
-	$SSqc_features_active =			$row[9];
-	$SShosted_settings =			$row[10];
-
-	# slightly increase limit value, because PHP somehow thinks 2.8 > 2.8
-	$SSauto_dial_limit = ($SSauto_dial_limit + 0.001);
-	}
-##### END SETTINGS LOOKUP #####
-###########################################
-
-$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u','',$PHP_AUTH_USER);
-
-if ( file_exists("/etc/mysql_enc.conf") ) {
-	$DBCagc = file("/etc/mysql_enc.conf");
-	foreach ($DBCagc as $DBCline) {
-		$DBCline = preg_replace("/ |>|\n|\r|\t|\#.*|;.*/","",$DBCline);
-		if (ereg("^enckey", $DBCline)) {$enckey = $DBCline;   $enckey = preg_replace("/.*=/","",$enckey);}
-	}
-}
-
-if (isset($_GET["DB"]))	{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
 if (isset($_GET["submit"]))	{$submit=$_GET["submit"];}
 	elseif (isset($_POST["submit"]))	{$submit=$_POST["submit"];}
@@ -85,15 +48,65 @@ if (isset($_GET["confirm_deletion"]))	{$confirm_deletion=$_GET["confirm_deletion
 if (isset($_GET["scorecard_id"]))	{$scorecard_id=$_GET["scorecard_id"];}
 	elseif (isset($_POST["scorecard_id"]))	{$scorecard_id=$_POST["scorecard_id"];}
 
+if ( file_exists("/etc/mysql_enc.conf") ) {
+	$DBCagc = file("/etc/mysql_enc.conf");
+	foreach ($DBCagc as $DBCline) {
+		$DBCline = preg_replace("/ |>|\n|\r|\t|\#.*|;.*/","",$DBCline);
+		if (ereg("^enckey", $DBCline)) {$enckey = $DBCline;   $enckey = preg_replace("/.*=/","",$enckey);}
+	}
+}
+
+$DB=preg_replace('/[^0-9]/','',$DB);
+
+#############################################
+##### START SYSTEM_SETTINGS LOOKUP #####
+$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,admin_screen_colors,qc_features_active,hosted_settings,allow_web_debug FROM system_settings;";
+$rslt=mysql_to_mysqli($stmt, $link);
+#if ($DB) {echo "$stmt\n";}
+$qm_conf_ct = mysqli_num_rows($rslt);
+if ($qm_conf_ct > 0)
+	{
+	$row=mysqli_fetch_row($rslt);
+	$non_latin =					$row[0];
+	$SSauto_dial_limit =			$row[1];
+	$SSuser_territories_active =	$row[2];
+	$SSallow_custom_dialplan =		$row[3];
+	$SScallcard_enabled =			$row[4];
+	$SSadmin_modify_refresh =		$row[5];
+	$SSnocache_admin =				$row[6];
+	$SSwebroot_writable =			$row[7];
+	$SSadmin_screen_colors =		$row[8];
+	$SSqc_features_active =			$row[9];
+	$SShosted_settings =			$row[10];
+	# slightly increase limit value, because PHP somehow thinks 2.8 > 2.8
+	$SSauto_dial_limit = ($SSauto_dial_limit + 0.001);
+	$SSallow_web_debug =			$row[11];
+	}
+if ($SSallow_web_debug < 1) {$DB=0;}
+##### END SETTINGS LOOKUP #####
+###########################################
+
 $submit=preg_replace('/[^-0-9 \p{L}]/u','',$submit);
-$new_scorecard_id = preg_replace('/[^-_0-9a-zA-Z]/','',$new_scorecard_id);
-$new_scorecard_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$new_scorecard_name);
 $new_active = preg_replace('/[^NY]/','',$new_active);
 $active = preg_replace('/[^NY]/','',$active);
 $action = preg_replace('/[^-_0-9a-zA-Z]/','',$action);
 $confirm_deletion = preg_replace('/[^Y]/','',$confirm_deletion);
 $scorecard_id = preg_replace('/[^-_0-9a-zA-Z]/','',$scorecard_id);
 
+if ($non_latin < 1)
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$new_scorecard_id = preg_replace('/[^-_0-9a-zA-Z]/','',$new_scorecard_id);
+	$new_scorecard_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$new_scorecard_name);
+	}
+else
+	{
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$new_scorecard_id = preg_replace('/[^-_0-9\p{L}]/u','',$new_scorecard_id);
+	$new_scorecard_name = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$new_scorecard_name);
+	}
 
 $SSmenu_background='015B91';
 $SSframe_background='D9E6FE';
@@ -132,11 +145,6 @@ $Mhead_color =	$SSstd_row5_background;
 $Mmain_bgcolor = $SSmenu_background;
 $Mhead_color =	$SSstd_row5_background;
 
-if ($submit==_QXZ("SUBMIT NEW SCORECARD")) {
-	$ins_stmt="insert into quality_control_scorecards(qc_scorecard_id, scorecard_name, active) VALUES('".mysqli_escape_string($link, $new_scorecard_id)."', '".mysqli_escape_string($link, $new_scorecard_name)."', '$new_active')";
-	$ins_rslt=mysql_to_mysqli($ins_stmt, $link);
-}
-
 # Valid user
 $auth=0;
 $auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1,0);
@@ -166,6 +174,13 @@ if ($auth < 1)
 	exit;
 	}	
 
+# submit new scorecard
+if ($submit==_QXZ("SUBMIT NEW SCORECARD")) 
+	{
+	$ins_stmt="insert into quality_control_scorecards(qc_scorecard_id, scorecard_name, active) VALUES('".mysqli_escape_string($link, $new_scorecard_id)."', '".mysqli_escape_string($link, $new_scorecard_name)."', '$new_active')";
+	$ins_rslt=mysql_to_mysqli($ins_stmt, $link);
+	}
+
 if ($auth) 
 	{
 	$office_no=strtoupper($PHP_AUTH_USER);

agc_2-X/trunk/www/vicidial/vdremote.php

@@ -4,7 +4,7 @@
 # make sure you have added a user to the vicidial_users MySQL table with at 
 # least user_level 4 to access this page the first time
 #
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # Changes
 # 50307-1721 - First version
@@ -22,10 +22,11 @@
 # 141229-1847 - Added code for on-the-fly language translations display
 # 170217-1213 - Fixed non-latin auth issue #995
 # 210618-1001 - Added CORS support
+# 220224-0820 - Added allow_web_debug system setting
 #
 
-$version = '2.14-14';
+$version = '2.14-15';
-$build = '210618-1001';
+$build = '220224-0820';
 $php_script='vdremote.php';
 
 require("dbconnect_mysqli.php");
@@ -35,37 +36,38 @@ $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
 $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
 $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
-if (isset($_GET["ADD"]))				{$ADD=$_GET["ADD"];}
+if (isset($_GET["ADD"]))			{$ADD=$_GET["ADD"];}
-	elseif (isset($_POST["ADD"]))		{$ADD=$_POST["ADD"];}
+	elseif (isset($_POST["ADD"]))	{$ADD=$_POST["ADD"];}
 if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
-	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
+	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
-if (isset($_GET["user"]))				{$user=$_GET["user"];}
+if (isset($_GET["user"]))			{$user=$_GET["user"];}
-	elseif (isset($_POST["user"]))		{$user=$_POST["user"];}
+	elseif (isset($_POST["user"]))	{$user=$_POST["user"];}
-if (isset($_GET["force_logout"]))				{$force_logout=$_GET["force_logout"];}
+if (isset($_GET["force_logout"]))			{$force_logout=$_GET["force_logout"];}
-	elseif (isset($_POST["force_logout"]))		{$force_logout=$_POST["force_logout"];}
+	elseif (isset($_POST["force_logout"]))	{$force_logout=$_POST["force_logout"];}
 if (isset($_GET["groups"]))				{$groups=$_GET["groups"];}
-	elseif (isset($_POST["groups"]))		{$groups=$_POST["groups"];}
+	elseif (isset($_POST["groups"]))	{$groups=$_POST["groups"];}
-if (isset($_GET["remote_agent_id"]))				{$remote_agent_id=$_GET["remote_agent_id"];}
+if (isset($_GET["remote_agent_id"]))			{$remote_agent_id=$_GET["remote_agent_id"];}
-	elseif (isset($_POST["remote_agent_id"]))		{$remote_agent_id=$_POST["remote_agent_id"];}
+	elseif (isset($_POST["remote_agent_id"]))	{$remote_agent_id=$_POST["remote_agent_id"];}
 if (isset($_GET["user_start"]))				{$user_start=$_GET["user_start"];}
-	elseif (isset($_POST["user_start"]))		{$user_start=$_POST["user_start"];}
+	elseif (isset($_POST["user_start"]))	{$user_start=$_POST["user_start"];}
-if (isset($_GET["number_of_lines"]))				{$number_of_lines=$_GET["number_of_lines"];}
+if (isset($_GET["number_of_lines"]))			{$number_of_lines=$_GET["number_of_lines"];}
-	elseif (isset($_POST["number_of_lines"]))		{$number_of_lines=$_POST["number_of_lines"];}
+	elseif (isset($_POST["number_of_lines"]))	{$number_of_lines=$_POST["number_of_lines"];}
 if (isset($_GET["server_ip"]))				{$server_ip=$_GET["server_ip"];}
 	elseif (isset($_POST["server_ip"]))		{$server_ip=$_POST["server_ip"];}
 if (isset($_GET["conf_exten"]))				{$conf_exten=$_GET["conf_exten"];}
-	elseif (isset($_POST["conf_exten"]))		{$conf_exten=$_POST["conf_exten"];}
+	elseif (isset($_POST["conf_exten"]))	{$conf_exten=$_POST["conf_exten"];}
 if (isset($_GET["status"]))				{$status=$_GET["status"];}
-	elseif (isset($_POST["status"]))		{$status=$_POST["status"];}
+	elseif (isset($_POST["status"]))	{$status=$_POST["status"];}
-if (isset($_GET["campaign_id"]))				{$campaign_id=$_GET["campaign_id"];}
+if (isset($_GET["campaign_id"]))			{$campaign_id=$_GET["campaign_id"];}
-	elseif (isset($_POST["campaign_id"]))		{$campaign_id=$_POST["campaign_id"];}
+	elseif (isset($_POST["campaign_id"]))	{$campaign_id=$_POST["campaign_id"];}
 if (isset($_GET["groups"]))				{$groups=$_GET["groups"];}
-	elseif (isset($_POST["groups"]))		{$groups=$_POST["groups"];}
+	elseif (isset($_POST["groups"]))	{$groups=$_POST["groups"];}
 if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
-	elseif (isset($_POST["submit"]))		{$submit=$_POST["submit"];}
+	elseif (isset($_POST["submit"]))	{$submit=$_POST["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
-	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
+	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+if (!isset($query_date)) {$query_date = $NOW_DATE;}
 if (!isset($force_logout)) {$force_logout = 0;}
 $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
@@ -85,9 +87,9 @@ if ($force_logout)
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method FROM system_settings;";
+$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,allow_web_debug FROM system_settings;";
 $rslt=mysql_to_mysqli($stmt, $link);
-if ($DB) {echo "$stmt\n";}
+#if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysqli_num_rows($rslt);
 if ($qm_conf_ct > 0)
 	{
@@ -99,23 +101,41 @@ if ($qm_conf_ct > 0)
 	$custom_fields_enabled =		$row[4];
 	$SSenable_languages =			$row[5];
 	$SSlanguage_method =			$row[6];
+	$SSallow_web_debug =			$row[7];
 	}
+if ($SSallow_web_debug < 1) {$DB=0;}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
-if (!isset($query_date)) {$query_date = $NOW_DATE;}
+$remote_agent_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $remote_agent_id);
+$query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date);
+$ADD = preg_replace('/[^-_0-9a-zA-Z]/', '', $ADD);
+$force_logout = preg_replace('/[^-_0-9a-zA-Z]/', '', $force_logout);
+$user_start = preg_replace('/[^-_0-9a-zA-Z]/', '', $user_start);
+$number_of_lines = preg_replace('/[^-_0-9a-zA-Z]/', '', $number_of_lines);
+$status = preg_replace('/[^-_0-9a-zA-Z]/', '', $status);
+$conf_exten = preg_replace('/[^-_0-9a-zA-Z]/', '', $conf_exten);
+$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+
+# Variables filtered further down in the code
+# $groups
+
 if ($non_latin < 1)
 	{
 	$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user);
+	$campaign_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $campaign_id);
 	}
 else
 	{
-	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
-	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
+	$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
+	$user = preg_replace('/[^-_0-9\p{L}]/u', '', $user);
+	$campaign_id = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign_id);
 	}
-$remote_agent_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $remote_agent_id);
-$query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date);
 
 $popup_page = './closer_popup.php';
 $STARTtime = date("U");
@@ -268,8 +288,9 @@ if (strlen($ADD)>4)
 		$group_name_value = $rowx[1];
 		$groups_list .= "<input type=\"checkbox\" name=\"groups[]\" value=\"$group_id_value\"";
 		$p=0;
-		while ($p<50)
+		while ($p<100)
 			{
+			$groups[$p] = preg_replace('/[^-_0-9a-zA-Z]/', '', $groups[$p]);
 			if ($group_id_value == $groups[$p]) 
 				{
 				$groups_list .= " CHECKED";
@@ -627,7 +648,4 @@ echo "<font size=0>\n\n\n<br><br><br>\nscript runtime: $RUNtime seconds</font>";
 	
 exit; 
 
-
-
 ?>
-