diff --git a/agc_2-X/trunk/www/vicidial/admin_mobile.php b/agc_2-X/trunk/www/vicidial/admin_mobile.php index 17028a1c..88ed9fdf 100644 --- a/agc_2-X/trunk/www/vicidial/admin_mobile.php +++ b/agc_2-X/trunk/www/vicidial/admin_mobile.php @@ -8,10 +8,11 @@ # 200210-1618 - Added links to more mobile-compatible reports # 200309-1819 - Modifications for display formatting # 220222-1451 - Added allow_web_debug system setting +# 220228-1048 - Added more variable filtering # -$admin_version = '2.14-4a'; -$build = '220222-1451'; +$admin_version = '2.14-5a'; +$build = '220228-1048'; $startMS = microtime(); @@ -157,7 +158,6 @@ if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); - ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,allow_emails,level_8_disable_add,pass_key,pass_hash_enabled,disable_auto_dial,country_code_list_stats,frozen_server_call_clear,active_modules,allow_chats,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,enable_did_entry_list_id,enable_third_webform,default_language,user_hide_realtime_enabled,log_recording_access,alt_ivr_logging,admin_row_click,admin_screen_colors,ofcom_uk_drop_calc,agent_screen_colors,script_remove_js,manual_auto_next,user_new_lead_limit,agent_xfer_park_3way,agent_soundboards,web_loader_phone_length,agent_script,enable_auto_reports,enable_pause_code_limits,enable_drop_lists,allow_ip_lists,system_ip_blacklist,hide_inactive_lists,allow_manage_active_lists,expired_lists_inactive,did_system_filter,enable_gdpr_download_deletion,allow_web_debug FROM system_settings;"; @@ -248,6 +248,17 @@ if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + } + ### populate pass_key if not set if ( ($qm_conf_ct > 0) and (strlen($SSpass_key)<16) ) { diff --git a/agc_2-X/trunk/www/vicidial/email_agent_login_link.php b/agc_2-X/trunk/www/vicidial/email_agent_login_link.php index 9f8540c8..00c1b907 100644 --- a/agc_2-X/trunk/www/vicidial/email_agent_login_link.php +++ b/agc_2-X/trunk/www/vicidial/email_agent_login_link.php @@ -1,17 +1,18 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script sends an email to an agent with a link that will log them # into their vicidial account when clicked. # # changes: # 200324-1543 - Initial Build +# 220228-1055 - Added allow_web_debug system setting # -$version = '2.14-13'; -$build = '200324-1543'; +$version = '2.14-2'; +$build = '220228-1055'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -35,17 +36,14 @@ if (isset($_GET["agent_id"])) {$agent_id=$_GET["agent_id"];} elseif (isset($_POST["agent_id"])) {$agent_id=$_POST["agent_id"];} $DB = preg_replace('/[^0-9]/','',$DB); -$preview = preg_replace('/[^-_0-9a-zA-Z]/','',$preview); -$agent_id = preg_replace('/[^-_0-9a-zA-Z]/','',$agent_id); if ( $preview == "" ) { $preview == 1; } - ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$sys_settings_stmt = "SELECT use_non_latin,outbound_autodial_active,sounds_central_control_active,enable_languages,language_method,admin_screen_colors,report_default_format,allow_manage_active_lists,user_account_emails,pass_hash_enabled FROM system_settings;"; +$sys_settings_stmt = "SELECT use_non_latin,outbound_autodial_active,sounds_central_control_active,enable_languages,language_method,admin_screen_colors,report_default_format,allow_manage_active_lists,user_account_emails,pass_hash_enabled,allow_web_debug FROM system_settings;"; $sys_settings_rslt=mysql_to_mysqli($sys_settings_stmt, $link); -if ($DB) {echo "$sys_settings_stmt\n";} +#if ($DB) {echo "$sys_settings_stmt\n";} $num_rows = mysqli_num_rows($sys_settings_rslt); if ($num_rows > 0) { @@ -60,15 +58,20 @@ if ($num_rows > 0) $SSallow_manage_active_lists = $sys_settings_row[7]; $user_account_emails = $sys_settings_row[8]; $pass_hash_enabled = $sys_settings_row[9]; + $SSallow_web_debug = $sys_settings_row[10]; } else { # there is something really weird if there are no system settings exit; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$preview = preg_replace('/[^-_0-9a-zA-Z]/','',$preview); +$agent_id = preg_replace('/[^-_0-9a-zA-Z]/','',$agent_id); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -76,10 +79,9 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$list_id_override = preg_replace('/[^0-9]/','',$list_id_override); $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} diff --git a/agc_2-X/trunk/www/vicidial/help.php b/agc_2-X/trunk/www/vicidial/help.php index 16d4427e..cf8eee41 100644 --- a/agc_2-X/trunk/www/vicidial/help.php +++ b/agc_2-X/trunk/www/vicidial/help.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGELOG: @@ -161,6 +161,7 @@ # 180430-1837 - Added inbound_groups-park_ext entry # 180506-1822 - Added text for custom list fields SWITCH field type # 191227-0857 - Fixes for translated phrases gathering +# 220228-1100 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -168,9 +169,9 @@ require("functions.php"); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,allow_emails,level_8_disable_add,pass_key,pass_hash_enabled,disable_auto_dial,country_code_list_stats,enable_languages,language_method,enable_third_webform,allow_chats FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,allow_emails,level_8_disable_add,pass_key,pass_hash_enabled,disable_auto_dial,country_code_list_stats,enable_languages,language_method,enable_third_webform,allow_chats,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -220,7 +221,9 @@ if ($qm_conf_ct > 0) $SSlanguage_method = $row[42]; $SSenable_third_webform = $row[43]; $SSallow_chats = $row[44]; + $SSallow_web_debug = $row[45]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -234,8 +237,8 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace('/\'|\"|\\\\|;/', '',$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace('/\'|\"|\\\\|;/', '',$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; diff --git a/agc_2-X/trunk/www/vicidial/lead_tools.php b/agc_2-X/trunk/www/vicidial/lead_tools.php index 3f370b42..56af9dd0 100644 --- a/agc_2-X/trunk/www/vicidial/lead_tools.php +++ b/agc_2-X/trunk/www/vicidial/lead_tools.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell,Michael Cargile LICENSE: AGPLv2 # # CHANGES # 121110-1446 - Initial Build @@ -17,10 +17,11 @@ # 170711-1105 - Added screen colors # 170819-1002 - Added allow_manage_active_lists option # 191119-1815 - Fixes for translations compatibility, issue #1142 +# 220228-1025 - Added allow_web_debug system setting # -$version = '2.14-13'; -$build = '191119-1815'; +$version = '2.14-14'; +$build = '220228-1025'; # This limit is to prevent data inconsistancies. # If there are too many leads in a list this @@ -62,21 +63,15 @@ if (isset($_GET["confirm_update"])) {$confirm_move=$_GET["confirm_update"];} elseif (isset($_POST["confirm_update"])) {$confirm_update=$_POST["confirm_update"];} if (isset($_GET["confirm_delete"])) {$confirm_delete=$_GET["confirm_delete"];} elseif (isset($_POST["confirm_delete"])) {$confirm_delete=$_POST["confirm_delete"];} - +# Several sets of variable inputs are further down in the code as well + $DB = preg_replace('/[^0-9]/','',$DB); -$move_submit = preg_replace('/[^-_0-9a-zA-Z]/','',$move_submit); -$update_submit = preg_replace('/[^-_0-9a-zA-Z]/','',$update_submit); -$delete_submit = preg_replace('/[^-_0-9a-zA-Z]/','',$delete_submit); -$confirm_move = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm_move); -$confirm_update = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm_update); -$confirm_delete = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm_delete); -$delete_status = preg_replace('/[^-_0-9a-zA-Z]/','',$delete_status); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$sys_settings_stmt = "SELECT use_non_latin,outbound_autodial_active,sounds_central_control_active,enable_languages,language_method,admin_screen_colors,report_default_format,allow_manage_active_lists FROM system_settings;"; +$sys_settings_stmt = "SELECT use_non_latin,outbound_autodial_active,sounds_central_control_active,enable_languages,language_method,admin_screen_colors,report_default_format,allow_manage_active_lists,allow_web_debug FROM system_settings;"; $sys_settings_rslt=mysql_to_mysqli($sys_settings_stmt, $link); -if ($DB) {echo "$sys_settings_stmt\n";} +#if ($DB) {echo "$sys_settings_stmt\n";} $num_rows = mysqli_num_rows($sys_settings_rslt); if ($num_rows > 0) { @@ -89,15 +84,25 @@ if ($num_rows > 0) $SSadmin_screen_colors = $sys_settings_row[5]; $SSreport_default_format = $sys_settings_row[6]; $SSallow_manage_active_lists = $sys_settings_row[7]; + $SSallow_web_debug = $sys_settings_row[8]; } else { # there is something really weird if there are no system settings exit; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$move_submit = preg_replace('/[^-_0-9a-zA-Z]/','',$move_submit); +$update_submit = preg_replace('/[^-_0-9a-zA-Z]/','',$update_submit); +$delete_submit = preg_replace('/[^-_0-9a-zA-Z]/','',$delete_submit); +$confirm_move = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm_move); +$confirm_update = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm_update); +$confirm_delete = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm_delete); +$delete_status = preg_replace('/[^-_0-9a-zA-Z]/','',$delete_status); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -105,10 +110,9 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$list_id_override = preg_replace('/[^0-9]/','',$list_id_override); $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} @@ -311,9 +315,9 @@ if ($move_submit == _QXZ("move") ) if (isset($_GET["move_count_num"])) {$move_count_num=$_GET["move_count_num"];} elseif (isset($_POST["move_count_num"])) {$move_count_num=$_POST["move_count_num"];} - #$move_status = preg_replace('/[^-_0-9a-zA-Z]/','',$move_status); $move_from_list = preg_replace('/[^0-9]/','',$move_from_list); $move_to_list = preg_replace('/[^0-9]/','',$move_to_list); + $move_status = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $move_status); $move_count_num = preg_replace('/[^0-9]/','',$move_count_num); $move_count_op = preg_replace('/[^<>=]/','',$move_count_op); @@ -401,9 +405,9 @@ if ($confirm_move == _QXZ("confirm")) if (isset($_GET["move_count_num"])) {$move_count_num=$_GET["move_count_num"];} elseif (isset($_POST["move_count_num"])) {$move_count_num=$_POST["move_count_num"];} - #$move_status = preg_replace('/[^-_0-9a-zA-Z]/','',$move_status); $move_from_list = preg_replace('/[^0-9]/','',$move_from_list); $move_to_list = preg_replace('/[^0-9]/','',$move_to_list); + $move_status = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $move_status); $move_count_num = preg_replace('/[^0-9]/','',$move_count_num); $move_count_op = preg_replace('/[^<>=]/','',$move_count_op); @@ -465,8 +469,8 @@ if ($update_submit == _QXZ("update") ) if (isset($_GET["update_count_num"])) {$update_count_num=$_GET["update_count_num"];} elseif (isset($_POST["update_count_num"])) {$update_count_num=$_POST["update_count_num"];} - $update_from_status = preg_replace('/[^-_0-9a-zA-Z]/','',$update_from_status); - $update_to_status = preg_replace('/[^-_0-9a-zA-Z]/','',$update_to_status); + $update_from_status = preg_replace('/[^-_0-9\p{L}]/u','',$update_from_status); + $update_to_status = preg_replace('/[^-_0-9\p{L}]/u','',$update_to_status); $update_list = preg_replace('/[^0-9]/','',$update_list); $update_count_num = preg_replace('/[^0-9]/','',$update_count_num); $update_count_op = preg_replace('/[^<>=]/','',$update_count_op); @@ -532,8 +536,8 @@ if ($confirm_update == _QXZ("confirm")) if (isset($_GET["update_count_num"])) {$update_count_num=$_GET["update_count_num"];} elseif (isset($_POST["update_count_num"])) {$update_count_num=$_POST["update_count_num"];} - $update_from_status = preg_replace('/[^-_0-9a-zA-Z]/','',$update_from_status); - $update_to_status = preg_replace('/[^-_0-9a-zA-Z]/','',$update_to_status); + $update_from_status = preg_replace('/[^-_0-9\p{L}]/u','',$update_from_status); + $update_to_status = preg_replace('/[^-_0-9\p{L}]/u','',$update_to_status); $update_list = preg_replace('/[^0-9]/','',$update_list); $update_count_num = preg_replace('/[^0-9]/','',$update_count_num); $update_count_op = preg_replace('/[^<>=]/','',$update_count_op); @@ -593,7 +597,7 @@ if ( ( $delete_submit == _QXZ("delete") ) && ( $delete_lists > 0 ) ) if (isset($_GET["delete_count_num"])) {$delete_count_num=$_GET["delete_count_num"];} elseif (isset($_POST["delete_count_num"])) {$delete_count_num=$_POST["delete_count_num"];} - $delete_status = preg_replace('/[^-_0-9a-zA-Z]/','',$delete_status); + $delete_status = preg_replace('/[^-_0-9\p{L}]/u','',$delete_status); $delete_list = preg_replace('/[^0-9]/','',$delete_list); $delete_count_num = preg_replace('/[^0-9]/','',$delete_count_num); $delete_count_op = preg_replace('/[^<>=]/','',$delete_count_op); @@ -655,7 +659,7 @@ if ( ( $confirm_delete == _QXZ("confirm") ) && ( $delete_lists > 0 ) ) if (isset($_GET["delete_count_num"])) {$delete_count_num=$_GET["delete_count_num"];} elseif (isset($_POST["delete_count_num"])) {$delete_count_num=$_POST["delete_count_num"];} - $delete_status = preg_replace('/[^-_0-9a-zA-Z]/','',$delete_status); + $delete_status = preg_replace('/[^-_0-9\p{L}]/u','',$delete_status); $delete_list = preg_replace('/[^0-9]/','',$delete_list); $delete_count_num = preg_replace('/[^0-9]/','',$delete_count_num); $delete_count_op = preg_replace('/[^<>=]/','',$delete_count_op); diff --git a/agc_2-X/trunk/www/vicidial/lead_tools_advanced.php b/agc_2-X/trunk/www/vicidial/lead_tools_advanced.php index 3d1b15e5..f4af59ce 100644 --- a/agc_2-X/trunk/www/vicidial/lead_tools_advanced.php +++ b/agc_2-X/trunk/www/vicidial/lead_tools_advanced.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell,Michael Cargile LICENSE: AGPLv2 # # CHANGES # 131016-1948 - Initial Build based upon lead_tools.php @@ -16,10 +16,11 @@ # 170819-1003 - Added allow_manage_active_lists option, Changed list selection to multi # 191119-1817 - Fixes for translations compatibility, issue #1142 # 210607-0923 - Added option to reset called_count to 0 +# 220228-1012 - Added allow_web_debug system setting # -$version = '2.14-12'; -$build = '210607-0923'; +$version = '2.14-13'; +$build = '220228-1012'; # This limit is to prevent data inconsistancies. # If there are too many leads in a list this @@ -73,8 +74,38 @@ if (isset($_GET["confirm_reset_called_count"])) {$confirm_reset_called_count=$_G elseif (isset($_POST["confirm_reset_called_count"])) {$confirm_reset_called_count=$_POST["confirm_reset_called_count"];} if (isset($_GET["confirm_callback"])) {$confirm_callback=$_GET["confirm_callback"];} elseif (isset($_POST["confirm_callback"])) {$confirm_callback=$_POST["confirm_callback"];} +# Several sets of variable inputs are further down in the code as well $DB = preg_replace('/[^0-9]/','',$DB); + +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$sys_settings_stmt = "SELECT use_non_latin,outbound_autodial_active,sounds_central_control_active,enable_languages,language_method,admin_screen_colors,report_default_format,allow_manage_active_lists,allow_web_debug FROM system_settings;"; +$sys_settings_rslt=mysql_to_mysqli($sys_settings_stmt, $link); +#if ($DB) {echo "$sys_settings_stmt\n";} +$num_rows = mysqli_num_rows($sys_settings_rslt); +if ($num_rows > 0) + { + $sys_settings_row=mysqli_fetch_row($sys_settings_rslt); + $non_latin = $sys_settings_row[0]; + $SSoutbound_autodial_active = $sys_settings_row[1]; + $sounds_central_control_active = $sys_settings_row[2]; + $SSenable_languages = $sys_settings_row[3]; + $SSlanguage_method = $sys_settings_row[4]; + $SSadmin_screen_colors = $sys_settings_row[5]; + $SSreport_default_format = $sys_settings_row[6]; + $SSallow_manage_active_lists = $sys_settings_row[7]; + $SSallow_web_debug = $sys_settings_row[8]; + } +else + { + # there is something really weird if there are no system settings + exit; + } +if ($SSallow_web_debug < 1) {$DB=0;} +##### END SETTINGS LOOKUP ##### +########################################### + $move_submit = preg_replace('/[^-_0-9a-zA-Z]/','',$move_submit); $update_submit = preg_replace('/[^-_0-9a-zA-Z]/','',$update_submit); $delete_submit = preg_replace('/[^-_0-9a-zA-Z]/','',$delete_submit); @@ -88,40 +119,6 @@ $confirm_callback = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm_callback); $delete_status = preg_replace('/[^-_0-9a-zA-Z]/','',$delete_status); $reset_called_count_status = preg_replace('/[^-_0-9a-zA-Z]/','',$reset_called_count_status); -$DBlink=''; -if ($DB) - { - $DBlink="?DB=$DB"; - echo "

DB = $DB | "._QXZ("move_submit")." = $move_submit | "._QXZ("update_submit")." = $update_submit | "._QXZ("delete_submit")." = $delete_submit | "._QXZ("reset_called_count_submit")." = $reset_called_count_submit | "._QXZ("callback_submit")." = $callback_submit | "._QXZ("confirm_move")." = $confirm_move | "._QXZ("confirm_update")." = $confirm_update | "._QXZ("confirm_delete")." = $confirm_delete | "._QXZ("confirm_reset_called_count")." = $confirm_reset_called_count | "._QXZ("confirm_callback")." = $confirm_callback

"; - } - - -############################################# -##### START SYSTEM_SETTINGS LOOKUP ##### -$sys_settings_stmt = "SELECT use_non_latin,outbound_autodial_active,sounds_central_control_active,enable_languages,language_method,admin_screen_colors,report_default_format,allow_manage_active_lists FROM system_settings;"; -$sys_settings_rslt=mysql_to_mysqli($sys_settings_stmt, $link); -if ($DB) {echo "$sys_settings_stmt\n";} -$num_rows = mysqli_num_rows($sys_settings_rslt); -if ($num_rows > 0) - { - $sys_settings_row=mysqli_fetch_row($sys_settings_rslt); - $non_latin = $sys_settings_row[0]; - $SSoutbound_autodial_active = $sys_settings_row[1]; - $sounds_central_control_active = $sys_settings_row[2]; - $SSenable_languages = $sys_settings_row[3]; - $SSlanguage_method = $sys_settings_row[4]; - $SSadmin_screen_colors = $sys_settings_row[5]; - $SSreport_default_format = $sys_settings_row[6]; - $SSallow_manage_active_lists = $sys_settings_row[7]; - } -else - { - # there is something really weird if there are no system settings - exit; - } -##### END SETTINGS LOOKUP ##### -########################################### - if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -129,10 +126,16 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + } + +$DBlink=''; +if ($DB) + { + $DBlink="?DB=$DB"; + echo "

DB = $DB | "._QXZ("move_submit")." = $move_submit | "._QXZ("update_submit")." = $update_submit | "._QXZ("delete_submit")." = $delete_submit | "._QXZ("reset_called_count_submit")." = $reset_called_count_submit | "._QXZ("callback_submit")." = $callback_submit | "._QXZ("confirm_move")." = $confirm_move | "._QXZ("confirm_update")." = $confirm_update | "._QXZ("confirm_delete")." = $confirm_delete | "._QXZ("confirm_reset_called_count")." = $confirm_reset_called_count | "._QXZ("confirm_callback")." = $confirm_callback

"; } -$list_id_override = preg_replace('/[^0-9]/','',$list_id_override); $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} @@ -2547,7 +2550,7 @@ if ( ( $delete_submit == _QXZ("delete") ) && ( $delete_lists > 0 ) ) } # filter out anything bad - $enable_delete_status = preg_replace('/[^a-zA-Z]/','',$enable_delete_status); + $enable_delete_lead_id = preg_replace('/[^a-zA-Z]/','',$enable_delete_lead_id); $enable_delete_country_code = preg_replace('/[^a-zA-Z]/','',$enable_delete_country_code); $enable_delete_vendor_lead_code = preg_replace('/[^a-zA-Z]/','',$enable_delete_vendor_lead_code); $enable_delete_source_id = preg_replace('/[^a-zA-Z]/','',$enable_delete_source_id); @@ -2950,7 +2953,7 @@ if ( ( $confirm_delete == _QXZ("confirm") ) && ( $delete_lists > 0 ) ) } # filter out anything bad - $enable_delete_status = preg_replace('/[^a-zA-Z]/','',$enable_delete_status); + $enable_delete_lead_id = preg_replace('/[^a-zA-Z]/','',$enable_delete_lead_id); $enable_delete_country_code = preg_replace('/[^a-zA-Z]/','',$enable_delete_country_code); $enable_delete_vendor_lead_code = preg_replace('/[^a-zA-Z]/','',$enable_delete_vendor_lead_code); $enable_delete_source_id = preg_replace('/[^a-zA-Z]/','',$enable_delete_source_id); @@ -3324,7 +3327,7 @@ if ( ( $reset_called_count_submit == _QXZ("reset called count") ) && ( $modify_l } # filter out anything bad - $enable_reset_called_count_status = preg_replace('/[^a-zA-Z]/','',$enable_reset_called_count_status); + $enable_reset_called_count_lead_id = preg_replace('/[^a-zA-Z]/','',$enable_reset_called_count_lead_id); $enable_reset_called_count_country_code = preg_replace('/[^a-zA-Z]/','',$enable_reset_called_count_country_code); $enable_reset_called_count_vendor_lead_code = preg_replace('/[^a-zA-Z]/','',$enable_reset_called_count_vendor_lead_code); $enable_reset_called_count_source_id = preg_replace('/[^a-zA-Z]/','',$enable_reset_called_count_source_id); @@ -3727,7 +3730,7 @@ if ( ( $confirm_reset_called_count == _QXZ("confirm") ) && ( $modify_leads > 0 ) } # filter out anything bad - $enable_reset_called_count_status = preg_replace('/[^a-zA-Z]/','',$enable_reset_called_count_status); + $enable_reset_called_count_lead_id = preg_replace('/[^a-zA-Z]/','',$enable_reset_called_count_lead_id); $enable_reset_called_count_country_code = preg_replace('/[^a-zA-Z]/','',$enable_reset_called_count_country_code); $enable_reset_called_count_vendor_lead_code = preg_replace('/[^a-zA-Z]/','',$enable_reset_called_count_vendor_lead_code); $enable_reset_called_count_source_id = preg_replace('/[^a-zA-Z]/','',$enable_reset_called_count_source_id); diff --git a/agc_2-X/trunk/www/vicidial/list_merge.php b/agc_2-X/trunk/www/vicidial/list_merge.php index 6ad5d6cf..568f613b 100644 --- a/agc_2-X/trunk/www/vicidial/list_merge.php +++ b/agc_2-X/trunk/www/vicidial/list_merge.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell,Joseph Johnson LICENSE: AGPLv2 # # CHANGES # 161004-2240 - Initial Build @@ -10,10 +10,11 @@ # 180508-2215 - Added new help display # 191101-1630 - Translation patch, removed function.js # 201117-1350 - Translation bug fixed, Issue #1236 +# 220227-2210 - Added allow_web_debug system setting # -$version = '2.14-3'; -$build = '170819-1000'; +$version = '2.14-4'; +$build = '220227-2210'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -61,25 +62,13 @@ if (isset($_GET["retain_original_list"])) {$retain_original_list=$_GET["retain_o if (isset($_GET["create_new_list"])) {$create_new_list=$_GET["create_new_list"];} elseif (isset($_POST["create_new_list"])) {$create_new_list=$_POST["create_new_list"];} - - - $DB = preg_replace('/[^0-9]/','',$DB); -$retain_original_list = preg_replace('/[^NY]/i','',$retain_original_list); -$available_lists = preg_replace('/[^0-9\|]/','',$available_lists); -$start_dest_list_id = preg_replace('/[^0-9]/','',$start_dest_list_id); -$destination_list_id = preg_replace('/[^0-9]/','',$destination_list_id); -$new_list_id = preg_replace('/[^0-9]/','',$new_list_id); -$new_list_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$new_list_name); -$new_list_description = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$new_list_description); -$num_leads = preg_replace('/[^0-9]/','',$num_leads); - ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$sys_settings_stmt = "SELECT use_non_latin,outbound_autodial_active,sounds_central_control_active,enable_languages,language_method,active_modules,admin_screen_colors,allow_manage_active_lists FROM system_settings;"; +$sys_settings_stmt = "SELECT use_non_latin,outbound_autodial_active,sounds_central_control_active,enable_languages,language_method,active_modules,admin_screen_colors,allow_manage_active_lists,allow_web_debug FROM system_settings;"; $sys_settings_rslt=mysql_to_mysqli($sys_settings_stmt, $link); -if ($DB) {echo "$sys_settings_stmt\n";} +#if ($DB) {echo "$sys_settings_stmt\n";} $num_rows = mysqli_num_rows($sys_settings_rslt); if ($num_rows > 0) { @@ -92,26 +81,42 @@ if ($num_rows > 0) $SSactive_modules = $sys_settings_row[5]; $SSadmin_screen_colors = $sys_settings_row[6]; $SSallow_manage_active_lists = $sys_settings_row[7]; + $SSallow_web_debug = $sys_settings_row[8]; } else { # there is something really weird if there are no system settings exit; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$retain_original_list = preg_replace('/[^NY]/i','',$retain_original_list); +$available_lists = preg_replace('/[^0-9\|]/','',$available_lists); +$start_dest_list_id = preg_replace('/[^0-9]/','',$start_dest_list_id); +$destination_list_id = preg_replace('/[^0-9]/','',$destination_list_id); +$new_list_id = preg_replace('/[^0-9]/','',$new_list_id); +$new_list_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$new_list_name); +$new_list_description = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$new_list_description); +$num_leads = preg_replace('/[^0-9]/','',$num_leads); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$confirm = preg_replace('/[^-_0-9a-zA-Z]/', '', $confirm); +$active = preg_replace('/[^-_0-9a-zA-Z]/', '', $active); +$create_new_list = preg_replace('/[^-_0-9a-zA-Z]/', '', $create_new_list); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $campaign_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $campaign_id); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $campaign_id = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign_id); } -$list_id_override = preg_replace('/[^0-9]/','',$list_id_override); $stmt="SELECT selected_language,modify_lists from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} diff --git a/agc_2-X/trunk/www/vicidial/list_split.php b/agc_2-X/trunk/www/vicidial/list_split.php index 70470cb0..63e815ea 100644 --- a/agc_2-X/trunk/www/vicidial/list_split.php +++ b/agc_2-X/trunk/www/vicidial/list_split.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell,Michael Cargile LICENSE: AGPLv2 # # CHANGES # 140916-1215 - Initial Build @@ -13,10 +13,11 @@ # 170819-1001 - Added allow_manage_active_lists option # 190703-0925 - Added use of admin_web_directory system setting # 210427-1741 - Added more list count options +# 220227-2204 - Added allow_web_debug system setting # -$version = '2.14-9'; -$build = '210427-1741'; +$version = '2.14-10'; +$build = '220227-2204'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -49,18 +50,12 @@ if (isset($_GET["num_leads"])) {$num_leads=$_GET["num_leads"];} elseif (isset($_POST["num_leads"])) {$num_leads=$_POST["num_leads"];} $DB = preg_replace('/[^0-9]/','',$DB); -$submit = preg_replace('/[^-_0-9a-zA-Z]/','',$submit); -$confirm = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm); -$orig_list = preg_replace('/[^0-9]/','',$orig_list); -$start_dest_list_id = preg_replace('/[^0-9]/','',$start_dest_list_id); -$num_leads = preg_replace('/[^0-9]/','',$num_leads); - ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$sys_settings_stmt = "SELECT use_non_latin,outbound_autodial_active,sounds_central_control_active,enable_languages,language_method,active_modules,admin_screen_colors,allow_manage_active_lists,admin_web_directory FROM system_settings;"; +$sys_settings_stmt = "SELECT use_non_latin,outbound_autodial_active,sounds_central_control_active,enable_languages,language_method,active_modules,admin_screen_colors,allow_manage_active_lists,admin_web_directory,allow_web_debug FROM system_settings;"; $sys_settings_rslt=mysql_to_mysqli($sys_settings_stmt, $link); -if ($DB) {echo "$sys_settings_stmt\n";} +#if ($DB) {echo "$sys_settings_stmt\n";} $num_rows = mysqli_num_rows($sys_settings_rslt); if ($num_rows > 0) { @@ -74,15 +69,23 @@ if ($num_rows > 0) $SSadmin_screen_colors = $sys_settings_row[6]; $SSallow_manage_active_lists = $sys_settings_row[7]; $SSadmin_web_directory = $sys_settings_row[8]; + $SSallow_web_debug = $sys_settings_row[9]; } else { # there is something really weird if there are no system settings exit; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$submit = preg_replace('/[^-_0-9a-zA-Z]/','',$submit); +$confirm = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm); +$orig_list = preg_replace('/[^0-9]/','',$orig_list); +$start_dest_list_id = preg_replace('/[^0-9]/','',$start_dest_list_id); +$num_leads = preg_replace('/[^0-9]/','',$num_leads); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -90,10 +93,9 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$list_id_override = preg_replace('/[^0-9]/','',$list_id_override); $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} diff --git a/agc_2-X/trunk/www/vicidial/process_report.php b/agc_2-X/trunk/www/vicidial/process_report.php index 80053a0c..2c3a6c64 100644 --- a/agc_2-X/trunk/www/vicidial/process_report.php +++ b/agc_2-X/trunk/www/vicidial/process_report.php @@ -1,10 +1,11 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # 180114-1051 - First build +# 220227-1958 - Added allow_web_debug system setting # $startMS = microtime(); @@ -29,11 +30,15 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); +$NOW_DATE = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$STARTtime = date("U"); + ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -44,19 +49,26 @@ if ($qm_conf_ct > 0) $user_territories_active = $row[3]; $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; + $SSallow_web_debug = $row[6]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$submit = preg_replace('/[^-_0-9a-zA-Z]/',"",$submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/',"",$SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9\p{L}]/u', '', $group); } $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; @@ -195,13 +207,6 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $MAIN.="\n"; } -$NOW_DATE = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); -$STARTtime = date("U"); -if (!isset($group)) {$group = array();} -if (!isset($query_date)) {$query_date = $NOW_DATE;} -if (!isset($server_ip)) {$server_ip = '10.10.10.15';} - $stmt="select distinct(serial_id) from vicidial_process_log order by run_time desc limit 10000;"; $rslt=mysql_to_mysqli($stmt, $link); if ($DB) {echo "$stmt\n";} diff --git a/agc_2-X/trunk/www/vicidial/settings_compare.php b/agc_2-X/trunk/www/vicidial/settings_compare.php index 9210d832..f42f1228 100644 --- a/agc_2-X/trunk/www/vicidial/settings_compare.php +++ b/agc_2-X/trunk/www/vicidial/settings_compare.php @@ -1,10 +1,11 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # 210306-2052 - First build +# 220227-1955 - Added allow_web_debug system setting # $startMS = microtime(); @@ -33,11 +34,17 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); +$NOW_DATE = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$STARTtime = date("U"); +if (!isset($query_date)) {$query_date = $NOW_DATE;} +if (!isset($server_ip)) {$server_ip = '10.10.10.15';} + ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_shared_dial,qc_features_active FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_shared_dial,qc_features_active,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -50,13 +57,17 @@ if ($qm_conf_ct > 0) $SSlanguage_method = $row[5]; $SSallow_shared_dial = $row[6]; $SSqc_features_active = $row[7]; + $SSallow_web_debug = $row[8]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### $first_id = preg_replace('/[^-:\+\*\#\.\_0-9\p{L}]/u', '', $first_id); $second_id = preg_replace('/[^-:\+\*\#\.\_0-9\p{L}]/u', '', $second_id); $stage = preg_replace('/[^-_0-9a-zA-Z]/', '', $stage); +$submit = preg_replace('/[^-_0-9a-zA-Z]/',"",$submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/',"",$SUBMIT); if ($non_latin < 1) { @@ -65,8 +76,8 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; @@ -247,12 +258,6 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $MAIN.="\n"; } -$NOW_DATE = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); -$STARTtime = date("U"); -if (!isset($query_date)) {$query_date = $NOW_DATE;} -if (!isset($server_ip)) {$server_ip = '10.10.10.15';} - ?> diff --git a/agc_2-X/trunk/www/vicidial/shared_debug.php b/agc_2-X/trunk/www/vicidial/shared_debug.php index e8d34f02..d02c04a2 100644 --- a/agc_2-X/trunk/www/vicidial/shared_debug.php +++ b/agc_2-X/trunk/www/vicidial/shared_debug.php @@ -1,10 +1,11 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # 210207-0913 - First build +# 220227-1944 - Added allow_web_debug system setting # $startMS = microtime(); @@ -33,11 +34,17 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); +$NOW_DATE = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$STARTtime = date("U"); +if (!isset($query_date)) {$query_date = $NOW_DATE;} +if (!isset($server_ip)) {$server_ip = '10.10.10.15';} + ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_shared_dial FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_shared_dial,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -49,23 +56,28 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $SSallow_shared_dial = $row[6]; + $SSallow_web_debug = $row[7]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### $query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date); $query_date_T = preg_replace('/[^- \:_0-9a-zA-Z]/', '', $query_date_T); -$stage = preg_replace('/[^-_0-9a-zA-Z]/', '', $stage); +$submit = preg_replace('/[^-_0-9a-zA-Z]/',"",$submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/',"",$SUBMIT); if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $stage = preg_replace('/[^-_0-9a-zA-Z]/', '', $stage); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $stage = preg_replace('/[^-_0-9\p{L}]/u', '', $stage); } $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; @@ -204,12 +216,6 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $MAIN.="\n"; } -$NOW_DATE = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); -$STARTtime = date("U"); -if (!isset($query_date)) {$query_date = $NOW_DATE;} -if (!isset($server_ip)) {$server_ip = '10.10.10.15';} - ?> diff --git a/agc_2-X/trunk/www/vicidial/sph_report.php b/agc_2-X/trunk/www/vicidial/sph_report.php index 1b12d563..b535d846 100644 --- a/agc_2-X/trunk/www/vicidial/sph_report.php +++ b/agc_2-X/trunk/www/vicidial/sph_report.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # @@ -16,6 +16,7 @@ # 141114-0031 - Finalized adding QXZ translation to all admin files # 141230-0950 - Added code for on-the-fly language translations display # 170409-1534 - Added IP List validation code +# 220227-1936 - Added allow_web_debug system setting # $startMS = microtime(); @@ -55,6 +56,14 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} +$NOW_DATE = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$STARTtime = date("U"); +if (!isset($query_date)) {$query_date = $NOW_DATE;} +if (!isset($end_date)) {$end_date = $NOW_DATE;} +if (!isset($campaign)) {$campaign = array();} +if (!isset($group)) {$group = array();} +if (!isset($user_group)) {$group = array();} if (strlen($shift)<2) {$shift='ALL';} if (strlen($role)<2) {$role='ALL';} if (strlen($order)<2) {$order='sales_down';} @@ -62,9 +71,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -72,10 +81,26 @@ if ($qm_conf_ct > 0) $non_latin = $row[0]; $SSenable_languages = $row[1]; $SSlanguage_method = $row[2]; + $SSallow_web_debug = $row[3]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$query_date = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$query_date); +$end_date = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$end_date); +$shift = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$shift); +$role = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$role); +$order = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$order); +$user = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$user); +$submit = preg_replace('/[^-_0-9a-zA-Z]/',"",$submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/',"",$SUBMIT); + +# Variables filtered further down in the code +# $campaign +# $user_group +# $group + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -83,18 +108,9 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$query_date = preg_replace("/'|\"|\\\\|;/","",$query_date); -$end_date = preg_replace("/'|\"|\\\\|;/","",$end_date); -$campaign = preg_replace("/'|\"|\\\\|;/","",$campaign); -$user_group = preg_replace("/'|\"|\\\\|;/","",$user_group); -$group = preg_replace("/'|\"|\\\\|;/","",$group); -$shift = preg_replace("/'|\"|\\\\|;/","",$shift); -$role = preg_replace("/'|\"|\\\\|;/","",$role); -$order = preg_replace("/'|\"|\\\\|;/","",$order); -$user = preg_replace("/'|\"|\\\\|;/","",$user); $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} @@ -203,24 +219,16 @@ else $webserver_id = mysqli_insert_id($link); } -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$campaign, $query_date, $end_date|', url='$LOGfull_url', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date|', url='$LOGfull_url', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); ##### END log visit to the vicidial_report_log table ##### -$NOW_DATE = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); -$STARTtime = date("U"); -if (!isset($campaign)) {$campaign = array();} -if (!isset($group)) {$group = array();} -if (!isset($user_group)) {$group = array();} $campaign_ct = count($campaign); $group_ct = count($group); $user_group_ct = count($user_group); -if (!isset($query_date)) {$query_date = $NOW_DATE;} -if (!isset($end_date)) {$end_date = $NOW_DATE;} $stmt="select campaign_id from vicidial_campaigns;"; $rslt=mysql_to_mysqli($stmt, $link); @@ -320,6 +328,7 @@ $user_group_string='|'; $i=0; while($i < $campaign_ct) { + $campaign[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign[$i]); $campaign_string .= "$campaign[$i]|"; $campaign_SQL .= "'$campaign[$i]',"; $i++; @@ -337,6 +346,7 @@ else $i=0; while($i < $group_ct) { + $group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $group[$i]); $group_string .= "$group[$i]|"; $group_SQL .= "'$group[$i]',"; $i++; @@ -355,6 +365,7 @@ else $i=0; while($i < $user_group_ct) { + $user_group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group[$i]); $user_group_string .= "$user_group[$i]|"; $user_group_SQL .= "'$user_group[$i]',"; $i++; diff --git a/agc_2-X/trunk/www/vicidial/web_form_forward.php b/agc_2-X/trunk/www/vicidial/web_form_forward.php index d00b9c09..623426f8 100644 --- a/agc_2-X/trunk/www/vicidial/web_form_forward.php +++ b/agc_2-X/trunk/www/vicidial/web_form_forward.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # You will need to customize this to your needs # @@ -10,15 +10,19 @@ # 90508-0644 - Changed to PHP long tags # 130902-0757 - Changed to mysqli PHP functions # 170527-0003 - Added variable filtering +# 220228-1107 - Added more variable filtering # if (isset($_GET["phone_number"])) {$phone_number=$_GET["phone_number"];} if (isset($_GET["source_id"])) {$source_id=$_GET["source_id"];} if (isset($_GET["user"])) {$user=$_GET["user"];} -$user=preg_replace("/\'|\"|\\\\|;| /","",$user); +$user = preg_replace("/\<|\>|\'|\"|\\\\|;| /", '', $user); +$source_id = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $source_id); +$phone_number = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $phone_number); require("dbconnect_mysqli.php"); +require("functions.php"); $stmt="SELECT full_name from vicidial_users where user='$user';"; $rslt=mysql_to_mysqli($stmt, $link); diff --git a/agc_2-X/trunk/www/vicidial/welcome.php b/agc_2-X/trunk/www/vicidial/welcome.php index 064d6ab3..3675c17d 100644 --- a/agc_2-X/trunk/www/vicidial/welcome.php +++ b/agc_2-X/trunk/www/vicidial/welcome.php @@ -1,11 +1,12 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGELOG: # 141007-2140 - Finalized adding QXZ translation to all admin files # 161106-1920 - Changed to use newer design and dynamic links +# 220228-1109 - Added allow_web_debug system setting # header ("Content-type: text/html; charset=utf-8"); @@ -22,10 +23,10 @@ if (file_exists('options.php')) ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,agent_screen_colors,admin_web_directory,agent_script FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,agent_screen_colors,admin_web_directory,agent_script,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'01001',$VD_login,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -37,7 +38,9 @@ if ($qm_conf_ct > 0) $agent_screen_colors = $row[4]; $admin_web_directory = $row[5]; $SSagent_script = $row[6]; + $SSallow_web_debug = $row[7]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ###########################################