From 1cc1e47da369331f7207a571b36d2e37fb989a8b Mon Sep 17 00:00:00 2001 From: mattf Date: Fri, 4 Mar 2022 05:38:26 +0000 Subject: [PATCH] Cleanup from input variable filter updates git-svn-id: svn://192.168.202.10@3580 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/trunk/www/agc/vicidial.php | 31 ++++++++++--------- .../trunk/www/vicidial/AST_API_log_report.php | 2 +- .../trunk/www/vicidial/AST_CLOSERstats.php | 2 +- .../trunk/www/vicidial/AST_CLOSERstats_v2.php | 2 +- agc_2-X/trunk/www/vicidial/AST_DIDstats.php | 2 +- .../trunk/www/vicidial/AST_DIDstats_v2.php | 2 +- agc_2-X/trunk/www/vicidial/AST_IVRstats.php | 8 +++-- .../www/vicidial/AST_LISTS_pass_report.php | 9 ++++-- .../trunk/www/vicidial/AST_agentDIDstats.php | 2 +- .../www/vicidial/AST_agent_days_detail.php | 2 +- .../vicidial/AST_agent_time_sheet_archive.php | 2 +- .../www/vicidial/AST_inbound_forecasting.php | 2 +- .../vicidial/AST_user_group_hourly_detail.php | 2 +- agc_2-X/trunk/www/vicidial/admin.php | 5 +++ .../www/vicidial/admin_campaign_multi_alt.php | 2 ++ .../vicidial/admin_listloader_fourth_gen.php | 1 + .../trunk/www/vicidial/admin_modify_lead.php | 4 +-- .../trunk/www/vicidial/admin_soundboard.php | 14 +++++++-- .../www/vicidial/admin_user_list_new.php | 3 ++ 19 files changed, 61 insertions(+), 36 deletions(-) diff --git a/agc_2-X/trunk/www/agc/vicidial.php b/agc_2-X/trunk/www/agc/vicidial.php index e8d4a0c2..176ea904 100644 --- a/agc_2-X/trunk/www/agc/vicidial.php +++ b/agc_2-X/trunk/www/agc/vicidial.php @@ -687,10 +687,11 @@ # 220212-0813 - Added pause_max_url triggering # 220217-1938 - Added agent_hide_hangup campaign feature # 220219-0133 - Added allow_web_debug system setting +# 220303-2018 - Changes to some input variable filters # -$version = '2.14-655c'; -$build = '220219-0133'; +$version = '2.14-656c'; +$build = '220303-2018'; $php_script = 'vicidial.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=98; @@ -764,18 +765,7 @@ if (!isset($flag_channels)) $flag_string=''; } -### security strip all non-alphanumeric characters out of the variables ### $DB=preg_replace("/[^0-9a-z]/","",$DB); -$VD_login=preg_replace("/\'|\"|\\\\|;| /","",$VD_login); -$VD_pass=preg_replace("/\'|\"|\\\\|;| /","",$VD_pass); -$VD_language = preg_replace("/\'|\"|\\\\|;/","",$VD_language); -$set_pass=preg_replace("/\'|\"|\\\\|;| /","",$set_pass); -$new_pass1=preg_replace("/\'|\"|\\\\|;| /","",$new_pass1); -$new_pass2=preg_replace("/\'|\"|\\\\|;| /","",$new_pass2); -$JS_browser_width=preg_replace("/[^0-9a-z]/","",$JS_browser_width); -$JS_browser_height=preg_replace("/[^0-9a-z]/","",$JS_browser_height); -$relogin=preg_replace("/[^0-9a-zA-Z]/","",$relogin); -$MGR_override=preg_replace("/[^0-9a-zA-Z]/","",$MGR_override); $forever_stop=0; @@ -884,6 +874,17 @@ if ($sl_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### +$VD_login=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$VD_login); +$VD_pass=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$VD_pass); +$VD_language = preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$VD_language); +$set_pass=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$set_pass); +$new_pass1=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$new_pass1); +$new_pass2=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$new_pass2); +$JS_browser_width=preg_replace("/[^0-9a-z]/","",$JS_browser_width); +$JS_browser_height=preg_replace("/[^0-9a-z]/","",$JS_browser_height); +$relogin=preg_replace("/[^0-9a-zA-Z]/","",$relogin); +$MGR_override=preg_replace("/[^0-9a-zA-Z]/","",$MGR_override); + if ($non_latin < 1) { $VD_login=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_login); @@ -1156,8 +1157,8 @@ if ($campaign_login_list > 0) if (isset($_GET["MGR_pass$loginDATE"])) {$MGR_pass=$_GET["MGR_pass$loginDATE"];} elseif (isset($_POST["MGR_pass$loginDATE"])) {$MGR_pass=$_POST["MGR_pass$loginDATE"];} - $MGR_login = preg_replace("/\'|\"|\\\\|;/","",$MGR_login); - $MGR_pass = preg_replace("/\'|\"|\\\\|;/","",$MGR_pass); + $MGR_login = preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$MGR_login); + $MGR_pass = preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$MGR_pass); $MGR_auth=0; $auth_message = user_authorization($MGR_login,$MGR_pass,'MGR',0,0,0,0,'vicidial_mgr_ovrd'); diff --git a/agc_2-X/trunk/www/vicidial/AST_API_log_report.php b/agc_2-X/trunk/www/vicidial/AST_API_log_report.php index 8ada1c75..5185f446 100644 --- a/agc_2-X/trunk/www/vicidial/AST_API_log_report.php +++ b/agc_2-X/trunk/www/vicidial/AST_API_log_report.php @@ -261,7 +261,7 @@ else $webserver_id = mysqli_insert_id($link); } -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); diff --git a/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php b/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php index 1785bf40..4afda011 100644 --- a/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php +++ b/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php @@ -431,7 +431,7 @@ else $AMP='&'; $QM='?'; -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $DID, $EMAIL, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&DID=".$DID."&EMAIL=".$EMAIL."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $DID, $EMAIL, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&DID=".$DID."&EMAIL=".$EMAIL."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); diff --git a/agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php b/agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php index 0a7cb295..d6ba6dc2 100644 --- a/agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php +++ b/agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php @@ -511,7 +511,7 @@ else $AMP='&'; $QM='?'; -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $DID, $EMAIL, $CHAT, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&DID=".$DID."&EMAIL=".$EMAIL."&CHAT=".$CHAT."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."&camp_select=".$camp_select."$groupQS$campaignsQS', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $DID, $EMAIL, $CHAT, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&DID=".$DID."&EMAIL=".$EMAIL."&CHAT=".$CHAT."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."&camp_select=".$camp_select."$groupQS$campaignsQS', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); diff --git a/agc_2-X/trunk/www/vicidial/AST_DIDstats.php b/agc_2-X/trunk/www/vicidial/AST_DIDstats.php index 2b424929..40abdb39 100644 --- a/agc_2-X/trunk/www/vicidial/AST_DIDstats.php +++ b/agc_2-X/trunk/www/vicidial/AST_DIDstats.php @@ -362,7 +362,7 @@ else $AMP='&'; $QM='?'; -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); diff --git a/agc_2-X/trunk/www/vicidial/AST_DIDstats_v2.php b/agc_2-X/trunk/www/vicidial/AST_DIDstats_v2.php index 2abd528d..1419fd62 100644 --- a/agc_2-X/trunk/www/vicidial/AST_DIDstats_v2.php +++ b/agc_2-X/trunk/www/vicidial/AST_DIDstats_v2.php @@ -324,7 +324,7 @@ else $AMP='&'; $QM='?'; -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); diff --git a/agc_2-X/trunk/www/vicidial/AST_IVRstats.php b/agc_2-X/trunk/www/vicidial/AST_IVRstats.php index 01339dd6..dec4b364 100644 --- a/agc_2-X/trunk/www/vicidial/AST_IVRstats.php +++ b/agc_2-X/trunk/www/vicidial/AST_IVRstats.php @@ -149,18 +149,19 @@ $search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_da $submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); $SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); +# Variables filtered further down in the code +# $group + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); - $group = preg_replace('/[^-_0-9a-zA-Z]/','',$group); $shift = preg_replace('/[^-_0-9a-zA-Z]/', '', $shift); } else { $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); - $group = preg_replace('/[^-_0-9\p{L}]/u','',$group); $shift = preg_replace('/[^-_0-9\p{L}]/u', '', $shift); } @@ -271,7 +272,7 @@ else $webserver_id = mysqli_insert_id($link); } -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); @@ -419,6 +420,7 @@ $group_string='|'; $group_ct = count($group); while($i < $group_ct) { + $group[$i] = preg_replace('/[^-_0-9\p{L}]/u','',$group[$i]); $group_string .= "$group[$i]|"; $group_SQL .= "'$group[$i]',"; $groupQS .= "&group[]=$group[$i]"; diff --git a/agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php b/agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php index 41d1d2fd..c2cb15dc 100644 --- a/agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php +++ b/agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php @@ -106,17 +106,18 @@ $report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type $use_lists = preg_replace('/[^-_0-9a-zA-Z]/', '', $use_lists); $search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data); +# Variables filtered further down in the code +# $group + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); - $group = preg_replace('/[^-_0-9a-zA-Z]/','',$group); } else { $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); - $group = preg_replace('/[^-_0-9\p{L}]/u','',$group); } ### ARCHIVED DATA CHECK CONFIGURATION @@ -243,7 +244,7 @@ else $webserver_id = mysqli_insert_id($link); } -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); @@ -284,6 +285,7 @@ $group_string='|'; $group_ct = count($group); while($i < $group_ct) { + $group[$i] = preg_replace('/[^-_0-9\p{L}]/u','',$group[$i]); $group_string .= "$group[$i]|"; $i++; } @@ -342,6 +344,7 @@ $group_string='|'; $group_ct = count($group); while($i < $group_ct) { + $group[$i] = preg_replace('/[^-_0-9\p{L}]/u','',$group[$i]); if ( (preg_match("/ $group[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) ) { $group_string .= "$group[$i]|"; diff --git a/agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php b/agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php index 8b9834d4..65cf5b1f 100644 --- a/agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php +++ b/agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php @@ -319,7 +319,7 @@ else $AMP='&'; $QM='?'; -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php b/agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php index 55ea7221..b599c562 100644 --- a/agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php +++ b/agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php @@ -264,7 +264,7 @@ else $webserver_id = mysqli_insert_id($link); } -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php b/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php index 78ed81c4..3cf2ae41 100644 --- a/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php +++ b/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php @@ -197,7 +197,7 @@ else $webserver_id = mysqli_insert_id($link); } -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); diff --git a/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php b/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php index fc1d124d..b0a56ffc 100644 --- a/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php +++ b/agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php @@ -353,7 +353,7 @@ else $webserver_id = mysqli_insert_id($link); } -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); diff --git a/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php b/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php index 8dc34056..205b6de4 100644 --- a/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php +++ b/agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php @@ -253,7 +253,7 @@ else $webserver_id = mysqli_insert_id($link); } -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); diff --git a/agc_2-X/trunk/www/vicidial/admin.php b/agc_2-X/trunk/www/vicidial/admin.php index d016df85..5dfcf14c 100644 --- a/agc_2-X/trunk/www/vicidial/admin.php +++ b/agc_2-X/trunk/www/vicidial/admin.php @@ -17401,6 +17401,10 @@ if ($ADD==49) if (isset($_GET[$Fvcl_name])) {$vcl_name=$_GET[$Fvcl_name];} elseif (isset($_POST[$Fvcl_name])) {$vcl_name=$_POST[$Fvcl_name];} $list_mix_container = preg_replace("/:$/","",$list_mix_container); + $list_mix_container = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $list_mix_container); + $mix_method = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $mix_method); + $status = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $status); + $vcl_name = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $vcl_name); if ( (strlen($campaign_id) < 2) or (strlen($vcl_id) < 1) or (strlen($list_mix_container) < 6) or (strlen($vcl_name) < 2) ) { @@ -19475,6 +19479,7 @@ if ($ADD==461111111111) $Ffilename = $mohfiles[$o]; if (isset($_GET[$Ffilename])) {$new_rank=$_GET[$Ffilename];} elseif (isset($_POST[$Ffilename])) {$new_rank=$_POST[$Ffilename];} + $new_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_rank); $stmt="UPDATE vicidial_music_on_hold_files set rank='$new_rank' where moh_id='$moh_id' and filename='$mohfiles[$o]';"; $rslt=mysql_to_mysqli($stmt, $link); diff --git a/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php b/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php index 179eb094..ef4ca15f 100644 --- a/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php +++ b/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php @@ -263,6 +263,8 @@ if ($action == "ALT_MULTI_SUBMIT") elseif (isset($_POST["$campaign_id$US$owner"])) {$owner_check=$_POST["$campaign_id$US$owner"];} if (isset($_GET["rank_$campaign_id$US$owner"])) {$owner_rank=$_GET["rank_$campaign_id$US$owner"];} elseif (isset($_POST["rank_$campaign_id$US$owner"])) {$owner_rank=$_POST["rank_$campaign_id$US$owner"];} + $owner_check = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$owner_check); + $owner_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$owner_rank); if ($owner_check=='YES') {$new_filter_sql .= "'$owner_raw',";} diff --git a/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php b/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php index c2cb06da..b97f5cfb 100644 --- a/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php +++ b/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php @@ -1261,6 +1261,7 @@ if ($OK_to_process) { if (isset($_GET["$field_name_id"])) {$form_field_value=$_GET["$field_name_id"];} elseif (isset($_POST["$field_name_id"])) {$form_field_value=$_POST["$field_name_id"];} + $form_field_value = preg_replace("/\<|\>|\"|\\\\|;/","",$form_field_value); if ($form_field_value >= 0) { diff --git a/agc_2-X/trunk/www/vicidial/admin_modify_lead.php b/agc_2-X/trunk/www/vicidial/admin_modify_lead.php index f0545b9f..ed5b5e39 100644 --- a/agc_2-X/trunk/www/vicidial/admin_modify_lead.php +++ b/agc_2-X/trunk/www/vicidial/admin_modify_lead.php @@ -396,8 +396,8 @@ if ($non_latin < 1) } else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); $user=preg_replace('/[^-_0-9\p{L}]/u','',$user); $pass=preg_replace('/[^-_0-9\p{L}]/u','',$pass); $function = preg_replace('/[^-\_0-9\p{L}]/u', '',$function); diff --git a/agc_2-X/trunk/www/vicidial/admin_soundboard.php b/agc_2-X/trunk/www/vicidial/admin_soundboard.php index 4df4d150..7b3b0cfb 100644 --- a/agc_2-X/trunk/www/vicidial/admin_soundboard.php +++ b/agc_2-X/trunk/www/vicidial/admin_soundboard.php @@ -819,13 +819,13 @@ if ($ADD==462111111111) $HORDfilename = '--HORD--' . $avatarfiles[$o] . '--' . $avatarlevel[$o] . '--' . $avatarranks[$o] . '--' . $avatarparent[$o]; $TYPEfilename = '--TYPE--' . $avatarfiles[$o] . '--' . $avatarlevel[$o] . '--' . $avatarranks[$o] . '--' . $avatarparent[$o]; $FONTfilename = '--FONT--' . $avatarfiles[$o] . '--' . $avatarlevel[$o] . '--' . $avatarranks[$o] . '--' . $avatarparent[$o]; - if (isset($_GET["$Ffilename"])) {$new_rank=$_GET["$Ffilename"];} + if (isset($_GET["$Ffilename"])) {$new_rank=$_GET["$Ffilename"];} elseif (isset($_POST["$Ffilename"])) {$new_rank=$_POST["$Ffilename"];} if (isset($_GET["$NAMEfilename"])) {$new_name=$_GET["$NAMEfilename"];} elseif (isset($_POST["$NAMEfilename"])) {$new_name=$_POST["$NAMEfilename"];} - if (isset($_GET["$LEVELfilename"])) {$new_level=$_GET["$LEVELfilename"];} + if (isset($_GET["$LEVELfilename"])) {$new_level=$_GET["$LEVELfilename"];} elseif (isset($_POST["$LEVELfilename"])) {$new_level=$_POST["$LEVELfilename"];} - if (isset($_GET["$OLDRANKfilename"])) {$old_rank=$_GET["$OLDRANKfilename"];} + if (isset($_GET["$OLDRANKfilename"])) {$old_rank=$_GET["$OLDRANKfilename"];} elseif (isset($_POST["$OLDRANKfilename"])) {$old_rank=$_POST["$OLDRANKfilename"];} if (isset($_GET["$HORDfilename"])) {$new_h_ord=$_GET["$HORDfilename"];} elseif (isset($_POST["$HORDfilename"])) {$new_h_ord=$_POST["$HORDfilename"];} @@ -834,6 +834,14 @@ if ($ADD==462111111111) if (isset($_GET["$FONTfilename"])) {$new_font_size=$_GET["$FONTfilename"];} elseif (isset($_POST["$FONTfilename"])) {$new_font_size=$_POST["$FONTfilename"];} + $new_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_rank); + $new_name = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_name); + $new_level = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_level); + $old_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$old_rank); + $new_h_ord = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_h_ord); + $new_button_type = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_button_type); + $new_font_size = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_font_size); + if ($DB) { echo "update variable debug: ($avatarfiles[$o])\n"; diff --git a/agc_2-X/trunk/www/vicidial/admin_user_list_new.php b/agc_2-X/trunk/www/vicidial/admin_user_list_new.php index 89ee75fe..5a48c226 100644 --- a/agc_2-X/trunk/www/vicidial/admin_user_list_new.php +++ b/agc_2-X/trunk/www/vicidial/admin_user_list_new.php @@ -383,6 +383,7 @@ else } if (isset($_GET["$Ruser$US$Rlist_id[$o]"])) {$Ruser_overrideNEW=$_GET["$Ruser$US$Rlist_id[$o]"];} elseif (isset($_POST["$Ruser$US$Rlist_id[$o]"])) {$Ruser_overrideNEW=$_POST["$Ruser$US$Rlist_id[$o]"];} + $Ruser_overrideNEW = preg_replace('/[^-_0-9\p{L}]/u', '', $Ruser_overrideNEW); if ( ($Ruser_overrideNEW == $Ruser_override) or (strlen($Ruser_overrideNEW) < 1) ) { $vulnl_nochng++; @@ -534,6 +535,7 @@ if ( ($list_id != '---ALL---') and ($list_id != 'NONE') ) } if (isset($_GET["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_GET["$Ruser[$o]$US$Rlist_id"];} elseif (isset($_POST["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_POST["$Ruser[$o]$US$Rlist_id"];} + $Ruser_overrideNEW = preg_replace('/[^-_0-9\p{L}]/u', '', $Ruser_overrideNEW); if ( ($Ruser_overrideNEW == $Ruser_override) or (strlen($Ruser_overrideNEW) < 1) ) { $vulnl_nochng++; @@ -672,6 +674,7 @@ if ($list_id == 'NONE') } if (isset($_GET["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_GET["$Ruser[$o]$US$Rlist_id"];} elseif (isset($_POST["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_POST["$Ruser[$o]$US$Rlist_id"];} + $Ruser_overrideNEW = preg_replace('/[^-_0-9\p{L}]/u', '', $Ruser_overrideNEW); if ( ($Ruser_overrideNEW == $Ruser_override) or (strlen($Ruser_overrideNEW) < 1) ) { $vulnl_nochng++;