ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Cleanup from input variable filter updates

Browse Source 
git-svn-id: svn://192.168.202.10@3580 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2022-03-04 05:38:26 +00:00
parent 33bab61ef4
commit 1cc1e47da3
19 changed files with 61 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/agc/vicidial.php
+16 -15
View File
@@ -687,10 +687,11 @@
# 220212-0813 - Added pause_max_url triggering
# 220217-1938 - Added agent_hide_hangup campaign feature
# 220219-0133 - Added allow_web_debug system setting
# 220303-2018 - Changes to some input variable filters
#
$version = '2.14-655c';
$build = '220219-0133';
$version = '2.14-656c';
$build = '220303-2018';
$php_script = 'vicidial.php';
$mel=1; # Mysql Error Log enabled = 1
$mysql_log_count=98;
@@ -764,18 +765,7 @@ if (!isset($flag_channels))
$flag_string='';
}
### security strip all non-alphanumeric characters out of the variables ###
$DB=preg_replace("/[^0-9a-z]/","",$DB);
$VD_login=preg_replace("/\'|\"|\\\\|;| /","",$VD_login);
$VD_pass=preg_replace("/\'|\"|\\\\|;| /","",$VD_pass);
$VD_language = preg_replace("/\'|\"|\\\\|;/","",$VD_language);
$set_pass=preg_replace("/\'|\"|\\\\|;| /","",$set_pass);
$new_pass1=preg_replace("/\'|\"|\\\\|;| /","",$new_pass1);
$new_pass2=preg_replace("/\'|\"|\\\\|;| /","",$new_pass2);
$JS_browser_width=preg_replace("/[^0-9a-z]/","",$JS_browser_width);
$JS_browser_height=preg_replace("/[^0-9a-z]/","",$JS_browser_height);
$relogin=preg_replace("/[^0-9a-zA-Z]/","",$relogin);
$MGR_override=preg_replace("/[^0-9a-zA-Z]/","",$MGR_override);
$forever_stop=0;
@@ -884,6 +874,17 @@ if ($sl_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$VD_login=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$VD_login);
$VD_pass=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$VD_pass);
$VD_language = preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$VD_language);
$set_pass=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$set_pass);
$new_pass1=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$new_pass1);
$new_pass2=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$new_pass2);
$JS_browser_width=preg_replace("/[^0-9a-z]/","",$JS_browser_width);
$JS_browser_height=preg_replace("/[^0-9a-z]/","",$JS_browser_height);
$relogin=preg_replace("/[^0-9a-zA-Z]/","",$relogin);
$MGR_override=preg_replace("/[^0-9a-zA-Z]/","",$MGR_override);
if ($non_latin < 1)
{
$VD_login=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_login);
@@ -1156,8 +1157,8 @@ if ($campaign_login_list > 0)
if (isset($_GET["MGR_pass$loginDATE"])) {$MGR_pass=$_GET["MGR_pass$loginDATE"];}
elseif (isset($_POST["MGR_pass$loginDATE"])) {$MGR_pass=$_POST["MGR_pass$loginDATE"];}
$MGR_login = preg_replace("/\'|\"|\\\\|;/","",$MGR_login);
$MGR_pass = preg_replace("/\'|\"|\\\\|;/","",$MGR_pass);
$MGR_login = preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$MGR_login);
$MGR_pass = preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$MGR_pass);
$MGR_auth=0;
$auth_message = user_authorization($MGR_login,$MGR_pass,'MGR',0,0,0,0,'vicidial_mgr_ovrd');
agc_2-X/trunk/www/vicidial/AST_API_log_report.php
+1 -1
View File
@@ -261,7 +261,7 @@ else
$webserver_id = mysqli_insert_id($link);
}
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php
+1 -1
View File
@@ -431,7 +431,7 @@ else
$AMP='&';
$QM='?';
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $DID, $EMAIL, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&DID=".$DID."&EMAIL=".$EMAIL."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';";
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $DID, $EMAIL, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&DID=".$DID."&EMAIL=".$EMAIL."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php
+1 -1
View File
@@ -511,7 +511,7 @@ else
$AMP='&';
$QM='?';
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $DID, $EMAIL, $CHAT, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&DID=".$DID."&EMAIL=".$EMAIL."&CHAT=".$CHAT."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."&camp_select=".$camp_select."$groupQS$campaignsQS', webserver='$webserver_id';";
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $DID, $EMAIL, $CHAT, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&DID=".$DID."&EMAIL=".$EMAIL."&CHAT=".$CHAT."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."&camp_select=".$camp_select."$groupQS$campaignsQS', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_DIDstats.php
+1 -1
View File
@@ -362,7 +362,7 @@ else
$AMP='&';
$QM='?';
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';";
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_DIDstats_v2.php
+1 -1
View File
@@ -324,7 +324,7 @@ else
$AMP='&';
$QM='?';
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';";
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_IVRstats.php
+5 -3
View File
@@ -149,18 +149,19 @@ $search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_da
$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
# Variables filtered further down in the code
# $group
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$group = preg_replace('/[^-_0-9a-zA-Z]/','',$group);
$shift = preg_replace('/[^-_0-9a-zA-Z]/', '', $shift);
}
else
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
$group = preg_replace('/[^-_0-9\p{L}]/u','',$group);
$shift = preg_replace('/[^-_0-9\p{L}]/u', '', $shift);
}
@@ -271,7 +272,7 @@ else
$webserver_id = mysqli_insert_id($link);
}
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link);
@@ -419,6 +420,7 @@ $group_string='|';
$group_ct = count($group);
while($i < $group_ct)
{
$group[$i] = preg_replace('/[^-_0-9\p{L}]/u','',$group[$i]);
$group_string .= "$group[$i]|";
$group_SQL .= "'$group[$i]',";
$groupQS .= "&group[]=$group[$i]";
agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php
+6 -3
View File
@@ -106,17 +106,18 @@ $report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type
$use_lists = preg_replace('/[^-_0-9a-zA-Z]/', '', $use_lists);
$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
# Variables filtered further down in the code
# $group
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$group = preg_replace('/[^-_0-9a-zA-Z]/','',$group);
}
else
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
$group = preg_replace('/[^-_0-9\p{L}]/u','',$group);
}
### ARCHIVED DATA CHECK CONFIGURATION
@@ -243,7 +244,7 @@ else
$webserver_id = mysqli_insert_id($link);
}
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link);
@@ -284,6 +285,7 @@ $group_string='|';
$group_ct = count($group);
while($i < $group_ct)
{
$group[$i] = preg_replace('/[^-_0-9\p{L}]/u','',$group[$i]);
$group_string .= "$group[$i]|";
$i++;
}
@@ -342,6 +344,7 @@ $group_string='|';
$group_ct = count($group);
while($i < $group_ct)
{
$group[$i] = preg_replace('/[^-_0-9\p{L}]/u','',$group[$i]);
if ( (preg_match("/ $group[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) )
{
$group_string .= "$group[$i]|";
agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php
+1 -1
View File
@@ -319,7 +319,7 @@ else
$AMP='&';
$QM='?';
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';";
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php
+1 -1
View File
@@ -264,7 +264,7 @@ else
$webserver_id = mysqli_insert_id($link);
}
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php
+1 -1
View File
@@ -197,7 +197,7 @@ else
$webserver_id = mysqli_insert_id($link);
}
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php
+1 -1
View File
@@ -353,7 +353,7 @@ else
$webserver_id = mysqli_insert_id($link);
}
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php
+1 -1
View File
@@ -253,7 +253,7 @@ else
$webserver_id = mysqli_insert_id($link);
}
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/admin.php
+5
View File
@@ -17401,6 +17401,10 @@ if ($ADD==49)
if (isset($_GET[$Fvcl_name])) {$vcl_name=$_GET[$Fvcl_name];}
elseif (isset($_POST[$Fvcl_name])) {$vcl_name=$_POST[$Fvcl_name];}
$list_mix_container = preg_replace("/:$/","",$list_mix_container);
$list_mix_container = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $list_mix_container);
$mix_method = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $mix_method);
$status = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $status);
$vcl_name = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $vcl_name);
if ( (strlen($campaign_id) < 2) or (strlen($vcl_id) < 1) or (strlen($list_mix_container) < 6) or (strlen($vcl_name) < 2) )
{
@@ -19475,6 +19479,7 @@ if ($ADD==461111111111)
$Ffilename = $mohfiles[$o];
if (isset($_GET[$Ffilename])) {$new_rank=$_GET[$Ffilename];}
elseif (isset($_POST[$Ffilename])) {$new_rank=$_POST[$Ffilename];}
$new_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_rank);
$stmt="UPDATE vicidial_music_on_hold_files set rank='$new_rank' where moh_id='$moh_id' and filename='$mohfiles[$o]';";
$rslt=mysql_to_mysqli($stmt, $link);
agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php
+2
View File
@@ -263,6 +263,8 @@ if ($action == "ALT_MULTI_SUBMIT")
elseif (isset($_POST["$campaign_id$US$owner"])) {$owner_check=$_POST["$campaign_id$US$owner"];}
if (isset($_GET["rank_$campaign_id$US$owner"])) {$owner_rank=$_GET["rank_$campaign_id$US$owner"];}
elseif (isset($_POST["rank_$campaign_id$US$owner"])) {$owner_rank=$_POST["rank_$campaign_id$US$owner"];}
$owner_check = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$owner_check);
$owner_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$owner_rank);
if ($owner_check=='YES')
{$new_filter_sql .= "'$owner_raw',";}
agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php
+1
View File
@@ -1261,6 +1261,7 @@ if ($OK_to_process)
{
if (isset($_GET["$field_name_id"])) {$form_field_value=$_GET["$field_name_id"];}
elseif (isset($_POST["$field_name_id"])) {$form_field_value=$_POST["$field_name_id"];}
$form_field_value = preg_replace("/\<|\>|\"|\\\\|;/","",$form_field_value);
if ($form_field_value >= 0)
{
agc_2-X/trunk/www/vicidial/admin_modify_lead.php
+2 -2
View File
@@ -396,8 +396,8 @@ if ($non_latin < 1)
}
else
{
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
$user=preg_replace('/[^-_0-9\p{L}]/u','',$user);
$pass=preg_replace('/[^-_0-9\p{L}]/u','',$pass);
$function = preg_replace('/[^-\_0-9\p{L}]/u', '',$function);
agc_2-X/trunk/www/vicidial/admin_soundboard.php
+11 -3
View File
@@ -819,13 +819,13 @@ if ($ADD==462111111111)
$HORDfilename = '--HORD--' . $avatarfiles[$o] . '--' . $avatarlevel[$o] . '--' . $avatarranks[$o] . '--' . $avatarparent[$o];
$TYPEfilename = '--TYPE--' . $avatarfiles[$o] . '--' . $avatarlevel[$o] . '--' . $avatarranks[$o] . '--' . $avatarparent[$o];
$FONTfilename = '--FONT--' . $avatarfiles[$o] . '--' . $avatarlevel[$o] . '--' . $avatarranks[$o] . '--' . $avatarparent[$o];
if (isset($_GET["$Ffilename"])) {$new_rank=$_GET["$Ffilename"];}
if (isset($_GET["$Ffilename"])) {$new_rank=$_GET["$Ffilename"];}
elseif (isset($_POST["$Ffilename"])) {$new_rank=$_POST["$Ffilename"];}
if (isset($_GET["$NAMEfilename"])) {$new_name=$_GET["$NAMEfilename"];}
elseif (isset($_POST["$NAMEfilename"])) {$new_name=$_POST["$NAMEfilename"];}
if (isset($_GET["$LEVELfilename"])) {$new_level=$_GET["$LEVELfilename"];}
if (isset($_GET["$LEVELfilename"])) {$new_level=$_GET["$LEVELfilename"];}
elseif (isset($_POST["$LEVELfilename"])) {$new_level=$_POST["$LEVELfilename"];}
if (isset($_GET["$OLDRANKfilename"])) {$old_rank=$_GET["$OLDRANKfilename"];}
if (isset($_GET["$OLDRANKfilename"])) {$old_rank=$_GET["$OLDRANKfilename"];}
elseif (isset($_POST["$OLDRANKfilename"])) {$old_rank=$_POST["$OLDRANKfilename"];}
if (isset($_GET["$HORDfilename"])) {$new_h_ord=$_GET["$HORDfilename"];}
elseif (isset($_POST["$HORDfilename"])) {$new_h_ord=$_POST["$HORDfilename"];}
@@ -834,6 +834,14 @@ if ($ADD==462111111111)
if (isset($_GET["$FONTfilename"])) {$new_font_size=$_GET["$FONTfilename"];}
elseif (isset($_POST["$FONTfilename"])) {$new_font_size=$_POST["$FONTfilename"];}
$new_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_rank);
$new_name = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_name);
$new_level = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_level);
$old_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$old_rank);
$new_h_ord = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_h_ord);
$new_button_type = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_button_type);
$new_font_size = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_font_size);
if ($DB)
{
echo "update variable debug: ($avatarfiles[$o])\n";
agc_2-X/trunk/www/vicidial/admin_user_list_new.php
+3
View File
@@ -383,6 +383,7 @@ else
}
if (isset($_GET["$Ruser$US$Rlist_id[$o]"])) {$Ruser_overrideNEW=$_GET["$Ruser$US$Rlist_id[$o]"];}
elseif (isset($_POST["$Ruser$US$Rlist_id[$o]"])) {$Ruser_overrideNEW=$_POST["$Ruser$US$Rlist_id[$o]"];}
$Ruser_overrideNEW = preg_replace('/[^-_0-9\p{L}]/u', '', $Ruser_overrideNEW);
if ( ($Ruser_overrideNEW == $Ruser_override) or (strlen($Ruser_overrideNEW) < 1) )
{
$vulnl_nochng++;
@@ -534,6 +535,7 @@ if ( ($list_id != '---ALL---') and ($list_id != 'NONE') )
}
if (isset($_GET["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_GET["$Ruser[$o]$US$Rlist_id"];}
elseif (isset($_POST["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_POST["$Ruser[$o]$US$Rlist_id"];}
$Ruser_overrideNEW = preg_replace('/[^-_0-9\p{L}]/u', '', $Ruser_overrideNEW);
if ( ($Ruser_overrideNEW == $Ruser_override) or (strlen($Ruser_overrideNEW) < 1) )
{
$vulnl_nochng++;
@@ -672,6 +674,7 @@ if ($list_id == 'NONE')
}
if (isset($_GET["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_GET["$Ruser[$o]$US$Rlist_id"];}
elseif (isset($_POST["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_POST["$Ruser[$o]$US$Rlist_id"];}
$Ruser_overrideNEW = preg_replace('/[^-_0-9\p{L}]/u', '', $Ruser_overrideNEW);
if ( ($Ruser_overrideNEW == $Ruser_override) or (strlen($Ruser_overrideNEW) < 1) )
{
$vulnl_nochng++;