ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Cleanup from input variable filter updates

Browse Source 
git-svn-id: svn://192.168.202.10@3580 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2022-03-04 05:38:26 +00:00
parent 33bab61ef4
commit 1cc1e47da3
19 changed files with 61 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/agc/vicidial.php
+16 -15
View File
@@ -687,10 +687,11 @@
# 220212-0813 - Added pause_max_url triggering # 220212-0813 - Added pause_max_url triggering
# 220217-1938 - Added agent_hide_hangup campaign feature # 220217-1938 - Added agent_hide_hangup campaign feature
# 220219-0133 - Added allow_web_debug system setting # 220219-0133 - Added allow_web_debug system setting
# 220303-2018 - Changes to some input variable filters
# #
$version = '2.14-655c'; $version = '2.14-656c';
$build = '220219-0133'; $build = '220303-2018';
$php_script = 'vicidial.php'; $php_script = 'vicidial.php';
$mel=1; # Mysql Error Log enabled = 1 $mel=1; # Mysql Error Log enabled = 1
$mysql_log_count=98; $mysql_log_count=98;
@@ -764,18 +765,7 @@ if (!isset($flag_channels))
$flag_string=''; $flag_string='';
} }
### security strip all non-alphanumeric characters out of the variables ###
$DB=preg_replace("/[^0-9a-z]/","",$DB); $DB=preg_replace("/[^0-9a-z]/","",$DB);
$VD_login=preg_replace("/\'|\"|\\\\|;| /","",$VD_login);
$VD_pass=preg_replace("/\'|\"|\\\\|;| /","",$VD_pass);
$VD_language = preg_replace("/\'|\"|\\\\|;/","",$VD_language);
$set_pass=preg_replace("/\'|\"|\\\\|;| /","",$set_pass);
$new_pass1=preg_replace("/\'|\"|\\\\|;| /","",$new_pass1);
$new_pass2=preg_replace("/\'|\"|\\\\|;| /","",$new_pass2);
$JS_browser_width=preg_replace("/[^0-9a-z]/","",$JS_browser_width);
$JS_browser_height=preg_replace("/[^0-9a-z]/","",$JS_browser_height);
$relogin=preg_replace("/[^0-9a-zA-Z]/","",$relogin);
$MGR_override=preg_replace("/[^0-9a-zA-Z]/","",$MGR_override);
$forever_stop=0; $forever_stop=0;
@@ -884,6 +874,17 @@ if ($sl_ct > 0)
##### END SETTINGS LOOKUP ##### ##### END SETTINGS LOOKUP #####
########################################### ###########################################
$VD_login=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$VD_login);
$VD_pass=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$VD_pass);
$VD_language = preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$VD_language);
$set_pass=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$set_pass);
$new_pass1=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$new_pass1);
$new_pass2=preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$new_pass2);
$JS_browser_width=preg_replace("/[^0-9a-z]/","",$JS_browser_width);
$JS_browser_height=preg_replace("/[^0-9a-z]/","",$JS_browser_height);
$relogin=preg_replace("/[^0-9a-zA-Z]/","",$relogin);
$MGR_override=preg_replace("/[^0-9a-zA-Z]/","",$MGR_override);
if ($non_latin < 1) if ($non_latin < 1)
{ {
$VD_login=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_login); $VD_login=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_login);
@@ -1156,8 +1157,8 @@ if ($campaign_login_list > 0)
if (isset($_GET["MGR_pass$loginDATE"])) {$MGR_pass=$_GET["MGR_pass$loginDATE"];} if (isset($_GET["MGR_pass$loginDATE"])) {$MGR_pass=$_GET["MGR_pass$loginDATE"];}
elseif (isset($_POST["MGR_pass$loginDATE"])) {$MGR_pass=$_POST["MGR_pass$loginDATE"];} elseif (isset($_POST["MGR_pass$loginDATE"])) {$MGR_pass=$_POST["MGR_pass$loginDATE"];}
$MGR_login = preg_replace("/\'|\"|\\\\|;/","",$MGR_login); $MGR_login = preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$MGR_login);
$MGR_pass = preg_replace("/\'|\"|\\\\|;/","",$MGR_pass); $MGR_pass = preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$MGR_pass);
$MGR_auth=0; $MGR_auth=0;
$auth_message = user_authorization($MGR_login,$MGR_pass,'MGR',0,0,0,0,'vicidial_mgr_ovrd'); $auth_message = user_authorization($MGR_login,$MGR_pass,'MGR',0,0,0,0,'vicidial_mgr_ovrd');
agc_2-X/trunk/www/vicidial/AST_API_log_report.php
+1 -1
View File
@@ -261,7 +261,7 @@ else
$webserver_id = mysqli_insert_id($link); $webserver_id = mysqli_insert_id($link);
} }
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; $stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";} if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link); $rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link); $report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php
+1 -1
View File
@@ -431,7 +431,7 @@ else
$AMP='&'; $AMP='&';
$QM='?'; $QM='?';
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $DID, $EMAIL, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&DID=".$DID."&EMAIL=".$EMAIL."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';"; $stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $DID, $EMAIL, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&DID=".$DID."&EMAIL=".$EMAIL."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";} if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link); $rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link); $report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php
+1 -1
View File
@@ -511,7 +511,7 @@ else
$AMP='&'; $AMP='&';
$QM='?'; $QM='?';
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $DID, $EMAIL, $CHAT, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&DID=".$DID."&EMAIL=".$EMAIL."&CHAT=".$CHAT."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."&camp_select=".$camp_select."$groupQS$campaignsQS', webserver='$webserver_id';"; $stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $DID, $EMAIL, $CHAT, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&DID=".$DID."&EMAIL=".$EMAIL."&CHAT=".$CHAT."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."&camp_select=".$camp_select."$groupQS$campaignsQS', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";} if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link); $rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link); $report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_DIDstats.php
+1 -1
View File
@@ -362,7 +362,7 @@ else
$AMP='&'; $AMP='&';
$QM='?'; $QM='?';
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';"; $stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";} if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link); $rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link); $report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_DIDstats_v2.php
+1 -1
View File
@@ -324,7 +324,7 @@ else
$AMP='&'; $AMP='&';
$QM='?'; $QM='?';
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';"; $stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";} if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link); $rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link); $report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_IVRstats.php
+5 -3
View File
@@ -149,18 +149,19 @@ $search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_da
$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); $submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); $SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
# Variables filtered further down in the code
# $group
if ($non_latin < 1) if ($non_latin < 1)
{ {
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$group = preg_replace('/[^-_0-9a-zA-Z]/','',$group);
$shift = preg_replace('/[^-_0-9a-zA-Z]/', '', $shift); $shift = preg_replace('/[^-_0-9a-zA-Z]/', '', $shift);
} }
else else
{ {
$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
$group = preg_replace('/[^-_0-9\p{L}]/u','',$group);
$shift = preg_replace('/[^-_0-9\p{L}]/u', '', $shift); $shift = preg_replace('/[^-_0-9\p{L}]/u', '', $shift);
} }
@@ -271,7 +272,7 @@ else
$webserver_id = mysqli_insert_id($link); $webserver_id = mysqli_insert_id($link);
} }
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; $stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";} if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link); $rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link); $report_log_id = mysqli_insert_id($link);
@@ -419,6 +420,7 @@ $group_string='|';
$group_ct = count($group); $group_ct = count($group);
while($i < $group_ct) while($i < $group_ct)
{ {
$group[$i] = preg_replace('/[^-_0-9\p{L}]/u','',$group[$i]);
$group_string .= "$group[$i]|"; $group_string .= "$group[$i]|";
$group_SQL .= "'$group[$i]',"; $group_SQL .= "'$group[$i]',";
$groupQS .= "&group[]=$group[$i]"; $groupQS .= "&group[]=$group[$i]";
agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php
+6 -3
View File
@@ -106,17 +106,18 @@ $report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type
$use_lists = preg_replace('/[^-_0-9a-zA-Z]/', '', $use_lists); $use_lists = preg_replace('/[^-_0-9a-zA-Z]/', '', $use_lists);
$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data); $search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
# Variables filtered further down in the code
# $group
if ($non_latin < 1) if ($non_latin < 1)
{ {
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$group = preg_replace('/[^-_0-9a-zA-Z]/','',$group);
} }
else else
{ {
$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
$group = preg_replace('/[^-_0-9\p{L}]/u','',$group);
} }
### ARCHIVED DATA CHECK CONFIGURATION ### ARCHIVED DATA CHECK CONFIGURATION
@@ -243,7 +244,7 @@ else
$webserver_id = mysqli_insert_id($link); $webserver_id = mysqli_insert_id($link);
} }
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; $stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";} if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link); $rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link); $report_log_id = mysqli_insert_id($link);
@@ -284,6 +285,7 @@ $group_string='|';
$group_ct = count($group); $group_ct = count($group);
while($i < $group_ct) while($i < $group_ct)
{ {
$group[$i] = preg_replace('/[^-_0-9\p{L}]/u','',$group[$i]);
$group_string .= "$group[$i]|"; $group_string .= "$group[$i]|";
$i++; $i++;
} }
@@ -342,6 +344,7 @@ $group_string='|';
$group_ct = count($group); $group_ct = count($group);
while($i < $group_ct) while($i < $group_ct)
{ {
$group[$i] = preg_replace('/[^-_0-9\p{L}]/u','',$group[$i]);
if ( (preg_match("/ $group[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) ) if ( (preg_match("/ $group[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) )
{ {
$group_string .= "$group[$i]|"; $group_string .= "$group[$i]|";
agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php
+1 -1
View File
@@ -319,7 +319,7 @@ else
$AMP='&'; $AMP='&';
$QM='?'; $QM='?';
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';"; $stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='".$LOGfull_url."?DB=".$DB."&file_download=".$file_download."&query_date=".$query_date."&end_date=".$end_date."&shift=".$shift."&report_display_type=".$report_display_type."$groupQS', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";} if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link); $rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link); $report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php
+1 -1
View File
@@ -264,7 +264,7 @@ else
$webserver_id = mysqli_insert_id($link); $webserver_id = mysqli_insert_id($link);
} }
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; $stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";} if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link); $rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link); $report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php
+1 -1
View File
@@ -197,7 +197,7 @@ else
$webserver_id = mysqli_insert_id($link); $webserver_id = mysqli_insert_id($link);
} }
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; $stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";} if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link); $rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link); $report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php
+1 -1
View File
@@ -353,7 +353,7 @@ else
$webserver_id = mysqli_insert_id($link); $webserver_id = mysqli_insert_id($link);
} }
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; $stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";} if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link); $rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link); $report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php
+1 -1
View File
@@ -253,7 +253,7 @@ else
$webserver_id = mysqli_insert_id($link); $webserver_id = mysqli_insert_id($link);
} }
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; $stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';";
if ($DB) {echo "|$stmt|\n";} if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link); $rslt=mysql_to_mysqli($stmt, $link);
$report_log_id = mysqli_insert_id($link); $report_log_id = mysqli_insert_id($link);
agc_2-X/trunk/www/vicidial/admin.php
+5
View File
@@ -17401,6 +17401,10 @@ if ($ADD==49)
if (isset($_GET[$Fvcl_name])) {$vcl_name=$_GET[$Fvcl_name];} if (isset($_GET[$Fvcl_name])) {$vcl_name=$_GET[$Fvcl_name];}
elseif (isset($_POST[$Fvcl_name])) {$vcl_name=$_POST[$Fvcl_name];} elseif (isset($_POST[$Fvcl_name])) {$vcl_name=$_POST[$Fvcl_name];}
$list_mix_container = preg_replace("/:$/","",$list_mix_container); $list_mix_container = preg_replace("/:$/","",$list_mix_container);
$list_mix_container = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $list_mix_container);
$mix_method = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $mix_method);
$status = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $status);
$vcl_name = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $vcl_name);
if ( (strlen($campaign_id) < 2) or (strlen($vcl_id) < 1) or (strlen($list_mix_container) < 6) or (strlen($vcl_name) < 2) ) if ( (strlen($campaign_id) < 2) or (strlen($vcl_id) < 1) or (strlen($list_mix_container) < 6) or (strlen($vcl_name) < 2) )
{ {
@@ -19475,6 +19479,7 @@ if ($ADD==461111111111)
$Ffilename = $mohfiles[$o]; $Ffilename = $mohfiles[$o];
if (isset($_GET[$Ffilename])) {$new_rank=$_GET[$Ffilename];} if (isset($_GET[$Ffilename])) {$new_rank=$_GET[$Ffilename];}
elseif (isset($_POST[$Ffilename])) {$new_rank=$_POST[$Ffilename];} elseif (isset($_POST[$Ffilename])) {$new_rank=$_POST[$Ffilename];}
$new_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_rank);
$stmt="UPDATE vicidial_music_on_hold_files set rank='$new_rank' where moh_id='$moh_id' and filename='$mohfiles[$o]';"; $stmt="UPDATE vicidial_music_on_hold_files set rank='$new_rank' where moh_id='$moh_id' and filename='$mohfiles[$o]';";
$rslt=mysql_to_mysqli($stmt, $link); $rslt=mysql_to_mysqli($stmt, $link);
agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php
+2
View File
@@ -263,6 +263,8 @@ if ($action == "ALT_MULTI_SUBMIT")
elseif (isset($_POST["$campaign_id$US$owner"])) {$owner_check=$_POST["$campaign_id$US$owner"];} elseif (isset($_POST["$campaign_id$US$owner"])) {$owner_check=$_POST["$campaign_id$US$owner"];}
if (isset($_GET["rank_$campaign_id$US$owner"])) {$owner_rank=$_GET["rank_$campaign_id$US$owner"];} if (isset($_GET["rank_$campaign_id$US$owner"])) {$owner_rank=$_GET["rank_$campaign_id$US$owner"];}
elseif (isset($_POST["rank_$campaign_id$US$owner"])) {$owner_rank=$_POST["rank_$campaign_id$US$owner"];} elseif (isset($_POST["rank_$campaign_id$US$owner"])) {$owner_rank=$_POST["rank_$campaign_id$US$owner"];}
$owner_check = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$owner_check);
$owner_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$owner_rank);
if ($owner_check=='YES') if ($owner_check=='YES')
{$new_filter_sql .= "'$owner_raw',";} {$new_filter_sql .= "'$owner_raw',";}
agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php
+1
View File
@@ -1261,6 +1261,7 @@ if ($OK_to_process)
{ {
if (isset($_GET["$field_name_id"])) {$form_field_value=$_GET["$field_name_id"];} if (isset($_GET["$field_name_id"])) {$form_field_value=$_GET["$field_name_id"];}
elseif (isset($_POST["$field_name_id"])) {$form_field_value=$_POST["$field_name_id"];} elseif (isset($_POST["$field_name_id"])) {$form_field_value=$_POST["$field_name_id"];}
$form_field_value = preg_replace("/\<|\>|\"|\\\\|;/","",$form_field_value);
if ($form_field_value >= 0) if ($form_field_value >= 0)
{ {
agc_2-X/trunk/www/vicidial/admin_modify_lead.php
+2 -2
View File
@@ -396,8 +396,8 @@ if ($non_latin < 1)
} }
else else
{ {
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
$user=preg_replace('/[^-_0-9\p{L}]/u','',$user); $user=preg_replace('/[^-_0-9\p{L}]/u','',$user);
$pass=preg_replace('/[^-_0-9\p{L}]/u','',$pass); $pass=preg_replace('/[^-_0-9\p{L}]/u','',$pass);
$function = preg_replace('/[^-\_0-9\p{L}]/u', '',$function); $function = preg_replace('/[^-\_0-9\p{L}]/u', '',$function);
agc_2-X/trunk/www/vicidial/admin_soundboard.php
+11 -3
View File
@@ -819,13 +819,13 @@ if ($ADD==462111111111)
$HORDfilename = '--HORD--' . $avatarfiles[$o] . '--' . $avatarlevel[$o] . '--' . $avatarranks[$o] . '--' . $avatarparent[$o]; $HORDfilename = '--HORD--' . $avatarfiles[$o] . '--' . $avatarlevel[$o] . '--' . $avatarranks[$o] . '--' . $avatarparent[$o];
$TYPEfilename = '--TYPE--' . $avatarfiles[$o] . '--' . $avatarlevel[$o] . '--' . $avatarranks[$o] . '--' . $avatarparent[$o]; $TYPEfilename = '--TYPE--' . $avatarfiles[$o] . '--' . $avatarlevel[$o] . '--' . $avatarranks[$o] . '--' . $avatarparent[$o];
$FONTfilename = '--FONT--' . $avatarfiles[$o] . '--' . $avatarlevel[$o] . '--' . $avatarranks[$o] . '--' . $avatarparent[$o]; $FONTfilename = '--FONT--' . $avatarfiles[$o] . '--' . $avatarlevel[$o] . '--' . $avatarranks[$o] . '--' . $avatarparent[$o];
if (isset($_GET["$Ffilename"])) {$new_rank=$_GET["$Ffilename"];} if (isset($_GET["$Ffilename"])) {$new_rank=$_GET["$Ffilename"];}
elseif (isset($_POST["$Ffilename"])) {$new_rank=$_POST["$Ffilename"];} elseif (isset($_POST["$Ffilename"])) {$new_rank=$_POST["$Ffilename"];}
if (isset($_GET["$NAMEfilename"])) {$new_name=$_GET["$NAMEfilename"];} if (isset($_GET["$NAMEfilename"])) {$new_name=$_GET["$NAMEfilename"];}
elseif (isset($_POST["$NAMEfilename"])) {$new_name=$_POST["$NAMEfilename"];} elseif (isset($_POST["$NAMEfilename"])) {$new_name=$_POST["$NAMEfilename"];}
if (isset($_GET["$LEVELfilename"])) {$new_level=$_GET["$LEVELfilename"];} if (isset($_GET["$LEVELfilename"])) {$new_level=$_GET["$LEVELfilename"];}
elseif (isset($_POST["$LEVELfilename"])) {$new_level=$_POST["$LEVELfilename"];} elseif (isset($_POST["$LEVELfilename"])) {$new_level=$_POST["$LEVELfilename"];}
if (isset($_GET["$OLDRANKfilename"])) {$old_rank=$_GET["$OLDRANKfilename"];} if (isset($_GET["$OLDRANKfilename"])) {$old_rank=$_GET["$OLDRANKfilename"];}
elseif (isset($_POST["$OLDRANKfilename"])) {$old_rank=$_POST["$OLDRANKfilename"];} elseif (isset($_POST["$OLDRANKfilename"])) {$old_rank=$_POST["$OLDRANKfilename"];}
if (isset($_GET["$HORDfilename"])) {$new_h_ord=$_GET["$HORDfilename"];} if (isset($_GET["$HORDfilename"])) {$new_h_ord=$_GET["$HORDfilename"];}
elseif (isset($_POST["$HORDfilename"])) {$new_h_ord=$_POST["$HORDfilename"];} elseif (isset($_POST["$HORDfilename"])) {$new_h_ord=$_POST["$HORDfilename"];}
@@ -834,6 +834,14 @@ if ($ADD==462111111111)
if (isset($_GET["$FONTfilename"])) {$new_font_size=$_GET["$FONTfilename"];} if (isset($_GET["$FONTfilename"])) {$new_font_size=$_GET["$FONTfilename"];}
elseif (isset($_POST["$FONTfilename"])) {$new_font_size=$_POST["$FONTfilename"];} elseif (isset($_POST["$FONTfilename"])) {$new_font_size=$_POST["$FONTfilename"];}
$new_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_rank);
$new_name = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_name);
$new_level = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_level);
$old_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$old_rank);
$new_h_ord = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_h_ord);
$new_button_type = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_button_type);
$new_font_size = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_font_size);
if ($DB) if ($DB)
{ {
echo "update variable debug: ($avatarfiles[$o])\n"; echo "update variable debug: ($avatarfiles[$o])\n";
agc_2-X/trunk/www/vicidial/admin_user_list_new.php
+3
View File
@@ -383,6 +383,7 @@ else
} }
if (isset($_GET["$Ruser$US$Rlist_id[$o]"])) {$Ruser_overrideNEW=$_GET["$Ruser$US$Rlist_id[$o]"];} if (isset($_GET["$Ruser$US$Rlist_id[$o]"])) {$Ruser_overrideNEW=$_GET["$Ruser$US$Rlist_id[$o]"];}
elseif (isset($_POST["$Ruser$US$Rlist_id[$o]"])) {$Ruser_overrideNEW=$_POST["$Ruser$US$Rlist_id[$o]"];} elseif (isset($_POST["$Ruser$US$Rlist_id[$o]"])) {$Ruser_overrideNEW=$_POST["$Ruser$US$Rlist_id[$o]"];}
$Ruser_overrideNEW = preg_replace('/[^-_0-9\p{L}]/u', '', $Ruser_overrideNEW);
if ( ($Ruser_overrideNEW == $Ruser_override) or (strlen($Ruser_overrideNEW) < 1) ) if ( ($Ruser_overrideNEW == $Ruser_override) or (strlen($Ruser_overrideNEW) < 1) )
{ {
$vulnl_nochng++; $vulnl_nochng++;
@@ -534,6 +535,7 @@ if ( ($list_id != '---ALL---') and ($list_id != 'NONE') )
} }
if (isset($_GET["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_GET["$Ruser[$o]$US$Rlist_id"];} if (isset($_GET["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_GET["$Ruser[$o]$US$Rlist_id"];}
elseif (isset($_POST["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_POST["$Ruser[$o]$US$Rlist_id"];} elseif (isset($_POST["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_POST["$Ruser[$o]$US$Rlist_id"];}
$Ruser_overrideNEW = preg_replace('/[^-_0-9\p{L}]/u', '', $Ruser_overrideNEW);
if ( ($Ruser_overrideNEW == $Ruser_override) or (strlen($Ruser_overrideNEW) < 1) ) if ( ($Ruser_overrideNEW == $Ruser_override) or (strlen($Ruser_overrideNEW) < 1) )
{ {
$vulnl_nochng++; $vulnl_nochng++;
@@ -672,6 +674,7 @@ if ($list_id == 'NONE')
} }
if (isset($_GET["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_GET["$Ruser[$o]$US$Rlist_id"];} if (isset($_GET["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_GET["$Ruser[$o]$US$Rlist_id"];}
elseif (isset($_POST["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_POST["$Ruser[$o]$US$Rlist_id"];} elseif (isset($_POST["$Ruser[$o]$US$Rlist_id"])) {$Ruser_overrideNEW=$_POST["$Ruser[$o]$US$Rlist_id"];}
$Ruser_overrideNEW = preg_replace('/[^-_0-9\p{L}]/u', '', $Ruser_overrideNEW);
if ( ($Ruser_overrideNEW == $Ruser_override) or (strlen($Ruser_overrideNEW) < 1) ) if ( ($Ruser_overrideNEW == $Ruser_override) or (strlen($Ruser_overrideNEW) < 1) )
{ {
$vulnl_nochng++; $vulnl_nochng++;