ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixes for better consistency in password change process for both vicidial.php and admin.php, Issue #1261

Browse Source 
git-svn-id: svn://192.168.202.10@3387 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2021-03-17 16:14:27 +00:00
parent 794556fe53
commit 259fce185b
3 changed files with 114 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/docs/ENCRYPTED_PASSWORDS.txt
+9 -6
View File
@@ -1,4 +1,4 @@
ENCRYPTED PASSWORDS DOC Started: 2013-07-09 Updated: 2020-09-01
ENCRYPTED PASSWORDS DOC Started: 2013-07-09 Updated: 2021-03-17
NOTE: THIS FEATURE IS OPTIONAL, AND SHOULD ONLY BE ACTIVATED AFTER YOUR SYSTEM
@@ -40,9 +40,10 @@ system.
DESCRIPTION:
This new optional feature is part of the security enhancements that have been
made to the Vicidial Contact Center System in our 2.8 development branch. After
consulting with security experts, we added several new security features to the
web interfaces and closed several security vulnerabilities as well.
made to the Vicidial Contact Center System in our 2.8 development branch(during
the summer of 2013). After consulting with security experts, we added several
new security features to the web interfaces and closed several security
vulnerabilities as well.
The first major change was protecting against most SQL injection attacks. The
second major change was locking a user's account for 15 minutes after 10 failed
@@ -62,7 +63,9 @@ All password checking goes through the bp.pl perl script to generate the Bcrypt
hash that checks against the vicidial_users table password hash if Password
Encryption is enabled on your system.
NOTES: Enabling Password Encryption will force case-sensitive passwords
NOTES:
1. Enabling Password Encryption will force case-sensitive passwords
2. Passwords only allow letters and numbers, NOT symbols
To test the password encryption, or to generate a pass hash manually, just go to
@@ -81,7 +84,7 @@ ADDITIONAL USER SECURITY TOOLS:
1. Passwords can now be up to 100 characters: According to new NIST password security guidelines, the length of a password is the single most important point in the security of that password.
2. Minimum password lengths: This setting will require that user passwords, phone and server passwords, and system settings default passwords be at least this minimum length of characters when those records settings are modified on the Modify pages. There is also a "PASSWORD LENGTH" indicator on the Modify pages to show you how long a password is as it is being typed.
3. Add an automated process that can deactivate accounts that have not been logged in to in over X number of days(see below)
4. Two-Factor Authentication has been added as an option within the VICIdial admin web screens, allowing Email, Phone-Call and SMS methods with definable session expiration times. See the 2FA_TWO_FACTOR_AUTHENTICATION.txt doc for more info.
NOTE: This is something an Admin will have to set up on your system.
agc_2-X/trunk/www/agc/vicidial.php
+30 -7
View File
@@ -656,12 +656,13 @@
# 210222-0819 - Fixes for manual dial agent-state issues and a translation issue
# 210312-1520 - Force clearing of webphone panel upon logout
# 210315-2102 - Added CALLBACK manual dial filter option, Issue #1139
# 210317-1207 - Fixes for better consistency in password change process, Issue #1261
#
$version = '2.14-624c';
$build = '210315-2102';
$version = '2.14-625c';
$build = '210317-1207';
$mel=1; # Mysql Error Log enabled = 1
$mysql_log_count=92;
$mysql_log_count=95;
$one_mysql_log=0;
$DB=0;
@@ -847,6 +848,8 @@ if ($non_latin < 1)
{
$VD_login=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_login);
$VD_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_pass);
$new_pass1=preg_replace("/[^-_0-9a-zA-Z]/","",$new_pass1);
$new_pass2=preg_replace("/[^-_0-9a-zA-Z]/","",$new_pass2);
$phone_login=preg_replace("/[^\,0-9a-zA-Z]/","",$phone_login);
$phone_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$phone_pass);
$VD_campaign = preg_replace("/[^-_0-9a-zA-Z]/","",$VD_campaign);
@@ -862,6 +865,8 @@ else
{
$VD_login = preg_replace("/\'|\"|\\\\|;/","",$VD_login);
$VD_pass=preg_replace("/\'|\"|\\\\|;| /","",$VD_pass);
$new_pass1=preg_replace("/[^-_0-9\p{L}]/u","",$new_pass1);
$new_pass2=preg_replace("/[^-_0-9\p{L}]/u","",$new_pass2);
$phone_login=preg_replace("/[^\,0-9\p{L}]/u","",$phone_login);
$phone_pass=preg_replace("/[^-_0-9\p{L}]/u","",$phone_pass);
$VD_campaign = preg_replace("/[^-_0-9\p{L}]/u","",$VD_campaign);
@@ -1560,6 +1565,7 @@ else
{
$pass_hash='';
$pass_hashSQL='';
$pass_querySQL="and pass='$new_pass1'";
if ($SSpass_hash_enabled > 0)
{
if (strlen($new_pass1) > 1)
@@ -1568,14 +1574,30 @@ else
$pass_hash = exec("../agc/bp.pl --pass=$pass");
$pass_hash = preg_replace("/PHASH: |\n|\r|\t| /",'',$pass_hash);
$pass_hashSQL = ",pass_hash='$pass_hash'";
$pass_querySQL = "and pass_hash='$pass_hash'";
}
$new_pass1='';
}
$stmt="SELECT count(*) from vicidial_users where user='$VD_login' $pass_querySQL;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'01093',$VD_login,$server_ip,$session_name,$one_mysql_log);}
$row=mysqli_fetch_row($rslt);
$dup_password=$row[0];
if ($dup_password > 0)
{
$set_pass_message = _QXZ("You cannot use the same password as your last password");
$set_pass=1;
}
}
if ($set_pass == '2')
{
$stmt="UPDATE vicidial_users SET force_change_password='N',pass='$new_pass1' $pass_hashSQL where user='$VD_login';";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_to_mysqli($stmt, $link);
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'01XXX',$VD_login,$server_ip,$session_name,$one_mysql_log);}
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'01094',$VD_login,$server_ip,$session_name,$one_mysql_log);}
$VUpassword_affected_rows = mysqli_affected_rows($link);
echo "<title>"._QXZ("Agent web client: Change Password")."</title>\n";
@@ -1651,10 +1673,11 @@ else
echo "<td align=\"left\" valign=\"bottom\" bgcolor=\"#$SSmenu_background\" width=\"170\"><img src=\"$selected_logo\" border=\"0\" height=\"45\" width=\"170\" alt=\"Agent Screen\" /></td>";
echo "<td align=\"center\" valign=\"middle\" bgcolor=\"#$SSmenu_background\"> <font class=\"sh_text_white\">$set_pass_message</font> </td>";
echo "</tr>\n";
echo "<tr><td colspan=2 align=\"center\"><font class=\"sk_text\"><BR>"._QXZ("Note: Passwords may be up to 100 characters in length, and you may only use letters and numbers in your password").". <BR> &nbsp; </font></td></tr>";
echo "<tr><td align=\"right\"><font class=\"skb_text\">"._QXZ("New Password").": </font> </td>";
echo "<td align=\"left\"><input type=\"password\" name=\"new_pass1\" id=\"new_pass1\" size=\"40\" maxlength=\"100\" onkeyup=\"return pwdChanged('new_pass1','pass_length1');\" /> &nbsp; <font size=1 face=\"Arial,Helvetica\"><span id=\"pass_length1\"></font></td></tr>\n";
echo "<td align=\"left\"><input type=\"password\" name=\"new_pass1\" id=\"new_pass1\" size=\"60\" maxlength=\"100\" onkeyup=\"return pwdChanged('new_pass1','pass_length1');\" /> &nbsp; <font size=1 face=\"Arial,Helvetica\"><span id=\"pass_length1\"></font></td></tr>\n";
echo "<tr><td align=\"right\"><font class=\"skb_text\">"._QXZ("Confirm New Password").": </font> </td>";
echo "<td align=\"left\"><input type=\"password\" name=\"new_pass2\" id=\"new_pass2\" size=\"40\" maxlength=\"100\" onkeyup=\"return pwdChanged('new_pass2','pass_length2');\" /> &nbsp; <font size=1 face=\"Arial,Helvetica\"><span id=\"pass_length2\"></font></td></tr>\n";
echo "<td align=\"left\"><input type=\"password\" name=\"new_pass2\" id=\"new_pass2\" size=\"60\" maxlength=\"100\" onkeyup=\"return pwdChanged('new_pass2','pass_length2');\" /> &nbsp; <font size=1 face=\"Arial,Helvetica\"><span id=\"pass_length2\"></font></td></tr>\n";
echo "<tr><td align=\"center\" colspan=\"2\"><input type=\"submit\" name=\"SUBMIT\" value=\""._QXZ("SUBMIT")."\" /> &nbsp; \n";
echo "<span id=\"LogiNReseT\"></span></td></tr>\n";
echo "<tr><td align=\"left\" colspan=\"2\"><font class=\"body_tiny\"><br />"._QXZ("VERSION:")." $version &nbsp; &nbsp; &nbsp; "._QXZ("BUILD:")." $build</font></td></tr>\n";
@@ -2442,7 +2465,7 @@ else
# Gather details on Pause Codes Max Exceptions settings container
$stmt = "SELECT container_entry FROM vicidial_settings_containers where container_id='$pause_max_exceptions';";
$rslt=mysql_to_mysqli($stmt, $link);
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'01XXX',$user,$server_ip,$session_name,$one_mysql_log);}
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'01095',$user,$server_ip,$session_name,$one_mysql_log);}
if ($DB) {echo "$stmt\n";}
$SCinfo_ct = mysqli_num_rows($rslt);
if ($SCinfo_ct > 0)
agc_2-X/trunk/www/vicidial/admin.php
+75 -36
View File
@@ -5537,12 +5537,13 @@ if ($SSscript_remove_js > 0)
# 210315-2118 - Added new manual_dial_filter CALLBACK options, Issue #1139
# 210316-0923 - Small fix for 2FA consistency
# 210317-0819 - Added lead_all_info Non-Agent API function, Changed lead-modify page links to javascript because of Chrome
# 210317-1211 - Fixes for better consistency in password change process, Issue #1261
#
# make sure you have added a user to the vicidial_users MySQL table with at least user_level 9 to access this page the first time
$admin_version = '2.14-801a';
$build = '210317-0819';
$admin_version = '2.14-802a';
$build = '210317-1211';
$STARTtime = date("U");
$SQLdate = date("Y-m-d H:i:s");
@@ -45852,6 +45853,14 @@ if ($ADD==999997)
if ( (mb_strlen($pass,'utf-8') > 100) or (strlen($pass) < 2) or ($pass==$PHP_AUTH_PW) or ( ($SSrequire_password_length > 0) and ($SSrequire_password_length > strlen($pass)) ) )
{
echo _QXZ("Password has not been changed, please try again")." |1|" . strlen($pass);
if ( (mb_strlen($pass,'utf-8') > 100) or (strlen($pass) < 2) )
{
echo "<br>"._QXZ("Your password must be between 2 and 100 characters in length")."\n";
}
if ($pass==$PHP_AUTH_PW)
{
echo "<br>"._QXZ("You cannot use the same password as your last password")."\n";
}
if ($SSrequire_password_length > 0)
{
echo "<br>"._QXZ("Password must be at least $SSrequire_password_length characters long")."\n";
@@ -45883,20 +45892,35 @@ if ($ADD==999997)
{echo _QXZ("Password has not been changed, please try again")." |3|$row[0]";}
else
{
$show_form=0;
$stmt="UPDATE vicidial_users SET pass='$pass',pass_hash='$pass_hash',force_change_password='N',failed_login_count=0 where user='$user' and force_change_password='Y' and active='Y' and user_level > 6;";
$stmt="SELECT count(*) from vicidial_users where user='$user' and $pass_checkSQL;";
$rslt=mysql_to_mysqli($stmt, $link);
if ($DB) {echo "$stmt\n";}
$userpass_to_print = mysqli_num_rows($rslt);
if ($userpass_to_print < 1)
{echo _QXZ("Password has not been changed, please try again")." |4|$userpass_to_print";}
else
{
$row=mysqli_fetch_row($rslt);
if ($row[0] > 0)
{echo _QXZ("You cannot use the same password as your last password, please try again")." |5|$row[0]";}
else
{
$show_form=0;
### LOG INSERTION Admin Log Table ###
$SQL_log = "$stmt|";
$SQL_log = preg_replace('/;/', '', $SQL_log);
$SQL_log = addslashes($SQL_log);
$stmt="INSERT INTO vicidial_admin_log set event_date='$SQLdate', user='$PHP_AUTH_USER', ip_address='$ip', event_section='USERS', event_type='MODIFY', record_id='$user', event_code='USER FORCE CHANGE PASSWORD', event_sql=\"$SQL_log\", event_notes='';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$stmt="UPDATE vicidial_users SET pass='$pass',pass_hash='$pass_hash',force_change_password='N',failed_login_count=0 where user='$user' and force_change_password='Y' and active='Y' and user_level > 6;";
$rslt=mysql_to_mysqli($stmt, $link);
echo _QXZ("Password has been updated, you may now continue")."\n";
### LOG INSERTION Admin Log Table ###
$SQL_log = "$stmt|";
$SQL_log = preg_replace('/;/', '', $SQL_log);
$SQL_log = addslashes($SQL_log);
$stmt="INSERT INTO vicidial_admin_log set event_date='$SQLdate', user='$PHP_AUTH_USER', ip_address='$ip', event_section='USERS', event_type='MODIFY', record_id='$user', event_code='USER FORCE CHANGE PASSWORD', event_sql=\"$SQL_log\", event_notes='';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
echo _QXZ("Password has been updated, you may now continue")."\n";
}
}
}
}
}
@@ -46461,35 +46485,50 @@ if ($ADD==999996)
{echo _QXZ("Password has not been changed, please try again")." |3|$row[0]";}
else
{
$show_form=0;
if (strlen($default_phone_registration_password) < 2) {$default_phone_registration_password = $SSdefault_phone_registration_password;}
if (strlen($default_phone_login_password) < 2) {$default_phone_login_password = $SSdefault_phone_login_password;}
if (strlen($default_server_password) < 2) {$default_server_password = $SSdefault_server_password;}
if (strlen($default_local_gmt) < 2) {$default_local_gmt = $SSdefault_local_gmt;}
if (strlen($default_voicemail_timezone) < 2) {$default_voicemail_timezone = $SSdefault_voicemail_timezone;}
$stmt="UPDATE vicidial_users SET pass='$pass',pass_hash='$pass_hash',force_change_password='N',failed_login_count=0 where user='$user' and active='Y' and user_level > 6;";
$stmt="SELECT count(*) from vicidial_users where user='$user' and $pass_checkSQL;";
$rslt=mysql_to_mysqli($stmt, $link);
if ($DB) {echo "$stmt\n";}
$userpass_to_print = mysqli_num_rows($rslt);
if ($userpass_to_print < 1)
{echo _QXZ("Password has not been changed, please try again")." |4|$userpass_to_print";}
else
{
$row=mysqli_fetch_row($rslt);
if ($row[0] > 0)
{echo _QXZ("You cannot use the same password as your last password, please try again")." |5|$row[0]";}
else
{
$show_form=0;
$stmtA="UPDATE system_settings SET first_login_trigger='N',default_phone_registration_password='$default_phone_registration_password',default_phone_login_password='$default_phone_login_password',default_server_password='$default_server_password',default_local_gmt='$default_local_gmt',default_voicemail_timezone='$default_voicemail_timezone';";
$rslt=mysql_to_mysqli($stmtA, $link);
if (strlen($default_phone_registration_password) < 2) {$default_phone_registration_password = $SSdefault_phone_registration_password;}
if (strlen($default_phone_login_password) < 2) {$default_phone_login_password = $SSdefault_phone_login_password;}
if (strlen($default_server_password) < 2) {$default_server_password = $SSdefault_server_password;}
if (strlen($default_local_gmt) < 2) {$default_local_gmt = $SSdefault_local_gmt;}
if (strlen($default_voicemail_timezone) < 2) {$default_voicemail_timezone = $SSdefault_voicemail_timezone;}
$stmtB="UPDATE phones SET conf_secret='$default_phone_registration_password',pass='$default_phone_login_password',local_gmt='$default_local_gmt',voicemail_timezone='$default_voicemail_timezone';";
$rslt=mysql_to_mysqli($stmtB, $link);
$stmt="UPDATE vicidial_users SET pass='$pass',pass_hash='$pass_hash',force_change_password='N',failed_login_count=0 where user='$user' and active='Y' and user_level > 6;";
$rslt=mysql_to_mysqli($stmt, $link);
$stmtC="UPDATE servers SET conf_secret='$default_server_password',rebuild_conf_files='Y';";
$rslt=mysql_to_mysqli($stmtC, $link);
$stmtA="UPDATE system_settings SET first_login_trigger='N',default_phone_registration_password='$default_phone_registration_password',default_phone_login_password='$default_phone_login_password',default_server_password='$default_server_password',default_local_gmt='$default_local_gmt',default_voicemail_timezone='$default_voicemail_timezone';";
$rslt=mysql_to_mysqli($stmtA, $link);
### LOG INSERTION Admin Log Table ###
$SQL_log = "$stmt|$stmtA|$stmtB|$stmtC|";
$SQL_log = preg_replace('/;/', '', $SQL_log);
$SQL_log = addslashes($SQL_log);
$stmt="INSERT INTO vicidial_admin_log set event_date='$SQLdate', user='$PHP_AUTH_USER', ip_address='$ip', event_section='USERS', event_type='MODIFY', record_id='$user', event_code='INITIAL SETTINGS UPDATE', event_sql=\"$SQL_log\", event_notes='';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$stmtB="UPDATE phones SET conf_secret='$default_phone_registration_password',pass='$default_phone_login_password',local_gmt='$default_local_gmt',voicemail_timezone='$default_voicemail_timezone';";
$rslt=mysql_to_mysqli($stmtB, $link);
echo _QXZ("Passwords have been updated, you may now continue on into Administration").". <BR><BR>"._QXZ("You may want to start by reading the ViciDial Manager Manual available at")." <a href=\"http://www.vicidial.org/store.php#MANAGER\" target=\"_blank\">vicidial.org</a> ("._QXZ("there is a free version available").")\n";
$stmtC="UPDATE servers SET conf_secret='$default_server_password',rebuild_conf_files='Y';";
$rslt=mysql_to_mysqli($stmtC, $link);
### LOG INSERTION Admin Log Table ###
$SQL_log = "$stmt|$stmtA|$stmtB|$stmtC|";
$SQL_log = preg_replace('/;/', '', $SQL_log);
$SQL_log = addslashes($SQL_log);
$stmt="INSERT INTO vicidial_admin_log set event_date='$SQLdate', user='$PHP_AUTH_USER', ip_address='$ip', event_section='USERS', event_type='MODIFY', record_id='$user', event_code='INITIAL SETTINGS UPDATE', event_sql=\"$SQL_log\", event_notes='';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
echo _QXZ("Passwords have been updated, you may now continue on into Administration").". <BR><BR>"._QXZ("You may want to start by reading the ViciDial Manager Manual available at")." <a href=\"http://www.vicidial.org/store.php#MANAGER\" target=\"_blank\">vicidial.org</a> ("._QXZ("there is a free version available").")\n";
}
}
}
}
}