From 2e54eb51e53c53c4bcaa0e67608c36efe17cc796 Mon Sep 17 00:00:00 2001 From: mattf Date: Sat, 27 May 2017 01:44:12 +0000 Subject: [PATCH] Added additional auth variable filtering, issue #1016 git-svn-id: svn://192.168.202.10@2759 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/branches/agc_2.0.4/extras/country_ISO_TLD.txt | 1 + agc_2-X/branches/agc_2.0.4/extras/phone_codes_GMT.txt | 5 +++++ agc_2-X/trunk/www/agc/functions.php | 7 ++++--- agc_2-X/trunk/www/vicidial/functions.php | 9 +++++---- 4 files changed, 15 insertions(+), 7 deletions(-) diff --git a/agc_2-X/branches/agc_2.0.4/extras/country_ISO_TLD.txt b/agc_2-X/branches/agc_2.0.4/extras/country_ISO_TLD.txt index 777cba1d..c8fdfec8 100644 --- a/agc_2-X/branches/agc_2.0.4/extras/country_ISO_TLD.txt +++ b/agc_2-X/branches/agc_2.0.4/extras/country_ISO_TLD.txt @@ -117,6 +117,7 @@ Kenya KE KEN 404 ke Kiribati KI KIR 296 ki Korea (Democratic People's Republic of) KP PRK 408 kp Korea (Republic of) KR KOR 410 kr +Kosovo XK XKX ? ? Kuwait KW KWT 414 kw Kyrgyzstan KG KGZ 417 kg Lao People's Democratic Republic LA LAO 418 la diff --git a/agc_2-X/branches/agc_2.0.4/extras/phone_codes_GMT.txt b/agc_2-X/branches/agc_2.0.4/extras/phone_codes_GMT.txt index b1064576..b80efe35 100644 --- a/agc_2-X/branches/agc_2.0.4/extras/phone_codes_GMT.txt +++ b/agc_2-X/branches/agc_2.0.4/extras/phone_codes_GMT.txt @@ -51,6 +51,7 @@ code country areacode state GMT DST DST_RANGE GEOGRAPHIC DESCRIPTION TZ_CODE 1 USA 274 WI -6 Y SSM-FSN Wisconsin CST 1 USA 276 VA -5 Y SSM-FSN Virginia EST 1 USA 278 MI -5 Y SSM-FSN Michigan EST +1 USA 279 CA -8 Y SSM-FSN California PST 1 USA 280 MD -5 Y SSM-FSN Maryland EST 1 USA 281 TX -6 Y SSM-FSN Texas CST 1 USA 282 IL -6 Y SSM-FSN Illinois CST @@ -101,6 +102,7 @@ code country areacode state GMT DST DST_RANGE GEOGRAPHIC DESCRIPTION TZ_CODE 1 USA 361 TX -6 Y SSM-FSN Texas CST 1 USA 364 KY -6 Y SSM-FSN Kentucky CST 1 CAN 365 ON -5 Y SSM-FSN Ontario EST +1 CAN 367 QC -5 Y SSM-FSN Quebec EST 1 USA 369 CA -8 Y SSM-FSN California PST 1 USA 380 OH -5 Y SSM-FSN Ohio EST 1 USA 385 UT -7 Y SSM-FSN Utah MST @@ -229,6 +231,7 @@ code country areacode state GMT DST DST_RANGE GEOGRAPHIC DESCRIPTION TZ_CODE 1 USA 631 NY -5 Y SSM-FSN New York EST 1 USA 636 MO -6 Y SSM-FSN Missouri CST 1 CAN 639 SK -6 N Saskatchewan CST +1 USA 640 NJ -5 Y SSM-FSN New Jersey EST 1 USA 641 IA -6 Y SSM-FSN Iowa CST 1 USA 646 NY -5 Y SSM-FSN New York EST 1 CAN 647 ON -5 Y SSM-FSN Ontario EST @@ -360,6 +363,7 @@ code country areacode state GMT DST DST_RANGE GEOGRAPHIC DESCRIPTION TZ_CODE 1 CAN 873 QC -5 Y SSM-FSN Quebec EST 1 JAM 876 -5 N Jamaica EST 1 USA 878 PA -5 Y SSM-FSN Pennsylvania EST +1 CAN 879 NF -3.5 Y SSM-FSN Newfoundland NST 1 USA 901 TN -6 Y SSM-FSN Tennessee CST 1 CAN 902 NS -4 Y SSM-FSN Nova Scotia AST 1 USA 903 TX -6 Y SSM-FSN Texas CST @@ -994,6 +998,7 @@ code country areacode state GMT DST DST_RANGE GEOGRAPHIC DESCRIPTION TZ_CODE 380 UKR * +2 Y LSM-LSO Ukraine EET 381 YUG * +1 Y LSM-LSO Yugoslavia CET 382 MNE * +1 Y LSM-LSO Montenegro CET +383 XKX * +1 Y LSM-LSO Kosovo CET 385 HRV * +1 Y LSM-LSO Croatia CET 386 SVN * +1 Y LSM-LSO Slovenia CET 387 BIH * +1 Y LSM-LSO Bosnia Hercegovina CET diff --git a/agc_2-X/trunk/www/agc/functions.php b/agc_2-X/trunk/www/agc/functions.php index 5e693fb6..692a467e 100644 --- a/agc_2-X/trunk/www/agc/functions.php +++ b/agc_2-X/trunk/www/agc/functions.php @@ -38,6 +38,7 @@ # 170317-0753 - Added more missing display variables # 170330-1152 - Added did_carrier_description display option # 170409-1004 - Added IP List features to user_authorization +# 170526-2141 - Added additional auth variable filtering, issue #1016 # # $mysql_queries = 26 @@ -77,8 +78,8 @@ function user_authorization($user,$pass,$user_option,$user_update,$bcrypt,$retur $LOCK_trigger_attempts = 10; $pass_hash=''; - $user = preg_replace("/\'|\"|\\\\|;| /","",$user); - $pass = preg_replace("/\'|\"|\\\\|;| /","",$pass); + $user = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$user); + $pass = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$pass); $passSQL = "pass='$pass'"; @@ -86,7 +87,7 @@ function user_authorization($user,$pass,$user_option,$user_update,$bcrypt,$retur { if ($bcrypt < 1) { - $pass_hash = exec("./bp.pl --pass=$pass"); + $pass_hash = exec("./bp.pl --pass='$pass'"); $pass_hash = preg_replace("/PHASH: |\n|\r|\t| /",'',$pass_hash); } else diff --git a/agc_2-X/trunk/www/vicidial/functions.php b/agc_2-X/trunk/www/vicidial/functions.php index a8af978e..3536038c 100644 --- a/agc_2-X/trunk/www/vicidial/functions.php +++ b/agc_2-X/trunk/www/vicidial/functions.php @@ -30,6 +30,7 @@ # 170227-2230 - Change to allow horizontal_bar_chart header to be translated, issue #991 # 170409-1003 - Added IP List features to user_authorization # 170503-2130 - Patched sec_convert to fix rounding time bug, issue #1011 +# 170526-2142 - Added additional auth variable filtering, issue #1016 # ##### BEGIN validate user login credentials, check for failed lock out ##### @@ -66,17 +67,17 @@ function user_authorization($user,$pass,$user_option,$user_update,$api_call) $LOCK_over = ($STARTtime - 900); # failed login lockout time is 15 minutes(900 seconds) $LOCK_trigger_attempts = 10; - $user = preg_replace("/\'|\"|\\\\|;/","",$user); - $pass = preg_replace("/\'|\"|\\\\|;/","",$pass); + $user = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$user); + $pass = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$pass); $passSQL = "pass='$pass'"; if ($SSpass_hash_enabled > 0) { if (file_exists("../agc/bp.pl")) - {$pass_hash = exec("../agc/bp.pl --pass=$pass");} + {$pass_hash = exec("../agc/bp.pl --pass='$pass'");} else - {$pass_hash = exec("../../agc/bp.pl --pass=$pass");} + {$pass_hash = exec("../../agc/bp.pl --pass='$pass'");} $pass_hash = preg_replace("/PHASH: |\n|\r|\t| /",'',$pass_hash); $passSQL = "pass_hash='$pass_hash'"; }