ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added additional auth variable filtering, issue #1016

Browse Source 
git-svn-id: svn://192.168.202.10@2759 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2017-05-27 01:44:12 +00:00
parent c0efa33ed1
commit 2e54eb51e5
4 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/vicidial/functions.php
+5 -4
View File
@@ -30,6 +30,7 @@
# 170227-2230 - Change to allow horizontal_bar_chart header to be translated, issue #991
# 170409-1003 - Added IP List features to user_authorization
# 170503-2130 - Patched sec_convert to fix rounding time bug, issue #1011
# 170526-2142 - Added additional auth variable filtering, issue #1016
#
##### BEGIN validate user login credentials, check for failed lock out #####
@@ -66,17 +67,17 @@ function user_authorization($user,$pass,$user_option,$user_update,$api_call)
$LOCK_over = ($STARTtime - 900); # failed login lockout time is 15 minutes(900 seconds)
$LOCK_trigger_attempts = 10;
$user = preg_replace("/\'|\"|\\\\|;/","",$user);
$pass = preg_replace("/\'|\"|\\\\|;/","",$pass);
$user = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$user);
$pass = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$pass);
$passSQL = "pass='$pass'";
if ($SSpass_hash_enabled > 0)
{
if (file_exists("../agc/bp.pl"))
{$pass_hash = exec("../agc/bp.pl --pass=$pass");}
{$pass_hash = exec("../agc/bp.pl --pass='$pass'");}
else
{$pass_hash = exec("../../agc/bp.pl --pass=$pass");}
{$pass_hash = exec("../../agc/bp.pl --pass='$pass'");}
$pass_hash = preg_replace("/PHASH: |\n|\r|\t| /",'',$pass_hash);
$passSQL = "pass_hash='$pass_hash'";
}