Added PHP input form variable filters

git-svn-id: svn://192.168.202.10@3566 3d104415-ff17-0410-8863-d5cf3c621b8a

agc_2-X/trunk/www/agc/agc_agent_manager_chat_interface.php

@@ -42,6 +42,8 @@ if (isset($_GET["pass"]))						{$pass=$_GET["pass"];}
 	elseif (isset($_POST["pass"]))				{$pass=$_POST["pass"];}
 if (!$user) {echo "Page should only be viewed through the agent interface."; die;}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $VUselected_language = '';

agc_2-X/trunk/www/agc/api.php

@@ -258,6 +258,8 @@ if (isset($_GET["cid_choice"]))				{$cid_choice=$_GET["cid_choice"];}
 if (isset($_GET["outbound_cid"]))			{$outbound_cid=$_GET["outbound_cid"];}
 	elseif (isset($_POST["outbound_cid"]))	{$outbound_cid=$_POST["outbound_cid"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 # if options file exists, use the override values for the above variables
 #   see the options-example.php file for more information
 if (file_exists('options.php'))

agc_2-X/trunk/www/agc/chat_db_query.php

@@ -102,6 +102,8 @@ if (isset($_GET["chat_xfer_type"]))					{$chat_xfer_type=$_GET["chat_xfer_type"]
 if (isset($_GET["chat_xfer_value"]))					{$chat_xfer_value=$_GET["chat_xfer_value"];}
 	elseif (isset($_POST["chat_xfer_value"]))			{$chat_xfer_value=$_POST["chat_xfer_value"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 if (!$user) {echo "No user, no using."; exit;}
 
 if (file_exists('options.php'))

agc_2-X/trunk/www/agc/conf_exten_check.php

@@ -154,6 +154,8 @@ if (isset($_GET["phone_number"]))			{$phone_number=$_GET["phone_number"];}
 if (isset($_GET["visibility"]))				{$visibility=$_GET["visibility"];}
 	elseif (isset($_POST["visibility"]))	{$visibility=$_POST["visibility"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 if ($bcrypt == 'OFF')
 	{$bcrypt=0;}
 

agc_2-X/trunk/www/agc/deactivate_lead.php

@@ -70,6 +70,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 if (isset($_GET["log_to_file"]))			{$log_to_file=$_GET["log_to_file"];}
 	elseif (isset($_POST["log_to_file"]))	{$log_to_file=$_POST["log_to_file"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$DB = '1';	# DEBUG override
 $US = '_';

agc_2-X/trunk/www/agc/dispo_add_FPG.php

@@ -57,6 +57,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 if (isset($_GET["log_to_file"]))			{$log_to_file=$_GET["log_to_file"];}
 	elseif (isset($_POST["log_to_file"]))	{$log_to_file=$_POST["log_to_file"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$DB = '1';	# DEBUG override
 $US = '_';

agc_2-X/trunk/www/agc/dispo_change_status.php

@@ -67,6 +67,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 if (isset($_GET["log_to_file"]))			{$log_to_file=$_GET["log_to_file"];}
 	elseif (isset($_POST["log_to_file"]))	{$log_to_file=$_POST["log_to_file"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$DB = '1';	# DEBUG override
 $US = '_';

agc_2-X/trunk/www/agc/dispo_list_quota.php

@@ -63,6 +63,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 if (isset($_GET["log_to_file"]))			{$log_to_file=$_GET["log_to_file"];}
 	elseif (isset($_POST["log_to_file"]))	{$log_to_file=$_POST["log_to_file"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$DB = '1';	# DEBUG override
 $US = '_';

agc_2-X/trunk/www/agc/dispo_move_list.php

@@ -125,6 +125,7 @@ if (isset($_GET["list_id_trigger"]))			{$list_id_trigger=$_GET["list_id_trigger"
 if (isset($_GET["multi_trigger"]))			{$multi_trigger=$_GET["multi_trigger"];}
 	elseif (isset($_POST["multi_trigger"]))	{$multi_trigger=$_POST["multi_trigger"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$DB = '1';	# DEBUG override
 $US = '_';

agc_2-X/trunk/www/agc/dispo_send_email.php

@@ -136,6 +136,7 @@ if (isset($_GET["email_attachment_19"]))			{$email_attachment_19=$_GET["email_at
 if (isset($_GET["email_attachment_20"]))			{$email_attachment_20=$_GET["email_attachment_20"];}
 	elseif (isset($_POST["email_attachment_20"]))	{$email_attachment_20=$_POST["email_attachment_20"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$DB = '1';	# DEBUG override
 $US = '_';

agc_2-X/trunk/www/agc/update_cf_ivr.php

@@ -47,6 +47,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 if (isset($_GET["log_to_file"]))			{$log_to_file=$_GET["log_to_file"];}
 	elseif (isset($_POST["log_to_file"]))	{$log_to_file=$_POST["log_to_file"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$DB = '1';	# DEBUG override
 $US = '_';

agc_2-X/trunk/www/agc/vdc_db_query.php

@@ -843,6 +843,8 @@ if (isset($_GET["calls_waiting_vl_twoLABEL"]))			{$calls_waiting_vl_twoLABEL=$_G
 if (isset($_GET["pause_max_url_trigger"]))			{$pause_max_url_trigger=$_GET["pause_max_url_trigger"];}
 	elseif (isset($_POST["pause_max_url_trigger"]))	{$pause_max_url_trigger=$_POST["pause_max_url_trigger"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 # if options file exists, use the override values for the above variables
 #   see the options-example.php file for more information
 if (file_exists('options.php'))

agc_2-X/trunk/www/agc/vdc_email_display.php

@@ -64,6 +64,8 @@ if (isset($_GET["REPLY"]))	{$REPLY=$_GET["REPLY"];}
 if (isset($_GET["agent_email"]))	{$agent_email=$_GET["agent_email"];}
 	elseif (isset($_POST["agent_email"]))	{$agent_email=$_POST["agent_email"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
 

agc_2-X/trunk/www/agc/vdc_form_display.php

@@ -223,6 +223,8 @@ if (isset($_GET["orig_URL"]))			{$orig_URL=$_GET["orig_URL"];}
 if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 if ($bcrypt == 'OFF')
 	{$bcrypt=0;}
 

agc_2-X/trunk/www/agc/vdc_script_display.php

@@ -267,6 +267,8 @@ if (isset($_GET["LOGINvarFIVE"]))			{$LOGINvarFIVE=$_GET["LOGINvarFIVE"];}
 if (isset($_GET["script_span"]))			{$script_span=$_GET["script_span"];}
 	elseif (isset($_POST["script_span"]))	{$script_span=$_POST["script_span"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 # if options file exists, use the override values for the above variables
 #   see the options-example.php file for more information
 if (file_exists('options.php'))

agc_2-X/trunk/www/agc/vdc_script_dispo_example.php

@@ -236,6 +236,9 @@ if (strlen($appointment_time) < 1)
 $appointment_timeARRAY = explode(":",$appointment_time);
 $appointment_hour = $appointment_timeARRAY[0];
 $appointment_min = $appointment_timeARRAY[1];
+
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 ##### END Put custom fields here #####
 
 # if options file exists, use the override values for the above variables

agc_2-X/trunk/www/agc/vdc_script_notes.php

@@ -207,6 +207,8 @@ $appointment_timeARRAY = explode(":",$appointment_time);
 $appointment_hour = $appointment_timeARRAY[0];
 $appointment_min = $appointment_timeARRAY[1];
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 # if options file exists, use the override values for the above variables
 #   see the options-example.php file for more information
 if (file_exists('options.php'))

agc_2-X/trunk/www/agc/vdc_soundboard_display.php

@@ -52,6 +52,7 @@ if (isset($_GET["bgcolor"]))			{$bgcolor=$_GET["bgcolor"];}
 if (isset($_GET["bcrypt"]))				{$bcrypt=$_GET["bcrypt"];}
 	elseif (isset($_POST["bcrypt"]))	{$bcrypt=$_POST["bcrypt"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 if ($bcrypt == 'OFF')
 	{$bcrypt=0;}

agc_2-X/trunk/www/chat_customer/customer_chat_functions.php

@@ -51,6 +51,7 @@ if (isset($_GET["available_agents"]))				{$available_agents=$_GET["available_age
 if (isset($_GET["show_email"]))						{$show_email=$_GET["show_email"];}
 	elseif (isset($_POST["show_email"]))			{$show_email=$_POST["show_email"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 $chat_member_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/',"",$chat_member_name);
 if (!$user) {echo "No user, no using."; exit;}
 

agc_2-X/trunk/www/vicidial/AST_AMD_log_report.php

@@ -47,6 +47,7 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
 $START_TIME=date("U");
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/AST_API_log_report.php

@@ -58,6 +58,8 @@ if (isset($_GET["show_urls"]))			{$show_urls=$_GET["show_urls"];}
 if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name="API Log Report";
 $NOW_DATE = date("Y-m-d");
 if (!isset($users)) {$users=array();}

agc_2-X/trunk/www/vicidial/AST_CLOSER_service_level.php

@@ -75,6 +75,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound Service Level Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php

@@ -116,6 +116,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 
 $MT[0]='0';
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_CLOSERstats_v2.php

@@ -127,6 +127,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 
 $MT[0]='0';
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_CLOSERsummary_hourly.php

@@ -80,6 +80,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 $MT[0]='0';
 if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($exclude_rollover)<2) {$exclude_rollover='NO';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound Summary Hourly Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_CMstats.php

@@ -45,6 +45,8 @@ if (isset($_GET["report_type"]))			{$report_type=$_GET["report_type"];}
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'Callmenu Survey Report';
 $db_source = 'M';
 

agc_2-X/trunk/www/vicidial/AST_DIDstats.php

@@ -74,6 +74,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='--';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound DID Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_DIDstats_v2.php

@@ -45,6 +45,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='--';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound DID Summary Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php

@@ -42,6 +42,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))			{$DB=$_POST["DB"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/AST_IVRfilter.php

@@ -61,6 +61,8 @@ if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 if (isset($_GET["file_download"]))				{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))	{$file_download=$_POST["file_download"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 if ($hourly_breakdown) 
 	{
 	$date_int=3600;

agc_2-X/trunk/www/vicidial/AST_IVRstats.php

@@ -77,6 +77,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 
 if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($type)<2) {$type='inbound';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 if ($type == 'inbound')
 	{$report_name = 'Inbound IVR Report';}

agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php

@@ -53,6 +53,7 @@ $NOW_DATE = date("Y-m-d");
 if (strlen($query_date_D) < 6) {$query_date_D = "00:00:00";}
 if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/AST_LISTS_campaign_stats.php

@@ -60,6 +60,8 @@ if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'Lists Campaign Statuses Report';
 $db_source = 'M';
 

agc_2-X/trunk/www/vicidial/AST_LISTS_pass_report.php

@@ -57,6 +57,7 @@ if (isset($_GET["use_lists"]))			{$use_lists=$_GET["use_lists"];}
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Lists Pass Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_LISTS_stats.php

@@ -48,6 +48,8 @@ if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_
 if (isset($_GET["campaigns_or_lists_rpt"]))				{$campaigns_or_lists_rpt=$_GET["campaigns_or_lists_rpt"];}
 	elseif (isset($_POST["campaigns_or_lists_rpt"]))	{$campaigns_or_lists_rpt=$_POST["campaigns_or_lists_rpt"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'Lists Statuses Report';
 $db_source = 'M';
 $JS_text="<script language='Javascript'>\n";

agc_2-X/trunk/www/vicidial/AST_LIST_UPDATEstats.php

@@ -41,6 +41,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))			{$DB=$_POST["DB"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'List Update Stats';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_OUTBOUNDsummary_interval.php

@@ -79,6 +79,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 $MT[0]='0';
 if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($include_rollover)<2) {$include_rollover='NO';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Outbound Summary Interval Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_VDADstats.php

@@ -111,6 +111,7 @@ if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($bottom_graph)<2) {$bottom_graph='NO';}
 if (strlen($carrier_stats)<2) {$carrier_stats='NO';}
 if (strlen($include_rollover)<2) {$include_rollover='NO';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Outbound Calling Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php

@@ -51,6 +51,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,enable_languages,language_method,source_id_display FROM system_settings;";

agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php

@@ -38,6 +38,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;";

agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php

@@ -62,6 +62,7 @@ $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
 $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
 $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #$vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|';
 $vicidial_listloader_fields = '|vendor_lead_code|source_id|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|rank|owner|';

agc_2-X/trunk/www/vicidial/AST_agentDIDstats.php

@@ -46,6 +46,7 @@ if (strlen($shift)<2) {$shift='ALL';}
 $report_name = 'Agent DID Report';
 $db_source = 'M';
 if ($file_download>0) {$DB="";}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php

@@ -71,6 +71,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Single Agent Daily';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_agent_days_time.php

@@ -48,6 +48,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Single Agent Daily Time';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_agent_debug_log_report.php

@@ -45,6 +45,8 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";

agc_2-X/trunk/www/vicidial/AST_agent_inbound_status.php

@@ -47,6 +47,7 @@ if (isset($_GET["show_defunct_users"]))				{$show_defunct_users=$_GET["show_defu
 
 if (strlen($shift)<2) {$shift='ALL';}
 if ($search_archived_data=="checked") {$closer_log_table="vicidial_closer_log_archive";} else {$closer_log_table="vicidial_closer_log";}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Agent Inbound Status Summary';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_agent_performance_detail.php

@@ -120,6 +120,7 @@ if (isset($_GET["show_defunct_users"]))				{$show_defunct_users=$_GET["show_defu
 
 if (strlen($shift)<2) {$shift='--';}
 if ($search_archived_data=="checked") {$agent_log_table="vicidial_agent_log_archive";} else {$agent_log_table="vicidial_agent_log";}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $TIME_HF_agentperfdetail = 'HF';
 $TIME_H_agentperfdetail = 'H';

agc_2-X/trunk/www/vicidial/AST_agent_performance_detail_SALES.php

@@ -77,8 +77,8 @@ if (isset($_GET["file_download"]))				{$file_download=$_GET["file_download"];}
 if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_display_type"];}
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
-
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Agent Performance Detail';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_agent_performance_detail_mobile.php

@@ -60,6 +60,7 @@ if (isset($_GET["show_defunct_users"]))				{$show_defunct_users=$_GET["show_defu
 
 if (strlen($shift)<2) {$shift='--';}
 if ($search_archived_data=="checked") {$agent_log_table="vicidial_agent_log_archive";} else {$agent_log_table="vicidial_agent_log";}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $TIME_HF_agentperfdetail = 'HF';
 $TIME_H_agentperfdetail = 'H';

agc_2-X/trunk/www/vicidial/AST_agent_status_detail.php

@@ -77,6 +77,7 @@ if (isset($_GET["show_defunct_users"]))				{$show_defunct_users=$_GET["show_defu
 	elseif (isset($_POST["show_defunct_users"]))	{$show_defunct_users=$_POST["show_defunct_users"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 if ($search_archived_data=="checked") {$agent_log_table="vicidial_agent_log_archive";} else {$agent_log_table="vicidial_agent_log";}
 
 $report_name = 'Agent Status Detail';

agc_2-X/trunk/www/vicidial/AST_agent_time_detail.php

@@ -106,6 +106,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 
 if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($stage)<2) {$stage='NAME';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 if ($search_archived_data=="checked") 
 	{

agc_2-X/trunk/www/vicidial/AST_agent_timeclock_detail.php

@@ -64,6 +64,7 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 if (strlen($shift)<2) {$shift='ALL';}
 if (strlen($stage)<2) {$stage='ID';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 require("screen_colors.php");
 

agc_2-X/trunk/www/vicidial/AST_campaign_status_list_report.php

@@ -70,6 +70,7 @@ if (!isset($query_date_D)) {$query_date_D=$NOW_DATE;}
 if (!isset($end_date_D)) {$end_date_D=$NOW_DATE;}
 if (!isset($query_date_T)) {$query_date_T="00:00:00";}
 if (!isset($end_date_T)) {$end_date_T="23:59:59";}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/AST_carrier_log_report.php

@@ -52,6 +52,8 @@ if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_display_type"];}
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";

agc_2-X/trunk/www/vicidial/AST_chat_log_report.php

@@ -64,8 +64,8 @@ if (isset($_GET["download_user"]))				{$download_user=$_GET["download_user"];}
 if (isset($_GET["download_manager"]))				{$download_manager=$_GET["download_manager"];}
 	elseif (isset($_POST["download_manager"]))	{$download_manager=$_POST["download_manager"];}
 
-
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Agent-Manager Chat Log';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_dial_log_report.php

@@ -156,6 +156,7 @@ if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 if (!isset($server_ip)) {$server_ip = array();}
 if (!isset($sip_hangup_cause)) {$sip_hangup_cause = array();}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/AST_dialer_inventory_report.php

@@ -70,6 +70,7 @@ $STARTtime = date("U");
 if (!isset($group)) {$group = array();}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 if (!isset($end_date)) {$end_date = $NOW_DATE;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 
 $report_name = 'Dialer Inventory Report';

agc_2-X/trunk/www/vicidial/AST_email_log_display.php

@@ -29,6 +29,8 @@ if (isset($_GET["email_row_id"]))	{$email_row_id=$_GET["email_row_id"];}
 if (isset($_GET["email_log_id"]))	{$email_log_id=$_GET["email_log_id"];}
 	elseif (isset($_POST["email_log_id"]))	{$email_log_id=$_POST["email_log_id"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
 header ("Pragma: no-cache");                          // HTTP/1.0

agc_2-X/trunk/www/vicidial/AST_email_log_report.php

@@ -70,6 +70,7 @@ if (isset($_GET["end_date"]))				{$end_date=$_GET["end_date"];}
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Email Log Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_hangup_cause_report.php

@@ -62,6 +62,7 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
 $START_TIME=date("U");
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/AST_inbound_daily_report.php

@@ -82,6 +82,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound Daily Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_inbound_forecasting.php

@@ -98,6 +98,7 @@ if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Inbound Forecasting Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_performance_comparison_report.php

@@ -61,6 +61,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Performance Comparison Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_quality_control_report.php

@@ -66,6 +66,8 @@ if (isset($_GET["search_archived_data"]))					{$search_archived_data=$_GET["sear
 if (isset($_GET["file_download"]))			{$file_download=$_GET["file_download"];}
 	elseif (isset($_POST["file_download"]))	{$file_download=$_POST["file_download"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'Quality Control Report';
 $db_source = 'M';
 $report_display_type="HTML";

agc_2-X/trunk/www/vicidial/AST_recording_log_report.php

@@ -54,6 +54,8 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name="Recording Access Log Report";
 $NOW_DATE = date("Y-m-d");
 if (!isset($users)) {$users=array();}

agc_2-X/trunk/www/vicidial/AST_rt_monitor_log_report.php

@@ -65,6 +65,7 @@ if (!isset($report_display_type)) {$report_display_type = "HTML";}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 if (!isset($end_date)) {$end_date = $NOW_DATE;}
 if (!isset($order_by)) {$order_by="monitor_start_time-asc";} 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Real-Time Monitoring Log Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_server_performance.php

@@ -53,6 +53,8 @@ if (isset($_GET["submit"]))				{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))				{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))	{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'Server Performance Report';
 $db_source = 'M';
 

agc_2-X/trunk/www/vicidial/AST_source_vlc_status_report.php

@@ -58,6 +58,7 @@ if (!isset($query_date_D)) {$query_date_D=$NOW_DATE;}
 if (!isset($end_date_D)) {$end_date_D=$NOW_DATE;}
 if (!isset($query_date_T)) {$query_date_T="00:00:00";}
 if (!isset($end_date_T)) {$end_date_T="23:59:59";}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/AST_team_performance_detail.php

@@ -73,6 +73,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 if (isset($_GET["show_all_users"]))			{$show_all_users=$_GET["show_all_users"];}
 	elseif (isset($_POST["show_all_users"]))	{$show_all_users=$_POST["show_all_users"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Team Performance Detail';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_timeonVDADall.php

@@ -125,10 +125,11 @@
 # 210615-2241 - Fix for issue #1314
 # 210618-1011 - Added CORS support
 # 210625-1432 - Added options.php RS_BargeSwap variable
+# 220217-2045 - Added input variable filters
 #
 
-$version = '2.14-110';
+$version = '2.14-111';
-$build = '210625-1432';
+$build = '220217-2045';
 $php_script='AST_timeonVDADall.php';
 
 require("dbconnect_mysqli.php");
@@ -252,6 +253,8 @@ if (isset($_GET["parkSTATS"]))			{$parkSTATS=$_GET["parkSTATS"];}
 if (isset($_GET["SLAinSTATS"]))				{$SLAinSTATS=$_GET["SLAinSTATS"];}
 	elseif (isset($_POST["SLAinSTATS"]))	{$SLAinSTATS=$_POST["SLAinSTATS"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 # defaults
 $RS_BargeSwap=0;
 
@@ -413,6 +416,46 @@ else
 	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
 	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
 	}
+$RR = preg_replace('/[^0-9]/', '', $RR);
+$inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $inbound);
+$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
+$groups[0] = preg_replace('/[^-_0-9a-zA-Z]/', '', $groups[0]);
+$usergroup = preg_replace('/[^-_0-9a-zA-Z]/', '', $usergroup);
+$DB = preg_replace('/[^0-9]/', '', $DB);
+$adastats = preg_replace('/[^-_0-9a-zA-Z]/', '', $adastats);
+$SIPmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $SIPmonitorLINK);
+$IAXmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $IAXmonitorLINK);
+$UGdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $UGdisplay);
+$UidORname = preg_replace('/[^-_0-9a-zA-Z]/', '', $UidORname);
+$orderby = preg_replace('/[^-_0-9a-zA-Z]/', '', $orderby);
+$SERVdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $SERVdisplay);
+$CALLSdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CALLSdisplay);
+$PHONEdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHONEdisplay);
+$CUSTPHONEdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CUSTPHONEdisplay);
+$CUSTINFOdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CUSTINFOdisplay);
+if ($CUSTINFOdisplay==1)	{$CUSTPHONEdisplay=0;}	# only one of these should be on at one time
+if ($CUSTPHONEdisplay==1)	{$CUSTINFOdisplay=0;}	# only one of these should be on at one time
+$NOLEADSalert = preg_replace('/[^-_0-9a-zA-Z]/', '', $NOLEADSalert);
+$DROPINGROUPstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $DROPINGROUPstats);
+$ALLINGROUPstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $ALLINGROUPstats);
+$with_inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $with_inbound);
+$monitor_active = preg_replace('/[^-_0-9a-zA-Z]/', '', $monitor_active);
+$monitor_phone = preg_replace('/[^-_0-9a-zA-Z]/', '', $monitor_phone);
+$CARRIERstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $CARRIERstats);
+$PRESETstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $PRESETstats);
+$AGENTtimeSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $AGENTtimeSTATS);
+$parkSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $parkSTATS);
+$SLAinSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $SLAinSTATS);
+$INGROUPcolorOVERRIDE = preg_replace('/[^-_0-9a-zA-Z]/', '', $INGROUPcolorOVERRIDE);
+$droppedOFtotal = preg_replace('/[^-_0-9a-zA-Z]/', '', $droppedOFtotal);
+$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type);
+$mobile_device = preg_replace('/[^-_0-9a-zA-Z]/', '', $mobile_device);
+$RTajax = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTajax);
+$RTpass = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTpass);
+$RTuser = preg_replace('/[^-_0-9a-zA-Z]/', '', $RTuser);
+$server_ip = preg_replace('/[^-\._0-9a-zA-Z]/', '', $server_ip);
+$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
+$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
 
 $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
 if ($DB) {echo "|$stmt|\n";}

agc_2-X/trunk/www/vicidial/AST_timeonVDADallREC.php

@@ -84,6 +84,7 @@ if (!isset($UGdisplay))		{$UGdisplay=0;}	# 0=no, 1=yes
 if (!isset($UidORname))		{$UidORname=0;}	# 0=id, 1=name
 if (!isset($orderby))		{$orderby='timeup';}
 if (!isset($SERVdisplay))	{$SERVdisplay=1;}	# 0=no, 1=yes
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 function get_server_load($windows = false) {
 $os = strtolower(PHP_OS);

agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY.php

@@ -57,6 +57,7 @@ if (isset($_GET["file_download"]))				{$file_download=$_GET["file_download"];}
 
 if (!isset($RR))			{$gRRroup=4;}
 if (!isset($types))			{$types='SHOW ALL CAMPAIGNS';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 
 $report_name = 'Real-Time Campaign Summary';

agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY_mobile.php

@@ -42,6 +42,7 @@ if (isset($_GET["browser_dimension"]))	{$browser_dimension=$_GET["browser_dimens
 if (!isset($browser_dimension))			{$browser_dimension=800;}
 if (!isset($types))			{$types='LIST ALL CAMPAIGNS';}
 $cell_dimension=floor($browser_dimension/10);
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Real-Time Campaign Summary';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_timeonVDADall_mobile.php

@@ -100,6 +100,7 @@ if (isset($_GET["RTdisplay_type"]))			{$RTdisplay_type=$_GET["RTdisplay_type"];}
 if (isset($_GET["mobile_device"]))				{$mobile_device=$_GET["mobile_device"];}
 	elseif (isset($_POST["mobile_device"]))	{$mobile_device=$_POST["mobile_device"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Real-Time Main Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_url_log_report.php

@@ -54,6 +54,7 @@ if (strlen($query_date_D) < 6) {$query_date_D = "00:00:00";}
 if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";}
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 if (!isset($url_type)) {$url_type = array();}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail.php

@@ -56,6 +56,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'User Group Hourly Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_user_group_hourly_detail_v2.php

@@ -61,6 +61,7 @@ if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'User Group Detail Hourly Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php

@@ -50,6 +50,8 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 if (isset($_GET["search_archived_data"]))			{$search_archived_data=$_GET["search_archived_data"];}
 	elseif (isset($_POST["search_archived_data"]))	{$search_archived_data=$_POST["search_archived_data"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $report_name = 'User Group Login Report';
 $db_source = 'M';
 

agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php

@@ -49,6 +49,7 @@ if (isset($_GET["submit"]))					{$submit=$_GET["submit"];}
 if (isset($_GET["SUBMIT"]))					{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))		{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php

@@ -52,6 +52,7 @@ if (isset($_GET["report_display_type"]))			{$report_display_type=$_GET["report_d
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
 $NOW_DATE = date("Y-m-d");
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 if (strlen($query_date_D) < 6) {$query_date_D = "00:00:00";}
 if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";}

agc_2-X/trunk/www/vicidial/DNCcom_inbound_filter.php

@@ -44,6 +44,8 @@ if (isset($_GET["in_filter_override"]))				{$in_filter_override=$_GET["in_filter
 if (isset($_GET["in_cache_override"]))			{$in_cache_override=$_GET["in_cache_override"];}
 	elseif (isset($_POST["in_cache_override"]))	{$in_cache_override=$_POST["in_cache_override"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable FROM system_settings;";

agc_2-X/trunk/www/vicidial/Erlang_report.php

@@ -98,6 +98,7 @@ if (isset($_GET["report_display_type"]))				{$report_display_type=$_GET["report_
 	elseif (isset($_POST["report_display_type"]))	{$report_display_type=$_POST["report_display_type"];}
 
 if (strlen($shift)<2) {$shift='ALL';}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $report_name = 'Advanced Forecasting Report';
 $db_source = 'M';

agc_2-X/trunk/www/vicidial/KHOMP_admin.php

@@ -102,6 +102,8 @@ if (isset($_GET["update_status"]))				{$update_status=$_GET["update_status"];}
 if (isset($_GET["update_dialstatus"]))				{$update_dialstatus=$_GET["update_dialstatus"];}
 	elseif (isset($_POST["update_dialstatus"]))	{$update_dialstatus=$_POST["update_dialstatus"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 $SQLdate = date("Y-m-d H:i:s");
 $date = date("r");
 $ip = getenv("REMOTE_ADDR");

agc_2-X/trunk/www/vicidial/QM_live_monitor.php

@@ -48,6 +48,7 @@ if (isset($_GET["extension"]))			{$extension=$_GET["extension"];}
 if (isset($_GET["stage"]))				{$stage=$_GET["stage"];}
 	elseif (isset($_POST["stage"]))		{$stage=$_POST["stage"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 $call = preg_replace('/[^0-9a-zA-Z]/', '', $call);
 $user = preg_replace('/[^0-9a-zA-Z]/', '', $user);
 $extension = preg_replace("/'|\"|\\\\|;/", '', $extension);

agc_2-X/trunk/www/vicidial/TCPAlitigatorlist_inbound_filter.php

@@ -37,6 +37,8 @@ if (isset($_GET["in_filter_override"]))				{$in_filter_override=$_GET["in_filter
 if (isset($_GET["in_cache_override"]))			{$in_cache_override=$_GET["in_cache_override"];}
 	elseif (isset($_POST["in_cache_override"]))	{$in_cache_override=$_POST["in_cache_override"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable FROM system_settings;";

agc_2-X/trunk/www/vicidial/admin.php

@@ -2704,6 +2704,7 @@ if (isset($_GET["pause_max_url"]))			{$pause_max_url=$_GET["pause_max_url"];}
 if (isset($_GET["agent_hide_hangup"]))			{$agent_hide_hangup=$_GET["agent_hide_hangup"];}
 	elseif (isset($_POST["agent_hide_hangup"]))	{$agent_hide_hangup=$_POST["agent_hide_hangup"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 if (isset($script_id)) {$script_id= mb_strtoupper($script_id,'utf-8');}
 if (isset($lead_filter_id)) {$lead_filter_id = mb_strtoupper($lead_filter_id,'utf-8');}
@@ -5819,12 +5820,13 @@ if ($SSscript_remove_js > 0)
 # 220215-1011 - Fix for XSS multi-script security issue
 # 220215-1431 - Additional XSS script text variable filtering
 # 220217-1727 - Added agent_hide_hangup system and campaign settings
+# 220217-2022 - Added input variable filtering
 #
 
 # make sure you have added a user to the vicidial_users MySQL table with at least user_level 9 to access this page the first time
 
-$admin_version = '2.14-846a';
+$admin_version = '2.14-847a';
-$build = '220217-1727';
+$build = '220217-2022';
 
 $STARTtime = date("U");
 $SQLdate = date("Y-m-d H:i:s");

agc_2-X/trunk/www/vicidial/admin_NANPA_updater.php

@@ -57,6 +57,7 @@ if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
 
 $block_scheduling_while_running=0;
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/admin_amm_multi.php

@@ -56,6 +56,7 @@ if (strlen($action) < 2)
 	{$action = 'BLANK';}
 if (strlen($DB) < 1)
 	{$DB=0;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/admin_bulk_tools.php

@@ -87,6 +87,7 @@ if (isset($_POST["USERdelete_from"]))				{$USERdelete_from=$_POST["USERdelete_fr
 if (isset($_POST["USERdelete_from_CONFIRMED"]))		{$USERdelete_from_CONFIRMED=$_POST["USERdelete_from_CONFIRMED"];}
 if (isset($_POST["DIDto_delete_TB"]))				{$DIDto_delete_TB=$_POST["DIDto_delete_TB"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 if ($DB) {echo "$form_to_run|";}
 

agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php

@@ -50,6 +50,7 @@ if (strlen($action) < 2)
 	{$action = 'BLANK';}
 if (strlen($DB) < 1)
 	{$DB=0;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/admin_email_accounts.php

@@ -95,6 +95,8 @@ if (isset($_GET["call_handle_method"]))						{$call_handle_method=$_GET["call_ha
 if (isset($_GET["agent_search_method"]))					{$agent_search_method=$_GET["agent_search_method"];}
 	elseif (isset($_POST["agent_search_method"]))			{$agent_search_method=$_POST["agent_search_method"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,allow_emails,allow_emails,level_8_disable_add,enable_languages,language_method,active_modules,enable_auto_reports FROM system_settings;";

agc_2-X/trunk/www/vicidial/admin_languages.php

@@ -82,6 +82,7 @@ else
 	}
 $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/admin_launch_trigger.php

@@ -31,6 +31,7 @@ if (isset($_GET["DB"]))						{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))			{$DB=$_POST["DB"];}
 
 $block_scheduling_while_running=0;
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php

@@ -204,6 +204,8 @@ if (isset($_GET["international_dnc_scrub"]))			{$international_dnc_scrub=$_GET["
 if (strlen($dedupe_statuses_override)>0) {
 	$dedupe_statuses=explode(",", $dedupe_statuses_override);
 }
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 # if the didnt select an over ride wipe out in_file
 if ( $list_id_override == "in_file" ) { $list_id_override = ""; }
 if ( $phone_code_override == "in_file" ) { $phone_code_override = ""; }

agc_2-X/trunk/www/vicidial/admin_lists_custom.php

@@ -1,7 +1,7 @@
 <?php
 # admin_lists_custom.php
 # 
-# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2022  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # this screen manages the custom lists fields in ViciDial
 #
@@ -56,10 +56,11 @@
 # 210211-0032 - Added SOURCESELECT field type
 # 210304-2039 - Added option to "re-rank" field ranks when adding/updating a field in the middle of the form
 # 210311-2338 - Added BUTTON field type and 2FA
+# 220217-2004 - Added input variable filtering
 #
 
-$admin_version = '2.14-47';
+$admin_version = '2.14-48';
-$build = '210311-2338';
+$build = '220217-2004';
 
 require("dbconnect_mysqli.php");
 require("functions.php");
@@ -123,6 +124,8 @@ if (isset($_GET["SUBMIT"]))						{$SUBMIT=$_GET["SUBMIT"];}
 if (isset($_GET["field_rerank"]))				{$field_rerank=$_GET["field_rerank"];}
 	elseif (isset($_POST["field_rerank"]))		{$field_rerank=$_POST["field_rerank"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,custom_fields_enabled,enable_languages,language_method,active_modules FROM system_settings;";

agc_2-X/trunk/www/vicidial/admin_mobile.php

@@ -154,6 +154,7 @@ if (!file_exists('old_clear'))
 
 if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 
 #############################################

agc_2-X/trunk/www/vicidial/admin_modify_lead.php

@@ -246,6 +246,7 @@ if ($archive_search=="Yes") {$vl_table="vicidial_list_archive";}
 else {$vl_table="vicidial_list"; $archive_search="No";}
 $altCIDdisplay="Yes";
 if ($CIDdisplay=="Yes") {$altCIDdisplay="No";} 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 $STARTtime = date("U");
 $TODAY = date("Y-m-d");

agc_2-X/trunk/www/vicidial/admin_phones_bulk_insert.php

@@ -73,6 +73,7 @@ if (strlen($action) < 2)
 	{$action = 'BLANK';}
 if (strlen($DB) < 1)
 	{$DB=0;}
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####

agc_2-X/trunk/www/vicidial/admin_search_lead.php

@@ -102,6 +102,8 @@ if (isset($_GET["archive_search"]))			{$archive_search=$_GET["archive_search"];}
 if (isset($_GET["called_count"]))			{$called_count=$_GET["called_count"];}
 	elseif (isset($_POST["called_count"]))	{$called_count=$_POST["called_count"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,qc_features_active FROM system_settings;";

agc_2-X/trunk/www/vicidial/admin_soundboard.php

@@ -85,6 +85,7 @@ if (isset($_GET["ConFiRm"]))					{$ConFiRm=$_GET["ConFiRm"];}
 if (isset($_GET["SUBMIT"]))						{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))			{$SUBMIT=$_POST["SUBMIT"];}
 
+$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####