ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

release 1.1.12

Browse Source 
git-svn-id: svn://192.168.202.10@10 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2006-07-07 15:30:10 +00:00
parent 8d319a6c2c
commit 398654d3d0
91 changed files with 4346 additions and 542 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_1-X/trunk/VICIDIAL_web/user_status.php
+11 -6
View File
@@ -3,6 +3,10 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60619-1738 - Added variable filtering to eliminate SQL injection attack threat
#
header ("Content-type: text/html; charset=utf-8");
@@ -26,6 +30,9 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
@@ -54,8 +61,6 @@ $browser = getenv("HTTP_USER_AGENT");
if($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name,change_agent_campaign from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -70,12 +75,12 @@ $browser = getenv("HTTP_USER_AGENT");
fclose($fp);
}
$stmt="SELECT full_name from vicidial_users where user='$user';";
$stmt="SELECT full_name from vicidial_users where user='" . mysql_real_escape_string($user) . "';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$full_name = $row[0];
$stmt="SELECT * from vicidial_live_agents where user='$user';";
$stmt="SELECT * from vicidial_live_agents where user='" . mysql_real_escape_string($user) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$agents_to_print = mysql_num_rows($rslt);
@@ -130,7 +135,7 @@ echo "<TR BGCOLOR=\"#F0F5FE\"><TD ALIGN=LEFT COLSPAN=2><FONT FACE=\"ARIAL,HELVET
if ($stage == "live_campaign_change")
{
$stmt="UPDATE vicidial_live_agents set campaign_id='$group' where user='$user';";
$stmt="UPDATE vicidial_live_agents set campaign_id='" . mysql_real_escape_string($group) . "' where user='" . mysql_real_escape_string($user) . "';";
$rslt=mysql_query($stmt, $link);
echo "Agent $user - $full_name changed to $group campaign<BR>\n";
@@ -140,7 +145,7 @@ if ($stage == "live_campaign_change")
if ($stage == "log_agent_out")
{
$stmt="DELETE from vicidial_live_agents where user='$user';";
$stmt="DELETE from vicidial_live_agents where user='" . mysql_real_escape_string($user) . "';";
$rslt=mysql_query($stmt, $link);
echo "Agent $user - $full_name has been emergency logged out, make sure they close their web browser<BR>\n";