ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

release 1.1.12

Browse Source 
git-svn-id: svn://192.168.202.10@10 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2006-07-07 15:30:10 +00:00
parent 8d319a6c2c
commit 398654d3d0
91 changed files with 4346 additions and 542 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_1-X/trunk/astguiclient_web/admin.php
+108 -7
View File
@@ -5,6 +5,7 @@
#
# AST GUI database administration
#
# CHANGES
# 50913-1118 - Added outbound_cid for web-client calls
# 50926-1356 - Modified to allow for language translation
# 50926-1613 - Added WeBRooTWritablE write controls
@@ -13,10 +14,11 @@
# 51213-1650 - Added option to delete phones if allowed by vicidial_users
# 60421-1430 - check GET/POST vars lines with isset to not trigger PHP NOTICES
# 60427-1137 - Fixed phone search bug
# 60620-1243 - Added variable filtering to eliminate SQL injection attack threat
#
$version = '1.1.10-3';
$build = '60427-1137';
$version = '1.1.12';
$build = '60620-1243';
require("dbconnect.php");
@@ -31,10 +33,6 @@ if (isset($_GET["pass"])) {$pass=$_GET["pass"];}
elseif (isset($_POST["pass"])) {$pass=$_POST["pass"];}
if (isset($_GET["full_name"])) {$full_name=$_GET["full_name"];}
elseif (isset($_POST["full_name"])) {$full_name=$_POST["full_name"];}
if (isset($_GET["user_level"])) {$user_level=$_GET["user_level"];}
elseif (isset($_POST["user_level"])) {$user_level=$_POST["user_level"];}
if (isset($_GET["group"])) {$group=$_GET["group"];}
elseif (isset($_POST["group"])) {$group=$_POST["group"];}
if (isset($_GET["status"])) {$status=$_GET["status"];}
elseif (isset($_POST["status"])) {$status=$_POST["status"];}
if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];}
@@ -200,6 +198,109 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
if (isset($_GET["CoNfIrM"])) {$CoNfIrM=$_GET["CoNfIrM"];}
elseif (isset($_POST["CoNfIrM"])) {$CoNfIrM=$_POST["CoNfIrM"];}
##### BEGIN VARIABLE FILTERING FOR SECURITY #####
### DIGITS and Dots
$phone_ip = ereg_replace("[^\.0-9]","",$phone_ip);
$server_ip = ereg_replace("[^\.0-9]","",$server_ip);
$old_server_ip = ereg_replace("[^\.0-9]","",$old_server_ip);
$computer_ip = ereg_replace("[^\.0-9]","",$computer_ip);
### Y or N ONLY ###
$active = ereg_replace("[^NY]","",$active);
### DIGITS ONLY ###
$dialplan_number = ereg_replace("[^0-9]","",$dialplan_number);
$voicemail_id = ereg_replace("[^0-9]","",$voicemail_id);
$outbound_cid = ereg_replace("[^0-9]","",$outbound_cid);
$VICIDIAL_park_on_extension = ereg_replace("[^0-9]","",$VICIDIAL_park_on_extension);
$park_on_extension = ereg_replace("[^0-9]","",$park_on_extension);
$conf_on_extension = ereg_replace("[^0-9]","",$conf_on_extension);
$conf_exten = ereg_replace("[^0-9]","",$conf_exten);
$old_conf_exten = ereg_replace("[^0-9]","",$old_conf_exten);
$voicemail_exten = ereg_replace("[^0-9]","",$voicemail_exten);
$voicemail_dump_exten = ereg_replace("[^0-9]","",$voicemail_dump_exten);
$recording_exten = ereg_replace("[^0-9]","",$recording_exten);
$monitor_prefix = ereg_replace("[^0-9]","",$monitor_prefix);
$answer_transfer_agent = ereg_replace("[^0-9]","",$answer_transfer_agent);
$DBX_port = ereg_replace("[^0-9]","",$DBX_port);
$DBY_port = ereg_replace("[^0-9]","",$DBY_port);
$telnet_port = ereg_replace("[^0-9]","",$telnet_port);
$max_vicidial_trunks = ereg_replace("[^0-9]","",$max_vicidial_trunks);
$auto_dial_next_number = ereg_replace("[^0-9]","",$auto_dial_next_number);
$VDstop_rec_after_each_call = ereg_replace("[^0-9]","",$VDstop_rec_after_each_call);
$enable_persistant_mysql = ereg_replace("[^0-9]","",$enable_persistant_mysql);
$enable_fast_refresh = ereg_replace("[^0-9]","",$enable_fast_refresh);
$user_switching_enabled = ereg_replace("[^0-9]","",$user_switching_enabled);
$updater_check_enabled = ereg_replace("[^0-9]","",$updater_check_enabled);
$QUEUE_ACTION_enabled = ereg_replace("[^0-9]","",$QUEUE_ACTION_enabled);
$conferencing_enabled = ereg_replace("[^0-9]","",$conferencing_enabled);
$voicemail_button_enabled = ereg_replace("[^0-9]","",$voicemail_button_enabled);
$CallerID_popup_enabled = ereg_replace("[^0-9]","",$CallerID_popup_enabled);
$call_parking_enabled = ereg_replace("[^0-9]","",$call_parking_enabled);
$AGI_call_logging_enabled = ereg_replace("[^0-9]","",$AGI_call_logging_enabled);
$AFLogging_enabled = ereg_replace("[^0-9]","",$AFLogging_enabled);
$admin_monitor_enabled = ereg_replace("[^0-9]","",$admin_monitor_enabled);
$admin_hijack_enabled = ereg_replace("[^0-9]","",$admin_hijack_enabled);
$admin_hangup_enabled = ereg_replace("[^0-9]","",$admin_hangup_enabled);
$fast_refresh_rate = ereg_replace("[^0-9]","",$fast_refresh_rate);
$ADD = ereg_replace("[^0-9]","",$ADD);
### ALPHA-NUMERIC and underscore and dash and slash and at and dot
$extension = ereg_replace("[^-\.\:\/\@\_0-9a-zA-Z]","",$extension);
$old_extension = ereg_replace("[^-\.\:\/\@\_0-9a-zA-Z]","",$old_extension);
$install_directory = ereg_replace("[^-\.\:\/\@\_0-9a-zA-Z]","",$install_directory);
$client_browser = ereg_replace("[^-\.\:\/\@\_0-9a-zA-Z]","",$client_browser);
$dtmf_send_extension = ereg_replace("[^-\.\:\/\@\_0-9a-zA-Z]","",$dtmf_send_extension);
$call_out_number_group = ereg_replace("[^-\.\:\/\@\_0-9a-zA-Z]","",$call_out_number_group);
$telnet_host = ereg_replace("[^-\.\:\/\@\_0-9a-zA-Z]","",$telnet_host);
$DBX_server = ereg_replace("[^-\.\:\/\@\_0-9a-zA-Z]","",$DBX_server);
$DBY_server = ereg_replace("[^-\.\:\/\@\_0-9a-zA-Z]","",$DBY_server);
### ALPHA-NUMERIC (and underscore and dash)
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$login = ereg_replace("[^-\_0-9a-zA-Z]","",$login);
$user = ereg_replace("[^-\_0-9a-zA-Z]","",$user);
$pass = ereg_replace("[^-\_0-9a-zA-Z]","",$pass);
$status = ereg_replace("[^-\_0-9a-zA-Z]","",$status);
$protocol = ereg_replace("[^-\_0-9a-zA-Z]","",$protocol);
$ASTmgrUSERNAMEupdate = ereg_replace("[^-\_0-9a-zA-Z]","",$ASTmgrUSERNAMEupdate);
$ASTmgrUSERNAMEsend = ereg_replace("[^-\_0-9a-zA-Z]","",$ASTmgrUSERNAMEsend);
$ASTmgrUSERNAMElisten = ereg_replace("[^-\_0-9a-zA-Z]","",$ASTmgrUSERNAMElisten);
$ASTmgrUSERNAME = ereg_replace("[^-\_0-9a-zA-Z]","",$ASTmgrUSERNAME);
$ASTmgrSECRET = ereg_replace("[^-\_0-9a-zA-Z]","",$ASTmgrSECRET);
$login_user = ereg_replace("[^-\_0-9a-zA-Z]","",$login_user);
$login_pass = ereg_replace("[^-\_0-9a-zA-Z]","",$login_pass);
$login_campaign = ereg_replace("[^-\_0-9a-zA-Z]","",$login_campaign);
$DBX_user = ereg_replace("[^-\_0-9a-zA-Z]","",$DBX_user);
$DBY_user = ereg_replace("[^-\_0-9a-zA-Z]","",$DBY_user);
$DBX_pass = ereg_replace("[^-\_0-9a-zA-Z]","",$DBX_pass);
$DBY_pass = ereg_replace("[^-\_0-9a-zA-Z]","",$DBY_pass);
$DBX_database = ereg_replace("[^-\_0-9a-zA-Z]","",$DBX_database);
$DBY_database = ereg_replace("[^-\_0-9a-zA-Z]","",$DBY_database);
$VICIDIAL_park_on_filename = ereg_replace("[^-\_0-9a-zA-Z]","",$VICIDIAL_park_on_filename);
$server_id = ereg_replace("[^-\_0-9a-zA-Z]","",$server_id);
$old_server_id = ereg_replace("[^-\_0-9a-zA-Z]","",$old_server_id);
$ext_context = ereg_replace("[^-\_0-9a-zA-Z]","",$ext_context);
$CoNfIrM = ereg_replace("[^-\_0-9a-zA-Z]","",$CoNfIrM);
### ALPHA-NUMERIC and spaces dots, commas, dashes, underscores
$phone_type = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$phone_type);
$full_name = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$full_name);
$fullname = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$fullname);
$company = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$company);
$picture = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$picture);
$local_gmt = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$local_gmt);
$server_description = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$server_description);
$asterisk_version = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$asterisk_version);
### VARIABLES TO BE mysql_real_escape_string ###
# $VICIDIAL_web_URL =
# $local_web_callerID_URL =
##### END VARIABLE FILTERING FOR SECURITY #####
if ($force_logout)
{
if( (strlen($PHP_AUTH_USER)>0) or (strlen($PHP_AUTH_PW)>0) )
@@ -1284,7 +1385,7 @@ if ($ADD==4)
{
echo "<br>PHONE MODIFIED: $extension\n";
$stmt="UPDATE phones set extension='$extension', dialplan_number='$dialplan_number', voicemail_id='$voicemail_id', phone_ip='$phone_ip', computer_ip='$computer_ip', server_ip='$server_ip', login='$login', pass='$pass', status='$status', active='$active', phone_type='$phone_type', fullname='$fullname', company='$company', picture='$picture', protocol='$protocol', local_gmt='$local_gmt', ASTmgrUSERNAME='$ASTmgrUSERNAME', ASTmgrSECRET='$ASTmgrSECRET', login_user='$login_user', login_pass='$login_pass', login_campaign='$login_campaign', park_on_extension='$park_on_extension', conf_on_extension='$conf_on_extension', VICIDIAL_park_on_extension='$VICIDIAL_park_on_extension', VICIDIAL_park_on_filename='$VICIDIAL_park_on_filename', monitor_prefix='$monitor_prefix', recording_exten='$recording_exten', voicemail_exten='$voicemail_exten', voicemail_dump_exten='$voicemail_dump_exten', ext_context='$ext_context', dtmf_send_extension='$dtmf_send_extension', call_out_number_group='$call_out_number_group', client_browser='$client_browser', install_directory='$install_directory', local_web_callerID_URL='$local_web_callerID_URL', VICIDIAL_web_URL='$VICIDIAL_web_URL', AGI_call_logging_enabled='$AGI_call_logging_enabled', user_switching_enabled='$user_switching_enabled', conferencing_enabled='$conferencing_enabled', admin_hangup_enabled='$admin_hangup_enabled', admin_hijack_enabled='$admin_hijack_enabled', admin_monitor_enabled='$admin_monitor_enabled', call_parking_enabled='$call_parking_enabled', updater_check_enabled='$updater_check_enabled', AFLogging_enabled='$AFLogging_enabled', QUEUE_ACTION_enabled='$QUEUE_ACTION_enabled', CallerID_popup_enabled='$CallerID_popup_enabled', voicemail_button_enabled='$voicemail_button_enabled', enable_fast_refresh='$enable_fast_refresh', fast_refresh_rate='$fast_refresh_rate', enable_persistant_mysql='$enable_persistant_mysql', auto_dial_next_number='$auto_dial_next_number', VDstop_rec_after_each_call='$VDstop_rec_after_each_call', DBX_server='$DBX_server', DBX_database='$DBX_database', DBX_user='$DBX_user', DBX_pass='$DBX_pass', DBX_port='$DBX_port', DBY_server='$DBY_server', DBY_database='$DBY_database', DBY_user='$DBY_user', DBY_pass='$DBY_pass', DBY_port='$DBY_port', outbound_cid='$outbound_cid' where extension='$old_extension' and server_ip='$old_server_ip';";
$stmt="UPDATE phones set extension='$extension', dialplan_number='$dialplan_number', voicemail_id='$voicemail_id', phone_ip='$phone_ip', computer_ip='$computer_ip', server_ip='$server_ip', login='$login', pass='$pass', status='$status', active='$active', phone_type='$phone_type', fullname='$fullname', company='$company', picture='$picture', protocol='$protocol', local_gmt='$local_gmt', ASTmgrUSERNAME='$ASTmgrUSERNAME', ASTmgrSECRET='$ASTmgrSECRET', login_user='$login_user', login_pass='$login_pass', login_campaign='$login_campaign', park_on_extension='$park_on_extension', conf_on_extension='$conf_on_extension', VICIDIAL_park_on_extension='$VICIDIAL_park_on_extension', VICIDIAL_park_on_filename='$VICIDIAL_park_on_filename', monitor_prefix='$monitor_prefix', recording_exten='$recording_exten', voicemail_exten='$voicemail_exten', voicemail_dump_exten='$voicemail_dump_exten', ext_context='$ext_context', dtmf_send_extension='$dtmf_send_extension', call_out_number_group='$call_out_number_group', client_browser='$client_browser', install_directory='$install_directory', local_web_callerID_URL='" . mysql_real_escape_string($local_web_callerID_URL) . "', VICIDIAL_web_URL='" . mysql_real_escape_string($VICIDIAL_web_URL) . "', AGI_call_logging_enabled='$AGI_call_logging_enabled', user_switching_enabled='$user_switching_enabled', conferencing_enabled='$conferencing_enabled', admin_hangup_enabled='$admin_hangup_enabled', admin_hijack_enabled='$admin_hijack_enabled', admin_monitor_enabled='$admin_monitor_enabled', call_parking_enabled='$call_parking_enabled', updater_check_enabled='$updater_check_enabled', AFLogging_enabled='$AFLogging_enabled', QUEUE_ACTION_enabled='$QUEUE_ACTION_enabled', CallerID_popup_enabled='$CallerID_popup_enabled', voicemail_button_enabled='$voicemail_button_enabled', enable_fast_refresh='$enable_fast_refresh', fast_refresh_rate='$fast_refresh_rate', enable_persistant_mysql='$enable_persistant_mysql', auto_dial_next_number='$auto_dial_next_number', VDstop_rec_after_each_call='$VDstop_rec_after_each_call', DBX_server='$DBX_server', DBX_database='$DBX_database', DBX_user='$DBX_user', DBX_pass='$DBX_pass', DBX_port='$DBX_port', DBY_server='$DBY_server', DBY_database='$DBY_database', DBY_user='$DBY_user', DBY_pass='$DBY_pass', DBY_port='$DBY_port', outbound_cid='$outbound_cid' where extension='$old_extension' and server_ip='$old_server_ip';";
$rslt=mysql_query($stmt, $link);
}
}