ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added filtering to AGI processes to help prevent DID SQL injection attacks

Browse Source 
Added nanpa filtering log viewing to new NANPA updating process
Fixed span order in vicidial.php
Fixed issue with list webform overrides in agent interface
other small variable filtering fixes

git-svn-id: svn://192.168.202.10@2023 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2013-09-26 01:27:15 +00:00
parent 54857ff2d1
commit 446b80719a
16 changed files with 170 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/agi/agi-DID_route.agi
+5 -1
View File
@@ -1,6 +1,6 @@
#!/usr/bin/perl
#
# agi-DID_route.agi version 2.6
# agi-DID_route.agi version 2.8
#
# runs when a call comes into an inbound context on a trunk. This script will
# send the calls to various places depending on the settings for each DID.
@@ -30,6 +30,7 @@
# 120314-1112 - Fixed small filter bug
# 120430-2214 - Converted call to Monitor app to be asterisk 1.8 compatible
# 130108-1810 - Changes for Asterisk 1.8 compatibility
# 130925-1819 - Added variable filter to prevent DID SQL injection attack
#
$script = 'agi-DID_route.agi';
@@ -190,6 +191,9 @@ $calleridname =~ s/unknown|\'//gi;
if ( (!$callerid) or ($callerid =~ /unknown/) )
{$callerid = $calleridname;}
$callerid =~ s/\'|\"|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
$calleridname =~ s/\'|\"|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
$extension =~ s/\'|\"|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
### Grab DID values from the database
$DIDs_in_system=0;