ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added more variable filtering to admin web pages

Browse Source 
git-svn-id: svn://192.168.202.10@3555 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2022-01-22 22:06:31 +00:00
parent dd66ba053d
commit 478f7e4615
3 changed files with 27 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/vicidial/AST_agent_time_sheet.php
+7 -4
View File
@@ -1,7 +1,7 @@
<?php <?php
# AST_agent_time_sheet.php # AST_agent_time_sheet.php
# #
# Copyright (C) 2017 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2 # Copyright (C) 2022 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# #
# CHANGES # CHANGES
# #
@@ -27,6 +27,7 @@
# 160325-1428 - Changes for sidebar update # 160325-1428 - Changes for sidebar update
# 170409-1539 - Added IP List validation code # 170409-1539 - Added IP List validation code
# 170711-1102 - Added screen colors and fixed default date variable # 170711-1102 - Added screen colors and fixed default date variable
# 220122-1700 - Added more variable filtering
# #
$startMS = microtime(); $startMS = microtime();
@@ -100,19 +101,21 @@ else
} }
############# #############
$user=$agent;
if ($non_latin < 1) if ($non_latin < 1)
{ {
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$agent = preg_replace('/[^-_0-9a-zA-Z]/','',$agent);
} }
else else
{ {
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
$agent = preg_replace('/[^-_0-9\p{L}]/u','',$agent);
} }
$user=$agent;
$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";} if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link); $rslt=mysql_to_mysqli($stmt, $link);
@@ -180,10 +183,10 @@ else
exit; exit;
} }
$agent = preg_replace('/[^-_0-9a-zA-Z]/', '', $agent);
$query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date); $query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date);
$calls_summary = preg_replace('/[^-_0-9a-zA-Z]/', '', $calls_summary); $calls_summary = preg_replace('/[^-_0-9a-zA-Z]/', '', $calls_summary);
$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download); $file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
$NOW_DATE = date("Y-m-d"); $NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s"); $NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U"); $STARTtime = date("U");
agc_2-X/trunk/www/vicidial/admin.php
+12 -8
View File
@@ -1,7 +1,7 @@
<?php <?php
# admin.php - VICIDIAL administration page # admin.php - VICIDIAL administration page
# #
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2 # Copyright (C) 2022 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# #
$startMS = microtime(); $startMS = microtime();
@@ -3186,6 +3186,9 @@ $agent_hidden_sound_seconds = preg_replace('/[^0-9]/','',$agent_hidden_sound_sec
$in_man_dial_next_ready_seconds = preg_replace('/[^0-9]/','',$in_man_dial_next_ready_seconds); $in_man_dial_next_ready_seconds = preg_replace('/[^0-9]/','',$in_man_dial_next_ready_seconds);
$call_limit_24hour = preg_replace('/[^0-9]/','',$call_limit_24hour); $call_limit_24hour = preg_replace('/[^0-9]/','',$call_limit_24hour);
$download_invalid_files = preg_replace('/[^0-9]/','',$download_invalid_files); $download_invalid_files = preg_replace('/[^0-9]/','',$download_invalid_files);
$modify_email_accounts = preg_replace('/[^0-9]/','',$modify_email_accounts);
$access_recordings = preg_replace('/[^0-9]/','',$access_recordings);
$agentcall_email = preg_replace('/[^0-9]/','',$agentcall_email);
$user_new_lead_limit = preg_replace('/[^-0-9]/','',$user_new_lead_limit); $user_new_lead_limit = preg_replace('/[^-0-9]/','',$user_new_lead_limit);
$drop_call_seconds = preg_replace('/[^-0-9]/','',$drop_call_seconds); $drop_call_seconds = preg_replace('/[^-0-9]/','',$drop_call_seconds);
@@ -5765,12 +5768,13 @@ if ($SSscript_remove_js > 0)
# 211217-0732 - Fixes for PHP8, issue #1341 # 211217-0732 - Fixes for PHP8, issue #1341
# 220118-1944 - Added auto_alt_threshold option for campaigns and override option for lists # 220118-1944 - Added auto_alt_threshold option for campaigns and override option for lists
# 220120-0902 - Added download_invalid_files user option # 220120-0902 - Added download_invalid_files user option
# 220122-1659 - Added more variable filtering, updated copyright year to 2022
# #
# make sure you have added a user to the vicidial_users MySQL table with at least user_level 9 to access this page the first time # make sure you have added a user to the vicidial_users MySQL table with at least user_level 9 to access this page the first time
$admin_version = '2.14-840a'; $admin_version = '2.14-841a';
$build = '220120-0902'; $build = '220122-1659';
$STARTtime = date("U"); $STARTtime = date("U");
$SQLdate = date("Y-m-d H:i:s"); $SQLdate = date("Y-m-d H:i:s");
@@ -5841,7 +5845,7 @@ if ($force_logout)
echo "<head>\n"; echo "<head>\n";
echo "<!-- Logout screen $PHP_SELF -->\n"; echo "<!-- Logout screen $PHP_SELF -->\n";
echo "<META NAME=\"ROBOTS\" CONTENT=\"NONE\">\n"; echo "<META NAME=\"ROBOTS\" CONTENT=\"NONE\">\n";
echo "<META NAME=\"COPYRIGHT\" CONTENT=\"&copy; 2021 ViciDial Group\">\n"; echo "<META NAME=\"COPYRIGHT\" CONTENT=\"&copy; 2022 ViciDial Group\">\n";
echo "<META NAME=\"AUTHOR\" CONTENT=\"ViciDial Group\">\n"; echo "<META NAME=\"AUTHOR\" CONTENT=\"ViciDial Group\">\n";
?> ?>
<script type="text/javascript"> <script type="text/javascript">
@@ -6376,7 +6380,7 @@ echo "<html>\n";
echo "<head>\n"; echo "<head>\n";
echo "<!-- VERSION: $admin_version BUILD: $build ADD: $ADD PHP_SELF: $PHP_SELF-->\n"; echo "<!-- VERSION: $admin_version BUILD: $build ADD: $ADD PHP_SELF: $PHP_SELF-->\n";
echo "<META NAME=\"ROBOTS\" CONTENT=\"NONE\">\n"; echo "<META NAME=\"ROBOTS\" CONTENT=\"NONE\">\n";
echo "<META NAME=\"COPYRIGHT\" CONTENT=\"&copy; 2021 ViciDial Group\">\n"; echo "<META NAME=\"COPYRIGHT\" CONTENT=\"&copy; 2022 ViciDial Group\">\n";
echo "<META NAME=\"AUTHOR\" CONTENT=\"ViciDial Group\">\n"; echo "<META NAME=\"AUTHOR\" CONTENT=\"ViciDial Group\">\n";
echo "<script language=\"JavaScript\" src=\"calendar_db.js\"></script>\n"; echo "<script language=\"JavaScript\" src=\"calendar_db.js\"></script>\n";
echo "<script language=\"JavaScript\" src=\"help.js\"></script>\n"; echo "<script language=\"JavaScript\" src=\"help.js\"></script>\n";
@@ -48289,7 +48293,7 @@ if ($ADD==999995)
echo "<br><B> "._QXZ("Welcome to ViciDial: copyright, trademark and license page")."</B><BR><BR>\n"; echo "<br><B> "._QXZ("Welcome to ViciDial: copyright, trademark and license page")."</B><BR><BR>\n";
echo "<center><TABLE width=$section_width cellspacing=5 cellpadding=2>\n"; echo "<center><TABLE width=$section_width cellspacing=5 cellpadding=2>\n";
echo "<tr bgcolor=#$SSstd_row4_background><td align=right valign=top><B><font size=3>"._QXZ("Copyright").": </B></td><td align=left> &nbsp; "._QXZ("The ViciDial Contact Center Suite is maintained by the")." <a href=\"http://www.vicidial.com/\" target=\"_blank\">ViciDial Group</a>, &copy; 2021</td></tr>\n"; echo "<tr bgcolor=#$SSstd_row4_background><td align=right valign=top><B><font size=3>"._QXZ("Copyright").": </B></td><td align=left> &nbsp; "._QXZ("The ViciDial Contact Center Suite is maintained by the")." <a href=\"http://www.vicidial.com/\" target=\"_blank\">ViciDial Group</a>, &copy; 2022</td></tr>\n";
echo "<tr bgcolor=#$SSstd_row4_background><td align=right valign=top><B><font size=3>"._QXZ("Trademark").": </B></td><td align=left> &nbsp; \"VICIDIAL\" "._QXZ("is a registered trademark of the")." <a href=\"http://www.vicidial.com/\" target=\"_blank\">ViciDial Group</a>. Here is our <a href=\"http://www.vicidial.com/?page_id=262\" target=\"_blank\">"._QXZ("trademark use policy")."</a></td></tr>\n"; echo "<tr bgcolor=#$SSstd_row4_background><td align=right valign=top><B><font size=3>"._QXZ("Trademark").": </B></td><td align=left> &nbsp; \"VICIDIAL\" "._QXZ("is a registered trademark of the")." <a href=\"http://www.vicidial.com/\" target=\"_blank\">ViciDial Group</a>. Here is our <a href=\"http://www.vicidial.com/?page_id=262\" target=\"_blank\">"._QXZ("trademark use policy")."</a></td></tr>\n";
@@ -48309,7 +48313,7 @@ if ($ADD==999995)
echo "<center><TABLE width=$section_width cellspacing=5 cellpadding=2>\n"; echo "<center><TABLE width=$section_width cellspacing=5 cellpadding=2>\n";
echo "<tr bgcolor=#$SSstd_row4_background><td align=right valign=middle rowspan=3 nowrap><B><font size=3>"._QXZ("Matex").": </B></td>"; echo "<tr bgcolor=#$SSstd_row4_background><td align=right valign=middle rowspan=3 nowrap><B><font size=3>"._QXZ("Matex").": </B></td>";
echo "<td align=right valign=top><B><font size=2>"._QXZ("Copyright").": </B></td><td align=left><font size=1> &nbsp; "._QXZ("Matex PHP Mathematical expression parser and evaluator library was written by Dorin Marcoci").", &copy; 2021</td></tr>\n"; echo "<td align=right valign=top><B><font size=2>"._QXZ("Copyright").": </B></td><td align=left><font size=1> &nbsp; "._QXZ("Matex PHP Mathematical expression parser and evaluator library was written by Dorin Marcoci").", &copy; 2022</td></tr>\n";
echo "<tr bgcolor=#$SSstd_row4_background><td align=right valign=top><B><font size=2>"._QXZ("License").": </B></td><td align=left><font size=1> &nbsp; "._QXZ("Matex is licensed under the")." <a href=\"https://github.com/madorin/matex/blob/master/LICENSE.md\" target=\"_blank\">MIT "._QXZ("open source license")."</a></td></tr>\n"; echo "<tr bgcolor=#$SSstd_row4_background><td align=right valign=top><B><font size=2>"._QXZ("License").": </B></td><td align=left><font size=1> &nbsp; "._QXZ("Matex is licensed under the")." <a href=\"https://github.com/madorin/matex/blob/master/LICENSE.md\" target=\"_blank\">MIT "._QXZ("open source license")."</a></td></tr>\n";
echo "<tr bgcolor=#$SSstd_row4_background><td align=right valign=top nowrap><B><font size=2>"._QXZ("Source Code").": </B></td><td align=left><font size=1> &nbsp; "._QXZ("Matex original source code is available at")." <a href=\"https://github.com/madorin/matex\" target=\"_blank\">"._QXZ("this link")."</a>.</td></tr>\n"; echo "<tr bgcolor=#$SSstd_row4_background><td align=right valign=top nowrap><B><font size=2>"._QXZ("Source Code").": </B></td><td align=left><font size=1> &nbsp; "._QXZ("Matex original source code is available at")." <a href=\"https://github.com/madorin/matex\" target=\"_blank\">"._QXZ("this link")."</a>.</td></tr>\n";
@@ -49473,7 +49477,7 @@ echo "<FONT STYLE=\"font-family:HELVETICA;font-size:9;color:white;\"><br><br><!-
echo _QXZ("VERSION").": $admin_version<BR>"; echo _QXZ("VERSION").": $admin_version<BR>";
echo _QXZ("BUILD").": $build\n"; echo _QXZ("BUILD").": $build\n";
if (!preg_match("/_BUILD_/",$SShosted_settings)) if (!preg_match("/_BUILD_/",$SShosted_settings))
{echo "<BR><a href=\"$PHP_SELF?ADD=999995\"><font color=white>&copy; 2021 ViciDial Group</font></a><BR><img src=\"images/pixel.gif\">";} {echo "<BR><a href=\"$PHP_SELF?ADD=999995\"><font color=white>&copy; 2022 ViciDial Group</font></a><BR><img src=\"images/pixel.gif\">";}
echo "</FONT>\n"; echo "</FONT>\n";
?> ?>
agc_2-X/trunk/www/vicidial/user_stats.php
+8 -2
View File
@@ -1,7 +1,7 @@
<?php <?php
# user_stats.php # user_stats.php
# #
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2 # Copyright (C) 2022 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# #
# CHANGES # CHANGES
# #
@@ -64,6 +64,7 @@
# 200702-1710 - Added ANI to INBOUND/CLOSER records for NVAuser, added secondary check to find lead ID for DIDs # 200702-1710 - Added ANI to INBOUND/CLOSER records for NVAuser, added secondary check to find lead ID for DIDs
# 210317-0058 - Changed lead-modify page links to javascript because of Chrome # 210317-0058 - Changed lead-modify page links to javascript because of Chrome
# 210319-1338 - Added HELP pop-ups for each section, added agent browser visibility log stats to agent activity section, reformatted most sections # 210319-1338 - Added HELP pop-ups for each section, added agent browser visibility log stats to agent activity section, reformatted most sections
# 220122-1701 - Added more variable filtering
# #
$startMS = microtime(); $startMS = microtime();
@@ -197,11 +198,13 @@ if ($non_latin < 1)
{ {
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$NVAuser = preg_replace('/[^-_0-9a-zA-Z]/','',$NVAuser);
} }
else else
{ {
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
$NVAuser = preg_replace('/[^-_0-9\p{L}]/u','',$NVAuser);
} }
$did_id = preg_replace("/'|\"|\\\\|;/","",$did_id); $did_id = preg_replace("/'|\"|\\\\|;/","",$did_id);
$did = preg_replace("/'|\"|\\\\|;/","",$did); $did = preg_replace("/'|\"|\\\\|;/","",$did);
@@ -209,7 +212,10 @@ $begin_date = preg_replace("/'|\"|\\\\|;/","",$begin_date);
$end_date = preg_replace("/'|\"|\\\\|;/","",$end_date); $end_date = preg_replace("/'|\"|\\\\|;/","",$end_date);
$user = preg_replace("/'|\"|\\\\|;/","",$user); $user = preg_replace("/'|\"|\\\\|;/","",$user);
$call_status = preg_replace("/'|\"|\\\\|;/","",$call_status); $call_status = preg_replace("/'|\"|\\\\|;/","",$call_status);
$NVAuser = preg_replace("/'|\"|\\\\|;/","",$NVAuser); $file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
$pause_code_rpt = preg_replace('/[^-_0-9a-zA-Z]/', '', $pause_code_rpt);
$park_rpt = preg_replace('/[^-_0-9a-zA-Z]/', '', $park_rpt);
$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data);
if ($call_status != "") if ($call_status != "")
{ {