From 4988291dcbacced20ae24b0794fa2048a18dd4a5 Mon Sep 17 00:00:00 2001 From: mattf Date: Thu, 30 Apr 2015 10:50:14 +0000 Subject: [PATCH] Added User API functions restrictions and API within-allowed-campaigns list ID restrictions git-svn-id: svn://192.168.202.10@2314 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/trunk/UPGRADE | 4 + agc_2-X/trunk/docs/AGENT_API.txt | 3 +- agc_2-X/trunk/docs/NON-AGENT_API.txt | 9 +- .../trunk/extras/MySQL_AST_CREATE_tables.sql | 6 +- agc_2-X/trunk/extras/upgrade_2.12.sql | 5 + agc_2-X/trunk/www/agc/api.php | 229 +++++++++- agc_2-X/trunk/www/vicidial/admin.php | 49 +- agc_2-X/trunk/www/vicidial/help.php | 20 +- agc_2-X/trunk/www/vicidial/non_agent_api.php | 422 +++++++++++++++--- 9 files changed, 658 insertions(+), 89 deletions(-) diff --git a/agc_2-X/trunk/UPGRADE b/agc_2-X/trunk/UPGRADE index 8dec8e39..91769c4c 100644 --- a/agc_2-X/trunk/UPGRADE +++ b/agc_2-X/trunk/UPGRADE @@ -65,6 +65,10 @@ OTHER CHANGES: 3. Added option to populate the entry_list_id from the DID when routing to an In-Group +4. Added agent screen webform 3 feature + +5. Added user API restrictions for allowed lists and allowed API functions + diff --git a/agc_2-X/trunk/docs/AGENT_API.txt b/agc_2-X/trunk/docs/AGENT_API.txt index 35639f14..80a2a6d4 100644 --- a/agc_2-X/trunk/docs/AGENT_API.txt +++ b/agc_2-X/trunk/docs/AGENT_API.txt @@ -1,4 +1,4 @@ -AGENT API DOCUMENT Started: 2008-07-03 Updated: 2015-03-13 +AGENT API DOCUMENT Started: 2008-07-03 Updated: 2015-04-29 This document describes the functions of an API(Application Programming Interface) for the VICIDIAL Agent screen. This functionality will be rather limited at first @@ -63,6 +63,7 @@ Response to calls will return either an ERROR or a SUCCESS along with an explana for example: SUCCESS: external_status function set - 6666|A ERROR: agent_user is not logged in - 6666 +ERROR: auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION - 6666|webserver|ADMIN diff --git a/agc_2-X/trunk/docs/NON-AGENT_API.txt b/agc_2-X/trunk/docs/NON-AGENT_API.txt index 26abb0b2..7e9930b1 100644 --- a/agc_2-X/trunk/docs/NON-AGENT_API.txt +++ b/agc_2-X/trunk/docs/NON-AGENT_API.txt @@ -1,4 +1,4 @@ -NON-AGENT API DOCUMENT Started: 2008-07-24 Updated: 2015-04-28 +NON-AGENT API DOCUMENT Started: 2008-07-24 Updated: 2015-04-30 This document describes the functions of an API(Application Programming Interface) for all functions NOT directly relating to the VICIDIAL Agent screen. @@ -102,6 +102,7 @@ Changes: 150309-0250 - Added ability to use urlencoded web form addresses 150313-0818 - Allow for single quotes in vicidial_list and custom data fields 150428-1720 - Added web_form_address_three to add_list/update_list functions +150430-0644 - Added API allowed function restrictions and allowed list restrictions API Functions use the 'function' variable @@ -109,6 +110,9 @@ API Functions use the 'function' variable NOTE: Just as with the Agent API, the non-agent API requires the user and pass of a valid api-enabled vicidial_users account to execute actions. +Example response if user permissions do not allow the function attempted: +ERROR: auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION - 6666|add_lead + -------------------------------------------------------------------------------- @@ -635,6 +639,7 @@ ERROR: add_lead INVALID PHONE NUMBER AREACODE - 72755|6666 ERROR: add_lead INVALID PHONE NUMBER NANPA AREACODE PREFIX - 7275551212|6666 ERROR: add_lead USER DOES NOT HAVE PERMISSION TO ADD LEADS TO THE SYSTEM - 6666|0 +ERROR: add_lead NOT AN ALLOWED LIST ID - 7275551212|98762 ERROR: NO FUNCTION SPECIFIED @@ -777,6 +782,7 @@ ERROR: update_lead NO MATCHES FOUND IN THE SYSTEM - 6666||| ERROR: update_lead NO VALID SEARCH METHOD - 6666|SYSTEM||| ERROR: update_lead USER DOES NOT HAVE PERMISSION TO UPDATE LEADS IN THE SYSTEM - 6666|0 +ERROR: update_lead NOT AN ALLOWED LIST ID - 7275551212|98762 @@ -1183,6 +1189,7 @@ http://server/vicidial/non_agent_api.php?source=test&user=6666&pass=1234&functio Example responses: ERROR: update_list USER DOES NOT HAVE PERMISSION TO UPDATE LISTS - 6666 ERROR: update_list YOU MUST USE ALL REQUIRED FIELDS - 6666|1 +ERROR: update_list NOT AN ALLOWED LIST ID - 98762 NOTICE: update_list LIST DOES NOT EXIST, SENDING TO add_list FUNCTION - 6666|1000 ERROR: update_list LIST DOES NOT EXIST - 6666|1000 ERROR: update_list CAMPAIGN DOES NOT EXIST, THIS IS AN OPTIONAL FIELD - 6666|TESTCIMP diff --git a/agc_2-X/trunk/extras/MySQL_AST_CREATE_tables.sql b/agc_2-X/trunk/extras/MySQL_AST_CREATE_tables.sql index 8b126598..030e7d44 100644 --- a/agc_2-X/trunk/extras/MySQL_AST_CREATE_tables.sql +++ b/agc_2-X/trunk/extras/MySQL_AST_CREATE_tables.sql @@ -627,7 +627,9 @@ wrapup_seconds_override SMALLINT(4) default '-1', modify_languages ENUM('1','0') default '0', selected_language VARCHAR(100) default 'default English', user_choose_language ENUM('1','0') default '0', -ignore_group_on_search ENUM('1','0') default '0' +ignore_group_on_search ENUM('1','0') default '0', +api_list_restrict ENUM('1','0') default '0', +api_allowed_functions VARCHAR(1000) default 'ALL_FUNCTIONS' ) ENGINE=MyISAM; CREATE UNIQUE INDEX user ON vicidial_users (user); @@ -3379,4 +3381,4 @@ UPDATE vicidial_configuration set value='1766' where name='qc_database_version'; UPDATE system_settings set vdc_agent_api_active='1'; -UPDATE system_settings SET db_schema_version='1408',db_schema_update_date=NOW(),reload_timestamp=NOW(); +UPDATE system_settings SET db_schema_version='1409',db_schema_update_date=NOW(),reload_timestamp=NOW(); diff --git a/agc_2-X/trunk/extras/upgrade_2.12.sql b/agc_2-X/trunk/extras/upgrade_2.12.sql index 19f7ebe9..539d269b 100644 --- a/agc_2-X/trunk/extras/upgrade_2.12.sql +++ b/agc_2-X/trunk/extras/upgrade_2.12.sql @@ -24,3 +24,8 @@ ALTER TABLE vicidial_campaigns MODIFY get_call_launch ENUM('NONE','SCRIPT','WEBF ALTER TABLE vicidial_inbound_groups MODIFY get_call_launch ENUM('NONE','SCRIPT','WEBFORM','WEBFORMTWO','WEBFORMTHREE','FORM') default 'NONE'; UPDATE system_settings SET db_schema_version='1408',db_schema_update_date=NOW() where db_schema_version < 1408; + +ALTER TABLE vicidial_users ADD api_list_restrict ENUM('1','0') default '0'; +ALTER TABLE vicidial_users ADD api_allowed_functions VARCHAR(1000) default 'ALL_FUNCTIONS'; + +UPDATE system_settings SET db_schema_version='1409',db_schema_update_date=NOW() where db_schema_version < 1409; diff --git a/agc_2-X/trunk/www/agc/api.php b/agc_2-X/trunk/www/agc/api.php index f2cbe797..028fd1b1 100644 --- a/agc_2-X/trunk/www/agc/api.php +++ b/agc_2-X/trunk/www/agc/api.php @@ -80,10 +80,11 @@ # 141216-2118 - Added language settings lookups and user/pass variable standardization # 150108-1039 - Added transfer_conf-ID of epoch to help prevent double-execution of transfer commands # 150313-0825 - Allow for single quotes in vicidial_list and custom data fields +# 150429-1717 - Added user allowed function restrictions # -$version = '2.12-46'; -$build = '150313-0825'; +$version = '2.12-47'; +$build = '150429-1717'; $startMS = microtime(); @@ -221,7 +222,7 @@ $pass = preg_replace("/'|\"|\\\\|;| /","",$pass); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### $VUselected_language = ''; -$stmt="SELECT selected_language from vicidial_users where user='$user';"; +$stmt="SELECT selected_language,api_list_restrict,api_allowed_functions,user_group from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} @@ -230,6 +231,9 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $VUapi_list_restrict = $row[1]; + $VUapi_allowed_functions = $row[2]; + $VUuser_group = $row[3]; } $stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;"; @@ -426,6 +430,49 @@ else } } } + + if ( ($VUapi_list_restrict > 0) and ( ($function == 'feature_not_needed') or ($function == 'feature_not_needed2') ) ) + { + $stmt="SELECT allowed_campaigns from vicidial_user_groups where user_group='$VUuser_group';"; + if ($DB>0) {echo "|$stmt|\n";} + $rslt=mysql_to_mysqli($stmt, $link); + $ss_conf_ct = mysqli_num_rows($rslt); + if ($ss_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $LOGallowed_campaigns = $row[0]; + $LOGallowed_campaignsSQL=''; + $whereLOGallowed_campaignsSQL=''; + if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } + $stmt="SELECT list_id from vicidial_lists $whereLOGadmin_viewable_groupsSQL order by list_id;"; + if ($DB>0) {echo "|$stmt|\n";} + $rslt=mysql_to_mysqli($stmt, $link); + $lists_to_print = mysqli_num_rows($rslt); + $i=0; + $allowed_lists=' '; + while ($i < $lists_to_print) + { + $row=mysqli_fetch_row($rslt); + $allowed_lists .= "$row[0] "; + $i++; + } + if ($DB>0) {echo "Allowed lists:|$allowed_lists|\n";} + } + else + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("user_group DOES NOT EXIST"); + echo "$result: $result_reason - $value|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } + } } if ($format=='debug') @@ -452,6 +499,14 @@ if ($format=='debug') ################################################################################ if ($function == 'webserver') { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } exec('ps aux | grep httpd', $output); $processes = count($output); $load = sys_getloadavg(); @@ -509,6 +564,14 @@ if ($function == 'external_hangup') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } if (strlen($alt_user)>1) { $stmt = "select count(*) from vicidial_users where custom_three='$alt_user';"; @@ -576,6 +639,14 @@ if ($function == 'external_status') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } if (strlen($alt_user)>1) { $stmt = "select count(*) from vicidial_users where custom_three='$alt_user';"; @@ -686,6 +757,14 @@ if ($function == 'external_pause') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } if (strlen($alt_user)>1) { $stmt = "select count(*) from vicidial_users where custom_three='$alt_user';"; @@ -769,6 +848,14 @@ if ($function == 'logout') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } if (strlen($alt_user)>1) { $stmt = "select count(*) from vicidial_users where custom_three='$alt_user';"; @@ -838,6 +925,14 @@ if ($function == 'recording') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } if (strlen($alt_user)>1) { $stmt = "select count(*) from vicidial_users where custom_three='$alt_user';"; @@ -963,6 +1058,14 @@ if ($function == 'webphone_url') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } if (strlen($alt_user)>1) { $stmt = "select count(*) from vicidial_users where custom_three='$alt_user';"; @@ -1068,6 +1171,14 @@ if ($function == 'call_agent') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } if (strlen($alt_user)>1) { $stmt = "select count(*) from vicidial_users where custom_three='$alt_user';"; @@ -1165,6 +1276,14 @@ if ($function == 'audio_playback') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } if (strlen($alt_user)>1) { $stmt = "select count(*) from vicidial_users where custom_three='$alt_user';"; @@ -1352,6 +1471,14 @@ if ($function == 'external_dial') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } if (strlen($alt_user)>1) { $stmt = "select count(*) from vicidial_users where custom_three='$alt_user';"; @@ -1703,6 +1830,14 @@ if ($function == 'preview_dial_action') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } if (strlen($alt_user)>1) { $stmt = "select count(*) from vicidial_users where custom_three='$alt_user';"; @@ -1854,6 +1989,14 @@ if ($function == 'external_add_lead') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } if (strlen($vendor_id) > 0 ) { $vendor_lead_code = $vendor_id; @@ -2017,6 +2160,14 @@ if ($function == 'change_ingroups') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt = "select count(*) from vicidial_live_agents where user='$agent_user';"; if ($DB) {echo "$stmt\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -2297,6 +2448,14 @@ if ($function == 'update_fields') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt = "select count(*) from vicidial_live_agents where user='$agent_user';"; if ($DB) {echo "$stmt\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -2569,6 +2728,14 @@ if ($function == 'set_timer_action') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt = "select count(*) from vicidial_live_agents where user='$agent_user';"; if ($DB) {echo "$stmt\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -2631,6 +2798,14 @@ if ($function == 'st_login_log') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt = "select count(*) from vicidial_users where custom_three='$value';"; if ($DB) {echo "$stmt\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -2684,6 +2859,14 @@ if ($function == 'st_get_agent_active_lead') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt = "select count(*) from vicidial_users where custom_three='$value';"; if ($DB) {echo "$stmt\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -2772,6 +2955,14 @@ if ($function == 'ra_call_control') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt = "select count(*) from vicidial_live_agents where user='$agent_user';"; if ($DB) {echo "$stmt\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -3130,6 +3321,14 @@ if ($function == 'send_dtmf') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } if (strlen($alt_user)>1) { $stmt = "select count(*) from vicidial_users where custom_three='$alt_user';"; @@ -3197,6 +3396,14 @@ if ($function == 'park_call') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } if (strlen($alt_user)>1) { $stmt = "select count(*) from vicidial_users where custom_three='$alt_user';"; @@ -3279,6 +3486,14 @@ if ($function == 'transfer_conference') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $processed=0; $SUCCESS=0; if (strlen($alt_user)>1) @@ -3526,6 +3741,14 @@ if ($function == 'pause_code') } else { + if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"); + echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } if (strlen($alt_user)>1) { $stmt = "select count(*) from vicidial_users where custom_three='$alt_user';"; diff --git a/agc_2-X/trunk/www/vicidial/admin.php b/agc_2-X/trunk/www/vicidial/admin.php index 81d87f6f..8330ed39 100644 --- a/agc_2-X/trunk/www/vicidial/admin.php +++ b/agc_2-X/trunk/www/vicidial/admin.php @@ -115,6 +115,8 @@ $UGreports = 'ALL REPORTS, NONE, Real-Time Main Report, Real-Time Campaign Summa $Vtables = 'NONE,log_noanswer,did_agent_log,contact_information'; +$APIfunctions = 'ALL_FUNCTIONS add_group_alias add_lead add_list add_phone add_phone_alias add_user agent_ingroup_info agent_stats_export agent_status audio_playback blind_monitor call_agent callid_info change_ingroups check_phone_number did_log_export external_add_lead external_dial external_hangup external_pause external_status in_group_status logout moh_list park_call pause_code preview_dial_action ra_call_control recording recording_lookup send_dtmf server_refresh set_timer_action sounds_list st_get_agent_active_lead st_login_log transfer_conference update_fields update_lead update_list update_log_entry update_phone update_phone_alias update_user user_group_status vm_list webphone_url webserver'; + ###################################################################################################### ###################################################################################################### ####### Form variable declaration @@ -1914,6 +1916,10 @@ if (isset($_GET["enable_third_webform"])) {$enable_third_webform=$_GET["enable elseif (isset($_POST["enable_third_webform"])) {$enable_third_webform=$_POST["enable_third_webform"];} if (isset($_GET["web_form_address_three"])) {$web_form_address_three=$_GET["web_form_address_three"];} elseif (isset($_POST["web_form_address_three"])) {$web_form_address_three=$_POST["web_form_address_three"];} +if (isset($_GET["api_list_restrict"])) {$api_list_restrict=$_GET["api_list_restrict"];} + elseif (isset($_POST["api_list_restrict"])) {$api_list_restrict=$_POST["api_list_restrict"];} +if (isset($_GET["api_allowed_functions"])) {$api_allowed_functions=$_GET["api_allowed_functions"];} + elseif (isset($_POST["api_allowed_functions"])) {$api_allowed_functions=$_POST["api_allowed_functions"];} if (isset($script_id)) {$script_id= strtoupper($script_id);} @@ -2264,6 +2270,7 @@ if ($non_latin < 1) $entry_list_id = preg_replace('/[^0-9]/','',$entry_list_id); $filter_entry_list_id = preg_replace('/[^0-9]/','',$filter_entry_list_id); $enable_third_webform = preg_replace('/[^0-9]/','',$enable_third_webform); + $api_list_restrict = preg_replace('/[^0-9]/','',$api_list_restrict); $drop_call_seconds = preg_replace('/[^-0-9]/','',$drop_call_seconds); $timer_alt_seconds = preg_replace('/[^-0-9]/','',$timer_alt_seconds); @@ -2852,6 +2859,7 @@ if ($non_latin < 1) $location = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$location); $holiday_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$holiday_name); $holiday_comments = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$holiday_comments); + $api_allowed_functions = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$api_allowed_functions); ### ALPHA-NUMERIC and underscore and dash and slash and at and dot $call_out_number_group = preg_replace('/[^-\.\:\/\@\_0-9a-zA-Z]/','',$call_out_number_group); @@ -3473,12 +3481,13 @@ else # 150421-2315 - Fixed bugs in allow_emails # 150422-1953 - Don't allow dial_timeout of less than 4 seconds # 150428-1705 - Added options for third webform +# 150429-1222 - Added new API user restrictions # # make sure you have added a user to the vicidial_users MySQL table with at least user_level 9 to access this page the first time -$admin_version = '2.12-483a'; -$build = '150428-1705'; +$admin_version = '2.12-484a'; +$build = '150429-1222'; $STARTtime = date("U"); $SQLdate = date("Y-m-d H:i:s"); @@ -11233,9 +11242,19 @@ if ($ADD=="4A") $pass=''; } + $k=0; + $multi_count = count($api_allowed_functions); + $multi_array = $api_allowed_functions; + while ($k < $multi_count) + { + $new_field_value .= "$multi_array[$k] "; + $k++; + } + $api_allowed_functions = " $new_field_value"; + echo "
"._QXZ("USER MODIFIED - ADMIN").": $user\n"; - $stmt="UPDATE vicidial_users set pass='$pass',full_name='$full_name',user_level='$user_level',user_group='$user_group',phone_login='$phone_login',phone_pass='$phone_pass',delete_users='$delete_users',delete_user_groups='$delete_user_groups',delete_lists='$delete_lists',delete_campaigns='$delete_campaigns',delete_ingroups='$delete_ingroups',delete_remote_agents='$delete_remote_agents',load_leads='$load_leads',campaign_detail='$campaign_detail',ast_admin_access='$ast_admin_access',ast_delete_phones='$ast_delete_phones',delete_scripts='$delete_scripts',modify_leads='$modify_leads',hotkeys_active='$hotkeys_active',change_agent_campaign='$change_agent_campaign',agent_choose_ingroups='$agent_choose_ingroups',closer_campaigns='$groups_value',scheduled_callbacks='$scheduled_callbacks',agentonly_callbacks='$agentonly_callbacks',agentcall_manual='$agentcall_manual',vicidial_recording='$vicidial_recording',vicidial_transfers='$vicidial_transfers',delete_filters='$delete_filters',alter_agent_interface_options='$alter_agent_interface_options',closer_default_blended='$closer_default_blended',delete_call_times='$delete_call_times',modify_call_times='$modify_call_times',modify_users='$modify_users',modify_campaigns='$modify_campaigns',modify_lists='$modify_lists',modify_scripts='$modify_scripts',modify_filters='$modify_filters',modify_ingroups='$modify_ingroups',modify_usergroups='$modify_usergroups',modify_remoteagents='$modify_remoteagents',modify_servers='$modify_servers',view_reports='$view_reports',vicidial_recording_override='$vicidial_recording_override',alter_custdata_override='$alter_custdata_override',qc_enabled='$qc_enabled',qc_user_level='$qc_user_level',qc_pass='$qc_pass',qc_finish='$qc_finish',qc_commit='$qc_commit',add_timeclock_log='$add_timeclock_log',modify_timeclock_log='$modify_timeclock_log',delete_timeclock_log='$delete_timeclock_log',alter_custphone_override='$alter_custphone_override',vdc_agent_api_access='$vdc_agent_api_access',modify_inbound_dids='$modify_inbound_dids',delete_inbound_dids='$delete_inbound_dids',active='$active',download_lists='$download_lists',agent_shift_enforcement_override='$agent_shift_enforcement_override',manager_shift_enforcement_override='$manager_shift_enforcement_override',export_reports='$export_reports',delete_from_dnc='$delete_from_dnc',email='$email',user_code='$user_code',territory='$territory',allow_alerts='$allow_alerts',agent_choose_territories='$agent_choose_territories',custom_one='$custom_one',custom_two='$custom_two',custom_three='$custom_three',custom_four='$custom_four',custom_five='$custom_five',voicemail_id='$voicemail_id',agent_call_log_view_override='$agent_call_log_view_override',callcard_admin='$callcard_admin',agent_choose_blended='$agent_choose_blended',realtime_block_user_info='$realtime_block_user_info',custom_fields_modify='$custom_fields_modify',force_change_password='$force_change_password',agent_lead_search_override='$agent_lead_search',modify_shifts='$modify_shifts',modify_phones='$modify_phones',modify_carriers='$modify_carriers',modify_labels='$modify_labels',modify_statuses='$modify_statuses',modify_voicemail='$modify_voicemail',modify_audiostore='$modify_audiostore',modify_moh='$modify_moh',modify_tts='$modify_tts',preset_contact_search='$preset_contact_search',modify_contacts='$modify_contacts',modify_same_user_level='$modify_same_user_level',admin_hide_lead_data='$admin_hide_lead_data',admin_hide_phone_data='$admin_hide_phone_data',agentcall_email='$agentcall_email',modify_email_accounts='$modify_email_accounts',failed_login_count=0,alter_admin_interface_options='$alter_admin_interface_options',max_inbound_calls='$max_inbound_calls',modify_custom_dialplans='$modify_custom_dialplans',wrapup_seconds_override='$wrapup_seconds_override',modify_languages='$modify_languages',selected_language='$selected_language',user_choose_language='$user_choose_language',ignore_group_on_search='$ignore_group_on_search' $pass_hashSQL where user='$user' $LOGadmin_viewable_groupsSQL;"; + $stmt="UPDATE vicidial_users set pass='$pass',full_name='$full_name',user_level='$user_level',user_group='$user_group',phone_login='$phone_login',phone_pass='$phone_pass',delete_users='$delete_users',delete_user_groups='$delete_user_groups',delete_lists='$delete_lists',delete_campaigns='$delete_campaigns',delete_ingroups='$delete_ingroups',delete_remote_agents='$delete_remote_agents',load_leads='$load_leads',campaign_detail='$campaign_detail',ast_admin_access='$ast_admin_access',ast_delete_phones='$ast_delete_phones',delete_scripts='$delete_scripts',modify_leads='$modify_leads',hotkeys_active='$hotkeys_active',change_agent_campaign='$change_agent_campaign',agent_choose_ingroups='$agent_choose_ingroups',closer_campaigns='$groups_value',scheduled_callbacks='$scheduled_callbacks',agentonly_callbacks='$agentonly_callbacks',agentcall_manual='$agentcall_manual',vicidial_recording='$vicidial_recording',vicidial_transfers='$vicidial_transfers',delete_filters='$delete_filters',alter_agent_interface_options='$alter_agent_interface_options',closer_default_blended='$closer_default_blended',delete_call_times='$delete_call_times',modify_call_times='$modify_call_times',modify_users='$modify_users',modify_campaigns='$modify_campaigns',modify_lists='$modify_lists',modify_scripts='$modify_scripts',modify_filters='$modify_filters',modify_ingroups='$modify_ingroups',modify_usergroups='$modify_usergroups',modify_remoteagents='$modify_remoteagents',modify_servers='$modify_servers',view_reports='$view_reports',vicidial_recording_override='$vicidial_recording_override',alter_custdata_override='$alter_custdata_override',qc_enabled='$qc_enabled',qc_user_level='$qc_user_level',qc_pass='$qc_pass',qc_finish='$qc_finish',qc_commit='$qc_commit',add_timeclock_log='$add_timeclock_log',modify_timeclock_log='$modify_timeclock_log',delete_timeclock_log='$delete_timeclock_log',alter_custphone_override='$alter_custphone_override',vdc_agent_api_access='$vdc_agent_api_access',modify_inbound_dids='$modify_inbound_dids',delete_inbound_dids='$delete_inbound_dids',active='$active',download_lists='$download_lists',agent_shift_enforcement_override='$agent_shift_enforcement_override',manager_shift_enforcement_override='$manager_shift_enforcement_override',export_reports='$export_reports',delete_from_dnc='$delete_from_dnc',email='$email',user_code='$user_code',territory='$territory',allow_alerts='$allow_alerts',agent_choose_territories='$agent_choose_territories',custom_one='$custom_one',custom_two='$custom_two',custom_three='$custom_three',custom_four='$custom_four',custom_five='$custom_five',voicemail_id='$voicemail_id',agent_call_log_view_override='$agent_call_log_view_override',callcard_admin='$callcard_admin',agent_choose_blended='$agent_choose_blended',realtime_block_user_info='$realtime_block_user_info',custom_fields_modify='$custom_fields_modify',force_change_password='$force_change_password',agent_lead_search_override='$agent_lead_search',modify_shifts='$modify_shifts',modify_phones='$modify_phones',modify_carriers='$modify_carriers',modify_labels='$modify_labels',modify_statuses='$modify_statuses',modify_voicemail='$modify_voicemail',modify_audiostore='$modify_audiostore',modify_moh='$modify_moh',modify_tts='$modify_tts',preset_contact_search='$preset_contact_search',modify_contacts='$modify_contacts',modify_same_user_level='$modify_same_user_level',admin_hide_lead_data='$admin_hide_lead_data',admin_hide_phone_data='$admin_hide_phone_data',agentcall_email='$agentcall_email',modify_email_accounts='$modify_email_accounts',failed_login_count=0,alter_admin_interface_options='$alter_admin_interface_options',max_inbound_calls='$max_inbound_calls',modify_custom_dialplans='$modify_custom_dialplans',wrapup_seconds_override='$wrapup_seconds_override',modify_languages='$modify_languages',selected_language='$selected_language',user_choose_language='$user_choose_language',ignore_group_on_search='$ignore_group_on_search',api_list_restrict='$api_list_restrict',api_allowed_functions='$api_allowed_functions' $pass_hashSQL where user='$user' $LOGadmin_viewable_groupsSQL;"; $rslt=mysql_to_mysqli($stmt, $link); ### LOG INSERTION Admin Log Table ### @@ -17735,7 +17754,7 @@ if ($ADD==3) echo "\n"; echo "\n"; - echo "\n"; echo "\n"; echo "\n"; @@ -18142,6 +18162,25 @@ if ($ADD==3) echo "\n"; + echo "\n"; + + echo "\n"; + + echo "\n"; + if ( ( ($LOGmodify_same_user_level > 0) or ($LOGalter_admin_interface > 0) ) and ($LOGuser_level > 8) ) { echo "\n"; diff --git a/agc_2-X/trunk/www/vicidial/help.php b/agc_2-X/trunk/www/vicidial/help.php index 00791868..04abec94 100644 --- a/agc_2-X/trunk/www/vicidial/help.php +++ b/agc_2-X/trunk/www/vicidial/help.php @@ -44,6 +44,7 @@ # 150307-2317 - Added custom meetme enter options # 150404-0934 - Added enable_did_entry_list_id and related DID options # 150428-1704 - Added enable_third_webform +# 150429-1232 - Added new user API restrictions # require("dbconnect_mysqli.php"); @@ -590,15 +591,25 @@ if ($SSqc_features_active > 0)
- +
+ +
+ - +

-
- +
- - + - + +
+ +
+ -
@@ -4541,11 +4552,6 @@ AU_SPAC 000 000 000 -
FR_SPAC 00 00 00 00 00 -
-
- -
- - -

diff --git a/agc_2-X/trunk/www/vicidial/non_agent_api.php b/agc_2-X/trunk/www/vicidial/non_agent_api.php index 96955534..adf0b8ce 100644 --- a/agc_2-X/trunk/www/vicidial/non_agent_api.php +++ b/agc_2-X/trunk/www/vicidial/non_agent_api.php @@ -96,10 +96,11 @@ # 150309-0250 - Added ability to use urlencoded web form addresses # 150313-0818 - Allow for single quotes in vicidial_list and custom data fields # 150428-1720 - Added web_form_address_three to add_list/update_list functions +# 150430-0644 - Added API allowed function restrictions and allowed list restrictions # -$version = '2.12-72'; -$build = '150428-1720'; +$version = '2.12-73'; +$build = '150430-0644'; $api_url_log = 0; $startMS = microtime(); @@ -638,6 +639,57 @@ if ($auth < 1) echo "$VDdisplayMESSAGE: |$user|$pass|$auth_message|\n"; exit; } + +$stmt="SELECT api_list_restrict,api_allowed_functions,user_group from vicidial_users where user='$user' and active='Y';"; +if ($DB>0) {echo "DEBUG: auth query - $stmt\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$api_list_restrict = $row[0]; +$api_allowed_functions = $row[1]; +$LOGuser_group = $row[2]; +if ( ($api_list_restrict > 0) and ( ($function == 'add_lead') or ($function == 'update_lead') or ($function == 'update_list') ) ) + { + $stmt="SELECT allowed_campaigns from vicidial_user_groups where user_group='$LOGuser_group';"; + if ($DB>0) {echo "|$stmt|\n";} + $rslt=mysql_to_mysqli($stmt, $link); + $ss_conf_ct = mysqli_num_rows($rslt); + if ($ss_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $LOGallowed_campaigns = $row[0]; + $LOGallowed_campaignsSQL=''; + $whereLOGallowed_campaignsSQL=''; + if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } + $stmt="SELECT list_id from vicidial_lists $whereLOGadmin_viewable_groupsSQL order by list_id;"; + if ($DB>0) {echo "|$stmt|\n";} + $rslt=mysql_to_mysqli($stmt, $link); + $lists_to_print = mysqli_num_rows($rslt); + $i=0; + $allowed_lists=' '; + while ($i < $lists_to_print) + { + $row=mysqli_fetch_row($rslt); + $allowed_lists .= "$row[0] "; + $i++; + } + if ($DB>0) {echo "Allowed lists:|$allowed_lists|\n";} + } + else + { + $result = 'ERROR'; + $result_reason = "user_group DOES NOT EXIST"; + echo "$result: $result_reason: |$user|$LOGuser_group|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } + } ##### END user authentication for all functions below ##### @@ -663,6 +715,15 @@ if ($function == 'sounds_list') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $server_name = getenv("SERVER_NAME"); $server_port = getenv("SERVER_PORT"); if (preg_match("/443/i",$server_port)) {$HTTPprotocol = 'https://';} @@ -831,6 +892,15 @@ if ($function == 'moh_list') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $server_name = getenv("SERVER_NAME"); $server_port = getenv("SERVER_PORT"); if (preg_match("/443/i",$server_port)) {$HTTPprotocol = 'https://';} @@ -864,12 +934,6 @@ if ($function == 'moh_list') } else { - $stmt="SELECT user_group from vicidial_users where user='$user' and user_level > 6;"; - if ($DB>0) {echo "|$stmt|\n";} - $rslt=mysql_to_mysqli($stmt, $link); - $row=mysqli_fetch_row($rslt); - $LOGuser_group = $row[0]; - $stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB>0) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -997,12 +1061,15 @@ if ($function == 'vm_list') } else { - $stmt="SELECT user_group from vicidial_users where user='$user' and user_level > 6;"; - if ($DB>0) {echo "|$stmt|\n";} - $rslt=mysql_to_mysqli($stmt, $link); - $row=mysqli_fetch_row($rslt); - $LOGuser_group = $row[0]; - + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB>0) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -1134,6 +1201,15 @@ if ($function == 'agent_ingroup_info') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and user_level > 6 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -1149,12 +1225,6 @@ if ($function == 'agent_ingroup_info') } else { - $stmt="SELECT user_group from vicidial_users where user='$user' and user_level > 6;"; - if ($DB>0) {echo "|$stmt|\n";} - $rslt=mysql_to_mysqli($stmt, $link); - $row=mysqli_fetch_row($rslt); - $LOGuser_group = $row[0]; - $stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB>0) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -1460,6 +1530,15 @@ if ($function == 'blind_monitor') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and user_level > 6 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -1629,6 +1708,15 @@ if ($function == 'add_user') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and modify_users='1' and user_level >= 8 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -1817,6 +1905,15 @@ if ($function == 'update_user') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and modify_users='1' and user_level >= 8 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -1843,12 +1940,6 @@ if ($function == 'update_user') } else { - $stmt="SELECT user_group from vicidial_users where user='$user' and user_level >= 8;"; - if ($DB>0) {echo "|$stmt|\n";} - $rslt=mysql_to_mysqli($stmt, $link); - $row=mysqli_fetch_row($rslt); - $LOGuser_group = $row[0]; - $stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB>0) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -2382,6 +2473,15 @@ if ($function == 'add_group_alias') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and ast_admin_access='1' and user_level >= 8 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -2474,6 +2574,15 @@ if ($function == 'add_phone') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and ast_admin_access='1' and user_level >= 8 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -2612,6 +2721,15 @@ if ($function == 'update_phone') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and ast_admin_access='1' and user_level >= 8 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -2638,12 +2756,6 @@ if ($function == 'update_phone') } else { - $stmt="SELECT user_group from vicidial_users where user='$user' and user_level >= 8;"; - if ($DB>0) {echo "|$stmt|\n";} - $rslt=mysql_to_mysqli($stmt, $link); - $row=mysqli_fetch_row($rslt); - $LOGuser_group = $row[0]; - $stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB>0) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -3023,6 +3135,15 @@ if ($function == 'add_phone_alias') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and ast_admin_access='1' and user_level >= 8 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -3132,6 +3253,15 @@ if ($function == 'update_phone_alias') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and ast_admin_access='1' and user_level >= 8 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -3317,6 +3447,15 @@ if ($function == 'server_refresh') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and ast_admin_access='1' and user_level >= 8 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -3391,6 +3530,15 @@ if ($function == 'update_list') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and modify_lists='1' and user_level >= 8 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -3417,12 +3565,18 @@ if ($function == 'update_list') } else { - $stmt="SELECT user_group from vicidial_users where user='$user' and user_level >= 8;"; - if ($DB>0) {echo "|$stmt|\n";} - $rslt=mysql_to_mysqli($stmt, $link); - $row=mysqli_fetch_row($rslt); - $LOGuser_group = $row[0]; - + if ($api_list_restrict > 0) + { + if (!preg_match("/ $list_id /",$allowed_lists)) + { + $result = 'ERROR'; + $result_reason = "update_list NOT AN ALLOWED LIST ID"; + $data = "$list_id"; + echo "$result: $result_reason - $data\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } + } $stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB>0) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -3862,6 +4016,15 @@ if ($function == 'add_list') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and modify_lists='1' and user_level >= 8 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -3888,12 +4051,6 @@ if ($function == 'add_list') } else { - $stmt="SELECT user_group from vicidial_users where user='$user' and user_level >= 8;"; - if ($DB>0) {echo "|$stmt|\n";} - $rslt=mysql_to_mysqli($stmt, $link); - $row=mysqli_fetch_row($rslt); - $LOGuser_group = $row[0]; - $stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB>0) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -4088,6 +4245,15 @@ if ($function == 'recording_lookup') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and view_reports='1' and user_level > 6 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -4260,6 +4426,15 @@ if ($function == 'did_log_export') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and view_reports='1' and user_level > 6 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -4400,6 +4575,15 @@ if ($function == 'agent_stats_export') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and view_reports='1' and user_level > 6 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -4611,6 +4795,15 @@ if ($function == 'user_group_status') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and view_reports='1' and user_level > 6 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -4647,12 +4840,6 @@ if ($function == 'user_group_status') } else { - $stmt="SELECT user_group from vicidial_users where user='$user' and user_level > 6 and view_reports='1' and active='Y';"; - if ($DB) {$MAIN.="|$stmt|\n";} - $rslt=mysql_to_mysqli($stmt, $link); - $row=mysqli_fetch_row($rslt); - $LOGuser_group = $row[0]; - $stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {$MAIN.="|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -4687,7 +4874,7 @@ if ($function == 'user_group_status') while ($i < $groups_to_print) { $row=mysqli_fetch_row($rslt); - $rawLOGallowed_ingroupsSQL .= "row[0]','"; + $rawLOGallowed_ingroupsSQL .= "$row[0]','"; $i++; } $whereLOGallowed_callsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL','$rawLOGallowed_ingroupsSQL')"; @@ -4827,6 +5014,15 @@ if ($function == 'in_group_status') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and view_reports='1' and user_level > 6 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -4864,12 +5060,6 @@ if ($function == 'in_group_status') } else { - $stmt="SELECT user_group from vicidial_users where user='$user' and user_level > 6 and view_reports='1' and active='Y';"; - if ($DB) {$MAIN.="|$stmt|\n";} - $rslt=mysql_to_mysqli($stmt, $link); - $row=mysqli_fetch_row($rslt); - $LOGuser_group = $row[0]; - $stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {$MAIN.="|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -4904,7 +5094,7 @@ if ($function == 'in_group_status') while ($i < $groups_to_print) { $row=mysqli_fetch_row($rslt); - $rawLOGallowed_ingroupsSQL .= "row[0]','"; + $rawLOGallowed_ingroupsSQL .= "$row[0]','"; $i++; } $LOGallowed_callsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL','$rawLOGallowed_ingroupsSQL')"; @@ -5043,6 +5233,15 @@ if ($function == 'agent_status') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and view_reports='1' and user_level > 6 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -5077,12 +5276,6 @@ if ($function == 'agent_status') } else { - $stmt="SELECT user_group from vicidial_users where user='$user' and user_level > 6 and view_reports='1' and active='Y';"; - if ($DB) {$MAIN.="|$stmt|\n";} - $rslt=mysql_to_mysqli($stmt, $link); - $row=mysqli_fetch_row($rslt); - $LOGuser_group = $row[0]; - $stmt="SELECT admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {$MAIN.="|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -5281,6 +5474,15 @@ if ($function == 'callid_info') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and view_reports='1' and user_level > 6 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -5316,12 +5518,6 @@ if ($function == 'callid_info') } else { - $stmt="SELECT user_group from vicidial_users where user='$user' and user_level > 6 and view_reports='1' and active='Y';"; - if ($DB) {$MAIN.="|$stmt|\n";} - $rslt=mysql_to_mysqli($stmt, $link); - $row=mysqli_fetch_row($rslt); - $LOGuser_group = $row[0]; - $stmt="SELECT admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {$MAIN.="|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -5489,6 +5685,15 @@ if ($function == 'update_log_entry') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and modify_leads='1' and user_level > 7 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -5630,6 +5835,15 @@ if ($function == 'add_lead') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and modify_leads='1' and user_level > 7 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -5646,6 +5860,18 @@ if ($function == 'add_lead') } else { + if ($api_list_restrict > 0) + { + if (!preg_match("/ $list_id /",$allowed_lists)) + { + $result = 'ERROR'; + $result_reason = "add_lead NOT AN ALLOWED LIST ID"; + $data = "$phone_number|$list_id"; + echo "$result: $result_reason - $data\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } + } if (strlen($gender)<1) {$gender='U';} if (strlen($rank)<1) {$rank='0';} if (strlen($list_id)<3) {$list_id='999';} @@ -6376,6 +6602,15 @@ if ($function == 'update_lead') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and modify_leads='1' and user_level > 7 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); @@ -6431,6 +6666,19 @@ if ($function == 'update_lead') } else { + if ( ($api_list_restrict > 0) and ($list_id >= 99) ) + { + if (!preg_match("/ $list_id /",$allowed_lists)) + { + $result = 'ERROR'; + $result_reason = "update_lead NOT AN ALLOWED LIST ID"; + $data = "$phone_number|$list_id"; + echo "$result: $result_reason - $data\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } + } + if (preg_match("/CAMPAIGN/i",$search_location)) # find lists within campaign { $stmt="SELECT campaign_id from vicidial_lists where list_id='$list_id';"; @@ -6582,6 +6830,19 @@ if ($function == 'update_lead') $VLaffected_rows=0; $CFaffected_rows=0; $VCBaffected_rows=0; + if ( ($api_list_restrict > 0) and ($search_lead_list[$n] >= 99) ) + { + if (!preg_match("/ $search_lead_list[$n] /",$allowed_lists)) + { + $result = 'ERROR'; + $result_reason = "update_lead NOT AN ALLOWED LIST ID"; + $data = "$search_lead_list[$n]"; + echo "$result: $result_reason - $data\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } + } + if ( (strlen($VL_update_SQL)>6) or ($delete_lead=='Y') ) { if ($delete_lead=='Y') @@ -6920,6 +7181,18 @@ if ($function == 'update_lead') } else { + if ( ($api_list_restrict > 0) and ($list_id >= 99) ) + { + if (!preg_match("/ $search_lead_list[$n] /",$allowed_lists)) + { + $result = 'ERROR'; + $result_reason = "update_lead NOT AN ALLOWED LIST ID"; + $data = "$phone_number|$list_id"; + echo "$result: $result_reason - $data\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } + } ### get current gmt_offset of the phone_number $gmt_offset = lookup_gmt($phone_code,$USarea,$state,$LOCAL_GMT_OFF_STD,$Shour,$Smin,$Ssec,$Smon,$Smday,$Syear,$tz_method,$postal_code,$owner,$USprefix); @@ -7125,6 +7398,15 @@ if ($function == 'check_phone_number') } else { + if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) ) + { + $result = 'ERROR'; + $result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION"; + echo "$result: $result_reason: |$user|$function|\n"; + $data = "$allowed_user"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and user_level > 7 and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt);
\n"; echo ""; - $stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,agent_choose_territories,custom_one,custom_two,custom_three,custom_four,custom_five,voicemail_id,agent_call_log_view_override,callcard_admin,agent_choose_blended,realtime_block_user_info,custom_fields_modify,force_change_password,agent_lead_search_override,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,preset_contact_search,modify_contacts,modify_same_user_level,admin_hide_lead_data,admin_hide_phone_data,agentcall_email,modify_email_accounts,failed_login_count,last_login_date,last_ip,alter_admin_interface_options,max_inbound_calls,modify_custom_dialplans,wrapup_seconds_override,modify_languages,selected_language,user_choose_language,ignore_group_on_search from vicidial_users where user='$user' $LOGadmin_viewable_groupsSQL;"; + $stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,agent_choose_territories,custom_one,custom_two,custom_three,custom_four,custom_five,voicemail_id,agent_call_log_view_override,callcard_admin,agent_choose_blended,realtime_block_user_info,custom_fields_modify,force_change_password,agent_lead_search_override,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,preset_contact_search,modify_contacts,modify_same_user_level,admin_hide_lead_data,admin_hide_phone_data,agentcall_email,modify_email_accounts,failed_login_count,last_login_date,last_ip,alter_admin_interface_options,max_inbound_calls,modify_custom_dialplans,wrapup_seconds_override,modify_languages,selected_language,user_choose_language,ignore_group_on_search,api_list_restrict,api_allowed_functions from vicidial_users where user='$user' $LOGadmin_viewable_groupsSQL;"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $user_id = $row[0]; @@ -17847,6 +17866,8 @@ if ($ADD==3) $selected_language = $row[108]; $user_choose_language = $row[109]; $ignore_group_on_search = $row[110]; + $api_list_restrict = $row[111]; + $api_allowed_functions = $row[112]; if ( ( ($user_level >= $LOGuser_level) and ($LOGuser_level < 9) ) or ( ($LOGmodify_same_user_level < 1) and ($LOGuser_level > 8) and ($user_level > 8) ) ) { @@ -18134,7 +18155,6 @@ if ($ADD==3) echo "
"._QXZ("Modify Contacts").": $NWB#users-modify_sections$NWE
"._QXZ("CallCard Access").": $NWB#users-modify_sections$NWE
"._QXZ("Agent API Access").": $NWB#users-vdc_agent_api_access$NWE
"._QXZ("Add Timeclock Log Record").": $NWB#users-add_timeclock_log$NWE
"._QXZ("Modify Timeclock Log Record").": $NWB#users-modify_timeclock_log$NWE
"._QXZ("Manager Shift Enforcement Override").": $NWB#users-manager_shift_enforcement_override$NWE
"._QXZ("Agent API Access").": $NWB#users-vdc_agent_api_access$NWE
"._QXZ("API List Restrict").": $NWB#users-api_list_restrict$NWE
"._QXZ("API Allowed Functions").": $NWB#users-api_allowed_functions$NWE
"._QXZ("LEVEL 9 ADMIN OPTIONS").":