diff --git a/agc_2-X/trunk/www/vicidial/AST_AMD_log_report.php b/agc_2-X/trunk/www/vicidial/AST_AMD_log_report.php index 4e7a317d..68193c9f 100644 --- a/agc_2-X/trunk/www/vicidial/AST_AMD_log_report.php +++ b/agc_2-X/trunk/www/vicidial/AST_AMD_log_report.php @@ -7,6 +7,7 @@ # 190329-1852 - First build, based on AST_carrier_log_report.php # 191013-0839 - Fixes for PHP7 # 220303-1415 - Added allow_web_debug system setting +# 220812-0951 - Added User Group report permissions checking # $startMS = microtime(); @@ -105,7 +106,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -113,6 +114,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -172,6 +174,33 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php b/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php index 5a1e5156..0cf09f90 100644 --- a/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php +++ b/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php @@ -17,6 +17,7 @@ # 141114-0842 - Finalized adding QXZ translation to all admin files # 141230-1502 - Added code for on-the-fly language translations display # 220303-0216 - Added allow_web_debug system setting +# 220812-0939 - Added User Group report permissions checking # $startMS = microtime(); @@ -84,7 +85,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -92,6 +93,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -151,6 +153,34 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php b/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php index 3c667ebb..27ae548b 100644 --- a/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php +++ b/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php @@ -22,6 +22,7 @@ # 170409-1538 - Added IP List validation code # 180507-2315 - Added new help display # 220302-1630 - Added allow_web_debug system setting +# 220812-0945 - Added User Group report permissions checking # $startMS = microtime(); @@ -125,7 +126,7 @@ else $checked=""; } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -133,6 +134,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -192,6 +194,35 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); $LOGbrowser = getenv("HTTP_USER_AGENT"); diff --git a/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php b/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php index 2ebd6b3f..68a0fc50 100644 --- a/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php +++ b/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php @@ -11,6 +11,7 @@ # 141230-1446 - Added code for on-the-fly language translations display # 170409-1536 - Added IP List validation code # 220302-1624 - Added allow_web_debug system setting +# 220812-0946 - Added User Group report permissions checking # $startMS = microtime(); @@ -94,7 +95,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -102,6 +103,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -161,6 +163,33 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php index 269e2154..1736daf0 100644 --- a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php +++ b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php @@ -30,6 +30,7 @@ # 201111-1435 - Added Campaign Drop-Run load # 210514-1615 - Added owner to DB=1 output # 220301-1627 - Added allow_web_debug system setting +# 220812-0929 - Added User Group report permissions checking # $startMS = microtime(); @@ -271,6 +272,14 @@ if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) } $regexLOGallowed_campaigns = " $LOGallowed_campaigns "; +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + $stmt="select campaign_id,campaign_name from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id;"; $rslt=mysql_to_mysqli($stmt, $link); diff --git a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php index bc27dc98..a043859f 100644 --- a/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php +++ b/agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php @@ -17,6 +17,7 @@ # 170409-1534 - Added IP List validation code # 190216-0806 - Fix for user-group, in-group and campaign allowed/permissions matching issues # 220301-1624 - Added allow_web_debug system setting +# 220812-0928 - Added User Group report permissions checking # $startMS = microtime(); @@ -82,7 +83,7 @@ else $group = preg_replace('/[^-_0-9\p{L}]/u', '', $group); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -90,6 +91,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -149,6 +151,34 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); $LOGbrowser = getenv("HTTP_USER_AGENT"); diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_debug_log_report.php b/agc_2-X/trunk/www/vicidial/AST_agent_debug_log_report.php index 08c8d1f4..87b011a4 100644 --- a/agc_2-X/trunk/www/vicidial/AST_agent_debug_log_report.php +++ b/agc_2-X/trunk/www/vicidial/AST_agent_debug_log_report.php @@ -10,6 +10,7 @@ # 170817-2330 - Added HTML format option # 170829-0040 - Added screen color settings # 220303-1507 - Added allow_web_debug system setting +# 220812-0947 - Added User Group report permissions checking # $startMS = microtime(); @@ -97,7 +98,7 @@ else $agent_user = preg_replace('/[^-_0-9\p{L}]/u','',$agent_user); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -105,6 +106,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -164,6 +166,34 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); $LOGbrowser = getenv("HTTP_USER_AGENT"); diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_disposition.php b/agc_2-X/trunk/www/vicidial/AST_agent_disposition.php index 2a0a1ca7..6da7c7be 100644 --- a/agc_2-X/trunk/www/vicidial/AST_agent_disposition.php +++ b/agc_2-X/trunk/www/vicidial/AST_agent_disposition.php @@ -16,11 +16,16 @@ # 141230-1525 - Added code for on-the-fly language translations display # 170409-1534 - Added IP List validation code # 220303-1631 - Added allow_web_debug system setting +# 220812-0949 - Added User Group report permissions checking # +$startMS = microtime(); + require("dbconnect_mysqli.php"); require("functions.php"); +$report_name='Agent Disposition Report'; + $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; @@ -82,7 +87,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -90,6 +95,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -148,7 +154,80 @@ else echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; exit; } - + +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + +##### BEGIN log visit to the vicidial_report_log table ##### +$LOGip = getenv("REMOTE_ADDR"); +$LOGbrowser = getenv("HTTP_USER_AGENT"); +$LOGscript_name = getenv("SCRIPT_NAME"); +$LOGserver_name = getenv("SERVER_NAME"); +$LOGserver_port = getenv("SERVER_PORT"); +$LOGrequest_uri = getenv("REQUEST_URI"); +$LOGhttp_referer = getenv("HTTP_REFERER"); +$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser); +$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri); +$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer); +if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';} + else {$HTTPprotocol = 'http://';} +if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';} +else {$LOGserver_port = ":$LOGserver_port";} +$LOGfull_url = "$HTTPprotocol$LOGserver_name$LOGserver_port$LOGrequest_uri"; + +$LOGhostname = php_uname('n'); +if (strlen($LOGhostname)<1) {$LOGhostname='X';} +if (strlen($LOGserver_name)<1) {$LOGserver_name='X';} + +$stmt="SELECT webserver_id FROM vicidial_webservers where webserver='$LOGserver_name' and hostname='$LOGhostname' LIMIT 1;"; +$rslt=mysql_to_mysqli($stmt, $link); +if ($DB) {echo "$stmt\n";} +$webserver_id_ct = mysqli_num_rows($rslt); +if ($webserver_id_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $webserver_id = $row[0]; + } +else + { + ##### insert webserver entry + $stmt="INSERT INTO vicidial_webservers (webserver,hostname) values('$LOGserver_name','$LOGhostname');"; + if ($DB) {echo "$stmt\n";} + $rslt=mysql_to_mysqli($stmt, $link); + $affected_rows = mysqli_affected_rows($link); + $webserver_id = mysqli_insert_id($link); + } + +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name', url='$LOGfull_url', webserver='$webserver_id';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$report_log_id = mysqli_insert_id($link); +##### END log visit to the vicidial_report_log table ##### $stmt="select campaign_id from vicidial_campaigns;"; if ($non_latin > 0) {$rslt=mysql_to_mysqli("SET NAMES 'UTF8'", $link);} @@ -335,3 +414,18 @@ echo "\n"; } ?> + + \ No newline at end of file diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_performance.php b/agc_2-X/trunk/www/vicidial/AST_agent_performance.php index 6117e9dc..98955310 100644 --- a/agc_2-X/trunk/www/vicidial/AST_agent_performance.php +++ b/agc_2-X/trunk/www/vicidial/AST_agent_performance.php @@ -18,11 +18,16 @@ # 170409-1534 - Added IP List validation code # 170527-0102 - Added variable filtering # 220303-1628 - Added allow_web_debug system setting +# 220812-0950 - Added User Group report permissions checking # +$startMS = microtime(); + require("dbconnect_mysqli.php"); require("functions.php"); +$report_name='Agent Performance Report'; + $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; @@ -83,7 +88,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -91,6 +96,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -149,7 +155,80 @@ else echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; exit; } - + +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + +##### BEGIN log visit to the vicidial_report_log table ##### +$LOGip = getenv("REMOTE_ADDR"); +$LOGbrowser = getenv("HTTP_USER_AGENT"); +$LOGscript_name = getenv("SCRIPT_NAME"); +$LOGserver_name = getenv("SERVER_NAME"); +$LOGserver_port = getenv("SERVER_PORT"); +$LOGrequest_uri = getenv("REQUEST_URI"); +$LOGhttp_referer = getenv("HTTP_REFERER"); +$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser); +$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri); +$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer); +if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';} + else {$HTTPprotocol = 'http://';} +if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';} +else {$LOGserver_port = ":$LOGserver_port";} +$LOGfull_url = "$HTTPprotocol$LOGserver_name$LOGserver_port$LOGrequest_uri"; + +$LOGhostname = php_uname('n'); +if (strlen($LOGhostname)<1) {$LOGhostname='X';} +if (strlen($LOGserver_name)<1) {$LOGserver_name='X';} + +$stmt="SELECT webserver_id FROM vicidial_webservers where webserver='$LOGserver_name' and hostname='$LOGhostname' LIMIT 1;"; +$rslt=mysql_to_mysqli($stmt, $link); +if ($DB) {echo "$stmt\n";} +$webserver_id_ct = mysqli_num_rows($rslt); +if ($webserver_id_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $webserver_id = $row[0]; + } +else + { + ##### insert webserver entry + $stmt="INSERT INTO vicidial_webservers (webserver,hostname) values('$LOGserver_name','$LOGhostname');"; + if ($DB) {echo "$stmt\n";} + $rslt=mysql_to_mysqli($stmt, $link); + $affected_rows = mysqli_affected_rows($link); + $webserver_id = mysqli_insert_id($link); + } + +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name', url='$LOGfull_url', webserver='$webserver_id';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$report_log_id = mysqli_insert_id($link); +##### END log visit to the vicidial_report_log table ##### $stmt="select campaign_id from vicidial_campaigns;"; if ($non_latin > 0) {$rslt=mysql_to_mysqli("SET NAMES 'UTF8'", $link);} @@ -355,4 +434,19 @@ echo "\n"; ?> - \ No newline at end of file + + + \ No newline at end of file diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet.php b/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet.php index 935786df..d450a31a 100644 --- a/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet.php +++ b/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet.php @@ -29,6 +29,7 @@ # 170711-1102 - Added screen colors and fixed default date variable # 220122-1700 - Added more variable filtering # 220221-0938 - Added allow_web_debug system setting +# 220811-1440 - Modified for date ranges instead of single-day # $startMS = microtime(); @@ -47,6 +48,8 @@ if (isset($_GET["agent"])) {$agent=$_GET["agent"];} elseif (isset($_POST["agent"])) {$agent=$_POST["agent"];} if (isset($_GET["query_date"])) {$query_date=$_GET["query_date"];} elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];} +if (isset($_GET["end_date"])) {$end_date=$_GET["end_date"];} + elseif (isset($_POST["end_date"])) {$end_date=$_POST["end_date"];} if (isset($_GET["calls_summary"])) {$calls_summary=$_GET["calls_summary"];} elseif (isset($_POST["calls_summary"])) {$calls_summary=$_POST["calls_summary"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} @@ -64,6 +67,7 @@ $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $STARTtime = date("U"); if ( (!isset($query_date)) or (strlen($query_date) < 8) ) {$query_date = $NOW_DATE;} +if ( (!isset($end_date)) or (strlen($end_date) < 8) ) {$end_date = $NOW_DATE;} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); @@ -114,6 +118,7 @@ else ############# $query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$query_date); +$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$end_date); $file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download); $search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data); $submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); @@ -408,17 +413,22 @@ $subcamp_color = '#C6C6C6'; $MAIN.="
\n"; -$MAIN.=_QXZ("Agent Time Sheet for").": $user\n"; +$MAIN.=_QXZ("Agent Time Sheet for").": $user\n"; $MAIN.="
\n"; -$MAIN.="
  \n"; -$MAIN.=_QXZ("Date").": \n"; -$MAIN.=_QXZ("User ID").": \n"; +$MAIN.="     \n"; +$MAIN.=""; +$MAIN.="\n"; + $MAIN.=""; +$MAIN.="\n"; if ($archives_available=="Y") { - $MAIN.=""._QXZ("Search archived data")."

\n"; + $MAIN.="\n"; } +$MAIN.="
"._QXZ("Date").":"._QXZ("To").":
"._QXZ("User ID").":
"._QXZ("Search archived data")."
"; +$MAIN.="

\n"; + $MAIN.="\n"; $MAIN.="
\n\n"; @@ -436,6 +446,8 @@ else { $query_date_BEGIN = "$query_date 00:00:00"; $query_date_END = "$query_date 23:59:59"; +$end_date_BEGIN = "$end_date 00:00:00"; +$end_date_END = "$end_date 23:59:59"; $time_BEGIN = "00:00:00"; $time_END = "23:59:59"; @@ -447,17 +459,17 @@ $full_name = $row[0]; $MAIN.=""._QXZ("Agent Time Sheet",44)." $NOW_TIME\n"; -$MAIN.=_QXZ("Time range").": $query_date_BEGIN "._QXZ("to")." $query_date_END\n\n"; +$MAIN.=_QXZ("Time range").": $query_date_BEGIN "._QXZ("to")." $end_date_END\n\n"; $MAIN.="---------- "._QXZ("AGENT TIME SHEET").": $agent - $full_name -------------\n\n"; $CSV_text_header.="\""._QXZ("Agent Time Sheet")." - $NOW_TIME\"\n"; -$CSV_text_header.="\""._QXZ("Time range").": $query_date_BEGIN "._QXZ("to")." $query_date_END\"\n"; +$CSV_text_header.="\""._QXZ("Time range").": $query_date_BEGIN "._QXZ("to")." $end_date_END\"\n"; $CSV_text_header.="\""._QXZ("AGENT TIME SHEET").": $agent - $full_name\"\n\n"; if ($calls_summary) { - $stmt="select count(*) as calls,sum(talk_sec) as talk,avg(talk_sec),sum(pause_sec),avg(pause_sec),sum(wait_sec),avg(wait_sec),sum(dispo_sec),avg(dispo_sec) from ".$vicidial_agent_log_table." where event_time <= '" . mysqli_real_escape_string($link, $query_date_END) . "' and event_time >= '" . mysqli_real_escape_string($link, $query_date_BEGIN) . "' and user='" . mysqli_real_escape_string($link, $agent) . "' and pause_sec<48800 and wait_sec<48800 and talk_sec<48800 and dispo_sec<48800 limit 1;"; + $stmt="select count(*) as calls,sum(talk_sec) as talk,avg(talk_sec),sum(pause_sec),avg(pause_sec),sum(wait_sec),avg(wait_sec),sum(dispo_sec),avg(dispo_sec) from ".$vicidial_agent_log_table." where event_time <= '" . mysqli_real_escape_string($link, $end_date_END) . "' and event_time >= '" . mysqli_real_escape_string($link, $query_date_BEGIN) . "' and user='" . mysqli_real_escape_string($link, $agent) . "' and pause_sec<48800 and wait_sec<48800 and talk_sec<48800 and dispo_sec<48800 limit 1;"; $rslt=mysql_to_mysqli($stmt, $link); if ($DB) {$MAIN.="$stmt\n";} $row=mysqli_fetch_row($rslt); @@ -505,7 +517,7 @@ else } -$stmt="select event_time,UNIX_TIMESTAMP(event_time) from ".$vicidial_agent_log_table." where event_time <= '" . mysqli_real_escape_string($link, $query_date_END) . "' and event_time >= '" . mysqli_real_escape_string($link, $query_date_BEGIN) . "' and user='" . mysqli_real_escape_string($link, $agent) . "' order by event_time limit 1;"; +$stmt="select event_time,UNIX_TIMESTAMP(event_time) from ".$vicidial_agent_log_table." where event_time <= '" . mysqli_real_escape_string($link, $end_date_END) . "' and event_time >= '" . mysqli_real_escape_string($link, $query_date_BEGIN) . "' and user='" . mysqli_real_escape_string($link, $agent) . "' order by event_time limit 1;"; $rslt=mysql_to_mysqli($stmt, $link); if ($DB) {$MAIN.="$stmt\n";} $row=mysqli_fetch_row($rslt); @@ -515,7 +527,7 @@ $start = $row[1]; $CSV_login.="\"\",\""._QXZ("FIRST LOGIN").":\",\"$row[0]\"\n"; -$stmt="select event_time,UNIX_TIMESTAMP(event_time) from ".$vicidial_agent_log_table." where event_time <= '" . mysqli_real_escape_string($link, $query_date_END) . "' and event_time >= '" . mysqli_real_escape_string($link, $query_date_BEGIN) . "' and user='" . mysqli_real_escape_string($link, $agent) . "' order by event_time desc limit 1;"; +$stmt="select event_time,UNIX_TIMESTAMP(event_time) from ".$vicidial_agent_log_table." where event_time <= '" . mysqli_real_escape_string($link, $end_date_END) . "' and event_time >= '" . mysqli_real_escape_string($link, $query_date_BEGIN) . "' and user='" . mysqli_real_escape_string($link, $agent) . "' order by event_time desc limit 1;"; $rslt=mysql_to_mysqli($stmt, $link); if ($DB) {$MAIN.="$stmt\n";} $row=mysqli_fetch_row($rslt); @@ -542,13 +554,13 @@ $CSV_text1.=$CSV_login; $total_login_time=0; $SQday_ARY = explode('-',$query_date_BEGIN); -$EQday_ARY = explode('-',$query_date_END); +$EQday_ARY = explode('-',$end_date_END); $SQepoch = mktime(0, 0, 0, $SQday_ARY[1], $SQday_ARY[2], $SQday_ARY[0]); $EQepoch = mktime(23, 59, 59, $EQday_ARY[1], $EQday_ARY[2], $EQday_ARY[0]); $MAIN.="\n"; -$MAIN.=""._QXZ("TIMECLOCK LOGIN/LOGOUT TIME").": ["._QXZ("DOWNLOAD")."]\n"; +$MAIN.=""._QXZ("TIMECLOCK LOGIN/LOGOUT TIME").": ["._QXZ("DOWNLOAD")."]\n"; $MAIN.="\n"; $MAIN.="\n"; diff --git a/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php b/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php index 3cf2ae41..8032800d 100644 --- a/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php +++ b/agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php @@ -19,11 +19,12 @@ # 170409-1534 - Added IP List validation code # 170711-1103 - Added screen colors and fixed default date variable # 220303-1625 - Added allow_web_debug system setting +# 220812-0959 - Added User Group report permissions checking # $startMS = microtime(); -$report_name='Agent Timesheet Archive'; +$report_name = 'User Time Sheet'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -89,7 +90,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -97,6 +98,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -156,6 +158,33 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/agc_2-X/trunk/www/vicidial/AST_carrier_log_report.php b/agc_2-X/trunk/www/vicidial/AST_carrier_log_report.php index d8085c04..99544595 100644 --- a/agc_2-X/trunk/www/vicidial/AST_carrier_log_report.php +++ b/agc_2-X/trunk/www/vicidial/AST_carrier_log_report.php @@ -17,6 +17,7 @@ # 170821-2219 - Added HTML formatting and screen colors # 191013-0815 - Fixes for PHP7 # 220303-0925 - Added allow_web_debug system setting +# 220812-0952 - Added User Group report permissions checking # $startMS = microtime(); @@ -106,7 +107,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -114,6 +115,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -173,6 +175,34 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); $LOGbrowser = getenv("HTTP_USER_AGENT"); diff --git a/agc_2-X/trunk/www/vicidial/AST_dial_log_report.php b/agc_2-X/trunk/www/vicidial/AST_dial_log_report.php index 272dfe7c..ba32ed7b 100644 --- a/agc_2-X/trunk/www/vicidial/AST_dial_log_report.php +++ b/agc_2-X/trunk/www/vicidial/AST_dial_log_report.php @@ -15,6 +15,7 @@ # 191013-0818 - Fixes for PHP7 # 210129-1010 - Added archive search option, issue #1222 # 220303-0812 - Added allow_web_debug system setting +# 220812-0953 - Added User Group report permissions checking # $startMS = microtime(); @@ -226,7 +227,7 @@ else } ############# -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -234,6 +235,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -293,6 +295,33 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/agc_2-X/trunk/www/vicidial/AST_hangup_cause_report.php b/agc_2-X/trunk/www/vicidial/AST_hangup_cause_report.php index 2161e891..a218bbd8 100644 --- a/agc_2-X/trunk/www/vicidial/AST_hangup_cause_report.php +++ b/agc_2-X/trunk/www/vicidial/AST_hangup_cause_report.php @@ -20,6 +20,7 @@ # 191013-0858 - Fixes for PHP7 # 201218-1700 - Modified to include caller ID in results # 220302-1813 - Added allow_web_debug system setting +# 220812-0940 - Added User Group report permissions checking # $startMS = microtime(); @@ -275,7 +276,7 @@ $sip_responses_to_print=count($master_sip_response_directory); $master_dialstatus_array=array(_QXZ("ANSWER"), _QXZ("BUSY"), _QXZ("NOANSWER"), _QXZ("CANCEL"), _QXZ("CONGESTION"), _QXZ("CHANUNAVAIL"), _QXZ("DONTCALL"), _QXZ("TORTURE"), _QXZ("INVALIDARGS")); $dialstatuses_to_print=count($master_dialstatus_array); -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -283,6 +284,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -342,6 +344,34 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/agc_2-X/trunk/www/vicidial/AST_inboundEXTstats.php b/agc_2-X/trunk/www/vicidial/AST_inboundEXTstats.php index 129f274f..a64f6941 100644 --- a/agc_2-X/trunk/www/vicidial/AST_inboundEXTstats.php +++ b/agc_2-X/trunk/www/vicidial/AST_inboundEXTstats.php @@ -16,11 +16,16 @@ # 141230-1452 - Added code for on-the-fly language translations display # 170409-1534 - Added IP List validation code # 220303-1623 - Added allow_web_debug system setting +# 220812-0954 - Added User Group report permissions checking # +$startMS = microtime(); + require("dbconnect_mysqli.php"); require("functions.php"); +$report_name='Inbound Extension Stats'; + $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; @@ -81,7 +86,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -89,6 +94,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -148,6 +154,79 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + +##### BEGIN log visit to the vicidial_report_log table ##### +$LOGip = getenv("REMOTE_ADDR"); +$LOGbrowser = getenv("HTTP_USER_AGENT"); +$LOGscript_name = getenv("SCRIPT_NAME"); +$LOGserver_name = getenv("SERVER_NAME"); +$LOGserver_port = getenv("SERVER_PORT"); +$LOGrequest_uri = getenv("REQUEST_URI"); +$LOGhttp_referer = getenv("HTTP_REFERER"); +$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser); +$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri); +$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer); +if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';} + else {$HTTPprotocol = 'http://';} +if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';} +else {$LOGserver_port = ":$LOGserver_port";} +$LOGfull_url = "$HTTPprotocol$LOGserver_name$LOGserver_port$LOGrequest_uri"; + +$LOGhostname = php_uname('n'); +if (strlen($LOGhostname)<1) {$LOGhostname='X';} +if (strlen($LOGserver_name)<1) {$LOGserver_name='X';} + +$stmt="SELECT webserver_id FROM vicidial_webservers where webserver='$LOGserver_name' and hostname='$LOGhostname' LIMIT 1;"; +$rslt=mysql_to_mysqli($stmt, $link); +if ($DB) {echo "$stmt\n";} +$webserver_id_ct = mysqli_num_rows($rslt); +if ($webserver_id_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $webserver_id = $row[0]; + } +else + { + ##### insert webserver entry + $stmt="INSERT INTO vicidial_webservers (webserver,hostname) values('$LOGserver_name','$LOGhostname');"; + if ($DB) {echo "$stmt\n";} + $rslt=mysql_to_mysqli($stmt, $link); + $affected_rows = mysqli_affected_rows($link); + $webserver_id = mysqli_insert_id($link); + } + +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name', url='$LOGfull_url', webserver='$webserver_id';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$report_log_id = mysqli_insert_id($link); +##### END log visit to the vicidial_report_log table ##### $stmt="select extension,full_number,inbound_name from inbound_numbers where server_ip='" . mysqli_real_escape_string($link, $server_ip) . "';"; $rslt=mysql_to_mysqli($stmt, $link); @@ -497,4 +576,19 @@ if ($output == 'FULL') ?> - \ No newline at end of file + + + \ No newline at end of file diff --git a/agc_2-X/trunk/www/vicidial/AST_inboundEXTstats_department.php b/agc_2-X/trunk/www/vicidial/AST_inboundEXTstats_department.php index 19829b8d..c4646429 100644 --- a/agc_2-X/trunk/www/vicidial/AST_inboundEXTstats_department.php +++ b/agc_2-X/trunk/www/vicidial/AST_inboundEXTstats_department.php @@ -14,11 +14,16 @@ # 141230-1450 - Added code for on-the-fly language translations display # 170409-1534 - Added IP List validation code # 220303-1619 - Added allow_web_debug system setting +# 220812-0955 - Added User Group report permissions checking # +$startMS = microtime(); + require("dbconnect_mysqli.php"); require("functions.php"); +$report_name='Inbound Extension Stats'; + $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; @@ -83,7 +88,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -91,6 +96,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -150,6 +156,79 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + +##### BEGIN log visit to the vicidial_report_log table ##### +$LOGip = getenv("REMOTE_ADDR"); +$LOGbrowser = getenv("HTTP_USER_AGENT"); +$LOGscript_name = getenv("SCRIPT_NAME"); +$LOGserver_name = getenv("SERVER_NAME"); +$LOGserver_port = getenv("SERVER_PORT"); +$LOGrequest_uri = getenv("REQUEST_URI"); +$LOGhttp_referer = getenv("HTTP_REFERER"); +$LOGbrowser=preg_replace("/\'|\"|\\\\/","",$LOGbrowser); +$LOGrequest_uri=preg_replace("/\'|\"|\\\\/","",$LOGrequest_uri); +$LOGhttp_referer=preg_replace("/\'|\"|\\\\/","",$LOGhttp_referer); +if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';} + else {$HTTPprotocol = 'http://';} +if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';} +else {$LOGserver_port = ":$LOGserver_port";} +$LOGfull_url = "$HTTPprotocol$LOGserver_name$LOGserver_port$LOGrequest_uri"; + +$LOGhostname = php_uname('n'); +if (strlen($LOGhostname)<1) {$LOGhostname='X';} +if (strlen($LOGserver_name)<1) {$LOGserver_name='X';} + +$stmt="SELECT webserver_id FROM vicidial_webservers where webserver='$LOGserver_name' and hostname='$LOGhostname' LIMIT 1;"; +$rslt=mysql_to_mysqli($stmt, $link); +if ($DB) {echo "$stmt\n";} +$webserver_id_ct = mysqli_num_rows($rslt); +if ($webserver_id_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $webserver_id = $row[0]; + } +else + { + ##### insert webserver entry + $stmt="INSERT INTO vicidial_webservers (webserver,hostname) values('$LOGserver_name','$LOGhostname');"; + if ($DB) {echo "$stmt\n";} + $rslt=mysql_to_mysqli($stmt, $link); + $affected_rows = mysqli_affected_rows($link); + $webserver_id = mysqli_insert_id($link); + } + +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name', url='$LOGfull_url', webserver='$webserver_id';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$report_log_id = mysqli_insert_id($link); +##### END log visit to the vicidial_report_log table ##### $stmt="select distinct department from inbound_numbers;"; $rslt=mysql_to_mysqli($stmt, $link); @@ -274,3 +353,18 @@ else + + \ No newline at end of file diff --git a/agc_2-X/trunk/www/vicidial/AST_timeonVDAD.php b/agc_2-X/trunk/www/vicidial/AST_timeonVDAD.php index b8006c68..0f2c54a0 100644 --- a/agc_2-X/trunk/www/vicidial/AST_timeonVDAD.php +++ b/agc_2-X/trunk/www/vicidial/AST_timeonVDAD.php @@ -21,6 +21,7 @@ # 141230-1418 - Added code for on-the-fly language translations display # 170409-1534 - Added IP List validation code # 220303-1606 - Added allow_web_debug system setting +# 220812-0956 - Added User Group report permissions checking # header ("Content-type: text/html; charset=utf-8"); @@ -28,6 +29,8 @@ header ("Content-type: text/html; charset=utf-8"); require("dbconnect_mysqli.php"); require("functions.php"); +$report_name='Agents Time On Calls'; + $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; @@ -87,7 +90,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -95,6 +98,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -154,6 +158,34 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + $reset_counter++; if ($reset_counter > 7) diff --git a/agc_2-X/trunk/www/vicidial/AST_url_log_report.php b/agc_2-X/trunk/www/vicidial/AST_url_log_report.php index 7d83f432..2955e589 100644 --- a/agc_2-X/trunk/www/vicidial/AST_url_log_report.php +++ b/agc_2-X/trunk/www/vicidial/AST_url_log_report.php @@ -13,6 +13,7 @@ # 170409-1536 - Added IP List validation code # 170710-1801 - Added webform url type # 220301-1951 - Added allow_web_debug system setting +# 220812-0931 - Added User Group report permissions checking # $startMS = microtime(); @@ -105,7 +106,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -113,6 +114,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -172,6 +174,34 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php b/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php index 80ba2295..068fa105 100644 --- a/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php +++ b/agc_2-X/trunk/www/vicidial/AST_vdad_debug_log_report.php @@ -8,6 +8,7 @@ # 161201-0815 - Added more statistics and options # 170409-1550 - Added IP List validation code # 220301-1650 - Added allow_web_debug system setting +# 220812-0930 - Added User Group report permissions checking # $startMS = microtime(); @@ -107,7 +108,7 @@ else $stage = preg_replace('/[^-_0-9\p{L}]/u',"",$stage); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -115,6 +116,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -174,6 +176,34 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); $LOGbrowser = getenv("HTTP_USER_AGENT"); diff --git a/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php b/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php index 5b23d0b1..93dbd1b4 100644 --- a/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php +++ b/agc_2-X/trunk/www/vicidial/AST_webserver_url_report.php @@ -12,6 +12,7 @@ # 170829-0040 - Added screen color settings # 191013-0907 - Fixes for PHP7 # 220301-1616 - Added allow_web_debug system setting +# 220812-0927 - Added User Group report permissions checking # $startMS = microtime(); @@ -109,7 +110,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -117,6 +118,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -176,6 +178,34 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/agc_2-X/trunk/www/vicidial/admin.php b/agc_2-X/trunk/www/vicidial/admin.php index 1e62b0cf..2e0bdbfc 100644 --- a/agc_2-X/trunk/www/vicidial/admin.php +++ b/agc_2-X/trunk/www/vicidial/admin.php @@ -125,9 +125,9 @@ $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); $QUERY_STRING = getenv("QUERY_STRING"); $groups=array(); -$Vreports = 'NONE, Real-Time Main Report, Real-Time Campaign Summary, Real-Time Whiteboard Report, Inbound Report, Inbound Report by DID, Inbound Service Level Report, Inbound Summary Hourly Report, Inbound Daily Report, Inbound DID Report, Inbound DID Summary Report, Agent DID Report, Inbound DID Detail Report, Inbound IVR Report, Inbound Forecasting Report, Advanced Forecasting Report, Outbound Calling Report, Outbound Summary Interval Report, Outbound IVR Report, Callmenu Survey Report, Outbound Lead Source Report, Fronter - Closer Report, Fronter - Closer Detail Report, Lists Campaign Statuses Report, Lists Statuses Report, Campaign Status List Report, Export Calls Report, Export Leads Report, Agent Time Detail, Agent Status Detail, Agent Inbound Status Summary, Agent Performance Detail, Team Performance Detail, Performance Comparison Report, Single Agent Daily, Single Agent Daily Time, User Group Login Report, User Group Hourly Report, User Group Detail Hourly Report, User Timeclock Report, User Group Timeclock Status Report, User Timeclock Detail Report, Server Performance Report, Administration Change Log, List Update Stats, User Stats, User Time Sheet, Download List, Dialer Inventory Report, Maximum System Stats, Maximum Stats Detail, Search Leads Logs, Email Log Report, Carrier Log Report, Campaign Debug, Shared Debug, Asterisk Debug, Hangup Cause Report, Lists Pass Report, Called Counts List IDs Report, Agent Debug Log Report, Agent Parked Call Report, Agent-Manager Chat Log, Recording Access Log Report, API Log Report, Real-Time Monitoring Log Report, AMD Log Report, SIP Event Report, Caller ID Log Report, Quality Control Report, Settings Compare, Phone Stats'; +$Vreports = 'NONE, Real-Time Main Report, Real-Time Campaign Summary, Real-Time Whiteboard Report, Inbound Report, Inbound Report by DID, Inbound Service Level Report, Inbound Summary Hourly Report, Inbound Daily Report, Inbound DID Report, Inbound DID Summary Report, Agent DID Report, Inbound DID Detail Report, Inbound IVR Report, Inbound Forecasting Report, Advanced Forecasting Report, Outbound Calling Report, Outbound Summary Interval Report, Outbound IVR Report, Callmenu Survey Report, Outbound Lead Source Report, Fronter - Closer Report, Fronter - Closer Detail Report, Lists Campaign Statuses Report, Lists Statuses Report, Campaign Status List Report, Export Calls Report, Export Leads Report, Agent Time Detail, Agent Status Detail, Agent Inbound Status Summary, Agent Performance Detail, Team Performance Detail, Performance Comparison Report, Single Agent Daily, Single Agent Daily Time, User Group Login Report, User Group Hourly Report, User Group Detail Hourly Report, User Timeclock Report, User Group Timeclock Status Report, User Timeclock Detail Report, Server Performance Report, Administration Change Log, List Update Stats, User Stats, User Time Sheet, Download List, Dialer Inventory Report, Maximum System Stats, Maximum Stats Detail, Search Leads Logs, Email Log Report, Carrier Log Report, Campaign Debug, Shared Debug, Asterisk Debug, Hangup Cause Report, Lists Pass Report, Called Counts List IDs Report, Agent Debug Log Report, Agent Parked Call Report, Agent-Manager Chat Log, Recording Access Log Report, API Log Report, Real-Time Monitoring Log Report, AMD Log Report, SIP Event Report, Caller ID Log Report, Quality Control Report, Settings Compare, Phone Stats, Hopper List Report, In-Group User List, Webserver-URL Report, VDAD Debug Log Report, URL Log Report, Medialog Inventory Report, Asterisk Debug, SPH Report, Shared Debug, Process Report, Group Alias Report, Hangup Cause Report, IVR Filter Report, LAGGED Agent Log Report, Agent Disposition Report, Agent Performance Report, Carrier Log Report, Dial Log Report, Inbound Extension Stats, Agents Time On Calls, Callbacks Export'; -$UGreports = 'ALL REPORTS, NONE, Real-Time Main Report, Real-Time Campaign Summary, Real-Time Whiteboard Report, Inbound Report, Inbound Report by DID, Inbound Service Level Report, Inbound Summary Hourly Report, Inbound Daily Report, Inbound DID Report, Inbound DID Summary Report, Agent DID Report, Inbound DID Detail Report, Inbound Email Report, Inbound Chat Report, Inbound IVR Report, Inbound Forecasting Report, Advanced Forecasting Report, Outbound Calling Report, Outbound Summary Interval Report, Outbound IVR Report, Callmenu Survey Report, Outbound Lead Source Report, Fronter - Closer Report, Fronter - Closer Detail Report, Lists Campaign Statuses Report, Lists Statuses Report, Campaign Status List Report, Export Calls Report, Export Leads Report, Agent Time Detail, Agent Status Detail, Agent Inbound Status Summary, Agent Performance Detail, Team Performance Detail, Performance Comparison Report, Single Agent Daily, Single Agent Daily Time, User Group Login Report, User Group Hourly Report, User Group Detail Hourly Report, User Timeclock Report, User Group Timeclock Status Report, User Timeclock Detail Report, Server Performance Report, Administration Change Log, List Update Stats, User Stats, User Time Sheet, Download List, Dialer Inventory Report, Custom Reports Links, CallCard Search, Maximum System Stats, Maximum Stats Detail, Search Leads Logs, Email Log Report, Lists Pass Report, Called Counts List IDs Report, Front Page System Summary, Report Page Servers Summary, Admin Utilities Page, Agent Debug Log Report, Agent Parked Call Report, Agent-Manager Chat Log, Recording Access Log Report, API Log Report, Real-Time Monitoring Log Report, AMD Log Report, SIP Event Report, Caller ID Log Report, Quality Control Report, Settings Compare, Phone Stats, VERM QA Links'; +$UGreports = 'ALL REPORTS, NONE, Real-Time Main Report, Real-Time Campaign Summary, Real-Time Whiteboard Report, Inbound Report, Inbound Report by DID, Inbound Service Level Report, Inbound Summary Hourly Report, Inbound Daily Report, Inbound DID Report, Inbound DID Summary Report, Agent DID Report, Inbound DID Detail Report, Inbound Email Report, Inbound Chat Report, Inbound IVR Report, Inbound Forecasting Report, Advanced Forecasting Report, Outbound Calling Report, Outbound Summary Interval Report, Outbound IVR Report, Callmenu Survey Report, Outbound Lead Source Report, Fronter - Closer Report, Fronter - Closer Detail Report, Lists Campaign Statuses Report, Lists Statuses Report, Campaign Status List Report, Export Calls Report, Export Leads Report, Agent Time Detail, Agent Status Detail, Agent Inbound Status Summary, Agent Performance Detail, Team Performance Detail, Performance Comparison Report, Single Agent Daily, Single Agent Daily Time, User Group Login Report, User Group Hourly Report, User Group Detail Hourly Report, User Timeclock Report, User Group Timeclock Status Report, User Timeclock Detail Report, Server Performance Report, Administration Change Log, List Update Stats, User Stats, User Time Sheet, Download List, Dialer Inventory Report, Custom Reports Links, CallCard Search, Maximum System Stats, Maximum Stats Detail, Search Leads Logs, Email Log Report, Lists Pass Report, Called Counts List IDs Report, Front Page System Summary, Report Page Servers Summary, Admin Utilities Page, Agent Debug Log Report, Agent Parked Call Report, Agent-Manager Chat Log, Recording Access Log Report, API Log Report, Real-Time Monitoring Log Report, AMD Log Report, SIP Event Report, Caller ID Log Report, Quality Control Report, Settings Compare, Phone Stats, Hopper List Report, In-Group User List, Webserver-URL Report, VDAD Debug Log Report, URL Log Report, Medialog Inventory Report, Asterisk Debug, SPH Report, Shared Debug, Process Report, Group Alias Report, Hangup Cause Report, IVR Filter Report, LAGGED Agent Log Report, Agent Disposition Report, Agent Performance Report, Carrier Log Report, Dial Log Report, Inbound Extension Stats, Agents Time On Calls, Callbacks Export, VERM QA Links'; $Vtables = 'NONE,log_noanswer,did_agent_log,contact_information'; diff --git a/agc_2-X/trunk/www/vicidial/asterisk_debug.php b/agc_2-X/trunk/www/vicidial/asterisk_debug.php index 843c30e3..54fe7f79 100644 --- a/agc_2-X/trunk/www/vicidial/asterisk_debug.php +++ b/agc_2-X/trunk/www/vicidial/asterisk_debug.php @@ -8,6 +8,8 @@ # 170409-1536 - Added IP List validation code # 191013-0905 - Fixes for PHP7 # 220228-2155 - Added allow_web_debug system setting +# 220812-0934 - Added User Group report permissions checking + # $startMS = microtime(); @@ -73,7 +75,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -81,6 +83,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -161,6 +164,34 @@ if ($LOGmodify_servers < 1) exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/agc_2-X/trunk/www/vicidial/callbacks_export.php b/agc_2-X/trunk/www/vicidial/callbacks_export.php index f150d8bf..51148f33 100644 --- a/agc_2-X/trunk/www/vicidial/callbacks_export.php +++ b/agc_2-X/trunk/www/vicidial/callbacks_export.php @@ -7,8 +7,11 @@ # 200622-1615 - First build # 220228-2126 - Added allow_web_debug system setting # 220713-1748 - Added user & count to output/modified SQL +# 220812-1000 - Added User Group report permissions checking # +$startMS = microtime(); + require("dbconnect_mysqli.php"); require("functions.php"); @@ -43,7 +46,8 @@ $ip = getenv("REMOTE_ADDR"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -$report_name="CALLBACKS EXPORT"; + +$report_name="Callbacks Export"; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### @@ -88,7 +92,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language,qc_enabled from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,qc_enabled,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -97,6 +101,7 @@ if ($sl_ct > 0) $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; $qc_auth = $row[1]; + $LOGuser_group = $row[2]; } $category=''; @@ -195,6 +200,14 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen( $whereLOGadmin_viewable_call_timesSQL = "where call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')"; } +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + $NWB = "\"HELP\""; diff --git a/agc_2-X/trunk/www/vicidial/campaign_debug.php b/agc_2-X/trunk/www/vicidial/campaign_debug.php index 5f843615..3247dabf 100644 --- a/agc_2-X/trunk/www/vicidial/campaign_debug.php +++ b/agc_2-X/trunk/www/vicidial/campaign_debug.php @@ -18,6 +18,7 @@ # 201122-2249 - Added Hopper debug output # 201219-2119 - Added SHARED campaign output # 220228-2048 - Added allow_web_debug system setting +# 220812-0933 - Added User Group report permissions checking # $startMS = microtime(); @@ -84,7 +85,7 @@ else $group = preg_replace('/[^-_0-9\p{L}]/u', '', $group); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -92,6 +93,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -164,6 +166,34 @@ if ($LOGmodify_campaigns < 1) exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/agc_2-X/trunk/www/vicidial/group_hourly_stats.php b/agc_2-X/trunk/www/vicidial/group_hourly_stats.php index 367febad..2818c1ad 100644 --- a/agc_2-X/trunk/www/vicidial/group_hourly_stats.php +++ b/agc_2-X/trunk/www/vicidial/group_hourly_stats.php @@ -21,6 +21,7 @@ # 160325-1426 - Changes for sidebar update # 170409-1539 - Added IP List validation code # 220303-1547 - Added allow_web_debug system setting +# 220812-0958 - Added User Group report permissions checking # $startMS = microtime(); @@ -100,7 +101,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -108,6 +109,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -167,6 +169,34 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); $LOGbrowser = getenv("HTTP_USER_AGENT"); diff --git a/agc_2-X/trunk/www/vicidial/medialog_inventory_report.php b/agc_2-X/trunk/www/vicidial/medialog_inventory_report.php index ea81010d..530e9041 100644 --- a/agc_2-X/trunk/www/vicidial/medialog_inventory_report.php +++ b/agc_2-X/trunk/www/vicidial/medialog_inventory_report.php @@ -13,6 +13,7 @@ # 170409-1540 - Added IP List validation code # 180508-2315 - Added new help display # 220228-1715 - Added allow_web_debug system setting +# 220812-0932 - Added User Group report permissions checking # $startMS = microtime(); @@ -148,7 +149,7 @@ if ($srv_conf_ct > 0) $carrier_logging_active = $row[0]; } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; # if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -156,6 +157,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -215,6 +217,34 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); $LOGbrowser = getenv("HTTP_USER_AGENT"); diff --git a/agc_2-X/trunk/www/vicidial/process_report.php b/agc_2-X/trunk/www/vicidial/process_report.php index 2c3a6c64..1e144cc1 100644 --- a/agc_2-X/trunk/www/vicidial/process_report.php +++ b/agc_2-X/trunk/www/vicidial/process_report.php @@ -6,6 +6,7 @@ # CHANGES # 180114-1051 - First build # 220227-1958 - Added allow_web_debug system setting +# 220812-0938 - Added User Group report permissions checking # $startMS = microtime(); @@ -151,6 +152,34 @@ if ($LOGview_reports < 1) exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/agc_2-X/trunk/www/vicidial/settings_compare.php b/agc_2-X/trunk/www/vicidial/settings_compare.php index f42f1228..a0df7dfe 100644 --- a/agc_2-X/trunk/www/vicidial/settings_compare.php +++ b/agc_2-X/trunk/www/vicidial/settings_compare.php @@ -6,6 +6,7 @@ # CHANGES # 210306-2052 - First build # 220227-1955 - Added allow_web_debug system setting +# 220812-0937 - Added User Group report permissions checking # $startMS = microtime(); @@ -80,7 +81,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -88,6 +89,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -202,6 +204,14 @@ if ( (!preg_match('/\-\-ALL\-\-/i',$LOGadmin_viewable_groups)) and (strlen($LOGa else {$admin_viewable_groupsALL=1;} +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/agc_2-X/trunk/www/vicidial/shared_debug.php b/agc_2-X/trunk/www/vicidial/shared_debug.php index d02c04a2..9069c4bd 100644 --- a/agc_2-X/trunk/www/vicidial/shared_debug.php +++ b/agc_2-X/trunk/www/vicidial/shared_debug.php @@ -6,6 +6,7 @@ # CHANGES # 210207-0913 - First build # 220227-1944 - Added allow_web_debug system setting +# 220812-0936 - Added User Group report permissions checking # $startMS = microtime(); @@ -80,7 +81,7 @@ else $stage = preg_replace('/[^-_0-9\p{L}]/u', '', $stage); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -88,6 +89,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -160,6 +162,34 @@ if ($LOGmodify_campaigns < 1) exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/agc_2-X/trunk/www/vicidial/sph_report.php b/agc_2-X/trunk/www/vicidial/sph_report.php index b535d846..e1952883 100644 --- a/agc_2-X/trunk/www/vicidial/sph_report.php +++ b/agc_2-X/trunk/www/vicidial/sph_report.php @@ -17,6 +17,7 @@ # 141230-0950 - Added code for on-the-fly language translations display # 170409-1534 - Added IP List validation code # 220227-1936 - Added allow_web_debug system setting +# 220812-0935 - Added User Group report permissions checking # $startMS = microtime(); @@ -112,7 +113,7 @@ else $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; +$stmt="SELECT selected_language,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); @@ -120,6 +121,7 @@ if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; + $LOGuser_group = $row[1]; } $auth=0; @@ -179,6 +181,34 @@ else exit; } +$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {$HTML_text.="|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); +$row=mysqli_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; +$LOGadmin_viewable_groups = $row[2]; +$LOGadmin_viewable_call_times = $row[3]; + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); $LOGbrowser = getenv("HTTP_USER_AGENT");
"._QXZ("ID")." "._QXZ("EDIT")." "._QXZ("EVENT")." "._QXZ("DATE")." "._QXZ("IP ADDRESS")." "._QXZ("GROUP").""._QXZ("HOURS:MINUTES")."