From 5a541b0ecdf22426ed814362a0f908dfbe665fca Mon Sep 17 00:00:00 2001 From: mattf Date: Tue, 27 Mar 2012 20:58:16 +0000 Subject: [PATCH] minor security fixes from issue #545 git-svn-id: svn://192.168.202.10@1799 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/trunk/www/agc/api.php | 2 ++ agc_2-X/trunk/www/vicidial/callcard_admin.php | 2 +- agc_2-X/trunk/www/vicidial/user_territories.php | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/agc_2-X/trunk/www/agc/api.php b/agc_2-X/trunk/www/agc/api.php index f03d75d8..f6f46d82 100644 --- a/agc_2-X/trunk/www/agc/api.php +++ b/agc_2-X/trunk/www/agc/api.php @@ -263,6 +263,8 @@ if ($non_latin < 1) $callback_comments = ereg_replace("\+"," ",$callback_comments); $callback_comments = ereg_replace("[^- \.\_0-9a-zA-Z]","",$callback_comments); $qm_dispo_code = ereg_replace("[^-\.\_0-9a-zA-Z]","",$qm_dispo_code); + $alt_user = ereg_replace("[^0-9a-zA-Z]","",$alt_user); + $postal_code = ereg_replace("[^- \.\_0-9a-zA-Z]","",$postal_code); } else { diff --git a/agc_2-X/trunk/www/vicidial/callcard_admin.php b/agc_2-X/trunk/www/vicidial/callcard_admin.php index 5d5b6a72..637656ca 100644 --- a/agc_2-X/trunk/www/vicidial/callcard_admin.php +++ b/agc_2-X/trunk/www/vicidial/callcard_admin.php @@ -112,7 +112,7 @@ if ($non_latin < 1) $batch = ereg_replace("[^0-9]","",$batch); $pack = ereg_replace("[^0-9]","",$pack); $sequence = ereg_replace("[^0-9]","",$sequence); - $territory_description = ereg_replace("[^ -\_\.\,0-9a-zA-Z]","",$territory_description); + $territory_description = ereg_replace("[^- \_\.\,0-9a-zA-Z]","",$territory_description); $user = ereg_replace("[^-\_0-9a-zA-Z]","",$user); $old_territory = ereg_replace("[^-\_0-9a-zA-Z]","",$old_territory); $old_user = ereg_replace("[^-\_0-9a-zA-Z]","",$old_user); diff --git a/agc_2-X/trunk/www/vicidial/user_territories.php b/agc_2-X/trunk/www/vicidial/user_territories.php index 92006655..ce6d622d 100644 --- a/agc_2-X/trunk/www/vicidial/user_territories.php +++ b/agc_2-X/trunk/www/vicidial/user_territories.php @@ -84,7 +84,7 @@ if ($non_latin < 1) $DB = ereg_replace("[^0-9]","",$DB); $action = ereg_replace("[^\_0-9a-zA-Z]","",$action); $territory = ereg_replace("[^-\_0-9a-zA-Z]","",$territory); - $territory_description = ereg_replace("[^ -\_\.\,0-9a-zA-Z]","",$territory_description); + $territory_description = ereg_replace("[^- \_\.\,0-9a-zA-Z]","",$territory_description); $user = ereg_replace("[^-\_0-9a-zA-Z]","",$user); $level = ereg_replace("[^\_A-Z]","",$level); $old_territory = ereg_replace("[^-\_0-9a-zA-Z]","",$old_territory);