ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added more variable filtering to several PHP scripts.

Browse Source 
git-svn-id: svn://192.168.202.10@3499 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2021-08-23 14:20:56 +00:00
parent 5a3ec2ca4d
commit 67cc4767fe
6 changed files with 64 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/agc/manager_send.php
+6 -5
View File
@@ -147,10 +147,11 @@
# 201117-1751 - Changes for better compatibility with non-latin data input
# 210615-1016 - Default security fixes, CVE-2021-28854
# 210616-2051 - Added optional CORS support, see options.php for details
# 210823-0916 - Fix for security issue
#
$version = '2.14-94';
$build = '210616-2051';
$version = '2.14-95';
$build = '210823-0916';
$php_script = 'manager_send.php';
$mel=1; # Mysql Error Log enabled = 1
$mysql_log_count=143;
@@ -555,9 +556,9 @@ if ($ACTION=="OriginateVDRelogin")
$CIDdate = date("ymdHis");
$DS='-';
$SIPSAK_prefix = 'LIN-';
$campaign = preg_replace("/\'|\"|\\\\|;/","",$campaign);
$extension = preg_replace("/\'|\"|\\\\|;/","",$extension);
$phone_ip = preg_replace("/\'|\"|\\\\|;/","",$phone_ip);
$campaign = preg_replace('/[^-\._0-9\p{L}]/u',"",$campaign);
$extension = preg_replace('/[^-\._0-9\p{L}]/u',"",$extension);
$phone_ip = preg_replace('/[^-\._0-9\p{L}]/u',"",$phone_ip);
print "<!-- sending login sipsak message: $SIPSAK_prefix$campaign -->\n";
passthru("/usr/local/bin/sipsak -M -O desktop -B \"$SIPSAK_prefix$campaign\" -r 5060 -s sip:$extension@$phone_ip > /dev/null");
agc_2-X/trunk/www/agc/vicidial_redirect.php
+10 -2
View File
@@ -1,13 +1,14 @@
<?php
# vicidial_redirect.php - forwards agents to another URL for vicidial.php login
#
# Copyright (C) 2014 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# CHANGELOG
# 71202-1546 - First Build
# 90508-0727 - Changed to PHP long tags
# 140811-0852 - Changed to use QXZ function for echoing text
# 141216-2131 - Added language settings lookups and user/pass variable standardization
# 210823-1004 - Fix for security issue
#
require_once("functions.php");
@@ -39,7 +40,14 @@ if (!isset($phone_pass))
elseif (isset($_POST["pp"])) {$phone_pass=$_POST["pp"];}
}
$VD_login=preg_replace("/\'|\"|\\\\|;| /","",$VD_login);
$DB = preg_replace('/[^-\._0-9\p{L}]/u',"",$DB);
$phone_login = preg_replace('/[^-\._0-9\p{L}]/u',"",$phone_login);
$phone_pass = preg_replace('/[^-\._0-9\p{L}]/u',"",$phone_pass);
$VD_login = preg_replace('/[^-\._0-9\p{L}]/u',"",$VD_login);
$VD_pass = preg_replace('/[^-\._0-9\p{L}]/u',"",$VD_pass);
$VD_campaign = preg_replace('/[^-\._0-9\p{L}]/u',"",$VD_campaign);
$relogin = preg_replace('/[^-\._0-9\p{L}]/u',"",$relogin);
#############################################
##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
agc_2-X/trunk/www/agc/webphone/zoiperweb.php
+12 -1
View File
@@ -1,7 +1,7 @@
<?php
# zoiperweb.php - the web-based Zoiper softphone
#
# Copyright (C) 2011 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# variables sent to this script:
# $phone_login - phone login
@@ -19,6 +19,7 @@
# 100827-1417 - Added system_key variable
# 101227-1313 - Added DIALPLAN_OFF_TOGGLE option
# 110526-1726 - Added AUTOANSWER option
# 210823-0959 - Fix for security issue
#
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
@@ -51,6 +52,16 @@ $b64_system_key = base64_decode($system_key);
if ($b64_protocol != 'SIP')
{$b64_protocol = 'IAX';}
$b64_phone_login = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_phone_login);
$b64_phone_pass = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_phone_pass);
$b64_server_ip = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_server_ip);
$b64_callerid = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_callerid);
$b64_protocol = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_protocol);
$b64_codecs = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_codecs);
$b64_options = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_options);
$b64_system_key = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_system_key);
?>
<html>
agc_2-X/trunk/www/agc/webphone/zoiperweb_redirect.php
+12 -1
View File
@@ -1,10 +1,11 @@
<?php
# zoiperweb_redirect.php - used for load balance forwarding with variables
#
# Copyright (C) 2010 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# CHANGELOG
# 100827-1419 - First Build
# 210823-1010 - Fix for security issue
#
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
@@ -26,6 +27,16 @@ if (isset($_GET["options"])) {$options=$_GET["options"];}
if (isset($_GET["system_key"])) {$system_key=$_GET["system_key"];}
elseif (isset($_POST["system_key"])) {$system_key=$_POST["system_key"];}
$DB = preg_replace('/[^-\._0-9\p{L}]/u',"",$DB);
$phone_login = preg_replace('/[^-\._0-9\p{L}]/u',"",$phone_login);
$phone_pass = preg_replace('/[^-\._0-9\p{L}]/u',"",$phone_pass);
$server_ip = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$server_ip);
$callerid = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$callerid);
$protocol = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$protocol);
$codecs = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$codecs);
$options = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$options);
$system_key = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$system_key);
$query_string = "/agc/webphone/zoiperweb.php?DB=$DB&phone_login=$phone_login&phone_pass=$phone_pass&server_ip=$server_ip&callerid=$callerid&protocol=$protocol&codecs=$codecs&options=$options&system_key=$system_key";
$servers = array("sslagent1.server.net","sslagent2.server.net");
agc_2-X/trunk/www/vicidial/non_agent_api.php
+10 -7
View File
@@ -182,10 +182,11 @@
# 210625-1421 - Added BARGESWAP option to blind_monitor function
# 210701-2050 - Added ingroup_rank/ingroup_grade options to the update_user function
# 210812-2640 - Added update of live agent records for ingroup_rank/ingroup_grade in the update_user function
# 210823-0918 - Fix for security issue
#
$version = '2.14-159';
$build = '210812-2640';
$version = '2.14-160';
$build = '210823-0918';
$php_script='non_agent_api.php';
$api_url_log = 0;
@@ -708,6 +709,7 @@ if ($non_latin < 1)
$DB=preg_replace('/[^0-9]/','',$DB);
$user=preg_replace('/[^-_0-9a-zA-Z]/','',$user);
$pass=preg_replace('/[^-_0-9a-zA-Z]/','',$pass);
$agent_user=preg_replace('/[^-_0-9a-zA-Z]/','',$agent_user);
$function = preg_replace('/[^-\_0-9a-zA-Z]/', '',$function);
$format = preg_replace('/[^0-9a-zA-Z]/','',$format);
$entry_list_id = preg_replace('/[^0-9]/','',$entry_list_id);
@@ -928,11 +930,12 @@ if ($non_latin < 1)
}
else
{
$user = preg_replace("/'|\"|\\\\|;|#/","",$user);
$pass = preg_replace("/'|\"|\\\\|;|#/","",$pass);
$source = preg_replace("/'|\"|\\\\|;|#/","",$source);
$source_user = preg_replace("/'|\"|\\\\|;|#/","",$source_user);
$menu_id = preg_replace("/'|\"|\\\\|;|#/",'',$menu_id);
$user = preg_replace('/[^-_0-9\p{L}]/u',"",$user);
$pass = preg_replace('/[^-_0-9\p{L}]/u',"",$pass);
$agent_user=preg_replace('/[^-_0-9\p{L}]/u','',$agent_user);
$source = preg_replace('/[^-_0-9\p{L}]/u',"",$source);
$source_user = preg_replace('/[^-_0-9\p{L}]/u',"",$source_user);
$menu_id = preg_replace('/[^-_0-9\p{L}]/u','',$menu_id);
}
$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id);
$list_id_field = preg_replace('/[^0-9]/','',$list_id_field);
agc_2-X/trunk/www/vicidial/whiteboard_reports.php
+14 -2
View File
@@ -1,13 +1,14 @@
<?php
# whiteboard_reports.php
#
# Copyright (C) 2020 Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com>, Joe Johnson <freewermadmin@gmail.com> LICENSE: AGPLv2
#
# A PHP file that is for generating the stats that are displayed in the whiteboard report. Returns values.
#
# 171027-2352 - First build
# 190302-1707 - Added code to exclude active calls from being counted with some stats
# 200427-2225 - Added use of slave database, if activated, fixes Issue #1207
# 210823-0948 - Fix for security issue
#
require("dbconnect_mysqli.php");
@@ -108,11 +109,22 @@ $rpt_string="";
$exclude_statuses=array("INCALL", "DISPO", "QUEUE", "DONEM");
$exc_status_SQL=" and status not in ('".implode("','", $exclude_statuses)."') ";
$query_date=preg_replace("/[^0-9\-]/", "", $query_date);
$end_date=preg_replace("/[^0-9\-]/", "", $end_date);
$query_time=preg_replace("/[^0-9\:]/", "", $query_time);
$end_time=preg_replace("/[^0-9\:]/", "", $end_time);
$rpt_type=preg_replace('/[^-_0-9\p{L}]/u', "", $rpt_type);
$hourly_display=preg_replace("/[^0-9]/", "", $hourly_display);
$target_gross=preg_replace("/[^0-9]/", "", $target_gross);
$target_per_agent=preg_replace("/[^0-9]/", "", $target_per_agent);
$target_per_team=preg_replace("/[^0-9]/", "", $target_per_team);
$commission_rates = preg_replace('/[^-\._0-9\p{L}]/u',"",$commission_rates);
$campaigns=preg_replace('/[^-_0-9\p{L}]/u','',$campaigns);
$users=preg_replace('/[^-_0-9\p{L}]/u','',$users);
$user_groups=preg_replace('/[^-_0-9\p{L}]/u','',$user_groups);
$groups=preg_replace('/[^-_0-9\p{L}]/u','',$groups);
$dids=preg_replace('/[^-_0-9\p{L}]/u','',$dids);
$status_flags=preg_replace('/[^-_0-9\p{L}]/u','',$status_flags);
if (preg_match("/status_performance/", $rpt_type)) {
if (!$campaigns || in_array("--ALL--", $campaigns)) {