From 67cc4767fea9db40ad43e496d75e7468ac0b2683 Mon Sep 17 00:00:00 2001 From: mattf Date: Mon, 23 Aug 2021 14:20:56 +0000 Subject: [PATCH] Added more variable filtering to several PHP scripts. git-svn-id: svn://192.168.202.10@3499 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/trunk/www/agc/manager_send.php | 11 ++++++----- agc_2-X/trunk/www/agc/vicidial_redirect.php | 12 ++++++++++-- agc_2-X/trunk/www/agc/webphone/zoiperweb.php | 13 ++++++++++++- .../www/agc/webphone/zoiperweb_redirect.php | 13 ++++++++++++- agc_2-X/trunk/www/vicidial/non_agent_api.php | 17 ++++++++++------- .../trunk/www/vicidial/whiteboard_reports.php | 16 ++++++++++++++-- 6 files changed, 64 insertions(+), 18 deletions(-) diff --git a/agc_2-X/trunk/www/agc/manager_send.php b/agc_2-X/trunk/www/agc/manager_send.php index 7c8df4eb..398f56e4 100644 --- a/agc_2-X/trunk/www/agc/manager_send.php +++ b/agc_2-X/trunk/www/agc/manager_send.php @@ -147,10 +147,11 @@ # 201117-1751 - Changes for better compatibility with non-latin data input # 210615-1016 - Default security fixes, CVE-2021-28854 # 210616-2051 - Added optional CORS support, see options.php for details +# 210823-0916 - Fix for security issue # -$version = '2.14-94'; -$build = '210616-2051'; +$version = '2.14-95'; +$build = '210823-0916'; $php_script = 'manager_send.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=143; @@ -555,9 +556,9 @@ if ($ACTION=="OriginateVDRelogin") $CIDdate = date("ymdHis"); $DS='-'; $SIPSAK_prefix = 'LIN-'; - $campaign = preg_replace("/\'|\"|\\\\|;/","",$campaign); - $extension = preg_replace("/\'|\"|\\\\|;/","",$extension); - $phone_ip = preg_replace("/\'|\"|\\\\|;/","",$phone_ip); + $campaign = preg_replace('/[^-\._0-9\p{L}]/u',"",$campaign); + $extension = preg_replace('/[^-\._0-9\p{L}]/u',"",$extension); + $phone_ip = preg_replace('/[^-\._0-9\p{L}]/u',"",$phone_ip); print "\n"; passthru("/usr/local/bin/sipsak -M -O desktop -B \"$SIPSAK_prefix$campaign\" -r 5060 -s sip:$extension@$phone_ip > /dev/null"); diff --git a/agc_2-X/trunk/www/agc/vicidial_redirect.php b/agc_2-X/trunk/www/agc/vicidial_redirect.php index 9612be9b..9a3fc463 100644 --- a/agc_2-X/trunk/www/agc/vicidial_redirect.php +++ b/agc_2-X/trunk/www/agc/vicidial_redirect.php @@ -1,13 +1,14 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # CHANGELOG # 71202-1546 - First Build # 90508-0727 - Changed to PHP long tags # 140811-0852 - Changed to use QXZ function for echoing text # 141216-2131 - Added language settings lookups and user/pass variable standardization +# 210823-1004 - Fix for security issue # require_once("functions.php"); @@ -39,7 +40,14 @@ if (!isset($phone_pass)) elseif (isset($_POST["pp"])) {$phone_pass=$_POST["pp"];} } -$VD_login=preg_replace("/\'|\"|\\\\|;| /","",$VD_login); +$DB = preg_replace('/[^-\._0-9\p{L}]/u',"",$DB); +$phone_login = preg_replace('/[^-\._0-9\p{L}]/u',"",$phone_login); +$phone_pass = preg_replace('/[^-\._0-9\p{L}]/u',"",$phone_pass); +$VD_login = preg_replace('/[^-\._0-9\p{L}]/u',"",$VD_login); +$VD_pass = preg_replace('/[^-\._0-9\p{L}]/u',"",$VD_pass); +$VD_campaign = preg_replace('/[^-\._0-9\p{L}]/u',"",$VD_campaign); +$relogin = preg_replace('/[^-\._0-9\p{L}]/u',"",$relogin); + ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### diff --git a/agc_2-X/trunk/www/agc/webphone/zoiperweb.php b/agc_2-X/trunk/www/agc/webphone/zoiperweb.php index fa11bba5..902251e3 100644 --- a/agc_2-X/trunk/www/agc/webphone/zoiperweb.php +++ b/agc_2-X/trunk/www/agc/webphone/zoiperweb.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # variables sent to this script: # $phone_login - phone login @@ -19,6 +19,7 @@ # 100827-1417 - Added system_key variable # 101227-1313 - Added DIALPLAN_OFF_TOGGLE option # 110526-1726 - Added AUTOANSWER option +# 210823-0959 - Fix for security issue # if (isset($_GET["DB"])) {$DB=$_GET["DB"];} @@ -51,6 +52,16 @@ $b64_system_key = base64_decode($system_key); if ($b64_protocol != 'SIP') {$b64_protocol = 'IAX';} +$b64_phone_login = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_phone_login); +$b64_phone_pass = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_phone_pass); +$b64_server_ip = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_server_ip); +$b64_callerid = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_callerid); +$b64_protocol = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_protocol); +$b64_codecs = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_codecs); +$b64_options = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_options); +$b64_system_key = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$b64_system_key); + + ?> diff --git a/agc_2-X/trunk/www/agc/webphone/zoiperweb_redirect.php b/agc_2-X/trunk/www/agc/webphone/zoiperweb_redirect.php index d37d9671..70adc635 100644 --- a/agc_2-X/trunk/www/agc/webphone/zoiperweb_redirect.php +++ b/agc_2-X/trunk/www/agc/webphone/zoiperweb_redirect.php @@ -1,10 +1,11 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # CHANGELOG # 100827-1419 - First Build +# 210823-1010 - Fix for security issue # if (isset($_GET["DB"])) {$DB=$_GET["DB"];} @@ -26,6 +27,16 @@ if (isset($_GET["options"])) {$options=$_GET["options"];} if (isset($_GET["system_key"])) {$system_key=$_GET["system_key"];} elseif (isset($_POST["system_key"])) {$system_key=$_POST["system_key"];} +$DB = preg_replace('/[^-\._0-9\p{L}]/u',"",$DB); +$phone_login = preg_replace('/[^-\._0-9\p{L}]/u',"",$phone_login); +$phone_pass = preg_replace('/[^-\._0-9\p{L}]/u',"",$phone_pass); +$server_ip = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$server_ip); +$callerid = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$callerid); +$protocol = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$protocol); +$codecs = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$codecs); +$options = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$options); +$system_key = preg_replace('/[^-\*\#\.\:\/\@\_0-9\p{L}]/u','',$system_key); + $query_string = "/agc/webphone/zoiperweb.php?DB=$DB&phone_login=$phone_login&phone_pass=$phone_pass&server_ip=$server_ip&callerid=$callerid&protocol=$protocol&codecs=$codecs&options=$options&system_key=$system_key"; $servers = array("sslagent1.server.net","sslagent2.server.net"); diff --git a/agc_2-X/trunk/www/vicidial/non_agent_api.php b/agc_2-X/trunk/www/vicidial/non_agent_api.php index 0b85daff..8d1b776e 100644 --- a/agc_2-X/trunk/www/vicidial/non_agent_api.php +++ b/agc_2-X/trunk/www/vicidial/non_agent_api.php @@ -182,10 +182,11 @@ # 210625-1421 - Added BARGESWAP option to blind_monitor function # 210701-2050 - Added ingroup_rank/ingroup_grade options to the update_user function # 210812-2640 - Added update of live agent records for ingroup_rank/ingroup_grade in the update_user function +# 210823-0918 - Fix for security issue # -$version = '2.14-159'; -$build = '210812-2640'; +$version = '2.14-160'; +$build = '210823-0918'; $php_script='non_agent_api.php'; $api_url_log = 0; @@ -708,6 +709,7 @@ if ($non_latin < 1) $DB=preg_replace('/[^0-9]/','',$DB); $user=preg_replace('/[^-_0-9a-zA-Z]/','',$user); $pass=preg_replace('/[^-_0-9a-zA-Z]/','',$pass); + $agent_user=preg_replace('/[^-_0-9a-zA-Z]/','',$agent_user); $function = preg_replace('/[^-\_0-9a-zA-Z]/', '',$function); $format = preg_replace('/[^0-9a-zA-Z]/','',$format); $entry_list_id = preg_replace('/[^0-9]/','',$entry_list_id); @@ -928,11 +930,12 @@ if ($non_latin < 1) } else { - $user = preg_replace("/'|\"|\\\\|;|#/","",$user); - $pass = preg_replace("/'|\"|\\\\|;|#/","",$pass); - $source = preg_replace("/'|\"|\\\\|;|#/","",$source); - $source_user = preg_replace("/'|\"|\\\\|;|#/","",$source_user); - $menu_id = preg_replace("/'|\"|\\\\|;|#/",'',$menu_id); + $user = preg_replace('/[^-_0-9\p{L}]/u',"",$user); + $pass = preg_replace('/[^-_0-9\p{L}]/u',"",$pass); + $agent_user=preg_replace('/[^-_0-9\p{L}]/u','',$agent_user); + $source = preg_replace('/[^-_0-9\p{L}]/u',"",$source); + $source_user = preg_replace('/[^-_0-9\p{L}]/u',"",$source_user); + $menu_id = preg_replace('/[^-_0-9\p{L}]/u','',$menu_id); } $list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id); $list_id_field = preg_replace('/[^0-9]/','',$list_id_field); diff --git a/agc_2-X/trunk/www/vicidial/whiteboard_reports.php b/agc_2-X/trunk/www/vicidial/whiteboard_reports.php index 105bd2ba..48667de5 100644 --- a/agc_2-X/trunk/www/vicidial/whiteboard_reports.php +++ b/agc_2-X/trunk/www/vicidial/whiteboard_reports.php @@ -1,13 +1,14 @@ , Joe Johnson LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell , Joe Johnson LICENSE: AGPLv2 # # A PHP file that is for generating the stats that are displayed in the whiteboard report. Returns values. # # 171027-2352 - First build # 190302-1707 - Added code to exclude active calls from being counted with some stats # 200427-2225 - Added use of slave database, if activated, fixes Issue #1207 +# 210823-0948 - Fix for security issue # require("dbconnect_mysqli.php"); @@ -108,11 +109,22 @@ $rpt_string=""; $exclude_statuses=array("INCALL", "DISPO", "QUEUE", "DONEM"); $exc_status_SQL=" and status not in ('".implode("','", $exclude_statuses)."') "; - $query_date=preg_replace("/[^0-9\-]/", "", $query_date); $end_date=preg_replace("/[^0-9\-]/", "", $end_date); $query_time=preg_replace("/[^0-9\:]/", "", $query_time); $end_time=preg_replace("/[^0-9\:]/", "", $end_time); +$rpt_type=preg_replace('/[^-_0-9\p{L}]/u', "", $rpt_type); +$hourly_display=preg_replace("/[^0-9]/", "", $hourly_display); +$target_gross=preg_replace("/[^0-9]/", "", $target_gross); +$target_per_agent=preg_replace("/[^0-9]/", "", $target_per_agent); +$target_per_team=preg_replace("/[^0-9]/", "", $target_per_team); +$commission_rates = preg_replace('/[^-\._0-9\p{L}]/u',"",$commission_rates); +$campaigns=preg_replace('/[^-_0-9\p{L}]/u','',$campaigns); +$users=preg_replace('/[^-_0-9\p{L}]/u','',$users); +$user_groups=preg_replace('/[^-_0-9\p{L}]/u','',$user_groups); +$groups=preg_replace('/[^-_0-9\p{L}]/u','',$groups); +$dids=preg_replace('/[^-_0-9\p{L}]/u','',$dids); +$status_flags=preg_replace('/[^-_0-9\p{L}]/u','',$status_flags); if (preg_match("/status_performance/", $rpt_type)) { if (!$campaigns || in_array("--ALL--", $campaigns)) {