From 736e238a3d1551b6cc168700c1c0488bc1429d55 Mon Sep 17 00:00:00 2001 From: mattf Date: Wed, 25 Aug 2021 13:37:52 +0000 Subject: [PATCH] Fixes for security issues in several PHP scripts git-svn-id: svn://192.168.202.10@3504 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/trunk/www/agc/active_list_refresh.php | 9 +- agc_2-X/trunk/www/agc/call_log_display.php | 9 +- agc_2-X/trunk/www/agc/conf_exten_check.php | 9 +- agc_2-X/trunk/www/agc/inbound_popup.php | 9 +- agc_2-X/trunk/www/agc/launch.php | 13 +- agc_2-X/trunk/www/agc/live_exten_check.php | 9 +- agc_2-X/trunk/www/agc/manager_send.php | 9 +- agc_2-X/trunk/www/agc/park_calls_display.php | 9 +- agc_2-X/trunk/www/agc/vdc_db_query.php | 9 +- agc_2-X/trunk/www/agc/vdc_form_display.php | 7 +- agc_2-X/trunk/www/agc/vdc_script_display.php | 7 +- .../www/agc/vdc_script_dispo_example.php | 8 +- agc_2-X/trunk/www/agc/vdc_script_notes.php | 7 +- agc_2-X/trunk/www/agc/voicemail_check.php | 11 +- agc_2-X/trunk/www/vicidial/qc_modify_lead.php | 142 +++++++++++++++++- agc_2-X/trunk/www/vicidial/qc_scorecards.php | 4 + .../www/vicidial/realtime_report_mobile.php | 3 +- .../vicidial_whiteboard_functions.php | 1 + 18 files changed, 217 insertions(+), 58 deletions(-) diff --git a/agc_2-X/trunk/www/agc/active_list_refresh.php b/agc_2-X/trunk/www/agc/active_list_refresh.php index f9f3c038..4ce640e1 100644 --- a/agc_2-X/trunk/www/agc/active_list_refresh.php +++ b/agc_2-X/trunk/www/agc/active_list_refresh.php @@ -48,10 +48,11 @@ # 150723-1715 - Added ajax logging # 190111-0903 - Fix for PHP7 # 210616-2108 - Added optional CORS support, see options.php for details +# 210825-0908 - Fix for XSS security issue # -$version = '0.0.19'; -$build = '210616-2108'; +$version = '0.0.20'; +$build = '210825-0908'; $php_script = 'active_list_refresh.php'; $SSagent_debug_logging=0; $startMS = microtime(); @@ -114,8 +115,8 @@ $selectedlocal=preg_replace("/[^ \#\*\:\/\@\.\-\_0-9a-zA-Z]/","",$selectedlocal) $textareaheight=preg_replace("/[^0-9a-zA-Z]/","",$textareaheight); $textareawidth=preg_replace("/[^0-9a-zA-Z]/","",$textareawidth); $field_name=preg_replace("/[^ \#\*\:\/\@\.\-\_0-9a-zA-Z]/","",$field_name); -$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); -$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip); +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); # default optional vars if not set if (!isset($ADD)) {$ADD="1";} diff --git a/agc_2-X/trunk/www/agc/call_log_display.php b/agc_2-X/trunk/www/agc/call_log_display.php index 6cb78c56..c61a07c6 100644 --- a/agc_2-X/trunk/www/agc/call_log_display.php +++ b/agc_2-X/trunk/www/agc/call_log_display.php @@ -42,10 +42,11 @@ # 190111-0904 - Fix for PHP7 # 201117-2200 - Changes for better compatibility with non-latin data input # 210616-2102 - Added optional CORS support, see options.php for details +# 210825-0903 - Fix for XSS security issue # -$version = '2.14-22'; -$build = '210616-2102'; +$version = '2.14-23'; +$build = '210825-0903'; $php_script = 'call_log_display.php'; $SSagent_debug_logging=0; $startMS = microtime(); @@ -71,8 +72,8 @@ if (isset($_GET["protocol"])) {$protocol=$_GET["protocol"];} $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); -$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip); +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten); $protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol); $in_limit = preg_replace('/[^0-9]/','',$in_limit); diff --git a/agc_2-X/trunk/www/agc/conf_exten_check.php b/agc_2-X/trunk/www/agc/conf_exten_check.php index 441eb0ca..e9d702fd 100644 --- a/agc_2-X/trunk/www/agc/conf_exten_check.php +++ b/agc_2-X/trunk/www/agc/conf_exten_check.php @@ -89,10 +89,11 @@ # 210328-1013 - Fix for emails-in-queue count query, Issue #1170 # 210425-2357 - Added calls_inqueue_count_ calculation # 210616-1905 - Added optional CORS support, see options.php for details +# 210825-0907 - Fix for XSS security issue # -$version = '2.14-63'; -$build = '210616-1905'; +$version = '2.14-64'; +$build = '210825-0907'; $php_script = 'conf_exten_check.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=51; @@ -206,8 +207,8 @@ if ($non_latin < 1) $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); } -$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); -$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip); +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $conf_exten = preg_replace("/[^-_0-9a-zA-Z]/","",$conf_exten); $exten = preg_replace("/\'|\"|\\\\|;/","",$exten); $clicks = preg_replace("/\'|\"|\\\\|;/","",$clicks); diff --git a/agc_2-X/trunk/www/agc/inbound_popup.php b/agc_2-X/trunk/www/agc/inbound_popup.php index 63368755..961aaad3 100644 --- a/agc_2-X/trunk/www/agc/inbound_popup.php +++ b/agc_2-X/trunk/www/agc/inbound_popup.php @@ -39,10 +39,11 @@ # 170526-2231 - Added additional variable filtering # 190111-0905 - Fix for PHP7 # 210616-2106 - Added optional CORS support, see options.php for details +# 210825-0906 - Fix for XSS security issue # -$version = '2.14-15'; -$build = '210616-2106'; +$version = '2.14-16'; +$build = '210825-0906'; $php_script = 'inbound_popup.php'; require_once("dbconnect_mysqli.php"); @@ -79,8 +80,8 @@ if (isset($_GET["local_web_callerID_URL_enc"])) {$local_web_callerID_URL = raw # variable filtering $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); -$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip); +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); $exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten); $vmail_box = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$vmail_box); diff --git a/agc_2-X/trunk/www/agc/launch.php b/agc_2-X/trunk/www/agc/launch.php index e7f16448..ca683a27 100644 --- a/agc_2-X/trunk/www/agc/launch.php +++ b/agc_2-X/trunk/www/agc/launch.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # For launch validation to work, the options.php file must have # window_validation = 1 and win_valid_name set to window_name below @@ -10,6 +10,7 @@ # 130903-2055 - First Build # 140811-0800 - Changed to use QXZ function for echoing text # 141216-2134 - Added language settings lookups and user/pass variable standardization +# 210825-0909 - Fix for XSS security issue # $window_name = 'subwindow_launch'; @@ -62,11 +63,11 @@ if (!isset($flag_channels)) ### security strip all non-alphanumeric characters out of the variables ### $DB=preg_replace("/[^0-9a-z]/","",$DB); -$phone_login=preg_replace("/[^\,0-9a-zA-Z]/","",$phone_login); -$phone_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$phone_pass); -$VD_login=preg_replace("/\'|\"|\\\\|;| /","",$VD_login); -$VD_pass=preg_replace("/\'|\"|\\\\|;| /","",$VD_pass); -$VD_campaign = preg_replace("/[^-_0-9a-zA-Z]/","",$VD_campaign); +$phone_login=preg_replace('/[^-_0-9\p{L}]/u',"",$phone_login); +$phone_pass=preg_replace('/[^-_0-9\p{L}]/u',"",$phone_pass); +$VD_login=preg_replace('/[^-_0-9\p{L}]/u',"",$VD_login); +$VD_pass=preg_replace('/[^-_0-9\p{L}]/u',"",$VD_pass); +$VD_campaign = preg_replace('/[^-_0-9\p{L}]/u',"",$VD_campaign); $login_string=''; diff --git a/agc_2-X/trunk/www/agc/live_exten_check.php b/agc_2-X/trunk/www/agc/live_exten_check.php index 49153f9e..5a704271 100644 --- a/agc_2-X/trunk/www/agc/live_exten_check.php +++ b/agc_2-X/trunk/www/agc/live_exten_check.php @@ -42,10 +42,11 @@ # 170526-2234 - Added additional variable filtering # 190111-0906 - Fix for PHP7 # 210616-2105 - Added optional CORS support, see options.php for details +# 210825-0905 - Fix for XSS security issue # -$version = '2.14-18'; -$build = '190111-0906'; +$version = '2.14-19'; +$build = '210825-0905'; $php_script = 'live_exten_check.php'; $SSagent_debug_logging=0; $startMS = microtime(); @@ -76,8 +77,8 @@ if (isset($_GET["favorites_list"])) {$favorites_list=$_GET["favorites_list"]; # variable filtering $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); -$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip); +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten); $protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol); $favorites_list = preg_replace("/\'|\"|\\\\|;| /","",$favorites_list); diff --git a/agc_2-X/trunk/www/agc/manager_send.php b/agc_2-X/trunk/www/agc/manager_send.php index 398f56e4..a8547394 100644 --- a/agc_2-X/trunk/www/agc/manager_send.php +++ b/agc_2-X/trunk/www/agc/manager_send.php @@ -148,10 +148,11 @@ # 210615-1016 - Default security fixes, CVE-2021-28854 # 210616-2051 - Added optional CORS support, see options.php for details # 210823-0916 - Fix for security issue +# 210825-0911 - Fix for XSS security issue # -$version = '2.14-95'; -$build = '210823-0916'; +$version = '2.14-96'; +$build = '210825-0911'; $php_script = 'manager_send.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=143; @@ -295,8 +296,8 @@ header ("Pragma: no-cache"); // HTTP/1.0 # filter variables $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); -$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip); +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $lead_id = preg_replace('/[^0-9]/','',$lead_id); $session_id = preg_replace('/[^0-9]/','',$session_id); $exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten); diff --git a/agc_2-X/trunk/www/agc/park_calls_display.php b/agc_2-X/trunk/www/agc/park_calls_display.php index 024b3d87..7023aacc 100644 --- a/agc_2-X/trunk/www/agc/park_calls_display.php +++ b/agc_2-X/trunk/www/agc/park_calls_display.php @@ -33,10 +33,11 @@ # 170526-2244 - Added additional variable filtering # 190111-0907 - Fix for PHP7 # 210616-2104 - Added optional CORS support, see options.php for details +# 210825-0904 - Fix for XSS security issue # -$version = '2.14-15'; -$build = '210616-2104'; +$version = '2.14-16'; +$build = '210825-0904'; $php_script = 'park_calls_display.php'; $SSagent_debug_logging=0; $startMS = microtime(); @@ -63,8 +64,8 @@ if (isset($_GET["protocol"])) {$protocol=$_GET["protocol"];} # variable filtering $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); -$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip); +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten); $protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol); diff --git a/agc_2-X/trunk/www/agc/vdc_db_query.php b/agc_2-X/trunk/www/agc/vdc_db_query.php index 9ac9d026..7ad57e22 100644 --- a/agc_2-X/trunk/www/agc/vdc_db_query.php +++ b/agc_2-X/trunk/www/agc/vdc_db_query.php @@ -517,10 +517,11 @@ # 210719-1120 - Added new state override options for 24-Hour Call Count Limits # 210729-2136 - Added cid_group_id_two campaign setting # 210822-2111 - Fix for manual dial lead search with phone_code, Issue #1322 +# 210825-0912 - Fix for XSS security issue # -$version = '2.14-410'; -$build = '210822-2111'; +$version = '2.14-411'; +$build = '210825-0912'; $php_script = 'vdc_db_query.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=865; @@ -1058,8 +1059,8 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); -$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip); +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $alt_phone = preg_replace("/\s/","",$alt_phone); $phone_code = preg_replace("/\s/","",$phone_code); $phone_number = preg_replace("/\s/","",$phone_number); diff --git a/agc_2-X/trunk/www/agc/vdc_form_display.php b/agc_2-X/trunk/www/agc/vdc_form_display.php index 98709b44..1576e791 100644 --- a/agc_2-X/trunk/www/agc/vdc_form_display.php +++ b/agc_2-X/trunk/www/agc/vdc_form_display.php @@ -53,10 +53,11 @@ # 210404-1522 - Added only_field option for refresh of already-loaded custom form SOURCESELECT element # 210506-1825 - Fix for SELECTSOURCE reloading issue # 210616-2037 - Added optional CORS support, see options.php for details +# 210825-0902 - Fix for XSS security issue # -$version = '2.14-43'; -$build = '210616-2037'; +$version = '2.14-44'; +$build = '210825-0902'; $php_script = 'vdc_form_display.php'; require_once("dbconnect_mysqli.php"); @@ -323,7 +324,7 @@ $lead_id = preg_replace('/[^0-9]/', '', $lead_id); $list_id = preg_replace('/[^0-9]/', '', $list_id); $new_list_id = preg_replace('/[^0-9]/', '', $new_list_id); $agent_log_id = preg_replace('/[^0-9]/', '', $agent_log_id); -$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $session_id = preg_replace('/[^0-9]/','',$session_id); $call_id = preg_replace('/[^-_\.0-9a-zA-Z]/','',$call_id); $button_action = preg_replace('/[^-_0-9a-zA-Z]/','',$button_action); diff --git a/agc_2-X/trunk/www/agc/vdc_script_display.php b/agc_2-X/trunk/www/agc/vdc_script_display.php index b1cd0d74..ee61d913 100644 --- a/agc_2-X/trunk/www/agc/vdc_script_display.php +++ b/agc_2-X/trunk/www/agc/vdc_script_display.php @@ -43,10 +43,11 @@ # 191031-1158 - Added Script2 feature # 201117-2107 - Changes for better compatibility with non-latin data input # 210616-2100 - Added optional CORS support, see options.php for details +# 210825-0858 - Fix for security issue # -$version = '2.14-37'; -$build = '210616-2100'; +$version = '2.14-38'; +$build = '210825-0858'; $php_script = 'vdc_script_display.php'; require_once("dbconnect_mysqli.php"); @@ -338,7 +339,7 @@ $orig_pass = preg_replace("/\'|\"|\\\\|;| /","",$orig_pass); $lead_id = preg_replace('/[^0-9]/', '', $lead_id); $list_id = preg_replace('/[^0-9]/', '', $list_id); $email_row_id = preg_replace('/[^0-9]/', '', $email_row_id); -$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $session_id = preg_replace('/[^0-9]/','',$session_id); $uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); $session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); diff --git a/agc_2-X/trunk/www/agc/vdc_script_dispo_example.php b/agc_2-X/trunk/www/agc/vdc_script_dispo_example.php index 0d42cbb6..7a8f68fa 100644 --- a/agc_2-X/trunk/www/agc/vdc_script_dispo_example.php +++ b/agc_2-X/trunk/www/agc/vdc_script_dispo_example.php @@ -23,10 +23,11 @@ # 170528-0902 - Added more variable filtering # 190111-0910 - Fix for PHP7 # 210616-2035 - Added optional CORS support, see options.php for details +# 210825-0838 - Fix for security issue # -$version = '2.14-11'; -$build = '210616-2035'; +$version = '2.14-12'; +$build = '210825-0838'; $php_script = 'vdc_script_dispo_example.php'; require_once("dbconnect_mysqli.php"); @@ -265,7 +266,7 @@ $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); $lead_id = preg_replace('/[^0-9]/', '', $lead_id); $list_id = preg_replace('/[^0-9]/', '', $list_id); $notesid = preg_replace('/[^0-9]/', '', $notesid); -$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $session_id = preg_replace('/[^0-9]/','',$session_id); $uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); $campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign); @@ -313,6 +314,7 @@ if ($qm_conf_ct > 0) if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass); $length_in_sec = preg_replace("/[^0-9]/","",$length_in_sec); $phone_code = preg_replace("/[^0-9]/","",$phone_code); $phone_number = preg_replace("/[^0-9]/","",$phone_number); diff --git a/agc_2-X/trunk/www/agc/vdc_script_notes.php b/agc_2-X/trunk/www/agc/vdc_script_notes.php index 221505a5..a3435acb 100644 --- a/agc_2-X/trunk/www/agc/vdc_script_notes.php +++ b/agc_2-X/trunk/www/agc/vdc_script_notes.php @@ -21,10 +21,11 @@ # 170528-0901 - Added more variable filtering # 201117-2213 - Changes for better compatibility with non-latin data input # 210616-2034 - Added optional CORS support, see options.php for details +# 210825-0901 - Fix for XSS security issue # -$version = '2.14-11'; -$build = '210616-2034'; +$version = '2.14-12'; +$build = '210825-0901'; $php_script = 'vdc_script_notes.php'; require_once("dbconnect_mysqli.php"); @@ -270,7 +271,7 @@ if ($qm_conf_ct > 0) $lead_id = preg_replace('/[^0-9]/', '', $lead_id); $list_id = preg_replace('/[^0-9]/', '', $list_id); $notesid = preg_replace('/[^0-9]/', '', $notesid); -$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $session_id = preg_replace('/[^0-9]/','',$session_id); $uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); $session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); diff --git a/agc_2-X/trunk/www/agc/voicemail_check.php b/agc_2-X/trunk/www/agc/voicemail_check.php index 6a43df8e..8fb67ece 100644 --- a/agc_2-X/trunk/www/agc/voicemail_check.php +++ b/agc_2-X/trunk/www/agc/voicemail_check.php @@ -32,10 +32,11 @@ # 150723-1711 - Added ajax logging # 170526-2351 - Added additional variable filtering # 210616-2109 - Added optional CORS support, see options.php for details +# 210825-0910 - Fix for XSS security issue # -$version = '2.14-15'; -$build = '210616-2109'; +$version = '2.14-16'; +$build = '210825-0910'; $php_script = 'voicemail_check.php'; $SSagent_debug_logging=0; $startMS = microtime(); @@ -59,9 +60,9 @@ if (isset($_GET["vmail_box"])) {$vmail_box=$_GET["vmail_box"];} $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); -$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip); -$vmail_box = preg_replace("/\'|\"|\\\\|;/","",$vmail_box); +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); +$vmail_box = preg_replace('/[^-_0-9\p{L}]/u',"",$vmail_box); # default optional vars if not set if (!isset($format)) {$format="text";} diff --git a/agc_2-X/trunk/www/vicidial/qc_modify_lead.php b/agc_2-X/trunk/www/vicidial/qc_modify_lead.php index 47121544..cb824789 100644 --- a/agc_2-X/trunk/www/vicidial/qc_modify_lead.php +++ b/agc_2-X/trunk/www/vicidial/qc_modify_lead.php @@ -155,8 +155,6 @@ if (isset($_POST["finish_qc"])) {$finish_qc=$_POST["finish_qc"];} elseif (isset($_GET["finish_qc"])) {$finish_qc=$_GET["finish_qc"];} if (isset($_POST["qc_display_method"])) {$qc_display_method=$_POST["qc_display_method"];} elseif (isset($_GET["qc_display_method"])) {$qc_display_method=$_GET["qc_display_method"];} -if (isset($_POST["qc_display_method"])) {$qc_display_method=$_POST["qc_display_method"];} - elseif (isset($_GET["qc_display_method"])) {$qc_display_method=$_GET["qc_display_method"];} if (isset($_POST["qc_display_group_type"])) {$qc_display_group_type=$_POST["qc_display_group_type"];} elseif (isset($_GET["qc_display_group_type"])) {$qc_display_group_type=$_GET["qc_display_group_type"];} if (isset($_POST["qc_status"])) {$qc_status=$_POST["qc_status"];} @@ -168,6 +166,146 @@ if (isset($_POST["referring_section"])) {$referring_section=$_POST["referring_ if (isset($_POST["referring_element"])) {$referring_element=$_POST["referring_element"];} elseif (isset($_GET["referring_element"])) {$referring_element=$_GET["referring_element"];} +$CBchangeANYtoUSER=preg_replace('/[^A-Z]/','',$CBchangeANYtoUSER); +$CBchangeDATE=preg_replace('/[^A-Z]/','',$CBchangeDATE); +$CBchangeUSERtoANY=preg_replace('/[^A-Z]/','',$CBchangeUSERtoANY); +$CBchangeUSERtoUSER=preg_replace('/[^A-Z]/','',$CBchangeUSERtoUSER); +$claim_QC=preg_replace('/[^A-Z]/','',$claim_QC); +$referring_section=preg_replace('/[^A-Z]/','',$referring_section); +$DB=preg_replace('/[^0-9]/','',$DB); + +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); + $user = preg_replace('/[^-\_0-9a-zA-Z]/','',$user); + $tsr = preg_replace('/[^-\_0-9a-zA-Z]/','',$tsr); + $CBuser = preg_replace('/[^-\_0-9a-zA-Z]/','',$CBuser); + $qc_agent = preg_replace('/[^-\_0-9a-zA-Z]/','',$qc_agent); + $title = preg_replace('/[^- \'\_\.0-9a-zA-Z]/','',$title); + $first_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$first_name); + $middle_initial = preg_replace('/[^0-9a-zA-Z]/','',$middle_initial); + $last_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$last_name); + $lead_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$lead_name); + $address1 = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$address1); + $address2 = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$address2); + $address3 = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$address3); + $city = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$city); + $state = preg_replace('/[^- 0-9a-zA-Z]/','',$state); + $province = preg_replace('/[^- \'\+\.\_0-9a-zA-Z]/','',$province); + $postal_code = preg_replace('/[^- \'\+0-9a-zA-Z]/','',$postal_code); + $alt_phone = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$alt_phone); + $email = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9a-zA-Z]/','',$email); + $security = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$security); + $campaign_id = preg_replace('/[^-\_0-9a-zA-Z]/', '',$campaign_id); + $owner = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$owner); + $country_code = preg_replace('/[^A-Z]/','',$country_code); + $gender = preg_replace('/[^A-Z]/','',$gender); + $qc_display_group_type = preg_replace('/[^A-Z]/','',$qc_display_group_type); + $qc_display_method = preg_replace('/[^A-Z]/','',$qc_display_method); + $qc_process_status = preg_replace('/[^A-Z]/','',$qc_process_status); + $channel = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$channel); + $dispo = preg_replace('/[^-\_0-9a-zA-Z]/', '',$dispo); + $status = preg_replace('/[^-\_0-9a-zA-Z]/', '',$status); + $qc_status = preg_replace('/[^-\_0-9a-zA-Z]/', '',$qc_status); + $referring_element = preg_replace('/[^-\_0-9a-zA-Z]/', '',$referring_element); + $submit = preg_replace('/[^- 0-9a-zA-Z]/','',$submit); + $SUBMIT = preg_replace('/[^- 0-9a-zA-Z]/','',$SUBMIT); + } +else + { + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $user=preg_replace('/[^-_0-9\p{L}]/u','',$user); + $tsr=preg_replace('/[^-_0-9\p{L}]/u','',$tsr); + $CBuser=preg_replace('/[^-_0-9\p{L}]/u','',$CBuser); + $qc_agent=preg_replace('/[^-_0-9\p{L}]/u','',$qc_agent); + $title = preg_replace('/[^- \'\_\.0-9\p{L}]/u','',$title); + $first_name = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$first_name); + $middle_initial = preg_replace('/[^0-9\p{L}]/u','',$middle_initial); + $last_name = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$last_name); + $lead_name = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$lead_name); + $address1 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address1); + $address2 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address2); + $address3 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address3); + $city = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$city); + $state = preg_replace('/[^- 0-9\p{L}]/u','',$state); + $province = preg_replace('/[^- \'\+\.\_0-9\p{L}]/u','',$province); + $postal_code = preg_replace('/[^- \'\+0-9\p{L}]/u','',$postal_code); + $alt_phone = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$alt_phone); + $email = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9\p{L}]/u','',$email); + $security = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$security); + $campaign_id = preg_replace('/[^-\_0-9\p{L}]/u', '',$campaign_id); + $owner = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$owner); + $country_code = preg_replace('/[^\p{L}]/u','',$country_code); + $gender = preg_replace('/[^\p{L}]/u','',$gender); + $qc_display_group_type = preg_replace('/[^\p{L}]/u','',$qc_display_group_type); + $qc_display_method = preg_replace('/[^\p{L}]/u','',$qc_display_method); + $qc_process_status = preg_replace('/[^\p{L}]/u','',$qc_process_status); + $channel = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$channel); + $dispo = preg_replace('/[^-_0-9\p{L}]/u','',$dispo); + $status = preg_replace('/[^-_0-9\p{L}]/u','',$status); + $qc_status = preg_replace('/[^-_0-9\p{L}]/u','',$qc_status); + $referring_element = preg_replace('/[^-\_0-9\p{L}]/u', '',$referring_element); + $submit = preg_replace('/[^- 0-9\p{L}]/u','',$submit); + $SUBMIT = preg_replace('/[^- 0-9\p{L}]/u','',$SUBMIT); + } + +$first_name = preg_replace('/\+/',' ',$first_name); +$last_name = preg_replace('/\+/',' ',$last_name); +$address1 = preg_replace('/\+/',' ',$address1); +$address2 = preg_replace('/\+/',' ',$address2); +$address3 = preg_replace('/\+/',' ',$address3); +$city = preg_replace('/\+/',' ',$city); +$province = preg_replace('/\+/',' ',$province); +$postal_code = preg_replace('/\+/',' ',$postal_code); +$alt_phone = preg_replace('/\+/',' ',$alt_phone); +$email = preg_replace('/\+/',' ',$email); +$security_phrase = preg_replace('/\+/',' ',$security_phrase); +$owner = preg_replace('/\+/',' ',$owner); + + +$list_id = preg_replace('/[^0-9]/','',$list_id); +$lead_id = preg_replace('/[^0-9a-zA-Z]/','',$lead_id); +$entry_list_id = preg_replace('/[^0-9]/','',$entry_list_id); +$phone_code = preg_replace('/[^0-9]/','',$phone_code); +$update_phone_number=preg_replace('/[^A-Z]/','',$update_phone_number); +$phone_number = preg_replace('/[^0-9]/','',$phone_number); +$old_phone = preg_replace('/[^0-9]/','',$old_phone); +$phone = preg_replace('/[^0-9]/','',$phone); +$vendor_lead_code = preg_replace('/;|#/','',$vendor_lead_code); + $vendor_lead_code = preg_replace('/\+/',' ',$vendor_lead_code); +$vendor_id = preg_replace('/;|#/','',$vendor_id); + $vendor_id = preg_replace('/\+/',' ',$vendor_id); +$source_id = preg_replace('/;|#/','',$source_id); + $source_id = preg_replace('/\+/',' ',$source_id); +$gmt_offset_now = preg_replace('/[^-\_\.0-9]/','',$gmt_offset_now); +$comments = preg_replace('/;|#/','',$comments); + $comments = preg_replace('/\+/',' ',$comments); +$rank = preg_replace('/[^0-9]/','',$rank); +$no_update = preg_replace('/[^A-Z]/','',$no_update); +$called_count=preg_replace('/[^0-9]/','',$called_count); +$local_gmt=preg_replace('/[^-\.0-9]/','',$local_gmt); + +$callback = preg_replace('/[^A-Z]/','',$callback); +$callback_type = preg_replace('/[^A-Z]/','',$callback_type); +$add_closer_record = preg_replace('/[^0-9]/','',$add_closer_record); +$agent_log_id = preg_replace('/[^0-9]/','',$agent_log_id); +$appointment_date = preg_replace('/[^-0-9]/','',$appointment_date); +$appointment_time = preg_replace('/[^0-9\:]/','',$appointment_time); +$parked_time = preg_replace('/[^0-9\:\-]/','',$parked_time); +$callback_id = preg_replace('/[^0-9]/','',$callback_id); +$server_ip=preg_replace("/[^0-9\.]/", "", $server_ip); +$end_call=preg_replace('/[^0-9]/','',$end_call); +$finish_qc=preg_replace('/[^0-9]/','',$finish_qc); +$group_id=preg_replace('/[^-_0-9\p{L}]/u','',$group_id); +$extension=preg_replace('/[^0-9]/','',$extension); +$qc_log_id = preg_replace('/[^0-9\:\-]/','',$qc_log_id); +$modify_agent_logs = preg_replace('/[^0-9]/','',$modify_agent_logs); +$modify_closer_logs = preg_replace('/[^0-9]/','',$modify_closer_logs); +$modify_logs = preg_replace('/[^0-9]/','',$modify_logs); + + $STARTtime = date("U"); $defaultappointment = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); diff --git a/agc_2-X/trunk/www/vicidial/qc_scorecards.php b/agc_2-X/trunk/www/vicidial/qc_scorecards.php index a56545cf..ff275dc5 100644 --- a/agc_2-X/trunk/www/vicidial/qc_scorecards.php +++ b/agc_2-X/trunk/www/vicidial/qc_scorecards.php @@ -84,10 +84,14 @@ if (isset($_GET["confirm_deletion"])) {$confirm_deletion=$_GET["confirm_deletion if (isset($_GET["scorecard_id"])) {$scorecard_id=$_GET["scorecard_id"];} elseif (isset($_POST["scorecard_id"])) {$scorecard_id=$_POST["scorecard_id"];} +$submit=preg_replace('/[^-0-9\p{L}]/u','',$submit); $new_scorecard_id = preg_replace('/[^-_0-9a-zA-Z]/','',$new_scorecard_id); $new_scorecard_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$new_scorecard_name); $new_active = preg_replace('/[^NY]/','',$new_active); $active = preg_replace('/[^NY]/','',$active); +$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action); +$confirm_deletion = preg_replace('/[^Y]/','',$confirm_deletion); +$scorecard_id = preg_replace('/[^-_0-9a-zA-Z]/','',$scorecard_id); $SSmenu_background='015B91'; diff --git a/agc_2-X/trunk/www/vicidial/realtime_report_mobile.php b/agc_2-X/trunk/www/vicidial/realtime_report_mobile.php index 5eb576fd..9cbc0341 100644 --- a/agc_2-X/trunk/www/vicidial/realtime_report_mobile.php +++ b/agc_2-X/trunk/www/vicidial/realtime_report_mobile.php @@ -290,7 +290,8 @@ $PRESETstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $PRESETstats); $AGENTtimeSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $AGENTtimeSTATS); $INGROUPcolorOVERRIDE = preg_replace('/[^-_0-9a-zA-Z]/', '', $INGROUPcolorOVERRIDE); $droppedOFtotal = preg_replace('/[^-_0-9a-zA-Z]/', '', $droppedOFtotal); - +$server_ip=preg_replace("/[^0-9\.]/", "", $server_ip); +$user_group_filter=preg_replace('/[^-_0-9\p{L}]/u','',$user_group_filter); $TOTALdisplay+=$ALLINGROUPstats; $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; diff --git a/agc_2-X/trunk/www/vicidial/vicidial_whiteboard_functions.php b/agc_2-X/trunk/www/vicidial/vicidial_whiteboard_functions.php index e7b8100f..0f3c4a0a 100644 --- a/agc_2-X/trunk/www/vicidial/vicidial_whiteboard_functions.php +++ b/agc_2-X/trunk/www/vicidial/vicidial_whiteboard_functions.php @@ -5,6 +5,7 @@ require("functions.php"); if (isset($_GET["mobile"])) {$mobile=$_GET["mobile"];} elseif (isset($_POST["mobile"])) {$mobile=$_POST["mobile"];} +$mobile=preg_replace('/[^0-9\p{L}]/u','',$mobile); ?> // vicidial_whiteboard_functions.php //