ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixes for security issues in several PHP scripts

Browse Source 
git-svn-id: svn://192.168.202.10@3504 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2021-08-25 13:37:52 +00:00
parent 0d67e9cb0f
commit 736e238a3d
18 changed files with 217 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/agc/voicemail_check.php
+6 -5
View File
@@ -32,10 +32,11 @@
# 150723-1711 - Added ajax logging
# 170526-2351 - Added additional variable filtering
# 210616-2109 - Added optional CORS support, see options.php for details
# 210825-0910 - Fix for XSS security issue
#
$version = '2.14-15';
$build = '210616-2109';
$version = '2.14-16';
$build = '210825-0910';
$php_script = 'voicemail_check.php';
$SSagent_debug_logging=0;
$startMS = microtime();
@@ -59,9 +60,9 @@ if (isset($_GET["vmail_box"])) {$vmail_box=$_GET["vmail_box"];}
$user=preg_replace("/\'|\"|\\\\|;| /","",$user);
$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$vmail_box = preg_replace("/\'|\"|\\\\|;/","",$vmail_box);
$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name);
$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
$vmail_box = preg_replace('/[^-_0-9\p{L}]/u',"",$vmail_box);
# default optional vars if not set
if (!isset($format)) {$format="text";}