From 865ca9f178abcd2edf0907b8a7b445b37e298a0e Mon Sep 17 00:00:00 2001 From: mattf Date: Thu, 13 Apr 2023 23:58:17 +0000 Subject: [PATCH] Fix for send_notification user group permissions git-svn-id: svn://192.168.202.10@3705 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/trunk/docs/AGENT_API.txt | 6 ++- agc_2-X/trunk/www/agc/api.php | 73 +++++++++++++++++++++++++++++++- 2 files changed, 76 insertions(+), 3 deletions(-) diff --git a/agc_2-X/trunk/docs/AGENT_API.txt b/agc_2-X/trunk/docs/AGENT_API.txt index 47d897da..1c0fd7e8 100644 --- a/agc_2-X/trunk/docs/AGENT_API.txt +++ b/agc_2-X/trunk/docs/AGENT_API.txt @@ -1,4 +1,4 @@ -AGENT API DOCUMENT Started: 2008-07-03 Updated: 2023-04-12 +AGENT API DOCUMENT Started: 2008-07-03 Updated: 2023-04-13 This document describes the functions of an API(Application Programming Interface) for the VICIDIAL Agent screen. This functionality will be rather limited at first @@ -1078,6 +1078,10 @@ RESPONSES: ERROR: Agent API Notifications are disabled on this system - 0 ERROR: Missing recipient or recipient_type: (|) ERROR: Invalid request, missing variables +ERROR: ACCESS TO CAMPAIGN TESTCAMP NOT ALLOWED FOR USER 6666 +ERROR: ACCESS TO USER GROUP ADMIN NOT ALLOWED FOR USER 6666 +ERROR: user_group DOES NOT EXIST - ADMIN|6666 +ERROR: 6667 DOES NOT EXIST in vicidial_users SUCCESS: notification queued ** Additionally, there are "NOTICE" messages that will be included in the response if the notification date is improperly formatted/missing, or if the recipient_type is not included. diff --git a/agc_2-X/trunk/www/agc/api.php b/agc_2-X/trunk/www/agc/api.php index e007117f..85e79609 100644 --- a/agc_2-X/trunk/www/agc/api.php +++ b/agc_2-X/trunk/www/agc/api.php @@ -108,10 +108,11 @@ # 210819-0902 - Updated change_ingroups for changes in vicidial_live_inbound_agents insert/update # 220220-0847 - Added allow_web_debug system setting # 230412-0945 - Added send_notification function +# 230413-1957 - Fix for send_notification user group permissions # -$version = '2.14-73'; -$build = '230412-0945'; +$version = '2.14-74'; +$build = '230413-1957'; $php_script = 'api.php'; $startMS = microtime(); @@ -5115,6 +5116,74 @@ if ($function == 'send_notification') if ($recipient && $recipient_type) { + ### Check that recipient exists in respective table + switch($recipient_type) + { + case "CAMPAIGN": + $tbl_name="vicidial_campaigns"; + $col_name="campaign_id"; + break; + case "USER_GROUP": + $tbl_name="vicidial_user_groups"; + $col_name="user_group"; + break; + case "USER": + $tbl_name="vicidial_users"; + $col_name="user"; + break; + } + $exist_stmt="select $col_name from $tbl_name where $col_name='$recipient'"; + if ($DB) {echo $exist_stmt."
\n";} + $exist_rslt=mysql_to_mysqli($exist_stmt, $link); + $exist_ct = mysqli_num_rows($exist_rslt); + if ($exist_ct==0) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("$recipient DOES NOT EXIST in $tbl_name"); + echo "$result: $result_reason - $value|$recipient\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } + + # For campaign alerts, verify the user has access to said campaign + if($recipient_type=="CAMPAIGN" || $recipient_type=="USER_GROUP") + { + $stmt="SELECT allowed_campaigns, admin_viewable_groups from vicidial_user_groups where user_group='$VUuser_group';"; + if ($DB>0) {echo "|$stmt|\n";} + $rslt=mysql_to_mysqli($stmt, $link); + $ss_conf_ct = mysqli_num_rows($rslt); + if ($ss_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $LOGallowed_campaigns = $row[0]; + $LOGadmin_viewable_groups = $row[1]; + if ($recipient_type=="CAMPAIGN" && (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) && !preg_match("/ $recipient /i", $LOGallowed_campaigns) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("ACCESS TO CAMPAIGN $recipient NOT ALLOWED FOR USER $user ($LOGallowed_campaigns)"); + echo "$result: $result_reason - $value|$recipient\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } + else if ($recipient_type=="USER_GROUP" && (!preg_match('/\-\-\-ALL/i', $LOGadmin_viewable_groups)) && !preg_match("/ $recipient /i", $LOGadmin_viewable_groups) ) + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("ACCESS TO USER GROUP $recipient NOT ALLOWED FOR USER $user"); + echo "$result: $result_reason - $value|$recipient\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } + } + else + { + $result = _QXZ("ERROR"); + $result_reason = _QXZ("user_group DOES NOT EXIST"); + echo "$result: $result_reason - $value|$VUuser_group\n"; + api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); + exit; + } + } + if(!$notification_date) {$notification_date=date("Y-m-d H:i:s");} if (preg_match('/Y/i', $notification_retry)) {