ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix for send_notification user group permissions

Browse Source 
git-svn-id: svn://192.168.202.10@3705 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2023-04-13 23:58:17 +00:00
parent ebfed832d6
commit 865ca9f178
2 changed files with 76 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/docs/AGENT_API.txt
+5 -1
View File
@@ -1,4 +1,4 @@
AGENT API DOCUMENT Started: 2008-07-03 Updated: 2023-04-12 AGENT API DOCUMENT Started: 2008-07-03 Updated: 2023-04-13
This document describes the functions of an API(Application Programming Interface) This document describes the functions of an API(Application Programming Interface)
for the VICIDIAL Agent screen. This functionality will be rather limited at first for the VICIDIAL Agent screen. This functionality will be rather limited at first
@@ -1078,6 +1078,10 @@ RESPONSES:
ERROR: Agent API Notifications are disabled on this system - 0 ERROR: Agent API Notifications are disabled on this system - 0
ERROR: Missing recipient or recipient_type: (<recipient>|<recipient_type>) ERROR: Missing recipient or recipient_type: (<recipient>|<recipient_type>)
ERROR: Invalid request, missing variables ERROR: Invalid request, missing variables
ERROR: ACCESS TO CAMPAIGN TESTCAMP NOT ALLOWED FOR USER 6666
ERROR: ACCESS TO USER GROUP ADMIN NOT ALLOWED FOR USER 6666
ERROR: user_group DOES NOT EXIST - ADMIN|6666
ERROR: 6667 DOES NOT EXIST in vicidial_users
SUCCESS: notification queued SUCCESS: notification queued
** Additionally, there are "NOTICE" messages that will be included in the response if the notification date is improperly formatted/missing, or if the recipient_type is not included. ** Additionally, there are "NOTICE" messages that will be included in the response if the notification date is improperly formatted/missing, or if the recipient_type is not included.
agc_2-X/trunk/www/agc/api.php
+71 -2
View File
@@ -108,10 +108,11 @@
# 210819-0902 - Updated change_ingroups for changes in vicidial_live_inbound_agents insert/update # 210819-0902 - Updated change_ingroups for changes in vicidial_live_inbound_agents insert/update
# 220220-0847 - Added allow_web_debug system setting # 220220-0847 - Added allow_web_debug system setting
# 230412-0945 - Added send_notification function # 230412-0945 - Added send_notification function
# 230413-1957 - Fix for send_notification user group permissions
# #
$version = '2.14-73'; $version = '2.14-74';
$build = '230412-0945'; $build = '230413-1957';
$php_script = 'api.php'; $php_script = 'api.php';
$startMS = microtime(); $startMS = microtime();
@@ -5115,6 +5116,74 @@ if ($function == 'send_notification')
if ($recipient && $recipient_type) if ($recipient && $recipient_type)
{ {
### Check that recipient exists in respective table
switch($recipient_type)
{
case "CAMPAIGN":
$tbl_name="vicidial_campaigns";
$col_name="campaign_id";
break;
case "USER_GROUP":
$tbl_name="vicidial_user_groups";
$col_name="user_group";
break;
case "USER":
$tbl_name="vicidial_users";
$col_name="user";
break;
}
$exist_stmt="select $col_name from $tbl_name where $col_name='$recipient'";
if ($DB) {echo $exist_stmt."<BR>\n";}
$exist_rslt=mysql_to_mysqli($exist_stmt, $link);
$exist_ct = mysqli_num_rows($exist_rslt);
if ($exist_ct==0)
{
$result = _QXZ("ERROR");
$result_reason = _QXZ("$recipient DOES NOT EXIST in $tbl_name");
echo "$result: $result_reason - $value|$recipient\n";
api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
exit;
}
# For campaign alerts, verify the user has access to said campaign
if($recipient_type=="CAMPAIGN" || $recipient_type=="USER_GROUP")
{
$stmt="SELECT allowed_campaigns, admin_viewable_groups from vicidial_user_groups where user_group='$VUuser_group';";
if ($DB>0) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$ss_conf_ct = mysqli_num_rows($rslt);
if ($ss_conf_ct > 0)
{
$row=mysqli_fetch_row($rslt);
$LOGallowed_campaigns = $row[0];
$LOGadmin_viewable_groups = $row[1];
if ($recipient_type=="CAMPAIGN" && (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) && !preg_match("/ $recipient /i", $LOGallowed_campaigns) )
{
$result = _QXZ("ERROR");
$result_reason = _QXZ("ACCESS TO CAMPAIGN $recipient NOT ALLOWED FOR USER $user ($LOGallowed_campaigns)");
echo "$result: $result_reason - $value|$recipient\n";
api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
exit;
}
else if ($recipient_type=="USER_GROUP" && (!preg_match('/\-\-\-ALL/i', $LOGadmin_viewable_groups)) && !preg_match("/ $recipient /i", $LOGadmin_viewable_groups) )
{
$result = _QXZ("ERROR");
$result_reason = _QXZ("ACCESS TO USER GROUP $recipient NOT ALLOWED FOR USER $user");
echo "$result: $result_reason - $value|$recipient\n";
api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
exit;
}
}
else
{
$result = _QXZ("ERROR");
$result_reason = _QXZ("user_group DOES NOT EXIST");
echo "$result: $result_reason - $value|$VUuser_group\n";
api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
exit;
}
}
if(!$notification_date) {$notification_date=date("Y-m-d H:i:s");} if(!$notification_date) {$notification_date=date("Y-m-d H:i:s");}
if (preg_match('/Y/i', $notification_retry)) if (preg_match('/Y/i', $notification_retry))
{ {