ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security fixes in PHP scripts for non-latin setting systems

Browse Source 
git-svn-id: svn://192.168.202.10@1123 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2009-05-22 09:14:08 +00:00
parent 7cfa3f79df
commit 8b7c03a26d
15 changed files with 657 additions and 538 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/branches/agc_2.0.5/www/agc/api.php
+10 -2
View File
@@ -29,10 +29,11 @@
# 90118-1051 - Added logging of API functions
# 90128-0229 - Added vendor_id to dial function
# 90303-0723 - Added group alias and dial prefix
# 90522-0506 - Security fix
#
$version = '2.0.5-5';
$build = '90303-0723';
$version = '2.0.5-6';
$build = '90522-0506';
require("dbconnect.php");
@@ -110,6 +111,13 @@ $dial_prefix = ereg_replace("[^0-9a-zA-Z]","",$dial_prefix);
$source = ereg_replace("[^0-9a-zA-Z]","",$source);
$format = ereg_replace("[^0-9a-zA-Z]","",$format);
}
else
{
$user = ereg_replace("'|\"|\\\\|;","",$user);
$pass = ereg_replace("'|\"|\\\\|;","",$pass);
$source = ereg_replace("'|\"|\\\\|;","",$source);
$agent_user = ereg_replace("'|\"|\\\\|;","",$agent_user);
}
### date and fixed variables
$epoch = date("U");
agc_2-X/branches/agc_2.0.5/www/agc/manager_send.php
+9 -2
View File
@@ -200,10 +200,17 @@ while ($i < $qm_conf_ct)
if ($non_latin < 1)
{
$user=ereg_replace("[^0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
$user=ereg_replace("[^-_0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^-_0-9a-zA-Z]","",$pass);
$secondS = ereg_replace("[^0-9]","",$secondS);
}
else
{
$user = ereg_replace("'|\"|\\\\|;","",$user);
$pass = ereg_replace("'|\"|\\\\|;","",$pass);
}
# default optional vars if not set
if (!isset($ACTION)) {$ACTION="Originate";}
agc_2-X/branches/agc_2.0.5/www/agc/vdc_db_query.php
+5
View File
@@ -406,6 +406,11 @@ $length_in_sec = ereg_replace("[^0-9]","",$length_in_sec);
$phone_code = ereg_replace("[^0-9]","",$phone_code);
$phone_number = ereg_replace("[^0-9]","",$phone_number);
}
else
{
$user = ereg_replace("'|\"|\\\\|;","",$user);
$pass = ereg_replace("'|\"|\\\\|;","",$pass);
}
# default optional vars if not set
if (!isset($format)) {$format="text";}
agc_2-X/branches/agc_2.0.5/www/vicidial/admin.php
+9 -2
View File
@@ -1456,6 +1456,12 @@ $dialplan_entry = ereg_replace(";","",$dialplan_entry);
# $script_text
} # end of non_latin
else
{
$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
}
##### END VARIABLE FILTERING FOR SECURITY #####
@@ -1645,11 +1651,12 @@ $dialplan_entry = ereg_replace(";","",$dialplan_entry);
# 90309-0059 - Changed logging to admin_server_log
# 90310-2203 - Added export_reports option for call activity report data exports
# 90320-0424 - Fixed several small bugs conf records group alias and permissions
# 90522-0506 - Security fix
#
# make sure you have added a user to the vicidial_users MySQL table with at least user_level 8 to access this page the first time
$admin_version = '2.0.5-173';
$build = '90320-0424';
$admin_version = '2.0.5-174';
$build = '90522-0506';
$STARTtime = date("U");
$SQLdate = date("Y-m-d H:i:s");
agc_2-X/branches/agc_2.0.5/www/vicidial/new_listloader_superL.php
+8 -2
View File
@@ -25,11 +25,12 @@
# 81011-2009 - a few bug fixes
# 90309-1831 - Added admin_log logging
# 90310-2128 - Added admin header
# 90522-0506 - Security fix
#
# make sure vicidial_list exists and that your file follows the formatting correctly. This page does not dedupe or do any other lead filtering actions yet at this time.
$version = '2.0.5-29';
$build = '90310-2128';
$version = '2.0.5-30';
$build = '90522-0506';
require("dbconnect.php");
@@ -142,6 +143,11 @@ $PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$list_id_override = ereg_replace("[^0-9]","",$list_id_override);
}
else
{
$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
}
$STARTtime = date("U");
$TODAY = date("Y-m-d");
agc_2-X/branches/agc_2.0.5/www/vicidial/non_agent_api.php
+9 -2
View File
@@ -19,10 +19,11 @@
# 80909-2012 - Added support for campaign-specific DNC lists
# 80910-0020 - Added support for multi-alt-phones, added version function
# 90118-1056 - Added logging of API functions
# 90522-0506 - Security fix
#
$version = '2.0.5-5';
$build = '90118-1056';
$version = '2.0.5-6';
$build = '90522-0506';
require("dbconnect.php");
@@ -175,6 +176,12 @@ if ($non_latin < 1)
$multi_alt_phones = ereg_replace("\+"," ",$multi_alt_phones);
$source = ereg_replace("[^0-9a-zA-Z]","",$source);
}
else
{
$user = ereg_replace("'|\"|\\\\|;","",$user);
$pass = ereg_replace("'|\"|\\\\|;","",$pass);
$source = ereg_replace("'|\"|\\\\|;","",$source);
}
if (strlen($list_id)<1) {$list_id='999';}
if (strlen($phone_code)<1) {$phone_code='1';}
agc_2-X/branches/agc_2.0.5/www/vicidial/vicidial_sales_viewer.php
+20
View File
@@ -23,6 +23,26 @@ if (isset($_GET["sales_time_frame"])) {$sales_time_frame=$_GET["sales_time_fra
if (isset($_GET["forc"])) {$forc=$_GET["forc"];}
elseif (isset($_POST["forc"])) {$forc=$_POST["forc"];}
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
# Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password or no export report permission: |$PHP_AUTH_USER|\n";
exit;
}
?>
<html>
<head>
agc_2-X/trunk/www/agc/api.php
+29 -21
View File
@@ -32,10 +32,11 @@
# 90303-0723 - Added group alias and dial prefix
# 90407-1920 - Added vtiger_callback option for external_dial function
# 90508-0727 - Changed to PHP long tags
# 90522-0506 - Security fix
#
$version = '2.2.0-7';
$build = '90508-0727';
$version = '2.2.0-8';
$build = '90522-0506';
require("dbconnect.php");
@@ -94,25 +95,32 @@ while ($i < $qm_conf_ct)
###########################################
if ($non_latin < 1)
{
$user=ereg_replace("[^0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
$agent_user=ereg_replace("[^0-9a-zA-Z]","",$agent_user);
$function = ereg_replace("[^-\_0-9a-zA-Z]","",$function);
$value = ereg_replace("[^-\_0-9a-zA-Z]","",$value);
$vendor_id = ereg_replace("[^-\_0-9a-zA-Z]","",$vendor_id);
$focus = ereg_replace("[^-\_0-9a-zA-Z]","",$focus);
$preview = ereg_replace("[^-\_0-9a-zA-Z]","",$preview);
$notes = ereg_replace("\+"," ",$notes);
$notes = ereg_replace("[^ -\_0-9a-zA-Z]","",$notes);
$phone_code = ereg_replace("[^0-9X]","",$phone_code);
$search = ereg_replace("[^-\_0-9a-zA-Z]","",$search);
$group_alias = ereg_replace("[^0-9a-zA-Z]","",$group_alias);
$dial_prefix = ereg_replace("[^0-9a-zA-Z]","",$dial_prefix);
$source = ereg_replace("[^0-9a-zA-Z]","",$source);
$format = ereg_replace("[^0-9a-zA-Z]","",$format);
$vtiger_callback = ereg_replace("[^A-Z]","",$vtiger_callback);
}
{
$user=ereg_replace("[^0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
$agent_user=ereg_replace("[^0-9a-zA-Z]","",$agent_user);
$function = ereg_replace("[^-\_0-9a-zA-Z]","",$function);
$value = ereg_replace("[^-\_0-9a-zA-Z]","",$value);
$vendor_id = ereg_replace("[^-\_0-9a-zA-Z]","",$vendor_id);
$focus = ereg_replace("[^-\_0-9a-zA-Z]","",$focus);
$preview = ereg_replace("[^-\_0-9a-zA-Z]","",$preview);
$notes = ereg_replace("\+"," ",$notes);
$notes = ereg_replace("[^ -\_0-9a-zA-Z]","",$notes);
$phone_code = ereg_replace("[^0-9X]","",$phone_code);
$search = ereg_replace("[^-\_0-9a-zA-Z]","",$search);
$group_alias = ereg_replace("[^0-9a-zA-Z]","",$group_alias);
$dial_prefix = ereg_replace("[^0-9a-zA-Z]","",$dial_prefix);
$source = ereg_replace("[^0-9a-zA-Z]","",$source);
$format = ereg_replace("[^0-9a-zA-Z]","",$format);
$vtiger_callback = ereg_replace("[^A-Z]","",$vtiger_callback);
}
else
{
$user = ereg_replace("'|\"|\\\\|;","",$user);
$pass = ereg_replace("'|\"|\\\\|;","",$pass);
$source = ereg_replace("'|\"|\\\\|;","",$source);
$agent_user = ereg_replace("'|\"|\\\\|;","",$agent_user);
}
### date and fixed variables
$epoch = date("U");
agc_2-X/trunk/www/agc/manager_send.php
+8 -2
View File
@@ -201,10 +201,16 @@ while ($i < $qm_conf_ct)
if ($non_latin < 1)
{
$user=ereg_replace("[^0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
$user=ereg_replace("[^-_0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^-_0-9a-zA-Z]","",$pass);
$secondS = ereg_replace("[^0-9]","",$secondS);
}
else
{
$user = ereg_replace("'|\"|\\\\|;","",$user);
$pass = ereg_replace("'|\"|\\\\|;","",$pass);
}
# default optional vars if not set
if (!isset($ACTION)) {$ACTION="Originate";}
agc_2-X/trunk/www/agc/vdc_db_query.php
+13 -7
View File
@@ -408,13 +408,19 @@ while ($i < $qm_conf_ct)
###########################################
if ($non_latin < 1)
{
$user=ereg_replace("[^0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
$length_in_sec = ereg_replace("[^0-9]","",$length_in_sec);
$phone_code = ereg_replace("[^0-9]","",$phone_code);
$phone_number = ereg_replace("[^0-9]","",$phone_number);
}
{
$user=ereg_replace("[^-_0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^-_0-9a-zA-Z]","",$pass);
$length_in_sec = ereg_replace("[^0-9]","",$length_in_sec);
$phone_code = ereg_replace("[^0-9]","",$phone_code);
$phone_number = ereg_replace("[^0-9]","",$phone_number);
}
else
{
$user = ereg_replace("'|\"|\\\\|;","",$user);
$pass = ereg_replace("'|\"|\\\\|;","",$pass);
}
# default optional vars if not set
if (!isset($format)) {$format="text";}
agc_2-X/trunk/www/agc/vicidial.php
+3 -3
View File
@@ -280,9 +280,9 @@ if (isset($_GET["MGR_override"])) {$MGR_override=$_GET["MGR_override"];}
$DB=ereg_replace("[^0-9a-z]","",$DB);
$phone_login=ereg_replace("[^\,0-9a-zA-Z]","",$phone_login);
$phone_pass=ereg_replace("[^0-9a-zA-Z]","",$phone_pass);
$VD_login=ereg_replace("[^0-9a-zA-Z]","",$VD_login);
$VD_pass=ereg_replace("[^0-9a-zA-Z]","",$VD_pass);
$VD_campaign = ereg_replace("[^-\_0-9a-zA-Z]","",$VD_campaign);
$VD_login=ereg_replace("[^-_0-9a-zA-Z]","",$VD_login);
$VD_pass=ereg_replace("[^-_0-9a-zA-Z]","",$VD_pass);
$VD_campaign = ereg_replace("[^-_0-9a-zA-Z]","",$VD_campaign);
$forever_stop=0;
agc_2-X/trunk/www/vicidial/admin.php
+491 -486
View File
File diff suppressed because it is too large Load Diff
agc_2-X/trunk/www/vicidial/new_listloader_superL.php
+13 -7
View File
@@ -26,11 +26,12 @@
# 90309-1831 - Added admin_log logging
# 90310-2128 - Added admin header
# 90508-0644 - Changed to PHP long tags
# 90522-0506 - Security fix
#
# make sure vicidial_list exists and that your file follows the formatting correctly. This page does not dedupe or do any other lead filtering actions yet at this time.
$version = '2.0.5-30';
$build = '90508-0644';
$version = '2.2.0-31';
$build = '90522-0506';
require("dbconnect.php");
@@ -138,11 +139,16 @@ while ($i < $qm_conf_ct)
###########################################
if ($non_latin < 1)
{
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$list_id_override = ereg_replace("[^0-9]","",$list_id_override);
}
{
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$list_id_override = ereg_replace("[^0-9]","",$list_id_override);
}
else
{
$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
}
$STARTtime = date("U");
$TODAY = date("Y-m-d");
agc_2-X/trunk/www/vicidial/non_agent_api.php
+9 -2
View File
@@ -22,10 +22,11 @@
# 90428-0209 - Added blind_monitor function
# 90508-0642 - Changed to PHP long tags
# 90514-0602 - Added sounds_list function
# 90522-0506 - Security fix
#
$version = '2.2.0-8';
$build = '90514-0602';
$version = '2.2.0-9';
$build = '90522-0506';
require("dbconnect.php");
@@ -192,6 +193,12 @@ if ($non_latin < 1)
$server_ip = ereg_replace("[^\.0-9]","",$server_ip);
$stage = ereg_replace("[^a-zA-Z]","",$stage);
}
else
{
$user = ereg_replace("'|\"|\\\\|;","",$user);
$pass = ereg_replace("'|\"|\\\\|;","",$pass);
$source = ereg_replace("'|\"|\\\\|;","",$source);
}
if (strlen($list_id)<1) {$list_id='999';}
if (strlen($phone_code)<1) {$phone_code='1';}
agc_2-X/trunk/www/vicidial/vicidial_sales_viewer.php
+21
View File
@@ -24,6 +24,27 @@ if (isset($_GET["sales_time_frame"])) {$sales_time_frame=$_GET["sales_time_fra
if (isset($_GET["forc"])) {$forc=$_GET["forc"];}
elseif (isset($_POST["forc"])) {$forc=$_POST["forc"];}
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
# Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password or no export report permission: |$PHP_AUTH_USER|\n";
exit;
}
?>
<html>
<head>