Security fixes in PHP scripts for non-latin setting systems

git-svn-id: svn://192.168.202.10@1123 3d104415-ff17-0410-8863-d5cf3c621b8a

agc_2-X/branches/agc_2.0.5/www/agc/api.php

@@ -29,10 +29,11 @@
 # 90118-1051 - Added logging of API functions
 # 90128-0229 - Added vendor_id to dial function
 # 90303-0723 - Added group alias and dial prefix
+# 90522-0506 - Security fix
 #
 
-$version = '2.0.5-5';
-$build = '90303-0723';
+$version = '2.0.5-6';
+$build = '90522-0506';
 
 require("dbconnect.php");
 
@@ -110,6 +111,13 @@ $dial_prefix = ereg_replace("[^0-9a-zA-Z]","",$dial_prefix);
 $source = ereg_replace("[^0-9a-zA-Z]","",$source);
 $format = ereg_replace("[^0-9a-zA-Z]","",$format);
 }
+else
+{
+$user = ereg_replace("'|\"|\\\\|;","",$user);
+$pass = ereg_replace("'|\"|\\\\|;","",$pass);
+$source = ereg_replace("'|\"|\\\\|;","",$source);
+$agent_user = ereg_replace("'|\"|\\\\|;","",$agent_user);
+}
 
 ### date and fixed variables
 $epoch = date("U");

agc_2-X/branches/agc_2.0.5/www/agc/manager_send.php

@@ -200,10 +200,17 @@ while ($i < $qm_conf_ct)
 
 if ($non_latin < 1)
 {
-$user=ereg_replace("[^0-9a-zA-Z]","",$user);
-$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
+$user=ereg_replace("[^-_0-9a-zA-Z]","",$user);
+$pass=ereg_replace("[^-_0-9a-zA-Z]","",$pass);
 $secondS = ereg_replace("[^0-9]","",$secondS);
 }
+else
+{
+$user = ereg_replace("'|\"|\\\\|;","",$user);
+$pass = ereg_replace("'|\"|\\\\|;","",$pass);
+}
+
+
 
 # default optional vars if not set
 if (!isset($ACTION))   {$ACTION="Originate";}

agc_2-X/branches/agc_2.0.5/www/agc/vdc_db_query.php

@@ -406,6 +406,11 @@ $length_in_sec = ereg_replace("[^0-9]","",$length_in_sec);
 $phone_code = ereg_replace("[^0-9]","",$phone_code);
 $phone_number = ereg_replace("[^0-9]","",$phone_number);
 }
+else
+{
+$user = ereg_replace("'|\"|\\\\|;","",$user);
+$pass = ereg_replace("'|\"|\\\\|;","",$pass);
+}
 
 # default optional vars if not set
 if (!isset($format))   {$format="text";}

agc_2-X/branches/agc_2.0.5/www/vicidial/admin.php

@@ -1456,6 +1456,12 @@ $dialplan_entry = ereg_replace(";","",$dialplan_entry);
 # $script_text
 
 }	# end of non_latin
+else
+{
+$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
+$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
+}
+
 
 
 ##### END VARIABLE FILTERING FOR SECURITY #####
@@ -1645,11 +1651,12 @@ $dialplan_entry = ereg_replace(";","",$dialplan_entry);
 # 90309-0059 - Changed logging to admin_server_log
 # 90310-2203 - Added export_reports option for call activity report data exports
 # 90320-0424 - Fixed several small bugs conf records group alias and permissions
+# 90522-0506 - Security fix
 #
 # make sure you have added a user to the vicidial_users MySQL table with at least user_level 8 to access this page the first time
 
-$admin_version = '2.0.5-173';
-$build = '90320-0424';
+$admin_version = '2.0.5-174';
+$build = '90522-0506';
 
 $STARTtime = date("U");
 $SQLdate = date("Y-m-d H:i:s");

agc_2-X/branches/agc_2.0.5/www/vicidial/new_listloader_superL.php

@@ -25,11 +25,12 @@
 # 81011-2009 - a few bug fixes
 # 90309-1831 - Added admin_log logging
 # 90310-2128 - Added admin header
+# 90522-0506 - Security fix
 #
 # make sure vicidial_list exists and that your file follows the formatting correctly. This page does not dedupe or do any other lead filtering actions yet at this time.
 
-$version = '2.0.5-29';
-$build = '90310-2128';
+$version = '2.0.5-30';
+$build = '90522-0506';
 
 
 require("dbconnect.php");
@@ -142,6 +143,11 @@ $PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
 $PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
 $list_id_override = ereg_replace("[^0-9]","",$list_id_override);
 }
+else
+{
+$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
+$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
+}
 
 $STARTtime = date("U");
 $TODAY = date("Y-m-d");

agc_2-X/branches/agc_2.0.5/www/vicidial/non_agent_api.php

@@ -19,10 +19,11 @@
 # 80909-2012 - Added support for campaign-specific DNC lists
 # 80910-0020 - Added support for multi-alt-phones, added version function
 # 90118-1056 - Added logging of API functions
+# 90522-0506 - Security fix
 #
 
-$version = '2.0.5-5';
-$build = '90118-1056';
+$version = '2.0.5-6';
+$build = '90522-0506';
 
 require("dbconnect.php");
 
@@ -175,6 +176,12 @@ if ($non_latin < 1)
 		$multi_alt_phones = ereg_replace("\+"," ",$multi_alt_phones);
 	$source = ereg_replace("[^0-9a-zA-Z]","",$source);
 	}
+else
+	{
+	$user = ereg_replace("'|\"|\\\\|;","",$user);
+	$pass = ereg_replace("'|\"|\\\\|;","",$pass);
+	$source = ereg_replace("'|\"|\\\\|;","",$source);
+	}
 
 if (strlen($list_id)<1) {$list_id='999';}
 if (strlen($phone_code)<1) {$phone_code='1';}

agc_2-X/branches/agc_2.0.5/www/vicidial/vicidial_sales_viewer.php

@@ -23,6 +23,26 @@ if (isset($_GET["sales_time_frame"]))			{$sales_time_frame=$_GET["sales_time_fra
 if (isset($_GET["forc"]))						{$forc=$_GET["forc"];}
 	elseif (isset($_POST["forc"]))				{$forc=$_POST["forc"];}
 
+$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
+$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
+
+$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
+$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
+
+$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';";
+if ($DB) {echo "|$stmt|\n";}
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$auth=$row[0];
+
+  if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
+	{
+#	Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
+#	Header("HTTP/1.0 401 Unauthorized");
+    echo "Invalid Username/Password or no export report permission: |$PHP_AUTH_USER|\n";
+    exit;
+	}
+
 ?>
 <html>
 <head>