Security fixes in PHP scripts for non-latin setting systems

git-svn-id: svn://192.168.202.10@1123 3d104415-ff17-0410-8863-d5cf3c621b8a

agc_2-X/branches/agc_2.0.5/www/agc/api.php

@@ -29,10 +29,11 @@
 # 90118-1051 - Added logging of API functions
 # 90128-0229 - Added vendor_id to dial function
 # 90303-0723 - Added group alias and dial prefix
+# 90522-0506 - Security fix
 #
 
-$version = '2.0.5-5';
+$version = '2.0.5-6';
-$build = '90303-0723';
+$build = '90522-0506';
 
 require("dbconnect.php");
 
@@ -110,6 +111,13 @@ $dial_prefix = ereg_replace("[^0-9a-zA-Z]","",$dial_prefix);
 $source = ereg_replace("[^0-9a-zA-Z]","",$source);
 $format = ereg_replace("[^0-9a-zA-Z]","",$format);
 }
+else
+{
+$user = ereg_replace("'|\"|\\\\|;","",$user);
+$pass = ereg_replace("'|\"|\\\\|;","",$pass);
+$source = ereg_replace("'|\"|\\\\|;","",$source);
+$agent_user = ereg_replace("'|\"|\\\\|;","",$agent_user);
+}
 
 ### date and fixed variables
 $epoch = date("U");

agc_2-X/branches/agc_2.0.5/www/agc/manager_send.php

@@ -200,10 +200,17 @@ while ($i < $qm_conf_ct)
 
 if ($non_latin < 1)
 {
-$user=ereg_replace("[^0-9a-zA-Z]","",$user);
+$user=ereg_replace("[^-_0-9a-zA-Z]","",$user);
-$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
+$pass=ereg_replace("[^-_0-9a-zA-Z]","",$pass);
 $secondS = ereg_replace("[^0-9]","",$secondS);
 }
+else
+{
+$user = ereg_replace("'|\"|\\\\|;","",$user);
+$pass = ereg_replace("'|\"|\\\\|;","",$pass);
+}
+
+
 
 # default optional vars if not set
 if (!isset($ACTION))   {$ACTION="Originate";}

agc_2-X/branches/agc_2.0.5/www/agc/vdc_db_query.php

@@ -406,6 +406,11 @@ $length_in_sec = ereg_replace("[^0-9]","",$length_in_sec);
 $phone_code = ereg_replace("[^0-9]","",$phone_code);
 $phone_number = ereg_replace("[^0-9]","",$phone_number);
 }
+else
+{
+$user = ereg_replace("'|\"|\\\\|;","",$user);
+$pass = ereg_replace("'|\"|\\\\|;","",$pass);
+}
 
 # default optional vars if not set
 if (!isset($format))   {$format="text";}

agc_2-X/branches/agc_2.0.5/www/vicidial/admin.php

@@ -1456,6 +1456,12 @@ $dialplan_entry = ereg_replace(";","",$dialplan_entry);
 # $script_text
 
 }	# end of non_latin
+else
+{
+$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
+$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
+}
+
 
 
 ##### END VARIABLE FILTERING FOR SECURITY #####
@@ -1645,11 +1651,12 @@ $dialplan_entry = ereg_replace(";","",$dialplan_entry);
 # 90309-0059 - Changed logging to admin_server_log
 # 90310-2203 - Added export_reports option for call activity report data exports
 # 90320-0424 - Fixed several small bugs conf records group alias and permissions
+# 90522-0506 - Security fix
 #
 # make sure you have added a user to the vicidial_users MySQL table with at least user_level 8 to access this page the first time
 
-$admin_version = '2.0.5-173';
+$admin_version = '2.0.5-174';
-$build = '90320-0424';
+$build = '90522-0506';
 
 $STARTtime = date("U");
 $SQLdate = date("Y-m-d H:i:s");

agc_2-X/branches/agc_2.0.5/www/vicidial/new_listloader_superL.php

@@ -25,11 +25,12 @@
 # 81011-2009 - a few bug fixes
 # 90309-1831 - Added admin_log logging
 # 90310-2128 - Added admin header
+# 90522-0506 - Security fix
 #
 # make sure vicidial_list exists and that your file follows the formatting correctly. This page does not dedupe or do any other lead filtering actions yet at this time.
 
-$version = '2.0.5-29';
+$version = '2.0.5-30';
-$build = '90310-2128';
+$build = '90522-0506';
 
 
 require("dbconnect.php");
@@ -142,6 +143,11 @@ $PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
 $PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
 $list_id_override = ereg_replace("[^0-9]","",$list_id_override);
 }
+else
+{
+$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
+$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
+}
 
 $STARTtime = date("U");
 $TODAY = date("Y-m-d");

agc_2-X/branches/agc_2.0.5/www/vicidial/non_agent_api.php

@@ -19,10 +19,11 @@
 # 80909-2012 - Added support for campaign-specific DNC lists
 # 80910-0020 - Added support for multi-alt-phones, added version function
 # 90118-1056 - Added logging of API functions
+# 90522-0506 - Security fix
 #
 
-$version = '2.0.5-5';
+$version = '2.0.5-6';
-$build = '90118-1056';
+$build = '90522-0506';
 
 require("dbconnect.php");
 
@@ -175,6 +176,12 @@ if ($non_latin < 1)
 		$multi_alt_phones = ereg_replace("\+"," ",$multi_alt_phones);
 	$source = ereg_replace("[^0-9a-zA-Z]","",$source);
 	}
+else
+	{
+	$user = ereg_replace("'|\"|\\\\|;","",$user);
+	$pass = ereg_replace("'|\"|\\\\|;","",$pass);
+	$source = ereg_replace("'|\"|\\\\|;","",$source);
+	}
 
 if (strlen($list_id)<1) {$list_id='999';}
 if (strlen($phone_code)<1) {$phone_code='1';}

agc_2-X/branches/agc_2.0.5/www/vicidial/vicidial_sales_viewer.php

@@ -23,6 +23,26 @@ if (isset($_GET["sales_time_frame"]))			{$sales_time_frame=$_GET["sales_time_fra
 if (isset($_GET["forc"]))						{$forc=$_GET["forc"];}
 	elseif (isset($_POST["forc"]))				{$forc=$_POST["forc"];}
 
+$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
+$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
+
+$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
+$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
+
+$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';";
+if ($DB) {echo "|$stmt|\n";}
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$auth=$row[0];
+
+  if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
+	{
+#	Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
+#	Header("HTTP/1.0 401 Unauthorized");
+    echo "Invalid Username/Password or no export report permission: |$PHP_AUTH_USER|\n";
+    exit;
+	}
+
 ?>
 <html>
 <head>

agc_2-X/trunk/www/agc/api.php

@@ -32,10 +32,11 @@
 # 90303-0723 - Added group alias and dial prefix
 # 90407-1920 - Added vtiger_callback option for external_dial function
 # 90508-0727 - Changed to PHP long tags
+# 90522-0506 - Security fix
 #
 
-$version = '2.2.0-7';
+$version = '2.2.0-8';
-$build = '90508-0727';
+$build = '90522-0506';
 
 require("dbconnect.php");
 
@@ -94,25 +95,32 @@ while ($i < $qm_conf_ct)
 ###########################################
 
 if ($non_latin < 1)
-{
+	{
-$user=ereg_replace("[^0-9a-zA-Z]","",$user);
+	$user=ereg_replace("[^0-9a-zA-Z]","",$user);
-$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
+	$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
-$agent_user=ereg_replace("[^0-9a-zA-Z]","",$agent_user);
+	$agent_user=ereg_replace("[^0-9a-zA-Z]","",$agent_user);
-$function = ereg_replace("[^-\_0-9a-zA-Z]","",$function);
+	$function = ereg_replace("[^-\_0-9a-zA-Z]","",$function);
-$value = ereg_replace("[^-\_0-9a-zA-Z]","",$value);
+	$value = ereg_replace("[^-\_0-9a-zA-Z]","",$value);
-$vendor_id = ereg_replace("[^-\_0-9a-zA-Z]","",$vendor_id);
+	$vendor_id = ereg_replace("[^-\_0-9a-zA-Z]","",$vendor_id);
-$focus = ereg_replace("[^-\_0-9a-zA-Z]","",$focus);
+	$focus = ereg_replace("[^-\_0-9a-zA-Z]","",$focus);
-$preview = ereg_replace("[^-\_0-9a-zA-Z]","",$preview);
+	$preview = ereg_replace("[^-\_0-9a-zA-Z]","",$preview);
-	$notes = ereg_replace("\+"," ",$notes);
+		$notes = ereg_replace("\+"," ",$notes);
-$notes = ereg_replace("[^ -\_0-9a-zA-Z]","",$notes);
+	$notes = ereg_replace("[^ -\_0-9a-zA-Z]","",$notes);
-$phone_code = ereg_replace("[^0-9X]","",$phone_code);
+	$phone_code = ereg_replace("[^0-9X]","",$phone_code);
-$search = ereg_replace("[^-\_0-9a-zA-Z]","",$search);
+	$search = ereg_replace("[^-\_0-9a-zA-Z]","",$search);
-$group_alias = ereg_replace("[^0-9a-zA-Z]","",$group_alias);
+	$group_alias = ereg_replace("[^0-9a-zA-Z]","",$group_alias);
-$dial_prefix = ereg_replace("[^0-9a-zA-Z]","",$dial_prefix);
+	$dial_prefix = ereg_replace("[^0-9a-zA-Z]","",$dial_prefix);
-$source = ereg_replace("[^0-9a-zA-Z]","",$source);
+	$source = ereg_replace("[^0-9a-zA-Z]","",$source);
-$format = ereg_replace("[^0-9a-zA-Z]","",$format);
+	$format = ereg_replace("[^0-9a-zA-Z]","",$format);
-$vtiger_callback = ereg_replace("[^A-Z]","",$vtiger_callback);
+	$vtiger_callback = ereg_replace("[^A-Z]","",$vtiger_callback);
-}
+	}
+else
+	{
+	$user = ereg_replace("'|\"|\\\\|;","",$user);
+	$pass = ereg_replace("'|\"|\\\\|;","",$pass);
+	$source = ereg_replace("'|\"|\\\\|;","",$source);
+	$agent_user = ereg_replace("'|\"|\\\\|;","",$agent_user);
+	}
 
 ### date and fixed variables
 $epoch = date("U");

agc_2-X/trunk/www/agc/manager_send.php

@@ -201,10 +201,16 @@ while ($i < $qm_conf_ct)
 
 if ($non_latin < 1)
 	{
-	$user=ereg_replace("[^0-9a-zA-Z]","",$user);
+	$user=ereg_replace("[^-_0-9a-zA-Z]","",$user);
-	$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
+	$pass=ereg_replace("[^-_0-9a-zA-Z]","",$pass);
 	$secondS = ereg_replace("[^0-9]","",$secondS);
 	}
+else
+	{
+	$user = ereg_replace("'|\"|\\\\|;","",$user);
+	$pass = ereg_replace("'|\"|\\\\|;","",$pass);
+	}
+
 
 # default optional vars if not set
 if (!isset($ACTION))   {$ACTION="Originate";}

agc_2-X/trunk/www/agc/vdc_db_query.php

@@ -408,13 +408,19 @@ while ($i < $qm_conf_ct)
 ###########################################
 
 if ($non_latin < 1)
-{
+	{
-$user=ereg_replace("[^0-9a-zA-Z]","",$user);
+	$user=ereg_replace("[^-_0-9a-zA-Z]","",$user);
-$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
+	$pass=ereg_replace("[^-_0-9a-zA-Z]","",$pass);
-$length_in_sec = ereg_replace("[^0-9]","",$length_in_sec);
+	$length_in_sec = ereg_replace("[^0-9]","",$length_in_sec);
-$phone_code = ereg_replace("[^0-9]","",$phone_code);
+	$phone_code = ereg_replace("[^0-9]","",$phone_code);
-$phone_number = ereg_replace("[^0-9]","",$phone_number);
+	$phone_number = ereg_replace("[^0-9]","",$phone_number);
-}
+	}
+else
+	{
+	$user = ereg_replace("'|\"|\\\\|;","",$user);
+	$pass = ereg_replace("'|\"|\\\\|;","",$pass);
+	}
+
 
 # default optional vars if not set
 if (!isset($format))   {$format="text";}

agc_2-X/trunk/www/agc/vicidial.php

@@ -280,9 +280,9 @@ if (isset($_GET["MGR_override"]))				{$MGR_override=$_GET["MGR_override"];}
 	$DB=ereg_replace("[^0-9a-z]","",$DB);
 	$phone_login=ereg_replace("[^\,0-9a-zA-Z]","",$phone_login);
 	$phone_pass=ereg_replace("[^0-9a-zA-Z]","",$phone_pass);
-	$VD_login=ereg_replace("[^0-9a-zA-Z]","",$VD_login);
+	$VD_login=ereg_replace("[^-_0-9a-zA-Z]","",$VD_login);
-	$VD_pass=ereg_replace("[^0-9a-zA-Z]","",$VD_pass);
+	$VD_pass=ereg_replace("[^-_0-9a-zA-Z]","",$VD_pass);
-	$VD_campaign = ereg_replace("[^-\_0-9a-zA-Z]","",$VD_campaign);
+	$VD_campaign = ereg_replace("[^-_0-9a-zA-Z]","",$VD_campaign);
 
 
 $forever_stop=0;

agc_2-X/trunk/www/vicidial/new_listloader_superL.php

@@ -26,11 +26,12 @@
 # 90309-1831 - Added admin_log logging
 # 90310-2128 - Added admin header
 # 90508-0644 - Changed to PHP long tags
+# 90522-0506 - Security fix
 #
 # make sure vicidial_list exists and that your file follows the formatting correctly. This page does not dedupe or do any other lead filtering actions yet at this time.
 
-$version = '2.0.5-30';
+$version = '2.2.0-31';
-$build = '90508-0644';
+$build = '90522-0506';
 
 
 require("dbconnect.php");
@@ -138,11 +139,16 @@ while ($i < $qm_conf_ct)
 ###########################################
 
 if ($non_latin < 1)
-{
+	{
-$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
+	$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
-$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
+	$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
-$list_id_override = ereg_replace("[^0-9]","",$list_id_override);
+	$list_id_override = ereg_replace("[^0-9]","",$list_id_override);
-}
+	}
+else
+	{
+	$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
+	$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
+	}
 
 $STARTtime = date("U");
 $TODAY = date("Y-m-d");

agc_2-X/trunk/www/vicidial/non_agent_api.php

@@ -22,10 +22,11 @@
 # 90428-0209 - Added blind_monitor function
 # 90508-0642 - Changed to PHP long tags
 # 90514-0602 - Added sounds_list function 
+# 90522-0506 - Security fix
 #
 
-$version = '2.2.0-8';
+$version = '2.2.0-9';
-$build = '90514-0602';
+$build = '90522-0506';
 
 require("dbconnect.php");
 
@@ -192,6 +193,12 @@ if ($non_latin < 1)
 	$server_ip = ereg_replace("[^\.0-9]","",$server_ip);
 	$stage = ereg_replace("[^a-zA-Z]","",$stage);
 	}
+else
+	{
+	$user = ereg_replace("'|\"|\\\\|;","",$user);
+	$pass = ereg_replace("'|\"|\\\\|;","",$pass);
+	$source = ereg_replace("'|\"|\\\\|;","",$source);
+	}
 
 if (strlen($list_id)<1) {$list_id='999';}
 if (strlen($phone_code)<1) {$phone_code='1';}

agc_2-X/trunk/www/vicidial/vicidial_sales_viewer.php

@@ -24,6 +24,27 @@ if (isset($_GET["sales_time_frame"]))			{$sales_time_frame=$_GET["sales_time_fra
 if (isset($_GET["forc"]))						{$forc=$_GET["forc"];}
 	elseif (isset($_POST["forc"]))				{$forc=$_POST["forc"];}
 
+$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
+$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
+
+$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
+$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
+
+$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';";
+if ($DB) {echo "|$stmt|\n";}
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$auth=$row[0];
+
+  if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
+	{
+#	Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
+#	Header("HTTP/1.0 401 Unauthorized");
+    echo "Invalid Username/Password or no export report permission: |$PHP_AUTH_USER|\n";
+    exit;
+	}
+
+
 ?>
 <html>
 <head>