From 91e28892db56a151e5b3ecb0c1b91bd8596b803e Mon Sep 17 00:00:00 2001 From: mattf Date: Sat, 24 Jun 2017 01:45:41 +0000 Subject: [PATCH] Changed password fields to allow up to 100 character passwords. Also changed password recommendations to emphasize length over complexity. git-svn-id: svn://192.168.202.10@2782 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/trunk/UPGRADE | 3 ++ .../trunk/extras/MySQL_AST_CREATE_tables.sql | 20 +++++----- agc_2-X/trunk/extras/upgrade_2.14.sql | 15 +++++++ agc_2-X/trunk/www/vicidial/admin.php | 39 ++++++++++--------- agc_2-X/trunk/www/vicidial/admin_header.php | 13 ++++--- agc_2-X/trunk/www/vicidial/help.php | 3 +- .../trunk/www/vicidial/lead_report_export.php | 33 +++++++++++++++- 7 files changed, 90 insertions(+), 36 deletions(-) diff --git a/agc_2-X/trunk/UPGRADE b/agc_2-X/trunk/UPGRADE index 702f24b5..a100f0d0 100644 --- a/agc_2-X/trunk/UPGRADE +++ b/agc_2-X/trunk/UPGRADE @@ -172,6 +172,9 @@ OTHER CHANGES: 38. Added Real-Time agent status of "DIAL" for agent manual dial calls after they have been placed but before they have been answered. +39. Changed password fields to allow up to 100 character passwords. Also changed + password recommendations to emphasize length over complexity. + diff --git a/agc_2-X/trunk/extras/MySQL_AST_CREATE_tables.sql b/agc_2-X/trunk/extras/MySQL_AST_CREATE_tables.sql index 43859492..651db574 100644 --- a/agc_2-X/trunk/extras/MySQL_AST_CREATE_tables.sql +++ b/agc_2-X/trunk/extras/MySQL_AST_CREATE_tables.sql @@ -6,7 +6,7 @@ phone_ip VARCHAR(15), computer_ip VARCHAR(15), server_ip VARCHAR(15), login VARCHAR(15), -pass VARCHAR(10), +pass VARCHAR(100), status VARCHAR(10), active ENUM('Y','N'), phone_type VARCHAR(50), @@ -20,7 +20,7 @@ local_gmt VARCHAR(6) default '-5.00', ASTmgrUSERNAME VARCHAR(20) default 'cron', ASTmgrSECRET VARCHAR(20) default '1234', login_user VARCHAR(20), -login_pass VARCHAR(20), +login_pass VARCHAR(100), login_campaign VARCHAR(10), park_on_extension VARCHAR(10) default '8301', conf_on_extension VARCHAR(10) default '8302', @@ -537,12 +537,12 @@ index (call_date) CREATE TABLE vicidial_users ( user_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, user VARCHAR(20) NOT NULL, -pass VARCHAR(20) NOT NULL, +pass VARCHAR(100) NOT NULL, full_name VARCHAR(50), user_level TINYINT(3) UNSIGNED default '1', user_group VARCHAR(20), phone_login VARCHAR(20), -phone_pass VARCHAR(20), +phone_pass VARCHAR(100), delete_users ENUM('0','1') default '0', delete_user_groups ENUM('0','1') default '0', delete_lists ENUM('0','1') default '0', @@ -638,7 +638,7 @@ modify_email_accounts ENUM('0','1') default '0', failed_login_count TINYINT(3) UNSIGNED default '0', last_login_date DATETIME default '2001-01-01 00:00:01', last_ip VARCHAR(15) default '', -pass_hash VARCHAR(100) default '', +pass_hash VARCHAR(500) default '', alter_admin_interface_options ENUM('0','1') default '1', max_inbound_calls SMALLINT(5) UNSIGNED default '0', modify_custom_dialplans ENUM('1','0') default '0', @@ -1625,9 +1625,9 @@ reports_use_slave_db VARCHAR(2000) default '', webphone_systemkey VARCHAR(100) default '', first_login_trigger ENUM('Y','N') default 'N', hosted_settings VARCHAR(100) default '', -default_phone_registration_password VARCHAR(20) default 'test', -default_phone_login_password VARCHAR(20) default 'test', -default_server_password VARCHAR(20) default 'test', +default_phone_registration_password VARCHAR(100) default 'test', +default_phone_login_password VARCHAR(100) default 'test', +default_server_password VARCHAR(100) default 'test', admin_modify_refresh SMALLINT(5) UNSIGNED default '0', nocache_admin ENUM('0','1') default '1', generate_cross_server_exten ENUM('0','1') default '0', @@ -3211,7 +3211,7 @@ avatar_id VARCHAR(100) PRIMARY KEY NOT NULL, avatar_name VARCHAR(100), avatar_notes TEXT, avatar_api_user VARCHAR(20) default '', -avatar_api_pass VARCHAR(20) default '', +avatar_api_pass VARCHAR(100) default '', active ENUM('Y','N') default 'Y', audio_functions VARCHAR(100) default 'PLAY-STOP-RESTART', audio_display VARCHAR(100) default 'FILE-NAME', @@ -4008,4 +4008,4 @@ UPDATE vicidial_configuration set value='1766' where name='qc_database_version'; UPDATE system_settings set vdc_agent_api_active='1'; -UPDATE system_settings SET db_schema_version='1507',db_schema_update_date=NOW(),reload_timestamp=NOW(); +UPDATE system_settings SET db_schema_version='1508',db_schema_update_date=NOW(),reload_timestamp=NOW(); diff --git a/agc_2-X/trunk/extras/upgrade_2.14.sql b/agc_2-X/trunk/extras/upgrade_2.14.sql index 1558eb97..610372f7 100644 --- a/agc_2-X/trunk/extras/upgrade_2.14.sql +++ b/agc_2-X/trunk/extras/upgrade_2.14.sql @@ -271,3 +271,18 @@ UPDATE system_settings SET db_schema_version='1506',db_schema_update_date=NOW() ALTER TABLE system_settings ADD hide_inactive_lists ENUM('0','1') default '0'; UPDATE system_settings SET db_schema_version='1507',db_schema_update_date=NOW() where db_schema_version < 1507; + +ALTER TABLE phones MODIFY pass VARCHAR(100); +ALTER TABLE phones MODIFY login_pass VARCHAR(100); + +ALTER TABLE vicidial_users MODIFY pass VARCHAR(100) NOT NULL; +ALTER TABLE vicidial_users MODIFY phone_pass VARCHAR(100); +ALTER TABLE vicidial_users MODIFY pass_hash VARCHAR(500) default ''; + +ALTER TABLE vicidial_avatars MODIFY avatar_api_pass VARCHAR(100) default ''; + +ALTER TABLE system_settings MODIFY default_phone_registration_password VARCHAR(100) default 'test'; +ALTER TABLE system_settings MODIFY default_phone_login_password VARCHAR(100) default 'test'; +ALTER TABLE system_settings MODIFY default_server_password VARCHAR(100) default 'test'; + +UPDATE system_settings SET db_schema_version='1508',db_schema_update_date=NOW() where db_schema_version < 1508; diff --git a/agc_2-X/trunk/www/vicidial/admin.php b/agc_2-X/trunk/www/vicidial/admin.php index ad15a039..ab3c628c 100644 --- a/agc_2-X/trunk/www/vicidial/admin.php +++ b/agc_2-X/trunk/www/vicidial/admin.php @@ -4140,12 +4140,13 @@ else # 170529-2320 - Added agent events push settings # 170609-1529 - Added ccc_lead_info API function # 170613-0851 - Added hide_inactive_lists system settings option +# 170623-2142 - Changed parameters for password recommendations # # make sure you have added a user to the vicidial_users MySQL table with at least user_level 9 to access this page the first time -$admin_version = '2.14-619a'; -$build = '170613-0851'; +$admin_version = '2.14-620a'; +$build = '170623-2142'; $STARTtime = date("U"); $SQLdate = date("Y-m-d H:i:s"); @@ -6070,7 +6071,7 @@ if ($ADD=="1") echo ""._QXZ("User Number").": $NWB#users-user$NWE\n"; } - echo ""._QXZ("Password").": $NWB#users-pass$NWE     "._QXZ("Strength").": \n"; + echo ""._QXZ("Password").": $NWB#users-pass$NWE     "._QXZ("Strength").": \n"; echo ""._QXZ("Full Name").": $NWB#users-full_name$NWE\n"; echo ""._QXZ("User Level").": $NWB#users-user$NWE\n"; } - echo ""._QXZ("Password").": $NWB#users-pass$NWE     "._QXZ("Strength").": \n"; + echo ""._QXZ("Password").": $NWB#users-pass$NWE     "._QXZ("Strength").": \n"; echo ""._QXZ("Full Name").": $NWB#users-full_name$NWE\n"; @@ -8132,8 +8133,8 @@ if ($ADD==11111111111) echo "$servers_list"; echo "$NWB#phones-server_ip$NWE\n"; echo ""._QXZ("Agent Screen Login").": $NWB#phones-login$NWE\n"; - echo ""._QXZ("Login Password").": $NWB#phones-pass$NWE\n"; - echo ""._QXZ("Registration Password").": $NWB#phones-conf_secret$NWE     "._QXZ("Strength").": \n"; + echo ""._QXZ("Login Password").": $NWB#phones-pass$NWE\n"; + echo ""._QXZ("Registration Password").": $NWB#phones-conf_secret$NWE     "._QXZ("Strength").": \n"; echo ""._QXZ("Status").": $NWB#phones-status$NWE\n"; echo ""._QXZ("Active Account").": $NWB#phones-active$NWE\n"; echo ""._QXZ("Phone Type").": $NWB#phones-phone_type$NWE\n"; @@ -20435,7 +20436,7 @@ if ($ADD==3) { echo ""._QXZ("PASSWORD IS ENCRYPTED, ONLY ENTER IN A PASSWORD BELOW IF YOU WANT TO CHANGE IT")."!\n"; } - echo ""._QXZ("Password").": $NWB#users-pass$NWE     "._QXZ("Strength").": \n"; + echo ""._QXZ("Password").": $NWB#users-pass$NWE     "._QXZ("Strength").": \n"; echo ""._QXZ("Force Change Password").": $NWB#users-force_change_password$NWE\n"; @@ -20470,7 +20471,7 @@ if ($ADD==3) echo "\n"; echo "$NWB#users-user_group$NWE\n"; echo ""._QXZ("Phone Login").": $NWB#users-phone_login$NWE\n"; - echo ""._QXZ("Phone Pass").": $NWB#users-phone_pass$NWE\n"; + echo ""._QXZ("Phone Pass").": $NWB#users-phone_pass$NWE\n"; echo ""._QXZ("Active").": $NWB#users-active$NWE\n"; echo ""._QXZ("Voicemail ID").": "._QXZ("voicemail chooser")."$NWB#users-voicemail_id$NWE\n"; echo ""._QXZ("Email").": $NWB#users-optional$NWE\n"; @@ -32444,8 +32445,8 @@ if ($ADD==31111111111) echo "\n"; echo "$NWB#phones-server_ip$NWE\n"; echo ""._QXZ("Agent Screen Login").": $NWB#phones-login$NWE\n"; - echo ""._QXZ("Login Password").": $NWB#phones-pass$NWE\n"; - echo ""._QXZ("Registration Password").": $NWB#phones-conf_secret$NWE     "._QXZ("Strength").": \n"; + echo ""._QXZ("Login Password").": $NWB#phones-pass$NWE\n"; + echo ""._QXZ("Registration Password").": $NWB#phones-conf_secret$NWE     "._QXZ("Strength").": \n"; echo ""._QXZ("Set As Webphone").": $NWB#phones-is_webphone$NWE\n"; echo ""._QXZ("Webphone Dialpad").": $NWB#phones-webphone_dialpad$NWE\n"; echo ""._QXZ("Webphone Auto-Answer").": $NWB#phones-webphone_auto_answer$NWE\n"; @@ -32845,7 +32846,7 @@ if ($ADD==311111111111) echo ""._QXZ("Manager Update User").": $NWB#servers-ASTmgrUSERNAMEupdate$NWE\n"; echo ""._QXZ("Manager Listen User").": $NWB#servers-ASTmgrUSERNAMElisten$NWE\n"; echo ""._QXZ("Manager Send User").": $NWB#servers-ASTmgrUSERNAMEsend$NWE\n"; - echo ""._QXZ("Conf File Secret").": $NWB#servers-conf_secret$NWE     "._QXZ("Strength").": \n"; + echo ""._QXZ("Conf File Secret").": $NWB#servers-conf_secret$NWE     "._QXZ("Strength").": \n"; echo ""._QXZ("Local GMT").": ("._QXZ("Do NOT Adjust for DST").")$NWB#servers-local_gmt$NWE\n"; echo ""._QXZ("VMail Dump Exten").": $NWB#servers-voicemail_dump_exten$NWE\n"; echo ""._QXZ("VMail Dump Exten NI").": $NWB#servers-voicemail_dump_exten_no_inst$NWE\n"; @@ -35234,11 +35235,11 @@ if ($ADD==311111111111111) echo ""._QXZ("First Login Trigger").": $first_login_trigger   $NWB#settings-first_login_trigger$NWE\n"; - echo ""._QXZ("Default Phone Registration Password").": $NWB#settings-default_phone_registration_password$NWE     "._QXZ("Strength").": \n"; + echo ""._QXZ("Default Phone Registration Password").": $NWB#settings-default_phone_registration_password$NWE     "._QXZ("Strength").": \n"; - echo ""._QXZ("Default Phone Login Password").": $NWB#settings-default_phone_login_password$NWE     "._QXZ("Strength").": \n"; + echo ""._QXZ("Default Phone Login Password").": $NWB#settings-default_phone_login_password$NWE     "._QXZ("Strength").": \n"; - echo ""._QXZ("Default Server Password").": $NWB#settings-default_server_password$NWE     "._QXZ("Strength").": \n"; + echo ""._QXZ("Default Server Password").": $NWB#settings-default_server_password$NWE     "._QXZ("Strength").": \n"; echo ""._QXZ("Report Default Format").": $NWB#settings-report_default_format$NWE\n"; @@ -39561,7 +39562,7 @@ if ($ADD==999997) echo "\n"; echo "
\n"; - echo "\n"; + echo "\n"; echo "\n"; @@ -39656,17 +39657,17 @@ if ($ADD==999996) echo "\n"; - echo "\n"; + echo "\n"; echo "\n"; echo "\n"; - echo "\n"; + echo "\n"; - echo "\n"; + echo "\n"; - echo "\n"; + echo "\n"; echo "\n"; diff --git a/agc_2-X/trunk/www/vicidial/admin_header.php b/agc_2-X/trunk/www/vicidial/admin_header.php index e8aa2202..d80abc7c 100644 --- a/agc_2-X/trunk/www/vicidial/admin_header.php +++ b/agc_2-X/trunk/www/vicidial/admin_header.php @@ -71,6 +71,7 @@ # 170113-1633 - Added dynamic call menu in-group option DYNAMIC_INGROUP_VAR for use with cm_phonesearch.agi # 170304-1354 - Added Automated Reports section to Admin # 170409-0757 - Added IP Lists +# 170623-2113 - Changed password strength parameters # $stmt="SELECT admin_home_url,enable_tts_integration,callcard_enabled,custom_fields_enabled,allow_emails,level_8_disable_add,allow_chats,enable_languages,admin_row_click,admin_screen_colors,user_new_lead_limit,user_territories_active,qc_features_active,agent_soundboards,enable_drop_lists,allow_ip_lists from system_settings;"; @@ -339,7 +340,6 @@ echo "\n"; echo "
"._QXZ("New Password").":     "._QXZ("Strength").":
"._QXZ("New Password").":     "._QXZ("Strength").":
"._QXZ("You are required to change your password before you can continue on to Administration. A strong password has both lower case and upper case letters as well as at least one number. Your password must be from 2 to 20 characters in length and cannot contain any characters that are not letters or numbers. Be sure that this password is something that you can remember, because as soon as you make this change you will be prompted to enter your new password to log back in to Administration")."
"._QXZ("You are required to change your password before you can continue on to Administration. A strong password has both lower case and upper case letters as well as at least one number. Your password must be from 2 to 20 characters in length and cannot contain any characters that are not letters or numbers. Be sure that this password is something that you can remember, because as soon as you complete this initial setup screen you will be prompted to enter your new password in again to log back in to Administration")."
"._QXZ("New Password").":     "._QXZ("Strength").":
"._QXZ("New Password").":     "._QXZ("Strength").":
 
"._QXZ("The next three default passwords are defined in the System Settings section, and you can change them after you define them here. It is a good idea to make these passwords strong so that no one can hack into your phone accounts and place phone calls without you knowing. The default registration password used when new phones are added to the system as the SIP or IAX VOIP phone password. The default phone web login password used when new phones are added to the system, as the phone password that an agent would use in the ViciDial Agent Interface. The default server password used when new servers are added to the system for servers to communicate with each other.")."
"._QXZ("Default Phone Registration Password").":     "._QXZ("Strength").":
"._QXZ("Default Phone Registration Password").":     "._QXZ("Strength").":
"._QXZ("Default Phone Login Password").":     "._QXZ("Strength").":
"._QXZ("Default Phone Login Password").":     "._QXZ("Strength").":
"._QXZ("Default Server Password").":     "._QXZ("Strength").":
"._QXZ("Default Server Password").":     "._QXZ("Strength").":