ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PHP Input variable filtering changes

Browse Source 
git-svn-id: svn://192.168.202.10@3848 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2024-07-09 02:23:35 +00:00
parent e3f2d907b5
commit 9d8494f6bf
2 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/VERM/VERM_AJAX_functions.php
+6 -1
View File
@@ -1,10 +1,11 @@
<?php
# VERM_AJAX_functions.php - Vicidial Enhanced Reporting AJAX functions page
#
# Copyright (C) 2022 Matt Florell <vicidial@gmail.com>, Joe Johnson <joej@vicidial.com> LICENSE: AGPLv2
# Copyright (C) 2024 Matt Florell <vicidial@gmail.com>, Joe Johnson <joej@vicidial.com> LICENSE: AGPLv2
#
# CHANGELOG:
# 220825-1608 - First build
# 240709-2151 - Added input variable filtering
#
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
@@ -56,12 +57,16 @@ if ($non_latin < 1)
$function = preg_replace('/[^\-_0-9a-zA-Z]/','',$function);
$custom_report_vars = preg_replace('/[^-\/\|\_\#\*\,\.\_\[\]0-9a-zA-Z]/','',$custom_report_vars);
$custom_report_name = preg_replace('/[^\-_0-9a-zA-Z]/','',$custom_report_name);
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$function = preg_replace('/[^-_0-9\p{L}/u','',$function);
$custom_report_vars = preg_replace('/[^-\/\|\_\#\*\,\.\_\[\]0-9\p{L}]/u','',$custom_report_vars);
$custom_report_name = preg_replace('/[^-_0-9\p{L}/u','',$custom_report_name);
$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
}
agc_2-X/trunk/www/agc/manager_send.php
+7 -4
View File
@@ -156,10 +156,11 @@
# 230726-0857 - Fix for rare vicidial_closer_log issue on Voicemail transfers
# 240420-2233 - ConfBridge code added
# 240430-1046 - Allow for park/grab of xfer line through API
# 240709-2010 - Changes to input variable filtering
#
$version = '2.14-103';
$build = '240430-1046';
$version = '2.14-104';
$build = '240709-2010';
$php_script = 'manager_send.php';
$mel=1; # Mysql Error Log enabled = 1
$mysql_log_count=161;
@@ -332,7 +333,6 @@ $ext_priority = preg_replace('/[^-_0-9a-zA-Z]/','',$ext_priority);
$exten = preg_replace("/\'|\"|\\\\|;/","",$exten);
$extenName = preg_replace("/\'|\"|\\\\|;/","",$extenName);
$extrachannel = preg_replace("/\'|\"|\\\\/","",$extrachannel);
$filename = preg_replace("/\'|\"|\\\\|;/","",$filename);
$format = preg_replace('/[^-_0-9a-zA-Z]/','',$format);
$log_campaign = preg_replace("/\'|\"|\\\\|;/","",$log_campaign);
$nodeletevdac = preg_replace('/[^0-9]/','',$nodeletevdac);
@@ -341,7 +341,6 @@ $parkedby = preg_replace("/\'|\"|\\\\|;/","",$parkedby);
$phone_code = preg_replace("/\s/","",$phone_code);
$preset_name = preg_replace("/\'|\"|\\\\|;/","",$preset_name);
$qm_extension = preg_replace("/\'|\"|\\\\|;/","",$qm_extension);
$queryCID = preg_replace("/\'|\"|\\\\|;/","",$queryCID);
$secondS = preg_replace('/[^0-9]/','',$secondS);
$stage = preg_replace("/\'|\"|\\\\|;/","",$stage);
$usegroupalias = preg_replace('/[^0-9]/','',$usegroupalias);
@@ -361,6 +360,8 @@ if ($non_latin < 1)
$agent_dialed_type = preg_replace('/[^-_0-9a-zA-Z]/','',$agent_dialed_type);
$account = preg_replace('/[^-_0-9a-zA-Z]/','',$account);
$group_id = preg_replace('/[^-_0-9a-zA-Z]/','',$group_id);
$filename = preg_replace('/[^-\._0-9a-zA-Z]/','',$filename);
$queryCID = preg_replace('/[^-\._0-9a-zA-Z]/','',$queryCID);
}
else
{
@@ -374,6 +375,8 @@ else
$agent_dialed_type = preg_replace('/[^-_0-9\p{L}]/u','',$agent_dialed_type);
$account = preg_replace('/[^-_0-9\p{L}]/u','',$account);
$group_id = preg_replace('/[^-_0-9\p{L}]/u','',$group_id);
$filename = preg_replace('/[^-\._0-9\p{L}]/u','',$filename);
$queryCID = preg_replace('/[^-\._0-9\p{L}]/u','',$queryCID);
}
# default optional vars if not set