ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added several security changes to the admin interface, including freezing a user's account for 15 minutes after 10 failed login attempts.

Browse Source 
Added 3 new reports to the admin interface: url log, lagged log and user group login reports
Added new AST_phone_update.pl --agent-lookup flag to allow for logging of the IP address of the agent's SIP or IAX phone connection. Can be enabled as a crontab entry to perform the lookups on each asterisk server.

git-svn-id: svn://192.168.202.10@1997 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2013-07-02 06:00:53 +00:00
parent d585504151
commit cf21ae391e
112 changed files with 8058 additions and 4242 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/UPGRADE
+11
View File
@@ -64,6 +64,17 @@ OTHER CHANGES:
depricated. This will also have the benefit of speeding up those scripts
because preg is supposed to be more efficient and faster than ereg.
4. Added several security changes to the admin interface, including freezing a
user's account for 15 minutes after 10 failed login attempts.
5. Added 3 new reports to the admin interface: url log, lagged log and
user group login reports
6. Added new AST_phone_update.pl --agent-lookup flag to allow for logging of the
IP address of the agent's SIP or IAX phone connection. Can be enabled as
a crontab entry to perform the lookups on each asterisk server.
agc_2-X/trunk/bin/ADMIN_keepalive_ALL.pl
+11 -1
View File
@@ -1,6 +1,6 @@
#!/usr/bin/perl
#
# ADMIN_keepalive_ALL.pl version 2.6
# ADMIN_keepalive_ALL.pl version 2.8
#
# Designed to keep the astGUIclient processes alive and check every minute
# Replaces all other ADMIN_keepalive scripts
@@ -84,6 +84,7 @@
# 130402-2148 - Changes to allow for native IAX bridging to other servers
# 130424-1607 - Added NOINT prefix option for call menu prompts to do Playback() instead of Background()
# 130508-1009 - Small fix for INVALID_2ND and 3RD
# 130624-0733 - Added optimize for vicidial_users due to logging IP and auth timestamp
#
$DB=0; # Debug flag
@@ -914,6 +915,15 @@ if ($timeclock_end_of_day_NOW > 0)
if ($DB) {print "|",$aryA[0],"|",$aryA[1],"|",$aryA[2],"|",$aryA[3],"|","\n";}
$sthA->finish();
$stmtA = "optimize table vicidial_users;";
if($DBX){print STDERR "\n|$stmtA|\n";}
$sthA = $dbhA->prepare($stmtA) or die "preparing: ",$dbhA->errstr;
$sthA->execute or die "executing: $stmtA ", $dbhA->errstr;
$sthArows=$sthA->rows;
@aryA = $sthA->fetchrow_array;
if ($DB) {print "|",$aryA[0],"|",$aryA[1],"|",$aryA[2],"|",$aryA[3],"|","\n";}
$sthA->finish();
$stmtA = "update vicidial_campaign_agents SET calls_today=0;";
if($DBX){print STDERR "\n|$stmtA|\n";}
$affected_rows = $dbhA->do($stmtA);
agc_2-X/trunk/bin/AST_phone_update.pl
+273 -184
View File
@@ -1,52 +1,68 @@
#!/usr/bin/perl
#
# AST_phone_update.pl version 2.4
# AST_phone_update.pl version 2.8
#
# DESCRIPTION:
# checks the registered IP address of the phone and updates the phones table
#
# Copyright (C) 2010 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2013 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# 70521-1529 - first build
# 100625-1220 - Added waitfors after logout to fix broken pipe errors in asterisk <MikeC>
# 130625-0947 - Added --agent-lookup option for agent phone_ip population
#
# constants
$DB=0; # Debug flag, set to 0 for no debug messages per minute
$US='__';
$MT[0]='';
$agent_lookup=0;
### begin parsing run-time options ###
if (length($ARGV[0])>1)
{
{
$i=0;
while ($#ARGV >= $i)
{
$args = "$args $ARGV[$i]";
$i++;
}
{
$args = "$args $ARGV[$i]";
$i++;
}
if ($args =~ /--help/i)
{
print "allowed run time options:\n [-t] = test\n [-debug] = verbose debug messages\n\n";
}
{
print "allowed run time options:\n";
print " [-t] = test\n";
print " [--debug] = verbose debug messages\n";
print " [--debugX] = extra verbose debug messages\n";
print " [--agent-lookup] = looks up the agent phone_ip only\n";
print "\n";
exit;
}
else
{
if ($args =~ /-debug/i)
{
$DB=1; # Debug flag
}
if ($args =~ /-t/i)
{
$TEST=1;
$T=1;
{
$TEST=1;
$T=1;
}
if ($args =~ /--debug/i)
{
$DB=1; # Debug flag
}
if ($args =~ /--debugX/i)
{
$DBX=1; # Extra debug flag
}
if ($args =~ /--agent-lookup/i)
{
$agent_lookup=1; # agent lookup only flag
}
}
}
}
else
{
# print "no command line options set\n";
}
{
# print "no command line options set\n";
}
### end parsing run-time options ###
# default path to astguiclient configuration file:
@@ -109,205 +125,281 @@ $sthArows=$sthA->rows;
$rec_count=0;
if ($sthArows > 0)
{
@aryA = $sthA->fetchrow_array;
$DBtelnet_host = "$aryA[0]";
$DBtelnet_port = "$aryA[1]";
$DBASTmgrUSERNAME = "$aryA[2]";
$DBASTmgrSECRET = "$aryA[3]";
$DBASTmgrUSERNAMEupdate = "$aryA[4]";
$DBASTmgrUSERNAMElisten = "$aryA[5]";
$DBASTmgrUSERNAMEsend = "$aryA[6]";
$DBmax_vicidial_trunks = "$aryA[7]";
$DBanswer_transfer_agent= "$aryA[8]";
$DBSERVER_GMT = "$aryA[9]";
$DBext_context = "$aryA[10]";
if ($DBtelnet_host) {$telnet_host = $DBtelnet_host;}
if ($DBtelnet_port) {$telnet_port = $DBtelnet_port;}
if ($DBASTmgrUSERNAME) {$ASTmgrUSERNAME = $DBASTmgrUSERNAME;}
if ($DBASTmgrSECRET) {$ASTmgrSECRET = $DBASTmgrSECRET;}
if ($DBASTmgrUSERNAMEupdate) {$ASTmgrUSERNAMEupdate = $DBASTmgrUSERNAMEupdate;}
if ($DBASTmgrUSERNAMElisten) {$ASTmgrUSERNAMElisten = $DBASTmgrUSERNAMElisten;}
if ($DBASTmgrUSERNAMEsend) {$ASTmgrUSERNAMEsend = $DBASTmgrUSERNAMEsend;}
if ($DBmax_vicidial_trunks) {$max_vicidial_trunks = $DBmax_vicidial_trunks;}
if ($DBanswer_transfer_agent) {$answer_transfer_agent = $DBanswer_transfer_agent;}
if ($DBSERVER_GMT) {$SERVER_GMT = $DBSERVER_GMT;}
if ($DBext_context) {$ext_context = $DBext_context;}
@aryA = $sthA->fetchrow_array;
$DBtelnet_host = $aryA[0];
$DBtelnet_port = $aryA[1];
$DBASTmgrUSERNAME = $aryA[2];
$DBASTmgrSECRET = $aryA[3];
$DBASTmgrUSERNAMEupdate = $aryA[4];
$DBASTmgrUSERNAMElisten = $aryA[5];
$DBASTmgrUSERNAMEsend = $aryA[6];
$DBmax_vicidial_trunks = $aryA[7];
$DBanswer_transfer_agent= $aryA[8];
$DBSERVER_GMT = $aryA[9];
$DBext_context = $aryA[10];
if ($DBtelnet_host) {$telnet_host = $DBtelnet_host;}
if ($DBtelnet_port) {$telnet_port = $DBtelnet_port;}
if ($DBASTmgrUSERNAME) {$ASTmgrUSERNAME = $DBASTmgrUSERNAME;}
if ($DBASTmgrSECRET) {$ASTmgrSECRET = $DBASTmgrSECRET;}
if ($DBASTmgrUSERNAMEupdate) {$ASTmgrUSERNAMEupdate = $DBASTmgrUSERNAMEupdate;}
if ($DBASTmgrUSERNAMElisten) {$ASTmgrUSERNAMElisten = $DBASTmgrUSERNAMElisten;}
if ($DBASTmgrUSERNAMEsend) {$ASTmgrUSERNAMEsend = $DBASTmgrUSERNAMEsend;}
if ($DBmax_vicidial_trunks) {$max_vicidial_trunks = $DBmax_vicidial_trunks;}
if ($DBanswer_transfer_agent) {$answer_transfer_agent = $DBanswer_transfer_agent;}
if ($DBSERVER_GMT) {$SERVER_GMT = $DBSERVER_GMT;}
if ($DBext_context) {$ext_context = $DBext_context;}
}
$sthA->finish();
$sthA->finish();
$secX = time();
$BDtarget = ($secX - 86400);
($Bsec,$Bmin,$Bhour,$Bmday,$Bmon,$Byear,$Bwday,$Byday,$Bisdst) = localtime($BDtarget);
$Byear = ($Byear + 1900);
$Bmon++;
if ($Bmon < 10) {$Bmon = "0$Bmon";}
if ($Bmday < 10) {$Bmday = "0$Bmday";}
if ($Bhour < 10) {$Bhour = "0$Bhour";}
if ($Bmin < 10) {$Bmin = "0$Bmin";}
if ($Bsec < 10) {$Bsec = "0$Bsec";}
$BDtsSQLdate = "$Byear$Bmon$Bmday$Bhour$Bmin$Bsec";
$phone_listSQL='';
$sip_count=0;
##### BEGIN sip agent phone_ip lookup #####
if ($agent_lookup > 0)
{
$stmtA = "SELECT distinct server_phone from vicidial_user_log where server_ip='$server_ip' and phone_ip='LOOKUP' and event_date > \"$BDtsSQLdate\" and extension LIKE \"SIP%\";";
if ($DB) {print "|$stmtA|\n";}
$sthA = $dbhA->prepare($stmtA) or die "preparing: ",$dbhA->errstr;
$sthA->execute or die "executing: $stmtA ", $dbhA->errstr;
$sthArows=$sthA->rows;
while ($sthArows > $sip_count)
{
@aryA = $sthA->fetchrow_array;
$phone_list .= "'$aryA[0]',";
$sip_count++;
}
$sthA->finish();
chop($phone_list);
if (length($phone_list) > 2)
{$phone_listSQL = "and login IN($phone_list)";}
}
##### END sip agent phone_ip lookup #####
############# BEGIN SIP SECTION ################################################
if($DB){print "\n\nSIP EXTENSIONS:\n";}
@PTextensions=@MT; @PTphone_ips=@MT;
$stmtA = "SELECT extension,phone_ip from phones where server_ip='$server_ip' and protocol='SIP'";
if ($DB) {print "|$stmtA|\n";}
$sthA = $dbhA->prepare($stmtA) or die "preparing: ",$dbhA->errstr;
$sthA->execute or die "executing: $stmtA ", $dbhA->errstr;
$sthArows=$sthA->rows;
$rec_count=0;
while ($sthArows > $rec_count)
{
@aryA = $sthA->fetchrow_array;
$PTextensions[$rec_count] = "$aryA[0]";
$PTphone_ips[$rec_count] = "$aryA[1]";
$rec_count++;
}
$sthA->finish();
### connect to asterisk manager through telnet
$t = new Net::Telnet (Port => 5038,
Prompt => '/.*[\$%#>] $/',
Output_record_separator => '',);
#$fh = $t->dump_log("$telnetlog"); # uncomment for telnet log
if (length($ASTmgrUSERNAMEsend) > 3) {$telnet_login = $ASTmgrUSERNAMEsend;}
else {$telnet_login = $ASTmgrUSERNAME;}
$t->open("$telnet_host");
$t->waitfor('/[01]\n$/'); # print login
$t->print("Action: Login\nUsername: $telnet_login\nSecret: $ASTmgrSECRET\n\n");
$t->waitfor('/Authentication accepted/'); # waitfor auth accepted
$i=0;
foreach(@PTextensions)
if ( ($sip_count > 0) || ($agent_lookup < 1) )
{
@list_channels=@MT;
$t->buffer_empty;
@list_channels = $t->cmd(String => "Action: Command\nCommand: sip show peer $PTextensions[$i]\n\nAction: Ping\n\n", Prompt => '/Response: Pong.*/');
@PTextensions=@MT; @PTphone_ips=@MT; @PTlogins=@MT;
$stmtA = "SELECT extension,phone_ip,login from phones where server_ip='$server_ip' and protocol='SIP' $phone_listSQL;";
if ($DB) {print "|$stmtA|\n";}
$sthA = $dbhA->prepare($stmtA) or die "preparing: ",$dbhA->errstr;
$sthA->execute or die "executing: $stmtA ", $dbhA->errstr;
$sthArows=$sthA->rows;
$rec_count=0;
while ($sthArows > $rec_count)
{
@aryA = $sthA->fetchrow_array;
$PTextensions[$rec_count] = $aryA[0];
$PTphone_ips[$rec_count] = $aryA[1];
$PTlogins[$rec_count] = $aryA[2];
$rec_count++;
}
$sthA->finish();
$j=0;
foreach(@list_channels)
{ # Addr->IP : 10.10.14.25 Port 5060
if ($list_channels[$j] =~ / Addr->IP : /)
{
$NEW_IPaddr[$i] = "$list_channels[$j]";
$NEW_IPaddr[$i] =~ s/ Addr->IP : | Port .*|\n|\r|\t//g;
### connect to asterisk manager through telnet
$t = new Net::Telnet (Port => 5038,
Prompt => '/.*[\$%#>] $/',
Output_record_separator => '',);
#$fh = $t->dump_log("$telnetlog"); # uncomment for telnet log
if (length($ASTmgrUSERNAMEsend) > 3) {$telnet_login = $ASTmgrUSERNAMEsend;}
else {$telnet_login = $ASTmgrUSERNAME;}
$t->open("$telnet_host");
$t->waitfor('/[01]\n$/'); # print login
$t->print("Action: Login\nUsername: $telnet_login\nSecret: $ASTmgrSECRET\n\n");
$t->waitfor('/Authentication accepted/'); # waitfor auth accepted
$i=0;
foreach(@PTextensions)
{
@list_channels=@MT;
$t->buffer_empty;
@list_channels = $t->cmd(String => "Action: Command\nCommand: sip show peer $PTextensions[$i]\n\nAction: Ping\n\n", Prompt => '/Response: Pong.*/');
$j=0;
foreach(@list_channels)
{ # Addr->IP : 10.10.14.25 Port 5060
if ($list_channels[$j] =~ / Addr->IP : /)
{
$NEW_IPaddr[$i] = "$list_channels[$j]";
$NEW_IPaddr[$i] =~ s/ Addr->IP : | Port .*|\n|\r|\t//g;
}
$j++;
}
$j++;
}
if($DB){print "Phone IP- $PTextensions[$i] NEW:|$NEW_IPaddr[$i]| OLD:|$PTphone_ips[$i]| ";}
if ( ($NEW_IPaddr[$i] =~ /$PTphone_ips[$i]/) && (length($NEW_IPaddr[$i]) eq length($PTphone_ips[$i])) )
{
if($DB){print "PHONE IP UNCHANGED, DOING NOTHING FOR THIS EXTENSION\n";}
}
else
{
if ($NEW_IPaddr[$i] =~ /Unspecified/)
if($DB){print "Phone IP- $PTextensions[$i] NEW:|$NEW_IPaddr[$i]| OLD:|$PTphone_ips[$i]| ";}
if ( ($NEW_IPaddr[$i] =~ /$PTphone_ips[$i]/) && (length($NEW_IPaddr[$i]) eq length($PTphone_ips[$i])) )
{
if($DB){print "PHONE IP UNSPECIFIED, DOING NOTHING FOR THIS EXTENSION\n";}
if($DB){print "PHONE IP UNCHANGED, DOING NOTHING FOR THIS EXTENSION\n";}
}
else
{
$stmtA = "UPDATE phones set phone_ip='$NEW_IPaddr[$i]' where server_ip='$server_ip' and extension='$PTextensions[$i]'";
if($DB){print STDERR "\n|$stmtA|\n";}
$affected_rows = $dbhA->do($stmtA); # or die "Couldn't execute query:|$stmtA|\n";
if ($NEW_IPaddr[$i] =~ /Unspecified/)
{
if($DB){print "PHONE IP UNSPECIFIED, DOING NOTHING FOR THIS EXTENSION\n";}
}
else
{
$stmtA = "UPDATE phones set phone_ip='$NEW_IPaddr[$i]' where server_ip='$server_ip' and extension='$PTextensions[$i]';";
$affected_rows = $dbhA->do($stmtA); # or die "Couldn't execute query:|$stmtA|\n";
if($DB){print STDERR "\n|$affected_rows|$stmtA|\n";}
}
}
if ($agent_lookup > 0)
{
$stmtA = "UPDATE vicidial_user_log set phone_ip='$NEW_IPaddr[$i]' where server_phone='$PTlogins[$i]' and server_ip='$server_ip' and phone_ip='LOOKUP' and event_date > \"$BDtsSQLdate\" and extension LIKE \"SIP%\";";
$affected_rows = $dbhA->do($stmtA); # or die "Couldn't execute query:|$stmtA|\n";
if($DB){print STDERR "\n|$affected_rows|$stmtA|\n";}
}
}
$i++;
$i++;
### sleep for 10 hundredths of a second
usleep(1*100*1000);
}
$t->buffer_empty;
@hangup = $t->cmd(String => "Action: Logoff\n\n", Prompt => "/.*/");
$t->buffer_empty;
$t->waitfor(Match => '/Message:.*\n\n/', Timeout => 10);
$ok = $t->close;
}
$t->buffer_empty;
@hangup = $t->cmd(String => "Action: Logoff\n\n", Prompt => "/.*/");
$t->buffer_empty;
$t->waitfor(Match => '/Message:.*\n\n/', Timeout => 10);
$ok = $t->close;
############# END SIP SECTION ################################################
$phone_listSQL='';
$iax_count=0;
##### BEGIN sip agent phone_ip lookup #####
if ($agent_lookup > 0)
{
$stmtA = "SELECT distinct server_phone from vicidial_user_log where server_ip='$server_ip' and phone_ip='LOOKUP' and event_date > \"$BDtsSQLdate\" and extension LIKE \"IAX%\";";
if ($DB) {print "|$stmtA|\n";}
$sthA = $dbhA->prepare($stmtA) or die "preparing: ",$dbhA->errstr;
$sthA->execute or die "executing: $stmtA ", $dbhA->errstr;
$sthArows=$sthA->rows;
while ($sthArows > $iax_count)
{
@aryA = $sthA->fetchrow_array;
$phone_list .= "'$aryA[0]',";
$iax_count++;
}
$sthA->finish();
chop($phone_list);
if (length($phone_list) > 2)
{$phone_listSQL = "and login IN($phone_list)";}
}
##### END sip agent phone_ip lookup #####
############# BEGIN IAX2 SECTION ################################################
if($DB){print "\n\niax2 EXTENSIONS:\n";}
@PTextensions=@MT; @PTphone_ips=@MT;
$stmtA = "SELECT extension,phone_ip from phones where server_ip='$server_ip' and protocol='IAX2'";
if ($DB) {print "|$stmtA|\n";}
$sthA = $dbhA->prepare($stmtA) or die "preparing: ",$dbhA->errstr;
$sthA->execute or die "executing: $stmtA ", $dbhA->errstr;
$sthArows=$sthA->rows;
$rec_count=0;
while ($sthArows > $rec_count)
{
@aryA = $sthA->fetchrow_array;
$PTextensions[$rec_count] = "$aryA[0]";
$PTphone_ips[$rec_count] = "$aryA[1]";
$rec_count++;
}
$sthA->finish();
### connect to asterisk manager through telnet
$t = new Net::Telnet (Port => 5038,
Prompt => '/.*[\$%#>] $/',
Output_record_separator => '',);
#$fh = $t->dump_log("$telnetlog"); # uncomment for telnet log
if (length($ASTmgrUSERNAMEsend) > 3) {$telnet_login = $ASTmgrUSERNAMEsend;}
else {$telnet_login = $ASTmgrUSERNAME;}
$t->open("$telnet_host");
$t->waitfor('/[01]\n$/'); # print login
$t->print("Action: Login\nUsername: $telnet_login\nSecret: $ASTmgrSECRET\n\n");
$t->waitfor('/Authentication accepted/'); # waitfor auth accepted
$i=0;
foreach(@PTextensions)
if ( ($iax_count > 0) || ($agent_lookup < 1) )
{
@list_channels=@MT;
$t->buffer_empty;
@list_channels = $t->cmd(String => "Action: Command\nCommand: iax2 show peer $PTextensions[$i]\n\nAction: Ping\n\n", Prompt => '/Response: Pong.*/');
@PTextensions=@MT; @PTphone_ips=@MT; @PTlogins=@MT;
$stmtA = "SELECT extension,phone_ip,login from phones where server_ip='$server_ip' and protocol='IAX2' $phone_listSQL;";
if ($DB) {print "|$stmtA|\n";}
$sthA = $dbhA->prepare($stmtA) or die "preparing: ",$dbhA->errstr;
$sthA->execute or die "executing: $stmtA ", $dbhA->errstr;
$sthArows=$sthA->rows;
$rec_count=0;
while ($sthArows > $rec_count)
{
@aryA = $sthA->fetchrow_array;
$PTextensions[$rec_count] = $aryA[0];
$PTphone_ips[$rec_count] = $aryA[1];
$PTlogins[$rec_count] = $aryA[2];
$rec_count++;
}
$sthA->finish();
$j=0;
foreach(@list_channels)
{ # Addr->IP : 10.10.14.25 Port 5060
if ($list_channels[$j] =~ / Addr->IP : /)
{
$NEW_IPaddr[$i] = "$list_channels[$j]";
$NEW_IPaddr[$i] =~ s/ Addr->IP : | Port .*|\n|\r|\t//g;
### connect to asterisk manager through telnet
$t = new Net::Telnet (Port => 5038,
Prompt => '/.*[\$%#>] $/',
Output_record_separator => '',);
#$fh = $t->dump_log("$telnetlog"); # uncomment for telnet log
if (length($ASTmgrUSERNAMEsend) > 3) {$telnet_login = $ASTmgrUSERNAMEsend;}
else {$telnet_login = $ASTmgrUSERNAME;}
$t->open("$telnet_host");
$t->waitfor('/[01]\n$/'); # print login
$t->print("Action: Login\nUsername: $telnet_login\nSecret: $ASTmgrSECRET\n\n");
$t->waitfor('/Authentication accepted/'); # waitfor auth accepted
$i=0;
foreach(@PTextensions)
{
@list_channels=@MT;
$t->buffer_empty;
@list_channels = $t->cmd(String => "Action: Command\nCommand: iax2 show peer $PTextensions[$i]\n\nAction: Ping\n\n", Prompt => '/Response: Pong.*/');
$j=0;
foreach(@list_channels)
{ # Addr->IP : 10.10.14.25 Port 5060
if ($list_channels[$j] =~ / Addr->IP : /)
{
$NEW_IPaddr[$i] = "$list_channels[$j]";
$NEW_IPaddr[$i] =~ s/ Addr->IP : | Port .*|\n|\r|\t//g;
}
$j++;
}
$j++;
}
if($DB){print "Phone IP- $PTextensions[$i] NEW:|$NEW_IPaddr[$i]| OLD:|$PTphone_ips[$i]| ";}
if ( ($NEW_IPaddr[$i] =~ /$PTphone_ips[$i]/) && (length($NEW_IPaddr[$i]) eq length($PTphone_ips[$i])) )
{
if($DB){print "PHONE IP UNCHANGED, DOING NOTHING FOR THIS EXTENSION\n";}
}
else
{
if ($NEW_IPaddr[$i] =~ /Unspecified/)
if($DB){print "Phone IP- $PTextensions[$i] NEW:|$NEW_IPaddr[$i]| OLD:|$PTphone_ips[$i]| ";}
if ( ($NEW_IPaddr[$i] =~ /$PTphone_ips[$i]/) && (length($NEW_IPaddr[$i]) eq length($PTphone_ips[$i])) )
{
if($DB){print "PHONE IP UNSPECIFIED, DOING NOTHING FOR THIS EXTENSION\n";}
if($DB){print "PHONE IP UNCHANGED, DOING NOTHING FOR THIS EXTENSION\n";}
}
else
{
$stmtA = "UPDATE phones set phone_ip='$NEW_IPaddr[$i]' where server_ip='$server_ip' and extension='$PTextensions[$i]'";
if($DB){print STDERR "\n|$stmtA|\n";}
$affected_rows = $dbhA->do($stmtA); # or die "Couldn't execute query:|$stmtA|\n";
if ($NEW_IPaddr[$i] =~ /Unspecified/)
{
if($DB){print "PHONE IP UNSPECIFIED, DOING NOTHING FOR THIS EXTENSION\n";}
}
else
{
$stmtA = "UPDATE phones set phone_ip='$NEW_IPaddr[$i]' where server_ip='$server_ip' and extension='$PTextensions[$i]';";
$affected_rows = $dbhA->do($stmtA); # or die "Couldn't execute query:|$stmtA|\n";
if($DB){print STDERR "\n|$affected_rows|$stmtA|\n";}
}
}
if ($agent_lookup > 0)
{
$stmtA = "UPDATE vicidial_user_log set phone_ip='$NEW_IPaddr[$i]' where server_phone='$PTlogins[$i]' and server_ip='$server_ip' and phone_ip='LOOKUP' and event_date > \"$BDtsSQLdate\" and extension LIKE \"IAX%\";";
$affected_rows = $dbhA->do($stmtA); # or die "Couldn't execute query:|$stmtA|\n";
if($DB){print STDERR "\n|$affected_rows|$stmtA|\n";}
}
}
$i++;
$i++;
### sleep for 10 hundredths of a second
usleep(1*100*1000);
}
$t->buffer_empty;
@hangup = $t->cmd(String => "Action: Logoff\n\n", Prompt => "/.*/");
$t->buffer_empty;
$t->waitfor(Match => '/Message:.*\n\n/', Timeout => 10);
$ok = $t->close;
}
$t->buffer_empty;
@hangup = $t->cmd(String => "Action: Logoff\n\n", Prompt => "/.*/");
$t->buffer_empty;
$t->waitfor(Match => '/Message:.*\n\n/', Timeout => 10);
$ok = $t->close;
############# END IAX2 SECTION ################################################
@@ -320,6 +412,3 @@ if($DB){print "DONE... Exiting...\n";}
exit;
agc_2-X/trunk/docs/BASE_INSTALL.txt
+3
View File
@@ -451,6 +451,9 @@ PHASE 6: ADDING CRONTAB ENTRIES FOR ASTGUICLIENT/VICIDIAL SCRIPTS
## uncomment below if using QueueMetrics
#*/5 * * * * /usr/share/astguiclient/AST_cleanup_agent_log.pl --only-qm-live-call-check
## uncomment below if you want to log agent phone_ip
#*/5 * * * * /usr/share/astguiclient/AST_phone_update.pl --agent-lookup
# cleanup of the scheduled callback records
25 0 * * * /usr/share/astguiclient/AST_DB_dead_cb_purge.pl --purge-non-cb --quiet
# removal of duplicate scheduled callback records
agc_2-X/trunk/docs/NON-AGENT_API.txt
+5 -6
View File
@@ -1,4 +1,4 @@
NON-AGENT API DOCUMENT Started: 2008-07-24 Updated: 2013-06-14
NON-AGENT API DOCUMENT Started: 2008-07-24 Updated: 2013-06-17
This document describes the functions of an API(Application Programming
Interface) for all functions NOT directly relating to the VICIDIAL Agent screen.
@@ -83,6 +83,7 @@ Changes:
130405-1538 - Added agent_status function
130420-1938 - Added NANPA prefix validation and timezone options
130614-0907 - Added pause code to output of agent_status function
130617-2232 - Added real-time sub-statuses to output of agent_status function
API Functions use the 'function' variable
@@ -410,9 +411,6 @@ SETTINGS FIELDS-
stage - the format of the exported data: csv, tab, pipe(default)
header - include a header(YES) or not(NO). This is optional, default is not to include a header
NOTES-
There is a hard limit of 10000000 records analyzed
Example URL strings for API calls:
http://server/vicidial/non_agent_api.php?source=test&user=6666&pass=1234&function=agent_status&agent_user=1234&stage=csv&header=YES
@@ -423,9 +421,10 @@ ERROR: agent_status AGENT NOT FOUND - 6666||
ERROR: agent_status AGENT NOT LOGGED IN - 6666||
A SUCCESS response will not show "SUCCESS", but instead will just print the results in the following format:
status,call_id,lead_id,campaign_id,calls_today,full_name,user_group,user_level,pause_code
INCALL,M4050908070000012345,12345,TESTCAMP,1,Test Agent,AGENTS,3,LOGIN
status,call_id,lead_id,campaign_id,calls_today,full_name,user_group,user_level,pause_code,real_time_sub_status
INCALL,M4050908070000012345,12345,TESTCAMP,1,Test Agent,AGENTS,3,LOGIN,
NOTE: real_time_sub_status field can consist of: DEAD, DISPO, 3-WAY, PARK, RING or it can be empty
agc_2-X/trunk/docs/SCRATCH_INSTALL.txt
+3
View File
@@ -2447,6 +2447,9 @@ SUBPHASE 6.5: setting up astguiclient scripts for continuous running
## uncomment below if using QueueMetrics
#*/5 * * * * /usr/share/astguiclient/AST_cleanup_agent_log.pl --only-qm-live-call-check
## uncomment below if you want to log agent phone_ip
#*/5 * * * * /usr/share/astguiclient/AST_phone_update.pl --agent-lookup
# cleanup of the scheduled callback records
25 0 * * * /usr/share/astguiclient/AST_DB_dead_cb_purge.pl --purge-non-cb --quiet
# removal of duplicate scheduled callback records
agc_2-X/trunk/extras/MySQL_AST_CREATE_tables.sql
+155 -148
View File
File diff suppressed because it is too large Load Diff
agc_2-X/trunk/extras/upgrade_2.8.sql
+12
View File
@@ -12,3 +12,15 @@ ALTER TABLE vicidial_users ADD pass_hash VARCHAR(100) default '';
ALTER TABLE system_settings ADD pass_hash_enabled ENUM('0','1') default '0';
UPDATE system_settings SET db_schema_version='1351',db_schema_update_date=NOW() where db_schema_version < 1351;
ALTER TABLE vicidial_user_log ADD phone_login VARCHAR(15) default '';
ALTER TABLE vicidial_user_log ADD server_phone VARCHAR(15) default '';
ALTER TABLE vicidial_user_log ADD phone_ip VARCHAR(15) default '';
ALTER TABLE system_settings ADD pass_key VARCHAR(100) default '';
ALTER TABLE system_settings ADD pass_cost TINYINT(2) UNSIGNED default '2';
CREATE INDEX phone_ip ON vicidial_user_log (phone_ip);
CREATE INDEX vuled ON vicidial_user_log (event_date);
UPDATE system_settings SET db_schema_version='1352',db_schema_update_date=NOW() where db_schema_version < 1352;
agc_2-X/trunk/www/agc/functions.php
+25
View File
@@ -24,10 +24,29 @@ function user_authorization($user,$pass,$user_option,$user_update)
{
require("dbconnect.php");
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,webroot_writable,pass_hash_enabled,pass_key,pass_cost FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$SSwebroot_writable = $row[1];
$SSpass_hash_enabled = $row[2];
$SSpass_key = $row[3];
$SSpass_cost = $row[4];
}
##### END SETTINGS LOOKUP #####
###########################################
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
$LOCK_over = ($STARTtime - 900); # failed login lockout time is 15 minutes(900 seconds)
$LOCK_trigger_attempts = 10;
@@ -76,6 +95,12 @@ function user_authorization($user,$pass,$user_option,$user_update)
{$auth_key='LOCK';}
}
}
if ($SSwebroot_writable > 0)
{
$fp = fopen ("./project_auth_entries.txt", "a");
fwrite ($fp, "AGENT|FAIL|$NOW_TIME|$user|$auth_key|$ip|$browser|\n");
fclose($fp);
}
}
else
{
agc_2-X/trunk/www/agc/vicidial.php
+5 -4
View File
@@ -404,10 +404,11 @@
# 130508-2307 - Branched 2.7, trunk becomes 2.8
# 130603-2209 - Added login lockout for 15 minutes after 10 failed logins, and other security fixes
# 130615-1125 - Added recording_id to dispo url
# 130625-0841 - Added more user log data on login
#
$version = '2.8-373c';
$build = '130615-1125';
$version = '2.8-374c';
$build = '130625-0841';
$mel=1; # Mysql Error Log enabled = 1
$mysql_log_count=79;
$one_mysql_log=0;
@@ -2516,7 +2517,7 @@ else
### insert an entry into the user log for the login event
$vul_data = "$vlERIaffected_rows|$vhICaffected_rows|$vlaLIaffected_rows|$vliaLIaffected_rows";
$stmt = "INSERT INTO vicidial_user_log (user,event,campaign_id,event_date,event_epoch,user_group,session_id,server_ip,extension,computer_ip,browser,data) values('$VD_login','LOGIN','$VD_campaign','$NOW_TIME','$StarTtimE','$VU_user_group','$session_id','$server_ip','$protocol/$extension','$ip','$browser','$vul_data')";
$stmt = "INSERT INTO vicidial_user_log (user,event,campaign_id,event_date,event_epoch,user_group,session_id,server_ip,extension,computer_ip,browser,data,phone_login,server_phone,phone_ip) values('$VD_login','LOGIN','$VD_campaign','$NOW_TIME','$StarTtimE','$VU_user_group','$session_id','$server_ip','$protocol/$extension','$ip','$browser','$vul_data','$original_phone_login','$phone_login','LOOKUP');";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'01031',$VD_login,$server_ip,$session_name,$one_mysql_log);}
@@ -14594,7 +14595,7 @@ $zi=2;
if ($label_comments == '---HIDE---')
{
echo " </td><td align=\"left\" colspan=5><input type=\"hidden\" name=\"comments\" id=\"comments\" value=\"\" />\n";
echo " </td><td align=\"left\" colspan=5><input type=\"hidden\" name=\"comments\" id=\"comments\" value=\"\" /><span id='viewcommentsdisplay'><input type='button' id='ViewCommentButton' onClick=\"ViewComments('ON')\" value='-History-'/></span>\n";
}
else
{
agc_2-X/trunk/www/vicidial/AST_CLOSER_service_level.php
+62 -23
View File
@@ -22,11 +22,13 @@
# 120224-0910 - Added HTML display option with bar graphs
# 130414-0104 - Added report logging
# 130610-1024 - Finalized changing of all ereg instances to preg
# 130621-0806 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -48,9 +50,6 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
if (strlen($shift)<2) {$shift='ALL';}
$report_name = 'Inbound Service Level Report';
@@ -73,25 +72,65 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -123,7 +162,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -140,7 +179,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php
+61 -23
View File
@@ -38,6 +38,7 @@
# 130124-1719 - Added email report support
# 130414-1429 - Added report logging
# 130610-1023 - Finalized changing of all ereg instances to preg
# 130621-0805 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -71,9 +72,6 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$MT[0]='0';
if (strlen($shift)<2) {$shift='ALL';}
@@ -112,28 +110,68 @@ if ($gmt_conf_ct > 0)
$epoch_offset = (($local_gmt + $dst) * 3600);
}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -150,7 +188,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_CLOSERsummary_hourly.php
+61 -23
View File
@@ -17,6 +17,7 @@
# 120224-0910 - Added HTML display option with bar graphs
# 130414-0107 - Added report logging
# 130610-1022 - Finalized changing of all ereg instances to preg
# 130621-0801 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -59,9 +60,6 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$MT[0]='0';
if (strlen($shift)<2) {$shift='ALL';}
if (strlen($exclude_rollover)<2) {$exclude_rollover='NO';}
@@ -98,25 +96,65 @@ if ($gmt_conf_ct > 0)
$epoch_offset = (($local_gmt + $dst) * 3600);
}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -148,7 +186,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -165,7 +203,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_DIDstats.php
+62 -23
View File
@@ -17,6 +17,7 @@
# 120224-0910 - Added HTML display option with bar graphs
# 130414-0113 - Added report logging
# 130610-1017 - Finalized changing of all ereg instances to preg
# 130621-0758 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -46,9 +47,6 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];}
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
if (strlen($shift)<2) {$shift='ALL';}
$report_name = 'Inbound DID Report';
@@ -71,28 +69,69 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -109,7 +148,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php
+60 -15
View File
@@ -11,6 +11,7 @@
# 90914-1003 - First build
# 130414-0214 - Added report logging
# 130610-1016 - Finalized changing of all ereg instances to preg
# 130621-0751 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -34,9 +35,6 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
if (strlen($shift)<2) {$shift='ALL';}
#############################################
@@ -53,20 +51,67 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 6 and view_reports='1';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
$LOGip = getenv("REMOTE_ADDR");
agc_2-X/trunk/www/vicidial/AST_IVRfilter.php
+66 -19
View File
@@ -11,6 +11,7 @@
# 120113-2022 - Added new columns for sent to queue and agent
# 130414-0257 - Added report logging
# 130610-1007 - Finalized changing of all ereg instances to preg
# 130621-0741 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -18,6 +19,7 @@ $startMS = microtime();
$report_name='IVR Filter Report';
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -49,18 +51,18 @@ if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];}
elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];}
if ($hourly_breakdown) {
if ($hourly_breakdown)
{
$date_int=3600;
$substr_place=13;
$checked="checked";
} else {
}
else
{
$date_int=86400;
$substr_place=10;
$checked="";
}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
@@ -78,20 +80,65 @@ while ($i < $qm_conf_ct)
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1';";
if ($DB) {$HTML_header.="|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
agc_2-X/trunk/www/vicidial/AST_IVRstats.php
+62 -23
View File
@@ -22,11 +22,13 @@
# 120224-0910 - Added HTML display option with bar graphs
# 130114-0115 - Added report logging
# 130610-1004 - Finalized changing of all ereg instances to preg
# 130621-0738 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -52,9 +54,6 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
if (strlen($shift)<2) {$shift='ALL';}
if (strlen($type)<2) {$type='inbound';}
@@ -83,25 +82,65 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -133,7 +172,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -180,7 +219,7 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen(
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php
+371
View File
@@ -0,0 +1,371 @@
<?php
# AST_LAGGED_log_report.php
#
# Copyright (C) 2013 Joe Johnson, Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# CHANGES
# 130622-1026 - First build
#
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
$report_name='LAGGED Agent Log Report';
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["query_date"])) {$query_date=$_GET["query_date"];}
elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];}
if (isset($_GET["query_date_D"])) {$query_date_D=$_GET["query_date_D"];}
elseif (isset($_POST["query_date_D"])) {$query_date_D=$_POST["query_date_D"];}
if (isset($_GET["query_date_T"])) {$query_date_T=$_GET["query_date_T"];}
elseif (isset($_POST["query_date_T"])) {$query_date_T=$_POST["query_date_T"];}
if (isset($_GET["url_type"])) {$url_type=$_GET["url_type"];}
elseif (isset($_POST["url_type"])) {$url_type=$_POST["url_type"];}
if (isset($_GET["response_sec"])) {$response_sec=$_GET["response_sec"];}
elseif (isset($_POST["response_sec"])) {$response_sec=$_POST["response_sec"];}
if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];}
elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];}
if (isset($_GET["lower_limit"])) {$lower_limit=$_GET["lower_limit"];}
elseif (isset($_POST["lower_limit"])) {$lower_limit=$_POST["lower_limit"];}
if (isset($_GET["upper_limit"])) {$upper_limit=$_GET["upper_limit"];}
elseif (isset($_POST["upper_limit"])) {$upper_limit=$_POST["upper_limit"];}
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];}
$NOW_DATE = date("Y-m-d");
if (strlen($query_date_D) < 6) {$query_date_D = "00:00:00";}
if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";}
if (!isset($query_date)) {$query_date = $NOW_DATE;}
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {$MAIN.="$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$outbound_autodial_active = $row[1];
$slave_db_server = $row[2];
$reports_use_slave_db = $row[3];
}
##### END SETTINGS LOOKUP #####
###########################################
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
$LOGip = getenv("REMOTE_ADDR");
$LOGbrowser = getenv("HTTP_USER_AGENT");
$LOGscript_name = getenv("SCRIPT_NAME");
$LOGserver_name = getenv("SERVER_NAME");
$LOGserver_port = getenv("SERVER_PORT");
$LOGrequest_uri = getenv("REQUEST_URI");
$LOGhttp_referer = getenv("HTTP_REFERER");
if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
else {$HTTPprotocol = 'http://';}
if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
else {$LOGserver_port = ":$LOGserver_port";}
$LOGfull_url = "$HTTPprotocol$LOGserver_name$LOGserver_port$LOGrequest_uri";
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $lower_limit, $upper_limit, $file_download|', url='$LOGfull_url';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$report_log_id = mysql_insert_id($link);
##### END log visit to the vicidial_report_log table #####
if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) )
{
mysql_close($link);
$use_slave_server=1;
$db_source = 'S';
require("dbconnect.php");
$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$HEADER.="<HTML>\n";
$HEADER.="<HEAD>\n";
$HEADER.="<STYLE type=\"text/css\">\n";
$HEADER.="<!--\n";
$HEADER.=" .green {color: white; background-color: green}\n";
$HEADER.=" .red {color: white; background-color: red}\n";
$HEADER.=" .blue {color: white; background-color: blue}\n";
$HEADER.=" .purple {color: white; background-color: purple}\n";
$HEADER.=" .small_standard { font-family: Arial, Helvetica, sans-serif; font-size: 8pt}\n";
$HEADER.=" .small_standard_bold { font-family: Arial, Helvetica, sans-serif; font-size: 8pt; font-weight: bold}\n";
$HEADER.="-->\n";
$HEADER.=" </STYLE>\n";
$HEADER.="<script language=\"JavaScript\" src=\"calendar_db.js\"></script>\n";
$HEADER.="<link rel=\"stylesheet\" href=\"calendar.css\">\n";
$HEADER.="<link rel=\"stylesheet\" href=\"horizontalbargraph.css\">\n";
$HEADER.="<link rel=\"stylesheet\" href=\"verticalbargraph.css\">\n";
$HEADER.="<script language=\"JavaScript\" src=\"wz_jsgraphics.js\"></script>\n";
$HEADER.="<script language=\"JavaScript\" src=\"line.js\"></script>\n";
$HEADER.="<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n";
$HEADER.="<TITLE>$report_name</TITLE></HEAD><BODY BGCOLOR=WHITE marginheight=0 marginwidth=0 leftmargin=0 topmargin=0>\n";
$short_header=1;
$MAIN.="<TABLE CELLPADDING=4 CELLSPACING=0><TR><TD>";
$MAIN.="<FORM ACTION=\"$PHP_SELF\" METHOD=GET name=vicidial_report id=vicidial_report>\n";
$MAIN.="<TABLE BORDER=0 cellspacing=5 cellpadding=5><TR><TD VALIGN=TOP align=center>\n";
$MAIN.="<INPUT TYPE=HIDDEN NAME=DB VALUE=\"$DB\">\n";
$MAIN.="Date:\n";
$MAIN.="<INPUT TYPE=TEXT NAME=query_date SIZE=10 MAXLENGTH=10 VALUE=\"$query_date\">";
$MAIN.="<script language=\"JavaScript\">\n";
$MAIN.="var o_cal = new tcal ({\n";
$MAIN.=" // form name\n";
$MAIN.=" 'formname': 'vicidial_report',\n";
$MAIN.=" // input name\n";
$MAIN.=" 'controlname': 'query_date'\n";
$MAIN.="});\n";
$MAIN.="o_cal.a_tpl.yearscroll = false;\n";
$MAIN.="// o_cal.a_tpl.weekstart = 1; // Monday week start\n";
$MAIN.="</script></tD>\n";
$MAIN.="<TD VALIGN=TOP align=center><INPUT TYPE=TEXT NAME=query_date_D SIZE=9 MAXLENGTH=8 VALUE=\"$query_date_D\">";
$MAIN.=" to <INPUT TYPE=TEXT NAME=query_date_T SIZE=9 MAXLENGTH=8 VALUE=\"$query_date_T\">";
$MAIN.="</TD><TD VALIGN=middle align=center>\n";
$MAIN.="Display as:";
$MAIN.="<select name='report_display_type'>";
if ($report_display_type) {$MAIN.="<option value='$report_display_type' selected>$report_display_type</option>";}
$MAIN.="<option value='TEXT'>TEXT</option><option value='HTML'>HTML</option></select></TD>";
$MAIN.="<TD VALIGN=TOP align=center><INPUT TYPE=submit NAME=SUBMIT VALUE=SUBMIT>\n";
$MAIN.="</TD></TR></TABLE>\n";
if ($SUBMIT && $query_date) {
$stmt="select server_ip, count(*) as ct From vicidial_agent_log where event_time>='$query_date $query_date_D' and event_time<='$query_date $query_date_T' and sub_status='LAGGED' group by server_ip order by server_ip";
$rslt=mysql_query($stmt, $link);
$ASCII_text="<PRE><font size=2>\n";
$HTML_text="";
if ($DB) {$ASCII_text.=$stmt."\n";}
if (mysql_num_rows($rslt)>0) {
$ASCII_text.="--- SERVER IP BREAKDOWN FOR LAGGED RECORDS $query_date, $query_date_D TO $query_date_T \n";
$ASCII_text.="+-----------------+---------+\n";
$ASCII_text.="| SERVER IP | COUNT |\n";
$ASCII_text.="+-----------------+---------+\n";
$HTML_text.="<table border='0' cellpadding='0' cellspacing='2' width='350'>";
$HTML_text.="<TR><TH colspan='2' class='small_standard_bold grey_graph_cell'>SERVER IP BREAKDOWN FOR LAGGED RECORDS $query_date, $query_date_D TO $query_date_T</TH></TR>";
$HTML_text.="<TR><TH class='small_standard_bold grey_graph_cell'>SERVER IP</th><TH class='small_standard_bold grey_graph_cell'>COUNT</th></tr>";
$total_count=0;
while ($row=mysql_fetch_array($rslt)) {
$ASCII_text.="| ".sprintf("%-16s", $row["server_ip"]);
$ASCII_text.="| ".sprintf("%-8s", $row["ct"]);
$ASCII_text.="|\n";
$HTML_text.="<TR><TD class='small_standard'>$row[server_ip]</td><TD class='small_standard'>$row[ct]</td></tr>";
$total_count+=$row["ct"];
}
$ASCII_text.="+-----------------+---------+\n";
$ASCII_text.="| TOTAL | ".sprintf("%-8s", $total_count)."|\n";
$ASCII_text.="+-----------------+---------+\n\n\n";
$HTML_text.="<TR><TH class='small_standard_bold grey_graph_cell'>TOTAL</th><TH class='small_standard_bold grey_graph_cell'>$total_count</th></tr></table>";
$rpt_stmt="select * from vicidial_agent_log where sub_status='LAGGED' and event_time>='$query_date $query_date_D' and event_time<='$query_date $query_date_T' $url_type_SQL order by user, event_time asc";
$rpt_rslt=mysql_query($rpt_stmt, $link);
if ($DB) {$ASCII_text.=$rpt_stmt."\n";}
if (!$lower_limit) {$lower_limit=1;}
if ($lower_limit+999>=mysql_num_rows($rpt_rslt)) {$upper_limit=($lower_limit+mysql_num_rows($rpt_rslt)%1000)-1;} else {$upper_limit=$lower_limit+999;}
$ASCII_text.="--- LAGGED LOG RECORDS FOR $query_date, $query_date_D TO $query_date_T $server_rpt_string, RECORDS #$lower_limit-$upper_limit <a href=\"$PHP_SELF?SUBMIT=$SUBMIT&DB=$DB&type=$type&query_date=$query_date&query_date_D=$query_date_D&query_date_T=$query_date_T$url_typeQS&lower_limit=$lower_limit&upper_limit=$upper_limit&file_download=1\">[DOWNLOAD]</a>\n";
$lagged_rpt.="+--------------+------------+-----------------+---------------------+-----------+----------+--------+----------------------+----------------------+----------------------+\n";
$lagged_rpt.="| AGENT LOG ID | USER | SERVER IP | EVENT TIME | LEAD ID | CAMPAIGN | STATUS | USER GROUP | COMMENTS | UNIQUE ID |\n";
$lagged_rpt.="+--------------+------------+-----------------+---------------------+-----------+----------+--------+----------------------+----------------------+----------------------+\n";
$HTML_text.="<BR><BR><table border='0' cellpadding='0' cellspacing='2' width='1000'>";
$HTML_rpt.="<TR><TH colspan='9' class='small_standard_bold grey_graph_cell'>LAGGED LOG RECORDS FOR $query_date, $query_date_D TO $query_date_T $server_rpt_string, RECORDS #$lower_limit-$upper_limit</TH><TD align='right' class='small_standard_bold grey_graph_cell'><a href=\"$PHP_SELF?SUBMIT=$SUBMIT&DB=$DB&type=$type&query_date=$query_date&query_date_D=$query_date_D&query_date_T=$query_date_T$url_typeQS&lower_limit=$lower_limit&upper_limit=$upper_limit&file_download=1\">[DOWNLOAD]</a></td></TR>";
$HTML_rpt.="<TR><TH class='small_standard_bold grey_graph_cell' width='90'>AGENT LOG ID</TH><TH class='small_standard_bold grey_graph_cell' width='80'>USER</TH><TH class='small_standard_bold grey_graph_cell' width='120'>SERVER IP</TH><TH class='small_standard_bold grey_graph_cell' width='100'>EVENT TIME</TH><TH class='small_standard_bold grey_graph_cell' width='80'>LEAD ID</TH><TH class='small_standard_bold grey_graph_cell' width='80'>CAMPAIGN</TH><TH class='small_standard_bold grey_graph_cell' width='60'>STATUS</TH><TH class='small_standard_bold grey_graph_cell' width='80'>USER GROUP</TH><TH class='small_standard_bold grey_graph_cell' width='160'>COMMENTS</TH><TH class='small_standard_bold grey_graph_cell' width='120'>UNIQUE ID</TH></TR>";
$CSV_text="\"AGENT LOG ID\",\"USER\",\"SERVER IP\",\"EVENT TIME\",\"LEAD ID\",\"CAMPAIGN\",\"STATUS\",\"USER GROUP\",\"COMMENTS\",\"UNIQUE ID\"\n";
for ($i=1; $i<=mysql_num_rows($rpt_rslt); $i++) {
$row=mysql_fetch_array($rpt_rslt);
$CSV_text.="\"$row[agent_log_id]\",\"$row[user]\",\"$row[server_ip]\",\"$row[event_time]\",\"$row[lead_id]\",\"$row[campaign_id]\",\"$row[status]\",\"$row[user_group]\",\"$row[comments]\",\"$row[uniqueid]\"\n";
if ($i>=$lower_limit && $i<=$upper_limit) {
if ($i%2==0) {$color_class="grey_graph_cell";} else {$color_class='white_graph_cell';}
$HTML_rpt.="<TR valign='top'><td class='small_standard_bold $color_class' width='90'>$row[agent_log_id]</td><td class='small_standard_bold $color_class' width='80'>$row[user]</td><td class='small_standard_bold $color_class' width='120'>$row[server_ip]</td><td class='small_standard_bold $color_class' width='100'>$row[event_time]</td><td class='small_standard_bold $color_class' width='80'>$row[lead_id]</td><td class='small_standard_bold $color_class' width='80'>$row[campaign_id]</td><td class='small_standard_bold $color_class' width='60'>$row[status]</td><td class='small_standard_bold $color_class' width='80'>$row[user_group]</td><td class='small_standard_bold $color_class' width='160'>$row[comments]</td><td class='small_standard_bold $color_class' width='120'>$row[uniqueid]</td></TR>";
$lagged_rpt.="| ".sprintf("%-13s", $row["agent_log_id"]);
$lagged_rpt.="| ".sprintf("%-11s", $row["user"]);
$lagged_rpt.="| ".sprintf("%-16s", $row["server_ip"]);
$lagged_rpt.="| ".sprintf("%-20s", $row["event_time"]);
$lagged_rpt.="| ".sprintf("%-10s", $row["lead_id"]);
$lagged_rpt.="| ".sprintf("%-9s", $row["campaign_id"]);
$lagged_rpt.="| ".sprintf("%-7s", $row["status"]);
$lagged_rpt.="| ".sprintf("%-21s", $row["user_group"]);
$lagged_rpt.="| ".sprintf("%-21s", $row["comments"]);
$lagged_rpt.="| ".sprintf("%-21s", $row["uniqueid"]);
$lagged_rpt.="|\n";
}
}
$lagged_rpt.="+--------------+------------+-----------------+---------------------+-----------+----------+--------+----------------------+----------------------+----------------------+\n";
$lagged_rpt_hf="";
$HTML_rpt_hf="<TR>";
$ll=$lower_limit-1000;
if ($ll<1 || ($lower_limit+1000)>=mysql_num_rows($rpt_rslt)) {$HTML_colspan=6;} else {$HTML_colspan=3;}
if ($ll>=1) {
$lagged_rpt_hf.="<a href=\"$PHP_SELF?SUBMIT=$SUBMIT&DB=$DB&report_display_type=$report_display_type&type=$type&query_date=$query_date&query_date_D=$query_date_D&query_date_T=$query_date_T$url_typeQS&lower_limit=$ll\">[<<< PREV 1000 records]</a>";
$HTML_rpt_hf.="<Td colspan='$HTML_colspan' class='small_standard_bold grey_graph_cell' align='left'><a href=\"$PHP_SELF?SUBMIT=$SUBMIT&DB=$DB&report_display_type=$report_display_type&type=$type&query_date=$query_date&query_date_D=$query_date_D&query_date_T=$query_date_T$url_typeQS&lower_limit=$ll\">[<<< PREV 1000 records]</a></TH>";
} else {
$lagged_rpt_hf.=sprintf("%-23s", " ");
}
$lagged_rpt_hf.=sprintf("%-145s", " ");
if (($lower_limit+1000)<mysql_num_rows($rpt_rslt)) {
if ($upper_limit+1000>=mysql_num_rows($rpt_rslt)) {$max_limit=mysql_num_rows($rpt_rslt)-$upper_limit;} else {$max_limit=1000;}
$lagged_rpt_hf.="<a href=\"$PHP_SELF?SUBMIT=$SUBMIT&DB=$DB&report_display_type=$report_display_type&type=$type&query_date=$query_date&query_date_D=$query_date_D&query_date_T=$query_date_T$url_typeQS&lower_limit=".($lower_limit+1000)."\">[NEXT $max_limit records >>>]</a>";
$HTML_rpt_hf.="<Td colspan='$HTML_colspan' class='small_standard_bold grey_graph_cell' align='right'><a href=\"$PHP_SELF?SUBMIT=$SUBMIT&DB=$DB&report_display_type=$report_display_type&type=$type&query_date=$query_date&query_date_D=$query_date_D&query_date_T=$query_date_T$url_typeQS&lower_limit=".($lower_limit+1000)."\">[NEXT $max_limit records >>>]</a></TH>";
} else {
$lagged_rpt_hf.=sprintf("%23s", " ");
}
$HTML_rpt_hf.="</TR>";
$lagged_rpt_hf.="\n";
$ASCII_text.=$lagged_rpt_hf.$lagged_rpt.$lagged_rpt_hf;
$HTML_text.=$HTML_rpt_hf.$HTML_rpt.$HTML_rpt_hf."</table>";
} else {
$MAIN.="*** NO RECORDS FOUND ***\n";
}
$ASCII_text.="</font></PRE>\n";
if ($report_display_type=="HTML")
{
$MAIN.=$HTML_text;
}
else
{
$MAIN.=$ASCII_text;
}
$MAIN.="</form></BODY></HTML>\n";
}
if ($file_download>0) {
$FILE_TIME = date("Ymd-His");
$CSVfilename = "AST_url_log_report_$US$FILE_TIME.csv";
$CSV_text=preg_replace('/ +\"/', '"', $CSV_text);
$CSV_text=preg_replace('/\" +/', '"', $CSV_text);
// We'll be outputting a TXT file
header('Content-type: application/octet-stream');
// It will be called LIST_101_20090209-121212.txt
header("Content-Disposition: attachment; filename=\"$CSVfilename\"");
header('Expires: 0');
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Pragma: public');
ob_clean();
flush();
echo "$CSV_text";
exit;
} else {
echo $HEADER;
require("admin_header.php");
echo $MAIN;
}
if ($db_source == 'S')
{
mysql_close($link);
$use_slave_server=0;
$db_source = 'M';
require("dbconnect.php");
}
$endMS = microtime();
$startMSary = explode(" ",$startMS);
$endMSary = explode(" ",$endMS);
$runS = ($endMSary[0] - $startMSary[0]);
$runM = ($endMSary[1] - $startMSary[1]);
$TOTALrun = ($runS + $runM);
$stmt="UPDATE vicidial_report_log set run_time='$TOTALrun' where report_log_id='$report_log_id';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
exit;
?>
agc_2-X/trunk/www/vicidial/AST_LISTS_campaign_stats.php
+62 -23
View File
@@ -15,6 +15,7 @@
# 130414-0127 - Added report logging
# 130424-2039 - Added lines for new status categories of scheduled callbacks and completed
# 130610-1001 - Finalized changing of all ereg instances to preg
# 130621-0735 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -40,9 +41,6 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$report_name = 'Lists Campaign Statuses Report';
$db_source = 'M';
$JS_text="<script language='Javascript'>\n";
@@ -65,26 +63,67 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
$LOGip = getenv("REMOTE_ADDR");
@@ -115,7 +154,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -130,7 +169,7 @@ $LOGallowed_reports = $row[1];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_LIST_UPDATEstats.php
+61 -23
View File
@@ -12,6 +12,7 @@
# 100914-1326 - Added lookup for user_level 7 users to set to reports only which will remove other admin links
# 130414-0201 - Added report logging
# 130610-1003 - Finalized changing of all ereg instances to preg
# 130621-0737 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -33,9 +34,6 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
if (strlen($shift)<2) {$shift='ALL';}
$report_name = 'List Update Stats';
@@ -58,25 +56,65 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if ( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -108,7 +146,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
echo "<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -123,7 +161,7 @@ $LOGallowed_reports = $row[1];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_OUTBOUNDsummary_interval.php
+62 -19
View File
@@ -17,6 +17,7 @@
# 120224-0910 - Added HTML display option with bar graphs
# 130414-0119 - Added report logging
# 130610-1000 - Finalized changing of all ereg instances to preg
# 130621-0730 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -57,9 +58,6 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$MT[0]='0';
if (strlen($shift)<2) {$shift='ALL';}
if (strlen($include_rollover)<2) {$include_rollover='NO';}
@@ -98,8 +96,68 @@ if ($gmt_conf_ct > 0)
$epoch_offset = (($local_gmt + $dst) * 3600);
}
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$stmt="SELECT full_name,user_level,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';";
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT full_name,user_level,user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$MAIN.="|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
@@ -110,21 +168,6 @@ if ($records_to_print > 0)
$full_name = $row[0];
$user_level = $row[1];
$user_group = $row[2];
$auth++;
}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
agc_2-X/trunk/www/vicidial/AST_VDADstats.php
+62 -23
View File
@@ -34,6 +34,7 @@
# 120224-0910 - Added HTML display option with bar graphs
# 130414-0117 - Added report logging
# 130610-0956 - Finalized changing of all ereg instances to preg
# 130620-2227 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -77,9 +78,6 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
if (strlen($shift)<2) {$shift='ALL';}
if (strlen($bottom_graph)<2) {$bottom_graph='NO';}
if (strlen($carrier_stats)<2) {$carrier_stats='NO';}
@@ -118,25 +116,66 @@ if ($srv_conf_ct > 0)
$carrier_logging_active = $row[0];
}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$group = preg_replace("/'|\"|\\\\|;/","",$group);
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -168,7 +207,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
echo "<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -183,7 +222,7 @@ $LOGallowed_reports = $row[1];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_VICIDIAL_hopperlist.php
+85 -11
View File
@@ -18,6 +18,7 @@
# 120221-0059 - Added User Group restriction settings
# 130414-0159 - Added report logging
# 130610-0955 - Finalized changing of all ereg instances to preg
# 130620-2222 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -25,6 +26,7 @@ $startMS = microtime();
$report_name='Hopper List Report';
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -38,21 +40,93 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
}
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and modify_campaigns='1';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$group = preg_replace("/'|\"|\\\\|;/","",$group);
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT modify_campaigns,user_group from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$LOGmodify_campaigns = $row[0];
$LOGuser_group = $row[1];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($LOGmodify_campaigns < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
Header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions for campaign modification: |$PHP_AUTH_USER|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -75,7 +149,7 @@ $rslt=mysql_query($stmt, $link);
$report_log_id = mysql_insert_id($link);
##### END log visit to the vicidial_report_log table #####
$stmt="SELECT full_name,user_group,admin_hide_lead_data,admin_hide_phone_data from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$stmt="SELECT full_name,user_group,admin_hide_lead_data,admin_hide_phone_data from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
agc_2-X/trunk/www/vicidial/AST_VICIDIAL_ingrouplist.php
+74 -13
View File
@@ -9,6 +9,7 @@
# 100320-2102 - First Build
# 130414-0222 - Added report logging
# 130610-0954 - Finalized changing of all ereg instances to preg
# 130620-2217 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -16,6 +17,7 @@ $startMS = microtime();
$report_name='In-Group User List';
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -29,21 +31,80 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
if ($DB) {echo "|$stmt|\n";}
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin FROM system_settings;";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
}
##### END SETTINGS LOOKUP #####
###########################################
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$group = preg_replace("/'|\"|\\\\|;/","",$group);
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
agc_2-X/trunk/www/vicidial/AST_admin_report.php
+1
View File
@@ -0,0 +1 @@
this file has been removed
agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php
+86 -82
View File
@@ -1,5 +1,5 @@
<?php
# AST_admin_template_maker.php - version 2.4
# AST_admin_template_maker.php - version 2.8
#
# Copyright (C) 2013 Matt Florell,Joe Johnson <vicidial@gmail.com> LICENSE: AGPLv2
#
@@ -8,14 +8,16 @@
# 120529-1427 - Filename filter fix
# 130514-2127 - Bug fix on Chrome/IE browsers
# 130610-1102 - Finalized changing of all ereg instances to preg
# 130619-2044 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
if (isset($_GET["standard_fields_layout"])) {$standard_fields_layout=$_GET["standard_fields_layout"];}
elseif (isset($_POST["standard_fields_layout"])) {$standard_fields_layout=$_POST["standard_fields_layout"];}
elseif (isset($_POST["standard_fields_layout"])) {$standard_fields_layout=$_POST["standard_fields_layout"];}
if (isset($_GET["custom_fields_layout"])) {$custom_fields_layout=$_GET["custom_fields_layout"];}
elseif (isset($_POST["custom_fields_layout"])) {$custom_fields_layout=$_POST["custom_fields_layout"];}
if (isset($_GET["template_id"])) {$template_id=$_GET["template_id"];}
@@ -31,7 +33,7 @@ if (isset($_GET["file_delimiter"])) {$file_delimiter=$_GET["file_delimiter"];
if (isset($_GET["template_list_id"])) {$template_list_id=$_GET["template_list_id"];}
elseif (isset($_POST["template_list_id"])) {$template_list_id=$_POST["template_list_id"];}
if (isset($_GET["standard_fields_layout"])) {$standard_fields_layout=$_GET["standard_fields_layout"];}
elseif (isset($_POST["standard_fields_layout"])) {$standard_fields_layout=$_POST["standard_fields_layout"];}
elseif (isset($_POST["standard_fields_layout"])) {$standard_fields_layout=$_POST["standard_fields_layout"];}
if (isset($_GET["custom_fields_layout"])) {$custom_fields_layout=$_GET["custom_fields_layout"];}
elseif (isset($_POST["custom_fields_layout"])) {$custom_fields_layout=$_POST["custom_fields_layout"];}
if (isset($_GET["submit_template"])) {$submit_template=$_GET["submit_template"];}
@@ -46,22 +48,6 @@ $PHP_SELF=$_SERVER['PHP_SELF'];
#$vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|';
$vicidial_listloader_fields = '|vendor_lead_code|source_id|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|rank|owner|';
if ($submit_template=="SUBMIT TEMPLATE" && $template_id && $template_name && $template_list_id && $standard_fields_layout) {
$custom_table="custom_".$template_list_id;
$ins_stmt="insert into vicidial_custom_leadloader_templates(template_id, template_name, template_description, list_id, standard_variables, custom_table, custom_variables) values('$template_id', '$template_name', '$template_description', '$template_list_id', '$standard_fields_layout', '$custom_table', '$custom_fields_layout')";
$ins_rslt=mysql_query($ins_stmt, $link);
if (mysql_affected_rows()>0) {
$success_msg="NEW TEMPLATE CREATED SUCCESSFULLY";
if (!$custom_fields_layout) {
$success_msg.="<BR/>**NO CUSTOM FIELDS ASSIGNED**";
}
} else {
$error_msg="TEMPLATE CREATION FAILED";
}
} else if ($delete_template=="DELETE TEMPLATE" && $template_id) {
$delete_stmt="delete from vicidial_custom_leadloader_templates where template_id='$template_id'";
$delete_rslt=mysql_query($delete_stmt, $link);
}
$US='_';
#############################################
@@ -83,79 +69,94 @@ if ($qm_conf_ct > 0)
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$list_id_override = preg_replace('/[^0-9]/','',$list_id_override);
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$list_id_override = preg_replace('/[^0-9]/','',$list_id_override);
$template_list_id = preg_replace('/[^0-9]/','',$template_list_id);
$template_id = preg_replace("/'|\"|\\\\|;/","",$template_id);
$template_name = preg_replace("/'|\"|\\\\|;/","",$template_name);
$template_description = preg_replace("/'|\"|\\\\|;/","",$template_description);
$standard_fields_layout = preg_replace("/'|\"|\\\\|;/","",$standard_fields_layout);
$custom_table = preg_replace("/'|\"|\\\\|;/","",$custom_table);
$custom_fields_layout = preg_replace("/'|\"|\\\\|;/","",$custom_fields_layout);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$FILE_datetime = $STARTtime;
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($webroot_writable > 0) {$fp = fopen ("./project_auth_entries.txt", "a");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($auth < 1)
{
# Header("WWW-Authenticate: Basic realm=\"VICIDIAL-LEAD-LOADER\"");
# Header("HTTP/1.0 401 Unauthorized");
# echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
header ("Content-type: text/html; charset=utf-8");
header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header ("Pragma: no-cache"); // HTTP/1.0
if($auth>0)
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT load_leads,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGload_leads = $row[0];
$LOGuser_group = $row[1];
if ($LOGload_leads < 1)
{
echo "You do not have permissions to load leads\n";
exit;
}
if ($webroot_writable > 0)
{
fwrite ($fp, "LIST_LOAD|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($webroot_writable > 0)
{
fwrite ($fp, "LIST_LOAD|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT load_leads,user_group from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGload_leads = $row[0];
$LOGuser_group = $row[1];
if ($LOGload_leads < 1)
{
Header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions to load leads: |$PHP_AUTH_USER|\n";
exit;
}
header ("Content-type: text/html; charset=utf-8");
header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header ("Pragma: no-cache"); // HTTP/1.0
if ($submit_template=="SUBMIT TEMPLATE" && $template_id && $template_name && $template_list_id && $standard_fields_layout)
{
$custom_table="custom_".$template_list_id;
$ins_stmt="INSERT INTO vicidial_custom_leadloader_templates(template_id, template_name, template_description, list_id, standard_variables, custom_table, custom_variables) values('$template_id', '$template_name', '$template_description', '$template_list_id', '$standard_fields_layout', '$custom_table', '$custom_fields_layout')";
$ins_rslt=mysql_query($ins_stmt, $link);
if (mysql_affected_rows($link)>0)
{
$success_msg="NEW TEMPLATE CREATED SUCCESSFULLY";
if (!$custom_fields_layout)
{
$success_msg.="<BR/>**NO CUSTOM FIELDS ASSIGNED**";
}
}
else
{
$errno = mysql_errno($link);
if ($errno > 0)
{$error = mysql_error($link);}
$error_msg="TEMPLATE CREATION FAILED<br>\n$errno - $error<br>\n[$ins_stmt]";
}
}
else if ($delete_template=="DELETE TEMPLATE" && $template_id)
{
$delete_stmt="delete from vicidial_custom_leadloader_templates where template_id='$template_id'";
$delete_rslt=mysql_query($delete_stmt, $link);
}
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
@@ -170,10 +171,10 @@ $LOGallowed_campaignsSQL='';
$whereLOGallowed_campaignsSQL='';
if (!preg_match('/\-ALL/i', $LOGallowed_campaigns))
{
echo "<BR/>**$LOGallowed_campaigns**";
echo "<BR/>**$LOGallowed_campaigns**";
$rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns);
$rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL);
echo "<BR/>##$rawLOGallowed_campaignsSQL##";
echo "<BR/>##$rawLOGallowed_campaignsSQL##";
$LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')";
$whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')";
}
@@ -183,7 +184,7 @@ $script_name = getenv("SCRIPT_NAME");
$server_name = getenv("SERVER_NAME");
$server_port = getenv("SERVER_PORT");
if (preg_match("/443/i",$server_port)) {$HTTPprotocol = 'https://';}
else {$HTTPprotocol = 'http://';}
else {$HTTPprotocol = 'http://';}
$admDIR = "$HTTPprotocol$server_name$script_name";
$admDIR = preg_replace('/AST_admin_template_maker\.php/i', '',$admDIR);
$admDIR = "/vicidial/";
@@ -194,6 +195,7 @@ $NWE = "')\"><IMG SRC=\"help.gif\" WIDTH=20 HEIGHT=20 BORDER=0 ALT=\"HELP\" ALIG
?>
<html>
<head>
<title>ADMIN: Lead Loader Template Maker</title>
</head>
<script language="Javascript">
var form_file_name='';
@@ -339,16 +341,18 @@ require("admin_header.php");
<tr><td align="center" bgcolor="#CCFFFF">
<table border=0 cellpadding=15 cellspacing=0 width="90%" align="center" bgcolor="#D9E6FE">
<?php
if ($error_msg) {
if ($error_msg)
{
echo "<tr bgcolor='#990000'>";
echo "<th colspan='2'><font color='#FFFFFF'>$error_msg</font></th>";
echo "</tr>";
}
if ($success_msg) {
}
if ($success_msg)
{
echo "<tr bgcolor='#009900'>";
echo "<th colspan='2'><font color='#FFFFFF'>$success_msg</font></th>";
echo "</tr>";
}
}
?>
<tr>
<th width="50%"><font class="standard_bold">Create a new template</font></th>
@@ -399,7 +403,7 @@ if (mysql_num_rows($template_rslt)>0) {
</tr>
<tr bgcolor="#D9E6FE">
<td align="right" width='25%'><font class="standard">Template Description:</font></td>
<td align="left" width='75%'><input type='text' name='template_desc' size='50' maxlength='255'><?php echo "$NWB#vicidial_template_maker-template_description$NWE"; ?></td>
<td align="left" width='75%'><input type='text' name='template_description' size='50' maxlength='255'><?php echo "$NWB#vicidial_template_maker-template_description$NWE"; ?></td>
</tr>
<tr bgcolor="#D9E6FE">
<td width='25%' align="right"><font class="standard">List ID template will load into:</font></td>
@@ -450,4 +454,4 @@ if (mysql_num_rows($template_rslt)>0) {
</form>
</span>
</body>
</html>
</html>
agc_2-X/trunk/www/vicidial/AST_agent_days_detail.php
+62 -23
View File
@@ -18,11 +18,13 @@
# 120224-0910 - Added HTML display option with bar graphs
# 130414-0143 - Added report logging
# 130610-1037 - Finalized changing of all ereg instances to preg
# 130621-0830 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -74,28 +76,65 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -127,7 +166,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
echo "<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -144,7 +183,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_agent_disposition.php
+73 -12
View File
@@ -10,9 +10,11 @@
# 70201-1213 - First build - from Marin Blu
# 90508-0644 - Changed to PHP long tags
# 130610-1136 - Finalized changing of all ereg instances to preg
# 130621-0828 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -28,23 +30,82 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
}
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$group = preg_replace("/'|\"|\\\\|;/","",$group);
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$admin_auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
@@ -236,4 +297,4 @@ echo "\n";
}
?>
</BODY></HTML>
</BODY></HTML>
agc_2-X/trunk/www/vicidial/AST_agent_performance.php
+72 -12
View File
@@ -10,9 +10,11 @@
# 70201-1203 - Added non_latin UTF8 output code, widened USER ID to 8 chars
# 90508-0644 - Changed to PHP long tags
# 130610-1135 - Finalized changing of all ereg instances to preg
# 130621-0825 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -28,24 +30,82 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
}
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$group = preg_replace("/'|\"|\\\\|;/","",$group);
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$admin_auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
agc_2-X/trunk/www/vicidial/AST_agent_performance_detail.php
+65 -25
View File
@@ -33,6 +33,7 @@
# 121130-0952 - Fix for user group permissions issue #588
# 130414-0140 - Added report logging
# 130610-1031 - Finalized changing of all ereg instances to preg
# 130621-0824 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -91,28 +92,65 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {$HTML_text.="|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$HTML_text.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -144,7 +182,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
$HTML_text.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$HTML_text.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -161,7 +199,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
@@ -724,7 +762,8 @@ while ($m < $k)
$CSV_lines.="\"$Sfull_nameRAW\",";
$CSV_lines.=preg_replace('/\s/', '', "\"$SuserRAW\",\"$Scalls\",\"$pfUSERtime_MS\",\"$pfUSERtotPAUSE_MS\",\"$pfUSERavgPAUSE_MS\",\"$pfUSERtotWAIT_MS\",\"$pfUSERavgWAIT_MS\",\"$pfUSERtotTALK_MS\",\"$pfUSERavgTALK_MS\",\"$pfUSERtotDISPO_MS\",\"$pfUSERavgDISPO_MS\",\"$pfUSERtotDEAD_MS\",\"$pfUSERavgDEAD_MS\",\"$pfUSERtotCUSTOMER_MS\",\"$pfUSERavgCUSTOMER_MS\"$CSVstatuses\n");
$CSV_lines.=preg_replace('/\s/', '', "\"$SuserRAW\",\"$Scalls\",\"$pfUSERtime_MS\",\"$pfUSERtotPAUSE_MS\",\"$pfUSERavgPAUSE_MS\",\"$pfUSERtotWAIT_MS\",\"$pfUSERavgWAIT_MS\",\"$pfUSERtotTALK_MS\",\"$pfUSERavgTALK_MS\",\"$pfUSERtotDISPO_MS\",\"$pfUSERavgDISPO_MS\",\"$pfUSERtotDEAD_MS\",\"$pfUSERavgDEAD_MS\",\"$pfUSERtotCUSTOMER_MS\",\"$pfUSERavgCUSTOMER_MS\"$CSVstatuses");
$CSV_lines.="\n";
$TOPsorted_output[$m] = $Toutput;
@@ -1199,7 +1238,8 @@ while ($m < $k)
$BOTTOMsorted_output[$m] = $BOTTOMoutput;
$ASCII_text.="$BOTTOMoutput";
$CSV_lines.="\"$Sfull_nameRAW\"".preg_replace('/\s/', '', ",\"$SuserRAW\",\"$pfUSERtotTOTAL_MS\",\"$pfUSERtotNONPAUSE_MS\",\"$pfUSERtotPAUSE_MS\",$CSV_statuses\n");
$CSV_lines.="\"$Sfull_nameRAW\"".preg_replace('/\s/', '', ",\"$SuserRAW\",\"$pfUSERtotTOTAL_MS\",\"$pfUSERtotNONPAUSE_MS\",\"$pfUSERtotPAUSE_MS\",$CSV_statuses");
$CSV_lines.="\n";
$m++;
}
### END loop through each user ###
agc_2-X/trunk/www/vicidial/AST_agent_status_detail.php
+62 -23
View File
@@ -20,11 +20,13 @@
# 121130-0958 - Fix for user group permissions issue #588
# 130414-0139 - Added report logging
# 130610-1029 - Finalized changing of all ereg instances to preg
# 130621-0822 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -76,28 +78,65 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -129,7 +168,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
# echo "<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -146,7 +185,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_agent_time_detail.php
+61 -23
View File
@@ -27,6 +27,7 @@
# 130414-0137 - Added report logging
# 220414-2111 - Added counts on parked(hold) calls
# 130610-0849 - Finalized changing of all ereg instances to preg
# 130621-0821 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -102,28 +103,65 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -155,7 +193,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
# echo "<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -172,7 +210,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_agent_time_sheet.php
+77 -40
View File
@@ -18,6 +18,7 @@
# 111104-1308 - Added user_group restrictions for selecting in-groups
# 130414-0148 - Added report logging
# 130610-1028 - Finalized changing of all ereg instances to preg
# 130621-0818 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -28,6 +29,22 @@ require("functions.php");
$report_name = 'User Time Sheet';
$db_source = 'M';
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["agent"])) {$agent=$_GET["agent"];}
elseif (isset($_POST["agent"])) {$agent=$_POST["agent"];}
if (isset($_GET["query_date"])) {$query_date=$_GET["query_date"];}
elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];}
if (isset($_GET["calls_summary"])) {$calls_summary=$_GET["calls_summary"];}
elseif (isset($_POST["calls_summary"])) {$calls_summary=$_POST["calls_summary"];}
if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];}
elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];}
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,user_territories_active FROM system_settings;";
@@ -46,47 +63,67 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["agent"])) {$agent=$_GET["agent"];}
elseif (isset($_POST["agent"])) {$agent=$_POST["agent"];}
if (isset($_GET["query_date"])) {$query_date=$_GET["query_date"];}
elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];}
if (isset($_GET["calls_summary"])) {$calls_summary=$_GET["calls_summary"];}
elseif (isset($_POST["calls_summary"])) {$calls_summary=$_POST["calls_summary"];}
if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];}
elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];}
$user=$agent;
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -118,7 +155,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -135,7 +172,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_agent_time_sheet_archive.php
+78 -17
View File
@@ -10,6 +10,7 @@
# 90508-0644 - Changed to PHP long tags
# 130414-0156 - Added report logging
# 130610-1027 - Finalized changing of all ereg instances to preg
# 130621-0812 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -17,6 +18,7 @@ $startMS = microtime();
$report_name='Agent Timesheet Archive';
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -24,29 +26,88 @@ $PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["agent"])) {$agent=$_GET["agent"];}
elseif (isset($_POST["agent"])) {$agent=$_POST["agent"];}
if (isset($_GET["query_date"])) {$query_date=$_GET["query_date"];}
elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];}
if (isset($_GET["calls_summary"])) {$calls_summary=$_GET["calls_summary"];}
elseif (isset($_POST["calls_summary"])) {$calls_summary=$_POST["calls_summary"];}
elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];}
if (isset($_GET["calls_summary"])) {$calls_summary=$_GET["calls_summary"];}
elseif (isset($_POST["calls_summary"])) {$calls_summary=$_POST["calls_summary"];}
if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
}
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$group = preg_replace("/'|\"|\\\\|;/","",$group);
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$admin_auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -89,8 +150,8 @@ if (!isset($query_date)) {$query_date = $NOW_DATE;}
<?php
echo "<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n";
echo "<TITLE>VICIDIAL: Agent Time Sheet</TITLE></HEAD><BODY BGCOLOR=WHITE>\n";
echo "<a href=\"./admin.php\">VICIDIAL ADMIN</a>: Agent Time Sheet\n";
echo "<TITLE>ADMIN: Agent Time Sheet</TITLE></HEAD><BODY BGCOLOR=WHITE>\n";
echo "<a href=\"./admin.php\">ADMIN</a>: Agent Time Sheet\n";
echo " - <a href=\"./user_stats.php?user=$agent\">User Stats</a>\n";
echo " - <a href=\"./user_status.php?user=$agent\">User Status</a>\n";
echo " - <a href=\"./admin.php?ADD=3&user=$agent\">Modify User</a>\n";
@@ -124,7 +185,7 @@ if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$full_name = $row[0];
echo "VICIDIAL: Agent Time Sheet $NOW_TIME\n";
echo "ADMIN: Agent Time Sheet $NOW_TIME\n";
echo "Time range: $query_date_BEGIN to $query_date_END\n\n";
echo "---------- AGENT TIME SHEET: $agent - $full_name -------------\n\n";
agc_2-X/trunk/www/vicidial/AST_agent_timeclock_detail.php
+61 -23
View File
@@ -15,6 +15,7 @@
# 120224-0910 - Added HTML display option with bar graphs
# 130414-0154 - Added report logging
# 130610-1024 - Finalized changing of all ereg instances to preg
# 130621-0810 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -70,28 +71,65 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -123,7 +161,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
# echo "<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -140,7 +178,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_campaign_status_list_report.php
+66 -29
View File
@@ -13,6 +13,7 @@
# 130414-0129 - Added report logging
# 130425-2113 - Added status flag summaries and other formatting cleanup
# 130425-2353 - Fixed bug with subtracting unsigned columns in SQL
# 130621-2016 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -23,14 +24,14 @@ require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["query_date_D"])) {$query_date_D=$_GET["query_date_D"];}
if (isset($_GET["query_date_D"])) {$query_date_D=$_GET["query_date_D"];}
elseif (isset($_POST["query_date_D"])) {$query_date_D=$_POST["query_date_D"];}
if (isset($_GET["end_date_D"])) {$end_date_D=$_GET["end_date_D"];}
elseif (isset($_POST["end_date_D"])) {$end_date_D=$_POST["end_date_D"];}
if (isset($_GET["query_date_T"])) {$query_date_T=$_GET["query_date_T"];}
elseif (isset($_POST["end_date_D"])) {$end_date_D=$_POST["end_date_D"];}
if (isset($_GET["query_date_T"])) {$query_date_T=$_GET["query_date_T"];}
elseif (isset($_POST["query_date_T"])) {$query_date_T=$_POST["query_date_T"];}
if (isset($_GET["end_date_T"])) {$end_date_T=$_GET["end_date_T"];}
elseif (isset($_POST["end_date_T"])) {$end_date_T=$_POST["end_date_T"];}
elseif (isset($_POST["end_date_T"])) {$end_date_T=$_POST["end_date_T"];}
if (isset($_GET["group"])) {$group=$_GET["group"];}
elseif (isset($_POST["group"])) {$group=$_POST["group"];}
if (isset($_GET["user_group"])) {$user_group=$_GET["user_group"];}
@@ -41,7 +42,7 @@ if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];}
$report_name="Campaign Status List Report";
@@ -69,29 +70,65 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace("/[^0-9a-zA-Z]/","",$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace("/[^0-9a-zA-Z]/","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {$HTML_text.="|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$HTML_text.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -123,7 +160,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
$HTML_text.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$HTML_text.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -138,7 +175,7 @@ $LOGallowed_reports = $row[1];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_carrier_log_report.php
+61 -22
View File
@@ -8,11 +8,13 @@
# 130413-2213 - Added SIP codes summary and fields, and report logging
# 130418-1048 - Changed how server list is generated
# 130610-0935 - Finalized changing of all ereg instances to preg
# 130621-0801 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
$report_name='Carrier Log Report';
@@ -40,9 +42,6 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db FROM system_settings;";
@@ -62,25 +61,65 @@ if ($qm_conf_ct > 0)
$NOW_DATE = date("Y-m-d");
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -127,7 +166,7 @@ while($i < $server_ip_ct)
$i++;
}
$server_stmt="select server_ip,server_description from servers where active_asterisk_server='Y' order by server_ip asc";
$server_stmt="select server_ip,server_description from servers where active_asterisk_server='Y' order by server_ip asc;";
$server_rslt=mysql_query($server_stmt, $link);
$servers_to_print=mysql_num_rows($server_rslt);
$i=0;
agc_2-X/trunk/www/vicidial/AST_dialer_inventory_report.php
+61 -20
View File
@@ -16,6 +16,7 @@
# 120221-2237 - Added totals, list options, other small changes
# 130414-0131 - Added report logging
# 130610-1021 - Finalized changing of all ereg instances to preg
# 130621-0800 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -81,25 +82,65 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {$HTML_header.="|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$HTML_header.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -131,7 +172,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
#$HTML_header.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$HTML_header.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -146,7 +187,7 @@ $LOGallowed_reports = $row[1];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_email_log_display.php
+60 -5
View File
@@ -8,11 +8,15 @@
# changes:
# 130221-2124 - First build
# 130610-1039 - Finalized changing of all ereg instances to preg
# 130621-0756 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
if (isset($_GET["email_row_id"])) {$email_row_id=$_GET["email_row_id"];}
@@ -50,15 +54,66 @@ if ($allow_emails<1)
if ($non_latin < 1)
{
$user=preg_replace('/[^-_0-9a-zA-Z]/', '',$user);
$pass=preg_replace('/[^-_0-9a-zA-Z]/', '',$pass);
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$user = preg_replace("/'|\"|\\\\|;/","",$user);
$pass = preg_replace("/'|\"|\\\\|;/","",$pass);
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
if ($email_log_id) {
$stmt="select * from vicidial_email_log where email_log_id='$email_log_id'";
$rslt=mysql_query($stmt, $link);
@@ -79,7 +134,7 @@ if (mysql_num_rows($rslt)>0) {
<html>
<head>
<title>VICIDIAL email frame</title>
<title>email frame</title>
</head>
<body topmargin=0 leftmargin=0>
<?php echo $EMAIL_form; ?>
agc_2-X/trunk/www/vicidial/AST_email_log_report.php
+63 -22
View File
@@ -9,12 +9,13 @@
# 130221-2117 - First build
# 130414-0132 - Added report logging
# 130610-1016 - Finalized changing of all ereg instances to preg
# 130621-0753 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
$version = '2.6-2';
$build = '130414-0132';
$version = '2.8-4';
$build = '130621-0753';
header ("Content-type: text/html; charset=utf-8");
@@ -89,25 +90,65 @@ if ($gmt_conf_ct > 0)
$epoch_offset = (($local_gmt + $dst) * 3600);
}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -139,7 +180,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
echo "<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -156,7 +197,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_hangup_cause_report.php
+60 -21
View File
@@ -8,6 +8,7 @@
# 130413-2348 - Added report logging
# 130419-2047 - Changed how menu lists are generated to speed up initial form load
# 132305-2305 - Finalized changing of all ereg instances to preg
# 130621-0749 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -15,6 +16,7 @@ $startMS = microtime();
$report_name='Hangup Cause Report';
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -46,9 +48,6 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$START_TIME=date("U");
#############################################
@@ -219,25 +218,65 @@ $master_dialstatus_array=array("ANSWER", "BUSY", "NOANSWER", "CANCEL", "CONGESTI
$dialstatuses_to_print=count($master_dialstatus_array);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
agc_2-X/trunk/www/vicidial/AST_inboundEXTstats.php
+71 -11
View File
@@ -9,9 +9,11 @@
# - Added required user/pass to gain access to this page
# 90508-0644 - Changed to PHP long tags
# 130610-1134 - Finalized changing of all ereg instances to preg
# 130621-0745 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -27,23 +29,81 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
}
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$group = preg_replace("/'|\"|\\\\|;/","",$group);
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$admin_auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
agc_2-X/trunk/www/vicidial/AST_inboundEXTstats_department.php
+121 -80
View File
@@ -7,9 +7,11 @@
# 70201-1710 - First Build
# 90508-0644 - Changed to PHP long tags
# 130610-1134 - Finalized changing of all ereg instances to preg
# 130621-0743 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -27,9 +29,6 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin FROM system_settings;";
@@ -46,21 +45,66 @@ while ($i < $qm_conf_ct)
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
@@ -106,9 +150,9 @@ echo "<SELECT SIZE=1 NAME=group>\n";
$o=0;
while ($dept_to_print > $o)
{
if ($dept[$o] == $group) {echo "<option selected value=\"$dept[$o]\">$dept[$o]</option>\n";}
else {echo "<option value=\"$dept[$o]\">$dept[$o]</option>\n";}
$o++;
if ($dept[$o] == $group) {echo "<option selected value=\"$dept[$o]\">$dept[$o]</option>\n";}
else {echo "<option value=\"$dept[$o]\">$dept[$o]</option>\n";}
$o++;
}
echo "</SELECT>\n";
echo "<INPUT TYPE=SUBMIT NAME=SUBMIT VALUE=SUBMIT>\n";
@@ -118,80 +162,77 @@ echo "<PRE><FONT SIZE=2>\n\n";
if (!$group)
{
echo "\n\n";
echo "PLEASE SELECT A DEPARTMENT AND DATE RANGE ABOVE AND CLICK SUBMIT\n";
}
{
echo "\n\n";
echo "PLEASE SELECT A DEPARTMENT AND DATE RANGE ABOVE AND CLICK SUBMIT\n";
}
else
{
$extSQL='';
$stmt="select extension from inbound_numbers where department='$group';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$inbound_to_print = mysql_num_rows($rslt);
$i=0;
while ($i < $inbound_to_print)
{
if (strlen($extSQL)> 1) {$extSQL .= ",";}
$row=mysql_fetch_row($rslt);
$extensions[$i] =$row[0];
$extSQL .= "'$extensions[$i]'";
$i++;
}
echo "ASTERISK: Inbound Calls Stats For $group from $query_date to $end_query_date\n";
echo "\n";
echo "---------- TOTALS\n";
echo "\n";
echo "+----------------------+------------+------------+\n";
echo "| NUMBER | CALLS | AVG TIME |\n";
echo "+----------------------+------------+------------+\n";
$k=0;
while ($k < $inbound_to_print)
{
$stmt="select count(*),sum(length_in_sec) from call_log where start_time >= '" . mysql_real_escape_string($query_date) . " 00:00:01' and start_time <= '" . mysql_real_escape_string($end_query_date) . " 23:59:59' and server_ip='" . mysql_real_escape_string($server_ip) . "' and extension='$extensions[$k]' ;";
$extSQL='';
$stmt="select extension from inbound_numbers where department='$group';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$extensions[$k] = sprintf("%20s", $extensions[$k]);
$TOTALcalls = sprintf("%10s", $row[0]);
if ( ($row[0]<1) or ($row[1]<1) )
$inbound_to_print = mysql_num_rows($rslt);
$i=0;
while ($i < $inbound_to_print)
{
$average_hold_seconds = " 0";
}
else
{
$average_hold_seconds = ($row[1] / $row[0]);
$average_hold_seconds = round($average_hold_seconds, 0);
$average_hold_seconds = sprintf("%10s", $average_hold_seconds);
if (strlen($extSQL)> 1) {$extSQL .= ",";}
$row=mysql_fetch_row($rslt);
$extensions[$i] =$row[0];
$extSQL .= "'$extensions[$i]'";
$i++;
}
$calls = ($TOTALcalls + $calls);
$seconds = ($row[1] + $seconds);
echo "ASTERISK: Inbound Calls Stats For $group from $query_date to $end_query_date\n";
echo "| $extensions[$k] | $TOTALcalls | $average_hold_seconds |\n";
$k++;
echo "\n";
echo "---------- TOTALS\n";
echo "\n";
echo "+----------------------+------------+------------+\n";
echo "| NUMBER | CALLS | AVG TIME |\n";
echo "+----------------------+------------+------------+\n";
$k=0;
while ($k < $inbound_to_print)
{
$stmt="select count(*),sum(length_in_sec) from call_log where start_time >= '" . mysql_real_escape_string($query_date) . " 00:00:01' and start_time <= '" . mysql_real_escape_string($end_query_date) . " 23:59:59' and server_ip='" . mysql_real_escape_string($server_ip) . "' and extension='$extensions[$k]' ;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$extensions[$k] = sprintf("%20s", $extensions[$k]);
$TOTALcalls = sprintf("%10s", $row[0]);
if ( ($row[0]<1) or ($row[1]<1) )
{
$average_hold_seconds = " 0";
}
else
{
$average_hold_seconds = ($row[1] / $row[0]);
$average_hold_seconds = round($average_hold_seconds, 0);
$average_hold_seconds = sprintf("%10s", $average_hold_seconds);
}
$calls = ($TOTALcalls + $calls);
$seconds = ($row[1] + $seconds);
echo "| $extensions[$k] | $TOTALcalls | $average_hold_seconds |\n";
$k++;
}
$calls = sprintf("%10s", $calls);
$seconds = ($seconds / $calls);
$seconds = round($seconds, 0);
$seconds = sprintf("%5s", $seconds);
echo "+----------------------+------------+------------+\n";
echo "| TOTALS | $calls | AVG: $seconds |\n";
echo "+----------------------+------------+------------+\n";
}
$calls = sprintf("%10s", $calls);
$seconds = ($seconds / $calls);
$seconds = round($seconds, 0);
$seconds = sprintf("%5s", $seconds);
echo "+----------------------+------------+------------+\n";
echo "| TOTALS | $calls | AVG: $seconds |\n";
echo "+----------------------+------------+------------+\n";
}
?>
</PRE>
</BODY></HTML>
</BODY></HTML>
agc_2-X/trunk/www/vicidial/AST_inbound_daily_report.php
+62 -23
View File
@@ -15,11 +15,13 @@
# 130322-2008 - Added Unique Agents column
# 130414-0110 - Added report logging
# 130610-1008 - Finalized changing of all ereg instances to preg
# 130621-0747 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
if (file_exists('options.php'))
{
@@ -54,9 +56,6 @@ if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
if (strlen($shift)<2) {$shift='ALL';}
$report_name = 'Inbound Daily Report';
@@ -81,25 +80,65 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -131,7 +170,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -148,7 +187,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_parkstats.php
+69 -9
View File
@@ -9,9 +9,11 @@
# - Added required user/pass to gain access to this page
# 90508-0644 - Changed to PHP long tags
# 130610-1133 - Finalized changing of all ereg instances to preg
# 130621-0728 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -25,21 +27,79 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
}
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$admin_auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
agc_2-X/trunk/www/vicidial/AST_server_performance.php
+62 -19
View File
@@ -18,11 +18,13 @@
# 100914-1326 - Added lookup for user_level 7 users to set to reports only which will remove other admin links
# 130414-0157 - Added report logging
# 130610-0959 - Finalized changing of all ereg instances to preg
# 130621-0726 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -63,24 +65,65 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -112,7 +155,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
echo "<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -127,7 +170,7 @@ $LOGallowed_reports = $row[1];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_team_performance_detail.php
+61 -23
View File
@@ -17,6 +17,7 @@
# 120307-1926 - Added additional statuses option and HTML display option
# 130414-0142 - Added report logging
# 130610-0958 - Finalized changing of all ereg instances to preg
# 130621-0723 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -75,28 +76,65 @@ if ($qm_conf_ct > 0)
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {$HTML_text.="|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$HTML_text.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -128,7 +166,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
$HTML_text.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$HTML_text.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -145,7 +183,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_timeonVDAD.php
+70 -9
View File
@@ -15,11 +15,13 @@
# 90310-1945 - Admin header
# 90508-0644 - Changed to PHP long tags
# 130610-1128 - Finalized changing of all ereg instances to preg
# 130620-2317 - Added filtering of input to prevent SQL injection attacks and new user auth
#
header ("Content-type: text/html; charset=utf-8");
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -35,21 +37,80 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
if (isset($_GET["closer_display"])) {$closer_display=$_GET["closer_display"];}
elseif (isset($_POST["closer_display"])) {$closer_display=$_POST["closer_display"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
}
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$group = preg_replace("/'|\"|\\\\|;/","",$group);
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$admin_auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$NOW_TIME = date("Y-m-d H:i:s");
agc_2-X/trunk/www/vicidial/AST_timeonVDADall.php
+130 -98
View File
@@ -81,10 +81,11 @@
# 130214-1323 - Added link to in-group selected users report for in-queue inbound calls
# 130424-1357 - Fixed issue with pause codes display
# 130610-0905 - Finalized changing of all ereg instances to preg
# 130620-2303 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$version = '2.6-70';
$build = '130424-1357';
$version = '2.8-71';
$build = '130620-2303';
header ("Content-type: text/html; charset=utf-8");
@@ -279,120 +280,151 @@ $timeSIXhoursAGO = date("Y-m-d H:i:s",$epochSIXhoursAGO);
$epochTWENTYFOURhoursAGO = ($STARTtime - 86400);
$timeTWENTYFOURhoursAGO = date("Y-m-d H:i:s",$epochTWENTYFOURhoursAGO);
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
if ($auth)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,callcard_admin,force_change_password,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,modify_contacts,modify_same_user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfull_name =$row[3];
$LOGuser_level =$row[4];
$LOGuser_group =$row[5];
$LOGdelete_users =$row[8];
$LOGdelete_user_groups =$row[9];
$LOGdelete_lists =$row[10];
$LOGdelete_campaigns =$row[11];
$LOGdelete_ingroups =$row[12];
$LOGdelete_remote_agents =$row[13];
$LOGload_leads =$row[14];
$LOGcampaign_detail =$row[15];
$LOGast_admin_access =$row[16];
$LOGast_delete_phones =$row[17];
$LOGdelete_scripts =$row[18];
$LOGdelete_filters =$row[29];
$LOGalter_agent_interface =$row[30];
$LOGdelete_call_times =$row[32];
$LOGmodify_call_times =$row[33];
$LOGmodify_users =$row[34];
$LOGmodify_campaigns =$row[35];
$LOGmodify_lists =$row[36];
$LOGmodify_scripts =$row[37];
$LOGmodify_filters =$row[38];
$LOGmodify_ingroups =$row[39];
$LOGmodify_usergroups =$row[40];
$LOGmodify_remoteagents =$row[41];
$LOGmodify_servers =$row[42];
$LOGview_reports =$row[43];
$LOGmodify_dids =$row[56];
$LOGdelete_dids =$row[57];
$LOGmanager_shift_enforcement_override=$row[61];
$LOGexport_reports =$row[64];
$LOGdelete_from_dnc =$row[65];
$LOGcallcard_admin =$row[70];
$LOGforce_change_password =$row[71];
$LOGmodify_shifts =$row[72];
$LOGmodify_phones =$row[73];
$LOGmodify_carriers =$row[74];
$LOGmodify_labels =$row[75];
$LOGmodify_statuses =$row[76];
$LOGmodify_voicemail =$row[77];
$LOGmodify_audiostore =$row[78];
$LOGmodify_moh =$row[79];
$LOGmodify_tts =$row[80];
$LOGmodify_contacts =$row[81];
$LOGmodify_same_user_level =$row[82];
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',0);
if ($auth_message == 'GOOD')
{$auth=1;}
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGallowed_campaigns = $row[0];
$LOGallowed_reports = $row[1];
$LOGadmin_viewable_groups = $row[2];
$LOGadmin_viewable_call_times = $row[3];
$LOGadmin_viewable_groupsSQL='';
$valLOGadmin_viewable_groupsSQL='';
$vmLOGadmin_viewable_groupsSQL='';
if ( (!preg_match('/\-\-ALL\-\-/i',$LOGadmin_viewable_groups)) and (strlen($LOGadmin_viewable_groups) > 3) )
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ -/",'',$LOGadmin_viewable_groups);
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_groupsSQL);
$LOGadmin_viewable_groupsSQL = "and user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$whereLOGadmin_viewable_groupsSQL = "where user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$valLOGadmin_viewable_groupsSQL = "and val.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$vmLOGadmin_viewable_groupsSQL = "and vm.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
else
{$admin_viewable_groupsALL=1;}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,callcard_admin,force_change_password,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,modify_contacts,modify_same_user_level from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfull_name =$row[3];
$LOGuser_level =$row[4];
$LOGuser_group =$row[5];
$LOGdelete_users =$row[8];
$LOGdelete_user_groups =$row[9];
$LOGdelete_lists =$row[10];
$LOGdelete_campaigns =$row[11];
$LOGdelete_ingroups =$row[12];
$LOGdelete_remote_agents =$row[13];
$LOGload_leads =$row[14];
$LOGcampaign_detail =$row[15];
$LOGast_admin_access =$row[16];
$LOGast_delete_phones =$row[17];
$LOGdelete_scripts =$row[18];
$LOGdelete_filters =$row[29];
$LOGalter_agent_interface =$row[30];
$LOGdelete_call_times =$row[32];
$LOGmodify_call_times =$row[33];
$LOGmodify_users =$row[34];
$LOGmodify_campaigns =$row[35];
$LOGmodify_lists =$row[36];
$LOGmodify_scripts =$row[37];
$LOGmodify_filters =$row[38];
$LOGmodify_ingroups =$row[39];
$LOGmodify_usergroups =$row[40];
$LOGmodify_remoteagents =$row[41];
$LOGmodify_servers =$row[42];
$LOGview_reports =$row[43];
$LOGmodify_dids =$row[56];
$LOGdelete_dids =$row[57];
$LOGmanager_shift_enforcement_override=$row[61];
$LOGexport_reports =$row[64];
$LOGdelete_from_dnc =$row[65];
$LOGcallcard_admin =$row[70];
$LOGforce_change_password =$row[71];
$LOGmodify_shifts =$row[72];
$LOGmodify_phones =$row[73];
$LOGmodify_carriers =$row[74];
$LOGmodify_labels =$row[75];
$LOGmodify_statuses =$row[76];
$LOGmodify_voicemail =$row[77];
$LOGmodify_audiostore =$row[78];
$LOGmodify_moh =$row[79];
$LOGmodify_tts =$row[80];
$LOGmodify_contacts =$row[81];
$LOGmodify_same_user_level =$row[82];
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGallowed_campaigns = $row[0];
$LOGallowed_reports = $row[1];
$LOGadmin_viewable_groups = $row[2];
$LOGadmin_viewable_call_times = $row[3];
$LOGadmin_viewable_groupsSQL='';
$valLOGadmin_viewable_groupsSQL='';
$vmLOGadmin_viewable_groupsSQL='';
if ( (!preg_match('/\-\-ALL\-\-/i',$LOGadmin_viewable_groups)) and (strlen($LOGadmin_viewable_groups) > 3) )
{
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ -/",'',$LOGadmin_viewable_groups);
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_groupsSQL);
$LOGadmin_viewable_groupsSQL = "and user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$whereLOGadmin_viewable_groupsSQL = "where user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$valLOGadmin_viewable_groupsSQL = "and val.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$vmLOGadmin_viewable_groupsSQL = "and vm.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
}
else
{$admin_viewable_groupsALL=1;}
# and (preg_match("/MONITOR|BARGE|HIJACK/",$monitor_active) ) )
if ( (!isset($monitor_phone)) or (strlen($monitor_phone)<1) )
{
$stmt="select phone_login from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and active='Y';";
$stmt="select phone_login from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$monitor_phone = $row[0];
}
$stmt="SELECT realtime_block_user_info,user_group,admin_hide_lead_data,admin_hide_phone_data from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT realtime_block_user_info,user_group,admin_hide_lead_data,admin_hide_phone_data from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -410,7 +442,7 @@ $LOGallowed_reports = $row[1];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_timeonVDADallREC.php
+84 -22
View File
@@ -28,11 +28,13 @@
# 70206-1140 - Added call-type statuses to display(A-Auto, M-Manual, I-Inbound/Closer)
# 90508-0644 - Changed to PHP long tags
# 130610-1126 - Finalized changing of all ereg instances to preg
# 130620-2300 - Added filtering of input to prevent SQL injection attacks and new user auth
#
header ("Content-type: text/html; charset=utf-8");
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -116,31 +118,91 @@ return false;
$load_ave = get_server_load(true);
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
if ($non_latin > 0) {$rslta=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {$MAIN.="$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$outbound_autodial_active = $row[1];
$slave_db_server = $row[2];
$reports_use_slave_db = $row[3];
}
##### END SETTINGS LOOKUP #####
###########################################
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT vicidial_recording from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
if ($non_latin > 0) {$rslta=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$authrec=$row[0];
if ($authrec=='1') {$RECmonitorLINK = 1;} else {$RECmonitorLINK = 0;}
$stmt="SELECT vicidial_recording from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$authrec=$row[0];
if ($authrec=='1') {$RECmonitorLINK = 1;} else {$RECmonitorLINK = 0;}
$NOW_TIME = date("Y-m-d H:i:s");
agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY.php
+62 -23
View File
@@ -24,9 +24,11 @@
# 110517-0059 - Added campaign type display option
# 110703-1854 - Added doanload option
# 130610-1120 - Finalized changing of all ereg instances to preg
# 130620-2256 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -78,31 +80,68 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -117,7 +156,7 @@ $LOGallowed_reports = $row[1];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/AST_timeonpark.php
+70 -10
View File
@@ -9,9 +9,11 @@
# - Added required user/pass to gain access to this page
# 90508-0644 - Changed to PHP long tags
# 130610-1132 - Finalized changing of all ereg instances to preg
# 130621-0720 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -25,21 +27,79 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
}
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$admin_auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$NOW_TIME = date("Y-m-d H:i:s");
@@ -218,4 +278,4 @@ $talking_to_print = mysql_num_rows($rslt);
?>
</PRE>
</BODY></HTML>
</BODY></HTML>
agc_2-X/trunk/www/vicidial/AST_url_log_report.php
+488
View File
@@ -0,0 +1,488 @@
<?php
# AST_url_log_report.php
#
# Copyright (C) 2013 Joe Johnson, Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# CHANGES
# 130620-0806 - First build
#
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
$report_name='URL Log Report';
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["query_date"])) {$query_date=$_GET["query_date"];}
elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];}
if (isset($_GET["query_date_D"])) {$query_date_D=$_GET["query_date_D"];}
elseif (isset($_POST["query_date_D"])) {$query_date_D=$_POST["query_date_D"];}
if (isset($_GET["query_date_T"])) {$query_date_T=$_GET["query_date_T"];}
elseif (isset($_POST["query_date_T"])) {$query_date_T=$_POST["query_date_T"];}
if (isset($_GET["url_type"])) {$url_type=$_GET["url_type"];}
elseif (isset($_POST["url_type"])) {$url_type=$_POST["url_type"];}
if (isset($_GET["response_sec"])) {$response_sec=$_GET["response_sec"];}
elseif (isset($_POST["response_sec"])) {$response_sec=$_POST["response_sec"];}
if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];}
elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];}
if (isset($_GET["lower_limit"])) {$lower_limit=$_GET["lower_limit"];}
elseif (isset($_POST["lower_limit"])) {$lower_limit=$_POST["lower_limit"];}
if (isset($_GET["upper_limit"])) {$upper_limit=$_GET["upper_limit"];}
elseif (isset($_POST["upper_limit"])) {$upper_limit=$_POST["upper_limit"];}
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];}
if (strlen($query_date_D) < 6) {$query_date_D = "00:00:00";}
if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";}
if (!isset($query_date)) {$query_date = $NOW_DATE;}
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {$MAIN.="$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$outbound_autodial_active = $row[1];
$slave_db_server = $row[2];
$reports_use_slave_db = $row[3];
}
##### END SETTINGS LOOKUP #####
###########################################
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$NOW_DATE = date("Y-m-d");
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
$LOGip = getenv("REMOTE_ADDR");
$LOGbrowser = getenv("HTTP_USER_AGENT");
$LOGscript_name = getenv("SCRIPT_NAME");
$LOGserver_name = getenv("SERVER_NAME");
$LOGserver_port = getenv("SERVER_PORT");
$LOGrequest_uri = getenv("REQUEST_URI");
$LOGhttp_referer = getenv("HTTP_REFERER");
if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';}
else {$HTTPprotocol = 'http://';}
if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';}
else {$LOGserver_port = ":$LOGserver_port";}
$LOGfull_url = "$HTTPprotocol$LOGserver_name$LOGserver_port$LOGrequest_uri";
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $lower_limit, $upper_limit, $file_download, $report_display_type|', url='$LOGfull_url';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$report_log_id = mysql_insert_id($link);
##### END log visit to the vicidial_report_log table #####
if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) )
{
mysql_close($link);
$use_slave_server=1;
$db_source = 'S';
require("dbconnect.php");
$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$url_type_string='|';
$url_type_ct = count($url_type);
$i=0;
while($i < $url_type_ct)
{
$url_type_string .= "$url_type[$i]|";
$i++;
}
$LISTurltypes=array("add_lead", "custom", "dispo", "na_callurl", "non-agent", "other", "qm_socket", "start", "start_ra");
$url_types_to_print=count($LISTurltypes);
$i=0;
while ($i < $url_types_to_print)
{
if (preg_match('/\-ALL/',$url_type_string) )
{
$url_type[$i] = $LISTurltypes[$i];
}
$i++;
}
$i=0;
$url_types_string='|';
$url_type_ct = count($url_type);
while($i < $url_type_ct)
{
if ( (strlen($url_type[$i]) > 0) and (preg_match("/\|$url_type[$i]\|/",$url_type_string)) )
{
$url_types_string .= "$url_type[$i]|";
$url_type_SQL .= "'$url_type[$i]',";
$url_typeQS .= "&url_type[]=$url_type[$i]";
}
$i++;
}
if ( (preg_match('/\-\-ALL\-\-/',$url_type_string) ) or ($url_type_ct < 1) )
{
$url_type_SQL = "";
$url_rpt_string="- ALL servers ";
if (preg_match('/\-\-ALL\-\-/',$url_type_string)) {$url_typeQS="&url_type[]=--ALL--";}
}
else
{
$url_type_SQL = preg_replace('/,$/i', '',$url_type_SQL);
$url_type_SQL = "and url_type IN($url_type_SQL)";
$url_rpt_string="- server(s) ".preg_replace('/\|/', ", ", substr($url_type_string, 1, -1));
}
if (strlen($url_type_SQL)<3) {$url_type_SQL="";}
$HEADER.="<HTML>\n";
$HEADER.="<HEAD>\n";
$HEADER.="<STYLE type=\"text/css\">\n";
$HEADER.="<!--\n";
$HEADER.=" .green {color: white; background-color: green}\n";
$HEADER.=" .red {color: white; background-color: red}\n";
$HEADER.=" .blue {color: white; background-color: blue}\n";
$HEADER.=" .purple {color: white; background-color: purple}\n";
$HEADER.=" .small_standard { font-family: Arial, Helvetica, sans-serif; font-size: 8pt}\n";
$HEADER.=" .small_standard_bold { font-family: Arial, Helvetica, sans-serif; font-size: 8pt; font-weight: bold}\n";
$HEADER.="-->\n";
$HEADER.=" </STYLE>\n";
$HEADER.="<script language=\"JavaScript\" src=\"calendar_db.js\"></script>\n";
$HEADER.="<link rel=\"stylesheet\" href=\"calendar.css\">\n";
$HEADER.="<link rel=\"stylesheet\" href=\"horizontalbargraph.css\">\n";
$HEADER.="<link rel=\"stylesheet\" href=\"verticalbargraph.css\">\n";
$HEADER.="<script language=\"JavaScript\" src=\"wz_jsgraphics.js\"></script>\n";
$HEADER.="<script language=\"JavaScript\" src=\"line.js\"></script>\n";
$HEADER.="<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n";
$HEADER.="<TITLE>$report_name</TITLE></HEAD><BODY BGCOLOR=WHITE marginheight=0 marginwidth=0 leftmargin=0 topmargin=0>\n";
$short_header=1;
$MAIN.="<TABLE CELLPADDING=4 CELLSPACING=0><TR><TD>";
$MAIN.="<FORM ACTION=\"$PHP_SELF\" METHOD=GET name=vicidial_report id=vicidial_report>\n";
$MAIN.="<TABLE BORDER=0 cellspacing=5 cellpadding=5><TR><TD VALIGN=TOP align=center>\n";
$MAIN.="<INPUT TYPE=HIDDEN NAME=DB VALUE=\"$DB\">\n";
$MAIN.="Date:\n";
$MAIN.="<INPUT TYPE=TEXT NAME=query_date SIZE=10 MAXLENGTH=10 VALUE=\"$query_date\">";
$MAIN.="<script language=\"JavaScript\">\n";
$MAIN.="var o_cal = new tcal ({\n";
$MAIN.=" // form name\n";
$MAIN.=" 'formname': 'vicidial_report',\n";
$MAIN.=" // input name\n";
$MAIN.=" 'controlname': 'query_date'\n";
$MAIN.="});\n";
$MAIN.="o_cal.a_tpl.yearscroll = false;\n";
$MAIN.="// o_cal.a_tpl.weekstart = 1; // Monday week start\n";
$MAIN.="</script>\n";
$MAIN.="<BR><BR><INPUT TYPE=TEXT NAME=query_date_D SIZE=9 MAXLENGTH=8 VALUE=\"$query_date_D\">";
$MAIN.="<BR> to <BR><INPUT TYPE=TEXT NAME=query_date_T SIZE=9 MAXLENGTH=8 VALUE=\"$query_date_T\">";
$MAIN.="</TD><TD ROWSPAN=2 VALIGN=TOP>URL type:<BR/>\n";
$MAIN.="<SELECT SIZE=5 NAME=url_type[] multiple>\n";
if (preg_match('/--ALL--/',$url_type_string))
{$MAIN.="<option value=\"--ALL--\" selected>-- ALL URL TYPES --</option>\n";}
else
{$MAIN.="<option value=\"--ALL--\">-- ALL URL TYPES --</option>\n";}
$o=0;
while ($url_types_to_print > $o)
{
if (preg_match("/\|$LISTurltypes[$o]\|/",$url_type_string))
{$MAIN.="<option selected value=\"$LISTurltypes[$o]\">".preg_replace("/_/", " ", $LISTurltypes[$o])."</option>\n";}
else
{$MAIN.="<option value=\"$LISTurltypes[$o]\">".preg_replace("/_/", " ", $LISTurltypes[$o])."</option>\n";}
$o++;
}
$MAIN.="</SELECT></TD><TD ROWSPAN=2 VALIGN=middle align=center>\n";
$MAIN.="Display as:<BR>";
$MAIN.="<select name='report_display_type'>";
if ($report_display_type) {$MAIN.="<option value='$report_display_type' selected>$report_display_type</option>";}
$MAIN.="<option value='TEXT'>TEXT</option><option value='HTML'>HTML</option></select>\n<BR><BR>";
$MAIN.="<INPUT TYPE=submit NAME=SUBMIT VALUE=SUBMIT><BR/><BR/>\n";
$MAIN.="</TD></TR></TABLE>\n";
if ($SUBMIT && $url_type_ct>0) {
$stmt="select url_type, count(*) as ct From vicidial_url_log where url_date>='$query_date $query_date_D' and url_date<='$query_date $query_date_T' $url_type_SQL $server_ip_SQL group by url_type order by url_type";
$rslt=mysql_query($stmt, $link);
$ASCII_text="<PRE><font size=2>\n";
$HTML_text="";
if ($DB) {$ASCII_text.=$stmt."\n";}
if (mysql_num_rows($rslt)>0) {
$ASCII_text.="--- URL TYPE BREAKDOWN FOR $query_date, $query_date_D TO $query_date_T $server_rpt_string\n";
$ASCII_text.="+--------------+---------+\n";
$ASCII_text.="| URL TYPE | COUNT |\n";
$ASCII_text.="+--------------+---------+\n";
$HTML_text.="<table border='0' cellpadding='0' cellspacing='2' width='350'>";
$HTML_text.="<TR><TH colspan='2' class='small_standard_bold grey_graph_cell'>URL TYPE BREAKDOWN FOR $query_date, $query_date_D TO $query_date_T $server_rpt_string</TH></TR>";
$HTML_text.="<TR><TH class='small_standard_bold grey_graph_cell'>URL TYPE</th><TH class='small_standard_bold grey_graph_cell'>COUNT</th></tr>";
$total_count=0;
while ($row=mysql_fetch_array($rslt)) {
$ASCII_text.="| ".sprintf("%-13s", $row["url_type"]);
$ASCII_text.="| ".sprintf("%-8s", $row["ct"]);
$ASCII_text.="|\n";
$HTML_text.="<TR><TD class='small_standard'>$row[url_type]</td><TD class='small_standard'>$row[ct]</td></tr>";
$total_count+=$row["ct"];
}
$ASCII_text.="+--------------+---------+\n";
$ASCII_text.="| TOTAL | ".sprintf("%-8s", $total_count)."|\n";
$ASCII_text.="+--------------+---------+\n\n";
$HTML_text.="<TR><TH class='small_standard_bold grey_graph_cell'>TOTAL</th><TH class='small_standard_bold grey_graph_cell'>$total_count</th></tr></table>";
$rpt_stmt="select * from vicidial_url_log where url_date>='$query_date $query_date_D' and url_date<='$query_date $query_date_T' $url_type_SQL order by url_date asc";
$rpt_rslt=mysql_query($rpt_stmt, $link);
if ($DB) {$ASCII_text.=$rpt_stmt."\n";}
if (!$lower_limit) {$lower_limit=1;}
if ($lower_limit+999>=mysql_num_rows($rpt_rslt)) {$upper_limit=($lower_limit+mysql_num_rows($rpt_rslt)%1000)-1;} else {$upper_limit=$lower_limit+999;}
$ASCII_text.="--- URL LOG RECORDS FOR $query_date, $query_date_D TO $query_date_T $server_rpt_string, RECORDS #$lower_limit-$upper_limit <a href=\"$PHP_SELF?SUBMIT=$SUBMIT&DB=$DB&type=$type&query_date=$query_date&query_date_D=$query_date_D&query_date_T=$query_date_T$url_typeQS&lower_limit=$lower_limit&upper_limit=$upper_limit&file_download=1\">[DOWNLOAD]</a>\n";
$url_rpt.="+----------------------+---------------------+--------------+----------+----------------------------------------------------------------------------------+----------------------------------------------------------------------------------+\n";
$url_rpt.="| UNIQUE ID | URL DATE | URL TYPE | RESP SEC | URL | URL RESPONSE |\n";
$url_rpt.="+----------------------+---------------------+--------------+----------+----------------------------------------------------------------------------------+----------------------------------------------------------------------------------+\n";
$HTML_text.="<BR><BR><table border='0' cellpadding='0' cellspacing='2' width='1000'>";
$HTML_rpt.="<TR><TH colspan='5' class='small_standard_bold grey_graph_cell'>URL LOG RECORDS FOR $query_date, $query_date_D TO $query_date_T $server_rpt_string, RECORDS #$lower_limit-$upper_limit</TH><TD align='right' class='small_standard_bold grey_graph_cell'><a href=\"$PHP_SELF?SUBMIT=$SUBMIT&DB=$DB&type=$type&query_date=$query_date&query_date_D=$query_date_D&query_date_T=$query_date_T$url_typeQS&lower_limit=$lower_limit&upper_limit=$upper_limit&file_download=1\">[DOWNLOAD]</a></td></TR>";
$HTML_rpt.="<TR><TH class='small_standard_bold grey_graph_cell' width='90'>UNIQUE ID</TH><TH class='small_standard_bold grey_graph_cell' width='120'>URL DATE</TH><TH class='small_standard_bold grey_graph_cell' width='70'>URL TYPE</TH><TH class='small_standard_bold grey_graph_cell' width='70'>RESP SEC</TH><TH class='small_standard_bold grey_graph_cell' width='300'>URL</TH><TH class='small_standard_bold grey_graph_cell' width='300'>URL RESPONSE</TH></TR>";
$CSV_text="\"UNIQUE ID\",\"URL DATE\",\"URL TYPE\",\"RESP SEC\",\"URL\",\"URL RESPONSE\"\n";
for ($i=1; $i<=mysql_num_rows($rpt_rslt); $i++) {
$row=mysql_fetch_array($rpt_rslt);
$phone_number=""; $phone_note="";
if (strlen($row["phone_number"])==0) {
$stmt2="select phone_number, alt_phone, address3 from vicidial_list where lead_id='$row[lead_id]'";
$rslt2=mysql_query($stmt2, $link);
while ($row2=mysql_fetch_array($rslt2)) {
if (strlen($row2["alt_phone"])>=7 && preg_match("/$row2[alt_phone]/", $channel)) {$phone_number=$row2["alt_phone"]; $phone_note="ALT";}
else if (strlen($row2["address3"])>=7 && preg_match("/$row2[address3]/", $channel)) {$phone_number=$row2["address3"]; $phone_note="ADDR3";}
else if (strlen($row2["phone_number"])>=7 && preg_match("/$row2[phone_number]/", $channel)) {$phone_number=$row2["phone_number"]; $phone_note="*";}
}
} else {
$phone_number=$row["phone_number"];
}
$CSV_text.="\"$row[uniqueid]\",\"$row[url_date]\",\"$row[url_type]\",\"$row[response_sec]\",\"$row[url]\",\"$row[url_response]\"\n";
if ($i>=$lower_limit && $i<=$upper_limit) {
if ($i%2==0) {$color_class="grey_graph_cell";} else {$color_class='white_graph_cell';}
$row["url_response"]=preg_replace("/\r/", "\\r", $row["url_response"]);
$row["url_response"]=preg_replace("/\n/", "\\n", $row["url_response"]);
$HTML_rpt.="<TR valign='top'><td class='small_standard_bold $color_class' width='90'><div style='width: 90px' class='wordwrap'>$row[uniqueid]</div></td><td class='small_standard_bold $color_class' width='120'><div style='width: 120px'>$row[url_date]</div></td><td class='small_standard_bold $color_class' width='70'><div style='width: 70px'>$row[url_type]</div></td><td class='small_standard_bold $color_class' width='70'><div style='width: 70px'>$row[response_sec]</div></td><td class='small_standard_bold $color_class' width='350'><div style='width: 350px' class='wordwrap'>$row[url]</div></td><td class='small_standard_bold $color_class' width='300'><div style='width: 300px' class='wordwrap'>$row[url_response]</div></td></TR>";
if (mb_strlen($row["url"])>mb_strlen($row["url_response"])) {
$max_url_length=mb_strlen($row["url"]);
} else {
$max_url_length=mb_strlen($row["url_response"]);
}
$lines_to_print=ceil($max_url_length/80);
for ($j=1; $j<=$lines_to_print; $j++) {
if ($j==1) {
$url_text=substr($row["url"], (80*($j-1)), 80);
$url_response_text=substr($row["url_response"], (80*($j-1)), 80);
$url_rpt.="| ".sprintf("%-21s", $row["uniqueid"]);
$url_rpt.="| ".sprintf("%-20s", $row["url_date"]);
$url_rpt.="| ".sprintf("%-13s", $row["url_type"]);
$url_rpt.="| ".sprintf("%-9s", $row["response_sec"]);
$url_rpt.="| ";
$url_rpt.=htmlspecialchars($url_text);
$blanks=81-strlen($url_text);
if ($blanks>0) {for ($k=1; $k<=$blanks; $k++) {$url_rpt.=" ";}}
$url_rpt.="| ";
$url_rpt.=htmlspecialchars($url_response_text);
$blanks=81-strlen($url_response_text);
if ($blanks>0) {for ($k=1; $k<=$blanks; $k++) {$url_rpt.=" ";}}
$url_rpt.="|\n";
} else {
$url_text=substr($row["url"], (80*($j-1)), 80);
$url_response_text=substr($row["url_response"], (80*($j-1)), 80);
$url_rpt.="| ".sprintf("%-21s", "");
$url_rpt.="| ".sprintf("%-20s", "");
$url_rpt.="| ".sprintf("%-13s", "");
$url_rpt.="| ".sprintf("%-9s", "");
$url_rpt.="| ";
$url_rpt.=htmlspecialchars($url_text);
$blanks=81-strlen($url_text);
if ($blanks>0) {for ($k=1; $k<=$blanks; $k++) {$url_rpt.=" ";}}
$url_rpt.="| ";
$url_rpt.=htmlspecialchars($url_response_text);
$blanks=81-strlen($url_response_text);
if ($blanks>0) {for ($k=1; $k<=$blanks; $k++) {$url_rpt.=" ";}}
$url_rpt.="|\n";
}
}
}
}
$url_rpt.="+----------------------+---------------------+--------------+----------+----------------------------------------------------------------------------------+----------------------------------------------------------------------------------+\n";
$url_rpt_hf="";
$HTML_rpt_hf="<TR>";
$ll=$lower_limit-1000;
if ($ll<1 || ($lower_limit+1000)>=mysql_num_rows($rpt_rslt)) {$HTML_colspan=6;} else {$HTML_colspan=3;}
if ($ll>=1) {
$url_rpt_hf.="<a href=\"$PHP_SELF?SUBMIT=$SUBMIT&DB=$DB&report_display_type=$report_display_type&type=$type&query_date=$query_date&query_date_D=$query_date_D&query_date_T=$query_date_T$url_typeQS&lower_limit=$ll\">[<<< PREV 1000 records]</a>";
$HTML_rpt_hf.="<Td colspan='$HTML_colspan' class='small_standard_bold grey_graph_cell' align='left'><a href=\"$PHP_SELF?SUBMIT=$SUBMIT&DB=$DB&report_display_type=$report_display_type&type=$type&query_date=$query_date&query_date_D=$query_date_D&query_date_T=$query_date_T$url_typeQS&lower_limit=$ll\">[<<< PREV 1000 records]</a></TH>";
} else {
$url_rpt_hf.=sprintf("%-23s", " ");
}
$url_rpt_hf.=sprintf("%-145s", " ");
if (($lower_limit+1000)<mysql_num_rows($rpt_rslt)) {
if ($upper_limit+1000>=mysql_num_rows($rpt_rslt)) {$max_limit=mysql_num_rows($rpt_rslt)-$upper_limit;} else {$max_limit=1000;}
$url_rpt_hf.="<a href=\"$PHP_SELF?SUBMIT=$SUBMIT&DB=$DB&report_display_type=$report_display_type&type=$type&query_date=$query_date&query_date_D=$query_date_D&query_date_T=$query_date_T$url_typeQS&lower_limit=".($lower_limit+1000)."\">[NEXT $max_limit records >>>]</a>";
$HTML_rpt_hf.="<Td colspan='$HTML_colspan' class='small_standard_bold grey_graph_cell' align='right'><a href=\"$PHP_SELF?SUBMIT=$SUBMIT&DB=$DB&report_display_type=$report_display_type&type=$type&query_date=$query_date&query_date_D=$query_date_D&query_date_T=$query_date_T$url_typeQS&lower_limit=".($lower_limit+1000)."\">[NEXT $max_limit records >>>]</a></TH>";
} else {
$url_rpt_hf.=sprintf("%23s", " ");
}
$HTML_rpt_hf.="</TR>";
$url_rpt_hf.="\n";
$ASCII_text.=$url_rpt_hf.$url_rpt.$url_rpt_hf;
$HTML_text.=$HTML_rpt_hf.$HTML_rpt.$HTML_rpt_hf."</table>";
} else {
$MAIN.="*** NO RECORDS FOUND ***\n";
}
$ASCII_text.="</font></PRE>\n";
if ($report_display_type=="HTML")
{
$MAIN.=$HTML_text;
}
else
{
$MAIN.=$ASCII_text;
}
$MAIN.="</form></BODY></HTML>\n";
}
if ($file_download>0) {
$FILE_TIME = date("Ymd-His");
$CSVfilename = "AST_url_log_report_$US$FILE_TIME.csv";
$CSV_text=preg_replace('/ +\"/', '"', $CSV_text);
$CSV_text=preg_replace('/\" +/', '"', $CSV_text);
// We'll be outputting a TXT file
header('Content-type: application/octet-stream');
// It will be called LIST_101_20090209-121212.txt
header("Content-Disposition: attachment; filename=\"$CSVfilename\"");
header('Expires: 0');
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Pragma: public');
ob_clean();
flush();
echo "$CSV_text";
exit;
} else {
echo $HEADER;
require("admin_header.php");
echo $MAIN;
}
if ($db_source == 'S')
{
mysql_close($link);
$use_slave_server=0;
$db_source = 'M';
require("dbconnect.php");
}
$endMS = microtime();
$startMSary = explode(" ",$startMS);
$endMSary = explode(" ",$endMS);
$runS = ($endMSary[0] - $startMSary[0]);
$runM = ($endMSary[1] - $startMSary[1]);
$TOTALrun = ($runS + $runM);
$stmt="UPDATE vicidial_report_log set run_time='$TOTALrun' where report_log_id='$report_log_id';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
exit;
?>
agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php
+75 -32
View File
@@ -11,6 +11,8 @@
# 120526-0803 - First build
# 130414-0145 - Added report logging
# 130610-0957 - Finalized changing of all ereg instances to preg
# 130620-2248 - Added filtering of input to prevent SQL injection attacks and new user auth
# 130627-0742 - Added new phone fields
#
$startMS = microtime();
@@ -55,28 +57,67 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {$HTML_text.="|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$HTML_text.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$group = preg_replace("/'|\"|\\\\|;/","",$group);
$user_group = preg_replace("/'|\"|\\\\|;/","",$user_group);
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -93,6 +134,8 @@ if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='
else {$LOGserver_port = ":$LOGserver_port";}
$LOGfull_url = "$HTTPprotocol$LOGserver_name$LOGserver_port$LOGrequest_uri";
$day30range=date("Y-m-d", mktime(0,0,0,date("m"),date("d")-30,date("Y")));
$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
@@ -108,7 +151,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
$HTML_text.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$HTML_text.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -125,7 +168,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
@@ -247,31 +290,31 @@ $HTML_text.="</FORM><font size=2><PRE>\n\n";
if ($SUBMIT=="SUBMIT")
{
$ASCII_text="+--------------------------------+----------+----------------------+---------------------+---------------------+----------+-----------------+-----------------+----------------------+--------------+\n";
$ASCII_text.="| USER NAME | ID | USER GROUP | FIRST LOGIN DATE | LAST LOGIN DATE | CAMPAIGN | SERVER IP | COMPUTER IP | EXTENSION | BROWSER |\n";
$ASCII_text.="+--------------------------------+----------+----------------------+---------------------+---------------------+----------+-----------------+-----------------+----------------------+--------------+\n";
$ASCII_text="+--------------------------------+----------+----------------------+---------------------+---------------------+----------+-----------------+-----------------+----------------------+--------------+-----------------+-----------------+-----------------+\n";
$ASCII_text.="| USER NAME | ID | USER GROUP | FIRST LOGIN DATE | LAST LOGIN DATE | CAMPAIGN | SERVER IP | COMPUTER IP | EXTENSION | BROWSER | PHONE LOGIN | SERVER PHONE | PHONE IP |\n";
$ASCII_text.="+--------------------------------+----------+----------------------+---------------------+---------------------+----------+-----------------+-----------------+----------------------+--------------+-----------------+-----------------+-----------------+\n";
$CSV_text="\"User group login report\",\"User groups:\",\"$user_group_string\"\n\n";
$CSV_text.="\"User name\",\"User ID\",\"User group\",\"First login date\",\"Last login date\",\"Campaign ID\",\"Server IP\",\"Computer IP\",\"Extension\",\"Browser\"\n";
$CSV_text.="\"User name\",\"User ID\",\"User group\",\"First login date\",\"Last login date\",\"Campaign ID\",\"Server IP\",\"Computer IP\",\"Extension\",\"Browser\",\"Phone login\",\"Server phone\",\"Phone IP\"\n";
$stmt="select distinct user, substr(full_name,1,30) as fullname, full_name from vicidial_users where user_group in ($user_group_SQL) order by user";
$rslt=mysql_query($stmt, $link);
while ($row=mysql_fetch_array($rslt))
{
$date_stmt="select min(event_date) as min_date, max(event_date) as max_date from vicidial_user_log where user='$row[user]' and event='LOGIN'";
$date_stmt="select min(event_date) as min_date, max(event_date) as max_date from vicidial_user_log where user='$row[user]' and event='LOGIN' and event_date>='$day30range'";
$date_rslt=mysql_query($date_stmt, $link);
$date_row=mysql_fetch_array($date_rslt);
$data_stmt="select campaign_id, server_ip, computer_ip, user_group, substring(extension,1,20) as ext, extension, browser from vicidial_user_log where user='$row[user]' and event_date='$date_row[max_date]' and event='LOGIN'";
$data_stmt="select campaign_id, server_ip, computer_ip, user_group, substring(extension,1,20) as ext, extension, browser, phone_login, server_phone, phone_ip from vicidial_user_log where user='$row[user]' and event_date='$date_row[max_date]' and event='LOGIN'";
$data_rslt=mysql_query($data_stmt, $link);
while ($data_row=mysql_fetch_array($data_rslt))
{
preg_match('/^[^\s]+/', $data_row["browser"], $browser_ary);
$browser=$browser_ary[0];
$ASCII_text.="| ".sprintf("%-30s", $row["fullname"])." | <a href='user_stats.php?user=$row[user]'>".sprintf("%-8s", $row["user"])."</a> | ".sprintf("%-20s", $data_row["user_group"])." | ".sprintf("%-19s", $date_row["min_date"])." | ".sprintf("%-19s", $date_row["max_date"])." | ".sprintf("%-8s", $data_row["campaign_id"])." | ".sprintf("%-15s", $data_row["server_ip"])." | ".sprintf("%-15s", $data_row["computer_ip"])." | ".sprintf("%-20s", $data_row["ext"])." | ".sprintf("%-12s", $browser)." |\n";
$CSV_text.="\"$row[full_name]\",\"$row[user]\",\"$data_row[user_group]\",\"$date_row[min_date]\",\"$date_row[max_date]\",\"$data_row[campaign_id]\",\"$data_row[server_ip]\",\"$data_row[computer_ip]\",\"$data_row[extension]\",\"$data_row[browser]\"\n";
$ASCII_text.="| ".sprintf("%-30s", $row["fullname"])." | <a href='user_stats.php?user=$row[user]'>".sprintf("%-8s", $row["user"])."</a> | ".sprintf("%-20s", $data_row["user_group"])." | ".sprintf("%-19s", $date_row["min_date"])." | ".sprintf("%-19s", $date_row["max_date"])." | ".sprintf("%-8s", $data_row["campaign_id"])." | ".sprintf("%-15s", $data_row["server_ip"])." | ".sprintf("%-15s", $data_row["computer_ip"])." | ".sprintf("%-20s", $data_row["ext"])." | ".sprintf("%-12s", $browser)." | ".sprintf("%-15s", $data_row["phone_login"])." | ".sprintf("%-15s", $data_row["server_phone"])." | ".sprintf("%-15s", $data_row["phone_ip"])." |\n";
$CSV_text.="\"$row[full_name]\",\"$row[user]\",\"$data_row[user_group]\",\"$date_row[min_date]\",\"$date_row[max_date]\",\"$data_row[campaign_id]\",\"$data_row[server_ip]\",\"$data_row[computer_ip]\",\"$data_row[extension]\",\"$data_row[browser]\",\"$data_row[phone_login]\",\"$data_row[server_phone]\",\"$data_row[phone_ip]\"\n";
}
}
$ASCII_text.="+--------------------------------+----------+----------------------+---------------------+---------------------+----------+-----------------+-----------------+----------------------+--------------+\n";
$ASCII_text.="+--------------------------------+----------+----------------------+---------------------+---------------------+----------+-----------------+-----------------+----------------------+--------------+-----------------+-----------------+-----------------+\n";
}
if ($file_download>0)
agc_2-X/trunk/www/vicidial/QM_live_monitor.php
+13 -6
View File
@@ -8,17 +8,17 @@
# CHANGELOG:
# 90529-2115 - First Build
# 130610-1130 - Finalized changing of all ereg instances to preg
# 130617-2128 - Added filtering of input to prevent SQL injection attacks
#
$version = '2.8-2';
$build = '130610-1130';
$version = '2.8-3';
$build = '130617-2128';
header ("Content-type: text/html; charset=utf-8");
require("dbconnect.php");
require("functions.php");
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
if (isset($_GET["campaign"])) {$campaign=$_GET["campaign"];}
@@ -42,6 +42,16 @@ if (isset($_GET["extension"])) {$extension=$_GET["extension"];}
if (isset($_GET["stage"])) {$stage=$_GET["stage"];}
elseif (isset($_POST["stage"])) {$stage=$_POST["stage"];}
$call = preg_replace('/[^0-9a-zA-Z]/', '', $call);
$user = preg_replace('/[^0-9a-zA-Z]/', '', $user);
$extension = preg_replace("/'|\"|\\\\|;/", '', $extension);
$server_ip = preg_replace("/'|\"|\\\\|;/", '', $server_ip);
$stage = preg_replace("/'|\"|\\\\|;/", '', $stage);
$campaign = preg_replace("/'|\"|\\\\|;/", '', $campaign);
$phone = preg_replace("/'|\"|\\\\|;/", '', $phone);
$type = preg_replace("/'|\"|\\\\|;/", '', $type);
$QMuser = preg_replace("/'|\"|\\\\|;/", '', $QMuser);
$ERR=0;
$ERRstring='';
@@ -173,6 +183,3 @@ if ($ERR > 0)
exit;
agc_2-X/trunk/www/vicidial/admin.php
+304 -238
View File
@@ -1813,61 +1813,10 @@ if (strlen($dial_status) > 0)
$status = $dial_status;
}
if ($download_max_system_stats_metric_name) {
if (!$query_date) {$query_date=date("Y-m-d", time()-(29*86400));}
if (!$end_date) {
$end_date=date("Y-m-d", time());
} else if (strtotime($end_date)>strtotime(date("Y-m-d"))) {
$end_date=date("Y-m-d");
}
if ($query_date>$end_date) {$query_date=$end_date;}
$num_graph_days = ceil(abs(strtotime($end_date) - strtotime($query_date)) / 86400)+1;
$CSV_text="";
if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="total call count in and out") {
download_max_system_stats($campaign_id,$num_graph_days,'system','total_calls','total call count in and out',$end_date);
}
if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="total inbound call count") {
download_max_system_stats($campaign_id,$num_graph_days,'system','total_calls_inbound_all','total inbound call count',$end_date);
}
if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="total outbound call count") {
download_max_system_stats($campaign_id,$num_graph_days,'system','total_calls_outbound_all','total outbound call count',$end_date);
}
if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent calls in and out") {
download_max_system_stats($campaign_id,$num_graph_days,'system','(max_inbound + max_outbound)','most concurrent calls in and out',$end_date);
}
if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent calls inbound total") {
download_max_system_stats($campaign_id,$num_graph_days,'system','max_inbound','most concurrent calls inbound total',$end_date);
}
if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent calls outbound total") {
download_max_system_stats($campaign_id,$num_graph_days,'system','max_outbound','most concurrent calls outbound total',$end_date);
}
if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent agents") {
download_max_system_stats($campaign_id,$num_graph_days,'system','max_agents','most concurrent agents',$end_date);
}
$FILE_TIME = date("Ymd-His");
$CSVfilename = "MAX_SYSTEM_STATS_$US$FILE_TIME.csv";
$CSV_text=preg_replace('/ +\"/', '"', $CSV_text);
$CSV_text=preg_replace('/\" +/', '"', $CSV_text);
header('Content-type: application/octet-stream');
header("Content-Disposition: attachment; filename=\"$CSVfilename\"");
header('Expires: 0');
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Pragma: public');
ob_clean();
flush();
echo "$CSV_text";
exit;
}
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,allow_emails,level_8_disable_add FROM system_settings;";
$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,allow_emails,level_8_disable_add,pass_key FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
@@ -1911,10 +1860,28 @@ if ($qm_conf_ct > 0)
$SSsvn_revision = $row[34];
$SSallow_emails = $row[35];
$SSlevel_8_disable_add = $row[36];
$SSpass_key = $row[37];
}
##### END SETTINGS LOOKUP #####
###########################################
### populate pass_key if not set
if ( ($qm_conf_ct > 0) and (strlen($SSpass_key)<16) )
{
$SSpass_key = '';
$possible = "0123456789abcdefghijklmnpqrstvwxyzABCDEFGHIJKLMNPQRSTUVWXYZ";
$i = 0;
$length = 16;
while ($i < $length)
{
$char = substr($possible, mt_rand(0, strlen($possible)-1), 1);
$SSpass_key .= $char;
$i++;
}
$stmt="UPDATE system_settings set pass_key='$SSpass_key' where ( (pass_key is NULL) or (pass_key='') );";
$rslt=mysql_query($stmt, $link);
}
######################################################################################################
######################################################################################################
@@ -3248,12 +3215,14 @@ else
# 130510-1350 - Added outbound state call time holidays functionality
# 130605-0841 - Converted ereg to preg
# - Added display of agent login information on User Modify screen, and reset of failed_logins on update
# 130615-2124 - Added login lockout for 15 minutes after 10 failed logins, and other security fixes
# 130627-0745 - Added url log, lagged log and user group login reports to admin utilities page
#
# make sure you have added a user to the vicidial_users MySQL table with at least user_level 8 to access this page the first time
$admin_version = '2.8-404a';
$build = '130605-0841';
$admin_version = '2.8-406a';
$build = '130627-0745';
$STARTtime = date("U");
$SQLdate = date("Y-m-d H:i:s");
@@ -3303,10 +3272,10 @@ if ($force_logout)
{
if( (strlen($PHP_AUTH_USER)>0) or (strlen($PHP_AUTH_PW)>0) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
}
echo "You have now logged out. Thank you\n";
echo "You have now logged out. Thank you\n<BR>To log back in, <a href=\"$PHP_SELF\">click here</a>";
exit;
}
#############################################
@@ -3331,202 +3300,285 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and active='Y';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and active='Y' and view_reports='1';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
$user_auth=0;
$auth=0;
$reports_auth=0;
$qc_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1);
if ($auth_message == 'GOOD')
{$user_auth=1;}
$reports_only_user=0;
if ( ($reports_auth > 0) and ($auth < 1) )
if ($user_auth > 0)
{
$ADD=999999;
$reports_only_user=1;
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 1 and qc_enabled > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$qc_auth=$row[0];
$reports_only_user=0;
$qc_only_user=0;
if ( ($reports_auth > 0) and ($auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
if ( ($qc_auth > 0) and ($reports_auth < 1) and ($auth < 1) )
{
if ( ($ADD != '881') and ($ADD != '100000000000000') )
{
$ADD=100000000000000;
}
$qc_only_user=1;
}
if ( ($qc_auth < 1) and ($reports_auth < 1) and ($auth < 1) )
{
$VDdisplayMESSAGE = "You do not have permission to be here";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##############################################
# Include QC Agents with no other permission #
##############################################
require_once('qc/QC_admin_include02.php');
if ($SSwebroot_writable > 0)
{$fp = fopen ("./project_auth_entries.txt", "a");}
$stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,callcard_admin,force_change_password,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,modify_contacts,modify_same_user_level from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfull_name =$row[3];
$LOGuser_level =$row[4];
$LOGuser_group =$row[5];
$LOGdelete_users =$row[8];
$LOGdelete_user_groups =$row[9];
$LOGdelete_lists =$row[10];
$LOGdelete_campaigns =$row[11];
$LOGdelete_ingroups =$row[12];
$LOGdelete_remote_agents =$row[13];
$LOGload_leads =$row[14];
$LOGcampaign_detail =$row[15];
$LOGast_admin_access =$row[16];
$LOGast_delete_phones =$row[17];
$LOGdelete_scripts =$row[18];
$LOGdelete_filters =$row[29];
$LOGalter_agent_interface =$row[30];
$LOGdelete_call_times =$row[32];
$LOGmodify_call_times =$row[33];
$LOGmodify_users =$row[34];
$LOGmodify_campaigns =$row[35];
$LOGmodify_lists =$row[36];
$LOGmodify_scripts =$row[37];
$LOGmodify_filters =$row[38];
$LOGmodify_ingroups =$row[39];
$LOGmodify_usergroups =$row[40];
$LOGmodify_remoteagents =$row[41];
$LOGmodify_servers =$row[42];
$LOGview_reports =$row[43];
$LOGmodify_dids =$row[56];
$LOGdelete_dids =$row[57];
$LOGmanager_shift_enforcement_override=$row[61];
$LOGexport_reports =$row[64];
$LOGdelete_from_dnc =$row[65];
$LOGcallcard_admin =$row[70];
$LOGforce_change_password =$row[71];
$LOGmodify_shifts =$row[72];
$LOGmodify_phones =$row[73];
$LOGmodify_carriers =$row[74];
$LOGmodify_labels =$row[75];
$LOGmodify_statuses =$row[76];
$LOGmodify_voicemail =$row[77];
$LOGmodify_audiostore =$row[78];
$LOGmodify_moh =$row[79];
$LOGmodify_tts =$row[80];
$LOGmodify_contacts =$row[81];
$LOGmodify_same_user_level =$row[82];
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGallowed_campaigns = $row[0];
$LOGallowed_reports = $row[1];
$LOGadmin_viewable_groups = $row[2];
$LOGadmin_viewable_call_times = $row[3];
if ( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or ( ($auth < 1 ) and ($reports_auth < 1) and ($qc_auth < 1)) )
$LOGallowed_campaignsSQL='';
$whereLOGallowed_campaignsSQL='';
if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
$rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns);
$rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL);
$LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')";
$whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')";
}
$regexLOGallowed_campaigns = " $LOGallowed_campaigns ";
$admin_viewable_groupsALL=0;
$LOGadmin_viewable_groupsSQL='';
$whereLOGadmin_viewable_groupsSQL='';
$valLOGadmin_viewable_groupsSQL='';
$vmLOGadmin_viewable_groupsSQL='';
if ( (!preg_match('/\-\-ALL\-\-/i',$LOGadmin_viewable_groups)) and (strlen($LOGadmin_viewable_groups) > 3) )
{
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ -/",'',$LOGadmin_viewable_groups);
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_groupsSQL);
$LOGadmin_viewable_groupsSQL = "and user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$whereLOGadmin_viewable_groupsSQL = "where user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$valLOGadmin_viewable_groupsSQL = "and val.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$vmLOGadmin_viewable_groupsSQL = "and vm.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
}
else
{$admin_viewable_groupsALL=1;}
$regexLOGadmin_viewable_groups = " $LOGadmin_viewable_groups ";
$LOGadmin_viewable_call_timesSQL='';
$whereLOGadmin_viewable_call_timesSQL='';
if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen($LOGadmin_viewable_call_times) > 3) )
{
$rawLOGadmin_viewable_call_timesSQL = preg_replace("/ -/",'',$LOGadmin_viewable_call_times);
$rawLOGadmin_viewable_call_timesSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_call_timesSQL);
$LOGadmin_viewable_call_timesSQL = "and call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')";
$whereLOGadmin_viewable_call_timesSQL = "where call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')";
}
$regexLOGadmin_viewable_call_times = " $LOGadmin_viewable_call_times ";
$UUgroups_list='';
if ($admin_viewable_groupsALL > 0)
{$UUgroups_list .= "<option value=\"---ALL---\">All Admin User Groups</option>\n";}
$stmt="SELECT user_group,group_name from vicidial_user_groups $whereLOGadmin_viewable_groupsSQL order by user_group;";
$rslt=mysql_query($stmt, $link);
$UUgroups_to_print = mysql_num_rows($rslt);
$o=0;
while ($UUgroups_to_print > $o)
{
$rowx=mysql_fetch_row($rslt);
$UUgroups_list .= "<option value=\"$rowx[0]\">$rowx[0] - $rowx[1]</option>\n";
$o++;
}
$first_login_link=0;
if ($LOGforce_change_password=='Y')
{
$ADD=999997;
$reports_only_user=1;
}
if ($SSfirst_login_trigger=='Y')
{
if ($ADD==999996)
{$reports_only_user=1;}
else
{
$ADD=999995;
$first_login_link=1;
}
}
if ($ADD==999995)
{
$reports_only_user=1;
}
if (($LOGuser_level < 9) and ($SSlevel_8_disable_add > 0))
{$add_copy_disabled++;}
if ($download_max_system_stats_metric_name)
{
if (!$query_date) {$query_date=date("Y-m-d", time()-(29*86400));}
if (!$end_date)
{
$end_date=date("Y-m-d", time());
}
else if (strtotime($end_date)>strtotime(date("Y-m-d")))
{
$end_date=date("Y-m-d");
}
if ($query_date>$end_date) {$query_date=$end_date;}
$num_graph_days = ceil(abs(strtotime($end_date) - strtotime($query_date)) / 86400)+1;
$CSV_text="";
if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="total call count in and out")
{
download_max_system_stats($campaign_id,$num_graph_days,'system','total_calls','total call count in and out',$end_date);
}
if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="total inbound call count")
{
download_max_system_stats($campaign_id,$num_graph_days,'system','total_calls_inbound_all','total inbound call count',$end_date);
}
if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="total outbound call count")
{
download_max_system_stats($campaign_id,$num_graph_days,'system','total_calls_outbound_all','total outbound call count',$end_date);
}
if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent calls in and out")
{
download_max_system_stats($campaign_id,$num_graph_days,'system','(max_inbound + max_outbound)','most concurrent calls in and out',$end_date);
}
if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent calls inbound total")
{
download_max_system_stats($campaign_id,$num_graph_days,'system','max_inbound','most concurrent calls inbound total',$end_date);
}
if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent calls outbound total")
{
download_max_system_stats($campaign_id,$num_graph_days,'system','max_outbound','most concurrent calls outbound total',$end_date);
}
if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent agents")
{
download_max_system_stats($campaign_id,$num_graph_days,'system','max_agents','most concurrent agents',$end_date);
}
$FILE_TIME = date("Ymd-His");
$CSVfilename = "MAX_SYSTEM_STATS_$US$FILE_TIME.csv";
$CSV_text=preg_replace('/ +\"/', '"', $CSV_text);
$CSV_text=preg_replace('/\" +/', '"', $CSV_text);
header('Content-type: application/octet-stream');
header("Content-Disposition: attachment; filename=\"$CSVfilename\"");
header('Expires: 0');
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Pragma: public');
ob_clean();
flush();
echo "$CSV_text";
exit;
}
if ( ($auth > 0) or ($reports_auth > 0) or ($qc_auth > 0) )
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,callcard_admin,force_change_password,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,modify_contacts,modify_same_user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfull_name =$row[3];
$LOGuser_level =$row[4];
$LOGuser_group =$row[5];
$LOGdelete_users =$row[8];
$LOGdelete_user_groups =$row[9];
$LOGdelete_lists =$row[10];
$LOGdelete_campaigns =$row[11];
$LOGdelete_ingroups =$row[12];
$LOGdelete_remote_agents =$row[13];
$LOGload_leads =$row[14];
$LOGcampaign_detail =$row[15];
$LOGast_admin_access =$row[16];
$LOGast_delete_phones =$row[17];
$LOGdelete_scripts =$row[18];
$LOGdelete_filters =$row[29];
$LOGalter_agent_interface =$row[30];
$LOGdelete_call_times =$row[32];
$LOGmodify_call_times =$row[33];
$LOGmodify_users =$row[34];
$LOGmodify_campaigns =$row[35];
$LOGmodify_lists =$row[36];
$LOGmodify_scripts =$row[37];
$LOGmodify_filters =$row[38];
$LOGmodify_ingroups =$row[39];
$LOGmodify_usergroups =$row[40];
$LOGmodify_remoteagents =$row[41];
$LOGmodify_servers =$row[42];
$LOGview_reports =$row[43];
$LOGmodify_dids =$row[56];
$LOGdelete_dids =$row[57];
$LOGmanager_shift_enforcement_override=$row[61];
$LOGexport_reports =$row[64];
$LOGdelete_from_dnc =$row[65];
$LOGcallcard_admin =$row[70];
$LOGforce_change_password =$row[71];
$LOGmodify_shifts =$row[72];
$LOGmodify_phones =$row[73];
$LOGmodify_carriers =$row[74];
$LOGmodify_labels =$row[75];
$LOGmodify_statuses =$row[76];
$LOGmodify_voicemail =$row[77];
$LOGmodify_audiostore =$row[78];
$LOGmodify_moh =$row[79];
$LOGmodify_tts =$row[80];
$LOGmodify_contacts =$row[81];
$LOGmodify_same_user_level =$row[82];
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGallowed_campaigns = $row[0];
$LOGallowed_reports = $row[1];
$LOGadmin_viewable_groups = $row[2];
$LOGadmin_viewable_call_times = $row[3];
$LOGallowed_campaignsSQL='';
$whereLOGallowed_campaignsSQL='';
if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) )
{
$rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns);
$rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL);
$LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')";
$whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')";
}
$regexLOGallowed_campaigns = " $LOGallowed_campaigns ";
$admin_viewable_groupsALL=0;
$LOGadmin_viewable_groupsSQL='';
$whereLOGadmin_viewable_groupsSQL='';
$valLOGadmin_viewable_groupsSQL='';
$vmLOGadmin_viewable_groupsSQL='';
if ( (!preg_match('/\-\-ALL\-\-/i',$LOGadmin_viewable_groups)) and (strlen($LOGadmin_viewable_groups) > 3) )
{
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ -/",'',$LOGadmin_viewable_groups);
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_groupsSQL);
$LOGadmin_viewable_groupsSQL = "and user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$whereLOGadmin_viewable_groupsSQL = "where user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$valLOGadmin_viewable_groupsSQL = "and val.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$vmLOGadmin_viewable_groupsSQL = "and vm.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
}
else
{$admin_viewable_groupsALL=1;}
$regexLOGadmin_viewable_groups = " $LOGadmin_viewable_groups ";
$LOGadmin_viewable_call_timesSQL='';
$whereLOGadmin_viewable_call_timesSQL='';
if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen($LOGadmin_viewable_call_times) > 3) )
{
$rawLOGadmin_viewable_call_timesSQL = preg_replace("/ -/",'',$LOGadmin_viewable_call_times);
$rawLOGadmin_viewable_call_timesSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_call_timesSQL);
$LOGadmin_viewable_call_timesSQL = "and call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')";
$whereLOGadmin_viewable_call_timesSQL = "where call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')";
}
$regexLOGadmin_viewable_call_times = " $LOGadmin_viewable_call_times ";
$UUgroups_list='';
if ($admin_viewable_groupsALL > 0)
{$UUgroups_list .= "<option value=\"---ALL---\">All Admin User Groups</option>\n";}
$stmt="SELECT user_group,group_name from vicidial_user_groups $whereLOGadmin_viewable_groupsSQL order by user_group;";
$rslt=mysql_query($stmt, $link);
$UUgroups_to_print = mysql_num_rows($rslt);
$o=0;
while ($UUgroups_to_print > $o)
{
$rowx=mysql_fetch_row($rslt);
$UUgroups_list .= "<option value=\"$rowx[0]\">$rowx[0] - $rowx[1]</option>\n";
$o++;
}
if ($SSwebroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfull_name|\n");
fclose($fp);
}
$first_login_link=0;
if ($LOGforce_change_password=='Y')
{
$ADD=999997;
$reports_only_user=1;
}
if ($SSfirst_login_trigger=='Y')
{
if ($ADD==999996)
{$reports_only_user=1;}
else
{
$ADD=999995;
$first_login_link=1;
}
}
if ($ADD==999995)
{
$reports_only_user=1;
}
if (($LOGuser_level < 9) and ($SSlevel_8_disable_add > 0))
{$add_copy_disabled++;}
}
else
{
if ($SSwebroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
}
######################################################################################################
######################################################################################################
@@ -14295,6 +14347,9 @@ if ($ADD==21111111111)
$stmtA="UPDATE servers SET rebuild_conf_files='Y' where generate_vicidial_conf='Y' and active_asterisk_server='Y' and server_ip='$server_ip';";
$rslt=mysql_query($stmtA, $link);
$stmtB="UPDATE servers SET rebuild_conf_files='Y' where generate_vicidial_conf='Y' and active_asterisk_server='Y' and server_ip='$SSactive_voicemail_server';";
$rslt=mysql_query($stmtB, $link);
### LOG INSERTION Admin Log Table ###
$SQL_log = "$stmt|";
$SQL_log = preg_replace('/;/', '', $SQL_log);
@@ -18027,6 +18082,9 @@ if ($ADD==41111111111)
$stmtA="UPDATE servers SET rebuild_conf_files='Y' where generate_vicidial_conf='Y' and active_asterisk_server='Y' and server_ip='$server_ip';";
$rslt=mysql_query($stmtA, $link);
$stmtB="UPDATE servers SET rebuild_conf_files='Y' where generate_vicidial_conf='Y' and active_asterisk_server='Y' and server_ip='$SSactive_voicemail_server';";
$rslt=mysql_query($stmtB, $link);
### LOG INSERTION Admin Log Table ###
$SQL_log = "$stmt|";
$SQL_log = preg_replace('/;/', '', $SQL_log);
@@ -20911,6 +20969,9 @@ if ($ADD==61111111111)
$stmtA="UPDATE servers SET rebuild_conf_files='Y' where generate_vicidial_conf='Y' and active_asterisk_server='Y' and server_ip='$server_ip';";
$rslt=mysql_query($stmtA, $link);
$stmtB="UPDATE servers SET rebuild_conf_files='Y' where generate_vicidial_conf='Y' and active_asterisk_server='Y' and server_ip='$SSactive_voicemail_server';";
$rslt=mysql_query($stmtB, $link);
### LOG INSERTION Admin Log Table ###
$SQL_log = "$stmt|";
$SQL_log = preg_replace('/;/', '', $SQL_log);
@@ -36100,11 +36161,16 @@ if ($ADD==999994)
{
echo "<UL>\n";
echo "<LI><a href=\"welcome_languages.php\"><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>Welcome Languages Page</a></FONT>\n";
echo "<LI><a href=\"campaign_debug.php\"><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>Campaign Debug Page</a></FONT>\n";
echo "<LI><a href=\"$PHP_SELF?ADD=999991\"><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>Servers Versions</a></FONT>\n";
echo "<BR><BR>\n";
echo "<LI><a href=\"campaign_debug.php\"><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>Campaign Debug Page</a></FONT>\n";
echo "<LI><a href=\"AST_carrier_log_report.php\"><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>Carrier Log Report</a></FONT>\n";
echo "<LI><a href=\"AST_hangup_cause_report.php\"><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>Hangup Cause Report</a></FONT>\n";
echo "<LI><a href=\"AST_url_log_report.php\"><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>URL Log Report</a></FONT>\n";
echo "<LI><a href=\"AST_LAGGED_log_report.php\"><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>Agent LAGGED Report</a></FONT>\n";
echo "<LI><a href=\"AST_usergroup_login_report.php\"><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>User Group Login Report</a></FONT>\n";
echo "<LI><a href=\"admin.php?ADD=800000000000000\"><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>Admin Report Log Viewer</a></FONT>\n";
echo "<BR><BR>\n";
echo "<LI><a href=\"admin_phones_bulk_insert.php\"><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>Bulk Phone Insert Page</a></FONT>\n";
echo "<LI><a href=\"lead_tools.php\"><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>Basic Lead Management Tools</a></FONT>\n";
echo "<LI><a href=\"callbacks_bulk_change.php\"><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>Callbacks Transferral Page</a></FONT>\n";
agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php
+39 -57
View File
@@ -14,13 +14,14 @@
# 110406-1818 - Updated logging
# 120223-2335 - Removed logging of good login passwords if webroot writable is enabled
# 130610-1116 - Finalized changing of all ereg instances to preg
# 130621-2009 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$admin_version = '2.8-4';
$build = '130610-1116';
$admin_version = '2.8-5';
$build = '130621-2009';
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -38,13 +39,11 @@ if (isset($_GET["lead_order_secondary"])) {$lead_order_secondary=$_GET["lead_o
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
if (strlen($action) < 2)
{$action = 'BLANK';}
if (strlen($DB) < 1)
{$DB=0;}
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,webroot_writable FROM system_settings;";
@@ -77,13 +76,45 @@ else
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
$user = $PHP_AUTH_USER;
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and modify_campaigns='1';";
if ($DB) {echo "|$stmt|\n";}
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT full_name,modify_campaigns,user_level from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$LOGfullname = $row[0];
$LOGmodify_campaigns = $row[1];
$LOGuser_level = $row[2];
if ($LOGmodify_campaigns < 1)
{
Header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions to modify campaigns\n";
exit;
}
$stmt="SELECT count(*) from vicidial_campaigns where campaign_id='$campaign_id' and auto_alt_dial='MULTI_LEAD';";
if ($DB) {echo "|$stmt|\n";}
@@ -91,50 +122,6 @@ $rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$camp_multi=$row[0];
if ($webroot_writable > 0)
{$fp = fopen ("./project_auth_entries.txt", "a");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
$user = $PHP_AUTH_USER;
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
if ($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name,modify_campaigns,user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$LOGmodify_campaigns = $row[1];
$LOGuser_level = $row[2];
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
}
}
?>
<html>
<head>
@@ -167,11 +154,6 @@ $subcamp_color = '#C6C6C6';
require("admin_header.php");
if ( ($LOGast_admin_access < 1) or ($LOGuser_level < 8) )
{
echo "You are not authorized to view this section\n";
exit;
}
if ($camp_multi < 1)
{
echo "This campaign is not set to Auto-Alt-Dial MULTI_LEAD\n";
agc_2-X/trunk/www/vicidial/admin_email_accounts.php
+103 -120
View File
@@ -10,14 +10,16 @@
# 130102-1131 - Small admin log change
# 130221-1754 - Added level 8 disable add feature
# 130610-1041 - Changed all ereg to preg
# 130621-2001 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$admin_version = '2.8-4';
$build = '130610-1041';
$admin_version = '2.8-5';
$build = '130621-2001';
$sh="emails";
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -135,138 +137,125 @@ if ($non_latin < 1)
$email_account_server = preg_replace("/[^\.\-\_0-9a-zA-Z]/","",$email_account_server);
$active = preg_replace("/[^_0-9a-zA-Z]/","",$active);
$email_frequency_check_mins = preg_replace("/[^0-9]/","",$email_frequency_check_mins);
$list_id = preg_replace("/[^0-9]/","",$list_id);
} # end of non_latin
else
{
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
}
$list_id = preg_replace("/[^0-9]/","",$list_id);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$add_copy_disabled=0;
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and modify_email_accounts='1';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if ($webroot_writable > 0)
{$fp = fopen ("./project_auth_entries.txt", "a");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
$user = $PHP_AUTH_USER;
$add_copy_disabled=0;
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
else
$stmt="SELECT full_name,user_level,user_group,modify_email_accounts from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$LOGuser_level = $row[1];
$LOGuser_group = $row[2];
$LOGemails_modify = $row[3];
if ($LOGemails_modify < 1)
{
if ($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name,user_level,user_group,modify_email_accounts from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$LOGuser_level = $row[1];
$LOGuser_group = $row[2];
$LOGemails_modify = $row[3];
if (($LOGuser_level < 9) and ($SSlevel_8_disable_add > 0))
{$add_copy_disabled++;}
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGallowed_campaigns = $row[0];
$LOGallowed_reports = $row[1];
$LOGadmin_viewable_groups = $row[2];
$LOGadmin_viewable_call_times = $row[3];
$admin_viewable_groupsALL=0;
$LOGadmin_viewable_groupsSQL='';
$whereLOGadmin_viewable_groupsSQL='';
$valLOGadmin_viewable_groupsSQL='';
$vmLOGadmin_viewable_groupsSQL='';
if ( (!preg_match("/\-\-ALL\-\-/i",$LOGadmin_viewable_groups)) and (strlen($LOGadmin_viewable_groups) > 3) )
{
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ -/",'',$LOGadmin_viewable_groups);
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_groupsSQL);
$LOGadmin_viewable_groupsSQL = "and user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$whereLOGadmin_viewable_groupsSQL = "where user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$valLOGadmin_viewable_groupsSQL = "and val.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$vmLOGadmin_viewable_groupsSQL = "and vm.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
}
else
{$admin_viewable_groupsALL=1;}
$regexLOGadmin_viewable_groups = " $LOGadmin_viewable_groups ";
$UUgroups_list='';
if ($admin_viewable_groupsALL > 0)
{$UUgroups_list .= "<option value=\"---ALL---\">All Admin User Groups</option>\n";}
$stmt="SELECT user_group,group_name from vicidial_user_groups $whereLOGadmin_viewable_groupsSQL order by user_group;";
$rslt=mysql_query($stmt, $link);
$UUgroups_to_print = mysql_num_rows($rslt);
$o=0;
while ($UUgroups_to_print > $o)
{
$rowx=mysql_fetch_row($rslt);
$UUgroups_list .= "<option value=\"$rowx[0]\">$rowx[0] - $rowx[1]</option>\n";
$o++;
}
$stmt="SELECT group_id,group_name from vicidial_inbound_groups where group_handling='EMAIL' $LOGadmin_viewable_groupsSQL order by group_id;";
# $stmt="SELECT group_id,group_name from vicidial_inbound_groups where group_id NOT IN('AGENTDIRECT') order by group_id";
$rslt=mysql_query($stmt, $link);
$Dgroups_to_print = mysql_num_rows($rslt);
$Dgroups_menu='';
$Dgroups_selected=0;
$o=0;
while ($Dgroups_to_print > $o)
{
$rowx=mysql_fetch_row($rslt);
$Dgroups_menu .= "<option ";
if ($drop_inbound_group == "$rowx[0]")
{
$Dgroups_menu .= "SELECTED ";
$Dgroups_selected++;
}
$Dgroups_menu .= "value=\"$rowx[0]\">$rowx[0] - $rowx[1]</option>\n";
$o++;
}
if ($Dgroups_selected < 1)
{$Dgroups_menu .= "<option SELECTED value=\"---NONE---\">---NONE---</option>\n";}
else
{$Dgroups_menu .= "<option value=\"---NONE---\">---NONE---</option>\n";}
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
}
Header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions to modify email accounts\n";
exit;
}
if (($LOGuser_level < 9) and ($SSlevel_8_disable_add > 0))
{$add_copy_disabled++;}
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGallowed_campaigns = $row[0];
$LOGallowed_reports = $row[1];
$LOGadmin_viewable_groups = $row[2];
$LOGadmin_viewable_call_times = $row[3];
$admin_viewable_groupsALL=0;
$LOGadmin_viewable_groupsSQL='';
$whereLOGadmin_viewable_groupsSQL='';
$valLOGadmin_viewable_groupsSQL='';
$vmLOGadmin_viewable_groupsSQL='';
if ( (!preg_match("/\-\-ALL\-\-/i",$LOGadmin_viewable_groups)) and (strlen($LOGadmin_viewable_groups) > 3) )
{
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ -/",'',$LOGadmin_viewable_groups);
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_groupsSQL);
$LOGadmin_viewable_groupsSQL = "and user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$whereLOGadmin_viewable_groupsSQL = "where user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$valLOGadmin_viewable_groupsSQL = "and val.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$vmLOGadmin_viewable_groupsSQL = "and vm.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
}
else
{$admin_viewable_groupsALL=1;}
$regexLOGadmin_viewable_groups = " $LOGadmin_viewable_groups ";
$UUgroups_list='';
if ($admin_viewable_groupsALL > 0)
{$UUgroups_list .= "<option value=\"---ALL---\">All Admin User Groups</option>\n";}
$stmt="SELECT user_group,group_name from vicidial_user_groups $whereLOGadmin_viewable_groupsSQL order by user_group;";
$rslt=mysql_query($stmt, $link);
$UUgroups_to_print = mysql_num_rows($rslt);
$o=0;
while ($UUgroups_to_print > $o)
{
$rowx=mysql_fetch_row($rslt);
$UUgroups_list .= "<option value=\"$rowx[0]\">$rowx[0] - $rowx[1]</option>\n";
$o++;
}
$stmt="SELECT group_id,group_name from vicidial_inbound_groups where group_handling='EMAIL' $LOGadmin_viewable_groupsSQL order by group_id;";
# $stmt="SELECT group_id,group_name from vicidial_inbound_groups where group_id NOT IN('AGENTDIRECT') order by group_id";
$rslt=mysql_query($stmt, $link);
$Dgroups_to_print = mysql_num_rows($rslt);
$Dgroups_menu='';
$Dgroups_selected=0;
$o=0;
while ($Dgroups_to_print > $o)
{
$rowx=mysql_fetch_row($rslt);
$Dgroups_menu .= "<option ";
if ($drop_inbound_group == "$rowx[0]")
{
$Dgroups_menu .= "SELECTED ";
$Dgroups_selected++;
}
$Dgroups_menu .= "value=\"$rowx[0]\">$rowx[0] - $rowx[1]</option>\n";
$o++;
}
if ($Dgroups_selected < 1)
{$Dgroups_menu .= "<option SELECTED value=\"---NONE---\">---NONE---</option>\n";}
else
{$Dgroups_menu .= "<option value=\"---NONE---\">---NONE---</option>\n";}
?>
<html>
<head>
@@ -298,12 +287,6 @@ $subcamp_color = '#C6C6C6';
require("admin_header.php");
if ( ($LOGemails_modify < 1) or ($LOGuser_level < 8) )
{
echo "You are not authorized to view this section\n";
exit;
}
if ($SSemail_enabled < 1)
{
echo "ERROR: Inbound emails are not active on this system\n";
agc_2-X/trunk/www/vicidial/admin_header.php
+48 -12
View File
@@ -42,6 +42,7 @@
# 121214-2238 - Added email menus
# 130221-1830 - Added Level 8 disable add option
# 130610-1040 - Finalized changing of all ereg instances to preg
# 130615-2314 - Changed Reports only and QC only headers
#
@@ -51,8 +52,10 @@ if($short_header)
?>
<TABLE CELLPADDING=0 CELLSPACING=0 BGCOLOR="#015B91"><TR>
<TD><IMG SRC="vicidial_admin_web_logo_small.gif" WIDTH=71 HEIGHT=22 ALT="System logo"> &nbsp; </TD>
<?php if ($reports_only_user < 1) {
?>
<?php
if ( ($reports_only_user < 1) and ($qc_only_user < 1) )
{
?>
<TD> &nbsp; <A HREF="admin.php" ALT="Users"><FONT FACE="ARIAL,HELVETICA" COLOR=WHITE SIZE=2><B>Users</B></A> &nbsp; </TD>
<TD> &nbsp; <A HREF="admin.php?ADD=10" ALT="Campaigns"><FONT FACE="ARIAL,HELVETICA" COLOR=WHITE SIZE=2><B>Campaigns</B></A> &nbsp; </TD>
<?php include 'qc/QC_header_include02.php'; ?>
@@ -63,13 +66,26 @@ if($short_header)
<TD> &nbsp; <A HREF="admin.php?ADD=100000" ALT="User Groups"><FONT FACE="ARIAL,HELVETICA" COLOR=WHITE SIZE=2><B>User Groups</B></A> &nbsp; </TD>
<TD> &nbsp; <A HREF="admin.php?ADD=10000" ALT="Remote Agents"><FONT FACE="ARIAL,HELVETICA" COLOR=WHITE SIZE=2><B>Remote Agents</B></A> &nbsp; </TD>
<TD> &nbsp; <A HREF="admin.php?ADD=999998" ALT="Admin"><FONT FACE="ARIAL,HELVETICA" COLOR=WHITE SIZE=2><B>Admin</B></A> &nbsp; </TD>
<TD> &nbsp; <A HREF="admin.php?ADD=999999" ALT="Reports"><FONT FACE="ARIAL,HELVETICA" COLOR=WHITE SIZE=2><B>Reports</B></A> &nbsp; </TD>
<?php
}
else
{ ?>
<TD width=600> &nbsp; &nbsp; </TD>
<?php } ?>
<TD> &nbsp; <A HREF="admin.php?ADD=999999" ALT="Reports"><FONT FACE="ARIAL,HELVETICA" COLOR=WHITE SIZE=2><B>Reports</B></A> &nbsp; </TD>
{
?>
<TD width=600> &nbsp; &nbsp; </TD>
<?php
if ($reports_only_user > 0)
{
?>
<TD> &nbsp; <A HREF="admin.php?ADD=999999" ALT="Reports"><FONT FACE="ARIAL,HELVETICA" COLOR=WHITE SIZE=2><B>Reports</B></A> &nbsp; </TD>
<?php
}
else
{
include 'qc/QC_header_include02.php';
}
}
?>
</TR>
</TABLE>
<?php
@@ -1080,8 +1096,10 @@ $SSlevel_8_disable_add = $row[5];
<IMG SRC="./vicidial_admin_web_logo.gif" WIDTH=170 HEIGHT=45 ALT="System logo">
<B><FONT FACE="ARIAL,HELVETICA" COLOR=white>ADMINISTRATION</FONT></B><BR>
<TABLE CELLPADDING=2 CELLSPACING=0 BGCOLOR=#015B91 WIDTH=160>
<?php if ($reports_only_user < 1) {
?>
<?php
if ( ($reports_only_user < 1) and ($qc_only_user < 1) )
{
?>
<!-- USERS NAVIGATION -->
<TR WIDTH=160><TD <?php echo $users_hh ?> WIDTH=160>
<a href="<?php echo $ADMIN ?>?ADD=0"><FONT FACE="ARIAL,HELVETICA" COLOR=<?php echo $users_fc ?> SIZE=<?php echo $header_font_size ?>><?php echo $users_bold ?>Users</a>
@@ -1482,13 +1500,31 @@ $SSlevel_8_disable_add = $row[5];
<?php }
}
?>
<!-- REPORTS NAVIGATION -->
<TR><TD <?php echo $reports_hh ?>>
<a href="<?php echo $ADMIN ?>?ADD=999999"><FONT FACE="ARIAL,HELVETICA" COLOR=<?php echo $reports_fc ?> SIZE=<?php echo $header_font_size ?>><?php echo $reports_bold ?> Reports </a>
</TD></TR>
<?php
}
else
{
if ($reports_only_user > 0)
{
?>
<!-- REPORTS NAVIGATION -->
<TR><TD <?php echo $reports_hh ?>>
<a href="<?php echo $ADMIN ?>?ADD=999999"><FONT FACE="ARIAL,HELVETICA" COLOR=<?php echo $reports_fc ?> SIZE=<?php echo $header_font_size ?>><?php echo $reports_bold ?> Reports </a>
</TD></TR>
<?php
}
else
{
include 'qc/QC_header_include.php';
}
}
?>
<!-- REPORTS NAVIGATION -->
<TR><TD <?php echo $reports_hh ?>>
<a href="<?php echo $ADMIN ?>?ADD=999999"><FONT FACE="ARIAL,HELVETICA" COLOR=<?php echo $reports_fc ?> SIZE=<?php echo $header_font_size ?>><?php echo $reports_bold ?> Reports </a>
</TD></TR>
<TR><TD> &nbsp; </TD></TR>
</TABLE>
</TD><TD VALIGN=TOP WIDTH=<?php echo $page_width ?> BGCOLOR=#D9E6FE>
agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php
+34 -55
View File
@@ -1,5 +1,5 @@
<?php
# admin_listloader_fourth_gen.php - version 2.6
# admin_listloader_fourth_gen.php - version 2.8
# (based upon - new_listloader_superL.php script)
#
# Copyright (C) 2013 Matt Florell,Joe Johnson <vicidial@gmail.com> LICENSE: AGPLv2
@@ -49,14 +49,14 @@
# 120529-1348 - Filename filter fix
# 130420-2056 - Added NANPA prefix validation and timezone options
# 130610-0920 - Finalized changing of all ereg instances to preg
# 130621-1817 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$version = '2.6-47';
$build = '130420-2056';
$version = '2.8-48';
$build = '130621-1817';
require("dbconnect.php");
require("functions.php");
$US='_';
@@ -181,74 +181,54 @@ if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$list_id_override = preg_replace('/[^0-9]/','',$list_id_override);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$list_id_override = preg_replace('/[^0-9]/','',$list_id_override);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$FILE_datetime = $STARTtime;
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if ($webroot_writable > 0) {$fp = fopen ("./project_auth_entries.txt", "a");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICIDIAL-LEAD-LOADER\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
header ("Content-type: text/html; charset=utf-8");
header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header ("Pragma: no-cache"); // HTTP/1.0
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if($auth>0)
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT load_leads,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGload_leads = $row[0];
$LOGuser_group = $row[1];
if ($LOGload_leads < 1)
{
echo "You do not have permissions to load leads\n";
exit;
}
if ($webroot_writable > 0)
{
fwrite ($fp, "LIST_LOAD|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($webroot_writable > 0)
{
fwrite ($fp, "LIST_LOAD|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT load_leads,user_group from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGload_leads = $row[0];
$LOGuser_group = $row[1];
if ($LOGload_leads < 1)
{
Header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions to load leads\n";
exit;
}
if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig))
@@ -257,7 +237,6 @@ if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig))
exit;
}
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
agc_2-X/trunk/www/vicidial/admin_listloader_third_gen.php
+34 -54
View File
@@ -2,7 +2,7 @@
# admin_listloader_third_gen.php - version 2.8
# (based upon - new_listloader_superL.php script)
#
# Copyright (C) 2012 Matt Florell,Joe Johnson <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2013 Matt Florell,Joe Johnson <vicidial@gmail.com> LICENSE: AGPLv2
#
# ViciDial web-based lead loader from formatted file
#
@@ -47,14 +47,14 @@
# 120525-1037 - Added uploaded filename filtering
# 120529-1347 - Filename filter fix
# 130610-1055 - Finalized changing of all ereg instances to preg
# 130621-1815 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$version = '2.8-46';
$build = '130610-1055';
$version = '2.8-47';
$build = '130621-1815';
require("dbconnect.php");
require("functions.php");
$US='_';
@@ -177,74 +177,54 @@ if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$list_id_override = preg_replace('/[^0-9]/','',$list_id_override);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$list_id_override = preg_replace('/[^0-9]/','',$list_id_override);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$FILE_datetime = $STARTtime;
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if ($webroot_writable > 0) {$fp = fopen ("./project_auth_entries.txt", "a");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICIDIAL-LEAD-LOADER\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
header ("Content-type: text/html; charset=utf-8");
header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header ("Pragma: no-cache"); // HTTP/1.0
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if($auth>0)
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT load_leads,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGload_leads = $row[0];
$LOGuser_group = $row[1];
if ($LOGload_leads < 1)
{
echo "You do not have permissions to load leads\n";
exit;
}
if ($webroot_writable > 0)
{
fwrite ($fp, "LIST_LOAD|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($webroot_writable > 0)
{
fwrite ($fp, "LIST_LOAD|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT load_leads,user_group from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGload_leads = $row[0];
$LOGuser_group = $row[1];
if ($LOGload_leads < 1)
{
Header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions to load leads\n";
exit;
}
if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig))
agc_2-X/trunk/www/vicidial/admin_lists_custom.php
+47 -55
View File
@@ -26,13 +26,14 @@
# 120907-1209 - Raised extended fields up to 99
# 130508-1020 - Added default field and length check validation, made errors appear in bold red text
# 130606-0545 - Finalized changing of all ereg instances to preg
# 130621-1736 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$admin_version = '2.8-19';
$build = '130606-0545';
$admin_version = '2.8-20';
$build = '130621-1736';
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -90,8 +91,7 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
$i=0;
while ($i < $qm_conf_ct)
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
@@ -99,12 +99,10 @@ while ($i < $qm_conf_ct)
$SSoutbound_autodial_active = $row[2];
$user_territories_active = $row[3];
$SScustom_fields_enabled = $row[4];
$i++;
}
##### END SETTINGS LOOKUP #####
###########################################
if ( (strlen($action) < 2) and ($list_id > 99) )
{$action = 'MODIFY_CUSTOM_FIELDS';}
if (strlen($action) < 2)
@@ -118,7 +116,6 @@ if ( (strlen($field_size) < 1) or ($field_size < 1) )
if ( (strlen($field_max) < 1) or ($field_max < 1) )
{$field_max = 1;}
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
@@ -156,6 +153,10 @@ else
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
$user = $PHP_AUTH_USER;
if (file_exists('options.php'))
{require('options.php');}
@@ -170,57 +171,48 @@ if ($extended_vl_fields > 0)
$mysql_reserved_words =
'|accessible|action|add|all|alter|analyze|and|as|asc|asensitive|before|between|bigint|binary|bit|blob|both|by|call|cascade|case|change|char|character|check|collate|column|condition|constraint|continue|convert|create|cross|current_date|current_time|current_timestamp|current_user|cursor|database|databases|date|day_hour|day_microsecond|day_minute|day_second|dec|decimal|declare|default|delayed|delete|desc|describe|deterministic|distinct|distinctrow|div|double|drop|dual|each|else|elseif|enclosed|enum|escaped|exists|exit|explain|false|fetch|float|float4|float8|for|force|foreign|from|fulltext|grant|group|having|high_priority|hour_microsecond|hour_minute|hour_second|if|ignore|in|index|infile|inner|inout|insensitive|insert|int|int1|int2|int3|int4|int8|integer|interval|into|is|iterate|join|key|keys|kill|leading|leave|left|like|limit|linear|lines|load|localtime|localtimestamp|lock|long|longblob|longtext|loop|low_priority|master_ssl_verify_server_cert|match|mediumblob|mediumint|mediumtext|middleint|minute_microsecond|minute_second|mod|modifies|mysql|natural|no|no_write_to_binlog|not|null|numeric|on|optimize|option|optionally|or|order|out|outer|outfile|precision|primary|procedure|purge|range|read|read_only|read_write|reads|real|references|regexp|release|remove|rename|repeat|replace|require|restrict|return|revoke|right|rlike|schema|schemas|second_microsecond|select|sensitive|separator|set|show|smallint|spatial|specific|sql|sql_big_result|sql_calc_found_rows|sql_small_result|sqlexception|sqlstate|sqlwarning|ssl|starting|straight_join|table|terminated|text|then|time|timestamp|tinyblob|tinyint|tinytext|to|trailing|trigger|true|undo|union|unique|unlock|unsigned|update|usage|use|using|utc_date|utc_time|utc_timestamp|values|varbinary|varchar|varcharacter|varying|when|where|while|with|write|xor|year_month|zerofill|';
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and modify_leads='1';";
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$rights_stmt = "SELECT modify_leads from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rights_rslt=mysql_query($rights_stmt, $link);
$rights_row=mysql_fetch_row($rights_rslt);
$modify_leads = $rights_row[0];
# check their permissions
if ( $modify_leads < 1 )
{
header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions to modify leads\n";
exit;
}
$stmt="SELECT full_name,modify_leads,custom_fields_modify,user_level from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if ($webroot_writable > 0)
{$fp = fopen ("./project_auth_entries.txt", "a");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
$user = $PHP_AUTH_USER;
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
if ($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name,modify_leads,custom_fields_modify,user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$LOGmodify_leads = $row[1];
$LOGcustom_fields_modify = $row[2];
$LOGuser_level = $row[3];
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
}
}
$LOGfullname = $row[0];
$LOGmodify_leads = $row[1];
$LOGcustom_fields_modify = $row[2];
$LOGuser_level = $row[3];
?>
<html>
agc_2-X/trunk/www/vicidial/admin_modify_lead.php
+47 -51
View File
@@ -53,9 +53,11 @@
# 121222-2145 - Added email log
# 130123-1940 - Added options.php option to allow display of non-selectable statuses
# 130610-1049 - Finalized changing of all ereg instances to preg
# 130621-1731 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -163,12 +165,12 @@ if (isset($_POST["appointment_time"])) {$appointment_time=$_POST["appointment_
if (isset($_GET["CBstatus"])) {$CBstatus=$_GET["CBstatus"];}
elseif (isset($_POST["CBstatus"])) {$CBstatus=$_POST["CBstatus"];}
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
$nonselectable_statuses=0;
if (file_exists('options.php'))
@@ -214,56 +216,50 @@ else
if (strlen($phone_number)<6) {$phone_number=$old_phone;}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and modify_leads='1';";
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$rights_stmt = "SELECT modify_leads from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rights_rslt=mysql_query($rights_stmt, $link);
$rights_row=mysql_fetch_row($rights_rslt);
$modify_leads = $rights_row[0];
# check their permissions
if ( $modify_leads < 1 )
{
header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions to modify leads\n";
exit;
}
$stmt="SELECT full_name,modify_leads,admin_hide_lead_data,admin_hide_phone_data,user_group,user_level from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if ($webroot_writable > 0)
{$fp = fopen ("./project_auth_entries.txt", "a");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
if($auth>0)
{
$stmt="SELECT full_name,modify_leads,admin_hide_lead_data,admin_hide_phone_data,user_group,user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$LOGmodify_leads = $row[1];
$LOGadmin_hide_lead_data = $row[2];
$LOGadmin_hide_phone_data = $row[3];
$LOGuser_group = $row[4];
$LOGuser_level = $row[5];
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
}
}
$LOGfullname = $row[0];
$LOGmodify_leads = $row[1];
$LOGadmin_hide_lead_data = $row[2];
$LOGadmin_hide_phone_data = $row[3];
$LOGuser_group = $row[4];
$LOGuser_level = $row[5];
$LOGallowed_listsSQL='';
$stmt="SELECT allowed_campaigns from vicidial_user_groups where user_group='$LOGuser_group';";
@@ -1457,7 +1453,7 @@ else
echo "</TABLE><BR><BR>\n";
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 9 and modify_leads='1';";
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level >= 9 and modify_leads='1';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
agc_2-X/trunk/www/vicidial/admin_phones_bulk_insert.php
+64 -69
View File
@@ -1,7 +1,7 @@
<?php
# admin_phones_bulk_insert.php
#
# Copyright (C) 2012 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2013 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# this screen will insert phones into your multi-server system with aliases
#
@@ -13,13 +13,14 @@
# 120223-2249 - Removed logging of good login passwords if webroot writable is enabled
# 120820-1026 - Added webphone option Y_API_LAUNCH
# 130610-1043 - Changed all ereg to preg
# 130621-1724 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$admin_version = '2.8-7';
$build = '130610-1043';
$admin_version = '2.8-8';
$build = '130621-1724';
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -57,12 +58,32 @@ if (isset($_GET["use_external_server_ip"])) {$use_external_server_ip=$_GET["us
if (isset($_GET["phone_context"])) {$phone_context=$_GET["phone_context"];}
elseif (isset($_POST["phone_context"])) {$phone_context=$_POST["phone_context"];}
if (strlen($action) < 2)
{$action = 'BLANK';}
if (strlen($DB) < 1)
{$DB=0;}
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,webroot_writable FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$ss_conf_ct = mysql_num_rows($rslt);
if ($ss_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
}
##### END SETTINGS LOOKUP #####
###########################################
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if ($non_latin < 1)
{
@@ -90,77 +111,51 @@ else
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
}
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,webroot_writable FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$ss_conf_ct = mysql_num_rows($rslt);
if ($ss_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
}
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and ast_delete_phones='1';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if ($webroot_writable > 0)
{$fp = fopen ("./project_auth_entries.txt", "a");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
$user = $PHP_AUTH_USER;
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
if ($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name,ast_delete_phones,ast_admin_access,user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$LOGast_delete_phones = $row[1];
$LOGast_admin_access = $row[2];
$LOGuser_level = $row[3];
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$rights_stmt = "SELECT ast_delete_phones from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rights_rslt=mysql_query($rights_stmt, $link);
$rights_row=mysql_fetch_row($rights_rslt);
$ast_delete_phones = $rights_row[0];
# check their permissions
if ( $ast_delete_phones < 1 )
{
header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions to manage phones\n";
exit;
}
$stmt="SELECT full_name,ast_delete_phones,ast_admin_access,user_level from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$LOGast_delete_phones = $row[1];
$LOGast_admin_access = $row[2];
$LOGuser_level = $row[3];
?>
<html>
<head>
agc_2-X/trunk/www/vicidial/admin_search_lead.php
+51 -48
View File
@@ -31,9 +31,11 @@
# 120409-1131 - Added option for log searches done through slave DB server
# 121025-1732 - Added owner field search option
# 130610-1054 - Finalized changing of all ereg instances to preg
# 130621-1714 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -75,8 +77,7 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
$i=0;
while ($i < $qm_conf_ct)
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
@@ -85,76 +86,78 @@ while ($i < $qm_conf_ct)
$user_territories_active = $row[3];
$slave_db_server = $row[4];
$reports_use_slave_db = $row[5];
$i++;
}
##### END SETTINGS LOOKUP #####
###########################################
$report_name = 'Search Leads Logs';
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$phone = preg_replace('/[^0-9]/','',$phone);
if (strlen($alt_phone_search) < 2) {$alt_phone_search='No';}
$vicidial_list_fields = 'lead_id,entry_date,modify_date,status,user,vendor_lead_code,source_id,list_id,gmt_offset_now,called_since_last_reset,phone_code,phone_number,title,first_name,middle_initial,last_name,address1,address2,address3,city,state,province,postal_code,country_code,gender,date_of_birth,alt_phone,email,security_phrase,comments,called_count,last_local_call_time,rank,owner';
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$vicidial_list_fields = 'lead_id,entry_date,modify_date,status,user,vendor_lead_code,source_id,list_id,gmt_offset_now,called_since_last_reset,phone_code,phone_number,title,first_name,middle_initial,last_name,address1,address2,address3,city,state,province,postal_code,country_code,gender,date_of_birth,alt_phone,email,security_phrase,comments,called_count,last_local_call_time,rank,owner';
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and modify_leads='1';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if ($webroot_writable > 0)
{$fp = fopen ("./project_auth_entries.txt", "a");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if (strlen($alt_phone_search) < 2) {$alt_phone_search='No';}
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
if ($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name,modify_leads,admin_hide_lead_data,admin_hide_phone_data,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$LOGmodify_leads = $row[1];
$LOGadmin_hide_lead_data = $row[2];
$LOGadmin_hide_phone_data = $row[3];
$LOGuser_group = $row[4];
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$phone = preg_replace('/[^0-9]/','',$phone);
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$rights_stmt = "SELECT modify_leads from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rights_rslt=mysql_query($rights_stmt, $link);
$rights_row=mysql_fetch_row($rights_rslt);
$modify_leads = $rights_row[0];
# check their permissions
if ( $modify_leads < 1 )
{
header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions to search leads\n";
exit;
}
$stmt="SELECT full_name,modify_leads,admin_hide_lead_data,admin_hide_phone_data,user_group from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$LOGmodify_leads = $row[1];
$LOGadmin_hide_lead_data = $row[2];
$LOGadmin_hide_phone_data = $row[3];
$LOGuser_group = $row[4];
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
if ($DB) {echo "|$stmt|\n";}
agc_2-X/trunk/www/vicidial/audio_store.php
+53 -20
View File
@@ -17,14 +17,16 @@
# 121019-0816 - Added audio file delete process
# 121129-1620 - Hide delete option text if not allowed
# 130610-1052 - Finalized changing of all ereg instances to preg
# 130620-1729 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$version = '2.8-11';
$build = '130610-1052';
$version = '2.8-12';
$build = '130620-1729';
$MT[0]='';
require("dbconnect.php");
require("functions.php");
$server_name = getenv("SERVER_NAME");
$PHP_SELF=$_SERVER['PHP_SELF'];
@@ -138,33 +140,64 @@ if ( (!preg_match("/\|$ip\|/", $server_ips)) and ($formIPvalid < 1) )
$user_set=1;
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$delete_file = preg_replace('/[^-\._0-9a-zA-Z]/','',$delete_file);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and ( (modify_campaigns='1') or (modify_audiostore='1') )";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 8 and ( (ast_admin_access='1') and (modify_audiostore='1') )";
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and( (modify_campaigns='1') or (modify_audiostore='1') );";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
if ($admin_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to upload audio files";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 8 and ( (ast_admin_access='1') and (modify_audiostore='1') )";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth_delete=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|\n";
exit;
}
}
$delete_message='';
### delete a file from the audio store
if ( ($action == "DELETE") and ($auth_delete > 0) )
agc_2-X/trunk/www/vicidial/call_report_export.php
+74 -29
View File
@@ -35,11 +35,13 @@
# 111104-1240 - Added user_group restrictions for selecting in-groups
# 130414-0122 - Added report logging
# 130610-0952 - Finalized changing of all ereg instances to preg
# 130620-1725 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -102,29 +104,78 @@ if ($qm_conf_ct > 0)
}
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and export_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
# Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password or no export report permission: |$PHP_AUTH_USER|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT export_reports,user_group from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGexport_reports = $row[0];
$LOGuser_group = $row[1];
if ($LOGexport_reports < 1)
{
Header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions for export reports: |$PHP_AUTH_USER|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -156,12 +207,6 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
# echo "<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGuser_group = $row[0];
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
@@ -173,7 +218,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/callbacks_bulk_change.php
+53 -54
View File
@@ -7,11 +7,11 @@
# 120819-0119 - First build
# 130414-0021 - Added admin logging
# 130610-0951 - Finalized changing of all ereg instances to preg
# 130620-0902 - Added filtering of input to prevent SQL injection attacks and new user auth
#
header ("Content-type: text/html; charset=utf-8");
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -39,80 +39,79 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active FROM sys
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
$i=0;
while ($i < $qm_conf_ct)
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
$SSoutbound_autodial_active = $row[2];
$i++;
}
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$StarTtimE = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$ip = getenv("REMOTE_ADDR");
if (!isset($begin_date)) {$begin_date = $TODAY;}
if (!isset($end_date)) {$end_date = $TODAY;}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';";
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$fp = fopen ("./project_auth_entries.txt", "a");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
if($auth>0)
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$stmt="SELECT full_name,change_agent_campaign,modify_timeclock_log,user_group,user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$change_agent_campaign = $row[1];
$modify_timeclock_log = $row[2];
$LOGuser_group = $row[3];
$user_level=$row[4];
if ($user_level==9)
{
$ul_clause="where user_level<=9";
} else {
$ul_clause="where user_level<$user_level";
}
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT full_name,change_agent_campaign,modify_timeclock_log,user_group,user_level,modify_leads from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$change_agent_campaign = $row[1];
$modify_timeclock_log = $row[2];
$LOGuser_group = $row[3];
$user_level = $row[4];
$LOGmodify_leads = $row[5];
if ($user_level==9)
{
$ul_clause="where user_level<=9";
}
else
{
$ul_clause="where user_level<$user_level";
}
if ($LOGmodify_leads < 1)
{
Header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions to modify leads: |$PHP_AUTH_USER|\n";
exit;
}
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
agc_2-X/trunk/www/vicidial/callcard_admin.php
+97 -50
View File
@@ -14,14 +14,16 @@
# 100823-1342 - Added Search option and display for level 7 users, added pin number search
# 120117-1457 - Security fix, issue #544
# 130610-1103 - Finalized changing of all ereg instances to preg
# 130620-0839 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$version = '2.8-6';
$build = '130610-1103';
$version = '2.8-7';
$build = '130620-0839';
$MT[0]='';
require("dbconnect.php");
require("functions.php");
$PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["action"])) {$action=$_GET["action"];}
@@ -73,11 +75,6 @@ if (isset($_GET["user"])) {$user=$_GET["user"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
header ("Content-type: text/html; charset=utf-8");
header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header ("Pragma: no-cache"); // HTTP/1.0
$report_name = 'CallCard Search';
$SEARCHONLY=0;
@@ -110,7 +107,7 @@ if ($non_latin < 1)
$action = preg_replace('/[^\_0-9a-zA-Z]/','',$action);
$card_id = preg_replace('/[^-\_0-9]/','',$card_id);
$run = preg_replace('/[^0-9]/','',$run);
$batch = preg_replace('/[^0-9]/','',$batch);
$batch = preg_replace('/[^0-9a-zA-Z]/','',$batch);
$pack = preg_replace('/[^0-9]/','',$pack);
$sequence = preg_replace('/[^0-9]/','',$sequence);
$territory_description = preg_replace('/[^- \_\.\,0-9a-zA-Z]/','',$territory_description);
@@ -130,57 +127,103 @@ else
{
$USER=$_SERVER['PHP_AUTH_USER'];
$PASS=$_SERVER['PHP_AUTH_PW'];
$USER = preg_replace('/[^0-9a-zA-Z]/','',$USER);
$PASS = preg_replace('/[^0-9a-zA-Z]/','',$PASS);
}
$stmt="SELECT count(*) from vicidial_users where user='$USER' and pass='$PASS' and user_level > 7 and callcard_admin='1' and active='Y';";
if ($non_latin < 1)
{
$USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $USER);
$PASS = preg_replace('/[^-_0-9a-zA-Z]/', '', $PASS);
}
else
{
$PASS = preg_replace("/'|\"|\\\\|;/","",$PASS);
$USER = preg_replace("/'|\"|\\\\|;/","",$USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($USER,$PASS,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$admin_auth=$row[0];
if( (strlen($USER)<2) or (strlen($PASS)<2) or (!$auth))
$stmt="SELECT count(*) from vicidial_users where user='$USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$stmt="SELECT count(*) from vicidial_users where user='$USER' and pass='$PASS' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$authreport=$row[0];
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$USER|$PASS|$auth_message|\n";
exit;
}
if ($authreport > 0)
{
$stmt="SELECT full_name,user_group from vicidial_users where user='$USER' and pass='$PASS';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$LOGuser_group = $row[1];
$stmt="SELECT callcard_admin,user_group,full_name from vicidial_users where user='$USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGcallcard_admin = $row[0];
$LOGuser_group = $row[1];
$LOGfullname = $row[2];
$stmt="SELECT allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGallowed_reports = $row[0];
if($reports_only_user > 0)
{
$stmt="SELECT allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGallowed_reports = $row[0];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
}
else
{
$SEARCHONLY=1;
}
}
else
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$USER|$PASS|\n";
exit;
}
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$USER|$report_name|\n";
exit;
}
else
{
$SEARCHONLY=1;
}
}
else
{
if ($LOGcallcard_admin < 1)
{
Header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions for call card administration: |$USER|\n";
exit;
}
}
@@ -194,6 +237,10 @@ if (strlen($action) < 1)
{$action = 'CALLCARD_SUMMARY';}
header ("Content-type: text/html; charset=utf-8");
header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header ("Pragma: no-cache"); // HTTP/1.0
?>
<html>
agc_2-X/trunk/www/vicidial/callcard_report_export.php
+69 -11
View File
@@ -11,9 +11,11 @@
#
# 100312-2127 - First build
# 130610-1125 - Finalized changing of all ereg instances to preg
# 130620-0835 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -59,22 +61,78 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and callcard_admin='1';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT callcard_admin,user_group from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$LOGcallcard_admin = $row[0];
$LOGuser_group = $row[1];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($LOGcallcard_admin < 1)
{
# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
# Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password or no CallCard permission: |$PHP_AUTH_USER|\n";
exit;
Header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions for call card administration: |$PHP_AUTH_USER|\n";
exit;
}
agc_2-X/trunk/www/vicidial/campaign_debug.php
+87 -11
View File
@@ -7,6 +7,7 @@
# 110514-1231 - First build
# 130413-2342 - Added report logging
# 130610-0949 - Finalized changing of all ereg instances to preg
# 130620-0829 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -14,6 +15,7 @@ $startMS = microtime();
$report_name='Campaign Debug';
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -27,23 +29,98 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
$SSoutbound_autodial_active = $row[2];
$user_territories_active = $row[3];
}
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1' and modify_campaigns='1';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT modify_campaigns,user_group from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$LOGmodify_campaigns = $row[0];
$LOGuser_group = $row[1];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($LOGmodify_campaigns < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
Header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions for campaign debugging: |$PHP_AUTH_USER|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
$LOGip = getenv("REMOTE_ADDR");
$LOGbrowser = getenv("HTTP_USER_AGENT");
@@ -139,7 +216,6 @@ if (!$group)
else
{
$stmt="select count(*) from vicidial_hopper where campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
agc_2-X/trunk/www/vicidial/closer-fronter_popup.php
+66 -51
View File
@@ -11,9 +11,11 @@
# 90508-0644 - Changed to PHP long tags
# 120223-2124 - Removed logging of good login passwords if webroot writable is enabled
# 130610-1115 - Finalized changing of all ereg instances to preg
# 130620-0824 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -99,8 +101,33 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
$SSoutbound_autodial_active = $row[2];
$user_territories_active = $row[3];
}
##### END SETTINGS LOOKUP #####
###########################################
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
#$DB = '1'; # DEBUG override
$US = '_';
@@ -110,67 +137,55 @@ $NOW_TIME = date("Y-m-d H:i:s");
$REC_TIME = date("Ymd-His");
$FILE_datetime = $STARTtime;
$parked_time = $STARTtime;
# $ext_context = 'default'; defined in dbconnect file
$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 0;";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$fp = fopen ("./project_auth_entries.txt", "a");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($user)<2) or (strlen($pass)<2) or (!$auth))
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICIDIAL-CLOSER\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$user|$pass|\n";
exit;
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
else
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
$fullname = $row[0];
if ( (strlen($customer_zap_channel)>2) and (preg_match('/zap/i',$customer_zap_channel)) )
{
echo "\n<!-- zap channel: $customer_zap_channel -->\n";
echo "\n<!-- session_id: $session_id -->\n";
if($auth>0)
{
$office_no=strtoupper($user);
$password=strtoupper($pass);
$stmt="SELECT full_name from vicidial_users where user='$user' and pass='$pass'";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
$fullname = $row[0];
fwrite ($fp, "VD_CLOSER|GOOD|$date|$user|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
if ( (strlen($customer_zap_channel)>2) and (preg_match('/zap/i',$customer_zap_channel)) )
{
echo "\n<!-- zap channel: $customer_zap_channel -->\n";
echo "\n<!-- session_id: $session_id -->\n";
}
else
{
echo "Bad channel: $customer_zap_channel\n";
echo "Make sure the Zap channel is live and try again\n";
exit;
}
}
else
{
fwrite ($fp, "VD_CLOSER|FAIL|$date|$user|XXXX|$ip|$browser|\n");
fclose($fp);
}
}
else
{
echo "Bad channel: $customer_zap_channel\n";
echo "Make sure the Zap channel is live and try again\n";
exit;
}
echo "<html>\n";
echo "<head>\n";
echo "<title>VICIDIAL FRONTER-CLOSER: Popup</title>\n";
echo "<title>FRONTER-CLOSER: Popup</title>\n";
echo "<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n";
if (preg_match('/CL_UNIV/i',$channel_group))
agc_2-X/trunk/www/vicidial/closer-fronter_popup2.php
+69 -70
View File
@@ -11,9 +11,11 @@
# 90508-0644 - Changed to PHP long tags
# 120223-2124 - Removed logging of good login passwords if webroot writable is enabled
# 130610-1114 - Finalized changing of all ereg instances to preg
# 130620-0823 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -99,8 +101,34 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
$SSoutbound_autodial_active = $row[2];
$user_territories_active = $row[3];
}
##### END SETTINGS LOOKUP #####
###########################################
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
#$DB = '1'; # DEBUG override
$US = '_';
@@ -111,80 +139,57 @@ $REC_TIME = date("Ymd-His");
$FILE_datetime = $STARTtime;
$parked_time = $STARTtime;
# $ext_context = 'default'; defined in dbconnect file
if (!isset($begin_date)) {$begin_date = $TODAY;}
if (!isset($end_date)) {$end_date = $TODAY;}
$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 0;";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if (!$auth)
{
if ( (strlen($PHP_AUTH_USER)>1) and ( (preg_match('/tsr/i',$PHP_AUTH_PW)) or (preg_match('/sales/i',$PHP_AUTH_PW)) ) )
{
$auth=1;
$user = $PHP_AUTH_USER;
$pass = $PHP_AUTH_PW;
}
}
$fp = fopen ("./project_auth_entries.txt", "a");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($user)<2) or (strlen($pass)<2) or (!$auth))
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICIDIAL-CLOSER - $user - $PHP_AUTH_USER\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$user|$pass|\n";
exit;
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
else
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
$fullname = $row[0];
if ( (strlen($customer_zap_channel)>2) and ( (preg_match('/zap/i',$customer_zap_channel)) or (preg_match('/iax/i',$customer_zap_channel)) ) )
{
echo "\n<!-- zap channel: $customer_zap_channel -->\n";
echo "<!-- session_id: $session_id -->\n";
echo "<!-- fronter: $fronter -->\n";
echo "<!-- user: $user -->\n";
if($auth>0)
{
$office_no=strtoupper($user);
$password=strtoupper($pass);
$stmt="SELECT full_name from vicidial_users where user='$user' and pass='$pass'";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
$fullname = $row[0];
fwrite ($fp, "VD_CLOSER|GOOD|$date|$user|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
if ( (strlen($customer_zap_channel)>2) and ( (preg_match('/zap/i',$customer_zap_channel)) or (preg_match('/iax/i',$customer_zap_channel)) ) )
{
echo "\n<!-- zap channel: $customer_zap_channel -->\n";
echo "<!-- session_id: $session_id -->\n";
echo "<!-- fronter: $fronter -->\n";
echo "<!-- user: $user -->\n";
}
else
{
echo "Bad channel: $customer_zap_channel\n";
echo "Make sure the Zap channel is live and try again\n";
exit;
}
}
else
{
fwrite ($fp, "VD_CLOSER|FAIL|$date|$user|XXXX|$ip|$browser|\n");
fclose($fp);
}
}
else
{
echo "Bad channel: $customer_zap_channel\n";
echo "Make sure the Zap channel is live and try again\n";
exit;
}
echo "<html>\n";
echo "<head>\n";
echo "<title>VICIDIAL FRONTER-CLOSER: Popup</title>\n";
echo "<title>FRONTER-CLOSER: Popup</title>\n";
echo "<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n";
if (preg_match('/CL_UNIV/i',$channel_group))
@@ -424,11 +429,5 @@ echo "<font size=0>\n\n\n<br><br><br>\nscript runtime: $RUNtime seconds</font>";
exit;
?>
agc_2-X/trunk/www/vicidial/closer.php
+36 -41
View File
@@ -11,9 +11,11 @@
# 90508-0644 - Changed to PHP long tags
# 120223-2249 - Removed logging of good login passwords if webroot writable is enabled
# 130610-1116 - Finalized changing of all ereg instances to preg
# 130620-0827 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -57,19 +59,27 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
$i=0;
while ($i < $qm_conf_ct)
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
$SSoutbound_autodial_active = $row[2];
$user_territories_active = $row[3];
$i++;
}
##### END SETTINGS LOOKUP #####
###########################################
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
@@ -78,52 +88,37 @@ $STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$popup_page = './closer_popup.php';
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 2;";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$fp = fopen ("./project_auth_entries.txt", "a");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICIDIAL-CLOSER\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
if($auth>0)
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
$fullname = $row[0];
if ($webroot_writable > 0)
{
fwrite ($fp, "VD_CLOSER|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($webroot_writable > 0)
{
fwrite ($fp, "VD_CLOSER|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
$fullname = $row[0];
$color_class[0] = 'green';
$color_class[1] = 'red';
@@ -150,7 +145,7 @@ $color_class[9] = 'orange';
-->
</STYLE>
<TITLE>VICIDIAL CLOSER: Main</TITLE></HEAD>
<TITLE>CLOSER: Main</TITLE></HEAD>
</HEAD>
<BODY BGCOLOR=white marginheight=0 marginwidth=0 leftmargin=0 topmargin=0>
<CENTER><FONT FACE="Courier" COLOR=BLACK SIZE=3>
agc_2-X/trunk/www/vicidial/closer_dispo.php
+38 -49
View File
@@ -12,9 +12,11 @@
# 90508-0644 - Changed to PHP long tags
# 120223-2249 - Removed logging of good login passwords if webroot writable is enabled
# 130610-1114 - Finalized changing of all ereg instances to preg
# 130620-0817 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -92,83 +94,70 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
$i=0;
while ($i < $qm_conf_ct)
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
$SSoutbound_autodial_active = $row[2];
$user_territories_active = $row[3];
$i++;
}
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$FILE_datetime = $STARTtime;
$ext_context = 'demo';
if (!isset($begin_date)) {$begin_date = $TODAY;}
if (!isset($end_date)) {$end_date = $TODAY;}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 2;";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$fp = fopen ("./project_auth_entries.txt", "a");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICIDIAL-CLOSER\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
if($auth>0)
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
$fullname = $row[0];
if ($webroot_writable > 0)
{
fwrite ($fp, "VD_CLOSER|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($webroot_writable > 0)
{
fwrite ($fp, "VD_CLOSER|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
$fullname = $row[0];
?>
<html>
<head>
<title>VICIDIAL CLOSER: Call Disposition</title>
<title>CLOSER: Call Disposition</title>
<?php
echo "<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n";
?>
agc_2-X/trunk/www/vicidial/closer_popup.php
+52 -64
View File
@@ -12,9 +12,11 @@
# 90508-0644 - Changed to PHP long tags
# 120223-2135 - Removed logging of good login passwords if webroot writable is enabled
# 130610-1113 - Finalized changing of all ereg instances to preg
# 130620-0010 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -22,9 +24,9 @@ $PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["group"])) {$group=$_GET["group"];}
elseif (isset($_POST["group"])) {$group=$_POST["group"];}
if (isset($_GET["group_selected"])) {$group_selected=$_GET["group_selected"];}
elseif (isset($_POST["group_selected"])) {$group_selected=$_POST["group_selected"];}
if (isset($_GET["dialplan_number"])) {$dialplan_number=$_GET["dialplan_number"];}
elseif (isset($_POST["dialplan_number"])) {$dialplan_number=$_POST["dialplan_number"];}
elseif (isset($_POST["group_selected"])) {$group_selected=$_POST["group_selected"];}
if (isset($_GET["dialplan_number"])) {$dialplan_number=$_GET["dialplan_number"];}
elseif (isset($_POST["dialplan_number"])) {$dialplan_number=$_POST["dialplan_number"];}
if (isset($_GET["extension"])) {$extension=$_GET["extension"];}
elseif (isset($_POST["extension"])) {$extension=$_POST["extension"];}
if (isset($_GET["groupselect"])) {$groupselect=$_GET["groupselect"];}
@@ -34,23 +36,23 @@ if (isset($_GET["PHONE_LOGIN"])) {$PHONE_LOGIN=$_GET["PHONE_LOGIN"];}
if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];}
elseif (isset($_POST["server_ip"])) {$server_ip=$_POST["server_ip"];}
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
if (isset($_GET["user"])) {$user=$_GET["user"];}
elseif (isset($_POST["user"])) {$user=$_POST["user"];}
if (isset($_GET["channel"])) {$channel=$_GET["channel"];}
elseif (isset($_POST["channel"])) {$channel=$_POST["channel"];}
if (isset($_GET["parked_time"])) {$parked_time=$_GET["parked_time"];}
elseif (isset($_POST["parked_time"])) {$parked_time=$_POST["parked_time"];}
if (isset($_GET["channel_group"])) {$channel_group=$_GET["channel_group"];}
elseif (isset($_POST["channel_group"])) {$channel_group=$_POST["channel_group"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
if (isset($_GET["user"])) {$user=$_GET["user"];}
elseif (isset($_POST["user"])) {$user=$_POST["user"];}
if (isset($_GET["channel"])) {$channel=$_GET["channel"];}
elseif (isset($_POST["channel"])) {$channel=$_POST["channel"];}
if (isset($_GET["parked_time"])) {$parked_time=$_GET["parked_time"];}
elseif (isset($_POST["parked_time"])) {$parked_time=$_POST["parked_time"];}
if (isset($_GET["channel_group"])) {$channel_group=$_GET["channel_group"];}
elseif (isset($_POST["channel_group"])) {$channel_group=$_POST["channel_group"];}
if (isset($_GET["debugvars"])) {$debugvars=$_GET["debugvars"];}
elseif (isset($_POST["debugvars"])) {$debugvars=$_POST["debugvars"];}
if (isset($_GET["parked_by"])) {$parked_by=$_GET["parked_by"];}
elseif (isset($_POST["parked_by"])) {$parked_by=$_POST["parked_by"];}
if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
#############################################
@@ -59,23 +61,27 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
$i=0;
while ($i < $qm_conf_ct)
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
$SSoutbound_autodial_active = $row[2];
$user_territories_active = $row[3];
$i++;
}
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
#$DB=1;
$US = '_';
@@ -87,51 +93,33 @@ $FILE_datetime = $STARTtime;
$ext_context = 'demo';
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 2;";
if ($DB) {echo "$stmt\n";}
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$fp = fopen ("./project_auth_entries.txt", "a");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICIDIAL-CLOSER\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
if($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
$fullname = $row[0];
if ($webroot_writable > 0)
{
fwrite ($fp, "VD_CLOSER|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($webroot_writable > 0)
{
fwrite ($fp, "VD_CLOSER|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
}
}
$LOGfullname=$row[0];
$fullname = $row[0];
echo "<html>\n";
echo "<head>\n";
agc_2-X/trunk/www/vicidial/fcstats.php
+69 -28
View File
@@ -23,35 +23,34 @@
# 120705-2007 - Changed SALES to use sales status flag
# 130414-0126 - Added report logging
# 130610-0948 - Finalized changing of all ereg instances to preg
# 130619-2339 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
if (isset($_GET["group"])) {$group=$_GET["group"];}
elseif (isset($_POST["group"])) {$group=$_POST["group"];}
if (isset($_GET["query_date"])) {$query_date=$_GET["query_date"];}
elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];}
elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];}
if (isset($_GET["shift"])) {$shift=$_GET["shift"];}
elseif (isset($_POST["shift"])) {$shift=$_POST["shift"];}
if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];}
elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];}
elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
if (strlen($shift)<2) {$shift='ALL';}
@@ -77,24 +76,66 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {$HTML_text.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$HTML_text.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$shift = preg_replace("/'|\"|\\\\|;/","",$shift);
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -126,7 +167,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
echo "<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$HTML_text.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -143,7 +184,7 @@ $LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/functions.php
+111 -7
View File
@@ -1,10 +1,10 @@
<?php
#
# functions.php version 2.4
# functions.php version 2.8
#
# functions for administrative scripts and reports
#
# Copyright (C) 2012 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2013 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
#
# CHANGES:
@@ -14,9 +14,107 @@
# 120125-1235 - Small changes to max stats function to allow for total system stats
# 120213-1417 - Changes to allow for ra stats
# 120713-2137 - Added download function for max stats
# 130615-2111 - Added user authentication function and login lockout for 15 minutes after 10 failed login
#
##### reformat seconds into HH:MM:SS or MM:SS #####
##### BEGIN validate user login credentials, check for failed lock out #####
function user_authorization($user,$pass,$user_option,$user_update)
{
require("dbconnect.php");
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,webroot_writable,pass_hash_enabled,pass_key,pass_cost FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$SSwebroot_writable = $row[1];
$SSpass_hash_enabled = $row[2];
$SSpass_key = $row[3];
$SSpass_cost = $row[4];
}
##### END SETTINGS LOOKUP #####
###########################################
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
$LOCK_over = ($STARTtime - 900); # failed login lockout time is 15 minutes(900 seconds)
$LOCK_trigger_attempts = 10;
$user = preg_replace("/\'|\"|\\\\|;/","",$user);
$pass = preg_replace("/\'|\"|\\\\|;/","",$pass);
$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 7 and active='Y' and ( (failed_login_count < $LOCK_trigger_attempts) or (UNIX_TIMESTAMP(last_login_date) < $LOCK_over) );";
if ($user_option == 'REPORTS')
{$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 6 and active='Y' and ( (failed_login_count < $LOCK_trigger_attempts) or (UNIX_TIMESTAMP(last_login_date) < $LOCK_over) );";}
if ($user_option == 'REMOTE')
{$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 3 and active='Y' and ( (failed_login_count < $LOCK_trigger_attempts) or (UNIX_TIMESTAMP(last_login_date) < $LOCK_over) );";}
if ($user_option == 'QC')
{$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 1 and active='Y' and ( (failed_login_count < $LOCK_trigger_attempts) or (UNIX_TIMESTAMP(last_login_date) < $LOCK_over) );";}
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if ($auth < 1)
{
$auth_key='BAD';
$stmt="SELECT failed_login_count,UNIX_TIMESTAMP(last_login_date) from vicidial_users where user='$user';";
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$cl_user_ct = mysql_num_rows($rslt);
if ($cl_user_ct > 0)
{
$row=mysql_fetch_row($rslt);
$failed_login_count = $row[0];
$last_login_date = $row[1];
if ($failed_login_count < $LOCK_trigger_attempts)
{
$stmt="UPDATE vicidial_users set failed_login_count=(failed_login_count+1),last_ip='$ip' where user='$user';";
$rslt=mysql_query($stmt, $link);
}
else
{
if ($LOCK_over > $last_login_date)
{
$stmt="UPDATE vicidial_users set last_login_date=NOW(),failed_login_count=1,last_ip='$ip' where user='$user';";
$rslt=mysql_query($stmt, $link);
}
else
{$auth_key='LOCK';}
}
}
if ($SSwebroot_writable > 0)
{
$fp = fopen ("./project_auth_entries.txt", "a");
fwrite ($fp, "ADMIN|FAIL|$NOW_TIME|$user|$auth_key|$ip|$browser|\n");
fclose($fp);
}
}
else
{
if ($user_update > 0)
{
$stmt="UPDATE vicidial_users set last_login_date=NOW(),last_ip='$ip',failed_login_count=0 where user='$user';";
$rslt=mysql_query($stmt, $link);
}
$auth_key='GOOD';
}
return $auth_key;
}
##### END validate user login credentials, check for failed lock out #####
##### BEGIN reformat seconds into HH:MM:SS or MM:SS #####
function sec_convert($sec,$precision)
{
$sec = round($sec,0);
@@ -71,9 +169,10 @@ function sec_convert($sec,$precision)
return "$Ftime";
}
}
##### END reformat seconds into HH:MM:SS or MM:SS #####
##### counts like elements in an array, optional sort asc desc #####
##### BEGIN counts like elements in an array, optional sort asc desc #####
function array_group_count($array, $sort = false)
{
$tally_array = array();
@@ -100,9 +199,10 @@ function array_group_count($array, $sort = false)
return $tally_array;
}
##### END counts like elements in an array, optional sort asc desc #####
##### bar chart using max stats data #####
##### BEGIN bar chart using max stats data #####
function horizontal_bar_chart($campaign_id,$days_graph,$title,$link,$metric,$metric_name,$more_link,$END_DATE,$download_link)
{
$stats_start_time = time();
@@ -197,8 +297,10 @@ function horizontal_bar_chart($campaign_id,$days_graph,$title,$link,$metric,$met
echo "</table>\n";
}
}
##### END bar chart using max stats data #####
##### bar chart using max stats data #####
##### BEGIN download max stats data #####
function download_max_system_stats($campaign_id,$days_graph,$title,$metric,$metric_name,$END_DATE)
{
global $CSV_text, $link;
@@ -283,4 +385,6 @@ function download_max_system_stats($campaign_id,$days_graph,$title,$metric,$metr
$CSV_text.="\n\n";
}
}
?>
##### BEGIN download max stats data #####
?>
agc_2-X/trunk/www/vicidial/group_hourly_stats.php
+78 -78
View File
@@ -13,6 +13,7 @@
# 120223-2135 - Removed logging of good login passwords if webroot writable is enabled
# 130414-0224 - Added report logging
# 130610-0946 - Finalized changing of all ereg instances to preg
# 130619-2329 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -20,6 +21,7 @@ $startMS = microtime();
$report_name='User Group Hourly Stats';
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -27,13 +29,13 @@ $PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["group"])) {$group=$_GET["group"];}
elseif (isset($_POST["group"])) {$group=$_POST["group"];}
if (isset($_GET["status"])) {$status=$_GET["status"];}
elseif (isset($_POST["status"])) {$status=$_POST["status"];}
elseif (isset($_POST["status"])) {$status=$_POST["status"];}
if (isset($_GET["date_with_hour"])) {$date_with_hour=$_GET["date_with_hour"];}
elseif (isset($_POST["date_with_hour"])) {$date_with_hour=$_POST["date_with_hour"];}
elseif (isset($_POST["date_with_hour"])) {$date_with_hour=$_POST["date_with_hour"];}
if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
@@ -41,35 +43,79 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
$i=0;
while ($i < $qm_conf_ct)
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
$SSoutbound_autodial_active = $row[2];
$user_territories_active = $row[3];
$i++;
}
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$group = preg_replace("/'|\"|\\\\|;/","",$group);
$status = preg_replace("/'|\"|\\\\|;/","",$status);
$date_with_hour = preg_replace("/'|\"|\\\\|;/","",$date_with_hour);
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -96,66 +142,21 @@ $STARTtime = date("U");
$TODAY = date("Y-m-d");
$date_with_hour_default = date("Y-m-d H");
$date_no_hour_default = $TODAY;
if (!isset($date_with_hour)) {$date_with_hour = $date_with_hour_default;}
$date_no_hour = $date_with_hour;
$date_no_hour = preg_replace('/\s([0-9]{2})/i',$date_no_hour);
if (!isset($begin_date)) {$begin_date = $TODAY;}
if (!isset($end_date)) {$end_date = $TODAY;}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$fp = fopen ("./project_auth_entries.txt", "a");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
header ("Content-type: text/html; charset=utf-8");
if (!isset($date_with_hour)) {$date_with_hour = $date_with_hour_default;}
$date_no_hour = $date_with_hour;
$date_no_hour = preg_replace('/\s([0-9]{2})/i','',$date_no_hour);
if (!isset($begin_date)) {$begin_date = $TODAY;}
if (!isset($end_date)) {$end_date = $TODAY;}
if($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$LOGuser_group = $row[1];
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
exit;
}
# $stmt="SELECT full_name from vicidial_users where user='$user';";
# $rslt=mysql_query($stmt, $link);
# $row=mysql_fetch_row($rslt);
# $full_name = $row[0];
}
$stmt="SELECT full_name,user_group from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$LOGuser_group = $row[1];
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
if ($DB) {$HTML_text.="|$stmt|\n";}
@@ -177,7 +178,6 @@ if ( (!preg_match('/\-\-ALL\-\-/i',$LOGadmin_viewable_groups)) and (strlen($LOGa
}
?>
<html>
<head>
agc_2-X/trunk/www/vicidial/lead_report_export.php
+74 -29
View File
@@ -13,11 +13,13 @@
# 111104-1245 - Added user_group restrictions for selecting in-groups
# 130414-0135 - Added report logging
# 130610-0945 - Finalized changing of all ereg instances to preg
# 130619-2307 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -79,28 +81,78 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and export_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
# Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password or no export report permission: |$PHP_AUTH_USER|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT export_reports,user_group from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGexport_reports = $row[0];
$LOGuser_group = $row[1];
if ($LOGexport_reports < 1)
{
Header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions for export reports: |$PHP_AUTH_USER|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -132,12 +184,6 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
# echo "<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGuser_group = $row[0];
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
@@ -147,10 +193,9 @@ $LOGallowed_reports = $row[1];
$LOGadmin_viewable_groups = $row[2];
$LOGadmin_viewable_call_times = $row[3];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
agc_2-X/trunk/www/vicidial/lead_tools.php
+63 -60
View File
@@ -8,10 +8,11 @@
# 121114-0956 - Added input filtering and vicidial_admin_log logging
# 130124-1129 - Added new options, from issue #632<noah>
# 130610-1045 - Finalized changing of all ereg instances to preg
# 130619-2203 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$version = '2.8-4';
$build = '130610-1045';
$version = '2.8-5';
$build = '130619-2203';
# This limit is to prevent data inconsistancies.
# If there are too many leads in a list this
@@ -22,6 +23,7 @@ $list_lead_limit = 100000;
$max_count = 20;
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -61,7 +63,6 @@ $confirm_update = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm_update);
$confirm_delete = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm_delete);
$delete_status = preg_replace('/[^-_0-9a-zA-Z]/','',$delete_status);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$sys_settings_stmt = "SELECT use_non_latin, outbound_autodial_active, sounds_central_control_active FROM system_settings;";
@@ -87,65 +88,68 @@ if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$list_id_override = preg_replace('/[^0-9]/','',$list_id_override);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$list_id_override = preg_replace('/[^0-9]/','',$list_id_override);
$valid_user_stmt = "SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;";
if ($DB) {echo "|$valid_user_stmt|\n";}
if ($non_latin > 0) {$valid_user_rslt=mysql_query("SET NAMES 'UTF8'");}
$valid_user_rslt = mysql_query($valid_user_stmt, $link);
$valid_user_row = mysql_fetch_row($valid_user_rslt);
$auth = $valid_user_row[0];
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ( ( strlen($PHP_AUTH_USER) < 2 ) or ( strlen($PHP_AUTH_PW) < 2 ) or ( !$auth ) )
if ($auth < 1)
{
# Invalid user
Header("WWW-Authenticate: Basic realm=\"VICIDIAL-LEAD-LOADER\"");
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
else
header ("Content-type: text/html; charset=utf-8");
header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header ("Pragma: no-cache"); // HTTP/1.0
# valid user
$rights_stmt = "SELECT load_leads,user_group, delete_lists, modify_leads, modify_lists from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rights_rslt=mysql_query($rights_stmt, $link);
$rights_row=mysql_fetch_row($rights_rslt);
$load_leads = $rights_row[0];
$user_group = $rights_row[1];
$delete_lists = $rights_row[2];
$modify_leads = $rights_row[3];
$modify_lists = $rights_row[4];
# check their permissions
if ( $load_leads < 1 )
{
header ("Content-type: text/html; charset=utf-8");
header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header ("Pragma: no-cache"); // HTTP/1.0
if ( $auth > 0 )
{
# valid user
$rights_stmt = "SELECT load_leads,user_group, delete_lists, modify_leads, modify_lists from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
if ($DB) {echo "|$stmt|\n";}
$rights_rslt=mysql_query($rights_stmt, $link);
$rights_row=mysql_fetch_row($rights_rslt);
$load_leads = $rights_row[0];
$user_group = $rights_row[1];
$delete_lists = $rights_row[2];
$modify_leads = $rights_row[3];
$modify_lists = $rights_row[4];
# check their permissions
if ( $load_leads < 1 )
{
echo "You do not have permissions to load leads\n";
exit;
}
if ( $modify_leads < 1 )
{
echo "You do not have permissions to modify leads\n";
exit;
}
if ( $modify_lists < 1 )
{
echo "You do not have permissions to modify lists\n";
exit;
}
}
echo "You do not have permissions to load leads\n";
exit;
}
if ( $modify_leads < 1 )
{
header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions to modify leads\n";
exit;
}
if ( $modify_lists < 1 )
{
header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions to modify lists\n";
exit;
}
echo "<html>\n";
@@ -155,11 +159,11 @@ echo "<!-- VERSION: <?php echo $version ?> BUILD: <?php echo $build ?> -->\n
echo "<title>ADMINISTRATION: Lead Tools</title>\n";
##### BEGIN Set variables to make header show properly #####
$ADD = '999998';
$hh = 'admin';
$ADD = '999998';
$hh = 'admin';
$LOGast_admin_access = '1';
$SSoutbound_autodial_active = '1';
$ADMIN = 'admin.php';
$ADMIN = 'admin.php';
$page_width='770';
$section_width='750';
$header_font_size='3';
@@ -330,15 +334,14 @@ if ($confirm_move == "confirm")
$move_lead_rslt = mysql_query($move_lead_stmt, $link);
$move_lead_count = mysql_affected_rows( $link );
$move_sentence = "$move_lead_count leads have been moved from list $move_from_list to $move_to_list with the status $move_status and that were called $move_count_op_phrase$move_count_num times.";
$SQL_log = "$move_lead_stmt|";
$SQL_log = preg_replace('/;/', '', $SQL_log);
$SQL_log = addslashes($SQL_log);
$admin_log_stmt="INSERT INTO vicidial_admin_log set event_date='$SQLdate', user='$PHP_AUTH_USER', ip_address='$ip', event_section='LISTS', event_type='OTHER', record_id='$move_from_list', event_code='ADMIN MOVE LEADS', event_sql=\"$SQL_log\", event_notes='$move_sentence';";
if ($DB) {echo "|$admin_log_stmt|\n";}
$admin_log_rslt=mysql_query($admin_log_stmt, $link);
$move_sentence = "$move_lead_count leads have been moved from list $move_from_list to $move_to_list with the status $move_status and that were called $move_count_op_phrase$move_count_num times.";
$SQL_log = "$move_lead_stmt|";
$SQL_log = preg_replace('/;/', '', $SQL_log);
$SQL_log = addslashes($SQL_log);
$admin_log_stmt="INSERT INTO vicidial_admin_log set event_date='$SQLdate', user='$PHP_AUTH_USER', ip_address='$ip', event_section='LISTS', event_type='OTHER', record_id='$move_from_list', event_code='ADMIN MOVE LEADS', event_sql=\"$SQL_log\", event_notes='$move_sentence';";
if ($DB) {echo "|$admin_log_stmt|\n";}
$admin_log_rslt=mysql_query($admin_log_stmt, $link);
echo "<p>$move_sentence</p>";
echo "<p><a href='$PHP_SELF'>Click here to start over.</a></p>\n";
agc_2-X/trunk/www/vicidial/leadloader_template_display.php
+86 -38
View File
@@ -8,9 +8,30 @@
# 120525-1039 - Added uploaded filename filtering
# 120529-1345 - Filename filter fix
# 130610-1101 - Finalized changing of all ereg instances to preg
# 130619-0902 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
if (isset($_GET["list_id"])) {$list_id=$_GET["list_id"];}
elseif (isset($_POST["list_id"])) {$list_id=$_POST["list_id"];}
if (isset($_GET["custom_fields_enabled"])) {$custom_fields_enabled=$_GET["custom_fields_enabled"];}
elseif (isset($_POST["custom_fields_enabled"])) {$custom_fields_enabled=$_POST["custom_fields_enabled"];}
$sample_template_file=$_FILES["sample_template_file"];
$LF_orig = $_FILES['sample_template_file']['name'];
$LF_path = $_FILES['sample_template_file']['tmp_name'];
if (isset($_GET["sample_template_file_name"])) {$sample_template_file_name=$_GET["sample_template_file_name"];}
elseif (isset($_POST["sample_template_file_name"])) {$sample_template_file_name=$_POST["sample_template_file_name"];}
if (isset($_FILES["sample_template_file"])) {$sample_template_file_name=$_FILES["sample_template_file"]['name'];}
if (isset($_GET["form_action"])) {$form_action=$_GET["form_action"];}
elseif (isset($_POST["form_action"])) {$form_action=$_POST["form_action"];}
if (isset($_GET["delimiter"])) {$delimiter=$_GET["delimiter"];}
elseif (isset($_POST["delimiter"])) {$delimiter=$_POST["delimiter"];}
if (isset($_GET["buffer"])) {$buffer=$_GET["buffer"];}
elseif (isset($_POST["buffer"])) {$buffer=$_POST["buffer"];}
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
@@ -29,22 +50,50 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
if (isset($_GET["list_id"])) {$list_id=$_GET["list_id"];}
elseif (isset($_POST["list_id"])) {$list_id=$_POST["list_id"];}
if (isset($_GET["custom_fields_enabled"])) {$custom_fields_enabled=$_GET["custom_fields_enabled"];}
elseif (isset($_POST["custom_fields_enabled"])) {$custom_fields_enabled=$_POST["custom_fields_enabled"];}
$sample_template_file=$_FILES["sample_template_file"];
$LF_orig = $_FILES['sample_template_file']['name'];
$LF_path = $_FILES['sample_template_file']['tmp_name'];
if (isset($_GET["sample_template_file_name"])) {$sample_template_file_name=$_GET["sample_template_file_name"];}
elseif (isset($_POST["sample_template_file_name"])) {$sample_template_file_name=$_POST["sample_template_file_name"];}
if (isset($_FILES["sample_template_file"])) {$sample_template_file_name=$_FILES["sample_template_file"]['name'];}
if (isset($_GET["form_action"])) {$form_action=$_GET["form_action"];}
elseif (isset($_POST["form_action"])) {$form_action=$_POST["form_action"];}
if (isset($_GET["delimiter"])) {$delimiter=$_GET["delimiter"];}
elseif (isset($_POST["delimiter"])) {$delimiter=$_POST["delimiter"];}
if (isset($_GET["buffer"])) {$buffer=$_GET["buffer"];}
elseif (isset($_POST["buffer"])) {$buffer=$_POST["buffer"];}
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$list_id = preg_replace('/[^0-9]/', '', $list_id);
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT load_leads from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGload_leads = $row[0];
if ($LOGload_leads < 1)
{
Header ("Content-type: text/html; charset=utf-8");
echo "You do not have permissions to load leads\n";
exit;
}
### REGEX to prevent weird characters from ending up in the fields
$field_regx = "['\"`\\;]";
@@ -88,7 +137,7 @@ if ($form_action=="prime_file" && $sample_template_file_name)
{$stmt_file=fopen("$WeBServeRRooT/$admin_web_directory/listloader_stmts.txt", "w");}
$buffer=fgets($file, 4096);
$buffer=preg_replace('/[\'\"\n]/i', $buffer);
$buffer=preg_replace('/[\'\"\n]/i', '', $buffer);
$tab_count=substr_count($buffer, "\t");
$pipe_count=substr_count($buffer, "|");
@@ -174,7 +223,6 @@ if ($custom_fields_enabled > 0)
}
$fields_stmt = "SELECT list_id, vendor_lead_code, source_id, phone_code, phone_number, title, first_name, middle_initial, last_name, address1, address2, address3, city, state, province, postal_code, country_code, gender, date_of_birth, alt_phone, email, security_phrase, comments, rank, owner $custom_SQL from vicidial_list, custom_$list_id limit 1";
}
}
}
@@ -190,34 +238,34 @@ if ($delimiter && $buffer)
# print "<center><font face='arial, helvetica' size=3 color='#009900'><B>Processing $delim_name file...\n";
$row=explode($delimiter, preg_replace('/[\'\"]/i', '', $buffer));
# echo "delimiter: $delimiter<BR>$buffer<BR>";
}
}
echo "<table border=0 width='100%' cellpadding=0 cellspacing=0>";
$rslt=mysql_query("$fields_stmt", $link);
$custom_fields_count=mysql_num_fields($rslt)-$vl_fields_count;
for ($i=0; $i<mysql_num_fields($rslt); $i++)
{
if (preg_match('/'.mysql_field_name($rslt, $i).'/', $vicidial_list_fields)) {$bgcolor="#D9E6FE";} else {$bgcolor="#FED9D9";}
if (preg_match('/'.mysql_field_name($rslt, $i).'/', $vicidial_list_fields)) {$bgcolor="#D9E6FE";} else {$bgcolor="#FED9D9";}
echo " <tr bgcolor='$bgcolor'>\r\n";
echo " <td align=right nowrap><font class=standard>".strtoupper(preg_replace('/_/i', ' ', mysql_field_name($rslt, $i))).": </font></td>\r\n";
if (mysql_field_name($rslt, $i)!="list_id")
echo " <tr bgcolor='$bgcolor'>\r\n";
echo " <td align=right nowrap><font class=standard>".strtoupper(preg_replace('/_/i', ' ', mysql_field_name($rslt, $i))).": </font></td>\r\n";
if (mysql_field_name($rslt, $i)!="list_id")
{
echo " <td align=left><select name='$field_prefix".mysql_field_name($rslt, $i)."_field' onChange='DrawTemplateStrings()'>\r\n";
echo " <option value='-1'>(none)</option>\r\n";
for ($j=0; $j<count($row); $j++)
{
echo " <td align=left><select name='$field_prefix".mysql_field_name($rslt, $i)."_field' onChange='DrawTemplateStrings()'>\r\n";
echo " <option value='-1'>(none)</option>\r\n";
for ($j=0; $j<count($row); $j++)
{
preg_replace('/\"/i', '', $row[$j]);
echo " <option value='$j'>\"$row[$j]\"</option>\r\n";
}
echo " </select></td>\r\n";
preg_replace('/\"/i', '', $row[$j]);
echo " <option value='$j'>\"$row[$j]\"</option>\r\n";
}
else
{
echo " <td align=left>&nbsp;<font class='standard_bold'>$list_id<input type='hidden' name='".$field_prefix.$list_id."' value='$list_id'></font></td>\r\n";
}
echo " </tr>\r\n";
echo " </select></td>\r\n";
}
else
{
echo " <td align=left>&nbsp;<font class='standard_bold'>$list_id<input type='hidden' name='".$field_prefix.$list_id."' value='$list_id'></font></td>\r\n";
}
echo " </tr>\r\n";
}
echo "</table>";
}
agc_2-X/trunk/www/vicidial/list_download.php
+45 -13
View File
@@ -24,11 +24,13 @@
# 120907-1217 - Raised extended fields up to 99
# 130414-0228 - Added report logging
# 130610-0945 - Finalized changing of all ereg instances to preg
# 130618-0043 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -70,21 +72,51 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id);
$group_id = preg_replace('/[^-_0-9a-zA-Z]/','',$group_id);
$download_type = preg_replace('/[^-_0-9a-zA-Z]/','',$download_type);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and download_lists='1' and active='Y';";
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and download_lists='1';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$download_auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($download_auth < 1)
{
# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
# Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password or no list download permission: |$PHP_AUTH_USER|\n";
Header ("Content-type: text/html; charset=utf-8");
echo "No list download permission: |$PHP_AUTH_USER|\n";
exit;
}
@@ -117,7 +149,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
# echo "<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -132,8 +164,7 @@ $LOGallowed_reports = $row[1];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
# Header("HTTP/1.0 401 Unauthorized");
Header ("Content-type: text/html; charset=utf-8");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
}
@@ -561,4 +592,5 @@ $rslt=mysql_query($stmt, $link);
exit;
?>
?>
agc_2-X/trunk/www/vicidial/listloader.php
+1
View File
@@ -0,0 +1 @@
this file has been removed
agc_2-X/trunk/www/vicidial/listloaderMAIN.php
+41 -50
View File
@@ -12,9 +12,11 @@
# 90508-0644 - Changed to PHP long tags
# 120223-2151 - Removed logging of good login passwords if webroot writable is enabled
# 130610-1111 - Finalized changing of all ereg instances to preg
# 130618-0035 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -26,77 +28,66 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
$i=0;
while ($i < $qm_conf_ct)
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
$SSoutbound_autodial_active = $row[2];
$user_territories_active = $row[3];
$i++;
}
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$FILE_datetime = $STARTtime;
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if ($webroot_writable > 0) {$fp = fopen ("./project_auth_entries.txt", "a");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICIDIAL-LEAD-LOADER\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
header ("Content-type: text/html; charset=utf-8");
if($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT load_leads from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGload_leads =$row[0];
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($LOGload_leads < 1)
{
echo "You do not have permissions to load leads\n";
exit;
}
if ($webroot_writable > 0)
{
fwrite ($fp, "LIST_LOAD|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
if ($webroot_writable > 0)
{
fwrite ($fp, "LIST_LOAD|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT load_leads from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGload_leads = $row[0];
if ($LOGload_leads < 1)
{
echo "You do not have permissions to load leads\n";
exit;
}
?><HTML>
@@ -106,4 +97,4 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
<FRAMESET ROWS="300,*" border=0>
<FRAME SRC="listloader.php" NAME="main">
<FRAME SRC="count.htm" NAME="lead_count">
</HTML>
</HTML>
agc_2-X/trunk/www/vicidial/non_agent_api.php
+77 -23
View File
@@ -77,15 +77,18 @@
# 130420-1938 - Added NANPA prefix validation and timezone options
# 130614-0907 - Finalized changing of all ereg instances to preg
# - Added pause code to output of agent_status function
# 130617-2232 - Added real-time sub-statuses to output of agent_status function
# - Added user authentication process to eliminate brute force attacks
#
$version = '2.8-54';
$build = '130614-0907';
$version = '2.8-55';
$build = '130617-2232';
$api_url_log = 0;
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
### If you have globals turned off uncomment these lines
if (isset($_GET["user"])) {$user=$_GET["user"];}
@@ -355,8 +358,8 @@ if ($qm_conf_ct > 0)
if ($non_latin < 1)
{
$DB=preg_replace('/[^0-9]/','',$DB);
$user=preg_replace('/[^0-9a-zA-Z]/','',$user);
$pass=preg_replace('/[^0-9a-zA-Z]/','',$pass);
$user=preg_replace('/[^-_0-9a-zA-Z]/','',$user);
$pass=preg_replace('/[^-_0-9a-zA-Z]/','',$pass);
$function = preg_replace('/[^-\_0-9a-zA-Z]/', '',$function);
$format = preg_replace('/[^0-9a-zA-Z]/','',$format);
$list_id = preg_replace('/[^0-9]/','',$list_id);
@@ -575,6 +578,29 @@ if ($function == 'version')
##### BEGIN user authentication for all functions below #####
$auth=0;
$auth_message = user_authorization($user,$pass,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
$VDdisplayMESSAGE = "ERROR: Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "ERROR: Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$user|$auth_message|\n";
exit;
}
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$user|$pass|$auth_message|\n";
exit;
}
##### END user authentication for all functions below #####
################################################################################
### sounds_list - sends a list of the sounds in the audio store
@@ -3641,8 +3667,6 @@ if ($function == 'agent_stats_export')
$search_SQL='';
$search_ready=0;
require_once("functions.php");
if ( (strlen($agent_user)>0) and (strlen($agent_user)<21) )
{
$search_SQL .= "user='$agent_user'";
@@ -3859,8 +3883,6 @@ if ($function == 'user_group_status')
$search_SQL='';
$search_ready=0;
require_once("functions.php");
if ( (strlen($user_groups)>0) and (strlen($user_groups)<10000) )
{
$user_groupsOUTPUT = preg_replace("/\|/",' ',$user_groups);
@@ -4077,8 +4099,6 @@ if ($function == 'in_group_status')
$search_SQL='';
$search_ready=0;
require_once("functions.php");
if ( (strlen($in_groups)>0) and (strlen($in_groups)<10000) )
{
$in_groupsOUTPUT = preg_replace("/\|/",' ',$in_groups);
@@ -4295,8 +4315,6 @@ if ($function == 'agent_status')
$agent_search_SQL='';
$search_ready=0;
require_once("functions.php");
if ( (strlen($agent_user)>0) and (strlen($agent_user)<100) )
{
$agent_search_SQL .= "where user='$agent_user'";
@@ -4351,7 +4369,7 @@ if ($function == 'agent_status')
if ($header == 'YES')
{$output .= 'status' . $DL . 'callerid' . $DL . 'lead_id' . $DL . 'campaign_id' . $DL . 'calls_today' . $DL . 'full_name' . $DL . 'user_group' . $DL . 'user_level' . "\n";}
$stmt="select full_name,user_group,user_level from vicidial_users $agent_search_SQL $LOGadmin_viewable_groupsSQL;";
$stmt="SELECT full_name,user_group,user_level from vicidial_users $agent_search_SQL $LOGadmin_viewable_groupsSQL;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$user_to_list = mysql_num_rows($rslt);
@@ -4362,22 +4380,25 @@ if ($function == 'agent_status')
$user_group = $row[1];
$user_level = $row[2];
$stmt="select status,callerid,lead_id,campaign_id,calls_today,agent_log_id from vicidial_live_agents $agent_search_SQL;";
$stmt="SELECT status,callerid,lead_id,campaign_id,calls_today,agent_log_id,on_hook_agent,ring_callerid from vicidial_live_agents $agent_search_SQL;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$agent_to_list = mysql_num_rows($rslt);
if ($agent_to_list > 0)
{
$row=mysql_fetch_row($rslt);
$status = $row[0];
$callerid = $row[1];
$lead_id = $row[2];
$campaign_id = $row[3];
$calls_today = $row[4];
$agent_log_id = $row[5];
$pause_code = '';
$status = $row[0];
$callerid = $row[1];
$lead_id = $row[2];
$campaign_id = $row[3];
$calls_today = $row[4];
$agent_log_id = $row[5];
$on_hook_agent = $row[6];
$ring_callerid = $row[7];
$pause_code = '';
$rtr_status = '';
$stmt="select sub_status from vicidial_agent_log $agent_search_SQL and agent_log_id='$agent_log_id';";
$stmt="SELECT sub_status from vicidial_agent_log $agent_search_SQL and agent_log_id='$agent_log_id';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$agent_to_log = mysql_num_rows($rslt);
@@ -4387,7 +4408,40 @@ if ($function == 'agent_status')
$pause_code = $row[0];
}
$output .= "$status$DL$callerid$DL$lead_id$DL$campaign_id$DL$calls_today$DL$full_name$DL$user_group$DL$user_level$DL$pause_code\n";
if ( ($on_hook_agent == 'Y') and (strlen($ring_callerid) > 18) )
{$rtr_status = "RING";}
if ( ($status == 'PAUSED') and ($lead_id > 0) )
{$rtr_status = 'DISPO';}
if ($status == 'INCALL')
{
if ($lead_id > 0)
{
$threewaystmt="select UNIX_TIMESTAMP(last_call_time) from vicidial_live_agents where lead_id='$lead_id' and status='INCALL' order by UNIX_TIMESTAMP(last_call_time) desc;";
$threewayrslt=mysql_query($threewaystmt, $link);
if (mysql_num_rows($threewayrslt)>1)
{$rtr_status = '3-WAY';}
}
$stmt="SELECT count(*) from parked_channels where channel_group='$callerid';";
$rslt=mysql_query($stmt,$link);
$row=mysql_fetch_row($rslt);
$parked_channel = $row[0];
if ($parked_channel > 0)
{$rtr_status = 'PARK';}
else
{
$stmt="SELECT count(*) from vicidial_auto_calls where callerid='$callerid';";
$rslt=mysql_query($stmt,$link);
$row=mysql_fetch_row($rslt);
$live_channel = $row[0];
if ($live_channel < 1)
{$rtr_status = 'DEAD';}
}
}
$output .= "$status$DL$callerid$DL$lead_id$DL$campaign_id$DL$calls_today$DL$full_name$DL$user_group$DL$user_level$DL$pause_code$DL$rtr_status\n";
echo "$output";
agc_2-X/trunk/www/vicidial/phone_stats.php
+124 -108
View File
@@ -11,9 +11,11 @@
# 90508-0644 - Changed to PHP long tags
# 120223-2135 - Removed logging of good login passwords if webroot writable is enabled
# 130610-1110 - Finalized changing of all ereg instances to preg
# 130617-2156 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -21,9 +23,9 @@ $PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["group"])) {$group=$_GET["group"];}
elseif (isset($_POST["group"])) {$group=$_POST["group"];}
if (isset($_GET["query_date"])) {$query_date=$_GET["query_date"];}
elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];}
elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];}
if (isset($_GET["begin_date"])) {$begin_date=$_GET["begin_date"];}
elseif (isset($_POST["begin_date"])) {$begin_date=$_POST["begin_date"];}
elseif (isset($_POST["begin_date"])) {$begin_date=$_POST["begin_date"];}
if (isset($_GET["end_date"])) {$end_date=$_GET["end_date"];}
elseif (isset($_POST["end_date"])) {$end_date=$_POST["end_date"];}
if (isset($_GET["extension"])) {$extension=$_GET["extension"];}
@@ -35,9 +37,9 @@ if (isset($_GET["user"])) {$user=$_GET["user"];}
if (isset($_GET["full_name"])) {$full_name=$_GET["full_name"];}
elseif (isset($_POST["full_name"])) {$full_name=$_POST["full_name"];}
if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
@@ -45,91 +47,115 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
$i=0;
while ($i < $qm_conf_ct)
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
$SSoutbound_autodial_active = $row[2];
$user_territories_active = $row[3];
$i++;
}
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$admin_page = './admin.php';
if (!isset($begin_date)) {$begin_date = $TODAY;}
if (!isset($end_date)) {$end_date = $TODAY;}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$fp = fopen ("./project_auth_entries.txt", "a");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if (!isset($begin_date)) {$begin_date = $TODAY;}
if (!isset($end_date)) {$end_date = $TODAY;}
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-ASTERISK\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
if($auth>0)
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$extension = preg_replace("/'|\"|\\\\|;/", '', $extension);
$server_ip = preg_replace("/'|\"|\\\\|;/", '', $server_ip);
$begin_date = preg_replace("/'|\"|\\\\|;/","",$begin_date);
$end_date = preg_replace("/'|\"|\\\\|;/","",$end_date);
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
if ($webroot_writable > 0)
{
fwrite ($fp, "ASTERISK|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
##### get server listing for dynamic pulldown
$stmt="SELECT fullname from phones where server_ip='$server_ip' and extension='$extension'";
$rsltx=mysql_query($stmt, $link);
$rowx=mysql_fetch_row($rsltx);
$fullname = $row[0];
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
else
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
if ($webroot_writable > 0)
{
fwrite ($fp, "ASTERISK|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
##### get server listing for dynamic pulldown
$stmt="SELECT fullname from phones where server_ip='$server_ip' and extension='$extension';";
$rsltx=mysql_query($stmt, $link);
$rowx=mysql_fetch_row($rsltx);
$fullname = $row[0];
?>
<html>
<head>
<title>VICIDIAL ADMIN: Phone Stats</title>
<title>ADMIN: Phone Stats</title>
</head>
<BODY BGCOLOR=white marginheight=0 marginwidth=0 leftmargin=0 topmargin=0>
<CENTER>
<TABLE WIDTH=620 BGCOLOR=#D9E6FE cellpadding=2 cellspacing=0><TR BGCOLOR=#015B91><TD ALIGN=LEFT><FONT FACE="ARIAL,HELVETICA" COLOR=WHITE SIZE=2><B> &nbsp; VICIDIAL ADMIN: Administration</TD><TD ALIGN=RIGHT><FONT FACE="ARIAL,HELVETICA" COLOR=WHITE SIZE=2><B><?php echo date("l F j, Y G:i:s A") ?> &nbsp; </TD></TR>
<TABLE WIDTH=620 BGCOLOR=#D9E6FE cellpadding=2 cellspacing=0><TR BGCOLOR=#015B91><TD ALIGN=LEFT><FONT FACE="ARIAL,HELVETICA" COLOR=WHITE SIZE=2><B> &nbsp; ADMIN: Administration</TD><TD ALIGN=RIGHT><FONT FACE="ARIAL,HELVETICA" COLOR=WHITE SIZE=2><B><?php echo date("l F j, Y G:i:s A") ?> &nbsp; </TD></TR>
<TR BGCOLOR=#F0F5FE><TD ALIGN=LEFT COLSPAN=2><FONT FACE="ARIAL,HELVETICA" COLOR=BLACK SIZE=1><B> &nbsp; <a href="<?php echo $admin_page ?>?ADD=10000000000"><FONT FACE="ARIAL,HELVETICA" COLOR=BLACK SIZE=1>LIST ALL PHONES</a> | <a href="<?php echo $admin_page ?>?ADD=11111111111"><FONT FACE="ARIAL,HELVETICA" COLOR=BLACK SIZE=1>ADD A NEW PHONE</a> | <a href="<?php echo $admin_page ?>?ADD=551"><FONT FACE="ARIAL,HELVETICA" COLOR=BLACK SIZE=1>SEARCH FOR A PHONE</a> | <a href="<?php echo $admin_page ?>?ADD=111111111111"><FONT FACE="ARIAL,HELVETICA" COLOR=BLACK SIZE=1>ADD A SERVER</a> | <a href="<?php echo $admin_page ?>?ADD=100000000000"><FONT FACE="ARIAL,HELVETICA" COLOR=BLACK SIZE=1>LIST ALL SERVERS</a></TD></TR>
<TR BGCOLOR=#F0F5FE><TD ALIGN=LEFT COLSPAN=2><FONT FACE="ARIAL,HELVETICA" COLOR=BLACK SIZE=1><B> &nbsp; <a href="<?php echo $admin_page ?>?ADD=1000000000000"><FONT FACE="ARIAL,HELVETICA" COLOR=BLACK SIZE=1>SHOW ALL CONFERENCES</a> | <a href="<?php echo $admin_page ?>?ADD=1111111111111"><FONT FACE="ARIAL,HELVETICA" COLOR=BLACK SIZE=1>ADD A NEW CONFERENCE</a></TD></TR>
<?php
echo "<TR BGCOLOR=\"#F0F5FE\"><TD ALIGN=LEFT COLSPAN=2><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2><B> &nbsp; \n";
@@ -148,9 +174,9 @@ echo "</B></TD></TR>\n";
echo "<TR><TD ALIGN=LEFT COLSPAN=2>\n";
$stmt="SELECT count(*),channel_group, sum(length_in_sec) from call_log where extension='" . mysql_real_escape_string($extension) . "' and server_ip='" . mysql_real_escape_string($server_ip) . "' and start_time >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and start_time <= '" . mysql_real_escape_string($end_date) . " 23:59:59' group by channel_group order by channel_group";
$rslt=mysql_query($stmt, $link);
$statuses_to_print = mysql_num_rows($rslt);
$stmt="SELECT count(*),channel_group, sum(length_in_sec) from call_log where extension='" . mysql_real_escape_string($extension) . "' and server_ip='" . mysql_real_escape_string($server_ip) . "' and start_time >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and start_time <= '" . mysql_real_escape_string($end_date) . " 23:59:59' group by channel_group order by channel_group";
$rslt=mysql_query($stmt, $link);
$statuses_to_print = mysql_num_rows($rslt);
# echo "|$stmt|\n";
echo "<br><center>\n";
@@ -160,31 +186,32 @@ echo "<B>CALL TIME AND CHANNELS:</B>\n";
echo "<center><TABLE width=300 cellspacing=0 cellpadding=1>\n";
echo "<tr><td><font size=2>CHANNEL GROUP </td><td align=right><font size=2>COUNT</td><td align=right><font size=2> HOURS:MINUTES</td></tr>\n";
$total_calls=0;
$o=0;
while ($statuses_to_print > $o) {
$row=mysql_fetch_row($rslt);
if (preg_match('/1$|3$|5$|7$|9$/i', $o))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
$total_calls=0;
$o=0;
while ($statuses_to_print > $o)
{
$row=mysql_fetch_row($rslt);
if (preg_match('/1$|3$|5$|7$|9$/i', $o))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
$call_seconds = $row[2];
$call_hours = ($call_seconds / 3600);
$call_hours = round($call_hours, 2);
$call_hours_int = intval("$call_hours");
$call_minutes = ($call_hours - $call_hours_int);
$call_minutes = ($call_minutes * 60);
$call_minutes_int = round($call_minutes, 0);
if ($call_minutes_int < 10) {$call_minutes_int = "0$call_minutes_int";}
$call_seconds = $row[2];
$call_hours = ($call_seconds / 3600);
$call_hours = round($call_hours, 2);
$call_hours_int = intval("$call_hours");
$call_minutes = ($call_hours - $call_hours_int);
$call_minutes = ($call_minutes * 60);
$call_minutes_int = round($call_minutes, 0);
if ($call_minutes_int < 10) {$call_minutes_int = "0$call_minutes_int";}
echo "<tr $bgcolor><td><font size=2>$row[1]</td>";
echo "<td align=right><font size=2> $row[0]</td>\n";
echo "<td align=right><font size=2> $call_hours_int:$call_minutes_int</td></tr>\n";
$total_calls = ($total_calls + $row[0]);
echo "<tr $bgcolor><td><font size=2>$row[1]</td>";
echo "<td align=right><font size=2> $row[0]</td>\n";
echo "<td align=right><font size=2> $call_hours_int:$call_minutes_int</td></tr>\n";
$total_calls = ($total_calls + $row[0]);
$call_seconds=0;
$o++;
$call_seconds=0;
$o++;
}
$stmt="SELECT sum(length_in_sec) from call_log where extension='" . mysql_real_escape_string($extension) . "' and server_ip='" . mysql_real_escape_string($server_ip) . "' and start_time >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and start_time <= '" . mysql_real_escape_string($end_date) . " 23:59:59'";
@@ -211,45 +238,40 @@ echo "<B>LAST 1000 CALLS FOR DATE RANGE:</B>\n";
echo "<TABLE width=400 cellspacing=0 cellpadding=1>\n";
echo "<tr><td><font size=2>NUMBER </td><td><font size=2>CHANNEL GROUP </td><td align=right><font size=2> DATE</td><td align=right><font size=2> LENGTH(MIN.)</td></tr>\n";
$stmt="SELECT number_dialed,channel_group,start_time,length_in_min from call_log where extension='" . mysql_real_escape_string($extension) . "' and server_ip='" . mysql_real_escape_string($server_ip) . "' and start_time >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and start_time <= '" . mysql_real_escape_string($end_date) . " 23:59:59' LIMIT 1000";
$rslt=mysql_query($stmt, $link);
$events_to_print = mysql_num_rows($rslt);
$stmt="SELECT number_dialed,channel_group,start_time,length_in_min from call_log where extension='" . mysql_real_escape_string($extension) . "' and server_ip='" . mysql_real_escape_string($server_ip) . "' and start_time >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and start_time <= '" . mysql_real_escape_string($end_date) . " 23:59:59' LIMIT 1000";
$rslt=mysql_query($stmt, $link);
$events_to_print = mysql_num_rows($rslt);
# echo "|$stmt|\n";
$total_calls=0;
$o=0;
$event_start_seconds='';
$event_stop_seconds='';
while ($events_to_print > $o) {
$row=mysql_fetch_row($rslt);
if (preg_match('/1$|3$|5$|7$|9$/i', $o))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
echo "<tr $bgcolor><td><font size=2>$row[0]</td>";
echo "<td align=right><font size=2> $row[1]</td>\n";
echo "<td align=right><font size=2> $row[2]</td>\n";
echo "<td align=right><font size=2> $row[3]</td></tr>\n";
$total_calls=0;
$o=0;
$event_start_seconds='';
$event_stop_seconds='';
while ($events_to_print > $o)
{
$row=mysql_fetch_row($rslt);
if (preg_match('/1$|3$|5$|7$|9$/i', $o))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
echo "<tr $bgcolor><td><font size=2>$row[0]</td>";
echo "<td align=right><font size=2> $row[1]</td>\n";
echo "<td align=right><font size=2> $row[2]</td>\n";
echo "<td align=right><font size=2> $row[3]</td></tr>\n";
$call_seconds=0;
$o++;
$call_seconds=0;
$o++;
}
echo "</TABLE></center>\n";
$ENDtime = date("U");
$RUNtime = ($ENDtime - $STARTtime);
echo "\n\n\n<br><br><br>\n\n";
echo "<font size=0>\n\n\n<br><br><br>\nscript runtime: $RUNtime seconds</font>";
?>
@@ -261,11 +283,5 @@ echo "<font size=0>\n\n\n<br><br><br>\nscript runtime: $RUNtime seconds</font>";
exit;
?>
agc_2-X/trunk/www/vicidial/qc/QC_admin_include01.php
+14 -8
View File
@@ -2,11 +2,13 @@
# QC_admin_include01.php
#
# Copyright (C) 2012 poundteam.com LICENSE: AGPLv2
# Copyright (C) 2013 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed to be used by admin.php with QC enabled, contributed by poundteam.com
#
# changes:
# 121116-1334 - First build, added to vicidial codebase
# 130621-2351 - Finalized changing of all ereg instances to preg
#
//Line 28030 admin.php
######################
@@ -32,12 +34,14 @@ if (($ADD==100000000000000) && ($qc_auth=='1')) {
$o=0;
while ($vicidialconf_to_print > $o) {
$row=mysql_fetch_row($rslt);
if (eregi("1$|3$|5$|7$|9$", $o)) {
if (preg_match("/1$|3$|5$|7$|9$/i", $o))
{
$bgcolor='bgcolor="#B9CBFD"';
}
else {
}
else
{
$bgcolor='bgcolor="#9BB9FB"';
}
}
echo "<tr $bgcolor><td><font size=1><a href=\"$PHP_SELF?ADD=881&campaign_id=$row[0]\">$row[0]</a></td>";
echo "<td><font size=1> $row[1]</td>";
echo "<td><font size=1> $row[2]</td>";
@@ -82,12 +86,14 @@ if (($ADD==881) && ($qc_auth=='1')) {
echo "<td align=center><font size=1 color=white><B>UserID</B></td></tr>\n";
}
$row=mysql_fetch_row($rslt);
if (eregi("1$|3$|5$|7$|9$", $o)) {
if (preg_match("/1$|3$|5$|7$|9$/i", $o))
{
$bgcolor='bgcolor="#B9CBFD"';
}
else {
}
else
{
$bgcolor='bgcolor="#9BB9FB"';
}
}
echo "<tr $bgcolor><td><font size=1>&nbsp;</td>";
echo "<td><font size=1> $row[0]</td>";
$lead_name=trim($row[1].' '.$row[2]);
agc_2-X/trunk/www/vicidial/qc/QC_call_client_iframe.php
+59 -59
View File
@@ -6,14 +6,18 @@
# QC_call_client_iframe.php
#
# Copyright (C) 2012 poundteam.com LICENSE: AGPLv2
# Copyright (C) 2013 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed to allow QC review and modification of leads, contributed by poundteam.com
#
# changes:
# 121116-1328 - First build, added to vicidial codebase
# 130621-2352 - Finalized changing of all ereg instances to preg
# - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("../dbconnect.php");
require("../functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -121,9 +125,6 @@ if (isset($_POST["appointment_date"])) {$appointment_date=$_POST["appointment_
if (isset($_POST["appointment_time"])) {$appointment_time=$_POST["appointment_time"];}
elseif (isset($_GET["appointment_time"])) {$appointment_time=$_GET["appointment_time"];}
$PHP_AUTH_USER = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_PW);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
@@ -143,71 +144,70 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
if ($non_latin < 1)
{
$PHP_AUTH_USER = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_PW);
$old_phone = ereg_replace("[^0-9]","",$old_phone);
$phone_number = ereg_replace("[^0-9]","",$phone_number);
$alt_phone = ereg_replace("[^0-9]","",$alt_phone);
} # end of non_latin
else
{
$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
}
if (strlen($phone_number)<6) {$phone_number=$old_phone;}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and qc_enabled = '1' and qc_user_level > 0;";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if ($WeBRooTWritablE > 0)
{$fp = fopen ("../project_auth_entries.txt", "a");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
$old_phone = preg_replace('/[^0-9]/','',$old_phone);
$phone_number = preg_replace('/[^0-9]/','',$phone_number);
$alt_phone = preg_replace('/[^0-9]/','',$alt_phone);
} # end of non_latin
else
{
if($auth>0)
{
$stmt="SELECT full_name,modify_leads from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname =$row[0];
$LOGmodify_leads =$row[1];
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|\n");
fclose($fp);
}
}
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
}
if (strlen($phone_number)<6) {$phone_number=$old_phone;}
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$rights_stmt = "SELECT modify_leads,qc_enabled,qc_user_level from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rights_rslt=mysql_query($rights_stmt, $link);
$rights_row=mysql_fetch_row($rights_rslt);
$modify_leads = $rights_row[0];
$qc_enabled = $rights_row[1];
$qc_user_level = $rights_row[2];
if ( $qc_enabled < 1 )
{
header ("Content-type: text/html; charset=utf-8");
echo "QC is not enabled for your user account\n";
exit;
}
if ( $qc_user_level < 1 )
{
header ("Content-type: text/html; charset=utf-8");
echo "QC user level is too low\n";
exit;
}
$label_title = 'Title';
$label_first_name = 'First';
$label_middle_initial = 'MI';
agc_2-X/trunk/www/vicidial/qc/QC_status_codes_include.php
+5 -3
View File
@@ -2,11 +2,13 @@
# QC_status_codes_include.php
#
# Copyright (C) 2012 poundteam.com LICENSE: AGPLv2
# Copyright (C) 2013 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed to display admin sections for QC functions, contributed by poundteam.com
#
# changes:
# 121116-1323 - First build, added to vicidial codebase
# 130621-2353 - Finalized changing of all ereg instances to preg
#
/*
@@ -44,7 +46,7 @@ if ($ADD==241111111111111)
### LOG INSERTION Admin Log Table ###
$SQL_log = "$stmt|";
$SQL_log = ereg_replace(';','',$SQL_log);
$SQL_log = preg_replace('/;/', '', $SQL_log);
$SQL_log = addslashes($SQL_log);
$stmt="INSERT INTO vicidial_admin_log set event_date='$SQLdate', user='$PHP_AUTH_USER', ip_address='$ip', event_section='QCSTATUSES', event_type='ADD', record_id='$code', event_code='ADMIN ADD QC STATUS', event_sql=\"$SQL_log\", event_notes='';";
if ($DB) {echo "|$stmt|\n";}
@@ -73,7 +75,7 @@ if ($ADD==341111111111111)
echo "<FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>";
echo "<br><center>\n";
echo "<b>VICIDIAL QC STATUS CODES WITHIN THIS SYSTEM: &nbsp; $NWB#vicidial_qc_status_codes$NWE</b><br>\n";
echo "<b>QC STATUS CODES WITHIN THIS SYSTEM: &nbsp; $NWB#vicidial_qc_status_codes$NWE</b><br>\n";
echo "<TABLE width=600 cellspacing=3>\n";
echo "<tr><td>STATUS CODE</td><td>DESCRIPTION</td><td>QC CATEGORY</td><td>MODIFY/DELETE</td></tr>\n";
@@ -92,7 +94,7 @@ if ($ADD==341111111111111)
$rowx=mysql_fetch_row($rslt);
$o++;
if (eregi("1$|3$|5$|7$|9$", $o))
if (preg_match("/1$|3$|5$|7$|9$/i", $o))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
agc_2-X/trunk/www/vicidial/qc/qc_api.php
+78 -61
View File
@@ -2,17 +2,21 @@
# qc_api.php
#
# Copyright (C) 2012 poundteam.com LICENSE: AGPLv2
# Copyright (C) 2013 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed to allow API functions for QC applications, contributed by poundteam.com
#
# changes:
# 121116-1329 - First build, added to vicidial codebase
# 130622-0001 - Finalized changing of all ereg instances to preg
# - Added filtering of input to prevent SQL injection attacks and new user auth
#
$version = '2.6-1';
$version = '2.8-2';
$build = '121116-1329';
require("../dbconnect.php");
require("../functions.php");
$query_string = getenv("QUERY_STRING");
@@ -124,7 +128,6 @@ if (isset($_GET["consultative"])) {$consultative=$_GET["consultative"];}
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
header ("Content-type: text/html; charset=utf-8");
header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header ("Pragma: no-cache"); // HTTP/1.0
@@ -143,65 +146,74 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$ingroup_choices = ereg_replace("\+"," ",$ingroup_choices);
$query_string = ereg_replace("'|\"|\\\\|;","",$query_string);
$ingroup_choices = preg_replace("/\+/"," ",$ingroup_choices);
$query_string = preg_replace("/'|\"|\\\\|;/","",$query_string);
if ($non_latin < 1)
{
$user=ereg_replace("[^0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
$agent_user=ereg_replace("[^0-9a-zA-Z]","",$agent_user);
$function = ereg_replace("[^-\_0-9a-zA-Z]","",$function);
$value = ereg_replace("[^-\_0-9a-zA-Z]","",$value);
$vendor_id = ereg_replace("[^-\_0-9a-zA-Z]","",$vendor_id);
$focus = ereg_replace("[^-\_0-9a-zA-Z]","",$focus);
$preview = ereg_replace("[^-\_0-9a-zA-Z]","",$preview);
$notes = ereg_replace("\+"," ",$notes);
$notes = ereg_replace("[^ -\.\_0-9a-zA-Z]","",$notes);
$phone_code = ereg_replace("[^0-9X]","",$phone_code);
$search = ereg_replace("[^-\_0-9a-zA-Z]","",$search);
$group_alias = ereg_replace("[^0-9a-zA-Z]","",$group_alias);
$dial_prefix = ereg_replace("[^0-9a-zA-Z]","",$dial_prefix);
$source = ereg_replace("[^0-9a-zA-Z]","",$source);
$format = ereg_replace("[^0-9a-zA-Z]","",$format);
$vtiger_callback = ereg_replace("[^A-Z]","",$vtiger_callback);
$blended = ereg_replace("[^A-Z]","",$blended);
$ingroup_choices = ereg_replace("[^ -\_0-9a-zA-Z]","",$ingroup_choices);
$set_as_default = ereg_replace("[^A-Z]","",$set_as_default);
$phone_number = ereg_replace("[^0-9]","",$phone_number);
$address1 = ereg_replace("[^ -\_0-9a-zA-Z]","",$address1);
$address2 = ereg_replace("[^ -\_0-9a-zA-Z]","",$address2);
$address3 = ereg_replace("[^ -\_0-9a-zA-Z]","",$address3);
$alt_phone = ereg_replace("[^ -\_0-9a-zA-Z]","",$alt_phone);
$city = ereg_replace("[^ -\_0-9a-zA-Z]","",$city);
$comments = ereg_replace("[^ -\_0-9a-zA-Z]","",$comments);
$country_code = ereg_replace("[^A-Z]","",$country_code);
$date_of_birth = ereg_replace("[^ -\_0-9]","",$date_of_birth);
$email = ereg_replace("[^-\.\:\/\@\_0-9a-zA-Z]","",$email);
$first_name = ereg_replace("[^ -\_0-9a-zA-Z]","",$first_name);
$gender = ereg_replace("[^A-Z]","",$gender);
$gmt_offset_now = ereg_replace("[^ \.-\_0-9]","",$gmt_offset_now);
$last_name = ereg_replace("[^ -\_0-9a-zA-Z]","",$last_name);
$lead_id = ereg_replace("[^0-9]","",$lead_id);
$middle_initial = ereg_replace("[^ -\_0-9a-zA-Z]","",$middle_initial);
$province = ereg_replace("[^ -\.\_0-9a-zA-Z]","",$province);
$security_phrase = ereg_replace("[^ -\.\_0-9a-zA-Z]","",$security_phrase);
$source_id = ereg_replace("[^ -\.\_0-9a-zA-Z]","",$source_id);
$state = ereg_replace("[^ -\_0-9a-zA-Z]","",$state);
$title = ereg_replace("[^ -\_0-9a-zA-Z]","",$title);
$vendor_lead_code = ereg_replace("[^ -\.\_0-9a-zA-Z]","",$vendor_lead_code);
$rank = ereg_replace("[^-0-9]","",$rank);
$owner = ereg_replace("[^-\.\:\/\@\_0-9a-zA-Z]","",$owner);
$dial_override = ereg_replace("[^A-Z]","",$dial_override);
$consultative = ereg_replace("[^A-Z]","",$consultative);
$user=preg_replace("/[^0-9a-zA-Z]/","",$user);
$pass=preg_replace("/[^0-9a-zA-Z]/","",$pass);
$agent_user=preg_replace("/[^0-9a-zA-Z]/","",$agent_user);
$function = preg_replace("/[^-\_0-9a-zA-Z]/","",$function);
$value = preg_replace("/[^-\_0-9a-zA-Z]/","",$value);
$vendor_id = preg_replace("/[^-\.\_0-9a-zA-Z]/","",$vendor_id);
$focus = preg_replace("/[^-\_0-9a-zA-Z]/","",$focus);
$preview = preg_replace("/[^-\_0-9a-zA-Z]/","",$preview);
$notes = preg_replace("/\+/"," ",$notes);
$notes = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$notes);
$phone_code = preg_replace("/[^0-9X]/","",$phone_code);
$search = preg_replace("/[^-\_0-9a-zA-Z]/","",$search);
$group_alias = preg_replace("/[^0-9a-zA-Z]/","",$group_alias);
$dial_prefix = preg_replace("/[^0-9a-zA-Z]/","",$dial_prefix);
$source = preg_replace("/[^0-9a-zA-Z]/","",$source);
$format = preg_replace("/[^0-9a-zA-Z]/","",$format);
$vtiger_callback = preg_replace("/[^A-Z]/","",$vtiger_callback);
$alt_dial = preg_replace("/[^0-9A-Z]/","",$alt_dial);
$blended = preg_replace("/[^A-Z]/","",$blended);
$ingroup_choices = preg_replace("/[^- \_0-9a-zA-Z]/","",$ingroup_choices);
$set_as_default = preg_replace("/[^A-Z]/","",$set_as_default);
$phone_number = preg_replace("/[^0-9]/","",$phone_number);
$address1 = preg_replace("/[^- \_0-9a-zA-Z]/","",$address1);
$address2 = preg_replace("/[^- \_0-9a-zA-Z]/","",$address2);
$address3 = preg_replace("/[^- \_0-9a-zA-Z]/","",$address3);
$alt_phone = preg_replace("/[^- \_0-9a-zA-Z]/","",$alt_phone);
$city = preg_replace("/[^- \_0-9a-zA-Z]/","",$city);
$comments = preg_replace("/[^- \_0-9a-zA-Z]/","",$comments);
$country_code = preg_replace("/[^A-Z]/","",$country_code);
$date_of_birth = preg_replace("/[^- \_0-9]/","",$date_of_birth);
$email = preg_replace("/[^-\.\:\/\@\_0-9a-zA-Z]/","",$email);
$first_name = preg_replace("/[^- \_0-9a-zA-Z]/","",$first_name);
$gender = preg_replace("/[^A-Z]/","",$gender);
$gmt_offset_now = preg_replace("/[^- \.\_0-9]/","",$gmt_offset_now);
$last_name = preg_replace("/[^- \_0-9a-zA-Z]/","",$last_name);
$lead_id = preg_replace("/[^0-9]/","",$lead_id);
$middle_initial = preg_replace("/[^- \_0-9a-zA-Z]/","",$middle_initial);
$province = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$province);
$security_phrase = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$security_phrase);
$source_id = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$source_id);
$state = preg_replace("/[^- \_0-9a-zA-Z]/","",$state);
$title = preg_replace("/[^- \_0-9a-zA-Z]/","",$title);
$vendor_lead_code = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$vendor_lead_code);
$rank = preg_replace("/[^-0-9]/","",$rank);
$owner = preg_replace("/[^-\.\:\/\@\_0-9a-zA-Z]/","",$owner);
$dial_override = preg_replace("/[^A-Z]/","",$dial_override);
$consultative = preg_replace("/[^A-Z]/","",$consultative);
$callback_datetime = preg_replace("/\+/"," ",$callback_datetime);
$callback_datetime = preg_replace("/[^- \:\.\_0-9a-zA-Z]/","",$callback_datetime);
$callback_type = preg_replace("/[^A-Z]/","",$callback_type);
$callback_comments = preg_replace("/\+/"," ",$callback_comments);
$callback_comments = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$callback_comments);
$qm_dispo_code = preg_replace("/[^-\.\_0-9a-zA-Z]/","",$qm_dispo_code);
$alt_user = preg_replace("/[^0-9a-zA-Z]/","",$alt_user);
$postal_code = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$postal_code);
}
else
{
$user = ereg_replace("'|\"|\\\\|;","",$user);
$pass = ereg_replace("'|\"|\\\\|;","",$pass);
$source = ereg_replace("'|\"|\\\\|;","",$source);
$agent_user = ereg_replace("'|\"|\\\\|;","",$agent_user);
$alt_user = ereg_replace("'|\"|\\\\|;","",$alt_user);
$user = preg_replace("/'|\"|\\\\|;/","",$user);
$pass = preg_replace("/'|\"|\\\\|;/","",$pass);
$source = preg_replace("/'|\"|\\\\|;/","",$source);
$agent_user = preg_replace("/'|\"|\\\\|;/","",$agent_user);
$alt_user = preg_replace("/'|\"|\\\\|;/","",$alt_user);
}
### date and fixed variables
@@ -256,18 +268,23 @@ else
}
else
{
$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and vdc_agent_api_access = '1';";
$auth=0;
$auth_message = user_authorization($user,$pass,'',0);
if ($auth_message == 'GOOD')
{$auth=1;}
$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$auth_api=$row[0];
if( (strlen($user)<2) or (strlen($pass)<2) or ($auth==0))
if( (strlen($user)<2) or (strlen($pass)<2) or ($auth==0) or ($auth_api==0))
{
$result = 'ERROR';
$result_reason = "Invalid Username/Password";
echo "$result: $result_reason: |$user|$pass|$auth|\n";
echo "$result: $result_reason: |$user|$pass|$auth|$auth_api|$auth_message|\n";
$data = "$user|$pass|$auth";
api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
exit;
@@ -319,7 +336,7 @@ if ($format=='debug')
################################################################################
if ($function == 'external_dial_lead')
{
$value = ereg_replace("[^0-9]","",$value);
$value = preg_replace("/[^0-9]/","",$value);
if ( (strlen($value)<1) or ( (strlen($agent_user)<2) and (strlen($alt_user)<2) ) or (strlen($search)<2) or (strlen($preview)<2) or (strlen($focus)<2) )
{
@@ -429,7 +446,7 @@ if ($function == 'external_dial_lead')
####### Begin Vtiger CallBack Launching #######
$vtiger_callback_id='';
if ( (eregi("YES",$vtiger_callback)) and (preg_match("/^99/",$value)) )
if ( (preg_match("/YES/i",$vtiger_callback)) and (preg_match("/^99/",$value)) )
{
$value = preg_replace("/^99/",'',$value);
$value = ($value + 0);
agc_2-X/trunk/www/vicidial/qc/qc_modify_lead.php
+75 -70
View File
@@ -6,15 +6,19 @@
# qc_modify_lead.php
#
# Copyright (C) 2012 poundteam.com LICENSE: AGPLv2
# Copyright (C) 2013 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed to allow QC review and modification of leads, contributed by poundteam.com
#
# changes:
# 121116-1324 - First build, added to vicidial codebase
# 121130-1034 - Changed scheduled callback user ID field to be 20 characters, issue #467
# 130621-2328 - Finalized changing of all ereg instances to preg
# - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("../dbconnect.php");
require("../functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -122,9 +126,6 @@ if (isset($_POST["appointment_date"])) {$appointment_date=$_POST["appointment_
if (isset($_POST["appointment_time"])) {$appointment_time=$_POST["appointment_time"];}
elseif (isset($_GET["appointment_time"])) {$appointment_time=$_GET["appointment_time"];}
$PHP_AUTH_USER = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_PW);
$STARTtime = date("U");
$defaultappointment = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
@@ -146,69 +147,69 @@ if ($qm_conf_ct > 0)
if ($non_latin < 1)
{
$PHP_AUTH_USER = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
$old_phone = ereg_replace("[^0-9]","",$old_phone);
$phone_number = ereg_replace("[^0-9]","",$phone_number);
$alt_phone = ereg_replace("[^0-9]","",$alt_phone);
$old_phone = preg_replace('/[^0-9]/','',$old_phone);
$phone_number = preg_replace('/[^0-9]/','',$phone_number);
$alt_phone = preg_replace('/[^0-9]/','',$alt_phone);
} # end of non_latin
else
{
$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
}
if (strlen($phone_number)<6) {$phone_number=$old_phone;}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and qc_enabled = '1' and qc_user_level > 0;";
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$rights_stmt = "SELECT modify_leads,qc_enabled from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rights_rslt=mysql_query($rights_stmt, $link);
$rights_row=mysql_fetch_row($rights_rslt);
$modify_leads = $rights_row[0];
$qc_enabled = $rights_row[1];
# check their permissions
#if ( $modify_leads < 1 )
# {
# header ("Content-type: text/html; charset=utf-8");
# echo "You do not have permissions to modify leads\n";
# exit;
# }
if ( $qc_enabled < 1 )
{
header ("Content-type: text/html; charset=utf-8");
echo "QC is not enabled for your user account\n";
exit;
}
$stmt="SELECT full_name,modify_leads,user_group from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if ($WeBRooTWritablE > 0)
{$fp = fopen ("../project_auth_entries.txt", "a");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
if($auth>0)
{
$stmt="SELECT full_name,modify_leads,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname =$row[0];
$LOGmodify_leads =$row[1];
$LOGuser_group =$row[2];
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|\n");
fclose($fp);
}
}
}
$LOGfullname =$row[0];
$LOGmodify_leads =$row[1];
$LOGuser_group =$row[2];
$label_title = 'Title';
$label_first_name = 'First';
@@ -320,7 +321,7 @@ if ($end_call > 0) {
}
### insert a NEW record to the vicidial_closer_log table
$qcchangelist=mysql_real_escape_string($qcchangelist);
$view_epoch = ereg_replace("[^0-9]","",$_POST['viewtime']);
$view_epoch = preg_replace('/[^0-9]/','',$_POST['viewtime']);
$elapsed_seconds=$STARTtime-$view_epoch;
$stmt="UPDATE vicidial_qc_agent_log set save_datetime='$NOW_TIME',save_epoch='$STARTtime',elapsed_seconds='$elapsed_seconds',old_status='{$original_record['status']}',new_status='{$new_record['status']}',details='$qcchangelist'
@@ -340,7 +341,7 @@ if ($end_call > 0) {
echo "<CENTER><B><FONT FACE='Courier' COLOR=BLACK SIZE=3><a href=\"../admin.php?ADD=881&campaign_id=$campaign_id\">Proceed to QC CAMPAIGN $campaign_id Queue</a></B><BR><BR><B><I>Callback Information:</I></B>\n";
### LOG INSERTION Admin Log Table ###
$SQL_log = "$stmt|";
$SQL_log = ereg_replace(';','',$SQL_log);
$SQL_log = preg_replace('/;/', '', $SQL_log);
$SQL_log = addslashes($SQL_log);
$stmt="INSERT INTO vicidial_admin_log set event_date='$NOW_TIME', user='$PHP_AUTH_USER', ip_address='$ip', event_section='LEADS', event_type='MODIFY', record_id='$lead_id', event_code='ADMIN MODIFY LEAD', event_sql=\"$SQL_log\", event_notes='';";
if ($DB) {echo "|$stmt|\n";}
@@ -573,7 +574,7 @@ if ($end_call > 0) {
echo __LINE__."\n";
}
$row=mysql_fetch_row($rslt);
if (eregi("1$|3$|5$|7$|9$", $c))
if (preg_match("/1$|3$|5$|7$|9$/i", $c))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
@@ -607,7 +608,7 @@ if ($end_call > 0) {
if($DB) echo __LINE__."<br>\n";
$row=mysql_fetch_row($rslt);
if (strlen($log_campaign)<1) {$log_campaign = $row[3];}
if (eregi("1$|3$|5$|7$|9$", $u))
if (preg_match("/1$|3$|5$|7$|9$/i", $u))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
@@ -640,7 +641,7 @@ if ($end_call > 0) {
{
$row=mysql_fetch_row($rslt);
if (strlen($Alog_campaign)<1) {$Alog_campaign = $row[5];}
if (eregi("1$|3$|5$|7$|9$", $y))
if (preg_match("/1$|3$|5$|7$|9$/i", $y))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
@@ -675,7 +676,7 @@ if ($end_call > 0) {
{
$row=mysql_fetch_assoc($rslt);
if (strlen($Alog_campaign)<1) {$Alog_campaign = $row[5];}
if (eregi("1$|3$|5$|7$|9$", $y))
if (preg_match("/1$|3$|5$|7$|9$/i", $y))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
@@ -720,7 +721,7 @@ if ($end_call > 0) {
{
$row=mysql_fetch_row($rslt);
if (strlen($Clog_campaign)<1) {$Clog_campaign = $row[3];}
if (eregi("1$|3$|5$|7$|9$", $y))
if (preg_match("/1$|3$|5$|7$|9$/i", $y))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
@@ -882,7 +883,7 @@ if ($end_call > 0) {
echo __LINE__."\n";
}
$rowx=mysql_fetch_row($rslt);
if ( (strlen($dispo) == strlen($rowx[0])) and (eregi($dispo,$rowx[0])) )
if ( (strlen($dispo) == strlen($rowx[0])) and (preg_match("/$dispo/",$rowx[0])) )
{$statuses_list .= "<option SELECTED value=\"$rowx[0]\">$rowx[0] - $rowx[1]</option>\n"; $DS++;}
else
{$statuses_list .= "<option value=\"$rowx[0]\">$rowx[0] - $rowx[1]</option>\n";}
@@ -1185,7 +1186,7 @@ if ($end_call > 0) {
while ($logs_to_print > $u)
{
$row=mysql_fetch_row($rslt);
if (eregi("1$|3$|5$|7$|9$", $u))
if (preg_match("/1$|3$|5$|7$|9$/i", $u))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
@@ -1195,9 +1196,9 @@ if ($end_call > 0) {
if (strlen($location)>2)
{
$URLserver_ip = $location;
$URLserver_ip = eregi_replace('http://','',$URLserver_ip);
$URLserver_ip = eregi_replace('https://','',$URLserver_ip);
$URLserver_ip = eregi_replace("\/.*",'',$URLserver_ip);
$URLserver_ip = preg_replace('/http:\/\//i', '',$URLserver_ip);
$URLserver_ip = preg_replace('/https:\/\//i', '',$URLserver_ip);
$URLserver_ip = preg_replace('/\/.*/i', '',$URLserver_ip);
$stmt="select count(*) from servers where server_ip='$URLserver_ip';";
$rsltx=mysql_query($stmt, $link);
$rowx=mysql_fetch_row($rsltx);
@@ -1208,9 +1209,13 @@ if ($end_call > 0) {
$rsltx=mysql_query($stmt, $link);
$rowx=mysql_fetch_row($rsltx);
if (eregi("ALT_IP",$rowx[0]))
if (preg_match("/ALT_IP/i",$rowx[0]))
{
$location = eregi_replace($URLserver_ip, $rowx[1], $location);
$location = preg_replace("/$URLserver_ip/i", "$rowx[1]", $location);
}
if (preg_match("/EXTERNAL_IP/i",$rowx[0]))
{
$location = preg_replace("/$URLserver_ip/i", "$rowx[2]", $location);
}
}
}
@@ -1219,7 +1224,7 @@ if ($end_call > 0) {
{$locat = substr($location,0,27); $locat = "$locat...";}
else
{$locat = $location;}
if ( (eregi("ftp",$location)) or (eregi("http",$location)) )
if ( (preg_match('/ftp/i',$location)) or (preg_match('/http/i',$location)) )
{$location = "<a href=\"$location\">$locat</a>";}
else
{$location = $locat;}
agc_2-X/trunk/www/vicidial/realtime_report.php
+94 -30
View File
@@ -23,12 +23,13 @@
# 121129-2131 - Fixed Choose link position
# 130414-0247 - Added report logging
# 130610-0944 - Finalized changing of all ereg instances to preg
# 130616-2237 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
$version = '2.6-11';
$build = '130414-0247';
$version = '2.8-13';
$build = '130616-2237';
header ("Content-type: text/html; charset=utf-8");
@@ -241,28 +242,91 @@ $epochTWENTYFOURhoursAGO = ($STARTtime - 86400);
$timeTWENTYFOURhoursAGO = date("Y-m-d H:i:s",$epochTWENTYFOURhoursAGO);
$webphone_content='';
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$RR = preg_replace('/[^0-9]/', '', $RR);
$inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $inbound);
$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group);
$groups[0] = preg_replace('/[^-_0-9a-zA-Z]/', '', $groups[0]);
$usergroup = preg_replace('/[^-_0-9a-zA-Z]/', '', $usergroup);
$DB = preg_replace('/[^0-9]/', '', $DB);
$adastats = preg_replace('/[^-_0-9a-zA-Z]/', '', $adastats);
$SIPmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $SIPmonitorLINK);
$IAXmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $IAXmonitorLINK);
$UGdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $UGdisplay);
$UidORname = preg_replace('/[^-_0-9a-zA-Z]/', '', $UidORname);
$orderby = preg_replace('/[^-_0-9a-zA-Z]/', '', $orderby);
$SERVdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $SERVdisplay);
$CALLSdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CALLSdisplay);
$PHONEdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHONEdisplay);
$CUSTPHONEdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CUSTPHONEdisplay);
$NOLEADSalert = preg_replace('/[^-_0-9a-zA-Z]/', '', $NOLEADSalert);
$DROPINGROUPstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $DROPINGROUPstats);
$ALLINGROUPstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $ALLINGROUPstats);
$with_inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $with_inbound);
$monitor_active = preg_replace('/[^-_0-9a-zA-Z]/', '', $monitor_active);
$monitor_phone = preg_replace('/[^-_0-9a-zA-Z]/', '', $monitor_phone);
$CARRIERstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $CARRIERstats);
$PRESETstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $PRESETstats);
$AGENTtimeSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $AGENTtimeSTATS);
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -296,9 +360,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
if ($auth)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,callcard_admin,force_change_password,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,modify_contacts,modify_same_user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW';";
$stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,callcard_admin,force_change_password,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,modify_contacts,modify_same_user_level from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfull_name =$row[3];
@@ -361,7 +423,7 @@ if ($auth)
$vmLOGadmin_viewable_groupsSQL='';
if ( (!preg_match('/\-\-ALL\-\-/i',$LOGadmin_viewable_groups)) and (strlen($LOGadmin_viewable_groups) > 3) )
{
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ -/",'',$LOGadmin_viewable_groups);
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ \-/",'',$LOGadmin_viewable_groups);
$rawLOGadmin_viewable_groupsSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_groupsSQL);
$LOGadmin_viewable_groupsSQL = "and user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
$whereLOGadmin_viewable_groupsSQL = "where user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
@@ -376,14 +438,14 @@ if ($auth)
# and (preg_match("/MONITOR|BARGE|HIJACK/",$monitor_active) ) )
if ( (!isset($monitor_phone)) or (strlen($monitor_phone)<1) )
{
$stmt="select phone_login from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and active='Y';";
$stmt="select phone_login from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$monitor_phone = $row[0];
}
$stmt="SELECT realtime_block_user_info,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT realtime_block_user_info,user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -402,7 +464,7 @@ $system_key = $row[4];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
@@ -443,6 +505,7 @@ $group_string='|';
$group_ct = count($groups);
while($i < $group_ct)
{
$groups[$i] = preg_replace('/[^-_0-9a-zA-Z]/', '', $groups[$i]);
if ( (preg_match("/ $groups[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/ALL-/",$LOGallowed_campaigns)) )
{
$group_string .= "$groups[$i]|";
@@ -459,6 +522,7 @@ $user_group_string='|';
$user_group_ct = count($user_group_filter);
while($i < $user_group_ct)
{
$user_group_filter[$i] = preg_replace('/[^-_0-9a-zA-Z]/', '', $user_group_filter[$i]);
# if ( (preg_match("/ $user_group_filter[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/ALL-/",$LOGallowed_campaigns)) )
# {
$user_group_string .= "$user_group_filter[$i]|";
agc_2-X/trunk/www/vicidial/record_conf_1_hour.php
+103 -98
View File
@@ -12,9 +12,11 @@
# 90508-0644 - Changed to PHP long tags
# 120223-2135 - Removed logging of good login passwords if webroot writable is enabled
# 130610-1109 - Finalized changing of all ereg instances to preg
# 130616-2230 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -24,13 +26,13 @@ if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];}
if (isset($_GET["station"])) {$station=$_GET["station"];}
elseif (isset($_POST["station"])) {$station=$_POST["station"];}
if (isset($_GET["session_id"])) {$session_id=$_GET["session_id"];}
elseif (isset($_POST["session_id"])) {$session_id=$_POST["session_id"];}
if (isset($_GET["NEW_RECORDING"])) {$NEW_RECORDING=$_GET["NEW_RECORDING"];}
elseif (isset($_POST["NEW_RECORDING"])) {$NEW_RECORDING=$_POST["NEW_RECORDING"];}
elseif (isset($_POST["session_id"])) {$session_id=$_POST["session_id"];}
if (isset($_GET["NEW_RECORDING"])) {$NEW_RECORDING=$_GET["NEW_RECORDING"];}
elseif (isset($_POST["NEW_RECORDING"])) {$NEW_RECORDING=$_POST["NEW_RECORDING"];}
if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
@@ -38,97 +40,102 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
$i=0;
while ($i < $qm_conf_ct)
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
$SSoutbound_autodial_active = $row[2];
$user_territories_active = $row[3];
$i++;
}
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$MYSQL_datetime = date("Y-m-d H:i:s");
$FILE_datetime = date("Ymd-His_");
$secX = $STARTtime;
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$fp = fopen ("./project_auth_entries.txt", "a");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
if($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($webroot_writable > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
}
$stmt="SELECT full_name from vicidial_users where user='$user';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$full_name = $row[0];
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
$stmt="SELECT full_name from vicidial_users where user='$user';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$full_name = $row[0];
?>
<html>
<head>
<title>VICIDIAL RECORD CONFERENCE: 1 hour</title>
<title>RECORD CONFERENCE: 1 hour</title>
<?php
echo "<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n";
?>
@@ -138,45 +145,43 @@ echo "<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n"
<?php
if ($NEW_RECORDING)
{
{
if ( (strlen($server_ip) > 8) && (strlen($session_id) > 3) && (strlen($station) > 3) )
{
$local_DEF = 'Local/';
$local_AMP = '@';
$conf_silent_prefix = '7';
$ext_context = 'demo';
{
$local_DEF = 'Local/';
$local_AMP = '@';
$conf_silent_prefix = '7';
$ext_context = 'demo';
$stmt="INSERT INTO vicidial_manager values('','','$MYSQL_datetime','NEW','N','" . mysql_real_escape_string($server_ip) . "','','Originate','RB$FILE_datetime" . mysql_real_escape_string($station) . "','Channel: $local_DEF$conf_silent_prefix" . mysql_real_escape_string($session_id) . "$local_AMP$ext_context','Context: $ext_context','Exten: 8309','Priority: 1','Callerid: $FILE_datetime" . mysql_real_escape_string($station) . "','','','','','')";
echo "|$stmt|\n<BR><BR>\n";
$rslt=mysql_query($stmt, $link);
$stmt="INSERT INTO vicidial_manager values('','','$MYSQL_datetime','NEW','N','" . mysql_real_escape_string($server_ip) . "','','Originate','RB$FILE_datetime" . mysql_real_escape_string($station) . "','Channel: $local_DEF$conf_silent_prefix" . mysql_real_escape_string($session_id) . "$local_AMP$ext_context','Context: $ext_context','Exten: 8309','Priority: 1','Callerid: $FILE_datetime" . mysql_real_escape_string($station) . "','','','','','')";
echo "|$stmt|\n<BR><BR>\n";
$rslt=mysql_query($stmt, $link);
$stmt="INSERT INTO recording_log (channel,server_ip,extension,start_time,start_epoch,filename) values('" . mysql_real_escape_string($session_id) . "','" . mysql_real_escape_string($server_ip) . "','" . mysql_real_escape_string($station) . "','$MYSQL_datetime','$secX','$FILE_datetime" . mysql_real_escape_string($station) . "')";
echo "|$stmt|\n<BR><BR>\n";
$rslt=mysql_query($stmt, $link);
$stmt="INSERT INTO recording_log (channel,server_ip,extension,start_time,start_epoch,filename) values('" . mysql_real_escape_string($session_id) . "','" . mysql_real_escape_string($server_ip) . "','" . mysql_real_escape_string($station) . "','$MYSQL_datetime','$secX','$FILE_datetime" . mysql_real_escape_string($station) . "')";
echo "|$stmt|\n<BR><BR>\n";
$rslt=mysql_query($stmt, $link);
echo "Recording started\n<BR><BR>\n";
echo "<a href=\"$PHP_SELF\">Back to main recording screen</a>\n<BR><BR>\n";
}
echo "Recording started\n<BR><BR>\n";
echo "<a href=\"$PHP_SELF\">Back to main recording screen</a>\n<BR><BR>\n";
}
else
{
echo "ERROR!!!! Not all info entered properly\n<BR><BR>\n";
echo "|$server_ip| |$session_id| |$station|\n<BR><BR>\n";
echo "<a href=\"$PHP_SELF\">Back to main recording screen</a>\n<BR><BR>\n";
{
echo "ERROR!!!! Not all info entered properly\n<BR><BR>\n";
echo "|$server_ip| |$session_id| |$station|\n<BR><BR>\n";
echo "<a href=\"$PHP_SELF\">Back to main recording screen</a>\n<BR><BR>\n";
}
}
}
else
{
echo "<br>Start recording a conference for 1 hour: <form action=$PHP_SELF method=POST>\n";
echo "<input type=hidden name=NEW_RECORDING value=1>\n";
echo "server_ip: <input type=text name=server_ip size=15 maxlength=15> | \n";
echo "session_id: <input type=text name=session_id size=7 maxlength=7> | \n";
echo "station: <input type=text name=station size=5 maxlength=5> | \n";
echo "<input type=submit name=submit value=submit>\n";
echo "<BR><BR><BR>\n";
}
{
echo "<br>Start recording a conference for 1 hour: <form action=$PHP_SELF method=POST>\n";
echo "<input type=hidden name=NEW_RECORDING value=1>\n";
echo "server_ip: <input type=text name=server_ip size=15 maxlength=15> | \n";
echo "session_id: <input type=text name=session_id size=7 maxlength=7> | \n";
echo "station: <input type=text name=station size=5 maxlength=5> | \n";
echo "<input type=submit name=submit value=submit>\n";
echo "<BR><BR><BR>\n";
}
?>
</BODY></HTML>
</BODY></HTML>
agc_2-X/trunk/www/vicidial/recording_lookup.php
+13 -11
View File
@@ -2,6 +2,7 @@
### recording_lookup.php
#
# REQUIRED! - check all paths and directory names, need to create a temp directory
# CUSTOMIZATION OF THIS SCRIPT IS REQUIRED FOR IT TO WORK!!!
#
# On the normal audio recording interface you now have the option of
# downloading the WAV or GSM file:
@@ -33,12 +34,13 @@
# 90508-0644 - Changed to PHP long tags
# 120223-2129 - Removed logging of good login passwords if webroot writable is enabled
# 130610-1108 - Finalized changing of all ereg instances to preg
# 130616-2228 - Added filtering of input to prevent SQL injection attacks
#
$STARTtime = date("U");
$TODAYstart = date("H/i/s 00:00:00");
$linkAST=mysql_connect("10.10.10.15", "cron", "1234");
$linkAST=mysql_connect("1.1.1.1", "cron", "1234");
mysql_select_db("asterisk");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
@@ -47,6 +49,10 @@ $PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["QUERY_recid"])) {$QUERY_recid=$_GET["QUERY_recid"];}
elseif (isset($_POST["QUERY_recid"])) {$QUERY_recid=$_POST["QUERY_recid"];}
$QUERY_recid = preg_replace("/'|\"|\\\\|;/","",$QUERY_recid);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$web_server = '1.1.1.1';
$US='_';
@@ -93,9 +99,9 @@ else
echo "<B>searching for: $QUERY_recid</B>\n";
echo "<PRE>\n";
$stmt="select recording_id,lead_id,user,filename,location,start_time,length_in_sec from recording_log where filename LIKE \"%$QUERY_recid%\" order by recording_id desc LIMIT 1;";
$rslt=mysql_query($stmt, $linkAST);
$logs_to_print = mysql_num_rows($rslt);
$stmt="select recording_id,lead_id,user,filename,location,start_time,length_in_sec from recording_log where filename LIKE \"%$QUERY_recid%\" order by recording_id desc LIMIT 1;";
$rslt=mysql_query($stmt, $linkAST);
$logs_to_print = mysql_num_rows($rslt);
#echo "|$stmt|";
$u=0;
@@ -110,8 +116,8 @@ else
$location = $row[4];
$start_time = $row[5];
$length_in_sec = $row[6];
$AUDname = explode("/",$location);
$AUDnamect = (count($AUDname)) - 1;
$AUDname = explode("/",$location);
$AUDnamect = (count($AUDname)) - 1;
preg_replace('/10\.10\.10\.16/i', "10.10.10.16",$AUDname[$AUDnamect]);
@@ -140,15 +146,12 @@ else
echo "Link Uncompressed WAV: <a href=\"./temp/$AUDname[$AUDnamect]\">$AUDname[$AUDnamect]</a>\n";
echo "Link Compressed GSM: <a href=\"./temp/$fileGSM\">$fileGSM</a>\n";
}
else
{
echo "ERROR: $QUERY_recid\n";
}
echo "</PRE>\n";
}
$ENDtime = date("U");
@@ -166,7 +169,6 @@ echo "\n\n\n<br><br><br>\nscript runtime: $RUNtime seconds";
?>
</body>
</html>
agc_2-X/trunk/www/vicidial/recording_lookup_DIRECT.php
+21 -17
View File
@@ -2,6 +2,7 @@
### recording_lookup_DIRECT.php
#
# REQUIRED! - check all paths and directory names, need to create a temp directory
# CUSTOMIZATION OF THIS SCRIPT IS REQUIRED FOR IT TO WORK!!!
#
# On the normal audio recording interface you now have the option of
# downloading the WAV or GSM file:
@@ -32,12 +33,13 @@
# 71112-1409 - First Build
# 90508-0644 - Changed to PHP long tags
# 130610-1132 - Finalized changing of all ereg instances to preg
# 130616-2225 - Added filtering of input to prevent SQL injection attacks
#
$STARTtime = date("U");
$TODAYstart = date("H/i/s 00:00:00");
$linkAST=mysql_connect("10.10.10.15", "cron", "1234");
$linkAST=mysql_connect("1.1.1.1", "cron", "1234");
mysql_select_db("asterisk");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
@@ -50,22 +52,26 @@ if (isset($_GET["format"])) {$format=$_GET["format"];}
if (isset($_GET["auth"])) {$auth=$_GET["auth"];}
elseif (isset($_POST["auth"])) {$auth=$_POST["auth"];}
$phone = preg_replace("/'|\"|\\\\|;/","",$phone);
$format = preg_replace("/'|\"|\\\\|;/","",$format);
$auth = preg_replace("/'|\"|\\\\|;/","",$auth);
$US='_';
if(preg_match("/VDC1234593JH654398722/i",$auth))
if(preg_match("/VDC1234593JH654398722/i",$auth))
{$nothing=1;}
else
else
{
echo "auth code: |$auth|\n";
exit;
echo "auth code: |$auth|\n";
exit;
}
$fp = fopen ("/usr/local/apache2/htdocs/vicidial/auth_entries.txt", "a");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
fwrite ($fp, "AUTH|VDC |$date|$auth|$ip|$phone|$format|$browser|\n");
fclose($fp);
$fp = fopen ("/usr/local/apache2/htdocs/vicidial/auth_entries.txt", "a");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
fwrite ($fp, "AUTH|VDC |$date|$auth|$ip|$phone|$format|$browser|\n");
fclose($fp);
if (strlen($format)<3) {$format='WAV';}
if ( (strlen($phone)<10) or (strlen($phone)>10) )
@@ -94,8 +100,8 @@ else
$filename = $row[1];
$location = $row[2];
$start_time = $row[3];
$AUDname = explode("/",$location);
$AUDnamect = (count($AUDname)) - 1;
$AUDname = explode("/",$location);
$AUDnamect = (count($AUDname)) - 1;
preg_replace('/10\.10\.10\.16/i', "10.10.10.16",$AUDname[$AUDnamect]);
@@ -103,10 +109,10 @@ else
$locationGSM=$location;
$fileGSM = preg_replace('/\.wav/i', ".gsm",$fileGSM);
if (!preg_match('/gsm/i',$locationGSM))
{
{
$locationGSM = preg_replace('/10\.10\.10\.16/i', "10.10.10.16/GSM",$locationGSM);
$locationGSM = preg_replace('/\.wav/i', ".gsm",$locationGSM);
}
}
if ($format == 'WAV')
{
exec("/usr/local/apache2/htdocs/vicidial/wget --output-document=/usr/local/apache2/htdocs/vicidial/temp/$AUDname[$AUDnamect] $location\n");
@@ -135,11 +141,9 @@ else
readfile($AUDIOfile);
}
}
else
{
echo "ERROR: $phone|$format\n";
}
}
?>
agc_2-X/trunk/www/vicidial/remote_dispo.php
+79 -113
View File
@@ -13,10 +13,11 @@
# 90508-0644 - Changed to PHP long tags
# 120223-2135 - Removed logging of good login passwords if webroot writable is enabled
# 130610-1108 - Finalized changing of all ereg instances to preg
# 130616-2149 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -108,15 +109,13 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
$i=0;
while ($i < $qm_conf_ct)
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
$SSoutbound_autodial_active = $row[2];
$user_territories_active = $row[3];
$i++;
}
##### END SETTINGS LOOKUP #####
###########################################
@@ -125,66 +124,51 @@ $STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$FILE_datetime = $STARTtime;
$ext_context = 'demo';
if (!isset($begin_date)) {$begin_date = $TODAY;}
if (!isset($end_date)) {$end_date = $TODAY;}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 2;";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$fp = fopen ("./project_auth_entries.txt", "a");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
$ext_context = 'demo';
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REMOTE',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICIDIAL-CLOSER\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
else
{
if($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
$fullname = $row[0];
if ($webroot_writable > 0)
{
fwrite ($fp, "VD_CLOSER|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($webroot_writable > 0)
{
fwrite ($fp, "VD_CLOSER|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
fclose($fp);
}
}
header ("Content-type: text/html; charset=utf-8");
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
$fullname = $row[0];
}
?>
<html>
<head>
<title>VICIDIAL REMOTE: Call Disposition</title>
<title>REMOTE: Call Disposition</title>
<?php
echo "<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n";
?>
@@ -197,9 +181,8 @@ echo "<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n"
echo "<!-- $call_began $lead_id -->";
if ($end_call > 0)
{
$call_length = ($STARTtime - $call_began);
{
$call_length = ($STARTtime - $call_began);
### insert a NEW record to the vicidial_closer_log table
$stmt="UPDATE vicidial_closer_log set end_epoch='$STARTtime', length_in_sec='" . mysql_real_escape_string($call_length) . "', status='" . mysql_real_escape_string($status) . "', user='$PHP_AUTH_USER' where lead_id='" . mysql_real_escape_string($lead_id) . "' order by start_epoch desc limit 1;";
@@ -214,10 +197,9 @@ $call_length = ($STARTtime - $call_began);
echo "Call has been dispositioned &nbsp; &nbsp; &nbsp; $NOW_TIME\n<BR><BR>\n";
echo "<form><input type=button value=\"Close This Window\" onClick=\"javascript:window.close();\"></form>\n";
}
}
else
{
{
$stmt="SELECT count(*) from vicidial_list where lead_id='" . mysql_real_escape_string($lead_id) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
@@ -225,37 +207,36 @@ else
$lead_count = $row[0];
if ($lead_count > 0)
{
{
$stmt="SELECT lead_id,entry_date,modify_date,status,user,vendor_lead_code,source_id,list_id,gmt_offset_now,called_since_last_reset,phone_code,phone_number,title,first_name,middle_initial,last_name,address1,address2,address3,city,state,province,postal_code,country_code,gender,date_of_birth,alt_phone,email,security_phrase,comments,called_count,last_local_call_time,rank,owner from vicidial_list where lead_id='" . mysql_real_escape_string($lead_id) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$lead_id = "$row[0]";
$tsr = "$row[4]";
$vendor_id = "$row[5]";
$list_id = "$row[7]";
$campaign_id = "$row[8]";
$phone_code = "$row[10]";
$phone_number = "$row[11]";
$title = "$row[12]";
$first_name = "$row[13]"; #
$middle_initial = "$row[14]";
$last_name = "$row[15]"; #
$address1 = "$row[16]"; #
$address2 = "$row[17]"; #
$address3 = "$row[18]"; #
$city = "$row[19]"; #
$state = "$row[20]"; #
$province = "$row[21]"; #
$postal_code = "$row[22]"; #
$country_code = "$row[23]"; #
$gender = "$row[24]";
$date_of_birth = "$row[25]";
$alt_phone = "$row[26]"; #
$email = "$row[27]"; #
$security = "$row[28]"; #
$comments = "$row[29]"; #
$lead_id = $row[0];
$tsr = $row[4];
$vendor_id = $row[5];
$list_id = $row[7];
$campaign_id = $row[8];
$phone_code = $row[10];
$phone_number = $row[11];
$title = $row[12];
$first_name = $row[13]; #
$middle_initial = $row[14];
$last_name = $row[15]; #
$address1 = $row[16]; #
$address2 = $row[17]; #
$address3 = $row[18]; #
$city = $row[19]; #
$state = $row[20]; #
$province = $row[21]; #
$postal_code = $row[22]; #
$country_code = $row[23]; #
$gender = $row[24];
$date_of_birth = $row[25];
$alt_phone = $row[26]; #
$email = $row[27]; #
$security = $row[28]; #
$comments = $row[29]; #
echo "<br>Call information: $first_name $last_name - $phone_number<br><br><form action=$PHP_SELF method=POST>\n";
echo "<input type=hidden name=end_call value=1>\n";
@@ -288,55 +269,46 @@ else
echo "<tr><td align=right>Email : </td><td align=left><input type=text name=email size=30 maxlength=50 value=\"$email\"></td></tr>\n";
echo "<tr><td align=right>Security : </td><td align=left><input type=text name=security size=30 maxlength=100 value=\"$security\"></td></tr>\n";
echo "<tr><td align=right>Comments : </td><td align=left><input type=text name=comments size=30 maxlength=255 value=\"$comments\"></td></tr>\n";
echo "<tr bgcolor=#B6D3FC><td align=right>Disposition: </td><td align=left><select size=1 name=status>\n";
echo "<tr bgcolor=#B6D3FC><td align=right>Disposition: </td><td align=left><select size=1 name=status>\n";
$stmt="SELECT status,status_name from vicidial_statuses where selectable='Y' order by status";
$rslt=mysql_query($stmt, $link);
$statuses_to_print = mysql_num_rows($rslt);
$statuses_list='';
$stmt="SELECT status,status_name from vicidial_statuses where selectable='Y' order by status";
$rslt=mysql_query($stmt, $link);
$statuses_to_print = mysql_num_rows($rslt);
$statuses_list='';
$o=0;
while ($statuses_to_print > $o) {
$rowx=mysql_fetch_row($rslt);
$statuses_list .= "<option value=\"$rowx[0]\">$rowx[0] - $rowx[1]</option>\n";
$o++;
}
echo "$statuses_list";
echo "</select></td></tr>\n";
$o=0;
while ($statuses_to_print > $o)
{
$rowx=mysql_fetch_row($rslt);
$statuses_list .= "<option value=\"$rowx[0]\">$rowx[0] - $rowx[1]</option>\n";
$o++;
}
echo "$statuses_list";
echo "</select></td></tr>\n";
echo "<tr><td colspan=2><input type=submit name=submit value=\"DISPO CALL\"></td></tr>\n";
echo "</table></form>\n";
echo "<BR><BR><BR>\n";
}
}
else
{
{
echo "lead lookup FAILED for lead_id $lead_id &nbsp; &nbsp; &nbsp; $NOW_TIME\n<BR><BR>\n";
# echo "<a href=\"$PHP_SELF\">Close this window</a>\n<BR><BR>\n";
}
}
}
$ENDtime = date("U");
$RUNtime = ($ENDtime - $STARTtime);
echo "\n\n\n<br><br><br>\n\n";
echo "<font size=0>\n\n\n<br><br><br>\nscript runtime: $RUNtime seconds</font>";
?>
</body>
</html>
@@ -344,11 +316,5 @@ echo "<font size=0>\n\n\n<br><br><br>\nscript runtime: $RUNtime seconds</font>";
exit;
?>
agc_2-X/trunk/www/vicidial/send_CID_call.php
+45 -16
View File
@@ -11,9 +11,11 @@
# 120831-1527 - Added vicidial_dial_log logging
# 130414-0039 - Added admin logging
# 130610-0943 - Finalized changing of all ereg instances to preg
# 130616-2144 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -33,33 +35,60 @@ if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
}
##### END SETTINGS LOOKUP #####
###########################################
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$sender = preg_replace('/[^0-9]/','',$sender);
$receiver = preg_replace('/[^0-9]/','',$receiver);
$cid_number = preg_replace('/[^0-9]/','',$cid_number);
$server_ip = preg_replace('/[^\.0-9]/','',$server_ip);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
$ip = getenv("REMOTE_ADDR");
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
?>
agc_2-X/trunk/www/vicidial/sheet2tab.pl
+3 -1
View File
@@ -2,7 +2,7 @@
#
# sheet2tab.pl - Convert spreadsheet to tab-delimited text file version 2.4
#
# Copyright (C) 2011 Matt Florell & Michael Cargile <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2013 Matt Florell & Michael Cargile <vicidial@gmail.com> LICENSE: AGPLv2
#
# Lead file conversion and scrubbing script. This is the first stage in the lead loading process.
#
@@ -27,6 +27,7 @@
# 100706-0833 - Initial build <mikec>
# 100706-1244 - Reformat and add comments
# 110927-1750 - Fixed issue with improperly CSV files locking up servers <mikec>
# 130619-2310 - Fixed missing XLSX perl module declaration
#
# disable when not debugging
@@ -34,6 +35,7 @@
#use warnings;
use Spreadsheet::Read;
use Spreadsheet::XLSX;
use File::Basename;
agc_2-X/trunk/www/vicidial/sph_report.php
+73 -20
View File
@@ -10,6 +10,7 @@
# 90508-0644 - Changed to PHP long tags
# 130414-0235 - Added report logging
# 130610-0942 - Finalized changing of all ereg instances to preg
# 130616-2045 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
@@ -17,6 +18,7 @@ $startMS = microtime();
$report_name='SPH Report';
require("dbconnect.php");
require("functions.php");
##### Pull values from posted form variables #####
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
@@ -57,32 +59,83 @@ $stmt = "SELECT use_non_latin FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
$i=0;
while ($i < $qm_conf_ct)
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$i++;
}
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$query_date = preg_replace("/'|\"|\\\\|;/","",$query_date);
$end_date = preg_replace("/'|\"|\\\\|;/","",$end_date);
$campaign = preg_replace("/'|\"|\\\\|;/","",$campaign);
$user_group = preg_replace("/'|\"|\\\\|;/","",$user_group);
$group = preg_replace("/'|\"|\\\\|;/","",$group);
$shift = preg_replace("/'|\"|\\\\|;/","",$shift);
$role = preg_replace("/'|\"|\\\\|;/","",$role);
$order = preg_replace("/'|\"|\\\\|;/","",$order);
$user = preg_replace("/'|\"|\\\\|;/","",$user);
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
##### BEGIN log visit to the vicidial_report_log table #####
@@ -195,7 +248,7 @@ while ($i < $user_groups_to_print)
</style>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">
<TITLE>VICIDIAL: Agent SPH Report</TITLE>
<TITLE><?php echo $report_name ?></TITLE>
</HEAD><BODY BGCOLOR=WHITE>
@@ -612,4 +665,4 @@ $rslt=mysql_query($stmt, $link);
?>
</CENTER>
</BODY></HTML>
</BODY></HTML>

Some files were not shown because too many files have changed in this diff Show More