From cf21ae391e8b94f8540d386ef53e326bcc26870b Mon Sep 17 00:00:00 2001 From: mattf Date: Tue, 2 Jul 2013 06:00:53 +0000 Subject: [PATCH] Added several security changes to the admin interface, including freezing a user's account for 15 minutes after 10 failed login attempts. Added 3 new reports to the admin interface: url log, lagged log and user group login reports Added new AST_phone_update.pl --agent-lookup flag to allow for logging of the IP address of the agent's SIP or IAX phone connection. Can be enabled as a crontab entry to perform the lookups on each asterisk server. git-svn-id: svn://192.168.202.10@1997 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/trunk/UPGRADE | 11 + agc_2-X/trunk/bin/ADMIN_keepalive_ALL.pl | 12 +- agc_2-X/trunk/bin/AST_phone_update.pl | 457 +++++++----- agc_2-X/trunk/docs/BASE_INSTALL.txt | 3 + agc_2-X/trunk/docs/NON-AGENT_API.txt | 11 +- agc_2-X/trunk/docs/SCRATCH_INSTALL.txt | 3 + .../trunk/extras/MySQL_AST_CREATE_tables.sql | 303 ++++---- agc_2-X/trunk/extras/upgrade_2.8.sql | 12 + agc_2-X/trunk/www/agc/functions.php | 25 + agc_2-X/trunk/www/agc/vicidial.php | 9 +- .../www/vicidial/AST_CLOSER_service_level.php | 85 ++- .../trunk/www/vicidial/AST_CLOSERstats.php | 84 ++- .../www/vicidial/AST_CLOSERsummary_hourly.php | 84 ++- agc_2-X/trunk/www/vicidial/AST_DIDstats.php | 85 ++- .../www/vicidial/AST_GROUP_ALIASstats.php | 75 +- agc_2-X/trunk/www/vicidial/AST_IVRfilter.php | 85 ++- agc_2-X/trunk/www/vicidial/AST_IVRstats.php | 85 ++- .../www/vicidial/AST_LAGGED_log_report.php | 371 ++++++++++ .../www/vicidial/AST_LISTS_campaign_stats.php | 85 ++- .../www/vicidial/AST_LIST_UPDATEstats.php | 84 ++- .../vicidial/AST_OUTBOUNDsummary_interval.php | 81 ++- agc_2-X/trunk/www/vicidial/AST_VDADstats.php | 85 ++- .../www/vicidial/AST_VICIDIAL_hopperlist.php | 96 ++- .../www/vicidial/AST_VICIDIAL_ingrouplist.php | 87 ++- .../trunk/www/vicidial/AST_admin_report.php | 1 + .../www/vicidial/AST_admin_template_maker.php | 168 ++--- .../www/vicidial/AST_agent_days_detail.php | 85 ++- .../www/vicidial/AST_agent_disposition.php | 85 ++- .../www/vicidial/AST_agent_performance.php | 84 ++- .../vicidial/AST_agent_performance_detail.php | 90 ++- .../www/vicidial/AST_agent_status_detail.php | 85 ++- .../www/vicidial/AST_agent_time_detail.php | 84 ++- .../www/vicidial/AST_agent_time_sheet.php | 117 ++-- .../vicidial/AST_agent_time_sheet_archive.php | 95 ++- .../vicidial/AST_agent_timeclock_detail.php | 84 ++- .../AST_campaign_status_list_report.php | 95 ++- .../www/vicidial/AST_carrier_log_report.php | 83 ++- .../vicidial/AST_dialer_inventory_report.php | 81 ++- .../www/vicidial/AST_email_log_display.php | 65 +- .../www/vicidial/AST_email_log_report.php | 85 ++- .../www/vicidial/AST_hangup_cause_report.php | 81 ++- .../www/vicidial/AST_inboundEXTstats.php | 82 ++- .../AST_inboundEXTstats_department.php | 201 +++--- .../www/vicidial/AST_inbound_daily_report.php | 85 ++- agc_2-X/trunk/www/vicidial/AST_parkstats.php | 78 ++- .../www/vicidial/AST_server_performance.php | 81 ++- .../vicidial/AST_team_performance_detail.php | 84 ++- agc_2-X/trunk/www/vicidial/AST_timeonVDAD.php | 79 ++- .../trunk/www/vicidial/AST_timeonVDADall.php | 228 +++--- .../www/vicidial/AST_timeonVDADallREC.php | 106 ++- .../www/vicidial/AST_timeonVDADallSUMMARY.php | 85 ++- agc_2-X/trunk/www/vicidial/AST_timeonpark.php | 80 ++- .../trunk/www/vicidial/AST_url_log_report.php | 488 +++++++++++++ .../vicidial/AST_usergroup_login_report.php | 107 ++- .../trunk/www/vicidial/QM_live_monitor.php | 19 +- agc_2-X/trunk/www/vicidial/admin.php | 542 ++++++++------- .../www/vicidial/admin_campaign_multi_alt.php | 96 ++- .../www/vicidial/admin_email_accounts.php | 223 +++--- agc_2-X/trunk/www/vicidial/admin_header.php | 60 +- .../vicidial/admin_listloader_fourth_gen.php | 89 +-- .../vicidial/admin_listloader_third_gen.php | 88 +-- .../trunk/www/vicidial/admin_lists_custom.php | 102 ++- .../trunk/www/vicidial/admin_modify_lead.php | 98 ++- .../www/vicidial/admin_phones_bulk_insert.php | 133 ++-- .../trunk/www/vicidial/admin_search_lead.php | 99 +-- agc_2-X/trunk/www/vicidial/audio_store.php | 73 +- .../trunk/www/vicidial/call_report_export.php | 103 ++- .../www/vicidial/callbacks_bulk_change.php | 107 ++- agc_2-X/trunk/www/vicidial/callcard_admin.php | 147 ++-- .../www/vicidial/callcard_report_export.php | 80 ++- agc_2-X/trunk/www/vicidial/campaign_debug.php | 98 ++- .../www/vicidial/closer-fronter_popup.php | 117 ++-- .../www/vicidial/closer-fronter_popup2.php | 139 ++-- agc_2-X/trunk/www/vicidial/closer.php | 77 +-- agc_2-X/trunk/www/vicidial/closer_dispo.php | 87 +-- agc_2-X/trunk/www/vicidial/closer_popup.php | 116 ++-- agc_2-X/trunk/www/vicidial/fcstats.php | 97 ++- agc_2-X/trunk/www/vicidial/functions.php | 118 +++- .../trunk/www/vicidial/group_hourly_stats.php | 156 ++--- .../trunk/www/vicidial/lead_report_export.php | 103 ++- agc_2-X/trunk/www/vicidial/lead_tools.php | 123 ++-- .../vicidial/leadloader_template_display.php | 124 +++- agc_2-X/trunk/www/vicidial/list_download.php | 58 +- agc_2-X/trunk/www/vicidial/listloader.php | 1 + agc_2-X/trunk/www/vicidial/listloaderMAIN.php | 91 ++- agc_2-X/trunk/www/vicidial/non_agent_api.php | 100 ++- agc_2-X/trunk/www/vicidial/phone_stats.php | 232 ++++--- .../www/vicidial/qc/QC_admin_include01.php | 22 +- .../www/vicidial/qc/QC_call_client_iframe.php | 118 ++-- .../vicidial/qc/QC_status_codes_include.php | 8 +- agc_2-X/trunk/www/vicidial/qc/qc_api.php | 139 ++-- .../trunk/www/vicidial/qc/qc_modify_lead.php | 145 ++-- .../trunk/www/vicidial/realtime_report.php | 124 +++- .../trunk/www/vicidial/record_conf_1_hour.php | 201 +++--- .../trunk/www/vicidial/recording_lookup.php | 24 +- .../www/vicidial/recording_lookup_DIRECT.php | 38 +- agc_2-X/trunk/www/vicidial/remote_dispo.php | 192 +++--- agc_2-X/trunk/www/vicidial/send_CID_call.php | 61 +- agc_2-X/trunk/www/vicidial/sheet2tab.pl | 4 +- agc_2-X/trunk/www/vicidial/sph_report.php | 93 ++- agc_2-X/trunk/www/vicidial/timeclock_edit.php | 651 +++++++++--------- .../trunk/www/vicidial/timeclock_report.php | 100 ++- .../trunk/www/vicidial/timeclock_status.php | 89 ++- .../www/vicidial/user_group_bulk_change.php | 77 +-- agc_2-X/trunk/www/vicidial/user_stats.php | 264 ++++--- agc_2-X/trunk/www/vicidial/user_status.php | 258 +++---- .../trunk/www/vicidial/user_territories.php | 53 +- agc_2-X/trunk/www/vicidial/vdremote.php | 56 +- .../www/vicidial/vicidial_sales_viewer.php | 66 +- agc_2-X/trunk/www/vicidial/voice_lab.php | 34 +- agc_2-X/trunk/www/vicidial/vtiger_search.php | 11 +- .../xml_rpc_audio_server_vicidial.php | 6 +- 112 files changed, 8058 insertions(+), 4242 deletions(-) create mode 100644 agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php create mode 100644 agc_2-X/trunk/www/vicidial/AST_admin_report.php create mode 100644 agc_2-X/trunk/www/vicidial/AST_url_log_report.php create mode 100644 agc_2-X/trunk/www/vicidial/listloader.php diff --git a/agc_2-X/trunk/UPGRADE b/agc_2-X/trunk/UPGRADE index 53871b43..3a0ae72d 100644 --- a/agc_2-X/trunk/UPGRADE +++ b/agc_2-X/trunk/UPGRADE @@ -64,6 +64,17 @@ OTHER CHANGES: depricated. This will also have the benefit of speeding up those scripts because preg is supposed to be more efficient and faster than ereg. +4. Added several security changes to the admin interface, including freezing a + user's account for 15 minutes after 10 failed login attempts. + +5. Added 3 new reports to the admin interface: url log, lagged log and + user group login reports + +6. Added new AST_phone_update.pl --agent-lookup flag to allow for logging of the + IP address of the agent's SIP or IAX phone connection. Can be enabled as + a crontab entry to perform the lookups on each asterisk server. + + diff --git a/agc_2-X/trunk/bin/ADMIN_keepalive_ALL.pl b/agc_2-X/trunk/bin/ADMIN_keepalive_ALL.pl index d8f606b5..b913d550 100644 --- a/agc_2-X/trunk/bin/ADMIN_keepalive_ALL.pl +++ b/agc_2-X/trunk/bin/ADMIN_keepalive_ALL.pl @@ -1,6 +1,6 @@ #!/usr/bin/perl # -# ADMIN_keepalive_ALL.pl version 2.6 +# ADMIN_keepalive_ALL.pl version 2.8 # # Designed to keep the astGUIclient processes alive and check every minute # Replaces all other ADMIN_keepalive scripts @@ -84,6 +84,7 @@ # 130402-2148 - Changes to allow for native IAX bridging to other servers # 130424-1607 - Added NOINT prefix option for call menu prompts to do Playback() instead of Background() # 130508-1009 - Small fix for INVALID_2ND and 3RD +# 130624-0733 - Added optimize for vicidial_users due to logging IP and auth timestamp # $DB=0; # Debug flag @@ -914,6 +915,15 @@ if ($timeclock_end_of_day_NOW > 0) if ($DB) {print "|",$aryA[0],"|",$aryA[1],"|",$aryA[2],"|",$aryA[3],"|","\n";} $sthA->finish(); + $stmtA = "optimize table vicidial_users;"; + if($DBX){print STDERR "\n|$stmtA|\n";} + $sthA = $dbhA->prepare($stmtA) or die "preparing: ",$dbhA->errstr; + $sthA->execute or die "executing: $stmtA ", $dbhA->errstr; + $sthArows=$sthA->rows; + @aryA = $sthA->fetchrow_array; + if ($DB) {print "|",$aryA[0],"|",$aryA[1],"|",$aryA[2],"|",$aryA[3],"|","\n";} + $sthA->finish(); + $stmtA = "update vicidial_campaign_agents SET calls_today=0;"; if($DBX){print STDERR "\n|$stmtA|\n";} $affected_rows = $dbhA->do($stmtA); diff --git a/agc_2-X/trunk/bin/AST_phone_update.pl b/agc_2-X/trunk/bin/AST_phone_update.pl index 97c7b066..62eef396 100644 --- a/agc_2-X/trunk/bin/AST_phone_update.pl +++ b/agc_2-X/trunk/bin/AST_phone_update.pl @@ -1,52 +1,68 @@ #!/usr/bin/perl # -# AST_phone_update.pl version 2.4 +# AST_phone_update.pl version 2.8 # # DESCRIPTION: # checks the registered IP address of the phone and updates the phones table # -# Copyright (C) 2010 Matt Florell LICENSE: AGPLv2 +# Copyright (C) 2013 Matt Florell LICENSE: AGPLv2 # # 70521-1529 - first build # 100625-1220 - Added waitfors after logout to fix broken pipe errors in asterisk +# 130625-0947 - Added --agent-lookup option for agent phone_ip population # # constants $DB=0; # Debug flag, set to 0 for no debug messages per minute $US='__'; $MT[0]=''; +$agent_lookup=0; ### begin parsing run-time options ### if (length($ARGV[0])>1) -{ + { $i=0; while ($#ARGV >= $i) - { - $args = "$args $ARGV[$i]"; - $i++; - } + { + $args = "$args $ARGV[$i]"; + $i++; + } if ($args =~ /--help/i) - { - print "allowed run time options:\n [-t] = test\n [-debug] = verbose debug messages\n\n"; - } + { + print "allowed run time options:\n"; + print " [-t] = test\n"; + print " [--debug] = verbose debug messages\n"; + print " [--debugX] = extra verbose debug messages\n"; + print " [--agent-lookup] = looks up the agent phone_ip only\n"; + print "\n"; + exit; + } else - { - if ($args =~ /-debug/i) { - $DB=1; # Debug flag - } if ($args =~ /-t/i) - { - $TEST=1; - $T=1; + { + $TEST=1; + $T=1; + } + if ($args =~ /--debug/i) + { + $DB=1; # Debug flag + } + if ($args =~ /--debugX/i) + { + $DBX=1; # Extra debug flag + } + if ($args =~ /--agent-lookup/i) + { + $agent_lookup=1; # agent lookup only flag + } } } -} else -{ -# print "no command line options set\n"; -} + { + # print "no command line options set\n"; + } ### end parsing run-time options ### # default path to astguiclient configuration file: @@ -109,205 +125,281 @@ $sthArows=$sthA->rows; $rec_count=0; if ($sthArows > 0) { - @aryA = $sthA->fetchrow_array; - $DBtelnet_host = "$aryA[0]"; - $DBtelnet_port = "$aryA[1]"; - $DBASTmgrUSERNAME = "$aryA[2]"; - $DBASTmgrSECRET = "$aryA[3]"; - $DBASTmgrUSERNAMEupdate = "$aryA[4]"; - $DBASTmgrUSERNAMElisten = "$aryA[5]"; - $DBASTmgrUSERNAMEsend = "$aryA[6]"; - $DBmax_vicidial_trunks = "$aryA[7]"; - $DBanswer_transfer_agent= "$aryA[8]"; - $DBSERVER_GMT = "$aryA[9]"; - $DBext_context = "$aryA[10]"; - if ($DBtelnet_host) {$telnet_host = $DBtelnet_host;} - if ($DBtelnet_port) {$telnet_port = $DBtelnet_port;} - if ($DBASTmgrUSERNAME) {$ASTmgrUSERNAME = $DBASTmgrUSERNAME;} - if ($DBASTmgrSECRET) {$ASTmgrSECRET = $DBASTmgrSECRET;} - if ($DBASTmgrUSERNAMEupdate) {$ASTmgrUSERNAMEupdate = $DBASTmgrUSERNAMEupdate;} - if ($DBASTmgrUSERNAMElisten) {$ASTmgrUSERNAMElisten = $DBASTmgrUSERNAMElisten;} - if ($DBASTmgrUSERNAMEsend) {$ASTmgrUSERNAMEsend = $DBASTmgrUSERNAMEsend;} - if ($DBmax_vicidial_trunks) {$max_vicidial_trunks = $DBmax_vicidial_trunks;} - if ($DBanswer_transfer_agent) {$answer_transfer_agent = $DBanswer_transfer_agent;} - if ($DBSERVER_GMT) {$SERVER_GMT = $DBSERVER_GMT;} - if ($DBext_context) {$ext_context = $DBext_context;} + @aryA = $sthA->fetchrow_array; + $DBtelnet_host = $aryA[0]; + $DBtelnet_port = $aryA[1]; + $DBASTmgrUSERNAME = $aryA[2]; + $DBASTmgrSECRET = $aryA[3]; + $DBASTmgrUSERNAMEupdate = $aryA[4]; + $DBASTmgrUSERNAMElisten = $aryA[5]; + $DBASTmgrUSERNAMEsend = $aryA[6]; + $DBmax_vicidial_trunks = $aryA[7]; + $DBanswer_transfer_agent= $aryA[8]; + $DBSERVER_GMT = $aryA[9]; + $DBext_context = $aryA[10]; + if ($DBtelnet_host) {$telnet_host = $DBtelnet_host;} + if ($DBtelnet_port) {$telnet_port = $DBtelnet_port;} + if ($DBASTmgrUSERNAME) {$ASTmgrUSERNAME = $DBASTmgrUSERNAME;} + if ($DBASTmgrSECRET) {$ASTmgrSECRET = $DBASTmgrSECRET;} + if ($DBASTmgrUSERNAMEupdate) {$ASTmgrUSERNAMEupdate = $DBASTmgrUSERNAMEupdate;} + if ($DBASTmgrUSERNAMElisten) {$ASTmgrUSERNAMElisten = $DBASTmgrUSERNAMElisten;} + if ($DBASTmgrUSERNAMEsend) {$ASTmgrUSERNAMEsend = $DBASTmgrUSERNAMEsend;} + if ($DBmax_vicidial_trunks) {$max_vicidial_trunks = $DBmax_vicidial_trunks;} + if ($DBanswer_transfer_agent) {$answer_transfer_agent = $DBanswer_transfer_agent;} + if ($DBSERVER_GMT) {$SERVER_GMT = $DBSERVER_GMT;} + if ($DBext_context) {$ext_context = $DBext_context;} } - $sthA->finish(); +$sthA->finish(); +$secX = time(); + +$BDtarget = ($secX - 86400); +($Bsec,$Bmin,$Bhour,$Bmday,$Bmon,$Byear,$Bwday,$Byday,$Bisdst) = localtime($BDtarget); +$Byear = ($Byear + 1900); +$Bmon++; +if ($Bmon < 10) {$Bmon = "0$Bmon";} +if ($Bmday < 10) {$Bmday = "0$Bmday";} +if ($Bhour < 10) {$Bhour = "0$Bhour";} +if ($Bmin < 10) {$Bmin = "0$Bmin";} +if ($Bsec < 10) {$Bsec = "0$Bsec";} +$BDtsSQLdate = "$Byear$Bmon$Bmday$Bhour$Bmin$Bsec"; + +$phone_listSQL=''; +$sip_count=0; +##### BEGIN sip agent phone_ip lookup ##### +if ($agent_lookup > 0) + { + $stmtA = "SELECT distinct server_phone from vicidial_user_log where server_ip='$server_ip' and phone_ip='LOOKUP' and event_date > \"$BDtsSQLdate\" and extension LIKE \"SIP%\";"; + if ($DB) {print "|$stmtA|\n";} + $sthA = $dbhA->prepare($stmtA) or die "preparing: ",$dbhA->errstr; + $sthA->execute or die "executing: $stmtA ", $dbhA->errstr; + $sthArows=$sthA->rows; + while ($sthArows > $sip_count) + { + @aryA = $sthA->fetchrow_array; + $phone_list .= "'$aryA[0]',"; + $sip_count++; + } + $sthA->finish(); + chop($phone_list); + if (length($phone_list) > 2) + {$phone_listSQL = "and login IN($phone_list)";} + } +##### END sip agent phone_ip lookup ##### + ############# BEGIN SIP SECTION ################################################ if($DB){print "\n\nSIP EXTENSIONS:\n";} - -@PTextensions=@MT; @PTphone_ips=@MT; -$stmtA = "SELECT extension,phone_ip from phones where server_ip='$server_ip' and protocol='SIP'"; -if ($DB) {print "|$stmtA|\n";} -$sthA = $dbhA->prepare($stmtA) or die "preparing: ",$dbhA->errstr; -$sthA->execute or die "executing: $stmtA ", $dbhA->errstr; -$sthArows=$sthA->rows; -$rec_count=0; -while ($sthArows > $rec_count) - { - @aryA = $sthA->fetchrow_array; - $PTextensions[$rec_count] = "$aryA[0]"; - $PTphone_ips[$rec_count] = "$aryA[1]"; - $rec_count++; - } - $sthA->finish(); - - -### connect to asterisk manager through telnet -$t = new Net::Telnet (Port => 5038, - Prompt => '/.*[\$%#>] $/', - Output_record_separator => '',); -#$fh = $t->dump_log("$telnetlog"); # uncomment for telnet log - if (length($ASTmgrUSERNAMEsend) > 3) {$telnet_login = $ASTmgrUSERNAMEsend;} - else {$telnet_login = $ASTmgrUSERNAME;} - -$t->open("$telnet_host"); -$t->waitfor('/[01]\n$/'); # print login -$t->print("Action: Login\nUsername: $telnet_login\nSecret: $ASTmgrSECRET\n\n"); -$t->waitfor('/Authentication accepted/'); # waitfor auth accepted - - -$i=0; -foreach(@PTextensions) +if ( ($sip_count > 0) || ($agent_lookup < 1) ) { - @list_channels=@MT; - $t->buffer_empty; - @list_channels = $t->cmd(String => "Action: Command\nCommand: sip show peer $PTextensions[$i]\n\nAction: Ping\n\n", Prompt => '/Response: Pong.*/'); + @PTextensions=@MT; @PTphone_ips=@MT; @PTlogins=@MT; + $stmtA = "SELECT extension,phone_ip,login from phones where server_ip='$server_ip' and protocol='SIP' $phone_listSQL;"; + if ($DB) {print "|$stmtA|\n";} + $sthA = $dbhA->prepare($stmtA) or die "preparing: ",$dbhA->errstr; + $sthA->execute or die "executing: $stmtA ", $dbhA->errstr; + $sthArows=$sthA->rows; + $rec_count=0; + while ($sthArows > $rec_count) + { + @aryA = $sthA->fetchrow_array; + $PTextensions[$rec_count] = $aryA[0]; + $PTphone_ips[$rec_count] = $aryA[1]; + $PTlogins[$rec_count] = $aryA[2]; + $rec_count++; + } + $sthA->finish(); - $j=0; - foreach(@list_channels) - { # Addr->IP : 10.10.14.25 Port 5060 - if ($list_channels[$j] =~ / Addr->IP : /) - { - $NEW_IPaddr[$i] = "$list_channels[$j]"; - $NEW_IPaddr[$i] =~ s/ Addr->IP : | Port .*|\n|\r|\t//g; + + ### connect to asterisk manager through telnet + $t = new Net::Telnet (Port => 5038, + Prompt => '/.*[\$%#>] $/', + Output_record_separator => '',); + #$fh = $t->dump_log("$telnetlog"); # uncomment for telnet log + if (length($ASTmgrUSERNAMEsend) > 3) {$telnet_login = $ASTmgrUSERNAMEsend;} + else {$telnet_login = $ASTmgrUSERNAME;} + + $t->open("$telnet_host"); + $t->waitfor('/[01]\n$/'); # print login + $t->print("Action: Login\nUsername: $telnet_login\nSecret: $ASTmgrSECRET\n\n"); + $t->waitfor('/Authentication accepted/'); # waitfor auth accepted + + + $i=0; + foreach(@PTextensions) + { + @list_channels=@MT; + $t->buffer_empty; + @list_channels = $t->cmd(String => "Action: Command\nCommand: sip show peer $PTextensions[$i]\n\nAction: Ping\n\n", Prompt => '/Response: Pong.*/'); + + $j=0; + foreach(@list_channels) + { # Addr->IP : 10.10.14.25 Port 5060 + if ($list_channels[$j] =~ / Addr->IP : /) + { + $NEW_IPaddr[$i] = "$list_channels[$j]"; + $NEW_IPaddr[$i] =~ s/ Addr->IP : | Port .*|\n|\r|\t//g; + } + + $j++; } - $j++; - } - - if($DB){print "Phone IP- $PTextensions[$i] NEW:|$NEW_IPaddr[$i]| OLD:|$PTphone_ips[$i]| ";} - if ( ($NEW_IPaddr[$i] =~ /$PTphone_ips[$i]/) && (length($NEW_IPaddr[$i]) eq length($PTphone_ips[$i])) ) - { - if($DB){print "PHONE IP UNCHANGED, DOING NOTHING FOR THIS EXTENSION\n";} - } - else - { - if ($NEW_IPaddr[$i] =~ /Unspecified/) + if($DB){print "Phone IP- $PTextensions[$i] NEW:|$NEW_IPaddr[$i]| OLD:|$PTphone_ips[$i]| ";} + if ( ($NEW_IPaddr[$i] =~ /$PTphone_ips[$i]/) && (length($NEW_IPaddr[$i]) eq length($PTphone_ips[$i])) ) { - if($DB){print "PHONE IP UNSPECIFIED, DOING NOTHING FOR THIS EXTENSION\n";} + if($DB){print "PHONE IP UNCHANGED, DOING NOTHING FOR THIS EXTENSION\n";} } else { - $stmtA = "UPDATE phones set phone_ip='$NEW_IPaddr[$i]' where server_ip='$server_ip' and extension='$PTextensions[$i]'"; - if($DB){print STDERR "\n|$stmtA|\n";} - $affected_rows = $dbhA->do($stmtA); # or die "Couldn't execute query:|$stmtA|\n"; + if ($NEW_IPaddr[$i] =~ /Unspecified/) + { + if($DB){print "PHONE IP UNSPECIFIED, DOING NOTHING FOR THIS EXTENSION\n";} + } + else + { + $stmtA = "UPDATE phones set phone_ip='$NEW_IPaddr[$i]' where server_ip='$server_ip' and extension='$PTextensions[$i]';"; + $affected_rows = $dbhA->do($stmtA); # or die "Couldn't execute query:|$stmtA|\n"; + if($DB){print STDERR "\n|$affected_rows|$stmtA|\n";} + } + } + if ($agent_lookup > 0) + { + $stmtA = "UPDATE vicidial_user_log set phone_ip='$NEW_IPaddr[$i]' where server_phone='$PTlogins[$i]' and server_ip='$server_ip' and phone_ip='LOOKUP' and event_date > \"$BDtsSQLdate\" and extension LIKE \"SIP%\";"; + $affected_rows = $dbhA->do($stmtA); # or die "Couldn't execute query:|$stmtA|\n"; + if($DB){print STDERR "\n|$affected_rows|$stmtA|\n";} } - } - $i++; + $i++; ### sleep for 10 hundredths of a second usleep(1*100*1000); + } + + $t->buffer_empty; + @hangup = $t->cmd(String => "Action: Logoff\n\n", Prompt => "/.*/"); + $t->buffer_empty; + $t->waitfor(Match => '/Message:.*\n\n/', Timeout => 10); + $ok = $t->close; } - - -$t->buffer_empty; -@hangup = $t->cmd(String => "Action: Logoff\n\n", Prompt => "/.*/"); -$t->buffer_empty; -$t->waitfor(Match => '/Message:.*\n\n/', Timeout => 10); -$ok = $t->close; - ############# END SIP SECTION ################################################ +$phone_listSQL=''; +$iax_count=0; +##### BEGIN sip agent phone_ip lookup ##### +if ($agent_lookup > 0) + { + $stmtA = "SELECT distinct server_phone from vicidial_user_log where server_ip='$server_ip' and phone_ip='LOOKUP' and event_date > \"$BDtsSQLdate\" and extension LIKE \"IAX%\";"; + if ($DB) {print "|$stmtA|\n";} + $sthA = $dbhA->prepare($stmtA) or die "preparing: ",$dbhA->errstr; + $sthA->execute or die "executing: $stmtA ", $dbhA->errstr; + $sthArows=$sthA->rows; + while ($sthArows > $iax_count) + { + @aryA = $sthA->fetchrow_array; + $phone_list .= "'$aryA[0]',"; + $iax_count++; + } + $sthA->finish(); + chop($phone_list); + if (length($phone_list) > 2) + {$phone_listSQL = "and login IN($phone_list)";} + } +##### END sip agent phone_ip lookup ##### + + ############# BEGIN IAX2 SECTION ################################################ if($DB){print "\n\niax2 EXTENSIONS:\n";} -@PTextensions=@MT; @PTphone_ips=@MT; -$stmtA = "SELECT extension,phone_ip from phones where server_ip='$server_ip' and protocol='IAX2'"; -if ($DB) {print "|$stmtA|\n";} -$sthA = $dbhA->prepare($stmtA) or die "preparing: ",$dbhA->errstr; -$sthA->execute or die "executing: $stmtA ", $dbhA->errstr; -$sthArows=$sthA->rows; -$rec_count=0; -while ($sthArows > $rec_count) - { - @aryA = $sthA->fetchrow_array; - $PTextensions[$rec_count] = "$aryA[0]"; - $PTphone_ips[$rec_count] = "$aryA[1]"; - $rec_count++; - } - $sthA->finish(); - - -### connect to asterisk manager through telnet -$t = new Net::Telnet (Port => 5038, - Prompt => '/.*[\$%#>] $/', - Output_record_separator => '',); -#$fh = $t->dump_log("$telnetlog"); # uncomment for telnet log - if (length($ASTmgrUSERNAMEsend) > 3) {$telnet_login = $ASTmgrUSERNAMEsend;} - else {$telnet_login = $ASTmgrUSERNAME;} - -$t->open("$telnet_host"); -$t->waitfor('/[01]\n$/'); # print login -$t->print("Action: Login\nUsername: $telnet_login\nSecret: $ASTmgrSECRET\n\n"); -$t->waitfor('/Authentication accepted/'); # waitfor auth accepted - - -$i=0; -foreach(@PTextensions) +if ( ($iax_count > 0) || ($agent_lookup < 1) ) { - @list_channels=@MT; - $t->buffer_empty; - @list_channels = $t->cmd(String => "Action: Command\nCommand: iax2 show peer $PTextensions[$i]\n\nAction: Ping\n\n", Prompt => '/Response: Pong.*/'); + @PTextensions=@MT; @PTphone_ips=@MT; @PTlogins=@MT; + $stmtA = "SELECT extension,phone_ip,login from phones where server_ip='$server_ip' and protocol='IAX2' $phone_listSQL;"; + if ($DB) {print "|$stmtA|\n";} + $sthA = $dbhA->prepare($stmtA) or die "preparing: ",$dbhA->errstr; + $sthA->execute or die "executing: $stmtA ", $dbhA->errstr; + $sthArows=$sthA->rows; + $rec_count=0; + while ($sthArows > $rec_count) + { + @aryA = $sthA->fetchrow_array; + $PTextensions[$rec_count] = $aryA[0]; + $PTphone_ips[$rec_count] = $aryA[1]; + $PTlogins[$rec_count] = $aryA[2]; + $rec_count++; + } + $sthA->finish(); - $j=0; - foreach(@list_channels) - { # Addr->IP : 10.10.14.25 Port 5060 - if ($list_channels[$j] =~ / Addr->IP : /) - { - $NEW_IPaddr[$i] = "$list_channels[$j]"; - $NEW_IPaddr[$i] =~ s/ Addr->IP : | Port .*|\n|\r|\t//g; + + ### connect to asterisk manager through telnet + $t = new Net::Telnet (Port => 5038, + Prompt => '/.*[\$%#>] $/', + Output_record_separator => '',); + #$fh = $t->dump_log("$telnetlog"); # uncomment for telnet log + if (length($ASTmgrUSERNAMEsend) > 3) {$telnet_login = $ASTmgrUSERNAMEsend;} + else {$telnet_login = $ASTmgrUSERNAME;} + + $t->open("$telnet_host"); + $t->waitfor('/[01]\n$/'); # print login + $t->print("Action: Login\nUsername: $telnet_login\nSecret: $ASTmgrSECRET\n\n"); + $t->waitfor('/Authentication accepted/'); # waitfor auth accepted + + + $i=0; + foreach(@PTextensions) + { + @list_channels=@MT; + $t->buffer_empty; + @list_channels = $t->cmd(String => "Action: Command\nCommand: iax2 show peer $PTextensions[$i]\n\nAction: Ping\n\n", Prompt => '/Response: Pong.*/'); + + $j=0; + foreach(@list_channels) + { # Addr->IP : 10.10.14.25 Port 5060 + if ($list_channels[$j] =~ / Addr->IP : /) + { + $NEW_IPaddr[$i] = "$list_channels[$j]"; + $NEW_IPaddr[$i] =~ s/ Addr->IP : | Port .*|\n|\r|\t//g; + } + + $j++; } - $j++; - } - - if($DB){print "Phone IP- $PTextensions[$i] NEW:|$NEW_IPaddr[$i]| OLD:|$PTphone_ips[$i]| ";} - if ( ($NEW_IPaddr[$i] =~ /$PTphone_ips[$i]/) && (length($NEW_IPaddr[$i]) eq length($PTphone_ips[$i])) ) - { - if($DB){print "PHONE IP UNCHANGED, DOING NOTHING FOR THIS EXTENSION\n";} - } - else - { - if ($NEW_IPaddr[$i] =~ /Unspecified/) + if($DB){print "Phone IP- $PTextensions[$i] NEW:|$NEW_IPaddr[$i]| OLD:|$PTphone_ips[$i]| ";} + if ( ($NEW_IPaddr[$i] =~ /$PTphone_ips[$i]/) && (length($NEW_IPaddr[$i]) eq length($PTphone_ips[$i])) ) { - if($DB){print "PHONE IP UNSPECIFIED, DOING NOTHING FOR THIS EXTENSION\n";} + if($DB){print "PHONE IP UNCHANGED, DOING NOTHING FOR THIS EXTENSION\n";} } else { - $stmtA = "UPDATE phones set phone_ip='$NEW_IPaddr[$i]' where server_ip='$server_ip' and extension='$PTextensions[$i]'"; - if($DB){print STDERR "\n|$stmtA|\n";} - $affected_rows = $dbhA->do($stmtA); # or die "Couldn't execute query:|$stmtA|\n"; + if ($NEW_IPaddr[$i] =~ /Unspecified/) + { + if($DB){print "PHONE IP UNSPECIFIED, DOING NOTHING FOR THIS EXTENSION\n";} + } + else + { + $stmtA = "UPDATE phones set phone_ip='$NEW_IPaddr[$i]' where server_ip='$server_ip' and extension='$PTextensions[$i]';"; + $affected_rows = $dbhA->do($stmtA); # or die "Couldn't execute query:|$stmtA|\n"; + if($DB){print STDERR "\n|$affected_rows|$stmtA|\n";} + } + } + if ($agent_lookup > 0) + { + $stmtA = "UPDATE vicidial_user_log set phone_ip='$NEW_IPaddr[$i]' where server_phone='$PTlogins[$i]' and server_ip='$server_ip' and phone_ip='LOOKUP' and event_date > \"$BDtsSQLdate\" and extension LIKE \"IAX%\";"; + $affected_rows = $dbhA->do($stmtA); # or die "Couldn't execute query:|$stmtA|\n"; + if($DB){print STDERR "\n|$affected_rows|$stmtA|\n";} } - } - $i++; + $i++; ### sleep for 10 hundredths of a second usleep(1*100*1000); + } + + $t->buffer_empty; + @hangup = $t->cmd(String => "Action: Logoff\n\n", Prompt => "/.*/"); + $t->buffer_empty; + $t->waitfor(Match => '/Message:.*\n\n/', Timeout => 10); + $ok = $t->close; } - - -$t->buffer_empty; -@hangup = $t->cmd(String => "Action: Logoff\n\n", Prompt => "/.*/"); -$t->buffer_empty; -$t->waitfor(Match => '/Message:.*\n\n/', Timeout => 10); -$ok = $t->close; ############# END IAX2 SECTION ################################################ @@ -320,6 +412,3 @@ if($DB){print "DONE... Exiting...\n";} exit; - - - diff --git a/agc_2-X/trunk/docs/BASE_INSTALL.txt b/agc_2-X/trunk/docs/BASE_INSTALL.txt index 664c3436..0e38869c 100644 --- a/agc_2-X/trunk/docs/BASE_INSTALL.txt +++ b/agc_2-X/trunk/docs/BASE_INSTALL.txt @@ -451,6 +451,9 @@ PHASE 6: ADDING CRONTAB ENTRIES FOR ASTGUICLIENT/VICIDIAL SCRIPTS ## uncomment below if using QueueMetrics #*/5 * * * * /usr/share/astguiclient/AST_cleanup_agent_log.pl --only-qm-live-call-check +## uncomment below if you want to log agent phone_ip +#*/5 * * * * /usr/share/astguiclient/AST_phone_update.pl --agent-lookup + # cleanup of the scheduled callback records 25 0 * * * /usr/share/astguiclient/AST_DB_dead_cb_purge.pl --purge-non-cb --quiet # removal of duplicate scheduled callback records diff --git a/agc_2-X/trunk/docs/NON-AGENT_API.txt b/agc_2-X/trunk/docs/NON-AGENT_API.txt index a473e0d1..27e06f85 100644 --- a/agc_2-X/trunk/docs/NON-AGENT_API.txt +++ b/agc_2-X/trunk/docs/NON-AGENT_API.txt @@ -1,4 +1,4 @@ -NON-AGENT API DOCUMENT Started: 2008-07-24 Updated: 2013-06-14 +NON-AGENT API DOCUMENT Started: 2008-07-24 Updated: 2013-06-17 This document describes the functions of an API(Application Programming Interface) for all functions NOT directly relating to the VICIDIAL Agent screen. @@ -83,6 +83,7 @@ Changes: 130405-1538 - Added agent_status function 130420-1938 - Added NANPA prefix validation and timezone options 130614-0907 - Added pause code to output of agent_status function +130617-2232 - Added real-time sub-statuses to output of agent_status function API Functions use the 'function' variable @@ -410,9 +411,6 @@ SETTINGS FIELDS- stage - the format of the exported data: csv, tab, pipe(default) header - include a header(YES) or not(NO). This is optional, default is not to include a header -NOTES- -There is a hard limit of 10000000 records analyzed - Example URL strings for API calls: http://server/vicidial/non_agent_api.php?source=test&user=6666&pass=1234&function=agent_status&agent_user=1234&stage=csv&header=YES @@ -423,9 +421,10 @@ ERROR: agent_status AGENT NOT FOUND - 6666|| ERROR: agent_status AGENT NOT LOGGED IN - 6666|| A SUCCESS response will not show "SUCCESS", but instead will just print the results in the following format: -status,call_id,lead_id,campaign_id,calls_today,full_name,user_group,user_level,pause_code -INCALL,M4050908070000012345,12345,TESTCAMP,1,Test Agent,AGENTS,3,LOGIN +status,call_id,lead_id,campaign_id,calls_today,full_name,user_group,user_level,pause_code,real_time_sub_status +INCALL,M4050908070000012345,12345,TESTCAMP,1,Test Agent,AGENTS,3,LOGIN, +NOTE: real_time_sub_status field can consist of: DEAD, DISPO, 3-WAY, PARK, RING or it can be empty diff --git a/agc_2-X/trunk/docs/SCRATCH_INSTALL.txt b/agc_2-X/trunk/docs/SCRATCH_INSTALL.txt index fe2e5676..ff85cfaf 100644 --- a/agc_2-X/trunk/docs/SCRATCH_INSTALL.txt +++ b/agc_2-X/trunk/docs/SCRATCH_INSTALL.txt @@ -2447,6 +2447,9 @@ SUBPHASE 6.5: setting up astguiclient scripts for continuous running ## uncomment below if using QueueMetrics #*/5 * * * * /usr/share/astguiclient/AST_cleanup_agent_log.pl --only-qm-live-call-check +## uncomment below if you want to log agent phone_ip +#*/5 * * * * /usr/share/astguiclient/AST_phone_update.pl --agent-lookup + # cleanup of the scheduled callback records 25 0 * * * /usr/share/astguiclient/AST_DB_dead_cb_purge.pl --purge-non-cb --quiet # removal of duplicate scheduled callback records diff --git a/agc_2-X/trunk/extras/MySQL_AST_CREATE_tables.sql b/agc_2-X/trunk/extras/MySQL_AST_CREATE_tables.sql index bf16c5f9..571348d8 100644 --- a/agc_2-X/trunk/extras/MySQL_AST_CREATE_tables.sql +++ b/agc_2-X/trunk/extras/MySQL_AST_CREATE_tables.sql @@ -88,7 +88,7 @@ index (server_ip), index (voicemail_id), index (dialplan_number), unique index extenserver (extension, server_ip) -); +) ENGINE=MyISAM; CREATE TABLE servers ( server_id VARCHAR(10) NOT NULL, @@ -137,7 +137,7 @@ user_group VARCHAR(20) default '---ALL---', audio_store_purge TEXT, svn_revision INT(9) default '0', svn_info TEXT -); +) ENGINE=MyISAM; CREATE UNIQUE INDEX server_id on servers (server_id); @@ -147,7 +147,7 @@ server_ip VARCHAR(15) NOT NULL, channel_group VARCHAR(30), extension VARCHAR(100), channel_data VARCHAR(100) -); +) ENGINE=MyISAM; CREATE TABLE live_sip_channels ( channel VARCHAR(100) NOT NULL, @@ -155,7 +155,7 @@ server_ip VARCHAR(15) NOT NULL, channel_group VARCHAR(30), extension VARCHAR(100), channel_data VARCHAR(100) -); +) ENGINE=MyISAM; CREATE TABLE parked_channels ( channel VARCHAR(100) NOT NULL, @@ -164,13 +164,13 @@ channel_group VARCHAR(30), extension VARCHAR(100), parked_by VARCHAR(100), parked_time DATETIME -); +) ENGINE=MyISAM; CREATE TABLE conferences ( conf_exten INT(7) UNSIGNED NOT NULL, server_ip VARCHAR(15) NOT NULL, extension VARCHAR(100) -); +) ENGINE=MyISAM; CREATE TABLE recording_log ( recording_id INT(10) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -192,7 +192,7 @@ index(filename), index(lead_id), index(user), index(vicidial_id) -); +) ENGINE=MyISAM; CREATE TABLE live_inbound ( uniqueid VARCHAR(20) NOT NULL, @@ -209,7 +209,7 @@ comment_b VARCHAR(50), comment_c VARCHAR(50), comment_d VARCHAR(50), comment_e VARCHAR(50) -); +) ENGINE=MyISAM; CREATE TABLE inbound_numbers ( extension VARCHAR(30) NOT NULL, @@ -217,13 +217,13 @@ full_number VARCHAR(30) NOT NULL, server_ip VARCHAR(15) NOT NULL, inbound_name VARCHAR(30), department VARCHAR(30) -); +) ENGINE=MyISAM; CREATE TABLE server_updater ( server_ip VARCHAR(15) NOT NULL, last_update DATETIME, db_time TIMESTAMP -); +) ENGINE=MyISAM; CREATE TABLE call_log ( uniqueid VARCHAR(20) PRIMARY KEY NOT NULL, @@ -243,7 +243,7 @@ length_in_min DOUBLE(8,2), index (caller_code), index (server_ip), index (channel) -); +) ENGINE=MyISAM; CREATE TABLE park_log ( uniqueid VARCHAR(20) default '', @@ -261,7 +261,7 @@ user VARCHAR(20), lead_id INT(9) UNSIGNED default '0', index (parked_time), index (lead_id) -); +) ENGINE=MyISAM; CREATE INDEX uniqueid_park on park_log (uniqueid); @@ -288,7 +288,7 @@ cmd_line_k VARCHAR(100), index (callerid), index (uniqueid), index serverstat(server_ip,status) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_list ( lead_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -335,7 +335,7 @@ index (postal_code), index (last_local_call_time), index (rank), index (owner) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_hopper ( hopper_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -351,7 +351,7 @@ priority TINYINT(2) default '0', source VARCHAR(1) default '', vendor_lead_code VARCHAR(20) default '', index (lead_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_live_agents ( live_agent_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -409,7 +409,7 @@ index (random_id), index (last_call_time), index (last_update_time), index (last_call_finish) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_auto_calls ( auto_call_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -437,7 +437,7 @@ index (uniqueid), index (callerid), index (call_time), index (last_update_time) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_log ( uniqueid VARCHAR(20) PRIMARY KEY NOT NULL, @@ -459,7 +459,7 @@ term_reason ENUM('CALLER','AGENT','QUEUETIMEOUT','ABANDON','AFTERHOURS','NONE') alt_dial VARCHAR(6) default 'NONE', index (lead_id), index (call_date) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_closer_log ( closecallid INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -487,7 +487,7 @@ index (lead_id), index (call_date), index (campaign_id), index (uniqueid) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_xfer_log ( xfercallid INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -501,7 +501,7 @@ user VARCHAR(20), closer VARCHAR(20), index (lead_id), index (call_date) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_users ( user_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -607,8 +607,8 @@ modify_email_accounts ENUM('0','1') default '0', failed_login_count TINYINT(3) UNSIGNED default '0', last_login_date DATETIME default '2001-01-01 00:00:01', last_ip VARCHAR(15) default '', -pass_hash VARCHAR(200) default '' -); +pass_hash VARCHAR(100) default '' +) ENGINE=MyISAM; CREATE UNIQUE INDEX user ON vicidial_users (user); @@ -626,8 +626,13 @@ extension VARCHAR(50), computer_ip VARCHAR(15), browser VARCHAR(255), data VARCHAR(255), -index (user) -); +phone_login VARCHAR(15) default '', +server_phone VARCHAR(15) default '', +phone_ip VARCHAR(15) default '', +index (user), +index (event_date), +index (phone_ip) +) ENGINE=MyISAM; CREATE TABLE vicidial_user_groups ( user_group VARCHAR(20) NOT NULL, @@ -654,7 +659,7 @@ webphone_systemkey_override VARCHAR(100) default '', webphone_dialpad_override ENUM('DISABLED','Y','N','TOGGLE','TOGGLE_OFF') default 'DISABLED', admin_viewable_groups TEXT, admin_viewable_call_times TEXT -); +) ENGINE=MyISAM; CREATE TABLE vicidial_campaigns ( campaign_id VARCHAR(8) PRIMARY KEY NOT NULL, @@ -873,7 +878,7 @@ allow_emails ENUM('Y','N') default 'N', amd_inbound_group VARCHAR(20) default '', amd_callmenu VARCHAR(50) default '', survey_wait_sec TINYINT(3) default '10' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_lists ( list_id BIGINT(14) UNSIGNED PRIMARY KEY NOT NULL, @@ -898,7 +903,7 @@ web_form_address_two TEXT, time_zone_setting ENUM('COUNTRY_AND_AREA_CODE','POSTAL_CODE','NANPA_PREFIX','OWNER_TIME_ZONE_CODE') default 'COUNTRY_AND_AREA_CODE', inventory_report ENUM('Y','N') default 'Y', expiration_date DATE default '2099-12-31' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_statuses ( status VARCHAR(6) PRIMARY KEY NOT NULL, @@ -913,7 +918,7 @@ not_interested ENUM('Y','N') default 'N', unworkable ENUM('Y','N') default 'N', scheduled_callback ENUM('Y','N') default 'N', completed ENUM('Y','N') default 'N' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_campaign_statuses ( status VARCHAR(6) NOT NULL, @@ -930,7 +935,7 @@ unworkable ENUM('Y','N') default 'N', scheduled_callback ENUM('Y','N') default 'N', completed ENUM('Y','N') default 'N', index (campaign_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_campaign_hotkeys ( status VARCHAR(6) NOT NULL, @@ -939,7 +944,7 @@ status_name VARCHAR(30), selectable ENUM('Y','N'), campaign_id VARCHAR(8), index (campaign_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_conferences ( conf_exten INT(7) UNSIGNED NOT NULL, @@ -947,7 +952,7 @@ server_ip VARCHAR(15) NOT NULL, extension VARCHAR(100), leave_3way ENUM('0','1') default '0', leave_3way_datetime DATETIME -); +) ENGINE=MyISAM; CREATE UNIQUE INDEX serverconf on vicidial_conferences (server_ip, conf_exten); @@ -961,7 +966,7 @@ DST enum('Y','N'), DST_range VARCHAR(8), geographic_description VARCHAR(100), tz_code VARCHAR(4) default '' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_inbound_groups ( group_id VARCHAR(20) PRIMARY KEY NOT NULL, @@ -1078,7 +1083,7 @@ max_calls_count SMALLINT(5) default '0', max_calls_action ENUM('DROP','AFTERHOURS','NO_AGENT_NO_QUEUE') default 'NO_AGENT_NO_QUEUE', dial_ingroup_cid VARCHAR(20) default '', group_handling ENUM('PHONE','EMAIL') default 'PHONE' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_stations ( agent_station VARCHAR(10) PRIMARY KEY NOT NULL, @@ -1089,7 +1094,7 @@ DB_server_ip VARCHAR(15) NOT NULL, DB_user VARCHAR(15), DB_pass VARCHAR(15), DB_port VARCHAR(6) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_remote_agents ( remote_agent_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -1104,7 +1109,7 @@ extension_group VARCHAR(20) default 'NONE', extension_group_order VARCHAR(20) default 'NONE', on_hook_agent ENUM('Y','N') default 'N', on_hook_ring_time SMALLINT(5) default '15' -); +) ENGINE=MyISAM; CREATE TABLE live_inbound_log ( uniqueid VARCHAR(20) NOT NULL, @@ -1124,7 +1129,7 @@ comment_e VARCHAR(50), index (uniqueid), index (phone_ext), index (start_time) -); +) ENGINE=MyISAM; CREATE TABLE web_client_sessions ( extension VARCHAR(100) NOT NULL, @@ -1132,7 +1137,7 @@ server_ip VARCHAR(15) NOT NULL, program ENUM('agc','vicidial','monitor','other') default 'agc', start_time DATETIME NOT NULL, session_name VARCHAR(40) UNIQUE NOT NULL -); +) ENGINE=MyISAM; CREATE TABLE server_performance ( start_time DATETIME NOT NULL, @@ -1152,7 +1157,7 @@ live_recordings SMALLINT(4) UNSIGNED NOT NULL, cpu_user_percent SMALLINT(3) UNSIGNED NOT NULL default '0', cpu_system_percent SMALLINT(3) UNSIGNED NOT NULL default '0', cpu_idle_percent SMALLINT(3) UNSIGNED NOT NULL default '0' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_agent_log ( agent_log_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -1180,7 +1185,7 @@ uniqueid VARCHAR(20) default '', index (lead_id), index (user), index (event_time) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_scripts ( script_id VARCHAR(10) PRIMARY KEY NOT NULL, @@ -1189,13 +1194,13 @@ script_comments VARCHAR(255), script_text TEXT, active ENUM('Y','N'), user_group VARCHAR(20) default '---ALL---' -); +) ENGINE=MyISAM; CREATE TABLE phone_favorites ( extension VARCHAR(100), server_ip VARCHAR(15), extensions_list TEXT -); +) ENGINE=MyISAM; CREATE TABLE vicidial_callbacks ( callback_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -1214,7 +1219,7 @@ lead_status VARCHAR(6) default 'CALLBK', index (lead_id), index (status), index (callback_time) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_list_pins ( pins_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -1228,7 +1233,7 @@ digits VARCHAR(20), index (lead_id), index (phone_number), index (entry_time) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_lead_filters ( lead_filter_id VARCHAR(10) PRIMARY KEY NOT NULL, @@ -1236,7 +1241,7 @@ lead_filter_name VARCHAR(30) NOT NULL, lead_filter_comments VARCHAR(255), lead_filter_sql TEXT, user_group VARCHAR(20) default '---ALL---' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_call_times ( call_time_id VARCHAR(10) PRIMARY KEY NOT NULL, @@ -1269,7 +1274,7 @@ friday_afterhours_filename_override VARCHAR(255) default '', saturday_afterhours_filename_override VARCHAR(255) default '', user_group VARCHAR(20) default '---ALL---', ct_holidays TEXT default '' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_state_call_times ( state_call_time_id VARCHAR(10) PRIMARY KEY NOT NULL, @@ -1294,7 +1299,7 @@ sct_saturday_start SMALLINT(4) unsigned default '0', sct_saturday_stop SMALLINT(4) unsigned default '0', user_group VARCHAR(20) default '---ALL---', ct_holidays TEXT default '' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_campaign_stats ( campaign_id VARCHAR(20) PRIMARY KEY NOT NULL, @@ -1343,11 +1348,11 @@ agent_wait_today BIGINT(14) UNSIGNED default '0', agent_custtalk_today BIGINT(14) UNSIGNED default '0', agent_acw_today BIGINT(14) UNSIGNED default '0', agent_pause_today BIGINT(14) UNSIGNED default '0' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_dnc ( phone_number VARCHAR(18) PRIMARY KEY NOT NULL -); +) ENGINE=MyISAM; CREATE TABLE vicidial_lead_recycle ( recycle_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -1357,7 +1362,7 @@ attempt_delay SMALLINT(5) UNSIGNED default '1800', attempt_maximum TINYINT(3) UNSIGNED default '2', active ENUM('Y','N') default 'N', index (campaign_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_campaign_server_stats ( campaign_id VARCHAR(20) NOT NULL, @@ -1366,7 +1371,7 @@ update_time TIMESTAMP, local_trunk_shortage SMALLINT(5) UNSIGNED default '0', index (campaign_id), index (server_ip) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_server_trunks ( server_ip VARCHAR(15) NOT NULL, @@ -1375,7 +1380,7 @@ dedicated_trunks SMALLINT(5) UNSIGNED default '0', trunk_restriction ENUM('MAXIMUM_LIMIT','OVERFLOW_ALLOWED') default 'OVERFLOW_ALLOWED', index (campaign_id), index (server_ip) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_postal_codes ( postal_code VARCHAR(10) NOT NULL, @@ -1385,7 +1390,7 @@ DST enum('Y','N'), DST_range VARCHAR(8), country CHAR(3), country_code SMALLINT(5) UNSIGNED -); +) ENGINE=MyISAM; CREATE TABLE vicidial_pause_codes ( pause_code VARCHAR(6) NOT NULL, @@ -1393,7 +1398,7 @@ pause_code_name VARCHAR(30), billable ENUM('NO','YES','HALF') default 'NO', campaign_id VARCHAR(8), index (campaign_id) -); +) ENGINE=MyISAM; CREATE TABLE system_settings ( version VARCHAR(50), @@ -1516,8 +1521,10 @@ queuemetrics_socket_url TEXT, enhanced_disconnect_logging ENUM('0','1') default '0', allow_emails ENUM('0','1') default '0', level_8_disable_add ENUM('0','1') default '0', -pass_hash_enabled ENUM('0','1') default '0' -); +pass_hash_enabled ENUM('0','1') default '0', +pass_key VARCHAR(100) default '', +pass_cost TINYINT(2) UNSIGNED default '2' +) ENGINE=MyISAM; CREATE TABLE vicidial_campaigns_list_mix ( vcl_id VARCHAR(20) PRIMARY KEY NOT NULL, @@ -1527,7 +1534,7 @@ list_mix_container TEXT, mix_method ENUM('EVEN_MIX','IN_ORDER','RANDOM') default 'IN_ORDER', status ENUM('ACTIVE','INACTIVE') default 'INACTIVE', index (campaign_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_status_categories ( vsc_id VARCHAR(20) PRIMARY KEY NOT NULL, @@ -1536,7 +1543,7 @@ vsc_description VARCHAR(255), tovdad_display ENUM('Y','N') default 'N', sale_category ENUM('Y','N') default 'N', dead_lead_category ENUM('Y','N') default 'N' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_ivr ( ivr_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -1593,7 +1600,7 @@ prompt_audio_20 VARCHAR(20), prompt_response_20 TINYINT(1) UNSIGNED default '0', index (phone_number), index (entry_time) -); +) ENGINE=MyISAM; ALTER TABLE vicidial_ivr AUTO_INCREMENT = 1000000; @@ -1608,7 +1615,7 @@ group_grade TINYINT(2) UNSIGNED default '1', index (group_id), index (user), unique index viga_user_group_id (user, group_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_live_inbound_agents ( user VARCHAR(20), @@ -1621,7 +1628,7 @@ group_grade TINYINT(2) UNSIGNED default '1', index (group_id), index (group_weight), unique index vlia_user_group_id (user, group_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_campaign_agents ( user VARCHAR(20), @@ -1633,7 +1640,7 @@ group_web_vars VARCHAR(255) default '', campaign_grade TINYINT(2) UNSIGNED default '1', index (campaign_id), index (user) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_user_closer_log ( user VARCHAR(20), @@ -1644,12 +1651,12 @@ closer_campaigns TEXT, manager_change VARCHAR(20) default '', index (user), index (event_date) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_qc_codes ( code VARCHAR(8) PRIMARY KEY NOT NULL, code_name VARCHAR(30) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_agent_sph ( campaign_group_id VARCHAR(20) NOT NULL, @@ -1664,14 +1671,14 @@ login_hours DECIMAL(5,2) DEFAULT '0.00', sph DECIMAL(6,2) DEFAULT '0.00', index (campaign_group_id), index (stat_date) -); +) ENGINE=MyISAM; CREATE TABLE phones_alias ( alias_id VARCHAR(20) NOT NULL UNIQUE PRIMARY KEY, alias_name VARCHAR(50), logins_list VARCHAR(255), user_group VARCHAR(20) default '---ALL---' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_shifts ( shift_id VARCHAR(20) NOT NULL, @@ -1683,7 +1690,7 @@ report_option ENUM('Y','N') default 'N', user_group VARCHAR(20) default '---ALL---', report_rank SMALLINT(5) default '1', index (shift_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_timeclock_log ( timeclock_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -1701,7 +1708,7 @@ manager_ip VARCHAR(15), event_datestamp TIMESTAMP NOT NULL, tcid_link INT(9) UNSIGNED, index (user) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_timeclock_status ( user VARCHAR(20) UNIQUE NOT NULL, @@ -1712,7 +1719,7 @@ status VARCHAR(50), ip_address VARCHAR(15), shift_id VARCHAR(20), index (user) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_timeclock_audit_log ( timeclock_id INT(9) UNSIGNED NOT NULL, @@ -1728,7 +1735,7 @@ event_datestamp TIMESTAMP NOT NULL, tcid_link INT(9) UNSIGNED, index (timeclock_id), index (user) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_admin_log ( admin_log_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -1745,7 +1752,7 @@ user_group VARCHAR(20) default '---ALL---', index (user), index (event_section), index (record_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_list_alt_phones ( alt_phone_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -1757,14 +1764,14 @@ alt_phone_count SMALLINT(5) UNSIGNED, active ENUM('Y','N') default 'Y', index (lead_id), index (phone_number) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_campaign_dnc ( phone_number VARCHAR(18) NOT NULL, campaign_id VARCHAR(8) NOT NULL, index (phone_number), unique index phonecamp (phone_number, campaign_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_inbound_dids ( did_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -1816,7 +1823,7 @@ custom_five VARCHAR(100) default '', user_group VARCHAR(20) default '---ALL---', unique index (did_pattern), index (group_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_did_log ( uniqueid VARCHAR(20) NOT NULL, @@ -1832,7 +1839,7 @@ index (uniqueid), index (caller_id_number), index (extension), index (call_date) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_api_log ( api_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -1848,7 +1855,7 @@ source VARCHAR(20), data TEXT, run_time VARCHAR(20) default '0', index(api_date) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_nanpa_prefix_codes ( areacode CHAR(3), @@ -1862,7 +1869,7 @@ state VARCHAR(2) default '', postal_code VARCHAR(10) default '', country VARCHAR(2) default '', lata_type VARCHAR(1) default '' -); +) ENGINE=MyISAM; CREATE INDEX areaprefix on vicidial_nanpa_prefix_codes (areacode,prefix); @@ -1880,7 +1887,7 @@ cpd_seconds DECIMAL(7,2) default '0', index(uniqueid), index(callerid), index(lead_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_conf_templates ( template_id VARCHAR(15) NOT NULL, @@ -1888,7 +1895,7 @@ template_name VARCHAR(50) NOT NULL, template_contents TEXT, user_group VARCHAR(20) default '---ALL---', unique index (template_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_server_carriers ( carrier_id VARCHAR(15) NOT NULL, @@ -1905,7 +1912,7 @@ carrier_description VARCHAR(255), user_group VARCHAR(20) default '---ALL---', unique index(carrier_id), index (server_ip) -); +) ENGINE=MyISAM; CREATE TABLE groups_alias ( group_alias_id VARCHAR(30) NOT NULL UNIQUE PRIMARY KEY, @@ -1914,7 +1921,7 @@ caller_id_number VARCHAR(20), caller_id_name VARCHAR(20), active ENUM('Y','N') default 'N', user_group VARCHAR(20) default '---ALL---' -); +) ENGINE=MyISAM; CREATE TABLE user_call_log ( user_call_log_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -1934,7 +1941,7 @@ customer_hungup_seconds SMALLINT(5) UNSIGNED default '0', index (user), index (call_date), index (group_alias_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_tts_prompts ( tts_id VARCHAR(50) PRIMARY KEY NOT NULL, @@ -1943,7 +1950,7 @@ active ENUM('Y','N'), tts_text TEXT, tts_voice VARCHAR(100) default 'Allison-8kHz', user_group VARCHAR(20) default '---ALL---' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_call_menu ( menu_id VARCHAR(50) PRIMARY KEY NOT NULL, @@ -1962,7 +1969,7 @@ dtmf_log ENUM('0','1') default '0', dtmf_field VARCHAR(50) default 'NONE', user_group VARCHAR(20) default '---ALL---', qualify_sql TEXT -); +) ENGINE=MyISAM; CREATE TABLE vicidial_call_menu_options ( menu_id VARCHAR(50) NOT NULL, @@ -1973,7 +1980,7 @@ option_route_value VARCHAR(255), option_route_value_context VARCHAR(1000), index (menu_id), unique index menuoption (menu_id, option_value) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_user_territories ( user VARCHAR(20) NOT NULL, @@ -1981,20 +1988,20 @@ territory VARCHAR(100) default '', level ENUM('TOP_AGENT','STANDARD_AGENT','BOTTOM_AGENT') default 'STANDARD_AGENT', index (user), unique index userterritory (user, territory) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_territories ( territory_id MEDIUMINT(8) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, territory VARCHAR(100) default '', territory_description VARCHAR(255) default '', unique index uniqueterritory (territory) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_override_ids ( id_table VARCHAR(50) PRIMARY KEY NOT NULL, active ENUM('0','1') default '1', value INT(9) default '0' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_carrier_log ( uniqueid VARCHAR(20) PRIMARY KEY NOT NULL, @@ -2011,7 +2018,7 @@ sip_hangup_reason VARCHAR(50) default '', caller_code VARCHAR(30) default '', index (call_date), index (lead_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_list_update_log ( event_date DATETIME, @@ -2025,7 +2032,7 @@ result VARCHAR(20), result_rows SMALLINT(3) UNSIGNED default '0', list_id VARCHAR(255), index (event_date) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_drop_rate_groups ( group_id VARCHAR(20) PRIMARY KEY NOT NULL, @@ -2035,7 +2042,7 @@ answers_today INT(9) UNSIGNED default '0', drops_today INT(9) UNSIGNED default '0', drops_today_pct VARCHAR(6) default '0', drops_answers_today_pct VARCHAR(6) default '0' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_process_triggers ( trigger_id VARCHAR(20) PRIMARY KEY NOT NULL, @@ -2045,7 +2052,7 @@ trigger_time DATETIME, trigger_run ENUM('0','1') default '0', user VARCHAR(20), trigger_lines TEXT -); +) ENGINE=MyISAM; CREATE TABLE vicidial_process_trigger_log ( trigger_id VARCHAR(20) NOT NULL, @@ -2056,7 +2063,7 @@ trigger_lines TEXT, trigger_results TEXT, index (trigger_id), index (trigger_time) -); +) ENGINE=MyISAM; CREATE TABLE vtiger_rank_data ( account VARCHAR(20) PRIMARY KEY NOT NULL, @@ -2070,7 +2077,7 @@ imu VARCHAR(10) NOT NULL, aov SMALLINT(5) NOT NULL, returns SMALLINT(5) NOT NULL, rank SMALLINT(5) NOT NULL -); +) ENGINE=MyISAM; CREATE TABLE vtiger_rank_parameters ( parameter_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -2079,7 +2086,7 @@ lower_range VARCHAR(20) NOT NULL, upper_range VARCHAR(20) NOT NULL, points SMALLINT(5) NOT NULL, index (parameter) -); +) ENGINE=MyISAM; CREATE TABLE twoday_call_log ( @@ -2100,7 +2107,7 @@ length_in_min DOUBLE(8,2), index (caller_code), index (server_ip), index (channel) -); +) ENGINE=MyISAM; CREATE TABLE twoday_vicidial_log ( uniqueid VARCHAR(20) PRIMARY KEY NOT NULL, @@ -2122,7 +2129,7 @@ term_reason ENUM('CALLER','AGENT','QUEUETIMEOUT','ABANDON','AFTERHOURS','NONE') alt_dial VARCHAR(6) default 'NONE', index (lead_id), index (call_date) -); +) ENGINE=MyISAM; CREATE TABLE twoday_vicidial_closer_log ( closecallid INT(9) UNSIGNED PRIMARY KEY NOT NULL, @@ -2149,7 +2156,7 @@ index (lead_id), index (call_date), index (campaign_id), index (uniqueid) -); +) ENGINE=MyISAM; CREATE TABLE twoday_vicidial_xfer_log ( xfercallid INT(9) UNSIGNED PRIMARY KEY NOT NULL, @@ -2163,7 +2170,7 @@ user VARCHAR(20), closer VARCHAR(20), index (lead_id), index (call_date) -); +) ENGINE=MyISAM; CREATE TABLE twoday_recording_log ( recording_id INT(10) UNSIGNED PRIMARY KEY NOT NULL, @@ -2185,7 +2192,7 @@ index(filename), index(lead_id), index(user), index(vicidial_id) -); +) ENGINE=MyISAM; CREATE TABLE twoday_vicidial_agent_log ( agent_log_id INT(9) UNSIGNED PRIMARY KEY NOT NULL, @@ -2213,7 +2220,7 @@ uniqueid VARCHAR(20) default '', index (lead_id), index (user), index (event_time) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_music_on_hold ( moh_id VARCHAR(100) PRIMARY KEY NOT NULL, @@ -2222,14 +2229,14 @@ active ENUM('Y','N') default 'N', random ENUM('Y','N') default 'N', remove ENUM('Y','N') default 'N', user_group VARCHAR(20) default '---ALL---' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_music_on_hold_files ( filename VARCHAR(100) NOT NULL, moh_id VARCHAR(100) NOT NULL, rank SMALLINT(5), unique index mohfile (filename, moh_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_voicemail ( voicemail_id VARCHAR(10) NOT NULL UNIQUE PRIMARY KEY, @@ -2244,7 +2251,7 @@ voicemail_timezone VARCHAR(30) default 'eastern', voicemail_options VARCHAR(255) default '', user_group VARCHAR(20) default '---ALL---', voicemail_greeting VARCHAR(100) default '' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_user_territory_log ( user VARCHAR(20), @@ -2253,7 +2260,7 @@ event_date DATETIME, agent_territories TEXT, index (user), index (event_date) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_grab_call_log ( auto_call_id INT(9) UNSIGNED NOT NULL, @@ -2270,12 +2277,12 @@ index (auto_call_id), index (event_date), index (user), index (campaign_id) -); +) ENGINE=MyISAM; CREATE TABLE vtiger_vicidial_roles ( user_level TINYINT(2), vtiger_role VARCHAR(5) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_call_notes ( notesid INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -2286,7 +2293,7 @@ order_id VARCHAR(20), appointment_date DATE, appointment_time TIME, call_notes TEXT -); +) ENGINE=MyISAM; ALTER TABLE vicidial_call_notes AUTO_INCREMENT = 100; CREATE INDEX lead_id on vicidial_call_notes (lead_id); @@ -2299,7 +2306,7 @@ country_code SMALLINT(5) UNSIGNED, campaign_id VARCHAR(8) default '--ALL--', index (state), index (areacode) -); +) ENGINE=MyISAM; CREATE TABLE callcard_accounts ( card_id VARCHAR(20) PRIMARY KEY NOT NULL, @@ -2308,7 +2315,7 @@ status ENUM('GENERATE','PRINT','SHIP','HOLD','ACTIVE','USED','EMPTY','CANCEL','V balance_minutes SMALLINT(5) default '3', inbound_group_id VARCHAR(20) default '', index (pin) -); +) ENGINE=MyISAM; CREATE TABLE callcard_accounts_details ( card_id VARCHAR(20) PRIMARY KEY NOT NULL, @@ -2335,7 +2342,7 @@ create_time DATETIME, activate_time DATETIME, used_time DATETIME, void_time DATETIME -); +) ENGINE=MyISAM; CREATE TABLE callcard_log ( uniqueid VARCHAR(20) PRIMARY KEY NOT NULL, @@ -2352,7 +2359,7 @@ phone_number VARCHAR(18), inbound_did VARCHAR(18), index (card_id), index (call_time) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_extension_groups ( extension_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -2364,7 +2371,7 @@ call_count_today MEDIUMINT(7) default '0', last_call_time DATETIME, last_callerid VARCHAR(20) default '', index (extension_group_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_remote_agent_log ( uniqueid VARCHAR(20) default '', @@ -2382,7 +2389,7 @@ index (call_time), index (ra_user), index (extension), index (phone_number) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_log_extended ( uniqueid VARCHAR(50) PRIMARY KEY NOT NULL, @@ -2395,7 +2402,7 @@ start_url_processed ENUM('N','Y','U') default 'N', dispo_url_processed ENUM('N','Y','U','XY','XU') default 'N', multi_alt_processed ENUM('N','Y','U') default 'N', noanswer_processed ENUM('N','Y','U') default 'N' -); +) ENGINE=MyISAM; CREATE INDEX call_date on vicidial_log_extended (call_date); @@ -2417,7 +2424,7 @@ field_required ENUM('Y','N') default 'N', name_position ENUM('LEFT','TOP') default 'LEFT', multi_position ENUM('HORIZONTAL','VERTICAL') default 'HORIZONTAL', field_order SMALLINT(5) default '1' -); +) ENGINE=MyISAM; CREATE UNIQUE INDEX listfield on vicidial_lists_fields (list_id, field_label); @@ -2427,14 +2434,14 @@ filter_phone_group_name VARCHAR(40) NOT NULL, filter_phone_group_description VARCHAR(100), user_group VARCHAR(20) default '---ALL---', index (filter_phone_group_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_filter_phone_numbers ( phone_number VARCHAR(18) NOT NULL, filter_phone_group_id VARCHAR(20) NOT NULL, index (phone_number), unique index phonefilter (phone_number, filter_phone_group_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_xfer_presets ( campaign_id VARCHAR(20) NOT NULL, @@ -2443,14 +2450,14 @@ preset_number VARCHAR(50) NOT NULL, preset_dtmf VARCHAR(50) default '', preset_hide_number ENUM('Y','N') default 'N', index (preset_name) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_xfer_stats ( campaign_id VARCHAR(20) NOT NULL, preset_name VARCHAR(40) NOT NULL, xfer_count SMALLINT(5) UNSIGNED default '0', index (campaign_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_manual_dial_queue ( mdq_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -2460,7 +2467,7 @@ entry_time DATETIME, status ENUM('READY','QUEUE') default 'READY', external_dial VARCHAR(100) default '', index (user) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_lead_search_log ( search_log_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -2472,7 +2479,7 @@ results INT(9) UNSIGNED default '0', seconds MEDIUMINT(7) UNSIGNED default '0', index (user), index (event_date) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_campaign_stats_debug ( campaign_id VARCHAR(20) NOT NULL, @@ -2483,7 +2490,7 @@ debug_output TEXT, adapt_output TEXT, index (campaign_id), unique index campserver (campaign_id, server_ip) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_outbound_ivr_log ( uniqueid VARCHAR(50) NOT NULL, @@ -2497,7 +2504,7 @@ index (event_date), index (lead_id), index (campaign_id), unique index campserver (event_date, lead_id, menu_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_screen_labels ( label_id VARCHAR(20) PRIMARY KEY NOT NULL, @@ -2524,7 +2531,7 @@ label_security_phrase VARCHAR(40) default '', label_email VARCHAR(40) default '', label_comments VARCHAR(40) default '', user_group VARCHAR(20) default '---ALL---' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_agent_skip_log ( user_skip_log_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -2537,7 +2544,7 @@ previous_called_count SMALLINT(5) UNSIGNED default '0', index (user), index (event_date), index (campaign_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_url_log ( url_log_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -2548,7 +2555,7 @@ response_sec SMALLINT(5) UNSIGNED default '0', url TEXT, url_response TEXT, index (uniqueid) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_log_noanswer ( uniqueid VARCHAR(20) PRIMARY KEY NOT NULL, @@ -2571,7 +2578,7 @@ alt_dial VARCHAR(6) default 'NONE', caller_code VARCHAR(30) NOT NULL, index (lead_id), index (call_date) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_did_agent_log ( uniqueid VARCHAR(20) NOT NULL, @@ -2589,7 +2596,7 @@ index (uniqueid), index (caller_id_number), index (extension), index (call_date) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_campaign_cid_areacodes ( campaign_id VARCHAR(8) NOT NULL, @@ -2600,7 +2607,7 @@ cid_description VARCHAR(50), call_count_today MEDIUMINT(7) default '0', index (campaign_id), index (areacode) -); +) ENGINE=MyISAM; CREATE UNIQUE INDEX campareacode on vicidial_campaign_cid_areacodes (campaign_id, areacode, outbound_cid); @@ -2613,7 +2620,7 @@ active ENUM('Y','N','') default '', call_count_today MEDIUMINT(7) default '0', index (did_id), index (user_start) -); +) ENGINE=MyISAM; CREATE UNIQUE INDEX didraexten on vicidial_did_ra_extensions (did_id, user_start, extension); @@ -2630,7 +2637,7 @@ department VARCHAR(100) default '', group_name VARCHAR(100) default '', job_title VARCHAR(100) default '', location VARCHAR(100) default '' -); +) ENGINE=MyISAM; CREATE INDEX ci_first_name on contact_information (first_name); CREATE INDEX ci_last_name on contact_information (last_name); @@ -2655,7 +2662,7 @@ time_setting ENUM('LOCAL','SERVER') default NULL, UNIQUE KEY snapshot_date_list_key (snapshot_time,list_id,time_setting), KEY snapshot_date_key (snapshot_time) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_daily_max_stats ( stats_date DATE NOT NULL, @@ -2674,7 +2681,7 @@ total_calls INT(9) UNSIGNED default '0', index (stats_date), index (stats_flag), index (campaign_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_daily_ra_stats ( stats_date DATE NOT NULL, @@ -2687,7 +2694,7 @@ total_calls INT(9) UNSIGNED default '0', index (stats_date), index (stats_flag), index (user) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_custom_leadloader_templates ( template_id VARCHAR(20) PRIMARY KEY NOT NULL, @@ -2697,7 +2704,7 @@ list_id BIGINT(14) UNSIGNED DEFAULT NULL, standard_variables TEXT, custom_table VARCHAR(20) DEFAULT NULL, custom_variables TEXT -); +) ENGINE=MyISAM; CREATE TABLE vicidial_session_data ( session_name VARCHAR(40) UNIQUE NOT NULL, @@ -2709,7 +2716,7 @@ extension VARCHAR(100) NOT NULL, login_time DATETIME NOT NULL, webphone_url TEXT, agent_login_call TEXT -); +) ENGINE=MyISAM; CREATE TABLE vicidial_dial_log ( caller_code VARCHAR(30) NOT NULL, @@ -2727,7 +2734,7 @@ uniqueid VARCHAR(20) default '', index (caller_code), index (lead_id), index (call_date) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_qc_agent_log ( @@ -2751,7 +2758,7 @@ details TEXT COLLATE utf8_unicode_ci, processed ENUM('Y','N') COLLATE utf8_unicode_ci NOT NULL, PRIMARY KEY (qc_agent_log_id), KEY view_epoch (view_epoch) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_comments ( comment_id BIGINT(20) unsigned NOT NULL AUTO_INCREMENT, @@ -2768,21 +2775,21 @@ unhidden_user_id INT(11) DEFAULT NULL, unhidden_timestamp DATETIME DEFAULT NULL, PRIMARY KEY (comment_id), index (lead_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_configuration ( id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY , name VARCHAR(36) NOT NULL , value VARCHAR(36) NOT NULL , UNIQUE (name) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_lists_custom ( list_id BIGINT(14) unsigned NOT NULL, audit_comments TINYINT(1) DEFAULT NULL COMMENT 'visible', audit_comments_enabled TINYINT(1) DEFAULT NULL COMMENT 'invisible', PRIMARY KEY (list_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_call_time_holidays ( holiday_id VARCHAR(30) PRIMARY KEY NOT NULL, @@ -2794,7 +2801,7 @@ ct_default_start SMALLINT(4) unsigned NOT NULL default '900', ct_default_stop SMALLINT(4) unsigned NOT NULL default '2100', default_afterhours_filename_override VARCHAR(255) default '', user_group VARCHAR(20) default '---ALL---' -); +) ENGINE=MyISAM; CREATE TABLE vicidial_email_list ( email_row_id INT(10) UNSIGNED NOT NULL AUTO_INCREMENT, @@ -2822,7 +2829,7 @@ PRIMARY KEY (email_row_id), KEY email_list_account_key (email_account_id), KEY email_list_user_key (user), KEY vicidial_email_lead_id_key (lead_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_email_accounts ( email_account_id VARCHAR(20) NOT NULL, @@ -2845,7 +2852,7 @@ list_id BIGINT(14) UNSIGNED DEFAULT NULL, email_account_type ENUM('INBOUND','OUTBOUND') DEFAULT 'INBOUND', PRIMARY KEY (email_account_id), KEY email_accounts_group_key (group_id) -); +) ENGINE=MyISAM; CREATE TABLE inbound_email_attachments ( attachment_id INT(10) UNSIGNED NOT NULL AUTO_INCREMENT, @@ -2858,7 +2865,7 @@ file_extension VARCHAR(5) NOT NULL DEFAULT '', file_contents LONGBLOB NOT NULL, PRIMARY KEY (attachment_id), KEY attachments_email_id_key (email_row_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_email_log ( email_log_id INT(10) UNSIGNED NOT NULL AUTO_INCREMENT, @@ -2873,7 +2880,7 @@ attachments TEXT, PRIMARY KEY (email_log_id), KEY vicidial_email_log_lead_id_key (lead_id), KEY vicidial_email_log_email_row_id_key (email_row_id) -); +) ENGINE=MyISAM; CREATE TABLE vicidial_report_log ( report_log_id INT(9) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, @@ -2888,7 +2895,7 @@ url TEXT, run_time VARCHAR(20) default '0', index (user), index (report_name) -); +) ENGINE=MyISAM; ALTER TABLE vicidial_email_list MODIFY message text character set utf8; @@ -3129,4 +3136,4 @@ UPDATE vicidial_configuration set value='1766' where name='qc_database_version'; UPDATE system_settings set vdc_agent_api_active='1'; -UPDATE system_settings SET db_schema_version='1351',db_schema_update_date=NOW(); +UPDATE system_settings SET db_schema_version='1352',db_schema_update_date=NOW(); diff --git a/agc_2-X/trunk/extras/upgrade_2.8.sql b/agc_2-X/trunk/extras/upgrade_2.8.sql index b2514cfc..7516ddd1 100644 --- a/agc_2-X/trunk/extras/upgrade_2.8.sql +++ b/agc_2-X/trunk/extras/upgrade_2.8.sql @@ -12,3 +12,15 @@ ALTER TABLE vicidial_users ADD pass_hash VARCHAR(100) default ''; ALTER TABLE system_settings ADD pass_hash_enabled ENUM('0','1') default '0'; UPDATE system_settings SET db_schema_version='1351',db_schema_update_date=NOW() where db_schema_version < 1351; + +ALTER TABLE vicidial_user_log ADD phone_login VARCHAR(15) default ''; +ALTER TABLE vicidial_user_log ADD server_phone VARCHAR(15) default ''; +ALTER TABLE vicidial_user_log ADD phone_ip VARCHAR(15) default ''; + +ALTER TABLE system_settings ADD pass_key VARCHAR(100) default ''; +ALTER TABLE system_settings ADD pass_cost TINYINT(2) UNSIGNED default '2'; + +CREATE INDEX phone_ip ON vicidial_user_log (phone_ip); +CREATE INDEX vuled ON vicidial_user_log (event_date); + +UPDATE system_settings SET db_schema_version='1352',db_schema_update_date=NOW() where db_schema_version < 1352; diff --git a/agc_2-X/trunk/www/agc/functions.php b/agc_2-X/trunk/www/agc/functions.php index 8ec78779..a03ab217 100644 --- a/agc_2-X/trunk/www/agc/functions.php +++ b/agc_2-X/trunk/www/agc/functions.php @@ -24,10 +24,29 @@ function user_authorization($user,$pass,$user_option,$user_update) { require("dbconnect.php"); + ############################################# + ##### START SYSTEM_SETTINGS LOOKUP ##### + $stmt = "SELECT use_non_latin,webroot_writable,pass_hash_enabled,pass_key,pass_cost FROM system_settings;"; + $rslt=mysql_query($stmt, $link); + if ($DB) {echo "$stmt\n";} + $qm_conf_ct = mysql_num_rows($rslt); + if ($qm_conf_ct > 0) + { + $row=mysql_fetch_row($rslt); + $non_latin = $row[0]; + $SSwebroot_writable = $row[1]; + $SSpass_hash_enabled = $row[2]; + $SSpass_key = $row[3]; + $SSpass_cost = $row[4]; + } + ##### END SETTINGS LOOKUP ##### + ########################################### + $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $ip = getenv("REMOTE_ADDR"); + $browser = getenv("HTTP_USER_AGENT"); $LOCK_over = ($STARTtime - 900); # failed login lockout time is 15 minutes(900 seconds) $LOCK_trigger_attempts = 10; @@ -76,6 +95,12 @@ function user_authorization($user,$pass,$user_option,$user_update) {$auth_key='LOCK';} } } + if ($SSwebroot_writable > 0) + { + $fp = fopen ("./project_auth_entries.txt", "a"); + fwrite ($fp, "AGENT|FAIL|$NOW_TIME|$user|$auth_key|$ip|$browser|\n"); + fclose($fp); + } } else { diff --git a/agc_2-X/trunk/www/agc/vicidial.php b/agc_2-X/trunk/www/agc/vicidial.php index 90ede4a2..6a335821 100644 --- a/agc_2-X/trunk/www/agc/vicidial.php +++ b/agc_2-X/trunk/www/agc/vicidial.php @@ -404,10 +404,11 @@ # 130508-2307 - Branched 2.7, trunk becomes 2.8 # 130603-2209 - Added login lockout for 15 minutes after 10 failed logins, and other security fixes # 130615-1125 - Added recording_id to dispo url +# 130625-0841 - Added more user log data on login # -$version = '2.8-373c'; -$build = '130615-1125'; +$version = '2.8-374c'; +$build = '130625-0841'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=79; $one_mysql_log=0; @@ -2516,7 +2517,7 @@ else ### insert an entry into the user log for the login event $vul_data = "$vlERIaffected_rows|$vhICaffected_rows|$vlaLIaffected_rows|$vliaLIaffected_rows"; - $stmt = "INSERT INTO vicidial_user_log (user,event,campaign_id,event_date,event_epoch,user_group,session_id,server_ip,extension,computer_ip,browser,data) values('$VD_login','LOGIN','$VD_campaign','$NOW_TIME','$StarTtimE','$VU_user_group','$session_id','$server_ip','$protocol/$extension','$ip','$browser','$vul_data')"; + $stmt = "INSERT INTO vicidial_user_log (user,event,campaign_id,event_date,event_epoch,user_group,session_id,server_ip,extension,computer_ip,browser,data,phone_login,server_phone,phone_ip) values('$VD_login','LOGIN','$VD_campaign','$NOW_TIME','$StarTtimE','$VU_user_group','$session_id','$server_ip','$protocol/$extension','$ip','$browser','$vul_data','$original_phone_login','$phone_login','LOOKUP');"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_query($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'01031',$VD_login,$server_ip,$session_name,$one_mysql_log);} @@ -14594,7 +14595,7 @@ $zi=2; if ($label_comments == '---HIDE---') { - echo " \n"; + echo " \n"; } else { diff --git a/agc_2-X/trunk/www/vicidial/AST_CLOSER_service_level.php b/agc_2-X/trunk/www/vicidial/AST_CLOSER_service_level.php index 8e0a0ad3..3d1b9daf 100644 --- a/agc_2-X/trunk/www/vicidial/AST_CLOSER_service_level.php +++ b/agc_2-X/trunk/www/vicidial/AST_CLOSER_service_level.php @@ -22,11 +22,13 @@ # 120224-0910 - Added HTML display option with bar graphs # 130414-0104 - Added report logging # 130610-1024 - Finalized changing of all ereg instances to preg +# 130621-0806 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -48,9 +50,6 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];} -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - if (strlen($shift)<2) {$shift='ALL';} $report_name = 'Inbound Service Level Report'; @@ -73,25 +72,65 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';"; -if ($DB) {$MAIN.="|$stmt|\n";} -if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';"; -if ($DB) {$MAIN.="|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$reports_only_user=$row[0]; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } ##### BEGIN log visit to the vicidial_report_log table ##### @@ -123,7 +162,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $MAIN.="\n"; } -$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {$MAIN.="|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); @@ -140,7 +179,7 @@ $LOGadmin_viewable_call_times = $row[3]; if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; diff --git a/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php b/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php index 693e5672..c72489df 100644 --- a/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php +++ b/agc_2-X/trunk/www/vicidial/AST_CLOSERstats.php @@ -38,6 +38,7 @@ # 130124-1719 - Added email report support # 130414-1429 - Added report logging # 130610-1023 - Finalized changing of all ereg instances to preg +# 130621-0805 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); @@ -71,9 +72,6 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];} -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - $MT[0]='0'; if (strlen($shift)<2) {$shift='ALL';} @@ -112,28 +110,68 @@ if ($gmt_conf_ct > 0) $epoch_offset = (($local_gmt + $dst) * 3600); } -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';"; -if ($DB) {$MAIN.="|$stmt|\n";} -if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';"; -if ($DB) {$MAIN.="|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$reports_only_user=$row[0]; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); } -$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {$MAIN.="|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); @@ -150,7 +188,7 @@ $LOGadmin_viewable_call_times = $row[3]; if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; diff --git a/agc_2-X/trunk/www/vicidial/AST_CLOSERsummary_hourly.php b/agc_2-X/trunk/www/vicidial/AST_CLOSERsummary_hourly.php index 25e3afb0..8482d515 100644 --- a/agc_2-X/trunk/www/vicidial/AST_CLOSERsummary_hourly.php +++ b/agc_2-X/trunk/www/vicidial/AST_CLOSERsummary_hourly.php @@ -17,6 +17,7 @@ # 120224-0910 - Added HTML display option with bar graphs # 130414-0107 - Added report logging # 130610-1022 - Finalized changing of all ereg instances to preg +# 130621-0801 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); @@ -59,9 +60,6 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];} -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - $MT[0]='0'; if (strlen($shift)<2) {$shift='ALL';} if (strlen($exclude_rollover)<2) {$exclude_rollover='NO';} @@ -98,25 +96,65 @@ if ($gmt_conf_ct > 0) $epoch_offset = (($local_gmt + $dst) * 3600); } -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';"; -if ($DB) {$MAIN.="|$stmt|\n";} -if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';"; -if ($DB) {$MAIN.="|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$reports_only_user=$row[0]; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } ##### BEGIN log visit to the vicidial_report_log table ##### @@ -148,7 +186,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $MAIN.="\n"; } -$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {$MAIN.="|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); @@ -165,7 +203,7 @@ $LOGadmin_viewable_call_times = $row[3]; if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; diff --git a/agc_2-X/trunk/www/vicidial/AST_DIDstats.php b/agc_2-X/trunk/www/vicidial/AST_DIDstats.php index c769e6eb..d2c33e07 100644 --- a/agc_2-X/trunk/www/vicidial/AST_DIDstats.php +++ b/agc_2-X/trunk/www/vicidial/AST_DIDstats.php @@ -17,6 +17,7 @@ # 120224-0910 - Added HTML display option with bar graphs # 130414-0113 - Added report logging # 130610-1017 - Finalized changing of all ereg instances to preg +# 130621-0758 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); @@ -46,9 +47,6 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];} -$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); - if (strlen($shift)<2) {$shift='ALL';} $report_name = 'Inbound DID Report'; @@ -71,28 +69,69 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';"; -if ($DB) {$MAIN.="|$stmt|\n";} -if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';"; -if ($DB) {$MAIN.="|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$reports_only_user=$row[0]; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); } -$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + + +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {$MAIN.="|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); @@ -109,7 +148,7 @@ $LOGadmin_viewable_call_times = $row[3]; if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; diff --git a/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php b/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php index d9481e0c..c7050d07 100644 --- a/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php +++ b/agc_2-X/trunk/www/vicidial/AST_GROUP_ALIASstats.php @@ -11,6 +11,7 @@ # 90914-1003 - First build # 130414-0214 - Added report logging # 130610-1016 - Finalized changing of all ereg instances to preg +# 130621-0751 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); @@ -34,9 +35,6 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - if (strlen($shift)<2) {$shift='ALL';} ############################################# @@ -53,20 +51,67 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 6 and view_reports='1';"; -if ($DB) {echo "|$stmt|\n";} -if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php b/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php index 6d33e8dc..184a6509 100644 --- a/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php +++ b/agc_2-X/trunk/www/vicidial/AST_IVRfilter.php @@ -11,6 +11,7 @@ # 120113-2022 - Added new columns for sent to queue and agent # 130414-0257 - Added report logging # 130610-1007 - Finalized changing of all ereg instances to preg +# 130621-0741 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); @@ -18,6 +19,7 @@ $startMS = microtime(); $report_name='IVR Filter Report'; require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -49,18 +51,18 @@ if (isset($_GET["DB"])) {$DB=$_GET["DB"];} if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];} -if ($hourly_breakdown) { +if ($hourly_breakdown) + { $date_int=3600; $substr_place=13; $checked="checked"; -} else { + } +else + { $date_int=86400; $substr_place=10; $checked=""; -} - -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### @@ -78,20 +80,65 @@ while ($i < $qm_conf_ct) ##### END SETTINGS LOOKUP ##### ########################################### -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1';"; -if ($DB) {$HTML_header.="|$stmt|\n";} -if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } ##### BEGIN log visit to the vicidial_report_log table ##### diff --git a/agc_2-X/trunk/www/vicidial/AST_IVRstats.php b/agc_2-X/trunk/www/vicidial/AST_IVRstats.php index 1627b2b1..297c36c0 100644 --- a/agc_2-X/trunk/www/vicidial/AST_IVRstats.php +++ b/agc_2-X/trunk/www/vicidial/AST_IVRstats.php @@ -22,11 +22,13 @@ # 120224-0910 - Added HTML display option with bar graphs # 130114-0115 - Added report logging # 130610-1004 - Finalized changing of all ereg instances to preg +# 130621-0738 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -52,9 +54,6 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];} -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - if (strlen($shift)<2) {$shift='ALL';} if (strlen($type)<2) {$type='inbound';} @@ -83,25 +82,65 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';"; -if ($DB) {$MAIN.="|$stmt|\n";} -if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';"; -if ($DB) {$MAIN.="|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$reports_only_user=$row[0]; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } ##### BEGIN log visit to the vicidial_report_log table ##### @@ -133,7 +172,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $MAIN.="\n"; } -$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {$MAIN.="|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); @@ -180,7 +219,7 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen( if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; diff --git a/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php b/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php new file mode 100644 index 00000000..0962541b --- /dev/null +++ b/agc_2-X/trunk/www/vicidial/AST_LAGGED_log_report.php @@ -0,0 +1,371 @@ + LICENSE: AGPLv2 +# +# CHANGES +# 130622-1026 - First build +# + +$startMS = microtime(); + +require("dbconnect.php"); +require("functions.php"); + +$report_name='LAGGED Agent Log Report'; + +$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; +$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; +$PHP_SELF=$_SERVER['PHP_SELF']; +if (isset($_GET["query_date"])) {$query_date=$_GET["query_date"];} + elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];} +if (isset($_GET["query_date_D"])) {$query_date_D=$_GET["query_date_D"];} + elseif (isset($_POST["query_date_D"])) {$query_date_D=$_POST["query_date_D"];} +if (isset($_GET["query_date_T"])) {$query_date_T=$_GET["query_date_T"];} + elseif (isset($_POST["query_date_T"])) {$query_date_T=$_POST["query_date_T"];} +if (isset($_GET["url_type"])) {$url_type=$_GET["url_type"];} + elseif (isset($_POST["url_type"])) {$url_type=$_POST["url_type"];} +if (isset($_GET["response_sec"])) {$response_sec=$_GET["response_sec"];} + elseif (isset($_POST["response_sec"])) {$response_sec=$_POST["response_sec"];} +if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} + elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];} +if (isset($_GET["lower_limit"])) {$lower_limit=$_GET["lower_limit"];} + elseif (isset($_POST["lower_limit"])) {$lower_limit=$_POST["lower_limit"];} +if (isset($_GET["upper_limit"])) {$upper_limit=$_GET["upper_limit"];} + elseif (isset($_POST["upper_limit"])) {$upper_limit=$_POST["upper_limit"];} +if (isset($_GET["DB"])) {$DB=$_GET["DB"];} + elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} +if (isset($_GET["submit"])) {$submit=$_GET["submit"];} + elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} +if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} + elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} +if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} + elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];} + +$NOW_DATE = date("Y-m-d"); + +if (strlen($query_date_D) < 6) {$query_date_D = "00:00:00";} +if (strlen($query_date_T) < 6) {$query_date_T = "23:59:59";} +if (!isset($query_date)) {$query_date = $NOW_DATE;} + +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db FROM system_settings;"; +$rslt=mysql_query($stmt, $link); +if ($DB) {$MAIN.="$stmt\n";} +$qm_conf_ct = mysql_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysql_fetch_row($rslt); + $non_latin = $row[0]; + $outbound_autodial_active = $row[1]; + $slave_db_server = $row[2]; + $reports_use_slave_db = $row[3]; + } +##### END SETTINGS LOOKUP ##### +########################################### + +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + + +##### BEGIN log visit to the vicidial_report_log table ##### +$LOGip = getenv("REMOTE_ADDR"); +$LOGbrowser = getenv("HTTP_USER_AGENT"); +$LOGscript_name = getenv("SCRIPT_NAME"); +$LOGserver_name = getenv("SERVER_NAME"); +$LOGserver_port = getenv("SERVER_PORT"); +$LOGrequest_uri = getenv("REQUEST_URI"); +$LOGhttp_referer = getenv("HTTP_REFERER"); +if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';} + else {$HTTPprotocol = 'http://';} +if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';} +else {$LOGserver_port = ":$LOGserver_port";} +$LOGfull_url = "$HTTPprotocol$LOGserver_name$LOGserver_port$LOGrequest_uri"; + +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $lower_limit, $upper_limit, $file_download|', url='$LOGfull_url';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$report_log_id = mysql_insert_id($link); +##### END log visit to the vicidial_report_log table ##### + + +if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_slave_db)) ) + { + mysql_close($link); + $use_slave_server=1; + $db_source = 'S'; + require("dbconnect.php"); + $MAIN.="\n"; + } + +$HEADER.="\n"; +$HEADER.="\n"; +$HEADER.="\n"; +$HEADER.="\n"; +$HEADER.="\n"; +$HEADER.="\n"; +$HEADER.="\n"; +$HEADER.="\n"; +$HEADER.="\n"; +$HEADER.="\n"; +$HEADER.="$report_name\n"; + +$short_header=1; + +$MAIN.="
"; +$MAIN.="
\n"; +$MAIN.="\n"; + +$MAIN.=""; +$MAIN.="
\n"; +$MAIN.="\n"; +$MAIN.="Date:\n"; +$MAIN.=""; +$MAIN.=""; + +$MAIN.=" to "; + +$MAIN.="\n"; +$MAIN.="Display as:"; +$MAIN.="\n"; +$MAIN.="
\n"; +if ($SUBMIT && $query_date) { + $stmt="select server_ip, count(*) as ct From vicidial_agent_log where event_time>='$query_date $query_date_D' and event_time<='$query_date $query_date_T' and sub_status='LAGGED' group by server_ip order by server_ip"; + $rslt=mysql_query($stmt, $link); + $ASCII_text="
\n";
+	$HTML_text="";
+	if ($DB) {$ASCII_text.=$stmt."\n";}
+	if (mysql_num_rows($rslt)>0) {
+		$ASCII_text.="--- SERVER IP BREAKDOWN FOR LAGGED RECORDS $query_date, $query_date_D TO $query_date_T \n";
+		$ASCII_text.="+-----------------+---------+\n";
+		$ASCII_text.="| SERVER IP       |  COUNT  |\n";
+		$ASCII_text.="+-----------------+---------+\n";
+		$HTML_text.="";
+		$HTML_text.="";
+		$HTML_text.="";
+
+		$total_count=0;
+		while ($row=mysql_fetch_array($rslt)) {
+			$ASCII_text.="| ".sprintf("%-16s", $row["server_ip"]);
+			$ASCII_text.="| ".sprintf("%-8s", $row["ct"]);
+			$ASCII_text.="|\n";
+			$HTML_text.="";
+			$total_count+=$row["ct"];
+		}
+		$ASCII_text.="+-----------------+---------+\n";
+		$ASCII_text.="|           TOTAL | ".sprintf("%-8s", $total_count)."|\n";
+		$ASCII_text.="+-----------------+---------+\n\n\n";
+		$HTML_text.="
SERVER IP BREAKDOWN FOR LAGGED RECORDS $query_date, $query_date_D TO $query_date_T
SERVER IPCOUNT
$row[server_ip]$row[ct]
TOTAL$total_count
";
+
+
+		$rpt_stmt="select * from vicidial_agent_log where sub_status='LAGGED' and event_time>='$query_date $query_date_D' and event_time<='$query_date $query_date_T' $url_type_SQL order by user, event_time asc";
+		$rpt_rslt=mysql_query($rpt_stmt, $link);
+		if ($DB) {$ASCII_text.=$rpt_stmt."\n";}
+
+		if (!$lower_limit) {$lower_limit=1;}
+		if ($lower_limit+999>=mysql_num_rows($rpt_rslt)) {$upper_limit=($lower_limit+mysql_num_rows($rpt_rslt)%1000)-1;} else {$upper_limit=$lower_limit+999;}
+
+		$ASCII_text.="--- LAGGED LOG RECORDS FOR $query_date, $query_date_D TO $query_date_T $server_rpt_string, RECORDS #$lower_limit-$upper_limit               [DOWNLOAD]\n";
+		$lagged_rpt.="+--------------+------------+-----------------+---------------------+-----------+----------+--------+----------------------+----------------------+----------------------+\n";
+		$lagged_rpt.="| AGENT LOG ID | USER       | SERVER IP       | EVENT TIME          | LEAD ID   | CAMPAIGN | STATUS | USER GROUP           | COMMENTS             | UNIQUE ID            |\n";
+		$lagged_rpt.="+--------------+------------+-----------------+---------------------+-----------+----------+--------+----------------------+----------------------+----------------------+\n";
+
+		$HTML_text.="

";
+		$HTML_rpt.="";
+		$HTML_rpt.="";
+
+		$CSV_text="\"AGENT LOG ID\",\"USER\",\"SERVER IP\",\"EVENT TIME\",\"LEAD ID\",\"CAMPAIGN\",\"STATUS\",\"USER GROUP\",\"COMMENTS\",\"UNIQUE ID\"\n";
+
+		for ($i=1; $i<=mysql_num_rows($rpt_rslt); $i++) {
+			$row=mysql_fetch_array($rpt_rslt);
+
+			$CSV_text.="\"$row[agent_log_id]\",\"$row[user]\",\"$row[server_ip]\",\"$row[event_time]\",\"$row[lead_id]\",\"$row[campaign_id]\",\"$row[status]\",\"$row[user_group]\",\"$row[comments]\",\"$row[uniqueid]\"\n";
+			if ($i>=$lower_limit && $i<=$upper_limit) {
+				if ($i%2==0) {$color_class="grey_graph_cell";} else {$color_class='white_graph_cell';}
+
+				$HTML_rpt.="";
+
+				$lagged_rpt.="| ".sprintf("%-13s", $row["agent_log_id"]); 
+				$lagged_rpt.="| ".sprintf("%-11s", $row["user"]); 
+				$lagged_rpt.="| ".sprintf("%-16s", $row["server_ip"]); 
+				$lagged_rpt.="| ".sprintf("%-20s", $row["event_time"]);
+				$lagged_rpt.="| ".sprintf("%-10s", $row["lead_id"]);
+				$lagged_rpt.="| ".sprintf("%-9s", $row["campaign_id"]);
+				$lagged_rpt.="| ".sprintf("%-7s", $row["status"]);
+				$lagged_rpt.="| ".sprintf("%-21s", $row["user_group"]);
+				$lagged_rpt.="| ".sprintf("%-21s", $row["comments"]);
+				$lagged_rpt.="| ".sprintf("%-21s", $row["uniqueid"]);
+				$lagged_rpt.="|\n";
+			}
+		}
+		$lagged_rpt.="+--------------+------------+-----------------+---------------------+-----------+----------+--------+----------------------+----------------------+----------------------+\n";
+
+		$lagged_rpt_hf="";
+		$HTML_rpt_hf="";
+		$ll=$lower_limit-1000;
+		if ($ll<1 || ($lower_limit+1000)>=mysql_num_rows($rpt_rslt)) {$HTML_colspan=6;} else {$HTML_colspan=3;}
+
+		if ($ll>=1) {
+			$lagged_rpt_hf.="[<<< PREV 1000 records]";
+			$HTML_rpt_hf.="";
+		$lagged_rpt_hf.="\n";
+		$ASCII_text.=$lagged_rpt_hf.$lagged_rpt.$lagged_rpt_hf;
+		$HTML_text.=$HTML_rpt_hf.$HTML_rpt.$HTML_rpt_hf."
LAGGED LOG RECORDS FOR $query_date, $query_date_D TO $query_date_T $server_rpt_string, RECORDS #$lower_limit-$upper_limit[DOWNLOAD]
AGENT LOG IDUSERSERVER IPEVENT TIMELEAD IDCAMPAIGNSTATUSUSER GROUPCOMMENTSUNIQUE ID
$row[agent_log_id]$row[user]$row[server_ip]$row[event_time]$row[lead_id]$row[campaign_id]$row[status]$row[user_group]$row[comments]$row[uniqueid]
[<<< PREV 1000 records]";
+
+		} else {
+			$lagged_rpt_hf.=sprintf("%-23s", " ");
+		}
+		$lagged_rpt_hf.=sprintf("%-145s", " ");
+		if (($lower_limit+1000)=mysql_num_rows($rpt_rslt)) {$max_limit=mysql_num_rows($rpt_rslt)-$upper_limit;} else {$max_limit=1000;}
+			$lagged_rpt_hf.="[NEXT $max_limit records >>>]";
+			$HTML_rpt_hf.="[NEXT $max_limit records >>>]";
+		} else {
+			$lagged_rpt_hf.=sprintf("%23s", " ");
+		}
+		$HTML_rpt_hf.="
";
+	} else {
+		$MAIN.="*** NO RECORDS FOUND ***\n";
+	}
+	$ASCII_text.="
\n"; + + if ($report_display_type=="HTML") + { + $MAIN.=$HTML_text; + } + else + { + $MAIN.=$ASCII_text; + } + + + $MAIN.="
\n"; + + +} + if ($file_download>0) { + $FILE_TIME = date("Ymd-His"); + $CSVfilename = "AST_url_log_report_$US$FILE_TIME.csv"; + $CSV_text=preg_replace('/ +\"/', '"', $CSV_text); + $CSV_text=preg_replace('/\" +/', '"', $CSV_text); + // We'll be outputting a TXT file + header('Content-type: application/octet-stream'); + + // It will be called LIST_101_20090209-121212.txt + header("Content-Disposition: attachment; filename=\"$CSVfilename\""); + header('Expires: 0'); + header('Cache-Control: must-revalidate, post-check=0, pre-check=0'); + header('Pragma: public'); + ob_clean(); + flush(); + + echo "$CSV_text"; + + exit; + } else { + echo $HEADER; + require("admin_header.php"); + echo $MAIN; + } + +if ($db_source == 'S') + { + mysql_close($link); + $use_slave_server=0; + $db_source = 'M'; + require("dbconnect.php"); + } + +$endMS = microtime(); +$startMSary = explode(" ",$startMS); +$endMSary = explode(" ",$endMS); +$runS = ($endMSary[0] - $startMSary[0]); +$runM = ($endMSary[1] - $startMSary[1]); +$TOTALrun = ($runS + $runM); + +$stmt="UPDATE vicidial_report_log set run_time='$TOTALrun' where report_log_id='$report_log_id';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); + +exit; + +?> diff --git a/agc_2-X/trunk/www/vicidial/AST_LISTS_campaign_stats.php b/agc_2-X/trunk/www/vicidial/AST_LISTS_campaign_stats.php index 9216973d..85a7883f 100644 --- a/agc_2-X/trunk/www/vicidial/AST_LISTS_campaign_stats.php +++ b/agc_2-X/trunk/www/vicidial/AST_LISTS_campaign_stats.php @@ -15,6 +15,7 @@ # 130414-0127 - Added report logging # 130424-2039 - Added lines for new status categories of scheduled callbacks and completed # 130610-1001 - Finalized changing of all ereg instances to preg +# 130621-0735 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); @@ -40,9 +41,6 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];} -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - $report_name = 'Lists Campaign Statuses Report'; $db_source = 'M'; $JS_text="\n"; +$HEADER.="\n"; +$HEADER.="\n"; +$HEADER.="\n"; +$HEADER.="\n"; +$HEADER.="\n"; +$HEADER.="\n"; +$HEADER.="$report_name\n"; + +$short_header=1; + +$MAIN.="
"; +$MAIN.="
\n"; +$MAIN.="
\n"; +$MAIN.="\n"; +$MAIN.="Date:\n"; +$MAIN.=""; +$MAIN.="\n"; + +$MAIN.="

"; + +$MAIN.="
to
"; + +$MAIN.="		URL type:
\n"; +$MAIN.="		\n"; +$MAIN.="Display as:
"; +$MAIN.="\n

"; +$MAIN.="

\n"; +$MAIN.="
\n"; +if ($SUBMIT && $url_type_ct>0) { + $stmt="select url_type, count(*) as ct From vicidial_url_log where url_date>='$query_date $query_date_D' and url_date<='$query_date $query_date_T' $url_type_SQL $server_ip_SQL group by url_type order by url_type"; + $rslt=mysql_query($stmt, $link); + $ASCII_text="
\n";
+	$HTML_text="";
+	if ($DB) {$ASCII_text.=$stmt."\n";}
+	if (mysql_num_rows($rslt)>0) {
+		$ASCII_text.="--- URL TYPE BREAKDOWN FOR $query_date, $query_date_D TO $query_date_T $server_rpt_string\n";
+		$ASCII_text.="+--------------+---------+\n";
+		$ASCII_text.="| URL TYPE     |  COUNT  |\n";
+		$ASCII_text.="+--------------+---------+\n";
+		$HTML_text.="";
+		$HTML_text.="";
+		$HTML_text.="";
+
+		$total_count=0;
+		while ($row=mysql_fetch_array($rslt)) {
+			$ASCII_text.="| ".sprintf("%-13s", $row["url_type"]);
+			$ASCII_text.="| ".sprintf("%-8s", $row["ct"]);
+			$ASCII_text.="|\n";
+			$HTML_text.="";
+			$total_count+=$row["ct"];
+		}
+		$ASCII_text.="+--------------+---------+\n";
+		$ASCII_text.="|        TOTAL | ".sprintf("%-8s", $total_count)."|\n";
+		$ASCII_text.="+--------------+---------+\n\n";
+		$HTML_text.="
URL TYPE BREAKDOWN FOR $query_date, $query_date_D TO $query_date_T $server_rpt_string
URL TYPECOUNT
$row[url_type]$row[ct]
TOTAL$total_count
";
+
+
+		$rpt_stmt="select * from vicidial_url_log where url_date>='$query_date $query_date_D' and url_date<='$query_date $query_date_T' $url_type_SQL order by url_date asc";
+		$rpt_rslt=mysql_query($rpt_stmt, $link);
+		if ($DB) {$ASCII_text.=$rpt_stmt."\n";}
+
+		if (!$lower_limit) {$lower_limit=1;}
+		if ($lower_limit+999>=mysql_num_rows($rpt_rslt)) {$upper_limit=($lower_limit+mysql_num_rows($rpt_rslt)%1000)-1;} else {$upper_limit=$lower_limit+999;}
+		
+		$ASCII_text.="--- URL LOG RECORDS FOR $query_date, $query_date_D TO $query_date_T $server_rpt_string, RECORDS #$lower_limit-$upper_limit               [DOWNLOAD]\n";
+		$url_rpt.="+----------------------+---------------------+--------------+----------+----------------------------------------------------------------------------------+----------------------------------------------------------------------------------+\n";
+		$url_rpt.="| UNIQUE ID            | URL DATE            | URL TYPE     | RESP SEC | URL                                                                              | URL RESPONSE                                                                     |\n";
+		$url_rpt.="+----------------------+---------------------+--------------+----------+----------------------------------------------------------------------------------+----------------------------------------------------------------------------------+\n";
+
+		$HTML_text.="

";
+		$HTML_rpt.="";
+		$HTML_rpt.="";
+
+		$CSV_text="\"UNIQUE ID\",\"URL DATE\",\"URL TYPE\",\"RESP SEC\",\"URL\",\"URL RESPONSE\"\n";
+
+		for ($i=1; $i<=mysql_num_rows($rpt_rslt); $i++) {
+			$row=mysql_fetch_array($rpt_rslt);
+			$phone_number=""; $phone_note="";
+
+			if (strlen($row["phone_number"])==0) {
+				$stmt2="select phone_number, alt_phone, address3 from vicidial_list where lead_id='$row[lead_id]'";
+				$rslt2=mysql_query($stmt2, $link);
+				while ($row2=mysql_fetch_array($rslt2)) {
+					if (strlen($row2["alt_phone"])>=7 && preg_match("/$row2[alt_phone]/", $channel)) {$phone_number=$row2["alt_phone"]; $phone_note="ALT";}
+					else if (strlen($row2["address3"])>=7 && preg_match("/$row2[address3]/", $channel)) {$phone_number=$row2["address3"]; $phone_note="ADDR3";}
+					else if (strlen($row2["phone_number"])>=7 && preg_match("/$row2[phone_number]/", $channel)) {$phone_number=$row2["phone_number"]; $phone_note="*";}
+				}
+			} else {
+				$phone_number=$row["phone_number"];
+			}
+
+			$CSV_text.="\"$row[uniqueid]\",\"$row[url_date]\",\"$row[url_type]\",\"$row[response_sec]\",\"$row[url]\",\"$row[url_response]\"\n";
+			if ($i>=$lower_limit && $i<=$upper_limit) {
+				if ($i%2==0) {$color_class="grey_graph_cell";} else {$color_class='white_graph_cell';}
+				$row["url_response"]=preg_replace("/\r/", "\\r", $row["url_response"]);
+				$row["url_response"]=preg_replace("/\n/", "\\n", $row["url_response"]);
+
+				$HTML_rpt.="";
+
+				if (mb_strlen($row["url"])>mb_strlen($row["url_response"])) {
+					$max_url_length=mb_strlen($row["url"]);
+				} else {
+					$max_url_length=mb_strlen($row["url_response"]);
+				}
+				$lines_to_print=ceil($max_url_length/80);
+				for ($j=1; $j<=$lines_to_print; $j++) {
+					if ($j==1) {
+						$url_text=substr($row["url"], (80*($j-1)), 80);
+						$url_response_text=substr($row["url_response"], (80*($j-1)), 80);
+
+						$url_rpt.="| ".sprintf("%-21s", $row["uniqueid"]); 
+						$url_rpt.="| ".sprintf("%-20s", $row["url_date"]); 
+						$url_rpt.="| ".sprintf("%-13s", $row["url_type"]); 
+						$url_rpt.="| ".sprintf("%-9s", $row["response_sec"]);
+
+						$url_rpt.="| ";
+						$url_rpt.=htmlspecialchars($url_text);
+						$blanks=81-strlen($url_text);
+						if ($blanks>0) {for ($k=1; $k<=$blanks; $k++) {$url_rpt.=" ";}}
+					
+						$url_rpt.="| ";
+						$url_rpt.=htmlspecialchars($url_response_text);
+						$blanks=81-strlen($url_response_text);
+						if ($blanks>0) {for ($k=1; $k<=$blanks; $k++) {$url_rpt.=" ";}}			
+						$url_rpt.="|\n";
+					} else {
+						$url_text=substr($row["url"], (80*($j-1)), 80);
+						$url_response_text=substr($row["url_response"], (80*($j-1)), 80);
+
+						$url_rpt.="| ".sprintf("%-21s", ""); 
+						$url_rpt.="| ".sprintf("%-20s", ""); 
+						$url_rpt.="| ".sprintf("%-13s", ""); 
+						$url_rpt.="| ".sprintf("%-9s", ""); 
+
+						$url_rpt.="| ";
+						$url_rpt.=htmlspecialchars($url_text);
+						$blanks=81-strlen($url_text);
+						if ($blanks>0) {for ($k=1; $k<=$blanks; $k++) {$url_rpt.=" ";}}
+
+						$url_rpt.="| ";
+						$url_rpt.=htmlspecialchars($url_response_text);
+						$blanks=81-strlen($url_response_text);
+						if ($blanks>0) {for ($k=1; $k<=$blanks; $k++) {$url_rpt.=" ";}}
+						$url_rpt.="|\n";
+					}
+				}
+			}
+		}
+		$url_rpt.="+----------------------+---------------------+--------------+----------+----------------------------------------------------------------------------------+----------------------------------------------------------------------------------+\n";
+
+		$url_rpt_hf="";
+		$HTML_rpt_hf="";
+		$ll=$lower_limit-1000;
+		if ($ll<1 || ($lower_limit+1000)>=mysql_num_rows($rpt_rslt)) {$HTML_colspan=6;} else {$HTML_colspan=3;}
+
+		if ($ll>=1) {
+			$url_rpt_hf.="[<<< PREV 1000 records]";
+			$HTML_rpt_hf.="";
+		$url_rpt_hf.="\n";
+		$ASCII_text.=$url_rpt_hf.$url_rpt.$url_rpt_hf;
+		$HTML_text.=$HTML_rpt_hf.$HTML_rpt.$HTML_rpt_hf."
URL LOG RECORDS FOR $query_date, $query_date_D TO $query_date_T $server_rpt_string, RECORDS #$lower_limit-$upper_limit[DOWNLOAD]
UNIQUE IDURL DATEURL TYPERESP SECURLURL RESPONSE
$row[uniqueid]
$row[url_date]
$row[url_type]
$row[response_sec]
$row[url]
$row[url_response]
[<<< PREV 1000 records]";
+
+		} else {
+			$url_rpt_hf.=sprintf("%-23s", " ");
+		}
+		$url_rpt_hf.=sprintf("%-145s", " ");
+		if (($lower_limit+1000)=mysql_num_rows($rpt_rslt)) {$max_limit=mysql_num_rows($rpt_rslt)-$upper_limit;} else {$max_limit=1000;}
+			$url_rpt_hf.="[NEXT $max_limit records >>>]";
+			$HTML_rpt_hf.="[NEXT $max_limit records >>>]";
+		} else {
+			$url_rpt_hf.=sprintf("%23s", " ");
+		}
+		$HTML_rpt_hf.="
";
+	} else {
+		$MAIN.="*** NO RECORDS FOUND ***\n";
+	}
+	$ASCII_text.="
\n"; + + if ($report_display_type=="HTML") + { + $MAIN.=$HTML_text; + } + else + { + $MAIN.=$ASCII_text; + } + + + $MAIN.="
\n"; + + +} + if ($file_download>0) { + $FILE_TIME = date("Ymd-His"); + $CSVfilename = "AST_url_log_report_$US$FILE_TIME.csv"; + $CSV_text=preg_replace('/ +\"/', '"', $CSV_text); + $CSV_text=preg_replace('/\" +/', '"', $CSV_text); + // We'll be outputting a TXT file + header('Content-type: application/octet-stream'); + + // It will be called LIST_101_20090209-121212.txt + header("Content-Disposition: attachment; filename=\"$CSVfilename\""); + header('Expires: 0'); + header('Cache-Control: must-revalidate, post-check=0, pre-check=0'); + header('Pragma: public'); + ob_clean(); + flush(); + + echo "$CSV_text"; + + exit; + } else { + echo $HEADER; + require("admin_header.php"); + echo $MAIN; + } + +if ($db_source == 'S') + { + mysql_close($link); + $use_slave_server=0; + $db_source = 'M'; + require("dbconnect.php"); + } + +$endMS = microtime(); +$startMSary = explode(" ",$startMS); +$endMSary = explode(" ",$endMS); +$runS = ($endMSary[0] - $startMSary[0]); +$runM = ($endMSary[1] - $startMSary[1]); +$TOTALrun = ($runS + $runM); + +$stmt="UPDATE vicidial_report_log set run_time='$TOTALrun' where report_log_id='$report_log_id';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); + +exit; + +?> diff --git a/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php b/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php index 11310a60..5ed9fc69 100644 --- a/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php +++ b/agc_2-X/trunk/www/vicidial/AST_usergroup_login_report.php @@ -11,6 +11,8 @@ # 120526-0803 - First build # 130414-0145 - Added report logging # 130610-0957 - Finalized changing of all ereg instances to preg +# 130620-2248 - Added filtering of input to prevent SQL injection attacks and new user auth +# 130627-0742 - Added new phone fields # $startMS = microtime(); @@ -55,28 +57,67 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; -if ($DB) {$HTML_text.="|$stmt|\n";} -if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';"; -if ($DB) {$HTML_text.="|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$reports_only_user=$row[0]; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } +$group = preg_replace("/'|\"|\\\\|;/","",$group); +$user_group = preg_replace("/'|\"|\\\\|;/","",$user_group); + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } ##### BEGIN log visit to the vicidial_report_log table ##### @@ -93,6 +134,8 @@ if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port=' else {$LOGserver_port = ":$LOGserver_port";} $LOGfull_url = "$HTTPprotocol$LOGserver_name$LOGserver_port$LOGrequest_uri"; +$day30range=date("Y-m-d", mktime(0,0,0,date("m"),date("d")-30,date("Y"))); + $stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_query($stmt, $link); @@ -108,7 +151,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $HTML_text.="\n"; } -$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {$HTML_text.="|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); @@ -125,7 +168,7 @@ $LOGadmin_viewable_call_times = $row[3]; if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; @@ -247,31 +290,31 @@ $HTML_text.="
\n\n";
 
 if ($SUBMIT=="SUBMIT") 
 	{
-	 $ASCII_text="+--------------------------------+----------+----------------------+---------------------+---------------------+----------+-----------------+-----------------+----------------------+--------------+\n";
-	$ASCII_text.="| USER NAME                      | ID       | USER GROUP           | FIRST LOGIN DATE    | LAST LOGIN DATE     | CAMPAIGN | SERVER IP       | COMPUTER IP     | EXTENSION            | BROWSER      |\n";
-	$ASCII_text.="+--------------------------------+----------+----------------------+---------------------+---------------------+----------+-----------------+-----------------+----------------------+--------------+\n";
+	$ASCII_text="+--------------------------------+----------+----------------------+---------------------+---------------------+----------+-----------------+-----------------+----------------------+--------------+-----------------+-----------------+-----------------+\n";
+	$ASCII_text.="| USER NAME                      | ID       | USER GROUP           | FIRST LOGIN DATE    | LAST LOGIN DATE     | CAMPAIGN | SERVER IP       | COMPUTER IP     | EXTENSION            | BROWSER      | PHONE LOGIN     |  SERVER PHONE   | PHONE IP        |\n";
+	$ASCII_text.="+--------------------------------+----------+----------------------+---------------------+---------------------+----------+-----------------+-----------------+----------------------+--------------+-----------------+-----------------+-----------------+\n";
 
 	$CSV_text="\"User group login report\",\"User groups:\",\"$user_group_string\"\n\n";
-	$CSV_text.="\"User name\",\"User ID\",\"User group\",\"First login date\",\"Last login date\",\"Campaign ID\",\"Server IP\",\"Computer IP\",\"Extension\",\"Browser\"\n";
+	$CSV_text.="\"User name\",\"User ID\",\"User group\",\"First login date\",\"Last login date\",\"Campaign ID\",\"Server IP\",\"Computer IP\",\"Extension\",\"Browser\",\"Phone login\",\"Server phone\",\"Phone IP\"\n";
 	$stmt="select distinct user, substr(full_name,1,30) as fullname, full_name from vicidial_users where user_group in ($user_group_SQL) order by user";
 	$rslt=mysql_query($stmt, $link);
 	while ($row=mysql_fetch_array($rslt)) 
 		{
-		$date_stmt="select min(event_date) as min_date, max(event_date) as max_date from vicidial_user_log where user='$row[user]' and event='LOGIN'";
+		$date_stmt="select min(event_date) as min_date, max(event_date) as max_date from vicidial_user_log where user='$row[user]' and event='LOGIN' and event_date>='$day30range'";
 		$date_rslt=mysql_query($date_stmt, $link);
 		$date_row=mysql_fetch_array($date_rslt);
 
-		$data_stmt="select campaign_id, server_ip, computer_ip, user_group, substring(extension,1,20) as ext, extension, browser from vicidial_user_log where user='$row[user]' and event_date='$date_row[max_date]' and event='LOGIN'";
+		$data_stmt="select campaign_id, server_ip, computer_ip, user_group, substring(extension,1,20) as ext, extension, browser, phone_login, server_phone, phone_ip from vicidial_user_log where user='$row[user]' and event_date='$date_row[max_date]' and event='LOGIN'";
 		$data_rslt=mysql_query($data_stmt, $link);
 		while ($data_row=mysql_fetch_array($data_rslt)) 
 			{
 			preg_match('/^[^\s]+/', $data_row["browser"], $browser_ary);
 			$browser=$browser_ary[0];
-			$ASCII_text.="| ".sprintf("%-30s", $row["fullname"])." | ".sprintf("%-8s", $row["user"])." | ".sprintf("%-20s", $data_row["user_group"])." | ".sprintf("%-19s", $date_row["min_date"])." | ".sprintf("%-19s", $date_row["max_date"])." | ".sprintf("%-8s", $data_row["campaign_id"])." | ".sprintf("%-15s", $data_row["server_ip"])." | ".sprintf("%-15s", $data_row["computer_ip"])." | ".sprintf("%-20s", $data_row["ext"])." | ".sprintf("%-12s", $browser)." |\n";
-			$CSV_text.="\"$row[full_name]\",\"$row[user]\",\"$data_row[user_group]\",\"$date_row[min_date]\",\"$date_row[max_date]\",\"$data_row[campaign_id]\",\"$data_row[server_ip]\",\"$data_row[computer_ip]\",\"$data_row[extension]\",\"$data_row[browser]\"\n";
+			$ASCII_text.="| ".sprintf("%-30s", $row["fullname"])." | ".sprintf("%-8s", $row["user"])." | ".sprintf("%-20s", $data_row["user_group"])." | ".sprintf("%-19s", $date_row["min_date"])." | ".sprintf("%-19s", $date_row["max_date"])." | ".sprintf("%-8s", $data_row["campaign_id"])." | ".sprintf("%-15s", $data_row["server_ip"])." | ".sprintf("%-15s", $data_row["computer_ip"])." | ".sprintf("%-20s", $data_row["ext"])." | ".sprintf("%-12s", $browser)." | ".sprintf("%-15s", $data_row["phone_login"])." | ".sprintf("%-15s", $data_row["server_phone"])." | ".sprintf("%-15s", $data_row["phone_ip"])." |\n";
+			$CSV_text.="\"$row[full_name]\",\"$row[user]\",\"$data_row[user_group]\",\"$date_row[min_date]\",\"$date_row[max_date]\",\"$data_row[campaign_id]\",\"$data_row[server_ip]\",\"$data_row[computer_ip]\",\"$data_row[extension]\",\"$data_row[browser]\",\"$data_row[phone_login]\",\"$data_row[server_phone]\",\"$data_row[phone_ip]\"\n";
 			}
 		}
-	$ASCII_text.="+--------------------------------+----------+----------------------+---------------------+---------------------+----------+-----------------+-----------------+----------------------+--------------+\n";
+	$ASCII_text.="+--------------------------------+----------+----------------------+---------------------+---------------------+----------+-----------------+-----------------+----------------------+--------------+-----------------+-----------------+-----------------+\n";
 	}
 
 if ($file_download>0) 
diff --git a/agc_2-X/trunk/www/vicidial/QM_live_monitor.php b/agc_2-X/trunk/www/vicidial/QM_live_monitor.php
index 3816d661..02dfc2e6 100644
--- a/agc_2-X/trunk/www/vicidial/QM_live_monitor.php
+++ b/agc_2-X/trunk/www/vicidial/QM_live_monitor.php
@@ -8,17 +8,17 @@
 # CHANGELOG:
 # 90529-2115 - First Build
 # 130610-1130 - Finalized changing of all ereg instances to preg
+# 130617-2128 - Added filtering of input to prevent SQL injection attacks
 #
 
-$version = '2.8-2';
-$build = '130610-1130';
+$version = '2.8-3';
+$build = '130617-2128';
 
 header ("Content-type: text/html; charset=utf-8");
 
 require("dbconnect.php");
 require("functions.php");
 
-
 if (isset($_GET["DB"]))					{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))		{$DB=$_POST["DB"];}
 if (isset($_GET["campaign"]))			{$campaign=$_GET["campaign"];}
@@ -42,6 +42,16 @@ if (isset($_GET["extension"]))			{$extension=$_GET["extension"];}
 if (isset($_GET["stage"]))				{$stage=$_GET["stage"];}
 	elseif (isset($_POST["stage"]))		{$stage=$_POST["stage"];}
 
+$call = preg_replace('/[^0-9a-zA-Z]/', '', $call);
+$user = preg_replace('/[^0-9a-zA-Z]/', '', $user);
+$extension = preg_replace("/'|\"|\\\\|;/", '', $extension);
+$server_ip = preg_replace("/'|\"|\\\\|;/", '', $server_ip);
+$stage = preg_replace("/'|\"|\\\\|;/", '', $stage);
+$campaign = preg_replace("/'|\"|\\\\|;/", '', $campaign);
+$phone = preg_replace("/'|\"|\\\\|;/", '', $phone);
+$type = preg_replace("/'|\"|\\\\|;/", '', $type);
+$QMuser = preg_replace("/'|\"|\\\\|;/", '', $QMuser);
+
 
 $ERR=0;
 $ERRstring='';
@@ -173,6 +183,3 @@ if ($ERR > 0)
 
 exit;
 
-
-
-
diff --git a/agc_2-X/trunk/www/vicidial/admin.php b/agc_2-X/trunk/www/vicidial/admin.php
index 95329b30..18ca3c0e 100644
--- a/agc_2-X/trunk/www/vicidial/admin.php
+++ b/agc_2-X/trunk/www/vicidial/admin.php
@@ -1813,61 +1813,10 @@ if (strlen($dial_status) > 0)
 	$status = $dial_status;
 	}
 
-if ($download_max_system_stats_metric_name) {
-	if (!$query_date) {$query_date=date("Y-m-d", time()-(29*86400));}
-	if (!$end_date) {
-		$end_date=date("Y-m-d", time());
-	} else if (strtotime($end_date)>strtotime(date("Y-m-d"))) {
-		$end_date=date("Y-m-d");
-	}
-	if ($query_date>$end_date) {$query_date=$end_date;}
-
-	$num_graph_days = ceil(abs(strtotime($end_date) - strtotime($query_date)) / 86400)+1;
-	$CSV_text="";
-
-	if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="total call count in and out") {
-		download_max_system_stats($campaign_id,$num_graph_days,'system','total_calls','total call count in and out',$end_date);
-	}
-	if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="total inbound call count") {
-		download_max_system_stats($campaign_id,$num_graph_days,'system','total_calls_inbound_all','total inbound call count',$end_date);
-	}
-	if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="total outbound call count") {
-		download_max_system_stats($campaign_id,$num_graph_days,'system','total_calls_outbound_all','total outbound call count',$end_date);
-	}
-	if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent calls in and out") {
-		download_max_system_stats($campaign_id,$num_graph_days,'system','(max_inbound + max_outbound)','most concurrent calls in and out',$end_date);
-	}
-	if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent calls inbound total") {
-		download_max_system_stats($campaign_id,$num_graph_days,'system','max_inbound','most concurrent calls inbound total',$end_date);
-	}
-	if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent calls outbound total") {
-		download_max_system_stats($campaign_id,$num_graph_days,'system','max_outbound','most concurrent calls outbound total',$end_date);
-	}
-	if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent agents") {
-		download_max_system_stats($campaign_id,$num_graph_days,'system','max_agents','most concurrent agents',$end_date);
-	}
-
-	$FILE_TIME = date("Ymd-His");
-	$CSVfilename = "MAX_SYSTEM_STATS_$US$FILE_TIME.csv";
-	$CSV_text=preg_replace('/ +\"/', '"', $CSV_text);
-	$CSV_text=preg_replace('/\" +/', '"', $CSV_text);
-	header('Content-type: application/octet-stream');
-
-	header("Content-Disposition: attachment; filename=\"$CSVfilename\"");
-	header('Expires: 0');
-	header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
-	header('Pragma: public');
-	ob_clean();
-	flush();
-
-	echo "$CSV_text";
-
-	exit;
-}
 
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
-$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,allow_emails,level_8_disable_add FROM system_settings;";
+$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,allow_emails,level_8_disable_add,pass_key FROM system_settings;";
 $rslt=mysql_query($stmt, $link);
 if ($DB) {echo "$stmt\n";}
 $qm_conf_ct = mysql_num_rows($rslt);
@@ -1911,10 +1860,28 @@ if ($qm_conf_ct > 0)
 	$SSsvn_revision =						$row[34];
 	$SSallow_emails =						$row[35];
 	$SSlevel_8_disable_add =				$row[36];
+	$SSpass_key =							$row[37];
 	}
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+### populate pass_key if not set
+if ( ($qm_conf_ct > 0) and (strlen($SSpass_key)<16) )
+	{
+	$SSpass_key = '';
+	$possible = "0123456789abcdefghijklmnpqrstvwxyzABCDEFGHIJKLMNPQRSTUVWXYZ";  
+	$i = 0; 
+	$length = 16;
+	while ($i < $length) 
+		{ 
+		$char = substr($possible, mt_rand(0, strlen($possible)-1), 1);
+		$SSpass_key .= $char;
+		$i++;
+		}
+	$stmt="UPDATE system_settings set pass_key='$SSpass_key' where ( (pass_key is NULL) or (pass_key='') );";
+	$rslt=mysql_query($stmt, $link);
+	}
+
 
 ######################################################################################################
 ######################################################################################################
@@ -3248,12 +3215,14 @@ else
 # 130510-1350 - Added outbound state call time holidays functionality
 # 130605-0841 - Converted ereg to preg
 #             - Added display of agent login information on User Modify screen, and reset of failed_logins on update
+# 130615-2124 - Added login lockout for 15 minutes after 10 failed logins, and other security fixes
+# 130627-0745 - Added url log, lagged log and user group login reports to admin utilities page
 #
 
 # make sure you have added a user to the vicidial_users MySQL table with at least user_level 8 to access this page the first time
 
-$admin_version = '2.8-404a';
-$build = '130605-0841';
+$admin_version = '2.8-406a';
+$build = '130627-0745';
 
 $STARTtime = date("U");
 $SQLdate = date("Y-m-d H:i:s");
@@ -3303,10 +3272,10 @@ if ($force_logout)
 	{
 	if( (strlen($PHP_AUTH_USER)>0) or (strlen($PHP_AUTH_PW)>0) )
 		{
-		Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
+		Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
 		Header("HTTP/1.0 401 Unauthorized");
 		}
-	echo "You have now logged out. Thank you\n";
+	echo "You have now logged out. Thank you\n
To log back in, click here";
 	exit;
 	}
 #############################################
@@ -3331,202 +3300,285 @@ if ($qm_conf_ct > 0)
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
-$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and active='Y';";
-if ($DB) {echo "|$stmt|\n";}
-if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
-$rslt=mysql_query($stmt, $link);
-$row=mysql_fetch_row($rslt);
-$auth=$row[0];
+$date = date("r");
+$ip = getenv("REMOTE_ADDR");
+$browser = getenv("HTTP_USER_AGENT");
 
-$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and active='Y' and view_reports='1';";
-if ($DB) {echo "|$stmt|\n";}
-$rslt=mysql_query($stmt, $link);
-$row=mysql_fetch_row($rslt);
-$reports_auth=$row[0];
+$user_auth=0;
+$auth=0;
+$reports_auth=0;
+$qc_auth=0;
+$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1);
+if ($auth_message == 'GOOD')
+	{$user_auth=1;}
 
-$reports_only_user=0;
-if ( ($reports_auth > 0) and ($auth < 1) )
+if ($user_auth > 0)
 	{
-	$ADD=999999;
-	$reports_only_user=1;
+	$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7;";
+	if ($DB) {echo "|$stmt|\n";}
+	$rslt=mysql_query($stmt, $link);
+	$row=mysql_fetch_row($rslt);
+	$auth=$row[0];
+
+	$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
+	if ($DB) {echo "|$stmt|\n";}
+	$rslt=mysql_query($stmt, $link);
+	$row=mysql_fetch_row($rslt);
+	$reports_auth=$row[0];
+
+	$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 1 and qc_enabled > 0;";
+	if ($DB) {echo "|$stmt|\n";}
+	$rslt=mysql_query($stmt, $link);
+	$row=mysql_fetch_row($rslt);
+	$qc_auth=$row[0];
+
+	$reports_only_user=0;
+	$qc_only_user=0;
+	if ( ($reports_auth > 0) and ($auth < 1) )
+		{
+		$ADD=999999;
+		$reports_only_user=1;
+		}
+	if ( ($qc_auth > 0) and ($reports_auth < 1) and ($auth < 1) )
+		{
+		if ( ($ADD != '881') and ($ADD != '100000000000000') )
+			{
+            $ADD=100000000000000;
+			}
+		$qc_only_user=1;
+		}
+	if ( ($qc_auth < 1) and ($reports_auth < 1) and ($auth < 1) )
+		{
+		$VDdisplayMESSAGE = "You do not have permission to be here";
+		Header ("Content-type: text/html; charset=utf-8");
+		echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
+		exit;
+		}
 	}
+else
+	{
+	$VDdisplayMESSAGE = "Login incorrect, please try again";
+	if ($auth_message == 'LOCK')
+		{
+		$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
+		Header ("Content-type: text/html; charset=utf-8");
+		echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
+		exit;
+		}
+	Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
+	Header("HTTP/1.0 401 Unauthorized");
+	echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
+	exit;
+	}
+
+
 ##############################################
 # Include QC Agents with no other permission #
 ##############################################
 require_once('qc/QC_admin_include02.php');
 
-if ($SSwebroot_writable > 0)
-	{$fp = fopen ("./project_auth_entries.txt", "a");}
+$stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,callcard_admin,force_change_password,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,modify_contacts,modify_same_user_level from vicidial_users where user='$PHP_AUTH_USER';";
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGfull_name				=$row[3];
+$LOGuser_level				=$row[4];
+$LOGuser_group				=$row[5];
+$LOGdelete_users			=$row[8];
+$LOGdelete_user_groups		=$row[9];
+$LOGdelete_lists			=$row[10];
+$LOGdelete_campaigns		=$row[11];
+$LOGdelete_ingroups			=$row[12];
+$LOGdelete_remote_agents	=$row[13];
+$LOGload_leads				=$row[14];
+$LOGcampaign_detail			=$row[15];
+$LOGast_admin_access		=$row[16];
+$LOGast_delete_phones		=$row[17];
+$LOGdelete_scripts			=$row[18];
+$LOGdelete_filters			=$row[29];
+$LOGalter_agent_interface	=$row[30];
+$LOGdelete_call_times		=$row[32];
+$LOGmodify_call_times		=$row[33];
+$LOGmodify_users			=$row[34];
+$LOGmodify_campaigns		=$row[35];
+$LOGmodify_lists			=$row[36];
+$LOGmodify_scripts			=$row[37];
+$LOGmodify_filters			=$row[38];
+$LOGmodify_ingroups			=$row[39];
+$LOGmodify_usergroups		=$row[40];
+$LOGmodify_remoteagents		=$row[41];
+$LOGmodify_servers			=$row[42];
+$LOGview_reports			=$row[43];
+$LOGmodify_dids				=$row[56];
+$LOGdelete_dids				=$row[57];
+$LOGmanager_shift_enforcement_override=$row[61];
+$LOGexport_reports			=$row[64];
+$LOGdelete_from_dnc			=$row[65];
+$LOGcallcard_admin			=$row[70];
+$LOGforce_change_password	=$row[71];
+$LOGmodify_shifts			=$row[72];
+$LOGmodify_phones			=$row[73];
+$LOGmodify_carriers			=$row[74];
+$LOGmodify_labels			=$row[75];
+$LOGmodify_statuses			=$row[76];
+$LOGmodify_voicemail		=$row[77];
+$LOGmodify_audiostore		=$row[78];
+$LOGmodify_moh				=$row[79];
+$LOGmodify_tts				=$row[80];
+$LOGmodify_contacts			=$row[81];
+$LOGmodify_same_user_level	=$row[82];
 
-$date = date("r");
-$ip = getenv("REMOTE_ADDR");
-$browser = getenv("HTTP_USER_AGENT");
+$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGallowed_campaigns =			$row[0];
+$LOGallowed_reports =			$row[1];
+$LOGadmin_viewable_groups =		$row[2];
+$LOGadmin_viewable_call_times =	$row[3];
 
-if ( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or ( ($auth < 1 ) and ($reports_auth < 1) and ($qc_auth < 1)) )
+$LOGallowed_campaignsSQL='';
+$whereLOGallowed_campaignsSQL='';
+if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) )
 	{
-	Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
-	Header("HTTP/1.0 401 Unauthorized");
-	echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
+	$rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns);
+	$rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL);
+	$LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')";
+	$whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')";
+	}
+$regexLOGallowed_campaigns = " $LOGallowed_campaigns ";
+
+$admin_viewable_groupsALL=0;
+$LOGadmin_viewable_groupsSQL='';
+$whereLOGadmin_viewable_groupsSQL='';
+$valLOGadmin_viewable_groupsSQL='';
+$vmLOGadmin_viewable_groupsSQL='';
+if ( (!preg_match('/\-\-ALL\-\-/i',$LOGadmin_viewable_groups)) and (strlen($LOGadmin_viewable_groups) > 3) )
+	{
+	$rawLOGadmin_viewable_groupsSQL = preg_replace("/ -/",'',$LOGadmin_viewable_groups);
+	$rawLOGadmin_viewable_groupsSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_groupsSQL);
+	$LOGadmin_viewable_groupsSQL = "and user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
+	$whereLOGadmin_viewable_groupsSQL = "where user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
+	$valLOGadmin_viewable_groupsSQL = "and val.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
+	$vmLOGadmin_viewable_groupsSQL = "and vm.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
+	}
+else 
+	{$admin_viewable_groupsALL=1;}
+$regexLOGadmin_viewable_groups = " $LOGadmin_viewable_groups ";
+
+$LOGadmin_viewable_call_timesSQL='';
+$whereLOGadmin_viewable_call_timesSQL='';
+if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen($LOGadmin_viewable_call_times) > 3) )
+	{
+	$rawLOGadmin_viewable_call_timesSQL = preg_replace("/ -/",'',$LOGadmin_viewable_call_times);
+	$rawLOGadmin_viewable_call_timesSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_call_timesSQL);
+	$LOGadmin_viewable_call_timesSQL = "and call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')";
+	$whereLOGadmin_viewable_call_timesSQL = "where call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')";
+	}
+$regexLOGadmin_viewable_call_times = " $LOGadmin_viewable_call_times ";
+
+$UUgroups_list='';
+if ($admin_viewable_groupsALL > 0)
+	{$UUgroups_list .= "\n";}
+$stmt="SELECT user_group,group_name from vicidial_user_groups $whereLOGadmin_viewable_groupsSQL order by user_group;";
+$rslt=mysql_query($stmt, $link);
+$UUgroups_to_print = mysql_num_rows($rslt);
+$o=0;
+while ($UUgroups_to_print > $o) 
+	{
+	$rowx=mysql_fetch_row($rslt);
+	$UUgroups_list .= "\n";
+	$o++;
+	}
+
+$first_login_link=0;
+
+if ($LOGforce_change_password=='Y')
+	{
+	$ADD=999997;
+	$reports_only_user=1;
+	}
+if ($SSfirst_login_trigger=='Y')
+	{
+	
+	if ($ADD==999996)
+		{$reports_only_user=1;}
+	else
+		{
+		$ADD=999995;
+		$first_login_link=1;
+		}
+	}
+if ($ADD==999995)
+	{
+	$reports_only_user=1;
+	}
+
+if (($LOGuser_level < 9) and ($SSlevel_8_disable_add > 0))
+	{$add_copy_disabled++;}
+
+
+if ($download_max_system_stats_metric_name) 
+	{
+	if (!$query_date) {$query_date=date("Y-m-d", time()-(29*86400));}
+	if (!$end_date) 
+		{
+		$end_date=date("Y-m-d", time());
+		}
+	else if (strtotime($end_date)>strtotime(date("Y-m-d"))) 
+		{
+		$end_date=date("Y-m-d");
+		}
+	if ($query_date>$end_date) {$query_date=$end_date;}
+
+	$num_graph_days = ceil(abs(strtotime($end_date) - strtotime($query_date)) / 86400)+1;
+	$CSV_text="";
+
+	if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="total call count in and out") 
+		{
+		download_max_system_stats($campaign_id,$num_graph_days,'system','total_calls','total call count in and out',$end_date);
+		}
+	if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="total inbound call count") 
+		{
+		download_max_system_stats($campaign_id,$num_graph_days,'system','total_calls_inbound_all','total inbound call count',$end_date);
+		}
+	if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="total outbound call count") 
+		{
+		download_max_system_stats($campaign_id,$num_graph_days,'system','total_calls_outbound_all','total outbound call count',$end_date);
+		}
+	if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent calls in and out") 
+		{
+		download_max_system_stats($campaign_id,$num_graph_days,'system','(max_inbound + max_outbound)','most concurrent calls in and out',$end_date);
+		}
+	if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent calls inbound total") 
+		{
+		download_max_system_stats($campaign_id,$num_graph_days,'system','max_inbound','most concurrent calls inbound total',$end_date);
+		}
+	if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent calls outbound total") 
+		{
+		download_max_system_stats($campaign_id,$num_graph_days,'system','max_outbound','most concurrent calls outbound total',$end_date);
+		}
+	if ($download_max_system_stats_metric_name=="ALL" || $download_max_system_stats_metric_name=="most concurrent agents") 
+		{
+		download_max_system_stats($campaign_id,$num_graph_days,'system','max_agents','most concurrent agents',$end_date);
+		}
+
+	$FILE_TIME = date("Ymd-His");
+	$CSVfilename = "MAX_SYSTEM_STATS_$US$FILE_TIME.csv";
+	$CSV_text=preg_replace('/ +\"/', '"', $CSV_text);
+	$CSV_text=preg_replace('/\" +/', '"', $CSV_text);
+	header('Content-type: application/octet-stream');
+
+	header("Content-Disposition: attachment; filename=\"$CSVfilename\"");
+	header('Expires: 0');
+	header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
+	header('Pragma: public');
+	ob_clean();
+	flush();
+
+	echo "$CSV_text";
+
 	exit;
 	}
 
-if ( ($auth > 0) or ($reports_auth > 0) or ($qc_auth > 0) )
-	{
-	$office_no=strtoupper($PHP_AUTH_USER);
-	$password=strtoupper($PHP_AUTH_PW);
-	$stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,callcard_admin,force_change_password,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,modify_contacts,modify_same_user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW';";
-	$rslt=mysql_query($stmt, $link);
-	$row=mysql_fetch_row($rslt);
-	$LOGfull_name				=$row[3];
-	$LOGuser_level				=$row[4];
-	$LOGuser_group				=$row[5];
-	$LOGdelete_users			=$row[8];
-	$LOGdelete_user_groups		=$row[9];
-	$LOGdelete_lists			=$row[10];
-	$LOGdelete_campaigns		=$row[11];
-	$LOGdelete_ingroups			=$row[12];
-	$LOGdelete_remote_agents	=$row[13];
-	$LOGload_leads				=$row[14];
-	$LOGcampaign_detail			=$row[15];
-	$LOGast_admin_access		=$row[16];
-	$LOGast_delete_phones		=$row[17];
-	$LOGdelete_scripts			=$row[18];
-	$LOGdelete_filters			=$row[29];
-	$LOGalter_agent_interface	=$row[30];
-	$LOGdelete_call_times		=$row[32];
-	$LOGmodify_call_times		=$row[33];
-	$LOGmodify_users			=$row[34];
-	$LOGmodify_campaigns		=$row[35];
-	$LOGmodify_lists			=$row[36];
-	$LOGmodify_scripts			=$row[37];
-	$LOGmodify_filters			=$row[38];
-	$LOGmodify_ingroups			=$row[39];
-	$LOGmodify_usergroups		=$row[40];
-	$LOGmodify_remoteagents		=$row[41];
-	$LOGmodify_servers			=$row[42];
-	$LOGview_reports			=$row[43];
-	$LOGmodify_dids				=$row[56];
-	$LOGdelete_dids				=$row[57];
-	$LOGmanager_shift_enforcement_override=$row[61];
-	$LOGexport_reports			=$row[64];
-	$LOGdelete_from_dnc			=$row[65];
-	$LOGcallcard_admin			=$row[70];
-	$LOGforce_change_password	=$row[71];
-	$LOGmodify_shifts			=$row[72];
-	$LOGmodify_phones			=$row[73];
-	$LOGmodify_carriers			=$row[74];
-	$LOGmodify_labels			=$row[75];
-	$LOGmodify_statuses			=$row[76];
-	$LOGmodify_voicemail		=$row[77];
-	$LOGmodify_audiostore		=$row[78];
-	$LOGmodify_moh				=$row[79];
-	$LOGmodify_tts				=$row[80];
-	$LOGmodify_contacts			=$row[81];
-	$LOGmodify_same_user_level	=$row[82];
-
-	$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
-	$rslt=mysql_query($stmt, $link);
-	$row=mysql_fetch_row($rslt);
-	$LOGallowed_campaigns =			$row[0];
-	$LOGallowed_reports =			$row[1];
-	$LOGadmin_viewable_groups =		$row[2];
-	$LOGadmin_viewable_call_times =	$row[3];
-
-	$LOGallowed_campaignsSQL='';
-	$whereLOGallowed_campaignsSQL='';
-	if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) )
-		{
-		$rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns);
-		$rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL);
-		$LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')";
-		$whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')";
-		}
-	$regexLOGallowed_campaigns = " $LOGallowed_campaigns ";
-
-	$admin_viewable_groupsALL=0;
-	$LOGadmin_viewable_groupsSQL='';
-	$whereLOGadmin_viewable_groupsSQL='';
-	$valLOGadmin_viewable_groupsSQL='';
-	$vmLOGadmin_viewable_groupsSQL='';
-	if ( (!preg_match('/\-\-ALL\-\-/i',$LOGadmin_viewable_groups)) and (strlen($LOGadmin_viewable_groups) > 3) )
-		{
-		$rawLOGadmin_viewable_groupsSQL = preg_replace("/ -/",'',$LOGadmin_viewable_groups);
-		$rawLOGadmin_viewable_groupsSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_groupsSQL);
-		$LOGadmin_viewable_groupsSQL = "and user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
-		$whereLOGadmin_viewable_groupsSQL = "where user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
-		$valLOGadmin_viewable_groupsSQL = "and val.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
-		$vmLOGadmin_viewable_groupsSQL = "and vm.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
-		}
-	else 
-		{$admin_viewable_groupsALL=1;}
-	$regexLOGadmin_viewable_groups = " $LOGadmin_viewable_groups ";
-
-	$LOGadmin_viewable_call_timesSQL='';
-	$whereLOGadmin_viewable_call_timesSQL='';
-	if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen($LOGadmin_viewable_call_times) > 3) )
-		{
-		$rawLOGadmin_viewable_call_timesSQL = preg_replace("/ -/",'',$LOGadmin_viewable_call_times);
-		$rawLOGadmin_viewable_call_timesSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_call_timesSQL);
-		$LOGadmin_viewable_call_timesSQL = "and call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')";
-		$whereLOGadmin_viewable_call_timesSQL = "where call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')";
-		}
-	$regexLOGadmin_viewable_call_times = " $LOGadmin_viewable_call_times ";
-
-	$UUgroups_list='';
-	if ($admin_viewable_groupsALL > 0)
-		{$UUgroups_list .= "\n";}
-	$stmt="SELECT user_group,group_name from vicidial_user_groups $whereLOGadmin_viewable_groupsSQL order by user_group;";
-	$rslt=mysql_query($stmt, $link);
-	$UUgroups_to_print = mysql_num_rows($rslt);
-	$o=0;
-	while ($UUgroups_to_print > $o) 
-		{
-		$rowx=mysql_fetch_row($rslt);
-		$UUgroups_list .= "\n";
-		$o++;
-		}
-
-	if ($SSwebroot_writable > 0)
-		{
-		fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfull_name|\n");
-		fclose($fp);
-		}
-
-	$first_login_link=0;
-
-	if ($LOGforce_change_password=='Y')
-		{
-		$ADD=999997;
-		$reports_only_user=1;
-		}
-	if ($SSfirst_login_trigger=='Y')
-		{
-		
-		if ($ADD==999996)
-			{$reports_only_user=1;}
-		else
-			{
-			$ADD=999995;
-			$first_login_link=1;
-			}
-		}
-	if ($ADD==999995)
-		{
-		$reports_only_user=1;
-		}
-
-	if (($LOGuser_level < 9) and ($SSlevel_8_disable_add > 0))
-		{$add_copy_disabled++;}
-	}
-else
-	{
-	if ($SSwebroot_writable > 0)
-		{
-		fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
-		fclose($fp);
-		}
-	}
-
 
 ######################################################################################################
 ######################################################################################################
@@ -14295,6 +14347,9 @@ if ($ADD==21111111111)
 							$stmtA="UPDATE servers SET rebuild_conf_files='Y' where generate_vicidial_conf='Y' and active_asterisk_server='Y' and server_ip='$server_ip';";
 							$rslt=mysql_query($stmtA, $link);
 
+							$stmtB="UPDATE servers SET rebuild_conf_files='Y' where generate_vicidial_conf='Y' and active_asterisk_server='Y' and server_ip='$SSactive_voicemail_server';";
+							$rslt=mysql_query($stmtB, $link);
+
 							### LOG INSERTION Admin Log Table ###
 							$SQL_log = "$stmt|";
 							$SQL_log = preg_replace('/;/', '', $SQL_log);
@@ -18027,6 +18082,9 @@ if ($ADD==41111111111)
 				$stmtA="UPDATE servers SET rebuild_conf_files='Y' where generate_vicidial_conf='Y' and active_asterisk_server='Y' and server_ip='$server_ip';";
 				$rslt=mysql_query($stmtA, $link);
 
+				$stmtB="UPDATE servers SET rebuild_conf_files='Y' where generate_vicidial_conf='Y' and active_asterisk_server='Y' and server_ip='$SSactive_voicemail_server';";
+				$rslt=mysql_query($stmtB, $link);
+
 				### LOG INSERTION Admin Log Table ###
 				$SQL_log = "$stmt|";
 				$SQL_log = preg_replace('/;/', '', $SQL_log);
@@ -20911,6 +20969,9 @@ if ($ADD==61111111111)
 		$stmtA="UPDATE servers SET rebuild_conf_files='Y' where generate_vicidial_conf='Y' and active_asterisk_server='Y' and server_ip='$server_ip';";
 		$rslt=mysql_query($stmtA, $link);
 
+		$stmtB="UPDATE servers SET rebuild_conf_files='Y' where generate_vicidial_conf='Y' and active_asterisk_server='Y' and server_ip='$SSactive_voicemail_server';";
+		$rslt=mysql_query($stmtB, $link);
+
 		### LOG INSERTION Admin Log Table ###
 		$SQL_log = "$stmt|";
 		$SQL_log = preg_replace('/;/', '', $SQL_log);
@@ -36100,11 +36161,16 @@ if ($ADD==999994)
 		{
 		echo "
    \n";
 		echo "
  • Welcome Languages Page\n";
-		echo "
  • Campaign Debug Page\n";
 		echo "
  • Servers Versions\n";
+		echo "

    \n";
+		echo "
  • Campaign Debug Page\n";
 		echo "
  • Carrier Log Report\n";
 		echo "
  • Hangup Cause Report\n";
+		echo "
  • URL Log Report\n";
+		echo "
  • Agent LAGGED Report\n";
+		echo "
  • User Group Login Report\n";
 		echo "
  • Admin Report Log Viewer\n";
+		echo "

    \n";
 		echo "
  • Bulk Phone Insert Page\n";
 		echo "
  • Basic Lead Management Tools\n";
 		echo "
  • Callbacks Transferral Page\n";
diff --git a/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php b/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php
index c6094b82..278f111a 100644
--- a/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php
+++ b/agc_2-X/trunk/www/vicidial/admin_campaign_multi_alt.php
@@ -14,13 +14,14 @@
 # 110406-1818 - Updated logging
 # 120223-2335 - Removed logging of good login passwords if webroot writable is enabled
 # 130610-1116 - Finalized changing of all ereg instances to preg
+# 130621-2009 - Added filtering of input to prevent SQL injection attacks and new user auth
 #
 
-$admin_version = '2.8-4';
-$build = '130610-1116';
-
+$admin_version = '2.8-5';
+$build = '130621-2009';
 
 require("dbconnect.php");
+require("functions.php");
 
 $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
 $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -38,13 +39,11 @@ if (isset($_GET["lead_order_secondary"]))			{$lead_order_secondary=$_GET["lead_o
 if (isset($_GET["SUBMIT"]))						{$SUBMIT=$_GET["SUBMIT"];}
 	elseif (isset($_POST["SUBMIT"]))			{$SUBMIT=$_POST["SUBMIT"];}
 
-
 if (strlen($action) < 2)
 	{$action = 'BLANK';}
 if (strlen($DB) < 1)
 	{$DB=0;}
 
-
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,webroot_writable FROM system_settings;";
@@ -77,13 +76,45 @@ else
 $STARTtime = date("U");
 $TODAY = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
+$date = date("r");
+$ip = getenv("REMOTE_ADDR");
+$browser = getenv("HTTP_USER_AGENT");
+$user = $PHP_AUTH_USER;
 
+$auth=0;
+$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
+if ($auth_message == 'GOOD')
+	{$auth=1;}
 
-$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and modify_campaigns='1';";
-if ($DB) {echo "|$stmt|\n";}
+if ($auth < 1)
+	{
+	$VDdisplayMESSAGE = "Login incorrect, please try again";
+	if ($auth_message == 'LOCK')
+		{
+		$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
+		Header ("Content-type: text/html; charset=utf-8");
+		echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
+		exit;
+		}
+	Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
+	Header("HTTP/1.0 401 Unauthorized");
+	echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
+	exit;
+	}
+
+$stmt="SELECT full_name,modify_campaigns,user_level from vicidial_users where user='$PHP_AUTH_USER';";
 $rslt=mysql_query($stmt, $link);
 $row=mysql_fetch_row($rslt);
-$auth=$row[0];
+$LOGfullname =				$row[0];
+$LOGmodify_campaigns =		$row[1];
+$LOGuser_level =			$row[2];
+
+if ($LOGmodify_campaigns < 1)
+	{
+	Header ("Content-type: text/html; charset=utf-8");
+	echo "You do not have permissions to modify campaigns\n";
+	exit;
+	}
 
 $stmt="SELECT count(*) from vicidial_campaigns where campaign_id='$campaign_id' and auto_alt_dial='MULTI_LEAD';";
 if ($DB) {echo "|$stmt|\n";}
@@ -91,50 +122,6 @@ $rslt=mysql_query($stmt, $link);
 $row=mysql_fetch_row($rslt);
 $camp_multi=$row[0];
 
-if ($webroot_writable > 0)
-	{$fp = fopen ("./project_auth_entries.txt", "a");}
-
-$date = date("r");
-$ip = getenv("REMOTE_ADDR");
-$browser = getenv("HTTP_USER_AGENT");
-$user = $PHP_AUTH_USER;
-
-if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
-	{
-    Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
-    Header("HTTP/1.0 401 Unauthorized");
-    echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
-    exit;
-	}
-else
-	{
-	if ($auth>0)
-		{
-		$office_no=strtoupper($PHP_AUTH_USER);
-		$password=strtoupper($PHP_AUTH_PW);
-		$stmt="SELECT full_name,modify_campaigns,user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
-		$rslt=mysql_query($stmt, $link);
-		$row=mysql_fetch_row($rslt);
-		$LOGfullname =				$row[0];
-		$LOGmodify_campaigns =		$row[1];
-		$LOGuser_level =			$row[2];
-
-		if ($webroot_writable > 0)
-			{
-			fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
-			fclose($fp);
-			}
-		}
-	else
-		{
-		if ($webroot_writable > 0)
-			{
-			fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
-			fclose($fp);
-			}
-		}
-	}
-
 ?>
 
 
@@ -167,11 +154,6 @@ $subcamp_color =	'#C6C6C6';
 
 require("admin_header.php");
 
-if ( ($LOGast_admin_access < 1) or ($LOGuser_level < 8) )
-	{
-	echo "You are not authorized to view this section\n";
-	exit;
-	}
 if ($camp_multi < 1)
 	{
 	echo "This campaign is not set to Auto-Alt-Dial MULTI_LEAD\n";
diff --git a/agc_2-X/trunk/www/vicidial/admin_email_accounts.php b/agc_2-X/trunk/www/vicidial/admin_email_accounts.php
index 0729e97f..9a4e6d12 100644
--- a/agc_2-X/trunk/www/vicidial/admin_email_accounts.php
+++ b/agc_2-X/trunk/www/vicidial/admin_email_accounts.php
@@ -10,14 +10,16 @@
 # 130102-1131 - Small admin log change
 # 130221-1754 - Added level 8 disable add feature
 # 130610-1041 - Changed all ereg to preg
+# 130621-2001 - Added filtering of input to prevent SQL injection attacks and new user auth
 #
 
-$admin_version = '2.8-4';
-$build = '130610-1041';
+$admin_version = '2.8-5';
+$build = '130621-2001';
 
 $sh="emails"; 
 
 require("dbconnect.php");
+require("functions.php");
 
 $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
 $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -135,138 +137,125 @@ if ($non_latin < 1)
 	$email_account_server = preg_replace("/[^\.\-\_0-9a-zA-Z]/","",$email_account_server);
 	$active = preg_replace("/[^_0-9a-zA-Z]/","",$active);
 	$email_frequency_check_mins = preg_replace("/[^0-9]/","",$email_frequency_check_mins);
-	$list_id = preg_replace("/[^0-9]/","",$list_id);
-
 	}	# end of non_latin
 else
 	{
 	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
 	$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
 	}
+$list_id = preg_replace("/[^0-9]/","",$list_id);
 
 $STARTtime = date("U");
 $TODAY = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
-$add_copy_disabled=0;
-
-$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and modify_email_accounts='1';";
-if ($DB) {echo "|$stmt|\n";}
-$rslt=mysql_query($stmt, $link);
-$row=mysql_fetch_row($rslt);
-$auth=$row[0];
-
-if ($webroot_writable > 0)
-	{$fp = fopen ("./project_auth_entries.txt", "a");}
-
 $date = date("r");
 $ip = getenv("REMOTE_ADDR");
 $browser = getenv("HTTP_USER_AGENT");
 $user = $PHP_AUTH_USER;
+$add_copy_disabled=0;
 
-if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
+$auth=0;
+$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
+if ($auth_message == 'GOOD')
+	{$auth=1;}
+
+if ($auth < 1)
 	{
-    Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
-    Header("HTTP/1.0 401 Unauthorized");
-    echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
-    exit;
+	$VDdisplayMESSAGE = "Login incorrect, please try again";
+	if ($auth_message == 'LOCK')
+		{
+		$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
+		Header ("Content-type: text/html; charset=utf-8");
+		echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
+		exit;
+		}
+	Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
+	Header("HTTP/1.0 401 Unauthorized");
+	echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
+	exit;
 	}
-else
+
+$stmt="SELECT full_name,user_level,user_group,modify_email_accounts from vicidial_users where user='$PHP_AUTH_USER';";
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGfullname =				$row[0];
+$LOGuser_level =			$row[1];
+$LOGuser_group =			$row[2];
+$LOGemails_modify =			$row[3];
+
+if ($LOGemails_modify < 1)
 	{
-	if ($auth>0)
-		{
-		$office_no=strtoupper($PHP_AUTH_USER);
-		$password=strtoupper($PHP_AUTH_PW);
-		$stmt="SELECT full_name,user_level,user_group,modify_email_accounts from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
-		$rslt=mysql_query($stmt, $link);
-		$row=mysql_fetch_row($rslt);
-		$LOGfullname =				$row[0];
-		$LOGuser_level =			$row[1];
-		$LOGuser_group =			$row[2];
-		$LOGemails_modify =			$row[3];
-
-		if (($LOGuser_level < 9) and ($SSlevel_8_disable_add > 0))
-			{$add_copy_disabled++;}
-
-		$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
-		$rslt=mysql_query($stmt, $link);
-		$row=mysql_fetch_row($rslt);
-		$LOGallowed_campaigns =			$row[0];
-		$LOGallowed_reports =			$row[1];
-		$LOGadmin_viewable_groups =		$row[2];
-		$LOGadmin_viewable_call_times =	$row[3];
-		$admin_viewable_groupsALL=0;
-		$LOGadmin_viewable_groupsSQL='';
-		$whereLOGadmin_viewable_groupsSQL='';
-		$valLOGadmin_viewable_groupsSQL='';
-		$vmLOGadmin_viewable_groupsSQL='';
-		if ( (!preg_match("/\-\-ALL\-\-/i",$LOGadmin_viewable_groups)) and (strlen($LOGadmin_viewable_groups) > 3) )
-			{
-			$rawLOGadmin_viewable_groupsSQL = preg_replace("/ -/",'',$LOGadmin_viewable_groups);
-			$rawLOGadmin_viewable_groupsSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_groupsSQL);
-			$LOGadmin_viewable_groupsSQL = "and user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
-			$whereLOGadmin_viewable_groupsSQL = "where user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
-			$valLOGadmin_viewable_groupsSQL = "and val.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
-			$vmLOGadmin_viewable_groupsSQL = "and vm.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
-			}
-		else 
-			{$admin_viewable_groupsALL=1;}
-		$regexLOGadmin_viewable_groups = " $LOGadmin_viewable_groups ";
-		
-		$UUgroups_list='';
-		if ($admin_viewable_groupsALL > 0)
-			{$UUgroups_list .= "\n";}
-		$stmt="SELECT user_group,group_name from vicidial_user_groups $whereLOGadmin_viewable_groupsSQL order by user_group;";
-		$rslt=mysql_query($stmt, $link);
-		$UUgroups_to_print = mysql_num_rows($rslt);
-		$o=0;
-		while ($UUgroups_to_print > $o) 
-			{
-			$rowx=mysql_fetch_row($rslt);
-			$UUgroups_list .= "\n";
-			$o++;
-			}
-
-		$stmt="SELECT group_id,group_name from vicidial_inbound_groups where group_handling='EMAIL' $LOGadmin_viewable_groupsSQL order by group_id;";
-	#	$stmt="SELECT group_id,group_name from vicidial_inbound_groups where group_id NOT IN('AGENTDIRECT') order by group_id";
-		$rslt=mysql_query($stmt, $link);
-		$Dgroups_to_print = mysql_num_rows($rslt);
-		$Dgroups_menu='';
-		$Dgroups_selected=0;
-		$o=0;
-		while ($Dgroups_to_print > $o) 
-			{
-			$rowx=mysql_fetch_row($rslt);
-			$Dgroups_menu .= "\n";
-			$o++;
-			}
-		if ($Dgroups_selected < 1) 
-			{$Dgroups_menu .= "\n";}
-		else 
-			{$Dgroups_menu .= "\n";}
-
-
-		if ($webroot_writable > 0)
-			{
-			fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n");
-			fclose($fp);
-			}
-		}
-	else
-		{
-		if ($webroot_writable > 0)
-			{
-			fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n");
-			fclose($fp);
-			}
-		}
+	Header ("Content-type: text/html; charset=utf-8");
+	echo "You do not have permissions to modify email accounts\n";
+	exit;
 	}
 
+if (($LOGuser_level < 9) and ($SSlevel_8_disable_add > 0))
+	{$add_copy_disabled++;}
+
+$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGallowed_campaigns =			$row[0];
+$LOGallowed_reports =			$row[1];
+$LOGadmin_viewable_groups =		$row[2];
+$LOGadmin_viewable_call_times =	$row[3];
+$admin_viewable_groupsALL=0;
+$LOGadmin_viewable_groupsSQL='';
+$whereLOGadmin_viewable_groupsSQL='';
+$valLOGadmin_viewable_groupsSQL='';
+$vmLOGadmin_viewable_groupsSQL='';
+if ( (!preg_match("/\-\-ALL\-\-/i",$LOGadmin_viewable_groups)) and (strlen($LOGadmin_viewable_groups) > 3) )
+	{
+	$rawLOGadmin_viewable_groupsSQL = preg_replace("/ -/",'',$LOGadmin_viewable_groups);
+	$rawLOGadmin_viewable_groupsSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_groupsSQL);
+	$LOGadmin_viewable_groupsSQL = "and user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
+	$whereLOGadmin_viewable_groupsSQL = "where user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
+	$valLOGadmin_viewable_groupsSQL = "and val.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
+	$vmLOGadmin_viewable_groupsSQL = "and vm.user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')";
+	}
+else 
+	{$admin_viewable_groupsALL=1;}
+$regexLOGadmin_viewable_groups = " $LOGadmin_viewable_groups ";
+
+$UUgroups_list='';
+if ($admin_viewable_groupsALL > 0)
+	{$UUgroups_list .= "\n";}
+$stmt="SELECT user_group,group_name from vicidial_user_groups $whereLOGadmin_viewable_groupsSQL order by user_group;";
+$rslt=mysql_query($stmt, $link);
+$UUgroups_to_print = mysql_num_rows($rslt);
+$o=0;
+while ($UUgroups_to_print > $o) 
+	{
+	$rowx=mysql_fetch_row($rslt);
+	$UUgroups_list .= "\n";
+	$o++;
+	}
+
+$stmt="SELECT group_id,group_name from vicidial_inbound_groups where group_handling='EMAIL' $LOGadmin_viewable_groupsSQL order by group_id;";
+#	$stmt="SELECT group_id,group_name from vicidial_inbound_groups where group_id NOT IN('AGENTDIRECT') order by group_id";
+$rslt=mysql_query($stmt, $link);
+$Dgroups_to_print = mysql_num_rows($rslt);
+$Dgroups_menu='';
+$Dgroups_selected=0;
+$o=0;
+while ($Dgroups_to_print > $o) 
+	{
+	$rowx=mysql_fetch_row($rslt);
+	$Dgroups_menu .= "\n";
+	$o++;
+	}
+if ($Dgroups_selected < 1) 
+	{$Dgroups_menu .= "\n";}
+else 
+	{$Dgroups_menu .= "\n";}
+
 ?>
 
 
@@ -298,12 +287,6 @@ $subcamp_color =	'#C6C6C6';
 
 require("admin_header.php");
 
-if ( ($LOGemails_modify < 1) or ($LOGuser_level < 8) )
-	{
-	echo "You are not authorized to view this section\n";
-	exit;
-	}
-
 if ($SSemail_enabled < 1)
 	{
 	echo "ERROR: Inbound emails are not active on this system\n";
diff --git a/agc_2-X/trunk/www/vicidial/admin_header.php b/agc_2-X/trunk/www/vicidial/admin_header.php
index 2d6d28c3..d4e0d726 100644
--- a/agc_2-X/trunk/www/vicidial/admin_header.php
+++ b/agc_2-X/trunk/www/vicidial/admin_header.php
@@ -42,6 +42,7 @@
 # 121214-2238 - Added email menus
 # 130221-1830 - Added Level 8 disable add option
 # 130610-1040 - Finalized changing of all ereg instances to preg
+# 130615-2314 - Changed Reports only and QC only headers
 #
 
 
@@ -51,8 +52,10 @@ if($short_header)
 	?>
 	
-	
+	
@@ -63,13 +66,26 @@ if($short_header)
 	
+	
-	
-	
-	
+		{ 
+		?>
+		
+		 0)
+			{
+			?>
+			
+			
    
 	System logo   
 	   Users   
 	   Campaigns   
            User Groups   
 	   Remote Agents   
 	   Admin      Reports   
 	        Reports           Reports   
 	
    
 	
    
 	
 ADMINISTRATION
    
 	
-	
+	
+		 0)
+			{
+			?>
+			
+			
+			
-	
-	
    
 	
 	
     WIDTH=160>
 	 SIZE=>Users
@@ -1482,13 +1500,31 @@ $SSlevel_8_disable_add =	$row[5];
 
 		
+		
+		
    >
+		 SIZE=> Reports 
+		
    >
+			 SIZE=> Reports 
+			
    >
-	 SIZE=> Reports 
-	
    
 	
      
BGCOLOR=#D9E6FE> diff --git a/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php b/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php index e93b42e4..03cce384 100644 --- a/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php +++ b/agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php @@ -1,5 +1,5 @@ LICENSE: AGPLv2 @@ -49,14 +49,14 @@ # 120529-1348 - Filename filter fix # 130420-2056 - Added NANPA prefix validation and timezone options # 130610-0920 - Finalized changing of all ereg instances to preg +# 130621-1817 - Added filtering of input to prevent SQL injection attacks and new user auth # -$version = '2.6-47'; -$build = '130420-2056'; - +$version = '2.8-48'; +$build = '130621-1817'; require("dbconnect.php"); - +require("functions.php"); $US='_'; @@ -181,74 +181,54 @@ if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - $list_id_override = preg_replace('/[^0-9]/','',$list_id_override); } else { $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); } +$list_id_override = preg_replace('/[^0-9]/','',$list_id_override); $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $FILE_datetime = $STARTtime; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;"; -if ($DB) {echo "|$stmt|\n";} -if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -if ($webroot_writable > 0) {$fp = fopen ("./project_auth_entries.txt", "a");} $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) - { - Header("WWW-Authenticate: Basic realm=\"VICIDIAL-LEAD-LOADER\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } -else - { - header ("Content-type: text/html; charset=utf-8"); - header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 - header ("Pragma: no-cache"); // HTTP/1.0 +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} - if($auth>0) +if ($auth < 1) + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT load_leads,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGload_leads = $row[0]; - $LOGuser_group = $row[1]; - - if ($LOGload_leads < 1) - { - echo "You do not have permissions to load leads\n"; - exit; - } - if ($webroot_writable > 0) - { - fwrite ($fp, "LIST_LOAD|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($webroot_writable > 0) - { - fwrite ($fp, "LIST_LOAD|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; exit; } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT load_leads,user_group from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGload_leads = $row[0]; +$LOGuser_group = $row[1]; + +if ($LOGload_leads < 1) + { + Header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions to load leads\n"; + exit; } if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig)) @@ -257,7 +237,6 @@ if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig)) exit; } - $stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_query($stmt, $link); diff --git a/agc_2-X/trunk/www/vicidial/admin_listloader_third_gen.php b/agc_2-X/trunk/www/vicidial/admin_listloader_third_gen.php index 01bb0589..ed2208be 100644 --- a/agc_2-X/trunk/www/vicidial/admin_listloader_third_gen.php +++ b/agc_2-X/trunk/www/vicidial/admin_listloader_third_gen.php @@ -2,7 +2,7 @@ # admin_listloader_third_gen.php - version 2.8 # (based upon - new_listloader_superL.php script) # -# Copyright (C) 2012 Matt Florell,Joe Johnson LICENSE: AGPLv2 +# Copyright (C) 2013 Matt Florell,Joe Johnson LICENSE: AGPLv2 # # ViciDial web-based lead loader from formatted file # @@ -47,14 +47,14 @@ # 120525-1037 - Added uploaded filename filtering # 120529-1347 - Filename filter fix # 130610-1055 - Finalized changing of all ereg instances to preg +# 130621-1815 - Added filtering of input to prevent SQL injection attacks and new user auth # -$version = '2.8-46'; -$build = '130610-1055'; - +$version = '2.8-47'; +$build = '130621-1815'; require("dbconnect.php"); - +require("functions.php"); $US='_'; @@ -177,74 +177,54 @@ if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - $list_id_override = preg_replace('/[^0-9]/','',$list_id_override); } else { $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); } +$list_id_override = preg_replace('/[^0-9]/','',$list_id_override); $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $FILE_datetime = $STARTtime; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;"; -if ($DB) {echo "|$stmt|\n";} -if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -if ($webroot_writable > 0) {$fp = fopen ("./project_auth_entries.txt", "a");} $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) - { - Header("WWW-Authenticate: Basic realm=\"VICIDIAL-LEAD-LOADER\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } -else - { - header ("Content-type: text/html; charset=utf-8"); - header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 - header ("Pragma: no-cache"); // HTTP/1.0 +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} - if($auth>0) +if ($auth < 1) + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT load_leads,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGload_leads = $row[0]; - $LOGuser_group = $row[1]; - - if ($LOGload_leads < 1) - { - echo "You do not have permissions to load leads\n"; - exit; - } - if ($webroot_writable > 0) - { - fwrite ($fp, "LIST_LOAD|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($webroot_writable > 0) - { - fwrite ($fp, "LIST_LOAD|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; exit; } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT load_leads,user_group from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGload_leads = $row[0]; +$LOGuser_group = $row[1]; + +if ($LOGload_leads < 1) + { + Header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions to load leads\n"; + exit; } if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig)) diff --git a/agc_2-X/trunk/www/vicidial/admin_lists_custom.php b/agc_2-X/trunk/www/vicidial/admin_lists_custom.php index 2dc33b2b..bc29441d 100644 --- a/agc_2-X/trunk/www/vicidial/admin_lists_custom.php +++ b/agc_2-X/trunk/www/vicidial/admin_lists_custom.php @@ -26,13 +26,14 @@ # 120907-1209 - Raised extended fields up to 99 # 130508-1020 - Added default field and length check validation, made errors appear in bold red text # 130606-0545 - Finalized changing of all ereg instances to preg +# 130621-1736 - Added filtering of input to prevent SQL injection attacks and new user auth # -$admin_version = '2.8-19'; -$build = '130606-0545'; - +$admin_version = '2.8-20'; +$build = '130621-1736'; require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -90,8 +91,7 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysql_num_rows($rslt); -$i=0; -while ($i < $qm_conf_ct) +if ($qm_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; @@ -99,12 +99,10 @@ while ($i < $qm_conf_ct) $SSoutbound_autodial_active = $row[2]; $user_territories_active = $row[3]; $SScustom_fields_enabled = $row[4]; - $i++; } ##### END SETTINGS LOOKUP ##### ########################################### - if ( (strlen($action) < 2) and ($list_id > 99) ) {$action = 'MODIFY_CUSTOM_FIELDS';} if (strlen($action) < 2) @@ -118,7 +116,6 @@ if ( (strlen($field_size) < 1) or ($field_size < 1) ) if ( (strlen($field_max) < 1) or ($field_max < 1) ) {$field_max = 1;} - if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); @@ -156,6 +153,10 @@ else $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); +$date = date("r"); +$ip = getenv("REMOTE_ADDR"); +$browser = getenv("HTTP_USER_AGENT"); +$user = $PHP_AUTH_USER; if (file_exists('options.php')) {require('options.php');} @@ -170,57 +171,48 @@ if ($extended_vl_fields > 0) $mysql_reserved_words = '|accessible|action|add|all|alter|analyze|and|as|asc|asensitive|before|between|bigint|binary|bit|blob|both|by|call|cascade|case|change|char|character|check|collate|column|condition|constraint|continue|convert|create|cross|current_date|current_time|current_timestamp|current_user|cursor|database|databases|date|day_hour|day_microsecond|day_minute|day_second|dec|decimal|declare|default|delayed|delete|desc|describe|deterministic|distinct|distinctrow|div|double|drop|dual|each|else|elseif|enclosed|enum|escaped|exists|exit|explain|false|fetch|float|float4|float8|for|force|foreign|from|fulltext|grant|group|having|high_priority|hour_microsecond|hour_minute|hour_second|if|ignore|in|index|infile|inner|inout|insensitive|insert|int|int1|int2|int3|int4|int8|integer|interval|into|is|iterate|join|key|keys|kill|leading|leave|left|like|limit|linear|lines|load|localtime|localtimestamp|lock|long|longblob|longtext|loop|low_priority|master_ssl_verify_server_cert|match|mediumblob|mediumint|mediumtext|middleint|minute_microsecond|minute_second|mod|modifies|mysql|natural|no|no_write_to_binlog|not|null|numeric|on|optimize|option|optionally|or|order|out|outer|outfile|precision|primary|procedure|purge|range|read|read_only|read_write|reads|real|references|regexp|release|remove|rename|repeat|replace|require|restrict|return|revoke|right|rlike|schema|schemas|second_microsecond|select|sensitive|separator|set|show|smallint|spatial|specific|sql|sql_big_result|sql_calc_found_rows|sql_small_result|sqlexception|sqlstate|sqlwarning|ssl|starting|straight_join|table|terminated|text|then|time|timestamp|tinyblob|tinyint|tinytext|to|trailing|trigger|true|undo|union|unique|unlock|unsigned|update|usage|use|using|utc_date|utc_time|utc_timestamp|values|varbinary|varchar|varcharacter|varying|when|where|while|with|write|xor|year_month|zerofill|'; +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and modify_leads='1';"; +if ($auth < 1) + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$rights_stmt = "SELECT modify_leads from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} +$rights_rslt=mysql_query($rights_stmt, $link); +$rights_row=mysql_fetch_row($rights_rslt); +$modify_leads = $rights_row[0]; + +# check their permissions +if ( $modify_leads < 1 ) + { + header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions to modify leads\n"; + exit; + } + +$stmt="SELECT full_name,modify_leads,custom_fields_modify,user_level from vicidial_users where user='$PHP_AUTH_USER';"; $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); -$auth=$row[0]; - -if ($webroot_writable > 0) - {$fp = fopen ("./project_auth_entries.txt", "a");} - -$date = date("r"); -$ip = getenv("REMOTE_ADDR"); -$browser = getenv("HTTP_USER_AGENT"); -$user = $PHP_AUTH_USER; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) - { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } -else - { - if ($auth>0) - { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT full_name,modify_leads,custom_fields_modify,user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname = $row[0]; - $LOGmodify_leads = $row[1]; - $LOGcustom_fields_modify = $row[2]; - $LOGuser_level = $row[3]; - - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } - } - } +$LOGfullname = $row[0]; +$LOGmodify_leads = $row[1]; +$LOGcustom_fields_modify = $row[2]; +$LOGuser_level = $row[3]; ?> diff --git a/agc_2-X/trunk/www/vicidial/admin_modify_lead.php b/agc_2-X/trunk/www/vicidial/admin_modify_lead.php index 5146f787..8661a168 100644 --- a/agc_2-X/trunk/www/vicidial/admin_modify_lead.php +++ b/agc_2-X/trunk/www/vicidial/admin_modify_lead.php @@ -53,9 +53,11 @@ # 121222-2145 - Added email log # 130123-1940 - Added options.php option to allow display of non-selectable statuses # 130610-1049 - Finalized changing of all ereg instances to preg +# 130621-1731 - Added filtering of input to prevent SQL injection attacks and new user auth # require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -163,12 +165,12 @@ if (isset($_POST["appointment_time"])) {$appointment_time=$_POST["appointment_ if (isset($_GET["CBstatus"])) {$CBstatus=$_GET["CBstatus"];} elseif (isset($_POST["CBstatus"])) {$CBstatus=$_POST["CBstatus"];} -$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); - $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); +$date = date("r"); +$ip = getenv("REMOTE_ADDR"); +$browser = getenv("HTTP_USER_AGENT"); $nonselectable_statuses=0; if (file_exists('options.php')) @@ -214,56 +216,50 @@ else if (strlen($phone_number)<6) {$phone_number=$old_phone;} -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and modify_leads='1';"; +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$rights_stmt = "SELECT modify_leads from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} -if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} +$rights_rslt=mysql_query($rights_stmt, $link); +$rights_row=mysql_fetch_row($rights_rslt); +$modify_leads = $rights_row[0]; + +# check their permissions +if ( $modify_leads < 1 ) + { + header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions to modify leads\n"; + exit; + } + +$stmt="SELECT full_name,modify_leads,admin_hide_lead_data,admin_hide_phone_data,user_group,user_level from vicidial_users where user='$PHP_AUTH_USER';"; $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); -$auth=$row[0]; - -if ($webroot_writable > 0) - {$fp = fopen ("./project_auth_entries.txt", "a");} - -$date = date("r"); -$ip = getenv("REMOTE_ADDR"); -$browser = getenv("HTTP_USER_AGENT"); - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) - { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } -else - { - if($auth>0) - { - $stmt="SELECT full_name,modify_leads,admin_hide_lead_data,admin_hide_phone_data,user_group,user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname = $row[0]; - $LOGmodify_leads = $row[1]; - $LOGadmin_hide_lead_data = $row[2]; - $LOGadmin_hide_phone_data = $row[3]; - $LOGuser_group = $row[4]; - $LOGuser_level = $row[5]; - - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } - } - } +$LOGfullname = $row[0]; +$LOGmodify_leads = $row[1]; +$LOGadmin_hide_lead_data = $row[2]; +$LOGadmin_hide_phone_data = $row[3]; +$LOGuser_group = $row[4]; +$LOGuser_level = $row[5]; $LOGallowed_listsSQL=''; $stmt="SELECT allowed_campaigns from vicidial_user_groups where user_group='$LOGuser_group';"; @@ -1457,7 +1453,7 @@ else echo "


\n"; - $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 9 and modify_leads='1';"; + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level >= 9 and modify_leads='1';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); diff --git a/agc_2-X/trunk/www/vicidial/admin_phones_bulk_insert.php b/agc_2-X/trunk/www/vicidial/admin_phones_bulk_insert.php index 293304dc..a9b7f166 100644 --- a/agc_2-X/trunk/www/vicidial/admin_phones_bulk_insert.php +++ b/agc_2-X/trunk/www/vicidial/admin_phones_bulk_insert.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2013 Matt Florell LICENSE: AGPLv2 # # this screen will insert phones into your multi-server system with aliases # @@ -13,13 +13,14 @@ # 120223-2249 - Removed logging of good login passwords if webroot writable is enabled # 120820-1026 - Added webphone option Y_API_LAUNCH # 130610-1043 - Changed all ereg to preg +# 130621-1724 - Added filtering of input to prevent SQL injection attacks and new user auth # -$admin_version = '2.8-7'; -$build = '130610-1043'; - +$admin_version = '2.8-8'; +$build = '130621-1724'; require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -57,12 +58,32 @@ if (isset($_GET["use_external_server_ip"])) {$use_external_server_ip=$_GET["us if (isset($_GET["phone_context"])) {$phone_context=$_GET["phone_context"];} elseif (isset($_POST["phone_context"])) {$phone_context=$_POST["phone_context"];} - if (strlen($action) < 2) {$action = 'BLANK';} if (strlen($DB) < 1) {$DB=0;} +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$stmt = "SELECT use_non_latin,webroot_writable FROM system_settings;"; +$rslt=mysql_query($stmt, $link); +if ($DB) {echo "$stmt\n";} +$ss_conf_ct = mysql_num_rows($rslt); +if ($ss_conf_ct > 0) + { + $row=mysql_fetch_row($rslt); + $non_latin = $row[0]; + $webroot_writable = $row[1]; + } +##### END SETTINGS LOOKUP ##### +########################################### + +$STARTtime = date("U"); +$TODAY = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$date = date("r"); +$ip = getenv("REMOTE_ADDR"); +$browser = getenv("HTTP_USER_AGENT"); if ($non_latin < 1) { @@ -90,77 +111,51 @@ else $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); } -$STARTtime = date("U"); -$TODAY = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); - -############################################# -##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable FROM system_settings;"; -$rslt=mysql_query($stmt, $link); -if ($DB) {echo "$stmt\n";} -$ss_conf_ct = mysql_num_rows($rslt); -if ($ss_conf_ct > 0) - { - $row=mysql_fetch_row($rslt); - $non_latin = $row[0]; - $webroot_writable = $row[1]; - } -##### END SETTINGS LOOKUP ##### -########################################### - - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and ast_delete_phones='1';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -if ($webroot_writable > 0) - {$fp = fopen ("./project_auth_entries.txt", "a");} - -$date = date("r"); -$ip = getenv("REMOTE_ADDR"); -$browser = getenv("HTTP_USER_AGENT"); $user = $PHP_AUTH_USER; -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) - { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } -else - { - if ($auth>0) - { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT full_name,ast_delete_phones,ast_admin_access,user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname = $row[0]; - $LOGast_delete_phones = $row[1]; - $LOGast_admin_access = $row[2]; - $LOGuser_level = $row[3]; +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else +if ($auth < 1) + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') { - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } +$rights_stmt = "SELECT ast_delete_phones from vicidial_users where user='$PHP_AUTH_USER';"; +if ($DB) {echo "|$stmt|\n";} +$rights_rslt=mysql_query($rights_stmt, $link); +$rights_row=mysql_fetch_row($rights_rslt); +$ast_delete_phones = $rights_row[0]; + +# check their permissions +if ( $ast_delete_phones < 1 ) + { + header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions to manage phones\n"; + exit; + } + +$stmt="SELECT full_name,ast_delete_phones,ast_admin_access,user_level from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGfullname = $row[0]; +$LOGast_delete_phones = $row[1]; +$LOGast_admin_access = $row[2]; +$LOGuser_level = $row[3]; + ?> diff --git a/agc_2-X/trunk/www/vicidial/admin_search_lead.php b/agc_2-X/trunk/www/vicidial/admin_search_lead.php index def0318a..6a26d6ec 100644 --- a/agc_2-X/trunk/www/vicidial/admin_search_lead.php +++ b/agc_2-X/trunk/www/vicidial/admin_search_lead.php @@ -31,9 +31,11 @@ # 120409-1131 - Added option for log searches done through slave DB server # 121025-1732 - Added owner field search option # 130610-1054 - Finalized changing of all ereg instances to preg +# 130621-1714 - Added filtering of input to prevent SQL injection attacks and new user auth # require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -75,8 +77,7 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysql_num_rows($rslt); -$i=0; -while ($i < $qm_conf_ct) +if ($qm_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; @@ -85,76 +86,78 @@ while ($i < $qm_conf_ct) $user_territories_active = $row[3]; $slave_db_server = $row[4]; $reports_use_slave_db = $row[5]; - $i++; } ##### END SETTINGS LOOKUP ##### ########################################### $report_name = 'Search Leads Logs'; -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); -$phone = preg_replace('/[^0-9]/','',$phone); -if (strlen($alt_phone_search) < 2) {$alt_phone_search='No';} +$vicidial_list_fields = 'lead_id,entry_date,modify_date,status,user,vendor_lead_code,source_id,list_id,gmt_offset_now,called_since_last_reset,phone_code,phone_number,title,first_name,middle_initial,last_name,address1,address2,address3,city,state,province,postal_code,country_code,gender,date_of_birth,alt_phone,email,security_phrase,comments,called_count,last_local_call_time,rank,owner'; $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); - -$vicidial_list_fields = 'lead_id,entry_date,modify_date,status,user,vendor_lead_code,source_id,list_id,gmt_offset_now,called_since_last_reset,phone_code,phone_number,title,first_name,middle_initial,last_name,address1,address2,address3,city,state,province,postal_code,country_code,gender,date_of_birth,alt_phone,email,security_phrase,comments,called_count,last_local_call_time,rank,owner'; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and modify_leads='1';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -if ($webroot_writable > 0) - {$fp = fopen ("./project_auth_entries.txt", "a");} - $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if (strlen($alt_phone_search) < 2) {$alt_phone_search='No';} + +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); } else { - if ($auth>0) - { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT full_name,modify_leads,admin_hide_lead_data,admin_hide_phone_data,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname = $row[0]; - $LOGmodify_leads = $row[1]; - $LOGadmin_hide_lead_data = $row[2]; - $LOGadmin_hide_phone_data = $row[3]; - $LOGuser_group = $row[4]; + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } +$phone = preg_replace('/[^0-9]/','',$phone); - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') { - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; exit; } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } +$rights_stmt = "SELECT modify_leads from vicidial_users where user='$PHP_AUTH_USER';"; +if ($DB) {echo "|$stmt|\n";} +$rights_rslt=mysql_query($rights_stmt, $link); +$rights_row=mysql_fetch_row($rights_rslt); +$modify_leads = $rights_row[0]; + +# check their permissions +if ( $modify_leads < 1 ) + { + header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions to search leads\n"; + exit; + } + +$stmt="SELECT full_name,modify_leads,admin_hide_lead_data,admin_hide_phone_data,user_group from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGfullname = $row[0]; +$LOGmodify_leads = $row[1]; +$LOGadmin_hide_lead_data = $row[2]; +$LOGadmin_hide_phone_data = $row[3]; +$LOGuser_group = $row[4]; $stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {echo "|$stmt|\n";} diff --git a/agc_2-X/trunk/www/vicidial/audio_store.php b/agc_2-X/trunk/www/vicidial/audio_store.php index bbe57f6b..250fb6da 100644 --- a/agc_2-X/trunk/www/vicidial/audio_store.php +++ b/agc_2-X/trunk/www/vicidial/audio_store.php @@ -17,14 +17,16 @@ # 121019-0816 - Added audio file delete process # 121129-1620 - Hide delete option text if not allowed # 130610-1052 - Finalized changing of all ereg instances to preg +# 130620-1729 - Added filtering of input to prevent SQL injection attacks and new user auth # -$version = '2.8-11'; -$build = '130610-1052'; +$version = '2.8-12'; +$build = '130620-1729'; $MT[0]=''; require("dbconnect.php"); +require("functions.php"); $server_name = getenv("SERVER_NAME"); $PHP_SELF=$_SERVER['PHP_SELF']; @@ -138,33 +140,64 @@ if ( (!preg_match("/\|$ip\|/", $server_ips)) and ($formIPvalid < 1) ) $user_set=1; $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; - $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); + if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } + else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } $delete_file = preg_replace('/[^-\._0-9a-zA-Z]/','',$delete_file); - $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and ( (modify_campaigns='1') or (modify_audiostore='1') )"; - if ($DB) {echo "|$stmt|\n";} - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $auth=$row[0]; + $auth=0; + $reports_auth=0; + $admin_auth=0; + $auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); + if ($auth_message == 'GOOD') + {$auth=1;} - $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 8 and ( (ast_admin_access='1') and (modify_audiostore='1') )"; + if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and( (modify_campaigns='1') or (modify_audiostore='1') );"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + if ($admin_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to upload audio files"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + } + else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 8 and ( (ast_admin_access='1') and (modify_audiostore='1') )"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $auth_delete=$row[0]; - - if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) - { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|\n"; - exit; - } } - - $delete_message=''; ### delete a file from the audio store if ( ($action == "DELETE") and ($auth_delete > 0) ) diff --git a/agc_2-X/trunk/www/vicidial/call_report_export.php b/agc_2-X/trunk/www/vicidial/call_report_export.php index e0c54495..84915885 100644 --- a/agc_2-X/trunk/www/vicidial/call_report_export.php +++ b/agc_2-X/trunk/www/vicidial/call_report_export.php @@ -35,11 +35,13 @@ # 111104-1240 - Added user_group restrictions for selecting in-groups # 130414-0122 - Added report logging # 130610-0952 - Finalized changing of all ereg instances to preg +# 130620-1725 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -102,29 +104,78 @@ if ($qm_conf_ct > 0) } ##### END SETTINGS LOOKUP ##### ########################################### - -$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and export_reports='1' and active='Y';"; -if ($DB) {echo "|$stmt|\n";} -if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$reports_only_user=$row[0]; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { -# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); -# Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password or no export report permission: |$PHP_AUTH_USER|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT export_reports,user_group from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGexport_reports = $row[0]; +$LOGuser_group = $row[1]; + +if ($LOGexport_reports < 1) + { + Header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions for export reports: |$PHP_AUTH_USER|\n"; + exit; } ##### BEGIN log visit to the vicidial_report_log table ##### @@ -156,12 +207,6 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ # echo "\n"; } -$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$LOGuser_group = $row[0]; - $stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_query($stmt, $link); @@ -173,7 +218,7 @@ $LOGadmin_viewable_call_times = $row[3]; if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; diff --git a/agc_2-X/trunk/www/vicidial/callbacks_bulk_change.php b/agc_2-X/trunk/www/vicidial/callbacks_bulk_change.php index 1263d9f0..a4091c00 100644 --- a/agc_2-X/trunk/www/vicidial/callbacks_bulk_change.php +++ b/agc_2-X/trunk/www/vicidial/callbacks_bulk_change.php @@ -7,11 +7,11 @@ # 120819-0119 - First build # 130414-0021 - Added admin logging # 130610-0951 - Finalized changing of all ereg instances to preg +# 130620-0902 - Added filtering of input to prevent SQL injection attacks and new user auth # -header ("Content-type: text/html; charset=utf-8"); - require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -39,80 +39,79 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active FROM sys $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysql_num_rows($rslt); -$i=0; -while ($i < $qm_conf_ct) +if ($qm_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; $SSoutbound_autodial_active = $row[2]; - $i++; } ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } $StarTtimE = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $ip = getenv("REMOTE_ADDR"); - -if (!isset($begin_date)) {$begin_date = $TODAY;} -if (!isset($end_date)) {$end_date = $TODAY;} - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';"; -if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$fp = fopen ("./project_auth_entries.txt", "a"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } -else - { - if($auth>0) + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') { - $stmt="SELECT full_name,change_agent_campaign,modify_timeclock_log,user_group,user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname = $row[0]; - $change_agent_campaign = $row[1]; - $modify_timeclock_log = $row[2]; - $LOGuser_group = $row[3]; - $user_level=$row[4]; - if ($user_level==9) - { - $ul_clause="where user_level<=9"; - } else { - $ul_clause="where user_level<$user_level"; - } - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; exit; } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT full_name,change_agent_campaign,modify_timeclock_log,user_group,user_level,modify_leads from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGfullname = $row[0]; +$change_agent_campaign = $row[1]; +$modify_timeclock_log = $row[2]; +$LOGuser_group = $row[3]; +$user_level = $row[4]; +$LOGmodify_leads = $row[5]; +if ($user_level==9) + { + $ul_clause="where user_level<=9"; + } +else + { + $ul_clause="where user_level<$user_level"; + } + +if ($LOGmodify_leads < 1) + { + Header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions to modify leads: |$PHP_AUTH_USER|\n"; + exit; } $stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; diff --git a/agc_2-X/trunk/www/vicidial/callcard_admin.php b/agc_2-X/trunk/www/vicidial/callcard_admin.php index 9fbca68b..96509da6 100644 --- a/agc_2-X/trunk/www/vicidial/callcard_admin.php +++ b/agc_2-X/trunk/www/vicidial/callcard_admin.php @@ -14,14 +14,16 @@ # 100823-1342 - Added Search option and display for level 7 users, added pin number search # 120117-1457 - Security fix, issue #544 # 130610-1103 - Finalized changing of all ereg instances to preg +# 130620-0839 - Added filtering of input to prevent SQL injection attacks and new user auth # -$version = '2.8-6'; -$build = '130610-1103'; +$version = '2.8-7'; +$build = '130620-0839'; $MT[0]=''; require("dbconnect.php"); +require("functions.php"); $PHP_SELF=$_SERVER['PHP_SELF']; if (isset($_GET["action"])) {$action=$_GET["action"];} @@ -73,11 +75,6 @@ if (isset($_GET["user"])) {$user=$_GET["user"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} - -header ("Content-type: text/html; charset=utf-8"); -header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 -header ("Pragma: no-cache"); // HTTP/1.0 - $report_name = 'CallCard Search'; $SEARCHONLY=0; @@ -110,7 +107,7 @@ if ($non_latin < 1) $action = preg_replace('/[^\_0-9a-zA-Z]/','',$action); $card_id = preg_replace('/[^-\_0-9]/','',$card_id); $run = preg_replace('/[^0-9]/','',$run); - $batch = preg_replace('/[^0-9]/','',$batch); + $batch = preg_replace('/[^0-9a-zA-Z]/','',$batch); $pack = preg_replace('/[^0-9]/','',$pack); $sequence = preg_replace('/[^0-9]/','',$sequence); $territory_description = preg_replace('/[^- \_\.\,0-9a-zA-Z]/','',$territory_description); @@ -130,57 +127,103 @@ else { $USER=$_SERVER['PHP_AUTH_USER']; $PASS=$_SERVER['PHP_AUTH_PW']; - $USER = preg_replace('/[^0-9a-zA-Z]/','',$USER); - $PASS = preg_replace('/[^0-9a-zA-Z]/','',$PASS); + } - $stmt="SELECT count(*) from vicidial_users where user='$USER' and pass='$PASS' and user_level > 7 and callcard_admin='1' and active='Y';"; +if ($non_latin < 1) + { + $USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $USER); + $PASS = preg_replace('/[^-_0-9a-zA-Z]/', '', $PASS); + } +else + { + $PASS = preg_replace("/'|\"|\\\\|;/","",$PASS); + $USER = preg_replace("/'|\"|\\\\|;/","",$USER); + } + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($USER,$PASS,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$USER' and user_level > 7 and view_reports > 0;"; if ($DB) {echo "|$stmt|\n";} - if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); - $auth=$row[0]; + $admin_auth=$row[0]; - if( (strlen($USER)<2) or (strlen($PASS)<2) or (!$auth)) + $stmt="SELECT count(*) from vicidial_users where user='$USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) { - $stmt="SELECT count(*) from vicidial_users where user='$USER' and pass='$PASS' and user_level > 6 and view_reports='1' and active='Y';"; - if ($DB) {echo "|$stmt|\n";} - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $authreport=$row[0]; + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$USER|$PASS|$auth_message|\n"; + exit; + } - if ($authreport > 0) - { - $stmt="SELECT full_name,user_group from vicidial_users where user='$USER' and pass='$PASS';"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname = $row[0]; - $LOGuser_group = $row[1]; +$stmt="SELECT callcard_admin,user_group,full_name from vicidial_users where user='$USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGcallcard_admin = $row[0]; +$LOGuser_group = $row[1]; +$LOGfullname = $row[2]; - $stmt="SELECT allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; - if ($DB) {echo "|$stmt|\n";} - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGallowed_reports = $row[0]; +if($reports_only_user > 0) + { + $stmt="SELECT allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $LOGallowed_reports = $row[0]; - if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) - { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; - exit; - } - else - { - $SEARCHONLY=1; - } - } - else - { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$USER|$PASS|\n"; - exit; - } + if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$USER|$report_name|\n"; + exit; + } + else + { + $SEARCHONLY=1; + } + } +else + { + if ($LOGcallcard_admin < 1) + { + Header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions for call card administration: |$USER|\n"; + exit; } } @@ -194,6 +237,10 @@ if (strlen($action) < 1) {$action = 'CALLCARD_SUMMARY';} +header ("Content-type: text/html; charset=utf-8"); +header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 +header ("Pragma: no-cache"); // HTTP/1.0 + ?> diff --git a/agc_2-X/trunk/www/vicidial/callcard_report_export.php b/agc_2-X/trunk/www/vicidial/callcard_report_export.php index f85c3d90..4c1a1587 100644 --- a/agc_2-X/trunk/www/vicidial/callcard_report_export.php +++ b/agc_2-X/trunk/www/vicidial/callcard_report_export.php @@ -11,9 +11,11 @@ # # 100312-2127 - First build # 130610-1125 - Finalized changing of all ereg instances to preg +# 130620-0835 - Added filtering of input to prevent SQL injection attacks and new user auth # require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -59,22 +61,78 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and callcard_admin='1';"; -if ($DB) {echo "|$stmt|\n";} -if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT callcard_admin,user_group from vicidial_users where user='$PHP_AUTH_USER';"; $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); -$auth=$row[0]; +$LOGcallcard_admin = $row[0]; +$LOGuser_group = $row[1]; -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($LOGcallcard_admin < 1) { -# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); -# Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password or no CallCard permission: |$PHP_AUTH_USER|\n"; - exit; + Header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions for call card administration: |$PHP_AUTH_USER|\n"; + exit; } diff --git a/agc_2-X/trunk/www/vicidial/campaign_debug.php b/agc_2-X/trunk/www/vicidial/campaign_debug.php index 835521ef..bd71f481 100644 --- a/agc_2-X/trunk/www/vicidial/campaign_debug.php +++ b/agc_2-X/trunk/www/vicidial/campaign_debug.php @@ -7,6 +7,7 @@ # 110514-1231 - First build # 130413-2342 - Added report logging # 130610-0949 - Finalized changing of all ereg instances to preg +# 130620-0829 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); @@ -14,6 +15,7 @@ $startMS = microtime(); $report_name='Campaign Debug'; require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -27,23 +29,98 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active FROM system_settings;"; +$rslt=mysql_query($stmt, $link); +if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysql_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysql_fetch_row($rslt); + $non_latin = $row[0]; + $webroot_writable = $row[1]; + $SSoutbound_autodial_active = $row[2]; + $user_territories_active = $row[3]; + } +##### END SETTINGS LOOKUP ##### +########################################### -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1' and modify_campaigns='1';"; -if ($DB) {echo "|$stmt|\n";} +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT modify_campaigns,user_group from vicidial_users where user='$PHP_AUTH_USER';"; $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); -$auth=$row[0]; +$LOGmodify_campaigns = $row[0]; +$LOGuser_group = $row[1]; -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($LOGmodify_campaigns < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + Header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions for campaign debugging: |$PHP_AUTH_USER|\n"; + exit; } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); $LOGbrowser = getenv("HTTP_USER_AGENT"); @@ -139,7 +216,6 @@ if (!$group) else { - $stmt="select count(*) from vicidial_hopper where campaign_id='" . mysql_real_escape_string($group) . "';"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} diff --git a/agc_2-X/trunk/www/vicidial/closer-fronter_popup.php b/agc_2-X/trunk/www/vicidial/closer-fronter_popup.php index 9ad74478..adc4d672 100644 --- a/agc_2-X/trunk/www/vicidial/closer-fronter_popup.php +++ b/agc_2-X/trunk/www/vicidial/closer-fronter_popup.php @@ -11,9 +11,11 @@ # 90508-0644 - Changed to PHP long tags # 120223-2124 - Removed logging of good login passwords if webroot writable is enabled # 130610-1115 - Finalized changing of all ereg instances to preg +# 130620-0824 - Added filtering of input to prevent SQL injection attacks and new user auth # require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -99,8 +101,33 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active FROM system_settings;"; +$rslt=mysql_query($stmt, $link); +if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysql_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysql_fetch_row($rslt); + $non_latin = $row[0]; + $webroot_writable = $row[1]; + $SSoutbound_autodial_active = $row[2]; + $user_territories_active = $row[3]; + } +##### END SETTINGS LOOKUP ##### +########################################### + +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } #$DB = '1'; # DEBUG override $US = '_'; @@ -110,67 +137,55 @@ $NOW_TIME = date("Y-m-d H:i:s"); $REC_TIME = date("Ymd-His"); $FILE_datetime = $STARTtime; $parked_time = $STARTtime; - -# $ext_context = 'default'; defined in dbconnect file - - $stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 0;"; - if ($DB) {echo "$stmt\n";} - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $auth=$row[0]; - -$fp = fopen ("./project_auth_entries.txt", "a"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); - if( (strlen($user)<2) or (strlen($pass)<2) or (!$auth)) +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) { - Header("WWW-Authenticate: Basic realm=\"VICIDIAL-CLOSER\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$user|$pass|\n"; - exit; + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } - else + +$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';"; +if ($DB) {echo "$stmt\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGfullname=$row[0]; +$fullname = $row[0]; + + +if ( (strlen($customer_zap_channel)>2) and (preg_match('/zap/i',$customer_zap_channel)) ) { + echo "\n\n"; + echo "\n\n"; - if($auth>0) - { - $office_no=strtoupper($user); - $password=strtoupper($pass); - $stmt="SELECT full_name from vicidial_users where user='$user' and pass='$pass'"; - if ($DB) {echo "$stmt\n";} - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname=$row[0]; - $fullname = $row[0]; - fwrite ($fp, "VD_CLOSER|GOOD|$date|$user|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - - if ( (strlen($customer_zap_channel)>2) and (preg_match('/zap/i',$customer_zap_channel)) ) - { - echo "\n\n"; - echo "\n\n"; - - } - else - { - echo "Bad channel: $customer_zap_channel\n"; - echo "Make sure the Zap channel is live and try again\n"; - exit; - } - - } - else - { - fwrite ($fp, "VD_CLOSER|FAIL|$date|$user|XXXX|$ip|$browser|\n"); - fclose($fp); - } + } +else + { + echo "Bad channel: $customer_zap_channel\n"; + echo "Make sure the Zap channel is live and try again\n"; + exit; } echo "\n"; echo "\n"; -echo "VICIDIAL FRONTER-CLOSER: Popup\n"; +echo "FRONTER-CLOSER: Popup\n"; echo "\n"; if (preg_match('/CL_UNIV/i',$channel_group)) diff --git a/agc_2-X/trunk/www/vicidial/closer-fronter_popup2.php b/agc_2-X/trunk/www/vicidial/closer-fronter_popup2.php index d4ebeea0..6e9b7454 100644 --- a/agc_2-X/trunk/www/vicidial/closer-fronter_popup2.php +++ b/agc_2-X/trunk/www/vicidial/closer-fronter_popup2.php @@ -11,9 +11,11 @@ # 90508-0644 - Changed to PHP long tags # 120223-2124 - Removed logging of good login passwords if webroot writable is enabled # 130610-1114 - Finalized changing of all ereg instances to preg +# 130620-0823 - Added filtering of input to prevent SQL injection attacks and new user auth # require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -99,8 +101,34 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); + +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active FROM system_settings;"; +$rslt=mysql_query($stmt, $link); +if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysql_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysql_fetch_row($rslt); + $non_latin = $row[0]; + $webroot_writable = $row[1]; + $SSoutbound_autodial_active = $row[2]; + $user_territories_active = $row[3]; + } +##### END SETTINGS LOOKUP ##### +########################################### + +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } #$DB = '1'; # DEBUG override $US = '_'; @@ -111,80 +139,57 @@ $REC_TIME = date("Ymd-His"); $FILE_datetime = $STARTtime; $parked_time = $STARTtime; -# $ext_context = 'default'; defined in dbconnect file -if (!isset($begin_date)) {$begin_date = $TODAY;} -if (!isset($end_date)) {$end_date = $TODAY;} - - $stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 0;"; - if ($DB) {echo "$stmt\n";} - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $auth=$row[0]; - - if (!$auth) - { - if ( (strlen($PHP_AUTH_USER)>1) and ( (preg_match('/tsr/i',$PHP_AUTH_PW)) or (preg_match('/sales/i',$PHP_AUTH_PW)) ) ) - { - $auth=1; - $user = $PHP_AUTH_USER; - $pass = $PHP_AUTH_PW; - } - } - -$fp = fopen ("./project_auth_entries.txt", "a"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); - if( (strlen($user)<2) or (strlen($pass)<2) or (!$auth)) +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) { - Header("WWW-Authenticate: Basic realm=\"VICIDIAL-CLOSER - $user - $PHP_AUTH_USER\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$user|$pass|\n"; - exit; + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } - else + +$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';"; +if ($DB) {echo "$stmt\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGfullname=$row[0]; +$fullname = $row[0]; + + +if ( (strlen($customer_zap_channel)>2) and ( (preg_match('/zap/i',$customer_zap_channel)) or (preg_match('/iax/i',$customer_zap_channel)) ) ) { + echo "\n\n"; + echo "\n"; + echo "\n"; + echo "\n"; - if($auth>0) - { - $office_no=strtoupper($user); - $password=strtoupper($pass); - $stmt="SELECT full_name from vicidial_users where user='$user' and pass='$pass'"; - if ($DB) {echo "$stmt\n";} - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname=$row[0]; - $fullname = $row[0]; - fwrite ($fp, "VD_CLOSER|GOOD|$date|$user|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - - if ( (strlen($customer_zap_channel)>2) and ( (preg_match('/zap/i',$customer_zap_channel)) or (preg_match('/iax/i',$customer_zap_channel)) ) ) - { - echo "\n\n"; - echo "\n"; - echo "\n"; - echo "\n"; - - } - else - { - echo "Bad channel: $customer_zap_channel\n"; - echo "Make sure the Zap channel is live and try again\n"; - exit; - } - - } - else - { - fwrite ($fp, "VD_CLOSER|FAIL|$date|$user|XXXX|$ip|$browser|\n"); - fclose($fp); - } + } +else + { + echo "Bad channel: $customer_zap_channel\n"; + echo "Make sure the Zap channel is live and try again\n"; + exit; } echo "\n"; echo "\n"; -echo "VICIDIAL FRONTER-CLOSER: Popup\n"; +echo "FRONTER-CLOSER: Popup\n"; echo "\n"; if (preg_match('/CL_UNIV/i',$channel_group)) @@ -424,11 +429,5 @@ echo "\n\n\n


\nscript runtime: $RUNtime seconds"; exit; - - ?> - - - - diff --git a/agc_2-X/trunk/www/vicidial/closer.php b/agc_2-X/trunk/www/vicidial/closer.php index e2402dec..a00d3bea 100644 --- a/agc_2-X/trunk/www/vicidial/closer.php +++ b/agc_2-X/trunk/www/vicidial/closer.php @@ -11,9 +11,11 @@ # 90508-0644 - Changed to PHP long tags # 120223-2249 - Removed logging of good login passwords if webroot writable is enabled # 130610-1116 - Finalized changing of all ereg instances to preg +# 130620-0827 - Added filtering of input to prevent SQL injection attacks and new user auth # require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -57,19 +59,27 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysql_num_rows($rslt); -$i=0; -while ($i < $qm_conf_ct) +if ($qm_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; $SSoutbound_autodial_active = $row[2]; $user_territories_active = $row[3]; - $i++; } ##### END SETTINGS LOOKUP ##### ########################################### +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } $PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); @@ -78,52 +88,37 @@ $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $popup_page = './closer_popup.php'; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 2;"; -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$fp = fopen ("./project_auth_entries.txt", "a"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) { - Header("WWW-Authenticate: Basic realm=\"VICIDIAL-CLOSER\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } -else - { - if($auth>0) + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - if ($DB) {echo "$stmt\n";} - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname=$row[0]; - $fullname = $row[0]; - if ($webroot_writable > 0) - { - fwrite ($fp, "VD_CLOSER|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($webroot_writable > 0) - { - fwrite ($fp, "VD_CLOSER|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } +$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';"; +if ($DB) {echo "$stmt\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGfullname=$row[0]; +$fullname = $row[0]; $color_class[0] = 'green'; $color_class[1] = 'red'; @@ -150,7 +145,7 @@ $color_class[9] = 'orange'; --> -VICIDIAL CLOSER: Main +CLOSER: Main
diff --git a/agc_2-X/trunk/www/vicidial/closer_dispo.php b/agc_2-X/trunk/www/vicidial/closer_dispo.php index 6825697f..4957efd2 100644 --- a/agc_2-X/trunk/www/vicidial/closer_dispo.php +++ b/agc_2-X/trunk/www/vicidial/closer_dispo.php @@ -12,9 +12,11 @@ # 90508-0644 - Changed to PHP long tags # 120223-2249 - Removed logging of good login passwords if webroot writable is enabled # 130610-1114 - Finalized changing of all ereg instances to preg +# 130620-0817 - Added filtering of input to prevent SQL injection attacks and new user auth # require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -92,83 +94,70 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysql_num_rows($rslt); -$i=0; -while ($i < $qm_conf_ct) +if ($qm_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; $SSoutbound_autodial_active = $row[2]; $user_territories_active = $row[3]; - $i++; } ##### END SETTINGS LOOKUP ##### ########################################### - -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $FILE_datetime = $STARTtime; - $ext_context = 'demo'; -if (!isset($begin_date)) {$begin_date = $TODAY;} -if (!isset($end_date)) {$end_date = $TODAY;} - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 2;"; - if ($DB) {echo "$stmt\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$fp = fopen ("./project_auth_entries.txt", "a"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) { - Header("WWW-Authenticate: Basic realm=\"VICIDIAL-CLOSER\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } -else - { - if($auth>0) + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - if ($DB) {echo "$stmt\n";} - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname=$row[0]; - $fullname = $row[0]; - if ($webroot_writable > 0) - { - fwrite ($fp, "VD_CLOSER|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($webroot_writable > 0) - { - fwrite ($fp, "VD_CLOSER|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } + +$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';"; +if ($DB) {echo "$stmt\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGfullname=$row[0]; +$fullname = $row[0]; + ?> -VICIDIAL CLOSER: Call Disposition +CLOSER: Call Disposition \n"; ?> diff --git a/agc_2-X/trunk/www/vicidial/closer_popup.php b/agc_2-X/trunk/www/vicidial/closer_popup.php index fe69b07b..7168c0cd 100644 --- a/agc_2-X/trunk/www/vicidial/closer_popup.php +++ b/agc_2-X/trunk/www/vicidial/closer_popup.php @@ -12,9 +12,11 @@ # 90508-0644 - Changed to PHP long tags # 120223-2135 - Removed logging of good login passwords if webroot writable is enabled # 130610-1113 - Finalized changing of all ereg instances to preg +# 130620-0010 - Added filtering of input to prevent SQL injection attacks and new user auth # require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -22,9 +24,9 @@ $PHP_SELF=$_SERVER['PHP_SELF']; if (isset($_GET["group"])) {$group=$_GET["group"];} elseif (isset($_POST["group"])) {$group=$_POST["group"];} if (isset($_GET["group_selected"])) {$group_selected=$_GET["group_selected"];} - elseif (isset($_POST["group_selected"])) {$group_selected=$_POST["group_selected"];} -if (isset($_GET["dialplan_number"])) {$dialplan_number=$_GET["dialplan_number"];} - elseif (isset($_POST["dialplan_number"])) {$dialplan_number=$_POST["dialplan_number"];} + elseif (isset($_POST["group_selected"])) {$group_selected=$_POST["group_selected"];} +if (isset($_GET["dialplan_number"])) {$dialplan_number=$_GET["dialplan_number"];} + elseif (isset($_POST["dialplan_number"])) {$dialplan_number=$_POST["dialplan_number"];} if (isset($_GET["extension"])) {$extension=$_GET["extension"];} elseif (isset($_POST["extension"])) {$extension=$_POST["extension"];} if (isset($_GET["groupselect"])) {$groupselect=$_GET["groupselect"];} @@ -34,23 +36,23 @@ if (isset($_GET["PHONE_LOGIN"])) {$PHONE_LOGIN=$_GET["PHONE_LOGIN"];} if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];} elseif (isset($_POST["server_ip"])) {$server_ip=$_POST["server_ip"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} - elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} -if (isset($_GET["user"])) {$user=$_GET["user"];} - elseif (isset($_POST["user"])) {$user=$_POST["user"];} -if (isset($_GET["channel"])) {$channel=$_GET["channel"];} - elseif (isset($_POST["channel"])) {$channel=$_POST["channel"];} -if (isset($_GET["parked_time"])) {$parked_time=$_GET["parked_time"];} - elseif (isset($_POST["parked_time"])) {$parked_time=$_POST["parked_time"];} -if (isset($_GET["channel_group"])) {$channel_group=$_GET["channel_group"];} - elseif (isset($_POST["channel_group"])) {$channel_group=$_POST["channel_group"];} + elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} +if (isset($_GET["user"])) {$user=$_GET["user"];} + elseif (isset($_POST["user"])) {$user=$_POST["user"];} +if (isset($_GET["channel"])) {$channel=$_GET["channel"];} + elseif (isset($_POST["channel"])) {$channel=$_POST["channel"];} +if (isset($_GET["parked_time"])) {$parked_time=$_GET["parked_time"];} + elseif (isset($_POST["parked_time"])) {$parked_time=$_POST["parked_time"];} +if (isset($_GET["channel_group"])) {$channel_group=$_GET["channel_group"];} + elseif (isset($_POST["channel_group"])) {$channel_group=$_POST["channel_group"];} if (isset($_GET["debugvars"])) {$debugvars=$_GET["debugvars"];} elseif (isset($_POST["debugvars"])) {$debugvars=$_POST["debugvars"];} if (isset($_GET["parked_by"])) {$parked_by=$_GET["parked_by"];} elseif (isset($_POST["parked_by"])) {$parked_by=$_POST["parked_by"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} - elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} + elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} - elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} + elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} ############################################# @@ -59,23 +61,27 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysql_num_rows($rslt); -$i=0; -while ($i < $qm_conf_ct) +if ($qm_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; $SSoutbound_autodial_active = $row[2]; $user_territories_active = $row[3]; - $i++; } ##### END SETTINGS LOOKUP ##### ########################################### - -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } #$DB=1; $US = '_'; @@ -87,51 +93,33 @@ $FILE_datetime = $STARTtime; $ext_context = 'demo'; -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 2;"; - if ($DB) {echo "$stmt\n";} +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';"; +if ($DB) {echo "$stmt\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$fp = fopen ("./project_auth_entries.txt", "a"); -$date = date("r"); -$ip = getenv("REMOTE_ADDR"); -$browser = getenv("HTTP_USER_AGENT"); - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) - { - Header("WWW-Authenticate: Basic realm=\"VICIDIAL-CLOSER\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } -else - { - if($auth>0) - { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - if ($DB) {echo "$stmt\n";} - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname=$row[0]; - $fullname = $row[0]; - if ($webroot_writable > 0) - { - fwrite ($fp, "VD_CLOSER|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($webroot_writable > 0) - { - fwrite ($fp, "VD_CLOSER|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } - } - } +$LOGfullname=$row[0]; +$fullname = $row[0]; echo "\n"; echo "\n"; diff --git a/agc_2-X/trunk/www/vicidial/fcstats.php b/agc_2-X/trunk/www/vicidial/fcstats.php index cc34ad64..80a56049 100644 --- a/agc_2-X/trunk/www/vicidial/fcstats.php +++ b/agc_2-X/trunk/www/vicidial/fcstats.php @@ -23,35 +23,34 @@ # 120705-2007 - Changed SALES to use sales status flag # 130414-0126 - Added report logging # 130610-0948 - Finalized changing of all ereg instances to preg +# 130619-2339 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; if (isset($_GET["DB"])) {$DB=$_GET["DB"];} - elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} + elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["group"])) {$group=$_GET["group"];} elseif (isset($_POST["group"])) {$group=$_POST["group"];} if (isset($_GET["query_date"])) {$query_date=$_GET["query_date"];} - elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];} + elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];} if (isset($_GET["shift"])) {$shift=$_GET["shift"];} elseif (isset($_POST["shift"])) {$shift=$_POST["shift"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} - elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} + elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} - elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} -if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} + elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} +if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];} -if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} +if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];} -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - if (strlen($shift)<2) {$shift='ALL';} @@ -77,24 +76,66 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; -if ($DB) {$HTML_text.="|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';"; -if ($DB) {$HTML_text.="|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$reports_only_user=$row[0]; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } +$shift = preg_replace("/'|\"|\\\\|;/","",$shift); + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } ##### BEGIN log visit to the vicidial_report_log table ##### @@ -126,7 +167,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ echo "\n"; } -$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {$HTML_text.="|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); @@ -143,7 +184,7 @@ $LOGadmin_viewable_call_times = $row[3]; if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; diff --git a/agc_2-X/trunk/www/vicidial/functions.php b/agc_2-X/trunk/www/vicidial/functions.php index 1d6ed60a..cffb4446 100644 --- a/agc_2-X/trunk/www/vicidial/functions.php +++ b/agc_2-X/trunk/www/vicidial/functions.php @@ -1,10 +1,10 @@ LICENSE: AGPLv2 +# Copyright (C) 2013 Matt Florell LICENSE: AGPLv2 # # # CHANGES: @@ -14,9 +14,107 @@ # 120125-1235 - Small changes to max stats function to allow for total system stats # 120213-1417 - Changes to allow for ra stats # 120713-2137 - Added download function for max stats +# 130615-2111 - Added user authentication function and login lockout for 15 minutes after 10 failed login # -##### reformat seconds into HH:MM:SS or MM:SS ##### +##### BEGIN validate user login credentials, check for failed lock out ##### +function user_authorization($user,$pass,$user_option,$user_update) + { + require("dbconnect.php"); + + ############################################# + ##### START SYSTEM_SETTINGS LOOKUP ##### + $stmt = "SELECT use_non_latin,webroot_writable,pass_hash_enabled,pass_key,pass_cost FROM system_settings;"; + $rslt=mysql_query($stmt, $link); + if ($DB) {echo "$stmt\n";} + $qm_conf_ct = mysql_num_rows($rslt); + if ($qm_conf_ct > 0) + { + $row=mysql_fetch_row($rslt); + $non_latin = $row[0]; + $SSwebroot_writable = $row[1]; + $SSpass_hash_enabled = $row[2]; + $SSpass_key = $row[3]; + $SSpass_cost = $row[4]; + } + ##### END SETTINGS LOOKUP ##### + ########################################### + + $STARTtime = date("U"); + $TODAY = date("Y-m-d"); + $NOW_TIME = date("Y-m-d H:i:s"); + $ip = getenv("REMOTE_ADDR"); + $browser = getenv("HTTP_USER_AGENT"); + $LOCK_over = ($STARTtime - 900); # failed login lockout time is 15 minutes(900 seconds) + $LOCK_trigger_attempts = 10; + + $user = preg_replace("/\'|\"|\\\\|;/","",$user); + $pass = preg_replace("/\'|\"|\\\\|;/","",$pass); + + $stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 7 and active='Y' and ( (failed_login_count < $LOCK_trigger_attempts) or (UNIX_TIMESTAMP(last_login_date) < $LOCK_over) );"; + if ($user_option == 'REPORTS') + {$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 6 and active='Y' and ( (failed_login_count < $LOCK_trigger_attempts) or (UNIX_TIMESTAMP(last_login_date) < $LOCK_over) );";} + if ($user_option == 'REMOTE') + {$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 3 and active='Y' and ( (failed_login_count < $LOCK_trigger_attempts) or (UNIX_TIMESTAMP(last_login_date) < $LOCK_over) );";} + if ($user_option == 'QC') + {$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 1 and active='Y' and ( (failed_login_count < $LOCK_trigger_attempts) or (UNIX_TIMESTAMP(last_login_date) < $LOCK_over) );";} + if ($DB) {echo "|$stmt|\n";} + if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $auth=$row[0]; + + if ($auth < 1) + { + $auth_key='BAD'; + $stmt="SELECT failed_login_count,UNIX_TIMESTAMP(last_login_date) from vicidial_users where user='$user';"; + if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} + $rslt=mysql_query($stmt, $link); + $cl_user_ct = mysql_num_rows($rslt); + if ($cl_user_ct > 0) + { + $row=mysql_fetch_row($rslt); + $failed_login_count = $row[0]; + $last_login_date = $row[1]; + + if ($failed_login_count < $LOCK_trigger_attempts) + { + $stmt="UPDATE vicidial_users set failed_login_count=(failed_login_count+1),last_ip='$ip' where user='$user';"; + $rslt=mysql_query($stmt, $link); + } + else + { + if ($LOCK_over > $last_login_date) + { + $stmt="UPDATE vicidial_users set last_login_date=NOW(),failed_login_count=1,last_ip='$ip' where user='$user';"; + $rslt=mysql_query($stmt, $link); + } + else + {$auth_key='LOCK';} + } + } + if ($SSwebroot_writable > 0) + { + $fp = fopen ("./project_auth_entries.txt", "a"); + fwrite ($fp, "ADMIN|FAIL|$NOW_TIME|$user|$auth_key|$ip|$browser|\n"); + fclose($fp); + } + } + else + { + if ($user_update > 0) + { + $stmt="UPDATE vicidial_users set last_login_date=NOW(),last_ip='$ip',failed_login_count=0 where user='$user';"; + $rslt=mysql_query($stmt, $link); + } + $auth_key='GOOD'; + } + return $auth_key; + } +##### END validate user login credentials, check for failed lock out ##### + + +##### BEGIN reformat seconds into HH:MM:SS or MM:SS ##### function sec_convert($sec,$precision) { $sec = round($sec,0); @@ -71,9 +169,10 @@ function sec_convert($sec,$precision) return "$Ftime"; } } +##### END reformat seconds into HH:MM:SS or MM:SS ##### -##### counts like elements in an array, optional sort asc desc ##### +##### BEGIN counts like elements in an array, optional sort asc desc ##### function array_group_count($array, $sort = false) { $tally_array = array(); @@ -100,9 +199,10 @@ function array_group_count($array, $sort = false) return $tally_array; } +##### END counts like elements in an array, optional sort asc desc ##### -##### bar chart using max stats data ##### +##### BEGIN bar chart using max stats data ##### function horizontal_bar_chart($campaign_id,$days_graph,$title,$link,$metric,$metric_name,$more_link,$END_DATE,$download_link) { $stats_start_time = time(); @@ -197,8 +297,10 @@ function horizontal_bar_chart($campaign_id,$days_graph,$title,$link,$metric,$met echo "
\n"; } } +##### END bar chart using max stats data ##### -##### bar chart using max stats data ##### + +##### BEGIN download max stats data ##### function download_max_system_stats($campaign_id,$days_graph,$title,$metric,$metric_name,$END_DATE) { global $CSV_text, $link; @@ -283,4 +385,6 @@ function download_max_system_stats($campaign_id,$days_graph,$title,$metric,$metr $CSV_text.="\n\n"; } } -?> \ No newline at end of file +##### BEGIN download max stats data ##### + +?> diff --git a/agc_2-X/trunk/www/vicidial/group_hourly_stats.php b/agc_2-X/trunk/www/vicidial/group_hourly_stats.php index d763a061..6b620a64 100644 --- a/agc_2-X/trunk/www/vicidial/group_hourly_stats.php +++ b/agc_2-X/trunk/www/vicidial/group_hourly_stats.php @@ -13,6 +13,7 @@ # 120223-2135 - Removed logging of good login passwords if webroot writable is enabled # 130414-0224 - Added report logging # 130610-0946 - Finalized changing of all ereg instances to preg +# 130619-2329 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); @@ -20,6 +21,7 @@ $startMS = microtime(); $report_name='User Group Hourly Stats'; require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -27,13 +29,13 @@ $PHP_SELF=$_SERVER['PHP_SELF']; if (isset($_GET["group"])) {$group=$_GET["group"];} elseif (isset($_POST["group"])) {$group=$_POST["group"];} if (isset($_GET["status"])) {$status=$_GET["status"];} - elseif (isset($_POST["status"])) {$status=$_POST["status"];} + elseif (isset($_POST["status"])) {$status=$_POST["status"];} if (isset($_GET["date_with_hour"])) {$date_with_hour=$_GET["date_with_hour"];} - elseif (isset($_POST["date_with_hour"])) {$date_with_hour=$_POST["date_with_hour"];} + elseif (isset($_POST["date_with_hour"])) {$date_with_hour=$_POST["date_with_hour"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} - elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} + elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} - elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} + elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### @@ -41,35 +43,79 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysql_num_rows($rslt); -$i=0; -while ($i < $qm_conf_ct) +if ($qm_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; $SSoutbound_autodial_active = $row[2]; $user_territories_active = $row[3]; - $i++; } ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';"; -if ($DB) {echo "|$stmt|\n";} -if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } +$group = preg_replace("/'|\"|\\\\|;/","",$group); +$status = preg_replace("/'|\"|\\\\|;/","",$status); +$date_with_hour = preg_replace("/'|\"|\\\\|;/","",$date_with_hour); + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } ##### BEGIN log visit to the vicidial_report_log table ##### @@ -96,66 +142,21 @@ $STARTtime = date("U"); $TODAY = date("Y-m-d"); $date_with_hour_default = date("Y-m-d H"); $date_no_hour_default = $TODAY; - -if (!isset($date_with_hour)) {$date_with_hour = $date_with_hour_default;} - $date_no_hour = $date_with_hour; - $date_no_hour = preg_replace('/\s([0-9]{2})/i',$date_no_hour); -if (!isset($begin_date)) {$begin_date = $TODAY;} -if (!isset($end_date)) {$end_date = $TODAY;} - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;"; -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$fp = fopen ("./project_auth_entries.txt", "a"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); - if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) - { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } - else - { - header ("Content-type: text/html; charset=utf-8"); +if (!isset($date_with_hour)) {$date_with_hour = $date_with_hour_default;} + $date_no_hour = $date_with_hour; + $date_no_hour = preg_replace('/\s([0-9]{2})/i','',$date_no_hour); +if (!isset($begin_date)) {$begin_date = $TODAY;} +if (!isset($end_date)) {$end_date = $TODAY;} - if($auth>0) - { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT full_name,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname = $row[0]; - $LOGuser_group = $row[1]; - - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } - exit; - } - -# $stmt="SELECT full_name from vicidial_users where user='$user';"; -# $rslt=mysql_query($stmt, $link); -# $row=mysql_fetch_row($rslt); -# $full_name = $row[0]; - - } +$stmt="SELECT full_name,user_group from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGfullname = $row[0]; +$LOGuser_group = $row[1]; $stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {$HTML_text.="|$stmt|\n";} @@ -177,7 +178,6 @@ if ( (!preg_match('/\-\-ALL\-\-/i',$LOGadmin_viewable_groups)) and (strlen($LOGa } - ?> diff --git a/agc_2-X/trunk/www/vicidial/lead_report_export.php b/agc_2-X/trunk/www/vicidial/lead_report_export.php index 72f5fbea..74c5d75c 100644 --- a/agc_2-X/trunk/www/vicidial/lead_report_export.php +++ b/agc_2-X/trunk/www/vicidial/lead_report_export.php @@ -13,11 +13,13 @@ # 111104-1245 - Added user_group restrictions for selecting in-groups # 130414-0135 - Added report logging # 130610-0945 - Finalized changing of all ereg instances to preg +# 130619-2307 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -79,28 +81,78 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and export_reports='1' and active='Y';"; -if ($DB) {echo "|$stmt|\n";} -if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$reports_only_user=$row[0]; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { -# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); -# Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password or no export report permission: |$PHP_AUTH_USER|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT export_reports,user_group from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGexport_reports = $row[0]; +$LOGuser_group = $row[1]; + +if ($LOGexport_reports < 1) + { + Header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions for export reports: |$PHP_AUTH_USER|\n"; + exit; } ##### BEGIN log visit to the vicidial_report_log table ##### @@ -132,12 +184,6 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ # echo "\n"; } -$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$LOGuser_group = $row[0]; - $stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_query($stmt, $link); @@ -147,10 +193,9 @@ $LOGallowed_reports = $row[1]; $LOGadmin_viewable_groups = $row[2]; $LOGadmin_viewable_call_times = $row[3]; - if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; diff --git a/agc_2-X/trunk/www/vicidial/lead_tools.php b/agc_2-X/trunk/www/vicidial/lead_tools.php index 5a5a10d4..57ed90ab 100644 --- a/agc_2-X/trunk/www/vicidial/lead_tools.php +++ b/agc_2-X/trunk/www/vicidial/lead_tools.php @@ -8,10 +8,11 @@ # 121114-0956 - Added input filtering and vicidial_admin_log logging # 130124-1129 - Added new options, from issue #632 # 130610-1045 - Finalized changing of all ereg instances to preg +# 130619-2203 - Added filtering of input to prevent SQL injection attacks and new user auth # -$version = '2.8-4'; -$build = '130610-1045'; +$version = '2.8-5'; +$build = '130619-2203'; # This limit is to prevent data inconsistancies. # If there are too many leads in a list this @@ -22,6 +23,7 @@ $list_lead_limit = 100000; $max_count = 20; require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -61,7 +63,6 @@ $confirm_update = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm_update); $confirm_delete = preg_replace('/[^-_0-9a-zA-Z]/','',$confirm_delete); $delete_status = preg_replace('/[^-_0-9a-zA-Z]/','',$delete_status); - ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $sys_settings_stmt = "SELECT use_non_latin, outbound_autodial_active, sounds_central_control_active FROM system_settings;"; @@ -87,65 +88,68 @@ if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - $list_id_override = preg_replace('/[^0-9]/','',$list_id_override); } else { $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); } +$list_id_override = preg_replace('/[^0-9]/','',$list_id_override); -$valid_user_stmt = "SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;"; -if ($DB) {echo "|$valid_user_stmt|\n";} -if ($non_latin > 0) {$valid_user_rslt=mysql_query("SET NAMES 'UTF8'");} -$valid_user_rslt = mysql_query($valid_user_stmt, $link); -$valid_user_row = mysql_fetch_row($valid_user_rslt); -$auth = $valid_user_row[0]; +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} -if ( ( strlen($PHP_AUTH_USER) < 2 ) or ( strlen($PHP_AUTH_PW) < 2 ) or ( !$auth ) ) +if ($auth < 1) { - # Invalid user - Header("WWW-Authenticate: Basic realm=\"VICIDIAL-LEAD-LOADER\""); + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; exit; } -else + +header ("Content-type: text/html; charset=utf-8"); +header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 +header ("Pragma: no-cache"); // HTTP/1.0 + +# valid user +$rights_stmt = "SELECT load_leads,user_group, delete_lists, modify_leads, modify_lists from vicidial_users where user='$PHP_AUTH_USER';"; +if ($DB) {echo "|$stmt|\n";} +$rights_rslt=mysql_query($rights_stmt, $link); +$rights_row=mysql_fetch_row($rights_rslt); +$load_leads = $rights_row[0]; +$user_group = $rights_row[1]; +$delete_lists = $rights_row[2]; +$modify_leads = $rights_row[3]; +$modify_lists = $rights_row[4]; + +# check their permissions +if ( $load_leads < 1 ) { header ("Content-type: text/html; charset=utf-8"); - header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 - header ("Pragma: no-cache"); // HTTP/1.0 - - if ( $auth > 0 ) - { - # valid user - $rights_stmt = "SELECT load_leads,user_group, delete_lists, modify_leads, modify_lists from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - if ($DB) {echo "|$stmt|\n";} - $rights_rslt=mysql_query($rights_stmt, $link); - $rights_row=mysql_fetch_row($rights_rslt); - $load_leads = $rights_row[0]; - $user_group = $rights_row[1]; - $delete_lists = $rights_row[2]; - $modify_leads = $rights_row[3]; - $modify_lists = $rights_row[4]; - - # check their permissions - if ( $load_leads < 1 ) - { - echo "You do not have permissions to load leads\n"; - exit; - } - if ( $modify_leads < 1 ) - { - echo "You do not have permissions to modify leads\n"; - exit; - } - if ( $modify_lists < 1 ) - { - echo "You do not have permissions to modify lists\n"; - exit; - } - } + echo "You do not have permissions to load leads\n"; + exit; + } +if ( $modify_leads < 1 ) + { + header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions to modify leads\n"; + exit; + } +if ( $modify_lists < 1 ) + { + header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions to modify lists\n"; + exit; } echo "\n"; @@ -155,11 +159,11 @@ echo "\n echo "ADMINISTRATION: Lead Tools\n"; ##### BEGIN Set variables to make header show properly ##### -$ADD = '999998'; -$hh = 'admin'; +$ADD = '999998'; +$hh = 'admin'; $LOGast_admin_access = '1'; $SSoutbound_autodial_active = '1'; -$ADMIN = 'admin.php'; +$ADMIN = 'admin.php'; $page_width='770'; $section_width='750'; $header_font_size='3'; @@ -330,15 +334,14 @@ if ($confirm_move == "confirm") $move_lead_rslt = mysql_query($move_lead_stmt, $link); $move_lead_count = mysql_affected_rows( $link ); - $move_sentence = "$move_lead_count leads have been moved from list $move_from_list to $move_to_list with the status $move_status and that were called $move_count_op_phrase$move_count_num times."; - - $SQL_log = "$move_lead_stmt|"; - $SQL_log = preg_replace('/;/', '', $SQL_log); - $SQL_log = addslashes($SQL_log); - $admin_log_stmt="INSERT INTO vicidial_admin_log set event_date='$SQLdate', user='$PHP_AUTH_USER', ip_address='$ip', event_section='LISTS', event_type='OTHER', record_id='$move_from_list', event_code='ADMIN MOVE LEADS', event_sql=\"$SQL_log\", event_notes='$move_sentence';"; - if ($DB) {echo "|$admin_log_stmt|\n";} - $admin_log_rslt=mysql_query($admin_log_stmt, $link); - + $move_sentence = "$move_lead_count leads have been moved from list $move_from_list to $move_to_list with the status $move_status and that were called $move_count_op_phrase$move_count_num times."; + + $SQL_log = "$move_lead_stmt|"; + $SQL_log = preg_replace('/;/', '', $SQL_log); + $SQL_log = addslashes($SQL_log); + $admin_log_stmt="INSERT INTO vicidial_admin_log set event_date='$SQLdate', user='$PHP_AUTH_USER', ip_address='$ip', event_section='LISTS', event_type='OTHER', record_id='$move_from_list', event_code='ADMIN MOVE LEADS', event_sql=\"$SQL_log\", event_notes='$move_sentence';"; + if ($DB) {echo "|$admin_log_stmt|\n";} + $admin_log_rslt=mysql_query($admin_log_stmt, $link); echo "

$move_sentence

"; echo "

Click here to start over.

\n"; diff --git a/agc_2-X/trunk/www/vicidial/leadloader_template_display.php b/agc_2-X/trunk/www/vicidial/leadloader_template_display.php index 9ba2ea5f..e0d7995e 100644 --- a/agc_2-X/trunk/www/vicidial/leadloader_template_display.php +++ b/agc_2-X/trunk/www/vicidial/leadloader_template_display.php @@ -8,9 +8,30 @@ # 120525-1039 - Added uploaded filename filtering # 120529-1345 - Filename filter fix # 130610-1101 - Finalized changing of all ereg instances to preg +# 130619-0902 - Added filtering of input to prevent SQL injection attacks and new user auth # require("dbconnect.php"); +require("functions.php"); + +$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; +$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; +if (isset($_GET["list_id"])) {$list_id=$_GET["list_id"];} + elseif (isset($_POST["list_id"])) {$list_id=$_POST["list_id"];} +if (isset($_GET["custom_fields_enabled"])) {$custom_fields_enabled=$_GET["custom_fields_enabled"];} + elseif (isset($_POST["custom_fields_enabled"])) {$custom_fields_enabled=$_POST["custom_fields_enabled"];} +$sample_template_file=$_FILES["sample_template_file"]; +$LF_orig = $_FILES['sample_template_file']['name']; +$LF_path = $_FILES['sample_template_file']['tmp_name']; +if (isset($_GET["sample_template_file_name"])) {$sample_template_file_name=$_GET["sample_template_file_name"];} + elseif (isset($_POST["sample_template_file_name"])) {$sample_template_file_name=$_POST["sample_template_file_name"];} +if (isset($_FILES["sample_template_file"])) {$sample_template_file_name=$_FILES["sample_template_file"]['name'];} +if (isset($_GET["form_action"])) {$form_action=$_GET["form_action"];} + elseif (isset($_POST["form_action"])) {$form_action=$_POST["form_action"];} +if (isset($_GET["delimiter"])) {$delimiter=$_GET["delimiter"];} + elseif (isset($_POST["delimiter"])) {$delimiter=$_POST["delimiter"];} +if (isset($_GET["buffer"])) {$buffer=$_GET["buffer"];} + elseif (isset($_POST["buffer"])) {$buffer=$_POST["buffer"];} ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### @@ -29,22 +50,50 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -if (isset($_GET["list_id"])) {$list_id=$_GET["list_id"];} - elseif (isset($_POST["list_id"])) {$list_id=$_POST["list_id"];} -if (isset($_GET["custom_fields_enabled"])) {$custom_fields_enabled=$_GET["custom_fields_enabled"];} - elseif (isset($_POST["custom_fields_enabled"])) {$custom_fields_enabled=$_POST["custom_fields_enabled"];} -$sample_template_file=$_FILES["sample_template_file"]; -$LF_orig = $_FILES['sample_template_file']['name']; -$LF_path = $_FILES['sample_template_file']['tmp_name']; -if (isset($_GET["sample_template_file_name"])) {$sample_template_file_name=$_GET["sample_template_file_name"];} - elseif (isset($_POST["sample_template_file_name"])) {$sample_template_file_name=$_POST["sample_template_file_name"];} -if (isset($_FILES["sample_template_file"])) {$sample_template_file_name=$_FILES["sample_template_file"]['name'];} -if (isset($_GET["form_action"])) {$form_action=$_GET["form_action"];} - elseif (isset($_POST["form_action"])) {$form_action=$_POST["form_action"];} -if (isset($_GET["delimiter"])) {$delimiter=$_GET["delimiter"];} - elseif (isset($_POST["delimiter"])) {$delimiter=$_POST["delimiter"];} -if (isset($_GET["buffer"])) {$buffer=$_GET["buffer"];} - elseif (isset($_POST["buffer"])) {$buffer=$_POST["buffer"];} +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } +$list_id = preg_replace('/[^0-9]/', '', $list_id); + +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT load_leads from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGload_leads = $row[0]; + +if ($LOGload_leads < 1) + { + Header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions to load leads\n"; + exit; + } ### REGEX to prevent weird characters from ending up in the fields $field_regx = "['\"`\\;]"; @@ -88,7 +137,7 @@ if ($form_action=="prime_file" && $sample_template_file_name) {$stmt_file=fopen("$WeBServeRRooT/$admin_web_directory/listloader_stmts.txt", "w");} $buffer=fgets($file, 4096); - $buffer=preg_replace('/[\'\"\n]/i', $buffer); + $buffer=preg_replace('/[\'\"\n]/i', '', $buffer); $tab_count=substr_count($buffer, "\t"); $pipe_count=substr_count($buffer, "|"); @@ -174,7 +223,6 @@ if ($custom_fields_enabled > 0) } $fields_stmt = "SELECT list_id, vendor_lead_code, source_id, phone_code, phone_number, title, first_name, middle_initial, last_name, address1, address2, address3, city, state, province, postal_code, country_code, gender, date_of_birth, alt_phone, email, security_phrase, comments, rank, owner $custom_SQL from vicidial_list, custom_$list_id limit 1"; - } } } @@ -190,34 +238,34 @@ if ($delimiter && $buffer) # print "
Processing $delim_name file...\n"; $row=explode($delimiter, preg_replace('/[\'\"]/i', '', $buffer)); # echo "delimiter: $delimiter
$buffer
"; -} + } echo ""; $rslt=mysql_query("$fields_stmt", $link); $custom_fields_count=mysql_num_fields($rslt)-$vl_fields_count; for ($i=0; $i\r\n"; - echo " \r\n"; - if (mysql_field_name($rslt, $i)!="list_id") + echo " \r\n"; + echo " \r\n"; + if (mysql_field_name($rslt, $i)!="list_id") + { + echo " \r\n"; + preg_replace('/\"/i', '', $row[$j]); + echo " \r\n"; } - else - { - echo " \r\n"; - } - echo " \r\n"; + + echo " \r\n"; + } + else + { + echo " \r\n"; + } + echo " \r\n"; } echo "
".strtoupper(preg_replace('/_/i', ' ', mysql_field_name($rslt, $i))).":
".strtoupper(preg_replace('/_/i', ' ', mysql_field_name($rslt, $i))).": \r\n"; - echo " \r\n"; - - for ($j=0; $j\"$row[$j]\"\r\n"; - } - - echo "  $list_id
 $list_id
"; } diff --git a/agc_2-X/trunk/www/vicidial/list_download.php b/agc_2-X/trunk/www/vicidial/list_download.php index 7743c2f8..c650ec53 100644 --- a/agc_2-X/trunk/www/vicidial/list_download.php +++ b/agc_2-X/trunk/www/vicidial/list_download.php @@ -24,11 +24,13 @@ # 120907-1217 - Raised extended fields up to 99 # 130414-0228 - Added report logging # 130610-0945 - Finalized changing of all ereg instances to preg +# 130618-0043 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -70,21 +72,51 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } +$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id); +$group_id = preg_replace('/[^-_0-9a-zA-Z]/','',$group_id); +$download_type = preg_replace('/[^-_0-9a-zA-Z]/','',$download_type); -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and download_lists='1' and active='Y';"; +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and download_lists='1';"; if ($DB) {echo "|$stmt|\n";} -if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); -$auth=$row[0]; +$download_auth=$row[0]; -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($download_auth < 1) { -# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); -# Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password or no list download permission: |$PHP_AUTH_USER|\n"; + Header ("Content-type: text/html; charset=utf-8"); + echo "No list download permission: |$PHP_AUTH_USER|\n"; exit; } @@ -117,7 +149,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ # echo "\n"; } -$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); @@ -132,8 +164,7 @@ $LOGallowed_reports = $row[1]; if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - # Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - # Header("HTTP/1.0 401 Unauthorized"); + Header ("Content-type: text/html; charset=utf-8"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; } @@ -561,4 +592,5 @@ $rslt=mysql_query($stmt, $link); exit; -?> \ No newline at end of file +?> + diff --git a/agc_2-X/trunk/www/vicidial/listloader.php b/agc_2-X/trunk/www/vicidial/listloader.php new file mode 100644 index 00000000..def2ebee --- /dev/null +++ b/agc_2-X/trunk/www/vicidial/listloader.php @@ -0,0 +1 @@ +this file has been removed \ No newline at end of file diff --git a/agc_2-X/trunk/www/vicidial/listloaderMAIN.php b/agc_2-X/trunk/www/vicidial/listloaderMAIN.php index 05c6e349..8c999988 100644 --- a/agc_2-X/trunk/www/vicidial/listloaderMAIN.php +++ b/agc_2-X/trunk/www/vicidial/listloaderMAIN.php @@ -12,9 +12,11 @@ # 90508-0644 - Changed to PHP long tags # 120223-2151 - Removed logging of good login passwords if webroot writable is enabled # 130610-1111 - Finalized changing of all ereg instances to preg +# 130618-0035 - Added filtering of input to prevent SQL injection attacks and new user auth # require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -26,77 +28,66 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysql_num_rows($rslt); -$i=0; -while ($i < $qm_conf_ct) +if ($qm_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; $SSoutbound_autodial_active = $row[2]; $user_territories_active = $row[3]; - $i++; } ##### END SETTINGS LOOKUP ##### ########################################### - -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $FILE_datetime = $STARTtime; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -if ($webroot_writable > 0) {$fp = fopen ("./project_auth_entries.txt", "a");} $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) - { - Header("WWW-Authenticate: Basic realm=\"VICIDIAL-LEAD-LOADER\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } - else - { - header ("Content-type: text/html; charset=utf-8"); - if($auth>0) - { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT load_leads from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGload_leads =$row[0]; +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} - if ($LOGload_leads < 1) - { - echo "You do not have permissions to load leads\n"; - exit; - } - if ($webroot_writable > 0) - { - fwrite ($fp, "LIST_LOAD|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else +if ($auth < 1) + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') { - if ($webroot_writable > 0) - { - fwrite ($fp, "LIST_LOAD|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT load_leads from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGload_leads = $row[0]; + +if ($LOGload_leads < 1) + { + echo "You do not have permissions to load leads\n"; + exit; } ?> @@ -106,4 +97,4 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) - \ No newline at end of file + diff --git a/agc_2-X/trunk/www/vicidial/non_agent_api.php b/agc_2-X/trunk/www/vicidial/non_agent_api.php index a18f1efd..94f91fb0 100644 --- a/agc_2-X/trunk/www/vicidial/non_agent_api.php +++ b/agc_2-X/trunk/www/vicidial/non_agent_api.php @@ -77,15 +77,18 @@ # 130420-1938 - Added NANPA prefix validation and timezone options # 130614-0907 - Finalized changing of all ereg instances to preg # - Added pause code to output of agent_status function +# 130617-2232 - Added real-time sub-statuses to output of agent_status function +# - Added user authentication process to eliminate brute force attacks # -$version = '2.8-54'; -$build = '130614-0907'; +$version = '2.8-55'; +$build = '130617-2232'; $api_url_log = 0; $startMS = microtime(); require("dbconnect.php"); +require("functions.php"); ### If you have globals turned off uncomment these lines if (isset($_GET["user"])) {$user=$_GET["user"];} @@ -355,8 +358,8 @@ if ($qm_conf_ct > 0) if ($non_latin < 1) { $DB=preg_replace('/[^0-9]/','',$DB); - $user=preg_replace('/[^0-9a-zA-Z]/','',$user); - $pass=preg_replace('/[^0-9a-zA-Z]/','',$pass); + $user=preg_replace('/[^-_0-9a-zA-Z]/','',$user); + $pass=preg_replace('/[^-_0-9a-zA-Z]/','',$pass); $function = preg_replace('/[^-\_0-9a-zA-Z]/', '',$function); $format = preg_replace('/[^0-9a-zA-Z]/','',$format); $list_id = preg_replace('/[^0-9]/','',$list_id); @@ -575,6 +578,29 @@ if ($function == 'version') +##### BEGIN user authentication for all functions below ##### +$auth=0; +$auth_message = user_authorization($user,$pass,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) + { + $VDdisplayMESSAGE = "ERROR: Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "ERROR: Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$user|$auth_message|\n"; + exit; + } + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$user|$pass|$auth_message|\n"; + exit; + } +##### END user authentication for all functions below ##### + + ################################################################################ ### sounds_list - sends a list of the sounds in the audio store @@ -3641,8 +3667,6 @@ if ($function == 'agent_stats_export') $search_SQL=''; $search_ready=0; - require_once("functions.php"); - if ( (strlen($agent_user)>0) and (strlen($agent_user)<21) ) { $search_SQL .= "user='$agent_user'"; @@ -3859,8 +3883,6 @@ if ($function == 'user_group_status') $search_SQL=''; $search_ready=0; - require_once("functions.php"); - if ( (strlen($user_groups)>0) and (strlen($user_groups)<10000) ) { $user_groupsOUTPUT = preg_replace("/\|/",' ',$user_groups); @@ -4077,8 +4099,6 @@ if ($function == 'in_group_status') $search_SQL=''; $search_ready=0; - require_once("functions.php"); - if ( (strlen($in_groups)>0) and (strlen($in_groups)<10000) ) { $in_groupsOUTPUT = preg_replace("/\|/",' ',$in_groups); @@ -4295,8 +4315,6 @@ if ($function == 'agent_status') $agent_search_SQL=''; $search_ready=0; - require_once("functions.php"); - if ( (strlen($agent_user)>0) and (strlen($agent_user)<100) ) { $agent_search_SQL .= "where user='$agent_user'"; @@ -4351,7 +4369,7 @@ if ($function == 'agent_status') if ($header == 'YES') {$output .= 'status' . $DL . 'callerid' . $DL . 'lead_id' . $DL . 'campaign_id' . $DL . 'calls_today' . $DL . 'full_name' . $DL . 'user_group' . $DL . 'user_level' . "\n";} - $stmt="select full_name,user_group,user_level from vicidial_users $agent_search_SQL $LOGadmin_viewable_groupsSQL;"; + $stmt="SELECT full_name,user_group,user_level from vicidial_users $agent_search_SQL $LOGadmin_viewable_groupsSQL;"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $user_to_list = mysql_num_rows($rslt); @@ -4362,22 +4380,25 @@ if ($function == 'agent_status') $user_group = $row[1]; $user_level = $row[2]; - $stmt="select status,callerid,lead_id,campaign_id,calls_today,agent_log_id from vicidial_live_agents $agent_search_SQL;"; + $stmt="SELECT status,callerid,lead_id,campaign_id,calls_today,agent_log_id,on_hook_agent,ring_callerid from vicidial_live_agents $agent_search_SQL;"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $agent_to_list = mysql_num_rows($rslt); if ($agent_to_list > 0) { $row=mysql_fetch_row($rslt); - $status = $row[0]; - $callerid = $row[1]; - $lead_id = $row[2]; - $campaign_id = $row[3]; - $calls_today = $row[4]; - $agent_log_id = $row[5]; - $pause_code = ''; + $status = $row[0]; + $callerid = $row[1]; + $lead_id = $row[2]; + $campaign_id = $row[3]; + $calls_today = $row[4]; + $agent_log_id = $row[5]; + $on_hook_agent = $row[6]; + $ring_callerid = $row[7]; + $pause_code = ''; + $rtr_status = ''; - $stmt="select sub_status from vicidial_agent_log $agent_search_SQL and agent_log_id='$agent_log_id';"; + $stmt="SELECT sub_status from vicidial_agent_log $agent_search_SQL and agent_log_id='$agent_log_id';"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $agent_to_log = mysql_num_rows($rslt); @@ -4387,7 +4408,40 @@ if ($function == 'agent_status') $pause_code = $row[0]; } - $output .= "$status$DL$callerid$DL$lead_id$DL$campaign_id$DL$calls_today$DL$full_name$DL$user_group$DL$user_level$DL$pause_code\n"; + if ( ($on_hook_agent == 'Y') and (strlen($ring_callerid) > 18) ) + {$rtr_status = "RING";} + + if ( ($status == 'PAUSED') and ($lead_id > 0) ) + {$rtr_status = 'DISPO';} + + if ($status == 'INCALL') + { + if ($lead_id > 0) + { + $threewaystmt="select UNIX_TIMESTAMP(last_call_time) from vicidial_live_agents where lead_id='$lead_id' and status='INCALL' order by UNIX_TIMESTAMP(last_call_time) desc;"; + $threewayrslt=mysql_query($threewaystmt, $link); + if (mysql_num_rows($threewayrslt)>1) + {$rtr_status = '3-WAY';} + } + + $stmt="SELECT count(*) from parked_channels where channel_group='$callerid';"; + $rslt=mysql_query($stmt,$link); + $row=mysql_fetch_row($rslt); + $parked_channel = $row[0]; + if ($parked_channel > 0) + {$rtr_status = 'PARK';} + else + { + $stmt="SELECT count(*) from vicidial_auto_calls where callerid='$callerid';"; + $rslt=mysql_query($stmt,$link); + $row=mysql_fetch_row($rslt); + $live_channel = $row[0]; + if ($live_channel < 1) + {$rtr_status = 'DEAD';} + } + } + + $output .= "$status$DL$callerid$DL$lead_id$DL$campaign_id$DL$calls_today$DL$full_name$DL$user_group$DL$user_level$DL$pause_code$DL$rtr_status\n"; echo "$output"; diff --git a/agc_2-X/trunk/www/vicidial/phone_stats.php b/agc_2-X/trunk/www/vicidial/phone_stats.php index b10b00d8..06cce388 100644 --- a/agc_2-X/trunk/www/vicidial/phone_stats.php +++ b/agc_2-X/trunk/www/vicidial/phone_stats.php @@ -11,9 +11,11 @@ # 90508-0644 - Changed to PHP long tags # 120223-2135 - Removed logging of good login passwords if webroot writable is enabled # 130610-1110 - Finalized changing of all ereg instances to preg +# 130617-2156 - Added filtering of input to prevent SQL injection attacks and new user auth # require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -21,9 +23,9 @@ $PHP_SELF=$_SERVER['PHP_SELF']; if (isset($_GET["group"])) {$group=$_GET["group"];} elseif (isset($_POST["group"])) {$group=$_POST["group"];} if (isset($_GET["query_date"])) {$query_date=$_GET["query_date"];} - elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];} + elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];} if (isset($_GET["begin_date"])) {$begin_date=$_GET["begin_date"];} - elseif (isset($_POST["begin_date"])) {$begin_date=$_POST["begin_date"];} + elseif (isset($_POST["begin_date"])) {$begin_date=$_POST["begin_date"];} if (isset($_GET["end_date"])) {$end_date=$_GET["end_date"];} elseif (isset($_POST["end_date"])) {$end_date=$_POST["end_date"];} if (isset($_GET["extension"])) {$extension=$_GET["extension"];} @@ -35,9 +37,9 @@ if (isset($_GET["user"])) {$user=$_GET["user"];} if (isset($_GET["full_name"])) {$full_name=$_GET["full_name"];} elseif (isset($_POST["full_name"])) {$full_name=$_POST["full_name"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} - elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} + elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} - elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} + elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### @@ -45,91 +47,115 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysql_num_rows($rslt); -$i=0; -while ($i < $qm_conf_ct) +if ($qm_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; $SSoutbound_autodial_active = $row[2]; $user_territories_active = $row[3]; - $i++; } ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - $STARTtime = date("U"); $TODAY = date("Y-m-d"); $admin_page = './admin.php'; - -if (!isset($begin_date)) {$begin_date = $TODAY;} -if (!isset($end_date)) {$end_date = $TODAY;} - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';"; -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$fp = fopen ("./project_auth_entries.txt", "a"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if (!isset($begin_date)) {$begin_date = $TODAY;} +if (!isset($end_date)) {$end_date = $TODAY;} + +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-ASTERISK\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); } else { - if($auth>0) + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } +$extension = preg_replace("/'|\"|\\\\|;/", '', $extension); +$server_ip = preg_replace("/'|\"|\\\\|;/", '', $server_ip); +$begin_date = preg_replace("/'|\"|\\\\|;/","",$begin_date); +$end_date = preg_replace("/'|\"|\\\\|;/","",$end_date); + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname=$row[0]; - if ($webroot_writable > 0) - { - fwrite ($fp, "ASTERISK|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - ##### get server listing for dynamic pulldown - $stmt="SELECT fullname from phones where server_ip='$server_ip' and extension='$extension'"; - $rsltx=mysql_query($stmt, $link); - $rowx=mysql_fetch_row($rsltx); - $fullname = $row[0]; + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; } - else + if ( ($reports_auth > 0) and ($admin_auth < 1) ) { - if ($webroot_writable > 0) - { - fwrite ($fp, "ASTERISK|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } + $ADD=999999; + $reports_only_user=1; } } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGfullname=$row[0]; + +##### get server listing for dynamic pulldown +$stmt="SELECT fullname from phones where server_ip='$server_ip' and extension='$extension';"; +$rsltx=mysql_query($stmt, $link); +$rowx=mysql_fetch_row($rsltx); +$fullname = $row[0]; ?> -VICIDIAL ADMIN: Phone Stats +ADMIN: Phone Stats
- +
  VICIDIAL ADMIN: Administration  
- - \n"; echo ""; echo ""; echo ""; @@ -82,12 +86,14 @@ if (($ADD==881) && ($qc_auth=='1')) { echo "\n"; } $row=mysql_fetch_row($rslt); - if (eregi("1$|3$|5$|7$|9$", $o)) { + if (preg_match("/1$|3$|5$|7$|9$/i", $o)) + { $bgcolor='bgcolor="#B9CBFD"'; - } - else { + } + else + { $bgcolor='bgcolor="#9BB9FB"'; - } + } echo ""; echo ""; $lead_name=trim($row[1].' '.$row[2]); diff --git a/agc_2-X/trunk/www/vicidial/qc/QC_call_client_iframe.php b/agc_2-X/trunk/www/vicidial/qc/QC_call_client_iframe.php index e5c13f1a..53652c20 100644 --- a/agc_2-X/trunk/www/vicidial/qc/QC_call_client_iframe.php +++ b/agc_2-X/trunk/www/vicidial/qc/QC_call_client_iframe.php @@ -6,14 +6,18 @@ # QC_call_client_iframe.php # # Copyright (C) 2012 poundteam.com LICENSE: AGPLv2 +# Copyright (C) 2013 Matt Florell LICENSE: AGPLv2 # # This script is designed to allow QC review and modification of leads, contributed by poundteam.com # # changes: # 121116-1328 - First build, added to vicidial codebase +# 130621-2352 - Finalized changing of all ereg instances to preg +# - Added filtering of input to prevent SQL injection attacks and new user auth # require("../dbconnect.php"); +require("../functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -121,9 +125,6 @@ if (isset($_POST["appointment_date"])) {$appointment_date=$_POST["appointment_ if (isset($_POST["appointment_time"])) {$appointment_time=$_POST["appointment_time"];} elseif (isset($_GET["appointment_time"])) {$appointment_time=$_GET["appointment_time"];} -$PHP_AUTH_USER = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_USER); -$PHP_AUTH_PW = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_PW); - $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); @@ -143,71 +144,70 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -if ($non_latin < 1) - { - $PHP_AUTH_USER = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_USER); - $PHP_AUTH_PW = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_PW); - - $old_phone = ereg_replace("[^0-9]","",$old_phone); - $phone_number = ereg_replace("[^0-9]","",$phone_number); - $alt_phone = ereg_replace("[^0-9]","",$alt_phone); - } # end of non_latin -else - { - $PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER); - $PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW); - } - -if (strlen($phone_number)<6) {$phone_number=$old_phone;} - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and qc_enabled = '1' and qc_user_level > 0;"; -if ($DB) {echo "|$stmt|\n";} -if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -if ($WeBRooTWritablE > 0) - {$fp = fopen ("../project_auth_entries.txt", "a");} - $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); + + $old_phone = preg_replace('/[^0-9]/','',$old_phone); + $phone_number = preg_replace('/[^0-9]/','',$phone_number); + $alt_phone = preg_replace('/[^0-9]/','',$alt_phone); + } # end of non_latin else { - - if($auth>0) - { - $stmt="SELECT full_name,modify_leads from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname =$row[0]; - $LOGmodify_leads =$row[1]; - - if ($WeBRooTWritablE > 0) - { - fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($WeBRooTWritablE > 0) - { - fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|\n"); - fclose($fp); - } - } + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); } +if (strlen($phone_number)<6) {$phone_number=$old_phone;} + +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$rights_stmt = "SELECT modify_leads,qc_enabled,qc_user_level from vicidial_users where user='$PHP_AUTH_USER';"; +if ($DB) {echo "|$stmt|\n";} +$rights_rslt=mysql_query($rights_stmt, $link); +$rights_row=mysql_fetch_row($rights_rslt); +$modify_leads = $rights_row[0]; +$qc_enabled = $rights_row[1]; +$qc_user_level = $rights_row[2]; + +if ( $qc_enabled < 1 ) + { + header ("Content-type: text/html; charset=utf-8"); + echo "QC is not enabled for your user account\n"; + exit; + } +if ( $qc_user_level < 1 ) + { + header ("Content-type: text/html; charset=utf-8"); + echo "QC user level is too low\n"; + exit; + } + + $label_title = 'Title'; $label_first_name = 'First'; $label_middle_initial = 'MI'; diff --git a/agc_2-X/trunk/www/vicidial/qc/QC_status_codes_include.php b/agc_2-X/trunk/www/vicidial/qc/QC_status_codes_include.php index e763e5f6..a9109fbb 100644 --- a/agc_2-X/trunk/www/vicidial/qc/QC_status_codes_include.php +++ b/agc_2-X/trunk/www/vicidial/qc/QC_status_codes_include.php @@ -2,11 +2,13 @@ # QC_status_codes_include.php # # Copyright (C) 2012 poundteam.com LICENSE: AGPLv2 +# Copyright (C) 2013 Matt Florell LICENSE: AGPLv2 # # This script is designed to display admin sections for QC functions, contributed by poundteam.com # # changes: # 121116-1323 - First build, added to vicidial codebase +# 130621-2353 - Finalized changing of all ereg instances to preg # /* @@ -44,7 +46,7 @@ if ($ADD==241111111111111) ### LOG INSERTION Admin Log Table ### $SQL_log = "$stmt|"; - $SQL_log = ereg_replace(';','',$SQL_log); + $SQL_log = preg_replace('/;/', '', $SQL_log); $SQL_log = addslashes($SQL_log); $stmt="INSERT INTO vicidial_admin_log set event_date='$SQLdate', user='$PHP_AUTH_USER', ip_address='$ip', event_section='QCSTATUSES', event_type='ADD', record_id='$code', event_code='ADMIN ADD QC STATUS', event_sql=\"$SQL_log\", event_notes='';"; if ($DB) {echo "|$stmt|\n";} @@ -73,7 +75,7 @@ if ($ADD==341111111111111) echo ""; echo "
\n"; - echo "VICIDIAL QC STATUS CODES WITHIN THIS SYSTEM:   $NWB#vicidial_qc_status_codes$NWE
\n"; + echo "QC STATUS CODES WITHIN THIS SYSTEM:   $NWB#vicidial_qc_status_codes$NWE
\n"; echo "
  ADMIN: Administration  
  LIST ALL PHONES | ADD A NEW PHONE | SEARCH FOR A PHONE | ADD A SERVER | LIST ALL SERVERS
  SHOW ALL CONFERENCES | ADD A NEW CONFERENCE
  \n"; @@ -148,9 +174,9 @@ echo "
\n"; - $stmt="SELECT count(*),channel_group, sum(length_in_sec) from call_log where extension='" . mysql_real_escape_string($extension) . "' and server_ip='" . mysql_real_escape_string($server_ip) . "' and start_time >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and start_time <= '" . mysql_real_escape_string($end_date) . " 23:59:59' group by channel_group order by channel_group"; - $rslt=mysql_query($stmt, $link); - $statuses_to_print = mysql_num_rows($rslt); +$stmt="SELECT count(*),channel_group, sum(length_in_sec) from call_log where extension='" . mysql_real_escape_string($extension) . "' and server_ip='" . mysql_real_escape_string($server_ip) . "' and start_time >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and start_time <= '" . mysql_real_escape_string($end_date) . " 23:59:59' group by channel_group order by channel_group"; +$rslt=mysql_query($stmt, $link); +$statuses_to_print = mysql_num_rows($rslt); # echo "|$stmt|\n"; echo "
\n"; @@ -160,31 +186,32 @@ echo "CALL TIME AND CHANNELS:\n"; echo "
\n"; echo "\n"; - $total_calls=0; - $o=0; - while ($statuses_to_print > $o) { - $row=mysql_fetch_row($rslt); - if (preg_match('/1$|3$|5$|7$|9$/i', $o)) - {$bgcolor='bgcolor="#B9CBFD"';} - else - {$bgcolor='bgcolor="#9BB9FB"';} +$total_calls=0; +$o=0; +while ($statuses_to_print > $o) + { + $row=mysql_fetch_row($rslt); + if (preg_match('/1$|3$|5$|7$|9$/i', $o)) + {$bgcolor='bgcolor="#B9CBFD"';} + else + {$bgcolor='bgcolor="#9BB9FB"';} - $call_seconds = $row[2]; - $call_hours = ($call_seconds / 3600); - $call_hours = round($call_hours, 2); - $call_hours_int = intval("$call_hours"); - $call_minutes = ($call_hours - $call_hours_int); - $call_minutes = ($call_minutes * 60); - $call_minutes_int = round($call_minutes, 0); - if ($call_minutes_int < 10) {$call_minutes_int = "0$call_minutes_int";} + $call_seconds = $row[2]; + $call_hours = ($call_seconds / 3600); + $call_hours = round($call_hours, 2); + $call_hours_int = intval("$call_hours"); + $call_minutes = ($call_hours - $call_hours_int); + $call_minutes = ($call_minutes * 60); + $call_minutes_int = round($call_minutes, 0); + if ($call_minutes_int < 10) {$call_minutes_int = "0$call_minutes_int";} - echo ""; - echo "\n"; - echo "\n"; - $total_calls = ($total_calls + $row[0]); + echo ""; + echo "\n"; + echo "\n"; + $total_calls = ($total_calls + $row[0]); - $call_seconds=0; - $o++; + $call_seconds=0; + $o++; } $stmt="SELECT sum(length_in_sec) from call_log where extension='" . mysql_real_escape_string($extension) . "' and server_ip='" . mysql_real_escape_string($server_ip) . "' and start_time >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and start_time <= '" . mysql_real_escape_string($end_date) . " 23:59:59'"; @@ -211,45 +238,40 @@ echo "LAST 1000 CALLS FOR DATE RANGE:\n"; echo "
CHANNEL GROUP COUNT HOURS:MINUTES
$row[1] $row[0] $call_hours_int:$call_minutes_int
$row[1] $row[0] $call_hours_int:$call_minutes_int
\n"; echo "\n"; - $stmt="SELECT number_dialed,channel_group,start_time,length_in_min from call_log where extension='" . mysql_real_escape_string($extension) . "' and server_ip='" . mysql_real_escape_string($server_ip) . "' and start_time >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and start_time <= '" . mysql_real_escape_string($end_date) . " 23:59:59' LIMIT 1000"; - $rslt=mysql_query($stmt, $link); - $events_to_print = mysql_num_rows($rslt); +$stmt="SELECT number_dialed,channel_group,start_time,length_in_min from call_log where extension='" . mysql_real_escape_string($extension) . "' and server_ip='" . mysql_real_escape_string($server_ip) . "' and start_time >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and start_time <= '" . mysql_real_escape_string($end_date) . " 23:59:59' LIMIT 1000"; +$rslt=mysql_query($stmt, $link); +$events_to_print = mysql_num_rows($rslt); # echo "|$stmt|\n"; - $total_calls=0; - $o=0; - $event_start_seconds=''; - $event_stop_seconds=''; - while ($events_to_print > $o) { - $row=mysql_fetch_row($rslt); - if (preg_match('/1$|3$|5$|7$|9$/i', $o)) - {$bgcolor='bgcolor="#B9CBFD"';} - else - {$bgcolor='bgcolor="#9BB9FB"';} - echo ""; - echo "\n"; - echo "\n"; - echo "\n"; +$total_calls=0; +$o=0; +$event_start_seconds=''; +$event_stop_seconds=''; +while ($events_to_print > $o) + { + $row=mysql_fetch_row($rslt); + if (preg_match('/1$|3$|5$|7$|9$/i', $o)) + {$bgcolor='bgcolor="#B9CBFD"';} + else + {$bgcolor='bgcolor="#9BB9FB"';} + echo ""; + echo "\n"; + echo "\n"; + echo "\n"; - - $call_seconds=0; - $o++; + $call_seconds=0; + $o++; } - echo "
NUMBER CHANNEL GROUP DATE LENGTH(MIN.)
$row[0] $row[1] $row[2] $row[3]
$row[0] $row[1] $row[2] $row[3]
\n"; - $ENDtime = date("U"); $RUNtime = ($ENDtime - $STARTtime); echo "\n\n\n


\n\n"; - - echo "\n\n\n


\nscript runtime: $RUNtime seconds"; - ?> @@ -261,11 +283,5 @@ echo "\n\n\n


\nscript runtime: $RUNtime seconds"; exit; - - ?> - - - - diff --git a/agc_2-X/trunk/www/vicidial/qc/QC_admin_include01.php b/agc_2-X/trunk/www/vicidial/qc/QC_admin_include01.php index e4cddc33..0d5f08c7 100644 --- a/agc_2-X/trunk/www/vicidial/qc/QC_admin_include01.php +++ b/agc_2-X/trunk/www/vicidial/qc/QC_admin_include01.php @@ -2,11 +2,13 @@ # QC_admin_include01.php # # Copyright (C) 2012 poundteam.com LICENSE: AGPLv2 +# Copyright (C) 2013 Matt Florell LICENSE: AGPLv2 # # This script is designed to be used by admin.php with QC enabled, contributed by poundteam.com # # changes: # 121116-1334 - First build, added to vicidial codebase +# 130621-2351 - Finalized changing of all ereg instances to preg # //Line 28030 admin.php ###################### @@ -32,12 +34,14 @@ if (($ADD==100000000000000) && ($qc_auth=='1')) { $o=0; while ($vicidialconf_to_print > $o) { $row=mysql_fetch_row($rslt); - if (eregi("1$|3$|5$|7$|9$", $o)) { + if (preg_match("/1$|3$|5$|7$|9$/i", $o)) + { $bgcolor='bgcolor="#B9CBFD"'; - } - else { + } + else + { $bgcolor='bgcolor="#9BB9FB"'; - } + } echo "
$row[0] $row[1] $row[2]UserID
  $row[0]
\n"; echo "\n"; @@ -92,7 +94,7 @@ if ($ADD==341111111111111) $rowx=mysql_fetch_row($rslt); $o++; - if (eregi("1$|3$|5$|7$|9$", $o)) + if (preg_match("/1$|3$|5$|7$|9$/i", $o)) {$bgcolor='bgcolor="#B9CBFD"';} else {$bgcolor='bgcolor="#9BB9FB"';} diff --git a/agc_2-X/trunk/www/vicidial/qc/qc_api.php b/agc_2-X/trunk/www/vicidial/qc/qc_api.php index 754baeda..46fda92e 100644 --- a/agc_2-X/trunk/www/vicidial/qc/qc_api.php +++ b/agc_2-X/trunk/www/vicidial/qc/qc_api.php @@ -2,17 +2,21 @@ # qc_api.php # # Copyright (C) 2012 poundteam.com LICENSE: AGPLv2 +# Copyright (C) 2013 Matt Florell LICENSE: AGPLv2 # # This script is designed to allow API functions for QC applications, contributed by poundteam.com # # changes: # 121116-1329 - First build, added to vicidial codebase +# 130622-0001 - Finalized changing of all ereg instances to preg +# - Added filtering of input to prevent SQL injection attacks and new user auth # -$version = '2.6-1'; +$version = '2.8-2'; $build = '121116-1329'; require("../dbconnect.php"); +require("../functions.php"); $query_string = getenv("QUERY_STRING"); @@ -124,7 +128,6 @@ if (isset($_GET["consultative"])) {$consultative=$_GET["consultative"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} - header ("Content-type: text/html; charset=utf-8"); header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 header ("Pragma: no-cache"); // HTTP/1.0 @@ -143,65 +146,74 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$ingroup_choices = ereg_replace("\+"," ",$ingroup_choices); -$query_string = ereg_replace("'|\"|\\\\|;","",$query_string); +$ingroup_choices = preg_replace("/\+/"," ",$ingroup_choices); +$query_string = preg_replace("/'|\"|\\\\|;/","",$query_string); if ($non_latin < 1) { - $user=ereg_replace("[^0-9a-zA-Z]","",$user); - $pass=ereg_replace("[^0-9a-zA-Z]","",$pass); - $agent_user=ereg_replace("[^0-9a-zA-Z]","",$agent_user); - $function = ereg_replace("[^-\_0-9a-zA-Z]","",$function); - $value = ereg_replace("[^-\_0-9a-zA-Z]","",$value); - $vendor_id = ereg_replace("[^-\_0-9a-zA-Z]","",$vendor_id); - $focus = ereg_replace("[^-\_0-9a-zA-Z]","",$focus); - $preview = ereg_replace("[^-\_0-9a-zA-Z]","",$preview); - $notes = ereg_replace("\+"," ",$notes); - $notes = ereg_replace("[^ -\.\_0-9a-zA-Z]","",$notes); - $phone_code = ereg_replace("[^0-9X]","",$phone_code); - $search = ereg_replace("[^-\_0-9a-zA-Z]","",$search); - $group_alias = ereg_replace("[^0-9a-zA-Z]","",$group_alias); - $dial_prefix = ereg_replace("[^0-9a-zA-Z]","",$dial_prefix); - $source = ereg_replace("[^0-9a-zA-Z]","",$source); - $format = ereg_replace("[^0-9a-zA-Z]","",$format); - $vtiger_callback = ereg_replace("[^A-Z]","",$vtiger_callback); - $blended = ereg_replace("[^A-Z]","",$blended); - $ingroup_choices = ereg_replace("[^ -\_0-9a-zA-Z]","",$ingroup_choices); - $set_as_default = ereg_replace("[^A-Z]","",$set_as_default); - $phone_number = ereg_replace("[^0-9]","",$phone_number); - $address1 = ereg_replace("[^ -\_0-9a-zA-Z]","",$address1); - $address2 = ereg_replace("[^ -\_0-9a-zA-Z]","",$address2); - $address3 = ereg_replace("[^ -\_0-9a-zA-Z]","",$address3); - $alt_phone = ereg_replace("[^ -\_0-9a-zA-Z]","",$alt_phone); - $city = ereg_replace("[^ -\_0-9a-zA-Z]","",$city); - $comments = ereg_replace("[^ -\_0-9a-zA-Z]","",$comments); - $country_code = ereg_replace("[^A-Z]","",$country_code); - $date_of_birth = ereg_replace("[^ -\_0-9]","",$date_of_birth); - $email = ereg_replace("[^-\.\:\/\@\_0-9a-zA-Z]","",$email); - $first_name = ereg_replace("[^ -\_0-9a-zA-Z]","",$first_name); - $gender = ereg_replace("[^A-Z]","",$gender); - $gmt_offset_now = ereg_replace("[^ \.-\_0-9]","",$gmt_offset_now); - $last_name = ereg_replace("[^ -\_0-9a-zA-Z]","",$last_name); - $lead_id = ereg_replace("[^0-9]","",$lead_id); - $middle_initial = ereg_replace("[^ -\_0-9a-zA-Z]","",$middle_initial); - $province = ereg_replace("[^ -\.\_0-9a-zA-Z]","",$province); - $security_phrase = ereg_replace("[^ -\.\_0-9a-zA-Z]","",$security_phrase); - $source_id = ereg_replace("[^ -\.\_0-9a-zA-Z]","",$source_id); - $state = ereg_replace("[^ -\_0-9a-zA-Z]","",$state); - $title = ereg_replace("[^ -\_0-9a-zA-Z]","",$title); - $vendor_lead_code = ereg_replace("[^ -\.\_0-9a-zA-Z]","",$vendor_lead_code); - $rank = ereg_replace("[^-0-9]","",$rank); - $owner = ereg_replace("[^-\.\:\/\@\_0-9a-zA-Z]","",$owner); - $dial_override = ereg_replace("[^A-Z]","",$dial_override); - $consultative = ereg_replace("[^A-Z]","",$consultative); + $user=preg_replace("/[^0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^0-9a-zA-Z]/","",$pass); + $agent_user=preg_replace("/[^0-9a-zA-Z]/","",$agent_user); + $function = preg_replace("/[^-\_0-9a-zA-Z]/","",$function); + $value = preg_replace("/[^-\_0-9a-zA-Z]/","",$value); + $vendor_id = preg_replace("/[^-\.\_0-9a-zA-Z]/","",$vendor_id); + $focus = preg_replace("/[^-\_0-9a-zA-Z]/","",$focus); + $preview = preg_replace("/[^-\_0-9a-zA-Z]/","",$preview); + $notes = preg_replace("/\+/"," ",$notes); + $notes = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$notes); + $phone_code = preg_replace("/[^0-9X]/","",$phone_code); + $search = preg_replace("/[^-\_0-9a-zA-Z]/","",$search); + $group_alias = preg_replace("/[^0-9a-zA-Z]/","",$group_alias); + $dial_prefix = preg_replace("/[^0-9a-zA-Z]/","",$dial_prefix); + $source = preg_replace("/[^0-9a-zA-Z]/","",$source); + $format = preg_replace("/[^0-9a-zA-Z]/","",$format); + $vtiger_callback = preg_replace("/[^A-Z]/","",$vtiger_callback); + $alt_dial = preg_replace("/[^0-9A-Z]/","",$alt_dial); + $blended = preg_replace("/[^A-Z]/","",$blended); + $ingroup_choices = preg_replace("/[^- \_0-9a-zA-Z]/","",$ingroup_choices); + $set_as_default = preg_replace("/[^A-Z]/","",$set_as_default); + $phone_number = preg_replace("/[^0-9]/","",$phone_number); + $address1 = preg_replace("/[^- \_0-9a-zA-Z]/","",$address1); + $address2 = preg_replace("/[^- \_0-9a-zA-Z]/","",$address2); + $address3 = preg_replace("/[^- \_0-9a-zA-Z]/","",$address3); + $alt_phone = preg_replace("/[^- \_0-9a-zA-Z]/","",$alt_phone); + $city = preg_replace("/[^- \_0-9a-zA-Z]/","",$city); + $comments = preg_replace("/[^- \_0-9a-zA-Z]/","",$comments); + $country_code = preg_replace("/[^A-Z]/","",$country_code); + $date_of_birth = preg_replace("/[^- \_0-9]/","",$date_of_birth); + $email = preg_replace("/[^-\.\:\/\@\_0-9a-zA-Z]/","",$email); + $first_name = preg_replace("/[^- \_0-9a-zA-Z]/","",$first_name); + $gender = preg_replace("/[^A-Z]/","",$gender); + $gmt_offset_now = preg_replace("/[^- \.\_0-9]/","",$gmt_offset_now); + $last_name = preg_replace("/[^- \_0-9a-zA-Z]/","",$last_name); + $lead_id = preg_replace("/[^0-9]/","",$lead_id); + $middle_initial = preg_replace("/[^- \_0-9a-zA-Z]/","",$middle_initial); + $province = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$province); + $security_phrase = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$security_phrase); + $source_id = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$source_id); + $state = preg_replace("/[^- \_0-9a-zA-Z]/","",$state); + $title = preg_replace("/[^- \_0-9a-zA-Z]/","",$title); + $vendor_lead_code = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$vendor_lead_code); + $rank = preg_replace("/[^-0-9]/","",$rank); + $owner = preg_replace("/[^-\.\:\/\@\_0-9a-zA-Z]/","",$owner); + $dial_override = preg_replace("/[^A-Z]/","",$dial_override); + $consultative = preg_replace("/[^A-Z]/","",$consultative); + $callback_datetime = preg_replace("/\+/"," ",$callback_datetime); + $callback_datetime = preg_replace("/[^- \:\.\_0-9a-zA-Z]/","",$callback_datetime); + $callback_type = preg_replace("/[^A-Z]/","",$callback_type); + $callback_comments = preg_replace("/\+/"," ",$callback_comments); + $callback_comments = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$callback_comments); + $qm_dispo_code = preg_replace("/[^-\.\_0-9a-zA-Z]/","",$qm_dispo_code); + $alt_user = preg_replace("/[^0-9a-zA-Z]/","",$alt_user); + $postal_code = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$postal_code); } else { - $user = ereg_replace("'|\"|\\\\|;","",$user); - $pass = ereg_replace("'|\"|\\\\|;","",$pass); - $source = ereg_replace("'|\"|\\\\|;","",$source); - $agent_user = ereg_replace("'|\"|\\\\|;","",$agent_user); - $alt_user = ereg_replace("'|\"|\\\\|;","",$alt_user); + $user = preg_replace("/'|\"|\\\\|;/","",$user); + $pass = preg_replace("/'|\"|\\\\|;/","",$pass); + $source = preg_replace("/'|\"|\\\\|;/","",$source); + $agent_user = preg_replace("/'|\"|\\\\|;/","",$agent_user); + $alt_user = preg_replace("/'|\"|\\\\|;/","",$alt_user); } ### date and fixed variables @@ -256,18 +268,23 @@ else } else { - $stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and vdc_agent_api_access = '1';"; + $auth=0; + $auth_message = user_authorization($user,$pass,'',0); + if ($auth_message == 'GOOD') + {$auth=1;} + + $stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); - $auth=$row[0]; + $auth_api=$row[0]; - if( (strlen($user)<2) or (strlen($pass)<2) or ($auth==0)) + if( (strlen($user)<2) or (strlen($pass)<2) or ($auth==0) or ($auth_api==0)) { $result = 'ERROR'; $result_reason = "Invalid Username/Password"; - echo "$result: $result_reason: |$user|$pass|$auth|\n"; + echo "$result: $result_reason: |$user|$pass|$auth|$auth_api|$auth_message|\n"; $data = "$user|$pass|$auth"; api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data); exit; @@ -319,7 +336,7 @@ if ($format=='debug') ################################################################################ if ($function == 'external_dial_lead') { - $value = ereg_replace("[^0-9]","",$value); + $value = preg_replace("/[^0-9]/","",$value); if ( (strlen($value)<1) or ( (strlen($agent_user)<2) and (strlen($alt_user)<2) ) or (strlen($search)<2) or (strlen($preview)<2) or (strlen($focus)<2) ) { @@ -429,7 +446,7 @@ if ($function == 'external_dial_lead') ####### Begin Vtiger CallBack Launching ####### $vtiger_callback_id=''; - if ( (eregi("YES",$vtiger_callback)) and (preg_match("/^99/",$value)) ) + if ( (preg_match("/YES/i",$vtiger_callback)) and (preg_match("/^99/",$value)) ) { $value = preg_replace("/^99/",'',$value); $value = ($value + 0); diff --git a/agc_2-X/trunk/www/vicidial/qc/qc_modify_lead.php b/agc_2-X/trunk/www/vicidial/qc/qc_modify_lead.php index 55652d34..8cb45531 100644 --- a/agc_2-X/trunk/www/vicidial/qc/qc_modify_lead.php +++ b/agc_2-X/trunk/www/vicidial/qc/qc_modify_lead.php @@ -6,15 +6,19 @@ # qc_modify_lead.php # # Copyright (C) 2012 poundteam.com LICENSE: AGPLv2 +# Copyright (C) 2013 Matt Florell LICENSE: AGPLv2 # # This script is designed to allow QC review and modification of leads, contributed by poundteam.com # # changes: # 121116-1324 - First build, added to vicidial codebase # 121130-1034 - Changed scheduled callback user ID field to be 20 characters, issue #467 +# 130621-2328 - Finalized changing of all ereg instances to preg +# - Added filtering of input to prevent SQL injection attacks and new user auth # require("../dbconnect.php"); +require("../functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -122,9 +126,6 @@ if (isset($_POST["appointment_date"])) {$appointment_date=$_POST["appointment_ if (isset($_POST["appointment_time"])) {$appointment_time=$_POST["appointment_time"];} elseif (isset($_GET["appointment_time"])) {$appointment_time=$_GET["appointment_time"];} -$PHP_AUTH_USER = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_USER); -$PHP_AUTH_PW = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_PW); - $STARTtime = date("U"); $defaultappointment = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); @@ -146,69 +147,69 @@ if ($qm_conf_ct > 0) if ($non_latin < 1) { - $PHP_AUTH_USER = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_USER); - $PHP_AUTH_PW = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); - $old_phone = ereg_replace("[^0-9]","",$old_phone); - $phone_number = ereg_replace("[^0-9]","",$phone_number); - $alt_phone = ereg_replace("[^0-9]","",$alt_phone); + $old_phone = preg_replace('/[^0-9]/','',$old_phone); + $phone_number = preg_replace('/[^0-9]/','',$phone_number); + $alt_phone = preg_replace('/[^0-9]/','',$alt_phone); } # end of non_latin else { - $PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER); - $PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); } if (strlen($phone_number)<6) {$phone_number=$old_phone;} -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and qc_enabled = '1' and qc_user_level > 0;"; +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$rights_stmt = "SELECT modify_leads,qc_enabled from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} -if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} +$rights_rslt=mysql_query($rights_stmt, $link); +$rights_row=mysql_fetch_row($rights_rslt); +$modify_leads = $rights_row[0]; +$qc_enabled = $rights_row[1]; + +# check their permissions +#if ( $modify_leads < 1 ) +# { +# header ("Content-type: text/html; charset=utf-8"); +# echo "You do not have permissions to modify leads\n"; +# exit; +# } +if ( $qc_enabled < 1 ) + { + header ("Content-type: text/html; charset=utf-8"); + echo "QC is not enabled for your user account\n"; + exit; + } + +$stmt="SELECT full_name,modify_leads,user_group from vicidial_users where user='$PHP_AUTH_USER';"; $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); -$auth=$row[0]; - -if ($WeBRooTWritablE > 0) - {$fp = fopen ("../project_auth_entries.txt", "a");} - -$date = date("r"); -$ip = getenv("REMOTE_ADDR"); -$browser = getenv("HTTP_USER_AGENT"); - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) - { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } -else - { - - if($auth>0) - { - $stmt="SELECT full_name,modify_leads,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname =$row[0]; - $LOGmodify_leads =$row[1]; - $LOGuser_group =$row[2]; - - if ($WeBRooTWritablE > 0) - { - fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($WeBRooTWritablE > 0) - { - fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|\n"); - fclose($fp); - } - } - } +$LOGfullname =$row[0]; +$LOGmodify_leads =$row[1]; +$LOGuser_group =$row[2]; $label_title = 'Title'; $label_first_name = 'First'; @@ -320,7 +321,7 @@ if ($end_call > 0) { } ### insert a NEW record to the vicidial_closer_log table $qcchangelist=mysql_real_escape_string($qcchangelist); - $view_epoch = ereg_replace("[^0-9]","",$_POST['viewtime']); + $view_epoch = preg_replace('/[^0-9]/','',$_POST['viewtime']); $elapsed_seconds=$STARTtime-$view_epoch; $stmt="UPDATE vicidial_qc_agent_log set save_datetime='$NOW_TIME',save_epoch='$STARTtime',elapsed_seconds='$elapsed_seconds',old_status='{$original_record['status']}',new_status='{$new_record['status']}',details='$qcchangelist' @@ -340,7 +341,7 @@ if ($end_call > 0) { echo "
Proceed to QC CAMPAIGN $campaign_id Queue

Callback Information:\n"; ### LOG INSERTION Admin Log Table ### $SQL_log = "$stmt|"; - $SQL_log = ereg_replace(';','',$SQL_log); + $SQL_log = preg_replace('/;/', '', $SQL_log); $SQL_log = addslashes($SQL_log); $stmt="INSERT INTO vicidial_admin_log set event_date='$NOW_TIME', user='$PHP_AUTH_USER', ip_address='$ip', event_section='LEADS', event_type='MODIFY', record_id='$lead_id', event_code='ADMIN MODIFY LEAD', event_sql=\"$SQL_log\", event_notes='';"; if ($DB) {echo "|$stmt|\n";} @@ -573,7 +574,7 @@ if ($end_call > 0) { echo __LINE__."\n"; } $row=mysql_fetch_row($rslt); - if (eregi("1$|3$|5$|7$|9$", $c)) + if (preg_match("/1$|3$|5$|7$|9$/i", $c)) {$bgcolor='bgcolor="#B9CBFD"';} else {$bgcolor='bgcolor="#9BB9FB"';} @@ -607,7 +608,7 @@ if ($end_call > 0) { if($DB) echo __LINE__."
\n"; $row=mysql_fetch_row($rslt); if (strlen($log_campaign)<1) {$log_campaign = $row[3];} - if (eregi("1$|3$|5$|7$|9$", $u)) + if (preg_match("/1$|3$|5$|7$|9$/i", $u)) {$bgcolor='bgcolor="#B9CBFD"';} else {$bgcolor='bgcolor="#9BB9FB"';} @@ -640,7 +641,7 @@ if ($end_call > 0) { { $row=mysql_fetch_row($rslt); if (strlen($Alog_campaign)<1) {$Alog_campaign = $row[5];} - if (eregi("1$|3$|5$|7$|9$", $y)) + if (preg_match("/1$|3$|5$|7$|9$/i", $y)) {$bgcolor='bgcolor="#B9CBFD"';} else {$bgcolor='bgcolor="#9BB9FB"';} @@ -675,7 +676,7 @@ if ($end_call > 0) { { $row=mysql_fetch_assoc($rslt); if (strlen($Alog_campaign)<1) {$Alog_campaign = $row[5];} - if (eregi("1$|3$|5$|7$|9$", $y)) + if (preg_match("/1$|3$|5$|7$|9$/i", $y)) {$bgcolor='bgcolor="#B9CBFD"';} else {$bgcolor='bgcolor="#9BB9FB"';} @@ -720,7 +721,7 @@ if ($end_call > 0) { { $row=mysql_fetch_row($rslt); if (strlen($Clog_campaign)<1) {$Clog_campaign = $row[3];} - if (eregi("1$|3$|5$|7$|9$", $y)) + if (preg_match("/1$|3$|5$|7$|9$/i", $y)) {$bgcolor='bgcolor="#B9CBFD"';} else {$bgcolor='bgcolor="#9BB9FB"';} @@ -882,7 +883,7 @@ if ($end_call > 0) { echo __LINE__."\n"; } $rowx=mysql_fetch_row($rslt); - if ( (strlen($dispo) == strlen($rowx[0])) and (eregi($dispo,$rowx[0])) ) + if ( (strlen($dispo) == strlen($rowx[0])) and (preg_match("/$dispo/",$rowx[0])) ) {$statuses_list .= "\n"; $DS++;} else {$statuses_list .= "\n";} @@ -1185,7 +1186,7 @@ if ($end_call > 0) { while ($logs_to_print > $u) { $row=mysql_fetch_row($rslt); - if (eregi("1$|3$|5$|7$|9$", $u)) + if (preg_match("/1$|3$|5$|7$|9$/i", $u)) {$bgcolor='bgcolor="#B9CBFD"';} else {$bgcolor='bgcolor="#9BB9FB"';} @@ -1195,9 +1196,9 @@ if ($end_call > 0) { if (strlen($location)>2) { $URLserver_ip = $location; - $URLserver_ip = eregi_replace('http://','',$URLserver_ip); - $URLserver_ip = eregi_replace('https://','',$URLserver_ip); - $URLserver_ip = eregi_replace("\/.*",'',$URLserver_ip); + $URLserver_ip = preg_replace('/http:\/\//i', '',$URLserver_ip); + $URLserver_ip = preg_replace('/https:\/\//i', '',$URLserver_ip); + $URLserver_ip = preg_replace('/\/.*/i', '',$URLserver_ip); $stmt="select count(*) from servers where server_ip='$URLserver_ip';"; $rsltx=mysql_query($stmt, $link); $rowx=mysql_fetch_row($rsltx); @@ -1208,9 +1209,13 @@ if ($end_call > 0) { $rsltx=mysql_query($stmt, $link); $rowx=mysql_fetch_row($rsltx); - if (eregi("ALT_IP",$rowx[0])) + if (preg_match("/ALT_IP/i",$rowx[0])) { - $location = eregi_replace($URLserver_ip, $rowx[1], $location); + $location = preg_replace("/$URLserver_ip/i", "$rowx[1]", $location); + } + if (preg_match("/EXTERNAL_IP/i",$rowx[0])) + { + $location = preg_replace("/$URLserver_ip/i", "$rowx[2]", $location); } } } @@ -1219,7 +1224,7 @@ if ($end_call > 0) { {$locat = substr($location,0,27); $locat = "$locat...";} else {$locat = $location;} - if ( (eregi("ftp",$location)) or (eregi("http",$location)) ) + if ( (preg_match('/ftp/i',$location)) or (preg_match('/http/i',$location)) ) {$location = "$locat";} else {$location = $locat;} diff --git a/agc_2-X/trunk/www/vicidial/realtime_report.php b/agc_2-X/trunk/www/vicidial/realtime_report.php index b69e8f77..062266b2 100644 --- a/agc_2-X/trunk/www/vicidial/realtime_report.php +++ b/agc_2-X/trunk/www/vicidial/realtime_report.php @@ -23,12 +23,13 @@ # 121129-2131 - Fixed Choose link position # 130414-0247 - Added report logging # 130610-0944 - Finalized changing of all ereg instances to preg +# 130616-2237 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); -$version = '2.6-11'; -$build = '130414-0247'; +$version = '2.8-13'; +$build = '130616-2237'; header ("Content-type: text/html; charset=utf-8"); @@ -241,28 +242,91 @@ $epochTWENTYFOURhoursAGO = ($STARTtime - 86400); $timeTWENTYFOURhoursAGO = date("Y-m-d H:i:s",$epochTWENTYFOURhoursAGO); $webphone_content=''; -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; -if ($DB) {echo "|$stmt|\n";} -if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$reports_only_user=$row[0]; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } +$RR = preg_replace('/[^0-9]/', '', $RR); +$inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $inbound); +$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); +$groups[0] = preg_replace('/[^-_0-9a-zA-Z]/', '', $groups[0]); +$usergroup = preg_replace('/[^-_0-9a-zA-Z]/', '', $usergroup); +$DB = preg_replace('/[^0-9]/', '', $DB); +$adastats = preg_replace('/[^-_0-9a-zA-Z]/', '', $adastats); +$SIPmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $SIPmonitorLINK); +$IAXmonitorLINK = preg_replace('/[^-_0-9a-zA-Z]/', '', $IAXmonitorLINK); +$UGdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $UGdisplay); +$UidORname = preg_replace('/[^-_0-9a-zA-Z]/', '', $UidORname); +$orderby = preg_replace('/[^-_0-9a-zA-Z]/', '', $orderby); +$SERVdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $SERVdisplay); +$CALLSdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CALLSdisplay); +$PHONEdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHONEdisplay); +$CUSTPHONEdisplay = preg_replace('/[^-_0-9a-zA-Z]/', '', $CUSTPHONEdisplay); +$NOLEADSalert = preg_replace('/[^-_0-9a-zA-Z]/', '', $NOLEADSalert); +$DROPINGROUPstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $DROPINGROUPstats); +$ALLINGROUPstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $ALLINGROUPstats); +$with_inbound = preg_replace('/[^-_0-9a-zA-Z]/', '', $with_inbound); +$monitor_active = preg_replace('/[^-_0-9a-zA-Z]/', '', $monitor_active); +$monitor_phone = preg_replace('/[^-_0-9a-zA-Z]/', '', $monitor_phone); +$CARRIERstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $CARRIERstats); +$PRESETstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $PRESETstats); +$AGENTtimeSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $AGENTtimeSTATS); + + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } ##### BEGIN log visit to the vicidial_report_log table ##### @@ -296,9 +360,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ if ($auth) { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,callcard_admin,force_change_password,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,modify_contacts,modify_same_user_level from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW';"; + $stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,callcard_admin,force_change_password,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,modify_contacts,modify_same_user_level from vicidial_users where user='$PHP_AUTH_USER';"; $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $LOGfull_name =$row[3]; @@ -361,7 +423,7 @@ if ($auth) $vmLOGadmin_viewable_groupsSQL=''; if ( (!preg_match('/\-\-ALL\-\-/i',$LOGadmin_viewable_groups)) and (strlen($LOGadmin_viewable_groups) > 3) ) { - $rawLOGadmin_viewable_groupsSQL = preg_replace("/ -/",'',$LOGadmin_viewable_groups); + $rawLOGadmin_viewable_groupsSQL = preg_replace("/ \-/",'',$LOGadmin_viewable_groups); $rawLOGadmin_viewable_groupsSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_groupsSQL); $LOGadmin_viewable_groupsSQL = "and user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')"; $whereLOGadmin_viewable_groupsSQL = "where user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')"; @@ -376,14 +438,14 @@ if ($auth) # and (preg_match("/MONITOR|BARGE|HIJACK/",$monitor_active) ) ) if ( (!isset($monitor_phone)) or (strlen($monitor_phone)<1) ) { - $stmt="select phone_login from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and active='Y';"; + $stmt="select phone_login from vicidial_users where user='$PHP_AUTH_USER';"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $row=mysql_fetch_row($rslt); $monitor_phone = $row[0]; } -$stmt="SELECT realtime_block_user_info,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +$stmt="SELECT realtime_block_user_info,user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); @@ -402,7 +464,7 @@ $system_key = $row[4]; if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; @@ -443,6 +505,7 @@ $group_string='|'; $group_ct = count($groups); while($i < $group_ct) { + $groups[$i] = preg_replace('/[^-_0-9a-zA-Z]/', '', $groups[$i]); if ( (preg_match("/ $groups[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/ALL-/",$LOGallowed_campaigns)) ) { $group_string .= "$groups[$i]|"; @@ -459,6 +522,7 @@ $user_group_string='|'; $user_group_ct = count($user_group_filter); while($i < $user_group_ct) { + $user_group_filter[$i] = preg_replace('/[^-_0-9a-zA-Z]/', '', $user_group_filter[$i]); # if ( (preg_match("/ $user_group_filter[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/ALL-/",$LOGallowed_campaigns)) ) # { $user_group_string .= "$user_group_filter[$i]|"; diff --git a/agc_2-X/trunk/www/vicidial/record_conf_1_hour.php b/agc_2-X/trunk/www/vicidial/record_conf_1_hour.php index 3e553cc5..5d30ae53 100644 --- a/agc_2-X/trunk/www/vicidial/record_conf_1_hour.php +++ b/agc_2-X/trunk/www/vicidial/record_conf_1_hour.php @@ -12,9 +12,11 @@ # 90508-0644 - Changed to PHP long tags # 120223-2135 - Removed logging of good login passwords if webroot writable is enabled # 130610-1109 - Finalized changing of all ereg instances to preg +# 130616-2230 - Added filtering of input to prevent SQL injection attacks and new user auth # require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -24,13 +26,13 @@ if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];} if (isset($_GET["station"])) {$station=$_GET["station"];} elseif (isset($_POST["station"])) {$station=$_POST["station"];} if (isset($_GET["session_id"])) {$session_id=$_GET["session_id"];} - elseif (isset($_POST["session_id"])) {$session_id=$_POST["session_id"];} -if (isset($_GET["NEW_RECORDING"])) {$NEW_RECORDING=$_GET["NEW_RECORDING"];} - elseif (isset($_POST["NEW_RECORDING"])) {$NEW_RECORDING=$_POST["NEW_RECORDING"];} + elseif (isset($_POST["session_id"])) {$session_id=$_POST["session_id"];} +if (isset($_GET["NEW_RECORDING"])) {$NEW_RECORDING=$_GET["NEW_RECORDING"];} + elseif (isset($_POST["NEW_RECORDING"])) {$NEW_RECORDING=$_POST["NEW_RECORDING"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} - elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} + elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} - elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} + elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### @@ -38,97 +40,102 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysql_num_rows($rslt); -$i=0; -while ($i < $qm_conf_ct) +if ($qm_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; $SSoutbound_autodial_active = $row[2]; $user_territories_active = $row[3]; - $i++; } ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) - { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } - $STARTtime = date("U"); $TODAY = date("Y-m-d"); $MYSQL_datetime = date("Y-m-d H:i:s"); $FILE_datetime = date("Ymd-His_"); $secX = $STARTtime; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;"; -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$fp = fopen ("./project_auth_entries.txt", "a"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); } else { - if($auth>0) - { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname=$row[0]; - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } - } - - $stmt="SELECT full_name from vicidial_users where user='$user';"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $full_name = $row[0]; + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); } +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGfullname=$row[0]; + +$stmt="SELECT full_name from vicidial_users where user='$user';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$full_name = $row[0]; ?> -VICIDIAL RECORD CONFERENCE: 1 hour +RECORD CONFERENCE: 1 hour \n"; ?> @@ -138,45 +145,43 @@ echo "\n" 8) && (strlen($session_id) > 3) && (strlen($station) > 3) ) - { - $local_DEF = 'Local/'; - $local_AMP = '@'; - $conf_silent_prefix = '7'; - $ext_context = 'demo'; + { + $local_DEF = 'Local/'; + $local_AMP = '@'; + $conf_silent_prefix = '7'; + $ext_context = 'demo'; - $stmt="INSERT INTO vicidial_manager values('','','$MYSQL_datetime','NEW','N','" . mysql_real_escape_string($server_ip) . "','','Originate','RB$FILE_datetime" . mysql_real_escape_string($station) . "','Channel: $local_DEF$conf_silent_prefix" . mysql_real_escape_string($session_id) . "$local_AMP$ext_context','Context: $ext_context','Exten: 8309','Priority: 1','Callerid: $FILE_datetime" . mysql_real_escape_string($station) . "','','','','','')"; - echo "|$stmt|\n

\n"; - $rslt=mysql_query($stmt, $link); + $stmt="INSERT INTO vicidial_manager values('','','$MYSQL_datetime','NEW','N','" . mysql_real_escape_string($server_ip) . "','','Originate','RB$FILE_datetime" . mysql_real_escape_string($station) . "','Channel: $local_DEF$conf_silent_prefix" . mysql_real_escape_string($session_id) . "$local_AMP$ext_context','Context: $ext_context','Exten: 8309','Priority: 1','Callerid: $FILE_datetime" . mysql_real_escape_string($station) . "','','','','','')"; + echo "|$stmt|\n

\n"; + $rslt=mysql_query($stmt, $link); - $stmt="INSERT INTO recording_log (channel,server_ip,extension,start_time,start_epoch,filename) values('" . mysql_real_escape_string($session_id) . "','" . mysql_real_escape_string($server_ip) . "','" . mysql_real_escape_string($station) . "','$MYSQL_datetime','$secX','$FILE_datetime" . mysql_real_escape_string($station) . "')"; - echo "|$stmt|\n

\n"; - $rslt=mysql_query($stmt, $link); + $stmt="INSERT INTO recording_log (channel,server_ip,extension,start_time,start_epoch,filename) values('" . mysql_real_escape_string($session_id) . "','" . mysql_real_escape_string($server_ip) . "','" . mysql_real_escape_string($station) . "','$MYSQL_datetime','$secX','$FILE_datetime" . mysql_real_escape_string($station) . "')"; + echo "|$stmt|\n

\n"; + $rslt=mysql_query($stmt, $link); - echo "Recording started\n

\n"; - echo "Back to main recording screen\n

\n"; - } + echo "Recording started\n

\n"; + echo "Back to main recording screen\n

\n"; + } else - { - echo "ERROR!!!! Not all info entered properly\n

\n"; - echo "|$server_ip| |$session_id| |$station|\n

\n"; - echo "Back to main recording screen\n

\n"; + { + echo "ERROR!!!! Not all info entered properly\n

\n"; + echo "|$server_ip| |$session_id| |$station|\n

\n"; + echo "Back to main recording screen\n

\n"; + } } -} else -{ -echo "
Start recording a conference for 1 hour:
\n"; -echo "\n"; -echo "server_ip: | \n"; -echo "session_id: | \n"; -echo "station: | \n"; -echo "\n"; -echo "


\n"; - - - -} + { + echo "
Start recording a conference for 1 hour: \n"; + echo "\n"; + echo "server_ip: | \n"; + echo "session_id: | \n"; + echo "station: | \n"; + echo "\n"; + echo "


\n"; + } ?> - \ No newline at end of file + + diff --git a/agc_2-X/trunk/www/vicidial/recording_lookup.php b/agc_2-X/trunk/www/vicidial/recording_lookup.php index 2bf8c792..ae24ba29 100644 --- a/agc_2-X/trunk/www/vicidial/recording_lookup.php +++ b/agc_2-X/trunk/www/vicidial/recording_lookup.php @@ -2,6 +2,7 @@ ### recording_lookup.php # # REQUIRED! - check all paths and directory names, need to create a temp directory +# CUSTOMIZATION OF THIS SCRIPT IS REQUIRED FOR IT TO WORK!!! # # On the normal audio recording interface you now have the option of # downloading the WAV or GSM file: @@ -33,12 +34,13 @@ # 90508-0644 - Changed to PHP long tags # 120223-2129 - Removed logging of good login passwords if webroot writable is enabled # 130610-1108 - Finalized changing of all ereg instances to preg +# 130616-2228 - Added filtering of input to prevent SQL injection attacks # $STARTtime = date("U"); $TODAYstart = date("H/i/s 00:00:00"); -$linkAST=mysql_connect("10.10.10.15", "cron", "1234"); +$linkAST=mysql_connect("1.1.1.1", "cron", "1234"); mysql_select_db("asterisk"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; @@ -47,6 +49,10 @@ $PHP_SELF=$_SERVER['PHP_SELF']; if (isset($_GET["QUERY_recid"])) {$QUERY_recid=$_GET["QUERY_recid"];} elseif (isset($_POST["QUERY_recid"])) {$QUERY_recid=$_POST["QUERY_recid"];} +$QUERY_recid = preg_replace("/'|\"|\\\\|;/","",$QUERY_recid); +$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); +$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $web_server = '1.1.1.1'; $US='_'; @@ -93,9 +99,9 @@ else echo "searching for: $QUERY_recid\n"; echo "
\n";
 
-		$stmt="select recording_id,lead_id,user,filename,location,start_time,length_in_sec from recording_log where filename LIKE \"%$QUERY_recid%\" order by recording_id desc LIMIT 1;";
-		$rslt=mysql_query($stmt, $linkAST);
-		$logs_to_print = mysql_num_rows($rslt);
+	$stmt="select recording_id,lead_id,user,filename,location,start_time,length_in_sec from recording_log where filename LIKE \"%$QUERY_recid%\" order by recording_id desc LIMIT 1;";
+	$rslt=mysql_query($stmt, $linkAST);
+	$logs_to_print = mysql_num_rows($rslt);
 	#echo "|$stmt|";
 
 	$u=0;
@@ -110,8 +116,8 @@ else
 		$location =		$row[4];
 		$start_time =	$row[5];
 		$length_in_sec = $row[6];
-			$AUDname =	explode("/",$location);
-			$AUDnamect =	(count($AUDname)) - 1;
+		$AUDname =	explode("/",$location);
+		$AUDnamect =	(count($AUDname)) - 1;
 
 		
 		preg_replace('/10\.10\.10\.16/i', "10.10.10.16",$AUDname[$AUDnamect]);
@@ -140,15 +146,12 @@ else
 		echo "Link Uncompressed WAV: $AUDname[$AUDnamect]\n";
 		echo "Link Compressed GSM:   $fileGSM\n";
 		}
-
 	else
 		{
 		echo "ERROR:        $QUERY_recid\n";
 		}
 
-
 	echo "
\n"; - } $ENDtime = date("U"); @@ -166,7 +169,6 @@ echo "\n\n\n


\nscript runtime: $RUNtime seconds"; ?> - - + diff --git a/agc_2-X/trunk/www/vicidial/recording_lookup_DIRECT.php b/agc_2-X/trunk/www/vicidial/recording_lookup_DIRECT.php index c96faef2..47fbc73d 100644 --- a/agc_2-X/trunk/www/vicidial/recording_lookup_DIRECT.php +++ b/agc_2-X/trunk/www/vicidial/recording_lookup_DIRECT.php @@ -2,6 +2,7 @@ ### recording_lookup_DIRECT.php # # REQUIRED! - check all paths and directory names, need to create a temp directory +# CUSTOMIZATION OF THIS SCRIPT IS REQUIRED FOR IT TO WORK!!! # # On the normal audio recording interface you now have the option of # downloading the WAV or GSM file: @@ -32,12 +33,13 @@ # 71112-1409 - First Build # 90508-0644 - Changed to PHP long tags # 130610-1132 - Finalized changing of all ereg instances to preg +# 130616-2225 - Added filtering of input to prevent SQL injection attacks # $STARTtime = date("U"); $TODAYstart = date("H/i/s 00:00:00"); -$linkAST=mysql_connect("10.10.10.15", "cron", "1234"); +$linkAST=mysql_connect("1.1.1.1", "cron", "1234"); mysql_select_db("asterisk"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; @@ -50,22 +52,26 @@ if (isset($_GET["format"])) {$format=$_GET["format"];} if (isset($_GET["auth"])) {$auth=$_GET["auth"];} elseif (isset($_POST["auth"])) {$auth=$_POST["auth"];} +$phone = preg_replace("/'|\"|\\\\|;/","",$phone); +$format = preg_replace("/'|\"|\\\\|;/","",$format); +$auth = preg_replace("/'|\"|\\\\|;/","",$auth); + $US='_'; - if(preg_match("/VDC1234593JH654398722/i",$auth)) +if(preg_match("/VDC1234593JH654398722/i",$auth)) {$nothing=1;} - else +else { - echo "auth code: |$auth|\n"; - exit; + echo "auth code: |$auth|\n"; + exit; } - $fp = fopen ("/usr/local/apache2/htdocs/vicidial/auth_entries.txt", "a"); - $date = date("r"); - $ip = getenv("REMOTE_ADDR"); - $browser = getenv("HTTP_USER_AGENT"); - fwrite ($fp, "AUTH|VDC |$date|$auth|$ip|$phone|$format|$browser|\n"); - fclose($fp); +$fp = fopen ("/usr/local/apache2/htdocs/vicidial/auth_entries.txt", "a"); +$date = date("r"); +$ip = getenv("REMOTE_ADDR"); +$browser = getenv("HTTP_USER_AGENT"); +fwrite ($fp, "AUTH|VDC |$date|$auth|$ip|$phone|$format|$browser|\n"); +fclose($fp); if (strlen($format)<3) {$format='WAV';} if ( (strlen($phone)<10) or (strlen($phone)>10) ) @@ -94,8 +100,8 @@ else $filename = $row[1]; $location = $row[2]; $start_time = $row[3]; - $AUDname = explode("/",$location); - $AUDnamect = (count($AUDname)) - 1; + $AUDname = explode("/",$location); + $AUDnamect = (count($AUDname)) - 1; preg_replace('/10\.10\.10\.16/i', "10.10.10.16",$AUDname[$AUDnamect]); @@ -103,10 +109,10 @@ else $locationGSM=$location; $fileGSM = preg_replace('/\.wav/i', ".gsm",$fileGSM); if (!preg_match('/gsm/i',$locationGSM)) - { + { $locationGSM = preg_replace('/10\.10\.10\.16/i', "10.10.10.16/GSM",$locationGSM); $locationGSM = preg_replace('/\.wav/i', ".gsm",$locationGSM); - } + } if ($format == 'WAV') { exec("/usr/local/apache2/htdocs/vicidial/wget --output-document=/usr/local/apache2/htdocs/vicidial/temp/$AUDname[$AUDnamect] $location\n"); @@ -135,11 +141,9 @@ else readfile($AUDIOfile); } } - else { echo "ERROR: $phone|$format\n"; } - } ?> diff --git a/agc_2-X/trunk/www/vicidial/remote_dispo.php b/agc_2-X/trunk/www/vicidial/remote_dispo.php index 5c68894f..22c71f0c 100644 --- a/agc_2-X/trunk/www/vicidial/remote_dispo.php +++ b/agc_2-X/trunk/www/vicidial/remote_dispo.php @@ -13,10 +13,11 @@ # 90508-0644 - Changed to PHP long tags # 120223-2135 - Removed logging of good login passwords if webroot writable is enabled # 130610-1108 - Finalized changing of all ereg instances to preg +# 130616-2149 - Added filtering of input to prevent SQL injection attacks and new user auth # - require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -108,15 +109,13 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysql_num_rows($rslt); -$i=0; -while ($i < $qm_conf_ct) +if ($qm_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; $SSoutbound_autodial_active = $row[2]; $user_territories_active = $row[3]; - $i++; } ##### END SETTINGS LOOKUP ##### ########################################### @@ -125,66 +124,51 @@ $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $FILE_datetime = $STARTtime; - -$ext_context = 'demo'; -if (!isset($begin_date)) {$begin_date = $TODAY;} -if (!isset($end_date)) {$end_date = $TODAY;} - - -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 2;"; -if ($DB) {echo "$stmt\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$fp = fopen ("./project_auth_entries.txt", "a"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); +$ext_context = 'demo'; + +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } + +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REMOTE',1); +if ($auth_message == 'GOOD') + {$auth=1;} + if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) { - Header("WWW-Authenticate: Basic realm=\"VICIDIAL-CLOSER\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; + echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; exit; } else { - if($auth>0) - { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - if ($DB) {echo "$stmt\n";} - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname=$row[0]; - $fullname = $row[0]; - if ($webroot_writable > 0) - { - fwrite ($fp, "VD_CLOSER|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($webroot_writable > 0) - { - fwrite ($fp, "VD_CLOSER|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } - } + header ("Content-type: text/html; charset=utf-8"); + + $stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';"; + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $LOGfullname=$row[0]; + $fullname = $row[0]; } + ?> -VICIDIAL REMOTE: Call Disposition +REMOTE: Call Disposition \n"; ?> @@ -197,9 +181,8 @@ echo "\n" echo ""; if ($end_call > 0) -{ - -$call_length = ($STARTtime - $call_began); + { + $call_length = ($STARTtime - $call_began); ### insert a NEW record to the vicidial_closer_log table $stmt="UPDATE vicidial_closer_log set end_epoch='$STARTtime', length_in_sec='" . mysql_real_escape_string($call_length) . "', status='" . mysql_real_escape_string($status) . "', user='$PHP_AUTH_USER' where lead_id='" . mysql_real_escape_string($lead_id) . "' order by start_epoch desc limit 1;"; @@ -214,10 +197,9 @@ $call_length = ($STARTtime - $call_began); echo "Call has been dispositioned       $NOW_TIME\n

\n"; echo "\n"; - -} + } else -{ + { $stmt="SELECT count(*) from vicidial_list where lead_id='" . mysql_real_escape_string($lead_id) . "'"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} @@ -225,37 +207,36 @@ else $lead_count = $row[0]; if ($lead_count > 0) - { - + { $stmt="SELECT lead_id,entry_date,modify_date,status,user,vendor_lead_code,source_id,list_id,gmt_offset_now,called_since_last_reset,phone_code,phone_number,title,first_name,middle_initial,last_name,address1,address2,address3,city,state,province,postal_code,country_code,gender,date_of_birth,alt_phone,email,security_phrase,comments,called_count,last_local_call_time,rank,owner from vicidial_list where lead_id='" . mysql_real_escape_string($lead_id) . "'"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $row=mysql_fetch_row($rslt); - $lead_id = "$row[0]"; - $tsr = "$row[4]"; - $vendor_id = "$row[5]"; - $list_id = "$row[7]"; - $campaign_id = "$row[8]"; - $phone_code = "$row[10]"; - $phone_number = "$row[11]"; - $title = "$row[12]"; - $first_name = "$row[13]"; # - $middle_initial = "$row[14]"; - $last_name = "$row[15]"; # - $address1 = "$row[16]"; # - $address2 = "$row[17]"; # - $address3 = "$row[18]"; # - $city = "$row[19]"; # - $state = "$row[20]"; # - $province = "$row[21]"; # - $postal_code = "$row[22]"; # - $country_code = "$row[23]"; # - $gender = "$row[24]"; - $date_of_birth = "$row[25]"; - $alt_phone = "$row[26]"; # - $email = "$row[27]"; # - $security = "$row[28]"; # - $comments = "$row[29]"; # + $lead_id = $row[0]; + $tsr = $row[4]; + $vendor_id = $row[5]; + $list_id = $row[7]; + $campaign_id = $row[8]; + $phone_code = $row[10]; + $phone_number = $row[11]; + $title = $row[12]; + $first_name = $row[13]; # + $middle_initial = $row[14]; + $last_name = $row[15]; # + $address1 = $row[16]; # + $address2 = $row[17]; # + $address3 = $row[18]; # + $city = $row[19]; # + $state = $row[20]; # + $province = $row[21]; # + $postal_code = $row[22]; # + $country_code = $row[23]; # + $gender = $row[24]; + $date_of_birth = $row[25]; + $alt_phone = $row[26]; # + $email = $row[27]; # + $security = $row[28]; # + $comments = $row[29]; # echo "
Call information: $first_name $last_name - $phone_number

\n"; echo "\n"; @@ -288,55 +269,46 @@ else echo "
\n"; echo "\n"; echo "\n"; - echo "\n"; + $o=0; + while ($statuses_to_print > $o) + { + $rowx=mysql_fetch_row($rslt); + $statuses_list .= "\n"; + $o++; + } + echo "$statuses_list"; + echo "\n"; echo "\n"; echo "
STATUS CODEDESCRIPTIONQC CATEGORYMODIFY/DELETE
Email :
Security :
Comments :
Disposition:
Disposition:
\n"; echo "


\n"; - - } + } else - { + { echo "lead lookup FAILED for lead_id $lead_id       $NOW_TIME\n

\n"; # echo "Close this window\n

\n"; + } } - - - - -} - - $ENDtime = date("U"); $RUNtime = ($ENDtime - $STARTtime); echo "\n\n\n


\n\n"; - echo "\n\n\n


\nscript runtime: $RUNtime seconds"; - ?> - @@ -344,11 +316,5 @@ echo "\n\n\n


\nscript runtime: $RUNtime seconds"; exit; - - ?> - - - - diff --git a/agc_2-X/trunk/www/vicidial/send_CID_call.php b/agc_2-X/trunk/www/vicidial/send_CID_call.php index 9df4b629..cd6acd7d 100644 --- a/agc_2-X/trunk/www/vicidial/send_CID_call.php +++ b/agc_2-X/trunk/www/vicidial/send_CID_call.php @@ -11,9 +11,11 @@ # 120831-1527 - Added vicidial_dial_log logging # 130414-0039 - Added admin logging # 130610-0943 - Finalized changing of all ereg instances to preg +# 130616-2144 - Added filtering of input to prevent SQL injection attacks and new user auth # require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -33,33 +35,60 @@ if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} -$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$stmt = "SELECT use_non_latin FROM system_settings;"; +$rslt=mysql_query($stmt, $link); +if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysql_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysql_fetch_row($rslt); + $non_latin = $row[0]; + } +##### END SETTINGS LOOKUP ##### +########################################### +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } $sender = preg_replace('/[^0-9]/','',$sender); $receiver = preg_replace('/[^0-9]/','',$receiver); $cid_number = preg_replace('/[^0-9]/','',$cid_number); $server_ip = preg_replace('/[^\.0-9]/','',$server_ip); -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - - if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) - { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } - $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $STARTtime = date("U"); $ip = getenv("REMOTE_ADDR"); +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } ?> diff --git a/agc_2-X/trunk/www/vicidial/sheet2tab.pl b/agc_2-X/trunk/www/vicidial/sheet2tab.pl index 7abf691d..f2a89467 100644 --- a/agc_2-X/trunk/www/vicidial/sheet2tab.pl +++ b/agc_2-X/trunk/www/vicidial/sheet2tab.pl @@ -2,7 +2,7 @@ # # sheet2tab.pl - Convert spreadsheet to tab-delimited text file version 2.4 # -# Copyright (C) 2011 Matt Florell & Michael Cargile LICENSE: AGPLv2 +# Copyright (C) 2013 Matt Florell & Michael Cargile LICENSE: AGPLv2 # # Lead file conversion and scrubbing script. This is the first stage in the lead loading process. # @@ -27,6 +27,7 @@ # 100706-0833 - Initial build # 100706-1244 - Reformat and add comments # 110927-1750 - Fixed issue with improperly CSV files locking up servers +# 130619-2310 - Fixed missing XLSX perl module declaration # # disable when not debugging @@ -34,6 +35,7 @@ #use warnings; use Spreadsheet::Read; +use Spreadsheet::XLSX; use File::Basename; diff --git a/agc_2-X/trunk/www/vicidial/sph_report.php b/agc_2-X/trunk/www/vicidial/sph_report.php index 9c0f0479..64e542de 100644 --- a/agc_2-X/trunk/www/vicidial/sph_report.php +++ b/agc_2-X/trunk/www/vicidial/sph_report.php @@ -10,6 +10,7 @@ # 90508-0644 - Changed to PHP long tags # 130414-0235 - Added report logging # 130610-0942 - Finalized changing of all ereg instances to preg +# 130616-2045 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); @@ -17,6 +18,7 @@ $startMS = microtime(); $report_name='SPH Report'; require("dbconnect.php"); +require("functions.php"); ##### Pull values from posted form variables ##### $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; @@ -57,32 +59,83 @@ $stmt = "SELECT use_non_latin FROM system_settings;"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysql_num_rows($rslt); -$i=0; -while ($i < $qm_conf_ct) +if ($qm_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; - $i++; } ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';"; -if ($DB) {echo "|$stmt|\n";} -if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - - if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } +$query_date = preg_replace("/'|\"|\\\\|;/","",$query_date); +$end_date = preg_replace("/'|\"|\\\\|;/","",$end_date); +$campaign = preg_replace("/'|\"|\\\\|;/","",$campaign); +$user_group = preg_replace("/'|\"|\\\\|;/","",$user_group); +$group = preg_replace("/'|\"|\\\\|;/","",$group); +$shift = preg_replace("/'|\"|\\\\|;/","",$shift); +$role = preg_replace("/'|\"|\\\\|;/","",$role); +$order = preg_replace("/'|\"|\\\\|;/","",$order); +$user = preg_replace("/'|\"|\\\\|;/","",$user); + + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } ##### BEGIN log visit to the vicidial_report_log table ##### @@ -195,7 +248,7 @@ while ($i < $user_groups_to_print) -VICIDIAL: Agent SPH Report +<?php echo $report_name ?> @@ -612,4 +665,4 @@ $rslt=mysql_query($stmt, $link); ?>
- \ No newline at end of file + diff --git a/agc_2-X/trunk/www/vicidial/timeclock_edit.php b/agc_2-X/trunk/www/vicidial/timeclock_edit.php index 7e68dc99..e375524e 100644 --- a/agc_2-X/trunk/www/vicidial/timeclock_edit.php +++ b/agc_2-X/trunk/www/vicidial/timeclock_edit.php @@ -11,11 +11,13 @@ # 90508-0644 - Changed to PHP long tags # 120223-2135 - Removed logging of good login passwords if webroot writable is enabled # 130610-1107 - Finalized changing of all ereg instances to preg +# 130616-1541 - Added filtering of input to prevent SQL injection attacks and new user auth # header ("Content-type: text/html; charset=utf-8"); require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -57,21 +59,39 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_ter $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysql_num_rows($rslt); -$i=0; -while ($i < $qm_conf_ct) +if ($qm_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; $SSoutbound_autodial_active = $row[2]; $user_territories_active = $row[3]; - $i++; } ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } +$user = preg_replace("/'|\"|\\\\|;/","",$user); +$timeclock_id = preg_replace("/'|\"|\\\\|;/","",$timeclock_id); +$stage = preg_replace("/'|\"|\\\\|;/","",$stage); +$oldLOGINepoch = preg_replace("/'|\"|\\\\|;/","",$oldLOGINepoch); +$oldLOGOUTepoch = preg_replace("/'|\"|\\\\|;/","",$oldLOGOUTepoch); +$oldLOGINdate = preg_replace("/'|\"|\\\\|;/","",$oldLOGINdate); +$oldLOGOUTdate = preg_replace("/'|\"|\\\\|;/","",$oldLOGOUTdate); +$LOGINepoch = preg_replace("/'|\"|\\\\|;/","",$LOGINepoch); +$LOGOUTepoch = preg_replace("/'|\"|\\\\|;/","",$LOGOUTepoch); +$notes = preg_replace("/'|\"|\\\\|;/","",$notes); +$LOGINevent_id = preg_replace("/'|\"|\\\\|;/","",$LOGINevent_id); +$LOGOUTevent_id = preg_replace("/'|\"|\\\\|;/","",$LOGOUTevent_id); $StarTtimE = date("U"); $TODAY = date("Y-m-d"); @@ -79,139 +99,137 @@ $NOW_TIME = date("Y-m-d H:i:s"); $ip = getenv("REMOTE_ADDR"); $invalid_record=0; -if (!isset($begin_date)) {$begin_date = $TODAY;} -if (!isset($end_date)) {$end_date = $TODAY;} -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';"; -if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; +$auth=0; +$reports_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} -$fp = fopen ("./project_auth_entries.txt", "a"); -$date = date("r"); -$ip = getenv("REMOTE_ADDR"); -$browser = getenv("HTTP_USER_AGENT"); - - if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($auth > 0) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } - else - { - - if($auth>0) - { - $stmt="SELECT full_name,modify_timeclock_log from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname = $row[0]; - $modify_timeclock_log = $row[1]; - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } - } - - $stmt="SELECT full_name,user_group from vicidial_users where user='" . mysql_real_escape_string($user) . "';"; + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); - $full_name = $row[0]; - $user_group = $row[1]; + $reports_auth=$row[0]; - $stmt="SELECT event,tcid_link from vicidial_timeclock_log where timeclock_id='" . mysql_real_escape_string($timeclock_id) . "';"; + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT full_name,modify_timeclock_log from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGfullname = $row[0]; +$modify_timeclock_log = $row[1]; + +$stmt="SELECT full_name,user_group from vicidial_users where user='" . mysql_real_escape_string($user) . "';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$full_name = $row[0]; +$user_group = $row[1]; + +$stmt="SELECT event,tcid_link from vicidial_timeclock_log where timeclock_id='" . mysql_real_escape_string($timeclock_id) . "';"; +$rslt=mysql_query($stmt, $link); +if ($DB) {echo "$stmt\n";} +$tc_logs_to_print = mysql_num_rows($rslt); +if ($tc_logs_to_print > 0) + { + $row=mysql_fetch_row($rslt); + $event = $row[0]; + $tcid_link = $row[1]; + } +if (preg_match('/LOGIN/',$event)) + { + $LOGINevent_id = $timeclock_id; + $LOGOUTevent_id = $tcid_link; + if ( (preg_match('/NULL/',$LOGOUTevent_id)) or (strlen($LOGOUTevent_id)<1) ) + {$invalid_record++;} + } +if (preg_match('/LOGOUT/',$event)) + { + $LOGOUTevent_id = $timeclock_id; + $stmt="SELECT timeclock_id from vicidial_timeclock_log where tcid_link='" . mysql_real_escape_string($timeclock_id) . "';"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $tc_logs_to_print = mysql_num_rows($rslt); if ($tc_logs_to_print > 0) { $row=mysql_fetch_row($rslt); - $event = $row[0]; - $tcid_link = $row[1]; + $LOGINevent_id = $row[0]; } - if (preg_match('/LOGIN/',$event)) - { - $LOGINevent_id = $timeclock_id; - $LOGOUTevent_id = $tcid_link; - if ( (preg_match('/NULL/',$LOGOUTevent_id)) or (strlen($LOGOUTevent_id)<1) ) - {$invalid_record++;} - } - if (preg_match('/LOGOUT/',$event)) - { - $LOGOUTevent_id = $timeclock_id; - $stmt="SELECT timeclock_id from vicidial_timeclock_log where tcid_link='" . mysql_real_escape_string($timeclock_id) . "';"; - $rslt=mysql_query($stmt, $link); - if ($DB) {echo "$stmt\n";} - $tc_logs_to_print = mysql_num_rows($rslt); - if ($tc_logs_to_print > 0) - { - $row=mysql_fetch_row($rslt); - $LOGINevent_id = $row[0]; - } - if ( (preg_match('/NULL/',$LOGOUTevent_id)) or (strlen($LOGOUTevent_id)<1) ) - {$invalid_record++;} - } - if (strlen($LOGOUTevent_id)<1) + if ( (preg_match('/NULL/',$LOGOUTevent_id)) or (strlen($LOGOUTevent_id)<1) ) {$invalid_record++;} + } +if (strlen($LOGOUTevent_id)<1) + {$invalid_record++;} - ### - if ($invalid_record < 1) +### +if ($invalid_record < 1) + { + $stmt="SELECT event_epoch,event_date,login_sec,event,user,user_group,ip_address,shift_id,notes,manager_user,manager_ip,event_datestamp from vicidial_timeclock_log where timeclock_id='$LOGINevent_id';"; + $rslt=mysql_query($stmt, $link); + if ($DB) {echo "$stmt\n";} + $tc_logs_to_print = mysql_num_rows($rslt); + if ($tc_logs_to_print > 0) { - $stmt="SELECT event_epoch,event_date,login_sec,event,user,user_group,ip_address,shift_id,notes,manager_user,manager_ip,event_datestamp from vicidial_timeclock_log where timeclock_id='$LOGINevent_id';"; - $rslt=mysql_query($stmt, $link); - if ($DB) {echo "$stmt\n";} - $tc_logs_to_print = mysql_num_rows($rslt); - if ($tc_logs_to_print > 0) - { - $row=mysql_fetch_row($rslt); - $LOGINevent_epoch = $row[0]; - $LOGINevent_date = $row[1]; - $LOGINlogin_sec = $row[2]; - $LOGINevent = $row[3]; - $LOGINuser = $row[4]; - $LOGINuser_group = $row[5]; - $LOGINip_address = $row[6]; - $LOGINshift_id = $row[7]; - $LOGINnotes = $row[8]; - $LOGINmanager_user = $row[9]; - $LOGINmanager_ip = $row[10]; - $LOGINevent_datestamp = $row[11]; - } - $stmt="SELECT event_epoch,event_date,login_sec,event,user,user_group,ip_address,shift_id,notes,manager_user,manager_ip,event_datestamp from vicidial_timeclock_log where timeclock_id='$LOGOUTevent_id';"; - $rslt=mysql_query($stmt, $link); - if ($DB) {echo "$stmt\n";} - $tc_logs_to_print = mysql_num_rows($rslt); - if ($tc_logs_to_print > 0) - { - $row=mysql_fetch_row($rslt); - $LOGOUTevent_epoch = $row[0]; - $LOGOUTevent_date = $row[1]; - $LOGOUTlogin_sec = $row[2]; - $LOGOUTevent = $row[3]; - $LOGOUTuser = $row[4]; - $LOGOUTuser_group = $row[5]; - $LOGOUTip_address = $row[6]; - $LOGOUTshift_id = $row[7]; - $LOGOUTnotes = $row[8]; - $LOGOUTmanager_user = $row[9]; - $LOGOUTmanager_ip = $row[10]; - $LOGOUTevent_datestamp =$row[11]; - } - - $user=$LOGINuser; + $row=mysql_fetch_row($rslt); + $LOGINevent_epoch = $row[0]; + $LOGINevent_date = $row[1]; + $LOGINlogin_sec = $row[2]; + $LOGINevent = $row[3]; + $LOGINuser = $row[4]; + $LOGINuser_group = $row[5]; + $LOGINip_address = $row[6]; + $LOGINshift_id = $row[7]; + $LOGINnotes = $row[8]; + $LOGINmanager_user = $row[9]; + $LOGINmanager_ip = $row[10]; + $LOGINevent_datestamp = $row[11]; } + $stmt="SELECT event_epoch,event_date,login_sec,event,user,user_group,ip_address,shift_id,notes,manager_user,manager_ip,event_datestamp from vicidial_timeclock_log where timeclock_id='$LOGOUTevent_id';"; + $rslt=mysql_query($stmt, $link); + if ($DB) {echo "$stmt\n";} + $tc_logs_to_print = mysql_num_rows($rslt); + if ($tc_logs_to_print > 0) + { + $row=mysql_fetch_row($rslt); + $LOGOUTevent_epoch = $row[0]; + $LOGOUTevent_date = $row[1]; + $LOGOUTlogin_sec = $row[2]; + $LOGOUTevent = $row[3]; + $LOGOUTuser = $row[4]; + $LOGOUTuser_group = $row[5]; + $LOGOUTip_address = $row[6]; + $LOGOUTshift_id = $row[7]; + $LOGOUTnotes = $row[8]; + $LOGOUTmanager_user = $row[9]; + $LOGOUTmanager_ip = $row[10]; + $LOGOUTevent_datestamp =$row[11]; + } + + $user=$LOGINuser; } @@ -261,211 +279,208 @@ echo " 0) - { - $row=mysql_fetch_row($rslt); - $NEXTevent_epoch = $row[0]; - $NEXTevent_id = $row[1]; - } - $stmt="SELECT event_epoch,timeclock_id from vicidial_timeclock_log where timeclock_id < '$LOGINevent_id' and user='$user' order by timeclock_id desc limit 1;"; - $rslt=mysql_query($stmt, $link); - if ($DB) {echo "$stmt\n";} - $tc_logs_to_print = mysql_num_rows($rslt); - if ($tc_logs_to_print > 0) - { - $row=mysql_fetch_row($rslt); - $PREVevent_epoch = $row[0]; - $PREVevent_id = $row[1]; - } - - if ( ($LOGINepoch <= $PREVevent_epoch) || ($LOGOUTepoch >= $NEXTevent_epoch) ) - { - echo "ERROR- There is a problem with the data that you entered, please go back
\n"; - echo "A timeclock session cannot overlap another timeclock session
\n"; - echo "$LOGINepoch
\n"; - echo "$LOGOUTepoch
\n"; - echo "$LOGINevent_id
\n"; - echo "$LOGOUTevent_id
\n"; - echo "$LOGINuser
\n"; - echo "$PREVevent_epoch
\n"; - echo "$PREVevent_id
\n"; - echo "$NEXTevent_epoch
\n"; - echo "$NEXTevent_id
\n"; - exit; - } - if ( ($LOGINepoch > $StarTtimE) || ($LOGOUTepoch > $StarTtimE) || ($log_time > 86400) || ($log_time < 1) ) - { - echo "ERROR- There is a problem with the data that you entered, please go back
\n"; - echo "$LOGINepoch
\n"; - echo "$LOGOUTepoch
\n"; - echo "$notes
\n"; - echo "$LOGINevent_id
\n"; - echo "$LOGOUTevent_id
\n"; - echo "$LOGINuser
\n"; - exit; - } - else - { - $LOGINdatetime = date("Y-m-d H:i:s", $LOGINepoch); - $LOGOUTdatetime = date("Y-m-d H:i:s", $LOGOUTepoch); - - ### update LOGIN record in the timeclock log - $stmtA="UPDATE vicidial_timeclock_log set event_epoch='$LOGINepoch', event_date='$LOGINdatetime', manager_user='$PHP_AUTH_USER', manager_ip='$ip', notes='Manager MODIFY', login_sec='$log_time' where timeclock_id='$LOGINevent_id';"; - if ($DB) {echo "$stmtA\n";} - $rslt=mysql_query($stmtA, $link); - $affected_rows = mysql_affected_rows($link); - $timeclock_id = mysql_insert_id($link); - print "\n"; - - ### Add a record to the vicidial_admin_log - $SQL_log = "$stmtA|"; - $SQL_log = preg_replace('/;/', '', $SQL_log); - $SQL_log = addslashes($SQL_log); - $stmt="INSERT INTO vicidial_admin_log set event_date='$NOW_TIME', user='$PHP_AUTH_USER', ip_address='$ip', event_section='TIMECLOCK', event_type='MODIFY', record_id='$LOGINevent_id', event_code='MANAGER MODIFY TIMECLOCK LOG', event_sql=\"$SQL_log\", event_notes='user: $user|$oldLOGINepoch|$oldLOGINdate|sec: $log_time|';"; - if ($DB) {echo "$stmt\n";} + $stmt="SELECT event_epoch,timeclock_id from vicidial_timeclock_log where timeclock_id > '$LOGOUTevent_id' and user='$user' order by timeclock_id limit 1;"; $rslt=mysql_query($stmt, $link); - $affected_rows = mysql_affected_rows($link); - print "\n"; - - ### update LOGOUT record in the timeclock log - $stmtB="UPDATE vicidial_timeclock_log set event_epoch='$LOGOUTepoch', event_date='$LOGOUTdatetime', manager_user='$PHP_AUTH_USER', manager_ip='$ip', notes='Manager MODIFY', login_sec='$log_time' where timeclock_id='$LOGOUTevent_id';"; - if ($DB) {echo "$stmtB\n";} - $rslt=mysql_query($stmtB, $link); - $affected_rows = mysql_affected_rows($link); - $timeclock_id = mysql_insert_id($link); - print "\n"; - - ### Add a record to the vicidial_admin_log - $SQL_log = "$stmtB|"; - $SQL_log = preg_replace('/;/', '', $SQL_log); - $SQL_log = addslashes($SQL_log); - $stmt="INSERT INTO vicidial_admin_log set event_date='$NOW_TIME', user='$PHP_AUTH_USER', ip_address='$ip', event_section='TIMECLOCK', event_type='MODIFY', record_id='$LOGOUTevent_id', event_code='MANAGER MODIFY TIMECLOCK LOG', event_sql=\"$SQL_log\", event_notes='user: $user|$oldLOGOUTepoch|$oldLOGOUTdate|sec: $log_time|';"; if ($DB) {echo "$stmt\n";} + $tc_logs_to_print = mysql_num_rows($rslt); + if ($tc_logs_to_print > 0) + { + $row=mysql_fetch_row($rslt); + $NEXTevent_epoch = $row[0]; + $NEXTevent_id = $row[1]; + } + $stmt="SELECT event_epoch,timeclock_id from vicidial_timeclock_log where timeclock_id < '$LOGINevent_id' and user='$user' order by timeclock_id desc limit 1;"; $rslt=mysql_query($stmt, $link); - $affected_rows = mysql_affected_rows($link); - print "\n"; + if ($DB) {echo "$stmt\n";} + $tc_logs_to_print = mysql_num_rows($rslt); + if ($tc_logs_to_print > 0) + { + $row=mysql_fetch_row($rslt); + $PREVevent_epoch = $row[0]; + $PREVevent_id = $row[1]; + } - echo "The timeclock session has been updated. Click here to view.
\n"; - exit; + if ( ($LOGINepoch <= $PREVevent_epoch) || ($LOGOUTepoch >= $NEXTevent_epoch) ) + { + echo "ERROR- There is a problem with the data that you entered, please go back
\n"; + echo "A timeclock session cannot overlap another timeclock session
\n"; + echo "$LOGINepoch
\n"; + echo "$LOGOUTepoch
\n"; + echo "$LOGINevent_id
\n"; + echo "$LOGOUTevent_id
\n"; + echo "$LOGINuser
\n"; + echo "$PREVevent_epoch
\n"; + echo "$PREVevent_id
\n"; + echo "$NEXTevent_epoch
\n"; + echo "$NEXTevent_id
\n"; + exit; + } + if ( ($LOGINepoch > $StarTtimE) || ($LOGOUTepoch > $StarTtimE) || ($log_time > 86400) || ($log_time < 1) ) + { + echo "ERROR- There is a problem with the data that you entered, please go back
\n"; + echo "$LOGINepoch
\n"; + echo "$LOGOUTepoch
\n"; + echo "$notes
\n"; + echo "$LOGINevent_id
\n"; + echo "$LOGOUTevent_id
\n"; + echo "$LOGINuser
\n"; + exit; + } + else + { + $LOGINdatetime = date("Y-m-d H:i:s", $LOGINepoch); + $LOGOUTdatetime = date("Y-m-d H:i:s", $LOGOUTepoch); + + ### update LOGIN record in the timeclock log + $stmtA="UPDATE vicidial_timeclock_log set event_epoch='$LOGINepoch', event_date='$LOGINdatetime', manager_user='$PHP_AUTH_USER', manager_ip='$ip', notes='Manager MODIFY', login_sec='$log_time' where timeclock_id='$LOGINevent_id';"; + if ($DB) {echo "$stmtA\n";} + $rslt=mysql_query($stmtA, $link); + $affected_rows = mysql_affected_rows($link); + $timeclock_id = mysql_insert_id($link); + print "\n"; + + ### Add a record to the vicidial_admin_log + $SQL_log = "$stmtA|"; + $SQL_log = preg_replace('/;/', '', $SQL_log); + $SQL_log = addslashes($SQL_log); + $stmt="INSERT INTO vicidial_admin_log set event_date='$NOW_TIME', user='$PHP_AUTH_USER', ip_address='$ip', event_section='TIMECLOCK', event_type='MODIFY', record_id='$LOGINevent_id', event_code='MANAGER MODIFY TIMECLOCK LOG', event_sql=\"$SQL_log\", event_notes='user: $user|$oldLOGINepoch|$oldLOGINdate|sec: $log_time|';"; + if ($DB) {echo "$stmt\n";} + $rslt=mysql_query($stmt, $link); + $affected_rows = mysql_affected_rows($link); + print "\n"; + + ### update LOGOUT record in the timeclock log + $stmtB="UPDATE vicidial_timeclock_log set event_epoch='$LOGOUTepoch', event_date='$LOGOUTdatetime', manager_user='$PHP_AUTH_USER', manager_ip='$ip', notes='Manager MODIFY', login_sec='$log_time' where timeclock_id='$LOGOUTevent_id';"; + if ($DB) {echo "$stmtB\n";} + $rslt=mysql_query($stmtB, $link); + $affected_rows = mysql_affected_rows($link); + $timeclock_id = mysql_insert_id($link); + print "\n"; + + ### Add a record to the vicidial_admin_log + $SQL_log = "$stmtB|"; + $SQL_log = preg_replace('/;/', '', $SQL_log); + $SQL_log = addslashes($SQL_log); + $stmt="INSERT INTO vicidial_admin_log set event_date='$NOW_TIME', user='$PHP_AUTH_USER', ip_address='$ip', event_section='TIMECLOCK', event_type='MODIFY', record_id='$LOGOUTevent_id', event_code='MANAGER MODIFY TIMECLOCK LOG', event_sql=\"$SQL_log\", event_notes='user: $user|$oldLOGOUTepoch|$oldLOGOUTdate|sec: $log_time|';"; + if ($DB) {echo "$stmt\n";} + $rslt=mysql_query($stmt, $link); + $affected_rows = mysql_affected_rows($link); + print "\n"; + + echo "The timeclock session has been updated. Click here to view.
\n"; + exit; + } } + ##### END TIMECLOCK RECORD MODIFY ##### + + + + + echo "\n
"; + + if ($modify_timeclock_log > 0) + { + # $LOGINevent_id = $timeclock_id; + # $LOGOUTevent_id = $tcid_link; + + $event_hours = ($LOGINlogin_sec / 3600); + $event_hours_int = round($event_hours, 2); + $event_hours_int = intval("$event_hours_int"); + $event_minutes = ($event_hours - $event_hours_int); + $event_minutes = ($event_minutes * 60); + $event_minutes_int = round($event_minutes, 0); + if ($event_minutes_int < 10) {$event_minutes_int = "0$event_minutes_int";} + + $stmt="SELECT full_name from vicidial_users where user='$LOGINuser';"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $full_name = $row[0]; + + echo "

\n"; + echo "
\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + + echo "\n"; + echo "
\n"; + echo "        USER: $LOGINuser ($full_name)         \n"; + echo "HOURS: $event_hours_int:$event_minutes_int \n"; + echo "
\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "
LOGIN TIME:
TIMECLOCK ID: $LOGINevent_id
USER GROUP: $LOGINuser_group
IP ADDRESS: $LOGINip_address
MANAGER USER: $LOGINmanager_user
MANAGER IP: $LOGINmanager_ip
NOTES: $LOGINnotes
LAST CHANGE: $LOGINevent_datestamp
\n"; + + echo "		         \n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "\n"; + echo "
LOGOUT TIME:
TIMECLOCK ID: $LOGOUTevent_id
USER GROUP: $LOGOUTuser_group
IP ADDRESS: $LOGOUTip_address
MANAGER USER: $LOGOUTmanager_user
MANAGER IP: $LOGOUTmanager_ip
NOTES: $LOGOUTnotes
LAST CHANGE: $LOGOUTevent_datestamp
\n"; + echo "
\n"; + echo "NEW NOTES: \n"; + echo "
\n"; + echo "
\n"; + echo "
\n"; + echo "

\n"; + } + + + echo "Agent Time Sheet\n"; + echo " - User Stats\n"; + echo " - Modify User\n"; + + echo "\n"; + echo "\n"; + + + $ENDtime = date("U"); + + $RUNtime = ($ENDtime - $StarTtimE); + + echo "\n\n\n


\n\n"; + + + echo "\n\n\n


\nscript runtime: $RUNtime seconds"; + + echo "|$stage|$group|"; } -##### END TIMECLOCK RECORD MODIFY ##### - - - - -echo "\n
"; - -if ($modify_timeclock_log > 0) - { -# $LOGINevent_id = $timeclock_id; -# $LOGOUTevent_id = $tcid_link; - - $event_hours = ($LOGINlogin_sec / 3600); - $event_hours_int = round($event_hours, 2); - $event_hours_int = intval("$event_hours_int"); - $event_minutes = ($event_hours - $event_hours_int); - $event_minutes = ($event_minutes * 60); - $event_minutes_int = round($event_minutes, 0); - if ($event_minutes_int < 10) {$event_minutes_int = "0$event_minutes_int";} - - $stmt="SELECT full_name from vicidial_users where user='$LOGINuser';"; - if ($DB) {echo "|$stmt|\n";} - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $full_name = $row[0]; - - echo "

\n"; - echo "
\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - - echo "\n"; - echo "
\n"; - echo "        USER: $LOGINuser ($full_name)         \n"; - echo "HOURS: $event_hours_int:$event_minutes_int \n"; - echo "
\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "
LOGIN TIME:
TIMECLOCK ID: $LOGINevent_id
USER GROUP: $LOGINuser_group
IP ADDRESS: $LOGINip_address
MANAGER USER: $LOGINmanager_user
MANAGER IP: $LOGINmanager_ip
NOTES: $LOGINnotes
LAST CHANGE: $LOGINevent_datestamp
\n"; - - echo "		         \n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "\n"; - echo "
LOGOUT TIME:
TIMECLOCK ID: $LOGOUTevent_id
USER GROUP: $LOGOUTuser_group
IP ADDRESS: $LOGOUTip_address
MANAGER USER: $LOGOUTmanager_user
MANAGER IP: $LOGOUTmanager_ip
NOTES: $LOGOUTnotes
LAST CHANGE: $LOGOUTevent_datestamp
\n"; - echo "
\n"; - echo "NEW NOTES: \n"; - echo "
\n"; - echo "
\n"; - echo "
\n"; - echo "

\n"; - } - - -echo "Agent Time Sheet\n"; -echo " - User Stats\n"; -echo " - Modify User\n"; - -echo "\n"; -echo "\n"; - - -$ENDtime = date("U"); - -$RUNtime = ($ENDtime - $StarTtimE); - -echo "\n\n\n


\n\n"; - - -echo "\n\n\n


\nscript runtime: $RUNtime seconds"; - -echo "|$stage|$group|"; - -} else -{ - -echo "ERROR! You cannot edit this timeclock record: $timeclock_id\n"; -} + { + echo "ERROR! You cannot edit this timeclock record: $timeclock_id\n"; + } ?> @@ -477,7 +492,5 @@ echo "ERROR! You cannot edit this timeclock record: $timeclock_id\n"; exit; - - ?> diff --git a/agc_2-X/trunk/www/vicidial/timeclock_report.php b/agc_2-X/trunk/www/vicidial/timeclock_report.php index 4bbadd72..201bbd75 100644 --- a/agc_2-X/trunk/www/vicidial/timeclock_report.php +++ b/agc_2-X/trunk/www/vicidial/timeclock_report.php @@ -20,11 +20,13 @@ # 120224-0910 - Added HTML display option with bar graphs # 130414-0150 - Added report logging # 130610-0942 - Finalized changing of all ereg instances to preg +# 130616-1026 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); require("dbconnect.php"); +require("functions.php"); ##### Pull values from posted form variables ##### $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; @@ -48,9 +50,9 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];} elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} -if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} +if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];} -if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} +if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];} if (strlen($shift)<2) {$shift='ALL';} @@ -77,28 +79,79 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); +$STARTtime = date("U"); +$TODAY = date("Y-m-d"); -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; -if ($DB) {$MAIN.="|$stmt|\n";} -if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; +if ( (!isset($query_date)) or (strlen($query_date) < 10) ) {$query_date = $TODAY;} +if ( (!isset($end_date)) or (strlen($end_date) < 10) ) {$end_date = $TODAY;} -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';"; -if ($DB) {$MAIN.="|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$reports_only_user=$row[0]; - -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($non_latin < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } +$query_date = preg_replace("/'|\"|\\\\|;/","",$query_date); +$end_date = preg_replace("/'|\"|\\\\|;/","",$end_date); +$user_group = preg_replace("/'|\"|\\\\|;/","",$user_group); +$shift = preg_replace("/'|\"|\\\\|;/","",$shift); +$order = preg_replace("/'|\"|\\\\|;/","",$order); +$user = preg_replace("/'|\"|\\\\|;/","",$user); +$file_download = preg_replace("/'|\"|\\\\|;/","",$file_download); +$report_display_type = preg_replace("/'|\"|\\\\|;/","",$report_display_type); + +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; } ##### BEGIN log visit to the vicidial_report_log table ##### @@ -130,7 +183,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $MAIN.="\n"; } -$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {$MAIN.="|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); @@ -147,8 +200,7 @@ $LOGadmin_viewable_call_times = $row[3]; if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); + Header ("Content-type: text/html; charset=utf-8"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; } diff --git a/agc_2-X/trunk/www/vicidial/timeclock_status.php b/agc_2-X/trunk/www/vicidial/timeclock_status.php index c664179d..33c6a6a1 100644 --- a/agc_2-X/trunk/www/vicidial/timeclock_status.php +++ b/agc_2-X/trunk/www/vicidial/timeclock_status.php @@ -17,6 +17,7 @@ # 111104-1315 - Added user_group restrictions for selecting in-groups # 130414-0152 - Added report logging # 130610-0940 - Finalized changing of all ereg instances to preg +# 130616-0114 - Added filtering of input to prevent SQL injection attacks and new user auth # #header ("Content-type: text/html; charset=utf-8"); @@ -24,6 +25,7 @@ $startMS = microtime(); require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -45,7 +47,6 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];} - $report_name = 'User Group Timeclock Status Report'; $db_source = 'M'; @@ -68,8 +69,20 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } +$begin_date = preg_replace("/'|\"|\\\\|;/","",$begin_date); +$end_date = preg_replace("/'|\"|\\\\|;/","",$end_date); +$user = preg_replace("/'|\"|\\\\|;/","",$user); +$user_group = preg_replace("/'|\"|\\\\|;/","",$user_group); $STARTtime = date("U"); $TODAY = date("Y-m-d"); @@ -83,30 +96,60 @@ else {$EoD = mktime($HHteod, $MMteod, 10, date("m"), date("d"), date("Y"));} $EoDdate = date("Y-m-d H:i:s", $EoD); - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; -if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';"; -if ($DB) {$MAIN.="|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$reports_only_user=$row[0]; - $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); @@ -137,7 +180,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $MAIN.="\n"; } -$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {$MAIN.="|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); @@ -154,7 +197,7 @@ $LOGadmin_viewable_call_times = $row[3]; if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; diff --git a/agc_2-X/trunk/www/vicidial/user_group_bulk_change.php b/agc_2-X/trunk/www/vicidial/user_group_bulk_change.php index affe3ec1..c3d92454 100644 --- a/agc_2-X/trunk/www/vicidial/user_group_bulk_change.php +++ b/agc_2-X/trunk/www/vicidial/user_group_bulk_change.php @@ -11,11 +11,13 @@ # 120221-0025 - Added in User Group restrictions # 120223-2135 - Removed logging of good login passwords if webroot writable is enabled # 130610-1106 - Finalized changing of all ereg instances to preg +# 130616-0106 - Added filtering of input to prevent SQL injection attacks and new user auth # header ("Content-type: text/html; charset=utf-8"); require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -39,20 +41,21 @@ $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active FROM sys $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysql_num_rows($rslt); -$i=0; -while ($i < $qm_conf_ct) +if ($qm_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; $SSoutbound_autodial_active = $row[2]; - $i++; } ##### END SETTINGS LOOKUP ##### ########################################### $PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); +$old_group = preg_replace("/'|\"|\\\\|;/","",$old_group); +$group = preg_replace("/'|\"|\\\\|;/","",$group); +$stage = preg_replace("/'|\"|\\\\|;/","",$stage); $StarTtimE = date("U"); $TODAY = date("Y-m-d"); @@ -62,50 +65,46 @@ $ip = getenv("REMOTE_ADDR"); if (!isset($begin_date)) {$begin_date = $TODAY;} if (!isset($end_date)) {$end_date = $TODAY;} -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';"; -if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$fp = fopen ("./project_auth_entries.txt", "a"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth < 1) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } -else - { - if($auth>0) + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') { - $stmt="SELECT full_name,change_agent_campaign,modify_timeclock_log,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname = $row[0]; - $change_agent_campaign = $row[1]; - $modify_timeclock_log = $row[2]; - $LOGuser_group = $row[3]; - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - } - else - { - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; exit; } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +$stmt="SELECT full_name,change_agent_campaign,modify_timeclock_log,user_group,modify_users from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGfullname = $row[0]; +$change_agent_campaign = $row[1]; +$modify_timeclock_log = $row[2]; +$LOGuser_group = $row[3]; +$modify_users = $row[4]; + +# check their permissions +if ( ($change_agent_campaign < 1 ) or ($modify_users < 1) ) + { + header ("Content-type: text/html; charset=utf-8"); + echo "You do not have permissions to modify users\n"; + exit; } $stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; diff --git a/agc_2-X/trunk/www/vicidial/user_stats.php b/agc_2-X/trunk/www/vicidial/user_stats.php index 1542ba99..1f017d1d 100644 --- a/agc_2-X/trunk/www/vicidial/user_stats.php +++ b/agc_2-X/trunk/www/vicidial/user_stats.php @@ -38,6 +38,8 @@ # 130124-1740 - Added option to display first and last name of lead # 130414-0146 - Added report logging # 130610-0938 - Finalized changing of all ereg instances to preg +# 130616-0059 - Added filtering of input to prevent SQL injection attacks and new user auth +# 130625-1341 - Added phone login and phone_ip display to login/logout section # $startMS = microtime(); @@ -45,7 +47,6 @@ $startMS = microtime(); require("dbconnect.php"); require("functions.php"); - $report_name = 'User Stats'; $db_source = 'M'; @@ -55,6 +56,28 @@ if (file_exists('options.php')) require('options.php'); } +$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; +$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; +$PHP_SELF=$_SERVER['PHP_SELF']; +if (isset($_GET["did_id"])) {$did_id=$_GET["did_id"];} + elseif (isset($_POST["did_id"])) {$did_id=$_POST["did_id"];} +if (isset($_GET["did"])) {$did=$_GET["did"];} + elseif (isset($_POST["did"])) {$did=$_POST["did"];} +if (isset($_GET["begin_date"])) {$begin_date=$_GET["begin_date"];} + elseif (isset($_POST["begin_date"])) {$begin_date=$_POST["begin_date"];} +if (isset($_GET["end_date"])) {$end_date=$_GET["end_date"];} + elseif (isset($_POST["end_date"])) {$end_date=$_POST["end_date"];} +if (isset($_GET["user"])) {$user=$_GET["user"];} + elseif (isset($_POST["user"])) {$user=$_POST["user"];} +if (isset($_GET["DB"])) {$DB=$_GET["DB"];} + elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} +if (isset($_GET["submit"])) {$submit=$_GET["submit"];} + elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} +if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} + elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} +if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} + elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];} + ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,user_territories_active,webroot_writable,allow_emails FROM system_settings;"; @@ -75,64 +98,82 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; -$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; -$PHP_SELF=$_SERVER['PHP_SELF']; -if (isset($_GET["did_id"])) {$did_id=$_GET["did_id"];} - elseif (isset($_POST["did_id"])) {$did_id=$_POST["did_id"];} -if (isset($_GET["did"])) {$did=$_GET["did"];} - elseif (isset($_POST["did"])) {$did=$_POST["did"];} -if (isset($_GET["begin_date"])) {$begin_date=$_GET["begin_date"];} - elseif (isset($_POST["begin_date"])) {$begin_date=$_POST["begin_date"];} -if (isset($_GET["end_date"])) {$end_date=$_GET["end_date"];} - elseif (isset($_POST["end_date"])) {$end_date=$_POST["end_date"];} -if (isset($_GET["user"])) {$user=$_GET["user"];} - elseif (isset($_POST["user"])) {$user=$_POST["user"];} -if (isset($_GET["campaign"])) {$campaign=$_GET["campaign"];} - elseif (isset($_POST["campaign"])) {$campaign=$_POST["campaign"];} -if (isset($_GET["DB"])) {$DB=$_GET["DB"];} - elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} -if (isset($_GET["submit"])) {$submit=$_GET["submit"];} - elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} -if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} - elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} -if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} - elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];} - -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - $STARTtime = date("U"); $TODAY = date("Y-m-d"); -if (!isset($begin_date)) {$begin_date = $TODAY;} -if (!isset($end_date)) {$end_date = $TODAY;} +if ( (!isset($begin_date)) or (strlen($begin_date) < 10) ) {$begin_date = $TODAY;} +if ( (!isset($end_date)) or (strlen($end_date) < 10) ) {$end_date = $TODAY;} -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; -if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } +$did_id = preg_replace("/'|\"|\\\\|;/","",$did_id); +$did = preg_replace("/'|\"|\\\\|;/","",$did); +$begin_date = preg_replace("/'|\"|\\\\|;/","",$begin_date); +$end_date = preg_replace("/'|\"|\\\\|;/","",$end_date); +$user = preg_replace("/'|\"|\\\\|;/","",$user); -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';"; -if ($DB) {$MAIN.="|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$reports_only_user=$row[0]; +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) + { + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } -$fp = fopen ("./project_auth_entries.txt", "a"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) - { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } - ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); $LOGbrowser = getenv("HTTP_USER_AGENT"); @@ -162,7 +203,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $MAIN.="\n"; } -$stmt="SELECT full_name,user_group,admin_hide_lead_data,admin_hide_phone_data from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; +$stmt="SELECT full_name,user_group,admin_hide_lead_data,admin_hide_phone_data from vicidial_users where user='$PHP_AUTH_USER';"; $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $LOGfullname = $row[0]; @@ -170,12 +211,6 @@ $LOGuser_group = $row[1]; $LOGadmin_hide_lead_data = $row[2]; $LOGadmin_hide_phone_data = $row[3]; -if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } - $stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {$MAIN.="|$stmt|\n";} $rslt=mysql_query($stmt, $link); @@ -222,7 +257,7 @@ if ( (!preg_match('/\-\-ALL\-\-/i',$LOGadmin_viewable_groups)) and (strlen($LOGa if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; @@ -452,76 +487,81 @@ if ($did < 1) $MAIN.="
\n"; $MAIN.="AGENT LOGIN/LOGOUT TIME:     [DOWNLOAD]\n"; - $MAIN.="\n"; - $MAIN.="\n"; + $MAIN.="
EVENT DATE CAMPAIGN GROUPHOURS:MM:SSSESSIONSERVERPHONECOMPUTER
\n"; + $MAIN.="\n"; $CSV_text2.="\"AGENT LOGIN/LOGOUT TIME\"\n"; - $CSV_text2.="\"\",\"EVENT\",\"DATE\",\"CAMPAIGN\",\"GROUP\",\"HOURS:MM:SS\",\"SESSION\",\"SERVER\",\"PHONE\",\"COMPUTER\"\n"; + $CSV_text2.="\"\",\"EVENT\",\"DATE\",\"CAMPAIGN\",\"GROUP\",\"HOURS:MM:SS\",\"SESSION\",\"SERVER\",\"PHONE\",\"COMPUTER\",\"PHONE_LOGIN\",\"PHONE_IP\"\n"; - $stmt="SELECT event,event_epoch,event_date,campaign_id,user_group,session_id,server_ip,extension,computer_ip from vicidial_user_log where user='" . mysql_real_escape_string($user) . "' and event_date >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and event_date <= '" . mysql_real_escape_string($end_date) . " 23:59:59' order by event_date;"; - $rslt=mysql_query($stmt, $link); - $events_to_print = mysql_num_rows($rslt); + $stmt="SELECT event,event_epoch,event_date,campaign_id,user_group,session_id,server_ip,extension,computer_ip,phone_login,phone_ip from vicidial_user_log where user='" . mysql_real_escape_string($user) . "' and event_date >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and event_date <= '" . mysql_real_escape_string($end_date) . " 23:59:59' order by event_date;"; + $rslt=mysql_query($stmt, $link); + $events_to_print = mysql_num_rows($rslt); - $total_calls=0; - $o=0; - $event_start_seconds=''; - $event_stop_seconds=''; - while ($events_to_print > $o) { - $row=mysql_fetch_row($rslt); - if (preg_match("/LOGIN/i", $row[0])) - {$bgcolor='bgcolor="#B9CBFD"';} - else - {$bgcolor='bgcolor="#9BB9FB"';} + $total_calls=0; + $o=0; + $event_start_seconds=''; + $event_stop_seconds=''; + while ($events_to_print > $o) + { + $row=mysql_fetch_row($rslt); + if (preg_match("/LOGIN/i", $row[0])) + {$bgcolor='bgcolor="#B9CBFD"';} + else + {$bgcolor='bgcolor="#9BB9FB"';} - if (preg_match('/LOGIN/', $row[0])) + if (preg_match('/LOGIN/', $row[0])) + { + if ($row[10]=='LOOKUP') + {$row[10]='';} + $event_start_seconds = $row[1]; + $MAIN.=""; + $MAIN.="\n"; + $MAIN.="\n"; + $MAIN.="\n"; + $MAIN.="\n"; + $MAIN.="\n"; + $MAIN.="\n"; + $MAIN.="\n"; + $MAIN.="\n"; + $MAIN.="\n"; + $MAIN.="\n"; + $CSV_text2.="\"\",\"$row[0]\",$row[2]\",\"$row[3]\",\"$row[4]\",\"\",\"$row[5]\",\"$row[6]\",\"$row[7]\",\"$row[8]\",\"$row[9]\",\"$row[10]\"\n"; + } + if (preg_match('/LOGOUT/', $row[0])) + { + if ($event_start_seconds) { - $event_start_seconds = $row[1]; + + $event_stop_seconds = $row[1]; + $event_seconds = ($event_stop_seconds - $event_start_seconds); + $total_login_time = ($total_login_time + $event_seconds); + $event_hours_minutes = sec_convert($event_seconds,'H'); + $MAIN.=""; $MAIN.="\n"; $MAIN.="\n"; $MAIN.="\n"; - $MAIN.="\n"; - $MAIN.="\n"; - $MAIN.="\n"; - $MAIN.="\n"; - $MAIN.="\n"; - $CSV_text2.="\"\",\"$row[0]\",$row[2]\",\"$row[3]\",\"$row[4]\",\"\",\"$row[5]\",\"$row[6]\",\"$row[7]\",\"$row[8]\"\n"; + $MAIN.="\n"; + $MAIN.="\n"; + $event_start_seconds=''; + $event_stop_seconds=''; + $CSV_text2.="\"\",\"$row[0]\",\"$row[2]\",\"$row[3]\",\"$row[4]\",\"$event_hours_minutes\"\n"; } - if (preg_match('/LOGOUT/', $row[0])) + else { - if ($event_start_seconds) - { - - $event_stop_seconds = $row[1]; - $event_seconds = ($event_stop_seconds - $event_start_seconds); - $total_login_time = ($total_login_time + $event_seconds); - $event_hours_minutes = sec_convert($event_seconds,'H'); - - $MAIN.=""; - $MAIN.="\n"; - $MAIN.="\n"; - $MAIN.="\n"; - $MAIN.="\n"; - $MAIN.="\n"; - $event_start_seconds=''; - $event_stop_seconds=''; - $CSV_text2.="\"\",\"$row[0]\",\"$row[2]\",\"$row[3]\",\"$row[4]\",\"$event_hours_minutes\"\n"; - } - else - { - $MAIN.=""; - $MAIN.="\n"; - $MAIN.="\n"; - $MAIN.="\n"; - $MAIN.="\n"; - $CSV_text2.="\"\",\"$row[0]\",\"$row[2]\",\"$row[3]\"\n"; - } + $MAIN.=""; + $MAIN.="\n"; + $MAIN.="\n"; + $MAIN.="\n"; + $MAIN.="\n"; + $CSV_text2.="\"\",\"$row[0]\",\"$row[2]\",\"$row[3]\"\n"; } + } - $total_calls = ($total_calls + $row[0]); + $total_calls = ($total_calls + $row[0]); - $call_seconds=0; - $o++; + $call_seconds=0; + $o++; } $total_login_hours_minutes = sec_convert($total_login_time,'H'); diff --git a/agc_2-X/trunk/www/vicidial/user_status.php b/agc_2-X/trunk/www/vicidial/user_status.php index a7c51e9d..8ec7b9bc 100644 --- a/agc_2-X/trunk/www/vicidial/user_status.php +++ b/agc_2-X/trunk/www/vicidial/user_status.php @@ -22,6 +22,7 @@ # 120223-2135 - Removed logging of good login passwords if webroot writable is enabled # 130414-0252 - Added report logging # 130610-0937 - Finalized changing of all ereg instances to preg +# 130616-0052 - Added filtering of input to prevent SQL injection attacks and new user auth # $startMS = microtime(); @@ -31,6 +32,7 @@ header ("Content-type: text/html; charset=utf-8"); $report_name='User Status'; require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -69,151 +71,171 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### +if (!isset($begin_date)) {$begin_date = $TODAY;} +if (!isset($end_date)) {$end_date = $TODAY;} + $PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); +$user = preg_replace("/'|\"|\\\\|;/","",$user); +$group = preg_replace("/'|\"|\\\\|;/","",$group); +$stage = preg_replace("/'|\"|\\\\|;/","",$stage); +$begin_date = preg_replace("/'|\"|\\\\|;/","",$begin_date); +$end_date = preg_replace("/'|\"|\\\\|;/","",$end_date); $StarTtimE = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $ip = getenv("REMOTE_ADDR"); $check_time = ($StarTtimE - 86400); - -if (!isset($begin_date)) {$begin_date = $TODAY;} -if (!isset($end_date)) {$end_date = $TODAY;} - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';"; -if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$fp = fopen ("./project_auth_entries.txt", "a"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} + +if ($auth > 0) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } } else { - ##### BEGIN log visit to the vicidial_report_log table ##### - $LOGip = getenv("REMOTE_ADDR"); - $LOGbrowser = getenv("HTTP_USER_AGENT"); - $LOGscript_name = getenv("SCRIPT_NAME"); - $LOGserver_name = getenv("SERVER_NAME"); - $LOGserver_port = getenv("SERVER_PORT"); - $LOGrequest_uri = getenv("REQUEST_URI"); - $LOGhttp_referer = getenv("HTTP_REFERER"); - if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';} - else {$HTTPprotocol = 'http://';} - if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';} - else {$LOGserver_port = ":$LOGserver_port";} - $LOGfull_url = "$HTTPprotocol$LOGserver_name$LOGserver_port$LOGrequest_uri"; - - $stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$user, $stage, $group|', url='$LOGfull_url';"; - if ($DB) {echo "|$stmt|\n";} - $rslt=mysql_query($stmt, $link); - $report_log_id = mysql_insert_id($link); - ##### END log visit to the vicidial_report_log table ##### - - if($auth>0) + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') { - $stmt="SELECT full_name,change_agent_campaign,modify_timeclock_log from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfullname = $row[0]; - $change_agent_campaign = $row[1]; - $modify_timeclock_log = $row[2]; - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); - } + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } + +##### BEGIN log visit to the vicidial_report_log table ##### +$LOGip = getenv("REMOTE_ADDR"); +$LOGbrowser = getenv("HTTP_USER_AGENT"); +$LOGscript_name = getenv("SCRIPT_NAME"); +$LOGserver_name = getenv("SERVER_NAME"); +$LOGserver_port = getenv("SERVER_PORT"); +$LOGrequest_uri = getenv("REQUEST_URI"); +$LOGhttp_referer = getenv("HTTP_REFERER"); +if (preg_match("/443/i",$LOGserver_port)) {$HTTPprotocol = 'https://';} + else {$HTTPprotocol = 'http://';} +if (($LOGserver_port == '80') or ($LOGserver_port == '443') ) {$LOGserver_port='';} +else {$LOGserver_port = ":$LOGserver_port";} +$LOGfull_url = "$HTTPprotocol$LOGserver_name$LOGserver_port$LOGrequest_uri"; + +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$user, $stage, $group|', url='$LOGfull_url';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$report_log_id = mysql_insert_id($link); +##### END log visit to the vicidial_report_log table ##### + +$stmt="SELECT full_name,change_agent_campaign,modify_timeclock_log from vicidial_users where user='$PHP_AUTH_USER';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGfullname = $row[0]; +$change_agent_campaign = $row[1]; +$modify_timeclock_log = $row[2]; + +$stmt="SELECT full_name,user_group from vicidial_users where user='" . mysql_real_escape_string($user) . "';"; +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$full_name = $row[0]; +$user_group = $row[1]; + +$stmt="SELECT live_agent_id,user,server_ip,conf_exten,extension,status,lead_id,campaign_id,uniqueid,callerid,channel,random_id,last_call_time,last_update_time,last_call_finish,closer_campaigns,call_server_ip,user_level,comments,campaign_weight,calls_today,external_hangup,external_status,external_pause,external_dial,agent_log_id,last_state_change,agent_territories,outbound_autodial,manager_ingroup_set,external_igb_set_user from vicidial_live_agents where user='" . mysql_real_escape_string($user) . "';"; +$rslt=mysql_query($stmt, $link); +if ($DB) {echo "$stmt\n";} +$agents_to_print = mysql_num_rows($rslt); +$i=0; +while ($i < $agents_to_print) + { + $row=mysql_fetch_row($rslt); + $Aserver_ip = $row[2]; + $Asession_id = $row[3]; + $Aextension = $row[4]; + $Astatus = $row[5]; + $Acampaign = $row[7]; + $Acallerid = $row[9]; + $Alast_call = $row[14]; + $Acl_campaigns = $row[15]; + $agent_territories = $row[27]; + $outbound_autodial = $row[28]; + $manager_ingroup_set = $row[29]; + $external_igb_set_user = $row[30]; + $i++; + } + +$stmt="SELECT event_date,status,ip_address from vicidial_timeclock_status where user='" . mysql_real_escape_string($user) . "';"; +$rslt=mysql_query($stmt, $link); +if ($DB) {echo "$stmt\n";} +$tc_logs_to_print = mysql_num_rows($rslt); +if ($tc_logs_to_print > 0) + { + $row=mysql_fetch_row($rslt); + $Tevent_date = $row[0]; + $Tstatus = $row[1]; + $Tip_address = $row[2]; + $i++; + } + +if ($Astatus == 'INCALL') + { + $stmtP="select count(*) from parked_channels where channel_group='$Acallerid';"; + $rsltP=mysql_query($stmtP,$link); + $rowP=mysql_fetch_row($rsltP); + $parked_channel = $rowP[0]; + + if ($parked_channel > 0) + { + $Astatus = 'PARK'; } else { - if ($webroot_writable > 0) - { - fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; - } - } - - $stmt="SELECT full_name,user_group from vicidial_users where user='" . mysql_real_escape_string($user) . "';"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $full_name = $row[0]; - $user_group = $row[1]; - - $stmt="SELECT live_agent_id,user,server_ip,conf_exten,extension,status,lead_id,campaign_id,uniqueid,callerid,channel,random_id,last_call_time,last_update_time,last_call_finish,closer_campaigns,call_server_ip,user_level,comments,campaign_weight,calls_today,external_hangup,external_status,external_pause,external_dial,agent_log_id,last_state_change,agent_territories,outbound_autodial,manager_ingroup_set,external_igb_set_user from vicidial_live_agents where user='" . mysql_real_escape_string($user) . "';"; - $rslt=mysql_query($stmt, $link); - if ($DB) {echo "$stmt\n";} - $agents_to_print = mysql_num_rows($rslt); - $i=0; - while ($i < $agents_to_print) - { - $row=mysql_fetch_row($rslt); - $Aserver_ip = $row[2]; - $Asession_id = $row[3]; - $Aextension = $row[4]; - $Astatus = $row[5]; - $Acampaign = $row[7]; - $Acallerid = $row[9]; - $Alast_call = $row[14]; - $Acl_campaigns = $row[15]; - $agent_territories = $row[27]; - $outbound_autodial = $row[28]; - $manager_ingroup_set = $row[29]; - $external_igb_set_user = $row[30]; - $i++; - } - - $stmt="SELECT event_date,status,ip_address from vicidial_timeclock_status where user='" . mysql_real_escape_string($user) . "';"; - $rslt=mysql_query($stmt, $link); - if ($DB) {echo "$stmt\n";} - $tc_logs_to_print = mysql_num_rows($rslt); - if ($tc_logs_to_print > 0) - { - $row=mysql_fetch_row($rslt); - $Tevent_date = $row[0]; - $Tstatus = $row[1]; - $Tip_address = $row[2]; - $i++; - } - - if ($Astatus == 'INCALL') - { - $stmtP="select count(*) from parked_channels where channel_group='$Acallerid';"; + $stmtP="select count(*) from vicidial_auto_calls where callerid='$Acallerid';"; $rsltP=mysql_query($stmtP,$link); $rowP=mysql_fetch_row($rsltP); - $parked_channel = $rowP[0]; + $live_channel = $rowP[0]; - if ($parked_channel > 0) + if ($live_channel < 1) { - $Astatus = 'PARK'; - } - else - { - $stmtP="select count(*) from vicidial_auto_calls where callerid='$Acallerid';"; - $rsltP=mysql_query($stmtP,$link); - $rowP=mysql_fetch_row($rsltP); - $live_channel = $rowP[0]; - - if ($live_channel < 1) - { - $Astatus = 'DEAD'; - } + $Astatus = 'DEAD'; } } } + $stmt="select campaign_id from vicidial_campaigns;"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} @@ -854,6 +876,4 @@ $rslt=mysql_query($stmt, $link); exit; - - ?> diff --git a/agc_2-X/trunk/www/vicidial/user_territories.php b/agc_2-X/trunk/www/vicidial/user_territories.php index 0fff5b93..0969c76b 100644 --- a/agc_2-X/trunk/www/vicidial/user_territories.php +++ b/agc_2-X/trunk/www/vicidial/user_territories.php @@ -13,14 +13,16 @@ # 90726-2302 - Added vicidial_list user owner update option # 91012-0310 - Added vicidial_list counts for territory as owner # 130610-1050 - Finalized changing of all ereg instances to preg +# 130616-0010 - Added filtering of input to prevent SQL injection attacks and new user auth # -$version = '2.8-5'; -$build = '130610-1050'; +$version = '2.8-6'; +$build = '130616-0010'; $MT[0]=''; require("dbconnect.php"); +require("functions.php"); $PHP_SELF=$_SERVER['PHP_SELF']; if (isset($_GET["action"])) {$action=$_GET["action"];} @@ -44,7 +46,6 @@ if (isset($_GET["vl_owner"])) {$vl_owner=$_GET["vl_owner"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} - header ("Content-type: text/html; charset=utf-8"); header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 header ("Pragma: no-cache"); // HTTP/1.0 @@ -71,8 +72,6 @@ if ($ss_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### - - if ($user_territories_active < 1) { echo "ERROR: User Territories are not active on this system\n"; @@ -92,6 +91,17 @@ if ($non_latin < 1) $old_user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$old_user); $accountid = preg_replace('/[^-\_0-9a-zA-Z]/', '',$accountid); } +else + { + $action = preg_replace("/'|\"|\\\\|;/","",$action); + $territory = preg_replace("/'|\"|\\\\|;/","",$territory); + $territory_description = preg_replace("/'|\"|\\\\|;/","",$territory_description); + $user = preg_replace("/'|\"|\\\\|;/","",$user); + $level = preg_replace("/'|\"|\\\\|;/","",$level); + $old_territory = preg_replace("/'|\"|\\\\|;/","",$old_territory); + $old_user = preg_replace("/'|\"|\\\\|;/","",$old_user); + $accountid = preg_replace("/'|\"|\\\\|;/","",$accountid); + } if (preg_match("/YES/i",$batch)) { @@ -104,21 +114,26 @@ else $PASS=$_SERVER['PHP_AUTH_PW']; $USER = preg_replace('/[^0-9a-zA-Z]/','',$USER); $PASS = preg_replace('/[^0-9a-zA-Z]/','',$PASS); + } - $stmt="SELECT count(*) from vicidial_users where user='$USER' and pass='$PASS' and user_level > 7 and modify_users='1'"; - if ($DB) {echo "|$stmt|\n";} - if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $auth=$row[0]; +$auth=0; +$modify_users_auth=0; +$auth_message = user_authorization($USER,$PASS,'',1); +if ($auth_message == 'GOOD') + {$auth=1;} - if( (strlen($USER)<2) or (strlen($PASS)<2) or (!$auth)) - { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$USER|$PASS|\n"; - exit; - } +$stmt="SELECT count(*) from vicidial_users where user='$USER' and user_level > 7 and modify_users='1'"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$modify_users_auth=$row[0]; + +if( (strlen($USER)<2) or (strlen($PASS)<2) or (!$auth) or (!$modify_users_auth)) + { + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "Invalid Username/Password: |$USER|$PASS|$auth_message|\n"; + exit; } if ($enable_vtiger_integration > 0) @@ -129,12 +144,10 @@ if ($enable_vtiger_integration > 0) mysql_select_db("$vtiger_dbname", $linkV); } - if (strlen($action) < 1) {$action = 'LIST_ALL_TERRITORIES';} - ?> diff --git a/agc_2-X/trunk/www/vicidial/vdremote.php b/agc_2-X/trunk/www/vicidial/vdremote.php index 9b842be3..75a5c0ed 100644 --- a/agc_2-X/trunk/www/vicidial/vdremote.php +++ b/agc_2-X/trunk/www/vicidial/vdremote.php @@ -15,12 +15,14 @@ # 91129-2249 - Replaced SELECT STAR in SQL queries, formatting fixes # 120223-2135 - Removed logging of good login passwords if webroot writable is enabled # 130610-1105 - Finalized changing of all ereg instances to preg +# 130616-0005 - Added filtering of input to prevent SQL injection attacks and new user auth # -$version = '2.8-8'; -$build = '130610-1105'; +$version = '2.8-9'; +$build = '130616-0005'; require("dbconnect.php"); +require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; @@ -62,39 +64,37 @@ if ($force_logout) { if( (strlen($PHP_AUTH_USER)>0) or (strlen($PHP_AUTH_PW)>0) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); } echo "You have now logged out. Thank you\n"; exit; } +if (!isset($query_date)) {$query_date = $NOW_DATE;} $PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - +$remote_agent_id = preg_replace('/[^0-9a-zA-Z]/', '', $remote_agent_id); +$query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date); $popup_page = './closer_popup.php'; $STARTtime = date("U"); $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); -if (!isset($query_date)) {$query_date = $NOW_DATE;} - -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 3;"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; - -$fp = fopen ("./project_auth_entries.txt", "a"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); +$auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REMOTE',1); +if ($auth_message == 'GOOD') + {$auth=1;} + if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; + echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; exit; } else @@ -103,9 +103,7 @@ else if($auth>0) { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; + $stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';"; $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $LOGfullname=$row[0]; @@ -125,23 +123,13 @@ else $remote_agent_id=$row[0]; $server_ip=$row[1]; if (!$number_of_lines) {$number_of_lines=$row[2];} - - fwrite ($fp, "VDremote|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); } else { - fwrite ($fp, "VDremote|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfullname|\n"); - fclose($fp); echo "This remote agent does not exist: |$PHP_AUTH_USER|\n"; exit; } } - else - { - fwrite ($fp, "VDremote|FAIL|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|\n"); - fclose($fp); - } } echo "\n"; @@ -176,7 +164,7 @@ if ($ADD==71111) {echo "Remote Agent Closer Stats";} if (strlen($ADD)>4) { ##### get server listing for dynamic pulldown - $stmt="SELECT server_ip,server_description from servers order by server_ip"; + $stmt="SELECT server_ip,server_description from servers order by server_ip;"; $rslt=mysql_query($stmt, $link); $servers_to_print = mysql_num_rows($rslt); $servers_list=''; @@ -190,7 +178,7 @@ if (strlen($ADD)>4) } ##### get campaigns listing for dynamic pulldown - $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns order by campaign_id"; + $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns order by campaign_id;"; $rslt=mysql_query($stmt, $link); $campaigns_to_print = mysql_num_rows($rslt); $campaigns_list=''; @@ -214,7 +202,7 @@ if (strlen($ADD)>4) $groups = explode(" ", $closer_campaigns); } - $stmt="SELECT group_id,group_name from vicidial_inbound_groups order by group_id"; + $stmt="SELECT group_id,group_name from vicidial_inbound_groups order by group_id;"; $rslt=mysql_query($stmt, $link); $groups_to_print = mysql_num_rows($rslt); $groups_list=''; @@ -315,9 +303,9 @@ if ($ADD==41111) echo "
REMOTE AGENTS MODIFIED\n"; ### LOG CHANGES TO LOG FILE ### - $fp = fopen ("./admin_changes_log.txt", "a"); - fwrite ($fp, "$date|MODIFY REMOTE AGENTS ENTRY |$PHP_AUTH_USER|$ip|$stmt|\n"); - fclose($fp); + # $fp = fopen ("./admin_changes_log.txt", "a"); + # fwrite ($fp, "$date|MODIFY REMOTE AGENTS ENTRY |$PHP_AUTH_USER|$ip|$stmt|\n"); + # fclose($fp); } $stmt="SELECT remote_agent_id,user_start,number_of_lines,server_ip,conf_exten,status,campaign_id,closer_campaigns from vicidial_remote_agents where remote_agent_id='" . mysql_real_escape_string($remote_agent_id) . "';"; diff --git a/agc_2-X/trunk/www/vicidial/vicidial_sales_viewer.php b/agc_2-X/trunk/www/vicidial/vicidial_sales_viewer.php index 35de6eaa..c5e206b7 100644 --- a/agc_2-X/trunk/www/vicidial/vicidial_sales_viewer.php +++ b/agc_2-X/trunk/www/vicidial/vicidial_sales_viewer.php @@ -10,6 +10,7 @@ # 90310-2135 - Added admin header # 90508-0644 - Changed to PHP long tags # 130610-1127 - Finalized changing of all ereg instances to preg +# 130615-2357 - Added filtering of input to prevent SQL injection attacks and new user auth # if (isset($_GET["dcampaign"])) {$dcampaign=$_GET["dcampaign"];} @@ -25,26 +26,65 @@ if (isset($_GET["sales_time_frame"])) {$sales_time_frame=$_GET["sales_time_fra if (isset($_GET["forc"])) {$forc=$_GET["forc"];} elseif (isset($_POST["forc"])) {$forc=$_POST["forc"];} +include("dbconnect.php"); +include("functions.php"); + $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); +$dcampaign = preg_replace('/[^0-9a-zA-Z]/', '', $dcampaign); -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_query($stmt, $link); -$row=mysql_fetch_row($rslt); -$auth=$row[0]; +$auth=0; +$reports_auth=0; +$admin_auth=0; +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1); +if ($auth_message == 'GOOD') + {$auth=1;} - if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ($auth > 0) { -# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); -# Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password or no export report permission: |$PHP_AUTH_USER|\n"; - exit; - } + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $admin_auth=$row[0]; + $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;"; + if ($DB) {echo "|$stmt|\n";} + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $reports_auth=$row[0]; + + if ($reports_auth < 1) + { + $VDdisplayMESSAGE = "You are not allowed to view reports"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + if ( ($reports_auth > 0) and ($admin_auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + } +else + { + $VDdisplayMESSAGE = "Login incorrect, please try again"; + if ($auth_message == 'LOCK') + { + $VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes"; + Header ("Content-type: text/html; charset=utf-8"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; + exit; + } + Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; + exit; + } ?> @@ -52,7 +92,7 @@ $auth=$row[0]; Recent Sales Lookup
EVENT DATE CAMPAIGN GROUPSESSION
HOURS:MM:SS		SERVERPHONECOMPUTERPHONE
LOGIN		PHONE IP
$row[0] $row[2] $row[3] $row[4] $row[5] $row[6] $row[7] $row[8] $row[9] $row[10]
$row[0] $row[2] $row[3] $row[4] $row[5] $row[6] $row[7] $row[8]
$event_hours_minutes  
$row[0] $row[2] $row[3] $row[4] $event_hours_minutes  
$row[0] $row[2] $row[3]  
$row[0] $row[2] $row[3]