ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added several security changes to the admin interface, including freezing a user's account for 15 minutes after 10 failed login attempts.

Browse Source 
Added 3 new reports to the admin interface: url log, lagged log and user group login reports
Added new AST_phone_update.pl --agent-lookup flag to allow for logging of the IP address of the agent's SIP or IAX phone connection. Can be enabled as a crontab entry to perform the lookups on each asterisk server.

git-svn-id: svn://192.168.202.10@1997 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2013-07-02 06:00:53 +00:00
parent d585504151
commit cf21ae391e
112 changed files with 8058 additions and 4242 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/vicidial/AST_timeonVDADallSUMMARY.php
+62 -23
View File
@@ -24,9 +24,11 @@
# 110517-0059 - Added campaign type display option
# 110703-1854 - Added doanload option
# 130610-1120 - Finalized changing of all ereg instances to preg
# 130620-2256 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -78,31 +80,68 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
$MAIN.="<!-- Using slave server $slave_db_server $db_source -->\n";
}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level='7' and view_reports='1' and active='Y';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_only_user=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($non_latin < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$auth=0;
$reports_auth=0;
$admin_auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REPORTS',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth > 0)
{
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$admin_auth=$row[0];
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 6 and view_reports > 0;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$reports_auth=$row[0];
if ($reports_auth < 1)
{
$VDdisplayMESSAGE = "You are not allowed to view reports";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
if ( ($reports_auth > 0) and ($admin_auth < 1) )
{
$ADD=999999;
$reports_only_user=1;
}
}
else
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {$MAIN.="|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -117,7 +156,7 @@ $LOGallowed_reports = $row[1];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;