ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added several security changes to the admin interface, including freezing a user's account for 15 minutes after 10 failed login attempts.

Browse Source 
Added 3 new reports to the admin interface: url log, lagged log and user group login reports
Added new AST_phone_update.pl --agent-lookup flag to allow for logging of the IP address of the agent's SIP or IAX phone connection. Can be enabled as a crontab entry to perform the lookups on each asterisk server.

git-svn-id: svn://192.168.202.10@1997 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2013-07-02 06:00:53 +00:00
parent d585504151
commit cf21ae391e
112 changed files with 8058 additions and 4242 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/vicidial/closer-fronter_popup.php
+66 -51
View File
@@ -11,9 +11,11 @@
# 90508-0644 - Changed to PHP long tags
# 120223-2124 - Removed logging of good login passwords if webroot writable is enabled
# 130610-1115 - Finalized changing of all ereg instances to preg
# 130620-0824 - Added filtering of input to prevent SQL injection attacks and new user auth
#
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -99,8 +101,33 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
$SSoutbound_autodial_active = $row[2];
$user_territories_active = $row[3];
}
##### END SETTINGS LOOKUP #####
###########################################
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
#$DB = '1'; # DEBUG override
$US = '_';
@@ -110,67 +137,55 @@ $NOW_TIME = date("Y-m-d H:i:s");
$REC_TIME = date("Ymd-His");
$FILE_datetime = $STARTtime;
$parked_time = $STARTtime;
# $ext_context = 'default'; defined in dbconnect file
$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 0;";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$fp = fopen ("./project_auth_entries.txt", "a");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($user)<2) or (strlen($pass)<2) or (!$auth))
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'QC',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
Header("WWW-Authenticate: Basic realm=\"VICIDIAL-CLOSER\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$user|$pass|\n";
exit;
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
else
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
$fullname = $row[0];
if ( (strlen($customer_zap_channel)>2) and (preg_match('/zap/i',$customer_zap_channel)) )
{
echo "\n<!-- zap channel: $customer_zap_channel -->\n";
echo "\n<!-- session_id: $session_id -->\n";
if($auth>0)
{
$office_no=strtoupper($user);
$password=strtoupper($pass);
$stmt="SELECT full_name from vicidial_users where user='$user' and pass='$pass'";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname=$row[0];
$fullname = $row[0];
fwrite ($fp, "VD_CLOSER|GOOD|$date|$user|XXXX|$ip|$browser|$LOGfullname|\n");
fclose($fp);
if ( (strlen($customer_zap_channel)>2) and (preg_match('/zap/i',$customer_zap_channel)) )
{
echo "\n<!-- zap channel: $customer_zap_channel -->\n";
echo "\n<!-- session_id: $session_id -->\n";
}
else
{
echo "Bad channel: $customer_zap_channel\n";
echo "Make sure the Zap channel is live and try again\n";
exit;
}
}
else
{
fwrite ($fp, "VD_CLOSER|FAIL|$date|$user|XXXX|$ip|$browser|\n");
fclose($fp);
}
}
else
{
echo "Bad channel: $customer_zap_channel\n";
echo "Make sure the Zap channel is live and try again\n";
exit;
}
echo "<html>\n";
echo "<head>\n";
echo "<title>VICIDIAL FRONTER-CLOSER: Popup</title>\n";
echo "<title>FRONTER-CLOSER: Popup</title>\n";
echo "<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n";
if (preg_match('/CL_UNIV/i',$channel_group))