ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added CORS support for some admin web PHP scripts

Browse Source 
git-svn-id: svn://192.168.202.10@3460 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2021-06-18 19:23:02 +00:00
parent e2e0505570
commit d213754cd4
8 changed files with 201 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/UPGRADE
+2 -1
View File
@@ -646,7 +646,8 @@ OTHER CHANGES:
an override setting based upon the day of the week and time of day.
180. Added CORS(Cross-Origin Resource Sharing) support for the VICIdial agent
PHP scripts. see the CORS_SUPPORT.txt doc for more information.
PHP scripts and select admin PHP scripts. see the CORS_SUPPORT.txt doc
for more information.
agc_2-X/trunk/docs/CORS_SUPPORT.txt
+33 -4
View File
@@ -1,8 +1,8 @@
CORS DOC(Cross-Origin Resource Sharing) Started: 2021-06-17 Updated: 2021-06-17
CORS DOC(Cross-Origin Resource Sharing) Started: 2021-06-17 Updated: 2021-06-18
This document will go over how to configure CORS (Cross-Origin Resource Sharing) with the scripts associated with the VICIdial agent screen.
This document will go over how to configure CORS (Cross-Origin Resource Sharing) with the scripts associated with the VICIdial agent and admin screen PHP scripts.
@@ -23,7 +23,7 @@ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
VICIDIAL AGENT WEB SCREEN SCRIPTS SUPPORT:
Support for CORS configuration for almost all of the PHP scripts in the "agc" web directory was added on 2021-06-17(svn/trunk revision 3459) with the addition of the "agentCORS.php" file and the addition of the following to the "agc/options.php" file on your webserver:
Support for CORS configuration for almost all of the PHP scripts in the "agc" web directory was added on 2021-06-17(svn/trunk revision 3459) with the addition of the "agentCORS.php" file and the addition of the following configurable variables to the "agc/options.php" file on your webserver:
(NOTE: If you have never set up an "agc/options.php" file on your webserver before, just use a copy the file "agc/options-example.php")
@@ -52,4 +52,33 @@ NOTES:
VICIDIAL ADMIN WEB SCREEN SCRIPTS SUPPORT:
Currently under development, the plan is support the "non_agent_api.php" script to start, then add some other scripts over time.
The implementation of CORS on tha admin side is very similar to the agent side, except only a limited number of admin PHP scripts are CORS-enabled at this time, and there is no '--ALL--' option for the $CORS_affected_scripts variable, so you must include every script you want to have CORS enabled on for the admin side in that variable. Support for CORS configuration for these limited admin "vicidial" web directory PHP scripts was added on 2021-06-18(svn/trunk revision 3460) with the addition of the "adminCORS.php" file and the addition of the following configurable variables to the "vicidial/options.php" file on your webserver:
(NOTE: If you have never set up an "vicidial/options.php" file on your webserver before, just use a copy the file "vicidial/options-example.php")
List of CORS-enabled admin("vicidial") PHP scripts:
- non_agent_api.php
- vdremote.php
- AST_timeonVDADall.php
- nanpa_type.php
# CORS settings: (to enable, customize the variables below, and uncomment the "require_once('adminCORS.php');" line at the bottom)
# (NOTE: The first 3 variables must be set for these features to be active)
$CORS_allowed_origin = ''; # if multiple origins allowed, separate them by a pipe (also allows PHP preg syntax)
# examples: 'https://acme.org|https://internal.acme.org' or "https?:\/\/(.*\\.?example\\.com|localhost):?[0-9]*|null"
$CORS_allowed_methods = ''; # if multiple methods allowed, separate them by a comma
# example: 'GET,POST,OPTIONS,HEAD'
$CORS_affected_scripts = ''; # If multiple(but less than all) scripts affected, separate them by a space (see CORS_SUPPORT.txt doc for list of files)
# examples: 'non_agent_api.php vdremote.php' or 'non_agent_api.php'
$CORS_allowed_headers = ''; # passed in Access-Control-Allow-Headers http response header,
# examples: X-Requested-With, X-Forwarded-For, X-Forwarded-Proto, Authorization, Cookie, Content-Type
$CORS_allowed_credentials = 'N'; # 'Y' or 'N', whether to send credentials to browser or not
$Xframe_options = 'N'; # Not part of CORS, but can prevent Iframe/embed/etc... use by foreign website, will populate for all affected scripts
# examples: 'N', 'SAMEORIGIN', 'DENY' NOTE: using 'DENY' may break some admin screen functionality
$CORS_debug = 0; # 0 = no, 1 = yes (default is no) This will generate a lot of log entries in a CORSdebug_log.txt file
# require_once('adminCORS.php');
NOTES:
- It is STRONGLY recommended that you do not set the $CORS_allowed_origin variable to '*', this creates a very insecure situation where any website anywhere can use the resources on your webserver within any browser window, iframe or hidden span.
agc_2-X/trunk/www/vicidial/AST_timeonVDADall.php
+10 -9
View File
@@ -123,12 +123,12 @@
# 201107-2253 - Added display of parked calls, inbound SLA stats and LIMITED report type
# 210314-2040 - Added optional DID Description display for inbound calls
# 210615-2241 - Fix for issue #1314
# 210618-1011 - Added CORS support
#
$version = '2.14-108';
$build = '210615-2241';
header ("Content-type: text/html; charset=utf-8");
$version = '2.14-109';
$build = '210618-1011';
$php_script='AST_timeonVDADall.php';
require("dbconnect_mysqli.php");
require("functions.php");
@@ -251,6 +251,12 @@ if (isset($_GET["parkSTATS"])) {$parkSTATS=$_GET["parkSTATS"];}
if (isset($_GET["SLAinSTATS"])) {$SLAinSTATS=$_GET["SLAinSTATS"];}
elseif (isset($_POST["SLAinSTATS"])) {$SLAinSTATS=$_POST["SLAinSTATS"];}
if (file_exists('options.php'))
{
require('options.php');
}
header ("Content-type: text/html; charset=utf-8");
$report_name = 'Real-Time Main Report';
$db_source = 'M';
@@ -294,11 +300,6 @@ $RS_agentWAIT = 3;
$RS_INcolumnsHIDE = 0;
$RS_DIDdesc = 0;
if (file_exists('options.php'))
{
require('options.php');
}
if (strlen($RS_report_default_format) > 3) {$SSreport_default_format = $RS_report_default_format;}
if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;}
agc_2-X/trunk/www/vicidial/adminCORS.php
+117
View File
@@ -0,0 +1,117 @@
<?php
# adminCORS.php - CORS processing and responses for Cross-Origin Features
#
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# CORS settings coming from the options.php script (the first 3 variables must be set for these features to be active)
# $CORS_allowed_origin = ''; # if multiple origins allowed, separate them by a pipe (also allows PHP preg syntax)
# # examples: 'https://acme.org|https://internal.acme.org' or "https?:\/\/(.*\\.?example\\.com|localhost):?[0-9]*|null"
# $CORS_allowed_methods = ''; # if multiple methods allowed, separate them by a comma
# # example: 'GET,POST,OPTIONS,HEAD'
# $CORS_affected_scripts = ''; # If multiple(but less than all) scripts affected, separate them by a space (see CORS_SUPPORT.txt doc for list of files)
# # examples: 'non_agent_api.php vdremote.php' or 'non_agent_api.php'
# $CORS_allowed_headers = ''; # passed in Access-Control-Allow-Headers http response header,
# # examples: X-Requested-With, X-Forwarded-For, X-Forwarded-Proto, Authorization, Cookie, Content-Type
# $CORS_allowed_credentials = 'N'; # 'Y' or 'N', whether to send credentials to browser or not
# $Xframe_options = 'N'; # Not part of CORS, but can prevent Iframe/embed/etc... use by foreign website, will populate for all affected scripts
# # examples: 'N', 'SAMEORIGIN', 'DENY' NOTE: using 'DENY' may break some admin screen functionality
# $CORS_debug = 0; # 0 = no, 1 = yes (default is no) This will generate a lot of log entries in a CORSdebug_log.txt file
#
#
# CHANGELOG
# 210618-0938 - First Build
#
$NOW_TIME = date("Y-m-d H:i:s");
if (strlen($php_script) < 1)
{exit;}
$CORS_origin = $_SERVER['HTTP_ORIGIN']; # The client browser origin server
$CORS_method = isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) ? $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] : $_SERVER['REQUEST_METHOD']; # Either the requested HTTP method or the current one
$CORS_affected_scripts = " $CORS_affected_scripts "; # surround with spaces for preg match below
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 1: BEGIN - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$CORS_affected_scripts($php_script)|$CORS_allowed_credentials|$CORS_allowed_headers|$Xframe_options|$CORS_debug|\n");
fclose($fp);
}
# if options.php $CORS_allowed_origin or $CORS_allowed_methods variables are not set, do nothing
if ( (strlen($CORS_allowed_origin) < 1) or (strlen($CORS_allowed_methods) < 1) or (strlen($CORS_affected_scripts) < 1) )
{
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 2: variable not set - |$CORS_allowed_origin|$CORS_allowed_methods|$CORS_affected_scripts|\n");
fclose($fp);
}
}
else
{
# check for affected scripts match (--ALL--, one-of-many)
#if ( (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts)) or ($CORS_affected_scripts == ' --ALL-- ') )
if (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts))
{
# check for allowed origin match (wildcard, one-of-many, preg-match) and check for allowed method match (one-of-many)
if ( ( ($CORS_allowed_origin == '*') or (stripos($CORS_allowed_origin,$CORS_origin) !== false) or (preg_match('/' . $CORS_allowed_origin . '/i', $CORS_origin)) ) and (preg_match('/' . $CORS_method . '/i', $CORS_allowed_methods)) )
{
header('Access-Control-Allow-Origin: ' . $CORS_origin);
header('Access-Control-Allow-Methods: ' . $CORS_allowed_methods);
if (strlen($CORS_allowed_headers) > 0)
{
header('Access-Control-Allow-Headers: ' . $CORS_allowed_headers);
}
if ($CORS_allowed_credentials == 'Y')
{
header('Access-Control-Allow-Credentials: true');
}
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 3: MATCHES found - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$php_script\n");
fclose($fp);
}
}
else
{
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 4: NO MATCH origin or method - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$php_script\n");
fclose($fp);
}
}
# For OPTIONS preflight requests, exit without processing the script further
if ( (strcasecmp($_SERVER['REQUEST_METHOD'], 'OPTIONS') == 0) and (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) )
{
flush();
die();
}
}
else
{
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 5: NO AFFECT script - |$CORS_affected_scripts|$php_script|\n");
fclose($fp);
}
}
# add $Xframe_options if defined
if ( ($Xframe_options == 'SAMEORIGIN') or ($Xframe_options == 'DENY') )
{
header('X-Frame-Options: ' . $Xframe_options);
if ($CORS_debug > 0)
{
$fp = fopen ("./CORSdebug_log.txt", "a");
fwrite ($fp, "$NOW_TIME CORS-Debug 6: X-frame-Options sent - |$Xframe_options|$php_script\n");
fclose($fp);
}
}
}
?>
agc_2-X/trunk/www/vicidial/nanpa_type.php
+7 -3
View File
@@ -1,7 +1,7 @@
<?php
# nanpa_type.php
#
# Copyright (C) 2017 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed to work with the NANPA exchange(NPA-NXX-X) data and
# the wireless-to-wired and wired-to-wireless number portability data from
@@ -30,10 +30,12 @@
# 130822-1433 - First build of script
# 140702-2251 - Added prefix phone type of V as landline
# 170409-1531 - Added IP List validation code
# 210618-1012 - Added CORS support
#
$version = '2.14-3';
$build = '170409-1531';
$version = '2.14-4';
$build = '210618-1012';
$php_script='nanpa_type.php';
$startMS = microtime();
@@ -52,6 +54,8 @@ if (isset($_GET["phone_number"])) {$phone_number=$_GET["phone_number"];}
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
if (file_exists('options.php'))
{require('options.php');}
header ("Content-type: text/html; charset=utf-8");
header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
agc_2-X/trunk/www/vicidial/non_agent_api.php
+6 -7
View File
@@ -178,10 +178,12 @@
# 210406-1047 - Added 'dialable_count' option to list_info function
# 210517-1850 - Added phone_code as modifiable field in update_lead function
# 210611-1610 - Added more variables for add_did/update_did functions
# 210618-1000 - Added CORS support
#
$version = '2.14-155';
$build = '210611-1610';
$version = '2.14-156';
$build = '210618-1000';
$php_script='non_agent_api.php';
$api_url_log = 0;
$startMS = microtime();
@@ -647,6 +649,8 @@ if (isset($_GET["call_handle_method"])) {$call_handle_method=$_GET["call_hand
if (isset($_GET["agent_search_method"])) {$agent_search_method=$_GET["agent_search_method"];}
elseif (isset($_POST["agent_search_method"])) {$agent_search_method=$_POST["agent_search_method"];}
if (file_exists('options.php'))
{require('options.php');}
header ("Content-type: text/html; charset=utf-8");
header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
@@ -2786,11 +2790,6 @@ if ($function == 'blind_monitor')
### BEGIN optional logging to vicidial_url_log for non-interface URL calls ###
if (file_exists('options.php'))
{
require('options.php');
}
if ($api_url_log > 0)
{
$ip = getenv("REMOTE_ADDR");
agc_2-X/trunk/www/vicidial/options-example.php
+18
View File
@@ -30,6 +30,7 @@
# 200506-1628 - Added RS_CUSTINFOdisplay & RS_CUSTINFOminUL options
# 201107-2257 - Added RS_parkSTATS option
# 210314-2101 - Added RS_DIDdesc option
# 210618-0937 - Added CORS support
#
# used by the realtime_report.php script
@@ -128,4 +129,21 @@ $enable_status_mismatch_leadloader_option=0;
# call report export ALTERNATE_2 header
$call_export_report_ALTERNATE_2_header="address3\tfirst_name\tlast_name\tphone_number\tstatus_name\tstatus_date\r\n";
# CORS settings: (to enable, customize the variables below, and uncomment the "require_once('adminCORS.php');" line at the bottom)
# (NOTE: The first 3 variables must be set for these features to be active)
$CORS_allowed_origin = ''; # if multiple origins allowed, separate them by a pipe (also allows PHP preg syntax)
# examples: 'https://acme.org|https://internal.acme.org' or "https?:\/\/(.*\\.?example\\.com|localhost):?[0-9]*|null"
$CORS_allowed_methods = ''; # if multiple methods allowed, separate them by a comma
# example: 'GET,POST,OPTIONS,HEAD'
$CORS_affected_scripts = ''; # If multiple(but less than all) scripts affected, separate them by a space (see CORS_SUPPORT.txt doc for list of files)
# examples: 'non_agent_api.php vdremote.php' or 'non_agent_api.php'
$CORS_allowed_headers = ''; # passed in Access-Control-Allow-Headers http response header,
# examples: X-Requested-With, X-Forwarded-For, X-Forwarded-Proto, Authorization, Cookie, Content-Type
$CORS_allowed_credentials = 'N'; # 'Y' or 'N', whether to send credentials to browser or not
$Xframe_options = 'N'; # Not part of CORS, but can prevent Iframe/embed/etc... use by foreign website, will populate for all affected scripts
# examples: 'N', 'SAMEORIGIN', 'DENY' NOTE: using 'DENY' may break some admin screen functionality
$CORS_debug = 0; # 0 = no, 1 = yes (default is no) This will generate a lot of log entries in a CORSdebug_log.txt file
# require_once('adminCORS.php');
?>
agc_2-X/trunk/www/vicidial/vdremote.php
+8 -3
View File
@@ -4,7 +4,7 @@
# make sure you have added a user to the vicidial_users MySQL table with at
# least user_level 4 to access this page the first time
#
# Copyright (C) 2017 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# Changes
# 50307-1721 - First version
@@ -21,10 +21,12 @@
# 141007-2123 - Finalized adding QXZ translation to all admin files
# 141229-1847 - Added code for on-the-fly language translations display
# 170217-1213 - Fixed non-latin auth issue #995
# 210618-1001 - Added CORS support
#
$version = '2.14-13';
$build = '170217-1213';
$version = '2.14-14';
$build = '210618-1001';
$php_script='vdremote.php';
require("dbconnect_mysqli.php");
require("functions.php");
@@ -66,6 +68,9 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
if (!isset($force_logout)) {$force_logout = 0;}
if (file_exists('options.php'))
{require('options.php');}
if ($force_logout)
{
if( (strlen($PHP_AUTH_USER)>0) or (strlen($PHP_AUTH_PW)>0) )