ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added additional variable filtering

Browse Source 
git-svn-id: svn://192.168.202.10@2760 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2017-05-27 07:14:38 +00:00
parent 2e54eb51e5
commit d46b1b5d26
95 changed files with 414 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/agc/live_exten_check.php
+9 -4
View File
@@ -1,7 +1,7 @@
<?php
# live_exten_check.php version 2.12
# live_exten_check.php version 2.14
#
# Copyright (C) 2015 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2017 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed purely to send whether the client channel is live and to what channel it is connected
# This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table
@@ -39,10 +39,11 @@
# 141128-0854 - Code cleanup for QXZ functions
# 141216-2109 - Added language settings lookups and user/pass variable standardization
# 150723-1713 - Added ajax logging
# 170526-2234 - Added additional variable filtering
#
$version = '2.10-16';
$build = '150723-1713';
$version = '2.14-17';
$build = '170526-2234';
$php_script = 'live_exten_check.php';
$SSagent_debug_logging=0;
$startMS = microtime();
@@ -70,10 +71,14 @@ if (isset($_GET["favorites_count"])) {$favorites_count=$_GET["favorites_count
if (isset($_GET["favorites_list"])) {$favorites_list=$_GET["favorites_list"];}
elseif (isset($_POST["favorites_list"])) {$favorites_list=$_POST["favorites_list"];}
# variable filtering
$user=preg_replace("/\'|\"|\\\\|;| /","",$user);
$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten);
$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol);
$favorites_list = preg_replace("/\'|\"|\\\\|;| /","",$favorites_list);
# default optional vars if not set
if (!isset($format)) {$format="text";}