ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added additional variable filtering

Browse Source 
git-svn-id: svn://192.168.202.10@2760 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2017-05-27 07:14:38 +00:00
parent 2e54eb51e5
commit d46b1b5d26
95 changed files with 414 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/agc/park_calls_display.php
+8 -4
View File
@@ -1,7 +1,7 @@
<?php
# park_calls_display.php version 2.12
# park_calls_display.php version 2.14
#
# Copyright (C) 2015 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2017 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed purely to send the details on the parked calls on the server
# This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table
@@ -30,10 +30,11 @@
# 141118-1237 - Formatting changes for QXZ output
# 141216-2105 - Added language settings lookups and user/pass variable standardization
# 150723-1712 - Added ajax logging
# 170526-2244 - Added additional variable filtering
#
$version = '0.0.12';
$build = '150723-1712';
$version = '2.14-13';
$build = '170526-2244';
$php_script = 'park_calls_display.php';
$SSagent_debug_logging=0;
$startMS = microtime();
@@ -57,10 +58,13 @@ if (isset($_GET["exten"])) {$exten=$_GET["exten"];}
if (isset($_GET["protocol"])) {$protocol=$_GET["protocol"];}
elseif (isset($_POST["protocol"])) {$protocol=$_POST["protocol"];}
# variable filtering
$user=preg_replace("/\'|\"|\\\\|;| /","",$user);
$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten);
$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol);
# default optional vars if not set
if (!isset($format)) {$format="text";}