ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Default security fixes, CVE-2021-28854

Browse Source 
git-svn-id: svn://192.168.202.10@3454 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2021-06-15 15:10:25 +00:00
parent 0013d84fa8
commit d4bd530333
19 changed files with 158 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/agc/astguiclient.php
+7 -6
View File
@@ -1,7 +1,7 @@
<?php
# astguiclient.php - the web-based version of the astGUIclient client application
#
# Copyright (C) 2020 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# make sure you have added a user to the vicidial_users MySQL table with at least
# user_level 1 or greater to access this page. Also you need to have the login
@@ -70,10 +70,11 @@
# 150727-0915 - Added default_language
# 190111-0902 - Fix for PHP7
# 200319-1532 - Small fixes for conference tab issues
# 210615-1037 - Default security fixes, CVE-2021-28854
#
$version = '2.2.6-3';
$build = '200319-1532';
$version = '2.2.6-4';
$build = '210615-1037';
require_once("dbconnect_mysqli.php");
require_once("functions.php");
@@ -180,7 +181,7 @@ if (preg_match("/^GOOD/",$auth_message))
$US='_';
$CL=':';
if ($WeBRooTWritablE > 0)
{$fp = fopen ("./astguiclient_auth_entries.txt", "a");}
{$fp = fopen ("./astguiclient_auth_entries.txt", "w");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
@@ -238,7 +239,7 @@ else
$LOGfullname=$row[0];
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$user|XXXX|$ip|$browser|$LOGfullname|\n");
fwrite ($fp, "VICIDIAL|GOOD|$date|\n");
fclose($fp);
}
}
@@ -246,7 +247,7 @@ else
{
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$user|XXXX|$ip|$browser|$LOGfullname|\n");
fwrite ($fp, "VICIDIAL|FAIL|$date|\n");
fclose($fp);
}
}