ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixes for upload filename filtering

Browse Source 
git-svn-id: svn://192.168.202.10@1824 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2012-05-29 18:35:03 +00:00
parent 8b38ed4387
commit e0a09764f3
12 changed files with 114 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/branches/agc_2.4/www/vicidial/AST_admin_template_maker.php
+5 -1
View File
@@ -5,6 +5,7 @@
#
# CHANGES
# 120402-2132 - First Build
# 120529-1427 - Filename filter fix
#
require("dbconnect.php");
@@ -193,6 +194,8 @@ $NWE = "')\"><IMG SRC=\"help.gif\" WIDTH=20 HEIGHT=20 BORDER=0 ALT=\"HELP\" ALIG
<head>
</head>
<script language="Javascript">
var form_file_name='';
function init() {
document.getElementById("listloader_file_primer").onsubmit=function() {
document.getElementById("listloader_file_primer").target = "file_holder";
@@ -229,7 +232,7 @@ function DisplayTemplateFields(list_id) {
xmlhttp = new XMLHttpRequest();
}
if (xmlhttp) {
var vs_query = "&custom_fields_enabled="+custom_fields_enabled+"&list_id="+list_id+"&delimiter="+delimiter+"&buffer="+buffer;
var vs_query = "&custom_fields_enabled="+custom_fields_enabled+"&list_id="+list_id+"&delimiter="+delimiter+"&buffer="+buffer+"&sample_template_file_name="+form_file_name;
xmlhttp.open('POST', 'leadloader_template_display.php');
xmlhttp.setRequestHeader('Content-Type','application/x-www-form-urlencoded; charset=UTF-8');
xmlhttp.send(vs_query);
@@ -264,6 +267,7 @@ function DrawTemplateStrings() {
document.getElementById("custom_fields_layout").value=custom_string;
}
function loadIFrame(form_action, field_value) {
form_file_name = field_value;
if (field_value=="") {
document.getElementById('list_data_display').style.display = 'none';
document.getElementById('list_data_display').style.visibility = 'hidden';
agc_2-X/branches/agc_2.4/www/vicidial/admin_listloader_fourth_gen.php
+10 -4
View File
@@ -46,10 +46,11 @@
# 120223-2318 - Removed logging of good login passwords if webroot writable is enabled
# 120402-2128 - Added template options
# 120525-1038 - Added uploaded filename filtering
# 120529-1348 - Filename filter fix
#
$version = '2.4-45';
$build = '120525-1038';
$version = '2.4-46';
$build = '120529-1348';
require("dbconnect.php");
@@ -154,8 +155,6 @@ if ( $phone_code_override == "in_file" ) { $phone_code_override = ""; }
### REGEX to prevent weird characters from ending up in the fields
$field_regx = "['\"`\\;]";
$lead_file = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$lead_file);
$leadfile_name = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$leadfile_name);
$vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|';
@@ -250,6 +249,13 @@ else
}
}
if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig))
{
echo "ERROR: Invalid File Name: $LF_orig\n";
exit;
}
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
agc_2-X/branches/agc_2.4/www/vicidial/admin_listloader_third_gen.php
+9 -4
View File
@@ -45,10 +45,11 @@
# 120221-0140 - Added User Group restrictions
# 120223-2318 - Removed logging of good login passwords if webroot writable is enabled
# 120525-1037 - Added uploaded filename filtering
# 120529-1347 - Filename filter fix
#
$version = '2.4-44';
$build = '120525-1037';
$version = '2.4-45';
$build = '120529-1347';
require("dbconnect.php");
@@ -151,8 +152,6 @@ if ( $phone_code_override == "in_file" ) { $phone_code_override = ""; }
### REGEX to prevent weird characters from ending up in the fields
$field_regx = "['\"`\\;]";
$lead_file = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$lead_file);
$leadfile_name = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$leadfile_name);
$vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|';
@@ -247,6 +246,12 @@ else
}
}
if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig))
{
echo "ERROR: Invalid File Name: $LF_orig\n";
exit;
}
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
agc_2-X/branches/agc_2.4/www/vicidial/audio_store.php
+8 -2
View File
@@ -12,10 +12,11 @@
# 110922-2331 - Added modify_audiostore user option for access
# 111122-1332 - Added more filename filtering
# 120525-0739 - Added yet more filename filtering
# 120529-1345 - Filename filter fix
#
$version = '2.4-6';
$build = '120525-0739';
$version = '2.4-7';
$build = '120529-1345';
$MT[0]='';
@@ -75,6 +76,11 @@ if ( ( (strlen($sounds_web_server)) != (strlen($server_name)) ) or (!eregi("$sou
exit;
}
if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$AF_orig))
{
echo "ERROR: Invalid File Name: $AF_orig\n";
exit;
}
### check if web directory exists, if not generate one
if (strlen($sounds_web_directory) < 30)
agc_2-X/branches/agc_2.4/www/vicidial/leadloader_template_display.php
+17 -3
View File
@@ -6,6 +6,7 @@
# CHANGES
# 120402-2238 - First Build
# 120525-1039 - Added uploaded filename filtering
# 120529-1345 - Filename filter fix
#
require("dbconnect.php");
@@ -46,7 +47,11 @@ if (isset($_GET["buffer"])) {$buffer=$_GET["buffer"];}
### REGEX to prevent weird characters from ending up in the fields
$field_regx = "['\"`\\;]";
$sample_template_file_name = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$sample_template_file_name);
if ( (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig)) or (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$sample_template_file_name)) )
{
echo "ERROR: Invalid File Name: $LF_orig $sample_template_file_name\n";
exit;
}
if ($form_action=="prime_file" && $sample_template_file_name)
{
@@ -101,9 +106,18 @@ if ($form_action=="prime_file" && $sample_template_file_name)
echo "</script>";
$field_check=explode($delimiter, $buffer);
flush();
} else if ($form_action=="update_template") {
}
else if ($form_action=="update_template")
{
echo "Hi";
} else {
}
else
{
if ( (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig)) or (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$sample_template_file_name)) )
{
echo "ERROR: Invalid File Name: $LF_orig $sample_template_file_name\n";
exit;
}
# echo "<B>** $form_action</b>"; die;
$fields_stmt = "SELECT list_id, vendor_lead_code, source_id, phone_code, phone_number, title, first_name, middle_initial, last_name, address1, address2, address3, city, state, province, postal_code, country_code, gender, date_of_birth, alt_phone, email, security_phrase, comments, rank, owner from vicidial_list limit 1";
agc_2-X/branches/agc_2.4/www/vicidial/new_listloader_superL.php
+8 -4
View File
@@ -36,11 +36,12 @@
# 100712-1416 - Added entry_list_id field to vicidial_list to preserve link to custom fields if any
# 120223-2148 - Removed logging of good login passwords if webroot writable is enabled
# 120525-0731 - Added uploaded filename filtering
# 120529-1346 - Filename filter fix
#
# make sure vicidial_list exists and that your file follows the formatting correctly. This page does not dedupe or do any other lead filtering actions yet at this time.
$version = '2.4-39';
$build = '120525-0731';
$version = '2.4-40';
$build = '120529-1346';
require("dbconnect.php");
@@ -140,8 +141,6 @@ if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
### REGEX to prevent weird characters from ending up in the fields
$field_regx = "['\"`\\;]";
$lead_file = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$lead_file);
$leadfile_name = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$leadfile_name);
$vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|';
@@ -234,6 +233,11 @@ $browser = getenv("HTTP_USER_AGENT");
}
}
if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig))
{
echo "ERROR: Invalid File Name: $LF_orig\n";
exit;
}
$script_name = getenv("SCRIPT_NAME");
$server_name = getenv("SERVER_NAME");
agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php
+5 -1
View File
@@ -5,6 +5,7 @@
#
# CHANGES
# 120402-2132 - First Build
# 120529-1427 - Filename filter fix
#
require("dbconnect.php");
@@ -193,6 +194,8 @@ $NWE = "')\"><IMG SRC=\"help.gif\" WIDTH=20 HEIGHT=20 BORDER=0 ALT=\"HELP\" ALIG
<head>
</head>
<script language="Javascript">
var form_file_name='';
function init() {
document.getElementById("listloader_file_primer").onsubmit=function() {
document.getElementById("listloader_file_primer").target = "file_holder";
@@ -229,7 +232,7 @@ function DisplayTemplateFields(list_id) {
xmlhttp = new XMLHttpRequest();
}
if (xmlhttp) {
var vs_query = "&custom_fields_enabled="+custom_fields_enabled+"&list_id="+list_id+"&delimiter="+delimiter+"&buffer="+buffer;
var vs_query = "&custom_fields_enabled="+custom_fields_enabled+"&list_id="+list_id+"&delimiter="+delimiter+"&buffer="+buffer+"&sample_template_file_name="+form_file_name;
xmlhttp.open('POST', 'leadloader_template_display.php');
xmlhttp.setRequestHeader('Content-Type','application/x-www-form-urlencoded; charset=UTF-8');
xmlhttp.send(vs_query);
@@ -264,6 +267,7 @@ function DrawTemplateStrings() {
document.getElementById("custom_fields_layout").value=custom_string;
}
function loadIFrame(form_action, field_value) {
form_file_name = field_value;
if (field_value=="") {
document.getElementById('list_data_display').style.display = 'none';
document.getElementById('list_data_display').style.visibility = 'hidden';
agc_2-X/trunk/www/vicidial/admin_listloader_fourth_gen.php
+10 -4
View File
@@ -46,10 +46,11 @@
# 120223-2318 - Removed logging of good login passwords if webroot writable is enabled
# 120402-2128 - Added template options
# 120525-1038 - Added uploaded filename filtering
# 120529-1348 - Filename filter fix
#
$version = '2.4-45';
$build = '120525-1038';
$version = '2.4-46';
$build = '120529-1348';
require("dbconnect.php");
@@ -154,8 +155,6 @@ if ( $phone_code_override == "in_file" ) { $phone_code_override = ""; }
### REGEX to prevent weird characters from ending up in the fields
$field_regx = "['\"`\\;]";
$lead_file = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$lead_file);
$leadfile_name = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$leadfile_name);
$vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|';
@@ -250,6 +249,13 @@ else
}
}
if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig))
{
echo "ERROR: Invalid File Name: $LF_orig\n";
exit;
}
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
agc_2-X/trunk/www/vicidial/admin_listloader_third_gen.php
+9 -4
View File
@@ -45,10 +45,11 @@
# 120221-0140 - Added User Group restrictions
# 120223-2318 - Removed logging of good login passwords if webroot writable is enabled
# 120525-1037 - Added uploaded filename filtering
# 120529-1347 - Filename filter fix
#
$version = '2.4-44';
$build = '120525-1037';
$version = '2.4-45';
$build = '120529-1347';
require("dbconnect.php");
@@ -151,8 +152,6 @@ if ( $phone_code_override == "in_file" ) { $phone_code_override = ""; }
### REGEX to prevent weird characters from ending up in the fields
$field_regx = "['\"`\\;]";
$lead_file = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$lead_file);
$leadfile_name = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$leadfile_name);
$vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|';
@@ -247,6 +246,12 @@ else
}
}
if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig))
{
echo "ERROR: Invalid File Name: $LF_orig\n";
exit;
}
$stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
agc_2-X/trunk/www/vicidial/audio_store.php
+8 -2
View File
@@ -12,10 +12,11 @@
# 110922-2331 - Added modify_audiostore user option for access
# 111122-1332 - Added more filename filtering
# 120525-0739 - Added yet more filename filtering
# 120529-1345 - Filename filter fix
#
$version = '2.4-6';
$build = '120525-0739';
$version = '2.4-7';
$build = '120529-1345';
$MT[0]='';
@@ -75,6 +76,11 @@ if ( ( (strlen($sounds_web_server)) != (strlen($server_name)) ) or (!eregi("$sou
exit;
}
if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$AF_orig))
{
echo "ERROR: Invalid File Name: $AF_orig\n";
exit;
}
### check if web directory exists, if not generate one
if (strlen($sounds_web_directory) < 30)
agc_2-X/trunk/www/vicidial/leadloader_template_display.php
+17 -3
View File
@@ -6,6 +6,7 @@
# CHANGES
# 120402-2238 - First Build
# 120525-1039 - Added uploaded filename filtering
# 120529-1345 - Filename filter fix
#
require("dbconnect.php");
@@ -46,7 +47,11 @@ if (isset($_GET["buffer"])) {$buffer=$_GET["buffer"];}
### REGEX to prevent weird characters from ending up in the fields
$field_regx = "['\"`\\;]";
$sample_template_file_name = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$sample_template_file_name);
if ( (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig)) or (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$sample_template_file_name)) )
{
echo "ERROR: Invalid File Name: $LF_orig $sample_template_file_name\n";
exit;
}
if ($form_action=="prime_file" && $sample_template_file_name)
{
@@ -101,9 +106,18 @@ if ($form_action=="prime_file" && $sample_template_file_name)
echo "</script>";
$field_check=explode($delimiter, $buffer);
flush();
} else if ($form_action=="update_template") {
}
else if ($form_action=="update_template")
{
echo "Hi";
} else {
}
else
{
if ( (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig)) or (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$sample_template_file_name)) )
{
echo "ERROR: Invalid File Name: $LF_orig $sample_template_file_name\n";
exit;
}
# echo "<B>** $form_action</b>"; die;
$fields_stmt = "SELECT list_id, vendor_lead_code, source_id, phone_code, phone_number, title, first_name, middle_initial, last_name, address1, address2, address3, city, state, province, postal_code, country_code, gender, date_of_birth, alt_phone, email, security_phrase, comments, rank, owner from vicidial_list limit 1";
agc_2-X/trunk/www/vicidial/new_listloader_superL.php
+8 -4
View File
@@ -36,11 +36,12 @@
# 100712-1416 - Added entry_list_id field to vicidial_list to preserve link to custom fields if any
# 120223-2148 - Removed logging of good login passwords if webroot writable is enabled
# 120525-0731 - Added uploaded filename filtering
# 120529-1346 - Filename filter fix
#
# make sure vicidial_list exists and that your file follows the formatting correctly. This page does not dedupe or do any other lead filtering actions yet at this time.
$version = '2.4-39';
$build = '120525-0731';
$version = '2.4-40';
$build = '120529-1346';
require("dbconnect.php");
@@ -140,8 +141,6 @@ if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
### REGEX to prevent weird characters from ending up in the fields
$field_regx = "['\"`\\;]";
$lead_file = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$lead_file);
$leadfile_name = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$leadfile_name);
$vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|';
@@ -234,6 +233,11 @@ $browser = getenv("HTTP_USER_AGENT");
}
}
if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig))
{
echo "ERROR: Invalid File Name: $LF_orig\n";
exit;
}
$script_name = getenv("SCRIPT_NAME");
$server_name = getenv("SERVER_NAME");