From e0a09764f3e60a35536927fb920ad7b94616d390 Mon Sep 17 00:00:00 2001 From: mattf Date: Tue, 29 May 2012 18:35:03 +0000 Subject: [PATCH] fixes for upload filename filtering git-svn-id: svn://192.168.202.10@1824 3d104415-ff17-0410-8863-d5cf3c621b8a --- .../www/vicidial/AST_admin_template_maker.php | 6 +++++- .../vicidial/admin_listloader_fourth_gen.php | 14 +++++++++---- .../vicidial/admin_listloader_third_gen.php | 13 ++++++++---- .../agc_2.4/www/vicidial/audio_store.php | 10 ++++++++-- .../vicidial/leadloader_template_display.php | 20 ++++++++++++++++--- .../www/vicidial/new_listloader_superL.php | 12 +++++++---- .../www/vicidial/AST_admin_template_maker.php | 6 +++++- .../vicidial/admin_listloader_fourth_gen.php | 14 +++++++++---- .../vicidial/admin_listloader_third_gen.php | 13 ++++++++---- agc_2-X/trunk/www/vicidial/audio_store.php | 10 ++++++++-- .../vicidial/leadloader_template_display.php | 20 ++++++++++++++++--- .../www/vicidial/new_listloader_superL.php | 12 +++++++---- 12 files changed, 114 insertions(+), 36 deletions(-) diff --git a/agc_2-X/branches/agc_2.4/www/vicidial/AST_admin_template_maker.php b/agc_2-X/branches/agc_2.4/www/vicidial/AST_admin_template_maker.php index d40d6297..7667d14b 100644 --- a/agc_2-X/branches/agc_2.4/www/vicidial/AST_admin_template_maker.php +++ b/agc_2-X/branches/agc_2.4/www/vicidial/AST_admin_template_maker.php @@ -5,6 +5,7 @@ # # CHANGES # 120402-2132 - First Build +# 120529-1427 - Filename filter fix # require("dbconnect.php"); @@ -193,6 +194,8 @@ $NWE = "')\">\"HELP\" "; $field_check=explode($delimiter, $buffer); flush(); -} else if ($form_action=="update_template") { + } +else if ($form_action=="update_template") + { echo "Hi"; -} else { + } +else + { + if ( (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig)) or (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$sample_template_file_name)) ) + { + echo "ERROR: Invalid File Name: $LF_orig $sample_template_file_name\n"; + exit; + } # echo "** $form_action"; die; $fields_stmt = "SELECT list_id, vendor_lead_code, source_id, phone_code, phone_number, title, first_name, middle_initial, last_name, address1, address2, address3, city, state, province, postal_code, country_code, gender, date_of_birth, alt_phone, email, security_phrase, comments, rank, owner from vicidial_list limit 1"; diff --git a/agc_2-X/branches/agc_2.4/www/vicidial/new_listloader_superL.php b/agc_2-X/branches/agc_2.4/www/vicidial/new_listloader_superL.php index c0be85a6..0de36376 100644 --- a/agc_2-X/branches/agc_2.4/www/vicidial/new_listloader_superL.php +++ b/agc_2-X/branches/agc_2.4/www/vicidial/new_listloader_superL.php @@ -36,11 +36,12 @@ # 100712-1416 - Added entry_list_id field to vicidial_list to preserve link to custom fields if any # 120223-2148 - Removed logging of good login passwords if webroot writable is enabled # 120525-0731 - Added uploaded filename filtering +# 120529-1346 - Filename filter fix # # make sure vicidial_list exists and that your file follows the formatting correctly. This page does not dedupe or do any other lead filtering actions yet at this time. -$version = '2.4-39'; -$build = '120525-0731'; +$version = '2.4-40'; +$build = '120529-1346'; require("dbconnect.php"); @@ -140,8 +141,6 @@ if (isset($_GET["DB"])) {$DB=$_GET["DB"];} ### REGEX to prevent weird characters from ending up in the fields $field_regx = "['\"`\\;]"; -$lead_file = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$lead_file); -$leadfile_name = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$leadfile_name); $vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|'; @@ -234,6 +233,11 @@ $browser = getenv("HTTP_USER_AGENT"); } } +if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig)) + { + echo "ERROR: Invalid File Name: $LF_orig\n"; + exit; + } $script_name = getenv("SCRIPT_NAME"); $server_name = getenv("SERVER_NAME"); diff --git a/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php b/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php index d40d6297..7667d14b 100644 --- a/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php +++ b/agc_2-X/trunk/www/vicidial/AST_admin_template_maker.php @@ -5,6 +5,7 @@ # # CHANGES # 120402-2132 - First Build +# 120529-1427 - Filename filter fix # require("dbconnect.php"); @@ -193,6 +194,8 @@ $NWE = "')\">\"HELP\" "; $field_check=explode($delimiter, $buffer); flush(); -} else if ($form_action=="update_template") { + } +else if ($form_action=="update_template") + { echo "Hi"; -} else { + } +else + { + if ( (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig)) or (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$sample_template_file_name)) ) + { + echo "ERROR: Invalid File Name: $LF_orig $sample_template_file_name\n"; + exit; + } # echo "** $form_action"; die; $fields_stmt = "SELECT list_id, vendor_lead_code, source_id, phone_code, phone_number, title, first_name, middle_initial, last_name, address1, address2, address3, city, state, province, postal_code, country_code, gender, date_of_birth, alt_phone, email, security_phrase, comments, rank, owner from vicidial_list limit 1"; diff --git a/agc_2-X/trunk/www/vicidial/new_listloader_superL.php b/agc_2-X/trunk/www/vicidial/new_listloader_superL.php index c0be85a6..0de36376 100644 --- a/agc_2-X/trunk/www/vicidial/new_listloader_superL.php +++ b/agc_2-X/trunk/www/vicidial/new_listloader_superL.php @@ -36,11 +36,12 @@ # 100712-1416 - Added entry_list_id field to vicidial_list to preserve link to custom fields if any # 120223-2148 - Removed logging of good login passwords if webroot writable is enabled # 120525-0731 - Added uploaded filename filtering +# 120529-1346 - Filename filter fix # # make sure vicidial_list exists and that your file follows the formatting correctly. This page does not dedupe or do any other lead filtering actions yet at this time. -$version = '2.4-39'; -$build = '120525-0731'; +$version = '2.4-40'; +$build = '120529-1346'; require("dbconnect.php"); @@ -140,8 +141,6 @@ if (isset($_GET["DB"])) {$DB=$_GET["DB"];} ### REGEX to prevent weird characters from ending up in the fields $field_regx = "['\"`\\;]"; -$lead_file = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$lead_file); -$leadfile_name = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$leadfile_name); $vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|'; @@ -234,6 +233,11 @@ $browser = getenv("HTTP_USER_AGENT"); } } +if (preg_match("/;|:|\/|\^|\[|\]|\"|\'|\*/",$LF_orig)) + { + echo "ERROR: Invalid File Name: $LF_orig\n"; + exit; + } $script_name = getenv("SCRIPT_NAME"); $server_name = getenv("SERVER_NAME");