ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added allow_web_debug system setting to disable $DB output by default.

Browse Source 
Added more input variable filtering

git-svn-id: svn://192.168.202.10@3567 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2022-02-21 15:41:15 +00:00
parent 3527a06150
commit e152282761
50 changed files with 1966 additions and 914 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/agc/deactivate_lead.php
+25 -15
View File
@@ -1,7 +1,7 @@
<?php
# deactivate_lead.php
#
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2022 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed to be used in the "Dispo URL" field of a campaign
# or in-group. It should take in the campaign_id to check for the same source_id
@@ -34,6 +34,7 @@
# 201117-2222 - Changes for better compatibility with non-latin data input
# 210615-1036 - Default security fixes, CVE-2021-28854
# 210616-2050 - Added optional CORS support, see options.php for details
# 220219-2320 - Added allow_web_debug system setting
#
$api_script = 'deactivate';
@@ -95,6 +96,21 @@ header ("Content-type: text/html; charset=utf-8");
#############################################
##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;";
$rslt=mysql_to_mysqli($stmt, $link);
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'02001',$user,$server_ip,$session_name,$one_mysql_log);}
#if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysqli_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysqli_fetch_row($rslt);
$non_latin = $row[0];
$SSenable_languages = $row[1];
$SSlanguage_method = $row[2];
$SSallow_web_debug = $row[3];
}
if ($SSallow_web_debug < 1) {$DB=0;}
$VUselected_language = '';
$stmt="SELECT selected_language from vicidial_users where user='$user';";
if ($DB) {echo "|$stmt|\n";}
@@ -106,36 +122,30 @@ if ($sl_ct > 0)
$row=mysqli_fetch_row($rslt);
$VUselected_language = $row[0];
}
$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;";
$rslt=mysql_to_mysqli($stmt, $link);
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'02001',$user,$server_ip,$session_name,$one_mysql_log);}
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysqli_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysqli_fetch_row($rslt);
$non_latin = $row[0];
$SSenable_languages = $row[1];
$SSlanguage_method = $row[2];
}
##### END SETTINGS LOOKUP #####
###########################################
$search_field = preg_replace("/\'|\"|\\\\|;| /","",$search_field);
$lead_id = preg_replace('/[^0-9]/','',$lead_id);
$log_to_file = preg_replace('/[^-_0-9a-zA-Z]/', '', $log_to_file);
if ($non_latin < 1)
{
$user=preg_replace("/[^-_0-9a-zA-Z]/","",$user);
$pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass);
$pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass);
$campaign_check = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign_check);
$new_status = preg_replace('/[^-_0-9a-zA-Z]/','',$new_status);
$sale_status = preg_replace('/[^-_0-9a-zA-Z]/', '', $sale_status);
$dispo = preg_replace('/[^-_0-9a-zA-Z]/', '', $dispo);
}
else
{
$user = preg_replace('/[^-_0-9\p{L}]/u','',$user);
$pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass);
$campaign_check = preg_replace('/[^-_0-9\p{L}]/u','',$campaign_check);
$new_status = preg_replace('/[^-_0-9\p{L}]/u','',$new_status);
$sale_status = preg_replace('/[^-_0-9\p{L}]/u', '', $sale_status);
$dispo = preg_replace('/[^-_0-9\p{L}]/u', '', $dispo);
}
if ($DB>0) {echo "$lead_id|$search_field|$campaign_check|$sale_status|$dispo|$new_status|$user|$pass|$DB|$log_to_file|\n";}