From e2e05055703aff8acf263cf04816442d2d57baf4 Mon Sep 17 00:00:00 2001 From: mattf Date: Fri, 18 Jun 2021 03:24:05 +0000 Subject: [PATCH] Added CORS(Cross-Origin Resource Sharing) support for the VICIdial agent PHP scripts. see the CORS_SUPPORT.txt doc for more information. git-svn-id: svn://192.168.202.10@3459 3d104415-ff17-0410-8863-d5cf3c621b8a --- agc_2-X/trunk/UPGRADE | 3 + agc_2-X/trunk/docs/CORS_SUPPORT.txt | 55 +++++++++ agc_2-X/trunk/www/agc/active_list_refresh.php | 14 ++- .../agc/agc_agent_manager_chat_interface.php | 15 ++- agc_2-X/trunk/www/agc/agentCORS.php | 116 ++++++++++++++++++ agc_2-X/trunk/www/agc/alt_display.php | 5 +- agc_2-X/trunk/www/agc/api.php | 13 +- agc_2-X/trunk/www/agc/astguiclient.php | 12 +- agc_2-X/trunk/www/agc/call_log_display.php | 13 +- agc_2-X/trunk/www/agc/chat_db_query.php | 5 +- agc_2-X/trunk/www/agc/conf_exten_check.php | 12 +- agc_2-X/trunk/www/agc/deactivate_lead.php | 13 +- agc_2-X/trunk/www/agc/dispo_add_FPG.php | 13 +- agc_2-X/trunk/www/agc/dispo_change_status.php | 13 +- agc_2-X/trunk/www/agc/dispo_move_list.php | 13 +- agc_2-X/trunk/www/agc/dispo_send_email.php | 13 +- agc_2-X/trunk/www/agc/inbound_popup.php | 15 ++- agc_2-X/trunk/www/agc/live_exten_check.php | 9 +- agc_2-X/trunk/www/agc/manager_send.php | 12 +- agc_2-X/trunk/www/agc/options-example.php | 21 +++- agc_2-X/trunk/www/agc/park_calls_display.php | 13 +- agc_2-X/trunk/www/agc/phone_only.php | 6 +- agc_2-X/trunk/www/agc/timeclock.php | 15 ++- agc_2-X/trunk/www/agc/update_cf_ivr.php | 9 ++ agc_2-X/trunk/www/agc/vdc_chat_display.php | 12 +- agc_2-X/trunk/www/agc/vdc_db_query.php | 12 +- agc_2-X/trunk/www/agc/vdc_email_display.php | 15 ++- agc_2-X/trunk/www/agc/vdc_form_display.php | 13 +- agc_2-X/trunk/www/agc/vdc_script_display.php | 14 ++- .../www/agc/vdc_script_dispo_example.php | 14 ++- agc_2-X/trunk/www/agc/vdc_script_notes.php | 15 ++- .../trunk/www/agc/vdc_soundboard_display.php | 15 ++- agc_2-X/trunk/www/agc/vicidial-grey.php | 6 +- agc_2-X/trunk/www/agc/vicidial.php | 6 +- agc_2-X/trunk/www/agc/voicemail_check.php | 13 +- 35 files changed, 491 insertions(+), 72 deletions(-) create mode 100644 agc_2-X/trunk/docs/CORS_SUPPORT.txt create mode 100644 agc_2-X/trunk/www/agc/agentCORS.php diff --git a/agc_2-X/trunk/UPGRADE b/agc_2-X/trunk/UPGRADE index d212235d..b23d63c8 100644 --- a/agc_2-X/trunk/UPGRADE +++ b/agc_2-X/trunk/UPGRADE @@ -645,6 +645,9 @@ OTHER CHANGES: able to click on the DIAL NEXT NUMBER button each time. Also allows for an override setting based upon the day of the week and time of day. +180. Added CORS(Cross-Origin Resource Sharing) support for the VICIdial agent + PHP scripts. see the CORS_SUPPORT.txt doc for more information. + diff --git a/agc_2-X/trunk/docs/CORS_SUPPORT.txt b/agc_2-X/trunk/docs/CORS_SUPPORT.txt new file mode 100644 index 00000000..20b339df --- /dev/null +++ b/agc_2-X/trunk/docs/CORS_SUPPORT.txt @@ -0,0 +1,55 @@ +CORS DOC(Cross-Origin Resource Sharing) Started: 2021-06-17 Updated: 2021-06-17 + + + +This document will go over how to configure CORS (Cross-Origin Resource Sharing) with the scripts associated with the VICIdial agent screen. + + + +What is CORS exactly? + +Cross-Origin Resource Sharing (CORS) is an HTTP-header based mechanism that allows a server to indicate any other origins (domain, scheme, and/or port) than its own from which a browser should permit loading of resources. CORS also relies on a mechanism by which browsers make a “preflight” request to the server hosting the cross-origin resource, in order to check that the server will permit the actual request. In that preflight, the browser sends headers that indicate the HTTP method and headers that will be used in the actual request. + +For an example of how this might work, let's say you have a CRM system on a separate webserver from your VICIdial webserver, and you want to use a Javascript AJAX call on that CRM to trigger a VICIdial Agent API command. That functionality would not work without configuring CORS on your VICIdial agent folder because they both have different origins. + + +For more details on how CORS works, and all of the options that are available within it: +https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS + +For more details on how X-Frame-Options works: +https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + + + +VICIDIAL AGENT WEB SCREEN SCRIPTS SUPPORT: + +Support for CORS configuration for almost all of the PHP scripts in the "agc" web directory was added on 2021-06-17(svn/trunk revision 3459) with the addition of the "agentCORS.php" file and the addition of the following to the "agc/options.php" file on your webserver: + (NOTE: If you have never set up an "agc/options.php" file on your webserver before, just use a copy the file "agc/options-example.php") + + +# CORS settings: (to enable, uncomment and customize the variables below, and uncomment the "require_once('agentCORS.php');" line at the bottom) +# (NOTE: The first 3 variables must be set for these features to be active) +$CORS_allowed_origin = ''; # if multiple origins allowed, separate them by a pipe (also allows PHP preg syntax) + # examples: 'https://acme.org|http://internal.acme.org' or "https?:\/\/(.*\\.?example\\.com|localhost):?[0-9]*|null" +$CORS_allowed_methods = ''; # if multiple methods allowed, separate them by a comma + # example: 'GET,POST,OPTIONS,HEAD' +$CORS_affected_scripts = ''; # use '--ALL--' for all agc scripts. If multiple(but less than all) scripts affected, separate them by a space + # examples: 'api.php alt_display.php' or '--ALL--' +$CORS_allowed_headers = ''; # passed in Access-Control-Allow-Headers http response header, + # examples: X-Requested-With, X-Forwarded-For, X-Forwarded-Proto, Authorization, Cookie, Content-Type +$CORS_allowed_credentials = 'N'; # 'Y' or 'N', whether to send credentials to browser or not +$Xframe_options = 'N'; # Not part of CORS, but can prevent Iframe/embed/etc... use by foreign website, will populate for all affected scripts + # examples: 'N', 'SAMEORIGIN', 'DENY' NOTE: using 'DENY' may break some agent screen functionality +$CORS_debug = 0; # 0 = no, 1 = yes (default is no) If enabled, this will generate a lot of log entries in a CORSdebug_log.txt file +# require_once('agentCORS.php'); + + +NOTES: +- It is STRONGLY recommended that you do not set the $CORS_allowed_origin variable to '*', this creates a very insecure situation where any website anywhere can use the resources on your webserver within any browser window, iframe or hidden span. + + + + +VICIDIAL ADMIN WEB SCREEN SCRIPTS SUPPORT: + +Currently under development, the plan is support the "non_agent_api.php" script to start, then add some other scripts over time. diff --git a/agc_2-X/trunk/www/agc/active_list_refresh.php b/agc_2-X/trunk/www/agc/active_list_refresh.php index b7a38faa..f9f3c038 100644 --- a/agc_2-X/trunk/www/agc/active_list_refresh.php +++ b/agc_2-X/trunk/www/agc/active_list_refresh.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # This script is designed purely to serve updates of the live data to the display scripts # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table @@ -47,10 +47,11 @@ # 141216-2119 - Added language settings lookups and user/pass variable standardization # 150723-1715 - Added ajax logging # 190111-0903 - Fix for PHP7 +# 210616-2108 - Added optional CORS support, see options.php for details # -$version = '0.0.18'; -$build = '190111-0903'; +$version = '0.0.19'; +$build = '210616-2108'; $php_script = 'active_list_refresh.php'; $SSagent_debug_logging=0; $startMS = microtime(); @@ -133,6 +134,13 @@ $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); if (!isset($query_date)) {$query_date = $NOW_DATE;} +# if options file exists, use the override values for the above variables +# see the options-example.php file for more information +if (file_exists('options.php')) + { + require_once('options.php'); + } + ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### $VUselected_language = ''; diff --git a/agc_2-X/trunk/www/agc/agc_agent_manager_chat_interface.php b/agc_2-X/trunk/www/agc/agc_agent_manager_chat_interface.php index 1b01b57d..cfd27b43 100644 --- a/agc_2-X/trunk/www/agc/agc_agent_manager_chat_interface.php +++ b/agc_2-X/trunk/www/agc/agc_agent_manager_chat_interface.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Joe Johnson, Matt Florell LICENSE: AGPLv2 # # This page is for agents to chat with managers via the agent interface. # @@ -16,10 +16,12 @@ # 161221-0801 - Added color-coding for users in internal chat sessions # 180927-0624 - Fix for missing translationm issue #1125 # 201117-2239 - Changes for better compatibility with non-latin data input +# 210616-2056 - Added optional CORS support, see options.php for details # -$admin_version = '2.14-10'; -$build = '201117-2239'; +$admin_version = '2.14-11'; +$build = '210616-2056'; +$php_script = 'agc_agent_manager_chat_interface.php'; $sh="managerchats"; @@ -74,6 +76,13 @@ else $manager_chat_id = preg_replace("/\'|\"|\\\\|;/","",$user); } +# if options file exists, use the override values for the above variables +# see the options-example.php file for more information +if (file_exists('options.php')) + { + require_once('options.php'); + } + $auth=0; $auth_message = user_authorization($user,$pass,'',0,0,0,0,'chat'); if ($auth_message == 'GOOD') diff --git a/agc_2-X/trunk/www/agc/agentCORS.php b/agc_2-X/trunk/www/agc/agentCORS.php new file mode 100644 index 00000000..d1b868ba --- /dev/null +++ b/agc_2-X/trunk/www/agc/agentCORS.php @@ -0,0 +1,116 @@ + LICENSE: AGPLv2 +# +# CORS settings coming from the options.php script (the first 3 variables must be set for these features to be active) +# $CORS_allowed_origin = ''; # if multiple origins allowed, separate them by a pipe (also allows PHP preg syntax) +# # examples: 'https://acme.org|https://internal.acme.org' or "https?:\/\/(.*\\.?example\\.com|localhost):?[0-9]*|null" +# $CORS_allowed_methods = ''; # if multiple methods allowed, separate them by a comma +# # example: 'GET,POST,OPTIONS,HEAD' +# $CORS_affected_scripts = ''; # use '--ALL--' for all agc scripts. If multiple(but less than all) scripts affected, separate them by a space +# # examples: 'api.php alt_display.php' or '--ALL--' +# $CORS_allowed_headers = ''; # passed in Access-Control-Allow-Headers http response header, +# # examples: X-Requested-With, X-Forwarded-For, X-Forwarded-Proto, Authorization, Cookie, Content-Type +# $CORS_allowed_credentials = 'N'; # 'Y' or 'N', whether to send credentials to browser or not +# $Xframe_options = 'N'; # Not part of CORS, but can prevent Iframe/embed/etc... use by foreign website, will populate for all affected scripts +# # examples: 'N', 'SAMEORIGIN', 'DENY' NOTE: using 'DENY' may break some agent screen functionality +# $CORS_debug = 0; # 0 = no, 1 = yes (default is no) This will generate a lot of log entries in a CORSdebug_log.txt file +# +# +# CHANGELOG +# 210616-1012 - First Build +# + +$NOW_TIME = date("Y-m-d H:i:s"); + +if (strlen($php_script) < 1) + {exit;} + +$CORS_origin = $_SERVER['HTTP_ORIGIN']; # The client browser origin server +$CORS_method = isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) ? $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] : $_SERVER['REQUEST_METHOD']; # Either the requested HTTP method or the current one +$CORS_affected_scripts = " $CORS_affected_scripts "; # surround with spaces for preg match below + +if ($CORS_debug > 0) + { + $fp = fopen ("./CORSdebug_log.txt", "a"); + fwrite ($fp, "$NOW_TIME CORS-Debug 1: BEGIN - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$CORS_affected_scripts($php_script)|$CORS_allowed_credentials|$CORS_allowed_headers|$Xframe_options|$CORS_debug|\n"); + fclose($fp); + } + +# if options.php $CORS_allowed_origin or $CORS_allowed_methods variables are not set, do nothing +if ( (strlen($CORS_allowed_origin) < 1) or (strlen($CORS_allowed_methods) < 1) or (strlen($CORS_affected_scripts) < 1) ) + { + if ($CORS_debug > 0) + { + $fp = fopen ("./CORSdebug_log.txt", "a"); + fwrite ($fp, "$NOW_TIME CORS-Debug 2: variable not set - |$CORS_allowed_origin|$CORS_allowed_methods|$CORS_affected_scripts|\n"); + fclose($fp); + } + } +else + { + # check for affected scripts match (--ALL--, one-of-many) + if ( (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts)) or ($CORS_affected_scripts == ' --ALL-- ') ) + { + # check for allowed origin match (wildcard, one-of-many, preg-match) and check for allowed method match (one-of-many) + if ( ( ($CORS_allowed_origin == '*') or (stripos($CORS_allowed_origin,$CORS_origin) !== false) or (preg_match('/' . $CORS_allowed_origin . '/i', $CORS_origin)) ) and (preg_match('/' . $CORS_method . '/i', $CORS_allowed_methods)) ) + { + header('Access-Control-Allow-Origin: ' . $CORS_origin); + header('Access-Control-Allow-Methods: ' . $CORS_allowed_methods); + + if (strlen($CORS_allowed_headers) > 0) + { + header('Access-Control-Allow-Headers: ' . $CORS_allowed_headers); + } + if ($CORS_allowed_credentials == 'Y') + { + header('Access-Control-Allow-Credentials: true'); + } + if ($CORS_debug > 0) + { + $fp = fopen ("./CORSdebug_log.txt", "a"); + fwrite ($fp, "$NOW_TIME CORS-Debug 3: MATCHES found - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|\n"); + fclose($fp); + } + } + else + { + if ($CORS_debug > 0) + { + $fp = fopen ("./CORSdebug_log.txt", "a"); + fwrite ($fp, "$NOW_TIME CORS-Debug 4: NO MATCH origin or method - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|\n"); + fclose($fp); + } + } + # For OPTIONS preflight requests, exit without processing the script further + if ( (strcasecmp($_SERVER['REQUEST_METHOD'], 'OPTIONS') == 0) and (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) ) + { + flush(); + die(); + } + } + else + { + if ($CORS_debug > 0) + { + $fp = fopen ("./CORSdebug_log.txt", "a"); + fwrite ($fp, "$NOW_TIME CORS-Debug 5: NO AFFECT script - |$CORS_affected_scripts|$php_script|\n"); + fclose($fp); + } + } + + # add $Xframe_options if defined + if ( ($Xframe_options == 'SAMEORIGIN') or ($Xframe_options == 'DENY') ) + { + header('X-Frame-Options: ' . $Xframe_options); + if ($CORS_debug > 0) + { + $fp = fopen ("./CORSdebug_log.txt", "a"); + fwrite ($fp, "$NOW_TIME CORS-Debug 6: X-frame-Options sent - |$Xframe_options|\n"); + fclose($fp); + } + } + } + +?> \ No newline at end of file diff --git a/agc_2-X/trunk/www/agc/alt_display.php b/agc_2-X/trunk/www/agc/alt_display.php index 5283846e..4aebde02 100644 --- a/agc_2-X/trunk/www/agc/alt_display.php +++ b/agc_2-X/trunk/www/agc/alt_display.php @@ -20,10 +20,11 @@ # 201026-1504 - Fix for LIVE call issue in top_panel # 210426-0138 - Added calls_inqueue_count_ campaign settings options, and calls_in_queue_option=CAMPAIGN setting # 210428-2156 - Added calls_in_queue_display setting +# 210616-1907 - Added optional CORS support, see options.php for details # -$version = '2.14-5'; -$build = '210428-2156'; +$version = '2.14-6'; +$build = '210616-1907'; $php_script = 'alt_display.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=11; diff --git a/agc_2-X/trunk/www/agc/api.php b/agc_2-X/trunk/www/agc/api.php index 33771b53..545f12b5 100644 --- a/agc_2-X/trunk/www/agc/api.php +++ b/agc_2-X/trunk/www/agc/api.php @@ -104,10 +104,12 @@ # 210116-1138 - Addressed session ID issue in ticket #1251 # 210222-1058 - Added call length logging to ra_call_control function # 210320-2335 - Added additional update_fields options: scriptreload,script2reload,formreload,emailreload,chatreload +# 210616-2057 - Added optional CORS support, see options.php for details # -$version = '2.14-69'; -$build = '210320-2335'; +$version = '2.14-70'; +$build = '210616-2057'; +$php_script = 'api.php'; $startMS = microtime(); @@ -255,6 +257,13 @@ if (isset($_GET["cid_choice"])) {$cid_choice=$_GET["cid_choice"];} if (isset($_GET["outbound_cid"])) {$outbound_cid=$_GET["outbound_cid"];} elseif (isset($_POST["outbound_cid"])) {$outbound_cid=$_POST["outbound_cid"];} +# if options file exists, use the override values for the above variables +# see the options-example.php file for more information +if (file_exists('options.php')) + { + require_once('options.php'); + } + header ("Content-type: text/html; charset=utf-8"); header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 header ("Pragma: no-cache"); // HTTP/1.0 diff --git a/agc_2-X/trunk/www/agc/astguiclient.php b/agc_2-X/trunk/www/agc/astguiclient.php index 943c165b..de685ece 100644 --- a/agc_2-X/trunk/www/agc/astguiclient.php +++ b/agc_2-X/trunk/www/agc/astguiclient.php @@ -71,10 +71,12 @@ # 190111-0902 - Fix for PHP7 # 200319-1532 - Small fixes for conference tab issues # 210615-1037 - Default security fixes, CVE-2021-28854 +# 210616-2053 - Added optional CORS support, see options.php for details # -$version = '2.2.6-4'; -$build = '210615-1037'; +$version = '2.2.6-5'; +$build = '210616-2053'; +$php_script = 'astguiclient.php'; require_once("dbconnect_mysqli.php"); require_once("functions.php"); @@ -113,6 +115,12 @@ $phone_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$phone_pass); $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); +# if options file exists, use the override values for the above variables +# see the options-example.php file for more information +if (file_exists('options.php')) + { + require_once('options.php'); + } ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### diff --git a/agc_2-X/trunk/www/agc/call_log_display.php b/agc_2-X/trunk/www/agc/call_log_display.php index e1f125e6..6cb78c56 100644 --- a/agc_2-X/trunk/www/agc/call_log_display.php +++ b/agc_2-X/trunk/www/agc/call_log_display.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # This script is designed purely to send the inbound and outbound calls for a specific phone # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table @@ -41,10 +41,11 @@ # 170526-2215 - Added additional variable filtering # 190111-0904 - Fix for PHP7 # 201117-2200 - Changes for better compatibility with non-latin data input +# 210616-2102 - Added optional CORS support, see options.php for details # -$version = '2.14-21'; -$build = '201117-2200'; +$version = '2.14-22'; +$build = '210616-2102'; $php_script = 'call_log_display.php'; $SSagent_debug_logging=0; $startMS = microtime(); @@ -89,6 +90,12 @@ $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); if (!isset($query_date)) {$query_date = $NOW_DATE;} +# if options file exists, use the override values for the above variables +# see the options-example.php file for more information +if (file_exists('options.php')) + { + require_once('options.php'); + } ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### diff --git a/agc_2-X/trunk/www/agc/chat_db_query.php b/agc_2-X/trunk/www/agc/chat_db_query.php index 3305c855..d2307027 100644 --- a/agc_2-X/trunk/www/agc/chat_db_query.php +++ b/agc_2-X/trunk/www/agc/chat_db_query.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Joe Johnson, Matt Florell LICENSE: AGPLv2 # # Called by vdc_chat_display.php and vicidial_chat_agent.js. This contains all actions taken by the # agent's interface when chatting with customers, other agents, and managers, through @@ -24,8 +24,11 @@ # 170526-2257 - Added additional variable filtering # 170528-1028 - Added more variable filtering # 201117-2238 - Changes for better compatibility with non-latin data input +# 210616-2055 - Added optional CORS support, see options.php for details # +$php_script = 'chat_db_query.php'; + require("dbconnect_mysqli.php"); require("functions.php"); diff --git a/agc_2-X/trunk/www/agc/conf_exten_check.php b/agc_2-X/trunk/www/agc/conf_exten_check.php index c3d09f97..441eb0ca 100644 --- a/agc_2-X/trunk/www/agc/conf_exten_check.php +++ b/agc_2-X/trunk/www/agc/conf_exten_check.php @@ -88,10 +88,11 @@ # 210317-1935 - Added visibility logging # 210328-1013 - Fix for emails-in-queue count query, Issue #1170 # 210425-2357 - Added calls_inqueue_count_ calculation +# 210616-1905 - Added optional CORS support, see options.php for details # -$version = '2.14-62'; -$build = '210425-2357'; +$version = '2.14-63'; +$build = '210616-1905'; $php_script = 'conf_exten_check.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=51; @@ -155,6 +156,13 @@ if (isset($_GET["visibility"])) {$visibility=$_GET["visibility"];} if ($bcrypt == 'OFF') {$bcrypt=0;} +# if options file exists, use the override values for the above variables +# see the options-example.php file for more information +if (file_exists('options.php')) + { + require_once('options.php'); + } + header ("Content-type: text/html; charset=utf-8"); header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 header ("Pragma: no-cache"); // HTTP/1.0 diff --git a/agc_2-X/trunk/www/agc/deactivate_lead.php b/agc_2-X/trunk/www/agc/deactivate_lead.php index e3f97f25..b476ffca 100644 --- a/agc_2-X/trunk/www/agc/deactivate_lead.php +++ b/agc_2-X/trunk/www/agc/deactivate_lead.php @@ -33,11 +33,11 @@ # 170526-2301 - Added additional variable filtering # 201117-2222 - Changes for better compatibility with non-latin data input # 210615-1036 - Default security fixes, CVE-2021-28854 +# 210616-2050 - Added optional CORS support, see options.php for details # $api_script = 'deactivate'; - -header ("Content-type: text/html; charset=utf-8"); +$php_script = 'deactivate_lead.php'; require_once("dbconnect_mysqli.php"); require_once("functions.php"); @@ -83,6 +83,15 @@ $search_value=''; $user = preg_replace("/\'|\"|\\\\|;| /","",$user); $pass = preg_replace("/\'|\"|\\\\|;| /","",$pass); +# if options file exists, use the override values for the above variables +# see the options-example.php file for more information +if (file_exists('options.php')) + { + require_once('options.php'); + } + +header ("Content-type: text/html; charset=utf-8"); + ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### $VUselected_language = ''; diff --git a/agc_2-X/trunk/www/agc/dispo_add_FPG.php b/agc_2-X/trunk/www/agc/dispo_add_FPG.php index b0a61488..5587d177 100644 --- a/agc_2-X/trunk/www/agc/dispo_add_FPG.php +++ b/agc_2-X/trunk/www/agc/dispo_add_FPG.php @@ -22,11 +22,11 @@ # 150724-1657 - First Build # 170526-2305 - Added additional variable filtering # 210615-1039 - Default security fixes, CVE-2021-28854 +# 210616-2049 - Added optional CORS support, see options.php for details # $api_script = 'add_FPG'; - -header ("Content-type: text/html; charset=utf-8"); +$php_script = 'dispo_add_FPG.php'; require_once("dbconnect_mysqli.php"); require_once("functions.php"); @@ -75,6 +75,15 @@ $phone_number = preg_replace('/[^-_0-9a-zA-Z]/','',$phone_number); $FPG_id = preg_replace("/\'|\"|\\\\|;| /","",$FPG_id); $lead_id = preg_replace('/[^0-9]/','',$lead_id); +# if options file exists, use the override values for the above variables +# see the options-example.php file for more information +if (file_exists('options.php')) + { + require_once('options.php'); + } + +header ("Content-type: text/html; charset=utf-8"); + ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### $VUselected_language = ''; diff --git a/agc_2-X/trunk/www/agc/dispo_change_status.php b/agc_2-X/trunk/www/agc/dispo_change_status.php index 87c10f6e..b2b92e43 100644 --- a/agc_2-X/trunk/www/agc/dispo_change_status.php +++ b/agc_2-X/trunk/www/agc/dispo_change_status.php @@ -26,11 +26,11 @@ # 171127-1736 - First Build # 201117-2217 - Changes for better compatibility with non-latin data input # 210615-1035 - Default security fixes, CVE-2021-28854 +# 210616-2047 - Added optional CORS support, see options.php for details # $api_script = 'dispo_change_status'; - -header ("Content-type: text/html; charset=utf-8"); +$php_script = 'dispo_change_status.php'; require_once("dbconnect_mysqli.php"); require_once("functions.php"); @@ -90,6 +90,15 @@ if ( ($archive_search != 'Y') and ($archive_search != 'N') ) if ( ($in_out_search != 'IN') and ($in_out_search != 'OUT') and ($in_out_search != 'BOTH') ) {$in_out_search = 'BOTH';} +# if options file exists, use the override values for the above variables +# see the options-example.php file for more information +if (file_exists('options.php')) + { + require_once('options.php'); + } + +header ("Content-type: text/html; charset=utf-8"); + ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### $VUselected_language = ''; diff --git a/agc_2-X/trunk/www/agc/dispo_move_list.php b/agc_2-X/trunk/www/agc/dispo_move_list.php index ae21094e..369ba56d 100644 --- a/agc_2-X/trunk/www/agc/dispo_move_list.php +++ b/agc_2-X/trunk/www/agc/dispo_move_list.php @@ -66,11 +66,11 @@ # 170526-2310 - Added additional variable filtering # 180419-2257 - Added multi_trigger option # 210615-1038 - Default security fixes, CVE-2021-28854 +# 210616-2046 - Added optional CORS support, see options.php for details # $api_script = 'movelist'; - -header ("Content-type: text/html; charset=utf-8"); +$php_script = 'dispo_move_list.php'; require_once("dbconnect_mysqli.php"); require_once("functions.php"); @@ -149,6 +149,15 @@ $new_list_id = preg_replace('/[^_0-9]/', '', $new_list_id); $list_id_trigger = preg_replace('/[^_0-9]/', '', $list_id_trigger); $multi_trigger=preg_replace("/\'|\"|\\\\|;| /","",$multi_trigger); +# if options file exists, use the override values for the above variables +# see the options-example.php file for more information +if (file_exists('options.php')) + { + require_once('options.php'); + } + +header ("Content-type: text/html; charset=utf-8"); + ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### $VUselected_language = ''; diff --git a/agc_2-X/trunk/www/agc/dispo_send_email.php b/agc_2-X/trunk/www/agc/dispo_send_email.php index 705729d2..ed5ca160 100644 --- a/agc_2-X/trunk/www/agc/dispo_send_email.php +++ b/agc_2-X/trunk/www/agc/dispo_send_email.php @@ -42,11 +42,11 @@ # 200814-1829 - added email_body_html, email_body_utf8 flags # 201117-2104 - Changes for better compatibility with non-latin data input # 210615-1033 - Default security fixes, CVE-2021-28854 +# 210616-2044 - Added optional CORS support, see options.php for details # $api_script = 'send_email'; - -header ("Content-type: text/html; charset=utf-8"); +$php_script = 'dispo_send_email.php'; require_once("dbconnect_mysqli.php"); require_once("functions.php"); @@ -150,6 +150,15 @@ $email_charset = 'iso-8859-1'; $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); +# if options file exists, use the override values for the above variables +# see the options-example.php file for more information +if (file_exists('options.php')) + { + require_once('options.php'); + } + +header ("Content-type: text/html; charset=utf-8"); + ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### $VUselected_language = ''; diff --git a/agc_2-X/trunk/www/agc/inbound_popup.php b/agc_2-X/trunk/www/agc/inbound_popup.php index 0aeeb74e..63368755 100644 --- a/agc_2-X/trunk/www/agc/inbound_popup.php +++ b/agc_2-X/trunk/www/agc/inbound_popup.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # This script is designed to open up when a live_inbound call comes in giving the user # options of what to do with the call or options to lookup the callerID on various web sites @@ -38,10 +38,12 @@ # 141216-2120 - Added language settings lookups and user/pass variable standardization # 170526-2231 - Added additional variable filtering # 190111-0905 - Fix for PHP7 +# 210616-2106 - Added optional CORS support, see options.php for details # -$version = '2.14-14'; -$build = '190111-0905'; +$version = '2.14-15'; +$build = '210616-2106'; +$php_script = 'inbound_popup.php'; require_once("dbconnect_mysqli.php"); require_once("functions.php"); @@ -93,6 +95,13 @@ if (!isset($query_date)) {$query_date = $NOW_DATE;} $DO = '-1'; if ( (preg_match("/^Zap/i",$channel)) and (!preg_match("/-/i",$channel)) ) {$channel = "$channel$DO";} +# if options file exists, use the override values for the above variables +# see the options-example.php file for more information +if (file_exists('options.php')) + { + require_once('options.php'); + } + ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### $VUselected_language = ''; diff --git a/agc_2-X/trunk/www/agc/live_exten_check.php b/agc_2-X/trunk/www/agc/live_exten_check.php index 871cfedd..49153f9e 100644 --- a/agc_2-X/trunk/www/agc/live_exten_check.php +++ b/agc_2-X/trunk/www/agc/live_exten_check.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # This script is designed purely to send whether the client channel is live and to what channel it is connected # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table @@ -41,6 +41,7 @@ # 150723-1713 - Added ajax logging # 170526-2234 - Added additional variable filtering # 190111-0906 - Fix for PHP7 +# 210616-2105 - Added optional CORS support, see options.php for details # $version = '2.14-18'; @@ -89,6 +90,12 @@ $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); if (!isset($query_date)) {$query_date = $NOW_DATE;} +# if options file exists, use the override values for the above variables +# see the options-example.php file for more information +if (file_exists('options.php')) + { + require_once('options.php'); + } ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### diff --git a/agc_2-X/trunk/www/agc/manager_send.php b/agc_2-X/trunk/www/agc/manager_send.php index 054ab459..7c8df4eb 100644 --- a/agc_2-X/trunk/www/agc/manager_send.php +++ b/agc_2-X/trunk/www/agc/manager_send.php @@ -146,10 +146,11 @@ # 201107-2228 - Added campaign/in-group logging in park_log # 201117-1751 - Changes for better compatibility with non-latin data input # 210615-1016 - Default security fixes, CVE-2021-28854 +# 210616-2051 - Added optional CORS support, see options.php for details # -$version = '2.14-93'; -$build = '210615-1016'; +$version = '2.14-94'; +$build = '210616-2051'; $php_script = 'manager_send.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=143; @@ -258,6 +259,13 @@ if (isset($_GET["user_group"])) {$user_group=$_GET["user_group"];} if (isset($_GET["group_id"])) {$group_id=$_GET["group_id"];} elseif (isset($_POST["group_id"])) {$group_id=$_POST["group_id"];} +# if options file exists, use the override values for the above variables +# see the options-example.php file for more information +if (file_exists('options.php')) + { + require_once('options.php'); + } + ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $stmt = "SELECT use_non_latin,allow_sipsak_messages,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,agent_debug_logging FROM system_settings;"; diff --git a/agc_2-X/trunk/www/agc/options-example.php b/agc_2-X/trunk/www/agc/options-example.php index 90b780cc..60ff1480 100644 --- a/agc_2-X/trunk/www/agc/options-example.php +++ b/agc_2-X/trunk/www/agc/options-example.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # rename this file to options.php for the settings here to go into effect # @@ -19,6 +19,7 @@ # 191107-0925 - Added $webphone_call_seconds # 200515-1339 - Added ast13_volume_override option # 200827-1230 - Added alt_display_enabled option +# 210616-0959 - Added CORS support # $conf_silent_prefix = '5'; # vicidial_conferences prefix to enter silently and muted for recording @@ -78,17 +79,33 @@ $SIDEBAR_COLOR = '#F6F6F6'; $window_validation = 0; # set to 1 to disallow direct logins to vicidial.php $win_valid_name = 'subwindow_launch'; # only window name to allow if validation enabled -# thin bar webphone settings: +# Thin bar webphone settings: # $webphone_width = 1085; # set the webphone frame width # $webphone_height = 36; # set the webphone frame height # $webphone_pad = 0; # set the table cellpadding for the webphone # $webphone_location = 'bar'; # set the location on the agent screen 'right' or 'bar' +# Agent screen code injection options: $INSERT_head_script = ''; # inserted right above the