Added CORS(Cross-Origin Resource Sharing) support for the VICIdial agent PHP scripts. see the CORS_SUPPORT.txt doc for more information.

git-svn-id: svn://192.168.202.10@3459 3d104415-ff17-0410-8863-d5cf3c621b8a

agc_2-X/trunk/UPGRADE

@@ -645,6 +645,9 @@ OTHER CHANGES:
 	able to click on the DIAL NEXT NUMBER button each time. Also allows for 
 	an override setting based upon the day of the week and time of day.
 
+180. Added CORS(Cross-Origin Resource Sharing) support for the VICIdial agent
+	PHP scripts. see the CORS_SUPPORT.txt doc for more information.
+
 
 
 

agc_2-X/trunk/docs/CORS_SUPPORT.txt

@@ -0,0 +1,55 @@
+CORS DOC(Cross-Origin Resource Sharing)		Started: 2021-06-17	Updated: 2021-06-17
+
+
+
+This document will go over how to configure CORS (Cross-Origin Resource Sharing) with the scripts associated with the VICIdial agent screen.
+
+
+
+What is CORS exactly?
+
+Cross-Origin Resource Sharing (CORS) is an HTTP-header based mechanism that allows a server to indicate any other origins (domain, scheme, and/or port) than its own from which a browser should permit loading of resources. CORS also relies on a mechanism by which browsers make a “preflight” request to the server hosting the cross-origin resource, in order to check that the server will permit the actual request. In that preflight, the browser sends headers that indicate the HTTP method and headers that will be used in the actual request.
+
+For an example of how this might work, let's say you have a CRM system on a separate webserver from your VICIdial webserver, and you want to use a Javascript AJAX call on that CRM to trigger a VICIdial Agent API command. That functionality would not work without configuring CORS on your VICIdial agent folder because they both have different origins.
+
+
+For more details on how CORS works, and all of the options that are available within it:
+https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
+
+For more details on how X-Frame-Options works:
+https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+
+
+
+VICIDIAL AGENT WEB SCREEN SCRIPTS SUPPORT:
+
+Support for CORS configuration for almost all of the PHP scripts in the "agc" web directory was added on 2021-06-17(svn/trunk revision 3459) with the addition of the "agentCORS.php" file and the addition of the following to the "agc/options.php" file on your webserver:
+     (NOTE: If you have never set up an "agc/options.php" file on your webserver before, just use a copy the file "agc/options-example.php")
+
+
+# CORS settings: (to enable, uncomment and customize the variables below, and uncomment the "require_once('agentCORS.php');" line at the bottom)
+# (NOTE: The first 3 variables must be set for these features to be active)
+$CORS_allowed_origin		= '';	# if multiple origins allowed, separate them by a pipe (also allows PHP preg syntax)
+					# examples: 'https://acme.org|http://internal.acme.org' or "https?:\/\/(.*\\.?example\\.com|localhost):?[0-9]*|null"
+$CORS_allowed_methods		= '';	# if multiple methods allowed, separate them by a comma 
+					# example: 'GET,POST,OPTIONS,HEAD'
+$CORS_affected_scripts		= '';	# use '--ALL--' for all agc scripts. If multiple(but less than all) scripts affected, separate them by a space 
+					# examples: 'api.php alt_display.php' or '--ALL--'
+$CORS_allowed_headers		= '';	# passed in Access-Control-Allow-Headers http response header, 
+					# examples: X-Requested-With, X-Forwarded-For, X-Forwarded-Proto, Authorization, Cookie, Content-Type
+$CORS_allowed_credentials	= 'N';	# 'Y' or 'N', whether to send credentials to browser or not
+$Xframe_options			= 'N';	# Not part of CORS, but can prevent Iframe/embed/etc... use by foreign website, will populate for all affected scripts
+					# examples: 'N', 'SAMEORIGIN', 'DENY'   NOTE: using 'DENY' may break some agent screen functionality
+$CORS_debug			= 0;	# 0 = no, 1 = yes (default is no) If enabled, this will generate a lot of log entries in a CORSdebug_log.txt file
+#	require_once('agentCORS.php');
+
+
+NOTES:
+- It is STRONGLY recommended that you do not set the $CORS_allowed_origin variable to '*', this creates a very insecure situation where any website anywhere can use the resources on your webserver within any browser window, iframe or hidden span.
+
+
+
+
+VICIDIAL ADMIN WEB SCREEN SCRIPTS SUPPORT:
+
+Currently under development, the plan is support the "non_agent_api.php" script to start, then add some other scripts over time.

agc_2-X/trunk/www/agc/active_list_refresh.php

@@ -1,7 +1,7 @@
 <?php
 # active_list_refresh.php    version 2.12
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed purely to serve updates of the live data to the display scripts
 # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table
@@ -47,10 +47,11 @@
 # 141216-2119 - Added language settings lookups and user/pass variable standardization
 # 150723-1715 - Added ajax logging
 # 190111-0903 - Fix for PHP7
+# 210616-2108 - Added optional CORS support, see options.php for details
 # 
 
-$version = '0.0.18';
+$version = '0.0.19';
-$build = '190111-0903';
+$build = '210616-2108';
 $php_script = 'active_list_refresh.php';
 $SSagent_debug_logging=0;
 $startMS = microtime();
@@ -133,6 +134,13 @@ $NOW_DATE = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
 $VUselected_language = '';

agc_2-X/trunk/www/agc/agc_agent_manager_chat_interface.php

@@ -1,7 +1,7 @@
 <?php
 # agc_agent_manager_chat_interface.php
 # 
-# Copyright (C) 2020  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This page is for agents to chat with managers via the agent interface.
 #
@@ -16,10 +16,12 @@
 # 161221-0801 - Added color-coding for users in internal chat sessions
 # 180927-0624 - Fix for missing translationm issue #1125
 # 201117-2239 - Changes for better compatibility with non-latin data input
+# 210616-2056 - Added optional CORS support, see options.php for details
 #
 
-$admin_version = '2.14-10';
+$admin_version = '2.14-11';
-$build = '201117-2239';
+$build = '210616-2056';
+$php_script = 'agc_agent_manager_chat_interface.php';
 
 $sh="managerchats"; 
 
@@ -74,6 +76,13 @@ else
 	$manager_chat_id = preg_replace("/\'|\"|\\\\|;/","",$user);
 	}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
 $auth=0;
 $auth_message = user_authorization($user,$pass,'',0,0,0,0,'chat');
 if ($auth_message == 'GOOD')

agc_2-X/trunk/www/agc/agentCORS.php

@@ -0,0 +1,116 @@
+<?php
+# agentCORS.php - CORS processing and responses for Cross-Origin Features
+# 
+# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+#
+# CORS settings coming from the options.php script (the first 3 variables must be set for these features to be active)
+#	$CORS_allowed_origin		= '';	# if multiple origins allowed, separate them by a pipe (also allows PHP preg syntax)
+#										# examples: 'https://acme.org|https://internal.acme.org' or "https?:\/\/(.*\\.?example\\.com|localhost):?[0-9]*|null"
+#	$CORS_allowed_methods		= '';	# if multiple methods allowed, separate them by a comma 
+#										# example: 'GET,POST,OPTIONS,HEAD'
+#	$CORS_affected_scripts		= '';	# use '--ALL--' for all agc scripts. If multiple(but less than all) scripts affected, separate them by a space 
+#										# examples: 'api.php alt_display.php' or '--ALL--'
+#	$CORS_allowed_headers		= '';	# passed in Access-Control-Allow-Headers http response header, 
+#										# examples: X-Requested-With, X-Forwarded-For, X-Forwarded-Proto, Authorization, Cookie, Content-Type
+#	$CORS_allowed_credentials	= 'N';	# 'Y' or 'N', whether to send credentials to browser or not
+#	$Xframe_options				= 'N';	# Not part of CORS, but can prevent Iframe/embed/etc... use by foreign website, will populate for all affected scripts
+#										# examples: 'N', 'SAMEORIGIN', 'DENY'   NOTE: using 'DENY' may break some agent screen functionality
+#	$CORS_debug					= 0;	# 0 = no, 1 = yes (default is no) This will generate a lot of log entries in a CORSdebug_log.txt file
+# 
+# 
+# CHANGELOG
+# 210616-1012 - First Build
+#
+
+$NOW_TIME = date("Y-m-d H:i:s");
+
+if (strlen($php_script) < 1)
+	{exit;}
+
+$CORS_origin = $_SERVER['HTTP_ORIGIN']; # The client browser origin server
+$CORS_method = isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) ? $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] : $_SERVER['REQUEST_METHOD']; # Either the requested HTTP method or the current one
+$CORS_affected_scripts = " $CORS_affected_scripts "; # surround with spaces for preg match below
+
+if ($CORS_debug > 0)
+	{
+	$fp = fopen ("./CORSdebug_log.txt", "a");
+	fwrite ($fp, "$NOW_TIME CORS-Debug 1: BEGIN - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|$CORS_affected_scripts($php_script)|$CORS_allowed_credentials|$CORS_allowed_headers|$Xframe_options|$CORS_debug|\n");
+	fclose($fp);
+	}
+
+# if options.php $CORS_allowed_origin or $CORS_allowed_methods variables are not set, do nothing
+if ( (strlen($CORS_allowed_origin) < 1) or (strlen($CORS_allowed_methods) < 1) or (strlen($CORS_affected_scripts) < 1) )
+	{
+	if ($CORS_debug > 0)
+		{
+		$fp = fopen ("./CORSdebug_log.txt", "a");
+		fwrite ($fp, "$NOW_TIME CORS-Debug 2: variable not set - |$CORS_allowed_origin|$CORS_allowed_methods|$CORS_affected_scripts|\n");
+		fclose($fp);
+		}
+	}
+else
+	{
+	# check for affected scripts match (--ALL--, one-of-many)
+	if ( (preg_match('/ ' . $php_script . ' /i', $CORS_affected_scripts)) or ($CORS_affected_scripts == ' --ALL-- ') )
+		{
+		# check for allowed origin match (wildcard, one-of-many, preg-match) and check for allowed method match (one-of-many)
+		if ( ( ($CORS_allowed_origin == '*') or (stripos($CORS_allowed_origin,$CORS_origin) !== false) or (preg_match('/' . $CORS_allowed_origin . '/i', $CORS_origin)) ) and (preg_match('/' . $CORS_method . '/i', $CORS_allowed_methods)) )
+			{
+			header('Access-Control-Allow-Origin: ' . $CORS_origin);
+			header('Access-Control-Allow-Methods: ' . $CORS_allowed_methods);
+
+			if (strlen($CORS_allowed_headers) > 0)
+				{
+				header('Access-Control-Allow-Headers: ' . $CORS_allowed_headers);
+				}
+			if ($CORS_allowed_credentials == 'Y')
+				{
+				header('Access-Control-Allow-Credentials: true');
+				}
+			if ($CORS_debug > 0)
+				{
+				$fp = fopen ("./CORSdebug_log.txt", "a");
+				fwrite ($fp, "$NOW_TIME CORS-Debug 3: MATCHES found - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|\n");
+				fclose($fp);
+				}
+			}
+		else
+			{
+			if ($CORS_debug > 0)
+				{
+				$fp = fopen ("./CORSdebug_log.txt", "a");
+				fwrite ($fp, "$NOW_TIME CORS-Debug 4: NO MATCH origin or method - |$CORS_allowed_origin($CORS_origin)|$CORS_allowed_methods($CORS_method)|\n");
+				fclose($fp);
+				}
+			}
+		# For OPTIONS preflight requests, exit without processing the script further
+		if ( (strcasecmp($_SERVER['REQUEST_METHOD'], 'OPTIONS') == 0) and (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) )
+			{
+			flush();
+			die();
+			}
+		}
+	else
+		{
+		if ($CORS_debug > 0)
+			{
+			$fp = fopen ("./CORSdebug_log.txt", "a");
+			fwrite ($fp, "$NOW_TIME CORS-Debug 5: NO AFFECT script - |$CORS_affected_scripts|$php_script|\n");
+			fclose($fp);
+			}
+		}
+
+	# add $Xframe_options if defined
+	if ( ($Xframe_options == 'SAMEORIGIN') or ($Xframe_options == 'DENY') )
+		{
+		header('X-Frame-Options: ' . $Xframe_options);
+		if ($CORS_debug > 0)
+			{
+			$fp = fopen ("./CORSdebug_log.txt", "a");
+			fwrite ($fp, "$NOW_TIME CORS-Debug 6: X-frame-Options sent - |$Xframe_options|\n");
+			fclose($fp);
+			}
+		}
+	}
+
+?>

agc_2-X/trunk/www/agc/alt_display.php

@@ -20,10 +20,11 @@
 # 201026-1504 - Fix for LIVE call issue in top_panel
 # 210426-0138 - Added calls_inqueue_count_ campaign settings options, and calls_in_queue_option=CAMPAIGN setting
 # 210428-2156 - Added calls_in_queue_display setting
+# 210616-1907 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-5';
+$version = '2.14-6';
-$build = '210428-2156';
+$build = '210616-1907';
 $php_script = 'alt_display.php';
 $mel=1;					# Mysql Error Log enabled = 1
 $mysql_log_count=11;

agc_2-X/trunk/www/agc/api.php

@@ -104,10 +104,12 @@
 # 210116-1138 - Addressed session ID issue in ticket #1251
 # 210222-1058 - Added call length logging to ra_call_control function
 # 210320-2335 - Added additional update_fields options: scriptreload,script2reload,formreload,emailreload,chatreload
+# 210616-2057 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-69';
+$version = '2.14-70';
-$build = '210320-2335';
+$build = '210616-2057';
+$php_script = 'api.php';
 
 $startMS = microtime();
 
@@ -255,6 +257,13 @@ if (isset($_GET["cid_choice"]))				{$cid_choice=$_GET["cid_choice"];}
 if (isset($_GET["outbound_cid"]))			{$outbound_cid=$_GET["outbound_cid"];}
 	elseif (isset($_POST["outbound_cid"]))	{$outbound_cid=$_POST["outbound_cid"];}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
 header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
 header ("Pragma: no-cache");                          // HTTP/1.0

agc_2-X/trunk/www/agc/astguiclient.php

@@ -71,10 +71,12 @@
 # 190111-0902 - Fix for PHP7
 # 200319-1532 - Small fixes for conference tab issues
 # 210615-1037 - Default security fixes, CVE-2021-28854
+# 210616-2053 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.2.6-4';
+$version = '2.2.6-5';
-$build = '210615-1037';
+$build = '210616-2053';
+$php_script = 'astguiclient.php';
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -113,6 +115,12 @@ $phone_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$phone_pass);
 $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
 
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####

agc_2-X/trunk/www/agc/call_log_display.php

@@ -1,7 +1,7 @@
 <?php
 # call_log_display.php    version 2.14
 # 
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed purely to send the inbound and outbound calls for a specific phone
 # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table
@@ -41,10 +41,11 @@
 # 170526-2215 - Added additional variable filtering
 # 190111-0904 - Fix for PHP7
 # 201117-2200 - Changes for better compatibility with non-latin data input
+# 210616-2102 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-21';
+$version = '2.14-22';
-$build = '201117-2200';
+$build = '210616-2102';
 $php_script = 'call_log_display.php';
 $SSagent_debug_logging=0;
 $startMS = microtime();
@@ -89,6 +90,12 @@ $NOW_DATE = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
 
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####

agc_2-X/trunk/www/agc/chat_db_query.php

@@ -1,7 +1,7 @@
 <?php
 # chat_db_query.php
 #
-# Copyright (C) 2020  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # Called by vdc_chat_display.php and vicidial_chat_agent.js.  This contains all actions taken by the
 # agent's interface when chatting with customers, other agents, and managers, through 
@@ -24,8 +24,11 @@
 # 170526-2257 - Added additional variable filtering
 # 170528-1028 - Added more variable filtering
 # 201117-2238 - Changes for better compatibility with non-latin data input
+# 210616-2055 - Added optional CORS support, see options.php for details
 #
 
+$php_script = 'chat_db_query.php';
+
 require("dbconnect_mysqli.php");
 require("functions.php");
 

agc_2-X/trunk/www/agc/conf_exten_check.php

@@ -88,10 +88,11 @@
 # 210317-1935 - Added visibility logging
 # 210328-1013 - Fix for emails-in-queue count query, Issue #1170
 # 210425-2357 - Added calls_inqueue_count_ calculation
+# 210616-1905 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-62';
+$version = '2.14-63';
-$build = '210425-2357';
+$build = '210616-1905';
 $php_script = 'conf_exten_check.php';
 $mel=1;					# Mysql Error Log enabled = 1
 $mysql_log_count=51;
@@ -155,6 +156,13 @@ if (isset($_GET["visibility"]))				{$visibility=$_GET["visibility"];}
 if ($bcrypt == 'OFF')
 	{$bcrypt=0;}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
 header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
 header ("Pragma: no-cache");                          // HTTP/1.0

agc_2-X/trunk/www/agc/deactivate_lead.php

@@ -33,11 +33,11 @@
 # 170526-2301 - Added additional variable filtering
 # 201117-2222 - Changes for better compatibility with non-latin data input
 # 210615-1036 - Default security fixes, CVE-2021-28854
+# 210616-2050 - Added optional CORS support, see options.php for details
 #
 
 $api_script = 'deactivate';
-
+$php_script = 'deactivate_lead.php';
-header ("Content-type: text/html; charset=utf-8");
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -83,6 +83,15 @@ $search_value='';
 $user = preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass = preg_replace("/\'|\"|\\\\|;| /","",$pass);
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
+header ("Content-type: text/html; charset=utf-8");
+
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
 $VUselected_language = '';

agc_2-X/trunk/www/agc/dispo_add_FPG.php

@@ -22,11 +22,11 @@
 # 150724-1657 - First Build
 # 170526-2305 - Added additional variable filtering
 # 210615-1039 - Default security fixes, CVE-2021-28854
+# 210616-2049 - Added optional CORS support, see options.php for details
 #
 
 $api_script = 'add_FPG';
-
+$php_script = 'dispo_add_FPG.php';
-header ("Content-type: text/html; charset=utf-8");
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -75,6 +75,15 @@ $phone_number = preg_replace('/[^-_0-9a-zA-Z]/','',$phone_number);
 $FPG_id = preg_replace("/\'|\"|\\\\|;| /","",$FPG_id);
 $lead_id = preg_replace('/[^0-9]/','',$lead_id);
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
+header ("Content-type: text/html; charset=utf-8");
+
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
 $VUselected_language = '';

agc_2-X/trunk/www/agc/dispo_change_status.php

@@ -26,11 +26,11 @@
 # 171127-1736 - First Build
 # 201117-2217 - Changes for better compatibility with non-latin data input
 # 210615-1035 - Default security fixes, CVE-2021-28854
+# 210616-2047 - Added optional CORS support, see options.php for details
 #
 
 $api_script = 'dispo_change_status';
-
+$php_script = 'dispo_change_status.php';
-header ("Content-type: text/html; charset=utf-8");
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -90,6 +90,15 @@ if ( ($archive_search != 'Y') and ($archive_search != 'N') )
 if ( ($in_out_search != 'IN') and ($in_out_search != 'OUT') and ($in_out_search != 'BOTH') )
 	{$in_out_search = 'BOTH';}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
+header ("Content-type: text/html; charset=utf-8");
+
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
 $VUselected_language = '';

agc_2-X/trunk/www/agc/dispo_move_list.php

@@ -66,11 +66,11 @@
 # 170526-2310 - Added additional variable filtering
 # 180419-2257 - Added multi_trigger option
 # 210615-1038 - Default security fixes, CVE-2021-28854
+# 210616-2046 - Added optional CORS support, see options.php for details
 #
 
 $api_script = 'movelist';
-
+$php_script = 'dispo_move_list.php';
-header ("Content-type: text/html; charset=utf-8");
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -149,6 +149,15 @@ $new_list_id = preg_replace('/[^_0-9]/', '', $new_list_id);
 $list_id_trigger = preg_replace('/[^_0-9]/', '', $list_id_trigger);
 $multi_trigger=preg_replace("/\'|\"|\\\\|;| /","",$multi_trigger);
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
+header ("Content-type: text/html; charset=utf-8");
+
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
 $VUselected_language = '';

agc_2-X/trunk/www/agc/dispo_send_email.php

@@ -42,11 +42,11 @@
 # 200814-1829 - added email_body_html, email_body_utf8 flags
 # 201117-2104 - Changes for better compatibility with non-latin data input
 # 210615-1033 - Default security fixes, CVE-2021-28854
+# 210616-2044 - Added optional CORS support, see options.php for details
 #
 
 $api_script = 'send_email';
-
+$php_script = 'dispo_send_email.php';
-header ("Content-type: text/html; charset=utf-8");
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -150,6 +150,15 @@ $email_charset = 'iso-8859-1';
 $user=preg_replace("/\'|\"|\\\\|;| /","",$user);
 $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
+header ("Content-type: text/html; charset=utf-8");
+
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
 $VUselected_language = '';

agc_2-X/trunk/www/agc/inbound_popup.php

@@ -1,7 +1,7 @@
 <?php
 # inbound_popup.php    version 2.14
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed to open up when a live_inbound call comes in giving the user
 #   options of what to do with the call or options to lookup the callerID on various web sites
@@ -38,10 +38,12 @@
 # 141216-2120 - Added language settings lookups and user/pass variable standardization
 # 170526-2231 - Added additional variable filtering
 # 190111-0905 - Fix for PHP7
+# 210616-2106 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-14';
+$version = '2.14-15';
-$build = '190111-0905';
+$build = '210616-2106';
+$php_script = 'inbound_popup.php';
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -93,6 +95,13 @@ if (!isset($query_date)) {$query_date = $NOW_DATE;}
 $DO = '-1';
 if ( (preg_match("/^Zap/i",$channel)) and (!preg_match("/-/i",$channel)) ) {$channel = "$channel$DO";}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
 $VUselected_language = '';

agc_2-X/trunk/www/agc/live_exten_check.php

@@ -1,7 +1,7 @@
 <?php
 # live_exten_check.php    version 2.14
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed purely to send whether the client channel is live and to what channel it is connected
 # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table
@@ -41,6 +41,7 @@
 # 150723-1713 - Added ajax logging
 # 170526-2234 - Added additional variable filtering
 # 190111-0906 - Fix for PHP7
+# 210616-2105 - Added optional CORS support, see options.php for details
 #
 
 $version = '2.14-18';
@@ -89,6 +90,12 @@ $NOW_DATE = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
 
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####

agc_2-X/trunk/www/agc/manager_send.php

@@ -146,10 +146,11 @@
 # 201107-2228 - Added campaign/in-group logging in park_log
 # 201117-1751 - Changes for better compatibility with non-latin data input
 # 210615-1016 - Default security fixes, CVE-2021-28854
+# 210616-2051 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-93';
+$version = '2.14-94';
-$build = '210615-1016';
+$build = '210616-2051';
 $php_script = 'manager_send.php';
 $mel=1;					# Mysql Error Log enabled = 1
 $mysql_log_count=143;
@@ -258,6 +259,13 @@ if (isset($_GET["user_group"]))				{$user_group=$_GET["user_group"];}
 if (isset($_GET["group_id"]))			{$group_id=$_GET["group_id"];}
 	elseif (isset($_POST["group_id"]))	{$group_id=$_POST["group_id"];}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
 $stmt = "SELECT use_non_latin,allow_sipsak_messages,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,agent_debug_logging FROM system_settings;";

agc_2-X/trunk/www/agc/options-example.php

@@ -1,7 +1,7 @@
 <?php
 # options.php - manually defined options for vicidial.php
 # 
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # rename this file to options.php for the settings here to go into effect
 #
@@ -19,6 +19,7 @@
 # 191107-0925 - Added $webphone_call_seconds
 # 200515-1339 - Added ast13_volume_override option
 # 200827-1230 - Added alt_display_enabled option
+# 210616-0959 - Added CORS support
 #
 
 $conf_silent_prefix		= '5';	# vicidial_conferences prefix to enter silently and muted for recording
@@ -78,17 +79,33 @@ $SIDEBAR_COLOR			= '#F6F6F6';
 $window_validation		= 0;	# set to 1 to disallow direct logins to vicidial.php
 $win_valid_name			= 'subwindow_launch';	# only window name to allow if validation enabled
 
-# thin bar webphone settings:
+# Thin bar webphone settings:
 #	$webphone_width			= 1085;	# set the webphone frame width
 #	$webphone_height		= 36;	# set the webphone frame height
 #	$webphone_pad			= 0;	# set the table cellpadding for the webphone
 #	$webphone_location		= 'bar';	# set the location on the agent screen 'right' or 'bar'
 
+# Agent screen code injection options:
 $INSERT_head_script		= '';	# inserted right above the <script language="Javascript"> line after logging in
 $INSERT_head_js			= '';	# inserted after first javascript function
 $INSERT_first_onload	= '';	# inserted at the beginning of the first section of the onload function
 $INSERT_window_onload	= '';	# inserted at the end of the onload function
 $INSERT_agent_events	= '';	# inserted within the agent_events function
 
+# CORS settings: (to enable, customize the variables below, and uncomment the "require_once('agentCORS.php');" line at the bottom)
+# (NOTE: The first 3 variables must be set for these features to be active)
+$CORS_allowed_origin		= '';	# if multiple origins allowed, separate them by a pipe (also allows PHP preg syntax)
+									# examples: 'https://acme.org|https://internal.acme.org' or "https?:\/\/(.*\\.?example\\.com|localhost):?[0-9]*|null"
+$CORS_allowed_methods		= '';	# if multiple methods allowed, separate them by a comma 
+									# example: 'GET,POST,OPTIONS,HEAD'
+$CORS_affected_scripts		= '';	# use '--ALL--' for all agc scripts. If multiple(but less than all) scripts affected, separate them by a space 
+									# examples: 'api.php alt_display.php' or '--ALL--'
+$CORS_allowed_headers		= '';	# passed in Access-Control-Allow-Headers http response header, 
+									# examples: X-Requested-With, X-Forwarded-For, X-Forwarded-Proto, Authorization, Cookie, Content-Type
+$CORS_allowed_credentials	= 'N';	# 'Y' or 'N', whether to send credentials to browser or not
+$Xframe_options				= 'N';	# Not part of CORS, but can prevent Iframe/embed/etc... use by foreign website, will populate for all affected scripts
+									# examples: 'N', 'SAMEORIGIN', 'DENY'   NOTE: using 'DENY' may break some agent screen functionality
+$CORS_debug					= 0;	# 0 = no, 1 = yes (default is no) This will generate a lot of log entries in a CORSdebug_log.txt file
+#	require_once('agentCORS.php');
 
 ?>

agc_2-X/trunk/www/agc/park_calls_display.php

@@ -1,7 +1,7 @@
 <?php
 # park_calls_display.php    version 2.14
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed purely to send the details on the parked calls on the server
 # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table
@@ -32,10 +32,11 @@
 # 150723-1712 - Added ajax logging
 # 170526-2244 - Added additional variable filtering
 # 190111-0907 - Fix for PHP7
+# 210616-2104 - Added optional CORS support, see options.php for details
 # 
 
-$version = '2.14-14';
+$version = '2.14-15';
-$build = '190111-0907';
+$build = '210616-2104';
 $php_script = 'park_calls_display.php';
 $SSagent_debug_logging=0;
 $startMS = microtime();
@@ -76,6 +77,12 @@ $NOW_DATE = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
 
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####

agc_2-X/trunk/www/agc/phone_only.php

@@ -20,10 +20,12 @@
 # 181003-1736 - Added external_web_socket_url option
 # 200123-1639 - Added Webphone options
 # 210615-1028 - Default security fixes, CVE-2021-28854
+# 210616-2043 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-16p';
+$version = '2.14-17p';
-$build = '210615-1028';
+$build = '210616-2043';
+$php_script = 'phone_only.php';
 $mel=1;					# Mysql Error Log enabled = 1
 $mysql_log_count=74;
 $one_mysql_log=0;

agc_2-X/trunk/www/agc/timeclock.php

@@ -1,7 +1,7 @@
 <?php
 # timeclock.php - VICIDIAL system user timeclock
 # 
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # CHANGELOG
 # 80523-0134 - First Build 
@@ -24,10 +24,12 @@
 # 161106-2112 - Added screen colors, fixed formatting
 # 190111-0901 - Fix for PHP7
 # 201117-2117 - Changes for better compatibility with non-latin data input
+# 210616-2101 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.12-19';
+$version = '2.14-20';
-$build = '201117-2117';
+$build = '210616-2101';
+$php_script = 'timeclock.php';
 
 $StarTtimE = date("U");
 $NOW_TIME = date("Y-m-d H:i:s");
@@ -94,6 +96,13 @@ $VD_pass=preg_replace("/\'|\"|\\\\|;| /","",$VD_pass);
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
 $VUselected_language = '';

agc_2-X/trunk/www/agc/update_cf_ivr.php

@@ -12,9 +12,11 @@
 # 150814-1441 - First Build
 # 170526-2319 - Added additional variable filtering
 # 210615-1030 - Default security fixes, CVE-2021-28854
+# 210616-2041 - Added optional CORS support, see options.php for details
 #
 
 $api_script = 'update_cf_ivr';
+$php_script = 'update_cf_ivr.php';
 
 header ("Content-type: text/html; charset=utf-8");
 
@@ -100,6 +102,13 @@ if ($non_latin < 1)
 	$user=preg_replace("/[^-_0-9a-zA-Z]/","",$user);
 	}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
 if ($DB>0) {echo "$lead_id|$caller_id|$list_id|$field|$value|$user|$DB|$log_to_file|\n";}
 
 

agc_2-X/trunk/www/agc/vdc_chat_display.php

@@ -1,7 +1,7 @@
 <?php
 # vdc_chat_display.php
 #
-# Copyright (C) 2020  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Joe Johnson, Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This is the interface for agents to chat with customers and each other.  It's separate from the manager-to-agent 
 # chat interface out of necessity and calls the chat_db_query.php page to send information and display it.  It will
@@ -19,11 +19,14 @@
 # 170528-1001 - Added variable filtering
 # 190902-0914 - Fix for PHP 7.2
 # 201117-2207 - Changes for better compatibility with non-latin data input
+# 210616-2040 - Added optional CORS support, see options.php for details
 #
 
 require("dbconnect_mysqli.php");
 require("functions.php");
 
+$php_script = 'vdc_chat_display.php';
+
 $MT[0]='';
 $chat_group_ids=$MT;
 
@@ -86,6 +89,13 @@ $VUselected_language = $SSdefault_language;
 ##### END SETTINGS LOOKUP #####
 ###########################################
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
 header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
 header ("Pragma: no-cache");                          // HTTP/1.0

agc_2-X/trunk/www/agc/vdc_db_query.php

@@ -509,10 +509,11 @@
 # 210606-0957 - Added TILTX features for pre-carrier call filtering
 # 210609-1045 - Added in_man_dial_next_ready_seconds to update_settings function
 # 210615-1014 - Default security fixes, CVE-2021-28854
+# 210616-1906 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-402';
+$version = '2.14-403';
-$build = '210615-1014';
+$build = '210616-1906';
 $php_script = 'vdc_db_query.php';
 $mel=1;					# Mysql Error Log enabled = 1
 $mysql_log_count=850;
@@ -828,6 +829,13 @@ if (isset($_GET["calls_waiting_vl_oneLABEL"]))			{$calls_waiting_vl_oneLABEL=$_G
 if (isset($_GET["calls_waiting_vl_twoLABEL"]))			{$calls_waiting_vl_twoLABEL=$_GET["calls_waiting_vl_twoLABEL"];}
 	elseif (isset($_POST["calls_waiting_vl_twoLABEL"]))	{$calls_waiting_vl_twoLABEL=$_POST["calls_waiting_vl_twoLABEL"];}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
 header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
 header ("Pragma: no-cache");                          // HTTP/1.0

agc_2-X/trunk/www/agc/vdc_email_display.php

@@ -1,7 +1,7 @@
 <?php
 # vdc_email_display.php - VICIDIAL agent email display script
 #
-# Copyright (C) 2017  Matt Florell, Joe Johnson <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Matt Florell, Joe Johnson <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This page displays any incoming emails in the Vicidial user interface.  It 
 # also allows the user to download and view any attachments sent in the email,
@@ -23,10 +23,12 @@
 # 150603-1541 - Fixed email attachments issue
 # 170526-2330 - Added additional variable filtering
 # 171126-1406 - Added fault tolerance and extra debug
+# 210616-2038 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-13';
+$version = '2.14-14';
-$build = '171126-1406';
+$build = '210616-2038';
+$php_script = 'vdc_email_display.php';
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -65,6 +67,13 @@ if (isset($_GET["agent_email"]))	{$agent_email=$_GET["agent_email"];}
 $PHP_SELF=$_SERVER['PHP_SELF'];
 $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
 $attachment1=$_FILES["attachment1"];
 	$A1_orig = $_FILES['attachment1']['name'];
 	$A1_path = $_FILES['attachment1']['tmp_name'];

agc_2-X/trunk/www/agc/vdc_form_display.php

@@ -52,10 +52,11 @@
 # 210329-2025 - Fixed for consistent custom fields values filtering
 # 210404-1522 - Added only_field option for refresh of already-loaded custom form SOURCESELECT element
 # 210506-1825 - Fix for SELECTSOURCE reloading issue
+# 210616-2037 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-42';
+$version = '2.14-43';
-$build = '210506-1825';
+$build = '210616-2037';
 $php_script = 'vdc_form_display.php';
 
 require_once("dbconnect_mysqli.php");
@@ -221,10 +222,16 @@ if (isset($_GET["orig_URL"]))			{$orig_URL=$_GET["orig_URL"];}
 if (isset($_GET["DB"]))				{$DB=$_GET["DB"];}
 	elseif (isset($_POST["DB"]))	{$DB=$_POST["DB"];}
 
-
 if ($bcrypt == 'OFF')
 	{$bcrypt=0;}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
 header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
 header ("Pragma: no-cache");                          // HTTP/1.0

agc_2-X/trunk/www/agc/vdc_script_display.php

@@ -1,7 +1,7 @@
 <?php
 # vdc_script_display.php
 # 
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed display the contents of the SCRIPT tab in the agent interface
 #
@@ -42,10 +42,12 @@
 # 191013-2145 - Fixes for PHP7
 # 191031-1158 - Added Script2 feature
 # 201117-2107 - Changes for better compatibility with non-latin data input
+# 210616-2100 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-36';
+$version = '2.14-37';
-$build = '201117-2107';
+$build = '210616-2100';
+$php_script = 'vdc_script_display.php';
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -264,6 +266,12 @@ if (isset($_GET["LOGINvarFIVE"]))			{$LOGINvarFIVE=$_GET["LOGINvarFIVE"];}
 if (isset($_GET["script_span"]))			{$script_span=$_GET["script_span"];}
 	elseif (isset($_POST["script_span"]))	{$script_span=$_POST["script_span"];}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
 
 header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1

agc_2-X/trunk/www/agc/vdc_script_dispo_example.php

@@ -1,7 +1,7 @@
 <?php
 # vdc_script_dispo_example.php
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed to be used in the SCRIPT tab in an IFRAME and will not submit unless a specific field is filled in
 #
@@ -22,10 +22,12 @@
 # 170526-2345 - Added additional variable filtering
 # 170528-0902 - Added more variable filtering
 # 190111-0910 - Fix for PHP7
+# 210616-2035 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-10';
+$version = '2.14-11';
-$build = '190111-0910';
+$build = '210616-2035';
+$php_script = 'vdc_script_dispo_example.php';
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -235,6 +237,12 @@ $appointment_hour = $appointment_timeARRAY[0];
 $appointment_min = $appointment_timeARRAY[1];
 ##### END Put custom fields here #####
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
 
 header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1

agc_2-X/trunk/www/agc/vdc_script_notes.php

@@ -1,7 +1,7 @@
 <?php
 # vdc_script_notes.php
 # 
-# Copyright (C) 2020  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed open in the SCRIPT tab in the agent interface through
 # an IFRAME. It will create a new record for every SUBMIT
@@ -20,10 +20,12 @@
 # 170526-2345 - Added additional variable filtering
 # 170528-0901 - Added more variable filtering
 # 201117-2213 - Changes for better compatibility with non-latin data input
+# 210616-2034 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-10';
+$version = '2.14-11';
-$build = '201117-2213';
+$build = '210616-2034';
+$php_script = 'vdc_script_notes.php';
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -204,6 +206,13 @@ $appointment_timeARRAY = explode(":",$appointment_time);
 $appointment_hour = $appointment_timeARRAY[0];
 $appointment_min = $appointment_timeARRAY[1];
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
 header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
 header ("Pragma: no-cache");                          // HTTP/1.0

agc_2-X/trunk/www/agc/vdc_soundboard_display.php

@@ -1,7 +1,7 @@
 <?php
 # vdc_soundboard_display.php
 # 
-# Copyright (C) 2019  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed display the contents of an audio soundboard in the system
 #
@@ -13,10 +13,12 @@
 # 161103-1656 - Added Agent Debug Logging
 # 161111-1647 - Added HIDENUMBERS display option, Font size, button type and layout options
 # 191013-2122 - Fixes for PHP7
+# 210616-2032 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.12-7';
+$version = '2.14-8';
-$build = '191013-2122';
+$build = '210616-2032';
+$php_script = 'vdc_soundboard_display.php';
 
 require_once("dbconnect_mysqli.php");
 require_once("functions.php");
@@ -54,6 +56,13 @@ if (isset($_GET["bcrypt"]))				{$bcrypt=$_GET["bcrypt"];}
 if ($bcrypt == 'OFF')
 	{$bcrypt=0;}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
+
 header ("Content-type: text/html; charset=utf-8");
 header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
 header ("Pragma: no-cache");                          // HTTP/1.0

agc_2-X/trunk/www/agc/vicidial-grey.php

@@ -528,10 +528,12 @@
 # 161102-1120 - Fixed QM partition problem
 # 190111-0908 - Fix for PHP7
 # 210615-1029 - Default security fixes, CVE-2021-28854
+# 210616-1852 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.12-494c-grey';
+$version = '2.12-495c-grey';
-$build = '190111-0908';
+$build = '210616-1852';
+$php_script = 'vicidial-grey.php';
 $mel=1;					# Mysql Error Log enabled = 1
 $mysql_log_count=87;
 $one_mysql_log=0;

agc_2-X/trunk/www/agc/vicidial.php

@@ -669,10 +669,12 @@
 # 210606-0955 - Cleanup of debugbottomspan, testing of TILTX features
 # 210609-0942 - Added in_man_dial_next_ready_seconds campaign options
 # 210615-0959 - Default security fix, CVE-2021-28854
+# 210616-1852 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-637c';
+$version = '2.14-638c';
-$build = '210615-0959';
+$build = '210616-1852';
+$php_script = 'vicidial.php';
 $mel=1;					# Mysql Error Log enabled = 1
 $mysql_log_count=95;
 $one_mysql_log=0;

agc_2-X/trunk/www/agc/voicemail_check.php

@@ -1,7 +1,7 @@
 <?php
 # voicemail_check.php    version 2.14
 # 
-# Copyright (C) 2017  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2021  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # This script is designed purely to check whether the voicemail box on the server defined has new and old messages
 # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table
@@ -31,10 +31,11 @@
 # 141216-1902 - Added language settings lookups and user/pass variable standardization
 # 150723-1711 - Added ajax logging
 # 170526-2351 - Added additional variable filtering
+# 210616-2109 - Added optional CORS support, see options.php for details
 #
 
-$version = '2.14-14';
+$version = '2.14-15';
-$build = '170526-2351';
+$build = '210616-2109';
 $php_script = 'voicemail_check.php';
 $SSagent_debug_logging=0;
 $startMS = microtime();
@@ -70,6 +71,12 @@ $NOW_DATE = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
 if (!isset($query_date)) {$query_date = $NOW_DATE;}
 
+# if options file exists, use the override values for the above variables
+#   see the options-example.php file for more information
+if (file_exists('options.php'))
+	{
+	require_once('options.php');
+	}
 
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####