LICENSE: AGPLv2 # # This territories script is for use with custom tables in Vtiger which is why # it is separate from the standard admin.php script. user_territories_active in # the system_settings table must be active for this script to work. # # CHANGES # 90520-1928 - first build # 90717-0651 - Added batch # 90726-2302 - Added vicidial_list user owner update option # 91012-0310 - Added vicidial_list counts for territory as owner # 130610-1050 - Finalized changing of all ereg instances to preg # 130616-0010 - Added filtering of input to prevent SQL injection attacks and new user auth # 130901-0834 - Changed to mysqli PHP functions # 141007-2050 - Finalized adding QXZ translation to all admin files # 141229-1850 - Added code for on-the-fly language translations display # 150626-2120 - Modified mysqli_error() to mysqli_connect_error() where appropriate # 160325-1432 - Changes for sidebar update # 160404-0939 - design changes # 160429-1126 - Added admin_row_click option # 160508-0211 - Added screen colors feature # 161101-2126 - Fixed missing menu items # 180508-2215 - Added new help display # 220223-0808 - Added allow_web_debug system setting # $version = '2.14-17'; $build = '220223-0808'; $MT[0]=''; require("dbconnect_mysqli.php"); require("functions.php"); $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); if (isset($_GET["action"])) {$action=$_GET["action"];} elseif (isset($_POST["action"])) {$action=$_POST["action"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["territory"])) {$territory=$_GET["territory"];} elseif (isset($_POST["territory"])) {$territory=$_POST["territory"];} if (isset($_GET["territory_description"])) {$territory_description=$_GET["territory_description"];} elseif (isset($_POST["territory_description"])) {$territory_description=$_POST["territory_description"];} if (isset($_GET["user"])) {$user=$_GET["user"];} elseif (isset($_POST["user"])) {$user=$_POST["user"];} if (isset($_GET["level"])) {$level=$_GET["level"];} elseif (isset($_POST["level"])) {$level=$_POST["level"];} if (isset($_GET["accountid"])) {$accountid=$_GET["accountid"];} elseif (isset($_POST["accountid"])) {$accountid=$_POST["accountid"];} if (isset($_GET["batch"])) {$batch=$_GET["batch"];} elseif (isset($_POST["batch"])) {$batch=$_POST["batch"];} if (isset($_GET["vl_owner"])) {$vl_owner=$_GET["vl_owner"];} elseif (isset($_POST["vl_owner"])) {$vl_owner=$_POST["vl_owner"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); header ("Content-type: text/html; charset=utf-8"); header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 header ("Pragma: no-cache"); // HTTP/1.0 ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $stmt = "SELECT use_non_latin,user_territories_active,enable_vtiger_integration,outbound_autodial_active,vtiger_server_ip,vtiger_dbname,vtiger_login,vtiger_pass,vtiger_url,enable_languages,language_method,qc_features_active,user_new_lead_limit,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); #if ($DB) {echo "$stmt\n";} $ss_conf_ct = mysqli_num_rows($rslt); if ($ss_conf_ct > 0) { $row=mysqli_fetch_row($rslt); $non_latin = $row[0]; $user_territories_active = $row[1]; $enable_vtiger_integration = $row[2]; $SSoutbound_autodial_active = $row[3]; $vtiger_server_ip = $row[4]; $vtiger_dbname = $row[5]; $vtiger_login = $row[6]; $vtiger_pass = $row[7]; $vtiger_url = $row[8]; $SSenable_languages = $row[9]; $SSlanguage_method = $row[10]; $SSqc_features_active = $row[11]; $SSuser_new_lead_limit = $row[12]; $SSallow_web_debug = $row[13]; } if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### if ($user_territories_active < 1) { echo _QXZ("ERROR: User Territories are not active on this system")."\n"; exit; } ### Filter Variable Values ### $DB = preg_replace('/[^0-9]/','',$DB); $action = preg_replace('/[^\_0-9a-zA-Z]/','',$action); $level = preg_replace('/[^\_A-Z]/','',$level); $batch = preg_replace('/[^-_0-9a-zA-Z]/', '',$batch); $SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '',$SUBMIT); $vl_owner = preg_replace('/[^-_0-9a-zA-Z]/', '',$vl_owner); if ($non_latin < 1) { $user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$user); $territory = preg_replace('/[^-\_0-9a-zA-Z]/', '',$territory); $territory_description = preg_replace('/[^- \_\.\,0-9a-zA-Z]/','',$territory_description); $old_territory = preg_replace('/[^-\_0-9a-zA-Z]/', '',$old_territory); $old_user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$old_user); $accountid = preg_replace('/[^-\_0-9a-zA-Z]/', '',$accountid); } else { $user = preg_replace('/[^-_0-9\p{L}]/u',"",$user); $territory = preg_replace('/[^-\_0-9\p{L}]/u', '',$territory); $territory_description = preg_replace('/[^- \_\.\,0-9\p{L}]/u','',$territory_description); $old_territory = preg_replace('/[^-\_0-9\p{L}]/u', '',$old_territory); $old_user = preg_replace('/[^-\_0-9\p{L}]/u', '',$old_user); $accountid = preg_replace('/[^-\_0-9\p{L}]/u', '',$accountid); } if (preg_match("/YES/i",$batch)) { $USER='batch'; $PASS='batch'; } else { $USER=$_SERVER['PHP_AUTH_USER']; $PASS=$_SERVER['PHP_AUTH_PW']; if ($non_latin < 1) { $USER = preg_replace('/[^-_0-9a-zA-Z]/','',$USER); $PASS = preg_replace('/[^-_0-9a-zA-Z]/','',$PASS); } else { $USER = preg_replace('/[^-_0-9\p{L}]/u', '', $USER); $PASS = preg_replace('/[^-_0-9\p{L}]/u', '', $PASS); } } $stmt="SELECT selected_language,qc_enabled from vicidial_users where user='$USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; $qc_auth = $row[1]; } $auth=0; $modify_users_auth=0; $auth_message = user_authorization($USER,$PASS,'',1,0); if ($auth_message == 'GOOD') {$auth=1;} $stmt="SELECT count(*) from vicidial_users where user='$USER' and user_level > 7 and modify_users='1'"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $modify_users_auth=$row[0]; if( (strlen($USER)<2) or (strlen($PASS)<2) or (!$auth) or (!$modify_users_auth)) { Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "Invalid Username/Password: |$USER|$PASS|$auth_message|\n"; exit; } if ($enable_vtiger_integration > 0) { ### connect to your vtiger database #$linkV=mysql_connect("$vtiger_server_ip", "$vtiger_login","$vtiger_pass"); $linkV=mysqli_connect("$vtiger_server_ip", "$vtiger_login", "$vtiger_pass", "$vtiger_dbname"); if (!$linkV) {die("Could not connect: $vtiger_server_ip|$vtiger_dbname|$vtiger_login|$vtiger_pass" . mysqli_connect_error());} #mysql_select_db("$vtiger_dbname", $linkV); } if (strlen($action) < 1) {$action = 'LIST_ALL_TERRITORIES';} ?>
| \n";
echo "";
echo " "._QXZ("Vtiger Change Territory Owner")." |