LICENSE: AGPLv2 # # This callcard script is to administer the callcard accounts in ViciDial # it is separate from the standard admin.php script. callcard_enabled in # the system_settings table must be active for this script to work. # # CHANGES # 100311-2325 - first build # 100525-1824 - Added generate option # 100616-0847 - Fixed batch issue # 100823-1342 - Added Search option and display for level 7 users, added pin number search # 120117-1457 - Security fix, issue #544 # 130610-1103 - Finalized changing of all ereg instances to preg # 130620-0839 - Added filtering of input to prevent SQL injection attacks and new user auth # 130901-1939 - Changed to mysqli PHP functions # 141007-2040 - Finalized adding QXZ translation to all admin files # 141229-2044 - Added code for on-the-fly language translations display # 160330-1551 - navigation changes and fixes # 170409-1539 - Added IP List validation code # 170829-0040 - Added screen color settings # 180508-0115 - Added new help display # 201111-1615 - Fix for Issue #1230 # 220224-1631 - Added allow_web_debug system setting # $version = '2.14-14'; $build = '220224-1631'; $MT[0]=''; require("dbconnect_mysqli.php"); require("functions.php"); $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); if (isset($_GET["action"])) {$action=$_GET["action"];} elseif (isset($_POST["action"])) {$action=$_POST["action"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["run"])) {$run=$_GET["run"];} elseif (isset($_POST["run"])) {$run=$_POST["run"];} if (isset($_GET["batch"])) {$batch=$_GET["batch"];} elseif (isset($_POST["batch"])) {$batch=$_POST["batch"];} if (isset($_GET["starting_batch"])) {$starting_batch=$_GET["starting_batch"];} elseif (isset($_POST["starting_batch"])) {$starting_batch=$_POST["starting_batch"];} if (isset($_GET["pack"])) {$pack=$_GET["pack"];} elseif (isset($_POST["pack"])) {$pack=$_POST["pack"];} if (isset($_GET["sequence"])) {$sequence=$_GET["sequence"];} elseif (isset($_POST["sequence"])) {$sequence=$_POST["sequence"];} if (isset($_GET["card_id"])) {$card_id=$_GET["card_id"];} elseif (isset($_POST["card_id"])) {$card_id=$_POST["card_id"];} if (isset($_GET["pin"])) {$pin=$_GET["pin"];} elseif (isset($_POST["pin"])) {$pin=$_POST["pin"];} if (isset($_GET["status"])) {$status=$_GET["status"];} elseif (isset($_POST["status"])) {$status=$_POST["status"];} if (isset($_GET["total"])) {$total=$_GET["total"];} elseif (isset($_POST["total"])) {$total=$_POST["total"];} if (isset($_GET["comment"])) {$comment=$_GET["comment"];} elseif (isset($_POST["comment"])) {$comment=$_POST["comment"];} if (isset($_GET["balance_minutes"])) {$balance_minutes=$_GET["balance_minutes"];} elseif (isset($_POST["balance_minutes"])) {$balance_minutes=$_POST["balance_minutes"];} if (isset($_GET["initial_value"])) {$initial_value=$_GET["initial_value"];} elseif (isset($_POST["initial_value"])) {$initial_value=$_POST["initial_value"];} if (isset($_GET["initial_minutes"])) {$initial_minutes=$_GET["initial_minutes"];} elseif (isset($_POST["initial_minutes"])) {$initial_minutes=$_POST["initial_minutes"];} if (isset($_GET["note_purchase_order"])) {$note_purchase_order=$_GET["note_purchase_order"];} elseif (isset($_POST["note_purchase_order"])) {$note_purchase_order=$_POST["note_purchase_order"];} if (isset($_GET["note_printer"])) {$note_printer=$_GET["note_printer"];} elseif (isset($_POST["note_printer"])) {$note_printer=$_POST["note_printer"];} if (isset($_GET["note_did"])) {$note_did=$_GET["note_did"];} elseif (isset($_POST["note_did"])) {$note_did=$_POST["note_did"];} if (isset($_GET["inbound_group_id"])) {$inbound_group_id=$_GET["inbound_group_id"];} elseif (isset($_POST["inbound_group_id"])) {$inbound_group_id=$_POST["inbound_group_id"];} if (isset($_GET["note_language"])) {$note_language=$_GET["note_language"];} elseif (isset($_POST["note_language"])) {$note_language=$_POST["note_language"];} if (isset($_GET["note_name"])) {$note_name=$_GET["note_name"];} elseif (isset($_POST["note_name"])) {$note_name=$_POST["note_name"];} if (isset($_GET["note_comments"])) {$note_comments=$_GET["note_comments"];} elseif (isset($_POST["note_comments"])) {$note_comments=$_POST["note_comments"];} if (isset($_GET["user"])) {$user=$_GET["user"];} elseif (isset($_POST["user"])) {$user=$_POST["user"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); $report_name = 'CallCard Search'; $SEARCHONLY=0; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $stmt = "SELECT use_non_latin,callcard_enabled,enable_languages,language_method,active_modules,contacts_enabled,allow_emails,outbound_autodial_active,enable_tts_integration,sounds_central_control_active,qc_features_active,enable_auto_reports,campaign_cid_areacodes_enabled,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); #if ($DB) {echo "$stmt\n";} $ss_conf_ct = mysqli_num_rows($rslt); if ($ss_conf_ct > 0) { $row=mysqli_fetch_row($rslt); $non_latin = $row[0]; $callcard_enabled = $row[1]; $SSenable_languages = $row[2]; $SSlanguage_method = $row[3]; $SSactive_modules = $row[4]; $SScontacts_enabled = $row[5]; $SSemail_enabled = $row[6]; $SSoutbound_autodial_active = $row[7]; $SSenable_tts_integration = $row[8]; $SSsounds_central_control_active = $row[9]; $SSqc_features_active = $row[10]; $SSenable_auto_reports = $row[11]; $SScampaign_cid_areacodes_enabled = $row[12]; $SSallow_web_debug = $row[13]; } if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### $DB = preg_replace('/[^0-9]/','',$DB); $action = preg_replace('/[^\_0-9a-zA-Z]/','',$action); $card_id = preg_replace('/[^-\_0-9]/','',$card_id); $run = preg_replace('/[^0-9]/','',$run); $batch = preg_replace('/[^0-9a-zA-Z]/','',$batch); $pack = preg_replace('/[^0-9]/','',$pack); $sequence = preg_replace('/[^0-9]/','',$sequence); $pin = preg_replace('/[^0-9a-zA-Z]/','',$pin); $starting_batch = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$starting_batch); $status = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$status); $total = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$total); $comment = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$comment); $balance_minutes = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$balance_minutes); $initial_value = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$initial_value); $initial_minutes = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$initial_minutes); $note_purchase_order = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_purchase_order); $note_printer = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_printer); $note_did = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_did); $inbound_group_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$inbound_group_id); $note_language = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_language); $note_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_name); $note_comments = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_comments); $SUBMIT = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$SUBMIT); if ($non_latin < 1) { $territory_description = preg_replace('/[^- \_\.\,0-9a-zA-Z]/','',$territory_description); $user = preg_replace('/[^-_0-9a-zA-Z]/', '',$user); $old_territory = preg_replace('/[^-_0-9a-zA-Z]/', '',$old_territory); $old_user = preg_replace('/[^-_0-9a-zA-Z]/', '',$old_user); $accountid = preg_replace('/[^-_0-9a-zA-Z]/', '',$accountid); } else { $territory_description = preg_replace('/[^- \_\.\,0-9\p{L}]/u','',$territory_description); $user = preg_replace('/[^-_0-9\p{L}]/u', '',$user); $old_territory = preg_replace('/[^-_0-9\p{L}]/u', '',$old_territory); $old_user = preg_replace('/[^-_0-9\p{L}]/u', '',$old_user); $accountid = preg_replace('/[^-_0-9\p{L}]/u', '',$accountid); } if (preg_match("/YES/i",$batch)) { $USER='batch'; $PASS='batch'; } else { $PASS=$_SERVER['PHP_AUTH_PW']; $USER=$_SERVER['PHP_AUTH_USER']; $user=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; } if ($non_latin < 1) { $PASS = preg_replace('/[^-_0-9a-zA-Z]/', '', $PASS); $USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $USER); $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); } else { $PASS = preg_replace('/[^-_0-9\p{L}]/u', '', $PASS); $USER = preg_replace('/[^-_0-9\p{L}]/u', '', $USER); $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); } $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } if ($callcard_enabled < 1) { echo _QXZ("ERROR: CallCard is not active on this system")."\n"; exit; } $auth=0; $reports_auth=0; $admin_auth=0; $auth_message = user_authorization($USER,$PASS,'',1,0); if ($auth_message == 'GOOD') {$auth=1;} if ($auth > 0) { $stmt="SELECT count(*) from vicidial_users where user='$user' and user_level > 7 and view_reports='1';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $admin_auth=$row[0]; $stmt="SELECT count(*) from vicidial_users where user='$user' and user_level > 6 and view_reports='1';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $reports_auth=$row[0]; if ($reports_auth < 1) { $VDdisplayMESSAGE = _QXZ("You are not allowed to view reports"); Header ("Content-type: text/html; charset=utf-8"); echo "$VDdisplayMESSAGE: |$USER|$auth_message|\n"; exit; } if ( ($reports_auth > 0) and ($admin_auth < 1) ) { $ADD=999999; $reports_only_user=1; } } else { $VDdisplayMESSAGE = _QXZ("Login incorrect, please try again"); if ($auth_message == 'LOCK') { $VDdisplayMESSAGE = _QXZ("Too many login attempts, try again in 15 minutes"); Header ("Content-type: text/html; charset=utf-8"); echo "$VDdisplayMESSAGE: |$USER|$auth_message|\n"; exit; } if ($auth_message == 'IPBLOCK') { $VDdisplayMESSAGE = _QXZ("Your IP Address is not allowed") . ": $ip"; Header ("Content-type: text/html; charset=utf-8"); echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; exit; } Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "$VDdisplayMESSAGE: |$USER|$PASS|$auth_message|\n"; exit; } $stmt="SELECT callcard_admin,user_group,full_name,qc_enabled from vicidial_users where user='$user';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $LOGcallcard_admin = $row[0]; $LOGuser_group = $row[1]; $LOGfullname = $row[2]; $qc_auth = $row[3]; if($reports_only_user > 0) { $stmt="SELECT allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $LOGallowed_reports = $row[0]; if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo _QXZ("You are not allowed to view this report").": |$USER|$report_name|\n"; exit; } else { $SEARCHONLY=1; } } else { if ($LOGcallcard_admin < 1) { Header ("Content-type: text/html; charset=utf-8"); echo _QXZ("You do not have permissions for call card administration").": |$USER|\n"; exit; } } if ($SEARCHONLY > 0) { if ( ($action != 'SEARCH') and ($action != 'SEARCH_RESULTS') and ($action != 'CALLCARD_DETAIL') ) {$action = 'SEARCH';} } if (strlen($action) < 1) {$action = 'CALLCARD_SUMMARY';} require("screen_colors.php"); header ("Content-type: text/html; charset=utf-8"); header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 header ("Pragma: no-cache"); // HTTP/1.0 ?>