LICENSE: AGPLv2 # # make sure you have added a user to the vicidial_users MySQL table with at least # user_level 1 or greater to access this page. Also you need to have the login # and pass of a phone listed in the asterisk.phones table. The page grabs the # server info and other details from this login and pass # # Other scripts that this application depends on: # - active_list_refresh.php: displays active/live channels and phones # - manager_send.php: sends Actions to be executed on Asterisk servers # - live_exten_check.php: checks to see if user's phone is on a live call # - call_log_display.php: retrieves log of inbound and outbound calls # - voicemail_check.php: retrieves counts of new and old messages # - inbound_popup.php: opens upon live_inbound call coming in # - conf_exten_check.php: checks to see if and calls are in a specific conf # - park_calls_display.php: retrieves list of parked calls # - vdc_db_query.php: Changes values in the DB for non-calling records # # CHANGES # 50215-1356 - Proof-of-concept test of XMLHttpRequest for astGUIclient web # 50323-1411 - First build version display-only # 50331-1040 - Second-build, added phone login and hangup/hijack display # 50401-1006 - Trunk/Local Hangup functions enabled # 50404-1056 - Trunk/Local Hijack functions enabled # 50404-1459 - Simple live calls display and grabs updated time from server # 50405-1221 - Reorganized the display and layers, added some images # 50406-1005 - Added In/Out call log display to MAIN panel # 50407-1254 - Start/Stop Recording on live calls enabled # 50422-1101 - Activated Check Voicemail button and new/old messages count # 50428-1449 - Added dial from log and basic live_inbound call popup # 50429-1455 - Modified inbound popup code for IE and to add more functions # 50502-1442 - Added basic method to transfer live calls somewhere else # 50503-1205 - Added web_client_sessions entry for more security of subscripts # 50503-1537 - Added basic conferences display # 50509-1132 - Added conference connected list and hangup/xfer for them # 50511-1129 - Added registration of conference rooms and added manual dial # 50523-1342 - Added Conference recording and send DTMF # 50523-1622 - Added Local Dial window frame for calling local extensions # 50524-1456 - Added ability to park call and display number of parked calls # 50524-1600 - Added ability to display and pickup/hangup/xfer parked calls # 50525-1224 - Added ability to place outbound call from within conferene # 50531-1225 - Added ability to do dual transfers to meetme rooms from Main # 50711-1229 - removed HTTP authentication in favor of user/pass vars # 50711-1610 - Added Zap monitoring to Trunk/Local Action screens # 50804-1604 - Minor bug fix in inbound_popup functions # 50818-1715 - Added pretty login section # 50913-1137 - Added custom outbound_cid from phones table # 51110-1430 - Fixed non-standard http port issue # 60103-1421 - Added code for favorite extensions chooser # 60104-1347 - Added basic layout for favorites editing frame # 60105-1124 - Finished Favorites frame and added DB submission # 60112-1622 - Several formatting changes # 60421-1357 - check GET/POST vars lines with isset to not trigger PHP NOTICES # 60619-1103 - Added variable filters to close security holes for login form # 60829-1528 - Made compatible with WeBRooTWritablE setting in dbconnect.php # 90508-0727 - Changed to PHP long tags # 91129-2211 - Replaced SELECT STAR in SQL query # 120223-2124 - Removed logging of good login passwords if webroot writable is enabled # 130328-0017 - Converted ereg to preg functions # 130603-2220 - Added login lockout for 15 minutes after 10 failed logins, and other security fixes # 130802-1002 - Changed to PHP mysqli functions # 140811-0848 - Changed to use QXZ function for echoing text # 141118-1230 - Formatting changes for QXZ output # 141125-0947 - Using pass hashes in AJAX # 141216-2115 - Added language settings lookups and user/pass variable standardization # 150218-1110 - Fixes for QXZ enclosed in single-quotes # 150727-0915 - Added default_language # 190111-0902 - Fix for PHP7 # 200319-1532 - Small fixes for conference tab issues # 210615-1037 - Default security fixes, CVE-2021-28854 # 210616-2053 - Added optional CORS support, see options.php for details # 220220-0938 - Added allow_web_debug system setting # 230418-1009 - Added astguiclient_disabled options.php setting, disabled by default # $version = '2.2.6-7'; $build = '230418-1009'; $php_script = 'astguiclient.php'; $astguiclient_disabled = '1'; require_once("dbconnect_mysqli.php"); require_once("functions.php"); ### If you have globals turned off uncomment these lines if (isset($_GET["user"])) {$user=$_GET["user"];} elseif (isset($_POST["user"])) {$user=$_POST["user"];} if (isset($_GET["pass"])) {$pass=$_GET["pass"];} elseif (isset($_POST["pass"])) {$pass=$_POST["pass"];} if (isset($_GET["phone_login"])) {$phone_login=$_GET["phone_login"];} elseif (isset($_POST["phone_login"])) {$phone_login=$_POST["phone_login"];} if (isset($_GET["phone_pass"])) {$phone_pass=$_GET["phone_pass"];} elseif (isset($_POST["phone_pass"])) {$phone_pass=$_POST["phone_pass"];} if (isset($_GET["relogin"])) {$relogin=$_GET["relogin"];} elseif (isset($_POST["relogin"])) {$relogin=$_POST["relogin"];} if (!isset($phone_login)) { if (isset($_GET["pl"])) {$phone_login=$_GET["pl"];} elseif (isset($_POST["pl"])) {$phone_login=$_POST["pl"];} } if (!isset($phone_pass)) { if (isset($_GET["pp"])) {$phone_pass=$_GET["pp"];} elseif (isset($_POST["pp"])) {$phone_pass=$_POST["pp"];} } $forever_stop=0; $user_abb = "$user$user$user$user"; while ( (strlen($user_abb) > 4) and ($forever_stop < 200) ) {$user_abb = preg_replace("/^./","",$user_abb); $forever_stop++;} ### security strip all non-alphanumeric characters out of the variables ### $DB=preg_replace("/[^0-9a-z]/","",$DB); $phone_login=preg_replace("/[^-_0-9a-zA-Z]/","",$phone_login); $phone_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$phone_pass); $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); $relogin=preg_replace("/[^-_0-9a-zA-Z]/","",$relogin); # if options file exists, use the override values for the above variables # see the options-example.php file for more information if (file_exists('options.php')) { require('options.php'); } if ($astguiclient_disabled > 0) { echo "astguiclient is disabled on this system\n"; exit; } ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### $stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} #if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { $row=mysqli_fetch_row($rslt); $non_latin = $row[0]; $SSenable_languages = $row[1]; $SSlanguage_method = $row[2]; $SSdefault_language = $row[3]; $SSallow_web_debug = $row[4]; } if ($SSallow_web_debug < 1) {$DB=0;} $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} $sl_ct = mysqli_num_rows($rslt); if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } if (strlen($VUselected_language) < 1) {$VUselected_language = $SSdefault_language;} ##### END SETTINGS LOOKUP ##### ########################################### if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); $pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass); } else { $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); $pass = preg_replace('/[^-_0-9\p{L}]/u','',$pass); } if ($force_logout) { if( (strlen($_SERVER['user'])>0) or (strlen($_SERVER['pass'])>0) ) { Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); Header("HTTP/1.0 401 Unauthorized"); } echo _QXZ("You have now logged out. Thank you")."\n"; exit; } $StarTtime = date("U"); $NOW_TIME = date("Y-m-d H:i:s"); $FILE_TIME = date("Ymd-His"); $month_old = mktime(0, 0, 0, date("m"), date("d")-7, date("Y")); $past_month_date = date("Y-m-d H:i:s",$month_old); $auth=0; $auth_message = user_authorization($user,$pass,'',1,0,1,0,'astguiclient'); if (preg_match("/^GOOD/",$auth_message)) { $auth=1; $pass_hash = preg_replace("/GOOD\|/",'',$auth_message); } $US='_'; $CL=':'; if ($WeBRooTWritablE > 0) {$fp = fopen ("./astguiclient_auth_entries.txt", "w");} $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); $script_name = getenv("SCRIPT_NAME"); $server_name = getenv("SERVER_NAME"); $server_port = getenv("SERVER_PORT"); if (preg_match("/443/i",$server_port)) {$HTTPprotocol = 'https://';} else {$HTTPprotocol = 'http://';} if (($server_port == '80') or ($server_port == '443') ) {$server_port='';} else {$server_port = "$CL$server_port";} $agcPAGE = "$HTTPprotocol$server_name$server_port$script_name"; $agcDIR = $agcPAGE; $agcDIR = preg_replace('/astguiclient\.php/i','',$agcDIR); if( (strlen($user)<2) or (strlen($pass)<2) or (!$auth) or ($relogin == 'YES') ) { header ("Content-type: text/html; charset=utf-8"); echo "
| \n"; echo "\n"; echo " |