LICENSE: AGPLv2 # # make sure you have added a user to the vicidial_users MySQL table with at least # user_level 1 or greater to access this page. Also you need to have the login # and pass of a phone listed in the asterisk.phones table. The page grabs the # server info and other details from this login and pass # # Other scripts that this application depends on: # - active_list_refresh.php: displays active/live channels and phones # - manager_send.php: sends Actions to be executed on Asterisk servers # - live_exten_check.php: checks to see if user's phone is on a live call # - call_log_display.php: retrieves log of inbound and outbound calls # - voicemail_check.php: retrieves counts of new and old messages # - inbound_popup.php: opens upon live_inbound call coming in # - conf_exten_check.php: checks to see if and calls are in a specific conf # - park_calls_display.php: retrieves list of parked calls # - vdc_db_query.php: Changes values in the DB for non-calling records # # CHANGES # 50215-1356 - Proof-of-concept test of XMLHttpRequest for astGUIclient web # 50323-1411 - First build version display-only # 50331-1040 - Second-build, added phone login and hangup/hijack display # 50401-1006 - Trunk/Local Hangup functions enabled # 50404-1056 - Trunk/Local Hijack functions enabled # 50404-1459 - Simple live calls display and grabs updated time from server # 50405-1221 - Reorganized the display and layers, added some images # 50406-1005 - Added In/Out call log display to MAIN panel # 50407-1254 - Start/Stop Recording on live calls enabled # 50422-1101 - Activated Check Voicemail button and new/old messages count # 50428-1449 - Added dial from log and basic live_inbound call popup # 50429-1455 - Modified inbound popup code for IE and to add more functions # 50502-1442 - Added basic method to transfer live calls somewhere else # 50503-1205 - Added web_client_sessions entry for more security of subscripts # 50503-1537 - Added basic conferences display # 50509-1132 - Added conference connected list and hangup/xfer for them # 50511-1129 - Added registration of conference rooms and added manual dial # 50523-1342 - Added Conference recording and send DTMF # 50523-1622 - Added Local Dial window frame for calling local extensions # 50524-1456 - Added ability to park call and display number of parked calls # 50524-1600 - Added ability to display and pickup/hangup/xfer parked calls # 50525-1224 - Added ability to place outbound call from within conferene # 50531-1225 - Added ability to do dual transfers to meetme rooms from Main # 50711-1229 - removed HTTP authentication in favor of user/pass vars # 50711-1610 - Added Zap monitoring to Trunk/Local Action screens # 50804-1604 - Minor bug fix in inbound_popup functions # 50818-1715 - Added pretty login section # 50913-1137 - Added custom outbound_cid from phones table # 51110-1430 - Fixed non-standard http port issue # 60103-1421 - Added code for favorite extensions chooser # 60104-1347 - Added basic layout for favorites editing frame # 60105-1124 - Finished Favorites frame and added DB submission # 60112-1622 - Several formatting changes # 60421-1357 - check GET/POST vars lines with isset to not trigger PHP NOTICES # 60619-1103 - Added variable filters to close security holes for login form # 60829-1528 - Made compatible with WeBRooTWritablE setting in dbconnect.php # 90508-0727 - Changed to PHP long tags # 91129-2211 - Replaced SELECT STAR in SQL query # 120223-2124 - Removed logging of good login passwords if webroot writable is enabled # 130328-0017 - Converted ereg to preg functions # 130603-2220 - Added login lockout for 15 minutes after 10 failed logins, and other security fixes # 130802-1002 - Changed to PHP mysqli functions # 140811-0848 - Changed to use QXZ function for echoing text # 141118-1230 - Formatting changes for QXZ output # 141125-0947 - Using pass hashes in AJAX # 141216-2115 - Added language settings lookups and user/pass variable standardization # 150218-1110 - Fixes for QXZ enclosed in single-quotes # 150727-0915 - Added default_language # 190111-0902 - Fix for PHP7 # 200319-1532 - Small fixes for conference tab issues # 210615-1037 - Default security fixes, CVE-2021-28854 # 210616-2053 - Added optional CORS support, see options.php for details # 220220-0938 - Added allow_web_debug system setting # 230418-1009 - Added astguiclient_disabled options.php setting, disabled by default # $version = '2.2.6-7'; $build = '230418-1009'; $php_script = 'astguiclient.php'; $astguiclient_disabled = '1'; require_once("dbconnect_mysqli.php"); require_once("functions.php"); ### If you have globals turned off uncomment these lines if (isset($_GET["user"])) {$user=$_GET["user"];} elseif (isset($_POST["user"])) {$user=$_POST["user"];} if (isset($_GET["pass"])) {$pass=$_GET["pass"];} elseif (isset($_POST["pass"])) {$pass=$_POST["pass"];} if (isset($_GET["phone_login"])) {$phone_login=$_GET["phone_login"];} elseif (isset($_POST["phone_login"])) {$phone_login=$_POST["phone_login"];} if (isset($_GET["phone_pass"])) {$phone_pass=$_GET["phone_pass"];} elseif (isset($_POST["phone_pass"])) {$phone_pass=$_POST["phone_pass"];} if (isset($_GET["relogin"])) {$relogin=$_GET["relogin"];} elseif (isset($_POST["relogin"])) {$relogin=$_POST["relogin"];} if (!isset($phone_login)) { if (isset($_GET["pl"])) {$phone_login=$_GET["pl"];} elseif (isset($_POST["pl"])) {$phone_login=$_POST["pl"];} } if (!isset($phone_pass)) { if (isset($_GET["pp"])) {$phone_pass=$_GET["pp"];} elseif (isset($_POST["pp"])) {$phone_pass=$_POST["pp"];} } $forever_stop=0; $user_abb = "$user$user$user$user"; while ( (strlen($user_abb) > 4) and ($forever_stop < 200) ) {$user_abb = preg_replace("/^./","",$user_abb); $forever_stop++;} ### security strip all non-alphanumeric characters out of the variables ### $DB=preg_replace("/[^0-9a-z]/","",$DB); $phone_login=preg_replace("/[^-_0-9a-zA-Z]/","",$phone_login); $phone_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$phone_pass); $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); $relogin=preg_replace("/[^-_0-9a-zA-Z]/","",$relogin); # if options file exists, use the override values for the above variables # see the options-example.php file for more information if (file_exists('options.php')) { require('options.php'); } if ($astguiclient_disabled > 0) { echo "astguiclient is disabled on this system\n"; exit; } ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### $stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} #if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { $row=mysqli_fetch_row($rslt); $non_latin = $row[0]; $SSenable_languages = $row[1]; $SSlanguage_method = $row[2]; $SSdefault_language = $row[3]; $SSallow_web_debug = $row[4]; } if ($SSallow_web_debug < 1) {$DB=0;} $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} $sl_ct = mysqli_num_rows($rslt); if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } if (strlen($VUselected_language) < 1) {$VUselected_language = $SSdefault_language;} ##### END SETTINGS LOOKUP ##### ########################################### if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); $pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass); } else { $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); $pass = preg_replace('/[^-_0-9\p{L}]/u','',$pass); } if ($force_logout) { if( (strlen($_SERVER['user'])>0) or (strlen($_SERVER['pass'])>0) ) { Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); Header("HTTP/1.0 401 Unauthorized"); } echo _QXZ("You have now logged out. Thank you")."\n"; exit; } $StarTtime = date("U"); $NOW_TIME = date("Y-m-d H:i:s"); $FILE_TIME = date("Ymd-His"); $month_old = mktime(0, 0, 0, date("m"), date("d")-7, date("Y")); $past_month_date = date("Y-m-d H:i:s",$month_old); $auth=0; $auth_message = user_authorization($user,$pass,'',1,0,1,0,'astguiclient'); if (preg_match("/^GOOD/",$auth_message)) { $auth=1; $pass_hash = preg_replace("/GOOD\|/",'',$auth_message); } $US='_'; $CL=':'; if ($WeBRooTWritablE > 0) {$fp = fopen ("./astguiclient_auth_entries.txt", "w");} $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); $script_name = getenv("SCRIPT_NAME"); $server_name = getenv("SERVER_NAME"); $server_port = getenv("SERVER_PORT"); if (preg_match("/443/i",$server_port)) {$HTTPprotocol = 'https://';} else {$HTTPprotocol = 'http://';} if (($server_port == '80') or ($server_port == '443') ) {$server_port='';} else {$server_port = "$CL$server_port";} $agcPAGE = "$HTTPprotocol$server_name$server_port$script_name"; $agcDIR = $agcPAGE; $agcDIR = preg_replace('/astguiclient\.php/i','',$agcDIR); if( (strlen($user)<2) or (strlen($pass)<2) or (!$auth) or ($relogin == 'YES') ) { header ("Content-type: text/html; charset=utf-8"); echo ""._QXZ("astGUIclient web client: Login")."\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "
\n"; echo "
\n"; echo "\n"; echo "


"; echo ""; echo ""; echo "\n"; echo "\n"; echo ""; echo "\n"; echo ""; echo "\n"; echo ""; echo "\n"; echo ""; echo "\n"; echo "\n"; echo "\n"; echo "
"._QXZ("Login")."
 
"._QXZ("User Login").":
"._QXZ("User Password:")."
"._QXZ("Phone Login:")."
"._QXZ("Phone Password:")."

"._QXZ("VERSION:")." $version       "._QXZ("BUILD:")." $build
\n"; echo "\n\n"; echo "\n\n"; echo "\n\n"; exit; } else { if($auth>0) { $stmt="SELECT full_name,user_level from vicidial_users where user='$user' and active='Y';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $LOGfullname=$row[0]; if ($WeBRooTWritablE > 0) { fwrite ($fp, "VICIDIAL|GOOD|$date|\n"); fclose($fp); } } else { if ($WeBRooTWritablE > 0) { fwrite ($fp, "VICIDIAL|FAIL|$date|\n"); fclose($fp); } } } header ("Content-type: text/html; charset=utf-8"); header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 header ("Pragma: no-cache"); // HTTP/1.0 echo "\n"; echo "\n"; echo "\n"; if ( (strlen($phone_login)<2) or (strlen($phone_pass)<2) ) { echo ""._QXZ("astGUIclient web client: Phone Login")."\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "
\n"; echo "
\n"; echo "\n"; echo "\n"; echo "\n"; echo "


"; echo ""; echo ""; echo "\n"; echo "\n"; echo ""; echo "\n"; echo ""; echo "\n"; echo "\n"; echo "\n"; echo "
"._QXZ("Phone Login")."
 
"._QXZ("Phone Login:")."
"._QXZ("Phone Password:")."

"._QXZ("VERSION:")." $version       "._QXZ("BUILD:")." $build
\n"; echo "\n\n"; echo "\n\n"; echo "\n\n"; exit; } else { $authphone=0; $stmt="SELECT count(*) from phones where login='$phone_login' and pass='$phone_pass' and active = 'Y';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $authphone=$row[0]; if (!$authphone) { echo ""._QXZ("astGUIclient web client: Phone Login")."\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "
\n"; echo "
\n"; echo "\n"; echo "\n"; echo "\n"; echo "


"; echo ""; echo ""; echo "\n"; echo "\n"; echo ""; echo "\n"; echo ""; echo "\n"; echo "\n"; echo "\n"; echo "
"._QXZ("Phone Login")."
 
"._QXZ("Sorry, your phone login and password are not active in this system, please try again:")."
 
"._QXZ("Phone Login:")."
"._QXZ("Phone Password:")."

"._QXZ("VERSION: %1s BUILD: %2s",0,'',$version,$build)."
\n"; echo "\n\n"; echo "\n\n"; echo "\n\n"; exit; } else { echo ""._QXZ("astGUIclient web client")."\n"; $stmt="SELECT extension,dialplan_number,voicemail_id,phone_ip,computer_ip,server_ip,login,pass,status,active,phone_type,fullname,company,picture,messages,old_messages,protocol,local_gmt,ASTmgrUSERNAME,ASTmgrSECRET,login_user,login_pass,login_campaign,park_on_extension,conf_on_extension,VICIDIAL_park_on_extension,VICIDIAL_park_on_filename,monitor_prefix,recording_exten,voicemail_exten,voicemail_dump_exten,ext_context,dtmf_send_extension,call_out_number_group,client_browser,install_directory,local_web_callerID_URL,VICIDIAL_web_URL,AGI_call_logging_enabled,user_switching_enabled,conferencing_enabled,admin_hangup_enabled,admin_hijack_enabled,admin_monitor_enabled,call_parking_enabled,updater_check_enabled,AFLogging_enabled,QUEUE_ACTION_enabled,CallerID_popup_enabled,voicemail_button_enabled,enable_fast_refresh,fast_refresh_rate,enable_persistant_mysql,auto_dial_next_number,VDstop_rec_after_each_call,DBX_server,DBX_database,DBX_user,DBX_pass,DBX_port,DBY_server,DBY_database,DBY_user,DBY_pass,DBY_port,outbound_cid,enable_sipsak_messages,email,template_id,conf_override,phone_context,phone_ring_timeout,conf_secret from phones where login='$phone_login' and pass='$phone_pass' and active = 'Y';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $extension=$row[0]; $dialplan_number=$row[1]; $voicemail_id=$row[2]; $phone_ip=$row[3]; $computer_ip=$row[4]; $server_ip=$row[5]; $phone_login=$row[6]; $phone_pass=$row[7]; $status=$row[8]; $active=$row[9]; $phone_type=$row[10]; $fullname=$row[11]; $company=$row[12]; $picture=$row[13]; $messages=$row[14]; $old_messages=$row[15]; $protocol=$row[16]; $local_gmt=$row[17]; $ASTmgrUSERNAME=$row[18]; $ASTmgrSECRET=$row[19]; $login_user=$row[20]; $login_pass=$row[21]; $login_campaign=$row[22]; $park_on_extension=$row[23]; $conf_on_extension=$row[24]; $VICIDiaL_park_on_extension=$row[25]; $VICIDiaL_park_on_filename=$row[26]; $monitor_prefix=$row[27]; $recording_exten=$row[28]; $voicemail_exten=$row[29]; $voicemail_dump_exten=$row[30]; $ext_context=$row[31]; $dtmf_send_extension=$row[32]; $call_out_number_group=$row[33]; $client_browser=$row[34]; $install_directory=$row[35]; $local_web_callerID_URL=$row[36]; $VICIDiaL_web_URL=$row[37]; $AGI_call_logging_enabled=$row[38]; $user_switching_enabled=$row[39]; $conferencing_enabled=$row[40]; $admin_hangup_enabled=$row[41]; $admin_hijack_enabled=$row[42]; $admin_monitor_enabled=$row[43]; $call_parking_enabled=$row[44]; $updater_check_enabled=$row[45]; $AFLogging_enabled=$row[46]; $QUEUE_ACTION_enabled=$row[47]; $CaLLerID_popup_enabled=$row[48]; $voicemail_button_enabled=$row[49]; $enable_fast_refresh=$row[50]; $fast_refresh_rate=$row[51]; $enable_persistant_mysql=$row[52]; $auto_dial_next_number=$row[53]; $VDstop_rec_after_each_call=$row[54]; $DBX_server=$row[55]; $DBX_database=$row[56]; $DBX_user=$row[57]; $DBX_pass=$row[58]; $DBX_port=$row[59]; $outbound_cid=$row[65]; $local_web_callerID_URL_enc = rawurlencode($local_web_callerID_URL); $session_ext = preg_replace("/[^a-z0-9]/i", "", $extension); if (strlen($session_ext) > 10) {$session_ext = substr($session_ext, 0, 10);} $session_rand = (rand(1,9999999) + 10000000); $session_name = "$StarTtime$US$session_ext$session_rand"; $stmt="DELETE from web_client_sessions where start_time < '$past_month_date' and extension='$extension' and server_ip = '$server_ip' and program = 'agc';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $stmt="INSERT INTO web_client_sessions values('$extension','$server_ip','agc','$NOW_TIME','$session_name');"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $stmt="SELECT count(*) from phone_favorites where extension='$extension' and server_ip = '$server_ip';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $favorites_present=$row[0]; if ($favorites_present > 0) { $stmt="SELECT extensions_list from phone_favorites where extension='$extension' and server_ip = '$server_ip';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $favorites_list=$row[0]; $h=0; $favorites_listX = preg_replace("/\'/i",'',$favorites_list); $favorites = explode(',',$favorites_listX); $favorites_count = count($favorites); $favorites_listX=''; $o=0; while ($favorites_count > $o) { $stmt="SELECT fullname,protocol from phones where extension = '$favorites[$o]' and server_ip='$server_ip';"; $rslt=mysql_to_mysqli($stmt, $link); $rowx=mysqli_fetch_row($rslt); $favorites_names[$o] = $rowx[0]; $favorites_listX .= "$rowx[1]/$favorites[$o],"; $o++; } echo "\n"; echo "\n"; } else { echo "\n"; } ### gather phone extensions and fullnames for favorites editor ### $stmt="SELECT extension,fullname from phones where server_ip = '$server_ip';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $exten_ct = mysqli_num_rows($rslt); $favlistCT=0; $nofavlistCT=0; while ($favlistCT < $exten_ct) { $row=mysqli_fetch_row($rslt); $favlist[$favlistCT]= "$row[0] - $row[1]"; $favlistCT++; } } } ?> \n"; ?>
"._QXZ("LOGOUT")."
\n"; ?>
" ALT="Main Panel" WIDTH=83 HEIGHT=30 BORDER=0> " ALT="Active Lines Panel" WIDTH=139 HEIGHT=30 BORDER=0> " ALT="Conferences Panel" WIDTH=139 HEIGHT=30 BORDER=0> " NAME=voicemail ALT="Check Voicemail" WIDTH=170 HEIGHT=30 BORDER=0> " NAME=livecall ALT="Live Call" WIDTH=109 HEIGHT=30 BORDER=0>




  |     |     |     |  



  |     |     |     |  








:
























 
                         
: 0                
$h) { if (strlen($favorites[$h])>1) { echo "\n"; } $h++; } ?>
     
$favorites[$h] - $favorites_names[$h]
 

 
|     1000 ms |


| |

| |

| |