LICENSE: AGPLv2 # # Changes # 50307-1721 - First version # 51123-1502 - removed requirement of PHP Globals=on # 60421-1229 - check GET/POST vars lines with isset to not trigger PHP NOTICES # 60619-1603 - Added variable filtering to eliminate SQL injection attack threat # 90508-0644 - Changed to PHP long tags # 91129-2249 - Replaced SELECT STAR in SQL queries, formatting fixes # 120223-2135 - Removed logging of good login passwords if webroot writable is enabled # 130610-1105 - Finalized changing of all ereg instances to preg # 130616-0005 - Added filtering of input to prevent SQL injection attacks and new user auth # 130901-0833 - Changed to mysqli PHP functions # 140328-0005 - Converted division calculations to use MathZDC function # 141007-2123 - Finalized adding QXZ translation to all admin files # 141229-1847 - Added code for on-the-fly language translations display # 170217-1213 - Fixed non-latin auth issue #995 # 210618-1001 - Added CORS support # 220224-0820 - Added allow_web_debug system setting # 221006-1454 - Added missing input variable, issue #1383 # 240801-1130 - Code updates for PHP8 compatibility # $version = '2.14-16'; $build = '221006-1454'; $php_script='vdremote.php'; $popup_page = './closer_popup.php'; $STARTtime = date("U"); $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); require("dbconnect_mysqli.php"); require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); if (isset($_GET["ADD"])) {$ADD=$_GET["ADD"];} elseif (isset($_POST["ADD"])) {$ADD=$_POST["ADD"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["user"])) {$user=$_GET["user"];} elseif (isset($_POST["user"])) {$user=$_POST["user"];} if (isset($_GET["force_logout"])) {$force_logout=$_GET["force_logout"];} elseif (isset($_POST["force_logout"])) {$force_logout=$_POST["force_logout"];} if (isset($_GET["groups"])) {$groups=$_GET["groups"];} elseif (isset($_POST["groups"])) {$groups=$_POST["groups"];} if (isset($_GET["remote_agent_id"])) {$remote_agent_id=$_GET["remote_agent_id"];} elseif (isset($_POST["remote_agent_id"])) {$remote_agent_id=$_POST["remote_agent_id"];} if (isset($_GET["user_start"])) {$user_start=$_GET["user_start"];} elseif (isset($_POST["user_start"])) {$user_start=$_POST["user_start"];} if (isset($_GET["number_of_lines"])) {$number_of_lines=$_GET["number_of_lines"];} elseif (isset($_POST["number_of_lines"])) {$number_of_lines=$_POST["number_of_lines"];} if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];} elseif (isset($_POST["server_ip"])) {$server_ip=$_POST["server_ip"];} if (isset($_GET["conf_exten"])) {$conf_exten=$_GET["conf_exten"];} elseif (isset($_POST["conf_exten"])) {$conf_exten=$_POST["conf_exten"];} if (isset($_GET["status"])) {$status=$_GET["status"];} elseif (isset($_POST["status"])) {$status=$_POST["status"];} if (isset($_GET["campaign_id"])) {$campaign_id=$_GET["campaign_id"];} elseif (isset($_POST["campaign_id"])) {$campaign_id=$_POST["campaign_id"];} if (isset($_GET["groups"])) {$groups=$_GET["groups"];} elseif (isset($_POST["groups"])) {$groups=$_POST["groups"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} if (isset($_GET["query_date"])) {$query_date=$_GET["query_date"];} elseif (isset($_POST["query_date"])) {$query_date=$_POST["query_date"];} if (!isset($query_date)) {$query_date = $NOW_DATE;} if (!isset($force_logout)) {$force_logout = 0;} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); if (file_exists('options.php')) {require('options.php');} if ($force_logout) { if( (strlen($PHP_AUTH_USER)>0) or (strlen($PHP_AUTH_PW)>0) ) { Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); } echo _QXZ("You have now logged out. Thank you")."\n"; exit; } ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); #if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { $row=mysqli_fetch_row($rslt); $non_latin = $row[0]; $outbound_autodial_active = $row[1]; $slave_db_server = $row[2]; $reports_use_slave_db = $row[3]; $custom_fields_enabled = $row[4]; $SSenable_languages = $row[5]; $SSlanguage_method = $row[6]; $SSallow_web_debug = $row[7]; } if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### $remote_agent_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $remote_agent_id); $query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date); $ADD = preg_replace('/[^-_0-9a-zA-Z]/', '', $ADD); $force_logout = preg_replace('/[^-_0-9a-zA-Z]/', '', $force_logout); $user_start = preg_replace('/[^-_0-9a-zA-Z]/', '', $user_start); $number_of_lines = preg_replace('/[^-_0-9a-zA-Z]/', '', $number_of_lines); $status = preg_replace('/[^-_0-9a-zA-Z]/', '', $status); $conf_exten = preg_replace('/[^-_0-9a-zA-Z]/', '', $conf_exten); $server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip); $submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); $SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); # Variables filtered further down in the code # $groups if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); $campaign_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $campaign_id); } else { $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); $campaign_id = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign_id); } $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } $auth=0; $auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REMOTE',1,0); if ($auth_message == 'GOOD') {$auth=1;} if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) { Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo _QXZ("Invalid Username/Password").": |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; exit; } else { header ("Content-type: text/html; charset=utf-8"); if($auth>0) { $stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $LOGfullname=$row[0]; $stmt="SELECT count(*) from vicidial_remote_agents where user_start='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $authx=$row[0]; if($authx>0) { $stmt="SELECT remote_agent_id,server_ip,number_of_lines from vicidial_remote_agents where user_start='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $remote_agent_id=$row[0]; $server_ip=$row[1]; if (!$number_of_lines) {$number_of_lines=$row[2];} } else { echo _QXZ("This remote agent does not exist").": |$PHP_AUTH_USER|\n"; exit; } } } require("screen_colors.php"); echo "\n"; echo "
\n"; echo "\n"; if ($ADD==61111) { echo"\n"; } echo "\n"; ?> REMOTE AGENTS: $LOGfullname - $PHP_AUTH_USER "; if (!$ADD) {$ADD="31111";} if ($ADD==31111) {echo "Modify Remote Agents";} if ($ADD==41111) {echo "Modify Remote Agents";} if ($ADD==61111) {echo "Remote Agent Status";} if ($ADD==71111) {echo "Remote Agent Closer Stats";} if (strlen($ADD)>4) { ##### get server listing for dynamic pulldown $stmt="SELECT server_ip,server_description from servers order by server_ip;"; $rslt=mysql_to_mysqli($stmt, $link); $servers_to_print = mysqli_num_rows($rslt); $servers_list=''; $o=0; while ($servers_to_print > $o) { $rowx=mysqli_fetch_row($rslt); $servers_list .= "\n"; $o++; } ##### get campaigns listing for dynamic pulldown $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns order by campaign_id;"; $rslt=mysql_to_mysqli($stmt, $link); $campaigns_to_print = mysqli_num_rows($rslt); $campaigns_list=''; $o=0; while ($campaigns_to_print > $o) { $rowx=mysqli_fetch_row($rslt); $campaigns_list .= "\n"; $o++; } ##### get inbound groups listing for checkboxes if ( (($ADD==31111) or ($ADD==31111)) and (!is_array($groups)) ) { $stmt="SELECT closer_campaigns from vicidial_remote_agents where remote_agent_id='" . mysqli_real_escape_string($link, $remote_agent_id) . "';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $closer_campaigns = $row[0]; $closer_campaigns = preg_replace("/ -$/","",$closer_campaigns); $groups = explode(" ", $closer_campaigns); } $stmt="SELECT group_id,group_name from vicidial_inbound_groups order by group_id;"; $rslt=mysql_to_mysqli($stmt, $link); $groups_to_print = mysqli_num_rows($rslt); $groups_list=''; $groups_value=''; $o=0; while ($groups_to_print > $o) { $rowx=mysqli_fetch_row($rslt); $group_id_value = $rowx[0]; $group_name_value = $rowx[1]; $groups_list .= "2) {$groups_value .= " -";} } ?>| : | |
| | "> | "> | |
|
";
$stmt="SELECT remote_agent_id,user_start,number_of_lines,server_ip,conf_exten,status,campaign_id,closer_campaigns from vicidial_remote_agents where remote_agent_id='" . mysqli_real_escape_string($link, $remote_agent_id) . "';";
$rslt=mysql_to_mysqli($stmt, $link);
$row=mysqli_fetch_row($rslt);
$remote_agent_id = $row[0];
$user_start = $row[1];
$number_of_lines = $row[2];
$server_ip = $row[3];
$conf_exten = $row[4];
$status = $row[5];
$campaign_id = $row[6];
echo " "._QXZ("MODIFY A REMOTE AGENTS ENTRY").": $row[0] | |