ViciDial/agc_1-X
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

release 1.1.12

Browse Source 
git-svn-id: svn://192.168.202.10@10 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2006-07-07 15:30:10 +00:00
parent ca8e640156
commit 065b96d043
91 changed files with 4346 additions and 542 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VICIDIAL_web/AST_CLOSERstats.php
+33 -11
View File
@@ -3,6 +3,11 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60619-1714 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
@@ -18,6 +23,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
@@ -63,7 +85,7 @@ echo "<SELECT SIZE=1 NAME=group>\n";
}
echo "</SELECT>\n";
echo "<INPUT TYPE=submit NAME=SUBMIT VALUE=SUBMIT>\n";
echo " &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./admin.php?ADD=3111&group_id=$group\">MODIFY</a> \n";
echo "<FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./admin.php?ADD=3111&group_id=$group\">MODIFY</a> | <a href=\"./server_stats.php\">REPORTS</a> </FONT>\n";
echo "</FORM>\n\n";
echo "<PRE><FONT SIZE=2>\n\n";
@@ -84,7 +106,7 @@ echo "VICIDIAL: Auto-dial Closer Stats $NOW_TIME\n";
echo "\n";
echo "---------- TOTALS\n";
$stmt="select count(*),sum(length_in_sec) from vicidial_closer_log where call_date >= '$query_date 00:00:01' and call_date <= '$query_date 23:59:59' and campaign_id='$group';";
$stmt="select count(*),sum(length_in_sec) from vicidial_closer_log where call_date >= '$query_date 00:00:01' and call_date <= '$query_date 23:59:59' and campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -100,7 +122,7 @@ echo "Average Call Length for all Calls in seconds: $average_hold_seconds\n";
echo "\n";
echo "---------- DROPS\n";
$stmt="select count(*),sum(length_in_sec) from vicidial_closer_log where call_date >= '$query_date 00:00:01' and call_date <= '$query_date 23:59:59' and campaign_id='$group' and status='DROP' and (length_in_sec <= 999 or length_in_sec is null);";
$stmt="select count(*),sum(length_in_sec) from vicidial_closer_log where call_date >= '$query_date 00:00:01' and call_date <= '$query_date 23:59:59' and campaign_id='" . mysql_real_escape_string($group) . "' and status='DROP' and (length_in_sec <= 999 or length_in_sec is null);";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -126,7 +148,7 @@ echo "+--------------------------+------------+--------+--------+\n";
echo "| USER | CALLS | TIME M | AVRG M |\n";
echo "+--------------------------+------------+--------+--------+\n";
$stmt="select vicidial_closer_log.user,full_name,count(*),sum(length_in_sec),avg(length_in_sec) from vicidial_closer_log,vicidial_users where call_date >= '$query_date 00:00:01' and call_date <= '$query_date 23:59:59' and campaign_id='$group' and vicidial_closer_log.user is not null and length_in_sec is not null and length_in_sec > 4 and vicidial_closer_log.user=vicidial_users.user group by vicidial_closer_log.user;";
$stmt="select vicidial_closer_log.user,full_name,count(*),sum(length_in_sec),avg(length_in_sec) from vicidial_closer_log,vicidial_users where call_date >= '$query_date 00:00:01' and call_date <= '$query_date 23:59:59' and campaign_id='" . mysql_real_escape_string($group) . "' and vicidial_closer_log.user is not null and length_in_sec is not null and length_in_sec > 4 and vicidial_closer_log.user=vicidial_users.user group by vicidial_closer_log.user;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$users_to_print = mysql_num_rows($rslt);
@@ -182,14 +204,14 @@ $i=0;
$h=0;
while ($i <= 96)
{
$stmt="select count(*) from vicidial_closer_log where call_date >= '$query_date $h:00:00' and call_date <= '$query_date $h:14:59' and campaign_id='$group';";
$stmt="select count(*) from vicidial_closer_log where call_date >= '$query_date $h:00:00' and call_date <= '$query_date $h:14:59' and campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$hour_count[$i] = $row[0];
if ($hour_count[$i] > $hi_hour_count) {$hi_hour_count = $hour_count[$i];}
if ($hour_count[$i] > 0) {$last_full_record = $i;}
$stmt="select count(*) from vicidial_closer_log where call_date >= '$query_date $h:00:00' and call_date <= '$query_date $h:14:59' and campaign_id='$group' and status='DROP';";
$stmt="select count(*) from vicidial_closer_log where call_date >= '$query_date $h:00:00' and call_date <= '$query_date $h:14:59' and campaign_id='" . mysql_real_escape_string($group) . "' and status='DROP';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -204,35 +226,35 @@ while ($i <= 96)
$hour_count[$i] = $row[0];
if ($hour_count[$i] > $hi_hour_count) {$hi_hour_count = $hour_count[$i];}
if ($hour_count[$i] > 0) {$last_full_record = $i;}
$stmt="select count(*) from vicidial_closer_log where call_date >= '$query_date $h:15:00' and call_date <= '$query_date $h:29:59' and campaign_id='$group' and status='DROP';";
$stmt="select count(*) from vicidial_closer_log where call_date >= '$query_date $h:15:00' and call_date <= '$query_date $h:29:59' and campaign_id='" . mysql_real_escape_string($group) . "' and status='DROP';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$drop_count[$i] = $row[0];
$i++;
$stmt="select count(*) from vicidial_closer_log where call_date >= '$query_date $h:30:00' and call_date <= '$query_date $h:44:59' and campaign_id='$group';";
$stmt="select count(*) from vicidial_closer_log where call_date >= '$query_date $h:30:00' and call_date <= '$query_date $h:44:59' and campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$hour_count[$i] = $row[0];
if ($hour_count[$i] > $hi_hour_count) {$hi_hour_count = $hour_count[$i];}
if ($hour_count[$i] > 0) {$last_full_record = $i;}
$stmt="select count(*) from vicidial_closer_log where call_date >= '$query_date $h:30:00' and call_date <= '$query_date $h:44:59' and campaign_id='$group' and status='DROP';";
$stmt="select count(*) from vicidial_closer_log where call_date >= '$query_date $h:30:00' and call_date <= '$query_date $h:44:59' and campaign_id='" . mysql_real_escape_string($group) . "' and status='DROP';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$drop_count[$i] = $row[0];
$i++;
$stmt="select count(*) from vicidial_closer_log where call_date >= '$query_date $h:45:00' and call_date <= '$query_date $h:59:59' and campaign_id='$group';";
$stmt="select count(*) from vicidial_closer_log where call_date >= '$query_date $h:45:00' and call_date <= '$query_date $h:59:59' and campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$hour_count[$i] = $row[0];
if ($hour_count[$i] > $hi_hour_count) {$hi_hour_count = $hour_count[$i];}
if ($hour_count[$i] > 0) {$last_full_record = $i;}
$stmt="select count(*) from vicidial_closer_log where call_date >= '$query_date $h:45:00' and call_date <= '$query_date $h:59:59' and campaign_id='$group' and status='DROP';";
$stmt="select count(*) from vicidial_closer_log where call_date >= '$query_date $h:45:00' and call_date <= '$query_date $h:59:59' and campaign_id='" . mysql_real_escape_string($group) . "' and status='DROP';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
VICIDIAL_web/AST_VDADstats.php
+35 -13
View File
@@ -3,6 +3,11 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60619-1718 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
header ("Content-type: text/html; charset=utf-8");
@@ -20,6 +25,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
@@ -65,7 +87,7 @@ echo "<SELECT SIZE=1 NAME=group>\n";
}
echo "</SELECT>\n";
echo "<INPUT type=submit NAME=SUBMIT VALUE=SUBMIT>\n";
echo " &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./admin.php?ADD=34&campaign_id=$group\">MODIFY</a> \n";
echo "<FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./admin.php?ADD=34&campaign_id=$group\">MODIFY</a> | <a href=\"./server_stats.php\">REPORTS</a> </FONT>\n";
echo "</FORM>\n\n";
echo "<PRE><FONT SIZE=2>\n\n";
@@ -86,7 +108,7 @@ echo "VICIDIAL: Auto-dial Stats $NOW_TIME\n";
echo "\n";
echo "---------- TOTALS\n";
$stmt="select count(*),sum(length_in_sec) from vicidial_log where call_date >= '$query_date 00:00:01' and call_date <= '$query_date 23:59:59' and campaign_id='$group';";
$stmt="select count(*),sum(length_in_sec) from vicidial_log where call_date >= '$query_date 00:00:01' and call_date <= '$query_date 23:59:59' and campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -102,7 +124,7 @@ echo "Average Call Length for all Calls in seconds: $average_hold_seconds\n";
echo "\n";
echo "---------- DROPS\n";
$stmt="select count(*),sum(length_in_sec) from vicidial_log where call_date >= '$query_date 00:00:01' and call_date <= '$query_date 23:59:59' and campaign_id='$group' and status='DROP' and (length_in_sec <= 60 or length_in_sec is null);";
$stmt="select count(*),sum(length_in_sec) from vicidial_log where call_date >= '$query_date 00:00:01' and call_date <= '$query_date 23:59:59' and campaign_id='" . mysql_real_escape_string($group) . "' and status='DROP' and (length_in_sec <= 60 or length_in_sec is null);";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -121,7 +143,7 @@ echo "Average Length for DROP Calls in seconds: $average_hold_seconds\n";
echo "\n";
echo "---------- AUTO-DIAL NO ANSWERS\n";
$stmt="select count(*),sum(length_in_sec) from vicidial_log where call_date >= '$query_date 00:00:01' and call_date <= '$query_date 23:59:59' and campaign_id='$group' and status='NA' and (length_in_sec <= 60 or length_in_sec is null);";
$stmt="select count(*),sum(length_in_sec) from vicidial_log where call_date >= '$query_date 00:00:01' and call_date <= '$query_date 23:59:59' and campaign_id='" . mysql_real_escape_string($group) . "' and status='NA' and (length_in_sec <= 60 or length_in_sec is null);";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -147,7 +169,7 @@ echo "+--------------------------+------------+--------+--------+\n";
echo "| USER | CALLS | TIME M | AVRG M |\n";
echo "+--------------------------+------------+--------+--------+\n";
$stmt="select vicidial_log.user,full_name,count(*),sum(length_in_sec),avg(length_in_sec) from vicidial_log,vicidial_users where call_date >= '$query_date 00:00:01' and call_date <= '$query_date 23:59:59' and campaign_id='$group' and vicidial_log.user is not null and length_in_sec is not null and length_in_sec > 4 and vicidial_log.user=vicidial_users.user group by vicidial_log.user;";
$stmt="select vicidial_log.user,full_name,count(*),sum(length_in_sec),avg(length_in_sec) from vicidial_log,vicidial_users where call_date >= '$query_date 00:00:01' and call_date <= '$query_date 23:59:59' and campaign_id='" . mysql_real_escape_string($group) . "' and vicidial_log.user is not null and length_in_sec is not null and length_in_sec > 4 and vicidial_log.user=vicidial_users.user group by vicidial_log.user;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$users_to_print = mysql_num_rows($rslt);
@@ -203,14 +225,14 @@ $i=0;
$h=0;
while ($i <= 96)
{
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:00:00' and call_date <= '$query_date $h:14:59' and campaign_id='$group';";
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:00:00' and call_date <= '$query_date $h:14:59' and campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$hour_count[$i] = $row[0];
if ($hour_count[$i] > $hi_hour_count) {$hi_hour_count = $hour_count[$i];}
if ($hour_count[$i] > 0) {$last_full_record = $i;}
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:00:00' and call_date <= '$query_date $h:14:59' and campaign_id='$group' and status='DROP';";
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:00:00' and call_date <= '$query_date $h:14:59' and campaign_id='" . mysql_real_escape_string($group) . "' and status='DROP';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -218,42 +240,42 @@ while ($i <= 96)
$i++;
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:15:00' and call_date <= '$query_date $h:29:59' and campaign_id='$group';";
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:15:00' and call_date <= '$query_date $h:29:59' and campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$hour_count[$i] = $row[0];
if ($hour_count[$i] > $hi_hour_count) {$hi_hour_count = $hour_count[$i];}
if ($hour_count[$i] > 0) {$last_full_record = $i;}
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:15:00' and call_date <= '$query_date $h:29:59' and campaign_id='$group' and status='DROP';";
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:15:00' and call_date <= '$query_date $h:29:59' and campaign_id='" . mysql_real_escape_string($group) . "' and status='DROP';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$drop_count[$i] = $row[0];
$i++;
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:30:00' and call_date <= '$query_date $h:44:59' and campaign_id='$group';";
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:30:00' and call_date <= '$query_date $h:44:59' and campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$hour_count[$i] = $row[0];
if ($hour_count[$i] > $hi_hour_count) {$hi_hour_count = $hour_count[$i];}
if ($hour_count[$i] > 0) {$last_full_record = $i;}
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:30:00' and call_date <= '$query_date $h:44:59' and campaign_id='$group' and status='DROP';";
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:30:00' and call_date <= '$query_date $h:44:59' and campaign_id='" . mysql_real_escape_string($group) . "' and status='DROP';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$drop_count[$i] = $row[0];
$i++;
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:45:00' and call_date <= '$query_date $h:59:59' and campaign_id='$group';";
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:45:00' and call_date <= '$query_date $h:59:59' and campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$hour_count[$i] = $row[0];
if ($hour_count[$i] > $hi_hour_count) {$hi_hour_count = $hour_count[$i];}
if ($hour_count[$i] > 0) {$last_full_record = $i;}
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:45:00' and call_date <= '$query_date $h:59:59' and campaign_id='$group' and status='DROP';";
$stmt="select count(*) from vicidial_log where call_date >= '$query_date $h:45:00' and call_date <= '$query_date $h:59:59' and campaign_id='" . mysql_real_escape_string($group) . "' and status='DROP';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
VICIDIAL_web/AST_VICIDIAL_hopperlist.php
+24 -2
View File
@@ -3,6 +3,11 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60619-1654 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
@@ -16,6 +21,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
@@ -85,7 +107,7 @@ echo "VICIDIAL: Live Current Hopper List $NOW_TIME\n";
echo "\n";
echo "---------- TOTALS\n";
$stmt="select count(*) from vicidial_hopper where campaign_id='$group';";
$stmt="select count(*) from vicidial_hopper where campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -104,7 +126,7 @@ echo "+------+-----------+------------+-------+--------+-------+--------+\n";
echo "| | LEAD_ID | PHONE NUM | STATE | STATUS | COUNT | GMT |\n";
echo "+------+-----------+------------+-------+--------+-------+--------+\n";
$stmt="select vicidial_hopper.lead_id,phone_number,vicidial_hopper.state,vicidial_list.status,called_count,vicidial_hopper.gmt_offset_now from vicidial_hopper,vicidial_list where vicidial_hopper.campaign_id='$group' and vicidial_hopper.lead_id=vicidial_list.lead_id order by hopper_id limit 2000;";
$stmt="select vicidial_hopper.lead_id,phone_number,vicidial_hopper.state,vicidial_list.status,called_count,vicidial_hopper.gmt_offset_now from vicidial_hopper,vicidial_list where vicidial_hopper.campaign_id='" . mysql_real_escape_string($group) . "' and vicidial_hopper.lead_id=vicidial_list.lead_id order by hopper_id limit 2000;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$users_to_print = mysql_num_rows($rslt);
VICIDIAL_web/AST_admin_log_display.php
+9 -4
View File
@@ -16,6 +16,10 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$query_date = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$query_date);
# AST GUI database administration
# AST_admin_log_display.php
#
@@ -23,14 +27,15 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
# 50325-0932 - First build
# 51123-1443 - removed globals=on requirement
# 60421-1229 - check GET/POST vars lines with isset to not trigger PHP NOTICES
# 60620-1044 - Added variable filtering to eliminate SQL injection attack threat
#
$version = '0.0.3';
$build = '60421-1229';
$version = '0.0.4';
$build = '60620-1044';
$STARTtime = date("U");
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;";
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 8;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
VICIDIAL_web/AST_agent_performance.php
+25 -3
View File
@@ -3,6 +3,11 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60619-1711 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
@@ -20,6 +25,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
@@ -69,7 +91,7 @@ echo "<option selected value=\"AM\">AM</option>\n";
echo "<option value=\"PM\">PM</option>\n";
echo "</SELECT>\n";
echo "<INPUT TYPE=SUBMIT NAME=SUBMIT VALUE=SUBMIT>\n";
echo " &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./admin.php?ADD=34&campaign_id=$group\">MODIFY</a> \n";
echo "<FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./admin.php?ADD=34&campaign_id=$group\">MODIFY</a> | <a href=\"./server_stats.php\">REPORTS</a> </FONT>\n";
echo "</FORM>\n\n";
echo "<PRE><FONT SIZE=2>\n";
@@ -108,7 +130,7 @@ echo "+-----------------+--------+--------+--------+--------+------+------+-----
echo "| USER NAME | ID | CALLS | TALK | TALKAVG| A | B | DC | DNC | N | NI | SALE |\n";
echo "+-----------------+--------+--------+--------+--------+------+------+------+------+------+------+------+\n";
$stmt="select count(*) as calls,sum(length_in_sec) as talk,full_name,vicidial_users.user,avg(length_in_sec) from vicidial_users,vicidial_log where call_date <= '$query_date_END' and call_date >= '$query_date_BEGIN' and vicidial_users.user=vicidial_log.user and campaign_id='$group' group by full_name order by calls desc limit 1000;";
$stmt="select count(*) as calls,sum(length_in_sec) as talk,full_name,vicidial_users.user,avg(length_in_sec) from vicidial_users,vicidial_log where call_date <= '$query_date_END' and call_date >= '$query_date_BEGIN' and vicidial_users.user=vicidial_log.user and campaign_id='" . mysql_real_escape_string($group) . "' group by full_name order by calls desc limit 1000;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$rows_to_print = mysql_num_rows($rslt);
@@ -150,7 +172,7 @@ $k=0;
while($k < $i)
{
$ctA[$k]="0 "; $ctB[$k]="0 "; $ctDC[$k]="0 "; $ctDNC[$k]="0 "; $ctN[$k]="0 "; $ctNI[$k]="0 "; $ctSALE[$k]="0 ";
$stmt="select count(*),status from vicidial_log where call_date <= '$query_date_END' and call_date >= '$query_date_BEGIN' and user='$user[$k]' and campaign_id='$group' group by status;";
$stmt="select count(*),status from vicidial_log where call_date <= '$query_date_END' and call_date >= '$query_date_BEGIN' and user='$user[$k]' and campaign_id='" . mysql_real_escape_string($group) . "' group by status;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$rows_to_print = mysql_num_rows($rslt);
VICIDIAL_web/AST_agent_performance_detail.php
+25 -3
View File
@@ -3,6 +3,11 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60619-1712 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
@@ -20,6 +25,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
@@ -69,7 +91,7 @@ echo "<option selected value=\"AM\">AM</option>\n";
echo "<option value=\"PM\">PM</option>\n";
echo "</SELECT>\n";
echo "<INPUT TYPE=SUBMIT NAME=SUBMIT VALUE=SUBMIT>\n";
echo " &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./admin.php?ADD=34&campaign_id=$group\">MODIFY</a> \n";
echo "<FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./admin.php?ADD=34&campaign_id=$group\">MODIFY</a> | <a href=\"./server_stats.php\">REPORTS</a> </FONT>\n";
echo "</FORM>\n\n";
echo "<PRE><FONT SIZE=2>\n";
@@ -108,7 +130,7 @@ echo "+-----------------+--------+--------+--------+--------+--------+--------+-
echo "| USER NAME | ID | CALLS | TIME | PAUSE | PAUSAVG| WAIT | WAITAVG| TALK | TALKAVG| DISPO | DISPAVG| A | B | DC | DNC | N | NI | CB | SALE |\n";
echo "+-----------------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+------+------+------+------+------+------+------+------+\n";
$stmt="select count(*) as calls,sum(talk_sec) as talk,full_name,vicidial_users.user,avg(talk_sec),sum(pause_sec),avg(pause_sec),sum(wait_sec),avg(wait_sec),sum(dispo_sec),avg(dispo_sec) from vicidial_users,vicidial_agent_log where event_time <= '$query_date_END' and event_time >= '$query_date_BEGIN' and vicidial_users.user=vicidial_agent_log.user and campaign_id='$group' and pause_sec<48800 and wait_sec<48800 and talk_sec<48800 and dispo_sec<48800 group by full_name order by calls desc limit 1000;";
$stmt="select count(*) as calls,sum(talk_sec) as talk,full_name,vicidial_users.user,avg(talk_sec),sum(pause_sec),avg(pause_sec),sum(wait_sec),avg(wait_sec),sum(dispo_sec),avg(dispo_sec) from vicidial_users,vicidial_agent_log where event_time <= '$query_date_END' and event_time >= '$query_date_BEGIN' and vicidial_users.user=vicidial_agent_log.user and campaign_id='" . mysql_real_escape_string($group) . "' and pause_sec<48800 and wait_sec<48800 and talk_sec<48800 and dispo_sec<48800 group by full_name order by calls desc limit 1000;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$rows_to_print = mysql_num_rows($rslt);
@@ -232,7 +254,7 @@ $k=0;
while($k < $i)
{
$ctA[$k]="0 "; $ctB[$k]="0 "; $ctDC[$k]="0 "; $ctDNC[$k]="0 "; $ctN[$k]="0 "; $ctNI[$k]="0 "; $ctSALE[$k]="0 "; $ctCB[$k]="0 ";
$stmt="select count(*),status from vicidial_agent_log where event_time <= '$query_date_END' and event_time >= '$query_date_BEGIN' and user='$user[$k]' and campaign_id='$group' group by status;";
$stmt="select count(*),status from vicidial_agent_log where event_time <= '$query_date_END' and event_time >= '$query_date_BEGIN' and user='$user[$k]' and campaign_id='" . mysql_real_escape_string($group) . "' group by status;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$rows_to_print = mysql_num_rows($rslt);
VICIDIAL_web/AST_agent_time_sheet.php
+25 -3
View File
@@ -3,6 +3,11 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60619-1729 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
@@ -20,6 +25,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
@@ -77,7 +99,7 @@ echo "---------- AGENT TIME SHEET: $agent - $full_name -------------\n\n";
if ($calls_summary)
{
$stmt="select count(*) as calls,sum(talk_sec) as talk,avg(talk_sec),sum(pause_sec),avg(pause_sec),sum(wait_sec),avg(wait_sec),sum(dispo_sec),avg(dispo_sec) from vicidial_agent_log where event_time <= '$query_date_END' and event_time >= '$query_date_BEGIN' and user='$agent' and pause_sec<48800 and wait_sec<48800 and talk_sec<48800 and dispo_sec<48800 limit 1;";
$stmt="select count(*) as calls,sum(talk_sec) as talk,avg(talk_sec),sum(pause_sec),avg(pause_sec),sum(wait_sec),avg(wait_sec),sum(dispo_sec),avg(dispo_sec) from vicidial_agent_log where event_time <= '" . mysql_real_escape_string($query_date_END) . "' and event_time >= '" . mysql_real_escape_string($query_date_BEGIN) . "' and user='" . mysql_real_escape_string($agent) . "' and pause_sec<48800 and wait_sec<48800 and talk_sec<48800 and dispo_sec<48800 limit 1;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -215,7 +237,7 @@ else
}
$stmt="select event_time,UNIX_TIMESTAMP(event_time) from vicidial_agent_log where event_time <= '$query_date_END' and event_time >= '$query_date_BEGIN' and user='$agent' order by event_time limit 1;";
$stmt="select event_time,UNIX_TIMESTAMP(event_time) from vicidial_agent_log where event_time <= '" . mysql_real_escape_string($query_date_END) . "' and event_time >= '" . mysql_real_escape_string($query_date_BEGIN) . "' and user='" . mysql_real_escape_string($agent) . "' order by event_time limit 1;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -223,7 +245,7 @@ $row=mysql_fetch_row($rslt);
echo "FIRST LOGIN: $row[0]\n";
$start = $row[1];
$stmt="select event_time,UNIX_TIMESTAMP(event_time) from vicidial_agent_log where event_time <= '$query_date_END' and event_time >= '$query_date_BEGIN' and user='$agent' order by event_time desc limit 1;";
$stmt="select event_time,UNIX_TIMESTAMP(event_time) from vicidial_agent_log where event_time <= '" . mysql_real_escape_string($query_date_END) . "' and event_time >= '" . mysql_real_escape_string($query_date_BEGIN) . "' and user='" . mysql_real_escape_string($agent) . "' order by event_time desc limit 1;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
VICIDIAL_web/AST_agent_time_sheet_archive.php
+25 -3
View File
@@ -3,6 +3,11 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60619-1721 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
@@ -20,6 +25,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
@@ -77,7 +99,7 @@ echo "---------- AGENT TIME SHEET: $agent - $full_name -------------\n\n";
if ($calls_summary)
{
$stmt="select count(*) as calls,sum(talk_sec) as talk,avg(talk_sec),sum(pause_sec),avg(pause_sec),sum(wait_sec),avg(wait_sec),sum(dispo_sec),avg(dispo_sec) from vicidial_agent_log_archive where event_time <= '$query_date_END' and event_time >= '$query_date_BEGIN' and user='$agent' and pause_sec<48800 and wait_sec<48800 and talk_sec<48800 and dispo_sec<48800 limit 1;";
$stmt="select count(*) as calls,sum(talk_sec) as talk,avg(talk_sec),sum(pause_sec),avg(pause_sec),sum(wait_sec),avg(wait_sec),sum(dispo_sec),avg(dispo_sec) from vicidial_agent_log_archive where event_time <= '" . mysql_real_escape_string($query_date_END) . "' and event_time >= '" . mysql_real_escape_string($query_date_BEGIN) . "' and user='" . mysql_real_escape_string($agent) . "' and pause_sec<48800 and wait_sec<48800 and talk_sec<48800 and dispo_sec<48800 limit 1;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -215,7 +237,7 @@ else
}
$stmt="select event_time,UNIX_TIMESTAMP(event_time) from vicidial_agent_log_archive where event_time <= '$query_date_END' and event_time >= '$query_date_BEGIN' and user='$agent' order by event_time limit 1;";
$stmt="select event_time,UNIX_TIMESTAMP(event_time) from vicidial_agent_log_archive where event_time <= '" . mysql_real_escape_string($query_date_END) . "' and event_time >= '" . mysql_real_escape_string($query_date_BEGIN) . "' and user='" . mysql_real_escape_string($agent) . "' order by event_time limit 1;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -223,7 +245,7 @@ $row=mysql_fetch_row($rslt);
echo "FIRST LOGIN: $row[0]\n";
$start = $row[1];
$stmt="select event_time,UNIX_TIMESTAMP(event_time) from vicidial_agent_log_archive where event_time <= '$query_date_END' and event_time >= '$query_date_BEGIN' and user='$agent' order by event_time desc limit 1;";
$stmt="select event_time,UNIX_TIMESTAMP(event_time) from vicidial_agent_log_archive where event_time <= '" . mysql_real_escape_string($query_date_END) . "' and event_time >= '" . mysql_real_escape_string($query_date_BEGIN) . "' and user='" . mysql_real_escape_string($agent) . "' order by event_time desc limit 1;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
VICIDIAL_web/AST_parkstats.php
+34 -12
View File
@@ -3,6 +3,11 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60619-1717 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
@@ -18,6 +23,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
@@ -63,7 +85,7 @@ echo "<SELECT SIZE=1 NAME=group>\n";
}
echo "</SELECT>\n";
echo "<INPUT TYPE=SUBMIT NAME=SUBMIT VALUE=SUBMIT>\n";
echo " &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./admin.php?ADD=34&campaign_id=$group\">MODIFY</a> \n";
echo "<FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./admin.php?ADD=34&campaign_id=$group\">MODIFY</a> | <a href=\"./server_stats.php\">REPORTS</a> </FONT>\n";
echo "</FORM>\n\n";
echo "<PRE><FONT SIZE=2>\n\n";
@@ -84,7 +106,7 @@ echo "VICIDIAL: Park Stats $NOW_TIME\n";
echo "\n";
echo "---------- TOTALS\n";
$stmt="select count(*),sum(parked_sec) from park_log where parked_time >= '$query_date 00:00:01' and parked_time <= '$query_date 23:59:59' and status ='HUNGUP' and channel_group='$group';";
$stmt="select count(*),sum(parked_sec) from park_log where parked_time >= '$query_date 00:00:01' and parked_time <= '$query_date 23:59:59' and status ='HUNGUP' and channel_group='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -100,7 +122,7 @@ echo "Average Hold Time(seconds) for all Calls: $average_hold_seconds\n";
echo "\n";
echo "---------- DROPS\n";
$stmt="select count(*),sum(parked_sec) from park_log where parked_time >= '$query_date 00:00:01' and parked_time <= '$query_date 23:59:59' and status ='HUNGUP' and channel_group='$group' and (talked_sec < 5 or talked_sec is null);";
$stmt="select count(*),sum(parked_sec) from park_log where parked_time >= '$query_date 00:00:01' and parked_time <= '$query_date 23:59:59' and status ='HUNGUP' and channel_group='" . mysql_real_escape_string($group) . "' and (talked_sec < 5 or talked_sec is null);";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -126,7 +148,7 @@ echo "+--------------------------+------------+--------+--------+\n";
echo "| USER | CALLS | TIME M | AVRG M |\n";
echo "+--------------------------+------------+--------+--------+\n";
$stmt="select park_log.user,full_name,count(*),sum(talked_sec),avg(talked_sec) from park_log,vicidial_users where parked_time >= '$query_date 00:00:01' and parked_time <= '$query_date 23:59:59' and status ='HUNGUP' and channel_group='$group' and park_log.user is not null and talked_sec is not null and talked_sec > 4 and park_log.user=vicidial_users.user group by park_log.user;";
$stmt="select park_log.user,full_name,count(*),sum(talked_sec),avg(talked_sec) from park_log,vicidial_users where parked_time >= '$query_date 00:00:01' and parked_time <= '$query_date 23:59:59' and status ='HUNGUP' and channel_group='" . mysql_real_escape_string($group) . "' and park_log.user is not null and talked_sec is not null and talked_sec > 4 and park_log.user=vicidial_users.user group by park_log.user;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$users_to_print = mysql_num_rows($rslt);
@@ -182,14 +204,14 @@ $i=0;
$h=0;
while ($i <= 96)
{
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:00:00' and parked_time <= '$query_date $h:14:59' and status ='HUNGUP' and channel_group='$group';";
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:00:00' and parked_time <= '$query_date $h:14:59' and status ='HUNGUP' and channel_group='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$hour_count[$i] = $row[0];
if ($hour_count[$i] > $hi_hour_count) {$hi_hour_count = $hour_count[$i];}
if ($hour_count[$i] > 0) {$last_full_record = $i;}
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:00:00' and parked_time <= '$query_date $h:14:59' and status ='HUNGUP' and channel_group='$group' and (talked_sec < 5 or talked_sec is null);";
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:00:00' and parked_time <= '$query_date $h:14:59' and status ='HUNGUP' and channel_group='" . mysql_real_escape_string($group) . "' and (talked_sec < 5 or talked_sec is null);";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -197,42 +219,42 @@ while ($i <= 96)
$i++;
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:15:00' and parked_time <= '$query_date $h:29:59' and status ='HUNGUP' and channel_group='$group';";
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:15:00' and parked_time <= '$query_date $h:29:59' and status ='HUNGUP' and channel_group='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$hour_count[$i] = $row[0];
if ($hour_count[$i] > $hi_hour_count) {$hi_hour_count = $hour_count[$i];}
if ($hour_count[$i] > 0) {$last_full_record = $i;}
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:15:00' and parked_time <= '$query_date $h:29:59' and status ='HUNGUP' and channel_group='$group' and (talked_sec < 5 or talked_sec is null);";
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:15:00' and parked_time <= '$query_date $h:29:59' and status ='HUNGUP' and channel_group='" . mysql_real_escape_string($group) . "' and (talked_sec < 5 or talked_sec is null);";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$drop_count[$i] = $row[0];
$i++;
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:30:00' and parked_time <= '$query_date $h:44:59' and status ='HUNGUP' and channel_group='$group';";
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:30:00' and parked_time <= '$query_date $h:44:59' and status ='HUNGUP' and channel_group='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$hour_count[$i] = $row[0];
if ($hour_count[$i] > $hi_hour_count) {$hi_hour_count = $hour_count[$i];}
if ($hour_count[$i] > 0) {$last_full_record = $i;}
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:30:00' and parked_time <= '$query_date $h:44:59' and status ='HUNGUP' and channel_group='$group' and (talked_sec < 5 or talked_sec is null);";
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:30:00' and parked_time <= '$query_date $h:44:59' and status ='HUNGUP' and channel_group='" . mysql_real_escape_string($group) . "' and (talked_sec < 5 or talked_sec is null);";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$drop_count[$i] = $row[0];
$i++;
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:45:00' and parked_time <= '$query_date $h:59:59' and status ='HUNGUP' and channel_group='$group';";
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:45:00' and parked_time <= '$query_date $h:59:59' and status ='HUNGUP' and channel_group='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$hour_count[$i] = $row[0];
if ($hour_count[$i] > $hi_hour_count) {$hi_hour_count = $hour_count[$i];}
if ($hour_count[$i] > 0) {$last_full_record = $i;}
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:45:00' and parked_time <= '$query_date $h:59:59' and status ='HUNGUP' and channel_group='$group' and (talked_sec < 5 or talked_sec is null);";
$stmt="select count(*) from park_log where parked_time >= '$query_date $h:45:00' and parked_time <= '$query_date $h:59:59' and status ='HUNGUP' and channel_group='" . mysql_real_escape_string($group) . "' and (talked_sec < 5 or talked_sec is null);";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
VICIDIAL_web/AST_server_performance.php
+29 -6
View File
@@ -3,6 +3,11 @@
#
# Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
#
# CHANGES
#
# 60619-1732 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
@@ -20,6 +25,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
# path from root to where ploticus files will be stored
$DOCroot = "$WeBServeRRooT/vicidial/ploticus/";
@@ -73,6 +95,7 @@ echo "<option selected value=\"AM\">AM</option>\n";
echo "<option value=\"PM\">PM</option>\n";
echo "</SELECT>\n";
echo "<INPUT TYPE=SUBMIT NAME=SUBMIT VALUE=SUBMIT>\n";
echo "<FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./server_stats.php\">REPORTS</a> </FONT>\n";
echo "</FORM>\n\n";
echo "<PRE><FONT SIZE=2>\n";
@@ -107,7 +130,7 @@ echo "VICIDIAL: Server Performance $NOW_TIME\n";
echo "Time range: $query_date_BEGIN to $query_date_END\n\n";
echo "---------- TOTALS, PEAKS and AVERAGES\n";
$stmt="select sysload from server_performance where start_time <= '$query_date_END' and start_time >= '$query_date_BEGIN' and server_ip='$group' order by sysload desc limit 1;";
$stmt="select sysload from server_performance where start_time <= '" . mysql_real_escape_string($query_date_END) . "' and start_time >= '" . mysql_real_escape_string($query_date_BEGIN) . "' and server_ip='" . mysql_real_escape_string($group) . "' order by sysload desc limit 1;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -115,14 +138,14 @@ $HIGHload = sprintf("%10s", $row[0]);
$HIGHmulti = intval($HIGHload / 100);
#$HIGHmulti = ($HIGHload / 100);
$stmt="select AVG(sysload),AVG(channels_total) from server_performance where start_time <= '$query_date_END' and start_time >= '$query_date_BEGIN' and server_ip='$group';";
$stmt="select AVG(sysload),AVG(channels_total) from server_performance where start_time <= '" . mysql_real_escape_string($query_date_END) . "' and start_time >= '" . mysql_real_escape_string($query_date_BEGIN) . "' and server_ip='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$AVGload = sprintf("%10s", $row[0]);
$AVGchannels = sprintf("%10s", $row[1]);
$stmt="select AVG(cpu_user_percent),AVG(cpu_system_percent),AVG(cpu_idle_percent) from server_performance where start_time <= '$query_date_END' and start_time >= '$query_date_BEGIN' and server_ip='$group';";
$stmt="select AVG(cpu_user_percent),AVG(cpu_system_percent),AVG(cpu_idle_percent) from server_performance where start_time <= '" . mysql_real_escape_string($query_date_END) . "' and start_time >= '" . mysql_real_escape_string($query_date_BEGIN) . "' and server_ip='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -130,13 +153,13 @@ $AVGcpuUSER = sprintf("%10s", $row[0]);
$AVGcpuSYSTEM = sprintf("%10s", $row[1]);
$AVGcpuIDLE = sprintf("%10s", $row[2]);
$stmt="select usedram from server_performance where start_time <= '$query_date_END' and start_time >= '$query_date_BEGIN' and server_ip='$group' order by usedram desc limit 1;";
$stmt="select usedram from server_performance where start_time <= '" . mysql_real_escape_string($query_date_END) . "' and start_time >= '" . mysql_real_escape_string($query_date_BEGIN) . "' and server_ip='" . mysql_real_escape_string($group) . "' order by usedram desc limit 1;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$USEDram = sprintf("%10s", $row[0]);
$stmt="select count(*),SUM(length_in_min) from call_log where extension NOT IN('8365','8366','8367') and start_time <= '$query_date_END' and start_time >= '$query_date_BEGIN' and server_ip='$group';";
$stmt="select count(*),SUM(length_in_min) from call_log where extension NOT IN('8365','8366','8367') and start_time <= '" . mysql_real_escape_string($query_date_END) . "' and start_time >= '" . mysql_real_escape_string($query_date_BEGIN) . "' and server_ip='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -173,7 +196,7 @@ $PNGfile = "$group$query_date$shift$filedate$PNG";
$HTMfp = fopen ("$DOCroot/$HTMfile", "a");
$DATfp = fopen ("$DOCroot/$DATfile", "a");
$stmt="select DATE_FORMAT(start_time,'%H:%i:%s') as timex,sysload,processes,channels_total,live_recordings,cpu_user_percent,cpu_system_percent from server_performance where server_ip='$group' and start_time <= '$query_date_END' and start_time >= '$query_date_BEGIN' order by timex;";
$stmt="select DATE_FORMAT(start_time,'%H:%i:%s') as timex,sysload,processes,channels_total,live_recordings,cpu_user_percent,cpu_system_percent from server_performance where server_ip='" . mysql_real_escape_string($group) . "' and start_time <= '" . mysql_real_escape_string($query_date_END) . "' and start_time >= '" . mysql_real_escape_string($query_date_BEGIN) . "' order by timex;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$rows_to_print = mysql_num_rows($rslt);
VICIDIAL_web/AST_timeonVDAD.php
+25 -6
View File
@@ -6,8 +6,10 @@
# live real-time stats for the VICIDIAL Auto-Dialer
#
# changes:
# 50406-0920 Added Paused agents < 1 min (Chris Doyle)
# 50406-0920 - Added Paused agents < 1 min (Chris Doyle)
# 60620-1040 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
header ("Content-type: text/html; charset=utf-8");
@@ -25,6 +27,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
$epochSIXhoursAGO = ($STARTtime - 21600);
@@ -66,19 +85,19 @@ if ($reset_counter > 7)
echo "<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n";
echo"<META HTTP-EQUIV=Refresh CONTENT=\"4; URL=$PHP_SELF?server_ip=$server_ip&DB=$DB&reset_counter=$reset_counter\">\n";
echo "<TITLE>VICIDIAL: Time On VDAD</TITLE></HEAD><BODY BGCOLOR=WHITE>\n";
echo "<PRE><FONT SIZE=3>\n\n";
echo "<PRE><FONT SIZE=3>";
###################################################################################
###### TIME ON SYSTEM
###################################################################################
echo "VICIDIAL: Agents Time On Calls $NOW_TIME\n\n";
echo "VICIDIAL: Agents Time On Calls $NOW_TIME <a href=\"./server_stats.php\">REPORTS</a>\n\n";
echo "+------------|--------+-----------+------------+--------+---------------------+---------+\n";
echo "| STATION | USER | SESSIONID | CHANNEL | STATUS | START TIME | MINUTES |\n";
echo "+------------|--------+-----------+------------+--------+---------------------+---------+\n";
$stmt="select extension,user,conf_exten,channel,status,last_call_time,UNIX_TIMESTAMP(last_call_time),UNIX_TIMESTAMP(last_call_finish) from vicidial_live_agents where server_ip='$server_ip' order by extension;";
$stmt="select extension,user,conf_exten,channel,status,last_call_time,UNIX_TIMESTAMP(last_call_time),UNIX_TIMESTAMP(last_call_finish) from vicidial_live_agents where server_ip='" . mysql_real_escape_string($server_ip) . "' order by extension;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$talking_to_print = mysql_num_rows($rslt);
@@ -169,7 +188,7 @@ echo "+------------+--------+----------+--------------------+-------------------
# $linkX=mysql_connect("localhost", "cron", "1234");
#mysql_select_db("asterisk");
$stmt="select channel,status,campaign_id,phone_code,phone_number,call_time,UNIX_TIMESTAMP(call_time) from vicidial_auto_calls where status NOT IN('XFER') and server_ip='$server_ip' order by auto_call_id;";
$stmt="select channel,status,campaign_id,phone_code,phone_number,call_time,UNIX_TIMESTAMP(call_time) from vicidial_auto_calls where status NOT IN('XFER') and server_ip='" . mysql_real_escape_string($server_ip) . "' order by auto_call_id;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$parked_to_print = mysql_num_rows($rslt);
VICIDIAL_web/AST_timeonVDAD_closer.php
+28 -5
View File
@@ -4,6 +4,12 @@
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# live real-time stats for the VICIDIAL Auto-Dialer
#
# CHANGES
#
# 60620-1037 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
header ("Content-type: text/html; charset=utf-8");
@@ -21,6 +27,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
$epochSIXhoursAGO = ($STARTtime - 21600);
@@ -81,19 +104,19 @@ $groups_to_print = mysql_num_rows($rslt);
echo "<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n";
echo"<META HTTP-EQUIV=Refresh CONTENT=\"4; URL=$PHP_SELF?server_ip=$server_ip&DB=$DB&reset_counter=$reset_counter\">\n";
echo "<TITLE>VICIDIAL: Time On VDAD</TITLE></HEAD><BODY BGCOLOR=WHITE>\n";
echo "<PRE><FONT SIZE=3>\n\n";
echo "<PRE><FONT SIZE=3>";
###################################################################################
###### TIME ON SYSTEM
###################################################################################
echo "VICIDIAL: Agents Time On Calls $NOW_TIME\n\n";
echo "VICIDIAL: Agents Time On Calls $NOW_TIME <a href=\"./server_stats.php\">REPORTS</a>\n\n";
echo "+------------|--------+-----------+---------------------+--------+----------+---------+--------------+--------+\n";
echo "| STATION | USER | SESSIONID | CHANNEL | STATUS | CALLTIME | MINUTES | CAMPAIGN | FRONT |\n";
echo "+------------|--------+-----------+---------------------+--------+----------+---------+--------------+--------+\n";
$stmt="select extension,user,conf_exten,channel,status,last_call_time,UNIX_TIMESTAMP(last_call_time),UNIX_TIMESTAMP(last_call_finish),uniqueid,lead_id from vicidial_live_agents where status NOT IN('PAUSED') and server_ip='$server_ip' order by extension;";
$stmt="select extension,user,conf_exten,channel,status,last_call_time,UNIX_TIMESTAMP(last_call_time),UNIX_TIMESTAMP(last_call_finish),uniqueid,lead_id from vicidial_live_agents where status NOT IN('PAUSED') and server_ip='" . mysql_real_escape_string($server_ip) . "' order by extension;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$talking_to_print = mysql_num_rows($rslt);
@@ -150,7 +173,7 @@ $talking_to_print = mysql_num_rows($rslt);
while ($i < $ext_count)
{
$stmt="select campaign_id from vicidial_auto_calls where uniqueid='$uniqueid[$i]' and server_ip='$server_ip';";
$stmt="select campaign_id from vicidial_auto_calls where uniqueid='$uniqueid[$i]' and server_ip='" . mysql_real_escape_string($server_ip) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$camp_to_print = mysql_num_rows($rslt);
@@ -219,7 +242,7 @@ echo "+---------------------+--------+--------------+--------------------+------
# $linkX=mysql_connect("localhost", "cron", "1234");
#mysql_select_db("asterisk");
$stmt="select channel,status,campaign_id,phone_code,phone_number,call_time,UNIX_TIMESTAMP(call_time) from vicidial_auto_calls where status NOT IN('XFER') and server_ip='$server_ip' order by auto_call_id desc;";
$stmt="select channel,status,campaign_id,phone_code,phone_number,call_time,UNIX_TIMESTAMP(call_time) from vicidial_auto_calls where status NOT IN('XFER') and server_ip='" . mysql_real_escape_string($server_ip) . "' order by auto_call_id desc;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$parked_to_print = mysql_num_rows($rslt);
VICIDIAL_web/AST_timeonVDADall.php
+28 -9
View File
@@ -11,6 +11,8 @@
# 60421-1043 - check GET/POST vars lines with isset to not trigger PHP NOTICES
# 60511-1343 - Added leads and drop info at the top of the screen
# 60608-1539 - Fixed CLOSER tallies for active calls
# 60619-1658 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
header ("Content-type: text/html; charset=utf-8");
@@ -37,6 +39,23 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
if (!isset($group)) {$group='';}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_TIME = date("Y-m-d H:i:s");
$NOW_DAY = date("Y-m-d");
$NOW_HOUR = date("H:i:s");
@@ -111,16 +130,16 @@ echo "<SELECT SIZE=1 NAME=group>\n";
$o++;
}
echo "</SELECT>\n";
echo "<INPUT type=submit NAME=SUBMIT VALUE=SUBMIT> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \n";
echo "<INPUT type=submit NAME=SUBMIT VALUE=SUBMIT><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2> &nbsp; &nbsp; &nbsp; &nbsp; \n";
echo "<a href=\"$PHP_SELF?group=$group&RR=40&DB=$DB\">STOP</a> | <a href=\"$PHP_SELF?group=$group&RR=4&DB=$DB\">GO</a>";
echo " &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./admin.php?ADD=34&campaign_id=$group\">MODIFY</a> \n";
echo " &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./admin.php?ADD=34&campaign_id=$group\">MODIFY</a> | <a href=\"./server_stats.php\">REPORTS</a> </FONT>\n";
echo "\n\n";
if (!$group) {echo "<BR><BR>please select a campaign from the pulldown above</FORM>\n"; exit;}
else
{
$stmt="select auto_dial_level,dial_status_a,dial_status_b,dial_status_c,dial_status_d,dial_status_e,lead_order,lead_filter_id,hopper_level from vicidial_campaigns where campaign_id='$group';";
$stmt="select auto_dial_level,dial_status_a,dial_status_b,dial_status_c,dial_status_d,dial_status_e,lead_order,lead_filter_id,hopper_level from vicidial_campaigns where campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$HOPlev = $row[8];
@@ -132,12 +151,12 @@ echo "<TD ALIGN=RIGHT><font size=2><B>ORDER:</B></TD><TD ALIGN=LEFT><font size=2
echo "<TD ALIGN=RIGHT><font size=2><B>FILTER:</B></TD><TD ALIGN=LEFT><font size=2>&nbsp; $row[7] &nbsp; &nbsp; </TD>";
echo "</TR>";
$stmt="select count(*) from vicidial_hopper where campaign_id='$group';";
$stmt="select count(*) from vicidial_hopper where campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$VDhop = $row[0];
$stmt="select dialable_leads,calls_today,drops_today,drops_today_pct from vicidial_campaign_stats where campaign_id='$group';";
$stmt="select dialable_leads,calls_today,drops_today,drops_today_pct from vicidial_campaign_stats where campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$DAleads = $row[0];
@@ -166,17 +185,17 @@ echo "</FORM>\n\n";
###################################################################################
if (eregi("CLOSER",$group))
{
$stmt="select closer_campaigns from vicidial_campaigns where campaign_id='$group';";
$stmt="select closer_campaigns from vicidial_campaigns where campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$closer_campaigns = preg_replace("/^ | -$/","",$row[0]);
$closer_campaigns = preg_replace("/ /","','",$closer_campaigns);
$closer_campaigns = "'$closer_campaigns'";
$stmt="select status from vicidial_auto_calls where status NOT IN('XFER') and ( (call_type='IN' and campaign_id IN($closer_campaigns)) or (campaign_id='$group' and call_type='OUT') );";
$stmt="select status from vicidial_auto_calls where status NOT IN('XFER') and ( (call_type='IN' and campaign_id IN($closer_campaigns)) or (campaign_id='" . mysql_real_escape_string($group) . "' and call_type='OUT') );";
}
else
{$stmt="select status from vicidial_auto_calls where status NOT IN('XFER') and campaign_id='$group';";}
{$stmt="select status from vicidial_auto_calls where status NOT IN('XFER') and campaign_id='" . mysql_real_escape_string($group) . "';";}
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$parked_to_print = mysql_num_rows($rslt);
@@ -238,7 +257,7 @@ $Aecho .= "| STATION | USER | SESSIONID | STATUS | SERVER IP | CALL S
$Aecho .= "+------------|--------+-----------+--------+-----------------+-----------------+---------+------------+\n";
$stmt="select extension,user,conf_exten,status,server_ip,UNIX_TIMESTAMP(last_call_time),UNIX_TIMESTAMP(last_call_finish),call_server_ip,campaign_id from vicidial_live_agents where campaign_id='$group' order by status,last_call_time;";
$stmt="select extension,user,conf_exten,status,server_ip,UNIX_TIMESTAMP(last_call_time),UNIX_TIMESTAMP(last_call_finish),call_server_ip,campaign_id from vicidial_live_agents where campaign_id='" . mysql_real_escape_string($group) . "' order by status,last_call_time;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$talking_to_print = mysql_num_rows($rslt);
VICIDIAL_web/AST_timeonVDADall_SIPmonitor.php
+25 -7
View File
@@ -9,6 +9,8 @@
# 50406-0920 - Added Paused agents < 1 min (Chris Doyle)
# 51130-1218 - Modified layout and info to show all servers in a vicidial system
# 60504-2023 - Modified click-to-listen for SIP phones by Angelito Manansala
# 60619-1708 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
header ("Content-type: text/html; charset=utf-8");
@@ -25,6 +27,22 @@ $DB=$_GET["DB"]; if (!$DB) {$DB=$_POST["DB"];}
$submit=$_GET["submit"]; if (!$submit) {$submit=$_POST["submit"];}
$SUBMIT=$_GET["SUBMIT"]; if (!$SUBMIT) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
@@ -96,15 +114,15 @@ echo "<SELECT SIZE=1 NAME=group>\n";
$o++;
}
echo "</SELECT>\n";
echo "<INPUT type=submit NAME=SUBMIT VALUE=SUBMIT> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; \n";
echo "<a href=\"$PHP_SELF?group=$group&RR=40&DB=$DB\">STOP</a> | <a href=\"$PHP_SELF?group=$group&RR=4&DB=$DB\">GO</a> \n";
echo " &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./admin.php?ADD=34&campaign_id=$group\">MODIFY</a> \n";
echo "<INPUT type=submit NAME=SUBMIT VALUE=SUBMIT><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2> &nbsp; &nbsp; &nbsp; &nbsp; \n";
echo "<a href=\"$PHP_SELF?group=$group&RR=40&DB=$DB\">STOP</a> | <a href=\"$PHP_SELF?group=$group&RR=4&DB=$DB\">GO</a>";
echo " &nbsp; &nbsp; &nbsp; &nbsp; <a href=\"./admin.php?ADD=34&campaign_id=$group\">MODIFY</a> | <a href=\"./server_stats.php\">REPORTS</a> </FONT>\n";
echo "\n\n";
if (!$group) {echo "<BR><BR>please select a campaign from the pulldown above</FORM>\n"; exit;}
else
{
$stmt="select auto_dial_level,dial_status_a,dial_status_b,dial_status_c,dial_status_d,dial_status_e,lead_order from vicidial_campaigns where campaign_id='$group';";
$stmt="select auto_dial_level,dial_status_a,dial_status_b,dial_status_c,dial_status_d,dial_status_e,lead_order from vicidial_campaigns where campaign_id='" . mysql_real_escape_string($group) . "';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -118,9 +136,9 @@ echo "</FORM>\n\n";
###### OUTBOUND CALLS
###################################################################################
if (eregi("CLOSER",$group))
{$stmt="select status from vicidial_auto_calls where status NOT IN('XFER') and (campaign_id='$group' or campaign_id LIKE \"CL_%\");";}
{$stmt="select status from vicidial_auto_calls where status NOT IN('XFER') and (campaign_id='" . mysql_real_escape_string($group) . "' or campaign_id LIKE \"CL_%\");";}
else
{$stmt="select status from vicidial_auto_calls where status NOT IN('XFER') and campaign_id='$group';";}
{$stmt="select status from vicidial_auto_calls where status NOT IN('XFER') and campaign_id='" . mysql_real_escape_string($group) . "';";}
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$parked_to_print = mysql_num_rows($rslt);
@@ -182,7 +200,7 @@ $Aecho .= "| STATION | USER | SESSIONID | STATUS | SERVER IP |
$Aecho .= "+------------|--------+------------------+--------+-----------------+-----------------+---------+------------+\n";
$stmt="select extension,user,conf_exten,status,server_ip,UNIX_TIMESTAMP(last_call_time),UNIX_TIMESTAMP(last_call_finish),call_server_ip,campaign_id from vicidial_live_agents where campaign_id='$group' order by status,last_call_time;";
$stmt="select extension,user,conf_exten,status,server_ip,UNIX_TIMESTAMP(last_call_time),UNIX_TIMESTAMP(last_call_finish),call_server_ip,campaign_id from vicidial_live_agents where campaign_id='" . mysql_real_escape_string($group) . "' order by status,last_call_time;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$talking_to_print = mysql_num_rows($rslt);
VICIDIAL_web/AST_timeoncall.php
+27 -5
View File
@@ -3,6 +3,11 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60620-1043 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
@@ -18,6 +23,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
@@ -38,19 +60,19 @@ echo"<META HTTP-EQUIV=Refresh CONTENT=\"15; URL=$PHP_SELF?server_ip=$server_ip&D
echo "<TITLE>VICIDIAL: Time On Call</TITLE></HEAD><BODY BGCOLOR=WHITE>\n";
echo "<PRE>\n\n";
echo "VICIDIAL: Time On Call $NOW_TIME\n\n";
echo "VICIDIAL: Time On Call $NOW_TIME <a href=\"./server_stats.php\">REPORTS</a>\n\n";
echo "+------------+-----------+-----------+------------------+---------------------+---------+\n";
echo "| STATION | SESSIONID | CHANNEL | NUMBER DIALED | START TIME | MINUTES |\n";
echo "+------------+-----------+-----------+------------------+---------------------+---------+\n";
$stmt="SELECT count(*) from live_sip_channels where server_ip='$server_ip';";
$stmt="SELECT count(*) from live_sip_channels where server_ip='" . mysql_real_escape_string($server_ip) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$parked_count = $row[0];
if ($parked_count > 0)
{
$stmt="select extension from live_channels where server_ip='$server_ip';";
$stmt="select extension from live_channels where server_ip='" . mysql_real_escape_string($server_ip) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$ext_to_print = mysql_num_rows($rslt);
@@ -70,7 +92,7 @@ $parked_count = $row[0];
if ($DB) {echo "SESSIONS: -$sessions-\n";}
$stmt="select * from live_sip_channels where server_ip='$server_ip' order by channel;";
$stmt="select * from live_sip_channels where server_ip='" . mysql_real_escape_string($server_ip) . "' order by channel;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$parked_to_print = mysql_num_rows($rslt);
@@ -119,7 +141,7 @@ $parked_count = $row[0];
while ($i < $live_calls_counter)
{
$stmt="select channel,extension,number_dialed,start_time,start_epoch from call_log where extension='$LIVE_stations[$i]' and server_ip='$server_ip' order by uniqueid desc LIMIT 1;";
$stmt="select channel,extension,number_dialed,start_time,start_epoch from call_log where extension='$LIVE_stations[$i]' and server_ip='" . mysql_real_escape_string($server_ip) . "' order by uniqueid desc LIMIT 1;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$parked_to_print = mysql_num_rows($rslt);
VICIDIAL_web/AST_timeonpark.php
+25 -3
View File
@@ -3,6 +3,11 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60620-1042 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
@@ -18,6 +23,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
$timeONEhoursAGO = ($STARTtime - 3600);
@@ -67,7 +89,7 @@ echo"<META HTTP-EQUIV=Refresh CONTENT=\"7; URL=$PHP_SELF?server_ip=$server_ip&DB
echo "<TITLE>VICIDIAL: Time On Park</TITLE></HEAD><BODY BGCOLOR=WHITE>\n";
echo "<PRE><FONT SIZE=3>\n\n";
echo "VICIDIAL: Time On Park $NOW_TIME\n\n";
echo "VICIDIAL: Time On Park $NOW_TIME <a href=\"./server_stats.php\">REPORTS</a>\n\n";
echo "+------------+-----------------+---------------------+---------+\n";
echo "| CHANNEL | GROUP | START TIME | MINUTES |\n";
echo "+------------+-----------------+---------------------+---------+\n";
@@ -76,7 +98,7 @@ echo "+------------+-----------------+---------------------+---------+\n";
# $linkX=mysql_connect("localhost", "cron", "1234");
#mysql_select_db("asterisk");
$stmt="select extension,user,channel,channel_group,parked_time,UNIX_TIMESTAMP(parked_time) from park_log where status ='PARKED' and server_ip='$server_ip' order by uniqueid;";
$stmt="select extension,user,channel,channel_group,parked_time,UNIX_TIMESTAMP(parked_time) from park_log where status ='PARKED' and server_ip='" . mysql_real_escape_string($server_ip) . "' order by uniqueid;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$parked_to_print = mysql_num_rows($rslt);
@@ -138,7 +160,7 @@ echo "| STATION | USER | CHANNEL | GROUP | START TIME
echo "+------------|--------+------------+-----------------+---------------------+---------+\n";
$stmt="select extension,user,channel,channel_group,grab_time,UNIX_TIMESTAMP(grab_time) from park_log where status ='TALKING' and server_ip='$server_ip' order by uniqueid;";
$stmt="select extension,user,channel,channel_group,grab_time,UNIX_TIMESTAMP(grab_time) from park_log where status ='TALKING' and server_ip='" . mysql_real_escape_string($server_ip) . "' order by uniqueid;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$talking_to_print = mysql_num_rows($rslt);
VICIDIAL_web/admin.php
+212 -47
View File
@@ -254,8 +254,6 @@ if (isset($_GET["ct_saturday_start"])) {$ct_saturday_start=$_GET["ct_saturday
elseif (isset($_POST["ct_saturday_start"])) {$ct_saturday_start=$_POST["ct_saturday_start"];}
if (isset($_GET["ct_saturday_stop"])) {$ct_saturday_stop=$_GET["ct_saturday_stop"];}
elseif (isset($_POST["ct_saturday_stop"])) {$ct_saturday_stop=$_POST["ct_saturday_stop"];}
if (isset($_GET["ct_state_call_times"])) {$ct_state_call_times=$_GET["ct_state_call_times"];}
elseif (isset($_POST["ct_state_call_times"])) {$ct_state_call_times=$_POST["ct_state_call_times"];}
if (isset($_GET["state_call_time_state"])) {$state_call_time_state=$_GET["state_call_time_state"];}
elseif (isset($_POST["state_call_time_state"])) {$state_call_time_state=$_POST["state_call_time_state"];}
if (isset($_GET["state_rule"])) {$state_rule=$_GET["state_rule"];}
@@ -280,6 +278,161 @@ if (isset($_GET["attempt_maximum"])) {$attempt_maximum=$_GET["attempt_maximum
if (isset($script_id)) {$script_id= strtoupper($script_id);}
if (isset($lead_filter_id)) {$lead_filter_id = strtoupper($lead_filter_id);}
##### BEGIN VARIABLE FILTERING FOR SECURITY #####
### DIGITS ONLY ###
$user_level = ereg_replace("[^0-9]","",$user_level);
$wrapup_seconds = ereg_replace("[^0-9]","",$wrapup_seconds);
$xferconf_a_number = ereg_replace("[^0-9]","",$xferconf_a_number);
$xferconf_b_number = ereg_replace("[^0-9]","",$xferconf_b_number);
$drop_call_seconds = ereg_replace("[^0-9]","",$drop_call_seconds);
$voicemail_ext = ereg_replace("[^0-9]","",$voicemail_ext);
$safe_harbor_exten = ereg_replace("[^0-9]","",$safe_harbor_exten);
$am_message_exten = ereg_replace("[^0-9]","",$am_message_exten);
$campaign_rec_exten = ereg_replace("[^0-9]","",$campaign_rec_exten);
$campaign_vdad_exten = ereg_replace("[^0-9]","",$campaign_vdad_exten);
$drop_exten = ereg_replace("[^0-9]","",$drop_exten);
$dial_timeout = ereg_replace("[^0-9]","",$dial_timeout);
$park_ext = ereg_replace("[^0-9]","",$park_ext);
$hopper_level = ereg_replace("[^0-9]","",$hopper_level);
$agent_choose_ingroups = ereg_replace("[^0-9]","",$agent_choose_ingroups);
$hotkeys_active = ereg_replace("[^0-9]","",$hotkeys_active);
$agentonly_callbacks = ereg_replace("[^0-9]","",$agentonly_callbacks);
$agentcall_manual = ereg_replace("[^0-9]","",$agentcall_manual);
$vicidial_recording = ereg_replace("[^0-9]","",$vicidial_recording);
$vicidial_transfers = ereg_replace("[^0-9]","",$vicidial_transfers);
$closer_default_blended = ereg_replace("[^0-9]","",$closer_default_blended);
$alter_agent_interface_options = ereg_replace("[^0-9]","",$alter_agent_interface_options);
$delete_users = ereg_replace("[^0-9]","",$delete_users);
$delete_user_groups = ereg_replace("[^0-9]","",$delete_user_groups);
$delete_scripts = ereg_replace("[^0-9]","",$delete_scripts);
$delete_remote_agents = ereg_replace("[^0-9]","",$delete_remote_agents);
$delete_lists = ereg_replace("[^0-9]","",$delete_lists);
$delete_ingroups = ereg_replace("[^0-9]","",$delete_ingroups);
$delete_filters = ereg_replace("[^0-9]","",$delete_filters);
$delete_campaigns = ereg_replace("[^0-9]","",$delete_campaigns);
$delete_call_times = ereg_replace("[^0-9]","",$delete_call_times);
$load_leads = ereg_replace("[^0-9]","",$delete_call_times);
$campaign_detail = ereg_replace("[^0-9]","",$campaign_detail);
$ast_delete_phones = ereg_replace("[^0-9]","",$ast_delete_phones);
$ast_admin_access = ereg_replace("[^0-9]","",$ast_admin_access);
$modify_leads = ereg_replace("[^0-9]","",$modify_leads);
$change_agent_campaign = ereg_replace("[^0-9]","",$change_agent_campaign);
$modify_call_times = ereg_replace("[^0-9]","",$modify_call_times);
$ct_wednesday_stop = ereg_replace("[^0-9]","",$ct_wednesday_stop);
$ct_wednesday_start = ereg_replace("[^0-9]","",$ct_wednesday_start);
$ct_tuesday_stop = ereg_replace("[^0-9]","",$ct_tuesday_stop);
$ct_tuesday_start = ereg_replace("[^0-9]","",$ct_tuesday_start);
$ct_thursday_stop = ereg_replace("[^0-9]","",$ct_thursday_stop);
$ct_thursday_start = ereg_replace("[^0-9]","",$ct_thursday_start);
$ct_sunday_stop = ereg_replace("[^0-9]","",$ct_sunday_stop);
$ct_sunday_start = ereg_replace("[^0-9]","",$ct_sunday_start);
$ct_saturday_stop = ereg_replace("[^0-9]","",$ct_saturday_stop);
$ct_saturday_start = ereg_replace("[^0-9]","",$ct_saturday_start);
$ct_monday_stop = ereg_replace("[^0-9]","",$ct_monday_stop);
$ct_monday_start = ereg_replace("[^0-9]","",$ct_monday_start);
$ct_friday_stop = ereg_replace("[^0-9]","",$ct_friday_stop);
$ct_friday_start = ereg_replace("[^0-9]","",$ct_friday_start);
$ct_default_stop = ereg_replace("[^0-9]","",$ct_default_stop);
$ct_default_start = ereg_replace("[^0-9]","",$ct_default_start);
$number_of_lines = ereg_replace("[^0-9]","",$number_of_lines);
$user_start = ereg_replace("[^0-9]","",$user_start);
$phone_number = ereg_replace("[^0-9]","",$phone_number);
$remote_agent_id = ereg_replace("[^0-9]","",$remote_agent_id);
$conf_exten = ereg_replace("[^0-9]","",$conf_exten);
$attempt_maximum = ereg_replace("[^0-9]","",$attempt_maximum);
$attempt_delay = ereg_replace("[^0-9]","",$attempt_delay);
$hotkey = ereg_replace("[^0-9]","",$hotkey);
$list_id = ereg_replace("[^0-9]","",$list_id);
### Y or N ONLY ###
$active = ereg_replace("[^NY]","",$active);
$allow_closers = ereg_replace("[^NY]","",$allow_closers);
$reset_hopper = ereg_replace("[^NY]","",$reset_hopper);
$amd_send_to_vmx = ereg_replace("[^NY]","",$amd_send_to_vmx);
$alt_number_dialing = ereg_replace("[^NY]","",$alt_number_dialing);
$scheduled_callbacks = ereg_replace("[^NY]","",$scheduled_callbacks);
$safe_harbor_message = ereg_replace("[^NY]","",$safe_harbor_message);
$selectable = ereg_replace("[^NY]","",$selectable);
$reset_list = ereg_replace("[^NY]","",$reset_list);
$fronter_display = ereg_replace("[^NY]","",$fronter_display);
$drop_message = ereg_replace("[^NY]","",$drop_message);
$use_internal_dnc = ereg_replace("[^NY]","",$use_internal_dnc);
### ALPHA-NUMERIC ONLY ###
$user = ereg_replace("[^0-9a-zA-Z]","",$user);
$pass = ereg_replace("[^0-9a-zA-Z]","",$pass);
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$script_id = ereg_replace("[^0-9a-zA-Z]","",$script_id);
$status = ereg_replace("[^0-9a-zA-Z]","",$status);
$HKstatus = ereg_replace("[^0-9a-zA-Z]","",$HKstatus);
$submit = ereg_replace("[^0-9a-zA-Z]","",$submit);
$CoNfIrM = ereg_replace("[^0-9a-zA-Z]","",$CoNfIrM);
$campaign_cid = ereg_replace("[^0-9a-zA-Z]","",$campaign_cid);
$get_call_launch = ereg_replace("[^0-9a-zA-Z]","",$get_call_launch);
$campaign_recording = ereg_replace("[^0-9a-zA-Z]","",$campaign_recording);
$ADD = ereg_replace("[^0-9a-zA-Z]","",$ADD);
$dial_prefix = ereg_replace("[^0-9a-zA-Z]","",$dial_prefix);
$state_call_time_state = ereg_replace("[^0-9a-zA-Z]","",$state_call_time_state);
### DIGITS and Dots
$server_ip = ereg_replace("[^\.0-9]","",$server_ip);
$auto_dial_level = ereg_replace("[^\.0-9]","",$auto_dial_level);
### DIGITS and spaces and hash and star and comma
$xferconf_a_dtmf = ereg_replace("[^ \,\*\#0-9]","",$xferconf_a_dtmf);
$xferconf_b_dtmf = ereg_replace("[^ \,\*\#0-9]","",$xferconf_b_dtmf);
### ALPHA-NUMERIC and underscore and dash
$dial_status_e = ereg_replace("[^-\_0-9a-zA-Z]","",$dial_status_e);
$dial_status_d = ereg_replace("[^-\_0-9a-zA-Z]","",$dial_status_d);
$dial_status_c = ereg_replace("[^-\_0-9a-zA-Z]","",$dial_status_c);
$dial_status_b = ereg_replace("[^-\_0-9a-zA-Z]","",$dial_status_b);
$dial_status_a = ereg_replace("[^-\_0-9a-zA-Z]","",$dial_status_a);
$stage = ereg_replace("[^-\_0-9a-zA-Z]","",$stage);
$lead_filter_id = ereg_replace("[^-\_0-9a-zA-Z]","",$lead_filter_id);
$campaign_id = ereg_replace("[^-\_0-9a-zA-Z]","",$campaign_id);
$old_campaign_id = ereg_replace("[^-\_0-9a-zA-Z]","",$old_campaign_id);
$park_file_name = ereg_replace("[^-\_0-9a-zA-Z]","",$park_file_name);
$next_agent_call = ereg_replace("[^-\_0-9a-zA-Z]","",$next_agent_call);
$local_call_time = ereg_replace("[^-\_0-9a-zA-Z]","",$local_call_time);
$call_time_id = ereg_replace("[^-\_0-9a-zA-Z]","",$call_time_id);
$phone_pass = ereg_replace("[^-\_0-9a-zA-Z]","",$phone_pass);
$phone_login = ereg_replace("[^-\_0-9a-zA-Z]","",$phone_login);
$group_id = ereg_replace("[^-\_0-9a-zA-Z]","",$group_id);
$user_group = ereg_replace("[^-\_0-9a-zA-Z]","",$user_group);
$OLDuser_group = ereg_replace("[^-\_0-9a-zA-Z]","",$OLDuser_group);
$state_rule = ereg_replace("[^-\_0-9a-zA-Z]","",$state_rule);
### ALPHA-NUMERIC and spaces
$lead_order = ereg_replace("[^ 0-9a-zA-Z]","",$lead_order);
### ALPHA-NUMERIC and hash
$group_color = ereg_replace("[^\#0-9a-zA-Z]","",$group_color);
### ALPHA-NUMERIC and spaces dots, commas, dashes, underscores
$group_name = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$group_name);
$campaign_name = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$campaign_name);
$full_name = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$full_name);
$wrapup_message = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$wrapup_message);
$status_name = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$status_name);
$script_name = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$script_name);
$script_comments = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$script_comments);
$list_name = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$list_name);
$lead_filter_name = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$lead_filter_name);
$lead_filter_comments = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$lead_filter_comments);
$campaign_rec_filename = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$campaign_rec_filename);
$call_time_name = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$call_time_name);
$call_time_comments = ereg_replace("[^ \.\,-\_0-9a-zA-Z]","",$call_time_comments);
### VARIABLES TO BE mysql_real_escape_string ###
# $web_form_address
# $script_text
# $lead_filter_sql
##### END VARIABLE FILTERING FOR SECURITY #####
# AST GUI database administration
# admin.php
#
@@ -336,12 +489,13 @@ if (isset($_GET["attempt_maximum"])) {$attempt_maximum=$_GET["attempt_maximum
# 60608-1401 - Added allowable inbound_groups checkboxes to CLOSER campaign detail screen
# 60609-1051 - Added add-to-dnc in LISTS section
# 60613-1415 - Added lead recycling options to campaign detail screen
# 60619-1523 - Added variable filtering to eliminate SQL injection attack threat
#
# make sure you have added a user to the vicidial_users MySQL table with at least user_level 8 to access this page the first time
$version = '1.1.11-11';
$build = '60613-1415';
$version = '1.1.11-12';
$build = '60619-1523';
$STARTtime = date("U");
@@ -568,7 +722,7 @@ if ( ($ADD>9) && ($ADD < 99998) )
}
}
if ( ( (strlen($ADD)>4) && ($ADD < 99998) ) or ($ADD==3) or ($ADD==31) or ($ADD==41) or ($ADD=="4A") or ($ADD=="4B") )
if ( ( (strlen($ADD)>4) && ($ADD < 99998) ) or ($ADD==3) or ($ADD==21) or ($ADD==31) or ($ADD==41) or ($ADD=="4A") or ($ADD=="4B") )
{
##### get server listing for dynamic pulldown
$stmt="SELECT server_ip,server_description from servers order by server_ip";
@@ -1047,6 +1201,10 @@ echo "<TABLE WIDTH=98% BGCOLOR=#E6E6E6 cellpadding=2 cellspacing=0><TR><TD ALIGN
<BR>
<B>Use Internal DNC List -</B> This defines whether this campaign is to filter leads against the Internal DNC list. If it is set to Y, the hopper will look for each phone number in the DNC list before placing it in the hopper. If it is in the DNC list then it will change that lead status to DNCL so it cannot be dialed. Default is N.
<BR>
<A NAME="vicidial_campaigns-closer_campaigns">
<BR>
<B>Allowed Inbound Groups -</B> For CLOSER campaigns only. Here is where you select the inbound groups you want agents in this CLOSER campaign to be able to take calls from. It is important for BLENDED inbound/outbound campaigns only to select the inbound groups that are used for agents in this campaign. The calls coming into the inbound groups selected here will be counted as active calls for a blended campaign even if all agents in the campaign are not logged in to receive calls from all of those selected inbound groups.
@@ -2053,7 +2211,7 @@ if ($ADD==21)
{
echo "<br><B>CAMPAIGN ADDED: $campaign_id</B>\n";
$stmt="INSERT INTO vicidial_campaigns (campaign_id,campaign_name,active,dial_status_a,lead_order,park_ext,park_file_name,web_form_address,allow_closers,hopper_level,auto_dial_level,next_agent_call,local_call_time,voicemail_ext,campaign_script,get_call_launch) values('$campaign_id','$campaign_name','$active','NEW','DOWN','$park_ext','$park_file_name','$web_form_address','$allow_closers','$hopper_level','$auto_dial_level','$next_agent_call','$local_call_time','$voicemail_ext','$script_id','$get_call_launch');";
$stmt="INSERT INTO vicidial_campaigns (campaign_id,campaign_name,active,dial_status_a,lead_order,park_ext,park_file_name,web_form_address,allow_closers,hopper_level,auto_dial_level,next_agent_call,local_call_time,voicemail_ext,campaign_script,get_call_launch) values('$campaign_id','$campaign_name','$active','NEW','DOWN','$park_ext','$park_file_name','" . mysql_real_escape_string($web_form_address) . "','$allow_closers','$hopper_level','$auto_dial_level','$next_agent_call','$local_call_time','$voicemail_ext','$script_id','$get_call_launch');";
$rslt=mysql_query($stmt, $link);
$stmt="INSERT INTO vicidial_campaign_stats (campaign_id) values('$campaign_id');";
@@ -2271,7 +2429,7 @@ if ($ADD==2111)
}
else
{
$stmt="INSERT INTO vicidial_inbound_groups (group_id,group_name,group_color,active,web_form_address,voicemail_ext,next_agent_call,fronter_display,ingroup_script,get_call_launch) values('$group_id','$group_name','$group_color','$active','$web_form_address','$voicemail_ext','$next_agent_call','$fronter_display','$script_id','$get_call_launch');";
$stmt="INSERT INTO vicidial_inbound_groups (group_id,group_name,group_color,active,web_form_address,voicemail_ext,next_agent_call,fronter_display,ingroup_script,get_call_launch) values('$group_id','$group_name','$group_color','$active','" . mysql_real_escape_string($web_form_address) . "','$voicemail_ext','$next_agent_call','$fronter_display','$script_id','$get_call_launch');";
$rslt=mysql_query($stmt, $link);
echo "<br><B>GROUP ADDED: $group_id</B>\n";
@@ -2280,7 +2438,7 @@ if ($ADD==2111)
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./admin_changes_log.txt", "a");
fwrite ($fp, "$date|ADD A NEW GROUP |$PHP_AUTH_USER|$ip|'$group_id','$group_name','$group_color','$active','$web_form_address','$voicemail_ext','$next_agent_call','$fronter_display','$script_id','$get_call_launch'|\n");
fwrite ($fp, "$date|ADD A NEW GROUP |$PHP_AUTH_USER|$ip|$stmt|\n");
fclose($fp);
}
}
@@ -2386,7 +2544,7 @@ if ($ADD==2111111)
}
else
{
$stmt="INSERT INTO vicidial_scripts values('$script_id','$script_name','$script_comments','$script_text','$active');";
$stmt="INSERT INTO vicidial_scripts values('$script_id','$script_name','$script_comments','" . mysql_real_escape_string($script_text) . "','$active');";
$rslt=mysql_query($stmt, $link);
echo "<br><B>SCRIPT ADDED: $script_id</B>\n";
@@ -2395,7 +2553,7 @@ if ($ADD==2111111)
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./admin_changes_log.txt", "a");
fwrite ($fp, "$date|ADD A NEW SCRIPT ENTRY |$PHP_AUTH_USER|$ip|'$script_id','$script_name','$script_comments','$script_text','$active'|\n");
fwrite ($fp, "$date|ADD A NEW SCRIPT ENTRY |$PHP_AUTH_USER|$ip|$stmt|\n");
fclose($fp);
}
}
@@ -2425,7 +2583,7 @@ if ($ADD==21111111)
}
else
{
$stmt="INSERT INTO vicidial_lead_filters SET lead_filter_id='$lead_filter_id',lead_filter_name='$lead_filter_name',lead_filter_comments='$lead_filter_comments',lead_filter_sql='$lead_filter_sql';";
$stmt="INSERT INTO vicidial_lead_filters SET lead_filter_id='$lead_filter_id',lead_filter_name='$lead_filter_name',lead_filter_comments='$lead_filter_comments',lead_filter_sql='" . mysql_real_escape_string($lead_filter_sql) . "';";
$rslt=mysql_query($stmt, $link);
echo "<br><B>FILTER ADDED: $lead_filter_id</B>\n";
@@ -2434,7 +2592,7 @@ if ($ADD==21111111)
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./admin_changes_log.txt", "a");
fwrite ($fp, "$date|ADD A NEW FILTER ENTRY |$PHP_AUTH_USER|$ip|lead_filter_id='$lead_filter_id',lead_filter_name='$lead_filter_name',lead_filter_comments='$lead_filter_comments',lead_filter_sql='$lead_filter_sql'|\n");
fwrite ($fp, "$date|ADD A NEW FILTER ENTRY |$PHP_AUTH_USER|$ip|$stmt|\n");
fclose($fp);
}
}
@@ -2651,7 +2809,7 @@ if ($ADD==41)
{
echo "<br><B>CAMPAIGN MODIFIED: $campaign_id</B>\n";
$stmtA="UPDATE vicidial_campaigns set campaign_name='$campaign_name',active='$active',dial_status_a='$dial_status_a',dial_status_b='$dial_status_b',dial_status_c='$dial_status_c',dial_status_d='$dial_status_d',dial_status_e='$dial_status_e',lead_order='$lead_order',allow_closers='$allow_closers',hopper_level='$hopper_level', auto_dial_level='$auto_dial_level', next_agent_call='$next_agent_call', local_call_time='$local_call_time', voicemail_ext='$voicemail_ext', dial_timeout='$dial_timeout', dial_prefix='$dial_prefix', campaign_cid='$campaign_cid', campaign_vdad_exten='$campaign_vdad_exten', web_form_address='$web_form_address', park_ext='$park_ext', park_file_name='$park_file_name', campaign_rec_exten='$campaign_rec_exten', campaign_recording='$campaign_recording', campaign_rec_filename='$campaign_rec_filename', campaign_script='$script_id', get_call_launch='$get_call_launch', am_message_exten='$am_message_exten', amd_send_to_vmx='$amd_send_to_vmx', xferconf_a_dtmf='$xferconf_a_dtmf',xferconf_a_number='$xferconf_a_number', xferconf_b_dtmf='$xferconf_b_dtmf',xferconf_b_number='$xferconf_b_number',lead_filter_id='$lead_filter_id',alt_number_dialing='$alt_number_dialing',scheduled_callbacks='$scheduled_callbacks',safe_harbor_message='$safe_harbor_message',drop_call_seconds='$drop_call_seconds',safe_harbor_exten='$safe_harbor_exten',wrapup_seconds='$wrapup_seconds',wrapup_message='$wrapup_message',closer_campaigns='$groups_value',use_internal_dnc='$use_internal_dnc' where campaign_id='$campaign_id';";
$stmtA="UPDATE vicidial_campaigns set campaign_name='$campaign_name',active='$active',dial_status_a='$dial_status_a',dial_status_b='$dial_status_b',dial_status_c='$dial_status_c',dial_status_d='$dial_status_d',dial_status_e='$dial_status_e',lead_order='$lead_order',allow_closers='$allow_closers',hopper_level='$hopper_level', auto_dial_level='$auto_dial_level', next_agent_call='$next_agent_call', local_call_time='$local_call_time', voicemail_ext='$voicemail_ext', dial_timeout='$dial_timeout', dial_prefix='$dial_prefix', campaign_cid='$campaign_cid', campaign_vdad_exten='$campaign_vdad_exten', web_form_address='" . mysql_real_escape_string($web_form_address) . "', park_ext='$park_ext', park_file_name='$park_file_name', campaign_rec_exten='$campaign_rec_exten', campaign_recording='$campaign_recording', campaign_rec_filename='$campaign_rec_filename', campaign_script='$script_id', get_call_launch='$get_call_launch', am_message_exten='$am_message_exten', amd_send_to_vmx='$amd_send_to_vmx', xferconf_a_dtmf='$xferconf_a_dtmf',xferconf_a_number='$xferconf_a_number', xferconf_b_dtmf='$xferconf_b_dtmf',xferconf_b_number='$xferconf_b_number',lead_filter_id='$lead_filter_id',alt_number_dialing='$alt_number_dialing',scheduled_callbacks='$scheduled_callbacks',safe_harbor_message='$safe_harbor_message',drop_call_seconds='$drop_call_seconds',safe_harbor_exten='$safe_harbor_exten',wrapup_seconds='$wrapup_seconds',wrapup_message='$wrapup_message',closer_campaigns='$groups_value',use_internal_dnc='$use_internal_dnc' where campaign_id='$campaign_id';";
$rslt=mysql_query($stmtA, $link);
if ($reset_hopper == 'Y')
@@ -2901,14 +3059,14 @@ if ($ADD==4111)
{
echo "<br><B>GROUP MODIFIED: $group_id</B>\n";
$stmt="UPDATE vicidial_inbound_groups set group_name='$group_name', group_color='$group_color', active='$active', web_form_address='$web_form_address', voicemail_ext='$voicemail_ext', next_agent_call='$next_agent_call', fronter_display='$fronter_display', ingroup_script='$script_id', get_call_launch='$get_call_launch', xferconf_a_dtmf='$xferconf_a_dtmf',xferconf_a_number='$xferconf_a_number', xferconf_b_dtmf='$xferconf_b_dtmf',xferconf_b_number='$xferconf_b_number',drop_message='$drop_message',drop_call_seconds='$drop_call_seconds',drop_exten='$drop_exten' where group_id='$group_id';";
$stmt="UPDATE vicidial_inbound_groups set group_name='$group_name', group_color='$group_color', active='$active', web_form_address='" . mysql_real_escape_string($web_form_address) . "', voicemail_ext='$voicemail_ext', next_agent_call='$next_agent_call', fronter_display='$fronter_display', ingroup_script='$script_id', get_call_launch='$get_call_launch', xferconf_a_dtmf='$xferconf_a_dtmf',xferconf_a_number='$xferconf_a_number', xferconf_b_dtmf='$xferconf_b_dtmf',xferconf_b_number='$xferconf_b_number',drop_message='$drop_message',drop_call_seconds='$drop_call_seconds',drop_exten='$drop_exten' where group_id='$group_id';";
$rslt=mysql_query($stmt, $link);
### LOG CHANGES TO LOG FILE ###
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./admin_changes_log.txt", "a");
fwrite ($fp, "$date|MODIFY GROUP INFO |$PHP_AUTH_USER|$ip|group_name='$group_name',group_color='$group_color',active='$active', web_form_address='$web_form_address', voicemail_ext='$voicemail_ext', next_agent_call='$next_agent_call', fronter_display='$fronter_display', ingroup_script='$script_id', get_call_launch='$get_call_launch', xferconf_a_dtmf='$xferconf_a_dtmf',xferconf_a_number='$xferconf_a_number', xferconf_b_dtmf='$xferconf_b_dtmf',xferconf_b_number='$xferconf_b_number',drop_message='$drop_message',drop_call_seconds='$drop_call_seconds',drop_exten='$drop_exten' where group_id='$group_id'|\n");
fwrite ($fp, "$date|MODIFY GROUP INFO |$PHP_AUTH_USER|$ip|$stmt|\n");
fclose($fp);
}
}
@@ -2999,7 +3157,7 @@ if ($ADD==4111111)
}
else
{
$stmt="UPDATE vicidial_scripts set script_name='$script_name', script_comments='$script_comments', script_text='$script_text', active='$active' where script_id='$script_id';";
$stmt="UPDATE vicidial_scripts set script_name='$script_name', script_comments='$script_comments', script_text='" . mysql_real_escape_string($script_text) . "', active='$active' where script_id='$script_id';";
$rslt=mysql_query($stmt, $link);
echo "<br><B>SCRIPT MODIFIED</B>\n";
@@ -3008,7 +3166,7 @@ if ($ADD==4111111)
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./admin_changes_log.txt", "a");
fwrite ($fp, "$date|MODIFY SCRIPT ENTRY |$PHP_AUTH_USER|$ip|UPDATE vicidial_scripts set script_name='$script_name', script_comments='$script_comments', script_text='$script_text', active='$active' where script_id='$script_id'|\n");
fwrite ($fp, "$date|MODIFY SCRIPT ENTRY |$PHP_AUTH_USER|$ip|$stmt|\n");
fclose($fp);
}
}
@@ -3032,7 +3190,7 @@ if ($ADD==41111111)
}
else
{
$stmt="UPDATE vicidial_lead_filters set lead_filter_name='$lead_filter_name', lead_filter_comments='$lead_filter_comments', lead_filter_sql='$lead_filter_sql' where lead_filter_id='$lead_filter_id';";
$stmt="UPDATE vicidial_lead_filters set lead_filter_name='$lead_filter_name', lead_filter_comments='$lead_filter_comments', lead_filter_sql='" . mysql_real_escape_string($lead_filter_sql) . "' where lead_filter_id='$lead_filter_id';";
$rslt=mysql_query($stmt, $link);
echo "<br><B>FILTER MODIFIED</B>\n";
@@ -3041,7 +3199,7 @@ if ($ADD==41111111)
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./admin_changes_log.txt", "a");
fwrite ($fp, "$date|MODIFY FILTER ENTRY |$PHP_AUTH_USER|$ip|lead_filter_name='$lead_filter_name', lead_filter_comments='$lead_filter_comments', lead_filter_sql='$lead_filter_sql' where lead_filter_id='$lead_filter_id'|\n");
fwrite ($fp, "$date|MODIFY FILTER ENTRY |$PHP_AUTH_USER|$ip|$stmt|\n");
fclose($fp);
}
}
@@ -4687,6 +4845,7 @@ echo "<tr><td>STATUS</td><td>STATUS NAME</td><td>CALLED</td><td>NOT CALLED</td><
$leads_in_list_N = 0;
$leads_in_list_Y = 0;
$stmt="SELECT status,called_since_last_reset,count(*) from vicidial_list where list_id='$list_id' group by status,called_since_last_reset order by status,called_since_last_reset";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$statuses_to_print = mysql_num_rows($rslt);
@@ -4720,27 +4879,30 @@ echo "<tr><td>STATUS</td><td>STATUS NAME</td><td>CALLED</td><td>NOT CALLED</td><
}
$o=0;
while (list($dispo,) = each($lead_list[$since_reset]))
if ($lead_list['count'] > 0)
{
if (eregi("1$|3$|5$|7$|9$", $o))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
if ($dispo == 'CBHOLD')
while (list($dispo,) = each($lead_list[$since_reset]))
{
$CLB="<a href=\"$PHP_SELF?ADD=811&list_id=$list_id\">";
$CLE="</a>";
}
else
{
$CLB='';
$CLE='';
}
echo "<tr $bgcolor><td><font size=1>$CLB$dispo$CLE</td><td><font size=1>$statuses_list[$dispo]</td><td><font size=1>".$lead_list['Y'][$dispo]."</td><td><font size=1>".$lead_list['N'][$dispo]." </td></tr>\n";
$o++;
if (eregi("1$|3$|5$|7$|9$", $o))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
if ($dispo == 'CBHOLD')
{
$CLB="<a href=\"$PHP_SELF?ADD=811&list_id=$list_id\">";
$CLE="</a>";
}
else
{
$CLB='';
$CLE='';
}
echo "<tr $bgcolor><td><font size=1>$CLB$dispo$CLE</td><td><font size=1>$statuses_list[$dispo]</td><td><font size=1>".$lead_list['Y'][$dispo]."</td><td><font size=1>".$lead_list['N'][$dispo]." </td></tr>\n";
$o++;
}
}
echo "<tr><td colspan=2><font size=1>SUBTOTALS</td><td><font size=1>$lead_list[Y_count]</td><td><font size=1>$lead_list[N_count]</td></tr>\n";
@@ -4792,19 +4954,22 @@ echo "<tr><td>GMT OFFSET NOW (local time)</td><td>CALLED</td><td>NOT CALLED</td>
$o++;
}
while (list($tzone,) = each($lead_list[$since_reset]))
if ($lead_list['count'] > 0)
{
$LOCALzone=3600 * $tzone;
$LOCALdate=gmdate("D M Y H:i", time() + $LOCALzone);
while (list($tzone,) = each($lead_list[$since_reset]))
{
$LOCALzone=3600 * $tzone;
$LOCALdate=gmdate("D M Y H:i", time() + $LOCALzone);
if ($tzone >= 0) {$DISPtzone = "$plus$tzone";}
else {$DISPtzone = "$tzone";}
if (eregi("1$|3$|5$|7$|9$", $o))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
if ($tzone >= 0) {$DISPtzone = "$plus$tzone";}
else {$DISPtzone = "$tzone";}
if (eregi("1$|3$|5$|7$|9$", $o))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
echo "<tr $bgcolor><td><font size=1>".$DISPtzone." &nbsp; &nbsp; ($LOCALdate)</td><td><font size=1>".$lead_list['Y'][$tzone]."</td><td><font size=1>".$lead_list['N'][$tzone]."</td></tr>\n";
echo "<tr $bgcolor><td><font size=1>".$DISPtzone." &nbsp; &nbsp; ($LOCALdate)</td><td><font size=1>".$lead_list['Y'][$tzone]."</td><td><font size=1>".$lead_list['N'][$tzone]."</td></tr>\n";
}
}
echo "<tr><td><font size=1>SUBTOTALS</td><td><font size=1>$lead_list[Y_count]</td><td><font size=1>$lead_list[N_count]</td></tr>\n";
VICIDIAL_web/admin_modify_lead.php
+18 -14
View File
@@ -87,6 +87,11 @@ if (isset($_GET["CBuser"])) {$CBuser=$_GET["CBuser"];}
elseif (isset($_POST["CBuser"])) {$CBuser=$_POST["CBuser"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
### AST GUI database administration modify lead in vicidial_list
### admin_modify_lead.php
@@ -97,6 +102,7 @@ if (isset($_GET["CBuser"])) {$CBuser=$_GET["CBuser"];}
# 60419-1705 - Added ability to change lead callback record from USERONLY to ANYONE or USERONLY-user
# 60421-1459 - check GET/POST vars lines with isset to not trigger PHP NOTICES
# 60609-1112 - Added DNC list addition if status changed to DNC
# 60619-1539 - Added variable filtering to eliminate SQL injection attack threat
#
$STARTtime = date("U");
@@ -129,8 +135,6 @@ $browser = getenv("HTTP_USER_AGENT");
if($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name,modify_leads from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -170,12 +174,12 @@ if ($end_call > 0)
$call_length = ($STARTtime - $call_began);
### insert a NEW record to the vicidial_closer_log table
$stmt="INSERT INTO vicidial_closer_log (lead_id,list_id,campaign_id,call_date,start_epoch,end_epoch,length_in_sec,status,phone_code,phone_number,user,comments,processed) values('$lead_id','$list_id','$campaign_id','$parked_time','$call_began','$STARTtime','$call_length','$status','$phone_code','$phone_number','$PHP_AUTH_USER','$comments','Y')";
$stmt="INSERT INTO vicidial_closer_log (lead_id,list_id,campaign_id,call_date,start_epoch,end_epoch,length_in_sec,status,phone_code,phone_number,user,comments,processed) values('" . mysql_real_escape_string($lead_id) . "','" . mysql_real_escape_string($list_id) . "','" . mysql_real_escape_string($campaign_id) . "','" . mysql_real_escape_string($parked_time) . "','" . mysql_real_escape_string($call_began) . "','$STARTtime','" . mysql_real_escape_string($call_length) . "','" . mysql_real_escape_string($status) . "','" . mysql_real_escape_string($phone_code) . "','" . mysql_real_escape_string($phone_number) . "','$PHP_AUTH_USER','" . mysql_real_escape_string($comments) . "','Y')";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
### update the lead record in the vicidial_list table
$stmt="UPDATE vicidial_list set status='$status',first_name='$first_name',last_name='$last_name',address1='$address1',address2='$address2',address3='$address3',city='$city',state='$state',province='$province',postal_code='$postal_code',country_code='$country_code',alt_phone='$alt_phone',email='$email',security_phrase='$security',comments='$comments' where lead_id='$lead_id'";
$stmt="UPDATE vicidial_list set status='" . mysql_real_escape_string($status) . "',first_name='" . mysql_real_escape_string($first_name) . "',last_name='" . mysql_real_escape_string($last_name) . "',address1='" . mysql_real_escape_string($address1) . "',address2='" . mysql_real_escape_string($address2) . "',address3='" . mysql_real_escape_string($address3) . "',city='" . mysql_real_escape_string($city) . "',state='" . mysql_real_escape_string($state) . "',province='" . mysql_real_escape_string($province) . "',postal_code='" . mysql_real_escape_string($postal_code) . "',country_code='" . mysql_real_escape_string($country_code) . "',alt_phone='" . mysql_real_escape_string($alt_phone) . "',email='" . mysql_real_escape_string($email) . "',security_phrase='" . mysql_real_escape_string($security) . "',comments='" . mysql_real_escape_string($comments) . "' where lead_id='" . mysql_real_escape_string($lead_id) . "'";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
@@ -185,7 +189,7 @@ $call_length = ($STARTtime - $call_began);
if ( ($dispo != $status) and ($dispo == 'CBHOLD') )
{
### inactivate vicidial_callbacks record for this lead
$stmt="UPDATE vicidial_callbacks set status='INACTIVE' where lead_id='$lead_id' and status='ACTIVE';";
$stmt="UPDATE vicidial_callbacks set status='INACTIVE' where lead_id='" . mysql_real_escape_string($lead_id) . "' and status='ACTIVE';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
@@ -194,7 +198,7 @@ $call_length = ($STARTtime - $call_began);
if ( ($dispo != $status) and ($dispo == 'CALLBK') )
{
### inactivate vicidial_callbacks record for this lead
$stmt="UPDATE vicidial_callbacks set status='INACTIVE' where lead_id='$lead_id' and status IN('ACTIVE','LIVE');";
$stmt="UPDATE vicidial_callbacks set status='INACTIVE' where lead_id='" . mysql_real_escape_string($lead_id) . "' and status IN('ACTIVE','LIVE');";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
@@ -204,7 +208,7 @@ $call_length = ($STARTtime - $call_began);
if ( ($dispo != $status) and ($status == 'DNC') )
{
### add lead to the internal DNC list
$stmt="INSERT INTO vicidial_dnc (phone_number) values('$phone_number');";
$stmt="INSERT INTO vicidial_dnc (phone_number) values('" . mysql_real_escape_string($phone_number) . "');";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
@@ -218,7 +222,7 @@ else
if ($CBchangeUSERtoANY == 'YES')
{
### inactivate vicidial_callbacks record for this lead
$stmt="UPDATE vicidial_callbacks set recipient='ANYONE' where callback_id='$callback_id';";
$stmt="UPDATE vicidial_callbacks set recipient='ANYONE' where callback_id='" . mysql_real_escape_string($callback_id) . "';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
@@ -227,7 +231,7 @@ else
if ($CBchangeUSERtoUSER == 'YES')
{
### inactivate vicidial_callbacks record for this lead
$stmt="UPDATE vicidial_callbacks set user='$CBuser' where callback_id='$callback_id';";
$stmt="UPDATE vicidial_callbacks set user='" . mysql_real_escape_string($CBuser) . "' where callback_id='" . mysql_real_escape_string($callback_id) . "';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
@@ -236,7 +240,7 @@ else
if ($CBchangeANYtoUSER == 'YES')
{
### inactivate vicidial_callbacks record for this lead
$stmt="UPDATE vicidial_callbacks set user='$CBuser',recipient='USERONLY' where callback_id='$callback_id';";
$stmt="UPDATE vicidial_callbacks set user='" . mysql_real_escape_string($CBuser) . "',recipient='USERONLY' where callback_id='" . mysql_real_escape_string($callback_id) . "';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
@@ -245,7 +249,7 @@ else
$stmt="SELECT count(*) from vicidial_list where lead_id='$lead_id'";
$stmt="SELECT count(*) from vicidial_list where lead_id='" . mysql_real_escape_string($lead_id) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -254,7 +258,7 @@ else
if ($lead_count > 0)
{
$stmt="SELECT * from vicidial_list where lead_id='$lead_id'";
$stmt="SELECT * from vicidial_list where lead_id='" . mysql_real_escape_string($lead_id) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -347,7 +351,7 @@ else
if ( ($dispo == 'CALLBK') or ($dispo == 'CBHOLD') )
{
### find any vicidial_callback records for this lead
$stmt="select * from vicidial_callbacks where lead_id='$lead_id' and status IN('ACTIVE','LIVE') order by callback_id desc LIMIT 1;";
$stmt="select * from vicidial_callbacks where lead_id='" . mysql_real_escape_string($lead_id) . "' and status IN('ACTIVE','LIVE') order by callback_id desc LIMIT 1;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$CB_to_print = mysql_num_rows($rslt);
@@ -411,7 +415,7 @@ echo "<B>CALLS TO THIS LEAD:</B>\n";
echo "<TABLE width=550 cellspacing=0 cellpadding=1>\n";
echo "<tr><td><font size=2>DATE/TIME </td><td align=left><font size=2>LENGTH</td><td align=left><font size=2> STATUS</td><td align=left><font size=2> TSR</td><td align=right><font size=2> CAMPAIGN</td><td align=right><font size=2> LIST</td><td align=right><font size=2> LEAD</td></tr>\n";
$stmt="select * from vicidial_log where lead_id='$lead_id' order by uniqueid desc limit 50;";
$stmt="select * from vicidial_log where lead_id='" . mysql_real_escape_string($lead_id) . "' order by uniqueid desc limit 50;";
$rslt=mysql_query($stmt, $link);
$logs_to_print = mysql_num_rows($rslt);
VICIDIAL_web/admin_search_lead.php
+68 -35
View File
@@ -3,28 +3,37 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
### AST GUI database administration search for lead info
### admin_modify_lead.php
#
# this is the administration lead information modifier screen, the administrator just needs to enter the leadID and then they can view and modify the information in the record for that lead
#
# changes:
# 60620-1055 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
# - Changed results to multi-record
#
require("dbconnect.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["vendor_id"])) {$vendor_id=$_GET["vendor_id"];}
elseif (isset($_POST["vendor_id"])) {$vendor_id=$_POST["vendor_id"];}
if (isset($_GET["vendor_id"])) {$vendor_id=$_GET["vendor_id"];}
elseif (isset($_POST["vendor_id"])) {$vendor_id=$_POST["vendor_id"];}
if (isset($_GET["phone"])) {$phone=$_GET["phone"];}
elseif (isset($_POST["phone"])) {$phone=$_POST["phone"];}
if (isset($_GET["lead_id"])) {$lead_id=$_GET["lead_id"];}
elseif (isset($_POST["lead_id"])) {$lead_id=$_POST["lead_id"];}
if (isset($_GET["lead_id"])) {$lead_id=$_GET["lead_id"];}
elseif (isset($_POST["lead_id"])) {$lead_id=$_POST["lead_id"];}
if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
### AST GUI database administration search for lead info
### admin_modify_lead.php
# this is the administration lead information modifier screen, the administrator just needs to enter the leadID and then they can view and modify the information in the record for that lead
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
@@ -97,6 +106,7 @@ if ( (!$vendor_id) and (!$phone) and (!$lead_id) )
echo date("l F j, Y G:i:s A");
echo "\n<br><br><center>\n";
echo "<form method=post name=search action=\"$PHP_SELF\">\n";
echo "<input type=hidden name=DB value=\"$DB\">\n";
echo "<b>Please enter a:<br> Vendor ID(vendor lead code): <input type=text name=vendor_id size=10 maxlength=10> or \n";
echo "<br><b>a Home Phone Number: <input type=text name=phone size=10 maxlength=10> or\n";
echo "<br><b>a lead ID: <input type=text name=lead_id size=10 maxlength=10> <br><br>\n";
@@ -111,19 +121,19 @@ else
if ($vendor_id)
{
$stmt="SELECT * from vicidial_list where vendor_lead_code='$vendor_id'";
$stmt="SELECT * from vicidial_list where vendor_lead_code='" . mysql_real_escape_string($vendor_id) . "' order by modify_date desc limit 1000";
}
else
{
if ($phone)
{
$stmt="SELECT * from vicidial_list where phone_number='$phone'";
$stmt="SELECT * from vicidial_list where phone_number='" . mysql_real_escape_string($phone) . "' order by modify_date desc limit 1000";
}
else
{
if ($lead_id)
{
$stmt="SELECT * from vicidial_list where lead_id='$lead_id'";
$stmt="SELECT * from vicidial_list where lead_id='" . mysql_real_escape_string($lead_id) . "' order by modify_date desc limit 1000";
}
else
{
@@ -132,13 +142,14 @@ else
}
}
}
if (eregi('10.10.10.2',$ip))
if ($DB)
{
echo "\n\n$stmt\n\n";
}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
if ( (strlen($row[0]) < 3) && (strlen($row[1]) < 3) )
$results_to_print = mysql_num_rows($rslt);
if ($results_to_print < 1)
{
echo date("l F j, Y G:i:s A");
echo "\n<br><br><center>\n";
@@ -150,24 +161,46 @@ else
}
else
{
echo "\n<PRE>\n\n";
echo "lead ID: $row[0]\n";
echo "status: $row[3]\n";
echo "vendor_id: $row[5]\n";
echo "last rep called: $row[4]\n";
echo "list_id: $row[7]\n";
echo "phone: $row[11]\n";
echo "Name: $row[13] $row[15]\n";
echo "City: $row[19]\n";
echo "Security: $row[28]\n";
echo "Comments: $row[29]\n\n";
echo "\n";
echo "</PRE>\n";
# https://www.vicimarketing.com/internal/back_end_sys/uk_cust_serv/index.php?person_id=$row[7]&people_packages_id=&secure_lvl=2&display=2&username=$username&passwd=$passwd
echo "<a href=\"admin_modify_lead.php?lead_id=$row[0]\">Click here to see the Lead Details</a>\n";
}
echo "<b>RESULTS: $results_to_print</b><BR><BR>\n";
echo "<TABLE BGCOLOR=WHITE CELLPADDING=1 CELLSPACING=0>\n";
echo "<TR BGCOLOR=BLACK>\n";
echo "<TD ALIGN=LEFT><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>#</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>LEAD ID</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>STATUS</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>VENDOR ID</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>LAST AGENT</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>LIST ID</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>PHONE</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>NAME</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>CITY</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>SECURITY</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>LAST CALL</B></FONT></TD>\n";
echo "</TR>\n";
$o=0;
while ($results_to_print > $o)
{
$row=mysql_fetch_row($rslt);
$o++;
if (eregi("1$|3$|5$|7$|9$", $o))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
echo "<TR $bgcolor>\n";
echo "<TD ALIGN=LEFT><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$o</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1><a href=\"admin_modify_lead.php?lead_id=$row[0]\">$row[0]</a></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[3]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[5]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[4]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[7]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[11]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[13] $row[15]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[19]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[28]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[2]</FONT></TD>\n";
echo "</TR>\n";
}
echo "</TABLE>\n";
}
}
VICIDIAL_web/closer-fronter_popup.php
+12 -6
View File
@@ -4,6 +4,10 @@
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# this is the closer popup of a specific call that starts recording the call and allows you to go and fetch info on that caller in the local CRM system.
# CHANGES
#
# 60620-1020 - Added variable filtering to eliminate SQL injection attack threat
#
require("dbconnect.php");
@@ -91,6 +95,8 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
#$DB = '1'; # DEBUG override
$US = '_';
@@ -235,15 +241,15 @@ if ($parked_count > 0)
# Local/78600098@demo-6617,2
$stmt = "INSERT INTO vicidial_manager values('','','$SQLdate','NEW','N','$server_ip','','Originate','$DTqueryCID','Channel: $local_DEF$conf_silent_prefix$session_id$local_AMP$ext_context','Context: $ext_context','Exten: $recording_exten','Priority: 1','Callerid: $filename','','','','','')";
$stmt = "INSERT INTO vicidial_manager values('','','$SQLdate','NEW','N','" . mysql_real_escape_string($server_ip) . "','','Originate','$DTqueryCID','Channel: $local_DEF$conf_silent_prefix" . mysql_real_escape_string($session_id) . "$local_AMP$ext_context','Context: $ext_context','Exten: $recording_exten','Priority: 1','Callerid: " . mysql_real_escape_string($filename) . "','','','','','')";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$stmt = "INSERT INTO recording_log (channel,server_ip,extension,start_time,start_epoch,filename) values('Zap/$channel','$server_ip','SIP/$SIPexten','$NOW_TIME','$STARTtime','$filename')";
$stmt = "INSERT INTO recording_log (channel,server_ip,extension,start_time,start_epoch,filename) values('Zap/" . mysql_real_escape_string($channel) . "','" . mysql_real_escape_string($server_ip) . "','SIP/" . mysql_real_escape_string($SIPexten) . "','$NOW_TIME','$STARTtime','" . mysql_real_escape_string($filename) . "')";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$stmt="SELECT recording_id FROM recording_log where filename='$filename'";
$stmt="SELECT recording_id FROM recording_log where filename='" . mysql_real_escape_string($filename) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -251,7 +257,7 @@ if ($parked_count > 0)
echo "Recording command sent for channel $channel - $filename - $recording_id &nbsp; &nbsp; &nbsp; $NOW_TIME\n<BR><BR>\n";
$stmt="SELECT full_name from vicidial_users where user='$user'";
$stmt="SELECT full_name from vicidial_users where user='" . mysql_real_escape_string($user) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -279,7 +285,7 @@ if (eregi('CL_TEST',$channel_group))
{
echo "GALLERIA TEST CLOSER GROUP: $channel_group\n";
$stmt="SELECT user,phone_number from vicidial_list where lead_id='$parked_by';";
$stmt="SELECT user,phone_number from vicidial_list where lead_id='" . mysql_real_escape_string($parked_by) . "';";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -314,7 +320,7 @@ if ( (eregi('CL_MWCOF',$channel_group)) or (eregi('MWCOF',$group)) or (eregi('TE
{
echo "BUYERS EDGE INTERNAL CLOSER GROUP: $channel_group\n";
$stmt="SELECT user,phone_number from vicidial_list where lead_id='$parked_by';";
$stmt="SELECT user,phone_number from vicidial_list where lead_id='" . mysql_real_escape_string($parked_by) . "';";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
VICIDIAL_web/closer-fronter_popup2.php
+12 -6
View File
@@ -4,6 +4,10 @@
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# this is the closer popup of a specific call that starts recording the call and allows you to go and fetch info on that caller in the local CRM system.
# CHANGES
#
# 60620-1025 - Added variable filtering to eliminate SQL injection attack threat
#
require("dbconnect.php");
@@ -91,6 +95,8 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
#$DB = '1'; # DEBUG override
$US = '_';
@@ -221,7 +227,7 @@ else
<?
$stmt="SELECT count(*) from live_channels where server_ip='$server_ip' and channel='$customer_zap_channel'";
$stmt="SELECT count(*) from live_channels where server_ip='" . mysql_real_escape_string($server_ip) . "' and channel='" . mysql_real_escape_string($customer_zap_channel) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -249,15 +255,15 @@ if ($parked_count > 0)
# Local/78600098@demo-6617,2
$stmt = "INSERT INTO vicidial_manager values('','','$SQLdate','NEW','N','$server_ip','','Originate','$DTqueryCID','Channel: $local_DEF$conf_silent_prefix$session_id$local_AMP$ext_context','Context: $ext_context','Exten: $recording_exten','Priority: 1','Callerid: $filename','','','','','')";
$stmt = "INSERT INTO vicidial_manager values('','','$SQLdate','NEW','N','" . mysql_real_escape_string($server_ip) . "','','Originate','$DTqueryCID','Channel: $local_DEF$conf_silent_prefix" . mysql_real_escape_string($session_id) . "$local_AMP$ext_context','Context: $ext_context','Exten: $recording_exten','Priority: 1','Callerid: " . mysql_real_escape_string($filename) . "','','','','','')";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$stmt = "INSERT INTO recording_log (channel,server_ip,extension,start_time,start_epoch,filename) values('$channel','$server_ip','SIP/$SIPexten','$NOW_TIME','$STARTtime','$filename')";
$stmt = "INSERT INTO recording_log (channel,server_ip,extension,start_time,start_epoch,filename) values('$channel','" . mysql_real_escape_string($server_ip) . "','SIP/" . mysql_real_escape_string($SIPexten) . "','$NOW_TIME','$STARTtime','" . mysql_real_escape_string($filename) . "')";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$stmt="SELECT recording_id FROM recording_log where filename='$filename'";
$stmt="SELECT recording_id FROM recording_log where filename='" . mysql_real_escape_string($filename) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -265,7 +271,7 @@ if ($parked_count > 0)
echo "Recording command sent for channel $channel - $filename - $recording_id &nbsp; &nbsp; &nbsp; $NOW_TIME\n<BR><BR>\n";
$stmt="SELECT full_name from vicidial_users where user='$fronter'";
$stmt="SELECT full_name from vicidial_users where user='" . mysql_real_escape_string($fronter) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -278,7 +284,7 @@ if ($parked_count > 0)
echo "<a href=\"$url\">View Customer Info and Disposition Call</a>\n<BR><BR>\n";
$stmt="SELECT group_name,group_color from vicidial_inbound_groups where group_id='$channel_group'";
$stmt="SELECT group_name,group_color from vicidial_inbound_groups where group_id='" . mysql_real_escape_string($channel_group) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
VICIDIAL_web/closer.php
+13 -5
View File
@@ -4,6 +4,11 @@
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# the purpose of this script and webpage is to allow for remote or local users of the system to log in and grab phone calls that are coming inbound into the Asterisk server and being put in the parked_channels table while they hear a soundfile for a limited amount of time before being forwarded on to either a set extension or a voicemail box. This gives remote or local agents a way to grab calls without tying up their phone lines all day. The agent sees the refreshing screen of calls on park and when they want to take one they just click on it, and a small window opens that will allow them to grab the call and/or look up more information on the caller through the callerID that is given(if available)
# CHANGES
#
# 60620-1032 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
@@ -43,6 +48,9 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
@@ -128,13 +136,13 @@ if (!$dialplan_number)
if ($extension)
{
$stmt="SELECT count(*) from phones where extension='$extension';";
$stmt="SELECT count(*) from phones where extension='" . mysql_real_escape_string($extension) . "';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$ext_found=$row[0];
if ($ext_found > 0)
{
$stmt="SELECT dialplan_number,server_ip from phones where extension='$extension';";
$stmt="SELECT dialplan_number,server_ip from phones where extension='" . mysql_real_escape_string($extension) . "';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$dialplan_number=$row[0];
@@ -181,7 +189,7 @@ if (!$dialplan_number)
$o++;
}
$stmt="INSERT INTO vicidial_user_log values('','$user','LOGIN','CLOSER','$NOW_TIME','$STARTtime');";
$stmt="INSERT INTO vicidial_user_log values('','" . mysql_real_escape_string($user) . "','LOGIN','CLOSER','$NOW_TIME','$STARTtime');";
$rslt=mysql_query($stmt, $link);
echo "<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n";
@@ -245,14 +253,14 @@ echo "--------------------------------------------------------------------------
$stmt="SELECT count(*) from parked_channels where server_ip='$server_ip'";
$stmt="SELECT count(*) from parked_channels where server_ip='" . mysql_real_escape_string($server_ip) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
$parked_count = $row[0];
if ($parked_count > 0)
{
$stmt="SELECT * from parked_channels where server_ip='$server_ip' and channel_group LIKE \"CL_%\" order by channel_group,parked_time";
$stmt="SELECT * from parked_channels where server_ip='" . mysql_real_escape_string($server_ip) . "' and channel_group LIKE \"CL_%\" order by channel_group,parked_time";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$parked_to_print = mysql_num_rows($rslt);
VICIDIAL_web/closer_dispo.php
+15 -6
View File
@@ -4,6 +4,10 @@
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# this is the closer disposition screen of a call that has been grabbed. This allows the closer to modify customer information and disposition the call
# CHANGES
#
# 60619-1641 - Added variable filtering to eliminate SQL injection attack threat
#
require("dbconnect.php");
@@ -77,6 +81,11 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
@@ -147,16 +156,16 @@ if ($end_call > 0)
$call_length = ($STARTtime - $call_began);
### insert a NEW record to the vicidial_closer_log table
$stmt="INSERT INTO vicidial_closer_log (lead_id,list_id,campaign_id,call_date,start_epoch,end_epoch,length_in_sec,status,phone_code,phone_number,user,comments,processed) values('$lead_id','$list_id','$campaign_id','$parked_time','$call_began','$STARTtime','$call_length','$status','$phone_code','$phone_number','$PHP_AUTH_USER','$comments','Y')";
$stmt="INSERT INTO vicidial_closer_log (lead_id,list_id,campaign_id,call_date,start_epoch,end_epoch,length_in_sec,status,phone_code,phone_number,user,comments,processed) values('" . mysql_real_escape_string($lead_id) . "','" . mysql_real_escape_string($list_id) . "','" . mysql_real_escape_string($campaign_id) . "','" . mysql_real_escape_string($parked_time) . "','" . mysql_real_escape_string($call_began) . "','$STARTtime','" . mysql_real_escape_string($call_length) . "','" . mysql_real_escape_string($status) . "','" . mysql_real_escape_string($phone_code) . "','" . mysql_real_escape_string($phone_number) . "','$PHP_AUTH_USER','" . mysql_real_escape_string($comments) . "','Y')";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
### update the lead record in the vicidial_list table
$stmt="UPDATE vicidial_list set status='$status',first_name='$first_name',last_name='$last_name',address1='$address1',address2='$address2',address3='$address3',city='$city',state='$state',province='$province',postal_code='$postal_code',country_code='$country_code',alt_phone='$alt_phone',email='$email',security_phrase='$security',comments='$comments' where lead_id='$lead_id'";
$stmt="UPDATE vicidial_list set status='" . mysql_real_escape_string($status) . "',first_name='" . mysql_real_escape_string($first_name) . "',last_name='" . mysql_real_escape_string($last_name) . "',address1='" . mysql_real_escape_string($address1) . "',address2='" . mysql_real_escape_string($address2) . "',address3='" . mysql_real_escape_string($address3) . "',city='" . mysql_real_escape_string($city) . "',state='" . mysql_real_escape_string($state) . "',province='" . mysql_real_escape_string($province) . "',postal_code='" . mysql_real_escape_string($postal_code) . "',country_code='" . mysql_real_escape_string($country_code) . "',alt_phone='" . mysql_real_escape_string($alt_phone) . "',email='" . mysql_real_escape_string($email) . "',security_phrase='" . mysql_real_escape_string($security) . "',comments='" . mysql_real_escape_string($comments) . "' where lead_id='" . mysql_real_escape_string($lead_id) . "'";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$stmt="SELECT count(*) from live_channels where server_ip='$server_ip' and channel='$channel' and extension like \"%$extension%\"";
$stmt="SELECT count(*) from live_channels where server_ip='$server_ip' and channel='" . mysql_real_escape_string($channel) . "' and extension like \"%" . mysql_real_escape_string($extension) . "%\"";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -168,7 +177,7 @@ $call_length = ($STARTtime - $call_began);
$DTqueryCID = "RR$FILE_datetime$PHP_AUTH_USER";
### insert a NEW record to the vicidial_manager table to be processed
$stmt="INSERT INTO vicidial_manager values('','','$NOW_TIME','NEW','N','$server_ip','','Hangup','$DTqueryCID','Channel: $channel','','','','','','','','','')";
$stmt="INSERT INTO vicidial_manager values('','','$NOW_TIME','NEW','N','" . mysql_real_escape_string($server_ip) . "','','Hangup','$DTqueryCID','Channel: " . mysql_real_escape_string($channel) . "','','','','','','','','','')";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
@@ -184,7 +193,7 @@ $call_length = ($STARTtime - $call_began);
}
else
{
$stmt="SELECT count(*) from vicidial_list where lead_id='$lead_id'";
$stmt="SELECT count(*) from vicidial_list where lead_id='" . mysql_real_escape_string($lead_id) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -193,7 +202,7 @@ else
if ($lead_count > 0)
{
$stmt="SELECT * from vicidial_list where lead_id='$lead_id'";
$stmt="SELECT * from vicidial_list where lead_id='" . mysql_real_escape_string($lead_id) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
VICIDIAL_web/closer_popup.php
+13 -6
View File
@@ -4,6 +4,10 @@
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# this is the closer popup of a specific call that grabs the call and allows you to go and fetch info on that caller in the local CRM system.
# CHANGES
#
# 60620-1029 - Added variable filtering to eliminate SQL injection attack threat
#
require("dbconnect.php");
@@ -43,6 +47,9 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
#$DB=1;
$US = '_';
@@ -153,7 +160,7 @@ $parked_count = $row[0];
if ($parked_count > 0)
{
$stmt="DELETE from parked_channels where server_ip='$server_ip' and parked_time='$parked_time' and channel='$channel' LIMIT 1";
$stmt="DELETE from parked_channels where server_ip='" . mysql_real_escape_string($server_ip) . "' and parked_time='" . mysql_real_escape_string($parked_time) . "' and channel='" . mysql_real_escape_string($channel) . "' LIMIT 1";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
@@ -181,13 +188,13 @@ if ($parked_count > 0)
# echo "Recording command sent for channel $channel - $filename - $recording_id<BR>\n";
### insert a NEW record to the vicidial_manager table to be processed
$stmt="INSERT INTO vicidial_manager values('','','$NOW_TIME','NEW','N','$server_ip','','Redirect','$DTqueryCID','Exten: $dialplan_number','Channel: $channel','Context: $ext_context','Priority: 1','Callerid: $DTqueryCID','','','','','')";
$stmt="INSERT INTO vicidial_manager values('','','$NOW_TIME','NEW','N','" . mysql_real_escape_string($server_ip) . "','','Redirect','$DTqueryCID','Exten: $dialplan_number','Channel: " . mysql_real_escape_string($channel) . "','Context: $ext_context','Priority: 1','Callerid: $DTqueryCID','','','','','')";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
echo "Redirect command sent for channel $channel &nbsp; &nbsp; &nbsp; $NOW_TIME\n<BR><BR>\n";
$stmt="SELECT full_name from vicidial_users where user='$parked_by'";
$stmt="SELECT full_name from vicidial_users where user='" . mysql_real_escape_string($parked_by) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -201,7 +208,7 @@ if ($parked_count > 0)
$stmt="UPDATE park_log set grab_time='$NOW_TIME',status='TALKING',extension='$extension',user='$PHP_AUTH_USER' where parked_time='$parked_time' and server_ip='$server_ip' and channel='$channel'";
$stmt="UPDATE park_log set grab_time='$NOW_TIME',status='TALKING',extension='" . mysql_real_escape_string($extension) . "',user='$PHP_AUTH_USER' where parked_time='" . mysql_real_escape_string($parked_time) . "' and server_ip='" . mysql_real_escape_string($server_ip) . "' and channel='" . mysql_real_escape_string($channel) . "'";
if ($DB) {echo "|$stmt|\n";}
$fp = fopen ("./closer_SQL_updates.txt", "a");
fwrite ($fp, "$date|$PHP_AUTH_USER|$stmt|\n");
@@ -217,7 +224,7 @@ if (eregi('CL_TEST',$channel_group))
{
echo "GALLERIA TEST CLOSER GROUP: $channel_group\n";
$stmt="SELECT user,phone_number from vicidial_list where lead_id='$parked_by';";
$stmt="SELECT user,phone_number from vicidial_list where lead_id='" . mysql_real_escape_string($parked_by) . "';";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -252,7 +259,7 @@ if (eregi('CL_MWCOF',$channel_group))
{
echo "GALLERIA INTERNAL CLOSER GROUP: $channel_group\n";
$stmt="SELECT user,phone_number from vicidial_list where lead_id='$parked_by';";
$stmt="SELECT user,phone_number from vicidial_list where lead_id='" . mysql_real_escape_string($parked_by) . "';";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
VICIDIAL_web/group_hourly_stats.php
+26 -4
View File
@@ -3,6 +3,11 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60620-1014 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
@@ -20,6 +25,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$date_with_hour_default = date("Y-m-d H");
@@ -98,7 +120,7 @@ echo "<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=utf-8\">\n"
if ( ($group) and ($status) and ($date_with_hour) )
{
$stmt="SELECT user,full_name from vicidial_users where user_group = '$group' order by full_name desc;";
$stmt="SELECT user,full_name from vicidial_users where user_group = '" . mysql_real_escape_string($group) . "' order by full_name desc;";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$tsrs_to_print = mysql_num_rows($rslt);
@@ -114,19 +136,19 @@ $tsrs_to_print = mysql_num_rows($rslt);
$o=0;
while($o < $tsrs_to_print)
{
$stmt="select count(*) from vicidial_log where call_date >= '$date_with_hour:00:00' and call_date <= '$date_with_hour:59:59' and user='$VDuser[$o]';";
$stmt="select count(*) from vicidial_log where call_date >= '" . mysql_real_escape_string($date_with_hour) . ":00:00' and call_date <= '" . mysql_real_escape_string($date_with_hour) . ":59:59' and user='$VDuser[$o]';";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$VDtotal[$o] = "$row[0]";
$stmt="select count(*) from vicidial_log where call_date >= '$date_no_hour 00:00:00' and call_date <= '$date_no_hour 23:59:59' and user='$VDuser[$o]' and status='$status';";
$stmt="select count(*) from vicidial_log where call_date >= '" . mysql_real_escape_string($date_no_hour) . " 00:00:00' and call_date <= '" . mysql_real_escape_string($date_no_hour) . " 23:59:59' and user='$VDuser[$o]' and status='" . mysql_real_escape_string($status) . "';";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$VDday[$o] = "$row[0]";
$stmt="select count(*) from vicidial_log where call_date >= '$date_with_hour:00:00' and call_date <= '$date_with_hour:59:59' and user='$VDuser[$o]' and status='$status';";
$stmt="select count(*) from vicidial_log where call_date >= '" . mysql_real_escape_string($date_with_hour) . ":00:00' and call_date <= '" . mysql_real_escape_string($date_with_hour) . ":59:59' and user='$VDuser[$o]' and status='" . mysql_real_escape_string($status) . "';";
if ($DB) {echo "$stmt\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
VICIDIAL_web/listloader.php
+8 -2
View File
@@ -10,10 +10,14 @@
# 51128-1108 - Removed PHP global vars requirement
# 60421-1043 - check GET/POST vars lines with isset to not trigger PHP NOTICES
# 60616-1006 - added listID override and gmt_offset lookup while loading
# 60619-1652 - Added variable filtering to eliminate SQL injection attack threat
#
# make sure vicidial_list exists and that your file follows the formatting correctly. This page does not dedupe or do any other lead filtering actions yet at this time.
#
$version = '1.1.12';
$build = '60619-1652';
header ("Content-type: text/html; charset=utf-8");
require("dbconnect.php");
@@ -34,8 +38,10 @@ $SUBMIT=$_GET["SUBMIT"]; if (!$SUBMIT) {$SUBMIT=$_POST["SUBMIT"];}
#$DB=1;
#$DBX=1;
$version = '1.1.12';
$build = '60616-1006';
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$list_id_override = ereg_replace("[^0-9]","",$list_id_override);
$script_name = getenv("SCRIPT_NAME");
$server_name = getenv("SERVER_NAME");
VICIDIAL_web/listloaderMAIN.php
+7
View File
@@ -5,6 +5,10 @@
#
# this is the main frame page for the lead loading section. This is where you
# would upload a file and have it inserted into vicidial_list
#
# changes:
# 60620-1149 - Added variable filtering to eliminate SQL injection attack threat
#
require("dbconnect.php");
@@ -12,6 +16,9 @@ $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_SELF=$_SERVER['PHP_SELF'];
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
VICIDIAL_web/new_listloader_superL.php
+9 -2
View File
@@ -12,11 +12,12 @@
# 60421-1624 - check GET/POST vars lines with isset to not trigger PHP NOTICES
# 60616-1240 - added listID override
# 60616-1604 - added gmt lookup for each lead
# 60619-1651 - Added variable filtering to eliminate SQL injection attack threat
#
# make sure vicidial_list exists and that your file follows the formatting correctly. This page does not dedupe or do any other lead filtering actions yet at this time.
$version = '1.1.12';
$build = '60616-1604';
$version = '1.1.12-1';
$build = '60619-1651';
require("dbconnect.php");
@@ -96,6 +97,12 @@ if (isset($_GET["list_id_override"])) {$list_id_override=$_GET["list_id_overr
# $country_field=$_GET["country_field"]; if (!$country_field) {$country_field=$_POST["country_field"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$list_id_override = ereg_replace("[^0-9]","",$list_id_override);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
VICIDIAL_web/record_conf_1_hour.php
+25 -2
View File
@@ -4,6 +4,12 @@
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# grab: $server_ip $station $session_id
#
# CHANGES
#
# 60620-1011 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
@@ -23,6 +29,23 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$MYSQL_datetime = date("Y-m-d H:i:s");
@@ -97,11 +120,11 @@ if ($NEW_RECORDING)
$conf_silent_prefix = '7';
$ext_context = 'demo';
$stmt="INSERT INTO vicidial_manager values('','','$MYSQL_datetime','NEW','N','$server_ip','','Originate','RB$FILE_datetime$station','Channel: $local_DEF$conf_silent_prefix$session_id$local_AMP$ext_context','Context: $ext_context','Exten: 8309','Priority: 1','Callerid: $FILE_datetime$station','','','','','')";
$stmt="INSERT INTO vicidial_manager values('','','$MYSQL_datetime','NEW','N','" . mysql_real_escape_string($server_ip) . "','','Originate','RB$FILE_datetime" . mysql_real_escape_string($station) . "','Channel: $local_DEF$conf_silent_prefix" . mysql_real_escape_string($session_id) . "$local_AMP$ext_context','Context: $ext_context','Exten: 8309','Priority: 1','Callerid: $FILE_datetime" . mysql_real_escape_string($station) . "','','','','','')";
echo "|$stmt|\n<BR><BR>\n";
$rslt=mysql_query($stmt, $link);
$stmt="INSERT INTO recording_log (channel,server_ip,extension,start_time,start_epoch,filename) values('$session_id','$server_ip','$station','$MYSQL_datetime','$secX','$FILE_datetime$station')";
$stmt="INSERT INTO recording_log (channel,server_ip,extension,start_time,start_epoch,filename) values('" . mysql_real_escape_string($session_id) . "','" . mysql_real_escape_string($server_ip) . "','" . mysql_real_escape_string($station) . "','$MYSQL_datetime','$secX','$FILE_datetime" . mysql_real_escape_string($station) . "')";
echo "|$stmt|\n<BR><BR>\n";
$rslt=mysql_query($stmt, $link);
VICIDIAL_web/remote_dispo.php
+14 -6
View File
@@ -5,6 +5,11 @@
###
# this is the remote agent disposition screen for calls sent to remote agents. This allows the remote agent to modify customer information and disposition the call
# CHANGES
#
# 60619-1626 - Added variable filtering to eliminate SQL injection attack threat
#
require("dbconnect.php");
@@ -101,8 +106,11 @@ $ext_context = 'demo';
if (!isset($begin_date)) {$begin_date = $TODAY;}
if (!isset($end_date)) {$end_date = $TODAY;}
#$link=mysql_connect("localhost", "cron", "1234");
#mysql_select_db("asterisk");
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 2;";
if ($DB) {echo "$stmt\n";}
@@ -167,12 +175,12 @@ if ($end_call > 0)
$call_length = ($STARTtime - $call_began);
### insert a NEW record to the vicidial_closer_log table
$stmt="UPDATE vicidial_closer_log set end_epoch='$STARTtime', length_in_sec='$call_length', status='$status', user='$PHP_AUTH_USER' where lead_id='$lead_id' order by start_epoch desc limit 1;";
$stmt="UPDATE vicidial_closer_log set end_epoch='$STARTtime', length_in_sec='" . mysql_real_escape_string($call_length) . "', status='" . mysql_real_escape_string($status) . "', user='$PHP_AUTH_USER' where lead_id='" . mysql_real_escape_string($lead_id) . "' order by start_epoch desc limit 1;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
### update the lead record in the vicidial_list table
$stmt="UPDATE vicidial_list set status='$status',first_name='$first_name',last_name='$last_name',address1='$address1',address2='$address2',address3='$address3',city='$city',state='$state',province='$province',postal_code='$postal_code',country_code='$country_code',alt_phone='$alt_phone',email='$email',security_phrase='$security',comments='$comments',user='$PHP_AUTH_USER' where lead_id='$lead_id'";
$stmt="UPDATE vicidial_list set status='" . mysql_real_escape_string($status) . "',first_name='" . mysql_real_escape_string($first_name) . "',last_name='" . mysql_real_escape_string($last_name) . "',address1='" . mysql_real_escape_string($address1) . "',address2='" . mysql_real_escape_string($address2) . "',address3='" . mysql_real_escape_string($address3) . "',city='" . mysql_real_escape_string($city) . "',state='" . mysql_real_escape_string($state) . "',province='" . mysql_real_escape_string($province) . "',postal_code='" . mysql_real_escape_string($postal_code) . "',country_code='" . mysql_real_escape_string($country_code) . "',alt_phone='" . mysql_real_escape_string($alt_phone) . "',email='" . mysql_real_escape_string($email) . "',security_phrase='" . mysql_real_escape_string($security) . "',comments='" . mysql_real_escape_string($comments) . "',user='$PHP_AUTH_USER' where lead_id='" . mysql_real_escape_string($lead_id) . "'";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
@@ -183,7 +191,7 @@ $call_length = ($STARTtime - $call_began);
}
else
{
$stmt="SELECT count(*) from vicidial_list where lead_id='$lead_id'";
$stmt="SELECT count(*) from vicidial_list where lead_id='" . mysql_real_escape_string($lead_id) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -192,7 +200,7 @@ else
if ($lead_count > 0)
{
$stmt="SELECT * from vicidial_list where lead_id='$lead_id'";
$stmt="SELECT * from vicidial_list where lead_id='" . mysql_real_escape_string($lead_id) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
VICIDIAL_web/server_stats.php
+29 -2
View File
@@ -3,8 +3,35 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60620-1037 - Added Link back to Admin section
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6;";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
@@ -31,8 +58,8 @@ while ($i < $servers_to_print)
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">
<TITLE>VICIDIAL: Server Stats and Reports</TITLE></HEAD><BODY BGCOLOR=WHITE>
<FONT SIZE=2>
<H1>VICIDIAL: Server Stats and Reports</H1>
<FONT SIZE=4><B>VICIDIAL: Server Stats and Reports</B></font> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
<a href="./admin.php"><FONT FACE="ARIAL,HELVETICA" COLOR=BLACK SIZE=2>BACK TO ADMIN</FONT></a><BR><BR>
<UL>
<LI><a href="AST_timeonVDADall.php"><FONT FACE="ARIAL,HELVETICA" COLOR=BLACK SIZE=2>TIME ON VDAD (per campaign)</a> | <a href="AST_timeonVDADall_SIPmonitor.php"><FONT FACE="ARIAL,HELVETICA" COLOR=BLACK SIZE=2>SIP Listen Version</a></FONT>
<LI><a href="AST_parkstats.php"><FONT FACE="ARIAL,HELVETICA" COLOR=BLACK SIZE=2>PARK REPORT</a></FONT>
VICIDIAL_web/user_stats.php
+11 -6
View File
@@ -3,6 +3,10 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60619-1743 - Added variable filtering to eliminate SQL injection attack threat
#
header ("Content-type: text/html; charset=utf-8");
@@ -24,6 +28,9 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
@@ -52,8 +59,6 @@ $browser = getenv("HTTP_USER_AGENT");
if($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -109,7 +114,7 @@ echo "</B></TD></TR>\n";
echo "<TR><TD ALIGN=LEFT COLSPAN=2>\n";
$stmt="SELECT count(*),status, sum(length_in_sec) from vicidial_log where user='$user' and call_date >= '$begin_date 0:00:01' and call_date <= '$end_date 23:59:59' group by status order by status";
$stmt="SELECT count(*),status, sum(length_in_sec) from vicidial_log where user='" . mysql_real_escape_string($user) . "' and call_date >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and call_date <= '" . mysql_real_escape_string($end_date) . " 23:59:59' group by status order by status";
$rslt=mysql_query($stmt, $link);
$statuses_to_print = mysql_num_rows($rslt);
@@ -147,7 +152,7 @@ echo "<tr><td><font size=2>STATUS</td><td align=right><font size=2>COUNT</td><td
$o++;
}
$stmt="SELECT sum(length_in_sec) from vicidial_log where user='$user' and call_date >= '$begin_date 0:00:01' and call_date <= '$end_date 23:59:59'";
$stmt="SELECT sum(length_in_sec) from vicidial_log where user='" . mysql_real_escape_string($user) . "' and call_date >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and call_date <= '" . mysql_real_escape_string($end_date) . " 23:59:59'";
$rslt=mysql_query($stmt, $link);
$counts_to_print = mysql_num_rows($rslt);
$row=mysql_fetch_row($rslt);
@@ -170,7 +175,7 @@ echo "<B>LOGIN/LOGOUT TIME:</B>\n";
echo "<TABLE width=400 cellspacing=0 cellpadding=1>\n";
echo "<tr><td><font size=2>EVENT </td><td align=right><font size=2> DATE</td><td align=right><font size=2> CAMPAIGN</td><td align=right><font size=2>HOURS:MINUTES</td></tr>\n";
$stmt="SELECT event,event_epoch,event_date,campaign_id from vicidial_user_log where user='$user' and event_date >= '$begin_date 0:00:01' and event_date <= '$end_date 23:59:59'";
$stmt="SELECT event,event_epoch,event_date,campaign_id from vicidial_user_log where user='" . mysql_real_escape_string($user) . "' and event_date >= '" . mysql_real_escape_string($begin_date) . " 0:00:01' and event_date <= '" . mysql_real_escape_string($end_date) . " 23:59:59'";
$rslt=mysql_query($stmt, $link);
$events_to_print = mysql_num_rows($rslt);
@@ -253,7 +258,7 @@ echo "<B>LAST 50 CALLS:</B>\n";
echo "<TABLE width=550 cellspacing=0 cellpadding=1>\n";
echo "<tr><td><font size=2>DATE/TIME </td><td align=left><font size=2>LENGTH</td><td align=left><font size=2> STATUS</td><td align=left><font size=2> PHONE</td><td align=right><font size=2> CAMPAIGN</td><td align=right><font size=2> LIST</td><td align=right><font size=2> LEAD</td></tr>\n";
$stmt="select * from vicidial_log where user='$user' order by uniqueid desc limit 50;";
$stmt="select * from vicidial_log where user='" . mysql_real_escape_string($user) . "' order by uniqueid desc limit 50;";
$rslt=mysql_query($stmt, $link);
$logs_to_print = mysql_num_rows($rslt);
VICIDIAL_web/user_status.php
+11 -6
View File
@@ -3,6 +3,10 @@
###
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# CHANGES
#
# 60619-1738 - Added variable filtering to eliminate SQL injection attack threat
#
header ("Content-type: text/html; charset=utf-8");
@@ -26,6 +30,9 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
@@ -54,8 +61,6 @@ $browser = getenv("HTTP_USER_AGENT");
if($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name,change_agent_campaign from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -70,12 +75,12 @@ $browser = getenv("HTTP_USER_AGENT");
fclose($fp);
}
$stmt="SELECT full_name from vicidial_users where user='$user';";
$stmt="SELECT full_name from vicidial_users where user='" . mysql_real_escape_string($user) . "';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$full_name = $row[0];
$stmt="SELECT * from vicidial_live_agents where user='$user';";
$stmt="SELECT * from vicidial_live_agents where user='" . mysql_real_escape_string($user) . "';";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$agents_to_print = mysql_num_rows($rslt);
@@ -130,7 +135,7 @@ echo "<TR BGCOLOR=\"#F0F5FE\"><TD ALIGN=LEFT COLSPAN=2><FONT FACE=\"ARIAL,HELVET
if ($stage == "live_campaign_change")
{
$stmt="UPDATE vicidial_live_agents set campaign_id='$group' where user='$user';";
$stmt="UPDATE vicidial_live_agents set campaign_id='" . mysql_real_escape_string($group) . "' where user='" . mysql_real_escape_string($user) . "';";
$rslt=mysql_query($stmt, $link);
echo "Agent $user - $full_name changed to $group campaign<BR>\n";
@@ -140,7 +145,7 @@ if ($stage == "live_campaign_change")
if ($stage == "log_agent_out")
{
$stmt="DELETE from vicidial_live_agents where user='$user';";
$stmt="DELETE from vicidial_live_agents where user='" . mysql_real_escape_string($user) . "';";
$rslt=mysql_query($stmt, $link);
echo "Agent $user - $full_name has been emergency logged out, make sure they close their web browser<BR>\n";
VICIDIAL_web/vdremote.php
+16 -11
View File
@@ -7,9 +7,13 @@
# 50307-1721 - First version
# 51123-1502 - removed requirement of PHP Globals=on
# 60421-1229 - check GET/POST vars lines with isset to not trigger PHP NOTICES
# 60619-1603 - Added variable filtering to eliminate SQL injection attack threat
#
# make sure you have added a user to the vicidial_users MySQL table with at least user_level 4 to access this page the first time
$version = '1.1.12';
$build = '60619-1603';
require("dbconnect.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
@@ -59,10 +63,11 @@ if ($force_logout)
exit;
}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$popup_page = './closer_popup.php';
$version = '1.1.11';
$build = '60421-1229';
$STARTtime = date("U");
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
@@ -195,7 +200,7 @@ if (strlen($ADD)>4)
##### get inbound groups listing for checkboxes
if ( (($ADD==31111) or ($ADD==31111)) and (count($groups)<1) )
{
$stmt="SELECT closer_campaigns from vicidial_remote_agents where remote_agent_id='$remote_agent_id';";
$stmt="SELECT closer_campaigns from vicidial_remote_agents where remote_agent_id='" . mysql_real_escape_string($remote_agent_id) . "';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$closer_campaigns = $row[0];
@@ -254,7 +259,7 @@ if ($ADD==31111)
{
echo "<FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>";
$stmt="SELECT * from vicidial_remote_agents where remote_agent_id='$remote_agent_id';";
$stmt="SELECT * from vicidial_remote_agents where remote_agent_id='" . mysql_real_escape_string($remote_agent_id) . "';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$remote_agent_id = $row[0];
@@ -299,7 +304,7 @@ if ($ADD==41111)
{echo "<br>REMOTE AGENTS NOT MODIFIED - Please go back and look at the data you entered\n";}
else
{
$stmt="UPDATE vicidial_remote_agents set number_of_lines='$number_of_lines', conf_exten='$conf_exten', status='$status', closer_campaigns='$groups_value' where remote_agent_id='$remote_agent_id';";
$stmt="UPDATE vicidial_remote_agents set number_of_lines='" . mysql_real_escape_string($number_of_lines) . "', conf_exten='" . mysql_real_escape_string($conf_exten) . "', status='" . mysql_real_escape_string($status) . "', closer_campaigns='" . mysql_real_escape_string($groups_value) . "' where remote_agent_id='" . mysql_real_escape_string($remote_agent_id) . "';";
$rslt=mysql_query($stmt, $link);
# echo "$stmt\n";
@@ -307,12 +312,12 @@ if ($ADD==41111)
### LOG CHANGES TO LOG FILE ###
$fp = fopen ("./admin_changes_log.txt", "a");
fwrite ($fp, "$date|MODIFY REMOTE AGENTS ENTRY |$PHP_AUTH_USER|$ip|UPDATE vicidial_remote_agents set number_of_lines='$number_of_lines', conf_exten='$conf_exten', status='$status', closer_campaigns='$groups_value' where remote_agent_id='$remote_agent_id'|\n");
fwrite ($fp, "$date|MODIFY REMOTE AGENTS ENTRY |$PHP_AUTH_USER|$ip|$stmt|\n");
fclose($fp);
}
$stmt="SELECT * from vicidial_remote_agents where remote_agent_id='$remote_agent_id';";
$stmt="SELECT * from vicidial_remote_agents where remote_agent_id='" . mysql_real_escape_string($remote_agent_id) . "';";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$remote_agent_id = $row[0];
@@ -351,7 +356,7 @@ echo "NOTE: It can take up to 30 seconds for changes submitted on this screen to
if ($ADD==61111)
{
echo "<FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2><PRE>";
echo "<FONT FACE=\"Courier\" COLOR=BLACK SIZE=2><PRE>";
if ( (strlen($server_ip) < 2) or (strlen($user) < 2) )
{echo "<br>REMOTE AGENTS ERROR - Please go back and look at the data you entered\n";}
@@ -363,7 +368,7 @@ if ($ADD==61111)
while($k < $number_of_lines)
{
$nextuser=($user + $k);
$users_list .= "'$nextuser',";
$users_list .= "'" . mysql_real_escape_string($nextuser) . "',";
$k++;
}
$users_list = preg_replace("/.$/","",$users_list);
@@ -374,7 +379,7 @@ if ($ADD==61111)
echo "+------------|--------+--------------+------------+--------+---------------------+---------+\n";
$stmt="select extension,user,lead_id,channel,status,last_call_time,UNIX_TIMESTAMP(last_call_time),UNIX_TIMESTAMP(last_call_finish) from vicidial_live_agents where status NOT IN('PAUSED') and server_ip='$server_ip' and user IN($users_list) order by extension;";
$stmt="select extension,user,lead_id,channel,status,last_call_time,UNIX_TIMESTAMP(last_call_time),UNIX_TIMESTAMP(last_call_finish) from vicidial_live_agents where status NOT IN('PAUSED') and server_ip='" . mysql_real_escape_string($server_ip) . "' and user IN($users_list) order by extension;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$talking_to_print = mysql_num_rows($rslt);
@@ -463,7 +468,7 @@ if ($ADD==71111)
echo "<INPUT TYPE=HIDDEN NAME=user VALUE=\"$user\">\n";
echo "<INPUT TYPE=SUBMIT NAME=SUBMIT VALUE=SUBMIT>\n";
echo "</FORM>\n\n";
echo "<FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2><PRE>";
echo "<FONT FACE=\"Courier\" COLOR=BLACK SIZE=2><PRE>";
if ( (strlen($server_ip) < 2) or (strlen($user) < 2) )
{echo "<br>REMOTE AGENTS ERROR - Please go back and look at the data you entered\n";}