ViciDial/agc_1-X
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

release 1.1.12

Browse Source 
git-svn-id: svn://192.168.202.10@10 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2006-07-07 15:30:10 +00:00
parent ca8e640156
commit 065b96d043
91 changed files with 4346 additions and 542 deletions
Download Patch File Download Diff File Expand all files Collapse all files
astguiclient_web/inbound_popup.php
+10 -3
View File
@@ -4,6 +4,11 @@
### Copyright (C) 2006 Matt Florell <vicidial@gmail.com> LICENSE: GPLv2
###
# this is the inbound popup of a specific call that grabs the call and allows you to go and fetch info on that caller in the local CRM system.
#
# changes:
# 60620-1329 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
#
require("dbconnect.php");
@@ -77,6 +82,8 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$STARTtime = date("U");
$TODAY = date("Y-m-d");
@@ -147,7 +154,7 @@ $browser = getenv("HTTP_USER_AGENT");
<?
$stmt="SELECT count(*) from parked_channels where server_ip='$user_server_ip' and parked_time='$parked_time' and channel='$channel'";
$stmt="SELECT count(*) from parked_channels where server_ip='$user_server_ip' and parked_time='" . mysql_real_escape_string($parked_time) . "' and channel='" . mysql_real_escape_string($channel) . "'";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$row=mysql_fetch_row($rslt);
@@ -156,14 +163,14 @@ $parked_count = $row[0];
if ($parked_count > 0)
{
$stmt="DELETE from parked_channels where server_ip='$user_server_ip' and parked_time='$parked_time' and channel='$channel' LIMIT 1";
$stmt="DELETE from parked_channels where server_ip='$user_server_ip' and parked_time='" . mysql_real_escape_string($parked_time) . "' and channel='" . mysql_real_escape_string($channel) . "' LIMIT 1";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$DTqueryCID = "RR$FILE_datetime$PHP_AUTH_USER";
### insert a NEW record to the vicidial_manager table to be processed
$stmt="INSERT INTO vicidial_manager values('','','$NOW_TIME','NEW','N','$user_server_ip','','Redirect','$DTqueryCID','Exten: $dialplan_number','Channel: $channel','Context: $ext_context','Priority: 1','Callerid: $DTqueryCID','','','','','')";
$stmt="INSERT INTO vicidial_manager values('','','$NOW_TIME','NEW','N','$user_server_ip','','Redirect','$DTqueryCID','Exten: $dialplan_number','Channel: " . mysql_real_escape_string($channel) . "','Context: $ext_context','Priority: 1','Callerid: $DTqueryCID','','','','','')";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);