LICENSE: GPLv2 ### ### AST GUI database administration search for lead info ### admin_modify_lead.php # # this is the administration lead information modifier screen, the administrator just needs to enter the leadID and then they can view and modify the information in the record for that lead # # changes: # 60620-1055 - Added variable filtering to eliminate SQL injection attack threat # - Added required user/pass to gain access to this page # - Changed results to multi-record # require("dbconnect.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; if (isset($_GET["vendor_id"])) {$vendor_id=$_GET["vendor_id"];} elseif (isset($_POST["vendor_id"])) {$vendor_id=$_POST["vendor_id"];} if (isset($_GET["phone"])) {$phone=$_GET["phone"];} elseif (isset($_POST["phone"])) {$phone=$_POST["phone"];} if (isset($_GET["lead_id"])) {$lead_id=$_GET["lead_id"];} elseif (isset($_POST["lead_id"])) {$lead_id=$_POST["lead_id"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} if (isset($_GET["ENVIAR"])) {$ENVIAR=$_GET["ENVIAR"];} elseif (isset($_POST["ENVIAR"])) {$ENVIAR=$_POST["ENVIAR"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} $PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER); $PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW); $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7;"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $auth=$row[0]; if ($WeBRooTWritablE > 0) {$fp = fopen ("./project_auth_entries.txt", "a");} $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) { Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); Header("HTTP/1.0 401 Unauthorized"); echo "Nombre y contraseña inválidos del usuario: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; exit; } else { if($auth>0) { $office_no=strtoupper($PHP_AUTH_USER); $password=strtoupper($PHP_AUTH_PW); $stmt="SELECT full_name,modify_leads from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $LOGfullname =$row[0]; $LOGmodify_leads =$row[1]; if ($WeBRooTWritablE > 0) { fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|$LOGfullname|\n"); fclose($fp); } } else { if ($WeBRooTWritablE > 0) { fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|\n"); fclose($fp); } } } ?>
\n"; echo "

\n"; echo "\n"; echo "Por favor, Introduzca un:
Vendor ID(código del vendedor del Lead): or \n"; echo "
un número de teléfono de casa: or\n"; echo "
ID del Lead:

\n"; echo "\n"; echo "\n

\n"; echo "\n"; exit; } else { if ($vendor_id) { $stmt="SELECT * from vicidial_list where vendor_lead_code='" . mysql_real_escape_string($vendor_id) . "' order by modify_date desc limit 1000"; } else { if ($phone) { $stmt="SELECT * from vicidial_list where phone_number='" . mysql_real_escape_string($phone) . "' order by modify_date desc limit 1000"; } else { if ($lead_id) { $stmt="SELECT * from vicidial_list where lead_id='" . mysql_real_escape_string($lead_id) . "' order by modify_date desc limit 1000"; } else { print "ERROR: you must search for something! Go back and search for something"; exit; } } } if ($DB) { echo "\n\n$stmt\n\n"; } $rslt=mysql_query($stmt, $link); $results_to_print = mysql_num_rows($rslt); if ($results_to_print < 1) { echo date("l F j, Y G:i:s A"); echo "\n

\n"; echo "Las variables de la búsqueda que usted incorporó no son activas en el sistema

\n"; echo "Va por favor detrás y dobla el cheque la información que usted incorporó y somete otra vez\n"; echo "\n"; echo "\n"; exit; } else { echo "RESULTS: $results_to_print

\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; $o=0; while ($results_to_print > $o) { $row=mysql_fetch_row($rslt); $o++; if (eregi("1$|3$|5$|7$|9$", $o)) {$bgcolor='bgcolor="#B9CBFD"';} else {$bgcolor='bgcolor="#9BB9FB"';} echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; echo "\n"; } echo "

#	LEAD ID	ESTADO	VENDOR ID	LAST AGENT	ID DE LA LISTA	PHONE	NOMBRE	CITY	SECURITY	LAST CALL
$o	$row[0]	$row[3]	$row[5]	$row[4]	$row[7]	$row[11]	$row[13] $row[15]	$row[19]	$row[28]	$row[2]

\n"; } } $ENDtime = date("U"); $RUNtime = ($ENDtime - $STARTtime); echo "\n\n\n


\nNUEVA BÚSQUEDA"; echo "\n\n\n


\nScript runtime: $RUNtime seconds"; ?>