ViciDial/agc_2-X
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added several security changes to the admin interface, including freezing a user's account for 15 minutes after 10 failed login attempts.

Browse Source 
Added 3 new reports to the admin interface: url log, lagged log and user group login reports
Added new AST_phone_update.pl --agent-lookup flag to allow for logging of the IP address of the agent's SIP or IAX phone connection. Can be enabled as a crontab entry to perform the lookups on each asterisk server.

git-svn-id: svn://192.168.202.10@1997 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2013-07-02 06:00:53 +00:00
parent 665894dd9d
commit 09c4284e1b
112 changed files with 8058 additions and 4242 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/vicidial/list_download.php
+45 -13
View File
@@ -24,11 +24,13 @@
# 120907-1217 - Raised extended fields up to 99
# 130414-0228 - Added report logging
# 130610-0945 - Finalized changing of all ereg instances to preg
# 130618-0043 - Added filtering of input to prevent SQL injection attacks and new user auth
#
$startMS = microtime();
require("dbconnect.php");
require("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
@@ -70,21 +72,51 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id);
$group_id = preg_replace('/[^-_0-9a-zA-Z]/','',$group_id);
$download_type = preg_replace('/[^-_0-9a-zA-Z]/','',$download_type);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and download_lists='1' and active='Y';";
$auth=0;
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
if ($auth_message == 'GOOD')
{$auth=1;}
if ($auth < 1)
{
$VDdisplayMESSAGE = "Login incorrect, please try again";
if ($auth_message == 'LOCK')
{
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
Header ("Content-type: text/html; charset=utf-8");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
exit;
}
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
Header("HTTP/1.0 401 Unauthorized");
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
exit;
}
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and user_level > 7 and download_lists='1';";
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
$download_auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
if ($download_auth < 1)
{
# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
# Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password or no list download permission: |$PHP_AUTH_USER|\n";
Header ("Content-type: text/html; charset=utf-8");
echo "No list download permission: |$PHP_AUTH_USER|\n";
exit;
}
@@ -117,7 +149,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
# echo "<!-- Using slave server $slave_db_server $db_source -->\n";
}
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
@@ -132,8 +164,7 @@ $LOGallowed_reports = $row[1];
if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
{
# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
# Header("HTTP/1.0 401 Unauthorized");
Header ("Content-type: text/html; charset=utf-8");
echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
exit;
}
@@ -561,4 +592,5 @@ $rslt=mysql_query($stmt, $link);
exit;
?>
?>