ViciDial/agc_2-X
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Default security fixes, CVE-2021-28854

Browse Source 
git-svn-id: svn://192.168.202.10@3454 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2021-06-15 15:10:25 +00:00
parent 0e1ffd4b1d
commit 1f249552ec
19 changed files with 158 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
extras/get2post.php
+7 -5
View File
@@ -1,7 +1,7 @@
<?php
# get2post.php
#
# Copyright (C) 2017 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed to take a url as part of the query string and convert
# it to a POST HTTP request and log to the url log table. uniqueid is required!
@@ -22,10 +22,11 @@
# 170324-1218 - Added headers options
# 170418-1257 - Added ability to use some special characters in headers
# 170531-0925 - Added ability to accept POST query string
# 210615-1042 - Default security fixes, CVE-2021-28854
#
$version = '2.14-4';
$build = '170531-0925';
$version = '2.14-5';
$build = '210615-1042';
require("dbconnect_mysqli.php");
require("functions.php");
@@ -207,8 +208,9 @@ if (strlen($resp) > 0)
if ($webroot_writable > 0)
{
$fp = fopen ("./get2post.txt", "a");
fwrite ($fp, "$output|$query_string\n");
$fp = fopen ("./get2post.txt", "w");
# fwrite ($fp, "$output|$query_string\n");
fwrite ($fp, "$NOW_TIME|\n");
fclose($fp);
}
www/agc/astguiclient.php
+7 -6
View File
@@ -1,7 +1,7 @@
<?php
# astguiclient.php - the web-based version of the astGUIclient client application
#
# Copyright (C) 2020 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# make sure you have added a user to the vicidial_users MySQL table with at least
# user_level 1 or greater to access this page. Also you need to have the login
@@ -70,10 +70,11 @@
# 150727-0915 - Added default_language
# 190111-0902 - Fix for PHP7
# 200319-1532 - Small fixes for conference tab issues
# 210615-1037 - Default security fixes, CVE-2021-28854
#
$version = '2.2.6-3';
$build = '200319-1532';
$version = '2.2.6-4';
$build = '210615-1037';
require_once("dbconnect_mysqli.php");
require_once("functions.php");
@@ -180,7 +181,7 @@ if (preg_match("/^GOOD/",$auth_message))
$US='_';
$CL=':';
if ($WeBRooTWritablE > 0)
{$fp = fopen ("./astguiclient_auth_entries.txt", "a");}
{$fp = fopen ("./astguiclient_auth_entries.txt", "w");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
@@ -238,7 +239,7 @@ else
$LOGfullname=$row[0];
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$user|XXXX|$ip|$browser|$LOGfullname|\n");
fwrite ($fp, "VICIDIAL|GOOD|$date|\n");
fclose($fp);
}
}
@@ -246,7 +247,7 @@ else
{
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$user|XXXX|$ip|$browser|$LOGfullname|\n");
fwrite ($fp, "VICIDIAL|FAIL|$date|\n");
fclose($fp);
}
}
www/agc/deactivate_lead.php
+5 -3
View File
@@ -1,7 +1,7 @@
<?php
# deactivate_lead.php
#
# Copyright (C) 2020 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed to be used in the "Dispo URL" field of a campaign
# or in-group. It should take in the campaign_id to check for the same source_id
@@ -32,6 +32,7 @@
# 141216-2130 - Added language settings lookups and user/pass variable standardization
# 170526-2301 - Added additional variable filtering
# 201117-2222 - Changes for better compatibility with non-latin data input
# 210615-1036 - Default security fixes, CVE-2021-28854
#
$api_script = 'deactivate';
@@ -231,7 +232,8 @@ else
if ($log_to_file > 0)
{
$fp = fopen ("./deactivate_lead.txt", "a");
fwrite ($fp, "$NOW_TIME|$lead_id|$search_field|$search_value|$campaign_check|$sale_status|$dispo|$new_status|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n");
$fp = fopen ("./deactivate_lead.txt", "w");
# fwrite ($fp, "$NOW_TIME|$lead_id|$search_field|$search_value|$campaign_check|$sale_status|$dispo|$new_status|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n");
fwrite ($fp, "$NOW_TIME|\n");
fclose($fp);
}
www/agc/dispo_add_FPG.php
+5 -3
View File
@@ -1,7 +1,7 @@
<?php
# dispo_add_FPG.php
#
# Copyright (C) 2017 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed to be used in the "Dispo URL" field of a campaign
# or in-group. It adds the phone_number of the call to a designated inbound
@@ -21,6 +21,7 @@
# CHANGES
# 150724-1657 - First Build
# 170526-2305 - Added additional variable filtering
# 210615-1039 - Default security fixes, CVE-2021-28854
#
$api_script = 'add_FPG';
@@ -219,7 +220,8 @@ else
if ($log_to_file > 0)
{
$fp = fopen ("./add_FPG.txt", "a");
fwrite ($fp, "$NOW_TIME|$k|$phone_number|$FPG_id|$sale_status|$dispo|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n");
$fp = fopen ("./add_FPG.txt", "w");
# fwrite ($fp, "$NOW_TIME|$k|$phone_number|$FPG_id|$sale_status|$dispo|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n");
fwrite ($fp, "$NOW_TIME|\n");
fclose($fp);
}
www/agc/dispo_change_status.php
+5 -3
View File
@@ -1,7 +1,7 @@
<?php
# dispo_change_status.php
#
# Copyright (C) 2020 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed to be used in the "Dispo URL" field of a campaign
# or in-group. It can update the status of a lead to a new status if the lead
@@ -25,6 +25,7 @@
# CHANGES
# 171127-1736 - First Build
# 201117-2217 - Changes for better compatibility with non-latin data input
# 210615-1035 - Default security fixes, CVE-2021-28854
#
$api_script = 'dispo_change_status';
@@ -290,7 +291,8 @@ else
if ($log_to_file > 0)
{
$fp = fopen ("./$api_script.txt", "a");
fwrite ($fp, "$NOW_TIME|$k|$lead_id|$dispo|$logged_status|$logged_count($search_count)|$new_status|$days_search($days_search_date)|$archive_search|$in_out_search|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n");
$fp = fopen ("./$api_script.txt", "w");
# fwrite ($fp, "$NOW_TIME|$k|$lead_id|$dispo|$logged_status|$logged_count($search_count)|$new_status|$days_search($days_search_date)|$archive_search|$in_out_search|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n");
fwrite ($fp, "$NOW_TIME|\n");
fclose($fp);
}
www/agc/dispo_move_list.php
+5 -3
View File
@@ -1,7 +1,7 @@
<?php
# dispo_move_list.php
#
# Copyright (C) 2018 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed to be used in the "Dispo URL" field of a campaign
# or in-group (although it can also be used in the "No Agent Call URL" field).
@@ -65,6 +65,7 @@
# 170402-0906 - Added list_id_trigger option, cleaned up outputs
# 170526-2310 - Added additional variable filtering
# 180419-2257 - Added multi_trigger option
# 210615-1038 - Default security fixes, CVE-2021-28854
#
$api_script = 'movelist';
@@ -504,7 +505,8 @@ else
if ($log_to_file > 0)
{
$fp = fopen ("./dispo_move_list.txt", "a");
fwrite ($fp, "$NOW_TIME|$k|$lead_id|$dispo|$user|XXXX|$DB|$log_to_file|$talk_time|$called_count|$first_pass_vars|$new_list_id|$original_sale_status|$talk_time_trigger|$exclude_status|$called_count_trigger|$list_id|$list_id_trigger|$multi_trigger|$MESSAGE|\n");
$fp = fopen ("./dispo_move_list.txt", "w");
# fwrite ($fp, "$NOW_TIME|$k|$lead_id|$dispo|$user|XXXX|$DB|$log_to_file|$talk_time|$called_count|$first_pass_vars|$new_list_id|$original_sale_status|$talk_time_trigger|$exclude_status|$called_count_trigger|$list_id|$list_id_trigger|$multi_trigger|$MESSAGE|\n");
fwrite ($fp, "$NOW_TIME|\n");
fclose($fp);
}
www/agc/dispo_send_email.php
+5 -3
View File
@@ -1,7 +1,7 @@
<?php
# dispo_send_email.php
#
# Copyright (C) 2020 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed to be used in the "Dispo URL" field of a campaign
# or in-group. It will send out an email to a fixed email address as defined
@@ -41,6 +41,7 @@
# 191013-2113 - Fixes for PHP7
# 200814-1829 - added email_body_html, email_body_utf8 flags
# 201117-2104 - Changes for better compatibility with non-latin data input
# 210615-1033 - Default security fixes, CVE-2021-28854
#
$api_script = 'send_email';
@@ -1368,7 +1369,8 @@ else
if ($log_to_file > 0)
{
$fp = fopen ("./send_email.txt", "a");
fwrite ($fp, "$NOW_TIME|$k|$lead_id|$call_id|$container_id|$sale_status|$dispo|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n");
$fp = fopen ("./send_email.txt", "w");
# fwrite ($fp, "$NOW_TIME|$k|$lead_id|$call_id|$container_id|$sale_status|$dispo|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n");
fwrite ($fp, "$NOW_TIME|\n");
fclose($fp);
}
www/agc/functions.php
+6 -4
View File
@@ -55,6 +55,7 @@
# 210401-2132 - Fixed issue #1271, security_phrase field not populating in custom fields form
# 210404-0902 - Added function to refresh a single field
# 210603-1616 - Fix for specific custom field values with a slash in them
# 210615-1032 - Default security fixes, CVE-2021-28854
#
# $mysql_queries = 26
@@ -155,8 +156,8 @@ function user_authorization($user,$pass,$user_option,$user_update,$bcrypt,$retur
}
if ($SSwebroot_writable > 0)
{
$fp = fopen ("./project_auth_entries.txt", "a");
fwrite ($fp, "AGENT|FAIL|$NOW_TIME|$user|$auth_key|$ip|$browser|\n");
$fp = fopen ("./project_auth_entries.txt", "w");
fwrite ($fp, "AGENT|FAIL|$NOW_TIME|\n");
fclose($fp);
}
}
@@ -2689,8 +2690,9 @@ function mysql_error_logging($NOW_TIME,$link,$mel,$stmt,$query_id,$user,$server_
if ( ($errno > 0) or ($mel > 1) or ($one_mysql_log > 0) )
{
$error = mysqli_error($link);
$efp = fopen ("./vicidial_mysqli_errors.txt", "a");
fwrite ($efp, "$NOW_TIME|vdc_db_query|$query_id|$errno|$error|$stmt|$user|$server_ip|$session_name|\n");
$efp = fopen ("./vicidial_mysqli_errors.txt", "w");
# fwrite ($efp, "$NOW_TIME|vdc_db_query|$query_id|$errno|$error|$stmt|$user|$server_ip|$session_name|\n");
fwrite ($efp, "$NOW_TIME|vdc_db_query|$query_id|\n");
fclose($efp);
}
}
www/agc/manager_send.php
+19 -13
View File
@@ -1,7 +1,7 @@
<?php
# manager_send.php version 2.14
#
# Copyright (C) 2020 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is designed purely to insert records into the vicidial_manager table to signal Actions to an asterisk server
# This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table
@@ -145,10 +145,11 @@
# 191013-2114 - Fixes for PHP7
# 201107-2228 - Added campaign/in-group logging in park_log
# 201117-1751 - Changes for better compatibility with non-latin data input
# 210615-1016 - Default security fixes, CVE-2021-28854
#
$version = '2.14-92';
$build = '201117-1751';
$version = '2.14-93';
$build = '210615-1016';
$php_script = 'manager_send.php';
$mel=1; # Mysql Error Log enabled = 1
$mysql_log_count=143;
@@ -760,8 +761,9 @@ if ($ACTION=="Hangup")
echo _QXZ("Channel %1s in use by another agent on %2s, Hangup command not inserted",0,'',$channel,$call_server_ip)." $rowx[0]\n$stmt\n";
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./vicidial_debug.txt", "a");
fwrite ($fp, "$NOW_TIME|MDCHU|$user|$channel|$call_server_ip|$exten|\n");
$fp = fopen ("./vicidial_debug.txt", "w");
# fwrite ($fp, "$NOW_TIME|MDCHU|$user|$channel|$call_server_ip|$exten|\n");
fwrite ($fp, "$NOW_TIME|MDCHU|\n");
fclose($fp);
}
}
@@ -1749,8 +1751,9 @@ if ($ACTION=="RedirectXtraCXNeW")
{
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./vicidial_debug.txt", "a");
fwrite ($fp, "$NOW_TIME|RDCXC|$filename|$user|$campaign|$channel|$extrachannel|$queryCID|$exten|$ext_context|ext_priority|\n");
$fp = fopen ("./vicidial_debug.txt", "w");
# fwrite ($fp, "$NOW_TIME|RDCXC|$filename|$user|$campaign|$channel|$extrachannel|$queryCID|$exten|$ext_context|ext_priority|\n");
fwrite ($fp, "$NOW_TIME|RDCXC|\n");
fclose($fp);
}
}
@@ -1936,8 +1939,9 @@ if ($ACTION=="RedirectXtraCXNeW")
{
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./vicidial_debug.txt", "a");
fwrite ($fp, "$NOW_TIME|RDCXC|$filename|$user|$campaign|$DBout|\n");
$fp = fopen ("./vicidial_debug.txt", "w");
# fwrite ($fp, "$NOW_TIME|RDCXC|$filename|$user|$campaign|$DBout|\n");
fwrite ($fp, "$NOW_TIME|RDCXC|\n");
fclose($fp);
}
}
@@ -1975,8 +1979,9 @@ if ($ACTION=="RedirectXtraNeW")
{
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./vicidial_debug.txt", "a");
fwrite ($fp, "$NOW_TIME|RDX|$filename|$user|$campaign|$channel|$extrachannel|$queryCID|$exten|$ext_context|ext_priority|$session_id|\n");
$fp = fopen ("./vicidial_debug.txt", "w");
# fwrite ($fp, "$NOW_TIME|RDX|$filename|$user|$campaign|$channel|$extrachannel|$queryCID|$exten|$ext_context|ext_priority|$session_id|\n");
fwrite ($fp, "$NOW_TIME|RDX|\n");
fclose($fp);
}
}
@@ -2145,8 +2150,9 @@ if ($ACTION=="RedirectXtraNeW")
{
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./vicidial_debug.txt", "a");
fwrite ($fp, "$NOW_TIME|RDX|$filename|$user|$campaign|$DBout|\n");
$fp = fopen ("./vicidial_debug.txt", "w");
# fwrite ($fp, "$NOW_TIME|RDX|$filename|$user|$campaign|$DBout|\n");
fwrite ($fp, "$NOW_TIME|RDX|\n");
fclose($fp);
}
}
www/agc/phone_only.php
+7 -6
View File
@@ -1,7 +1,7 @@
<?php
# phone_only.php - the web-based web-phone-only client application
#
# Copyright (C) 2020 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# CHANGELOG
# 110511-1336 - First Build
@@ -19,10 +19,11 @@
# 170511-1107 - Added code for WebRTC phones
# 181003-1736 - Added external_web_socket_url option
# 200123-1639 - Added Webphone options
# 210615-1028 - Default security fixes, CVE-2021-28854
#
$version = '2.14-15p';
$build = '200123-1639';
$version = '2.14-16p';
$build = '210615-1028';
$mel=1; # Mysql Error Log enabled = 1
$mysql_log_count=74;
$one_mysql_log=0;
@@ -356,7 +357,7 @@ if ( (strlen($phone_login) < 1) or (strlen($phone_pass) < 1) )
else
{
if ($WeBRooTWritablE > 0)
{$fp = fopen ("./vicidial_auth_entries.txt", "a");}
{$fp = fopen ("./vicidial_auth_entries.txt", "w");}
$VDloginDISPLAY=0;
if ( (strlen($VD_login)<2) or (strlen($VD_pass)<2) )
@@ -396,7 +397,7 @@ else
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "vdweb|GOOD|$date|$VD_login|XXXX|$ip|$browser|$LOGfullname|\n");
fwrite ($fp, "vdweb|GOOD|$date|\n");
fclose($fp);
}
$user_abb = "$VD_login$VD_login$VD_login$VD_login";
@@ -408,7 +409,7 @@ else
{
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "vdweb|FAIL|$date|$VD_login|XXXX|$ip|$browser|\n");
fwrite ($fp, "vdweb|FAIL|$date|\n");
fclose($fp);
}
$VDloginDISPLAY=1;
www/agc/update_cf_ivr.php
+4 -3
View File
@@ -1,7 +1,7 @@
<?php
# update_cf_ivr.php
#
# Copyright (C) 2017 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# This script is part of the API group and any modifications of data are
# logged to the vicidial_api_log table.
@@ -11,6 +11,7 @@
# CHANGES
# 150814-1441 - First Build
# 170526-2319 - Added additional variable filtering
# 210615-1030 - Default security fixes, CVE-2021-28854
#
$api_script = 'update_cf_ivr';
@@ -192,7 +193,7 @@ else
if ($log_to_file > 0)
{
$fp = fopen ("./update_cf.txt", "a");
fwrite ($fp, "$NOW_TIME|$k|$lead_id|$caller_id|$list_id|$field|$value|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n");
$fp = fopen ("./update_cf.txt", "w");
# fwrite ($fp, "$NOW_TIME|$k|$lead_id|$caller_id|$list_id|$field|$value|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n");
fclose($fp);
}
www/agc/vdc_db_query.php
+49 -32
View File
@@ -508,10 +508,11 @@
# 210421-2111 - Added more screen labels
# 210606-0957 - Added TILTX features for pre-carrier call filtering
# 210609-1045 - Added in_man_dial_next_ready_seconds to update_settings function
# 210615-1014 - Default security fixes, CVE-2021-28854
#
$version = '2.14-401';
$build = '210609-1045';
$version = '2.14-402';
$build = '210615-1014';
$php_script = 'vdc_db_query.php';
$mel=1; # Mysql Error Log enabled = 1
$mysql_log_count=850;
@@ -5370,8 +5371,10 @@ if ($ACTION == 'manDiaLnextCaLL')
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00672',$user,$server_ip,$session_name,$one_mysql_log);}
$vla_update_timer = mysqli_affected_rows($link);
$fp = fopen ("./call_url_log.txt", "a");
fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n");
$fp = fopen ("./call_url_log.txt", "w");
# fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n");
fwrite ($fp, "$NOW_TIME|minuteswarning1|\n");
fclose($fp);
}
}
@@ -7081,8 +7084,9 @@ if ($ACTION == 'manDiaLonly')
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00684',$user,$server_ip,$session_name,$one_mysql_log);}
$vla_update_timer = mysqli_affected_rows($link);
$fp = fopen ("./call_url_log.txt", "a");
fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n");
$fp = fopen ("./call_url_log.txt", "w");
# fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n");
fwrite ($fp, "$NOW_TIME|minuteswarning2|\n");
fclose($fp);
}
}
@@ -7424,8 +7428,9 @@ if ($stage == "start")
{
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./vicidial_debug.txt", "a");
fwrite ($fp, "$NOW_TIME|VL_LOG_0|$uniqueid|$lead_id|$user|$list_id|$campaign|$start_epoch|$phone_number|$agent_log_id|\n");
$fp = fopen ("./vicidial_debug.txt", "w");
# fwrite ($fp, "$NOW_TIME|VL_LOG_0|$uniqueid|$lead_id|$user|$list_id|$campaign|$start_epoch|$phone_number|$agent_log_id|\n");
fwrite ($fp, "$NOW_TIME|VL_LOG_0|\n");
fclose($fp);
}
@@ -7560,8 +7565,9 @@ if ($stage == "end")
if ( (strlen($uniqueid)<1) and ($VLA_inOUT == 'INBOUND') )
{
$fp = fopen ("./vicidial_debug.txt", "a");
fwrite ($fp, "$NOW_TIME|INBND_LOG_0|$uniqueid|$lead_id|$user|$inOUT|$VLA_inOUT|$start_epoch|$phone_number|$agent_log_id|\n");
$fp = fopen ("./vicidial_debug.txt", "w");
# fwrite ($fp, "$NOW_TIME|INBND_LOG_0|$uniqueid|$lead_id|$user|$inOUT|$VLA_inOUT|$start_epoch|$phone_number|$agent_log_id|\n");
fwrite ($fp, "$NOW_TIME|INBND_LOG_0|\n");
fclose($fp);
$uniqueid='6666.1';
}
@@ -7633,8 +7639,9 @@ if ($stage == "end")
if ( ($length_in_sec < 1) and ($VLA_inOUT == 'INBOUND') )
{
$fp = fopen ("./vicidial_debug.txt", "a");
fwrite ($fp, "$NOW_TIME|INBND_LOG_1|$uniqueid|$lead_id|$user|$inOUT|$length_in_sec|$VDterm_reason|$VDvicidial_id|$start_epoch|\n");
$fp = fopen ("./vicidial_debug.txt", "w");
# fwrite ($fp, "$NOW_TIME|INBND_LOG_1|$uniqueid|$lead_id|$user|$inOUT|$length_in_sec|$VDterm_reason|$VDvicidial_id|$start_epoch|\n");
fwrite ($fp, "$NOW_TIME|INBND_LOG_1|\n");
fclose($fp);
##### start epoch in the vicidial_log table, couldn't find one in vicidial_closer_log
@@ -7683,8 +7690,9 @@ if ($stage == "end")
}
else
{
$fp = fopen ("./vicidial_debug.txt", "a");
fwrite ($fp, "$NOW_TIME|INBND_LOG_2|$uniqueid|$lead_id|$user|$inOUT|$length_in_sec|$VDterm_reason|$VDvicidial_id|$start_epoch|\n");
$fp = fopen ("./vicidial_debug.txt", "w");
# fwrite ($fp, "$NOW_TIME|INBND_LOG_2|$uniqueid|$lead_id|$user|$inOUT|$length_in_sec|$VDterm_reason|$VDvicidial_id|$start_epoch|\n");
fwrite ($fp, "$NOW_TIME|INBND_LOG_2|\n");
fclose($fp);
}
}
@@ -8683,8 +8691,9 @@ if ($stage == "end")
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./vicidial_debug.txt", "a");
fwrite ($fp, "$NOW_TIME|INBND_LOG_3|$uniqueid|$lead_id|$user|$inOUT|$VLA_inOUT|$length_in_sec|$VDterm_reason|$VDvicidial_id|$vicidial_id|$start_epoch|$recording_id|\n");
$fp = fopen ("./vicidial_debug.txt", "w");
# fwrite ($fp, "$NOW_TIME|INBND_LOG_3|$uniqueid|$lead_id|$user|$inOUT|$VLA_inOUT|$length_in_sec|$VDterm_reason|$VDvicidial_id|$vicidial_id|$start_epoch|$recording_id|\n");
fwrite ($fp, "$NOW_TIME|INBND_LOG_3|\n");
fclose($fp);
}
}
@@ -8770,8 +8779,9 @@ if ($stage == "end")
if ($log_no_enter > 0)
{
$fp = fopen ("./vicidial_debug.txt", "a");
fwrite ($fp, "$NOW_TIME|DIAL_LOG_1N|$uniqueid|$lead_id|$user|$inOUT|$VLA_inOUT|$start_epoch|$phone_number|$MDnextCID|$agentchannel|$loop_count|$total_rec|$total_hangup|$VDstop_rec_after_each_call\n");
$fp = fopen ("./vicidial_debug.txt", "w");
# fwrite ($fp, "$NOW_TIME|DIAL_LOG_1N|$uniqueid|$lead_id|$user|$inOUT|$VLA_inOUT|$start_epoch|$phone_number|$MDnextCID|$agentchannel|$loop_count|$total_rec|$total_hangup|$VDstop_rec_after_each_call\n");
fwrite ($fp, "$NOW_TIME|DIAL_LOG_1N|\n");
fclose($fp);
exit;
@@ -9228,8 +9238,9 @@ if ($ACTION == 'VDADcheckINCOMING')
}
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./vicidial_debug.txt", "a");
fwrite ($fp, "$NOW_TIME|INBND|$callerid|$user|$user_group|$list_id|$lead_id|$phone_number|$uniqueid|$VDADchannel_group|$call_type|$dialed_number|$dialed_label|$INclosecallid|$INxfercallid|\n");
$fp = fopen ("./vicidial_debug.txt", "w");
# fwrite ($fp, "$NOW_TIME|INBND|$callerid|$user|$user_group|$list_id|$lead_id|$phone_number|$uniqueid|$VDADchannel_group|$call_type|$dialed_number|$dialed_label|$INclosecallid|$INxfercallid|\n");
fwrite ($fp, "$NOW_TIME|INBND|\n");
fclose($fp);
}
}
@@ -10312,8 +10323,9 @@ if ($ACTION == 'VDADcheckINCOMING')
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00295',$user,$server_ip,$session_name,$one_mysql_log);}
$vla_update_timer = mysqli_affected_rows($link);
$fp = fopen ("./call_url_log.txt", "a");
fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n");
$fp = fopen ("./call_url_log.txt", "w");
# fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n");
fwrite ($fp, "$NOW_TIME|minuteswarning3|\n");
fclose($fp);
}
}
@@ -11647,8 +11659,9 @@ if ($ACTION == 'VDADcheckINCOMINGother')
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00528',$user,$server_ip,$session_name,$one_mysql_log);}
$vla_update_timer = mysqli_affected_rows($link);
$fp = fopen ("./call_url_log.txt", "a");
fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n");
$fp = fopen ("./call_url_log.txt", "w");
# fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n");
fwrite ($fp, "$NOW_TIME|minuteswarning4|\n");
fclose($fp);
}
}
@@ -11944,8 +11957,9 @@ if ($ACTION == 'LeaDSearcHSelecTUpdatE')
}
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./vicidial_debug.txt", "a");
fwrite ($fp, "$NOW_TIME|INBND|$callerid|$user|$user_group|$list_id|$lead_id|$phone_number|$uniqueid|$VDADchannel_group|$call_type|$dialed_number|$dialed_label|$INclosecallid|$INxfercallid|\n");
$fp = fopen ("./vicidial_debug.txt", "w");
# fwrite ($fp, "$NOW_TIME|INBND|$callerid|$user|$user_group|$list_id|$lead_id|$phone_number|$uniqueid|$VDADchannel_group|$call_type|$dialed_number|$dialed_label|$INclosecallid|$INxfercallid|\n");
fwrite ($fp, "$NOW_TIME|INBND|\n");
fclose($fp);
}
@@ -14700,8 +14714,9 @@ if ($ACTION == 'updateDISPO')
$SCUoutput='';
foreach ($SCUfile as $SCUline)
{$SCUoutput .= "$SCUline";}
$fp = fopen ("./call_url_log.txt", "a");
fwrite ($fp, "$dispo_call_urlARY[$j]\n$SCUoutput\n");
$fp = fopen ("./call_url_log.txt", "w");
# fwrite ($fp, "$dispo_call_urlARY[$j]\n$SCUoutput\n");
fwrite ($fp, "$NOW_TIME|vtiger|\n");
fclose($fp);
}
@@ -14713,8 +14728,9 @@ if ($ACTION == 'updateDISPO')
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00317',$user,$server_ip,$session_name,$one_mysql_log);}
if ($DB) {echo "$stmt\n";}
$bms_ct = mysqli_num_rows($rslt);
$fp = fopen ("./call_url_log.txt", "a");
fwrite ($fp, "$dispo_call_urlARY[$j]\n$stmt|$bms_ct\n");
$fp = fopen ("./call_url_log.txt", "w");
# fwrite ($fp, "$dispo_call_urlARY[$j]\n$stmt|$bms_ct\n");
fwrite ($fp, "$NOW_TIME|vtiger2|\n");
fclose($fp);
if ($bms_ct > 0)
@@ -18945,8 +18961,9 @@ if ($ACTION == 'CALLSINQUEUEgrab')
$row=mysqli_fetch_row($rslt);
if ($WeBRooTWritablE > 0)
{
$fp = fopen ("./vicidial_debug.txt", "a");
fwrite ($fp, "$NOW_TIME|GRAB_CALL |$stmtU|$VACaffected_rows|$stmtD|$row[0]|$row[1]|$row[2]|$row[3]|$row[4]|$row[5]|$row[6]|$row[7]|$row[8]|$row[9]|$row[10]|$row[11]|$row[12]|$row[13]|$row[14]|$row[15]|$row[16]|$row[17]|$row[18]|\n");
$fp = fopen ("./vicidial_debug.txt", "w");
# fwrite ($fp, "$NOW_TIME|GRAB_CALL |$stmtU|$VACaffected_rows|$stmtD|$row[0]|$row[1]|$row[2]|$row[3]|$row[4]|$row[5]|$row[6]|$row[7]|$row[8]|$row[9]|$row[10]|$row[11]|$row[12]|$row[13]|$row[14]|$row[15]|$row[16]|$row[17]|$row[18]|\n");
fwrite ($fp, "$NOW_TIME|GRAB_CALL|\n");
fclose($fp);
}
}
www/agc/vicidial-grey.php
+5 -4
View File
@@ -1,7 +1,7 @@
<?php
# vicidial-grey.php - the web-based version of the astVICIDIAL client application
#
# Copyright (C) 2019 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# Other scripts that this application depends on:
# - vdc_db_query.php: Updates information in the database
@@ -527,6 +527,7 @@
# NOTE: THIS VERSION WILL EVENTUALLY BECOME UNSUPPORTED!!!!!!!!!!
# 161102-1120 - Fixed QM partition problem
# 190111-0908 - Fix for PHP7
# 210615-1029 - Default security fixes, CVE-2021-28854
#
$version = '2.12-494c-grey';
@@ -1171,7 +1172,7 @@ if ( (strlen($phone_login)<2) or (strlen($phone_pass)<2) )
else
{
if ($WeBRooTWritablE > 0)
{$fp = fopen ("./vicidial_auth_entries.txt", "a");}
{$fp = fopen ("./vicidial_auth_entries.txt", "w");}
$VDloginDISPLAY=0;
if ( (strlen($VD_login)<2) or (strlen($VD_pass)<2) or (strlen($VD_campaign)<2) )
@@ -1498,7 +1499,7 @@ else
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "vdweb|GOOD|$date|$VD_login|XXXX|$ip|$browser|$LOGfullname|\n");
fwrite ($fp, "vdweb|GOOD|$date|\n");
fclose($fp);
}
$user_abb = "$VD_login$VD_login$VD_login$VD_login";
@@ -2310,7 +2311,7 @@ else
{
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "vdweb|FAIL|$date|$VD_login|XXXX|$ip|$browser|\n");
fwrite ($fp, "vdweb|FAIL|$date|\n");
fclose($fp);
}
$VDloginDISPLAY=1;
www/agc/vicidial.php
+6 -5
View File
@@ -668,10 +668,11 @@
# 210421-2110 - Added more screen labels
# 210606-0955 - Cleanup of debugbottomspan, testing of TILTX features
# 210609-0942 - Added in_man_dial_next_ready_seconds campaign options
# 210615-0959 - Default security fix, CVE-2021-28854
#
$version = '2.14-636c';
$build = '210609-0942';
$version = '2.14-637c';
$build = '210615-0959';
$mel=1; # Mysql Error Log enabled = 1
$mysql_log_count=95;
$one_mysql_log=0;
@@ -1518,7 +1519,7 @@ if ( (strlen($phone_login)<2) or (strlen($phone_pass)<2) )
else
{
if ($WeBRooTWritablE > 0)
{$fp = fopen ("./vicidial_auth_entries.txt", "a");}
{$fp = fopen ("./vicidial_auth_entries.txt", "w");}
$VDloginDISPLAY=0;
if ( (strlen($VD_login)<2) or (strlen($VD_pass)<2) or (strlen($VD_campaign)<2) )
@@ -2046,7 +2047,7 @@ else
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "vdweb|GOOD|$date|$VD_login|XXXX|$ip|$browser|$LOGfullname|\n");
fwrite ($fp, "vdweb|GOOD|$date|$browser|\n");
fclose($fp);
}
$user_abb = "$VD_login$VD_login$VD_login$VD_login";
@@ -3132,7 +3133,7 @@ else
{
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "vdweb|FAIL|$date|$VD_login|XXXX|$ip|$browser|\n");
fwrite ($fp, "vdweb|FAIL|$date|$browser|\n");
fclose($fp);
}
$VDloginDISPLAY=1;
www/chat_customer/functions.php
+7 -5
View File
@@ -4,11 +4,12 @@
#
# functions for agent scripts
#
# Copyright (C) 2015 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
#
# CHANGES:
# 151212-0826 - First Build for customer chat, based on agc/functions.php
# 210615-1044 - Default security fixes, CVE-2021-28854
#
# $mysql_queries = 20
@@ -107,8 +108,8 @@ function user_authorization($user,$pass,$user_option,$user_update,$bcrypt,$retur
}
if ($SSwebroot_writable > 0)
{
$fp = fopen ("./project_auth_entries.txt", "a");
fwrite ($fp, "AGENT|FAIL|$NOW_TIME|$user|$auth_key|$ip|$browser|\n");
$fp = fopen ("./project_auth_entries.txt", "w");
fwrite ($fp, "AGENT|FAIL|$NOW_TIME|\n");
fclose($fp);
}
}
@@ -2050,8 +2051,9 @@ function mysql_error_logging($NOW_TIME,$link,$mel,$stmt,$query_id,$user,$server_
if ( ($errno > 0) or ($mel > 1) or ($one_mysql_log > 0) )
{
$error = mysqli_error($link);
$efp = fopen ("./vicidial_mysqli_errors.txt", "a");
fwrite ($efp, "$NOW_TIME|vdc_db_query|$query_id|$errno|$error|$stmt|$user|$server_ip|$session_name|\n");
$efp = fopen ("./vicidial_mysqli_errors.txt", "w");
# fwrite ($efp, "$NOW_TIME|customer_chat|$query_id|$errno|$error|$stmt|$user|$server_ip|$session_name|\n");
fwrite ($efp, "$NOW_TIME|customer_chat|$query_id|\n");
fclose($efp);
}
}
www/vicidial/admin.php
+7 -2
View File
@@ -146,6 +146,10 @@ if (!file_exists('old_clear'))
fwrite($clear_file, '1');
fclose($clear_file);
}
if (file_exists('project_auth_entries.txt'))
{
unlink('project_auth_entries.txt');
}
### END housecleaning of old static report files ###
@@ -5664,12 +5668,13 @@ if ($SSscript_remove_js > 0)
# 210429-1624 - Added mohsuggest phone config option
# 210519-1747 - Fix for Copy Phone conf rebuild, Require prompt be populated on Call Menu creation and modification
# 210608-2108 - Added In-Group Drop Seconds Override Container and Inbound Manual Dial Agent Forced Ready features
# 210615-1108 - Default security fixes, CVE-2021-28854
#
# make sure you have added a user to the vicidial_users MySQL table with at least user_level 9 to access this page the first time
$admin_version = '2.14-814a';
$build = '210608-2108';
$admin_version = '2.14-815a';
$build = '210615-1108';
$STARTtime = date("U");
$SQLdate = date("Y-m-d H:i:s");
www/vicidial/functions.php
+3 -2
View File
@@ -38,6 +38,7 @@
# 210311-2316 - Added 2FA check in user_authorization function
# 210316-0924 - Small fix for 2FA consistency
# 210406-1740 - Moved 'dialable_leads' function to this script
# 210615-0952 - Default security fix, CVE-2021-28854
#
##### BEGIN validate user login credentials, check for failed lock out #####
@@ -135,8 +136,8 @@ function user_authorization($user,$pass,$user_option,$user_update,$api_call)
}
if ($SSwebroot_writable > 0)
{
$fp = fopen ("./project_auth_entries.txt", "a");
fwrite ($fp, "ADMIN|FAIL|$NOW_TIME|X|$auth_key|$ip|$browser|\n");
$fp = fopen ("./project_auth_entries.txt", "w");
fwrite ($fp, "ADMIN|FAIL|$NOW_TIME|$browser|\n");
fclose($fp);
}
}
www/vicidial/log_test.php
+4 -7
View File
@@ -1,7 +1,7 @@
<?php
# log_test.php
#
# Copyright (C) 2009 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
@@ -15,20 +15,17 @@ if (!isset($begin_date)) {$begin_date = $TODAY;}
if (!isset($end_date)) {$end_date = $TODAY;}
$fp = fopen ("./closer_SQL_updates.txt", "a");
$fp = fopen ("./closer_SQL_updates.txt", "w");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
fwrite ($fp, "CLOSER SQL UPDATE|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|$LOGfullname|\n");
fclose($fp);
fwrite ($fp, "CLOSER SQL UPDATE|$date|\n");
fclose($fp);
exit;
?>
www/vicidial/recording_lookup_DIRECT.php
+2 -2
View File
@@ -68,11 +68,11 @@ else
exit;
}
$fp = fopen ("/usr/local/apache2/htdocs/vicidial/auth_entries.txt", "a");
$fp = fopen ("/usr/local/apache2/htdocs/vicidial/auth_entries.txt", "w");
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
fwrite ($fp, "AUTH|VDC |$date|$auth|$ip|$phone|$format|$browser|\n");
fwrite ($fp, "AUTH|VDC |$date|\n");
fclose($fp);
if (strlen($format)<3) {$format='WAV';}