diff --git a/extras/get2post.php b/extras/get2post.php index 7a20f460..5e84dc56 100644 --- a/extras/get2post.php +++ b/extras/get2post.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # This script is designed to take a url as part of the query string and convert # it to a POST HTTP request and log to the url log table. uniqueid is required! @@ -22,10 +22,11 @@ # 170324-1218 - Added headers options # 170418-1257 - Added ability to use some special characters in headers # 170531-0925 - Added ability to accept POST query string +# 210615-1042 - Default security fixes, CVE-2021-28854 # -$version = '2.14-4'; -$build = '170531-0925'; +$version = '2.14-5'; +$build = '210615-1042'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -207,8 +208,9 @@ if (strlen($resp) > 0) if ($webroot_writable > 0) { - $fp = fopen ("./get2post.txt", "a"); - fwrite ($fp, "$output|$query_string\n"); + $fp = fopen ("./get2post.txt", "w"); +# fwrite ($fp, "$output|$query_string\n"); + fwrite ($fp, "$NOW_TIME|\n"); fclose($fp); } diff --git a/www/agc/astguiclient.php b/www/agc/astguiclient.php index 9fa29a39..943c165b 100644 --- a/www/agc/astguiclient.php +++ b/www/agc/astguiclient.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # make sure you have added a user to the vicidial_users MySQL table with at least # user_level 1 or greater to access this page. Also you need to have the login @@ -70,10 +70,11 @@ # 150727-0915 - Added default_language # 190111-0902 - Fix for PHP7 # 200319-1532 - Small fixes for conference tab issues +# 210615-1037 - Default security fixes, CVE-2021-28854 # -$version = '2.2.6-3'; -$build = '200319-1532'; +$version = '2.2.6-4'; +$build = '210615-1037'; require_once("dbconnect_mysqli.php"); require_once("functions.php"); @@ -180,7 +181,7 @@ if (preg_match("/^GOOD/",$auth_message)) $US='_'; $CL=':'; if ($WeBRooTWritablE > 0) - {$fp = fopen ("./astguiclient_auth_entries.txt", "a");} + {$fp = fopen ("./astguiclient_auth_entries.txt", "w");} $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); @@ -238,7 +239,7 @@ else $LOGfullname=$row[0]; if ($WeBRooTWritablE > 0) { - fwrite ($fp, "VICIDIAL|GOOD|$date|$user|XXXX|$ip|$browser|$LOGfullname|\n"); + fwrite ($fp, "VICIDIAL|GOOD|$date|\n"); fclose($fp); } } @@ -246,7 +247,7 @@ else { if ($WeBRooTWritablE > 0) { - fwrite ($fp, "VICIDIAL|FAIL|$date|$user|XXXX|$ip|$browser|$LOGfullname|\n"); + fwrite ($fp, "VICIDIAL|FAIL|$date|\n"); fclose($fp); } } diff --git a/www/agc/deactivate_lead.php b/www/agc/deactivate_lead.php index cf10b059..0c8808a4 100644 --- a/www/agc/deactivate_lead.php +++ b/www/agc/deactivate_lead.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # This script is designed to be used in the "Dispo URL" field of a campaign # or in-group. It should take in the campaign_id to check for the same source_id @@ -32,6 +32,7 @@ # 141216-2130 - Added language settings lookups and user/pass variable standardization # 170526-2301 - Added additional variable filtering # 201117-2222 - Changes for better compatibility with non-latin data input +# 210615-1036 - Default security fixes, CVE-2021-28854 # $api_script = 'deactivate'; @@ -231,7 +232,8 @@ else if ($log_to_file > 0) { - $fp = fopen ("./deactivate_lead.txt", "a"); - fwrite ($fp, "$NOW_TIME|$lead_id|$search_field|$search_value|$campaign_check|$sale_status|$dispo|$new_status|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n"); + $fp = fopen ("./deactivate_lead.txt", "w"); +# fwrite ($fp, "$NOW_TIME|$lead_id|$search_field|$search_value|$campaign_check|$sale_status|$dispo|$new_status|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n"); + fwrite ($fp, "$NOW_TIME|\n"); fclose($fp); } diff --git a/www/agc/dispo_add_FPG.php b/www/agc/dispo_add_FPG.php index 411f703d..a6358310 100644 --- a/www/agc/dispo_add_FPG.php +++ b/www/agc/dispo_add_FPG.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # This script is designed to be used in the "Dispo URL" field of a campaign # or in-group. It adds the phone_number of the call to a designated inbound @@ -21,6 +21,7 @@ # CHANGES # 150724-1657 - First Build # 170526-2305 - Added additional variable filtering +# 210615-1039 - Default security fixes, CVE-2021-28854 # $api_script = 'add_FPG'; @@ -219,7 +220,8 @@ else if ($log_to_file > 0) { - $fp = fopen ("./add_FPG.txt", "a"); - fwrite ($fp, "$NOW_TIME|$k|$phone_number|$FPG_id|$sale_status|$dispo|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n"); + $fp = fopen ("./add_FPG.txt", "w"); +# fwrite ($fp, "$NOW_TIME|$k|$phone_number|$FPG_id|$sale_status|$dispo|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n"); + fwrite ($fp, "$NOW_TIME|\n"); fclose($fp); } diff --git a/www/agc/dispo_change_status.php b/www/agc/dispo_change_status.php index 3fec153f..2343d2f7 100644 --- a/www/agc/dispo_change_status.php +++ b/www/agc/dispo_change_status.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # This script is designed to be used in the "Dispo URL" field of a campaign # or in-group. It can update the status of a lead to a new status if the lead @@ -25,6 +25,7 @@ # CHANGES # 171127-1736 - First Build # 201117-2217 - Changes for better compatibility with non-latin data input +# 210615-1035 - Default security fixes, CVE-2021-28854 # $api_script = 'dispo_change_status'; @@ -290,7 +291,8 @@ else if ($log_to_file > 0) { - $fp = fopen ("./$api_script.txt", "a"); - fwrite ($fp, "$NOW_TIME|$k|$lead_id|$dispo|$logged_status|$logged_count($search_count)|$new_status|$days_search($days_search_date)|$archive_search|$in_out_search|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n"); + $fp = fopen ("./$api_script.txt", "w"); +# fwrite ($fp, "$NOW_TIME|$k|$lead_id|$dispo|$logged_status|$logged_count($search_count)|$new_status|$days_search($days_search_date)|$archive_search|$in_out_search|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n"); + fwrite ($fp, "$NOW_TIME|\n"); fclose($fp); } diff --git a/www/agc/dispo_move_list.php b/www/agc/dispo_move_list.php index e1b36cb6..eaa9c7b7 100644 --- a/www/agc/dispo_move_list.php +++ b/www/agc/dispo_move_list.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # This script is designed to be used in the "Dispo URL" field of a campaign # or in-group (although it can also be used in the "No Agent Call URL" field). @@ -65,6 +65,7 @@ # 170402-0906 - Added list_id_trigger option, cleaned up outputs # 170526-2310 - Added additional variable filtering # 180419-2257 - Added multi_trigger option +# 210615-1038 - Default security fixes, CVE-2021-28854 # $api_script = 'movelist'; @@ -504,7 +505,8 @@ else if ($log_to_file > 0) { - $fp = fopen ("./dispo_move_list.txt", "a"); - fwrite ($fp, "$NOW_TIME|$k|$lead_id|$dispo|$user|XXXX|$DB|$log_to_file|$talk_time|$called_count|$first_pass_vars|$new_list_id|$original_sale_status|$talk_time_trigger|$exclude_status|$called_count_trigger|$list_id|$list_id_trigger|$multi_trigger|$MESSAGE|\n"); + $fp = fopen ("./dispo_move_list.txt", "w"); +# fwrite ($fp, "$NOW_TIME|$k|$lead_id|$dispo|$user|XXXX|$DB|$log_to_file|$talk_time|$called_count|$first_pass_vars|$new_list_id|$original_sale_status|$talk_time_trigger|$exclude_status|$called_count_trigger|$list_id|$list_id_trigger|$multi_trigger|$MESSAGE|\n"); + fwrite ($fp, "$NOW_TIME|\n"); fclose($fp); } diff --git a/www/agc/dispo_send_email.php b/www/agc/dispo_send_email.php index a03412e3..0afd44a2 100644 --- a/www/agc/dispo_send_email.php +++ b/www/agc/dispo_send_email.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # This script is designed to be used in the "Dispo URL" field of a campaign # or in-group. It will send out an email to a fixed email address as defined @@ -41,6 +41,7 @@ # 191013-2113 - Fixes for PHP7 # 200814-1829 - added email_body_html, email_body_utf8 flags # 201117-2104 - Changes for better compatibility with non-latin data input +# 210615-1033 - Default security fixes, CVE-2021-28854 # $api_script = 'send_email'; @@ -1368,7 +1369,8 @@ else if ($log_to_file > 0) { - $fp = fopen ("./send_email.txt", "a"); - fwrite ($fp, "$NOW_TIME|$k|$lead_id|$call_id|$container_id|$sale_status|$dispo|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n"); + $fp = fopen ("./send_email.txt", "w"); +# fwrite ($fp, "$NOW_TIME|$k|$lead_id|$call_id|$container_id|$sale_status|$dispo|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n"); + fwrite ($fp, "$NOW_TIME|\n"); fclose($fp); } diff --git a/www/agc/functions.php b/www/agc/functions.php index eb2e44c9..e13ac097 100644 --- a/www/agc/functions.php +++ b/www/agc/functions.php @@ -55,6 +55,7 @@ # 210401-2132 - Fixed issue #1271, security_phrase field not populating in custom fields form # 210404-0902 - Added function to refresh a single field # 210603-1616 - Fix for specific custom field values with a slash in them +# 210615-1032 - Default security fixes, CVE-2021-28854 # # $mysql_queries = 26 @@ -155,8 +156,8 @@ function user_authorization($user,$pass,$user_option,$user_update,$bcrypt,$retur } if ($SSwebroot_writable > 0) { - $fp = fopen ("./project_auth_entries.txt", "a"); - fwrite ($fp, "AGENT|FAIL|$NOW_TIME|$user|$auth_key|$ip|$browser|\n"); + $fp = fopen ("./project_auth_entries.txt", "w"); + fwrite ($fp, "AGENT|FAIL|$NOW_TIME|\n"); fclose($fp); } } @@ -2689,8 +2690,9 @@ function mysql_error_logging($NOW_TIME,$link,$mel,$stmt,$query_id,$user,$server_ if ( ($errno > 0) or ($mel > 1) or ($one_mysql_log > 0) ) { $error = mysqli_error($link); - $efp = fopen ("./vicidial_mysqli_errors.txt", "a"); - fwrite ($efp, "$NOW_TIME|vdc_db_query|$query_id|$errno|$error|$stmt|$user|$server_ip|$session_name|\n"); + $efp = fopen ("./vicidial_mysqli_errors.txt", "w"); + # fwrite ($efp, "$NOW_TIME|vdc_db_query|$query_id|$errno|$error|$stmt|$user|$server_ip|$session_name|\n"); + fwrite ($efp, "$NOW_TIME|vdc_db_query|$query_id|\n"); fclose($efp); } } diff --git a/www/agc/manager_send.php b/www/agc/manager_send.php index bd7c344a..054ab459 100644 --- a/www/agc/manager_send.php +++ b/www/agc/manager_send.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # This script is designed purely to insert records into the vicidial_manager table to signal Actions to an asterisk server # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table @@ -145,10 +145,11 @@ # 191013-2114 - Fixes for PHP7 # 201107-2228 - Added campaign/in-group logging in park_log # 201117-1751 - Changes for better compatibility with non-latin data input +# 210615-1016 - Default security fixes, CVE-2021-28854 # -$version = '2.14-92'; -$build = '201117-1751'; +$version = '2.14-93'; +$build = '210615-1016'; $php_script = 'manager_send.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=143; @@ -760,8 +761,9 @@ if ($ACTION=="Hangup") echo _QXZ("Channel %1s in use by another agent on %2s, Hangup command not inserted",0,'',$channel,$call_server_ip)." $rowx[0]\n$stmt\n"; if ($WeBRooTWritablE > 0) { - $fp = fopen ("./vicidial_debug.txt", "a"); - fwrite ($fp, "$NOW_TIME|MDCHU|$user|$channel|$call_server_ip|$exten|\n"); + $fp = fopen ("./vicidial_debug.txt", "w"); + # fwrite ($fp, "$NOW_TIME|MDCHU|$user|$channel|$call_server_ip|$exten|\n"); + fwrite ($fp, "$NOW_TIME|MDCHU|\n"); fclose($fp); } } @@ -1749,8 +1751,9 @@ if ($ACTION=="RedirectXtraCXNeW") { if ($WeBRooTWritablE > 0) { - $fp = fopen ("./vicidial_debug.txt", "a"); - fwrite ($fp, "$NOW_TIME|RDCXC|$filename|$user|$campaign|$channel|$extrachannel|$queryCID|$exten|$ext_context|ext_priority|\n"); + $fp = fopen ("./vicidial_debug.txt", "w"); + # fwrite ($fp, "$NOW_TIME|RDCXC|$filename|$user|$campaign|$channel|$extrachannel|$queryCID|$exten|$ext_context|ext_priority|\n"); + fwrite ($fp, "$NOW_TIME|RDCXC|\n"); fclose($fp); } } @@ -1936,8 +1939,9 @@ if ($ACTION=="RedirectXtraCXNeW") { if ($WeBRooTWritablE > 0) { - $fp = fopen ("./vicidial_debug.txt", "a"); - fwrite ($fp, "$NOW_TIME|RDCXC|$filename|$user|$campaign|$DBout|\n"); + $fp = fopen ("./vicidial_debug.txt", "w"); + # fwrite ($fp, "$NOW_TIME|RDCXC|$filename|$user|$campaign|$DBout|\n"); + fwrite ($fp, "$NOW_TIME|RDCXC|\n"); fclose($fp); } } @@ -1975,8 +1979,9 @@ if ($ACTION=="RedirectXtraNeW") { if ($WeBRooTWritablE > 0) { - $fp = fopen ("./vicidial_debug.txt", "a"); - fwrite ($fp, "$NOW_TIME|RDX|$filename|$user|$campaign|$channel|$extrachannel|$queryCID|$exten|$ext_context|ext_priority|$session_id|\n"); + $fp = fopen ("./vicidial_debug.txt", "w"); + # fwrite ($fp, "$NOW_TIME|RDX|$filename|$user|$campaign|$channel|$extrachannel|$queryCID|$exten|$ext_context|ext_priority|$session_id|\n"); + fwrite ($fp, "$NOW_TIME|RDX|\n"); fclose($fp); } } @@ -2145,8 +2150,9 @@ if ($ACTION=="RedirectXtraNeW") { if ($WeBRooTWritablE > 0) { - $fp = fopen ("./vicidial_debug.txt", "a"); - fwrite ($fp, "$NOW_TIME|RDX|$filename|$user|$campaign|$DBout|\n"); + $fp = fopen ("./vicidial_debug.txt", "w"); + # fwrite ($fp, "$NOW_TIME|RDX|$filename|$user|$campaign|$DBout|\n"); + fwrite ($fp, "$NOW_TIME|RDX|\n"); fclose($fp); } } diff --git a/www/agc/phone_only.php b/www/agc/phone_only.php index 1bb5cbf1..e7c26b2c 100644 --- a/www/agc/phone_only.php +++ b/www/agc/phone_only.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # CHANGELOG # 110511-1336 - First Build @@ -19,10 +19,11 @@ # 170511-1107 - Added code for WebRTC phones # 181003-1736 - Added external_web_socket_url option # 200123-1639 - Added Webphone options +# 210615-1028 - Default security fixes, CVE-2021-28854 # -$version = '2.14-15p'; -$build = '200123-1639'; +$version = '2.14-16p'; +$build = '210615-1028'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=74; $one_mysql_log=0; @@ -356,7 +357,7 @@ if ( (strlen($phone_login) < 1) or (strlen($phone_pass) < 1) ) else { if ($WeBRooTWritablE > 0) - {$fp = fopen ("./vicidial_auth_entries.txt", "a");} + {$fp = fopen ("./vicidial_auth_entries.txt", "w");} $VDloginDISPLAY=0; if ( (strlen($VD_login)<2) or (strlen($VD_pass)<2) ) @@ -396,7 +397,7 @@ else if ($WeBRooTWritablE > 0) { - fwrite ($fp, "vdweb|GOOD|$date|$VD_login|XXXX|$ip|$browser|$LOGfullname|\n"); + fwrite ($fp, "vdweb|GOOD|$date|\n"); fclose($fp); } $user_abb = "$VD_login$VD_login$VD_login$VD_login"; @@ -408,7 +409,7 @@ else { if ($WeBRooTWritablE > 0) { - fwrite ($fp, "vdweb|FAIL|$date|$VD_login|XXXX|$ip|$browser|\n"); + fwrite ($fp, "vdweb|FAIL|$date|\n"); fclose($fp); } $VDloginDISPLAY=1; diff --git a/www/agc/update_cf_ivr.php b/www/agc/update_cf_ivr.php index 27210f9f..7f64e570 100644 --- a/www/agc/update_cf_ivr.php +++ b/www/agc/update_cf_ivr.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # This script is part of the API group and any modifications of data are # logged to the vicidial_api_log table. @@ -11,6 +11,7 @@ # CHANGES # 150814-1441 - First Build # 170526-2319 - Added additional variable filtering +# 210615-1030 - Default security fixes, CVE-2021-28854 # $api_script = 'update_cf_ivr'; @@ -192,7 +193,7 @@ else if ($log_to_file > 0) { - $fp = fopen ("./update_cf.txt", "a"); - fwrite ($fp, "$NOW_TIME|$k|$lead_id|$caller_id|$list_id|$field|$value|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n"); + $fp = fopen ("./update_cf.txt", "w"); +# fwrite ($fp, "$NOW_TIME|$k|$lead_id|$caller_id|$list_id|$field|$value|$user|XXXX|$DB|$log_to_file|$MESSAGE|\n"); fclose($fp); } diff --git a/www/agc/vdc_db_query.php b/www/agc/vdc_db_query.php index da9b1395..a24f796b 100644 --- a/www/agc/vdc_db_query.php +++ b/www/agc/vdc_db_query.php @@ -508,10 +508,11 @@ # 210421-2111 - Added more screen labels # 210606-0957 - Added TILTX features for pre-carrier call filtering # 210609-1045 - Added in_man_dial_next_ready_seconds to update_settings function +# 210615-1014 - Default security fixes, CVE-2021-28854 # -$version = '2.14-401'; -$build = '210609-1045'; +$version = '2.14-402'; +$build = '210615-1014'; $php_script = 'vdc_db_query.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=850; @@ -5370,8 +5371,10 @@ if ($ACTION == 'manDiaLnextCaLL') if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00672',$user,$server_ip,$session_name,$one_mysql_log);} $vla_update_timer = mysqli_affected_rows($link); - $fp = fopen ("./call_url_log.txt", "a"); - fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n"); + $fp = fopen ("./call_url_log.txt", "w"); + # fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n"); + + fwrite ($fp, "$NOW_TIME|minuteswarning1|\n"); fclose($fp); } } @@ -7081,8 +7084,9 @@ if ($ACTION == 'manDiaLonly') if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00684',$user,$server_ip,$session_name,$one_mysql_log);} $vla_update_timer = mysqli_affected_rows($link); - $fp = fopen ("./call_url_log.txt", "a"); - fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n"); + $fp = fopen ("./call_url_log.txt", "w"); + # fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n"); + fwrite ($fp, "$NOW_TIME|minuteswarning2|\n"); fclose($fp); } } @@ -7424,8 +7428,9 @@ if ($stage == "start") { if ($WeBRooTWritablE > 0) { - $fp = fopen ("./vicidial_debug.txt", "a"); - fwrite ($fp, "$NOW_TIME|VL_LOG_0|$uniqueid|$lead_id|$user|$list_id|$campaign|$start_epoch|$phone_number|$agent_log_id|\n"); + $fp = fopen ("./vicidial_debug.txt", "w"); + # fwrite ($fp, "$NOW_TIME|VL_LOG_0|$uniqueid|$lead_id|$user|$list_id|$campaign|$start_epoch|$phone_number|$agent_log_id|\n"); + fwrite ($fp, "$NOW_TIME|VL_LOG_0|\n"); fclose($fp); } @@ -7560,8 +7565,9 @@ if ($stage == "end") if ( (strlen($uniqueid)<1) and ($VLA_inOUT == 'INBOUND') ) { - $fp = fopen ("./vicidial_debug.txt", "a"); - fwrite ($fp, "$NOW_TIME|INBND_LOG_0|$uniqueid|$lead_id|$user|$inOUT|$VLA_inOUT|$start_epoch|$phone_number|$agent_log_id|\n"); + $fp = fopen ("./vicidial_debug.txt", "w"); + # fwrite ($fp, "$NOW_TIME|INBND_LOG_0|$uniqueid|$lead_id|$user|$inOUT|$VLA_inOUT|$start_epoch|$phone_number|$agent_log_id|\n"); + fwrite ($fp, "$NOW_TIME|INBND_LOG_0|\n"); fclose($fp); $uniqueid='6666.1'; } @@ -7633,8 +7639,9 @@ if ($stage == "end") if ( ($length_in_sec < 1) and ($VLA_inOUT == 'INBOUND') ) { - $fp = fopen ("./vicidial_debug.txt", "a"); - fwrite ($fp, "$NOW_TIME|INBND_LOG_1|$uniqueid|$lead_id|$user|$inOUT|$length_in_sec|$VDterm_reason|$VDvicidial_id|$start_epoch|\n"); + $fp = fopen ("./vicidial_debug.txt", "w"); + # fwrite ($fp, "$NOW_TIME|INBND_LOG_1|$uniqueid|$lead_id|$user|$inOUT|$length_in_sec|$VDterm_reason|$VDvicidial_id|$start_epoch|\n"); + fwrite ($fp, "$NOW_TIME|INBND_LOG_1|\n"); fclose($fp); ##### start epoch in the vicidial_log table, couldn't find one in vicidial_closer_log @@ -7683,8 +7690,9 @@ if ($stage == "end") } else { - $fp = fopen ("./vicidial_debug.txt", "a"); - fwrite ($fp, "$NOW_TIME|INBND_LOG_2|$uniqueid|$lead_id|$user|$inOUT|$length_in_sec|$VDterm_reason|$VDvicidial_id|$start_epoch|\n"); + $fp = fopen ("./vicidial_debug.txt", "w"); + # fwrite ($fp, "$NOW_TIME|INBND_LOG_2|$uniqueid|$lead_id|$user|$inOUT|$length_in_sec|$VDterm_reason|$VDvicidial_id|$start_epoch|\n"); + fwrite ($fp, "$NOW_TIME|INBND_LOG_2|\n"); fclose($fp); } } @@ -8683,8 +8691,9 @@ if ($stage == "end") if ($WeBRooTWritablE > 0) { - $fp = fopen ("./vicidial_debug.txt", "a"); - fwrite ($fp, "$NOW_TIME|INBND_LOG_3|$uniqueid|$lead_id|$user|$inOUT|$VLA_inOUT|$length_in_sec|$VDterm_reason|$VDvicidial_id|$vicidial_id|$start_epoch|$recording_id|\n"); + $fp = fopen ("./vicidial_debug.txt", "w"); + # fwrite ($fp, "$NOW_TIME|INBND_LOG_3|$uniqueid|$lead_id|$user|$inOUT|$VLA_inOUT|$length_in_sec|$VDterm_reason|$VDvicidial_id|$vicidial_id|$start_epoch|$recording_id|\n"); + fwrite ($fp, "$NOW_TIME|INBND_LOG_3|\n"); fclose($fp); } } @@ -8770,8 +8779,9 @@ if ($stage == "end") if ($log_no_enter > 0) { - $fp = fopen ("./vicidial_debug.txt", "a"); - fwrite ($fp, "$NOW_TIME|DIAL_LOG_1N|$uniqueid|$lead_id|$user|$inOUT|$VLA_inOUT|$start_epoch|$phone_number|$MDnextCID|$agentchannel|$loop_count|$total_rec|$total_hangup|$VDstop_rec_after_each_call\n"); + $fp = fopen ("./vicidial_debug.txt", "w"); + # fwrite ($fp, "$NOW_TIME|DIAL_LOG_1N|$uniqueid|$lead_id|$user|$inOUT|$VLA_inOUT|$start_epoch|$phone_number|$MDnextCID|$agentchannel|$loop_count|$total_rec|$total_hangup|$VDstop_rec_after_each_call\n"); + fwrite ($fp, "$NOW_TIME|DIAL_LOG_1N|\n"); fclose($fp); exit; @@ -9228,8 +9238,9 @@ if ($ACTION == 'VDADcheckINCOMING') } if ($WeBRooTWritablE > 0) { - $fp = fopen ("./vicidial_debug.txt", "a"); - fwrite ($fp, "$NOW_TIME|INBND|$callerid|$user|$user_group|$list_id|$lead_id|$phone_number|$uniqueid|$VDADchannel_group|$call_type|$dialed_number|$dialed_label|$INclosecallid|$INxfercallid|\n"); + $fp = fopen ("./vicidial_debug.txt", "w"); + # fwrite ($fp, "$NOW_TIME|INBND|$callerid|$user|$user_group|$list_id|$lead_id|$phone_number|$uniqueid|$VDADchannel_group|$call_type|$dialed_number|$dialed_label|$INclosecallid|$INxfercallid|\n"); + fwrite ($fp, "$NOW_TIME|INBND|\n"); fclose($fp); } } @@ -10312,8 +10323,9 @@ if ($ACTION == 'VDADcheckINCOMING') if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00295',$user,$server_ip,$session_name,$one_mysql_log);} $vla_update_timer = mysqli_affected_rows($link); - $fp = fopen ("./call_url_log.txt", "a"); - fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n"); + $fp = fopen ("./call_url_log.txt", "w"); + # fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n"); + fwrite ($fp, "$NOW_TIME|minuteswarning3|\n"); fclose($fp); } } @@ -11647,8 +11659,9 @@ if ($ACTION == 'VDADcheckINCOMINGother') if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00528',$user,$server_ip,$session_name,$one_mysql_log);} $vla_update_timer = mysqli_affected_rows($link); - $fp = fopen ("./call_url_log.txt", "a"); - fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n"); + $fp = fopen ("./call_url_log.txt", "w"); + # fwrite ($fp, "$VDCL_start_call_url\n$SCUoutput\n$durationLimit|$durationLimitSEC|$vla_update_timer|$minuteswarning|$uniqueid|\n"); + fwrite ($fp, "$NOW_TIME|minuteswarning4|\n"); fclose($fp); } } @@ -11944,8 +11957,9 @@ if ($ACTION == 'LeaDSearcHSelecTUpdatE') } if ($WeBRooTWritablE > 0) { - $fp = fopen ("./vicidial_debug.txt", "a"); - fwrite ($fp, "$NOW_TIME|INBND|$callerid|$user|$user_group|$list_id|$lead_id|$phone_number|$uniqueid|$VDADchannel_group|$call_type|$dialed_number|$dialed_label|$INclosecallid|$INxfercallid|\n"); + $fp = fopen ("./vicidial_debug.txt", "w"); + # fwrite ($fp, "$NOW_TIME|INBND|$callerid|$user|$user_group|$list_id|$lead_id|$phone_number|$uniqueid|$VDADchannel_group|$call_type|$dialed_number|$dialed_label|$INclosecallid|$INxfercallid|\n"); + fwrite ($fp, "$NOW_TIME|INBND|\n"); fclose($fp); } @@ -14700,8 +14714,9 @@ if ($ACTION == 'updateDISPO') $SCUoutput=''; foreach ($SCUfile as $SCUline) {$SCUoutput .= "$SCUline";} - $fp = fopen ("./call_url_log.txt", "a"); - fwrite ($fp, "$dispo_call_urlARY[$j]\n$SCUoutput\n"); + $fp = fopen ("./call_url_log.txt", "w"); + # fwrite ($fp, "$dispo_call_urlARY[$j]\n$SCUoutput\n"); + fwrite ($fp, "$NOW_TIME|vtiger|\n"); fclose($fp); } @@ -14713,8 +14728,9 @@ if ($ACTION == 'updateDISPO') if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00317',$user,$server_ip,$session_name,$one_mysql_log);} if ($DB) {echo "$stmt\n";} $bms_ct = mysqli_num_rows($rslt); - $fp = fopen ("./call_url_log.txt", "a"); - fwrite ($fp, "$dispo_call_urlARY[$j]\n$stmt|$bms_ct\n"); + $fp = fopen ("./call_url_log.txt", "w"); + # fwrite ($fp, "$dispo_call_urlARY[$j]\n$stmt|$bms_ct\n"); + fwrite ($fp, "$NOW_TIME|vtiger2|\n"); fclose($fp); if ($bms_ct > 0) @@ -18945,8 +18961,9 @@ if ($ACTION == 'CALLSINQUEUEgrab') $row=mysqli_fetch_row($rslt); if ($WeBRooTWritablE > 0) { - $fp = fopen ("./vicidial_debug.txt", "a"); - fwrite ($fp, "$NOW_TIME|GRAB_CALL |$stmtU|$VACaffected_rows|$stmtD|$row[0]|$row[1]|$row[2]|$row[3]|$row[4]|$row[5]|$row[6]|$row[7]|$row[8]|$row[9]|$row[10]|$row[11]|$row[12]|$row[13]|$row[14]|$row[15]|$row[16]|$row[17]|$row[18]|\n"); + $fp = fopen ("./vicidial_debug.txt", "w"); + # fwrite ($fp, "$NOW_TIME|GRAB_CALL |$stmtU|$VACaffected_rows|$stmtD|$row[0]|$row[1]|$row[2]|$row[3]|$row[4]|$row[5]|$row[6]|$row[7]|$row[8]|$row[9]|$row[10]|$row[11]|$row[12]|$row[13]|$row[14]|$row[15]|$row[16]|$row[17]|$row[18]|\n"); + fwrite ($fp, "$NOW_TIME|GRAB_CALL|\n"); fclose($fp); } } diff --git a/www/agc/vicidial-grey.php b/www/agc/vicidial-grey.php index 49ae217e..bdc18a86 100644 --- a/www/agc/vicidial-grey.php +++ b/www/agc/vicidial-grey.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # Other scripts that this application depends on: # - vdc_db_query.php: Updates information in the database @@ -527,6 +527,7 @@ # NOTE: THIS VERSION WILL EVENTUALLY BECOME UNSUPPORTED!!!!!!!!!! # 161102-1120 - Fixed QM partition problem # 190111-0908 - Fix for PHP7 +# 210615-1029 - Default security fixes, CVE-2021-28854 # $version = '2.12-494c-grey'; @@ -1171,7 +1172,7 @@ if ( (strlen($phone_login)<2) or (strlen($phone_pass)<2) ) else { if ($WeBRooTWritablE > 0) - {$fp = fopen ("./vicidial_auth_entries.txt", "a");} + {$fp = fopen ("./vicidial_auth_entries.txt", "w");} $VDloginDISPLAY=0; if ( (strlen($VD_login)<2) or (strlen($VD_pass)<2) or (strlen($VD_campaign)<2) ) @@ -1498,7 +1499,7 @@ else if ($WeBRooTWritablE > 0) { - fwrite ($fp, "vdweb|GOOD|$date|$VD_login|XXXX|$ip|$browser|$LOGfullname|\n"); + fwrite ($fp, "vdweb|GOOD|$date|\n"); fclose($fp); } $user_abb = "$VD_login$VD_login$VD_login$VD_login"; @@ -2310,7 +2311,7 @@ else { if ($WeBRooTWritablE > 0) { - fwrite ($fp, "vdweb|FAIL|$date|$VD_login|XXXX|$ip|$browser|\n"); + fwrite ($fp, "vdweb|FAIL|$date|\n"); fclose($fp); } $VDloginDISPLAY=1; diff --git a/www/agc/vicidial.php b/www/agc/vicidial.php index 4d9c6b56..b1f9ca93 100644 --- a/www/agc/vicidial.php +++ b/www/agc/vicidial.php @@ -668,10 +668,11 @@ # 210421-2110 - Added more screen labels # 210606-0955 - Cleanup of debugbottomspan, testing of TILTX features # 210609-0942 - Added in_man_dial_next_ready_seconds campaign options +# 210615-0959 - Default security fix, CVE-2021-28854 # -$version = '2.14-636c'; -$build = '210609-0942'; +$version = '2.14-637c'; +$build = '210615-0959'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=95; $one_mysql_log=0; @@ -1518,7 +1519,7 @@ if ( (strlen($phone_login)<2) or (strlen($phone_pass)<2) ) else { if ($WeBRooTWritablE > 0) - {$fp = fopen ("./vicidial_auth_entries.txt", "a");} + {$fp = fopen ("./vicidial_auth_entries.txt", "w");} $VDloginDISPLAY=0; if ( (strlen($VD_login)<2) or (strlen($VD_pass)<2) or (strlen($VD_campaign)<2) ) @@ -2046,7 +2047,7 @@ else if ($WeBRooTWritablE > 0) { - fwrite ($fp, "vdweb|GOOD|$date|$VD_login|XXXX|$ip|$browser|$LOGfullname|\n"); + fwrite ($fp, "vdweb|GOOD|$date|$browser|\n"); fclose($fp); } $user_abb = "$VD_login$VD_login$VD_login$VD_login"; @@ -3132,7 +3133,7 @@ else { if ($WeBRooTWritablE > 0) { - fwrite ($fp, "vdweb|FAIL|$date|$VD_login|XXXX|$ip|$browser|\n"); + fwrite ($fp, "vdweb|FAIL|$date|$browser|\n"); fclose($fp); } $VDloginDISPLAY=1; diff --git a/www/chat_customer/functions.php b/www/chat_customer/functions.php index 3f9bc057..3c2f22c3 100644 --- a/www/chat_customer/functions.php +++ b/www/chat_customer/functions.php @@ -4,11 +4,12 @@ # # functions for agent scripts # -# Copyright (C) 2015 Matt Florell LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # # # CHANGES: # 151212-0826 - First Build for customer chat, based on agc/functions.php +# 210615-1044 - Default security fixes, CVE-2021-28854 # # $mysql_queries = 20 @@ -107,8 +108,8 @@ function user_authorization($user,$pass,$user_option,$user_update,$bcrypt,$retur } if ($SSwebroot_writable > 0) { - $fp = fopen ("./project_auth_entries.txt", "a"); - fwrite ($fp, "AGENT|FAIL|$NOW_TIME|$user|$auth_key|$ip|$browser|\n"); + $fp = fopen ("./project_auth_entries.txt", "w"); + fwrite ($fp, "AGENT|FAIL|$NOW_TIME|\n"); fclose($fp); } } @@ -2050,8 +2051,9 @@ function mysql_error_logging($NOW_TIME,$link,$mel,$stmt,$query_id,$user,$server_ if ( ($errno > 0) or ($mel > 1) or ($one_mysql_log > 0) ) { $error = mysqli_error($link); - $efp = fopen ("./vicidial_mysqli_errors.txt", "a"); - fwrite ($efp, "$NOW_TIME|vdc_db_query|$query_id|$errno|$error|$stmt|$user|$server_ip|$session_name|\n"); + $efp = fopen ("./vicidial_mysqli_errors.txt", "w"); + # fwrite ($efp, "$NOW_TIME|customer_chat|$query_id|$errno|$error|$stmt|$user|$server_ip|$session_name|\n"); + fwrite ($efp, "$NOW_TIME|customer_chat|$query_id|\n"); fclose($efp); } } diff --git a/www/vicidial/admin.php b/www/vicidial/admin.php index 30fc0f69..3b7ac711 100644 --- a/www/vicidial/admin.php +++ b/www/vicidial/admin.php @@ -146,6 +146,10 @@ if (!file_exists('old_clear')) fwrite($clear_file, '1'); fclose($clear_file); } +if (file_exists('project_auth_entries.txt')) + { + unlink('project_auth_entries.txt'); + } ### END housecleaning of old static report files ### @@ -5664,12 +5668,13 @@ if ($SSscript_remove_js > 0) # 210429-1624 - Added mohsuggest phone config option # 210519-1747 - Fix for Copy Phone conf rebuild, Require prompt be populated on Call Menu creation and modification # 210608-2108 - Added In-Group Drop Seconds Override Container and Inbound Manual Dial Agent Forced Ready features +# 210615-1108 - Default security fixes, CVE-2021-28854 # # make sure you have added a user to the vicidial_users MySQL table with at least user_level 9 to access this page the first time -$admin_version = '2.14-814a'; -$build = '210608-2108'; +$admin_version = '2.14-815a'; +$build = '210615-1108'; $STARTtime = date("U"); $SQLdate = date("Y-m-d H:i:s"); diff --git a/www/vicidial/functions.php b/www/vicidial/functions.php index d0ce6224..77a4533a 100644 --- a/www/vicidial/functions.php +++ b/www/vicidial/functions.php @@ -38,6 +38,7 @@ # 210311-2316 - Added 2FA check in user_authorization function # 210316-0924 - Small fix for 2FA consistency # 210406-1740 - Moved 'dialable_leads' function to this script +# 210615-0952 - Default security fix, CVE-2021-28854 # ##### BEGIN validate user login credentials, check for failed lock out ##### @@ -135,8 +136,8 @@ function user_authorization($user,$pass,$user_option,$user_update,$api_call) } if ($SSwebroot_writable > 0) { - $fp = fopen ("./project_auth_entries.txt", "a"); - fwrite ($fp, "ADMIN|FAIL|$NOW_TIME|X|$auth_key|$ip|$browser|\n"); + $fp = fopen ("./project_auth_entries.txt", "w"); + fwrite ($fp, "ADMIN|FAIL|$NOW_TIME|$browser|\n"); fclose($fp); } } diff --git a/www/vicidial/log_test.php b/www/vicidial/log_test.php index 30727891..f510267d 100644 --- a/www/vicidial/log_test.php +++ b/www/vicidial/log_test.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 # @@ -15,20 +15,17 @@ if (!isset($begin_date)) {$begin_date = $TODAY;} if (!isset($end_date)) {$end_date = $TODAY;} -$fp = fopen ("./closer_SQL_updates.txt", "a"); +$fp = fopen ("./closer_SQL_updates.txt", "w"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); - fwrite ($fp, "CLOSER SQL UPDATE|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|$LOGfullname|\n"); - fclose($fp); +fwrite ($fp, "CLOSER SQL UPDATE|$date|\n"); +fclose($fp); - exit; - - ?> diff --git a/www/vicidial/recording_lookup_DIRECT.php b/www/vicidial/recording_lookup_DIRECT.php index 9598f4aa..ab3ae0c8 100644 --- a/www/vicidial/recording_lookup_DIRECT.php +++ b/www/vicidial/recording_lookup_DIRECT.php @@ -68,11 +68,11 @@ else exit; } -$fp = fopen ("/usr/local/apache2/htdocs/vicidial/auth_entries.txt", "a"); +$fp = fopen ("/usr/local/apache2/htdocs/vicidial/auth_entries.txt", "w"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -fwrite ($fp, "AUTH|VDC |$date|$auth|$ip|$phone|$format|$browser|\n"); +fwrite ($fp, "AUTH|VDC |$date|\n"); fclose($fp); if (strlen($format)<3) {$format='WAV';}