Added User API functions restrictions and API within-allowed-campaigns list ID restrictions

git-svn-id: svn://192.168.202.10@2314 3d104415-ff17-0410-8863-d5cf3c621b8a

UPGRADE

@@ -65,6 +65,10 @@ OTHER CHANGES:
 3. Added option to populate the entry_list_id from the DID when routing to an
 	In-Group
 
+4. Added agent screen webform 3 feature
+
+5. Added user API restrictions for allowed lists and allowed API functions
+
 
 
 

docs/AGENT_API.txt

@@ -1,4 +1,4 @@
-AGENT API DOCUMENT		Started: 2008-07-03	Updated: 2015-03-13
+AGENT API DOCUMENT		Started: 2008-07-03	Updated: 2015-04-29
 
 This document describes the functions of an API(Application Programming Interface)
 for the VICIDIAL Agent screen. This functionality will be rather limited at first
@@ -63,6 +63,7 @@ Response to calls will return either an ERROR or a SUCCESS along with an explana
 for example:
 SUCCESS: external_status function set - 6666|A
 ERROR: agent_user is not logged in - 6666
+ERROR: auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION - 6666|webserver|ADMIN
 
 
 

docs/NON-AGENT_API.txt

@@ -1,4 +1,4 @@
-NON-AGENT API DOCUMENT           Started: 2008-07-24         Updated: 2015-04-28
+NON-AGENT API DOCUMENT           Started: 2008-07-24         Updated: 2015-04-30
 
 This document describes the functions of an API(Application Programming 
 Interface) for all functions NOT directly relating to the VICIDIAL Agent screen. 
@@ -102,6 +102,7 @@ Changes:
 150309-0250 - Added ability to use urlencoded web form addresses
 150313-0818 - Allow for single quotes in vicidial_list and custom data fields
 150428-1720 - Added web_form_address_three to add_list/update_list functions
+150430-0644 - Added API allowed function restrictions and allowed list restrictions
 
 
 API Functions use the 'function' variable
@@ -109,6 +110,9 @@ API Functions use the 'function' variable
 NOTE: Just as with the Agent API, the non-agent API requires the user and pass of a
 valid api-enabled vicidial_users account to execute actions.
 
+Example response if user permissions do not allow the function attempted:
+ERROR: auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION - 6666|add_lead
+
 
 
 --------------------------------------------------------------------------------
@@ -635,6 +639,7 @@ ERROR: add_lead INVALID PHONE NUMBER AREACODE - 72755|6666
 ERROR: add_lead INVALID PHONE NUMBER NANPA AREACODE PREFIX - 7275551212|6666
 
 ERROR: add_lead USER DOES NOT HAVE PERMISSION TO ADD LEADS TO THE SYSTEM - 6666|0 
+ERROR: add_lead NOT AN ALLOWED LIST ID - 7275551212|98762
 
 ERROR: NO FUNCTION SPECIFIED
 
@@ -777,6 +782,7 @@ ERROR: update_lead NO MATCHES FOUND IN THE SYSTEM - 6666|||
 ERROR: update_lead NO VALID SEARCH METHOD - 6666|SYSTEM|||
 
 ERROR: update_lead USER DOES NOT HAVE PERMISSION TO UPDATE LEADS IN THE SYSTEM - 6666|0 
+ERROR: update_lead NOT AN ALLOWED LIST ID - 7275551212|98762
 
 
 
@@ -1183,6 +1189,7 @@ http://server/vicidial/non_agent_api.php?source=test&user=6666&pass=1234&functio
 Example responses:
 ERROR: update_list USER DOES NOT HAVE PERMISSION TO UPDATE LISTS - 6666
 ERROR: update_list YOU MUST USE ALL REQUIRED FIELDS - 6666|1
+ERROR: update_list NOT AN ALLOWED LIST ID - 98762
 NOTICE: update_list LIST DOES NOT EXIST, SENDING TO add_list FUNCTION - 6666|1000
 ERROR: update_list LIST DOES NOT EXIST - 6666|1000
 ERROR: update_list CAMPAIGN DOES NOT EXIST, THIS IS AN OPTIONAL FIELD - 6666|TESTCIMP

extras/MySQL_AST_CREATE_tables.sql

@@ -627,7 +627,9 @@ wrapup_seconds_override SMALLINT(4) default '-1',
 modify_languages ENUM('1','0') default '0',
 selected_language VARCHAR(100) default 'default English',
 user_choose_language ENUM('1','0') default '0',
-ignore_group_on_search ENUM('1','0') default '0'
+ignore_group_on_search ENUM('1','0') default '0',
+api_list_restrict ENUM('1','0') default '0',
+api_allowed_functions VARCHAR(1000) default 'ALL_FUNCTIONS'
 ) ENGINE=MyISAM;
 
 CREATE UNIQUE INDEX user ON vicidial_users (user);
@@ -3379,4 +3381,4 @@ UPDATE vicidial_configuration set value='1766' where name='qc_database_version';
 
 UPDATE system_settings set vdc_agent_api_active='1';
 
-UPDATE system_settings SET db_schema_version='1408',db_schema_update_date=NOW(),reload_timestamp=NOW();
+UPDATE system_settings SET db_schema_version='1409',db_schema_update_date=NOW(),reload_timestamp=NOW();

extras/upgrade_2.12.sql

@@ -24,3 +24,8 @@ ALTER TABLE vicidial_campaigns MODIFY get_call_launch ENUM('NONE','SCRIPT','WEBF
 ALTER TABLE vicidial_inbound_groups MODIFY get_call_launch ENUM('NONE','SCRIPT','WEBFORM','WEBFORMTWO','WEBFORMTHREE','FORM') default 'NONE';
 
 UPDATE system_settings SET db_schema_version='1408',db_schema_update_date=NOW() where db_schema_version < 1408;
+
+ALTER TABLE vicidial_users ADD api_list_restrict ENUM('1','0') default '0';
+ALTER TABLE vicidial_users ADD api_allowed_functions VARCHAR(1000) default 'ALL_FUNCTIONS';
+
+UPDATE system_settings SET db_schema_version='1409',db_schema_update_date=NOW() where db_schema_version < 1409;

www/agc/api.php

@@ -80,10 +80,11 @@
 # 141216-2118 - Added language settings lookups and user/pass variable standardization
 # 150108-1039 - Added transfer_conf-ID of epoch to help prevent double-execution of transfer commands
 # 150313-0825 - Allow for single quotes in vicidial_list and custom data fields
+# 150429-1717 - Added user allowed function restrictions
 #
 
-$version = '2.12-46';
-$build = '150313-0825';
+$version = '2.12-47';
+$build = '150429-1717';
 
 $startMS = microtime();
 
@@ -221,7 +222,7 @@ $pass = preg_replace("/'|\"|\\\\|;| /","",$pass);
 #############################################
 ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP #####
 $VUselected_language = '';
-$stmt="SELECT selected_language from vicidial_users where user='$user';";
+$stmt="SELECT selected_language,api_list_restrict,api_allowed_functions,user_group from vicidial_users where user='$user';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_to_mysqli($stmt, $link);
 	if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);}
@@ -230,6 +231,9 @@ if ($sl_ct > 0)
 	{
 	$row=mysqli_fetch_row($rslt);
 	$VUselected_language =		$row[0];
+	$VUapi_list_restrict =		$row[1];
+	$VUapi_allowed_functions =	$row[2];
+	$VUuser_group =				$row[3];
 	}
 
 $stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;";
@@ -426,6 +430,49 @@ else
 				}
 			}
 		}
+
+	if ( ($VUapi_list_restrict > 0) and ( ($function == 'feature_not_needed') or ($function == 'feature_not_needed2') ) )
+		{
+		$stmt="SELECT allowed_campaigns from vicidial_user_groups where user_group='$VUuser_group';";
+		if ($DB>0) {echo "|$stmt|\n";}
+		$rslt=mysql_to_mysqli($stmt, $link);
+		$ss_conf_ct = mysqli_num_rows($rslt);
+		if ($ss_conf_ct > 0)
+			{
+			$row=mysqli_fetch_row($rslt);
+			$LOGallowed_campaigns =			$row[0];
+			$LOGallowed_campaignsSQL='';
+			$whereLOGallowed_campaignsSQL='';
+			if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) )
+				{
+				$rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns);
+				$rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL);
+				$LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')";
+				$whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')";
+				}
+			$stmt="SELECT list_id from vicidial_lists $whereLOGadmin_viewable_groupsSQL order by list_id;";
+			if ($DB>0) {echo "|$stmt|\n";}
+			$rslt=mysql_to_mysqli($stmt, $link);
+			$lists_to_print = mysqli_num_rows($rslt);
+			$i=0;
+			$allowed_lists=' ';
+			while ($i < $lists_to_print)
+				{
+				$row=mysqli_fetch_row($rslt);
+				$allowed_lists .=	"$row[0] ";
+				$i++;
+				}
+			if ($DB>0) {echo "Allowed lists:|$allowed_lists|\n";}
+			}
+		else
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("user_group DOES NOT EXIST");
+			echo "$result: $result_reason - $value|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
+		}
 	}
 
 if ($format=='debug')
@@ -452,6 +499,14 @@ if ($format=='debug')
 ################################################################################
 if ($function == 'webserver')
 	{
+	if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+		{
+		$result = _QXZ("ERROR");
+		$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+		echo "$result: $result_reason - $user|$function|$VUuser_group\n";
+		api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+		exit;
+		}
 	exec('ps aux | grep httpd', $output);
 	$processes = count($output);
 	$load = sys_getloadavg();
@@ -509,6 +564,14 @@ if ($function == 'external_hangup')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		if (strlen($alt_user)>1)
 			{
 			$stmt = "select count(*) from vicidial_users where custom_three='$alt_user';";
@@ -576,6 +639,14 @@ if ($function == 'external_status')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		if (strlen($alt_user)>1)
 			{
 			$stmt = "select count(*) from vicidial_users where custom_three='$alt_user';";
@@ -686,6 +757,14 @@ if ($function == 'external_pause')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		if (strlen($alt_user)>1)
 			{
 			$stmt = "select count(*) from vicidial_users where custom_three='$alt_user';";
@@ -769,6 +848,14 @@ if ($function == 'logout')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		if (strlen($alt_user)>1)
 			{
 			$stmt = "select count(*) from vicidial_users where custom_three='$alt_user';";
@@ -838,6 +925,14 @@ if ($function == 'recording')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		if (strlen($alt_user)>1)
 			{
 			$stmt = "select count(*) from vicidial_users where custom_three='$alt_user';";
@@ -963,6 +1058,14 @@ if ($function == 'webphone_url')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		if (strlen($alt_user)>1)
 			{
 			$stmt = "select count(*) from vicidial_users where custom_three='$alt_user';";
@@ -1068,6 +1171,14 @@ if ($function == 'call_agent')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		if (strlen($alt_user)>1)
 			{
 			$stmt = "select count(*) from vicidial_users where custom_three='$alt_user';";
@@ -1165,6 +1276,14 @@ if ($function == 'audio_playback')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		if (strlen($alt_user)>1)
 			{
 			$stmt = "select count(*) from vicidial_users where custom_three='$alt_user';";
@@ -1352,6 +1471,14 @@ if ($function == 'external_dial')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		if (strlen($alt_user)>1)
 			{
 			$stmt = "select count(*) from vicidial_users where custom_three='$alt_user';";
@@ -1703,6 +1830,14 @@ if ($function == 'preview_dial_action')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		if (strlen($alt_user)>1)
 			{
 			$stmt = "select count(*) from vicidial_users where custom_three='$alt_user';";
@@ -1854,6 +1989,14 @@ if ($function == 'external_add_lead')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		if (strlen($vendor_id) > 0 )
 			{
 			$vendor_lead_code = $vendor_id;
@@ -2017,6 +2160,14 @@ if ($function == 'change_ingroups')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt = "select count(*) from vicidial_live_agents where user='$agent_user';";
 		if ($DB) {echo "$stmt\n";}
 		$rslt=mysql_to_mysqli($stmt, $link);
@@ -2297,6 +2448,14 @@ if ($function == 'update_fields')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt = "select count(*) from vicidial_live_agents where user='$agent_user';";
 		if ($DB) {echo "$stmt\n";}
 		$rslt=mysql_to_mysqli($stmt, $link);
@@ -2569,6 +2728,14 @@ if ($function == 'set_timer_action')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt = "select count(*) from vicidial_live_agents where user='$agent_user';";
 		if ($DB) {echo "$stmt\n";}
 		$rslt=mysql_to_mysqli($stmt, $link);
@@ -2631,6 +2798,14 @@ if ($function == 'st_login_log')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt = "select count(*) from vicidial_users where custom_three='$value';";
 		if ($DB) {echo "$stmt\n";}
 		$rslt=mysql_to_mysqli($stmt, $link);
@@ -2684,6 +2859,14 @@ if ($function == 'st_get_agent_active_lead')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt = "select count(*) from vicidial_users where custom_three='$value';";
 		if ($DB) {echo "$stmt\n";}
 		$rslt=mysql_to_mysqli($stmt, $link);
@@ -2772,6 +2955,14 @@ if ($function == 'ra_call_control')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt = "select count(*) from vicidial_live_agents where user='$agent_user';";
 		if ($DB) {echo "$stmt\n";}
 		$rslt=mysql_to_mysqli($stmt, $link);
@@ -3130,6 +3321,14 @@ if ($function == 'send_dtmf')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		if (strlen($alt_user)>1)
 			{
 			$stmt = "select count(*) from vicidial_users where custom_three='$alt_user';";
@@ -3197,6 +3396,14 @@ if ($function == 'park_call')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		if (strlen($alt_user)>1)
 			{
 			$stmt = "select count(*) from vicidial_users where custom_three='$alt_user';";
@@ -3279,6 +3486,14 @@ if ($function == 'transfer_conference')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$processed=0;
 		$SUCCESS=0;
 		if (strlen($alt_user)>1)
@@ -3526,6 +3741,14 @@ if ($function == 'pause_code')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$VUapi_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$VUapi_allowed_functions)) )
+			{
+			$result = _QXZ("ERROR");
+			$result_reason = _QXZ("auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION");
+			echo "$result: $result_reason - $value|$user|$function|$VUuser_group\n";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		if (strlen($alt_user)>1)
 			{
 			$stmt = "select count(*) from vicidial_users where custom_three='$alt_user';";

www/vicidial/admin.php

@@ -115,6 +115,8 @@ $UGreports = 'ALL REPORTS, NONE, Real-Time Main Report, Real-Time Campaign Summa
 
 $Vtables = 'NONE,log_noanswer,did_agent_log,contact_information';
 
+$APIfunctions = 'ALL_FUNCTIONS add_group_alias add_lead add_list add_phone add_phone_alias add_user agent_ingroup_info agent_stats_export agent_status audio_playback blind_monitor call_agent callid_info change_ingroups check_phone_number did_log_export external_add_lead external_dial external_hangup external_pause external_status in_group_status logout moh_list park_call pause_code preview_dial_action ra_call_control recording recording_lookup send_dtmf server_refresh set_timer_action sounds_list st_get_agent_active_lead st_login_log transfer_conference update_fields update_lead update_list update_log_entry update_phone update_phone_alias update_user user_group_status vm_list webphone_url webserver';
+
 ######################################################################################################
 ######################################################################################################
 #######   Form variable declaration
@@ -1914,6 +1916,10 @@ if (isset($_GET["enable_third_webform"]))			{$enable_third_webform=$_GET["enable
 	elseif (isset($_POST["enable_third_webform"]))	{$enable_third_webform=$_POST["enable_third_webform"];}
 if (isset($_GET["web_form_address_three"]))			{$web_form_address_three=$_GET["web_form_address_three"];}
 	elseif (isset($_POST["web_form_address_three"]))	{$web_form_address_three=$_POST["web_form_address_three"];}
+if (isset($_GET["api_list_restrict"]))			{$api_list_restrict=$_GET["api_list_restrict"];}
+	elseif (isset($_POST["api_list_restrict"]))	{$api_list_restrict=$_POST["api_list_restrict"];}
+if (isset($_GET["api_allowed_functions"]))			{$api_allowed_functions=$_GET["api_allowed_functions"];}
+	elseif (isset($_POST["api_allowed_functions"]))	{$api_allowed_functions=$_POST["api_allowed_functions"];}
 
 
 if (isset($script_id)) {$script_id= strtoupper($script_id);}
@@ -2264,6 +2270,7 @@ if ($non_latin < 1)
 	$entry_list_id = preg_replace('/[^0-9]/','',$entry_list_id);
 	$filter_entry_list_id = preg_replace('/[^0-9]/','',$filter_entry_list_id);
 	$enable_third_webform = preg_replace('/[^0-9]/','',$enable_third_webform);
+	$api_list_restrict = preg_replace('/[^0-9]/','',$api_list_restrict);
 
 	$drop_call_seconds = preg_replace('/[^-0-9]/','',$drop_call_seconds);
 	$timer_alt_seconds = preg_replace('/[^-0-9]/','',$timer_alt_seconds);
@@ -2852,6 +2859,7 @@ if ($non_latin < 1)
 	$location = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$location);
 	$holiday_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$holiday_name);
 	$holiday_comments = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$holiday_comments);
+	$api_allowed_functions = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$api_allowed_functions);
 
 	### ALPHA-NUMERIC and underscore and dash and slash and at and dot
 	$call_out_number_group = preg_replace('/[^-\.\:\/\@\_0-9a-zA-Z]/','',$call_out_number_group);
@@ -3473,12 +3481,13 @@ else
 # 150421-2315 - Fixed bugs in allow_emails
 # 150422-1953 - Don't allow dial_timeout of less than 4 seconds
 # 150428-1705 - Added options for third webform
+# 150429-1222 - Added new API user restrictions
 #
 
 # make sure you have added a user to the vicidial_users MySQL table with at least user_level 9 to access this page the first time
 
-$admin_version = '2.12-483a';
-$build = '150428-1705';
+$admin_version = '2.12-484a';
+$build = '150429-1222';
 
 $STARTtime = date("U");
 $SQLdate = date("Y-m-d H:i:s");
@@ -11233,9 +11242,19 @@ if ($ADD=="4A")
 				$pass='';
 				}
 
+			$k=0;
+			$multi_count = count($api_allowed_functions);
+			$multi_array = $api_allowed_functions;
+			while ($k < $multi_count)
+				{
+				$new_field_value .= "$multi_array[$k] ";
+				$k++;
+				}
+			$api_allowed_functions = " $new_field_value";
+
 			echo "<br><B>"._QXZ("USER MODIFIED - ADMIN").": $user</B>\n";
 
-			$stmt="UPDATE vicidial_users set pass='$pass',full_name='$full_name',user_level='$user_level',user_group='$user_group',phone_login='$phone_login',phone_pass='$phone_pass',delete_users='$delete_users',delete_user_groups='$delete_user_groups',delete_lists='$delete_lists',delete_campaigns='$delete_campaigns',delete_ingroups='$delete_ingroups',delete_remote_agents='$delete_remote_agents',load_leads='$load_leads',campaign_detail='$campaign_detail',ast_admin_access='$ast_admin_access',ast_delete_phones='$ast_delete_phones',delete_scripts='$delete_scripts',modify_leads='$modify_leads',hotkeys_active='$hotkeys_active',change_agent_campaign='$change_agent_campaign',agent_choose_ingroups='$agent_choose_ingroups',closer_campaigns='$groups_value',scheduled_callbacks='$scheduled_callbacks',agentonly_callbacks='$agentonly_callbacks',agentcall_manual='$agentcall_manual',vicidial_recording='$vicidial_recording',vicidial_transfers='$vicidial_transfers',delete_filters='$delete_filters',alter_agent_interface_options='$alter_agent_interface_options',closer_default_blended='$closer_default_blended',delete_call_times='$delete_call_times',modify_call_times='$modify_call_times',modify_users='$modify_users',modify_campaigns='$modify_campaigns',modify_lists='$modify_lists',modify_scripts='$modify_scripts',modify_filters='$modify_filters',modify_ingroups='$modify_ingroups',modify_usergroups='$modify_usergroups',modify_remoteagents='$modify_remoteagents',modify_servers='$modify_servers',view_reports='$view_reports',vicidial_recording_override='$vicidial_recording_override',alter_custdata_override='$alter_custdata_override',qc_enabled='$qc_enabled',qc_user_level='$qc_user_level',qc_pass='$qc_pass',qc_finish='$qc_finish',qc_commit='$qc_commit',add_timeclock_log='$add_timeclock_log',modify_timeclock_log='$modify_timeclock_log',delete_timeclock_log='$delete_timeclock_log',alter_custphone_override='$alter_custphone_override',vdc_agent_api_access='$vdc_agent_api_access',modify_inbound_dids='$modify_inbound_dids',delete_inbound_dids='$delete_inbound_dids',active='$active',download_lists='$download_lists',agent_shift_enforcement_override='$agent_shift_enforcement_override',manager_shift_enforcement_override='$manager_shift_enforcement_override',export_reports='$export_reports',delete_from_dnc='$delete_from_dnc',email='$email',user_code='$user_code',territory='$territory',allow_alerts='$allow_alerts',agent_choose_territories='$agent_choose_territories',custom_one='$custom_one',custom_two='$custom_two',custom_three='$custom_three',custom_four='$custom_four',custom_five='$custom_five',voicemail_id='$voicemail_id',agent_call_log_view_override='$agent_call_log_view_override',callcard_admin='$callcard_admin',agent_choose_blended='$agent_choose_blended',realtime_block_user_info='$realtime_block_user_info',custom_fields_modify='$custom_fields_modify',force_change_password='$force_change_password',agent_lead_search_override='$agent_lead_search',modify_shifts='$modify_shifts',modify_phones='$modify_phones',modify_carriers='$modify_carriers',modify_labels='$modify_labels',modify_statuses='$modify_statuses',modify_voicemail='$modify_voicemail',modify_audiostore='$modify_audiostore',modify_moh='$modify_moh',modify_tts='$modify_tts',preset_contact_search='$preset_contact_search',modify_contacts='$modify_contacts',modify_same_user_level='$modify_same_user_level',admin_hide_lead_data='$admin_hide_lead_data',admin_hide_phone_data='$admin_hide_phone_data',agentcall_email='$agentcall_email',modify_email_accounts='$modify_email_accounts',failed_login_count=0,alter_admin_interface_options='$alter_admin_interface_options',max_inbound_calls='$max_inbound_calls',modify_custom_dialplans='$modify_custom_dialplans',wrapup_seconds_override='$wrapup_seconds_override',modify_languages='$modify_languages',selected_language='$selected_language',user_choose_language='$user_choose_language',ignore_group_on_search='$ignore_group_on_search' $pass_hashSQL where user='$user' $LOGadmin_viewable_groupsSQL;";
+			$stmt="UPDATE vicidial_users set pass='$pass',full_name='$full_name',user_level='$user_level',user_group='$user_group',phone_login='$phone_login',phone_pass='$phone_pass',delete_users='$delete_users',delete_user_groups='$delete_user_groups',delete_lists='$delete_lists',delete_campaigns='$delete_campaigns',delete_ingroups='$delete_ingroups',delete_remote_agents='$delete_remote_agents',load_leads='$load_leads',campaign_detail='$campaign_detail',ast_admin_access='$ast_admin_access',ast_delete_phones='$ast_delete_phones',delete_scripts='$delete_scripts',modify_leads='$modify_leads',hotkeys_active='$hotkeys_active',change_agent_campaign='$change_agent_campaign',agent_choose_ingroups='$agent_choose_ingroups',closer_campaigns='$groups_value',scheduled_callbacks='$scheduled_callbacks',agentonly_callbacks='$agentonly_callbacks',agentcall_manual='$agentcall_manual',vicidial_recording='$vicidial_recording',vicidial_transfers='$vicidial_transfers',delete_filters='$delete_filters',alter_agent_interface_options='$alter_agent_interface_options',closer_default_blended='$closer_default_blended',delete_call_times='$delete_call_times',modify_call_times='$modify_call_times',modify_users='$modify_users',modify_campaigns='$modify_campaigns',modify_lists='$modify_lists',modify_scripts='$modify_scripts',modify_filters='$modify_filters',modify_ingroups='$modify_ingroups',modify_usergroups='$modify_usergroups',modify_remoteagents='$modify_remoteagents',modify_servers='$modify_servers',view_reports='$view_reports',vicidial_recording_override='$vicidial_recording_override',alter_custdata_override='$alter_custdata_override',qc_enabled='$qc_enabled',qc_user_level='$qc_user_level',qc_pass='$qc_pass',qc_finish='$qc_finish',qc_commit='$qc_commit',add_timeclock_log='$add_timeclock_log',modify_timeclock_log='$modify_timeclock_log',delete_timeclock_log='$delete_timeclock_log',alter_custphone_override='$alter_custphone_override',vdc_agent_api_access='$vdc_agent_api_access',modify_inbound_dids='$modify_inbound_dids',delete_inbound_dids='$delete_inbound_dids',active='$active',download_lists='$download_lists',agent_shift_enforcement_override='$agent_shift_enforcement_override',manager_shift_enforcement_override='$manager_shift_enforcement_override',export_reports='$export_reports',delete_from_dnc='$delete_from_dnc',email='$email',user_code='$user_code',territory='$territory',allow_alerts='$allow_alerts',agent_choose_territories='$agent_choose_territories',custom_one='$custom_one',custom_two='$custom_two',custom_three='$custom_three',custom_four='$custom_four',custom_five='$custom_five',voicemail_id='$voicemail_id',agent_call_log_view_override='$agent_call_log_view_override',callcard_admin='$callcard_admin',agent_choose_blended='$agent_choose_blended',realtime_block_user_info='$realtime_block_user_info',custom_fields_modify='$custom_fields_modify',force_change_password='$force_change_password',agent_lead_search_override='$agent_lead_search',modify_shifts='$modify_shifts',modify_phones='$modify_phones',modify_carriers='$modify_carriers',modify_labels='$modify_labels',modify_statuses='$modify_statuses',modify_voicemail='$modify_voicemail',modify_audiostore='$modify_audiostore',modify_moh='$modify_moh',modify_tts='$modify_tts',preset_contact_search='$preset_contact_search',modify_contacts='$modify_contacts',modify_same_user_level='$modify_same_user_level',admin_hide_lead_data='$admin_hide_lead_data',admin_hide_phone_data='$admin_hide_phone_data',agentcall_email='$agentcall_email',modify_email_accounts='$modify_email_accounts',failed_login_count=0,alter_admin_interface_options='$alter_admin_interface_options',max_inbound_calls='$max_inbound_calls',modify_custom_dialplans='$modify_custom_dialplans',wrapup_seconds_override='$wrapup_seconds_override',modify_languages='$modify_languages',selected_language='$selected_language',user_choose_language='$user_choose_language',ignore_group_on_search='$ignore_group_on_search',api_list_restrict='$api_list_restrict',api_allowed_functions='$api_allowed_functions' $pass_hashSQL where user='$user' $LOGadmin_viewable_groupsSQL;";
 			$rslt=mysql_to_mysqli($stmt, $link);
 
 			### LOG INSERTION Admin Log Table ###
@@ -17735,7 +17754,7 @@ if ($ADD==3)
 		echo "<TABLE><TR><TD>\n";
 		echo "<FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=2>";
 
-		$stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,agent_choose_territories,custom_one,custom_two,custom_three,custom_four,custom_five,voicemail_id,agent_call_log_view_override,callcard_admin,agent_choose_blended,realtime_block_user_info,custom_fields_modify,force_change_password,agent_lead_search_override,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,preset_contact_search,modify_contacts,modify_same_user_level,admin_hide_lead_data,admin_hide_phone_data,agentcall_email,modify_email_accounts,failed_login_count,last_login_date,last_ip,alter_admin_interface_options,max_inbound_calls,modify_custom_dialplans,wrapup_seconds_override,modify_languages,selected_language,user_choose_language,ignore_group_on_search from vicidial_users where user='$user' $LOGadmin_viewable_groupsSQL;";
+		$stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,agent_choose_territories,custom_one,custom_two,custom_three,custom_four,custom_five,voicemail_id,agent_call_log_view_override,callcard_admin,agent_choose_blended,realtime_block_user_info,custom_fields_modify,force_change_password,agent_lead_search_override,modify_shifts,modify_phones,modify_carriers,modify_labels,modify_statuses,modify_voicemail,modify_audiostore,modify_moh,modify_tts,preset_contact_search,modify_contacts,modify_same_user_level,admin_hide_lead_data,admin_hide_phone_data,agentcall_email,modify_email_accounts,failed_login_count,last_login_date,last_ip,alter_admin_interface_options,max_inbound_calls,modify_custom_dialplans,wrapup_seconds_override,modify_languages,selected_language,user_choose_language,ignore_group_on_search,api_list_restrict,api_allowed_functions from vicidial_users where user='$user' $LOGadmin_viewable_groupsSQL;";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
 		$user_id =				$row[0];
@@ -17847,6 +17866,8 @@ if ($ADD==3)
 		$selected_language =	$row[108];
 		$user_choose_language = $row[109];
 		$ignore_group_on_search = $row[110];
+		$api_list_restrict =	$row[111];
+		$api_allowed_functions = $row[112];
 
 		if ( ( ($user_level >= $LOGuser_level) and ($LOGuser_level < 9) ) or ( ($LOGmodify_same_user_level < 1) and ($LOGuser_level > 8) and ($user_level > 8) ) )
 			{
@@ -18134,7 +18155,6 @@ if ($ADD==3)
 				echo "<tr bgcolor=#B9CBFD><td align=right>"._QXZ("Modify Contacts").": </td><td align=left><select size=1 name=modify_contacts><option>0</option><option>1</option><option SELECTED>$modify_contacts</option></select>$NWB#users-modify_sections$NWE</td></tr>\n";
 
 				echo "<tr bgcolor=#B9CBFD><td align=right>"._QXZ("CallCard Access").": </td><td align=left><select size=1 name=callcard_admin><option>0</option><option>1</option><option SELECTED>$callcard_admin</option></select>$NWB#users-modify_sections$NWE</td></tr>\n";
-				echo "<tr bgcolor=#B9CBFD><td align=right>"._QXZ("Agent API Access").": </td><td align=left><select size=1 name=vdc_agent_api_access><option>0</option><option>1</option><option SELECTED>$vdc_agent_api_access</option></select>$NWB#users-vdc_agent_api_access$NWE</td></tr>\n";
 
 				echo "<tr bgcolor=#9BB9FB><td align=right>"._QXZ("Add Timeclock Log Record").": </td><td align=left><select size=1 name=add_timeclock_log><option>0</option><option>1</option><option SELECTED>$add_timeclock_log</option></select>$NWB#users-add_timeclock_log$NWE</td></tr>\n";
 				echo "<tr bgcolor=#9BB9FB><td align=right>"._QXZ("Modify Timeclock Log Record").": </td><td align=left><select size=1 name=modify_timeclock_log><option>0</option><option>1</option><option SELECTED>$modify_timeclock_log</option></select>$NWB#users-modify_timeclock_log$NWE</td></tr>\n";
@@ -18142,6 +18162,25 @@ if ($ADD==3)
 
 				echo "<tr bgcolor=#B9CBFD><td align=right>"._QXZ("Manager Shift Enforcement Override").": </td><td align=left><select size=1 name=manager_shift_enforcement_override><option>0</option><option>1</option><option SELECTED>$manager_shift_enforcement_override</option></select>$NWB#users-manager_shift_enforcement_override$NWE</td></tr>\n";
 
+				echo "<tr bgcolor=#B9CBFD><td align=right>"._QXZ("Agent API Access").": </td><td align=left><select size=1 name=vdc_agent_api_access><option>0</option><option>1</option><option SELECTED>$vdc_agent_api_access</option></select>$NWB#users-vdc_agent_api_access$NWE</td></tr>\n";
+
+				echo "<tr bgcolor=#B9CBFD><td align=right>"._QXZ("API List Restrict").": </td><td align=left><select size=1 name=api_list_restrict><option>0</option><option>1</option><option SELECTED>$api_list_restrict</option></select>$NWB#users-api_list_restrict$NWE</td></tr>\n";
+
+				echo "<tr bgcolor=#B9CBFD><td align=right>"._QXZ("API Allowed Functions").": </td><td align=left><select MULTIPLE size=8 name=api_allowed_functions[]>\n";
+				$Afunctions_ARY = explode(' ',$APIfunctions);
+				$Afunctions_ct = count($Afunctions_ARY);
+				$b=0;
+				while ($b < $Afunctions_ct)
+					{
+					$field_selected='';
+					trim($Afunctions_ARY[$b]);
+					if (preg_match("/ $Afunctions_ARY[$b] /",$api_allowed_functions))
+						{$field_selected = 'SELECTED';}
+					echo "<option value=\"$Afunctions_ARY[$b]\" $field_selected>$Afunctions_ARY[$b]</option>\n";
+					$b++;
+					}
+				echo "</select>$NWB#users-api_allowed_functions$NWE</td></tr>\n";
+
 				if ( ( ($LOGmodify_same_user_level > 0) or ($LOGalter_admin_interface > 0) ) and ($LOGuser_level > 8) )
 					{
 					echo "<tr bgcolor=#015B91><td colspan=2 align=center><font color=white><B>"._QXZ("LEVEL 9 ADMIN OPTIONS").":</td></tr>\n";

www/vicidial/help.php

@@ -44,6 +44,7 @@
 # 150307-2317 - Added custom meetme enter options
 # 150404-0934 - Added enable_did_entry_list_id and related DID options
 # 150428-1704 - Added enable_third_webform
+# 150429-1232 - Added new user API restrictions
 #
 
 require("dbconnect_mysqli.php");
@@ -590,15 +591,25 @@ if ($SSqc_features_active > 0)
 <BR>
 <B><?php echo _QXZ("Delete Timeclock Log Record"); ?> -</B><?php echo _QXZ("This option allows the user to delete records in the timeclock log."); ?>
 
+<BR>
+<A NAME="users-manager_shift_enforcement_override">
+<BR>
+<B><?php echo _QXZ("Manager Shift Enforcement Override"); ?> -</B><?php echo _QXZ("This setting if set to 1 will allow a manager to enter their user and password on an agent screen to override the shift restrictions on an agent session if the agent is trying to log in outside of their shift. Default is 0."); ?>
+
 <BR>
 <A NAME="users-vdc_agent_api_access">
 <BR>
 <B><?php echo _QXZ("Agent API Access"); ?> -</B><?php echo _QXZ("This option allows the account to be used with the agent and non-agent API commands."); ?>
 
 <BR>
-<A NAME="users-manager_shift_enforcement_override">
+<A NAME="users-api_list_restrict">
 <BR>
-<B><?php echo _QXZ("Manager Shift Enforcement Override"); ?> -</B><?php echo _QXZ("This setting if set to 1 will allow a manager to enter their user and password on an agent screen to override the shift restrictions on an agent session if the agent is trying to log in outside of their shift. Default is 0."); ?>
+<B><?php echo _QXZ("API List Restrict"); ?> -</B><?php echo _QXZ("This option will restrict any API actions used by this user to be restricted only within the lists included within the user group allowable campaigns for this user. Default is 0 for disabled."); ?>
+
+<BR>
+<A NAME="users-api_allowed_functions">
+<BR>
+<B><?php echo _QXZ("API Allowed Functions"); ?> -</B><?php echo _QXZ("This option will allow you to restrict the API functions that are allowed to be used by this user. Default is ALL_FUNCTIONS."); ?>
 
 <BR>
 <A NAME="users-download_lists">
@@ -4541,11 +4552,6 @@ AU_SPAC 000 000 000 - <?php echo _QXZ("Australia space separated phone number");
 IT_DASH 0000-000-000 - <?php echo _QXZ("Italy dash separated phone number"); ?><BR>
 FR_SPAC 00 00 00 00 00 - <?php echo _QXZ("France space separated phone number"); ?><BR>
 
-<BR>
-<A NAME="settings-vdc_agent_api_active">
-<BR>
-<B><?php echo _QXZ("Agent interface API Access Active"); ?> -</B><?php echo _QXZ("This option allows you to enable or disable the agent interface API. Default is 0."); ?>
-
 <BR>
 <A NAME="settings-agentonly_callback_campaign_lock">
 <BR>

www/vicidial/non_agent_api.php

@@ -96,10 +96,11 @@
 # 150309-0250 - Added ability to use urlencoded web form addresses
 # 150313-0818 - Allow for single quotes in vicidial_list and custom data fields
 # 150428-1720 - Added web_form_address_three to add_list/update_list functions
+# 150430-0644 - Added API allowed function restrictions and allowed list restrictions
 #
 
-$version = '2.12-72';
-$build = '150428-1720';
+$version = '2.12-73';
+$build = '150430-0644';
 $api_url_log = 0;
 
 $startMS = microtime();
@@ -638,6 +639,57 @@ if ($auth < 1)
 	echo "$VDdisplayMESSAGE: |$user|$pass|$auth_message|\n";
 	exit;
 	}
+
+$stmt="SELECT api_list_restrict,api_allowed_functions,user_group from vicidial_users where user='$user' and active='Y';";
+if ($DB>0) {echo "DEBUG: auth query - $stmt\n";}
+$rslt=mysql_to_mysqli($stmt, $link);
+$row=mysqli_fetch_row($rslt);
+$api_list_restrict =		$row[0];
+$api_allowed_functions =	$row[1];
+$LOGuser_group =			$row[2];
+if ( ($api_list_restrict > 0) and ( ($function == 'add_lead') or ($function == 'update_lead') or ($function == 'update_list') ) )
+	{
+	$stmt="SELECT allowed_campaigns from vicidial_user_groups where user_group='$LOGuser_group';";
+	if ($DB>0) {echo "|$stmt|\n";}
+	$rslt=mysql_to_mysqli($stmt, $link);
+	$ss_conf_ct = mysqli_num_rows($rslt);
+	if ($ss_conf_ct > 0)
+		{
+		$row=mysqli_fetch_row($rslt);
+		$LOGallowed_campaigns =			$row[0];
+		$LOGallowed_campaignsSQL='';
+		$whereLOGallowed_campaignsSQL='';
+		if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) )
+			{
+			$rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns);
+			$rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL);
+			$LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')";
+			$whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')";
+			}
+		$stmt="SELECT list_id from vicidial_lists $whereLOGadmin_viewable_groupsSQL order by list_id;";
+		if ($DB>0) {echo "|$stmt|\n";}
+		$rslt=mysql_to_mysqli($stmt, $link);
+		$lists_to_print = mysqli_num_rows($rslt);
+		$i=0;
+		$allowed_lists=' ';
+		while ($i < $lists_to_print)
+			{
+			$row=mysqli_fetch_row($rslt);
+			$allowed_lists .=	"$row[0] ";
+			$i++;
+			}
+		if ($DB>0) {echo "Allowed lists:|$allowed_lists|\n";}
+		}
+	else
+		{
+		$result = 'ERROR';
+		$result_reason = "user_group DOES NOT EXIST";
+		echo "$result: $result_reason: |$user|$LOGuser_group|\n";
+		$data = "$allowed_user";
+		api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+		exit;
+		}
+	}
 ##### END user authentication for all functions below #####
 
 
@@ -663,6 +715,15 @@ if ($function == 'sounds_list')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$server_name = getenv("SERVER_NAME");
 		$server_port = getenv("SERVER_PORT");
 		if (preg_match("/443/i",$server_port)) {$HTTPprotocol = 'https://';}
@@ -831,6 +892,15 @@ if ($function == 'moh_list')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$server_name = getenv("SERVER_NAME");
 		$server_port = getenv("SERVER_PORT");
 		if (preg_match("/443/i",$server_port)) {$HTTPprotocol = 'https://';}
@@ -864,12 +934,6 @@ if ($function == 'moh_list')
 			}
 		else
 			{
-			$stmt="SELECT user_group from vicidial_users where user='$user' and user_level > 6;";
-			if ($DB>0) {echo "|$stmt|\n";}
-			$rslt=mysql_to_mysqli($stmt, $link);
-			$row=mysqli_fetch_row($rslt);
-			$LOGuser_group =			$row[0];
-
 			$stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';";
 			if ($DB>0) {echo "|$stmt|\n";}
 			$rslt=mysql_to_mysqli($stmt, $link);
@@ -997,12 +1061,15 @@ if ($function == 'vm_list')
 		}
 	else
 		{
-		$stmt="SELECT user_group from vicidial_users where user='$user' and user_level > 6;";
-		if ($DB>0) {echo "|$stmt|\n";}
-		$rslt=mysql_to_mysqli($stmt, $link);
-		$row=mysqli_fetch_row($rslt);
-		$LOGuser_group =			$row[0];
-
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';";
 		if ($DB>0) {echo "|$stmt|\n";}
 		$rslt=mysql_to_mysqli($stmt, $link);
@@ -1134,6 +1201,15 @@ if ($function == 'agent_ingroup_info')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and user_level > 6 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -1149,12 +1225,6 @@ if ($function == 'agent_ingroup_info')
 			}
 		else
 			{
-			$stmt="SELECT user_group from vicidial_users where user='$user' and user_level > 6;";
-			if ($DB>0) {echo "|$stmt|\n";}
-			$rslt=mysql_to_mysqli($stmt, $link);
-			$row=mysqli_fetch_row($rslt);
-			$LOGuser_group =			$row[0];
-
 			$stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';";
 			if ($DB>0) {echo "|$stmt|\n";}
 			$rslt=mysql_to_mysqli($stmt, $link);
@@ -1460,6 +1530,15 @@ if ($function == 'blind_monitor')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and user_level > 6 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -1629,6 +1708,15 @@ if ($function == 'add_user')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and modify_users='1' and user_level >= 8 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -1817,6 +1905,15 @@ if ($function == 'update_user')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and modify_users='1' and user_level >= 8 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -1843,12 +1940,6 @@ if ($function == 'update_user')
 				}
 			else
 				{
-				$stmt="SELECT user_group from vicidial_users where user='$user' and user_level >= 8;";
-				if ($DB>0) {echo "|$stmt|\n";}
-				$rslt=mysql_to_mysqli($stmt, $link);
-				$row=mysqli_fetch_row($rslt);
-				$LOGuser_group =			$row[0];
-
 				$stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';";
 				if ($DB>0) {echo "|$stmt|\n";}
 				$rslt=mysql_to_mysqli($stmt, $link);
@@ -2382,6 +2473,15 @@ if ($function == 'add_group_alias')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and ast_admin_access='1' and user_level >= 8 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -2474,6 +2574,15 @@ if ($function == 'add_phone')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and ast_admin_access='1' and user_level >= 8 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -2612,6 +2721,15 @@ if ($function == 'update_phone')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and ast_admin_access='1' and user_level >= 8 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -2638,12 +2756,6 @@ if ($function == 'update_phone')
 				}
 			else
 				{
-				$stmt="SELECT user_group from vicidial_users where user='$user' and user_level >= 8;";
-				if ($DB>0) {echo "|$stmt|\n";}
-				$rslt=mysql_to_mysqli($stmt, $link);
-				$row=mysqli_fetch_row($rslt);
-				$LOGuser_group =			$row[0];
-
 				$stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';";
 				if ($DB>0) {echo "|$stmt|\n";}
 				$rslt=mysql_to_mysqli($stmt, $link);
@@ -3023,6 +3135,15 @@ if ($function == 'add_phone_alias')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and ast_admin_access='1' and user_level >= 8 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -3132,6 +3253,15 @@ if ($function == 'update_phone_alias')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and ast_admin_access='1' and user_level >= 8 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -3317,6 +3447,15 @@ if ($function == 'server_refresh')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and ast_admin_access='1' and user_level >= 8 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -3391,6 +3530,15 @@ if ($function == 'update_list')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and modify_lists='1' and user_level >= 8 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -3417,12 +3565,18 @@ if ($function == 'update_list')
 				}
 			else
 				{
-				$stmt="SELECT user_group from vicidial_users where user='$user' and user_level >= 8;";
-				if ($DB>0) {echo "|$stmt|\n";}
-				$rslt=mysql_to_mysqli($stmt, $link);
-				$row=mysqli_fetch_row($rslt);
-				$LOGuser_group =			$row[0];
-
+				if ($api_list_restrict > 0)
+					{
+					if (!preg_match("/ $list_id /",$allowed_lists))
+						{
+						$result = 'ERROR';
+						$result_reason = "update_list NOT AN ALLOWED LIST ID";
+						$data = "$list_id";
+						echo "$result: $result_reason - $data\n";
+						api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+						exit;
+						}
+					}
 				$stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';";
 				if ($DB>0) {echo "|$stmt|\n";}
 				$rslt=mysql_to_mysqli($stmt, $link);
@@ -3862,6 +4016,15 @@ if ($function == 'add_list')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and modify_lists='1' and user_level >= 8 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -3888,12 +4051,6 @@ if ($function == 'add_list')
 				}
 			else
 				{
-				$stmt="SELECT user_group from vicidial_users where user='$user' and user_level >= 8;";
-				if ($DB>0) {echo "|$stmt|\n";}
-				$rslt=mysql_to_mysqli($stmt, $link);
-				$row=mysqli_fetch_row($rslt);
-				$LOGuser_group =			$row[0];
-
 				$stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';";
 				if ($DB>0) {echo "|$stmt|\n";}
 				$rslt=mysql_to_mysqli($stmt, $link);
@@ -4088,6 +4245,15 @@ if ($function == 'recording_lookup')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and view_reports='1' and user_level > 6 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -4260,6 +4426,15 @@ if ($function == 'did_log_export')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and view_reports='1' and user_level > 6 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -4400,6 +4575,15 @@ if ($function == 'agent_stats_export')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and view_reports='1' and user_level > 6 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -4611,6 +4795,15 @@ if ($function == 'user_group_status')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and view_reports='1' and user_level > 6 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -4647,12 +4840,6 @@ if ($function == 'user_group_status')
 				}
 			else
 				{
-				$stmt="SELECT user_group from vicidial_users where user='$user' and user_level > 6 and view_reports='1' and active='Y';";
-				if ($DB) {$MAIN.="|$stmt|\n";}
-				$rslt=mysql_to_mysqli($stmt, $link);
-				$row=mysqli_fetch_row($rslt);
-				$LOGuser_group =			$row[0];
-
 				$stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';";
 				if ($DB) {$MAIN.="|$stmt|\n";}
 				$rslt=mysql_to_mysqli($stmt, $link);
@@ -4687,7 +4874,7 @@ if ($function == 'user_group_status')
 					while ($i < $groups_to_print)
 						{
 						$row=mysqli_fetch_row($rslt);
-						$rawLOGallowed_ingroupsSQL .=	"row[0]','";
+						$rawLOGallowed_ingroupsSQL .=	"$row[0]','";
 						$i++;
 						}
 					$whereLOGallowed_callsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL','$rawLOGallowed_ingroupsSQL')";
@@ -4827,6 +5014,15 @@ if ($function == 'in_group_status')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and view_reports='1' and user_level > 6 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -4864,12 +5060,6 @@ if ($function == 'in_group_status')
 				}
 			else
 				{
-				$stmt="SELECT user_group from vicidial_users where user='$user' and user_level > 6 and view_reports='1' and active='Y';";
-				if ($DB) {$MAIN.="|$stmt|\n";}
-				$rslt=mysql_to_mysqli($stmt, $link);
-				$row=mysqli_fetch_row($rslt);
-				$LOGuser_group =			$row[0];
-
 				$stmt="SELECT allowed_campaigns,admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';";
 				if ($DB) {$MAIN.="|$stmt|\n";}
 				$rslt=mysql_to_mysqli($stmt, $link);
@@ -4904,7 +5094,7 @@ if ($function == 'in_group_status')
 					while ($i < $groups_to_print)
 						{
 						$row=mysqli_fetch_row($rslt);
-						$rawLOGallowed_ingroupsSQL .=	"row[0]','";
+						$rawLOGallowed_ingroupsSQL .=	"$row[0]','";
 						$i++;
 						}
 					$LOGallowed_callsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL','$rawLOGallowed_ingroupsSQL')";
@@ -5043,6 +5233,15 @@ if ($function == 'agent_status')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and view_reports='1' and user_level > 6 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -5077,12 +5276,6 @@ if ($function == 'agent_status')
 				}
 			else
 				{
-				$stmt="SELECT user_group from vicidial_users where user='$user' and user_level > 6 and view_reports='1' and active='Y';";
-				if ($DB) {$MAIN.="|$stmt|\n";}
-				$rslt=mysql_to_mysqli($stmt, $link);
-				$row=mysqli_fetch_row($rslt);
-				$LOGuser_group =			$row[0];
-
 				$stmt="SELECT admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';";
 				if ($DB) {$MAIN.="|$stmt|\n";}
 				$rslt=mysql_to_mysqli($stmt, $link);
@@ -5281,6 +5474,15 @@ if ($function == 'callid_info')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and view_reports='1' and user_level > 6 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -5316,12 +5518,6 @@ if ($function == 'callid_info')
 				}
 			else
 				{
-				$stmt="SELECT user_group from vicidial_users where user='$user' and user_level > 6 and view_reports='1' and active='Y';";
-				if ($DB) {$MAIN.="|$stmt|\n";}
-				$rslt=mysql_to_mysqli($stmt, $link);
-				$row=mysqli_fetch_row($rslt);
-				$LOGuser_group =			$row[0];
-
 				$stmt="SELECT admin_viewable_groups from vicidial_user_groups where user_group='$LOGuser_group';";
 				if ($DB) {$MAIN.="|$stmt|\n";}
 				$rslt=mysql_to_mysqli($stmt, $link);
@@ -5489,6 +5685,15 @@ if ($function == 'update_log_entry')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and modify_leads='1' and user_level > 7 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -5630,6 +5835,15 @@ if ($function == 'add_lead')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and modify_leads='1' and user_level > 7 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -5646,6 +5860,18 @@ if ($function == 'add_lead')
 			}
 		else
 			{
+			if ($api_list_restrict > 0)
+				{
+				if (!preg_match("/ $list_id /",$allowed_lists))
+					{
+					$result = 'ERROR';
+					$result_reason = "add_lead NOT AN ALLOWED LIST ID";
+					$data = "$phone_number|$list_id";
+					echo "$result: $result_reason - $data\n";
+					api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+					exit;
+					}
+				}
 			if (strlen($gender)<1) {$gender='U';}
 			if (strlen($rank)<1) {$rank='0';}
 			if (strlen($list_id)<3) {$list_id='999';}
@@ -6376,6 +6602,15 @@ if ($function == 'update_lead')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and modify_leads='1' and user_level > 7 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);
@@ -6431,6 +6666,19 @@ if ($function == 'update_lead')
 				}
 			else
 				{
+				if ( ($api_list_restrict > 0) and ($list_id >= 99) )
+					{
+					if (!preg_match("/ $list_id /",$allowed_lists))
+						{
+						$result = 'ERROR';
+						$result_reason = "update_lead NOT AN ALLOWED LIST ID";
+						$data = "$phone_number|$list_id";
+						echo "$result: $result_reason - $data\n";
+						api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+						exit;
+						}
+					}
+
 				if (preg_match("/CAMPAIGN/i",$search_location)) # find lists within campaign
 					{
 					$stmt="SELECT campaign_id from vicidial_lists where list_id='$list_id';";
@@ -6582,6 +6830,19 @@ if ($function == 'update_lead')
 							$VLaffected_rows=0;
 							$CFaffected_rows=0;
 							$VCBaffected_rows=0;
+							if ( ($api_list_restrict > 0) and ($search_lead_list[$n] >= 99) )
+								{
+								if (!preg_match("/ $search_lead_list[$n] /",$allowed_lists))
+									{
+									$result = 'ERROR';
+									$result_reason = "update_lead NOT AN ALLOWED LIST ID";
+									$data = "$search_lead_list[$n]";
+									echo "$result: $result_reason - $data\n";
+									api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+									exit;
+									}
+								}
+
 							if ( (strlen($VL_update_SQL)>6) or ($delete_lead=='Y') )
 								{
 								if ($delete_lead=='Y')
@@ -6920,6 +7181,18 @@ if ($function == 'update_lead')
 								}
 							else
 								{
+								if ( ($api_list_restrict > 0) and ($list_id >= 99) )
+									{
+									if (!preg_match("/ $search_lead_list[$n] /",$allowed_lists))
+										{
+										$result = 'ERROR';
+										$result_reason = "update_lead NOT AN ALLOWED LIST ID";
+										$data = "$phone_number|$list_id";
+										echo "$result: $result_reason - $data\n";
+										api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+										exit;
+										}
+									}
 								### get current gmt_offset of the phone_number
 								$gmt_offset = lookup_gmt($phone_code,$USarea,$state,$LOCAL_GMT_OFF_STD,$Shour,$Smin,$Ssec,$Smon,$Smday,$Syear,$tz_method,$postal_code,$owner,$USprefix);
 
@@ -7125,6 +7398,15 @@ if ($function == 'check_phone_number')
 		}
 	else
 		{
+		if ( (!preg_match("/ $function /",$api_allowed_functions)) and (!preg_match("/ALL_FUNCTIONS/",$api_allowed_functions)) )
+			{
+			$result = 'ERROR';
+			$result_reason = "auth USER DOES NOT HAVE PERMISSION TO USE THIS FUNCTION";
+			echo "$result: $result_reason: |$user|$function|\n";
+			$data = "$allowed_user";
+			api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
+			exit;
+			}
 		$stmt="SELECT count(*) from vicidial_users where user='$user' and vdc_agent_api_access='1' and user_level > 7 and active='Y';";
 		$rslt=mysql_to_mysqli($stmt, $link);
 		$row=mysqli_fetch_row($rslt);