ViciDial/agc_2-X
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prevent non-wav/gsm files from being uploaded in audiostore

Browse Source 
git-svn-id: svn://192.168.202.10@2772 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2017-06-02 14:47:54 +00:00
parent 437c8f83e5
commit 25d38491d0
1 changed files with 34 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/vicidial/audio_store.php
+34 -19
View File
@@ -26,10 +26,11 @@
# 160613-1002 - Added feature to copy recordings to a new filename
# 170301-1650 - Added validation that sounds web dir exists
# 170409-1555 - Added IP List validation code
# 170602-1042 - Prevent non-wav/gsm files from being uploaded
#
$version = '2.14-20';
$build = '170409-1555';
$version = '2.14-21';
$build = '170602-1042';
$MT[0]='';
@@ -338,11 +339,18 @@ if ($action == "AUTOUPLOAD")
$audiofile_name = preg_replace("/\!/",'',$audiofile_name);
$audiofile_name = preg_replace("/\%/",'',$audiofile_name);
$audiofile_name = preg_replace("/\^/",'',$audiofile_name);
copy($AF_path, "$WeBServeRRooT/$sounds_web_directory/$audiofile_name");
chmod("$WeBServeRRooT/$sounds_web_directory/$audiofile_name", 0766);
if (preg_match("/\.wav$|\.gsm$/", $audiofile_name))
{
copy($AF_path, "$WeBServeRRooT/$sounds_web_directory/$audiofile_name");
chmod("$WeBServeRRooT/$sounds_web_directory/$audiofile_name", 0766);
echo _QXZ("SUCCESS").": $audiofile_name "._QXZ("uploaded")." "._QXZ("size").":" . filesize("$WeBServeRRooT/$sounds_web_directory/$audiofile_name") . "\n";
exit;
echo _QXZ("SUCCESS").": $audiofile_name "._QXZ("uploaded")." "._QXZ("size").":" . filesize("$WeBServeRRooT/$sounds_web_directory/$audiofile_name") . "\n";
exit;
}
else
{
echo _QXZ("ERROR").": "._QXZ("only wav and gsm files are allowed in the audio store")."\n";
}
}
else
{
@@ -521,21 +529,28 @@ if ($action == "MANUALUPLOAD")
$audiofile_name = preg_replace("/\!/",'',$audiofile_name);
$audiofile_name = preg_replace("/\%/",'',$audiofile_name);
$audiofile_name = preg_replace("/\^/",'',$audiofile_name);
copy($AF_path, "$WeBServeRRooT/$sounds_web_directory/$audiofile_name");
chmod("$WeBServeRRooT/$sounds_web_directory/$audiofile_name", 0766);
echo _QXZ("SUCCESS").": $audiofile_name "._QXZ("uploaded")." "._QXZ("size").":" . filesize("$WeBServeRRooT/$sounds_web_directory/$audiofile_name") . "\n";
if (preg_match("/\.wav$|\.gsm$/", $audiofile_name))
{
copy($AF_path, "$WeBServeRRooT/$sounds_web_directory/$audiofile_name");
chmod("$WeBServeRRooT/$sounds_web_directory/$audiofile_name", 0766);
echo _QXZ("SUCCESS").": $audiofile_name "._QXZ("uploaded")." "._QXZ("size").":" . filesize("$WeBServeRRooT/$sounds_web_directory/$audiofile_name") . "\n";
$stmt="UPDATE servers SET sounds_update='Y';";
$rslt=mysql_to_mysqli($stmt, $link);
$stmt="UPDATE servers SET sounds_update='Y';";
$rslt=mysql_to_mysqli($stmt, $link);
### LOG INSERTION Admin Log Table ###
$SQL_log = "$stmt|";
$SQL_log = preg_replace('/;/', '', $SQL_log);
$SQL_log = addslashes($SQL_log);
$stmt="INSERT INTO vicidial_admin_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$ip', event_section='AUDIOSTORE', event_type='LOAD', record_id='manualupload', event_code='$audiofile_name " . filesize("$WeBServeRRooT/$sounds_web_directory/$audiofile_name") . "', event_sql=\"$SQL_log\", event_notes='$audiofile_name $AF_path $AF_orig';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
### LOG INSERTION Admin Log Table ###
$SQL_log = "$stmt|";
$SQL_log = preg_replace('/;/', '', $SQL_log);
$SQL_log = addslashes($SQL_log);
$stmt="INSERT INTO vicidial_admin_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$ip', event_section='AUDIOSTORE', event_type='LOAD', record_id='manualupload', event_code='$audiofile_name " . filesize("$WeBServeRRooT/$sounds_web_directory/$audiofile_name") . "', event_sql=\"$SQL_log\", event_notes='$audiofile_name $AF_path $AF_orig';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
}
else
{
echo _QXZ("ERROR").": "._QXZ("only wav and gsm files are allowed in the audio store")."\n";
}
}
else
{