diff --git a/UPGRADE b/UPGRADE index 8677f6c4..b7b313e0 100644 --- a/UPGRADE +++ b/UPGRADE @@ -710,6 +710,10 @@ OTHER CHANGES: 198. Added "Pause Max URL" Campaign feature +199. Added "Allow Web DB Debug" System Settings feature, to allow use of the $DB + variable on the web screens for troubleshooting issues. + It is disabled by default. + diff --git a/extras/MySQL_AST_CREATE_tables.sql b/extras/MySQL_AST_CREATE_tables.sql index 52cd47a2..c3d09930 100644 --- a/extras/MySQL_AST_CREATE_tables.sql +++ b/extras/MySQL_AST_CREATE_tables.sql @@ -1955,7 +1955,8 @@ label_entry_list_id VARCHAR(60) default '', call_limit_24hour ENUM('0','1') default '0', call_limit_24hour_reset DATETIME default '2000-01-01 00:00:01', allowed_sip_stacks ENUM('SIP','PJSIP','SIP_and_PJSIP') default 'SIP', -agent_hide_hangup ENUM('1','0','2','3','4','5','6') default '0' +agent_hide_hangup ENUM('1','0','2','3','4','5','6') default '0', +allow_web_debug ENUM('0','1','2','3','4','5','6') default '0' ) ENGINE=MyISAM; CREATE TABLE vicidial_campaigns_list_mix ( @@ -5049,4 +5050,4 @@ INSERT INTO vicidial_settings_containers(container_id,container_notes,container_ UPDATE system_settings set vdc_agent_api_active='1'; -UPDATE system_settings SET db_schema_version='1654',db_schema_update_date=NOW(),reload_timestamp=NOW(); +UPDATE system_settings SET db_schema_version='1655',db_schema_update_date=NOW(),reload_timestamp=NOW(); diff --git a/extras/upgrade_2.14.sql b/extras/upgrade_2.14.sql index a458fb2c..a80ac7d4 100644 --- a/extras/upgrade_2.14.sql +++ b/extras/upgrade_2.14.sql @@ -1877,3 +1877,7 @@ ALTER TABLE system_settings ADD agent_hide_hangup ENUM('1','0','2','3','4','5',' ALTER TABLE vicidial_campaigns ADD agent_hide_hangup ENUM('Y','N') default 'N'; UPDATE system_settings SET db_schema_version='1654',db_schema_update_date=NOW() where db_schema_version < 1654; + +ALTER TABLE system_settings ADD allow_web_debug ENUM('0','1','2','3','4','5','6') default '0'; + +UPDATE system_settings SET db_schema_version='1655',db_schema_update_date=NOW() where db_schema_version < 1655; diff --git a/www/agc/active_list_refresh.php b/www/agc/active_list_refresh.php index 4ce640e1..1187df7d 100644 --- a/www/agc/active_list_refresh.php +++ b/www/agc/active_list_refresh.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed purely to serve updates of the live data to the display scripts # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table @@ -49,10 +49,11 @@ # 190111-0903 - Fix for PHP7 # 210616-2108 - Added optional CORS support, see options.php for details # 210825-0908 - Fix for XSS security issue +# 220220-0922 - Added allow_web_debug system setting # -$version = '0.0.20'; -$build = '210825-0908'; +$version = '0.0.21'; +$build = '220220-0922'; $php_script = 'active_list_refresh.php'; $SSagent_debug_logging=0; $startMS = microtime(); @@ -101,22 +102,6 @@ if (isset($_GET["field_name"])) {$field_name=$_GET["field_name"];} ### security strip all non-alphanumeric characters out of the variables ### $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$ADD=preg_replace("/[^0-9]/","",$ADD); -$order=preg_replace("/[^0-9a-zA-Z]/","",$order); -$format=preg_replace("/[^0-9a-zA-Z]/","",$format); -$bgcolor=preg_replace("/[^\#0-9a-zA-Z]/","",$bgcolor); -$txtcolor=preg_replace("/[^\#0-9a-zA-Z]/","",$txtcolor); -$txtsize=preg_replace("/[^0-9a-zA-Z]/","",$txtsize); -$selectsize=preg_replace("/[^0-9a-zA-Z]/","",$selectsize); -$selectfontsize=preg_replace("/[^0-9a-zA-Z]/","",$selectfontsize); -$selectedext=preg_replace("/[^ \#\*\:\/\@\.\-\_0-9a-zA-Z]/","",$selectedext); -$selectedtrunk=preg_replace("/[^ \#\*\:\/\@\.\-\_0-9a-zA-Z]/","",$selectedtrunk); -$selectedlocal=preg_replace("/[^ \#\*\:\/\@\.\-\_0-9a-zA-Z]/","",$selectedlocal); -$textareaheight=preg_replace("/[^0-9a-zA-Z]/","",$textareaheight); -$textareawidth=preg_replace("/[^0-9a-zA-Z]/","",$textareawidth); -$field_name=preg_replace("/[^ \#\*\:\/\@\.\-\_0-9a-zA-Z]/","",$field_name); -$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); -$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); # default optional vars if not set if (!isset($ADD)) {$ADD="1";} @@ -144,6 +129,22 @@ if (file_exists('options.php')) ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_languages,language_method,agent_debug_logging,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $SSagent_debug_logging = $row[3]; + $SSallow_web_debug = $row[4]; + } +if ($SSallow_web_debug < 1) {$DB=0; $format="text";} + $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} @@ -155,27 +156,37 @@ if ($sl_ct > 0) $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } - -$stmt = "SELECT use_non_latin,enable_languages,language_method,agent_debug_logging FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - $SSagent_debug_logging = $row[3]; - } ##### END SETTINGS LOOKUP ##### ########################################### +$ADD=preg_replace("/[^0-9]/","",$ADD); +$order=preg_replace("/[^0-9a-zA-Z]/","",$order); +$format=preg_replace("/[^0-9a-zA-Z]/","",$format); +$bgcolor=preg_replace("/[^\#0-9a-zA-Z]/","",$bgcolor); +$txtcolor=preg_replace("/[^\#0-9a-zA-Z]/","",$txtcolor); +$txtsize=preg_replace("/[^0-9a-zA-Z]/","",$txtsize); +$selectsize=preg_replace("/[^0-9a-zA-Z]/","",$selectsize); +$selectfontsize=preg_replace("/[^0-9a-zA-Z]/","",$selectfontsize); +$selectedext=preg_replace("/[^ \#\*\:\/\@\.\-\_0-9a-zA-Z]/","",$selectedext); +$selectedtrunk=preg_replace("/[^ \#\*\:\/\@\.\-\_0-9a-zA-Z]/","",$selectedtrunk); +$selectedlocal=preg_replace("/[^ \#\*\:\/\@\.\-\_0-9a-zA-Z]/","",$selectedlocal); +$textareaheight=preg_replace("/[^0-9a-zA-Z]/","",$textareaheight); +$textareawidth=preg_replace("/[^0-9a-zA-Z]/","",$textareawidth); +$field_name=preg_replace("/[^ \#\*\:\/\@\.\-\_0-9a-zA-Z]/","",$field_name); +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); + if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); } +else + { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + } + if (strlen($SSagent_debug_logging) > 1) { if ($SSagent_debug_logging == "$user") diff --git a/www/agc/agc_agent_manager_chat_interface.php b/www/agc/agc_agent_manager_chat_interface.php index e6f96784..e5cf039a 100644 --- a/www/agc/agc_agent_manager_chat_interface.php +++ b/www/agc/agc_agent_manager_chat_interface.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Joe Johnson, Matt Florell LICENSE: AGPLv2 # # This page is for agents to chat with managers via the agent interface. # @@ -17,10 +17,11 @@ # 180927-0624 - Fix for missing translationm issue #1125 # 201117-2239 - Changes for better compatibility with non-latin data input # 210616-2056 - Added optional CORS support, see options.php for details +# 220220-0855 - Added allow_web_debug system setting # -$admin_version = '2.14-11'; -$build = '210616-2056'; +$admin_version = '2.14-12'; +$build = '220220-0855'; $php_script = 'agc_agent_manager_chat_interface.php'; $sh="managerchats"; @@ -43,14 +44,16 @@ if (isset($_GET["pass"])) {$pass=$_GET["pass"];} if (!$user) {echo "Page should only be viewed through the agent interface."; die;} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); +$user=preg_replace("/\'|\"|\\\\|;| /","",$user); +$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $VUselected_language = ''; -$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,allow_chats FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,allow_chats,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -60,22 +63,27 @@ if ($qm_conf_ct > 0) $SSlanguage_method = $row[2]; $SSdefault_language = $row[3]; $SSallow_chats = $row[4]; + $SSallow_web_debug = $row[5]; } $VUselected_language = $SSdefault_language; +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$action = preg_replace('/[^-\_0-9a-zA-Z]/','',$action); +$SUBMIT = preg_replace('/[^-\_0-9a-zA-Z]/','',$SUBMIT); + if ($non_latin < 1) { - $user = preg_replace('/[^-\_0-9a-zA-Z]/','',$user); - $pass = preg_replace('/[^-\_0-9a-zA-Z]/','',$pass); + $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $manager_chat_id = preg_replace('/[^- \_\.0-9a-zA-Z]/','',$user); } else { - $user = preg_replace("/\'|\"|\\\\|;/","",$user); - $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); - $manager_chat_id = preg_replace("/\'|\"|\\\\|;/","",$user); + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + $manager_chat_id = preg_replace("/[^- \_\.0-9\p{L}]/u","",$user); } # if options file exists, use the override values for the above variables diff --git a/www/agc/alt_display.php b/www/agc/alt_display.php index 4aebde02..af44ad3a 100644 --- a/www/agc/alt_display.php +++ b/www/agc/alt_display.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed to display agent screen information outside of the agent screen # To use this script, you must set the options.php setting $alt_display_enabled = '1'; @@ -21,10 +21,11 @@ # 210426-0138 - Added calls_inqueue_count_ campaign settings options, and calls_in_queue_option=CAMPAIGN setting # 210428-2156 - Added calls_in_queue_display setting # 210616-1907 - Added optional CORS support, see options.php for details +# 220220-0940 - Added allow_web_debug system setting # -$version = '2.14-6'; -$build = '210616-1907'; +$version = '2.14-7'; +$build = '220220-0940'; $php_script = 'alt_display.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=11; @@ -53,6 +54,10 @@ if (isset($_GET["calls_in_queue_display"])) {$calls_in_queue_display=$_GET["c if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} +# default optional vars if not set +if (!isset($stage)) {$stage="default";} +if (!isset($ACTION)) {$ACTION="top_panel";} + $user = preg_replace("/\'|\"|\\\\|;/","",$user); $stage = preg_replace("/[^-_0-9a-zA-Z]/","",$stage); $ACTION = preg_replace('/[^-_0-9a-zA-Z]/','',$ACTION); @@ -62,10 +67,6 @@ $DB = preg_replace('/[^-_0-9a-zA-Z]/','',$DB); $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); -# default optional vars if not set -if (!isset($stage)) {$stage="default";} -if (!isset($ACTION)) {$ACTION="top_panel";} - $alt_display_enabled = '0'; # set to 1 to allow the alt_display.php script to be used # if options file exists, use the override values for the above variables @@ -145,10 +146,10 @@ $LOCAL_GMT_OFF_STD = $SERVER_GMT; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,qc_features_active,allow_emails,callback_time_24hour,enable_languages,language_method,agent_debug_logging,default_language,active_modules,allow_chats,default_phone_code,user_new_lead_limit,sip_event_logging,call_quota_lead_ranking FROM system_settings;"; +$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,qc_features_active,allow_emails,callback_time_24hour,enable_languages,language_method,agent_debug_logging,default_language,active_modules,allow_chats,default_phone_code,user_new_lead_limit,sip_event_logging,call_quota_lead_ranking,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'09002',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -174,10 +175,23 @@ if ($qm_conf_ct > 0) $SSuser_new_lead_limit = $row[18]; $SSsip_event_logging = $row[19]; $SScall_quota_lead_ranking = $row[20]; + $SSallow_web_debug = $row[21]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +if ($non_latin < 1) + { + $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); + } +else + { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + } + if (strlen($SSagent_debug_logging) > 1) { if ($SSagent_debug_logging == "$user") diff --git a/www/agc/api.php b/www/agc/api.php index 9cd58bda..175c1d2c 100644 --- a/www/agc/api.php +++ b/www/agc/api.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed as an API(Application Programming Interface) to allow # other programs to interact with the VICIDIAL Agent screen @@ -106,10 +106,11 @@ # 210320-2335 - Added additional update_fields options: scriptreload,script2reload,formreload,emailreload,chatreload # 210616-2057 - Added optional CORS support, see options.php for details # 210819-0902 - Updated change_ingroups for changes in vicidial_live_inbound_agents insert/update +# 220220-0847 - Added allow_web_debug system setting # -$version = '2.14-71'; -$build = '210819-0902'; +$version = '2.14-72'; +$build = '220220-0847'; $php_script = 'api.php'; $startMS = microtime(); @@ -276,6 +277,23 @@ $pass = preg_replace("/'|\"|\\\\|;| /","",$pass); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_languages,language_method,agent_debug_logging,outbound_cid_any,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $SSagent_debug_logging = $row[3]; + $SSoutbound_cid_any = $row[4]; + $SSallow_web_debug = $row[5]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + $VUselected_language = ''; $stmt="SELECT selected_language,api_list_restrict,api_allowed_functions,user_group from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} @@ -290,33 +308,20 @@ if ($sl_ct > 0) $VUapi_allowed_functions = $row[2]; $VUuser_group = $row[3]; } - -$stmt = "SELECT use_non_latin,enable_languages,language_method,agent_debug_logging,outbound_cid_any FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - $SSagent_debug_logging = $row[3]; - $SSoutbound_cid_any = $row[4]; - } ##### END SETTINGS LOOKUP ##### ########################################### $ingroup_choices = preg_replace("/\+/"," ",$ingroup_choices); $query_string = preg_replace("/'|\"|\\\\|;/","",$query_string); $stage = preg_replace("/\'|\"|\\\\|;/","",$stage); -$status = preg_replace("/\'|\"|\\\\|;/","",$status); +$close_window_link=preg_replace("/[^-_0-9a-zA-Z]/","",$close_window_link); +$dnc_check=preg_replace("/[^-_0-9a-zA-Z]/","",$dnc_check); +$campaign_dnc_check=preg_replace("/[^-_0-9a-zA-Z]/","",$campaign_dnc_check); if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); - $pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $agent_user=preg_replace("/[^0-9a-zA-Z]/","",$agent_user); $function = preg_replace("/[^-\_0-9a-zA-Z]/","",$function); $value = preg_replace("/[^-\|\_0-9a-zA-Z]/","",$value); @@ -395,9 +400,83 @@ if ($non_latin < 1) } else { - $source = preg_replace("/'|\"|\\\\|;|#/","",$source); - $agent_user = preg_replace("/'|\"|\\\\|;|#/","",$agent_user); - $alt_user = preg_replace("/'|\"|\\\\|;|#/","",$alt_user); + $user=preg_replace("/[^-_0-9\p{L}]/u","",$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + $agent_user=preg_replace("/[^0-9\p{L}]/u","",$agent_user); + $function = preg_replace("/[^-\_0-9\p{L}]/u","",$function); + $value = preg_replace("/[^-\|\_0-9\p{L}]/u","",$value); + $focus = preg_replace("/[^-\_0-9\p{L}]/u","",$focus); + $preview = preg_replace("/[^-\_0-9\p{L}]/u","",$preview); + $notes = preg_replace("/\+/"," ",$notes); + $notes = preg_replace("/[^- \.\_0-9\p{L}]/u","",$notes); + $search = preg_replace("/[^-\_0-9\p{L}]/u","",$search); + $group_alias = preg_replace("/[^0-9\p{L}]/u","",$group_alias); + $dial_prefix = preg_replace("/[^0-9\p{L}]/u","",$dial_prefix); + $source = preg_replace("/[^0-9\p{L}]/u","",$source); + $format = preg_replace("/[^0-9\p{L}]/u","",$format); + $vtiger_callback = preg_replace("/[^A-Z]/","",$vtiger_callback); + $alt_dial = preg_replace("/[^0-9A-Z]/","",$alt_dial); + $blended = preg_replace("/[^A-Z]/","",$blended); + $ingroup_choices = preg_replace("/[^- \_0-9\p{L}]/u","",$ingroup_choices); + $set_as_default = preg_replace("/[^A-Z]/","",$set_as_default); + $phone_code = preg_replace("/[^0-9X]/","",$phone_code); + $phone_number = preg_replace("/[^\*#0-9]/","",$phone_number); + $lead_id = preg_replace("/[^0-9]/","",$lead_id); + $vendor_id = preg_replace('/;|#/','',$vendor_id); + $vendor_id = preg_replace('/\+/',' ',$vendor_id); + $vendor_lead_code = preg_replace('/;|#/','',$vendor_lead_code); + $vendor_lead_code = preg_replace('/\+/',' ',$vendor_lead_code); + $source_id = preg_replace('/;|#/','',$source_id); + $source_id = preg_replace('/\+/',' ',$source_id); + $gmt_offset_now = preg_replace('/[^-\_\.0-9]/','',$gmt_offset_now); + $title = preg_replace('/[^- \'\_\.0-9\p{L}]/u','',$title); + $first_name = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$first_name); + $first_name = preg_replace('/\+/',' ',$first_name); + $middle_initial = preg_replace('/[^0-9\p{L}]/u','',$middle_initial); + $last_name = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$last_name); + $last_name = preg_replace('/\+/',' ',$last_name); + $address1 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address1); + $address2 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address2); + $address3 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address3); + $address1 = preg_replace('/\+/',' ',$address1); + $address2 = preg_replace('/\+/',' ',$address2); + $address3 = preg_replace('/\+/',' ',$address3); + $city = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$city); + $city = preg_replace('/\+/',' ',$city); + $state = preg_replace('/[^- 0-9\p{L}]/u','',$state); + $province = preg_replace('/[^- \'\+\.\_0-9\p{L}]/u','',$province); + $province = preg_replace('/\+/',' ',$province); + $postal_code = preg_replace('/[^- \'\+0-9\p{L}]/u','',$postal_code); + $postal_code = preg_replace('/\+/',' ',$postal_code); + $country_code = preg_replace('/[^A-Z]/','',$country_code); + $gender = preg_replace('/[^A-Z]/','',$gender); + $date_of_birth = preg_replace('/[^-0-9]/','',$date_of_birth); + $alt_phone = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$alt_phone); + $alt_phone = preg_replace('/\+/',' ',$alt_phone); + $email = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9\p{L}]/u','',$email); + $email = preg_replace('/\+/',' ',$email); + $security_phrase = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$security_phrase); + $security_phrase = preg_replace('/\+/',' ',$security_phrase); + $comments = preg_replace('/;|#/','',$comments); + $comments = preg_replace('/\+/',' ',$comments); + $rank = preg_replace('/[^0-9]/','',$rank); + $owner = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$owner); + $owner = preg_replace('/\+/',' ',$owner); + $dial_override = preg_replace("/[^A-Z]/","",$dial_override); + $consultative = preg_replace("/[^A-Z]/","",$consultative); + $callback_datetime = preg_replace("/\+/"," ",$callback_datetime); + $callback_datetime = preg_replace("/[^- \:\.\_0-9\p{L}]/u","",$callback_datetime); + $callback_type = preg_replace("/[^A-Z]/","",$callback_type); + $callback_comments = preg_replace("/\+/"," ",$callback_comments); + $callback_comments = preg_replace("/[^- \.\_0-9\p{L}]/u","",$callback_comments); + $qm_dispo_code = preg_replace("/[^-\.\_0-9\p{L}]/u","",$qm_dispo_code); + $alt_user = preg_replace("/[^0-9\p{L}]/u","",$alt_user); + $postal_code = preg_replace("/[^- \.\_0-9\p{L}]/u","",$postal_code); + $agent_debug = preg_replace("/[^- \.\:\|\_0-9\p{L}]/u","",$agent_debug); + $status = preg_replace("/[^-\_0-9\p{L}]/u","",$status); + $dial_ingroup = preg_replace("/[^-\_0-9\p{L}]/u","",$dial_ingroup); + $cid_choice = preg_replace("/[^-\_0-9\p{L}]/u","",$cid_choice); + $outbound_cid = preg_replace("/[^-\_0-9\p{L}]/u","",$outbound_cid); } ### date and fixed variables diff --git a/www/agc/astguiclient.php b/www/agc/astguiclient.php index de685ece..c3e82ade 100644 --- a/www/agc/astguiclient.php +++ b/www/agc/astguiclient.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # make sure you have added a user to the vicidial_users MySQL table with at least # user_level 1 or greater to access this page. Also you need to have the login @@ -72,10 +72,11 @@ # 200319-1532 - Small fixes for conference tab issues # 210615-1037 - Default security fixes, CVE-2021-28854 # 210616-2053 - Added optional CORS support, see options.php for details +# 220220-0938 - Added allow_web_debug system setting # -$version = '2.2.6-5'; -$build = '210616-2053'; +$version = '2.2.6-6'; +$build = '220220-0938'; $php_script = 'astguiclient.php'; require_once("dbconnect_mysqli.php"); @@ -114,6 +115,7 @@ $phone_login=preg_replace("/[^-_0-9a-zA-Z]/","",$phone_login); $phone_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$phone_pass); $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); +$relogin=preg_replace("/[^-_0-9a-zA-Z]/","",$relogin); # if options file exists, use the override values for the above variables # see the options-example.php file for more information @@ -124,6 +126,22 @@ if (file_exists('options.php')) ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $SSdefault_language = $row[3]; + $SSallow_web_debug = $row[4]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} @@ -136,20 +154,6 @@ if ($sl_ct > 0) $VUselected_language = $row[0]; } -$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - $SSdefault_language = $row[3]; - } - if (strlen($VUselected_language) < 1) {$VUselected_language = $SSdefault_language;} ##### END SETTINGS LOOKUP ##### @@ -160,6 +164,11 @@ if ($non_latin < 1) $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); $pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass); } +else + { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-_0-9\p{L}]/u','',$pass); + } if ($force_logout) { diff --git a/www/agc/call_log_display.php b/www/agc/call_log_display.php index c61a07c6..8c821629 100644 --- a/www/agc/call_log_display.php +++ b/www/agc/call_log_display.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed purely to send the inbound and outbound calls for a specific phone # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table @@ -43,10 +43,11 @@ # 201117-2200 - Changes for better compatibility with non-latin data input # 210616-2102 - Added optional CORS support, see options.php for details # 210825-0903 - Fix for XSS security issue +# 220220-0920 - Added allow_web_debug system setting # -$version = '2.14-23'; -$build = '210825-0903'; +$version = '2.14-24'; +$build = '220220-0920'; $php_script = 'call_log_display.php'; $SSagent_debug_logging=0; $startMS = microtime(); @@ -72,12 +73,6 @@ if (isset($_GET["protocol"])) {$protocol=$_GET["protocol"];} $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); -$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); -$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten); -$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol); -$in_limit = preg_replace('/[^0-9]/','',$in_limit); -$out_limit = preg_replace('/[^0-9]/','',$out_limit); # default optional vars if not set if (!isset($format)) {$format="text";} @@ -100,23 +95,10 @@ if (file_exists('options.php')) ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### -$VUselected_language = ''; -$stmt="SELECT selected_language from vicidial_users where user='$user';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$VD_login,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} -$sl_ct = mysqli_num_rows($rslt); -if ($sl_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $VUselected_language = $row[0]; - } - -$stmt = "SELECT use_non_latin,enable_languages,language_method,agent_debug_logging FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_languages,language_method,agent_debug_logging,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'03001',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -125,14 +107,43 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[1]; $SSlanguage_method = $row[2]; $SSagent_debug_logging = $row[3]; + $SSallow_web_debug = $row[4]; + } +if ($SSallow_web_debug < 1) {$DB=0; $format="text";} + +$VUselected_language = ''; +$stmt="SELECT selected_language from vicidial_users where user='$user';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$VD_login,$server_ip,$session_name,$one_mysql_log);} +$sl_ct = mysqli_num_rows($rslt); +if ($sl_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $VUselected_language = $row[0]; } ##### END SETTINGS LOOKUP ##### ########################################### +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); +$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten); +$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol); +$in_limit = preg_replace('/[^0-9]/','',$in_limit); +$out_limit = preg_replace('/[^0-9]/','',$out_limit); +$format = preg_replace('/[^-_0-9a-zA-Z]/','',$format); + if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); } +else + { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + } + if (strlen($SSagent_debug_logging) > 1) { if ($SSagent_debug_logging == "$user") diff --git a/www/agc/chat_db_query.php b/www/agc/chat_db_query.php index 961afb03..35a742fc 100644 --- a/www/agc/chat_db_query.php +++ b/www/agc/chat_db_query.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Joe Johnson, Matt Florell LICENSE: AGPLv2 # # Called by vdc_chat_display.php and vicidial_chat_agent.js. This contains all actions taken by the # agent's interface when chatting with customers, other agents, and managers, through @@ -25,6 +25,7 @@ # 170528-1028 - Added more variable filtering # 201117-2238 - Changes for better compatibility with non-latin data input # 210616-2055 - Added optional CORS support, see options.php for details +# 220219-2336 - Added allow_web_debug system setting # $php_script = 'chat_db_query.php'; @@ -36,71 +37,62 @@ $NOW_TIME = date("Y-m-d H:i:s"); $chat_background_array=array(); # Defined further down $style_array=array("", "italics", "bold italics"); -if (isset($_GET["action"])) {$action=$_GET["action"];} +if (isset($_GET["action"])) {$action=$_GET["action"];} elseif (isset($_POST["action"])) {$action=$_POST["action"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} -if (isset($_GET["chat_id"])) {$chat_id=$_GET["chat_id"];} +if (isset($_GET["chat_id"])) {$chat_id=$_GET["chat_id"];} elseif (isset($_POST["chat_id"])) {$chat_id=$_POST["chat_id"];} -if (isset($_GET["chat_group_id"])) {$chat_group_id=$_GET["chat_group_id"];} +if (isset($_GET["chat_group_id"])) {$chat_group_id=$_GET["chat_group_id"];} elseif (isset($_POST["chat_group_id"])) {$chat_group_id=$_POST["chat_group_id"];} -if (isset($_GET["chat_level"])) {$chat_level=$_GET["chat_level"];} +if (isset($_GET["chat_level"])) {$chat_level=$_GET["chat_level"];} elseif (isset($_POST["chat_level"])) {$chat_level=$_POST["chat_level"];} -if (isset($_GET["chat_creator"])) {$chat_creator=$_GET["chat_creator"];} +if (isset($_GET["chat_creator"])) {$chat_creator=$_GET["chat_creator"];} elseif (isset($_POST["chat_creator"])) {$chat_creator=$_POST["chat_creator"];} -if (isset($_GET["chat_member_name"])) {$chat_member_name=$_GET["chat_member_name"];} +if (isset($_GET["chat_member_name"])) {$chat_member_name=$_GET["chat_member_name"];} elseif (isset($_POST["chat_member_name"])) {$chat_member_name=$_POST["chat_member_name"];} -if (isset($_GET["chat_message"])) {$chat_message=$_GET["chat_message"];} +if (isset($_GET["chat_message"])) {$chat_message=$_GET["chat_message"];} elseif (isset($_POST["chat_message"])) {$chat_message=$_POST["chat_message"];} -if (isset($_GET["email"])) {$email=$_GET["email"];} +if (isset($_GET["email"])) {$email=$_GET["email"];} elseif (isset($_POST["email"])) {$email=$_POST["email"];} -if (isset($_GET["lead_id"])) {$lead_id=$_GET["lead_id"];} +if (isset($_GET["lead_id"])) {$lead_id=$_GET["lead_id"];} elseif (isset($_POST["lead_id"])) {$lead_id=$_POST["lead_id"];} -if (isset($_GET["user"])) {$user=$_GET["user"];} +if (isset($_GET["user"])) {$user=$_GET["user"];} elseif (isset($_POST["user"])) {$user=$_POST["user"];} -if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];} +if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];} elseif (isset($_POST["server_ip"])) {$server_ip=$_POST["server_ip"];} -if (isset($_GET["user_level"])) {$user_level=$_GET["user_level"];} - elseif (isset($_POST["user_level"])) {$user_level=$_POST["user_level"];} -if (isset($_GET["pass"])) {$pass=$_GET["pass"];} +if (isset($_GET["pass"])) {$pass=$_GET["pass"];} elseif (isset($_POST["pass"])) {$pass=$_POST["pass"];} -if (isset($_GET["first_name"])) {$first_name=$_GET["first_name"];} - elseif (isset($_POST["first_name"])) {$first_name=$_POST["first_name"];} -if (isset($_GET["last_name"])) {$last_name=$_GET["last_name"];} - elseif (isset($_POST["last_name"])) {$last_name=$_POST["last_name"];} -if (isset($_GET["group_id"])) {$group_id=$_GET["group_id"];} - elseif (isset($_POST["group_id"])) {$group_id=$_POST["group_id"];} -if (isset($_GET["keepalive"])) {$keepalive=$_GET["keepalive"];} - elseif (isset($_POST["keepalive"])) {$keepalive=$_POST["keepalive"];} -if (isset($_GET["current_message_count"])) {$current_message_count=$_GET["current_message_count"];} - elseif (isset($_POST["current_message_count"])) {$current_message_count=$_POST["current_message_count"];} - -if (isset($_GET["manager_chat_id"])) {$manager_chat_id=$_GET["manager_chat_id"];} +if (isset($_GET["group_id"])) {$group_id=$_GET["group_id"];} + elseif (isset($_POST["group_id"])) {$group_id=$_POST["group_id"];} +if (isset($_GET["keepalive"])) {$keepalive=$_GET["keepalive"];} + elseif (isset($_POST["keepalive"])) {$keepalive=$_POST["keepalive"];} +if (isset($_GET["current_message_count"])) {$current_message_count=$_GET["current_message_count"];} + elseif (isset($_POST["current_message_count"])) {$current_message_count=$_POST["current_message_count"];} +if (isset($_GET["manager_chat_id"])) {$manager_chat_id=$_GET["manager_chat_id"];} elseif (isset($_POST["manager_chat_id"])) {$manager_chat_id=$_POST["manager_chat_id"];} -if (isset($_GET["manager_chat_subid"])) {$manager_chat_subid=$_GET["manager_chat_subid"];} +if (isset($_GET["manager_chat_subid"])) {$manager_chat_subid=$_GET["manager_chat_subid"];} elseif (isset($_POST["manager_chat_subid"])) {$manager_chat_subid=$_POST["manager_chat_subid"];} -if (isset($_GET["current_active_chat"])) {$current_active_chat=$_GET["current_active_chat"];} - elseif (isset($_POST["current_active_chat"])) {$current_active_chat=$_POST["current_active_chat"];} -if (isset($_GET["field_name"])) {$field_name=$_GET["field_name"];} +if (isset($_GET["field_name"])) {$field_name=$_GET["field_name"];} elseif (isset($_POST["field_name"])) {$field_name=$_POST["field_name"];} -if (isset($_GET["agent_manager"])) {$agent_manager=$_GET["agent_manager"];} - elseif (isset($_POST["agent_manager"])) {$agent_manager=$_POST["agent_manager"];} -if (isset($_GET["agent_to_add"])) {$agent_to_add=$_GET["agent_to_add"];} - elseif (isset($_POST["agent_to_add"])) {$agent_to_add=$_POST["agent_to_add"];} +if (isset($_GET["agent_manager"])) {$agent_manager=$_GET["agent_manager"];} + elseif (isset($_POST["agent_manager"])) {$agent_manager=$_POST["agent_manager"];} +if (isset($_GET["agent_to_add"])) {$agent_to_add=$_GET["agent_to_add"];} + elseif (isset($_POST["agent_to_add"])) {$agent_to_add=$_POST["agent_to_add"];} if (isset($_GET["agent_user"])) {$agent_user=$_GET["agent_user"];} - elseif (isset($_POST["agent_user"])) {$agent_user=$_POST["agent_user"];} -if (isset($_GET["agent_override"])) {$agent_override=$_GET["agent_override"];} - elseif (isset($_POST["agent_override"])) {$agent_override=$_POST["agent_override"];} -if (isset($_GET["hangup_override"])) {$hangup_override=$_GET["hangup_override"];} - elseif (isset($_POST["hangup_override"])) {$hangup_override=$_POST["hangup_override"];} -if (isset($_GET["manager_message"])) {$manager_message=$_GET["manager_message"];} - elseif (isset($_POST["manager_message"])) {$manager_message=$_POST["manager_message"];} -if (isset($_GET["ChatReloadIDNumber"])) {$ChatReloadIDNumber=$_GET["ChatReloadIDNumber"];} - elseif (isset($_POST["ChatReloadIDNumber"])) {$ChatReloadIDNumber=$_POST["ChatReloadIDNumber"];} + elseif (isset($_POST["agent_user"])) {$agent_user=$_POST["agent_user"];} +if (isset($_GET["agent_override"])) {$agent_override=$_GET["agent_override"];} + elseif (isset($_POST["agent_override"])) {$agent_override=$_POST["agent_override"];} +if (isset($_GET["hangup_override"])) {$hangup_override=$_GET["hangup_override"];} + elseif (isset($_POST["hangup_override"])) {$hangup_override=$_POST["hangup_override"];} +if (isset($_GET["manager_message"])) {$manager_message=$_GET["manager_message"];} + elseif (isset($_POST["manager_message"])) {$manager_message=$_POST["manager_message"];} +if (isset($_GET["ChatReloadIDNumber"])) {$ChatReloadIDNumber=$_GET["ChatReloadIDNumber"];} + elseif (isset($_POST["ChatReloadIDNumber"])) {$ChatReloadIDNumber=$_POST["ChatReloadIDNumber"];} if (isset($_GET["chat_xfer_type"])) {$chat_xfer_type=$_GET["chat_xfer_type"];} - elseif (isset($_POST["chat_xfer_type"])) {$chat_xfer_type=$_POST["chat_xfer_type"];} -if (isset($_GET["chat_xfer_value"])) {$chat_xfer_value=$_GET["chat_xfer_value"];} - elseif (isset($_POST["chat_xfer_value"])) {$chat_xfer_value=$_POST["chat_xfer_value"];} + elseif (isset($_POST["chat_xfer_type"])) {$chat_xfer_type=$_POST["chat_xfer_type"];} +if (isset($_GET["chat_xfer_value"])) {$chat_xfer_value=$_GET["chat_xfer_value"];} + elseif (isset($_POST["chat_xfer_value"])) {$chat_xfer_value=$_POST["chat_xfer_value"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); @@ -116,10 +108,10 @@ $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $VUselected_language = ''; -$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,allow_chats FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,allow_chats,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -129,12 +121,13 @@ if ($qm_conf_ct > 0) $SSlanguage_method = $row[2]; $SSdefault_language = $row[3]; $SSallow_chats = $row[4]; + $SSallow_web_debug = $row[5]; } $VUselected_language = $SSdefault_language; +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### -$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); $server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip); $agent_manager = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$agent_manager); $agent_user = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$agent_user); @@ -151,15 +144,25 @@ $chat_xfer_value = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$chat_xfer_value); $email = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$email); $field_name = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$field_name); $manager_chat_subid = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$manager_chat_subid); +$action=preg_replace("/[^-_0-9a-zA-Z]/","",$action); +$keepalive=preg_replace("/[^-_0-9a-zA-Z]/","",$keepalive); +$chat_message = preg_replace("/\"|\\\\|;/","",$chat_message); +$current_message_count=preg_replace("/[^-_0-9a-zA-Z]/","",$current_message_count); +$agent_override = preg_replace('/[^-_0-9\p{L}]/u',"",$agent_override); +$hangup_override = preg_replace('/[^-_0-9\p{L}]/u',"",$hangup_override); +$ChatReloadIDNumber=preg_replace("/[^-_0-9a-zA-Z]/","",$ChatReloadIDNumber); +$manager_message = preg_replace("/\"|\\\\|;/","",$manager_message); if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); - $pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $chat_member_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/',"",$chat_member_name); } else { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); $chat_member_name = preg_replace('/[^- \.\,\_0-9\p{L}]/u',"",$chat_member_name); } diff --git a/www/agc/conf_exten_check.php b/www/agc/conf_exten_check.php index 0c7e04e3..e92f8e9c 100644 --- a/www/agc/conf_exten_check.php +++ b/www/agc/conf_exten_check.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed purely to send whether the meetme conference has live channels connected and which they are # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table @@ -90,10 +90,11 @@ # 210425-2357 - Added calls_inqueue_count_ calculation # 210616-1905 - Added optional CORS support, see options.php for details # 210825-0907 - Fix for XSS security issue +# 220219-2328 - Added allow_web_debug system setting # -$version = '2.14-64'; -$build = '210825-0907'; +$version = '2.14-65'; +$build = '220219-2328'; $php_script = 'conf_exten_check.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=51; @@ -156,8 +157,11 @@ if (isset($_GET["visibility"])) {$visibility=$_GET["visibility"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); -if ($bcrypt == 'OFF') - {$bcrypt=0;} +# default optional vars if not set +if (!isset($format)) {$format="text";} +if (!isset($ACTION)) {$ACTION="refresh";} +if (!isset($client)) {$client="agc";} +if ($bcrypt == 'OFF') {$bcrypt=0;} # if options file exists, use the override values for the above variables # see the options-example.php file for more information @@ -176,6 +180,22 @@ $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_languages,language_method,agent_debug_logging,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'03001',$user,$server_ip,$session_name,$one_mysql_log);} +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $SSagent_debug_logging = $row[3]; + $SSallow_web_debug = $row[4]; + } +if ($SSallow_web_debug < 1) {$DB=0; $format='text';} + $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} @@ -187,28 +207,9 @@ if ($sl_ct > 0) $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } - -$stmt = "SELECT use_non_latin,enable_languages,language_method,agent_debug_logging FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'03001',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - $SSagent_debug_logging = $row[3]; - } ##### END SETTINGS LOOKUP ##### ########################################### -if ($non_latin < 1) - { - $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); - } - $session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); $server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $conf_exten = preg_replace("/[^-_0-9a-zA-Z]/","",$conf_exten); @@ -216,17 +217,35 @@ $exten = preg_replace("/\'|\"|\\\\|;/","",$exten); $clicks = preg_replace("/\'|\"|\\\\|;/","",$clicks); $customer_chat_id = preg_replace("/[^0-9a-zA-Z]/","",$customer_chat_id); $visibility = preg_replace("/\'|\"|\\\\|;/","",$visibility); +$MDnextCID = preg_replace("/[^-_0-9a-zA-Z]/","",$MDnextCID); +$live_call_seconds = preg_replace("/[^-_0-9a-zA-Z]/","",$live_call_seconds); +$bcrypt = preg_replace("/[^-_0-9a-zA-Z]/","",$bcrypt); +$format = preg_replace("/[^-_0-9a-zA-Z]/","",$format); +$ACTION = preg_replace("/[^-_0-9a-zA-Z]/","",$ACTION); +$auto_dial_level = preg_replace("/[^-\._0-9a-zA-Z]/","",$auto_dial_level); +$check_for_answer = preg_replace("/[^-_0-9a-zA-Z]/","",$check_for_answer); +$client = preg_replace("/[^-_0-9a-zA-Z]/","",$client); +$campagentstdisp = preg_replace("/[^-_0-9a-zA-Z]/","",$campagentstdisp); +$phone_number = preg_replace("/[^-_0-9a-zA-Z]/","",$phone_number); +$xferchannel = preg_replace("/\'|\"|\\\\|;/","",$xferchannel); + +if ($non_latin < 1) + { + $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); + $campaign = preg_replace("/[^-_0-9a-zA-Z]/","",$campaign); + } +else + { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + $campaign = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign); + } -# default optional vars if not set -if (!isset($format)) {$format="text";} -if (!isset($ACTION)) {$ACTION="refresh";} -if (!isset($client)) {$client="agc";} if (strlen($SSagent_debug_logging) > 1) { - if ($SSagent_debug_logging == "$user") - {$SSagent_debug_logging=1;} - else - {$SSagent_debug_logging=0;} + if ($SSagent_debug_logging == "$user") {$SSagent_debug_logging=1;} + else {$SSagent_debug_logging=0;} } $Alogin='N'; @@ -287,6 +306,10 @@ if ($format=='debug') echo "\n"; echo "\n"; echo "\n"; + if ($DB > 0) + { + echo "|session_name: $session_name|server_ip: $server_ip|conf_exten: $conf_exten|exten: $exten|clicks: $clicks|customer_chat_id: $customer_chat_id|visibility: $visibility|MDnextCID: $MDnextCID|live_call_seconds: $live_call_seconds|bcrypt: $bcrypt|format: $format|ACTION: $ACTION|auto_dial_level: $auto_dial_level|check_for_answer: $check_for_answer|client: $client|campagentstdisp: $campagentstdisp|phone_number: $phone_number|xferchannel: $xferchannel\n"; + } } diff --git a/www/agc/deactivate_lead.php b/www/agc/deactivate_lead.php index 70ee60d9..00fd25bc 100644 --- a/www/agc/deactivate_lead.php +++ b/www/agc/deactivate_lead.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed to be used in the "Dispo URL" field of a campaign # or in-group. It should take in the campaign_id to check for the same source_id @@ -34,6 +34,7 @@ # 201117-2222 - Changes for better compatibility with non-latin data input # 210615-1036 - Default security fixes, CVE-2021-28854 # 210616-2050 - Added optional CORS support, see options.php for details +# 220219-2320 - Added allow_web_debug system setting # $api_script = 'deactivate'; @@ -95,6 +96,21 @@ header ("Content-type: text/html; charset=utf-8"); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'02001',$user,$server_ip,$session_name,$one_mysql_log);} +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $SSallow_web_debug = $row[3]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} @@ -106,36 +122,30 @@ if ($sl_ct > 0) $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } - -$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'02001',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - } ##### END SETTINGS LOOKUP ##### ########################################### $search_field = preg_replace("/\'|\"|\\\\|;| /","",$search_field); $lead_id = preg_replace('/[^0-9]/','',$lead_id); +$log_to_file = preg_replace('/[^-_0-9a-zA-Z]/', '', $log_to_file); if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); - $pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $campaign_check = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign_check); $new_status = preg_replace('/[^-_0-9a-zA-Z]/','',$new_status); + $sale_status = preg_replace('/[^-_0-9a-zA-Z]/', '', $sale_status); + $dispo = preg_replace('/[^-_0-9a-zA-Z]/', '', $dispo); } else { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); $campaign_check = preg_replace('/[^-_0-9\p{L}]/u','',$campaign_check); $new_status = preg_replace('/[^-_0-9\p{L}]/u','',$new_status); + $sale_status = preg_replace('/[^-_0-9\p{L}]/u', '', $sale_status); + $dispo = preg_replace('/[^-_0-9\p{L}]/u', '', $dispo); } if ($DB>0) {echo "$lead_id|$search_field|$campaign_check|$sale_status|$dispo|$new_status|$user|$pass|$DB|$log_to_file|\n";} diff --git a/www/agc/dispo_add_FPG.php b/www/agc/dispo_add_FPG.php index 75651555..0bd88f68 100644 --- a/www/agc/dispo_add_FPG.php +++ b/www/agc/dispo_add_FPG.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed to be used in the "Dispo URL" field of a campaign # or in-group. It adds the phone_number of the call to a designated inbound @@ -23,6 +23,7 @@ # 170526-2305 - Added additional variable filtering # 210615-1039 - Default security fixes, CVE-2021-28854 # 210616-2049 - Added optional CORS support, see options.php for details +# 220219-2317 - Added allow_web_debug system setting # $api_script = 'add_FPG'; @@ -72,9 +73,6 @@ $k=0; # filter variables $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$phone_number = preg_replace('/[^-_0-9a-zA-Z]/','',$phone_number); -$FPG_id = preg_replace("/\'|\"|\\\\|;| /","",$FPG_id); -$lead_id = preg_replace('/[^0-9]/','',$lead_id); # if options file exists, use the override values for the above variables # see the options-example.php file for more information @@ -87,6 +85,21 @@ header ("Content-type: text/html; charset=utf-8"); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'02001',$user,$server_ip,$session_name,$one_mysql_log);} +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $SSallow_web_debug = $row[3]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} @@ -98,25 +111,27 @@ if ($sl_ct > 0) $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } - -$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'02001',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - } ##### END SETTINGS LOOKUP ##### ########################################### +$phone_number = preg_replace('/[^-_0-9a-zA-Z]/','',$phone_number); +$FPG_id = preg_replace("/\'|\"|\\\\|;| /","",$FPG_id); +$lead_id = preg_replace('/[^0-9]/','',$lead_id); +$log_to_file = preg_replace('/[^-_0-9a-zA-Z]/', '', $log_to_file); + if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); + $sale_status = preg_replace('/[^-_0-9a-zA-Z]/', '', $sale_status); + $dispo = preg_replace('/[^-_0-9a-zA-Z]/', '', $dispo); + } +else + { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + $sale_status = preg_replace('/[^-_0-9\p{L}]/u', '', $sale_status); + $dispo = preg_replace('/[^-_0-9\p{L}]/u', '', $dispo); } if ($DB>0) {echo "$lead_id|$search_field|$campaign_check|$sale_status|$dispo|$new_status|$user|$pass|$DB|$log_to_file|\n";} diff --git a/www/agc/dispo_change_status.php b/www/agc/dispo_change_status.php index ef47774d..5f76b38c 100644 --- a/www/agc/dispo_change_status.php +++ b/www/agc/dispo_change_status.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed to be used in the "Dispo URL" field of a campaign # or in-group. It can update the status of a lead to a new status if the lead @@ -27,6 +27,7 @@ # 201117-2217 - Changes for better compatibility with non-latin data input # 210615-1035 - Default security fixes, CVE-2021-28854 # 210616-2047 - Added optional CORS support, see options.php for details +# 220219-2314 - Added allow_web_debug system setting # $api_script = 'dispo_change_status'; @@ -102,6 +103,20 @@ header ("Content-type: text/html; charset=utf-8"); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $SSallow_web_debug = $row[3]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} @@ -112,18 +127,6 @@ if ($sl_ct > 0) $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } - -$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - } ##### END SETTINGS LOOKUP ##### ########################################### @@ -137,14 +140,18 @@ $log_to_file = preg_replace('/[^0-9]/','',$log_to_file); if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); - $pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $logged_status = preg_replace('/[^-_0-9a-zA-Z]/','',$logged_status); $new_status = preg_replace('/[^-_0-9a-zA-Z]/','',$new_status); + $dispo = preg_replace('/[^-_0-9a-zA-Z]/', '', $dispo); } else { + $user=preg_replace("/[^-_0-9\p{L}]/u","",$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); $logged_status = preg_replace('/[^-_0-9\p{L}]/u','',$logged_status); $new_status = preg_replace('/[^-_0-9\p{L}]/u','',$new_status); + $dispo = preg_replace('/[^-_0-9\p{L}]/u', '', $dispo); } if ($DB>0) {echo "$lead_id|$dispo|$logged_status|$logged_count|$new_status|$days_search|$archive_search|$in_out_search|$user|$pass|$DB|$log_to_file|\n";} diff --git a/www/agc/dispo_list_quota.php b/www/agc/dispo_list_quota.php index 9b015891..0eacbac4 100644 --- a/www/agc/dispo_list_quota.php +++ b/www/agc/dispo_list_quota.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed to be used in the "Dispo URL" field of a campaign # or in-group. It can check to see if a list should be set to active=N if the @@ -23,6 +23,7 @@ # # CHANGES # 210813-1340 - First Build +# 220219-2311 - Added allow_web_debug system setting # $api_script = 'dispo_list_quota'; @@ -98,6 +99,20 @@ header ("Content-type: text/html; charset=utf-8"); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $SSallow_web_debug = $row[3]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} @@ -108,18 +123,6 @@ if ($sl_ct > 0) $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } - -$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - } ##### END SETTINGS LOOKUP ##### ########################################### @@ -129,16 +132,19 @@ $log_to_file = preg_replace('/[^0-9]/','',$log_to_file); $list_quota_field = preg_replace('/[^-_0-9a-zA-Z]/', '', $list_quota_field); $list_quota_count = preg_replace('/[^-_0-9a-zA-Z]/', '', $list_quota_count); $clear_from_hopper = preg_replace('/[^0-9]/','',$clear_from_hopper); +$logged_count = preg_replace('/[^-_0-9a-zA-Z]/', '', $logged_count); if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); - $pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $quota_status = preg_replace('/[^-_0-9a-zA-Z]/','',$quota_status); $dispo = preg_replace('/[^-_0-9a-zA-Z]/', '', $dispo); } else { + $user=preg_replace("/[^-_0-9\p{L}]/u","",$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); $quota_status = preg_replace('/[^-_0-9\p{L}]/u','',$quota_status); $dispo = preg_replace('/[^-_0-9\p{L}]/u','',$dispo); } diff --git a/www/agc/dispo_move_list.php b/www/agc/dispo_move_list.php index 8604dfb0..2eb24097 100644 --- a/www/agc/dispo_move_list.php +++ b/www/agc/dispo_move_list.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed to be used in the "Dispo URL" field of a campaign # or in-group (although it can also be used in the "No Agent Call URL" field). @@ -67,6 +67,7 @@ # 180419-2257 - Added multi_trigger option # 210615-1038 - Default security fixes, CVE-2021-28854 # 210616-2046 - Added optional CORS support, see options.php for details +# 220219-2253 - Added allow_web_debug system setting # $api_script = 'movelist'; @@ -143,12 +144,6 @@ $k=0; # filter variables $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$lead_age = preg_replace('/[^_0-9]/', '', $lead_age); -$lead_id = preg_replace('/[^_0-9]/', '', $lead_id); -$list_id = preg_replace('/[^_0-9]/', '', $list_id); -$new_list_id = preg_replace('/[^_0-9]/', '', $new_list_id); -$list_id_trigger = preg_replace('/[^_0-9]/', '', $list_id_trigger); -$multi_trigger=preg_replace("/\'|\"|\\\\|;| /","",$multi_trigger); # if options file exists, use the override values for the above variables # see the options-example.php file for more information @@ -161,6 +156,21 @@ header ("Content-type: text/html; charset=utf-8"); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'02001',$user,$server_ip,$session_name,$one_mysql_log);} +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $SSallow_web_debug = $row[3]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} @@ -172,26 +182,42 @@ if ($sl_ct > 0) $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } - -$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'02001',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - } ##### END SETTINGS LOOKUP ##### ########################################### +$lead_age = preg_replace('/[^_0-9]/', '', $lead_age); +$lead_id = preg_replace('/[^_0-9]/', '', $lead_id); +$list_id = preg_replace('/[^_0-9]/', '', $list_id); +$new_list_id = preg_replace('/[^_0-9]/', '', $new_list_id); +$list_id_trigger = preg_replace('/[^_0-9]/', '', $list_id_trigger); +$multi_trigger=preg_replace("/\'|\"|\\\\|;| /","",$multi_trigger); +$log_to_file = preg_replace('/[^-_0-9a-zA-Z]/', '', $log_to_file); +$called_count = preg_replace('/[^-_0-9a-zA-Z]/', '', $called_count); +$called_count_trigger = preg_replace('/[^-_0-9a-zA-Z]/', '', $called_count_trigger); +$talk_time = preg_replace('/[^-_0-9a-zA-Z]/', '', $talk_time); +$talk_time_trigger = preg_replace('/[^-_0-9a-zA-Z]/', '', $talk_time_trigger); +$reset_dialed = preg_replace('/[^-_0-9a-zA-Z]/', '', $reset_dialed); +$entry_date = preg_replace('/[^- \:_0-9a-zA-Z]/', '', $entry_date); +$populate_sp_old_list = preg_replace('/[^-_0-9a-zA-Z]/', '', $populate_sp_old_list); +$populate_comm_old_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $populate_comm_old_date); + if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); + $exclude_status = preg_replace('/[^-_0-9a-zA-Z]/', '', $exclude_status); + $sale_status = preg_replace('/[^-_0-9a-zA-Z]/', '', $sale_status); + $dispo = preg_replace('/[^-_0-9a-zA-Z]/', '', $dispo); } +else + { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + $exclude_status = preg_replace('/[^-_0-9\p{L}]/u', '', $exclude_status); + $sale_status = preg_replace('/[^-_0-9\p{L}]/u', '', $sale_status); + $dispo = preg_replace('/[^-_0-9\p{L}]/u', '', $dispo); + } + if ($lead_age > 0) { @@ -323,6 +349,10 @@ else $sale_status = "$TD$sale_status$TD"; $lead_age = preg_replace('/[^_0-9]/', '', $lead_age); $list_id_trigger = preg_replace('/[^_0-9]/', '', $list_id_trigger); + $called_count_trigger = preg_replace('/[^-_0-9a-zA-Z]/', '', $called_count_trigger); + $talk_time_trigger = preg_replace('/[^-_0-9a-zA-Z]/', '', $talk_time_trigger); + $sale_status = preg_replace('/[^-_0-9\p{L}]/u', '', $sale_status); + $exclude_status = preg_replace('/[^-_0-9\p{L}]/u', '', $exclude_status); if ($lead_age > 0) { @@ -363,6 +393,8 @@ else if (isset($_GET["$resetfield"])) {$reset_dialed=$_GET["$resetfield"];} elseif (isset($_POST["$resetfield"])) {$reset_dialed=$_POST["$resetfield"];} $new_list_id = preg_replace('/[^_0-9]/', '', $new_list_id); + $reset_dialed = preg_replace('/[^-_0-9a-zA-Z]/', '', $reset_dialed); + if ($DB) {echo _QXZ("MULTI_MATCH:")." $k|$sale_status|$new_list_id|$reset_dialed|$exclude_status|$talk_time_trigger|$called_count_trigger|\n";} } } diff --git a/www/agc/dispo_send_email.php b/www/agc/dispo_send_email.php index 4b060273..c14875f1 100644 --- a/www/agc/dispo_send_email.php +++ b/www/agc/dispo_send_email.php @@ -48,6 +48,7 @@ # 220127-0942 - Added email_header_attach and allow_sendmail_bypass options.php settings # 220213-0849 - Added code for Pause Max Email functionality # 220216-0027 - Fix for very large emails using allow_sendmail_bypass +# 220219-0135 - Added allow_web_debug system setting # $api_script = 'send_email'; @@ -176,6 +177,21 @@ if ($email_header_attach > 0) {$EHA="\n\n";} ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'60002',$user,$server_ip,$session_name,$one_mysql_log);} +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $SSallow_web_debug = $row[3]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} @@ -187,19 +203,6 @@ if ($sl_ct > 0) $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } - -$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'60002',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - } ##### END SETTINGS LOOKUP ##### ########################################### @@ -251,19 +254,31 @@ $email_attachment_18=preg_replace("/etc\//","",$email_attachment_18); $email_attachment_19=preg_replace("/etc\//","",$email_attachment_19); $email_attachment_20=preg_replace("/etc\//","",$email_attachment_20); - -$email_to=preg_replace("/\\\\/","",$email_to); +$email_to = preg_replace('/[^-\.\:\/\@\_0-9\p{L}]/u','',$email_to); +$log_to_file = preg_replace('/[^-_0-9a-zA-Z]/', '', $log_to_file); +$called_count = preg_replace('/[^-_0-9a-zA-Z]/', '', $called_count); +$called_count_trigger = preg_replace('/[^-_0-9a-zA-Z]/', '', $called_count_trigger); if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $container_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $container_id); + $sale_status = preg_replace('/[^-_0-9a-zA-Z]/', '', $sale_status); + $dispo = preg_replace('/[^-_0-9a-zA-Z]/', '', $dispo); + $channel_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $channel_group); } else { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); $container_id = preg_replace('/[^-_0-9\p{L}]/u', '', $container_id); + $sale_status = preg_replace('/[^-_0-9\p{L}]/u', '', $sale_status); + $dispo = preg_replace('/[^-_0-9\p{L}]/u', '', $dispo); + $channel_group = preg_replace('/[^-_0-9\p{L}]/u', '', $channel_group); } + if ($DB>0) {echo "$lead_id|$container_id|$call_id|$sale_status|$dispo|$new_status|$called_count|$called_count_trigger|$user|$pass|$DB|$log_to_file|\n";} if ( (preg_match("/$TD$dispo$TD/",$sale_status)) or (preg_match("/ALL-STATUSES/",$sale_status)) ) diff --git a/www/agc/inbound_popup.php b/www/agc/inbound_popup.php index 961aaad3..117f104d 100644 --- a/www/agc/inbound_popup.php +++ b/www/agc/inbound_popup.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed to open up when a live_inbound call comes in giving the user # options of what to do with the call or options to lookup the callerID on various web sites @@ -40,10 +40,11 @@ # 190111-0905 - Fix for PHP7 # 210616-2106 - Added optional CORS support, see options.php for details # 210825-0906 - Fix for XSS security issue +# 220220-0914 - Added allow_web_debug system setting # -$version = '2.14-16'; -$build = '210825-0906'; +$version = '2.14-17'; +$build = '220220-0914'; $php_script = 'inbound_popup.php'; require_once("dbconnect_mysqli.php"); @@ -80,11 +81,6 @@ if (isset($_GET["local_web_callerID_URL_enc"])) {$local_web_callerID_URL = raw # variable filtering $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); -$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); -$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); -$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten); -$vmail_box = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$vmail_box); # default optional vars if not set if (!isset($format)) {$format="text";} @@ -105,6 +101,21 @@ if (file_exists('options.php')) ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $SSallow_web_debug = $row[3]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} @@ -116,25 +127,32 @@ if ($sl_ct > 0) $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } - -$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - } ##### END SETTINGS LOOKUP ##### ########################################### +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); +$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); +$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten); +$vmail_box = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$vmail_box); +$format = preg_replace('/[^-_0-9a-zA-Z]/','',$format); +$voicemail_dump_exten = preg_replace('/[^-_0-9a-zA-Z]/','',$voicemail_dump_exten); +$local_web_callerID_URL = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$local_web_callerID_URL); +$local_web_callerID_URL_enc = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$local_web_callerID_URL_enc); + if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); + $ext_context=preg_replace("/[^-_0-9a-zA-Z]/","",$ext_context); + $ext_priority=preg_replace("/[^-_0-9a-zA-Z]/","",$ext_priority); + } +else + { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + $ext_context = preg_replace('/[^-_0-9\p{L}]/u','',$ext_context); + $ext_priority = preg_replace('/[^-_0-9\p{L}]/u','',$ext_priority); } $auth=0; diff --git a/www/agc/launch.php b/www/agc/launch.php index ca683a27..fed8b4c8 100644 --- a/www/agc/launch.php +++ b/www/agc/launch.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # For launch validation to work, the options.php file must have # window_validation = 1 and win_valid_name set to window_name below @@ -11,6 +11,7 @@ # 140811-0800 - Changed to use QXZ function for echoing text # 141216-2134 - Added language settings lookups and user/pass variable standardization # 210825-0909 - Fix for XSS security issue +# 220220-0911 - Added allow_web_debug system setting # $window_name = 'subwindow_launch'; @@ -68,6 +69,10 @@ $phone_pass=preg_replace('/[^-_0-9\p{L}]/u',"",$phone_pass); $VD_login=preg_replace('/[^-_0-9\p{L}]/u',"",$VD_login); $VD_pass=preg_replace('/[^-_0-9\p{L}]/u',"",$VD_pass); $VD_campaign = preg_replace('/[^-_0-9\p{L}]/u',"",$VD_campaign); +$JS_browser_width = preg_replace('/[^-_0-9\p{L}]/u',"",$JS_browser_width); +$JS_browser_height = preg_replace('/[^-_0-9\p{L}]/u',"",$JS_browser_height); +$relogin = preg_replace('/[^-_0-9\p{L}]/u',"",$relogin); +$MGR_override = preg_replace('/[^-_0-9\p{L}]/u',"",$MGR_override); $login_string=''; @@ -105,20 +110,8 @@ if (strlen($static_agent_url) > 5) ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### -$VUselected_language = ''; -$stmt="SELECT selected_language from vicidial_users where user='$VD_login';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$VD_login,$server_ip,$session_name,$one_mysql_log);} -$sl_ct = mysqli_num_rows($rslt); -if ($sl_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $VUselected_language = $row[0]; - } - -$stmt = "SELECT use_non_latin,admin_home_url,admin_web_directory,enable_languages,language_method FROM system_settings;"; -if ($DB) {echo "$stmt\n";} +$stmt = "SELECT use_non_latin,admin_home_url,admin_web_directory,enable_languages,language_method,allow_web_debug FROM system_settings;"; +#if ($DB) {echo "$stmt\n";} $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$VD_login,$server_ip,$session_name,$one_mysql_log);} $qm_conf_ct = mysqli_num_rows($rslt); @@ -130,6 +123,20 @@ if ($qm_conf_ct > 0) $admin_web_directory = $row[2]; $SSenable_languages = $row[3]; $SSlanguage_method = $row[4]; + $SSallow_web_debug = $row[5]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + +$VUselected_language = ''; +$stmt="SELECT selected_language from vicidial_users where user='$VD_login';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$VD_login,$server_ip,$session_name,$one_mysql_log);} +$sl_ct = mysqli_num_rows($rslt); +if ($sl_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $VUselected_language = $row[0]; } ##### END SETTINGS LOOKUP ##### ########################################### diff --git a/www/agc/live_exten_check.php b/www/agc/live_exten_check.php index 5a704271..98a7c984 100644 --- a/www/agc/live_exten_check.php +++ b/www/agc/live_exten_check.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed purely to send whether the client channel is live and to what channel it is connected # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table @@ -43,10 +43,11 @@ # 190111-0906 - Fix for PHP7 # 210616-2105 - Added optional CORS support, see options.php for details # 210825-0905 - Fix for XSS security issue +# 220220-0907 - Added allow_web_debug system setting # -$version = '2.14-19'; -$build = '210825-0905'; +$version = '2.14-20'; +$build = '220220-0907'; $php_script = 'live_exten_check.php'; $SSagent_debug_logging=0; $startMS = microtime(); @@ -61,27 +62,22 @@ if (isset($_GET["pass"])) {$pass=$_GET["pass"];} elseif (isset($_POST["pass"])) {$pass=$_POST["pass"];} if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];} elseif (isset($_POST["server_ip"])) {$server_ip=$_POST["server_ip"];} -if (isset($_GET["session_name"])) {$session_name=$_GET["session_name"];} - elseif (isset($_POST["session_name"])) {$session_name=$_POST["session_name"];} +if (isset($_GET["session_name"])) {$session_name=$_GET["session_name"];} + elseif (isset($_POST["session_name"])) {$session_name=$_POST["session_name"];} if (isset($_GET["format"])) {$format=$_GET["format"];} - elseif (isset($_POST["format"])) {$format=$_POST["format"];} + elseif (isset($_POST["format"])) {$format=$_POST["format"];} if (isset($_GET["exten"])) {$exten=$_GET["exten"];} elseif (isset($_POST["exten"])) {$exten=$_POST["exten"];} if (isset($_GET["protocol"])) {$protocol=$_GET["protocol"];} elseif (isset($_POST["protocol"])) {$protocol=$_POST["protocol"];} -if (isset($_GET["favorites_count"])) {$favorites_count=$_GET["favorites_count"];} - elseif (isset($_POST["favorites_count"])) {$favorites_count=$_POST["favorites_count"];} +if (isset($_GET["favorites_count"])) {$favorites_count=$_GET["favorites_count"];} + elseif (isset($_POST["favorites_count"])) {$favorites_count=$_POST["favorites_count"];} if (isset($_GET["favorites_list"])) {$favorites_list=$_GET["favorites_list"];} - elseif (isset($_POST["favorites_list"])) {$favorites_list=$_POST["favorites_list"];} + elseif (isset($_POST["favorites_list"])) {$favorites_list=$_POST["favorites_list"];} # variable filtering $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); -$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); -$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten); -$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol); -$favorites_list = preg_replace("/\'|\"|\\\\|;| /","",$favorites_list); # default optional vars if not set if (!isset($format)) {$format="text";} @@ -100,6 +96,22 @@ if (file_exists('options.php')) ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_languages,language_method,agent_debug_logging,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $SSagent_debug_logging = $row[3]; + $SSallow_web_debug = $row[4]; + } +if ($SSallow_web_debug < 1) {$DB=0; $format="text";} + $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} @@ -111,27 +123,28 @@ if ($sl_ct > 0) $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } - -$stmt = "SELECT use_non_latin,enable_languages,language_method,agent_debug_logging FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - $SSagent_debug_logging = $row[3]; - } ##### END SETTINGS LOOKUP ##### ########################################### +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); +$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten); +$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol); +$favorites_list = preg_replace("/\'|\"|\\\\|;| /","",$favorites_list); +$format = preg_replace('/[^-_0-9a-zA-Z]/','',$format); +$favorites_count = preg_replace('/[^-_0-9a-zA-Z]/','',$favorites_count); + if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); } +else + { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + } + if (strlen($SSagent_debug_logging) > 1) { if ($SSagent_debug_logging == "$user") diff --git a/www/agc/manager_send.php b/www/agc/manager_send.php index a8547394..0239dd97 100644 --- a/www/agc/manager_send.php +++ b/www/agc/manager_send.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed purely to insert records into the vicidial_manager table to signal Actions to an asterisk server # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table @@ -149,10 +149,11 @@ # 210616-2051 - Added optional CORS support, see options.php for details # 210823-0916 - Fix for security issue # 210825-0911 - Fix for XSS security issue +# 220220-0904 - Added allow_web_debug system setting # -$version = '2.14-96'; -$build = '210825-0911'; +$version = '2.14-97'; +$build = '220220-0904'; $php_script = 'manager_send.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=143; @@ -268,12 +269,16 @@ if (file_exists('options.php')) require_once('options.php'); } +$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); +$user=preg_replace("/\'|\"|\\\\|;| /","",$user); +$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); + ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,allow_sipsak_messages,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,agent_debug_logging FROM system_settings;"; +$stmt = "SELECT use_non_latin,allow_sipsak_messages,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,agent_debug_logging,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'02001',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -285,7 +290,9 @@ if ($qm_conf_ct > 0) $meetme_enter_login_filename = $row[4]; $meetme_enter_leave3way_filename = $row[5]; $SSagent_debug_logging = $row[6]; + $SSallow_web_debug = $row[7]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -294,8 +301,6 @@ header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 header ("Pragma: no-cache"); // HTTP/1.0 # filter variables -$user=preg_replace("/\'|\"|\\\\|;| /","",$user); -$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); $session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); $server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $lead_id = preg_replace('/[^0-9]/','',$lead_id); @@ -332,10 +337,14 @@ $queryCID = preg_replace("/\'|\"|\\\\|;/","",$queryCID); $secondS = preg_replace('/[^0-9]/','',$secondS); $stage = preg_replace("/\'|\"|\\\\|;/","",$stage); $usegroupalias = preg_replace('/[^0-9]/','',$usegroupalias); +$phone_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$phone_ip); +$allow_sipsak_messages = preg_replace('/[^-_0-9a-zA-Z]/','',$allow_sipsak_messages); +$alertCID = preg_replace('/[^-_0-9a-zA-Z]/','',$alertCID); if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign); $phone_number = preg_replace('/[^-_0-9a-zA-Z]/','',$phone_number); $uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); @@ -347,6 +356,8 @@ if ($non_latin < 1) } else { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); $campaign = preg_replace('/[^-_0-9\p{L}]/u','',$campaign); $phone_number = preg_replace('/[^-_0-9\p{L}]/u','',$phone_number); $uniqueid = preg_replace('/[^-_\.0-9\p{L}]/u','',$uniqueid); diff --git a/www/agc/park_calls_display.php b/www/agc/park_calls_display.php index 7023aacc..97f4289f 100644 --- a/www/agc/park_calls_display.php +++ b/www/agc/park_calls_display.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed purely to send the details on the parked calls on the server # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table @@ -34,10 +34,11 @@ # 190111-0907 - Fix for PHP7 # 210616-2104 - Added optional CORS support, see options.php for details # 210825-0904 - Fix for XSS security issue +# 220220-0902 - Added allow_web_debug system setting # -$version = '2.14-16'; -$build = '210825-0904'; +$version = '2.14-17'; +$build = '220220-0902'; $php_script = 'park_calls_display.php'; $SSagent_debug_logging=0; $startMS = microtime(); @@ -64,10 +65,6 @@ if (isset($_GET["protocol"])) {$protocol=$_GET["protocol"];} # variable filtering $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); -$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); -$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten); -$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol); # default optional vars if not set if (!isset($format)) {$format="text";} @@ -87,6 +84,22 @@ if (file_exists('options.php')) ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_languages,language_method,agent_debug_logging,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $SSagent_debug_logging = $row[3]; + $SSallow_web_debug = $row[4]; + } +if ($SSallow_web_debug < 1) {$DB=0; $format="text";} + $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} @@ -98,27 +111,26 @@ if ($sl_ct > 0) $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } - -$stmt = "SELECT use_non_latin,enable_languages,language_method,agent_debug_logging FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - $SSagent_debug_logging = $row[3]; - } ##### END SETTINGS LOOKUP ##### ########################################### +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); +$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten); +$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol); +$format = preg_replace('/[^-_0-9a-zA-Z]/','',$format); + if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); } +else + { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + } + if (strlen($SSagent_debug_logging) > 1) { if ($SSagent_debug_logging == "$user") diff --git a/www/agc/phone_only.php b/www/agc/phone_only.php index 50a66851..e02e9926 100644 --- a/www/agc/phone_only.php +++ b/www/agc/phone_only.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGELOG # 110511-1336 - First Build @@ -21,10 +21,11 @@ # 200123-1639 - Added Webphone options # 210615-1028 - Default security fixes, CVE-2021-28854 # 210616-2043 - Added optional CORS support, see options.php for details +# 220220-0936 - Added allow_web_debug system setting # -$version = '2.14-17p'; -$build = '210616-2043'; +$version = '2.14-18p'; +$build = '220220-0936'; $php_script = 'phone_only.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=74; @@ -67,6 +68,7 @@ $phone_login=preg_replace("/[^\,0-9a-zA-Z]/","",$phone_login); $phone_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$phone_pass); $VD_login=preg_replace("/\'|\"|\\\\|;| /","",$VD_login); $VD_pass=preg_replace("/\'|\"|\\\\|;| /","",$VD_pass); +$relogin=preg_replace("/[^-_0-9a-zA-Z]/","",$relogin); $forever_stop=0; @@ -95,22 +97,10 @@ $random = (rand(1000000, 9999999) + 10000000); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### -$VUselected_language = ''; -$stmt="SELECT selected_language from vicidial_users where user='$VD_login';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'09074',$VD_login,$server_ip,$session_name,$one_mysql_log);} -$sl_ct = mysqli_num_rows($rslt); -if ($sl_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $VUselected_language = $row[0]; - } - -$stmt = "SELECT use_non_latin,vdc_header_date_format,vdc_customer_date_format,vdc_header_phone_format,webroot_writable,timeclock_end_of_day,vtiger_url,enable_vtiger_integration,outbound_autodial_active,enable_second_webform,user_territories_active,static_agent_url,custom_fields_enabled,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,vdc_header_date_format,vdc_customer_date_format,vdc_header_phone_format,webroot_writable,timeclock_end_of_day,vtiger_url,enable_vtiger_integration,outbound_autodial_active,enable_second_webform,user_territories_active,static_agent_url,custom_fields_enabled,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'09001',$VD_login,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -130,6 +120,20 @@ if ($qm_conf_ct > 0) $custom_fields_enabled = $row[12]; $SSenable_languages = $row[13]; $SSlanguage_method = $row[14]; + $SSallow_web_debug = $row[15]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + +$VUselected_language = ''; +$stmt="SELECT selected_language from vicidial_users where user='$VD_login';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'09074',$VD_login,$server_ip,$session_name,$one_mysql_log);} +$sl_ct = mysqli_num_rows($rslt); +if ($sl_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $VUselected_language = $row[0]; } ##### END SETTINGS LOOKUP ##### ########################################### @@ -139,6 +143,11 @@ if ($non_latin < 1) $VD_login=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_login); $VD_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_pass); } +else + { + $VD_login = preg_replace('/[^-_0-9\p{L}]/u','',$VD_login); + $VD_pass = preg_replace('/[^-_0-9\p{L}]/u','',$VD_pass); + } ##### DEFINABLE SETTINGS AND OPTIONS diff --git a/www/agc/timeclock.php b/www/agc/timeclock.php index b827118f..a87a3d96 100644 --- a/www/agc/timeclock.php +++ b/www/agc/timeclock.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGELOG # 80523-0134 - First Build @@ -25,10 +25,11 @@ # 190111-0901 - Fix for PHP7 # 201117-2117 - Changes for better compatibility with non-latin data input # 210616-2101 - Added optional CORS support, see options.php for details +# 220220-0934 - Added allow_web_debug system setting # -$version = '2.14-20'; -$build = '210616-2101'; +$version = '2.14-21'; +$build = '220220-0934'; $php_script = 'timeclock.php'; $StarTtimE = date("U"); @@ -92,6 +93,8 @@ if (!isset($phone_pass)) $DB=preg_replace("/[^0-9a-z]/","",$DB); $VD_login=preg_replace("/\'|\"|\\\\|;| /","",$VD_login); $VD_pass=preg_replace("/\'|\"|\\\\|;| /","",$VD_pass); +$user=preg_replace("/\'|\"|\\\\|;| /","",$user); +$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); require_once("dbconnect_mysqli.php"); require_once("functions.php"); @@ -105,21 +108,8 @@ if (file_exists('options.php')) ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### -$VUselected_language = ''; -$stmt="SELECT user,selected_language from vicidial_users where user='$VD_login';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$VD_login,$server_ip,$session_name,$one_mysql_log);} -$sl_ct = mysqli_num_rows($rslt); -if ($sl_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $VUuser = $row[0]; - $VUselected_language = $row[1]; - } - -$stmt = "SELECT use_non_latin,admin_home_url,admin_web_directory,enable_languages,language_method,default_language,agent_screen_colors,agent_script FROM system_settings;"; -if ($DB) {echo "$stmt\n";} +$stmt = "SELECT use_non_latin,admin_home_url,admin_web_directory,enable_languages,language_method,default_language,agent_screen_colors,agent_script,allow_web_debug FROM system_settings;"; +#if ($DB) {echo "$stmt\n";} $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$VD_login,$server_ip,$session_name,$one_mysql_log);} $qm_conf_ct = mysqli_num_rows($rslt); @@ -134,6 +124,21 @@ if ($qm_conf_ct > 0) $SSdefault_language = $row[5]; $agent_screen_colors = $row[6]; $SSagent_script = $row[7]; + $SSallow_web_debug = $row[8]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + +$VUselected_language = ''; +$stmt="SELECT user,selected_language from vicidial_users where user='$VD_login';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$VD_login,$server_ip,$session_name,$one_mysql_log);} +$sl_ct = mysqli_num_rows($rslt); +if ($sl_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $VUuser = $row[0]; + $VUselected_language = $row[1]; } if (strlen($VUselected_language) < 1) @@ -152,7 +157,7 @@ $referrer=preg_replace("/[^0-9a-zA-Z]/","",$referrer); if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); - $pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $VD_login=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_login); $VD_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_pass); $VD_campaign=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_campaign); @@ -161,7 +166,13 @@ if ($non_latin < 1) } else { + $user=preg_replace("/[^-_0-9\p{L}]/u","",$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + $VD_login=preg_replace("/[^-_0-9\p{L}]/u","",$VD_login); + $VD_pass=preg_replace("/[^-_0-9\p{L}]/u","",$VD_pass); $VD_campaign=preg_replace("/[^-_0-9\p{L}]/u","",$VD_campaign); + $phone_login=preg_replace("/[^\,0-9\p{L}]/u","",$phone_login); + $phone_pass=preg_replace("/[^-_0-9\p{L}]/u","",$phone_pass); } header ("Content-type: text/html; charset=utf-8"); diff --git a/www/agc/update_cf_ivr.php b/www/agc/update_cf_ivr.php index ed39c8f2..a63fac3c 100644 --- a/www/agc/update_cf_ivr.php +++ b/www/agc/update_cf_ivr.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is part of the API group and any modifications of data are # logged to the vicidial_api_log table. @@ -13,6 +13,7 @@ # 170526-2319 - Added additional variable filtering # 210615-1030 - Default security fixes, CVE-2021-28854 # 210616-2041 - Added optional CORS support, see options.php for details +# 220219-2238 - Added allow_web_debug system setting # $api_script = 'update_cf_ivr'; @@ -62,14 +63,25 @@ $k=0; # filter variables $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$caller_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $caller_id); -$lead_id = preg_replace('/[^_0-9]/', '', $lead_id); -$list_id = preg_replace('/[^_0-9]/', '', $list_id); -$field = preg_replace('/[^-_0-9a-zA-Z]/', '', $field); -$value = preg_replace("/\'|\"|\\\\|;| /","",$value); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_languages,language_method,active_modules,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'02001',$user,$server_ip,$session_name,$one_mysql_log);} +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $active_modules = $row[3]; + $SSallow_web_debug = $row[4]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; if ($DB) {echo "|$stmt|\n";} @@ -81,26 +93,25 @@ if ($sl_ct > 0) $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } - -$stmt = "SELECT use_non_latin,enable_languages,language_method,active_modules FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'02001',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - $active_modules = $row[3]; - } ##### END SETTINGS LOOKUP ##### ########################################### +$caller_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $caller_id); +$lead_id = preg_replace('/[^_0-9]/', '', $lead_id); +$list_id = preg_replace('/[^_0-9]/', '', $list_id); +$field = preg_replace('/[^-_0-9a-zA-Z]/', '', $field); +$value = preg_replace("/\'|\"|\\\\|;| /","",$value); +$log_to_file = preg_replace('/[^-_0-9a-zA-Z]/', '', $log_to_file); + if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); + } +else + { + $user=preg_replace("/[^-_0-9\p{L}]/u","",$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); } # if options file exists, use the override values for the above variables diff --git a/www/agc/vdc_chat_display.php b/www/agc/vdc_chat_display.php index 8dca9739..ef9e9fb4 100644 --- a/www/agc/vdc_chat_display.php +++ b/www/agc/vdc_chat_display.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Joe Johnson, Matt Florell LICENSE: AGPLv2 # # This is the interface for agents to chat with customers and each other. It's separate from the manager-to-agent # chat interface out of necessity and calls the chat_db_query.php page to send information and display it. It will @@ -20,6 +20,7 @@ # 190902-0914 - Fix for PHP 7.2 # 201117-2207 - Changes for better compatibility with non-latin data input # 210616-2040 - Added optional CORS support, see options.php for details +# 220220-0928 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -68,13 +69,17 @@ if (isset($_GET["stage"])) {$stage=$_GET["stage"];} $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); +$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); +$user=preg_replace("/\'|\"|\\\\|;| /","",$user); +$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); + ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $VUselected_language = ''; -$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,allow_chats FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,allow_chats,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -84,8 +89,10 @@ if ($qm_conf_ct > 0) $SSlanguage_method = $row[2]; $SSdefault_language = $row[3]; $SSallow_chats = $row[4]; + $SSallow_web_debug = $row[5]; } $VUselected_language = $SSdefault_language; +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -110,14 +117,14 @@ $dial_method = preg_replace('/[^-\_0-9a-zA-Z]/','',$dial_method); $clickmute = preg_replace("/\'|\"|\\\\|;/","",$clickmute); $stage = preg_replace('/[^-\_0-9a-zA-Z]/','',$stage); $email_invite_lead_id = preg_replace("/\'|\"|\\\\|;/","",$email_invite_lead_id); +$child_window = preg_replace('/[^-\_0-9a-zA-Z]/','',$child_window); +$chat_group_ids = preg_replace("/\"|\\\\|;/","",$chat_group_ids); if ($non_latin < 1) { $user = preg_replace('/[^-\_0-9a-zA-Z]/','',$user); - $pass = preg_replace('/[^-\_0-9a-zA-Z]/','',$pass); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $outside_user_name = preg_replace('/[^- \_\.0-9a-zA-Z]/','',$user); - $chat_creator = preg_replace('/[^- \_0-9a-zA-Z]/','',$chat_creator); - $phone_number = preg_replace("/[^0-9]/","",$phone_number); $first_name = preg_replace('/[^- \_\.0-9a-zA-Z]/','',$first_name); $last_name = preg_replace('/[^- \_\.0-9a-zA-Z]/','',$last_name); $campaign = preg_replace('/[^-\_0-9a-zA-Z]/','',$campaign); @@ -125,8 +132,8 @@ if ($non_latin < 1) } else { - $user = preg_replace("/\'|\"|\\\\|;/","",$user); - $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); $outside_user_name = preg_replace("/\'|\"|\\\\|;/","",$user); $first_name = preg_replace('/[^- \_\.0-9\p{L}]/u','',$first_name); $last_name = preg_replace('/[^- \_\.0-9\p{L}]/u','',$last_name); diff --git a/www/agc/vdc_db_query.php b/www/agc/vdc_db_query.php index 538d5f4d..168fef1b 100644 --- a/www/agc/vdc_db_query.php +++ b/www/agc/vdc_db_query.php @@ -522,10 +522,11 @@ # 211117-2033 - Added ALT Dispo Call URL url_call_length setting # 220119-1014 - Added auto_alt_threshold feature # 220212-0919 - Added pause_max_url_trigger input +# 220219-0134 - Added allow_web_debug system setting # -$version = '2.14-415'; -$build = '220212-0919'; +$version = '2.14-416'; +$build = '220219-0134'; $php_script = 'vdc_db_query.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=876; @@ -844,6 +845,8 @@ if (isset($_GET["pause_max_url_trigger"])) {$pause_max_url_trigger=$_GET["paus elseif (isset($_POST["pause_max_url_trigger"])) {$pause_max_url_trigger=$_POST["pause_max_url_trigger"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); +$user=preg_replace("/\'|\"|\\\\|;| /","",$user); +$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); # if options file exists, use the override values for the above variables # see the options-example.php file for more information @@ -869,6 +872,12 @@ $US='_'; while (strlen($CIDdate) > 9) {$CIDdate = substr("$CIDdate", 1);} $check_time = ($StarTtime - 86400); +# default optional vars if not set +if (!isset($format)) {$format="text";} + if ($format == 'debug') {$DB=1;} +if (!isset($ACTION)) {$ACTION="refresh";} +if (!isset($query_date)) {$query_date = $NOW_DATE;} + $secX = date("U"); $epoch = $secX; $hour = date("H"); @@ -1032,10 +1041,10 @@ $sip_hangup_cause_dictionary = array( ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,qc_features_active,allow_emails,callback_time_24hour,enable_languages,language_method,agent_debug_logging,default_language,active_modules,allow_chats,default_phone_code,user_new_lead_limit,sip_event_logging,call_quota_lead_ranking,daily_call_count_limit,call_limit_24hour FROM system_settings;"; +$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,qc_features_active,allow_emails,callback_time_24hour,enable_languages,language_method,agent_debug_logging,default_language,active_modules,allow_chats,default_phone_code,user_new_lead_limit,sip_event_logging,call_quota_lead_ranking,daily_call_count_limit,call_limit_24hour,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00001',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -1063,7 +1072,9 @@ if ($qm_conf_ct > 0) $SScall_quota_lead_ranking = $row[20]; $SSdaily_call_count_limit = $row[21]; $SScall_limit_24hour = $row[22]; + $SSallow_web_debug = $row[23]; } +if ($SSallow_web_debug < 1) {$DB=0; $format='text';} ##### END SETTINGS LOOKUP ##### ########################################### @@ -1164,11 +1175,42 @@ $leave_3way_start_recording_trigger = preg_replace('/[^0-9]/','',$leave_3way_sta $leave_3way_start_recording_filename = preg_replace('/[^-_0-9a-zA-Z]/','',$leave_3way_start_recording_filename); $channelrec = preg_replace("/\'|\"|\\\\|;/","",$channelrec); $pause_max_url_trigger = preg_replace('/[^0-9]/','',$pause_max_url_trigger); +$ACTION = preg_replace('/[^-_0-9a-zA-Z]/','',$ACTION); +$vendor_lead_code = preg_replace("/\"|\\\\|;/",'-',$vendor_lead_code); +$title = preg_replace("/\"|\\\\|;/",'-',$title); +$first_name = preg_replace("/\"|\\\\|;/",'-',$first_name); +$middle_initial = preg_replace("/\"|\\\\|;/",'-',$middle_initial); +$last_name = preg_replace("/\"|\\\\|;/",'-',$last_name); +$address1 = preg_replace("/\"|\\\\|;/",'-',$address1); +$address2 = preg_replace("/\"|\\\\|;/",'-',$address2); +$address3 = preg_replace("/\"|\\\\|;/",'-',$address3); +$city = preg_replace("/\"|\\\\|;/",'-',$city); +$state = preg_replace("/\"|\\\\|;/",'-',$state); +$province = preg_replace("/\"|\\\\|;/",'-',$province); +$postal_code = preg_replace("/\"|\\\\|;/",'-',$postal_code); +$country_code = preg_replace("/\"|\\\\|;/",'-',$country_code); +$date_of_birth = preg_replace("/\'|\"|\\\\|;/",'-',$date_of_birth); +$email = preg_replace("/\"|\\\\|;/",'-',$email); +$security_phrase = preg_replace("/\"|\\\\|;/",'-',$security_phrase); +$comments = preg_replace("/\"|\\\\|;/",'-',$comments); +$phone_ip = preg_replace("/\'|\"|\\\\|;/","",$phone_ip); +$FORMcustom_field_names = preg_replace("/\'|\"|\\\\|;/",'-',$FORMcustom_field_names); + +# input variables that are encoded or escaped or filtered in their only function: +# $call_notes +# $dispo_comments +# $cbcomment_comments +# $bu_name +# $department +# $job_title +# $location +# $inbound_email_groups +# $inbound_chat_groups if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); - $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $orig_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$orig_pass); $phone_code = preg_replace("/[^0-9a-zA-Z]/","",$phone_code); $phone_number = preg_replace("/[^0-9a-zA-Z]/","",$phone_number); @@ -1198,9 +1240,9 @@ if ($non_latin < 1) } else { - $user = preg_replace("/\'|\"|\\\\|;/","",$user); - $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); - $orig_pass = preg_replace("/\'|\"|\\\\|;/","",$orig_pass); + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + $orig_pass = preg_replace('/[^-_0-9\p{L}]/u','',$orig_pass); $status = preg_replace("/\'|\"|\\\\|;/","",$status); $MgrApr_user = preg_replace("/\'|\"|\\\\|;/","",$MgrApr_user); $MgrApr_pass = preg_replace("/\'|\"|\\\\|;/","",$MgrApr_pass); @@ -1227,11 +1269,6 @@ else } -# default optional vars if not set -if (!isset($format)) {$format="text";} - if ($format == 'debug') {$DB=1;} -if (!isset($ACTION)) {$ACTION="refresh";} -if (!isset($query_date)) {$query_date = $NOW_DATE;} if (strlen($SSagent_debug_logging) > 1) { if ($SSagent_debug_logging == "$user") @@ -16235,7 +16272,6 @@ if ($ACTION == 'userLOGout') if ( ($enable_sipsak_messages > 0) and ($allow_sipsak_messages > 0) and (preg_match("/SIP/i",$protocol)) ) { $extension = preg_replace("/\'|\"|\\\\|;/","",$extension); - $phone_ip = preg_replace("/\'|\"|\\\\|;/","",$phone_ip); $SIPSAK_message = 'LOGGED OUT'; passthru("/usr/local/bin/sipsak -M -O desktop -B \"$SIPSAK_message\" -r 5060 -s sip:$extension@$phone_ip > /dev/null"); } @@ -16619,7 +16655,6 @@ if ($ACTION == 'PauseCodeSubmit') if ( ($enable_sipsak_messages > 0) and ($allow_sipsak_messages > 0) and (preg_match("/SIP/i",$protocol)) ) { $extension = preg_replace("/\'|\"|\\\\|;/","",$extension); - $phone_ip = preg_replace("/\'|\"|\\\\|;/","",$phone_ip); $SIPSAK_prefix = 'BK-'; passthru("/usr/local/bin/sipsak -M -O desktop -B \"$SIPSAK_prefix$status\" -r 5060 -s sip:$extension@$phone_ip > /dev/null"); } diff --git a/www/agc/vdc_email_display.php b/www/agc/vdc_email_display.php index 53fe076d..c64cf2fc 100644 --- a/www/agc/vdc_email_display.php +++ b/www/agc/vdc_email_display.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell, Joe Johnson LICENSE: AGPLv2 # # This page displays any incoming emails in the Vicidial user interface. It # also allows the user to download and view any attachments sent in the email, @@ -24,10 +24,11 @@ # 170526-2330 - Added additional variable filtering # 171126-1406 - Added fault tolerance and extra debug # 210616-2038 - Added optional CORS support, see options.php for details +# 220219-1839 - More security changes # -$version = '2.14-14'; -$build = '210616-2038'; +$version = '2.14-15'; +$build = '220219-1839'; $php_script = 'vdc_email_display.php'; require_once("dbconnect_mysqli.php"); @@ -117,27 +118,21 @@ if (strlen($bgcolor) < 6) {$bgcolor='FFFFFF';} $IFRAME=0; +# default optional vars if not set +if (!isset($format)) {$format="text";} + if ($format == 'debug') {$DB=1;} +if (!isset($ACTION)) {$ACTION="refresh";} +if (!isset($query_date)) {$query_date = $NOW_DATE;} + $user = preg_replace("/\'|\"|\\\\|;| /","",$user); $pass = preg_replace("/\'|\"|\\\\|;| /","",$pass); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### -$VUselected_language = ''; -$stmt="SELECT selected_language from vicidial_users where user='$user';"; -if ($DB) {echo "|$stmt|\n";} +$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,custom_fields_enabled,allow_emails,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -$sl_ct = mysqli_num_rows($rslt); -if ($sl_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $VUselected_language = $row[0]; - } - -$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,custom_fields_enabled,allow_emails,enable_languages,language_method FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -149,6 +144,20 @@ if ($qm_conf_ct > 0) $allow_emails = $row[4]; $SSenable_languages = $row[5]; $SSlanguage_method = $row[6]; + $SSallow_web_debug = $row[7]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + +$VUselected_language = ''; +$stmt="SELECT selected_language from vicidial_users where user='$user';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} +$sl_ct = mysqli_num_rows($rslt); +if ($sl_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $VUselected_language = $row[0]; } ##### END SETTINGS LOOKUP ##### ########################################### @@ -159,26 +168,36 @@ if ($allow_emails<1) exit; } -$campaign = preg_replace("/\'|\"|\\\\|;/","",$campaign); +$campaign = preg_replace('/[^-_0-9\p{L}]/u',"",$campaign); $attachment_id = preg_replace("/[^0-9]/","",$attachment_id); $lead_id = preg_replace('/[^0-9]/','',$lead_id); $email_row_id = preg_replace('/[^0-9]/','',$email_row_id); $reply_to_address = preg_replace("/\'|\"|\\\\|;/","",$reply_to_address); +$reply_to_address = preg_replace('/[^-\.\:\/\@\_0-9\p{L}]/u','',$reply_to_address); +$stage = preg_replace('/[^-_0-9\p{L}]/u','',$stage); +$sender_email = preg_replace('/[^-\.\:\/\@\_0-9\p{L}]/u','',$sender_email); +$reply_subject = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$reply_subject); +$reply_from_address = preg_replace('/[^-\.\:\/\@\_0-9\p{L}]/u','',$reply_from_address); +$agent_email = preg_replace('/[^-\.\:\/\@\_0-9\p{L}]/u','',$agent_email); +$REPLY=preg_replace("/[^-_0-9a-zA-Z]/","",$REPLY); + +# filtered +# $reply_message if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); + } +else + { + $user=preg_replace("/[^-_0-9\p{L}]/u","",$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); } -# default optional vars if not set -if (!isset($format)) {$format="text";} - if ($format == 'debug') {$DB=1;} -if (!isset($ACTION)) {$ACTION="refresh";} -if (!isset($query_date)) {$query_date = $NOW_DATE;} - $auth=0; -$auth_message = user_authorization($user,$pass,'',0,0,0,0,'vdc_email_display'); +$auth_message = user_authorization($user,$pass,'',0,1,0,0,'vdc_email_display'); if ($auth_message == 'GOOD') {$auth=1;} @@ -418,6 +437,6 @@ if ( ($lead_id) or (strlen($email_row_id)>0) ) diff --git a/www/agc/vdc_form_display.php b/www/agc/vdc_form_display.php index 9252edd5..5b8489ab 100644 --- a/www/agc/vdc_form_display.php +++ b/www/agc/vdc_form_display.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed display the contents of the FORM tab in the agent # interface, as well as take submission of the form submission when the agent @@ -280,6 +280,12 @@ $vdcURL = $vdcPAGE . '?' . $query_string; $vicidial_list_fields = '|lead_id|entry_date|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|'; +# default optional vars if not set +if (!isset($format)) {$format="text";} + if ($format == 'debug') {$DB=1;} +if (!isset($ACTION)) {$ACTION="custom_form_frame";} +if (!isset($query_date)) {$query_date = $NOW_DATE;} + $IFRAME=0; $SUBMIT_only=0; @@ -288,22 +294,10 @@ $pass = preg_replace("/\'|\"|\\\\|;| /","",$pass); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### -$VUselected_language = ''; -$stmt="SELECT selected_language from vicidial_users where user='$user';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'06002',$user,$server_ip,$session_name,$one_mysql_log);} -$sl_ct = mysqli_num_rows($rslt); -if ($sl_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $VUselected_language = $row[0]; - } - -$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,custom_fields_enabled,enable_languages,language_method,agent_debug_logging FROM system_settings;"; +$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,custom_fields_enabled,enable_languages,language_method,agent_debug_logging,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'06005',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -315,44 +309,146 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $SSagent_debug_logging = $row[6]; + $SSallow_web_debug = $row[7]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + +$VUselected_language = ''; +$stmt="SELECT selected_language from vicidial_users where user='$user';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'06002',$user,$server_ip,$session_name,$one_mysql_log);} +$sl_ct = mysqli_num_rows($rslt); +if ($sl_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $VUselected_language = $row[0]; } ##### END SETTINGS LOOKUP ##### ########################################### -$length_in_sec = preg_replace("/[^0-9]/","",$length_in_sec); -$phone_code = preg_replace("/[^0-9]/","",$phone_code); -$phone_number = preg_replace("/[^0-9]/","",$phone_number); +$agent_email = preg_replace("/\<|\>|\"|\\\\|;/",'-',$agent_email); +$agent_log_id = preg_replace("/\<|\>|\"|\\\\|;/",'-',$agent_log_id); +$agent_log_id = preg_replace('/[^0-9]/', '', $agent_log_id); +$button_action = preg_replace('/[^-_0-9a-zA-Z]/','',$button_action); +$call_id = preg_replace('/[^-_\.0-9a-zA-Z]/','',$call_id); +$called_count = preg_replace("/\<|\>|\"|\\\\|;/",'-',$called_count); +$camp_script = preg_replace("/\<|\>|\"|\\\\|;/",'-',$camp_script); +$channel_group = preg_replace("/\<|\>|\"|\\\\|;/",'-',$channel_group); +$closecallid = preg_replace("/[^-_0-9a-zA-Z]/",'-',$closecallid); +$closer = preg_replace("/\<|\>|\"|\\\\|;/",'-',$closer); +$customer_server_ip = preg_replace("/\<|\>|\"|\\\\|;/",'-',$customer_server_ip); +$customer_zap_channel = preg_replace("/\<|\>|\"|\\\\|;/",'-',$customer_zap_channel); +$DB = preg_replace("/\"|\\\\|;/",'-',$DB); +$dialed_label = preg_replace("/\<|\>|\"|\\\\|;/",'-',$dialed_label); +$dialed_number = preg_replace("/\<|\>|\"|\\\\|;/",'-',$dialed_number); +$did_custom_five = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_custom_five ); +$did_custom_four = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_custom_four); +$did_custom_one = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_custom_one); +$did_custom_three = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_custom_three); +$did_custom_two = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_custom_two); +$did_description = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_description); +$did_extension = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_extension); +$did_id = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_id); +$did_pattern = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_pattern); +$epoch = preg_replace("/\<|\>|\"|\\\\|;/",'-',$epoch); +$fronter = preg_replace("/\<|\>|\"|\\\\|;/",'-',$fronter); +$fullname = preg_replace("/\<|\>|\"|\\\\|;/",'-',$fullname); +$in_script = preg_replace("/\<|\>|\"|\\\\|;/",'-',$in_script); $lead_id = preg_replace('/[^0-9]/', '', $lead_id); $list_id = preg_replace('/[^0-9]/', '', $list_id); $new_list_id = preg_replace('/[^0-9]/', '', $new_list_id); -$agent_log_id = preg_replace('/[^0-9]/', '', $agent_log_id); +$only_field = preg_replace('/[^-_0-9a-zA-Z]/','',$only_field); +$original_phone_login = preg_replace("/\<|\>|\"|\\\\|;/",'-',$original_phone_login); +$parked_by = preg_replace("/\<|\>|\"|\\\\|;/",'-',$parked_by); +$pass = preg_replace("/\<|\>|\"|\\\\|;/",'-',$pass); +$phone = preg_replace("/\<|\>|\"|\\\\|;/",'-',$phone); +$phone_login = preg_replace("/\<|\>|\"|\\\\|;/",'-',$phone_login); +$phone_pass = preg_replace("/\<|\>|\"|\\\\|;/",'-',$phone_pass); +$preset_dtmf_a = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_dtmf_a); +$preset_dtmf_b = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_dtmf_b); +$preset_number_a = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_a); +$preset_number_b = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_b); +$preset_number_c = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_c); +$preset_number_d = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_d); +$preset_number_e = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_e); +$preset_number_f = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_f); +$recording_filename = preg_replace("/\<|\>|\"|\\\\|;/",'-',$recording_filename); +$recording_id = preg_replace("/\<|\>|\"|\\\\|;/",'-',$recording_id); +$script_height = preg_replace("/\<|\>|\"|\\\\|;/",'-',$script_height); +$script_width = preg_replace("/\<|\>|\"|\\\\|;/",'-',$script_width); $server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $session_id = preg_replace('/[^0-9]/','',$session_id); -$call_id = preg_replace('/[^-_\.0-9a-zA-Z]/','',$call_id); -$button_action = preg_replace('/[^-_0-9a-zA-Z]/','',$button_action); -$only_field = preg_replace('/[^-_0-9a-zA-Z]/','',$only_field); +$SIPexten = preg_replace("/\<|\>|\"|\\\\|;/",'-',$SIPexten); $source_field = preg_replace('/[^-_0-9a-zA-Z]/','',$source_field); $source_field_value = preg_replace("/\'|\"|\\\\|;/",'',$source_field_value); +$SQLdate = preg_replace("/\<|\>|\"|\\\\|;/",'-',$SQLdate); +$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); +$user_custom_five = preg_replace("/\"|\\\\|;/",'-',$user_custom_five); +$user_custom_four = preg_replace("/\"|\\\\|;/",'-',$user_custom_four); +$user_custom_one = preg_replace("/\"|\\\\|;/",'-',$user_custom_one); +$user_custom_three = preg_replace("/\"|\\\\|;/",'-',$user_custom_three); +$user_custom_two = preg_replace("/\"|\\\\|;/",'-',$user_custom_two); +$user_group = preg_replace("/\<|\>|\"|\\\\|;/",'-',$user_group); +$web_vars = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$web_vars); +$xfercallid = preg_replace("/\<|\>|\"|\\\\|;/",'-',$xfercallid); +$stage = preg_replace('/[^-_\.0-9a-zA-Z]/','',$stage); +$submit_button = preg_replace('/[^-_0-9a-zA-Z]/','',$submit_button); +$admin_submit = preg_replace('/[^-_0-9a-zA-Z]/','',$admin_submit); +$bgcolor = preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$bgcolor); +$bcrypt = preg_replace('/[^-_0-9a-zA-Z]/','',$bcrypt); +$hide_gender = preg_replace('/[^-_0-9a-zA-Z]/','',$hide_gender); +$orig_URL = preg_replace("/\<|\>|\"|\\\\|;/",'-',$orig_URL); if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); $campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign); - $user_group = preg_replace('/[^-_0-9a-zA-Z]/','',$user_group); + $group = preg_replace('/[^-_0-9a-zA-Z]/','',$group); + $agent_email = preg_replace("/[^-\.\:\/\@\_0-9a-zA-Z]/",'-',$agent_email); + $did_id = preg_replace("/[^-_0-9a-zA-Z]/",'-',$did_id); + $did_extension = preg_replace("/[^-_0-9a-zA-Z]/",'-',$did_extension); + $did_pattern = preg_replace("/[^:\+\*\#\.\_0-9a-zA-Z]/",'-',$did_pattern); + $did_description = preg_replace("/[^- \.\,\_0-9a-zA-Z]/",'-',$did_description); + $xfercallid = preg_replace("/[^-_0-9a-zA-Z]/",'-',$xfercallid); + $agent_log_id = preg_replace("/[^-_0-9a-zA-Z]/",'-',$agent_log_id); + $user_group = preg_replace("/[^-_0-9a-zA-Z]/",'-',$user_group); + $called_count = preg_replace("/[^-_0-9a-zA-Z]/",'-',$called_count); + $did_custom_one = preg_replace('/[^- \.\:\/\@\_0-9a-zA-Z]/','-',$did_custom_one); + $did_custom_two = preg_replace('/[^- \.\:\/\@\_0-9a-zA-Z]/','-',$did_custom_two); + $did_custom_three = preg_replace('/[^- \.\:\/\@\_0-9a-zA-Z]/','-',$did_custom_three); + $did_custom_four = preg_replace('/[^- \.\:\/\@\_0-9a-zA-Z]/','-',$did_custom_four); + $did_custom_five = preg_replace('/[^- \.\:\/\@\_0-9a-zA-Z]/','-',$did_custom_five ); + $list_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$list_name); + $list_description = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$list_description); } else { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); $uniqueid = preg_replace('/[^-_\.0-9\p{L}]/u','',$uniqueid); $campaign = preg_replace('/[^-_0-9\p{L}]/u','',$campaign); - $user_group = preg_replace('/[^-_0-9\p{L}]/u','',$user_group); + $group = preg_replace('/[^-_0-9\p{L}]/u','',$group); + $agent_email = preg_replace("/[^-\.\:\/\@\_0-9\p{L}]/u",'-',$agent_email); + $did_id = preg_replace("/[^-_0-9\p{L}]/u",'-',$did_id); + $did_extension = preg_replace("/[^-_0-9\p{L}]/u",'-',$did_extension); + $did_pattern = preg_replace("/[^:\+\*\#\.\_0-9\p{L}]/u",'-',$did_pattern); + $did_description = preg_replace("/[^- \.\,\_0-9\p{L}]/u",'-',$did_description); + $xfercallid = preg_replace("/[^-_0-9\p{L}]/u",'-',$xfercallid); + $agent_log_id = preg_replace("/[^-_0-9\p{L}]/u",'-',$agent_log_id); + $user_group = preg_replace("/[^-_0-9\p{L}]/u",'-',$user_group); + $called_count = preg_replace("/[^-_0-9\p{L}]/u",'-',$called_count); + $did_custom_one = preg_replace('/[^- \.\:\/\@\_0-9\p{L}]/u','-',$did_custom_one); + $did_custom_two = preg_replace('/[^- \.\:\/\@\_0-9\p{L}]/u','-',$did_custom_two); + $did_custom_three = preg_replace('/[^- \.\:\/\@\_0-9\p{L}]/u','-',$did_custom_three); + $did_custom_four = preg_replace('/[^- \.\:\/\@\_0-9\p{L}]/u','-',$did_custom_four); + $did_custom_five = preg_replace('/[^- \.\:\/\@\_0-9\p{L}]/u','-',$did_custom_five ); + $list_name = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$list_name); + $list_description = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$list_description); } -# default optional vars if not set -if (!isset($format)) {$format="text";} - if ($format == 'debug') {$DB=1;} -if (!isset($ACTION)) {$ACTION="custom_form_frame";} -if (!isset($query_date)) {$query_date = $NOW_DATE;} if (strlen($SSagent_debug_logging) > 1) { if ($SSagent_debug_logging == "$user") diff --git a/www/agc/vdc_script_display.php b/www/agc/vdc_script_display.php index cb1c21e3..ecf467bf 100644 --- a/www/agc/vdc_script_display.php +++ b/www/agc/vdc_script_display.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed display the contents of the SCRIPT tab in the agent interface # @@ -44,10 +44,11 @@ # 201117-2107 - Changes for better compatibility with non-latin data input # 210616-2100 - Added optional CORS support, see options.php for details # 210825-0858 - Fix for security issue +# 220219-0144 - Added allow_web_debug system setting # -$version = '2.14-38'; -$build = '210825-0858'; +$version = '2.14-39'; +$build = '220219-0144'; $php_script = 'vdc_script_display.php'; require_once("dbconnect_mysqli.php"); @@ -301,25 +302,19 @@ $FQDN = "$server_name$server_port"; $IFRAME=0; $IFRAMEencode=1; +# default optional vars if not set +if (!isset($format)) {$format="text";} + if ($format == 'debug') {$DB=1;} +if (!isset($ACTION)) {$ACTION="refresh";} +if (!isset($query_date)) {$query_date = $NOW_DATE;} + $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### -$VUselected_language = ''; -$stmt="SELECT selected_language from vicidial_users where user='$user';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -$sl_ct = mysqli_num_rows($rslt); -if ($sl_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $VUselected_language = $row[0]; - } - -$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,custom_fields_enabled,enable_languages,language_method,enable_second_script FROM system_settings;"; -if ($DB) {echo "$stmt\n";} +$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,custom_fields_enabled,enable_languages,language_method,enable_second_script,allow_web_debug FROM system_settings;"; +#if ($DB) {echo "$stmt\n";} $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} $qm_conf_ct = mysqli_num_rows($rslt); @@ -333,27 +328,128 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $SSenable_second_script = $row[6]; + $SSallow_web_debug = $row[7]; + } +if ($SSallow_web_debug < 1) {$DB=0; $format='text';} + +$VUselected_language = ''; +$stmt="SELECT selected_language from vicidial_users where user='$user';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} +$sl_ct = mysqli_num_rows($rslt); +if ($sl_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $VUselected_language = $row[0]; } ##### END SETTINGS LOOKUP ##### ########################################### -$orig_pass = preg_replace("/\'|\"|\\\\|;| /","",$orig_pass); +$address1 = preg_replace("/\"|\\\\|;/",'-',$address1); +$address2 = preg_replace("/\"|\\\\|;/",'-',$address2); +$address3 = preg_replace("/\"|\\\\|;/",'-',$address3); +$agent_email = preg_replace("/\<|\>|\"|\\\\|;/",'-',$agent_email); +$agent_log_id = preg_replace("/\<|\>|\"|\\\\|;/",'-',$agent_log_id); +$alt_phone = preg_replace("/\"|\\\\|;/",'-',$alt_phone); +$call_id = preg_replace("/[^-_0-9a-zA-Z]/",'-',$call_id); +$called_count = preg_replace("/\<|\>|\"|\\\\|;/",'-',$called_count); +$camp_script = preg_replace("/\<|\>|\"|\\\\|;/",'-',$camp_script); +$CF_uses_custom_fields = preg_replace("/[^-_0-9a-zA-Z]/",'-',$CF_uses_custom_fields); +$channel_group = preg_replace("/\<|\>|\"|\\\\|;/",'-',$channel_group); +$city = preg_replace("/\"|\\\\|;/",'-',$city); +$closecallid = preg_replace("/[^-_0-9a-zA-Z]/",'-',$closecallid); +$closer = preg_replace("/\<|\>|\"|\\\\|;/",'-',$closer); +$comments = preg_replace("/\"|\\\\|;/",'-',$comments); +$country_code = preg_replace("/\"|\\\\|;/",'-',$country_code); +$customer_server_ip = preg_replace("/\<|\>|\"|\\\\|;/",'-',$customer_server_ip); +$customer_zap_channel = preg_replace("/\<|\>|\"|\\\\|;/",'-',$customer_zap_channel); +$date_of_birth = preg_replace("/\"|\\\\|;/",'-',$date_of_birth); +$DB = preg_replace("/\"|\\\\|;/",'-',$DB); +$dialed_label = preg_replace("/\<|\>|\"|\\\\|;/",'-',$dialed_label); +$dialed_number = preg_replace("/\<|\>|\"|\\\\|;/",'-',$dialed_number); +$did_custom_five = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_custom_five ); +$did_custom_four = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_custom_four); +$did_custom_one = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_custom_one); +$did_custom_three = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_custom_three); +$did_custom_two = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_custom_two); +$did_description = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_description); +$did_extension = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_extension); +$did_id = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_id); +$did_pattern = preg_replace("/\<|\>|\"|\\\\|;/",'-',$did_pattern); +$dispo = preg_replace("/\<|\>|\"|\\\\|;/",'-',$dispo); +$email = preg_replace("/\"|\\\\|;/",'-',$email); +$email_row_id = preg_replace('/[^0-9]/', '', $email_row_id); +$entry_date = preg_replace("/\<|\>|\"|\\\\|;/",'-',$entry_date); +$entry_list_id = preg_replace("/^0-9]/",'',$entry_list_id); +$epoch = preg_replace("/\<|\>|\"|\\\\|;/",'-',$epoch); +$first_name = preg_replace("/\"|\\\\|;/",'-',$first_name); +$fronter = preg_replace("/\<|\>|\"|\\\\|;/",'-',$fronter); +$fullname = preg_replace("/\<|\>|\"|\\\\|;/",'-',$fullname); +$gender = preg_replace("/\"|\\\\|;/",'-',$gender); +$gmt_offset_now = preg_replace("/\"|\\\\|;/",'-',$gmt_offset_now); +$ignore_list_script = preg_replace("/\<|\>|\"|\\\\|;/",'-',$ignore_list_script); +$in_script = preg_replace("/\<|\>|\"|\\\\|;/",'-',$in_script); +$inOUT=preg_replace("/[^-_0-9a-zA-Z]/","",$inOUT); +$last_name = preg_replace("/\"|\\\\|;/",'-',$last_name); $lead_id = preg_replace('/[^0-9]/', '', $lead_id); $list_id = preg_replace('/[^0-9]/', '', $list_id); -$email_row_id = preg_replace('/[^0-9]/', '', $email_row_id); +$middle_initial = preg_replace("/\"|\\\\|;/",'-',$middle_initial); +$orig_pass = preg_replace("/\'|\"|\\\\|;| /","",$orig_pass); +$original_phone_login = preg_replace("/\<|\>|\"|\\\\|;/",'-',$original_phone_login); +$owner = preg_replace("/\<|\>|\"|\\\\|;/",'-',$owner); +$parked_by = preg_replace("/\<|\>|\"|\\\\|;/",'-',$parked_by); +$pass = preg_replace("/\<|\>|\"|\\\\|;/",'-',$pass); +$phone = preg_replace("/\<|\>|\"|\\\\|;/",'-',$phone); +$phone_code = preg_replace("/[^0-9]/","",$phone_code); +$phone_login = preg_replace("/\<|\>|\"|\\\\|;/",'-',$phone_login); +$phone_number = preg_replace("/[^0-9]/","",$phone_number); +$phone_pass = preg_replace("/\<|\>|\"|\\\\|;/",'-',$phone_pass); +$postal_code = preg_replace("/\"|\\\\|;/",'-',$postal_code); +$preset_dtmf_a = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_dtmf_a); +$preset_dtmf_b = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_dtmf_b); +$preset_number_a = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_a); +$preset_number_b = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_b); +$preset_number_c = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_c); +$preset_number_d = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_d); +$preset_number_e = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_e); +$preset_number_f = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_f); +$province = preg_replace("/\"|\\\\|;/",'-',$province); +$rank = preg_replace("/\<|\>|\"|\\\\|;/",'-',$rank); +$recording_filename = preg_replace("/\<|\>|\"|\\\\|;/",'-',$recording_filename); +$recording_id = preg_replace("/\<|\>|\"|\\\\|;/",'-',$recording_id); +$script_height = preg_replace("/\<|\>|\"|\\\\|;/",'-',$script_height); +$script_override = preg_replace("/\<|\>|\"|\\\\|;/",'-',$script_override); +$script_span=preg_replace("/[^-_0-9a-zA-Z]/","",$script_span); +$script_width = preg_replace("/\<|\>|\"|\\\\|;/",'-',$script_width); +$SCRIPTcamp_script = preg_replace("/\<|\>|\"|\\\\|;/",'-',$SCRIPTcamp_script); +$SCRIPTin_script = preg_replace("/\<|\>|\"|\\\\|;/",'-',$SCRIPTin_script); +$ScrollDIV = preg_replace("/\<|\>|\"|\\\\|;/",'-',$ScrollDIV); +$security_phrase = preg_replace("/\"|\\\\|;/",'-',$security_phrase); $server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $session_id = preg_replace('/[^0-9]/','',$session_id); -$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); $session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); -$script_span=preg_replace("/[^-_0-9a-zA-Z]/","",$script_span); -$inOUT=preg_replace("/[^-_0-9a-zA-Z]/","",$inOUT); -$length_in_sec = preg_replace("/[^0-9]/","",$length_in_sec); -$phone_code = preg_replace("/[^0-9]/","",$phone_code); -$phone_number = preg_replace("/[^0-9]/","",$phone_number); +$SIPexten = preg_replace("/\<|\>|\"|\\\\|;/",'-',$SIPexten); +$source_id = preg_replace("/\<|\>|\"|\\\\|;/",'-',$source_id); +$SQLdate = preg_replace("/\<|\>|\"|\\\\|;/",'-',$SQLdate); +$state = preg_replace("/\"|\\\\|;/",'-',$state); +$title = preg_replace("/\"|\\\\|;/",'-',$title); +$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); +$user_custom_five = preg_replace("/\"|\\\\|;/",'-',$user_custom_five); +$user_custom_four = preg_replace("/\"|\\\\|;/",'-',$user_custom_four); +$user_custom_one = preg_replace("/\"|\\\\|;/",'-',$user_custom_one); +$user_custom_three = preg_replace("/\"|\\\\|;/",'-',$user_custom_three); +$user_custom_two = preg_replace("/\"|\\\\|;/",'-',$user_custom_two); +$user_group = preg_replace("/\<|\>|\"|\\\\|;/",'-',$user_group); +$vendor_id = preg_replace("/\"|\\\\|;/",'-',$vendor_id); +$vendor_lead_code = preg_replace("/\"|\\\\|;/",'-',$vendor_lead_code); +$web_vars = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$web_vars); +$xfercallid = preg_replace("/\<|\>|\"|\\\\|;/",'-',$xfercallid); if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $orig_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$orig_pass); $campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign); $group = preg_replace('/[^-_0-9a-zA-Z]/','',$group); @@ -363,9 +459,30 @@ if ($non_latin < 1) $LOGINvarTHREE=preg_replace("/[^-_0-9a-zA-Z]/","",$LOGINvarTHREE); $LOGINvarFOUR=preg_replace("/[^-_0-9a-zA-Z]/","",$LOGINvarFOUR); $LOGINvarFIVE=preg_replace("/[^-_0-9a-zA-Z]/","",$LOGINvarFIVE); + $SCRIPTcamp_script = preg_replace("/[^-_0-9a-zA-Z]/",'',$SCRIPTcamp_script); + $SCRIPTin_script = preg_replace("/[^-_0-9a-zA-Z]/",'',$SCRIPTin_script); + $agent_email = preg_replace("/[^-\.\:\/\@\_0-9a-zA-Z]/",'-',$agent_email); + $did_id = preg_replace("/[^-_0-9a-zA-Z]/",'-',$did_id); + $did_extension = preg_replace("/[^-_0-9a-zA-Z]/",'-',$did_extension); + $did_pattern = preg_replace("/[^:\+\*\#\.\_0-9a-zA-Z]/",'-',$did_pattern); + $did_description = preg_replace("/[^- \.\,\_0-9a-zA-Z]/",'-',$did_description); + $xfercallid = preg_replace("/[^-_0-9a-zA-Z]/",'-',$xfercallid); + $agent_log_id = preg_replace("/[^-_0-9a-zA-Z]/",'-',$agent_log_id); + $user_group = preg_replace("/[^-_0-9a-zA-Z]/",'-',$user_group); + $called_count = preg_replace("/[^-_0-9a-zA-Z]/",'-',$called_count); + $script_override = preg_replace("/[^-_0-9a-zA-Z]/",'-',$script_override); + $entry_date = preg_replace("/[^- \.\:\,\_0-9a-zA-Z]/",'-',$entry_date); + $did_custom_one = preg_replace('/[^- \.\:\/\@\_0-9a-zA-Z]/','-',$did_custom_one); + $did_custom_two = preg_replace('/[^- \.\:\/\@\_0-9a-zA-Z]/','-',$did_custom_two); + $did_custom_three = preg_replace('/[^- \.\:\/\@\_0-9a-zA-Z]/','-',$did_custom_three); + $did_custom_four = preg_replace('/[^- \.\:\/\@\_0-9a-zA-Z]/','-',$did_custom_four); + $did_custom_five = preg_replace('/[^- \.\:\/\@\_0-9a-zA-Z]/','-',$did_custom_five ); } else { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + $orig_pass = preg_replace('/[^-_0-9\p{L}]/u','',$orig_pass); $campaign = preg_replace('/[^-_0-9\p{L}]/u','',$campaign); $group = preg_replace('/[^-_0-9\p{L}]/u','',$group); $session_name=preg_replace("/[^-_0-9\p{L}]/u","",$session_name); @@ -374,14 +491,26 @@ else $LOGINvarTHREE=preg_replace("/[^-_0-9\p{L}]/u","",$LOGINvarTHREE); $LOGINvarFOUR=preg_replace("/[^-_0-9\p{L}]/u","",$LOGINvarFOUR); $LOGINvarFIVE=preg_replace("/[^-_0-9\p{L}]/u","",$LOGINvarFIVE); + $SCRIPTcamp_script = preg_replace("/[^-_0-9\p{L}]/u",'',$SCRIPTcamp_script); + $SCRIPTin_script = preg_replace("/[^-_0-9\p{L}]/u",'',$SCRIPTin_script); + $agent_email = preg_replace("/[^-\.\:\/\@\_0-9\p{L}]/u",'-',$agent_email); + $did_id = preg_replace("/[^-_0-9\p{L}]/u",'-',$did_id); + $did_extension = preg_replace("/[^-_0-9\p{L}]/u",'-',$did_extension); + $did_pattern = preg_replace("/[^:\+\*\#\.\_0-9\p{L}]/u",'-',$did_pattern); + $did_description = preg_replace("/[^- \.\,\_0-9\p{L}]/u",'-',$did_description); + $xfercallid = preg_replace("/[^-_0-9\p{L}]/u",'-',$xfercallid); + $agent_log_id = preg_replace("/[^-_0-9\p{L}]/u",'-',$agent_log_id); + $user_group = preg_replace("/[^-_0-9\p{L}]/u",'-',$user_group); + $called_count = preg_replace("/[^-_0-9\p{L}]/u",'-',$called_count); + $script_override = preg_replace("/[^-_0-9\p{L}]/u",'-',$script_override); + $entry_date = preg_replace("/[^- \.\:\,\_0-9\p{L}]/u",'-',$entry_date); + $did_custom_one = preg_replace('/[^- \.\:\/\@\_0-9\p{L}]/u','-',$did_custom_one); + $did_custom_two = preg_replace('/[^- \.\:\/\@\_0-9\p{L}]/u','-',$did_custom_two); + $did_custom_three = preg_replace('/[^- \.\:\/\@\_0-9\p{L}]/u','-',$did_custom_three); + $did_custom_four = preg_replace('/[^- \.\:\/\@\_0-9\p{L}]/u','-',$did_custom_four); + $did_custom_five = preg_replace('/[^- \.\:\/\@\_0-9\p{L}]/u','-',$did_custom_five ); } -# default optional vars if not set -if (!isset($format)) {$format="text";} - if ($format == 'debug') {$DB=1;} -if (!isset($ACTION)) {$ACTION="refresh";} -if (!isset($query_date)) {$query_date = $NOW_DATE;} - $auth=0; $auth_message = user_authorization($user,$pass,'',0,1,0,0,'vdc_script_display'); if ($auth_message == 'GOOD') diff --git a/www/agc/vdc_script_dispo_example.php b/www/agc/vdc_script_dispo_example.php index 9417d3b4..c017474f 100644 --- a/www/agc/vdc_script_dispo_example.php +++ b/www/agc/vdc_script_dispo_example.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed to be used in the SCRIPT tab in an IFRAME and will not submit unless a specific field is filled in # @@ -24,10 +24,11 @@ # 190111-0910 - Fix for PHP7 # 210616-2035 - Added optional CORS support, see options.php for details # 210825-0838 - Fix for security issue +# 220219-0137 - Added allow_web_debug system setting # -$version = '2.14-12'; -$build = '210825-0838'; +$version = '2.14-13'; +$build = '220219-0136'; $php_script = 'vdc_script_dispo_example.php'; require_once("dbconnect_mysqli.php"); @@ -233,10 +234,6 @@ if (strlen($vicidial_id) < 1) if (strlen($appointment_time) < 1) {$appointment_time = '12:00:00';} -$appointment_timeARRAY = explode(":",$appointment_time); -$appointment_hour = $appointment_timeARRAY[0]; -$appointment_min = $appointment_timeARRAY[1]; - $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ##### END Put custom fields here ##### @@ -261,43 +258,23 @@ $ENTRYdate = date("YmdHis"); $MT[0]=''; $agents='@agents'; -if (strlen($call_date) < 1) - {$call_date = $NOW_TIME;} +# default optional vars if not set +if (!isset($format)) {$format="text";} + if ($format == 'debug') {$DB=1;} +if (!isset($ACTION)) {$ACTION="refresh";} +if (!isset($query_date)) {$query_date = $NOW_DATE;} +if (strlen($call_date) < 1) {$call_date = $NOW_TIME;} $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$lead_id = preg_replace('/[^0-9]/', '', $lead_id); -$list_id = preg_replace('/[^0-9]/', '', $list_id); -$notesid = preg_replace('/[^0-9]/', '', $notesid); -$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); -$session_id = preg_replace('/[^0-9]/','',$session_id); -$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); -$campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign); -$group = preg_replace('/[^-_0-9a-zA-Z]/','',$group); -$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); -$question = preg_replace("/\'|\"|\\\\|;/","",$question); -$answer = preg_replace("/\'|\"|\\\\|;/","",$answer); -$status = preg_replace("/\'|\"|\\\\|;/","",$status); $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### -$VUselected_language = ''; -$stmt="SELECT selected_language from vicidial_users where user='$user';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -$sl_ct = mysqli_num_rows($rslt); -if ($sl_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $VUselected_language = $row[0]; - } - -$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,custom_fields_enabled,enable_languages,language_method FROM system_settings;"; -if ($DB) {echo "$stmt\n";} +$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,custom_fields_enabled,enable_languages,language_method,allow_web_debug FROM system_settings;"; +#if ($DB) {echo "$stmt\n";} $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} $qm_conf_ct = mysqli_num_rows($rslt); @@ -310,19 +287,140 @@ if ($qm_conf_ct > 0) $custom_fields_enabled = $row[3]; $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; + $SSallow_web_debug = $row[6]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + +$VUselected_language = ''; +$stmt="SELECT selected_language from vicidial_users where user='$user';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} +$sl_ct = mysqli_num_rows($rslt); +if ($sl_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $VUselected_language = $row[0]; } ##### END SETTINGS LOOKUP ##### ########################################### +$lead_id = preg_replace('/[^0-9]/', '', $lead_id); +$list_id = preg_replace('/[^0-9]/', '', $list_id); +$notesid = preg_replace('/[^0-9]/', '', $notesid); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); +$session_id = preg_replace('/[^0-9]/','',$session_id); +$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); +$campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign); +$group = preg_replace('/[^-_0-9a-zA-Z]/','',$group); +$question = preg_replace("/\'|\"|\\\\|;/","",$question); +$answer = preg_replace("/\'|\"|\\\\|;/","",$answer); +$status = preg_replace("/\'|\"|\\\\|;/","",$status); +$entry_list_id = preg_replace("/^0-9]/",'',$entry_list_id); +$notesid = preg_replace('/[^0-9]/', '', $notesid); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); +$session_id = preg_replace('/[^0-9]/','',$session_id); +$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); +$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); +$phone_code = preg_replace("/[^0-9]/","",$phone_code); +$phone_number = preg_replace("/[^0-9]/","",$phone_number); +$vendor_id = preg_replace("/\"|\\\\|;/",'-',$vendor_id); +$vendor_lead_code = preg_replace("/\"|\\\\|;/",'-',$vendor_lead_code); +$gmt_offset_now = preg_replace("/\"|\\\\|;/",'-',$gmt_offset_now); +$title = preg_replace("/\"|\\\\|;/",'-',$title); +$first_name = preg_replace("/\"|\\\\|;/",'-',$first_name); +$middle_initial = preg_replace("/\"|\\\\|;/",'-',$middle_initial); +$last_name = preg_replace("/\"|\\\\|;/",'-',$last_name); +$address1 = preg_replace("/\"|\\\\|;/",'-',$address1); +$address2 = preg_replace("/\"|\\\\|;/",'-',$address2); +$address3 = preg_replace("/\"|\\\\|;/",'-',$address3); +$city = preg_replace("/\"|\\\\|;/",'-',$city); +$state = preg_replace("/\"|\\\\|;/",'-',$state); +$province = preg_replace("/\"|\\\\|;/",'-',$province); +$postal_code = preg_replace("/\"|\\\\|;/",'-',$postal_code); +$country_code = preg_replace("/\"|\\\\|;/",'-',$country_code); +$gender = preg_replace("/\"|\\\\|;/",'-',$gender); +$date_of_birth = preg_replace("/\"|\\\\|;/",'-',$date_of_birth); +$alt_phone = preg_replace("/\"|\\\\|;/",'-',$alt_phone); +$email = preg_replace("/\"|\\\\|;/",'-',$email); +$security_phrase = preg_replace("/\"|\\\\|;/",'-',$security_phrase); +$comments = preg_replace("/\"|\\\\|;/",'-',$comments); +$pass = preg_replace("/\<|\>|\"|\\\\|;/",'-',$pass); +$phone_login = preg_replace("/\<|\>|\"|\\\\|;/",'-',$phone_login); +$original_phone_login = preg_replace("/\<|\>|\"|\\\\|;/",'-',$original_phone_login); +$phone_pass = preg_replace("/\<|\>|\"|\\\\|;/",'-',$phone_pass); +$fronter = preg_replace("/\<|\>|\"|\\\\|;/",'-',$fronter); +$closer = preg_replace("/\<|\>|\"|\\\\|;/",'-',$closer); +$channel_group = preg_replace("/\<|\>|\"|\\\\|;/",'-',$channel_group); +$SQLdate = preg_replace("/\<|\>|\"|\\\\|;/",'-',$SQLdate); +$epoch = preg_replace("/\<|\>|\"|\\\\|;/",'-',$epoch); +$customer_zap_channel = preg_replace("/\<|\>|\"|\\\\|;/",'-',$customer_zap_channel); +$customer_server_ip = preg_replace("/\<|\>|\"|\\\\|;/",'-',$customer_server_ip); +$SIPexten = preg_replace("/\<|\>|\"|\\\\|;/",'-',$SIPexten); +$phone = preg_replace("/\<|\>|\"|\\\\|;/",'-',$phone); +$parked_by = preg_replace("/\<|\>|\"|\\\\|;/",'-',$parked_by); +$dispo = preg_replace("/\<|\>|\"|\\\\|;/",'-',$dispo); +$dialed_number = preg_replace("/\<|\>|\"|\\\\|;/",'-',$dialed_number); +$dialed_label = preg_replace("/\<|\>|\"|\\\\|;/",'-',$dialed_label); +$source_id = preg_replace("/\<|\>|\"|\\\\|;/",'-',$source_id); +$rank = preg_replace("/\<|\>|\"|\\\\|;/",'-',$rank); +$owner = preg_replace("/\<|\>|\"|\\\\|;/",'-',$owner); +$camp_script = preg_replace("/\<|\>|\"|\\\\|;/",'-',$camp_script); +$in_script = preg_replace("/\<|\>|\"|\\\\|;/",'-',$in_script); +$script_width = preg_replace("/\<|\>|\"|\\\\|;/",'-',$script_width); +$script_height = preg_replace("/\<|\>|\"|\\\\|;/",'-',$script_height); +$fullname = preg_replace("/\<|\>|\"|\\\\|;/",'-',$fullname); +$recording_filename = preg_replace("/\<|\>|\"|\\\\|;/",'-',$recording_filename); +$recording_id = preg_replace("/\<|\>|\"|\\\\|;/",'-',$recording_id); +$user_custom_one = preg_replace("/\"|\\\\|;/",'-',$user_custom_one); +$user_custom_two = preg_replace("/\"|\\\\|;/",'-',$user_custom_two); +$user_custom_three = preg_replace("/\"|\\\\|;/",'-',$user_custom_three); +$user_custom_four = preg_replace("/\"|\\\\|;/",'-',$user_custom_four); +$user_custom_five = preg_replace("/\"|\\\\|;/",'-',$user_custom_five); +$preset_number_a = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_a); +$preset_number_b = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_b); +$preset_number_c = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_c); +$preset_number_d = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_d); +$preset_number_e = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_e); +$preset_number_f = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_f); +$preset_dtmf_a = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_dtmf_a); +$preset_dtmf_b = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_dtmf_b); +$ScrollDIV = preg_replace("/\<|\>|\"|\\\\|;/",'-',$ScrollDIV); +$ignore_list_script = preg_replace("/\<|\>|\"|\\\\|;/",'-',$ignore_list_script); +$DB = preg_replace("/\"|\\\\|;/",'-',$DB); +$process = preg_replace("/\"|\\\\|;/",'-',$process); +$vicidial_id = preg_replace("/\"|\\\\|;/",'-',$vicidial_id); +$call_date = preg_replace("/\"|\\\\|;/",'-',$call_date); +$order_id = preg_replace("/\"|\\\\|;/",'-',$order_id); +$appointment_date = preg_replace("/\<|\>|\"|\\\\|;/",'-',$appointment_date); +$appointment_time = preg_replace("/\<|\>|\"|\\\\|;/",'-',$appointment_time); +$call_notes = preg_replace("/\<|\>|\"|\\\\|;/",'-',$call_notes ); +$pause = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$pause); +$closecallid = preg_replace("/[^-_0-9a-zA-Z]/",'-',$closecallid); +$question = preg_replace("/\<|\>|\"|\\\\|;/",'-',$question); +$answer = preg_replace("/\<|\>|\"|\\\\|;/",'-',$answer); +$length_in_sec = preg_replace("/[^0-9]/","",$length_in_sec); +$phone_code = preg_replace("/[^0-9]/","",$phone_code); +$phone_number = preg_replace("/[^0-9]/","",$phone_number); + if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); - $pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass); - $length_in_sec = preg_replace("/[^0-9]/","",$length_in_sec); - $phone_code = preg_replace("/[^0-9]/","",$phone_code); - $phone_number = preg_replace("/[^0-9]/","",$phone_number); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $status=preg_replace("/[^-_0-9a-zA-Z]/","",$status); + $campaign=preg_replace("/[^-_0-9a-zA-Z]/","",$campaign); } +else + { + $user=preg_replace("/[^-_0-9\p{L}]/u","",$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); + $campaign=preg_replace("/[^-_0-9\p{L}]/u","",$campaign); + $status=preg_replace("/[^-_0-9\p{L}]/u","",$status); + } + +$appointment_timeARRAY = explode(":",$appointment_time); +$appointment_hour = $appointment_timeARRAY[0]; +$appointment_min = $appointment_timeARRAY[1]; if ($DB > 0) { @@ -374,12 +472,6 @@ if (strlen($row[17])>0) {$label_email = $row[17];} if (strlen($row[18])>0) {$label_comments = $row[18];} ### END find any custom field labels ### -# default optional vars if not set -if (!isset($format)) {$format="text";} - if ($format == 'debug') {$DB=1;} -if (!isset($ACTION)) {$ACTION="refresh";} -if (!isset($query_date)) {$query_date = $NOW_DATE;} - $auth=0; $auth_message = user_authorization($user,$pass,'',0,0,0,0,'vdc_script_dispo'); if ($auth_message == 'GOOD') @@ -464,7 +556,7 @@ if ($process > 0) $affected_rows = mysqli_affected_rows($link); #Insert/Update custom record - $stmt="INSERT IGNORE INTO custom_$entry_list_id SET question='$question',answer='$answer',lead_id='$lead_id' ON DUPLICATE KEY UPDATE question='$question',answer='$answer';"; + $stmt="INSERT IGNORE INTO custom_$entry_list_id SET question=\"$question\",answer=\"$answer\",lead_id='$lead_id' ON DUPLICATE KEY UPDATE question=\"$question\",answer=\"$answer\";"; if ($DB) {echo "$stmt\n";} $rslt=mysql_to_mysqli($stmt, $link); $CFaffected_rows = mysqli_affected_rows($link); @@ -514,7 +606,7 @@ if ($process > 0) sleep(3); #Update the agent screen with status and hangup - $stmt="UPDATE vicidial_live_agents set external_status='$status',external_hangup='1' where user='$user';"; + $stmt="UPDATE vicidial_live_agents set external_status=\"$status\",external_hangup='1' where user='$user';"; if ($DB) {echo "$stmt\n";} $rslt=mysql_to_mysqli($stmt, $link); $affected_rows = mysqli_affected_rows($link); diff --git a/www/agc/vdc_script_notes.php b/www/agc/vdc_script_notes.php index 80358c65..78cac0de 100644 --- a/www/agc/vdc_script_notes.php +++ b/www/agc/vdc_script_notes.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed open in the SCRIPT tab in the agent interface through # an IFRAME. It will create a new record for every SUBMIT @@ -22,10 +22,11 @@ # 201117-2213 - Changes for better compatibility with non-latin data input # 210616-2034 - Added optional CORS support, see options.php for details # 210825-0901 - Fix for XSS security issue +# 220219-0136 - Added allow_web_debug system setting # -$version = '2.14-12'; -$build = '210825-0901'; +$version = '2.14-13'; +$build = '220219-0136'; $php_script = 'vdc_script_notes.php'; require_once("dbconnect_mysqli.php"); @@ -203,10 +204,6 @@ if (strlen($vicidial_id) < 1) if (strlen($appointment_time) < 1) {$appointment_time = '12:00:00';} -$appointment_timeARRAY = explode(":",$appointment_time); -$appointment_hour = $appointment_timeARRAY[0]; -$appointment_min = $appointment_timeARRAY[1]; - $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); # if options file exists, use the override values for the above variables @@ -229,8 +226,12 @@ $ENTRYdate = date("YmdHis"); $MT[0]=''; $agents='@agents'; -if (strlen($call_date) < 1) - {$call_date = $NOW_TIME;} +# default optional vars if not set +if (!isset($format)) {$format="text";} + if ($format == 'debug') {$DB=1;} +if (!isset($ACTION)) {$ACTION="refresh";} +if (!isset($query_date)) {$query_date = $NOW_DATE;} +if (strlen($call_date) < 1) {$call_date = $NOW_TIME;} $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); @@ -240,20 +241,8 @@ $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### -$VUselected_language = ''; -$stmt="SELECT selected_language from vicidial_users where user='$user';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -$sl_ct = mysqli_num_rows($rslt); -if ($sl_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $VUselected_language = $row[0]; - } - -$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,custom_fields_enabled,enable_languages,language_method FROM system_settings;"; -if ($DB) {echo "$stmt\n";} +$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,custom_fields_enabled,enable_languages,language_method,allow_web_debug FROM system_settings;"; +#if ($DB) {echo "$stmt\n";} $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} $qm_conf_ct = mysqli_num_rows($rslt); @@ -266,6 +255,20 @@ if ($qm_conf_ct > 0) $custom_fields_enabled = $row[3]; $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; + $SSallow_web_debug = $row[6]; + } +if ($SSallow_web_debug < 1) {$DB=0; $format='text';} + +$VUselected_language = ''; +$stmt="SELECT selected_language from vicidial_users where user='$user';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} +$sl_ct = mysqli_num_rows($rslt); +if ($sl_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $VUselected_language = $row[0]; } ##### END SETTINGS LOOKUP ##### ########################################### @@ -276,23 +279,100 @@ $notesid = preg_replace('/[^0-9]/', '', $notesid); $server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); $session_id = preg_replace('/[^0-9]/','',$session_id); $uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid); -$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name); -$length_in_sec = preg_replace("/[^0-9]/","",$length_in_sec); $phone_code = preg_replace("/[^0-9]/","",$phone_code); $phone_number = preg_replace("/[^0-9]/","",$phone_number); +$vendor_id = preg_replace("/\"|\\\\|;/",'-',$vendor_id); +$vendor_lead_code = preg_replace("/\"|\\\\|;/",'-',$vendor_lead_code); +$gmt_offset_now = preg_replace("/\"|\\\\|;/",'-',$gmt_offset_now); +$title = preg_replace("/\"|\\\\|;/",'-',$title); +$first_name = preg_replace("/\"|\\\\|;/",'-',$first_name); +$middle_initial = preg_replace("/\"|\\\\|;/",'-',$middle_initial); +$last_name = preg_replace("/\"|\\\\|;/",'-',$last_name); +$address1 = preg_replace("/\"|\\\\|;/",'-',$address1); +$address2 = preg_replace("/\"|\\\\|;/",'-',$address2); +$address3 = preg_replace("/\"|\\\\|;/",'-',$address3); +$city = preg_replace("/\"|\\\\|;/",'-',$city); +$state = preg_replace("/\"|\\\\|;/",'-',$state); +$province = preg_replace("/\"|\\\\|;/",'-',$province); +$postal_code = preg_replace("/\"|\\\\|;/",'-',$postal_code); +$country_code = preg_replace("/\"|\\\\|;/",'-',$country_code); +$gender = preg_replace("/\"|\\\\|;/",'-',$gender); +$date_of_birth = preg_replace("/\"|\\\\|;/",'-',$date_of_birth); +$alt_phone = preg_replace("/\"|\\\\|;/",'-',$alt_phone); +$email = preg_replace("/\"|\\\\|;/",'-',$email); +$security_phrase = preg_replace("/\"|\\\\|;/",'-',$security_phrase); +$comments = preg_replace("/\"|\\\\|;/",'-',$comments); +$pass = preg_replace("/\<|\>|\"|\\\\|;/",'-',$pass); +$phone_login = preg_replace("/\<|\>|\"|\\\\|;/",'-',$phone_login); +$original_phone_login = preg_replace("/\<|\>|\"|\\\\|;/",'-',$original_phone_login); +$phone_pass = preg_replace("/\<|\>|\"|\\\\|;/",'-',$phone_pass); +$fronter = preg_replace("/\<|\>|\"|\\\\|;/",'-',$fronter); +$closer = preg_replace("/\<|\>|\"|\\\\|;/",'-',$closer); +$channel_group = preg_replace("/\<|\>|\"|\\\\|;/",'-',$channel_group); +$SQLdate = preg_replace("/\<|\>|\"|\\\\|;/",'-',$SQLdate); +$epoch = preg_replace("/\<|\>|\"|\\\\|;/",'-',$epoch); +$customer_zap_channel = preg_replace("/\<|\>|\"|\\\\|;/",'-',$customer_zap_channel); +$customer_server_ip = preg_replace("/\<|\>|\"|\\\\|;/",'-',$customer_server_ip); +$SIPexten = preg_replace("/\<|\>|\"|\\\\|;/",'-',$SIPexten); +$phone = preg_replace("/\<|\>|\"|\\\\|;/",'-',$phone); +$parked_by = preg_replace("/\<|\>|\"|\\\\|;/",'-',$parked_by); +$dispo = preg_replace("/\<|\>|\"|\\\\|;/",'-',$dispo); +$dialed_number = preg_replace("/\<|\>|\"|\\\\|;/",'-',$dialed_number); +$dialed_label = preg_replace("/\<|\>|\"|\\\\|;/",'-',$dialed_label); +$source_id = preg_replace("/\<|\>|\"|\\\\|;/",'-',$source_id); +$rank = preg_replace("/\<|\>|\"|\\\\|;/",'-',$rank); +$owner = preg_replace("/\<|\>|\"|\\\\|;/",'-',$owner); +$camp_script = preg_replace("/\<|\>|\"|\\\\|;/",'-',$camp_script); +$in_script = preg_replace("/\<|\>|\"|\\\\|;/",'-',$in_script); +$script_width = preg_replace("/\<|\>|\"|\\\\|;/",'-',$script_width); +$script_height = preg_replace("/\<|\>|\"|\\\\|;/",'-',$script_height); +$fullname = preg_replace("/\<|\>|\"|\\\\|;/",'-',$fullname); +$recording_filename = preg_replace("/\<|\>|\"|\\\\|;/",'-',$recording_filename); +$recording_id = preg_replace("/\<|\>|\"|\\\\|;/",'-',$recording_id); +$user_custom_one = preg_replace("/\"|\\\\|;/",'-',$user_custom_one); +$user_custom_two = preg_replace("/\"|\\\\|;/",'-',$user_custom_two); +$user_custom_three = preg_replace("/\"|\\\\|;/",'-',$user_custom_three); +$user_custom_four = preg_replace("/\"|\\\\|;/",'-',$user_custom_four); +$user_custom_five = preg_replace("/\"|\\\\|;/",'-',$user_custom_five); +$preset_number_a = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_a); +$preset_number_b = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_b); +$preset_number_c = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_c); +$preset_number_d = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_d); +$preset_number_e = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_e); +$preset_number_f = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_number_f); +$preset_dtmf_a = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_dtmf_a); +$preset_dtmf_b = preg_replace("/\<|\>|\"|\\\\|;/",'-',$preset_dtmf_b); +$ScrollDIV = preg_replace("/\<|\>|\"|\\\\|;/",'-',$ScrollDIV); +$ignore_list_script = preg_replace("/\<|\>|\"|\\\\|;/",'-',$ignore_list_script); +$DB = preg_replace("/\"|\\\\|;/",'-',$DB); +$process = preg_replace("/\"|\\\\|;/",'-',$process); +$vicidial_id = preg_replace("/\"|\\\\|;/",'-',$vicidial_id); +$call_date = preg_replace("/\"|\\\\|;/",'-',$call_date); +$order_id = preg_replace("/\"|\\\\|;/",'-',$order_id); +$appointment_date = preg_replace("/\<|\>|\"|\\\\|;/",'-',$appointment_date); +$appointment_time = preg_replace("/\<|\>|\"|\\\\|;/",'-',$appointment_time); +$call_notes = preg_replace("/\<|\>|\"|\\\\|;/",'-',$call_notes ); if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign); $group = preg_replace('/[^-_0-9a-zA-Z]/','',$group); } else { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); $campaign = preg_replace('/[^-_0-9\p{L}]/u','',$campaign); $group = preg_replace('/[^-_0-9\p{L}]/u','',$group); } +$appointment_timeARRAY = explode(":",$appointment_time); +$appointment_hour = $appointment_timeARRAY[0]; +$appointment_min = $appointment_timeARRAY[1]; + + if ($DB > 0) { echo "
$lead_id|$entry_date|$modify_date|$status|$user|$vendor_lead_code|$source_id|$list_id|$gmt_offset_now|$called_since_last_reset|$phone_code|$phone_number|$title|$first_name|$middle_initial|$last_name|$address1|$address2|$address3|$city|$state|$province|$postal_code|$country_code|$gender|$date_of_birth|$alt_phone|$email|$security_phrase|$comments|$called_count|$last_local_call_time|$rank|$owner|\n
"; @@ -343,12 +423,6 @@ if (strlen($row[17])>0) {$label_email = $row[17];} if (strlen($row[18])>0) {$label_comments = $row[18];} ### END find any custom field labels ### -# default optional vars if not set -if (!isset($format)) {$format="text";} - if ($format == 'debug') {$DB=1;} -if (!isset($ACTION)) {$ACTION="refresh";} -if (!isset($query_date)) {$query_date = $NOW_DATE;} - $auth=0; $auth_message = user_authorization($user,$pass,'',0,0,0,0,'script_notes'); if ($auth_message == 'GOOD') diff --git a/www/agc/vdc_soundboard_display.php b/www/agc/vdc_soundboard_display.php index 8571914f..dc4bf543 100644 --- a/www/agc/vdc_soundboard_display.php +++ b/www/agc/vdc_soundboard_display.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed display the contents of an audio soundboard in the system # @@ -14,10 +14,11 @@ # 161111-1647 - Added HIDENUMBERS display option, Font size, button type and layout options # 191013-2122 - Fixes for PHP7 # 210616-2032 - Added optional CORS support, see options.php for details +# 220219-0143 - Added allow_web_debug system setting # -$version = '2.14-8'; -$build = '210616-2032'; +$version = '2.14-9'; +$build = '220219-0143'; $php_script = 'vdc_soundboard_display.php'; require_once("dbconnect_mysqli.php"); @@ -52,7 +53,6 @@ if (isset($_GET["bgcolor"])) {$bgcolor=$_GET["bgcolor"];} if (isset($_GET["bcrypt"])) {$bcrypt=$_GET["bcrypt"];} elseif (isset($_POST["bcrypt"])) {$bcrypt=$_POST["bcrypt"];} -$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); if ($bcrypt == 'OFF') {$bcrypt=0;} @@ -79,33 +79,36 @@ $agents='@agents'; $script_height = ($script_height - 20); if (strlen($bgcolor) < 6) {$bgcolor='FFFFFF';} +# default optional vars if not set +if (!isset($format)) {$format="text";} + if ($format == 'debug') {$DB=1;} +if (!isset($ACTION)) {$ACTION="refresh";} +if (!isset($query_date)) {$query_date = $NOW_DATE;} +if ( (strlen($soundboard_id) < 1) and (strlen($avatar_id) > 0) ) {$soundboard_id=$avatar_id;} + $IFRAME=0; $wav='.wav'; $gsm='.gsm'; -$user = preg_replace("/\'|\"|\\\\|;| /","",$user); -$pass = preg_replace("/\'|\"|\\\\|;| /","",$pass); +$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); +$user=preg_replace("/[^-_0-9\p{L}]/u","",$user); +$pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); +$session_id = preg_replace('/[^-_\.0-9a-zA-Z]/','',$session_id); +$stage = preg_replace('/[^-_\.0-9a-zA-Z]/','',$stage); +$submit_button = preg_replace('/[^-_0-9a-zA-Z]/','',$submit_button); +$admin_submit = preg_replace('/[^-_0-9a-zA-Z]/','',$admin_submit); +$bgcolor = preg_replace("/\<|\>|\'|\"|\\\\|;| /","",$bgcolor); +$bcrypt = preg_replace('/[^-_0-9a-zA-Z]/','',$bcrypt); $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### -$VUselected_language = ''; -$stmt="SELECT selected_language from vicidial_users where user='$user';"; -if ($DB) {echo "|$stmt|\n";} +$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,active_modules,enable_languages,language_method,agent_soundboards,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -$sl_ct = mysqli_num_rows($rslt); -if ($sl_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $VUselected_language = $row[0]; - } - -$stmt = "SELECT use_non_latin,timeclock_end_of_day,agentonly_callback_campaign_lock,active_modules,enable_languages,language_method,agent_soundboards FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -117,6 +120,20 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $SSagent_soundboards = $row[6]; + $SSallow_web_debug = $row[7]; + } +if ($SSallow_web_debug < 1) {$DB=0; $format='text';} + +$VUselected_language = ''; +$stmt="SELECT selected_language from vicidial_users where user='$user';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} +$sl_ct = mysqli_num_rows($rslt); +if ($sl_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $VUselected_language = $row[0]; } ##### END SETTINGS LOOKUP ##### ########################################### @@ -124,28 +141,20 @@ if ($qm_conf_ct > 0) if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); - $pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); $soundboard_id=preg_replace("/[^-_0-9a-zA-Z]/","",$soundboard_id); $avatar_id=preg_replace("/[^-_0-9a-zA-Z]/","",$avatar_id); $session_name=preg_replace("/[^-_0-9a-zA-Z]/","",$session_name); } else { - $user=preg_replace("/\'|\"|\\\\|;| /","",$user); - $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); $soundboard_id=preg_replace("/\'|\"|\\\\|;| /","",$soundboard_id); $avatar_id=preg_replace("/\'|\"|\\\\|;| /","",$avatar_id); $session_name=preg_replace("/[^-_0-9a-zA-Z]/","",$session_name); } - -# default optional vars if not set -if (!isset($format)) {$format="text";} - if ($format == 'debug') {$DB=1;} -if (!isset($ACTION)) {$ACTION="refresh";} -if (!isset($query_date)) {$query_date = $NOW_DATE;} -if ( (strlen($soundboard_id) < 1) and (strlen($avatar_id) > 0) ) {$soundboard_id=$avatar_id;} - $auth=0; $auth_message = user_authorization($user,$pass,'',0,$bcrypt,0,0,'vdc_soundboard_display'); if ($auth_message == 'GOOD') diff --git a/www/agc/vicidial-grey.php b/www/agc/vicidial-grey.php index 9c9bfebc..c73b052f 100644 --- a/www/agc/vicidial-grey.php +++ b/www/agc/vicidial-grey.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # Other scripts that this application depends on: # - vdc_db_query.php: Updates information in the database @@ -529,10 +529,11 @@ # 190111-0908 - Fix for PHP7 # 210615-1029 - Default security fixes, CVE-2021-28854 # 210616-1852 - Added optional CORS support, see options.php for details +# 220220-0926 - Added allow_web_debug system setting # -$version = '2.12-495c-grey'; -$build = '210616-1852'; +$version = '2.12-496c-grey'; +$build = '220220-0926'; $php_script = 'vicidial-grey.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=87; @@ -596,6 +597,10 @@ $VD_pass=preg_replace("/\'|\"|\\\\|;| /","",$VD_pass); $VD_campaign = preg_replace("/[^-_0-9a-zA-Z]/","",$VD_campaign); $VD_language = preg_replace("/\'|\"|\\\\|;/","",$VD_language); $admin_test = preg_replace("/[^0-9a-zA-Z]/","",$admin_test); +$JS_browser_width = preg_replace('/[^-_0-9\p{L}]/u',"",$JS_browser_width); +$JS_browser_height = preg_replace('/[^-_0-9\p{L}]/u',"",$JS_browser_height); +$relogin = preg_replace('/[^-_0-9\p{L}]/u',"",$relogin); +$MGR_override = preg_replace('/[^-_0-9\p{L}]/u',"",$MGR_override); $forever_stop=0; @@ -619,7 +624,7 @@ $random = (rand(1000000, 9999999) + 10000000); $stmt="SELECT user,selected_language from vicidial_users where user='$VD_login';"; -if ($DB) {echo "|$stmt|\n";} +#if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'01081',$VD_login,$server_ip,$session_name,$one_mysql_log);} $sl_ct = mysqli_num_rows($rslt); @@ -632,10 +637,10 @@ if ($sl_ct > 0) ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,vdc_header_date_format,vdc_customer_date_format,vdc_header_phone_format,webroot_writable,timeclock_end_of_day,vtiger_url,enable_vtiger_integration,outbound_autodial_active,enable_second_webform,user_territories_active,static_agent_url,custom_fields_enabled,pllb_grouping_limit,qc_features_active,allow_emails,callback_time_24hour,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,enable_third_webform,default_language,active_modules,allow_chats,chat_url,default_phone_code FROM system_settings;"; +$stmt = "SELECT use_non_latin,vdc_header_date_format,vdc_customer_date_format,vdc_header_phone_format,webroot_writable,timeclock_end_of_day,vtiger_url,enable_vtiger_integration,outbound_autodial_active,enable_second_webform,user_territories_active,static_agent_url,custom_fields_enabled,pllb_grouping_limit,qc_features_active,allow_emails,callback_time_24hour,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,enable_third_webform,default_language,active_modules,allow_chats,chat_url,default_phone_code,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'01001',$VD_login,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -667,12 +672,14 @@ if ($qm_conf_ct > 0) $chat_enabled = $row[24]; $chat_URL = $row[25]; $default_phone_code = $row[26]; + $SSallow_web_debug = $row[27]; } else { echo _QXZ("ERROR: System Settings missing")."\n"; exit; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -681,6 +688,11 @@ if ($non_latin < 1) $VD_login=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_login); $VD_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_pass); } +else + { + $VD_login = preg_replace('/[^-_0-9\p{L}]/u','',$VD_login); + $VD_pass = preg_replace('/[^-_0-9\p{L}]/u','',$VD_pass); + } if ($force_logout) { diff --git a/www/agc/vicidial.php b/www/agc/vicidial.php index 4e2d6b00..e8d4a0c2 100644 --- a/www/agc/vicidial.php +++ b/www/agc/vicidial.php @@ -686,10 +686,11 @@ # 220128-0030 - Added more logging of dial alerts, force PauseCode MDSKIP when skipping previewed lead # 220212-0813 - Added pause_max_url triggering # 220217-1938 - Added agent_hide_hangup campaign feature +# 220219-0133 - Added allow_web_debug system setting # -$version = '2.14-654c'; -$build = '220217-1938'; +$version = '2.14-655c'; +$build = '220219-0133'; $php_script = 'vicidial.php'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=98; @@ -773,6 +774,8 @@ $new_pass1=preg_replace("/\'|\"|\\\\|;| /","",$new_pass1); $new_pass2=preg_replace("/\'|\"|\\\\|;| /","",$new_pass2); $JS_browser_width=preg_replace("/[^0-9a-z]/","",$JS_browser_width); $JS_browser_height=preg_replace("/[^0-9a-z]/","",$JS_browser_height); +$relogin=preg_replace("/[^0-9a-zA-Z]/","",$relogin); +$MGR_override=preg_replace("/[^0-9a-zA-Z]/","",$MGR_override); $forever_stop=0; @@ -795,26 +798,12 @@ $VUselected_language = ''; $random = (rand(1000000, 9999999) + 10000000); - -$stmt="SELECT user,selected_language,force_change_password from vicidial_users where user='$VD_login';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'01081',$VD_login,$server_ip,$session_name,$one_mysql_log);} -$sl_ct = mysqli_num_rows($rslt); -if ($sl_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $VUuser = $row[0]; - $VUselected_language = $row[1]; - $VUforce_change_password = $row[2]; - } - ############################################# -##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,vdc_header_date_format,vdc_customer_date_format,vdc_header_phone_format,webroot_writable,timeclock_end_of_day,vtiger_url,enable_vtiger_integration,outbound_autodial_active,enable_second_webform,user_territories_active,static_agent_url,custom_fields_enabled,pllb_grouping_limit,qc_features_active,allow_emails,callback_time_24hour,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,enable_third_webform,default_language,active_modules,allow_chats,chat_url,default_phone_code,agent_screen_colors,manual_auto_next,agent_xfer_park_3way,admin_web_directory,agent_script,agent_push_events,agent_push_url,agent_logout_link,agentonly_callback_campaign_lock,manual_dial_validation,mute_recordings,enable_second_script,enable_first_webform,recording_buttons,outbound_cid_any,browser_call_alerts,manual_dial_phone_strip,require_password_length,pass_hash_enabled,agent_hidden_sound_seconds,agent_hidden_sound,agent_hidden_sound_volume,agent_screen_timer,agent_hide_hangup FROM system_settings;"; +##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### +$stmt = "SELECT use_non_latin,vdc_header_date_format,vdc_customer_date_format,vdc_header_phone_format,webroot_writable,timeclock_end_of_day,vtiger_url,enable_vtiger_integration,outbound_autodial_active,enable_second_webform,user_territories_active,static_agent_url,custom_fields_enabled,pllb_grouping_limit,qc_features_active,allow_emails,callback_time_24hour,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,enable_third_webform,default_language,active_modules,allow_chats,chat_url,default_phone_code,agent_screen_colors,manual_auto_next,agent_xfer_park_3way,admin_web_directory,agent_script,agent_push_events,agent_push_url,agent_logout_link,agentonly_callback_campaign_lock,manual_dial_validation,mute_recordings,enable_second_script,enable_first_webform,recording_buttons,outbound_cid_any,browser_call_alerts,manual_dial_phone_strip,require_password_length,pass_hash_enabled,agent_hidden_sound_seconds,agent_hidden_sound,agent_hidden_sound_volume,agent_screen_timer,agent_hide_hangup,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'01001',$VD_login,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -870,6 +859,7 @@ if ($qm_conf_ct > 0) $SSagent_hidden_sound_volume = $row[48]; $SSagent_screen_timer = $row[49]; $SSagent_hide_hangup = $row[50]; + $SSallow_web_debug = $row[51]; if ( ($SSagent_hidden_sound == '---NONE---') or ($SSagent_hidden_sound == '') ) {$SSagent_hidden_sound_seconds=0;} } else @@ -877,13 +867,27 @@ else echo _QXZ("ERROR: System Settings missing")."\n"; exit; } +if ($SSallow_web_debug < 1) {$DB=0;} + +$stmt="SELECT user,selected_language,force_change_password from vicidial_users where user='$VD_login';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'01081',$VD_login,$server_ip,$session_name,$one_mysql_log);} +$sl_ct = mysqli_num_rows($rslt); +if ($sl_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $VUuser = $row[0]; + $VUselected_language = $row[1]; + $VUforce_change_password = $row[2]; + } ##### END SETTINGS LOOKUP ##### ########################################### if ($non_latin < 1) { $VD_login=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_login); - $VD_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_pass); + $VD_pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$VD_pass); $new_pass1=preg_replace("/[^-_0-9a-zA-Z]/","",$new_pass1); $new_pass2=preg_replace("/[^-_0-9a-zA-Z]/","",$new_pass2); $phone_login=preg_replace("/[^\,0-9a-zA-Z]/","",$phone_login); @@ -899,8 +903,8 @@ if ($non_latin < 1) } else { - $VD_login = preg_replace("/\'|\"|\\\\|;/","",$VD_login); - $VD_pass=preg_replace("/\'|\"|\\\\|;| /","",$VD_pass); + $VD_login = preg_replace('/[^-_0-9\p{L}]/u','',$VD_login); + $VD_pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$VD_pass); $new_pass1=preg_replace("/[^-_0-9\p{L}]/u","",$new_pass1); $new_pass2=preg_replace("/[^-_0-9\p{L}]/u","",$new_pass2); $phone_login=preg_replace("/[^\,0-9\p{L}]/u","",$phone_login); @@ -19159,7 +19163,7 @@ function phone_number_format(formatphone) { var form_entry_list_id = document.vicidial_form.entry_list_id.value; if (form_entry_list_id.length > 2) {form_list_id = form_entry_list_id} - document.getElementById('vcEmailIFrame').src='./vdc_email_display.php?lead_id=' + document.vicidial_form.lead_id.value + '&email_row_id=' + email_row_id + '&list_id=' + form_list_id + '&user=' + user + '&pass=' + orig_pass + '&campaign=' + campaign + '&server_ip=' + server_ip + '&session_id=' + '&uniqueid=' + document.vicidial_form.uniqueid.value + '&stage=DISPLAY' + "&campaign=" + campaign + "&phone_login=" + phone_login + "&original_phone_login=" + original_phone_login +"&phone_pass=" + phone_pass + "&fronter=" + fronter + "&closer=" + user + "&group=" + group + "&channel_group=" + group + "&SQLdate=" + SQLdate + "&epoch=" + UnixTime + "&customer_zap_channel=" + lastcustchannel + "&customer_server_ip=" + lastcustserverip +"&server_ip=" + server_ip + "&SIPexten=" + extension + "&session_id=" + session_id + "&phone=" + document.vicidial_form.phone_number.value + "&parked_by=" + document.vicidial_form.lead_id.value +"&dispo=" + LeaDDispO + '' +"&dialed_number=" + dialed_number + '' +"&dialed_label=" + dialed_label + '' +"&camp_script=" + campaign_script + '' +"&in_script=" + CalL_ScripT_id + '' +"&script_width=" + script_width + '' +"&script_height=" + script_height + '' +"&fullname=" + LOGfullname + '' +"&agent_email=" + LOGemail + '' +"&recording_filename=" + recording_filename + '' +"&recording_id=" + recording_id + '' +"&user_custom_one=" + VU_custom_one + '' +"&user_custom_two=" + VU_custom_two + '' +"&user_custom_three=" + VU_custom_three + '' +"&user_custom_four=" + VU_custom_four + '' +"&user_custom_five=" + VU_custom_five + '' +"&did_id=" + did_id + '' +"&did_extension=" + did_extension + '' +"&did_pattern=" + did_pattern + '' +"&did_description=" + did_description + '' +"&closecallid=" + closecallid + '' +"&xfercallid=" + xfercallid + '' + "&agent_log_id=" + agent_log_id + "&call_id=" + LasTCID + "&user_group=" + VU_user_group + '' + "&did_custom_one=" + did_custom_one + "&did_custom_two=" + did_custom_two + "&did_custom_three=" + did_custom_three + "&did_custom_four=" + did_custom_four + "&did_custom_five=" + did_custom_five + "&web_vars=" + LIVE_web_vars + '' +"&preset_number_a=" + CalL_XC_a_NuMber + '' +"&preset_number_b=" + CalL_XC_b_NuMber + '' +"&preset_number_c=" + CalL_XC_c_NuMber + '' +"&preset_number_d=" + CalL_XC_d_NuMber + '' +"&preset_number_e=" + CalL_XC_e_NuMber + '' +"&preset_dtmf_a=" + CalL_XC_a_Dtmf + '' +"&preset_dtmf_b=" + CalL_XC_b_Dtmf + '' ; + document.getElementById('vcEmailIFrame').src='./vdc_email_display.php?lead_id=' + document.vicidial_form.lead_id.value + '&email_row_id=' + email_row_id + '&list_id=' + form_list_id + '&user=' + user + '&pass=' + pass + '&campaign=' + campaign + '&server_ip=' + server_ip + '&session_id=' + '&uniqueid=' + document.vicidial_form.uniqueid.value + '&stage=DISPLAY' + "&campaign=" + campaign + "&phone_login=" + phone_login + "&original_phone_login=" + original_phone_login +"&phone_pass=" + phone_pass + "&fronter=" + fronter + "&closer=" + user + "&group=" + group + "&channel_group=" + group + "&SQLdate=" + SQLdate + "&epoch=" + UnixTime + "&customer_zap_channel=" + lastcustchannel + "&customer_server_ip=" + lastcustserverip +"&server_ip=" + server_ip + "&SIPexten=" + extension + "&session_id=" + session_id + "&phone=" + document.vicidial_form.phone_number.value + "&parked_by=" + document.vicidial_form.lead_id.value +"&dispo=" + LeaDDispO + '' +"&dialed_number=" + dialed_number + '' +"&dialed_label=" + dialed_label + '' +"&camp_script=" + campaign_script + '' +"&in_script=" + CalL_ScripT_id + '' +"&script_width=" + script_width + '' +"&script_height=" + script_height + '' +"&fullname=" + LOGfullname + '' +"&agent_email=" + LOGemail + '' +"&recording_filename=" + recording_filename + '' +"&recording_id=" + recording_id + '' +"&user_custom_one=" + VU_custom_one + '' +"&user_custom_two=" + VU_custom_two + '' +"&user_custom_three=" + VU_custom_three + '' +"&user_custom_four=" + VU_custom_four + '' +"&user_custom_five=" + VU_custom_five + '' +"&did_id=" + did_id + '' +"&did_extension=" + did_extension + '' +"&did_pattern=" + did_pattern + '' +"&did_description=" + did_description + '' +"&closecallid=" + closecallid + '' +"&xfercallid=" + xfercallid + '' + "&agent_log_id=" + agent_log_id + "&call_id=" + LasTCID + "&user_group=" + VU_user_group + '' + "&did_custom_one=" + did_custom_one + "&did_custom_two=" + did_custom_two + "&did_custom_three=" + did_custom_three + "&did_custom_four=" + did_custom_four + "&did_custom_five=" + did_custom_five + "&web_vars=" + LIVE_web_vars + '' +"&preset_number_a=" + CalL_XC_a_NuMber + '' +"&preset_number_b=" + CalL_XC_b_NuMber + '' +"&preset_number_c=" + CalL_XC_c_NuMber + '' +"&preset_number_d=" + CalL_XC_d_NuMber + '' +"&preset_number_e=" + CalL_XC_e_NuMber + '' +"&preset_dtmf_a=" + CalL_XC_a_Dtmf + '' +"&preset_dtmf_b=" + CalL_XC_b_Dtmf + '' ; form_list_id = ''; form_entry_list_id = ''; } diff --git a/www/agc/vicidial_redirect.php b/www/agc/vicidial_redirect.php index 9a3fc463..a124aa48 100644 --- a/www/agc/vicidial_redirect.php +++ b/www/agc/vicidial_redirect.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGELOG # 71202-1546 - First Build @@ -9,6 +9,7 @@ # 140811-0852 - Changed to use QXZ function for echoing text # 141216-2131 - Added language settings lookups and user/pass variable standardization # 210823-1004 - Fix for security issue +# 220220-0924 - Added allow_web_debug system setting # require_once("functions.php"); @@ -51,20 +52,8 @@ $relogin = preg_replace('/[^-\._0-9\p{L}]/u',"",$relogin); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### -$VUselected_language = ''; -$stmt="SELECT selected_language from vicidial_users where user='$VD_login';"; -if ($DB) {echo "|$stmt|\n";} -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$VD_login,$server_ip,$session_name,$one_mysql_log);} -$sl_ct = mysqli_num_rows($rslt); -if ($sl_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $VUselected_language = $row[0]; - } - -$stmt = "SELECT use_non_latin,admin_home_url,admin_web_directory,enable_languages,language_method FROM system_settings;"; -if ($DB) {echo "$stmt\n";} +$stmt = "SELECT use_non_latin,admin_home_url,admin_web_directory,enable_languages,language_method,allow_web_debug FROM system_settings;"; +#if ($DB) {echo "$stmt\n";} $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$VD_login,$server_ip,$session_name,$one_mysql_log);} $qm_conf_ct = mysqli_num_rows($rslt); @@ -76,6 +65,20 @@ if ($qm_conf_ct > 0) $admin_web_directory = $row[2]; $SSenable_languages = $row[3]; $SSlanguage_method = $row[4]; + $SSallow_web_debug = $row[5]; + } +if ($SSallow_web_debug < 1) {$DB=0;} + +$VUselected_language = ''; +$stmt="SELECT selected_language from vicidial_users where user='$VD_login';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$VD_login,$server_ip,$session_name,$one_mysql_log);} +$sl_ct = mysqli_num_rows($rslt); +if ($sl_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $VUselected_language = $row[0]; } ##### END SETTINGS LOOKUP ##### ########################################### diff --git a/www/agc/voicemail_check.php b/www/agc/voicemail_check.php index 8fb67ece..c0375bc2 100644 --- a/www/agc/voicemail_check.php +++ b/www/agc/voicemail_check.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed purely to check whether the voicemail box on the server defined has new and old messages # This script depends on the server_ip being sent and also needs to have a valid user/pass from the vicidial_users table @@ -33,10 +33,11 @@ # 170526-2351 - Added additional variable filtering # 210616-2109 - Added optional CORS support, see options.php for details # 210825-0910 - Fix for XSS security issue +# 220220-0855 - Added allow_web_debug system setting # -$version = '2.14-16'; -$build = '210825-0910'; +$version = '2.14-17'; +$build = '220220-0855'; $php_script = 'voicemail_check.php'; $SSagent_debug_logging=0; $startMS = microtime(); @@ -60,9 +61,6 @@ if (isset($_GET["vmail_box"])) {$vmail_box=$_GET["vmail_box"];} $user=preg_replace("/\'|\"|\\\\|;| /","",$user); $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass); -$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); -$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); -$vmail_box = preg_replace('/[^-_0-9\p{L}]/u',"",$vmail_box); # default optional vars if not set if (!isset($format)) {$format="text";} @@ -83,7 +81,7 @@ if (file_exists('options.php')) ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### $VUselected_language = ''; $stmt="SELECT selected_language from vicidial_users where user='$user';"; -if ($DB) {echo "|$stmt|\n";} +#if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} $sl_ct = mysqli_num_rows($rslt); @@ -93,10 +91,10 @@ if ($sl_ct > 0) $VUselected_language = $row[0]; } -$stmt = "SELECT use_non_latin,enable_languages,language_method,agent_debug_logging FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_languages,language_method,agent_debug_logging,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -105,13 +103,26 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[1]; $SSlanguage_method = $row[2]; $SSagent_debug_logging = $row[3]; + $SSallow_web_debug = $row[4]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); +$vmail_box = preg_replace('/[^-_0-9\p{L}]/u',"",$vmail_box); +$format = preg_replace('/[^-_0-9a-zA-Z]/','',$format); + if ($non_latin < 1) { $user=preg_replace("/[^-_0-9a-zA-Z]/","",$user); + $pass=preg_replace("/[^-\.\+\/\=_0-9a-zA-Z]/","",$pass); + } +else + { + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); + $pass = preg_replace('/[^-\.\+\/\=_0-9\p{L}]/u','',$pass); } $auth=0; diff --git a/www/chat_customer/customer_chat_code.php b/www/chat_customer/customer_chat_code.php index 568ca261..d10d15f0 100644 --- a/www/chat_customer/customer_chat_code.php +++ b/www/chat_customer/customer_chat_code.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Joe Johnson, Matt Florell LICENSE: AGPLv2 # # Example for incorporating the customer side of the Vicidial chat into a web page. # Can be called as an include file, if desired. @@ -12,6 +12,7 @@ # 151219-1415 - Added header and language variable # 160108-1659 - Added available_agents variable # 160120-1944 - Added show_email variable +# 220220-1921 - Added allow_web_debug system setting # if (isset($_GET["lead_id"])) {$lead_id=$_GET["lead_id"];} @@ -33,6 +34,16 @@ if (isset($_GET["available_agents"])) {$available_agents=$_GET["available_agen if (isset($_GET["show_email"])) {$show_email=$_GET["show_email"];} elseif (isset($_POST["show_email"])) {$show_email=$_POST["show_email"];} +$lead_id = preg_replace("/[^0-9]/","",$lead_id); +$chat_id = preg_replace('/[^-\_\.0-9a-zA-Z]/','',$chat_id); +$group_id = preg_replace('/[^-\_0-9\p{L}]/u','',$group_id); +$chat_group_id = preg_replace('/[^-\_0-9\p{L}]/u','',$chat_group_id); +$email = preg_replace('/[^-\.\:\/\@\_0-9\p{L}]/u','',$email); +$unique_userID = preg_replace('/[^-\.\_0-9a-zA-Z]/','',$unique_userID); +$language = preg_replace('/[^-\_0-9a-zA-Z]/','',$language); +$available_agents = preg_replace('/[^-\_0-9a-zA-Z]/','',$available_agents); +$show_email = preg_replace('/[^-\_0-9a-zA-Z]/','',$show_email); + $URL_vars="?user=".urlencode($unique_userID)."&lead_id=".$lead_id."&group_id=".urlencode($chat_group_id)."&chat_id=".$chat_id."&email=".urlencode($email)."&language=".urlencode($language)."&available_agents=".urlencode($available_agents)."&show_email=".urlencode($show_email); header ("Content-type: text/html; charset=utf-8"); header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 diff --git a/www/chat_customer/customer_chat_functions.php b/www/chat_customer/customer_chat_functions.php index 1d90c395..8dbe5a25 100644 --- a/www/chat_customer/customer_chat_functions.php +++ b/www/chat_customer/customer_chat_functions.php @@ -1,6 +1,8 @@ LICENSE: AGPLv2 +# # CHANGES # 151212-0828 - First Build for customer chat # 151213-1106 - Added variable filtering @@ -13,6 +15,7 @@ # 160725-1711 - Fixed nested iframe issue # 160805-2315 - Added coding to show logos in customer display # 161026-2230 - Added translation QXZ to untranslated text +# 220220-1940 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -51,29 +54,24 @@ if (isset($_GET["available_agents"])) {$available_agents=$_GET["available_age if (isset($_GET["show_email"])) {$show_email=$_GET["show_email"];} elseif (isset($_POST["show_email"])) {$show_email=$_POST["show_email"];} -$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); $chat_member_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/',"",$chat_member_name); if (!$user) {echo "No user, no using."; exit;} +$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); $lead_id = preg_replace("/[^0-9]/","",$lead_id); $chat_id = preg_replace('/[^- \_\.0-9a-zA-Z]/','',$chat_id); $chat_level = preg_replace('/[^- \_\.0-9a-zA-Z]/','',$chat_level); $group_id = preg_replace('/[^- \_0-9a-zA-Z]/','',$group_id); $language = preg_replace('/[^-\_0-9a-zA-Z]/','',$language); +$user = preg_replace("/\'|\"|\\\\|;/","",$user); $chat_member_name = preg_replace("/\'|\"|\\\\|;/","",$chat_member_name); $available_agents = preg_replace('/[^-\_0-9a-zA-Z]/','',$available_agents); $show_email = preg_replace('/[^-\_0-9a-zA-Z]/','',$show_email); $chat_message = preg_replace('/\|/', '|', $chat_message); - -if ($non_latin < 1) - { - $user = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$user); - $phone_number = preg_replace("/[^0-9]/","",$phone_number); - } -else - { - $user = preg_replace("/\'|\"|\\\\|;/","",$user); - } +$action = preg_replace('/[^-\_0-9a-zA-Z]/','',$action); +$user_level = preg_replace('/[^-\_0-9a-zA-Z]/','',$user_level); +$keepalive = preg_replace('/[^-\_0-9a-zA-Z]/','',$keepalive); +$current_message_count = preg_replace('/[^-\_0-9a-zA-Z]/','',$current_message_count); $use_agent_colors=1; if (file_exists('options.php')) @@ -83,7 +81,7 @@ if (file_exists('options.php')) ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $VUselected_language=''; -$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,chat_url,allow_chats FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,chat_url,allow_chats,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} if ($DB) {echo "$stmt\n";} @@ -97,11 +95,23 @@ if ($qm_conf_ct > 0) $SSdefault_language = $row[3]; $chat_url = $row[4]; $SSallow_chats = $row[5]; + $SSallow_web_debug = $row[6]; } $VUselected_language = $SSdefault_language; +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +if ($non_latin < 1) + { + $user = preg_replace('/[^- \+\_\.0-9a-zA-Z]/','',$user); + } +else + { + $user = preg_replace("/\'|\"|\\\\|;/","",$user); + } + + if (strlen($language) > 1) { $stmt = "SELECT language_code,language_description FROM vicidial_languages where language_id='$language' and active='Y';"; diff --git a/www/chat_customer/vicidial_chat_customer_side.php b/www/chat_customer/vicidial_chat_customer_side.php index bfc2c2ad..cb2deeb9 100644 --- a/www/chat_customer/vicidial_chat_customer_side.php +++ b/www/chat_customer/vicidial_chat_customer_side.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Joe Johnson, Matt Florell LICENSE: AGPLv2 # # The main page of the customer chat interface. This will display a form for the customer # to fill out to attempt to initiate a chat with an available agent in the in-group @@ -18,6 +18,7 @@ # 160120-1925 - Fixed missing list_id on vicidial_list inserts, Issue #915. Added show_email option # 160203-1052 - Added display of chat message after ending it # 160805-2315 - Added coding to show logos in customer display +# 220220-1915 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -57,16 +58,44 @@ $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); $lead_id = preg_replace("/[^0-9]/","",$lead_id); +$user = preg_replace("/\'|\"|\\\\|;/","",$user); $chat_id = preg_replace('/[^- \_\.0-9a-zA-Z]/','',$chat_id); $group_id = preg_replace('/[^- \_0-9a-zA-Z]/','',$group_id); $language = preg_replace('/[^-\_0-9a-zA-Z]/','',$language); $available_agents = preg_replace('/[^-\_0-9a-zA-Z]/','',$available_agents); $status_link = preg_replace('/[^-\_0-9a-zA-Z]/','',$status_link); $show_email = preg_replace('/[^-\_0-9a-zA-Z]/','',$show_email); +$send_request = preg_replace('/[^-\_0-9a-zA-Z]/','',$send_request); +$join_chat = preg_replace('/[^-\_0-9a-zA-Z]/','',$join_chat); +$stage = preg_replace('/[^-\_0-9a-zA-Z]/','',$stage); + +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$VUselected_language=''; +$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,allow_chats,chat_url,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); + if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} +if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSenable_languages = $row[1]; + $SSlanguage_method = $row[2]; + $SSdefault_language = $row[3]; + $SSallow_chats = $row[4]; + $SSchat_url = $row[5]; + $SSallow_web_debug = $row[6]; + } +$VUselected_language = $SSdefault_language; +if ($SSallow_web_debug < 1) {$DB=0;} +##### END SETTINGS LOOKUP ##### +########################################### if ($non_latin < 1) { - $user = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$user); + $user = preg_replace('/[^- \+\_\.0-9a-zA-Z]/','',$user); $first_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$first_name); $first_name = preg_replace('/\+/',' ',$first_name); $last_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$last_name); @@ -81,31 +110,9 @@ else $first_name = preg_replace("/\"|\\\\|;/","",$first_name); $last_name = preg_replace("/\"|\\\\|;/","",$last_name); $email = preg_replace("/\'|\"|\\\\|;/","",$email); - $phone_number = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9a-zA-Z]/','',$email); + $phone_number = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9a-zA-Z]/','',$phone_number); } -############################################# -##### START SYSTEM_SETTINGS LOOKUP ##### -$VUselected_language=''; -$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,allow_chats,chat_url FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); - if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);} -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSenable_languages = $row[1]; - $SSlanguage_method = $row[2]; - $SSdefault_language = $row[3]; - $SSallow_chats = $row[4]; - $SSchat_url = $row[5]; - } -$VUselected_language = $SSdefault_language; -##### END SETTINGS LOOKUP ##### -########################################### - if (strlen($language) > 1) { $stmt = "SELECT language_code,language_description FROM vicidial_languages where language_id='$language' and active='Y';"; diff --git a/www/vicidial/AST_IVRstats.php b/www/vicidial/AST_IVRstats.php index af86c8ba..01339dd6 100644 --- a/www/vicidial/AST_IVRstats.php +++ b/www/vicidial/AST_IVRstats.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # 81026-2026 - First build @@ -41,6 +41,7 @@ # 171012-2015 - Fixed javascript/apache errors with graphs # 180507-2315 - Added new help display # 191013-0835 - Fixes for PHP7 +# 220221-0926 - Added allow_web_debug system setting # $startMS = microtime(); @@ -77,6 +78,13 @@ if (isset($_GET["search_archived_data"])) {$search_archived_data=$_GET["search if (strlen($shift)<2) {$shift='ALL';} if (strlen($type)<2) {$type='inbound';} +$NOW_DATE = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$STARTtime = date("U"); +if (!isset($group)) {$group = array();} +if (!isset($query_date)) {$query_date = "$NOW_DATE 00:00:00";} +if (!isset($end_date)) {$end_date = "$NOW_DATE 23:23:59";} + $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); if ($type == 'inbound') @@ -87,9 +95,9 @@ $db_source = 'M'; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {$MAIN.="$stmt\n";} +#if ($DB) {$MAIN.="$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -101,10 +109,12 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $SSreport_default_format = $row[6]; + $SSallow_web_debug = $row[7]; } +if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;} +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### -if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;} ### ARCHIVED DATA CHECK CONFIGURATION $archives_available="N"; @@ -130,15 +140,28 @@ else } ############# +$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type); +$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$query_date); +$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$end_date); +$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download); +$type = preg_replace('/[^-_0-9a-zA-Z]/', '', $type); +$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9a-zA-Z]/','',$group); + $shift = preg_replace('/[^-_0-9a-zA-Z]/', '', $shift); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9\p{L}]/u','',$group); + $shift = preg_replace('/[^-_0-9\p{L}]/u', '', $shift); } $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; @@ -316,13 +339,6 @@ if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL exit; } -$NOW_DATE = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); -$STARTtime = date("U"); -if (!isset($group)) {$group = array();} -if (!isset($query_date)) {$query_date = "$NOW_DATE 00:00:00";} -if (!isset($end_date)) {$end_date = "$NOW_DATE 23:23:59";} - ##### BEGIN Generate select list for which in-groups or campaigns to display ##### diff --git a/www/vicidial/AST_LISTS_pass_report.php b/www/vicidial/AST_LISTS_pass_report.php index ef589ccb..41d1d2fd 100644 --- a/www/vicidial/AST_LISTS_pass_report.php +++ b/www/vicidial/AST_LISTS_pass_report.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This is a list inventory report, not a calling report. This report will show # statistics for all of the lists in the selected campaigns @@ -25,6 +25,7 @@ # 180507-2315 - Added new help display # 191013-0828 - Fixes for PHP7 # 210330-1659 - Added extra warnings and forced confirmation before running report +# 220221-0906 - Added allow_web_debug system setting # $startMS = microtime(); @@ -42,13 +43,13 @@ if (isset($_GET["group"])) {$group=$_GET["group"];} elseif (isset($_POST["group"])) {$group=$_POST["group"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} -if (isset($_GET["confirm_run"])) {$confirm_run=$_GET["confirm_run"];} - elseif (isset($_POST["confirm_run"])) {$confirm_run=$_POST["confirm_run"];} +if (isset($_GET["confirm_run"])) {$confirm_run=$_GET["confirm_run"];} + elseif (isset($_POST["confirm_run"])) {$confirm_run=$_POST["confirm_run"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} -if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} +if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];} if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];} @@ -57,6 +58,11 @@ if (isset($_GET["use_lists"])) {$use_lists=$_GET["use_lists"];} if (isset($_GET["search_archived_data"])) {$search_archived_data=$_GET["search_archived_data"];} elseif (isset($_POST["search_archived_data"])) {$search_archived_data=$_POST["search_archived_data"];} +$NOW_DATE = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$STARTtime = date("U"); +if (!isset($group)) {$group = array();} + $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); $report_name = 'Lists Pass Report'; @@ -71,9 +77,9 @@ $JS_onload="onload = function() {\n"; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {$MAIN.="$stmt\n";} +#if ($DB) {$MAIN.="$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -85,10 +91,33 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $SSreport_default_format = $row[6]; + $SSallow_web_debug = $row[7]; } +if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;} +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### -if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;} + +$confirm_run = preg_replace('/[^-_0-9a-zA-Z]/', '', $confirm_run); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); +$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download); +$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type); +$use_lists = preg_replace('/[^-_0-9a-zA-Z]/', '', $use_lists); +$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data); + +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9a-zA-Z]/','',$group); + } +else + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9\p{L}]/u','',$group); + } ### ARCHIVED DATA CHECK CONFIGURATION $archives_available="N"; @@ -106,17 +135,6 @@ else } ############# -if ($non_latin < 1) - { - $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); - } -else - { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - } - $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -261,11 +279,6 @@ if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL exit; } -$NOW_DATE = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); -$STARTtime = date("U"); -if (!isset($group)) {$group = array();} - $i=0; $group_string='|'; $group_ct = count($group); diff --git a/www/vicidial/AST_agent_days_detail.php b/www/vicidial/AST_agent_days_detail.php index 96aa9d76..55ea7221 100644 --- a/www/vicidial/AST_agent_days_detail.php +++ b/www/vicidial/AST_agent_days_detail.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # @@ -34,6 +34,7 @@ # 171012-2015 - Fixed javascript/apache errors with graphs # 171204-2300 - Fixed minor reporting bug # 191013-0848 - Fixes for PHP7 +# 220221-0946 - Added allow_web_debug system setting # $startMS = microtime(); @@ -70,7 +71,16 @@ if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_d if (isset($_GET["search_archived_data"])) {$search_archived_data=$_GET["search_archived_data"];} elseif (isset($_POST["search_archived_data"])) {$search_archived_data=$_POST["search_archived_data"];} +$MT=array(); +$MT[0]=''; +$NOW_DATE = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$STARTtime = date("U"); +if (!isset($group)) {$group = array();} +if (!isset($query_date)) {$query_date = $NOW_DATE;} +if (!isset($end_date)) {$end_date = $NOW_DATE;} if (strlen($shift)<2) {$shift='ALL';} + $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); $report_name = 'Single Agent Daily'; @@ -80,9 +90,9 @@ $JS_onload="onload = function() {\n"; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -94,10 +104,12 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $SSreport_default_format = $row[6]; + $SSallow_web_debug = $row[7]; } +if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;} +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### -if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;} ### ARCHIVED DATA CHECK CONFIGURATION $archives_available="N"; @@ -119,15 +131,30 @@ else } ############# +$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type); +$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$query_date); +$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$end_date); +$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download); +$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); +$stage = preg_replace('/[^-_0-9a-zA-Z]/', '', $stage); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9a-zA-Z]/','',$group); + $shift = preg_replace('/[^-_0-9a-zA-Z]/', '', $shift); + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9\p{L}]/u','',$group); + $shift = preg_replace('/[^-_0-9\p{L}]/u', '', $shift); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); } $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; @@ -308,14 +335,6 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen( $whereLOGadmin_viewable_call_timesSQL = "where call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')"; } -$MT=array(); -$MT[0]=''; -$NOW_DATE = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); -$STARTtime = date("U"); -if (!isset($group)) {$group = array();} -if (!isset($query_date)) {$query_date = $NOW_DATE;} -if (!isset($end_date)) {$end_date = $NOW_DATE;} $i=0; $group_string='|'; diff --git a/www/vicidial/AST_agent_time_sheet.php b/www/vicidial/AST_agent_time_sheet.php index 109a32a0..935786df 100644 --- a/www/vicidial/AST_agent_time_sheet.php +++ b/www/vicidial/AST_agent_time_sheet.php @@ -28,6 +28,7 @@ # 170409-1539 - Added IP List validation code # 170711-1102 - Added screen colors and fixed default date variable # 220122-1700 - Added more variable filtering +# 220221-0938 - Added allow_web_debug system setting # $startMS = microtime(); @@ -56,12 +57,21 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} elseif (isset($_POST["file_download"])) {$file_download=$_POST["file_download"];} if (isset($_GET["search_archived_data"])) {$search_archived_data=$_GET["search_archived_data"];} elseif (isset($_POST["search_archived_data"])) {$search_archived_data=$_POST["search_archived_data"];} +if (isset($_GET["DB"])) {$DB=$_GET["DB"];} + elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} + +$NOW_DATE = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$STARTtime = date("U"); +if ( (!isset($query_date)) or (strlen($query_date) < 8) ) {$query_date = $NOW_DATE;} + +$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,user_territories_active,enable_languages,language_method,admin_screen_colors,report_default_format FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,user_territories_active,enable_languages,language_method,admin_screen_colors,report_default_format,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {$MAIN.="$stmt\n";} +#if ($DB) {$MAIN.="$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -75,7 +85,9 @@ if ($qm_conf_ct > 0) $SSlanguage_method = $row[6]; $SSadmin_screen_colors = $row[7]; $SSreport_default_format = $row[8]; + $SSallow_web_debug = $row[9]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -101,6 +113,13 @@ else } ############# +$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$query_date); +$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download); +$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); +$calls_summary = preg_replace('/[^-_0-9a-zA-Z]/', '', $calls_summary); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -109,11 +128,12 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); $agent = preg_replace('/[^-_0-9\p{L}]/u','',$agent); } + $user=$agent; $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; @@ -183,15 +203,6 @@ else exit; } -$query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date); -$calls_summary = preg_replace('/[^-_0-9a-zA-Z]/', '', $calls_summary); -$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download); -$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data); -$NOW_DATE = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); -$STARTtime = date("U"); -if ( (!isset($query_date)) or (strlen($query_date) < 8) ) {$query_date = $NOW_DATE;} - ##### BEGIN log visit to the vicidial_report_log table ##### $LOGip = getenv("REMOTE_ADDR"); diff --git a/www/vicidial/AST_user_group_hourly_detail.php b/www/vicidial/AST_user_group_hourly_detail.php index 3aa609c7..8dc34056 100644 --- a/www/vicidial/AST_user_group_hourly_detail.php +++ b/www/vicidial/AST_user_group_hourly_detail.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Joseph Johnson LICENSE: AGPLv2 # # Gives hourly count of distinct agents per user group, with totals. # For single days only @@ -13,6 +13,7 @@ # 170829-0040 - Added screen color settings # 180507-2315 - Added new help display # 191013-0855 - Fixes for PHP7 +# 220221-0932 - Added allow_web_debug system setting # $startMS = microtime(); @@ -56,6 +57,16 @@ if (isset($_GET["search_archived_data"])) {$search_archived_data=$_GET["search elseif (isset($_POST["search_archived_data"])) {$search_archived_data=$_POST["search_archived_data"];} if (strlen($shift)<2) {$shift='ALL';} +$MT[0]=''; +$NOW_DATE = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$STARTtime = date("U"); +if (!isset($group)) {$group = array();} +if (!isset($user_group)) {$user_group = array();} +if (!isset($query_date)) {$query_date = $NOW_DATE;} +if (!isset($start_hour)) {$start_hour = date("H");} +if (!isset($end_hour)) {$end_hour = date("H");} + $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); $report_name = 'User Group Hourly Report'; @@ -63,9 +74,9 @@ $db_source = 'M'; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -77,11 +88,12 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $SSreport_default_format = $row[6]; + $SSallow_web_debug = $row[7]; } -##### END SETTINGS LOOKUP ##### - -########################################### if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;} +if ($SSallow_web_debug < 1) {$DB=0;} +##### END SETTINGS LOOKUP ##### +########################################### ### ARCHIVED DATA CHECK CONFIGURATION $archives_available="N"; @@ -103,15 +115,35 @@ else } ############# +$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/', '', $report_display_type); +$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$query_date); +$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$end_date); +$start_hour = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$start_hour); +$end_hour = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$end_hour); +$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download); +$type = preg_replace('/[^-_0-9a-zA-Z]/', '', $type); +$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); +$stage = preg_replace('/[^-_0-9a-zA-Z]/', '', $stage); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9a-zA-Z]/','',$group); + $shift = preg_replace('/[^-_0-9a-zA-Z]/', '', $shift); + $user_group = preg_replace('/[^-_0-9a-zA-Z]/','',$user_group); + $user = preg_replace('/[^-_0-9a-zA-Z]/','',$user); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9\p{L}]/u','',$group); + $shift = preg_replace('/[^-_0-9\p{L}]/u', '', $shift); + $user_group = preg_replace('/[^-_0-9\p{L}]/u','',$user_group); + $user = preg_replace('/[^-_0-9\p{L}]/u','',$user); } $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; @@ -292,16 +324,6 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen( $whereLOGadmin_viewable_call_timesSQL = "where call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')"; } -$MT[0]=''; -$NOW_DATE = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); -$STARTtime = date("U"); -if (!isset($group)) {$group = array();} -if (!isset($user_group)) {$user_group = array();} -if (!isset($query_date)) {$query_date = $NOW_DATE;} -if (!isset($start_hour)) {$start_hour = date("H");} -if (!isset($end_hour)) {$end_hour = date("H");} - $stmt="select user_group from vicidial_user_groups $whereLOGadmin_viewable_groupsSQL order by user_group;"; $rslt=mysql_to_mysqli($stmt, $link); diff --git a/www/vicidial/admin.php b/www/vicidial/admin.php index 229aa13c..d016df85 100644 --- a/www/vicidial/admin.php +++ b/www/vicidial/admin.php @@ -2703,6 +2703,8 @@ if (isset($_GET["pause_max_url"])) {$pause_max_url=$_GET["pause_max_url"];} elseif (isset($_POST["pause_max_url"])) {$pause_max_url=$_POST["pause_max_url"];} if (isset($_GET["agent_hide_hangup"])) {$agent_hide_hangup=$_GET["agent_hide_hangup"];} elseif (isset($_POST["agent_hide_hangup"])) {$agent_hide_hangup=$_POST["agent_hide_hangup"];} +if (isset($_GET["allow_web_debug"])) {$allow_web_debug=$_GET["allow_web_debug"];} + elseif (isset($_POST["allow_web_debug"])) {$allow_web_debug=$_POST["allow_web_debug"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); @@ -2718,9 +2720,9 @@ if (strlen($dial_status) > 0) ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,allow_emails,level_8_disable_add,pass_key,pass_hash_enabled,disable_auto_dial,country_code_list_stats,frozen_server_call_clear,active_modules,allow_chats,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,enable_did_entry_list_id,enable_third_webform,default_language,user_hide_realtime_enabled,log_recording_access,alt_ivr_logging,admin_row_click,admin_screen_colors,ofcom_uk_drop_calc,agent_screen_colors,script_remove_js,manual_auto_next,user_new_lead_limit,agent_xfer_park_3way,agent_soundboards,web_loader_phone_length,agent_script,enable_auto_reports,enable_pause_code_limits,enable_drop_lists,allow_ip_lists,system_ip_blacklist,hide_inactive_lists,allow_manage_active_lists,expired_lists_inactive,did_system_filter,enable_gdpr_download_deletion,mute_recordings,user_admin_redirect,list_status_modification_confirmation,sip_event_logging,call_quota_lead_ranking,enable_second_script,enable_first_webform,recording_buttons,opensips_cid_name,require_password_length,user_account_emails,outbound_cid_any,entries_per_page,browser_call_alerts,inbound_answer_config,enable_international_dncs,daily_call_count_limit,allow_shared_dial,agent_search_method,admin_home_url,qc_claim_limit,qc_expire_days,two_factor_auth_hours,two_factor_container,call_limit_24hour,allowed_sip_stacks,agent_hide_hangup FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,enable_vtiger_integration,qc_features_active,outbound_autodial_active,sounds_central_control_active,enable_second_webform,user_territories_active,custom_fields_enabled,admin_web_directory,webphone_url,first_login_trigger,hosted_settings,default_phone_registration_password,default_phone_login_password,default_server_password,test_campaign_calls,active_voicemail_server,voicemail_timezones,default_voicemail_timezone,default_local_gmt,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,allow_emails,level_8_disable_add,pass_key,pass_hash_enabled,disable_auto_dial,country_code_list_stats,frozen_server_call_clear,active_modules,allow_chats,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,enable_did_entry_list_id,enable_third_webform,default_language,user_hide_realtime_enabled,log_recording_access,alt_ivr_logging,admin_row_click,admin_screen_colors,ofcom_uk_drop_calc,agent_screen_colors,script_remove_js,manual_auto_next,user_new_lead_limit,agent_xfer_park_3way,agent_soundboards,web_loader_phone_length,agent_script,enable_auto_reports,enable_pause_code_limits,enable_drop_lists,allow_ip_lists,system_ip_blacklist,hide_inactive_lists,allow_manage_active_lists,expired_lists_inactive,did_system_filter,enable_gdpr_download_deletion,mute_recordings,user_admin_redirect,list_status_modification_confirmation,sip_event_logging,call_quota_lead_ranking,enable_second_script,enable_first_webform,recording_buttons,opensips_cid_name,require_password_length,user_account_emails,outbound_cid_any,entries_per_page,browser_call_alerts,inbound_answer_config,enable_international_dncs,daily_call_count_limit,allow_shared_dial,agent_search_method,admin_home_url,qc_claim_limit,qc_expire_days,two_factor_auth_hours,two_factor_container,call_limit_24hour,allowed_sip_stacks,agent_hide_hangup,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -2827,7 +2829,9 @@ if ($qm_conf_ct > 0) $SScall_limit_24hour = $row[99]; $SSallowed_sip_stacks = $row[100]; $SSagent_hide_hangup = $row[101]; + $SSallow_web_debug = $row[102]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -3194,7 +3198,11 @@ $call_limit_24hour = preg_replace('/[^0-9]/','',$call_limit_24hour); $download_invalid_files = preg_replace('/[^0-9]/','',$download_invalid_files); $modify_email_accounts = preg_replace('/[^0-9]/','',$modify_email_accounts); $access_recordings = preg_replace('/[^0-9]/','',$access_recordings); -$agentcall_email = preg_replace('/[^0-9]/','',$agentcall_email); +$agentcall_email = preg_replace('/[^0-9]/','',$agentcall_email); +$allow_web_debug = preg_replace('/[^0-9]/','',$allow_web_debug); +$force_logout = preg_replace('/[^0-9]/','',$force_logout); +$log_recording_access = preg_replace('/[^0-9]/','',$log_recording_access); +$dial_level_override = preg_replace('/[^0-9]/','',$dial_level_override); $user_new_lead_limit = preg_replace('/[^-0-9]/','',$user_new_lead_limit); $drop_call_seconds = preg_replace('/[^-0-9]/','',$drop_call_seconds); @@ -3384,6 +3392,25 @@ $allowed_sip_stacks = preg_replace('/[^-_0-9a-zA-Z]/','',$allowed_sip_stacks); $in_queue_nanque = preg_replace('/[^-_0-9a-zA-Z]/','',$in_queue_nanque); $reports_header_override = preg_replace('/[^-_0-9a-zA-Z]/','',$reports_header_override); $agent_hide_hangup = preg_replace('/[^-_0-9a-zA-Z]/','',$agent_hide_hangup); +$SUB = preg_replace('/[^-_0-9a-zA-Z]/','',$SUB); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT); +$qc_display_group_type = preg_replace('/[^-_0-9a-zA-Z]/','',$qc_display_group_type); +$available_only_tally_threshold = preg_replace('/[^-_0-9a-zA-Z]/','',$available_only_tally_threshold); +$dial_level_threshold = preg_replace('/[^-_0-9a-zA-Z]/','',$dial_level_threshold); +$form_end = preg_replace('/[^-_0-9a-zA-Z]/','',$form_end); +$download_max_system_stats_metric = preg_replace('/[^- \+_0-9a-zA-Z]/','',$download_max_system_stats_metric); +$download_max_system_stats_metric_name = preg_replace('/[^- \+_0-9a-zA-Z]/','',$download_max_system_stats_metric_name); +$chat_timeout = preg_replace('/[^-_0-9a-zA-Z]/','',$chat_timeout); +$manager_chat_id = preg_replace('/[^-\._0-9a-zA-Z]/','',$manager_chat_id); +$group_handling = preg_replace('/[^-_0-9a-zA-Z]/','',$group_handling); +$query_date = preg_replace('/[^-_0-9a-zA-Z]/','',$query_date); +$end_date = preg_replace('/[^-_0-9a-zA-Z]/','',$end_date); +$show_vm_on_summary = preg_replace('/[^-_0-9a-zA-Z]/','',$show_vm_on_summary); +$admin_screen_colors = preg_replace('/[^-_0-9a-zA-Z]/','',$admin_screen_colors); +$last_run = preg_replace('/[^-_0-9a-zA-Z]/','',$last_run); +$closing_time_option_xfer_group = preg_replace('/[^-_0-9a-zA-Z]/','',$closing_time_option_xfer_group); +$user_account_emails = preg_replace('/[^-_0-9a-zA-Z]/','',$user_account_emails); +$outbound_cid_any = preg_replace('/[^-_0-9a-zA-Z]/','',$outbound_cid_any); if ($non_latin < 1) { @@ -4035,6 +4062,7 @@ if ($non_latin < 1) $label_entry_list_id = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$label_entry_list_id); $user_location = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$user_location); $queue_group_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$queue_group_name); + $qc_scorecard_id = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$qc_scorecard_id); ### ALPHA-NUMERIC and underscore and dash and slash and at and dot $call_out_number_group = preg_replace('/[^-\.\:\/\@\_0-9a-zA-Z]/','',$call_out_number_group); @@ -4748,6 +4776,7 @@ else $label_entry_list_id = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$label_entry_list_id); $user_location = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$user_location); $queue_group_name = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$queue_group_name); + $qc_scorecard_id = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$qc_scorecard_id); ### ALPHA-NUMERIC and underscore and dash and slash and at and dot $call_out_number_group = preg_replace('/[^-\.\:\/\@\_0-9\p{L}]/u','',$call_out_number_group); @@ -4912,6 +4941,37 @@ $pause_max_url = preg_replace('/\'/', '',$pause_max_url); # $enter_ingroup_url # $dead_trigger_url # $user_admin_redirect_url +# $local_web_callerID_URL +# $VICIDIAL_web_URL +# $audit_comments +# $chat_url + +# filtered further down in the code +# $groups +# $XFERgroups +# $campaigns +# $qc_campaigns +# $qc_groups +# $qc_statuses +# $qc_lists +# $shift_weekdays +# $group_shifts +# $phone_numbers +# $list_active_change +# $reports_use_slave_db +# $custom_reports_use_slave_db +# $allowed_reports +# $allowed_custom_reports +# $tables_use_alt_log_db +# $admin_viewable_groups +# $admin_viewable_call_times +# $territory_reset +# $max_inbound_filter_statuses +# $max_inbound_filter_ingroups +# $included_campaigns +# $included_inbound_groups +# $allowed_queue_groups +# $queue_groups ### VARIABLES optionally filtered: ### @@ -5821,12 +5881,13 @@ if ($SSscript_remove_js > 0) # 220215-1431 - Additional XSS script text variable filtering # 220217-1727 - Added agent_hide_hangup system and campaign settings # 220217-2022 - Added input variable filtering +# 220218-1656 - Added allow_web_debug system setting to disable $DB output by default # # make sure you have added a user to the vicidial_users MySQL table with at least user_level 9 to access this page the first time -$admin_version = '2.14-847a'; -$build = '220217-2022'; +$admin_version = '2.14-848a'; +$build = '220218-1656'; $STARTtime = date("U"); $SQLdate = date("Y-m-d H:i:s"); @@ -7202,6 +7263,7 @@ if ( ( (strlen($ADD)>4) and ($ADD < 99998) ) or ($ADD==3) or (($ADD>20) and ($AD $xfer_groups .= " $XFERgroups[$p]"; $p++; } + $xfer_groups = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$xfer_groups); $xfer_groupsSQL = preg_replace("/^ | -$/","",$xfer_groups); $xfer_groupsSQL = preg_replace("/ /","','",$xfer_groupsSQL); $xfer_groupsSQL = "WHERE group_id IN('$xfer_groupsSQL')"; @@ -9235,7 +9297,7 @@ if ($ADD==1111) else { */ - echo "\n"; + echo "\n"; # } echo "\n"; echo "\n"; @@ -14289,6 +14351,7 @@ if ($ADD==231111111) $SHIFT_weekdays .= "$shift_weekdays[$p]"; $p++; } + $SHIFT_weekdays = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$SHIFT_weekdays); $stmt="INSERT INTO vicidial_shifts SET shift_id='$shift_id',shift_name='$shift_name',shift_start_time='$shift_start_time',shift_length='$shift_length',report_option='$report_option',shift_weekdays='$SHIFT_weekdays',user_group='$user_group';"; $rslt=mysql_to_mysqli($stmt, $link); if ($DB > 0) {echo "|$stmt|";} @@ -15672,6 +15735,7 @@ if ($ADD=="4A") $new_field_value .= "$multi_array[$k],"; $k++; } + $new_field_value = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_field_value); $max_inbound_filter_statuses = preg_replace("/,$/","",$new_field_value); $k=0; $new_field_value=''; @@ -15682,6 +15746,7 @@ if ($ADD=="4A") $new_field_value .= "$multi_array[$k],"; $k++; } + $new_field_value = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_field_value); $max_inbound_filter_ingroups = preg_replace("/,$/","",$new_field_value); echo "
"._QXZ("USER MODIFIED - ADMIN").": $user\n"; @@ -15961,6 +16026,7 @@ if ($ADD=="4B") $new_field_value .= "$multi_array[$k],"; $k++; } + $new_field_value = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_field_value); $max_inbound_filter_statuses = preg_replace("/,$/","",$new_field_value); $k=0; $new_field_value=''; @@ -15971,6 +16037,7 @@ if ($ADD=="4B") $new_field_value .= "$multi_array[$k],"; $k++; } + $new_field_value = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_field_value); $max_inbound_filter_ingroups = preg_replace("/,$/","",$new_field_value); echo "
"._QXZ("USER MODIFIED - ADMIN").": $user\n"; @@ -16644,6 +16711,7 @@ if ($ADD==41) $list_active_change_ct = count($list_active_change); while ($p < $list_active_change_ct) { + $list_active_change[$p] = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$list_active_change[$p]); $LIST_ACTIVATE .= "'$list_active_change[$p]',"; $p++; } @@ -17024,6 +17092,7 @@ if ($ADD==44) $list_active_change_ct = count($list_active_change); while ($p < $list_active_change_ct) { + $list_active_change[$p] = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$list_active_change[$p]); $LIST_ACTIVATE .= "'$list_active_change[$p]',"; $p++; } @@ -17240,6 +17309,8 @@ if ($ADD==48) if (strlen($QC_statuses)>0) {$QC_statuses .= " -";} if (strlen($QC_lists)>0) {$QC_lists .= " -";} + $QC_statuses = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$QC_statuses); + $QC_lists = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$QC_lists); echo "
"._QXZ("QC SETTINGS MODIFIED").": $campaign_id\n"; @@ -17634,6 +17705,7 @@ if ($ADD==411) $TERR_RESET .= "'$territory_reset[$p]',"; $p++; } + $TERR_RESET = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$TERR_RESET); $TERR_RESET = preg_replace("/,$/",'',$TERR_RESET); if (strlen($TERR_RESET) > 1) { @@ -17840,7 +17912,8 @@ if ($ADD==4111 || $ADD==4811 || $ADD==4911) if (strlen($QC_statuses)>0) {$QC_statuses .= " -";} if (strlen($QC_lists)>0) {$QC_lists .= " -";} - + $QC_statuses = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$QC_statuses); + $QC_lists = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$QC_lists); if ($no_agent_action == "INGROUP") { @@ -18462,6 +18535,7 @@ if ($ADD==411111) $new_field_value .= "$multi_array[$k],"; $k++; } + $new_field_value = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_field_value); $allowed_reports = preg_replace("/,$/","",$new_field_value); # update allowed_camapigns with values that the editor cant see http://www.vicidial.org/VICIDIALforum/viewtopic.php?f=5&t=26101 @@ -18522,7 +18596,8 @@ if ($ADD==411111) $custom_report_str.=$custom_rpt_row[0]."|"; } } - $custom_rpt_SQL=",allowed_custom_reports='$custom_report_str'"; + $custom_report_str = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$custom_report_str); + $custom_rpt_SQL=",allowed_custom_reports='$custom_report_str'"; } $stmt="UPDATE vicidial_user_groups set user_group='$user_group', group_name='$group_name',allowed_campaigns='$campaigns_value',qc_allowed_campaigns='$qc_campaigns_value',qc_allowed_inbound_groups='$qc_groups_value',group_shifts='$GROUP_shifts',forced_timeclock_login='$forced_timeclock_login',shift_enforcement='$shift_enforcement',agent_status_viewable_groups='$VGROUP_vgroups',agent_status_view_time='$agent_status_view_time',agent_call_log_view='$agent_call_log_view',agent_xfer_consultative='$agent_xfer_consultative',agent_xfer_dial_override='$agent_xfer_dial_override',agent_xfer_vm_transfer='$agent_xfer_vm_transfer',agent_xfer_blind_transfer='$agent_xfer_blind_transfer',agent_xfer_dial_with_customer='$agent_xfer_dial_with_customer',agent_xfer_park_customer_dial='$agent_xfer_park_customer_dial',agent_fullscreen='$agent_fullscreen',allowed_reports='$allowed_reports'$custom_rpt_SQL,webphone_url_override='" . mysqli_real_escape_string($link, $webphone_url_override) . "',webphone_systemkey_override='$webphone_systemkey_override',webphone_dialpad_override='$webphone_dialpad_override',admin_viewable_groups='$Vadmin_viewable_groups',admin_viewable_call_times='$Vadmin_viewable_call_times',agent_allowed_chat_groups='$VGROUP_chatgroups',agent_xfer_park_3way='$agent_xfer_park_3way',admin_ip_list='$admin_ip_list',agent_ip_list='$agent_ip_list',api_ip_list='$api_ip_list',webphone_layout='" . mysqli_real_escape_string($link, $webphone_layout) . "',reports_header_override='$reports_header_override',admin_home_url='" . mysqli_real_escape_string($link, $admin_home_url) . "',allowed_queue_groups='$queue_groups_value' where user_group='$OLDuser_group';"; $rslt=mysql_to_mysqli($stmt, $link); @@ -18893,6 +18968,7 @@ if ($ADD==431111111) $SHIFT_weekdays .= "$shift_weekdays[$p]"; $p++; } + $SHIFT_weekdays = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$SHIFT_weekdays); $shift_start_time = preg_replace('/\D/', '', $shift_start_time); $stmt="UPDATE vicidial_shifts set shift_name='$shift_name', shift_start_time='$shift_start_time', shift_length='$shift_length', shift_weekdays='$SHIFT_weekdays',report_option='$report_option',user_group='$user_group',report_rank='$report_rank' where shift_id='$shift_id';"; $rslt=mysql_to_mysqli($stmt, $link); @@ -20358,6 +20434,7 @@ if ($ADD==411111111111111) $new_field_value .= "$multi_array[$k],"; $k++; } + $new_field_value = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_field_value); $reports_use_slave_db = preg_replace("/,$/","",$new_field_value); $m=0; @@ -20368,6 +20445,7 @@ if ($ADD==411111111111111) $new_altlog_value .= "$altlog_array[$m],"; $m++; } + $new_altlog_value = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$new_altlog_value); $tables_use_alt_log_db = preg_replace("/,$/","",$new_altlog_value); $custom_dialplanSQL=''; @@ -20391,6 +20469,7 @@ if ($ADD==411111111111111) $custom_reports_slave_SQL=''; } $custom_reports_slave_SQL=substr($custom_reports_slave_SQL,0,-1); + $custom_reports_slave_SQL = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$custom_reports_slave_SQL); $custom_reports_slave_SQL=",custom_reports_use_slave_db='$custom_reports_slave_SQL'"; } $stmt="SELECT count(*) from servers where active='Y' and active_asterisk_server='Y';"; @@ -20414,7 +20493,7 @@ if ($ADD==411111111111111) } } - $stmt="UPDATE system_settings set use_non_latin='$use_non_latin',webroot_writable='$webroot_writable',enable_queuemetrics_logging='$enable_queuemetrics_logging',queuemetrics_server_ip='$queuemetrics_server_ip',queuemetrics_dbname='$queuemetrics_dbname',queuemetrics_login='$queuemetrics_login',queuemetrics_pass='$queuemetrics_pass',queuemetrics_url='" . mysqli_real_escape_string($link, $queuemetrics_url) . "',queuemetrics_log_id='$queuemetrics_log_id',queuemetrics_eq_prepend='$queuemetrics_eq_prepend',vicidial_agent_disable='$vicidial_agent_disable',allow_sipsak_messages='$allow_sipsak_messages',admin_home_url='" . mysqli_real_escape_string($link, $admin_home_url) . "',enable_agc_xfer_log='$enable_agc_xfer_log',timeclock_end_of_day='$timeclock_end_of_day',vdc_header_date_format='$vdc_header_date_format',vdc_customer_date_format='$vdc_customer_date_format',vdc_header_phone_format='$vdc_header_phone_format',vdc_agent_api_active='$vdc_agent_api_active',enable_vtiger_integration='$enable_vtiger_integration',vtiger_server_ip='$vtiger_server_ip',vtiger_dbname='$vtiger_dbname',vtiger_login='$vtiger_login',vtiger_pass='$vtiger_pass',vtiger_url='" . mysqli_real_escape_string($link, $vtiger_url) . "',qc_features_active='$qc_features_active',outbound_autodial_active='$outbound_autodial_active',outbound_calls_per_second='$outbound_calls_per_second',enable_tts_integration='$enable_tts_integration',agentonly_callback_campaign_lock='$agentonly_callback_campaign_lock',sounds_central_control_active='$sounds_central_control_active',sounds_web_server='$sounds_web_server',sounds_web_directory='$sounds_web_directory',active_voicemail_server='$active_voicemail_server',auto_dial_limit='$auto_dial_limit',user_territories_active='$user_territories_active',allow_custom_dialplan='$allow_custom_dialplan',enable_second_webform='$enable_second_webform',default_webphone='$default_webphone',default_external_server_ip='$default_external_server_ip',webphone_url='" . mysqli_real_escape_string($link, $webphone_url) . "',enable_agc_dispo_log='$enable_agc_dispo_log',queuemetrics_loginout='$queuemetrics_loginout',callcard_enabled='$callcard_enabled',queuemetrics_callstatus='$queuemetrics_callstatus',default_codecs='$default_codecs',admin_web_directory='$admin_web_directory',label_title='$label_title',label_first_name='$label_first_name',label_middle_initial='$label_middle_initial',label_last_name='$label_last_name',label_address1='$label_address1',label_address2='$label_address2',label_address3='$label_address3',label_city='$label_city',label_state='$label_state',label_province='$label_province',label_postal_code='$label_postal_code',label_vendor_lead_code='$label_vendor_lead_code',label_gender='$label_gender',label_phone_number='$label_phone_number',label_phone_code='$label_phone_code',label_alt_phone='$label_alt_phone',label_security_phrase='$label_security_phrase',label_email='$label_email',label_comments='$label_comments',label_lead_id='$label_lead_id',label_list_id='$label_list_id',label_entry_date='$label_entry_date',label_gmt_offset_now='$label_gmt_offset_now',label_source_id='$label_source_id',label_called_since_last_reset='$label_called_since_last_reset',label_status='$label_status',label_user='$label_user',label_date_of_birth='$label_date_of_birth',label_country_code='$label_country_code',label_last_local_call_time='$label_last_local_call_time',label_called_count='$label_called_count',label_rank='$label_rank',label_owner='$label_owner',label_entry_list_id='$label_entry_list_id',custom_fields_enabled='$custom_fields_enabled',slave_db_server='$slave_db_server',reports_use_slave_db='$reports_use_slave_db'$custom_reports_slave_SQL,webphone_systemkey='$webphone_systemkey',first_login_trigger='$first_login_trigger',default_phone_registration_password='$default_phone_registration_password',default_phone_login_password='$default_phone_login_password',default_server_password='$default_server_password',admin_modify_refresh='$admin_modify_refresh',nocache_admin='$nocache_admin',generate_cross_server_exten='$generate_cross_server_exten',queuemetrics_addmember_enabled='$queuemetrics_addmember_enabled',queuemetrics_dispo_pause='$queuemetrics_dispo_pause',label_hide_field_logs='$label_hide_field_logs',queuemetrics_pe_phone_append='$queuemetrics_pe_phone_append',test_campaign_calls='$test_campaign_calls',agents_calls_reset='$agents_calls_reset',default_voicemail_timezone='$default_voicemail_timezone',default_local_gmt='$default_local_gmt',noanswer_log='$noanswer_log',alt_log_server_ip='$alt_log_server_ip',alt_log_dbname='$alt_log_dbname',alt_log_login='$alt_log_login',alt_log_pass='$alt_log_pass',tables_use_alt_log_db='$tables_use_alt_log_db',did_agent_log='$did_agent_log',campaign_cid_areacodes_enabled='$campaign_cid_areacodes_enabled',pllb_grouping_limit='$pllb_grouping_limit',did_ra_extensions_enabled='$did_ra_extensions_enabled',expanded_list_stats='$expanded_list_stats',contacts_enabled='$contacts_enabled',call_menu_qualify_enabled='$call_menu_qualify_enabled',admin_list_counts='$admin_list_counts',allow_voicemail_greeting='$allow_voicemail_greeting',queuemetrics_socket='$queuemetrics_socket',queuemetrics_socket_url='$queuemetrics_socket_url',enhanced_disconnect_logging='$enhanced_disconnect_logging',allow_emails='$allow_emails',level_8_disable_add='$level_8_disable_add',queuemetrics_record_hold='$queuemetrics_record_hold',country_code_list_stats='$country_code_list_stats',queuemetrics_pause_type='$queuemetrics_pause_type',frozen_server_call_clear='$frozen_server_call_clear',callback_time_24hour='$callback_time_24hour',enable_languages='$enable_languages',language_method='$language_method',meetme_enter_login_filename='$meetme_enter_login_filename',meetme_enter_leave3way_filename='$meetme_enter_leave3way_filename',enable_did_entry_list_id='$enable_did_entry_list_id',enable_third_webform='$enable_third_webform',allow_chats='$allow_chats',chat_url='$chat_url',chat_timeout='$chat_timeout',agent_debug_logging='$agent_debug_logging',default_language='$default_language',agent_whisper_enabled='$agent_whisper_enabled',user_hide_realtime_enabled='$user_hide_realtime_enabled',usacan_phone_dialcode_fix='$usacan_phone_dialcode_fix',cache_carrier_stats_realtime='$cache_carrier_stats_realtime',log_recording_access='$log_recording_access',report_default_format='$report_default_format',alt_ivr_logging='$alt_ivr_logging',default_phone_code='$default_phone_code',admin_row_click='$admin_row_click',admin_screen_colors='$admin_screen_colors',ofcom_uk_drop_calc='$ofcom_uk_drop_calc',agent_screen_colors='$agent_screen_colors',script_remove_js='$script_remove_js',manual_auto_next='$manual_auto_next',user_new_lead_limit='$user_new_lead_limit',agent_xfer_park_3way='$agent_xfer_park_3way',agent_soundboards='$agent_soundboards',web_loader_phone_length='$web_loader_phone_length',agent_script='$agent_script',agent_chat_screen_colors='$agent_chat_screen_colors',enable_auto_reports='$enable_auto_reports',enable_pause_code_limits='$enable_pause_code_limits',enable_drop_lists='$enable_drop_lists',allow_ip_lists='$allow_ip_lists',system_ip_blacklist='$system_ip_blacklist',agent_push_events='$agent_push_events',agent_push_url='$agent_push_url',hide_inactive_lists='$hide_inactive_lists',allow_manage_active_lists='$allow_manage_active_lists',expired_lists_inactive='$expired_lists_inactive',did_system_filter='$did_system_filter',anyone_callback_inactive_lists='$anyone_callback_inactive_lists',enable_gdpr_download_deletion='$enable_gdpr_download_deletion',source_id_display='$source_id_display',agent_logout_link='$agent_logout_link',manual_dial_validation='$manual_dial_validation',mute_recordings='$mute_recordings',user_admin_redirect='$user_admin_redirect',list_status_modification_confirmation='$list_status_modification_confirmation',sip_event_logging='$sip_event_logging',call_quota_lead_ranking='$call_quota_lead_ranking',enable_second_script='$enable_second_script',enable_first_webform='$enable_first_webform',recording_buttons='$recording_buttons',opensips_cid_name='$opensips_cid_name',require_password_length='$require_password_length',user_account_emails='$user_account_emails',outbound_cid_any='$outbound_cid_any',entries_per_page='$entries_per_page',browser_call_alerts='$browser_call_alerts',queuemetrics_pausereason='$queuemetrics_pausereason',inbound_answer_config='$inbound_answer_config',enable_international_dncs='$enable_international_dncs',web_loader_phone_strip='$web_loader_phone_strip',manual_dial_phone_strip='$manual_dial_phone_strip',daily_call_count_limit='$daily_call_count_limit',allow_shared_dial='$allow_shared_dial',agent_search_method='$agent_search_method',phone_defaults_container='$phone_defaults_container',qc_claim_limit='$qc_claim_limit',qc_expire_days='$qc_expire_days',two_factor_auth_hours='$two_factor_auth_hours',two_factor_container='$two_factor_container',agent_hidden_sound='$agent_hidden_sound',agent_hidden_sound_volume='$agent_hidden_sound_volume',agent_hidden_sound_seconds='$agent_hidden_sound_seconds',agent_screen_timer='$agent_screen_timer',call_limit_24hour='$call_limit_24hour',allowed_sip_stacks='$allowed_sip_stacks',agent_hide_hangup='$agent_hide_hangup'$custom_dialplanSQL;"; + $stmt="UPDATE system_settings set use_non_latin='$use_non_latin',webroot_writable='$webroot_writable',enable_queuemetrics_logging='$enable_queuemetrics_logging',queuemetrics_server_ip='$queuemetrics_server_ip',queuemetrics_dbname='$queuemetrics_dbname',queuemetrics_login='$queuemetrics_login',queuemetrics_pass='$queuemetrics_pass',queuemetrics_url='" . mysqli_real_escape_string($link, $queuemetrics_url) . "',queuemetrics_log_id='$queuemetrics_log_id',queuemetrics_eq_prepend='$queuemetrics_eq_prepend',vicidial_agent_disable='$vicidial_agent_disable',allow_sipsak_messages='$allow_sipsak_messages',admin_home_url='" . mysqli_real_escape_string($link, $admin_home_url) . "',enable_agc_xfer_log='$enable_agc_xfer_log',timeclock_end_of_day='$timeclock_end_of_day',vdc_header_date_format='$vdc_header_date_format',vdc_customer_date_format='$vdc_customer_date_format',vdc_header_phone_format='$vdc_header_phone_format',vdc_agent_api_active='$vdc_agent_api_active',enable_vtiger_integration='$enable_vtiger_integration',vtiger_server_ip='$vtiger_server_ip',vtiger_dbname='$vtiger_dbname',vtiger_login='$vtiger_login',vtiger_pass='$vtiger_pass',vtiger_url='" . mysqli_real_escape_string($link, $vtiger_url) . "',qc_features_active='$qc_features_active',outbound_autodial_active='$outbound_autodial_active',outbound_calls_per_second='$outbound_calls_per_second',enable_tts_integration='$enable_tts_integration',agentonly_callback_campaign_lock='$agentonly_callback_campaign_lock',sounds_central_control_active='$sounds_central_control_active',sounds_web_server='$sounds_web_server',sounds_web_directory='$sounds_web_directory',active_voicemail_server='$active_voicemail_server',auto_dial_limit='$auto_dial_limit',user_territories_active='$user_territories_active',allow_custom_dialplan='$allow_custom_dialplan',enable_second_webform='$enable_second_webform',default_webphone='$default_webphone',default_external_server_ip='$default_external_server_ip',webphone_url='" . mysqli_real_escape_string($link, $webphone_url) . "',enable_agc_dispo_log='$enable_agc_dispo_log',queuemetrics_loginout='$queuemetrics_loginout',callcard_enabled='$callcard_enabled',queuemetrics_callstatus='$queuemetrics_callstatus',default_codecs='$default_codecs',admin_web_directory='$admin_web_directory',label_title='$label_title',label_first_name='$label_first_name',label_middle_initial='$label_middle_initial',label_last_name='$label_last_name',label_address1='$label_address1',label_address2='$label_address2',label_address3='$label_address3',label_city='$label_city',label_state='$label_state',label_province='$label_province',label_postal_code='$label_postal_code',label_vendor_lead_code='$label_vendor_lead_code',label_gender='$label_gender',label_phone_number='$label_phone_number',label_phone_code='$label_phone_code',label_alt_phone='$label_alt_phone',label_security_phrase='$label_security_phrase',label_email='$label_email',label_comments='$label_comments',label_lead_id='$label_lead_id',label_list_id='$label_list_id',label_entry_date='$label_entry_date',label_gmt_offset_now='$label_gmt_offset_now',label_source_id='$label_source_id',label_called_since_last_reset='$label_called_since_last_reset',label_status='$label_status',label_user='$label_user',label_date_of_birth='$label_date_of_birth',label_country_code='$label_country_code',label_last_local_call_time='$label_last_local_call_time',label_called_count='$label_called_count',label_rank='$label_rank',label_owner='$label_owner',label_entry_list_id='$label_entry_list_id',custom_fields_enabled='$custom_fields_enabled',slave_db_server='$slave_db_server',reports_use_slave_db='$reports_use_slave_db'$custom_reports_slave_SQL,webphone_systemkey='$webphone_systemkey',first_login_trigger='$first_login_trigger',default_phone_registration_password='$default_phone_registration_password',default_phone_login_password='$default_phone_login_password',default_server_password='$default_server_password',admin_modify_refresh='$admin_modify_refresh',nocache_admin='$nocache_admin',generate_cross_server_exten='$generate_cross_server_exten',queuemetrics_addmember_enabled='$queuemetrics_addmember_enabled',queuemetrics_dispo_pause='$queuemetrics_dispo_pause',label_hide_field_logs='$label_hide_field_logs',queuemetrics_pe_phone_append='$queuemetrics_pe_phone_append',test_campaign_calls='$test_campaign_calls',agents_calls_reset='$agents_calls_reset',default_voicemail_timezone='$default_voicemail_timezone',default_local_gmt='$default_local_gmt',noanswer_log='$noanswer_log',alt_log_server_ip='$alt_log_server_ip',alt_log_dbname='$alt_log_dbname',alt_log_login='$alt_log_login',alt_log_pass='$alt_log_pass',tables_use_alt_log_db='$tables_use_alt_log_db',did_agent_log='$did_agent_log',campaign_cid_areacodes_enabled='$campaign_cid_areacodes_enabled',pllb_grouping_limit='$pllb_grouping_limit',did_ra_extensions_enabled='$did_ra_extensions_enabled',expanded_list_stats='$expanded_list_stats',contacts_enabled='$contacts_enabled',call_menu_qualify_enabled='$call_menu_qualify_enabled',admin_list_counts='$admin_list_counts',allow_voicemail_greeting='$allow_voicemail_greeting',queuemetrics_socket='$queuemetrics_socket',queuemetrics_socket_url='$queuemetrics_socket_url',enhanced_disconnect_logging='$enhanced_disconnect_logging',allow_emails='$allow_emails',level_8_disable_add='$level_8_disable_add',queuemetrics_record_hold='$queuemetrics_record_hold',country_code_list_stats='$country_code_list_stats',queuemetrics_pause_type='$queuemetrics_pause_type',frozen_server_call_clear='$frozen_server_call_clear',callback_time_24hour='$callback_time_24hour',enable_languages='$enable_languages',language_method='$language_method',meetme_enter_login_filename='$meetme_enter_login_filename',meetme_enter_leave3way_filename='$meetme_enter_leave3way_filename',enable_did_entry_list_id='$enable_did_entry_list_id',enable_third_webform='$enable_third_webform',allow_chats='$allow_chats',chat_url='" . mysqli_real_escape_string($link, $chat_url) . "',chat_timeout='$chat_timeout',agent_debug_logging='$agent_debug_logging',default_language='$default_language',agent_whisper_enabled='$agent_whisper_enabled',user_hide_realtime_enabled='$user_hide_realtime_enabled',usacan_phone_dialcode_fix='$usacan_phone_dialcode_fix',cache_carrier_stats_realtime='$cache_carrier_stats_realtime',log_recording_access='$log_recording_access',report_default_format='$report_default_format',alt_ivr_logging='$alt_ivr_logging',default_phone_code='$default_phone_code',admin_row_click='$admin_row_click',admin_screen_colors='$admin_screen_colors',ofcom_uk_drop_calc='$ofcom_uk_drop_calc',agent_screen_colors='$agent_screen_colors',script_remove_js='$script_remove_js',manual_auto_next='$manual_auto_next',user_new_lead_limit='$user_new_lead_limit',agent_xfer_park_3way='$agent_xfer_park_3way',agent_soundboards='$agent_soundboards',web_loader_phone_length='$web_loader_phone_length',agent_script='$agent_script',agent_chat_screen_colors='$agent_chat_screen_colors',enable_auto_reports='$enable_auto_reports',enable_pause_code_limits='$enable_pause_code_limits',enable_drop_lists='$enable_drop_lists',allow_ip_lists='$allow_ip_lists',system_ip_blacklist='$system_ip_blacklist',agent_push_events='$agent_push_events',agent_push_url='$agent_push_url',hide_inactive_lists='$hide_inactive_lists',allow_manage_active_lists='$allow_manage_active_lists',expired_lists_inactive='$expired_lists_inactive',did_system_filter='$did_system_filter',anyone_callback_inactive_lists='$anyone_callback_inactive_lists',enable_gdpr_download_deletion='$enable_gdpr_download_deletion',source_id_display='$source_id_display',agent_logout_link='$agent_logout_link',manual_dial_validation='$manual_dial_validation',mute_recordings='$mute_recordings',user_admin_redirect='$user_admin_redirect',list_status_modification_confirmation='$list_status_modification_confirmation',sip_event_logging='$sip_event_logging',call_quota_lead_ranking='$call_quota_lead_ranking',enable_second_script='$enable_second_script',enable_first_webform='$enable_first_webform',recording_buttons='$recording_buttons',opensips_cid_name='$opensips_cid_name',require_password_length='$require_password_length',user_account_emails='$user_account_emails',outbound_cid_any='$outbound_cid_any',entries_per_page='$entries_per_page',browser_call_alerts='$browser_call_alerts',queuemetrics_pausereason='$queuemetrics_pausereason',inbound_answer_config='$inbound_answer_config',enable_international_dncs='$enable_international_dncs',web_loader_phone_strip='$web_loader_phone_strip',manual_dial_phone_strip='$manual_dial_phone_strip',daily_call_count_limit='$daily_call_count_limit',allow_shared_dial='$allow_shared_dial',agent_search_method='$agent_search_method',phone_defaults_container='$phone_defaults_container',qc_claim_limit='$qc_claim_limit',qc_expire_days='$qc_expire_days',two_factor_auth_hours='$two_factor_auth_hours',two_factor_container='$two_factor_container',agent_hidden_sound='$agent_hidden_sound',agent_hidden_sound_volume='$agent_hidden_sound_volume',agent_hidden_sound_seconds='$agent_hidden_sound_seconds',agent_screen_timer='$agent_screen_timer',call_limit_24hour='$call_limit_24hour',allowed_sip_stacks='$allowed_sip_stacks',agent_hide_hangup='$agent_hide_hangup',allow_web_debug='$allow_web_debug'$custom_dialplanSQL;"; $rslt=mysql_to_mysqli($stmt, $link); $update_main_rows=mysqli_affected_rows($link); if ($DB) {echo "$update_main_rows|$stmt|\n";} @@ -41645,7 +41724,7 @@ if ($ADD==311111111111111) $ALLagent_count = $rowx[2]; } - $stmt="SELECT version,install_date,use_non_latin,webroot_writable,enable_queuemetrics_logging,queuemetrics_server_ip,queuemetrics_dbname,queuemetrics_login,queuemetrics_pass,queuemetrics_url,queuemetrics_log_id,queuemetrics_eq_prepend,vicidial_agent_disable,allow_sipsak_messages,admin_home_url,enable_agc_xfer_log,db_schema_version,auto_user_add_value,timeclock_end_of_day,timeclock_last_reset_date,vdc_header_date_format,vdc_customer_date_format,vdc_header_phone_format,vdc_agent_api_active,qc_last_pull_time,enable_vtiger_integration,vtiger_server_ip,vtiger_dbname,vtiger_login,vtiger_pass,vtiger_url,qc_features_active,outbound_autodial_active,outbound_calls_per_second,enable_tts_integration,agentonly_callback_campaign_lock,sounds_central_control_active,sounds_web_server,sounds_web_directory,active_voicemail_server,auto_dial_limit,user_territories_active,allow_custom_dialplan,db_schema_update_date,enable_second_webform,default_webphone,default_external_server_ip,webphone_url,enable_agc_dispo_log,custom_dialplan_entry,queuemetrics_loginout,callcard_enabled,queuemetrics_callstatus,default_codecs,admin_web_directory,label_title,label_first_name,label_middle_initial,label_last_name,label_address1,label_address2,label_address3,label_city,label_state,label_province,label_postal_code,label_vendor_lead_code,label_gender,label_phone_number,label_phone_code,label_alt_phone,label_security_phrase,label_email,label_comments,custom_fields_enabled,slave_db_server,reports_use_slave_db,webphone_systemkey,first_login_trigger,default_phone_registration_password,default_phone_login_password,default_server_password,admin_modify_refresh,nocache_admin,generate_cross_server_exten,queuemetrics_addmember_enabled,queuemetrics_dispo_pause,label_hide_field_logs,queuemetrics_pe_phone_append,test_campaign_calls,agents_calls_reset,default_voicemail_timezone,default_local_gmt,noanswer_log,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,did_agent_log,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,queuemetrics_socket,queuemetrics_socket_url,enhanced_disconnect_logging,allow_emails,level_8_disable_add,pass_hash_enabled,pass_key,pass_cost,disable_auto_dial,queuemetrics_record_hold,country_code_list_stats,reload_timestamp,queuemetrics_pause_type,frozen_server_call_clear,callback_time_24hour,allow_chats,chat_url,chat_timeout,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,enable_did_entry_list_id,enable_third_webform,agent_debug_logging,default_language,agent_whisper_enabled,user_hide_realtime_enabled,usacan_phone_dialcode_fix,cache_carrier_stats_realtime,oldest_logs_date,log_recording_access,report_default_format,alt_ivr_logging,default_phone_code,admin_row_click,admin_screen_colors,ofcom_uk_drop_calc,agent_screen_colors,script_remove_js,manual_auto_next,user_new_lead_limit,agent_xfer_park_3way,rec_prompt_count,agent_soundboards,web_loader_phone_length,agent_script,agent_chat_screen_colors,enable_auto_reports,enable_pause_code_limits,enable_drop_lists,allow_ip_lists,system_ip_blacklist,agent_push_events,agent_push_url,hide_inactive_lists,allow_manage_active_lists,expired_lists_inactive,did_system_filter,anyone_callback_inactive_lists,enable_gdpr_download_deletion,source_id_display,agent_logout_link,manual_dial_validation,mute_recordings,user_admin_redirect,list_status_modification_confirmation,sip_event_logging,call_quota_lead_ranking,enable_second_script,enable_first_webform,recording_buttons,opensips_cid_name,require_password_length,user_account_emails,outbound_cid_any,entries_per_page,browser_call_alerts,queuemetrics_pausereason,inbound_answer_config,enable_international_dncs,web_loader_phone_strip,manual_dial_phone_strip,daily_call_count_limit,allow_shared_dial,agent_search_method,phone_defaults_container,qc_claim_limit,qc_expire_days,two_factor_auth_hours,two_factor_container,agent_hidden_sound,agent_hidden_sound_volume,agent_hidden_sound_seconds,agent_screen_timer,label_lead_id,label_list_id,label_entry_date,label_gmt_offset_now,label_source_id,label_called_since_last_reset,label_status,label_user,label_date_of_birth,label_country_code,label_last_local_call_time,label_called_count,label_rank,label_owner,label_entry_list_id,call_limit_24hour,allowed_sip_stacks,agent_hide_hangup from system_settings;"; + $stmt="SELECT version,install_date,use_non_latin,webroot_writable,enable_queuemetrics_logging,queuemetrics_server_ip,queuemetrics_dbname,queuemetrics_login,queuemetrics_pass,queuemetrics_url,queuemetrics_log_id,queuemetrics_eq_prepend,vicidial_agent_disable,allow_sipsak_messages,admin_home_url,enable_agc_xfer_log,db_schema_version,auto_user_add_value,timeclock_end_of_day,timeclock_last_reset_date,vdc_header_date_format,vdc_customer_date_format,vdc_header_phone_format,vdc_agent_api_active,qc_last_pull_time,enable_vtiger_integration,vtiger_server_ip,vtiger_dbname,vtiger_login,vtiger_pass,vtiger_url,qc_features_active,outbound_autodial_active,outbound_calls_per_second,enable_tts_integration,agentonly_callback_campaign_lock,sounds_central_control_active,sounds_web_server,sounds_web_directory,active_voicemail_server,auto_dial_limit,user_territories_active,allow_custom_dialplan,db_schema_update_date,enable_second_webform,default_webphone,default_external_server_ip,webphone_url,enable_agc_dispo_log,custom_dialplan_entry,queuemetrics_loginout,callcard_enabled,queuemetrics_callstatus,default_codecs,admin_web_directory,label_title,label_first_name,label_middle_initial,label_last_name,label_address1,label_address2,label_address3,label_city,label_state,label_province,label_postal_code,label_vendor_lead_code,label_gender,label_phone_number,label_phone_code,label_alt_phone,label_security_phrase,label_email,label_comments,custom_fields_enabled,slave_db_server,reports_use_slave_db,webphone_systemkey,first_login_trigger,default_phone_registration_password,default_phone_login_password,default_server_password,admin_modify_refresh,nocache_admin,generate_cross_server_exten,queuemetrics_addmember_enabled,queuemetrics_dispo_pause,label_hide_field_logs,queuemetrics_pe_phone_append,test_campaign_calls,agents_calls_reset,default_voicemail_timezone,default_local_gmt,noanswer_log,alt_log_server_ip,alt_log_dbname,alt_log_login,alt_log_pass,tables_use_alt_log_db,did_agent_log,campaign_cid_areacodes_enabled,pllb_grouping_limit,did_ra_extensions_enabled,expanded_list_stats,contacts_enabled,call_menu_qualify_enabled,admin_list_counts,allow_voicemail_greeting,svn_revision,queuemetrics_socket,queuemetrics_socket_url,enhanced_disconnect_logging,allow_emails,level_8_disable_add,pass_hash_enabled,pass_key,pass_cost,disable_auto_dial,queuemetrics_record_hold,country_code_list_stats,reload_timestamp,queuemetrics_pause_type,frozen_server_call_clear,callback_time_24hour,allow_chats,chat_url,chat_timeout,enable_languages,language_method,meetme_enter_login_filename,meetme_enter_leave3way_filename,enable_did_entry_list_id,enable_third_webform,agent_debug_logging,default_language,agent_whisper_enabled,user_hide_realtime_enabled,usacan_phone_dialcode_fix,cache_carrier_stats_realtime,oldest_logs_date,log_recording_access,report_default_format,alt_ivr_logging,default_phone_code,admin_row_click,admin_screen_colors,ofcom_uk_drop_calc,agent_screen_colors,script_remove_js,manual_auto_next,user_new_lead_limit,agent_xfer_park_3way,rec_prompt_count,agent_soundboards,web_loader_phone_length,agent_script,agent_chat_screen_colors,enable_auto_reports,enable_pause_code_limits,enable_drop_lists,allow_ip_lists,system_ip_blacklist,agent_push_events,agent_push_url,hide_inactive_lists,allow_manage_active_lists,expired_lists_inactive,did_system_filter,anyone_callback_inactive_lists,enable_gdpr_download_deletion,source_id_display,agent_logout_link,manual_dial_validation,mute_recordings,user_admin_redirect,list_status_modification_confirmation,sip_event_logging,call_quota_lead_ranking,enable_second_script,enable_first_webform,recording_buttons,opensips_cid_name,require_password_length,user_account_emails,outbound_cid_any,entries_per_page,browser_call_alerts,queuemetrics_pausereason,inbound_answer_config,enable_international_dncs,web_loader_phone_strip,manual_dial_phone_strip,daily_call_count_limit,allow_shared_dial,agent_search_method,phone_defaults_container,qc_claim_limit,qc_expire_days,two_factor_auth_hours,two_factor_container,agent_hidden_sound,agent_hidden_sound_volume,agent_hidden_sound_seconds,agent_screen_timer,label_lead_id,label_list_id,label_entry_date,label_gmt_offset_now,label_source_id,label_called_since_last_reset,label_status,label_user,label_date_of_birth,label_country_code,label_last_local_call_time,label_called_count,label_rank,label_owner,label_entry_list_id,call_limit_24hour,allowed_sip_stacks,agent_hide_hangup,allow_web_debug from system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $version = $row[0]; @@ -41870,6 +41949,7 @@ if ($ADD==311111111111111) $call_limit_24hour = $row[219]; $allowed_sip_stacks = $row[220]; $agent_hide_hangup = $row[221]; + $allow_web_debug = $row[222]; if ($pass_hash_enabled > 0) {$pass_hash_enabled = 'ENABLED';} else {$pass_hash_enabled = 'DISABLED';} @@ -42257,6 +42337,8 @@ if ($ADD==311111111111111) echo ""._QXZ("Admin Lead Source ID Display").": $NWB#settings-source_id_display$NWE\n"; + echo ""._QXZ("Allow Web DB Debug").": $NWB#settings-allow_web_debug$NWE\n"; + echo ""._QXZ("Agent Screen Debug Logging").": $NWB#settings-agent_debug_logging$NWE\n"; echo ""._QXZ("Agent Screen Timer").": $NWB#settings-agent_screen_timer$NWE\n"; diff --git a/www/vicidial/admin_lists_custom.php b/www/vicidial/admin_lists_custom.php index 5c2f8cc3..245ac16a 100644 --- a/www/vicidial/admin_lists_custom.php +++ b/www/vicidial/admin_lists_custom.php @@ -57,10 +57,11 @@ # 210304-2039 - Added option to "re-rank" field ranks when adding/updating a field in the middle of the form # 210311-2338 - Added BUTTON field type and 2FA # 220217-2004 - Added input variable filtering +# 220221-0910 - Added allow_web_debug system setting # -$admin_version = '2.14-48'; -$build = '220217-2004'; +$admin_version = '2.14-49'; +$build = '220221-0910'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -128,9 +129,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,custom_fields_enabled,enable_languages,language_method,active_modules FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,custom_fields_enabled,enable_languages,language_method,active_modules,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -143,7 +144,9 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[5]; $SSlanguage_method = $row[6]; $SSactive_modules = $row[7]; + $SSallow_web_debug = $row[8]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -160,47 +163,54 @@ if ( (strlen($field_size) < 1) or ($field_size < 1) ) if ( (strlen($field_max) < 1) or ($field_max < 1) ) {$field_max = 1;} +$list_id = preg_replace('/[^0-9]/','',$list_id); +$field_id = preg_replace('/[^0-9]/','',$field_id); +$field_rank = preg_replace('/[^0-9]/','',$field_rank); +$field_size = preg_replace('/[^0-9]/','',$field_size); +$field_max = preg_replace('/[^0-9]/','',$field_max); +$field_order = preg_replace('/[^0-9]/','',$field_order); +$source_list_id = preg_replace('/[^0-9]/','',$source_list_id); +$field_rerank = preg_replace('/[^_0-9a-zA-Z]/','',$field_rerank); +$field_cost = preg_replace('/[^_0-9a-zA-Z]/','',$field_cost); +$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT); +$field_encrypt = preg_replace('/[^NY]/','',$field_encrypt); +$field_required = preg_replace('/[^_A-Z]/','',$field_required); +$field_duplicate = preg_replace('/[^_A-Z]/','',$field_duplicate); +$field_type = preg_replace('/[^0-9a-zA-Z]/','',$field_type); +$ConFiRm = preg_replace('/[^0-9a-zA-Z]/','',$ConFiRm); +$name_position = preg_replace('/[^0-9a-zA-Z]/','',$name_position); +$multi_position = preg_replace('/[^0-9a-zA-Z]/','',$multi_position); +$copy_option = preg_replace('/[^_0-9a-zA-Z]/','',$copy_option); +$field_show_hide = preg_replace('/[^_0-9a-zA-Z]/','',$field_show_hide); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); - - $list_id = preg_replace('/[^0-9]/','',$list_id); - $field_id = preg_replace('/[^0-9]/','',$field_id); - $field_rank = preg_replace('/[^0-9]/','',$field_rank); - $field_size = preg_replace('/[^0-9]/','',$field_size); - $field_max = preg_replace('/[^0-9]/','',$field_max); - $field_order = preg_replace('/[^0-9]/','',$field_order); - $source_list_id = preg_replace('/[^0-9]/','',$source_list_id); - - $field_required = preg_replace('/[^_A-Z]/','',$field_required); - $field_encrypt = preg_replace('/[^NY]/','',$field_encrypt); - $field_duplicate = preg_replace('/[^_A-Z]/','',$field_duplicate); - - $field_type = preg_replace('/[^0-9a-zA-Z]/','',$field_type); - $ConFiRm = preg_replace('/[^0-9a-zA-Z]/','',$ConFiRm); - $name_position = preg_replace('/[^0-9a-zA-Z]/','',$name_position); - $multi_position = preg_replace('/[^0-9a-zA-Z]/','',$multi_position); - $field_label = preg_replace('/[^_0-9a-zA-Z]/','',$field_label); - $copy_option = preg_replace('/[^_0-9a-zA-Z]/','',$copy_option); - $field_show_hide = preg_replace('/[^_0-9a-zA-Z]/','',$field_show_hide); - $field_name = preg_replace('/[^ \.\,-\_0-9a-zA-Z]/','',$field_name); $field_description = preg_replace('/[^ \.\,-\_0-9a-zA-Z]/','',$field_description); $field_options = preg_replace('/[^ \'\&\.\n\|\,-\_0-9a-zA-Z]/', '',$field_options); if ($field_type != 'SCRIPT') {$field_options = preg_replace('/[^ \.\n\|\,-\_0-9a-zA-Z]/', '',$field_options);} - $field_help = preg_replace('/[^ \'\&\.\n\|\,-\_0-9a-zA-Z]/', '',$field_help); + $field_help = preg_replace('/[^ \'\&\!\?\.\n\|\,-\_0-9a-zA-Z]/', '',$field_help); $field_default = preg_replace('/[^ \.\n\,-\_0-9a-zA-Z]/', '',$field_default); } # end of non_latin else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u','',$PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u','',$PHP_AUTH_PW); + $field_label = preg_replace('/[^_0-9\p{L}]/u','',$field_label); + $field_name = preg_replace('/[^ \.\,-\_0-9\p{L}]/u','',$field_name); + $field_description = preg_replace('/[^ \.\,-\_0-9\p{L}]/u','',$field_description); + $field_options = preg_replace('/[^ \'\&\.\n\|\,-\_0-9\p{L}]/u', '',$field_options); + if ($field_type != 'SCRIPT') + {$field_options = preg_replace('/[^ \.\n\|\,-\_0-9\p{L}]/u', '',$field_options);} + $field_help = preg_replace('/[^ \'\&\!\?\.\n\|\,-\_0-9\p{L}]/u', '',$field_help); + $field_default = preg_replace('/[^ \.\n\,-\_0-9\p{L}]/u', '',$field_default); } -$field_rerank = preg_replace('/[^_0-9a-zA-Z]/','',$field_rerank); $STARTtime = date("U"); $TODAY = date("Y-m-d"); diff --git a/www/vicidial/help_documentation.txt b/www/vicidial/help_documentation.txt index 13d4f634..b4139c05 100644 --- a/www/vicidial/help_documentation.txt +++ b/www/vicidial/help_documentation.txt @@ -1,4 +1,4 @@ -# version: 20220217173801 +# version: 20220218195501 users-user User ID This field is where you put the users ID number, can be up to 8 digits in length, Must be at least 2 characters in length. users-pass Password This field is where you put the users password. Must be at least 2 characters in length. Only letters and numbers are allowed in user passwords. A medium strength user password will be at least 10 characters in length, and a strong user password will be at least 20 characters in length and have letters as well as at least one number. It is recommended that you use a longer password if possible, stringing together several unrelated words with no spaces, and a number somewhere in the string. The maximum size of a password is 100 characters. users-force_change_password Force Change Password If this option is set to Y then the user will be prompted to change their password the next time they log in to the administration webpage or the agent screen. Default is N. @@ -1123,6 +1123,7 @@ settings-expired_lists_inactive Expired Lists Auto Inactive This setting if settings-enable_gdpr_download_deletion Enable GDPR-compliant Data Download Deletion This setting if enabled will allow for the complete download and/or deletion of all customer data for a particular lead, in compliance with the General Data Protection Regulation (GDPR). Default is 0 for disabled. A setting of 1 will enable downloading data, and a setting of 2 will enable not just downloading, but also deletion of data, including any recordings. settings-enable_drop_lists Enable Drop Lists This setting if enabled will make the Drop Lists feature appear under the LISTS menu. This feature set can take dropped call log records and create new leads in a list from multiple inbound groups. Default is 0 for disabled. settings-source_id_display Admin Lead Source ID Display This setting will make the Source ID lead field show up in the Admin Modify Lead screen. Default is 0 for disabled. +settings-allow_web_debug Allow Web DB Debug This option will allow the DB query string option to be used in most web pages on this system to show debug output. Default is 0 for disabled. settings-agent_debug_logging Agent Screen Debug Logging This setting if enabled will log almost all agent screen mouse clicks and AJAX processes triggered by the agent screen. To enable for all agents, set this option to 1. To enable only for one agent on the system, set this option to the user that you want to log. Warning, this feature can log hundreds of entries per phone call, so use with caution. These agent debug records are deleted after 7 days. Default is 0 for disabled. settings-agent_screen_timer Agent Screen Timer This will select the method of JavaScript timer to be used by the Agent Screen. The original method is setTimeout, which maintains the timer directly in JavaScript. An alternative method is EventSource, which uses a script on the server to trigger the timer. You may want to use EventSource if your agents are using a Chromium-based web browser that has limitations on how native JavaScript timers work, although using this method may possibly cause issues if you have a poor network connection to the server or are on an older network or proxy that does not handle streaming web services well. Default is setTimeout settings-enhanced_disconnect_logging Enhanced Disconnect Logging This setting, set to 1, enables logging of calls that get a CONGESTION signal with a cause code of 1, 19, 21, 34 or 38. Setting this to 2 will additionally log calls with cause codes of 18-CHANUNAVAIL and 102. Default is 0 for disabled. diff --git a/www/vicidial/user_stats.php b/www/vicidial/user_stats.php index ec9685e2..d89ce07c 100644 --- a/www/vicidial/user_stats.php +++ b/www/vicidial/user_stats.php @@ -65,6 +65,7 @@ # 210317-0058 - Changed lead-modify page links to javascript because of Chrome # 210319-1338 - Added HELP pop-ups for each section, added agent browser visibility log stats to agent activity section, reformatted most sections # 220122-1701 - Added more variable filtering +# 220221-0916 - Added allow_web_debug system setting # $startMS = microtime(); @@ -117,11 +118,17 @@ if (isset($_GET["NVAuser"])) {$NVAuser=$_GET["NVAuser"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); +$STARTtime = date("U"); +$TODAY = date("Y-m-d"); + +if ( (!isset($begin_date)) or (strlen($begin_date) < 10) ) {$begin_date = $TODAY;} +if ( (!isset($end_date)) or (strlen($end_date) < 10) ) {$end_date = $TODAY;} + ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,user_territories_active,webroot_writable,allow_emails,level_8_disable_add,enable_languages,language_method,log_recording_access,admin_screen_colors,mute_recordings FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,user_territories_active,webroot_writable,allow_emails,level_8_disable_add,enable_languages,language_method,log_recording_access,admin_screen_colors,mute_recordings,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {$MAIN.="$stmt\n";} +#if ($DB) {$MAIN.="$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -139,7 +146,9 @@ if ($qm_conf_ct > 0) $log_recording_access = $row[10]; $SSadmin_screen_colors = $row[11]; $SSmute_recordings = $row[12]; + $SSallow_web_debug = $row[13]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -189,34 +198,33 @@ else } ############# -$STARTtime = date("U"); -$TODAY = date("Y-m-d"); - -if ( (!isset($begin_date)) or (strlen($begin_date) < 10) ) {$begin_date = $TODAY;} -if ( (!isset($end_date)) or (strlen($end_date) < 10) ) {$end_date = $TODAY;} +$did_id = preg_replace('/[^-\+\_0-9a-zA-Z]/',"",$did_id); +$did = preg_replace('/[^-\+\_0-9a-zA-Z]/',"",$did); +$begin_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$begin_date); +$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$end_date); +$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download); +$pause_code_rpt = preg_replace('/[^-_0-9a-zA-Z]/', '', $pause_code_rpt); +$park_rpt = preg_replace('/[^-_0-9a-zA-Z]/', '', $park_rpt); +$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); $NVAuser = preg_replace('/[^-_0-9a-zA-Z]/','',$NVAuser); + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); + $call_status = preg_replace('/[^-_0-9a-zA-Z]/', '', $call_status); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); $NVAuser = preg_replace('/[^-_0-9\p{L}]/u','',$NVAuser); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); + $call_status = preg_replace('/[^-_0-9\p{L}]/u', '', $call_status); } -$did_id = preg_replace("/'|\"|\\\\|;/","",$did_id); -$did = preg_replace("/'|\"|\\\\|;/","",$did); -$begin_date = preg_replace("/'|\"|\\\\|;/","",$begin_date); -$end_date = preg_replace("/'|\"|\\\\|;/","",$end_date); -$user = preg_replace("/'|\"|\\\\|;/","",$user); -$call_status = preg_replace("/'|\"|\\\\|;/","",$call_status); -$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download); -$pause_code_rpt = preg_replace('/[^-_0-9a-zA-Z]/', '', $pause_code_rpt); -$park_rpt = preg_replace('/[^-_0-9a-zA-Z]/', '', $park_rpt); -$search_archived_data = preg_replace('/[^-_0-9a-zA-Z]/', '', $search_archived_data); if ($call_status != "") { diff --git a/www/vicidial/user_status.php b/www/vicidial/user_status.php index 6cd29226..a1ef5dfd 100644 --- a/www/vicidial/user_status.php +++ b/www/vicidial/user_status.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # @@ -41,6 +41,7 @@ # 170228-1623 - Changed emergency logout to hangup all agent session calls, and more logging # 170409-1555 - Added IP List validation code # 170912-1704 - Removed non-functional change-campaign feature +# 220221-0953 - Added allow_web_debug system setting # $startMS = microtime(); @@ -75,13 +76,24 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} +$StarTtimE = date("U"); +$TODAY = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$ip = getenv("REMOTE_ADDR"); +$check_time = ($StarTtimE - 86400); +$date = date("r"); +$ip = getenv("REMOTE_ADDR"); +$browser = getenv("HTTP_USER_AGENT"); +if (!isset($begin_date)) {$begin_date = $TODAY;} +if (!isset($end_date)) {$end_date = $TODAY;} + $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,level_8_disable_add,enable_languages,language_method,allow_chats,admin_screen_colors FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,level_8_disable_add,enable_languages,language_method,allow_chats,admin_screen_colors,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -95,28 +107,32 @@ if ($qm_conf_ct > 0) $SSlanguage_method = $row[6]; $SSallow_chats = $row[7]; $SSadmin_screen_colors = $row[8]; + $SSallow_web_debug = $row[9]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### -if (!isset($begin_date)) {$begin_date = $TODAY;} -if (!isset($end_date)) {$end_date = $TODAY;} +$stage = preg_replace('/[^-_0-9a-zA-Z]/', '', $stage); +$begin_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$begin_date); +$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$end_date); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9a-zA-Z]/','',$group); + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9\p{L}]/u','',$group); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); } -$user = preg_replace("/'|\"|\\\\|;/","",$user); -$group = preg_replace("/'|\"|\\\\|;/","",$group); -$stage = preg_replace("/'|\"|\\\\|;/","",$stage); -$begin_date = preg_replace("/'|\"|\\\\|;/","",$begin_date); -$end_date = preg_replace("/'|\"|\\\\|;/","",$end_date); $SSmenu_background='015B91'; @@ -156,15 +172,6 @@ $Mmain_bgcolor = $SSmenu_background; $Mhead_color = $SSstd_row5_background; -$StarTtimE = date("U"); -$TODAY = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); -$ip = getenv("REMOTE_ADDR"); -$check_time = ($StarTtimE - 86400); -$date = date("r"); -$ip = getenv("REMOTE_ADDR"); -$browser = getenv("HTTP_USER_AGENT"); - $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link);