ViciDial/agc_2-X
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added allow_web_debug system setting to disable $DB output by default.

Browse Source 
Added more input variable filtering

git-svn-id: svn://192.168.202.10@3567 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2022-02-21 15:41:15 +00:00
parent 55c9bc35dc
commit 31ed5a073c
50 changed files with 1966 additions and 914 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/chat_customer/customer_chat_code.php
+12 -1
View File
@@ -1,7 +1,7 @@
<?php
# customer_chat_code.php
#
# Copyright (C) 2016 Joe Johnson, Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2022 Joe Johnson, Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# Example for incorporating the customer side of the Vicidial chat into a web page.
# Can be called as an include file, if desired.
@@ -12,6 +12,7 @@
# 151219-1415 - Added header and language variable
# 160108-1659 - Added available_agents variable
# 160120-1944 - Added show_email variable
# 220220-1921 - Added allow_web_debug system setting
#
if (isset($_GET["lead_id"])) {$lead_id=$_GET["lead_id"];}
@@ -33,6 +34,16 @@ if (isset($_GET["available_agents"])) {$available_agents=$_GET["available_agen
if (isset($_GET["show_email"])) {$show_email=$_GET["show_email"];}
elseif (isset($_POST["show_email"])) {$show_email=$_POST["show_email"];}
$lead_id = preg_replace("/[^0-9]/","",$lead_id);
$chat_id = preg_replace('/[^-\_\.0-9a-zA-Z]/','',$chat_id);
$group_id = preg_replace('/[^-\_0-9\p{L}]/u','',$group_id);
$chat_group_id = preg_replace('/[^-\_0-9\p{L}]/u','',$chat_group_id);
$email = preg_replace('/[^-\.\:\/\@\_0-9\p{L}]/u','',$email);
$unique_userID = preg_replace('/[^-\.\_0-9a-zA-Z]/','',$unique_userID);
$language = preg_replace('/[^-\_0-9a-zA-Z]/','',$language);
$available_agents = preg_replace('/[^-\_0-9a-zA-Z]/','',$available_agents);
$show_email = preg_replace('/[^-\_0-9a-zA-Z]/','',$show_email);
$URL_vars="?user=".urlencode($unique_userID)."&lead_id=".$lead_id."&group_id=".urlencode($chat_group_id)."&chat_id=".$chat_id."&email=".urlencode($email)."&language=".urlencode($language)."&available_agents=".urlencode($available_agents)."&show_email=".urlencode($show_email);
header ("Content-type: text/html; charset=utf-8");
header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
www/chat_customer/customer_chat_functions.php
+22 -12
View File
@@ -1,6 +1,8 @@
<?php
# customer_chat_functions.php
#
# Copyright (C) 2022 Joe Johnson, Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# CHANGES
# 151212-0828 - First Build for customer chat
# 151213-1106 - Added variable filtering
@@ -13,6 +15,7 @@
# 160725-1711 - Fixed nested iframe issue
# 160805-2315 - Added coding to show logos in customer display
# 161026-2230 - Added translation QXZ to untranslated text
# 220220-1940 - Added allow_web_debug system setting
#
require("dbconnect_mysqli.php");
@@ -51,29 +54,24 @@ if (isset($_GET["available_agents"])) {$available_agents=$_GET["available_age
if (isset($_GET["show_email"])) {$show_email=$_GET["show_email"];}
elseif (isset($_POST["show_email"])) {$show_email=$_POST["show_email"];}
$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
$chat_member_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/',"",$chat_member_name);
if (!$user) {echo "No user, no using."; exit;}
$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
$lead_id = preg_replace("/[^0-9]/","",$lead_id);
$chat_id = preg_replace('/[^- \_\.0-9a-zA-Z]/','',$chat_id);
$chat_level = preg_replace('/[^- \_\.0-9a-zA-Z]/','',$chat_level);
$group_id = preg_replace('/[^- \_0-9a-zA-Z]/','',$group_id);
$language = preg_replace('/[^-\_0-9a-zA-Z]/','',$language);
$user = preg_replace("/\'|\"|\\\\|;/","",$user);
$chat_member_name = preg_replace("/\'|\"|\\\\|;/","",$chat_member_name);
$available_agents = preg_replace('/[^-\_0-9a-zA-Z]/','',$available_agents);
$show_email = preg_replace('/[^-\_0-9a-zA-Z]/','',$show_email);
$chat_message = preg_replace('/\|/', '&#124;', $chat_message);
if ($non_latin < 1)
{
$user = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$user);
$phone_number = preg_replace("/[^0-9]/","",$phone_number);
}
else
{
$user = preg_replace("/\'|\"|\\\\|;/","",$user);
}
$action = preg_replace('/[^-\_0-9a-zA-Z]/','',$action);
$user_level = preg_replace('/[^-\_0-9a-zA-Z]/','',$user_level);
$keepalive = preg_replace('/[^-\_0-9a-zA-Z]/','',$keepalive);
$current_message_count = preg_replace('/[^-\_0-9a-zA-Z]/','',$current_message_count);
$use_agent_colors=1;
if (file_exists('options.php'))
@@ -83,7 +81,7 @@ if (file_exists('options.php'))
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$VUselected_language='';
$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,chat_url,allow_chats FROM system_settings;";
$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,chat_url,allow_chats,allow_web_debug FROM system_settings;";
$rslt=mysql_to_mysqli($stmt, $link);
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);}
if ($DB) {echo "$stmt\n";}
@@ -97,11 +95,23 @@ if ($qm_conf_ct > 0)
$SSdefault_language = $row[3];
$chat_url = $row[4];
$SSallow_chats = $row[5];
$SSallow_web_debug = $row[6];
}
$VUselected_language = $SSdefault_language;
if ($SSallow_web_debug < 1) {$DB=0;}
##### END SETTINGS LOOKUP #####
###########################################
if ($non_latin < 1)
{
$user = preg_replace('/[^- \+\_\.0-9a-zA-Z]/','',$user);
}
else
{
$user = preg_replace("/\'|\"|\\\\|;/","",$user);
}
if (strlen($language) > 1)
{
$stmt = "SELECT language_code,language_description FROM vicidial_languages where language_id='$language' and active='Y';";
www/chat_customer/vicidial_chat_customer_side.php
+32 -25
View File
@@ -1,7 +1,7 @@
<?php
# vicidial_chat_customer_side.php
#
# Copyright (C) 2016 Joe Johnson, Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2022 Joe Johnson, Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# The main page of the customer chat interface. This will display a form for the customer
# to fill out to attempt to initiate a chat with an available agent in the in-group
@@ -18,6 +18,7 @@
# 160120-1925 - Fixed missing list_id on vicidial_list inserts, Issue #915. Added show_email option
# 160203-1052 - Added display of chat message after ending it
# 160805-2315 - Added coding to show logos in customer display
# 220220-1915 - Added allow_web_debug system setting
#
require("dbconnect_mysqli.php");
@@ -57,16 +58,44 @@ $PHP_SELF=$_SERVER['PHP_SELF'];
$PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF);
$lead_id = preg_replace("/[^0-9]/","",$lead_id);
$user = preg_replace("/\'|\"|\\\\|;/","",$user);
$chat_id = preg_replace('/[^- \_\.0-9a-zA-Z]/','',$chat_id);
$group_id = preg_replace('/[^- \_0-9a-zA-Z]/','',$group_id);
$language = preg_replace('/[^-\_0-9a-zA-Z]/','',$language);
$available_agents = preg_replace('/[^-\_0-9a-zA-Z]/','',$available_agents);
$status_link = preg_replace('/[^-\_0-9a-zA-Z]/','',$status_link);
$show_email = preg_replace('/[^-\_0-9a-zA-Z]/','',$show_email);
$send_request = preg_replace('/[^-\_0-9a-zA-Z]/','',$send_request);
$join_chat = preg_replace('/[^-\_0-9a-zA-Z]/','',$join_chat);
$stage = preg_replace('/[^-\_0-9a-zA-Z]/','',$stage);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$VUselected_language='';
$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,allow_chats,chat_url,allow_web_debug FROM system_settings;";
$rslt=mysql_to_mysqli($stmt, $link);
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);}
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysqli_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysqli_fetch_row($rslt);
$non_latin = $row[0];
$SSenable_languages = $row[1];
$SSlanguage_method = $row[2];
$SSdefault_language = $row[3];
$SSallow_chats = $row[4];
$SSchat_url = $row[5];
$SSallow_web_debug = $row[6];
}
$VUselected_language = $SSdefault_language;
if ($SSallow_web_debug < 1) {$DB=0;}
##### END SETTINGS LOOKUP #####
###########################################
if ($non_latin < 1)
{
$user = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$user);
$user = preg_replace('/[^- \+\_\.0-9a-zA-Z]/','',$user);
$first_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$first_name);
$first_name = preg_replace('/\+/',' ',$first_name);
$last_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$last_name);
@@ -81,31 +110,9 @@ else
$first_name = preg_replace("/\"|\\\\|;/","",$first_name);
$last_name = preg_replace("/\"|\\\\|;/","",$last_name);
$email = preg_replace("/\'|\"|\\\\|;/","",$email);
$phone_number = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9a-zA-Z]/','',$email);
$phone_number = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9a-zA-Z]/','',$phone_number);
}
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$VUselected_language='';
$stmt = "SELECT use_non_latin,enable_languages,language_method,default_language,allow_chats,chat_url FROM system_settings;";
$rslt=mysql_to_mysqli($stmt, $link);
if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$user,$server_ip,$session_name,$one_mysql_log);}
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysqli_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysqli_fetch_row($rslt);
$non_latin = $row[0];
$SSenable_languages = $row[1];
$SSlanguage_method = $row[2];
$SSdefault_language = $row[3];
$SSallow_chats = $row[4];
$SSchat_url = $row[5];
}
$VUselected_language = $SSdefault_language;
##### END SETTINGS LOOKUP #####
###########################################
if (strlen($language) > 1)
{
$stmt = "SELECT language_code,language_description FROM vicidial_languages where language_id='$language' and active='Y';";