From 4116939fd1c13310cc5469ffb07a324d3ba17618 Mon Sep 17 00:00:00 2001 From: mattf Date: Tue, 17 Jan 2012 19:58:29 +0000 Subject: [PATCH] security fix issue #544 git-svn-id: svn://192.168.202.10@1773 3d104415-ff17-0410-8863-d5cf3c621b8a --- www/vicidial/callcard_admin.php | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/www/vicidial/callcard_admin.php b/www/vicidial/callcard_admin.php index 57bb7ec1..5d5b6a72 100644 --- a/www/vicidial/callcard_admin.php +++ b/www/vicidial/callcard_admin.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2012 Matt Florell LICENSE: AGPLv2 # # This callcard script is to administer the callcard accounts in ViciDial # it is separate from the standard admin.php script. callcard_enabled in @@ -12,10 +12,11 @@ # 100525-1824 - Added generate option # 100616-0847 - Fixed batch issue # 100823-1342 - Added Search option and display for level 7 users, added pin number search +# 120117-1457 - Security fix, issue #544 # -$version = '2.4-4'; -$build = '100823-1342'; +$version = '2.4-5'; +$build = '120117-1457'; $MT[0]=''; @@ -116,6 +117,7 @@ if ($non_latin < 1) $old_territory = ereg_replace("[^-\_0-9a-zA-Z]","",$old_territory); $old_user = ereg_replace("[^-\_0-9a-zA-Z]","",$old_user); $accountid = ereg_replace("[^-\_0-9a-zA-Z]","",$accountid); + $pin = ereg_replace("[^0-9a-zA-Z]","",$pin); } if (eregi("YES",$batch))