From 4b258c4f031068bf0337c29abbc124e19b98ba72 Mon Sep 17 00:00:00 2001 From: mattf Date: Sat, 26 Feb 2022 04:40:37 +0000 Subject: [PATCH] Another batch of Added allow_web_debug system setting updates git-svn-id: svn://192.168.202.10@3572 3d104415-ff17-0410-8863-d5cf3c621b8a --- www/vicidial/DNCcom_inbound_filter.php | 17 ++-- www/vicidial/bench_agent_assign.php | 28 +++--- www/vicidial/callbacks_bulk_change.php | 22 +++-- www/vicidial/callbacks_bulk_move.php | 95 +++++++++++++++--- www/vicidial/callcard_admin.php | 69 ++++++++----- www/vicidial/closer-fronter_popup.php | 65 ++++++++++++- www/vicidial/closer-fronter_popup2.php | 65 ++++++++++++- www/vicidial/closer.php | 76 ++++++++++++--- www/vicidial/closer_dispo.php | 63 ++++++++++-- www/vicidial/closer_popup.php | 34 ++++++- www/vicidial/display_help.php | 19 ++-- www/vicidial/list_download.php | 22 +++-- www/vicidial/qc_api.php | 88 +++++++++++++---- www/vicidial/qc_call_client_iframe.php | 103 ++++++++++++++++---- www/vicidial/qc_modify_lead.php | 67 ++++++------- www/vicidial/qc_module_actions.php | 129 +++++++++++++++++++------ www/vicidial/qc_scorecards.php | 113 ++++++++++++---------- www/vicidial/vdremote.php | 86 ++++++++++------- 18 files changed, 856 insertions(+), 305 deletions(-) diff --git a/www/vicidial/DNCcom_inbound_filter.php b/www/vicidial/DNCcom_inbound_filter.php index ca8f1c7e..da3ddb9a 100644 --- a/www/vicidial/DNCcom_inbound_filter.php +++ b/www/vicidial/DNCcom_inbound_filter.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script searches DNC.COM's scrub service for incoming DID phone numbers # and returns a blocking match of '1' that will send the call to the Filter route @@ -28,6 +28,7 @@ # 170923-1905 - First Build # 170926-1016 - Added in_filter_override option and cache searching option # 170927-2127 - Changed to log flags that are not used to filter, added in_cache_override option, added connect retry if rejected +# 220224-1051 - Added allow_web_debug system setting # header ("Content-type: text/html; charset=utf-8"); @@ -48,29 +49,33 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { $row=mysqli_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; + $SSallow_web_debug = $row[2]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$in_filter_override=preg_replace('/[^-_0-9a-zA-Z]/','',$in_filter_override); +$in_cache_override=preg_replace('/[^-_0-9a-zA-Z]/','',$in_cache_override); + if ($non_latin < 1) { $phone=preg_replace('/[^-_0-9a-zA-Z]/','',$phone); } else { - $phone = preg_replace("/'|\"|\\\\|;/","",$phone); + $phone = preg_replace('/[^-_0-9\p{L}]/u', '', $phone); } -$in_filter_override=preg_replace('/[^-_0-9a-zA-Z]/','',$in_filter_override); -$in_cache_override=preg_replace('/[^-_0-9a-zA-Z]/','',$in_cache_override); + $filter_count=0; $ENTRYdate = date("mdHis"); diff --git a/www/vicidial/bench_agent_assign.php b/www/vicidial/bench_agent_assign.php index 5d11b53b..05922687 100644 --- a/www/vicidial/bench_agent_assign.php +++ b/www/vicidial/bench_agent_assign.php @@ -1,10 +1,11 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # 190815-2242 - First build +# 220224-1753 - Added allow_web_debug system setting # $startMS = microtime(); @@ -40,9 +41,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -53,29 +54,34 @@ if ($qm_conf_ct > 0) $user_territories_active = $row[3]; $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; + $SSallow_web_debug = $row[6]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$list_id = preg_replace('/[^0-9]/', '', $list_id); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); $absent_agent = preg_replace('/[^-_0-9a-zA-Z]/', '', $absent_agent); $bench_agent = preg_replace('/[^-_0-9a-zA-Z]/', '', $bench_agent); + $group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $absent_agent = preg_replace("/'|\"|\\\\|;/","",$absent_agent); - $bench_agent = preg_replace("/'|\"|\\\\|;/","",$bench_agent); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $absent_agent = preg_replace('/[^-_0-9\p{L}]/u', '', $absent_agent); + $bench_agent = preg_replace('/[^-_0-9\p{L}]/u', '', $bench_agent); + $group = preg_replace('/[^-_0-9\p{L}]/u', '', $group); } -$list_id = preg_replace('/[^0-9]/', '', $list_id); -$group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); -$server_ip = preg_replace('/[^-._0-9a-zA-Z]/', '', $server_ip); - $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); diff --git a/www/vicidial/callbacks_bulk_change.php b/www/vicidial/callbacks_bulk_change.php index 99ed60b0..37ebc104 100644 --- a/www/vicidial/callbacks_bulk_change.php +++ b/www/vicidial/callbacks_bulk_change.php @@ -16,6 +16,7 @@ # 170822-2255 - Added screen color settings # 170829-0040 - Added screen color settings # 220217-2220 - Added input variable filtering +# 220224-1752 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -33,8 +34,8 @@ if (isset($_GET["group"])) {$group=$_GET["group"];} elseif (isset($_POST["group"])) {$group=$_POST["group"];} if (isset($_GET["stage"])) {$stage=$_GET["stage"];} elseif (isset($_POST["stage"])) {$stage=$_POST["stage"];} -if (isset($_GET["confirm_transfer"])) {$confirm_transfer=$_GET["confirm_transfer"];} - elseif (isset($_POST["confirm_transfer"])) {$confirm_transfer=$_POST["confirm_transfer"];} +if (isset($_GET["confirm_transfer"])) {$confirm_transfer=$_GET["confirm_transfer"];} + elseif (isset($_POST["confirm_transfer"])) {$confirm_transfer=$_POST["confirm_transfer"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} @@ -48,9 +49,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -60,10 +61,17 @@ if ($qm_conf_ct > 0) $SSoutbound_autodial_active = $row[2]; $SSenable_languages = $row[3]; $SSlanguage_method = $row[4]; + $SSallow_web_debug = $row[5]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$convert_to_anyone = preg_replace('/[^-_0-9a-zA-Z]/', '', $convert_to_anyone); +$confirm_transfer = preg_replace('/[^-_0-9a-zA-Z]/', '', $confirm_transfer); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -75,9 +83,9 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $old_user = preg_replace('/[^-_0-9a-zA-Z]/', '', $old_user); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $old_user = preg_replace('/[^-_0-9\p{L}]/u', '', $old_user); $new_user = preg_replace('/[^-_0-9\p{L}]/u', '', $new_user); $group = preg_replace('/[^-_0-9\p{L}]/u', '', $group); $stage = preg_replace('/[^-_0-9\p{L}]/u', '', $stage); diff --git a/www/vicidial/callbacks_bulk_move.php b/www/vicidial/callbacks_bulk_move.php index 458a8cf8..457f39f4 100644 --- a/www/vicidial/callbacks_bulk_move.php +++ b/www/vicidial/callbacks_bulk_move.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # 150218-0923 - First build based on callbacks_bulk_change.php @@ -10,6 +10,7 @@ # 170409-1548 - Added IP List validation code # 180508-0115 - Added new help display # 191013-0853 - Fixes for PHP7 +# 220224-1656 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -39,7 +40,6 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];} elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} - if (isset($_GET["new_list_id"])) {$new_list_id=$_GET["new_list_id"];} elseif (isset($_POST["new_list_id"])) {$new_list_id=$_POST["new_list_id"];} if (isset($_GET["new_status"])) {$new_status=$_GET["new_status"];} @@ -65,9 +65,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method,qc_features_active FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method,qc_features_active,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -78,19 +78,48 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[3]; $SSlanguage_method = $row[4]; $SSqc_features_active = $row[5]; + $SSallow_web_debug = $row[6]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$list_id = preg_replace('/[^0-9a-zA-Z]/', '', $list_id); +$new_list_id = preg_replace('/[^0-9a-zA-Z]/', '', $new_list_id); +$days = preg_replace('/[^-0-9]/', '', $days); +$days_uncalled = preg_replace('/[^-0-9]/', '', $days_uncalled); +$stage = preg_replace('/[^-_0-9a-zA-Z]/', '', $stage); +$confirm_transfer = preg_replace('/[^-_0-9a-zA-Z]/', '', $confirm_transfer); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); +$purge_called_records = preg_replace('/[^-_0-9a-zA-Z]/', '', $purge_called_records); +$purge_uncalled_records = preg_replace('/[^-_0-9a-zA-Z]/', '', $purge_uncalled_records); + +# Variables filtered further down in the code +# $cb_lists +# $cb_groups +# $cb_user_groups +# $cb_users + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $revert_status = preg_replace('/[^-_0-9a-zA-Z]/', '', $revert_status); + $new_status = preg_replace('/[^-_0-9a-zA-Z]/', '', $new_status); + $campaign_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $campaign_id); + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); + $user_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $user_group); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $revert_status = preg_replace('/[^-_0-9\p{L}]/u', '', $revert_status); + $new_status = preg_replace('/[^-_0-9\p{L}]/u', '', $new_status); + $campaign_id = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign_id); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); + $user_group = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group); } $StarTtimE = date("U"); @@ -121,6 +150,7 @@ if (strlen($user) < 1) {$category='USERS'; $record_id=$user;} if (strlen($user_group) < 1) {$category='USERGROUPS'; $record_id=$user_group;} if (strlen($list_id) < 1) {$category='LISTS'; $record_id=$list_id;} if (strlen($campaign_id) < 1) {$category='CAMPAIGNS'; $record_id=$campaign_id;} +$cb_dispos=array("CALLBK","CBHOLD"); $auth=0; $auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1,0); @@ -549,12 +579,16 @@ if ($SUBMIT && $new_list_id && ($new_status || $revert_status)) } else { - $usersSQL=" and vc.user in ('".implode("','", $cb_users)."') "; + $usersSQLx=""; $usersQS=""; for ($i=0; $i 0) {$usersSQL.="','";} + $usersSQLx.="$cb_users[$i]"; } + $usersSQL=" and vc.user in ('".$usersSQLx."') "; } } @@ -576,12 +610,16 @@ if ($SUBMIT && $new_list_id && ($new_status || $revert_status)) } else { - $user_groupsSQL=" and vc.user_group in ('".implode("','", $cb_user_groups)."') "; + $user_groupsSQLx=""; $user_groupsQS=""; for ($i=0; $i 0) {$user_groupsSQL.="','";} + $user_groupsSQLx.="$cb_user_groups[$i]"; } + $user_groupsSQL=" and vc.user_group in ('".$user_groupsSQLx."') "; } } @@ -612,12 +650,16 @@ if ($SUBMIT && $new_list_id && ($new_status || $revert_status)) } else { - $listsSQL=" and vc.list_id in ('".implode("','", $cb_lists)."') "; + $listsSQLx=""; $listsQS=""; for ($i=0; $i 0) {$listsSQL.="','";} + $listsSQLx.="$cb_lists[$i]"; } + $listsSQL=" and vc.list_id in ('".$listsSQLx."') "; } } @@ -639,12 +681,16 @@ if ($SUBMIT && $new_list_id && ($new_status || $revert_status)) } else { - $groupsSQL=" and vc.campaign_id in ('".implode("','", $cb_groups)."') "; + $groupsSQLx=""; $groupsQS=""; for ($i=0; $i 0) {$groupsSQL.="','";} + $groupsSQLx.="$cb_groups[$i]"; } + $groupsSQL=" and vc.campaign_id in ('".$groupsSQLx."') "; } } @@ -658,7 +704,6 @@ if ($SUBMIT && $new_list_id && ($new_status || $revert_status)) $callback_dispo_stmt="SELECT distinct status from vicidial_statuses where scheduled_callback='Y' UNION SELECT distinct status from vicidial_campaign_statuses where scheduled_callback='Y' ".preg_replace("/vc\./", "", $groupsSQL); if ($DB) {echo $callback_dispo_stmt."
";} $callback_dispo_rslt=mysql_to_mysqli($callback_dispo_stmt, $link); - $cb_dispos=array("CALLBK","CBHOLD"); while ($cb_dispo_row=mysqli_fetch_row($callback_dispo_rslt)) { array_push($cb_dispos, "$cb_dispo_row[0]"); @@ -854,10 +899,30 @@ else if ($SUBMIT && $new_list_id && ($new_status || $revert_status) && (count($ echo "
"; echo _QXZ("You are about to transfer")." $callback_ct "._QXZ("callbacks from")."
    \n"; - if (count($cb_groups)>0) {echo "
  • "._QXZ("campaigns")." ".implode(",", $cb_groups)."
    • \n";} - if (count($cb_lists)>0) {echo "
  • "._QXZ("lists")." ".implode(",", $cb_lists)."
    • \n";} - if (count($cb_user_groups)>0) {echo"
  • ". _QXZ("user groups")." ".implode(",", $cb_user_groups)."
    • \n";} - if (count($cb_users)>0) {echo "
  • "._QXZ("users")." ".implode(",", $cb_users)."
    • \n";} + if (count($cb_groups)>0) + { + $temp_groups = implode(",", $cb_groups); + $temp_groups = preg_replace('/[^-\,\_0-9\p{L}]/u', '', $temp_groups); + echo "
  • "._QXZ("campaigns")." ".$temp_groups."
    • \n"; + } + if (count($cb_lists)>0) + { + $temp_lists = implode(",", $cb_lists); + $temp_lists = preg_replace('/[^-\,\_0-9\p{L}]/u', '', $temp_lists); + echo "
  • "._QXZ("lists")." ".$temp_lists."
    • \n"; + } + if (count($cb_user_groups)>0) + { + $temp_groups = implode(",", $cb_user_groups); + $temp_groups = preg_replace('/[^-\,\_0-9\p{L}]/u', '', $temp_groups); + echo"
  • ". _QXZ("user groups")." ".$temp_groups."
    • \n"; + } + if (count($cb_users)>0) + { + $temp_users = implode(",", $cb_users); + $temp_users = preg_replace('/[^-\,\_0-9\p{L}]/u', '', $temp_users); + echo "
  • "._QXZ("users")." ".$temp_users."
    • \n"; + } if ($days_uncalled) {echo "
  • "._QXZ("where leads have been LIVE and uncalled for ")." $days_uncalled "._QXZ("days")."
    • \n";} echo "

"; diff --git a/www/vicidial/callcard_admin.php b/www/vicidial/callcard_admin.php index fd052191..596127c9 100644 --- a/www/vicidial/callcard_admin.php +++ b/www/vicidial/callcard_admin.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This callcard script is to administer the callcard accounts in ViciDial # it is separate from the standard admin.php script. callcard_enabled in @@ -23,10 +23,11 @@ # 170829-0040 - Added screen color settings # 180508-0115 - Added new help display # 201111-1615 - Fix for Issue #1230 +# 220224-1631 - Added allow_web_debug system setting # -$version = '2.14-13'; -$build = '201111-1615'; +$version = '2.14-14'; +$build = '220224-1631'; $MT[0]=''; @@ -91,9 +92,9 @@ $SEARCHONLY=0; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,callcard_enabled,enable_languages,language_method,active_modules,contacts_enabled,allow_emails,outbound_autodial_active,enable_tts_integration,sounds_central_control_active,qc_features_active,enable_auto_reports,campaign_cid_areacodes_enabled FROM system_settings;"; +$stmt = "SELECT use_non_latin,callcard_enabled,enable_languages,language_method,active_modules,contacts_enabled,allow_emails,outbound_autodial_active,enable_tts_integration,sounds_central_control_active,qc_features_active,enable_auto_reports,campaign_cid_areacodes_enabled,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $ss_conf_ct = mysqli_num_rows($rslt); if ($ss_conf_ct > 0) { @@ -111,27 +112,51 @@ if ($ss_conf_ct > 0) $SSqc_features_active = $row[10]; $SSenable_auto_reports = $row[11]; $SScampaign_cid_areacodes_enabled = $row[12]; + $SSallow_web_debug = $row[13]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$DB = preg_replace('/[^0-9]/','',$DB); +$action = preg_replace('/[^\_0-9a-zA-Z]/','',$action); +$card_id = preg_replace('/[^-\_0-9]/','',$card_id); +$run = preg_replace('/[^0-9]/','',$run); +$batch = preg_replace('/[^0-9a-zA-Z]/','',$batch); +$pack = preg_replace('/[^0-9]/','',$pack); +$sequence = preg_replace('/[^0-9]/','',$sequence); +$pin = preg_replace('/[^0-9a-zA-Z]/','',$pin); +$starting_batch = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$starting_batch); +$status = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$status); +$total = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$total); +$comment = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$comment); +$balance_minutes = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$balance_minutes); +$initial_value = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$initial_value); +$initial_minutes = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$initial_minutes); +$note_purchase_order = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_purchase_order); +$note_printer = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_printer); +$note_did = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_did); +$inbound_group_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$inbound_group_id); +$note_language = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_language); +$note_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_name); +$note_comments = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$note_comments); +$SUBMIT = preg_replace("/\<|\>|\’|\"|\\\\|;/",'',$SUBMIT); if ($non_latin < 1) { - ### Clean Variable Values ### - $DB = preg_replace('/[^0-9]/','',$DB); - $action = preg_replace('/[^\_0-9a-zA-Z]/','',$action); - $card_id = preg_replace('/[^-\_0-9]/','',$card_id); - $run = preg_replace('/[^0-9]/','',$run); - $batch = preg_replace('/[^0-9a-zA-Z]/','',$batch); - $pack = preg_replace('/[^0-9]/','',$pack); - $sequence = preg_replace('/[^0-9]/','',$sequence); $territory_description = preg_replace('/[^- \_\.\,0-9a-zA-Z]/','',$territory_description); - $user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$user); - $old_territory = preg_replace('/[^-\_0-9a-zA-Z]/', '',$old_territory); - $old_user = preg_replace('/[^-\_0-9a-zA-Z]/', '',$old_user); - $accountid = preg_replace('/[^-\_0-9a-zA-Z]/', '',$accountid); - $pin = preg_replace('/[^0-9a-zA-Z]/','',$pin); + $user = preg_replace('/[^-_0-9a-zA-Z]/', '',$user); + $old_territory = preg_replace('/[^-_0-9a-zA-Z]/', '',$old_territory); + $old_user = preg_replace('/[^-_0-9a-zA-Z]/', '',$old_user); + $accountid = preg_replace('/[^-_0-9a-zA-Z]/', '',$accountid); + } +else + { + $territory_description = preg_replace('/[^- \_\.\,0-9\p{L}]/u','',$territory_description); + $user = preg_replace('/[^-_0-9\p{L}]/u', '',$user); + $old_territory = preg_replace('/[^-_0-9\p{L}]/u', '',$old_territory); + $old_user = preg_replace('/[^-_0-9\p{L}]/u', '',$old_user); + $accountid = preg_replace('/[^-_0-9\p{L}]/u', '',$accountid); } if (preg_match("/YES/i",$batch)) @@ -156,10 +181,10 @@ if ($non_latin < 1) } else { - $PASS = preg_replace("/'|\"|\\\\|;/","",$PASS); - $USER = preg_replace("/'|\"|\\\\|;/","",$USER); - $user = preg_replace("/'|\"|\\\\|;/","",$user); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PASS = preg_replace('/[^-_0-9\p{L}]/u', '', $PASS); + $USER = preg_replace('/[^-_0-9\p{L}]/u', '', $USER); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); } $stmt="SELECT selected_language from vicidial_users where user='$user';"; diff --git a/www/vicidial/closer-fronter_popup.php b/www/vicidial/closer-fronter_popup.php index fba8375d..1ba71cbd 100644 --- a/www/vicidial/closer-fronter_popup.php +++ b/www/vicidial/closer-fronter_popup.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # this is the closer popup of a specific call that starts recording the call and allows you to go and fetch info on that caller in the local CRM system. # CHANGES @@ -16,6 +16,7 @@ # 141007-2210 - Finalized adding QXZ translation to all admin files # 141229-2040 - Added code for on-the-fly language translations display # 170409-1532 - Added IP List validation code +# 220224-1626 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -110,9 +111,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -123,19 +124,73 @@ if ($qm_conf_ct > 0) $user_territories_active = $row[3]; $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; + $SSallow_web_debug = $row[6]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip); +$dialplan_number = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$dialplan_number); +$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$extension); +$PHONE_LOGIN = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$PHONE_LOGIN); +$channel = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$channel); +$parked_time = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_time); +$debugvars = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$debugvars); +$parked_by = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_by); +$submit = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$submit); +$SUBMIT = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$SUBMIT); +$vendor_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$vendor_id); +$phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone); +$lead_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$lead_id); +$first_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$first_name); +$last_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$last_name); +$phone_number = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_number); +$end_call = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$end_call); +$DB = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$DB); +$dispo = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$dispo); +$list_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$list_id); +$campaign_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$campaign_id); +$phone_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_code); +$call_began = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$call_began); +$tsr = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$tsr); +$address1 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address1); +$address2 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address2); +$address3 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address3); +$city = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$city); +$state = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$state); +$postal_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$postal_code); +$province = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$province); +$country_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$country_code); +$alt_phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$alt_phone); +$email = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$email); +$security = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$security); +$comments = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$comments); +$status = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$status); +$customer_zap_channel = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$customer_zap_channel); +$session_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$session_id); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); + $pass = preg_replace('/[^-_0-9a-zA-Z]/', '', $pass); + $group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); + $group_selected = preg_replace('/[^-_0-9a-zA-Z]/', '', $group_selected); + $groupselect = preg_replace('/[^-_0-9a-zA-Z]/', '', $groupselect); + $channel_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $channel_group); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); + $pass = preg_replace('/[^-_0-9\p{L}]/u', '', $pass); + $group = preg_replace('/[^-_0-9\p{L}]/u', '', $group); + $group_selected = preg_replace('/[^-_0-9\p{L}]/u', '', $group_selected); + $groupselect = preg_replace('/[^-_0-9\p{L}]/u', '', $groupselect); + $channel_group = preg_replace('/[^-_0-9\p{L}]/u', '', $channel_group); } #$DB = '1'; # DEBUG override diff --git a/www/vicidial/closer-fronter_popup2.php b/www/vicidial/closer-fronter_popup2.php index 09589b3e..3288d8cf 100644 --- a/www/vicidial/closer-fronter_popup2.php +++ b/www/vicidial/closer-fronter_popup2.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # this is the closer popup of a specific call that starts recording the call and allows you to go and fetch info on that caller in the local CRM system. # CHANGES @@ -16,6 +16,7 @@ # 141007-2211 - Finalized adding QXZ translation to all admin files # 141229-2038 - Added code for on-the-fly language translations display # 170409-1532 - Added IP List validation code +# 220224-1622 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -110,9 +111,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -123,19 +124,73 @@ if ($qm_conf_ct > 0) $user_territories_active = $row[3]; $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; + $SSallow_web_debug = $row[6]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip); +$dialplan_number = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$dialplan_number); +$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$extension); +$PHONE_LOGIN = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$PHONE_LOGIN); +$channel = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$channel); +$parked_time = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_time); +$debugvars = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$debugvars); +$parked_by = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_by); +$submit = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$submit); +$SUBMIT = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$SUBMIT); +$vendor_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$vendor_id); +$phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone); +$lead_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$lead_id); +$first_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$first_name); +$last_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$last_name); +$phone_number = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_number); +$end_call = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$end_call); +$DB = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$DB); +$dispo = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$dispo); +$list_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$list_id); +$campaign_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$campaign_id); +$phone_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_code); +$call_began = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$call_began); +$tsr = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$tsr); +$address1 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address1); +$address2 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address2); +$address3 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address3); +$city = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$city); +$state = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$state); +$postal_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$postal_code); +$province = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$province); +$country_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$country_code); +$alt_phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$alt_phone); +$email = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$email); +$security = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$security); +$comments = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$comments); +$status = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$status); +$customer_zap_channel = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$customer_zap_channel); +$session_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$session_id); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); + $pass = preg_replace('/[^-_0-9a-zA-Z]/', '', $pass); + $group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); + $group_selected = preg_replace('/[^-_0-9a-zA-Z]/', '', $group_selected); + $groupselect = preg_replace('/[^-_0-9a-zA-Z]/', '', $groupselect); + $channel_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $channel_group); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); + $pass = preg_replace('/[^-_0-9\p{L}]/u', '', $pass); + $group = preg_replace('/[^-_0-9\p{L}]/u', '', $group); + $group_selected = preg_replace('/[^-_0-9\p{L}]/u', '', $group_selected); + $groupselect = preg_replace('/[^-_0-9\p{L}]/u', '', $groupselect); + $channel_group = preg_replace('/[^-_0-9\p{L}]/u', '', $channel_group); } #$DB = '1'; # DEBUG override diff --git a/www/vicidial/closer.php b/www/vicidial/closer.php index 5d1f5307..bb61884d 100644 --- a/www/vicidial/closer.php +++ b/www/vicidial/closer.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # the purpose of this script and webpage is to allow for remote or local users of the system to log in and grab phone calls that are coming inbound into the Asterisk server and being put in the parked_channels table while they hear a soundfile for a limited amount of time before being forwarded on to either a set extension or a voicemail box. This gives remote or local agents a way to grab calls without tying up their phone lines all day. The agent sees the refreshing screen of calls on park and when they want to take one they just click on it, and a small window opens that will allow them to grab the call and/or look up more information on the caller through the callerID that is given(if available) # CHANGES @@ -16,6 +16,7 @@ # 141007-2212 - Finalized adding QXZ translation to all admin files # 141229-2041 - Added code for on-the-fly language translations display # 170409-1532 - Added IP List validation code +# 220224-1629 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -62,9 +63,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -75,24 +76,75 @@ if ($qm_conf_ct > 0) $user_territories_active = $row[3]; $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; + $SSallow_web_debug = $row[6]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip); +$dialplan_number = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$dialplan_number); +$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$extension); +$PHONE_LOGIN = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$PHONE_LOGIN); +$channel = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$channel); +$parked_time = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_time); +$debugvars = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$debugvars); +$parked_by = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_by); +$submit = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$submit); +$SUBMIT = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$SUBMIT); +$vendor_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$vendor_id); +$phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone); +$lead_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$lead_id); +$first_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$first_name); +$last_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$last_name); +$phone_number = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_number); +$end_call = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$end_call); +$DB = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$DB); +$dispo = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$dispo); +$list_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$list_id); +$campaign_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$campaign_id); +$phone_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_code); +$call_began = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$call_began); +$tsr = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$tsr); +$address1 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address1); +$address2 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address2); +$address3 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address3); +$city = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$city); +$state = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$state); +$postal_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$postal_code); +$province = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$province); +$country_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$country_code); +$alt_phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$alt_phone); +$email = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$email); +$security = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$security); +$comments = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$comments); +$status = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$status); +$customer_zap_channel = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$customer_zap_channel); +$session_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$session_id); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); + $pass = preg_replace('/[^-_0-9a-zA-Z]/', '', $pass); + $group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); + $group_selected = preg_replace('/[^-_0-9a-zA-Z]/', '', $group_selected); + $groupselect = preg_replace('/[^-_0-9a-zA-Z]/', '', $groupselect); + $channel_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $channel_group); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); + $pass = preg_replace('/[^-_0-9\p{L}]/u', '', $pass); + $group = preg_replace('/[^-_0-9\p{L}]/u', '', $group); + $group_selected = preg_replace('/[^-_0-9\p{L}]/u', '', $group_selected); + $groupselect = preg_replace('/[^-_0-9\p{L}]/u', '', $groupselect); + $channel_group = preg_replace('/[^-_0-9\p{L}]/u', '', $channel_group); } -$PHP_AUTH_USER = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^0-9a-zA-Z]/', '', $PHP_AUTH_PW); - $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); @@ -385,7 +437,6 @@ echo "\n\n\n


\n"._QXZ("script runtime").": $RUNtime "._Q ?> - @@ -393,11 +444,4 @@ echo "\n\n\n


\n"._QXZ("script runtime").": $RUNtime "._Q exit; - - ?> - - - - - diff --git a/www/vicidial/closer_dispo.php b/www/vicidial/closer_dispo.php index 68ca7df2..47b6e024 100644 --- a/www/vicidial/closer_dispo.php +++ b/www/vicidial/closer_dispo.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # this is the closer disposition screen of a call that has been grabbed. This # allows the closer to modify customer information and disposition the call @@ -17,6 +17,7 @@ # 141007-2138 - Finalized adding QXZ translation to all admin files # 141229-2037 - Added code for on-the-fly language translations display # 170409-1532 - Added IP List validation code +# 220224-1611 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -41,7 +42,7 @@ if (isset($_GET["phone_number"])) {$phone_number=$_GET["phone_number"];} if (isset($_GET["end_call"])) {$end_call=$_GET["end_call"];} elseif (isset($_POST["end_call"])) {$end_call=$_POST["end_call"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} - elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} + elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["dispo"])) {$dispo=$_GET["dispo"];} elseif (isset($_POST["dispo"])) {$dispo=$_POST["dispo"];} if (isset($_GET["list_id"])) {$list_id=$_GET["list_id"];} @@ -97,9 +98,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -110,19 +111,69 @@ if ($qm_conf_ct > 0) $user_territories_active = $row[3]; $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; + $SSallow_web_debug = $row[6]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip); +$dialplan_number = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$dialplan_number); +$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$extension); +$PHONE_LOGIN = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$PHONE_LOGIN); +$channel = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$channel); +$parked_time = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_time); +$debugvars = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$debugvars); +$parked_by = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_by); +$submit = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$submit); +$SUBMIT = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$SUBMIT); +$vendor_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$vendor_id); +$phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone); +$lead_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$lead_id); +$first_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$first_name); +$last_name = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$last_name); +$phone_number = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_number); +$end_call = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$end_call); +$DB = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$DB); +$dispo = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$dispo); +$list_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$list_id); +$campaign_id = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$campaign_id); +$phone_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$phone_code); +$call_began = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$call_began); +$tsr = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$tsr); +$address1 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address1); +$address2 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address2); +$address3 = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$address3); +$city = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$city); +$state = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$state); +$postal_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$postal_code); +$province = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$province); +$country_code = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$country_code); +$alt_phone = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$alt_phone); +$email = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$email); +$security = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$security); +$comments = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$comments); +$status = preg_replace("/\<|\>|\’|\"|\\\\|;/",'-',$status ); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); + $group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); + $group_selected = preg_replace('/[^-_0-9a-zA-Z]/', '', $group_selected); + $groupselect = preg_replace('/[^-_0-9a-zA-Z]/', '', $groupselect); + $channel_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $channel_group); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); + $group = preg_replace('/[^-_0-9\p{L}]/u', '', $group); + $group_selected = preg_replace('/[^-_0-9\p{L}]/u', '', $group_selected); + $groupselect = preg_replace('/[^-_0-9\p{L}]/u', '', $groupselect); + $channel_group = preg_replace('/[^-_0-9\p{L}]/u', '', $channel_group); } $STARTtime = date("U"); diff --git a/www/vicidial/closer_popup.php b/www/vicidial/closer_popup.php index c3bf2cd3..f6709402 100644 --- a/www/vicidial/closer_popup.php +++ b/www/vicidial/closer_popup.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # this is the closer popup of a specific call that grabs the call and allows you # to go and fetch info on that caller in the local CRM system. @@ -17,6 +17,7 @@ # 141007-2213 - Finalized adding QXZ translation to all admin files # 141229-2035 - Added code for on-the-fly language translations display # 170409-1532 - Added IP List validation code +# 220224-1554 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -63,9 +64,9 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -76,19 +77,42 @@ if ($qm_conf_ct > 0) $user_territories_active = $row[3]; $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; + $SSallow_web_debug = $row[6]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip); +$dialplan_number = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$dialplan_number); +$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$extension); +$PHONE_LOGIN = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$PHONE_LOGIN); +$channel = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$channel); +$parked_time = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_time); +$debugvars = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$debugvars); +$parked_by = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parked_by); +$submit = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$submit); +$SUBMIT = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); + $group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); + $group_selected = preg_replace('/[^-_0-9a-zA-Z]/', '', $group_selected); + $groupselect = preg_replace('/[^-_0-9a-zA-Z]/', '', $groupselect); + $channel_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $channel_group); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); + $group = preg_replace('/[^-_0-9\p{L}]/u', '', $group); + $group_selected = preg_replace('/[^-_0-9\p{L}]/u', '', $group_selected); + $groupselect = preg_replace('/[^-_0-9\p{L}]/u', '', $groupselect); + $channel_group = preg_replace('/[^-_0-9\p{L}]/u', '', $channel_group); } #$DB=1; diff --git a/www/vicidial/display_help.php b/www/vicidial/display_help.php index 0c003b65..2b03656b 100644 --- a/www/vicidial/display_help.php +++ b/www/vicidial/display_help.php @@ -1,13 +1,14 @@ , Joe Johnson LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell , Joe Johnson LICENSE: AGPLv2 # # pulls help text to display on the screen when the appropriate help link is clicked # # CHANGELOG: # 180501-0045 - First build # 180512-1055 - Added update of help_documentation.txt file if modified +# 220224-1053 - Added allow_web_debug system setting # $startMS = microtime(); @@ -20,19 +21,20 @@ if ( file_exists($help_file) ) require("dbconnect_mysqli.php"); require("functions.php"); +$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; +$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; if (isset($_GET["help_id"])) {$help_id=$_GET["help_id"];} elseif (isset($_POST["help_id"])) {$help_id=$_POST["help_id"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} -$help_id = preg_replace('/[^-\_0-9a-zA-Z]/', '',$help_id); $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,enable_languages,language_method,help_modification_date FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_languages,language_method,help_modification_date,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -41,12 +43,13 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[1]; $SSlanguage_method = $row[2]; $help_modification_date = $row[3]; + $SSallow_web_debug = $row[4]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; -$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; +$help_id = preg_replace('/[^-_0-9a-zA-Z]/', '',$help_id); if ($non_latin < 1) { @@ -55,8 +58,8 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace('/\'|\"|\\\\|;/', '',$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace('/\'|\"|\\\\|;/', '',$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; diff --git a/www/vicidial/list_download.php b/www/vicidial/list_download.php index d36497bb..5f9d82eb 100644 --- a/www/vicidial/list_download.php +++ b/www/vicidial/list_download.php @@ -4,7 +4,7 @@ # downloads the entire contents of a vicidial list ID to a flat text file # that is tab delimited # -# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # @@ -38,6 +38,7 @@ # 190926-1015 - Fix for PHP7 # 201208-1630 - Fix for custom fields issue when downloading list with no custom fields itself # 210308-0939 - Fix for ALL_DNC_CAMPAIGNS dnc download +# 220224-1041 - Added allow_web_debug system setting # $startMS = microtime(); @@ -71,9 +72,9 @@ $db_source = 'M'; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,active_modules,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -86,10 +87,18 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[5]; $SSlanguage_method = $row[6]; $active_modules = $row[7]; + $SSallow_web_debug = $row[8]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id); +$group_id = preg_replace('/[^-_0-9a-zA-Z]/','',$group_id); +$download_type = preg_replace('/[^-_0-9a-zA-Z]/','',$download_type); +$submit = preg_replace('/[^-_0-9a-zA-Z]/','',$submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/','',$SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -97,12 +106,9 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$list_id = preg_replace('/[^-_0-9a-zA-Z]/','',$list_id); -$group_id = preg_replace('/[^-_0-9a-zA-Z]/','',$group_id); -$download_type = preg_replace('/[^-_0-9a-zA-Z]/','',$download_type); $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} diff --git a/www/vicidial/qc_api.php b/www/vicidial/qc_api.php index d075678b..b40667ca 100644 --- a/www/vicidial/qc_api.php +++ b/www/vicidial/qc_api.php @@ -2,7 +2,7 @@ # qc_api.php # # Copyright (C) 2012 poundteam.com LICENSE: AGPLv2 -# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed to allow API functions for QC applications, contributed by poundteam.com # @@ -16,10 +16,11 @@ # 141229-2015 - Added code for on-the-fly language translations display # 150626-2120 - Modified mysqli_error() to mysqli_connect_error() where appropriate # 210306-1051 - Changes for new QC module +# 220224-1021 - Added allow_web_debug system setting # -$version = '2.14-8'; -$build = '210306-1051'; +$version = '2.14-9'; +$build = '220224-1021'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -142,9 +143,9 @@ header ("Pragma: no-cache"); // HTTP/1.0 ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -152,12 +153,28 @@ if ($qm_conf_ct > 0) $non_latin = $row[0]; $SSenable_languages = $row[1]; $SSlanguage_method = $row[2]; + $SSallow_web_debug = $row[3]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### $ingroup_choices = preg_replace("/\+/"," ",$ingroup_choices); $query_string = preg_replace("/'|\"|\\\\|;/","",$query_string); +$dial_override = preg_replace("/[^A-Z]/","",$dial_override); +$consultative = preg_replace("/[^A-Z]/","",$consultative); +$phone_code = preg_replace("/[^0-9X]/","",$phone_code); +$format = preg_replace("/[^0-9a-zA-Z]/","",$format); +$set_as_default = preg_replace("/[^A-Z]/","",$set_as_default); +$phone_number = preg_replace("/[^0-9]/","",$phone_number); +$blended = preg_replace("/[^A-Z]/","",$blended); +$vtiger_callback = preg_replace("/[^A-Z]/","",$vtiger_callback); +$alt_dial = preg_replace("/[^0-9A-Z]/","",$alt_dial); +$rank = preg_replace("/[^-0-9]/","",$rank); +$stage = preg_replace("/[^-_0-9a-zA-Z]/","",$stage); +$close_window_link = preg_replace("/[^-_0-9a-zA-Z]/","",$close_window_link); +$dnc_check = preg_replace("/[^-_0-9a-zA-Z]/","",$dnc_check); +$campaign_dnc_check = preg_replace("/[^-_0-9a-zA-Z]/","",$campaign_dnc_check); if ($non_latin < 1) { @@ -165,24 +182,18 @@ if ($non_latin < 1) $pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass); $agent_user=preg_replace("/[^0-9a-zA-Z]/","",$agent_user); $function = preg_replace("/[^-\_0-9a-zA-Z]/","",$function); + $status = preg_replace("/[^-_0-9a-zA-Z]/","",$status); $value = preg_replace("/[^-\_0-9a-zA-Z]/","",$value); $vendor_id = preg_replace("/[^-\.\_0-9a-zA-Z]/","",$vendor_id); $focus = preg_replace("/[^-\_0-9a-zA-Z]/","",$focus); $preview = preg_replace("/[^-\_0-9a-zA-Z]/","",$preview); $notes = preg_replace("/\+/"," ",$notes); $notes = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$notes); - $phone_code = preg_replace("/[^0-9X]/","",$phone_code); $search = preg_replace("/[^-\_0-9a-zA-Z]/","",$search); $group_alias = preg_replace("/[^0-9a-zA-Z]/","",$group_alias); $dial_prefix = preg_replace("/[^0-9a-zA-Z]/","",$dial_prefix); $source = preg_replace("/[^0-9a-zA-Z]/","",$source); - $format = preg_replace("/[^0-9a-zA-Z]/","",$format); - $vtiger_callback = preg_replace("/[^A-Z]/","",$vtiger_callback); - $alt_dial = preg_replace("/[^0-9A-Z]/","",$alt_dial); - $blended = preg_replace("/[^A-Z]/","",$blended); $ingroup_choices = preg_replace("/[^- \_0-9a-zA-Z]/","",$ingroup_choices); - $set_as_default = preg_replace("/[^A-Z]/","",$set_as_default); - $phone_number = preg_replace("/[^0-9]/","",$phone_number); $address1 = preg_replace("/[^- \_0-9a-zA-Z]/","",$address1); $address2 = preg_replace("/[^- \_0-9a-zA-Z]/","",$address2); $address3 = preg_replace("/[^- \_0-9a-zA-Z]/","",$address3); @@ -204,10 +215,7 @@ if ($non_latin < 1) $state = preg_replace("/[^- \_0-9a-zA-Z]/","",$state); $title = preg_replace("/[^- \_0-9a-zA-Z]/","",$title); $vendor_lead_code = preg_replace("/[^- \.\_0-9a-zA-Z]/","",$vendor_lead_code); - $rank = preg_replace("/[^-0-9]/","",$rank); $owner = preg_replace("/[^-\.\:\/\@\_0-9a-zA-Z]/","",$owner); - $dial_override = preg_replace("/[^A-Z]/","",$dial_override); - $consultative = preg_replace("/[^A-Z]/","",$consultative); $callback_datetime = preg_replace("/\+/"," ",$callback_datetime); $callback_datetime = preg_replace("/[^- \:\.\_0-9a-zA-Z]/","",$callback_datetime); $callback_type = preg_replace("/[^A-Z]/","",$callback_type); @@ -219,11 +227,51 @@ if ($non_latin < 1) } else { - $user = preg_replace("/'|\"|\\\\|;/","",$user); - $pass = preg_replace("/'|\"|\\\\|;/","",$pass); - $source = preg_replace("/'|\"|\\\\|;/","",$source); - $agent_user = preg_replace("/'|\"|\\\\|;/","",$agent_user); - $alt_user = preg_replace("/'|\"|\\\\|;/","",$alt_user); + $user=preg_replace("/[^-_0-9\p{L}]/u","",$user); + $pass=preg_replace("/[^-_0-9\p{L}]/u","",$pass); + $agent_user=preg_replace("/[^0-9\p{L}]/u","",$agent_user); + $function = preg_replace("/[^-\_0-9\p{L}]/u","",$function); + $value = preg_replace("/[^-\_0-9\p{L}]/u","",$value); + $vendor_id = preg_replace("/[^-\.\_0-9\p{L}]/u","",$vendor_id); + $focus = preg_replace("/[^-\_0-9\p{L}]/u","",$focus); + $preview = preg_replace("/[^-\_0-9\p{L}]/u","",$preview); + $notes = preg_replace("/\+/"," ",$notes); + $notes = preg_replace("/[^- \.\_0-9\p{L}]/u","",$notes); + $search = preg_replace("/[^-\_0-9\p{L}]/u","",$search); + $group_alias = preg_replace("/[^0-9\p{L}]/u","",$group_alias); + $dial_prefix = preg_replace("/[^0-9\p{L}]/u","",$dial_prefix); + $source = preg_replace("/[^0-9\p{L}]/u","",$source); + $ingroup_choices = preg_replace("/[^- \_0-9\p{L}]/u","",$ingroup_choices); + $address1 = preg_replace("/[^- \_0-9\p{L}]/u","",$address1); + $address2 = preg_replace("/[^- \_0-9\p{L}]/u","",$address2); + $address3 = preg_replace("/[^- \_0-9\p{L}]/u","",$address3); + $alt_phone = preg_replace("/[^- \_0-9\p{L}]/u","",$alt_phone); + $city = preg_replace("/[^- \_0-9\p{L}]/u","",$city); + $comments = preg_replace("/[^- \_0-9\p{L}]/u","",$comments); + $country_code = preg_replace("/[^A-Z]/","",$country_code); + $date_of_birth = preg_replace("/[^- \_0-9]/","",$date_of_birth); + $email = preg_replace("/[^-\.\:\/\@\_0-9\p{L}]/u","",$email); + $first_name = preg_replace("/[^- \_0-9\p{L}]/u","",$first_name); + $gender = preg_replace("/[^A-Z]/","",$gender); + $gmt_offset_now = preg_replace("/[^- \.\_0-9]/","",$gmt_offset_now); + $last_name = preg_replace("/[^- \_0-9\p{L}]/u","",$last_name); + $lead_id = preg_replace("/[^0-9]/","",$lead_id); + $middle_initial = preg_replace("/[^- \_0-9\p{L}]/u","",$middle_initial); + $province = preg_replace("/[^- \.\_0-9\p{L}]/u","",$province); + $security_phrase = preg_replace("/[^- \.\_0-9\p{L}]/u","",$security_phrase); + $source_id = preg_replace("/[^- \.\_0-9\p{L}]/u","",$source_id); + $state = preg_replace("/[^- \_0-9\p{L}]/u","",$state); + $title = preg_replace("/[^- \_0-9\p{L}]/u","",$title); + $vendor_lead_code = preg_replace("/[^- \.\_0-9\p{L}]/u","",$vendor_lead_code); + $owner = preg_replace("/[^-\.\:\/\@\_0-9\p{L}]/u","",$owner); + $callback_datetime = preg_replace("/\+/"," ",$callback_datetime); + $callback_datetime = preg_replace("/[^- \:\.\_0-9\p{L}]/u","",$callback_datetime); + $callback_type = preg_replace("/[^A-Z]/","",$callback_type); + $callback_comments = preg_replace("/\+/"," ",$callback_comments); + $callback_comments = preg_replace("/[^- \.\_0-9\p{L}]/u","",$callback_comments); + $qm_dispo_code = preg_replace("/[^-\.\_0-9\p{L}]/u","",$qm_dispo_code); + $alt_user = preg_replace("/[^0-9\p{L}]/u","",$alt_user); + $postal_code = preg_replace("/[^- \.\_0-9\p{L}]/u","",$postal_code); } ### date and fixed variables diff --git a/www/vicidial/qc_call_client_iframe.php b/www/vicidial/qc_call_client_iframe.php index d45c0523..b6acb9fb 100644 --- a/www/vicidial/qc_call_client_iframe.php +++ b/www/vicidial/qc_call_client_iframe.php @@ -4,7 +4,7 @@ # ViciDial database administration modify lead in vicidial_list # # Copyright (C) 2012 poundteam.com LICENSE: AGPLv2 -# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed to allow QC review and modification of leads, contributed by poundteam.com # @@ -20,6 +20,7 @@ # 210306-1052 - Changes for new QC module # 210825-0937 - Removed custom fields, unused here. # 210827-1818 - Fix for security issue +# 220224-0947 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -137,12 +138,15 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); +$date = date("r"); +$ip = getenv("REMOTE_ADDR"); +$browser = getenv("HTTP_USER_AGENT"); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,custom_fields_enabled,enable_languages,language_method,qc_features_active FROM system_settings;"; +$stmt = "SELECT use_non_latin,custom_fields_enabled,enable_languages,language_method,qc_features_active,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -152,33 +156,98 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[2]; $SSlanguage_method = $row[3]; $SSqc_features_active = $row[4]; + $SSallow_web_debug = $row[5]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### -$date = date("r"); -$ip = getenv("REMOTE_ADDR"); -$browser = getenv("HTTP_USER_AGENT"); +$old_phone = preg_replace('/[^0-9]/','',$old_phone); +$phone_number = preg_replace('/[^0-9]/','',$phone_number); + if (strlen($phone_number)<6) {$phone_number=$old_phone;} +$alt_phone = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$alt_phone); +$list_id = preg_replace('/[^0-9]/','',$list_id); +$lead_id = preg_replace('/[^0-9a-zA-Z]/','',$lead_id); +$entry_list_id = preg_replace('/[^0-9]/','',$entry_list_id); +$phone_code = preg_replace('/[^0-9]/','',$phone_code); +$update_phone_number=preg_replace('/[^A-Z]/','',$update_phone_number); +$vendor_lead_code = preg_replace('/;|#/','',$vendor_lead_code); + $vendor_lead_code = preg_replace('/\+/',' ',$vendor_lead_code); +$source_id = preg_replace('/;|#/','',$source_id); + $source_id = preg_replace('/\+/',' ',$source_id); +$gmt_offset_now = preg_replace('/[^-\_\.0-9]/','',$gmt_offset_now); +$country_code = preg_replace('/[^A-Z]/','',$country_code); +$gender = preg_replace('/[^A-Z]/','',$gender); +$date_of_birth = preg_replace('/[^-0-9]/','',$date_of_birth); +$comments = preg_replace('/;|#/','',$comments); + $comments = preg_replace('/\+/',' ',$comments); +$rank = preg_replace('/[^0-9]/','',$rank); +$no_update = preg_replace('/[^A-Z]/','',$no_update); +$called_count=preg_replace('/[^0-9]/','',$called_count); +$local_gmt=preg_replace('/[^-\.0-9]/','',$local_gmt); +$callback = preg_replace('/[^A-Z]/','',$callback); +$callback_type = preg_replace('/[^A-Z]/','',$callback_type); +$end_call=preg_replace('/[^0-9]/','',$end_call); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip); +$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$extension); +$channel = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$channel); +$submit = preg_replace('/[^- \.\_0-9a-zA-Z]/','',$submit); +$SUBMIT = preg_replace('/[^- \.\_0-9a-zA-Z]/','',$SUBMIT); +$modify_logs=preg_replace('/[^0-9]/','',$modify_logs); +$modify_closer_logs=preg_replace('/[^0-9]/','',$modify_closer_logs); +$modify_agent_logs=preg_replace('/[^0-9]/','',$modify_agent_logs); +$add_closer_record=preg_replace('/[^0-9]/','',$add_closer_record); +$call_began = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$call_began); +$parked_time = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$parked_time); +$callback_id = preg_replace('/[^-_0-9a-zA-Z]/','',$callback_id); +$CBchangeUSERtoANY = preg_replace('/[^-_0-9a-zA-Z]/','',$CBchangeUSERtoANY); +$CBchangeANYtoUSER = preg_replace('/[^-_0-9a-zA-Z]/','',$CBchangeANYtoUSER); +$CBchangeUSERtoUSER = preg_replace('/[^-_0-9a-zA-Z]/','',$CBchangeUSERtoUSER); +$CBchangeDATE = preg_replace('/[^-_0-9a-zA-Z]/','',$CBchangeDATE); +$archive_search = preg_replace('/[^-_0-9a-zA-Z]/','',$archive_search); +$archive_log = preg_replace('/[^-_0-9a-zA-Z]/','',$archive_log); +$gdpr_action = preg_replace('/[^-_0-9a-zA-Z]/','',$gdpr_action); +$CIDdisplay = preg_replace('/[^-_0-9a-zA-Z]/','',$CIDdisplay); +$appointment_date = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$appointment_date); +$appointment_time = preg_replace('/[^- \:\_0-9a-zA-Z]/','',$appointment_time); +$vendor_id = preg_replace("/\<|\>|\"|\\\\|;/",'-',$vendor_id); +$phone = preg_replace("/\<|\>|\"|\\\\|;/",'-',$phone); +$title = preg_replace("/\<|\>|\"|\\\\|;/",'-',$title); +$first_name = preg_replace("/\<|\>|\"|\\\\|;/",'-',$first_name); +$middle_initial = preg_replace("/\<|\>|\"|\\\\|;/",'-',$middle_initial); +$last_name = preg_replace("/\<|\>|\"|\\\\|;/",'-',$last_name); +$lead_name = preg_replace("/\<|\>|\"|\\\\|;/",'-',$lead_name); +$tsr = preg_replace("/\<|\>|\"|\\\\|;/",'-',$tsr); +$address1 = preg_replace("/\<|\>|\"|\\\\|;/",'-',$address1); +$address2 = preg_replace("/\<|\>|\"|\\\\|;/",'-',$address2); +$address3 = preg_replace("/\<|\>|\"|\\\\|;/",'-',$address3); +$city = preg_replace("/\<|\>|\"|\\\\|;/",'-',$city); +$state = preg_replace("/\<|\>|\"|\\\\|;/",'-',$state); +$postal_code = preg_replace("/\<|\>|\"|\\\\|;/",'-',$postal_code); +$province = preg_replace("/\<|\>|\"|\\\\|;/",'-',$province); +$email = preg_replace("/\<|\>|\"|\\\\|;/",'-',$email); +$security = preg_replace("/\<|\>|\"|\\\\|;/",'-',$security); +$owner = preg_replace("/\<|\>|\"|\\\\|;/",'-',$owner); if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); + $campaign_id = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign_id); + $dispo = preg_replace('/[^-_0-9a-zA-Z]/','',$dispo); + $status = preg_replace('/[^-_0-9a-zA-Z]/','',$status); + $CBuser = preg_replace('/[^-_0-9a-zA-Z]/','',$CBuser); } # end of non_latin else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $campaign_id = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign_id); + $dispo = preg_replace('/[^-_0-9\p{L}]/u', '', $dispo); + $status = preg_replace('/[^-_0-9\p{L}]/u', '', $status); + $CBuser = preg_replace('/[^-_0-9\p{L}]/u', '', $CBuser); } -$old_phone = preg_replace('/[^0-9]/','',$old_phone); -$phone_number = preg_replace('/[^0-9]/','',$phone_number); -$alt_phone = preg_replace('/[^0-9]/','',$alt_phone); -$lead_id = preg_replace('/[^0-9]/','',$lead_id); -$list_id = preg_replace('/[^0-9]/','',$list_id); - -if (strlen($phone_number)<6) {$phone_number=$old_phone;} - $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); @@ -276,6 +345,6 @@ else { echo "$qc_user_logged_in

"; } -echo " "._QXZ("Refresh").""; +echo " "._QXZ("Refresh").""; ?> diff --git a/www/vicidial/qc_modify_lead.php b/www/vicidial/qc_modify_lead.php index 69869406..4a14ba34 100644 --- a/www/vicidial/qc_modify_lead.php +++ b/www/vicidial/qc_modify_lead.php @@ -6,7 +6,7 @@ # qc_modify_lead.php # # Copyright (C) 2012 poundteam.com LICENSE: AGPLv2 -# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script is designed to allow QC review and modification of leads, contributed by poundteam.com # @@ -31,6 +31,7 @@ # 210304-1650 - Added modify_leads=5 read-only option # 210306-0854 - Redesign of QC module # 210827-1818 - Fix for security issue +# 220224-2143 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -167,13 +168,36 @@ if (isset($_POST["referring_section"])) {$referring_section=$_POST["referring_ if (isset($_POST["referring_element"])) {$referring_element=$_POST["referring_element"];} elseif (isset($_GET["referring_element"])) {$referring_element=$_GET["referring_element"];} +$DB=preg_replace('/[^0-9]/','',$DB); + +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$stmt = "SELECT use_non_latin,custom_fields_enabled,enable_languages,language_method,active_modules,log_recording_access,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $custom_fields_enabled = $row[1]; + $SSenable_languages = $row[2]; + $SSlanguage_method = $row[3]; + $active_modules = $row[4]; + $log_recording_access = $row[5]; + $SSallow_web_debug = $row[6]; + } +if ($SSallow_web_debug < 1) {$DB=0;} +##### END SETTINGS LOOKUP ##### +########################################### + $CBchangeANYtoUSER=preg_replace('/[^A-Z]/','',$CBchangeANYtoUSER); $CBchangeDATE=preg_replace('/[^A-Z]/','',$CBchangeDATE); $CBchangeUSERtoANY=preg_replace('/[^A-Z]/','',$CBchangeUSERtoANY); $CBchangeUSERtoUSER=preg_replace('/[^A-Z]/','',$CBchangeUSERtoUSER); $claim_QC=preg_replace('/[^A-Z]/','',$claim_QC); $referring_section=preg_replace('/[^A-Z]/','',$referring_section); -$DB=preg_replace('/[^0-9]/','',$DB); +$call_began = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$call_began); if ($non_latin < 1) { @@ -215,8 +239,8 @@ if ($non_latin < 1) } else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); $user=preg_replace('/[^-_0-9\p{L}]/u','',$user); $tsr=preg_replace('/[^-_0-9\p{L}]/u','',$tsr); $CBuser=preg_replace('/[^-_0-9\p{L}]/u','',$CBuser); @@ -265,7 +289,6 @@ $email = preg_replace('/\+/',' ',$email); $security_phrase = preg_replace('/\+/',' ',$security_phrase); $owner = preg_replace('/\+/',' ',$owner); - $list_id = preg_replace('/[^0-9]/','',$list_id); $lead_id = preg_replace('/[^0-9a-zA-Z]/','',$lead_id); $entry_list_id = preg_replace('/[^0-9]/','',$entry_list_id); @@ -324,40 +347,6 @@ switch($referring_section) # was $scorecard_source break; } -############################################# -##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,custom_fields_enabled,enable_languages,language_method,active_modules,log_recording_access FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $custom_fields_enabled = $row[1]; - $SSenable_languages = $row[2]; - $SSlanguage_method = $row[3]; - $active_modules = $row[4]; - $log_recording_access = $row[5]; - } -##### END SETTINGS LOOKUP ##### -########################################### - -if ($non_latin < 1) - { - $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); - - $old_phone = preg_replace('/[^0-9]/','',$old_phone); - $phone_number = preg_replace('/[^0-9]/','',$phone_number); - $alt_phone = preg_replace('/[^0-9]/','',$alt_phone); - } # end of non_latin -else - { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - } - $rights_stmt = "SELECT modify_leads,qc_enabled,full_name,modify_leads,user_group,selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rights_rslt=mysql_to_mysqli($rights_stmt, $link); diff --git a/www/vicidial/qc_module_actions.php b/www/vicidial/qc_module_actions.php index 186532f4..1bc4f65f 100644 --- a/www/vicidial/qc_module_actions.php +++ b/www/vicidial/qc_module_actions.php @@ -1,4 +1,15 @@ LICENSE: AGPLv2 +# +# CHANGES: +# 210309-1645 - First build +# 220224-0836 - Added allow_web_debug system setting +# + header ("Content-type: text/html; charset=utf-8"); require("dbconnect_mysqli.php"); @@ -12,39 +23,11 @@ if ( file_exists("/etc/mysql_enc.conf") ) { } } - $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $QUERY_STRING = getenv("QUERY_STRING"); $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); - -############################################# -##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,admin_screen_colors,qc_features_active FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSauto_dial_limit = $row[1]; - $SSuser_territories_active = $row[2]; - $SSallow_custom_dialplan = $row[3]; - $SScallcard_enabled = $row[4]; - $SSadmin_modify_refresh = $row[5]; - $SSnocache_admin = $row[6]; - $SSwebroot_writable = $row[7]; - $SSadmin_screen_colors = $row[8]; - $SSqc_features_active = $row[9]; - - # slightly increase limit value, because PHP somehow thinks 2.8 > 2.8 - $SSauto_dial_limit = ($SSauto_dial_limit + 0.001); - } -##### END SETTINGS LOOKUP ##### -########################################### - if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["end_date"])) {$end_date=$_GET["end_date"];} @@ -71,12 +54,10 @@ if (isset($_GET["qc_agent_comments"])) {$qc_agent_comments=$_GET["qc_agent_comme elseif (isset($_POST["qc_agent_comments"])) {$qc_agent_comments=$_POST["qc_agent_comments"];} if (isset($_GET["qc_manager_comments"])) {$qc_manager_comments=$_GET["qc_manager_comments"];} elseif (isset($_POST["qc_manager_comments"])) {$qc_manager_comments=$_POST["qc_manager_comments"];} - if (isset($_GET["field_name"])) {$field_name=$_GET["field_name"];} elseif (isset($_POST["field_name"])) {$field_name=$_POST["field_name"];} if (isset($_GET["field_value"])) {$field_value=$_GET["field_value"];} elseif (isset($_POST["field_value"])) {$field_value=$_POST["field_value"];} - if (isset($_GET["lead_id"])) {$lead_id=$_GET["lead_id"];} elseif (isset($_POST["lead_id"])) {$lead_id=$_POST["lead_id"];} if (isset($_GET["callback_id"])) {$callback_id=$_GET["callback_id"];} @@ -89,8 +70,6 @@ if (isset($_GET["callback_time"])) {$callback_time=$_GET["callback_time"];} elseif (isset($_POST["callback_time"])) {$callback_time=$_POST["callback_time"];} if (isset($_GET["callback_comments"])) {$callback_comments=$_GET["callback_comments"];} elseif (isset($_POST["callback_comments"])) {$callback_comments=$_POST["callback_comments"];} - - if (isset($_GET["qc_checkpoint_log_id"])) {$qc_checkpoint_log_id=$_GET["qc_checkpoint_log_id"];} elseif (isset($_POST["qc_checkpoint_log_id"])) {$qc_checkpoint_log_id=$_POST["qc_checkpoint_log_id"];} if (isset($_GET["qc_level"])) {$qc_level=$_GET["qc_level"];} @@ -152,6 +131,92 @@ $defaultappointment = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $STARTtime = date("U"); +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,admin_screen_colors,qc_features_active,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSauto_dial_limit = $row[1]; + $SSuser_territories_active = $row[2]; + $SSallow_custom_dialplan = $row[3]; + $SScallcard_enabled = $row[4]; + $SSadmin_modify_refresh = $row[5]; + $SSnocache_admin = $row[6]; + $SSwebroot_writable = $row[7]; + $SSadmin_screen_colors = $row[8]; + $SSqc_features_active = $row[9]; + # slightly increase limit value, because PHP somehow thinks 2.8 > 2.8 + $SSauto_dial_limit = ($SSauto_dial_limit + 0.001); + $SSallow_web_debug = $row[10]; + } +if ($SSallow_web_debug < 1) {$DB=0;} +##### END SETTINGS LOOKUP ##### +########################################### + +$lead_id = preg_replace('/[^0-9]/', '', $lead_id); +$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $end_date); +$modify_date = preg_replace('/[^- \:\_0-9a-zA-Z]/', '', $modify_date); +$recording_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $recording_id); +$qc_action = preg_replace('/[^-_0-9a-zA-Z]/', '', $qc_action); +$claim_rec = preg_replace('/[^-_0-9a-zA-Z]/', '', $claim_rec); +$mgr_override = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$mgr_override); +$scorecard_id = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$scorecard_id); +$qc_row_id = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$qc_row_id); +$qc_log_id = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$qc_log_id); +$qc_status = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$qc_status); +$qc_agent_comments = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$qc_agent_comments); +$qc_manager_comments = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$qc_manager_comments); +$field_name = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$field_name); +$field_value = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$field_value); +$callback_id = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$callback_id); +$recipient = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$recipient); +$CBuser = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$CBuser); +$callback_time = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$callback_time); +$callback_comments = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$callback_comments); +$qc_checkpoint_log_id = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$qc_checkpoint_log_id); +$qc_level = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$qc_level); +$checkpoint_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$checkpoint_rank); +$checkpoint_points = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$checkpoint_points); +$checkpoint_points_earned = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$checkpoint_points_earned); +$new_checkpoint_points = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$new_checkpoint_points); +$checkpoint_points_failed = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$checkpoint_points_failed); +$old_checkpoint_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$old_checkpoint_rank); +$new_checkpoint_rank = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$new_checkpoint_rank); +$new_active = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$new_active); +$new_commission_loss = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$new_commission_loss); +$new_instant_fail = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$new_instant_fail); +$new_checkpoint_text = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$new_checkpoint_text); +$new_checkpoint_text_presets = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$new_checkpoint_text_presets); +$checkpoint_row_id = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$checkpoint_row_id); +$checkpoint_comment_agent = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$checkpoint_comment_agent); +$checkpoint_answer = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$checkpoint_answer); +$instant_fail = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$instant_fail); +$instant_fail_value = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$instant_fail_value); +$commission_loss = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$commission_loss); +$parameter = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parameter); +$parameter_value = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$parameter_value); +$recording_timestamp = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$recording_timestamp); +$upd_customer = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$upd_customer); +$view_epoch = preg_replace("/\<|\>|\'|\"|\\\\|;/",'-',$view_epoch); +$new_admin_notes = preg_replace("/\<|\>|\"|\\\\|;/",'-',$new_admin_notes); +$admin_notes = preg_replace("/\<|\>|\"|\\\\|;/",'-',$admin_notes); + +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + } + $rights_stmt = "SELECT modify_leads,qc_enabled,full_name,modify_leads,user_group,selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rights_rslt=mysql_to_mysqli($rights_stmt, $link); diff --git a/www/vicidial/qc_scorecards.php b/www/vicidial/qc_scorecards.php index b9284632..d43c7968 100644 --- a/www/vicidial/qc_scorecards.php +++ b/www/vicidial/qc_scorecards.php @@ -1,17 +1,18 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # this screen manages QC Scorecards within VICIdial # # changes: # 210306-1532 - First Build # 210827-1818 - Fix for security issue +# 220224-2144 - Added allow_web_debug system setting # -$admin_version = '2.14-1'; -$build = '210306-1532'; +$admin_version = '2.14-2'; +$build = '220224-2144'; header ("Content-type: text/html; charset=utf-8"); @@ -28,45 +29,7 @@ $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $QUERY_STRING = getenv("QUERY_STRING"); $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); - -############################################# -##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,admin_screen_colors,qc_features_active,hosted_settings FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $SSauto_dial_limit = $row[1]; - $SSuser_territories_active = $row[2]; - $SSallow_custom_dialplan = $row[3]; - $SScallcard_enabled = $row[4]; - $SSadmin_modify_refresh = $row[5]; - $SSnocache_admin = $row[6]; - $SSwebroot_writable = $row[7]; - $SSadmin_screen_colors = $row[8]; - $SSqc_features_active = $row[9]; - $SShosted_settings = $row[10]; - - # slightly increase limit value, because PHP somehow thinks 2.8 > 2.8 - $SSauto_dial_limit = ($SSauto_dial_limit + 0.001); - } -##### END SETTINGS LOOKUP ##### -########################################### - -$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u','',$PHP_AUTH_USER); - -if ( file_exists("/etc/mysql_enc.conf") ) { - $DBCagc = file("/etc/mysql_enc.conf"); - foreach ($DBCagc as $DBCline) { - $DBCline = preg_replace("/ |>|\n|\r|\t|\#.*|;.*/","",$DBCline); - if (ereg("^enckey", $DBCline)) {$enckey = $DBCline; $enckey = preg_replace("/.*=/","",$enckey);} - } -} - -if (isset($_GET["DB"])) {$DB=$_GET["DB"];} +if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} @@ -85,15 +48,65 @@ if (isset($_GET["confirm_deletion"])) {$confirm_deletion=$_GET["confirm_deletion if (isset($_GET["scorecard_id"])) {$scorecard_id=$_GET["scorecard_id"];} elseif (isset($_POST["scorecard_id"])) {$scorecard_id=$_POST["scorecard_id"];} +if ( file_exists("/etc/mysql_enc.conf") ) { + $DBCagc = file("/etc/mysql_enc.conf"); + foreach ($DBCagc as $DBCline) { + $DBCline = preg_replace("/ |>|\n|\r|\t|\#.*|;.*/","",$DBCline); + if (ereg("^enckey", $DBCline)) {$enckey = $DBCline; $enckey = preg_replace("/.*=/","",$enckey);} + } +} + +$DB=preg_replace('/[^0-9]/','',$DB); + +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$stmt = "SELECT use_non_latin,auto_dial_limit,user_territories_active,allow_custom_dialplan,callcard_enabled,admin_modify_refresh,nocache_admin,webroot_writable,admin_screen_colors,qc_features_active,hosted_settings,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $SSauto_dial_limit = $row[1]; + $SSuser_territories_active = $row[2]; + $SSallow_custom_dialplan = $row[3]; + $SScallcard_enabled = $row[4]; + $SSadmin_modify_refresh = $row[5]; + $SSnocache_admin = $row[6]; + $SSwebroot_writable = $row[7]; + $SSadmin_screen_colors = $row[8]; + $SSqc_features_active = $row[9]; + $SShosted_settings = $row[10]; + # slightly increase limit value, because PHP somehow thinks 2.8 > 2.8 + $SSauto_dial_limit = ($SSauto_dial_limit + 0.001); + $SSallow_web_debug = $row[11]; + } +if ($SSallow_web_debug < 1) {$DB=0;} +##### END SETTINGS LOOKUP ##### +########################################### + $submit=preg_replace('/[^-0-9 \p{L}]/u','',$submit); -$new_scorecard_id = preg_replace('/[^-_0-9a-zA-Z]/','',$new_scorecard_id); -$new_scorecard_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$new_scorecard_name); $new_active = preg_replace('/[^NY]/','',$new_active); $active = preg_replace('/[^NY]/','',$active); $action = preg_replace('/[^-_0-9a-zA-Z]/','',$action); $confirm_deletion = preg_replace('/[^Y]/','',$confirm_deletion); $scorecard_id = preg_replace('/[^-_0-9a-zA-Z]/','',$scorecard_id); +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $new_scorecard_id = preg_replace('/[^-_0-9a-zA-Z]/','',$new_scorecard_id); + $new_scorecard_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$new_scorecard_name); + } +else + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $new_scorecard_id = preg_replace('/[^-_0-9\p{L}]/u','',$new_scorecard_id); + $new_scorecard_name = preg_replace('/[^- \.\,\_0-9\p{L}]/u','',$new_scorecard_name); + } $SSmenu_background='015B91'; $SSframe_background='D9E6FE'; @@ -132,11 +145,6 @@ $Mhead_color = $SSstd_row5_background; $Mmain_bgcolor = $SSmenu_background; $Mhead_color = $SSstd_row5_background; -if ($submit==_QXZ("SUBMIT NEW SCORECARD")) { - $ins_stmt="insert into quality_control_scorecards(qc_scorecard_id, scorecard_name, active) VALUES('".mysqli_escape_string($link, $new_scorecard_id)."', '".mysqli_escape_string($link, $new_scorecard_name)."', '$new_active')"; - $ins_rslt=mysql_to_mysqli($ins_stmt, $link); -} - # Valid user $auth=0; $auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1,0); @@ -166,6 +174,13 @@ if ($auth < 1) exit; } +# submit new scorecard +if ($submit==_QXZ("SUBMIT NEW SCORECARD")) + { + $ins_stmt="insert into quality_control_scorecards(qc_scorecard_id, scorecard_name, active) VALUES('".mysqli_escape_string($link, $new_scorecard_id)."', '".mysqli_escape_string($link, $new_scorecard_name)."', '$new_active')"; + $ins_rslt=mysql_to_mysqli($ins_stmt, $link); + } + if ($auth) { $office_no=strtoupper($PHP_AUTH_USER); diff --git a/www/vicidial/vdremote.php b/www/vicidial/vdremote.php index d343d99b..4f34fc42 100644 --- a/www/vicidial/vdremote.php +++ b/www/vicidial/vdremote.php @@ -4,7 +4,7 @@ # make sure you have added a user to the vicidial_users MySQL table with at # least user_level 4 to access this page the first time # -# Copyright (C) 2021 Matt Florell LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # Changes # 50307-1721 - First version @@ -22,10 +22,11 @@ # 141229-1847 - Added code for on-the-fly language translations display # 170217-1213 - Fixed non-latin auth issue #995 # 210618-1001 - Added CORS support +# 220224-0820 - Added allow_web_debug system setting # -$version = '2.14-14'; -$build = '210618-1001'; +$version = '2.14-15'; +$build = '220224-0820'; $php_script='vdremote.php'; require("dbconnect_mysqli.php"); @@ -35,37 +36,38 @@ $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); -if (isset($_GET["ADD"])) {$ADD=$_GET["ADD"];} - elseif (isset($_POST["ADD"])) {$ADD=$_POST["ADD"];} +if (isset($_GET["ADD"])) {$ADD=$_GET["ADD"];} + elseif (isset($_POST["ADD"])) {$ADD=$_POST["ADD"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} - elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} -if (isset($_GET["user"])) {$user=$_GET["user"];} - elseif (isset($_POST["user"])) {$user=$_POST["user"];} -if (isset($_GET["force_logout"])) {$force_logout=$_GET["force_logout"];} - elseif (isset($_POST["force_logout"])) {$force_logout=$_POST["force_logout"];} + elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} +if (isset($_GET["user"])) {$user=$_GET["user"];} + elseif (isset($_POST["user"])) {$user=$_POST["user"];} +if (isset($_GET["force_logout"])) {$force_logout=$_GET["force_logout"];} + elseif (isset($_POST["force_logout"])) {$force_logout=$_POST["force_logout"];} if (isset($_GET["groups"])) {$groups=$_GET["groups"];} - elseif (isset($_POST["groups"])) {$groups=$_POST["groups"];} -if (isset($_GET["remote_agent_id"])) {$remote_agent_id=$_GET["remote_agent_id"];} - elseif (isset($_POST["remote_agent_id"])) {$remote_agent_id=$_POST["remote_agent_id"];} + elseif (isset($_POST["groups"])) {$groups=$_POST["groups"];} +if (isset($_GET["remote_agent_id"])) {$remote_agent_id=$_GET["remote_agent_id"];} + elseif (isset($_POST["remote_agent_id"])) {$remote_agent_id=$_POST["remote_agent_id"];} if (isset($_GET["user_start"])) {$user_start=$_GET["user_start"];} - elseif (isset($_POST["user_start"])) {$user_start=$_POST["user_start"];} -if (isset($_GET["number_of_lines"])) {$number_of_lines=$_GET["number_of_lines"];} - elseif (isset($_POST["number_of_lines"])) {$number_of_lines=$_POST["number_of_lines"];} + elseif (isset($_POST["user_start"])) {$user_start=$_POST["user_start"];} +if (isset($_GET["number_of_lines"])) {$number_of_lines=$_GET["number_of_lines"];} + elseif (isset($_POST["number_of_lines"])) {$number_of_lines=$_POST["number_of_lines"];} if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];} elseif (isset($_POST["server_ip"])) {$server_ip=$_POST["server_ip"];} if (isset($_GET["conf_exten"])) {$conf_exten=$_GET["conf_exten"];} - elseif (isset($_POST["conf_exten"])) {$conf_exten=$_POST["conf_exten"];} + elseif (isset($_POST["conf_exten"])) {$conf_exten=$_POST["conf_exten"];} if (isset($_GET["status"])) {$status=$_GET["status"];} - elseif (isset($_POST["status"])) {$status=$_POST["status"];} -if (isset($_GET["campaign_id"])) {$campaign_id=$_GET["campaign_id"];} - elseif (isset($_POST["campaign_id"])) {$campaign_id=$_POST["campaign_id"];} + elseif (isset($_POST["status"])) {$status=$_POST["status"];} +if (isset($_GET["campaign_id"])) {$campaign_id=$_GET["campaign_id"];} + elseif (isset($_POST["campaign_id"])) {$campaign_id=$_POST["campaign_id"];} if (isset($_GET["groups"])) {$groups=$_GET["groups"];} - elseif (isset($_POST["groups"])) {$groups=$_POST["groups"];} + elseif (isset($_POST["groups"])) {$groups=$_POST["groups"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} - elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} + elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} - elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} + elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} +if (!isset($query_date)) {$query_date = $NOW_DATE;} if (!isset($force_logout)) {$force_logout = 0;} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); @@ -85,9 +87,9 @@ if ($force_logout) ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -99,23 +101,41 @@ if ($qm_conf_ct > 0) $custom_fields_enabled = $row[4]; $SSenable_languages = $row[5]; $SSlanguage_method = $row[6]; + $SSallow_web_debug = $row[7]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### -if (!isset($query_date)) {$query_date = $NOW_DATE;} +$remote_agent_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $remote_agent_id); +$query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date); +$ADD = preg_replace('/[^-_0-9a-zA-Z]/', '', $ADD); +$force_logout = preg_replace('/[^-_0-9a-zA-Z]/', '', $force_logout); +$user_start = preg_replace('/[^-_0-9a-zA-Z]/', '', $user_start); +$number_of_lines = preg_replace('/[^-_0-9a-zA-Z]/', '', $number_of_lines); +$status = preg_replace('/[^-_0-9a-zA-Z]/', '', $status); +$conf_exten = preg_replace('/[^-_0-9a-zA-Z]/', '', $conf_exten); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); + +# Variables filtered further down in the code +# $groups + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); + $campaign_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $campaign_id); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); + $campaign_id = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign_id); } -$remote_agent_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $remote_agent_id); -$query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date); $popup_page = './closer_popup.php'; $STARTtime = date("U"); @@ -268,8 +288,9 @@ if (strlen($ADD)>4) $group_name_value = $rowx[1]; $groups_list .= "\n\n\n


\nscript runtime: $RUNtime seconds"; exit; - - ?> -