diff --git a/www/vicidial/AST_agent_timeclock_detail.php b/www/vicidial/AST_agent_timeclock_detail.php index 818b2a12..c1e82bfd 100644 --- a/www/vicidial/AST_agent_timeclock_detail.php +++ b/www/vicidial/AST_agent_timeclock_detail.php @@ -3,7 +3,7 @@ # # Pulls all timeclock records for an agent # -# Copyright (C) 2019 Matt Florell LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # 90602-2244 - First build @@ -29,6 +29,7 @@ # 170829-0040 - Added screen color settings # 171012-2015 - Fixed javascript/apache errors with graphs # 191013-0833 - Fixes for PHP7 +# 220227-0927 - Added allow_web_debug system setting # $startMS = microtime(); @@ -62,6 +63,15 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];} + +$MT[0]=''; +$NOW_DATE = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$STARTtime = date("U"); +if (!isset($group)) {$group = array();} +if (!isset($user_group)) {$user_group = array();} +if (!isset($query_date)) {$query_date = "$NOW_DATE 00:00:00";} +if (!isset($end_date)) {$end_date = "$NOW_DATE 23:59:59";} if (strlen($shift)<2) {$shift='ALL';} if (strlen($stage)<2) {$stage='ID';} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); @@ -73,9 +83,9 @@ $db_source = 'M'; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,report_default_format,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -87,20 +97,37 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $SSreport_default_format = $row[6]; + $SSallow_web_debug = $row[7]; } +if ($SSallow_web_debug < 1) {$DB=0;} +if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;} ##### END SETTINGS LOOKUP ##### ########################################### -if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;} + +$query_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$query_date); +$end_date = preg_replace('/[^- \:\_0-9a-zA-Z]/',"",$end_date); +$submit = preg_replace('/[^-_0-9a-zA-Z]/',"",$submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/',"",$SUBMIT); +$file_download = preg_replace('/[^-_0-9a-zA-Z]/',"",$file_download); +$stage = preg_replace('/[^-_0-9a-zA-Z]/',"",$stage); +$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/',"",$report_display_type); + +# Variables filter further down in the code +# $user_group if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9a-zA-Z]/', '', $group); + $shift = preg_replace('/[^-_0-9a-zA-Z]/',"",$shift); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $group = preg_replace('/[^-_0-9\p{L}]/u', '', $group); + $shift = preg_replace('/[^-_0-9\p{L}]/u',"",$shift); } $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; @@ -210,7 +237,7 @@ else $webserver_id = mysqli_insert_id($link); } -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$user_group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); @@ -279,14 +306,6 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen( $whereLOGadmin_viewable_call_timesSQL = "where call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')"; } -$MT[0]=''; -$NOW_DATE = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); -$STARTtime = date("U"); -if (!isset($group)) {$group = array();} -if (!isset($user_group)) {$user_group = array();} -if (!isset($query_date)) {$query_date = "$NOW_DATE 00:00:00";} -if (!isset($end_date)) {$end_date = "$NOW_DATE 23:59:59";} $query_dateURL = preg_replace('/\s/', '+', $query_date); $end_dateURL = preg_replace('/\s/', '+', $end_date); @@ -345,6 +364,7 @@ $user_group_string='|'; $user_group_ct = count($user_group); while($i < $user_group_ct) { + $user_group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group[$i]); $user_group_string .= "$user_group[$i]|"; $user_group_SQL .= "'$user_group[$i]',"; $user_groupQS .= "&user_group[]=$user_group[$i]"; diff --git a/www/vicidial/QM_live_monitor.php b/www/vicidial/QM_live_monitor.php index e07381ff..ba58710d 100644 --- a/www/vicidial/QM_live_monitor.php +++ b/www/vicidial/QM_live_monitor.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # Script to initiate live monitoring from QueueMetrics link # @@ -11,10 +11,11 @@ # 130617-2128 - Added filtering of input to prevent SQL injection attacks # 130901-0859 - Changed to mysqli PHP functions # 180529-1005 - Added debug logging +# 220226-2215 - Added allow_web_debug system setting # -$version = '2.14-5'; -$build = '180529-1005'; +$version = '2.14-6'; +$build = '220226-2215'; $DBlogfile=0; # set to 1 for logfile writing @@ -49,15 +50,46 @@ if (isset($_GET["stage"])) {$stage=$_GET["stage"];} elseif (isset($_POST["stage"])) {$stage=$_POST["stage"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); + +$ERR=0; +$ERRstring=''; + +############################################# +##### START QUEUEMETRICS LOGGING LOOKUP ##### +$stmt = "SELECT use_non_latin,enable_queuemetrics_logging,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $enable_queuemetrics_logging = $row[1]; + $SSallow_web_debug = $row[2]; + } +if ($SSallow_web_debug < 1) {$DB=0; $DBlogfile=0;} +##### END QUEUEMETRICS LOGGING LOOKUP ##### +########################################### + $call = preg_replace('/[^0-9a-zA-Z]/', '', $call); -$user = preg_replace('/[^0-9a-zA-Z]/', '', $user); -$extension = preg_replace("/'|\"|\\\\|;/", '', $extension); -$server_ip = preg_replace("/'|\"|\\\\|;/", '', $server_ip); -$stage = preg_replace("/'|\"|\\\\|;/", '', $stage); -$campaign = preg_replace("/'|\"|\\\\|;/", '', $campaign); -$phone = preg_replace("/'|\"|\\\\|;/", '', $phone); -$type = preg_replace("/'|\"|\\\\|;/", '', $type); -$QMuser = preg_replace("/'|\"|\\\\|;/", '', $QMuser); +$session = preg_replace('/[^0-9a-zA-Z]/', '', $session); +$extension = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $extension); +$server_ip = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $server_ip); +$stage = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $stage); +$phone = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $phone); +$type = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $type); +$QMuser = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $QMuser); + +if ($non_latin < 1) + { + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); + $campaign = preg_replace('/[^-_0-9a-zA-Z]/', '', $campaign); + } +else + { + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); + $campaign = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign); + } if ($DBlogfile > 0) { @@ -66,22 +98,6 @@ if ($DBlogfile > 0) fclose($logfile); } -$ERR=0; -$ERRstring=''; - -############################################# -##### START QUEUEMETRICS LOGGING LOOKUP ##### -$stmt = "SELECT enable_queuemetrics_logging FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $enable_queuemetrics_logging = $row[0]; - } -##### END QUEUEMETRICS LOGGING LOOKUP ##### -########################################### if ($enable_queuemetrics_logging > 0) { $stmt = "SELECT user,server_ip,conf_exten,comments FROM vicidial_live_agents where callerid='$call';"; diff --git a/www/vicidial/TCPAlitigatorlist_inbound_filter.php b/www/vicidial/TCPAlitigatorlist_inbound_filter.php index e1949639..994cb8e1 100644 --- a/www/vicidial/TCPAlitigatorlist_inbound_filter.php +++ b/www/vicidial/TCPAlitigatorlist_inbound_filter.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # This script searches tcpalitigatorlist.com's scrub service for incoming DID phone numbers # and returns a blocking match of '1' that will send the call to the Filter route @@ -21,6 +21,7 @@ # # CHANGES # 190618-1417 - First Build +# 220226-1730 - Added allow_web_debug system setting # header ("Content-type: text/html; charset=utf-8"); @@ -41,19 +42,24 @@ $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { $row=mysqli_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; + $SSallow_web_debug = $row[2]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$in_filter_override=preg_replace('/[^-_0-9a-zA-Z]/','',$in_filter_override); +$in_cache_override=preg_replace('/[^-_0-9a-zA-Z]/','',$in_cache_override); + if ($non_latin < 1) { $phone=preg_replace('/[^-_0-9a-zA-Z]/','',$phone); @@ -62,8 +68,7 @@ else { $phone = preg_replace("/'|\"|\\\\|;/","",$phone); } -$in_filter_override=preg_replace('/[^-_0-9a-zA-Z]/','',$in_filter_override); -$in_cache_override=preg_replace('/[^-_0-9a-zA-Z]/','',$in_cache_override); + $filter_count=0; $ENTRYdate = date("mdHis"); diff --git a/www/vicidial/Vicidial_international_DNC_interface.php b/www/vicidial/Vicidial_international_DNC_interface.php index c1024294..c8eb621c 100644 --- a/www/vicidial/Vicidial_international_DNC_interface.php +++ b/www/vicidial/Vicidial_international_DNC_interface.php @@ -1,12 +1,13 @@ , Joe Johnson LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell , Joe Johnson LICENSE: AGPLv2 # # ViciDial web-based DNC file loader from formatted file # # CHANGES: # 200813-1230 - First version +# 220227-0848 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -24,14 +25,18 @@ $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); +if (isset($_GET["DB"])) {$DB=$_GET["DB"];} + elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["file_update_str"])) {$file_update_str=$_GET["file_update_str"];} elseif (isset($_POST["file_update_str"])) {$file_update_str=$_POST["file_update_str"];} +$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); + ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method,active_modules,admin_screen_colors,web_loader_phone_length,enable_international_dncs FROM system_settings;"; +$stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method,active_modules,admin_screen_colors,web_loader_phone_length,enable_international_dncs,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -46,10 +51,14 @@ if ($qm_conf_ct > 0) $SSadmin_screen_colors = $row[7]; $SSweb_loader_phone_length = $row[8]; $SSenable_international_dncs = $row[9]; + $SSallow_web_debug = $row[10]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$file_update_str = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$file_update_str); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); @@ -57,11 +66,9 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } -$list_id_override = preg_replace('/[^0-9]/','',$list_id_override); -$web_loader_phone_length = preg_replace('/[^0-9]/','',$web_loader_phone_length); $STARTtime = date("U"); $TODAY = date("Y-m-d"); @@ -398,6 +405,7 @@ while ($row=mysqli_fetch_array($rslt)) echo ""; echo ""; echo ""; +echo ""; echo ""; ?> diff --git a/www/vicidial/listloaderMAIN.php b/www/vicidial/listloaderMAIN.php index 36bcd267..9e13c152 100644 --- a/www/vicidial/listloaderMAIN.php +++ b/www/vicidial/listloaderMAIN.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell,Joe Johnson LICENSE: AGPLv2 # # this is the main frame page for the lead loading section. This is where you # would upload a file and have it inserted into vicidial_list @@ -13,7 +13,7 @@ # 120223-2151 - Removed logging of good login passwords if webroot writable is enabled # 130610-1111 - Finalized changing of all ereg instances to preg # 130618-0035 - Added filtering of input to prevent SQL injection attacks and new user auth -# 130901-0901 - Changed to mysqli PHP functions +# 220227-0857 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -23,12 +23,16 @@ $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); +if (isset($_GET["DB"])) {$DB=$_GET["DB"];} + elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} + +$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -37,7 +41,9 @@ if ($qm_conf_ct > 0) $webroot_writable = $row[1]; $SSoutbound_autodial_active = $row[2]; $user_territories_active = $row[3]; + $SSallow_web_debug = $row[4]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### @@ -48,8 +54,8 @@ if ($non_latin < 1) } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } $STARTtime = date("U"); @@ -61,7 +67,7 @@ $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); $auth=0; -$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); +$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1,0); if ($auth_message == 'GOOD') {$auth=1;} diff --git a/www/vicidial/record_conf_1_hour.php b/www/vicidial/record_conf_1_hour.php index 9f17c834..444eb903 100644 --- a/www/vicidial/record_conf_1_hour.php +++ b/www/vicidial/record_conf_1_hour.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # grab: $server_ip $station $session_id # @@ -15,6 +15,7 @@ # 130616-2230 - Added filtering of input to prevent SQL injection attacks and new user auth # 130901-0857 - Changed to mysqli PHP functions # 170409-1534 - Added IP List validation code +# 220227-0901 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -36,23 +37,10 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];} elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} +if (isset($_GET["DB"])) {$DB=$_GET["DB"];} + elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} -############################################# -##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active FROM system_settings;"; -$rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} -$qm_conf_ct = mysqli_num_rows($rslt); -if ($qm_conf_ct > 0) - { - $row=mysqli_fetch_row($rslt); - $non_latin = $row[0]; - $webroot_writable = $row[1]; - $SSoutbound_autodial_active = $row[2]; - $user_territories_active = $row[3]; - } -##### END SETTINGS LOOKUP ##### -########################################### +$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); $STARTtime = date("U"); $TODAY = date("Y-m-d"); @@ -63,15 +51,42 @@ $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,allow_web_debug FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); +#if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $webroot_writable = $row[1]; + $SSoutbound_autodial_active = $row[2]; + $user_territories_active = $row[3]; + $SSallow_web_debug = $row[4]; + } +if ($SSallow_web_debug < 1) {$DB=0;} +##### END SETTINGS LOOKUP ##### +########################################### + +$session_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $session_id); +$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/', '', $server_ip); +$NEW_RECORDING = preg_replace('/[^-_0-9a-zA-Z]/', '', $NEW_RECORDING); +$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $station = preg_replace('/[^-_0-9a-zA-Z]/', '', $station); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $station = preg_replace('/[^-_0-9\p{L}]/u', '', $station); } $auth=0; @@ -185,6 +200,7 @@ else { echo "
Start recording a conference for 1 hour:
\n"; echo "\n"; + echo "\n"; echo "server_ip: | \n"; echo "session_id: | \n"; echo "station: | \n"; diff --git a/www/vicidial/recording_log_redirect.php b/www/vicidial/recording_log_redirect.php index 4ed31b5a..57b6d3e7 100644 --- a/www/vicidial/recording_log_redirect.php +++ b/www/vicidial/recording_log_redirect.php @@ -1,12 +1,13 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Joe Johnson, Matt Florell LICENSE: AGPLv2 # # CHANGELOG # 160116-1349 - First Build # 170409-1538 - Added IP List validation code # 210401-1625 - Added no_redirect for logging when playing a Javascript audio object +# 220227-0858 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); @@ -25,13 +26,16 @@ if (isset($_GET["no_redirect"])) {$no_redirect=$_GET["no_redirect"];} elseif (isset($_POST["no_redirect"])) {$no_redirect=$_POST["no_redirect"];} if (isset($_GET["search_archived_data"])) {$search_archived_data=$_GET["search_archived_data"];} elseif (isset($_POST["search_archived_data"])) {$search_archived_data=$_POST["search_archived_data"];} +if (isset($_GET["DB"])) {$DB=$_GET["DB"];} + elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} +$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,custom_fields_enabled,webroot_writable,allow_emails,enable_languages,language_method,active_modules,log_recording_access FROM system_settings;"; +$stmt = "SELECT use_non_latin,custom_fields_enabled,webroot_writable,allow_emails,enable_languages,language_method,active_modules,log_recording_access,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -44,23 +48,26 @@ if ($qm_conf_ct > 0) $SSlanguage_method = $row[5]; $active_modules = $row[6]; $log_recording_access = $row[7]; + $SSallow_web_debug = $row[8]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### $recording_id = preg_replace('/[^0-9]/','',$recording_id); $lead_id = preg_replace('/[^0-9]/','',$lead_id); -$search_archived_data = preg_replace("/'|\"|\\\\|;/","",$search_archived_data); +$no_redirect = preg_replace('/[^-_0-9a-zA-Z]/','',$no_redirect); +$search_archived_data = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$search_archived_data); if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW); - } # end of non_latin + } else { - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } if ($search_archived_data) diff --git a/www/vicidial/timeclock_edit.php b/www/vicidial/timeclock_edit.php index 6241285d..b4db84c5 100644 --- a/www/vicidial/timeclock_edit.php +++ b/www/vicidial/timeclock_edit.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # @@ -19,6 +19,7 @@ # 151203-1902 - Fix for javascript timezone issues in editing of timeclock entries # 160329-1610 - Fix for DST time and editing entries # 170409-1539 - Added IP List validation code +# 220226-1726 - Added allow_web_debug system setting # header ("Content-type: text/html; charset=utf-8"); @@ -63,11 +64,18 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); +$StarTtimE = date("U"); +$TODAY = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$isdst = date("I"); +$ip = getenv("REMOTE_ADDR"); +$invalid_record=0; + ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -78,16 +86,39 @@ if ($qm_conf_ct > 0) $user_territories_active = $row[3]; $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; + $SSallow_web_debug = $row[6]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### -$StarTtimE = date("U"); -$TODAY = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); -$isdst = date("I"); -$ip = getenv("REMOTE_ADDR"); -$invalid_record=0; +$timeclock_id = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$timeclock_id); +$oldLOGINepoch = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$oldLOGINepoch); +$oldLOGOUTepoch = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$oldLOGOUTepoch); +$oldLOGINdate = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$oldLOGINdate); +$oldLOGOUTdate = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$oldLOGOUTdate); +$LOGINepoch = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$LOGINepoch); +$LOGOUTepoch = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$LOGOUTepoch); +$notes = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$notes); +$LOGINevent_id = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$LOGINevent_id); +$LOGOUTevent_id = preg_replace("/\<|\>|\'|\"|\\\\|;/","",$LOGOUTevent_id); +$submit = preg_replace('/[^-_0-9a-zA-Z]/',"",$submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/',"",$SUBMIT); + +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); + $stage = preg_replace('/[^-_0-9a-zA-Z]/',"",$stage); + } +else + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); + $stage = preg_replace('/[^-_0-9\p{L}]/u',"",$stage); + } $local_gmt=0; $stmt = "SELECT local_gmt FROM servers where active='Y';"; @@ -102,29 +133,6 @@ if ($sr_conf_ct > 0) $local_gmt = ($local_gmt + $isdst); $local_gmt_sec = ($local_gmt * -3600); -if ($non_latin < 1) - { - $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); - $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); - } -else - { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); - } -$user = preg_replace("/'|\"|\\\\|;/","",$user); -$timeclock_id = preg_replace("/'|\"|\\\\|;/","",$timeclock_id); -$stage = preg_replace("/'|\"|\\\\|;/","",$stage); -$oldLOGINepoch = preg_replace("/'|\"|\\\\|;/","",$oldLOGINepoch); -$oldLOGOUTepoch = preg_replace("/'|\"|\\\\|;/","",$oldLOGOUTepoch); -$oldLOGINdate = preg_replace("/'|\"|\\\\|;/","",$oldLOGINdate); -$oldLOGOUTdate = preg_replace("/'|\"|\\\\|;/","",$oldLOGOUTdate); -$LOGINepoch = preg_replace("/'|\"|\\\\|;/","",$LOGINepoch); -$LOGOUTepoch = preg_replace("/'|\"|\\\\|;/","",$LOGOUTepoch); -$notes = preg_replace("/'|\"|\\\\|;/","",$notes); -$LOGINevent_id = preg_replace("/'|\"|\\\\|;/","",$LOGINevent_id); -$LOGOUTevent_id = preg_replace("/'|\"|\\\\|;/","",$LOGOUTevent_id); - $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); diff --git a/www/vicidial/timeclock_report.php b/www/vicidial/timeclock_report.php index 3a7ae42e..f959f943 100644 --- a/www/vicidial/timeclock_report.php +++ b/www/vicidial/timeclock_report.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # @@ -32,6 +32,7 @@ # 170409-1555 - Added IP List validation code # 171012-2015 - Fixed javascript/apache errors with graphs # 191013-0827 - Fixes for PHP7 +# 220226-1716 - Added allow_web_debug system setting # $startMS = microtime(); @@ -67,18 +68,27 @@ if (isset($_GET["file_download"])) {$file_download=$_GET["file_download"];} if (isset($_GET["report_display_type"])) {$report_display_type=$_GET["report_display_type"];} elseif (isset($_POST["report_display_type"])) {$report_display_type=$_POST["report_display_type"];} +$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); + +$STARTtime = date("U"); +$TODAY = date("Y-m-d"); +$NOW_DATE = date("Y-m-d"); +$NOW_TIME = date("Y-m-d H:i:s"); +$STARTtime = date("U"); if (strlen($shift)<2) {$shift='ALL';} if (strlen($order)<2) {$order='hours_down';} -$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); +if ( (!isset($query_date)) or (strlen($query_date) < 10) ) {$query_date = $TODAY;} +if ( (!isset($end_date)) or (strlen($end_date) < 10) ) {$end_date = $TODAY;} +if (!isset($user_group)) {$user_group = array();} $report_name = 'User Timeclock Report'; $db_source = 'M'; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,webroot_writable,enable_languages,language_method,admin_screen_colors,report_default_format FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,webroot_writable,enable_languages,language_method,admin_screen_colors,report_default_format,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {$MAIN.="$stmt\n";} +#if ($DB) {$MAIN.="$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -92,34 +102,38 @@ if ($qm_conf_ct > 0) $SSlanguage_method = $row[6]; $SSadmin_screen_colors = $row[7]; $SSreport_default_format = $row[8]; + $SSallow_web_debug = $row[9]; } +if ($SSallow_web_debug < 1) {$DB=0;} +if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;} ##### END SETTINGS LOOKUP ##### ########################################### -if (strlen($report_display_type)<2) {$report_display_type = $SSreport_default_format;} -$STARTtime = date("U"); -$TODAY = date("Y-m-d"); +$query_date = preg_replace('/[^-_0-9a-zA-Z]/',"",$query_date); +$end_date = preg_replace('/[^-_0-9a-zA-Z]/',"",$end_date); +$submit = preg_replace('/[^-_0-9a-zA-Z]/',"",$submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/',"",$SUBMIT); +$file_download = preg_replace('/[^-_0-9a-zA-Z]/',"",$file_download); +$order = preg_replace('/[^-_0-9a-zA-Z]/',"",$order); +$report_display_type = preg_replace('/[^-_0-9a-zA-Z]/',"",$report_display_type); -if ( (!isset($query_date)) or (strlen($query_date) < 10) ) {$query_date = $TODAY;} -if ( (!isset($end_date)) or (strlen($end_date) < 10) ) {$end_date = $TODAY;} +# Variables filter further down in the code +# $user_group if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); + $shift = preg_replace('/[^-_0-9a-zA-Z]/',"",$shift); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); + $shift = preg_replace('/[^-_0-9\p{L}]/u',"",$shift); } -$query_date = preg_replace("/'|\"|\\\\|;/","",$query_date); -$end_date = preg_replace("/'|\"|\\\\|;/","",$end_date); -$shift = preg_replace("/'|\"|\\\\|;/","",$shift); -$order = preg_replace("/'|\"|\\\\|;/","",$order); -$user = preg_replace("/'|\"|\\\\|;/","",$user); -$file_download = preg_replace("/'|\"|\\\\|;/","",$file_download); -$report_display_type = preg_replace("/'|\"|\\\\|;/","",$report_display_type); $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} @@ -228,7 +242,7 @@ else $webserver_id = mysqli_insert_id($link); } -$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$user_group[0], $query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; +$stmt="INSERT INTO vicidial_report_log set event_date=NOW(), user='$PHP_AUTH_USER', ip_address='$LOGip', report_name='$report_name', browser='$LOGbrowser', referer='$LOGhttp_referer', notes='$LOGserver_name:$LOGserver_port $LOGscript_name |$query_date, $end_date, $shift, $file_download, $report_display_type|', url='$LOGfull_url', webserver='$webserver_id';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $report_log_id = mysqli_insert_id($link); @@ -285,13 +299,6 @@ if ( (!preg_match('/\-\-ALL\-\-/i', $LOGadmin_viewable_call_times)) and (strlen( $whereLOGadmin_viewable_call_timesSQL = "where call_time_id IN('---ALL---','$rawLOGadmin_viewable_call_timesSQL')"; } -$NOW_DATE = date("Y-m-d"); -$NOW_TIME = date("Y-m-d H:i:s"); -$STARTtime = date("U"); -if (!isset($user_group)) {$user_group = array();} -if (!isset($query_date)) {$query_date = $NOW_DATE;} -if (!isset($end_date)) {$end_date = $NOW_DATE;} - $stmt="select user_group from vicidial_user_groups $whereLOGadmin_viewable_groupsSQL order by user_group;"; $rslt=mysql_to_mysqli($stmt, $link); if ($DB) {$MAIN.="$stmt\n";} @@ -454,6 +461,7 @@ $user_group_string='|'; $i=0; while($i < $user_group_ct) { + $user_group[$i] = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group[$i]); $user_group_string .= "$user_group[$i]|"; $user_group_SQL .= "'$user_group[$i]',"; $user_groupQS .= "&user_group[]=$user_group[$i]"; diff --git a/www/vicidial/timeclock_status.php b/www/vicidial/timeclock_status.php index d3b7a46d..8be03c2e 100644 --- a/www/vicidial/timeclock_status.php +++ b/www/vicidial/timeclock_status.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # CHANGES # @@ -24,6 +24,7 @@ # 141229-1853 - Added code for on-the-fly language translations display # 161019-2254 - Added screen colors # 170409-1544 - Added IP List validation code +# 220226-1712 - Added allow_web_debug system setting # #header ("Content-type: text/html; charset=utf-8"); @@ -61,9 +62,9 @@ $db_source = 'M'; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,webroot_writable,timeclock_end_of_day,enable_languages,language_method,admin_screen_colors FROM system_settings;"; +$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,webroot_writable,timeclock_end_of_day,enable_languages,language_method,admin_screen_colors,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {$MAIN.="$stmt\n";} +#if ($DB) {$MAIN.="$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -77,24 +78,32 @@ if ($qm_conf_ct > 0) $SSenable_languages = $row[6]; $SSlanguage_method = $row[7]; $SSadmin_screen_colors = $row[8]; + $SSallow_web_debug = $row[9]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$begin_date = preg_replace('/[^-_0-9a-zA-Z]/',"",$begin_date); +$end_date = preg_replace('/[^-_0-9a-zA-Z]/',"",$end_date); +$submit = preg_replace('/[^-_0-9a-zA-Z]/',"",$submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/',"",$SUBMIT); +$file_download = preg_replace('/[^-_0-9a-zA-Z]/',"",$file_download); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9a-zA-Z]/', '', $user); + $user_group = preg_replace('/[^-_0-9a-zA-Z]/', '', $user_group); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $user = preg_replace('/[^-_0-9\p{L}]/u', '', $user); + $user_group = preg_replace('/[^-_0-9\p{L}]/u', '', $user_group); } -$begin_date = preg_replace("/'|\"|\\\\|;/","",$begin_date); -$end_date = preg_replace("/'|\"|\\\\|;/","",$end_date); -$user = preg_replace("/'|\"|\\\\|;/","",$user); -$user_group = preg_replace("/'|\"|\\\\|;/","",$user_group); $STARTtime = date("U"); $TODAY = date("Y-m-d"); diff --git a/www/vicidial/voice_lab.php b/www/vicidial/voice_lab.php index 775dd068..c818cc32 100644 --- a/www/vicidial/voice_lab.php +++ b/www/vicidial/voice_lab.php @@ -4,7 +4,7 @@ # This script is designed to broadcast a recorded message or allow a person to # speak to all agents logged into a VICIDIAL campaign. # -# Copyright (C) 2017 Matt Florell LICENSE: AGPLv2 +# Copyright (C) 2022 Matt Florell LICENSE: AGPLv2 # # # CHANGES @@ -20,6 +20,7 @@ # 141007-2143 - Finalized adding QXZ translation to all admin files # 141229-1817 - Added code for on-the-fly language translations display # 170217-1213 - Fixed non-latin auth issue #995 +# 220226-2221 - Added allow_web_debug system setting # $startMS = microtime(); @@ -52,11 +53,6 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} -$campaign_id = preg_replace('/[^0-9a-zA-Z]/', '', $campaign_id); -$server_ip = preg_replace('/[^\.0-9a-zA-Z]/', '', $server_ip); -$session_id = preg_replace('/[^0-9a-zA-Z]/', '', $session_id); -$message = preg_replace('/[^0-9a-zA-Z]/', '', $message); - $STARTtime = date("U"); $TODAY = date("Y-m-d"); $mysql_datetime = date("Y-m-d H:i:s"); @@ -72,9 +68,9 @@ $ext_context = 'demo'; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### -$stmt = "SELECT use_non_latin,custom_fields_enabled,enable_languages,language_method FROM system_settings;"; +$stmt = "SELECT use_non_latin,custom_fields_enabled,enable_languages,language_method,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); -if ($DB) {echo "$stmt\n";} +#if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { @@ -83,19 +79,32 @@ if ($qm_conf_ct > 0) $custom_fields_enabled = $row[1]; $SSenable_languages = $row[2]; $SSlanguage_method = $row[3]; + $SSallow_web_debug = $row[4]; } +if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### +$server_ip = preg_replace('/[^\.0-9a-zA-Z]/', '', $server_ip); +$session_id = preg_replace('/[^0-9a-zA-Z]/', '', $session_id); +$message = preg_replace('/[^0-9a-zA-Z]/', '', $message); +$NEW_VOICE_LAB = preg_replace('/[^0-9a-zA-Z]/', '', $NEW_VOICE_LAB); +$KILL_VOICE_LAB = preg_replace('/[^0-9a-zA-Z]/', '', $KILL_VOICE_LAB); +$PLAY_MESSAGE = preg_replace('/[^0-9a-zA-Z]/', '', $PLAY_MESSAGE); +$submit = preg_replace('/[^-_0-9a-zA-Z]/',"",$submit); +$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/',"",$SUBMIT); + if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + $campaign_id = preg_replace('/[^0-9a-zA-Z]/', '', $campaign_id); } else { - $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); - $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); + $campaign_id = preg_replace('/[^-_0-9\p{L}]/u', '', $campaign_id); } $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";