From 5be4d855e6b5e0e79e81fe5ee0cf7e17d656c0cb Mon Sep 17 00:00:00 2001 From: mattf Date: Tue, 3 Aug 2010 19:02:42 +0000 Subject: [PATCH] Added User Group setting for allowable reports to restrict report viewing Enabled User Group setting for allowable campaigns to restrict report viewing and admin.php activity Changed level 7 users to only view reports links page Changed "Admin" link to go to an admin links page instead of Phones listing Added manual_dial_filter CAMPLISTS_ALL options git-svn-id: svn://192.168.202.10@1491 3d104415-ff17-0410-8863-d5cf3c621b8a --- UPGRADE | 8 + extras/MySQL_AST_CREATE_tables.sql | 5 +- extras/upgrade_2.4.sql | 4 + .../TO_BE_TRANSLATED_2.4.txt | 4 + www/agc/vdc_db_query.php | 16 +- www/vicidial/AST_CLOSER_service_level.php | 25 +- www/vicidial/AST_CLOSERstats.php | 25 +- www/vicidial/AST_CLOSERsummary_hourly.php | 24 +- www/vicidial/AST_DIDstats.php | 24 +- www/vicidial/AST_IVRstats.php | 24 +- www/vicidial/AST_LIST_UPDATEstats.php | 27 +- www/vicidial/AST_OUTBOUNDsummary_interval.php | 41 +- www/vicidial/AST_VDADstats.php | 54 +- www/vicidial/AST_agent_days_detail.php | 57 +- www/vicidial/AST_agent_performance_detail.php | 58 +- www/vicidial/AST_agent_status_detail.php | 59 +- www/vicidial/AST_agent_time_detail.php | 90 ++- www/vicidial/AST_agent_time_sheet.php | 24 +- www/vicidial/AST_agent_timeclock_detail.php | 24 +- www/vicidial/AST_server_performance.php | 24 +- www/vicidial/AST_timeonVDADall.php | 86 ++- www/vicidial/AST_timeonVDADallSUMMARY.php | 51 +- www/vicidial/admin.php | 513 +++++++++++------- www/vicidial/call_report_export.php | 48 +- www/vicidial/fcstats.php | 24 +- www/vicidial/list_download.php | 49 +- www/vicidial/timeclock_report.php | 24 +- www/vicidial/timeclock_status.php | 45 +- www/vicidial/user_stats.php | 72 +-- 29 files changed, 1134 insertions(+), 395 deletions(-) diff --git a/UPGRADE b/UPGRADE index 81ef0449..962c4e88 100644 --- a/UPGRADE +++ b/UPGRADE @@ -233,6 +233,14 @@ OTHER CHANGES: allow you to hangup or transfer the call at a set number of seconds from start time or triggered from an outside process. +51. Added Allowable Reports option in User Groups for user_level 7 and higher + users to restrict viewable reports. Also enforced the Allowed + Campaigns option in User Group across admin.php and reports + +52. Changed the "Admin" link in admin.php to go to a links page instead of a + listing of Phones, also forced level 7 users to the reports links page + if they try going anywhere in admin.php + diff --git a/extras/MySQL_AST_CREATE_tables.sql b/extras/MySQL_AST_CREATE_tables.sql index 4c6e37e8..aa9139de 100644 --- a/extras/MySQL_AST_CREATE_tables.sql +++ b/extras/MySQL_AST_CREATE_tables.sql @@ -597,7 +597,8 @@ agent_xfer_vm_transfer ENUM('Y','N') default 'Y', agent_xfer_blind_transfer ENUM('Y','N') default 'Y', agent_xfer_dial_with_customer ENUM('Y','N') default 'Y', agent_xfer_park_customer_dial ENUM('Y','N') default 'Y', -agent_fullscreen ENUM('Y','N') default 'N' +agent_fullscreen ENUM('Y','N') default 'N', +allowed_reports VARCHAR(2000) default 'ALL REPORTS' ); CREATE TABLE vicidial_campaigns ( @@ -2295,7 +2296,7 @@ ALTER TABLE vicidial_agent_log_archive MODIFY agent_log_id INT(9) UNSIGNED NOT N CREATE TABLE vicidial_carrier_log_archive LIKE vicidial_carrier_log; -UPDATE system_settings SET db_schema_version='1237',db_schema_update_date=NOW(); +UPDATE system_settings SET db_schema_version='1238',db_schema_update_date=NOW(); GRANT RELOAD ON *.* TO cron@'%'; GRANT RELOAD ON *.* TO cron@localhost; diff --git a/extras/upgrade_2.4.sql b/extras/upgrade_2.4.sql index ff938da9..242dd9c2 100644 --- a/extras/upgrade_2.4.sql +++ b/extras/upgrade_2.4.sql @@ -447,3 +447,7 @@ ALTER TABLE vicidial_inbound_groups ADD timer_action_destination VARCHAR(30) def ALTER TABLE vicidial_live_agents ADD external_timer_action_destination VARCHAR(100) default ''; UPDATE system_settings SET db_schema_version='1237',db_schema_update_date=NOW(); + +ALTER TABLE vicidial_user_groups ADD allowed_reports VARCHAR(2000) default 'ALL REPORTS'; + +UPDATE system_settings SET db_schema_version='1238',db_schema_update_date=NOW(); diff --git a/translations/raw_translation_files/TO_BE_TRANSLATED_2.4.txt b/translations/raw_translation_files/TO_BE_TRANSLATED_2.4.txt index 9e3b6539..1eac213e 100644 --- a/translations/raw_translation_files/TO_BE_TRANSLATED_2.4.txt +++ b/translations/raw_translation_files/TO_BE_TRANSLATED_2.4.txt @@ -292,6 +292,10 @@ Timer Action Destination|| This field is where you specify the Call Menu, Extension or In-Group that you want the cacll sent to if the Time Action is set to CALLMENU, EXTENSION or IN_GROUP. Default is empty|| You must enter field options when adding a|| You must enter field options when updating a|| +Allowed Reports|| +If a user in this group is set to user level 7 or higher, then this feature can be used to restrict the reports that the users can view. Default is ALL. If you want to select more than one report then press the Ctrl key on your keyboard as you select the reports|| +You are not allowed to view this report|| +CAMPLISTS_ALL - will include inactive lists in the search for the number|| AST_VICIDIAL_ingrouplist.php diff --git a/www/agc/vdc_db_query.php b/www/agc/vdc_db_query.php index f149cf7c..c3620a6e 100644 --- a/www/agc/vdc_db_query.php +++ b/www/agc/vdc_db_query.php @@ -250,10 +250,11 @@ # 100624-1401 - Fix for dispo call url bug related to dialed number and label # 100625-0915 - Fix for auto-dial bug for presets and timer actions # 100712-1447 - Added entry_list_id field to vicidial_list to preserve link to custom fields if any +# 100803-0822 - Added CAMPLISTS_ALL for manual_dial_filter(issue #369 # -$version = '2.4-157'; -$build = '100712-1447'; +$version = '2.4-158'; +$build = '100803-0822'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=333; $one_mysql_log=0; @@ -1163,7 +1164,16 @@ if ($ACTION == 'manDiaLnextCaLL') { $rowx=mysql_fetch_row($rslt); if (ereg("Y", $rowx[1])) {$active_lists++; $camp_lists .= "'$rowx[0]',";} - if (ereg("N", $rowx[1])) {$inactive_lists++;} + if (ereg("ALL",$manual_dial_filter)) + { + if (ereg("N", $rowx[1])) + {$inactive_lists++; $camp_lists .= "'$rowx[0]',";} + } + else + { + if (ereg("N", $rowx[1])) + {$inactive_lists++;} + } $o++; } $camp_lists = eregi_replace(".$","",$camp_lists); diff --git a/www/vicidial/AST_CLOSER_service_level.php b/www/vicidial/AST_CLOSER_service_level.php index e327ebeb..3f19ee79 100644 --- a/www/vicidial/AST_CLOSER_service_level.php +++ b/www/vicidial/AST_CLOSER_service_level.php @@ -15,6 +15,7 @@ # 100214-1421 - Sort menu alphabetically # 100216-0042 - Added popup date selector # 100712-1324 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation # require("dbconnect.php"); @@ -69,14 +70,13 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ echo "\n"; } -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1';"; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $auth=$row[0]; - if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) { Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); @@ -85,6 +85,27 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $STARTtime = date("U"); diff --git a/www/vicidial/AST_CLOSERstats.php b/www/vicidial/AST_CLOSERstats.php index 7fbf34d3..0e68d9e0 100644 --- a/www/vicidial/AST_CLOSERstats.php +++ b/www/vicidial/AST_CLOSERstats.php @@ -28,6 +28,7 @@ # 100214-1421 - Sort menu alphabetically # 100216-0042 - Added popup date selector # 100709-1809 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation # require("dbconnect.php"); @@ -99,14 +100,13 @@ if ($gmt_conf_ct > 0) $epoch_offset = (($local_gmt + $dst) * 3600); } -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1';"; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $auth=$row[0]; - if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) { Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); @@ -115,6 +115,27 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $STARTtime = date("U"); diff --git a/www/vicidial/AST_CLOSERsummary_hourly.php b/www/vicidial/AST_CLOSERsummary_hourly.php index cc8a00a0..1d2931ee 100644 --- a/www/vicidial/AST_CLOSERsummary_hourly.php +++ b/www/vicidial/AST_CLOSERsummary_hourly.php @@ -10,6 +10,7 @@ # 100214-1421 - Sort menu alphabetically # 100216-0042 - Added popup date selector # 100712-1324 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation # require("dbconnect.php"); @@ -94,7 +95,7 @@ if ($gmt_conf_ct > 0) $epoch_offset = (($local_gmt + $dst) * 3600); } -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1';"; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); @@ -109,6 +110,27 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $STARTtime = date("U"); diff --git a/www/vicidial/AST_DIDstats.php b/www/vicidial/AST_DIDstats.php index 0a2b1a05..e487bd0e 100644 --- a/www/vicidial/AST_DIDstats.php +++ b/www/vicidial/AST_DIDstats.php @@ -10,6 +10,7 @@ # 100214-1421 - Sort menu alphabetically # 100216-0042 - Added popup date selector # 100712-1324 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation # require("dbconnect.php"); @@ -67,7 +68,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ echo "\n"; } -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1';"; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); @@ -83,6 +84,27 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $STARTtime = date("U"); diff --git a/www/vicidial/AST_IVRstats.php b/www/vicidial/AST_IVRstats.php index 5e8cb448..bc63341a 100644 --- a/www/vicidial/AST_IVRstats.php +++ b/www/vicidial/AST_IVRstats.php @@ -14,6 +14,7 @@ # 100214-1421 - Sort menu alphabetically # 100301-1401 - Added popup date selector # 100712-1324 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation # require("dbconnect.php"); @@ -70,7 +71,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ echo "\n"; } -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1';"; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); @@ -86,6 +87,27 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $STARTtime = date("U"); diff --git a/www/vicidial/AST_LIST_UPDATEstats.php b/www/vicidial/AST_LIST_UPDATEstats.php index 3427050b..2e2a3824 100644 --- a/www/vicidial/AST_LIST_UPDATEstats.php +++ b/www/vicidial/AST_LIST_UPDATEstats.php @@ -8,6 +8,7 @@ # 90627-2055 - First build # 90907-0636 - Added list id to results # 100712-1324 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation # require("dbconnect.php"); @@ -61,15 +62,14 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ echo "\n"; } -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1';"; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $auth=$row[0]; - - if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if ( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) { Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); Header("HTTP/1.0 401 Unauthorized"); @@ -77,6 +77,27 @@ $auth=$row[0]; exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $STARTtime = date("U"); diff --git a/www/vicidial/AST_OUTBOUNDsummary_interval.php b/www/vicidial/AST_OUTBOUNDsummary_interval.php index d133c667..247eefc9 100644 --- a/www/vicidial/AST_OUTBOUNDsummary_interval.php +++ b/www/vicidial/AST_OUTBOUNDsummary_interval.php @@ -10,6 +10,7 @@ # 100214-1421 - Sort menu alphabetically # 100216-0042 - Added popup date selector # 100712-1324 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation # require("dbconnect.php"); @@ -117,28 +118,31 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) $LOGallowed_campaignsSQL=''; $whereLOGallowed_campaignsSQL=''; -if ($user_level < 9) +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$user_group';"; +$rslt=mysql_query($stmt, $link); +$records_to_print = mysql_num_rows($rslt); +if ($records_to_print > 0) { - $stmt="SELECT allowed_campaigns from vicidial_user_groups where user_group='$user_group';"; - $rslt=mysql_query($stmt, $link); - $records_to_print = mysql_num_rows($rslt); - if ($records_to_print > 0) + $row=mysql_fetch_row($rslt); + $LOGallowed_reports = $row[1]; + if ( (!eregi("ALL-CAMPAIGNS",$row[0])) ) { - $row=mysql_fetch_row($rslt); - if ( (!eregi("ALL-CAMPAIGNS",$row[0])) ) - { - $rawLOGallowed_campaignsSQL = eregi_replace(' -','',$row[0]); - $rawLOGallowed_campaignsSQL = eregi_replace(' ',"','",$rawLOGallowed_campaignsSQL); - $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; - $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; - } + $rawLOGallowed_campaignsSQL = eregi_replace(' -','',$row[0]); + $rawLOGallowed_campaignsSQL = eregi_replace(' ',"','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; } - else + if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { - echo "Campaigns Permissions Error: |$PHP_AUTH_USER|$user_group|\n"; + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; } } +else + { + echo "Campaigns Permissions Error: |$PHP_AUTH_USER|$user_group|\n"; + exit; + } $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); @@ -179,10 +183,6 @@ $group_string='|'; $group_ct = count($group); while($i < $group_ct) { - $group_string .= "$group[$i]|"; - $group_SQL .= "'$group[$i]',"; - $groupQS .= "&group[]=$group[$i]"; - $stmt="select campaign_name from vicidial_campaigns where campaign_id='$group[$i]' $LOGallowed_campaignsSQL;"; $rslt=mysql_query($stmt, $link); $campaign_names_to_print = mysql_num_rows($rslt); @@ -190,6 +190,9 @@ while($i < $group_ct) { $row=mysql_fetch_row($rslt); $group_cname[$i] = $row[0]; + $group_string .= "$group[$i]|"; + $group_SQL .= "'$group[$i]',"; + $groupQS .= "&group[]=$group[$i]"; } if (eregi("YES",$include_rollover)) diff --git a/www/vicidial/AST_VDADstats.php b/www/vicidial/AST_VDADstats.php index 6997dc1a..10ef469b 100644 --- a/www/vicidial/AST_VDADstats.php +++ b/www/vicidial/AST_VDADstats.php @@ -27,6 +27,7 @@ # 100214-1421 - Sort menu alphabetically # 100216-0042 - Added popup date selector # 100712-1324 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation and allowed campaigns restrictions # header ("Content-type: text/html; charset=utf-8"); @@ -114,7 +115,7 @@ if ($srv_conf_ct > 0) $carrier_logging_active = $row[0]; } -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1';"; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level >= 7 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); @@ -129,6 +130,27 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $STARTtime = date("U"); @@ -145,7 +167,18 @@ while($i < $group_ct) $i++; } -$stmt="select campaign_id,campaign_name from vicidial_campaigns order by campaign_id;"; +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!eregi("-ALL",$LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +$stmt="select campaign_id,campaign_name from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id;"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $campaigns_to_print = mysql_num_rows($rslt); @@ -155,7 +188,7 @@ while ($i < $campaigns_to_print) $row=mysql_fetch_row($rslt); $groups[$i] = $row[0]; $group_names[$i] = $row[1]; - if (ereg("--ALL",$group_string) ) + if (ereg("-ALL",$group_string) ) {$group[$i] = $groups[$i];} $i++; } @@ -166,13 +199,16 @@ $group_string='|'; $group_ct = count($group); while($i < $group_ct) { - $group_string .= "$group[$i]|"; - $group_SQL .= "'$group[$i]',"; - $groupQS .= "&group[]=$group[$i]"; + if ( (preg_match("/ $group[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) ) + { + $group_string .= "$group[$i]|"; + $group_SQL .= "'$group[$i]',"; + $groupQS .= "&group[]=$group[$i]"; + } if (eregi("YES",$include_rollover)) { - $stmt="select drop_inbound_group from vicidial_campaigns where campaign_id='$group[$i]' and drop_inbound_group NOT LIKE \"%NONE%\" and drop_inbound_group is NOT NULL and drop_inbound_group != '';"; + $stmt="select drop_inbound_group from vicidial_campaigns where campaign_id='$group[$i]' $LOGallowed_campaignsSQL and drop_inbound_group NOT LIKE \"%NONE%\" and drop_inbound_group is NOT NULL and drop_inbound_group != '';"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $in_groups_to_print = mysql_num_rows($rslt); @@ -189,9 +225,9 @@ while($i < $group_ct) } if (strlen($group_drop_SQL) < 2) {$group_drop_SQL = "''";} -if ( (ereg("--ALL--",$group_string) ) or ($group_ct < 1) ) +if ( (ereg("--ALL--",$group_string) ) or ($group_ct < 1) or (strlen($group_string) < 2) ) { - $group_SQL = ""; + $group_SQL = "$LOGallowed_campaignsSQL"; $group_drop_SQL = ""; } else diff --git a/www/vicidial/AST_agent_days_detail.php b/www/vicidial/AST_agent_days_detail.php index 5c33589f..0ad7c3b2 100644 --- a/www/vicidial/AST_agent_days_detail.php +++ b/www/vicidial/AST_agent_days_detail.php @@ -12,6 +12,7 @@ # 100214-1421 - Sort menu alphabetically # 100216-0042 - Added popup date selector # 100712-1324 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation and allowed campaigns restrictions # @@ -75,7 +76,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER); $PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW); -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';"; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); @@ -90,6 +91,38 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!eregi("-ALL",$LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + $MT[0]=''; $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); @@ -98,7 +131,16 @@ if (!isset($group)) {$group = '';} if (!isset($query_date)) {$query_date = $NOW_DATE;} if (!isset($end_date)) {$end_date = $NOW_DATE;} -$stmt="select campaign_id from vicidial_campaigns;"; +$i=0; +$group_string='|'; +$group_ct = count($group); +while($i < $group_ct) + { + $group_string .= "$group[$i]|"; + $i++; + } + +$stmt="select campaign_id from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id;"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $campaigns_to_print = mysql_num_rows($rslt); @@ -107,6 +149,8 @@ while ($i < $campaigns_to_print) { $row=mysql_fetch_row($rslt); $groups[$i] =$row[0]; + if (ereg("-ALL",$group_string) ) + {$group[$i] = $groups[$i];} $i++; } @@ -115,9 +159,12 @@ $group_string='|'; $group_ct = count($group); while($i < $group_ct) { - $group_string .= "$group[$i]|"; - $group_SQL .= "'$group[$i]',"; - $groupQS .= "&group[]=$group[$i]"; + if ( (preg_match("/ $group[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) ) + { + $group_string .= "$group[$i]|"; + $group_SQL .= "'$group[$i]',"; + $groupQS .= "&group[]=$group[$i]"; + } $i++; } if ( (ereg("--ALL--",$group_string) ) or ($group_ct < 1) ) diff --git a/www/vicidial/AST_agent_performance_detail.php b/www/vicidial/AST_agent_performance_detail.php index 0e797b98..9774b553 100644 --- a/www/vicidial/AST_agent_performance_detail.php +++ b/www/vicidial/AST_agent_performance_detail.php @@ -24,6 +24,7 @@ # 100214-1421 - Sort menu alphabetically # 100216-0042 - Added popup date selector # 100712-1324 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation and allowed campaigns restrictions # require("dbconnect.php"); @@ -88,7 +89,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER); $PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW); -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';"; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); @@ -103,6 +104,38 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!eregi("-ALL",$LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + $MT[0]=''; $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); @@ -111,7 +144,17 @@ if (!isset($group)) {$group = '';} if (!isset($query_date)) {$query_date = $NOW_DATE;} if (!isset($end_date)) {$end_date = $NOW_DATE;} -$stmt="select campaign_id from vicidial_campaigns order by campaign_id;"; + +$i=0; +$group_string='|'; +$group_ct = count($group); +while($i < $group_ct) + { + $group_string .= "$group[$i]|"; + $i++; + } + +$stmt="select campaign_id from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id;"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $campaigns_to_print = mysql_num_rows($rslt); @@ -120,6 +163,8 @@ while ($i < $campaigns_to_print) { $row=mysql_fetch_row($rslt); $groups[$i] =$row[0]; + if (ereg("-ALL",$group_string) ) + {$group[$i] = $groups[$i];} $i++; } $stmt="select user_group from vicidial_user_groups order by user_group;"; @@ -139,9 +184,12 @@ $group_string='|'; $group_ct = count($group); while($i < $group_ct) { - $group_string .= "$group[$i]|"; - $group_SQL .= "'$group[$i]',"; - $groupQS .= "&group[]=$group[$i]"; + if ( (preg_match("/ $group[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) ) + { + $group_string .= "$group[$i]|"; + $group_SQL .= "'$group[$i]',"; + $groupQS .= "&group[]=$group[$i]"; + } $i++; } if ( (ereg("--ALL--",$group_string) ) or ($group_ct < 1) ) diff --git a/www/vicidial/AST_agent_status_detail.php b/www/vicidial/AST_agent_status_detail.php index 3ca13b34..8acee792 100644 --- a/www/vicidial/AST_agent_status_detail.php +++ b/www/vicidial/AST_agent_status_detail.php @@ -13,6 +13,7 @@ # 100214-1421 - Sort menu alphabetically # 100216-0042 - Added popup date selector # 100712-1324 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation and allowed campaigns restrictions # @@ -76,7 +77,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER); $PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW); -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';"; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); @@ -91,6 +92,39 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!eregi("-ALL",$LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + + $MT[0]=''; $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); @@ -99,7 +133,17 @@ if (!isset($group)) {$group = '';} if (!isset($query_date)) {$query_date = $NOW_DATE;} if (!isset($end_date)) {$end_date = $NOW_DATE;} -$stmt="select campaign_id from vicidial_campaigns order by campaign_id;"; + +$i=0; +$group_string='|'; +$group_ct = count($group); +while($i < $group_ct) + { + $group_string .= "$group[$i]|"; + $i++; + } + +$stmt="select campaign_id from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id;"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $campaigns_to_print = mysql_num_rows($rslt); @@ -108,6 +152,8 @@ while ($i < $campaigns_to_print) { $row=mysql_fetch_row($rslt); $groups[$i] =$row[0]; + if (ereg("-ALL",$group_string) ) + {$group[$i] = $groups[$i];} $i++; } $stmt="select user_group from vicidial_user_groups order by user_group;"; @@ -127,9 +173,12 @@ $group_string='|'; $group_ct = count($group); while($i < $group_ct) { - $group_string .= "$group[$i]|"; - $group_SQL .= "'$group[$i]',"; - $groupQS .= "&group[]=$group[$i]"; + if ( (preg_match("/ $group[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) ) + { + $group_string .= "$group[$i]|"; + $group_SQL .= "'$group[$i]',"; + $groupQS .= "&group[]=$group[$i]"; + } $i++; } if ( (ereg("--ALL--",$group_string) ) or ($group_ct < 1) ) diff --git a/www/vicidial/AST_agent_time_detail.php b/www/vicidial/AST_agent_time_detail.php index f7cee69a..abde2707 100644 --- a/www/vicidial/AST_agent_time_detail.php +++ b/www/vicidial/AST_agent_time_detail.php @@ -13,6 +13,7 @@ # 100214-1421 - Sort menu alphabetically # 100216-0042 - Added popup date selector # 100712-1324 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation # require("dbconnect.php"); @@ -77,7 +78,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER); $PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW); -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';"; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); @@ -92,6 +93,38 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!eregi("-ALL",$LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + $MT[0]=''; $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); @@ -100,7 +133,18 @@ if (!isset($group)) {$group = '';} if (!isset($query_date)) {$query_date = $NOW_DATE;} if (!isset($end_date)) {$end_date = $NOW_DATE;} -$stmt="select campaign_id from vicidial_campaigns order by campaign_id;"; + + +$i=0; +$group_string='|'; +$group_ct = count($group); +while($i < $group_ct) + { + $group_string .= "$group[$i]|"; + $i++; + } + +$stmt="select campaign_id from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id;"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $campaigns_to_print = mysql_num_rows($rslt); @@ -109,8 +153,32 @@ while ($i < $campaigns_to_print) { $row=mysql_fetch_row($rslt); $groups[$i] =$row[0]; + if (ereg("-ALL",$group_string) ) + {$group[$i] = $groups[$i];} $i++; } + +$i=0; +$group_string='|'; +$group_ct = count($group); +while($i < $group_ct) + { + if ( (preg_match("/ $group[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) ) + { + $group_string .= "$group[$i]|"; + $group_SQL .= "'$group[$i]',"; + $groupQS .= "&group[]=$group[$i]"; + } + $i++; + } +if ( (ereg("--ALL--",$group_string) ) or ($group_ct < 1) ) + {$group_SQL = "";} +else + { + $group_SQL = eregi_replace(",$",'',$group_SQL); + $group_SQL = "and campaign_id IN($group_SQL)"; + } + $stmt="select user_group from vicidial_user_groups order by user_group;"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} @@ -123,24 +191,6 @@ while ($i < $user_groups_to_print) $i++; } -$i=0; -$group_string='|'; -$group_ct = count($group); -while($i < $group_ct) - { - $group_string .= "$group[$i]|"; - $group_SQL .= "'$group[$i]',"; - $groupQS .= "&group[]=$group[$i]"; - $i++; - } -if ( (ereg("--ALL--",$group_string) ) or ($group_ct < 1) ) - {$group_SQL = "";} -else - { - $group_SQL = eregi_replace(",$",'',$group_SQL); - $group_SQL = "and campaign_id IN($group_SQL)"; - } - $i=0; $user_group_string='|'; $user_group_ct = count($user_group); diff --git a/www/vicidial/AST_agent_time_sheet.php b/www/vicidial/AST_agent_time_sheet.php index d2e012ae..064b1e78 100644 --- a/www/vicidial/AST_agent_time_sheet.php +++ b/www/vicidial/AST_agent_time_sheet.php @@ -12,6 +12,7 @@ # 90508-0644 - Changed to PHP long tags # 90524-2231 - Changed to use functions.php for seconds to HH:MM:SS conversion # 100712-1324 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation # require("dbconnect.php"); @@ -66,7 +67,7 @@ $user=$agent; $PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER); $PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW); -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';"; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); @@ -81,6 +82,27 @@ $auth=$row[0]; exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $STARTtime = date("U"); diff --git a/www/vicidial/AST_agent_timeclock_detail.php b/www/vicidial/AST_agent_timeclock_detail.php index a7604f79..f05282e5 100644 --- a/www/vicidial/AST_agent_timeclock_detail.php +++ b/www/vicidial/AST_agent_timeclock_detail.php @@ -9,6 +9,7 @@ # 90602-2244 - First build # 100301-1401 - Added popup date selector # 100712-1324 - Added system setting slave server option and added user stats link dates +# 100802-2347 - Added User Group Allowed Reports option validation # @@ -74,7 +75,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER); $PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW); -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';"; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); @@ -89,6 +90,27 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + $MT[0]=''; $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); diff --git a/www/vicidial/AST_server_performance.php b/www/vicidial/AST_server_performance.php index 2a66591a..21c1acb7 100644 --- a/www/vicidial/AST_server_performance.php +++ b/www/vicidial/AST_server_performance.php @@ -14,6 +14,7 @@ # 90508-0644 - Changed to PHP long tags # 100214-1421 - Sort menu alphabetically # 100712-1324 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation # require("dbconnect.php"); @@ -66,7 +67,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ echo "\n"; } -$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and modify_servers='1';"; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); @@ -80,6 +81,27 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + # path from root to where ploticus files will be stored $PLOTroot = "vicidial/ploticus"; $DOCroot = "$WeBServeRRooT/$PLOTroot/"; diff --git a/www/vicidial/AST_timeonVDADall.php b/www/vicidial/AST_timeonVDADall.php index 5d5b1ca7..9e4f8fda 100644 --- a/www/vicidial/AST_timeonVDADall.php +++ b/www/vicidial/AST_timeonVDADall.php @@ -63,10 +63,11 @@ # 100303-0930 - Added carrier stats display option # 100424-0943 - Added realtime_block_user_info option # 100709-1054 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation and allowed campaigns restrictions # -$version = '2.4-54'; -$build = '100709-1054'; +$version = '2.4-55'; +$build = '100802-2347'; header ("Content-type: text/html; charset=utf-8"); @@ -160,7 +161,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ if (!isset($DB)) {$DB=0;} if (!isset($RR)) {$RR=40;} -if (!isset($group)) {$group='';} +if (!isset($group)) {$group='ALL-ACTIVE';} if (!isset($usergroup)) {$usergroup='';} if (!isset($UGdisplay)) {$UGdisplay=0;} # 0=no, 1=yes if (!isset($UidORname)) {$UidORname=1;} # 0=id, 1=name @@ -258,7 +259,7 @@ $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $auth=$row[0]; - if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) { Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); Header("HTTP/1.0 401 Unauthorized"); @@ -275,14 +276,40 @@ if ( (!isset($monitor_phone)) or (strlen($monitor_phone)<1) ) $monitor_phone = $row[0]; } -$stmt="SELECT realtime_block_user_info from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +$stmt="SELECT realtime_block_user_info,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} -if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); -$realtime_block_user_info=$row[0]; +$realtime_block_user_info = $row[0]; +$LOGuser_group = $row[1]; -$stmt="select campaign_id,campaign_name from vicidial_campaigns where active='Y' order by campaign_id;"; +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!preg_match("/-ALL/",$LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } +$regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + +$stmt="select campaign_id,campaign_name from vicidial_campaigns where active='Y' $LOGallowed_campaignsSQL order by campaign_id;"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $groups_to_print = mysql_num_rows($rslt); @@ -303,18 +330,22 @@ $group_string='|'; $group_ct = count($groups); while($i < $group_ct) { - $group_string .= "$groups[$i]|"; - $group_SQL .= "'$groups[$i]',"; - $groupQS .= "&groups[]=$groups[$i]"; + if ( (preg_match("/ $groups[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) ) + { + $group_string .= "$groups[$i]|"; + $group_SQL .= "'$groups[$i]',"; + $groupQS .= "&groups[]=$groups[$i]"; + } + $i++; } $group_SQL = eregi_replace(",$",'',$group_SQL); ### if no campaigns selected, display all -if ($group_ct < 1) +if ( ($group_ct < 1) or (strlen($group_string) < 2) ) { $groups[0] = 'ALL-ACTIVE'; - $group_string = 'ALL-ACTIVE'; + $group_string = '|ALL-ACTIVE|'; $group = 'ALL-ACTIVE'; $groupQS .= "&groups[]=ALL-ACTIVE"; } @@ -329,9 +360,9 @@ if ( (ereg("--NONE--",$group_string) ) or ($group_ct < 1) ) elseif ( eregi('ALL-ACTIVE',$group_string) ) { $all_active = 1; - $group_SQL = "''"; - $group_SQLand = ""; - $group_SQLwhere = ""; + $group_SQL = "'$rawLOGallowed_campaignsSQL'"; + $group_SQLand = "$LOGallowed_campaignsSQL"; + $group_SQLwhere = "$whereLOGallowed_campaignsSQL"; } else { @@ -853,10 +884,9 @@ if ( ( ereg('Y',$with_inbound) or ereg('O',$with_inbound) ) and ($campaign_allow } $closer_campaignsSQL = preg_replace("/,$/","",$closer_campaignsSQL); } -else - { - $closer_campaignsSQL = "''"; - } +if (strlen($closer_campaignsSQL)<2) + {$closer_campaignsSQL="''";} + if ($DB > 0) {echo "\n|$closer_campaigns|$closer_campaignsSQL|$stmt|\n";} @@ -1188,7 +1218,7 @@ if (ereg('O',$with_inbound)) if (eregi('ALL-ACTIVE',$group_string)) { - $inboundSQL = "where campaign_id IN ($ALLcloser_campaignsSQL)"; + $inboundSQL = "where campaign_id IN ($closer_campaignsSQL)"; $stmtB="select sum(calls_today),sum(drops_today),sum(answers_today),max(status_category_1),sum(status_category_count_1),max(status_category_2),sum(status_category_count_2),max(status_category_3),sum(status_category_count_3),max(status_category_4),sum(status_category_count_4),sum(hold_sec_stat_one),sum(hold_sec_stat_two),sum(hold_sec_answer_calls),sum(hold_sec_drop_calls),sum(hold_sec_queue_calls) from vicidial_campaign_stats $inboundSQL;"; } @@ -1312,11 +1342,13 @@ else { $non_inboundSQL=''; if (ereg('N',$with_inbound)) - {$non_inboundSQL = "where campaign_id NOT IN ($ALLcloser_campaignsSQL)";} + {$non_inboundSQL = "and campaign_id NOT IN($ALLcloser_campaignsSQL)";} + else + {$non_inboundSQL = "and campaign_id IN($group_SQL,$closer_campaignsSQL)";} $multi_drop++; - $stmt="select avg(auto_dial_level),min(dial_status_a),min(dial_status_b),min(dial_status_c),min(dial_status_d),min(dial_status_e),min(lead_order),min(lead_filter_id),sum(hopper_level),min(dial_method),avg(adaptive_maximum_level),avg(adaptive_dropped_percentage),avg(adaptive_dl_diff_target),avg(adaptive_intensity),min(available_only_ratio_tally),min(adaptive_latest_server_time),min(local_call_time),avg(dial_timeout),min(dial_statuses),max(agent_pause_codes_active),max(list_order_mix) from vicidial_campaigns where active='Y';"; + $stmt="select avg(auto_dial_level),min(dial_status_a),min(dial_status_b),min(dial_status_c),min(dial_status_d),min(dial_status_e),min(lead_order),min(lead_filter_id),sum(hopper_level),min(dial_method),avg(adaptive_maximum_level),avg(adaptive_dropped_percentage),avg(adaptive_dl_diff_target),avg(adaptive_intensity),min(available_only_ratio_tally),min(adaptive_latest_server_time),min(local_call_time),avg(dial_timeout),min(dial_statuses),max(agent_pause_codes_active),max(list_order_mix) from vicidial_campaigns where active='Y' $group_SQLand;"; - $stmtB="select sum(dialable_leads),sum(calls_today),sum(drops_today),avg(drops_answers_today_pct),avg(differential_onemin),avg(agents_average_onemin),sum(balance_trunk_fill),sum(answers_today),max(status_category_1),sum(status_category_count_1),max(status_category_2),sum(status_category_count_2),max(status_category_3),sum(status_category_count_3),max(status_category_4),sum(status_category_count_4) from vicidial_campaign_stats $non_inboundSQL;"; + $stmtB="select sum(dialable_leads),sum(calls_today),sum(drops_today),avg(drops_answers_today_pct),avg(differential_onemin),avg(agents_average_onemin),sum(balance_trunk_fill),sum(answers_today),max(status_category_1),sum(status_category_count_1),max(status_category_2),sum(status_category_count_2),max(status_category_3),sum(status_category_count_3),max(status_category_4),sum(status_category_count_4) from vicidial_campaign_stats where calls_today > -1 $non_inboundSQL;"; } else { @@ -1419,7 +1451,7 @@ else } else { - $stmt="select vcl_id from vicidial_campaigns_list_mix where status='ACTIVE' $groupSQLand limit 1;"; + $stmt="select vcl_id from vicidial_campaigns_list_mix where status='ACTIVE' $group_SQLand limit 1;"; $rslt=mysql_query($stmt, $link); $Lmix_to_print = mysql_num_rows($rslt); if ($Lmix_to_print > 0) @@ -1605,7 +1637,7 @@ if ($campaign_allow_inbound > 0) { if (eregi('ALL-ACTIVE',$group_string)) { - $stmt="select closer_campaigns from vicidial_campaigns $group_SQLwhere"; + $stmt="select closer_campaigns from vicidial_campaigns where active='Y' $group_SQLand"; $rslt=mysql_query($stmt, $link); $closer_campaigns=""; while ($row=mysql_fetch_row($rslt)) @@ -1932,7 +1964,7 @@ else if ($orderby=='userdown') {$orderSQL='vicidial_live_agents.user desc';} } -if (eregi('ALL-ACTIVE',$group_string)) {$UgroupSQL = '';} +if ( (eregi('ALL-ACTIVE',$group_string)) and (strlen($group_SQL) < 3) ) {$UgroupSQL = '';} else {$UgroupSQL = " and vicidial_live_agents.campaign_id IN($group_SQL)";} if (strlen($usergroup)<1) {$usergroupSQL = '';} else {$usergroupSQL = " and user_group='" . mysql_real_escape_string($usergroup) . "'";} diff --git a/www/vicidial/AST_timeonVDADallSUMMARY.php b/www/vicidial/AST_timeonVDADallSUMMARY.php index 7e578aa7..effa41dd 100644 --- a/www/vicidial/AST_timeonVDADallSUMMARY.php +++ b/www/vicidial/AST_timeonVDADallSUMMARY.php @@ -17,9 +17,9 @@ # 90310-2119 - Added admin header # 90508-0644 - Changed to PHP long tags # 100709-1806 - Added system setting slave server option +# 100802-2347 - Added User Group Allowed Reports option validation and allowed campaigns restrictions # - header ("Content-type: text/html; charset=utf-8"); require("dbconnect.php"); @@ -73,13 +73,13 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_ $PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER); $PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW); - $stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';"; - if ($DB) {echo "|$stmt|\n";} - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $auth=$row[0]; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$auth=$row[0]; - if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) +if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) { Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); Header("HTTP/1.0 401 Unauthorized"); @@ -87,10 +87,41 @@ $PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW); exit; } +$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGuser_group = $row[0]; + +$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$LOGallowed_campaigns = $row[0]; +$LOGallowed_reports = $row[1]; + +if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + { + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; + exit; + } + $NOW_TIME = date("Y-m-d H:i:s"); $STARTtime = date("U"); -$stmt="select campaign_id from vicidial_campaigns where active='Y';"; +$LOGallowed_campaignsSQL=''; +$whereLOGallowed_campaignsSQL=''; +if ( (!eregi("-ALL",$LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } + +$stmt="select campaign_id from vicidial_campaigns where active='Y' $LOGallowed_campaignsSQL order by campaign_id;"; $rslt=mysql_query($stmt, $link); if (!isset($DB)) {$DB=0;} if ($DB) {echo "$stmt\n";} @@ -477,10 +508,12 @@ echo ""; echo ""; echo ""; -echo "\n\n
$db_source"; +echo "\n\n
"; $k++; } + +echo "$db_source\n"; ?> diff --git a/www/vicidial/admin.php b/www/vicidial/admin.php index 8d66c4cd..900e3310 100644 --- a/www/vicidial/admin.php +++ b/www/vicidial/admin.php @@ -94,6 +94,10 @@ $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; +$Vreports = 'NONE, Real-Time Main Report, Real-Time Campaign Summary , Inbound Report, Inbound Service Level Report, Inbound Summary Hourly Report, Inbound DID Report, Inbound IVR Report, Outbound Calling Report, Outbound Summary Interval Report, Fronter - Closer Report, Export Calls Report , Agent Time Detail, Agent Status Detail, Agent Performance Detail, Single Agent Daily , User Timeclock Report, User Group Timeclock Status Report, User Timeclock Detail Report , Server Perforrmance Report, Administration Change Log, List Update Stats, User Stats, User Time Sheet, Download List'; + +$UGreports = 'ALL REPORTS, NONE, Real-Time Main Report, Real-Time Campaign Summary , Inbound Report, Inbound Service Level Report, Inbound Summary Hourly Report, Inbound DID Report, Inbound IVR Report, Outbound Calling Report, Outbound Summary Interval Report, Fronter - Closer Report, Export Calls Report , Agent Time Detail, Agent Status Detail, Agent Performance Detail, Single Agent Daily , User Timeclock Report, User Group Timeclock Status Report, User Timeclock Detail Report , Server Perforrmance Report, Administration Change Log, List Update Stats, User Stats, User Time Sheet, Download List, Custom Reports Links'; + ###################################################################################################### ###################################################################################################### ####### Form variable declaration @@ -1367,6 +1371,8 @@ if (isset($_GET["wait_time_option_prompt_seconds"])) {$wait_time_option_prompt elseif (isset($_POST["wait_time_option_prompt_seconds"])) {$wait_time_option_prompt_seconds=$_POST["wait_time_option_prompt_seconds"];} if (isset($_GET["timer_action_destination"])) {$timer_action_destination=$_GET["timer_action_destination"];} elseif (isset($_POST["timer_action_destination"])) {$timer_action_destination=$_POST["timer_action_destination"];} +if (isset($_GET["allowed_reports"])) {$allowed_reports=$_GET["allowed_reports"];} + elseif (isset($_POST["allowed_reports"])) {$allowed_reports=$_POST["allowed_reports"];} if (isset($script_id)) {$script_id= strtoupper($script_id);} @@ -2385,11 +2391,13 @@ else # 100723-1519 - Added LOCKED options for Quick Transfer Button in campaigns # 100726-1017 - Added HANGUP, CALLMENU, EXTENSION and IN_GROUP timer actions to campaigns and in-groups # 100802-2130 - Changed Admin links to point to links page instead of Phones listings, changed Remote Agents to allow 9-digit IDs +# 100803-1412 - Added allowed_reports option to User Groups, added CAMPLISTS_ALL for manual_dial_filter(issue #369) +# - Added allowed_campaigns enforcement for Campaign listings # # make sure you have added a user to the vicidial_users MySQL table with at least user_level 8 to access this page the first time -$admin_version = '2.4-267'; -$build = '100802-2130'; +$admin_version = '2.4-268'; +$build = '100803-1412'; $STARTtime = date("U"); $SQLdate = date("Y-m-d H:i:s"); @@ -2459,6 +2467,19 @@ $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $auth=$row[0]; +$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and active='Y' and view_reports='1';"; +if ($DB) {echo "|$stmt|\n";} +$rslt=mysql_query($stmt, $link); +$row=mysql_fetch_row($rslt); +$reports_auth=$row[0]; + +$reports_only_user=0; +if ( ($reports_auth > 0) and ($auth < 1) ) + { + $ADD=999999; + $reports_only_user=1; + } + if ($WeBRooTWritablE > 0) {$fp = fopen ("./project_auth_entries.txt", "a");} @@ -2466,78 +2487,89 @@ $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); -if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or ($auth<1)) +if ( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or ( ($auth < 1 ) and ($reports_auth < 1) ) ) { - Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); - Header("HTTP/1.0 401 Unauthorized"); - echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; - exit; + Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); + Header("HTTP/1.0 401 Unauthorized"); + echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n"; + exit; + } + +if ( ($auth > 0) or ($reports_auth > 0) ) + { + $office_no=strtoupper($PHP_AUTH_USER); + $password=strtoupper($PHP_AUTH_PW); + $stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,callcard_admin from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW';"; + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $LOGfull_name =$row[3]; + $LOGuser_level =$row[4]; + $LOGuser_group =$row[5]; + $LOGdelete_users =$row[8]; + $LOGdelete_user_groups =$row[9]; + $LOGdelete_lists =$row[10]; + $LOGdelete_campaigns =$row[11]; + $LOGdelete_ingroups =$row[12]; + $LOGdelete_remote_agents =$row[13]; + $LOGload_leads =$row[14]; + $LOGcampaign_detail =$row[15]; + $LOGast_admin_access =$row[16]; + $LOGast_delete_phones =$row[17]; + $LOGdelete_scripts =$row[18]; + $LOGdelete_filters =$row[29]; + $LOGalter_agent_interface =$row[30]; + $LOGdelete_call_times =$row[32]; + $LOGmodify_call_times =$row[33]; + $LOGmodify_users =$row[34]; + $LOGmodify_campaigns =$row[35]; + $LOGmodify_lists =$row[36]; + $LOGmodify_scripts =$row[37]; + $LOGmodify_filters =$row[38]; + $LOGmodify_ingroups =$row[39]; + $LOGmodify_usergroups =$row[40]; + $LOGmodify_remoteagents =$row[41]; + $LOGmodify_servers =$row[42]; + $LOGview_reports =$row[43]; + $LOGmodify_dids =$row[56]; + $LOGdelete_dids =$row[57]; + $LOGmanager_shift_enforcement_override=$row[61]; + $LOGexport_reports =$row[64]; + $LOGdelete_from_dnc =$row[65]; + $LOGcallcard_admin =$row[66]; + + $stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $LOGallowed_campaigns = $row[0]; + $LOGallowed_reports = $row[1]; + + $LOGallowed_campaignsSQL=''; + $whereLOGallowed_campaignsSQL=''; + if ( (!eregi("-ALL",$LOGallowed_campaigns)) ) + { + $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); + $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); + $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; + $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; + } + $regexLOGallowed_campaigns = " $LOGallowed_campaigns "; + + if ($WeBRooTWritablE > 0) + { + fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfull_name|\n"); + fclose($fp); + } } else { - if($auth>0) + if ($WeBRooTWritablE > 0) { - $office_no=strtoupper($PHP_AUTH_USER); - $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT user_id,user,pass,full_name,user_level,user_group,phone_login,phone_pass,delete_users,delete_user_groups,delete_lists,delete_campaigns,delete_ingroups,delete_remote_agents,load_leads,campaign_detail,ast_admin_access,ast_delete_phones,delete_scripts,modify_leads,hotkeys_active,change_agent_campaign,agent_choose_ingroups,closer_campaigns,scheduled_callbacks,agentonly_callbacks,agentcall_manual,vicidial_recording,vicidial_transfers,delete_filters,alter_agent_interface_options,closer_default_blended,delete_call_times,modify_call_times,modify_users,modify_campaigns,modify_lists,modify_scripts,modify_filters,modify_ingroups,modify_usergroups,modify_remoteagents,modify_servers,view_reports,vicidial_recording_override,alter_custdata_override,qc_enabled,qc_user_level,qc_pass,qc_finish,qc_commit,add_timeclock_log,modify_timeclock_log,delete_timeclock_log,alter_custphone_override,vdc_agent_api_access,modify_inbound_dids,delete_inbound_dids,active,alert_enabled,download_lists,agent_shift_enforcement_override,manager_shift_enforcement_override,shift_override_flag,export_reports,delete_from_dnc,email,user_code,territory,allow_alerts,callcard_admin from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW';"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGfull_name =$row[3]; - $LOGuser_level =$row[4]; - $LOGuser_group =$row[5]; - $LOGdelete_users =$row[8]; - $LOGdelete_user_groups =$row[9]; - $LOGdelete_lists =$row[10]; - $LOGdelete_campaigns =$row[11]; - $LOGdelete_ingroups =$row[12]; - $LOGdelete_remote_agents =$row[13]; - $LOGload_leads =$row[14]; - $LOGcampaign_detail =$row[15]; - $LOGast_admin_access =$row[16]; - $LOGast_delete_phones =$row[17]; - $LOGdelete_scripts =$row[18]; - $LOGdelete_filters =$row[29]; - $LOGalter_agent_interface =$row[30]; - $LOGdelete_call_times =$row[32]; - $LOGmodify_call_times =$row[33]; - $LOGmodify_users =$row[34]; - $LOGmodify_campaigns =$row[35]; - $LOGmodify_lists =$row[36]; - $LOGmodify_scripts =$row[37]; - $LOGmodify_filters =$row[38]; - $LOGmodify_ingroups =$row[39]; - $LOGmodify_usergroups =$row[40]; - $LOGmodify_remoteagents =$row[41]; - $LOGmodify_servers =$row[42]; - $LOGview_reports =$row[43]; - $LOGmodify_dids =$row[56]; - $LOGdelete_dids =$row[57]; - $LOGmanager_shift_enforcement_override=$row[61]; - $LOGexport_reports =$row[64]; - $LOGdelete_from_dnc =$row[65]; - $LOGcallcard_admin =$row[66]; - - $stmt="SELECT allowed_campaigns from vicidial_user_groups where user_group='$LOGuser_group';"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGallowed_campaigns = $row[0]; - - if ($WeBRooTWritablE > 0) - { - fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|XXXX|$ip|$browser|$LOGfull_name|\n"); - fclose($fp); - } - } - else - { - if ($WeBRooTWritablE > 0) - { - fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|\n"); - fclose($fp); - } + fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|\n"); + fclose($fp); } } + ###################################################################################################### ###################################################################################################### ####### Header settings @@ -2831,6 +2863,7 @@ if ($ADD==99999) {$hh='users'; echo "HELP";} if ($ADD==999999) {$hh='reports'; echo "REPORTS";} if ($ADD==999998) {$hh='admin'; echo "ADMIN";} + if ( ($ADD>9) && ($ADD < 99998) ) { ##### get scripts listing for dynamic pulldown @@ -2884,7 +2917,7 @@ if ( ( (strlen($ADD)>4) && ($ADD < 99998) ) or ($ADD==3) or (($ADD>20) and ($ADD ##### BEGIN get campaigns listing for rankings ##### - $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns order by campaign_id"; + $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id"; $rslt=mysql_query($stmt, $link); $campaigns_to_print = mysql_num_rows($rslt); $campaigns_list=''; @@ -3235,7 +3268,7 @@ if ( ($ADD==211111) or ($ADD==311111) or ($ADD==411111) or ($ADD==511111) or ($A $qc_campaigns_list.="> ALL-CAMPAIGNS - USERS CAN QC ANY CAMPAIGN
\n"; $qc_groups_list.="> ALL-GROUPS - USERS CAN QC ANY INBOUND GROUP
\n"; - $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns order by campaign_id"; + $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id"; $rslt=mysql_query($stmt, $link); $campaigns_to_print = mysql_num_rows($rslt); @@ -4296,7 +4329,7 @@ if ($ADD==99999)

- Manual Dial Filter - This allows you to filter the calls that agents make in manual dial mode for this campaign by any combination of the following: DNC - to kick out, CAMPAIGNLISTS - the number must be within the lists for the campaign, NONE - no filter on manual dial or fast dial lists. + Manual Dial Filter - This allows you to filter the calls that agents make in manual dial mode for this campaign by any combination of the following: DNC - to kick out, CAMPAIGNLISTS - the number must be within the lists for the campaign, NONE - no filter on manual dial or fast dial lists. CAMPLISTS_ALL - will include inactive lists in the search for the number.
@@ -5401,6 +5434,11 @@ if ($ADD==99999)
Agent Fullscreen - This option if set to Y will set the height and width of the ViciDial agent screen to the size of the web browser window without any allowance for the Agents View, Calls in Queue View or Calls in Session view. Default is N for no or disabled. +
+ +
+ Allowed Reports - If a user in this group is set to user level 7 or higher, then this feature can be used to restrict the reports that the users can view. Default is ALL. If you want to select more than one report then press the Ctrl key on your keyboard as you select the reports. + 0) { @@ -7407,7 +7445,7 @@ if ($ADD==12) echo "Source Campaign: $NWB#vicidial_lists-list_description$NWE\n"; echo "Campaign: $NWB#vicidial_campaigns-manual_dial_list_id$NWE\n"; - echo "Manual Dial Filter: $NWB#vicidial_campaigns-manual_dial_filter$NWE\n"; + echo "Manual Dial Filter: $NWB#vicidial_campaigns-manual_dial_filter$NWE\n"; echo "Agent Screen Clipboard Copy: $NWB#vicidial_campaigns-agent_clipboard_copy$NWE\n"; @@ -19457,7 +19504,7 @@ echo "STATUSES\n"; echo "MODIFY\n"; echo "\n"; - $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns order by campaign_id"; + $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id"; $rslt=mysql_query($stmt, $link); $campaigns_to_print = mysql_num_rows($rslt); @@ -19519,7 +19566,7 @@ echo "HOTKEYS\n"; echo "MODIFY\n"; echo "\n"; - $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns order by campaign_id"; + $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id"; $rslt=mysql_query($stmt, $link); $campaigns_to_print = mysql_num_rows($rslt); @@ -19581,7 +19628,7 @@ echo "LEAD RECYCLES\n"; echo "MODIFY\n"; echo "\n"; - $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns order by campaign_id"; + $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id"; $rslt=mysql_query($stmt, $link); $campaigns_to_print = mysql_num_rows($rslt); @@ -19643,7 +19690,7 @@ echo "AUTO-ALT DIAL\n"; echo "MODIFY\n"; echo "\n"; - $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns order by campaign_id"; + $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id"; $rslt=mysql_query($stmt, $link); $campaigns_to_print = mysql_num_rows($rslt); @@ -19705,7 +19752,7 @@ echo "PAUSE CODES\n"; echo "MODIFY\n"; echo "\n"; - $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns order by campaign_id"; + $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id"; $rslt=mysql_query($stmt, $link); $campaigns_to_print = mysql_num_rows($rslt); @@ -19767,7 +19814,7 @@ echo "LIST MIX\n"; echo "MODIFY\n"; echo "\n"; - $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns order by campaign_id"; + $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id"; $rslt=mysql_query($stmt, $link); $campaigns_to_print = mysql_num_rows($rslt); @@ -19921,7 +19968,7 @@ if ($ADD==311) echo "List Description: $NWB#vicidial_lists-list_description$NWE\n"; echo "Campaign: $NWB#vicidial_user_groups-agent_fullscreen$NWE\n"; + echo "Allowed Reports: $NWB#vicidial_user_groups-allowed_reports$NWE\n"; + if ($SSqc_features_active > 0) { echo "QC Allowed Campaigns:
$NWB#vicidial_user_groups-qc_allowed_campaigns$NWE\n"; @@ -22069,7 +22132,7 @@ if ($ADD==3111111) echo " CAMPAIGNS USING THIS SCRIPT:
\n"; echo "\n"; - $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns where campaign_script='$script_id';"; + $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns where campaign_script='$script_id' $LOGallowed_campaignsSQL;"; $rslt=mysql_query($stmt, $link); $camps_to_print = mysql_num_rows($rslt); $o=0; @@ -22099,7 +22162,7 @@ if ($ADD==3111111) echo " LIST OVERRIDES USING THIS SCRIPT:
\n"; echo "
\n"; - $stmt="SELECT list_id,list_name from vicidial_lists where agent_script_override='$script_id';"; + $stmt="SELECT list_id,list_name from vicidial_lists where agent_script_override='$script_id' $LOGallowed_campaignsSQL;"; $rslt=mysql_query($stmt, $link); $camps_to_print = mysql_num_rows($rslt); $o=0; @@ -22161,7 +22224,7 @@ if ($ADD==31111111) echo "
\n"; ##### get campaigns listing for dynamic pulldown - $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns order by campaign_id"; + $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id"; $rslt=mysql_query($stmt, $link); $campaigns_to_print = mysql_num_rows($rslt); $campaigns_list=''; @@ -22363,7 +22426,7 @@ if ($ADD==311111111) echo "CAMPAIGNS USING THIS CALL TIME:
\n"; echo "\n"; - $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns where local_call_time='$call_time_id';"; + $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns where local_call_time='$call_time_id' $LOGallowed_campaignsSQL;"; $rslt=mysql_query($stmt, $link); $camps_to_print = mysql_num_rows($rslt); $o=0; @@ -23889,7 +23952,6 @@ if ($ADD==311111111111111) echo "
Reports to use Slave DB: "; + + $stmt="select NOW();"; + $rslt=mysql_query($stmt, $link); + if ($DB) {echo "$stmt\n";} + $dbtime_to_print = mysql_num_rows($rslt); + if ($dbtime_to_print) + { + $row=mysql_fetch_row($rslt); + echo ""; + } + } + echo "
\n"; echo ""; - $stmt="SELECT campaign_id,campaign_name,active,dial_method,auto_dial_level,lead_order,dial_statuses from vicidial_campaigns order by campaign_id"; + $stmt="SELECT campaign_id,campaign_name,active,dial_method,auto_dial_level,lead_order,dial_statuses from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id"; $rslt=mysql_query($stmt, $link); $campaigns_to_print = mysql_num_rows($rslt); @@ -24735,7 +24797,7 @@ if ($ADD==100) if (eregi("CAMPAIGNDOWN",$stage)) {$SQLorder='order by campaign_id desc'; $CAMPAIGNlink='stage=CAMPAIGNUP';} if (eregi("CALLDATEUP",$stage)) {$SQLorder='order by list_lastcalldate asc'; $CALLDATElink='stage=CALLDATEDOWN';} if (eregi("CALLDATEDOWN",$stage)) {$SQLorder='order by list_lastcalldate desc'; $CALLDATElink='stage=CALLDATEUP';} - $stmt="SELECT vls.list_id,list_name,list_description,count(*) as tally,active,list_lastcalldate,campaign_id,reset_time from vicidial_lists vls,vicidial_list vl where vls.list_id=vl.list_id group by list_id $SQLorder"; + $stmt="SELECT vls.list_id,list_name,list_description,count(*) as tally,active,list_lastcalldate,campaign_id,reset_time from vicidial_lists vls,vicidial_list vl where vls.list_id=vl.list_id $LOGallowed_campaignsSQL group by list_id $SQLorder"; $rslt=mysql_query($stmt, $link); $lists_to_print = mysql_num_rows($rslt); @@ -24775,7 +24837,7 @@ if ($ADD==100) $o++; } - $stmt="SELECT list_id,list_name,list_description,0,active,list_lastcalldate,campaign_id,reset_time from vicidial_lists where list_id NOT IN($lists_printed'');"; + $stmt="SELECT list_id,list_name,list_description,0,active,list_lastcalldate,campaign_id,reset_time from vicidial_lists where list_id NOT IN($lists_printed'') $LOGallowed_campaignsSQL;"; $rslt=mysql_query($stmt, $link); $lists_to_print = mysql_num_rows($rslt); $o=0; @@ -24962,7 +25024,7 @@ if ($ADD==10000) echo "
\n"; echo ""; - $stmt="SELECT remote_agent_id,user_start,number_of_lines,server_ip,conf_exten,extension_group,status,campaign_id from vicidial_remote_agents order by server_ip,campaign_id,user_start"; + $stmt="SELECT remote_agent_id,user_start,number_of_lines,server_ip,conf_exten,extension_group,status,campaign_id from vicidial_remote_agents $whereLOGallowed_campaignsSQL order by server_ip,campaign_id,user_start"; $rslt=mysql_query($stmt, $link); $remoteagents_to_print = mysql_num_rows($rslt); @@ -26145,54 +26207,75 @@ if ($ADD==999999)
      - Real-Time Reports
-
- Inbound and Outbound Calling Reports
- \n"; + echo "		\n"; + echo "      \n"; + echo "\n"; + echo "Agent Reports
\n"; + echo "
    \n"; + if ( (preg_match("/Agent Time Detail/",$LOGallowed_reports)) or (preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + {echo "
  • Agent Time Detail\n";} + if ( (preg_match("/Agent Status Detail/",$LOGallowed_reports)) or (preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + {echo "
  • Agent Status Detail\n";} + if ( (preg_match("/Agent Performance Detail/",$LOGallowed_reports)) or (preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + {echo "
  • Agent Performance Detail\n";} + if ( (preg_match("/Single Agent Daily/",$LOGallowed_reports)) or (preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + {echo "
  • Single Agent Daily\n";} + if ( (preg_match("/User Stats/",$LOGallowed_reports)) or (preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + {echo "
  • User Stats\n";} + if ( (preg_match("/User Time Sheet/",$LOGallowed_reports)) or (preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + {echo "
  • User Time Sheet\n";} + echo "

\n"; + echo "Time Clock Reports
\n"; + echo "
    \n"; + if ( (preg_match("/User Timeclock Report/",$LOGallowed_reports)) or (preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + {echo "
  • User Timeclock Report\n";} + if ( (preg_match("/User Group Timeclock Status Report/",$LOGallowed_reports)) or (preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + {echo "
  • User Group Timeclock Status Report\n";} + if ( (preg_match("/User Timeclock Detail Report/",$LOGallowed_reports)) or (preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + {echo "
  • User Timeclock Detail Report\n";} + echo "

\n"; + echo "Other Reports and Links
\n"; + echo "
    \n"; + if ( (preg_match("/Server Perforrmance Report/",$LOGallowed_reports)) or (preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) + {echo "
  • Server Perforrmance Report\n";} -
-       - - Agent Reports
-
- Time Clock Reports
-
- Other Reports and Links
-
    -
  • Server Perforrmance Report - = 9) + if ( ($LOGuser_level >= 9) and ( (preg_match("/Administration Change Log/",$LOGallowed_reports)) or (preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) ) { echo "
  • Administration Change Log\n"; } @@ -26204,98 +26287,106 @@ if ($ADD==999999) { echo "
  • VtigerCRM Home\n"; } - if ($list_update_count > 0) + if ( ($list_update_count > 0) and ( (preg_match("/List Update Stats/",$LOGallowed_reports)) or (preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) ) { echo "
  • List Update Stats\n"; } - ?> -
-
+ echo "\n"; + echo "
\n"; - - 

-		";
-			echo "\n";
-			}
-		else
-			{
-			echo "";
-			echo "\n";
+			readfile('custom_report_links.html');
 			}
 
-		$o=0;
-		while ($servers_to_print > $o)
+
+		if ($reports_only_user < 1)
 			{
-			$cpu = (100 - $cpu_idle_percent[$o]);
-			$disk = '';
-			$disk_ary = explode('|',$disk_usage[$o]);
-			$disk_ary_ct = count($disk_ary);
-			$k=0;
-			while ($k < $disk_ary_ct)
-				{
-				$disk_ary[$k] = preg_replace("/^\d* /","",$disk_ary[$k]);
-				if ($k<1) {$disk = "$disk_ary[$k]";}
-				else
-					{
-					if ($disk_ary[$k] > $disk) {$disk = "$disk_ary[$k]";}
-					}
-				$k++;
-				}
-			$disk = "$disk%";
-			echo "\n";
-			echo "\n";
-			echo "\n";
-			echo "\n";
-			echo "\n";
-			echo "\n";
-			echo "\n";
-			echo "\n";
+			echo "
SERVER -DESCRIPTIONIPACTLOADCHANDISKTIME
SERVER +DESCRIPTIONIPACTLOADCHANDISKOUTBOUNDINBOUND
$server_id[$o]$server_description[$o]$server_ip[$o]$active[$o]$sysload[$o] - $cpu%$channels_total[$o]$disk
\n";
+
 			if ($stage == 'TIME')
 				{
-				$stmt="select last_update from server_updater where server_ip='$server_ip[$o]';";
-				$rslt=mysql_query($stmt, $link);
-				if ($DB) {echo "$stmt\n";}
-				$servertime_to_print = mysql_num_rows($rslt);
-				if ($servertime_to_print)
-					{
-					$row=mysql_fetch_row($rslt);
-					echo "";
-					}
+				echo "";
+				echo "\n";
 				}
 			else
 				{
-				echo "\n";
-				echo "\n";
+				echo "";
+				echo "\n";
 				}
-			echo "\n";
-			$o++;
-			}
 
-		if ($stage == 'TIME')
-			{
-			echo "";
-
-			$stmt="select NOW();";
-			$rslt=mysql_query($stmt, $link);
-			if ($DB) {echo "$stmt\n";}
-			$dbtime_to_print = mysql_num_rows($rslt);
-			if ($dbtime_to_print)
+			$o=0;
+			while ($servers_to_print > $o)
 				{
-				$row=mysql_fetch_row($rslt);
-				echo "";
+				$cpu = (100 - $cpu_idle_percent[$o]);
+				$disk = '';
+				$disk_ary = explode('|',$disk_usage[$o]);
+				$disk_ary_ct = count($disk_ary);
+				$k=0;
+				while ($k < $disk_ary_ct)
+					{
+					$disk_ary[$k] = preg_replace("/^\d* /","",$disk_ary[$k]);
+					if ($k<1) {$disk = "$disk_ary[$k]";}
+					else
+						{
+						if ($disk_ary[$k] > $disk) {$disk = "$disk_ary[$k]";}
+						}
+					$k++;
+					}
+				$disk = "$disk%";
+				echo "\n";
+				echo "\n";
+				echo "\n";
+				echo "\n";
+				echo "\n";
+				echo "\n";
+				echo "\n";
+				echo "\n";
+				if ($stage == 'TIME')
+					{
+					$stmt="select last_update from server_updater where server_ip='$server_ip[$o]';";
+					$rslt=mysql_query($stmt, $link);
+					if ($DB) {echo "$stmt\n";}
+					$servertime_to_print = mysql_num_rows($rslt);
+					if ($servertime_to_print)
+						{
+						$row=mysql_fetch_row($rslt);
+						echo "";
+						}
+					}
+				else
+					{
+					if ( (preg_match("/Real-Time Main Report/",$LOGallowed_reports)) or (preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
+						{
+						echo "\n";
+						echo "\n";
+						}
+					else
+						{
+						echo "\n";
+						echo "\n";
+						}
+					}
+				echo "\n";
+				$o++;
 				}
-			}
 
-		echo "
$row[0]
SERVER -DESCRIPTIONIPACTLOADCHANDISKTIME
LINKLINK
SERVER +DESCRIPTIONIPACTLOADCHANDISKOUTBOUNDINBOUND
   PHP Time   " . date("Y-m-d H:i:s") . "
   DB Time   $row[0]
$server_id[$o]$server_description[$o]$server_ip[$o]$active[$o]$sysload[$o] - $cpu%$channels_total[$o]$disk$row[0]LINKLINK      
\n";
+			if ($stage == 'TIME')
+				{
+				echo "
   PHP Time   " . date("Y-m-d H:i:s") . "
   DB Time   $row[0]
\n";
+			}
 		}
 	else
 		{
diff --git a/www/vicidial/call_report_export.php b/www/vicidial/call_report_export.php
index e7eec3e0..83f8e033 100644
--- a/www/vicidial/call_report_export.php
+++ b/www/vicidial/call_report_export.php
@@ -22,6 +22,7 @@
 # 100712-1324 - Added system setting slave server option
 # 100713-0101 - Added recordings fields option (for filename, recording ID and URL)
 # 100713-1050 - Fixed minor custom fields issue
+# 100802-2347 - Added User Group Allowed Reports option validation and allowed campaigns restrictions
 #
 
 require("dbconnect.php");
@@ -93,7 +94,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
 $PHP_AUTH_USER = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_USER);
 $PHP_AUTH_PW = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_PW);
 
-$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and export_reports='1';";
+$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and export_reports='1' and active='Y';";
 if ($DB) {echo "|$stmt|\n";}
 if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
 $rslt=mysql_query($stmt, $link);
@@ -108,6 +109,38 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
     exit;
 	}
 
+$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1' and active='Y';";
+if ($DB) {echo "|$stmt|\n";}
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGuser_group =			$row[0];
+
+$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';";
+if ($DB) {echo "|$stmt|\n";}
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGallowed_campaigns = $row[0];
+$LOGallowed_reports =	$row[1];
+
+if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
+	{
+    Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
+    Header("HTTP/1.0 401 Unauthorized");
+    echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
+    exit;
+	}
+
+$LOGallowed_campaignsSQL='';
+$whereLOGallowed_campaignsSQL='';
+if ( (!eregi("-ALL",$LOGallowed_campaigns)) )
+	{
+	$rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns);
+	$rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL);
+	$LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')";
+	$whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')";
+	}
+$regexLOGallowed_campaigns = " $LOGallowed_campaigns ";
+
 
 ##### START RUN THE EXPORT AND OUTPUT FLAT DATA FILE #####
 if ($run_export > 0)
@@ -137,8 +170,11 @@ if ($run_export > 0)
 	$i=0;
 	while($i < $campaign_ct)
 		{
-		$campaign_string .= "$campaign[$i]|";
-		$campaign_SQL .= "'$campaign[$i]',";
+		if ( (preg_match("/ $campaign[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/-ALL/",$LOGallowed_campaigns)) )
+			{
+			$campaign_string .= "$campaign[$i]|";
+			$campaign_SQL .= "'$campaign[$i]',";
+			}
 		$i++;
 		}
 	if ( (ereg("--NONE--",$campaign_string) ) or ($campaign_ct < 1) )
@@ -490,7 +526,7 @@ else
 	if (!isset($query_date)) {$query_date = $NOW_DATE;}
 	if (!isset($end_date)) {$end_date = $NOW_DATE;}
 
-	$stmt="select campaign_id from vicidial_campaigns order by campaign_id;";
+	$stmt="select campaign_id from vicidial_campaigns $whereLOGallowed_campaignsSQL order by campaign_id;";
 	$rslt=mysql_query($stmt, $link);
 	if ($DB) {echo "$stmt\n";}
 	$campaigns_to_print = mysql_num_rows($rslt);
@@ -535,7 +571,7 @@ else
 		$i++;
 		}
 
-	$stmt="select list_id from vicidial_lists order by list_id;";
+	$stmt="select list_id from vicidial_lists $whereLOGallowed_campaignsSQL order by list_id;";
 	$rslt=mysql_query($stmt, $link);
 	if ($DB) {echo "$stmt\n";}
 	$lists_to_print = mysql_num_rows($rslt);
@@ -565,7 +601,7 @@ else
 		$i++;
 		}
 
-	$stmt="select distinct status from vicidial_campaign_statuses order by status;";
+	$stmt="select distinct status from vicidial_campaign_statuses $whereLOGallowed_campaignsSQL order by status;";
 	$rslt=mysql_query($stmt, $link);
 	if ($DB) {echo "$stmt\n";}
 	$Cstatuses_to_print = mysql_num_rows($rslt);
diff --git a/www/vicidial/fcstats.php b/www/vicidial/fcstats.php
index a1ecd7a6..c9a0e88d 100644
--- a/www/vicidial/fcstats.php
+++ b/www/vicidial/fcstats.php
@@ -15,6 +15,7 @@
 # 100214-1421 - Sort menu alphabetically
 # 100216-0042 - Added popup date selector
 # 100712-1324 - Added system setting slave server option
+# 100802-2347 - Added User Group Allowed Reports option validation
 #
 
 require("dbconnect.php");
@@ -70,7 +71,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
 	echo "\n";
 	}
 
-$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
+$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
 if ($DB) {echo "|$stmt|\n";}
 $rslt=mysql_query($stmt, $link);
 $row=mysql_fetch_row($rslt);
@@ -84,6 +85,27 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
     exit;
 	}
 
+$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
+if ($DB) {echo "|$stmt|\n";}
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGuser_group =			$row[0];
+
+$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';";
+if ($DB) {echo "|$stmt|\n";}
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGallowed_campaigns = $row[0];
+$LOGallowed_reports =	$row[1];
+
+if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
+	{
+    Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
+    Header("HTTP/1.0 401 Unauthorized");
+    echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
+    exit;
+	}
+
 $NOW_DATE = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
 $STARTtime = date("U");
diff --git a/www/vicidial/list_download.php b/www/vicidial/list_download.php
index f492ba87..60e478c5 100644
--- a/www/vicidial/list_download.php
+++ b/www/vicidial/list_download.php
@@ -15,6 +15,7 @@
 # 100508-1439 - Added header row to output
 # 100702-1335 - Added custom fields
 # 100712-1324 - Added system setting slave server option
+# 100802-2347 - Added User Group Allowed Reports option validation
 #
 
 require("dbconnect.php");
@@ -66,7 +67,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
 $PHP_AUTH_USER = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_USER);
 $PHP_AUTH_PW = ereg_replace("[^-_0-9a-zA-Z]","",$PHP_AUTH_PW);
 
-$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and download_lists='1';";
+$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and download_lists='1' and active='Y';";
 if ($DB) {echo "|$stmt|\n";}
 if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
 $rslt=mysql_query($stmt, $link);
@@ -81,6 +82,52 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
     exit;
 	}
 
+$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
+if ($DB) {echo "|$stmt|\n";}
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGuser_group =			$row[0];
+
+$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';";
+if ($DB) {echo "|$stmt|\n";}
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGallowed_campaigns = $row[0];
+$LOGallowed_reports =	$row[1];
+
+if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
+	{
+ #   Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
+ #   Header("HTTP/1.0 401 Unauthorized");
+    echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
+    exit;
+	}
+
+$LOGallowed_campaignsSQL='';
+if ( (!eregi("-ALL",$LOGallowed_campaigns)) )
+	{
+	$rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns);
+	$rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL);
+	$LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')";
+	}
+
+$stmt="select count(*) from vicidial_lists where list_id='$list_id' $LOGallowed_campaignsSQL;";
+$rslt=mysql_query($stmt, $link);
+if ($DB) {echo "$stmt\n";}
+$count_to_print = mysql_num_rows($rslt);
+if ($count_to_print > 0)
+	{
+	$row=mysql_fetch_row($rslt);
+	$lists_allowed =$row[0];
+	$i++;
+	}
+
+if ($lists_allowed < 1)
+	{
+	echo "You are not allowed to download this list: $list_id\n";
+	exit;
+	}
+
 $stmt="select count(*) from vicidial_list where list_id='$list_id';";
 $rslt=mysql_query($stmt, $link);
 if ($DB) {echo "$stmt\n";}
diff --git a/www/vicidial/timeclock_report.php b/www/vicidial/timeclock_report.php
index 0491d328..43495b83 100644
--- a/www/vicidial/timeclock_report.php
+++ b/www/vicidial/timeclock_report.php
@@ -13,6 +13,7 @@
 # 100214-1421 - Sort menu alphabetically
 # 100216-0042 - Added popup date selector
 # 100712-1324 - Added system setting slave server option
+# 100802-2347 - Added User Group Allowed Reports option validation
 #
 
 require("dbconnect.php");
@@ -76,7 +77,7 @@ if ( (strlen($slave_db_server)>5) and (preg_match("/$report_name/",$reports_use_
 $PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
 $PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
 
-$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1';";
+$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
 if ($DB) {echo "|$stmt|\n";}
 if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
 $rslt=mysql_query($stmt, $link);
@@ -91,6 +92,27 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
     exit;
 	}
 
+$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
+if ($DB) {echo "|$stmt|\n";}
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGuser_group =			$row[0];
+
+$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';";
+if ($DB) {echo "|$stmt|\n";}
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGallowed_campaigns = $row[0];
+$LOGallowed_reports =	$row[1];
+
+if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
+	{
+    Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
+    Header("HTTP/1.0 401 Unauthorized");
+    echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
+    exit;
+	}
+
 $NOW_DATE = date("Y-m-d");
 $NOW_TIME = date("Y-m-d H:i:s");
 $STARTtime = date("U");
diff --git a/www/vicidial/timeclock_status.php b/www/vicidial/timeclock_status.php
index 1e3e2bc4..a212f662 100644
--- a/www/vicidial/timeclock_status.php
+++ b/www/vicidial/timeclock_status.php
@@ -11,6 +11,7 @@
 # 90508-0644 - Changed to PHP long tags
 # 100214-1421 - Sort menu alphabetically
 # 100712-1324 - Added system setting slave server option
+# 100802-2347 - Added User Group Allowed Reports option validation
 #
 
 header ("Content-type: text/html; charset=utf-8");
@@ -83,7 +84,7 @@ else
 
 $EoDdate = date("Y-m-d H:i:s", $EoD);
 
-$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';";
+$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
 if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
 $rslt=mysql_query($stmt, $link);
 $row=mysql_fetch_row($rslt);
@@ -101,32 +102,28 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
     echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
     exit;
 	}
-else
+
+$stmt="SELECT user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
+if ($DB) {echo "|$stmt|\n";}
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGuser_group =			$row[0];
+
+$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';";
+if ($DB) {echo "|$stmt|\n";}
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGallowed_campaigns = $row[0];
+$LOGallowed_reports =	$row[1];
+
+if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
 	{
-	if($auth>0)
-		{
-			$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
-			$rslt=mysql_query($stmt, $link);
-			$row=mysql_fetch_row($rslt);
-			$LOGfullname=$row[0];
-		if ($webroot_writable > 0)
-			{
-			fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|$LOGfullname|\n");
-			fclose($fp);
-			}
-		}
-	else
-		{
-		if ($webroot_writable > 0)
-			{
-			fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|\n");
-			fclose($fp);
-			}
-		}
-
+    Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
+    Header("HTTP/1.0 401 Unauthorized");
+    echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
+    exit;
 	}
 
-
 $stmt="select user_group from vicidial_user_groups order by user_group;";
 $rslt=mysql_query($stmt, $link);
 if ($DB) {echo "$stmt\n";}
diff --git a/www/vicidial/user_stats.php b/www/vicidial/user_stats.php
index b9593d4f..21d28b3c 100644
--- a/www/vicidial/user_stats.php
+++ b/www/vicidial/user_stats.php
@@ -25,6 +25,7 @@
 # 100216-0042 - Added popup date selector
 # 100425-0115 - Added more login data
 # 100712-1324 - Added system setting slave server option
+# 100802-2347 - Added User Group Allowed Reports option validation
 #
 
 header ("Content-type: text/html; charset=utf-8");
@@ -94,7 +95,7 @@ $TODAY = date("Y-m-d");
 if (!isset($begin_date)) {$begin_date = $TODAY;}
 if (!isset($end_date)) {$end_date = $TODAY;}
 
-$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';";
+$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 6 and view_reports='1' and active='Y';";
 if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");}
 $rslt=mysql_query($stmt, $link);
 $row=mysql_fetch_row($rslt);
@@ -112,41 +113,44 @@ if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
     echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
     exit;
 	}
+
+$stmt="SELECT full_name,user_group from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGfullname =		$row[0];
+$LOGuser_group =	$row[1];
+
+fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|$LOGfullname|\n");
+fclose($fp);
+
+$stmt="SELECT allowed_campaigns,allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';";
+if ($DB) {echo "|$stmt|\n";}
+$rslt=mysql_query($stmt, $link);
+$row=mysql_fetch_row($rslt);
+$LOGallowed_campaigns = $row[0];
+$LOGallowed_reports =	$row[1];
+
+if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) )
+	{
+    Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
+    Header("HTTP/1.0 401 Unauthorized");
+    echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n";
+    exit;
+	}
+
+if ($did > 0)
+	{
+	$stmt="SELECT did_description from vicidial_inbound_dids where did_pattern='$user';";
+	$rslt=mysql_query($stmt, $link);
+	$row=mysql_fetch_row($rslt);
+	$full_name = $row[0];
+	}
 else
 	{
-
-	if($auth>0)
-		{
-		$stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
-		$rslt=mysql_query($stmt, $link);
-		$row=mysql_fetch_row($rslt);
-		$LOGfullname=$row[0];
-
-		fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|$LOGfullname|\n");
-		fclose($fp);
-		}
-	else
-		{
-		fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|\n");
-		fclose($fp);
-		echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
-		exit;
-		}
-
-	if ($did > 0)
-		{
-		$stmt="SELECT did_description from vicidial_inbound_dids where did_pattern='$user';";
-		$rslt=mysql_query($stmt, $link);
-		$row=mysql_fetch_row($rslt);
-		$full_name = $row[0];
-		}
-	else
-		{
-		$stmt="SELECT full_name from vicidial_users where user='$user';";
-		$rslt=mysql_query($stmt, $link);
-		$row=mysql_fetch_row($rslt);
-		$full_name = $row[0];
-		}
+	$stmt="SELECT full_name from vicidial_users where user='$user';";
+	$rslt=mysql_query($stmt, $link);
+	$row=mysql_fetch_row($rslt);
+	$full_name = $row[0];
 	}