diff --git a/UPGRADE b/UPGRADE index b97f377a..cdbbda80 100644 --- a/UPGRADE +++ b/UPGRADE @@ -129,6 +129,8 @@ OTHER CHANGES: 25. Added new LOCK options to Manual Dial Search Checkbox to prevent the agent from checking or unchecking the search checkbox. +26. Added case-sensitive user ID validation on agent login. + diff --git a/www/agc/timeclock.php b/www/agc/timeclock.php index 7d87bd9a..8203254c 100644 --- a/www/agc/timeclock.php +++ b/www/agc/timeclock.php @@ -19,10 +19,11 @@ # 141118-1239 - Formatting changes for QXZ output # 141216-2122 - Added language settings lookups and user/pass variable standardization # 150210-1307 - Fixed QXZ tags and formatting(issue #827) +# 150212-0033 - Added case-sensitive user validation(issue #682) # -$version = '2.10-14'; -$build = '141216-2122'; +$version = '2.10-15'; +$build = '150212-0033'; $StarTtimE = date("U"); $NOW_TIME = date("Y-m-d H:i:s"); @@ -99,7 +100,7 @@ require_once("functions.php"); ############################################# ##### START SYSTEM_SETTINGS AND USER LANGUAGE LOOKUP ##### $VUselected_language = ''; -$stmt="SELECT selected_language from vicidial_users where user='$VD_login';"; +$stmt="SELECT user,selected_language from vicidial_users where user='$VD_login';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00XXX',$VD_login,$server_ip,$session_name,$one_mysql_log);} @@ -107,7 +108,8 @@ $sl_ct = mysqli_num_rows($rslt); if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); - $VUselected_language = $row[0]; + $VUuser = $row[0]; + $VUselected_language = $row[1]; } $stmt = "SELECT use_non_latin,admin_home_url,admin_web_directory,enable_languages,language_method FROM system_settings;"; @@ -147,6 +149,15 @@ if ( ($stage == 'login') or ($stage == 'logout') ) if ($auth_message == 'GOOD') {$valid_user=1;} + # case-sensitive check for user + if($valid_user>0) + { + if ($user != "$VUuser") + { + $valid_user=0; + } + } + print "\n"; if ($valid_user < 1) diff --git a/www/agc/vicidial.php b/www/agc/vicidial.php index eb3d476c..2e9794b8 100644 --- a/www/agc/vicidial.php +++ b/www/agc/vicidial.php @@ -477,10 +477,11 @@ # 150203-1331 - Small changes to improve manual dial hotkey use # 150204-1911 - Changed Manual hotkey auto-manual-dial to a variable delay depending on dispo processing time # 150210-1225 - Added LOCK options for manual_dial_search_checkbox, fixed missing QXZ tags(issue #827) +# 150212-0034 - Added case-sensitive user validation(issue #682) # -$version = '2.10-448c'; -$build = '150210-1225'; +$version = '2.10-449c'; +$build = '150212-0034'; $mel=1; # Mysql Error Log enabled = 1 $mysql_log_count=85; $one_mysql_log=0; @@ -563,7 +564,7 @@ $VUselected_language = ''; $random = (rand(1000000, 9999999) + 10000000); -$stmt="SELECT selected_language from vicidial_users where user='$VD_login';"; +$stmt="SELECT user,selected_language from vicidial_users where user='$VD_login';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'01081',$VD_login,$server_ip,$session_name,$one_mysql_log);} @@ -571,7 +572,8 @@ $sl_ct = mysqli_num_rows($rslt); if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); - $VUselected_language = $row[0]; + $VUuser = $row[0]; + $VUselected_language = $row[1]; } ############################################# @@ -1122,6 +1124,15 @@ else $auth=1; $pass_hash = preg_replace("/GOOD\|/",'',$auth_message); } + # case-sensitive check for user + if($auth>0) + { + if ($VD_login != "$VUuser") + { + $auth=0; + $auth_message='ERRCASE'; + } + } if($auth>0) { @@ -2202,6 +2213,8 @@ else {$VDdisplayMESSAGE = _QXZ("You are already logged in, please log out of your other session first")."
";} if ($auth_message == 'ERRAGENTS') {$VDdisplayMESSAGE = _QXZ("Too many agents logged in, please contact your administrator")."
";} + if ($auth_message == 'ERRCASE') + {$VDdisplayMESSAGE = _QXZ("Login incorrect, user names are case sensitive")."
";} } } if ($VDloginDISPLAY)