ViciDial/agc_2-X
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix for send_notification user group permissions

Browse Source 
git-svn-id: svn://192.168.202.10@3705 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2023-04-13 23:58:17 +00:00
parent 52f5464c39
commit 5c2f9fbc2f
2 changed files with 76 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/AGENT_API.txt
+5 -1
View File
@@ -1,4 +1,4 @@
AGENT API DOCUMENT Started: 2008-07-03 Updated: 2023-04-12
AGENT API DOCUMENT Started: 2008-07-03 Updated: 2023-04-13
This document describes the functions of an API(Application Programming Interface)
for the VICIDIAL Agent screen. This functionality will be rather limited at first
@@ -1078,6 +1078,10 @@ RESPONSES:
ERROR: Agent API Notifications are disabled on this system - 0
ERROR: Missing recipient or recipient_type: (<recipient>|<recipient_type>)
ERROR: Invalid request, missing variables
ERROR: ACCESS TO CAMPAIGN TESTCAMP NOT ALLOWED FOR USER 6666
ERROR: ACCESS TO USER GROUP ADMIN NOT ALLOWED FOR USER 6666
ERROR: user_group DOES NOT EXIST - ADMIN|6666
ERROR: 6667 DOES NOT EXIST in vicidial_users
SUCCESS: notification queued
** Additionally, there are "NOTICE" messages that will be included in the response if the notification date is improperly formatted/missing, or if the recipient_type is not included.
www/agc/api.php
+71 -2
View File
@@ -108,10 +108,11 @@
# 210819-0902 - Updated change_ingroups for changes in vicidial_live_inbound_agents insert/update
# 220220-0847 - Added allow_web_debug system setting
# 230412-0945 - Added send_notification function
# 230413-1957 - Fix for send_notification user group permissions
#
$version = '2.14-73';
$build = '230412-0945';
$version = '2.14-74';
$build = '230413-1957';
$php_script = 'api.php';
$startMS = microtime();
@@ -5115,6 +5116,74 @@ if ($function == 'send_notification')
if ($recipient && $recipient_type)
{
### Check that recipient exists in respective table
switch($recipient_type)
{
case "CAMPAIGN":
$tbl_name="vicidial_campaigns";
$col_name="campaign_id";
break;
case "USER_GROUP":
$tbl_name="vicidial_user_groups";
$col_name="user_group";
break;
case "USER":
$tbl_name="vicidial_users";
$col_name="user";
break;
}
$exist_stmt="select $col_name from $tbl_name where $col_name='$recipient'";
if ($DB) {echo $exist_stmt."<BR>\n";}
$exist_rslt=mysql_to_mysqli($exist_stmt, $link);
$exist_ct = mysqli_num_rows($exist_rslt);
if ($exist_ct==0)
{
$result = _QXZ("ERROR");
$result_reason = _QXZ("$recipient DOES NOT EXIST in $tbl_name");
echo "$result: $result_reason - $value|$recipient\n";
api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
exit;
}
# For campaign alerts, verify the user has access to said campaign
if($recipient_type=="CAMPAIGN" || $recipient_type=="USER_GROUP")
{
$stmt="SELECT allowed_campaigns, admin_viewable_groups from vicidial_user_groups where user_group='$VUuser_group';";
if ($DB>0) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
$ss_conf_ct = mysqli_num_rows($rslt);
if ($ss_conf_ct > 0)
{
$row=mysqli_fetch_row($rslt);
$LOGallowed_campaigns = $row[0];
$LOGadmin_viewable_groups = $row[1];
if ($recipient_type=="CAMPAIGN" && (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) && !preg_match("/ $recipient /i", $LOGallowed_campaigns) )
{
$result = _QXZ("ERROR");
$result_reason = _QXZ("ACCESS TO CAMPAIGN $recipient NOT ALLOWED FOR USER $user ($LOGallowed_campaigns)");
echo "$result: $result_reason - $value|$recipient\n";
api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
exit;
}
else if ($recipient_type=="USER_GROUP" && (!preg_match('/\-\-\-ALL/i', $LOGadmin_viewable_groups)) && !preg_match("/ $recipient /i", $LOGadmin_viewable_groups) )
{
$result = _QXZ("ERROR");
$result_reason = _QXZ("ACCESS TO USER GROUP $recipient NOT ALLOWED FOR USER $user");
echo "$result: $result_reason - $value|$recipient\n";
api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
exit;
}
}
else
{
$result = _QXZ("ERROR");
$result_reason = _QXZ("user_group DOES NOT EXIST");
echo "$result: $result_reason - $value|$VUuser_group\n";
api_log($link,$api_logging,$api_script,$user,$agent_user,$function,$value,$result,$result_reason,$source,$data);
exit;
}
}
if(!$notification_date) {$notification_date=date("Y-m-d H:i:s");}
if (preg_match('/Y/i', $notification_retry))
{