diff --git a/UPGRADE b/UPGRADE
index 1bc53bbc..5a559df2 100644
--- a/UPGRADE
+++ b/UPGRADE
@@ -136,6 +136,13 @@ OTHER CHANGES:
15. Added AST_CRON_audio_4_ftp2_FTPSSL.pl script to allow for transmission of
second archival of recordings to an FTP SSL server.
+16. Added settings to the agc/options.php file to allow for forced launching of
+ the agent screen from a script like the new launch.php script. The agent
+ is not allowed to login by going to the vicidial.php page directly, and
+ the launch.php page will open the agent screen with a read-only address
+ bar and several other browser options disabled. To enable this feature,
+ just set the $window_validation variable to '1' in options.php
+
diff --git a/translations/raw_translation_files/TO_BE_TRANSLATED_2.8.txt b/translations/raw_translation_files/TO_BE_TRANSLATED_2.8.txt
index 4d87d62d..31cb8e07 100644
--- a/translations/raw_translation_files/TO_BE_TRANSLATED_2.8.txt
+++ b/translations/raw_translation_files/TO_BE_TRANSLATED_2.8.txt
@@ -237,6 +237,8 @@ If set to N, the calls will queue up, even if there are no agents logged in and
############################################################ CLIENT
+This agent screen was not opened properly||
+
########################## CHANGES TO EXISTING PHRASES IN AGENT TRANSLATION
diff --git a/www/agc/launch.php b/www/agc/launch.php
new file mode 100644
index 00000000..9b0b69b6
--- /dev/null
+++ b/www/agc/launch.php
@@ -0,0 +1,148 @@
+ LICENSE: AGPLv2
+#
+# For launch validation to work, the options.php file must have
+# window_validation = 1 and win_valid_name set to window_name below
+#
+# CHANGELOG
+# 130903-2055 - First Build
+#
+
+$window_name = 'subwindow_launch';
+
+
+
+### do not edit below this line ###
+
+if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
+ elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
+if (isset($_GET["JS_browser_width"])) {$JS_browser_width=$_GET["JS_browser_width"];}
+ elseif (isset($_POST["JS_browser_width"])) {$JS_browser_width=$_POST["JS_browser_width"];}
+if (isset($_GET["JS_browser_height"])) {$JS_browser_height=$_GET["JS_browser_height"];}
+ elseif (isset($_POST["JS_browser_height"])) {$JS_browser_height=$_POST["JS_browser_height"];}
+if (isset($_GET["phone_login"])) {$phone_login=$_GET["phone_login"];}
+ elseif (isset($_POST["phone_login"])) {$phone_login=$_POST["phone_login"];}
+if (isset($_GET["phone_pass"])) {$phone_pass=$_GET["phone_pass"];}
+ elseif (isset($_POST["phone_pass"])) {$phone_pass=$_POST["phone_pass"];}
+if (isset($_GET["VD_login"])) {$VD_login=$_GET["VD_login"];}
+ elseif (isset($_POST["VD_login"])) {$VD_login=$_POST["VD_login"];}
+if (isset($_GET["VD_pass"])) {$VD_pass=$_GET["VD_pass"];}
+ elseif (isset($_POST["VD_pass"])) {$VD_pass=$_POST["VD_pass"];}
+if (isset($_GET["VD_campaign"])) {$VD_campaign=$_GET["VD_campaign"];}
+ elseif (isset($_POST["VD_campaign"])) {$VD_campaign=$_POST["VD_campaign"];}
+if (isset($_GET["relogin"])) {$relogin=$_GET["relogin"];}
+ elseif (isset($_POST["relogin"])) {$relogin=$_POST["relogin"];}
+if (isset($_GET["MGR_override"])) {$MGR_override=$_GET["MGR_override"];}
+ elseif (isset($_POST["MGR_override"])) {$MGR_override=$_POST["MGR_override"];}
+if (!isset($phone_login))
+ {
+ if (isset($_GET["pl"])) {$phone_login=$_GET["pl"];}
+ elseif (isset($_POST["pl"])) {$phone_login=$_POST["pl"];}
+ }
+if (!isset($phone_pass))
+ {
+ if (isset($_GET["pp"])) {$phone_pass=$_GET["pp"];}
+ elseif (isset($_POST["pp"])) {$phone_pass=$_POST["pp"];}
+ }
+if (isset($VD_campaign))
+ {
+ $VD_campaign = strtoupper($VD_campaign);
+ $VD_campaign = preg_replace("/\s/i",'',$VD_campaign);
+ }
+if (!isset($flag_channels))
+ {
+ $flag_channels=0;
+ $flag_string='';
+ }
+
+### security strip all non-alphanumeric characters out of the variables ###
+$DB=preg_replace("/[^0-9a-z]/","",$DB);
+$phone_login=preg_replace("/[^\,0-9a-zA-Z]/","",$phone_login);
+$phone_pass=preg_replace("/[^0-9a-zA-Z]/","",$phone_pass);
+$VD_login=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_login);
+$VD_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$VD_pass);
+$VD_campaign = preg_replace("/[^-_0-9a-zA-Z]/","",$VD_campaign);
+
+$login_string='';
+
+if (strlen($phone_login)>0)
+ {$login_string .= "phone_login=$phone_login&";}
+if (strlen($phone_pass)>0)
+ {$login_string .= "phone_pass=$phone_pass&";}
+if (strlen($VD_login)>0)
+ {$login_string .= "VD_login=$VD_login&";}
+if (strlen($VD_pass)>0)
+ {$login_string .= "VD_pass=$VD_pass&";}
+if (strlen($VD_campaign)>0)
+ {$login_string .= "VD_campaign=$VD_campaign";}
+if (strlen($login_string)>0)
+ {$login_string = "?$login_string";}
+
+$US='_';
+$CL=':';
+$AT='@';
+$DS='-';
+$date = date("r");
+$ip = getenv("REMOTE_ADDR");
+$browser = getenv("HTTP_USER_AGENT");
+$script_name = getenv("SCRIPT_NAME");
+$server_name = getenv("SERVER_NAME");
+$server_port = getenv("SERVER_PORT");
+if (preg_match("/443/i",$server_port)) {$HTTPprotocol = 'https://';}
+ else {$HTTPprotocol = 'http://';}
+if (($server_port == '80') or ($server_port == '443') ) {$server_port='';}
+else {$server_port = "$CL$server_port";}
+$agcPAGE = "$HTTPprotocol$server_name$server_port$script_name";
+$agcDIR = preg_replace("/launch\.php/",'',$agcPAGE);
+if (strlen($static_agent_url) > 5)
+ {$agcPAGE = $static_agent_url;}
+
+
+?>
+
+
+
+Agent Screen Opener
+
+
+
+Agent Screen Opener
+
+
+
+
diff --git a/www/agc/options-example.php b/www/agc/options-example.php
index 94f8d207..b40ccbb4 100644
--- a/www/agc/options-example.php
+++ b/www/agc/options-example.php
@@ -1,13 +1,14 @@
LICENSE: AGPLv2
+# Copyright (C) 2013 Matt Florell LICENSE: AGPLv2
#
# rename this file to options.php for the settings here to go into effect
#
# CHANGELOG
# 100306-0805 - First Build
-# 120214-1636 - Added consult_custom_delay optioin
+# 120214-1636 - Added consult_custom_delay option
+# 130903-2015 - Added window validation options
#
$conf_silent_prefix = '5'; # vicidial_conferences prefix to enter silently and muted for recording
@@ -55,6 +56,9 @@ $MAIN_COLOR = '#CCCCCC'; # old default is E0C2D6
$SCRIPT_COLOR = '#E6E6E6'; # old default is FFE7D0
$SIDEBAR_COLOR = '#F6F6F6';
+$window_validation = 0; # set to 1 to disallow direct logins to vicidial.php
+$win_valid_name = 'subwindow_launch'; # only window name to allow if validation enabled
+
# thin bar webphone settings:
# $webphone_width = 1085; # set the webphone frame width
# $webphone_height = 36; # set the webphone frame height
diff --git a/www/agc/vicidial.php b/www/agc/vicidial.php
index 6297784e..9aa7680c 100644
--- a/www/agc/vicidial.php
+++ b/www/agc/vicidial.php
@@ -409,10 +409,11 @@
# 130718-0745 - Added recording_filename to dispo_call_url
# 130802-1134 - Changed to PHP mysqli functions
# 130822-0656 - Changed all require to require_once in agc directory for PHP backward compatibility
+# 130903-1920 - Added security check for browser window name, see launch.php for more information
#
-$version = '2.8-378c';
-$build = '130822-0656';
+$version = '2.8-379c';
+$build = '130903-1920';
$mel=1; # Mysql Error Log enabled = 1
$mysql_log_count=79;
$one_mysql_log=0;
@@ -576,6 +577,9 @@ $SCRIPT_COLOR = '#E6E6E6'; # old default is FFE7D0
$FORM_COLOR = '#EFEFEF';
$SIDEBAR_COLOR = '#F6F6F6';
+$window_validation = 0; # set to 1 to disallow direct logins to vicidial.php
+$win_valid_name = 'subwindow_launch'; # only window name to allow if validation enabled
+
# if options file exists, use the override values for the above variables
# see the options-example.php file for more information
if (file_exists('options.php'))
@@ -3197,7 +3201,6 @@ $CCAL_OUT .= "";
?>