Added filtering to AGI processes to help prevent DID SQL injection attacks

Added nanpa filtering log viewing to new NANPA updating process Fixed span order in vicidial.php Fixed issue with list webform overrides in agent interface other small variable filtering fixes git-svn-id: svn://192.168.202.10@2023 3d104415-ff17-0410-8863-d5cf3c621b8a
2013-09-26 01:27:15 +00:00
parent 5bab063a9c
commit 61b5e03d01
16 changed files with 170 additions and 62 deletions
@@ -29,6 +29,7 @@
 #
 # CHANGELOG
 # 130716-1315 - First build based upon agi-phone_monitor.agi
+# 130925-1823 - Added variable filter to prevent DID SQL injection attack
 #

 &get_time_now;
@@ -163,6 +164,10 @@ while(<STDIN>)
 	if (/^agi_calleridname\:\s+(.*)$/)	{$calleridname = $1;}
 	}

+$callerid =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+$calleridname =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+$extension =~ s/\'|\"|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+
 if ( ($callerid =~ /\".*\"/) && ( (!$calleridname) or ($calleridname =~ /unknown/) ) )
 	{
 	$calleridname = $callerid;
@@ -174,6 +179,7 @@ $callerid =~ s/\D//gi;
 $calleridname =~ s/unknown//gi;
 if ( (!$callerid) or ($callerid =~ /unknown/) )
 	{$callerid = $calleridname;}
+
 $phone_number=$callerid;

 ### Grab Server values from the database
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 #
-# agi-DID_route.agi version 2.6
+# agi-DID_route.agi version 2.8
 # 
 # runs when a call comes into an inbound context on a trunk. This script will 
 # send the calls to various places depending on the settings for each DID.
@@ -30,6 +30,7 @@
 # 120314-1112 - Fixed small filter bug
 # 120430-2214 - Converted call to Monitor app to be asterisk 1.8 compatible
 # 130108-1810 - Changes for Asterisk 1.8 compatibility
+# 130925-1819 - Added variable filter to prevent DID SQL injection attack
 #

 $script = 'agi-DID_route.agi';
@@ -190,6 +191,9 @@ $calleridname =~ s/unknown|\'//gi;
 if ( (!$callerid) or ($callerid =~ /unknown/) )
 	{$callerid = $calleridname;}

+$callerid =~ s/\'|\"|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+$calleridname =~ s/\'|\"|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+$extension =~ s/\'|\"|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;

 ### Grab DID values from the database
 $DIDs_in_system=0;
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 #
-# agi-VDAD_ALL_inbound.agi version 2.6
+# agi-VDAD_ALL_inbound.agi version 2.8
 # 
 # runs when a call comes in from an inbound call. This script will 
 # send the calls out to the closers that are logged in.
@@ -184,6 +184,7 @@
 # 121124-1345 - Added call times holidays function
 # 121129-1618 - Small fix for estimated hold time, excluding QUEUE status
 # 130108-1804 - Changes for Asterisk 1.8 compatibility
+# 130925-1821 - Added variable filter to prevent DID SQL injection attack
 #

 $script = 'agi-VDAD_ALL_inbound.agi';
@@ -363,7 +364,9 @@ while(<STDIN>)
 	if (/^agi_callerid\:\s+(.*)$/)		{$callerid = $1;}
 	if (/^agi_calleridname\:\s+(.*)$/)	{$calleridname = $1;}
 	}
-
+$callerid =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+$calleridname =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+$extension =~ s/\'|\"|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;

 if ($calleridname =~ /^V\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d|^Y\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d/)
 	{$callerid = $calleridname;}
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 #
-# agi-VDAD_inbound_calltime_check.agi   version 2.6
+# agi-VDAD_inbound_calltime_check.agi   version 2.8
 # 
 # Runs when a call comes in from an inbound call. This script will check the
 # settings of the defined calltime scheme in VICIDIAL and either send the call
@@ -50,6 +50,7 @@
 # 120730-0727 - Fixed issue with non-populating phone number
 # 121124-1414 - Added call times holidays function
 # 130108-1807 - Changes for Asterisk 1.8 compatibility
+# 130925-1826 - Added variable filter to prevent DID SQL injection attack
 #

 $script = 'agi-VDAD_inbound_calltime_check.agi';
@@ -225,6 +226,9 @@ while(<STDIN>)
 	if (/^agi_callerid\:\s+(.*)$/)		{$callerid = $1;}
 	if (/^agi_calleridname\:\s+(.*)$/)	{$calleridname = $1;}
 	}
+$callerid =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+$calleridname =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+$extension =~ s/\'|\"|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;

 $outboundIVR=0;
 $ingroupIVR=0;
@@ -286,7 +290,6 @@ else
 	if ( (!$callerid) or ($callerid =~ /unknown/) )
 		{$callerid = $calleridname;}

-
 	if (length($callerid)>0) {$phone_number = $callerid;}
 	   else {$phone_number = '';}
 	if (length($calleridname)>0) {$VLcomments = $calleridname;}
@@ -296,7 +299,6 @@ else
 if (length($callerid)<8) {$callerid = $parked_by;}
 if (length($pin)>0) {$callerid = $pin;}

-
 foreach $i (sort keys %AGI) 
 	{
 	if ($AGILOG) {$agi_string = " -- $i = $AGI{$i}";   &agi_output;}
@@ -29,6 +29,7 @@
 # 130401-0724 - First build
 # 130520-1013 - Added PLOGIN lookup option and no-prompt extension feature
 # 130710-1658 - Small change to allow non-hangup between agent calls
+# 130925-1824 - Added variable filter to prevent DID SQL injection attack
 #

 &get_time_now;
@@ -143,6 +144,9 @@ while(<STDIN>)
 	if (/^agi_callerid\:\s+(.*)$/)		{$callerid = $1;}
 	if (/^agi_calleridname\:\s+(.*)$/)	{$calleridname = $1;}
 	}
+$callerid =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+$calleridname =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+$extension =~ s/\'|\"|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;

 if ( ($callerid =~ /\".*\"/) && ( (!$calleridname) or ($calleridname =~ /unknown/) ) )
 	{
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 #
-# cm.agi   version 2.4
+# cm.agi   version 2.8
 # 
 # Used by Call Menus to log digit presses if enabled in the settings. You should
 # not need to manually use this script, it is used by the dialplan builder.
@@ -19,12 +19,13 @@
 #exten => _XXXXX,1,AGI(cm.agi,INBOUND-----${EXTEN}-----postal_code)
 #exten => _XXXXX,n,Goto(next_callmenu_here,s,1)
 #
-# Copyright (C) 2012  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
+# Copyright (C) 2013  Matt Florell <vicidial@gmail.com>    LICENSE: AGPLv2
 #
 # changes:
 # 110525-2100 - First Build
 # 111003-2150 - Added field to update
 # 120730-0729 - Changed to allow inbound logging when lead is defined
+# 130925-1822 - Added variable filter to prevent DID SQL injection attack
 #

 $script = 'cm.agi';
@@ -174,6 +175,9 @@ while(<STDIN>)
 	if (/^agi_callerid\:\s+(.*)$/)		{$callerid = $1;}
 	if (/^agi_calleridname\:\s+(.*)$/)	{$calleridname = $1;}
 	}
+$callerid =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+$calleridname =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+$extension =~ s/\'|\"|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;

 $outboundIVR=0;
 $fieldUPDATE=0;
@@ -221,7 +225,6 @@ else
 	if ( (!$callerid) or ($callerid =~ /unknown/) )
 		{$callerid = $calleridname;}

-
 	if (length($callerid)>0) {$phone_number = $callerid;}
 	   else {$phone_number = '';}
 	if (length($calleridname)>0) {$VLcomments = $calleridname;}
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 #
-# cm_dnc.agi version 2.6
+# cm_dnc.agi version 2.8
 # 
 # Designed to work with Cell Menus to allow setting of a number as DNC or NI
 # This script is meant as a replacecment for the agi-VDADinbound_NI_DNC_CIDlookup.agi
@@ -22,6 +22,7 @@
 # changes:
 # 121109-1623 - First draft
 # 130108-1817 - Changes for Asterisk 1.8 compatibility
+# 130925-1825 - Added variable filter to prevent DID SQL injection attack
 #

 $script = 'cm_dnc.agi';
@@ -161,6 +162,9 @@ while(<STDIN>)
 	if (/^agi_type\:\s+(.*)$/)			{$type = $1;}
 	if (/^agi_callerid\:\s+(.*)$/)		{$callerid = $1;}
 	if (/^agi_calleridname\:\s+(.*)$/)	{$calleridname = $1;}
+	$callerid =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+	$calleridname =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+	$extension =~ s/\'|\"|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;

 	if ( ($callerid =~ /\".*\"/) && ( (!$calleridname) or ($calleridname =~ /unknown/) ) )
 		{
@@ -67,6 +67,7 @@
 # 130412-1321 - Added sip_hangup_cause to carrier log
 # 130531-1619 - Fixed issue with busy agent login calls attempting to be logged
 # 130802-0739 - Added CAMPCUST dialplan variable definition for outbound calls
+# 130925-1820 - Added variable filter to prevent DID SQL injection attack
 #

 # defaults for PreFork
@@ -356,6 +357,9 @@ sub process_request
 			$calleridname = $callerid;
 			}
 		}
+	$callerid =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+	$calleridname =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
+	$extension =~ s/\'|\"|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;

 	if ($AGILOG) 
 		{
@@ -47,7 +47,7 @@ Requires "Net::SFTP::Foreign" and "IO::Pty" CPAN modules to run. Automatically g
  NOTE: before you can run this script, you will need to sftp into the dnc.com server first on the Linux command line, (sftp XXXX@sftp.dncscrub.com)

 bin/nanpa_type_preload.pl - 
-This script is designed to load all of the prefixes and portability data into RAM and run against your entire database to scrub it for cellphone numbers every night after the data is refreshed. It takes several minutes to initialize, but runs very fast after that. This process should be set to run in the crontab every morning AFTER thee populate script is finished running.
+This script is designed to load all of the prefixes and portability data into RAM and run against your entire database to scrub it for cellphone numbers every night after the data is refreshed. It takes several minutes to initialize, but runs very fast after that. This process should be set to run in the crontab every morning AFTER the populate script is finished running.

 bin/nanpa_type_filter.pl - 
 This script is designed to do one list or a few lists at a time, or the entire database on smaller systems. It works together with a PHP script to perform lookups of cellphones and updating vicidial_list records depending on settings
@@ -335,10 +335,11 @@
 # 130705-1512 - Added optional encrypted passwords compatibility
 # 130718-0737 - Added recording_filename to dispo url
 # 130802-1039 - Changed to PHP mysqli functions
-# 
+# 130925-2108 - Fixed issue with List webform overrides
+#

-$version = '2.8-233';
-$build = '130802-1039';
+$version = '2.8-234';
+$build = '130925-2108';
 $mel=1;					# Mysql Error Log enabled = 1
 $mysql_log_count=533;
 $one_mysql_log=0;
@@ -5406,10 +5407,12 @@ if ($ACTION == 'VDADcheckINCOMING')
 					$VDCL_timer_action_destination =	$row[15];
 					}

+				$VDCL_group_web='';
+				$VDCL_group_name='';
 				### Check for List ID override settings
 				if (strlen($list_id)>0)
 					{
-					$stmt = "SELECT xferconf_a_number,xferconf_b_number,xferconf_c_number,xferconf_d_number,xferconf_e_number from vicidial_lists where list_id='$list_id';";
+					$stmt = "SELECT xferconf_a_number,xferconf_b_number,xferconf_c_number,xferconf_d_number,xferconf_e_number,web_form_address,web_form_address_two from vicidial_lists where list_id='$list_id';";
 					if ($DB) {echo "$stmt\n";}
 					$rslt=mysql_to_mysqli($stmt, $link);
 					if ($mel > 0) {mysql_error_logging($NOW_TIME,$link,$mel,$stmt,'00281',$user,$server_ip,$session_name,$one_mysql_log);}
@@ -5427,10 +5430,14 @@ if ($ACTION == 'VDADcheckINCOMING')
 							{$VDCL_xferconf_d_number =	$row[3];}
 						if (strlen($row[4]) > 0)
 							{$VDCL_xferconf_e_number =	$row[4];}
+						if (strlen($row[5]) > 5)
+							{$VDCL_group_web =			$row[5];}
+						if (strlen($row[6]) > 5)
+							{$VDCL_group_web_two =		$row[6];}
 						}
 					}

-				echo "|||||$VDCL_campaign_script|$VDCL_get_call_launch|$VDCL_xferconf_a_dtmf|$VDCL_xferconf_a_number|$VDCL_xferconf_b_dtmf|$VDCL_xferconf_b_number|$VDCL_default_xfer_group|X|X|||||$VDCL_timer_action|$VDCL_timer_action_message|$VDCL_timer_action_seconds|$VDCL_xferconf_c_number|$VDCL_xferconf_d_number|$VDCL_xferconf_e_number||||$VDCL_timer_action_destination||||||\n|\n";
+				echo "$VDCL_group_web|$VDCL_group_name||||$VDCL_campaign_script|$VDCL_get_call_launch|$VDCL_xferconf_a_dtmf|$VDCL_xferconf_a_number|$VDCL_xferconf_b_dtmf|$VDCL_xferconf_b_number|$VDCL_default_xfer_group|X|X||||$VDCL_group_web_two|$VDCL_timer_action|$VDCL_timer_action_message|$VDCL_timer_action_seconds|$VDCL_xferconf_c_number|$VDCL_xferconf_d_number|$VDCL_xferconf_e_number||||$VDCL_timer_action_destination||||||\n|\n";
 				
 				if (preg_match('/X/',$dialed_label))
 					{
@@ -410,10 +410,11 @@
 # 130802-1134 - Changed to PHP mysqli functions
 # 130822-0656 - Changed all require to require_once in agc directory for PHP backward compatibility
 # 130903-1920 - Added security check for browser window name, see launch.php for more information
+# 130925-2119 - Fixed span order issue
 #

-$version = '2.8-379c';
-$build = '130903-1920';
+$version = '2.8-380c';
+$build = '130925-2119';
 $mel=1;					# Mysql Error Log enabled = 1
 $mysql_log_count=79;
 $one_mysql_log=0;
@@ -14842,6 +14843,34 @@ if ($agent_display_dialable_leads > 0)
 <a href="#" onclick="EmailContentsLoad()"><font class="body_small">refresh</font></a>
 </span>

+<span style="position:absolute;left:5px;top:<?php echo $HTheight ?>px;z-index:<?php $zi++; echo $zi ?>;" id="HotKeyActionBox">
+    <table border="0" bgcolor="#FFDD99" width="<?php echo $HCwidth ?>px" height="70px">
+    <tr bgcolor="#FFEEBB"><td height="70px"><font class="sh_text"> Lead Dispositioned As: </font><br /><br /><center>
+    <font class="sd_text"><span id="HotKeyDispo"> - </span></font></center>
+ </td>
+    </tr></table>
+</span>
+
+<span style="position:absolute;left:5px;top:<?php echo $HTheight ?>px;z-index:<?php $zi++; echo $zi ?>;" id="HotKeyEntriesBox">
+    <table border="0" bgcolor="#FFDD99" width="<?php echo $HCwidth ?>px" height="70px">
+    <tr bgcolor="#FFEEBB"><td width="200px"><font class="sh_text"> Disposition Hot Keys: </font></td><td colspan="2">
+	<font class="body_small">When active, simply press the keyboard key for the desired disposition for this call. The call will then be hungup and dispositioned automatically:</font></td></tr><tr>
+    <td width="200px"><font class="sk_text">
+	<span id="HotKeyBoxA"><?php echo $HKboxA ?></span>
+    </font></td>
+    <td width="200px"><font class="sk_text">
+	<span id="HotKeyBoxB"><?php echo $HKboxB ?></span>
+    </font></td>
+    <td><font class="sk_text">
+	<span id="HotKeyBoxC"><?php echo $HKboxC ?></span>
+    </font></td>
+    </tr></table>
+</span>
+
+<?php if ( ($HK_statuses_camp > 0) && ($user_level>=$HKuser_level) && ($VU_hotkeys_active > 0) ) { ?>
+<span style="position:absolute;left:<?php echo $HKwidth ?>px;top:<?php echo $HKheight ?>px;z-index:<?php $zi++; echo $zi ?>;" id="hotkeysdisplay"><a href="#" onMouseOver="HotKeys('ON')"><img src="./images/vdc_XB_hotkeysactive_OFF.gif" border="0" alt="HOT KEYS INACTIVE" /></a></span>
+<?php } ?>
+

 <span style="position:absolute;left:157px;top:<?php echo $HTheight ?>px;z-index:<?php $zi++; echo $zi ?>;" id="TransferMain">
    <table bgcolor="#CCCCFF" width="<?php echo $SDwidth ?>px">
@@ -14962,34 +14991,6 @@ if ($agent_display_dialable_leads > 0)
 Available Agents Transfer: <span id="AgentXferViewSelect"></span></center></font></span>


-<span style="position:absolute;left:5px;top:<?php echo $HTheight ?>px;z-index:<?php $zi++; echo $zi ?>;" id="HotKeyActionBox">
-    <table border="0" bgcolor="#FFDD99" width="<?php echo $HCwidth ?>px" height="70px">
-    <tr bgcolor="#FFEEBB"><td height="70px"><font class="sh_text"> Lead Dispositioned As: </font><br /><br /><center>
-    <font class="sd_text"><span id="HotKeyDispo"> - </span></font></center>
- </td>
-    </tr></table>
-</span>
-
-<span style="position:absolute;left:5px;top:<?php echo $HTheight ?>px;z-index:<?php $zi++; echo $zi ?>;" id="HotKeyEntriesBox">
-    <table border="0" bgcolor="#FFDD99" width="<?php echo $HCwidth ?>px" height="70px">
-    <tr bgcolor="#FFEEBB"><td width="200px"><font class="sh_text"> Disposition Hot Keys: </font></td><td colspan="2">
-	<font class="body_small">When active, simply press the keyboard key for the desired disposition for this call. The call will then be hungup and dispositioned automatically:</font></td></tr><tr>
-    <td width="200px"><font class="sk_text">
-	<span id="HotKeyBoxA"><?php echo $HKboxA ?></span>
-    </font></td>
-    <td width="200px"><font class="sk_text">
-	<span id="HotKeyBoxB"><?php echo $HKboxB ?></span>
-    </font></td>
-    <td><font class="sk_text">
-	<span id="HotKeyBoxC"><?php echo $HKboxC ?></span>
-    </font></td>
-    </tr></table>
-</span>
-
-<?php if ( ($HK_statuses_camp > 0) && ($user_level>=$HKuser_level) && ($VU_hotkeys_active > 0) ) { ?>
-<span style="position:absolute;left:<?php echo $HKwidth ?>px;top:<?php echo $HKheight ?>px;z-index:<?php $zi++; echo $zi ?>;" id="hotkeysdisplay"><a href="#" onMouseOver="HotKeys('ON')"><img src="./images/vdc_XB_hotkeysactive_OFF.gif" border="0" alt="HOT KEYS INACTIVE" /></a></span>
-<?php } ?>
-
 <?php //AUDIT COMMENTS ADDED BY POUNDTEAM // ?>
 <span style="position:absolute;left:5px;top:350px;z-index:<?php $zi++; echo $zi ?>;" id="ViewCommentsBox">
    <TABLE border=0 bgcolor="#FFDD99" width=<?php echo $HCwidth; ?>px height='<?php echo $BROWSER_HEIGHT-380; ?>px'>
@@ -127,6 +127,11 @@ else
 	exit;
 	}

+$agent = preg_replace('/[^-_0-9a-zA-Z]/', '', $agent);
+$query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date);
+$calls_summary = preg_replace('/[^-_0-9a-zA-Z]/', '', $calls_summary);
+$file_download = preg_replace('/[^-_0-9a-zA-Z]/', '', $file_download);
+
 ##### BEGIN log visit to the vicidial_report_log table #####
 $LOGip = getenv("REMOTE_ADDR");
 $LOGbrowser = getenv("HTTP_USER_AGENT");
@@ -111,6 +111,10 @@ else
 	exit;
 	}

+$agent = preg_replace('/[^-_0-9a-zA-Z]/', '', $agent);
+$query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date);
+$calls_summary = preg_replace('/[^-_0-9a-zA-Z]/', '', $calls_summary);
+
 ##### BEGIN log visit to the vicidial_report_log table #####
 $LOGip = getenv("REMOTE_ADDR");
 $LOGbrowser = getenv("HTTP_USER_AGENT");
@@ -484,6 +484,7 @@ $group_string='|';
 $group_ct = count($groups);
 while($i < $group_ct)
 	{
+	$groups[$i] = preg_replace("/'|\"|\\\\|;/","",$groups[$i]);
 	if ( (preg_match("/ $groups[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/ALL-/",$LOGallowed_campaigns)) )
 		{
 		$group_string .= "$groups[$i]|";
@@ -500,13 +501,13 @@ $user_group_string='|';
 $user_group_ct = count($user_group_filter);
 while($i < $user_group_ct)
 	{
+	$user_group_filter[$i] = preg_replace("/'|\"|\\\\|;/","",$user_group_filter[$i]);
 #	if ( (preg_match("/ $user_group_filter[$i] /",$regexLOGallowed_campaigns)) or (preg_match("/ALL-/",$LOGallowed_campaigns)) )
 #		{
 		$user_group_string .= "$user_group_filter[$i]|";
 		$user_group_SQL .= "'$user_group_filter[$i]',";
 		$usergroupQS .= "&user_group_filter[]=$user_group_filter[$i]";
 #		}
-
 	$i++;
 	}
 $user_group_SQL = preg_replace('/,$/i', '',$user_group_SQL);
@@ -21,6 +21,10 @@ $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
 $PHP_SELF=$_SERVER['PHP_SELF'];
 if (isset($_GET["output_codes_to_display"]))			{$output_codes_to_display=$_GET["output_codes_to_display"];}
 	elseif (isset($_POST["output_codes_to_display"]))	{$output_codes_to_display=$_POST["output_codes_to_display"];}
+if (isset($_GET["show_history"]))			{$show_history=$_GET["show_history"];}
+	elseif (isset($_POST["show_history"]))	{$show_history=$_POST["show_history"];}
+if (isset($_GET["process_limit"]))			{$process_limit=$_GET["process_limit"];}
+	elseif (isset($_POST["process_limit"]))	{$process_limit=$_POST["process_limit"];}

 #############################################
 ##### START SYSTEM_SETTINGS LOOKUP #####
@@ -50,6 +54,8 @@ else
 	$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
 	}

+$process_limit = preg_replace('/[^-_0-9a-zA-Z]/', '', $process_limit);
+
 $NOW_DATE = date("Y-m-d");

 $user_auth=0;
@@ -123,23 +129,36 @@ $oc_ct=count($output_codes_to_display);
 $oc_SQL="";
 $url_str="";

-for ($i=0; $i<$oc_ct; $i++) {
+for ($i=0; $i<$oc_ct; $i++) 
+	{
 	$oc_SQL.="'$output_codes_to_display[$i]',";
 	$url_str.="output_codes_to_display[]=".$output_codes_to_display[$i];
-}
+	}
 $oc_SQL=substr($oc_SQL, 0, -1);

-$process_stmt="select * from vicidial_nanpa_filter_log where output_code in ($oc_SQL) and status!='COMPLETED'";
-$process_rslt=mysqli_query($link, $process_stmt);
+if (!$show_history) {
+	$process_stmt="select * from vicidial_nanpa_filter_log where output_code in ($oc_SQL) and status!='COMPLETED'";
+	$process_rslt=mysqli_query($link, $process_stmt);
+	$report_title="Currently running NANPA scrubs";
+} else {
+	if (!$process_limit) {$process_limit=10;}
+	$process_stmt="SELECT * from vicidial_nanpa_filter_log where user='$PHP_AUTH_USER' and status='COMPLETED' order by start_time asc limit $process_limit";
+
+	$process_rslt=mysqli_query($link, $process_stmt);
+	$report_title="Past NANPA scrubs for user $PHP_AUTH_USER";
+
+	$past_process_ct=mysqli_num_rows($process_rslt);
+	if ($process_limit<=$past_process_ct) {
+		$upper_limit=$process_limit+10;
+		$more_history_link="<BR><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=1><a name='past_scrubs' href='#past_scrubs' onClick='ShowPastProcesses($upper_limit)'>Show more processes</a></font>";
+	} else {
+		$more_history_link="";
+	}
+}

 if (mysqli_num_rows($process_rslt)>0) {
-#	echo "<html>";
-#	echo "<head>";
-#	echo "<title>NANPA running processes</title>";
-#	echo "</head>";
-#	echo "<body marginheight=0 marginwidth=0 leftmargin=0 topmargin=0>";
 	echo "<table width='770' cellpadding=5 cellspacing=0>";
-	echo "<tr><th colspan='7' bgcolor='#015B91'><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE SIZE=2>Currently running NANPA scrubs</th></tr>";
+	echo "<tr><th colspan='7' bgcolor='#015B91'><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE SIZE=2>$report_title</th></tr>";
 	echo "<tr>";
 	echo "<td align='left' bgcolor='#015B91' width='80'><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE SIZE=2>Start time</th>";
 	echo "<td align='left' bgcolor='#015B91' width='80'><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE SIZE=2>Status</th>";
@@ -164,7 +183,8 @@ if (mysqli_num_rows($process_rslt)>0) {
 		echo "</tr>";
 	}
 	echo "</table>";
-#	echo "</body>";
-#	echo "</html>";
+	echo $more_history_link;
+} else { 
+	echo $more_history_link;
 }
 ?>
@@ -269,9 +269,41 @@ function RefreshNANPA(spanURL) {
 		xmlhttp.send(nanpa_URL);
 		xmlhttp.onreadystatechange = function() {
 			if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
-				var StatSpanText = null;
-				StatSpanText = xmlhttp.responseText;
-				document.getElementById("running_processes").innerHTML = StatSpanText;
+				var ProcessSpanText = null;
+				ProcessSpanText = xmlhttp.responseText;
+				document.getElementById("running_processes").innerHTML = ProcessSpanText;
+				delete xmlhttp;
+			}
+		}
+	}
+}
+function ShowPastProcesses(limit) {
+	if (!limit){var limitURL="";} else {var limitURL="&process_limit="+limit;}
+
+	var xmlhttp=false;
+	try {
+		xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
+	} catch (e) {
+		try {
+			xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
+		} catch (E) {
+			xmlhttp = false;
+		}
+	}
+	if (!xmlhttp && typeof XMLHttpRequest!='undefined') {
+		xmlhttp = new XMLHttpRequest();
+	}
+	if (xmlhttp) {
+		var nanpa_URL = "&show_history=1"+limitURL;
+		// alert(nanpa_URL);
+		xmlhttp.open('POST', 'NANPA_running_processes.php');
+		xmlhttp.setRequestHeader('Content-Type','application/x-www-form-urlencoded; charset=UTF-8');
+		xmlhttp.send(nanpa_URL);
+		xmlhttp.onreadystatechange = function() {
+			if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
+				var ProcessSpanText = null;
+				ProcessSpanText = xmlhttp.responseText;
+				document.getElementById("past_NANPA_scrubs").innerHTML = ProcessSpanText;
 				delete xmlhttp;
 			}
 		}
@@ -435,6 +467,14 @@ else

 	echo "</td></tr>";
 	}
+echo "<tr><td>";
+echo "<table width='770' cellpadding=0 cellspacing=0 bgcolor='#FFFFFF'>";
+echo "<tr><td align='center'>";
+echo "<span id='past_NANPA_scrubs'><FONT FACE=\"ARIAL,HELVETICA\" COLOR=BLACK SIZE=1><a name='past_scrubs' href='#past_scrubs' onClick='ShowPastProcesses(10)'>View past scrubs</font></span>";
+echo "</td></tr>";
+echo "</table>";
+echo "</td></tr>";
+
 echo "</table>";
 echo "</form>";
 echo "</body>";