ViciDial/agc_2-X
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added filtering to AGI processes to help prevent DID SQL injection attacks

Browse Source 
Added nanpa filtering log viewing to new NANPA updating process
Fixed span order in vicidial.php
Fixed issue with list webform overrides in agent interface
other small variable filtering fixes

git-svn-id: svn://192.168.202.10@2023 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2013-09-26 01:27:15 +00:00
parent 5bab063a9c
commit 61b5e03d01
16 changed files with 170 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agi/agent_monitor.agi
+6
View File
@@ -29,6 +29,7 @@
#
# CHANGELOG
# 130716-1315 - First build based upon agi-phone_monitor.agi
# 130925-1823 - Added variable filter to prevent DID SQL injection attack
#
&get_time_now;
@@ -163,6 +164,10 @@ while(<STDIN>)
if (/^agi_calleridname\:\s+(.*)$/) {$calleridname = $1;}
}
$callerid =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
$calleridname =~ s/\'|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
$extension =~ s/\'|\"|\\\\|\\\|\\|\\;|\\\;|\;|;//gi;
if ( ($callerid =~ /\".*\"/) && ( (!$calleridname) or ($calleridname =~ /unknown/) ) )
{
$calleridname = $callerid;
@@ -174,6 +179,7 @@ $callerid =~ s/\D//gi;
$calleridname =~ s/unknown//gi;
if ( (!$callerid) or ($callerid =~ /unknown/) )
{$callerid = $calleridname;}
$phone_number=$callerid;
### Grab Server values from the database