ViciDial/agc_2-X
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added allow_web_debug system setting, and more input variable filtering

Browse Source 
git-svn-id: svn://192.168.202.10@3578 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2022-03-03 08:17:13 +00:00
parent bc2224f5b6
commit 8b7abfb273
17 changed files with 712 additions and 463 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/vicidial/AST_server_performance.php
+21 -17
View File
@@ -1,7 +1,7 @@
<?php
# AST_server_performance.php
#
# Copyright (C) 2019 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2022 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# CHANGES
#
@@ -29,6 +29,7 @@
# 170422-0750 - Added input variable filtering
# 180223-1541 - Fixed blank default date/time ranges
# 191013-0842 - Fixes for PHP7
# 220302-0841 - Added allow_web_debug system setting
#
$startMS = microtime();
@@ -55,14 +56,21 @@ if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
$DB=preg_replace("/[^0-9a-zA-Z]/","",$DB);
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
if (strlen($begin_query_time) < 10) {$begin_query_time = "$NOW_DATE 09:00:00";}
if (strlen($end_query_time) < 10) {$end_query_time = "$NOW_DATE 15:30:00";}
if (!isset($group)) {$group = '';}
$report_name = 'Server Performance Report';
$db_source = 'M';
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;";
$stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,enable_languages,language_method,allow_web_debug FROM system_settings;";
$rslt=mysql_to_mysqli($stmt, $link);
if ($DB) {echo "$stmt\n";}
#if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysqli_num_rows($rslt);
if ($qm_conf_ct > 0)
{
@@ -73,10 +81,18 @@ if ($qm_conf_ct > 0)
$reports_use_slave_db = $row[3];
$SSenable_languages = $row[4];
$SSlanguage_method = $row[5];
$SSallow_web_debug = $row[6];
}
if ($SSallow_web_debug < 1) {$DB=0;}
##### END SETTINGS LOOKUP #####
###########################################
$begin_query_time = preg_replace('/[^- \:_0-9a-zA-Z]/', '', $begin_query_time);
$end_query_time = preg_replace('/[^- \:_0-9a-zA-Z]/', '', $end_query_time);
$group = preg_replace('/[^- \.\:\_0-9a-zA-Z]/', '', $group);
$submit = preg_replace('/[^-_0-9a-zA-Z]/', '', $submit);
$SUBMIT = preg_replace('/[^-_0-9a-zA-Z]/', '', $SUBMIT);
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
@@ -84,14 +100,10 @@ if ($non_latin < 1)
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
$PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW);
}
$begin_query_time = preg_replace('/[^- \:_0-9a-zA-Z]/', '', $begin_query_time);
$end_query_time = preg_replace('/[^- \:_0-9a-zA-Z]/', '', $end_query_time);
$group = preg_replace('/[^\._0-9a-zA-Z]/', '', $group);
$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);
@@ -243,14 +255,6 @@ if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL
$PLOTroot = "vicidial/ploticus";
$DOCroot = "$WeBServeRRooT/$PLOTroot/";
$NOW_DATE = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$STARTtime = date("U");
if (strlen($begin_query_time) < 10) {$begin_query_time = "$NOW_DATE 09:00:00";}
if (strlen($end_query_time) < 10) {$end_query_time = "$NOW_DATE 15:30:00";}
if (!isset($group)) {$group = '';}
$stmt="select server_ip from servers order by server_ip;";
$rslt=mysql_to_mysqli($stmt, $link);
if ($DB) {echo "$stmt\n";}