ViciDial/agc_2-X
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixes for security issues in several PHP scripts

Browse Source 
git-svn-id: svn://192.168.202.10@3504 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2021-08-25 13:37:52 +00:00
parent a2d9f7da6c
commit a5c6987149
18 changed files with 217 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/agc/active_list_refresh.php
+5 -4
View File
@@ -48,10 +48,11 @@
# 150723-1715 - Added ajax logging
# 190111-0903 - Fix for PHP7
# 210616-2108 - Added optional CORS support, see options.php for details
# 210825-0908 - Fix for XSS security issue
#
$version = '0.0.19';
$build = '210616-2108';
$version = '0.0.20';
$build = '210825-0908';
$php_script = 'active_list_refresh.php';
$SSagent_debug_logging=0;
$startMS = microtime();
@@ -114,8 +115,8 @@ $selectedlocal=preg_replace("/[^ \#\*\:\/\@\.\-\_0-9a-zA-Z]/","",$selectedlocal)
$textareaheight=preg_replace("/[^0-9a-zA-Z]/","",$textareaheight);
$textareawidth=preg_replace("/[^0-9a-zA-Z]/","",$textareawidth);
$field_name=preg_replace("/[^ \#\*\:\/\@\.\-\_0-9a-zA-Z]/","",$field_name);
$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name);
$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
# default optional vars if not set
if (!isset($ADD)) {$ADD="1";}
www/agc/call_log_display.php
+5 -4
View File
@@ -42,10 +42,11 @@
# 190111-0904 - Fix for PHP7
# 201117-2200 - Changes for better compatibility with non-latin data input
# 210616-2102 - Added optional CORS support, see options.php for details
# 210825-0903 - Fix for XSS security issue
#
$version = '2.14-22';
$build = '210616-2102';
$version = '2.14-23';
$build = '210825-0903';
$php_script = 'call_log_display.php';
$SSagent_debug_logging=0;
$startMS = microtime();
@@ -71,8 +72,8 @@ if (isset($_GET["protocol"])) {$protocol=$_GET["protocol"];}
$user=preg_replace("/\'|\"|\\\\|;| /","",$user);
$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name);
$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten);
$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol);
$in_limit = preg_replace('/[^0-9]/','',$in_limit);
www/agc/conf_exten_check.php
+5 -4
View File
@@ -89,10 +89,11 @@
# 210328-1013 - Fix for emails-in-queue count query, Issue #1170
# 210425-2357 - Added calls_inqueue_count_ calculation
# 210616-1905 - Added optional CORS support, see options.php for details
# 210825-0907 - Fix for XSS security issue
#
$version = '2.14-63';
$build = '210616-1905';
$version = '2.14-64';
$build = '210825-0907';
$php_script = 'conf_exten_check.php';
$mel=1; # Mysql Error Log enabled = 1
$mysql_log_count=51;
@@ -206,8 +207,8 @@ if ($non_latin < 1)
$user=preg_replace("/[^-_0-9a-zA-Z]/","",$user);
}
$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name);
$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
$conf_exten = preg_replace("/[^-_0-9a-zA-Z]/","",$conf_exten);
$exten = preg_replace("/\'|\"|\\\\|;/","",$exten);
$clicks = preg_replace("/\'|\"|\\\\|;/","",$clicks);
www/agc/inbound_popup.php
+5 -4
View File
@@ -39,10 +39,11 @@
# 170526-2231 - Added additional variable filtering
# 190111-0905 - Fix for PHP7
# 210616-2106 - Added optional CORS support, see options.php for details
# 210825-0906 - Fix for XSS security issue
#
$version = '2.14-15';
$build = '210616-2106';
$version = '2.14-16';
$build = '210825-0906';
$php_script = 'inbound_popup.php';
require_once("dbconnect_mysqli.php");
@@ -79,8 +80,8 @@ if (isset($_GET["local_web_callerID_URL_enc"])) {$local_web_callerID_URL = raw
# variable filtering
$user=preg_replace("/\'|\"|\\\\|;| /","",$user);
$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name);
$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid);
$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten);
$vmail_box = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$vmail_box);
www/agc/launch.php
+7 -6
View File
@@ -1,7 +1,7 @@
<?php
# launch.php - launches vicidial.php in restricted window
#
# Copyright (C) 2014 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2021 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# For launch validation to work, the options.php file must have
# window_validation = 1 and win_valid_name set to window_name below
@@ -10,6 +10,7 @@
# 130903-2055 - First Build
# 140811-0800 - Changed to use QXZ function for echoing text
# 141216-2134 - Added language settings lookups and user/pass variable standardization
# 210825-0909 - Fix for XSS security issue
#
$window_name = 'subwindow_launch';
@@ -62,11 +63,11 @@ if (!isset($flag_channels))
### security strip all non-alphanumeric characters out of the variables ###
$DB=preg_replace("/[^0-9a-z]/","",$DB);
$phone_login=preg_replace("/[^\,0-9a-zA-Z]/","",$phone_login);
$phone_pass=preg_replace("/[^-_0-9a-zA-Z]/","",$phone_pass);
$VD_login=preg_replace("/\'|\"|\\\\|;| /","",$VD_login);
$VD_pass=preg_replace("/\'|\"|\\\\|;| /","",$VD_pass);
$VD_campaign = preg_replace("/[^-_0-9a-zA-Z]/","",$VD_campaign);
$phone_login=preg_replace('/[^-_0-9\p{L}]/u',"",$phone_login);
$phone_pass=preg_replace('/[^-_0-9\p{L}]/u',"",$phone_pass);
$VD_login=preg_replace('/[^-_0-9\p{L}]/u',"",$VD_login);
$VD_pass=preg_replace('/[^-_0-9\p{L}]/u',"",$VD_pass);
$VD_campaign = preg_replace('/[^-_0-9\p{L}]/u',"",$VD_campaign);
$login_string='';
www/agc/live_exten_check.php
+5 -4
View File
@@ -42,10 +42,11 @@
# 170526-2234 - Added additional variable filtering
# 190111-0906 - Fix for PHP7
# 210616-2105 - Added optional CORS support, see options.php for details
# 210825-0905 - Fix for XSS security issue
#
$version = '2.14-18';
$build = '190111-0906';
$version = '2.14-19';
$build = '210825-0905';
$php_script = 'live_exten_check.php';
$SSagent_debug_logging=0;
$startMS = microtime();
@@ -76,8 +77,8 @@ if (isset($_GET["favorites_list"])) {$favorites_list=$_GET["favorites_list"];
# variable filtering
$user=preg_replace("/\'|\"|\\\\|;| /","",$user);
$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name);
$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten);
$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol);
$favorites_list = preg_replace("/\'|\"|\\\\|;| /","",$favorites_list);
www/agc/manager_send.php
+5 -4
View File
@@ -148,10 +148,11 @@
# 210615-1016 - Default security fixes, CVE-2021-28854
# 210616-2051 - Added optional CORS support, see options.php for details
# 210823-0916 - Fix for security issue
# 210825-0911 - Fix for XSS security issue
#
$version = '2.14-95';
$build = '210823-0916';
$version = '2.14-96';
$build = '210825-0911';
$php_script = 'manager_send.php';
$mel=1; # Mysql Error Log enabled = 1
$mysql_log_count=143;
@@ -295,8 +296,8 @@ header ("Pragma: no-cache"); // HTTP/1.0
# filter variables
$user=preg_replace("/\'|\"|\\\\|;| /","",$user);
$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name);
$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
$lead_id = preg_replace('/[^0-9]/','',$lead_id);
$session_id = preg_replace('/[^0-9]/','',$session_id);
$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten);
www/agc/park_calls_display.php
+5 -4
View File
@@ -33,10 +33,11 @@
# 170526-2244 - Added additional variable filtering
# 190111-0907 - Fix for PHP7
# 210616-2104 - Added optional CORS support, see options.php for details
# 210825-0904 - Fix for XSS security issue
#
$version = '2.14-15';
$build = '210616-2104';
$version = '2.14-16';
$build = '210825-0904';
$php_script = 'park_calls_display.php';
$SSagent_debug_logging=0;
$startMS = microtime();
@@ -63,8 +64,8 @@ if (isset($_GET["protocol"])) {$protocol=$_GET["protocol"];}
# variable filtering
$user=preg_replace("/\'|\"|\\\\|;| /","",$user);
$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name);
$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
$exten = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$exten);
$protocol = preg_replace("/\||`|&|\'|\"|\\\\|;| /","",$protocol);
www/agc/vdc_db_query.php
+5 -4
View File
@@ -517,10 +517,11 @@
# 210719-1120 - Added new state override options for 24-Hour Call Count Limits
# 210729-2136 - Added cid_group_id_two campaign setting
# 210822-2111 - Fix for manual dial lead search with phone_code, Issue #1322
# 210825-0912 - Fix for XSS security issue
#
$version = '2.14-410';
$build = '210822-2111';
$version = '2.14-411';
$build = '210825-0912';
$php_script = 'vdc_db_query.php';
$mel=1; # Mysql Error Log enabled = 1
$mysql_log_count=865;
@@ -1058,8 +1059,8 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name);
$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
$alt_phone = preg_replace("/\s/","",$alt_phone);
$phone_code = preg_replace("/\s/","",$phone_code);
$phone_number = preg_replace("/\s/","",$phone_number);
www/agc/vdc_form_display.php
+4 -3
View File
@@ -53,10 +53,11 @@
# 210404-1522 - Added only_field option for refresh of already-loaded custom form SOURCESELECT element
# 210506-1825 - Fix for SELECTSOURCE reloading issue
# 210616-2037 - Added optional CORS support, see options.php for details
# 210825-0902 - Fix for XSS security issue
#
$version = '2.14-43';
$build = '210616-2037';
$version = '2.14-44';
$build = '210825-0902';
$php_script = 'vdc_form_display.php';
require_once("dbconnect_mysqli.php");
@@ -323,7 +324,7 @@ $lead_id = preg_replace('/[^0-9]/', '', $lead_id);
$list_id = preg_replace('/[^0-9]/', '', $list_id);
$new_list_id = preg_replace('/[^0-9]/', '', $new_list_id);
$agent_log_id = preg_replace('/[^0-9]/', '', $agent_log_id);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
$session_id = preg_replace('/[^0-9]/','',$session_id);
$call_id = preg_replace('/[^-_\.0-9a-zA-Z]/','',$call_id);
$button_action = preg_replace('/[^-_0-9a-zA-Z]/','',$button_action);
www/agc/vdc_script_display.php
+4 -3
View File
@@ -43,10 +43,11 @@
# 191031-1158 - Added Script2 feature
# 201117-2107 - Changes for better compatibility with non-latin data input
# 210616-2100 - Added optional CORS support, see options.php for details
# 210825-0858 - Fix for security issue
#
$version = '2.14-37';
$build = '210616-2100';
$version = '2.14-38';
$build = '210825-0858';
$php_script = 'vdc_script_display.php';
require_once("dbconnect_mysqli.php");
@@ -338,7 +339,7 @@ $orig_pass = preg_replace("/\'|\"|\\\\|;| /","",$orig_pass);
$lead_id = preg_replace('/[^0-9]/', '', $lead_id);
$list_id = preg_replace('/[^0-9]/', '', $list_id);
$email_row_id = preg_replace('/[^0-9]/', '', $email_row_id);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
$session_id = preg_replace('/[^0-9]/','',$session_id);
$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid);
$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
www/agc/vdc_script_dispo_example.php
+5 -3
View File
@@ -23,10 +23,11 @@
# 170528-0902 - Added more variable filtering
# 190111-0910 - Fix for PHP7
# 210616-2035 - Added optional CORS support, see options.php for details
# 210825-0838 - Fix for security issue
#
$version = '2.14-11';
$build = '210616-2035';
$version = '2.14-12';
$build = '210825-0838';
$php_script = 'vdc_script_dispo_example.php';
require_once("dbconnect_mysqli.php");
@@ -265,7 +266,7 @@ $pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
$lead_id = preg_replace('/[^0-9]/', '', $lead_id);
$list_id = preg_replace('/[^0-9]/', '', $list_id);
$notesid = preg_replace('/[^0-9]/', '', $notesid);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
$session_id = preg_replace('/[^0-9]/','',$session_id);
$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid);
$campaign = preg_replace('/[^-_0-9a-zA-Z]/','',$campaign);
@@ -313,6 +314,7 @@ if ($qm_conf_ct > 0)
if ($non_latin < 1)
{
$user=preg_replace("/[^-_0-9a-zA-Z]/","",$user);
$pass=preg_replace("/[^-_0-9a-zA-Z]/","",$pass);
$length_in_sec = preg_replace("/[^0-9]/","",$length_in_sec);
$phone_code = preg_replace("/[^0-9]/","",$phone_code);
$phone_number = preg_replace("/[^0-9]/","",$phone_number);
www/agc/vdc_script_notes.php
+4 -3
View File
@@ -21,10 +21,11 @@
# 170528-0901 - Added more variable filtering
# 201117-2213 - Changes for better compatibility with non-latin data input
# 210616-2034 - Added optional CORS support, see options.php for details
# 210825-0901 - Fix for XSS security issue
#
$version = '2.14-11';
$build = '210616-2034';
$version = '2.14-12';
$build = '210825-0901';
$php_script = 'vdc_script_notes.php';
require_once("dbconnect_mysqli.php");
@@ -270,7 +271,7 @@ if ($qm_conf_ct > 0)
$lead_id = preg_replace('/[^0-9]/', '', $lead_id);
$list_id = preg_replace('/[^0-9]/', '', $list_id);
$notesid = preg_replace('/[^0-9]/', '', $notesid);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
$session_id = preg_replace('/[^0-9]/','',$session_id);
$uniqueid = preg_replace('/[^-_\.0-9a-zA-Z]/','',$uniqueid);
$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
www/agc/voicemail_check.php
+6 -5
View File
@@ -32,10 +32,11 @@
# 150723-1711 - Added ajax logging
# 170526-2351 - Added additional variable filtering
# 210616-2109 - Added optional CORS support, see options.php for details
# 210825-0910 - Fix for XSS security issue
#
$version = '2.14-15';
$build = '210616-2109';
$version = '2.14-16';
$build = '210825-0910';
$php_script = 'voicemail_check.php';
$SSagent_debug_logging=0;
$startMS = microtime();
@@ -59,9 +60,9 @@ if (isset($_GET["vmail_box"])) {$vmail_box=$_GET["vmail_box"];}
$user=preg_replace("/\'|\"|\\\\|;| /","",$user);
$pass=preg_replace("/\'|\"|\\\\|;| /","",$pass);
$session_name = preg_replace("/\'|\"|\\\\|;/","",$session_name);
$server_ip = preg_replace("/\'|\"|\\\\|;/","",$server_ip);
$vmail_box = preg_replace("/\'|\"|\\\\|;/","",$vmail_box);
$session_name = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$session_name);
$server_ip = preg_replace('/[^-\.\:\_0-9a-zA-Z]/','',$server_ip);
$vmail_box = preg_replace('/[^-_0-9\p{L}]/u',"",$vmail_box);
# default optional vars if not set
if (!isset($format)) {$format="text";}
www/vicidial/qc_modify_lead.php
+140 -2
View File
@@ -155,8 +155,6 @@ if (isset($_POST["finish_qc"])) {$finish_qc=$_POST["finish_qc"];}
elseif (isset($_GET["finish_qc"])) {$finish_qc=$_GET["finish_qc"];}
if (isset($_POST["qc_display_method"])) {$qc_display_method=$_POST["qc_display_method"];}
elseif (isset($_GET["qc_display_method"])) {$qc_display_method=$_GET["qc_display_method"];}
if (isset($_POST["qc_display_method"])) {$qc_display_method=$_POST["qc_display_method"];}
elseif (isset($_GET["qc_display_method"])) {$qc_display_method=$_GET["qc_display_method"];}
if (isset($_POST["qc_display_group_type"])) {$qc_display_group_type=$_POST["qc_display_group_type"];}
elseif (isset($_GET["qc_display_group_type"])) {$qc_display_group_type=$_GET["qc_display_group_type"];}
if (isset($_POST["qc_status"])) {$qc_status=$_POST["qc_status"];}
@@ -168,6 +166,146 @@ if (isset($_POST["referring_section"])) {$referring_section=$_POST["referring_
if (isset($_POST["referring_element"])) {$referring_element=$_POST["referring_element"];}
elseif (isset($_GET["referring_element"])) {$referring_element=$_GET["referring_element"];}
$CBchangeANYtoUSER=preg_replace('/[^A-Z]/','',$CBchangeANYtoUSER);
$CBchangeDATE=preg_replace('/[^A-Z]/','',$CBchangeDATE);
$CBchangeUSERtoANY=preg_replace('/[^A-Z]/','',$CBchangeUSERtoANY);
$CBchangeUSERtoUSER=preg_replace('/[^A-Z]/','',$CBchangeUSERtoUSER);
$claim_QC=preg_replace('/[^A-Z]/','',$claim_QC);
$referring_section=preg_replace('/[^A-Z]/','',$referring_section);
$DB=preg_replace('/[^0-9]/','',$DB);
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/','',$PHP_AUTH_PW);
$user = preg_replace('/[^-\_0-9a-zA-Z]/','',$user);
$tsr = preg_replace('/[^-\_0-9a-zA-Z]/','',$tsr);
$CBuser = preg_replace('/[^-\_0-9a-zA-Z]/','',$CBuser);
$qc_agent = preg_replace('/[^-\_0-9a-zA-Z]/','',$qc_agent);
$title = preg_replace('/[^- \'\_\.0-9a-zA-Z]/','',$title);
$first_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$first_name);
$middle_initial = preg_replace('/[^0-9a-zA-Z]/','',$middle_initial);
$last_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$last_name);
$lead_name = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$lead_name);
$address1 = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$address1);
$address2 = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$address2);
$address3 = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$address3);
$city = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$city);
$state = preg_replace('/[^- 0-9a-zA-Z]/','',$state);
$province = preg_replace('/[^- \'\+\.\_0-9a-zA-Z]/','',$province);
$postal_code = preg_replace('/[^- \'\+0-9a-zA-Z]/','',$postal_code);
$alt_phone = preg_replace('/[^- \'\+\_\.0-9a-zA-Z]/','',$alt_phone);
$email = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9a-zA-Z]/','',$email);
$security = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$security);
$campaign_id = preg_replace('/[^-\_0-9a-zA-Z]/', '',$campaign_id);
$owner = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$owner);
$country_code = preg_replace('/[^A-Z]/','',$country_code);
$gender = preg_replace('/[^A-Z]/','',$gender);
$qc_display_group_type = preg_replace('/[^A-Z]/','',$qc_display_group_type);
$qc_display_method = preg_replace('/[^A-Z]/','',$qc_display_method);
$qc_process_status = preg_replace('/[^A-Z]/','',$qc_process_status);
$channel = preg_replace('/[^- \'\+\.\:\/\@\_0-9a-zA-Z]/','',$channel);
$dispo = preg_replace('/[^-\_0-9a-zA-Z]/', '',$dispo);
$status = preg_replace('/[^-\_0-9a-zA-Z]/', '',$status);
$qc_status = preg_replace('/[^-\_0-9a-zA-Z]/', '',$qc_status);
$referring_element = preg_replace('/[^-\_0-9a-zA-Z]/', '',$referring_element);
$submit = preg_replace('/[^- 0-9a-zA-Z]/','',$submit);
$SUBMIT = preg_replace('/[^- 0-9a-zA-Z]/','',$SUBMIT);
}
else
{
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$user=preg_replace('/[^-_0-9\p{L}]/u','',$user);
$tsr=preg_replace('/[^-_0-9\p{L}]/u','',$tsr);
$CBuser=preg_replace('/[^-_0-9\p{L}]/u','',$CBuser);
$qc_agent=preg_replace('/[^-_0-9\p{L}]/u','',$qc_agent);
$title = preg_replace('/[^- \'\_\.0-9\p{L}]/u','',$title);
$first_name = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$first_name);
$middle_initial = preg_replace('/[^0-9\p{L}]/u','',$middle_initial);
$last_name = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$last_name);
$lead_name = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$lead_name);
$address1 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address1);
$address2 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address2);
$address3 = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$address3);
$city = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$city);
$state = preg_replace('/[^- 0-9\p{L}]/u','',$state);
$province = preg_replace('/[^- \'\+\.\_0-9\p{L}]/u','',$province);
$postal_code = preg_replace('/[^- \'\+0-9\p{L}]/u','',$postal_code);
$alt_phone = preg_replace('/[^- \'\+\_\.0-9\p{L}]/u','',$alt_phone);
$email = preg_replace('/[^- \'\+\.\:\/\@\%\_0-9\p{L}]/u','',$email);
$security = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$security);
$campaign_id = preg_replace('/[^-\_0-9\p{L}]/u', '',$campaign_id);
$owner = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$owner);
$country_code = preg_replace('/[^\p{L}]/u','',$country_code);
$gender = preg_replace('/[^\p{L}]/u','',$gender);
$qc_display_group_type = preg_replace('/[^\p{L}]/u','',$qc_display_group_type);
$qc_display_method = preg_replace('/[^\p{L}]/u','',$qc_display_method);
$qc_process_status = preg_replace('/[^\p{L}]/u','',$qc_process_status);
$channel = preg_replace('/[^- \'\+\.\:\/\@\_0-9\p{L}]/u','',$channel);
$dispo = preg_replace('/[^-_0-9\p{L}]/u','',$dispo);
$status = preg_replace('/[^-_0-9\p{L}]/u','',$status);
$qc_status = preg_replace('/[^-_0-9\p{L}]/u','',$qc_status);
$referring_element = preg_replace('/[^-\_0-9\p{L}]/u', '',$referring_element);
$submit = preg_replace('/[^- 0-9\p{L}]/u','',$submit);
$SUBMIT = preg_replace('/[^- 0-9\p{L}]/u','',$SUBMIT);
}
$first_name = preg_replace('/\+/',' ',$first_name);
$last_name = preg_replace('/\+/',' ',$last_name);
$address1 = preg_replace('/\+/',' ',$address1);
$address2 = preg_replace('/\+/',' ',$address2);
$address3 = preg_replace('/\+/',' ',$address3);
$city = preg_replace('/\+/',' ',$city);
$province = preg_replace('/\+/',' ',$province);
$postal_code = preg_replace('/\+/',' ',$postal_code);
$alt_phone = preg_replace('/\+/',' ',$alt_phone);
$email = preg_replace('/\+/',' ',$email);
$security_phrase = preg_replace('/\+/',' ',$security_phrase);
$owner = preg_replace('/\+/',' ',$owner);
$list_id = preg_replace('/[^0-9]/','',$list_id);
$lead_id = preg_replace('/[^0-9a-zA-Z]/','',$lead_id);
$entry_list_id = preg_replace('/[^0-9]/','',$entry_list_id);
$phone_code = preg_replace('/[^0-9]/','',$phone_code);
$update_phone_number=preg_replace('/[^A-Z]/','',$update_phone_number);
$phone_number = preg_replace('/[^0-9]/','',$phone_number);
$old_phone = preg_replace('/[^0-9]/','',$old_phone);
$phone = preg_replace('/[^0-9]/','',$phone);
$vendor_lead_code = preg_replace('/;|#/','',$vendor_lead_code);
$vendor_lead_code = preg_replace('/\+/',' ',$vendor_lead_code);
$vendor_id = preg_replace('/;|#/','',$vendor_id);
$vendor_id = preg_replace('/\+/',' ',$vendor_id);
$source_id = preg_replace('/;|#/','',$source_id);
$source_id = preg_replace('/\+/',' ',$source_id);
$gmt_offset_now = preg_replace('/[^-\_\.0-9]/','',$gmt_offset_now);
$comments = preg_replace('/;|#/','',$comments);
$comments = preg_replace('/\+/',' ',$comments);
$rank = preg_replace('/[^0-9]/','',$rank);
$no_update = preg_replace('/[^A-Z]/','',$no_update);
$called_count=preg_replace('/[^0-9]/','',$called_count);
$local_gmt=preg_replace('/[^-\.0-9]/','',$local_gmt);
$callback = preg_replace('/[^A-Z]/','',$callback);
$callback_type = preg_replace('/[^A-Z]/','',$callback_type);
$add_closer_record = preg_replace('/[^0-9]/','',$add_closer_record);
$agent_log_id = preg_replace('/[^0-9]/','',$agent_log_id);
$appointment_date = preg_replace('/[^-0-9]/','',$appointment_date);
$appointment_time = preg_replace('/[^0-9\:]/','',$appointment_time);
$parked_time = preg_replace('/[^0-9\:\-]/','',$parked_time);
$callback_id = preg_replace('/[^0-9]/','',$callback_id);
$server_ip=preg_replace("/[^0-9\.]/", "", $server_ip);
$end_call=preg_replace('/[^0-9]/','',$end_call);
$finish_qc=preg_replace('/[^0-9]/','',$finish_qc);
$group_id=preg_replace('/[^-_0-9\p{L}]/u','',$group_id);
$extension=preg_replace('/[^0-9]/','',$extension);
$qc_log_id = preg_replace('/[^0-9\:\-]/','',$qc_log_id);
$modify_agent_logs = preg_replace('/[^0-9]/','',$modify_agent_logs);
$modify_closer_logs = preg_replace('/[^0-9]/','',$modify_closer_logs);
$modify_logs = preg_replace('/[^0-9]/','',$modify_logs);
$STARTtime = date("U");
$defaultappointment = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
www/vicidial/qc_scorecards.php
+4
View File
@@ -84,10 +84,14 @@ if (isset($_GET["confirm_deletion"])) {$confirm_deletion=$_GET["confirm_deletion
if (isset($_GET["scorecard_id"])) {$scorecard_id=$_GET["scorecard_id"];}
elseif (isset($_POST["scorecard_id"])) {$scorecard_id=$_POST["scorecard_id"];}
$submit=preg_replace('/[^-0-9\p{L}]/u','',$submit);
$new_scorecard_id = preg_replace('/[^-_0-9a-zA-Z]/','',$new_scorecard_id);
$new_scorecard_name = preg_replace('/[^- \.\,\_0-9a-zA-Z]/','',$new_scorecard_name);
$new_active = preg_replace('/[^NY]/','',$new_active);
$active = preg_replace('/[^NY]/','',$active);
$action = preg_replace('/[^-_0-9a-zA-Z]/','',$action);
$confirm_deletion = preg_replace('/[^Y]/','',$confirm_deletion);
$scorecard_id = preg_replace('/[^-_0-9a-zA-Z]/','',$scorecard_id);
$SSmenu_background='015B91';
www/vicidial/realtime_report_mobile.php
+2 -1
View File
@@ -290,7 +290,8 @@ $PRESETstats = preg_replace('/[^-_0-9a-zA-Z]/', '', $PRESETstats);
$AGENTtimeSTATS = preg_replace('/[^-_0-9a-zA-Z]/', '', $AGENTtimeSTATS);
$INGROUPcolorOVERRIDE = preg_replace('/[^-_0-9a-zA-Z]/', '', $INGROUPcolorOVERRIDE);
$droppedOFtotal = preg_replace('/[^-_0-9a-zA-Z]/', '', $droppedOFtotal);
$server_ip=preg_replace("/[^0-9\.]/", "", $server_ip);
$user_group_filter=preg_replace('/[^-_0-9\p{L}]/u','',$user_group_filter);
$TOTALdisplay+=$ALLINGROUPstats;
$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
www/vicidial/vicidial_whiteboard_functions.php
+1
View File
@@ -5,6 +5,7 @@ require("functions.php");
if (isset($_GET["mobile"])) {$mobile=$_GET["mobile"];}
elseif (isset($_POST["mobile"])) {$mobile=$_POST["mobile"];}
$mobile=preg_replace('/[^0-9\p{L}]/u','',$mobile);
?>
// vicidial_whiteboard_functions.php
//