ViciDial/agc_2-X
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security fixes in PHP scripts for non-latin setting systems

Browse Source 
git-svn-id: svn://192.168.202.10@1123 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2009-05-22 09:14:08 +00:00
parent 845fc52237
commit d4aef7ba9e
8 changed files with 587 additions and 528 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/agc/api.php
+29 -21
View File
@@ -32,10 +32,11 @@
# 90303-0723 - Added group alias and dial prefix
# 90407-1920 - Added vtiger_callback option for external_dial function
# 90508-0727 - Changed to PHP long tags
# 90522-0506 - Security fix
#
$version = '2.2.0-7';
$build = '90508-0727';
$version = '2.2.0-8';
$build = '90522-0506';
require("dbconnect.php");
@@ -94,25 +95,32 @@ while ($i < $qm_conf_ct)
###########################################
if ($non_latin < 1)
{
$user=ereg_replace("[^0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
$agent_user=ereg_replace("[^0-9a-zA-Z]","",$agent_user);
$function = ereg_replace("[^-\_0-9a-zA-Z]","",$function);
$value = ereg_replace("[^-\_0-9a-zA-Z]","",$value);
$vendor_id = ereg_replace("[^-\_0-9a-zA-Z]","",$vendor_id);
$focus = ereg_replace("[^-\_0-9a-zA-Z]","",$focus);
$preview = ereg_replace("[^-\_0-9a-zA-Z]","",$preview);
$notes = ereg_replace("\+"," ",$notes);
$notes = ereg_replace("[^ -\_0-9a-zA-Z]","",$notes);
$phone_code = ereg_replace("[^0-9X]","",$phone_code);
$search = ereg_replace("[^-\_0-9a-zA-Z]","",$search);
$group_alias = ereg_replace("[^0-9a-zA-Z]","",$group_alias);
$dial_prefix = ereg_replace("[^0-9a-zA-Z]","",$dial_prefix);
$source = ereg_replace("[^0-9a-zA-Z]","",$source);
$format = ereg_replace("[^0-9a-zA-Z]","",$format);
$vtiger_callback = ereg_replace("[^A-Z]","",$vtiger_callback);
}
{
$user=ereg_replace("[^0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
$agent_user=ereg_replace("[^0-9a-zA-Z]","",$agent_user);
$function = ereg_replace("[^-\_0-9a-zA-Z]","",$function);
$value = ereg_replace("[^-\_0-9a-zA-Z]","",$value);
$vendor_id = ereg_replace("[^-\_0-9a-zA-Z]","",$vendor_id);
$focus = ereg_replace("[^-\_0-9a-zA-Z]","",$focus);
$preview = ereg_replace("[^-\_0-9a-zA-Z]","",$preview);
$notes = ereg_replace("\+"," ",$notes);
$notes = ereg_replace("[^ -\_0-9a-zA-Z]","",$notes);
$phone_code = ereg_replace("[^0-9X]","",$phone_code);
$search = ereg_replace("[^-\_0-9a-zA-Z]","",$search);
$group_alias = ereg_replace("[^0-9a-zA-Z]","",$group_alias);
$dial_prefix = ereg_replace("[^0-9a-zA-Z]","",$dial_prefix);
$source = ereg_replace("[^0-9a-zA-Z]","",$source);
$format = ereg_replace("[^0-9a-zA-Z]","",$format);
$vtiger_callback = ereg_replace("[^A-Z]","",$vtiger_callback);
}
else
{
$user = ereg_replace("'|\"|\\\\|;","",$user);
$pass = ereg_replace("'|\"|\\\\|;","",$pass);
$source = ereg_replace("'|\"|\\\\|;","",$source);
$agent_user = ereg_replace("'|\"|\\\\|;","",$agent_user);
}
### date and fixed variables
$epoch = date("U");
www/agc/manager_send.php
+8 -2
View File
@@ -201,10 +201,16 @@ while ($i < $qm_conf_ct)
if ($non_latin < 1)
{
$user=ereg_replace("[^0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
$user=ereg_replace("[^-_0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^-_0-9a-zA-Z]","",$pass);
$secondS = ereg_replace("[^0-9]","",$secondS);
}
else
{
$user = ereg_replace("'|\"|\\\\|;","",$user);
$pass = ereg_replace("'|\"|\\\\|;","",$pass);
}
# default optional vars if not set
if (!isset($ACTION)) {$ACTION="Originate";}
www/agc/vdc_db_query.php
+13 -7
View File
@@ -408,13 +408,19 @@ while ($i < $qm_conf_ct)
###########################################
if ($non_latin < 1)
{
$user=ereg_replace("[^0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^0-9a-zA-Z]","",$pass);
$length_in_sec = ereg_replace("[^0-9]","",$length_in_sec);
$phone_code = ereg_replace("[^0-9]","",$phone_code);
$phone_number = ereg_replace("[^0-9]","",$phone_number);
}
{
$user=ereg_replace("[^-_0-9a-zA-Z]","",$user);
$pass=ereg_replace("[^-_0-9a-zA-Z]","",$pass);
$length_in_sec = ereg_replace("[^0-9]","",$length_in_sec);
$phone_code = ereg_replace("[^0-9]","",$phone_code);
$phone_number = ereg_replace("[^0-9]","",$phone_number);
}
else
{
$user = ereg_replace("'|\"|\\\\|;","",$user);
$pass = ereg_replace("'|\"|\\\\|;","",$pass);
}
# default optional vars if not set
if (!isset($format)) {$format="text";}
www/agc/vicidial.php
+3 -3
View File
@@ -280,9 +280,9 @@ if (isset($_GET["MGR_override"])) {$MGR_override=$_GET["MGR_override"];}
$DB=ereg_replace("[^0-9a-z]","",$DB);
$phone_login=ereg_replace("[^\,0-9a-zA-Z]","",$phone_login);
$phone_pass=ereg_replace("[^0-9a-zA-Z]","",$phone_pass);
$VD_login=ereg_replace("[^0-9a-zA-Z]","",$VD_login);
$VD_pass=ereg_replace("[^0-9a-zA-Z]","",$VD_pass);
$VD_campaign = ereg_replace("[^-\_0-9a-zA-Z]","",$VD_campaign);
$VD_login=ereg_replace("[^-_0-9a-zA-Z]","",$VD_login);
$VD_pass=ereg_replace("[^-_0-9a-zA-Z]","",$VD_pass);
$VD_campaign = ereg_replace("[^-_0-9a-zA-Z]","",$VD_campaign);
$forever_stop=0;
www/vicidial/admin.php
+491 -486
View File
File diff suppressed because it is too large Load Diff
www/vicidial/new_listloader_superL.php
+13 -7
View File
@@ -26,11 +26,12 @@
# 90309-1831 - Added admin_log logging
# 90310-2128 - Added admin header
# 90508-0644 - Changed to PHP long tags
# 90522-0506 - Security fix
#
# make sure vicidial_list exists and that your file follows the formatting correctly. This page does not dedupe or do any other lead filtering actions yet at this time.
$version = '2.0.5-30';
$build = '90508-0644';
$version = '2.2.0-31';
$build = '90522-0506';
require("dbconnect.php");
@@ -138,11 +139,16 @@ while ($i < $qm_conf_ct)
###########################################
if ($non_latin < 1)
{
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$list_id_override = ereg_replace("[^0-9]","",$list_id_override);
}
{
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$list_id_override = ereg_replace("[^0-9]","",$list_id_override);
}
else
{
$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
}
$STARTtime = date("U");
$TODAY = date("Y-m-d");
www/vicidial/non_agent_api.php
+9 -2
View File
@@ -22,10 +22,11 @@
# 90428-0209 - Added blind_monitor function
# 90508-0642 - Changed to PHP long tags
# 90514-0602 - Added sounds_list function
# 90522-0506 - Security fix
#
$version = '2.2.0-8';
$build = '90514-0602';
$version = '2.2.0-9';
$build = '90522-0506';
require("dbconnect.php");
@@ -192,6 +193,12 @@ if ($non_latin < 1)
$server_ip = ereg_replace("[^\.0-9]","",$server_ip);
$stage = ereg_replace("[^a-zA-Z]","",$stage);
}
else
{
$user = ereg_replace("'|\"|\\\\|;","",$user);
$pass = ereg_replace("'|\"|\\\\|;","",$pass);
$source = ereg_replace("'|\"|\\\\|;","",$source);
}
if (strlen($list_id)<1) {$list_id='999';}
if (strlen($phone_code)<1) {$phone_code='1';}
www/vicidial/vicidial_sales_viewer.php
+21
View File
@@ -24,6 +24,27 @@ if (isset($_GET["sales_time_frame"])) {$sales_time_frame=$_GET["sales_time_fra
if (isset($_GET["forc"])) {$forc=$_GET["forc"];}
elseif (isset($_POST["forc"])) {$forc=$_POST["forc"];}
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_AUTH_PW = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_PW);
$PHP_AUTH_USER = ereg_replace("'|\"|\\\\|;","",$PHP_AUTH_USER);
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and view_reports='1';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
# Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
# Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password or no export report permission: |$PHP_AUTH_USER|\n";
exit;
}
?>
<html>
<head>