diff --git a/bin/AST_CRON_audio_2_compress.pl b/bin/AST_CRON_audio_2_compress.pl index 1b899cb7..abe639bd 100644 --- a/bin/AST_CRON_audio_2_compress.pl +++ b/bin/AST_CRON_audio_2_compress.pl @@ -177,7 +177,7 @@ foreach(@conf) ### concurrency check if ($run_check > 0) { - my $grepout = `/bin/ps ax | grep $0 | grep -v grep`; + my $grepout = `/bin/ps ax | grep $0 | grep -v grep | grep -v '/bin/sh'`; my $grepnum=0; $grepnum++ while ($grepout =~ m/\n/g); if ($grepnum > 1) diff --git a/bin/AST_CRON_audio_3_ftp.pl b/bin/AST_CRON_audio_3_ftp.pl index 0ffdfe5b..44cd964c 100644 --- a/bin/AST_CRON_audio_3_ftp.pl +++ b/bin/AST_CRON_audio_3_ftp.pl @@ -300,7 +300,7 @@ foreach(@conf) ### concurrency check if ($run_check > 0) { - my $grepout = `/bin/ps ax | grep $0 | grep -v grep`; + my $grepout = `/bin/ps ax | grep $0 | grep -v grep | grep -v '/bin/sh'`; my $grepnum=0; $grepnum++ while ($grepout =~ m/\n/g); if ($grepnum > 1) diff --git a/bin/AST_CRON_audio_3_newftp.pl b/bin/AST_CRON_audio_3_newftp.pl index f239a61f..1f7504c2 100644 --- a/bin/AST_CRON_audio_3_newftp.pl +++ b/bin/AST_CRON_audio_3_newftp.pl @@ -383,7 +383,7 @@ if ($ingrp_check) { ### concurrency check if ($run_check > 0) { - my $grepout = `/bin/ps ax | grep $0 | grep -v grep`; + my $grepout = `/bin/ps ax | grep $0 | grep -v grep | grep -v '/bin/sh'`; my $grepnum=0; $grepnum++ while ($grepout =~ m/\n/g); if ($grepnum > 1) diff --git a/bin/AST_CRON_audio_4_ftp2.pl b/bin/AST_CRON_audio_4_ftp2.pl index d95296a3..8aae9756 100644 --- a/bin/AST_CRON_audio_4_ftp2.pl +++ b/bin/AST_CRON_audio_4_ftp2.pl @@ -245,7 +245,7 @@ foreach(@conf) ### concurrency check if ($run_check > 0) { - my $grepout = `/bin/ps ax | grep $0 | grep -v grep`; + my $grepout = `/bin/ps ax | grep $0 | grep -v grep | grep -v '/bin/sh'`; my $grepnum=0; $grepnum++ while ($grepout =~ m/\n/g); if ($grepnum > 1) diff --git a/bin/AST_cleanup_agent_log.pl b/bin/AST_cleanup_agent_log.pl index 93b4eed4..80bb0d33 100644 --- a/bin/AST_cleanup_agent_log.pl +++ b/bin/AST_cleanup_agent_log.pl @@ -391,7 +391,7 @@ foreach(@conf) ### concurrency check if ($run_check > 0) { - my $grepout = `/bin/ps ax | grep $0 | grep -v grep`; + my $grepout = `/bin/ps ax | grep $0 | grep -v grep | grep -v '/bin/sh'`; my $grepnum=0; $grepnum++ while ($grepout =~ m/\n/g); if ($grepnum > 1) diff --git a/www/vicidial/AST_LISTS_campaign_stats.php b/www/vicidial/AST_LISTS_campaign_stats.php index 8f29c959..bb039004 100644 --- a/www/vicidial/AST_LISTS_campaign_stats.php +++ b/www/vicidial/AST_LISTS_campaign_stats.php @@ -10,6 +10,7 @@ # 100916-0928 - First build # 110703-1815 - Added download option # 120224-0910 - Added HTML display option with bar graphs +# 120524-1754 - Fixed status categories issue # header ("Content-type: text/html; charset=utf-8"); @@ -180,7 +181,7 @@ else $stmt="select vsc_id,vsc_name from vicidial_status_categories;"; $rslt=mysql_query($stmt, $link); -if ($DB) {$MAIN.="$stmt\n";} +if ($DB) {echo "$stmt\n";} $statcats_to_print = mysql_num_rows($rslt); $i=0; while ($i < $statcats_to_print) @@ -188,13 +189,27 @@ while ($i < $statcats_to_print) $row=mysql_fetch_row($rslt); $vsc_id[$i] = $row[0]; $vsc_name[$i] = $row[1]; - $vsc_count[$i] = 0; + + $category_statuses=""; + $status_stmt="select distinct status from vicidial_statuses where category='$row[0]' UNION select distinct status from vicidial_campaign_statuses where category='$row[0]' $group_SQLand"; + if ($DB) {echo "$status_stmt\n";} + $status_rslt=mysql_query($status_stmt, $link); + while ($status_row=mysql_fetch_row($status_rslt)) + { + $category_statuses.="'$status_row[0]',"; + } + $category_statuses=substr($category_statuses, 0, -1); + + $category_stmt="select count(*) from vicidial_list where status in ($category_statuses) and list_id IN( SELECT list_id from vicidial_lists where active IN('Y','N') $group_SQLand)"; + if ($DB) {echo "$category_stmt\n";} + $category_rslt=mysql_query($category_stmt, $link); + $category_row=mysql_fetch_row($category_rslt); + $vsc_count[$i] = $category_row[0]; $i++; } - ### BEGIN gather all statuses that are in status flags ### $human_answered_statuses=''; $sale_statuses=''; diff --git a/www/vicidial/admin_listloader_fourth_gen.php b/www/vicidial/admin_listloader_fourth_gen.php index db265ad0..78ae0849 100644 --- a/www/vicidial/admin_listloader_fourth_gen.php +++ b/www/vicidial/admin_listloader_fourth_gen.php @@ -45,10 +45,11 @@ # 120221-0140 - Added User Group restrictions # 120223-2318 - Removed logging of good login passwords if webroot writable is enabled # 120402-2128 - Added template options +# 120525-1038 - Added uploaded filename filtering # -$version = '2.4-44'; -$build = '120402-2128'; +$version = '2.4-45'; +$build = '120525-1038'; require("dbconnect.php"); @@ -153,6 +154,8 @@ if ( $phone_code_override == "in_file" ) { $phone_code_override = ""; } ### REGEX to prevent weird characters from ending up in the fields $field_regx = "['\"`\\;]"; +$lead_file = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$lead_file); +$leadfile_name = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$leadfile_name); $vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|'; diff --git a/www/vicidial/admin_listloader_third_gen.php b/www/vicidial/admin_listloader_third_gen.php index 8ad792d9..acb8d374 100644 --- a/www/vicidial/admin_listloader_third_gen.php +++ b/www/vicidial/admin_listloader_third_gen.php @@ -44,10 +44,11 @@ # 110705-1947 - Added USACAN check for prefix and areacode # 120221-0140 - Added User Group restrictions # 120223-2318 - Removed logging of good login passwords if webroot writable is enabled +# 120525-1037 - Added uploaded filename filtering # -$version = '2.4-43'; -$build = '120223-2318'; +$version = '2.4-44'; +$build = '120525-1037'; require("dbconnect.php"); @@ -150,6 +151,8 @@ if ( $phone_code_override == "in_file" ) { $phone_code_override = ""; } ### REGEX to prevent weird characters from ending up in the fields $field_regx = "['\"`\\;]"; +$lead_file = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$lead_file); +$leadfile_name = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$leadfile_name); $vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|'; diff --git a/www/vicidial/audio_store.php b/www/vicidial/audio_store.php index ad441c1a..f93ebd37 100644 --- a/www/vicidial/audio_store.php +++ b/www/vicidial/audio_store.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2012 Matt Florell LICENSE: AGPLv2 # # Central Audio Storage script # @@ -11,10 +11,11 @@ # 100401-1037 - remove spaces and special characters from filenames, admin log uploads # 110922-2331 - Added modify_audiostore user option for access # 111122-1332 - Added more filename filtering +# 120525-0739 - Added yet more filename filtering # -$version = '2.4-5'; -$build = '111122-1332'; +$version = '2.4-6'; +$build = '120525-0739'; $MT[0]=''; @@ -206,6 +207,7 @@ if ($action == "AUTOUPLOAD") $AF_path = preg_replace("/\!/",'\!',$AF_path); $AF_path = preg_replace("/\%/",'\%',$AF_path); $AF_path = preg_replace("/\^/",'\^',$AF_path); + $AF_path = preg_replace("/;|:|\/|\[|\]|\"|\'/",'',$AF_path); $audiofile_name = preg_replace("/ /",'',$audiofile_name); $audiofile_name = preg_replace("/@/",'',$audiofile_name); $audiofile_name = preg_replace("/\(/",'',$audiofile_name); @@ -216,6 +218,7 @@ if ($action == "AUTOUPLOAD") $audiofile_name = preg_replace("/\!/",'',$audiofile_name); $audiofile_name = preg_replace("/\%/",'',$audiofile_name); $audiofile_name = preg_replace("/\^/",'',$audiofile_name); + $audiofile_name = preg_replace("/;|:|\/|\[|\]|\"|\'/",'',$audiofile_name); copy($AF_path, "$WeBServeRRooT/$sounds_web_directory/$audiofile_name"); chmod("$WeBServeRRooT/$sounds_web_directory/$audiofile_name", 0766); @@ -310,6 +313,7 @@ if ($action == "MANUALUPLOAD") $AF_path = preg_replace("/\!/",'\!',$AF_path); $AF_path = preg_replace("/\%/",'\%',$AF_path); $AF_path = preg_replace("/\^/",'\^',$AF_path); + $AF_path = preg_replace("/;|:|\/|\[|\]|\"|\'/",'',$AF_path); $audiofile_name = preg_replace("/ /",'',$audiofile_name); $audiofile_name = preg_replace("/@/",'',$audiofile_name); $audiofile_name = preg_replace("/\(/",'',$audiofile_name); @@ -320,6 +324,7 @@ if ($action == "MANUALUPLOAD") $audiofile_name = preg_replace("/\!/",'',$audiofile_name); $audiofile_name = preg_replace("/\%/",'',$audiofile_name); $audiofile_name = preg_replace("/\^/",'',$audiofile_name); + $audiofile_name = preg_replace("/;|:|\/|\[|\]|\"|\'/",'',$audiofile_name); copy($AF_path, "$WeBServeRRooT/$sounds_web_directory/$audiofile_name"); chmod("$WeBServeRRooT/$sounds_web_directory/$audiofile_name", 0766); diff --git a/www/vicidial/leadloader_template_display.php b/www/vicidial/leadloader_template_display.php index 8c80474c..4415e014 100644 --- a/www/vicidial/leadloader_template_display.php +++ b/www/vicidial/leadloader_template_display.php @@ -5,6 +5,7 @@ # # CHANGES # 120402-2238 - First Build +# 120525-1039 - Added uploaded filename filtering # require("dbconnect.php"); @@ -45,6 +46,8 @@ if (isset($_GET["buffer"])) {$buffer=$_GET["buffer"];} ### REGEX to prevent weird characters from ending up in the fields $field_regx = "['\"`\\;]"; +$sample_template_file_name = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$sample_template_file_name); + if ($form_action=="prime_file" && $sample_template_file_name) { $delim_set=0; diff --git a/www/vicidial/new_listloader_superL.php b/www/vicidial/new_listloader_superL.php index a9bb278d..c0be85a6 100644 --- a/www/vicidial/new_listloader_superL.php +++ b/www/vicidial/new_listloader_superL.php @@ -35,11 +35,12 @@ # 100705-1507 - Added custom fields to field chooser, only when liast_id_override is used and only with TXT and CSV file formats # 100712-1416 - Added entry_list_id field to vicidial_list to preserve link to custom fields if any # 120223-2148 - Removed logging of good login passwords if webroot writable is enabled +# 120525-0731 - Added uploaded filename filtering # # make sure vicidial_list exists and that your file follows the formatting correctly. This page does not dedupe or do any other lead filtering actions yet at this time. -$version = '2.4-38'; -$build = '120223-2148'; +$version = '2.4-39'; +$build = '120525-0731'; require("dbconnect.php"); @@ -139,6 +140,8 @@ if (isset($_GET["DB"])) {$DB=$_GET["DB"];} ### REGEX to prevent weird characters from ending up in the fields $field_regx = "['\"`\\;]"; +$lead_file = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$lead_file); +$leadfile_name = preg_replace("/;|:|\/|\^|\[|\]|\"|\'|\*/","",$leadfile_name); $vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|'; @@ -205,10 +208,10 @@ $browser = getenv("HTTP_USER_AGENT"); { $office_no=strtoupper($PHP_AUTH_USER); $password=strtoupper($PHP_AUTH_PW); - $stmt="SELECT load_leads from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; - $rslt=mysql_query($stmt, $link); - $row=mysql_fetch_row($rslt); - $LOGload_leads =$row[0]; + $stmt="SELECT load_leads from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'"; + $rslt=mysql_query($stmt, $link); + $row=mysql_fetch_row($rslt); + $LOGload_leads = $row[0]; if ($LOGload_leads < 1) {