ViciDial/agc_2-X
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed non-latin auth issue #995

Browse Source 
git-svn-id: svn://192.168.202.10@2670 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2017-02-17 18:18:22 +00:00
parent 3c044b5671
commit ff64f90c0f
5 changed files with 81 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/vicidial/user_group_bulk_change.php
+12 -3
View File
@@ -1,7 +1,7 @@
<?php
# user_group_bulk_change.php
#
# Copyright (C) 2016 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2017 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# CHANGES
# 81119-0918 - First build
@@ -18,6 +18,7 @@
# 160105-1232 - Fixed SQL errors
# 160106-1318 - Added options.php option to disable this utility
# 160325-1429 - Changes for sidebar update
# 170217-1213 - Fixed non-latin auth issue #995
#
header ("Content-type: text/html; charset=utf-8");
@@ -59,8 +60,16 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$old_group = preg_replace("/'|\"|\\\\|;/","",$old_group);
$group = preg_replace("/'|\"|\\\\|;/","",$group);
$stage = preg_replace("/'|\"|\\\\|;/","",$stage);
www/vicidial/user_status.php
+12 -3
View File
@@ -1,7 +1,7 @@
<?php
# user_status.php
#
# Copyright (C) 2016 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2017 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# CHANGES
#
@@ -37,6 +37,7 @@
# 151211-1458 - Added chat visibility
# 160325-1433 - Changes for sidebar update
# 161102-1041 - Fixed QM partition problem
# 170217-1213 - Fixed non-latin auth issue #995
#
$startMS = microtime();
@@ -94,8 +95,16 @@ if ($qm_conf_ct > 0)
if (!isset($begin_date)) {$begin_date = $TODAY;}
if (!isset($end_date)) {$end_date = $TODAY;}
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$user = preg_replace("/'|\"|\\\\|;/","",$user);
$group = preg_replace("/'|\"|\\\\|;/","",$group);
$stage = preg_replace("/'|\"|\\\\|;/","",$stage);
www/vicidial/vdremote.php
+14 -5
View File
@@ -4,7 +4,7 @@
# make sure you have added a user to the vicidial_users MySQL table with at
# least user_level 4 to access this page the first time
#
# Copyright (C) 2014 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2017 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# Changes
# 50307-1721 - First version
@@ -20,10 +20,11 @@
# 140328-0005 - Converted division calculations to use MathZDC function
# 141007-2123 - Finalized adding QXZ translation to all admin files
# 141229-1847 - Added code for on-the-fly language translations display
# 170217-1213 - Fixed non-latin auth issue #995
#
$version = '2.10-12';
$build = '141229-1847';
$version = '2.14-13';
$build = '170217-1213';
require("dbconnect_mysqli.php");
require("functions.php");
@@ -96,8 +97,16 @@ if ($qm_conf_ct > 0)
###########################################
if (!isset($query_date)) {$query_date = $NOW_DATE;}
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$remote_agent_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $remote_agent_id);
$query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date);
www/vicidial/vicidial_sales_viewer.php
+30 -3
View File
@@ -3,7 +3,7 @@
# vicidial_sales_viewer.php - VICIDIAL administration page
#
#
# Copyright (C) 2014 Joe Johnson,Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2017 Joe Johnson,Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
# CHANGES
# 80310-1500 - first build
@@ -13,6 +13,7 @@
# 130615-2357 - Added filtering of input to prevent SQL injection attacks and new user auth
# 130901-0832 - Changed to mysqli PHP functions
# 141007-2147 - Finalized adding QXZ translation to all admin files
# 170217-1213 - Fixed non-latin auth issue #995
#
if (isset($_GET["dcampaign"])) {$dcampaign=$_GET["dcampaign"];}
@@ -34,8 +35,34 @@ include("functions.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method FROM system_settings;";
$rslt=mysql_to_mysqli($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysqli_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysqli_fetch_row($rslt);
$non_latin = $row[0];
$webroot_writable = $row[1];
$SSoutbound_autodial_active = $row[2];
$SSenable_languages = $row[3];
$SSlanguage_method = $row[4];
}
##### END SETTINGS LOOKUP #####
###########################################
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$dcampaign = preg_replace('/[^0-9a-zA-Z]/', '', $dcampaign);
$auth=0;
www/vicidial/voice_lab.php
+13 -3
View File
@@ -4,7 +4,7 @@
# This script is designed to broadcast a recorded message or allow a person to
# speak to all agents logged into a VICIDIAL campaign.
#
# Copyright (C) 2014 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2017 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
#
# CHANGES
@@ -19,6 +19,7 @@
# 130901-0831 - Changed to mysqli PHP functions
# 141007-2143 - Finalized adding QXZ translation to all admin files
# 141229-1817 - Added code for on-the-fly language translations display
# 170217-1213 - Fixed non-latin auth issue #995
#
$startMS = microtime();
@@ -50,8 +51,6 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
$campaign_id = preg_replace('/[^0-9a-zA-Z]/', '', $campaign_id);
$server_ip = preg_replace('/[^\.0-9a-zA-Z]/', '', $server_ip);
$session_id = preg_replace('/[^0-9a-zA-Z]/', '', $session_id);
@@ -87,6 +86,17 @@ if ($qm_conf_ct > 0)
##### END SETTINGS LOOKUP #####
###########################################
if ($non_latin < 1)
{
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
}
else
{
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
}
$stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_to_mysqli($stmt, $link);