diff --git a/www/vicidial/user_group_bulk_change.php b/www/vicidial/user_group_bulk_change.php index f4742ba9..e6304a73 100644 --- a/www/vicidial/user_group_bulk_change.php +++ b/www/vicidial/user_group_bulk_change.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2017 Matt Florell LICENSE: AGPLv2 # # CHANGES # 81119-0918 - First build @@ -18,6 +18,7 @@ # 160105-1232 - Fixed SQL errors # 160106-1318 - Added options.php option to disable this utility # 160325-1429 - Changes for sidebar update +# 170217-1213 - Fixed non-latin auth issue #995 # header ("Content-type: text/html; charset=utf-8"); @@ -59,8 +60,16 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### -$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } $old_group = preg_replace("/'|\"|\\\\|;/","",$old_group); $group = preg_replace("/'|\"|\\\\|;/","",$group); $stage = preg_replace("/'|\"|\\\\|;/","",$stage); diff --git a/www/vicidial/user_status.php b/www/vicidial/user_status.php index edc35a49..c3d4c2c8 100644 --- a/www/vicidial/user_status.php +++ b/www/vicidial/user_status.php @@ -1,7 +1,7 @@ LICENSE: AGPLv2 +# Copyright (C) 2017 Matt Florell LICENSE: AGPLv2 # # CHANGES # @@ -37,6 +37,7 @@ # 151211-1458 - Added chat visibility # 160325-1433 - Changes for sidebar update # 161102-1041 - Fixed QM partition problem +# 170217-1213 - Fixed non-latin auth issue #995 # $startMS = microtime(); @@ -94,8 +95,16 @@ if ($qm_conf_ct > 0) if (!isset($begin_date)) {$begin_date = $TODAY;} if (!isset($end_date)) {$end_date = $TODAY;} -$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } $user = preg_replace("/'|\"|\\\\|;/","",$user); $group = preg_replace("/'|\"|\\\\|;/","",$group); $stage = preg_replace("/'|\"|\\\\|;/","",$stage); diff --git a/www/vicidial/vdremote.php b/www/vicidial/vdremote.php index a32a0ea0..390b116b 100644 --- a/www/vicidial/vdremote.php +++ b/www/vicidial/vdremote.php @@ -4,7 +4,7 @@ # make sure you have added a user to the vicidial_users MySQL table with at # least user_level 4 to access this page the first time # -# Copyright (C) 2014 Matt Florell LICENSE: AGPLv2 +# Copyright (C) 2017 Matt Florell LICENSE: AGPLv2 # # Changes # 50307-1721 - First version @@ -20,10 +20,11 @@ # 140328-0005 - Converted division calculations to use MathZDC function # 141007-2123 - Finalized adding QXZ translation to all admin files # 141229-1847 - Added code for on-the-fly language translations display +# 170217-1213 - Fixed non-latin auth issue #995 # -$version = '2.10-12'; -$build = '141229-1847'; +$version = '2.14-13'; +$build = '170217-1213'; require("dbconnect_mysqli.php"); require("functions.php"); @@ -96,8 +97,16 @@ if ($qm_conf_ct > 0) ########################################### if (!isset($query_date)) {$query_date = $NOW_DATE;} -$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } $remote_agent_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $remote_agent_id); $query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date); diff --git a/www/vicidial/vicidial_sales_viewer.php b/www/vicidial/vicidial_sales_viewer.php index 9a44600c..5a992b91 100644 --- a/www/vicidial/vicidial_sales_viewer.php +++ b/www/vicidial/vicidial_sales_viewer.php @@ -3,7 +3,7 @@ # vicidial_sales_viewer.php - VICIDIAL administration page # # -# Copyright (C) 2014 Joe Johnson,Matt Florell LICENSE: AGPLv2 +# Copyright (C) 2017 Joe Johnson,Matt Florell LICENSE: AGPLv2 # # CHANGES # 80310-1500 - first build @@ -13,6 +13,7 @@ # 130615-2357 - Added filtering of input to prevent SQL injection attacks and new user auth # 130901-0832 - Changed to mysqli PHP functions # 141007-2147 - Finalized adding QXZ translation to all admin files +# 170217-1213 - Fixed non-latin auth issue #995 # if (isset($_GET["dcampaign"])) {$dcampaign=$_GET["dcampaign"];} @@ -34,8 +35,34 @@ include("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; -$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); -$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); +############################################# +##### START SYSTEM_SETTINGS LOOKUP ##### +$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,enable_languages,language_method FROM system_settings;"; +$rslt=mysql_to_mysqli($stmt, $link); +if ($DB) {echo "$stmt\n";} +$qm_conf_ct = mysqli_num_rows($rslt); +if ($qm_conf_ct > 0) + { + $row=mysqli_fetch_row($rslt); + $non_latin = $row[0]; + $webroot_writable = $row[1]; + $SSoutbound_autodial_active = $row[2]; + $SSenable_languages = $row[3]; + $SSlanguage_method = $row[4]; + } +##### END SETTINGS LOOKUP ##### +########################################### + +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } $dcampaign = preg_replace('/[^0-9a-zA-Z]/', '', $dcampaign); $auth=0; diff --git a/www/vicidial/voice_lab.php b/www/vicidial/voice_lab.php index 9e6d874d..580b87d5 100644 --- a/www/vicidial/voice_lab.php +++ b/www/vicidial/voice_lab.php @@ -4,7 +4,7 @@ # This script is designed to broadcast a recorded message or allow a person to # speak to all agents logged into a VICIDIAL campaign. # -# Copyright (C) 2014 Matt Florell LICENSE: AGPLv2 +# Copyright (C) 2017 Matt Florell LICENSE: AGPLv2 # # # CHANGES @@ -19,6 +19,7 @@ # 130901-0831 - Changed to mysqli PHP functions # 141007-2143 - Finalized adding QXZ translation to all admin files # 141229-1817 - Added code for on-the-fly language translations display +# 170217-1213 - Fixed non-latin auth issue #995 # $startMS = microtime(); @@ -50,8 +51,6 @@ if (isset($_GET["submit"])) {$submit=$_GET["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} -$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); -$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); $campaign_id = preg_replace('/[^0-9a-zA-Z]/', '', $campaign_id); $server_ip = preg_replace('/[^\.0-9a-zA-Z]/', '', $server_ip); $session_id = preg_replace('/[^0-9a-zA-Z]/', '', $session_id); @@ -87,6 +86,17 @@ if ($qm_conf_ct > 0) ##### END SETTINGS LOOKUP ##### ########################################### +if ($non_latin < 1) + { + $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); + $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); + } +else + { + $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); + $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); + } + $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link);