LICENSE: AGPLv2 # # this screen will insert phones into your multi-server system with aliases # # changes: # 101230-0501 - First Build # 110712-0932 - Added extension suffix exception for non-SIP/IAX phones, added HELP # 120104-2023 - Added webphone options # 120209-1545 - Added phone context option # 120223-2249 - Removed logging of good login passwords if webroot writable is enabled # 120820-1026 - Added webphone option Y_API_LAUNCH # 130610-1043 - Changed all ereg to preg # 130621-1724 - Added filtering of input to prevent SQL injection attacks and new user auth # 130902-0751 - Changed to mysqli PHP functions # 141007-1145 - Finalized adding QXZ translation to all admin files # 141229-2101 - Added code for on-the-fly language translations display # 170409-1532 - Added IP List validation code # 180503-2015 - Added new help display # 181130-1304 - Added template option # 201112-1017 - Fix for side menu issue #1223 # 210827-0907 - Added PJSIP support # 220222-1942 - Added allow_web_debug system setting # $admin_version = '2.14-16'; $build = '220222-1942'; require("dbconnect_mysqli.php"); require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["action"])) {$action=$_GET["action"];} elseif (isset($_POST["action"])) {$action=$_POST["action"];} if (isset($_GET["servers"])) {$servers=$_GET["servers"];} elseif (isset($_POST["servers"])) {$servers=$_POST["servers"];} if (isset($_GET["phones"])) {$phones=$_GET["phones"];} elseif (isset($_POST["phones"])) {$phones=$_POST["phones"];} if (isset($_GET["conf_secret"])) {$conf_secret=$_GET["conf_secret"];} elseif (isset($_POST["conf_secret"])) {$conf_secret=$_POST["conf_secret"];} if (isset($_GET["pass"])) {$pass=$_GET["pass"];} elseif (isset($_POST["pass"])) {$pass=$_POST["pass"];} if (isset($_GET["alias_option"])) {$alias_option=$_GET["alias_option"];} elseif (isset($_POST["alias_option"])) {$alias_option=$_POST["alias_option"];} if (isset($_GET["protocol"])) {$protocol=$_GET["protocol"];} elseif (isset($_POST["protocol"])) {$protocol=$_POST["protocol"];} if (isset($_GET["local_gmt"])) {$local_gmt=$_GET["local_gmt"];} elseif (isset($_POST["local_gmt"])) {$local_gmt=$_POST["local_gmt"];} if (isset($_GET["alias_suffix"])) {$alias_suffix=$_GET["alias_suffix"];} elseif (isset($_POST["alias_suffix"])) {$alias_suffix=$_POST["alias_suffix"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} if (isset($_GET["is_webphone"])) {$is_webphone=$_GET["is_webphone"];} elseif (isset($_POST["is_webphone"])) {$is_webphone=$_POST["is_webphone"];} if (isset($_GET["webphone_dialpad"])) {$webphone_dialpad=$_GET["webphone_dialpad"];} elseif (isset($_POST["webphone_dialpad"])) {$webphone_dialpad=$_POST["webphone_dialpad"];} if (isset($_GET["webphone_auto_answer"])) {$webphone_auto_answer=$_GET["webphone_auto_answer"];} elseif (isset($_POST["webphone_auto_answer"])) {$webphone_auto_answer=$_POST["webphone_auto_answer"];} if (isset($_GET["use_external_server_ip"])) {$use_external_server_ip=$_GET["use_external_server_ip"];} elseif (isset($_POST["use_external_server_ip"])){$use_external_server_ip=$_POST["use_external_server_ip"];} if (isset($_GET["phone_context"])) {$phone_context=$_GET["phone_context"];} elseif (isset($_POST["phone_context"])) {$phone_context=$_POST["phone_context"];} if (isset($_GET["template_id"])) {$template_id=$_GET["template_id"];} elseif (isset($_POST["template_id"])) {$template_id=$_POST["template_id"];} if (strlen($action) < 2) {$action = 'BLANK';} if (strlen($DB) < 1) {$DB=0;} $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $stmt = "SELECT use_non_latin,webroot_writable,enable_languages,language_method,admin_screen_colors,campaign_cid_areacodes_enabled,sounds_central_control_active,contacts_enabled,enable_auto_reports,allowed_sip_stacks,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); #if ($DB) {echo "$stmt\n";} $ss_conf_ct = mysqli_num_rows($rslt); if ($ss_conf_ct > 0) { $row=mysqli_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; $SSenable_languages = $row[2]; $SSlanguage_method = $row[3]; $SSadmin_screen_colors = $row[4]; $SScampaign_cid_areacodes_enabled = $row[5]; $SSsounds_central_control_active = $row[6]; $SScontacts_enabled = $row[7]; $SSenable_auto_reports = $row[8]; $SSallowed_sip_stacks = $row[9]; $SSallow_web_debug = $row[10]; } if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); $servers = preg_replace("/'|\"|\\\\|;/","",$servers); $phones = preg_replace("/'|\"|\\\\|;/","",$phones); $action = preg_replace("/[^-_0-9a-zA-Z]/", "",$action); $alias_option = preg_replace("/[^-_0-9a-zA-Z]/", "",$alias_option); $protocol = preg_replace("/[^-_0-9a-zA-Z]/", "",$protocol); $local_gmt = preg_replace("/[^- \.\,\_0-9a-zA-Z]/","",$local_gmt); $is_webphone = preg_replace("/[^-_0-9a-zA-Z]/", "",$is_webphone); $webphone_dialpad = preg_replace("/[^-_0-9a-zA-Z]/", "",$webphone_dialpad); $webphone_auto_answer = preg_replace("/[^NY]/","",$webphone_auto_answer); $use_external_server_ip = preg_replace("/[^NY]/","",$use_external_server_ip); $SUBMIT = preg_replace("/[^-_0-9a-zA-Z]/", "",$SUBMIT); if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace("/[^-_0-9a-zA-Z]/", "",$PHP_AUTH_PW); $conf_secret = preg_replace("/[^-_0-9a-zA-Z]/", "",$conf_secret); $pass = preg_replace("/[^-_0-9a-zA-Z]/", "",$pass); $alias_suffix = preg_replace("/[^0-9a-zA-Z]/","",$alias_suffix); $phone_context = preg_replace("/[^-\_0-9a-zA-Z]/","",$phone_context); $template_id = preg_replace('/[^-_0-9a-zA-Z]/','',$template_id); } # end of non_latin else { $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); $conf_secret = preg_replace("/[^-_0-9\p{L}]/u", "",$conf_secret); $pass = preg_replace("/[^-_0-9\p{L}]/u", "",$pass); $alias_suffix = preg_replace("/[^0-9\p{L}]/u","",$alias_suffix); $phone_context = preg_replace("/[^-\_0-9\p{L}]/u","",$phone_context); $template_id = preg_replace('/[^-_0-9\p{L}]/u','',$template_id); } $user = $PHP_AUTH_USER; $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } $auth=0; $auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1,0); if ( ($auth_message == 'GOOD') or ($auth_message == '2FA') ) { $auth=1; if ($auth_message == '2FA') { header ("Content-type: text/html; charset=utf-8"); echo _QXZ("Your session is expired").". "._QXZ("Click here to log in").".\n"; exit; } } if ($auth < 1) { $VDdisplayMESSAGE = _QXZ("Login incorrect, please try again"); if ($auth_message == 'LOCK') { $VDdisplayMESSAGE = _QXZ("Too many login attempts, try again in 15 minutes"); Header ("Content-type: text/html; charset=utf-8"); echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; exit; } if ($auth_message == 'IPBLOCK') { $VDdisplayMESSAGE = _QXZ("Your IP Address is not allowed") . ": $ip"; Header ("Content-type: text/html; charset=utf-8"); echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; exit; } Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; exit; } $rights_stmt = "SELECT ast_delete_phones from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rights_rslt=mysql_to_mysqli($rights_stmt, $link); $rights_row=mysqli_fetch_row($rights_rslt); $ast_delete_phones = $rights_row[0]; # check their permissions if ( $ast_delete_phones < 1 ) { header ("Content-type: text/html; charset=utf-8"); echo _QXZ("You do not have permissions to manage phones")."\n"; exit; } $stmt="SELECT full_name,ast_delete_phones,ast_admin_access,user_level,user_group from vicidial_users where user='$PHP_AUTH_USER';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $LOGfullname = $row[0]; $LOGast_delete_phones = $row[1]; $LOGast_admin_access = $row[2]; $LOGuser_level = $row[3]; $LOGuser_group = $row[4]; $stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {$DBout .= "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $LOGallowed_campaigns = $row[0]; $LOGallowed_reports = $row[1]; $LOGadmin_viewable_groups = $row[2]; $LOGadmin_viewable_call_times = $row[3]; $LOGadmin_viewable_groupsSQL=''; $whereLOGadmin_viewable_groupsSQL=''; if ( (!preg_match('/\-\-ALL\-\-/i',$LOGadmin_viewable_groups)) and (strlen($LOGadmin_viewable_groups) > 3) ) { $rawLOGadmin_viewable_groupsSQL = preg_replace("/ -/",'',$LOGadmin_viewable_groups); $rawLOGadmin_viewable_groupsSQL = preg_replace("/ /","','",$rawLOGadmin_viewable_groupsSQL); $LOGadmin_viewable_groupsSQL = "and user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')"; $whereLOGadmin_viewable_groupsSQL = "where user_group IN('---ALL---','$rawLOGadmin_viewable_groupsSQL')"; } ?>
|
- - - - - - - - - - - - - - |
| \n";
echo "";
echo " "._QXZ("Add Multi-Server Phones Form")." |