LICENSE: AGPLv2 # # AST GUI database administration search for lead info # admin_modify_lead.php # # this is the administration lead information search screen, the administrator # just needs to enter the leadID and then they can view and modify the information # in the record for that lead # # changes: # 60620-1055 - Added variable filtering to eliminate SQL injection attack threat # - Added required user/pass to gain access to this page # - Changed results to multi-record # 80710-0023 - Added searching by list, user, status # 90121-0500 - Added filter for phone to remove non-digits # 90309-1828 - Added admin_log logging # 90310-2146 - Added admin header # 90508-0644 - Changed to PHP long tags # 90917-2307 - Added alternate phone number searching option # 90921-0713 - Removed SELECT STAR # 100224-1621 - Added first/last name search and changed format of the page # 100405-1331 - Added log search ability # 100622-0928 - Added field labels # 110218-1237 - Added vicidial_lead_search_log logging # 111103-1239 - Added admin_hide_phone_data and admin_hide_lead_data options # 120221-0118 - Added User Group campaign list restrictions to search queries # 120223-2249 - Removed logging of good login passwords if webroot writable is enabled # 120409-1131 - Added option for log searches done through slave DB server # 121025-1732 - Added owner field search option # 130610-1054 - Finalized changing of all ereg instances to preg # 130621-1714 - Added filtering of input to prevent SQL injection attacks and new user auth # 130902-0747 - Changed to mysqli PHP functions # 130926-2048 - Added option to search vicidial_list_archive table # 140724-1240 - Added the abilty to search the log archive tables # 140808-1117 - Added more admin logging # 140817-0941 - Added archive_log variable to modify page link # 141001-2200 - Finalized adding QXZ translation to all admin files # 141124-1747 - Fixed issue #790 # 141229-1748 - Added code for on-the-fly language translations display # 150107-1728 - Added ignore_group_on_search user option # 150312-1507 - Allow for single quotes in vicidial_list data fields # 150602-1207 - Allow for searching by email address # 151203-2104 - Added option for called_count as search variable # 160325-1427 - Changes for sidebar update # 160508-0753 - Added colors features # require("dbconnect_mysqli.php"); require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; if (isset($_GET["vendor_id"])) {$vendor_id=$_GET["vendor_id"];} elseif (isset($_POST["vendor_id"])) {$vendor_id=$_POST["vendor_id"];} if (isset($_GET["first_name"])) {$first_name=$_GET["first_name"];} elseif (isset($_POST["first_name"])) {$first_name=$_POST["first_name"];} if (isset($_GET["last_name"])) {$last_name=$_GET["last_name"];} elseif (isset($_POST["last_name"])) {$last_name=$_POST["last_name"];} if (isset($_GET["email"])) {$email=$_GET["email"];} elseif (isset($_POST["email"])) {$email=$_POST["email"];} if (isset($_GET["phone"])) {$phone=$_GET["phone"];} elseif (isset($_POST["phone"])) {$phone=$_POST["phone"];} if (isset($_GET["lead_id"])) {$lead_id=$_GET["lead_id"];} elseif (isset($_POST["lead_id"])) {$lead_id=$_POST["lead_id"];} if (isset($_GET["log_phone"])) {$log_phone=$_GET["log_phone"];} elseif (isset($_POST["log_phone"])) {$log_phone=$_POST["log_phone"];} if (isset($_GET["log_lead_id"])) {$log_lead_id=$_GET["log_lead_id"];} elseif (isset($_POST["log_lead_id"])) {$log_lead_id=$_POST["log_lead_id"];} if (isset($_GET["log_phone_archive"])) {$log_phone_archive=$_GET["log_phone_archive"];} elseif (isset($_POST["log_phone_archive"])) {$log_phone_archive=$_POST["log_phone_archive"];} if (isset($_GET["log_lead_id_archive"])) {$log_lead_id_archive=$_GET["log_lead_id_archive"];} elseif (isset($_POST["log_lead_id_archive"])) {$log_lead_id_archive=$_POST["log_lead_id_archive"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["status"])) {$status=$_GET["status"];} elseif (isset($_POST["status"])) {$status=$_POST["status"];} if (isset($_GET["user"])) {$user=$_GET["user"];} elseif (isset($_POST["user"])) {$user=$_POST["user"];} if (isset($_GET["owner"])) {$owner=$_GET["owner"];} elseif (isset($_POST["owner"])) {$owner=$_POST["owner"];} if (isset($_GET["list_id"])) {$list_id=$_GET["list_id"];} elseif (isset($_POST["list_id"])) {$list_id=$_POST["list_id"];} if (isset($_GET["alt_phone_search"])) {$alt_phone_search=$_GET["alt_phone_search"];} elseif (isset($_POST["alt_phone_search"])) {$alt_phone_search=$_POST["alt_phone_search"];} if (isset($_GET["archive_search"])) {$archive_search=$_GET["archive_search"];} elseif (isset($_POST["archive_search"])) {$archive_search=$_POST["archive_search"];} if (isset($_GET["called_count"])) {$called_count=$_GET["called_count"];} elseif (isset($_POST["called_count"])) {$called_count=$_POST["called_count"];} ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active,slave_db_server,reports_use_slave_db,enable_languages,language_method FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { $row=mysqli_fetch_row($rslt); $non_latin = $row[0]; $webroot_writable = $row[1]; $SSoutbound_autodial_active = $row[2]; $user_territories_active = $row[3]; $slave_db_server = $row[4]; $reports_use_slave_db = $row[5]; $SSenable_languages = $row[6]; $SSlanguage_method = $row[7]; } ##### END SETTINGS LOOKUP ##### ########################################### $report_name = 'Search Leads Logs'; if ($archive_search=="Yes") {$vl_table="vicidial_list_archive";} else {$vl_table="vicidial_list"; $archive_search="No";} $vicidial_list_fields = 'lead_id,entry_date,modify_date,status,user,vendor_lead_code,source_id,list_id,gmt_offset_now,called_since_last_reset,phone_code,phone_number,title,first_name,middle_initial,last_name,address1,address2,address3,city,state,province,postal_code,country_code,gender,date_of_birth,alt_phone,email,security_phrase,comments,called_count,last_local_call_time,rank,owner'; $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); $log_archive_link=0; if (strlen($alt_phone_search) < 2) {$alt_phone_search='No';} if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); } else { $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); } $phone = preg_replace('/[^0-9]/','',$phone); $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } $auth=0; $auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1); if ($auth_message == 'GOOD') {$auth=1;} if ($auth < 1) { $VDdisplayMESSAGE = _QXZ("Login incorrect, please try again"); if ($auth_message == 'LOCK') { $VDdisplayMESSAGE = _QXZ("Too many login attempts, try again in 15 minutes"); Header ("Content-type: text/html; charset=utf-8"); echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; exit; } Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; exit; } $rights_stmt = "SELECT modify_leads from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rights_rslt=mysql_to_mysqli($rights_stmt, $link); $rights_row=mysqli_fetch_row($rights_rslt); $modify_leads = $rights_row[0]; # check their permissions if ( $modify_leads < 1 ) { header ("Content-type: text/html; charset=utf-8"); echo _QXZ("You do not have permissions to search leads")."\n"; exit; } $stmt="SELECT full_name,modify_leads,admin_hide_lead_data,admin_hide_phone_data,user_group,ignore_group_on_search from vicidial_users where user='$PHP_AUTH_USER';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $LOGfullname = $row[0]; $LOGmodify_leads = $row[1]; $LOGadmin_hide_lead_data = $row[2]; $LOGadmin_hide_phone_data = $row[3]; $LOGuser_group = $row[4]; $LOGignore_group_on_search = $row[5]; $stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $LOGallowed_campaigns = $row[0]; $LOGallowed_reports = $row[1]; $LOGadmin_viewable_groups = $row[2]; $LOGadmin_viewable_call_times = $row[3]; $camp_lists=''; $LOGallowed_campaignsSQL=''; $whereLOGallowed_campaignsSQL=''; $LOGallowed_listsSQL=''; $whereLOGallowed_listsSQL=''; if ( (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) and ($LOGignore_group_on_search != '1') ) { $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; $stmt="SELECT list_id from vicidial_lists $whereLOGallowed_campaignsSQL;"; $rslt=mysql_to_mysqli($stmt, $link); $lists_to_print = mysqli_num_rows($rslt); $o=0; while ($lists_to_print > $o) { $rowx=mysqli_fetch_row($rslt); $camp_lists .= "'$rowx[0]',"; $o++; } $camp_lists = preg_replace('/.$/i','',$camp_lists);; if (strlen($camp_lists)<2) {$camp_lists="''";} $LOGallowed_listsSQL = "and list_id IN($camp_lists)"; $whereLOGallowed_listsSQL = "where list_id IN($camp_lists)"; } $regexLOGallowed_campaigns = " $LOGallowed_campaigns "; ?>