LICENSE: AGPLv2 # # CHANGES # 120402-2132 - First Build # 120529-1427 - Filename filter fix # 130514-2127 - Bug fix on Chrome/IE browsers # 130610-1102 - Finalized changing of all ereg instances to preg # 130619-2044 - Added filtering of input to prevent SQL injection attacks and new user auth # 130719-1914 - Added ability to filter by statuses # 130824-2325 - Changed to mysqli PHP functions # 141114-0912 - Finalized adding QXZ translation to all admin files # 141229-2024 - Added code for on-the-fly language translations display # 170409-1532 - Added IP List validation code # 180324-0942 - Enforce User Group campaign permissions for templates based on list_id # 180503-2215 - Added new help display # 180927-0633 - Fix for deleted template function in alternate language, issue #1127 # 210312-1700 - Added layout editing functionality # 220222-1100 - Added allow_web_debug system setting # require("dbconnect_mysqli.php"); require("functions.php"); if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["standard_fields_layout"])) {$standard_fields_layout=$_GET["standard_fields_layout"];} elseif (isset($_POST["standard_fields_layout"])) {$standard_fields_layout=$_POST["standard_fields_layout"];} if (isset($_GET["custom_fields_layout"])) {$custom_fields_layout=$_GET["custom_fields_layout"];} elseif (isset($_POST["custom_fields_layout"])) {$custom_fields_layout=$_POST["custom_fields_layout"];} if (isset($_GET["template_id"])) {$template_id=$_GET["template_id"];} elseif (isset($_POST["template_id"])) {$template_id=$_POST["template_id"];} if (isset($_GET["template_name"])) {$template_name=$_GET["template_name"];} elseif (isset($_POST["template_name"])) {$template_name=$_POST["template_name"];} if (isset($_GET["template_description"])) {$template_description=$_GET["template_description"];} elseif (isset($_POST["template_description"])) {$template_description=$_POST["template_description"];} if (isset($_GET["file_format"])) {$file_format=$_GET["file_format"];} elseif (isset($_POST["file_format"])) {$file_format=$_POST["file_format"];} if (isset($_GET["file_delimiter"])) {$file_delimiter=$_GET["file_delimiter"];} elseif (isset($_POST["file_delimiter"])) {$file_delimiter=$_POST["file_delimiter"];} if (isset($_GET["template_list_id"])) {$template_list_id=$_GET["template_list_id"];} elseif (isset($_POST["template_list_id"])) {$template_list_id=$_POST["template_list_id"];} if (isset($_GET["template_statuses"])) {$template_statuses=$_GET["template_statuses"];} elseif (isset($_POST["template_statuses"])) {$template_statuses=$_POST["template_statuses"];} if (isset($_GET["standard_fields_layout"])) {$standard_fields_layout=$_GET["standard_fields_layout"];} elseif (isset($_POST["standard_fields_layout"])) {$standard_fields_layout=$_POST["standard_fields_layout"];} if (isset($_GET["custom_fields_layout"])) {$custom_fields_layout=$_GET["custom_fields_layout"];} elseif (isset($_POST["custom_fields_layout"])) {$custom_fields_layout=$_POST["custom_fields_layout"];} if (isset($_GET["submit_template"])) {$submit_template=$_GET["submit_template"];} elseif (isset($_POST["submit_template"])) {$submit_template=$_POST["submit_template"];} if (isset($_GET["submit_edited_template"])) {$submit_edited_template=$_GET["submit_edited_template"];} elseif (isset($_POST["submit_edited_template"])) {$submit_edited_template=$_POST["submit_edited_template"];} if (isset($_GET["edit_standard_fields_layout"])) {$edit_standard_fields_layout=$_GET["edit_standard_fields_layout"];} elseif (isset($_POST["edit_standard_fields_layout"])) {$edit_standard_fields_layout=$_POST["edit_standard_fields_layout"];} if (isset($_GET["edit_custom_fields_layout"])) {$edit_custom_fields_layout=$_GET["edit_custom_fields_layout"];} elseif (isset($_POST["edit_custom_fields_layout"])) {$edit_custom_fields_layout=$_POST["edit_custom_fields_layout"];} if (isset($_GET["delete_template"])) {$delete_template=$_GET["delete_template"];} elseif (isset($_POST["delete_template"])) {$delete_template=$_POST["delete_template"];} $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); $DB=preg_replace("/[^0-9a-zA-Z]/","",$DB); #$vicidial_list_fields = '|lead_id|vendor_lead_code|source_id|list_id|gmt_offset_now|called_since_last_reset|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|called_count|last_local_call_time|rank|owner|entry_list_id|'; $vicidial_listloader_fields = '|vendor_lead_code|source_id|phone_code|phone_number|title|first_name|middle_initial|last_name|address1|address2|address3|city|state|province|postal_code|country_code|gender|date_of_birth|alt_phone|email|security_phrase|comments|rank|owner|'; $US='_'; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $stmt = "SELECT use_non_latin,admin_web_directory,custom_fields_enabled,webroot_writable,enable_languages,language_method,admin_screen_colors,allow_web_debug FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); #if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { $row=mysqli_fetch_row($rslt); $non_latin = $row[0]; $admin_web_directory = $row[1]; $custom_fields_enabled = $row[2]; $webroot_writable = $row[3]; $SSenable_languages = $row[4]; $SSlanguage_method = $row[5]; $SSadmin_screen_colors = $row[6]; $SSallow_web_debug = $row[7]; } if ($SSallow_web_debug < 1) {$DB=0;} ##### END SETTINGS LOOKUP ##### ########################################### $list_id_override = preg_replace('/[^0-9]/','',$list_id_override); $template_list_id = preg_replace('/[^0-9]/','',$template_list_id); $template_id = preg_replace("/\<|\>|'|\"|\\\\|;/","",$template_id); $template_name = preg_replace("/\<|\>|'|\"|\\\\|;/","",$template_name); $template_description = preg_replace("/\<|\>|'|\"|\\\\|;/","",$template_description); $standard_fields_layout = preg_replace("/\<|\>|'|\"|\\\\|;/","",$standard_fields_layout); $custom_table = preg_replace("/\<|\>|'|\"|\\\\|;/","",$custom_table); $custom_fields_layout = preg_replace("/\<|\>|'|\"|\\\\|;/","",$custom_fields_layout); $edit_standard_fields_layout = preg_replace("/\<|\>|'|\"|\\\\|;/","",$edit_standard_fields_layout); $edit_custom_fields_layout = preg_replace("/\<|\>|'|\"|\\\\|;/","",$edit_custom_fields_layout); $delete_template = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $delete_template); $submit_template = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $submit_template); $submit_edited_template = preg_replace("/\<|\>|\'|\"|\\\\|;/", '', $submit_edited_template); $file_format = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$file_format); $file_delimiter = preg_replace("/\<|\>|\'|\"|\\\\|;/",'',$file_delimiter); # Variables filtered further down in the code # $template_statuses if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); } else { $PHP_AUTH_USER = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9\p{L}]/u', '', $PHP_AUTH_PW); } if ($submit_edited_template) { $upd_stmt="update vicidial_custom_leadloader_templates set template_name='$template_name', template_description='$template_description', standard_variables='$edit_standard_fields_layout', custom_variables='$edit_custom_fields_layout' where template_id='$template_id' limit 1"; $upd_rslt=mysql_to_mysqli($upd_stmt, $link); if (mysqli_affected_rows($link)>0) { $success_msg=_QXZ("TEMPLATE UPDATED"); if (!$edit_custom_fields_layout) { $success_msg.="**"._QXZ("NO CUSTOM FIELDS ASSIGNED")."**"; } } else { $errno = mysqli_errno($link); if ($errno > 0) {$error = mysqli_error($link);} $error_msg=_QXZ("TEMPLATE UPDATE FAILED")."\n$errno - $error\n[$upd_stmt]"; } } $STARTtime = date("U"); $TODAY = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $FILE_datetime = $STARTtime; $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } $auth=0; $auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1,0); if ($auth_message == 'GOOD') {$auth=1;} if ($auth < 1) { $VDdisplayMESSAGE = _QXZ("Login incorrect, please try again"); if ($auth_message == 'LOCK') { $VDdisplayMESSAGE = _QXZ("Too many login attempts, try again in 15 minutes"); Header ("Content-type: text/html; charset=utf-8"); echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; exit; } if ($auth_message == 'IPBLOCK') { $VDdisplayMESSAGE = _QXZ("Your IP Address is not allowed") . ": $ip"; Header ("Content-type: text/html; charset=utf-8"); echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n"; exit; } Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; exit; } $stmt="SELECT load_leads,user_group from vicidial_users where user='$PHP_AUTH_USER';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $LOGload_leads = $row[0]; $LOGuser_group = $row[1]; if ($LOGload_leads < 1) { Header ("Content-type: text/html; charset=utf-8"); echo "You do not have permissions to load leads: |$PHP_AUTH_USER|\n"; exit; } header ("Content-type: text/html; charset=utf-8"); header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 header ("Pragma: no-cache"); // HTTP/1.0 if ($submit_template==_QXZ("SUBMIT TEMPLATE") && $template_id && $template_name && $template_list_id && $standard_fields_layout) { $status_str=""; $status_count=count($template_statuses); for ($q=0; $q|\'|\"|\\\\|;/",'',$template_statuses[$q]); echo "\n"; $status_str.="$template_statuses[$q]|"; } echo ""; $status_str=preg_replace('/\|$/', '', $status_str); if (preg_match('/\-\-ALL\-\-/', $status_str)) {$status_str="";} $custom_table="custom_".$template_list_id; $ins_stmt="INSERT INTO vicidial_custom_leadloader_templates(template_id, template_name, template_description, list_id, standard_variables, custom_table, custom_variables, template_statuses) values('$template_id', '$template_name', '$template_description', '$template_list_id', '$standard_fields_layout', '$custom_table', '$custom_fields_layout', '$status_str')"; $ins_rslt=mysql_to_mysqli($ins_stmt, $link); echo ""; if (mysqli_affected_rows($link)>0) { $success_msg=_QXZ("NEW TEMPLATE CREATED SUCCESSFULLY"); if (!$custom_fields_layout) { $success_msg.="**"._QXZ("NO CUSTOM FIELDS ASSIGNED")."**"; } } else { $errno = mysqli_errno($link); if ($errno > 0) {$error = mysqli_error($link);} $error_msg=_QXZ("TEMPLATE CREATION FAILED")."\n$errno - $error\n[$ins_stmt]"; } } else if ( ($delete_template == _QXZ("DELETE TEMPLATE")) and (strlen($template_id) > 0) ) { $delete_stmt="delete from vicidial_custom_leadloader_templates where template_id='$template_id'"; $delete_rslt=mysql_to_mysqli($delete_stmt, $link); } $stmt="SELECT allowed_campaigns,allowed_reports,admin_viewable_groups,admin_viewable_call_times from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $LOGallowed_campaigns = $row[0]; $LOGallowed_reports = $row[1]; $LOGadmin_viewable_groups = $row[2]; $LOGadmin_viewable_call_times = $row[3]; $camp_lists=''; $LOGallowed_campaignsSQL=''; $whereLOGallowed_campaignsSQL=''; if (!preg_match('/\-ALL/i', $LOGallowed_campaigns)) { # echo "**$LOGallowed_campaigns**"; $rawLOGallowed_campaignsSQL = preg_replace("/ -/",'',$LOGallowed_campaigns); $rawLOGallowed_campaignsSQL = preg_replace("/ /","','",$rawLOGallowed_campaignsSQL); # echo "##$rawLOGallowed_campaignsSQL##"; $LOGallowed_campaignsSQL = "and campaign_id IN('$rawLOGallowed_campaignsSQL')"; $whereLOGallowed_campaignsSQL = "where campaign_id IN('$rawLOGallowed_campaignsSQL')"; } $regexLOGallowed_campaigns = " $LOGallowed_campaigns "; $script_name = getenv("SCRIPT_NAME"); $server_name = getenv("SERVER_NAME"); $server_port = getenv("SERVER_PORT"); if (preg_match("/443/i",$server_port)) {$HTTPprotocol = 'https://';} else {$HTTPprotocol = 'http://';} $admDIR = "$HTTPprotocol$server_name$script_name"; $admDIR = preg_replace('/AST_admin_template_maker\.php/i', '',$admDIR); $admDIR = "/vicidial/"; $admSCR = 'admin.php'; # $NWB = " "; $NWB = ""; require("screen_colors.php"); ?> ADMIN: Lead Loader Template Maker = 5.0) return $fontsize; else return ($fontsize+2); } else return $fontsize; /* Browser is not a Mac - don't touch fonts */ } echo "\n"; ?> "; echo "$error_msg"; echo ""; } if ($success_msg) { echo ""; echo "$success_msg"; echo ""; } ?> :() : 0) { if ($update_template) {echo "$update_template\n";} else {echo "--"._QXZ("Choose an existing template")."--\n";} while ($template_row=mysqli_fetch_array($template_rslt)) { echo "$template_row[template_id] - $template_row[template_name]\n"; } } else { echo "--"._QXZ("No templates exist")."--\n"; } ?> " style='background-color:#' name="edit_template" style="align:right; width: 150px" onClick="EditTemplate(this.form.template_id.value)"> " style='background-color:#' name="delete_template" style="align:center; width: 150px"> **** : : : : ---- $count ) { $row = mysqli_fetch_row($rslt); echo "\t\t\t$row[0] - $row[1]\n"; $count++; } ?> : ---- $count ) { $row = mysqli_fetch_row($rslt); echo "\t\t\t$row[0] - $row[1]\n"; $count++; } ?> type='submit' name='submit_template' onClick="return checkForm(this.form)" value=''> () ****