LICENSE: AGPLv2 # # This callcard script is to administer the callcard accounts in ViciDial # it is separate from the standard admin.php script. callcard_enabled in # the system_settings table must be active for this script to work. # # CHANGES # 100311-2325 - first build # 100525-1824 - Added generate option # 100616-0847 - Fixed batch issue # 100823-1342 - Added Search option and display for level 7 users, added pin number search # $version = '2.4-4'; $build = '100823-1342'; $MT[0]=''; require("dbconnect.php"); $PHP_SELF=$_SERVER['PHP_SELF']; if (isset($_GET["action"])) {$action=$_GET["action"];} elseif (isset($_POST["action"])) {$action=$_POST["action"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["run"])) {$run=$_GET["run"];} elseif (isset($_POST["run"])) {$run=$_POST["run"];} if (isset($_GET["batch"])) {$batch=$_GET["batch"];} elseif (isset($_POST["batch"])) {$batch=$_POST["batch"];} if (isset($_GET["starting_batch"])) {$starting_batch=$_GET["starting_batch"];} elseif (isset($_POST["starting_batch"])) {$starting_batch=$_POST["starting_batch"];} if (isset($_GET["pack"])) {$pack=$_GET["pack"];} elseif (isset($_POST["pack"])) {$pack=$_POST["pack"];} if (isset($_GET["sequence"])) {$sequence=$_GET["sequence"];} elseif (isset($_POST["sequence"])) {$sequence=$_POST["sequence"];} if (isset($_GET["card_id"])) {$card_id=$_GET["card_id"];} elseif (isset($_POST["card_id"])) {$card_id=$_POST["card_id"];} if (isset($_GET["pin"])) {$pin=$_GET["pin"];} elseif (isset($_POST["pin"])) {$pin=$_POST["pin"];} if (isset($_GET["status"])) {$status=$_GET["status"];} elseif (isset($_POST["status"])) {$status=$_POST["status"];} if (isset($_GET["total"])) {$total=$_GET["total"];} elseif (isset($_POST["total"])) {$total=$_POST["total"];} if (isset($_GET["comment"])) {$comment=$_GET["comment"];} elseif (isset($_POST["comment"])) {$comment=$_POST["comment"];} if (isset($_GET["balance_minutes"])) {$balance_minutes=$_GET["balance_minutes"];} elseif (isset($_POST["balance_minutes"])) {$balance_minutes=$_POST["balance_minutes"];} if (isset($_GET["initial_value"])) {$initial_value=$_GET["initial_value"];} elseif (isset($_POST["initial_value"])) {$initial_value=$_POST["initial_value"];} if (isset($_GET["initial_minutes"])) {$initial_minutes=$_GET["initial_minutes"];} elseif (isset($_POST["initial_minutes"])) {$initial_minutes=$_POST["initial_minutes"];} if (isset($_GET["note_purchase_order"])) {$note_purchase_order=$_GET["note_purchase_order"];} elseif (isset($_POST["note_purchase_order"])) {$note_purchase_order=$_POST["note_purchase_order"];} if (isset($_GET["note_printer"])) {$note_printer=$_GET["note_printer"];} elseif (isset($_POST["note_printer"])) {$note_printer=$_POST["note_printer"];} if (isset($_GET["note_did"])) {$note_did=$_GET["note_did"];} elseif (isset($_POST["note_did"])) {$note_did=$_POST["note_did"];} if (isset($_GET["inbound_group_id"])) {$inbound_group_id=$_GET["inbound_group_id"];} elseif (isset($_POST["inbound_group_id"])) {$inbound_group_id=$_POST["inbound_group_id"];} if (isset($_GET["note_language"])) {$note_language=$_GET["note_language"];} elseif (isset($_POST["note_language"])) {$note_language=$_POST["note_language"];} if (isset($_GET["note_name"])) {$note_name=$_GET["note_name"];} elseif (isset($_POST["note_name"])) {$note_name=$_POST["note_name"];} if (isset($_GET["note_comments"])) {$note_comments=$_GET["note_comments"];} elseif (isset($_POST["note_comments"])) {$note_comments=$_POST["note_comments"];} if (isset($_GET["user"])) {$user=$_GET["user"];} elseif (isset($_POST["user"])) {$user=$_POST["user"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} header ("Content-type: text/html; charset=utf-8"); header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 header ("Pragma: no-cache"); // HTTP/1.0 $report_name = 'CallCard Search'; $SEARCHONLY=0; ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $stmt = "SELECT use_non_latin,callcard_enabled FROM system_settings;"; $rslt=mysql_query($stmt, $link); if ($DB) {echo "$stmt\n";} $ss_conf_ct = mysql_num_rows($rslt); if ($ss_conf_ct > 0) { $row=mysql_fetch_row($rslt); $non_latin = $row[0]; $callcard_enabled = $row[1]; } ##### END SETTINGS LOOKUP ##### ########################################### if ($callcard_enabled < 1) { echo "ERROR: CallCard is not active on this system\n"; exit; } if ($non_latin < 1) { ### Clean Variable Values ### $DB = ereg_replace("[^0-9]","",$DB); $action = ereg_replace("[^\_0-9a-zA-Z]","",$action); $card_id = ereg_replace("[^-\_0-9]","",$card_id); $run = ereg_replace("[^0-9]","",$run); $batch = ereg_replace("[^0-9]","",$batch); $pack = ereg_replace("[^0-9]","",$pack); $sequence = ereg_replace("[^0-9]","",$sequence); $territory_description = ereg_replace("[^ -\_\.\,0-9a-zA-Z]","",$territory_description); $user = ereg_replace("[^-\_0-9a-zA-Z]","",$user); $old_territory = ereg_replace("[^-\_0-9a-zA-Z]","",$old_territory); $old_user = ereg_replace("[^-\_0-9a-zA-Z]","",$old_user); $accountid = ereg_replace("[^-\_0-9a-zA-Z]","",$accountid); } if (eregi("YES",$batch)) { $USER='batch'; $PASS='batch'; } else { $USER=$_SERVER['PHP_AUTH_USER']; $PASS=$_SERVER['PHP_AUTH_PW']; $USER = ereg_replace("[^0-9a-zA-Z]","",$USER); $PASS = ereg_replace("[^0-9a-zA-Z]","",$PASS); $stmt="SELECT count(*) from vicidial_users where user='$USER' and pass='$PASS' and user_level > 7 and callcard_admin='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} if ($non_latin > 0) { $rslt=mysql_query("SET NAMES 'UTF8'");} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $auth=$row[0]; if( (strlen($USER)<2) or (strlen($PASS)<2) or (!$auth)) { $stmt="SELECT count(*) from vicidial_users where user='$USER' and pass='$PASS' and user_level > 6 and view_reports='1' and active='Y';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $authreport=$row[0]; if ($authreport > 0) { $stmt="SELECT full_name,user_group from vicidial_users where user='$USER' and pass='$PASS';"; $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $LOGfullname = $row[0]; $LOGuser_group = $row[1]; $stmt="SELECT allowed_reports from vicidial_user_groups where user_group='$LOGuser_group';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_query($stmt, $link); $row=mysql_fetch_row($rslt); $LOGallowed_reports = $row[0]; if ( (!preg_match("/$report_name/",$LOGallowed_reports)) and (!preg_match("/ALL REPORTS/",$LOGallowed_reports)) ) { Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); Header("HTTP/1.0 401 Unauthorized"); echo "You are not allowed to view this report: |$PHP_AUTH_USER|$report_name|\n"; exit; } else { $SEARCHONLY=1; } } else { Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\""); Header("HTTP/1.0 401 Unauthorized"); echo "Invalid Username/Password: |$USER|$PASS|\n"; exit; } } } if ($SEARCHONLY > 0) { if ( ($action != 'SEARCH') and ($action != 'SEARCH_RESULTS') and ($action != 'CALLCARD_DETAIL') ) {$action = 'SEARCH';} } if (strlen($action) < 1) {$action = 'CALLCARD_SUMMARY';} ?>