LICENSE: AGPLv2 # # Changes # 50307-1721 - First version # 51123-1502 - removed requirement of PHP Globals=on # 60421-1229 - check GET/POST vars lines with isset to not trigger PHP NOTICES # 60619-1603 - Added variable filtering to eliminate SQL injection attack threat # 90508-0644 - Changed to PHP long tags # 91129-2249 - Replaced SELECT STAR in SQL queries, formatting fixes # 120223-2135 - Removed logging of good login passwords if webroot writable is enabled # 130610-1105 - Finalized changing of all ereg instances to preg # 130616-0005 - Added filtering of input to prevent SQL injection attacks and new user auth # 130901-0833 - Changed to mysqli PHP functions # 140328-0005 - Converted division calculations to use MathZDC function # 141007-2123 - Finalized adding QXZ translation to all admin files # 141229-1847 - Added code for on-the-fly language translations display # 170217-1213 - Fixed non-latin auth issue #995 # 210618-1001 - Added CORS support # $version = '2.14-14'; $build = '210618-1001'; $php_script='vdremote.php'; require("dbconnect_mysqli.php"); require("functions.php"); $PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER']; $PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW']; $PHP_SELF=$_SERVER['PHP_SELF']; $PHP_SELF = preg_replace('/\.php.*/i','.php',$PHP_SELF); if (isset($_GET["ADD"])) {$ADD=$_GET["ADD"];} elseif (isset($_POST["ADD"])) {$ADD=$_POST["ADD"];} if (isset($_GET["DB"])) {$DB=$_GET["DB"];} elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];} if (isset($_GET["user"])) {$user=$_GET["user"];} elseif (isset($_POST["user"])) {$user=$_POST["user"];} if (isset($_GET["force_logout"])) {$force_logout=$_GET["force_logout"];} elseif (isset($_POST["force_logout"])) {$force_logout=$_POST["force_logout"];} if (isset($_GET["groups"])) {$groups=$_GET["groups"];} elseif (isset($_POST["groups"])) {$groups=$_POST["groups"];} if (isset($_GET["remote_agent_id"])) {$remote_agent_id=$_GET["remote_agent_id"];} elseif (isset($_POST["remote_agent_id"])) {$remote_agent_id=$_POST["remote_agent_id"];} if (isset($_GET["user_start"])) {$user_start=$_GET["user_start"];} elseif (isset($_POST["user_start"])) {$user_start=$_POST["user_start"];} if (isset($_GET["number_of_lines"])) {$number_of_lines=$_GET["number_of_lines"];} elseif (isset($_POST["number_of_lines"])) {$number_of_lines=$_POST["number_of_lines"];} if (isset($_GET["server_ip"])) {$server_ip=$_GET["server_ip"];} elseif (isset($_POST["server_ip"])) {$server_ip=$_POST["server_ip"];} if (isset($_GET["conf_exten"])) {$conf_exten=$_GET["conf_exten"];} elseif (isset($_POST["conf_exten"])) {$conf_exten=$_POST["conf_exten"];} if (isset($_GET["status"])) {$status=$_GET["status"];} elseif (isset($_POST["status"])) {$status=$_POST["status"];} if (isset($_GET["campaign_id"])) {$campaign_id=$_GET["campaign_id"];} elseif (isset($_POST["campaign_id"])) {$campaign_id=$_POST["campaign_id"];} if (isset($_GET["groups"])) {$groups=$_GET["groups"];} elseif (isset($_POST["groups"])) {$groups=$_POST["groups"];} if (isset($_GET["submit"])) {$submit=$_GET["submit"];} elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];} if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];} elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];} if (!isset($force_logout)) {$force_logout = 0;} if (file_exists('options.php')) {require('options.php');} if ($force_logout) { if( (strlen($PHP_AUTH_USER)>0) or (strlen($PHP_AUTH_PW)>0) ) { Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); } echo _QXZ("You have now logged out. Thank you")."\n"; exit; } ############################################# ##### START SYSTEM_SETTINGS LOOKUP ##### $stmt = "SELECT use_non_latin,outbound_autodial_active,slave_db_server,reports_use_slave_db,custom_fields_enabled,enable_languages,language_method FROM system_settings;"; $rslt=mysql_to_mysqli($stmt, $link); if ($DB) {echo "$stmt\n";} $qm_conf_ct = mysqli_num_rows($rslt); if ($qm_conf_ct > 0) { $row=mysqli_fetch_row($rslt); $non_latin = $row[0]; $outbound_autodial_active = $row[1]; $slave_db_server = $row[2]; $reports_use_slave_db = $row[3]; $custom_fields_enabled = $row[4]; $SSenable_languages = $row[5]; $SSlanguage_method = $row[6]; } ##### END SETTINGS LOOKUP ##### ########################################### if (!isset($query_date)) {$query_date = $NOW_DATE;} if ($non_latin < 1) { $PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER); $PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW); } else { $PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW); $PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER); } $remote_agent_id = preg_replace('/[^-_0-9a-zA-Z]/', '', $remote_agent_id); $query_date = preg_replace('/[^-_0-9a-zA-Z]/', '', $query_date); $popup_page = './closer_popup.php'; $STARTtime = date("U"); $NOW_DATE = date("Y-m-d"); $NOW_TIME = date("Y-m-d H:i:s"); $date = date("r"); $ip = getenv("REMOTE_ADDR"); $browser = getenv("HTTP_USER_AGENT"); $stmt="SELECT selected_language from vicidial_users where user='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $sl_ct = mysqli_num_rows($rslt); if ($sl_ct > 0) { $row=mysqli_fetch_row($rslt); $VUselected_language = $row[0]; } $auth=0; $auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'REMOTE',1,0); if ($auth_message == 'GOOD') {$auth=1;} if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth)) { Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\""); Header("HTTP/1.0 401 Unauthorized"); echo _QXZ("Invalid Username/Password").": |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n"; exit; } else { header ("Content-type: text/html; charset=utf-8"); if($auth>0) { $stmt="SELECT full_name from vicidial_users where user='$PHP_AUTH_USER';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $LOGfullname=$row[0]; $stmt="SELECT count(*) from vicidial_remote_agents where user_start='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $authx=$row[0]; if($authx>0) { $stmt="SELECT remote_agent_id,server_ip,number_of_lines from vicidial_remote_agents where user_start='$PHP_AUTH_USER';"; if ($DB) {echo "|$stmt|\n";} $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $remote_agent_id=$row[0]; $server_ip=$row[1]; if (!$number_of_lines) {$number_of_lines=$row[2];} } else { echo _QXZ("This remote agent does not exist").": |$PHP_AUTH_USER|\n"; exit; } } } require("screen_colors.php"); echo "\n"; echo "
\n"; echo "\n"; if ($ADD==61111) { echo"\n"; } echo "\n"; ?> REMOTE AGENTS: $LOGfullname - $PHP_AUTH_USER "; if (!$ADD) {$ADD="31111";} if ($ADD==31111) {echo "Modify Remote Agents";} if ($ADD==41111) {echo "Modify Remote Agents";} if ($ADD==61111) {echo "Remote Agent Status";} if ($ADD==71111) {echo "Remote Agent Closer Stats";} if (strlen($ADD)>4) { ##### get server listing for dynamic pulldown $stmt="SELECT server_ip,server_description from servers order by server_ip;"; $rslt=mysql_to_mysqli($stmt, $link); $servers_to_print = mysqli_num_rows($rslt); $servers_list=''; $o=0; while ($servers_to_print > $o) { $rowx=mysqli_fetch_row($rslt); $servers_list .= "\n"; $o++; } ##### get campaigns listing for dynamic pulldown $stmt="SELECT campaign_id,campaign_name from vicidial_campaigns order by campaign_id;"; $rslt=mysql_to_mysqli($stmt, $link); $campaigns_to_print = mysqli_num_rows($rslt); $campaigns_list=''; $o=0; while ($campaigns_to_print > $o) { $rowx=mysqli_fetch_row($rslt); $campaigns_list .= "\n"; $o++; } ##### get inbound groups listing for checkboxes if ( (($ADD==31111) or ($ADD==31111)) and (count($groups)<1) ) { $stmt="SELECT closer_campaigns from vicidial_remote_agents where remote_agent_id='" . mysqli_real_escape_string($link, $remote_agent_id) . "';"; $rslt=mysql_to_mysqli($stmt, $link); $row=mysqli_fetch_row($rslt); $closer_campaigns = $row[0]; $closer_campaigns = preg_replace("/ -$/","",$closer_campaigns); $groups = explode(" ", $closer_campaigns); } $stmt="SELECT group_id,group_name from vicidial_inbound_groups order by group_id;"; $rslt=mysql_to_mysqli($stmt, $link); $groups_to_print = mysqli_num_rows($rslt); $groups_list=''; $groups_value=''; $o=0; while ($groups_to_print > $o) { $rowx=mysqli_fetch_row($rslt); $group_id_value = $rowx[0]; $group_name_value = $rowx[1]; $groups_list .= "2) {$groups_value .= " -";} } ?>| : | |
| | "> | "> | |
|
";
$stmt="SELECT remote_agent_id,user_start,number_of_lines,server_ip,conf_exten,status,campaign_id,closer_campaigns from vicidial_remote_agents where remote_agent_id='" . mysqli_real_escape_string($link, $remote_agent_id) . "';";
$rslt=mysql_to_mysqli($stmt, $link);
$row=mysqli_fetch_row($rslt);
$remote_agent_id = $row[0];
$user_start = $row[1];
$number_of_lines = $row[2];
$server_ip = $row[3];
$conf_exten = $row[4];
$status = $row[5];
$campaign_id = $row[6];
echo " "._QXZ("MODIFY A REMOTE AGENTS ENTRY").": $row[0] | |