LICENSE: AGPLv2
#
# AST GUI database administration search for lead info
# admin_modify_lead.php
#
# this is the administration lead information modifier screen, the administrator
# just needs to enter the leadID and then they can view and modify the information
# in the record for that lead
#
# changes:
# 60620-1055 - Added variable filtering to eliminate SQL injection attack threat
# - Added required user/pass to gain access to this page
# - Changed results to multi-record
# 80710-0023 - Added searching by list, user, status
# 90121-0500 - Added filter for phone to remove non-digits
# 90309-1828 - Added admin_log logging
# 90310-2146 - Added admin header
# 90508-0644 - Changed to PHP long tags
# 90917-2307 - Added alternate phone number searching option
# 90921-0713 - Removed SELECT STAR
#
require("dbconnect.php");
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
$PHP_SELF=$_SERVER['PHP_SELF'];
if (isset($_GET["vendor_id"])) {$vendor_id=$_GET["vendor_id"];}
elseif (isset($_POST["vendor_id"])) {$vendor_id=$_POST["vendor_id"];}
if (isset($_GET["phone"])) {$phone=$_GET["phone"];}
elseif (isset($_POST["phone"])) {$phone=$_POST["phone"];}
if (isset($_GET["lead_id"])) {$lead_id=$_GET["lead_id"];}
elseif (isset($_POST["lead_id"])) {$lead_id=$_POST["lead_id"];}
if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
if (isset($_GET["status"])) {$status=$_GET["status"];}
elseif (isset($_POST["status"])) {$status=$_POST["status"];}
if (isset($_GET["user"])) {$user=$_GET["user"];}
elseif (isset($_POST["user"])) {$user=$_POST["user"];}
if (isset($_GET["list_id"])) {$list_id=$_GET["list_id"];}
elseif (isset($_POST["list_id"])) {$list_id=$_POST["list_id"];}
if (isset($_GET["alt_phone_search"])) {$alt_phone_search=$_GET["alt_phone_search"];}
elseif (isset($_POST["alt_phone_search"])) {$alt_phone_search=$_POST["alt_phone_search"];}
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
$phone = ereg_replace("[^0-9]","",$phone);
if (strlen($alt_phone_search) < 2) {$alt_phone_search='No';}
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$vicidial_list_fields = 'lead_id,entry_date,modify_date,status,user,vendor_lead_code,source_id,list_id,gmt_offset_now,called_since_last_reset,phone_code,phone_number,title,first_name,middle_initial,last_name,address1,address2,address3,city,state,province,postal_code,country_code,gender,date_of_birth,alt_phone,email,security_phrase,comments,called_count,last_local_call_time,rank,owner';
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and modify_leads='1';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if ($WeBRooTWritablE > 0)
{$fp = fopen ("./project_auth_entries.txt", "a");}
$date = date("r");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
{
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
Header("HTTP/1.0 401 Unauthorized");
echo "Invalid Username/Password: |$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
exit;
}
else
{
if ($auth>0)
{
$office_no=strtoupper($PHP_AUTH_USER);
$password=strtoupper($PHP_AUTH_PW);
$stmt="SELECT full_name,modify_leads from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$LOGfullname = $row[0];
$LOGmodify_leads = $row[1];
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|$LOGfullname|\n");
fclose($fp);
}
}
else
{
if ($WeBRooTWritablE > 0)
{
fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|\n");
fclose($fp);
}
}
}
?>
ADMINISTRATION: Lead Search
<?php
##### BEGIN Set variables to make header show properly #####
$ADD = '100';
$hh = 'lists';
$LOGast_admin_access = '1';
$SSoutbound_autodial_active = '1';
$ADMIN = 'admin.php';
$page_width='770';
$section_width='750';
$header_font_size='3';
$subheader_font_size='2';
$subcamp_font_size='2';
$header_selected_bold='<b>';
$header_nonselected_bold='';
$lists_color = '#FFFF99';
$lists_font = 'BLACK';
$lists_color = '#E6E6E6';
$subcamp_color = '#C6C6C6';
##### END Set variables to make header show properly #####
require("admin_header.php");
echo " Lead search: $vendor_id $phone $lead_id $status $list_id $user<BR>\n";
if ( (!$vendor_id) and (!$phone) and (!$lead_id) and ( (strlen($status)<1) and (strlen($list_id)<1) and (strlen($user)<1) ))
{
echo date("l F j, Y G:i:s A");
echo "\n<br><br><center>\n";
echo "<form method=post name=search action=\"$PHP_SELF\">\n";
echo "<input type=hidden name=DB value=\"$DB\">\n";
echo "<b>Please enter a:<br> Vendor ID(vendor lead code): <input type=text name=vendor_id size=10 maxlength=10> or \n";
echo "<br><b>a Home Phone Number: <input type=text name=phone size=20 maxlength=16> Alt phone search: \n";
echo "<select size=1 name=alt_phone_search><option>No</option><option>Yes</option><option SELECTED>$alt_phone_search</option></select> or \n";
echo "<br><b>a lead ID: <input type=text name=lead_id size=10 maxlength=10> or\n";
echo "<br><b>status: <input type=text name=status size=7 maxlength=6> \n";
echo "<b>list ID: <input type=text name=list_id size=15 maxlength=14> \n";
echo "<b>user: <input type=text name=user size=15 maxlength=20> <br><br>\n";
echo "<input type=submit name=submit value=SUBMIT></b>\n";
echo "</form>\n</center>\n";
echo "</body></html>\n";
exit;
}
else
{
if ($vendor_id)
{
$stmt="SELECT $vicidial_list_fields from vicidial_list where vendor_lead_code='" . mysql_real_escape_string($vendor_id) . "'";
}
else
{
if ($phone)
{
if ($alt_phone_search=="Yes")
{
$stmt="SELECT $vicidial_list_fields from vicidial_list where phone_number='" . mysql_real_escape_string($phone) . "' or alt_phone='" . mysql_real_escape_string($phone) . "' or address3='" . mysql_real_escape_string($phone) . "'";
}
else
{
$stmt="SELECT $vicidial_list_fields from vicidial_list where phone_number='" . mysql_real_escape_string($phone) . "'";
}
}
else
{
if ($lead_id)
{
$stmt="SELECT $vicidial_list_fields from vicidial_list where lead_id='" . mysql_real_escape_string($lead_id) . "'";
}
else
{
if ( (strlen($status)>0) or (strlen($list_id)>0) or (strlen($user)>0) )
{
$statusSQL = '';
$list_idSQL = '';
$userSQL = '';
if (strlen($status)>0)
{
$statusSQL = "status='" . mysql_real_escape_string($status) . "'"; $SQLctA++;
}
if (strlen($list_id)>0)
{
if ($SQLctA > 0) {$andA = 'and';}
$list_idSQL = "$andA list_id='" . mysql_real_escape_string($list_id) . "'"; $SQLctB++;
}
if (strlen($user)>0)
{
if ( ($SQLctA > 0) or ($SQLctB > 0) ) {$andB = 'and';}
$userSQL = "$andB user='" . mysql_real_escape_string($user) . "'";
}
$stmt="SELECT $vicidial_list_fields from vicidial_list where $statusSQL $list_idSQL $userSQL";
}
else
{
print "ERROR: you must search for something! Go back and search for something";
exit;
}
}
}
}
$stmt_alt='';
$results_to_printX=0;
if ( ($alt_phone_search=="Yes") and (strlen($phone) > 4) )
{
$stmtX="SELECT lead_id from vicidial_list_alt_phones where phone_number='" . mysql_real_escape_string($phone) . "' limit 1000;";
$rsltX=mysql_query($stmtX, $link);
$results_to_printX = mysql_num_rows($rsltX);
if ($DB)
{echo "\n\n$results_to_printX|$stmtX\n\n";}
$o=0;
while ($results_to_printX > $o)
{
$row=mysql_fetch_row($rsltX);
if ($o > 0) {$stmt_alt .= ",";}
$stmt_alt .= "'$row[0]'";
$o++;
}
if (strlen($stmt_alt) > 2)
{$stmt_alt = "or lead_id IN($stmt_alt)";}
}
$stmt = "$stmt$stmt_alt order by modify_date desc limit 1000;";
if ($DB)
{
echo "\n\n$stmt\n\n";
}
$rslt=mysql_query("$stmt", $link);
$results_to_print = mysql_num_rows($rslt);
if ( ($results_to_print < 1) and ($results_to_printX < 1) )
{
echo date("l F j, Y G:i:s A");
echo "\n<br><br><center>\n";
echo "<b>The search variables you entered are not active in the system</b><br><br>\n";
echo "<b>Please go back and double check the information you entered and submit again</b>\n";
echo "</center>\n";
echo "</body></html>\n";
exit;
}
else
{
echo "<b>RESULTS: $results_to_print</b><BR><BR>\n";
echo "<TABLE BGCOLOR=WHITE CELLPADDING=1 CELLSPACING=0>\n";
echo "<TR BGCOLOR=BLACK>\n";
echo "<TD ALIGN=LEFT><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>#</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>LEAD ID</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>STATUS</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>VENDOR ID</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>LAST AGENT</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>LIST ID</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>PHONE</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>NAME</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>CITY</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>SECURITY</B></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>LAST CALL</B></FONT></TD>\n";
echo "</TR>\n";
$o=0;
while ($results_to_print > $o)
{
$row=mysql_fetch_row($rslt);
$o++;
$search_lead = $row[0];
if (eregi("1$|3$|5$|7$|9$", $o))
{$bgcolor='bgcolor="#B9CBFD"';}
else
{$bgcolor='bgcolor="#9BB9FB"';}
echo "<TR $bgcolor>\n";
echo "<TD ALIGN=LEFT><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$o</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1><a href=\"admin_modify_lead.php?lead_id=$row[0]\" target=\"_blank\">$row[0]</a></FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[3]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[5]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[4]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[7]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[11]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[13] $row[15]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[19]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[28]</FONT></TD>\n";
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[31]</FONT></TD>\n";
echo "</TR>\n";
}
echo "</TABLE>\n";
}
### LOG INSERTION Admin Log Table ###
$SQL_log = "$stmt|";
$SQL_log = ereg_replace(';','',$SQL_log);
$SQL_log = addslashes($SQL_log);
$stmt="INSERT INTO vicidial_admin_log set event_date='$NOW_TIME', user='$PHP_AUTH_USER', ip_address='$ip', event_section='LEADS', event_type='SEARCH', record_id='$search_lead', event_code='ADMIN SEARCH LEAD', event_sql=\"$SQL_log\", event_notes='';";
if ($DB) {echo "|$stmt|\n";}
$rslt=mysql_query($stmt, $link);
}
$ENDtime = date("U");
$RUNtime = ($ENDtime - $STARTtime);
echo "\n\n\n<br><br><br>\n<a href=\"$PHP_SELF\">NEW SEARCH</a>";
echo "\n\n\n<br><br><br>\nscript runtime: $RUNtime seconds";
?>
</body>
</html>