331 lines
12 KiB
PHP
331 lines
12 KiB
PHP
<?php
|
|
# admin_search_lead.php
|
|
#
|
|
# Copyright (C) 2009 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
|
|
#
|
|
# AST GUI database administration search for lead info
|
|
# admin_modify_lead.php
|
|
#
|
|
# this is the administration lead information modifier screen, the administrator
|
|
# just needs to enter the leadID and then they can view and modify the information
|
|
# in the record for that lead
|
|
#
|
|
# changes:
|
|
# 60620-1055 - Added variable filtering to eliminate SQL injection attack threat
|
|
# - Added required user/pass to gain access to this page
|
|
# - Changed results to multi-record
|
|
# 80710-0023 - Added searching by list, user, status
|
|
# 90121-0500 - Added filter for phone to remove non-digits
|
|
# 90309-1828 - Added admin_log logging
|
|
# 90310-2146 - Added admin header
|
|
# 90508-0644 - Changed to PHP long tags
|
|
# 90917-2307 - Added alternate phone number searching option
|
|
# 90921-0713 - Removed SELECT STAR
|
|
#
|
|
|
|
require("dbconnect.php");
|
|
|
|
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
|
|
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
|
|
$PHP_SELF=$_SERVER['PHP_SELF'];
|
|
if (isset($_GET["vendor_id"])) {$vendor_id=$_GET["vendor_id"];}
|
|
elseif (isset($_POST["vendor_id"])) {$vendor_id=$_POST["vendor_id"];}
|
|
if (isset($_GET["phone"])) {$phone=$_GET["phone"];}
|
|
elseif (isset($_POST["phone"])) {$phone=$_POST["phone"];}
|
|
if (isset($_GET["lead_id"])) {$lead_id=$_GET["lead_id"];}
|
|
elseif (isset($_POST["lead_id"])) {$lead_id=$_POST["lead_id"];}
|
|
if (isset($_GET["submit"])) {$submit=$_GET["submit"];}
|
|
elseif (isset($_POST["submit"])) {$submit=$_POST["submit"];}
|
|
if (isset($_GET["SUBMIT"])) {$SUBMIT=$_GET["SUBMIT"];}
|
|
elseif (isset($_POST["SUBMIT"])) {$SUBMIT=$_POST["SUBMIT"];}
|
|
if (isset($_GET["DB"])) {$DB=$_GET["DB"];}
|
|
elseif (isset($_POST["DB"])) {$DB=$_POST["DB"];}
|
|
if (isset($_GET["status"])) {$status=$_GET["status"];}
|
|
elseif (isset($_POST["status"])) {$status=$_POST["status"];}
|
|
if (isset($_GET["user"])) {$user=$_GET["user"];}
|
|
elseif (isset($_POST["user"])) {$user=$_POST["user"];}
|
|
if (isset($_GET["list_id"])) {$list_id=$_GET["list_id"];}
|
|
elseif (isset($_POST["list_id"])) {$list_id=$_POST["list_id"];}
|
|
if (isset($_GET["alt_phone_search"])) {$alt_phone_search=$_GET["alt_phone_search"];}
|
|
elseif (isset($_POST["alt_phone_search"])) {$alt_phone_search=$_POST["alt_phone_search"];}
|
|
|
|
$PHP_AUTH_USER = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_USER);
|
|
$PHP_AUTH_PW = ereg_replace("[^0-9a-zA-Z]","",$PHP_AUTH_PW);
|
|
$phone = ereg_replace("[^0-9]","",$phone);
|
|
if (strlen($alt_phone_search) < 2) {$alt_phone_search='No';}
|
|
|
|
$STARTtime = date("U");
|
|
$TODAY = date("Y-m-d");
|
|
$NOW_TIME = date("Y-m-d H:i:s");
|
|
|
|
$vicidial_list_fields = 'lead_id,entry_date,modify_date,status,user,vendor_lead_code,source_id,list_id,gmt_offset_now,called_since_last_reset,phone_code,phone_number,title,first_name,middle_initial,last_name,address1,address2,address3,city,state,province,postal_code,country_code,gender,date_of_birth,alt_phone,email,security_phrase,comments,called_count,last_local_call_time,rank,owner';
|
|
|
|
$stmt="SELECT count(*) from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW' and user_level > 7 and modify_leads='1';";
|
|
if ($DB) {echo "|$stmt|\n";}
|
|
$rslt=mysql_query($stmt, $link);
|
|
$row=mysql_fetch_row($rslt);
|
|
$auth=$row[0];
|
|
|
|
if ($WeBRooTWritablE > 0)
|
|
{$fp = fopen ("./project_auth_entries.txt", "a");}
|
|
|
|
$date = date("r");
|
|
$ip = getenv("REMOTE_ADDR");
|
|
$browser = getenv("HTTP_USER_AGENT");
|
|
|
|
if( (strlen($PHP_AUTH_USER)<2) or (strlen($PHP_AUTH_PW)<2) or (!$auth))
|
|
{
|
|
Header("WWW-Authenticate: Basic realm=\"VICI-PROJECTS\"");
|
|
Header("HTTP/1.0 401 Unauthorized");
|
|
echo "Unzulässiges Username/Kennwort:|$PHP_AUTH_USER|$PHP_AUTH_PW|\n";
|
|
exit;
|
|
}
|
|
else
|
|
{
|
|
if ($auth>0)
|
|
{
|
|
$office_no=strtoupper($PHP_AUTH_USER);
|
|
$password=strtoupper($PHP_AUTH_PW);
|
|
$stmt="SELECT full_name,modify_leads from vicidial_users where user='$PHP_AUTH_USER' and pass='$PHP_AUTH_PW'";
|
|
$rslt=mysql_query($stmt, $link);
|
|
$row=mysql_fetch_row($rslt);
|
|
$LOGfullname = $row[0];
|
|
$LOGmodify_leads = $row[1];
|
|
|
|
if ($WeBRooTWritablE > 0)
|
|
{
|
|
fwrite ($fp, "VICIDIAL|GOOD|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|$LOGfullname|\n");
|
|
fclose($fp);
|
|
}
|
|
}
|
|
else
|
|
{
|
|
if ($WeBRooTWritablE > 0)
|
|
{
|
|
fwrite ($fp, "VICIDIAL|FAIL|$date|$PHP_AUTH_USER|$PHP_AUTH_PW|$ip|$browser|\n");
|
|
fclose($fp);
|
|
}
|
|
}
|
|
}
|
|
|
|
?>
|
|
<html>
|
|
<head>
|
|
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">
|
|
<title>ADMINISTRATION: Leitung Suche
|
|
<?php
|
|
|
|
##### BEGIN Set variables to make header show properly #####
|
|
$ADD = '100';
|
|
$hh = 'lists';
|
|
$LOGast_admin_access = '1';
|
|
$SSoutbound_autodial_active = '1';
|
|
$ADMIN = 'admin.php';
|
|
$page_width='770';
|
|
$section_width='750';
|
|
$header_font_size='3';
|
|
$subheader_font_size='2';
|
|
$subcamp_font_size='2';
|
|
$header_selected_bold='<b>';
|
|
$header_nonselected_bold='';
|
|
$lists_color = '#FFFF99';
|
|
$lists_font = 'BLACK';
|
|
$lists_color = '#E6E6E6';
|
|
$subcamp_color = '#C6C6C6';
|
|
##### END Set variables to make header show properly #####
|
|
|
|
require("admin_header.php");
|
|
|
|
|
|
echo " Lead search: $vendor_id $phone $lead_id $status $list_id $user<BR>\n";
|
|
|
|
if ( (!$vendor_id) and (!$phone) and (!$lead_id) and ( (strlen($status)<1) and (strlen($list_id)<1) and (strlen($user)<1) ))
|
|
{
|
|
echo date("l F j, Y G:i:s A");
|
|
echo "\n<br><br><center>\n";
|
|
echo "<form method=post name=search action=\"$PHP_SELF\">\n";
|
|
echo "<input type=hidden name=DB value=\"$DB\">\n";
|
|
echo "<b>Tragen Sie bitte a ein:<br> Vendor ID(Verkäuferleitung Code): <input type=text name=vendor_id size=10 maxlength=10> or \n";
|
|
echo "<br><b>eine Haupttelefonnummer: <input type=text name=phone size=20 maxlength=16> Alt phone search: \n";
|
|
echo "<select size=1 name=alt_phone_search><option>No</option><option>Yes</option><option SELECTED>$alt_phone_search</option></select> or \n";
|
|
echo "<br><b>eine Leitung Identifikation: <input type=text name=lead_id size=10 maxlength=10> or\n";
|
|
echo "<br><b>status: <input type=text name=status size=7 maxlength=6> \n";
|
|
echo "<b>list ID: <input type=text name=list_id size=15 maxlength=14> \n";
|
|
echo "<b>user: <input type=text name=user size=15 maxlength=20> <br><br>\n";
|
|
echo "<input type=submit name=submit value=SUBMIT></b>\n";
|
|
echo "</form>\n</center>\n";
|
|
echo "</body></html>\n";
|
|
exit;
|
|
}
|
|
|
|
else
|
|
{
|
|
|
|
if ($vendor_id)
|
|
{
|
|
$stmt="SELECT $vicidial_list_fields from vicidial_list where vendor_lead_code='" . mysql_real_escape_string($vendor_id) . "'";
|
|
}
|
|
else
|
|
{
|
|
if ($phone)
|
|
{
|
|
if ($alt_phone_search=="Yes")
|
|
{
|
|
$stmt="SELECT $vicidial_list_fields from vicidial_list where phone_number='" . mysql_real_escape_string($phone) . "' or alt_phone='" . mysql_real_escape_string($phone) . "' or address3='" . mysql_real_escape_string($phone) . "'";
|
|
}
|
|
else
|
|
{
|
|
$stmt="SELECT $vicidial_list_fields from vicidial_list where phone_number='" . mysql_real_escape_string($phone) . "'";
|
|
}
|
|
}
|
|
else
|
|
{
|
|
if ($lead_id)
|
|
{
|
|
$stmt="SELECT $vicidial_list_fields from vicidial_list where lead_id='" . mysql_real_escape_string($lead_id) . "'";
|
|
}
|
|
else
|
|
{
|
|
if ( (strlen($status)>0) or (strlen($list_id)>0) or (strlen($user)>0) )
|
|
{
|
|
$statusSQL = '';
|
|
$list_idSQL = '';
|
|
$userSQL = '';
|
|
if (strlen($status)>0)
|
|
{
|
|
$statusSQL = "status='" . mysql_real_escape_string($status) . "'"; $SQLctA++;
|
|
}
|
|
if (strlen($list_id)>0)
|
|
{
|
|
if ($SQLctA > 0) {$andA = 'and';}
|
|
$list_idSQL = "$andA list_id='" . mysql_real_escape_string($list_id) . "'"; $SQLctB++;
|
|
}
|
|
if (strlen($user)>0)
|
|
{
|
|
if ( ($SQLctA > 0) or ($SQLctB > 0) ) {$andB = 'and';}
|
|
$userSQL = "$andB user='" . mysql_real_escape_string($user) . "'";
|
|
}
|
|
$stmt="SELECT $vicidial_list_fields from vicidial_list where $statusSQL $list_idSQL $userSQL";
|
|
}
|
|
else
|
|
{
|
|
print "ERROR: you must search for something! Go back and search for something";
|
|
exit;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
$stmt_alt='';
|
|
$results_to_printX=0;
|
|
if ( ($alt_phone_search=="Yes") and (strlen($phone) > 4) )
|
|
{
|
|
$stmtX="SELECT lead_id from vicidial_list_alt_phones where phone_number='" . mysql_real_escape_string($phone) . "' limit 1000;";
|
|
$rsltX=mysql_query($stmtX, $link);
|
|
$results_to_printX = mysql_num_rows($rsltX);
|
|
if ($DB)
|
|
{echo "\n\n$results_to_printX|$stmtX\n\n";}
|
|
$o=0;
|
|
while ($results_to_printX > $o)
|
|
{
|
|
$row=mysql_fetch_row($rsltX);
|
|
if ($o > 0) {$stmt_alt .= ",";}
|
|
$stmt_alt .= "'$row[0]'";
|
|
$o++;
|
|
}
|
|
if (strlen($stmt_alt) > 2)
|
|
{$stmt_alt = "or lead_id IN($stmt_alt)";}
|
|
}
|
|
|
|
$stmt = "$stmt$stmt_alt order by modify_date desc limit 1000;";
|
|
|
|
if ($DB)
|
|
{
|
|
echo "\n\n$stmt\n\n";
|
|
}
|
|
|
|
$rslt=mysql_query("$stmt", $link);
|
|
$results_to_print = mysql_num_rows($rslt);
|
|
if ( ($results_to_print < 1) and ($results_to_printX < 1) )
|
|
{
|
|
echo date("l F j, Y G:i:s A");
|
|
echo "\n<br><br><center>\n";
|
|
echo "<b>Die Suchvariablen, die Sie eintrugen, sind nicht im System aktiv</b><br><br>\n";
|
|
echo "<b>Bitte zurück und verdoppeln Überprüfung gehen die Informationen,die Sie eintrugen und reichen wieder ein</b>\n";
|
|
echo "</center>\n";
|
|
echo "</body></html>\n";
|
|
exit;
|
|
}
|
|
else
|
|
{
|
|
echo "<b>RESULTS: $results_to_print</b><BR><BR>\n";
|
|
echo "<TABLE BGCOLOR=WHITE CELLPADDING=1 CELLSPACING=0>\n";
|
|
echo "<TR BGCOLOR=BLACK>\n";
|
|
echo "<TD ALIGN=LEFT><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>#</B></FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>LEAD ID</B></FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>STATUS</B></FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>VENDOR ID</B></FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>LAST AGENT</B></FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>LISTE IDENTIFIKATION</B></FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>PHONE</B></FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>NAME</B></FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>CITY</B></FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>SECURITY</B></FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" COLOR=WHITE><B>LAST CALL</B></FONT></TD>\n";
|
|
echo "</TR>\n";
|
|
$o=0;
|
|
while ($results_to_print > $o)
|
|
{
|
|
$row=mysql_fetch_row($rslt);
|
|
$o++;
|
|
$search_lead = $row[0];
|
|
if (eregi("1$|3$|5$|7$|9$", $o))
|
|
{$bgcolor='bgcolor="#B9CBFD"';}
|
|
else
|
|
{$bgcolor='bgcolor="#9BB9FB"';}
|
|
echo "<TR $bgcolor>\n";
|
|
echo "<TD ALIGN=LEFT><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$o</FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1><a href=\"admin_modify_lead.php?lead_id=$row[0]\" target=\"_blank\">$row[0]</a></FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[3]</FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[5]</FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[4]</FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[7]</FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[11]</FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[13] $row[15]</FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[19]</FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[28]</FONT></TD>\n";
|
|
echo "<TD ALIGN=CENTER><FONT FACE=\"ARIAL,HELVETICA\" SIZE=1>$row[31]</FONT></TD>\n";
|
|
echo "</TR>\n";
|
|
}
|
|
echo "</TABLE>\n";
|
|
}
|
|
|
|
### LOG INSERTION Admin Log Table ###
|
|
$SQL_log = "$stmt|";
|
|
$SQL_log = ereg_replace(';','',$SQL_log);
|
|
$SQL_log = addslashes($SQL_log);
|
|
$stmt="INSERT INTO vicidial_admin_log set event_date='$NOW_TIME', user='$PHP_AUTH_USER', ip_address='$ip', event_section='LEADS', event_type='SEARCH', record_id='$search_lead', event_code='ADMIN SEARCH LEAD', event_sql=\"$SQL_log\", event_notes='';";
|
|
if ($DB) {echo "|$stmt|\n";}
|
|
$rslt=mysql_query($stmt, $link);
|
|
}
|
|
|
|
|
|
|
|
|
|
$ENDtime = date("U");
|
|
|
|
$RUNtime = ($ENDtime - $STARTtime);
|
|
|
|
echo "\n\n\n<br><br><br>\n<a href=\"$PHP_SELF\">NEUE SUCHE</a>";
|
|
|
|
|
|
echo "\n\n\n<br><br><br>\nIndexlaufzeit: $RUNtime seconds";
|
|
|
|
|
|
?>
|
|
|
|
|
|
|
|
</body>
|
|
</html>
|