mattf
9c4311ef65
Fixes for issue #699 Fix for issue #697 git-svn-id: svn://192.168.202.10@2017 3d104415-ff17-0410-8863-d5cf3c621b8a
102 lines
3.1 KiB
PHP
102 lines
3.1 KiB
PHP
<?php
|
|
# listloaderMAIN.php
|
|
#
|
|
# Copyright (C) 2013 Matt Florell,Joe Johnson <vicidial@gmail.com> LICENSE: AGPLv2
|
|
#
|
|
# this is the main frame page for the lead loading section. This is where you
|
|
# would upload a file and have it inserted into vicidial_list
|
|
#
|
|
# changes:
|
|
# 60620-1149 - Added variable filtering to eliminate SQL injection attack threat
|
|
# 60822-1105 - fixed for nonwritable directories
|
|
# 90508-0644 - Changed to PHP long tags
|
|
# 120223-2151 - Removed logging of good login passwords if webroot writable is enabled
|
|
# 130610-1111 - Finalized changing of all ereg instances to preg
|
|
# 130618-0035 - Added filtering of input to prevent SQL injection attacks and new user auth
|
|
# 130901-0901 - Changed to mysqli PHP functions
|
|
#
|
|
|
|
require("dbconnect_mysqli.php");
|
|
require("functions.php");
|
|
|
|
$PHP_AUTH_USER=$_SERVER['PHP_AUTH_USER'];
|
|
$PHP_AUTH_PW=$_SERVER['PHP_AUTH_PW'];
|
|
$PHP_SELF=$_SERVER['PHP_SELF'];
|
|
|
|
#############################################
|
|
##### START SYSTEM_SETTINGS LOOKUP #####
|
|
$stmt = "SELECT use_non_latin,webroot_writable,outbound_autodial_active,user_territories_active FROM system_settings;";
|
|
$rslt=mysql_to_mysqli($stmt, $link);
|
|
if ($DB) {echo "$stmt\n";}
|
|
$qm_conf_ct = mysqli_num_rows($rslt);
|
|
if ($qm_conf_ct > 0)
|
|
{
|
|
$row=mysqli_fetch_row($rslt);
|
|
$non_latin = $row[0];
|
|
$webroot_writable = $row[1];
|
|
$SSoutbound_autodial_active = $row[2];
|
|
$user_territories_active = $row[3];
|
|
}
|
|
##### END SETTINGS LOOKUP #####
|
|
###########################################
|
|
|
|
if ($non_latin < 1)
|
|
{
|
|
$PHP_AUTH_USER = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_USER);
|
|
$PHP_AUTH_PW = preg_replace('/[^-_0-9a-zA-Z]/', '', $PHP_AUTH_PW);
|
|
}
|
|
else
|
|
{
|
|
$PHP_AUTH_PW = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_PW);
|
|
$PHP_AUTH_USER = preg_replace("/'|\"|\\\\|;/","",$PHP_AUTH_USER);
|
|
}
|
|
|
|
$STARTtime = date("U");
|
|
$TODAY = date("Y-m-d");
|
|
$NOW_TIME = date("Y-m-d H:i:s");
|
|
$FILE_datetime = $STARTtime;
|
|
$date = date("r");
|
|
$ip = getenv("REMOTE_ADDR");
|
|
$browser = getenv("HTTP_USER_AGENT");
|
|
|
|
$auth=0;
|
|
$auth_message = user_authorization($PHP_AUTH_USER,$PHP_AUTH_PW,'',1);
|
|
if ($auth_message == 'GOOD')
|
|
{$auth=1;}
|
|
|
|
if ($auth < 1)
|
|
{
|
|
$VDdisplayMESSAGE = "Login incorrect, please try again";
|
|
if ($auth_message == 'LOCK')
|
|
{
|
|
$VDdisplayMESSAGE = "Too many login attempts, try again in 15 minutes";
|
|
Header ("Content-type: text/html; charset=utf-8");
|
|
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$auth_message|\n";
|
|
exit;
|
|
}
|
|
Header("WWW-Authenticate: Basic realm=\"CONTACT-CENTER-ADMIN\"");
|
|
Header("HTTP/1.0 401 Unauthorized");
|
|
echo "$VDdisplayMESSAGE: |$PHP_AUTH_USER|$PHP_AUTH_PW|$auth_message|\n";
|
|
exit;
|
|
}
|
|
|
|
$stmt="SELECT load_leads from vicidial_users where user='$PHP_AUTH_USER';";
|
|
$rslt=mysql_to_mysqli($stmt, $link);
|
|
$row=mysqli_fetch_row($rslt);
|
|
$LOGload_leads = $row[0];
|
|
|
|
if ($LOGload_leads < 1)
|
|
{
|
|
echo "You do not have permissions to load leads\n";
|
|
exit;
|
|
}
|
|
|
|
?><HTML>
|
|
<HEAD>
|
|
<TITLE>Lead Loader Module</TITLE>
|
|
</HEAD>
|
|
<FRAMESET ROWS="300,*" border=0>
|
|
<FRAME SRC="listloader.php" NAME="main">
|
|
<FRAME SRC="count.htm" NAME="lead_count">
|
|
</HTML>
|