Changeset 10457

Timestamp:

11/01/10 15:46:35 (3 years ago)

Author:

p_lindheimer

Message:

Merged revisions 10456 via svnmerge from
http://svn.freepbx.org/modules/branches/2.8

................

r10456 | p_lindheimer | 2010-11-01 12:39:25 -0700 (Mon, 01 Nov 2010) | 17 lines

Merged revisions 10444,10447,10449-10451,10453-10455 via svnmerge from
http://svn.freepbx.org/modules/branches/2.9

........

r10444 | mbrevda | 2010-10-25 05:43:18 -0700 (Mon, 25 Oct 2010) | 1 line

re #4604 - potential injection when uploading files. Can be closed by when published/backported

........

r10454 | p_lindheimer | 2010-11-01 10:51:02 -0700 (Mon, 01 Nov 2010) | 1 line

block xss re #4615

........

r10455 | p_lindheimer | 2010-11-01 12:12:39 -0700 (Mon, 01 Nov 2010) | 1 line

changes to some of the fixes re #4604

........

................

Files:

• modules/branches/2.7 (modified) (1 prop)
• modules/branches/2.7/core/module.xml (modified) (2 diffs)
• modules/branches/2.7/core/page.trunks.php (modified) (1 diff)
• modules/branches/2.7/music/module.xml (modified) (2 diffs)
• modules/branches/2.7/music/page.music.php (modified) (6 diffs)
• modules/branches/2.7/recordings/module.xml (modified) (2 diffs)
• modules/branches/2.7/recordings/page.recordings.php (modified) (2 diffs)

modules/branches/2.7/core/module.xml

@@ -4 +4 @@
-  <category>Basic</category>
-  <name>Core</name>
-9
+10
-  <publisher>FreePBX</publisher>
-  <license>GPLv2+</license>
@@ -10 +10 @@
-  <canuninstall>no</canuninstall>
-  <changelog>
+    *2.7.0.10* #4615 (Security Bug)
-    *2.7.0.9* #4396, #4507, #4574
-    *2.7.0.8* #4089

modules/branches/2.7/core/page.trunks.php

@@ -25 +25 @@
-$action = isset($_REQUEST['action'])?$_REQUEST['action']:'';
-
-$_REQUEST['tech']
+htmlentities($_REQUEST['tech'])
-$outcid       = isset($_REQUEST['outcid'])?$_REQUEST['outcid']:'';
-$maxchans     = isset($_REQUEST['maxchans'])?$_REQUEST['maxchans']:'';

modules/branches/2.7/music/module.xml

@@ -2 +2 @@
-  <rawname>music</rawname>
-  <name>Music on Hold</name>
-5
+6
-  <publisher>FreePBX</publisher>
-  <license>GPLv2+</license>
@@ -11 +11 @@
-  <description>Uploading and management of sound files (wav, mp3) to be used for on-hold music.</description>
-  <changelog>
+    *2.7.0.6* #4615 (Security Bug)
-    *2.7.0.5* #4261
-    *2.7.0.4* #4157

modules/branches/2.7/music/page.music.php

@@ -19 +19 @@
-$randoff = isset($_REQUEST['randoff'])?$_REQUEST['randoff']:'';
-$category = strtr(isset($_REQUEST['category'])?$_REQUEST['category']:''," ./\"\'\`", "------");
+$volume = isset($_REQUEST['volume']) && is_numeric($_REQUEST['volume']) ? $_REQUEST['volume'] : '';
-
-// Determine default path to music directory, old default was mohmp3, now settable
@@ -207 +208 @@
-  $output = 0;
-  $returncode = 0;
+  $mohfile = escapeshellcmd($mohfile);
-  $origmohfile=$path_to_dir."/orig_".$mohfile;
-  if ($amp_conf['AMPMPG123']) {
@@ -427 +429 @@
-    <tr>
-      <td><a href="#" class="info"><?php echo _("Optional Format:")?><span><?php echo _("Optional value for \"format=\" line used to provide the format to Asterisk. This should be a format understood by Asterisk such as ulaw, and is specific to the streaming application you are using. See information on musiconhold.conf configuration for different audio and Internet streaming source options.")?> </span></a></td>
-$format
+htmlentities($format)
-    </tr>
-    <tr>
@@ -505 +507 @@
-      echo "<h5> PHP "._("Error Processing")."! "._("No file provided")." "._("Please select a file to upload")."</h5>";
-    } else {
-$_FILES['mohfile']['name']
+htmlentities($_FILES['mohfile']['name'])
-    }
-  }
@@ -513 +515 @@
-
-    if ($amp_conf['AMPMPG123']) {
-_REQUEST['volume']
+volume
-    } else {
-      $process_err = process_mohfile($_FILES['mohfile']['name'],($_REQUEST['onlywav'] != ''));
@@ -519 +521 @@
-
-    if (isset($process_err)) {
-$_FILES['mohfile']['name']
+htmlentities($_FILES['mohfile']['name'])
-      echo "<h5>"._("This is not a fatal error, your Music on Hold may still work.")."</h5>\n";
-    } else {
-$_FILES['mohfile']['name']
+htmlentities($_FILES['mohfile']['name'])
-    }
-    needreload();

modules/branches/2.7/recordings/module.xml

@@ -2 +2 @@
-  <rawname>recordings</rawname>
-  <name>Recordings</name>
-8
+9
-  <publisher>FreePBX</publisher>
-  <license>GPLv2+</license>
@@ -11 +11 @@
-  <description>Creates and manages system recordings, used by many other modules (eg, IVR).</description>
-  <changelog>
+    *3.3.9.9* #4615 (Security Bug)
-    *3.3.9.8* #4568 Security Patch
-    *3.3.9.7* #4553 Security Patch

modules/branches/2.7/recordings/page.recordings.php

@@ -19 +19 @@
-// Lite weight popup code here, don't need everything else below
-//
+
-switch ($action) {
-  case 'popup':
@@ -79 +80 @@
-    break;
-  case "recorded":
-
+suffix,
-    $filename = escapeshellcmd(strtr($rname, '/ ', '__'));
+    $suffix = escapeshellcmd(strtr($suffix, '/ ', '__'));
-    if (!file_exists($astsnd."custom")) {
-      if (!mkdir($astsnd."custom", 0775)) {