Changeset 6527

Show
Ignore:
Timestamp:
08/31/08 20:20:32 (5 years ago)
Author:
p_lindheimer
Message:

closes #3138 replace addslashes with Pear's escapeSimple

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • modules/branches/2.5/announcement/functions.inc.php

    r6128 r6527  
    130130function announcement_get($announcement_id) { 
    131131  global $db; 
    132   $sql = "SELECT announcement_id, description, recording_id, allow_skip, post_dest, return_ivr, noanswer, repeat_msg FROM announcement WHERE announcement_id = '".addslashes($announcement_id)."'"; 
     132  $sql = "SELECT announcement_id, description, recording_id, allow_skip, post_dest, return_ivr, noanswer, repeat_msg FROM announcement WHERE announcement_id = '".$db->escapeSimple($announcement_id)."'"; 
    133133  $row = $db->getRow($sql,DB_FETCHMODE_ASSOC); 
    134134  if(DB::IsError($row)) { 
    …… 
    148148  global $db; 
    149149  $sql = "INSERT INTO announcement (description, recording_id, allow_skip, post_dest, return_ivr, noanswer, repeat_msg) VALUES (". 
    150     "'".addslashes($description)."', ". 
     150    "'".$db->escapeSimple($description)."', ". 
    151151    "'".$recording_id."', ". 
    152152    "'".($allow_skip ? 1 : 0)."', ". 
    153     "'".addslashes($post_dest)."', ". 
     153    "'".$db->escapeSimple($post_dest)."', ". 
    154154    "'".($return_ivr ? 1 : 0)."', ". 
    155155    "'".($noanswer ? 1 : 0)."', ". 
    156     "'".addslashes($repeat_msg)."')"; 
     156    "'".$db->escapeSimple($repeat_msg)."')"; 
    157157  $result = $db->query($sql); 
    158158  if(DB::IsError($result)) { 
    …… 
    163163function announcement_delete($announcement_id) { 
    164164  global $db; 
    165   $sql = "DELETE FROM announcement WHERE announcement_id = ".addslashes($announcement_id); 
     165  $sql = "DELETE FROM announcement WHERE announcement_id = ".$db->escapeSimple($announcement_id); 
    166166  $result = $db->query($sql); 
    167167  if(DB::IsError($result)) { 
    …… 
    174174  global $db; 
    175175  $sql = "UPDATE announcement SET ". 
    176     "description = '".addslashes($description)."', ". 
     176    "description = '".$db->escapeSimple($description)."', ". 
    177177    "recording_id = '".$recording_id."', ". 
    178178    "allow_skip = '".($allow_skip ? 1 : 0)."', ". 
    179     "post_dest = '".addslashes($post_dest)."', ". 
     179    "post_dest = '".$db->escapeSimple($post_dest)."', ". 
    180180    "return_ivr = '".($return_ivr ? 1 : 0)."', ". 
    181181    "noanswer = '".($noanswer ? 1 : 0)."', ". 
    182     "repeat_msg = '".addslashes($repeat_msg)."' ". 
    183     "WHERE announcement_id = ".addslashes($announcement_id); 
     182    "repeat_msg = '".$db->escapeSimple($repeat_msg)."' ". 
     183    "WHERE announcement_id = ".$db->escapeSimple($announcement_id); 
    184184  $result = $db->query($sql); 
    185185  if(DB::IsError($result)) { 

  • modules/branches/2.5/core/functions.inc.php

    r6521 r6527  
    18281828 
    18291829function core_did_edit($old_extension,$old_cidnum, $incoming){ 
    1830  
    1831   $old_extension = addslashes(trim($old_extension)); 
    1832   $old_cidnum = addslashes(trim($old_cidnum)); 
     1830  global $db; 
     1831 
     1832  $old_extension = $db->escapeSimple(trim($old_extension)); 
     1833  $old_cidnum = $db->escapeSimple(trim($old_cidnum)); 
    18331834 
    18341835  $incoming['extension'] = trim($incoming['extension']); 
    18351836  $incoming['cidnum'] = trim($incoming['cidnum']); 
    18361837 
    1837   $extension = addslashes($incoming['extension']); 
    1838   $cidnum = addslashes($incoming['cidnum']); 
     1838  $extension = $db->escapeSimple($incoming['extension']); 
     1839  $cidnum = $db->escapeSimple($incoming['cidnum']); 
    18391840 
    18401841  // if did or cid changed, then check to make sure that this pair is not already being used. 
    …… 
    18551856 
    18561857function core_did_add($incoming,$target=false){ 
    1857   foreach ($incoming as $key => $val) { ${$key} = addslashes($val); } // create variables from request 
     1858  global $db; 
     1859  foreach ($incoming as $key => $val) { ${$key} = $db->escapeSimple($val); } // create variables from request 
    18581860 
    18591861  // Check to make sure the did is not being used elsewhere 
    …… 
    19281930  global $currentFile; 
    19291931  global $astman; 
     1932  global $db; 
    19301933 
    19311934  $display = isset($_REQUEST['display'])?$_REQUEST['display']:''; 
    …… 
    19671970  if(!get_magic_quotes_gpc()) { 
    19681971    if(!empty($emergency_cid)) 
    1969       $emergency_cid = addslashes($emergency_cid); 
     1972      $emergency_cid = $db->escapeSimple($emergency_cid); 
    19701973    if(!empty($description)) 
    1971       $description = addslashes($description); 
     1974      $description = $db->escapeSimple($description); 
    19721975  } 
    19731976   
    …… 
    21702173  global $amp_conf; 
    21712174  global $astman; 
     2175  global $db; 
    21722176 
    21732177  $sql = "SELECT * FROM users"; 
    …… 
    21822186      $astman->database_put("AMPUSER",$extension."/noanswer",$noanswer); 
    21832187      $astman->database_put("AMPUSER",$extension."/recording",$recording); 
    2184       $astman->database_put("AMPUSER",$extension."/outboundcid","\"".addslashes($outboundcid)."\""); 
    2185       $astman->database_put("AMPUSER",$extension."/cidname","\"".addslashes($name)."\""); 
     2188      $astman->database_put("AMPUSER",$extension."/outboundcid","\"".$db->escapeSimple($outboundcid)."\""); 
     2189      $astman->database_put("AMPUSER",$extension."/cidname","\"".$db->escapeSimple($name)."\""); 
    21862190      $astman->database_put("AMPUSER",$extension."/voicemail","\"".$voicemail."\""); 
    21872191    }  
    …… 
    25962600  } 
    25972601 
    2598   $newdid_name = isset($newdid_name) ? addslashes($newdid_name) : ''; 
     2602  $newdid_name = isset($newdid_name) ? $db->escapeSimple($newdid_name) : ''; 
    25992603  $newdid = isset($newdid) ? $newdid : ''; 
    26002604  $newdid = preg_replace("/[^0-9._XxNnZz\[\]\-\+]/" ,"", trim($newdid)); 
    …… 
    26342638  //escape quotes and any other bad chars: 
    26352639  if(!get_magic_quotes_gpc()) { 
    2636     $outboundcid = addslashes($outboundcid); 
    2637     $name = addslashes($name); 
     2640    $outboundcid = $db->escapeSimple($outboundcid); 
     2641    $name = $db->escapeSimple($name); 
    26382642  } 
    26392643 
    …… 
    28452849  // clean and check the did to make sure it is not being used by another extension or in did routing 
    28462850  // 
    2847   $newdid_name = isset($newdid_name) ? addslashes($newdid_name) : ''; 
     2851  $newdid_name = isset($newdid_name) ? $db->escapeSimple($newdid_name) : ''; 
    28482852  $newdid = isset($vars['newdid']) ? $vars['newdid'] : ''; 
    28492853  $newdid = preg_replace("/[^0-9._XxNnZz\[\]\-\+]/" ,"", trim($newdid)); 

  • modules/branches/2.5/core/install.php

    r6521 r6527  
    1717 
    1818  foreach ($incoming as $key => $val) {  
    19     ${$key} = addslashes($val);  
     19    ${$key} = $db->escapeSimple($val);  
    2020  }  
    2121 

  • modules/branches/2.5/daynight/functions.inc.php

    r6300 r6527  
    264264 
    265265function daynight_edit($post, $id=0) { 
     266  global $db; 
    266267 
    267268  // TODO: Probably have separate add and edit (and change in page.daynight.php also) 
    …… 
    282283  } 
    283284  $fc_description = isset($post['fc_description']) ? trim($post['fc_description']) : ""; 
    284   sql("INSERT INTO daynight (ext, dmode, dest) VALUES ('$id', 'fc_description', '".addslashes($fc_description)."')"); 
     285  sql("INSERT INTO daynight (ext, dmode, dest) VALUES ('$id', 'fc_description', '".$db->escapeSimple($fc_description)."')"); 
    285286 
    286287  $dn = new dayNightObject($id); 

  • modules/branches/2.5/disa/functions.inc.php

    r6428 r6527  
    170170 
    171171function disa_add($post) { 
     172  global $db; 
    172173  if(!disa_chk($post)) { 
    173174    return null; 
    …… 
    179180      $displayname = "unnamed"; 
    180181    } 
    181     $results = sql("INSERT INTO disa (displayname,pin,cid,context,resptimeout,digittimeout,needconf,hangup) values ('".addslashes($displayname)."','".addslashes($pin)."','".addslashes($cid)."','".addslashes($context)."', '".addslashes($resptimeout)."', '".addslashes($digittimeout)."', '$needconf', '$hangup')"); 
     182    $results = sql("INSERT INTO disa (displayname,pin,cid,context,resptimeout,digittimeout,needconf,hangup) values ('".$db->escapeSimple($displayname)."','".$db->escapeSimple($pin)."','".$db->escapeSimple($cid)."','".$db->escapeSimple($context)."', '".$db->escapeSimple($resptimeout)."', '".$db->escapeSimple($digittimeout)."', '$needconf', '$hangup')"); 
    182183} 
    183184 
    …… 
    188189 
    189190function disa_edit($id, $post) { 
     191  global $db; 
    190192  if (!disa_chk($post)) { 
    191193    return null; 
    …… 
    198200    $displayname = "unnamed"; 
    199201  } 
    200   $results = sql("UPDATE disa  set displayname = '".addslashes($displayname)."', pin = '".addslashes($pin)."', cid = '".addslashes($cid)."', context = '".addslashes($context)."', resptimeout = '".addslashes($resptimeout)."', digittimeout = '".addslashes($digittimeout)."', needconf = \"$needconf\", hangup = \"$hangup\" where disa_id = '$id'"); 
     202  $results = sql("UPDATE disa  set displayname = '".$db->escapeSimple($displayname)."', pin = '".$db->escapeSimple($pin)."', cid = '".$db->escapeSimple($cid)."', context = '".$db->escapeSimple($context)."', resptimeout = '".$db->escapeSimple($resptimeout)."', digittimeout = '".$db->escapeSimple($digittimeout)."', needconf = \"$needconf\", hangup = \"$hangup\" where disa_id = '$id'"); 
    201203} 
    202204?> 

  • modules/branches/2.5/languages/functions.inc.php

    r6485 r6527  
    8383function languages_get($language_id) { 
    8484  global $db; 
    85   $sql = "SELECT language_id, description, lang_code, dest FROM languages WHERE language_id = ".addslashes($language_id); 
     85  $sql = "SELECT language_id, description, lang_code, dest FROM languages WHERE language_id = ".$db->escapeSimple($language_id); 
    8686  $row = $db->getRow($sql, DB_FETCHMODE_ASSOC); 
    8787  if(DB::IsError($row)) { 
    …… 
    9595  global $db; 
    9696  $sql = "INSERT INTO languages (description, lang_code, dest) VALUES (". 
    97     "'".addslashes($description)."', ". 
    98     "'".addslashes($lang_code)."', ". 
    99     "'".addslashes($dest)."')"; 
     97    "'".$db->escapeSimple($description)."', ". 
     98    "'".$db->escapeSimple($lang_code)."', ". 
     99    "'".$db->escapeSimple($dest)."')"; 
    100100  $result = $db->query($sql); 
    101101  if(DB::IsError($result)) { 
    …… 
    106106function languages_delete($language_id) { 
    107107  global $db; 
    108   $sql = "DELETE FROM languages WHERE language_id = ".addslashes($language_id); 
     108  $sql = "DELETE FROM languages WHERE language_id = ".$db->escapeSimple($language_id); 
    109109  $result = $db->query($sql); 
    110110  if(DB::IsError($result)) { 
    …… 
    116116  global $db; 
    117117  $sql = "UPDATE languages SET ". 
    118     "description = '".addslashes($description)."', ". 
    119     "lang_code = '".addslashes($lang_code)."', ". 
    120     "dest = '".addslashes($dest)."' ". 
    121     "WHERE language_id = ".addslashes($language_id); 
     118    "description = '".$db->escapeSimple($description)."', ". 
     119    "lang_code = '".$db->escapeSimple($lang_code)."', ". 
     120    "dest = '".$db->escapeSimple($dest)."' ". 
     121    "WHERE language_id = ".$db->escapeSimple($language_id); 
    122122  $result = $db->query($sql); 
    123123  if(DB::IsError($result)) { 

  • modules/branches/2.5/miscapps/functions.inc.php

    r5276 r6527  
    5555function miscapps_get($miscapps_id) { 
    5656  global $db; 
    57   $sql = "SELECT miscapps_id, description, ext, dest FROM miscapps WHERE miscapps_id = ".addslashes($miscapps_id); 
     57  $sql = "SELECT miscapps_id, description, ext, dest FROM miscapps WHERE miscapps_id = ".$db->escapeSimple($miscapps_id); 
    5858  $row = $db->getRow($sql, DB_FETCHMODE_ASSOC); 
    5959  if(DB::IsError($row)) { 
    …… 
    7272  global $db; 
    7373  $sql = "INSERT INTO miscapps (description, ext, dest) VALUES (". 
    74     "'".addslashes($description)."', ". 
    75     "'".addslashes($ext)."', ". 
    76     "'".addslashes($dest)."')"; 
     74    "'".$db->escapeSimple($description)."', ". 
     75    "'".$db->escapeSimple($ext)."', ". 
     76    "'".$db->escapeSimple($dest)."')"; 
    7777  $result = $db->query($sql); 
    7878  if(DB::IsError($result)) { 
    …… 
    9393function miscapps_delete($miscapps_id) { 
    9494  global $db; 
    95   $sql = "DELETE FROM miscapps WHERE miscapps_id = ".addslashes($miscapps_id); 
     95  $sql = "DELETE FROM miscapps WHERE miscapps_id = ".$db->escapeSimple($miscapps_id); 
    9696  $result = $db->query($sql); 
    9797  if(DB::IsError($result)) { 
    …… 
    106106  global $db; 
    107107  $sql = "UPDATE miscapps SET ". 
    108     "description = '".addslashes($description)."', ". 
    109     "ext = '".addslashes($ext)."', ". 
    110     "dest = '".addslashes($dest)."' ". 
    111     "WHERE miscapps_id = ".addslashes($miscapps_id); 
     108    "description = '".$db->escapeSimple($description)."', ". 
     109    "ext = '".$db->escapeSimple($ext)."', ". 
     110    "dest = '".$db->escapeSimple($dest)."' ". 
     111    "WHERE miscapps_id = ".$db->escapeSimple($miscapps_id); 
    112112  $result = $db->query($sql); 
    113113  if(DB::IsError($result)) { 

  • modules/branches/2.5/paging/functions.inc.php

    r6347 r6527  
    400400 
    401401  // Just in case someone's trying to be smart with a SQL injection. 
    402   $grp = addslashes($grp);  
     402  $grp = $db->escapeSimple($grp);  
    403403 
    404404  $sql = "SELECT ext FROM paging_groups where page_number='$grp'"; 
    …… 
    415415 
    416416  // Just in case someone's trying to be smart with a SQL injection. 
    417   $grp = addslashes($grp);  
     417  $grp = $db->escapeSimple($grp);  
    418418 
    419419  $sql = "SELECT * FROM paging_config WHERE page_group='$grp'"; 
    …… 
    436436 
    437437  // Just in case someone's trying to be smart with a SQL injection. 
    438   $xtn = addslashes($xtn); 
     438  $xtn = $db->escapeSimple($xtn); 
    439439 
    440440  // Delete it if it's there. 
    …… 
    480480  } 
    481481  foreach (array_keys($xtns) as $val) { 
    482     $val = addslashes(trim($xtns[$val])); 
     482    $val = $db->escapeSimple(trim($xtns[$val])); 
    483483    // Sanity check input. 
    484484     
    …… 
    487487  } 
    488488   
    489   $description = addslashes(trim($description)); 
     489  $description = $db->escapeSimple(trim($description)); 
    490490  $sql = "INSERT INTO paging_config(page_group, force_page, duplex, description) VALUES ('$xtn', '$force_page', '$duplex', '$description')"; 
    491491  $db->query($sql); 

  • modules/branches/2.5/queueprio/functions.inc.php

    r6485 r6527  
    6868function queueprio_get($queueprio_id) { 
    6969  global $db; 
    70   $sql = "SELECT queueprio_id, description, queue_priority, dest FROM queueprio WHERE queueprio_id = ".addslashes($queueprio_id); 
     70  $sql = "SELECT queueprio_id, description, queue_priority, dest FROM queueprio WHERE queueprio_id = ".$db->escapeSimple($queueprio_id); 
    7171  $row = $db->getRow($sql, DB_FETCHMODE_ASSOC); 
    7272  if(DB::IsError($row)) { 
    …… 
    8080  global $db; 
    8181  $sql = "INSERT INTO queueprio (description, queue_priority, dest) VALUES (". 
    82     "'".addslashes($description)."', ". 
    83     "'".addslashes($queue_priority)."', ". 
    84     "'".addslashes($dest)."')"; 
     82    "'".$db->escapeSimple($description)."', ". 
     83    "'".$db->escapeSimple($queue_priority)."', ". 
     84    "'".$db->escapeSimple($dest)."')"; 
    8585  $result = $db->query($sql); 
    8686  if(DB::IsError($result)) { 
    …… 
    9191function queueprio_delete($queueprio_id) { 
    9292  global $db; 
    93   $sql = "DELETE FROM queueprio WHERE queueprio_id = ".addslashes($queueprio_id); 
     93  $sql = "DELETE FROM queueprio WHERE queueprio_id = ".$db->escapeSimple($queueprio_id); 
    9494  $result = $db->query($sql); 
    9595  if(DB::IsError($result)) { 
    …… 
    101101  global $db; 
    102102  $sql = "UPDATE queueprio SET ". 
    103     "description = '".addslashes($description)."', ". 
    104     "queue_priority = '".addslashes($queue_priority)."', ". 
    105     "dest = '".addslashes($dest)."' ". 
    106     "WHERE queueprio_id = ".addslashes($queueprio_id); 
     103    "description = '".$db->escapeSimple($description)."', ". 
     104    "queue_priority = '".$db->escapeSimple($queue_priority)."', ". 
     105    "dest = '".$db->escapeSimple($dest)."' ". 
     106    "WHERE queueprio_id = ".$db->escapeSimple($queueprio_id); 
    107107  $result = $db->query($sql); 
    108108  if(DB::IsError($result)) { 

  • modules/branches/2.5/queues/functions.inc.php

    r6447 r6527  
    422422  } 
    423423  $extension     = $account; 
    424   $descr         = isset($name) ? addslashes($name):''; 
    425   $grppre        = isset($prefix) ? addslashes($prefix):''; 
    426   $alertinfo     = isset($alertinfo) ? addslashes($alertinfo):''; 
     424  $descr         = isset($name) ? $db->escapeSimple($name):''; 
     425  $grppre        = isset($prefix) ? $db->escapeSimple($prefix):''; 
     426  $alertinfo     = isset($alertinfo) ? $db->escapeSimple($alertinfo):''; 
    427427  //$joinannounce_id  = $joinannounce_id; 
    428428  $ringing       = isset($_REQUEST['rtone']) ? $_REQUEST['rtone']:''; 
    …… 
    434434  $cwignore      = isset($cwignore) ? $cwignore:'0'; 
    435435  $queuewait     = isset($queuewait) ? $queuewait:'0'; 
    436   $qregex        = isset($qregex) ? addslashes($qregex):''; 
     436  $qregex        = isset($qregex) ? $db->escapeSimple($qregex):''; 
    437437 
    438438  // Assumes it has just been deleted 

  • modules/branches/2.5/recordings/functions.inc.php

    r6160 r6527  
    176176    $fname = $filename; 
    177177  } 
    178   $description = ($description != '') ? addslashes($description) : _("No long description available"); 
    179   $displayname = addslashes($displayname); 
     178  $description = ($description != '') ? $db->escapeSimple($description) : _("No long description available"); 
     179  $displayname = $db->escapeSimple($displayname); 
    180180  sql("INSERT INTO recordings (displayname, filename, description) VALUES ( '$displayname', '$fname', '$description')"); 
    181181 
    …… 
    185185 
    186186function recordings_update($id, $rname, $descr, $_REQUEST, $fcode=0, $fcode_pass='') { 
     187  global $db; 
    187188 
    188189  // Update the descriptive fields 
    189190  $fcode_pass = preg_replace("/[^0-9*]/" ,"", trim($fcode_pass)); 
    190   $results = sql("UPDATE recordings SET displayname = '".addslashes($rname)."', description = '".addslashes($descr)."', fcode='$fcode', fcode_pass='".$fcode_pass."' WHERE id = '$id'"); 
     191  $results = sql("UPDATE recordings SET displayname = '".$db->escapeSimple($rname)."', description = '".$db->escapeSimple($descr)."', fcode='$fcode', fcode_pass='".$fcode_pass."' WHERE id = '$id'"); 
    191192   
    192193  // Build the file list from _REQUEST 
    …… 
    295296 
    296297function recordings_set_file($id, $filename) { 
     298  global $db; 
    297299  // Strip off any dangling &'s on the end: 
    298300  $filename = rtrim($filename, '&'); 
    299   $results = sql("UPDATE recordings SET filename = '".addslashes($filename)."' WHERE id = '$id'"); 
     301  $results = sql("UPDATE recordings SET filename = '".$db->escapeSimple($filename)."' WHERE id = '$id'"); 
    300302} 
    301303 

  • modules/branches/2.5/timeconditions/functions.inc.php

    r6481 r6527  
    406406  $times = isset($_REQUEST['times'])?$_REQUEST['times']:null; 
    407407 
    408   //addslashes   
    409408  switch ($action) { 
    410409    case 'add': 

  • modules/branches/2.5/vmblast/functions.inc.php

    r6347 r6527  
    148148 
    149149  foreach ($xtns as $key => $value) { 
    150     $xtns[$key] = addslashes(trim($value)); 
     150    $xtns[$key] = $db->escapeSimple(trim($value)); 
    151151  } 
    152152    // Sanity check input.