Changeset 6731

Timestamp:

09/15/08 20:38:35 (3 months ago)

Author:

p_lindheimer

Message:

closes #3184 Secruity Issue allowing access of arbitrary files from authenticated ARI users with brute force cracking of a weak encryption key

Files:

• freepbx/branches/2.5/amp_conf/htdocs/recordings/includes/login.php (modified) (1 diff)
• freepbx/branches/2.5/amp_conf/htdocs/recordings/misc/audio.php (modified) (1 diff)
• freepbx/branches/2.5/amp_conf/htdocs/recordings/misc/recording_popup.php (modified) (2 diffs)
• freepbx/branches/2.5/amp_conf/htdocs/recordings/modules/callmonitor.module (modified) (5 diffs)
• freepbx/branches/2.5/amp_conf/htdocs/recordings/modules/voicemail.module (modified) (9 diffs)

freepbx/branches/2.5/amp_conf/htdocs/recordings/includes/login.php

@@ -336 +336 @@
-        $_SESSION['ari_user']['default_page'] = $default_page;
-
-
-
+
+
+
+
+
-      } 
-    }

freepbx/branches/2.5/amp_conf/htdocs/recordings/misc/audio.php

@@ -7 +7 @@
-
-
-
-
+
-
-  chdir("..");
-  include_once("./includes/bootstrap.php");
-
- global $ARI_CRYPT_PASSWORD
+      $path = $_SESSION['ari_user']['recfiles'][$_GET['recindex']]
-
-  $crypt = new Crypt();
-
-  $path = $crypt->decrypt($_GET['recording'],$ARI_CRYPT_PASSWORD);
-
-  // strip ".." from path and retrieve absolute path from filesystem for security
-  $path = realpath(preg_replace('/\.\./','',$path));
-  
-  // See if the file exists
-  if (!is_file($path)) { die("<b>404 File not found!</b>"); }

freepbx/branches/2.5/amp_conf/htdocs/recordings/misc/recording_popup.php

@@ -23 +23 @@
-<?php
-
-
+
+
+
-
-  if (isset($path)) {
@@ -34 +36 @@
-
-    echo("<br>");
-ording=" . $path
-ording="  . $path
+index=".$_GET['recindex']
+index="  . $_GET['recindex']
-  }
-

freepbx/branches/2.5/amp_conf/htdocs/recordings/modules/callmonitor.module

@@ -60 +60 @@
-    $files = array();
-    foreach($_REQUEST as $key => $value) {
-
-value
+ && isset($_SESSION['ari_user']['recfiles'][$value])
+_SESSION['ari_user']['recfiles'][$value]
-      }
-    }
@@ -100 +100 @@
-    global $CALLMONITOR_ALLOW_DELETE;
-    global $AJAX_PAGE_REFRESH_ENABLE;
-    global $ARI_CRYPT_PASSWORD;
-
-    $display = new DisplaySearch();
-    $crypt = new Crypt();
-
-    // get the search string
@@ -204 +202 @@
-
-    // table body
+                unset($_SESSION['ari_user']['recfiles']);
-    if (is_array($data)) foreach($data as $key=>$value) {
+                        $i++;
-
-      // recording file
-      $recording = $recordings[$value['uniqueid'] . $value['calldate']];
-      $fileCrypt = $crypt->encrypt($recording,$ARI_CRYPT_PASSWORD);
-      $recordingCrypt = urlencode($fileCrypt);
-
-      // date and time
@@ -216 +214 @@
-      $time = $buf[1];
-
-      // recording delete checkbox
-      if ($CALLMONITOR_ALLOW_DELETE) {
-        $recording_delete_checkbox = "<td class='checkbox'><input type=checkbox name='selected" . ++$i . "' value=" . $fileCrypt . "></td>";
-      }
-
-      $recordingLink = '';
-      if (is_file($recordings[$value['uniqueid'] . $value['calldate']])) {
-
-
+
+
+
+
+
+
+
+
+
+
+
-    
-      $recording_body .= "<tr>
@@ -531 +534 @@
-  function deleteRecData($files) {
-
-
-
-
-
-
-
+
-      if (is_writable($file)) {
-        unlink($file);

freepbx/branches/2.5/amp_conf/htdocs/recordings/modules/voicemail.module

@@ -149 +149 @@
-    $files = array();
-    foreach($_REQUEST as $key => $value) {
-
-value
+ && isset($_SESSION['ari_user']['recfiles'][$value])
+_SESSION['ari_user']['recfiles'][$value]
-      }
-    }
@@ -208 +208 @@
-    global $ASTERISK_VOICEMAIL_FOLDERS;
-    global $AJAX_PAGE_REFRESH_ENABLE;
-    global $ARI_CRYPT_PASSWORD;
-
-    $voicemail_audio_format = $_COOKIE['ari_voicemail_audio_format'];
-
-    $display = new DisplaySearch();
-    $crypt = new Crypt();
-
-    // args
@@ -385 +383 @@
-
-    // table body
+                unset($_SESSION['ari_user']['recfiles']);
-    if (isset($data)) {
-      foreach($data as $file=>$value) {
-
+
-        // recording popup link
-        $voicemail_audio_format = $voicemail_audio_format=='' ? '.wav' : $voicemail_audio_format;
@@ -398 +397 @@
-        $duration = $value[duration];
-        if (is_file($recording)) {
-          $recordingCrypt = urlencode($crypt->encrypt($recording,$ARI_CRYPT_PASSWORD))
-  $recordingLink = "<a href='#' onClick=\"javascript:popUp('misc/recording_popup.php?recording=" . $recordingCrypt . "
+                                       $_SESSION['ari_user']['recfiles'][$i] = $recording
+                               $recordingLink = "<a href='#' onClick=\"javascript:popUp('misc/recording_popup.php?recindex=$i
-            " . _("play") . "
-          </a>";
@@ -406 +405 @@
-          $_SESSION['ari_error'] = _("Voicemail recording(s) was not found.") . "<br>" .
-                                   sprintf(_("On settings page, change voicemail audio format.  It is currently set to %s"),$voicemail_audio_format);
-
-
-
+
+
+
+
-
-        $tableText .= "
-          <tr>
-++$i . "' value=" . $fileCrypt
+$i . "' value=" . $i
-            <td width=68>" . $date . "</td>
-            <td>" . $time . "</td>
@@ -422 +422 @@
-          </tr>";
-      }
-
-
+
-    // options
-    $url_opts = array();
@@ -622 +621 @@
-  function deleteVoicemailData($files) {
-
-
-
-
-
-
-
-
-
+
-
-      // get file parts for search
@@ -666 +658 @@
-
-    global $ASTERISK_VOICEMAIL_PATH;
-    global $ARI_CRYPT_PASSWORD;
-
-    $crypt = new Crypt();
-
-    $perm = fileperms($ASTERISK_VOICEMAIL_PATH);
@@ -723 +712 @@
-    }
-
-
-
-
+
-      // add plain path to new array
-      $filesPlain[] = $pathPlain;