Changeset 6764

Timestamp:

09/17/08 11:29:39 (3 months ago)

Author:

p_lindheimer

Message:

fixes #3209 Reports SECURITY VULNERABILITY by forcing all access to the CDR Reports section to flow through config.php

Files:

• freepbx/branches/2.5/amp_conf/bin/retrieve_conf (modified) (1 diff)
• freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/about.php (modified) (1 diff)
• freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/call-comp.php (modified) (2 diffs)
• freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/call-daily-load.php (modified) (4 diffs)
• freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/call-last-month.php (modified) (2 diffs)
• freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/call-log.php (modified) (5 diffs)
• freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/cdr.php (modified) (1 diff)
• freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/css (deleted)
• freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/images/clear.gif (added)
• freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/images/corner-bl.png (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/css/images/corner-bl.png)
• freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/images/corner-br.png (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/css/images/corner-br.png)
• freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/images/corner-tl.png (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/css/images/corner-tl.png)
• freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/images/corner-tr.png (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/css/images/corner-tr.png)
• freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/lib/defines.php (modified) (2 diffs)
• freepbx/branches/2.5/amp_conf/htdocs/admin/common/content.css (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/css/content.css)
• freepbx/branches/2.5/amp_conf/htdocs/admin/common/docbook.css (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/css/docbook.css)
• freepbx/branches/2.5/amp_conf/htdocs/admin/common/encrypt.js (moved) (moved from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/encrypt.js)
• freepbx/branches/2.5/amp_conf/htdocs/admin/common/graph_hourdetail.php (moved) (moved from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/graph_hourdetail.php) (1 diff)
• freepbx/branches/2.5/amp_conf/htdocs/admin/common/graph_pie.php (moved) (moved from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/graph_pie.php) (1 diff)
• freepbx/branches/2.5/amp_conf/htdocs/admin/common/graph_stat.php (moved) (moved from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/graph_stat.php) (1 diff)
• freepbx/branches/2.5/amp_conf/htdocs/admin/common/graph_statbar.php (moved) (moved from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/graph_statbar.php) (1 diff)
• freepbx/branches/2.5/amp_conf/htdocs/admin/common/layout.css (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/css/layout.css)
• freepbx/branches/2.5/amp_conf/htdocs/admin/common/print.css (moved) (moved from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/images/print.css)
• freepbx/branches/2.5/amp_conf/htdocs/admin/config.php (modified) (1 diff)
• freepbx/branches/2.5/amp_conf/htdocs/admin/views/reports.php (modified) (1 diff)

freepbx/branches/2.5/amp_conf/bin/retrieve_conf

@@ -345 +345 @@
-        }
-}
+// Now also make sure to symlink the CDR images which is not a proper module
+//
+symlink_subdirs( $amp_conf['AMPWEBROOT'].'/admin/cdr/');
-
-// create an object of the extensions class

freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/about.php

@@ -35 +35 @@
-                <title>Asterisk CDR</title>
-                <meta http-equiv="Content-Type" content="text/html">
-/css
-.
+common
+common
-                <style type="text/css" media="screen">
-ss
-ss
-ss
+ommon
+ommon
+ommon
-                </style>
-                <meta name="MSSmartTagsPreventParsing" content="TRUE">

freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/call-comp.php

@@ -257 +257 @@
-<!-- ** ** ** ** ** Part for the research ** ** ** ** ** -->
-        <center>
-
+handler=cdr&
-        <INPUT TYPE="hidden" NAME="posted" value=1>
-                <table class="bar-status" width="75%" border="0" cellspacing="1" cellpadding="2" align="center">
@@ -522 +522 @@
-</td></tr></tbody></table>
-        <br>
-
+common/
-
-<?php  }else{ ?>

freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/call-daily-load.php

@@ -230 +230 @@
-<!-- ** ** ** ** ** Part for the research ** ** ** ** ** -->
-        <center>
-
+handler=cdr&
-        <INPUT TYPE="hidden" NAME="posted" value=1>
-                <table class="bar-status" width="75%" border="0" cellspacing="1" cellpadding="2" align="center">
@@ -482 +482 @@
-</td></tr></tbody></table>
-        <br>
-
+common/
-
-
@@ -490 +490 @@
-<br/>
-        <center>Select the hour interval to see the details
-
+common/
-        <!-- ** ** ** ** ** HOURLY LOAD ** ** ** ** ** -->
-                <table class="bar-status" width="60%" border="0" cellspacing="1" cellpadding="2" align="center">
@@ -539 +539 @@
-<br>
-<center>
-
+common/
-
-    </iframe>

freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/call-last-month.php

@@ -236 +236 @@
-<!-- ** ** ** ** ** Part for the research ** ** ** ** ** -->
-        <center>
-
+handler=cdr&
-        <INPUT TYPE="hidden" NAME="posted" value=1>
-                <table class="bar-status" width="75%" border="0" cellspacing="1" cellpadding="2" align="center">
@@ -498 +498 @@
-<?php  if ($posted==1){ ?>
-        <center>
-
+common/
-        </center>
-<?php  } ?>

freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/call-log.php

@@ -337 +337 @@
-<!-- ** ** ** ** ** Part for the research ** ** ** ** ** -->
-        <center>
-
+handler=cdr&
-        <INPUT TYPE="hidden" NAME="posted" value=1>
-        <INPUT TYPE="hidden" NAME="current_page" value=0>       
@@ -601 +601 @@
-                    <center><strong> 
-                    <?php  if (strtoupper($FG_TABLE_COL[$i][4])=="SORT"){?>
-
+handler=cdr&
-                                        echo "&posted=$posted&Period=$Period&frommonth=$frommonth&fromstatsmonth=$fromstatsmonth&tomonth=$tomonth&tostatsmonth=$tostatsmonth&fromday=$fromday&fromstatsday_sday=$fromstatsday_sday&fromstatsmonth_sday=$fromstatsmonth_sday&today=$today&tostatsday_sday=$tostatsday_sday&tostatsmonth_sday=$tostatsmonth_sday&dsttype=$dsttype&srctype=$srctype&clidtype=$clidtype&channel=$channel&resulttype=$resulttype&dst=$dst&src=$src&clid=$clid";?>"> 
-                    <span class="liens"><?php  } ?>
@@ -727 +727 @@
-                  <TD align="right"><SPAN style="COLOR: #ffffff; FONT-SIZE: 11px"><B> 
-                    <?php if ($current_page>0){?>
-
+handler=cdr&
-                                        echo "&posted=$posted&Period=$Period&frommonth=$frommonth&fromstatsmonth=$fromstatsmonth&tomonth=$tomonth&tostatsmonth=$tostatsmonth&fromday=$fromday&fromstatsday_sday=$fromstatsday_sday&fromstatsmonth_sday=$fromstatsmonth_sday&today=$today&tostatsday_sday=$tostatsday_sday&tostatsmonth_sday=$tostatsmonth_sday&dsttype=$dsttype&srctype=$srctype&clidtype=$clidtype&channel=$channel&resulttype=$resulttype&dst=$dst&src=$src&clid=$clid&channel=$channel&resulttype=$resulttype&dst=$dst&src=$src&clid=$clid&userfieldtype=$userfieldtype&userfield=$userfield&accountcodetype=$accountcodetype&accountcode=$accountcode&duration1=$duration1&duration1type=$duration1type&duration2=$duration2&duration2type=$duration2type";?>"> 
-                    Previous </a> - 
@@ -733 +733 @@
-                    <?php echo ($current_page+1);?> / <?php  echo $nb_record_max;?> 
-                    <?php if ($current_page<$nb_record_max-1){?>
-
+handler=cdr&
-                                        echo "&posted=$posted&Period=$Period&frommonth=$frommonth&fromstatsmonth=$fromstatsmonth&tomonth=$tomonth&tostatsmonth=$tostatsmonth&fromday=$fromday&fromstatsday_sday=$fromstatsday_sday&fromstatsmonth_sday=$fromstatsmonth_sday&today=$today&tostatsday_sday=$tostatsday_sday&tostatsmonth_sday=$tostatsmonth_sday&dsttype=$dsttype&srctype=$srctype&clidtype=$clidtype&channel=$channel&resulttype=$resulttype&dst=$dst&src=$src&clid=$clid&channel=$channel&resulttype=$resulttype&dst=$dst&src=$src&clid=$clid&userfieldtype=$userfieldtype&userfield=$userfield&accountcodetype=$accountcodetype&accountcode=$accountcode&duration1=$duration1&duration1type=$duration1type&duration2=$duration2&duration2type=$duration2type";?>"> 
-                    Next </a> <img src="images/fleche-d.gif" width="5" height="10"> 
@@ -882 +882 @@
-<br/>
-<table width="60%"><tr><td>
-export_pdf.php" target="_blank"><img src="./images/pdf.png    " border="0"/></a> <a href="export_pdf.php
+config.php?handler=cdr_export_pdf" target="_blank"><img src="./images/pdf.png " border="0"/></a> <a href="config.php?handler=cdr_export_pdf
-</td>
-<td>
-export_csv.php" target="_blank" ><img src="./images/excel.png" border="0"/></a> <a href="export_csv.php
+config.php?handler=cdr_export_csv" target="_blank" ><img src="./images/excel.png" border="0"/></a> <a href="config.php?handler=cdr_export_csv
-</td></tr></table>
-

freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/cdr.php

@@ -50 +50 @@
-                <title>Asterisk CDR</title>
-                <meta http-equiv="Content-Type" content="text/html">
-/css
-.
+common
+common
-                <style type="text/css" media="screen">
-ss
-ss
-ss
+ommon
+ommon
+ommon
-                </style>
-                <meta name="MSSmartTagsPreventParsing" content="TRUE">

freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/lib/defines.php

@@ -3 +3 @@
-require_once('DB.php'); // PEAR
-
+if (!function_exists('parse_amportal_conf')) {
-function parse_amportal_conf($filename) {
-        $file = file($filename);
@@ -11 +12 @@
-        }
-        return $conf;
+}
-}
-

freepbx/branches/2.5/amp_conf/htdocs/admin/common/graph_hourdetail.php

@@ -1 +1 @@
-<?php /* $Id$ */
-
-
-
-
-
+../cdr/
+../cdr/
+../cdr/
+../cdr/
+../cdr/
-
-

freepbx/branches/2.5/amp_conf/htdocs/admin/common/graph_pie.php

@@ -1 +1 @@
-<?php /* $Id$ */
-
-
-
-
-
+../cdr/
+../cdr/
+../cdr/
+../cdr/
+../cdr/
-
-

freepbx/branches/2.5/amp_conf/htdocs/admin/common/graph_stat.php

@@ -1 +1 @@
-<?php
-
-
-
-
+../cdr/
+../cdr/
+../cdr/
+../cdr/
-
-// this variable specifie the debug type (0 => nothing, 1 => sql result, 2 => boucle checking, 3 other value checking)

freepbx/branches/2.5/amp_conf/htdocs/admin/common/graph_statbar.php

@@ -1 +1 @@
-<?php /* $Id$ */
-
-
-
-
+../cdr/
+../cdr/
+../cdr/
+../cdr/
-
-// this variable specifie the debug type (0 => nothing, 1 => sql result, 2 => boucle checking, 3 other value checking)

freepbx/branches/2.5/amp_conf/htdocs/admin/config.php

@@ -42 +42 @@
-if (isset($_REQUEST['handler'])) {
-        switch ($_REQUEST['handler']) {
+                case 'cdr':
+                        include('cdr/cdr.php');
+                        break;
+                case 'cdr_export_csv':
+                        include('cdr/export_csv.php');
+                        break;
+                case 'cdr_export_pdf':
+                        include('cdr/export_pdf.php');
+                        break;
-                case 'reload':
-                        /** AJAX handler for reload event

freepbx/branches/2.5/amp_conf/htdocs/admin/views/reports.php

@@ -14 +14 @@
-$template['content'] .= 
-        '<div id="reportframe">'.
-dr/cdr.php?
+onfig.php?handler=cdr&
-        '</div>';
-