Changeset 6765

Timestamp:

09/17/08 11:42:10 (3 months ago)

Author:

p_lindheimer

Message:

fixed #3209 Merged revisions 6764 via svnmerge from
http://svn.freepbx.org/freepbx/branches/2.5

........

r6764 | p_lindheimer | 2008-09-17 11:29:39 -0700 (Wed, 17 Sep 2008) | 1 line

fixes #3209 Reports SECURITY VULNERABILITY by forcing all access to the CDR Reports section to flow through config.php

........

Files:

• freepbx/branches/2.4 (modified) (1 prop)
• freepbx/branches/2.4/amp_conf/bin/retrieve_conf (modified) (1 diff)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/about.php (modified) (1 diff)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/call-comp.php (modified) (2 diffs)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/call-daily-load.php (modified) (4 diffs)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/call-last-month.php (modified) (2 diffs)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/call-log.php (modified) (5 diffs)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/cdr.php (modified) (1 diff)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/css (deleted)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/encrypt.js (deleted)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/graph_hourdetail.php (deleted)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/graph_pie.php (deleted)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/graph_stat.php (deleted)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/graph_statbar.php (deleted)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/images/clear.gif (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/images/clear.gif)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/images/corner-bl.png (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/images/corner-bl.png)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/images/corner-br.png (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/images/corner-br.png)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/images/corner-tl.png (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/images/corner-tl.png)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/images/corner-tr.png (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/cdr/images/corner-tr.png)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/images/print.css (deleted)
• freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/lib/defines.php (modified) (2 diffs)
• freepbx/branches/2.4/amp_conf/htdocs/admin/common/content.css (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/common/content.css)
• freepbx/branches/2.4/amp_conf/htdocs/admin/common/docbook.css (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/common/docbook.css)
• freepbx/branches/2.4/amp_conf/htdocs/admin/common/encrypt.js (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/common/encrypt.js)
• freepbx/branches/2.4/amp_conf/htdocs/admin/common/graph_hourdetail.php (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/common/graph_hourdetail.php)
• freepbx/branches/2.4/amp_conf/htdocs/admin/common/graph_pie.php (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/common/graph_pie.php)
• freepbx/branches/2.4/amp_conf/htdocs/admin/common/graph_stat.php (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/common/graph_stat.php)
• freepbx/branches/2.4/amp_conf/htdocs/admin/common/graph_statbar.php (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/common/graph_statbar.php)
• freepbx/branches/2.4/amp_conf/htdocs/admin/common/layout.css (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/common/layout.css)
• freepbx/branches/2.4/amp_conf/htdocs/admin/common/print.css (copied) (copied from freepbx/branches/2.5/amp_conf/htdocs/admin/common/print.css)
• freepbx/branches/2.4/amp_conf/htdocs/admin/config.php (modified) (1 diff)
• freepbx/branches/2.4/amp_conf/htdocs/admin/views/reports.php (modified) (1 diff)

freepbx/branches/2.4/amp_conf/bin/retrieve_conf

@@ -330 +330 @@
-        }
-}
+// Now also make sure to symlink the CDR images which is not a proper module
+//
+symlink_subdirs( $amp_conf['AMPWEBROOT'].'/admin/cdr/');
-
-// create an object of the extensions class

freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/about.php

@@ -35 +35 @@
-                <title>Asterisk CDR</title>
-                <meta http-equiv="Content-Type" content="text/html">
-/css
-.
+common
+common
-                <style type="text/css" media="screen">
-ss
-ss
-ss
+ommon
+ommon
+ommon
-                </style>
-                <meta name="MSSmartTagsPreventParsing" content="TRUE">

freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/call-comp.php

@@ -252 +252 @@
-<!-- ** ** ** ** ** Part for the research ** ** ** ** ** -->
-        <center>
-
+handler=cdr&
-        <INPUT TYPE="hidden" NAME="posted" value=1>
-                <table class="bar-status" width="75%" border="0" cellspacing="1" cellpadding="2" align="center">
@@ -517 +517 @@
-</td></tr></tbody></table>
-        <br>
-
+common/
-
-<?php  }else{ ?>

freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/call-daily-load.php

@@ -225 +225 @@
-<!-- ** ** ** ** ** Part for the research ** ** ** ** ** -->
-        <center>
-
+handler=cdr&
-        <INPUT TYPE="hidden" NAME="posted" value=1>
-                <table class="bar-status" width="75%" border="0" cellspacing="1" cellpadding="2" align="center">
@@ -477 +477 @@
-</td></tr></tbody></table>
-        <br>
-
+common/
-
-
@@ -485 +485 @@
-<br/>
-        <center>Select the hour interval to see the details
-
+common/
-        <!-- ** ** ** ** ** HOURLY LOAD ** ** ** ** ** -->
-                <table class="bar-status" width="60%" border="0" cellspacing="1" cellpadding="2" align="center">
@@ -534 +534 @@
-<br>
-<center>
-
+common/
-
-    </iframe>

freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/call-last-month.php

@@ -231 +231 @@
-<!-- ** ** ** ** ** Part for the research ** ** ** ** ** -->
-        <center>
-
+handler=cdr&
-        <INPUT TYPE="hidden" NAME="posted" value=1>
-                <table class="bar-status" width="75%" border="0" cellspacing="1" cellpadding="2" align="center">
@@ -493 +493 @@
-<?php  if ($posted==1){ ?>
-        <center>
-
+common/
-        </center>
-<?php  } ?>

freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/call-log.php

@@ -324 +324 @@
-<!-- ** ** ** ** ** Part for the research ** ** ** ** ** -->
-        <center>
-
+handler=cdr&
-        <INPUT TYPE="hidden" NAME="posted" value=1>
-        <INPUT TYPE="hidden" NAME="current_page" value=0>       
@@ -588 +588 @@
-                    <center><strong> 
-                    <?php  if (strtoupper($FG_TABLE_COL[$i][4])=="SORT"){?>
-
+handler=cdr&
-                                        echo "&posted=$posted&Period=$Period&frommonth=$frommonth&fromstatsmonth=$fromstatsmonth&tomonth=$tomonth&tostatsmonth=$tostatsmonth&fromday=$fromday&fromstatsday_sday=$fromstatsday_sday&fromstatsmonth_sday=$fromstatsmonth_sday&today=$today&tostatsday_sday=$tostatsday_sday&tostatsmonth_sday=$tostatsmonth_sday&dsttype=$dsttype&srctype=$srctype&clidtype=$clidtype&channel=$channel&resulttype=$resulttype&dst=$dst&src=$src&clid=$clid";?>"> 
-                    <span class="liens"><?php  } ?>
@@ -714 +714 @@
-                  <TD align="right"><SPAN style="COLOR: #ffffff; FONT-SIZE: 11px"><B> 
-                    <?php if ($current_page>0){?>
-
+handler=cdr&
-                                        echo "&posted=$posted&Period=$Period&frommonth=$frommonth&fromstatsmonth=$fromstatsmonth&tomonth=$tomonth&tostatsmonth=$tostatsmonth&fromday=$fromday&fromstatsday_sday=$fromstatsday_sday&fromstatsmonth_sday=$fromstatsmonth_sday&today=$today&tostatsday_sday=$tostatsday_sday&tostatsmonth_sday=$tostatsmonth_sday&dsttype=$dsttype&srctype=$srctype&clidtype=$clidtype&channel=$channel&resulttype=$resulttype&dst=$dst&src=$src&clid=$clid&channel=$channel&resulttype=$resulttype&dst=$dst&src=$src&clid=$clid&userfieldtype=$userfieldtype&userfield=$userfield&accountcodetype=$accountcodetype&accountcode=$accountcode&duration1=$duration1&duration1type=$duration1type&duration2=$duration2&duration2type=$duration2type";?>"> 
-                    Previous </a> - 
@@ -720 +720 @@
-                    <?php echo ($current_page+1);?> / <?php  echo $nb_record_max;?> 
-                    <?php if ($current_page<$nb_record_max-1){?>
-
+handler=cdr&
-                                        echo "&posted=$posted&Period=$Period&frommonth=$frommonth&fromstatsmonth=$fromstatsmonth&tomonth=$tomonth&tostatsmonth=$tostatsmonth&fromday=$fromday&fromstatsday_sday=$fromstatsday_sday&fromstatsmonth_sday=$fromstatsmonth_sday&today=$today&tostatsday_sday=$tostatsday_sday&tostatsmonth_sday=$tostatsmonth_sday&dsttype=$dsttype&srctype=$srctype&clidtype=$clidtype&channel=$channel&resulttype=$resulttype&dst=$dst&src=$src&clid=$clid&channel=$channel&resulttype=$resulttype&dst=$dst&src=$src&clid=$clid&userfieldtype=$userfieldtype&userfield=$userfield&accountcodetype=$accountcodetype&accountcode=$accountcode&duration1=$duration1&duration1type=$duration1type&duration2=$duration2&duration2type=$duration2type";?>"> 
-                    Next </a> <img src="images/fleche-d.gif" width="5" height="10"> 
@@ -869 +869 @@
-<br/>
-<table width="60%"><tr><td>
-export_pdf.php" target="_blank"><img src="./images/pdf.png    " border="0"/></a> <a href="export_pdf.php
+config.php?handler=cdr_export_pdf" target="_blank"><img src="./images/pdf.png " border="0"/></a> <a href="config.php?handler=cdr_export_pdf
-</td>
-<td>
-export_csv.php" target="_blank" ><img src="./images/excel.png" border="0"/></a> <a href="export_csv.php
+config.php?handler=cdr_export_csv" target="_blank" ><img src="./images/excel.png" border="0"/></a> <a href="config.php?handler=cdr_export_csv
-</td></tr></table>
-

freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/cdr.php

@@ -50 +50 @@
-                <title>Asterisk CDR</title>
-                <meta http-equiv="Content-Type" content="text/html">
-/css
-.
+common
+common
-                <style type="text/css" media="screen">
-ss
-ss
-ss
+ommon
+ommon
+ommon
-                </style>
-                <meta name="MSSmartTagsPreventParsing" content="TRUE">

freepbx/branches/2.4/amp_conf/htdocs/admin/cdr/lib/defines.php

@@ -3 +3 @@
-require_once('DB.php'); // PEAR
-
+if (!function_exists('parse_amportal_conf')) {
-function parse_amportal_conf($filename) {
-        $file = file($filename);
@@ -11 +12 @@
-        }
-        return $conf;
+}
-}
-

freepbx/branches/2.4/amp_conf/htdocs/admin/config.php

@@ -36 +36 @@
-if (isset($_REQUEST['handler'])) {
-        switch ($_REQUEST['handler']) {
+                case 'cdr':
+                        include('cdr/cdr.php');
+                        break;
+                case 'cdr_export_csv':
+                        include('cdr/export_csv.php');
+                        break;
+                case 'cdr_export_pdf':
+                        include('cdr/export_pdf.php');
+                        break;
-                case 'reload':
-                        /** AJAX handler for reload event

freepbx/branches/2.4/amp_conf/htdocs/admin/views/reports.php

@@ -14 +14 @@
-$template['content'] .= 
-        '<div id="reportframe">'.
-dr/cdr.php?
+onfig.php?handler=cdr&
-        '</div>';
-