Changeset 7598

Timestamp:

04/29/09 19:46:45 (4 years ago)

Author:

p_lindheimer

Message:

Merged revisions 7552-7571,7573-7597 via svnmerge from
http://svn.freepbx.org/freepbx/branches/2.5

........

r7552 | mickecarlsson | 2009-03-26 23:09:45 -0700 (Thu, 26 Mar 2009) | 1 line

Added GPL license text to various files

........

r7591 | p_lindheimer | 2009-04-27 12:09:11 -0700 (Mon, 27 Apr 2009) | 1 line

fix error message so it is same wether username was correct or not

........

r7592 | p_lindheimer | 2009-04-27 13:34:43 -0700 (Mon, 27 Apr 2009) | 1 line

make sure the requested report display is included in the menu items list, otherwise bogus values can be injected

........

r7593 | p_lindheimer | 2009-04-27 13:54:36 -0700 (Mon, 27 Apr 2009) | 1 line

make sure no bogus characters or scripts are injected in a get with the POST/GET variables that reporting uses

........

r7594 | p_lindheimer | 2009-04-27 15:23:37 -0700 (Mon, 27 Apr 2009) | 1 line

run extdisplay and all the derivatives through htmlspecialchars since many pages echo it in the display, this keeps any bogus characters that could create issues from being injected if a url is manually be typed in

........

r7595 | p_lindheimer | 2009-04-27 15:25:25 -0700 (Mon, 27 Apr 2009) | 1 line

filter the search parameters (and sort) to keep bogus entries from creating problems when redisplayed or links generated

........

r7597 | p_lindheimer | 2009-04-29 16:35:39 -0700 (Wed, 29 Apr 2009) | 1 line

add security check when action verb is set to protect against CSRF attacks, but can be disabled with CHECREFERER=false in amportal.conf

........

Files:

• freepbx/trunk (modified) (1 prop)
• freepbx/trunk/amp_conf/htdocs/admin/cdr/lib/defines.php (modified) (1 diff)
• freepbx/trunk/amp_conf/htdocs/admin/config.php (modified) (3 diffs)
• freepbx/trunk/amp_conf/htdocs/admin/functions.inc.php (modified) (1 diff)
• freepbx/trunk/amp_conf/htdocs/admin/reports.php (modified) (2 diffs)
• freepbx/trunk/amp_conf/htdocs/recordings/includes/display.php (modified) (1 diff)
• freepbx/trunk/amp_conf/htdocs/recordings/includes/login.php (modified) (2 diffs)
• freepbx/trunk/amp_conf/htdocs/recordings/modules/callmonitor.module (modified) (2 diffs)
• freepbx/trunk/amp_conf/htdocs/recordings/modules/voicemail.module (modified) (4 diffs)
• freepbx/trunk/amportal.conf (modified) (2 diffs)
• freepbx/trunk/install_amp (modified) (1 diff)
• freepbx/trunk/libfreepbx.install.php (modified) (1 diff)
• freepbx/trunk/setup_svn.php (modified) (1 diff)
• freepbx/trunk/start_asterisk (modified) (1 diff)
• freepbx/trunk/update_l10n.sh (modified) (1 diff)

freepbx/trunk/amp_conf/htdocs/admin/cdr/lib/defines.php

@@ -97 +97 @@
-    if (isset($_POST[$test_var])) { 
-      global $$test_var;
-$_POST[$test_var]
+htmlspecialchars($_POST[$test_var])
-    } elseif (isset($_GET[$test_var])) {
-      global $$test_var; 
-$_GET[$test_var]
+htmlspecialchars($_GET[$test_var])
-    }
-  }

freepbx/trunk/amp_conf/htdocs/admin/config.php

@@ -19 +19 @@
-$type = isset($_REQUEST['type'])?$_REQUEST['type']:'setup';
-$display = isset($_REQUEST['display'])?$_REQUEST['display']:'';
-
+
+
+
+
+
+
-$skip = isset($_REQUEST['skip'])?$_REQUEST['skip']:0;
-$action = isset($_REQUEST['action'])?$_REQUEST['action']:null;
@@ -39 +44 @@
-
-include('header.php');
+/* If there is an action request then some sort of update is usually being done.
+   This will protect from cross site request forgeries unless disabled.
+*/
+if ($action != '' && $amp_conf['CHECKREFERER']) {
+  if (isset($_SERVER['HTTP_REFERER'])) {
+    $referer = parse_url($_SERVER['HTTP_REFERER']);
+    $refererok = (trim($referer['host']) == trim($_SERVER['HTTP_HOST'])) ? true : false;
+  } else {
+    $refererok = false;
+  }
+
+  if (!$refererok) {
+    die_freepbx(_("POTENTIAL SECURITY BREACH: an attempt was made to modify settings from a URL that did not come from a FreePBX page. This action has been blocked because the HTTP_REFERER does not match your current SERVER. If you require this access, you can set CHECKREFERER=false in amportal.conf to disable this security check"));
+  }
+}
-
-// handle special requests
@@ -286 +306 @@
-    $itemid = '';
-    foreach($possibilites as $possibility) {
-
-
+
+
+
+
-    }
-

freepbx/trunk/amp_conf/htdocs/admin/functions.inc.php

@@ -745 +745 @@
-  'FOPDISABLE'      => array('bool' , false),
-  'ZAP2DAHDICOMPAT' => array('bool' , false),
+  'CHECKREFERER'    => array('bool' , true),
-);
-

freepbx/trunk/amp_conf/htdocs/admin/reports.php

@@ -32 +32 @@
-}
-
-$display=1;
-if (isset($_REQUEST['display'])) {
-  $display=$_REQUEST['display'];
-}
-
-// setup menu 
-$menu = array(
@@ -45 +40 @@
-  );
-
+if (isset($_REQUEST['display']) && isset($menu[$_REQUEST['display']])) {
+  $display=$_REQUEST['display'];
+} else {
+  $display=1;
+}
+
-// CDR viewer from www.areski.net.  
-// Changes for -- AMP -- commented in:

freepbx/trunk/amp_conf/htdocs/recordings/includes/display.php

@@ -87 +87 @@
-               <form class='bar' action='" . $_SESSION['ARI_ROOT'] . "' method='GET' name='search'>
-                 <input type=hidden name=m value=" . $m . ">  
-$q
+htmlspecialchars($q)
-                 " . $option_text . " 
-                 <input type=hidden name=start value=0> 

freepbx/trunk/amp_conf/htdocs/recordings/includes/login.php

@@ -193 +193 @@
-              }
-              else {
-"Incorrect Password"
+_("Incorrect Username or Password")
-                return;
-              }
@@ -265 +265 @@
-                  else if ($protocol_username==$username &&
-                             $protocol_password!=$password) {
-
+Username or 
-                    return;
-                  }

freepbx/trunk/amp_conf/htdocs/recordings/modules/callmonitor.module

@@ -87 +87 @@
-        <script>
-        <!--
-$q
+urlencode($q)
-        // -->
-        </script>
@@ -291 +291 @@
-          <input type=hidden name=f value=recAction>
-          <input type=hidden name=a value=''>
-$q
+urlencode($q)
-          <input type=hidden name=start value=" . $start . ">
-          <input type=hidden name=span value=" . $span . ">

freepbx/trunk/amp_conf/htdocs/recordings/modules/voicemail.module

@@ -118 +118 @@
-                // add folder to list
-                $ret .= "<p><small><small>
-$q
+urlencode($q)
-                           " . $fn . " (" . $record_count . ")" . "
-                           </a>
@@ -334 +334 @@
-        <script>
-        <!--
-$q
+urlencode($q)
-        // -->
-        </script>
@@ -371 +371 @@
-    $span = $span=='' ? 15 : $span;
-    $order = $order=='' ? 'calldate' : $order;
-$sort=='' ? 'desc' : $sort
+($sort=='' || strtolower($sort) == 'desc') ? 'desc' : 'asc'
-
-    $paths = split(';',$ASTERISK_VOICEMAIL_PATH);
@@ -625 +625 @@
-        <input type=hidden name=f value=msgAction>
-        <input type=hidden name=a value=''>
-$q
+urlencode($q)
-        <input type=hidden name=folder value=" . $folder . ">
-        <input type=hidden name=start value=" . $start . ">

freepbx/trunk/amportal.conf

@@ +1 @@
+# This file is part of FreePBX.
+#
+#    FreePBX is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License as published by
+#    the Free Software Foundation, either version 2 of the License, or
+#    (at your option) any later version.
+#
+#    FreePBX is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with FreePBX.  If not, see <http://www.gnu.org/licenses/>.
+#
-# This file contains settings for components of the Asterisk Management Portal
-# Spaces are not allowed!
@@ -210 +225 @@
-# GUI will continue to refer to these as ZAP but it will use the proper DAHDI channels.
-# This will also keep Zap Channel DIDs working.
+
+# CHECKREFERER=true|false
+# DEFAULT VALUE: true
+# When set to the default value of true, all requests into FreePBX that might possibly add/edit/delete settings will
+# be validated to assure the request is coming from the server. This will protect the system from CSRF (cross site 
+# request forgery) attacks. It will have the effect of preventing legitimately entering URLs that could modify
+# settings which can be allowed by changing this field to false
+#

freepbx/trunk/install_amp

@@ -1 +1 @@
-#!/usr/bin/php -q
-<?php
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-require_once ("libfreepbx.install.php");
-

freepbx/trunk/libfreepbx.install.php

@@ -1 +1 @@
-<?php
+//This file is part of FreePBX.
+//
+//    FreePBX is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU General Public License as published by
+//    the Free Software Foundation, either version 2 of the License, or
+//    (at your option) any later version.
+//
+//    FreePBX is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU General Public License for more details.
+//
+//    You should have received a copy of the GNU General Public License
+//    along with FreePBX.  If not, see <http://www.gnu.org/licenses/>.
+//
+//    Copyright 2007, Philippe Lindheimer
+//
-
-/********************************************************************************************************************/

freepbx/trunk/setup_svn.php

@@ -1 +1 @@
-#!/usr/bin/php -q
-<?php
+//This file is part of FreePBX.
+//
+//    FreePBX is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU General Public License as published by
+//    the Free Software Foundation, either version 2 of the License, or
+//    (at your option) any later version.
+//
+//    FreePBX is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU General Public License for more details.
+//
+//    You should have received a copy of the GNU General Public License
+//    along with FreePBX.  If not, see <http://www.gnu.org/licenses/>.
+//
+//    Copyright 2007, Philippe Lindheimer
+//
-
-/** setup_svn.php

freepbx/trunk/start_asterisk

@@ -1 +1 @@
-#!/usr/bin/env bash
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-ROOT_UID=0   # root uid is 0
-E_NOTROOT=67   # Non-root exit error

freepbx/trunk/update_l10n.sh

@@ -1 +1 @@
-#! /bin/sh
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-echo "Creating new POT template file"
-find amp_conf/htdocs/admin -name '*.php' | xargs xgettext -L PHP -o freepbx.pot --keyword=_ -