Ticket #3266 (closed Feature Requests: fixed)

Opened 1 year ago

Last modified 2 months ago

Warning text if extension number is same as secret

Reported by: acaley Assigned to: p_lindheimer
Priority: minor Milestone: 2.6
Component: Core - Users/Devices Version: 2.5-branch
Keywords: Cc: kgarrison
Confirmation: Need Feedback SVN Revision (if applicable):
Backend Engine: All Backend Engine Version:

Description (Last modified by p_lindheimer)

Since there are now several scripts hunting down Asterisk based system, an extension should have a strong password and it should never match the extension number. This is a simple patch that adds an additional warning messages to users who try to use the same secret as their password.

This patch was created by acaley, originally submitted by kgarrison requesting inclusion.

Attachments

secret_same_as_extension.patch (1.4 kB) - added by kgarrison on 10/08/08 14:46:04.
secret_same_as_extension.2.patch (3.0 kB) - added by kgarrison on 10/15/08 13:59:47.
secret_same_as_extension.3.patch (2.8 kB) - added by acaley on 10/22/08 08:56:31.

Change History

10/08/08 14:46:04 changed by kgarrison

  • attachment secret_same_as_extension.patch added.

10/12/08 18:23:24 changed by p_lindheimer

  • confirmation changed from Unreviewed to Need Feedback.

Thanks for the patch, it's a reasonable suggestion but the patch needs to be complete. Current issues:

  • It does not work in deviceanduser mode
  • It should be extended to iax in addition to sip
  • If you choose cancel, it ends up popping up the alert box as if there were no secret specified
  • It is missing the localization enclosures (usually _()) so that it can be translated.

Beyond that, I would suggest shortening the message up a bit, maybe something like:

"You have set your secret and device/extension to the same value. This can be a serious security vulnerability resulting in a hacker compromising your system to make free phone calls. There are many known instances where this has already occurred"

If you can complete the patch, we can put it into 2.5 given the security implications and abuse that has already occurred.

10/15/08 10:58:17 changed by acaley

Working on these fixes today. One question:

"If you choose cancel, it ends up popping up the alert box as if there were no secret specified"

This is no different than the existing behavior: if you leave the secret empty, it pops up a box explaining why this is bad, and if you hit cancel it then says "Please enter a secret for this device" and then leaves the secret box in focus for you to change it. So it seems to me this behavior is fine.

I will fix the other things though..

10/15/08 11:11:37 changed by p_lindheimer

acaley,

You are correct, it is the same. A little awkward but I guess fine. When you make the change, do move the message up into a variable like the other related messages are to clean up the code a bit also.

btw, are you the original author? of the patch or just jumping in to help out? (and in either case, thanks).

10/15/08 13:44:36 changed by acaley

Yes I am the author. I have fixed the patch but I don't have privileges to upload it apparently. I did just as you suggest, putting the text into a _().

10/15/08 13:59:31 changed by kgarrison

Attached new page

10/15/08 13:59:47 changed by kgarrison

  • attachment secret_same_as_extension.2.patch added.

10/15/08 18:11:02 changed by p_lindheimer

  • reporter changed from kgarrison to acaley.

acaley,

not sure why you could not upload, you should be able to once authenticated unless you were trying to replace the other which it may have stopped you from doing.

Anyhow - I put you in as the reporter since the patch is yours, we'll have a look shortly and see if we can get it in soon. Thanks.

One minor request, when making a new patch in the future, make it off of the base, not off of the previous patch. I almost replied telling you the patch did not apply until I realized I had to first apply the first patch and then your second one over the first:-)

10/18/08 09:43:36 changed by p_lindheimer

  • status changed from new to closed.
  • resolution set to fixed.

(In [7001]) closes #3266 add confirm box when sip secret == device number since it is a commonly exploited security vulnerability on systems exposed to the outside

10/22/08 08:28:11 changed by p_lindheimer

(In [7098]) fixes #3311 revert r7001 re #3266 introduces faulty javascript on new extension/device and doesn't work in those cases either

10/22/08 08:34:15 changed by p_lindheimer

  • status changed from closed to reopened.
  • resolution deleted.
  • description changed.
  • milestone changed from 2.5 to 3.0.

This is being re-opened, it had two issues:

  • It does not work on new extension/device creation (which is where people set the password usually)
  • It creates an error in both cases because the generated javascript variable is corrupted breaking other javascript enabled functionality and validation.

You are going to have to create different code for new extension/device creation which checks the DOM variable where the extension/device number is supplied.

10/22/08 08:34:33 changed by p_lindheimer

  • cc set to kgarrison.

10/22/08 08:50:11 changed by p_lindheimer

(In [7101]) Merged revisions 7098-7099 via svnmerge from http://svn.freepbx.org/modules/branches/2.5

........

r7098 | p_lindheimer | 2008-10-22 08:28:11 -0700 (Wed, 22 Oct 2008) | 1 line

fixes #3311 revert r7001 re #3266 introduces faulty javascript on new extension/device and doesn't work in those cases either

........

r7099 | p_lindheimer | 2008-10-22 08:39:23 -0700 (Wed, 22 Oct 2008) | 1 line

Module Publish Script: core 2.5.1.1

........

10/22/08 08:56:31 changed by acaley

  • attachment secret_same_as_extension.3.patch added.

10/22/08 08:57:44 changed by acaley

OK this should fix the issues. I hope I created the patch correctly.

10/24/08 09:26:41 changed by dinhtrung

Why not use a simple javascript validation like this? 

$tmparr['secret'] = array('value' => '', 'level' => 0, 'jsvalidation' => '(theForm.extension.value == theForm.devinfo_secret.value && !confirm("' . $msgSecretSameAsExtension . '")) || isEmpty() && !confirm("'.$msgConfirmSecret.'")', 'failvalidationmsg' => $msgInvalidSecret);

Work for both deviceanduser/extensions mode, and didn't use a specific value (because it will look up the value in extension fields on HTML instead of PHP source - server side).

10/24/08 11:50:05 changed by acaley

Looking up the value in the fields doesn't work in all cases (I actually had it that way to begin with, and then changed it), IE you are editing an existing extension.

10/24/08 12:03:44 changed by p_lindheimer

  • milestone changed from 3.0 to 2.6.

the suggested change looks conceptually correct (other than you want to add an isset($_REQUESTextension?) && trim($_REQUESTextension?) != "") or something like that, in case your extension is 0 (I think that may now be supported) and in any event to get rid of errors.

I'll look at putting this into the 2.6 branch to be evaluated for a while before putting it into 2.5 like I did the last time. It ended costing a lot of pain and expense to several people because of the javascript bug that resulted in corrupted voicemail.conf files ...

10/24/08 20:17:02 changed by dinhtrung

In extension page, I don't see any field with id "deviceid". Deviceid is assigned automatically in extension mode by core_device_configprocess(). So just wonder this will work? Why not use 'extension' field instead? This will support both extension and deviceanduser mode.

08/23/09 21:54:04 changed by p_lindheimer

(In [8114]) weakpassword validation re #3581 and re #3266

08/23/09 21:55:25 changed by p_lindheimer

  • status changed from reopened to closed.
  • resolution set to fixed.

(In [8115]) closes #3581 and closes #3266 weakpassword validation for sip and iax devices

01/13/10 12:59:04 changed by p_lindheimer

(In [8599]) Merged revisions 7910,7912-8166,8168-8338,8340-8371,8373-8405,8407-8598 via svnmerge from http://svn.freepbx.org/freepbx/branches/2.6

........

r7910 | p_lindheimer | 2009-08-02 18:36:37 -0700 (Sun, 02 Aug 2009) | 1 line

branch trunk to 2.6

........

r7978 | p_lindheimer | 2009-08-07 15:40:44 -0700 (Fri, 07 Aug 2009) | 1 line

update packed js library

........

r7981 | p_lindheimer | 2009-08-07 15:52:01 -0700 (Fri, 07 Aug 2009) | 1 line

Creating release 2.6.0beta1

........

r7992 | p_lindheimer | 2009-08-07 18:58:23 -0700 (Fri, 07 Aug 2009) | 1 line

added trunk migration code to table.php, seems to be needed

........

r8006 | p_lindheimer | 2009-08-07 20:11:49 -0700 (Fri, 07 Aug 2009) | 1 line

add sql() function definition if not there

........

r8019 | p_lindheimer | 2009-08-09 17:10:47 -0700 (Sun, 09 Aug 2009) | 1 line

forgot to change moduleauthor to modulepublisher in css, need to roll the tarball one more time :(

........

r8022 | p_lindheimer | 2009-08-09 21:13:58 -0700 (Sun, 09 Aug 2009) | 1 line

2.6 highlights added to CHANGES

........

r8025 | p_lindheimer | 2009-08-09 21:23:46 -0700 (Sun, 09 Aug 2009) | 1 line

Creating release 2.6.0beta1

........

r8043 | p_lindheimer | 2009-08-14 18:05:20 -0700 (Fri, 14 Aug 2009) | 1 line

adds sort param used by new printextensions

........

r8046 | p_lindheimer | 2009-08-15 11:43:14 -0700 (Sat, 15 Aug 2009) | 1 line

Creating release 2.6.0beta1

........

r8083 | p_lindheimer | 2009-08-18 14:44:13 -0700 (Tue, 18 Aug 2009) | 1 line

fixes #3075 dead code removal

........

r8088 | p_lindheimer | 2009-08-22 17:27:44 -0700 (Sat, 22 Aug 2009) | 1 line

closes #3675 increase text input field size in components.class.php

........

r8099 | p_lindheimer | 2009-08-23 14:54:27 -0700 (Sun, 23 Aug 2009) | 1 line

undefined varialbes re #3780

........

r8102 | p_lindheimer | 2009-08-23 16:10:55 -0700 (Sun, 23 Aug 2009) | 1 line

fixes #3382 make links relative and add audio/basic type to make work in safari

........

r8104 | p_lindheimer | 2009-08-23 16:41:10 -0700 (Sun, 23 Aug 2009) | 1 line

fixes #3559 adds ASTMANAGERHOST

........

r8105 | p_lindheimer | 2009-08-23 16:58:54 -0700 (Sun, 23 Aug 2009) | 1 line

fixes #3606 improved logout view

........

r8106 | p_lindheimer | 2009-08-23 17:14:36 -0700 (Sun, 23 Aug 2009) | 1 line

use TXTCIDNAME() as TXTCIDname has been deprecated since 1.2 re #3599

........

r8109 | p_lindheimer | 2009-08-23 18:13:27 -0700 (Sun, 23 Aug 2009) | 1 line

fixes #3642 hardcoded paths

........

r8110 | p_lindheimer | 2009-08-23 18:51:20 -0700 (Sun, 23 Aug 2009) | 1 line

needs parse_amprotal because of change re #3642

........

r8113 | p_lindheimer | 2009-08-23 21:22:44 -0700 (Sun, 23 Aug 2009) | 1 line

closes #3608 use htmlspecialchars to remove some html errors

........

r8114 | p_lindheimer | 2009-08-23 21:54:04 -0700 (Sun, 23 Aug 2009) | 1 line

weakpassword validation re #3581 and re #3266

........

r8117 | p_lindheimer | 2009-08-24 12:01:39 -0700 (Mon, 24 Aug 2009) | 1 line

add USEQUEUESTATE flag to use 'HINT:' format re #3562 but related to the Asterisk patch: https://issues.asterisk.org/view.php?id=15168

........

r8118 | p_lindheimer | 2009-08-24 12:19:58 -0700 (Mon, 24 Aug 2009) | 1 line

add USEQUEUESTATE flag to amportal.confto use 'HINT:' format re #3562 but related to the Asterisk patch: https://issues.asterisk.org/view.php?id=15168

........

r8162 | p_lindheimer | 2009-08-25 12:38:39 -0700 (Tue, 25 Aug 2009) | 1 line

add include of main functions.inc.php removing several duplicated functions

........

r8169 | p_lindheimer | 2009-08-25 18:53:37 -0700 (Tue, 25 Aug 2009) | 1 line

fixes #3621 better matching of call recordings with users that occured at the same time

........

r8170 | p_lindheimer | 2009-08-25 19:03:54 -0700 (Tue, 25 Aug 2009) | 1 line

fixes #3639 allows pidof to be defined and removes hard coded /etc/asterisk path

........

r8171 | p_lindheimer | 2009-08-25 19:20:17 -0700 (Tue, 25 Aug 2009) | 1 line

closes #3305 adds reload command to freepbx_engine using kill -HUP to reload asterisk and fop

........

r8195 | p_lindheimer | 2009-08-26 10:35:26 -0700 (Wed, 26 Aug 2009) | 1 line

create 2.6.0beta2 dir in upgrades to reflect upcoming version

........

r8198 | p_lindheimer | 2009-08-26 10:50:14 -0700 (Wed, 26 Aug 2009) | 1 line

Creating release 2.6.0beta2

........

r8217 | p_lindheimer | 2009-08-27 13:50:33 -0700 (Thu, 27 Aug 2009) | 1 line

closes #2880 fix lower timeouts in phpagi-asmanager that gets called from agi scripts, does not effect the copy called by the GUI code

........

r8218 | p_lindheimer | 2009-08-27 14:05:49 -0700 (Thu, 27 Aug 2009) | 1 line

closes #3291 replace perl version with php version, leaving perl version code base for now though not called by retrieve_conf

........

r8222 | p_lindheimer | 2009-08-27 22:30:36 -0700 (Thu, 27 Aug 2009) | 1 line

fixes #3835 and re #3291 - we should redo how the trunks are searched now that we have the trunk table plus there is an option for a descriptive name that should be used if present

........

r8234 | mickecarlsson | 2009-08-28 13:12:11 -0700 (Fri, 28 Aug 2009) | 1 line

Localization updates for core

........

r8235 | mickecarlsson | 2009-08-28 13:17:48 -0700 (Fri, 28 Aug 2009) | 1 line

Small fix for Swedish language in core

........

r8236 | mickecarlsson | 2009-08-28 13:21:28 -0700 (Fri, 28 Aug 2009) | 1 line

Yet another small fix for Swedish language in core

........

r8242 | p_lindheimer | 2009-08-29 12:29:48 -0700 (Sat, 29 Aug 2009) | 1 line

fixes #3840 replace last with break left over from perl port

........

r8255 | p_lindheimer | 2009-08-31 11:12:45 -0700 (Mon, 31 Aug 2009) | 1 line

remove pass by reference indicator in parse_zapata it is already declared in the function and creates error on php 5.3+

........

r8270 | p_lindheimer | 2009-09-02 09:43:41 -0700 (Wed, 02 Sep 2009) | 1 line

fixes #3850 adds dahdi (though some real dahdi testing is necessary, tried to get labels right), also moves retrieve_op_conf_from_mysql.php to an include file no longer stand-alone executable re #3837

........

r8273 | p_lindheimer | 2009-09-04 17:44:43 -0700 (Fri, 04 Sep 2009) | 1 line

fixes #3858 reload deprecated starting 1.4 changed to module_reload

........

r8274 | p_lindheimer | 2009-09-05 08:25:52 -0700 (Sat, 05 Sep 2009) | 1 line

fixes #3861 previous patch had wrong path to default asterisk.conf

........

r8280 | p_lindheimer | 2009-09-05 17:35:56 -0700 (Sat, 05 Sep 2009) | 1 line

fixes #3678 parse voicemail includes even when they have single/double quotes

........

r8287 | p_lindheimer | 2009-09-05 18:25:06 -0700 (Sat, 05 Sep 2009) | 1 line

bump to RC1

........

r8289 | p_lindheimer | 2009-09-05 18:32:59 -0700 (Sat, 05 Sep 2009) | 1 line

Creating release 2.6.0RC1

........

r8303 | p_lindheimer | 2009-09-05 19:14:55 -0700 (Sat, 05 Sep 2009) | 1 line

update to 2.5.2

........

r8352 | p_lindheimer | 2009-09-09 14:00:11 -0700 (Wed, 09 Sep 2009) | 1 line

fix sort order of old trunk dialrules in conversion re #3854

........

r8356 | p_lindheimer | 2009-09-09 15:00:32 -0700 (Wed, 09 Sep 2009) | 1 line

make more generic email address example re #3877

........

r8371 | p_lindheimer | 2009-09-09 16:39:13 -0700 (Wed, 09 Sep 2009) | 1 line

closes #3870 add astdb information to FOP

........

r8376 | p_lindheimer | 2009-09-09 16:59:01 -0700 (Wed, 09 Sep 2009) | 1 line

Creating release 2.6.0RC2

........

r8388 | mickecarlsson | 2009-09-10 10:28:06 -0700 (Thu, 10 Sep 2009) | 1 line

Closes #3885 move macro-dumpvars out from extensions.conf to extensions_custom.conf.sample and update the deprecated variables

........

r8401 | lazytt | 2009-10-08 11:16:00 -0700 (Thu, 08 Oct 2009) | 1 line

bring the trash in to the 21st centry

........

r8405 | p_lindheimer | 2009-10-11 20:51:32 -0700 (Sun, 11 Oct 2009) | 1 line

fixes #3903 rename goto to goto_dest, scanned freepbx code, not used in any agi scripts so should be safe

........

r8407 | p_lindheimer | 2009-10-11 21:03:23 -0700 (Sun, 11 Oct 2009) | 1 line

regenerate js library

........

r8408 | p_lindheimer | 2009-10-11 21:06:02 -0700 (Sun, 11 Oct 2009) | 1 line

create 2.6.0 dir to force final release

........

r8410 | lazytt | 2009-10-13 00:57:39 -0700 (Tue, 13 Oct 2009) | 1 line

closes #3925, #3904; adds fax extensions in extensions.class.php, fixes splice funtion

........

r8416 | p_lindheimer | 2009-10-21 13:35:34 -0700 (Wed, 21 Oct 2009) | 1 line

file upload to stringent (e.g. doesn't like RC1 in version number because it was not allowing caps

........

r8421 | mickecarlsson | 2009-11-07 01:27:29 -0800 (Sat, 07 Nov 2009) | 1 line

Closes #3943 removed obsolete links in INSTALL file

........

r8428 | mickecarlsson | 2009-11-29 02:43:22 -0800 (Sun, 29 Nov 2009) | 1 line

Fixed some spelling errors in install_amp

........

r8430 | mickecarlsson | 2009-12-01 11:08:55 -0800 (Tue, 01 Dec 2009) | 1 line

Adds utf-8 support line (currently disabled) to vm_email.inc so that voicemail email can be localized

........

r8431 | mickecarlsson | 2009-12-01 11:51:07 -0800 (Tue, 01 Dec 2009) | 1 line

Closes #3963 adds preload of pbx_config and chan_local to modules.conf

........

r8432 | lazytt | 2009-12-10 04:25:01 -0800 (Thu, 10 Dec 2009) | 19 lines

Extended functionality of amportal sbin app with an 'admin' option, which allowes running of more admin/dev options. Also added fpbx application which can be called in place of amportal. Additional aoptions are as followes:

reload|r: does a full dialplan regeneration/reload (like clicking the orange bar) context|cxt: show's the specified context from the dialplan. This is extreamly usefull when

when developing dialplan on a system with many modules, where it is not fesable look thru the whole extensions_additional every time to see how a specific context was generate

  • when run with the 'list' or 'l' option, will list all avalible context's as they appear in extensions* files
  • when run with the 'contains' or 'con' options, will only print the dialplan WITHIN the context, eliminating the contexts header and trailing ;

modadmin|ma: runs the module_admin script with additional argument as passed

additioanly, the shortcut a can replace admin. For example:

'amportal admin reload' is the same as 'amportal a reload' 'amportal admin context list' is the same as 'amportal a ctx l' or 'fpbx a ctx l'

........

r8433 | lazytt | 2009-12-10 04:35:25 -0800 (Thu, 10 Dec 2009) | 1 line

allow /sbin/fpbx to be executable, re: r8432

........

r8434 | mickecarlsson | 2009-12-10 11:44:43 -0800 (Thu, 10 Dec 2009) | 1 line

Closes #3971, updated Russian language file for amp

........

r8436 | mickecarlsson | 2009-12-10 11:55:59 -0800 (Thu, 10 Dec 2009) | 1 line

Re #3971, added missing license text

........

r8439 | lazytt | 2009-12-13 06:08:31 -0800 (Sun, 13 Dec 2009) | 1 line

update amportal.conf to reflect r8438

........

r8442 | lazytt | 2009-12-14 09:08:53 -0800 (Mon, 14 Dec 2009) | 1 line

further amportal/fpbx admin features: externalip or extip returns the external ip address of the default gateway

........

r8444 | mickecarlsson | 2009-12-16 07:27:11 -0800 (Wed, 16 Dec 2009) | 1 line

Re #3977 fixes spelling error in code

........

r8459 | mickecarlsson | 2010-01-01 05:27:17 -0800 (Fri, 01 Jan 2010) | 1 line

Closes #3900 dbDel is deprecated, replaced with DB_DELETE

........

r8464 | mickecarlsson | 2010-01-02 14:19:06 -0800 (Sat, 02 Jan 2010) | 1 line

Closes #3987 fixes delimeter for Asterisk 1.6 and NVFax

........

r8466 | lazytt | 2010-01-04 14:21:06 -0800 (Mon, 04 Jan 2010) | 1 line

re: #3900; DB_DELETE is a function not an application, wrap it in a Noop to execute it

........

r8478 | p_lindheimer | 2010-01-04 16:12:02 -0800 (Mon, 04 Jan 2010) | 1 line

Creating release 2.6.0

........

r8578 | mickecarlsson | 2010-01-10 13:26:37 -0800 (Sun, 10 Jan 2010) | 1 line

Re #3805 initial checkin of new extension class Progress

........