Changeset 13873

Show
Ignore:
Timestamp:
03/23/12 14:05:28 (1 year ago)
Author:
p_lindheimer
Message:

Merged revisions 13872 via svnmerge from
http://www.freepbx.org/v2/svn/freepbx/branches/2.8

................

r13872 | p_lindheimer | 2012-03-23 11:02:49 -0700 (Fri, 23 Mar 2012) | 16 lines


Merged revisions 13871 via svnmerge from
http://www.freepbx.org/v2/svn/freepbx/branches/2.9


................

r13871 | p_lindheimer | 2012-03-23 10:56:36 -0700 (Fri, 23 Mar 2012) | 9 lines


Merged revisions 13870 via svnmerge from
http://www.freepbx.org/v2/svn/freepbx/branches/2.10


........

r13870 | p_lindheimer | 2012-03-23 10:47:34 -0700 (Fri, 23 Mar 2012) | 1 line


fixes RCE security vulnerability reported and solution provided by Martin Tschirsich with some bug fixes present in his original patch

........

................

................

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • freepbx/branches/2.7

    • Property svn:mergeinfo set to
      /freepbx/branches/2.10:13870
      /freepbx/branches/2.8:13872
      /freepbx/branches/2.9:13871
    • Property svnmerge-integrated changed from /freepbx/branches/2.6:1-8598,8646-8647,8828 /freepbx/branches/2.8:1-9715,9728,9961,9977,10010,10038,10050,10453,11465,11623,11673,11743 to /freepbx/branches/2.8:1-9715,9728,9961,9977,10010,10038,10050,10453,11465,11623,11673,11743,13872 /freepbx/branches/2.6:1-8598,8646-8647,8828

  • freepbx/branches/2.7/amp_conf/htdocs/recordings/misc/callme_page.php

    r7040 r13873  
    1010include_once("./includes/common.php"); 
    1111 
     12$pageaction = $_REQUEST['action']; 
     13 
     14if (!isset($_SESSION['ari_user']['extension']) || $pageaction === 'c' && !isset($_SESSION['ari_user']['recfiles'][$_REQUEST['recindex']])) { 
     15  die; // Disable anonymous or malicious access. 
     16} 
     17 
    1218?> 
    1319 
    …… 
    1925    <meta http-equiv="content-type" content="text/html; charset=UTF-8"> 
    2026  </head> 
     27  <body> 
    2128 
    2229<?php 
    …… 
    2532  $success = databaseLogon(); 
    2633  if ($success) { 
     34  $extension  = $_SESSION['ari_user']['extension']; 
    2735  $path       = $_SESSION['ari_user']['recfiles'][$_REQUEST['recindex']]; 
    28   $pageaction = $_REQUEST['action']; 
    29   $to         = $_REQUEST['callmenum']; 
    30   $msgFrom    = $_REQUEST['msgFrom']; 
     36  $to         =  callme_getnum($extension); 
    3137  $new_path   = substr($path, 0, -4);   /* Without the sound file extension. */ 
    32   $matches[0] = ''; /* init the $matches array. */ 
    3338  /* Either start or end the call me call */ 
    3439  switch($pageaction) 
    …… 
    3641    case "c": 
    3742      /* Call me. */ 
    38       $call_status = callme_startcall($to, $msgFrom, $new_path); 
     43      $call_status = callme_startcall($to, $extension, $new_path); 
    3944      echo("<table class='voicemail' style='width: 100%; height: 100%; margin: 0 0 0 0; border: 0px; padding: 0px'><tr><td valign='middle' style='border: 0px'>"); 
    4045      /* if successful, display hang-up button */ 
    4146      if (callme_succeeded($call_status)) 
    4247      { 
    43         echo("<a href='callme_page.php?action=h&callmenum=" . $to . "'>Click here to hang up.</a>"); 
     48        echo("<a href='callme_page.php?action=h'>Click here to hang up.</a>"); 
    4449      } 
    4550      echo("</td></tr></table>"); 

  • freepbx/branches/2.7/amp_conf/htdocs/recordings/modules/voicemail.module

    r8599 r13873  
    553553          $_SESSION['ari_user']['recfiles'][$i] = $recording; 
    554554    $recordingLink = "<a href='#' onClick=\"javascript:playback('play', $playbackRow, 'misc/play_page.php?recindex=" . $i . "'); return false;\"><img src='theme/images/sound.png' title=" . _("Play") . "></img></a>"; 
    555     $callmePage   = "'misc/callme_page.php?recindex=" . $i . "&callmenum=" . $this->callme_num . "&action=c&msgFrom=" . $extension . "'"; 
     555    $callmePage   = "'misc/callme_page.php?recindex=" . $i . "&action=c'"; 
    556556    $callme_tooltip = _("Play message at: ") . $this->callme_num; 
    557557    $callmeLink = "<a href='#' onClick=\"javascript:playback('callme', $playbackRow, $callmePage); return false;\"><img src='theme/images/telephone.png' title='" . $callme_tooltip . "'></img></a>";