diff --git a/app/voicemail_greetings/voicemail_greetings.php b/app/voicemail_greetings/voicemail_greetings.php index 9d74304b59..570f769275 100644 --- a/app/voicemail_greetings/voicemail_greetings.php +++ b/app/voicemail_greetings/voicemail_greetings.php @@ -29,12 +29,10 @@ require_once "resources/require.php"; require_once "resources/check_auth.php"; -//check permissions - if (!permission_exists('voicemail_greeting_view')) { - if (!is_extension_assigned($voicemail_id)) { - echo "access denied"; - return; - } + //check permissions + if (!permission_exists('voicemail_greeting_view') || !extension_assigned($_REQUEST["id"])) { + echo "access denied"; + return; } //add multi-lingual support @@ -56,14 +54,13 @@ } //used (above) to search the array to determine if an extension is assigned to the user - function is_extension_assigned($number) { - $result = false; + function extension_assigned($number) { foreach ($_SESSION['user']['extension'] as $row) { - if ($row['user'] == $number) { - $result = true; + if ((is_numeric($row['number_alias']) && $row['number_alias'] == $number) || $row['user'] == $number) { + return true; } } - return $result; + return false; } //get currently selected greeting diff --git a/app/voicemails/resources/classes/voicemail.php b/app/voicemails/resources/classes/voicemail.php index a3b43a00af..5b999eceed 100644 --- a/app/voicemails/resources/classes/voicemail.php +++ b/app/voicemails/resources/classes/voicemail.php @@ -108,7 +108,7 @@ //set the voicemail id and voicemail uuid arrays if (isset($_SESSION['user']['extension'])) { foreach ($_SESSION['user']['extension'] as $index => $row) { - $voicemail_ids[$index]['voicemail_id'] = strlen($row['number_alias']) > 0 ? $row['number_alias'] : $row['user']; + $voicemail_ids[$index] = is_numeric($row['number_alias']) ? $row['number_alias'] : $row['user']; } } if (isset($_SESSION['user']['voicemail'])) { @@ -149,15 +149,21 @@ else { if (is_array($voicemail_ids) && @sizeof($voicemail_ids) != 0) { //show only the assigned voicemail ids - $x = 0; - $sql .= "and ( "; - foreach($voicemail_ids as $row) { - $sql_where_or[] = "voicemail_id = :voicemail_id_".$x; - $parameters['voicemail_id_'.$x] = $row['voicemail_id']; - $x++; + $sql .= "and "; + if (is_numeric($this->voicemail_id) && in_array($this->voicemail_id, $voicemail_ids)) { + $sql_where = 'voicemail_id = :voicemail_id '; + $parameters['voicemail_id'] = $this->voicemail_id; } - $sql .= implode(' or ', $sql_where_or); - $sql .= ") "; + else { + $x = 0; + foreach($voicemail_ids as $voicemail_id) { + $sql_where_or[] = "voicemail_id = :voicemail_id_".$x; + $parameters['voicemail_id_'.$x] = $voicemail_id; + $x++; + } + $sql_where .= '('.implode(' or ', $sql_where_or).') '; + } + $sql .= $sql_where; unset($sql_where_or); } else { diff --git a/app/voicemails/voicemail_messages.php b/app/voicemails/voicemail_messages.php index aa657fc489..8f0f4aadf7 100644 --- a/app/voicemails/voicemail_messages.php +++ b/app/voicemails/voicemail_messages.php @@ -31,8 +31,11 @@ require_once "resources/paging.php"; //set the voicemail_uuid - if (is_uuid($_REQUEST["id"])) { - $voicemail_uuid = $_REQUEST["id"]; + if (is_uuid($_REQUEST['id'])) { + $voicemail_uuid = $_REQUEST['id']; + } + else if (is_numeric($_REQUEST['id'])) { + $voicemail_id = $_REQUEST['id']; } //download the message @@ -161,7 +164,12 @@ //get the voicemail $vm = new voicemail; $vm->domain_uuid = $_SESSION['domain_uuid']; - $vm->voicemail_uuid = $voicemail_uuid; + if (is_uuid($voicemail_uuid)) { + $vm->voicemail_uuid = $voicemail_uuid; + } + else if (is_numeric($voicemail_id)) { + $vm->voicemail_id = $voicemail_id; + } $vm->order_by = $order_by; $vm->order = $order; $voicemails = $vm->messages(); diff --git a/core/user_settings/user_dashboard.php b/core/user_settings/user_dashboard.php index 2cf7c7796d..d05bbfabd8 100644 --- a/core/user_settings/user_dashboard.php +++ b/core/user_settings/user_dashboard.php @@ -398,9 +398,9 @@ foreach ($messages as $voicemail_uuid => $row) { if (is_uuid($voicemail_uuid)) { - $tr_link = "href='".PROJECT_PATH."/app/voicemails/voicemail_messages.php?id=".$voicemail_uuid."'"; + $tr_link = "href='".PROJECT_PATH."/app/voicemails/voicemail_messages.php?id=".(permission_exists('voicemail_view') ? $voicemail_uuid : $row['ext'])."'"; $hud[$n]['html'] .= "