nsinnovations/fusionpbx
2
0
Fork 0
mirror of https://github.com/fusionpbx/fusionpbx.git synced 2026-01-06 11:43:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

[security] prevent xml injection and executing switch api cmds (#6594)

Browse Source
This commit is contained in:
agree
2023-03-30 01:24:04 -04:00
committed by GitHub
parent de70dd2910
commit ca36d10121
5 changed files with 158 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
app/call_centers/call_center_queue_edit.php
View File

@@ -336,42 +336,42 @@
}
//build the xml dialplan
$dialplan_xml = "<extension name=\"".$queue_name."\" continue=\"\" uuid=\"".$dialplan_uuid."\">\n";
$dialplan_xml = "<extension name=\"".xml::sanitize($queue_name)."\" continue=\"\" uuid=\"".xml::sanitize($dialplan_uuid)."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^([^#]+#)(.*)\$\" break=\"never\">\n";
$dialplan_xml .= " <action application=\"set\" data=\"caller_id_name=\$2\"/>\n";
$dialplan_xml .= " </condition>\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^(callcenter\+)?".$queue_extension."$\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^(callcenter\+)?".xml::sanitize($queue_extension)."$\">\n";
$dialplan_xml .= " <action application=\"answer\" data=\"\"/>\n";
if (is_uuid($call_center_queue_uuid)) {
$dialplan_xml .= " <action application=\"set\" data=\"call_center_queue_uuid=".$call_center_queue_uuid."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"call_center_queue_uuid=".xml::sanitize($call_center_queue_uuid)."\"/>\n";
}
if (is_numeric($queue_extension)) {
$dialplan_xml .= " <action application=\"set\" data=\"queue_extension=".$queue_extension."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"queue_extension=".xml::sanitize($queue_extension)."\"/>\n";
}
$dialplan_xml .= " <action application=\"set\" data=\"cc_export_vars=\${cc_export_vars},call_center_queue_uuid,sip_h_Alert-Info\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"hangup_after_bridge=true\"/>\n";
if ($queue_time_base_score_sec != '') {
$dialplan_xml .= " <action application=\"set\" data=\"cc_base_score=".$queue_time_base_score_sec."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"cc_base_score=".xml::sanitize($queue_time_base_score_sec)."\"/>\n";
}
if ($queue_greeting_path != '') {
$dialplan_xml .= " <action application=\"sleep\" data=\"1000\"/>\n";
$greeting_array = explode(':', $queue_greeting_path);
if (count($greeting_array) == 1) {
$dialplan_xml .= " <action application=\"playback\" data=\"".$queue_greeting_path."\"/>\n";
$dialplan_xml .= " <action application=\"playback\" data=\"".xml::sanitize($queue_greeting_path)."\"/>\n";
}
else {
if ($greeting_array[0] == 'say' || $greeting_array[0] == 'tone_stream' || $greeting_array[0] == 'phrase') {
$dialplan_xml .= " <action application=\"".$greeting_array[0]."\" data=\"".$greeting_array[1]."\"/>\n";
$dialplan_xml .= " <action application=\"".xml::sanitize($greeting_array[0])."\" data=\"".xml::sanitize($greeting_array[1])."\"/>\n";
}
}
}
if (strlen($queue_cid_prefix) > 0) {
$dialplan_xml .= " <action application=\"set\" data=\"effective_caller_id_name=".$queue_cid_prefix."#\${caller_id_name}\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"effective_caller_id_name=".xml::sanitize($queue_cid_prefix)."#\${caller_id_name}\"/>\n";
}
if (strlen($queue_cc_exit_keys) > 0) {
$dialplan_xml .= " <action application=\"set\" data=\"cc_exit_keys=".$queue_cc_exit_keys."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"cc_exit_keys=".xml::sanitize($queue_cc_exit_keys)."\"/>\n";
}
$dialplan_xml .= " <action application=\"callcenter\" data=\"".$queue_extension."@".$_SESSION["domain_name"]."\"/>\n";
$dialplan_xml .= " <action application=\"callcenter\" data=\"".xml::sanitize($queue_extension)."@".$_SESSION["domain_name"]."\"/>\n";
if ($destination->valid($queue_timeout_app.':'.$queue_timeout_data)) {
$dialplan_xml .= " <action application=\"".$queue_timeout_app."\" data=\"".$queue_timeout_data."\"/>\n";
}