dbxe
/
fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a problem with call flows. Increase the security for both the xm_edit and the provision_editor.

This commit is contained in:
Mark Crane 2012-09-23 10:31:31 +00:00
parent 25259972f5
commit 1b781dd048
3 changed files with 20 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
app/provision_editor/fileread.php
View File

@ -25,6 +25,7 @@
*/ */
include "root.php"; include "root.php";
require_once "includes/require.php"; require_once "includes/require.php";
require_once "includes/checkauth.php";
if (permission_exists('xml_editor_view')) { if (permission_exists('xml_editor_view')) {
//access granted //access granted
} }
@ -33,7 +34,7 @@ else {
exit; exit;
} }
$filename = $_POST["file"]; $filename = check_str($_POST["file"]);
$filename = str_replace ("\\", "/", $filename); $filename = str_replace ("\\", "/", $filename);
$handle = fopen($filename, "r"); $handle = fopen($filename, "r");

3
app/xml_edit/fileread.php
View File

@ -25,6 +25,7 @@
*/ */
include "root.php"; include "root.php";
require_once "includes/require.php"; require_once "includes/require.php";
require_once "includes/checkauth.php";
if (permission_exists('xml_editor_view')) { if (permission_exists('xml_editor_view')) {
//access granted //access granted
} }
@ -33,7 +34,7 @@ else {
exit; exit;
} }
$filename = $_POST["file"]; $filename = check_str($_POST["file"]);
$filename = str_replace ("\\", "/", $filename); $filename = str_replace ("\\", "/", $filename);
$handle = fopen($filename, "r"); $handle = fopen($filename, "r");

14
includes/install/scripts/call_flow_monitor.lua
View File

@ -25,7 +25,11 @@
-- POSSIBILITY OF SUCH DAMAGE. -- POSSIBILITY OF SUCH DAMAGE.
--set the time between loops in seconds --set the time between loops in seconds
sleep = 500; sleep = 300;
--set the debug level
debug["log"] = false;
debug["sql"] = false;
--include the lua script --include the lua script
scripts_dir = string.sub(debug.getinfo(1).source,2,string.len(debug.getinfo(1).source)-(string.len(argv[0])+1)); scripts_dir = string.sub(debug.getinfo(1).source,2,string.len(debug.getinfo(1).source)-(string.len(argv[0])+1));
@ -75,7 +79,9 @@
from v_call_flows as f, v_domains as d from v_call_flows as f, v_domains as d
where f.domain_uuid = d.domain_uuid]] where f.domain_uuid = d.domain_uuid]]
--and call_flow_enabled = 'true' --and call_flow_enabled = 'true'
--freeswitch.consoleLog("notice", "SQL:" .. sql .. "\n"); if (debug["sql"]) then
freeswitch.consoleLog("notice", "SQL:" .. sql .. "\n");
end
x = 0; x = 0;
dbh:query(sql, function(row) dbh:query(sql, function(row)
domain_name = row.domain_name; domain_name = row.domain_name;
@ -103,7 +109,9 @@
event:addHeader("answer-state", "terminated"); event:addHeader("answer-state", "terminated");
event:fire(); event:fire();
--show in the console --show in the console
if (debug["log"]) then
freeswitch.consoleLog("notice", "Call Flow: label="..call_flow_label..",status=true,uuid="..call_flow_uuid.."\n"); freeswitch.consoleLog("notice", "Call Flow: label="..call_flow_label..",status=true,uuid="..call_flow_uuid.."\n");
end
else else
--set presence in - turn lamp on --set presence in - turn lamp on
event = freeswitch.Event("PRESENCE_IN"); event = freeswitch.Event("PRESENCE_IN");
@ -120,8 +128,10 @@
event:addHeader("answer-state", "confirmed"); event:addHeader("answer-state", "confirmed");
event:fire(); event:fire();
--show in the console --show in the console
if (debug["log"]) then
freeswitch.consoleLog("notice", "Call Flow: label="..call_flow_anti_label..",status=false,uuid="..call_flow_uuid.."\n"); freeswitch.consoleLog("notice", "Call Flow: label="..call_flow_anti_label..",status=false,uuid="..call_flow_uuid.."\n");
end end
end
end); end);
--exit the loop when the file does not exist --exit the loop when the file does not exist