dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Harden the security with specific permissions for domains, domain settings and default settings. Everyone using multi-tenant are encouraged to update. Run Upgrade Schema on wiki.fusionpbx.com. After updating go to advanced -> group manager click on the superadmin group and then select the permissions for domains, domains settings, and default settings. Logout and back in.

Browse Source
This commit is contained in:
Mark Crane
2012-09-27 00:34:10 +00:00
parent 6e662615d4
commit 23a2f84577
16 changed files with 161 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/default_settings/app_config.php
+4 -1
View File
@@ -1,7 +1,7 @@
<?php
//application details
$apps[$x]['name'] = 'Default Settings';
$apps[$x]['guid'] = '2c2453c0-1bea-4475-9f44-4d969650de09';
$apps[$x]['uuid'] = '2c2453c0-1bea-4475-9f44-4d969650de09';
$apps[$x]['category'] = 'Core';
$apps[$x]['subcategory'] = '';
$apps[$x]['version'] = '';
@@ -19,6 +19,9 @@
//permission details
$y = 0;
$apps[$x]['permissions'][$y]['name'] = 'default_setting_view';
$apps[$x]['permissions'][$y]['groups'][] = 'superadmin';
$y++;
$apps[$x]['permissions'][$y]['name'] = 'default_setting_add';
$apps[$x]['permissions'][$y]['groups'][] = 'superadmin';
$y++;
core/default_settings/default_settings.php
+24 -13
View File
@@ -26,7 +26,7 @@
require_once "root.php";
require_once "includes/require.php";
require_once "includes/checkauth.php";
if (if_group("admin") || if_group("superadmin")) {
if (permission_exists('default_setting_view')) {
//access granted
}
else {
@@ -60,8 +60,7 @@ require_once "includes/paging.php";
echo "</table>\n";
//prepare to page the results
$sql = "";
$sql .= " select count(*) as num_rows from v_default_settings ";
$sql = "select count(*) as num_rows from v_default_settings ";
if (strlen($order_by)> 0) { $sql .= "order by $order_by $order "; }
$prep_statement = $db->prepare($sql);
if ($prep_statement) {
@@ -83,16 +82,15 @@ require_once "includes/paging.php";
list($paging_controls, $rows_per_page, $var3) = paging($num_rows, $param, $rows_per_page);
$offset = $rows_per_page * $page;
//get the domain list
$sql = "";
$sql .= " select * from v_default_settings ";
//get the list
$sql = "select * from v_default_settings ";
if (strlen($order_by) == 0) {
$sql .= "order by default_setting_category, default_setting_subcategory asc ";
}
else {
$sql .= "order by $order_by $order ";
}
$sql .= " limit $rows_per_page offset $offset ";
$sql .= "limit $rows_per_page offset $offset ";
$prep_statement = $db->prepare(check_sql($sql));
$prep_statement->execute();
$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
@@ -120,7 +118,12 @@ require_once "includes/paging.php";
echo th_order_by('default_setting_enabled', 'Enabled', $order_by, $order);
echo th_order_by('default_setting_description', 'Description', $order_by, $order);
echo "<td align='right' width='42'>\n";
echo " <a href='default_settings_edit.php' alt='add'>$v_link_label_add</a>\n";
if (permission_exists('default_setting_add')) {
echo " <a href='default_settings_edit.php' alt='add'>$v_link_label_add</a>\n";
}
else {
echo " &nbsp;\n";
}
echo "</td>\n";
echo "</tr>\n";
}
@@ -133,8 +136,7 @@ require_once "includes/paging.php";
$subcategory = $row['default_setting_subcategory'];
$name = $row['default_setting_name'];
if ($category == "domain" && $subcategory == "menu" && $name == "uuid" ) {
$sql = "";
$sql .= "select * from v_menus ";
$sql = "select * from v_menus ";
$sql .= "where menu_uuid = '".$row['default_setting_value']."' ";
$sub_prep_statement = $db->prepare(check_sql($sql));
$sub_prep_statement->execute();
@@ -150,8 +152,12 @@ require_once "includes/paging.php";
echo " <td valign='top' class='".$row_style[$c]."'>".$row['default_setting_enabled']."&nbsp;</td>\n";
echo " <td valign='top' class='".$row_style[$c]."'>".$row['default_setting_description']."&nbsp;</td>\n";
echo " <td valign='top' align='right'>\n";
echo " <a href='default_settings_edit.php?id=".$row['default_setting_uuid']."' alt='edit'>$v_link_label_edit</a>\n";
echo " <a href='default_settings_delete.php?id=".$row['default_setting_uuid']."' alt='delete' onclick=\"return confirm('Do you really want to delete this?')\">$v_link_label_delete</a>\n";
if (permission_exists('default_setting_edit')) {
echo " <a href='default_setting_edit.php?id=".$row['default_setting_uuid']."' alt='edit'>$v_link_label_edit</a>\n";
}
if (permission_exists('default_setting_delete')) {
echo " <a href='default_setting_delete.php?id=".$row['default_setting_uuid']."' alt='delete' onclick=\"return confirm('Do you really want to delete this?')\">$v_link_label_delete</a>\n";
}
echo " </td>\n";
echo "</tr>\n";
$previous_category = $row['default_setting_category'];
@@ -167,7 +173,12 @@ require_once "includes/paging.php";
echo " <td width='33.3%' nowrap>&nbsp;</td>\n";
echo " <td width='33.3%' align='center' nowrap>$paging_controls</td>\n";
echo " <td width='33.3%' align='right'>\n";
echo " <a href='default_settings_edit.php' alt='add'>$v_link_label_add</a>\n";
if (permission_exists('default_setting_add')) {
echo " <a href='default_setting_edit.php' alt='add'>$v_link_label_add</a>\n";
}
else {
echo " &nbsp;\n";
}
echo " </td>\n";
echo " </tr>\n";
echo " </table>\n";
core/default_settings/default_settings_delete.php
+10 -8
View File
@@ -26,7 +26,7 @@
require_once "root.php";
require_once "includes/require.php";
require_once "includes/checkauth.php";
if (if_group("admin") || if_group("superadmin")) {
if (permission_exists('default_setting_delete')) {
//access granted
}
else {
@@ -39,6 +39,7 @@ if (count($_GET)>0) {
}
if (strlen($id)>0) {
//delete default_setting
$sql = "delete from v_default_settings ";
$sql .= "where default_setting_uuid = '$id' ";
$prep_statement = $db->prepare(check_sql($sql));
@@ -46,12 +47,13 @@ if (strlen($id)>0) {
unset($sql);
}
require_once "includes/header.php";
echo "<meta http-equiv=\"refresh\" content=\"2;url=default_settings.php\">\n";
echo "<div align='center'>\n";
echo "Delete Complete\n";
echo "</div>\n";
require_once "includes/footer.php";
return;
//redirect the user
require_once "includes/header.php";
echo "<meta http-equiv=\"refresh\" content=\"2;url=default_settings.php\">\n";
echo "<div align='center'>\n";
echo "Delete Complete\n";
echo "</div>\n";
require_once "includes/footer.php";
return;
?>
core/default_settings/default_settings_edit.php
+5 -5
View File
@@ -26,7 +26,7 @@
require_once "root.php";
require_once "includes/require.php";
require_once "includes/checkauth.php";
if (if_group("admin") || if_group("superadmin")) {
if (permission_exists('default_setting_add') || permission_exists('default_setting_edit')) {
//access granted
}
else {
@@ -82,7 +82,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
//add or update the database
if ($_POST["persistformvar"] != "true") {
if ($action == "add") {
if ($action == "add" && permission_exists('default_setting_add')) {
$sql = "insert into v_default_settings ";
$sql .= "(";
$sql .= "default_setting_uuid, ";
@@ -115,7 +115,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
return;
} //if ($action == "add")
if ($action == "update") {
if ($action == "update" && permission_exists('default_setting_edit')) {
$sql = "update v_default_settings set ";
$sql .= "default_setting_category = '$default_setting_category', ";
$sql .= "default_setting_subcategory = '$default_setting_subcategory', ";
@@ -140,7 +140,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
//pre-populate the form
if (count($_GET)>0 && $_POST["persistformvar"] != "true") {
$default_setting_uuid = $_GET["id"];
$default_setting_uuid = check_str($_GET["id"]);
$sql = "select * from v_default_settings ";
$sql .= "where default_setting_uuid = '$default_setting_uuid' ";
$prep_statement = $db->prepare(check_sql($sql));
@@ -166,7 +166,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
echo "<table width='100%' border='0' cellpadding='0' cellspacing=''>\n";
echo "<tr class='border'>\n";
echo " <td align=\"left\">\n";
echo " <br>";
echo " <br>";
echo "<form method='post' name='frm' action=''>\n";
echo "<div align='center'>\n";