dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prevent application duplicates and update the applications array. (#6173)

Browse Source 
* Prevent application duplicates and filter the applications before the content.
* Don't allow the new spawn commands as they are as dangerous as system commands.
* Update dialplan_valid false to include bg_spawn, spawn and spawn_stream.
This commit is contained in:
FusionPBX
2021-12-05 14:52:36 -07:00
committed by GitHub
parent 72c9aa5a61
commit 38dea5f699
2 changed files with 55 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/dialplans/dialplan_xml.php
+19 -1
View File
@@ -17,7 +17,7 @@
The Initial Developer of the Original Code is
Mark J Crane <markjcrane@fusionpbx.com>
Portions created by the Initial Developer are Copyright (C) 2008-2019
Portions created by the Initial Developer are Copyright (C) 2008-2021
the Initial Developer. All Rights Reserved.
Contributor(s):
@@ -81,12 +81,30 @@
if (preg_match("/.*([\"\'])bgsystem([\"\']).*>/i", $dialplan_xml)) {
$dialplan_valid = false;
}
if (preg_match("/.*([\"\'])bg_spawn([\"\']).*>/i", $dialplan_xml)) {
$dialplan_valid = false;
}
if (preg_match("/.*([\"\'])spawn([\"\']).*>/i", $dialplan_xml)) {
$dialplan_valid = false;
}
if (preg_match("/.*([\"\'])spawn_stream([\"\']).*>/i", $dialplan_xml)) {
$dialplan_valid = false;
}
if (preg_match("/.*{system.*/i", $dialplan_xml)) {
$dialplan_valid = false;
}
if (preg_match("/.*{bgsystem.*/i", $dialplan_xml)) {
$dialplan_valid = false;
}
if (preg_match("/.*{bg_spawn.*/i", $dialplan_xml)) {
$dialplan_valid = false;
}
if (preg_match("/.*{spawn.*/i", $dialplan_xml)) {
$dialplan_valid = false;
}
if (preg_match("/.*{spawn_stream.*/i", $dialplan_xml)) {
$dialplan_valid = false;
}
//disable xml entities and load the xml object to test if the xml is valid
libxml_disable_entity_loader(true);