dbxe
/
fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[security] sanitize the xml (#6595) 

* Update call_center_queue_edit.php

* fix typo

* Update call_flow_edit.php

* Update conference_center_edit.php

* Update conference_edit.php

* Update destination_edit.php

* Update fax.php

* Update ivr_menu_edit.php

* Update ring_group_edit.php

* Update app_defaults.php

* Update ivr_menu_copy.php

* Update destination_imports.php

* Update app_defaults.php
This commit is contained in:
Alex 2023-03-30 12:46:36 -06:00 committed by GitHub
parent 3091370f14
commit 43eb2a5b9d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
12 changed files with 76 additions and 76 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
app/call_centers/app_defaults.php
View File

@ -94,43 +94,43 @@ if ($domains_processed == 1) {
}
//build the xml dialplan
$dialplan_xml = "<extension name=\"".$row["queue_name"]."\" continue=\"\" uuid=\"".$row["dialplan_uuid"]."\">\n";
$dialplan_xml = "<extension name=\"".xml::sanitize($row["queue_name"])."\" continue=\"\" uuid=\"".xml::sanitize($row["dialplan_uuid"])."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^([^#]+#)(.*)\$\" break=\"never\">\n";
$dialplan_xml .= " <action application=\"set\" data=\"caller_id_name=\$2\"/>\n";
$dialplan_xml .= " </condition>\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^(callcenter\+)?".$row["queue_extension"]."$\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^(callcenter\+)?".xml::sanitize($row["queue_extension"])."$\">\n";
$dialplan_xml .= " <action application=\"answer\" data=\"\"/>\n";
if (is_uuid($row['call_center_queue_uuid'])) {
$dialplan_xml .= " <action application=\"set\" data=\"call_center_queue_uuid=".$row['call_center_queue_uuid']."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"call_center_queue_uuid=".xml::sanitize($row['call_center_queue_uuid'])."\"/>\n";
}
if (is_numeric($row['queue_extension'])) {
$dialplan_xml .= " <action application=\"set\" data=\"queue_extension=".$row['queue_extension']."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"queue_extension=".xml::sanitize($row['queue_extension'])."\"/>\n";
}
$dialplan_xml .= " <action application=\"set\" data=\"cc_export_vars=\${cc_export_vars},call_center_queue_uuid,sip_h_Alert-Info\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"hangup_after_bridge=true\"/>\n";
if ($row['queue_time_base_score_sec'] != '') {
$dialplan_xml .= " <action application=\"set\" data=\"cc_base_score=".$row['queue_time_base_score_sec']."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"cc_base_score=".xml::sanitize($row['queue_time_base_score_sec'])."\"/>\n";
}
if ($row['queue_greeting'] != '') {
$greeting_array = explode(':', $row['queue_greeting']);
if (count($greeting_array) == 1) {
$dialplan_xml .= " <action application=\"playback\" data=\"".$queue_greeting_path."\"/>\n";
$dialplan_xml .= " <action application=\"playback\" data=\"".xml::sanitize($queue_greeting_path)."\"/>\n";
}
else {
if ($greeting_array[0] == 'say' || $greeting_array[0] == 'tone_stream' || $greeting_array[0] == 'phrase') {
$dialplan_xml .= " <action application=\"".$greeting_array[0]."\" data=\"".$greeting_array[1]."\"/>\n";
$dialplan_xml .= " <action application=\"".xml::sanitize($greeting_array[0])."\" data=\"".xml::sanitize($greeting_array[1])."\"/>\n";
}
}
}
if (strlen($row['queue_cid_prefix']) > 0) {
$dialplan_xml .= " <action application=\"set\" data=\"effective_caller_id_name=".$row['queue_cid_prefix']."#\${caller_id_name}\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"effective_caller_id_name=".xml::sanitize($row['queue_cid_prefix'])."#\${caller_id_name}\"/>\n";
}
if (strlen($row['queue_cc_exit_keys']) > 0) {
$dialplan_xml .= " <action application=\"set\" data=\"cc_exit_keys=".$row['queue_cc_exit_keys']."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"cc_exit_keys=".xml::sanitize($row['queue_cc_exit_keys'])."\"/>\n";
}
$dialplan_xml .= " <action application=\"callcenter\" data=\"".$row['queue_extension']."@".$row['domain_name']."\"/>\n";
$dialplan_xml .= " <action application=\"callcenter\" data=\"".xml::sanitize($row['queue_extension'])."@".xml::sanitize($row['domain_name'])."\"/>\n";
//if ($destination->valid($queue_timeout_app.':'.$queue_timeout_data)) {
$dialplan_xml .= " <action application=\"".$queue_timeout_app."\" data=\"".$queue_timeout_data."\"/>\n";
$dialplan_xml .= " <action application=\"".xml::sanitize($queue_timeout_app)."\" data=\"".xml::sanitize($queue_timeout_data)."\"/>\n";
//}
$dialplan_xml .= " </condition>\n";
$dialplan_xml .= "</extension>";

2
app/call_centers/call_center_agent_edit.php
View File

@ -162,7 +162,7 @@
$agent_contact = str_replace("@", "/", $agent_contact);
}
//freeswitch expands the the contact string, so we need to sanitize it.
//freeswitch expands the contact string, so we need to sanitize it.
$agent_contact = str_replace('$', '', $agent_contact);
//prepare the array

2
app/call_centers/call_center_queue_edit.php
View File

@ -373,7 +373,7 @@
}
$dialplan_xml .= " <action application=\"callcenter\" data=\"".xml::sanitize($queue_extension)."@".$_SESSION["domain_name"]."\"/>\n";
if ($destination->valid($queue_timeout_app.':'.$queue_timeout_data)) {
$dialplan_xml .= " <action application=\"".$queue_timeout_app."\" data=\"".$queue_timeout_data."\"/>\n";
$dialplan_xml .= " <action application=\"".xml::sanitize($queue_timeout_app)."\" data=\"".xml::sanitize($queue_timeout_data)."\"/>\n";
}
$dialplan_xml .= " </condition>\n";
$dialplan_xml .= "</extension>\n";

10
app/call_flows/call_flow_edit.php
View File

@ -172,16 +172,16 @@
$destination_feature = str_replace("+", "\+", $destination_feature);
//build the xml dialplan
$dialplan_xml = "<extension name=\"".$call_flow_name."\" continue=\"\" uuid=\"".$dialplan_uuid."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".$destination_feature."$\" break=\"on-true\">\n";
$dialplan_xml = "<extension name=\"".xml::sanitize($call_flow_name)."\" continue=\"\" uuid=\"".xml::sanitize($dialplan_uuid)."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".xml::sanitize($destination_feature)."$\" break=\"on-true\">\n";
$dialplan_xml .= " <action application=\"answer\" data=\"\"/>\n";
$dialplan_xml .= " <action application=\"sleep\" data=\"200\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"feature_code=true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"call_flow_uuid=".$call_flow_uuid."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"call_flow_uuid=".xml::sanitize($call_flow_uuid)."\"/>\n";
$dialplan_xml .= " <action application=\"lua\" data=\"call_flow.lua\"/>\n";
$dialplan_xml .= " </condition>\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".$destination_extension."$\">\n";
$dialplan_xml .= " <action application=\"set\" data=\"call_flow_uuid=".$call_flow_uuid."\"/>\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".xml::sanitize($destination_extension)."$\">\n";
$dialplan_xml .= " <action application=\"set\" data=\"call_flow_uuid=".xml::sanitize($call_flow_uuid)."\"/>\n";
$dialplan_xml .= " <action application=\"lua\" data=\"call_flow.lua\"/>\n";
$dialplan_xml .= " </condition>\n";
$dialplan_xml .= "</extension>\n";

6
app/conference_centers/conference_center_edit.php
View File

@ -132,15 +132,15 @@
$array['conference_centers'][0]['conference_center_description'] = $conference_center_description;
//build the xml dialplan
$dialplan_xml = "<extension name=\"".$conference_center_name."\" continue=\"\" uuid=\"".$dialplan_uuid."\">\n";
$dialplan_xml = "<extension name=\"".xml::sanitize($conference_center_name)."\" continue=\"\" uuid=\"".xml::sanitize($dialplan_uuid)."\">\n";
if ($conference_center_pin_length > 1 && $conference_center_pin_length < 4) {
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^(".$conference_center_extension.")(\d{".$conference_center_pin_length."})$\" break=\"on-true\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^(".xml::sanitize($conference_center_extension).")(\d{".xml::sanitize($conference_center_pin_length)."})$\" break=\"on-true\">\n";
$dialplan_xml .= " <action application=\"set\" data=\"destination_number=$1\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"pin_number=$2\"/>\n";
$dialplan_xml .= " <action application=\"lua\" data=\"app.lua conference_center\"/>\n";
$dialplan_xml .= " </condition>\n";
}
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".$conference_center_extension."$\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".xml::sanitize($conference_center_extension)."$\">\n";
$dialplan_xml .= " <action application=\"lua\" data=\"app.lua conference_center\"/>\n";
$dialplan_xml .= " </condition>\n";
$dialplan_xml .= "</extension>\n";

12
app/conferences/conference_edit.php
View File

@ -201,13 +201,13 @@
$pin_number = (strlen($conference_pin_number) > 0) ? '+'.$conference_pin_number : '';
//build the xml
$dialplan_xml = "<extension name=\"".$conference_name."\" continue=\"\" uuid=\"".$dialplan_uuid."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".$conference_extension."$\">\n";
$dialplan_xml = "<extension name=\"".xml::sanitize($conference_name)."\" continue=\"\" uuid=\"".xml::sanitize($dialplan_uuid)."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".xml::sanitize($conference_extension)."$\">\n";
$dialplan_xml .= " <action application=\"answer\" data=\"\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"conference_uuid=".$conference_uuid."\" inline=\"true\"/>\n";
//$dialplan_xml .= " <action application=\"set\" data=\"conference_name=".$conference_name."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"conference_extension=".$conference_extension."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"conference\" data=\"".$conference_extension."@".$_SESSION['domain_name']."@".$conference_profile.$pin_number."+flags{'".$conference_flags."'}\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"conference_uuid=".xml::sanitize($conference_uuid)."\" inline=\"true\"/>\n";
//$dialplan_xml .= " <action application=\"set\" data=\"conference_name=".xml::sanitize($conference_name)."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"conference_extension=".xml::sanitize($conference_extension)."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"conference\" data=\"".xml::sanitize($conference_extension)."@".$_SESSION['domain_name']."@".xml::sanitize($conference_profile.$pin_number)."+flags{'".xml::sanitize($conference_flags)."'}\"/>\n";
$dialplan_xml .= " </condition>\n";
$dialplan_xml .= "</extension>\n";

20
app/destinations/destination_edit.php
View File

@ -443,7 +443,7 @@
}
//build the xml dialplan
$dialplan["dialplan_xml"] = "<extension name=\"".$dialplan["dialplan_name"]."\" continue=\"false\" uuid=\"".$dialplan_uuid."\">\n";
$dialplan["dialplan_xml"] = "<extension name=\"".xml::sanitize($dialplan["dialplan_name"])."\" continue=\"false\" uuid=\"".xml::sanitize($dialplan_uuid)."\">\n";
//add the dialplan xml destination conditions
if (is_array($conditions)) {
@ -454,11 +454,11 @@
else {
$condition_expression = str_replace("+", "\+", $row['condition_expression']);
}
$dialplan["dialplan_xml"] .= " <condition field=\"".$row['condition_field']."\" expression=\"^".$condition_expression."$\"/>\n";
$dialplan["dialplan_xml"] .= " <condition field=\"".xml::sanitize($row['condition_field'])."\" expression=\"^".xml::sanitize($condition_expression)."$\"/>\n";
}
}
$dialplan["dialplan_xml"] .= " <condition field=\"".$dialplan_detail_type."\" expression=\"".$destination_number_regex."\">\n";
$dialplan["dialplan_xml"] .= " <condition field=\"".xml::sanitize($dialplan_detail_type)."\" expression=\"".xml::sanitize($destination_number_regex)."\">\n";
$dialplan["dialplan_xml"] .= " <action application=\"export\" data=\"call_direction=inbound\" inline=\"true\"/>\n";
$dialplan["dialplan_xml"] .= " <action application=\"set\" data=\"domain_uuid=".$_SESSION['domain_uuid']."\" inline=\"true\"/>\n";
$dialplan["dialplan_xml"] .= " <action application=\"set\" data=\"domain_name=".$_SESSION['domain_name']."\" inline=\"true\"/>\n";
@ -470,7 +470,7 @@
}
if (strlen($destination_cid_name_prefix) > 0) {
$dialplan["dialplan_xml"] .= " <action application=\"set\" data=\"effective_caller_id_name=".$destination_cid_name_prefix."#\${caller_id_name}\" inline=\"false\"/>\n";
$dialplan["dialplan_xml"] .= " <action application=\"set\" data=\"effective_caller_id_name=".xml::sanitize($destination_cid_name_prefix)."#\${caller_id_name}\" inline=\"false\"/>\n";
}
if (strlen($destination_record) > 0 && $destination_record == 'true') {
$dialplan["dialplan_xml"] .= " <action application=\"set\" data=\"record_path=\${recordings_dir}/\${domain_name}/archive/\${strftime(%Y)}/\${strftime(%b)}/\${strftime(%d)}\" inline=\"true\"/>\n";
@ -481,20 +481,20 @@
$dialplan["dialplan_xml"] .= " <action application=\"record_session\" data=\"\${record_path}/\${record_name}\" inline=\"false\"/>\n";
}
if (strlen($destination_hold_music) > 0) {
$dialplan["dialplan_xml"] .= " <action application=\"export\" data=\"hold_music=".$destination_hold_music."\" inline=\"true\"/>\n";
$dialplan["dialplan_xml"] .= " <action application=\"export\" data=\"hold_music=".xml::sanitize($destination_hold_music)."\" inline=\"true\"/>\n";
}
if (strlen($destination_distinctive_ring) > 0) {
$dialplan["dialplan_xml"] .= " <action application=\"export\" data=\"sip_h_Alert-Info=".$destination_distinctive_ring."\" inline=\"true\"/>\n";
$dialplan["dialplan_xml"] .= " <action application=\"export\" data=\"sip_h_Alert-Info=".xml::sanitize($destination_distinctive_ring)."\" inline=\"true\"/>\n";
}
if (strlen($destination_accountcode) > 0) {
$dialplan["dialplan_xml"] .= " <action application=\"export\" data=\"accountcode=".$destination_accountcode."\" inline=\"true\"/>\n";
$dialplan["dialplan_xml"] .= " <action application=\"export\" data=\"accountcode=".xml::sanitize($destination_accountcode)."\" inline=\"true\"/>\n";
}
if (strlen($destination_carrier) > 0) {
$dialplan["dialplan_xml"] .= " <action application=\"set\" data=\"carrier=".$destination_carrier."\" inline=\"true\"/>\n";
$dialplan["dialplan_xml"] .= " <action application=\"set\" data=\"carrier=".xml::sanitize($destination_carrier)."\" inline=\"true\"/>\n";
}
if (strlen($fax_uuid) > 0) {
$dialplan["dialplan_xml"] .= " <action application=\"set\" data=\"tone_detect_hits=1\" inline=\"true\"/>\n";
$dialplan["dialplan_xml"] .= " <action application=\"set\" data=\"execute_on_tone_detect=transfer ".$fax_extension." XML \${domain_name}\" inline=\"true\"/>\n";
$dialplan["dialplan_xml"] .= " <action application=\"set\" data=\"execute_on_tone_detect=transfer ".xml::sanitize($fax_extension)." XML \${domain_name}\" inline=\"true\"/>\n";
$dialplan["dialplan_xml"] .= " <action application=\"tone_detect\" data=\"fax 1100 r +3000\"/>\n";
}
@ -503,7 +503,7 @@
$action_array = explode(":", $destination_action, 2);
if (isset($action_array[0]) && $action_array[0] != '') {
if ($destination->valid($action_array[0].':'.$action_array[1])) {
$dialplan["dialplan_xml"] .= " <action application=\"".$action_array[0]."\" data=\"".$action_array[1]."\"/>\n";
$dialplan["dialplan_xml"] .= " <action application=\"".xml::sanitize($action_array[0])."\" data=\"".xml::sanitize($action_array[1])."\"/>\n";
}
}
}

14
app/destinations/destination_imports.php
View File

@ -277,13 +277,13 @@
}
//build the xml dialplan
$array["dialplans"][$row_id]["dialplan_xml"] = "<extension name=\"".$dialplan_name."\" continue=\"false\" uuid=\"".$dialplan_uuid."\">\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= " <condition field=\"".$dialplan_detail_type."\" expression=\"".$destination_number_regex."\">\n";
$array["dialplans"][$row_id]["dialplan_xml"] = "<extension name=\"".xml::sanitize($dialplan_name)."\" continue=\"false\" uuid=\"".xml::sanitize($dialplan_uuid)."\">\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= " <condition field=\"".xml::sanitize($dialplan_detail_type)."\" expression=\"".xml::sanitize($destination_number_regex)."\">\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"export\" data=\"call_direction=inbound\" inline=\"true\"/>\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"set\" data=\"domain_uuid=".$_SESSION['domain_uuid']."\" inline=\"true\"/>\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"set\" data=\"domain_name=".$_SESSION['domain_name']."\" inline=\"true\"/>\n";
if (strlen($destination_cid_name_prefix) > 0) {
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"set\" data=\"effective_caller_id_name=".$destination_cid_name_prefix."#\${caller_id_name}\" inline=\"true\"/>\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"set\" data=\"effective_caller_id_name=".xml::sanitize($destination_cid_name_prefix)."#\${caller_id_name}\" inline=\"true\"/>\n";
}
if (strlen($destination_record) > 0) {
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"set\" data=\"record_path=\${recordings_dir}/\${domain_name}/archive/\${strftime(%Y)}/\${strftime(%b)}/\${strftime(%d)}\" inline=\"true\"/>\n";
@ -294,18 +294,18 @@
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"record_session\" data=\"\${record_path}/\${record_name}\" inline=\"false\"/>\n";
}
if (strlen($destination_accountcode) > 0) {
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"set\" data=\"accountcode=".$destination_accountcode."\" inline=\"true\"/>\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"set\" data=\"accountcode=".xml::sanitize($destination_accountcode)."\" inline=\"true\"/>\n";
}
if (strlen($destination_carrier) > 0) {
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"set\" data=\"carrier=".$destination_carrier."\" inline=\"true\"/>\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"set\" data=\"carrier=".xml::sanitize($destination_carrier)."\" inline=\"true\"/>\n";
}
if (strlen($fax_uuid) > 0) {
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"set\" data=\"tone_detect_hits=1\" inline=\"true\"/>\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"set\" data=\"execute_on_tone_detect=transfer ".$fax_extension." XML \${domain_name}\" inline=\"true\"/>\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"set\" data=\"execute_on_tone_detect=transfer ".xml::sanitize($fax_extension)." XML \${domain_name}\" inline=\"true\"/>\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"tone_detect\" data=\"fax 1100 r +5000\"/>\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"sleep\" data=\"3000\"/>\n";
}
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"".$destination_app."\" data=\"".$destination_data."\"/>\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= " <action application=\"".xml::sanitize($destination_app)."\" data=\"".xml::sanitize($destination_data)."\"/>\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= " </condition>\n";
$array["dialplans"][$row_id]["dialplan_xml"] .= "</extension>\n";

14
app/fax/resources/classes/fax.php
View File

@ -132,24 +132,24 @@ if (!class_exists('fax')) {
}
//set the rx_fax
$rxfax_data = $_SESSION['switch']['storage']['dir'].'/fax/'.$_SESSION['domain_name'].'/'.$this->fax_extension.'/inbox/'.$this->forward_prefix.'${last_fax}.tif';
$rxfax_data = $_SESSION['switch']['storage']['dir'].'/fax/'.$_SESSION['domain_name'].'/'.xml::sanitize($this->fax_extension).'/inbox/'.xml::sanitize($this->forward_prefix).'${last_fax}.tif';
//build the xml dialplan
$dialplan_xml = "<extension name=\"".$fax_name ."\" continue=\"false\" uuid=\"".$this->dialplan_uuid."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".$this->destination_number."$\">\n";
$dialplan_xml = "<extension name=\"".xml::sanitize($fax_name)."\" continue=\"false\" uuid=\"".xml::sanitize($this->dialplan_uuid)."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".xml::sanitize($this->destination_number)."$\">\n";
$dialplan_xml .= " <action application=\"answer\" data=\"\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"fax_uuid=".$this->fax_uuid."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"fax_uuid=".xml::sanitize($this->fax_uuid)."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"api_hangup_hook=lua app/fax/resources/scripts/hangup_rx.lua\"/>\n";
foreach($_SESSION['fax']['variable'] as $data) {
if (substr($data,0,8) == "inbound:") {
$dialplan_xml .= " <action application=\"set\" data=\"".substr($data,8,strlen($data))."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"".xml::sanitize(substr($data,8,strlen($data)))."\"/>\n";
}
elseif (substr($data,0,9) == "outbound:") {}
else {
$dialplan_xml .= " <action application=\"set\" data=\"".$data."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"".xml::sanitize($data)."\"/>\n";
}
}
$dialplan_xml .= " <action application=\"set\" data=\"".$last_fax."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"".xml::sanitize($last_fax)."\"/>\n";
$dialplan_xml .= " <action application=\"rxfax\" data=\"$rxfax_data\"/>\n";
$dialplan_xml .= " <action application=\"hangup\" data=\"\"/>\n";
$dialplan_xml .= " </condition>\n";

22
app/ivr_menus/ivr_menu_copy.php
View File

@ -113,26 +113,26 @@
}
//build the xml dialplan
$dialplan_xml = "<extension name=\"".$ivr_menu_name."\" continue=\"\" uuid=\"".$dialplan_uuid."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".$ivr_menu_extension."\">\n";
$dialplan_xml = "<extension name=\"".xml::sanitize($ivr_menu_name)."\" continue=\"\" uuid=\"".xml::sanitize($dialplan_uuid)."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".xml::sanitize($ivr_menu_extension)."\">\n";
$dialplan_xml .= " <action application=\"ring_ready\" data=\"\"/>\n";
$dialplan_xml .= " <action application=\"answer\" data=\"\"/>\n";
$dialplan_xml .= " <action application=\"sleep\" data=\"1000\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"hangup_after_bridge=true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"ringback=".$ivr_menu_ringback."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"transfer_ringback=".$ivr_menu_ringback."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"presence_id=".$ivr_menu_extension."@".$_SESSION['domain_name']."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"ringback=".xml::sanitize($ivr_menu_ringback)."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"transfer_ringback=".xml::sanitize($ivr_menu_ringback)."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"presence_id=".xml::sanitize($ivr_menu_extension)."@".$_SESSION['domain_name']."\"/>\n";
if (strlen($ivr_menu_language) > 0) {
$dialplan_xml .= " <action application=\"set\" data=\"default_language=".$ivr_menu_language."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_dialect=".$ivr_menu_dialect."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_voice=".$ivr_menu_voice ."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_language=".xml::sanitize($ivr_menu_language)."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_dialect=".xml::sanitize($ivr_menu_dialect)."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_voice=".xml::sanitize($ivr_menu_voice)."\" inline=\"true\"/>\n";
}
$dialplan_xml .= " <action application=\"set\" data=\"ivr_menu_uuid=".$ivr_menu_uuid."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"ivr_menu_uuid=".xml::sanitize($ivr_menu_uuid)."\"/>\n";
if (strlen($ivr_menu_cid_prefix) > 0) {
$dialplan_xml .= " <action application=\"set\" data=\"caller_id_name=".$ivr_menu_cid_prefix."#\${caller_id_name}\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"caller_id_name=".xml::sanitize($ivr_menu_cid_prefix)."#\${caller_id_name}\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"effective_caller_id_name=\${caller_id_name}\"/>\n";
}
$dialplan_xml .= " <action application=\"ivr\" data=\"".$ivr_menu_uuid."\"/>\n";
$dialplan_xml .= " <action application=\"ivr\" data=\"".xml::sanitize($ivr_menu_uuid)."\"/>\n";
$dialplan_xml .= " <action application=\"hangup\" data=\"\"/>\n";
$dialplan_xml .= " </condition>\n";
$dialplan_xml .= "</extension>\n";

22
app/ivr_menus/ivr_menu_edit.php
View File

@ -332,36 +332,36 @@
}
//build the xml dialplan
$dialplan_xml = "<extension name=\"".$ivr_menu_name."\" continue=\"false\" uuid=\"".$dialplan_uuid."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".$ivr_menu_extension."\$\">\n";
$dialplan_xml = "<extension name=\"".xml::sanitize($ivr_menu_name)."\" continue=\"false\" uuid=\"".xml::sanitize($dialplan_uuid)."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".xml::sanitize($ivr_menu_extension)."\$\">\n";
$dialplan_xml .= " <action application=\"ring_ready\" data=\"\"/>\n";
if ($_SESSION['ivr_menu']['answer']['boolean'] == 'true') {
$dialplan_xml .= " <action application=\"answer\" data=\"\"/>\n";
}
$dialplan_xml .= " <action application=\"sleep\" data=\"1000\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"hangup_after_bridge=true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"ringback=".$ivr_menu_ringback."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"ringback=".xml::sanitize($ivr_menu_ringback)."\"/>\n";
if (strlen($ivr_menu_language) > 0) {
$dialplan_xml .= " <action application=\"set\" data=\"default_language=".$ivr_menu_language."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_dialect=".$ivr_menu_dialect."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_voice=".$ivr_menu_voice ."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_language=".xml::sanitize($ivr_menu_language)."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_dialect=".xml::sanitize($ivr_menu_dialect)."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_voice=".xml::sanitize($ivr_menu_voice)."\" inline=\"true\"/>\n";
}
$dialplan_xml .= " <action application=\"set\" data=\"transfer_ringback=".$ivr_menu_ringback."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"ivr_menu_uuid=".$ivr_menu_uuid."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"transfer_ringback=".xml::sanitize($ivr_menu_ringback)."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"ivr_menu_uuid=".xml::sanitize($ivr_menu_uuid)."\"/>\n";
if ($_SESSION['ivr_menu']['application']['text'] == "lua") {
$dialplan_xml .= " <action application=\"lua\" data=\"ivr_menu.lua\"/>\n";
}
else {
if (strlen($ivr_menu_cid_prefix) > 0) {
$dialplan_xml .= " <action application=\"set\" data=\"caller_id_name=".$ivr_menu_cid_prefix."#\${caller_id_name}\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"caller_id_name=".xml::sanitize($ivr_menu_cid_prefix)."#\${caller_id_name}\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"effective_caller_id_name=\${caller_id_name}\"/>\n";
}
$dialplan_xml .= " <action application=\"ivr\" data=\"".$ivr_menu_uuid."\"/>\n";
$dialplan_xml .= " <action application=\"ivr\" data=\"".xml::sanitize($ivr_menu_uuid)."\"/>\n";
}
if (strlen($ivr_menu_exit_app) > 0) {
$dialplan_xml .= " <action application=\"".$ivr_menu_exit_app."\" data=\"".$ivr_menu_exit_data."\"/>\n";
$dialplan_xml .= " <action application=\"".xml::sanitize($ivr_menu_exit_app)."\" data=\"".xml::sanitize($ivr_menu_exit_data)."\"/>\n";
}
$dialplan_xml .= " </condition>\n";
$dialplan_xml .= "</extension>\n";

6
app/ring_groups/ring_group_edit.php
View File

@ -385,10 +385,10 @@
}
//build the xml dialplan
$dialplan_xml = "<extension name=\"".$ring_group_name."\" continue=\"\" uuid=\"".$dialplan_uuid."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".$ring_group_extension."$\">\n";
$dialplan_xml = "<extension name=\"".xml::sanitize($ring_group_name)."\" continue=\"\" uuid=\"".xml::sanitize($dialplan_uuid)."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".xml::sanitize($ring_group_extension)."$\">\n";
$dialplan_xml .= " <action application=\"ring_ready\" data=\"\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"ring_group_uuid=".$ring_group_uuid."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"ring_group_uuid=".xml::sanitize($ring_group_uuid)."\"/>\n";
$dialplan_xml .= " <action application=\"lua\" data=\"app.lua ring_groups\"/>\n";
$dialplan_xml .= " </condition>\n";
$dialplan_xml .= "</extension>\n";