dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[security] sanitize the xml (#6595)

Browse Source 
* Update call_center_queue_edit.php

* fix typo

* Update call_flow_edit.php

* Update conference_center_edit.php

* Update conference_edit.php

* Update destination_edit.php

* Update fax.php

* Update ivr_menu_edit.php

* Update ring_group_edit.php

* Update app_defaults.php

* Update ivr_menu_copy.php

* Update destination_imports.php

* Update app_defaults.php
This commit is contained in:
Alex
2023-03-30 12:46:36 -06:00
committed by GitHub
parent 3091370f14
commit 43eb2a5b9d
12 changed files with 76 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/call_centers/app_defaults.php
+11 -11
View File
@@ -94,43 +94,43 @@ if ($domains_processed == 1) {
}
//build the xml dialplan
$dialplan_xml = "<extension name=\"".$row["queue_name"]."\" continue=\"\" uuid=\"".$row["dialplan_uuid"]."\">\n";
$dialplan_xml = "<extension name=\"".xml::sanitize($row["queue_name"])."\" continue=\"\" uuid=\"".xml::sanitize($row["dialplan_uuid"])."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^([^#]+#)(.*)\$\" break=\"never\">\n";
$dialplan_xml .= " <action application=\"set\" data=\"caller_id_name=\$2\"/>\n";
$dialplan_xml .= " </condition>\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^(callcenter\+)?".$row["queue_extension"]."$\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^(callcenter\+)?".xml::sanitize($row["queue_extension"])."$\">\n";
$dialplan_xml .= " <action application=\"answer\" data=\"\"/>\n";
if (is_uuid($row['call_center_queue_uuid'])) {
$dialplan_xml .= " <action application=\"set\" data=\"call_center_queue_uuid=".$row['call_center_queue_uuid']."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"call_center_queue_uuid=".xml::sanitize($row['call_center_queue_uuid'])."\"/>\n";
}
if (is_numeric($row['queue_extension'])) {
$dialplan_xml .= " <action application=\"set\" data=\"queue_extension=".$row['queue_extension']."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"queue_extension=".xml::sanitize($row['queue_extension'])."\"/>\n";
}
$dialplan_xml .= " <action application=\"set\" data=\"cc_export_vars=\${cc_export_vars},call_center_queue_uuid,sip_h_Alert-Info\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"hangup_after_bridge=true\"/>\n";
if ($row['queue_time_base_score_sec'] != '') {
$dialplan_xml .= " <action application=\"set\" data=\"cc_base_score=".$row['queue_time_base_score_sec']."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"cc_base_score=".xml::sanitize($row['queue_time_base_score_sec'])."\"/>\n";
}
if ($row['queue_greeting'] != '') {
$greeting_array = explode(':', $row['queue_greeting']);
if (count($greeting_array) == 1) {
$dialplan_xml .= " <action application=\"playback\" data=\"".$queue_greeting_path."\"/>\n";
$dialplan_xml .= " <action application=\"playback\" data=\"".xml::sanitize($queue_greeting_path)."\"/>\n";
}
else {
if ($greeting_array[0] == 'say' || $greeting_array[0] == 'tone_stream' || $greeting_array[0] == 'phrase') {
$dialplan_xml .= " <action application=\"".$greeting_array[0]."\" data=\"".$greeting_array[1]."\"/>\n";
$dialplan_xml .= " <action application=\"".xml::sanitize($greeting_array[0])."\" data=\"".xml::sanitize($greeting_array[1])."\"/>\n";
}
}
}
if (strlen($row['queue_cid_prefix']) > 0) {
$dialplan_xml .= " <action application=\"set\" data=\"effective_caller_id_name=".$row['queue_cid_prefix']."#\${caller_id_name}\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"effective_caller_id_name=".xml::sanitize($row['queue_cid_prefix'])."#\${caller_id_name}\"/>\n";
}
if (strlen($row['queue_cc_exit_keys']) > 0) {
$dialplan_xml .= " <action application=\"set\" data=\"cc_exit_keys=".$row['queue_cc_exit_keys']."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"cc_exit_keys=".xml::sanitize($row['queue_cc_exit_keys'])."\"/>\n";
}
$dialplan_xml .= " <action application=\"callcenter\" data=\"".$row['queue_extension']."@".$row['domain_name']."\"/>\n";
$dialplan_xml .= " <action application=\"callcenter\" data=\"".xml::sanitize($row['queue_extension'])."@".xml::sanitize($row['domain_name'])."\"/>\n";
//if ($destination->valid($queue_timeout_app.':'.$queue_timeout_data)) {
$dialplan_xml .= " <action application=\"".$queue_timeout_app."\" data=\"".$queue_timeout_data."\"/>\n";
$dialplan_xml .= " <action application=\"".xml::sanitize($queue_timeout_app)."\" data=\"".xml::sanitize($queue_timeout_data)."\"/>\n";
//}
$dialplan_xml .= " </condition>\n";
$dialplan_xml .= "</extension>";