dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[security] sanitize the xml (#6595)

Browse Source 
* Update call_center_queue_edit.php

* fix typo

* Update call_flow_edit.php

* Update conference_center_edit.php

* Update conference_edit.php

* Update destination_edit.php

* Update fax.php

* Update ivr_menu_edit.php

* Update ring_group_edit.php

* Update app_defaults.php

* Update ivr_menu_copy.php

* Update destination_imports.php

* Update app_defaults.php
This commit is contained in:
Alex
2023-03-30 12:46:36 -06:00
committed by GitHub
parent 3091370f14
commit 43eb2a5b9d
12 changed files with 76 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/ivr_menus/ivr_menu_edit.php
+11 -11
View File
@@ -332,36 +332,36 @@
}
//build the xml dialplan
$dialplan_xml = "<extension name=\"".$ivr_menu_name."\" continue=\"false\" uuid=\"".$dialplan_uuid."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".$ivr_menu_extension."\$\">\n";
$dialplan_xml = "<extension name=\"".xml::sanitize($ivr_menu_name)."\" continue=\"false\" uuid=\"".xml::sanitize($dialplan_uuid)."\">\n";
$dialplan_xml .= " <condition field=\"destination_number\" expression=\"^".xml::sanitize($ivr_menu_extension)."\$\">\n";
$dialplan_xml .= " <action application=\"ring_ready\" data=\"\"/>\n";
if ($_SESSION['ivr_menu']['answer']['boolean'] == 'true') {
$dialplan_xml .= " <action application=\"answer\" data=\"\"/>\n";
}
$dialplan_xml .= " <action application=\"sleep\" data=\"1000\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"hangup_after_bridge=true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"ringback=".$ivr_menu_ringback."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"ringback=".xml::sanitize($ivr_menu_ringback)."\"/>\n";
if (strlen($ivr_menu_language) > 0) {
$dialplan_xml .= " <action application=\"set\" data=\"default_language=".$ivr_menu_language."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_dialect=".$ivr_menu_dialect."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_voice=".$ivr_menu_voice ."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_language=".xml::sanitize($ivr_menu_language)."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_dialect=".xml::sanitize($ivr_menu_dialect)."\" inline=\"true\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"default_voice=".xml::sanitize($ivr_menu_voice)."\" inline=\"true\"/>\n";
}
$dialplan_xml .= " <action application=\"set\" data=\"transfer_ringback=".$ivr_menu_ringback."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"ivr_menu_uuid=".$ivr_menu_uuid."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"transfer_ringback=".xml::sanitize($ivr_menu_ringback)."\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"ivr_menu_uuid=".xml::sanitize($ivr_menu_uuid)."\"/>\n";
if ($_SESSION['ivr_menu']['application']['text'] == "lua") {
$dialplan_xml .= " <action application=\"lua\" data=\"ivr_menu.lua\"/>\n";
}
else {
if (strlen($ivr_menu_cid_prefix) > 0) {
$dialplan_xml .= " <action application=\"set\" data=\"caller_id_name=".$ivr_menu_cid_prefix."#\${caller_id_name}\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"caller_id_name=".xml::sanitize($ivr_menu_cid_prefix)."#\${caller_id_name}\"/>\n";
$dialplan_xml .= " <action application=\"set\" data=\"effective_caller_id_name=\${caller_id_name}\"/>\n";
}
$dialplan_xml .= " <action application=\"ivr\" data=\"".$ivr_menu_uuid."\"/>\n";
$dialplan_xml .= " <action application=\"ivr\" data=\"".xml::sanitize($ivr_menu_uuid)."\"/>\n";
}
if (strlen($ivr_menu_exit_app) > 0) {
$dialplan_xml .= " <action application=\"".$ivr_menu_exit_app."\" data=\"".$ivr_menu_exit_data."\"/>\n";
$dialplan_xml .= " <action application=\"".xml::sanitize($ivr_menu_exit_app)."\" data=\"".xml::sanitize($ivr_menu_exit_data)."\"/>\n";
}
$dialplan_xml .= " </condition>\n";
$dialplan_xml .= "</extension>\n";