dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Remove email_logs download. (#6331)

Browse Source 
* Remove email_logs download.

This feature has a security risk that is being eliminated by removing the download feature.

* Update email_logs.php
This commit is contained in:
FusionPBX
2022-03-21 10:01:05 -06:00
committed by GitHub
parent 8aaa3a6b9a
commit 4e260b170e
2 changed files with 3 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/email_logs/resources/classes/email_logs.php
+1 -123
View File
@@ -198,129 +198,7 @@ if (!class_exists('email_logs')) {
}
}
/**
* download records
*/
public function download($records) {
if (permission_exists($this->permission_prefix.'download')) {
//add multi-lingual support
$language = new text;
$text = $language->get();
//validate the token
$token = new token;
if (!$token->validate('/app/email_logs/email_logs.php')) {
message::add($text['message-invalid_token'],'negative');
header('Location: '.$this->list_page);
exit;
}
//download multiple records (eventually zip individual emails together)
if (is_array($records) && @sizeof($records) != 0) {
//retrieve checked records
foreach($records as $x => $record) {
if ($record['checked'] == 'true' && is_uuid($record['uuid'])) {
$uuids[] = $record['uuid'];
}
}
//download emails
if (is_array($uuids) && @sizeof($uuids) != 0) {
foreach ($uuids as $x => $uuid) {
//get email details
$sql = "select call_uuid, sent_date, type, email from v_email_logs ";
$sql .= "where email_log_uuid = :email_log_uuid ";
$parameters['email_log_uuid'] = $uuid;
$database = new database;
$row = $database->select($sql, $parameters, 'row');
if (is_array($row) && @sizeof($row) != 0 && is_uuid($row['call_uuid'])) {
//santize filename components
$sent_date = str_replace('-','', $row['sent_date']);
$sent_date = str_replace(':','', $sent_date);
$sent_date = str_replace(' ','_', $sent_date);
$type = strtolower($row['type']);
$email_filename = $sent_date.'_'.$type.'_'.$row['call_uuid'].'.eml';
//single email
if (@sizeof($uuids) == 1) {
//set headers
header("Content-Type: message/rfc822");
header('Content-Disposition: attachment; filename="'.$email_filename.'"');
header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past
header("Content-Length: ".strlen($row['email']));
//output content
echo $row['email'];
exit;
}
//multiple emails
else {
if (is_dir($_SESSION['server']['temp']['dir'])) {
if (file_put_contents($_SESSION['server']['temp']['dir'].'/'.$email_filename, $row['email'])) {
$email_files[] = $_SESSION['server']['temp']['dir'].'/'.$email_filename;
}
}
}
}
unset($sql, $parameters, $row);
}
//download compressed file
if (@sizeof($email_files) != 0) {
//define compressed file name
$compressed_filename = 'emails_'.date('Ymd_His').'.zip';
//compress email files
$command = 'zip -mj '.$_SESSION['server']['temp']['dir'].'/'.$compressed_filename.' '.implode(' ', $email_files).' 2>&1';
exec($command, $response, $restore_errlevel);
unset($command);
//push download
if (file_exists($_SESSION['server']['temp']['dir'].'/'.$compressed_filename)) {
//open file
session_cache_limiter('public');
$fd = fopen($_SESSION['server']['temp']['dir'].'/'.$compressed_filename, 'rb');
//set headers
header("Content-Type: application/zip");
header('Content-Disposition: attachment; filename="'.$compressed_filename.'"');
header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past
header("Content-Length: ".filesize($_SESSION['server']['temp']['dir'].'/'.$compressed_filename));
//output file content
ob_clean();
fpassthru($fd);
fclose($fd);
//remove compressed file
@unlink($_SESSION['server']['temp']['dir'].'/'.$compressed_filename);
exit;
}
}
}
}
}
} //method
} //class
}
?>
?>