Merge branch 'master' into master

.htaccess

@@ -1,5 +1,8 @@
 RewriteEngine    On
 
+#REST api
+RewriteRule ^(.*)/api/(.*)$                                                     $1/api/index.php?rewrite_uri=$2 [QSA]
+
 # $mac or $mac.cfg/xml
 RewriteRule     ^.*([A-Fa-f0-9]{12})(?:\.xml|\.cfg)?$                           app/provision/index.php?mac=$1 [QSA]
 

README.md

@@ -1,9 +1,9 @@
-What is [FusionPBX](http://fusionpbx.com/)?
+What is [FusionPBX](https://www.fusionpbx.com/)?
 --------------------------------------
 
-[FusionPBX](http://fusionpbx.com/) can be used as a single or domain based multi-tenant PBX, carrier grade switch, call center server, fax server, VoIP server, voicemail server, conference server, voice application server, multi-tenant appliance framework and more. [FreeSWITCH™](http://freeswitch.org) is a highly scalable, multi-threaded, multi-platform communication platform. 
+[FusionPBX](http://fusionpbx.com/) can be used as a single or domain based multi-tenant PBX, carrier grade switch, call center server, fax server, VoIP server, voicemail server, conference server, voice application server, multi-tenant appliance framework and more. [FreeSWITCH™](https://freeswitch.com) is a highly scalable, multi-threaded, multi-platform communication platform. 
 
-It provides the functionality your business needs and brings carrier grade switching, and corporate-level phone system features to small, medium, and large businesses. Read more at [FusionPBX](http://fusionpbx.com/). [Please visit our youtube channel](https://www.youtube.com/FusionPBX)
+It provides the functionality your business needs and brings carrier grade switching, and corporate-level phone system features to small, medium, and large businesses. Read more at [FusionPBX](https://www.fusionpbx.com/). [Please visit our youtube channel](https://www.youtube.com/FusionPBX)
 
 In addition to providing all of the usual PBX functionality, FusionPBX allows you to configure:
 
@@ -20,38 +20,38 @@ In addition to providing all of the usual PBX functionality, FusionPBX allows yo
 - Hot desking
 - High Availability and Redundancy
 - Dialplan Programming that allow nearly endless possibilities
-- [Many other Features](http://docs.fusionpbx.com/en/latest/features/features.html)
+- [Many other Features](https://docs.fusionpbx.com/en/latest/features/features.html)
 
 Free Support
 --------------------------------------
 We provide several avenues for you to get your system up and running on your own and learn the basics of the system.
 
 1. [Youtube Channel](https://www.youtube.com/channel/UCN5j2ITmjua1MfjGR8jX9TA)
-2. [Documentation](http://docs.fusionpbx.com)
+2. [Documentation](https://docs.fusionpbx.com)
 3. [How to Contribute](https://github.com/Fusionpbx/opensource)
 
 Commercial Support
 --------------------------------------
 These options support the project and cover any kind of help you might need from architecture, installation, best practices, troubleshooting, custom feature programming, and training.
 
-1. [Commercial Paid Support](http://fusionpbx.com/support.php)
+1. [Commercial Paid Support](https://www.fusionpbx.com/support)
-2. [Custom Feature Development](http://fusionpbx.com/support.php)
+2. [Custom Feature Development](https://www.fusionpbx.com/support)
-3. [Admin Training](http://fusionpbx.com)
+3. [Admin Training](https://www.fusionpbx.com)
-4. [Advanced Training](http://fusionpbx.com)
+4. [Advanced Training](https://www.fusionpbx.com)
-5. [Developer Training](http://fusionpbx.com)
+5. [Developer Training](https://www.fusionpbx.com)
 
 Software Requirements
 --------------------------------------
 
-- FusionPBX will run on Debian 8, FreeBSD 10 & 11, CentOS, and more.
+- FusionPBX will run on Debian 8 & 9, FreeBSD 10 & 11, CentOS, and more.
-- [FusionPBX Installer](http://fusionpbx.com/download.php)
+- [FusionPBX Installer](https://fusionpbx.com/download.php)
 
 Community
 --------------------------------------
 We have a pretty thriving community. You can find us here:
 
-- [Twitter](http://twitter.com/fusionpbx)
+- [Twitter](https://twitter.com/fusionpbx)
-- [Website](http://fusionpbx.com)
+- [Website](https://fusionpbx.com)
 
 Contributing
 ---------------------------------------
@@ -93,3 +93,6 @@ cd /usr/src/fusionpbx-install.sh/debian
 This install script is designed to be an fast, simple, and in a modular way to install FusionPBX. Start with a minimal install of Debian 8 with SSH enabled. Run the following commands under root. The script installs FusionPBX, FreeSWITCH release package and its dependencies, IPTables, Fail2ban, NGINX, PHP FPM and PostgreSQL.
 
 Some installations require special considerations. Visit https://github.com/fusionpbx/fusionpbx-install.sh readme section for more details.
+
+### ISSUES
+If you find a bug sign up for an account on [www.fusionpbx.com](https://www.fusionpbx.com) to report the issue.

app/access_controls/access_control_delete.php

@@ -73,7 +73,7 @@
 	}
 
 //redirect the user
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header('Location: access_controls.php');
 
 

app/access_controls/access_control_edit.php

@@ -108,7 +108,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 				if ($fp) { event_socket_request($fp, "api reloadacl"); }
 
 				//add the message
-				messages::add($text['message-add']);
+				message::add($text['message-add']);
 				
 				//redirect the user
 				header("Location: access_controls.php");
@@ -135,7 +135,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 				if ($fp) { event_socket_request($fp, "api reloadacl"); }
 
 				//add the message
-				messages::add($text['message-update']);
+				message::add($text['message-update']);
 
 				//redirect the user
 				header("Location: access_controls.php");

app/access_controls/access_control_node_delete.php

@@ -62,7 +62,7 @@
 	}
 
 //redirect the browser
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header('Location: access_control_edit.php?id='.$access_control_uuid);
 
 ?>

app/access_controls/access_control_node_edit.php

@@ -128,7 +128,7 @@ if (count($_POST) > 0 && strlen($_POST["persistformvar"]) == 0) {
 				if ($fp) { event_socket_request($fp, "api reloadacl"); }
 
 				//add the message
-				messages::add($text['message-add']);
+				message::add($text['message-add']);
 
 				//redirect the browser
 				header('Location: access_control_edit.php?id='.escape($access_control_uuid));
@@ -158,7 +158,7 @@ if (count($_POST) > 0 && strlen($_POST["persistformvar"]) == 0) {
 				if ($fp) { event_socket_request($fp, "api reloadacl"); }
 
 				//add the message
-				messages::add($text['message-update']);
+				message::add($text['message-update']);
 
 				//redirect the browser
 				header('Location: access_control_edit.php?id='.escape($access_control_uuid));

app/access_controls/app_config.php

@@ -93,7 +93,7 @@
 		$apps[$x]['db'][$y]['fields'][$z]['type']['sqlite'] = "text";
 		$apps[$x]['db'][$y]['fields'][$z]['type']['mysql'] = "char(36)";
 		$apps[$x]['db'][$y]['fields'][$z]['key']['type'] = "foreign";
-		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['table'] = "v_access_control";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['table'] = "v_access_controls";
 		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['field'] = "access_control_uuid";
 		$z++;
 		$apps[$x]['db'][$y]['fields'][$z]['name'] = "node_type";
@@ -112,4 +112,4 @@
 		$apps[$x]['db'][$y]['fields'][$z]['type'] = "text";
 		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "Enter the description.";
 
-?>
+?>

app/adminer/index.php

@@ -33,7 +33,7 @@
 					return 'Adminer';
 				}
 
-				function permanentLogin() {
+				function permanentLogin($j = false) {
 					// key used for permanent login
 					if ($_SESSION['adminer']['auto_login']['boolean'] == 'true') {
 						return "7bebc76d8680196752c6b961ef13c360";
@@ -43,7 +43,7 @@
 				function credentials() {
 					// server, username and password for connecting to database
 					if ($_SESSION['adminer']['auto_login']['boolean'] == 'true') {
-						global $db_host, $db_username, $db_password;
+						global $db_host, $db_port, $db_username, $db_password;
 						return array($db_host.':'.$db_port, $db_username, $db_password);
 					}
 				}

app/backup/index.php

@@ -17,22 +17,25 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2016
+	Portions created by the Initial Developer are Copyright (C) 2008-2019
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
 	Mark J Crane <markjcrane@fusionpbx.com>
 */
-include "root.php";
+//includes
-require_once "resources/require.php";
+	include "root.php";
-require_once "resources/check_auth.php";
+	require_once "resources/require.php";
-if (permission_exists("backup_download")) {
+	require_once "resources/check_auth.php";
-	//access granted
+
-}
+//check permissions
-else {
+	if (permission_exists("backup_download")) {
-	echo "access denied";
+		//access granted
-	exit;
+	}
-}
+	else {
+		echo "access denied";
+		exit;
+	}
 
 //add multi-lingual support
 	$language = new text;
@@ -40,8 +43,9 @@ else {
 
 //download the backup
 	if ($_GET['a'] == "download" && permission_exists('backup_download')) {
-		$file_format = $_GET['file_format'];
+		//get the file format
-		$file_format = ($file_format != '') ? $file_format : 'tgz';
+			$file_format = $_GET['file_format'];
+			$file_format = ($file_format != '') ? $file_format : 'tgz';
 
 		//build the backup file
 			$backup_path = ($_SESSION['server']['backup']['path'] != '') ? $_SESSION['server']['backup']['path'] : '/tmp';
@@ -55,8 +59,12 @@ else {
 					default : $cmd = 'tar -zvcf ';
 				}
 				$cmd .= $backup_path.'/'.$backup_file.' ';
-				if (isset($_SESSION['backup']['path'])) foreach ($_SESSION['backup']['path'] as $value) {
+				if (isset($_SESSION['backup']['path'])) {
-					$cmd .= $value.' ';
+					foreach ($_SESSION['backup']['path'] as $value) {
+						if (file_exists($value)) {
+							$cmd .= $value.' ';
+						}
+					}
 				}
 				$cmd .= " 2>&1";
 				exec($cmd, $response, $restore_errlevel);
@@ -81,14 +89,14 @@ else {
 				}
 				else {
 					//set response message
-					messages::add($text['message-backup_failed_format'] . $response_txt, 'negative');
+					message::add($text['message-backup_failed_format'] . $response_txt, 'negative');
 					header("Location: ".$_SERVER['PHP_SELF']);
 					exit;
 				}
 			}
 			else {
 				//set response message
-				messages::add($text['message-backup_failed_paths'], 'negative');
+				message::add($text['message-backup_failed_paths'], 'negative');
 				header("Location: ".$_SERVER['PHP_SELF']);
 				exit;
 			}
@@ -109,7 +117,7 @@ else {
 		$backup_path = ($_SESSION['server']['backup']['path'] != '') ? $_SESSION['server']['backup']['path'] : '/tmp';
 		$backup_file = $_FILES['backup_file']['name'];
 
-		if (is_uploaded_file($_FILES['backup_file']['tmp_name'])) {
+		if (is_uploaded_file($_FILES['backup_file']['tmp_name']) && file_exists($backup_path.'/'.$backup_file)) {
 			//move temp file to backup path
 			move_uploaded_file($_FILES['backup_file']['tmp_name'], $backup_path.'/'.$backup_file);
 			//determine file format and restore backup
@@ -124,7 +132,7 @@ else {
 			}
 			if (!$valid_format) {
 				@unlink($backup_path.'/'.$backup_file);
-				messages::add($text['message-restore_failed_format'], 'negative');
+				message::add($text['message-restore_failed_format'], 'negative');
 				header("Location: ".$_SERVER['PHP_SELF']);
 				exit;
 			}
@@ -134,11 +142,11 @@ else {
 				$response_txt = "<br>" . implode("<br>", $response);
 				if ($restore_errlevel == 0) {
 					//set response message
-					messages::add($text['message-restore_completed']);
+					message::add($text['message-restore_completed']);
 					header("Location: ".$_SERVER['PHP_SELF']);
 					exit;
 				} else {
-					messages::add($text['message-restore_failed_extract'] . $response_txt, 'negative');
+					message::add($text['message-restore_failed_extract'] . $response_txt, 'negative');
 					header("Location: ".$_SERVER['PHP_SELF']);
 					exit;
 				}
@@ -146,7 +154,7 @@ else {
 		}
 		else {
 			//set response message
-			messages::add($text['message-restore_failed_upload'], 'negative');
+			message::add($text['message-restore_failed_upload'], 'negative');
 			header("Location: ".$_SERVER['PHP_SELF']);
 			exit;
 		}
@@ -265,4 +273,4 @@ else {
  //show the footer
  	require_once "resources/footer.php";
 
-?>
+?>

app/bridges/bridge_delete.php

@@ -33,7 +33,7 @@
 	$text = $language->get();
 
 //delete the message
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 
 //delete the data
 	if (isset($_GET["id"]) && is_uuid($_GET["id"]) && permission_exists('bridge_delete')) {

app/bridges/bridge_edit.php

@@ -17,7 +17,7 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2018
+	Portions created by the Initial Developer are Copyright (C) 2018 - 2019
 	the Initial Developer. All Rights Reserved.
 */
 
@@ -127,13 +127,15 @@
 //pre-populate the form
 	if (is_array($_GET) && $_POST["persistformvar"] != "true") {
 		$bridge_uuid = check_str($_GET["id"]);
+		$parameters['bridge_uuid'] = $bridge_uuid;
 		$sql = "select * from v_bridges ";
-		$sql .= "where bridge_uuid = '$bridge_uuid' ";
+		$sql .= "where bridge_uuid = :bridge_uuid ";
-		//$sql .= "and domain_uuid = '$domain_uuid' ";
+		//$sql .= "and domain_uuid = :domain_uuid ";
-		$prep_statement = $db->prepare(check_sql($sql));
+		$database = new database;
-		$prep_statement->execute();
+		//$database = $database->app_name = 'bridges';
-		$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
+		$result = $database->execute($sql, $parameters);
-		foreach ($result as &$row) {
+		//$message = $database->message;
+		foreach ($result as $row) {
 			$bridge_name = $row["bridge_name"];
 			$bridge_destination = $row["bridge_destination"];
 			$bridge_enabled = $row["bridge_enabled"];
@@ -161,7 +163,7 @@
 	echo "	".$text['label-bridge_name']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' style='position: relative;' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='bridge_name' maxlength='255' value=\"".escape($bridge_name)."\">\n";
+	echo "	<input class='formfld' type='text' name='bridge_name' maxlength='255' value='".escape($bridge_name)."'>\n";
 	echo "<br />\n";
 	echo $text['description-bridge_name']."\n";
 	echo "</td>\n";
@@ -172,7 +174,7 @@
 	echo "	".$text['label-bridge_destination']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' style='position: relative;' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='bridge_destination' maxlength='255' value=\"".escape($bridge_destination)."\">\n";
+	echo "	<input class='formfld' type='text' name='bridge_destination' maxlength='255' value='".escape($bridge_destination)."'>\n";
 	echo "<br />\n";
 	echo $text['description-bridge_destination']."\n";
 	echo "</td>\n";
@@ -205,7 +207,7 @@
 
 	echo "	<tr>\n";
 	echo "		<td colspan='2' align='right'>\n";
-	echo "				<input type='hidden' name='bridge_uuid' value='$bridge_uuid'>\n";
+	echo "				<input type='hidden' name='bridge_uuid' value='".escape($bridge_uuid)."'>\n";
 	echo "				<input type='submit' class='btn' value='".$text['button-save']."'>\n";
 	echo "		</td>\n";
 	echo "	</tr>";

app/bridges/bridges.php

@@ -17,7 +17,7 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2018
+	Portions created by the Initial Developer are Copyright (C) 2018 - 2019
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
@@ -28,6 +28,7 @@
 	require_once "root.php";
 	require_once "resources/require.php";
 	require_once "resources/check_auth.php";
+	require_once "resources/paging.php";
 
 //check permissions
 	if (permission_exists('bridge_view')) {
@@ -60,27 +61,39 @@
 				$obj = new bridges;
 				$obj->delete($bridges);
 			//delete message
-				messages::add($text['message-delete']);
+				message::add($text['message-delete']);
 		}
 	}
 
-//get variables used to control the order
+//get order and order by and sanatize the values
-	$order_by = check_str($_GET["order_by"]);
+	$order_by = $_GET["order_by"];
-	$order = check_str($_GET["order"]);
+	$order = $_GET["order"];
+	if (strlen($order_by) > 0) {
+		$order_by = preg_replace('#[^a-zA-Z0-9_\-]#', '', $order_by);
+	}
+	if (strlen($order) > 0) {
+		if ($order == 'asc' || $order == 'desc') {
+			//expected value
+		}
+		else {
+			$order = '';
+		}
+	}
+
+//add the parameters
+	$parameters['domain_uuid'] = $domain_uuid;
 
 //add the search term
 	$search = strtolower(check_str($_GET["search"]));
 	if (strlen($search) > 0) {
 		$sql_search = " (";
-		$sql_search .= "lower(bridge_name) like '%".$search."%' ";
+		$sql_search .= "	lower(bridge_name) like :search ";
-		$sql_search .= "or lower(bridge_destination) like '%".$search."%' ";
+		$sql_search .= "	or lower(bridge_destination) like :search ";
-		$sql_search .= "or lower(bridge_enabled) like '%".$search."%' ";
+		$sql_search .= "	or lower(bridge_enabled) like :search ";
 		$sql_search .= ") ";
-	}
 
-//additional includes
+		$parameters['search'] = '%'.$search.'%';
-	require_once "resources/header.php";
+	}
-	require_once "resources/paging.php";
 
 //prepare to page the results
 	$sql = "select count(bridge_uuid) as num_rows from v_bridges ";
@@ -88,23 +101,23 @@
 		if (isset($sql_search)) {
 			$sql .= "where ".$sql_search;
 		}
-	} else {
+	}
-		$sql .= "where (domain_uuid = '".$domain_uuid."' or domain_uuid is null) ";
+	else {
+		$sql .= "where (domain_uuid = :domain_uuid or domain_uuid is null) ";
 		if (isset($sql_search)) {
 			$sql .= "and ".$sql_search;
 		}
 	}
-	if (strlen($order_by)> 0) { $sql .= "order by $order_by $order "; }
+	if (strlen($order_by) > 0) {
-	$prep_statement = $db->prepare($sql);
+		$sql .= "order by $order_by $order ";
-	if ($prep_statement) {
+	}
-		$prep_statement->execute();
+	$database = new database;
-		$row = $prep_statement->fetch(PDO::FETCH_ASSOC);
+	$row = $database->execute($sql, $parameters);
-		if ($row['num_rows'] > 0) {
+	if ($row[0]['num_rows'] > 0) {
-			$num_rows = $row['num_rows'];
+		$num_rows = $row[0]['num_rows'];
-		}
+	}
-		else {
+	else {
-			$num_rows = '0';
+		$num_rows = '0';
-		}
 	}
 
 //prepare to page the results
@@ -124,24 +137,32 @@
 		if (isset($sql_search)) {
 			$sql .= "where ".$sql_search;
 		}
-	} else {
+	}
-		$sql .= "where (domain_uuid = '".$domain_uuid."' or domain_uuid is null) ";
+	else {
+		$sql .= "where (domain_uuid = :domain_uuid or domain_uuid is null) ";
 		if (isset($sql_search)) {
 			$sql .= "and ".$sql_search;
 		}
 	}
-	if (strlen($order_by) > 0) { $sql .= "order by $order_by $order "; }
+	if (strlen($order_by) > 0) {
-	$sql .= "limit $rows_per_page offset $offset ";
+		$sql .= "order by $order_by $order ";
-	$prep_statement = $db->prepare(check_sql($sql));
+	}
-	$prep_statement->execute();
+	if (is_numeric($rows_per_page) && is_numeric($offset)) {
-	$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
+		$sql .= "limit $rows_per_page offset $offset ";
-	unset ($prep_statement, $sql);
+	}
+	$database = new database;
+	$bridges = $database->execute($sql, $parameters);
+	//$message = $database->message;
+	//print_r($message);
 
 //alternate the row style
 	$c = 0;
 	$row_style["0"] = "row_style0";
 	$row_style["1"] = "row_style1";
 
+//include the header
+	require_once "resources/header.php";
+
 //define the checkbox_toggle function
 	echo "<script type=\"text/javascript\">\n";
 	echo "	function checkbox_toggle(item) {\n";
@@ -206,11 +227,11 @@
 	echo "	</td>\n";
 	echo "<tr>\n";
 
-	if (is_array($result)) {
+	if (is_array($bridges)) {
 		$x = 0;
-		foreach($result as $row) {
+		foreach($bridges as $row) {
 			if (permission_exists('bridge_edit')) {
-				$tr_link = "href='bridge_edit.php?id=".$row['bridge_uuid']."'";
+				$tr_link = "href='bridge_edit.php?id=".escape($row['bridge_uuid'])."'";
 			}
 			echo "<tr ".$tr_link.">\n";
 			echo "	<td valign='top' class='".$row_style[$c]." tr_link_void' style='align: center; padding: 3px 3px 0px 8px;'>\n";
@@ -232,7 +253,7 @@
 			$x++;
 			if ($c==0) { $c=1; } else { $c=0; }
 		} //end foreach
-		unset($sql, $result, $row_count);
+		unset($sql, $bridges);
 	} //end if results
 
 	echo "<tr>\n";

app/call_block/app_config.php

@@ -28,6 +28,16 @@
 		$apps[$x]['description']['sv-se'] = "";
 		$apps[$x]['description']['uk-ua'] = "";
 
+	//default settings
+		$y=0;
+		$apps[$x]['default_settings'][$y]['default_setting_uuid'] = "e8356e52-3d18-4da5-93b1-9b2e08878982";
+		$apps[$x]['default_settings'][$y]['default_setting_category'] = "call_block";
+		$apps[$x]['default_settings'][$y]['default_setting_subcategory'] = "recent_call_limit";
+		$apps[$x]['default_settings'][$y]['default_setting_name'] = "text";
+		$apps[$x]['default_settings'][$y]['default_setting_value'] = "50";
+		$apps[$x]['default_settings'][$y]['default_setting_enabled'] = "true";
+		$apps[$x]['default_settings'][$y]['default_setting_description'] = "Number of recent calls to show.";
+
 	//permission details
 		$y=0;
 		$apps[$x]['permissions'][$y]['name'] = "call_block_view";
@@ -97,4 +107,4 @@
 		$apps[$x]['db'][$y]['fields'][$z]['type'] = "text";
 		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "Enable/disable blocking the call.";
 
-?>
+?>

app/call_block/call_block_cdr_add.php

@@ -17,7 +17,7 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2012
+	Portions created by the Initial Developer are Copyright (C) 2008-2018
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
@@ -25,17 +25,20 @@
 
 	Call Block is written by Gerrit Visser <gerrit308@gmail.com>
 */
-require_once "root.php";
-require_once "resources/require.php";
-require_once "resources/check_auth.php";
 
-if (permission_exists('call_block_edit') || permission_exists('call_block_add')) {
+//includes
-	//access granted
+	require_once "root.php";
-}
+	require_once "resources/require.php";
-else {
+	require_once "resources/check_auth.php";
-	echo "access denied";
+
-	exit;
+//check permissions
-}
+	if (permission_exists('call_block_edit') || permission_exists('call_block_add')) {
+		//access granted
+	}
+	else {
+		echo "access denied";
+		exit;
+	}
 
 //add multi-lingual support
 	$language = new text;
@@ -45,7 +48,7 @@ else {
 	if (isset($_REQUEST["cdr_id"])) {
 
 		$action = "cdr_add";
-		$cdr_uuid = check_str($_REQUEST["cdr_id"]);
+		$xml_cdr_uuid = check_str($_REQUEST["cdr_id"]);
 		$call_block_name = check_str($_REQUEST["name"]);
 
 		// get the caller id info from cdr that user chose
@@ -55,7 +58,7 @@ else {
 		}
 		$sql .= "caller_id_number ";
 		$sql .= "from v_xml_cdr ";
-		$sql .= "where uuid = '".$cdr_uuid."' ";
+		$sql .= "where xml_cdr_uuid = '".$xml_cdr_uuid."' ";
 		$prep_statement = $db->prepare(check_sql($sql));
 		$prep_statement->execute();
 		$result = $prep_statement->fetch();
@@ -76,7 +79,7 @@ else {
 		$db->exec(check_sql($sql));
 		unset($sql);
 
-		// insert call block record
+		//insert call block record
 		$sql = "insert into v_call_block ";
 		$sql .= "(";
 		$sql .= "domain_uuid, ";
@@ -102,9 +105,11 @@ else {
 		$db->exec(check_sql($sql));
 		unset($sql);
 
-		messages::add($text['label-add-complete']);
+		//add a message
-
+		message::add($text['label-add-complete']);
 	}
 
-header("Location: call_block.php");
+//redirect the browser
-?>
+	header("Location: call_block.php");
+
+?>

app/call_block/call_block_delete.php

@@ -25,16 +25,19 @@
 
 	Call Block is written by Gerrit Visser <gerrit308@gmail.com>
 */
-include "root.php";
+//includes
-require_once "resources/require.php";
+	include "root.php";
-require_once "resources/check_auth.php";
+	require_once "resources/require.php";
-if (permission_exists('call_block_delete')) {
+	require_once "resources/check_auth.php";
-	//access granted
+
-}
+//check permissions
-else {
+	if (permission_exists('call_block_delete')) {
-	echo "access denied";
+		//access granted
-	exit;
+	}
-}
+	else {
+		echo "access denied";
+		exit;
+	}
 
 //add multi-lingual support
 	$language = new text;
@@ -76,8 +79,8 @@ else {
 	}
 
 	//redirect the browser
-		messages::add($text['label-delete-complete']);
+		message::add($text['label-delete-complete']);
 		header("Location: call_block.php");
 		return;
 
-?>
+?>

app/call_block/call_block_edit.php

@@ -17,7 +17,7 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2018
+	Portions created by the Initial Developer are Copyright (C) 2008-2019
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
@@ -26,17 +26,19 @@
 
 	Call Block is written by Gerrit Visser <gerrit308@gmail.com>
 */
-require_once "root.php";
+//includes
-require_once "resources/require.php";
+	require_once "root.php";
-require_once "resources/check_auth.php";
+	require_once "resources/require.php";
+	require_once "resources/check_auth.php";
 
-if (permission_exists('call_block_edit') || permission_exists('call_block_add')) {
+//check permissions
-	//access granted
+	if (permission_exists('call_block_edit') || permission_exists('call_block_add')) {
-}
+		//access granted
-else {
+	}
-	echo "access denied";
+	else {
-	exit;
+		echo "access denied";
-}
+		exit;
+	}
 
 //add multi-lingual support
 	$language = new text;
@@ -84,132 +86,130 @@ else {
 		$call_block_enabled = check_str($_POST["call_block_enabled"]);
 	}
 
-if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
+//handle the http post
-
+	if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
-	$msg = '';
+	
-	if ($action == "update") {
+		$msg = '';
-		//$call_block_uuid = check_str($_POST["call_block_uuid"]);
+		if ($action == "update") {
-	}
+			//$call_block_uuid = check_str($_POST["call_block_uuid"]);
-
-	//check for all required data
-		if (strlen($call_block_name) == 0) { $msg .= $text['label-provide-name']."<br>\n"; }
-		if ($action == "add") {
-			if (strlen($call_block_number) == 0) { $msg .= $text['label-provide-number']."<br>\n"; }
 		}
-		if (strlen($call_block_enabled) == 0) { $msg .= $text['label-provide-enabled']."<br>\n"; }
+	
-		if (strlen($msg) > 0 && strlen($_POST["persistformvar"]) == 0) {
+		//check for all required data
-			require_once "resources/header.php";
+			if (strlen($call_block_name) == 0) { $msg .= $text['label-provide-name']."<br>\n"; }
-			require_once "resources/persist_form_var.php";
-			echo "<div align='center'>\n";
-			echo "<table><tr><td>\n";
-			echo $msg."<br />";
-			echo "</td></tr></table>\n";
-			persistformvar($_POST);
-			echo "</div>\n";
-			require_once "resources/footer.php";
-			return;
-		}
-
-	//add or update the database
-		if (($_POST["persistformvar"] != "true")>0) {
-
-			if ($action == "add" || $action == "update") {
-				//ensure call block is enabled in the dialplan
-				$sql = "update v_dialplans set ";
-				$sql .= "dialplan_enabled = 'true' ";
-				$sql .= "where ";
-				$sql .= "app_uuid = 'b1b31930-d0ee-4395-a891-04df94599f1f' and ";
-				$sql .= "domain_uuid = '".$domain_uuid."' and ";
-				$sql .= "dialplan_enabled <> 'true' ";
-				$db->exec(check_sql($sql));
-				unset($sql);
-			}
-
 			if ($action == "add") {
-				$sql = "insert into v_call_block ";
+				if (strlen($call_block_number) == 0) { $msg .= $text['label-provide-number']."<br>\n"; }
-				$sql .= "(";
+			}
-				$sql .= "domain_uuid, ";
+			if (strlen($call_block_enabled) == 0) { $msg .= $text['label-provide-enabled']."<br>\n"; }
-				$sql .= "call_block_uuid, ";
+			if (strlen($msg) > 0 && strlen($_POST["persistformvar"]) == 0) {
-				$sql .= "call_block_name, ";
+				require_once "resources/header.php";
-				$sql .= "call_block_number, ";
+				require_once "resources/persist_form_var.php";
-				$sql .= "call_block_count, ";
+				echo "<div align='center'>\n";
-				$sql .= "call_block_action, ";
+				echo "<table><tr><td>\n";
-				$sql .= "call_block_enabled, ";
+				echo $msg."<br />";
-				$sql .= "date_added ";
+				echo "</td></tr></table>\n";
-				$sql .= ") ";
+				persistformvar($_POST);
-				$sql .= "values ";
+				echo "</div>\n";
-				$sql .= "(";
+				require_once "resources/footer.php";
-				$sql .= "'".$_SESSION['domain_uuid']."', ";
-				$sql .= "'".uuid()."', ";
-				$sql .= "'$call_block_name', ";
-				$sql .= "'$call_block_number', ";
-				$sql .= "0, ";
-				$sql .= "'$call_block_action', ";
-				$sql .= "'$call_block_enabled', ";
-				$sql .= "'".time()."' ";
-				$sql .= ")";
-				$db->exec(check_sql($sql));
-				unset($sql);
-
-				messages::add($text['label-add-complete']);
-				header("Location: call_block.php");
 				return;
-			} //if ($action == "add")
+			}
-
+	
-			if ($action == "update") {
+		//add or update the database
-				$sql = " select c.call_block_number, d.domain_name from v_call_block as c ";
+			if (($_POST["persistformvar"] != "true")>0) {
-				$sql  .= "JOIN v_domains as d ON c.domain_uuid=d.domain_uuid ";
+	
-				$sql .= "where c.domain_uuid = '".$_SESSION['domain_uuid']."' ";
+				if ($action == "add" || $action == "update") {
-				$sql .= "and c.call_block_uuid = '$call_block_uuid'";
+					//ensure call block is enabled in the dialplan
-
+					$sql = "update v_dialplans set ";
-				$prep_statement = $db->prepare(check_sql($sql));
+					$sql .= "dialplan_enabled = 'true' ";
-				$prep_statement->execute();
+					$sql .= "where ";
-				$result = $prep_statement->fetchAll();
+					$sql .= "app_uuid = 'b1b31930-d0ee-4395-a891-04df94599f1f' and ";
-				$result_count = count($result);
+					$sql .= "domain_uuid = '".$domain_uuid."' and ";
-				if ($result_count > 0) {
+					$sql .= "dialplan_enabled <> 'true' ";
-					//set the domain_name
+					$db->exec(check_sql($sql));
-					$domain_name = $result[0]["domain_name"];
+					unset($sql);
-
-					//clear the cache
-					$cache = new cache;
-					$cache->delete("app:call_block:".$domain_name.":".$call_block_number);
 				}
-				unset ($prep_statement, $sql);
+	
-
+				if ($action == "add") {
-				$sql = "update v_call_block set ";
+					$sql = "insert into v_call_block ";
-				$sql .= "call_block_name = '$call_block_name', ";
+					$sql .= "(";
-				$sql .= "call_block_number = '$call_block_number', ";
+					$sql .= "domain_uuid, ";
-				$sql .= "call_block_action = '$call_block_action', ";
+					$sql .= "call_block_uuid, ";
-				$sql .= "call_block_enabled = '$call_block_enabled' ";
+					$sql .= "call_block_name, ";
-				$sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
+					$sql .= "call_block_number, ";
-				$sql .= "and call_block_uuid = '$call_block_uuid'";
+					$sql .= "call_block_count, ";
-				$db->exec(check_sql($sql));
+					$sql .= "call_block_action, ";
-				unset($sql);
+					$sql .= "call_block_enabled, ";
-
+					$sql .= "date_added ";
-				messages::add($text['label-update-complete']);
+					$sql .= ") ";
-				header("Location: call_block.php");
+					$sql .= "values ";
-				return;
+					$sql .= "(";
-			} //if ($action == "update")
+					$sql .= "'".$_SESSION['domain_uuid']."', ";
-		} //if ($_POST["persistformvar"] != "true")
+					$sql .= "'".uuid()."', ";
-} //(count($_POST)>0 && strlen($_POST["persistformvar"]) == 0)
+					$sql .= "'$call_block_name', ";
+					$sql .= "'$call_block_number', ";
+					$sql .= "0, ";
+					$sql .= "'$call_block_action', ";
+					$sql .= "'$call_block_enabled', ";
+					$sql .= "'".time()."' ";
+					$sql .= ")";
+					$db->exec(check_sql($sql));
+					unset($sql);
+	
+					message::add($text['label-add-complete']);
+					header("Location: call_block.php");
+					return;
+				} //if ($action == "add")
+	
+				if ($action == "update") {
+					$sql = " select c.call_block_number, d.domain_name from v_call_block as c ";
+					$sql  .= "JOIN v_domains as d ON c.domain_uuid=d.domain_uuid ";
+					$sql .= "where c.domain_uuid = '".$_SESSION['domain_uuid']."' ";
+					$sql .= "and c.call_block_uuid = '$call_block_uuid'";
+	
+					$prep_statement = $db->prepare(check_sql($sql));
+					$prep_statement->execute();
+					$result = $prep_statement->fetchAll();
+					$result_count = count($result);
+					if ($result_count > 0) {
+						//set the domain_name
+						$domain_name = $result[0]["domain_name"];
+	
+						//clear the cache
+						$cache = new cache;
+						$cache->delete("app:call_block:".$domain_name.":".$call_block_number);
+					}
+					unset ($prep_statement, $sql);
+	
+					$sql = "update v_call_block set ";
+					$sql .= "call_block_name = '$call_block_name', ";
+					$sql .= "call_block_number = '$call_block_number', ";
+					$sql .= "call_block_action = '$call_block_action', ";
+					$sql .= "call_block_enabled = '$call_block_enabled' ";
+					$sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
+					$sql .= "and call_block_uuid = '$call_block_uuid'";
+					$db->exec(check_sql($sql));
+					unset($sql);
+	
+					message::add($text['label-update-complete']);
+					header("Location: call_block.php");
+					return;
+				} //if ($action == "update")
+			} //if ($_POST["persistformvar"] != "true")
+	} //(count($_POST)>0 && strlen($_POST["persistformvar"]) == 0)
 
 //pre-populate the form
-	if (count($_GET)>0 && $_POST["persistformvar"] != "true") {
+	if (count($_GET) > 0 && $_POST["persistformvar"] != "true") {
 		$call_block_uuid = $_GET["id"];
 		$sql = "select * from v_call_block ";
 		$sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
 		$sql .= "and call_block_uuid = '$call_block_uuid' ";
 		$prep_statement = $db->prepare(check_sql($sql));
 		$prep_statement->execute();
-		$result = $prep_statement->fetchAll();
+		$row = $prep_statement->fetch();
-		foreach ($result as &$row) {
+		$call_block_name = $row["call_block_name"];
-			$call_block_name = $row["call_block_name"];
+		$call_block_number = $row["call_block_number"];
-			$call_block_number = $row["call_block_number"];
+		$call_block_action = $row["call_block_action"];
-			$call_block_action = $row["call_block_action"];
+		$blocked_call_destination = $row["blocked_call_destination"];
-			$blocked_call_destination = $row["blocked_call_destination"];
+		$call_block_enabled = $row["call_block_enabled"];
-			$call_block_enabled = $row["call_block_enabled"];
-			break; //limit to 1 row
-		}
 		unset ($prep_statement, $sql);
 	}
 
@@ -343,15 +343,14 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 
 //get recent calls from the db (if not editing an existing call block record)
 	if (!isset($_REQUEST["id"])) {
-		$sql = "select caller_id_number, caller_id_name, start_epoch, direction, hangup_cause, duration, billsec, uuid from v_xml_cdr ";
+		$sql = "select caller_id_number, caller_id_name, start_epoch, direction, hangup_cause, duration, billsec, xml_cdr_uuid from v_xml_cdr ";
 		$sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
 		$sql .= "and direction != 'outbound' ";
 		$sql .= "order by start_stamp DESC ";
-		$sql .= "limit 20 ";
+		$sql .= "limit '".$_SESSION['call_block']['recent_call_limit']['text']."'";
 		$prep_statement = $db->prepare(check_sql($sql));
 		$prep_statement->execute();
 		$result = $prep_statement->fetchAll();
-		$result_count = count($result);
 		unset ($prep_statement);
 
 		echo "<b>".$text['label-edit-add-recent']."</b>";
@@ -368,9 +367,9 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 		$row_style["0"] = "row_style0";
 		$row_style["1"] = "row_style1";
 
-		if ($result_count > 0) {
+		if (is_array($result)) {
 			foreach($result as $row) {
-				$tr_onclick = " onclick=\"call_block_recent('".$row['uuid']."','".urlencode($row['caller_id_name'])."');\" ";
+				$tr_onclick = " onclick=\"call_block_recent('".escape($row['xml_cdr_uuid'])."','".urlencode(escape($row['caller_id_name']))."');\" ";
 				if (strlen($row['caller_id_number']) >= 7) {
 					if (defined('TIME_24HR') && TIME_24HR == 1) {
 						$tmp_start_epoch = date("j M Y H:i:s", $row['start_epoch']);
@@ -420,9 +419,9 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 					echo "	<td valign='top' class='".$row_style[$c]."' ".$tr_onclick.">".gmdate("G:i:s", $seconds)."</td>\n";
 					echo "	<td class='list_control_icons' ".((!(if_group("admin") || if_group("superadmin"))) ? "style='width: 25px;'" : null).">";
 					if (if_group("admin") || if_group("superadmin")) {
-						echo "	<a href='".PROJECT_PATH."/app/xml_cdr/xml_cdr_details.php?uuid=".escape($row['uuid'])."' alt='".$text['button-view']."'>".$v_link_label_view."</a>";
+						echo "	<a href='".PROJECT_PATH."/app/xml_cdr/xml_cdr_details.php?id=".escape($row['xml_cdr_uuid'])."' alt='".$text['button-view']."'>".$v_link_label_view."</a>";
 					}
-					echo 		"<a href='javascript:void(0);' onclick=\"call_block_recent('".escape($row['uuid'])."','".urlencode(escape($row['caller_id_name']))."');\" alt='".$text['button-add']."'>".$v_link_label_add."</a>";
+					echo 		"<a href='javascript:void(0);' onclick=\"call_block_recent('".escape($row['xml_cdr_uuid'])."','".urlencode(escape($row['caller_id_name']))."');\" alt='".$text['button-add']."'>".$v_link_label_add."</a>";
 					echo "  </td>";
 					echo "</tr>\n";
 					if ($c==0) { $c=1; } else { $c=0; }
@@ -441,7 +440,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 		}
 
 	}
-// end of Display Last 5-10 Calls
+	// end of Display Last 5-10 Calls
 
 //include the footer
 	require_once "resources/footer.php";

app/call_broadcast/call_broadcast_delete.php

@@ -54,7 +54,7 @@ else {
 	}
 
 
-messages::add($text['confirm-delete']);
+message::add($text['confirm-delete']);
 header("Location: call_broadcast.php");
 return;
 

app/call_broadcast/call_broadcast_edit.php

@@ -222,7 +222,7 @@ if (count($_POST) > 0 && strlen($_POST["persistformvar"]) == 0) {
 			$db->exec(check_sql($sql));
 			unset($sql);
 
-			messages::add($text['confirm-add']);
+			message::add($text['confirm-add']);
 			header("Location: call_broadcast.php");
 			return;
 		} //if ($action == "add")
@@ -270,7 +270,7 @@ if (count($_POST) > 0 && strlen($_POST["persistformvar"]) == 0) {
 			$db->exec(check_sql($sql));
 			unset($sql);
 
-			messages::add($text['confirm-update']);
+			message::add($text['confirm-update']);
 			header("Location: call_broadcast.php");
 			return;
 		} //if ($action == "update")

app/call_broadcast/call_broadcast_send.php

@@ -271,7 +271,7 @@ require_once "resources/header.php";
 		}
 
 	if (strlen($group_name) > 0) {
-		$sql = " select * from v_users as u, v_group_users as m ";
+		$sql = " select * from v_users as u, v_user_groups as m ";
 		$sql .= "where u.user_uuid = m.user_uuid ";
 		$sql .= "and u.user_enabled = 'true' ";
 		$sql .= "and m.group_name = '".$group_name."' ";
@@ -287,7 +287,6 @@ require_once "resources/header.php";
 	$prep_statement = $db->prepare(check_sql($sql));
 	$prep_statement->execute();
 	$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
-	$result_count = count($result);
 	unset ($prep_statement, $sql);
 
 	$c = 0;
@@ -307,7 +306,7 @@ require_once "resources/header.php";
 	echo th_order_by('user_phone_2', 'phone_2', $order_by, $order);
 	echo "<tr>\n";
 
-	if ($result_count > 0) {
+	if (is_array($result)) {
 		foreach($result as $row) {
 			echo "<tr >\n";
 			//echo "	<td valign='top' class='".$row_style[$c]."'>".$row[username]."&nbsp;</td>\n";

app/call_broadcast/call_broadcast_stop.php

@@ -52,7 +52,7 @@ else {
 		if ($fp) {
 			$cmd = "sched_del ".$uuid;
 			$result = event_socket_request($fp, 'api '.$cmd);
-			messages::add(htmlentities($result));
+			message::add(htmlentities($result));
 		}
 	}
 

app/call_centers/app_config.php

@@ -65,7 +65,6 @@
 		$y++;
 		$apps[$x]['permissions'][$y]['name'] = "call_center_agent_view";
 		$apps[$x]['permissions'][$y]['menu']['uuid'] = "597c483a-51a9-f95a-8d54-ea7d87ada2b8";
-		$apps[$x]['permissions'][$y]['groups'][] = "agent";
 		$apps[$x]['permissions'][$y]['groups'][] = "admin";
 		$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
 		$y++;
@@ -83,7 +82,6 @@
 		$y++;
 		$apps[$x]['permissions'][$y]['name'] = "call_center_tier_view";
 		$apps[$x]['permissions'][$y]['menu']['uuid'] = "6c072b29-5b6c-49fc-008e-95e24c77de99";
-		$apps[$x]['permissions'][$y]['groups'][] = "agent";
 		$apps[$x]['permissions'][$y]['groups'][] = "admin";
 		$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
 		$y++;
@@ -288,6 +286,10 @@
 		$apps[$x]['db'][$y]['fields'][$z]['type'] = "text";
 		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "";
 		$z++;
+		$apps[$x]['db'][$y]['fields'][$z]['name'] = "queue_greeting";
+		$apps[$x]['db'][$y]['fields'][$z]['type'] = "text";
+		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "Select the greeting.";
+		$z++;
 		$apps[$x]['db'][$y]['fields'][$z]['name'] = "queue_strategy";
 		$apps[$x]['db'][$y]['fields'][$z]['type'] = "text";
 		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "";

app/call_centers/app_menu.php

@@ -24,9 +24,8 @@
 	$apps[$x]['menu'][$y]['parent_uuid'] = "fd29e39c-c936-f5fc-8e2b-611681b266b5";
 	$apps[$x]['menu'][$y]['category'] = "internal";
 	$apps[$x]['menu'][$y]['path'] = "/app/call_centers/call_center_queues.php";
-	$apps[$x]['menu'][$y]['groups'][] = "agent";
-	$apps[$x]['menu'][$y]['groups'][] = "admin";
 	$apps[$x]['menu'][$y]['groups'][] = "superadmin";
+	$apps[$x]['menu'][$y]['groups'][] = "admin";
 	$y++;
 	$apps[$x]['menu'][$y]['title']['en-us'] = "Agent Status";
 	$apps[$x]['menu'][$y]['title']['ar-eg'] = "";

app/call_centers/call_center_agent_delete.php

@@ -83,7 +83,7 @@
 	remove_config_from_cache('configuration:callcenter.conf');
 
 //redirect the browser
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header("Location: call_center_agents.php");
 	return;
 

app/call_centers/call_center_agent_edit.php

@@ -249,10 +249,10 @@
 		//redirect the user
 			if (isset($action)) {
 				if ($action == "add") {
-					messages::add($text['message-add']);
+					message::add($text['message-add']);
 				}
 				if ($action == "update") {
-					messages::add($text['message-update']);
+					message::add($text['message-update']);
 				}
 				header("Location: call_center_agents.php");
 				return;
@@ -293,7 +293,7 @@
 
 //set default values
 	if (strlen($agent_type) == 0) { $agent_type = "callback"; }
-	if (strlen($agent_call_timeout) == 0) { $agent_call_timeout = "15"; }
+	if (strlen($agent_call_timeout) == 0) { $agent_call_timeout = "20"; }
 	if (strlen($agent_max_no_answer) == 0) { $agent_max_no_answer = "0"; }
 	if (strlen($agent_wrap_up_time) == 0) { $agent_wrap_up_time = "10"; }
 	if (strlen($agent_no_answer_delay_time) == 0) { $agent_no_answer_delay_time = "30"; }

app/call_centers/call_center_agent_status.php

@@ -120,8 +120,31 @@
 								$response = event_socket_request($fp, $cmd);
 							}
 							usleep(200);
-					}
+					
+						//set the blf status
+						//get the agents from the database
+							$sql = "select agent_name from v_call_center_agents ";
+							$sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
+							$sql .= "and call_center_agent_uuid = '".$row['agent_uuid']."' ";
+							$prep_statement = $db->prepare(check_sql($sql));
+							$prep_statement->execute();
+							$agent_name = $prep_statement->fetchAll(PDO::FETCH_NAMED);
 
+							if ($row['agent_status'] == 'Available') {
+								$answer_state = 'confirmed';
+							}
+							else {
+								$answer_state = 'terminated';
+							}
+							
+							$call_center_notify = new call_center_notify;
+							$call_center_notify->domain_name = $_SESSION['domain_name'];
+							$call_center_notify->agent_name = $agent_name[0]['agent_name'];
+							$call_center_notify->answer_state = $answer_state;
+							$call_center_notify->agent_uuid = $row['agent_uuid'];
+							$call_center_notify->send_call_center_notify();
+							unset($call_center_notify);
+					}
 			}
 		}
 	}
@@ -234,10 +257,10 @@
 	$x = 0;
 	foreach($agents as $row) {
 		$html = "<tr>\n";
-		$html .= "		<td valign='top' class='".$row_style[$c]."'>".$row['agent_name']."&nbsp;</td>\n";
+		$html .= "		<td valign='top' class='".$row_style[$c]."'>".escape($row['agent_name'])."&nbsp;</td>\n";
 
 		//$html .= "	<td valign='top' class='".$row_style[$c]."'>".$row['agent_name']."&nbsp;</td>\n";
-		$html .= "	<td valign='top' class='".$row_style[$c]."'>".$row['agent_status']."&nbsp;</td>\n";
+		$html .= "	<td valign='top' class='".$row_style[$c]."'>".escape($row['agent_status'])."&nbsp;</td>\n";
 		$html .= "	<td valign='top' class='".$row_style[$c]."' nowrap='nowrap'>";
 		$html .= "		<input type='hidden' name='agents[".$x."][agent_name]' id='agent_".$x."_name' value='".escape($row['agent_name'])."'>\n";
 		$html .= "		<input type='hidden' name='agents[".$x."][agent_uuid]' id='agent_".$x."_uuid' value='".escape($row['call_center_agent_uuid'])."'>\n";
@@ -277,10 +300,10 @@
 				//$html .= "			<input type='radio' name='agents[".$x."][agent_status]' id='agent_".$x."_status_no_change' value='' checked='checked'>&nbsp;<label for='agent_".$x."_status_no_change'>".$text['option-no_change']."</label>&nbsp;\n";
 				$html .= "			<input type='radio' name='agents[".$x."][agent_status]' id='agent_".$x."_status_available' value='Available'>&nbsp;<label for='agent_".$x."_status_available'>".$text['option-available']."</label>&nbsp;\n";
 				$html .= "			<input type='radio' name='agents[".$x."][agent_status]' id='agent_".$x."_status_logged_out' value='Logged Out'>&nbsp;<label for='agent_".$x."_status_logged_out'>".$text['option-logged_out']."</label>&nbsp;\n";
-				$html .= "			<input type='hidden' name='agents[".$x."][queue_name]' id='queue_".$x."_name' value='".$queue['queue_name']."'>\n";
+				$html .= "			<input type='hidden' name='agents[".$x."][queue_name]' id='queue_".$x."_name' value='".escape($queue['queue_name'])."'>\n";
 				$html .= "			<input type='hidden' name='agents[".$x."][agent_name]' id='agent_".$x."_name' value='".escape($row['agent_name'])."'>\n";
 				$html .= "			<input type='hidden' name='agents[".$x."][user_uuid]' id='agent_".$x."_name' value='".escape($row['user_uuid'])."'>\n";
-				$html .= "			<input type='hidden' name='agents[".$x."][queue_uuid]' id='queue_".$x."_uuid' value='".$queue['call_center_queue_uuid']."'>\n";
+				$html .= "			<input type='hidden' name='agents[".$x."][queue_uuid]' id='queue_".$x."_uuid' value='".escape($queue['call_center_queue_uuid'])."'>\n";
 				$html .= "			<input type='hidden' name='agents[".$x."][agent_uuid]' id='agent_".$x."_uuid' value='".escape($row['call_center_agent_uuid'])."'>\n";
 				$html .= "		</td>\n";
 				$html .= "	</tr>\n";

app/call_centers/call_center_queue_delete.php

@@ -103,7 +103,7 @@
 	}
 
 //redirect the browser
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header("Location: call_center_queues.php");
 	return;
 

app/call_centers/call_center_queue_edit.php

@@ -65,7 +65,7 @@
 			}
 			unset($prep_statement, $row);
 			if ($total_call_center_queues >= $_SESSION['limit']['call_center_queues']['numeric']) {
-				messages::add($text['message-maximum_queues'].' '.$_SESSION['limit']['call_center_queues']['numeric'], 'negative');
+				message::add($text['message-maximum_queues'].' '.$_SESSION['limit']['call_center_queues']['numeric'], 'negative');
 				header('Location: call_center_queues.php');
 				return;
 			}
@@ -79,6 +79,7 @@
 			$dialplan_uuid = check_str($_POST["dialplan_uuid"]);
 			$queue_name = check_str($_POST["queue_name"]);
 			$queue_extension = check_str($_POST["queue_extension"]);
+			$queue_greeting = check_str($_POST["queue_greeting"]);
 			$queue_strategy = check_str($_POST["queue_strategy"]);
 			$queue_moh_sound = check_str($_POST["queue_moh_sound"]);
 			$queue_record_template = check_str($_POST["queue_record_template"]);
@@ -223,6 +224,14 @@
 			unset($action_array[0]);
 			$queue_timeout_data = implode($action_array);
 
+		//add the recording path if needed
+			if (file_exists($_SESSION['switch']['recordings']['dir'].'/'.$_SESSION['domain_name'].'/'.$queue_greeting)) {
+				$queue_greeting_path = $_SESSION['switch']['recordings']['dir'].'/'.$_SESSION['domain_name'].'/'.$queue_greeting;
+			}
+			else {
+				$queue_greeting_path = $queue_greeting;
+			}
+
 		//build the xml dialplan
 			$dialplan_xml = "<extension name=\"".$queue_name."\" continue=\"\" uuid=\"".escape($dialplan_uuid)."\">\n";
 			$dialplan_xml .= "	<condition field=\"destination_number\" expression=\"^([^#]+#)(.*)\$\" break=\"never\">\n";
@@ -231,6 +240,7 @@
 			$dialplan_xml .= "	<condition field=\"destination_number\" expression=\"^".escape($queue_extension)."$\">\n";
 			$dialplan_xml .= "		<action application=\"answer\" data=\"\"/>\n";
 			$dialplan_xml .= "		<action application=\"set\" data=\"hangup_after_bridge=true\"/>\n";
+			$dialplan_xml .= "		<action application=\"playback\" data=\"".escape($queue_greeting_path)."\"/>\n";
 			if (strlen($queue_cid_prefix) > 0) {
 				$dialplan_xml .= "		<action application=\"set\" data=\"effective_caller_id_name=".$queue_cid_prefix."#\${caller_id_name}\"/>\n";
 			}
@@ -291,10 +301,10 @@
 		//redirect the user
 			if (isset($action)) {
 				if ($action == "add") {
-					messages::add($text['message-add']);
+					message::add($text['message-add']);
 				}
 				if ($action == "update") {
-					messages::add($text['message-update']);
+					message::add($text['message-update']);
 				}
 			}
 
@@ -363,6 +373,7 @@
 				$dialplan_uuid = $row["dialplan_uuid"];
 				$database_queue_name = $row["queue_name"];
 				$queue_extension = $row["queue_extension"];
+				$queue_greeting = $row["queue_greeting"];
 				$queue_strategy = $row["queue_strategy"];
 				$queue_moh_sound = $row["queue_moh_sound"];
 				$queue_record_template = $row["queue_record_template"];
@@ -393,7 +404,7 @@
 	$sql .= "where t.call_center_queue_uuid = '".$call_center_queue_uuid."' ";
 	$sql .= "and t.call_center_agent_uuid = a.call_center_agent_uuid ";
 	$sql .= "and t.domain_uuid = '".$_SESSION['domain_uuid']."' ";
-	$sql .= "order by tier_level asc, tier_position asc, agent_name asc";
+	$sql .= "order by tier_level asc, tier_position asc, a.agent_name asc";
 	$prep_statement = $db->prepare(check_sql($sql));
 	$prep_statement->execute();
 	$tiers = $prep_statement->fetchAll(PDO::FETCH_NAMED);
@@ -425,6 +436,10 @@
 	$prep_statement->execute();
 	$agents = $prep_statement->fetchAll(PDO::FETCH_NAMED);
 
+//get the sounds
+	$sounds = new sounds;
+	$sounds = $sounds->get();
+
 //set default values
 	if (strlen($queue_strategy) == 0) { $queue_strategy = "longest-idle-agent"; }
 	if (strlen($queue_moh_sound) == 0) { $queue_moh_sound = "\$\${hold_music}"; }
@@ -500,6 +515,39 @@
 	echo "</td>\n";
 	echo "</tr>\n";
 
+	echo "<tr>\n";
+	echo "<td class='vncell' valign='top' align='left' nowrap='nowrap'>\n";
+	echo "	".$text['label-greeting']."\n";
+	echo "</td>\n";
+	echo "<td class='vtable' align='left'>\n";
+	echo "<select name='queue_greeting' class='formfld' style='width: 200px;' ".((if_group("superadmin")) ? "onchange='changeToInput(this);'" : null).">\n";
+	echo "	<option value=''></option>\n";
+	foreach($sounds as $key => $value) {
+		echo "<optgroup label=".$text['label-'.$key].">\n";
+		$selected = false;
+		foreach($value as $row) {
+			if ($queue_greeting == $row["value"]) { 
+				$selected = true;
+				echo "	<option value='".escape($row["value"])."' selected='selected'>".escape($row["name"])."</option>\n";
+			}
+			else {
+				echo "	<option value='".escape($row["value"])."'>".escape($row["name"])."</option>\n";
+			}
+		}
+		echo "</optgroup>\n";
+	}
+	if (if_group("superadmin")) {
+		if (!$selected && strlen($queue_greeting) > 0) {
+			echo "	<option value='".escape($queue_greeting)."' selected='selected'>".escape($queue_greeting)."</option>\n";
+		}
+		unset($selected);
+	}
+	echo "	</select>\n";
+	echo "<br />\n";
+	echo $text['description-greeting']."\n";
+	echo "</td>\n";
+	echo "</tr>\n";
+
 	echo "<tr>\n";
 	echo "<td class='vncellreq' valign='top' align='left' nowrap>\n";
 	echo "	".$text['label-strategy']."\n";
@@ -592,7 +640,7 @@
 				if ($row['call_center_agent_uuid'] == $field['call_center_agent_uuid']) {
 					$selected = "selected=\"selected\"";
 				}
-				echo "				<option value=\"".$row['call_center_agent_uuid']."\" $selected>".escape($row['agent_name'])."</option>\n";
+				echo "				<option value=\"".escape($row['call_center_agent_uuid'])."\" $selected>".escape($row['agent_name'])."</option>\n";
 			}
 			echo "				</select>";
 			echo "		</td>\n";

app/call_centers/call_center_queues.php

@@ -56,6 +56,9 @@
 	echo "<tr>\n";
 	echo "<td width='50%' align='left' nowrap='nowrap'><b>".$text['header-call_center_queues']."</b></td>\n";
 	echo "<td width='50%' align='right'>\n";
+	if (permission_exists('call_center_wallboard')) {
+		echo "  <input type='button' class='btn' value='".$text['button-wallboard']."' onclick=\"document.location.href='".PROJECT_PATH."/app/call_center_wallboard/call_center_wallboard.php';\" />\n";
+	}
 	echo "	<input type='button' class='btn' value='".$text['button-agents']."' alt='".$text['button-agents']."' onclick=\"window.location='call_center_agents.php'\">\n";
 	echo "</td>\n";
 	echo "</tr>\n";

app/call_centers/call_center_tier_edit.php

@@ -125,7 +125,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 		}
 		unset($prep_statement);
 
-		messages::add($text['message-update']);
+		message::add($text['message-update']);
 		header("Location: call_center_queue_edit.php?id=".$queue_uuid);
 		return;
 

app/call_centers/resources/classes/call_center.php

@@ -144,16 +144,37 @@
 						$dialplan["dialplan_details"][$y]["dialplan_detail_order"] = $y * 10;
 						$y++;
 					}
+
+
+					if (strlen($this->queue_greeting) > 0) {
+						$dialplan["dialplan_details"][$y]["domain_uuid"] = $this->domain_uuid;
+						$dialplan["dialplan_details"][$y]["dialplan_detail_tag"] = "action";
+						$dialplan["dialplan_details"][$y]["dialplan_detail_type"] = "sleep";
+						$dialplan["dialplan_details"][$y]["dialplan_detail_data"] = "1000";
+						$dialplan["dialplan_details"][$y]["dialplan_detail_group"] = "2";
+						$dialplan["dialplan_details"][$y]["dialplan_detail_order"] = $y * 10;
+						$y++;
+					}
 				
-                                       if (strlen($this->queue_cc_exit_keys) > 0) {
+					if (strlen($this->queue_greeting) > 0) {
-                                               $dialplan["dialplan_details"][$y]["domain_uuid"] = $this->domain_uuid;
+						$dialplan["dialplan_details"][$y]["domain_uuid"] = $this->domain_uuid;
-                                               $dialplan["dialplan_details"][$y]["dialplan_detail_tag"] = "action";
+						$dialplan["dialplan_details"][$y]["dialplan_detail_tag"] = "action";
-                                               $dialplan["dialplan_details"][$y]["dialplan_detail_type"] = "set";
+						$dialplan["dialplan_details"][$y]["dialplan_detail_type"] = "playback";
-                                               $dialplan["dialplan_details"][$y]["dialplan_detail_data"] = "cc_exit_keys=".$this->queue_cc_exit_keys;
+						$dialplan["dialplan_details"][$y]["dialplan_detail_data"] = "".$this->queue_greeting;
-                                               $dialplan["dialplan_details"][$y]["dialplan_detail_group"] = "2";
+						$dialplan["dialplan_details"][$y]["dialplan_detail_group"] = "2";
-                                               $dialplan["dialplan_details"][$y]["dialplan_detail_order"] = $y * 10;
+						$dialplan["dialplan_details"][$y]["dialplan_detail_order"] = $y * 10;
-                                               $y++;
+						$y++;
-                                       }
+					}
+
+					if (strlen($this->queue_cc_exit_keys) > 0) {
+						$dialplan["dialplan_details"][$y]["domain_uuid"] = $this->domain_uuid;
+						$dialplan["dialplan_details"][$y]["dialplan_detail_tag"] = "action";
+						$dialplan["dialplan_details"][$y]["dialplan_detail_type"] = "set";
+						$dialplan["dialplan_details"][$y]["dialplan_detail_data"] = "cc_exit_keys=".$this->queue_cc_exit_keys;
+						$dialplan["dialplan_details"][$y]["dialplan_detail_group"] = "2";
+						$dialplan["dialplan_details"][$y]["dialplan_detail_order"] = $y * 10;
+						$y++;
+					}
 
 					$dialplan["dialplan_details"][$y]["domain_uuid"] = $this->domain_uuid;
 					$dialplan["dialplan_details"][$y]["dialplan_detail_tag"] = "action";

app/call_flows/call_flow_delete.php

@@ -17,82 +17,86 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2012
+	Portions created by the Initial Developer are Copyright (C) 2008-2019
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
 	Mark J Crane <markjcrane@fusionpbx.com>
 */
-require_once "root.php";
+//includes
-require_once "resources/require.php";
+	require_once "root.php";
-require_once "resources/check_auth.php";
+	require_once "resources/require.php";
-if (permission_exists('call_flow_delete')) {
+	require_once "resources/check_auth.php";
-	//access granted
+
-}
+//check permissions
-else {
+	if (permission_exists('call_flow_delete')) {
-	echo "access denied";
+		//access granted
-	exit;
+	}
-}
+	else {
+		echo "access denied";
+		exit;
+	}
 
 //add multi-lingual support
 	$language = new text;
 	$text = $language->get();
 
-if (count($_GET)>0) {
+//get the http value and set it as a php variable
-	$id = check_str($_GET["id"]);
+	if (count($_GET)>0) {
-}
+		$id = check_str($_GET["id"]);
+	}
 
-if (strlen($id)>0) {
+//delete the user data
+	if (is_uuid($id)) {
 
-	//get the dialplan uuid
+		//get the dialplan uuid
-		$sql = "select * from v_call_flows ";
+			$sql = "select * from v_call_flows ";
-		$sql .= "where domain_uuid = '$domain_uuid' ";
+			$sql .= "where domain_uuid = '$domain_uuid' ";
-		$sql .= "and call_flow_uuid = '$id' ";
+			$sql .= "and call_flow_uuid = '$id' ";
-		$prep_statement = $db->prepare($sql);
+			$prep_statement = $db->prepare($sql);
-		$prep_statement->execute();
+			$prep_statement->execute();
-		while($row = $prep_statement->fetch(PDO::FETCH_ASSOC)) {
+			while($row = $prep_statement->fetch(PDO::FETCH_ASSOC)) {
-			$dialplan_uuid = $row['dialplan_uuid'];
+				$dialplan_uuid = $row['dialplan_uuid'];
-		}
+				$call_flow_context = $row['call_flow_context'];
+			}
 
-	//delete call_flow
+		//delete call_flow
-		$sql = "delete from v_call_flows ";
+			$sql = "delete from v_call_flows ";
-		$sql .= "where domain_uuid = '$domain_uuid' ";
+			$sql .= "where domain_uuid = '$domain_uuid' ";
-		$sql .= "and call_flow_uuid = '$id' ";
+			$sql .= "and call_flow_uuid = '$id' ";
-		$prep_statement = $db->prepare(check_sql($sql));
+			$prep_statement = $db->prepare(check_sql($sql));
-		$prep_statement->execute();
+			$prep_statement->execute();
-		unset($sql);
+			unset($sql);
 
-	//delete the dialplan entry
+		//delete the dialplan entry
-		$sql = "delete from v_dialplans ";
+			$sql = "delete from v_dialplans ";
-		$sql .= "where domain_uuid = '$domain_uuid' ";
+			$sql .= "where domain_uuid = '$domain_uuid' ";
-		$sql .= "and dialplan_uuid = '$dialplan_uuid' ";
+			$sql .= "and dialplan_uuid = '$dialplan_uuid' ";
-		$db->query($sql);
+			$db->query($sql);
-		unset($sql);
+			unset($sql);
 
-	//delete the dialplan details
+		//delete the dialplan details
-		$sql = "delete from v_dialplan_details ";
+			$sql = "delete from v_dialplan_details ";
-		$sql .= "where domain_uuid = '$domain_uuid' ";
+			$sql .= "where domain_uuid = '$domain_uuid' ";
-		$sql .= "and dialplan_uuid = '$dialplan_uuid' ";
+			$sql .= "and dialplan_uuid = '$dialplan_uuid' ";
-		$db->query($sql);
+			$db->query($sql);
-		unset($sql);
+			unset($sql);
 
-	//syncrhonize configuration
+		//syncrhonize configuration
-		save_dialplan_xml();
+			save_dialplan_xml();
 
-	//apply settings reminder
+		//apply settings reminder
-		$_SESSION["reload_xml"] = true;
+			$_SESSION["reload_xml"] = true;
 
-	//delete the dialplan context from memcache
+		//clear the cache
-		$fp = event_socket_create($_SESSION['event_socket_ip_address'], $_SESSION['event_socket_port'], $_SESSION['event_socket_password']);
+			$cache = new cache;
-		if ($fp) {
+			$cache->delete("dialplan:".$call_flow_context);
-			$switch_cmd = "memcache delete dialplan:".$_SESSION["context"]."@".$_SESSION['domain_name'];
-			$switch_result = event_socket_request($fp, 'api '.$switch_cmd);
-		}
-}
 
+	}
 
-messages::add($text['message-delete']);
+//send a message an redirect the browser
-header("Location: call_flows.php");
+	message::add($text['message-delete']);
-return;
+	header("Location: call_flows.php");
+	return;
 
-?>
+?>

app/call_flows/call_flow_edit.php

@@ -159,6 +159,8 @@
 		//build the xml dialplan
 			$dialplan_xml = "<extension name=\"".$call_flow_name."\" continue=\"\" uuid=\"".$dialplan_uuid."\">\n";
 			$dialplan_xml .= "	<condition field=\"destination_number\" expression=\"^".$destination_feature."$\" break=\"on-true\">\n";
+			$dialplan_xml .= "		<action application=\"answer\" data=\"\"/>\n";
+			$dialplan_xml .= "		<action application=\"sleep\" data=\"200\"/>\n";
 			$dialplan_xml .= "		<action application=\"set\" data=\"feature_code=true\"/>\n";
 			$dialplan_xml .= "		<action application=\"set\" data=\"call_flow_uuid=".$call_flow_uuid."\"/>\n";
 			$dialplan_xml .= "		<action application=\"lua\" data=\"call_flow.lua\"/>\n";
@@ -242,10 +244,10 @@
 		//redirect the user
 			if (isset($action)) {
 				if ($action == "add") {
-					messages::add($text['message-add']);
+					message::add($text['message-add']);
 				}
 				if ($action == "update") {
-					messages::add($text['message-update']);
+					message::add($text['message-update']);
 				}
 				header("Location: call_flows.php");
 				return;
@@ -376,7 +378,7 @@
 					$recording_filename = $row["recording_filename"];
 					if ($var == $_SESSION['switch']['recordings']['dir']."/".$_SESSION['domain_name']."/".$recording_filename && strlen($var) > 0) {
 						$tmp_selected = true;
-						echo "	<option value='".$_SESSION['switch']['recordings']['dir']."/".$_SESSION['domain_name']."/".$recording_filename."' selected='selected'>".$recording_name."</option>\n";
+						echo "	<option value='".$_SESSION['switch']['recordings']['dir']."/".$_SESSION['domain_name']."/".escape($recording_filename)."' selected='selected'>".escape($recording_name)."</option>\n";
 					}
 					else if ($var == $recording_filename && strlen($var) > 0) {
 						$tmp_selected = true;
@@ -510,7 +512,7 @@
 	echo "	<option value=''></option>\n";
 	if ($call_flow_status == "true") {
 		if (strlen($call_flow_label) > 0) {
-			echo "	<option value='true' selected='selected'>$call_flow_label</option>\n";
+			echo "	<option value='true' selected='selected'>".escape($call_flow_label)."</option>\n";
 		}
 		else {
 			echo "	<option value='true' selected='selected'>".$text['label-true']."</option>\n";
@@ -518,7 +520,7 @@
 	}
 	else {
 		if (strlen($call_flow_label) > 0) {
-			echo "	<option value='true'>$call_flow_label</option>\n";
+			echo "	<option value='true'>".escape($call_flow_label)."</option>\n";
 		}
 		else {
 			echo "	<option value='true'>".$text['label-true']."</option>\n";
@@ -526,7 +528,7 @@
 	}
 	if ($call_flow_status == "false") {
 		if (strlen($call_flow_alternate_label) > 0) {
-			echo "	<option value='false' selected='selected'>$call_flow_alternate_label</option>\n";
+			echo "	<option value='false' selected='selected'>".escape($call_flow_alternate_label)."</option>\n";
 		}
 		else {
 			echo "	<option value='false' selected='selected'>".$text['label-false']."</option>\n";
@@ -534,7 +536,7 @@
 	}
 	else {
 		if (strlen($call_flow_alternate_label) > 0) {
-			echo "	<option value='false'>$call_flow_alternate_label</option>\n";
+			echo "	<option value='false'>".escape($call_flow_alternate_label)."</option>\n";
 		}
 		else {
 			echo "	<option value='false'>".$text['label-false']."</option>\n";

app/call_recordings/app_config.php

@@ -14,7 +14,6 @@
 		$y = 0;
 		$apps[$x]['permissions'][$y]['name'] = 'call_recording_view';
 		$apps[$x]['permissions'][$y]['groups'][] = 'superadmin';
-		$apps[$x]['permissions'][$y]['groups'][] = 'admin';
 		$y++;
 		$apps[$x]['permissions'][$y]['name'] = 'call_recording_add';
 		//$apps[$x]['permissions'][$y]['groups'][] = 'superadmin';
@@ -24,15 +23,12 @@
 		$y++;
 		$apps[$x]['permissions'][$y]['name'] = 'call_recording_delete';
 		$apps[$x]['permissions'][$y]['groups'][] = 'superadmin';
-		$apps[$x]['permissions'][$y]['groups'][] = 'admin';
 		$y++;
 		$apps[$x]['permissions'][$y]['name'] = 'call_recording_play';
 		$apps[$x]['permissions'][$y]['groups'][] = 'superadmin';
-		$apps[$x]['permissions'][$y]['groups'][] = 'admin';
 		$y++;
 		$apps[$x]['permissions'][$y]['name'] = 'call_recording_download';
 		$apps[$x]['permissions'][$y]['groups'][] = 'superadmin';
-		$apps[$x]['permissions'][$y]['groups'][] = 'admin';
 
 	//Call Recordings
 		$y = 2;
@@ -84,4 +80,4 @@
 		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = '';
 		$z++;
 
-?>
+?>

app/call_recordings/app_menu.php

@@ -13,7 +13,5 @@ $apps[$x]['menu'][0]['parent_uuid'] = 'fd29e39c-c936-f5fc-8e2b-611681b266b5';
 $apps[$x]['menu'][0]['category'] = 'internal';
 $apps[$x]['menu'][0]['path'] = '/app/call_recordings/call_recordings.php';
 $apps[$x]['menu'][0]['groups'][] = 'superadmin';
-//$apps[$x]['menu'][0]['groups'][] = 'admin';
-//$apps[$x]['menu'][0]['groups'][] = 'user';
 
-?>
+?>

app/call_recordings/call_recording_delete.php

@@ -47,7 +47,7 @@
 	$obj->delete($_GET["id"]);
 
 //delete message
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 
 //redirect the user
 	header('Location: call_recordings.php');

app/call_recordings/call_recordings.php

@@ -77,7 +77,7 @@
 				$obj = new call_recordings;
 				$obj->delete($call_recordings);
 			//delete message
-				messages::add($text['message-delete']);
+				message::add($text['message-delete']);
 		}
 	}
 
@@ -257,7 +257,7 @@
 			//echo "	<td valign='top' class='".$row_style[$c]."'>".escape($row['call_recording_base64'])."&nbsp;</td>\n";
 			echo "	<td class='list_control_icons'>";
 			if (permission_exists('xml_cdr_details')) {
-				echo "		<a href='/app/xml_cdr/xml_cdr_details.php?uuid=".escape($row['call_recording_uuid'])."' title='".$text['button-view']."'>$v_link_label_view</a>";
+				echo "		<a href='/app/xml_cdr/xml_cdr_details.php?id=".escape($row['call_recording_uuid'])."' title='".$text['button-view']."'>$v_link_label_view</a>";
 			}
 			if (permission_exists('call_recording_edit')) {
 				echo "<button type='button' class='btn btn-default list_control_icon' name='' alt='".$text['button-edit']."' onclick=\"window.location='call_recording_edit.php?id=".escape($row['call_recording_uuid'])."'\" value='edit'><span class='glyphicon glyphicon-pencil'></span></input>\n";
@@ -278,7 +278,7 @@
 	echo "	<table width='100%' cellpadding='0' cellspacing='0'>\n";
 	echo "	<tr>\n";
 	echo "		<td width='33.3%' nowrap='nowrap'>&nbsp;</td>\n";
-	echo "		<td width='33.3%' align='center' nowrap='nowrap'>$paging_controls</td>\n";
+	echo "		<td width='33.3%' align='center' nowrap='nowrap'>&nbsp;</td>\n";
 	echo "		<td class='list_control_icons'>";
 	if (permission_exists('call_recording_add')) {
 		echo 		"<a href='call_recording_edit.php' alt='".$text['button-add']."'>$v_link_label_add</a>";
@@ -293,6 +293,12 @@
 	echo "</tr>\n";
 	echo "</table>";
 	echo "</form>\n";
+
+	if (strlen($paging_controls) > 0) {
+		echo "<br />";
+		echo $paging_controls."\n";
+	}
+
 	echo "<br /><br />";
 
 //include the footer

app/call_recordings/resources/classes/call_recordings.php

@@ -109,7 +109,7 @@ if (!class_exists('call_recordings')) {
 		} //end download method
 
 		/**
-		 * download the recordings
+		 * delete the recordings
 		 */
 		public function delete($id) {
 			if (permission_exists('call_recording_delete')) {

app/calls/app_config.php

@@ -31,24 +31,24 @@
 	//permission details
 		$y=0;
 		$apps[$x]['permissions'][$y]['name'] = "follow_me";
-		$apps[$x]['permissions'][$y]['groups'][] = "user";
-		$apps[$x]['permissions'][$y]['groups'][] = "admin";
 		$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
+		$apps[$x]['permissions'][$y]['groups'][] = "admin";
+		$apps[$x]['permissions'][$y]['groups'][] = "user";
+		$apps[$x]['permissions'][$y]['groups'][] = "agent";
 		$y++;
 		$apps[$x]['permissions'][$y]['name'] = "call_forward";
-		$apps[$x]['permissions'][$y]['groups'][] = "user";
-		$apps[$x]['permissions'][$y]['groups'][] = "admin";
 		$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
+		$apps[$x]['permissions'][$y]['groups'][] = "admin";
+		$apps[$x]['permissions'][$y]['groups'][] = "user";
+		$apps[$x]['permissions'][$y]['groups'][] = "agent";
 		$y++;
 		$apps[$x]['permissions'][$y]['name'] = "do_not_disturb";
-		$apps[$x]['permissions'][$y]['groups'][] = "user";
-		$apps[$x]['permissions'][$y]['groups'][] = "admin";
 		$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
+		$apps[$x]['permissions'][$y]['groups'][] = "admin";
+		$apps[$x]['permissions'][$y]['groups'][] = "user";
+		$apps[$x]['permissions'][$y]['groups'][] = "agent";
 		$y++;
 		$apps[$x]['permissions'][$y]['name'] = "call_forward_caller_id";
-		$apps[$x]['permissions'][$y]['groups'][] = "user";
-		$apps[$x]['permissions'][$y]['groups'][] = "admin";
-		$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
 
 	//default settings
 		$y=0;

app/calls/call_edit.php

@@ -382,11 +382,8 @@
 				$cache->delete("directory:".$number_alias."@".$_SESSION['domain_name']);
 			}
 
-		//redirect the user
+		//add the message
-			messages::add($text['confirm-update']);
+			message::add($text['confirm-update']);
-			header("Location: ".$_REQUEST['return_url']);
-			return;
-
 	}
 
 //show the header
@@ -446,10 +443,10 @@
 	$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
 	foreach ($result as &$row) {
 		if (strlen($number_alias) == 0) {
-			echo "		\"".$row["extension"]."\",\n";
+			echo "		\"".escape($row["extension"])."\",\n";
 		}
 		else {
-			echo "		\"".$row["number_alias"]."\",\n";
+			echo "		\"".escape($row["number_alias"])."\",\n";
 		}
 	}
 	echo "	];\n";
@@ -463,7 +460,6 @@
 
 //show the content
 	echo "<form method='post' name='frm' action=''>\n";
-	echo "<input type='hidden' name='return_url' value='".$_SERVER["HTTP_REFERER"]."'>\n";
 
 	echo "<table width='100%' border='0' cellpadding='0' cellspacing='0'>\n";
 	echo "<tr>\n";
@@ -471,7 +467,7 @@
 	echo "	<b>".$text['title']."</b>\n";
 	echo "</td>\n";
 	echo "<td width='70%' align='right' valign='top'>\n";
-	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='".$_SERVER["HTTP_REFERER"]."'\" value='".$text['button-back']."'>\n";
+	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='/'\" value='".$text['button-back']."'>\n";
 	echo "	<input type='submit' name='submit' class='btn' value='".$text['button-save']."'>\n";
 	echo "</td>\n";
 	echo "</tr>\n";
@@ -491,7 +487,7 @@
 	$on_click .= "document.getElementById('dnd_disabled').checked=true; ";
 	$on_click .= "document.getElementById('forward_all_destination').focus(); ";
 	echo "	<label for='forward_all_disabled'><input type='radio' name='forward_all_enabled' id='forward_all_disabled' onclick=\"\" value='false' ".(($forward_all_enabled == "false" || $forward_all_enabled == "") ? "checked='checked'" : null)." /> ".$text['label-disabled']."</label> \n";
-	echo "	<label for='forward_all_enabled'><input type='radio' name='forward_all_enabled' id='forward_all_enabled' onclick=\"".$on_click."\" value='true' ".(($forward_all_enabled == "true") ? "checked='checked'" : null)." /> ".$text['label-enabled']."</label> \n";
+	echo "	<label for='forward_all_enabled'><input type='radio' name='forward_all_enabled' id='forward_all_enabled' onclick=\"$on_click\" value='true' ".(($forward_all_enabled == "true") ? "checked='checked'" : null)." /> ".$text['label-enabled']."</label> \n";
 	unset($on_click);
 	echo "&nbsp;&nbsp;&nbsp;";
 	echo "	<input class='formfld' type='text' name='forward_all_destination' id='forward_all_destination' maxlength='255' placeholder=\"".$text['label-destination']."\" value=\"".escape($forward_all_destination)."\">\n";
@@ -507,7 +503,7 @@
 	$on_click = "document.getElementById('dnd_disabled').checked=true;";
 	$on_click .= "document.getElementById('forward_busy_destination').focus();";
 	echo "	<label for='forward_busy_disabled'><input type='radio' name='forward_busy_enabled' id='forward_busy_disabled' onclick=\"\" value='false' ".(($forward_busy_enabled == "false" || $forward_busy_enabled == "") ? "checked='checked'" : null)." /> ".$text['label-disabled']."</label> \n";
-	echo "	<label for='forward_busy_enabled'><input type='radio' name='forward_busy_enabled' id='forward_busy_enabled' onclick=\"".escape($on_click)."\" value='true' ".(($forward_busy_enabled == "true") ? "checked='checked'" : null)."/> ".$text['label-enabled']."</label> \n";
+	echo "	<label for='forward_busy_enabled'><input type='radio' name='forward_busy_enabled' id='forward_busy_enabled' onclick=\"$on_click\" value='true' ".(($forward_busy_enabled == "true") ? "checked='checked'" : null)."/> ".$text['label-enabled']."</label> \n";
 	unset($on_click);
 	echo "&nbsp;&nbsp;&nbsp;";
 	echo "	<input class='formfld' type='text' name='forward_busy_destination' id='forward_busy_destination' maxlength='255' placeholder=\"".$text['label-destination']."\" value=\"".escape($forward_busy_destination)."\">\n";
@@ -547,7 +543,7 @@
 	echo "</tr>\n";
 
 	if (permission_exists('call_forward_caller_id')) {
-		$sql_forward = "select destination_uuid, destination_number, destination_description, destination_caller_id_number, destination_caller_id_name from v_destinations where domain_uuid = '$domain_uuid' and destination_type = 'inbound' order by destination_number asc ";
+		$sql_forward = "select destination_uuid, destination_number, destination_description, destination_caller_id_number, destination_caller_id_name from v_destinations where domain_uuid = '".escape($domain_uuid)."' and destination_type = 'inbound' order by destination_number asc ";
 		$prep_statement_forward = $db->prepare(check_sql($sql_forward));
 		$prep_statement_forward->execute();
 		$result_forward = $prep_statement_forward->fetchAll(PDO::FETCH_ASSOC);
@@ -592,7 +588,7 @@
 		$on_click .= "document.getElementById('follow_me_caller_id_uuid').focus(); ";
 	}
 	echo "	<label for='follow_me_disabled'><input type='radio' name='follow_me_enabled' id='follow_me_disabled' onclick=\"$('#tr_follow_me_settings').slideUp('fast');\" value='false' ".(($follow_me_enabled == "false" || $follow_me_enabled == "") ? "checked='checked'" : null)." /> ".$text['label-disabled']."</label> \n";
-	echo "	<label for='follow_me_enabled'><input type='radio' name='follow_me_enabled' id='follow_me_enabled' onclick=\"$('#tr_follow_me_settings').slideDown('fast'); ".escape($on_click)."\" value='true' ".(($follow_me_enabled == "true") ? "checked='checked'" : null)."/> ".$text['label-enabled']."</label> \n";
+	echo "	<label for='follow_me_enabled'><input type='radio' name='follow_me_enabled' id='follow_me_enabled' onclick=\"$('#tr_follow_me_settings').slideDown('fast'); $on_click\" value='true' ".(($follow_me_enabled == "true") ? "checked='checked'" : null)."/> ".$text['label-enabled']."</label> \n";
 	unset($on_click);
 	echo "</td>\n";
 	echo "</tr>\n";
@@ -652,7 +648,7 @@
 		echo "			</td>\n";
 		echo "			<td class='vtable' align='left'>\n";
 		echo "				<label for='follow_me_ignore_busy_false'><input type='radio' name='follow_me_ignore_busy' id='follow_me_ignore_busy_false' value='false' onclick=\"\" ".(($follow_me_ignore_busy == "false" || $follow_me_ignore_busy == "") ? "checked='checked'" : null)." /> ".$text['label-disabled']."</label> \n";
-		echo "				<label for='follow_me_ignore_busy_true'><input type='radio' name='follow_me_ignore_busy' id='follow_me_ignore_busy_true' value='true' onclick=\"".escape($on_click)."\" ".(($follow_me_ignore_busy == "true") ? "checked='checked'" : null)." /> ".$text['label-enabled']."</label> \n";
+		echo "				<label for='follow_me_ignore_busy_true'><input type='radio' name='follow_me_ignore_busy' id='follow_me_ignore_busy_true' value='true' onclick=\"$on_click\" ".(($follow_me_ignore_busy == "true") ? "checked='checked'" : null)." /> ".$text['label-enabled']."</label> \n";
 		echo "				<br />\n";
 		echo 				$text['description-ignore_busy']."\n";
 		echo "			</td>\n";
@@ -660,7 +656,7 @@
 	}
 
 	if (permission_exists('follow_me_caller_id')) {
-		$sql_follow_me = "select destination_uuid, destination_number, destination_description, destination_caller_id_number, destination_caller_id_name from v_destinations where domain_uuid = '$domain_uuid' and destination_type = 'inbound' order by destination_number asc ";
+		$sql_follow_me = "select destination_uuid, destination_number, destination_description, destination_caller_id_number, destination_caller_id_name from v_destinations where domain_uuid = '".escape($domain_uuid)."' and destination_type = 'inbound' order by destination_number asc ";
 		$prep_statement_follow_me = $db->prepare(check_sql($sql_follow_me));
 		$prep_statement_follow_me->execute();
 		$result_follow_me = $prep_statement_follow_me->fetchAll(PDO::FETCH_ASSOC);

app/calls/calls.php

@@ -167,10 +167,8 @@
 	if (permission_exists('call_forward')) { echo "<th>".$text['label-call-forward']."</th>\n"; }
 	if (permission_exists('follow_me')) { echo "<th>".$text['label-follow-me']."</th>\n"; }
 	if (permission_exists('do_not_disturb')) { echo "<th>".$text['label-dnd']."</th>\n"; }
-	if (!$is_included) {
+	echo "<th>".$text['label-description']."</th>\n";
-		echo "<th class='hidden-xs'>".$text['table-description']."</th>\n";
+	echo "	<td class='list_control_icon'>&nbsp;</td>\n";
-	}
-	echo "<td class='list_control_icon'>&nbsp;</td>\n";
 	echo "</tr>\n";
 
 	if (is_array($extensions)) {
@@ -180,7 +178,7 @@
 			echo "<tr ".$tr_link.">\n";
 			echo "	<td valign='top' class='".$row_style[$c]."'><a ".$tr_link.">".escape($row['extension'])."</a></td>\n";
 			if (permission_exists('call_forward')) {
-				echo "<td valign='top' class='".$row_style[$c]."'>".(($row['forward_all_enabled'] == 'true') ? escape(format_phone($row['forward_all_destination'])) : '&nbsp;')."</td>";
+				echo "	<td valign='top' class='".$row_style[$c]."'>".(($row['forward_all_enabled'] == 'true') ? escape(format_phone($row['forward_all_destination'])) : '&nbsp;')."</td>";
 			}
 			if (permission_exists('follow_me')) {
 				if ($row['follow_me_uuid'] != '') {
@@ -204,14 +202,13 @@
 				else {
 					$follow_me_enabled = false;
 				}
-				echo "<td valign='top' class='".$row_style[$c]."'>".(($follow_me_enabled) ? $text['label-enabled']." (".$follow_me_destination_count.")" : '&nbsp;')."</td>";
+				echo "	<td valign='top' class='".$row_style[$c]."'>".(($follow_me_enabled) ? $text['label-enabled']." (".$follow_me_destination_count.")" : '&nbsp;')."</td>";
 			}
 			if (permission_exists('do_not_disturb')) {
-				echo "<td valign='top' class='".$row_style[$c]."'>".(($row['do_not_disturb'] == 'true') ? $text['label-enabled'] : '&nbsp;')."</td>";
+				echo "	<td valign='top' class='".$row_style[$c]."'>".(($row['do_not_disturb'] == 'true') ? $text['label-enabled'] : '&nbsp;')."</td>";
-			}
-			if (!$is_included) {
-				echo "<td valign='top' class='row_stylebg hidden-xs'>".escape($row['description'])."&nbsp;</td>\n";
 			}
+			echo "	<td valign='top' class='".$row_style[$c]."'>".escape($row['description'])."&nbsp;</td>\n";
+
 			echo "	<td class='list_control_icon'><a href='".$tr_url."' alt='".$text['button-edit']."'>".$v_link_label_edit."</a></td>\n";
 			echo "</tr>\n";
 			$c = ($c) ? 0 : 1;

app/calls/resources/classes/follow_me.php

@@ -17,7 +17,7 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Copyright (C) 2010 - 2016
+	Copyright (C) 2010 - 2019
 	All Rights Reserved.
 
 	Contributor(s):
@@ -32,6 +32,7 @@ include "root.php";
 //define the follow me class
 	class follow_me {
 		public $domain_uuid;
+		private $domain_name;
 		public $db_type;
 		public $follow_me_uuid;
 		public $cid_name_prefix;
@@ -158,7 +159,7 @@ include "root.php";
 						. "follow_me_delay,"
 						. "follow_me_prompt,"
 						. "follow_me_order"
-					. ")values(?,?,?,?,?,?,?,?)"
+					. ") values(?,?,?,?,?,?,?,?)"
 				);
 
 			//delete related follow me destinations
@@ -235,6 +236,7 @@ include "root.php";
 		} //function
 
 		public function set() {
+
 			//set the global variable
 				global $db;
 
@@ -255,16 +257,21 @@ include "root.php";
 				}
 
 			//determine whether to update the dial string
-				$sql = "select * from v_follow_me ";
+				$sql = "select d.domain_name, f.* from v_follow_me as f, v_domains as d ";
-				$sql .= "where domain_uuid = '".$this->domain_uuid."' ";
+				$sql .= "where f.domain_uuid = '".$this->domain_uuid."' ";
-				$sql .= "and follow_me_uuid = '".$this->follow_me_uuid."' ";
+				$sql .= "and f.follow_me_uuid = '".$this->follow_me_uuid."' ";
+				$sql .= "and d.domain_uuid = f.domain_uuid ";
 				$prep_statement = $db->prepare(check_sql($sql));
 				$prep_statement->execute();
 				$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
-				if (is_array($result)) foreach ($result as &$row) {
+				if (is_array($result)) {
-					$follow_me_uuid = $row["follow_me_uuid"];
+					foreach ($result as &$row) {
-					$this->cid_name_prefix = $row["cid_name_prefix"];
+						$follow_me_uuid = $row["follow_me_uuid"];
-					$this->cid_number_prefix = $row["cid_number_prefix"];
+						$this->domain_name = $row["domain_name"];
+						$this->follow_me_enabled = $row["follow_me_enabled"];
+						$this->cid_name_prefix = $row["cid_name_prefix"];
+						$this->cid_number_prefix = $row["cid_number_prefix"];
+					}
 				}
 				unset ($prep_statement);
 
@@ -275,22 +282,10 @@ include "root.php";
 				$prep_statement_2 = $db->prepare(check_sql($sql));
 				$prep_statement_2->execute();
 				$result = $prep_statement_2->fetchAll(PDO::FETCH_NAMED);
-				$dial_string = "{";
-				if ($this->follow_me_ignore_busy != 'true') {
-					$dial_string .= "fail_on_single_reject=USER_BUSY,";
-				}
-				$dial_string .= "instant_ringback=true,";
-				$dial_string .= "ignore_early_media=true";
-				$dial_string .= ",domain_uuid=".$_SESSION['domain_uuid'];
-				$dial_string .= ",sip_invite_domain=".$_SESSION['domain_name'];
-				$dial_string .= ",domain_name=".$_SESSION['domain_name'];
-				$dial_string .= ",domain=".$_SESSION['domain_name'];
-				$dial_string .= ",extension_uuid=".$this->extension_uuid;
-				$dial_string .= ",group_confirm_key=exec,group_confirm_file=lua confirm.lua";
 
+				/*
 				$dial_string_caller_id_name = "\${effective_caller_id_name}";
 				$dial_string_caller_id_number = "\${effective_caller_id_number}";
-
 				if (strlen($this->follow_me_caller_id_uuid) > 0) {
 					$sql_caller = "select destination_number, destination_description, destination_caller_id_number, destination_caller_id_name ";
 					$sql_caller .= "from v_destinations ";
@@ -311,123 +306,151 @@ include "root.php";
 						}
 					}
 				}
+				*/
 
-				//accountcode
-				if (strlen($this->accountcode) == 0) {
-					$dial_string .= ",sip_h_X-accountcode=\${accountcode}";
-				}
-				else {
-					$dial_string .= ",sip_h_X-accountcode=".$this->accountcode;
-					$dial_string .= ",accountcode=".$this->accountcode;
-				}
-
-				//toll allow
-				if ($this->toll_allow != '') {
-					$dial_string .= ",toll_allow='".$this->toll_allow."'";
-				}
-
-				$dial_string .= "}";
 				$x = 0;
 				if (is_array($result)) foreach ($result as &$row) {
 					if ($x > 0) {
 						$dial_string .= ",";
 					}
-					if (($presence_id = extension_presence_id($row["follow_me_destination"])) !== false) {
+
-						//set the dial string
+					//determine if the destination is a local sip user
-						// using here `sofia_contact` instead of `user/` allows add registered device
+					$sql = "select extension, number_alias from v_extensions ";
-						// so you can make follow me for extension `100` like `100` and avoid recursion
+					$sql .= "where domain_uuid = '".$this->domain_uuid."' ";
-						// but it ignores DND/CallForwad settings
+					$sql .= "and (extension = '".$row["follow_me_destination"]."' ";
-						if (strlen($_SESSION['domain']['dial_string']['text']) == 0) {
+					$sql .= "or number_alias = '".$row["follow_me_destination"]."') ";
-							$dial_string .= "[";
+					$field = $db->query($sql)->fetch(PDO::FETCH_ASSOC);
-							$dial_string .= "presence_id=".$presence_id."@".$_SESSION['domain_name'].',';
+					if (isset($field['extension'])) {
-							if ($row["follow_me_prompt"] == "1") {
+						if (is_numeric($field['extension'])) {
-								$dial_string .= "group_confirm_key=exec,group_confirm_file=lua confirm.lua,confirm=true,";
+							$presence_id = $field['extension'];
-							}
-							$dial_string .= "leg_delay_start=".$row["follow_me_delay"].",";
-							$dial_string .= "leg_timeout=".$row["follow_me_timeout"]."]";
-							$dial_string .= "\${sofia_contact(".$row["follow_me_destination"]."@".$_SESSION['domain_name'].")}";
 						}
 						else {
-							//get the session dial string
+							$presence_id = $field['number_alias'];
-							$dial_string_template = $_SESSION['domain']['dial_string']['text'];
-
-							//replace the variables with the values
-							$dial_string_template = str_replace("sip_invite_domain=\${domain_name},", "", $dial_string_template);
-							$dial_string_template = str_replace("presence_id=\${dialed_user}@\${dialed_domain}", "", $dial_string_template);
-							$dial_string_template = str_replace("\${dialed_user}", $row["follow_me_destination"], $dial_string_template);
-							$dial_string_template = str_replace("\${dialed_domain}", $_SESSION['domain_name'], $dial_string_template);
-							$dial_string_template = str_replace("\${call_timeout}", $row["follow_me_timeout"], $dial_string_template);
-							$dial_string_template = str_replace("\${leg_timeout}", $row["follow_me_timeout"], $dial_string_template);
-
-							//seperate the variables from the bridge statement
-							preg_match_all('/{((?:[^{}]|(?R))*)}/', $dial_string_template, $matches, PREG_PATTERN_ORDER);
-							$dial_string_variables = $matches[1][0];
-							$dial_string_bridge = $matches[1][1];
-
-							//add to the dial string
-							$dial_string .= "[";
-							$dial_string .= $dial_string_variables;
-
-							//group confirm
-							if ($row["follow_me_prompt"] == "1") {
-								$dial_string .= ",group_confirm_key=exec,group_confirm_file=lua confirm.lua,confirm=true";
-							}
-							$dial_string .= "]";
-							$dial_string .= "\${".$dial_string_bridge."}";
 						}
+						$variables[] = "presence_id=".$presence_id."@".$this->domain_name;
+						if ($row["follow_me_prompt"] == "1") {
+							$variables[] = "group_confirm_key=exec";
+							$variables[] = "group_confirm_file=lua confirm.lua";
+							$variables[] = "confirm=true";
+						}
+						if ($this->follow_me_ignore_busy != 'true') {
+							$variables[] = "fail_on_single_reject=USER_BUSY";
+						}
+						//accountcode
+						if (strlen($this->accountcode) == 0) {
+							$variables[] = "sip_h_X-accountcode=\${accountcode}";
+						}
+						else {
+							$variables[] = "sip_h_X-accountcode=".$this->accountcode;
+							$variables[] = "accountcode=".$this->accountcode;
+						}
+						//toll allow
+						if ($this->toll_allow != '') {
+							$variables[] = "toll_allow=''".str_replace(",", "\,", $this->toll_allow)."''";
+						}
+
+						$variables[] = "instant_ringback=true";
+						$variables[] = "ignore_early_media=true";
+						$variables[] = "domain_uuid=".$this->domain_uuid;
+						$variables[] = "sip_invite_domain=".$this->domain_name;
+						$variables[] = "domain_name=".$this->domain_name;
+						$variables[] = "domain=".$this->domain_name;
+						$variables[] = "extension_uuid=".$this->extension_uuid;
+						$variables[] = "leg_delay_start=".$row["follow_me_delay"];
+						$variables[] = "originate_delay_start=".$row["follow_me_delay"];
+						$variables[] = "leg_timeout=".$row["follow_me_timeout"];
+
+						$dial_string .= "[".implode(",", $variables)."]\${sofia_contact(*/".$row["follow_me_destination"]."@".$this->domain_name.")}";
+						//$dial_string .= "[".implode(",", $variables)."]user/".$row["follow_me_destination"]."@".$this->domain_name;
+						//$dial_string .= "loopback/export:".implode("\,export:", $variables)."\,transfer:".$row["follow_me_destination"]."/".$this->domain_name."/inline";
+						unset($variables);
 					}
 					else {
-						$presence_id = extension_presence_id($this->extension, $this->number_alias);
+						if (is_numeric($this->extension)) {
-						$dial_string .= "[presence_id=".$presence_id."@".$_SESSION['domain_name'];
+							$presence_id = $this->extension;
+						}
+						else {
+							$presence_id = $this->number_alias;
+						}
+						$variables[] = "presence_id=".$presence_id."@".$this->domain_name;
 
 						//set the caller id
-						if ($_SESSION['cdr']['follow_me_fix']['boolean'] == "true") {
+						if ($_SESSION['follow_me']['outbound_caller_id']['boolean'] == "true") {
 							if (strlen($this->outbound_caller_id_name) > 0) {
-								$dial_string .= ",origination_caller_id_name=".$this->cid_name_prefix.$this->outbound_caller_id_name;
+								$variables[] = "origination_caller_id_name=".$this->cid_name_prefix.$this->outbound_caller_id_name;
-								$dial_string .= ",effective_caller_id_name=".$this->cid_name_prefix.$this->outbound_caller_id_name;
+								$variables[] = "effective_caller_id_name=".$this->cid_name_prefix.$this->outbound_caller_id_name;
 							}
 							if (strlen($this->outbound_caller_id_number) > 0) {
-								$dial_string .= ",origination_caller_id_number=".$this->cid_number_prefix.$this->outbound_caller_id_number;
+								$variables[] = "origination_caller_id_number=".$this->cid_number_prefix.$this->outbound_caller_id_number;
-								$dial_string .= ",effective_caller_id_number=".$this->cid_number_prefix.$this->outbound_caller_id_number;
+								$variables[] = "effective_caller_id_number=".$this->cid_number_prefix.$this->outbound_caller_id_number;
 							}
 						}
 						else {
-							if (strlen($caller_id_number) > 0) {
+							if ($_SESSION['domain']['bridge']['text'] == "loopback") {
-								//set the caller id if it is set
-								if (strlen($caller_id_name) > 0) { 
-									$dial_string .= ",origination_caller_id_name=".$this->cid_name_prefix.$caller_id_name; 
-									$dial_string .= ",effective_caller_id_name=".$this->cid_name_prefix.$caller_id_name;
-								}
-								$dial_string .= ",origination_caller_id_number=".$this->cid_number_prefix.$caller_id_number;
-								$dial_string .= ",effective_caller_id_number=".$this->cid_number_prefix.$caller_id_number;
-							}
-							else {
 								//set the outbound caller id number if the caller id number is a user
-							        $dial_string .=',origination_caller_id_number=${cond(${from_user_exists} == true ? ${outbound_caller_id_number} : ${origination_caller_id_number})}';
+								$variables[] = "origination_caller_id_number=\${cond(\${from_user_exists} == true ? ".$this->outbound_caller_id_number." : \${origination_caller_id_number})}";
-								$dial_string .=',effective_caller_id_number=${cond(${from_user_exists} == true ? ${outbound_caller_id_number} : ${effective_caller_id_number})}';
+								$variables[] = "effective_caller_id_number=\${cond(\${from_user_exists} == true ? ".$this->outbound_caller_id_number." : \${effective_caller_id_number})}";
-								$dial_string .=',origination_caller_id_name=${cond(${from_user_exists} == true ? ${outbound_caller_id_name} : ${origination_caller_id_name})}';
+								$variables[] = "origination_caller_id_name=\${cond(\${from_user_exists} == true ? ".$this->outbound_caller_id_name." : \${origination_caller_id_name})}";
-								$dial_string .=',effective_caller_id_name=${cond(${from_user_exists} == true ? ${outbound_caller_id_name} : ${effective_caller_id_name})}';
+								$variables[] = "effective_caller_id_name=\${cond(\${from_user_exists} == true ? ".$this->outbound_caller_id_name." : \${effective_caller_id_name})}";
+							} else {
+								$variables[] .="origination_caller_id_number=\${cond(\${from_user_exists} == true ? \${outbound_caller_id_number} : )}";
+								$variables[] .="effective_caller_id_number=\${cond(\${from_user_exists} == true ? \${outbound_caller_id_number} : )}";
+								$variables[] .="origination_caller_id_name=\${cond(\${from_user_exists} == true ? \${outbound_caller_id_name} : )}";
+								$variables[] .="effective_caller_id_name=\${cond(\${from_user_exists} == true ? \${outbound_caller_id_name} : )}";								
 							}
 						}
 
+						//accountcode
+						if (strlen($this->accountcode) == 0) {
+							$variables[] = "sip_h_X-accountcode=\${accountcode}";
+						}
+						else {
+							$variables[] = "sip_h_X-accountcode=".$this->accountcode;
+							$variables[] = "accountcode=".$this->accountcode;
+						}
+
+						//toll allow
+						if ($this->toll_allow != '') {
+							$variables[] = "toll_allow=''".str_replace(",", "\,", $this->toll_allow)."''";
+						}
+
+						if ($this->follow_me_ignore_busy != 'true') {
+							$variables[] = "fail_on_single_reject=USER_BUSY";
+						}
+
 						if ($row["follow_me_prompt"] == "1") {
-							$dial_string .= ",group_confirm_key=exec,group_confirm_file=lua confirm.lua,confirm=true,";
+							$variables[] = "group_confirm_key=exec";
+							$variables[] = "group_confirm_file=lua confirm.lua";
+							$variables[] = "confirm=true";
 						}
-						$dial_string .= ",leg_delay_start=".$row["follow_me_delay"];
+
-						$dial_string .= ",leg_timeout=".$row["follow_me_timeout"]."]";
+						$variables[] = "instant_ringback=true";
+						$variables[] = "ignore_early_media=true";
+						$variables[] = "domain_uuid=".$this->domain_uuid;
+						$variables[] = "sip_invite_domain=".$this->domain_name;
+						$variables[] = "domain_name=".$this->domain_name;
+						//$variables[] = "domain=".$this->domain_name;
+						$variables[] = "extension_uuid=".$this->extension_uuid;
+						$variables[] = "leg_delay_start=".$row["follow_me_delay"];
+						$variables[] = "originate_delay_start=".$row["follow_me_delay"];
+						$variables[] = "sleep=".($row["follow_me_delay"] * 1000);
+						$variables[] = "leg_timeout=".$row["follow_me_timeout"];
 						if (is_numeric($row["follow_me_destination"])) {
 							if ($_SESSION['domain']['bridge']['text'] == "outbound" || $_SESSION['domain']['bridge']['text'] == "bridge") {
-								$bridge = outbound_route_to_bridge ($_SESSION['domain_uuid'], $row["follow_me_destination"]);
+								$bridge = outbound_route_to_bridge ($this->domain_uuid, $row["follow_me_destination"]);
-								$dial_string .= $bridge[0];
+								$dial_string .= "[".implode(",", $variables)."]".$bridge[0];
 							}
 							elseif ($_SESSION['domain']['bridge']['text'] == "loopback") {
-								$dial_string .= "loopback/".$row["follow_me_destination"]."/".$_SESSION['domain_name'];
+								$variables[] = "is_follow_me_loopback=true";
+								//$dial_string .= "loopback/".$row["follow_me_destination"]."/".$this->domain_name;
+								$dial_string .= "loopback/export:".implode("\,export:", $variables)."\,transfer:".$row["follow_me_destination"]."/".$this->domain_name."/inline";
 							}
 							elseif ($_SESSION['domain']['bridge']['text'] == "lcr") {
-								$dial_string .= "lcr/".$_SESSION['lcr']['profile']['text']."/".$_SESSION['domain_name']."/".$row["follow_me_destination"];
+								$dial_string .= "[".implode(",", $variables)."]lcr/".$_SESSION['lcr']['profile']['text']."/".$this->domain_name."/".$row["follow_me_destination"];
 							}
 							else {
-								$dial_string .= "loopback/".$row["follow_me_destination"]."/".$_SESSION['domain_name'];
+								//$dial_string .= "loopback/".$row["follow_me_destination"]."/".$this->domain_name;
+								$dial_string .= "loopback/export:".implode("\,export:", $variables)."\,transfer:".$row["follow_me_destination"]."/".$this->domain_name."/inline";
 							}
 						}
 						else {
@@ -436,18 +459,28 @@ include "root.php";
 					}
 					$x++;
 				}
-				$dial_string = str_replace(",]", "]", $dial_string);
+				//$dial_string = str_replace(",]", "]", $dial_string);
-				$this->dial_string = $dial_string;
+				$this->dial_string = "{ignore_early_media=true}".$dial_string;
+				unset($variables);
 
-				$sql  = "update v_follow_me set ";
+			//get the extension_uuid
-				$sql .= "dial_string = '".check_str($this->dial_string)."' ";
+				$parameters['follow_me_uuid'] = $this->follow_me_uuid;
-				$sql .= "where domain_uuid = '".$this->domain_uuid."' ";
+				$sql = "select extension_uuid from v_extensions ";
-				$sql .= "and follow_me_uuid = '".$this->follow_me_uuid."' ";
+				$sql .= "where follow_me_uuid = :follow_me_uuid ";
-				if ($this->debug) {
+				$database = new database;
-					echo $sql."<br />";
+				$result = $database->execute($sql, $parameters);
-				}
+				$message = $database->message;
-				$db->exec($sql);
+				$extension_uuid = $result[0]['extension_uuid'];
-				unset($sql);
+
+			//add the dialplan permission
+				$p = new permissions;
+				$p->add("follow_me_edit", 'temp');
+				$p->add("extension_edit", 'temp');
+
+			//add follow me to the array
+				$array['follow_me'][0]["follow_me_uuid"] = $this->follow_me_uuid;
+				$array['follow_me'][0]["domain_uuid"] = $this->domain_uuid;
+				$array['follow_me'][0]["dial_string"] = $this->dial_string;
 
 			//is follow me enabled
 				$dial_string = '';
@@ -455,17 +488,23 @@ include "root.php";
 					$dial_string = $this->dial_string;
 				}
 
-				$sql  = "update v_extensions set ";
+			//add extensions to the array
-				$sql .= "dial_string = '".check_str($dial_string)."', ";
+				$array['extensions'][0]["extension_uuid"] = $extension_uuid;
-				$sql .= "dial_domain = '".$_SESSION['domain_name']."' ";
+				$array['extensions'][0]["dial_domain"] = $this->domain_uuid;
-				$sql .= "where domain_uuid = '".$this->domain_uuid."' ";
+				$array['extensions'][0]["dial_string"] = $dial_string;
-				$sql .= "and follow_me_uuid = '".$this->follow_me_uuid."' ";
+				$array['extensions'][0]["follow_me_destinations"] = $dial_string;
-				if ($this->debug) {
+				$array['extensions'][0]["follow_me_enabled"] = $this->follow_me_enabled;
-					echo $sql."<br />";
-				}
-				$db->exec($sql);
-				unset($sql);
 
+			//save the destination
+				$database = new database;
+				$database->app_name = 'follow_me';
+				$database->app_uuid = '19806921-e8ed-dcff-b325-dd3e5da4959d';
+				$database->save($array);
+				$dialplan_response = $database->message;
+
+			//remove the temporary permission
+				$p->delete("follow_me_edit", 'temp');
+				$p->delete("extension_edit", 'temp');
 		} //function
 	} //class
 

app/click_to_call/click_to_call.php

@@ -52,19 +52,20 @@
 	require_once "resources/header.php";
 
 //send the call
-	if (is_array($_REQUEST) && !empty($_REQUEST['src']) && !empty($_REQUEST['dest'])) {
+	if (is_array($_GET) && isset($_GET['src']) && isset($_GET['dest'])) {
+
 		//retrieve submitted variables
-			$src = check_str($_REQUEST['src']);
+			$src = check_str($_GET['src']);
-			$src_cid_name = check_str($_REQUEST['src_cid_name']);
+			$src_cid_name = check_str($_GET['src_cid_name']);
-			$src_cid_number = check_str($_REQUEST['src_cid_number']);
+			$src_cid_number = check_str($_GET['src_cid_number']);
 
-			$dest = check_str($_REQUEST['dest']);
+			$dest = check_str($_GET['dest']);
-			$dest_cid_name = check_str($_REQUEST['dest_cid_name']);
+			$dest_cid_name = check_str($_GET['dest_cid_name']);
-			$dest_cid_number = check_str($_REQUEST['dest_cid_number']);
+			$dest_cid_number = check_str($_GET['dest_cid_number']);
 
-			$auto_answer = check_str($_REQUEST['auto_answer']); //true,false
+			$auto_answer = check_str($_GET['auto_answer']); //true,false
-			$rec = check_str($_REQUEST['rec']); //true,false
+			$rec = check_str($_GET['rec']); //true,false
-			$ringback = check_str($_REQUEST['ringback']);
+			$ringback = check_str($_GET['ringback']);
 			$context = $_SESSION['context'];
 
 		//clean up variable values
@@ -135,8 +136,7 @@
 
 		//define a leg - set source to display the defined caller id name and number
 			$source_common = "{";
-			$source_common .= "origination_uuid=".$origination_uuid;
+			$source_common .= "click_to_call=true";
-			$source_common .= ",click_to_call=true";
 			$source_common .= ",origination_caller_id_name='".$src_cid_name."'";
 			$source_common .= ",origination_caller_id_number=".$src_cid_number;
 			$source_common .= ",instant_ringback=true";
@@ -250,12 +250,12 @@
 
 	echo "	<br />";
 
-	echo "<form>\n";
+	echo "<form method=\"get\">\n";
 	echo "<table border='0' width='100%' cellpadding='0' cellspacing='0'\n";
 	echo "<tr>\n";
 	echo "	<td class='vncellreq' width='40%'>".$text['label-src-caller-id-nam']."</td>\n";
 	echo "	<td class='vtable' align='left'>\n";
-	echo "		<input name=\"src_cid_name\" value='$src_cid_name' class='formfld'>\n";
+	echo "		<input name=\"src_cid_name\" value='".escape($src_cid_name)."' class='formfld'>\n";
 	echo "		<br />\n";
 	echo "		".$text['desc-src-caller-id-nam']."\n";
 	echo "	</td>\n";
@@ -264,7 +264,7 @@
 	echo "<tr>\n";
 	echo "	<td class='vncellreq'>".$text['label-src-caller-id-num']."</td>\n";
 	echo "	<td class='vtable' align='left'>\n";
-	echo "		<input name=\"src_cid_number\" value='$src_cid_number' class='formfld'>\n";
+	echo "		<input name=\"src_cid_number\" value='".escape($src_cid_number)."' class='formfld'>\n";
 	echo "		<br />\n";
 	echo "		".$text['desc-src-caller-id-num']."\n";
 	echo "	</td>\n";
@@ -273,7 +273,7 @@
 	echo "<tr>\n";
 	echo "	<td class='vncell' width='40%'>".$text['label-dest-caller-id-nam']."</td>\n";
 	echo "	<td class='vtable' align='left'>\n";
-	echo "		<input name=\"dest_cid_name\" value='$dest_cid_name' class='formfld'>\n";
+	echo "		<input name=\"dest_cid_name\" value='".escape($dest_cid_name)."' class='formfld'>\n";
 	echo "		<br />\n";
 	echo "		".$text['desc-dest-caller-id-nam']."\n";
 	echo "	</td>\n";
@@ -282,7 +282,7 @@
 	echo "<tr>\n";
 	echo "	<td class='vncell'>".$text['label-dest-caller-id-num']."</td>\n";
 	echo "	<td class='vtable' align='left'>\n";
-	echo "		<input name=\"dest_cid_number\" value='$dest_cid_number' class='formfld'>\n";
+	echo "		<input name=\"dest_cid_number\" value='".escape($dest_cid_number)."' class='formfld'>\n";
 	echo "		<br />\n";
 	echo "		".$text['desc-dest-caller-id-num']."\n";
 	echo "	</td>\n";
@@ -405,6 +405,12 @@
 	else {
 		echo "    <option value='it-ring'>".$text['opt-itring']."</option>\n";
 	}
+	if ($ringback == "de-ring") {
+		echo "    <option value='de-ring' selected='selected'>".$text['opt-dering']."</option>\n";
+	}
+	else {
+		echo "    <option value='de-ring'>".$text['opt-dering']."</option>\n";
+	}
 	if ($ringback == "music") {
 		echo "    <option value='music' selected='selected'>".$text['opt-moh']."</option>\n";
 	}

app/conference_centers/app_config.php

@@ -111,8 +111,6 @@
 		$y++;
 		$apps[$x]['permissions'][$y]['name'] = "conference_room_max_members";
 		$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
-		$apps[$x]['permissions'][$y]['groups'][] = "admin";
-		$apps[$x]['permissions'][$y]['groups'][] = "user";
 		$y++;
 		$apps[$x]['permissions'][$y]['name'] = "conference_room_wait_mod";
 		$apps[$x]['permissions'][$y]['groups'][] = "superadmin";

app/conference_centers/app_menu.php

@@ -26,6 +26,30 @@
 	$apps[$x]['menu'][$y]['path'] = "/app/conference_centers/conference_centers.php";
 	$apps[$x]['menu'][$y]['groups'][] = "superadmin";
 	$apps[$x]['menu'][$y]['groups'][] = "admin";
+	$y++;
+	$apps[$x]['menu'][$y]['title']['en-us'] = "Conference Centers";
+	$apps[$x]['menu'][$y]['title']['ar-eg'] = "";
+	$apps[$x]['menu'][$y]['title']['de-at'] = "Konferenz Zentrale";
+	$apps[$x]['menu'][$y]['title']['de-ch'] = "";
+	$apps[$x]['menu'][$y]['title']['de-de'] = "Konferenz Zentrale";
+	$apps[$x]['menu'][$y]['title']['es-cl'] = "Cent. de Conferencias";
+	$apps[$x]['menu'][$y]['title']['es-mx'] = "";
+	$apps[$x]['menu'][$y]['title']['fr-ca'] = "";
+	$apps[$x]['menu'][$y]['title']['fr-fr'] = "Centre de Conférences";
+	$apps[$x]['menu'][$y]['title']['he-il'] = "";
+	$apps[$x]['menu'][$y]['title']['it-it'] = "Centro Conferenze";
+	$apps[$x]['menu'][$y]['title']['nl-nl'] = "";
+	$apps[$x]['menu'][$y]['title']['pl-pl'] = "Centrum Konferencyjne";
+	$apps[$x]['menu'][$y]['title']['pt-br'] = "Centro de Conferência";
+	$apps[$x]['menu'][$y]['title']['pt-pt'] = "Conferencias";
+	$apps[$x]['menu'][$y]['title']['ro-ro'] = "";
+	$apps[$x]['menu'][$y]['title']['ru-ru'] = "Конференц-центр";
+	$apps[$x]['menu'][$y]['title']['sv-se'] = "Konferenscenter";
+	$apps[$x]['menu'][$y]['title']['uk-ua'] = "Конференц-центр";
+	$apps[$x]['menu'][$y]['uuid'] = "b99cb768-ca19-4374-a954-02e344313d84";
+	$apps[$x]['menu'][$y]['parent_uuid'] = "fd29e39c-c936-f5fc-8e2b-611681b266b5";
+	$apps[$x]['menu'][$y]['category'] = "internal";
+	$apps[$x]['menu'][$y]['path'] = "/app/conference_centers/conference_rooms.php";
 	$apps[$x]['menu'][$y]['groups'][] = "user";
 
 ?>

app/conference_centers/conference_center_delete.php

@@ -90,7 +90,7 @@ else {
 	}
 
 //redirect the browser
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header("Location: conference_centers.php");
 	return;
 

app/conference_centers/conference_center_edit.php

@@ -177,10 +177,10 @@
 		//redirect the user
 			if (isset($action)) {
 				if ($action == "add") {
-					messages::add($text['message-add']);
+					message::add($text['message-add']);
 				}
 				if ($action == "update") {
-					messages::add($text['message-update']);
+					message::add($text['message-update']);
 				}
 				header("Location: conference_centers.php");
 				return;

app/conference_centers/conference_room_delete.php

@@ -91,7 +91,7 @@
 	}
 
 //redirect the user
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header("Location: conference_rooms.php");
 	return;
 

app/conference_centers/conference_room_edit.php

@@ -171,7 +171,7 @@
 				unset($sql);
 		}
 
-		messages::add($text['message-delete']);
+		message::add($text['message-delete']);
 		header("Location: conference_room_edit.php?id=".escape($conference_room_uuid));
 		return;
 	}
@@ -360,7 +360,7 @@ if (count($_POST) > 0 && strlen($_POST["persistformvar"]) == 0) {
 						unset($sql);
 					}
 
-				messages::add($text['message-add']);
+				message::add($text['message-add']);
 			} //if ($action == "add")
 
 			if ($action == "update" && permission_exists('conference_room_edit')) {
@@ -426,7 +426,7 @@ if (count($_POST) > 0 && strlen($_POST["persistformvar"]) == 0) {
 					$db->exec(check_sql($sql));
 					unset($sql);
 
-				messages::add($text['message-update']);
+				message::add($text['message-update']);
 			} //if ($action == "update")
 
 			//assign the user to the meeting
@@ -450,7 +450,7 @@ if (count($_POST) > 0 && strlen($_POST["persistformvar"]) == 0) {
 					$db->exec(check_sql($sql));
 					unset($sql);
 
-					messages::add($text['message-add']);
+					message::add($text['message-add']);
 				}
 
 			header("Location: conference_room_edit.php?id=".escape($conference_room_uuid));

app/conference_centers/conference_rooms.php

@@ -166,8 +166,7 @@
 	echo "<br /><br>\n";
 
 	//get the conference room count
-		require_once "app/conference_centers/resources/classes/conference_center.php";
+		$conference_center = new conference_centers;
-		$conference_center = new conference_center;
 		$conference_center->db = $db;
 		$conference_center->domain_uuid = $_SESSION['domain_uuid'];
 		if (strlen($meeting_uuid) > 0) {

app/conference_centers/conference_session_details.php

@@ -151,8 +151,7 @@
 		$sql .= "limit $rows_per_page offset $offset ";
 		$prep_statement = $db->prepare(check_sql($sql));
 		$prep_statement->execute();
-		$result = $prep_statement->fetchAll();
+		$conference_session_details = $prep_statement->fetchAll();
-		$result_count = count($result);
 		unset ($prep_statement, $sql);
 
 	$c = 0;
@@ -177,8 +176,8 @@
 	}
 	echo "</tr>\n";
 
-	if ($result_count > 0) {
+	if (is_array($conference_session_details)) {
-		foreach($result as $row) {
+		foreach($conference_session_details as $row) {
 			if (defined('TIME_24HR') && TIME_24HR == 1) {
 				$start_date = date("j M Y H:i:s", $row['start_epoch']);
 				$end_date = date("j M Y H:i:s", $row['end_epoch']);
@@ -191,7 +190,7 @@
 				$time_difference = $row['end_epoch'] - $row['start_epoch'];
 				$time_difference = gmdate("G:i:s", $time_difference);
 			}
-			$tr_link = (permission_exists('conference_session_details')) ? "href='/app/xml_cdr/xml_cdr_details.php?uuid=".escape($row['uuid'])."'" : null;
+			$tr_link = (permission_exists('conference_session_details')) ? "href='/app/xml_cdr/xml_cdr_details.php?id=".escape($row['uuid'])."'" : null;
 			echo "<tr ".$tr_link.">\n";
 			//echo "	<td valign='top' class='".$row_style[$c]."'>".$row['meeting_uuid']."&nbsp;</td>\n";
 			//echo "	<td valign='top' class='".$row_style[$c]."'>".$row['conference_session_uuid']."&nbsp;</td>\n";
@@ -204,13 +203,13 @@
 			echo "	<td valign='top' class='".$row_style[$c]."'>".$end_date."&nbsp;</td>\n";
 			if (permission_exists('conference_session_details')) {
 				echo "	<td class='list_control_icon'>";
-				echo "		<a href='/app/xml_cdr/xml_cdr_details.php?uuid=".escape($row['uuid'])."' alt='".$text['button-view']."'>$v_link_label_view</a>";
+				echo "		<a href='/app/xml_cdr/xml_cdr_details.php?id=".escape($row['uuid'])."' alt='".$text['button-view']."'>$v_link_label_view</a>";
 				echo "	</td>\n";
 			}
 			echo "</tr>\n";
 			if ($c==0) { $c=1; } else { $c=0; }
 		} //end foreach
-		unset($sql, $result, $row_count);
+		unset($sql, $conference_session_details);
 	} //end if results
 
 	echo "<tr>\n";

app/conference_centers/conference_sessions.php

@@ -105,14 +105,27 @@
 		$sql .= "limit $rows_per_page offset $offset ";
 		$prep_statement = $db->prepare(check_sql($sql));
 		$prep_statement->execute();
-		$result = $prep_statement->fetchAll();
+		$conference_sessions = $prep_statement->fetchAll();
-		$result_count = count($result);
 		unset ($prep_statement, $sql);
 
 	$c = 0;
 	$row_style["0"] = "row_style0";
 	$row_style["1"] = "row_style1";
 
+	echo "\n";
+	echo "<style>\n";
+	echo "audio {\n";
+	echo "	width:320px;\n";
+	echo "	height: 28px;\n";
+	echo "	-moz-border-radius:3px;\n";
+	echo "	-webkit-border-radius:3px;\n";
+	echo "	border-radius:3px;\n";
+	echo "	overflow:hidden;\n";
+	echo "	display: block;\n";
+	echo "}\n";
+	echo "</style>\n";
+	echo "\n";
+
 	echo "<table class='tr_hover' width='100%' border='0' cellpadding='0' cellspacing='0'>\n";
 	echo "<tr>\n";
 	echo "<th>".$text['label-time']."</th>\n";
@@ -124,8 +137,8 @@
 	echo "<td class='list_control_icon'>&nbsp;</td>\n";
 	echo "</tr>\n";
 
-	if ($result_count > 0) {
+	if (is_array($conference_sessions)) {
-		foreach($result as $row) {
+		foreach($conference_sessions as $row) {
 			$tmp_year = date("Y", $row['start_epoch']);
 			$tmp_month = date("M", $row['start_epoch']);
 			$tmp_day = date("d", $row['start_epoch']);
@@ -158,25 +171,43 @@
 				elseif (file_exists($tmp_dir.'/'.$row['conference_session_uuid'].'.wav')) {
 					$tmp_name = $row['conference_session_uuid'].".wav";
 				}
-				echo "	<td valign='top' class='".$row_style[$c]."'>\n";
+				echo "	<td class='".$row_style[$c]."'>\n";
 				if (strlen($tmp_name) > 0 && file_exists($tmp_dir.'/'.$tmp_name)) {
+					echo "<table border='0' cellpadding='0' cellspacing='0'>\n";
+					echo "</tr>\n";
 					if (permission_exists('conference_session_play')) {
-						echo "		<a href=\"javascript:void(0);\" onclick=\"window.open('".PROJECT_PATH."/app/recordings/recording_play.php?a=download&type=moh&filename=".base64_encode('archive/'.$tmp_year.'/'.$tmp_month.'/'.$tmp_day.'/'.$tmp_name)."', 'play',' width=420,height=150,menubar=no,status=no,toolbar=no')\">\n";
+						echo "<td valign=\"bottom\">\n";
-						echo "			".$text['label-play']."\n";
+						echo "		<audio controls=\"controls\">\n";
-						echo "		</a>\n";
+  						echo "			<source src=\"download.php?id=".escape($row['conference_session_uuid'])."\" type=\"audio/x-wav\">\n";
-						echo "		&nbsp;\n";
+						echo "		</audio>\n";
+						//echo "		<a href=\"javascript:void(0);\" onclick=\"window.open('".PROJECT_PATH."/app/recordings/recording_play.php?a=download&type=moh&filename=".base64_encode('archive/'.$tmp_year.'/'.$tmp_month.'/'.$tmp_day.'/'.$tmp_name)."', 'play',' width=420,height=150,menubar=no,status=no,toolbar=no')\">\n";
+						//echo "			".$text['label-play']."\n";
+						//echo "		</a>\n";
+						//echo "		&nbsp;\n";
+						echo "</td>\n";
 					}
-					echo "		<a href=\"../recordings/recordings.php?a=download&type=rec&t=bin&filename=".base64_encode("archive/".$tmp_year."/".$tmp_month."/".$tmp_day."/".$tmp_name)."\">\n";
+					echo "<td>\n";
-					echo "			".$text['label-download']."\n";
+					echo "	&nbsp;\n";
+					echo "</td>\n";
+					echo "<td>\n";
+					echo "		<a href=\"download.php?id=".escape($row['conference_session_uuid'])."\" valign='middle'>";
+					//echo "			".$text['label-download']."\n";
+					echo "			<input type='button' class='btn' name='' alt='".$text['label-download']."' value='".$text['label-download']."'>";
 					echo "		</a>\n";
-					echo "		&nbsp;\n";
+					echo "</td>\n";
+					echo "</tr>\n";
+					echo "</table>\n";
+					//echo "		&nbsp;\n";
 				}
 				else {
 					echo "&nbsp;";
 				}
 				echo "	</td>\n";
-				echo "	<td class='list_control_icon'>";
+				echo "	<td class='list_control_icon'>\n";
-				echo "		<a href='conference_session_details.php?uuid=".escape($row['conference_session_uuid'])."' alt='".$text['button-view']."'>$v_link_label_view</a>";
+				echo "		<a href='conference_session_details.php?uuid=".escape($row['conference_session_uuid'])."' alt='".$text['button-view']."'>\n";
+				//echo "			<input type='button' class='btn' name='' alt='".$text['label-view']."' value='".$text['label-view']."'>";
+				echo "			$v_link_label_view\n";
+				echo "		</a>\n";
 				echo "	</td>\n";
 				echo "</tr>\n";
 			}

app/conference_centers/download.php

@@ -0,0 +1,45 @@
+<?php
+/*
+	FusionPBX
+	Version: MPL 1.1
+
+	The contents of this file are subject to the Mozilla Public License Version
+	1.1 (the "License"); you may not use this file except in compliance with
+	the License. You may obtain a copy of the License at
+	http://www.mozilla.org/MPL/
+
+	Software distributed under the License is distributed on an "AS IS" basis,
+	WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+	for the specific language governing rights and limitations under the
+	License.
+
+	The Original Code is FusionPBX
+
+	The Initial Developer of the Original Code is
+	Mark J Crane <markjcrane@fusionpbx.com>
+	Portions created by the Initial Developer are Copyright (C) 2018
+	the Initial Developer. All Rights Reserved.
+
+	Contributor(s):
+	Mark J Crane <markjcrane@fusionpbx.com>
+*/
+
+//includes
+	require_once "root.php";
+	require_once "resources/require.php";
+
+//check permisions
+	require_once "resources/check_auth.php";
+	if (permission_exists('call_recording_view')) {
+		//access granted
+	}
+	else {
+		echo "access denied";
+		exit;
+	}
+
+//download
+	$obj = new conference_centers;
+	$obj->download();
+
+?>

app/conference_centers/resources/classes/call_center_notify.php

@@ -0,0 +1,63 @@
+<?php
+/*
+	FusionPBX
+	Version: MPL 1.1
+
+	The contents of this file are subject to the Mozilla Public License Version
+	1.1 (the "License"); you may not use this file except in compliance with
+	the License. You may obtain a copy of the License at
+	http://www.mozilla.org/MPL/
+
+	Software distributed under the License is distributed on an "AS IS" basis,
+	WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+	for the specific language governing rights and limitations under the
+	License.
+
+	The Original Code is FusionPBX
+
+	The Initial Developer of the Original Code is
+	Mark J Crane <markjcrane@fusionpbx.com>
+	Portions created by the Initial Developer are Copyright (C) 2008-2017
+	the Initial Developer. All Rights Reserved.
+
+	Contributor(s):
+	Mark J Crane <markjcrane@fusionpbx.com>
+	KonradSC <konrd@yahoo.com>
+*/
+include "root.php";
+
+//define the blf_notify class
+	class call_center_notify {
+
+		public $debug;
+		public $domain_name;
+		public $agent_name;
+		public $answer_state;
+		public $agent_uuid;
+
+
+	//feature_event method		
+		public function send_call_center_notify() {
+
+				$fp = event_socket_create($_SESSION['event_socket_ip_address'], $_SESSION['event_socket_port'], $_SESSION['event_socket_password']);
+				if ($fp) {
+					//send the event
+						$event = "sendevent PRESENCE_IN\n";
+						$event .= "proto: agent\n";
+						$event .= "event_type: presence\n";
+						$event .= "alt_event_type: dialog\n";
+						$event .= "Presence-Call-Direction: outbound\n";
+						$event .= "state: Active (1 waiting)\n";
+						$event .= "from: agent+".$this->agent_name."@".$this->domain_name."\n";
+						$event .= "login: agent+".$this->agent_name."@".$this->domain_name."\n";
+						$event .= "unique-id: ".$this->agent_uuid."\n";
+						$event .= "answer-state: ".$this->answer_state."\n";
+						event_socket_request($fp, $event);
+						//echo $event."<br />";
+					fclose($fp);	
+				}
+		} //function
+	
+	} //class
+
+?>

app/conference_centers/resources/classes/conference_centers.php

@@ -17,7 +17,7 @@
 
  The Initial Developer of the Original Code is
  Mark J Crane <markjcrane@fusionpbx.com>
- Portions created by the Initial Developer are Copyright (C) 2008-2013
+ Portions created by the Initial Developer are Copyright (C) 2008-2018
  the Initial Developer. All Rights Reserved.
 
  Contributor(s):
@@ -26,7 +26,8 @@
 */
 
 //define the conference center class
-	class conference_center {
+	class conference_centers {
+
 		public $db;
 		public $domain_uuid;
 		public $meeting_uuid;
@@ -39,6 +40,32 @@
 		public $count;
 		public $created_by;
 
+		/**
+		 * Called when the object is created
+		 */
+		public function __construct() {
+			//connect to the database if not connected
+			if (!$this->db) {
+				require_once "resources/classes/database.php";
+				$database = new database;
+				$database->connect();
+				$this->db = $database->db;
+			}
+		}
+
+		/**
+		 * Called when there are no references to a particular object
+		 * unset the variables used in the class
+		 */
+		public function __destruct() {
+			foreach ($this as $key => $value) {
+				unset($this->$key);
+			}
+		}
+
+		/**
+		 * count the conference rooms
+		 */
 		public function room_count() {
 			//get the room count
 				$not_admin = 1;
@@ -76,6 +103,9 @@
 				}
 		}
 
+		/**
+		 * get the list of conference rooms
+		 */
 		public function rooms() {
 			//get the list of rooms
 				$not_admin = 1;
@@ -153,6 +183,92 @@
 				}
 				return $result;
 		}
+		
+
+		/**
+		 * download the recordings
+		 */
+		public function download() {
+			if (permission_exists('call_recording_play') || permission_exists('call_recording_download')) {
+
+				//cache limiter
+					session_cache_limiter('public');
+
+				//get call recording from database
+					if (is_uuid($_GET['id'])) {
+						$conference_session_uuid = check_str($_GET['id']);
+					}
+					if ($conference_session_uuid != '') {
+						$sql = "select recording from v_conference_sessions ";
+						$sql .= "where conference_session_uuid = '".$conference_session_uuid."' ";
+						//$sql .= "and domain_uuid = '".$domain_uuid."' \n";
+						$prep_statement = $this->db->prepare($sql);
+						$prep_statement->execute();
+						$conference_sessions = $prep_statement->fetchAll(PDO::FETCH_ASSOC);
+						if (is_array($conference_sessions)) {
+							foreach($conference_sessions as &$row) {
+								$recording = $row['recording'];
+								break;
+							}
+						}
+						unset ($sql, $prep_statement, $conference_sessions);
+					}
+
+				//set the path for the directory
+					$default_path = $_SESSION['switch']['call_recordings']['dir']."/".$_SESSION['domain_name'];
+					
+				//get the file path and name
+					$record_path = dirname($recording);
+					$record_name = basename($recording);
+
+				//download the file
+					if (file_exists($record_path . '/' . $record_name . '.wav')) {
+						$record_name = $record_name . '.wav';
+					}
+					else {
+						if (file_exists($record_path . '/' . $record_name . '.mp3')) {
+							$record_name = $record_name . '.mp3';
+						}
+					}
+
+				//download the file
+					if (file_exists($record_path . '/' . $record_name)) {
+						//content-range
+						//if (isset($_SERVER['HTTP_RANGE']))  {
+						//	range_download($full_recording_path);
+						//}
+						ob_clean();
+						$fd = fopen($record_path . '/' . $record_name, "rb");
+						if ($_GET['t'] == "bin") {
+							header("Content-Type: application/force-download");
+							header("Content-Type: application/octet-stream");
+							header("Content-Type: application/download");
+							header("Content-Description: File Transfer");
+						}
+						else {
+							$file_ext = substr($record_name, -3);
+							if ($file_ext == "wav") {
+								header("Content-Type: audio/x-wav");
+							}
+							if ($file_ext == "mp3") {
+								header("Content-Type: audio/mpeg");
+							}
+						}
+						header('Content-Disposition: attachment; filename="'.$record_name.'"');
+						header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
+						header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past
+						// header("Content-Length: " . filesize($full_recording_path));
+						ob_clean();
+						fpassthru($fd);
+					}
+
+				//if base64, remove temp recording file
+					//if ($_SESSION['conference']['storage_type']['text'] == 'base64' && $row['conference_recording_base64'] != '') {
+					//	@unlink($record_path . '/' . $record_name);
+					//}
+			}
+		} //end download method
+
 	}
 
 //example conference center

app/conference_controls/app_config.php

@@ -104,7 +104,7 @@
 		$apps[$x]['db'][$y]['fields'][$z]['type']['sqlite'] = "text";
 		$apps[$x]['db'][$y]['fields'][$z]['type']['mysql'] = "char(36)";
 		$apps[$x]['db'][$y]['fields'][$z]['key']['type'] = "foreign";
-		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['table'] = "v_conference_control";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['table'] = "v_conference_controls";
 		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['field'] = "conference_control_uuid";
 		$z++;
 		$apps[$x]['db'][$y]['fields'][$z]['name'] = "control_digits";
@@ -123,4 +123,4 @@
 		$apps[$x]['db'][$y]['fields'][$z]['type'] = "text";
 		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "Set the status of the control.";
 
-?>
+?>

app/conference_controls/conference_control_delete.php

@@ -43,7 +43,7 @@
 	}
 
 //redirect the user
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header('Location: conference_controls.php');
 
 ?>

app/conference_controls/conference_control_detail_delete.php

@@ -36,7 +36,7 @@
 	}
 
 //redirect the user
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header('Location: conference_control_detail_edit.php?id='.$conference_control_uuid);
 
 ?>

app/conference_controls/conference_control_detail_edit.php

@@ -92,7 +92,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 				$db->exec(check_sql($sql));
 				unset($sql);
 
-				messages::add($text['message-add']);
+				message::add($text['message-add']);
 				header('Location: conference_control_edit.php?id='.$conference_control_uuid);
 				return;
 
@@ -110,7 +110,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 				$db->exec(check_sql($sql));
 				unset($sql);
 
-				messages::add($text['message-update']);
+				message::add($text['message-update']);
 				header('Location: conference_control_edit.php?id='.$conference_control_uuid);
 				return;
 
@@ -145,7 +145,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 	echo "<tr>\n";
 	echo "<td align='left' width='30%' nowrap='nowrap' valign='top'><b>".$text['title-conference_control_detail']."</b><br><br></td>\n";
 	echo "<td width='70%' align='right' valign='top'>\n";
-	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='conference_control_edit.php?id=$conference_control_uuid'\" value='".$text['button-back']."'>";
+	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='conference_control_edit.php?id=".escape($conference_control_uuid)."'\" value='".$text['button-back']."'>";
 	echo "	<input type='submit' name='submit' class='btn' value='".$text['button-save']."'>";
 	echo "</td>\n";
 	echo "</tr>\n";
@@ -155,7 +155,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 	echo "	".$text['label-control_digits']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "  <input class='formfld' type='text' name='control_digits' maxlength='255' value='$control_digits'>\n";
+	echo "  <input class='formfld' type='text' name='control_digits' maxlength='255' value='".escape($control_digits)."'>\n";
 	echo "<br />\n";
 	echo $text['description-control_digits']."\n";
 	echo "</td>\n";
@@ -166,7 +166,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 	echo "	".$text['label-control_action']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='control_action' maxlength='255' value=\"$control_action\">\n";
+	echo "	<input class='formfld' type='text' name='control_action' maxlength='255' value=\"".escape($control_action)."\">\n";
 	echo "<br />\n";
 	echo $text['description-control_action']."\n";
 	echo "</td>\n";
@@ -177,7 +177,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 	echo "	".$text['label-control_data']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='control_data' maxlength='255' value=\"$control_data\">\n";
+	echo "	<input class='formfld' type='text' name='control_data' maxlength='255' value=\"".escape($control_data)."\">\n";
 	echo "<br />\n";
 	echo $text['description-control_data']."\n";
 	echo "</td>\n";
@@ -209,9 +209,9 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
 	echo "</tr>\n";
 	echo "	<tr>\n";
 	echo "		<td colspan='2' align='right'>\n";
-	echo "				<input type='hidden' name='conference_control_uuid' value='$conference_control_uuid'>\n";
+	echo "				<input type='hidden' name='conference_control_uuid' value='".escape($conference_control_uuid)."'>\n";
 	if ($action == "update") {
-		echo "				<input type='hidden' name='conference_control_detail_uuid' value='$conference_control_detail_uuid'>\n";
+		echo "				<input type='hidden' name='conference_control_detail_uuid' value='".escape($conference_control_detail_uuid)."'>\n";
 	}
 	echo "				<input type='submit' name='submit' class='btn' value='".$text['button-save']."'>\n";
 	echo "		</td>\n";

app/conference_controls/conference_control_details.php

@@ -86,7 +86,7 @@
 	echo "		<td width='50%' align='left' nowrap='nowrap'><b>".$text['title-conference_control_details']."</b></td>\n";
 	//echo "		<form method='get' action=''>\n";
 	//echo "			<td width='50%' style='vertical-align: top; text-align: right; white-space: nowrap;'>\n";
-	//echo "				<input type='text' class='txt' style='width: 150px' name='search' id='search' value='".$search."'>\n";
+	//echo "				<input type='text' class='txt' style='width: 150px' name='search' id='search' value='".escape($search)."'>\n";
 	//echo "				<input type='submit' class='btn' name='submit' value='".$text['button-search']."'>\n";
 	//echo "			</td>\n";
 	//echo "		</form>\n";
@@ -112,19 +112,19 @@
 	if (is_array($result)) {
 		foreach($result as $row) {
 			if (permission_exists('conference_control_detail_edit')) {
-				$tr_link = "href='conference_control_detail_edit.php?conference_control_uuid=".$row['conference_control_uuid']."&id=".$row['conference_control_detail_uuid']."'";
+				$tr_link = "href='conference_control_detail_edit.php?conference_control_uuid=".escape($row['conference_control_uuid'])."&id=".escape($row['conference_control_detail_uuid'])."'";
 			}
 			echo "<tr ".$tr_link.">\n";
-			echo "	<td valign='top' class='".$row_style[$c]."'>".$row['control_digits']."&nbsp;</td>\n";
+			echo "	<td valign='top' class='".$row_style[$c]."'>".escape($row['control_digits'])."&nbsp;</td>\n";
-			echo "	<td valign='top' class='".$row_style[$c]."'>".$row['control_action']."&nbsp;</td>\n";
+			echo "	<td valign='top' class='".$row_style[$c]."'>".escape($row['control_action'])."&nbsp;</td>\n";
-			echo "	<td valign='top' class='".$row_style[$c]."'>".$row['control_data']."&nbsp;</td>\n";
+			echo "	<td valign='top' class='".$row_style[$c]."'>".escape($row['control_data'])."&nbsp;</td>\n";
-			echo "	<td valign='top' class='".$row_style[$c]."'>".$row['control_enabled']."&nbsp;</td>\n";
+			echo "	<td valign='top' class='".$row_style[$c]."'>".escape($row['control_enabled'])."&nbsp;</td>\n";
 			echo "	<td class='list_control_icons'>";
 			if (permission_exists('conference_control_detail_edit')) {
-				echo "<a href='conference_control_detail_edit.php?conference_control_uuid=".$row['conference_control_uuid']."&id=".$row['conference_control_detail_uuid']."' alt='".$text['button-edit']."'>$v_link_label_edit</a>";
+				echo "<a href='conference_control_detail_edit.php?conference_control_uuid=".escape($row['conference_control_uuid'])."&id=".escape($row['conference_control_detail_uuid'])."' alt='".$text['button-edit']."'>$v_link_label_edit</a>";
 			}
 			if (permission_exists('conference_control_detail_delete')) {
-				echo "<a href='conference_control_detail_delete.php?conference_control_uuid=".$row['conference_control_uuid']."&id=".$row['conference_control_detail_uuid']."' alt='".$text['button-delete']."' onclick=\"return confirm('".$text['confirm-delete']."')\">$v_link_label_delete</a>";
+				echo "<a href='conference_control_detail_delete.php?conference_control_uuid=".escape($row['conference_control_uuid'])."&id=".escape($row['conference_control_detail_uuid'])."' alt='".$text['button-delete']."' onclick=\"return confirm('".$text['confirm-delete']."')\">$v_link_label_delete</a>";
 			}
 			echo "	</td>\n";
 			echo "</tr>\n";

app/conference_controls/conference_control_edit.php

@@ -82,10 +82,10 @@
 		//redirect the user
 			if (isset($action)) {
 				if ($action == "add") {
-					messages::add($text['message-add']);
+					message::add($text['message-add']);
 				}
 				if ($action == "update") {
-					messages::add($text['message-update']);
+					message::add($text['message-update']);
 				}
 				header("Location: conference_controls.php");
 				return;

app/conference_profiles/app_config.php

@@ -104,7 +104,7 @@
 		$apps[$x]['db'][$y]['fields'][$z]['type']['sqlite'] = "text";
 		$apps[$x]['db'][$y]['fields'][$z]['type']['mysql'] = "char(36)";
 		$apps[$x]['db'][$y]['fields'][$z]['key']['type'] = "foreign";
-		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['table'] = "v_conference_profile";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['table'] = "v_conference_profiles";
 		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['field'] = "conference_profile_uuid";
 		$z++;
 		$apps[$x]['db'][$y]['fields'][$z]['name'] = "profile_param_name";
@@ -123,4 +123,4 @@
 		$apps[$x]['db'][$y]['fields'][$z]['type'] = "text";
 		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "Enter the description.";
 
-?>
+?>

app/conference_profiles/conference_profile_delete.php

@@ -43,7 +43,7 @@
 	}
 
 //redirect the user
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header('Location: conference_profiles.php');
 
 ?>

app/conference_profiles/conference_profile_edit.php

@@ -81,7 +81,7 @@
 					$db->exec(check_sql($sql));
 					unset($sql);
 	
-					messages::add($text['message-add']);
+					message::add($text['message-add']);
 					header("Location: conference_profiles.php");
 					return;
 	
@@ -97,7 +97,7 @@
 					$db->exec(check_sql($sql));
 					unset($sql);
 	
-					messages::add($text['message-update']);
+					message::add($text['message-update']);
 					header("Location: conference_profiles.php");
 					return;
 	

app/conference_profiles/conference_profile_param_delete.php

@@ -36,7 +36,7 @@
 	}
 
 //redirect the user
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header('Location: conference_profile_param_edit.php?id='.$conference_profile_uuid);
 
 ?>

app/conference_profiles/conference_profile_param_edit.php

@@ -93,7 +93,7 @@
 					$db->exec(check_sql($sql));
 					unset($sql);
 	
-					messages::add($text['message-add']);
+					message::add($text['message-add']);
 					header('Location: conference_profile_edit.php?id='.$conference_profile_uuid);
 					return;
 	
@@ -111,7 +111,7 @@
 					$db->exec(check_sql($sql));
 					unset($sql);
 	
-					messages::add($text['message-update']);
+					message::add($text['message-update']);
 					header('Location: conference_profile_edit.php?id='.$conference_profile_uuid);
 					return;
 	
@@ -156,7 +156,7 @@
 	echo "	".$text['label-profile_param_name']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='profile_param_name' maxlength='255' value=\"$profile_param_name\">\n";
+	echo "	<input class='formfld' type='text' name='profile_param_name' maxlength='255' value=\"".escape($profile_param_name)."\">\n";
 	echo "<br />\n";
 	echo $text['description-profile_param_name']."\n";
 	echo "</td>\n";
@@ -167,7 +167,7 @@
 	echo "	".$text['label-profile_param_value']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='profile_param_value' maxlength='255' value=\"$profile_param_value\">\n";
+	echo "	<input class='formfld' type='text' name='profile_param_value' maxlength='255' value=\"".escape($profile_param_value)."\">\n";
 	echo "<br />\n";
 	echo $text['description-profile_param_value']."\n";
 	echo "</td>\n";
@@ -203,7 +203,7 @@
 	echo "	".$text['label-profile_param_description']."\n";
 	echo "</td>\n";
 	echo "<td class='vtable' align='left'>\n";
-	echo "	<input class='formfld' type='text' name='profile_param_description' maxlength='255' value=\"$profile_param_description\">\n";
+	echo "	<input class='formfld' type='text' name='profile_param_description' maxlength='255' value=\"".escape($profile_param_description)."\">\n";
 	echo "<br />\n";
 	echo $text['description-profile_param_description']."\n";
 	echo "</td>\n";

app/conference_profiles/conference_profile_params.php

@@ -121,16 +121,16 @@
 				$tr_link = "href='conference_profile_param_edit.php?conference_profile_uuid=".$row['conference_profile_uuid']."&id=".$row['conference_profile_param_uuid']."'";
 			}
 			echo "<tr ".$tr_link.">\n";
-			echo "	<td valign='top' class='".$row_style[$c]."'>".$row['profile_param_name']."&nbsp;</td>\n";
+			echo "	<td valign='top' class='".$row_style[$c]."'>".escape($row['profile_param_name'])."&nbsp;</td>\n";
-			echo "	<td valign='top' class='".$row_style[$c]."'>".$row['profile_param_value']."&nbsp;</td>\n";
+			echo "	<td valign='top' class='".$row_style[$c]."'>".escape($row['profile_param_value'])."&nbsp;</td>\n";
-			echo "	<td valign='top' class='".$row_style[$c]."'>".$row['profile_param_enabled']."&nbsp;</td>\n";
+			echo "	<td valign='top' class='".$row_style[$c]."'>".escape($row['profile_param_enabled'])."&nbsp;</td>\n";
-			echo "	<td valign='top' class='".$row_style[$c]."'>".$row['profile_param_description']."&nbsp;</td>\n";
+			echo "	<td valign='top' class='".$row_style[$c]."'>".escape($row['profile_param_description'])."&nbsp;</td>\n";
 			echo "	<td class='list_control_icons'>";
 			if (permission_exists('conference_profile_param_edit')) {
-				echo "<a href='conference_profile_param_edit.php?conference_profile_uuid=".$row['conference_profile_uuid']."&id=".$row['conference_profile_param_uuid']."' alt='".$text['button-edit']."'>$v_link_label_edit</a>";
+				echo "<a href='conference_profile_param_edit.php?conference_profile_uuid=".escape($row['conference_profile_uuid'])."&id=".escape($row['conference_profile_param_uuid'])."' alt='".$text['button-edit']."'>$v_link_label_edit</a>";
 			}
 			if (permission_exists('conference_profile_param_delete')) {
-				echo "<a href='conference_profile_param_delete.php?conference_profile_uuid=".$row['conference_profile_uuid']."&id=".$row['conference_profile_param_uuid']."' alt='".$text['button-delete']."' onclick=\"return confirm('".$text['confirm-delete']."')\">$v_link_label_delete</a>";
+				echo "<a href='conference_profile_param_delete.php?conference_profile_uuid=".escape($row['conference_profile_uuid'])."&id=".escape($row['conference_profile_param_uuid'])."' alt='".$text['button-delete']."' onclick=\"return confirm('".$text['confirm-delete']."')\">$v_link_label_delete</a>";
 			}
 			echo "	</td>\n";
 			echo "</tr>\n";

app/conferences/conference_delete.php

@@ -91,7 +91,7 @@ else {
 	}
 
 //redirect the browser
-	messages::add($text['confirm-delete']);
+	message::add($text['confirm-delete']);
 	header("Location: conferences.php");
 	return;
 

app/conferences/conference_edit.php

@@ -80,7 +80,7 @@
 			$sql .= "and user_uuid = '".$user_uuid."' ";
 			$db->exec(check_sql($sql));
 
-		messages::add($text['confirm-delete']);
+		message::add($text['confirm-delete']);
 		header("Location: conference_edit.php?id=".$conference_uuid);
 		return;
 	}
@@ -107,7 +107,7 @@
 			$sql_insert .= ")";
 			$db->exec($sql_insert);
 		//send a message
-			messages::add($text['confirm-add']);
+			message::add($text['confirm-add']);
 			header("Location: conference_edit.php?id=".$conference_uuid);
 			return;
 	}
@@ -217,7 +217,7 @@
 						dialplan_detail_add($_SESSION['domain_uuid'], $dialplan_uuid, $dialplan_detail_tag, $dialplan_detail_order, $dialplan_detail_group, $dialplan_detail_type, $dialplan_detail_data);
 
 					//add the message
-						messages::add($text['confirm-add']);
+						message::add($text['confirm-add']);
 				} //if ($action == "add")
 
 				if ($action == "update") {
@@ -273,7 +273,7 @@
 						$db->query($sql);
 
 					//add the message
-						messages::add($text['confirm-update']);
+						message::add($text['confirm-update']);
 				} //if ($action == "update")
 
 				//update the dialplan xml
@@ -334,6 +334,25 @@
 	$conference_profiles = $prep_statement->fetchAll(PDO::FETCH_NAMED);
 	unset ($prep_statement, $sql);
 
+//get conference users
+	$sql = "SELECT * FROM v_conference_users as e, v_users as u ";
+	$sql .= "where e.user_uuid = u.user_uuid  ";
+	$sql .= "and u.user_enabled = 'true' ";
+	$sql .= "and e.domain_uuid = '".$_SESSION['domain_uuid']."' ";
+	$sql .= "and e.conference_uuid = '".$conference_uuid."' ";
+	$prep_statement = $db->prepare(check_sql($sql));
+	$prep_statement->execute();
+	$conference_users = $prep_statement->fetchAll(PDO::FETCH_ASSOC);
+
+//get the users
+	$sql = "SELECT * FROM v_users ";
+	$sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
+	$sql .= "and user_enabled = 'true' ";
+	$prep_statement = $db->prepare(check_sql($sql));
+	$prep_statement->execute();
+	$users = $prep_statement->fetchAll(PDO::FETCH_NAMED);
+	unset($sql);
+
 //set the default
 	if ($conference_profile == "") { $conference_profile = "default"; }
 
@@ -403,23 +422,14 @@
 	echo "</td>\n";
 	echo "</tr>\n";
 
-	if (if_group("admin") || if_group("superadmin")) {
+	if (permission_exists('conference_user_add') || permission_exists('conference_user_edit')) {
 		if ($action == "update") {
 			echo "	<tr>";
 			echo "		<td class='vncell' valign='top'>".$text['label-user_list']."</td>";
 			echo "		<td class='vtable'>";
 
 			echo "			<table width='52%'>\n";
-			$sql = "SELECT * FROM v_conference_users as e, v_users as u ";
+			foreach($conference_users as $field) {
-			$sql .= "where e.user_uuid = u.user_uuid  ";
-			$sql .= "and u.user_enabled = 'true' ";
-			$sql .= "and e.domain_uuid = '".$_SESSION['domain_uuid']."' ";
-			$sql .= "and e.conference_uuid = '".$conference_uuid."' ";
-			$prep_statement = $db->prepare(check_sql($sql));
-			$prep_statement->execute();
-			$result = $prep_statement->fetchAll(PDO::FETCH_ASSOC);
-			$result_count = count($result);
-			foreach($result as $field) {
 				echo "			<tr>\n";
 				echo "				<td class='vtable'>".escape($field['username'])."</td>\n";
 				echo "				<td>\n";
@@ -428,22 +438,15 @@
 				echo "			</tr>\n";
 			}
 			echo "			</table>\n";
-
 			echo "			<br />\n";
-			$sql = "SELECT * FROM v_users ";
-			$sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
-			$sql .= "and user_enabled = 'true' ";
-			$prep_statement = $db->prepare(check_sql($sql));
-			$prep_statement->execute();
 			echo "			<select name=\"user_uuid\" class='formfld'>\n";
 			echo "			<option value=\"\"></option>\n";
-			$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
+			foreach($users as $field) {
-			foreach($result as $field) {
 				echo "			<option value='".escape($field['user_uuid'])."'>".escape($field['username'])."</option>\n";
 			}
 			echo "			</select>";
 			echo "			<input type=\"submit\" class='btn' value=\"".$text['button-add']."\">\n";
-			unset($sql, $result);
+
 			echo "			<br>\n";
 			echo "			".$text['description-user-add']."\n";
 			echo "			<br />\n";

app/contacts/app_config.php

@@ -196,21 +196,36 @@
 		$apps[$x]['permissions'][$y]['groups'][] = "admin";
 		$y++;
 		$apps[$x]['permissions'][$y]['name'] = "contact_extension_view";
+		//$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
+		//$apps[$x]['permissions'][$y]['groups'][] = "admin";
+		$y++;
+		$apps[$x]['permissions'][$y]['name'] = "contact_time_view";
+		//$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
+		$y++;
+		$apps[$x]['permissions'][$y]['name'] = "contact_time_add";
+		//$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
+		$y++;
+		$apps[$x]['permissions'][$y]['name'] = "contact_time_edit";
+		//$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
+		$y++;
+		$apps[$x]['permissions'][$y]['name'] = "contact_time_delete";
+		//$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
+		$y++;
+		$apps[$x]['permissions'][$y]['name'] = "contact_attachment_view";
 		$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
 		$apps[$x]['permissions'][$y]['groups'][] = "admin";
 		$y++;
-		$apps[$x]['permissions'][$y]['name'] = "contact_time_view";
+		$apps[$x]['permissions'][$y]['name'] = "contact_attachment_add";
 		$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
+		$apps[$x]['permissions'][$y]['groups'][] = "admin";
 		$y++;
-		$apps[$x]['permissions'][$y]['name'] = "contact_time_add";
+		$apps[$x]['permissions'][$y]['name'] = "contact_attachment_edit";
 		$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
+		$apps[$x]['permissions'][$y]['groups'][] = "admin";
 		$y++;
-		$apps[$x]['permissions'][$y]['name'] = "contact_time_edit";
+		$apps[$x]['permissions'][$y]['name'] = "contact_attachment_delete";
 		$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
-		$y++;
+		$apps[$x]['permissions'][$y]['groups'][] = "admin";
-		$apps[$x]['permissions'][$y]['name'] = "contact_time_delete";
-		$apps[$x]['permissions'][$y]['groups'][] = "superadmin";
-		$y++;
 
 	//schema details
 		$y=0;
@@ -628,6 +643,8 @@
 		$apps[$x]['db'][$y]['fields'][$z]['type']['sqlite'] = "text";
 		$apps[$x]['db'][$y]['fields'][$z]['type']['mysql'] = "char(36)";
 		$apps[$x]['db'][$y]['fields'][$z]['key']['type'] = "foreign";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['table'] = "v_domains";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['field'] = "domain_uuid";
 		$z++;
 		$apps[$x]['db'][$y]['fields'][$z]['name'] = "contact_setting_category";
 		$apps[$x]['db'][$y]['fields'][$z]['type'] = "text";
@@ -672,6 +689,8 @@
 		$apps[$x]['db'][$y]['fields'][$z]['type']['sqlite'] = "text";
 		$apps[$x]['db'][$y]['fields'][$z]['type']['mysql'] = "char(36)";
 		$apps[$x]['db'][$y]['fields'][$z]['key']['type'] = "foreign";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['table'] = "v_domains";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['field'] = "domain_uuid";
 		$z++;
 		$apps[$x]['db'][$y]['fields'][$z]['name'] = "contact_uuid";
 		$apps[$x]['db'][$y]['fields'][$z]['type']['pgsql'] = "uuid";
@@ -812,7 +831,7 @@
 		$apps[$x]['db'][$y]['fields'][$z]['type']['sqlite'] = "text";
 		$apps[$x]['db'][$y]['fields'][$z]['type']['mysql'] = "char(36)";
 		$apps[$x]['db'][$y]['fields'][$z]['key']['type'] = "foreign";
-		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['table'] = "v_contact";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['table'] = "v_contacts";
 		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['field'] = "contact_uuid";
 		$z++;
 		$apps[$x]['db'][$y]['fields'][$z]['name'] = "user_uuid";
@@ -835,4 +854,75 @@
 		$apps[$x]['db'][$y]['fields'][$z]['type'] = "text";
 		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "Description";
 
+		$y++;
+		$apps[$x]['db'][$y]['table']['name'] = "v_contact_attachments";
+		$apps[$x]['db'][$y]['table']['parent'] = "v_contacts";
+		$z=0;
+		$apps[$x]['db'][$y]['fields'][$z]['name'] = "contact_attachment_uuid";
+		$apps[$x]['db'][$y]['fields'][$z]['type']['pgsql'] = "uuid";
+		$apps[$x]['db'][$y]['fields'][$z]['type']['sqlite'] = "text";
+		$apps[$x]['db'][$y]['fields'][$z]['type']['mysql'] = "char(36)";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['type'] = "primary";
+		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "";
+		$z++;
+		$apps[$x]['db'][$y]['fields'][$z]['name'] = "domain_uuid";
+		$apps[$x]['db'][$y]['fields'][$z]['type']['pgsql'] = "uuid";
+		$apps[$x]['db'][$y]['fields'][$z]['type']['sqlite'] = "text";
+		$apps[$x]['db'][$y]['fields'][$z]['type']['mysql'] = "char(36)";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['type'] = "foreign";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['table'] = "v_domains";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['field'] = "domain_uuid";
+		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "";
+		$z++;
+		$apps[$x]['db'][$y]['fields'][$z]['name'] = "contact_uuid";
+		$apps[$x]['db'][$y]['fields'][$z]['type']['pgsql'] = "uuid";
+		$apps[$x]['db'][$y]['fields'][$z]['type']['sqlite'] = "text";
+		$apps[$x]['db'][$y]['fields'][$z]['type']['mysql'] = "char(36)";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['type'] = "foreign";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['table'] = "v_contacts";
+		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['field'] = "contact_uuid";
+		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "";
+		$z++;
+		$apps[$x]['db'][$y]['fields'][$z]['name'] = "attachment_primary";
+		$apps[$x]['db'][$y]['fields'][$z]['type'] = "numeric";
+		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "Primary attachments are used as the Contact photo and sent with Messages.";
+		$z++;
+		$apps[$x]['db'][$y]['fields'][$z]['name'] = "attachment_filename";
+		$apps[$x]['db'][$y]['fields'][$z]['type'] = "text";
+		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "The attachment filename.";
+		$z++;
+		$apps[$x]['db'][$y]['fields'][$z]['name'] = "attachment_content";
+		$apps[$x]['db'][$y]['fields'][$z]['type'] = "text";
+		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "The attachment content.";
+		$z++;
+		$apps[$x]['db'][$y]['fields'][$z]['name'] = "attachment_description";
+		$apps[$x]['db'][$y]['fields'][$z]['type'] = "text";
+		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = "Enter the description.";
+		$z++;
+		$apps[$x]['db'][$y]['fields'][$z]['name'] = 'attachment_uploaded_date';
+		$apps[$x]['db'][$y]['fields'][$z]['type']['pgsql'] = 'timestamptz';
+		$apps[$x]['db'][$y]['fields'][$z]['type']['sqlite'] = 'date';
+		$apps[$x]['db'][$y]['fields'][$z]['type']['mysql'] = 'timestamp';
+		$apps[$x]['db'][$y]['fields'][$z]['description']['en-us'] = 'The date the attachment was uploaded.';
+		$z++;
+		$apps[$x]['db'][$y]['fields'][$z]['name'] = 'attachment_uploaded_user_uuid';
+		$apps[$x]['db'][$y]['fields'][$z]['type']['pgsql'] = 'uuid';
+		$apps[$x]['db'][$y]['fields'][$z]['type']['sqlite'] = 'text';
+		$apps[$x]['db'][$y]['fields'][$z]['type']['mysql'] = 'char(36)';
+		$apps[$x]['db'][$y]['fields'][$z]['key']['type'] = 'foreign';
+		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['table'] = 'v_users';
+		$apps[$x]['db'][$y]['fields'][$z]['key']['reference']['field'] = 'user_uuid';
+
+
+	//default settings
+		$y=0;
+		$apps[$x]['default_settings'][$y]['default_setting_uuid'] = "38a67445-577d-483d-a176-09549cfdaa69";
+		$apps[$x]['default_settings'][$y]['default_setting_category'] = "contact";
+		$apps[$x]['default_settings'][$y]['default_setting_subcategory'] = "allowed_attachment_types";
+		$apps[$x]['default_settings'][$y]['default_setting_name'] = "text";
+		$apps[$x]['default_settings'][$y]['default_setting_value'] = '{"jpg":"image\/jpg","jpeg":"image\/jpg","gif":"image\/gif","png":"image\/png","pdf":"application\/pdf","doc":"application\/vnd.ms-word","docx":"application\/vnd.openxmlformats-officedocument.wordprocessingml.document","xls":"application\/vnd.ms-excel","xlsx":"application\/vnd.openxmlformats-officedocument.spreadsheetml.sheet","zip":"application\/zip","rar":"application\/x-rar-compressed","7z":"application\/x-7z-compressed","txt":"text\/plain","pcap":"application\/vnd.tcpdump.pcap"}';
+		$apps[$x]['default_settings'][$y]['default_setting_enabled'] = "true";
+		$apps[$x]['default_settings'][$y]['default_setting_description'] = "Define the allowed file attachment extensions and their mime types in a JSON array.";
+		$y++;
+
 ?>

app/contacts/app_languages.php

@@ -281,6 +281,46 @@ $text['title-contact_addresses-add']['ru-ru'] = "Добавить Адрес д
 $text['title-contact_addresses-add']['sv-se'] = "Lägg Till Kontakt Adress";
 $text['title-contact_addresses-add']['uk-ua'] = "";
 
+$text['title-contact_attachment-edit']['en-us'] = "Contact Attachment Edit";
+$text['title-contact_attachment-edit']['ar-eg'] = "";
+$text['title-contact_attachment-edit']['de-at'] = "";
+$text['title-contact_attachment-edit']['de-ch'] = "";
+$text['title-contact_attachment-edit']['de-de'] = "";
+$text['title-contact_attachment-edit']['es-cl'] = "";
+$text['title-contact_attachment-edit']['es-mx'] = "";
+$text['title-contact_attachment-edit']['fr-ca'] = "";
+$text['title-contact_attachment-edit']['fr-fr'] = "";
+$text['title-contact_attachment-edit']['he-il'] = "";
+$text['title-contact_attachment-edit']['it-it'] = "";
+$text['title-contact_attachment-edit']['nl-nl'] = "";
+$text['title-contact_attachment-edit']['pl-pl'] = "";
+$text['title-contact_attachment-edit']['pt-br'] = "";
+$text['title-contact_attachment-edit']['pt-pt'] = "";
+$text['title-contact_attachment-edit']['ro-ro'] = "";
+$text['title-contact_attachment-edit']['ru-ru'] = "";
+$text['title-contact_attachment-edit']['sv-se'] = "";
+$text['title-contact_attachment-edit']['uk-ua'] = "";
+
+$text['title-contact_attachment-add']['en-us'] = "Contact Attachment Add";
+$text['title-contact_attachment-add']['ar-eg'] = "";
+$text['title-contact_attachment-add']['de-at'] = "";
+$text['title-contact_attachment-add']['de-ch'] = "";
+$text['title-contact_attachment-add']['de-de'] = "";
+$text['title-contact_attachment-add']['es-cl'] = "";
+$text['title-contact_attachment-add']['es-mx'] = "";
+$text['title-contact_attachment-add']['fr-ca'] = "";
+$text['title-contact_attachment-add']['fr-fr'] = "";
+$text['title-contact_attachment-add']['he-il'] = "";
+$text['title-contact_attachment-add']['it-it'] = "";
+$text['title-contact_attachment-add']['nl-nl'] = "";
+$text['title-contact_attachment-add']['pl-pl'] = "";
+$text['title-contact_attachment-add']['pt-br'] = "";
+$text['title-contact_attachment-add']['pt-pt'] = "";
+$text['title-contact_attachment-add']['ro-ro'] = "";
+$text['title-contact_attachment-add']['ru-ru'] = "";
+$text['title-contact_attachment-add']['sv-se'] = "";
+$text['title-contact_attachment-add']['uk-ua'] = "";
+
 $text['title-contact-edit']['en-us'] = "Contact";
 $text['title-contact-edit']['ar-eg'] = "";
 $text['title-contact-edit']['de-at'] = "Kontakt"; //copied from de-de
@@ -3181,6 +3221,106 @@ $text['label-address_address']['ru-ru'] = "Адрес";
 $text['label-address_address']['sv-se'] = "Adress";
 $text['label-address_address']['uk-ua'] = "Адреси";
 
+$text['label-attachments']['en-us'] = "Attachments";
+$text['label-attachments']['ar-eg'] = "";
+$text['label-attachments']['de-at'] = "";
+$text['label-attachments']['de-ch'] = "";
+$text['label-attachments']['de-de'] = "";
+$text['label-attachments']['es-cl'] = "";
+$text['label-attachments']['es-mx'] = "";
+$text['label-attachments']['fr-ca'] = "";
+$text['label-attachments']['fr-fr'] = "";
+$text['label-attachments']['he-il'] = "";
+$text['label-attachments']['it-it'] = "";
+$text['label-attachments']['nl-nl'] = "";
+$text['label-attachments']['pl-pl'] = "";
+$text['label-attachments']['pt-br'] = "";
+$text['label-attachments']['pt-pt'] = "";
+$text['label-attachments']['ro-ro'] = "";
+$text['label-attachments']['ru-ru'] = "";
+$text['label-attachments']['sv-se'] = "";
+$text['label-attachments']['uk-ua'] = "";
+
+$text['label-attachment_filename']['en-us'] = "Filename";
+$text['label-attachment_filename']['ar-eg'] = "";
+$text['label-attachment_filename']['de-at'] = "";
+$text['label-attachment_filename']['de-ch'] = "";
+$text['label-attachment_filename']['de-de'] = "";
+$text['label-attachment_filename']['es-cl'] = "";
+$text['label-attachment_filename']['es-mx'] = "";
+$text['label-attachment_filename']['fr-ca'] = "";
+$text['label-attachment_filename']['fr-fr'] = "";
+$text['label-attachment_filename']['he-il'] = "";
+$text['label-attachment_filename']['it-it'] = "";
+$text['label-attachment_filename']['nl-nl'] = "";
+$text['label-attachment_filename']['pl-pl'] = "";
+$text['label-attachment_filename']['pt-br'] = "";
+$text['label-attachment_filename']['pt-pt'] = "";
+$text['label-attachment_filename']['ro-ro'] = "";
+$text['label-attachment_filename']['ru-ru'] = "";
+$text['label-attachment_filename']['sv-se'] = "";
+$text['label-attachment_filename']['uk-ua'] = "";
+
+$text['label-attachment']['en-us'] = "Attachment";
+$text['label-attachment']['ar-eg'] = "";
+$text['label-attachment']['de-at'] = "";
+$text['label-attachment']['de-ch'] = "";
+$text['label-attachment']['de-de'] = "";
+$text['label-attachment']['es-cl'] = "";
+$text['label-attachment']['es-mx'] = "";
+$text['label-attachment']['fr-ca'] = "";
+$text['label-attachment']['fr-fr'] = "";
+$text['label-attachment']['he-il'] = "";
+$text['label-attachment']['it-it'] = "";
+$text['label-attachment']['nl-nl'] = "";
+$text['label-attachment']['pl-pl'] = "";
+$text['label-attachment']['pt-br'] = "";
+$text['label-attachment']['pt-pt'] = "";
+$text['label-attachment']['ro-ro'] = "";
+$text['label-attachment']['ru-ru'] = "";
+$text['label-attachment']['sv-se'] = "";
+$text['label-attachment']['uk-ua'] = "";
+
+$text['label-attachment_size']['en-us'] = "Size";
+$text['label-attachment_size']['ar-eg'] = "";
+$text['label-attachment_size']['de-at'] = "";
+$text['label-attachment_size']['de-ch'] = "";
+$text['label-attachment_size']['de-de'] = "";
+$text['label-attachment_size']['es-cl'] = "";
+$text['label-attachment_size']['es-mx'] = "";
+$text['label-attachment_size']['fr-ca'] = "";
+$text['label-attachment_size']['fr-fr'] = "";
+$text['label-attachment_size']['he-il'] = "";
+$text['label-attachment_size']['it-it'] = "";
+$text['label-attachment_size']['nl-nl'] = "";
+$text['label-attachment_size']['pl-pl'] = "";
+$text['label-attachment_size']['pt-br'] = "";
+$text['label-attachment_size']['pt-pt'] = "";
+$text['label-attachment_size']['ro-ro'] = "";
+$text['label-attachment_size']['ru-ru'] = "";
+$text['label-attachment_size']['sv-se'] = "";
+$text['label-attachment_size']['uk-ua'] = "";
+
+$text['label-attachment_description']['en-us'] = "Description";
+$text['label-attachment_description']['ar-eg'] = "";
+$text['label-attachment_description']['de-at'] = "";
+$text['label-attachment_description']['de-ch'] = "";
+$text['label-attachment_description']['de-de'] = "";
+$text['label-attachment_description']['es-cl'] = "";
+$text['label-attachment_description']['es-mx'] = "";
+$text['label-attachment_description']['fr-ca'] = "";
+$text['label-attachment_description']['fr-fr'] = "";
+$text['label-attachment_description']['he-il'] = "";
+$text['label-attachment_description']['it-it'] = "";
+$text['label-attachment_description']['nl-nl'] = "";
+$text['label-attachment_description']['pl-pl'] = "";
+$text['label-attachment_description']['pt-br'] = "";
+$text['label-attachment_description']['pt-pt'] = "";
+$text['label-attachment_description']['ro-ro'] = "";
+$text['label-attachment_description']['ru-ru'] = "";
+$text['label-attachment_description']['sv-se'] = "";
+$text['label-attachment_description']['uk-ua'] = "";
+
 $text['header_contact_times']['en-us'] = "Times";
 $text['header_contact_times']['ar-eg'] = "";
 $text['header_contact_times']['de-at'] = "Zeiten"; //copied from de-de
@@ -3581,6 +3721,46 @@ $text['header-contact_addresses-add']['ru-ru'] = "Добавить контак
 $text['header-contact_addresses-add']['sv-se'] = "Lägg Till Kontakt Adress";
 $text['header-contact_addresses-add']['uk-ua'] = "";
 
+$text['header-contact_attachment-edit']['en-us'] = "Contact Attachment Edit";
+$text['header-contact_attachment-edit']['ar-eg'] = "";
+$text['header-contact_attachment-edit']['de-at'] = "";
+$text['header-contact_attachment-edit']['de-ch'] = "";
+$text['header-contact_attachment-edit']['de-de'] = "";
+$text['header-contact_attachment-edit']['es-cl'] = "";
+$text['header-contact_attachment-edit']['es-mx'] = "";
+$text['header-contact_attachment-edit']['fr-ca'] = "";
+$text['header-contact_attachment-edit']['fr-fr'] = "";
+$text['header-contact_attachment-edit']['he-il'] = "";
+$text['header-contact_attachment-edit']['it-it'] = "";
+$text['header-contact_attachment-edit']['nl-nl'] = "";
+$text['header-contact_attachment-edit']['pl-pl'] = "";
+$text['header-contact_attachment-edit']['pt-br'] = "";
+$text['header-contact_attachment-edit']['pt-pt'] = "";
+$text['header-contact_attachment-edit']['ro-ro'] = "";
+$text['header-contact_attachment-edit']['ru-ru'] = "";
+$text['header-contact_attachment-edit']['sv-se'] = "";
+$text['header-contact_attachment-edit']['uk-ua'] = "";
+
+$text['header-contact_attachment-add']['en-us'] = "Contact Attachment Add";
+$text['header-contact_attachment-add']['ar-eg'] = "";
+$text['header-contact_attachment-add']['de-at'] = "";
+$text['header-contact_attachment-add']['de-ch'] = "";
+$text['header-contact_attachment-add']['de-de'] = "";
+$text['header-contact_attachment-add']['es-cl'] = "";
+$text['header-contact_attachment-add']['es-mx'] = "";
+$text['header-contact_attachment-add']['fr-ca'] = "";
+$text['header-contact_attachment-add']['fr-fr'] = "";
+$text['header-contact_attachment-add']['he-il'] = "";
+$text['header-contact_attachment-add']['it-it'] = "";
+$text['header-contact_attachment-add']['nl-nl'] = "";
+$text['header-contact_attachment-add']['pl-pl'] = "";
+$text['header-contact_attachment-add']['pt-br'] = "";
+$text['header-contact_attachment-add']['pt-pt'] = "";
+$text['header-contact_attachment-add']['ro-ro'] = "";
+$text['header-contact_attachment-add']['ru-ru'] = "";
+$text['header-contact_attachment-add']['sv-se'] = "";
+$text['header-contact_attachment-add']['uk-ua'] = "";
+
 $text['header-contact-edit']['en-us'] = "Contact";
 $text['header-contact-edit']['ar-eg'] = "";
 $text['header-contact-edit']['de-at'] = "Kontakt"; //copied from de-de
@@ -5381,4 +5561,24 @@ $text['button-add']['ru-ru'] = "Добавить";
 $text['button-add']['sv-se'] = "Lägg Till";
 $text['button-add']['uk-ua'] = "Додати";
 
-?>
+$text['button-user']['en-us'] = "User";
+$text['button-user']['ar-eg'] = "";
+$text['button-user']['de-at'] = "Benutzer"; //copied from de-de
+$text['button-user']['de-ch'] = "Benutzer"; //copied from de-de
+$text['button-user']['de-de'] = "Benutzer";
+$text['button-user']['es-cl'] = "Usuario";
+$text['button-user']['es-mx'] = "Usuario"; //copied from es-cl
+$text['button-user']['fr-ca'] = "Utilisateurs"; //copied from fr-fr
+$text['button-user']['fr-fr'] = "Utilisateurs";
+$text['button-user']['he-il'] = "";
+$text['button-user']['it-it'] = "Utente";
+$text['button-user']['nl-nl'] = "";
+$text['button-user']['pl-pl'] = "Użytkownik";
+$text['button-user']['pt-br'] = "Usuário";
+$text['button-user']['pt-pt'] = "Utilizador";
+$text['button-user']['ro-ro'] = "";
+$text['button-user']['ru-ru'] = "Пользователь";
+$text['button-user']['sv-se'] = "Användare";
+$text['button-user']['uk-ua'] = "Користувач";
+
+?>

app/contacts/contact_address_delete.php

@@ -55,7 +55,7 @@ else {
 	}
 
 //redirect the browser
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header("Location: contact_edit.php?id=".$contact_uuid);
 	return;
 

app/contacts/contact_address_edit.php

@@ -161,7 +161,7 @@ else {
 					$db->exec(check_sql($sql));
 					unset($sql);
 
-					messages::add($text['message-add']);
+					message::add($text['message-add']);
 					header("Location: contact_edit.php?id=".$contact_uuid);
 					return;
 				} //if ($action == "add")
@@ -187,7 +187,7 @@ else {
 					$db->exec(check_sql($sql));
 					unset($sql);
 
-					messages::add($text['message-update']);
+					message::add($text['message-update']);
 					header("Location: contact_edit.php?id=".$contact_uuid);
 					return;
 				} //if ($action == "update")

app/contacts/contact_attachment.php

@@ -0,0 +1,81 @@
+<?php
+/*
+	FusionPBX
+	Version: MPL 1.1
+
+	The contents of this file are subject to the Mozilla Public License Version
+	1.1 (the "License"); you may not use this file except in compliance with
+	the License. You may obtain a copy of the License at
+	http://www.mozilla.org/MPL/
+
+	Software distributed under the License is distributed on an "AS IS" basis,
+	WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+	for the specific language governing rights and limitations under the
+	License.
+
+	The Original Code is FusionPBX
+
+	The Initial Developer of the Original Code is
+	Mark J Crane <markjcrane@fusionpbx.com>
+	Portions created by the Initial Developer are Copyright (C) 2016-2018
+	the Initial Developer. All Rights Reserved.
+
+	Contributor(s):
+	Mark J Crane <markjcrane@fusionpbx.com>
+*/
+
+//includes
+	require_once "root.php";
+	require_once "resources/require.php";
+
+//add multi-lingual support
+	$language = new text;
+	$text = $language->get();
+
+//get attachment uuid
+	$contact_attachment_uuid = $_GET['id'];
+	$action = $_GET['action'];
+
+//get media
+	if (is_uuid($contact_attachment_uuid)) {
+
+		$sql = "select attachment_filename, attachment_content from v_contact_attachments ";
+		$sql .= "where contact_attachment_uuid = '".$contact_attachment_uuid."' ";
+		$sql .= "and (domain_uuid = '".$domain_uuid."' or domain_uuid is null) ";
+		$prep_statement = $db->prepare(check_sql($sql));
+		$prep_statement->execute();
+		$attachment = $prep_statement->fetch(PDO::FETCH_NAMED);
+		unset ($prep_statement, $sql);
+
+		$attachment_type = strtolower(pathinfo($attachment['attachment_filename'], PATHINFO_EXTENSION));
+
+		//determine mime type
+		$content_type = 'application/octet-stream'; //set default
+		$allowed_attachment_types = json_decode($_SESSION['contacts']['allowed_attachment_types']['text'], true);
+		if (is_array($allowed_attachment_types) && sizeof($allowed_attachment_types) != 0) {
+			if ($allowed_attachment_types[$attachment_type] != '') {
+				$content_type = $allowed_attachment_types[$attachment_type];
+			}
+		}
+
+		switch ($action) {
+			case 'download':
+				header("Content-type: ".$content_type."; charset=utf-8");
+				header("Content-Disposition: attachment; filename=\"".$attachment['attachment_filename']."\"");
+				header("Content-Length: ".strlen(base64_decode($attachment['attachment_content'])));
+				echo base64_decode($attachment['attachment_content']);
+				break;
+			case 'display':
+				echo "	<table cellpadding='0' cellspacing='0' border='0' width='100%' height='100%'>\n";
+				echo "		<tr>\n";
+				echo "			<td align='center' valign='middle'>\n";
+				echo "				<img src=\"data:".$content_type.";base64,".$attachment['attachment_content']."\" style='width: auto; max-width: 95%; height: auto; max-height: 800px; box-shadow: 0px 1px 20px #888; background-color: #fff; cursor: pointer;' onclick=\"$('#contact_attachment_layer').fadeOut(200);\" oncontextmenu=\"window.open('contact_attachment.php?id=".$contact_attachment_uuid."&action=download'); return false;\" title=\"".$text['message-click_close_save']."\">\n";
+				echo "			</td>\n";
+				echo "		</tr>\n";
+				echo "	</table>\n";
+				break;
+		}
+
+	}
+
+?>

app/contacts/contact_attachment_delete.php

@@ -0,0 +1,63 @@
+<?php
+/*
+	FusionPBX
+	Version: MPL 1.1
+
+	The contents of this file are subject to the Mozilla Public License Version
+	1.1 (the "License"); you may not use this file except in compliance with
+	the License. You may obtain a copy of the License at
+	http://www.mozilla.org/MPL/
+
+	Software distributed under the License is distributed on an "AS IS" basis,
+	WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+	for the specific language governing rights and limitations under the
+	License.
+
+	The Original Code is FusionPBX
+
+	The Initial Developer of the Original Code is
+	Mark J Crane <markjcrane@fusionpbx.com>
+	Portions created by the Initial Developer are Copyright (C) 2008-2012
+	the Initial Developer. All Rights Reserved.
+
+	Contributor(s):
+	Mark J Crane <markjcrane@fusionpbx.com>
+*/
+
+//includes
+	require_once "root.php";
+	require_once "resources/require.php";
+	require_once "resources/check_auth.php";
+
+//check permissions
+	if (!permission_exists('contact_attachment_delete')) {
+		echo "access denied"; exit;
+	}
+
+//add multi-lingual support
+	$language = new text;
+	$text = $language->get();
+
+//get the http values and set as variables
+	if (count($_GET) > 0) {
+		$id = check_str($_GET["id"]);
+		$contact_uuid = check_str($_GET["contact_uuid"]);
+	}
+
+//delete the record
+	if (is_uuid($id)) {
+		$sql = "delete from v_contact_attachments ";
+		$sql .= "where domain_uuid = '$domain_uuid' ";
+		$sql .= "and contact_attachment_uuid = :contact_attachment_uuid ";
+		$bind[':contact_attachment_uuid'] = $id;
+		$prep_statement = $db->prepare(check_sql($sql));
+		$prep_statement->execute(is_array($bind) ? $bind : null);
+		unset($sql);
+	}
+
+//redirect the browser
+	message::add($text['message-delete']);
+	header("Location: contact_edit.php?id=".$contact_uuid);
+	return;
+
+?>

app/contacts/contact_attachment_edit.php

@@ -0,0 +1,228 @@
+<?php
+/*
+	FusionPBX
+	Version: MPL 1.1
+
+	The contents of this file are subject to the Mozilla Public License Version
+	1.1 (the "License"); you may not use this file except in compliance with
+	the License. You may obtain a copy of the License at
+	http://www.mozilla.org/MPL/
+
+	Software distributed under the License is distributed on an "AS IS" basis,
+	WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+	for the specific language governing rights and limitations under the
+	License.
+
+	The Original Code is FusionPBX
+
+	The Initial Developer of the Original Code is
+	Mark J Crane <markjcrane@fusionpbx.com>
+	Portions created by the Initial Developer are Copyright (C) 2008-2018
+	the Initial Developer. All Rights Reserved.
+
+	Contributor(s):
+	Mark J Crane <markjcrane@fusionpbx.com>
+	Luis Daniel Lucio Quiroz <dlucio@okay.com.mx>
+*/
+
+//includes
+	require_once "root.php";
+	require_once "resources/require.php";
+	require_once "resources/check_auth.php";
+
+//check permissions
+	if (!permission_exists('contact_attachment_edit') && !permission_exists('contact_attachment_add')) {
+		echo "access denied"; exit;
+	}
+
+//add multi-lingual support
+	$language = new text;
+	$text = $language->get();
+
+//action add or update
+	$contact_attachment_uuid = $_REQUEST['id'];
+	$contact_uuid = $_REQUEST['contact_uuid'];
+
+	if (is_uuid($contact_attachment_uuid) && is_uuid($contact_uuid)) {
+		$action = 'update';
+	}
+	else if (is_uuid($contact_uuid)) {
+		$action = 'add';
+	}
+	else {
+		exit;
+	}
+
+//get http post variables and set them to php variables
+	if (is_array($_POST) && sizeof($_POST) != 0) {
+
+		$attachment = $_FILES['attachment'];
+		$attachment_primary = check_str($_POST['attachment_primary']);
+		$attachment_description = check_str($_POST['attachment_description']);
+
+		if (!is_array($attachment) || sizeof($attachment) == 0) {
+			$attachment_type = strtolower(pathinfo($_POST['attachment_filename'], PATHINFO_EXTENSION));
+		}
+		else {
+			$attachment_type = strtolower(pathinfo($attachment['name'], PATHINFO_EXTENSION));
+		}
+
+		//unflag others as primary
+			if ($attachment_primary && ($attachment_type == 'jpg' || $attachment_type == 'jpeg' || $attachment_type == 'gif' || $attachment_type == 'png')) {
+				$sql = "update v_contact_attachments set attachment_primary = 0 ";
+				$sql .= "where domain_uuid = '".$domain_uuid."' ";
+				$sql .= "and contact_uuid = '".$contact_uuid."' ";
+				$db->exec(check_sql($sql));
+				unset($sql);
+			}
+
+		//format array
+			$allowed_extensions = array_keys(json_decode($_SESSION['contact']['allowed_attachment_types']['text'], true));
+			$array['contact_attachments'][$index]['contact_attachment_uuid'] = $action == 'update' ? $contact_attachment_uuid : uuid();
+			$array['contact_attachments'][$index]['domain_uuid'] = $_SESSION['domain_uuid'];
+			$array['contact_attachments'][$index]['contact_uuid'] = $contact_uuid;
+			$array['contact_attachments'][$index]['attachment_primary'] = $attachment_primary == '1' && ($attachment_type == 'jpg' || $attachment_type == 'jpeg' || $attachment_type == 'gif' || $attachment_type == 'png') ? 1 : 0;
+			if ($attachment['error'] == '0' && in_array(strtolower(pathinfo($attachment['name'], PATHINFO_EXTENSION)), $allowed_extensions)) {
+				$array['contact_attachments'][$index]['attachment_filename'] = $attachment['name'];
+				$array['contact_attachments'][$index]['attachment_content'] = base64_encode(file_get_contents($attachment['tmp_name']));
+			}
+			$array['contact_attachments'][$index]['attachment_description'] = $attachment_description;
+			if ($action == 'add') {
+				$array['contact_attachments'][$index]['attachment_uploaded_date'] = 'now()';
+				$array['contact_attachments'][$index]['attachment_uploaded_user_uuid'] = $_SESSION['user_uuid'];
+			}
+
+		//save data
+			$database = new database;
+			$database->app_name = 'contacts';
+			$database->app_uuid = '04481e0e-a478-c559-adad-52bd4174574c';
+			$database->uuid($contact_attachment_uuid);
+			$database->save($array);
+
+		//redirect
+			message::add($text['message-message_'.($action == 'update' ? 'updated' : 'added')]);
+			header('Location: contact_edit.php?id='.$contact_uuid);
+			exit;
+
+	}
+
+//get form data
+	if (is_array($_GET) && sizeof($_GET) != 0) {
+		$sql = "select * from v_contact_attachments ";
+		$sql .= "where domain_uuid = '$domain_uuid' ";
+		$sql .= "and contact_attachment_uuid = :contact_attachment_uuid ";
+		$bind[':contact_attachment_uuid'] = $contact_attachment_uuid;
+		$prep_statement = $db->prepare(check_sql($sql));
+		$prep_statement->execute(is_array($bind) ? $bind : null);
+		$row = $prep_statement->fetch(PDO::FETCH_NAMED);
+		$attachment_primary = $row["attachment_primary"];
+		$attachment_filename = $row["attachment_filename"];
+		$attachment_content = $row["attachment_content"];
+		$attachment_description = $row["attachment_description"];
+		unset($sql, $bind, $prep_statement, $row);
+	}
+
+//show the header
+	require_once "resources/header.php";
+	if ($action == "update") {
+		$document['title'] = $text['title-contact_attachment-edit'];
+	}
+	else if ($action == "add") {
+		$document['title'] = $text['title-contact_attachment-add'];
+	}
+
+//show the content
+	echo "<form method='post' name='frm' enctype='multipart/form-data' action=''>\n";
+	echo "<input type='hidden' name='contact_uuid' value='".escape($contact_uuid)."'>\n";
+	if ($action == "update") {
+		echo "<input type='hidden' name='contact_attachment_uuid' value='".escape($contact_attachment_uuid)."'>\n";
+	}
+	echo "<table width='100%' border='0' cellpadding='0' cellspacing='0'>\n";
+	echo "<tr>\n";
+	echo "<td align='left' valign='top' nowrap='nowrap'><b>";
+	if ($action == "update") {
+		echo $text['header-contact_attachment-edit'];
+	}
+	else if ($action == "add") {
+		echo $text['header-contact_attachment-add'];
+	}
+	echo "</b></td>\n";
+	echo "<td align='right' valign='top'>";
+	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='contact_edit.php?id=$contact_uuid'\" value='".$text['button-back']."'>";
+	echo "	<input type='submit' name='submit' class='btn' value='".$text['button-save']."'>\n";
+	echo "</td>\n";
+	echo "</tr>\n";
+	echo "</table>\n";
+	echo "<br>\n";
+
+	echo "<table width='100%'  border='0' cellpadding='0' cellspacing='0'>\n";
+
+	echo "<tr>\n";
+	echo "<td class='vncell' valign='top' align='left' nowrap='nowrap'>\n";
+	echo "	".$text['label-attachment']."\n";
+	echo "</td>\n";
+	echo "<td class='vtable' align='left'>\n";
+	$attachment_type = strtolower(pathinfo($attachment_filename, PATHINFO_EXTENSION));
+	if ($action == 'update') {
+		echo "<input type='hidden' name='attachment_filename' value=\"".escape($attachment_filename)."\">\n";
+		if ($attachment_type == 'jpg' || $attachment_type == 'jpeg' || $attachment_type == 'gif' || $attachment_type == 'png') {
+			echo "<img src='data:image/".$attachment_type.";base64,".$attachment_content."' style='border: none; width: auto; max-height: 400px;' oncontextmenu=\"window.open('contact_attachment.php?id=".$contact_attachment_uuid."&action=download'); return false;\">";
+		}
+		else {
+			echo "<a href='contact_attachment.php?id=".$contact_attachment_uuid."&action=download' style='font-size: 120%;'>".$attachment_filename."</a>";
+		}
+	}
+	else {
+		$allowed_attachment_types = json_decode($_SESSION['contact']['allowed_attachment_types']['text'], true);
+		echo "	<input type='file' class='formfld' name='attachment' id='attachment' accept='.".implode(',.',array_keys($allowed_attachment_types))."'>\n";
+		echo "	<span style='display: inline-block; margin-top: 5px; font-size: 80%;'>".strtoupper(implode(', ', array_keys($allowed_attachment_types)))."</span>";
+	}
+	echo "</td>\n";
+	echo "</tr>\n";
+
+	if ($action == 'update' && ($attachment_type == 'jpg' || $attachment_type == 'jpeg' || $attachment_type == 'gif' || $attachment_type == 'png')) {
+		echo "<tr>\n";
+		echo "<td class='vncell' valign='top' align='left' nowrap='nowrap'>\n";
+		echo "	".$text['label-attachment_filename']."\n";
+		echo "</td>\n";
+		echo "<td class='vtable' align='left'>\n";
+		echo "	<a href='contact_attachment.php?id=".$contact_attachment_uuid."&action=download' style='font-size: 120%;'>".$attachment_filename."</a>";
+		echo "</td>\n";
+		echo "</tr>\n";
+	}
+
+	echo "<tr>\n";
+	echo "<td class='vncell' valign='top' align='left' nowrap='nowrap'>\n";
+	echo "	".$text['label-primary']."\n";
+	echo "</td>\n";
+	echo "<td class='vtable' align='left'>\n";
+	echo "	<select class='formfld' name='attachment_primary' id='attachment_primary'>\n";
+	echo "		<option value='0'>".$text['option-false']."</option>\n";
+	echo "		<option value='1' ".(($attachment_primary) ? "selected" : null).">".$text['option-true']."</option>\n";
+	echo "	</select>\n";
+	echo "</td>\n";
+	echo "</tr>\n";
+
+	echo "<tr>\n";
+	echo "<td class='vncell' valign='top' align='left' nowrap='nowrap'>\n";
+	echo "	".$text['label-attachment_description']."\n";
+	echo "</td>\n";
+	echo "<td class='vtable' align='left'>\n";
+	echo "	<input class='formfld' type='text' name='attachment_description' maxlength='255' value=\"".escape($attachment_description)."\">\n";
+	echo "</td>\n";
+	echo "</tr>\n";
+
+	echo "	<tr>\n";
+	echo "		<td colspan='2' align='right'>\n";
+	echo "			<br>\n";
+	echo "			<input type='submit' class='btn' value='".$text['button-save']."'>\n";
+	echo "		</td>\n";
+	echo "	</tr>";
+	echo "</table>";
+	echo "<br><br>";
+	echo "</form>";
+
+//include the footer
+	require_once "resources/footer.php";
+
+?>

app/contacts/contact_attachments.php

@@ -0,0 +1,129 @@
+<?php
+/*
+	FusionPBX
+	Version: MPL 1.1
+
+	The contents of this file are subject to the Mozilla Public License Version
+	1.1 (the "License"); you may not use this file except in compliance with
+	the License. You may obtain a copy of the License at
+	http://www.mozilla.org/MPL/
+
+	Software distributed under the License is distributed on an "AS IS" basis,
+	WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+	for the specific language governing rights and limitations under the
+	License.
+
+	The Original Code is FusionPBX
+
+	The Initial Developer of the Original Code is
+	Mark J Crane <markjcrane@fusionpbx.com>
+	Portions created by the Initial Developer are Copyright (C) 2008-2018
+	the Initial Developer. All Rights Reserved.
+
+	Contributor(s):
+	Mark J Crane <markjcrane@fusionpbx.com>
+*/
+
+//includes
+	require_once "root.php";
+	require_once "resources/require.php";
+	require_once "resources/check_auth.php";
+
+//check permissions
+	if (!permission_exists('contact_attachment_view')) {
+		echo "access denied"; exit;
+	}
+
+//get the contact attachment list
+	$sql = "select *, length(decode(attachment_content,'base64')) as attachment_size from v_contact_attachments ";
+	$sql .= "where domain_uuid = '$domain_uuid' ";
+	$sql .= "and contact_uuid = '$contact_uuid' ";
+	$sql .= "order by attachment_primary desc, attachment_filename asc ";
+	$prep_statement = $db->prepare(check_sql($sql));
+	$prep_statement->execute();
+	$contact_attachments = $prep_statement->fetchAll(PDO::FETCH_NAMED);
+	unset ($prep_statement, $sql);
+
+//set the row style
+	$c = 0;
+	$row_style["0"] = "row_style0";
+	$row_style["1"] = "row_style1";
+
+//styles
+	echo "<style>\n";
+
+	echo "	#contact_attachment_layer {\n";
+	echo "		z-index: 999999;\n";
+	echo "		position: absolute;\n";
+	echo "		left: 0px;\n";
+	echo "		top: 0px;\n";
+	echo "		right: 0px;\n";
+	echo "		bottom: 0px;\n";
+	echo "		text-align: center;\n";
+	echo "		vertical-align: middle;\n";
+	echo "	}\n";
+
+	echo "</style>\n";
+
+//ticket attachment layer
+	echo "<div id='contact_attachment_layer' style='display: none;'></div>\n";
+
+//show the content
+	echo "<b>".$text['label-attachments']."</b>\n";
+
+	echo "<table class='tr_hover' style='margin-bottom: 20px;' width='100%' border='0' cellpadding='0' cellspacing='0'>\n";
+	echo "<tr>\n";
+	echo "<th>".$text['label-attachment_filename']."</th>\n";
+	echo "<th>".$text['label-attachment_size']."</th>\n";
+	echo "<th>".$text['label-attachment_description']."</th>\n";
+	echo "<td class='list_control_icons'>";
+	if (permission_exists('contact_attachment_add')) {
+		echo "<a href='contact_attachment_edit.php?contact_uuid=".escape($_GET['id'])."' alt='".$text['button-add']."'>$v_link_label_add</a>";
+	}
+	echo "</td>\n";
+	echo "</tr>\n";
+	if (is_array($contact_attachments)) {
+		foreach($contact_attachments as $row) {
+			if (permission_exists('contact_attachment_edit')) {
+				$tr_link = "href='contact_attachment_edit.php?contact_uuid=".escape($row['contact_uuid'])."&id=".escape($row['contact_attachment_uuid'])."'";
+			}
+			echo "<tr ".$tr_link." ".((escape($row['attachment_primary'])) ? "style='font-weight: bold;'" : null).">\n";
+			$attachment_type = strtolower(pathinfo($row['attachment_filename'], PATHINFO_EXTENSION));
+			if ($attachment_type == 'jpg' || $attachment_type == 'jpeg' || $attachment_type == 'gif' || $attachment_type == 'png') {
+				echo "	<td valign='top' class='".$row_style[$c]." tr_link_void' style='cursor: pointer;' onclick=\"display_attachment('".escape($row['contact_attachment_uuid'])."');\">";
+			}
+			else {
+				echo "	<td valign='top' class='".$row_style[$c]." tr_link_void' style='cursor: pointer;' onclick=\"window.location='contact_attachment.php?id=".escape($row['contact_attachment_uuid'])."&action=download';\">";
+			}
+			echo "		<a>".escape($row['attachment_filename'])."</a>\n";
+			echo "	</td>\n";
+			echo "	<td valign='top' class='".$row_style[$c]."'>".strtoupper(byte_convert($row['attachment_size']))."</td>\n";
+			echo "	<td valign='top' class='row_stylebg'>".escape($row['attachment_description'])."</td>\n";
+			echo "	<td class='list_control_icons'>";
+			if (permission_exists('contact_attachment_edit')) {
+				echo "<a href='contact_attachment_edit.php?contact_uuid=".escape($row['contact_uuid'])."&id=".escape($row['contact_attachment_uuid'])."' alt='".$text['button-edit']."'>$v_link_label_edit</a>";
+			}
+			if (permission_exists('contact_attachment_delete')) {
+				echo "<a href='contact_attachment_delete.php?contact_uuid=".escape($row['contact_uuid'])."&id=".escape($row['contact_attachment_uuid'])."' alt='".$text['button-delete']."' onclick=\"return confirm('".$text['confirm-delete']."')\">$v_link_label_delete</a>";
+			}
+			echo "	</td>\n";
+			echo "</tr>\n";
+			$c = $c ?: 1;
+		}
+		unset($sql, $contact_attachments);
+	}
+
+	echo "</table>";
+
+//javascript
+	echo "<script>\n";
+
+	echo "	function display_attachment(id) {\n";
+	echo "		$('#contact_attachment_layer').load('contact_attachment.php?id=' + id + '&action=display', function(){\n";
+	echo "			$('#contact_attachment_layer').fadeIn(200);\n";
+	echo "		});\n";
+	echo "	}\n";
+
+	echo "</script>\n";
+
+?>

app/contacts/contact_auth.php

@@ -52,7 +52,7 @@ $_SESSION['contact_auth']['target'] = ($_SESSION['contact_auth']['target'] == ''
 if ($_SESSION['contact_auth']['source'] == 'google') {
 
 	if ($_REQUEST['error']) {
-		messages::add(($text['message-'.$_REQUEST['error']] != '') ? $text['message-'.$_REQUEST['error']] : $_REQUEST['error'], 'negative');
+		message::add(($text['message-'.$_REQUEST['error']] != '') ? $text['message-'.$_REQUEST['error']] : $_REQUEST['error'], 'negative');
 		header("Location: ".$_SESSION['contact_auth']['referer']);
 		unset($_SESSION['contact_auth']);
 		exit;
@@ -60,7 +60,7 @@ if ($_SESSION['contact_auth']['source'] == 'google') {
 
 	if (isset($_REQUEST['signout'])) {
 		unset($_SESSION['contact_auth']['token']);
-		messages::add($text['message-google_signed_out']);
+		message::add($text['message-google_signed_out']);
 		header("Location: https://www.google.com/accounts/Logout?continue=https://appengine.google.com/_ah/logout?continue=".(($_SERVER["HTTPS"] == "on") ? "https" : "http")."://".$_SERVER['HTTP_HOST'].PROJECT_PATH."/app/contacts/".$_SESSION['contact_auth']['referer']);
 		exit;
 	}
@@ -110,7 +110,7 @@ if ($_SESSION['contact_auth']['source'] == 'google') {
 
 }
 else {
-	messages::add($text['message-access_denied'], 'negative');
+	message::add($text['message-access_denied'], 'negative');
 	header("Location: ".$_SESSION['contact_auth']['referer']);
 	unset($_SESSION['contact_auth']);
 	exit;

app/contacts/contact_delete.php

@@ -45,11 +45,11 @@ if (!$included) {
 	}
 }
 
-if (strlen($contact_uuid) > 0) {
+if (is_uuid($contact_uuid)) {
 	//delete addresses
 		$sql = "delete from v_contact_addresses ";
 		$sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
-		$sql .= "and contact_uuid = '".$contact_uuid."' ";
+		$sql .= "and contact_uuid = :contact_uuid ";
 		$prep_statement = $db->prepare(check_sql($sql));
 		$prep_statement->execute();
 		unset($prep_statement, $sql);
@@ -106,6 +106,14 @@ if (strlen($contact_uuid) > 0) {
 		$prep_statement->execute();
 		unset($prep_statement, $sql);
 
+	//delete attachments
+		$sql = "delete from v_contact_attachments ";
+		$sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
+		$sql .= "and contact_uuid = '".$contact_uuid."' ";
+		$prep_statement = $db->prepare(check_sql($sql));
+		$prep_statement->execute();
+		unset($prep_statement, $sql);
+
 	//delete contact users
 		$sql = "delete from v_contact_users ";
 		$sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
@@ -132,7 +140,7 @@ if (strlen($contact_uuid) > 0) {
 }
 
 if (!$included) {
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header("Location: contacts.php");
 	return;
 }

app/contacts/contact_edit.php

@@ -17,22 +17,26 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2018
+	Portions created by the Initial Developer are Copyright (C) 2008-2019
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
 	Mark J Crane <markjcrane@fusionpbx.com>
 */
-require_once "root.php";
+
-require_once "resources/require.php";
+//includes
-require_once "resources/check_auth.php";
+	require_once "root.php";
-if (permission_exists('contact_view')) {
+	require_once "resources/require.php";
-	//access granted
+	require_once "resources/check_auth.php";
-}
+
-else {
+//check permissions
-	echo "access denied";
+	if (permission_exists('contact_view')) {
-	exit;
+		//access granted
-}
+	}
+	else {
+		echo "access denied";
+		exit;
+	}
 
 //add multi-lingual support
 	$language = new text;
@@ -150,7 +154,7 @@ else {
 						$db->exec(check_sql($sql));
 						unset($sql);
 
-						messages::add($text['message-add']);
+						message::add($text['message-add']);
 						$location = "contact_edit.php?id=".$contact_uuid;
 					} //if ($action == "add")
 
@@ -177,7 +181,7 @@ else {
 						$db->exec(check_sql($sql));
 						unset($sql);
 
-						messages::add($text['message-update']);
+						message::add($text['message-update']);
 						$location = "contact_edit.php?id=".escape($contact_uuid);
 					} //if ($action == "update")
 
@@ -281,6 +285,16 @@ else {
 	$users = $prep_statement->fetchAll(PDO::FETCH_NAMED);
 	unset($prep_statement, $sql);
 
+//determine if contact assigned to a user
+	if (is_array($users) && sizeof($users) != 0) {
+		foreach($users as $user) {
+			if ($user['contact_uuid'] == $contact_uuid) {
+				$contact_user_uuid = $user['user_uuid'];
+				break;
+			}
+		}
+	}
+
 //get the users assigned to this contact
 	$sql = "SELECT u.username, u.user_uuid, a.contact_user_uuid FROM v_contacts as c, v_users as u, v_contact_users as a ";
 	$sql .= "where c.contact_uuid = '".$contact_uuid."' ";
@@ -303,8 +317,8 @@ else {
 	}
 
 //set the mode
-	if (isset($_SESSION['theme']['qr_image'])) {
+	if (isset($_SESSION['theme']['qr_image']['text'])) {
-		if (strlen($_SESSION['theme']['qr_image']) > 0) {
+		if (strlen($_SESSION['theme']['qr_image']['text']) == 0) {
 			$mode = '4';
 		}
 		else {
@@ -407,11 +421,14 @@ else {
 		echo "	<input type='button' class='btn' name='' alt='".$text['button-vcard']."' onclick=\"window.location='contacts_vcard.php?id=".escape($contact_uuid)."&type=download'\" value='".$text['button-vcard']."'>\n";
 	}
 	if ($action == "update" && is_dir($_SERVER["DOCUMENT_ROOT"].PROJECT_PATH.'/app/invoices')) {
-		echo "	<input type='button' class='btn' name='' alt='".$text['button-invoices']."' onclick=\"window.location='".PROJECT_PATH."/app/invoices/invoices.php?id=escape($contact_uuid)'\" value='".$text['button-invoices']."'>\n";
+		echo "	<input type='button' class='btn' name='' alt='".$text['button-invoices']."' onclick=\"window.location='".PROJECT_PATH."/app/invoices/invoices.php?id=".escape($contact_uuid)."'\" value='".$text['button-invoices']."'>\n";
 	}
 	if ($action == "update" && is_dir($_SERVER["DOCUMENT_ROOT"].PROJECT_PATH.'/app/certificates')) {
 		echo "	<input type='button' class='btn' name='' alt='".$text['button-certificate']."' onclick=\"window.location='".PROJECT_PATH."/app/certificates/index.php?name=".urlencode(escape($contact_name_given)." ".escape($contact_name_family))."'\" value='".$text['button-certificate']."'>\n";
 	}
+	if ($action == "update" && permission_exists('user_edit') && is_uuid($contact_user_uuid)) {
+		echo "	<input type='button' class='btn' name='' alt='".$text['button-user']."' onclick=\"window.location='".PROJECT_PATH."/core/users/user_edit.php?id=".$contact_user_uuid."'\" value='".$text['button-user']."'>\n";
+	}
 	echo "	<input type='submit' name='submit' class='btn' value='".$text['button-save']."'>\n";
 	echo "</td>\n";
 	echo "</tr>\n";
@@ -656,12 +673,8 @@ else {
 			echo "		</td>";
 			echo "	</tr>";
 		}
-		echo "</table>";
 
 		if (permission_exists('contact_group_view')) {
-			$contact_shared = 'true';
-			echo "<div id='div_groups' ".(($contact_shared != 'true') ? "style='display: none;'" : null).">\n";
-			echo "<table border='0' cellpadding='0' cellspacing='0' width='100%'>\n";
 			echo "<tr>";
 			echo "	<td width='30%' class='vncell' valign='top'>".$text['label-groups']."</td>";
 			echo "	<td width='70%' class='vtable'>";
@@ -735,11 +748,8 @@ else {
 
 			echo "	</td>";
 			echo "</tr>";
-			echo "</table>\n";
-			echo "</div>";
 		}
 
-		echo "<table border='0' cellpadding='0' cellspacing='0' width='100%'>\n";
 		echo "<tr>\n";
 		echo "<td width='30%' class='vncell' valign='top' align='left' nowrap='nowrap'>\n";
 		echo "	".$text['label-contact_note']."\n";
@@ -759,13 +769,14 @@ else {
 		echo "			<input type='submit' name='submit' class='btn' value='".$text['button-save']."'>\n";
 		echo "		</td>\n";
 		echo "	</tr>";
+
 		echo "</table>";
 
 	echo "</td>\n";
 
 	if ($action == "update") {
 		echo "<td>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>";
-		echo "<td width='60%' class='' valign='top' align='center'>\n";
+		echo "<td width='60%' valign='top'>\n";
 		//echo "	<img src='contacts_vcard.php?id=$contact_uuid&type=image' width='90%'><br /><br />\n";
 		if (permission_exists('contact_phone_view')) { require "contact_phones.php"; }
 		if (permission_exists('contact_address_view')) { require "contact_addresses.php"; }
@@ -776,6 +787,7 @@ else {
 		if (permission_exists('contact_note_view')) { require "contact_notes.php"; }
 		if (permission_exists('contact_time_view')) { require "contact_times.php"; }
 		if (permission_exists('contact_setting_view')) { require "contact_settings.php"; }
+		if (permission_exists('contact_attachment_view')) { require "contact_attachments.php"; }
 		echo "</td>\n";
 	}
 

app/contacts/contact_email_delete.php

@@ -52,7 +52,7 @@ if (strlen($id)>0) {
 	unset($sql);
 }
 
-messages::add($text['message-delete']);
+message::add($text['message-delete']);
 header("Location: contact_edit.php?id=".$contact_uuid);
 return;
 

app/contacts/contact_email_edit.php

@@ -133,7 +133,7 @@ if (strlen($_GET["contact_uuid"]) > 0) {
 					$db->exec(check_sql($sql));
 					unset($sql);
 
-					messages::add($text['message-add']);
+					message::add($text['message-add']);
 					header("Location: contact_edit.php?id=".$contact_uuid);
 					return;
 				} //if ($action == "add")
@@ -150,7 +150,7 @@ if (strlen($_GET["contact_uuid"]) > 0) {
 					$db->exec(check_sql($sql));
 					unset($sql);
 
-					messages::add($text['message-update']);
+					message::add($text['message-update']);
 					header("Location: contact_edit.php?id=".$contact_uuid);
 					return;
 				} //if ($action == "update")

app/contacts/contact_group_delete.php

@@ -57,7 +57,7 @@ else {
 
 //redirect the browser
 	if (!$included) {
-		messages::add($text['message-delete']);
+		message::add($text['message-delete']);
 		header("Location: contact_edit.php?id=".$contact_uuid);
 		return;
 	}

app/contacts/contact_import.php

@@ -61,6 +61,7 @@
 	$action = check_str($_POST["action"]);
 	$order_by = check_str($_POST["order_by"]);
 	$order = check_str($_POST["order"]);
+	$from_row = check_str($_POST["from_row"]);
 	$delimiter = check_str($_POST["data_delimiter"]);
 	$enclosure = check_str($_POST["data_enclosure"]);
 
@@ -128,6 +129,13 @@
 					$i++;
 				}
 			}
+			$schema[$i]['table'] = 'contact_groups';
+			$schema[$i]['parent'] = 'contacts';
+			$schema[$i]['fields'][] = 'group_name';
+			$i++;
+			$schema[$i]['table'] = 'contact_users';
+			$schema[$i]['parent'] = 'contacts';
+			$schema[$i]['fields'][] = 'username';
 	}
 
 //match the column names to the field names
@@ -176,8 +184,12 @@
 				foreach($schema as $row) {
 					echo "			<optgroup label='".$row['table']."'>\n";
 					foreach($row['fields'] as $field) {
+						$selected = '';
+						if ($field == $line_field) {
+							$selected = "selected='selected'";
+						}
 						if (substr($field, -5) != '_uuid') {
-							echo "    			<option value='".$row['table'].".$field'>$field</option>\n";
+							echo "    			<option value='".$row['table'].".$field' $selected>$field</option>\n";
 						}
 					}
 					echo "			</optgroup>\n";
@@ -193,6 +205,7 @@
 			echo "		<tr>\n";
 			echo "			<td colspan='2' valign='top' align='right' nowrap='nowrap'>\n";
 			echo "				<input name='action' type='hidden' value='import'>\n";
+			echo "				<input name='from_row' type='hidden' value='$from_row'>\n";
 			echo "				<input name='data_delimiter' type='hidden' value='$delimiter'>\n";
 			echo "				<input name='data_enclosure' type='hidden' value='$enclosure'>\n";
 			echo "				<input type='submit' class='btn' id='import' value=\"".$text['button-import']."\">\n";
@@ -237,72 +250,112 @@
 		//set the domain_uuid
 			$domain_uuid = $_SESSION['domain_uuid'];
 
+		//get the groups
+			$sql = "select * from v_groups where domain_uuid is null ";
+			$prep_statement = $db->prepare($sql);
+			$prep_statement->execute();
+			$groups = $prep_statement->fetchAll(PDO::FETCH_ASSOC);
+
+		//get the users
+			$sql = "select * from v_users where domain_uuid = '".$domain_uuid."' ";
+			$prep_statement = $db->prepare($sql);
+			$prep_statement->execute();
+			$users = $prep_statement->fetchAll(PDO::FETCH_ASSOC);
+
+
 		//get the contents of the csv file and convert them into an array
 			$handle = @fopen($_SESSION['file'], "r");
 			if ($handle) {
-				//set the row id
+				//pre-set the numbers
+					$row_number = 1;
 					$row_id = 0;
-				
+
 				//loop through the array
 					while (($line = fgets($handle, 4096)) !== false) {
-
+						if ($from_row <= $row_number) {
-						//format the data
+							//format the data
-							$y = 0;
+								$y = 0;
-							foreach ($fields as $key => $value) {
+								foreach ($fields as $key => $value) {
-								//get the line
+									//get the line
-								$result = str_getcsv($line, $delimiter, $enclosure);
+									$result = str_getcsv($line, $delimiter, $enclosure);
-								
-								//get the table and field name
-								$field_array = explode(".",$value);
-								$table_name = $field_array[0];
-								$field_name = $field_array[1];
-								//echo "value: $value<br />\n";
-								//echo "table_name: $table_name<br />\n";
-								//echo "field_name: $field_name<br />\n";
-								
-								//get the parent table name
-								$parent = get_parent($schema, $table_name);
-
-								//remove formatting from the phone number
-								if ($field_name == "phone_number") {
-									$result[$key] = preg_replace('{\D}', '', $result[$key]);
-								}
-
-								//build the data array
-								if (strlen($table_name) > 0) {
-									if (strlen($parent) == 0) {
-										$array[$table_name][$row_id]['domain_uuid'] = $domain_uuid;
-										$array[$table_name][$row_id][$field_name] = $result[$key];
-									}
-									else {
-										$array[$parent][$row_id][$table_name][$y]['domain_uuid'] = $domain_uuid;
-										$array[$parent][$row_id][$table_name][$y][$field_name] = $result[$key];
-									}
-								}
-							}
-
-						//process a chunk of the array
-							if ($row_id === 1000) {
-
-								//save to the data
-									$database = new database;
-									$database->app_name = 'contacts';
-									$database->app_uuid = '04481e0e-a478-c559-adad-52bd4174574c';
-									$database->save($array);
-									//$message = $database->message;
-
-								//clear the array
-									unset($array);
 									
-								//set the row id back to 0
+									//get the table and field name
-									$row_id = 0;
+									$field_array = explode(".",$value);
-							}
+									$table_name = $field_array[0];
-
+									$field_name = $field_array[1];
-						//increment row id
+									//echo "value: $value<br />\n";
-							$row_id++;
+									//echo "table_name: $table_name<br />\n";
+									//echo "field_name: $field_name<br />\n";
+									
+									//get the parent table name
+									$parent = get_parent($schema, $table_name);
+	
+									//remove formatting from the phone number
+								//	if ($field_name == "phone_number") {
+								//		$result[$key] = preg_replace('{\D}', '', $result[$key]);
+								//	}
+	
+									//build the data array
+									if (strlen($table_name) > 0) {
+										if (strlen($parent) == 0) {
+											$array[$table_name][$row_id]['domain_uuid'] = $domain_uuid;
+											$array[$table_name][$row_id][$field_name] = $result[$key];
+										}
+										else {
+											if ($field_name != "username" && $field_name != "group_name") {
+												$array[$parent][$row_id][$table_name][$y]['domain_uuid'] = $domain_uuid;
+												$array[$parent][$row_id][$table_name][$y][$field_name] = $result[$key];
+											}
+										}
+	
+										if ($field_name == "group_name") {
+												foreach ($groups as $field) {
+													if ($field['group_name'] == $result[$key]) {
+														//$array[$parent][$row_id]['contact_group_uuid'] = uuid();
+														$array[$parent][$row_id]['contact_groups'][$y]['domain_uuid'] = $domain_uuid;
+														//$array['contact_groups'][$x]['contact_uuid'] = $row['contact_uuid'];
+														$array[$parent][$row_id]['contact_groups'][$y]['group_uuid'] = $field['group_uuid'];
+													}
+												}
+										}
+	
+										if ($field_name == "username") {
+												foreach ($users as $field) {
+													if ($field['username'] == $result[$key]) {
+														//$array[$parent][$row_id]['contact_users'][$y]['contact_group_uuid'] = uuid();
+														$array[$parent][$row_id]['contact_users'][$y]['domain_uuid'] = $domain_uuid;
+														//$array['contact_groups'][$x]['contact_uuid'] = $row['contact_uuid'];
+														$array[$parent][$row_id]['contact_users'][$y]['user_uuid'] = $field['user_uuid'];
+													}
+												}
+										}
+									} //if (strlen($table_name) > 0)
+								} //end foreach
+	
+							//process a chunk of the array
+								if ($row_id === 1000) {
+	
+									//save to the data
+										$database = new database;
+										$database->app_name = 'contacts';
+										$database->app_uuid = '04481e0e-a478-c559-adad-52bd4174574c';
+										$database->save($array);
+										//$message = $database->message;
+	
+									//clear the array
+										unset($array);
+										
+									//set the row id back to 0
+										$row_id = 0;
+								}
+	
+							//increment row id
+								$row_id++;
+						} //if ($from_row <= $row_number)
+						$row_number++;
 					}
 					fclose($handle);
-				
+	
 				//debug info
 					//echo "<pre>\n";
 					//print_r($array);
@@ -351,16 +404,16 @@
 				foreach($results as $row) {
 					echo "<tr>\n";
 					echo "	<td class='vncell' valign='top' align='left'>\n";
-					echo 		$row['FirstName'] ." ".$row['LastName'];
+					echo 		escape($row['FirstName'])." ".escape($row['LastName']);
 					echo "	</td>\n";
 					echo "	<td class='vncell' valign='top' align='left'>\n";
-					echo 	$row['Company']."&nbsp;\n";
+					echo 	escape($row['Company'])."&nbsp;\n";
 					echo "	</td>\n";
 					echo "	<td class='vncell' valign='top' align='left'>\n";
-					echo 		$row['EmailAddress']."&nbsp;\n";
+					echo 		escape($row['EmailAddress'])."&nbsp;\n";
 					echo "	</td>\n";
 					echo "	<td class='vncell' valign='top' align='left'>\n";
-					echo 		$row['Web Page']."&nbsp;\n";
+					echo 		escape($row['Web Page'])."&nbsp;\n";
 					echo "	</td>\n";
 					echo "</tr>\n";
 				}
@@ -407,6 +460,24 @@
 	echo "</td>\n";
 	echo "</tr>\n";
 
+	echo "<tr>\n";
+	echo "<td class='vncell' valign='top' align='left' nowrap='nowrap'>\n";
+	echo "    ".$text['label-from_row']."\n";
+	echo "</td>\n";
+	echo "<td class='vtable' align='left'>\n";
+	echo "		<select class='formfld' name='from_row'>\n";
+	$i=1;
+	while($i<=99) {
+		$selected = ($i == $from_row) ? "selected" : null;
+		echo "			<option value='$i' ".$selected.">$i</option>\n";
+		$i++;
+	}
+	echo "		</select>\n";
+	echo "<br />\n";
+	echo $text['description-from_row']."\n";
+	echo "</td>\n";
+	echo "</tr>\n";
+
 	echo "<tr>\n";
 	echo "<td class='vncell' valign='top' align='left' nowrap='nowrap'>\n";
 	echo "    ".$text['label-import_delimiter']."\n";

app/contacts/contact_import_google.php

@@ -333,7 +333,7 @@ if ($_POST['a'] == 'import') {
 	else {
 
 		// no contacts imported
-		messages::add($text['message-contacts_imported']." ".$contacts_imported, 'negative');
+		message::add($text['message-contacts_imported']." ".$contacts_imported, 'negative');
 
 	}
 }

app/contacts/contact_note_delete.php

@@ -52,7 +52,7 @@ if (strlen($id)>0) {
 	unset($sql);
 }
 
-messages::add($text['message-delete']);
+message::add($text['message-delete']);
 header("Location: contact_edit.php?id=".$contact_uuid);
 return;
 

app/contacts/contact_note_edit.php

@@ -117,7 +117,7 @@ else {
 						$db->exec(check_sql($sql));
 						unset($sql);
 
-						messages::add($text['message-add']);
+						message::add($text['message-add']);
 						header("Location: contact_edit.php?id=".$contact_uuid);
 						return;
 					} //if ($action == "add")
@@ -134,7 +134,7 @@ else {
 						$db->exec(check_sql($sql));
 						unset($sql);
 
-						messages::add($text['message-update']);
+						message::add($text['message-update']);
 						header("Location: contact_edit.php?id=".$contact_uuid);
 						return;
 					} //if ($action == "update")

app/contacts/contact_notes.php

@@ -46,23 +46,24 @@
 	echo "</tr>\n";
 	echo "</table>\n";
 
-	//get the contact list
+//get the contact list
-		$sql = "select * from v_contact_notes ";
+	$sql = "select * from v_contact_notes ";
-		$sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
+	$sql .= "where domain_uuid = '".$_SESSION['domain_uuid']."' ";
-		$sql .= "and contact_uuid = '$contact_uuid' ";
+	$sql .= "and contact_uuid = '$contact_uuid' ";
-		$sql .= "order by last_mod_date desc ";
+	$sql .= "order by last_mod_date desc ";
-		$prep_statement = $db->prepare(check_sql($sql));
+	$prep_statement = $db->prepare(check_sql($sql));
-		if ($prep_statement) {
+	if ($prep_statement) {
-			$prep_statement->execute();
+		$prep_statement->execute();
-			$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
+		$contact_notes = $prep_statement->fetchAll(PDO::FETCH_NAMED);
-			$result_count = count($result);
+		unset ($prep_statement, $sql);
-			unset ($prep_statement, $sql);
+	}
-		}
 
+//set the row style array
 	$c = 0;
 	$row_style["0"] = "row_style0";
 	$row_style["1"] = "row_style1";
 
+//show the content
 	echo "<table width='100%' border='0' cellpadding='0' cellspacing='0'>\n";
 
 	echo "<tr>\n";
@@ -78,30 +79,31 @@
 
 	echo "<div id='contact_notes' style='width: 100%; overflow: auto; direction: rtl; text-align: right; margin-bottom: 23px;'>";
 	echo "<table class='tr_hover' style='width: 100%; direction: ltr; padding-left: 1px' border='0' cellpadding='0' cellspacing='0'>\n";
-	if ($result_count != 0) {
+	if (is_array($contact_notes)) {
-		foreach($result as $row) {
+		foreach($contact_notes as $row) {
-			$contact_note = escape($row['contact_note']);
+			$contact_note = $row['contact_note'];
+			$contact_note = escape($contact_note);
 			$contact_note = str_replace("\n","<br />",$contact_note);
 			if (permission_exists('contact_note_add')) {
-				$tr_link = "href='contact_note_edit.php?contact_uuid=".$row['contact_uuid']."&id=".$row['contact_note_uuid']."'";
+				$tr_link = "href='contact_note_edit.php?contact_uuid=".escape($row['contact_uuid'])."&id=".escape($row['contact_note_uuid'])."'";
 			}
 			echo "<tr ".$tr_link.">\n";
 			echo "	<td valign='top' class='".$row_style[$c]."' colspan='2'>";
-			echo "		<div style='display: inline-block; float: right; margin: -5px -7px 5px 5px; padding: 3px 4px; font-size: 10px; background-color: #f0f2f6;'><span style='color: #000; font-weight: bold;'>".$row['last_mod_user']."</span>: ".date("j M Y @ H:i:s", strtotime($row['last_mod_date']))."</div>";
+			echo "		<div style='display: inline-block; float: right; margin: -5px -7px 5px 5px; padding: 3px 4px; font-size: 10px; background-color: #f0f2f6;'><span style='color: #000; font-weight: bold;'>".escape($row['last_mod_user'])."</span>: ".date("j M Y @ H:i:s", strtotime($row['last_mod_date']))."</div>";
-			echo 		$contact_note."&nbsp;";
+			echo 			$contact_note."&nbsp;";
 			echo "	</td>\n";
 			echo "	<td class='list_control_icons'>";
 			if (permission_exists('contact_note_edit')) {
-				echo "<a href='contact_note_edit.php?contact_uuid=".$row['contact_uuid']."&id=".$row['contact_note_uuid']."' alt='".$text['button-edit']."'>$v_link_label_edit</a>";
+				echo "<a href='contact_note_edit.php?contact_uuid=".escape($row['contact_uuid'])."&id=".escape($row['contact_note_uuid'])."' alt='".$text['button-edit']."'>$v_link_label_edit</a>";
 			}
 			if (permission_exists('contact_note_delete')) {
-				echo "<a href='contact_note_delete.php?contact_uuid=".$row['contact_uuid']."&id=".$row['contact_note_uuid']."' alt='".$text['button-delete']."' onclick=\"return confirm('".$text['confirm-delete']."')\">$v_link_label_delete</a>";
+				echo "<a href='contact_note_delete.php?contact_uuid=".escape($row['contact_uuid'])."&id=".escape($row['contact_note_uuid'])."' alt='".$text['button-delete']."' onclick=\"return confirm('".$text['confirm-delete']."')\">$v_link_label_delete</a>";
 			}
 			echo "	</td>\n";
 			echo "</tr>\n";
 			$c = ($c) ? 0 : 1;
 		} //end foreach
-		unset($sql, $result, $row_count);
+		unset($sql, $contact_notes);
 	} //end if results
 	echo "</table>";
 	echo "</div>\n";

app/contacts/contact_phone_delete.php

@@ -55,7 +55,7 @@ else {
 	}
 
 //redirect the browser
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header("Location: contact_edit.php?id=".$contact_uuid);
 	return;
 

app/contacts/contact_phone_edit.php

@@ -159,7 +159,7 @@
 					$db->exec(check_sql($sql));
 					unset($sql);
 
-					messages::add($text['message-add']);
+					message::add($text['message-add']);
 					header("Location: contact_edit.php?id=".$contact_uuid);
 					return;
 				} //if ($action == "add")
@@ -182,7 +182,7 @@
 					$db->exec(check_sql($sql));
 					unset($sql);
 
-					messages::add($text['message-update']);
+					message::add($text['message-update']);
 					header("Location: contact_edit.php?id=".$contact_uuid);
 					return;
 				} //if ($action == "update")

app/contacts/contact_relation_delete.php

@@ -53,7 +53,7 @@ if (strlen($id)>0) {
 	unset($sql);
 }
 
-messages::add($text['message-delete']);
+message::add($text['message-delete']);
 header("Location: contact_edit.php?id=".$contact_uuid);
 return;
 

app/contacts/contact_relation_edit.php

@@ -145,7 +145,7 @@ else {
 						unset($sql);
 					}
 
-					messages::add($text['message-add']);
+					message::add($text['message-add']);
 					header("Location: contact_edit.php?id=".$contact_uuid);
 					return;
 				} //if ($action == "add")
@@ -159,7 +159,7 @@ else {
 					$db->exec(check_sql($sql));
 					unset($sql);
 
-					messages::add($text['message-update']);
+					message::add($text['message-update']);
 					header("Location: contact_edit.php?id=".$contact_uuid);
 					return;
 				} //if ($action == "update")

app/contacts/contact_setting_delete.php

@@ -56,7 +56,7 @@ else {
 	}
 
 //redirect the user
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header("Location: contact_edit.php?id=".$contact_uuid);
 	return;
 

app/contacts/contact_setting_edit.php

@@ -24,16 +24,20 @@
  Mark J Crane <markjcrane@fusionpbx.com>
  Luis Daniel Lucio Quiroz <dlucio@okay.com.mx>
 */
-require_once "root.php";
+
-require_once "resources/require.php";
+//includes
-require_once "resources/check_auth.php";
+	require_once "root.php";
-if (permission_exists('contact_setting_edit') || permission_exists('contact_setting_add')) {
+	require_once "resources/require.php";
-	//access granted
+	require_once "resources/check_auth.php";
-}
+
-else {
+//check permissions
-	echo "access denied";
+	if (permission_exists('contact_setting_edit') || permission_exists('contact_setting_add')) {
-	exit;
+		//access granted
-}
+	}
+	else {
+		echo "access denied";
+		exit;
+	}
 
 //add multi-lingual support
 	$language = new text;
@@ -162,12 +166,12 @@ else {
 
 				//redirect the browser
 					if ($action == "update") {
-						messages::add($text['message-update']);
+						message::add($text['message-update']);
 					}
 					if ($action == "add") {
-						messages::add($text['message-add']);
+						message::add($text['message-add']);
 					}
-					header("Location: contact_edit.php?id=".$contact_uuid);
+					header("Location: contact_edit.php?id=".escape($contact_uuid));
 					return;
 			} //if ($_POST["persistformvar"] != "true")
 	} //(count($_POST)>0 && strlen($_POST["persistformvar"]) == 0)
@@ -182,14 +186,13 @@ else {
 		$prep_statement->execute();
 		$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
 		foreach ($result as &$row) {
-			$contact_setting_category = $row["contact_setting_category"];
+			$contact_setting_category = escape($row["contact_setting_category"]);
-			$contact_setting_subcategory = $row["contact_setting_subcategory"];
+			$contact_setting_subcategory = escape($row["contact_setting_subcategory"]);
-			$contact_setting_name = $row["contact_setting_name"];
+			$contact_setting_name = escape($row["contact_setting_name"]);
-			$contact_setting_value = $row["contact_setting_value"];
+			$contact_setting_value = escape($row["contact_setting_value"]);
-			$contact_setting_order = $row["contact_setting_order"];
+			$contact_setting_order = escape($row["contact_setting_order"]);
-			$contact_setting_enabled = $row["contact_setting_enabled"];
+			$contact_setting_enabled = escape($row["contact_setting_enabled"]);
-			$contact_setting_description = $row["contact_setting_description"];
+			$contact_setting_description = escape($row["contact_setting_description"]);
-			break; //limit to 1 row
 		}
 		unset ($prep_statement);
 	}
@@ -290,13 +293,13 @@ else {
 		while($i<=999) {
 			$selected = ($i == $contact_setting_order) ? "selected" : null;
 			if (strlen($i) == 1) {
-				echo "		<option value='00$i' ".escape($selected).">00$i</option>\n";
+				echo "		<option value='00$i' ".$selected.">00$i</option>\n";
 			}
 			if (strlen($i) == 2) {
-				echo "		<option value='0$i' ".escape($selected).">0$i</option>\n";
+				echo "		<option value='0$i' ".$selected.">0$i</option>\n";
 			}
 			if (strlen($i) == 3) {
-				echo "		<option value='$i' ".escape($selected).">$i</option>\n";
+				echo "		<option value='$i' ".$selected.">$i</option>\n";
 			}
 			$i++;
 		}
@@ -345,9 +348,9 @@ else {
 	echo "	<tr>\n";
 	echo "		<td colspan='2' align='right'>\n";
 	echo "			<br>";
-	echo "			<input type='hidden' name='contact_uuid' value='".escape($contact_uuid)."'>\n";
+	echo "			<input type='hidden' name='contact_uuid' value='".$contact_uuid."'>\n";
 	if ($action == "update") {
-		echo "		<input type='hidden' name='contact_setting_uuid' value='".escape($contact_setting_uuid)."'>\n";
+		echo "		<input type='hidden' name='contact_setting_uuid' value='".$contact_setting_uuid."'>\n";
 	}
 	echo "			<input type='submit' name='submit' class='btn' value='".$text['button-save']."'>\n";
 	echo "		</td>\n";
@@ -358,4 +361,5 @@ else {
 
 //include the footer
 	require_once "resources/footer.php";
+
 ?>

app/contacts/contact_time_delete.php

@@ -56,7 +56,7 @@ else {
 	}
 
 //redirect the browser
-	messages::add($text['message-delete']);
+	message::add($text['message-delete']);
 	header("Location: contact_edit.php?id=".$contact_uuid);
 	return;
 

app/contacts/contact_time_edit.php

@@ -119,7 +119,7 @@ else {
 					$db->exec(check_sql($sql));
 					unset($sql);
 
-					messages::add($text['message-add']);
+					message::add($text['message-add']);
 					header("Location: contact_edit.php?id=".$contact_uuid);
 					return;
 				} //if ($action == "add")
@@ -138,7 +138,7 @@ else {
 					$db->exec(check_sql($sql));
 					unset($sql);
 
-					messages::add($text['message-update']);
+					message::add($text['message-update']);
 					header("Location: contact_edit.php?id=".$contact_uuid);
 					return;
 				} //if ($action == "update")

app/contacts/contact_timer.php

@@ -302,7 +302,7 @@ if (!permission_exists('contact_time_add')) { echo "access denied"; exit; }
 		$(document).ready(function(){
 			//ajax for refresh
 			var refresh = 1500;
-			var source_url = 'contact_timer_inc.php?domain_uuid=<?php echo $domain_uuid; ?>&contact_uuid=<?php echo $contact_uuid; ?>&contact_time_uuid=<?php echo $contact_time_uuid; ?>';
+			var source_url = 'contact_timer_inc.php?domain_uuid=<?php echo escape($domain_uuid); ?>&contact_uuid=<?php echo escape($contact_uuid); ?>&contact_time_uuid=<?php echo escape($contact_time_uuid); ?>';
 
 			var ajax_get = function () {
 				$.ajax({
@@ -330,20 +330,20 @@ if (!permission_exists('contact_time_add')) { echo "access denied"; exit; }
 	<br><br>
 	<?php echo $text['description_timer']; ?>
 	<br><br>
-	<strong><a href="javascript:void(0);" onclick="window.opener.location.href='contact_edit.php?id=<?php echo $contact_uuid; ?>';"><?php echo $contact; ?></a></strong>
+	<strong><a href="javascript:void(0);" onclick="window.opener.location.href='contact_edit.php?id=<?php echo escape($contact_uuid); ?>';"><?php echo escape($contact); ?></a></strong>
 	<br><br>
-	<div id='ajax_reponse' class='timer_<?php echo $timer_state;?>'>00:00:00</div>
+	<div id='ajax_reponse' class='timer_<?php echo escape($timer_state);?>'>00:00:00</div>
 	<br>
 	<form name='frm' id='frm' method='post' action=''>
-	<input type='hidden' name='domain_uuid' value="<?php echo $domain_uuid; ?>">
+	<input type='hidden' name='domain_uuid' value="<?php echo escape($domain_uuid); ?>">
-	<input type='hidden' name='contact_time_uuid' value="<?php echo $contact_time_uuid; ?>">
+	<input type='hidden' name='contact_time_uuid' value="<?php echo escape($contact_time_uuid); ?>">
-	<input type='hidden' name='contact_uuid' value="<?php echo $contact_uuid; ?>">
+	<input type='hidden' name='contact_uuid' value="<?php echo escape($contact_uuid); ?>">
-	<input type='hidden' name='time_action' value="<?php echo $timer_action; ?>">
+	<input type='hidden' name='time_action' value="<?php echo escape($timer_action); ?>">
 	<table cellpadding='0' cellspacing='0' border='0' style='width: 100%;'>
 		<tr>
 			<td class='vncell' style='text-align: center; padding: 10px;'>
 				<?php echo $text['label-description']; ?>
-				<textarea name='time_description' id='timer_description' class='formfld' style='width: 100%; height: 50px; margin-top: 5px;'><?php echo $time_description; ?></textarea>
+				<textarea name='time_description' id='timer_description' class='formfld' style='width: 100%; height: 50px; margin-top: 5px;'><?php echo escape($time_description); ?></textarea>
 				<? if ($timer_state == 'stopped') { ?><script>document.getElementById('timer_description').focus();</script><? } ?>
 			</td>
 		</tr>
@@ -358,4 +358,4 @@ if (!permission_exists('contact_time_add')) { echo "access denied"; exit; }
 	</center>
 	</form>
 </body>
-</html>
+</html>

app/contacts/contact_times.php

@@ -38,6 +38,24 @@
 		exit;
 	}
 
+//get the contact list
+	$sql = "select ct.*, u.username, u.domain_uuid as user_domain_uuid ";
+	$sql .= "from v_contact_times as ct, v_users as u ";
+	$sql .= "where ct.user_uuid = u.user_uuid ";
+	$sql .= "and ct.domain_uuid = '".$domain_uuid."' ";
+	$sql .= "and ct.contact_uuid = '".$contact_uuid."' ";
+	$sql .= "order by ct.time_start desc ";
+	$prep_statement = $db->prepare(check_sql($sql));
+	$prep_statement->execute();
+	$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
+	$result_count = count($result);
+	unset ($prep_statement, $sql);
+
+//set the row style
+	$c = 0;
+	$row_style["0"] = "row_style0";
+	$row_style["1"] = "row_style1";
+
 //show the content
 	echo "<table width='100%' border='0'>\n";
 	echo "<tr>\n";
@@ -46,23 +64,6 @@
 	echo "</tr>\n";
 	echo "</table>\n";
 
-	//get the contact list
-		$sql = "select ct.*, u.username, u.domain_uuid as user_domain_uuid ";
-		$sql .= "from v_contact_times as ct, v_users as u ";
-		$sql .= "where ct.user_uuid = u.user_uuid ";
-		$sql .= "and ct.domain_uuid = '".$domain_uuid."' ";
-		$sql .= "and ct.contact_uuid = '".$contact_uuid."' ";
-		$sql .= "order by ct.time_start desc ";
-		$prep_statement = $db->prepare(check_sql($sql));
-		$prep_statement->execute();
-		$result = $prep_statement->fetchAll(PDO::FETCH_NAMED);
-		$result_count = count($result);
-		unset ($prep_statement, $sql);
-
-	$c = 0;
-	$row_style["0"] = "row_style0";
-	$row_style["1"] = "row_style1";
-
 	echo "<table class='tr_hover' width='100%' border='0' cellpadding='0' cellspacing='0'>\n";
 	echo "<tr>\n";
 	echo "<th id='th_filler' style='display: none; padding: 0px;'>".img_spacer('21px', '1px')."</th>\n";
@@ -103,7 +104,7 @@
 			echo "	<td class='list_control_icons' nowrap>";
 			if (permission_exists('contact_time_edit')) {
 				if ($row['user_uuid'] == $_SESSION["user"]["user_uuid"]) {
-					echo "<a href='contact_time_edit.php?contact_uuid=".$row['contact_uuid']."&id=".$row['contact_time_uuid']."' alt='".$text['button-edit']."'>".$v_link_label_edit."</a>";
+					echo "<a href='contact_time_edit.php?contact_uuid=".escape($row['contact_uuid'])."&id=".escape($row['contact_time_uuid'])."' alt='".$text['button-edit']."'>".$v_link_label_edit."</a>";
 				}
 				else {
 					echo "<span onclick=\"alert('".$text['message-access_denied']."');\" alt='".$text['button-edit']."'>".str_replace("list_control_icon", "list_control_icon_disabled", $v_link_label_edit)."</span>";

app/contacts/contact_url_delete.php

@@ -54,7 +54,7 @@ if (strlen($id)>0) {
 	unset($sql);
 }
 
-messages::add($text['message-delete']);
+message::add($text['message-delete']);
 header("Location: contact_edit.php?id=".$contact_uuid);
 return;
 

app/contacts/contact_url_edit.php

@@ -134,7 +134,7 @@ else {
 					$db->exec(check_sql($sql));
 					unset($sql);
 
-					messages::add($text['message-add']);
+					message::add($text['message-add']);
 					header("Location: contact_edit.php?id=".$contact_uuid);
 					return;
 				} //if ($action == "add")
@@ -151,7 +151,7 @@ else {
 					$db->exec(check_sql($sql));
 					unset($sql);
 
-					messages::add($text['message-update']);
+					message::add($text['message-update']);
 					header("Location: contact_edit.php?id=".$contact_uuid);
 					return;
 				} //if ($action == "update")

app/contacts/contact_urls.php

@@ -85,7 +85,7 @@
 			echo "	<td valign='top' class='row_stylebg'>".escape($row['url_description'])."&nbsp;</td>\n";
 			echo "	<td class='list_control_icons'>";
 			if (permission_exists('contact_url_edit')) {
-				echo "<a href='contact_url_edit.php?contact_uuid=".escape($row['contact_uuid'])."&id=".$row['contact_url_uuid']."' alt='".$text['button-edit']."'>$v_link_label_edit</a>";
+				echo "<a href='contact_url_edit.php?contact_uuid=".escape($row['contact_uuid'])."&id=".escape($row['contact_url_uuid'])."' alt='".$text['button-edit']."'>$v_link_label_edit</a>";
 			}
 			if (permission_exists('contact_url_delete')) {
 				echo "<a href='contact_url_delete.php?contact_uuid=".escape($row['contact_uuid'])."&id=".escape($row['contact_url_uuid'])."' alt='".$text['button-delete']."' onclick=\"return confirm('".$text['confirm-delete']."')\">$v_link_label_delete</a>";