From 8dbd85484e8efd38d1d5965de0d909b7b08a95a0 Mon Sep 17 00:00:00 2001
From: FusionPBX <markjcrane@gmail.com>
Date: Thu, 20 Apr 2023 14:20:14 -0600
Subject: [PATCH] xml.santize allow required variables

---
 .../scripts/configuration/callcenter.conf.lua      | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/app/scripts/resources/scripts/app/xml_handler/resources/scripts/configuration/callcenter.conf.lua b/app/scripts/resources/scripts/app/xml_handler/resources/scripts/configuration/callcenter.conf.lua
index 158ecc2c32..e3da36175f 100644
--- a/app/scripts/resources/scripts/app/xml_handler/resources/scripts/configuration/callcenter.conf.lua
+++ b/app/scripts/resources/scripts/app/xml_handler/resources/scripts/configuration/callcenter.conf.lua
@@ -105,6 +105,12 @@
 				--replace the space with a dash
 					queue_name = queue_name:gsub(" ", "-");
 
+				--sanitize the queue_record_template and allow specific variables
+					queue_record_template = xml.sanitize(queue_record_template);
+					queue_record_template = string.gsub(queue_record_template, "{strftime", "${strftime");
+					queue_record_template = string.gsub(queue_record_template, "{uuid}", "${uuid}");
+					queue_record_template = string.gsub(queue_record_template, "{record_ext}", "${record_ext}");
+
 				--start the xml
 					xml:append([[                            <queue name="]] .. xml.sanitize(queue_extension) .. [[@]] .. xml.sanitize(domain_name) .. [[" label="]] .. xml.sanitize(queue_name) .. [[@]] .. xml.sanitize(domain_name) .. [[">]]);
 					xml:append([[                                    <param name="strategy" value="]] .. xml.sanitize(queue_strategy) .. [["/>]]);
@@ -112,7 +118,7 @@
 					queue_ringback = format_ringback(queue_moh_sound);
 					xml:append([[                                    <param name="moh-sound" value="]] .. xml.sanitize(queue_ringback) .. [["/>]]);
 					if (queue_record_template ~= nil) then
-						xml:append([[                                    <param name="record-template" value="]] .. xml.sanitize(queue_record_template) .. [["/>]]);
+						xml:append([[                                    <param name="record-template" value="]] .. queue_record_template .. [["/>]]);
 					end
 					if (queue_time_base_score ~= nil) then
 						xml:append([[                                    <param name="time-base-score" value="]] .. xml.sanitize(queue_time_base_score) .. [["/>]]);
@@ -238,12 +244,16 @@
 							end
 						end
 
+				--sanitize the agent_contact and allow specific variables
+					agent_contact = xml.sanitize(agent_contact);
+					agent_contact = string.gsub(agent_contact, "{caller_destination}", "${caller_destination");
+
 				--build the xml string
 					xml:append([[                            <agent ]]);
 					xml:append([[                            	name="]] .. xml.sanitize(agent_uuid) .. [[" ]]);
 					xml:append([[                            	label="]] .. xml.sanitize(agent_name) .. [[@]] .. xml.sanitize(domain_name) .. [[" ]]);
 					xml:append([[                            	type="]] .. xml.sanitize(agent_type) .. [[" ]]);
-					xml:append([[                            	contact="]] .. xml.sanitize(agent_contact) .. [[" ]]);
+					xml:append([[                            	contact="]] .. agent_contact .. [[" ]]);
 					xml:append([[                            	status="]] .. xml.sanitize(agent_status) .. [[" ]]);
 					if (agent_no_answer_delay_time ~= nil) then
 						xml:append([[                            	no-answer-delay-time="]] .. xml.sanitize(agent_no_answer_delay_time) .. [[" ]]);