diff --git a/app/ring_groups/ring_group_forward.php b/app/ring_groups/ring_group_forward.php index 28ba413579..575c9f3624 100644 --- a/app/ring_groups/ring_group_forward.php +++ b/app/ring_groups/ring_group_forward.php @@ -50,25 +50,39 @@ $order_by = $_GET["order_by"]; $order = $_GET["order"]; +//find the path + switch ($_SERVER['REQUEST_URI']) { + case PROJECT_PATH."/core/user_settings/user_dashboard.php": + $validated_path = PROJECT_PATH."/core/user_settings/user_dashboard.php"; + break; + case PROJECT_PATH."/app/ring_groups/ring_group_forward.php": + $validated_path = PROJECT_PATH."/app/ring_groups/ring_group_forward.php"; + break; + default: + $validated_path = PROJECT_PATH."/app/ring_groups/ring_group_forward.php"; + } + //update ring group forwarding if (sizeof($_POST) > 0) { - $ring_groups = $_POST['ring_group_forward_enabled']; - $destinations = $_POST['ring_group_forward_destination']; - - if (is_array($ring_groups) && @sizeof($ring_groups) != 0 && permission_exists('ring_group_forward')) { + if (is_array($_POST['ring_groups']) && @sizeof($_POST['ring_groups']) != 0 && permission_exists('ring_group_forward')) { $x = 0; - foreach ($ring_groups as $ring_group_uuid => $ring_group_forward_enabled) { + foreach ($_POST['ring_groups'] as $row) { //remove non-numeric characters - $ring_group_foreward_destination = preg_replace("~[^0-9]~", "", $destinations[$ring_group_uuid]); + $ring_group_uuid = $row['ring_group_uuid']; + $ring_group_forward_destination = preg_replace("~[^0-9]~", "", $row['ring_group_forward_destination']); + $ring_group_forward_enabled = ($row['ring_group_forward_enabled'] == 'true') ? $ring_group_forward_enabled = 'true' : $ring_group_forward_enabled = 'false'; //build array - $array['ring_groups'][$x]['ring_group_uuid'] = $ring_group_uuid; - $array['ring_groups'][$x]['domain_uuid'] = $_SESSION['domain_uuid']; - $array['ring_groups'][$x]['ring_group_forward_enabled'] = $ring_group_forward_enabled; - $array['ring_groups'][$x]['ring_group_forward_destination'] = $ring_group_foreward_destination; + if (is_uuid($ring_group_uuid)) { + $array['ring_groups'][$x]['ring_group_uuid'] = $ring_group_uuid; + $array['ring_groups'][$x]['domain_uuid'] = $_SESSION['domain_uuid']; + $array['ring_groups'][$x]['ring_group_forward_enabled'] =$ring_group_forward_enabled; + $array['ring_groups'][$x]['ring_group_forward_destination'] = $ring_group_forward_destination; + } //increment counter $x++; } - if (is_array($array) && !sizeof($array) != 0) { + + if (is_array($array) && sizeof($array) != 0) { //update ring group $p = new permissions; $p->add('ring_group_edit', 'temp'); @@ -85,7 +99,7 @@ message::add($text['message-update']); //redirect the user - header("Location: ".$_REQUEST['return_url']); + header("Location: ".$validated_path); exit; } } @@ -104,8 +118,8 @@ $sql .= "where r.ring_group_uuid = u.ring_group_uuid "; $sql .= "and r.domain_uuid = :domain_uuid "; $sql .= "and u.user_uuid = :user_uuid "; - $parameters['domain_uuid'] = $_SESSION['domain_uuid']; - $parameters['user_uuid'] = $_SESSION['user_uuid']; + $parameters['domain_uuid'] = $_SESSION['user']['domain_uuid']; + $parameters['user_uuid'] = $_SESSION['user']['user_uuid']; } $database = new database; $num_rows = $database->select($sql, $parameters, 'column'); @@ -132,7 +146,8 @@ $sql .= "where r.ring_group_uuid = u.ring_group_uuid "; $sql .= "and r.domain_uuid = :domain_uuid "; $sql .= "and u.user_uuid = :user_uuid "; - $parameters['domain_uuid'] = $_SESSION['domain_uuid']; + $parameters['domain_uuid'] = $_SESSION['user']['domain_uuid']; + $parameters['user_uuid'] = $_SESSION['user']['user_uuid']; } $sql .= order_by($order_by, $order, 'ring_group_extension', 'asc'); $sql .= limit_offset($rows_per_page, $offset); @@ -140,9 +155,7 @@ $result = $database->select($sql, $parameters, 'all'); unset($sql, $parameters); - echo "
\n"; - echo "\n"; - + echo "\n"; echo "
"; echo " ".$text['header-ring-group-forward']."
"; if (!$is_included) { @@ -168,25 +181,27 @@ } echo "\n"; - $c = 0; + $c = 0; $x = 0; if (is_array($result) && @sizeof($result) != 0) { foreach($result as $row) { - $onclick = "onclick=\"document.getElementById('".$row['ring_group_uuid']."').selectedIndex = (document.getElementById('".$row['ring_group_uuid']."').selectedIndex) ? 0 : 1; if (document.getElementById('".$row['ring_group_uuid']."').selectedIndex) { document.getElementById('destination').focus(); }\""; + $onclick = "onclick=\"document.getElementById('".escape($row['ring_group_uuid'])."').selectedIndex = (document.getElementById('".escape($row['ring_group_uuid'])."').selectedIndex) ? 0 : 1; if (document.getElementById('".escape($row['ring_group_uuid'])."').selectedIndex) { document.getElementById('destination').focus(); }\""; echo "\n"; - echo " ".$row['ring_group_name']." \n"; - echo " ".$row['ring_group_extension']." \n"; + echo " ".escape($row['ring_group_name'])." \n"; + echo " ".escape($row['ring_group_extension'])." \n"; echo " "; - echo " "; + echo " "; - echo " "; + echo " "; echo " \n"; if (!$is_included) { - echo " ".$row['ring_group_description']." \n"; + echo " ".escape($row['ring_group_description'])." \n"; } echo "\n"; $c = ($c) ? 0 : 1; + $x++; } } unset($result, $row);