Ticket #2565: ari_ticket_2565.patch

File ari_ticket_2565.patch, 8.2 kB (added by p_lindheimer, 4 months ago)

comprehensive patch of what I think is needed per all the discussion on this thread

  • includes/crypt.php

    old new  
    6262   */ 
    6363  function decrypt($enc, $salt, $iv_len = 16) { 
    6464 
    65      $enc = urldecode(base64_decode($enc)); 
     65     $enc = base64_decode(urldecode($enc)); 
    6666     $n = strlen($enc); 
    6767     $i = $iv_len; 
    6868     $str = ''; 

  • modules/callmonitor.module

    old new  
    9999    global $ASTERISK_CALLMONITOR_PATH; 
    100100    global $CALLMONITOR_ALLOW_DELETE; 
    101101    global $AJAX_PAGE_REFRESH_ENABLE; 
     102    global $ARI_CRYPT_PASSWORD; 
    102103 
    103104    $display = new DisplaySearch(); 
     105    $crypt = new Crypt(); 
    104106 
    105107    // get the search string 
    106108    $m = getArgument($args,'m'); 
    …… 
    205207 
    206208      // recording file 
    207209      $recording = $recordings[$value['uniqueid'] . $value['calldate']]; 
     210      $recordingCrypt = $crypt->encrypt($recording,$ARI_CRYPT_PASSWORD); 
    208211 
    209212      // date and time 
    210213      $buf = split(' ', $value[calldate]); 
    …… 
    213216 
    214217      // recording delete checkbox 
    215218      if ($CALLMONITOR_ALLOW_DELETE) { 
    216         $recording_delete_checkbox = "<td class='checkbox'><input type=checkbox name='selected" . ++$i . "' value=" . $recording . "></td>"; 
     219        $recording_delete_checkbox = "<td class='checkbox'><input type=checkbox name='selected" . ++$i . "' value=" . $recordingCrypt . "></td>"; 
    217220      } 
    218221 
    219222      $recordingLink = ''; 
    220223      if (is_file($recordings[$value['uniqueid'] . $value['calldate']])) { 
    221         $recordingLink = "<a href='#' onClick=\"javascript:popUp('misc/recording_popup.php?recording=" . $recording . "&date=" . $date . "&time=" . $time . "'); return false;\">" . _("play") . "</a>"; 
     224        $recordingLink = "<a href='#' onClick=\"javascript:popUp('misc/recording_popup.php?recording=" . $recordingCrypt . "&date=" . $date . "&time=" . $time . "'); return false;\">" . _("play") . "</a>"; 
    222225      } 
    223226     
    224227      $recording_body .= "<tr> 
    …… 
    526529   */ 
    527530  function deleteRecData($files) { 
    528531 
    529     foreach($files as $key => $file) { 
     532    global $ARI_CRYPT_PASSWORD; 
     533 
     534    $crypt = new Crypt(); 
     535 
     536    foreach($files as $key => $fileCrypt) { 
     537      $file = $crypt->decrypt($fileCrypt,$ARI_CRYPT_PASSWORD); 
    530538      if (is_writable($file)) { 
    531539        unlink($file); 
    532540      } else { 

  • modules/voicemail.module

    old new  
    207207    global $ASTERISK_VOICEMAIL_PATH; 
    208208    global $ASTERISK_VOICEMAIL_FOLDERS; 
    209209    global $AJAX_PAGE_REFRESH_ENABLE; 
     210    global $ARI_CRYPT_PASSWORD; 
    210211 
    211212    $voicemail_audio_format = $_COOKIE['ari_voicemail_audio_format']; 
    212213 
    213214    $display = new DisplaySearch(); 
     215    $crypt = new Crypt(); 
    214216 
    215217    // args 
    216218    $m = getArgument($args,'m'); 
    …… 
    385387        // recording popup link 
    386388        $voicemail_audio_format = $voicemail_audio_format=='' ? '.wav' : $voicemail_audio_format; 
    387389        $recording = preg_replace('/.txt/', $voicemail_audio_format, $file); 
     390        $date = GetDateFormat($value['origtime']); 
     391        $time = GetTimeFormat($value['origtime']); 
     392        $from = $value[callerid]; 
     393        $priority = $value[priority]; 
     394        $to = $value[origmailbox]; 
     395        $duration = $value[duration]; 
    388396        if (is_file($recording)) { 
    389           $recordingLink = "<a href='#' onClick=\"javascript:popUp('misc/recording_popup.php?recording=" . $recording . "&date=" . $date . "&time=" . $time . "'); return false;\"> 
     397          $recordingCrypt = $crypt->encrypt($recording,$ARI_CRYPT_PASSWORD); 
     398          $recordingLink = "<a href='#' onClick=\"javascript:popUp('misc/recording_popup.php?recording=" . $recordingCrypt . "&date=" . $date . "&time=" . $time . "'); return false;\"> 
    390399            " . _("play") . " 
    391400          </a>"; 
    392401        }  
    …… 
    395404                                   sprintf(_("On settings page, change voicemail audio format.  It is currently set to %s"),$voicemail_audio_format); 
    396405        } 
    397406 
     407        $fileCrypt = $crypt->encrypt($file,$ARI_CRYPT_PASSWORD); 
     408 
    398409        $tableText .= " 
    399410          <tr> 
    400             <td class='checkbox'><input type=checkbox name='selected" . ++$i . "' value=" . $file . "></td> 
    401             <td width=68>" . GetDateFormat($value['origtime']) . "</td> 
    402             <td>" . GetTimeFormat($value['origtime']) . "</td> 
    403             <td width=100>" . $value[callerid] . "</td> 
     411            <td class='checkbox'><input type=checkbox name='selected" . ++$i . "' value=" . $fileCrypt . "></td> 
     412            <td width=68>" . $date . "</td> 
     413            <td>" . $time . "</td> 
     414            <td width=100>" . $from . "</td> 
    404415            <td>" . $value[priority] . "</td> 
    405             <td width=90>" . $value[origmailbox] . "</td> 
    406             <td>" . $value[duration] . " sec</td> 
     416            <td width=90>" . $to . "</td> 
     417            <td>" . $duration . " sec</td> 
    407418            <td>" . $recordingLink . "</td> 
    408419          </tr>"; 
    409420      } 
    …… 
    607618   */ 
    608619  function deleteVoicemailData($files) { 
    609620 
    610     foreach($files as $key => $path) { 
     621    global $ARI_CRYPT_PASSWORD; 
    611622 
     623    $crypt = new Crypt(); 
     624 
     625    foreach($files as $key => $pathCrypt) { 
     626 
     627      // decrypt path 
     628      $path = $crypt->decrypt($pathCrypt,$ARI_CRYPT_PASSWORD); 
     629 
    612630      // get file parts for search 
    613631      $path_parts = pathinfo($path); 
    614632      $path = fixPathSlash($path_parts['dirname']); 
    …… 
    642660  function moveVoicemailData($files,$context_rx,$extension_rx,$folder_rx) { 
    643661 
    644662    global $ASTERISK_VOICEMAIL_PATH; 
     663    global $ARI_CRYPT_PASSWORD; 
    645664 
     665    $crypt = new Crypt(); 
     666 
    646667    $perm = fileperms($ASTERISK_VOICEMAIL_PATH); 
    647668    $uid = fileowner($ASTERISK_VOICEMAIL_PATH); 
    648669    $gid = filegroup($ASTERISK_VOICEMAIL_PATH); 
    …… 
    696717      return; 
    697718    } 
    698719 
     720    foreach($files as $key => $pathCrypt) { 
     721      // decrypt path 
     722      $pathPlain = $crypt->decrypt($pathCrypt,$ARI_CRYPT_PASSWORD); 
     723      // add plain path to new array 
     724      $filesPlain[] = $pathPlain; 
     725    } 
     726 
    699727    // copy files to new location, incrementing each message number  
    700     asort($files); 
    701     foreach($files as $key => $path) { 
     728    asort($filesPlain); 
     729    foreach($filesPlain as $key => $path) { 
    702730 
    703731      // get file parts for search 
    704732      $path_parts = pathinfo($path); 

  • misc/recording_popup.php

    old new  
    1414<html xmlns="http://www.w3.org/1999/xhtml"> 
    1515  <head> 
    1616    <TITLE>ARI</TITLE> 
     17    <link rel="stylesheet" href="../theme/main.css" type="text/css"> 
    1718    <link rel="stylesheet" href="popup.css" type="text/css"> 
    1819    <meta http-equiv="content-type" content="text/html; charset=UTF-8"> 
    1920  </head> 
    …… 
    2122 
    2223<?php 
    2324 
    24   global $ARI_CRYPT_PASSWORD; 
     25  $path = urlencode($_GET['recording']); 
    2526 
    26   $crypt = new Crypt(); 
    27  
    28   $path = $crypt->encrypt($_GET['recording'],$ARI_CRYPT_PASSWORD); 
    29  
    3027  if (isset($path)) { 
    3128    if (isset($_GET['date'])) { 
    32       echo($_GET['date'] . "<br>"); 
     29      echo("<small>" . $_GET['date'] . "</small><br>"); 
    3330    } 
    3431    if (isset($_GET['time'])) { 
    35       echo($_GET['time'] . "<br>"); 
     32      echo("<small>" . $_GET['time'] . "</small><br>"); 
    3633    } 
     34 
    3735    echo("<br>"); 
    38     echo("<embed src='audio.php?recording=" . $path . "' width=300, height=20 autoplay=true loop=false></embed><br>"); 
     36    echo("<embed src='audio.php?recording=" . $path . "' width=300, height=25 autoplay=true loop=false></embed><br>"); 
    3937    echo("<a class='popup_download' href=/recordings/misc/audio.php?recording="  . $path . ">" . _("download") . "</a><br>"); 
    4038  } 
    4139 

  • misc/audio.php

    old new  
    1616 
    1717  $crypt = new Crypt(); 
    1818 
    19   $path = $crypt->decrypt($_GET['recording'],$ARI_CRYPT_PASSWORD); 
     19  $path = $crypt->decrypt(urlencode($_GET['recording']),$ARI_CRYPT_PASSWORD); 
    2020 
    2121  // strip ".." from path for security 
    2222  $path = preg_replace('/\.\./','',$path); 
Donate



Support
Download
Develop
Forums
News
Documentation
Paid Support
About

Paid Ads