Open Source Training Seminar FreePBX Paid Support

Ticket #2983 (closed Bugs: fixed)

Opened 1 month ago

Last modified 1 month ago

encryption creates missing plugin sometimes when playing modules

Reported by: p_lindheimer Assigned to:
Priority: minor Milestone: 2.5
Component: System Recordings Version: 2.5-branch
Keywords: Cc:
Confirmation: Confirmed SVN Revision (if applicable):
Backend Engine: All Backend Engine Version:

Description

re-introduced in #2547, there was a similar fix for the ARI in #2515

Question, is the encryption needed at all and if so, then we need to introduce something similar here.

Change History

07/31/08 10:23:13 changed by p_lindheimer

one current issue, the encryption password is being transmitted making this completely useless at this time... (to be fixed shortly)

07/31/08 10:26:00 changed by p_lindheimer

(In [6233]) re #2983 get encryption key out of url, and re #2547

07/31/08 12:00:51 changed by p_lindheimer

to answer the question from some discussion on the IRC, the changes require this to go through the normal config.php with all the included security checking. So if the user can't get to the recording module they can't hack this either. However, there are many systems that have enabled access to the modules directory to get around the problem in #2547 with access violations, so those systems can still be listened into.

In order to somewhat address this, we will encrypt the path name but leave the sound file name alone since this is pulled out of the DOM and we don't want to pre-encrypt every sound file name in the select box. (This requires several changes and also a lot of overhead especially on an embedded low powered system).

If security is an issue, the modules directory should not allow access (and this should be the case anyhow). That should resolve the real problem.

07/31/08 12:02:28 changed by p_lindheimer

  • status changed from new to closed.
  • resolution set to fixed.

(In [6234]) fixes #2983 now we encrypt the path but not the sound file, for real security, make sure modules diretory is locked down

Donate



Support
Download
Develop
Forums
News
Documentation
Paid Support
About

Paid Ads