Ticket #3209 (closed Bugs: fixed)

Opened 4 months ago

Last modified 3 months ago

CDR Reports requires access to the admin/cdr direcotry resulting in possible Sercuirty Issues

Reported by: p_lindheimer Assigned to:
Priority: minor Milestone: 2.5
Component: Reports Version: 2.5-branch
Keywords: Cc:
Confirmation: Need testing SVN Revision (if applicable):
Backend Engine: All Backend Engine Version:

Description

FreePBX currently requires http access to the admin/cdr directory for proper operations of the CDR reporting system. If using authentication methods that do not incorporate http authentication (current AUTHTYPE=database), it is possible to bypass the authentication system with the potential of accessing CDR records.

It should be possible to lock down the admin/cdr directory with a .htaccess file and "Deny From All" (or equivalent httpd.conf config) just like that should be done in the admin/modules directory. Since doing such breaks the Reports tab, it results in this security vulnerability.

Change History

09/17/08 11:29:40 changed by p_lindheimer

  • status changed from new to closed.
  • resolution set to fixed.

(In [6764]) fixes #3209 Reports SECURITY VULNERABILITY by forcing all access to the CDR Reports section to flow through config.php

09/17/08 11:42:10 changed by p_lindheimer

(In [6765]) fixed #3209 Merged revisions 6764 via svnmerge from http://svn.freepbx.org/freepbx/branches/2.5

........

r6764 | p_lindheimer | 2008-09-17 11:29:39 -0700 (Wed, 17 Sep 2008) | 1 line

fixes #3209 Reports SECURITY VULNERABILITY by forcing all access to the CDR Reports section to flow through config.php

........

09/17/08 11:52:50 changed by p_lindheimer

  • confirmation changed from Confirmed to Need testing.

This fix will be published on 2.5 with an upcoming framework update. It will not be published on 2.4 until we get some independent confirmation from some testers who can load it on a 2.4 system from SVN (where the changes have been merged back to) and confirm that the system works. The patch will not be applied back prior to 2.4.

If you have concerns on this issue and can not upgrade to 2.5 or pull the changes form SVN in 2.4 (until we can eventually publish the change) then you have the option of choosing an http based authentication solution (AUTHTYPE=none or webserver in conjunction with a proper http setup).

It is also up to your installation to add the required .htaccess file to your admin/cdr directory or make the changes in the httpd.conf or equivalent file as this is ISO/installation independent and can not be dictated by FreePBX.

09/17/08 22:15:04 changed by p_lindheimer

(In [6769]) add 2.5.0 upgrade directory and remove the moved files re #3209

09/18/08 11:09:31 changed by sasargen

I tested this patch, r6765, on a 2.4.1.1 system. Each of the report tabs appeared normal and queries worked as expected. Looks ready to release.

10/13/08 19:33:42 changed by p_lindheimer

(In [6977]) Merged revisions 6459-6976 via svnmerge from http://svn.freepbx.org/freepbx/trunk

................

r6480 | mickecarlsson | 2008-08-26 08:20:49 -0700 (Tue, 26 Aug 2008) | 1 line

Enclosed text strings for translation

................

r6482 | mickecarlsson | 2008-08-26 10:53:32 -0700 (Tue, 26 Aug 2008) | 1 line

All new text strings from core and framework added, adds missing folder views

................

r6487 | mickecarlsson | 2008-08-27 12:14:50 -0700 (Wed, 27 Aug 2008) | 1 line

Fixed #3117, and also updated the otyher modules in cdr, checking for invalid dates

................

r6492 | p_lindheimer | 2008-08-27 22:37:13 -0700 (Wed, 27 Aug 2008) | 37 lines

Merged revisions 6458-6459,6461-6490 via svnmerge from http://svn.freepbx.org/freepbx/branches/2.5

........

r6462 | p_lindheimer | 2008-08-24 20:37:24 -0700 (Sun, 24 Aug 2008) | 1 line

Creating release 2.5.0rc2

........

r6474 | p_lindheimer | 2008-08-25 12:06:13 -0700 (Mon, 25 Aug 2008) | 1 line

fixes #3104 - looks like some of the code paths do extra urlencodes/decodes - this looks like it does it

........

r6477 | p_lindheimer | 2008-08-25 15:26:43 -0700 (Mon, 25 Aug 2008) | 1 line

fixes #3107 don't include module specific css/js files twice in some circumstances

........

r6478 | sasargen | 2008-08-26 05:30:34 -0700 (Tue, 26 Aug 2008) | 1 line

fixes #3104 - removes manual urlencode of checkbox values because they are form fields and are automatically urlencoded by the browser when the form is submitted

........

r6483 | p_lindheimer | 2008-08-26 12:15:04 -0700 (Tue, 26 Aug 2008) | 1 line

closes #3093 reset the execution time limit to the system configured limit before each module download and install so downloading many modules at once does not result in a timeout failure, this still counts on a reasonable php.ini setting for any given installation of which the default is typically adeqaute

........

r6484 | p_lindheimer | 2008-08-26 19:06:13 -0700 (Tue, 26 Aug 2008) | 1 line

closes #3113 and ref #3090 - puts error in notification panel if magic_quotes_gpc is enabled

........

r6486 | p_lindheimer | 2008-08-27 11:40:19 -0700 (Wed, 27 Aug 2008) | 1 line

improve the symlink failure message to provide feedback on what can be done to resolve the issue

........

r6490 | p_lindheimer | 2008-08-27 22:29:03 -0700 (Wed, 27 Aug 2008) | 1 line

updated CHANGES

........

................

r6502 | mickecarlsson | 2008-08-28 11:36:24 -0700 (Thu, 28 Aug 2008) | 1 line

Fixes #2609, moving files to correct location

................

r6503 | mickecarlsson | 2008-08-29 11:00:34 -0700 (Fri, 29 Aug 2008) | 1 line

Cleaned up the readme and locale, added zh_TW in scrip

................

r6511 | sasargen | 2008-08-30 07:14:47 -0700 (Sat, 30 Aug 2008) | 1 line

ARI: merge inline play and download features into trunk

................

r6512 | sasargen | 2008-08-30 07:37:09 -0700 (Sat, 30 Aug 2008) | 1 line

remove extra curly brace from voicemail.module that was causing an error

................

r6530 | mickecarlsson | 2008-09-01 11:30:58 -0700 (Mon, 01 Sep 2008) | 1 line

New version of language template due to new text strings added

................

r6537 | mickecarlsson | 2008-09-02 12:19:57 -0700 (Tue, 02 Sep 2008) | 1 line

Changed from freePBX to FreePBX in some text strings

................

r6539 | p_lindheimer | 2008-09-02 16:41:54 -0700 (Tue, 02 Sep 2008) | 74 lines

Merged revisions 6492-6538 via svnmerge from http://svn.freepbx.org/freepbx/branches/2.5

........

r6504 | p_lindheimer | 2008-08-29 11:13:55 -0700 (Fri, 29 Aug 2008) | 1 line

don't define WEBROOT if AMPWEBADDRESS is not defined, it breaks the graphing libraries (which seem to otherwise function fine without it defined)

........

r6505 | p_lindheimer | 2008-08-29 14:55:13 -0700 (Fri, 29 Aug 2008) | 1 line

make max files for call monitor configurable within main.conf.php, default remains the same

........

r6506 | p_lindheimer | 2008-08-29 15:16:05 -0700 (Fri, 29 Aug 2008) | 1 line

return the raw Asterisk version info obtained from checking the version info re #2750 and re #3128

........

r6513 | p_lindheimer | 2008-08-30 20:53:16 -0700 (Sat, 30 Aug 2008) | 1 line

re #3124 put url in auto-generated warnings to reference further help, still need to update all the fixed files with similar warnings but they should consider including some custom instructions such as sip.conf can suggest what sort of sip settings go in which includes files, etc.

........

r6515 | p_lindheimer | 2008-08-31 07:35:02 -0700 (Sun, 31 Aug 2008) | 1 line

re #3134 makes ajax refresh rates for dashboard configurable

........

r6519 | p_lindheimer | 2008-08-31 15:40:00 -0700 (Sun, 31 Aug 2008) | 1 line

re #3131 add Mixmonitor and Stopmonitor to extension class

........

r6525 | p_lindheimer | 2008-08-31 16:36:33 -0700 (Sun, 31 Aug 2008) | 49 lines

closes #3137

db_connect.php:

  • removed all checks for notification panel when in quietmode since it's usually used for ajax calls and other light weight calls that can do without the overhead.

config.php:

  • added restrictmods parameter, populated with '/' separted module names. If passed, only these modules will have their functions.inc.php files included. Used for light weight ajax and similar calls, to avoid the overhead if we know we don't need those.

  • removed all checks for notification panel when in quietmode. Removed the inclusion of hooks when in quietmode.

functions.inc.php:

  • added modulelist class, used to cache the module xml structure which is now serialized and saved to the db to avoid the heavy xml processing overhead of reading all the module.xml files. (should probably move most of module_getinfo() into the class but for starters just did minimal changes to avoid introducing bugs since this is pretty sensitive).
  • fixed several instances of using " instead of ' in sql satements which breaks sqlite3 queries often.
  • replaced all instances of addslashes() with $db->escapeSimple() since sqlite3 is not compatible with addslashes() and this makes it db independent through pear.
  • added third argument to module_getinfo() defaulting in false. Setting to true forces a read of all the module.xml files. Module Admin and module_admin should always set this to true.

header.php

  • removed all checks for notification panel when in quietmode

page.modules.php

  • added third true paramter to module_getinfo

........

r6526 | p_lindheimer | 2008-08-31 17:16:27 -0700 (Sun, 31 Aug 2008) | 49 lines

closes #3137

module_admin

  • added third true paramter to module_getinfo

........

................

r6575 | mickecarlsson | 2008-09-05 00:32:33 -0700 (Fri, 05 Sep 2008) | 1 line

Enclosed text string for localization for page.modules.php

................

r6593 | ethans | 2008-09-07 11:24:20 -0700 (Sun, 07 Sep 2008) | 2 lines

Fixes #3165

................

r6598 | ethans | 2008-09-07 15:11:29 -0700 (Sun, 07 Sep 2008) | 3 lines

Shouldn't be here

................

r6600 | p_lindheimer | 2008-09-07 15:33:09 -0700 (Sun, 07 Sep 2008) | 89 lines

Merged revisions 6539-6598 via svnmerge from http://svn.freepbx.org/freepbx/branches/2.5

........

r6549 | p_lindheimer | 2008-09-03 14:54:37 -0700 (Wed, 03 Sep 2008) | 1 line

fixes #3145 LookupCIDName deprecated in 1.6

........

r6551 | p_lindheimer | 2008-09-03 16:16:11 -0700 (Wed, 03 Sep 2008) | 1 line

fixes #3151 typo in variable name that should not be there at all

........

r6552 | p_lindheimer | 2008-09-03 16:19:08 -0700 (Wed, 03 Sep 2008) | 1 line

fixes #3154 undefined variable needs global directive

........

r6554 | p_lindheimer | 2008-09-03 23:31:18 -0700 (Wed, 03 Sep 2008) | 1 line

fixes #3155 chown should be int not string for permissions

........

r6563 | p_lindheimer | 2008-09-04 14:43:50 -0700 (Thu, 04 Sep 2008) | 1 line

fix SECURITY SQL Injection vulnerability that could allow an authenticated user to access CDR and recorded calls from any other user on the system

........

r6572 | p_lindheimer | 2008-09-04 15:44:55 -0700 (Thu, 04 Sep 2008) | 1 line

re #3156 updated CHANGES MoH Streaming Categories

........

r6573 | p_lindheimer | 2008-09-04 18:05:44 -0700 (Thu, 04 Sep 2008) | 1 line

rearraged to move all classes at begining and fixed bug in mirror annoucements when using wget mode

........

r6574 | p_lindheimer | 2008-09-04 18:26:41 -0700 (Thu, 04 Sep 2008) | 1 line

no changes, just re-organized to move all functions to the bottom

........

r6577 | p_lindheimer | 2008-09-05 23:10:23 -0700 (Fri, 05 Sep 2008) | 1 line

typo in warning banner override mode

........

r6578 | p_lindheimer | 2008-09-05 23:11:39 -0700 (Fri, 05 Sep 2008) | 1 line

closes #3164 sql_formattext issue with sqlite3

........

r6579 | p_lindheimer | 2008-09-06 08:28:11 -0700 (Sat, 06 Sep 2008) | 1 line

additional sanity checks on callmonitor sql paramters

........

r6583 | p_lindheimer | 2008-09-06 17:34:17 -0700 (Sat, 06 Sep 2008) | 1 line

closes #3166 includes compatibility mode. translation using module's i18n is done first. If the translated text is the same as the original text, then translation is done against the the default _() which is amp.po at that point. So for previous translation work, it will continue to pull the old translations. All modules should move towards providing their own translations for menu items as this point despite this.

........

r6584 | p_lindheimer | 2008-09-06 19:37:04 -0700 (Sat, 06 Sep 2008) | 1 line

re #3166 and re #2461 the remove the linefeed that the xml parser inserts before and after an ampersand in menuitems and catagories so that translations can have a better chance of matching

........

r6585 | p_lindheimer | 2008-09-06 19:55:55 -0700 (Sat, 06 Sep 2008) | 1 line

re #3166 and re #2461 also cleanup the name field

........

r6586 | p_lindheimer | 2008-09-06 20:09:38 -0700 (Sat, 06 Sep 2008) | 1 line

re #3166 and re #2461 fixed typo in variable

........

r6587 | p_lindheimer | 2008-09-06 20:21:10 -0700 (Sat, 06 Sep 2008) | 1 line

re #3166 and re #2461 added translations to Module Admin so it can get them out of module's i18n also

........

r6590 | p_lindheimer | 2008-09-07 08:27:08 -0700 (Sun, 07 Sep 2008) | 1 line

re #3166 and re #2461 added ability to translated description and attention module admin xml fields

........

r6591 | p_lindheimer | 2008-09-07 09:51:56 -0700 (Sun, 07 Sep 2008) | 1 line

strip leading/trailingwhitespace and linefeed characters out of module.xml description field so that translations can more consistenly be done and so that when displayed, the text floats properly.

........

r6593 | ethans | 2008-09-07 11:24:20 -0700 (Sun, 07 Sep 2008) | 2 lines

Fixes #3165

........

r6595 | pnlarsson | 2008-09-07 13:42:10 -0700 (Sun, 07 Sep 2008) | 1 line

Fix for #3077 - DAHDI support, commit no 2 for core

........

r6597 | p_lindheimer | 2008-09-07 14:47:58 -0700 (Sun, 07 Sep 2008) | 1 line

re #3077 some tweaks based on version actually tested and update of CHANGES, amportal.conf

........

................

r6815 | p_lindheimer | 2008-09-19 11:28:44 -0700 (Fri, 19 Sep 2008) | 1 line

revert r6511 and r6512 merged from ari branch so we can try to get a clean merge from 2.5, then these ari branch can be merged back in again when ready

................

r6816 | p_lindheimer | 2008-09-19 11:33:18 -0700 (Fri, 19 Sep 2008) | 87 lines

Merged revisions 6600-6815 via svnmerge from http://svn.freepbx.org/freepbx/branches/2.5

........

r6601 | ethans | 2008-09-07 15:39:51 -0700 (Sun, 07 Sep 2008) | 4 lines

Adds FOPDISABLE option to amportal.conf. This will disable FOP on the web interfaces as well as server operations in retrieve_conf and freepbx_engine

References: 3170

........

r6605 | p_lindheimer | 2008-09-07 19:23:41 -0700 (Sun, 07 Sep 2008) | 1 line

create 2.5.0rc3 upgrade dir and remove zh_TW from error in #2609 placement

........

r6635 | p_lindheimer | 2008-09-07 20:01:27 -0700 (Sun, 07 Sep 2008) | 1 line

Creating release 2.5.0rc3

........

r6672 | p_lindheimer | 2008-09-09 08:46:14 -0700 (Tue, 09 Sep 2008) | 1 line

closes #3176 fix message to reflect that module will be downloaded but kept disable

........

r6675 | p_lindheimer | 2008-09-09 14:32:14 -0700 (Tue, 09 Sep 2008) | 1 line

tweak on freepbx_debug function to easily write out arrays

........

r6680 | sasargen | 2008-09-10 05:58:58 -0700 (Wed, 10 Sep 2008) | 1 line

fixes #3181 by adding value='yes' to checkbox tags

........

r6699 | sasargen | 2008-09-12 08:06:35 -0700 (Fri, 12 Sep 2008) | 1 line

basic fix of #3184 for ARI in 2.5

........

r6708 | p_lindheimer | 2008-09-13 15:04:03 -0700 (Sat, 13 Sep 2008) | 1 line

re #3191 fix uninitialized variables

........

r6725 | mickecarlsson | 2008-09-15 09:06:13 -0700 (Mon, 15 Sep 2008) | 1 line

Added menu choice for Swedish in framework

........

r6731 | p_lindheimer | 2008-09-15 20:38:35 -0700 (Mon, 15 Sep 2008) | 1 line

closes #3184 Secruity Issue allowing access of arbitrary files from authenticated ARI users with brute force cracking of a weak encryption key

........

r6746 | sasargen | 2008-09-16 08:20:31 -0700 (Tue, 16 Sep 2008) | 1 line

ARI: fixes #3202 by checking if any files selected

........

r6747 | sasargen | 2008-09-16 08:29:34 -0700 (Tue, 16 Sep 2008) | 1 line

ARI: fixes #3203 by removing checkbox when recording file does not exist

........

r6755 | sasargen | 2008-09-16 12:53:50 -0700 (Tue, 16 Sep 2008) | 1 line

ARI: disable delete button on callmonitor page when no recordings shown

........

r6756 | p_lindheimer | 2008-09-17 00:02:57 -0700 (Wed, 17 Sep 2008) | 1 line

fixes #3204 set localization domain when applying hooks, for gui hooks, implementation depends on standardization of the gui functions to start with modulename_ which is currently the standard although not required. Implemented so that the domain will only be set if the current target language localization directory exists for the module, otherwise it will fallback to amp since many past languages have put their localizations in the amp domain. They should move this to the proper module going forward

........

r6764 | p_lindheimer | 2008-09-17 11:29:39 -0700 (Wed, 17 Sep 2008) | 1 line

fixes #3209 Reports SECURITY VULNERABILITY by forcing all access to the CDR Reports section to flow through config.php

........

r6766 | p_lindheimer | 2008-09-17 18:27:30 -0700 (Wed, 17 Sep 2008) | 1 line

remove old unused code in drawListMenu and allow the Add to be optional

........

r6767 | p_lindheimer | 2008-09-17 19:21:08 -0700 (Wed, 17 Sep 2008) | 1 line

don't print out submit button in guielements if no fields form fields are generated

........

r6769 | p_lindheimer | 2008-09-17 22:15:04 -0700 (Wed, 17 Sep 2008) | 1 line

add 2.5.0 upgrade directory and remove the moved files re #3209

........

r6803 | p_lindheimer | 2008-09-19 08:47:01 -0700 (Fri, 19 Sep 2008) | 1 line

update CHANGES document before final release, and updated ChangeLog? for once

........

r6804 | p_lindheimer | 2008-09-19 08:48:03 -0700 (Fri, 19 Sep 2008) | 1 line

Creating release 2.5.0

........

................

r6976 | p_lindheimer | 2008-10-13 19:13:55 -0700 (Mon, 13 Oct 2008) | 109 lines

Merged revisions 6816-6975 via svnmerge from http://svn.freepbx.org/freepbx/branches/2.5

........

r6817 | p_lindheimer | 2008-09-19 20:28:54 -0700 (Fri, 19 Sep 2008) | 1 line

closes #2792 by removing the underlying array_reverse() for php 5+

........

r6821 | p_lindheimer | 2008-09-20 20:29:25 -0700 (Sat, 20 Sep 2008) | 1 line

fixes #3223 replace --directory with -C in tar command when unpacking modules so that versions of tar such as Busy Box v1.8.2 will run

........

r6834 | p_lindheimer | 2008-09-22 17:16:16 -0700 (Mon, 22 Sep 2008) | 1 line

fixes #3225 typo in rex var

........

r6844 | p_lindheimer | 2008-09-26 13:15:51 -0700 (Fri, 26 Sep 2008) | 1 line

fixes #3235 undefined variable when choosing the FOP tab

........

r6857 | p_lindheimer | 2008-09-26 20:14:40 -0700 (Fri, 26 Sep 2008) | 1 line

closes #3234 remove deprecated sqlite2 code

........

r6859 | p_lindheimer | 2008-09-26 22:19:05 -0700 (Fri, 26 Sep 2008) | 1 line

error not fail if retrieve_op_conf_from_mysql.pl can't be executed

........

r6864 | p_lindheimer | 2008-09-27 09:35:26 -0700 (Sat, 27 Sep 2008) | 1 line

closes #3242 gettext enclosure

........

r6869 | p_lindheimer | 2008-09-27 21:47:03 -0700 (Sat, 27 Sep 2008) | 1 line

fixes previous check to make sure retrieve_op_conf_from_mysql.pl is there and executable before running

........

r6875 | mickecarlsson | 2008-09-28 08:08:30 -0700 (Sun, 28 Sep 2008) | 1 line

Added Swedish language to core/framework, added amp.pot

........

r6876 | mickecarlsson | 2008-09-29 01:50:37 -0700 (Mon, 29 Sep 2008) | 1 line

Added missing strings to amp.pot, and to Swedish language for amp

........

r6878 | mickecarlsson | 2008-09-29 07:03:55 -0700 (Mon, 29 Sep 2008) | 1 line

Added russian translations for core in #3246

........

r6879 | p_lindheimer | 2008-09-29 08:03:56 -0700 (Mon, 29 Sep 2008) | 1 line

fixes #3247 was using display name as domain instead of module name to look for translation

........

r6880 | p_lindheimer | 2008-09-29 08:46:17 -0700 (Mon, 29 Sep 2008) | 1 line

fixes #3247 really this time, forgot to change binding from display name, this time it should be correct

........

r6884 | p_lindheimer | 2008-09-29 11:30:32 -0700 (Mon, 29 Sep 2008) | 1 line

fixes #3248 change translation domain to each destination's hosting module, and if nothing found, try amp and then the current module

........

r6901 | p_lindheimer | 2008-09-30 14:58:51 -0700 (Tue, 30 Sep 2008) | 1 line

more textdomain changes to make sure callbacks have the proper translation domain for the hosting modules

........

r6902 | p_lindheimer | 2008-09-30 14:59:27 -0700 (Tue, 30 Sep 2008) | 1 line

remove debug statement left in error

........

r6907 | p_lindheimer | 2008-10-01 09:46:48 -0700 (Wed, 01 Oct 2008) | 1 line

move header.php up before calls to _() in case gettext extension not loaded since header.php defines some dummy replacements

........

r6909 | p_lindheimer | 2008-10-01 22:19:08 -0700 (Wed, 01 Oct 2008) | 1 line

re #3221 remove duplicate code, also seems to be related to the referenced bug, IE6 was displaying the issue and this made it go away although IE7 was still having issues - this was on an isolated system, the issue is still not regularly reproducable

........

r6937 | p_lindheimer | 2008-10-05 09:35:26 -0700 (Sun, 05 Oct 2008) | 1 line

additional localization tweaks, if a module does not have an i18n, then use amp and not the modules's for certain 'hooks'

........

r6949 | mickecarlsson | 2008-10-11 10:03:11 -0700 (Sat, 11 Oct 2008) | 1 line

Enclosed test string in page.modules, updates swedish language

........

r6957 | mickecarlsson | 2008-10-12 06:46:24 -0700 (Sun, 12 Oct 2008) | 1 line

Fixed localization, updated .pot file and swedish language for admin

........

r6965 | mickecarlsson | 2008-10-12 12:29:21 -0700 (Sun, 12 Oct 2008) | 1 line

Corrected localization for reserved words for amp.po in swedish language

........

r6966 | mickecarlsson | 2008-10-12 13:13:40 -0700 (Sun, 12 Oct 2008) | 1 line

Fixes broken modules display in other languages than English

........

r6967 | p_lindheimer | 2008-10-12 13:25:25 -0700 (Sun, 12 Oct 2008) | 1 line

translations should be done by the calling functions of this classe, there are times these are used that we do NOT want it translated

........

r6968 | mickecarlsson | 2008-10-12 14:03:49 -0700 (Sun, 12 Oct 2008) | 1 line

Fixes translation issue in freepbx_reloadbar.php

........

r6974 | mickecarlsson | 2008-10-13 09:30:49 -0700 (Mon, 13 Oct 2008) | 1 line

New version of russian translation for amp

........

................