new file mode 100644

@@ -0,0 +1,173 @@

+<?php

+/**

+ *  Copyright (C) 2021  Double Bastion LLC

+ *

+ *  This file is part of Roundpin, which is licensed under the

+ *  GNU Affero General Public License Version 3.0. The license terms

+ *  are detailed in the "LICENSE.txt" file located in the root directory.

+ */

+

+session_start();

+

+ // header('Set-Cookie: PHPSESSID= ' . session_id() . '; SameSite=strict; Secure=true; HttpOnly=true;');

+

+if (isset($_POST['s_ajax_call']) && ($_POST['s_ajax_call'] == $_SESSION['validate_s_access'])) {

+

+    define('ACCESSCONST', TRUE);

+

+    require('db-connect.php');

+

+    $username = $_POST['username'];

+    $extenForExternal = $_POST['exten_for_external'];

+    $extenForExternalPass = $_POST['exten_for_ext_pass'];

+    $confExtension = $_POST['conf_extension'];

+    $confTag = $_POST['conf_tag'];

+    $wssServer = $_POST['wss_server'];

+    $webSocketAndPath = $_POST['web_sock_path'];

+

+    /**

+     *  Encrypt the user and the extension used for external access

+     */

+

+    // Extract the secret from the configuration file

+    $configfilestring = file_get_contents(dirname(__FILE__) . '/roundpin-config.php');

+

+    if (preg_match_all('[include|include_once|require|require_once]', $configfilestring) != 0) {

+

+        if (strpos($configfilestring, "'") !== false) {

+            $continit = explode("'", $configfilestring);

+            $configfilepath = $continit[1];

+        } elseif (strpos($configfilestring, "\"") !== false) {

+            $continit = explode("\"", $configfilestring);

+            $configfilepath = $continit[1];

+          }

+

+        $configfilelines = file($configfilepath);

+

+        if (count($configfilelines) != 0) {

+

+           foreach ($configfilelines as $keyfile => $valuefile) {

+

+              if (strpos($valuefile, "\$secret") !== false) {

+                  $secret_init = explode("'", $valuefile);

+                  $secretfin = $secret_init[1];

+              }

+           }

+        }

+

+    } else {

+

+        $configfilelines = file(dirname(__FILE__) . '/roundpin-config.php');

+

+        if (count($configfilelines) != 0) {

+           foreach ($configfilelines as $keyfile => $valuefile) {

+              if (strpos($valuefile, "\$secret") !== false) {

+                  $secretinit = explode("'", $valuefile);

+                  $secretfin = $secretinit[1];

+              }

+           }

+        }

+      }

+

+    // Encrypt the username, extension name, conference extension, conference label and WebSocket port and server path

+    $userExtenConfExt = $username . "|" . $extenForExternal . "|" . $confExtension . "|" . $confTag . "|" . $webSocketAndPath;

+    $ivsep = substr(sha1((string) mt_rand()), 0, 16);

+    $encryptpwdin = openssl_encrypt($userExtenConfExt, 'AES-256-CBC', $secretfin, false, $ivsep);

+    $finUserExtEncinit = $encryptpwdin.':'.$ivsep;

+    $finUserExtEnc = bin2hex($finUserExtEncinit);

+

+    // Build the external access link

+    $confAccessLinkEnc = "https://".$wssServer."/videoconference/external.php?param=".$finUserExtEnc;

+

+    // Get the id of the user for which we want to insert the external user data

+    $enabled = 1;

+    $query1 = $mysqli->prepare("SELECT id, userrole, username, enabled FROM app_users WHERE (userrole = 'admin' OR userrole = 'superadmin') AND BINARY username = ? AND enabled = ?");

+    $query1->bind_param("si", $username, $enabled);

+    $query1->execute();

+    $queryres = $query1->get_result()->fetch_assoc();

+    $userID = $queryres['id'];

+

+    // Check if the extension has already been introduced in the 'external_users' table

+    $query2 = $mysqli->prepare("SELECT id, userid, exten_for_external FROM external_users WHERE exten_for_external = ?");

+    $query2->bind_param("s", $extenForExternal);

+    $query2->execute();

+    $extqueryres = $query2->get_result()->fetch_assoc();

+    $linkauthorID = $extqueryres['userid'];

+    $extensionExists = $extqueryres['id'];

+

+

+    if ($extenForExternalPass != '' && $extenForExternalPass != "%20%20%20%20%20%20%20") {

+

+        // Encrypt the SIP password for the extension used for external access

+

+        $keypasssp = substr(sha1((string) mt_rand()), 0, 32);

+        $keysaltsp = openssl_random_pseudo_bytes(24);

+        $keyLengthsp = 80;

+        $iterationssp = 100;

+        $generated_keysp = openssl_pbkdf2($keypasssp, $keysaltsp, $keyLengthsp, $iterationssp, 'sha256');

+        $psswdaddedsp = bin2hex($generated_keysp);

+

+        if (!is_dir('../restr')) {

+            mkdir('../restr', 0700);

+        }

+

+        if (!is_dir('../restr/'.$username.'')) {

+            mkdir('../restr/'.$username.'', 0700);

+        }

+

+        if (!is_dir('../restr/'.$username.'/externalext')) {

+            mkdir('../restr/'.$username.'/externalext', 0700);

+        }

+

+        file_put_contents('../restr/'.$username.'/externalext/'.$extenForExternal, $psswdaddedsp);

+        chmod('../restr/'.$username.'/externalext/'.$extenForExternal, 0600);

+

+        $ivsp = substr(sha1((string) mt_rand()), 0, 16);

+        $encpwdinsp = openssl_encrypt($extenForExternalPass, 'AES-256-CBC', $psswdaddedsp, false, $ivsp);

+        $extenForExternalPassEnc = $encpwdinsp.':'.$ivsp;

+

+    } elseif ($extenForExternalPass == "%20%20%20%20%20%20%20") {

+

+              $queryselextpass = $mysqli->prepare("SELECT id, userid, exten_for_external, exten_for_ext_pass FROM external_users WHERE userid = ? AND exten_for_external = ?");

+              $queryselextpass->bind_param("is", $userID, $extenForExternal);

+              $queryselextpass->execute();

+              $extpassarr = $queryselextpass->get_result()->fetch_assoc();

+

+              $extenForExternalPassEnc = $extpassarr['exten_for_ext_pass'];

+

+    } elseif ($extenForExternalPass == '') {

+              $extenForExternalPassEnc = '';

+    } else { $extenForExternalPassEnc = ''; }

+

+    $date = date("Y-m-d H:i:s");

+

+    // Update or insert the data in the 'external_users' table

+    if ($extensionExists != '') {

+

+        if ($linkauthorID == $userID) {

+	    $updatequery = $mysqli->prepare("UPDATE external_users SET exten_for_ext_pass = ?, conf_extension = ?, conf_tag = ?, conf_access_link = ?, date_modified = ? WHERE userid = ?

+                                             AND exten_for_external = ?");

+	    $updatequery->bind_param("sssssis", $extenForExternalPassEnc, $confExtension, $confTag, $confAccessLinkEnc, $date, $userID, $extenForExternal);

+

+	    if ($updatequery->execute()) { $messagetosend = 'The data has been successfully saved to the database !'; } else { $messagetosend = 'Error while updating the data !'; }

+

+        } else { $messagetosend = 'A different user has already created a link for this extension. Please choose a different extension!'; }

+

+    } else {

+	    $insertquery = $mysqli->prepare("INSERT INTO external_users (userid, exten_for_external, exten_for_ext_pass, conf_extension, conf_tag, conf_access_link, date_added, 

+                                             date_modified) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");

+	    $insertquery->bind_param("isssssss", $userID, $extenForExternal, $extenForExternalPassEnc, $confExtension, $confTag, $confAccessLinkEnc, $date, $date);

+

+	    if ($insertquery->execute()) { 

+                $messagetosend = 'The data has been successfully saved to the database !';

+            } else { $messagetosend = 'Error while inserting the data into the database !'; }

+      }

+

+    $response = array('result' => $messagetosend);

+    echo json_encode($response);

+

+} else {

+    header("Location: ../login.php");

+}

+

+?>