Browse code

Changed majority of files.

DoubleBastionAdmin authored on 30/11/2024 06:56:40
Showing 1 changed files
save-update-external-user-conf.php
History View file @ e8a619c
1 1 
deleted file mode 100644
... ... 
@@ -1,157 +0,0 @@
1 
-<?php
2 
-/**
3 
- *  Copyright (C) 2021  Double Bastion LLC
4 
- *
5 
- *  This file is part of Roundpin, which is licensed under the
6 
- *  GNU Affero General Public License Version 3.0. The license terms
7 
- *  are detailed in the "LICENSE.txt" file located in the root directory.
8 
- */
9 
-
10 
-session_start();
11 
-
12 
-if (isset($_POST['s_ajax_call']) && ($_POST['s_ajax_call'] == $_SESSION['validate_s_access'])) {
13 
-
14 
- define('ACCESSCONST', TRUE);
15 
-
16 
- require('db-connect.php');
17 
-
18 
-    $username = $_POST['username'];
19 
-    $extenForExternal = $_POST['exten_for_external'];
20 
-    $extenForExternalPass = $_POST['exten_for_ext_pass'];
21 
-    $wssServer = $_POST['wss_server'];
22 
-
23 
-    /**
24 
-     *  Encrypt the user and the extension used for external access
25 
-     */
26 
-
27 
-    // Extract the secret from the configuration file
28 
-    $configfilestring = file_get_contents(dirname(__FILE__) . '/roundpin-config.php');
29 
-
30 
-    if (preg_match_all('[include|include_once|require|require_once]', $configfilestring) != 0) {
31 
-
32 
-        if (strpos($configfilestring, "'") !== false) {
33 
-            $continit = explode("'", $configfilestring);
34 
-            $configfilepath = $continit[1];
35 
-        } elseif (strpos($configfilestring, "\"") !== false) {
36 
-            $continit = explode("\"", $configfilestring);
37 
-            $configfilepath = $continit[1];
38 
-          }
39 
-
40 
-        $configfilelines = file($configfilepath);
41 
-
42 
-        if (count($configfilelines) != 0) {
43 
-
44 
-           foreach ($configfilelines as $keyfile => $valuefile) {
45 
-
46 
-              if (strpos($valuefile, "\$secret") !== false) {
47 
-                  $secret_init = explode("'", $valuefile);
48 
-                  $secretfin = $secret_init[1];
49 
-              }
50 
-           }
51 
-        }
52 
-
53 
-    } else {
54 
-
55 
-        $configfilelines = file(dirname(__FILE__) . '/roundpin-config.php');
56 
-
57 
-        if (count($configfilelines) != 0) {
58 
-           foreach ($configfilelines as $keyfile => $valuefile) {
59 
-              if (strpos($valuefile, "\$secret") !== false) {
60 
-                  $secretinit = explode("'", $valuefile);
61 
-                  $secretfin = $secretinit[1];
62 
-              }
63 
-           }
64 
-        }
65 
-      }
66 
-
67 
-    // Encrypt the username and extension name
68 
-    $userAndExt = $username . "|" . $extenForExternal;
69 
-    $ivsep = substr(sha1(mt_rand()), 0, 16);
70 
-    $encryptpwdin = openssl_encrypt($userAndExt, 'AES-256-CBC', $secretfin, false, $ivsep);
71 
-    $finUserExtEncinit = $encryptpwdin.':'.$ivsep;
72 
-    $finUserExtEnc = bin2hex($finUserExtEncinit);
73 
-
74 
-    // Build the external access link
75 
-    $confAccessLinkEnc = "https://".$wssServer."/videoconference/external.php?param=".$finUserExtEnc;
76 
-
77 
-    // Get the id of the superadmin for which we want to insert the external user data
78 
-    $query1 = $mysqli->query("SELECT id, userrole, username, enabled FROM app_users WHERE userrole = 'superadmin' AND BINARY username = '$username' AND enabled = 1");
79 
-    $queryres = $query1->fetch_array();
80 
-    $userID = $queryres[0];
81 
-
82 
-    // Check if the extension has already been introduced in the 'external_users' table
83 
-    $query2 = $mysqli->query("SELECT id, userid, exten_for_external FROM external_users WHERE exten_for_external = '$extenForExternal'");
84 
-    $extqueryres = $query2->fetch_array();
85 
-    $linkauthorID = $extqueryres[1];
86 
-    $extensionExists = $extqueryres[0];
87 
-
88 
-
89 
-    if ($extenForExternalPass != '' && $extenForExternalPass != "%20%20%20%20%20%20%20") {
90 
-
91 
-        // Encrypt the SIP password for the extension used for external access
92 
-
93 
-        $keypasssp = substr(sha1(mt_rand()), 0, 32);
94 
-        $keysaltsp = openssl_random_pseudo_bytes(24);
95 
-        $keyLengthsp = 80;
96 
-        $iterationssp = 100;
97 
-        $generated_keysp = openssl_pbkdf2($keypasssp, $keysaltsp, $keyLengthsp, $iterationssp, 'sha256');
98 
-        $psswdaddedsp = bin2hex($generated_keysp);
99 
-
100 
-        if (!is_dir('restr')) {
101 
-            mkdir('restr', 0700);
102 
-        }
103 
-
104 
-        if (!is_dir('restr/'.$username.'')) {
105 
-            mkdir('restr/'.$username.'', 0700);
106 
-        }
107 
-
108 
-        if (!is_dir('restr/'.$username.'/externalext')) {
109 
-            mkdir('restr/'.$username.'/externalext', 0700);
110 
-        }
111 
-
112 
-        file_put_contents('restr/'.$username.'/externalext/'.$extenForExternal, $psswdaddedsp);
113 
-        chmod('restr/'.$username.'/externalext/'.$extenForExternal, 0600);
114 
-
115 
-        $ivsp = substr(sha1(mt_rand()), 0, 16);
116 
-        $encpwdinsp = openssl_encrypt($extenForExternalPass, 'AES-256-CBC', $psswdaddedsp, false, $ivsp);
117 
-        $extenForExternalPassEnc = $encpwdinsp.':'.$ivsp;
118 
-
119 
-    } elseif ($extenForExternalPass == "%20%20%20%20%20%20%20") {
120 
-
121 
-              $queryselextpass = $mysqli->query("SELECT id, userid, exten_for_external, exten_for_ext_pass FROM external_users WHERE userid = '$userID' AND
122 
-                                                 exten_for_external = '$extenForExternal'");
123 
-              $extpassarr = $queryselextpass->fetch_assoc();
124 
-
125 
-              $extenForExternalPassEnc = $extpassarr['exten_for_ext_pass'];
126 
-
127 
-    } elseif ($extenForExternalPass == '') {
128 
-              $extenForExternalPassEnc = '';
129 
-    } else { $extenForExternalPassEnc = ''; }
130 
-
131 
-
132 
-    // Update or insert the data in the 'external_users' table
133 
-    if ($extensionExists != '') {
134 
-
135 
-        if ($linkauthorID == $userID) {
136 
-	    $updatequery = $mysqli->prepare("UPDATE external_users SET exten_for_ext_pass=?, conf_access_link=? WHERE userid=? AND exten_for_external=?");
137 
-	    $updatequery->bind_param("ssis", $extenForExternalPassEnc, $confAccessLinkEnc, $userID, $extenForExternal);
138 
-
139 
-	    if ($updatequery->execute()) { $messagetosend = 'The data has been successfully saved to the database !'; } else { $messagetosend = 'Error while updating data!'; }
140 
-
141 
-        } else { $messagetosend = 'A different Superadmin has already created a link for this extension. Please choose a different extension!'; }
142 
-
143 
-    } else {
144 
-	    $insertquery = $mysqli->prepare("INSERT INTO external_users (userid, exten_for_external, exten_for_ext_pass, conf_access_link) VALUES (?, ?, ?, ?)");
145 
-	    $insertquery->bind_param("isss", $userID, $extenForExternal, $extenForExternalPassEnc, $confAccessLinkEnc);
146 
-
147 
-	    if ($insertquery->execute()) { $messagetosend = 'The data has been successfully saved to the database !'; } else { $messagetosend = 'Error while inserting data into the database!'; }
148 
-      }
149 
-
150 
-    $response = array('result' => $messagetosend);
151 
-    echo json_encode($response);
152 
-
153 
-} else {
154 
-    header("Location: roundpin-login.php");
155 
-}
156 
-
157 
-?>
Browse code

Created repository.

DoubleBastionAdmin authored on 26/01/2022 20:32:42
Showing 1 changed files
save-update-external-user-conf.php
History View file @ 06fbd76
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,157 @@
1 
+<?php
2 
+/**
3 
+ *  Copyright (C) 2021  Double Bastion LLC
4 
+ *
5 
+ *  This file is part of Roundpin, which is licensed under the
6 
+ *  GNU Affero General Public License Version 3.0. The license terms
7 
+ *  are detailed in the "LICENSE.txt" file located in the root directory.
8 
+ */
9 
+
10 
+session_start();
11 
+
12 
+if (isset($_POST['s_ajax_call']) && ($_POST['s_ajax_call'] == $_SESSION['validate_s_access'])) {
13 
+
14 
+ define('ACCESSCONST', TRUE);
15 
+
16 
+ require('db-connect.php');
17 
+
18 
+    $username = $_POST['username'];
19 
+    $extenForExternal = $_POST['exten_for_external'];
20 
+    $extenForExternalPass = $_POST['exten_for_ext_pass'];
21 
+    $wssServer = $_POST['wss_server'];
22 
+
23 
+    /**
24 
+     *  Encrypt the user and the extension used for external access
25 
+     */
26 
+
27 
+    // Extract the secret from the configuration file
28 
+    $configfilestring = file_get_contents(dirname(__FILE__) . '/roundpin-config.php');
29 
+
30 
+    if (preg_match_all('[include|include_once|require|require_once]', $configfilestring) != 0) {
31 
+
32 
+        if (strpos($configfilestring, "'") !== false) {
33 
+            $continit = explode("'", $configfilestring);
34 
+            $configfilepath = $continit[1];
35 
+        } elseif (strpos($configfilestring, "\"") !== false) {
36 
+            $continit = explode("\"", $configfilestring);
37 
+            $configfilepath = $continit[1];
38 
+          }
39 
+
40 
+        $configfilelines = file($configfilepath);
41 
+
42 
+        if (count($configfilelines) != 0) {
43 
+
44 
+           foreach ($configfilelines as $keyfile => $valuefile) {
45 
+
46 
+              if (strpos($valuefile, "\$secret") !== false) {
47 
+                  $secret_init = explode("'", $valuefile);
48 
+                  $secretfin = $secret_init[1];
49 
+              }
50 
+           }
51 
+        }
52 
+
53 
+    } else {
54 
+
55 
+        $configfilelines = file(dirname(__FILE__) . '/roundpin-config.php');
56 
+
57 
+        if (count($configfilelines) != 0) {
58 
+           foreach ($configfilelines as $keyfile => $valuefile) {
59 
+              if (strpos($valuefile, "\$secret") !== false) {
60 
+                  $secretinit = explode("'", $valuefile);
61 
+                  $secretfin = $secretinit[1];
62 
+              }
63 
+           }
64 
+        }
65 
+      }
66 
+
67 
+    // Encrypt the username and extension name
68 
+    $userAndExt = $username . "|" . $extenForExternal;
69 
+    $ivsep = substr(sha1(mt_rand()), 0, 16);
70 
+    $encryptpwdin = openssl_encrypt($userAndExt, 'AES-256-CBC', $secretfin, false, $ivsep);
71 
+    $finUserExtEncinit = $encryptpwdin.':'.$ivsep;
72 
+    $finUserExtEnc = bin2hex($finUserExtEncinit);
73 
+
74 
+    // Build the external access link
75 
+    $confAccessLinkEnc = "https://".$wssServer."/videoconference/external.php?param=".$finUserExtEnc;
76 
+
77 
+    // Get the id of the superadmin for which we want to insert the external user data
78 
+    $query1 = $mysqli->query("SELECT id, userrole, username, enabled FROM app_users WHERE userrole = 'superadmin' AND BINARY username = '$username' AND enabled = 1");
79 
+    $queryres = $query1->fetch_array();
80 
+    $userID = $queryres[0];
81 
+
82 
+    // Check if the extension has already been introduced in the 'external_users' table
83 
+    $query2 = $mysqli->query("SELECT id, userid, exten_for_external FROM external_users WHERE exten_for_external = '$extenForExternal'");
84 
+    $extqueryres = $query2->fetch_array();
85 
+    $linkauthorID = $extqueryres[1];
86 
+    $extensionExists = $extqueryres[0];
87 
+
88 
+
89 
+    if ($extenForExternalPass != '' && $extenForExternalPass != "%20%20%20%20%20%20%20") {
90 
+
91 
+        // Encrypt the SIP password for the extension used for external access
92 
+
93 
+        $keypasssp = substr(sha1(mt_rand()), 0, 32);
94 
+        $keysaltsp = openssl_random_pseudo_bytes(24);
95 
+        $keyLengthsp = 80;
96 
+        $iterationssp = 100;
97 
+        $generated_keysp = openssl_pbkdf2($keypasssp, $keysaltsp, $keyLengthsp, $iterationssp, 'sha256');
98 
+        $psswdaddedsp = bin2hex($generated_keysp);
99 
+
100 
+        if (!is_dir('restr')) {
101 
+            mkdir('restr', 0700);
102 
+        }
103 
+
104 
+        if (!is_dir('restr/'.$username.'')) {
105 
+            mkdir('restr/'.$username.'', 0700);
106 
+        }
107 
+
108 
+        if (!is_dir('restr/'.$username.'/externalext')) {
109 
+            mkdir('restr/'.$username.'/externalext', 0700);
110 
+        }
111 
+
112 
+        file_put_contents('restr/'.$username.'/externalext/'.$extenForExternal, $psswdaddedsp);
113 
+        chmod('restr/'.$username.'/externalext/'.$extenForExternal, 0600);
114 
+
115 
+        $ivsp = substr(sha1(mt_rand()), 0, 16);
116 
+        $encpwdinsp = openssl_encrypt($extenForExternalPass, 'AES-256-CBC', $psswdaddedsp, false, $ivsp);
117 
+        $extenForExternalPassEnc = $encpwdinsp.':'.$ivsp;
118 
+
119 
+    } elseif ($extenForExternalPass == "%20%20%20%20%20%20%20") {
120 
+
121 
+              $queryselextpass = $mysqli->query("SELECT id, userid, exten_for_external, exten_for_ext_pass FROM external_users WHERE userid = '$userID' AND
122 
+                                                 exten_for_external = '$extenForExternal'");
123 
+              $extpassarr = $queryselextpass->fetch_assoc();
124 
+
125 
+              $extenForExternalPassEnc = $extpassarr['exten_for_ext_pass'];
126 
+
127 
+    } elseif ($extenForExternalPass == '') {
128 
+              $extenForExternalPassEnc = '';
129 
+    } else { $extenForExternalPassEnc = ''; }
130 
+
131 
+
132 
+    // Update or insert the data in the 'external_users' table
133 
+    if ($extensionExists != '') {
134 
+
135 
+        if ($linkauthorID == $userID) {
136 
+	    $updatequery = $mysqli->prepare("UPDATE external_users SET exten_for_ext_pass=?, conf_access_link=? WHERE userid=? AND exten_for_external=?");
137 
+	    $updatequery->bind_param("ssis", $extenForExternalPassEnc, $confAccessLinkEnc, $userID, $extenForExternal);
138 
+
139 
+	    if ($updatequery->execute()) { $messagetosend = 'The data has been successfully saved to the database !'; } else { $messagetosend = 'Error while updating data!'; }
140 
+
141 
+        } else { $messagetosend = 'A different Superadmin has already created a link for this extension. Please choose a different extension!'; }
142 
+
143 
+    } else {
144 
+	    $insertquery = $mysqli->prepare("INSERT INTO external_users (userid, exten_for_external, exten_for_ext_pass, conf_access_link) VALUES (?, ?, ?, ?)");
145 
+	    $insertquery->bind_param("isss", $userID, $extenForExternal, $extenForExternalPassEnc, $confAccessLinkEnc);
146 
+
147 
+	    if ($insertquery->execute()) { $messagetosend = 'The data has been successfully saved to the database !'; } else { $messagetosend = 'Error while inserting data into the database!'; }
148 
+      }
149 
+
150 
+    $response = array('result' => $messagetosend);
151 
+    echo json_encode($response);
152 
+
153 
+} else {
154 
+    header("Location: roundpin-login.php");
155 
+}
156 
+
157 
+?>