diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000..199e0e6 --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,15 @@ +name: Build and Publish + +on: + push: + branches: + - master + - develop + workflow_dispatch: + +jobs: + build: + uses: mikopbx/.github-workflows/.github/workflows/extension-publish.yml@master + with: + initial_version: "1.39" + secrets: inherit \ No newline at end of file diff --git a/App/Controllers/ModulePT1CCoreController.php b/App/Controllers/ModulePT1CCoreController.php index a747f17..8b710f5 100644 --- a/App/Controllers/ModulePT1CCoreController.php +++ b/App/Controllers/ModulePT1CCoreController.php @@ -5,12 +5,13 @@ * Proprietary and confidential * Written by Alexey Portnov, 11 2018 */ + + namespace Modules\ModulePT1CCore\App\Controllers; use MikoPBX\AdminCabinet\Controllers\BaseController; use MikoPBX\Modules\PbxExtensionUtils; use Modules\ModulePT1CCore\App\Forms\ModulePT1CCoreForm; use Modules\ModulePT1CCore\Models\ModulePT1CCore; -use MikoPBX\Common\Models\Providers; class ModulePT1CCoreController extends BaseController { @@ -54,11 +55,33 @@ public function indexAction(): void /** * Save settings AJAX action */ + /** + * Whitelist of fields allowed for mass assignment. + */ + private const ALLOWED_FIELDS = [ + 'interception_extension', + 'conference_extension', + 'get_peer_info_extension', + 'get_auth_extension', + 'get_statuses_extension', + 'get_cdr_extension', + 'listen_recordings_extension', + 'get_recordings_extension', + ]; + public function saveAction() :void { if ( ! $this->request->isPost()) { return; } + + // CSRF protection (compatible with Phalcon 4 and 5) + if ($this->di->has('security') && !$this->security->checkToken()) { + $this->flash->error('Invalid CSRF token'); + $this->view->success = false; + return; + } + $data = $this->request->getPost(); $record = ModulePT1CCore::findFirst(); @@ -66,24 +89,9 @@ public function saveAction() :void $record = new ModulePT1CCore(); } $this->db->begin(); - foreach ($record as $key => $value) { - switch ($key) { - case 'id': - break; - case 'checkbox_field': - case 'toggle_field': - if (array_key_exists($key, $data)) { - $record->$key = ($data[$key] === 'on') ? '1' : '0'; - } else { - $record->$key = '0'; - } - break; - default: - if (array_key_exists($key, $data)) { - $record->$key = $data[$key]; - } else { - $record->$key = ''; - } + foreach (self::ALLOWED_FIELDS as $key) { + if (array_key_exists($key, $data)) { + $record->$key = $data[$key]; } } diff --git a/App/Forms/ModulePT1CCoreForm.php b/App/Forms/ModulePT1CCoreForm.php index d221448..cabb6d7 100644 --- a/App/Forms/ModulePT1CCoreForm.php +++ b/App/Forms/ModulePT1CCoreForm.php @@ -9,13 +9,7 @@ namespace Modules\ModulePT1CCore\App\Forms; use Phalcon\Forms\Form; -use Phalcon\Forms\Element\Text; -use Phalcon\Forms\Element\Numeric; -use Phalcon\Forms\Element\Password; -use Phalcon\Forms\Element\Check; -use Phalcon\Forms\Element\TextArea; use Phalcon\Forms\Element\Hidden; -use Phalcon\Forms\Element\Select; class ModulePT1CCoreForm extends Form diff --git a/App/Views/index.volt b/App/Views/index.volt index 3881180..117b731 100644 --- a/App/Views/index.volt +++ b/App/Views/index.volt @@ -1,6 +1,10 @@