Skip to content

Conversation

@hannes427
Copy link
Contributor

@hannes427
Copy link
Contributor Author

@kguptasangoma This is the new pull request without the i18n files.

@miken32
Copy link
Contributor

miken32 commented Apr 2, 2025

If this is intended as a security feature, it's very trivial to just remove the dash from the hidden input value. The server-side code should be checking for a leading dash and not allowing updates from UCP in that case.

Copy link
Contributor

@miken32 miken32 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

str_starts_with($settings['pwd'], '-') seems simpler to read at a glance than the regex, IMO

If the password is prefixed by '-', the password is locked (see https://github.com/asterisk/asterisk/blob/2d7948fa483c8703cf9948811fd67147f4d560d4/configs/samples/voicemail.conf.sample#L330 for details).

* Add server-side check in ucp/Voicemail.class.php check for leading '-'
  in the old password before password is saved
* Replaced regex in ucp/views/vmsettings.php by str_starts_with()
* Modified regex in functions.inc.php to allow voicemail passwords with leading '-' in admin-panel
If the password is prefixed by '-', the password is locked (see https://github.com/asterisk/asterisk/blob/2d7948fa483c8703cf9948811fd67147f4d560d4/configs/samples/voicemail.conf.sample#L330 for details).

* Add server-side check in ucp/Voicemail.class.php check for leading '-'
  in the old password before password is saved
* Replaced regex in ucp/views/vmsettings.php by str_starts_with()
* Modified regex in functions.inc.php to allow voicemail passwords with leading '-' in admin-panel

Bugfix FreePBX/issue-tracker#151
If the password is prefixed by '-', the password is locked (see https://github.com/asterisk/asterisk/blob/2d7948fa483c8703cf9948811fd67147f4d560d4/configs/samples/voicemail.conf.sample#L330 for details).

* Add server-side check in ucp/Voicemail.class.php check for leading '-'
  in the old password before password is saved
* Replaced regex in ucp/views/vmsettings.php by str_starts_with()
* Modified regex in functions.inc.php to allow voicemail passwords with leading '-' in admin-panel

Bugfix FreePBX/issue-tracker#151
@hannes427
Copy link
Contributor Author

@miken32 Thank you for your comments. Added a new PR with your modifications

* Removed displaying '-' from Voicemail Pin in UCP if password is
  locked
@kguptasangoma
Copy link
Member

hi @miken32 thanks for your feedback on this PR. Just want to know how does this PR now looks to you?

@miken32
Copy link
Contributor

miken32 commented Apr 21, 2025 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants