Jonathan Rose 70b976f084 MixMontior: Add class authorization requirements to MixMonitor AMI commands ...

MixMonitor AMI commands StartMixMonitor and StopMixMonitor lacked class
authorization. StopMixMonitor now requires that the manager user either have
the call or system class authorization. StartMixMonitor is a slightly larger
issue since it can execute shell commands if the right arguments are passed
into it, and we consider this a permission escalation. A security release
will be issued for problem this shortly.

ASTERISK-23609 #close
Reported by: Corey Farrell

........

Merged revisions 415825 from http://svn.asterisk.org/svn/asterisk/branches/11
........

Merged revisions 415832 from http://svn.asterisk.org/svn/asterisk/branches/12


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@415834 65c4cc65-6c06-0410-ace0-fbb531ad65f3

2014-06-12 15:39:52 +00:00

..

confbridge

app_confbridge: Correct verification of conference name length

2014-06-04 07:27:21 +00:00

app_adsiprog.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:49:26 +00:00

app_agent_pool.c

app_agent_pool: Return to dialplan if the agent fails to ack the call.

2014-05-28 16:34:47 +00:00

app_alarmreceiver.c

Fix XML Document Validation Failure

2012-10-18 20:31:05 +00:00

app_amd.c

Doxygen Updates - Title update

2012-10-14 21:45:16 +00:00

app_authenticate.c

Update Asterisk's CDRs for the new bridging framework

2013-06-17 03:00:38 +00:00

app_bridgewait.c

uniqueid: channel linkedid, ami, ari object creation with id's

2014-03-07 15:47:55 +00:00

app_cdr.c

CDRs: Synchronize dialplan applications that manipulate CDRs with the engine

2014-01-12 22:13:12 +00:00

app_celgenuserevent.c

CELGenUserEvent: Fix error message from ast_json_pack

2013-11-12 16:34:31 +00:00

app_chanisavail.c

uniqueid: channel linkedid, ami, ari object creation with id's

2014-03-07 15:47:55 +00:00

app_channelredirect.c

Merge in the bridge_construction branch to make the system use the Bridging API.

2013-05-21 18:00:22 +00:00

app_chanspy.c

app_chanspy: Fix a test that was failing on account of r413551

2014-05-12 22:33:28 +00:00

app_confbridge.c

app_confbridge: Allow muting of users waiting to enter a ConfBridge

2014-06-05 14:49:20 +00:00

app_controlplayback.c

Add ControlPlayback manager action

2013-01-22 15:16:20 +00:00

app_dahdibarge.c

Opaquify ast_channel typedefs, fd arrays, and softhangup flag

2012-03-01 22:09:18 +00:00

app_dahdiras.c

app_dahdiras: Use waitpid instead of wait4.

2013-11-08 14:58:13 +00:00

app_db.c

Don't throw a spurious error when using DBdeltree

2013-02-14 03:49:52 +00:00

app_dial.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:49:26 +00:00

app_dictate.c

Clean up and ensure proper usage of alloca()

2012-07-31 20:21:43 +00:00

app_directed_pickup.c

PickupChan: Add ability to specify channel uniqueids as well as channel names.

2013-11-22 16:43:21 +00:00

app_directory.c

app_directory: Set variable indicating reason directory exited

2013-11-21 22:38:31 +00:00

app_disa.c

app_cdr,app_forkcdr,func_cdr: Synchronize with engine when manipulating state

2013-12-19 00:50:01 +00:00

app_dumpchan.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:49:26 +00:00

app_echo.c

Prevent Echo() from relaying control, null, and modem frames

2012-03-20 20:42:34 +00:00

app_exec.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

app_externalivr.c

Remove declaration of eivr_connect_socket because it no longer exists.

2012-06-20 11:47:12 +00:00

app_fax.c

Resolve a merge conflict

2013-05-29 02:26:17 +00:00

app_festival.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:49:26 +00:00

app_flash.c

Opaquify ast_channel typedefs, fd arrays, and softhangup flag

2012-03-01 22:09:18 +00:00

app_followme.c

uniqueid: channel linkedid, ami, ari object creation with id's

2014-03-07 15:47:55 +00:00

app_forkcdr.c

CDRs: Synchronize dialplan applications that manipulate CDRs with the engine

2014-01-12 22:13:12 +00:00

app_getcpeid.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:49:26 +00:00

app_ices.c

Doxygen Updates - janitor work

2012-09-21 17:14:59 +00:00

app_image.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

app_ivrdemo.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_jack.c

Fix dialplan function NULL channel safety issues

2014-03-27 19:21:44 +00:00

app_macro.c

Clean up and ensure proper usage of alloca()

2012-07-31 20:21:43 +00:00

app_meetme.c

app_meetme: Don't interrupt MOH for waitmarked users.

2014-05-22 16:19:13 +00:00

app_milliwatt.c

Replace GNU old-style field designator extensions to fix clang warnings

2012-04-04 18:08:28 +00:00

app_minivm.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:49:26 +00:00

app_mixmonitor.c

MixMontior: Add class authorization requirements to MixMonitor AMI commands

2014-06-12 15:39:52 +00:00

app_morsecode.c

Merged revisions 336717 via svnmerge from

2011-09-19 20:23:29 +00:00

app_mp3.c

Opaquification for ast_format structs in struct ast_channel

2012-02-24 00:32:20 +00:00

app_nbscat.c

Opaquification for ast_format structs in struct ast_channel

2012-02-24 00:32:20 +00:00

app_originate.c

Originated calls: Fix several originate call problems.

2014-04-18 16:44:48 +00:00

app_osplookup.c

Update Asterisk's CDRs for the new bridging framework

2013-06-17 03:00:38 +00:00

app_page.c

uniqueid: channel linkedid, ami, ari object creation with id's

2014-03-07 15:47:55 +00:00

app_playback.c

Check result of ast_var_assign() calls for memory allocation failure.

2013-08-06 08:36:15 +00:00

app_playtones.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_privacy.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

app_queue.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:49:26 +00:00

app_read.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_readexten.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

app_readfile.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

app_record.c

app_record: Add an option that allows DTMF '0' to act as an additional terminator

2013-12-05 23:40:38 +00:00

app_saycounted.c

Merged revisions 336717 via svnmerge from

2011-09-19 20:23:29 +00:00

app_sayunixtime.c

Say: If SAY_DTMF_INTERRUPT is set to an ast_true value, jump on DTMF

2013-11-14 20:32:45 +00:00

app_senddtmf.c

Add pause one second W dial modifier.

2012-09-28 18:27:02 +00:00

app_sendtext.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_setcallerid.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

app_skel.c

Add CLI configuration documentation

2013-02-15 13:38:12 +00:00

app_sms.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:49:26 +00:00

app_softhangup.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_speech_utils.c

Fix dialplan function NULL channel safety issues

2014-03-27 19:21:44 +00:00

app_stack.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:49:26 +00:00

app_stasis.c

Fix menuselect display for stasis modules.

2013-06-24 21:40:52 +00:00

app_system.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

app_talkdetect.c

Finalize ast_channel opaquification

2012-03-13 18:20:34 +00:00

app_test.c

Opaquification for ast_format structs in struct ast_channel

2012-02-24 00:32:20 +00:00

app_transfer.c

Documentation: doc fixes across various parts of the code for ASTERISK issues 23061,23028,23046,23027

2014-01-17 17:16:14 +00:00

app_url.c

Merged revisions 339777 via svnmerge from

2011-10-07 19:37:33 +00:00

app_userevent.c

ARI: Add ability to raise arbitrary User Events

2014-05-22 16:09:51 +00:00

app_verbose.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:49:26 +00:00

app_voicemail.c

Logger/CLI/etc.: Fix some aesthetic issues; reduce chatty verbose messages

2014-05-28 22:54:12 +00:00

app_voicemail.exports.in

Remove some symbol exports that got missed in the removal of global symbols.

2012-06-15 15:33:41 +00:00

app_waitforring.c

Multiple revisions 375993-375994

2012-11-07 19:15:26 +00:00

app_waitforsilence.c

Logger/CLI/etc.: Fix some aesthetic issues; reduce chatty verbose messages

2014-05-28 22:54:12 +00:00

app_waituntil.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

app_while.c

Clean up and ensure proper usage of alloca()

2012-07-31 20:21:43 +00:00

app_zapateller.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

enter.h

remove extraneous svn:executable properties

2005-11-29 18:24:39 +00:00

leave.h

remove extraneous svn:executable properties

2005-11-29 18:24:39 +00:00

Makefile

Moved core logic from app_stasis to res_stasis

2013-04-15 16:43:47 +00:00