David M. Lee 744556c01d security: Inhibit execution of privilege escalating functions ...

This patch allows individual dialplan functions to be marked as
'dangerous', to inhibit their execution from external sources.

A 'dangerous' function is one which results in a privilege escalation.
For example, if one were to read the channel variable SHELL(rm -rf /)
Bad Things(TM) could happen; even if the external source has only read
permissions.

Execution from external sources may be enabled by setting
'live_dangerously' to 'yes' in the [options] section of asterisk.conf.
Although doing so is not recommended.

Also, the ABI was changed to something more reasonable, since Asterisk
12 does not yet have a public release.

(closes issue ASTERISK-22905)
Review: http://reviewboard.digium.internal/r/432/
........

Merged revisions 403913 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 403917 from http://svn.asterisk.org/svn/asterisk/branches/11
........

Merged revisions 403959 from http://svn.asterisk.org/svn/asterisk/branches/12


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@403960 65c4cc65-6c06-0410-ace0-fbb531ad65f3

2013-12-16 19:11:51 +00:00

..

func_aes.c

Fix many issues from the NULL_RETURNS Coverity report

2012-05-04 22:17:38 +00:00

func_audiohookinherit.c

func_audiohookinherit: Document some missed sources.

2012-09-24 21:19:49 +00:00

func_base64.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

func_blacklist.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

func_callcompletion.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

func_callerid.c

Update Asterisk's CDRs for the new bridging framework

2013-06-17 03:00:38 +00:00

func_cdr.c

Parse arguments passed to the CDR_PROP function correctly

2013-09-30 19:58:19 +00:00

func_channel.c

func_channel, chan_pjsip: Add CHANNEL read function support for chan_pjsip

2013-12-11 13:06:30 +00:00

func_config.c

Fix func_config list entry allocation

2013-10-08 18:19:59 +00:00

func_curl.c

Have func_curl log a warning when a curl request fails.

2013-03-20 20:27:37 +00:00

func_cut.c

Clean up and ensure proper usage of alloca()

2012-07-31 20:21:43 +00:00

func_db.c

security: Inhibit execution of privilege escalating functions

2013-12-16 19:11:51 +00:00

func_devstate.c

Prevent exhaustion of system resources through exploitation of event cache

2013-01-02 18:11:59 +00:00

func_dialgroup.c

Fix incorrect usages of ast_realloc().

2013-09-10 18:05:47 +00:00

func_dialplan.c

Enable macros in 1.8 to find the next highest "h" extension in a context, like in 1.4.

2012-03-13 08:06:20 +00:00

func_enum.c

Allow ENUM query functions to report lookup errors

2011-08-09 17:08:33 +00:00

func_env.c

security: Inhibit execution of privilege escalating functions

2013-12-16 19:11:51 +00:00

func_extstate.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

func_frame_trace.c

ARI: Add recording controls

2013-08-06 14:44:45 +00:00

func_global.c

Check result of ast_var_assign() calls for memory allocation failure.

2013-08-06 08:36:15 +00:00

func_groupcount.c

Avoid cppcheck warnings; removing unused vars and a bit of cleanup.

2012-04-17 18:57:40 +00:00

func_hangupcause.c

Make the name of the "HangupCauseClear" application consistent

2012-08-18 01:34:50 +00:00

func_iconv.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

func_jitterbuffer.c

Merge in the bridge_construction branch to make the system use the Bridging API.

2013-05-21 18:00:22 +00:00

func_lock.c

security: Inhibit execution of privilege escalating functions

2013-12-16 19:11:51 +00:00

func_logic.c

Clean up and ensure proper usage of alloca()

2012-07-31 20:21:43 +00:00

func_math.c

memory leaks: Memory leak cleanup patch by Corey Farrell (first set)

2013-10-23 20:10:30 +00:00

func_md5.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

func_module.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

func_odbc.c

Fix misuses of asprintf throughout the code.

2012-08-21 21:01:11 +00:00

func_pitchshift.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

func_pjsip_endpoint.c

func_pjsip_endpoint: Add PJSIP_ENDPOINT function for querying endpoint details

2013-12-11 12:31:57 +00:00

func_presencestate.c

Multiple revisions 399887,400138,400178,400180-400181

2013-09-30 18:55:27 +00:00

func_rand.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

func_realtime.c

security: Inhibit execution of privilege escalating functions

2013-12-16 19:11:51 +00:00

func_sha1.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

func_shell.c

security: Inhibit execution of privilege escalating functions

2013-12-16 19:11:51 +00:00

func_speex.c

Doxygen Updates - janitor work

2012-09-21 17:14:59 +00:00

func_sprintf.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

func_srv.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

func_strings.c

Check result of ast_var_assign() calls for memory allocation failure (2).

2013-08-06 08:43:22 +00:00

func_sysinfo.c

Multiple revisions 361403,361412

2012-04-06 16:33:24 +00:00

func_timeout.c

Reverting r403311. It's causing ARI tests to hang.

2013-12-05 22:10:20 +00:00

func_uri.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

func_version.c

Fix documentation for ${VERSION(ASTERISK_VERSION_NUM)}.

2012-04-19 22:01:20 +00:00

func_vmcount.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

func_volume.c

Minor spelling fix to the VOLUME documentation.

2012-11-30 17:08:41 +00:00

Makefile

Title update

2012-10-14 21:56:13 +00:00