iamdoubz
65e777ab41
Headers (08 §2.4) on every response: CSP (connect-src also allows
WEBRTC_WS_URL's origin when set), nosniff, Referrer-Policy,
Permissions-Policy. The dark-mode bootstrap moved from an inline
<script> to /theme.js so script-src stays 'self'.
Phone ACL (08 §2.2): with sip.restrictPhonesToLocalNets, every desk
extension endpoint gets deny 0.0.0.0/0 and permit for each local and
extra net. The spec's snippet was wrong: contact_acl names acl.conf
sections, a pjsip type=acl is the global ACL (it would filter trunks),
and Contact-header rules let a NATed remote phone through. Browser
endpoints come through the reverse proxy and aren't filtered. Golden
case phone-acl. Settings → Security holds it, with the provisioning
switches.
PIN rules for PINs changed from the phone's voicemail menu, which went
around the api: externpasscheck = sp-vm-pincheck (in the Asterisk
image, same rules as isTrivialPin, a unit test keeps them in step) and
minpassword = 4. Accepted PINs reach the api through AMI
VoicemailPasswordChange and are stored; before, the next config write
silently put the old PIN back.
e2e m11-t1: no CSP violations across admin pages; Asterisk refuses a
REGISTER ("Not match Endpoint ACL") until the network is listed; from
the phone, 1111 is refused by the check script and 7391 is stored and
survives a later config write.
Task: M11-T1
21 lines
873 B
Bash
21 lines
873 B
Bash
#!/bin/sh
|
|
# Voicemail PIN check for PINs changed from the phone (app_voicemail externpasscheck).
|
|
# Args: mailbox context oldpin newpin. Prints VALID or INVALID. Same rules as the api
|
|
# (crypto/secrets.ts isTrivialPin): 4-10 digits, not one digit repeated, not a run like
|
|
# 1234 or 4321, not the extension repeated.
|
|
box=$1
|
|
pin=$4
|
|
case $pin in
|
|
'' | *[!0-9]*) echo INVALID; exit 0 ;;
|
|
esac
|
|
len=${#pin}
|
|
if [ "$len" -lt 4 ] || [ "$len" -gt 10 ]; then echo INVALID; exit 0; fi
|
|
first=$(printf %.1s "$pin")
|
|
if [ -z "$(printf %s "$pin" | tr -d "$first")" ]; then echo INVALID; exit 0; fi
|
|
case 01234567890 in *"$pin"*) echo INVALID; exit 0 ;; esac
|
|
case 09876543210 in *"$pin"*) echo INVALID; exit 0 ;; esac
|
|
rep=$box
|
|
while [ ${#rep} -lt "$len" ]; do rep=$rep$box; done
|
|
if [ -n "$box" ] && [ "$(printf %s "$rep" | cut -c1-"$len")" = "$pin" ]; then echo INVALID; exit 0; fi
|
|
echo VALID
|