For most modules that interacted with app_macro, this change is limited
to no longer looking for the current context from the macrocontext when
set. Additionally, the following modules are impacted:
app_dial - no longer supports M^ connected/redirecting macro
app_minivm - samples written using macro will no longer work.
The sample needs a re-write
app_queue - can no longer a macro on the called party's channel.
Use gosub which is currently supported
ccss - no callback macro, gosub only
app_voicemail - no macro support
channel - remove macrocontext and priority, no connected line or
redirection macro options
options - stdexten is deprecated to gosub as the default and only
pbx - removed macrolock
pbx_dundi - no longer look for macro
snmp - removed macro context, exten, and priority
ASTERISK-30304
Change-Id: I830daab293117179b8d61bd4df0d971a1b3d07f6
Correct typos of the following word families:
password
excludes
undesirable
checksums
through
screening
interpreting
database
causes
initiation
member
busydetect
defined
severely
throughput
recognized
counter
require
indefinitely
accounts
ASTERISK-29714
Change-Id: Ie8f2a7b274a162dd627ee6a2165f5e8a3876527e
An admin can configure app_minivm with an externnotify program to be run
when a voicemail is received. The app_minivm application MinivmNotify
uses ast_safe_system() for this purpose which is vulnerable to command
injection since the Caller-ID name and number values given to externnotify
can come from an external untrusted source.
* Add ast_safe_execvp() function. This gives modules the ability to run
external commands with greater safety compared to ast_safe_system().
Specifically when some parameters are filled by untrusted sources the new
function does not allow malicious input to break argument encoding. This
may be of particular concern where CALLERID(name) or CALLERID(num) may be
used as a parameter to a script run by ast_safe_system() which could
potentially allow arbitrary command execution.
* Changed app_minivm.c:run_externnotify() to use the new ast_safe_execvp()
instead of ast_safe_system() to avoid command injection.
* Document code injection potential from untrusted data sources for other
shell commands that are under user control.
ASTERISK-27103
Change-Id: I7552472247a84cde24e1358aaf64af160107aef1
Mike Bradeen
Josh Soref
Corey Farrell
Richard Mudgett
Matthew Jordan