Voicemail wav file downloads
-
I purchased and installed FOP2, with the Voicemail Explorer add-on, on Friday, and have not been able to get Voicemail Explorer to play the message audio in the browser. When I looked at our Apache logs, I saw that requests for download.php were failing.
I did a little bit of looking into this (though I haven't gotten it working yet) and discovered a couple of problems: First of all, the Apache user needs to have read access to the voicemail directory and files. More importantly, it appears that download.php has no access control of any kind, other than that the file extension is wav. Unless I'm missing something, this PHP script will happily serve any wav file on the system that the Apache user can access - with no access control of any kind. Therefore, given the predictable filename scheme of Asterisk voicemail spools, it would be trivial to download the voicemail messages of any known mailbox on the system.
Am I missing something?
-
You are right, the script does not have a proper access control, and it also prevents other file types to be played altough they are valid (like WAV or gsm). The next beta release fixes all of that, but I have not packaged it yet. It also fixes some issues with the buffering that prevented the file to play if your network conditions or wav file was too long.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login