* customer_id filter is now possible, which behaves the same as the
existing contract_id. This is to add consistency as filtering by
customer_id is available in other endpoints
Change-Id: I1577d06133f9629c363940a4e8d2fb8012336e21
* rtcengine related logic and apps is now removed
* remove /api/rtcapps endpoint
* remove /api/rtcnetworks endpoint
* remove rtcengine relations from resellers such as
enable_rtc flags
* remove rtcengine related API tests
* remove rtcengine and comx related libraries
* remove csc webphone ui app
* remove webrtc related selenium tests
* remove rtcengine flags from /api/capabilities
Change-Id: I83a4b0457fac2e0df23d267f8dbc82841dfb3001
* target selection for chained routes in BillingNetworks is now
performed based on the account that $c->stash->{close_target}
can be already set, and it's used if defined instead of the
explicit target
* add NGCP::Panel::Utils::Navigation::select_back_target()
* NGCP::Panel::Utils::Navigation::back_or() now uses internally
select_back_target()
Change-Id: If6ca47a776896db48955a04f544731dc87c59aa1
* the password reset via API now uses webusername instead of
wrongly used username to fetch the subscriber
Change-Id: Ib2ed042382963f13d73619acd48a588f3874c25b
for deployments that expose panel/csc via a proxy,
the auto-generated base url printed in emails can
be unreachable. we therefore introduce the option
to explicitly specify a base url to use.
it will support an sprintf pattern with individual
params for eg.:
- protocol scheme
- domain part
- port
- base url path
Change-Id: I6a9ca23126c669d249ef7f3e092cae0161235ebe
* Call forwardings related internal usr preferences are now
distinct per call forward type (maximum 1 record per call
forward type, if at least one forwarding for this type exists).
This change is meant to address the issue when there are >1000
call forwardings per subscriber, which leads to performance
issues. Other components (kamailio) only uses this preference
as a boolean to check if there are call forwardings at all per
type, therefore, more than one preference, per type, per subscriber
is not needed.
Change-Id: Iffa475700a74f56eff67400ce9b57092018a14a0
* show the correct error message when a peer_auth preferences are
modified for a disabled peering server
Change-Id: Ibd710d142066c9622932992c8a60ec0d7f7674e1
* The succesful password recovering redirects to https://<host>/ which is translated to /#/login on CSC page.
Change-Id: If4e7ae510396e3852319c7e5c9d4915fdd214e95
* Contract default sound set - subscriber propagation for cases:
- New customer sound set is created as default.
- Customer sound set is changed to default.
- New subscriber creation - setting contract default sound set id.
* The mentioned cases were implemented for both UI and API.
Change-Id: Ia4733c972ae388d3457d0336e3f85b85eec6e9a2
* /login_jwt now accepts "jwt" key with an existing valid JWT as the
value
* upon successful authentication with the token a new token with
prolonged expiration time is issued for the authenticated user
and returned in the JSON response
* add "expires" value in the JSON response that contains a timestamp
integer when the issued token expires
* fix encode_json() calls formatting
* most of JWT related error messages are now appear in the log as INFO
instead of ERROR as they are not related to the system errors
Change-Id: Ie8e04534c8819dc756b3c64ebc4432ce442a1d31
* 'location' field is now optional, if not filled it it will always
default to an empty string instead of null. This is required for the
new mode 'forward' that has no use for this field. If the field
is empty in any other mode like 'add' or 'replace', the entry
will be skiped by the logic.
Change-Id: Ia964c3bb272c9772c51b836ac2418ee4cd7b7f42
WHAT: This fix allows the options: (a) Voicemail greeting "temp", and (b) Voicemail greeting "greet" to be displayed within Subscriber Preferences -> "Voicemail and Voicebox" on Admin Panel (Perl-based). Hence, an Admin can load 'greet' and 'temp' prompts via Admin Panel, similarly as 'unavail' and 'busy' options.
WHY: 'greet' and 'temp' options were added to be managed via API, but they were not available on Admin Panel.
Change-Id: Ie2d18f4d9a8e8369f3bbcb8593848ce6ee4b7d32
* Fetch recording_metakeys caller/callee for the certain record id(call).
* Add caller/callee fields to the resource and form.
* Frefetching recording_metakeys for the call recording.
Change-Id: I767ea32e19edfd7cbbc74956200343f680fdb2b4
this fix addresses regression reported by dominik:
* $resource{_password}/{_webpassword} cannot be set before the
form validation as they are effectively removed by it,
causing /api/susbcribers returning no passwords at
all for 'subscriber' roles
* Having them after the patch makes no sense either as next
resource_from_item call will effectively remove them again (in PATCH)
(cherry picked from commit 5e9066c4fb)
Change-Id: I88c9ec40843f1e9a6983952b96c0b0e70fbb1bb1
* An attempt to change own role, login, flags
(except for can_reset_password) now returns
403 Forbidden, User cannot modify own permissions
* POST checks if the admin has necessarry permissions
to create another admin
* PUT/PATCH changing own role is now forbidden
* PUT/PATCH changing other's admin role now checks permissions
* DELETE checks role permissions
Change-Id: I990609985ae9cab6213cf47f5f5c8afba2efdda3
This reverts commit 5e9066c4fb.
This implementation breaks:
* $resource{_password}/{_webpassword} cannot be set before the
form validation as they are effectively removed by it,
causing /api/susbcribers returning no passwords at
all for 'subscriber' roles
* Having them after the patch makes no sense either as next
resource_from_item call will effectively remove them again (in PATCH)
Change-Id: I0e8389e8ab34ad72f1b87a684daba77f1030f8ba
* admin users with is_master = 0, cannot see other admin users
(this includes system users) and brings the is_master flag
to the common behaviour
* ccareadmin, ccare users can now access te UI Admins page
as well as /api/admins but they are limited to see/manage
only themselves
* admin users cannot see system users (UI/API)
* reseller users cannot see system/admin users (UI/API)
* admin users cannot modify their own role and flags except for:
email, password, can_reset_password (UI/API)
* UI edit form now does not render fields that are not meant to be
modified by a user (exception: "login")
Change-Id: I82e1946437fd2ec4651abd24074470c695a40582
- Optional "role" parameter is added for POST PUT PATCH.
If "role" is provided then the passed flags are ignored and are applied internally by the server according to the provided role.
If "role" is not provided then the former flags based approach is applied.
Change-Id: Ib6e591ff6dc50122e0ec49a348153ca820fc2e03
- Add Role column on /administrator table
- Add Role dropdown input on /administrator/:id/edit
- Add Role dropdown input on /administrator/create
- Implements logic to resolve flags and role id params:
1. role_id is passed(create/edit) then flags will be overrided according to the concrete role.
2. role_id is not passed(create/edit) then flags will be checked to determine role id according to the concrete flags pattern:
Role | Flags
----------- ---------------------------------
system | is_system = 1,
admin | is_superuser = 1
reseller | is_superuser = 0
ccareadmin | is_ccare = 1, is_superuser = 1
ccare | is_ccare = 1, is_superuser = 0
lintercept | lintercept = 1
Change-Id: Ia923a47f664a162d78a06efcc006f84dcd08701d
a multitude of issues popped after introducing bcrypted
webpasswords in the database. most recently the PATCH /api/susbcribers
rail was reported to reset the webpassword unintentionally.
subscriber login fails afterwards, which is a severe issue.
the bugs are adressed by this refactorings. the change also
introduces a global variable
$NGCP::Panel::Utils::Auth::ENCRYPT_SUBSCRIBER_WEBPASSWORDS
to control encrypting webpasswords. it is still enabled as of now,
but it's worth to consider disabling it. there other ways to have
a "cost" for an authentication request, eg. adding a simple
sleep(1sec).
Change-Id: I2d47d54a2d83568546ffdd2b211337a5f56be3a2
- role_id is taken from billing.acl_roles and written into the billing.admins table when a new admin user is created/updated via UI/API. This is the first step towards the role based admin user handling.
Change-Id: I0804379cbbcab174cebbb292397a39cb3ea01a31
follow up on TT#147151 (fast loading/paging/searching panel
datatables), which broke restapi tests.
Change-Id: I799cb9087b9405c71dec4c690e7a7bab5dfdbdde
* decode utf8 on multipart/form-data request
since we encode the json for this content
type, and the fax body gets double encoded
and ends up wrong
Change-Id: I50d10879e5fe1ba99141e76d311641fcd5d568a1
* Fix for language solving for API requests. Changed the sequence of language choosing:
1. Request parameter "lang" for API and UI.
2. Cookie value "ngcp_panel_lang" for UI only.
3. User agent/browser language for API and UI.
Change-Id: Id5d814deead22eb7e2908fdc742b0c8474314d49
query refactoring an rowcount clipping for UI datatables
that are slow when using millions of subscribers:
contacts
customers
contracts
subscribers
billing profiles
billing networks
billing profile packages
Change-Id: Ia50e3aa52684772548569b6908f0cbc08395a5a7
* "subscriber" role can now retrieve own autoattendant data. This is needed for the CSC interface.
Change-Id: Id10b302205fe458d5793ae8f7bd9201233f9a0d4
* Admins with is_system and is_superuser are able to see the items for all roles.
* Admin is able to see own journal.
Change-Id: I3e5d459b08ff7ef218220f1ae11974351121c489
the POST /api/provicioningtemplates/<reseller>/<template>
request will accept text/csv content type to provision
many susbcribers at once.
Change-Id: I59079ba8f2bacc0ce2b1367d2bd1a7251cf4763c
provisioning templates with their dynamic forms
can be executed by a entityitem POST request, ie.
POST /api/provicioningtemplates/<reseller>/<template>
or
POST /api/provisioningtemplates/<readonly template>
Change-Id: I77f6c9d42e1afdb49635d3f11e4d73bcf6269605
* vmnotify() now accepts cli and uuid arguments
* API handling of voicemails is now improved to:
- send a notify if the item's INBOX/Old has been changed
- correctly process DELETE to send vmnotify after the
item's removal
Change-Id: Ic00ae825cf091bce273e55aa37cd0a7ac80d8b0f
* domains do not use billing.domain_resellers table anymore
but instead the new domains.reseller_id field. That is
to remove the unneeded many<>many relation through the
additional table where the actual logic only supports
one(reseller) to many(domains) relation
Change-Id: I1b681543baf1901f19e10c2f6210e4cf6eeb8fbe
* switch to 'populate' instead of using
'insert' for each destinations, sources,
times, bnumbers, mappings and CF preferences
* add API->check_patch_op_add_only - to check if
the patch contains only "add" operations
* improve /api/cfmappings, if all PATCH operations
are "add" then the existing records are not
fetched and not recreated, enabling very new mapping
inserts
Change-Id: I0b4e71565c11771026dbbc000aa57b2a613409fa
the /api/provisionintemplates rail provides the
operations to create, edit and delete "provisioning
templates" know from the "batch provisioning" feature
of admin panel.
these templates can also be defined in config.yml,
while it is however only possible to edit templates
stored in the database.
executing a template and/or uploading a .csv for bulk
execution will be available in a separate part.
Change-Id: If8627327270edfce5bca1be3b1f777c1bd44e90f
The modern browsers (except Safari) supports 'Sec-Fetch-Dest':
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Dest
In theory we can remove the current 'framed session' storage completely,
but Safari will not be supported. Let's expand the current logic to provide
extra protection here to backport the commit to mr9.5+.
Change-Id: I9c070f77f427c81581f4d9ceeb1a57b274d77819
* kamailio.sems_registrations now uses
kamailio.lcr_gw.id -> peer_host_id
kamailio.subscriber.id -> subscriber_id
for foreign keys consistency withing the same database
Change-Id: I4722729fdee07eb2a153473e85d64faa46eedca5
We need to de-register all subsequent peering hosts located under
the peering group being deleted.
Change-Id: I50bc25932e59d6b918f65c6525f2631cb9868fe4
We need to add an improvement, which fulfills the work of the
registration mechanism for SIP peerings.
Not only do we add here a registration tirggering for peerings,
but also a 'type' is introduced, which is mostly needed for XMLRPC
commands being sent towards SEMS, to let it understand to whom the $sid is related to.
Plus a list of improvements:
- de-register peering host on deletion ;
- de-register peering host on disable / register of peering host on enable ;
Change-Id: I035dfadf6709acb4d106a70f6124f024e719044f
Throw descriptive error for attempt to create Customer with Template
that does not belong to Contact’s Reseller. Cover the case when the
Template belongs to System Contact (with no Reseller).
Error example:
'subscriber_email_template_id' with value '1' does not belong to
Reseller '1' that is assigned to Customer's Contact '1'
Change-Id: Iffcef0339afc4490ecba81d4667cbb9225766af4
* 'webpassword' field is now also validated for invalid
(non-ascii) characters
* Fix multiple APP input field validation erros to comma joined.
* Adjust 'webpassword' field validation errors to have better
readability when there are multiple validation errors
Change-Id: I21536f97a4da78cc5192a3abd8cd5adef1b819ec
* webpassword field was unconditionally deleted
in API GET and DELETE methods, it now relies
on resource_from_item for the common approach
Change-Id: I703158fd2022b49a49470db28cb22f37e613f841
* PATCH: password fields are not removed when
resource is created for apply_patch(), they
are removed under the same condititions later
when hal is generated, that is to ensure that
admin users without the 'show_passwords' flag
as well as subscribers will not run into situation
when they use PATCH and cannot apply it for
"path": "/password" or/and "path": "/webpassword",
as they were removed before apply_patch()
* rework encrypted webpassword detection.
webpasword is detected as encrypted if its length
is 54 or 56 and it contains at least one '$' char,
there is a chance for false positive detection when
a user provides with a plain-text password with the
same pattern but it's very unlikely, as well as
since mr8.5 webpasswords are expected to be encrypted,
and moreover worth case scenario is that the
plain-text password will not be returned to the user
Change-Id: I8ea739cbf728b2134f3ce00cee29da42ab3fb4a3
* Login CSC v2 button is shown on the subscriber's master
data page if www_admin.http_csc.csc_js_enable == 1 or 2
* When the login is triggered an auth token
is generated internally followed by a redirect to
CSC as /?a=auth_token
* move generate_auth_token() into Utils/Auth
* improve generate_auth_token() arguments support
* add /api/authtokens error handling
Change-Id: Idd65400bf8ce6ce48979c736f6a199fb567ffaa4
It is much more usable to see the debug information as URLs:
> Jul 22 08:24:53 sp1 ngcp-panel: DEBUG: *** New GET request on path: /
> Jul 22 08:24:53 sp1 ngcp-panel: DEBUG: *** New GET request on path: /subscriber
> Jul 22 08:24:53 sp1 ngcp-panel: DEBUG: *** New GET request on path: /subscriber/ajax
Instead of Catalyst oriented way:
> Jul 22 08:24:53 sp1 ngcp-panel: DEBUG: *** New GET request on path:
> Jul 22 08:24:53 sp1 ngcp-panel: DEBUG: *** New GET request on path: subscriber
> Jul 22 08:24:53 sp1 ngcp-panel: DEBUG: *** New GET request on path: subscriber/ajax
Change-Id: I38699152e232c5f5aa2ef218db9bf61c692bbf33
It was close to impossible to read ngcp-panel debug log due to:
* missing clear marker of the start reuqest processing, use '***' once only
* some personal markers (like '+++++++') have been removed as they have no
meaning for other developers. Let's remove the personal markers and work to
make the panel debug log well readable for all developers.
Change-Id: I69faff3ab2258fc156e88c7b8da0edfef14c3e6e
* /login_jwt is now the only endpoint to issue JWT tokens
* JWT token admin/subscriber is provided based on the
NGCP_REALM/NGCP_API_REALM fcgi env values
(e.g.: https://localhost:1443/login_jwt = admin JWT token and
https://localhost/login_jwt = subscriber JWT token)
* Authorization: Bearer a= prefix is deprecated
* Clients cannot use subscriber JWT token to access admin
NGCP_API_REALM https://localhost:1443/api/...
and vice-versa
Change-Id: I46edf4c7aaf7bb835dc4ac6b7535aa2d6b5ac136
* the extra packing of the secret key during encode/decode
conflicts with the API v2 implementation
* move JWT "typ" from the payload to the header
Change-Id: Ica5822d810d6eaf7b3ae017f7037f25637b6f861
* the endpoint will receive "type" (expires|onetime)
and "expires" (positive integer representing seconds)
* type will define the expiray method for the token;
onetime: the token expires as soon as it's used, or
after "expires" seconds if not used
expires: the token can be used multiple times until
it expires according to the "expires" param value
* login_jwt endpoint for generating the JWT token for
subscribers has been enhanced to accept the "token"
param, containing the token generated using the
/api/authtokens endpoint
* admin_login_jwt endpoint for generating the JWT token
for admins has been enhanced to accept the "token"
param, containing the token generated using the
/api/authtokens endpoint
* login_jwt and amin_login_jwt will respond with 403
"Forbidden" if the token role stored in Redis does
not match the role of the user that generated it
* /api/authtokens is hidden from documentation for now
Change-Id: I4eb76c2b08f2e24774fa84ba0ccf7412ce8670e8
* add additional centralised checks for inactive and read_only users.
* use_userdata_from_session=0 now for all auth realms to cause the data
re-fetched from the database, to avoid scenarios when a user is set
as inactive or read_only and UI keeps using the cached data.
the change only affects cookie and JWT subscriber based sessions
as in all other cases, the auth data is fetched from the storage regardless.
* add is_active=1 flag for the internal 'system' role, as otherwise
access would be permanently denied for it.
* default 403 error for denied api requests is changed to "Forbidden"
instead of "Forbidden path".
Change-Id: I1d6d3c765ca8e017e11845c1f5260243a3963c3b
* sip_lcr_reload is now called after "commit" in all API endpoints,
to correctly reflect updated DB changes. It was correct in
/api/peeringrules POST but not correct in DELETE, as well as
also not correct in /api/peeringservers and /api/peeringgroups
* sip_domain_reload does not check if the domain is successfully
reload in kamailio proxy as is logic is redundant, it fails
however if domain reload XMLRPC request failed on any available
proxy servers. Another reason is by default tcp_conn_wq_max
in kamailio-proxy is 32KB by default and that causes an impact
when domain.dump XMLRPC is used on very large domain sets (600+),
as well as sip_domain_reload has improved performance with the removed
XMLRPC domain.dump body parsing.
Change-Id: I17c5718198b06b1ce78b2654f3d7c3bd2830f60b
* xmlrpc lcr.reload request is now sent after the transaction
is committed, otherwise the reload operation is performed without
the newly added changes in the peering rules
Change-Id: I728605a8d277b00d02a3f864c84f172306f7b090
* upon pressing the button, a new session object
with selected subscriber's details will be inserted
in Redis, and also a new ngcp-panel_subscriber
cookie will be created containing the session id
of the previously created session object; then
the user will be redirected to CSC v1 address
where the selected subscriber will be authenticated
based on the cookie and Redis info
* the new button will be available for admin,
reseller, ccare and ccareadmin roles
Change-Id: I03952efe4abe18e61884859c466d700a7885ead4
* /api/platforminfo does not have its own endpoint file
and therefore, does not appear in the rendered documentation.
it only supports GET method and renders the template file.
the endpoint is designed to provide with the prerendered JSON
data containing the current platform configuration.
* /api/platforminfo supports both authenticated and anonymous
requests, where based on that, the template provides with
the corresponding info withing the current scope.
Change-Id: Idc8138595eda2c14e7f8dc7ed97cc50039fd1adc
* the new filter params works as follows:
* if start_time is provided, recordings
with start time greater than provided value
are displayed
* if end_time is provided, recordings
with end time less than provided value
are displayed
Change-Id: Ie9cfb88141506581e2b724d4502b88091f9c7a02
* Replace wrong usage of 'reseller_id' filter
for missed templates resultsedl use 'id'
instead, because the query is made directly
on resellers table
Change-Id: I85bdcda79168979c8b1bb0503ab7bba91c5f8a78
* give access to subscribers roles to see,
create and update own registrations
* subscriberadmins can manage all registrations
of subscribers under same customer
Change-Id: I643121da901b0ed99fc718106a1632da4e1e1936
The fix has been created by Gerhard Jungwirth three years ago for
branch 'mr5.5' and was not merged into branch 'master'.
It is a follow up master commit to address customer ticket TT#82306.
The cherry-pick has been done AS IS, with one small trivial resolution:
> + my $is_pbx_customer = $c->stash->{billing_mapping}->product->class eq "pbxaccount";
> my $base_number;
>
> ++<<<<<<< HEAD
> + if($subscriber->contract->product->class eq "pbxaccount") {
> ++=======
> + if($is_pbx_customer) {
> ++>>>>>>> 239d4a385... TT#44168 create additional form for subadmin non-pbx subscriber edit
Change-Id: Ie242c4ad44fc21319cdaa29dcca423fe241aab20
(cherry picked from commit 239d4a3859)
Kirill Solomko
Alexander Lutay
Rene Krenn
Oleksandr Duts
Javier Rodriguez
Michael Prokop
Flaviu Mates
Donat Zenichev
Victor Tsvetov
Gerhard Jungwirth