Couldn't this be a huge security vulnerability used to inject arbitrary commands into a session in FreeSWITCH?
On Wednesday, April 22, 2015, Luis Azedo <luis.azedo@factorlusitano.com> wrote:
Hi,
i need a inline custom action passed with an INVITE msg with a replaces header
or a better to use this scenario.
right now, for calls with replaces header there is support for sla,
intercept and attendant transfer.
my problem is that intercept requires the bridge_uuid which is not set
on one leg calls (on hold playing music) so the intercept condition
won't be hit.
the attendant transfer takes app/data applies and then hangs up the call.
i need a simple answer,intercept:(sip->sip_replaces->rp_call_id)
instead of bridge_uuid.
i tried to set signal_bond and originate_signal_bound on the channel
to see if i could bypass this, but with no luck.
i created a small patch that i am attaching here with the hope that
FreeSWITCH will look and possibly merge it.
Best