Sometimes the call is authenticated, sometimes not.  Regardless, do you want any autheticated call to be able to run any arbitrary application including "system" on your switch?


On Apr 22, 2015, at 9:47 AM, Luis Azedo <luis.azedo@factorlusitano.com> wrote:

Couldn't this be a huge security vulnerability used to inject arbitrary commands into a session in FreeSWITCH?


isn't the call authenticated first ? anyway, an option can be added to sip_profile to allow this.
 
why don't you pass the call to mod_perl or Lua, and do all the
necessary lookups in the script? This shpouldn;t be a big deal to
implement, and much more safe than patching mod_sofia.

not an option, but thanks for suggesting