voicemail and recording portal

[kevsworld]

********************************************************************
* PBX in a Flash BRONZE Daemon Status *
********************************************************************
* Asterisk * ONLINE * Dahdi * ONLINE * MySQL * ONLINE *
* SSH * ONLINE * Apache * ONLINE * Iptables * ONLINE *
* Fail2ban * ONLINE * IP Connect* ONLINE * Ip6tables * ONLINE *
* BlueTooth * ONLINE * Hidd * ONLINE * NTPD * ONLINE *
* Sendmail * OFFLINE * Samba * OFFLINE * Webmin * ONLINE *
* Ethernet0 * ONLINE * Ethernet1 * N/A * Wlan0 * N/A *
********************************************************************
* PBX in a Flash Version : 1.7.5.5
* FreePBX Version : 2.6.0.2
* Running Asterisk Version : Asterisk 1.6.2.9
* Asterisk Source Version : 1.6.2.9
* Dahdi Source Version : 2.3.0.1+2.3.0
* Libpri Source Version : 1.4.11.3
* Addons Source Version : 1.6.2.1
********************************************************************
Hi All,

I am having an issue with the voicemail and recording portal.
When I click on the link from the main PiaF menu, it pops up asking for a username password. By popup I mean just like when you go into the FreePBX admin and it asks for the maint login.
I can enter maint / password and it then displays the voicemail login screen where you enter extension number and voicemail password. Also I can click cancel, and it still displays the webpage, which makes me think this is perhaps a bug rather than a feature.

This isn't a problem for me as I know the maint / password login but I need the end users to be able to get to the voicemail login screen without entering maint login.

Have tried via the PiaF main menu and via http://ip-address/recordings and both have this issue.

Any one else noticed this? Any advise on fixing www permissions?

Thanks
Kevin

 

[kevsworld]

bump

no one experienced this or has this issue?

should post this on the bugs topics instead?

 

[chris_c_]

the end user logs in as follows:

username: extension
password: voicemail password for that extension

NOTE!!!!: this vm pw is NOT the "SECRET" number used to login their phone extension to asterisk...

the vm pw is a different number , listed in the extension page, default is 5 random digits.

They can change their extension password by themselves anytime thru the phone or web interface.

 

[kevsworld]

no not that password

Thanks Chris for you help but this is before you get to the enduser extension number / voicemail password. Sorry perhaps I didn't explain it very well and I realise I am a newbie on the forum but I have been using asterisk for a couple of years now. I am a convert to PiaF from Trixbox.
This is the username / password prompt that comes up when you click on voicemail and recording from the main PiaF menu:
http://imagebin.ca/view/fyuuLK.html
This is the maint password login prompt and only the maint login is accepted.

I have the same issue on two different installs.

Can admin move this to the bugs topic? don't want to double post but I am sure this is a bug.

Kevin

 

[sanitycheck]

Chris_c: That's not his problem. I see the same thing kevsworld reports on a new, basic 1.7.55 box I built about 2 weeks ago. I ran update-fixes, which I notice was updated yesterday, but it didn't address the problem.

I can cancel out of the admin login and get to the voicemail screen when accessed from a regular user's workstation; it's annoying for the end user, but they can get around it. I didn't notice it earlier because on my workstation I had saved the maint password for my convenience; so it auto-cleared the prompts for me.

 

[chris_c_]

Kevin

You're absolutely right.

I tried logging in with only the extension and vm pw and it failed.

This definitely looks like a bug.

Users should be able to login to their "voicemail and recordings" with only their extension and voicemail pw.

Probably the creators of piaf didn't notice that they were logged in already with a maint username/pw

They should fix it so that users can get in with only a user extension/pw.

I second kevin's request to move this thread to the bugs topic.

 

[kevsworld]

glad its not just me

Yeah I think its easy to miss cause if you already have freepbx admin open, then you are already authenticated, so doesn't ask again but if you open new session - up pops the prompt

Makes the voicemail portal unusable for end users.

 

[kevsworld]

had a quick look at httpd logs.

http://pastebin.com/v4fGDfb1

Could it be line 2 /admin/common/libfreepbx.javascripts.js
as admin directory is password protected?

Or perhaps I am barking up the wrong tree I don't really know anything about apache and permissions.

 

[sanitycheck]

Yeah I think its easy to miss cause if you already have freepbx admin open, then you are already authenticated, so doesn't ask again but if you open new session - up pops the prompt

That's why I missed it.

Makes the voicemail portal unusable for end users.

Did you try to cancel out of the maint login prompt, or try to close the dialog box itself without responding? That worked for me, directing me to the page anyway, and allowing the user to log in without additional prompts. The prompt is annoying but I can get around it.

 

[chris_c_]

Did you try to cancel out of the maint login prompt, or try to close the dialog box itself without responding? That worked for me, directing me to the page anyway, and allowing the user to log in without additional prompts. The prompt is annoying but I can get around it.

That failed for me.

Cancelling out of login shows the standard http error text

AUTHORIZATION REQUIRED.
login is required to access this page...bla bla bla
Apache .../Centos....

no chance to login with extension number + vm pw

bug

 

[sanitycheck]

Our symptoms are slightly different but I'm confident we're dealing with the same problem.

 

[tm1000]

It's because we are calling some external files, like an image or something.

chris_c_ please post relevant parts from your error_log file so I can file a bug and get this fixed

 

[chris_c_]

It's because we are calling some external files, like an image or something.

chris_c_ please post relevant parts from your error_log file so I can file a bug and get this fixed

@tm1000 :

[Sat Sept 18 18:11:58 2010] [error] [client 192.168.x.x] user 701 not found: /recordings

 

[kevsworld]

had a quick look at httpd logs.

http://pastebin.com/v4fGDfb1

Could it be line 2 /admin/common/libfreepbx.javascripts.js
as admin directory is password protected?

Or perhaps I am barking up the wrong tree I don't really know anything about apache and permissions.

@tm1000: I think that this is the relevant part of the log but let me know if not and I can post other stuff.

@sanitycheck: yes if I click cancel I can indeed login to the portal but if you notice it will ask again on the next page and you have to keep canceling it - if it were just the once then could live with it.

@chris_c: user 701 not found sounds like a different problem to me.

 

[kevsworld]

I was going to post a thread in bugs about this but I found this thread already there: http://pbxinaflash.com/community/threads/ari-asking-for-apache-authentication.6879/?t=6879 think I missed it before due to forum 3 letter search restriction ie. ARI Anyway, seems like this is not a bug but by design. Though perhaps the design needs to be revisited because as previously mentioned, you can just cancel out of the auth prompt and go on your merry hacking way I still don't understand how to fix the issue but will continue discussion on that thread.

 

[tm1000]

Hey guys. This was actually fixed in a newer version of FreePBX.

I realized this when I tried to reproduce the issue but couldn't because I've updated to 2.8+

Not saying you should update to 2.8. I'll have to talk to darmock and ward about this. we could probably patch ARI with update-scripts.

 

[tm1000]

There's nothing to 'hack' after cancel. You'd still have to have a logon to be able to log on to ARI. (eg, EXT & Vmail password)

It's simply calling a script from the admin directory that it's not suppose to be calling.

I was going to post a thread in bugs about this but I found this thread already there: http://pbxinaflash.com/community/threads/ari-asking-for-apache-authentication.6879/?t=6879 think I missed it before due to forum 3 letter search restriction ie. ARI Anyway, seems like this is not a bug but by design. Though perhaps the design needs to be revisited because as previously mentioned, you can just cancel out of the auth prompt and go on your merry hacking way I still don't understand how to fix the issue but will continue discussion on that thread.

 

[tm1000]

Everyone please see this: http://www.freepbx.com/trac/ticket/4158

 

[sanitycheck]

Everyone please see this: http://www.freepbx.com/trac/ticket/4158

Ticket 4158 was labeled "closed bugs: fixed" six months ago. What am I missing? Is the next step to reopen the ticket?

 

[chris_c_]

@tm1000: I think that this is the relevant part of the log but let me know if not and I can post other stuff.

@sanitycheck: yes if I click cancel I can indeed login to the portal but if you notice it will ask again on the next page and you have to keep canceling it - if it were just the once then could live with it.

@chris_c: user 701 not found sounds like a different problem to me.

I'm logging in as voicemail extension 701, with the proper password, and it refuses access.

It should allow access.