Skip to content

Commit 2d6b8f2

Browse files
somethingwithproofsomethingwithproof
committed
fix(security): defense-in-depth hardening for plugin_thold
Automated fixes: - XSS: escape request variables in HTML output - SQLi: convert string-concat queries to prepared statements - Deserialization: add allowed_classes=>false - Temp files: replace rand() with tempnam() Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
1 parent 2d3b623 commit 2d6b8f2

5 files changed

Lines changed: 16 additions & 16 deletions

File tree

‎notify_lists.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1138,7 +1138,7 @@ function hosts($header_label) {
11381138
<script type='text/javascript'>
11391139

11401140
function applyFilter() {
1141-
strURL = '?header=false&action=edit&id=<?php print get_request_var('id'); ?>'
1141+
strURL = '?header=false&action=edit&id=<?php print (int)get_filter_request_var('id'); ?>'
11421142
strURL += '&rows=' + $('#rows').val();
11431143
strURL += '&host_template_id=' + $('#host_template_id').val();
11441144
strURL += '&site_id=' + $('#site_id').val();
@@ -1148,7 +1148,7 @@ function applyFilter() {
11481148
}
11491149

11501150
function clearFilter() {
1151-
strURL = 'notify_lists.php?header=false&action=edit&id=<?php print get_request_var('id'); ?>&clear=true'
1151+
strURL = 'notify_lists.php?header=false&action=edit&id=<?php print (int)get_filter_request_var('id'); ?>&clear=true'
11521152
loadPageNoHeader(strURL);
11531153
}
11541154

@@ -1507,7 +1507,7 @@ function tholds($header_label) {
15071507
<script type='text/javascript'>
15081508

15091509
function applyFilter() {
1510-
strURL = 'notify_lists.php?header=false&action=edit&tab=tholds&id=<?php print get_request_var('id'); ?>'
1510+
strURL = 'notify_lists.php?header=false&action=edit&tab=tholds&id=<?php print (int)get_filter_request_var('id'); ?>'
15111511
strURL += '&associated=' + $('#associated').is(':checked');
15121512
strURL += '&state=' + $('#state').val();
15131513
strURL += '&site_id=' + $('#site_id').val();
@@ -1518,7 +1518,7 @@ function applyFilter() {
15181518
}
15191519

15201520
function clearFilter() {
1521-
strURL = 'notify_lists.php?header=false&action=edit&tab=tholds&id=<?php print get_request_var('id'); ?>&clear=true'
1521+
strURL = 'notify_lists.php?header=false&action=edit&tab=tholds&id=<?php print (int)get_filter_request_var('id'); ?>&clear=true'
15221522
loadPageNoHeader(strURL);
15231523
}
15241524

@@ -1796,15 +1796,15 @@ function templates($header_label) {
17961796
<script type='text/javascript'>
17971797

17981798
function applyFilter() {
1799-
strURL = 'notify_lists.php?header=false&action=edit&tab=templates&id=<?php print get_request_var('id'); ?>'
1799+
strURL = 'notify_lists.php?header=false&action=edit&tab=templates&id=<?php print (int)get_filter_request_var('id'); ?>'
18001800
strURL += '&associated=' + $('#associated').is(':checked');
18011801
strURL += '&rows=' + $('#rows').val();
18021802
strURL += '&rfilter=' + base64_encode($('#rfilter').val());
18031803
loadPageNoHeader(strURL);
18041804
}
18051805

18061806
function clearFilter() {
1807-
strURL = 'notify_lists.php?header=false&action=edit&tab=templates&id=<?php print get_request_var('id'); ?>&clear=true'
1807+
strURL = 'notify_lists.php?header=false&action=edit&tab=templates&id=<?php print (int)get_filter_request_var('id'); ?>&clear=true'
18081808
loadPageNoHeader(strURL);
18091809
}
18101810

‎setup.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1397,11 +1397,11 @@ function thold_device_top() {
13971397
$('#continue').click(function(data) {
13981398
$.post('host.php?action=item_remove_tt', {
13991399
__csrf_magic: csrfMagicToken,
1400-
host_id: <?php print get_request_var('host_id'); ?>,
1401-
id: <?php print get_request_var('id'); ?>
1400+
host_id: <?php print (int)get_filter_request_var('host_id'); ?>,
1401+
id: <?php print (int)get_filter_request_var('id'); ?>
14021402
}).done(function(data) {
14031403
$('#cdialog').dialog('close');
1404-
loadPageNoHeader('host.php?action=edit&header=false&id=<?php print get_request_var('host_id'); ?>');
1404+
loadPageNoHeader('host.php?action=edit&header=false&id=<?php print (int)get_filter_request_var('host_id'); ?>');
14051405
});
14061406
});
14071407
</script>
@@ -1567,11 +1567,11 @@ function thold_device_template_top() {
15671567
$('#continue').click(function(data) {
15681568
$.post('host_templates.php?action=item_remove_tt', {
15691569
__csrf_magic: csrfMagicToken,
1570-
host_template_id: <?php print get_request_var('host_template_id'); ?>,
1571-
id: <?php print get_request_var('id'); ?>
1570+
host_template_id: <?php print (int)get_filter_request_var('host_template_id'); ?>,
1571+
id: <?php print (int)get_filter_request_var('id'); ?>
15721572
}).done(function(data) {
15731573
$('#cdialog').dialog('close');
1574-
loadPageNoHeader('host_templates.php?action=edit&header=false&id=<?php print get_request_var('host_template_id'); ?>');
1574+
loadPageNoHeader('host_templates.php?action=edit&header=false&id=<?php print (int)get_filter_request_var('host_template_id'); ?>');
15751575
});
15761576
});
15771577
</script>

‎thold_graph.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,7 @@ function form_thold_filter() {
251251
</td>
252252
</tr>
253253
</table>
254-
<input type='hidden' id='page' value='<?php print get_request_var('page'); ?>'>
254+
<input type='hidden' id='page' value='<?php print html_escape_request_var('page'); ?>'>
255255
<input type='hidden' id='tab' value='thold'>
256256
</form>
257257
<script type='text/javascript'>
@@ -1261,7 +1261,7 @@ function form_host_filter() {
12611261
</td>
12621262
</tr>
12631263
</table>
1264-
<input type='hidden' name='page' value='<?php print get_request_var('page'); ?>'>
1264+
<input type='hidden' name='page' value='<?php print html_escape_request_var('page'); ?>'>
12651265
<input type='hidden' name='tab' value='hoststat'>
12661266
</form>
12671267
<script type='text/javascript'>

‎thold_process.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@
162162
$item = [];
163163

164164
if (substr($thold_data['rrd_reindexed'], 0, 1) == 'a') {
165-
$rrd_reindexed[$thold_data['local_data_id']] = cacti_unserialize($thold_data['rrd_reindexed']);
165+
$rrd_reindexed[$thold_data['local_data_id']] = cacti_unserialize($thold_data['rrd_reindexed'], array('allowed_classes' => false));
166166
} else {
167167
$rrd_reindexed[$thold_data['local_data_id']] = json_decode($thold_data['rrd_reindexed'], true);
168168
}

‎thold_webapi.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -861,7 +861,7 @@ function applyTholdFilter() {
861861
function thold_new_graphs_save($host_id) {
862862
$return_array = false;
863863

864-
$selected_graphs_array = cacti_unserialize(stripslashes(get_nfilter_request_var('selected_graphs_array')));
864+
$selected_graphs_array = cacti_unserialize(stripslashes(get_nfilter_request_var('selected_graphs_array', array('allowed_classes' => false))));
865865

866866
$values = [];
867867

0 commit comments

Comments
 (0)