From 7b71431ba8aacee2ed853a70ee33cfddf4665182 Mon Sep 17 00:00:00 2001
From: Adrien Morais <31647811+adr-mo@users.noreply.github.com>
Date: Thu, 12 Mar 2020 11:59:08 +0100
Subject: [PATCH] fix(centreonACL): return all services linked to a
 servicegroup (#8406)

* fix(centreonACL): return all services linked to a servicegroup

* enh(centreonACL): add some code documentation

* fix(centreonACL): take review feedbacks into account

* Sanitize the servicegroup id
* add missing code line to get only activated ressources

* fix(centreonACL): variable enough checked.

* take kduret feedback into account

Co-Authored-By: Kevin Duret <kduret@centreon.com>

Co-authored-by: Kevin Duret <kduret@centreon.com>
---
 www/class/centreonACL.class.php | 43 ++++++++++++++++++++-------------
 1 file changed, 26 insertions(+), 17 deletions(-)

diff --git a/www/class/centreonACL.class.php b/www/class/centreonACL.class.php
index 4dab367311e..4cdf102656e 100644
--- a/www/class/centreonACL.class.php
+++ b/www/class/centreonACL.class.php
@@ -2014,9 +2014,15 @@ public function getServiceGroupAclConf($search = null, $broker = null, $options
     }
 
     /**
-     * Get Services in servicesgroups from ACL and configuration DB
+     * Get all services linked to a servicegroup regarding ACL
+     *
+     * @param int $sgId servicegroup id
+     * @param mixed $broker
+     * @param mixed $options
+     * @access public
+     * @return array
      */
-    public function getServiceServiceGroupAclConf($sg_id, $broker = null, $options = null)
+    public function getServiceServiceGroupAclConf($sgId, $broker = null, $options = null)
     {
         $services = array();
 
@@ -2050,24 +2056,27 @@ public function getServiceServiceGroupAclConf($sg_id, $broker = null, $options =
                 . "AND $db_name_acl.centreon_acl.host_id = host.host_id "
                 . "AND $db_name_acl.centreon_acl.service_id = service.service_id ";
         }
+
+        // Making sure that the id provided is a real int
+        $option = ['default' => 0];
+        $sgId = filter_var($sgId, FILTER_VALIDATE_INT, $option);
+
+        /*
+         * Using the centreon_storage database to get the information
+         * where the services_servicegroups table provides "resolved" dependencies
+         * for possible components of the servicegroup which can be:
+         *     - simple services
+         *     - service templates
+         *     - hostgroup services
+         */
         $query = $request['select'] . $request['simpleFields'] . " "
             . "FROM ( "
             . "SELECT " . $request['fields'] . " "
-            . "FROM servicegroup, servicegroup_relation, service, host " . $from_acl . " "
-            . "WHERE servicegroup.sg_id = '" . CentreonDB::escape($sg_id) . "' "
-            . "AND service.service_activate='1' AND host.host_activate='1' "
-            . "AND servicegroup.sg_id = servicegroup_relation.servicegroup_sg_id "
-            . "AND servicegroup_relation.service_service_id = service.service_id "
-            . "AND servicegroup_relation.host_host_id = host.host_id "
-            . $where_acl . " "
-            . "UNION "
-            . "SELECT " . $request['fields'] . " "
-            . "FROM servicegroup, servicegroup_relation, hostgroup_relation, service, host " . $from_acl . " "
-            . "WHERE servicegroup.sg_id = '" . CentreonDB::escape($sg_id) . "' "
-            . "AND servicegroup.sg_id = servicegroup_relation.servicegroup_sg_id "
-            . "AND servicegroup_relation.hostgroup_hg_id = hostgroup_relation.hostgroup_hg_id "
-            . "AND hostgroup_relation.host_host_id = host.host_id "
-            . "AND servicegroup_relation.service_service_id = service.service_id "
+            . "FROM " . $db_name_acl . ".services_servicegroups, service, host" . $from_acl . " "
+            . "WHERE servicegroup_id = " . $sgId . " "
+            . "AND host.host_id = services_servicegroups.host_id "
+            . "AND service.service_id = services_servicegroups.service_id "
+            . "AND service.service_activate = '1' AND host.host_activate = '1'"
             . $where_acl . " "
             . ") as t ";