Skip to content
This repository has been archived by the owner on Dec 13, 2022. It is now read-only.

fix(secu): sql injections in the service by hostgroups and servicegroups pages #7267

Merged
merged 5 commits into from
Mar 26, 2019
Merged

fix(secu): sql injections in the service by hostgroups and servicegroups pages #7267

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6e2574f
style: clean and remove dead code
sc979 Mar 11, 2019
338d241
fix(DB): protect pages against SQL injection in services by hg or sg
sc979 Mar 11, 2019
db79f5a
style and indentation
sc979 Mar 13, 2019
85d031d
fix(JS): removing debug
sc979 Mar 13, 2019
b30b1cb
fix(api): changing path
sc979 Mar 13, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 24 additions & 5 deletions www/include/monitoring/status/ServicesHostGroups/serviceGridByHG.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<?php
/*
* Copyright 2005-2015 Centreon
* Centreon is developped by : Julien Mathis and Romain Le Merlus under
* Copyright 2005-2019 Centreon
* Centreon is developed by : Julien Mathis and Romain Le Merlus under
* GPL Licence 2.0.
*
* This program is free software; you can redistribute it and/or modify it under
Expand Down Expand Up @@ -62,13 +62,15 @@
"ack_0" => _("Not Acknowledged"),
);

/*
* Check search value in Host search field
*/
// Check search value in Host search field
if (isset($_GET["host_search"])) {
$centreon->historySearch[$url] = $_GET["host_search"];
}

// Check search value in Hostgroup list. $_GET["host_group_filter"] return the id of the HG
if (isset($_GET["hg_search"])) {
$centreon->historySearch[$hostgroup] = $_GET["hg_search"];
}

$tab_class = array("0" => "list_one", "1" => "list_two");
$rows = 10;
Expand Down Expand Up @@ -101,6 +103,23 @@

$form = new HTML_QuickFormCustom('select_form', 'GET', "?p=" . $p);

//adding hostgroup's select2 list
$hostgroupsRoute = './api/internal.php?object=centreon_configuration_hostgroup&action=list';
$attrHostGroup = array(
'datasourceOrigin' => 'ajax',
'availableDatasetRoute' => $hostgroupsRoute,
'defaultDatasetRoute' => "",
'multiple' => false,
'linkedObject' => 'centreonHostgroups'
);
$form->addElement(
'select2',
'hg_search',
_('Hostgroup List'),
array('id' => 'hg_search'),
$attrHostGroup
);

$form->addElement(
'select',
'typeDisplay',
Expand Down
24 changes: 16 additions & 8 deletions www/include/monitoring/status/ServicesHostGroups/serviceGridByHGJS.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<?php
/*
* Copyright 2005-2015 Centreon
* Centreon is developped by : Julien Mathis and Romain Le Merlus under
* Copyright 2005-2019 Centreon
* Centreon is developed by : Julien Mathis and Romain Le Merlus under
* GPL Licence 2.0.
*
* This program is free software; you can redistribute it and/or modify it under
Expand Down Expand Up @@ -61,9 +61,10 @@
?>
<script type="text/javascript">
var _debug = 0;

var _addrXML = "./include/monitoring/status/ServicesHostGroups/xml/serviceGridByHGXML.php";
var _addrXSL = "./include/monitoring/status/ServicesHostGroups/xsl/serviceGridByHG.xsl";
// hostgroup select2 value
var hg_search = "";

<?php include_once "./include/monitoring/status/Common/commonJS.php"; ?>

Expand Down Expand Up @@ -150,6 +151,14 @@ function initM(_time_reload, _sid, _o) {
_host_search = "";
}

// checking if a hostgroup was selected
if (document.getElementById("select2-hg_search-container") &&
document.getElementById("select2-hg_search-container").title
) {
this.hg_search = document.getElementById("select2-hg_search-container").title;
viewDebugInfo('search: ' + document.getElementById("select2-hg_search-container").title);
}

if (_first) {
mainLoopLocal();
_first = 0;
Expand All @@ -166,9 +175,9 @@ function goM(_time_reload, _sid, _o) {
var proc = new Transformation();
proc.setCallback(function(t){monitoringCallBack(t); proc = null;});
proc.setXml(
_addrXML + "?" + '&search=' + _host_search + '&num=' + _num + '&limit=' + _limit +
'&sort_type=' + _sort_type + '&order=' + _order + '&date_time_format_status=' + _date_time_format_status +
'&o=' + _o + '&p=' + _p + '&time=<?php print time(); ?>'
_addrXML + "?" + '&search=' + _host_search + '&hg_search=' + this.hg_search + '&num=' + _num +
'&limit=' + _limit + '&sort_type=' + _sort_type + '&order=' + _order + '&date_time_format_status=' +
_date_time_format_status + '&o=' + _o + '&p=' + _p + '&time=<?php print time(); ?>'
);
proc.setXslt(_addrXSL);
if (handleVisibilityChange()) {
Expand All @@ -186,5 +195,4 @@ function goM(_time_reload, _sid, _o) {
_on = 1;
set_header_title();
}

</SCRIPT>
</script>
75 changes: 47 additions & 28 deletions www/include/monitoring/status/ServicesHostGroups/templates/serviceGrid.ihtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,42 +4,52 @@
<input name="o" value="svc" type="hidden">
{assign var='nbCol' value='4'}
{if $poller_listing}
{assign var='nbCol' value='$nbCol+1'}
{assign var='nbCol' value='$nbCol+1'}
{/if}
<table class="ajaxOption table">
<tbody>
<tr>
<th colspan=""><h5>{t}Filters{/t}</h5></th>
</tr>
<tr>
<td><h4>{$search}</h4></td>
{if $poller_listing}
<tr>
<th colspan=""><h5>{t}Filters{/t}</h5></th>
</tr>
<tr>
<td><h4>{$search}</h4></td>
{if $poller_listing}
<td><h4>{$pollerStr}</h4></td>
{/if}
<td><h4>{$hgStr}</h4></td>
<td><h4>{$typeDisplay}</h4></td>
<td><h4>{$typeDisplay2}</h4></td>
</tr>
<tr>
<td><input size="15" id="host_search" class="search_input" name="host_search" type="text" /></td>
{if $poller_listing}
<td><span id="instance_selected"></span></td>
{/if}
<td><span id="hostgroups_selected"></span></td>
<td>{$form.typeDisplay.html}</td>
<td>{$form.typeDisplay2.html}</td>
</tr>
{/if}
<td><h4>{$hgStr}</h4></td>
<td><h4>{$typeDisplay}</h4></td>
<td><h4>{$typeDisplay2}</h4></td>
</tr>
<tr>
<td><input size="15" id="host_search" class="search_input" name="host_search" type="text" /></td>
{if $poller_listing}
<td><span id="instance_selected"></span></td>
{/if}
<td><span id="hostgroups_selected">{$form.hg_search.html}</span></td>
<td>{$form.typeDisplay.html}</td>
<td>{$form.typeDisplay2.html}</td>
</tr>
</tbody>
</table>
<table class="ToolbarTable table">
<tr class="ToolbarTR">
<td>
<div class="Toolbar_TDSelectAction_Top">
<span class="consol_button"><a id="JS_monitoring_refresh" href="#" onclick="javascript:monitoring_refresh('');"><img src='./img/icons/refresh.png' alt='Refresh' title='Refresh'></a></span>
<span class="consol_button"><a id="JS_monitoring_play" class="cachediv" href="#" onclick="javascript:monitoring_play('');"><img src='./img/icons/media_play.png' alt='Play' title='Play'></a></span>
<span class="consol_button"><img id="JS_monitoring_play_gray" src='./img/icons/media_play_gray.png' alt='Play' title='Play'></span>
<span class="consol_button"><a class="" id="JS_monitoring_pause" href="#" onclick="javascript:monitoring_pause('');"><img src='./img/icons/media_pause.png' alt='Pause' title='Pause'></a></span>
<span class="consol_button"><img id="JS_monitoring_pause_gray" class="cachediv" src='./img/icons/media_pause_gray.png' alt='Pause' title='Pause'></span>
<span class="consol_button">
<a id="JS_monitoring_refresh" href="#" onclick="javascript:monitoring_refresh('');">
<img src='./img/icons/refresh.png' alt='Refresh' title='Refresh'></a></span>
<span class="consol_button">
<a id="JS_monitoring_play" class="cachediv" href="#" onclick="javascript:monitoring_play('');">
<img src='./img/icons/media_play.png' alt='Play' title='Play'></a></span>
<span class="consol_button">
<img id="JS_monitoring_play_gray" src='./img/icons/media_play_gray.png' alt='Play' title='Play'>
</span>
<span class="consol_button">
<a class="" id="JS_monitoring_pause" href="#" onclick="javascript:monitoring_pause('');">
<img src='./img/icons/media_pause.png' alt='Pause' title='Pause'></a></span>
<span class="consol_button">
<img id="JS_monitoring_pause_gray" class="cachediv" src='./img/icons/media_pause_gray.png' alt='Pause' title='Pause'>
</span>
</div>
</td>
<td id="pagination1" class="ToolbarPagination"></td>
Expand All @@ -55,10 +65,19 @@
</tr>
</table>
{if $host_name}
<input type='hidden' name='host_name' value='{$host_name}'>
<input type='hidden' name='host_name' value='{$host_name}'>
{/if}
<input name='cmd' id='cmd' value='42' type='hidden'>
<input name='o' value='{$o}' type='hidden'>
<input type='hidden' id='limit' name='limit' value='{$limit}'>
<input type='hidden' id='limit' name='limit' value='{$limit}'>
{$form.hidden}
</form>
<script>
{literal}
//reloading the page after selecting a hg in the select2 field
jQuery('#hostgroups_selected').on('change', function(e) {
monitoring_refresh();
});
{/literal}
</script>

Loading