Skip to content
This repository has been archived by the owner on Dec 13, 2022. It is now read-only.

fix(secu): sanitize inputs, bindvalues and control format in ExportCSVServiceData #8765

Merged
merged 19 commits into from
Jun 10, 2020
Merged

fix(secu): sanitize inputs, bindvalues and control format in ExportCSVServiceData #8765

merged 19 commits into from
Jun 10, 2020

Conversation

adr-mo
Copy link
Contributor

@adr-mo adr-mo commented Jun 3, 2020 •
edited by callapa
Loading

Description

Security issues

  • Binding values for all the SQL requests
  • Sanitizing inputs
  • Controlling the variable format

Fixes # (issue)

Type of change

  • Patch fixing an issue (non-breaking change)
  • New functionality (non-breaking change)
  • Breaking change (patch or feature) that might cause side effects breaking part of the Software
  • Updating documentation (missing information, typo...)

Target serie

  • 2.8.x
  • 18.10.x
  • 19.04.x
  • 19.10.x
  • 20.04.x
  • 20.10.x (master)

How this pull request can be tested ?

See related JIRA ticket for a test description.

Checklist

  • I followed the coding style guidelines provided by Centreon
  • I have commented my code, especially new classes, functions or any legacy code modified. (docblock)
  • I have commented my code, especially hard-to-understand areas of the PR.
  • I have made corresponding changes to the documentation.
  • I have rebased my development branch on the base branch (master, maintenance).

@adr-mo adr-mo requested review from kduret and sc979 June 3, 2020 15:17
@adr-mo adr-mo requested a review from callapa June 4, 2020 08:16
@adr-mo adr-mo requested review from sc979, jeremyjaouen and loiclau June 4, 2020 09:44
@adr-mo @callapa
Update www/include/views/graphs/exportData/ExportCSVServiceData.php
27283ec 
Co-authored-by: Laurent Calvet <lcalvet@centreon.com>
callapa
callapa previously approved these changes Jun 5, 2020
View reviewed changes
@callapa callapa self-requested a review June 5, 2020 14:55
jeremyjaouen
jeremyjaouen previously approved these changes Jun 8, 2020
View reviewed changes
@adr-mo @callapa
Update www/include/views/graphs/exportData/ExportCSVServiceData.php
51691b6 
Co-authored-by: Laurent Calvet <lcalvet@centreon.com>
@adr-mo adr-mo dismissed stale reviews from jeremyjaouen and callapa via 51691b6 June 9, 2020 08:19
adr-mo and others added 3 commits June 9, 2020 10:19
@adr-mo @sc979
Update www/include/views/graphs/exportData/ExportCSVServiceData.php
3990c68 
Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>
@adr-mo @sc979
Update www/include/views/graphs/exportData/ExportCSVServiceData.php
b50793c 
Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>
@adr-mo @sc979
Update www/include/views/graphs/exportData/ExportCSVServiceData.php
606ed91 
Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>
callapa
callapa previously approved these changes Jun 9, 2020
View reviewed changes
www/include/views/graphs/exportData/ExportCSVServiceData.php Outdated Show resolved Hide resolved
@callapa callapa changed the title security(ExportCSVServiceData): sanitize inputs, bindvalues and contr… security(ExportCSVServiceData): sanitize inputs, bindvalues and control format Jun 9, 2020
@adr-mo @callapa
Update www/include/views/graphs/exportData/ExportCSVServiceData.php
fbc54ec 
Co-authored-by: Laurent Calvet <lcalvet@centreon.com>
@adr-mo adr-mo requested review from callapa and sc979 June 10, 2020 07:38
@adr-mo adr-mo changed the title security(ExportCSVServiceData): sanitize inputs, bindvalues and control format fix(secu): sanitize inputs, bindvalues and control format in ExportCSVServiceData Jun 10, 2020
@adr-mo
Copy link
Contributor Author

adr-mo commented Jun 10, 2020

@sc979 @jeremyjaouen done

@adr-mo adr-mo requested a review from jeremyjaouen June 10, 2020 08:40
sc979
sc979 previously approved these changes Jun 10, 2020
View reviewed changes
@adr-mo adr-mo merged commit 3c4decb into master Jun 10, 2020
@adr-mo adr-mo deleted the MON-5517-sql-injection-graph-export branch June 10, 2020 12:39
adr-mo added a commit that referenced this pull request Jun 10, 2020
@adr-mo @sc979 @callapa
fix(secu): sanitize inputs, bindvalues and control format in ExportCS…
1184606 
…VServiceData (#8765)

* security(ExportCSVServiceData): sanitize inputs, bindvalues and control format

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* check consistency and definition of index

* check start time and end time definition

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: Laurent Calvet <lcalvet@centreon.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: Laurent Calvet <lcalvet@centreon.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* rename variable from index_data to indexData

* take feedbacks into account

* centreon-bot: fix coding style

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: Laurent Calvet <lcalvet@centreon.com>

* sc979: take feedbacks into account

* sc979: take feedbacks into account

* sc979: take feedbacks into account #2

* correct conditon

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>
Co-authored-by: Laurent Calvet <lcalvet@centreon.com>
adr-mo added a commit that referenced this pull request Jun 10, 2020
@adr-mo @sc979 @callapa
fix(secu): sanitize inputs, bindvalues and control format in ExportCS…
1436d67 
…VServiceData (#8765)

* security(ExportCSVServiceData): sanitize inputs, bindvalues and control format

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* check consistency and definition of index

* check start time and end time definition

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: Laurent Calvet <lcalvet@centreon.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: Laurent Calvet <lcalvet@centreon.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* rename variable from index_data to indexData

* take feedbacks into account

* centreon-bot: fix coding style

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: Laurent Calvet <lcalvet@centreon.com>

* sc979: take feedbacks into account

* sc979: take feedbacks into account

* sc979: take feedbacks into account #2

* correct conditon

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>
Co-authored-by: Laurent Calvet <lcalvet@centreon.com>
adr-mo added a commit that referenced this pull request Jun 10, 2020
@adr-mo @sc979 @callapa
fix(secu): sanitize inputs, bindvalues and control format in ExportCS…
98cf975 
…VServiceData (#8765)

* security(ExportCSVServiceData): sanitize inputs, bindvalues and control format

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* check consistency and definition of index

* check start time and end time definition

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: Laurent Calvet <lcalvet@centreon.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: Laurent Calvet <lcalvet@centreon.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>

* rename variable from index_data to indexData

* take feedbacks into account

* centreon-bot: fix coding style

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

* Update www/include/views/graphs/exportData/ExportCSVServiceData.php

Co-authored-by: Laurent Calvet <lcalvet@centreon.com>

* sc979: take feedbacks into account

* sc979: take feedbacks into account

* sc979: take feedbacks into account #2

* correct conditon

Co-authored-by: sc979 <34628915+sc979@users.noreply.github.com>
Co-authored-by: Laurent Calvet <lcalvet@centreon.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@jeremyjaouen jeremyjaouen jeremyjaouen approved these changes

@Fxdpt Fxdpt Fxdpt approved these changes

@sc979 sc979 sc979 approved these changes

@callapa callapa callapa approved these changes

@kduret kduret Awaiting requested review from kduret

@loiclau loiclau Awaiting requested review from loiclau

Assignees
No one assigned
Labels
area/backend area/security
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@adr-mo @callapa @sc979 @Fxdpt @jeremyjaouen