From 3c8bd4255cd154b3dd675c1d33470bf7eb4c2bd3 Mon Sep 17 00:00:00 2001 From: Reinhard Scheck Date: Sat, 10 Jul 2010 11:59:33 +0000 Subject: [PATCH] 0001794: html tags on management lists are escaped git-svn-id: svn+ssh://repo.cacti.net/var/data/svnroot/cacti/cacti/branches/0.8.7@6050 860744bd-22fc-0310-8c96-e9fe5004b5ca --- data_sources.php | 9 +++++---- graphs.php | 5 +++-- lib/data_query.php | 1 + 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/data_sources.php b/data_sources.php index e472d312a..5e2fdc877 100644 --- a/data_sources.php +++ b/data_sources.php @@ -1310,16 +1310,17 @@ function ds() { $i = 0; if (sizeof($data_sources) > 0) { foreach ($data_sources as $data_source) { - $data_template_name = ((empty($data_source["data_template_name"])) ? "None" : $data_source["data_template_name"]); - $data_input_name = ((empty($data_source["data_input_name"])) ? "External" : $data_source["data_input_name"]); + /* we're escaping strings here, so no need to escape them on form_selectable_cell */ + $data_template_name = ((empty($data_source["data_template_name"])) ? "None" : htmlspecialchars($data_source["data_template_name"])); + $data_input_name = ((empty($data_source["data_input_name"])) ? "External" : htmlspecialchars($data_source["data_input_name"])); $poller_interval = ((isset($poller_intervals[$data_source["local_data_id"]])) ? $poller_intervals[$data_source["local_data_id"]] : 0); form_alternate_row_color($colors["alternate"], $colors["light"], $i, 'line' . $data_source["local_data_id"]); $i++; form_selectable_cell("" . ((get_request_var_request("filter") != "") ? eregi_replace("(" . preg_quote(get_request_var_request("filter")) . ")", "\\1", title_trim(htmlspecialchars($data_source["name_cache"]), read_config_option("max_title_data_source"))) : title_trim(htmlspecialchars($data_source["name_cache"]), read_config_option("max_title_data_source"))) . "", $data_source["local_data_id"]); form_selectable_cell($data_source['local_data_id'], $data_source['local_data_id']); - form_selectable_cell(((get_request_var_request("filter") != "") ? eregi_replace("(" . preg_quote(get_request_var_request("filter")) . ")", "\\1", htmlspecialchars($data_input_name)) : htmlspecialchars($data_input_name)), $data_source["local_data_id"]); + form_selectable_cell(((get_request_var_request("filter") != "") ? eregi_replace("(" . preg_quote(get_request_var_request("filter")) . ")", "\\1", $data_input_name) : $data_input_name), $data_source["local_data_id"]); form_selectable_cell(get_poller_interval($poller_interval), $data_source["local_data_id"]); form_selectable_cell(($data_source['active'] == "on" ? "Yes" : "No"), $data_source["local_data_id"]); - form_selectable_cell(((get_request_var_request("filter") != "") ? eregi_replace("(" . preg_quote(get_request_var_request("filter")) . ")", "\\1", htmlspecialchars($data_source['data_template_name'])) : htmlspecialchars($data_source['data_template_name'])), $data_source["local_data_id"]); + form_selectable_cell(((get_request_var_request("filter") != "") ? eregi_replace("(" . preg_quote(get_request_var_request("filter")) . ")", "\\1", $data_template_name) : $data_template_name), $data_source["local_data_id"]); form_checkbox_cell($data_source["name_cache"], $data_source["local_data_id"]); form_end_row(); } diff --git a/graphs.php b/graphs.php index e0bc39d2e..fa98bdbbc 100644 --- a/graphs.php +++ b/graphs.php @@ -1317,11 +1317,12 @@ function graph() { $i = 0; if (sizeof($graph_list) > 0) { foreach ($graph_list as $graph) { - $template_name = ((empty($graph["name"])) ? "None" : $graph["name"]); + /* we're escaping strings here, so no need to escape them on form_selectable_cell */ + $template_name = ((empty($graph["name"])) ? "None" : htmlspecialchars($graph["name"])); form_alternate_row_color($colors["alternate"], $colors["light"], $i, 'line' . $graph["local_graph_id"]); $i++; form_selectable_cell("" . ((get_request_var_request("filter") != "") ? eregi_replace("(" . preg_quote(get_request_var_request("filter")) . ")", "\\1", title_trim(htmlspecialchars($graph["title_cache"]), read_config_option("max_title_graph"))) : title_trim(htmlspecialchars($graph["title_cache"]), read_config_option("max_title_graph"))) . "", $graph["local_graph_id"]); form_selectable_cell($graph["local_graph_id"], $graph["local_graph_id"]); - form_selectable_cell(((get_request_var_request("filter") != "") ? eregi_replace("(" . preg_quote(get_request_var_request("filter")) . ")", "\\1", htmlspecialchars($template_name)) : htmlspecialchars($template_name)), $graph["local_graph_id"]); + form_selectable_cell(((get_request_var_request("filter") != "") ? eregi_replace("(" . preg_quote(get_request_var_request("filter")) . ")", "\\1", $template_name) : $template_name), $graph["local_graph_id"]); form_selectable_cell($graph["height"] . "x" . $graph["width"], $graph["local_graph_id"]); form_checkbox_cell($graph["title_cache"], $graph["local_graph_id"]); form_end_row(); diff --git a/lib/data_query.php b/lib/data_query.php index ac03c75e7..2a0658767 100644 --- a/lib/data_query.php +++ b/lib/data_query.php @@ -620,6 +620,7 @@ function update_data_query_sort_cache($host_id, $data_query_id) { } /* update the cache */ + /* TODO: if both $sort field and $title_format are empty, this yields funny results */ db_execute("update host_snmp_query set sort_field = '$sort_field', title_format = '$title_format' where host_id = '$host_id' and snmp_query_id = '$data_query_id'"); }