"; // ---- cacti-stored-value-echoed-unescaped ---- $host = db_fetch_row_prepared('SELECT * FROM host WHERE id = ?', [$id]); // ruleid: cacti-stored-value-echoed-unescaped print '' . $host['description'] . ''; // ok: cacti-stored-value-echoed-unescaped print '' . html_escape($host['description']) . ''; // ok: cacti-stored-value-echoed-unescaped print '' . $host['id'] . ''; $graphs = db_fetch_assoc('SELECT title_cache FROM graph_templates_graph'); foreach ($graphs as $graph) { // ruleid: cacti-stored-value-echoed-unescaped print "'; } $notes = db_fetch_cell_prepared('SELECT notes FROM host WHERE id = ?', [$id]); // ruleid: cacti-stored-value-echoed-unescaped print "

$notes

"; $sysdescr = cacti_snmp_session_get($session, '.1.3.6.1.2.1.1.1.0'); // ruleid: cacti-stored-value-echoed-unescaped print '' . $sysdescr . ''; // ok: cacti-stored-value-echoed-unescaped print '' . __esc('System: %s', $sysdescr) . ''; $extra = api_plugin_hook_function('device_table_cell', $host); // ruleid: cacti-stored-value-echoed-unescaped print $extra; $lines = tail_file($logfile, 100); foreach ($lines as $line) { // ruleid: cacti-stored-value-echoed-unescaped print '' . $line . ''; } // ok: cacti-stored-value-echoed-unescaped print '' . number_format_i18n($host['value']) . ''; // ---- cacti-unescaped-form-selectable-cell ---- foreach ($graphs as $graph) { // ruleid: cacti-unescaped-form-selectable-cell form_selectable_cell($graph['title_cache'], $graph['id']); // ok: cacti-unescaped-form-selectable-cell form_selectable_ecell($graph['title_cache'], $graph['id']); // ok: cacti-unescaped-form-selectable-cell form_selectable_cell(html_escape($graph['title_cache']), $graph['id']); // ok: cacti-unescaped-form-selectable-cell form_selectable_cell(filter_value($graph['title_cache'], grv('filter'), 'graphs.php?id=1'), $graph['id']); // ok: cacti-unescaped-form-selectable-cell form_selectable_cell($graph['id'], $graph['id']); } // ruleid: cacti-unescaped-form-selectable-cell form_selectable_cell("" . gnrv('name') . '', 1); // ruleid: cacti-request-var-in-sql $groups = db_fetch_assoc('SELECT * FROM user_auth_group WHERE user_id = ' . grv('id')); foreach ($groups as $g) { // ok: cacti-unescaped-form-selectable-cell form_selectable_cell($g['id'], $g['id']); // ok: cacti-unescaped-form-selectable-cell form_selectable_cell($status_labels[$g['enabled']], $g['id']); // ruleid: cacti-unescaped-form-selectable-cell form_selectable_cell($g['description'], $g['id']); } $total_rows = db_fetch_cell('SELECT COUNT(*) FROM host'); $nav = html_nav_bar('host.php', MAX_DISPLAY_PAGES, grv('page'), 30, $total_rows, 10, 'Devices'); // ok: cacti-stored-value-echoed-unescaped print $nav;