mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-23 03:27:02 +09:00
* Confine index.php external-link content includes render_external_links() built the include path as include/content/<contentfile> and required it after only a file_exists() check. contentfile comes from the external_links table, so a '../' value included an arbitrary local file. Resolve and confine the path to include/content the way link.php already does, and html_escape the contentfile in the iframe src and error message. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * Escape only the filename in the not-found message and guard the test offsets Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: TheWitness <thewitness@cacti.net>
129 lines
6.0 KiB
PHP
129 lines
6.0 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
| |
|
|
| This program is free software; you can redistribute it and/or |
|
|
| modify it under the terms of the GNU General Public License |
|
|
| as published by the Free Software Foundation; either version 2 |
|
|
| of the License, or (at your option) any later version. |
|
|
| |
|
|
| This program is distributed in the hope that it will be useful, |
|
|
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
|
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
|
| GNU General Public License for more details. |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDtool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
| This code is designed, written, and maintained by the Cacti Group. See |
|
|
| about.php and/or the AUTHORS file for specific developer information. |
|
|
+-------------------------------------------------------------------------+
|
|
| http://www.cacti.net/ |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
require('./include/auth.php');
|
|
top_header();
|
|
|
|
global $local_db_cnn_id;
|
|
|
|
api_plugin_hook('console_before');
|
|
|
|
function render_external_links(string $style = 'FRONT') : void {
|
|
$consoles = db_fetch_assoc_prepared('SELECT id, contentfile
|
|
FROM external_links
|
|
WHERE enabled = "on"
|
|
AND style = ?', [$style]);
|
|
|
|
if (cacti_sizeof($consoles)) {
|
|
foreach ($consoles as $page) {
|
|
if (is_realm_allowed($page['id'] + 10000)) {
|
|
if (preg_match('/^((((ht|f)tp(s?))\:\/\/){1}\S+)/i', $page['contentfile'])) {
|
|
print '<iframe class="content" src="' . html_escape($page['contentfile']) . '" frameborder="0"></iframe>';
|
|
} else {
|
|
print '<div id="content">';
|
|
|
|
// Confine the include to include/content, the same way link.php
|
|
// does. contentfile comes from the external_links table; without
|
|
// this a '../' value would include an arbitrary local file.
|
|
$basepath = realpath(CACTI_PATH_INCLUDE . '/content');
|
|
$file = ($basepath !== false) ? realpath($basepath . '/' . $page['contentfile']) : false;
|
|
|
|
if ($file !== false && is_file($file) && str_starts_with($file, $basepath . DIRECTORY_SEPARATOR)) {
|
|
require_once($file);
|
|
} else {
|
|
print '<h1>The file \'' . html_escape($page['contentfile']) . '\' does not exist!!</h1>';
|
|
}
|
|
|
|
print '</div>';
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
render_external_links('FRONTTOP');
|
|
|
|
if (read_config_option('hide_console') != 'on') {
|
|
?>
|
|
<table class='cactiTable'>
|
|
<tr class='tableRow'>
|
|
<td class='textAreaNotes top left'>
|
|
<?php print __('You are now logged into <a href="%s"><b>Cacti</b></a>. You can follow these basic steps to get started.', 'about.php'); ?>
|
|
|
|
<ul>
|
|
<li><?php print __('<a href="%s">Create devices</a> for network', 'host.php'); ?></li>
|
|
<li><?php print __('<a href="%s">Create graphs</a> for your new devices', 'graphs_new.php'); ?></li>
|
|
<li><?php print __('<a href="%s">View</a> your new graphs', CACTI_PATH_URL . 'graph_view.php'); ?></li>
|
|
</ul>
|
|
</td>
|
|
<td class='textAreaNotes top right'>
|
|
<strong><?php print CACTI_VERSION_TEXT_FULL; ?></strong>
|
|
</td>
|
|
</tr>
|
|
<?php if (POLLER_ID > 1) {?>
|
|
<tr class='tableRow'><td colspan='2'><hr></td></tr>
|
|
<tr class='tableRow'><td colspan='2'><strong><?php print __('Remote Data Collector Status:'); ?></strong> <?php print '<i>' . (CACTI_CONNECTION == 'online' ? __('Online') : (CACTI_CONNECTION == 'recovery' ? __('Recovery') : __('Offline'))) . '</i>'; ?></td></tr>
|
|
<?php if (CACTI_CONNECTION != 'online') {?>
|
|
<tr class='tableRow'><td colspan='2'><strong><?php print __('Number of Offline Records:'); ?></strong> <?php print '<i>' . number_format_i18n(db_fetch_cell('SELECT COUNT(*) FROM poller_output_boost', '', true, $local_db_cnn_id)) . '</i>'; ?></td></tr>
|
|
<?php }?>
|
|
<tr class='tableRow'><td colspan='2'><hr></td></tr>
|
|
<tr class='tableRow'>
|
|
<td class='textAreaNotes top left' colspan='2'>
|
|
<?php print __('<strong>NOTE:</strong> You are logged into a Remote Data Collector. When <b>\'online\'</b>, you will be able to view and control much of the Main Cacti Web Site just as if you were logged into it. Also, it\'s important to note that Remote Data Collectors are required to use the Cacti\'s Performance Boosting Services <b>\'On Demand Updating\'</b> feature, and we always recommend using Spine. When the Remote Data Collector is <b>\'offline\'</b>, the Remote Data Collectors Web Site will contain much less information. However, it will cache all updates until the Main Cacti Database and Web Server are reachable. Then it will dump it\'s Boost table output back to the Main Cacti Database for updating.'); ?>
|
|
</td>
|
|
</tr>
|
|
<tr class='tableRow'>
|
|
<td class='textAreaNotes top left' colspan='2'>
|
|
<?php print __('<strong>NOTE:</strong> None of the Core Cacti Plugins, to date, have been re-designed to work with Remote Data Collectors. Therefore, Plugins such as MacTrack, and HMIB, which require direct access to devices will not work with Remote Data Collectors at this time. However, plugins such as Thold will work so long as the Remote Data Collector is in <b>\'online\'</b> mode.'); ?>
|
|
</td>
|
|
</tr>
|
|
<?php } ?>
|
|
</table>
|
|
|
|
<?php
|
|
}
|
|
|
|
render_external_links('FRONT');
|
|
|
|
api_plugin_hook('console_after');
|
|
|
|
?>
|
|
<script type='text/javascript'>
|
|
$(function() {
|
|
resizeWindow();
|
|
$(window).resize(function() {
|
|
resizeWindow();
|
|
});
|
|
});
|
|
|
|
function resizeWindow() {
|
|
height = parseInt($('#navigation_right').height());
|
|
width = $('#main').width();
|
|
$('.content').css({'height':height+'px', 'width':width, 'margin-top':'-5px'});
|
|
}
|
|
</script>
|
|
<?php
|
|
|
|
bottom_footer();
|