Files
cacti/links.php
Thomas Vincent c749790d84 fix(security): [develop] require CSRF-protected POST for link and plugin reordering (#8278)
* security: require CSRF-protected POST for link and plugin reordering (#7454)

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(csrf): share POST and token guards for reorder actions

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
2026-10-13 07:52:20 -04:00

610 lines
19 KiB
PHP

<?php
/*
+-------------------------------------------------------------------------+
| Copyright (C) 2004-2026 The Cacti Group |
| |
| This program is free software; you can redistribute it and/or |
| modify it under the terms of the GNU General Public License |
| as published by the Free Software Foundation; either version 2 |
| of the License, or (at your option) any later version. |
| |
| This program is distributed in the hope that it will be useful, |
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| GNU General Public License for more details. |
+-------------------------------------------------------------------------+
| Cacti: The Complete RRDtool-based Graphing Solution |
+-------------------------------------------------------------------------+
| This code is designed, written, and maintained by the Cacti Group. See |
| about.php and/or the AUTHORS file for specific developer information. |
+-------------------------------------------------------------------------+
| http://www.cacti.net/ |
+-------------------------------------------------------------------------+
*/
require_once('./include/auth.php');
$actions = [
1 => __('Delete'),
3 => __('Enable'),
2 => __('Disable')
];
set_default_action();
if (in_array(grv('action'), [
'delete_page', 'ajax_dnd',
], true)) {
csrf_require_post();
}
switch (grv('action')) {
case 'actions':
form_actions();
break;
case 'delete_page':
if (isrv('id') && gfrv('id')) {
page_delete(grv('id'));
}
header('Location: links.php');
break;
case 'move_page_up':
if (isrv('id') && gfrv('id') && isrv('order') && gfrv('order')) {
page_move(grv('id'), -1);
}
header('Location: links.php');
break;
case 'move_page_down':
if (isrv('id') && gfrv('id') && isrv('order') && gfrv('order')) {
page_move(grv('id'), 1);
}
header('Location: links.php');
break;
case 'ajax_dnd':
csrf_require_post();
$new_order = gnrv('dnd');
links_reorder($new_order);
header('Location: links.php');
break;
case 'save':
$save['id'] = isrv('id') ? gfrv('id') : 0;
$save['title'] = form_input_validate(gnrv('title'), 'title', '', false, 3);
$save['style'] = gnrv('style');
$save['enabled'] = (isrv('enabled') ? 'on' : '');
$save['refresh'] = form_input_validate(gnrv('refresh'), 'refresh', '^[0-9]+$', false, 3);
if (preg_match('/^((((ht|f)tp(s?))\:\/\/){1}\S+)/i', gnrv('fileurl')) && gnrv('filename') == '0') {
if (filter_var(gnrv('fileurl'), FILTER_VALIDATE_URL)) {
$save['contentfile'] = gnrv('fileurl');
} else {
$_SESSION['sess_error_fields']['contentfile'] = 'contentfile';
raise_message('badurl', __('Your contentfile is not a valid URL. Please enter a value URL'), MESSAGE_LEVEL_ERROR);
}
} else {
$save['contentfile'] = preg_replace('/[^A-Za-z0-9_\.-]/', '_', gnrv('filename'));
}
$consolesection = gnrv('consolesection');
$consolenewsection = gnrv('consolenewsection');
$extendedstyle = '';
$lastsortorder = db_fetch_cell('SELECT MAX(sortorder) FROM external_links');
$save['sortorder'] = $lastsortorder + 1;
if ($save['style'] == 'CONSOLE') {
if ($consolesection == '__NEW__') {
$extendedstyle = $consolenewsection;
} else {
$extendedstyle = $consolesection;
}
if ($extendedstyle == '') {
$extendedstyle = __('External Links');
}
}
$save['extendedstyle'] = $extendedstyle;
if (!is_error_message()) {
$id = sql_save($save, 'external_links');
// always give the login account access
db_execute_prepared('REPLACE INTO user_auth_realm (user_id, realm_id) VALUES (?, ?)', [$_SESSION[SESS_USER_ID], $id + 10000]);
raise_message(1);
header('Location: links.php');
exit;
} else {
raise_message(2);
header('Location: links.php?action=edit&id=' . (isrv('id') ? gfrv('id') : ''));
exit;
}
case 'edit':
top_header();
edit_page();
bottom_footer();
break;
default:
top_header();
pages();
bottom_footer();
break;
}
function links_reorder(array $new_order) : void {
if (cacti_sizeof($new_order)) {
$sort = 1;
foreach ($new_order as $l) {
$link_id = str_replace('line', '', $l);
db_execute_prepared('UPDATE external_links
SET sortorder = ?
WHERE id = ?',
[$sort, $link_id]);
$sort++;
}
}
}
function form_actions() : void {
global $actions;
// ================= input validation =================
gfrv('drp_action');
// ====================================================
// if we are to save this form, instead of display it
if (isrv('selected_items')) {
$selected_items = sanitize_unserialize_selected_items(gnrv('selected_items'));
if ($selected_items != false) {
if (grv('drp_action') == '3') { // Enable Page
for ($i = 0; ($i < cacti_count($selected_items)); $i++) {
db_execute_prepared("UPDATE external_links SET enabled='on' WHERE id = ?", [$selected_items[$i]]);
}
} elseif (grv('drp_action') == '2') { // Disable Page
for ($i = 0; ($i < cacti_count($selected_items)); $i++) {
db_execute_prepared("UPDATE external_links SET enabled='' WHERE id = ?", [$selected_items[$i]]);
}
} elseif (grv('drp_action') == '1') { // Delete Page
for ($i = 0; ($i < cacti_count($selected_items)); $i++) {
db_execute_prepared('DELETE FROM external_links WHERE id = ?', [$selected_items[$i]]);
db_execute_prepared('DELETE FROM user_auth_realm WHERE realm_id = ?', [$selected_items[$i] + 10000]);
db_execute_prepared('DELETE FROM user_auth_group_realm WHERE realm_id = ?', [$selected_items[$i] + 10000]);
}
}
}
header('Location: links.php');
exit;
} else {
$ilist = '';
$iarray = [];
// loop through each of the pages selected on the previous page and get more info about them
foreach ($_POST as $var => $val) {
if (preg_match('/^chk_([0-9]+)$/', $var, $matches)) {
// ================= input validation =================
input_validate_input_number($matches[1], 'chk[1]');
// ====================================================
$ilist .= '<li>' . htmle(db_fetch_cell_prepared('SELECT title FROM external_links WHERE id = ?', [$matches[1]])) . '</li>';
$iarray[] = $matches[1];
}
}
$form_data = [
'general' => [
'page' => 'links.php',
'actions' => $actions,
'optvar' => 'drp_action',
'item_array' => $iarray,
'item_list' => $ilist
],
'options' => [
1 => [
'smessage' => __('Click \'Continue\' to Delete the following External Link.'),
'pmessage' => __('Click \'Continue\' to Delete following External Links.'),
'scont' => __('Delete External Link'),
'pcont' => __('Delete External Links')
],
2 => [
'smessage' => __('Click \'Continue\' to Disable the following External Link.'),
'pmessage' => __('Click \'Continue\' to Disable following External Links.'),
'scont' => __('Disable External Link'),
'pcont' => __('Disable External Links')
],
3 => [
'smessage' => __('Click \'Continue\' to Enable the following External Link.'),
'pmessage' => __('Click \'Continue\' to Enable following External Links.'),
'scont' => __('Enable External Link'),
'pcont' => __('Enable External Links'),
]
]
];
form_continue_confirmation($form_data);
}
}
function pages() : void {
global $item_rows, $actions;
// create the page filter
$pageFilter = new CactiTableFilter(__('External Links'), 'links.php', 'links', 'sess_links', 'links.php?action=edit');
$pageFilter->rows_label = __('Receivers');
$pageFilter->set_sort_array('sortorder', 'ASC');
$pageFilter->render();
if (grv('rows') == '-1') {
$rows = read_config_option('num_rows_table');
} else {
$rows = grv('rows');
}
$style_translate = [
'CONSOLE' => __('Console'),
'TAB' => __('Top Tab'),
'FRONT' => __('Bottom Console'),
'FRONTTOP' => __('Top Console')
];
if (grv('filter') != '') {
$sql_where = ' WHERE title LIKE ' . db_qstr('%' . grv('filter') . '%') . ' OR contentfile LIKE ' . db_qstr('%' . grv('filter') . '%');
} else {
$sql_where = '';
}
$sql_order = get_order_string();
$sql_order = str_replace('sortorder DESC', 'sortorder ASC', $sql_order);
$sql_limit = ' LIMIT ' . ($rows * (grv('page') - 1)) . ',' . $rows;
$pages = db_fetch_assoc("SELECT *
FROM external_links
$sql_where
$sql_order
$sql_limit");
$total_rows = db_fetch_cell("SELECT COUNT(*)
FROM external_links
$sql_where");
form_start('links.php', 'chk');
$nav = html_nav_bar('links.php', MAX_DISPLAY_PAGES, get_request_var_request('page'), $rows, $total_rows, 8, __('External Links'), 'page', 'main');
print $nav;
html_start_box('', '100%', false, 3, 'center', '');
$display_text = [
'nosort0' => [
'display' => __('Actions'),
'align' => 'left',
'sort' => ''
],
'contentfile' => [
'display' => __('Page'),
'align' => 'left',
'sort' => 'ASC'
],
'title' => [
'display' => __('Title'),
'align' => 'left',
'sort' => 'ASC'
],
'style' => [
'display' => __('Style'),
'align' => 'left',
'sort' => 'ASC'
],
'disabled' => [
'display' => __('Enabled'),
'align' => 'left',
'sort' => 'ASC'
],
'sortorder' => [
'display' => __('Order'),
'align' => 'center',
'sort' => 'ASC'
]
];
html_header_sort_checkbox($display_text, grv('sort_column'), grv('sort_direction'));
$i = 0;
if (cacti_sizeof($pages)) {
foreach ($pages as $page) {
form_alternate_row('line' . $page['id']);
$menuicons = '<a class="pic" href="' . htmle('links.php?action=edit&id=' . $page['id']) . '" title="' . __esc('Edit Page') . '"><i class="ti ti-edit editTemplate"></i></a>';
if ($page['enabled'] == 'on') {
$menuicons .= '<a class="pic" href="' . htmle('link.php?id=' . $page['id']) . '" title="' . __esc('View Page') . '"><i class="ti ti-eye deviceUp"></i></a>';
}
form_selectable_cell($menuicons, $page['id'], '1%');
form_selectable_ecell($page['contentfile'], $page['id']);
form_selectable_ecell($page['title'], $page['id']);
form_selectable_ecell($style_translate[$page['style']] . ($page['style'] == 'CONSOLE' ? ' ( ' . ($page['extendedstyle'] == '' ? __('External Links') : $page['extendedstyle']) . ' )' : ''), $page['id']);
form_selectable_cell(($page['enabled'] == 'on' ? __('Yes') : __('No')), $page['id']);
if (grv('sort_column') == 'sortorder') {
if ($i != 0) {
$sort = '<a class="pic ti ti-caret-up-filled moveArrow cactiPostAction" href="#" data-url="' . html_escape_url('links.php?action=move_page_up&order=' . $page['sortorder'] . '&id=' . $page['id']) . '"></a>';
} else {
$sort = '<span class="moveArrowNone"></span>';
}
if ($i == cacti_sizeof($pages) - 1) {
$sort .= '<span class="moveArrowNone"></span>';
} else {
$sort .= '<a class="pic ti ti-caret-down-filled moveArrow cactiPostAction" href="#" data-url="' . html_escape_url('links.php?action=move_page_down&order=' . $page['sortorder'] . '&id=' . $page['id']) . '"></a>';
}
form_selectable_cell($sort, $page['id'], '1%', 'center');
} else {
form_selectable_cell(__('Sort for Ordering'), $page['id']);
}
form_checkbox_cell($page['title'], $page['id']);
form_end_row();
$i++;
}
} else {
print "<tr class='tableRow odd'><td colspan='" . (cacti_sizeof($nav) + 1) . "'><em>" . __('No Pages Found') . "</em></td></tr>\n";
}
html_end_box(false);
if (cacti_sizeof($pages)) {
print $nav;
}
draw_actions_dropdown($actions);
form_end();
if (grv('sort_column') == 'sortorder' && read_config_option('drag_and_drop') == 'on') {
?>
<script type='text/javascript'>
$(function() {
$('#links2_child').attr('id', 'dnd');
$('#dnd').find('tr:first').addClass('nodrag').addClass('nodrop');
$('#dnd').tableDnD({
onDrop: function(table, row) {
const request = cactiPreparePostRequest('links.php', 'action=ajax_dnd&' + $.tableDnD.serialize());
postUrl({url: request.url}, request.data);
}
});
});
</script>
<?php
}
}
function page_delete(int $id) : void {
db_execute_prepared('DELETE FROM external_links WHERE id = ?', [$id]);
db_execute_prepared('DELETE FROM user_auth_realm WHERE realm_id = ?', [$id + 10000]);
db_execute_prepared('DELETE FROM user_auth_group_realm WHERE realm_id = ?', [$id + 10000]);
page_resort();
}
function page_resort() : void {
$pages = db_fetch_assoc('SELECT * FROM external_links ORDER BY sortorder');
$i = 1;
if (cacti_sizeof($pages)) {
foreach ($pages as $page) {
db_execute_prepared('UPDATE external_links SET sortorder = ? WHERE id = ?', [$i, $page['id']]);
$i++;
}
}
}
function page_move(int $pageid, int $direction) : void {
$oldorder = db_fetch_cell_prepared('SELECT sortorder FROM external_links WHERE id = ?', [$pageid]);
$neworder = $oldorder + $direction;
$otherid = db_fetch_cell_prepared('SELECT id FROM external_links WHERE sortorder = ?', [$neworder]);
if (!empty($otherid)) {
db_execute_prepared('UPDATE external_links SET sortorder = ? WHERE id = ?', [$neworder, $pageid]);
db_execute_prepared('UPDATE external_links SET sortorder = ? WHERE id = ?', [$oldorder, $otherid]);
}
}
function edit_page() : void {
global $poller_intervals;
$sections = db_fetch_assoc("SELECT extendedstyle
FROM external_links
WHERE style='CONSOLE'
GROUP BY extendedstyle
ORDER BY extendedstyle");
$sec_ar = [];
$sec_ar['External Links'] = __('External Links');
foreach ($sections as $sec) {
if ($sec['extendedstyle'] != '') {
$sec_ar[$sec['extendedstyle']] = $sec['extendedstyle'];
}
}
$sec_ar['__NEW__'] = 'New Name Below';
if (isrv('id')) {
$data = db_fetch_row_prepared('SELECT * FROM external_links WHERE id = ?', [gfrv('id')]);
} else {
$data = [];
}
$myrefresh[0] = __('Disabled');
$myrefresh += $poller_intervals;
$field_array = [
'id' => [
'friendly_name' => __('Style'),
'method' => 'hidden',
'value' => isrv('id') ? grv('id') : 0
],
'style' => [
'friendly_name' => __('Style'),
'method' => 'drop_array',
'array' => [
'TAB' => __('Top Tab'),
'CONSOLE' => __('Console Menu'),
'FRONT' => __('Bottom of Console Page'),
'FRONTTOP' => __('Top of Console Page')
],
'description' => __('Where should this page appear?'),
'value' => (isset($data['style']) ? $data['style'] : '')
],
'consolesection' => [
'friendly_name' => __('Console Menu Section'),
'method' => 'drop_array',
'array' => $sec_ar,
'description' => __('Under which Console heading should this item appear? (All External Link menus will appear between Configuration and Utilities)'),
'value' => (isset($data['extendedstyle']) ? $data['extendedstyle'] : '')
],
'consolenewsection' => [
'friendly_name' => __('New Console Section'),
'method' => 'textbox',
'max_length' => 20,
'description' => __('If you don\'t like any of the choices above, type a new title in here.'),
'value' => (isset($data['extendedstyle']) ? $data['extendedstyle'] : '')
],
'title' => [
'friendly_name' => __('Tab/Menu Name'),
'method' => 'textbox',
'max_length' => 20,
'description' => __('The text that will appear in the tab or menu.'),
'value' => (isset($data['title']) ? $data['title'] : '')
],
'filename' => [
'friendly_name' => __('Content File/URL'),
'method' => 'drop_files',
'directory' => CACTI_PATH_INCLUDE . '/content',
'exclusions' => ['README', 'index.php'],
'none_value' => __('Web URL Below'),
'description' => __('The file that contains the content for this page. This file needs to be in the Cacti \'include/content/\' directory.'),
'value' => (isset($data['contentfile']) ? $data['contentfile'] : '')
],
'fileurl' => [
'friendly_name' => __('Web URL Location'),
'method' => 'textbox',
'description' => __('The valid URL to use for this external link. Must include the type, for example http://www.cacti.net. Note that many websites do not allow them to be embedded in an iframe from a foreign site, and therefore External Linking may not work.'),
'max_length' => 255,
'size' => 80,
'default' => 'http://www.cacti.net',
'value' => (isset($data['contentfile']) ? $data['contentfile'] : '')
],
'enabled' => [
'friendly_name' => __('Enabled'),
'method' => 'checkbox',
'description' => __('If checked, the page will be available immediately to the admin user.'),
'default' => 'on',
'value' => (isset($data['enabled']) ? 'on' : '')
],
'refresh' => [
'friendly_name' => __('Automatic Page Refresh'),
'method' => 'drop_array',
'array' => $myrefresh,
'description' => __('How often do you wish this page to be refreshed automatically.'),
'value' => (isset($data['refresh']) ? $data['refresh'] : '')
],
];
form_start('links.php', 'link_edit');
if (isset($data['title'])) {
html_start_box(__('External Links [edit: %s]', htmle($data['title'])), '100%', true, 3, 'center', '');
} else {
html_start_box(__('External Links [new]'), '100%', true, 3, 'center', '');
}
draw_edit_form(
[
'config' => ['no_form_tag' => true],
'fields' => $field_array
]
);
html_end_box(true, true);
form_save_button('links.php', 'save');
?>
<script type='text/javascript'>
$(function() {
// hide and show the extra console fields when necessary
$('#style').change(function() {
if ($('#style').val() != 'CONSOLE') {
$('#row_consolesection').hide();
$('#row_consolenewsection').hide();
} else {
$('#row_consolesection').show();
setConsoleNewSectionVisibility();
}
}).change();
$('#filename').change(function() {
changeFilename();
}).change();
// if you change the section, make the 'new' textbox reflect it
// if you change it to 'new', then clear the textbox, and jump to it
$('#consolesection').change(function() {
setConsoleNewSectionVisibility();
}).change();
});
function setConsoleNewSectionVisibility() {
var isNew = $('#consolesection').val() == '__NEW__';
toggleFields({
row_consolenewsection: isNew,
});
if (isNew) {
$('#consolenewsection').focus();
}
}
function changeFilename() {
toggleFields({
fileurl: $('#filename').val() == 0,
});
}
</script>
<?php
}