mirror of
https://github.com/Cacti/cacti.git
synced 2026-11-03 02:27:13 +09:00
71 lines
2.6 KiB
PHP
71 lines
2.6 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDtool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
/*
|
|
* Forward-port of the 1.2.x hardening fixes. cacti_is_https() is exercised
|
|
* directly (it has no DB dependency); the remaining three are source-scan
|
|
* guards because they sit inside DB/shell code paths.
|
|
*/
|
|
|
|
$functions = file_get_contents(dirname(__DIR__, 4) . '/lib/functions.php');
|
|
$auth = file_get_contents(dirname(__DIR__, 4) . '/lib/auth.php');
|
|
$dsstats = file_get_contents(dirname(__DIR__, 4) . '/lib/dsstats.php');
|
|
|
|
require_once dirname(__DIR__, 4) . '/lib/functions.php';
|
|
|
|
beforeEach(function () {
|
|
unset($_SERVER['HTTPS'], $_SERVER['HTTP_X_FORWARDED_PROTO'], $_SERVER['HTTP_X_FORWARDED_SSL']);
|
|
$GLOBALS['config']['proxy_headers'] = [];
|
|
});
|
|
|
|
test('cacti_is_https is true on direct TLS and false on plain http', function () {
|
|
$_SERVER['HTTPS'] = 'on';
|
|
expect(cacti_is_https())->toBeTrue();
|
|
|
|
$_SERVER['HTTPS'] = 'off';
|
|
expect(cacti_is_https())->toBeFalse();
|
|
|
|
unset($_SERVER['HTTPS']);
|
|
expect(cacti_is_https())->toBeFalse();
|
|
});
|
|
|
|
test('a forwarded proto is honoured only when proxy trust is enabled', function () {
|
|
$_SERVER['HTTP_X_FORWARDED_PROTO'] = 'https';
|
|
|
|
// proxy trust off: a client-supplied header must NOT force https
|
|
$GLOBALS['config']['proxy_headers'] = [];
|
|
expect(cacti_is_https())->toBeFalse();
|
|
|
|
// proxy trust on: the forwarded proto is honoured
|
|
$GLOBALS['config']['proxy_headers'] = ['REMOTE_ADDR'];
|
|
expect(cacti_is_https())->toBeTrue();
|
|
});
|
|
|
|
test('X-Forwarded-SSL on is honoured under proxy trust', function () {
|
|
$GLOBALS['config']['proxy_headers'] = true;
|
|
$_SERVER['HTTP_X_FORWARDED_SSL'] = 'on';
|
|
expect(cacti_is_https())->toBeTrue();
|
|
});
|
|
|
|
test('get_guest_account requires the guest user to be enabled', function () use ($functions) {
|
|
$start = strpos($functions, 'function get_guest_account(');
|
|
expect(substr($functions, $start, 400))->toContain("enabled = 'on'");
|
|
});
|
|
|
|
test('permission where-clauses cast ids to int', function () use ($auth) {
|
|
expect($auth)->not->toContain('" gl.id = $graph_id"');
|
|
expect($auth)->not->toContain('" h.id = $device_id"');
|
|
expect($auth)->toContain('(int) $graph_id');
|
|
expect($auth)->toContain('(int) $device_id');
|
|
});
|
|
|
|
test('path_dsstats_log is escaped in the shell redirect', function () use ($dsstats) {
|
|
expect(substr_count($dsstats, "cacti_escapeshellarg(read_config_option('path_dsstats_log'))"))->toBe(2);
|
|
});
|