mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-24 03:57:32 +09:00
TheWitness
7b551eea72
Excludes vendored packages, third-party JS, patches, and the Win32 probe fixture. Pure EOL change; guards pass and php -l is clean.
24 lines
982 B
PHP
24 lines
982 B
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDtool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
/*
|
|
* GHSA-77pr-g949-4v5f: spikekill.php authorized only the Spike Kill realm
|
|
* (1043) and never the target graph, so a realm holder could destroy the RRD
|
|
* history of a graph their permissions deny.
|
|
*/
|
|
|
|
$root = dirname(__DIR__, 4);
|
|
|
|
test('spikekill authorizes the target graph in addition to the Spike Kill realm', function () use ($root) {
|
|
$source = file_get_contents($root . '/spikekill.php');
|
|
|
|
expect($source)->toContain('is_realm_allowed(1043) && is_graph_allowed($local_graph_id)')
|
|
->and($source)->not->toContain("if (is_realm_allowed(1043)) {\n\t\$local_data_ids");
|
|
});
|