mirror of
https://github.com/Cacti/cacti.git
synced 2026-11-02 18:17:00 +09:00
TheWitness
7b551eea72
Excludes vendored packages, third-party JS, patches, and the Win32 probe fixture. Pure EOL change; guards pass and php -l is clean.
37 lines
1.4 KiB
PHP
37 lines
1.4 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDtool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
/*
|
|
* GHSA-j67j-wpm4-9g3x: the update_policy branch runs before the action
|
|
* dispatcher, so the global.php GET/CSRF denylist cannot cover it. Both
|
|
* user_admin.php and user_group_admin.php must require a POST before calling
|
|
* update_policies() (csrf_check() only validates the token on POST).
|
|
*/
|
|
|
|
$root = dirname(__DIR__, 4);
|
|
|
|
test('update_policy requires a POST before mutating the policy', function () use ($root) {
|
|
foreach (array('/user_admin.php', '/user_group_admin.php') as $file) {
|
|
$source = file_get_contents($root . $file);
|
|
|
|
$branch = strpos($source, "if (isrv('update_policy')) {");
|
|
$call = strpos($source, 'update_policies();', $branch);
|
|
$guard = strpos($source, "strtoupper(\$_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'POST'", $branch);
|
|
|
|
expect($branch)->not->toBeFalse()
|
|
->and($call)->not->toBeFalse()
|
|
->and($guard)->not->toBeFalse()
|
|
->and($guard)->toBeLessThan($call);
|
|
|
|
$pre = substr($source, $guard, $call - $guard);
|
|
expect($pre)->toContain('http_response_code(405)')
|
|
->and($pre)->toContain('exit;');
|
|
}
|
|
});
|