mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-28 23:57:30 +09:00
TheWitness
7b551eea72
Excludes vendored packages, third-party JS, patches, and the Win32 probe fixture. Pure EOL change; guards pass and php -l is clean.
33 lines
1.1 KiB
PHP
33 lines
1.1 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
/*
|
|
* GHSA-73qf-hq23-c4m7: tree.php's lock/unlock/get_node actions dispatched to
|
|
* api_tree_*() with no ownership check, letting any authenticated user lock or
|
|
* unlock any tree and read another user's private tree structure. Every tree
|
|
* node action must gate on is_tree_allowed() before dispatch, like the node
|
|
* write actions already do.
|
|
*/
|
|
|
|
$root = dirname(__DIR__, 4);
|
|
$source = file_get_contents($root . '/tree.php');
|
|
|
|
$actions = ['lock', 'unlock', 'copy_node', 'create_node', 'delete_node', 'move_node', 'rename_node', 'get_node'];
|
|
|
|
test('every tree node action is gated by is_tree_allowed before dispatch', function () use ($source, $actions) {
|
|
foreach ($actions as $action) {
|
|
$pos = strpos($source, "case '" . $action . "':");
|
|
|
|
expect($pos)->not->toBeFalse();
|
|
|
|
$next = strpos($source, 'break;', $pos);
|
|
$block = substr($source, $pos, $next - $pos);
|
|
|
|
expect($block)->toContain('is_tree_allowed');
|
|
}
|
|
});
|