mirror of
https://github.com/Cacti/cacti.git
synced 2026-11-08 21:16:17 +09:00
Tony Roman
872f374725
Update to remove XSS issues reported by Redhat Security Response Team git-svn-id: svn+ssh://repo.cacti.net/var/data/svnroot/cacti/cacti/branches/0.8.7@6025 860744bd-22fc-0310-8c96-e9fe5004b5ca
170 lines
9.3 KiB
PHP
170 lines
9.3 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2010 The Cacti Group |
|
|
| |
|
|
| This program is free software; you can redistribute it and/or |
|
|
| modify it under the terms of the GNU General Public License |
|
|
| as published by the Free Software Foundation; either version 2 |
|
|
| of the License, or (at your option) any later version. |
|
|
| |
|
|
| This program is distributed in the hope that it will be useful, |
|
|
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
|
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
|
| GNU General Public License for more details. |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDTool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
| This code is designed, written, and maintained by the Cacti Group. See |
|
|
| about.php and/or the AUTHORS file for specific developer information. |
|
|
+-------------------------------------------------------------------------+
|
|
| http://www.cacti.net/ |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
$using_guest_account = false;
|
|
$show_console_tab = true;
|
|
|
|
/* ================= input validation ================= */
|
|
input_validate_input_number(get_request_var_request("local_graph_id"));
|
|
input_validate_input_number(get_request_var_request("graph_start"));
|
|
input_validate_input_number(get_request_var_request("graph_end"));
|
|
/* ==================================================== */
|
|
|
|
if (read_config_option("auth_method") != 0) {
|
|
/* at this point this user is good to go... so get some setting about this
|
|
user and put them into variables to save excess SQL in the future */
|
|
$current_user = db_fetch_row("select * from user_auth where id=" . $_SESSION["sess_user_id"]);
|
|
|
|
/* find out if we are logged in as a 'guest user' or not */
|
|
if (db_fetch_cell("select id from user_auth where username='" . read_config_option("guest_user") . "'") == $_SESSION["sess_user_id"]) {
|
|
$using_guest_account = true;
|
|
}
|
|
|
|
/* find out if we should show the "console" tab or not, based on this user's permissions */
|
|
if (sizeof(db_fetch_assoc("select realm_id from user_auth_realm where realm_id=8 and user_id=" . $_SESSION["sess_user_id"])) == 0) {
|
|
$show_console_tab = false;
|
|
}
|
|
}
|
|
|
|
/* need to correct $_SESSION["sess_nav_level_cache"] in zoom view */
|
|
if (isset($_REQUEST["action"]) && $_REQUEST["action"] == "zoom") {
|
|
$_SESSION["sess_nav_level_cache"][2]["url"] = "graph.php?local_graph_id=" . $_REQUEST["local_graph_id"] . "&rra_id=all";
|
|
}
|
|
|
|
?>
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
|
<html>
|
|
<head>
|
|
<title><?php echo draw_navigation_text("title");?></title>
|
|
<?php
|
|
if (isset($_SESSION["custom"]) && $_SESSION["custom"] == true) {
|
|
print "<meta http-equiv=refresh content='99999'>\r\n";
|
|
}else{
|
|
print "<meta http-equiv=refresh content='" . htmlspecialchars(read_graph_config_option("page_refresh"),ENT_QUOTES) . "'>\r\n";
|
|
}
|
|
?>
|
|
<meta http-equiv="Content-Type" content="text/html;charset=utf-8">
|
|
<link href="include/main.css" type="text/css" rel="stylesheet">
|
|
<link href="images/favicon.ico" rel="shortcut icon"/>
|
|
<script type="text/javascript" src="include/layout.js"></script>
|
|
<script type="text/javascript" src="include/treeview/ua.js"></script>
|
|
<script type="text/javascript" src="include/treeview/ftiens4.js"></script>
|
|
<script type="text/javascript" src="include/jscalendar/calendar.js"></script>
|
|
<script type="text/javascript" src="include/jscalendar/lang/calendar-en.js"></script>
|
|
<script type="text/javascript" src="include/jscalendar/calendar-setup.js"></script>
|
|
</head>
|
|
|
|
<body>
|
|
<a name='page_top'></a>
|
|
<table style="width:100%;height:100%;" cellspacing="0" cellpadding="0">
|
|
<tr style="height:25px;" bgcolor="#a9a9a9" class="noprint">
|
|
<td colspan="2" valign="bottom" nowrap>
|
|
<table width="100%" cellspacing="0" cellpadding="0">
|
|
<tr style="background: transparent url('images/cacti_backdrop2.gif') no-repeat center right;">
|
|
<td id="tabs" nowrap>
|
|
<?php if ($show_console_tab == true) {?><a href="index.php"><img src="images/tab_console.gif" alt="Console" align="absmiddle" border="0"></a><?php }?><a href="graph_view.php"><img src="images/tab_graphs<?php if ((substr(basename($_SERVER["PHP_SELF"]),0,5) == "graph") || (basename($_SERVER["PHP_SELF"]) == "graph_settings.php")) { print "_down"; } print ".gif";?>" alt="Graphs" align="absmiddle" border="0"></a>
|
|
</td>
|
|
<td id="gtabs" align="right" nowrap>
|
|
<?php if ((!isset($_SESSION["sess_user_id"])) || ($current_user["graph_settings"] == "on")) { print '<a href="graph_settings.php"><img src="images/tab_settings'; if (basename($_SERVER["PHP_SELF"]) == "graph_settings.php") { print "_down"; } print '.gif" border="0" alt="Settings" align="absmiddle"></a>';}?> <?php if ((!isset($_SESSION["sess_user_id"])) || ($current_user["show_tree"] == "on")) {?><a href="<?php print htmlspecialchars("graph_view.php?action=tree");?>"><img src="images/tab_mode_tree<?php if (isset($_REQUEST["action"]) && $_REQUEST["action"] == "tree") { print "_down"; }?>.gif" border="0" title="Tree View" alt="Tree View" align="absmiddle"></a><?php }?><?php if ((!isset($_SESSION["sess_user_id"])) || ($current_user["show_list"] == "on")) {?><a href="graph_view.php?action=list"><img src="images/tab_mode_list<?php if (isset($_REQUEST["action"]) && $_REQUEST["action"] == "list") { print "_down"; }?>.gif" border="0" title="List View" alt="List View" align="absmiddle"></a><?php }?><?php if ((!isset($_SESSION["sess_user_id"])) || ($current_user["show_preview"] == "on")) {?><a href="graph_view.php?action=preview"><img src="images/tab_mode_preview<?php if (isset($_REQUEST["action"]) && $_REQUEST["action"] == "preview") { print "_down"; }?>.gif" border="0" title="Preview View" alt="Preview View" align="absmiddle"></a><?php }?> <br>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</td>
|
|
</tr>
|
|
<tr style="height:2px;" bgcolor="#183c8f" class="noprint">
|
|
<td colspan="2">
|
|
<img src="images/transparent_line.gif" style="height:2px;width:170px;" border="0"><br>
|
|
</td>
|
|
</tr>
|
|
<tr style="height:5px;" bgcolor="#e9e9e9" class="noprint">
|
|
<td colspan="2">
|
|
<table width="100%">
|
|
<tr>
|
|
<td>
|
|
<?php echo draw_navigation_text();?>
|
|
</td>
|
|
<td align="right">
|
|
<?php if ((isset($_SESSION["sess_user_id"])) && ($using_guest_account == false)) { ?>
|
|
Logged in as <strong><?php print db_fetch_cell("select username from user_auth where id=" . $_SESSION["sess_user_id"]);?></strong> (<a href="logout.php">Logout</a>)
|
|
<?php } ?>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</td>
|
|
</tr>
|
|
<tr class="noprint">
|
|
<td bgcolor="#efefef" colspan="1" style="height:8px;background-image: url(images/shadow_gray.gif); background-repeat: repeat-x; border-right: #aaaaaa 1px solid;">
|
|
<img src="images/transparent_line.gif" width="<?php print htmlspecialchars(read_graph_config_option("default_dual_pane_width"));?>" style="height:2px;" border="0"><br>
|
|
</td>
|
|
<td bgcolor="#ffffff" colspan="1" style="height:8px;background-image: url(images/shadow.gif); background-repeat: repeat-x;">
|
|
|
|
</td>
|
|
</tr>
|
|
|
|
<?php if ((basename($_SERVER["PHP_SELF"]) == "graph.php") && ($_REQUEST["action"] == "properties")) {?>
|
|
<tr>
|
|
<td valign="top" style="height:1px;" colspan="3" bgcolor="#efefef">
|
|
<?php
|
|
$graph_data_array["print_source"] = true;
|
|
|
|
/* override: graph start time (unix time) */
|
|
if (!empty($_GET["graph_start"])) {
|
|
$graph_data_array["graph_start"] = get_request_var_request("graph_start");
|
|
}
|
|
|
|
/* override: graph end time (unix time) */
|
|
if (!empty($_GET["graph_end"])) {
|
|
$graph_data_array["graph_end"] = get_request_var_request("graph_end");
|
|
}
|
|
|
|
print trim(@rrdtool_function_graph(get_request_var_request("local_graph_id"), get_request_var_request("rra_id"), $graph_data_array));
|
|
?>
|
|
</td>
|
|
</tr>
|
|
<?php }
|
|
load_current_session_value("action", "sess_cacti_graph_action", $graph_views[read_graph_config_option("default_tree_view_mode")]);
|
|
?>
|
|
<tr>
|
|
<?php if (basename($_SERVER["PHP_SELF"]) == "graph_view.php" && ($_REQUEST["action"] == "tree" || (isset($_REQUEST["view_type"]) && $_REQUEST["view_type"] == "tree"))) { ?>
|
|
<td valign="top" style="padding: 5px; border-right: #aaaaaa 1px solid;background-repeat:repeat-y;background-color:#efefef;" bgcolor='#efefef' width='<?php print htmlspecialchars(read_graph_config_option("default_dual_pane_width"));?>' class='noprint'>
|
|
<table border=0 cellpadding=0 cellspacing=0><tr><td><a style="font-size:7pt;text-decoration:none;color:silver" href="http://www.treemenu.net/" target=_blank></a></td></tr></table>
|
|
<?php grow_dhtml_trees(); ?>
|
|
<script type="text/javascript">initializeDocument();</script>
|
|
|
|
<?php if (isset($_GET["select_first"])) { ?>
|
|
<script type="text/javascript">
|
|
var tobj;
|
|
tobj = findObj(1);
|
|
|
|
if (tobj) {
|
|
if (!tobj.isOpen) {
|
|
clickOnNode(1);
|
|
}
|
|
}
|
|
</script>
|
|
<?php } ?>
|
|
</td>
|
|
<?php } ?>
|
|
<td valign="top" style="padding: 5px; border-right: #aaaaaa 1px solid;"><div style='position:static;' id='main'>
|