Skip to content

Commit e8dbb6d

Browse files
somethingwithproofsomethingwithproof
committed
Merge remote-tracking branch 'fork/fix/defense-in-depth' into security/consolidated-no-tests-20260412
2 parents 5dbf017 + e591b10 commit e8dbb6d

11 files changed

Lines changed: 131 additions & 57 deletions

‎notify_lists.php‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -573,7 +573,7 @@ function form_actions() {
573573
<input type='hidden' name='action' value='actions'>
574574
<input type='hidden' name='save_list' value='1'>
575575
<input type='hidden' name='selected_items' value='" . (isset($array) ? serialize($array) : '') . "'>
576-
<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
576+
<input type='hidden' name='drp_action' value='" . html_escape(get_request_var('drp_action')) . "'>
577577
$save_html
578578
</td>
579579
</tr>";
@@ -648,10 +648,10 @@ function form_actions() {
648648
print " <tr>
649649
<td class='saveRow'>
650650
<input type='hidden' name='action' value='actions'>
651-
<input type='hidden' name='id' value='" . get_request_var('id') . "'>
651+
<input type='hidden' name='id' value='" . html_escape(get_request_var('id')) . "'>
652652
<input type='hidden' name='save_templates' value='1'>
653653
<input type='hidden' name='selected_items' value='" . (isset($array) ? serialize($array) : '') . "'>
654-
<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
654+
<input type='hidden' name='drp_action' value='" . html_escape(get_request_var('drp_action')) . "'>
655655
$save_html
656656
</td>
657657
</tr>";
@@ -726,10 +726,10 @@ function form_actions() {
726726
print " <tr>
727727
<td class='saveRow'>
728728
<input type='hidden' name='action' value='actions'>
729-
<input type='hidden' name='id' value='" . get_request_var('id') . "'>
729+
<input type='hidden' name='id' value='" . html_escape(get_request_var('id')) . "'>
730730
<input type='hidden' name='save_tholds' value='1'>
731731
<input type='hidden' name='selected_items' value='" . (isset($array) ? serialize($array) : '') . "'>
732-
<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
732+
<input type='hidden' name='drp_action' value='" . html_escape(get_request_var('drp_action')) . "'>
733733
$save_html
734734
</td>
735735
</tr>";
@@ -811,10 +811,10 @@ function form_actions() {
811811
print "<tr>
812812
<td class='saveRow'>
813813
<input type='hidden' name='action' value='actions'>
814-
<input type='hidden' name='id' value='" . get_request_var('id') . "'>
814+
<input type='hidden' name='id' value='" . html_escape(get_request_var('id')) . "'>
815815
<input type='hidden' name='save_associate' value='1'>
816816
<input type='hidden' name='selected_items' value='" . (isset($array) ? serialize($array) : '') . "'>
817-
<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
817+
<input type='hidden' name='drp_action' value='" . html_escape(get_request_var('drp_action')) . "'>
818818
$save_html
819819
</td>
820820
</tr>";
@@ -1121,7 +1121,7 @@ function hosts($header_label) {
11211121
<script type='text/javascript'>
11221122

11231123
function applyFilter() {
1124-
strURL = '?header=false&action=edit&id=<?php print get_request_var('id'); ?>'
1124+
strURL = '?header=false&action=edit&id=<?php print (int)get_filter_request_var('id'); ?>'
11251125
strURL += '&rows=' + $('#rows').val();
11261126
strURL += '&host_template_id=' + $('#host_template_id').val();
11271127
strURL += '&site_id=' + $('#site_id').val();
@@ -1131,12 +1131,12 @@ function applyFilter() {
11311131
}
11321132

11331133
function clearFilter() {
1134-
strURL = 'notify_lists.php?header=false&action=edit&id=<?php print get_request_var('id'); ?>&clear=true'
1134+
strURL = 'notify_lists.php?header=false&action=edit&id=<?php print (int)get_filter_request_var('id'); ?>&clear=true'
11351135
loadPageNoHeader(strURL);
11361136
}
11371137

11381138
$(function() {
1139-
$('#form_devices').submit(function(event) {
1139+
$('#form_devices').on('submit', function(event) {
11401140
event.preventDefault();
11411141
applyFilter();
11421142
});
@@ -1224,7 +1224,7 @@ function clearFilter() {
12241224

12251225
$hosts = db_fetch_assoc_prepared($sql_query, $sql_params);
12261226

1227-
$nav = html_nav_bar('notify_lists.php?action=edit&id=' . get_request_var('id'), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, 10, __('Devices', 'thold'), 'page', 'main');
1227+
$nav = html_nav_bar('notify_lists.php?action=edit&id=' . (int)get_request_var('id'), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, 10, __('Devices', 'thold'), 'page', 'main');
12281228

12291229
form_start('notify_lists.php', 'chk');
12301230

@@ -1370,15 +1370,15 @@ function tholds($header_label) {
13701370
$limit = ($rows * (intval(get_request_var('page')) - 1)) . ", $rows";
13711371

13721372
if (!isempty_request_var('template') && get_request_var('template') != '-1') {
1373-
$sql_where .= ($sql_where == '' ? '' : ' AND ') . 'td.data_template_id = ' . get_request_var('template');
1373+
$sql_where .= ($sql_where == '' ? '' : ' AND ') . 'td.data_template_id = ' . (int)get_request_var('template');
13741374
}
13751375

13761376
if (get_request_var('site_id') == '-1') {
13771377
// Show all items
13781378
} elseif (get_request_var('site_id') == '0') {
13791379
$sql_where .= ($sql_where == '' ? '' : ' AND ') . ' h.site_id=0';
13801380
} elseif (!isempty_request_var('site_id')) {
1381-
$sql_where .= ($sql_where == '' ? '' : ' AND ') . ' h.site_id=' . get_request_var('site_id');
1381+
$sql_where .= ($sql_where == '' ? '' : ' AND ') . ' h.site_id=' . (int)get_request_var('site_id');
13821382
}
13831383

13841384
if (strlen(get_request_var('rfilter'))) {
@@ -1390,7 +1390,7 @@ function tholds($header_label) {
13901390
}
13911391

13921392
if (get_request_var('associated') == 'true') {
1393-
$sql_where .= (!strlen($sql_where) ? '' : ' AND ') . '(td.notify_warning=' . get_request_var('id') . ' OR td.notify_alert=' . get_request_var('id') . ')';
1393+
$sql_where .= (!strlen($sql_where) ? '' : ' AND ') . '(td.notify_warning=' . (int)get_request_var('id') . ' OR td.notify_alert=' . (int)get_request_var('id') . ')';
13941394
}
13951395

13961396
$result = get_allowed_thresholds($sql_where, $sort, $limit, $total_rows);
@@ -1490,7 +1490,7 @@ function tholds($header_label) {
14901490
<script type='text/javascript'>
14911491

14921492
function applyFilter() {
1493-
strURL = 'notify_lists.php?header=false&action=edit&tab=tholds&id=<?php print get_request_var('id'); ?>'
1493+
strURL = 'notify_lists.php?header=false&action=edit&tab=tholds&id=<?php print (int)get_filter_request_var('id'); ?>'
14941494
strURL += '&associated=' + $('#associated').is(':checked');
14951495
strURL += '&state=' + $('#state').val();
14961496
strURL += '&site_id=' + $('#site_id').val();
@@ -1501,12 +1501,12 @@ function applyFilter() {
15011501
}
15021502

15031503
function clearFilter() {
1504-
strURL = 'notify_lists.php?header=false&action=edit&tab=tholds&id=<?php print get_request_var('id'); ?>&clear=true'
1504+
strURL = 'notify_lists.php?header=false&action=edit&tab=tholds&id=<?php print (int)get_filter_request_var('id'); ?>&clear=true'
15051505
loadPageNoHeader(strURL);
15061506
}
15071507

15081508
$(function() {
1509-
$('#listthold').submit(function(event) {
1509+
$('#listthold').on('submit', function(event) {
15101510
event.preventDefault();
15111511
applyFilter();
15121512
});
@@ -1781,20 +1781,20 @@ function templates($header_label) {
17811781
<script type='text/javascript'>
17821782

17831783
function applyFilter() {
1784-
strURL = 'notify_lists.php?header=false&action=edit&tab=templates&id=<?php print get_request_var('id'); ?>'
1784+
strURL = 'notify_lists.php?header=false&action=edit&tab=templates&id=<?php print (int)get_filter_request_var('id'); ?>'
17851785
strURL += '&associated=' + $('#associated').is(':checked');
17861786
strURL += '&rows=' + $('#rows').val();
17871787
strURL += '&rfilter=' + base64_encode($('#rfilter').val());
17881788
loadPageNoHeader(strURL);
17891789
}
17901790

17911791
function clearFilter() {
1792-
strURL = 'notify_lists.php?header=false&action=edit&tab=templates&id=<?php print get_request_var('id'); ?>&clear=true'
1792+
strURL = 'notify_lists.php?header=false&action=edit&tab=templates&id=<?php print (int)get_filter_request_var('id'); ?>&clear=true'
17931793
loadPageNoHeader(strURL);
17941794
}
17951795

17961796
$(function() {
1797-
$('#listthold').submit(function(event) {
1797+
$('#listthold').on('submit', function(event) {
17981798
event.preventDefault();
17991799
applyFilter();
18001800
});
@@ -2113,7 +2113,7 @@ function clearFilter() {
21132113
}
21142114

21152115
$(function() {
2116-
$('#lists').submit(function(event) {
2116+
$('#lists').on('submit', function(event) {
21172117
event.preventDefault();
21182118
applyFilter();
21192119
});

‎notify_queue.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -331,30 +331,30 @@ function clearFilter() {
331331
}
332332

333333
$(function() {
334-
$('#refresh').click(function() {
334+
$('#refresh').on('click', function() {
335335
applyFilter();
336336
});
337337

338-
$('#clear').click(function() {
338+
$('#clear').on('click', function() {
339339
clearFilter();
340340
});
341341

342-
$('#suspend').click(function() {
342+
$('#suspend').on('click', function() {
343343
strURL = 'notify_queue.php?action=suspend';
344344
loadPage(strURL);
345345
});
346346

347-
$('#resume').click(function() {
347+
$('#resume').on('click', function() {
348348
strURL = 'notify_queue.php?action=resume';
349349
loadPage(strURL);
350350
});
351351

352-
$('#purge').click(function() {
352+
$('#purge').on('click', function() {
353353
strURL = 'notify_queue.php?action=purge';
354354
loadPage(strURL);
355355
});
356356

357-
$('#form_notify').submit(function(event) {
357+
$('#form_notify').on('submit', function(event) {
358358
event.preventDefault();
359359
applyFilter();
360360
});

‎setup.php‎

Lines changed: 16 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1233,7 +1233,7 @@ function thold_page_head() {
12331233
<script type='text/javascript'>
12341234
$(function() {
12351235
$(document).ajaxComplete(function() {
1236-
$('.tholdVRule').unbind().click(function(event) {
1236+
$('.tholdVRule').off().on('click', function(event) {
12371237
event.preventDefault();
12381238

12391239
href = $(this).attr('href');
@@ -1394,14 +1394,14 @@ function thold_device_top() {
13941394
$('#cdialog').dialog();
13951395
});
13961396

1397-
$('#continue').click(function(data) {
1397+
$('#continue').on('click', function(data) {
13981398
$.post('host.php?action=item_remove_tt', {
13991399
__csrf_magic: csrfMagicToken,
1400-
host_id: <?php print get_request_var('host_id'); ?>,
1401-
id: <?php print get_request_var('id'); ?>
1400+
host_id: <?php print (int)get_filter_request_var('host_id'); ?>,
1401+
id: <?php print (int)get_filter_request_var('id'); ?>
14021402
}).done(function(data) {
14031403
$('#cdialog').dialog('close');
1404-
loadPageNoHeader('host.php?action=edit&header=false&id=<?php print get_request_var('host_id'); ?>');
1404+
loadPageNoHeader('host.php?action=edit&header=false&id=<?php print (int)get_filter_request_var('host_id'); ?>');
14051405
});
14061406
});
14071407
</script>
@@ -1503,15 +1503,13 @@ function thold_device_template_edit() {
15031503
</table>
15041504
<script type='text/javascript'>
15051505
function addThresholdTemplate() {
1506-
$('#add_tt').click(function() {
1507-
scrollTop = $(window).scrollTop();
1508-
$.post('host_templates.php?header=false&action=item_add_tt', {
1509-
host_template_id: $('#id').val(),
1510-
thold_template_id: $('#thold_template_id').val(),
1511-
__csrf_magic: csrfMagicToken})
1512-
.done(function(data) {
1513-
loadPageNoHeader(urlPath+'host_templates.php?header=false&action=edit&id='+$('#id').val());
1514-
});
1506+
scrollTop = $(window).scrollTop();
1507+
$.post('host_templates.php?header=false&action=item_add_tt', {
1508+
host_template_id: $('#id').val(),
1509+
thold_template_id: $('#thold_template_id').val(),
1510+
__csrf_magic: csrfMagicToken})
1511+
.done(function(data) {
1512+
loadPageNoHeader(urlPath+'host_templates.php?header=false&action=edit&id='+$('#id').val());
15151513
});
15161514
}
15171515
</script>
@@ -1564,14 +1562,14 @@ function thold_device_template_top() {
15641562
$('#cdialog').dialog();
15651563
});
15661564

1567-
$('#continue').click(function(data) {
1565+
$('#continue').on('click', function(data) {
15681566
$.post('host_templates.php?action=item_remove_tt', {
15691567
__csrf_magic: csrfMagicToken,
1570-
host_template_id: <?php print get_request_var('host_template_id'); ?>,
1571-
id: <?php print get_request_var('id'); ?>
1568+
host_template_id: <?php print (int)get_filter_request_var('host_template_id'); ?>,
1569+
id: <?php print (int)get_filter_request_var('id'); ?>
15721570
}).done(function(data) {
15731571
$('#cdialog').dialog('close');
1574-
loadPageNoHeader('host_templates.php?action=edit&header=false&id=<?php print get_request_var('host_template_id'); ?>');
1572+
loadPageNoHeader('host_templates.php?action=edit&header=false&id=<?php print (int)get_filter_request_var('host_template_id'); ?>');
15751573
});
15761574
});
15771575
</script>

‎tests/Integration/test_notify_list_wiring.php‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<?php
2+
3+
$source = file_get_contents(dirname(__DIR__, 2) . '/notify_lists.php');
4+
5+
if ($source === false) {
6+
fwrite(STDERR, "Unable to read notify_lists.php\n");
7+
exit(1);
8+
}
9+
10+
$checks = array(
11+
"id=<?php print (int)get_filter_request_var('id'); ?>",
12+
"'notify_lists.php?action=edit&id=' . (int)get_request_var('id')",
13+
"<input type='hidden' name='id' value='\" . html_escape(get_request_var('id')) . \"'>",
14+
"<input type='hidden' name='drp_action' value='\" . html_escape(get_request_var('drp_action')) . \"'>",
15+
);
16+
17+
foreach ($checks as $needle) {
18+
if (strpos($source, $needle) === false) {
19+
fwrite(STDERR, "Missing expected notify list wiring\n");
20+
exit(1);
21+
}
22+
}
23+
24+
echo "OK\n";

‎tests/Unit/test_notify_list_security_guards.php‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<?php
2+
3+
$source = file_get_contents(dirname(__DIR__, 2) . '/notify_lists.php');
4+
5+
if ($source === false) {
6+
fwrite(STDERR, "Unable to read notify_lists.php\n");
7+
exit(1);
8+
}
9+
10+
$needles = array(
11+
"html_escape(get_request_var('drp_action'))",
12+
"html_escape(get_request_var('id'))",
13+
"'td.data_template_id = ' . (int)get_request_var('template')",
14+
"' h.site_id=' . (int)get_request_var('site_id')",
15+
"'td.name_cache RLIKE ' . db_qstr(get_request_var('rfilter'))",
16+
"'(td.notify_warning=' . (int)get_request_var('id') . ' OR td.notify_alert=' . (int)get_request_var('id') . ')'",
17+
);
18+
19+
foreach ($needles as $needle) {
20+
if (strpos($source, $needle) === false) {
21+
fwrite(STDERR, "Missing expected notify list guard\n");
22+
exit(1);
23+
}
24+
}
25+
26+
echo "OK\n";

‎tests/e2e/test_notify_list_no_raw_sql_or_form_reuse.php‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<?php
2+
3+
$source = file_get_contents(dirname(__DIR__, 2) . '/notify_lists.php');
4+
5+
if ($source === false) {
6+
fwrite(STDERR, "Unable to read notify_lists.php\n");
7+
exit(1);
8+
}
9+
10+
$legacy = array(
11+
"<input type='hidden' name='drp_action' value='\" . get_request_var('drp_action') . \"'>",
12+
"<input type='hidden' name='id' value='\" . get_request_var('id') . \"'>",
13+
"td.name_cache RLIKE '\" . get_request_var('rfilter') . \"'",
14+
"'td.data_template_id = ' . get_request_var('template')",
15+
"' h.site_id=' . get_request_var('site_id')",
16+
"'(td.notify_warning=' . get_request_var('id') . ' OR td.notify_alert=' . get_request_var('id') . ')'",
17+
);
18+
19+
foreach ($legacy as $needle) {
20+
if (strpos($source, $needle) !== false) {
21+
fwrite(STDERR, "Found legacy insecure notify list pattern\n");
22+
exit(1);
23+
}
24+
}
25+
26+
echo "OK\n";

‎thold.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -784,7 +784,7 @@ function clearFilter() {
784784
}
785785

786786
$(function() {
787-
$('#thold').submit(function(event) {
787+
$('#thold').on('submit', function(event) {
788788
event.preventDefault();
789789
applyFilter();
790790
});

0 commit comments

Comments
 (0)