includes/html/vars.inc.php

<?php

$vars = \LibreNMS\Util\Url::parseLegacyPathVars($_SERVER['REQUEST_URI']);

foreach ($_GET as $name => $value) {
    $vars[$name] = strip_tags($value);
}

foreach ($_POST as $name => $value) {
    $vars[$name] = ($value);
}

// don't leak login data
unset($vars['username'], $vars['password'], $uri, $base_url);
CSV Exports 2015-04-16 10:08:19 +00:00			`<?php`

Add @signedGraphTag() and @signedGraphUrl() blade directives (#14269) * More secure external graph access Add @signedGraphTag() and @signedGraphUrl() blade directives Takes either an array of graph variables or a url to a graph Uses a signed url that is accessible without user login, embeds signature in url to authenticate access See Laravel Signed Url for more details. Adds Laravel route to graphs (does not change links to use it yet) @graphImage requires the other PR Also APP_URL is required in .env * missing files from rebase * Fix url parsing with a get string * allow width and height to be omitted * Documentation * Add to, otherwise it will always be now * Doc note for to and from relative security * fix vars.inc.php (Laravel has a dummy url here) 2022-09-03 12:48:43 -05:00			`$vars = \LibreNMS\Util\Url::parseLegacyPathVars($_SERVER['REQUEST_URI']);`
CSV Exports 2015-04-16 10:08:19 +00:00
			`foreach ($_GET as $name => $value) {`
Remove legacy function calls (#12651) * massive inlines * fix style and wtf * remove rrdtool.inc.php include * fix CommonFunctions namespace issues * looking for missing class space, fix undefined class issues * style fixes 2021-03-28 17:25:30 -05:00			`$vars[$name] = strip_tags($value);`
CSV Exports 2015-04-16 10:08:19 +00:00			`}`

			`foreach ($_POST as $name => $value) {`
fix: Remove escape characters for services form / display #4891 2016-11-01 11:20:12 -06:00			`$vars[$name] = ($value);`
CSV Exports 2015-04-16 10:08:19 +00:00			`}`
Don't leak passwords deep linking to a graph and logging in on Apache httpd (#8761) * Don't leak passwords when users update urls to include all variables after login * Less aggressive 2018-05-24 11:29:12 -05:00
			`// don't leak login data`
Don't add %3F=yes to the url (#13041) * Don't add %3F=yes to the url... * introduce variable 2021-07-14 09:26:33 -05:00			`unset($vars['username'], $vars['password'], $uri, $base_url);`