mirror/librenms-librenms
1
0
Fork 0
mirror of https://github.com/librenms/librenms.git synced 2024-10-07 16:52:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Security fix: unauthorized access (#10091)

Browse Source 
* Security fix: unauthorized access
Affects nginx users:
Moved php files outside of public html directory (Apache was protected by .htaccess)

Affects all users:
Some files did not check for authentication and could disclose some info.
Better checks before including files from user input

* git mv html/includes/ includes/html
git mv html/pages/ includes/html/
This commit is contained in:
Tony Murray
2019-04-11 23:26:42 -05:00
committed by GitHub
parent b81af32ed2
commit 36431dd296
1301 changed files with 1443 additions and 1439 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
includes/html/graphs/netscalervsvr/auth.inc.php Normal file
View File

@@ -0,0 +1,15 @@
<?php
if (is_numeric($vars['id'])) {
$vsvr = dbFetchRow('SELECT * FROM `netscaler_vservers` AS I, `devices` AS D WHERE I.vsvr_id = ? AND I.device_id = D.device_id', array($vars['id']));
if (is_numeric($vsvr['device_id']) && ($auth || device_permitted($vsvr['device_id']))) {
$device = device_by_id_cache($vsvr['device_id']);
$rrd_filename = rrd_name($device['hostname'], array('netscaler', 'vsvr', $vsvr['vsvr_name']));
$title = generate_device_link($device);
$title .= ' :: Netscaler VServer :: '.htmlentities($vsvr['vsvr_name']);
$auth = true;
}
}

6
includes/html/graphs/netscalervsvr/bits.inc.php Normal file
View File

@@ -0,0 +1,6 @@
<?php
$ds_in = 'TotalRequestBytes';
$ds_out = 'TotalResponseBytes';
require 'includes/html/graphs/generic_data.inc.php';

20
includes/html/graphs/netscalervsvr/conns.inc.php Normal file
View File

@@ -0,0 +1,20 @@
<?php
$ds_in = 'CurClntConnections';
$ds_out = 'CurSrvrConnections';
$colour_area_in = 'AA66AA';
$colour_line_in = '330033';
$colour_area_out = 'FFDD88';
$colour_line_out = 'FF6600';
$colour_area_in_max = 'cc88cc';
$colour_area_out_max = 'FFefaa';
$in_text = 'Client';
$out_text = 'Server';
$graph_max = 1;
$unit_text = 'Connections';
require 'includes/html/graphs/generic_duplex.inc.php';

23
includes/html/graphs/netscalervsvr/hitmiss.inc.php Normal file
View File

@@ -0,0 +1,23 @@
<?php
$oids = array(
'TotMiss',
'TotHits',
);
$i = 0;
foreach ($oids as $oid) {
$oid_ds = substr($oid, 0, 19);
$rrd_list[$i]['filename'] = $rrd_filename;
$rrd_list[$i]['descr'] = $oid;
$rrd_list[$i]['ds'] = $oid_ds;
$i++;
}
$colours = 'mixed';
$nototal = 1;
$unit_text = '';
$simple_rrd = 1;
require 'includes/html/graphs/generic_multi_simplex_seperated.inc.php';

17
includes/html/graphs/netscalervsvr/pkts.inc.php Normal file
View File

@@ -0,0 +1,17 @@
<?php
$ds_in = 'TotalPktsRecvd';
$ds_out = 'TotalPktsSent';
$colour_area_in = 'AA66AA';
$colour_line_in = '330033';
$colour_area_out = 'FFDD88';
$colour_line_out = 'FF6600';
$colour_area_in_max = 'cc88cc';
$colour_area_out_max = 'FFefaa';
$graph_max = 1;
$unit_text = 'Packets';
require 'includes/html/graphs/generic_duplex.inc.php';

20
includes/html/graphs/netscalervsvr/reqs.inc.php Normal file
View File

@@ -0,0 +1,20 @@
<?php
$ds_in = 'TotalRequests';
$ds_out = 'TotalResponses';
$colour_area_in = 'AA66AA';
$colour_line_in = '330033';
$colour_area_out = 'FFDD88';
$colour_line_out = 'FF6600';
$colour_area_in_max = 'cc88cc';
$colour_area_out_max = 'FFefaa';
$in_text = 'Requests';
$out_text = 'Responses';
$graph_max = 1;
$unit_text = '';
require 'includes/html/graphs/generic_duplex.inc.php';