mirror/librenms-librenms
1
0
Fork 0
mirror of https://github.com/librenms/librenms.git synced 2024-10-07 16:52:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Security fix: unauthorized access (#10091)

Browse Source 
* Security fix: unauthorized access
Affects nginx users:
Moved php files outside of public html directory (Apache was protected by .htaccess)

Affects all users:
Some files did not check for authentication and could disclose some info.
Better checks before including files from user input

* git mv html/includes/ includes/html
git mv html/pages/ includes/html/
This commit is contained in:
Tony Murray
2019-04-11 23:26:42 -05:00
committed by GitHub
parent b81af32ed2
commit 36431dd296
1301 changed files with 1443 additions and 1439 deletions
Download Patch File Download Diff File Expand all files Collapse all files

97
includes/html/pages/bill/actions.inc.php Normal file
View File

@@ -0,0 +1,97 @@
<?php
if ($_POST['action'] == 'delete_bill' && $_POST['confirm'] == 'confirm') {
dbDelete('bill_history', '`bill_id` = ?', array($bill_id));
dbDelete('bill_ports', '`bill_id` = ?', array($bill_id));
dbDelete('bill_data', '`bill_id` = ?', array($bill_id));
dbDelete('bill_perms', '`bill_id` = ?', array($bill_id));
dbDelete('bills', '`bill_id` = ?', array($bill_id));
echo '<div class=infobox>Bill Deleted. Redirecting to Bills list.</div>';
echo "<meta http-equiv='Refresh' content=\"2; url='bills/'\">";
}
if ($_POST['action'] == 'reset_bill' && ($_POST['confirm'] == 'rrd' || $_POST['confirm'] == 'mysql')) {
if ($_POST['confirm'] == 'mysql') {
dbDelete('bill_history', '`bill_id` = ?', array($bill_id));
dbDelete('bill_data', '`bill_id` = ?', array($bill_id));
}
if ($_POST['confirm'] == 'rrd') {
// Stil todo
}
echo '<div class=infobox>Bill Resetting. Redirecting to Bills list.</div>';
echo "<meta http-equiv='Refresh' content=\"2; url='bills/'\">";
}
if ($_POST['action'] == 'add_bill_port') {
dbInsert(array('bill_id' => $_POST['bill_id'], 'port_id' => $_POST['port_id']), 'bill_ports');
}
if ($_POST['action'] == 'delete_bill_port') {
dbDelete('bill_ports', '`bill_id` = ? AND `port_id` = ?', array($bill_id, $_POST['port_id']));
}
if ($_POST['action'] == 'update_bill') {
if (isset($_POST['bill_quota']) or isset($_POST['bill_cdr'])) {
if ($_POST['bill_type'] == 'quota') {
if (isset($_POST['bill_quota_type'])) {
if ($_POST['bill_quota_type'] == 'MB') {
$multiplier = (1 * $config['billing']['base']);
}
if ($_POST['bill_quota_type'] == 'GB') {
$multiplier = (1 * $config['billing']['base'] * $config['billing']['base']);
}
if ($_POST['bill_quota_type'] == 'TB') {
$multiplier = (1 * $config['billing']['base'] * $config['billing']['base'] * $config['billing']['base']);
}
$bill_quota = (is_numeric($_POST['bill_quota']) ? $_POST['bill_quota'] * $config['billing']['base'] * $multiplier : 0);
$bill_cdr = 0;
}
}
if ($_POST['bill_type'] == 'cdr') {
if (isset($_POST['bill_cdr_type'])) {
if ($_POST['bill_cdr_type'] == 'Kbps') {
$multiplier = (1 * $config['billing']['base']);
}
if ($_POST['bill_cdr_type'] == 'Mbps') {
$multiplier = (1 * $config['billing']['base'] * $config['billing']['base']);
}
if ($_POST['bill_cdr_type'] == 'Gbps') {
$multiplier = (1 * $config['billing']['base'] * $config['billing']['base'] * $config['billing']['base']);
}
$bill_cdr = (is_numeric($_POST['bill_cdr']) ? $_POST['bill_cdr'] * $multiplier : 0);
$bill_quota = 0;
}
}
}//end if
// NOTE: casting to string for mysqli bug (fixed by mysqlnd)
if (dbUpdate(
array(
'bill_name' => $_POST['bill_name'],
'bill_day' => $_POST['bill_day'],
'bill_quota' => (string)$bill_quota,
'bill_cdr' => (string)$bill_cdr,
'bill_type' => $_POST['bill_type'],
'bill_custid' => $_POST['bill_custid'],
'bill_ref' => $_POST['bill_ref'],
'bill_notes' => $_POST['bill_notes'],
),
'bills',
'`bill_id` = ?',
array($bill_id)
)) {
print_message('Bill Properties Updated');
}
}//end if