mirror of
https://github.com/librenms/librenms.git
synced 2024-10-07 16:52:45 +00:00
Security fix: unauthorized access (#10091)
* Security fix: unauthorized access Affects nginx users: Moved php files outside of public html directory (Apache was protected by .htaccess) Affects all users: Some files did not check for authentication and could disclose some info. Better checks before including files from user input * git mv html/includes/ includes/html git mv html/pages/ includes/html/
This commit is contained in:
Tony Murray
GitHub
57
includes/html/pages/peering/as-selection.inc.php
Normal file
57
includes/html/pages/peering/as-selection.inc.php
Normal file
@@ -0,0 +1,57 @@
|
||||
<?php
|
||||
/**
|
||||
*
|
||||
* LibreNMS PeeringDB Integration
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
* @package LibreNMS
|
||||
* @link http://librenms.org
|
||||
* @copyright 2017 Neil Lathwood
|
||||
* @author Neil Lathwood <neil@lathwood.co.uk>
|
||||
*/
|
||||
|
||||
$cache_date = dbFetchCell("SELECT FROM_UNIXTIME(`timestamp`) FROM `pdb_ix` ORDER BY `timestamp` ASC LIMIT 1");
|
||||
|
||||
echo "<div class='alert alert-info' role='alert'>Cached date: $cache_date</div>";
|
||||
|
||||
?>
|
||||
|
||||
<div class="row">
|
||||
<div class="col-sm-4">
|
||||
<table id="asn" class="table table-bordered table-hover">
|
||||
<thead>
|
||||
<tr>
|
||||
<th data-column-id="bgpLocalAs">ASN</th>
|
||||
<th data-column-id="asname" data-searchable="false" data-sortable="false">AS Name</th>
|
||||
<th data-column-id="action" data-sortable="false"></th>
|
||||
</tr>
|
||||
</thead>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<script>
|
||||
var grid = $("#asn").bootgrid({
|
||||
ajax: true,
|
||||
rowCount: [50, 100, 250, -1],
|
||||
post: function ()
|
||||
{
|
||||
return {
|
||||
id: 'as-selection',
|
||||
};
|
||||
},
|
||||
url: "ajax_table.php"
|
||||
});
|
||||
</script>
|
||||
57
includes/html/pages/peering/ix-list.inc.php
Normal file
57
includes/html/pages/peering/ix-list.inc.php
Normal file
@@ -0,0 +1,57 @@
|
||||
<?php
|
||||
/**
|
||||
*
|
||||
* LibreNMS PeeringDB Integration
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
* @package LibreNMS
|
||||
* @link http://librenms.org
|
||||
* @copyright 2017 Neil Lathwood
|
||||
* @author Neil Lathwood <neil@lathwood.co.uk>
|
||||
*/
|
||||
|
||||
$asn = $vars['bgpLocalAs'];
|
||||
|
||||
?>
|
||||
<div class="row">
|
||||
<div class="col-sm-4">
|
||||
<div class="table-responsive">
|
||||
<table id="ixlist" class="table table-bordered table-striped">
|
||||
<thead>
|
||||
<tr>
|
||||
<th data-column-id="exchange" data-sortable="false">Exchange</th>
|
||||
<th data-column-id="action" data-sortable="false"></th>
|
||||
<th data-column-id="links" data-sortable="false"></th>
|
||||
</tr>
|
||||
</thead>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<script>
|
||||
var grid = $("#ixlist").bootgrid({
|
||||
ajax: true,
|
||||
rowCount: [50, 100, 250, -1],
|
||||
post: function ()
|
||||
{
|
||||
return {
|
||||
id: 'ix-list',
|
||||
asn: '<?php echo $asn; ?>',
|
||||
};
|
||||
},
|
||||
url: "ajax_table.php"
|
||||
});
|
||||
</script>
|
||||
78
includes/html/pages/peering/ix-peers.inc.php
Normal file
78
includes/html/pages/peering/ix-peers.inc.php
Normal file
@@ -0,0 +1,78 @@
|
||||
<?php
|
||||
/**
|
||||
*
|
||||
* LibreNMS PeeringDB Integration
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
* @package LibreNMS
|
||||
* @link http://librenms.org
|
||||
* @copyright 2017 Neil Lathwood
|
||||
* @author Neil Lathwood <neil@lathwood.co.uk>
|
||||
*/
|
||||
|
||||
$asn = $vars['asn'];
|
||||
$ixid = $vars['ixid'];
|
||||
$status = $vars['status'];
|
||||
|
||||
?>
|
||||
<div class="row">
|
||||
<div class="col-sm-6">
|
||||
<div class="table-responsive">
|
||||
<table id="ixpeers" class="table table-bordered table-striped">
|
||||
<thead>
|
||||
<tr>
|
||||
<th data-column-id="remote_asn">ASN</th>
|
||||
<th data-column-id="remote_ipaddr4">IP</th>
|
||||
<th data-column-id="peer" data-sortable="false">Peer</th>
|
||||
<th data-column-id="connected" data-sortable="false">Connected</th>
|
||||
<th data-column-id="links" data-sortable="false"></th>
|
||||
</tr>
|
||||
</thead>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<script>
|
||||
var grid = $("#ixpeers").bootgrid({
|
||||
ajax: true,
|
||||
rowCount: [50, 100, 250, -1],
|
||||
templates: {
|
||||
header:
|
||||
"<div id=\"{{ctx.id}}\" class=\"{{css.header}}\"><div class=\"row\">"+
|
||||
"<div class=\"col-sm-6 actionBar\"><span class=\"pull-left\">"+
|
||||
"<form method=\"post\" action=\"\" class=\"form-inline\" role=\"form\">"+
|
||||
"<div class=\"form-group\">"+
|
||||
"<select name=\"status\" id=\"status\" class=\"form-control input-sm\">"+
|
||||
"<option value=\"all\">All</option>"+
|
||||
"<option value=\"connected\">Connected</option>"+
|
||||
"<option value=\"unconnected\">Not connected</option>"+
|
||||
"</select>"+
|
||||
"<button type=\"submit\" class=\"btn btn-default input-sm\">Search</button>"+
|
||||
"</div></form></span></div>"+
|
||||
"<div class=\"col-sm-6 actionBar\"><span class=\"{{css.search}}\"></span> <span class=\"{{css.actions}}\"></span></div></div></div>"
|
||||
},
|
||||
post: function ()
|
||||
{
|
||||
return {
|
||||
id: 'ix-peers',
|
||||
asn: '<?php echo $asn; ?>',
|
||||
ixid: '<?php echo $ixid; ?>',
|
||||
status: '<?php echo $status; ?>',
|
||||
};
|
||||
},
|
||||
url: "ajax_table.php"
|
||||
});
|
||||
</script>
|
||||
Reference in New Issue
Block a user