mirror/librenms-librenms
1
0
Fork 0
mirror of https://github.com/librenms/librenms.git synced 2024-10-07 16:52:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

XSS fix, cont. again (#13778)

Browse Source 
* XSS in alert template creation

* XSS in alert rule name

* XSS in service name & desc

* style

* strip_tags in alert_notes

* strip_tags in create_alert_item

* strip_tags in addsrv page
This commit is contained in:
PipoCanaja
2022-02-13 20:23:07 +01:00
committed by GitHub
parent 0029e9f161
commit 41ddce6377
6 changed files with 17 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
includes/html/forms/create-service.inc.php
View File

@@ -28,7 +28,14 @@ if (! Auth::user()->hasGlobalAdmin()) {
exit('ERROR: You need to be admin');
}
foreach (['desc', 'ip', 'ignore', 'disabled', 'param', 'name', 'template_id'] as $varname) {
foreach (['desc', 'name'] as $varname) {
//sanitize description and name
if (isset($vars[$varname])) {
$$varname = strip_tags($vars[$varname]);
$update['service_' . $varname] = $$varname;
}
}
foreach (['ip', 'ignore', 'disabled', 'param', 'template_id'] as $varname) {
if (isset($vars[$varname])) {
$update['service_' . $varname] = $vars[$varname];
$$varname = $vars[$varname];