mirror/librenms-librenms
1
0
Fork 0
mirror of https://github.com/librenms/librenms.git synced 2024-10-07 16:52:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

security: Remove possibility of xss in Oxidized and RIPE searches (#6595)

Browse Source
This commit is contained in:
Neil Lathwood
2017-05-05 22:16:39 +01:00
committed by Tony Murray
parent 6734e84382
commit 868fe44390
3 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
html/includes/forms/query-ripenccapi.inc.php
View File

@@ -23,10 +23,10 @@ if (isset($data_param) && isset($query_param)) {
$status = 'error'; $status = 'error';
$message = 'ERROR: Could not query'; $message = 'ERROR: Could not query';
} }
die(json_encode(array( die(display(json_encode(array(
'status' => $status, 'status' => $status,
'message' => $message, 'message' => $message,
'data_param' => $data_param, 'data_param' => $data_param,
'query_param' => $query_param, 'query_param' => $query_param,
'output' => $output 'output' => $output,
))); ))));

5
html/includes/forms/search-oxidized-config.inc.php
View File

@@ -22,10 +22,9 @@ if (isset($parameters)) {
$status = 'error'; $status = 'error';
$message = 'ERROR: Could not query'; $message = 'ERROR: Could not query';
} }
echo display(_json_encode(array(
echo _json_encode(array(
'status' => $status, 'status' => $status,
'message' => $message, 'message' => $message,
'search_in_conf_textbox' => $parameters, 'search_in_conf_textbox' => $parameters,
'output' => $output 'output' => $output
)); )));

4
html/pages/oxidized.inc.php
View File

@@ -77,8 +77,8 @@ $pagetitle[] = 'Oxidized';
$("#search-output").show(); $("#search-output").show();
if (data.output) if (data.output)
$('#search-output').append('Config appears on the folllowing device(s):<br />'); $('#search-output').append('Config appears on the folllowing device(s):<br />');
$.each(data.output, function (row, value) { $.each(data.output, function (row, value) {
$('#search-output').append(value['full_name'] + '<br />'); $('#search-output').append(value['full_name'] + '<br />');
}); });
}, },
error: function () { error: function () {