mirror/librenms-librenms
1
0
Fork 0
mirror of https://github.com/librenms/librenms.git synced 2024-10-07 16:52:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Hide community and make it XSS safer (#13783)

Browse Source 
* sanitize message display

* sanitize message display

* safe display of community, and community hidden until focus occurs
This commit is contained in:
PipoCanaja
2022-02-14 14:03:01 +01:00
committed by GitHub
parent 18ca4566eb
commit f24bb42cb2
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
includes/html/pages/addhost.inc.php
View File

@@ -55,7 +55,7 @@ if (! empty($_POST['hostname'])) {
}
$snmpver = strip_tags($_POST['snmpver']);
print_message("Adding host $hostname communit" . (count(Config::get('snmp.community')) == 1 ? 'y' : 'ies') . ' ' . implode(', ', Config::get('snmp.community')) . " port $port using $transport");
print_message("Adding host $hostname communit" . (count(Config::get('snmp.community')) == 1 ? 'y' : 'ies') . ' ' . implode(', ', array_map("\LibreNMS\Util\Clean::html", Config::get('snmp.community'))) . " port $port using $transport");
} elseif ($_POST['snmpver'] === 'v3') {
$v3 = [
'authlevel' => strip_tags($_POST['authlevel']),

4
includes/html/pages/device/edit/snmp.inc.php
View File

@@ -33,7 +33,7 @@ if ($_POST['editing']) {
$update['retries'] = ['NULL'];
}
if ($snmpver != 'v3') {
if ($snmpver != 'v3' && $_POST['community'] != '********') {
$community = $_POST['community'];
$update['community'] = $community;
}
@@ -318,7 +318,7 @@ echo " </select>
<div class='form-group'>
<label for='community' class='col-sm-2 control-label'>SNMP Community</label>
<div class='col-sm-4'>
<input id='community' class='form-control' name='community' value='" . htmlspecialchars($device['community']) . "'/>
<input id='community' class='form-control' name='community' value='********' onfocus='this.value=(this.value==\"********\" ? decodeURIComponent(\"" . rawurlencode($device['community']) . "\") : this.value);'/>
</div>
</div>
</div>