mirror/librenms-librenms
1
0
Fork 0
mirror of https://github.com/librenms/librenms.git synced 2024-10-07 16:52:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix alert template creation xss (#16446)

Browse Source 
https://github.com/librenms/librenms/security/advisories/GHSA-gcgp-q2jq-fw52
This commit is contained in:
Tony Murray
2024-09-29 08:02:25 -05:00
committed by GitHub
parent 6af12dbc45
commit f259edc19b
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
includes/html/forms/alert-templates.inc.php
View File

@ -91,6 +91,6 @@ try {
$message .= $e->getMessage();
}
$response = ['status' => $status, 'message' => $message, 'newid' => $template_newid];
$response = ['status' => htmlentities($status), 'message' => htmlentities($message), 'newid' => $template_newid];
echo json_encode($response, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);

4
includes/html/modal/alert_template.inc.php
View File

@ -201,7 +201,9 @@ function alertTemplateAjaxOps(template, name, template_id, title, title_rec, rul
}
});
} else {
var newrow = [{id: output.newid, templatename: name, alert_rules: JSON.stringify(row_rules)}];
var escaped_name = new Option(name).innerHTML;
var newrow = [{id: output.newid, templatename: escaped_name, alert_rules: JSON.stringify(row_rules)}];
$('#templatetable').bootgrid("append", newrow);
}
} else {