Commit Graph

24 Commits

Author SHA1 Message Date
Tony Murray
8fd8d9b06a Fix unescaped output in ipv6 search page (#15327) 2023-09-15 16:05:08 -05:00
Tony Murray
2c5960631c Fix injection vulnerability in fdb search page (#15315)
unescaped search output
reported by: https://huntr.dev/users/hainguyen0207
2023-09-14 00:22:42 -05:00
Tony Murray
e4c46a4536 Fix another injection in ipv4 search page (#15312)
Reported by: https://huntr.dev/users/trunggg02
2023-09-13 23:48:24 -05:00
Tony Murray
1194934d31 Fix injection in search pages ipv4, etc (#15311)
Reported by: https://huntr.dev/users/hainguyen0207
2023-09-13 23:35:49 -05:00
Tony Murray
12f8bb2040 MAC Vendor OUI use scheduler (#15187)
* MAC Vendor OUI use scheduler
Add command to update `lnms maintenance:fetch-ouis`
Show vendor column in tables if mac_oui.enabled is set to true
Improve scheduler validation handle non-standard install directories and systems without systemd
Add index to table to improve speed and improve mac->vendor lookup speed
Scheduled weekly with random wait to prevent stampeding herd issues for upstream
drop oui update from daily

* MAC Vendor OUI use scheduler
Add command to update `lnms maintenance:fetch-ouis`
Show vendor column in tables if mac_oui.enabled is set to true

* Lint fixes and better prefix detection

* update schema file
2023-08-03 19:29:30 -05:00
Tony Murray
91c57a1ee5 Fix unsanitized input injection (#15184)
Search for and sanitize import that is output to html.
Spurred by report from [Hakiduck](https://huntr.dev/users/mike993/)
2023-08-02 10:37:22 -05:00
Andy Norwood
64c4650801 Add FDB table vendor search drop down (#15072)
* Add vendor search and related functions

* Add OUIDB cache for vendor lookup

* Add vendor drop down

* appy style CI changes

* Apply style CI and lint changes

* more styleCI changes

* update type hinting

* Edit mac_oui cache lock name and function

* Update MAC OUI message during daily

* Use DB for vendor lookup

* New vendor_oui table migration

* New MAC OUI to database function

* Update readbleOUI to use DB rather than cache

* Make StyleCI changes

* styleCI tweak

* Remove lock release to allow refresh timer

* change migration name to match table

* add schema dump

* update schema

* styleCI tweak
2023-07-21 11:30:13 -05:00
David Girón
94d435eff1 Search device by MAC via URL (#14072)
* Search MAC by GET

* Add address from parsed vars

* Trim tabs and spaces when searching MAC
2022-07-09 04:51:07 -05:00
Feras Al-Kassar
35a6905092 Fix security vuls (#13554)
* Fix XSS vulnerabilities

* fix XSS vulnerabilities in alerts.inc.php

* fix XSS vulnerability in poller-groups.inc.php

* small fix for the integration

* another fix for the inegration

* another fix for the inegration

* change the sanitizer at sources instead of json_encode sinks

* another change sanitizer at sources instead of json_encode sinks

* another change sanitizer at sources instead of common_output and current_config sinks

* fix path manipulation vulnerability
2021-11-24 10:00:25 -06:00
Tony Murray
790c4b3402 Configurable device display name (#13528)
* Configurable device display name
You can just set the display name in device settings.

It also accepts simple template format with  the variables: hostname, sysName, sysName_fallback, ip

Default controlled by device_display_default, (set from old force_hostname_to_sysname and force_ip_to_sysname settings

* remove second argument to format_hostname()

* Style fixes

* Update schema

* update phpstan baseline

* Improved settings strings (and add for translation)
2021-11-18 15:46:22 -06:00
Jellyfrog
258505ed44 Apply fixes from StyleCI (#13224) 2021-09-10 20:09:53 +02:00
Tony Murray
3d62be5003 Jquery upgrade (#12802)
* WIP js upgrades

* trying 3.0

* Event handler changes

* fix alert rule collection loading

* blur fix

* jQuery 3.5
homescreen no warnings

* actually 3.6 include js

* Update bootstrap to 3.4.1

* missed file

* Update and test install process

* cleanup

* attempt to version js files that were updated.
2021-05-11 08:08:06 -05:00
PipoCanaja
fff8b8e832 Collect OUI Database and do OUI lookups (#12842)
* first draft

refresh time

refresh time

* return codes

style

style

* presentation

* Exception details

more

fix

fix

* add tooltips

fixes for dns display

* create WebUI config option

languages

* refresh data every 7 to 11 days, keep it 15 days max

* 'Ports' and 'Port' ARP table

* Stp page support

style

style

* fix dnsname column finding when vendor is added/removed

fix dnsname column finding when vendor is added/removed

* nac vendor column

nac

* filter fields to reduce size of AJAX reply

filter fields to reduce size of AJAX reply

* fix typo on dns column detection

* default enabled
2021-05-10 14:56:48 -05:00
Tony Murray
1c379dcd05 Remove legacy function calls (#12651)
* massive inlines

* fix style and wtf

* remove rrdtool.inc.php include

* fix CommonFunctions namespace issues

* looking for missing class space, fix undefined class issues

* style fixes
2021-03-29 00:25:30 +02:00
Jellyfrog
20b4215204 Swich links to https (#12511)
* Switch librenms links to https

* Convert librenms links in comments

* Switch gnu.org url to https

* switch php urls to https
2021-02-09 00:29:04 +01:00
Jellyfrog
29f45ca352 Apply fixes from StyleCI (#12124) 2020-09-21 15:59:34 +02:00
Jellyfrog
0d56bbd946 Apply fixes from StyleCI (#12123) 2020-09-21 15:51:53 +02:00
Jellyfrog
82f43cb98d Apply fixes from StyleCI (#12120) 2020-09-21 15:40:17 +02:00
Tony Murray
217969e140 Update php-codesniffer (#11368)
* PHPCS 3.5+

* Fix newly detected style issues
2020-04-03 08:41:24 -05:00
Jellyfrog
b361710148 Device group based access (#10568)
* Device group based access

* Use Permissions class to resolve permissions

Also give port access based on device access

* Convert more pages to use Permissions class

* shorten config setting name
use Eloquent relationships in several places
alphabetize config_definitions.json

* Change Models and Permissions

* Clean up ajax_search LIMIT sql

* Convert more pages to use Permissions class

Co-authored-by: Tony Murray <murraytony@gmail.com>
2019-12-30 12:11:26 +01:00
Tony Murray
e99f421511 Remove legacy auth usage of $_SESSION (#10491)
* Remove auth use of $_SESSION

Will break plugins that depend on $_SESSION, Weathermap was already fixed.
Port them to use Auth::check()/Auth::user()/Auth:id()

* revert accidental replacement
2019-08-05 14:16:05 -05:00
Tony Murray
3ead462549 Enable CSRF protection (#10447)
* Enable CSRF protection

* fix style issues
2019-07-17 07:20:26 -05:00
Tony Murray
e9ae08d5db Use Laravel url helpers to improve functionality without dns name (#10227)
* Use Laravel url helpers to improve functionality without dns name
Not exhaustive...

* Fix Url generated urls

* Bump js version
2019-05-20 11:47:34 -05:00
Tony Murray
36431dd296 Security fix: unauthorized access (#10091)
* Security fix: unauthorized access
Affects nginx users:
Moved php files outside of public html directory (Apache was protected by .htaccess)

Affects all users:
Some files did not check for authentication and could disclose some info.
Better checks before including files from user input

* git mv html/includes/ includes/html
git mv html/pages/ includes/html/
2019-04-11 23:26:42 -05:00