mirror of
https://github.com/librenms/librenms.git
synced 2024-10-07 16:52:45 +00:00
36431dd296
* Security fix: unauthorized access Affects nginx users: Moved php files outside of public html directory (Apache was protected by .htaccess) Affects all users: Some files did not check for authentication and could disclose some info. Better checks before including files from user input * git mv html/includes/ includes/html git mv html/pages/ includes/html/
34 lines
808 B
PHP
34 lines
808 B
PHP
<?php
|
|
|
|
use LibreNMS\Authentication\LegacyAuth;
|
|
|
|
header('Content-type: text/plain');
|
|
|
|
// FUA
|
|
|
|
if (!LegacyAuth::user()->hasGlobalAdmin()) {
|
|
die('ERROR: You need to be admin');
|
|
}
|
|
|
|
$device['device_id'] = $_POST['device_id'];
|
|
$module = 'discover_'.$_POST['discovery_module'];
|
|
|
|
if (!isset($module) && validate_device_id($device['device_id']) === false) {
|
|
echo 'error with data';
|
|
exit;
|
|
} else {
|
|
if ($_POST['state'] == 'true') {
|
|
$state = 1;
|
|
} elseif ($_POST['state'] == 'false') {
|
|
$state = 0;
|
|
} else {
|
|
$state = 0;
|
|
}
|
|
|
|
if (isset($attribs['discover_'.$module]) && $attribs['discover_'.$module] != $config['discover_modules'][$module]) {
|
|
del_dev_attrib($device, $module);
|
|
} else {
|
|
set_dev_attrib($device, $module, $state);
|
|
}
|
|
}
|