mirror of
https://github.com/librenms/librenms.git
synced 2024-10-07 16:52:45 +00:00
36431dd296
* Security fix: unauthorized access Affects nginx users: Moved php files outside of public html directory (Apache was protected by .htaccess) Affects all users: Some files did not check for authentication and could disclose some info. Better checks before including files from user input * git mv html/includes/ includes/html git mv html/pages/ includes/html/
43 lines
1.2 KiB
PHP
43 lines
1.2 KiB
PHP
<?php
|
|
|
|
use LibreNMS\Authentication\LegacyAuth;
|
|
|
|
$no_refresh = true;
|
|
|
|
if (!LegacyAuth::user()->hasGlobalAdmin()) {
|
|
include 'includes/html/error-no-perm.inc.php';
|
|
} else {
|
|
if ($vars['addsrv']) {
|
|
if (LegacyAuth::user()->hasGlobalAdmin()) {
|
|
$updated = '1';
|
|
|
|
$service_id = add_service($vars['device'], $vars['type'], $vars['descr'], $vars['ip'], $vars['params'], 0);
|
|
if ($service_id) {
|
|
$message .= $message_break.'Service added ('.$service_id.')!';
|
|
$message_break .= '<br />';
|
|
}
|
|
}
|
|
}
|
|
foreach (list_available_services() as $current_service) {
|
|
$servicesform .= "<option value='$current_service'>$current_service</option>";
|
|
}
|
|
|
|
foreach (dbFetchRows('SELECT * FROM `devices` ORDER BY `hostname`') as $device) {
|
|
$devicesform .= "<option value='".$device['device_id']."'>".format_hostname($device).'</option>';
|
|
}
|
|
|
|
if ($updated) {
|
|
print_message('Device Settings Saved');
|
|
}
|
|
|
|
$pagetitle[] = 'Add service';
|
|
|
|
echo "<div class='row'>
|
|
<div class='col-sm-6'>";
|
|
|
|
include_once 'includes/html/print-service-add.inc.php';
|
|
|
|
echo '</div>
|
|
</div>';
|
|
}//end if
|