Files
librenms-librenms/includes/html/forms/show-alert-transport.inc.php
Tony Murray 36431dd296 Security fix: unauthorized access (#10091)
* Security fix: unauthorized access
Affects nginx users:
Moved php files outside of public html directory (Apache was protected by .htaccess)

Affects all users:
Some files did not check for authentication and could disclose some info.
Better checks before including files from user input

* git mv html/includes/ includes/html
git mv html/pages/ includes/html/
2019-04-11 23:26:42 -05:00

57 lines
1.5 KiB
PHP

<?php
/*
* LibreNMS
*
* This program is free software: you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation, either version 3 of the License, or (at your
* option) any later version. Please see LICENSE.txt at the top level of
* the source code distribution for details.
*/
use LibreNMS\Authentication\LegacyAuth;
header('Content-type: application/json');
if (!LegacyAuth::user()->hasGlobalAdmin()) {
die(json_encode([
'status' => 'error',
'message' => 'You need to be admin'
]));
}
$transport_id = $vars['transport_id'];
// Retrieve alert transport
if (is_numeric($transport_id) && $transport_id > 0) {
$transport = dbFetchRow('SELECT * FROM `alert_transports` WHERE `transport_id` =? LIMIT 1', [$transport_id]);
if ($transport['is_default'] == true) {
$is_default = true;
} else {
$is_default = false;
}
$details = [];
// Get alert transport configuration details
foreach (json_decode($transport['transport_config'], true) as $key => $value) {
$details[] = [
'name' => $key,
'value' => $value
];
}
}
if (is_array($transport)) {
die(json_encode([
'name' => $transport['transport_name'],
'type' => $transport['transport_type'],
'is_default' => $is_default,
'details' => $details
]));
} else {
die(json_encode([
'status' => 'error',
'message' => 'No alert transport found'
]));
}