mirror of
https://github.com/librenms/librenms.git
synced 2024-10-07 16:52:45 +00:00
36431dd296
* Security fix: unauthorized access Affects nginx users: Moved php files outside of public html directory (Apache was protected by .htaccess) Affects all users: Some files did not check for authentication and could disclose some info. Better checks before including files from user input * git mv html/includes/ includes/html git mv html/pages/ includes/html/
30 lines
1014 B
PHP
30 lines
1014 B
PHP
<?php
|
|
|
|
// handle OAuth requests
|
|
$request = request(); // grab the Request object
|
|
|
|
if ($request->has('oauthtransport')) {
|
|
// make sure transport is safe
|
|
$validator = Validator::make($request->all(), ['oauthtransport' => 'required|alpha']);
|
|
|
|
if ($validator->passes()) {
|
|
$transport_name = $request->get('oauthtransport');
|
|
$class = 'LibreNMS\\Alert\\Transport\\'.$transport_name;
|
|
if (class_exists($class)) {
|
|
$transport = app($class);
|
|
if ($transport->handleOauth($request)) {
|
|
Toastr::success("$transport_name added successfully.");
|
|
} else {
|
|
Toastr::error("$transport_name was not added. Check the log for details.");
|
|
}
|
|
}
|
|
}
|
|
|
|
// remove get variables otherwise things will get double added
|
|
echo '<script>window.history.replaceState(null, null, window.location.pathname);</script>';
|
|
}
|
|
unset($request);
|
|
|
|
// print alert transports
|
|
require_once 'includes/html/print-alert-transports.php';
|