Potential fix for grave/backtick XSS usage (#4356)

Cacti · Sep 25, 2021 · 9a45ef5 · 9a45ef5
1 parent 87a34f2
commit 9a45ef5
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/CHANGELOG b/CHANGELOG
@@ -1,6 +1,7 @@
 Cacti CHANGELOG
 
 1.2.19
+-security#4356: Potential fix for grave/backtick XSS usage (#4356)
 -issue#3787: Add SHA256 and AES256 for snmp polling
 -issue#4341: Missing sequence field leads to errors in system logs
 -issue#4342: Tree Graph shows same highlighting as graph edit screen

diff --git a/lib/functions.php b/lib/functions.php
@@ -62,6 +62,8 @@ function filter_value($value, $filter, $href = '') {
 	}
 
 	$value =  htmlspecialchars($value, ENT_QUOTES, $charset, false);
+	// Grave Accent character can lead to xss
+	$value = str_replace('`', '&#96;', $value);
 
 	if ($filter != '') {
 		$value = preg_replace('#(' . preg_quote($filter) . ')#i', "<span class='filteredValue'>\\1</span>", $value);