Lack of escaping of color items can lead to XSS exposure (CVE-2020-7106)

[ddb4github]

Describe the bug

Ref #3191, try <svg/onload=alert(1)> in pollers.php.
See attached screen shot

Screenshots

Additional context

Issue code lines:

pollers.php:297:         raise_message('dupe_hostname', __('You have already used this hostname \'%s\'.  Please enter a non-duplicate hostname.', $save['hostname']), MESSAGE_LEVEL_ERROR);
pollers.php:303:         raise_message('dupe_dbhost', __('You have already used this database hostname \'%s\'.  Please enter a non-duplicate database hostname.', $save['hostname']), MESSAGE_LEVEL_ERROR);

[TheWitness]

Nice bug hunting @ddb4github (aka Jing Chen).

[ddb4github]

Actually, this issue is found by 'grep/review code/create testcase to verify' when I check #3191 solution for all PHP files.
I'll create another PR for thold/syslog today. Just because thold+syslog only dozen of lines to be reivewd. Cacti core have hundred lines now.

[netniV]

Since this additional, should this have a new CVE?

[TheWitness]

I think so, and update the CHANGELOG appropriately.

[ddb4github]

Conform issue page:

• color_templates.php: Sync Aggregates Action