Skip to content
This repository has been archived by the owner on Dec 13, 2022. It is now read-only.

Fix(security): Sanitize queries in the list of service groups #12007

Open
wants to merge 3 commits into
base: develop
Choose a base branch
from
Open

Fix(security): Sanitize queries in the list of service groups #12007

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3d9b00c
sanitize queries in service groups and change acl->queryBuilder by bi…
emabassi-ext Oct 17, 2022
3265d78
refactoring querry and fis camel case variables
emabassi-ext Oct 17, 2022
c865f5d
fix condition operator
emabassi-ext Oct 24, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 31 additions & 12 deletions www/include/configuration/configObject/servicegroup/listServiceGroup.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,19 +55,38 @@
$search = $centreon->historySearch[$url]["search"] ?? null;
}

if ($search) {
$rq = "SELECT SQL_CALC_FOUND_ROWS sg_id, sg_name, sg_alias, sg_activate FROM servicegroup " .
"WHERE (sg_name LIKE '%" . $search . "%' " .
"OR sg_alias LIKE '%" . $search . "%') " .
$acl->queryBuilder('AND', 'sg_id', $sgString) .
" ORDER BY sg_name LIMIT " . $num * $limit . ", " . $limit;
} else {
$rq = "SELECT SQL_CALC_FOUND_ROWS sg_id, sg_name, sg_alias, sg_activate FROM servicegroup " .
$acl->queryBuilder('WHERE', 'sg_id', $sgString) .
" ORDER BY sg_name LIMIT " . $num * $limit . ", " . $limit;
$conditionStr = "";
$sgStrParams = [];
if (!$acl->admin && $sgString) {
$sgStrList = explode(',', $sgString);
foreach ($sgStrList as $index => $sgId) {
$sgStrParams[':sg_' . $index] = (int) str_replace("'", "", $sgId);
}
$queryParams = implode(',', array_keys($sgStrParams));

if ($search !== '') {
$conditionStr = "AND sg_id IN (" . $queryParams . ")";
} else {
$conditionStr = "WHERE sg_id IN (" . $queryParams . ")";
}
}

$dbResult = $pearDB->query($rq);
if ($search !== '') {
$statement = $pearDB->prepare("SELECT SQL_CALC_FOUND_ROWS sg_id, sg_name, sg_alias, sg_activate" .
" FROM servicegroup WHERE (sg_name LIKE :search OR sg_alias LIKE :search) " . $conditionStr .
" ORDER BY sg_name LIMIT :offset, :limit");

$statement->bindValue(':search', '%' . $search . '%', \PDO::PARAM_STR);
} else {
$statement = $pearDB->prepare("SELECT SQL_CALC_FOUND_ROWS sg_id, sg_name, sg_alias, sg_activate" .
" FROM servicegroup " . $conditionStr . " ORDER BY sg_name LIMIT :offset, :limit");
}
foreach ($sgStrParams as $key => $sgId) {
$statement->bindValue($key, $sgId, \PDO::PARAM_INT);
}
$statement->bindValue(':offset', (int) $num * (int) $limit, \PDO::PARAM_INT);
$statement->bindValue(':limit', $limit, \PDO::PARAM_INT);
$statement->execute();
$rows = $pearDB->query("SELECT FOUND_ROWS()")->fetchColumn();

include "./include/common/checkPagination.php";
Expand Down Expand Up @@ -101,7 +120,7 @@
$elemArr = array();
$centreonToken = createCSRFToken();

for ($i = 0; $sg = $dbResult->fetch(); $i++) {
for ($i = 0; $sg = $statement->fetch(\PDO::FETCH_ASSOC); $i++) {
$selectedElements = $form->addElement('checkbox', "select[" . $sg['sg_id'] . "]");
$moptions = "";
if ($sg["sg_activate"]) {
Expand Down