fix ganglia#67 (additional encoding, some html fixes rolled in as well)

jbuchbinder · Apr 19, 2012 · 214c9a2 · 214c9a2
1 parent 7dea904
commit 214c9a2
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 19 deletions.
diff --git a/actions.php b/actions.php
@@ -35,30 +35,30 @@
 	foreach ( $_GET as $key => $value ) {
 	  if ( is_array($value) ) {
 	    foreach ( $value as $index => $value2 ) {
-	      print '<input type=hidden name="' . $key .'[]" value="' . $value2 . '">';
+	      print '<input type="hidden" name="' . $key .'[]" value="' . $value2 . '" />';
 	    }
 	  } else {
-	    print '<input type=hidden name=' . $key .' value="' . $value . '">';
+	    print '<input type="hidden" name="' . $key .'" value="' . $value . '" />';
 	  }
 	}
     } else {
       // If hostname is not set we assume we are dealing with aggregate graphs
-      print "<input type=hidden name=host_name value=\"{$_GET['host_name']}\">";
+      print "<input type=\"hidden\" name=\"host_name\" value=\"{$_GET['host_name']}\" />";
       $metric_name=$_GET['metric_name'];
-      print "<input type=hidden name=metric_name value=\"{$_GET['metric_name']}\">";
-      print "<input type=hidden name=type value=\"{$_GET['type']}\">";
+      print "<input type=\"hidden\" name=\"metric_name\" value=\"{$_GET['metric_name']}\" />";
+      print "<input type=\"hidden\" name=\"type\" value=\"{$_GET['type']}\">";
       if (isset($_GET['vl']) && ($_GET['vl'] !== ''))
-	  print "<input type=hidden name=vertical_label value=\"{$_GET['vl']}\">";
+	  print "<input type=\"hidden\" name=\"vertical_label\" value=\"" . htmlentities(stripslashes($_GET['vl'])) . \" />";
       if (isset($_GET['ti']) && ($_GET['ti'] !== ''))
-	  print "<input type=hidden name=title value=\"{$_GET['ti']}\">";
+	  print "<input type=\"hidden\" name=\"title\" value=\"" . htmlentities(stripslashes($_GET['ti'])) . "\" />";
     }
     ?>
 
     <select onChange="addItemToView()" name="view_name">
-    <option value='none'>Please choose one</option>
+    <option value="none">Please choose one</option>
     <?php
     foreach ( $available_views as $view_id => $view ) {
-      print "<option value='" . $view['view_name'] . "'>" . $view['view_name'] . "</option>";
+      print "<option value=\"" . $view['view_name'] . "\">" . $view['view_name'] . "</option>";
     } 
 
   ?>
@@ -68,17 +68,17 @@
     <p>
     Add alert: <p>
     Alert when value is 
-    <select name=alert_operator>
-      <option value=more>greater</option>
-      <option value=less>smaller</option>
-      <option value=equal>equal</option>
-      <option value=notequal>not equal</option>
+    <select name="alert_operator">
+      <option value="more">greater</option>
+      <option value="less">smaller</option>
+      <option value="equal">equal</option>
+      <option value="notequal">not equal</option>
     </select> than
-    <input size=7 name=critical_value type=text>
+    <input size="7" name="critical_value" type="text" />
     <button onClick="alert('not implemented yet'); return false">Add</button>
   </form>
 
 <?php
 
 } // end of if ( isset($_GET['show_views']) {
-?>
+?>
diff --git a/views_view.php b/views_view.php
@@ -130,8 +130,8 @@
 	  $item_array = array("aggregate_graph" => "true", 
                               "metric_regex" => $metric_regex_array, 
 	                      "host_regex" => $host_regex_array, 
-                              "graph_type" => $_GET['gtype'],
-	                      "vertical_label" => $_GET['vl'],
+                              "graph_type" => stripslashes($_GET['gtype']),
+	                      "vertical_label" => stripslashes($_GET['vl']),
                               "title" => $_GET['title'],
                         "glegend" => $_GET['glegend']);
 
@@ -158,7 +158,7 @@
           $items = array("hostname" => $_GET['host_name'], 
                          "metric" => $_GET['metric_name']);
 	  if (isset($_GET['vertical_label']))
-            $items["vertical_label"] = $_GET['vertical_label'];
+            $items["vertical_label"] = stripslashes($_GET['vertical_label']);
 	  if (isset($_GET['title']))
             $items["title"] = $_GET['title'];
 	  if (isset($_GET['c']))