Skip to content

Commit

Permalink
Merge pull request #6 from Exagone313/fix-security
Browse files Browse the repository at this point in the history 
Fix query string injections
  • Loading branch information
@nidebr
nidebr committed Sep 7, 2018
2 parents f37a935 + 309fa8e commit ba4a9ea
Show file tree
Hide file tree
Showing 5 changed files with 18 additions and 16 deletions.
14 changes: 7 additions & 7 deletions asset.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@
header("Location: asset.php");
} else if ( $action == "clear" and $asset ) {
clearCacheFileASSET($asset);
header("Location: asset.php?asset=".$asset."");
header("Location: asset.php?asset=".urlencode($asset));
}
}

Expand All @@ -49,9 +49,9 @@
$start = time() - $hours*3600;
$end = time();

$title = "AS-Stats | History for AS-SET: ".$asset;
$title = "AS-Stats | History for AS-SET: ".htmlentities($asset);
$header = 'History for AS-SET';
$header_small = $asset;
$header_small = htmlentities($asset);
$select_form = "";

$aslist = getASSET($asset);
Expand Down Expand Up @@ -191,11 +191,11 @@
} else {
$aff_astable .= '<div class="alert alert-info">';
$aff_astable .= '<h4><i class="icon fa fa-warning"></i> Alert!</h4>';
$aff_astable .= 'No data for AS-SET <b>' . $asset . '</b>';
$aff_astable .= 'No data for AS-SET <b>' . htmlentities($asset) . '</b>';
$aff_astable .= '</div>';
}
// TOOLSBOX
$aff_toolsbox_add = '<a href="asset.php?asset='.$asset.'&action=clear" class="list-group-item"><i class="fa fa-remove text-red"></i> Remove AS-SET cache file for '.$asset.'.</a>';
$aff_toolsbox_add = '<a href="asset.php?asset='.htmlentities($asset).'&action=clear" class="list-group-item"><i class="fa fa-remove text-red"></i> Remove AS-SET cache file for '.htmlentities($asset).'.</a>';
} else {
$title = "AS-Stats | View AS-SET";
$header = 'History for AS-SET';
Expand Down Expand Up @@ -252,7 +252,7 @@
<div class="box-body">
<form class="navbar-form navbar-left" role="search">
<div class="input-group">
<input type="text" class="form-control menu-input" name="asset" placeholder="Search AS-SET" value="<?php echo $val_searchasset; ?>">
<input type="text" class="form-control menu-input" name="asset" placeholder="Search AS-SET" value="<?php echo htmlspecialchars($val_searchasset); ?>">
<span class="input-group-btn">
<button type="submit" class="btn btn-flat button-input"><i class="fa fa-search"></i></button>
</span>
Expand Down Expand Up @@ -284,7 +284,7 @@
<div class="col-lg-12">

<form method='get'>
<input type='hidden' name='asset' value='<?php echo $asset; ?>'/>
<input type='hidden' name='asset' value='<?php echo htmlspecialchars($asset); ?>'/>
<div class="box box-primary">
<div class="box-header with-border">
<h3 class="box-title">Legend</h3>
Expand Down
4 changes: 2 additions & 2 deletions func.inc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -326,7 +326,7 @@ function menu($selected_links) {

$return .='</ul>';

$val_ntop = isset($_GET['n']) ? $_GET['n'] : "";
$val_ntop = isset($_GET['n']) ? htmlentities($_GET['n']) : "";

if ($dpagename == "index" || $dpagename == "ix") {
$return .='<form class="navbar-form navbar-left" role="search">';
Expand All @@ -336,7 +336,7 @@ function menu($selected_links) {
}

if ( $dpagename == "ix" && isset($_GET['ix']) ) {
$return .='<input type="hidden" name="ix" value="'.$_GET['ix'].'">';
$return .='<input type="hidden" name="ix" value="'.htmlspecialchars($_GET['ix']).'">';
}

$return .='<div class="input-group">';
Expand Down
4 changes: 3 additions & 1 deletion gengraph.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,9 @@
foreach($knownlinks as $link)
$reverse[$link['tag']] = array('color' => $link['color'], 'descr' => $link['descr']);
$links = array();
foreach(explode(',', $_GET['selected_links']) as $tag){
foreach(explode(',', $_GET['selected_links']) as $tag){
if (preg_match('/[^a-zA-Z0-9]/', $tag))
continue;
$link = array('tag' => $tag,
'color' => $reverse[$tag]['color'],
'descr' => $reverse[$tag]['descr']);
Expand Down
9 changes: 4 additions & 5 deletions ix.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -223,7 +223,7 @@
<!-- =============================================== -->

<div class="content-wrapper">
<?php echo content_header($ix_name . ' Top ' . $ntop . ' AS', '('.$label.')'); ?>
<?php echo content_header(htmlentities($ix_name) . ' Top ' . $ntop . ' AS', '('.$label.')'); ?>

<section class="content">
<div class="row">
Expand Down Expand Up @@ -261,7 +261,7 @@
<input type='hidden' name='numhours' value='<?php echo $hours; ?>'/>
<input type='hidden' name='n' value='<?php echo $ntop; ?>'/>
<input type='hidden' name='ix' value='<?php echo $ix_id; ?>'/>
<input type='hidden' name='name_ix' value='<?php echo $name_ix; ?>'/>
<input type='hidden' name='name_ix' value='<?php echo htmlspecialchars($name_ix); ?>'/>
<div class="box box-primary">
<div class="box-header with-border">
<h3 class="box-title">Legend</h3>
Expand Down Expand Up @@ -309,8 +309,7 @@
<h3 class="box-title">Search IX</h3>
</div>
<div class="box-body">
<?php $val_name_ix = isset($_GET['name_ix']) ? $_GET['name_ix'] : ""; ?>
<input type="text" class="form-control" name="name_ix" placeholder="Search IX" id="peeringdb" data-provide="typeahead" autocomplete="off" value="<?php echo $val_name_ix; ?>">
<input type="text" class="form-control" name="name_ix" placeholder="Search IX" id="peeringdb" data-provide="typeahead" autocomplete="off" value="<?php echo htmlspecialchars($name_ix); ?>">
<input type='hidden' id='ix' name='ix'/>
<div id="message"></div>
</div>
Expand All @@ -323,7 +322,7 @@
<form method='get'>
<input type='hidden' name='ix' value='<?php echo $ix_id; ?>'/>
<input type='hidden' name='n' value='<?php echo $ntop; ?>'/>
<input type='hidden' name='name_ix' value='<?php echo $name_ix; ?>'/>
<input type='hidden' name='name_ix' value='<?php echo htmlspecialchars($name_ix); ?>'/>
<div class="box box-primary">
<div class="box-header with-border">
<h3 class="box-title">Interval</h3>
Expand Down
3 changes: 2 additions & 1 deletion lib/class/peeringdb.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,8 @@ public function GetIXASN($id = NULL) {
}

public function GetIXName( $regex = NULL) {
if ( $regex ) { $regex = '?name__contains='.$regex; }
if (is_string($regex)) { $regex = '?name__contains='.urlencode($regex); }
else $regex = '';
$json = json_decode($this->sendRequest($this->url."/ix".$regex));
return $json->data;
}
Expand Down

0 comments on commit ba4a9ea

Please sign in to comment.