From 10b0bbe0102c7a298adb753733471f44c9c12d4a Mon Sep 17 00:00:00 2001 From: Tom Laermans Date: Fri, 25 Mar 2011 14:18:04 +0000 Subject: [PATCH] fix 2 possible sql injections, make graph clickthrough work on the non-sensor blocks in the device overview too git-svn-id: http://www.observium.org/svn/observer/trunk@1973 61d68cd4-352d-0410-923a-c4978735b2b8 --- html/pages/device/overview.inc.php | 6 +++--- html/pages/device/overview/mempools.inc.php | 6 ++++-- html/pages/device/overview/processors.inc.php | 6 ++++-- html/pages/device/overview/storage.inc.php | 6 ++++-- 4 files changed, 15 insertions(+), 9 deletions(-) diff --git a/html/pages/device/overview.inc.php b/html/pages/device/overview.inc.php index b863567d1..84320aa29 100644 --- a/html/pages/device/overview.inc.php +++ b/html/pages/device/overview.inc.php @@ -59,14 +59,14 @@ if ($services['total']) echo(""); } -$sql = "SELECT *, DATE_FORMAT(timestamp, '%d/%b/%y %T') AS date from syslog WHERE device_id = '" . $_GET['id'] . "' $where"; +$sql = "SELECT *, DATE_FORMAT(timestamp, '%d/%b/%y %T') AS date from syslog WHERE device_id = '" . $device['device_id'] . "' $where"; $sql .= " ORDER BY timestamp DESC LIMIT 20"; $query = mysql_query($sql); if (mysql_affected_rows() > "0") { echo("
"); - echo("

Recent Syslog

"); + echo("

Recent Syslog

"); echo(""); while ($entry = mysql_fetch_array($query)) { include("includes/print-syslog.inc.php"); } echo("
"); @@ -96,7 +96,7 @@ echo("

"); echo(''); echo(" Recent Events

"); -$query = "SELECT *,DATE_FORMAT(datetime, '%d/%b/%y %T') as humandate FROM `eventlog` WHERE `host` = '$_GET[id]' ORDER BY `datetime` DESC LIMIT 0,10"; +$query = "SELECT *,DATE_FORMAT(datetime, '%d/%b/%y %T') as humandate FROM `eventlog` WHERE `host` = '" . $device['device_id'] . "' ORDER BY `datetime` DESC LIMIT 0,10"; $data = mysql_query($query); echo(""); diff --git a/html/pages/device/overview/mempools.inc.php b/html/pages/device/overview/mempools.inc.php index ffd94140c..03a043762 100644 --- a/html/pages/device/overview/mempools.inc.php +++ b/html/pages/device/overview/mempools.inc.php @@ -5,7 +5,9 @@ $graph_type = "mempool_usage"; if (mysql_result(mysql_query("SELECT count(*) from mempools WHERE device_id = '" . $device['device_id'] . "'"),0)) { echo("
"); - echo("

Memory Pools

"); + echo("

"); + echo(''); + echo(" Memory Pools

"); echo("
"); $mempool_rows = '1'; $mempools = mysql_query("SELECT * FROM `mempools` WHERE device_id = '" . $device['device_id'] . "'"); @@ -17,7 +19,7 @@ if (mysql_result(mysql_query("SELECT count(*) from mempools WHERE device_id = '" $text_descr = rewrite_entity_descr($mempool['mempool_descr']); - $mempool_url = $config['base_url'] . "/device/".$device['device_id']."/health/memory/"; + $mempool_url = $config['base_url'] . "/graphs/".$mempool['mempool_id']."/mempool_usage/"; $mini_url = $config['base_url'] . "/graph.php?id=".$mempool['mempool_id']."&type=".$graph_type."&from=".$day."&to=".$now."&width=80&height=20&bg=f4f4f4"; $mempool_popup = "onmouseover=\"return overlib('
".$device['hostname']." - ".$text_descr; diff --git a/html/pages/device/overview/processors.inc.php b/html/pages/device/overview/processors.inc.php index 4527f19a3..13910a4ea 100644 --- a/html/pages/device/overview/processors.inc.php +++ b/html/pages/device/overview/processors.inc.php @@ -6,7 +6,9 @@ if (mysql_result(mysql_query("SELECT count(*) from processors WHERE device_id = { $processor_rows = 0; echo("
"); - echo("

Processors

"); + echo("

"); + echo(''); + echo(" Processors

"); echo("
"); $i = '1'; $procs = mysql_query("SELECT * FROM `processors` WHERE device_id = '" . $device['device_id'] . "' ORDER BY processor_descr ASC"); @@ -14,7 +16,7 @@ if (mysql_result(mysql_query("SELECT count(*) from processors WHERE device_id = { if (is_integer($processor_rows/2)) { $row_colour = $list_colour_a; } else { $row_colour = $list_colour_b; } - $proc_url = $config['base_url'] . "/device/".$device['device_id']."/health/processors/"; + $proc_url = $config['base_url'] . "/graphs/".$proc['processor_id']."/processor_usage/"; $proc_popup = "onmouseover=\"return overlib('
".$device['hostname']." - ".$proc['processor_descr']; $proc_popup .= "
"; diff --git a/html/pages/device/overview/storage.inc.php b/html/pages/device/overview/storage.inc.php index 8ef4aa603..772d7fa37 100644 --- a/html/pages/device/overview/storage.inc.php +++ b/html/pages/device/overview/storage.inc.php @@ -5,7 +5,9 @@ $graph_type = "storage_usage"; if (mysql_result(mysql_query("SELECT count(storage_id) from storage WHERE device_id = '" . $device['device_id'] . "'"),0)) { echo("
"); - echo("

Storage

"); + echo("

"); + echo(''); + echo(" Storage

"); echo("
"); $drive_rows = '0'; @@ -44,7 +46,7 @@ if (mysql_result(mysql_query("SELECT count(storage_id) from storage WHERE device $free = formatStorage($drive['storage_free']); $used = formatStorage($drive['storage_used']); - $fs_url = $config['base_url'] . "/device/".$device['device_id']."/health/storage/"; + $fs_url = $config['base_url'] . "/graphs/".$drive['storage_id']."/storage_usage/"; $fs_popup = "onmouseover=\"return overlib('
".$device['hostname']." - ".$drive['storage_descr']; $fs_popup .= "
";