From a6bca987bf927d36c91df980c42a777e643cee72 Mon Sep 17 00:00:00 2001
From: f0o <f0o@librenms.org>
Date: Wed, 10 Feb 2016 13:52:43 +0000
Subject: [PATCH] Enforce sanity before returning from database

---
 html/includes/vars.inc.php   |  2 +-
 includes/common.php          | 10 ++++++++++
 includes/dbFacile.mysql.php  |  2 ++
 includes/dbFacile.mysqli.php |  2 ++
 4 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/html/includes/vars.inc.php b/html/includes/vars.inc.php
index 8d3c3b6c2..a633cef72 100644
--- a/html/includes/vars.inc.php
+++ b/html/includes/vars.inc.php
@@ -23,7 +23,7 @@ else {
 foreach ($segments as $pos => $segment) {
     $segment = urldecode($segment);
     if ($pos == '0') {
-        $vars['page'] =htmlentities( $segment);
+        $vars['page'] = htmlentities($segment);
     }
     else {
         list($name, $value) = explode('=', $segment);
diff --git a/includes/common.php b/includes/common.php
index 8b59ba774..1162b819a 100644
--- a/includes/common.php
+++ b/includes/common.php
@@ -1255,3 +1255,13 @@ function get_port_id ($ports_mapped, $port, $port_association_mode) {
 
     return $port_id;
 }
+
+/**
+ * Sanitize
+ * @param mixed $item Reference to Item
+ * @param mixed $key Key
+ * @return void
+ */
+function sanitize_array(&$item, $key) {
+    $item = htmlentities($item);
+}
diff --git a/includes/dbFacile.mysql.php b/includes/dbFacile.mysql.php
index f2bb56c0b..d9372cbb6 100644
--- a/includes/dbFacile.mysql.php
+++ b/includes/dbFacile.mysql.php
@@ -266,6 +266,7 @@ function dbFetchRows($sql, $parameters=array(), $nocache=false) {
         if ($config['memcached']['enable'] && $nocache === false) {
             $config['memcached']['resource']->set(hash('sha512',$sql.'|'.serialize($parameters)),$rows,$config['memcached']['ttl']);
         }
+        array_walk_recursive($rows,'sanitize_array');
         return $rows;
     }
 
@@ -333,6 +334,7 @@ function dbFetchRow($sql=null, $parameters=array(), $nocache=false) {
         if ($config['memcached']['enable'] && $nocache === false) {
             $config['memcached']['resource']->set(hash('sha512',$sql.'|'.serialize($parameters)),$row,$config['memcached']['ttl']);
         }
+        array_walk_recursive($row,'sanitize_array');
         return $row;
     }
     else {
diff --git a/includes/dbFacile.mysqli.php b/includes/dbFacile.mysqli.php
index 15a48962c..70c4651e7 100644
--- a/includes/dbFacile.mysqli.php
+++ b/includes/dbFacile.mysqli.php
@@ -267,6 +267,7 @@ function dbFetchRows($sql, $parameters=array(), $nocache=false) {
         if ($config['memcached']['enable'] && $nocache === false) {
             $config['memcached']['resource']->set(hash('sha512',$sql.'|'.serialize($parameters)),$rows,$config['memcached']['ttl']);
         }
+        array_walk_recursive($rows,'sanitize_array');
         return $rows;
     }
 
@@ -334,6 +335,7 @@ function dbFetchRow($sql=null, $parameters=array(), $nocache=false) {
         if ($config['memcached']['enable'] && $nocache === false) {
             $config['memcached']['resource']->set(hash('sha512',$sql.'|'.serialize($parameters)),$row,$config['memcached']['ttl']);
         }
+        array_walk_recursive($row,'sanitize_array');
         return $row;
     }
     else {