From b34ee3932f209da5ffeacd8eaff30d2d8f9a5c6c Mon Sep 17 00:00:00 2001 From: Eldon Koyle Date: Tue, 1 Mar 2016 11:39:06 -0700 Subject: [PATCH 1/6] Add transport to alert_template vars --- alerts.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/alerts.php b/alerts.php index 6d791d213..fc27e130f 100755 --- a/alerts.php +++ b/alerts.php @@ -121,8 +121,6 @@ function IssueAlert($alert) { $obj = DescribeAlert($alert); if (is_array($obj)) { echo 'Issuing Alert-UID #'.$alert['id'].'/'.$alert['state'].': '; - $msg = FormatAlertTpl($obj); - $obj['msg'] = $msg; if (!empty($config['alert']['transports'])) { ExtTransports($obj); } @@ -336,6 +334,9 @@ function ExtTransports($obj) { $opts = array_filter($opts); } if (($opts === true || !empty($opts)) && $opts != false && file_exists($config['install_dir'].'/includes/alerts/transport.'.$transport.'.php')) { + $obj['transport'] = $transport; + $msg = FormatAlertTpl($obj); + $obj['msg'] = $msg; echo $transport.' => '; eval('$tmp = function($obj,$opts) { global $config; '.file_get_contents($config['install_dir'].'/includes/alerts/transport.'.$transport.'.php').' return false; };'); $tmp = $tmp($obj,$opts); From 124afc2054529b080abd0b9629b0673edad279e9 Mon Sep 17 00:00:00 2001 From: Eldon Koyle Date: Thu, 3 Mar 2016 11:02:17 -0700 Subject: [PATCH 2/6] Don't escape single quotes in alert templates so that we can compare strings in if statements --- alerts.php | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/alerts.php b/alerts.php index fc27e130f..0948045a9 100755 --- a/alerts.php +++ b/alerts.php @@ -359,6 +359,18 @@ function ExtTransports($obj) { }//end ExtTransports() +/** + * Escape certain characters in template string + * @param string $tpl Template + * @return string + */ +function TplEscape($tpl) { + // theoretically like addslashes(), but don't escape single quote (') and do escape $ + // FIXME: is there still a way to break out of the double-quoted string, maybe with a unicode char? + return preg_replace('(["\\\\$\\0])','\\0',$tpl); +} + + /** * Format Alert * @param array $obj Alert-Array @@ -366,7 +378,7 @@ function ExtTransports($obj) { */ function FormatAlertTpl($obj) { $tpl = $obj["template"]; - $msg = '$ret .= "'.str_replace(array('{else}', '{/if}', '{/foreach}'), array('"; } else { $ret .= "', '"; } $ret .= "', '"; } $ret .= "'), addslashes($tpl)).'";'; + $msg = '$ret .= "'.str_replace(array('{else}', '{/if}', '{/foreach}'), array('"; } else { $ret .= "', '"; } $ret .= "', '"; } $ret .= "'), TplEscape($tpl)).'";'; $parsed = $msg; $s = strlen($msg); $x = $pos = -1; From a3c4076aae02c952df7605c48f38182aec0a1fde Mon Sep 17 00:00:00 2001 From: Eldon Koyle Date: Thu, 3 Mar 2016 16:55:34 -0700 Subject: [PATCH 3/6] Add some hints in the documentation. --- doc/Extensions/Alerting.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/doc/Extensions/Alerting.md b/doc/Extensions/Alerting.md index 6ce8431f8..e2f5a9ae3 100644 --- a/doc/Extensions/Alerting.md +++ b/doc/Extensions/Alerting.md @@ -116,6 +116,7 @@ Placeholders: - Rule: `%rule` - Rule-Name: `%name` - Timestamp: `%timestamp` +- Transport name: `%transport` - Contacts, must be iterated in a foreach, `%key` holds email and `%value` holds name: `%contacts` The Default Template is a 'one-size-fit-all'. We highly recommend defining own templates for your rules to include more specific information. @@ -136,6 +137,11 @@ Rule: {if %name}%name{else}%rule{/if}\r\n Alert sent to: {foreach %contacts}%value <%key> {/foreach} ``` +Conditional formatting example, will display a link to the host in email or just the hostname in any other transport: +```text +{if %transport == 'mail'}%hostname{else}%hostname{/if} +``` + # Transports Transports are located within `$config['install_dir']/includes/alerts/transports.*.php` and defined as well as configured via ~~`$config['alert']['transports']['Example'] = 'Some Options'`~~. From 94a182a396ac028bbd2c4e7e4c1c5df45777c78d Mon Sep 17 00:00:00 2001 From: Eldon Koyle Date: Mon, 7 Mar 2016 16:12:57 -0700 Subject: [PATCH 4/6] Revert "Don't escape single quotes in alert templates so that we can compare strings in if statements" This reverts commit 124afc2054529b080abd0b9629b0673edad279e9. --- alerts.php | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-) diff --git a/alerts.php b/alerts.php index 0948045a9..fc27e130f 100755 --- a/alerts.php +++ b/alerts.php @@ -359,18 +359,6 @@ function ExtTransports($obj) { }//end ExtTransports() -/** - * Escape certain characters in template string - * @param string $tpl Template - * @return string - */ -function TplEscape($tpl) { - // theoretically like addslashes(), but don't escape single quote (') and do escape $ - // FIXME: is there still a way to break out of the double-quoted string, maybe with a unicode char? - return preg_replace('(["\\\\$\\0])','\\0',$tpl); -} - - /** * Format Alert * @param array $obj Alert-Array @@ -378,7 +366,7 @@ function TplEscape($tpl) { */ function FormatAlertTpl($obj) { $tpl = $obj["template"]; - $msg = '$ret .= "'.str_replace(array('{else}', '{/if}', '{/foreach}'), array('"; } else { $ret .= "', '"; } $ret .= "', '"; } $ret .= "'), TplEscape($tpl)).'";'; + $msg = '$ret .= "'.str_replace(array('{else}', '{/if}', '{/foreach}'), array('"; } else { $ret .= "', '"; } $ret .= "', '"; } $ret .= "'), addslashes($tpl)).'";'; $parsed = $msg; $s = strlen($msg); $x = $pos = -1; From 621ea93831a87d9d9d55e8711ef55e423fc4d5e8 Mon Sep 17 00:00:00 2001 From: Eldon Koyle Date: Mon, 7 Mar 2016 16:15:38 -0700 Subject: [PATCH 5/6] Fix minor doc bug and update example --- doc/Extensions/Alerting.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/Extensions/Alerting.md b/doc/Extensions/Alerting.md index e2f5a9ae3..1cef41509 100644 --- a/doc/Extensions/Alerting.md +++ b/doc/Extensions/Alerting.md @@ -99,7 +99,7 @@ The template-parser understands `if` and `foreach` controls and replaces certain Controls: - if-else (Else can be omitted): -`{if %placeholder == 'value'}Some Text{else}Other Text{/if}` +`{if %placeholder == value}Some Text{else}Other Text{/if}` - foreach-loop: `{foreach %placeholder}Key: %key
Value: %value{/foreach}` @@ -139,7 +139,7 @@ Alert sent to: {foreach %contacts}%value <%key> {/foreach} Conditional formatting example, will display a link to the host in email or just the hostname in any other transport: ```text -{if %transport == 'mail'}%hostname{else}%hostname{/if} +{if %transport == mail}%hostname{else}%hostname{/if} ``` # Transports From 36818d6c59d487c19a920a960991edc6bc61a8e4 Mon Sep 17 00:00:00 2001 From: Eldon Koyle Date: Wed, 16 Mar 2016 11:26:19 -0600 Subject: [PATCH 6/6] Use double-quotes in template example and warn about single-quotes --- doc/Extensions/Alerting.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/doc/Extensions/Alerting.md b/doc/Extensions/Alerting.md index 1cef41509..88836f5e4 100644 --- a/doc/Extensions/Alerting.md +++ b/doc/Extensions/Alerting.md @@ -139,9 +139,12 @@ Alert sent to: {foreach %contacts}%value <%key> {/foreach} Conditional formatting example, will display a link to the host in email or just the hostname in any other transport: ```text -{if %transport == mail}%hostname{else}%hostname{/if} +{if %transport == mail}%hostname{else}%hostname{/if} ``` +Note the use of double-quotes. Single quotes (`'`) in templates will be escaped (replaced with `\'`) in the output and should therefore be avoided. + + # Transports Transports are located within `$config['install_dir']/includes/alerts/transports.*.php` and defined as well as configured via ~~`$config['alert']['transports']['Example'] = 'Some Options'`~~.