Skip to content
This repository was archived by the owner on Dec 13, 2022. It is now read-only.

Commit 3002339

Browse files
tuntojaemabassi-extTamazCkduretjeremyjaouen
authored
chore(release): merge release-21.04.next into 21.04.x (#11909)
* query sanitized in listServiceCategoriesà (#11597) (#11634) * sanitize and bind in centreon connector queriy (#11637) * Sanitize and bind listVirtualMetrics queries (#11649) * sanitize and bind host categories queryà (#11591) (#11646) * sanitize insrert queries in db-func (#11652) MON-14667 * Sanitized and bound queries in service argumentsXml file (#11655) MON-14669 * (fix) service status : encoding issue on status page (#11583) * fix(git): sync dev-21.04.x with 21.04.x (#11526) * [SNYK] Sanitize and bind ACL host dependency queries (#11389) (#11521) * Sanitize and bind ACL host dependency queries * fix issues * [SNYK] Sanitize and bind centreonGraph class queries (#11409) (#11517) 1122 1153 1134 * removed old variable userCrypted and the use of it (#11334) (#11516) * fix(test): wait 8s before checking downtime is active in rest api v1 test (#11498) (#11506) Refs: MON-14585 * [Snyk] Sanitize and bind ACL action access queries (#11385) (#11514) * Sanitize and bind ACL action access queries _ sanitize if possible each variables inserted in a query _ use PDO prepared statement and bind() method _ Do not use $pearDB->escape on which is for examples useless on integers and on non closed HTML tags (svg, img, etc) * fix line length * fix failed checks * [SNYK] Sanitize and bind ACL class queries (#11392) (#11513) * Sanitize and bind ACL class queries Queries sanitized and bound using PDO statement * fix spaces spaces between (int) cast and variables * update file delete spaces after comma * change variables names due to a review * Line exceeds 120 characters; contains 123 characters * fix(pendo): correctly set locale when language is detection by browser (#11484) (#11530) Refs: MON-14039 * doc(ack): acknowledge Hakaï security (#11538) * SNYK: Sanitize and bind ACL actions queries (#11549) * sanitizing and binding acl actions queries * fix missing bind * SNYK: Sanitize and bind Broker listing queries (#11553) * Sanitizing and binding broker listing queries * applying suggested changes * fix(conf) fix encoding in template service listing (#11558) (#11566) * fix encoding * remove useless function * SNYK: Sanitize and bind generateImage queries (#11563) * sanitize and bind generate image queries * adding throw exception * applying suggested changes * Update www/include/views/graphs/generateGraphs/generateImage.php Co-authored-by: Kevin Duret <[email protected]> Co-authored-by: Kevin Duret <[email protected]> * MON-14501 - sanitize query in centreonXmlbgRequest class (#11572) * sanitize query in centreonXmlbgRequest class * add closeCursor func to resolve conv * SNYK: Sanitize and bind Meta-Services dependency queries (#11554) (#11569) * sanityze 2 insert queries * spaces removed in a query * Fix encoding issue on status serviceXML Co-authored-by: Kevin Duret <[email protected]> Co-authored-by: Elmahdi ABBASSI <[email protected]> Co-authored-by: jeremyjaouen <[email protected]> Co-authored-by: Stéphane Chapron <[email protected]> Co-authored-by: hyahiaoui-ext <[email protected]> Co-authored-by: alaunois <[email protected]> * Sanitize and bind service group dependecies queries (#11667) * fix(conf) fix parent template display in service template listing (#11671) (#11678) * fix(details): remove dead code (#11672) (#11684) * fix(clapi): Check that user is admin to use clapi (#11631) (#11638) * fix(widgets): retrieve possibility to not select poller in pref (#11696) (#11700) Refs: MON-14919 * fix(details): second part of code cleanup for "tools" (#11725) * fix(resource): Fix bad SQL request (#11702) (#11751) * chore(release): merge release-21.04.next into 21.04.x (#11819) (#11826) * query sanitized in listServiceCategoriesà (#11597) (#11634) * sanitize and bind in centreon connector queriy (#11637) * Sanitize and bind listVirtualMetrics queries (#11649) * sanitize and bind host categories queryà (#11591) (#11646) * sanitize insrert queries in db-func (#11652) MON-14667 * Sanitized and bound queries in service argumentsXml file (#11655) MON-14669 * (fix) service status : encoding issue on status page (#11583) * fix(git): sync dev-21.04.x with 21.04.x (#11526) * [SNYK] Sanitize and bind ACL host dependency queries (#11389) (#11521) * Sanitize and bind ACL host dependency queries * fix issues * [SNYK] Sanitize and bind centreonGraph class queries (#11409) (#11517) 1122 1153 1134 * removed old variable userCrypted and the use of it (#11334) (#11516) * fix(test): wait 8s before checking downtime is active in rest api v1 test (#11498) (#11506) Refs: MON-14585 * [Snyk] Sanitize and bind ACL action access queries (#11385) (#11514) * Sanitize and bind ACL action access queries _ sanitize if possible each variables inserted in a query _ use PDO prepared statement and bind() method _ Do not use $pearDB->escape on which is for examples useless on integers and on non closed HTML tags (svg, img, etc) * fix line length * fix failed checks * [SNYK] Sanitize and bind ACL class queries (#11392) (#11513) * Sanitize and bind ACL class queries Queries sanitized and bound using PDO statement * fix spaces spaces between (int) cast and variables * update file delete spaces after comma * change variables names due to a review * Line exceeds 120 characters; contains 123 characters * fix(pendo): correctly set locale when language is detection by browser (#11484) (#11530) Refs: MON-14039 * doc(ack): acknowledge Hakaï security (#11538) * SNYK: Sanitize and bind ACL actions queries (#11549) * sanitizing and binding acl actions queries * fix missing bind * SNYK: Sanitize and bind Broker listing queries (#11553) * Sanitizing and binding broker listing queries * applying suggested changes * fix(conf) fix encoding in template service listing (#11558) (#11566) * fix encoding * remove useless function * SNYK: Sanitize and bind generateImage queries (#11563) * sanitize and bind generate image queries * adding throw exception * applying suggested changes * Update www/include/views/graphs/generateGraphs/generateImage.php Co-authored-by: Kevin Duret <[email protected]> Co-authored-by: Kevin Duret <[email protected]> * MON-14501 - sanitize query in centreonXmlbgRequest class (#11572) * sanitize query in centreonXmlbgRequest class * add closeCursor func to resolve conv * SNYK: Sanitize and bind Meta-Services dependency queries (#11554) (#11569) * sanityze 2 insert queries * spaces removed in a query * Fix encoding issue on status serviceXML Co-authored-by: Kevin Duret <[email protected]> Co-authored-by: Elmahdi ABBASSI <[email protected]> Co-authored-by: jeremyjaouen <[email protected]> Co-authored-by: Stéphane Chapron <[email protected]> Co-authored-by: hyahiaoui-ext <[email protected]> Co-authored-by: alaunois <[email protected]> * Sanitize and bind service group dependecies queries (#11667) * fix(conf) fix parent template display in service template listing (#11671) (#11678) * fix(details): remove dead code (#11672) (#11684) * fix(clapi): Check that user is admin to use clapi (#11631) (#11638) * fix(widgets): retrieve possibility to not select poller in pref (#11696) (#11700) Refs: MON-14919 * fix(details): second part of code cleanup for "tools" (#11725) * fix(resource): Fix bad SQL request (#11702) (#11751) * chore(install): update version to 21.04.18 Co-authored-by: Elmahdi ABBASSI <[email protected]> Co-authored-by: TamazC <[email protected]> Co-authored-by: Kevin Duret <[email protected]> Co-authored-by: jeremyjaouen <[email protected]> Co-authored-by: Stéphane Chapron <[email protected]> Co-authored-by: hyahiaoui-ext <[email protected]> Co-authored-by: alaunois <[email protected]> Co-authored-by: Adrien Morais-Mestre <[email protected]> Co-authored-by: Laurent Calvet <[email protected]> Co-authored-by: Elmahdi ABBASSI <[email protected]> Co-authored-by: TamazC <[email protected]> Co-authored-by: Kevin Duret <[email protected]> Co-authored-by: jeremyjaouen <[email protected]> Co-authored-by: Stéphane Chapron <[email protected]> Co-authored-by: hyahiaoui-ext <[email protected]> Co-authored-by: alaunois <[email protected]> Co-authored-by: Adrien Morais-Mestre <[email protected]> Co-authored-by: Laurent Calvet <[email protected]> * FIX: SQLi in poller's broker configuration 21.04.x (#11779) * sanitize and bind pollers broker config queries * applying suggested changes * chore(release): update version to 21.04.19 Co-authored-by: Elmahdi ABBASSI <[email protected]> Co-authored-by: TamazC <[email protected]> Co-authored-by: Kevin Duret <[email protected]> Co-authored-by: jeremyjaouen <[email protected]> Co-authored-by: Stéphane Chapron <[email protected]> Co-authored-by: hyahiaoui-ext <[email protected]> Co-authored-by: alaunois <[email protected]> Co-authored-by: Adrien Morais-Mestre <[email protected]> Co-authored-by: Laurent Calvet <[email protected]>
1 parent 6cbd3ee commit 3002339

File tree

4 files changed

+97
-25
lines changed

4 files changed

+97
-25
lines changed

www/class/centreonConfigCentreonBroker.php

+5-3
Original file line numberDiff line numberDiff line change
@@ -730,13 +730,15 @@ public function insertConfig($values)
730730
/*
731731
* Get the ID
732732
*/
733-
$query = "SELECT config_id FROM cfg_centreonbroker WHERE config_name = '" . $values['name'] . "'";
733+
$query = "SELECT config_id FROM cfg_centreonbroker WHERE config_name = :config_name";
734734
try {
735-
$res = $this->db->query($query);
735+
$statement = $this->db->prepare($query);
736+
$statement->bindValue(':config_name', $values['name'], \PDO::PARAM_STR);
737+
$statement->execute();
736738
} catch (\PDOException $e) {
737739
return false;
738740
}
739-
$row = $res->fetch();
741+
$row = $statement->fetch(\PDO::FETCH_ASSOC);
740742
$id = $row['config_id'];
741743

742744
/*

www/include/configuration/configCentreonBroker/DB-Func.php

+70-21
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,10 @@ function enableCentreonBrokerInDB($id)
7474
return;
7575
}
7676

77-
$query = "UPDATE cfg_centreonbroker SET config_activate = '1' WHERE config_id = " . $id;
78-
$pearDB->query($query);
77+
$query = "UPDATE cfg_centreonbroker SET config_activate = '1' WHERE config_id = :config_id";
78+
$statement = $pearDB->prepare($query);
79+
$statement->bindValue(':config_id', (int) $id, \PDO::PARAM_INT);
80+
$statement->execute();
7981
}
8082

8183
/**
@@ -91,8 +93,10 @@ function disablCentreonBrokerInDB($id)
9193
return;
9294
}
9395

94-
$query = "UPDATE cfg_centreonbroker SET config_activate = '0' WHERE config_id = " . $id;
95-
$pearDB->query($query);
96+
$query = "UPDATE cfg_centreonbroker SET config_activate = '0' WHERE config_id = :config_id";
97+
$statement = $pearDB->prepare($query);
98+
$statement->bindValue(':config_id', (int) $id, \PDO::PARAM_INT);
99+
$statement->execute();
96100
}
97101

98102
/**
@@ -104,8 +108,10 @@ function deleteCentreonBrokerInDB($ids = array())
104108
{
105109
global $pearDB;
106110

111+
$statement = $pearDB->prepare("DELETE FROM cfg_centreonbroker WHERE config_id = :config_id");
107112
foreach ($ids as $key => $value) {
108-
$pearDB->query("DELETE FROM cfg_centreonbroker WHERE config_id = " . $key);
113+
$statement->bindValue(':config_id', (int) $key, \PDO::PARAM_INT);
114+
$statement->execute();
109115
}
110116
}
111117

@@ -194,13 +200,7 @@ function multipleCentreonBrokerInDB($ids, $nbrDup)
194200
foreach ($ids as $id => $value) {
195201
$cbObj = new CentreonConfigCentreonBroker($pearDB);
196202

197-
$query = "SELECT config_name, config_filename, config_activate, ns_nagios_server,
198-
event_queue_max_size, cache_directory, daemon "
199-
. "FROM cfg_centreonbroker "
200-
. "WHERE config_id = " . $id . " ";
201-
$dbResult = $pearDB->query($query);
202-
$row = $dbResult->fetch();
203-
$dbResult->closeCursor();
203+
$row = getCfgBrokerData((int) $id);
204204

205205
# Prepare values
206206
$values = array();
@@ -210,14 +210,11 @@ function multipleCentreonBrokerInDB($ids, $nbrDup)
210210
$values['event_queue_max_size'] = $row['event_queue_max_size'];
211211
$values['cache_directory'] = $row['cache_directory'];
212212
$values['activate_watchdog']['activate_watchdog'] = $row['daemon'];
213-
$query = "SELECT config_key, config_value, config_group, config_group_id "
214-
. "FROM cfg_centreonbroker_info "
215-
. "WHERE config_id = " . $id . " ";
216-
$dbResult = $pearDB->query($query);
217213
$values['output'] = array();
218214
$values['input'] = array();
219215
$values['logger'] = array();
220-
while ($rowOpt = $dbResult->fetch()) {
216+
$brokerCfgInfoData = getCfgBrokerInfoData((int) $id);
217+
foreach ($brokerCfgInfoData as $rowOpt) {
221218
if ($rowOpt['config_key'] == 'filters') {
222219
continue;
223220
} elseif ($rowOpt['config_key'] == 'category') {
@@ -228,7 +225,6 @@ function multipleCentreonBrokerInDB($ids, $nbrDup)
228225
$rowOpt['config_value'];
229226
}
230227
}
231-
$dbResult->closeCursor();
232228

233229
# Convert values radio button
234230
foreach ($values as $group => $groups) {
@@ -254,16 +250,18 @@ function multipleCentreonBrokerInDB($ids, $nbrDup)
254250

255251
# Copy the configuration
256252
$j = 1;
253+
$query = "SELECT COUNT(*) as nb FROM cfg_centreonbroker WHERE config_name = :config_name";
254+
$statement = $pearDB->prepare($query);
257255
for ($i = 1; $i <= $nbrDup[$id]; $i++) {
258256
$nameNOk = true;
259257

260258
# Find the name
261259
while ($nameNOk) {
262260
$newname = $row['config_name'] . '_' . $j;
263261
$newfilename = $j . '_' . $row['config_filename'];
264-
$query = "SELECT COUNT(*) as nb FROM cfg_centreonbroker WHERE config_name = '" . $newname . "'";
265-
$res = $pearDB->query($query);
266-
$rowNb = $res->fetch();
262+
$statement->bindValue(':config_name', $newname, \PDO::PARAM_STR);
263+
$statement->execute();
264+
$rowNb = $statement->fetch(\PDO::FETCH_ASSOC);
267265
if ($rowNb['nb'] == 0) {
268266
$nameNOk = false;
269267
}
@@ -293,3 +291,54 @@ function isPositiveNumeric($size): bool
293291
}
294292
return $isPositive;
295293
}
294+
295+
/**
296+
* Getting Centreon CFG broker data
297+
*
298+
* @param int $configId
299+
* @return array
300+
*/
301+
function getCfgBrokerData(int $configId): array
302+
{
303+
global $pearDB;
304+
305+
$query = "SELECT config_name, config_filename, config_activate, ns_nagios_server,
306+
event_queue_max_size, cache_directory, daemon "
307+
. "FROM cfg_centreonbroker "
308+
. "WHERE config_id = :config_id ";
309+
try {
310+
$statement = $pearDB->prepare($query);
311+
$statement->bindValue(':config_id', $configId, \PDO::PARAM_INT);
312+
$statement->execute();
313+
$cfgBrokerData = $statement->fetch(\PDO::FETCH_ASSOC);
314+
} catch (PDOException $exception) {
315+
throw new \Exception("Cannot fetch Broker config data");
316+
}
317+
$statement->closeCursor();
318+
return $cfgBrokerData;
319+
}
320+
321+
/**
322+
* Getting Centreon CFG broker Info data
323+
*
324+
* @param int $configId
325+
* @return array
326+
*/
327+
function getCfgBrokerInfoData(int $configId): array
328+
{
329+
global $pearDB;
330+
331+
$query = "SELECT config_key, config_value, config_group, config_group_id "
332+
. "FROM cfg_centreonbroker_info "
333+
. "WHERE config_id = :config_id";
334+
try {
335+
$statement = $pearDB->prepare($query);
336+
$statement->bindValue(':config_id', $configId, \PDO::PARAM_INT);
337+
$statement->execute();
338+
$cfgBrokerInfoData = $statement->fetchAll(\PDO::FETCH_ASSOC);
339+
} catch (\PDOException $exception) {
340+
throw new \Exception("Cannot fetch Broker info config data");
341+
}
342+
$statement->closeCursor();
343+
return $cfgBrokerInfoData;
344+
}

www/install/insertBaseConf.sql

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
-- Insert version
33
--
44

5-
INSERT INTO `informations` (`key` ,`value`) VALUES ('version', '21.04.18');
5+
INSERT INTO `informations` (`key` ,`value`) VALUES ('version', '21.04.19');
66

77
--
88
-- Contenu de la table `contact`

www/install/php/Update-21.04.19.php

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<?php
2+
3+
/*
4+
* Copyright 2005 - 2022 Centreon (https://www.centreon.com/)
5+
*
6+
* Licensed under the Apache License, Version 2.0 (the "License");
7+
* you may not use this file except in compliance with the License.
8+
* You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*
18+
* For more information : [email protected]
19+
*
20+
*/
21+

0 commit comments

Comments
 (0)