Projet

Général

Profil

« Précédent | Suivant » 

Révision d09ff9ef

Ajouté par Renato Botelho il y a presque 10 ans

Make sure variables are escaped, also replace exec calls to run rm by unlink_if_exists()

Voir les différences:

usr/local/www/status_rrd_graph_img.php
43 43
$pgtitle = array(gettext("System"),gettext("RRD Graphs"),gettext("Image viewer"));
44 44

  
45 45
if ($_GET['database']) {
46
	$curdatabase = basename($_GET['database']);
46
	$curdatabase = escapeshellarg(basename($_GET['database']));
47 47
} else {
48 48
	$curdatabase = "wan-traffic.rrd";
49 49
}
......
56 56

  
57 57
/* this is used for temp name */
58 58
if ($_GET['graph']) {
59
	$curgraph = $_GET['graph'];
59
	$curgraph = escapeshellarg($_GET['graph']);
60 60
} else {
61 61
	$curgraph = "custom";
62 62
}
......
1246 1246
	log_error(sprintf(gettext('Failed to create graph with error code %1$s, the error is: %2$s'),$graphcmdreturn,$graphcmdoutput));
1247 1247
	if(strstr($curdatabase, "queues")) {
1248 1248
		log_error(sprintf(gettext("failed to create graph from %s%s, removing database"),$rrddbpath,$curdatabase));
1249
		exec("/bin/rm -f $rrddbpath$curif$queues");
1249
		unlink_if_exists($rrddbpath . $curif . $queues);
1250 1250
		flush();
1251 1251
		usleep(500);
1252 1252
		enable_rrd_graphing();
1253 1253
	}
1254 1254
	if(strstr($curdatabase, "queuesdrop")) {
1255 1255
		log_error(sprintf(gettext("failed to create graph from %s%s, removing database"),$rrddbpath,$curdatabase));
1256
		exec("/bin/rm -f $rrddbpath$curdatabase");
1256
		unlink_if_exists($rrddbpath . $curdatabase);
1257 1257
		flush();
1258 1258
		usleep(500);
1259 1259
		enable_rrd_graphing();

Formats disponibles : Unified diff