tyler.durden
/
pandorafms
mirror of https://github.com/pandorafms/pandorafms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'ent-6279-vulnerabilidades-XSS' into 'develop' 

Ent 6279 vulnerabilidades xss

See merge request artica/pandorafms!3445
This commit is contained in:
Daniel Rodriguez 2020-09-17 10:17:11 +02:00
parent 21b3a5ad2a b97014f577
commit 4174d9910f
7 changed files with 21 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pandora_console/godmode/alerts/alert_special_days.php
View File

@ -116,7 +116,7 @@ if ($create_special_day) {
$same_day = (string) get_parameter('same_day');
$values = [];
$values['id_group'] = (string) get_parameter('id_group');
$values['description'] = (string) get_parameter('description');
$values['description'] = io_safe_input(strip_tags(io_safe_output((string) get_parameter('description'))));
$aviable_description = true;
if (preg_match('/script/i', $values['description'])) {
@ -180,7 +180,7 @@ if ($update_special_day) {
$date = (string) get_parameter('date');
$date_orig = (string) get_parameter('date_orig');
$same_day = (string) get_parameter('same_day');
$description = (string) get_parameter('description');
$description = io_safe_input(strip_tags(io_safe_output((string) get_parameter('description'))));
$id_group = (string) get_parameter('id_group');
$id_group_orig = (string) get_parameter('id_group_orig');
@ -515,7 +515,11 @@ for ($month = 1; $month <= 12; $month++) {
break;
}
$cal_table->data[$cal_line][$week] .= ui_print_help_tip($special_day['description'], true);
// Only show description if is filled.
if (empty($special_day['description']) === false) {
$cal_table->data[$cal_line][$week] .= ui_print_help_tip($special_day['description'], true);
}
if ($special_day['id_group'] || ($can_manage_group_all && $special_day['id_group'] == 0)) {
$cal_table->data[$cal_line][$week] .= '<a href="index.php?sec=galertas&sec2=godmode/alerts/configure_alert_special_days&id='.$special_day['id'].'" title=';
$cal_table->data[$cal_line][$week] .= __('Edit');

4
pandora_console/godmode/modules/manage_network_components.php
View File

@ -81,8 +81,8 @@ if (defined('METACONSOLE')) {
}
$type = (int) get_parameter('type');
$name = (string) get_parameter('name');
$description = (string) get_parameter('description');
$name = io_safe_input(strip_tags(io_safe_output((string) get_parameter('name'))));
$description = io_safe_input(strip_tags(io_safe_output((string) get_parameter('description'))));
$max = (int) get_parameter('max');
$min = (int) get_parameter('min');
$tcp_send = (string) get_parameter('tcp_send');

8
pandora_console/godmode/setup/os.php
View File

@ -37,8 +37,8 @@ if ($idOS) {
$description = $os['description'];
$icon = $os['icon_name'];
} else {
$name = get_parameter('name', '');
$description = get_parameter('description', '');
$name = io_safe_input(strip_tags(io_safe_output((string) get_parameter('name'))));
$description = io_safe_input(strip_tags(io_safe_output((string) get_parameter('description'))));
$icon = get_parameter('icon', 0);
}
@ -91,8 +91,8 @@ switch ($action) {
break;
case 'update':
$name = get_parameter('name', '');
$description = get_parameter('description', '');
$name = io_safe_input(strip_tags(io_safe_output((string) get_parameter('name'))));
$description = io_safe_input(strip_tags(io_safe_output((string) get_parameter('description'))));
$icon = get_parameter('icon', 0);
$values = [];

4
pandora_console/godmode/users/configure_user.php
View File

@ -313,7 +313,7 @@ if ($create_user) {
$password_confirm = (string) get_parameter('password_confirm', '');
$values['email'] = (string) get_parameter('email');
$values['phone'] = (string) get_parameter('phone');
$values['comments'] = (string) get_parameter('comments');
$values['comments'] = io_safe_input(strip_tags(io_safe_output((string) get_parameter('comments'))));
$values['is_admin'] = $user_is_admin;
$values['language'] = get_parameter('language', 'default');
$values['timezone'] = (string) get_parameter('timezone');
@ -500,7 +500,7 @@ if ($update_user) {
$values['lastname'] = (string) get_parameter('lastname');
$values['email'] = (string) get_parameter('email');
$values['phone'] = (string) get_parameter('phone');
$values['comments'] = (string) get_parameter('comments');
$values['comments'] = io_safe_input(strip_tags(io_safe_output((string) get_parameter('comments'))));
$values['is_admin'] = get_parameter('is_admin', 0);
$values['language'] = (string) get_parameter('language');
$values['timezone'] = (string) get_parameter('timezone');

4
pandora_console/include/class/ConfigPEN.class.php
View File

@ -495,8 +495,8 @@ class ConfigPEN extends HTML
public function add()
{
$pen = get_parameter('pen', 0);
$manufacturer = get_parameter('manufacturer', '');
$description = get_parameter('description', '');
$manufacturer = io_safe_input(strip_tags(io_safe_output((string) get_parameter('manufacturer'))));
$description = io_safe_input(strip_tags(io_safe_output((string) get_parameter('description'))));
$is_new = (bool) get_parameter('is_new', false);
if (empty($pen)) {

4
pandora_console/include/class/ManageNetScanScripts.class.php
View File

@ -180,7 +180,7 @@ class ManageNetScanScripts extends Wizard
$result = [];
$reconscript_name = get_parameter('form_name', '');
$reconscript_description = get_parameter('form_description', '');
$reconscript_description = io_safe_input(strip_tags(io_safe_output((string) get_parameter('form_description'))));
$reconscript_script = get_parameter('form_script', '');
// Get macros.
@ -260,7 +260,7 @@ class ManageNetScanScripts extends Wizard
// If modified any parameter.
$reconscript_name = get_parameter('form_name', '');
$reconscript_description = get_parameter('form_description', '');
$reconscript_description = io_safe_input(strip_tags(io_safe_output((string) get_parameter('form_description'))));
$reconscript_script = get_parameter('form_script', '');
// Get macros.

4
pandora_console/include/class/ModuleTemplates.class.php
View File

@ -303,8 +303,8 @@ class ModuleTemplates extends HTML
if (!empty($this->action)) {
// Success variable.
$success = false;
$this->name = get_parameter('name', '');
$this->description = get_parameter('description', '');
$this->name = io_safe_input(strip_tags(io_safe_output((string) get_parameter('name'))));
$this->description = io_safe_input(strip_tags(io_safe_output((string) get_parameter('description'))));
$this->pen = get_parameter('pen', '');
switch ($this->action) {