From 562aebfb85a123bb7ddaa9dcdb93af886ac3c303 Mon Sep 17 00:00:00 2001
From: Daniel Cebrian <daniel.cebrian@pandorafms.com>
Date: Thu, 25 May 2023 14:01:43 +0200
Subject: [PATCH] #11312 fixed url public in visual console

---
 .../javascript/pandora_visual_console.js      |  4 ++--
 .../operation/visual_console/public_view.php  | 22 ++++++++++---------
 .../operation/visual_console/view.php         |  4 +++-
 3 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/pandora_console/include/javascript/pandora_visual_console.js b/pandora_console/include/javascript/pandora_visual_console.js
index 354934039c..0348306365 100755
--- a/pandora_console/include/javascript/pandora_visual_console.js
+++ b/pandora_console/include/javascript/pandora_visual_console.js
@@ -770,8 +770,8 @@ function loadVisualConsoleData(
         page: "include/rest-api/index",
         getVisualConsole: 1,
         visualConsoleId: vcId,
-        id_user: typeof id_user == undefined ? id_user : null,
-        auth_hash: typeof hash == undefined ? hash : null
+        id_user: typeof id_user !== undefined ? id_user : null,
+        auth_hash: typeof hash !== undefined ? hash : null
       },
       "json"
     )
diff --git a/pandora_console/operation/visual_console/public_view.php b/pandora_console/operation/visual_console/public_view.php
index ddf6811930..05a17ea851 100644
--- a/pandora_console/operation/visual_console/public_view.php
+++ b/pandora_console/operation/visual_console/public_view.php
@@ -61,6 +61,18 @@ echo '<link rel="stylesheet" href="'.$url_css.'?v='.$config['current_package'].'
 require_once 'include/functions_visual_map.php';
 
 $hash = (string) get_parameter('hash');
+
+// Check input hash.
+// DO NOT move it after of get parameter user id.
+if (User::validatePublicHash($hash) !== true) {
+    db_pandora_audit(
+        AUDIT_LOG_VISUAL_CONSOLE_MANAGEMENT,
+        'Trying to access public visual console'
+    );
+    include 'general/noaccess.php';
+    exit;
+}
+
 $visualConsoleId = (int) get_parameter('id_layout');
 $userAccessMaintenance = null;
 if (empty($config['id_user']) === true) {
@@ -75,16 +87,6 @@ if (!isset($config['pure'])) {
     $config['pure'] = 0;
 }
 
-// Check input hash.
-if (User::validatePublicHash($hash) !== true) {
-    db_pandora_audit(
-        AUDIT_LOG_VISUAL_CONSOLE_MANAGEMENT,
-        'Trying to access public visual console'
-    );
-    include 'general/noaccess.php';
-    exit;
-}
-
 // Load Visual Console.
 use Models\VisualConsole\Container as VisualConsole;
 $visualConsole = null;
diff --git a/pandora_console/operation/visual_console/view.php b/pandora_console/operation/visual_console/view.php
index 01f4a2092f..0150da5c45 100644
--- a/pandora_console/operation/visual_console/view.php
+++ b/pandora_console/operation/visual_console/view.php
@@ -85,6 +85,8 @@ $width = (int) get_parameter('width', 0);
 $height = (int) get_parameter('height', 0);
 // Load Visual Console.
 use Models\VisualConsole\Container as VisualConsole;
+use PandoraFMS\User;
+
 $visualConsole = null;
 try {
     $visualConsole = VisualConsole::fromDB(['id' => $visualConsoleId]);
@@ -152,7 +154,7 @@ if ($aclWrite === true || $aclManage === true) {
         $baseUrl = 'index.php?operation=edit_visualmap&sec=screen&sec2=screens/screens&action=visualmap&pure='.$pure.'&action2='.$action;
     }
 
-    $hash = md5($config['dbpass'].$visualConsoleId.$config['id_user']);
+    $hash = User::generatePublicHash();
 
     $options['public_link']['text'] = '<a href="'.ui_get_full_url(
         'operation/visual_console/public_console.php?hash='.$hash.'&id_layout='.$visualConsoleId.'&refr='.$refr.'&id_user='.$config['id_user'],