diff --git a/pandora_console/godmode/setup/setup.php b/pandora_console/godmode/setup/setup.php index 56c8be9aaa..4d55762d8c 100644 --- a/pandora_console/godmode/setup/setup.php +++ b/pandora_console/godmode/setup/setup.php @@ -51,6 +51,7 @@ if (! check_acl ($config['id_user'], 0, "PM") && ! is_user_admin ($config['id_us } // Load enterprise extensions enterprise_include_once ('include/functions_setup.php'); +enterprise_include_once ('include/functions_io.php'); enterprise_include_once ('godmode/setup/setup.php'); /* diff --git a/pandora_console/godmode/setup/setup_general.php b/pandora_console/godmode/setup/setup_general.php index 8209cefd11..cb8511130b 100644 --- a/pandora_console/godmode/setup/setup_general.php +++ b/pandora_console/godmode/setup/setup_general.php @@ -53,7 +53,7 @@ $table->data[0][1] = html_print_select_from_sql ( $table->data[1][0] = __('Remote config directory') . ui_print_help_tip (__("Directory where agent remote configuration is stored."), true); -$table->data[1][1] = html_print_input_text ('remote_config', $config["remote_config"], '', 30, 100, true); +$table->data[1][1] = html_print_input_text ('remote_config', io_safe_output($config["remote_config"]), '', 30, 100, true); $table->data[6][0] = __('Auto login (hash) password'); $table->data[6][1] = html_print_input_text ('loginhash_pwd', $config["loginhash_pwd"], '', 15, 15, true); @@ -72,7 +72,7 @@ $table->data[11][1] = __('Yes').'   '.html_print_radio_button_ext $table->data[11][1] .= __('No').'   '.html_print_radio_button ('https', 0, '', $config["https"], true); $table->data[14][0] = __('Attachment store') . ui_print_help_tip (__("Directory where temporary data is stored."), true); -$table->data[14][1] = html_print_input_text ('attachment_store', $config["attachment_store"], '', 50, 255, true); +$table->data[14][1] = html_print_input_text ('attachment_store', io_safe_output($config["attachment_store"]), '', 50, 255, true); $table->data[15][0] = __('IP list with API access') . ui_print_help_icon ("ip_api_list", true); if (isset($_POST["list_ACL_IPs_for_API"])) { diff --git a/pandora_console/godmode/setup/setup_visuals.php b/pandora_console/godmode/setup/setup_visuals.php index 7caacc2ce9..b95ad63fe7 100644 --- a/pandora_console/godmode/setup/setup_visuals.php +++ b/pandora_console/godmode/setup/setup_visuals.php @@ -179,7 +179,7 @@ $row++; $table->data[$row][0] = __('Font path'); $fonts = load_fonts(); -$table->data[$row][1] = html_print_select($fonts, 'fontpath', $config["fontpath"], '', '', 0, true); +$table->data[$row][1] = html_print_select($fonts, 'fontpath', io_safe_output($config["fontpath"]), '', '', 0, true); $row++; diff --git a/pandora_console/include/functions_config.php b/pandora_console/include/functions_config.php index daf6bd4eae..37975e597d 100644 --- a/pandora_console/include/functions_config.php +++ b/pandora_console/include/functions_config.php @@ -51,7 +51,7 @@ function config_update_value ($token, $value) { if (!isset ($config[$token])) { $config[$token] = $value; - return (bool) config_create_value ($token, $value); + return (bool) config_create_value ($token, io_safe_input($value)); } /* If it has not changed */ @@ -59,9 +59,10 @@ function config_update_value ($token, $value) { return true; $config[$token] = $value; + $value = io_safe_output($value); $result = db_process_sql_update ('tconfig', - array ('value' => $value), + array ('value' => io_safe_input($value)), array ('token' => $token)); if ($result === 0) @@ -119,7 +120,7 @@ function config_update_config () { case 'general': if (!config_update_value ('language', (string) get_parameter ('language'))) $error_update[] = __('Language code for Pandora'); - if (!config_update_value ('remote_config', io_safe_input((string) get_parameter ('remote_config')))) + if (!config_update_value ('remote_config', (string) get_parameter ('remote_config'))) $error_update[] = __('Remote config directory'); if (!config_update_value ('loginhash_pwd', (string) get_parameter ('loginhash_pwd'))) $error_update[] = __('Auto login (hash) password'); @@ -130,7 +131,7 @@ function config_update_config () { $error_update[] = __('Automatic check for updates'); if (!config_update_value ('https', (bool) get_parameter ('https'))) $error_update[] = __('Enforce https'); - if (!config_update_value ('attachment_store', io_safe_input((string) get_parameter ('attachment_store')))) + if (!config_update_value ('attachment_store', (string) get_parameter ('attachment_store'))) $error_update[] = __('Attachment store'); if (!config_update_value ('list_ACL_IPs_for_API', (string) get_parameter('list_ACL_IPs_for_API'))) $error_update[] = __('IP list with API access'); @@ -405,7 +406,7 @@ function config_update_config () { $error_update[] = __('Show QR code header'); if (!config_update_value ('status_images_set', (string) get_parameter ('status_images_set'))) $error_update[] = __('Status icon set'); - if (!config_update_value ('fontpath', io_safe_input((string) get_parameter ('fontpath')))) + if (!config_update_value ('fontpath', (string) get_parameter ('fontpath'))) $error_update[] = __('Font path'); if (!config_update_value ('font_size', get_parameter('font_size'))) $error_update[] = __('Font size'); @@ -443,7 +444,7 @@ function config_update_config () { $error_update[] = __('Fixed menu'); if (!config_update_value ('paginate_module', get_parameter('paginate_module'))) $error_update[] = __('Paginate module'); - if (!config_update_value ('graphviz_bin_dir', io_safe_input(get_parameter('graphviz_bin_dir')))) + if (!config_update_value ('graphviz_bin_dir', get_parameter('graphviz_bin_dir'))) $error_update[] = __('Custom graphviz directory'); if (!config_update_value ('networkmap_max_width', get_parameter('networkmap_max_width'))) $error_update[] = __('Networkmap max width'); @@ -533,7 +534,7 @@ function config_update_config () { $error_update[] = __('Name resolution for IP address'); break; case 'log': - if (!config_update_value ('log_dir', io_safe_input(get_parameter('log_dir')))) + if (!config_update_value ('log_dir', get_parameter('log_dir'))) $error_update[] = __('Netflow max lifetime'); if (!config_update_value ('log_max_lifetime', (int)get_parameter('log_max_lifetime'))) $error_update[] = __('Log max lifetime'); @@ -815,14 +816,14 @@ function config_process_config () { //after the first uses. if (!is_dir($config['attachment_store'])) { config_update_value('attachment_store', - io_safe_input($config['homedir']) . '/attachment'); + $config['homedir'] . '/attachment'); } } if (!isset ($config['fontpath'])) { config_update_value('fontpath', - io_safe_input($config['homedir']) . '/include/fonts/smallfont.ttf'); + $config['homedir'] . '/include/fonts/smallfont.ttf'); } if (!isset ($config['style'])) { @@ -1368,7 +1369,7 @@ function config_check () { 'no_close' => true, 'force_style' => 'color: #000000 !important'), '', true); } - $fontpath = io_safe_output(db_get_value_filter('value', 'tconfig', array('token' => 'fontpath'))); + $fontpath = io_safe_output( db_get_value_filter('value', 'tconfig', array('token' => 'fontpath')) ); if (($fontpath == "") OR (!file_exists ($fontpath))) { $config["alert_cnt"]++; $_SESSION["alert_msg"] .= ui_print_error_message( @@ -1468,11 +1469,20 @@ function config_check () { 'no_close' => true, 'force_style' => 'color: #000000 !important'), '', true); } - if (preg_match("/system/", $PHPdisable_functions) or preg_match("/exec/", $PHPdisable_functions)) { + if ( preg_match("/system\b/", $PHPdisable_functions) ) { $config["alert_cnt"]++; $_SESSION["alert_msg"] .= ui_print_info_message( array('title' => __("Problems with disable functions in PHP.INI"), - 'message' => __("Variable disable_functions containts functions system() or exec(), in PHP configuration file (php.ini)"). '

' . + 'message' => __("Variable disable_functions containts functions system(), in PHP configuration file (php.ini)"). '

' . + __('Please, change it on your PHP configuration file (php.ini) or contact with administrator (Dont forget restart apache process after changes)'), + 'no_close' => true, 'force_style' => 'color: #000000 !important'), '', true); + } + + if ( preg_match("/exec\b/", $PHPdisable_functions) ) { + $config["alert_cnt"]++; + $_SESSION["alert_msg"] .= ui_print_info_message( + array('title' => __("Problems with disable functions in PHP.INI"), + 'message' => __("Variable disable_functions containts functions exec(), in PHP configuration file (php.ini)"). '

' . __('Please, change it on your PHP configuration file (php.ini) or contact with administrator (Dont forget restart apache process after changes)'), 'no_close' => true, 'force_style' => 'color: #000000 !important'), '', true); }