Merge branch 'develop' into ent-5951-XSS-SNMP-Browser

This commit is contained in:
alejandro-campos 2020-06-17 09:46:41 +02:00
commit e78cd2b581
42 changed files with 257 additions and 94 deletions

View File

@ -1,5 +1,5 @@
package: pandorafms-agent-unix
Version: 7.0NG.746-200612
Version: 7.0NG.746-200617
Architecture: all
Priority: optional
Section: admin

View File

@ -14,7 +14,7 @@
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
pandora_version="7.0NG.746-200612"
pandora_version="7.0NG.746-200617"
echo "Test if you has the tools for to make the packages."
whereis dpkg-deb | cut -d":" -f2 | grep dpkg-deb > /dev/null

View File

@ -55,7 +55,7 @@ my $Sem = undef;
my $ThreadSem = undef;
use constant AGENT_VERSION => '7.0NG.746';
use constant AGENT_BUILD => '200612';
use constant AGENT_BUILD => '200617';
# Agent log default file size maximum and instances
use constant DEFAULT_MAX_LOG_SIZE => 600000;

View File

@ -3,7 +3,7 @@
#
%define name pandorafms_agent_unix
%define version 7.0NG.746
%define release 200612
%define release 200617
Summary: Pandora FMS Linux agent, PERL version
Name: %{name}

View File

@ -3,7 +3,7 @@
#
%define name pandorafms_agent_unix
%define version 7.0NG.746
%define release 200612
%define release 200617
Summary: Pandora FMS Linux agent, PERL version
Name: %{name}

View File

@ -10,7 +10,7 @@
# **********************************************************************
PI_VERSION="7.0NG.746"
PI_BUILD="200612"
PI_BUILD="200617"
OS_NAME=`uname -s`
FORCE=0

View File

@ -186,7 +186,7 @@ UpgradeApplicationID
{}
Version
{200612}
{200617}
ViewReadme
{Yes}

View File

@ -30,7 +30,7 @@ using namespace Pandora;
using namespace Pandora_Strutils;
#define PATH_SIZE _MAX_PATH+1
#define PANDORA_VERSION ("7.0NG.746(Build 200612)")
#define PANDORA_VERSION ("7.0NG.746(Build 200617)")
string pandora_path;
string pandora_dir;

View File

@ -11,7 +11,7 @@ BEGIN
VALUE "LegalCopyright", "Artica ST"
VALUE "OriginalFilename", "PandoraAgent.exe"
VALUE "ProductName", "Pandora FMS Windows Agent"
VALUE "ProductVersion", "(7.0NG.746(Build 200612))"
VALUE "ProductVersion", "(7.0NG.746(Build 200617))"
VALUE "FileVersion", "1.0.0.0"
END
END

View File

@ -1,5 +1,5 @@
package: pandorafms-console
Version: 7.0NG.746-200612
Version: 7.0NG.746-200617
Architecture: all
Priority: optional
Section: admin

View File

@ -14,7 +14,7 @@
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
pandora_version="7.0NG.746-200612"
pandora_version="7.0NG.746-200617"
package_pear=0
package_pandora=1

View File

@ -118,6 +118,10 @@ if ($create_special_day) {
$values['id_group'] = (string) get_parameter('id_group');
$values['description'] = (string) get_parameter('description');
$aviable_description = true;
if (preg_match('<script>', $values['description'])) {
$aviable_description = false;
}
$array_date = explode('-', $date);
@ -142,8 +146,12 @@ if ($create_special_day) {
$result = '';
$messageAction = __('Could not be created, it already exists');
} else {
$result = alerts_create_alert_special_day($date, $same_day, $values);
$info = '{"Date":"'.$date.'","Same day of the week":"'.$same_day.'","Description":"'.$values['description'].'"}';
if ($aviable_description) {
$result = alerts_create_alert_special_day($date, $same_day, $values);
$info = '{"Date":"'.$date.'","Same day of the week":"'.$same_day.'","Description":"'.$values['description'].'"}';
} else {
$result = false;
}
}
}
@ -176,6 +184,11 @@ if ($update_special_day) {
$id_group = (string) get_parameter('id_group');
$id_group_orig = (string) get_parameter('id_group_orig');
$aviable_description = true;
if (preg_match('<script>', $description)) {
$aviable_description = false;
}
$array_date = explode('-', $date);
$year = $array_date[0];
@ -206,12 +219,16 @@ if ($update_special_day) {
$result = '';
$messageAction = __('Could not be updated, it already exists');
} else {
if ($aviable_description !== false) {
$result = alerts_update_alert_special_day($id, $values);
$info = '{"Date":"'.$date.'","Same day of the week":"'.$same_day.'","Description":"'.$description.'"}';
}
}
} else {
if ($aviable_description !== false) {
$result = alerts_update_alert_special_day($id, $values);
$info = '{"Date":"'.$date.'","Same day of the week":"'.$same_day.'","Description":"'.$description.'"}';
}
} else {
$result = alerts_update_alert_special_day($id, $values);
$info = '{"Date":"'.$date.'","Same day of the week":"'.$same_day.'","Description":"'.$description.'"}';
}
}

View File

@ -347,24 +347,32 @@ if (($create_group) && (check_acl($config['id_user'], 0, 'PM'))) {
$check = db_get_value('nombre', 'tgrupo', 'nombre', $name);
$propagate = (bool) get_parameter('propagate');
$aviable_name = true;
if (preg_match('<script>', $name)) {
$aviable_name = false;
}
// Check if name field is empty.
if ($name != '') {
if (!$check) {
$values = [
'nombre' => $name,
'icon' => empty($icon) ? '' : substr($icon, 0, -4),
'parent' => $id_parent,
'disabled' => $alerts_disabled,
'custom_id' => $custom_id,
'id_skin' => $skin,
'description' => $description,
'contact' => $contact,
'propagate' => $propagate,
'other' => $other,
'password' => io_safe_input($group_pass),
];
if ($aviable_name === true) {
$values = [
'nombre' => $name,
'icon' => empty($icon) ? '' : substr($icon, 0, -4),
'parent' => $id_parent,
'disabled' => $alerts_disabled,
'custom_id' => $custom_id,
'id_skin' => $skin,
'description' => $description,
'contact' => $contact,
'propagate' => $propagate,
'other' => $other,
'password' => io_safe_input($group_pass),
];
$result = db_process_sql_insert('tgrupo', $values);
}
$result = db_process_sql_insert('tgrupo', $values);
if ($result) {
ui_print_success_message(__('Group successfully created'));
} else {
@ -394,8 +402,13 @@ if ($update_group) {
$contact = (string) get_parameter('contact');
$other = (string) get_parameter('other');
$aviable_name = true;
if (preg_match('<script>', $name)) {
$aviable_name = false;
}
// Check if name field is empty.
if ($name != '') {
if ($name != '' && $aviable_name === true) {
$sql = sprintf(
'UPDATE tgrupo
SET nombre = "%s",

View File

@ -767,9 +767,14 @@ switch ($action) {
)
);
if (count($reports)) {
$filters = [
'search' => $search,
'id_group' => $id_group,
];
$filtersStr = http_build_query($filters, '', '&amp;');
$url = 'index.php?sec=reporting&sec2=godmode/reporting/reporting_builder';
$url .= '&'.$filtersStr;
ui_pagination($total_reports, $url, $offset, $pagination);
$table = new stdClass();

View File

@ -31,11 +31,10 @@ $id_tag = (int) get_parameter('id_tag', 0);
$update_tag = (int) get_parameter('update_tag', 0);
$create_tag = (int) get_parameter('create_tag', 0);
$name_tag = (string) get_parameter('name_tag', '');
$description_tag = (string) get_parameter('description_tag', '');
$description_tag = io_safe_input(strip_tags(io_safe_output($description_tag)));
$description_tag = io_safe_input(strip_tags(io_safe_output((string) get_parameter('description_tag'))));
$url_tag = (string) get_parameter('url_tag', '');
$email_tag = (string) get_parameter('email_tag', '');
$phone_tag = (string) get_parameter('phone_tag', '');
$email_tag = io_safe_input(strip_tags(io_safe_output(((string) get_parameter('email_tag')))));
$phone_tag = io_safe_input(strip_tags(io_safe_output(((string) get_parameter('phone_tag')))));
$tab = (string) get_parameter('tab', 'list');
if (defined('METACONSOLE')) {

View File

@ -692,9 +692,7 @@ class HostDevices extends Wizard
if ($this->page == 1) {
$title = __(
'"%s" features',
io_safe_output(
$this->task['name']
)
$this->task['name']
);
}

View File

@ -832,7 +832,7 @@ class Wizard
$first_block_printed = true;
}
$output .= '<div class="edit_discovery_info '.$row['class'].'" style="'.$row['style'].'">';
$row_output = '<div class="edit_discovery_info '.$row['class'].'" style="'.$row['style'].'">';
foreach ($row['columns'] as $column) {
$width = isset($column['width']) ? 'width: '.$column['width'].';' : 'width: 100%;';
@ -841,23 +841,36 @@ class Wizard
$extra_styles = isset($column['style']) ? $column['style'] : '';
$class = isset($column['class']) ? $column['class'] : '';
$output .= '<div class="'.$class.'" ';
$output .= ' style="'.$width.$padding_left.$padding_right;
$output .= $extra_styles.'">';
$row_output .= '<div class="'.$class.'" ';
$row_output .= ' style="'.$width.$padding_left.$padding_right;
$row_output .= $extra_styles.'">';
foreach ($column['inputs'] as $input) {
if (is_array($input)) {
if ($input['arguments']['type'] != 'submit') {
$output .= $this->printBlockAsGrid($input, true);
$row_output .= $this->printBlockAsGrid($input, true);
} else {
$output_submit .= $this->printBlockAsGrid($input, true);
}
} else {
$output .= $input;
$row_output .= $input;
}
}
$output .= '</div>';
$row_output .= '</div>';
}
if (isset($row['toggle'])) {
$output .= ui_print_toggle(
[
'content' => $row_output,
'name' => $row['toggle_label'],
'hidden_default' => ! (bool) $row['toggle'],
'return' => true,
]
);
} else {
$output .= $row_output;
}
$output .= '</div>';

View File

@ -1088,10 +1088,18 @@ if ($dialogue_event_response) {
}
if ($add_comment) {
$aviability_comment = true;
$comment = get_parameter('comment');
if (preg_match('<script>', io_safe_output($comment))) {
$aviability_comment = false;
$return = false;
}
$event_id = get_parameter('event_id');
$return = events_comment($event_id, $comment, 'Added comment', $meta, $history);
if ($aviability_comment !== false) {
$return = events_comment($event_id, $comment, 'Added comment', $meta, $history);
}
if ($return) {
echo 'comment_ok';

View File

@ -261,6 +261,13 @@ if ($correctLogin) {
}
break;
case 'event':
// Preventive check for users if not available write events
if (! check_acl($config['id_user'], $event['id_grupo'], 'EW')) {
return false;
}
break;
default:
// Ignore.
break;

View File

@ -277,7 +277,8 @@ if (file_exists('languages/'.$user_language.'.mo') === true) {
$params['ttl'],
$params['sizeForTicks'],
$params['show'],
$params['date_to']
$params['date_to'],
$params['server_id']
);
break;

View File

@ -105,7 +105,7 @@ class CustomNetScan extends Wizard
// from 'validation' page.
if (isset($this->page) === true && $this->page === 1) {
$task_id = get_parameter('task', null);
$taskname = get_parameter('taskname', '');
$taskname = io_safe_input(strip_tags(io_safe_output(get_parameter('taskname'))));
$comment = get_parameter('comment', '');
$server_id = get_parameter('id_recon_server', '');
$id_group = get_parameter('id_group', '');

View File

@ -20,7 +20,7 @@
/**
* Pandora build version and version
*/
$build_version = 'PC200612';
$build_version = 'PC200617';
$pandora_version = 'v7.0NG.746';
// Do not overwrite default timezone set if defined.

View File

@ -477,7 +477,8 @@ function set_user_language()
/**
* INTERNAL (use ui_print_timestamp for output): Transform an amount of time in seconds into a human readable
* INTERNAL (use ui_print_timestamp for output):
* Transform an amount of time in seconds into a human readable
* strings of minutes, hours or days.
*
* @param integer $seconds Seconds elapsed time
@ -488,17 +489,11 @@ function set_user_language()
*/
function human_time_description_raw($seconds, $exactly=false, $units='large')
{
switch ($units) {
case 'large':
$secondsString = __('seconds');
$daysString = __('days');
$monthsString = __('months');
$yearsString = __('years');
$minutesString = __('minutes');
$hoursString = __('hours');
$nowString = __('Now');
break;
if (isset($units) === false || empty($units) === true) {
$units = 'large';
}
switch ($units) {
case 'tiny':
$secondsString = __('s');
$daysString = __('d');
@ -508,6 +503,17 @@ function human_time_description_raw($seconds, $exactly=false, $units='large')
$hoursString = __('h');
$nowString = __('N');
break;
default:
case 'large':
$secondsString = __('seconds');
$daysString = __('days');
$monthsString = __('months');
$yearsString = __('years');
$minutesString = __('minutes');
$hoursString = __('hours');
$nowString = __('Now');
break;
}
if (empty($seconds)) {
@ -2136,7 +2142,7 @@ function check_sql($sql)
{
// We remove "*" to avoid things like SELECT * FROM tusuario
// Check that it not delete_ as "delete_pending" (this is a common field in pandora tables).
if (preg_match('/\*|delete[^_]|drop|alter|modify|password|pass|insert|update/i', $sql)) {
if (preg_match('/([ ]*(delete|drop|alter|modify|password|pass|insert|update)\b[ \\]+)/i', $sql)) {
return '';
}

View File

@ -8796,6 +8796,11 @@ function otherParameter2Filter($other, $return_as_array=false, $use_agent_name=f
}
}
// Esto es extraño, hablar con Tati
/*
$filter['1'] = $filter['sql'];
unset($filter['sql']); */
if (isset($other['data'][4]) && $other['data'][4] != '') {
$idTemplate = db_get_value_filter('id', 'talert_templates', ['name' => $other['data'][4]]);
if ($idTemplate !== false) {
@ -10727,6 +10732,83 @@ function get_events_with_user($trash1, $trash2, $other, $returnType, $user_in_db
}
/**
* Update an event
*
* @param string $id_event Id of the event for change.
* @param string $unused1 Without use.
* @param array $params Dictionary with field,value format with the data for update.
* @param string $unused2 Without use.
* @param string $unused3 Without use.
*
* @return void
*/
function api_set_event($id_event, $unused1, $params, $unused2, $unused3)
{
// Get the event
$event = events_get_event($id_event, false, is_metaconsole());
// If event not exists, end the execution.
if ($event === false) {
returnError(
'event_not_exists',
'Event not exists'
);
return false;
}
$paramsSerialize = [];
// Serialize the data for update
if ($params['type'] === 'array') {
// Keys that is not available to change
$invalidKeys = [
'id_evento',
'id_agente',
'id_grupo',
'timestamp',
'utimestamp',
'id_agentmodule',
'ack_utimestamp',
'data',
];
foreach ($params['data'] as $key_value) {
list($key, $value) = explode(',', $key_value, 2);
if (in_array($key, $invalidKeys) == false) {
$paramsSerialize[$key] = $value;
}
}
}
// In meta or node.
if (is_metaconsole() === true) {
$table = 'tmetaconsole_event';
} else {
$table = 'tevento';
}
// TODO. Stablish security for prevent sql injection?
// Update the row
$result = db_process_sql_update(
$table,
$paramsSerialize,
[ 'id_evento' => $id_event ]
);
// If update results failed
if (empty($result) === true || $result === false) {
returnError(
'failed_event_update',
__('Failed event update')
);
return false;
} else {
returnData('string', ['data' => 'Event updated']);
}
return;
}
/**
*
* @param $trash1

View File

@ -287,7 +287,7 @@ function config_update_config()
$error_update[] = __('Command Snapshot');
}
if (!config_update_value('server_log_dir', get_parameter('server_log_dir'))) {
if (!config_update_value('server_log_dir', io_safe_input(strip_tags(io_safe_output(get_parameter('server_log_dir')))))) {
$error_update[] = __('Server logs directory');
}
@ -1200,8 +1200,8 @@ function config_update_config()
// --------------------------------------------------
// CUSTOM VALUES POST PROCESS
// --------------------------------------------------
$custom_value = get_parameter('custom_value');
$custom_text = get_parameter('custom_text');
$custom_value = io_safe_input(strip_tags(io_safe_output(get_parameter('custom_value'))));
$custom_text = io_safe_input(strip_tags(io_safe_output(get_parameter('custom_text'))));
$custom_value_add = (bool) get_parameter('custom_value_add', 0);
$custom_value_to_delete = get_parameter('custom_value_to_delete', 0);
@ -1272,8 +1272,8 @@ function config_update_config()
// --------------------------------------------------
// MODULE CUSTOM UNITS
// --------------------------------------------------
$custom_unit = get_parameter('custom_module_unit');
$custom_unit_to_delete = get_parameter('custom_module_unit_to_delete', '');
$custom_unit = io_safe_input(strip_tags(io_safe_output(get_parameter('custom_module_unit'))));
$custom_unit_to_delete = io_safe_input(strip_tags(io_safe_output(get_parameter('custom_module_unit_to_delete', ''))));
if (!empty($custom_unit)) {
if (!add_custom_module_unit(

View File

@ -699,6 +699,7 @@ function flot_slicesbar_graph(
'show' => $show,
'return_img_base_64' => true,
'date_to' => $date_to,
'server_id' => $server_id,
];
$graph = '<img src="data:image/jpg;base64,';
@ -738,7 +739,7 @@ function flot_slicesbar_graph(
$maxticks = (int) 20;
if ($sizeForTicks === false) {
$maxticks = (int) 20;
$maxticks = (int) 12;
} else if ($sizeForTicks < 300) {
$maxticks = (int) 3;
} else if ($sizeForTicks < 600) {
@ -808,7 +809,23 @@ function flot_slicesbar_graph(
// Javascript code.
$return .= "<script type='text/javascript'>";
$return .= "//<![CDATA[\n";
$return .= "pandoraFlotSlicebar('$graph_id','$values','$datacolor','$legend',$intervaltick,'$fontpath',$fontsize,'$separator','$separator2',$id_agent,'$full_legend_date',$not_interactive, '$show', $datelimit, $server_id)";
$return .= "pandoraFlotSlicebar(
'$graph_id',
'$values',
'$datacolor',
'$legend',
$intervaltick,
'$fontpath',
$fontsize,
'$separator',
'$separator2',
$id_agent,
'$full_legend_date',
$not_interactive,
'$show',
$datelimit,
'$server_id'
)";
$return .= "\n//]]>";
$return .= '</script>';

View File

@ -685,6 +685,11 @@ if (! isset($config['id_user'])) {
unset($query_params_redirect['sec2']);
}
// Dashboard do not want sec2.
if ($home_page == 'Dashboard') {
unset($query_params_redirect['sec2']);
}
$redirect_url = '?logged=1';
foreach ($query_params_redirect as $key => $value) {
if ($key == 'login') {

View File

@ -129,7 +129,7 @@
<div style='height: 10px'>
<?php
$version = '7.0NG.746';
$build = '200612';
$build = '200617';
$banner = "v$version Build $build";
error_reporting(0);

View File

@ -1962,17 +1962,7 @@ function process_datatables_item(item) {
/* Agent ID link */
if (item.id_agente > 0) {
<?php
if (in_array('agent_name', $fields)) {
?>
item.id_agente = '<a href="'+url_link+item.id_agente+url_link_hash+'">' + item.id_agente + '</a>';
<?php
} else {
?>
item.id_agente = '<a href="'+url_link+item.id_agente+url_link_hash+'">' + item.agent_name + '</a>';
<?php
}
?>
item.id_agente = '<a href="'+url_link+item.id_agente+url_link_hash+'">' + item.id_agente + '</a>';
} else {
item.id_agente = '';
}

View File

@ -3,7 +3,7 @@
#
%define name pandorafms_console
%define version 7.0NG.746
%define release 200612
%define release 200617
# User and Group under which Apache is running
%define httpd_name httpd

View File

@ -3,7 +3,7 @@
#
%define name pandorafms_console
%define version 7.0NG.746
%define release 200612
%define release 200617
# User and Group under which Apache is running
%define httpd_name httpd

View File

@ -3,7 +3,7 @@
#
%define name pandorafms_console
%define version 7.0NG.746
%define release 200612
%define release 200617
%define httpd_name httpd
# User and Group under which Apache is running
%define httpd_name apache2

View File

@ -1,5 +1,5 @@
package: pandorafms-server
Version: 7.0NG.746-200612
Version: 7.0NG.746-200617
Architecture: all
Priority: optional
Section: admin

View File

@ -14,7 +14,7 @@
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
pandora_version="7.0NG.746-200612"
pandora_version="7.0NG.746-200617"
package_cpan=0
package_pandora=1

View File

@ -45,7 +45,7 @@ our @EXPORT = qw(
# version: Defines actual version of Pandora Server for this module only
my $pandora_version = "7.0NG.746";
my $pandora_build = "200612";
my $pandora_build = "200617";
our $VERSION = $pandora_version." ".$pandora_build;
# Setup hash
@ -399,7 +399,8 @@ sub pandora_load_config {
$pa_config->{'max_log_generation'} = 1;
# Ignore the timestamp in the XML and use the file timestamp instead
$pa_config->{'use_xml_timestamp'} = 0;
# If 1 => uses timestamp from received XML #5763.
$pa_config->{'use_xml_timestamp'} = 1;
# Server restart delay in seconds
$pa_config->{'restart_delay'} = 60;

View File

@ -234,6 +234,7 @@ sub data_consumer ($$) {
}
# Ignore the timestamp in the XML and use the file timestamp instead
# If 1 => uses timestamp from received XML #5763.
$xml_data->{'timestamp'} = strftime ("%Y-%m-%d %H:%M:%S", localtime((stat($file_name))[9])) if ($pa_config->{'use_xml_timestamp'} eq '0' || ! defined ($xml_data->{'timestamp'}));
# Double check that the file exists

View File

@ -33,7 +33,7 @@ our @ISA = qw(Exporter);
# version: Defines actual version of Pandora Server for this module only
my $pandora_version = "7.0NG.746";
my $pandora_build = "200612";
my $pandora_build = "200617";
our $VERSION = $pandora_version." ".$pandora_build;
our %EXPORT_TAGS = ( 'all' => [ qw() ] );

View File

@ -3,7 +3,7 @@
#
%define name pandorafms_server
%define version 7.0NG.746
%define release 200612
%define release 200617
Summary: Pandora FMS Server
Name: %{name}

View File

@ -3,7 +3,7 @@
#
%define name pandorafms_server
%define version 7.0NG.746
%define release 200612
%define release 200617
Summary: Pandora FMS Server
Name: %{name}

View File

@ -9,7 +9,7 @@
# **********************************************************************
PI_VERSION="7.0NG.746"
PI_BUILD="200612"
PI_BUILD="200617"
MODE=$1
if [ $# -gt 1 ]; then

View File

@ -35,7 +35,7 @@ use PandoraFMS::Config;
use PandoraFMS::DB;
# version: define current version
my $version = "7.0NG.746 PS200612";
my $version = "7.0NG.746 PS200617";
# Pandora server configuration
my %conf;

View File

@ -36,7 +36,7 @@ use Encode::Locale;
Encode::Locale::decode_argv;
# version: define current version
my $version = "7.0NG.746 PS200612";
my $version = "7.0NG.746 PS200617";
# save program name for logging
my $progname = basename($0);