Merge branch 'ent-5325-CSRF-XSS-realtime-graphs' into 'develop'

Added enconding to POST variables realtime graphs See merge request artica/pandorafms!3019
2020-01-22 12:04:14 +01:00 · 2020-01-22 12:04:14 +01:00 · f6cb7eb3d7
parent ec03f947fe 3d0b71d953
commit f6cb7eb3d7
1 changed files with 2 additions and 2 deletions
--- a/pandora_console/extensions/realtime_graphs/ajax.php
+++ b/pandora_console/extensions/realtime_graphs/ajax.php
@ -109,6 +109,6 @@ if (empty($data)) {
 }

 echo '{
-	"label": "'.$graph_title.'",
-	"data": [["'.time().'", '.$data.']]
+	"label": "'.htmlspecialchars($graph_title, ENT_QUOTES).'",    
+	"data": [["'.time().'", '.htmlspecialchars($data, ENT_QUOTES).']]
 }';