- patch for 0.8.7g fixing some Cross-site scripting and SQL InjectionS potientials

Changed files:
    cacti-0.8.7g-sqli-xss.patch -> 1.1

diff --git a/cacti-0.8.7g-sqli-xss.patch b/cacti-0.8.7g-sqli-xss.patch
new file mode 100644 (file)
index 0000000..de8c6a6
--- /dev/null
+++ b/cacti-0.8.7g-sqli-xss.patch
@@ -0,0 +1,115 @@
+diff -ur cacti-0.8.7g.orig/data_input.php cacti-0.8.7g/data_input.php
+--- cacti-0.8.7g.orig/data_input.php   2010-07-10 00:33:46.000000000 +0200
++++ cacti-0.8.7g/data_input.php        2011-04-14 21:10:24.658500117 +0200
+@@ -386,7 +386,7 @@
+       html_end_box();
+ 
+       if (!empty($_GET["id"])) {
+-              html_start_box("<strong>Input Fields</strong>", "100%", $colors["header"], "3", "center", "data_input.php?action=field_edit&type=in&data_input_id=" . $_GET["id"]);
++              html_start_box("<strong>Input Fields</strong>", "100%", $colors["header"], "3", "center", "data_input.php?action=field_edit&type=in&data_input_id=" . htmlspecialchars(get_request_var("id")));
+               print "<tr bgcolor='#" . $colors["header_panel"] . "'>";
+                       DrawMatrixHeaderItem("Name",$colors["header_text"],1);
+                       DrawMatrixHeaderItem("Field Order",$colors["header_text"],1);
+diff -ur cacti-0.8.7g.orig/graphs.php cacti-0.8.7g/graphs.php
+--- cacti-0.8.7g.orig/graphs.php       2010-07-10 00:33:46.000000000 +0200
++++ cacti-0.8.7g/graphs.php    2011-04-14 21:13:55.043000147 +0200
+@@ -1118,7 +1118,7 @@
+       </script>
+       <?php
+ 
+-      html_start_box("<strong>Graph Management</strong>", "100%", $colors["header"], "3", "center", "graphs.php?action=graph_edit&host_id=" . get_request_var_request("host_id"));
++      html_start_box("<strong>Graph Management</strong>", "100%", $colors["header"], "3", "center", "graphs.php?action=graph_edit&host_id=" . htmlspecialchars(get_request_var_request("host_id")));
+ 
+       ?>
+       <tr bgcolor="#<?php print $colors["panel"];?>">
+diff -ur cacti-0.8.7g.orig/graph_templates.php cacti-0.8.7g/graph_templates.php
+--- cacti-0.8.7g.orig/graph_templates.php      2010-07-10 00:33:46.000000000 +0200
++++ cacti-0.8.7g/graph_templates.php   2011-04-14 21:12:45.854000138 +0200
+@@ -302,12 +302,12 @@
+ 
+               $header_label = "[edit: " . db_fetch_cell("select name from graph_templates where id=" . $_GET["id"]) . "]";
+       }
+-
+-      html_start_box("<strong>Graph Template Items</strong> " . htmlspecialchars($header_label), "100%", $colors["header"], "3", "center", "graph_templates_items.php?action=item_edit&graph_template_id=" . $_GET["id"]);
++      
++      html_start_box("<strong>Graph Template Items</strong> " . htmlspecialchars($header_label), "100%", $colors["header"], "3", "center", "graph_templates_items.php?action=item_edit&graph_template_id=" . htmlspecialchars(get_request_var("id")));
+       draw_graph_items_list($template_item_list, "graph_templates_items.php", "graph_template_id=" . $_GET["id"], false);
+       html_end_box();
+ 
+-      html_start_box("<strong>Graph Item Inputs</strong>", "100%", $colors["header"], "3", "center", "graph_templates_inputs.php?action=input_edit&graph_template_id=" . $_GET["id"]);
++      html_start_box("<strong>Graph Item Inputs</strong>", "100%", $colors["header"], "3", "center", "graph_templates_inputs.php?action=input_edit&graph_template_id=" . htmlspecialchars(get_request_var("id")));
+ 
+       print "<tr bgcolor='#" . $colors["header_panel"] . "'>";
+               DrawMatrixHeaderItem("Name",$colors["header_text"],2);
+diff -ur cacti-0.8.7g.orig/host.php cacti-0.8.7g/host.php
+--- cacti-0.8.7g.orig/host.php 2010-07-10 00:33:46.000000000 +0200
++++ cacti-0.8.7g/host.php      2011-04-14 21:07:38.703500166 +0200
+@@ -333,7 +333,7 @@
+       /* add a list of tree names to the actions dropdown */
+       add_tree_names_to_actions_array();
+ 
+-      html_start_box("<strong>" . $device_actions{$_POST["drp_action"]} . "</strong>", "60%", $colors["header_panel"], "3", "center", "");
++      html_start_box("<strong>" . $device_actions[get_request_var_post("drp_action")] . "</strong>", "60%", $colors["header_panel"], "3", "center", "");
+ 
+       print "<form action='host.php' autocomplete='off' method='post'>\n";
+ 
+@@ -1189,7 +1189,7 @@
+       </script>
+       <?php
+ 
+-      html_start_box("<strong>Devices</strong>", "100%", $colors["header"], "3", "center", "host.php?action=edit&host_template_id=" . get_request_var_request("host_template_id") . "&host_status=" . get_request_var_request("host_status"));
++      html_start_box("<strong>Devices</strong>", "100%", $colors["header"], "3", "center", "host.php?action=edit&host_template_id=" . htmlspecialchars(get_request_var_request("host_template_id")) . "&host_status=" . htmlspecialchars(get_request_var_request("host_status")));
+ 
+       ?>
+       <tr bgcolor="#<?php print $colors["panel"];?>">
+diff -ur cacti-0.8.7g.orig/templates_export.php cacti-0.8.7g/templates_export.php
+--- cacti-0.8.7g.orig/templates_export.php     2010-07-10 00:33:46.000000000 +0200
++++ cacti-0.8.7g/templates_export.php  2011-04-14 21:15:29.790000150 +0200
+@@ -93,7 +93,7 @@
+                               <select name="cbo_graph_id" onChange="window.location=document.form_graph_id.cbo_graph_id.options[document.form_graph_id.cbo_graph_id.selectedIndex].value">
+                                       <?php
+                                       while (list($key, $array) = each($export_types)) {
+-                                              print "<option value='templates_export.php?export_type=$key'"; if ($_REQUEST["export_type"] == $key) { print " selected"; } print ">" . $array["name"] . "</option>\n";
++                                              print "<option value='templates_export.php?export_type=" . htmlspecialchars($key) . "'"; if ($_REQUEST["export_type"] == $key) { print " selected"; } print ">" . $array["name"] . "</option>\n";
+                                       }
+                                       ?>
+                               </select>
+diff -ur cacti-0.8.7g.orig/tree.php cacti-0.8.7g/tree.php
+--- cacti-0.8.7g.orig/tree.php 2010-07-10 00:33:46.000000000 +0200
++++ cacti-0.8.7g/tree.php      2011-04-14 21:18:53.174500150 +0200
+@@ -141,7 +141,7 @@
+       /* ==================================================== */
+ 
+       if (!empty($_GET["id"])) {
+-              $tree_item = db_fetch_row("select * from graph_tree_items where id=" . $_GET["id"]);
++              $tree_item = db_fetch_row("select * from graph_tree_items where id=" . get_request_var("id"));
+ 
+               if ($tree_item["local_graph_id"] > 0) { $db_type = TREE_ITEM_TYPE_GRAPH; }
+               if ($tree_item["title"] != "") { $db_type = TREE_ITEM_TYPE_HEADER; }
+@@ -156,7 +156,7 @@
+               $current_type = TREE_ITEM_TYPE_HEADER;
+       }
+ 
+-      $tree_sort_type = db_fetch_cell("select sort_type from graph_tree where id='" . $_GET["tree_id"] . "'");
++      $tree_sort_type = db_fetch_cell("select sort_type from graph_tree where id='" . get_request_var("tree_id") . "'");
+ 
+       print "<form method='post' action='tree.php' name='form_tree'>\n";
+ 
+@@ -429,13 +429,13 @@
+       html_end_box();
+ 
+       if (!empty($_GET["id"])) {
+-              html_start_box("<strong>Tree Items</strong>", "100%", $colors["header"], "3", "center", "tree.php?action=item_edit&tree_id=" . $tree["id"] . "&parent_id=0");
++              html_start_box("<strong>Tree Items</strong>", "100%", $colors["header"], "3", "center", "tree.php?action=item_edit&tree_id=" . htmlspecialchars($tree["id"]) . "&parent_id=0");
+ 
+               ?>
+               <td>
+-              <input type='button' onClick='return document.location="tree.php?action=edit&id=<?php print $_GET["id"];?>&subaction=expand_all"' value='Expand All' title='Expand All Trees'>
+-              <input type='button' onClick='return document.location="tree.php?action=edit&id=<?php print $_GET["id"];?>&subaction=collapse_all"' value='Collapse All' title='Collapse All Trees'></a>
+-              </td>
++              <input type='button' onClick='return document.location="tree.php?action=edit&id=<?php print htmlspecialchars(get_request_var("id"));?>&subaction=expand_all"' value='Expand All' title='Expand All Trees'>
++              <input type='button' onClick='return document.location="tree.php?action=edit&id=<?php print htmlspecialchars(get_request_var("id"));?>&subaction=collapse_all"' value='Collapse All' title='Collapse All Trees'></a>            
++              </td>   
+               <?php
+ 
+               print "<tr bgcolor='#" . $colors["header_panel"] . "'>";