diff options
author | Peter Wu | 2014-07-20 23:30:49 +0200 |
---|---|---|
committer | Peter Wu | 2014-07-20 23:30:49 +0200 |
commit | 4a737bc1abdbef7e0698b006704a26583a4c61df (patch) | |
tree | 7d5f51f76acd43d1aeda601dd7201e2c158bdae4 /inc/rrdtool.class.php | |
parent | security: Add missing input validation for plugin (diff) | |
download | apt-panopticon_cgp-4a737bc1abdbef7e0698b006704a26583a4c61df.zip apt-panopticon_cgp-4a737bc1abdbef7e0698b006704a26583a4c61df.tar.gz apt-panopticon_cgp-4a737bc1abdbef7e0698b006704a26583a4c61df.tar.bz2 apt-panopticon_cgp-4a737bc1abdbef7e0698b006704a26583a4c61df.tar.xz |
Use a more secure command line building method
Previously, a command is built by string concatenation. Here, the
distinction between a value and multiple params got lost. Solve this
by using an array for shell arguments. As the escaping is now removed
from the `rrd_gen_graph` function, the canvas style needs to manually
add those quotes to make the JS code still work. That only supports
double-quotes, so hopefully nobody creates a name with a double quote
as that would break the fragile JS command line parser.
Separate the rrdtool options from the rrdtool graph command to make the
`$graph_type == 'canvas'` option work (it would otherwise not understand
the `rrdtool graph - -a PNG` option).
Merge the SVG and PNG cases as they are the same except for the
Content-Type header.
Fix a missing html escape in a debug style.
Diffstat (limited to 'inc/rrdtool.class.php')
0 files changed, 0 insertions, 0 deletions