aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/inc/rrdtool.class.php
diff options
context:
space:
mode:
authorPeter Wu2014-07-20 23:30:49 +0200
committerPeter Wu2014-07-20 23:30:49 +0200
commit4a737bc1abdbef7e0698b006704a26583a4c61df (patch)
tree7d5f51f76acd43d1aeda601dd7201e2c158bdae4 /inc/rrdtool.class.php
parentsecurity: Add missing input validation for plugin (diff)
downloadapt-panopticon_cgp-4a737bc1abdbef7e0698b006704a26583a4c61df.zip
apt-panopticon_cgp-4a737bc1abdbef7e0698b006704a26583a4c61df.tar.gz
apt-panopticon_cgp-4a737bc1abdbef7e0698b006704a26583a4c61df.tar.bz2
apt-panopticon_cgp-4a737bc1abdbef7e0698b006704a26583a4c61df.tar.xz
Use a more secure command line building method
Previously, a command is built by string concatenation. Here, the distinction between a value and multiple params got lost. Solve this by using an array for shell arguments. As the escaping is now removed from the `rrd_gen_graph` function, the canvas style needs to manually add those quotes to make the JS code still work. That only supports double-quotes, so hopefully nobody creates a name with a double quote as that would break the fragile JS command line parser. Separate the rrdtool options from the rrdtool graph command to make the `$graph_type == 'canvas'` option work (it would otherwise not understand the `rrdtool graph - -a PNG` option). Merge the SVG and PNG cases as they are the same except for the Content-Type header. Fix a missing html escape in a debug style.
Diffstat (limited to 'inc/rrdtool.class.php')
0 files changed, 0 insertions, 0 deletions