better validation of possible user input (get)

3 files changed, 37 insertions, 5 deletions

diff --git a/inc/collectd.inc.php b/inc/collectd.inc.php
index 2a44fba..ab4340f 100644
--- a/inc/collectd.inc.php
+++ b/inc/collectd.inc.php
@@ -1,5 +1,7 @@
 <?php
 
+# collectd related functions
+
 require_once 'conf/common.inc.php';
 
 # returns an array of all collectd hosts
diff --git a/inc/functions.inc.php b/inc/functions.inc.php
new file mode 100644
index 0000000..2906530
--- /dev/null
+++ b/inc/functions.inc.php
@@ -0,0 +1,27 @@
+<?php
+
+# global functions
+
+function validate_get($value, $type) {
+        switch($type) {
+                case 'host':
+                        if (!preg_match('/^[\d\w\W]+$/', $value))
+                                return NULL;
+                break;
+                case 'plugin':
+                case 'type':
+                        if (!preg_match('/^\w+$/', $value))
+                                return NULL;
+                break;
+                case 'pinstance':
+                case 'tinstance':
+                        if (!preg_match('/^[\d\w-]+$/', $value))
+                                return NULL;
+                break;
+        }
+
+        return $value;
+}
+
+
+?>
diff --git a/inc/html.inc.php b/inc/html.inc.php
index e93cc66..e38ca8e 100644
--- a/inc/html.inc.php
+++ b/inc/html.inc.php
@@ -1,7 +1,10 @@
 <?php
 
+# html related functions
+
 require_once 'conf/common.inc.php';
 require_once 'inc/rrdtool.class.php';
+require_once 'inc/functions.inc.php';
 require_once 'inc/collectd.inc.php';
 
 function html_start() {
@@ -78,15 +81,15 @@ function host_summary($hosts) {
 
 
 function breadcrumbs() {
-        if (isset($_GET['h']))
+        if (validate_get($_GET['h'], 'host'))
                 $path = ' - '.ucfirst($_GET['h']);
-        if (isset($_GET['p']))
+        if (validate_get($_GET['p'], 'plugin'))
                 $path .= ' - '.ucfirst($_GET['p']);
-        if (isset($_GET['pi']))
+        if (validate_get($_GET['pi'], 'pinstance'))
                 $path .= ' - '.$_GET['pi'];
-        if (isset($_GET['t']) && isset($_GET['p']) && $_GET['t'] != $_GET['p'])
+        if (validate_get($_GET['t'], 'type') && validate_get($_GET['p'], 'plugin') && $_GET['t'] != $_GET['p'])
                 $path .= ' - '.$_GET['t'];
-        if (isset($_GET['ti']))
+        if (validate_get($_GET['ti'], 'tinstance'))
                 $path .= ' - '.$_GET['ti'];
 
         return $path;