aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/type/Default.class.php
diff options
context:
space:
mode:
authorPeter Wu2014-07-20 23:30:49 +0200
committerPeter Wu2014-07-20 23:30:49 +0200
commit4a737bc1abdbef7e0698b006704a26583a4c61df (patch)
tree7d5f51f76acd43d1aeda601dd7201e2c158bdae4 /type/Default.class.php
parentsecurity: Add missing input validation for plugin (diff)
downloadapt-panopticon_cgp-4a737bc1abdbef7e0698b006704a26583a4c61df.zip
apt-panopticon_cgp-4a737bc1abdbef7e0698b006704a26583a4c61df.tar.gz
apt-panopticon_cgp-4a737bc1abdbef7e0698b006704a26583a4c61df.tar.bz2
apt-panopticon_cgp-4a737bc1abdbef7e0698b006704a26583a4c61df.tar.xz
Use a more secure command line building method
Previously, a command is built by string concatenation. Here, the distinction between a value and multiple params got lost. Solve this by using an array for shell arguments. As the escaping is now removed from the `rrd_gen_graph` function, the canvas style needs to manually add those quotes to make the JS code still work. That only supports double-quotes, so hopefully nobody creates a name with a double quote as that would break the fragile JS command line parser. Separate the rrdtool options from the rrdtool graph command to make the `$graph_type == 'canvas'` option work (it would otherwise not understand the `rrdtool graph - -a PNG` option). Merge the SVG and PNG cases as they are the same except for the Content-Type header. Fix a missing html escape in a debug style.
Diffstat (limited to 'type/Default.class.php')
-rw-r--r--type/Default.class.php10
1 files changed, 5 insertions, 5 deletions
diff --git a/type/Default.class.php b/type/Default.class.php
index 6e7efd9..4cb9ff7 100644
--- a/type/Default.class.php
+++ b/type/Default.class.php
@@ -48,11 +48,11 @@ class Type_Default extends Type_Base {
48 foreach ($sources as $source) { 48 foreach ($sources as $source) {
49 $legend = empty($this->legend[$source]) ? $source : $this->legend[$source]; 49 $legend = empty($this->legend[$source]) ? $source : $this->legend[$source];
50 $color = is_array($this->colors) ? (isset($this->colors[$source])?$this->colors[$source]:$this->colors[$c++]): $this->colors; 50 $color = is_array($this->colors) ? (isset($this->colors[$source])?$this->colors[$source]:$this->colors[$c++]): $this->colors;
51 $rrdgraph[] = sprintf('"LINE1:avg_%s#%s:%s"', crc32hex($source), $this->validate_color($color), $this->rrd_escape($legend)); 51 $rrdgraph[] = sprintf('LINE1:avg_%s#%s:%s', crc32hex($source), $this->validate_color($color), $this->rrd_escape($legend));
52 $rrdgraph[] = sprintf('"GPRINT:min_%s:MIN:%s Min,"', crc32hex($source), $this->rrd_format); 52 $rrdgraph[] = sprintf('GPRINT:min_%s:MIN:%s Min,', crc32hex($source), $this->rrd_format);
53 $rrdgraph[] = sprintf('"GPRINT:avg_%s:AVERAGE:%s Avg,"', crc32hex($source), $this->rrd_format); 53 $rrdgraph[] = sprintf('GPRINT:avg_%s:AVERAGE:%s Avg,', crc32hex($source), $this->rrd_format);
54 $rrdgraph[] = sprintf('"GPRINT:max_%s:MAX:%s Max,"', crc32hex($source), $this->rrd_format); 54 $rrdgraph[] = sprintf('GPRINT:max_%s:MAX:%s Max,', crc32hex($source), $this->rrd_format);
55 $rrdgraph[] = sprintf('"GPRINT:avg_%s:LAST:%s Last\\l"', crc32hex($source), $this->rrd_format); 55 $rrdgraph[] = sprintf('GPRINT:avg_%s:LAST:%s Last\\l', crc32hex($source), $this->rrd_format);
56 } 56 }
57 57
58 return $rrdgraph; 58 return $rrdgraph;