Repository navigation
security: require POST for state changes and escape map data in the web pages - #352
Open
somethingwithproof wants to merge 1 commit into
Open
somethingwithproof wants to merge 1 commit into
somethingwithproof wants to merge 1 commit into
Conversation
…eb pages Management and editor actions that change state are refused unless they are POSTed with the CSRF token, and map data is escaped where it reaches page markup. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Further security hardening for Weathermap, following #348.
The management and editor actions that change maps, groups, settings or permissions now answer 405 unless they arrive by POST, so Cacti's CSRF check covers them. The management links for those actions post through a small capture-phase handler, which also works on Cacti 1.2.29 where core has no POST link helper, and the editor start page forms now carry the token.
Hover graph URLs, the editor's inline script data, the add-map picker links, map setting values and the page title are escaped, and hover graphs with a script scheme are dropped. New maps and their source maps stay inside
configs/, output-file directives can no longer take the names the poller and the graph tree use, and the tree view prints the generated HTML instead of including it. Lines of an INCLUDE file are no longer copied into the log, and a format string with a huge or value-supplied width is printed literally.Tested on Cacti 1.2.32 with PHP 8.5 in Docker. The Pest suite passes apart from the two
DocumentationExampleHoverTestfailures that also fail on develop, patch coverage is 100%, and the manifest and POT checks pass. On the live instance, GET requests for these actions return 405, a tokenless POST changes nothing, and clicking activate and deactivate, group rename, Rebuild All, creating a map from the editor start page, and adding a node in the editor all still work.The CHANGELOG entry for #351 is included here so the two open PRs do not conflict.
Corresponding details are tracked privately through the project's security advisory process.