diff options
-rw-r--r-- | ChangeLog | 1 | ||||
-rw-r--r-- | frontends/php/bulkloader.php | 2 | ||||
-rw-r--r-- | frontends/php/include/actions.inc.php | 4 | ||||
-rw-r--r-- | frontends/php/include/bulkloader.inc.php | 4 | ||||
-rw-r--r-- | frontends/php/include/config.inc.php | 57 | ||||
-rw-r--r-- | frontends/php/include/graphs.inc.php | 26 | ||||
-rw-r--r-- | frontends/php/include/hosts.inc.php | 8 | ||||
-rw-r--r-- | frontends/php/include/items.inc.php | 20 | ||||
-rw-r--r-- | frontends/php/include/maps.inc.php | 14 | ||||
-rw-r--r-- | frontends/php/include/profiles.inc.php | 4 | ||||
-rw-r--r-- | frontends/php/include/screens.inc.php | 4 | ||||
-rw-r--r-- | frontends/php/include/services.inc.php | 6 | ||||
-rw-r--r-- | frontends/php/include/triggers.inc.php | 29 | ||||
-rw-r--r-- | frontends/php/include/users.inc.php | 24 | ||||
-rw-r--r-- | frontends/php/index.php | 6 | ||||
-rw-r--r-- | frontends/php/latest.php | 2 | ||||
-rw-r--r-- | frontends/php/map.php | 4 | ||||
-rw-r--r-- | frontends/php/overview.php | 6 |
18 files changed, 110 insertions, 111 deletions
@@ -1,5 +1,6 @@ Changes for 1.1beta6: + - GUI made immune to SQL injection attacks (Alexei) - added Check All functionality (Eugene) - added support of icon label locations (Alexei) - added new column sysmaps.label_location (Alexei) diff --git a/frontends/php/bulkloader.php b/frontends/php/bulkloader.php index bc0334bb..c5f35408 100644 --- a/frontends/php/bulkloader.php +++ b/frontends/php/bulkloader.php @@ -84,7 +84,7 @@ } // Determine which template, if any this host is linked to - $sql="select distinct(hostid) from hosts where status<>". HOST_STATUS_DELETED ." and host='$tmpHostTemplate'"; + $sql="select distinct(hostid) from hosts where status<>". HOST_STATUS_DELETED ." and host='".zbx_ads($tmpHostTemplate)."'"; $sqlResult=DBselect($sql); if(DBnum_rows($sqlResult)==1) { diff --git a/frontends/php/include/actions.inc.php b/frontends/php/include/actions.inc.php index 9e443b6f..c88c7a65 100644 --- a/frontends/php/include/actions.inc.php +++ b/frontends/php/include/actions.inc.php @@ -44,7 +44,7 @@ // return 0; // } - $sql="insert into actions (userid,delay,nextcheck,subject,message,recipient,maxrepeats,repeatdelay) values ($id,$delay,0,'$subject','$message',$recipient,$maxrepeats,$repeatdelay)"; + $sql="insert into actions (userid,delay,nextcheck,subject,message,recipient,maxrepeats,repeatdelay) values ($id,$delay,0,'".zbx_ads($subject)."','".zbx_ads($message)."',$recipient,$maxrepeats,$repeatdelay)"; $result=DBexecute($sql); return DBinsert_id($result,"actions","actionid"); } @@ -59,7 +59,7 @@ // return 0; // } - $sql="update actions set userid=$id,delay=$delay,nextcheck=0,subject='$subject',message='$message',recipient=$recipient,maxrepeats=$maxrepeats, repeatdelay=$repeatdelay where actionid=$actionid"; + $sql="update actions set userid=$id,delay=$delay,nextcheck=0,subject='".zbx_ads($subject)."',message='".zbx_ads($message)."',recipient=$recipient,maxrepeats=$maxrepeats, repeatdelay=$repeatdelay where actionid=$actionid"; $result=DBexecute($sql); return $result; } diff --git a/frontends/php/include/bulkloader.inc.php b/frontends/php/include/bulkloader.inc.php index c03be61b..7ef22239 100644 --- a/frontends/php/include/bulkloader.inc.php +++ b/frontends/php/include/bulkloader.inc.php @@ -28,14 +28,14 @@ include_once "include/config.inc.php"; // Returns: 0 if unable to create, otherwise it returns the groupID function create_Host_Group($group) { - $result=DBselect("select distinct(groupid) from groups where name='$group'"); + $result=DBselect("select distinct(groupid) from groups where name='".zbx_ads($group)."'"); if(DBnum_rows($result)>0) { $row=DBfetch($result); return $row["groupid"]; } - $result=DBexecute("insert into groups (name) values ('$group')"); + $result=DBexecute("insert into groups (name) values ('".zbx_ads($group)."')"); if($result) { return DBinsert_id($result,"groups","name"); diff --git a/frontends/php/include/config.inc.php b/frontends/php/include/config.inc.php index db004fbf..f1be42c9 100644 --- a/frontends/php/include/config.inc.php +++ b/frontends/php/include/config.inc.php @@ -332,7 +332,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! } # default_permission - $sql="select permission from rights where name='$right' and id!=0 and userid=".$USER_DETAILS["userid"]; + $sql="select permission from rights where name='".zbx_ads($right)."' and id!=0 and userid=".$USER_DETAILS["userid"]; $result=DBselect($sql); $all_permissions=""; @@ -422,7 +422,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! } # default_permission - $sql="select permission from rights where name='$right' and id=0 and userid=".$USER_DETAILS["userid"]; + $sql="select permission from rights where name='".zbx_ads($right)."' and id=0 and userid=".$USER_DETAILS["userid"]; $result=DBselect($sql); $group_permission=""; @@ -438,7 +438,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! $id_permission=""; if($id!=0) { - $sql="select permission from rights where name='$right' and id=$id and userid=".$USER_DETAILS["userid"]; + $sql="select permission from rights where name='".zbx_ads($right)."' and id=$id and userid=".$USER_DETAILS["userid"]; $result=DBselect($sql); if(DBnum_rows($result)>0) { @@ -655,7 +655,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! function get_image_by_name($imagetype,$name) { - $sql="select * from images where imagetype=$imagetype and name='$name'"; + $sql="select * from images where imagetype=$imagetype and name='".zbx_ads($name)."'"; $result=DBselect($sql); if(DBnum_rows($result) == 1) { @@ -797,7 +797,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! // echo $function,"<br>"; // echo $parameter,"<br>"; - $sql="select count(*) as cnt from hosts h,items i where h.host='$host' and i.key_='$key' and h.hostid=i.hostid"; + $sql="select count(*) as cnt from hosts h,items i where h.host='".zbx_ads($host)."' and i.key_='".zbx_ads($key)."' and h.hostid=i.hostid"; $result=DBselect($sql); $row=DBfetch($result); if($row["cnt"]!=1) @@ -973,13 +973,13 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! if(isset($sessionid)) { - $sql="select u.userid,u.alias,u.name,u.surname,u.lang,u.refresh from sessions s,users u where s.sessionid='$sessionid' and s.userid=u.userid and ((s.lastaccess+u.autologout>".time().") or (u.autologout=0))"; + $sql="select u.userid,u.alias,u.name,u.surname,u.lang,u.refresh from sessions s,users u where s.sessionid='".zbx_ads($sessionid)."' and s.userid=u.userid and ((s.lastaccess+u.autologout>".time().") or (u.autologout=0))"; $result=DBselect($sql); if(DBnum_rows($result)==1) { // setcookie("sessionid",$sessionid,time()+3600); setcookie("sessionid",$sessionid); - $sql="update sessions set lastaccess=".time()." where sessionid='$sessionid'"; + $sql="update sessions set lastaccess=".time()." where sessionid='".zbx_ads($sessionid)."'"; DBexecute($sql); $USER_DETAILS=DBfetch($result); return; @@ -1384,7 +1384,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! // echo "PARAMETER:$parameter<BR>"; $state=''; - $sql="select i.itemid from items i,hosts h where i.key_='$key' and h.host='$host' and h.hostid=i.hostid"; + $sql="select i.itemid from items i,hosts h where i.key_='".zbx_ads($key)."' and h.host='".zbx_ads($host)."' and h.hostid=i.hostid"; # echo $sql,"<Br>"; $res=DBselect($sql); $row=DBfetch($res); @@ -1392,7 +1392,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! $itemid=$row["itemid"]; # echo "ITEMID:$itemid<BR>"; - $sql="insert into functions (itemid,triggerid,function,parameter) values ($itemid,$triggerid,'$function','$parameter')"; + $sql="insert into functions (itemid,triggerid,function,parameter) values ($itemid,$triggerid,'".zbx_ads($function)."','".zbx_ads($parameter)."')"; # echo $sql,"<Br>"; $res=DBexecute($sql); if(!$res) @@ -1475,8 +1475,8 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! if($files["image"]["error"]==0) if($files["image"]["size"]<1024*1024) { - $image=zbx_ads(fread(fopen($files["image"]["tmp_name"],"r"),filesize($files["image"]["tmp_name"]))); - $sql="insert into images (name,imagetype,image) values ('$name',$imagetype,'$image')"; + $image=fread(fopen($files["image"]["tmp_name"],"r"),filesize($files["image"]["tmp_name"])); + $sql="insert into images (name,imagetype,image) values ('".zbx_ads($name)."',$imagetype,'".zbx_ads($image)."')"; return DBexecute($sql); } else @@ -1499,8 +1499,8 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! if($files["image"]["error"]==0) if($files["image"]["size"]<1024*1024) { - $image=zbx_ads(fread(fopen($files["image"]["tmp_name"],"r"),filesize($files["image"]["tmp_name"]))); - $sql="update images set name='$name',imagetype='$imagetype',image='$image' where imageid='$imageid'"; + $image=fread(fopen($files["image"]["tmp_name"],"r"),filesize($files["image"]["tmp_name"])); + $sql="update images set name='".zbx_ads($name)."',imagetype='".zbx_ads($imagetype)."',image='".zbx_ads($image)."' where imageid=$imageid"; return DBexecute($sql); } else @@ -1616,7 +1616,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! function add_group_to_host($hostid,$newgroup) { - $sql="insert into groups (groupid,name) values (NULL,'$newgroup')"; + $sql="insert into groups (groupid,name) values (NULL,'".zbx_ads($newgroup)."')"; $result=DBexecute($sql); if(!$result) { @@ -1667,7 +1667,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! // return 0; // } - $sql="select * from groups where name='$name'"; + $sql="select * from groups where name='".zbx_ads($name)."'"; $result=DBexecute($sql); if(DBnum_rows($result)>0) { @@ -1675,7 +1675,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! return 0; } - $sql="insert into groups (name) values ('$name')"; + $sql="insert into groups (name) values ('".zbx_ads($name)."')"; $result=DBexecute($sql); if(!$result) { @@ -1697,7 +1697,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! // return 0; // } - $sql="select * from groups where name='$name' and groupid<>$groupid"; + $sql="select * from groups where name='".zbx_ads($name)."' and groupid<>$groupid"; $result=DBexecute($sql); if(DBnum_rows($result)>0) { @@ -1705,7 +1705,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! return 0; } - $sql="update groups set name='$name' where groupid=$groupid"; + $sql="update groups set name='".zbx_ads($name)."' where groupid=$groupid"; $result=DBexecute($sql); if(!$result) { @@ -1814,7 +1814,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! { $ret = 0; - $sql="select * from media_type where description='".zbx_ads($description)."' and mediatypeid!=".zbx_ads($mediatypeid); + $sql="select * from media_type where description='".zbx_ads($description)."' and mediatypeid!=$mediatypeid"; $result=DBexecute($sql); if(DBnum_rows($result)>0) { @@ -1822,7 +1822,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! } else { - $sql="update media_type set type=".zbx_ads($type).",description='".zbx_ads($description)."',smtp_server='".zbx_ads($smtp_server)."',smtp_helo='".zbx_ads($smtp_helo)."',smtp_email='".zbx_ads($smtp_email)."',exec_path='".zbx_ads($exec_path)."' where mediatypeid=".zbx_ads($mediatypeid); + $sql="update media_type set type=$type,description='".zbx_ads($description)."',smtp_server='".zbx_ads($smtp_server)."',smtp_helo='".zbx_ads($smtp_helo)."',smtp_email='".zbx_ads($smtp_email)."',exec_path='".zbx_ads($exec_path)."' where mediatypeid=$mediatypeid"; $ret = DBexecute($sql); } return $ret; @@ -1839,8 +1839,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! return 0; } - $description=zbx_ads($description); - $sql="select * from media_type where description='$description'"; + $sql="select * from media_type where description='".zbx_ads($description)."'"; $result=DBexecute($sql); if(DBnum_rows($result)>0) { @@ -1848,7 +1847,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! } else { - $sql="insert into media_type (type,description,smtp_server,smtp_helo,smtp_email,exec_path) values ($type,'$description','$smtp_server','$smtp_helo','$smtp_email','$exec_path')"; + $sql="insert into media_type (type,description,smtp_server,smtp_helo,smtp_email,exec_path) values ($type,'".zbx_ads($description)."','".zbx_ads($smtp_server)."','".zbx_ads($smtp_helo)."','".zbx_ads($smtp_email)."','".zbx_ads($exec_path)."')"; $ret = DBexecute($sql); } return $ret; @@ -1864,7 +1863,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! { $s=$s|pow(2,(int)$severity[$i]); } - $sql="insert into media (userid,mediatypeid,sendto,active,severity,period) values ($userid,'$mediatypeid','$sendto',$active,$s,'$period')"; + $sql="insert into media (userid,mediatypeid,sendto,active,severity,period) values ($userid,'".zbx_ads($mediatypeid)."','".zbx_ads($sendto)."',$active,$s,'".zbx_ads($period)."')"; return DBexecute($sql); } @@ -1878,7 +1877,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! { $s=$s|pow(2,(int)$severity[$i]); } - $sql="update media set userid=$userid, mediatypeid=$mediatypeid, sendto='$sendto', active=$active,severity=$s,period='$period' where mediaid=$mediaid"; + $sql="update media set userid=$userid, mediatypeid=$mediatypeid, sendto='".zbx_ads($sendto)."', active=$active,severity=$s,period='".zbx_ads($period)."' where mediaid=$mediaid"; return DBexecute($sql); } @@ -2787,7 +2786,7 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! return $default_value; } - $sql="select value from profiles where userid=".$USER_DETAILS["userid"]." and idx='$idx'"; + $sql="select value from profiles where userid=".$USER_DETAILS["userid"]." and idx='".zbx_ads($idx)."'"; $result=DBselect($sql); if(DBnum_rows($result)==0) @@ -2810,18 +2809,18 @@ function SDI($msg) { echo "DEBUG INFO: $msg ".BR; } # DEBUG INFO!!! return; } - $sql="select value from profiles where userid=".$USER_DETAILS["userid"]." and idx='$idx'"; + $sql="select value from profiles where userid=".$USER_DETAILS["userid"]." and idx='".zbx_ads($idx)."'"; $result=DBselect($sql); if(DBnum_rows($result)==0) { - $sql="insert into profiles (userid,idx,value) values (".$USER_DETAILS["userid"].",'$idx','$value')"; + $sql="insert into profiles (userid,idx,value) values (".$USER_DETAILS["userid"].",'".zbx_ads($idx)."','".zbx_ads($value)."')"; DBexecute($sql); } else { $row=DBfetch($result); - $sql="update profiles set value='$value' where userid=".$USER_DETAILS["userid"]." and idx='$idx'"; + $sql="update profiles set value='".zbx_ads($value)."' where userid=".$USER_DETAILS["userid"]." and idx='".zbx_ads($idx)."'"; DBexecute($sql); } } diff --git a/frontends/php/include/graphs.inc.php b/frontends/php/include/graphs.inc.php index a06d80c0..f60a8838 100644 --- a/frontends/php/include/graphs.inc.php +++ b/frontends/php/include/graphs.inc.php @@ -74,7 +74,7 @@ return 0; } - $sql="insert into graphs (name,width,height,yaxistype,yaxismin,yaxismax) values ('$name',$width,$height,$yaxistype,$yaxismin,$yaxismax)"; + $sql="insert into graphs (name,width,height,yaxistype,yaxismin,yaxismax) values ('".zbx_ads($name)."',$width,$height,$yaxistype,$yaxismin,$yaxismax)"; $result=DBexecute($sql); return DBinsert_id($result,"graphs","graphid"); } @@ -88,7 +88,7 @@ error("Insufficient permissions"); return 0; } - $sql="update graphs set name='$name',width=$width,height=$height,yaxistype=$yaxistype,yaxismin=$yaxismin,yaxismax=$yaxismax where graphid=$graphid"; + $sql="update graphs set name='".zbx_ads($name)."',width=$width,height=$height,yaxistype=$yaxistype,yaxismin=$yaxismin,yaxismax=$yaxismax where graphid=$graphid"; return DBexecute($sql); } @@ -162,14 +162,14 @@ function add_item_to_graph($graphid,$itemid,$color,$drawtype,$sortorder,$yaxisside) { - $sql="insert into graphs_items (graphid,itemid,color,drawtype,sortorder,yaxisside) values ($graphid,$itemid,'$color',$drawtype,$sortorder,$yaxisside)"; + $sql="insert into graphs_items (graphid,itemid,color,drawtype,sortorder,yaxisside) values ($graphid,$itemid,'".zbx_ads($color)."',$drawtype,$sortorder,$yaxisside)"; $result=DBexecute($sql); return DBinsert_id($result,"graphs_items","gitemid"); } function update_graph_item($gitemid,$itemid,$color,$drawtype,$sortorder,$yaxisside) { - $sql="update graphs_items set itemid=$itemid,color='$color',drawtype=$drawtype,sortorder=$sortorder,yaxisside=$yaxisside where gitemid=$gitemid"; + $sql="update graphs_items set itemid=$itemid,color='".zbx_ads($color)."',drawtype=$drawtype,sortorder=$sortorder,yaxisside=$yaxisside where gitemid=$gitemid"; return DBexecute($sql); } @@ -254,7 +254,7 @@ { if($host["graphs"]&2 == 0) continue; - $sql="select i.itemid from items i where i.key_='".$template_item["key_"]."' and i.hostid=".$host["hostid"]; + $sql="select i.itemid from items i where i.key_='".zbx_ads($template_item["key_"])."' and i.hostid=".$host["hostid"]; $items=DBselect($sql); if(DBnum_rows($items)==0) continue; $item=DBfetch($items); @@ -306,12 +306,12 @@ { if($row["graphs"]&2 == 0) continue; - $sql="select i.itemid from items i where i.key_='".$item["key_"]."' and i.hostid=".$row["hostid"]; + $sql="select i.itemid from items i where i.key_='".zbx_ads($item["key_"])."' and i.hostid=".$row["hostid"]; $result2=DBselect($sql); if(DBnum_rows($result2)==0) continue; $row2=DBfetch($result2); - $sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".$graph_item["color"]."' and gi.yaxisside= ".$graph_item["yaxisside"]; + $sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".zbx_ads($graph_item["color"])."' and gi.yaxisside= ".$graph_item["yaxisside"]; $result3=DBselect($sql); if(DBnum_rows($result3)==0) continue; $row3=DBfetch($result3); @@ -339,12 +339,12 @@ { if($row["graphs"]&2 == 0) continue; - $sql="select i.itemid from items i where i.key_='".$item["key_"]."' and i.hostid=".$row["hostid"]; + $sql="select i.itemid from items i where i.key_='".zbx_ads($item["key_"])."' and i.hostid=".$row["hostid"]; $result2=DBselect($sql); if(DBnum_rows($result2)==0) continue; $row2=DBfetch($result2); - $sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".$graph_item["color"]."' and gi.yaxisside= ".$graph_item["yaxisside"]; + $sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".zbx_ads($graph_item["color"])."' and gi.yaxisside= ".$graph_item["yaxisside"]; $result3=DBselect($sql); if(DBnum_rows($result3)==0) continue; $row3=DBfetch($result3); @@ -373,12 +373,12 @@ { if($row["graphs"]&2 == 0) continue; - $sql="select i.itemid from items i where i.key_='".$item["key_"]."' and i.hostid=".$row["hostid"]; + $sql="select i.itemid from items i where i.key_='".zbx_ads($item["key_"])."' and i.hostid=".$row["hostid"]; $result2=DBselect($sql); if(DBnum_rows($result2)==0) continue; $row2=DBfetch($result2); - $sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".$graph_item["color"]."' and gi.yaxisside= ".$graph_item["yaxisside"]; + $sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".zbx_ads($graph_item["color"])."' and gi.yaxisside= ".$graph_item["yaxisside"]; $result3=DBselect($sql); if(DBnum_rows($result3)==0) continue; $row3=DBfetch($result3); @@ -409,13 +409,13 @@ { if($row["graphs"]&2 == 0) continue; - $sql="select i.itemid from items i where i.key_='".$item["key_"]."' and i.hostid=".$row["hostid"]; + $sql="select i.itemid from items i where i.key_='".zbx_ads($item["key_"])."' and i.hostid=".$row["hostid"]; $result2=DBselect($sql); if(DBnum_rows($result2)==0) continue; $row2=DBfetch($result2); $itemid=$row2["itemid"]; - $sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".$graph_item["color"]."' and gi.yaxisside= ".$graph_item["yaxisside"]; + $sql="select distinct gi.gitemid,gi.graphid from graphs_items gi,items i where i.itemid=gi.itemid and i.hostid=".$row["hostid"]." and i.itemid=".$row2["itemid"]." and gi.drawtype=".$graph_item["drawtype"]." and gi.sortorder=".$graph_item["sortorder"]." and gi.color='".zbx_ads($graph_item["color"])."' and gi.yaxisside= ".$graph_item["yaxisside"]; $result3=DBselect($sql); if(DBnum_rows($result3)==0) continue; $row3=DBfetch($result3); diff --git a/frontends/php/include/hosts.inc.php b/frontends/php/include/hosts.inc.php index e24a4c1e..c1223984 100644 --- a/frontends/php/include/hosts.inc.php +++ b/frontends/php/include/hosts.inc.php @@ -35,7 +35,7 @@ return 0; } - $sql="select * from hosts where host='$host'"; + $sql="select * from hosts where host='".zbx_ads($host)."'"; $result=DBexecute($sql); if(DBnum_rows($result)>0) { @@ -52,7 +52,7 @@ $useip=0; } - $sql="insert into hosts (host,port,status,useip,ip,disable_until,available) values ('$host',$port,$status,$useip,'$ip',0,".HOST_AVAILABLE_UNKNOWN.")"; + $sql="insert into hosts (host,port,status,useip,ip,disable_until,available) values ('".zbx_ads($host)."',$port,$status,$useip,'".zbx_ads($ip)."',0,".HOST_AVAILABLE_UNKNOWN.")"; $result=DBexecute($sql); if(!$result) { @@ -94,7 +94,7 @@ return 0; } - $sql="select * from hosts where host='$host' and hostid<>$hostid"; + $sql="select * from hosts where host='".zbx_ads($host)."' and hostid<>$hostid"; $result=DBexecute($sql); if(DBnum_rows($result)>0) { @@ -112,7 +112,7 @@ $useip=0; } - $sql="update hosts set host='$host',port=$port,useip=$useip,ip='$ip' where hostid=$hostid"; + $sql="update hosts set host='".zbx_ads($host)."',port=$port,useip=$useip,ip='".zbx_ads($ip)."' where hostid=$hostid"; $result=DBexecute($sql); diff --git a/frontends/php/include/items.inc.php b/frontends/php/include/items.inc.php index 56e1c5e3..e8910e3b 100644 --- a/frontends/php/include/items.inc.php +++ b/frontends/php/include/items.inc.php @@ -23,7 +23,7 @@ function update_item_in_group($groupid,$itemid,$description,$key,$hostid,$delay,$history,$status,$type,$snmp_community,$snmp_oid,$value_type,$trapper_hosts,$snmp_port,$units,$multiplier,$delta,$snmpv3_securityname,$snmpv3_securitylevel,$snmpv3_authpassphrase,$snmpv3_privpassphrase,$formula,$trends,$logtimefmt) { - $sql="select i.itemid,i.hostid from hosts_groups hg,items i where hg.groupid=$groupid and i.key_=\"$key\" and hg.hostid=i.hostid"; + $sql="select i.itemid,i.hostid from hosts_groups hg,items i where hg.groupid=$groupid and i.key_='".zbx_ads($key)."' and hg.hostid=i.hostid"; $result=DBexecute($sql); while($row=DBfetch($result)) { @@ -47,7 +47,7 @@ return 0; } - $sql="select i.itemid from hosts_groups hg,items i where hg.groupid=$groupid and i.key_=\"".$item["key_"]."\" and hg.hostid=i.hostid"; + $sql="select i.itemid from hosts_groups hg,items i where hg.groupid=$groupid and i.key_='".zbx_ads($item["key_"])."' and hg.hostid=i.hostid"; $result=DBexecute($sql); while($row=DBfetch($result)) { @@ -81,7 +81,7 @@ $host=get_host_by_hostid($hostid); - $sql="select count(*) as cnt from items where hostid=$hostid and key_='$key'"; + $sql="select count(*) as cnt from items where hostid=$hostid and key_='".zbx_ads($key)."'"; $result=DBexecute($sql); $row = DBfetch($result); if($row["cnt"]>0) @@ -107,7 +107,7 @@ $delta=0; } - $sql="insert into items (description,key_,hostid,delay,history,nextcheck,status,type,snmp_community,snmp_oid,value_type,trapper_hosts,snmp_port,units,multiplier,delta,snmpv3_securityname,snmpv3_securitylevel,snmpv3_authpassphrase,snmpv3_privpassphrase,formula,trends,logtimefmt) values ('".zbx_ads($description)."','".zbx_ads($key)."',".zbx_ads($hostid).",".zbx_ads($delay).",".zbx_ads($history).",0,".zbx_ads($status).",".zbx_ads($type).",'".zbx_ads($snmp_community)."','".zbx_ads($snmp_oid)."',".zbx_ads($value_type).",'".zbx_ads($trapper_hosts)."',".zbx_ads($snmp_port).",'".zbx_ads($units)."',".zbx_ads($multiplier).",".zbx_ads($delta).",'".zbx_ads($snmpv3_securityname)."',".zbx_ads($snmpv3_securitylevel).",'".zbx_ads($snmpv3_authpassphrase)."','".zbx_ads($snmpv3_privpassphrase)."','".zbx_ads($formula)."',".zbx_ads($trends).",'".zbx_ads($logtimefmt)."')"; + $sql="insert into items (description,key_,hostid,delay,history,nextcheck,status,type,snmp_community,snmp_oid,value_type,trapper_hosts,snmp_port,units,multiplier,delta,snmpv3_securityname,snmpv3_securitylevel,snmpv3_authpassphrase,snmpv3_privpassphrase,formula,trends,logtimefmt) values ('".zbx_ads($description)."','".zbx_ads($key)."',$hostid,$delay,$history,0,$status,$type,'".zbx_ads($snmp_community)."','".zbx_ads($snmp_oid)."',$value_type,'".zbx_ads($trapper_hosts)."',".zbx_ads($snmp_port).",'".zbx_ads($units)."',$multiplier,$delta,'".zbx_ads($snmpv3_securityname)."',".zbx_ads($snmpv3_securitylevel).",'".zbx_ads($snmpv3_authpassphrase)."','".zbx_ads($snmpv3_privpassphrase)."','".zbx_ads($formula)."',$trends,'".zbx_ads($logtimefmt)."')"; $result=DBexecute($sql); if($result) { @@ -127,7 +127,7 @@ return 0; } if($status==ITEM_STATUS_ACTIVE) - $sql="update items set status=$status,error=\"\" where itemid=$itemid"; + $sql="update items set status=$status,error='' where itemid=$itemid"; else $sql="update items set status=$status where itemid=$itemid"; @@ -160,10 +160,10 @@ $delta=0; } - $sql="update items set lastlogsize=0 where itemid=".zbx_ads($itemid)." and key_<>'".zbx_ads($key)."'"; + $sql="update items set lastlogsize=0 where itemid=$itemid and key_<>'".zbx_ads($key)."'"; DBexecute($sql); - $sql="update items set description='".zbx_ads($description)."',key_='".zbx_ads($key)."',hostid=".zbx_ads($hostid).",delay=".zbx_ads($delay).",history=".zbx_ads($history).",nextcheck=0,status=".zbx_ads($status).",type=".zbx_ads($type).",snmp_community='".zbx_ads($snmp_community)."',snmp_oid='".zbx_ads($snmp_oid)."',value_type=".zbx_ads($value_type).",trapper_hosts='".zbx_ads($trapper_hosts)."',snmp_port=".zbx_ads($snmp_port).",units='".zbx_ads($units)."',multiplier=".zbx_ads($multiplier).",delta=".zbx_ads($delta).",snmpv3_securityname='".zbx_ads($snmpv3_securityname)."',snmpv3_securitylevel=".zbx_ads($snmpv3_securitylevel).",snmpv3_authpassphrase='".zbx_ads($snmpv3_authpassphrase)."',snmpv3_privpassphrase='".zbx_ads($snmpv3_privpassphrase)."',formula='".zbx_ads($formula)."',trends=".zbx_ads($trends).",logtimefmt='".zbx_ads($logtimefmt)."' where itemid=".zbx_ads($itemid); + $sql="update items set description='".zbx_ads($description)."',key_='".zbx_ads($key)."',hostid=$hostid,delay=$delay,history=$history,nextcheck=0,status=$status,type=$type,snmp_community='".zbx_ads($snmp_community)."',snmp_oid='".zbx_ads($snmp_oid)."',value_type=$value_type,trapper_hosts='".zbx_ads($trapper_hosts)."',snmp_port=$snmp_port,units='".zbx_ads($units)."',multiplier=$multiplier,delta=$delta,snmpv3_securityname='".zbx_ads($snmpv3_securityname)."',snmpv3_securitylevel=".zbx_ads($snmpv3_securitylevel).",snmpv3_authpassphrase='".zbx_ads($snmpv3_authpassphrase)."',snmpv3_privpassphrase='".zbx_ads($snmpv3_privpassphrase)."',formula='".zbx_ads($formula)."',trends=$trends,logtimefmt='".zbx_ads($logtimefmt)."' where itemid=$itemid"; $result=DBexecute($sql); if($result) { @@ -181,7 +181,7 @@ { $item=get_item_by_itemid($row["itemid"]); - $sql="select itemid from items where key_=\"".$item["key_"]."\" and hostid=$hostid"; + $sql="select itemid from items where key_=\"".zbx_ads($item["key_"])."\" and hostid=$hostid"; $result2=DBselect($sql); if(DBnum_rows($result2)==0) { @@ -241,7 +241,7 @@ while($row=DBfetch($result)) { if($row["items"]&4 == 0) continue; - $sql="select itemid from items where key_=\"".$item["key_"]."\" and hostid=".$row["hostid"]; + $sql="select itemid from items where key_='".zbx_ads($item["key_"])."' and hostid=".$row["hostid"]; $result2=DBselect($sql); while($row2=DBfetch($result2)) { @@ -268,7 +268,7 @@ while($row=DBfetch($result)) { if($row["items"]&2 == 0) continue; - $sql="select itemid from items where key_=\"".$item["key_"]."\" and hostid=".$row["hostid"]; + $sql="select itemid from items where key_=\"".zbx_ads($item["key_"])."\" and hostid=".$row["hostid"]; $result2=DBselect($sql); if(DBnum_rows($result2)==1) { diff --git a/frontends/php/include/maps.inc.php b/frontends/php/include/maps.inc.php index 7169e26e..bf263685 100644 --- a/frontends/php/include/maps.inc.php +++ b/frontends/php/include/maps.inc.php @@ -79,7 +79,7 @@ return 0; } - $sql="update sysmaps set name='$name',width=$width,height=$height,background='$background',label_type=$label_type,label_location=$label_location where sysmapid=$sysmapid"; + $sql="update sysmaps set name='".zbx_ads($name)."',width=$width,height=$height,background='".zbx_ads($background)."',label_type=$label_type,label_location=$label_location where sysmapid=$sysmapid"; return DBexecute($sql); } @@ -93,7 +93,7 @@ return 0; } - $sql="insert into sysmaps (name,width,height,background,label_type,label_location) values ('$name',$width,$height,'$background',$label_type,$label_location)"; + $sql="insert into sysmaps (name,width,height,background,label_type,label_location) values ('".zbx_ads($name)."',$width,$height,'".zbx_ads($background)."',$label_type,$label_location)"; return DBexecute($sql); } @@ -101,11 +101,11 @@ { if($triggerid == 0) { - $sql="insert into sysmaps_links (sysmapid,shostid1,shostid2,triggerid,drawtype_off,color_off,drawtype_on,color_on) values ($sysmapid,$shostid1,$shostid2,NULL,$drawtype_off,'$color_off',$drawtype_on,'$color_on')"; + $sql="insert into sysmaps_links (sysmapid,shostid1,shostid2,triggerid,drawtype_off,color_off,drawtype_on,color_on) values ($sysmapid,$shostid1,$shostid2,NULL,$drawtype_off,'".zbx_ads($color_off)."',$drawtype_on,'".zbx_ads($color_on)."')"; } else { - $sql="insert into sysmaps_links (sysmapid,shostid1,shostid2,triggerid,drawtype_off,color_off,drawtype_on,color_on) values ($sysmapid,$shostid1,$shostid2,$triggerid,$drawtype_off,'$color_off',$drawtype_on,'$color_on')"; + $sql="insert into sysmaps_links (sysmapid,shostid1,shostid2,triggerid,drawtype_off,color_off,drawtype_on,color_on) values ($sysmapid,$shostid1,$shostid2,$triggerid,$drawtype_off,'".zbx_ads($color_off)."',$drawtype_on,'".zbx_ads($color_on)."')"; } return DBexecute($sql); } @@ -120,13 +120,13 @@ function add_host_to_sysmap($sysmapid,$hostid,$label,$x,$y,$icon,$url,$icon_on) { - $sql="insert into sysmaps_hosts (sysmapid,hostid,label,x,y,icon,url,icon_on) values ($sysmapid,$hostid,'$label',$x,$y,'$icon','$url','$icon_on')"; + $sql="insert into sysmaps_hosts (sysmapid,hostid,label,x,y,icon,url,icon_on) values ($sysmapid,$hostid,'".zbx_ads($label)."',$x,$y,'".zbx_ads($icon)."','".zbx_ads($url)."','".zbx_ads($icon_on)."')"; return DBexecute($sql); } function update_sysmap_host($shostid,$sysmapid,$hostid,$label,$x,$y,$icon,$url,$icon_on) { - $sql="update sysmaps_hosts set hostid=$hostid,label='$label',x=$x,y=$y,icon='$icon',url='$url',icon_on='$icon_on' where shostid=$shostid"; + $sql="update sysmaps_hosts set hostid=$hostid,label='".zbx_ads($label)."',x=$x,y=$y,icon='".zbx_ads($icon)."',url='".zbx_ads($url)."',icon_on='".zbx_ads($icon_on)."' where shostid=$shostid"; return DBexecute($sql); } @@ -176,7 +176,7 @@ if($status==HOST_STATUS_MONITORED) { - $sql="select image from images where imagetype=1 and name='$icon'"; + $sql="select image from images where imagetype=1 and name='".zbx_ads($icon)."'"; $result2=DBselect($sql); if(DBnum_rows($result2)==1) { diff --git a/frontends/php/include/profiles.inc.php b/frontends/php/include/profiles.inc.php index e94ff270..d88d59e8 100644 --- a/frontends/php/include/profiles.inc.php +++ b/frontends/php/include/profiles.inc.php @@ -38,7 +38,7 @@ return 0; } - $sql="insert into hosts_profiles (hostid,devicetype,name,os,serialno,tag,macaddress,hardware,software,contact,location,notes) values (".zbx_ads($hostid).",'".zbx_ads($devicetype)."','".zbx_ads($name)."','".zbx_ads($os)."','".zbx_ads($serialno)."','".zbx_ads($tag)."','".zbx_ads($macaddress)."','".zbx_ads($hardware)."','".zbx_ads($software)."','".zbx_ads($contact)."','".zbx_ads($location)."','".zbx_ads($notes)."')"; + $sql="insert into hosts_profiles (hostid,devicetype,name,os,serialno,tag,macaddress,hardware,software,contact,location,notes) values ($hostid,'".zbx_ads($devicetype)."','".zbx_ads($name)."','".zbx_ads($os)."','".zbx_ads($serialno)."','".zbx_ads($tag)."','".zbx_ads($macaddress)."','".zbx_ads($hardware)."','".zbx_ads($software)."','".zbx_ads($contact)."','".zbx_ads($location)."','".zbx_ads($notes)."')"; $result=DBexecute($sql); return $result; @@ -63,7 +63,7 @@ return 0; } - $sql="update hosts_profiles set devicetype='".zbx_ads($devicetype)."',name='".zbx_ads($name)."',os='".zbx_ads($os)."',serialno='".zbx_ads($serialno)."',tag='".zbx_ads($tag)."',macaddress='".zbx_ads($macaddress)."',hardware='".zbx_ads($hardware)."',software='".zbx_ads($software)."',contact='".zbx_ads($contact)."',location='".zbx_ads($location)."',notes='".zbx_ads($notes)."' where hostid=".zbx_ads($hostid); + $sql="update hosts_profiles set devicetype='".zbx_ads($devicetype)."',name='".zbx_ads($name)."',os='".zbx_ads($os)."',serialno='".zbx_ads($serialno)."',tag='".zbx_ads($tag)."',macaddress='".zbx_ads($macaddress)."',hardware='".zbx_ads($hardware)."',software='".zbx_ads($software)."',contact='".zbx_ads($contact)."',location='".zbx_ads($location)."',notes='".zbx_ads($notes)."' where hostid=$hostid"; $result=DBexecute($sql); return $result; diff --git a/frontends/php/include/screens.inc.php b/frontends/php/include/screens.inc.php index 1e21e396..f2b44365 100644 --- a/frontends/php/include/screens.inc.php +++ b/frontends/php/include/screens.inc.php @@ -27,7 +27,7 @@ return 0; } - $sql="insert into screens (name,cols,rows) values ('$name',$cols,$rows)"; + $sql="insert into screens (name,cols,rows) values ('".zbx_ads($name)."',$cols,$rows)"; return DBexecute($sql); } @@ -39,7 +39,7 @@ return 0; } - $sql="update screens set name='$name',cols=$cols,rows=$rows where screenid=$screenid"; + $sql="update screens set name='".zbx_ads($name)."',cols=$cols,rows=$rows where screenid=$screenid"; return DBexecute($sql); } diff --git a/frontends/php/include/services.inc.php b/frontends/php/include/services.inc.php index 7a63d508..dd14ecbc 100644 --- a/frontends/php/include/services.inc.php +++ b/frontends/php/include/services.inc.php @@ -43,11 +43,11 @@ $description=expand_trigger_description($triggerid); // } $description=zbx_ads($description); - $sql="insert into services (name,triggerid,status,algorithm,showsla,goodsla,sortorder) values ('$description',$triggerid,0,$algorithm,$showsla,$goodsla,$sortorder)"; + $sql="insert into services (name,triggerid,status,algorithm,showsla,goodsla,sortorder) values ('".zbx_ads($description)."',$triggerid,0,$algorithm,$showsla,$goodsla,$sortorder)"; } else { - $sql="insert into services (name,status,algorithm,showsla,goodsla,sortorder) values ('$name',0,$algorithm,$showsla,$goodsla,$sortorder)"; + $sql="insert into services (name,status,algorithm,showsla,goodsla,sortorder) values ('".zbx_ads($name)."',0,$algorithm,$showsla,$goodsla,$sortorder)"; } $result=DBexecute($sql); if(!$result) @@ -180,7 +180,7 @@ { $showsla=0; } - $sql="update services set name='$name',triggerid=$triggerid,status=0,algorithm=$algorithm,showsla=$showsla,goodsla=$goodsla,sortorder=$sortorder where serviceid=$serviceid"; + $sql="update services set name='".zbx_ads($name)."',triggerid=$triggerid,status=0,algorithm=$algorithm,showsla=$showsla,goodsla=$goodsla,sortorder=$sortorder where serviceid=$serviceid"; return DBexecute($sql); } diff --git a/frontends/php/include/triggers.inc.php b/frontends/php/include/triggers.inc.php index 7e3d3fd3..97c6cd0a 100644 --- a/frontends/php/include/triggers.inc.php +++ b/frontends/php/include/triggers.inc.php @@ -27,7 +27,7 @@ return 0; } - $sql="update triggers set comments='".zbx_ads($comments)."' where triggerid=".zbx_ads($triggerid); + $sql="update triggers set comments='".zbx_ads($comments)."' where triggerid=$triggerid"; return DBexecute($sql); } @@ -109,7 +109,7 @@ // return 0; // } - $sql="insert into triggers (description,priority,status,comments,url,value,error) values ('".zbx_ads($description)."',".zbx_ads($priority).",".zbx_ads($status).",'".zbx_ads($comments)."','".zbx_ads($url)."',2,'Trigger just added. No status update so far.')"; + $sql="insert into triggers (description,priority,status,comments,url,value,error) values ('".zbx_ads($description)."',$priority,$status,'".zbx_ads($comments)."','".zbx_ads($url)."',2,'Trigger just added. No status update so far.')"; # echo $sql,"<br>"; $result=DBexecute($sql); if(!$result) @@ -122,7 +122,7 @@ add_alarm($triggerid,2); $expression=implode_exp($expression,$triggerid); - $sql="update triggers set expression='".zbx_ads($expression)."' where triggerid=".zbx_ads($triggerid); + $sql="update triggers set expression='".zbx_ads($expression)."' where triggerid=$triggerid"; # echo $sql,"<br>"; DBexecute($sql); reset_items_nextcheck($triggerid); @@ -185,14 +185,13 @@ add_alarm($triggerid,2); // $sql="update triggers set expression='$expression',description='$description',priority=$priority,status=$status,comments='$comments',url='$url' where triggerid=$triggerid"; reset_items_nextcheck($triggerid); - $sql="update triggers set expression='$expression',description='$description',priority=$priority,status=$status,comments='$comments',url='$url',value=2 where triggerid=$triggerid"; + $sql="update triggers set expression='".zbx_ads($expression)."',description='".zbx_ads($description)."',priority=$priority,status=$status,comments='".zbx_ads($comments)."',url='".zbx_ads($url)."',value=2 where triggerid=$triggerid"; return DBexecute($sql); } function check_right_on_trigger($permission,$triggerid) { - $sql="select distinct h.hostid from functions f,items i,hosts h -where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=$triggerid"; + $sql="select distinct h.hostid from functions f,items i,hosts h where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=$triggerid"; $result=DBselect($sql); $ok=0; while($row=DBfetch($result)) @@ -352,7 +351,7 @@ where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=$triggerid"; while($row3=DBfetch($result2)) { - $sql="select itemid from items where key_=\"".$row3["key_"]."\" and hostid=".$row["hostid"]; + $sql="select itemid from items where key_='".zbx_ads($row3["key_"])."' and hostid=".$row["hostid"]; $result3=DBselect($sql); if(DBnum_rows($result3)!=1) { @@ -366,15 +365,15 @@ where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=$triggerid"; $item=get_item_by_itemid($row4["itemid"]); - $sql="insert into functions (itemid,triggerid,function,parameter) values (".$item["itemid"].",".$row2["triggerid"].",'".$row3["function"]."','".$row3["parameter"]."')"; + $sql="insert into functions (itemid,triggerid,function,parameter) values (".$item["itemid"].",".$row2["triggerid"].",'".zbx_ads($row3["function"])."','".zbx_ads($row3["parameter"])."')"; $result5=DBexecute($sql); $functionid=DBinsert_id($result5,"functions","functionid"); - $sql="update triggers set expression='$expression_old' where triggerid=".$row2["triggerid"]; + $sql="update triggers set expression='".zbx_ads($expression_old)."' where triggerid=".$row2["triggerid"]; DBexecute($sql); $expression=str_replace("{".$row3["functionid"]."}","{".$functionid."}",$expression_old); $expression_old=$expression; - $sql="update triggers set expression='$expression' where triggerid=".$row2["triggerid"]; + $sql="update triggers set expression='".zbx_ads($expression)."' where triggerid=".$row2["triggerid"]; DBexecute($sql); } @@ -422,7 +421,7 @@ where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=$triggerid"; if($row["triggers"]&1 == 0) continue; - $sql="insert into triggers (description,priority,status,comments,url,value,expression) values ('".zbx_ads($trigger["description"])."',".$trigger["priority"].",".$trigger["status"].",'".zbx_ads($trigger["comments"])."','".zbx_ads($trigger["url"])."',2,'$expression_old')"; + $sql="insert into triggers (description,priority,status,comments,url,value,expression) values ('".zbx_ads($trigger["description"])."',".$trigger["priority"].",".$trigger["status"].",'".zbx_ads($trigger["comments"])."','".zbx_ads($trigger["url"])."',2,'".zbx_ads($expression_old)."')"; $result4=DBexecute($sql); $triggerid_new=DBinsert_id($result4,"triggers","triggerid"); @@ -432,7 +431,7 @@ where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=$triggerid"; // Loop: functions while($row2=DBfetch($result2)) { - $sql="select itemid from items where key_=\"".$row2["key_"]."\" and hostid=".$row["hostid"]; + $sql="select itemid from items where key_='".zbx_ads($row2["key_"])."' and hostid=".$row["hostid"]; $result3=DBselect($sql); if(DBnum_rows($result3)!=1) { @@ -446,15 +445,15 @@ where h.hostid=i.hostid and i.itemid=f.itemid and f.triggerid=$triggerid"; $item=get_item_by_itemid($row3["itemid"]); - $sql="insert into functions (itemid,triggerid,function,parameter) values (".$item["itemid"].",$triggerid_new,'".$row2["function"]."','".$row2["parameter"]."')"; + $sql="insert into functions (itemid,triggerid,function,parameter) values (".$item["itemid"].",$triggerid_new,'".zbx_ads($row2["function"])."','".zbx_ads($row2["parameter"])."')"; $result5=DBexecute($sql); $functionid=DBinsert_id($result5,"functions","functionid"); - $sql="update triggers set expression='$expression_old' where triggerid=$triggerid_new"; + $sql="update triggers set expression='".zbx_ads($expression_old)."' where triggerid=$triggerid_new"; DBexecute($sql); $expression=str_replace("{".$row2["functionid"]."}","{".$functionid."}",$expression_old); $expression_old=$expression; - $sql="update triggers set expression='$expression' where triggerid=$triggerid_new"; + $sql="update triggers set expression='".zbx_ads($expression)."' where triggerid=$triggerid_new"; DBexecute($sql); $host=get_host_by_hostid($row["hostid"]); diff --git a/frontends/php/include/users.inc.php b/frontends/php/include/users.inc.php index ac9dfca6..3ac82961 100644 --- a/frontends/php/include/users.inc.php +++ b/frontends/php/include/users.inc.php @@ -34,7 +34,7 @@ return 0; } - $sql="select * from users where alias='$alias'"; + $sql="select * from users where alias='".zbx_ads($alias)."'"; $result=DBexecute($sql); if(DBnum_rows($result)>0) { @@ -43,7 +43,7 @@ } $passwd=md5($passwd); - $sql="insert into users (name,surname,alias,passwd,url,autologout,lang,refresh) values ('$name','$surname','$alias','$passwd','$url',$autologout,'$lang',$refresh)"; + $sql="insert into users (name,surname,alias,passwd,url,autologout,lang,refresh) values ('".zbx_ads($name)."','".zbx_ads($surname)."','".zbx_ads($alias)."','".zbx_ads($passwd)."','".zbx_ads($url)."',$autologout,'".zbx_ads($lang)."',$refresh)"; return DBexecute($sql); } @@ -62,7 +62,7 @@ return 0; } - $sql="select * from users where alias='$alias' and userid<>$userid"; + $sql="select * from users where alias='".zbx_ads($alias)."' and userid<>$userid"; $result=DBexecute($sql); if(DBnum_rows($result)>0) { @@ -72,12 +72,12 @@ if($passwd=="") { - $sql="update users set name='$name',surname='$surname',alias='$alias',url='$url',autologout=$autologout,lang='$lang',refresh=$refresh where userid=$userid"; + $sql="update users set name='".zbx_ads($name)."',surname='".zbx_ads($surname)."',alias='".zbx_ads($alias)."',url='".zbx_ads($url)."',autologout=$autologout,lang='".zbx_ads($lang)."',refresh=$refresh where userid=$userid"; } else { $passwd=md5($passwd); - $sql="update users set name='$name',surname='$surname',alias='$alias',passwd='$passwd',url='$url',autologout=$autologout,lang='$lang',refresh=$refresh where userid=$userid"; + $sql="update users set name='".zbx_ads($name)."',surname='".zbx_ads($surname)."',alias='".zbx_ads($alias)."',passwd='".zbx_ads($passwd)."',url='".zbx_ads($url)."',autologout=$autologout,lang='".zbx_ads($lang)."',refresh=$refresh where userid=$userid"; } return DBexecute($sql); } @@ -96,12 +96,12 @@ if($passwd=="") { - $sql="update users set url='$url',autologout=$autologout,lang='$lang',refresh=$refresh where userid=$userid"; + $sql="update users set url='".zbx_ads($url)."',autologout=$autologout,lang='".zbx_ads($lang)."',refresh=$refresh where userid=$userid"; } else { $passwd=md5($passwd); - $sql="update users set passwd='$passwd',url='$url',autologout=$autologout,lang='$lang',refresh=$refresh where userid=$userid"; + $sql="update users set passwd='".zbx_ads($passwd)."',url='".zbx_ads($url)."',autologout=$autologout,lang='".zbx_ads($lang)."',refresh=$refresh where userid=$userid"; } return DBexecute($sql); } @@ -110,7 +110,7 @@ function add_permission($userid,$right,$permission,$id) { - $sql="insert into rights (userid,name,permission,id) values ($userid,'$right','$permission',$id)"; + $sql="insert into rights (userid,name,permission,id) values ($userid,'".zbx_ads($right)."','".zbx_ads($permission)."',$id)"; return DBexecute($sql); } @@ -142,7 +142,7 @@ return 0; } - $sql="select * from usrgrp where name='$name'"; + $sql="select * from usrgrp where name='".zbx_ads($name)."'"; $result=DBexecute($sql); if(DBnum_rows($result)>0) { @@ -150,7 +150,7 @@ return 0; } - $sql="insert into usrgrp (name) values ('$name')"; + $sql="insert into usrgrp (name) values ('".zbx_ads($name)."')"; $result=DBexecute($sql); if(!$result) { @@ -177,7 +177,7 @@ return 0; } - $sql="select * from usrgrp where name='$name' and usrgrpid<>$usrgrpid"; + $sql="select * from usrgrp where name='".zbx_ads($name)."' and usrgrpid<>$usrgrpid"; $result=DBexecute($sql); if(DBnum_rows($result)>0) { @@ -185,7 +185,7 @@ return 0; } - $sql="update usrgrp set name='$name' where usrgrpid=$usrgrpid"; + $sql="update usrgrp set name='".zbx_ads($name)."' where usrgrpid=$usrgrpid"; $result=DBexecute($sql); if(!$result) { diff --git a/frontends/php/index.php b/frontends/php/index.php index 88e2071c..18199872 100644 --- a/frontends/php/index.php +++ b/frontends/php/index.php @@ -83,7 +83,7 @@ if(isset($reconnect) && isset($sessionid)) { - $sql="delete from sessions where sessionid='$sessionid'"; + $sql="delete from sessions where sessionid='".zbx_ads($sessionid)."'"; DBexecute($sql); setcookie("sessionid",$sessionid,time()-3600); unset($sessionid); @@ -92,7 +92,7 @@ if(isset($enter)&&($enter=="Enter")) { $password=md5($password); - $sql="select u.userid,u.alias,u.name,u.surname,u.url,u.refresh from users u where u.alias='$name' and u.passwd='$password'"; + $sql="select u.userid,u.alias,u.name,u.surname,u.url,u.refresh from users u where u.alias='".zbx_ads($name)."' and u.passwd='".zbx_ads($password)."'"; $result=DBselect($sql); if(DBnum_rows($result)==1) { @@ -107,7 +107,7 @@ setcookie("sessionid",$sessionid,time()+3600); // Required ! $_COOKIE["sessionid"]=$sessionid; - $sql="insert into sessions (sessionid,userid,lastaccess) values ('$sessionid',".$USER_DETAILS["userid"].",".time().")"; + $sql="insert into sessions (sessionid,userid,lastaccess) values ('".zbx_ads($sessionid)."',".$USER_DETAILS["userid"].",".time().")"; DBexecute($sql); if($USER_DETAILS["url"] != '') diff --git a/frontends/php/latest.php b/frontends/php/latest.php index ce63f9d6..7876376e 100644 --- a/frontends/php/latest.php +++ b/frontends/php/latest.php @@ -186,7 +186,7 @@ $col=0; if(isset($_REQUEST["select"])) - $sql="select h.host,i.itemid,i.description,i.lastvalue,i.prevvalue,i.lastclock,i.status,h.hostid,i.value_type,i.units,i.multiplier,i.key_ from items i,hosts h where h.hostid=i.hostid and h.status=".HOST_STATUS_MONITORED." and i.status=0 and i.description like '%".$_REQUEST["select"]."%' order by i.description"; + $sql="select h.host,i.itemid,i.description,i.lastvalue,i.prevvalue,i.lastclock,i.status,h.hostid,i.value_type,i.units,i.multiplier,i.key_ from items i,hosts h where h.hostid=i.hostid and h.status=".HOST_STATUS_MONITORED." and i.status=0 and i.description like '%".zbx_ads($_REQUEST["select"])."%' order by i.description"; else $sql="select h.host,i.itemid,i.description,i.lastvalue,i.prevvalue,i.lastclock,i.status,h.hostid,i.value_type,i.units,i.multiplier,i.key_ from items i,hosts h where h.hostid=i.hostid and h.status=".HOST_STATUS_MONITORED." and i.status=0 and h.hostid=".$_REQUEST["hostid"]." order by i.description"; $result=DBselect($sql); diff --git a/frontends/php/map.php b/frontends/php/map.php index c3049e1b..8b10e07e 100644 --- a/frontends/php/map.php +++ b/frontends/php/map.php @@ -86,7 +86,7 @@ # ImageFilledRectangle($im,0,0,$width,$height,$black); if($background!="") { - $sql="select image from images where imagetype=2 and name='$background'"; + $sql="select image from images where imagetype=2 and name='".zbx_ads($background)."'"; $result2=DBselect($sql); if(DBnum_rows($result2)==1) { @@ -286,7 +286,7 @@ $icons[$icon]=ImageCreateFromPNG("images/sysmaps/old/$icon.png"); } */ - $sql="select image from images where imagetype=1 and name='$icon'"; + $sql="select image from images where imagetype=1 and name='".zbx_ads($icon)."'"; $result2=DBselect($sql); if(DBnum_rows($result2)!=1) { diff --git a/frontends/php/overview.php b/frontends/php/overview.php index 25b5411d..f2af4e9c 100644 --- a/frontends/php/overview.php +++ b/frontends/php/overview.php @@ -153,7 +153,7 @@ $rows=array(nbsp($row["description"])); foreach($hosts as $hostid) { - $sql="select itemid,value_type,lastvalue,units from items where hostid=$hostid and description='".$row["description"]."'"; + $sql="select itemid,value_type,lastvalue,units from items where hostid=$hostid and description='".zbx_ads($row["description"])."'"; $result2=DBselect($sql); if(DBnum_rows($result2)==1) { @@ -224,14 +224,14 @@ $_REQUEST["sort"]="order by i.description"; } // $sql="select distinct description from items order by 1;"; - $sql="select distinct t.description from hosts h,items i,hosts_groups hg,triggers t,functions f where h.status=".HOST_STATUS_MONITORED." and t.status=".TRIGGER_STATUS_ENABLED." and h.hostid=i.hostid and hg.groupid=".zbx_ads($_REQUEST["groupid"])." and hg.hostid=h.hostid and t.triggerid=f.triggerid and f.itemid=i.itemid order by 1"; + $sql="select distinct t.description from hosts h,items i,hosts_groups hg,triggers t,functions f where h.status=".HOST_STATUS_MONITORED." and t.status=".TRIGGER_STATUS_ENABLED." and h.hostid=i.hostid and hg.groupid=".$_REQUEST["groupid"]." and hg.hostid=h.hostid and t.triggerid=f.triggerid and f.itemid=i.itemid order by 1"; $result=DBselect($sql); while($row=DBfetch($result)) { $rows=array(nbsp($row["description"])); foreach($hosts as $hostid) { - $sql="select t.status,t.value,t.lastchange from triggers t,functions f,items i where f.triggerid=t.triggerid and i.itemid=f.itemid and t.status=".TRIGGER_STATUS_ENABLED." and i.hostid=".zbx_ads($hostid)." and t.description='".zbx_ads($row["description"])."'"; + $sql="select t.status,t.value,t.lastchange from triggers t,functions f,items i where f.triggerid=t.triggerid and i.itemid=f.itemid and t.status=".TRIGGER_STATUS_ENABLED." and i.hostid=$hostid and t.description='".zbx_ads($row["description"])."'"; $result2=DBselect($sql); if(DBnum_rows($result2)==1) { |