' . html_escape('Subprocess error: exit code ' . intval($exit_code)) . '
'; + } } } @@ -3158,7 +3166,9 @@ function mactrack_rescan($web = false) { } function mactrack_site_scan($web = false) { - global $config, $web; + global $config; + + get_filter_request_var('site_id'); $site_id = get_request_var('site_id'); @@ -3175,7 +3185,7 @@ function mactrack_site_scan($web = false) { // create the command script $command_string = $config['base_path'] . '/plugins/mactrack/poller_mactrack.php'; - $extra_args = ' --web -sid=' . $dbinfo['site_id']; + $extra_args = ' -sid=' . cacti_escapeshellarg($dbinfo['site_id']) . ($web ? ' --web' : ''); // print out the type, and device_id $data['site_id'] = $site_id; @@ -3184,10 +3194,15 @@ function mactrack_site_scan($web = false) { ob_start(); // execute the command, and show the results - $command = read_config_option('path_php_binary') . ' -q ' . $command_string . $extra_args; - passthru($command); + $command = cacti_escapeshellarg(read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg($command_string) . $extra_args; + passthru($command, $exit_code); $data['content'] = ob_get_clean(); + + if ($exit_code !== 0) { + $data['error'] = 'site_scan process exited with code ' . intval($exit_code); + $data['content'] .= '' . html_escape('Subprocess error: exit code ' . intval($exit_code)) . '
'; + } } header('Content-Type: application/json; charset=utf-8'); diff --git a/mactrack_actions.php b/mactrack_actions.php index ab253dd..751affa 100644 --- a/mactrack_actions.php +++ b/mactrack_actions.php @@ -147,7 +147,7 @@ function sync_mactrack_to_cacti($mt_device) { $mt_device['snmp_engine_id'] ??= ''; // fetch current data for cacti device - $cacti_device = db_fetch_row('SELECT * FROM host WHERE id=' . $mt_device['host_id']); + $cacti_device = db_fetch_row_prepared('SELECT * FROM host WHERE id = ?', [$mt_device['host_id']]); if (cacti_sizeof($cacti_device)) { // update cacti device @@ -176,7 +176,7 @@ function sync_cacti_to_mactrack($device) { if ((read_config_option('mt_update_policy', true) == 2) && ($device['id'] > 0)) { // $devices holds the whole row from host table // now fetch the related device from mac_track_devices, if any - $mt_device = db_fetch_row('SELECT * from mac_track_devices WHERE host_id=' . $device['id']); + $mt_device = db_fetch_row_prepared('SELECT * FROM mac_track_devices WHERE host_id = ?', [$device['id']]); if (is_array($mt_device) && $mt_device) { $mt_device['snmp_engine_id'] ??= ''; diff --git a/mactrack_devices.php b/mactrack_devices.php index 5c895ad..47207c9 100644 --- a/mactrack_devices.php +++ b/mactrack_devices.php @@ -202,19 +202,26 @@ function form_mactrack_actions() { if (isset($cacti_host['id'])) { reset($fields_mactrack_snmp_item); - $updates = ''; + $set_clauses = []; + $set_params = []; foreach ($fields_mactrack_snmp_item as $field_name => $field_array) { if (isset($cacti_host[$field_name])) { - $updates .= ($updates != '' ? ', ' : '') . $field_name . "='" . $cacti_host[$field_name] . "'"; + // $field_name is a trusted key from the static $fields_mactrack_snmp_item + // definition; the host-table value is bound as a parameter to avoid + // second-order SQL injection when it contains a quote. + $set_clauses[] = $field_name . ' = ?'; + $set_params[] = $cacti_host[$field_name]; } } - if ($updates != '') { + if (cacti_sizeof($set_clauses)) { + $set_params[] = $selected_items[$i]; + db_execute_prepared('UPDATE mac_track_devices - SET ' . $updates . ' - WHERE device_id=?', - [$selected_items[$i]]); + SET ' . implode(', ', $set_clauses) . ' + WHERE device_id = ?', + $set_params); } } else { // skip silently; possible enhancement: tell the user what we did @@ -246,7 +253,7 @@ function form_mactrack_actions() { FROM mac_track_devices WHERE device_id = ?', [$matches[1]]); - $device_list .= '| - () + () | |
| - - " . ($save_html != '' ? " + + " . ($save_html != '' ? " $save_html" : "') . ' | @@ -221,7 +221,8 @@ function form_aggregated_actions() { if ($selected_items != false) { if (get_request_var('drp_action') == '3') { // Delete if (cacti_sizeof($selected_items)) { - db_execute('DELETE FROM mac_track_aggregated_ports WHERE row_id IN (' . implode(',', $selected_items) . ')'); + $placeholders = implode(',', array_fill(0, cacti_sizeof($selected_items), '?')); + db_execute_prepared('DELETE FROM mac_track_aggregated_ports WHERE row_id IN (' . $placeholders . ')', $selected_items); } } @@ -235,7 +236,6 @@ function form_aggregated_actions() { $mac_address_list = ''; $row_list = ''; $i = 0; - $row_ids = ''; // loop through each of the ports selected on the previous page and get more info about them foreach ($_POST as $var => $val) { @@ -249,14 +249,20 @@ function form_aggregated_actions() { } if (cacti_sizeof($row_array)) { - $row_ids = implode(',', $row_array); - $rows_info = db_fetch_assoc('SELECT device_name, mac_address, ip_address, port_number, count_rec + $row_placeholders = implode(',', array_fill(0, cacti_sizeof($row_array), '?')); + $rows_info = db_fetch_assoc_prepared('SELECT device_name, mac_address, ip_address, port_number, count_rec FROM mac_track_aggregated_ports - WHERE row_id IN (' . implode(',', $row_array) . ')'); + WHERE row_id IN (' . $row_placeholders . ')', $row_array); if (isset($rows_info)) { foreach ($rows_info as $row_info) { - $row_list .= '|
| - - " . ($save_html != '' ? " + + " . ($save_html != '' ? " $save_html" : "') . ' | diff --git a/tests/Pest.php b/tests/Pest.php new file mode 100644 index 0000000..675e214 --- /dev/null +++ b/tests/Pest.php @@ -0,0 +1,12 @@ +toBe(0, + "{$relativeFile} uses str_contains() which requires PHP 8.0" + ); + } + }); + + it('does not use str_starts_with (PHP 8.0)', function () use ($files) { + foreach ($files as $relativeFile) { + $path = realpath(__DIR__ . '/../../' . $relativeFile); + + if ($path === false) { + continue; + } + + $contents = file_get_contents($path); + + if ($contents === false) { + continue; + } + + expect(preg_match('/\bstr_starts_with\s*\(/', $contents))->toBe(0, + "{$relativeFile} uses str_starts_with() which requires PHP 8.0" + ); + } + }); + + it('does not use str_ends_with (PHP 8.0)', function () use ($files) { + foreach ($files as $relativeFile) { + $path = realpath(__DIR__ . '/../../' . $relativeFile); + + if ($path === false) { + continue; + } + + $contents = file_get_contents($path); + + if ($contents === false) { + continue; + } + + expect(preg_match('/\bstr_ends_with\s*\(/', $contents))->toBe(0, + "{$relativeFile} uses str_ends_with() which requires PHP 8.0" + ); + } + }); + + it('does not use nullsafe operator (PHP 8.0)', function () use ($files) { + foreach ($files as $relativeFile) { + $path = realpath(__DIR__ . '/../../' . $relativeFile); + + if ($path === false) { + continue; + } + + $contents = file_get_contents($path); + + if ($contents === false) { + continue; + } + + expect(preg_match('/\?->/', $contents))->toBe(0, + "{$relativeFile} uses nullsafe operator which requires PHP 8.0" + ); + } + }); +}); diff --git a/tests/Security/PreparedStatementConsistencyTest.php b/tests/Security/PreparedStatementConsistencyTest.php new file mode 100644 index 0000000..8c74477 --- /dev/null +++ b/tests/Security/PreparedStatementConsistencyTest.php @@ -0,0 +1,66 @@ +toBe(0, + "File {$relativeFile} contains raw (unprepared) DB calls" + ); + } + }); +}); diff --git a/tests/Security/SetupStructureTest.php b/tests/Security/SetupStructureTest.php new file mode 100644 index 0000000..83b7148 --- /dev/null +++ b/tests/Security/SetupStructureTest.php @@ -0,0 +1,34 @@ +toContain('function plugin_mactrack_install'); + }); + + it('defines plugin_mactrack_version function', function () use ($source) { + expect($source)->toContain('function plugin_mactrack_version'); + }); + + it('defines plugin_mactrack_uninstall function', function () use ($source) { + expect($source)->toContain('function plugin_mactrack_uninstall'); + }); + + it('returns version array with name key', function () use ($source) { + expect($source)->toMatch('/[\'\""]name[\'\""]\s*=>/'); + }); + + it('returns version array with version key', function () use ($source) { + expect($source)->toMatch('/[\'\""]version[\'\""]\s*=>/'); + }); +}); diff --git a/tests/bootstrap.php b/tests/bootstrap.php new file mode 100644 index 0000000..bb20bc6 --- /dev/null +++ b/tests/bootstrap.php @@ -0,0 +1,202 @@ + 'db_execute', 'sql' => $sql, 'params' => []]; + + return true; + } +} + +if (!function_exists('db_execute_prepared')) { + function db_execute_prepared($sql, $params = []) { + $GLOBALS['__test_db_calls'][] = ['fn' => 'db_execute_prepared', 'sql' => $sql, 'params' => $params]; + + return true; + } +} + +if (!function_exists('db_fetch_assoc')) { + function db_fetch_assoc($sql) { + return []; + } +} + +if (!function_exists('db_fetch_assoc_prepared')) { + function db_fetch_assoc_prepared($sql, $params = []) { + return []; + } +} + +if (!function_exists('db_fetch_row')) { + function db_fetch_row($sql) { + return []; + } +} + +if (!function_exists('db_fetch_row_prepared')) { + function db_fetch_row_prepared($sql, $params = []) { + return []; + } +} + +if (!function_exists('db_fetch_cell')) { + function db_fetch_cell($sql) { + return ''; + } +} + +if (!function_exists('db_fetch_cell_prepared')) { + function db_fetch_cell_prepared($sql, $params = []) { + return ''; + } +} + +if (!function_exists('db_index_exists')) { + function db_index_exists($table, $index) { + return false; + } +} + +if (!function_exists('db_column_exists')) { + function db_column_exists($table, $column) { + return false; + } +} + +if (!function_exists('api_plugin_db_add_column')) { + function api_plugin_db_add_column($plugin, $table, $data) { + return true; + } +} + +if (!function_exists('api_plugin_db_table_create')) { + function api_plugin_db_table_create($plugin, $table, $data) { + return true; + } +} + +if (!function_exists('read_config_option')) { + function read_config_option($name, $force = false) { + return ''; + } +} + +if (!function_exists('set_config_option')) { + function set_config_option($name, $value) { + } +} + +if (!function_exists('html_escape')) { + function html_escape($string) { + return htmlspecialchars($string, ENT_QUOTES | ENT_HTML5, 'UTF-8'); + } +} + +if (!function_exists('__')) { + function __($text, $domain = '') { + return $text; + } +} + +if (!function_exists('__esc')) { + function __esc($text, $domain = '') { + return htmlspecialchars($text, ENT_QUOTES | ENT_HTML5, 'UTF-8'); + } +} + +if (!function_exists('cacti_log')) { + function cacti_log($message, $also_print = false, $log_type = '', $level = 0) { + } +} + +if (!function_exists('cacti_sizeof')) { + function cacti_sizeof($array) { + return is_array($array) ? count($array) : 0; + } +} + +if (!function_exists('is_realm_allowed')) { + function is_realm_allowed($realm) { + return true; + } +} + +if (!function_exists('raise_message')) { + function raise_message($id, $text = '', $level = 0) { + } +} + +if (!function_exists('get_request_var')) { + function get_request_var($name) { + return ''; + } +} + +if (!function_exists('get_nfilter_request_var')) { + function get_nfilter_request_var($name) { + return ''; + } +} + +if (!function_exists('get_filter_request_var')) { + function get_filter_request_var($name) { + return ''; + } +} + +if (!function_exists('form_input_validate')) { + function form_input_validate($value, $name, $regex, $optional, $error) { + return $value; + } +} + +if (!function_exists('is_error_message')) { + function is_error_message() { + return false; + } +} + +if (!function_exists('sql_save')) { + function sql_save($array, $table, $key = 'id') { + return isset($array['id']) ? $array['id'] : 1; + } +} + +if (!defined('CACTI_PATH_BASE')) { + define('CACTI_PATH_BASE', '/var/www/html/cacti'); +} + +if (!defined('POLLER_VERBOSITY_LOW')) { + define('POLLER_VERBOSITY_LOW', 2); +} + +if (!defined('POLLER_VERBOSITY_MEDIUM')) { + define('POLLER_VERBOSITY_MEDIUM', 3); +} + +if (!defined('POLLER_VERBOSITY_DEBUG')) { + define('POLLER_VERBOSITY_DEBUG', 5); +} + +if (!defined('POLLER_VERBOSITY_NONE')) { + define('POLLER_VERBOSITY_NONE', 6); +} + +if (!defined('MESSAGE_LEVEL_ERROR')) { + define('MESSAGE_LEVEL_ERROR', 1); +}