Skip to content

Commit 5894247

Browse files
somethingwithproofsomethingwithproof
authored
bugfix: trim xml import payload value before emptiness check (#272)
* fix: trim xml import payload value before emptiness check Refs #272 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(i18n): correct zh-CN.po format string errors Fix fullwidth percent signs and missing format specifiers. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
1 parent 9166406 commit 5894247

6 files changed

Lines changed: 178 additions & 26 deletions

File tree

‎locales/po/zh-CN.po‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,12 @@ msgstr "请使用HTML电子邮件客户端"
3030
#: functions.php:1304
3131
#, fuzzy, php-format
3232
msgid "Cacti Syslog Threshold Alert '%s' for Host '%s'"
33-
msgstr "Cacti Syslog插件阈值警报'％s'"
33+
msgstr "Cacti Syslog插件阈值警报'%s'"
3434

3535
#: functions.php:1306
3636
#, fuzzy, php-format
3737
msgid "Cacti Syslog Threshold Alert '%s'"
38-
msgstr "Cacti Syslog插件阈值警报'％s'"
38+
msgstr "Cacti Syslog插件阈值警报'%s'"
3939

4040
#: functions.php:1314 syslog.php:1896 syslog_alerts.php:874
4141
msgid "Alert Name"
@@ -62,12 +62,12 @@ msgstr "匹配字符串"
6262
#: functions.php:1329 functions.php:1368
6363
#, fuzzy, php-format
6464
msgid "Cacti Syslog Alert '%s' for Host '%s'"
65-
msgstr "Cacti Syslog插件阈值警报'％s'"
65+
msgstr "Cacti Syslog插件阈值警报'%s'"
6666

6767
#: functions.php:1331 functions.php:1370
6868
#, fuzzy, php-format
6969
msgid "Cacti Syslog Alert '%s'"
70-
msgstr "Cacti Syslog插件警报'％s'"
70+
msgstr "Cacti Syslog插件警报'%s'"
7171

7272
#: functions.php:1340
7373
msgid "Hostname"
@@ -152,7 +152,7 @@ msgstr "西弗："
152152
#: functions.php:1490 functions.php:1544
153153
#, fuzzy, php-format
154154
msgid "Event Alert - %s"
155-
msgstr "事件警报 - ％s"
155+
msgstr "事件警报 - %s"
156156

157157
#: functions.php:1548
158158
#, fuzzy
@@ -166,7 +166,7 @@ msgstr "主机"
166166
#: functions.php:2116
167167
#, fuzzy, php-format
168168
msgid "Event Report - %s"
169-
msgstr "活动报告 - ％s"
169+
msgstr "活动报告 - %s"
170170

171171
#: setup.php:34
172172
#, fuzzy
@@ -252,7 +252,7 @@ msgstr "选择您希望每天创建的分区数。"
252252
#: setup.php:918 setup.php:919 setup.php:920 setup.php:921 setup.php:922
253253
#, php-format
254254
msgid "%d Per Day"
255-
msgstr "％d 每天"
255+
msgstr "%d 每天"
256256

257257
#: setup.php:927 setup.php:1015
258258
msgid "Upgrade"
@@ -265,7 +265,7 @@ msgstr "安装"
265265
#: setup.php:933
266266
#, fuzzy, php-format
267267
msgid "Syslog %s Advisor"
268-
msgstr "Syslog％s顾问"
268+
msgstr "Syslog%s顾问"
269269

270270
#: setup.php:937
271271
msgid "WARNING: Syslog Upgrade is Time Consuming!!!"
@@ -291,7 +291,7 @@ msgstr "安装Syslog时有几个选项可供选择。第一个是数据库架构
291291
#: setup.php:945
292292
#, fuzzy, php-format
293293
msgid "Syslog %s Settings"
294-
msgstr "Syslog％s设置"
294+
msgstr "Syslog%s设置"
295295

296296
#: setup.php:972
297297
msgid "What uninstall method do you want to use?"
@@ -662,7 +662,7 @@ msgstr "在范围内显示Syslog"
662662
#: setup.php:1548
663663
#, fuzzy, php-format
664664
msgid "There were %s Device records removed from the Syslog database"
665-
msgstr "从Syslog数据库中删除了％s设备记录"
665+
msgstr "从Syslog数据库中删除了%s设备记录"
666666

667667
#: setup.php:1564
668668
#, fuzzy
@@ -692,7 +692,7 @@ msgstr "所有文字"
692692
#: syslog.php:67
693693
#, fuzzy, php-format
694694
msgid "%d Chars"
695-
msgstr "％d Chars"
695+
msgstr "%d Chars"
696696

697697
#: syslog.php:171
698698
msgid "System Logs"
@@ -810,7 +810,7 @@ msgstr "默认"
810810
#: syslog.php:1066
811811
#, php-format
812812
msgid " [ Start: '%s' to End: '%s', Unprocessed Messages: %s ]"
813-
msgstr "[开始：'％s'到结尾：'％s'，未处理的消息：％s]"
813+
msgstr "[开始：'%s'到结尾：'%s'，未处理的消息：%s]"
814814

815815
#: syslog.php:1068
816816
#, php-format
@@ -839,7 +839,7 @@ msgstr "选择所有设备"
839839
#: syslog.php:1329
840840
#, fuzzy, php-format
841841
msgid "Syslog Message Filter %s"
842-
msgstr "系统日志消息过滤器％s"
842+
msgstr "系统日志消息过滤器%s"
843843

844844
#: syslog.php:1336
845845
msgid "Timespan"
@@ -1160,7 +1160,7 @@ msgstr "1个月"
11601160
#: syslog_alerts.php:449
11611161
#, fuzzy, php-format
11621162
msgid "Alert Edit [edit: %s]"
1163-
msgstr "警报编辑[编辑：％s]"
1163+
msgstr "警报编辑[编辑：%s]"
11641164

11651165
#: syslog_alerts.php:451 syslog_alerts.php:458 syslog_alerts.php:465
11661166
#, fuzzy
@@ -1424,7 +1424,7 @@ msgstr "导入的"
14241424
#: syslog_alerts.php:1039
14251425
#, fuzzy, php-format
14261426
msgid "NOTE: Alert '%s' %s!"
1427-
msgstr "注意：提醒'％s'％s！"
1427+
msgstr "注意：提醒'%s'%s！"
14281428

14291429
#: syslog_alerts.php:1039 syslog_removal.php:861 syslog_reports.php:903
14301430
msgid "Updated"
@@ -1433,7 +1433,7 @@ msgstr "更新"
14331433
#: syslog_alerts.php:1041
14341434
#, fuzzy, php-format
14351435
msgid "ERROR: Alert '%s' %s Failed!"
1436-
msgstr "错误：警报'％s'％s失败！"
1436+
msgstr "错误：警报'%s'%s失败！"
14371437

14381438
#: syslog_alerts.php:1041 syslog_removal.php:863 syslog_reports.php:905
14391439
msgid "Update"
@@ -1496,12 +1496,12 @@ msgstr "导出Syslog删除规则"
14961496
#: syslog_removal.php:342
14971497
#, fuzzy, php-format
14981498
msgid "Rule '%s' resulted in %s/%s messages removed/transferred"
1499-
msgstr "删除了％s消息，并传输了％s消息"
1499+
msgstr "删除了%s消息，并传输了%s消息"
15001500

15011501
#: syslog_removal.php:398
15021502
#, fuzzy, php-format
15031503
msgid "Removal Rule Edit [edit: %s]"
1504-
msgstr "删除规则编辑[编辑：％s]"
1504+
msgstr "删除规则编辑[编辑：%s]"
15051505

15061506
#: syslog_removal.php:400 syslog_removal.php:407
15071507
#, fuzzy
@@ -1626,12 +1626,12 @@ msgstr "导入删除规则"
16261626
#: syslog_removal.php:861
16271627
#, fuzzy, php-format
16281628
msgid "NOTE: Removal Rule '%s' %s!"
1629-
msgstr "注意：删除规则'％s'％s！"
1629+
msgstr "注意：删除规则'%s'%s！"
16301630

16311631
#: syslog_removal.php:863
16321632
#, fuzzy, php-format
16331633
msgid "ERROR: Removal Rule '%s' %s Failed!"
1634-
msgstr "错误：删除规则'％s'％s失败！"
1634+
msgstr "错误：删除规则'%s'%s失败！"
16351635

16361636
#: syslog_reports.php:169
16371637
#, fuzzy
@@ -1685,7 +1685,7 @@ msgstr "返回"
16851685
#: syslog_reports.php:391
16861686
#, fuzzy, php-format
16871687
msgid "Report Edit [edit: %s]"
1688-
msgstr "报告编辑[编辑：％s]"
1688+
msgstr "报告编辑[编辑：%s]"
16891689

16901690
#: syslog_reports.php:393 syslog_reports.php:398
16911691
#, fuzzy
@@ -1800,9 +1800,9 @@ msgstr "导入报告数据"
18001800
#: syslog_reports.php:903
18011801
#, php-format
18021802
msgid "NOTE: Report Rule '%s' %s!"
1803-
msgstr "注意：报告规则"
1803+
msgstr ""
18041804

18051805
#: syslog_reports.php:905
18061806
#, php-format
18071807
msgid "ERROR: Report Rule '%s' %s Failed!"
1808-
msgstr "错误：报告规则'％s'％s失败！"
1808+
msgstr "错误：报告规则'%s'%s失败！"

‎syslog_alerts.php‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -939,7 +939,20 @@ function import() {
939939
}
940940

941941
function alert_import() {
942-
$xml_data = syslog_get_import_xml_payload('syslog_alerts.php?header=false');
942+
$import_text = get_nfilter_request_var('import_text');
943+
944+
if (trim($import_text) != '') {
945+
/* textbox input */
946+
$xml_data = $import_text;
947+
} elseif (($_FILES['import_file']['tmp_name'] != 'none') && ($_FILES['import_file']['tmp_name'] != '')) {
948+
/* file upload */
949+
$fp = fopen($_FILES['import_file']['tmp_name'],'r');
950+
$xml_data = fread($fp, filesize($_FILES['import_file']['tmp_name']));
951+
fclose($fp);
952+
} else {
953+
header('Location: syslog_alerts.php?header=false');
954+
exit;
955+
}
943956

944957
$xml_array = xml2array($xml_data);
945958

‎syslog_removal.php‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -739,7 +739,20 @@ function import() {
739739
}
740740

741741
function removal_import() {
742-
$xml_data = syslog_get_import_xml_payload('syslog_removal.php?header=false');
742+
$import_text = get_nfilter_request_var('import_text');
743+
744+
if (trim($import_text) != '') {
745+
/* textbox input */
746+
$xml_data = $import_text;
747+
} elseif (($_FILES['import_file']['tmp_name'] != 'none') && ($_FILES['import_file']['tmp_name'] != '')) {
748+
/* file upload */
749+
$fp = fopen($_FILES['import_file']['tmp_name'],'r');
750+
$xml_data = fread($fp, filesize($_FILES['import_file']['tmp_name']));
751+
fclose($fp);
752+
} else {
753+
header('Location: syslog_removal.php?header=false');
754+
exit;
755+
}
743756

744757
/* obtain debug information if it's set */
745758
$xml_array = xml2array($xml_data);

‎syslog_reports.php‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -801,7 +801,20 @@ function import() {
801801
}
802802

803803
function report_import() {
804-
$xml_data = syslog_get_import_xml_payload('syslog_reports.php?header=false');
804+
$import_text = get_nfilter_request_var('import_text');
805+
806+
if (trim($import_text) != '') {
807+
/* textbox input */
808+
$xml_data = $import_text;
809+
} elseif (($_FILES['import_file']['tmp_name'] != 'none') && ($_FILES['import_file']['tmp_name'] != '')) {
810+
/* file upload */
811+
$fp = fopen($_FILES['import_file']['tmp_name'],'r');
812+
$xml_data = fread($fp, filesize($_FILES['import_file']['tmp_name']));
813+
fclose($fp);
814+
} else {
815+
header('Location: syslog_reports.php?header=false');
816+
exit;
817+
}
805818

806819
/* obtain debug information if it's set */
807820
$xml_array = xml2array($xml_data);

‎tests/regression/issue269_import_text_branch_logic_test.php‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
<?php
2+
3+
/*
4+
* Regression test for issue #269 -- branch-logic invariants.
5+
*
6+
* These assertions verify the structural properties that make whitespace-only
7+
* input fall through to the file-upload branch instead of the textbox branch,
8+
* and that a non-empty payload is assigned to $xml_data without further
9+
* modification. Pure source inspection: the functions themselves cannot be
10+
* called in isolation because they depend on the Cacti runtime.
11+
*/
12+
13+
$root = dirname(__DIR__, 2);
14+
$targets = array(
15+
'alert_import' => $root . '/syslog_alerts.php',
16+
'removal_import' => $root . '/syslog_removal.php',
17+
'report_import' => $root . '/syslog_reports.php',
18+
);
19+
20+
foreach ($targets as $func => $target) {
21+
$content = file_get_contents($target);
22+
23+
if ($content === false) {
24+
fwrite(STDERR, "Failed to load $target\n");
25+
exit(1);
26+
}
27+
28+
/*
29+
* 1. The request variable must be captured into a local first.
30+
* Whitespace-only input falls through only because trim() is applied
31+
* to the local; if the assignment were missing the condition would
32+
* be wrong.
33+
*/
34+
if (!preg_match('/\$import_text\s*=\s*get_nfilter_request_var\s*\(\s*\'import_text\'\s*\)/', $content)) {
35+
fwrite(STDERR, "$func: \$import_text assignment via get_nfilter_request_var missing in $target\n");
36+
exit(1);
37+
}
38+
39+
/*
40+
* 2. The branch condition must trim the local variable, not the raw
41+
* request call. This is what makes whitespace-only values fall
42+
* through to the file-upload branch.
43+
*/
44+
if (!preg_match('/trim\s*\(\s*\$import_text\s*\)\s*!=\s*\'\'/', $content)) {
45+
fwrite(STDERR, "$func: trim(\$import_text) != '' condition missing in $target\n");
46+
exit(1);
47+
}
48+
49+
/*
50+
* 3. Inside the textbox branch, $xml_data must be assigned the
51+
* untrimmed local. A non-empty payload is preserved as-is.
52+
*/
53+
if (!preg_match('/\$xml_data\s*=\s*\$import_text\s*;/', $content)) {
54+
fwrite(STDERR, "$func: \$xml_data = \$import_text assignment missing in $target\n");
55+
exit(1);
56+
}
57+
58+
/*
59+
* 4. The file-upload branch must still exist (elseif on $_FILES).
60+
* Ensures the fallback path was not accidentally removed.
61+
*/
62+
if (!preg_match('/elseif\s*\(\s*\(\s*\$_FILES\s*\[/', $content)) {
63+
fwrite(STDERR, "$func: \$_FILES elseif branch missing in $target\n");
64+
exit(1);
65+
}
66+
}
67+
68+
echo "issue269_import_text_branch_logic_test passed\n";

‎tests/regression/issue269_import_text_trim_check_test.php‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
<?php
2+
3+
$root = dirname(__DIR__, 2);
4+
$targets = array(
5+
$root . '/syslog_alerts.php',
6+
$root . '/syslog_reports.php',
7+
$root . '/syslog_removal.php'
8+
);
9+
10+
$legacy = "trim(get_nfilter_request_var('import_text') != '')";
11+
12+
foreach ($targets as $target) {
13+
$content = file_get_contents($target);
14+
15+
if ($content === false) {
16+
fwrite(STDERR, "Failed to load $target\n");
17+
exit(1);
18+
}
19+
20+
if (strpos($content, $legacy) !== false) {
21+
fwrite(STDERR, "Legacy import_text trim/comparison bug remains in $target\n");
22+
exit(1);
23+
}
24+
25+
$fixedPattern = '/trim\s*\(\s*\$import_text\s*\)\s*!=\s*\'\'/';
26+
if (!preg_match($fixedPattern, $content)) {
27+
fwrite(STDERR, "Fixed import_text trim/comparison check missing in $target\n");
28+
exit(1);
29+
}
30+
31+
/* After the local $import_text assignment, there must be no second
32+
get_nfilter_request_var('import_text') call. A duplicate call
33+
would bypass the cached local variable. */
34+
$needle = "\$import_text = get_nfilter_request_var('import_text')";
35+
$assignPos = strpos($content, $needle);
36+
if ($assignPos !== false) {
37+
$afterAssign = substr($content, $assignPos + strlen($needle));
38+
if (preg_match('/get_nfilter_request_var\s*\(\s*\'import_text\'\s*\)/', $afterAssign)) {
39+
fwrite(STDERR, "Redundant get_nfilter_request_var('import_text') call after local assignment in $target\n");
40+
exit(1);
41+
}
42+
}
43+
}
44+
45+
echo "issue269_import_text_trim_check_test passed\n";

0 commit comments

Comments
 (0)