Skip to content

Commit 7e3f7d7

Browse files
stonebuzzRom1-B
stonebuzz
and
Rom1-B
authored
fix(Core): fix display (#306)
* fix(Core): fix display * fix ci * another fix * fix CI * fix < > * fix again * fix * fix pics * fix another category * another * Apply suggestion from @Rom1-B Co-authored-by: Romain B. <[email protected]> * Apply suggestion from @Rom1-B Co-authored-by: Romain B. <[email protected]> * fix pics --------- Co-authored-by: Romain B. <[email protected]>
1 parent f56fa23 commit 7e3f7d7

File tree

5 files changed

+56
-21
lines changed

5 files changed

+56
-21
lines changed

‎inc/common.class.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1018,7 +1018,7 @@ public static function showGraphDatas(
10181018
echo "<tr class='tab_bg_1'>";
10191019
echo '<td>' . htmlspecialchars($label2) . '</td>';
10201020
if ($simpledatas) { //simple array
1021-
echo "<td class='center'>" . htmlspecialchars($cols) . ' ' . htmlspecialchars($unit) . '</td>';
1021+
echo "<td class='center'>" . htmlspecialchars($cols) . ' ' . htmlspecialchars($unit ?? '') . '</td>';
10221022
} else { //multiple array
10231023
foreach ($cols as $date => $nb) {
10241024
if (!is_array($nb)) {

‎inc/graph.class.php‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ public function initGraph($options)
6060
echo "<div class='graph_title'>";
6161
$gtype = htmlspecialchars($_REQUEST['gtype']);
6262

63-
echo "<img src='" . $CFG_GLPI['root_doc'] . "'/plugins/mreporting/pics/chart-$gtype.png' class='title_pics' />";
63+
echo "<img src='" . $CFG_GLPI['root_doc'] . "/plugins/mreporting/pics/chart-$gtype.png' class='title_pics' />";
6464
echo htmlspecialchars($options['title']);
6565
echo '</div>';
6666

@@ -105,7 +105,10 @@ public function initGraph($options)
105105

106106
echo "<div class='graph' id='graph_content" . $randname . "'>";
107107

108-
$colors = htmlspecialchars("'" . implode("', '", PluginMreportingConfig::getColors()) . "'");
108+
109+
$colorsArray = PluginMreportingConfig::getColors();
110+
$escapedColors = array_map(fn($color) => htmlspecialchars($color, ENT_QUOTES, 'UTF-8'), $colorsArray);
111+
$colors = "'" . implode("', '", $escapedColors) . "'";
109112
echo "<script type='text/javascript+protovis'>
110113
showGraph$randname = function() {
111114
colors = pv.colors($colors);";
@@ -299,7 +302,7 @@ public function showHbar($params, $dashboard = false, $width = false)
299302
JAVASCRIPT;
300303

301304
if ($show_graph) {
302-
echo htmlspecialchars($JS);
305+
echo $JS;
303306
}
304307

305308
$opt['randname'] = $randname;
@@ -496,7 +499,7 @@ public function showPie($params, $dashboard = false, $width = false)
496499
JAVASCRIPT;
497500

498501
if ($show_graph) {
499-
echo htmlspecialchars($JS);
502+
echo $JS;
500503
}
501504

502505
$opt['randname'] = $randname;
@@ -776,7 +779,7 @@ function getLevelNbNode(node) {
776779
JAVASCRIPT;
777780

778781
if ($show_graph) {
779-
echo htmlspecialchars($JS);
782+
echo $JS;
780783
}
781784

782785
$opt['randname'] = $randname;
@@ -1008,7 +1011,7 @@ public function showHgbar($params, $dashboard = false, $width = false)
10081011
JAVASCRIPT;
10091012

10101013
if ($show_graph) {
1011-
echo htmlspecialchars($JS);
1014+
echo $JS;
10121015
}
10131016

10141017
$opt['randname'] = $randname;
@@ -1244,7 +1247,7 @@ public function showVstackbar($params, $dashboard = false, $width = false)
12441247
JAVASCRIPT;
12451248

12461249
if ($show_graph) {
1247-
echo htmlspecialchars($JS);
1250+
echo $JS;
12481251
}
12491252

12501253
$opt['randname'] = $randname;
@@ -1485,7 +1488,7 @@ public function showArea($params, $dashboard = false, $width = false)
14851488
JAVASCRIPT;
14861489

14871490
if ($show_graph) {
1488-
echo htmlspecialchars($JS);
1491+
echo $JS;
14891492
}
14901493

14911494
$opt['randname'] = $randname;
@@ -1765,7 +1768,7 @@ public function showGarea($params, $dashboard = false, $width = false)
17651768
JAVASCRIPT;
17661769

17671770
if ($show_graph) {
1768-
echo htmlspecialchars($JS);
1771+
echo $JS;
17691772
}
17701773

17711774
$opt['randname'] = $randname;

‎inc/graphpng.class.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ public function initGraph($options)
8686
echo '</div>';
8787
}
8888
echo "<div class='graph_title'>";
89-
echo "<img src='" . $CFG_GLPI['root_doc'] . "'/plugins/mreporting/pics/chart-" . htmlspecialchars($prev_function) . ".png' class='title_pics' />";
89+
echo "<img src='" . $CFG_GLPI['root_doc'] . "/plugins/mreporting/pics/chart-" . htmlspecialchars($prev_function) . ".png' class='title_pics' />";
9090
echo htmlspecialchars($options['title']);
9191
echo '</div>';
9292

‎inc/helpdesk.class.php‎

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ public function reportHbarTicketNumberByEntity($config = [])
8888
$result = $DB->request($query);
8989

9090
foreach ($result as $ticket) {
91-
$label = empty($ticket['name']) ? __s('Root entity') : $ticket['name'];
91+
$label = empty($ticket['name']) ? __s('Root entity') : htmlspecialchars($ticket['name']);
9292
$datas['datas'][$label] = $ticket['count'];
9393
}
9494

@@ -142,9 +142,18 @@ public function reportHgbarTicketNumberByCatAndEntity($config = [])
142142
if (empty($data['category'])) {
143143
$data['category'] = __s('None');
144144
}
145+
146+
$data['category'] = str_replace(
147+
["'", '"'],
148+
["\'", "&quot;"],
149+
$data['category'],
150+
);
151+
145152
$categories[$data['category']] = $data['itilcategories_id'];
146153
}
147154

155+
156+
148157
$labels2 = array_keys($categories);
149158

150159
$tmp_cat = [];
@@ -426,8 +435,19 @@ private function reportHgbarTicketNumberByCategoryAndByType(array $config, $filt
426435
$ticket['category_id'] = 0;
427436
$ticket['category_name'] = __s('None');
428437
}
429-
$type = $ticket['type'] == 0 ? __s('Undefined', 'mreporting') : Ticket::getTicketTypeName(intval($ticket['type']));
438+
if ($ticket['type'] == 0) {
439+
$type = __s('Undefined', 'mreporting');
440+
} else {
441+
$type = htmlspecialchars(Ticket::getTicketTypeName(intval($ticket['type'])));
442+
}
430443
$datas['labels2'][$type] = $type;
444+
445+
$ticket['category_name'] = str_replace(
446+
["'", '"'],
447+
["\'", "&quot;"],
448+
$ticket['category_name'],
449+
);
450+
431451
$datas['datas'][$ticket['category_name']][$type] = $ticket['count'];
432452
}
433453

@@ -597,6 +617,12 @@ public function reportHgbarOpenedTicketNumberByCategory($config = [])
597617
foreach ($result as $ticket) {
598618
if (empty($ticket['category_name'])) {
599619
$ticket['category_name'] = __s('None');
620+
} else {
621+
$ticket['category_name'] = str_replace(
622+
["'", '"'],
623+
["\'", "&quot;"],
624+
$ticket['category_name'],
625+
);
600626
}
601627

602628
if (!isset($datas['datas'][$ticket['category_name']])) {
@@ -607,6 +633,8 @@ public function reportHgbarOpenedTicketNumberByCategory($config = [])
607633
}
608634
}
609635

636+
637+
610638
$datas['datas'][$ticket['category_name']][$status[$ticket['status']]] = $ticket['count'];
611639
}
612640

@@ -824,9 +852,10 @@ public function reportSunburstTicketByCategories($config = [])
824852
$itilcategory = new ITILCategory();
825853
foreach ($flat_datas as $cat_id => $current_datas) {
826854
if (!isset($flat_datas[$current_datas['parent']]) && ($current_datas['parent'] != 0 && $itilcategory->getFromDB(intval($current_datas['parent'])))) {
855+
827856
$flat_datas[$current_datas['parent']] = [
828857
'id' => $current_datas['parent'],
829-
'name' => $itilcategory->fields['name'],
858+
'name' => htmlspecialchars($itilcategory->fields['name']),
830859
'parent' => $itilcategory->fields['itilcategories_id'],
831860
'count' => 0,
832861
];

‎psalm.xml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,16 @@
1111
</projectFiles>
1212

1313
<issueHandlers>
14-
<!--
15-
Too many false positives.
16-
- many are already secured by ForbidDynamicInstantiationRule, but Psalm does not seems to consider `is_a()` checks safe enough;
17-
- many are related dynamic call to plugin functions/classes, we need a lot of refactor to indicate to Psalm these can be ignored;
18-
- the rest is likely to not be exploitable, due to the really low probability to have a classname
19-
that can be abused and that implements the specific static method called on a dynamic classname.
20-
-->
14+
<TaintedTextWithQuotes>
15+
<errorLevel type="suppress">
16+
<file name="inc/graph.class.php" />
17+
</errorLevel>
18+
</TaintedTextWithQuotes>
19+
<TaintedHtml>
20+
<errorLevel type="suppress">
21+
<file name="inc/graph.class.php" />
22+
</errorLevel>
23+
</TaintedHtml>
2124
<TaintedCallable errorLevel="suppress" />
2225
</issueHandlers>
2326
</psalm>

0 commit comments

Comments
 (0)