{if $index_data}
diff --git a/www/include/monitoring/status/Services/xml/serviceXML.php b/www/include/monitoring/status/Services/xml/serviceXML.php
index 92ea1182e14..bb6148db493 100644
--- a/www/include/monitoring/status/Services/xml/serviceXML.php
+++ b/www/include/monitoring/status/Services/xml/serviceXML.php
@@ -1,4 +1,5 @@
XML->writeElement("sc", $obj->colorService[$data["state"]]);
$obj->XML->writeElement("cs", _($obj->statusService[$data["state"]]), false);
$obj->XML->writeElement("ssc", $data["state"]);
- $obj->XML->writeElement("po", CentreonUtils::escapeSecure($pluginShortOuput));
+ $obj->XML->writeElement("po", htmlspecialchars(htmlspecialchars($pluginShortOuput)));
$obj->XML->writeElement(
"ca",
$data["current_attempt"] . "/" . $data["max_check_attempts"]
diff --git a/www/include/options/accessLists/groupsACL/groupsConfig.php b/www/include/options/accessLists/groupsACL/groupsConfig.php
index 0962a1ec3d7..efca74051f9 100644
--- a/www/include/options/accessLists/groupsACL/groupsConfig.php
+++ b/www/include/options/accessLists/groupsACL/groupsConfig.php
@@ -71,8 +71,14 @@ function sanitize_input_array(array $inputArray): array
$acl_group_id = filter_var($_GET['acl_group_id'] ?? $_POST['acl_group_id'] ?? null, FILTER_VALIDATE_INT) ?? null;
// Caution $o may already be set from the GET or from the POST.
-$postO = filter_var($_POST['o1'] ?? $_POST['o2'] ?? $o ?? null, FILTER_SANITIZE_STRING);
-$o = ("" !== $postO) ? $postO : null;
+$postO = filter_var(
+ $_POST['o1'] ?? $_POST['o2'] ?? $o ?? null,
+ FILTER_VALIDATE_REGEXP,
+ ["options" => ["regexp" => "/^(a|c|d|m|s|u|w)$/"]]
+);
+if ($postO !== false) {
+ $o = $postO;
+}
switch ($o) {
case "a":
diff --git a/www/include/views/virtualMetrics/listVirtualMetrics.php b/www/include/views/virtualMetrics/listVirtualMetrics.php
index 533279620c3..38ea5717dfb 100644
--- a/www/include/views/virtualMetrics/listVirtualMetrics.php
+++ b/www/include/views/virtualMetrics/listVirtualMetrics.php
@@ -130,31 +130,37 @@
"\" maxlength=\"3\" size=\"3\" value='1' style=\"margin-bottom:0px;\" name='dupNbr[" .
$vmetric['vmetric_id'] . "]' />";
+ $indexDataStatement = $pearDBO->prepare("SELECT id,host_id,service_id FROM index_data " .
+ "WHERE id = :indexId ");
try {
- $query = "SELECT id,host_id,service_id FROM index_data WHERE id = '" . $vmetric['index_id'] . "'";
- $dbindd = $pearDBO->query($query);
+ $indexDataStatement->bindValue(':indexId', (int) $vmetric['index_id'], \PDO::PARAM_INT);
+ $indexDataStatement->execute();
} catch (\PDOException $e) {
print "DB Error : " . $e->getMessage() . "
";
}
- $indd = $dbindd->fetchRow();
- $dbindd->closeCursor();
+ $indd = $indexDataStatement->fetchRow();
+
+ $indexDataStatement->closeCursor();
if ($indd !== false) {
try {
- $query = "(SELECT concat(h.host_name,' > ',s.service_description) full_name " .
+ $hsrStatement = $pearDB->prepare("(SELECT concat(h.host_name,' > ',s.service_description) full_name " .
"FROM host_service_relation AS hsr, host AS h, service AS s WHERE hsr.host_host_id = h.host_id " .
- "AND hsr.service_service_id = s.service_id AND h.host_id = '" . $indd["host_id"] .
- "' AND s.service_id = '" . $indd["service_id"] . "') UNION " .
+ "AND hsr.service_service_id = s.service_id AND h.host_id = :hostId " .
+ "AND s.service_id = :serviceId ) UNION " .
"(SELECT concat(h.host_name,' > ',s.service_description) full_name " .
"FROM host_service_relation AS hsr, host AS h, service AS s, hostgroup_relation AS hr " .
"WHERE hsr.hostgroup_hg_id = hr.hostgroup_hg_id AND hr.host_host_id = h.host_id " .
- "AND hsr.service_service_id = s.Service_id AND h.host_id = '" . $indd["host_id"] .
- "' AND s.service_id = '" . $indd["service_id"] . "') ORDER BY full_name";
- $dbhsrname = $pearDB->query($query);
+ "AND hsr.service_service_id = s.Service_id AND h.host_id = :hostId " .
+ "AND s.service_id = :serviceId ) ORDER BY full_name");
+
+ $hsrStatement->bindValue(':hostId', (int) $indd["host_id"], \PDO::PARAM_INT);
+ $hsrStatement->bindValue(':serviceId', (int) $indd["service_id"], \PDO::PARAM_INT);
+ $hsrStatement->execute();
} catch (\PDOException $e) {
print "DB Error : " . $e->getMessage() . "
";
}
- $hsrname = $dbhsrname->fetchRow();
- $dbhsrname->closeCursor();
+ $hsrname = $hsrStatement->fetchRow();
+ $hsrStatement->closeCursor();
$hsrname["full_name"] = str_replace('#S#', "/", $hsrname["full_name"]);
$hsrname["full_name"] = str_replace('#BS#', "\\", $hsrname["full_name"]);
}
diff --git a/www/install/createTables.sql b/www/install/createTables.sql
index f07082a5f9d..5676f4c90f9 100644
--- a/www/install/createTables.sql
+++ b/www/install/createTables.sql
@@ -2329,7 +2329,9 @@ CREATE TABLE IF NOT EXISTS `remote_servers` (
`http_method` enum('http','https') NOT NULL DEFAULT 'http',
`http_port` int(11) DEFAULT NULL,
`no_check_certificate` enum('0','1') NOT NULL DEFAULT '0',
- `no_proxy` enum('0','1') NOT NULL DEFAULT '0'
+ `no_proxy` enum('0','1') NOT NULL DEFAULT '0',
+ `server_id` int(11) NOT NULL,
+ CONSTRAINT `remote_server_nagios_server_ibfk_1` FOREIGN KEY(`server_id`) REFERENCES `nagios_server` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
-- Create rs_poller_relation for the additional relationship between poller and remote servers
diff --git a/www/install/insertBaseConf.sql b/www/install/insertBaseConf.sql
index e594a988e0f..c08019ce84f 100644
--- a/www/install/insertBaseConf.sql
+++ b/www/install/insertBaseConf.sql
@@ -2,7 +2,7 @@
-- Insert version
--
-INSERT INTO `informations` (`key` ,`value`) VALUES ('version', '21.10.9');
+INSERT INTO `informations` (`key` ,`value`) VALUES ('version', '21.10.10');
--
-- Contenu de la table `contact`
diff --git a/www/install/php/Update-21.10.10.php b/www/install/php/Update-21.10.10.php
new file mode 100644
index 00000000000..d22a8c06dca
--- /dev/null
+++ b/www/install/php/Update-21.10.10.php
@@ -0,0 +1,102 @@
+isColumnExist('remote_servers', 'server_id') === 0) {
+ $errorMessage = "Unable to add 'server_id' column to remote_servers table";
+ $pearDB->query(
+ "ALTER TABLE remote_servers
+ ADD COLUMN `server_id` int(11) NOT NULL"
+ );
+
+ migrateRemoteServerRelations($pearDB);
+
+ $errorMessage = "Unable to add foreign key constraint of remote_servers.server_id";
+ $pearDB->query(
+ "ALTER TABLE remote_servers
+ ADD CONSTRAINT `remote_server_nagios_server_ibfk_1`
+ FOREIGN KEY(`server_id`) REFERENCES `nagios_server` (`id`)
+ ON DELETE CASCADE"
+ );
+ }
+} catch (\Exception $e) {
+ $centreonLog->insertLog(
+ 4,
+ $versionOfTheUpgrade . $errorMessage .
+ " - Code : " . (int)$e->getCode() .
+ " - Error : " . $e->getMessage() .
+ " - Trace : " . $e->getTraceAsString()
+ );
+
+ throw new \Exception($versionOfTheUpgrade . $errorMessage, (int) $e->getCode(), $e);
+}
+
+/**
+ * Manage relations between remote servers and nagios servers
+ *
+ * @param \CentreonDB $pearDB
+ */
+function migrateRemoteServerRelations(\CentreonDB $pearDB): void
+{
+ $processedIps = [];
+
+ $selectServerStatement = $pearDB->prepare(
+ "SELECT id FROM nagios_server WHERE ns_ip_address = :ip_address"
+ );
+ $deleteRemoteStatement = $pearDB->prepare(
+ "DELETE FROM remote_servers WHERE id = :id"
+ );
+ $updateRemoteStatement = $pearDB->prepare(
+ "UPDATE remote_servers SET server_id = :server_id WHERE id = :id"
+ );
+
+ $result = $pearDB->query(
+ "SELECT id, ip FROM remote_servers"
+ );
+ while ($remote = $result->fetch()) {
+ $remoteIp = $remote['ip'];
+ $remoteId = $remote['id'];
+ if (in_array($remoteIp, $processedIps)) {
+ $deleteRemoteStatement->bindValue(':id', $remoteId, \PDO::PARAM_INT);
+ $deleteRemoteStatement->execute();
+ }
+
+ $processedIps[] = $remoteIp;
+
+ $selectServerStatement->bindValue(':ip_address', $remoteIp, \PDO::PARAM_STR);
+ $selectServerStatement->execute();
+ if ($server = $selectServerStatement->fetch()) {
+ $updateRemoteStatement->bindValue(':server_id', $server['id'], \PDO::PARAM_INT);
+ $updateRemoteStatement->bindValue(':id', $remoteId, \PDO::PARAM_INT);
+ $updateRemoteStatement->execute();
+ } else {
+ $deleteRemoteStatement->bindValue(':id', $remoteId, \PDO::PARAM_INT);
+ $deleteRemoteStatement->execute();
+ }
+ }
+}
|