[patch] monshow info leak

[Dmitriy Kropivnitskiy]

This is a patch for monshow, to prevent it from letting people out of a 
view. If a person is restricted to a view,
all the links such as summary table will point to current view as 
opposed to generic view.

--- /usr/lib/mon/monshow        Thu Nov 20 12:44:46 2003
+++ monshow.cgi Wed Dec  3 12:41:04 2003
@@ -207,9 +207,11 @@
       if ($QUERY_ARGS{"watch"})
       {
-           $OUT_BUF .= <<EOB;
-       <a href="$ENV{SCRIPT_NAME}">Back to summary table</a><br>
-EOB
+           if ($GLOBAL->{"view-name"} ne "") {
+               $OUT_BUF .= "<a 
href=\"$ENV{SCRIPT_NAME}/$GLOBAL->{\"view-name\"}\">Back to summary 
table</a><br>";
+           } else {
+               $OUT_BUF .= "<a href=\"$ENV{SCRIPT_NAME}\">Back to 
summary table</a><br>";
+           }
       }
    }

@@ -1223,17 +1225,24 @@
               $bgcolor = "bgcolor=\"#$bgcolor\"";
           }
           $OUT_BUF .= <<EOF;
-
<tr $bgcolor>
   <td> $DEP </td>
-   <td> <a href="$ENV{SCRIPT_NAME}?watch=$GROUP">$GROUP</a> </td>
-   <td> <a href="$ENV{SCRIPT_NAME}?detail=$group,$service">$SERVICE</a> 
</td>
-   <td> <small>$DESC</small> </td>
-   <td> $TIME </td>
-   <td> $NEXT </td>
-   <td> $ALERTS </td>
-   <td> $STATUS </td>
-   <td> $SUMMARY </td>
+EOF
+
+           if ($GLOBAL->{"view-name"} ne "") {
+               $OUT_BUF .= "<td><a 
href=\"$ENV{SCRIPT_NAME}/$GLOBAL->{\"view-name\"}?watch=$GROUP\">$GROUP</a></td>";
+               $OUT_BUF .= "<td><a 
href=\"$ENV{SCRIPT_NAME}/$GLOBAL->{\"view-name\"}?detail=$group,$service\">$SERVICE</a></td>";
+           } else {
+               $OUT_BUF .= "<td><a 
href=\"$ENV{SCRIPT_NAME}?watch=$GROUP\">$GROUP</a></td>";
+               $OUT_BUF .= "<td><a 
href=\"$ENV{SCRIPT_NAME}?detail=$group,$service\">$SERVICE</a></td>";
+           }
+           $OUT_BUF .= <<EOF
+    <td> <small>$DESC</small> </td>
+    <td> $TIME </td>
+    <td> $NEXT </td>
+    <td> $ALERTS </td>
+    <td> $STATUS </td>
+    <td> $SUMMARY </td>
</tr>
EOF

@@ -1567,13 +1576,22 @@
           }
       }
-       $OUT_BUF .= <<EOF;
+       if ($GLOBAL->{"view-name"} ne "")
+       {
+          $OUT_BUF .= <<EOF;
<p>
-<a href="$ENV{SCRIPT_NAME}?watch=group">Back to $group table</a>
-<a href="$ENV{SCRIPT_NAME}">Back to summary table</a>
+<a href="$ENV{SCRIPT_NAME}/$GLOBAL->{"view-name"}?watch=group">Back to 
$group table</a>
+<a href="$ENV{SCRIPT_NAME}/$GLOBAL->{"view-name"}">Back to summary 
table</a>
+<p>
+EOF
+       } else {
+          $OUT_BUF .= <<EOF;
+<p>
+<a href="$ENV{SCRIPT_NAME}/$GLOBAL->{"view-name"}?watch=group">Back to 
$group table</a>
+<a href="$ENV{SCRIPT_NAME}/$GLOBAL->{"view-name"}">Back to summary 
table</a>
<p>
-
EOF
+       }
    }

    #

_______________________________________________
mon mailing list
[EMAIL PROTECTED]
http://linux.kernel.org/mailman/listinfo/mon