Skip to content

Commit 88e46a8

Browse files
Thomas Vincentoz-agent
authored and
somethingwithproof
committed
hardening(mactrack): int-cast remaining numeric request-var SQL interpolations in view pages
The string filters in the view/report pages were already routed through db_qstr(); this closes the remaining raw interpolations of numeric request vars (site_id, device_id, status, vlan, authorized, host_id, graph_template_id, device_type_id) into WHERE clauses by casting them with (int) at the concatenation point. These are declared FILTER_VALIDATE_INT in each validate_store_request_vars() array, so this is defense-in-depth that removes reliance on upstream validation and matches the intval() approach already used in mactrack_get_devices(). 1.2.31-idiomatic, PHP 7.4-safe. Files: mactrack_view_{arp,ips,dot1x,interfaces,sites,graphs,macs}.php Co-Authored-By: Oz <oz-agent@warp.dev>
1 parent 97c9750 commit 88e46a8

7 files changed

Lines changed: 19 additions & 19 deletions

‎mactrack_view_arp.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -228,12 +228,12 @@ function mactrack_view_get_ip_records(&$sql_where, $rows, $apply_limits = true)
228228

229229
if ((get_request_var('site_id') != '-1')) {
230230
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') .
231-
' mti.site_id = ' . get_request_var('site_id');
231+
' mti.site_id = ' . (int) get_request_var('site_id');
232232
}
233233

234234
if ((get_request_var('device_id') != '-1')) {
235235
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') .
236-
' mti.device_id = ' . get_request_var('device_id');
236+
' mti.device_id = ' . (int) get_request_var('device_id');
237237
}
238238

239239
// prevent table scans, either a device or site must be selected

‎mactrack_view_dot1x.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -309,15 +309,15 @@ function mactrack_view_get_dot1x_records(&$sql_where, $rows, $apply_limits = tru
309309
}
310310

311311
if (get_request_var('site_id') != '-1') {
312-
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') . ' mtd.site_id = ' . get_request_var('site_id');
312+
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') . ' mtd.site_id = ' . (int) get_request_var('site_id');
313313
}
314314

315315
if (get_request_var('status') != '0') {
316-
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') . ' mtd.status = ' . get_request_var('status');
316+
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') . ' mtd.status = ' . (int) get_request_var('status');
317317
}
318318

319319
if (get_request_var('device_id') != '-1') {
320-
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') . ' mtd.device_id = ' . get_request_var('device_id');
320+
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') . ' mtd.device_id = ' . (int) get_request_var('device_id');
321321
}
322322

323323
if ((get_request_var('scan_date') != '1') && (get_request_var('scan_date') != '2')) {

‎mactrack_view_graphs.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -125,12 +125,12 @@ function mactrack_view_graphs() {
125125

126126
// Host Id sql_where
127127
if (get_filter_request_var('host_id') > 0) {
128-
$sql_where .= ($sql_where != '' ? ' AND' : '') . ' gl.host_id=' . get_request_var('host_id');
128+
$sql_where .= ($sql_where != '' ? ' AND' : '') . ' gl.host_id=' . (int) get_request_var('host_id');
129129
}
130130

131131
// Graph Template Id sql_where
132132
if (get_filter_request_var('graph_template_id') > 0) {
133-
$sql_where .= ($sql_where != '' ? ' AND' : '') . ' gl.graph_template_id=' . get_request_var('graph_template_id');
133+
$sql_where .= ($sql_where != '' ? ' AND' : '') . ' gl.graph_template_id=' . (int) get_request_var('graph_template_id');
134134
}
135135

136136
if (get_request_var('graphs') == '-1') {

‎mactrack_view_interfaces.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -567,7 +567,7 @@ function mactrack_filter_table() {
567567
$sql_where = '';
568568

569569
if (get_request_var('site_id') != -1) {
570-
$sql_where .= ' WHERE mac_track_devices.site_id=' . get_request_var('site_id');
570+
$sql_where .= ' WHERE mac_track_devices.site_id=' . (int) get_request_var('site_id');
571571
} else {
572572
$sql_where = '';
573573
}
@@ -602,11 +602,11 @@ function mactrack_filter_table() {
602602
$sql_where = '';
603603

604604
if (get_request_var('site_id') != -1) {
605-
$sql_where .= ($sql_where != '' ? ' AND ' : 'WHERE ') . 'site_id=' . get_request_var('site_id');
605+
$sql_where .= ($sql_where != '' ? ' AND ' : 'WHERE ') . 'site_id=' . (int) get_request_var('site_id');
606606
}
607607

608608
if (get_request_var('device_type_id') != '-1') {
609-
$sql_where .= ($sql_where != '' ? ' AND ' : 'WHERE ') . 'device_type_id=' . get_request_var('device_type_id');
609+
$sql_where .= ($sql_where != '' ? ' AND ' : 'WHERE ') . 'device_type_id=' . (int) get_request_var('device_type_id');
610610
}
611611

612612
$devices = array_rekey(db_fetch_assoc("SELECT device_id, device_name FROM mac_track_devices $sql_where ORDER BY device_name"), 'device_id', 'device_name');

‎mactrack_view_ips.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ function mactrack_view_export_ip_ranges() {
129129

130130
function mactrack_view_get_ip_range_records(&$sql_where, $rows, $apply_limits = true) {
131131
if (get_request_var('site_id') != '-1') {
132-
$sql_where = 'WHERE mtir.site_id = ' . get_request_var('site_id');
132+
$sql_where = 'WHERE mtir.site_id = ' . (int) get_request_var('site_id');
133133
} else {
134134
$sql_where = '';
135135
}

‎mactrack_view_macs.php‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -587,19 +587,19 @@ function mactrack_view_get_mac_records(&$sql_where, $rows, $apply_limits = true)
587587
}
588588

589589
if (get_request_var('authorized') != '-1') {
590-
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') . ' mtp.authorized = ' . get_request_var('authorized');
590+
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') . ' mtp.authorized = ' . (int) get_request_var('authorized');
591591
}
592592

593593
if (get_request_var('site_id') != '-1') {
594-
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') . ' mtp.site_id = ' . get_request_var('site_id');
594+
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') . ' mtp.site_id = ' . (int) get_request_var('site_id');
595595
}
596596

597597
if (get_request_var('vlan') != '-1') {
598-
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') . ' mtp.vlan_id = ' . get_request_var('vlan');
598+
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') . ' mtp.vlan_id = ' . (int) get_request_var('vlan');
599599
}
600600

601601
if (get_request_var('device_id') != '-1') {
602-
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') . ' mtp.device_id = ' . get_request_var('device_id');
602+
$sql_where .= ($sql_where != '' ? ' AND' : 'WHERE') . ' mtp.device_id = ' . (int) get_request_var('device_id');
603603
}
604604

605605
if ((get_request_var('scan_date') != '1') && (get_request_var('scan_date') != '2') && (get_request_var('scan_date') != '3')) {
@@ -1216,14 +1216,14 @@ function mactrack_mac_filter() {
12161216
$sql_where = '';
12171217

12181218
if (get_request_var('device_id') != '-1') {
1219-
$sql_where = 'WHERE device_id=' . get_request_var('device_id');
1219+
$sql_where = 'WHERE device_id=' . (int) get_request_var('device_id');
12201220
}
12211221

12221222
if (get_request_var('site_id') != '-1') {
12231223
if ($sql_where != '') {
1224-
$sql_where .= ' AND site_id=' . get_request_var('site_id');
1224+
$sql_where .= ' AND site_id=' . (int) get_request_var('site_id');
12251225
} else {
1226-
$sql_where = 'WHERE site_id=' . get_request_var('site_id');
1226+
$sql_where = 'WHERE site_id=' . (int) get_request_var('site_id');
12271227
}
12281228
}
12291229

‎mactrack_view_sites.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ function mactrack_view_get_site_records(&$sql_where, $rows, $apply_limits = true
106106
}
107107

108108
if ((get_request_var('site_id') != '-1') && (get_request_var('detail'))) {
109-
$sql_where = ($sql_where != '' ? ' AND ' : 'WHERE ') . '(mac_track_devices.site_id=' . get_request_var('site_id') . ')';
109+
$sql_where = ($sql_where != '' ? ' AND ' : 'WHERE ') . '(mac_track_devices.site_id=' . (int) get_request_var('site_id') . ')';
110110
}
111111

112112
$sql_order = get_order_string();

0 commit comments

Comments
 (0)