Skip to content

Commit

Permalink
phodevi: Input sanitization updates for Phoromatic Server
Browse files Browse the repository at this point in the history 
Also other code formatting / cleanups while reviewing the code...
  • Loading branch information
@michaellarabel
michaellarabel committed Jan 8, 2022
1 parent f70fa28 commit 56fd0a3
Show file tree
Hide file tree
Showing 37 changed files with 559 additions and 644 deletions.
4 changes: 4 additions & 0 deletions ChangeLog
View file
@@ -1,5 +1,9 @@
PHORONIX TEST SUITE CHANGE-LOG

Phoronix Test Suite (Git)

phodevi: Input sanitization updates for Phoromatic Server

Phoronix Test Suite 10.8.0
25 December 2021

Expand Down
2 changes: 1 addition & 1 deletion pts-core/objects/pts_env.php
View file
Expand Up @@ -650,7 +650,7 @@ public static function get_posted_options($limit = false)
}
if(!empty($v) && $v !== 0)
{
$posted[$var] = $v;
$posted[$var] = pts_strings::sanitize($v);
}
}
}
Expand Down
2 changes: 1 addition & 1 deletion pts-core/objects/pts_phoroql.php
View file
Expand Up @@ -22,7 +22,7 @@

class pts_phoroql
{
public static function evaluate_search_tree($tree, $join = 'AND', $callback)
public static function evaluate_search_tree($tree, $join = 'AND', $callback = '')
{
$matches = false;

Expand Down
16 changes: 6 additions & 10 deletions pts-core/objects/pts_result_viewer_embed.php
View file
Expand Up @@ -3,8 +3,8 @@
/*
Phoronix Test Suite
URLs: http://www.phoronix.com, http://www.phoronix-test-suite.com/
Copyright (C) 2018 - 2020, Phoronix Media
Copyright (C) 2018 - 2020, Michael Larabel
Copyright (C) 2018 - 2022, Phoronix Media
Copyright (C) 2018 - 2022, Michael Larabel
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
Expand Down Expand Up @@ -119,8 +119,8 @@ public function get_html()
$html_options = self::get_html_options_markup($result_file, $_REQUEST, $this->result_public_id, $this->can_delete_results);
self::process_request_to_attributes($_REQUEST, $result_file, $extra_attributes);
$PAGE .= self::get_html_sort_bar($result_file, $_REQUEST);
$PAGE .= '<h1 id="result_file_title" placeholder="Title">' . $result_file->get_title() . '</h1>';
$PAGE .= '<p id="result_file_desc" placeholder="Description">' . str_replace(PHP_EOL, '<br />', $result_file->get_description()) . '</p>';
$PAGE .= '<h1 id="result_file_title" placeholder="Title">' . pts_strings::sanitize($result_file->get_title()) . '</h1>';
$PAGE .= '<p id="result_file_desc" placeholder="Description">' . str_replace(PHP_EOL, '<br />', pts_strings::sanitize($result_file->get_description())) . '</p>';
$PAGE .= '<div id="result-settings">';
if($this->can_modify_results)
{
Expand Down Expand Up @@ -412,8 +412,6 @@ public function get_html()
}
}

// $PAGE .= $res . '<br />';

//
// DISPLAY LOGS
//
Expand All @@ -430,7 +428,6 @@ public function get_html()
$button_area .= ' <button onclick="javascript:display_install_logs_for_result_object(\'' . $this->result_public_id . '\', \'' . $i . '\'); return false;">View Test Installation Logs</button> ';
}


//
// EDITING / DELETE OPTIONS
//
Expand All @@ -452,12 +449,12 @@ public function get_html()
}
else
{
$PAGE .= '<div id="update_annotation_' . $i . '" contentEditable="true">' . $result_object->get_annotation() . '</div> <input type="submit" value="Update Annotation" onclick="javascript:update_annotation_for_result_object(\'' . $this->result_public_id . '\', \'' . $i . '\'); return false;">';
$PAGE .= '<div id="update_annotation_' . $i . '" contentEditable="true">' . pts_strings::sanitize($result_object->get_annotation()) . '</div> <input type="submit" value="Update Annotation" onclick="javascript:update_annotation_for_result_object(\'' . $this->result_public_id . '\', \'' . $i . '\'); return false;">';
}
}
else
{
$PAGE .= '<p class="mini">' . $result_object->get_annotation() . '</p>';
$PAGE .= '<p class="mini">' . pts_strings::sanitize($result_object->get_annotation()) . '</p>';
}
if($button_area != null)
{
Expand Down Expand Up @@ -1023,7 +1020,6 @@ public static function process_result_export_pre_render(&$request, &$result_file
}
public static function process_result_modify_pre_render(&$result_file, $can_modify_results = false, $can_delete_results = false)
{

if(!isset($_REQUEST['modify']) || ($can_modify_results == false && $can_delete_results == false))
{
return;
Expand Down
4 changes: 0 additions & 4 deletions pts-core/phoromatic/pages/phoromatic_account_activity.php
View file
Expand Up @@ -20,7 +20,6 @@
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/


class phoromatic_account_activity implements pts_webui_interface
{
public static function page_title()
Expand All @@ -37,9 +36,7 @@ public static function preload($PAGE)
}
public static function render_page_process($PATH)
{

$main = '<h1>Recent Account Activity</h1>';

$stmt = phoromatic_server::$db->prepare('SELECT * FROM phoromatic_activity_stream WHERE AccountID = :account_id ORDER BY ActivityTime DESC');
$stmt->bindValue(':account_id', $_SESSION['AccountID']);
$result = $stmt->execute();
Expand Down Expand Up @@ -122,7 +119,6 @@ public static function render_page_process($PATH)
$main .= ': ' . $id_link_format;

$main .= '<br />' . PHP_EOL;

}

//$main .= '<p>' . $row['ActivityCreator'] . ' ' . $row['ActivityCreatorType'] . ' ' . $row['ActivityEvent'] . ' ' . $row['ActivityEventID'] . ' ' . $row['ActivityEventType'] . '</p>';
Expand Down
8 changes: 4 additions & 4 deletions pts-core/phoromatic/pages/phoromatic_admin.php
View file
Expand Up @@ -3,8 +3,8 @@
/*
Phoronix Test Suite
URLs: http://www.phoronix.com, http://www.phoronix-test-suite.com/
Copyright (C) 2014 - 2018, Phoronix Media
Copyright (C) 2014 - 2018, Michael Larabel
Copyright (C) 2014 - 2022, Phoronix Media
Copyright (C) 2014 - 2022, Michael Larabel
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
Expand All @@ -20,7 +20,6 @@
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/


class phoromatic_admin implements pts_webui_interface
{
public static function page_title()
Expand Down Expand Up @@ -71,10 +70,12 @@ public static function render_page_process($PATH)
}
else if(isset($_POST['register_username']) && isset($_POST['register_password']) && isset($_POST['register_password_confirm']) && isset($_POST['register_email']))
{
phoromatic_quit_if_invalid_input_found(array('register_username', 'register_password', 'register_password_confirm', 'register_email', 'seed_accountid'));
$new_account = create_new_phoromatic_account($_POST['register_username'], $_POST['register_password'], $_POST['register_password_confirm'], $_POST['register_email'], (isset($_POST['seed_accountid']) ? $_POST['seed_accountid'] : null));
}
else if(isset($_POST['email_all_subject']) && isset($_POST['email_all_message']) && !empty($_POST['email_all_message']))
{
phoromatic_quit_if_invalid_input_found(array('email_all_subject', 'email_all_message'));
$stmt = phoromatic_server::$db->prepare('SELECT * FROM phoromatic_users ORDER BY UserName ASC');
$result = $stmt->execute();

Expand Down Expand Up @@ -207,7 +208,6 @@ public static function render_page_process($PATH)
<sup>4</sup> The account ID field is optional and is used to pre-seed the account identifier for advanced purposes. The field must be six characters. Leave this field blank if you are unsure.<br />
</p>';


//
$server_log = explode(PHP_EOL, file_get_contents(getenv('PTS_PHOROMATIC_LOG_LOCATION')));
foreach($server_log as $i => $line_item)
Expand Down
1 change: 0 additions & 1 deletion pts-core/phoromatic/pages/phoromatic_admin_config.php
View file
Expand Up @@ -20,7 +20,6 @@
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/


class phoromatic_admin_config implements pts_webui_interface
{
public static function page_title()
Expand Down
16 changes: 6 additions & 10 deletions pts-core/phoromatic/pages/phoromatic_admin_data.php
View file
Expand Up @@ -20,7 +20,6 @@
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/


class phoromatic_admin_data implements pts_webui_interface
{
public static function page_title()
Expand Down Expand Up @@ -144,7 +143,7 @@ public static function render_page_process($PATH)
$results = 0;
while($test_result_row = $test_result_result->fetchArray())
{
$main .= '<a onclick=""><li id="result_select_' . $test_result_row['PPRID'] . '"><input type="checkbox" id="result_compare_checkbox_' . $test_result_row['PPRID'] . '" onclick="javascript:phoromatic_checkbox_toggle_result_comparison(\'' . $test_result_row['PPRID'] . '\');" onchange="return false;"></input> <span onclick="javascript:phoromatic_window_redirect(\'public.php?ut=' . $test_result_row['PPRID'] . '\');">' . $test_result_row['Title'] . '</span><br /><table><tr><td>' . phoromatic_system_id_to_name($test_result_row['SystemID'], $test_result_row['AccountID']) . '</td><td>' . phoromatic_user_friendly_timedate($test_result_row['UploadTime']) . '</td><td>' . $test_result_row['TimesViewed'] . ' Times Viewed</td></table></li></a>';
$main .= '<a onclick=""><li id="result_select_' . $test_result_row['PPRID'] . '"><input type="checkbox" id="result_compare_checkbox_' . $test_result_row['PPRID'] . '" onclick="javascript:phoromatic_checkbox_toggle_result_comparison(\'' . $test_result_row['PPRID'] . '\');" onchange="return false;"></input> <span onclick="javascript:phoromatic_window_redirect(\'public.php?ut=' . $test_result_row['PPRID'] . '\');">' . $test_result_row['Title'] . '</span><br /><table><tr><td>' . phoromatic_server::system_id_to_name($test_result_row['SystemID'], $test_result_row['AccountID']) . '</td><td>' . phoromatic_user_friendly_timedate($test_result_row['UploadTime']) . '</td><td>' . $test_result_row['TimesViewed'] . ' Times Viewed</td></table></li></a>';
$results++;

}
Expand All @@ -154,7 +153,6 @@ public static function render_page_process($PATH)
}
$main .= '</ul></div>';
$main .= '</div>';

$main .= '<hr /><h1>Schedules</h1>';
$main .= '<h2>Active Test Schedules</h2>';
$main .= '<div class="pts_phoromatic_info_box_area">
Expand All @@ -173,12 +171,11 @@ public static function render_page_process($PATH)
do
{

$main .= '<a onclick=""><li>' . $row['Title'] . '<br /><table><tr><td>' . phoromatic_account_id_to_group_name($row['AccountID']) . '</td><td>' . pts_strings::plural_handler(count(phoromatic_server::systems_associated_with_schedule($row['AccountID'], $row['ScheduleID'])), 'System') . '</td><td><strong>' . phoromatic_schedule_activeon_string($row['ActiveOn'], $row['RunAt']) . '</strong></td><td><a onclick="return confirm(\'Permanently remove this schedule?\');" href="/?admin_data/delete/schedule/' . $row['AccountID'] . '/' . $row['ScheduleID'] . '">Permanently Remove</a></td></tr></table></li></a>';
$main .= '<a onclick=""><li>' . $row['Title'] . '<br /><table><tr><td>' . phoromatic_server::account_id_to_group_name($row['AccountID']) . '</td><td>' . pts_strings::plural_handler(count(phoromatic_server::systems_associated_with_schedule($row['AccountID'], $row['ScheduleID'])), 'System') . '</td><td><strong>' . phoromatic_schedule_activeon_string($row['ActiveOn'], $row['RunAt']) . '</strong></td><td><a onclick="return confirm(\'Permanently remove this schedule?\');" href="/?admin_data/delete/schedule/' . $row['AccountID'] . '/' . $row['ScheduleID'] . '">Permanently Remove</a></td></tr></table></li></a>';
}
while($row = $result->fetchArray());
}
$main .= '</ul></div>';

$main .= '<hr /><h2>Inactive Test Schedules</h2>';
$main .= '<div class="pts_phoromatic_info_box_area">
<ul>
Expand All @@ -196,7 +193,7 @@ public static function render_page_process($PATH)
do
{

$main .= '<a onclick=""><li>' . $row['Title'] . '<br /><table><tr><td>' . phoromatic_account_id_to_group_name($row['AccountID']) . '</td><td>' . pts_strings::plural_handler(count(phoromatic_server::systems_associated_with_schedule($row['AccountID'], $row['ScheduleID'])), 'System') . '</td><td><strong>' . phoromatic_schedule_activeon_string($row['ActiveOn'], $row['RunAt']) . '</strong></td><td><a onclick="return confirm(\'Permanently remove this schedule?\');" href="/?admin_data/delete/schedule/' . $row['AccountID'] . '/' . $row['ScheduleID'] . '">Permanently Remove</a></td></tr></table></li></a>';
$main .= '<a onclick=""><li>' . $row['Title'] . '<br /><table><tr><td>' . phoromatic_server::account_id_to_group_name($row['AccountID']) . '</td><td>' . pts_strings::plural_handler(count(phoromatic_server::systems_associated_with_schedule($row['AccountID'], $row['ScheduleID'])), 'System') . '</td><td><strong>' . phoromatic_schedule_activeon_string($row['ActiveOn'], $row['RunAt']) . '</strong></td><td><a onclick="return confirm(\'Permanently remove this schedule?\');" href="/?admin_data/delete/schedule/' . $row['AccountID'] . '/' . $row['ScheduleID'] . '">Permanently Remove</a></td></tr></table></li></a>';
}
while($row = $result->fetchArray());
}
Expand All @@ -219,7 +216,7 @@ public static function render_page_process($PATH)
do
{

$main .= '<a onclick=""><li>' . $row['Trigger'] . '<br /><table><tr><td>' . $row['TriggeredOn'] . '</td><td>' . phoromatic_account_id_to_group_name($row['AccountID']) . '</td><td><a onclick="return confirm(\'Permanently remove this trigger?\');" href="/?admin_data/delete/trigger/' . $row['AccountID'] . '/' . $row['ScheduleID'] . '/' . $row['Trigger'] . '">Permanently Remove</a></td></tr></table></li></a>';
$main .= '<a onclick=""><li>' . $row['Trigger'] . '<br /><table><tr><td>' . $row['TriggeredOn'] . '</td><td>' . phoromatic_server::account_id_to_group_name($row['AccountID']) . '</td><td><a onclick="return confirm(\'Permanently remove this trigger?\');" href="/?admin_data/delete/trigger/' . $row['AccountID'] . '/' . $row['ScheduleID'] . '/' . $row['Trigger'] . '">Permanently Remove</a></td></tr></table></li></a>';
}
while($row = $result->fetchArray());
}
Expand All @@ -245,7 +242,7 @@ public static function render_page_process($PATH)
{
do
{
$main .= '<a onclick=""><li>' . $row['Title'] . '<br /><table><tr><td>' . phoromatic_account_id_to_group_name($row['AccountID']) . '</td><td>' . $row['LocalIP'] . '</td><td><strong>' . $row['CurrentTask'] . '</strong></td><td><strong>Last Communication:</strong> ' . date('j F Y H:i', strtotime($row['LastCommunication'])) . '</td><td><a onclick="return confirm(\'Permanently remove this system?\');" href="/?admin_data/delete/system/' . $row['AccountID'] . '/' . $row['SystemID'] . '">Permanently Remove</a></td></tr></table></li></a>';
$main .= '<a onclick=""><li>' . $row['Title'] . '<br /><table><tr><td>' . phoromatic_server::account_id_to_group_name($row['AccountID']) . '</td><td>' . $row['LocalIP'] . '</td><td><strong>' . $row['CurrentTask'] . '</strong></td><td><strong>Last Communication:</strong> ' . date('j F Y H:i', strtotime($row['LastCommunication'])) . '</td><td><a onclick="return confirm(\'Permanently remove this system?\');" href="/?admin_data/delete/system/' . $row['AccountID'] . '/' . $row['SystemID'] . '">Permanently Remove</a></td></tr></table></li></a>';
$active_system_count++;
}
while($row = $result->fetchArray());
Expand All @@ -255,7 +252,6 @@ public static function render_page_process($PATH)
$main .= '</ul></div>';
$main .= '<h2>Inactive Systems</h2>
<div class="pts_phoromatic_info_box_area">
<ul>
<li><h1>Inactive Systems</h1></li>';

Expand All @@ -272,7 +268,7 @@ public static function render_page_process($PATH)
{
do
{
$main .= '<a onclick=""><li>' . $row['Title'] . '<br /><table><tr><td>' . phoromatic_account_id_to_group_name($row['AccountID']) . '</td><td>' . $row['LocalIP'] . '</td><td><strong>' . $row['CurrentTask'] . '</strong></td><td><strong>Last Communication:</strong> ' . date('j F Y H:i', strtotime($row['LastCommunication'])) . '</td><td><a onclick="return confirm(\'Permanently remove this system?\');" href="/?admin_data/delete/system/' . $row['AccountID'] . '/' . $row['SystemID'] . '">Permanently Remove</a></td></tr></table></li></a>';
$main .= '<a onclick=""><li>' . $row['Title'] . '<br /><table><tr><td>' . phoromatic_server::account_id_to_group_name($row['AccountID']) . '</td><td>' . $row['LocalIP'] . '</td><td><strong>' . $row['CurrentTask'] . '</strong></td><td><strong>Last Communication:</strong> ' . date('j F Y H:i', strtotime($row['LastCommunication'])) . '</td><td><a onclick="return confirm(\'Permanently remove this system?\');" href="/?admin_data/delete/system/' . $row['AccountID'] . '/' . $row['SystemID'] . '">Permanently Remove</a></td></tr></table></li></a>';
$active_system_count++;
}
while($row = $result->fetchArray());
Expand Down
14 changes: 4 additions & 10 deletions pts-core/phoromatic/pages/phoromatic_benchmark.php
View file
Expand Up @@ -3,8 +3,8 @@
/*
Phoronix Test Suite
URLs: http://www.phoronix.com, http://www.phoronix-test-suite.com/
Copyright (C) 2015 - 2021, Phoronix Media
Copyright (C) 2015 - 2021, Michael Larabel
Copyright (C) 2015 - 2022, Phoronix Media
Copyright (C) 2015 - 2022, Michael Larabel
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
Expand All @@ -20,7 +20,6 @@
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/


class phoromatic_benchmark implements pts_webui_interface
{
public static function page_title()
Expand Down Expand Up @@ -141,7 +140,6 @@ public static function render_page_process($PATH)
}

$main .= '</ol>';

if(!empty($row['EnvironmentVariables']))
{
$main .= '<hr /><h1>Environment</h1><ol>';
Expand All @@ -152,7 +150,6 @@ public static function render_page_process($PATH)
}
$main .= '</ol>';
}

$main .= '<hr /><h1>Ticket Payload</h1>';
$main .= '<p>This ticket runs the <strong>' . $row['SuiteToRun'] . '</strong> test suite:</p>';
$main .= '<div style="max-height: 400px; overflow-y: scroll;">';
Expand Down Expand Up @@ -236,7 +233,7 @@ public static function render_page_process($PATH)
$results = 0;
while($test_result_row = $test_result_result->fetchArray())
{
$main .= '<a onclick=""><li id="result_select_' . $test_result_row['PPRID'] . '"><input type="checkbox" id="result_compare_checkbox_' . $test_result_row['PPRID'] . '" onclick="javascript:phoromatic_checkbox_toggle_result_comparison(\'' . $test_result_row['PPRID'] . '\');" onchange="return false;"></input> <span onclick="javascript:phoromatic_window_redirect(\'?result/' . $test_result_row['PPRID'] . '\');">' . $test_result_row['Title'] . '</span><br /><table><tr><td>' . phoromatic_system_id_to_name($test_result_row['SystemID']) . '</td><td>' . phoromatic_user_friendly_timedate($test_result_row['UploadTime']) . '</td><td>' . $test_result_row['TimesViewed'] . ' Times Viewed</td></table></li></a>';
$main .= '<a onclick=""><li id="result_select_' . $test_result_row['PPRID'] . '"><input type="checkbox" id="result_compare_checkbox_' . $test_result_row['PPRID'] . '" onclick="javascript:phoromatic_checkbox_toggle_result_comparison(\'' . $test_result_row['PPRID'] . '\');" onchange="return false;"></input> <span onclick="javascript:phoromatic_window_redirect(\'?result/' . $test_result_row['PPRID'] . '\');">' . $test_result_row['Title'] . '</span><br /><table><tr><td>' . phoromatic_server::system_id_to_name($test_result_row['SystemID']) . '</td><td>' . phoromatic_user_friendly_timedate($test_result_row['UploadTime']) . '</td><td>' . $test_result_row['TimesViewed'] . ' Times Viewed</td></table></li></a>';
$results++;

}
Expand Down Expand Up @@ -338,10 +335,8 @@ public static function render_page_process($PATH)
}
}

$main = '
<h2>' . ($is_new ? 'Create' : 'Edit') . ' A Benchmark</h2>
$main = '<h2>' . ($is_new ? 'Create' : 'Edit') . ' A Benchmark</h2>
<p>This page allows you to run a test suite -- consisting of a single or multiple test suites -- on a given set/group of systems right away at their next earliest possibility. This benchmark mode is an alternative to the <a href="?schedules">benchmark schedules</a> for reptitive/routine testing.</p>';

$local_suites = array();
foreach(pts_file_io::glob(phoromatic_server::phoromatic_account_suite_path($_SESSION['AccountID']) . '*/suite-definition.xml') as $xml_path)
{
Expand Down Expand Up @@ -384,7 +379,6 @@ public static function render_page_process($PATH)
$stmt->bindValue(':account_id', $_SESSION['AccountID']);
$result = $stmt->execute();


if(!$is_new)
{
$e_schedule['RunTargetSystems'] = explode(',', $e_schedule['RunTargetSystems']);
Expand Down

0 comments on commit 56fd0a3

Please sign in to comment.