Skip to content

fix: use prepared statements for device-reported values and require POST for admin actions #401

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheWitness merged 2 commits into from
Oct 23, 2026
Merged

fix: use prepared statements for device-reported values and require POST for admin actions #401

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f12373e
fix: use prepared statements for device-reported values
somethingwithproof Oct 23, 2026
a03f90f
fix: require POST for the admin device and site actions
somethingwithproof Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
* security: Restrict Net_DNS2 cache deserialization to DNS response classes
* security: Remove all inline JavaScript handlers like onClick, onChange
* security: Add a version-safe CSP nonce (`plugin_mactrack_csp_nonce()`) to every inline `<script>` tag
* security: Require POST for the device rescan, site scan, enable and disable actions
* issue#246: Fix Cisco device collection
* issue#248: Cacti process control, terminate dns resolvet when is nothing to do
* issue#250: Disable automatic MIBs load
Expand All @@ -27,6 +28,7 @@
* issue: Pin the CI database image and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime
* issue: Reach PHPStan level 8 with zero errors across all first-party PHP and add native function return type declarations, using no baselines or inline suppressions
* issue: Use prepared statements for all vendor collection
* issue: Use prepared statements for device-reported values in the interface, ARP, DHCP snooping and 802.1x scanners
* issue: Fix a variable-variable typo that broke 3Com interface-graph mac updates
* issue: Return the rendered device-row HTML from the enable/disable AJAX handlers, which previously captured an always-null value
* issue: Decode MAC/IP OIDs as hex in the Extreme scanner by correcting a misplaced xform_stripped_oid() argument
Expand Down
23 changes: 18 additions & 5 deletions js/mactrack.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,38 +26,47 @@ var url
function scan_device(device_id) {
url = urlPath + 'plugins/mactrack/mactrack_ajax_admin.php?action=rescan&device_id=' + device_id
$('#r_' + device_id).find('i').addClass('fa-spin');
$.getJSON(url, function(data) {
$.post(url, { __csrf_magic: csrfMagicToken }, function(data) {
type = data.type;
device_id = data.device_id;
content = data.content;
$('#r_' + device_id).find('i').removeClass('fa-spin');
$('#response').hide().html(content).dialog({ width: 800, maxHeight: 500 });
}, 'json').fail(function(data) {
$('#r_' + device_id).find('i').removeClass('fa-spin');
getPresentHTTPError(data);
});
}

function site_scan(site_id) {
url = urlPath + 'plugins/mactrack/mactrack_ajax_admin.php?action=site_scan&site_id=' + site_id;
$('#r_' + site_id).find('i').addClass('fa-spin');
$.getJSON(url, function(data) {
$.post(url, { __csrf_magic: csrfMagicToken }, function(data) {
var type = data.type;
var site_id = data.site_id
var content = data.content;
$('#r_' + site_id).find('i').removeClass('fa-spin');
$('#response').hide().html(content).dialog({ width: 800, maxHeight: 500 });
}, 'json').fail(function(data) {
$('#r_' + site_id).find('i').removeClass('fa-spin');
getPresentHTTPError(data);
});
}

function scan_device_interface(device_id, ifIndex) {
url = urlPath + 'plugins/mactrack/mactrack_ajax_admin.php?action=rescan&device_id=' + device_id + '&ifIndex=' + ifIndex;
$('#r_' + device_id + '_' + ifIndex).find('i').addClass('fa-spin');

$.getJSON(url, function(data) {
$.post(url, { __csrf_magic: csrfMagicToken }, function(data) {
var type = data.type;
var device_id = data.device_id;
var ifIndex = data.ifIndex;
var content = data.content;
$('#r_' + device_id + '_' + ifIndex).find('i').removeClass('fa-spin');
$('#response').hide().html(content).dialog({ width: 800, maxHeight: 500 });
}, 'json').fail(function(data) {
$('#r_' + device_id + '_' + ifIndex).find('i').removeClass('fa-spin');
getPresentHTTPError(data);
});
}

Expand All @@ -67,21 +76,25 @@ function clearScanResults() {

function disable_device(device_id) {
url=urlPath + 'plugins/mactrack/mactrack_ajax_admin.php?action=disable&device_id=' + device_id;
$.getJSON(url, function(data) {
$.post(url, { __csrf_magic: csrfMagicToken }, function(data) {
var type = data.type;
var device_id = data.device_id;
var content = data.content;
$('#line_' + device_id).html(content);
}, 'json').fail(function(data) {
getPresentHTTPError(data);
});
}

function enable_device(device_id) {
url=urlPath + 'plugins/mactrack/mactrack_ajax_admin.php?action=enable&device_id=' + device_id;
$.getJSON(url, function(data) {
$.post(url, { __csrf_magic: csrfMagicToken }, function(data) {
var type = data.type;
var device_id = data.device_id;
var content = data.content;
$('#line_' + device_id).html(content);
}, 'json').fail(function(data) {
getPresentHTTPError(data);
});
}

Expand Down
27 changes: 15 additions & 12 deletions lib/mactrack_aruba_oscx.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -517,24 +517,27 @@ function get_aruba_oscx_arp_table($site, &$device): void {

// output details to database
if (cacti_sizeof($result)) {
$sql = [];
$sql = [];
$params = [];

foreach ($result as $key=>$value) {
$sql[] = '(' .
$device['site_id'] . ', ' .
$device['device_id'] . ', ' .
db_qstr($device['hostname']) . ', ' .
db_qstr($device['device_name']) . ', ' .
db_qstr($value['port']) . ', ' .
db_qstr($value['mac']) . ', ' .
db_qstr($key) . ', ' .
db_qstr($scan_date) . ')';
$sql[] = '(?, ?, ?, ?, ?, ?, ?, ?)';

array_push($params,
$device['site_id'],
$device['device_id'],
$device['hostname'],
$device['device_name'],
$value['port'],
$value['mac'],
$key,
$scan_date);
}

if (cacti_sizeof($sql)) {
db_execute('REPLACE INTO mac_track_ips
db_execute_prepared('REPLACE INTO mac_track_ips
(site_id, device_id, hostname, device_name, port_number, mac_address,ip_address,scan_date)
VALUES ' . implode(', ', $sql));
VALUES ' . implode(', ', $sql), $params);
}
}

Expand Down
75 changes: 40 additions & 35 deletions lib/mactrack_cisco.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -764,20 +764,20 @@ function get_cisco_dhcpsnooping_table($site, &$device): void {
if (cacti_sizeof($cdsBindingEntries)) {
foreach ($cdsBindingEntries as $cdsBindingEntry) {
if ($cdsBindingEntry['cdsBindingsIpAddress'] != '') { // It's acceptable to have IPs without a MAC (meaning that MAC is not present but DHCP entry is still present) here but not the other way around.
$insert_string = 'REPLACE INTO mac_track_ips
db_execute_prepared('REPLACE INTO mac_track_ips
(site_id,device_id,hostname,device_name,port_number,
mac_address,ip_address,scan_date)
VALUES (' .
$device['site_id'] . ',' .
$device['device_id'] . ',' .
db_qstr($device['hostname']) . ',' .
db_qstr($device['device_name']) . ',' .
db_qstr($cdsBindingEntry['cdsBindingIndex']) . ',' .
db_qstr($cdsBindingEntry['dot1dTpFdbEntry']) . ',' .
db_qstr($cdsBindingEntry['cdsBindingsIpAddress']) . ',' .
db_qstr($scan_date) . ')';

db_execute($insert_string);
VALUES (?, ?, ?, ?, ?, ?, ?, ?)',
[
$device['site_id'],
$device['device_id'],
$device['hostname'],
$device['device_name'],
$cdsBindingEntry['cdsBindingIndex'],
$cdsBindingEntry['dot1dTpFdbEntry'],
$cdsBindingEntry['cdsBindingsIpAddress'],
$scan_date
]);
}
}
}
Expand Down Expand Up @@ -812,20 +812,21 @@ function get_cisco_vrf_arp_table($site, &$device): void {
// output details to database
if (cacti_sizeof($cdsBindingEntries)) {
foreach ($cdsBindingEntries as $cdsBindingEntry) {
$insert_string = 'INSERT INTO mac_track_arp
db_execute_prepared('INSERT INTO mac_track_arp
(site_id,ip_address,mac_address,scan_date)
VALUES
(' .
$device['site_id'] . ',' .
db_qstr($cdsBindingEntry['key']) . ',' .
db_qstr($cdsBindingEntry['value']) . ',' .
db_qstr($scan_date) . '
)
(?, ?, ?, ?)
ON DUPLICATE KEY UPDATE
`ip_address` = ' . db_qstr($cdsBindingEntry['key']) . ',
`scan_date` = ' . db_qstr($scan_date) . ';';

db_execute($insert_string);
`ip_address` = ?,
`scan_date` = ?',
[
$device['site_id'],
$cdsBindingEntry['key'],
$cdsBindingEntry['value'],
$scan_date,
$cdsBindingEntry['key'],
$scan_date
]);
}
}

Expand Down Expand Up @@ -901,29 +902,33 @@ function get_cisco_dot1x_table($site, &$device): void {

// output details to database
$sql = [];
$params = [];
$prefix = 'REPLACE INTO mac_track_dot1x
(site_id, device_id, hostname, device_name, username, mac_address, ip_address, domain, status, port_number, scan_date)
VALUES ';

if (cacti_sizeof($entries)) {
foreach ($entries as $entry) {
if ($entry['UserName'] != '') {
$sql[] = '(' . $device['site_id'] . ',' .
$device['device_id'] . ',' .
db_qstr($device['hostname']) . ',' .
db_qstr($device['device_name']) . ',' .
db_qstr($entry['UserName']) . ',' .
db_qstr($entry['cafSessionClientMacAddress']) . ',' .
db_qstr($entry['cafSessionClientAddress']) . ',' .
db_qstr($entry['cafSessionDomain']) . ',' .
db_qstr($entry['cafSessionStatus']) . ',' .
db_qstr($entry['port_number']) . ',' .
db_qstr($scan_date) . ')';
$sql[] = '(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)';

array_push($params,
$device['site_id'],
$device['device_id'],
$device['hostname'],
$device['device_name'],
$entry['UserName'],
$entry['cafSessionClientMacAddress'],
$entry['cafSessionClientAddress'],
$entry['cafSessionDomain'],
$entry['cafSessionStatus'],
$entry['port_number'],
$scan_date);
}
}

if (cacti_sizeof($sql)) {
db_execute($prefix . implode(', ', $sql));
db_execute_prepared($prefix . implode(', ', $sql), $params);
}
}
}
27 changes: 15 additions & 12 deletions lib/mactrack_enterasys_N7.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -535,28 +535,31 @@ function get_CTAlias_table($site, &$device): void {

// output details to database
if (cacti_sizeof($CTAliasEntries)) {
$sql = [];
$sql = [];
$params = [];

foreach ($CTAliasEntries as $CTAliasEntry) {
// drop non-IP protocols
if ($CTAliasEntry['CTAliasProtocol'] != 1) {
continue;
}

$sql[] = '(' .
$device['site_id'] . ', ' .
$device['device_id'] . ', ' .
db_qstr($device['hostname']) . ', ' .
db_qstr($device['device_name']) . ', ' .
db_qstr($CTAliasEntry['ifIndex']) . ', ' .
db_qstr($CTAliasEntry['CTAliasMacAddress']) . ', ' .
db_qstr($CTAliasEntry['CTAliasAddressText']) . ', ' .
db_qstr($scan_date) . ')';
$sql[] = '(?, ?, ?, ?, ?, ?, ?, ?)';

array_push($params,
$device['site_id'],
$device['device_id'],
$device['hostname'],
$device['device_name'],
$CTAliasEntry['ifIndex'],
$CTAliasEntry['CTAliasMacAddress'],
$CTAliasEntry['CTAliasAddressText'],
$scan_date);
}

db_execute('REPLACE INTO mac_track_ips
db_execute_prepared('REPLACE INTO mac_track_ips
(site_id,device_id,hostname,device_name,port_number, mac_address,ip_address,scan_date)
VALUES ' . implode(', ', $sql));
VALUES ' . implode(', ', $sql), $params);
}

// save ip information for the device
Expand Down
27 changes: 15 additions & 12 deletions lib/mactrack_extreme.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -348,24 +348,27 @@ function get_extreme_arp_table($site, &$device, $extremeware = false): void {

// output details to database
if (cacti_sizeof($atEntries)) {
$sql = [];
$sql = [];
$params = [];

foreach ($atEntries as $atEntry) {
$sql[] = '(' .
$device['site_id'] . ', ' .
$device['device_id'] . ', ' .
db_qstr($device['hostname']) . ', ' .
db_qstr($device['device_name']) . ', ' .
db_qstr($atEntry['atifIndex']) . ', ' .
db_qstr($atEntry['atPhysAddress']) . ', ' .
db_qstr($atEntry['atNetAddress']) . ', ' .
db_qstr($scan_date) . ')';
$sql[] = '(?, ?, ?, ?, ?, ?, ?, ?)';

array_push($params,
$device['site_id'],
$device['device_id'],
$device['hostname'],
$device['device_name'],
$atEntry['atifIndex'],
$atEntry['atPhysAddress'],
$atEntry['atNetAddress'],
$scan_date);
}

if (cacti_sizeof($sql)) {
db_execute('REPLACE INTO mac_track_ips
db_execute_prepared('REPLACE INTO mac_track_ips
(site_id, device_id, hostname, device_name, port_number, mac_address,ip_address,scan_date)
VALUES ' . implode(', ', $sql));
VALUES ' . implode(', ', $sql), $params);
}
}

Expand Down
Loading
Loading