Skip to content

fix(thold): correct trigger_cmd variable references for low/normal states #765

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
somethingwithproof wants to merge 2 commits into from
+24 −22
Closed

fix(thold): correct trigger_cmd variable references for low/normal states #765

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ecca352
fix(hardening): migrate RLIKE to db_qstr for SQL injection prevention
somethingwithproof Apr 9, 2026
5fda692
fix(thold): correct trigger_cmd variable references for low/normal st…
somethingwithproof Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 16 additions & 14 deletions notify_lists.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1399,7 +1399,7 @@ function tholds($header_label) {
}

if (strlen(get_request_var('rfilter'))) {
$sql_where .= (!strlen($sql_where) ? '' : ' AND ') . "td.name_cache RLIKE '" . get_request_var('rfilter') . "'";
$sql_where .= (!strlen($sql_where) ? '' : ' AND ') . "td.name_cache RLIKE " . db_qstr(get_request_var('rfilter')) . "";
Copy link

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This concatenation ends with . "", which is a no-op and makes the SQL assembly harder to read. Consider removing the trailing empty-string concatenation.

Suggested change
$sql_where .= (!strlen($sql_where) ? '' : ' AND ') . "td.name_cache RLIKE " . db_qstr(get_request_var('rfilter')) . "";
$sql_where .= (!strlen($sql_where) ? '' : ' AND ') . 'td.name_cache RLIKE ' . db_qstr(get_request_var('rfilter'));

Copilot uses AI. Check for mistakes.
}

if ($statefilter != '') {
Expand Down Expand Up @@ -1730,16 +1730,18 @@ function templates($header_label) {
$rows = get_request_var('rows');
}

$sql_where = '';
$sql_order = get_order_string();
$sql_limit = ' LIMIT ' . ($rows * (intval(get_request_var('page')) - 1)) . ',' . $rows;
$sql_where = '';
$sql_params = array();
$sql_order = get_order_string();
$sql_limit = ' LIMIT ' . ($rows * (intval(get_request_var('page')) - 1)) . ',' . $rows;

if (get_request_var('associated') == 'true') {
$sql_where .= (!strlen($sql_where) ? 'WHERE ' : ' AND ') . '(notify_warning=' . get_request_var('id') . ' OR notify_alert=' . get_request_var('id') . ')';
}

if (strlen(get_request_var('rfilter'))) {
$sql_where .= (!strlen($sql_where) ? 'WHERE ' : ' AND ') . "thold_template.name RLIKE '" . get_request_var('rfilter') . "'";
$sql_where .= (!strlen($sql_where) ? 'WHERE ' : ' AND ') . 'thold_template.name RLIKE ?';
$sql_params[] = get_request_var('rfilter');
}

$sql = "SELECT *
Expand All @@ -1748,7 +1750,7 @@ function templates($header_label) {
$sql_order
$sql_limit";

$result = db_fetch_assoc($sql);
$result = db_fetch_assoc_prepared($sql, $sql_params);

html_start_box(__('Associated Templates', 'thold') . ' ' . html_escape($header_label), '100%', false, '3', 'center', '');
?>
Expand Down Expand Up @@ -2142,24 +2144,24 @@ function clearFilter() {
html_end_box();

// form the 'where' clause for our main sql query
$sql_params = array();

if (strlen(get_request_var('rfilter'))) {
$sql_where = "WHERE (
name RLIKE '" . get_request_var('rfilter') . "'
OR description RLIKE '" . get_request_var('rfilter') . "'
OR emails RLIKE '" . get_request_var('rfilter') . "')";
$sql_where = 'WHERE (name RLIKE ? OR description RLIKE ? OR emails RLIKE ?)';
$sql_params = array(get_request_var('rfilter'), get_request_var('rfilter'), get_request_var('rfilter'));
} else {
$sql_where = '';
}

$total_rows = db_fetch_cell("SELECT
$total_rows = db_fetch_cell_prepared("SELECT
COUNT(*)
FROM plugin_notification_lists
$sql_where");
$sql_where", $sql_params);

$sql_order = get_order_string();
$sql_limit = ' LIMIT ' . ($rows * (intval(get_request_var('page')) - 1)) . ',' . $rows;

$lists = db_fetch_assoc("SELECT id, name, enabled, description, emails,
$lists = db_fetch_assoc_prepared("SELECT id, name, enabled, description, emails,
(SELECT COUNT(id) FROM thold_data WHERE notify_alert = nl.id) as thold_alerts,
(SELECT COUNT(id) FROM thold_data WHERE notify_warning = nl.id) as thold_warnings,
(SELECT COUNT(id) FROM thold_template WHERE notify_alert = nl.id) as template_alerts,
Expand All @@ -2168,7 +2170,7 @@ function clearFilter() {
FROM plugin_notification_lists nl
$sql_where
$sql_order
$sql_limit");
$sql_limit", $sql_params);

$nav = html_nav_bar('notify_lists.php', MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, 10, __('Lists', 'thold'), 'page', 'main');

Expand Down
2 changes: 1 addition & 1 deletion thold.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -614,7 +614,7 @@ function list_tholds() {
}

if (get_request_var('rfilter') != '') {
$sql_where .= ($sql_where == '' ? '(' : ' AND ') . " td.name_cache RLIKE '" . get_request_var('rfilter') . "'";
$sql_where .= ($sql_where == '' ? '(' : ' AND ') . " td.name_cache RLIKE " . db_qstr(get_request_var('rfilter')) . "";
Copy link

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This concatenation ends with . "", which is a no-op and makes the SQL assembly harder to read. Consider removing the trailing empty-string concatenation.

Suggested change
$sql_where .= ($sql_where == '' ? '(' : ' AND ') . " td.name_cache RLIKE " . db_qstr(get_request_var('rfilter')) . "";
$sql_where .= ($sql_where == '' ? '(' : ' AND ') . " td.name_cache RLIKE " . db_qstr(get_request_var('rfilter'));

Copilot uses AI. Check for mistakes.
}

if ($statefilter != '') {
Expand Down
4 changes: 2 additions & 2 deletions thold_functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4009,7 +4009,7 @@ function thold_command_execution(&$thold_data, &$h, $breach_up, $breach_down, $b
$cmd = thold_replace_threshold_tags($thold_data['trigger_cmd_low'], $thold_data, $h, $thold_data['lastread'], $thold_data['local_graph_id'], $data_source_name);
$cmd = thold_expand_string($thold_data, $cmd);

$environment = thold_set_environ($thold_data['trigger_cmd_high'], $thold_data, $h, $thold_data['lastread'], $thold_data['local_graph_id'], $data_source_name);
$environment = thold_set_environ($thold_data['trigger_cmd_low'], $thold_data, $h, $thold_data['lastread'], $thold_data['local_graph_id'], $data_source_name);

if ($queue == 'on') {
$data = [
Expand All @@ -4028,7 +4028,7 @@ function thold_command_execution(&$thold_data, &$h, $breach_up, $breach_down, $b
$cmd = thold_replace_threshold_tags($thold_data['trigger_cmd_norm'], $thold_data, $h, $thold_data['lastread'], $thold_data['local_graph_id'], $data_source_name);
$cmd = thold_expand_string($thold_data, $cmd);

$environment = thold_set_environ($thold_data['trigger_cmd_high'], $thold_data, $h, $thold_data['lastread'], $thold_data['local_graph_id'], $data_source_name);
$environment = thold_set_environ($thold_data['trigger_cmd_norm'], $thold_data, $h, $thold_data['lastread'], $thold_data['local_graph_id'], $data_source_name);

if ($queue == 'on') {
$data = [
Expand Down
10 changes: 5 additions & 5 deletions thold_graph.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -404,7 +404,7 @@ function tholds() {
$statefilter = thold_get_state_filter(get_request_var('state'));

if (get_request_var('rfilter') != '') {
$sql_where .= ($sql_where == '' ? '(' : ' AND ') . " td.name_cache RLIKE '" . get_request_var('rfilter') . "'";
$sql_where .= ($sql_where == '' ? '(' : ' AND ') . " td.name_cache RLIKE " . db_qstr(get_request_var('rfilter')) . "";
Copy link

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This concatenation ends with . "", which is a no-op and makes the SQL assembly harder to read. Consider removing the trailing empty-string concatenation.

Suggested change
$sql_where .= ($sql_where == '' ? '(' : ' AND ') . " td.name_cache RLIKE " . db_qstr(get_request_var('rfilter')) . "";
$sql_where .= ($sql_where == '' ? '(' : ' AND ') . ' td.name_cache RLIKE ' . db_qstr(get_request_var('rfilter'));

Copilot uses AI. Check for mistakes.
}

if (get_request_var('data_template_id') != '-1') {
Expand Down Expand Up @@ -937,8 +937,8 @@ function hosts() {

if (get_request_var('rfilter') != '') {
$sql_where .= " (h.deleted = ''
AND (h.hostname RLIKE '" . get_request_var('rfilter') . "'
OR h.description RLIKE '" . get_request_var('rfilter') . "')";
AND (h.hostname RLIKE " . db_qstr(get_request_var('rfilter')) . "
OR h.description RLIKE " . db_qstr(get_request_var('rfilter')) . ")";
}

if (get_request_var('host_status') == '-1') {
Expand Down Expand Up @@ -1395,7 +1395,7 @@ function thold_export_log() {
}

if (get_request_var('rfilter') != '') {
$sql_where .= ($sql_where == '' ? '' : ' AND') . " tl.description RLIKE '" . get_request_var('rfilter') . "'";
$sql_where .= ($sql_where == '' ? '' : ' AND') . " tl.description RLIKE " . db_qstr(get_request_var('rfilter')) . "";
Copy link

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This concatenation ends with . "", which is a no-op and makes the SQL assembly harder to read. Consider removing the trailing empty-string concatenation.

Suggested change
$sql_where .= ($sql_where == '' ? '' : ' AND') . " tl.description RLIKE " . db_qstr(get_request_var('rfilter')) . "";
$sql_where .= ($sql_where == '' ? '' : ' AND') . " tl.description RLIKE " . db_qstr(get_request_var('rfilter'));

Copilot uses AI. Check for mistakes.
}

$sql_order = '';
Expand Down Expand Up @@ -1490,7 +1490,7 @@ function thold_show_log() {
}

if (get_request_var('rfilter') != '') {
$sql_where .= ($sql_where == '' ? '' : ' AND') . " tl.description RLIKE '" . get_request_var('rfilter') . "'";
$sql_where .= ($sql_where == '' ? '' : ' AND') . " tl.description RLIKE " . db_qstr(get_request_var('rfilter')) . "";
Copy link

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This concatenation ends with . "", which is a no-op and makes the SQL assembly harder to read. Consider removing the trailing empty-string concatenation.

Suggested change
$sql_where .= ($sql_where == '' ? '' : ' AND') . " tl.description RLIKE " . db_qstr(get_request_var('rfilter')) . "";
$sql_where .= ($sql_where == '' ? '' : ' AND') . " tl.description RLIKE " . db_qstr(get_request_var('rfilter'));

Copilot uses AI. Check for mistakes.
}

$sql_order = get_order_string();
Expand Down
Loading