search

FOGProject / fogproject

An open source computer cloning & management system
https://fogproject.org
GNU General Public License v3.0
1.09k stars 221 forks source link

Introduce log sanitization to `logtoview.php` so logs are not parsed as html #540

Closed 0x41c closed 10 months ago

0x41c commented 1 year ago

I've also added fixes for the possibility of $currentUser being null when checking for authentication status on certain endpoints. I meant to make a new branch for those changes so that they could be merged separately, but the quicker it gets fixed, the less time there is for people to have these issues show up in prod.

0x41c commented 1 year ago

So after finding some errors show up, I did a little digging. How come we're unauthenticated at this point? https://github.com/FOGProject/fogproject/blob/3ed1818465eb59f12b0602e1605218847935e07a/packages/web/lib/fog/storagenode.class.php#L225-L236

The reason I ask this is because it seems like the getfiles endpoint is returning nothing here. This effects logtoview behaviour since it's unable to get log files.