Fix(Report): fix injection from GLPI Stat (#349)

stonebuzz · web-flow · commit 56f9ecd672cd · 2026-02-26T09:04:19.000+01:00
* Fix(Report): fix injection from GLPI Stat

* adapt CHANGELOG.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [UNRELEASED]
+
+### Fixed
+
+- Fix GLIP Stat injection
+
 ## [1.9.3] - 2026-01-08
 
 ### Fixed
diff --git a/inc/common.class.php b/inc/common.class.php
@@ -223,7 +223,7 @@ public function getAllReports($with_url = true, $params = [])
 
                         if ($with_url) {
                             $reports[$classname]['functions'][$i]['url_graph']     = $url_graph;
-                            $reports[$classname]['functions'][$i]['min_url_graph'] = $min_url_graph;
+                            $reports[$classname]['functions'][$i]['min_url_graph'] = html_entity_decode($min_url_graph, ENT_QUOTES | ENT_HTML5, 'UTF-8');
                         }
 
                         $i++;
diff --git a/setup.php b/setup.php
@@ -127,7 +127,7 @@ function plugin_init_mreporting()
             }
 
             /* Show Reports in standart stats page */
-            if (preg_match('#front/stat.*\.php#', $_SERVER['SCRIPT_NAME'])) {
+            if (preg_match('#front/stat.*\.php#', $_SERVER['REQUEST_URI'])) {
                 $mreporting_common = new PluginMreportingCommon();
                 $reports           = $mreporting_common->getAllReports();
                 if ($reports !== false) {

Original file line number	Diff line number	Diff line change
`@@ -223,7 +223,7 @@ public function getAllReports($with_url = true, $params = [])`
`223`	`223`
`224`	`224`	`if ($with_url) {`
`225`	`225`	`$reports[$classname]['functions'][$i]['url_graph'] = $url_graph;`
`226`		`- $reports[$classname]['functions'][$i]['min_url_graph'] = $min_url_graph;`
	`226`	`+ $reports[$classname]['functions'][$i]['min_url_graph'] = html_entity_decode($min_url_graph, ENT_QUOTES \| ENT_HTML5, 'UTF-8');`
`227`	`227`	`}`
`228`	`228`
`229`	`229`	`$i++;`
Original file line number	Diff line number	Diff line change
`@@ -127,7 +127,7 @@ function plugin_init_mreporting()`
`127`	`127`	`}`
`128`	`128`
`129`	`129`	`/* Show Reports in standart stats page */`
`130`		`- if (preg_match('#front/stat.*\.php#', $_SERVER['SCRIPT_NAME'])) {`
	`130`	`+ if (preg_match('#front/stat.*\.php#', $_SERVER['REQUEST_URI'])) {`
`131`	`131`	`$mreporting_common = new PluginMreportingCommon();`
`132`	`132`	`$reports = $mreporting_common->getAllReports();`
`133`	`133`	`if ($reports !== false) {`