Skip to content

security(hardening): cacti_form_action_label() and html_escape graph_list (1.2.x) #7171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheWitness merged 7 commits into from
Jun 4, 2026
Merged

security(hardening): cacti_form_action_label() and html_escape graph_list (1.2.x) #7171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6e28e48
security: add cacti_form_action_label() and fix reflected XSS
somethingwithproof May 29, 2026
5f5c0ac
fix(xss): remove html_escape from graph_list; refactor cacti_form_act…
somethingwithproof May 29, 2026
a77c514
fix(xss): extend cacti_form_action_label to remaining 9 call sites
somethingwithproof May 29, 2026
5366698
fix(xss): escape html_start_box labels and fix unescaped hidden fields
somethingwithproof May 29, 2026
74dc755
fix(xss): tolerate array drp_action in cacti_form_action_label
somethingwithproof May 29, 2026
3863a38
fix(xss): close double-quoted string in aggregate graph_list block
somethingwithproof May 29, 2026
0957ef1
refactor(xss): fold html_escape into escape_page_action()
somethingwithproof May 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions aggregate_graphs.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -341,7 +341,7 @@ function form_actions() {

form_start('aggregate_graphs.php');

html_start_box($graph_actions[get_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($graph_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

$save_html = '';

Expand Down Expand Up @@ -536,7 +536,7 @@ function form_actions() {
<input type='hidden' name='action' value='actions'>
<input type='hidden' name='local_graph_id' value='" . (isset_request_var('local_graph_id') ? get_nfilter_request_var('local_graph_id'):0) . "'>
<input type='hidden' name='selected_items' value='" . (isset($graph_array) ? serialize($graph_array) : '') . "'>
<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
<input type='hidden' name='drp_action' value='" . html_escape(get_request_var('drp_action')) . "'>
$save_html
</td>
</tr>";
Expand Down
2 changes: 1 addition & 1 deletion aggregate_templates.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -309,7 +309,7 @@ function aggregate_form_actions() {

form_start('aggregate_templates.php');

html_start_box($aggregate_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($aggregate_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($aggregate_array) && cacti_sizeof($aggregate_array)) {
if (get_nfilter_request_var('drp_action') == '1') { /* delete */
Expand Down
4 changes: 2 additions & 2 deletions automation_devices.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@ function form_actions() {

form_start('automation_devices.php', 'chk');

html_start_box($device_actions[get_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($device_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

$available_host_templates = db_fetch_assoc_prepared('SELECT id, name FROM host_template ORDER BY name');

Expand Down Expand Up @@ -241,7 +241,7 @@ function form_actions() {
<td class='saveRow'>
<input type='hidden' name='action' value='actions'>
<input type='hidden' name='selected_items' value='" . (isset($device_array) ? serialize($device_array) : '') . "'>
<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
<input type='hidden' name='drp_action' value='" . html_escape(get_request_var('drp_action')) . "'>
$save_html
</td>
</tr>";
Expand Down
2 changes: 1 addition & 1 deletion automation_graph_rules.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -294,7 +294,7 @@ function automation_graph_rules_form_actions() {

form_start('automation_graph_rules.php', 'automation_graph_rules');

html_start_box($automation_graph_rules_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($automation_graph_rules_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (get_nfilter_request_var('drp_action') == AUTOMATION_ACTION_GRAPH_DELETE) { /* delete */
print "<tr>
Expand Down
2 changes: 1 addition & 1 deletion automation_networks.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -344,7 +344,7 @@ function form_actions() {

form_start('automation_networks.php');

html_start_box($network_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($network_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (get_nfilter_request_var('drp_action') == '1') { /* delete */
print "<tr>
Expand Down
2 changes: 1 addition & 1 deletion automation_snmp.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,7 +220,7 @@ function goTo(location) {

form_start('automation_snmp.php', 'automation_filter');

html_start_box($automation_snmp_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($automation_snmp_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (!isset($automation_array)) {
raise_message(40);
Expand Down
2 changes: 1 addition & 1 deletion automation_templates.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,7 @@ function form_actions() {

form_start('automation_templates.php');

html_start_box($at_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($at_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($at_array) && cacti_sizeof($at_array)) {
if (get_nfilter_request_var('drp_action') == '1') { /* delete */
Expand Down
2 changes: 1 addition & 1 deletion automation_tree_rules.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,7 +277,7 @@ function automation_tree_rules_form_actions() {

form_start('automation_tree_rules.php', 'automation_tree_rules_action');

html_start_box($automation_tree_rules_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($automation_tree_rules_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (get_nfilter_request_var('drp_action') == AUTOMATION_ACTION_TREE_DELETE) { /* DELETE */
print "<tr>
Expand Down
2 changes: 1 addition & 1 deletion cdef.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,7 +262,7 @@ function form_actions() {

form_start('cdef.php');

html_start_box($cdef_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($cdef_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($cdef_array) && cacti_sizeof($cdef_array)) {
if (get_nfilter_request_var('drp_action') == '1') { /* delete */
Expand Down
4 changes: 2 additions & 2 deletions color.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@ function form_actions() {

form_start('color.php');

html_start_box($color_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($color_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($color_array) && cacti_sizeof($color_array)) {
if (get_nfilter_request_var('drp_action') == '1') { /* delete */
Expand All @@ -201,7 +201,7 @@ function form_actions() {
<td class='saveRow'>
<input type='hidden' name='action' value='actions'>
<input type='hidden' name='selected_items' value='" . (isset($color_array) ? serialize($color_array) : '') . "'>
<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
<input type='hidden' name='drp_action' value='" . html_escape(get_request_var('drp_action')) . "'>
$save_html
</td>
</tr>\n";
Expand Down
4 changes: 2 additions & 2 deletions color_templates.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -229,7 +229,7 @@ function aggregate_color_form_actions() {

form_start('color_templates.php');

html_start_box($aggregate_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($aggregate_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($color_array) && cacti_sizeof($color_array)) {
if (get_request_var('drp_action') == '1') { /* delete */
Expand Down Expand Up @@ -273,7 +273,7 @@ function aggregate_color_form_actions() {
<td class='saveRow'>
<input type='hidden' name='action' value='actions'>
<input type='hidden' name='selected_items' value='" . (isset($color_array) ? serialize($color_array) : '') . "'>
<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
<input type='hidden' name='drp_action' value='" . html_escape(get_request_var('drp_action')) . "'>
$save_html
</td>
</tr>\n";
Expand Down
2 changes: 1 addition & 1 deletion data_input.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -273,7 +273,7 @@ function form_actions() {

form_start('data_input.php');

html_start_box($di_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($di_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($di_array) && cacti_sizeof($di_array)) {
if (get_request_var('drp_action') == '1') { // delete
Expand Down
2 changes: 1 addition & 1 deletion data_queries.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -398,7 +398,7 @@ function form_actions() {

form_start('data_queries.php');

html_start_box($dq_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($dq_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($dq_array) && cacti_sizeof($dq_array)) {
if (get_nfilter_request_var('drp_action') == '1') { /* delete */
Expand Down
4 changes: 2 additions & 2 deletions data_source_profiles.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -291,7 +291,7 @@ function form_actions() {

form_start('data_source_profiles.php');

html_start_box($profile_actions[get_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($profile_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($profile_array) && cacti_sizeof($profile_array)) {
if (get_request_var('drp_action') == '1') { // delete
Expand Down Expand Up @@ -324,7 +324,7 @@ function form_actions() {
<td class='saveRow'>
<input type='hidden' name='action' value='actions'>
<input type='hidden' name='selected_items' value='" . (isset($profile_array) ? serialize($profile_array) : '') . "'>
<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
<input type='hidden' name='drp_action' value='" . html_escape(get_request_var('drp_action')) . "'>
$save_html
</td>
</tr>\n";
Expand Down
2 changes: 1 addition & 1 deletion data_sources.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -488,7 +488,7 @@ function form_actions() {

form_start('data_sources.php');

html_start_box($ds_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($ds_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($ds_array) && cacti_sizeof($ds_array)) {
if (get_nfilter_request_var('drp_action') == '1') { /* delete */
Expand Down
4 changes: 2 additions & 2 deletions data_templates.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -453,7 +453,7 @@ function form_actions() {

form_start('data_templates.php');

html_start_box($ds_actions[get_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($ds_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($ds_array) && cacti_sizeof($ds_array)) {
if (get_request_var('drp_action') == '1') { // delete
Expand Down Expand Up @@ -502,7 +502,7 @@ function form_actions() {
<td class='saveRow'>
<input type='hidden' name='action' value='actions'>
<input type='hidden' name='selected_items' value='" . (isset($ds_array) ? serialize($ds_array) : '') . "'>
<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
<input type='hidden' name='drp_action' value='" . html_escape(get_request_var('drp_action')) . "'>
$save_html
</td>
</tr>\n";
Expand Down
4 changes: 2 additions & 2 deletions gprint_presets.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,7 +139,7 @@ function form_actions() {

form_start('gprint_presets.php');

html_start_box($gprint_actions[get_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($gprint_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($gprint_array) && cacti_sizeof($gprint_array)) {
if (get_request_var('drp_action') == '1') { /* delete */
Expand All @@ -162,7 +162,7 @@ function form_actions() {
<td class='saveRow'>
<input type='hidden' name='action' value='actions'>
<input type='hidden' name='selected_items' value='" . (isset($gprint_array) ? serialize($gprint_array) : '') . "'>
<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
<input type='hidden' name='drp_action' value='" . html_escape(get_request_var('drp_action')) . "'>
$save_html
</td>
</tr>\n";
Expand Down
2 changes: 1 addition & 1 deletion graph_templates.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -362,7 +362,7 @@ function form_actions() {

form_start('graph_templates.php');

html_start_box($graph_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($graph_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($graph_array) && cacti_sizeof($graph_array)) {
if (get_request_var('drp_action') == '1') { // delete
Expand Down
10 changes: 5 additions & 5 deletions graphs.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -826,7 +826,7 @@ function form_actions() {

form_start('graphs.php');

html_start_box($graph_actions[get_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($graph_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($graph_array) && cacti_sizeof($graph_array)) {
if (get_request_var('drp_action') == '1') { // delete
Expand Down Expand Up @@ -1007,8 +1007,8 @@ function form_actions() {
print '<tr>';
print "<td class='textArea'>
<p>" . __('Click \'Continue\' to create an Aggregate Graph from the selected Graph(s).'). "</p>
<div class='itemlist'><ul>" . get_nfilter_request_var('graph_list') . '</ul></div>
</td></tr>';
<div class='itemlist'><ul>$graph_list</ul></div>
</td></tr>";

/* list affected data sources */
print '<tr>';
Expand Down Expand Up @@ -1290,7 +1290,7 @@ function checkSubmit() {
$save_html = "<input type='button' class='ui-button ui-corner-all ui-widget cactiReturnTo' value='" . __esc('Return') . "'>";
}
} else {
$save['drp_action'] = get_nfilter_request_var('drp_action');
$save['drp_action'] = get_request_var('drp_action');
$save['graph_list'] = $graph_list;
$save['graph_array'] = (isset($graph_array) ? $graph_array : array());

Expand All @@ -1308,7 +1308,7 @@ function checkSubmit() {
<td class='saveRow'>
<input type='hidden' name='action' value='actions'>
<input type='hidden' name='selected_items' value='" . (isset($graph_array) ? serialize($graph_array) : '') . "'>
<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
<input type='hidden' name='drp_action' value='" . html_escape(get_request_var('drp_action')) . "'>
$save_html
</td>
</tr>";
Expand Down
2 changes: 1 addition & 1 deletion host.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -392,7 +392,7 @@ function form_actions() {

form_start('host.php');

html_start_box($device_actions[get_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($device_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($host_array) && cacti_sizeof($host_array)) {
if (get_request_var('drp_action') == '2') { // Enable Devices
Expand Down
4 changes: 2 additions & 2 deletions host_templates.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,7 +214,7 @@ function form_actions() {

form_start('host_templates.php');

html_start_box($host_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($host_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($host_array) && cacti_sizeof($host_array)) {
if (get_request_var('drp_action') == '1') { // delete
Expand Down Expand Up @@ -262,7 +262,7 @@ function form_actions() {
<td class='saveRow'>
<input type='hidden' name='action' value='actions'>
<input type='hidden' name='selected_items' value='" . (isset($host_array) ? serialize($host_array) : '') . "'>
<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
<input type='hidden' name='drp_action' value='" . html_escape(get_request_var('drp_action')) . "'>
$save_html
</td>
</tr>\n";
Expand Down
23 changes: 23 additions & 0 deletions lib/functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8412,6 +8412,29 @@ function cacti_validate_sort_column(string $column, array $allowed, string $defa
return $default !== '' ? $default : (count($allowed) > 0 ? $allowed[0] : 'id');
}

/**
* escape_page_action - Look up a drp_action key in an actions array and return
* the matching label, html_escape()'d and ready for direct output.
*
* The key is used only for the array lookup, so a non-scalar or unknown key
* yields $default. Plugin hooks (api_plugin_hook_function) may substitute
* labels containing HTML, so the result is escaped here; callers output it
* directly without a second html_escape().
*
* @param array $actions Associative array mapping drp_action values to labels.
* @param mixed $drp_action The drp_action key to look up; non-scalar keys yield $default.
* @param string $default Label to return when the key is absent from the array.
*
* @return string The html_escape()'d matched label, or $default.
*/
function escape_page_action(array $actions, $drp_action, string $default = ''): string {
if (!is_string($drp_action) && !is_int($drp_action)) {
return $default;
}

return html_escape(isset($actions[$drp_action]) ? $actions[$drp_action] : $default);
}

/**
* cacti_http - SSRF-hardened HTTP GET.
*
Expand Down
2 changes: 1 addition & 1 deletion lib/html_reports.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -516,7 +516,7 @@ function ($rid) {

form_start(get_reports_page(), 'report');

html_start_box($reports_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($reports_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (!isset($reports_array)) {
raise_message(40);
Expand Down
4 changes: 2 additions & 2 deletions links.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,7 +188,7 @@ function form_actions() {

form_start('links.php');

html_start_box($link_actions[get_request_var_post('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($link_actions, get_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($pages) && cacti_sizeof($pages)) {
if (get_request_var('drp_action') == '3') { // Enable Pages
Expand Down Expand Up @@ -229,7 +229,7 @@ function form_actions() {
<td>
<input type='hidden' name='action' value='actions'>
<input type='hidden' name='selected_items' value='" . (isset($pages) ? serialize($pages) : '') . "'>
<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
<input type='hidden' name='drp_action' value='" . html_escape(get_request_var('drp_action')) . "'>
$save_html
</td>
</tr>";
Expand Down
4 changes: 2 additions & 2 deletions managers.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1015,7 +1015,7 @@ function form_actions() {

form_start('managers.php');

html_start_box($manager_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($manager_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (cacti_sizeof($selected_items)) {
if (get_nfilter_request_var('drp_action') == '1') { // delete
Expand Down Expand Up @@ -1080,7 +1080,7 @@ function form_actions() {

form_start('managers.php');

html_start_box($manager_notification_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($manager_notification_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (cacti_sizeof($selected_items)) {
$msg = (get_nfilter_request_var('drp_action') == 2)
Expand Down
2 changes: 1 addition & 1 deletion pollers.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -550,7 +550,7 @@ function form_actions() {

form_start('pollers.php');

html_start_box($poller_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($poller_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($poller_array) && cacti_sizeof($poller_array)) {
if (get_nfilter_request_var('drp_action') == '1') { // delete
Expand Down
2 changes: 1 addition & 1 deletion sites.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -369,7 +369,7 @@ function form_actions() {

form_start('sites.php');

html_start_box($site_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($site_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($site_array) && cacti_sizeof($site_array)) {
if (get_nfilter_request_var('drp_action') == '1') { /* delete */
Expand Down
2 changes: 1 addition & 1 deletion tree.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -706,7 +706,7 @@ function ($tid) {

form_start('tree.php');

html_start_box($tree_actions[get_nfilter_request_var('drp_action')], '60%', '', '3', 'center', '');
html_start_box(escape_page_action($tree_actions, get_nfilter_request_var('drp_action')), '60%', '', '3', 'center', '');

if (isset($tree_array) && cacti_sizeof($tree_array)) {
if (get_nfilter_request_var('drp_action') == '1') { // delete
Expand Down
Loading