CVE-2024-54146 / GHSA-vj9g-p7f2-4wqj fix (#6096)

* CVE-2024-54146 / GHSA-vj9g-p7f2-4wqj fix c7e4ee7 doesn't seem to fix the issue, which is still reproducible. * Update host_templates.php Do this a bit differently. --------- Co-authored-by: TheWitness <thewitness@cacti.net>
Cacti · Feb 7, 2025 · 7fa60c0 · 7fa60c0
1 parent 94526a9
commit 7fa60c0
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/host_templates.php b/host_templates.php
@@ -850,7 +850,7 @@ function clearFilter() {
 	}
 
 	if (get_request_var('graph_template') != '-1') {
-		$sql_where .= ($sql_where != '' ? ' AND ':'WHERE ') . '(gt_id = ' . get_request_var('graph_template') . ')';
+		$sql_where .= ($sql_where != '' ? ' AND ':'WHERE ') . '(gt_id = ' . get_filter_request_var('graph_template') . ')';
 		$sql_join   = "INNER JOIN (
 			SELECT DISTINCT host_template_id, id AS gt_id
 			FROM (