diff --git a/application/dashboard.class.inc.php b/application/dashboard.class.inc.php index 23f1cf8a3..8bc91c721 100644 --- a/application/dashboard.class.inc.php +++ b/application/dashboard.class.inc.php @@ -918,6 +918,11 @@ class RuntimeDashboard extends Dashboard { $bCustomized = false; + $sDashboardFileSanitized = utils::RealPath($sDashboardFile, APPROOT); + if (false === $sDashboardFileSanitized) { + throw new SecurityException('Invalid dashboard file !'); + } + // Search for an eventual user defined dashboard $oUDSearch = new DBObjectSearch('UserDashboard'); $oUDSearch->AddCondition('user_id', UserRights::GetUserId(), '='); @@ -929,7 +934,7 @@ class RuntimeDashboard extends Dashboard $sDashboardDefinition = $oUserDashboard->Get('contents'); $bCustomized = true; } else { - $sDashboardDefinition = @file_get_contents($sDashboardFile); + $sDashboardDefinition = @file_get_contents($sDashboardFileSanitized); } @@ -937,7 +942,7 @@ class RuntimeDashboard extends Dashboard $oDashboard = new RuntimeDashboard($sDashBoardId); $oDashboard->FromXml($sDashboardDefinition); $oDashboard->SetCustomFlag($bCustomized); - $oDashboard->SetDefinitionFile($sDashboardFile); + $oDashboard->SetDefinitionFile($sDashboardFileSanitized); } else { $oDashboard = null; } diff --git a/core/kpi.class.inc.php b/core/kpi.class.inc.php index 460b5a822..053f0e570 100644 --- a/core/kpi.class.inc.php +++ b/core/kpi.class.inc.php @@ -1,29 +1,14 @@ +/** + * @copyright Copyright (C) 2010-2023 Combodo SARL + * @license http://opensource.org/licenses/AGPL-3.0 + */ use Combodo\iTop\Core\Kpi\KpiLogData; use Combodo\iTop\Service\Module\ModuleService; /** * Measures operations duration, memory usage, etc. (and some other KPIs) - * - * @copyright Copyright (C) 2010-2023 Combodo SARL - * @license http://opensource.org/licenses/AGPL-3.0 */ class ExecutionKPI @@ -355,6 +340,10 @@ class ExecutionKPI { global $fItopStarted; + if (!self::IsEnabled()) { + return; + } + $aNewEntry = null; $fStarted = $this->m_fStarted; @@ -417,6 +406,10 @@ class ExecutionKPI public function ComputeStatsForExtension($object, $sMethod) { + if (!self::IsEnabled()) { + return; + } + $sSignature = ModuleService::GetInstance()->GetModuleMethodSignature($object, $sMethod); if (utils::StartsWith($sSignature, '[')) { $this->ComputeStats('Extension', $sSignature); @@ -425,6 +418,10 @@ class ExecutionKPI public function ComputeStats($sOperation, $sArguments) { + if (!self::IsEnabled()) { + return; + } + $fDuration = 0; if (self::$m_bEnabled_Duration) { $fStopped = MyHelpers::getmicrotime(); diff --git a/core/metamodel.class.php b/core/metamodel.class.php index a2a9b67a5..4b00f4df6 100644 --- a/core/metamodel.class.php +++ b/core/metamodel.class.php @@ -7635,6 +7635,7 @@ abstract class MetaModel 'ModuleHandlerApiInterface', 'iNewsroomProvider', 'iModuleExtension', + 'iKPILoggerExtension', ]; foreach ($aInterfaces as $sInterface) { self::$m_aExtensionClassNames[$sInterface] = array();