Two independent commits (reviewable separately).
Output escaping (security hardening)
Several panels rendered values into HTML, including title="..." attributes, without html_escape, while their detail views already escape the same values. Escaped on output:
busiest.php: data-source names in headers and title attributes.misc.php: webseer URLs/codes, servcheck names/types/results/errors, maint schedule names and affected-host descriptions.graphs.php: host descriptions in the failed-host detail.system.php: the admin-alert banner.display.php: the shared (cross-user) dashboard name in the Actions list.
Correctness bugs
system.php: extrem_detail() used an undefined $lines in a LIMIT (SQL error, the sibling queries use LIMIT 25) and incremented $f instead of the $j column index; the spine-version check used !strpos(), which misreads a match at offset 0.alert.php: array + union dropped alert rows with colliding keys; use array_merge.top5.php: a closing </table> was computed but never appended (missing .=).
Tracking issue for #377, which carries the fix.
Two independent commits (reviewable separately).
Output escaping (security hardening)
Several panels rendered values into HTML, including
title="..."attributes, withouthtml_escape, while their detail views already escape the same values. Escaped on output:busiest.php: data-source names in headers and title attributes.misc.php: webseer URLs/codes, servcheck names/types/results/errors, maint schedule names and affected-host descriptions.graphs.php: host descriptions in the failed-host detail.system.php: the admin-alert banner.display.php: the shared (cross-user) dashboard name in the Actions list.Correctness bugs
system.php:extrem_detail()used an undefined$linesin aLIMIT(SQL error, the sibling queries useLIMIT 25) and incremented$finstead of the$jcolumn index; the spine-version check used!strpos(), which misreads a match at offset 0.alert.php: array+union dropped alert rows with colliding keys; usearray_merge.top5.php: a closing</table>was computed but never appended (missing.=).Tracking issue for #377, which carries the fix.