Hannes/SeMonitoring
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enhance alarm handling by adding MySQL escaping for phone numbers and refactoring SQL insertions

Browse Source
This commit is contained in:
jhartworks
2025-09-30 10:18:04 +02:00
parent 8b25601611
commit 265c6746a2
1 changed files with 34 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Monitoring Server Influx V1/module.php
+34 -13
View File
@@ -429,6 +429,16 @@ class MonitoringServer extends IPSModule {
$tdOld = $this->ReadAttributeString("AtAlarmtable");
$td = $tdOld;
MySQL_Open($idSql);
// === Helfer: Escaping für Strings ===
if (function_exists('MySQL_RealEscapeString')) {
$esc = fn(string $s) => MySQL_RealEscapeString($idSql, $s);
} else {
// Fallback, falls Modul-Funktion nicht verfügbar ist
$esc = fn(string $s) => addslashes($s);
}
$time = date("Y-m-d H:i:s");
$art = $projectnumber." | ".$projectname. " | ISP ".$ispnr;
@@ -479,7 +489,28 @@ class MonitoringServer extends IPSModule {
if ($sendphone == true){
$phone = 1;
if ($numbersPhone != ""){
$phonenumbers = $numbersPhone;
$phonenumbers = str_getcsv($numbersPhone);
foreach ($phonenumbers as $phonenumber){
$sqlcall = sprintf(
"INSERT INTO alarmcalls (
alarmname, phonenumber
) VALUES (
'%s','%s'
)",
$esc($smname), $esc($phonenumber)
);
// === Ausführen ===
$okcall = MySQL_ExecuteSimple($idSql, $sqlcall);
if (!$okcall) {
echo "INSERT fehlgeschlagen.\n";
}
$phoned = 1;
}
}
}
@@ -509,7 +540,7 @@ class MonitoringServer extends IPSModule {
$this->WriteAttributeString("AtAlarmtable", $td);
//IPS_LogMessage ("Notify", "Alarmhistory updated");
MySQL_Open($idSql);
// Beispielwerte (ersetzen durch echte)
$topic = '';
@@ -518,15 +549,6 @@ class MonitoringServer extends IPSModule {
$smsnumber = '0';
$smsed = 0;
// === Helfer: Escaping für Strings ===
if (function_exists('MySQL_RealEscapeString')) {
$esc = fn(string $s) => MySQL_RealEscapeString($idSql, $s);
} else {
// Fallback, falls Modul-Funktion nicht verfügbar ist
$esc = fn(string $s) => addslashes($s);
}
// === INSERT bauen ===
$sql = sprintf(
"INSERT INTO alarms (
@@ -547,7 +569,7 @@ class MonitoringServer extends IPSModule {
$esc($topic), $esc($projectnumber), $esc($projectname), $esc($ispnumber), $esc($smname),
(int)$sms, $esc($smsnumber), (int)$smsed,
(int)$whatsapp, $esc($numbersWhatsapp), (int)$whatsapped,
(int)$phone, $esc($phonenumber), (int)$phoned,
(int)$phone, $esc($numbersPhone), (int)$phoned,
(int)$mail, $esc($email_address), (int)$mailed,
(int)$push
);
@@ -556,7 +578,6 @@ class MonitoringServer extends IPSModule {
$ok = MySQL_ExecuteSimple($idSql, $sql);
if (!$ok) {
echo "INSERT fehlgeschlagen.\n";
return;
}
}
elseif (GetValue($trigid) == false) {