From 133a24552863795c9a763c487945a5021aed791b Mon Sep 17 00:00:00 2001
From: Serghey Rodin <serghey.rodin@gmail.com>
Date: Wed, 16 Apr 2014 14:24:37 +0300
Subject: [PATCH] secured way to display rrd charts

---
 web/list/rrd/image.php            | 13 +++++++++++++
 web/templates/admin/list_rrd.html |  4 ++--
 2 files changed, 15 insertions(+), 2 deletions(-)
 create mode 100644 web/list/rrd/image.php

diff --git a/web/list/rrd/image.php b/web/list/rrd/image.php
new file mode 100644
index 00000000..48c1c615
--- /dev/null
+++ b/web/list/rrd/image.php
@@ -0,0 +1,13 @@
+<?php
+
+session_start();
+if ($_SESSION['user'] != 'admin') exit;
+$real_path = realpath($_SERVER["DOCUMENT_ROOT"].$_SERVER['QUERY_STRING']);
+if (empty($real_path)) exit;
+$dir_name = dirname($real_path);
+$dir_name = dirname($dir_name);
+if ($dir_name != $_SERVER["DOCUMENT_ROOT"].'/rrd') exit;
+header("X-Accel-Redirect: ".$_SERVER['QUERY_STRING']);
+header("Content-Type: image/png");
+
+?>
diff --git a/web/templates/admin/list_rrd.html b/web/templates/admin/list_rrd.html
index aafb203f..3910ffa0 100644
--- a/web/templates/admin/list_rrd.html
+++ b/web/templates/admin/list_rrd.html
@@ -38,7 +38,7 @@
                         </table>
                     </td>
                     <td class="data-dotted">
-                        <a href="/rrd/<?php echo $data[$key]['TYPE']."/".$period."-".$data[$key]['RRD'].".png" ?>" target="_blank" class="data-controls">
+                        <a href="/list/rrd/image.php?/rrd/<?php echo $data[$key]['TYPE']."/".$period."-".$data[$key]['RRD'].".png"?>" target="_blank" class="data-controls">
                             <span>
                                 <img src="/images/download.png" width="8px" height="8px">
                                 <?php print __('download');?> 
@@ -51,7 +51,7 @@
                                     <table>
                                         </tr>
                                             <td style="background: #7a766d;" width="630px" height="250px">
-                                                <img style="padding: 0 0 0 36px;" src="/rrd/<?php echo $data[$key]['TYPE']."/".$period."-".$data[$key]['RRD'].".png" ?>">
+                                                <img style="padding: 0 0 0 36px;" src="/list/rrd/image.php?/rrd/<?php echo $data[$key]['TYPE']."/".$period."-".$data[$key]['RRD'].".png" ?>">
                                             </td>
                                         </tr>
                                     </table>