improved documentation for master/slave

fixed taint error in Smokeping.pm

3 files changed, 19 insertions, 2 deletions

diff --git a/CHANGES b/CHANGES
index 57d871e..5366a3f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+* kill taint error in Smokeping.pm -- tobi
+
+* better master/slave secrets documentation -- tobi
+
 * do not load :sys_wait_h from POSIX perl module since this seems to
   be missing in some linux distros and we can do alright without I think.
 
diff --git a/doc/smokeping_master_slave.pod b/doc/smokeping_master_slave.pod
index bd3b41f..14da56f 100644
--- a/doc/smokeping_master_slave.pod
+++ b/doc/smokeping_master_slave.pod
@@ -108,6 +108,12 @@ create the following files:
  dest3~slave1.rrd
  dest3~slave2.rrd
 
+The F<slavesecrets.conf> file contains a colon separated list of hostnames
+and secrets.
+
+ host1:secret1
+ host2:secret2
+
 =head2 Slave Configuration
 
 A smokeping slave setup has no configuration file. It just needs to know
@@ -119,6 +125,9 @@ F</tmp/smokeping.$USER.cache>.
              --cache-dir=/var/smokeping/ \
              --shared-secret=/var/smokeping/secret.txt
 
+The F<secret.txt> file contains a single word, the secret of this slave. It
+is NOT the same as the F<slavesecrets.conf> file the master uses.
+
 =head1 SECURITY CONSIDERATIONS
 
 The master effectively has full access to slave hosts as the user the
diff --git a/lib/Smokeping.pm b/lib/Smokeping.pm
index e66ee44..cb8ec46 100644
--- a/lib/Smokeping.pm
+++ b/lib/Smokeping.pm
@@ -1000,7 +1000,7 @@ sub get_detail ($$$$;$){
     my $tree = shift;
     my $open = shift;
     my $mode = shift || $q->param('displaymode') || 's';
-
+    
     my $phys_tree = $tree;
     my $phys_open = $open;    
     if ($tree->{__tree_link}){
@@ -1547,7 +1547,11 @@ sub hierarchy_switcher($$){
 sub display_webpage($$){
     my $cfg = shift;
     my $q = shift;
-    my ($path,$slave) = split(/~/,$q->param('target') || '');
+    my $trag = '';
+    if ( $q->param('target') and $q->param('target') !~ /\.\./ and $q->param('target') =~ /(\S+)/){
+        $targ = $1;
+    }
+    my ($path,$slave) = split(/~/,$targ);
     if ($slave and $slave ~= /(\S+)/){
         die "ERROR: slave '$slave' is not defined in the '*** Slaves ***' section!\n"
             unless defined $cfg->{Slaves}{$slave};