Merge pull request #10478 from snipe/fixes/whitelist_modal_views

Added allow list to modal view options

app/Http/Controllers/ModalController.php

@@ -6,7 +6,31 @@ use App\Helpers\Helper;
 
 class ModalController extends Controller
 {
+
+    /** 
+     * Load the modal views after confirming they are in the allowed_types array.
+     * The allowed types away just prevents shithead skiddies from fuzzing the urls 
+     * with automated scripts and junking up the logs. - snipe
+     */
     function show ($type, $itemId = null) {
+
+        $allowed_types = [
+            'category',
+            'kit-model', 
+            'kit-license', 
+            'kit-consumable', 
+            'kit-accessory',
+            'location',
+            'manufacturer',
+            'model',
+            'statuslabel',
+            'supplier',
+            'upload-file',
+            'user',         
+        ];
+
+
+        if (in_array($type, $allowed_types)) {
             $view = view("modals.${type}");
 
             if ($type == "statuslabel") {
@@ -17,4 +41,8 @@ class ModalController extends Controller
             }
             return $view;
         }
+        
+        abort(404,'Page not found');
+        
+    }
 }