2 Commits
Author SHA1 Message Date
nicolargo f3f50323d8 SQL Injection leading to Data Exfiltration via OOB (Out-of-Band) in Glances ClickHouse Export Module - GHSA-2hvx-g9v6-w29h 2026-09-12 15:30:08 +02:00
Nguyen Thanh Dat ff80c90355 fix(webui): keep a row while any of its hide_zero fields is visible
hide_zero is decided per field but applied per row, and the two front ends
read that per-field verdict in opposite directions.

msg_curse drops a disk only when *all* of its hide_zero_fields are hidden:

    if all(self.get_views(item=..., key=f, option='hidden') for f in self.hide_zero_fields):
        continue

plugin-diskio.vue and plugin-network.vue keep a row only when *all* of them
are visible:

    return (
        (!readBytesRate || readBytesRate.hidden === false) &&
        (!writeBytesRate || writeBytesRate.hidden === false)
    );

Those agree while both fields say the same thing, and disagree the moment
one moves and the other does not -- a disk that has only ever been read, an
interface that has only ever received. Curses shows it; the browser drops
it entirely.

Use the same rule as msg_curse in both components.
2026-09-09 14:52:11 +07:00