2 Commits
Author SHA1 Message Date
nicolargo f3f50323d8 SQL Injection leading to Data Exfiltration via OOB (Out-of-Band) in Glances ClickHouse Export Module - GHSA-2hvx-g9v6-w29h 2026-09-12 15:30:08 +02:00
Nguyen Thanh Dat cc5e2bab65 fix(views): keep hide_zero hiding a stat that never moves
The reference configuration documents the boundary for both plugins that
use the feature:

    # Set hide_threshold_bytes to an integer value to automatically hide
    # interface with traffic less or equal than this value
    #hide_threshold_bytes=0

"less or equal than this value", with a documented default of 0, means a
rate of exactly 0 is hidden. The comparison un-hid on `>=` instead, so at
the default threshold every zero rate satisfied `0 >= 0` and the row came
straight back.

The first refresh still hides, because it has no previous view to carry
forward and falls into the `else` branch. From the second refresh on,
nothing was ever hidden again -- which is why `hide_zero=True` looked like
it worked for one frame and then stopped.

This restores the behaviour that `i[field] != 0` had before the threshold
option was introduced, and honours a non-zero threshold the way the
configuration file describes it.

Tests pin the boundary rather than any rendered message: the views dict
keeps every key either way, only `hidden` moves.
2026-09-09 14:46:17 +07:00