mirror of
https://github.com/Cacti/plugin_monitor.git
synced 2026-10-24 03:56:53 +09:00
e2fc5aed5f
* ci: modernize Monitor workflow * ci: pin integration tests to Cacti 1.2.31 * ci(security): pin GitHub Actions to commit SHAs Pin actions/checkout (v5), shivammathur/setup-php (v2) and actions/upload-artifact (v4) to full commit SHAs with a trailing # vX comment. Mutable tags let a compromised or force-pushed tag run arbitrary code in CI; pinning to an immutable SHA is the supply-chain-hardening best practice and matches the SHA-pinned checkout used in the core security workflow. * Allow Cacti dependency validation warnings * Align Monitor matrix with Cacti dependencies * Fix Monitor PHPStan working directory * Fix duplicate Monitor workflow key * Guard optional PHPStan configuration * Guard optional Composer vendor binaries * Skip unavailable Composer quality scripts * ci: restore full PHP 8.1-8.4 integration matrix Keep 1.2.31 pin while covering mid-stream PHP releases. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: grant the Cacti database user the host pattern the service uses The service container publishes a port, so Cacti reaches MariaDB from the Docker gateway address and matches cactiuser@'%', not cactiuser@localhost. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: rebuild plugin CI workflow from plugin_evidence template Replace the Monitor CI workflow wholesale with the plugin_evidence CI workflow, renamed for plugin_monitor, adding Pest test support (phpunit.xml, tests/Pest.php, tests/TestCase.php, tests/bootstrap-unit.php, tests/.cacti-version). Convert the existing raw-script sanity checks in tests/unit, tests/e2e, and tests/Integration into Pest tests, renaming tests/unit to tests/Unit and using PascalCase *Test.php file names. --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: Thomas Vincent <thomas@vincent.dev>
17 lines
654 B
PHP
17 lines
654 B
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDTool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
it('escapes request values used in hidden inputs', function () {
|
|
$payload = '" autofocus onfocus="alert(1)';
|
|
$escaped = htmlspecialchars($payload, ENT_QUOTES, 'UTF-8');
|
|
|
|
expect($escaped)->not->toContain('"');
|
|
expect($escaped)->toContain('"');
|
|
});
|