admin/cacti
1
0 Fork 0
mirror of https://github.com/Cacti/cacti.git synced 2026-10-23 03:27:02 +09:00
Code Issues Packages Projects Releases Wiki Activity

security: consolidate verified GHSA fixes for develop (batch 3) + CHANGELOG CVE reconciliation (#8141)

Browse Source 
* security: consolidate verified GHSA fixes for develop (batch 3)

Develop counterparts of the 1.2.x fixes in #8138, each re-verified against
develop HEAD.

- GHSA-77pr-g949-4v5f: spikekill.php also requires is_graph_allowed() on the
  target graph, not just the Spike Kill realm.
- GHSA-w3qw-762w-6g9v: the include/global.php GET action guard fails closed on
  an array-form action[] before the scalar denylist comparison.
- GHSA-xhpr-w454-cc9w: update_poller_cache() casts the stored output_type to
  int before interpolation.
- GHSA-j3px-vw6r-g25x: graphs_new.php escapes stored snmp_index via db_qstr()
  in the data-query IN() pivot.
- GHSA-h745-3r76-g253: graphs_new.php escapes the data-query and field names in
  the XML parse error messages (__ -> __esc).

GHSA-297h-95ff-r767 does not apply on develop: the clog log-file selector
renders through the drop_array filter framework, which escapes.

tests/Unit/Security/ConsolidatedBatch3Test.php adds source-scanning regression
guards. CHANGELOG (1.3.0-dev) updated; php -l, the security baselines, and
check-changelog.py all pass.

* chore: lead 1.3.0-dev security CHANGELOG entries with the GHSA id

Normalize the 1.3.0-dev -security entries to the approved
"-security: GHSA-xxxx [CVE-xxxx] Description" form, moving the advisory id to
the front. CVE tokens are omitted because none of these advisories have a CVE
issued yet (verified via the repository security-advisories API). Covers the
five batch-3 entries plus the pre-existing entries that still used the trailing
(GHSA-xxxx) form.

* chore: use the -security#GHSA-xxxx: form for the 1.3.0-dev CHANGELOG entries

Correct the batch-3 and reconciled 1.3.0-dev -security entries to the approved
"-security#GHSA-xxxx: CVE-yyyy Description" form (GHSA id in the prefix). No CVE
tokens are added because none of these advisories have a CVE issued yet
(verified via the repository security-advisories API).

* test: split batch-3 security guards into vulnerability-class files; reconcile CHANGELOG

- Move the ConsolidatedBatch3Test.php guards into the matching Auth, Csrf,
  SqlInjection and Xss folders with behavior-based filenames, and strengthen
  them per review: the GET-guard test asserts the array branch actually returns
  405 and exits; the snmp_index test rejects both raw concatenation branches;
  the parse-error test asserts every name-bearing message uses __esc().
- Append this pull request number to the five new 1.3.0-dev security entries.
- Add issued CVE identifiers to the older -security#GHSA CHANGELOG entries
  (verified via the repository security-advisories API). Entries with no CVE
  yet, entries that already carried a CVE, and non-GHSA lines are unchanged.
This commit is contained in:
TheWitness authored and GitHub committed 2026-10-02 11:03:52 -04:00
1 parent 850778aa5b
commit 0055dd00cc
10 files changed
+216 -58
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CHANGELOG
+55 -50
View File
@@ -1,20 +1,25 @@
Cacti CHANGELOG Cacti CHANGELOG
1.3.0-dev 1.3.0-dev
-security: Validate host_id before it is concatenated into the graph_view list and preview filter WHERE clauses (GHSA-r7hc-hrpv-52gf) (#8100) - Special Thanks to Jiecub3, Aur0ra-m and lz2y -security#GHSA-77pr-g949-4v5f: Authorize the target graph before Spike Kill rewrites its RRD history (#8141)
-security: Validate and bind local_graph_id in the aggregate graph item sequence query (GHSA-6mjm-5vwr-3fr2) (#8099) - Special Thanks to Jiecub3, Aur0ra-m and lz2y -security#GHSA-w3qw-762w-6g9v: Reject array-form GET actions that bypass the POST and CSRF guard (#8141)
-security: Grant AllowOverride All in docker/apache.conf so shipped .htaccess denies on log/cache/scripts/cli take effect (GHSA-fxfg-j995-j69j) -security#GHSA-xhpr-w454-cc9w: Cast the stored data-query output_type before building the poller cache query (#8141)
-security: Authorize the bulk Change Data Source Profile action against the owning device (GHSA-fc82-w6xq-4jg7) -security#GHSA-j3px-vw6r-g25x: Escape stored snmp_index values in the New Graphs data-query pivot (#8141)
-security: Authorize Data Source enable/disable against the owning device before mutating (GHSA-2fhv-c794-v433) -security#GHSA-h745-3r76-g253: Escape the data-query and field names in the New Graphs parse error messages (#8141)
-security: Confine Reports format_file to a bare filename to close a path traversal/LFI regression (GHSA-5x27-wqpm-m24v) -security#GHSA-r7hc-hrpv-52gf: Validate host_id before it is concatenated into the graph_view list and preview filter WHERE clauses (#8100) - Special Thanks to Jiecub3, Aur0ra-m and lz2y
-security: Reject ORDER BY sort_column subquery payloads that bypassed the GHSA-q9xg-p762-9jm3 fix (GHSA-8j73-cvf6-jrvx) -security#GHSA-6mjm-5vwr-3fr2: Validate and bind local_graph_id in the aggregate graph item sequence query (#8099) - Special Thanks to Jiecub3, Aur0ra-m and lz2y
-security: Authorize Report save/edit against report ownership to close an authenticated IDOR (GHSA-8f5c-3h59-q7gc) -security#GHSA-fxfg-j995-j69j: Grant AllowOverride All in docker/apache.conf so shipped .htaccess denies on log/cache/scripts/cli take effect
-security: Stop building the Realtime RRD create command through a shell and validate DS bounds are numeric before they reach it (GHSA-f88m-q789-g22j) -security#GHSA-fc82-w6xq-4jg7: Authorize the bulk Change Data Source Profile action against the owning device
-security: Authorize tree node create/delete/move/rename/copy against per-tree access before mutating (GHSA-prxj-84qq-v5jq) -security#GHSA-2fhv-c794-v433: Authorize Data Source enable/disable against the owning device before mutating
-security: Authorize single-item Report actions (remove/move) against report ownership to close a guest-bind IDOR (GHSA-j5jh-fhwg-r56x) -security#GHSA-5x27-wqpm-m24v: Confine Reports format_file to a bare filename to close a path traversal/LFI regression
-security: Use validate_redirect_url() for the CSRF timeout redirect to close a tab-based open redirect bypass (GHSA-c725-4jm5-9fx5) -security#GHSA-8j73-cvf6-jrvx: Reject ORDER BY sort_column subquery payloads that bypassed the GHSA-q9xg-p762-9jm3 fix
-security: Require Package Management permission to trust new package signers (GHSA-gxgm-8rhv-r7jv) -security#GHSA-8f5c-3h59-q7gc: Authorize Report save/edit against report ownership to close an authenticated IDOR
-security: Harden cmd.exe shell sinks and strip %VAR% from hostnames on win32 (GHSA-rjvj-r52f-8v5q) (#8056) -security#GHSA-f88m-q789-g22j: Stop building the Realtime RRD create command through a shell and validate DS bounds are numeric before they reach it
-security#GHSA-prxj-84qq-v5jq: Authorize tree node create/delete/move/rename/copy against per-tree access before mutating
-security#GHSA-j5jh-fhwg-r56x: Authorize single-item Report actions (remove/move) against report ownership to close a guest-bind IDOR
-security#GHSA-c725-4jm5-9fx5: Use validate_redirect_url() for the CSRF timeout redirect to close a tab-based open redirect bypass
-security#GHSA-gxgm-8rhv-r7jv: Require Package Management permission to trust new package signers
-security#GHSA-rjvj-r52f-8v5q: Harden cmd.exe shell sinks and strip %VAR% from hostnames on win32 (#8056)
-security: Reject SHA-1 signatures across every package import path -security: Reject SHA-1 signatures across every package import path
-security: Escape path_dsstats_log before it reaches the dsstats poller shell redirect -security: Escape path_dsstats_log before it reaches the dsstats poller shell redirect
-security: Revoke anonymous access when the guest account is disabled -security: Revoke anonymous access when the guest account is disabled
@@ -490,12 +495,12 @@ Cacti CHANGELOG
-issue#6183: Checkbox is displayed always on in some cases -issue#6183: Checkbox is displayed always on in some cases
1.2.29 1.2.29
-security#GHSA-pv2c-97pp-vxwg: Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path -security#GHSA-pv2c-97pp-vxwg: CVE-2024-45598 Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path
-security#GHSA-f9c7-7rc3-574c: SQL Injection vulnerability when using tree rules through Automation API -security#GHSA-f9c7-7rc3-574c: CVE-2025-24368 SQL Injection vulnerability when using tree rules through Automation API
-security#GHSA-vj9g-P7F2-4wqj: SQL Injection vulnerability when view host template -security#GHSA-vj9g-P7F2-4wqj: SQL Injection vulnerability when view host template
-security#GHSA-fh3x-69rr-qqpp: SQL Injection vulnerability when request automation devices -security#GHSA-fh3x-69rr-qqpp: CVE-2024-54145 SQL Injection vulnerability when request automation devices
-security#GHSA-c5j8-jxj3-hh36: Authenticated RCE via multi-line SNMP responses -security#GHSA-c5j8-jxj3-hh36: CVE-2025-22604 Authenticated RCE via multi-line SNMP responses
-security#GHSA-fxrq-fr7h-9rqq: Arbitrary File Creation leading to RCE -security#GHSA-fxrq-fr7h-9rqq: CVE-2025-24367 Arbitrary File Creation leading to RCE
-issue#5843: Issue with temporary tables with use of microtime -issue#5843: Issue with temporary tables with use of microtime
-issue#5847: Presets Time in Cacti 1.2.28 Not Automatically Updating... -issue#5847: Presets Time in Cacti 1.2.28 Not Automatically Updating...
-issue#5848: RRDfile Auto Clean not working -issue#5848: RRDfile Auto Clean not working
@@ -517,10 +522,10 @@ Cacti CHANGELOG
-feature#5933: Only attempt to change the table type and character encoding for built-in Cacti tables -feature#5933: Only attempt to change the table type and character encoding for built-in Cacti tables
1.2.28 1.2.28
-security#GHSA-49f2-hwx9-qffr: XSS vulnerability when creating external links with the consolenewsection parameter -security#GHSA-49f2-hwx9-qffr: CVE-2024-43365 XSS vulnerability when creating external links with the consolenewsection parameter
-security#GHSA-fgc6-g8gc-wcg5: XSS vulnerability when creating external links with the title parameter -security#GHSA-fgc6-g8gc-wcg5: CVE-2024-43364 XSS vulnerability when creating external links with the title parameter
-security#GHSA-gxq4-mv8h-6qj4: RCE vulnerability can be executed via Log Poisoning -security#GHSA-gxq4-mv8h-6qj4: CVE-2024-43363 RCE vulnerability can be executed via Log Poisoning
-security#GHSA-wh9c-v56x-v77c: XSS vulnerability when creating external links with the fileurl parameter -security#GHSA-wh9c-v56x-v77c: CVE-2024-43362 XSS vulnerability when creating external links with the fileurl parameter
-issue#5636: When using LDAP authentication the first time, warnings may appear in logs -issue#5636: When using LDAP authentication the first time, warnings may appear in logs
-issue#5754: When installing, a replication loop for plugin_realms may occur -issue#5754: When installing, a replication loop for plugin_realms may occur
-issue#5759: When installing, remote poller may attempt to sync with other pollers -issue#5759: When installing, remote poller may attempt to sync with other pollers
@@ -557,15 +562,15 @@ Cacti CHANGELOG
-feature: Improve the performance of the repopulation of the poller cache -feature: Improve the performance of the repopulation of the poller cache
1.2.27 1.2.27
-security#GHSA-37x7-mfjv-mm7m: Authentication Bypass when using using older password hashes -security#GHSA-37x7-mfjv-mm7m: CVE-2024-34340 Authentication Bypass when using using older password hashes
-security#GHSA-7cmj-g5qc-pj88: RCE vulnerability when importing packages -security#GHSA-7cmj-g5qc-pj88: CVE-2024-25641 RCE vulnerability when importing packages
-security#GHSA-cx8g-hvq8-p2rv: RCE vulnerability when plugins include files -security#GHSA-cx8g-hvq8-p2rv: CVE-2024-31459 RCE vulnerability when plugins include files
-security#GHSA-gj3f-p326-gh8r: SQL Injection vulnerability when using tree rules through Automation API -security#GHSA-gj3f-p326-gh8r: CVE-2024-31460 SQL Injection vulnerability when using tree rules through Automation API
-security#GHSA-grj5-8fcj-34gh: XSS vulnerability when using JavaScript based messaging API -security#GHSA-grj5-8fcj-34gh: CVE-2024-29894 XSS vulnerability when using JavaScript based messaging API
-security#GHSA-jrxg-8wh8-943x: SQL Injection vulnerability when using form templates -security#GHSA-jrxg-8wh8-943x: CVE-2024-31458 SQL Injection vulnerability when using form templates
-security#GHSA-p4ch-7hjw-6m87: XSS vulnerability when reading tree rules with Automation API -security#GHSA-p4ch-7hjw-6m87: CVE-2024-31444 XSS vulnerability when reading tree rules with Automation API
-security#GHSA-rqc8-78cm-85j3: XSS vulnerability when managing data queries -security#GHSA-rqc8-78cm-85j3: CVE-2024-31443 XSS vulnerability when managing data queries
-security#GHSA-vjph-r677-6pcc: SQL Injection vulnerability when retrieving graphs using Automation API -security#GHSA-vjph-r677-6pcc: CVE-2024-31445 SQL Injection vulnerability when retrieving graphs using Automation API
-issue#5622: Improve PHP 8.3 support -issue#5622: Improve PHP 8.3 support
-issue#5628: When importing packages via command line, data source profile could not be selected -issue#5628: When importing packages via command line, data source profile could not be selected
-issue#5629: When changing password, returning to previous page does not always work -issue#5629: When changing password, returning to previous page does not always work
@@ -637,24 +642,24 @@ Cacti CHANGELOG
-feature#5597: Add OSCX 6x00 templates -feature#5597: Add OSCX 6x00 templates
1.2.25 1.2.25
-security#GHSA-77rf-774j-6h3p: Protect against Insecure deserialization of filter data -security#GHSA-77rf-774j-6h3p: CVE-2023-30534 Protect against Insecure deserialization of filter data
-security#GHSA-gx8c-xvjh-9qh4: Protect against Cross-Site Scripting vulnerability when creating new graphs -security#GHSA-gx8c-xvjh-9qh4: CVE-2023-39360 Protect against Cross-Site Scripting vulnerability when creating new graphs
-security#GHSA-6r43-q2fw-5wrg: Protect against Unauthenticated SQL Injection when viewing graphs -security#GHSA-6r43-q2fw-5wrg: CVE-2023-39361 Protect against Unauthenticated SQL Injection when viewing graphs
-security#GHSA-6jhp-mgqg-fhqg: Protect against SQL Injection when saving data with sql_save() -security#GHSA-6jhp-mgqg-fhqg: CVE-2023-39357 Protect against SQL Injection when saving data with sql_save()
-security#GHSA-g6ff-58cj-x3cp: Protect against Authenticated command injection when using SNMP options -security#GHSA-g6ff-58cj-x3cp: CVE-2023-39362 Protect against Authenticated command injection when using SNMP options
-security#GHSA-q4wh-3f9w-836h: Protect against Authenticated SQL injection vulnerability when managing graphs -security#GHSA-q4wh-3f9w-836h: CVE-2023-39359 Protect against Authenticated SQL injection vulnerability when managing graphs
-security#GHSA-gj95-7xr8-9p7g: Protect against Authenticated SQL injection vulnerability when managing reports -security#GHSA-gj95-7xr8-9p7g: CVE-2023-39358 Protect against Authenticated SQL injection vulnerability when managing reports
-security#GHSA-v5w7-hww7-2f22: Protect against SQL Injection when using regular expressions -security#GHSA-v5w7-hww7-2f22: CVE-2023-39365 Protect against SQL Injection when using regular expressions
-security#GHSA-4pjv-rmrp-r59x: Protect against Open redirect in change password functionality -security#GHSA-4pjv-rmrp-r59x: CVE-2023-39364 Protect against Open redirect in change password functionality
-security#GHSA-rwhh-xxm6-vcrv: Protect against Cross-Site Scripting vulnerability with Device Name when managing Data Sources -security#GHSA-rwhh-xxm6-vcrv: CVE-2023-39366 Protect against Cross-Site Scripting vulnerability with Device Name when managing Data Sources
-security#GHSA-24w4-4hp2-3j8h: Protect against Cross-Site Scripting vulnerability with Device Name when administrating Reports -security#GHSA-24w4-4hp2-3j8h: CVE-2023-39510 Protect against Cross-Site Scripting vulnerability with Device Name when administrating Reports
-security#GHSA-5hpr-4hhc-8q42: Protect against Cross-Site Scripting vulnerability with Device Name when editing Graphs whilst managing Reports -security#GHSA-5hpr-4hhc-8q42: CVE-2023-39511 Protect against Cross-Site Scripting vulnerability with Device Name when editing Graphs whilst managing Reports
-security#GHSA-vqcc-5v63-g9q7: Protect against Cross-Site Scripting vulnerability with Device Name when managing Data Sources -security#GHSA-vqcc-5v63-g9q7: CVE-2023-39512 Protect against Cross-Site Scripting vulnerability with Device Name when managing Data Sources
-security#GHSA-9fj7-8f2j-2rw2: Protect against Cross-Site Scripting vulnerability with Device Name when debugging data queries -security#GHSA-9fj7-8f2j-2rw2: CVE-2023-39513 Protect against Cross-Site Scripting vulnerability with Device Name when debugging data queries
-security#GHSA-6hrc-2cfc-8hm7: Protect against Cross-Site Scripting vulnerability with Data Source Name when managing Graphs -security#GHSA-6hrc-2cfc-8hm7: CVE-2023-39514 Protect against Cross-Site Scripting vulnerability with Data Source Name when managing Graphs
-security#GHSA-hrg9-qqqx-wc4h: Protect against Cross-Site Scripting vulnerability with Data Source Name when debugging Data Queries -security#GHSA-hrg9-qqqx-wc4h: CVE-2023-39515 Protect against Cross-Site Scripting vulnerability with Data Source Name when debugging Data Queries
-security#GHSA-r8qq-88g3-hmgv: Protect against Cross-Site Scripting vulnerability with Data Source Information when managing Data Sources -security#GHSA-r8qq-88g3-hmgv: CVE-2023-39516 Protect against Cross-Site Scripting vulnerability with Data Source Information when managing Data Sources
-security#GHSA-rf5w-pq3f-9876: Protect against Privilege escalation when Cacti installed using Windows Installer defaults -security#GHSA-rf5w-pq3f-9876: CVE-2023-31132 Protect against Privilege escalation when Cacti installed using Windows Installer defaults
-issue#2959: When rebuilding the Poller Cache from command line, allow it to be multi-threaded -issue#2959: When rebuilding the Poller Cache from command line, allow it to be multi-threaded
-issue#4045: When searching tree or list views, the URL does not update after changes -issue#4045: When searching tree or list views, the URL does not update after changes
-issue#5254: When creating a Data Source Template with a specific snmp port, the port is not always applied -issue#5254: When creating a Data Source Template with a specific snmp port, the port is not always applied
graphs_new.php
+7 -4
View File
@@ -710,11 +710,11 @@ function graphs() : void {
} }
} }
} else { } else {
raise_message('xmlfielderr' . $field_name, __('Error Parsing Data Query Resource XML file for Data Query \'%s\' with id \'%s\'. Field Name \'%s\' missing a \'direction\' attribute', $snmp_query['name'], $snmp_query['id'], $field_name), MESSAGE_LEVEL_ERROR); raise_message('xmlfielderr' . $field_name, __esc('Error Parsing Data Query Resource XML file for Data Query \'%s\' with id \'%s\'. Field Name \'%s\' missing a \'direction\' attribute', $snmp_query['name'], $snmp_query['id'], $field_name), MESSAGE_LEVEL_ERROR);
} }
} }
} elseif (!$message_raised) { } elseif (!$message_raised) {
raise_message('xmlerror', __('Error Parsing Data Query Resource XML file for Data Query \'%s\' with id \'%s\'', $snmp_query['name'], $snmp_query['id']), MESSAGE_LEVEL_ERROR); raise_message('xmlerror', __esc('Error Parsing Data Query Resource XML file for Data Query \'%s\' with id \'%s\'', $snmp_query['name'], $snmp_query['id']), MESSAGE_LEVEL_ERROR);
$message_raised = true; $message_raised = true;
} }
} }
@@ -781,10 +781,13 @@ function graphs() : void {
if (cacti_sizeof($indexes)) { if (cacti_sizeof($indexes)) {
foreach ($indexes as $index) { foreach ($indexes as $index) {
// GHSA-j3px-vw6r-g25x: snmp_index is stored host_snmp_cache
// data; quote and escape it so a crafted index cannot break
// out of this IN() list.
if ($sql_where != '') { if ($sql_where != '') {
$sql_where .= ", '" . $index['snmp_index'] . "'"; $sql_where .= ', ' . db_qstr($index['snmp_index']);
} else { } else {
$sql_where .= " AND snmp_index IN('" . $index['snmp_index'] . "'"; $sql_where .= ' AND snmp_index IN(' . db_qstr($index['snmp_index']);
} }
} }
include/global.php
+9
View File
@@ -813,6 +813,15 @@ if ($config['is_web']) {
if (isrv('action')) { if (isrv('action')) {
$action = gnrv('action'); $action = gnrv('action');
// GHSA-w3qw-762w-6g9v: an array-form action[] makes every scalar
// $action == $bad comparison below false, slipping a state-changing
// action past this guard. A real action is never an array here.
if (is_array($action)) {
header('Allow: POST');
http_response_code(405);
exit;
}
// State-changing actions must arrive by POST with a CSRF token. Their // State-changing actions must arrive by POST with a CSRF token. Their
// links use cactiPostAction so the query fields and token are submitted // links use cactiPostAction so the query fields and token are submitted
// in the request body instead of remaining cross-origin GET targets. // in the request body instead of remaining cross-origin GET targets.
lib/utility.php
+4 -1
View File
@@ -233,7 +233,10 @@ function update_poller_cache(mixed $data_source, bool $commit = false, ?int $pol
$params = []; $params = [];
if (cacti_sizeof($field) && $field['output_type'] != '') { if (cacti_sizeof($field) && $field['output_type'] != '') {
$output_type_sql = ' AND sqgr.snmp_query_graph_id = ' . $field['output_type']; // GHSA-xhpr-w454-cc9w: output_type is a stored snmp_query_graph_id
// interpolated into the query below; cast it so a tampered
// data-query field cannot inject SQL second-hand.
$output_type_sql = ' AND sqgr.snmp_query_graph_id = ' . (int) $field['output_type'];
} else { } else {
$output_type_sql = ''; $output_type_sql = '';
} }
spikekill.php
+8 -3
View File
@@ -41,13 +41,18 @@ if (isrv('method')) {
} }
} }
if (is_realm_allowed(1043)) { $local_graph_id = gfrv('local_graph_id');
// GHSA-77pr-g949-4v5f: the Spike Kill realm (1043) only grants use of the
// feature, not access to a specific graph. Authorize the target graph too so a
// realm holder cannot destroy the RRD history of a graph they are denied.
if (is_realm_allowed(1043) && is_graph_allowed($local_graph_id)) {
$local_data_ids = db_fetch_assoc_prepared('SELECT DISTINCT data_template_rrd.local_data_id $local_data_ids = db_fetch_assoc_prepared('SELECT DISTINCT data_template_rrd.local_data_id
FROM graph_templates_item FROM graph_templates_item
LEFT JOIN data_template_rrd LEFT JOIN data_template_rrd
ON graph_templates_item.task_item_id=data_template_rrd.id ON graph_templates_item.task_item_id=data_template_rrd.id
WHERE graph_templates_item.local_graph_id = ?', WHERE graph_templates_item.local_graph_id = ?',
[gfrv('local_graph_id')]); [$local_graph_id]);
$results = ''; $results = '';
@@ -112,7 +117,7 @@ if (is_realm_allowed(1043)) {
} }
} }
print json_encode(['local_graph_id' => grv('local_graph_id'), 'results' => $results]); print json_encode(['local_graph_id' => $local_graph_id, 'results' => $results]);
} else { } else {
print __('FATAL: Spike Kill Not Allowed') . PHP_EOL; print __('FATAL: Spike Kill Not Allowed') . PHP_EOL;
} }
tests/Unit/Security/Auth/SpikekillGraphAuthorizationTest.php
+23
View File
@@ -0,0 +1,23 @@
<?php
/*
+-------------------------------------------------------------------------+
| Copyright (C) 2004-2026 The Cacti Group |
+-------------------------------------------------------------------------+
| Cacti: The Complete RRDtool-based Graphing Solution |
+-------------------------------------------------------------------------+
*/
/*
* GHSA-77pr-g949-4v5f: spikekill.php authorized only the Spike Kill realm
* (1043) and never the target graph, so a realm holder could destroy the RRD
* history of a graph their permissions deny.
*/
$root = dirname(__DIR__, 4);
test('spikekill authorizes the target graph in addition to the Spike Kill realm', function () use ($root) {
$source = file_get_contents($root . '/spikekill.php');
expect($source)->toContain('is_realm_allowed(1043) && is_graph_allowed($local_graph_id)')
->and($source)->not->toContain("if (is_realm_allowed(1043)) {\n\t\$local_data_ids");
});
tests/Unit/Security/Csrf/GetActionArrayBypassGuardTest.php
+33
View File
@@ -0,0 +1,33 @@
<?php
/*
+-------------------------------------------------------------------------+
| Copyright (C) 2004-2026 The Cacti Group |
+-------------------------------------------------------------------------+
| Cacti: The Complete RRDtool-based Graphing Solution |
+-------------------------------------------------------------------------+
*/
/*
* GHSA-w3qw-762w-6g9v: an array-form action[] made every scalar $action == $bad
* comparison in the include/global.php GET guard false, slipping a
* state-changing action past it. The array guard must itself fail closed.
*/
$root = dirname(__DIR__, 4);
test('the GET action guard rejects an array action by failing closed before the denylist', function () use ($root) {
$source = file_get_contents($root . '/include/global.php');
$guard = strpos($source, 'if (is_array($action)) {');
$loop = strpos($source, 'foreach ($bad_actions as $bad) {');
expect($guard)->not->toBeFalse()
->and($loop)->not->toBeFalse()
->and($guard)->toBeLessThan($loop);
// the guard body itself must return 405 and terminate, not merely exist
$body = substr($source, $guard, $loop - $guard);
expect($body)->toContain('http_response_code(405)')
->and($body)->toContain('exit;');
});
tests/Unit/Security/SqlInjection/NewGraphsSnmpIndexEscapeTest.php
+26
View File
@@ -0,0 +1,26 @@
<?php
/*
+-------------------------------------------------------------------------+
| Copyright (C) 2004-2026 The Cacti Group |
+-------------------------------------------------------------------------+
| Cacti: The Complete RRDtool-based Graphing Solution |
+-------------------------------------------------------------------------+
*/
/*
* GHSA-j3px-vw6r-g25x: snmp_index is stored host_snmp_cache data interpolated
* raw into an IN() list in graphs_new.php. Both the first-item and the
* subsequent-item branches must quote/escape it via db_qstr().
*/
$root = dirname(__DIR__, 4);
test('New Graphs escapes snmp_index in both branches of the IN() pivot', function () use ($root) {
$source = file_get_contents($root . '/graphs_new.php');
expect($source)->toContain("db_qstr(\$index['snmp_index'])")
// first-item branch must not concatenate the raw value
->and($source)->not->toContain("\" AND snmp_index IN('\" . \$index['snmp_index']")
// subsequent-item branch must not concatenate the raw value either
->and($source)->not->toContain("\", '\" . \$index['snmp_index'] . \"'");
});
tests/Unit/Security/SqlInjection/PollerCacheOutputTypeCastTest.php
+23
View File
@@ -0,0 +1,23 @@
<?php
/*
+-------------------------------------------------------------------------+
| Copyright (C) 2004-2026 The Cacti Group |
+-------------------------------------------------------------------------+
| Cacti: The Complete RRDtool-based Graphing Solution |
+-------------------------------------------------------------------------+
*/
/*
* GHSA-xhpr-w454-cc9w: output_type is a stored snmp_query_graph_id interpolated
* into a query in update_poller_cache(); it must be cast to int so a tampered
* data-query field cannot inject SQL second-hand.
*/
$root = dirname(__DIR__, 4);
test('update_poller_cache casts the stored output_type to int before interpolation', function () use ($root) {
$source = file_get_contents($root . '/lib/utility.php');
expect($source)->toContain("sqgr.snmp_query_graph_id = ' . (int) \$field['output_type']")
->and($source)->not->toContain("sqgr.snmp_query_graph_id = ' . \$field['output_type']");
});
tests/Unit/Security/Xss/NewGraphsDataQueryNameEscapeTest.php
+28
View File
@@ -0,0 +1,28 @@
<?php
/*
+-------------------------------------------------------------------------+
| Copyright (C) 2004-2026 The Cacti Group |
+-------------------------------------------------------------------------+
| Cacti: The Complete RRDtool-based Graphing Solution |
+-------------------------------------------------------------------------+
*/
/*
* GHSA-h745-3r76-g253: the data-query name and field name reached the New
* Graphs XML parse error messages through __() (no escaping). Both
* name-bearing messages (the xmlfielderr branch and the data-query-name
* xmlerror branch) must use __esc(); the id-only xmlerror carries no user
* string and stays on __().
*/
$root = dirname(__DIR__, 4);
test('New Graphs escapes the data-query and field names in every name-bearing parse error', function () use ($root) {
$source = file_get_contents($root . '/graphs_new.php');
// the two name-bearing messages escape; the id-only message does not
expect(substr_count($source, "__esc('Error Parsing Data Query Resource XML file"))->toBe(2)
->and(substr_count($source, "__('Error Parsing Data Query Resource XML file"))->toBe(1)
->and($source)->toContain("raise_message('xmlfielderr' . \$field_name, __esc(")
->and($source)->not->toContain("raise_message('xmlfielderr' . \$field_name, __(");
});