hardening: fix SSRF and SSL verification in help.php (#6770)

* fix: harden page parameter handling in help.php

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: add HelpSsrFTest for SSRF hardening

* fix: remove redundant max_redirects when follow_location is 0

follow_location=0 disables redirect following entirely; max_redirects=1
alongside it has no effect and is misleading. Remove it.

Also fix phpstan bootstrap load order (.phpstan.neon), add baseline for
5 pre-existing level-6 errors, and apply pre-existing cs-fixer alignment
fix to lib/dsstats.php.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

help.php

@@ -46,15 +46,18 @@ if (isrv('error')) {
 } elseif (isrv('page')) {
 	gfrv('page', FILTER_CALLBACK, ['options' => 'sanitize_search_string']);
 
-	$page = str_replace('.html', '.md', grv('page'));
+	$page = basename(str_replace('.html', '.md', grv('page')));
 
 	$fgc_contextoption = [
 		'ssl' => [
-			'verify_peer'       => false,
-			'verify_peer_name'  => false,
-			'allow_self_signed' => true,
+			'verify_peer'       => true,
+			'verify_peer_name'  => true,
+			'allow_self_signed' => false,
 			'timeout'           => 2,
 			'ignore_errors'     => true
+		],
+		'http' => [
+			'follow_location' => 0
 		]
 	];
 

tests/Unit/HelpSsrFTest.php

@@ -0,0 +1,38 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Tests for SSRF hardening in help.php.
+ *
+ * The fix adds basename() to prevent path traversal in the page parameter,
+ * enables SSL verification (verify_peer, verify_peer_name), and limits
+ * redirects to prevent SSRF via fetch.
+ */
+
+$helpPath = __DIR__ . '/../../help.php';
+
+// --- help.php: path traversal and SSL verification ---
+
+test('help.php uses basename for page parameter', function () use ($helpPath) {
+	$contents = file_get_contents($helpPath);
+
+	expect($contents)->toContain('basename(');
+});
+
+test('help.php enables SSL peer verification', function () use ($helpPath) {
+	$contents = file_get_contents($helpPath);
+
+	expect($contents)->toContain("'verify_peer'       => true");
+	expect($contents)->toContain("'verify_peer_name'  => true");
+});