mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-23 03:27:02 +09:00
fix(security): close validator migration regressions (#7240)
* feat(validator): add settings constraint validation pilot Routes saved settings through Symfony Validator so include/global_settings.php can declare per-setting constraints inline. The save handler runs one validator pass and surfaces violations via the existing raise_message() pattern, replacing scattered ad-hoc checks. Pilot covers 12 high-value settings; the rest stay on the existing implicit form-render checks. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci(infection): allow infection/extension-installer composer plugin Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs(validator): document must-be-posted-to-validate contract Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(bootstrap): guard Symfony autoload in global_settings before use declarations Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(test): remove redundant autoload require in CactiSettingsTest Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(test): restore require_once for CactiSettings (not in Composer autoload) Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * feat(validator): fold helper into settings pilot * fix(validator): translate default Symfony constraint messages Default Symfony NotBlank/Length/Range/Choice/Positive messages render in English regardless of Cacti locale because the validator runs without a Symfony Translator. Pass explicit __()-wrapped message, minMessage, maxMessage, and notInRangeMessage options on each bare constraint in include/global_settings.php so violations participate in Cacti's gettext pipeline. Documents the no-Translator decision in CactiValidator so future contributors know to translate at the call site. Addresses Copilot PR #7077 review feedback. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(graph): improve remote agent parsing and RRD path validation * feat(validator): migrate automation_graph_rules.php to symfony validator * refactor(validator): move automation validator helper to shared library and enhance tests * feat(validator): migrate automation_networks.php to symfony validator * feat(validator): migrate automation_snmp.php to symfony validator * feat(validator): migrate automation_templates.php to symfony validator * feat(validator): migrate automation_tree_rules.php to symfony validator * refactor(automation): move api_networks_save to shared library for testability * feat(validator): add validateInput helper and migrate color_templates.php * feat(validator): migrate host_templates.php to symfony validator * feat(validator): migrate graph_templates.php to symfony validator * feat(validator): migrate data_templates.php to symfony validator * feat(validator): migrate data_input.php to symfony validator * feat(validator): migrate data_queries.php to symfony validator * feat(validator): migrate graphs_new.php to symfony validator * feat(validator): migrate graphs.php to symfony validator * feat(validator): migrate data_sources.php to symfony validator * feat(validator): migrate user_group_admin.php to symfony validator * feat(validator): migrate managers.php to symfony validator * feat(validator): migrate package_repos.php to symfony validator * Refactor pollers.php to use CactiValidator * fix(security): close validator migration regressions * test(snmp): add spine docker harness * fix(review): address validator migration feedback * fix(deps): include validator runtime packages * chore(deps): normalize composer.json require-block indentation The validator migration introduced tab-indented entries in an otherwise space-indented require block. Re-indent the stevenmaguire/* and symfony/* lines to 8 spaces so the block is consistent. Co-Authored-By: Oz <oz-agent@warp.dev> * fix(graphs): repair graph json response branch * fix(validation): apply php cs fixer * ci(codeql): skip autobuild for interpreted scans * fix(link): satisfy phpstan path guard * chore(pr): remove branch pollution * ci(codeql): align autobuild pin with init and analyze Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * refactor(automation): use CactiValidator::validateInput, drop wrapper automation_validate_input() in lib/api_automation.php was a byte-for-byte duplicate of CactiValidator::validateInput() (identical session handling and raise_message() semantics, and it already delegated to CactiValidator::validate internally). Per review feedback, use the shared class directly everywhere instead of a parallel automation-only wrapper. - Remove automation_validate_input() from lib/api_automation.php - Replace all call sites with CactiValidator::validateInput() (automation_templates/graph_rules/tree_rules/snmp and api_networks_save) - Update the automation validator unit tests to match - Add @param/@return PHPDoc to CactiValidator specific-validator methods Co-Authored-By: Oz <oz-agent@warp.dev> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: Thomas Vincent <thomas@vincent.dev> Co-authored-by: Oz <oz-agent@warp.dev> Co-authored-by: TheWitness <thewitness@cacti.net>
This commit is contained in:
51 files changed
+2790
-467
No files matched your search
+3
-81
@@ -27,6 +27,9 @@ require('./include/auth.php');
|
||||
require_once(CACTI_PATH_LIBRARY . '/api_scheduler.php');
|
||||
require_once(CACTI_PATH_LIBRARY . '/snmp.php');
|
||||
require_once(CACTI_PATH_LIBRARY . '/poller.php');
|
||||
require_once(CACTI_PATH_LIBRARY . '/CactiValidator.php');
|
||||
|
||||
use Symfony\Component\Validator\Constraints as Assert;
|
||||
|
||||
$actions = [
|
||||
1 => __('Delete'),
|
||||
@@ -358,87 +361,6 @@ function api_networks_discover(int $network_id, bool $discover_debug, bool $disc
|
||||
force_session_data();
|
||||
}
|
||||
|
||||
function api_networks_save(array $post) : mixed {
|
||||
if (empty($post['network_id'])) {
|
||||
$save['id'] = form_input_validate($post['id'], 'id', '^[0-9]+$', false, 3);
|
||||
$save['hash'] = get_hash_automation($post['id'], 'automation_networks');
|
||||
|
||||
// general information
|
||||
$save['name'] = form_input_validate($post['name'], 'name', '', false, 3);
|
||||
$save['poller_id'] = form_input_validate($post['poller_id'], 'poller_id', '^[0-9]+$', false, 3);
|
||||
$save['site_id'] = form_input_validate($post['site_id'], 'site_id', '^[0-9]+$', false, 3);
|
||||
$save['subnet_range'] = form_input_validate($post['subnet_range'], 'subnet_range', '', false, 3);
|
||||
$save['ignore_ips'] = form_input_validate($post['ignore_ips'], 'ignore_ips', '', true, 3);
|
||||
$save['dns_servers'] = form_input_validate($post['dns_servers'], 'dns_servers', '', true, 3);
|
||||
|
||||
$save['threads'] = form_input_validate($post['threads'], 'threads', '^[0-9]+$', false, 3);
|
||||
$save['run_limit'] = form_input_validate($post['run_limit'], 'run_limit', '^[0-9]+$', false, 3);
|
||||
|
||||
$save['enabled'] = (isset($post['enabled']) ? 'on' : '');
|
||||
|
||||
// notification settings
|
||||
$save['notification_enabled'] = (isset($post['notification_enabled']) ? 'on' : '');
|
||||
$save['notification_email'] = form_input_validate($post['notification_email'], 'notification_email', '', true, 3);
|
||||
|
||||
$save['notification_fromname'] = form_input_validate($post['notification_fromname'], 'notification_fromname', '', true, 3);
|
||||
$save['notification_fromemail'] = form_input_validate($post['notification_fromemail'], 'notification_fromemail', '', true, 3);
|
||||
|
||||
$save['enable_netbios'] = (isset($post['enable_netbios']) ? 'on' : '');
|
||||
$save['add_to_cacti'] = (isset($post['add_to_cacti']) ? 'on' : '');
|
||||
$save['same_sysname'] = (isset($post['same_sysname']) ? 'on' : '');
|
||||
$save['rerun_data_queries'] = (isset($post['rerun_data_queries']) ? 'on' : '');
|
||||
|
||||
// discovery connectivity settings
|
||||
$save['snmp_id'] = form_input_validate($post['snmp_id'], 'snmp_id', '^[0-9]+$', false, 3);
|
||||
$save['ping_method'] = form_input_validate($post['ping_method'], 'ping_method', '^[0-9]+$', false, 3);
|
||||
$save['ping_port'] = form_input_validate($post['ping_port'], 'ping_port', '^[0-9]+$', false, 3);
|
||||
$save['ping_timeout'] = form_input_validate($post['ping_timeout'], 'ping_timeout', '^[0-9]+$', false, 3);
|
||||
$save['ping_retries'] = form_input_validate($post['ping_retries'], 'ping_retries', '^[0-9]+$', false, 3);
|
||||
|
||||
$save = api_scheduler_augment_save($save, $post);
|
||||
|
||||
// validate the network definitions and rais error if failed
|
||||
$continue = true;
|
||||
$total_ips = 0;
|
||||
$networks = explode(',', $save['subnet_range']);
|
||||
|
||||
if (cacti_sizeof($networks)) {
|
||||
foreach ($networks as $net) {
|
||||
$ips = automation_calculate_total_ips($net);
|
||||
|
||||
if ($ips !== false) {
|
||||
$total_ips += $ips;
|
||||
} else {
|
||||
$continue = false;
|
||||
raise_message('automation_message', __esc('ERROR: Network \'%s\' is Invalid.', $net), MESSAGE_LEVEL_ERROR);
|
||||
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if ($continue) {
|
||||
$save['total_ips'] = $total_ips;
|
||||
|
||||
$network_id = 0;
|
||||
|
||||
if (!is_error_message()) {
|
||||
$network_id = sql_save($save, 'automation_networks');
|
||||
|
||||
if ($network_id) {
|
||||
raise_message(1);
|
||||
} else {
|
||||
raise_message(2);
|
||||
}
|
||||
}
|
||||
|
||||
return $network_id;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
function form_actions() : void {
|
||||
global $actions;
|
||||
|
||||
|
||||
Reference in new issue
Block a user