fix: cast path_php_binary before passing it to string parameters (#7576) (#7577)

* fix: cast path_php_binary before passing it to string parameters

The setting has no default, so it is null on a fresh install, and PHP 9 turns
the resulting coercion from a deprecation into a TypeError.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* docs: append the changelog entry at the end of the issue block

Matches .github/copilot-instructions.md, which appends rather than inserting
in numeric order.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: use the full licence header on the new test files

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix: cast path_php_binary at every site that escapes it

The first pass covered three of them; a repo-wide scan found 21, and the test
now fails if a new one appears.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: strengthen PHP binary path guard

* fix: cover default-config PHP binary reads

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>

CHANGELOG

@@ -81,6 +81,7 @@ Cacti CHANGELOG
 -issue#7429: Prevent monthly automation schedules from resetting next_start to 1970
 -issue#7493: SNMP walk for output_format fields used max OIDs instead of the device bulk walk size
 -issue#7518: Replace the DsstatsMeasure enum in lib/html_utility.php with const arrays for PHP 8.0 compatibility
+-issue#7576: Stop passing an unset path_php_binary into string parameters
 -feature#412: Import Export for Graph and Tree rules
 -feature#1214: Move Tree Create/Remove/Modify Functions to lib/api_tree.php
 -feature#1361: UI should update alternate row colors

graph_realtime.php

@@ -219,7 +219,7 @@ switch (grv('action')) {
 		$local_graph_id = (int) gfrv('local_graph_id');
 		$poller_id      = hash('sha256', session_id());
 		$graph_rrd      = read_config_option('realtime_cache_path') . '/user_' . $poller_id . '_lgi_' . $local_graph_id . '.png';
-		$php_binary     = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+		$php_binary     = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 		$script_path    = cacti_escapeshellarg(CACTI_PATH_BASE . '/poller_realtime.php');
 		$args           = '--graph=' . $local_graph_id . ' --interval=' . ((int) $graph_data_array['ds_step']) . ' --poller_id=' . cacti_escapeshellarg($poller_id);
 

host.php

@@ -200,7 +200,7 @@ function host_reindex() : void {
 	$start = microtime(true);
 
 	$host_id = gfrv('host_id');
-	shell_exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/poller_reindex_hosts.php') . ' --qid=all --id=' . $host_id);
+	shell_exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/poller_reindex_hosts.php') . ' --qid=all --id=' . $host_id);
 
 	$end = microtime(true);
 

install/functions.php

@@ -955,7 +955,7 @@ function install_setup_get_templates() : array {
 			$info[]                   = $data['info'];
 		} else {
 			// Loading Template Information from package
-			$shell_output       = shell_exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/import_package.php') . ' --filename=' . cacti_escapeshellarg("/$path/$xmlfile") . ' --info');
+			$shell_output       = shell_exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/import_package.php') . ' --filename=' . cacti_escapeshellarg("/$path/$xmlfile") . ' --info');
 			$myinfo             = @json_decode($shell_output !== false && $shell_output !== null ? $shell_output : '', true) ?? [];
 			$myinfo['filename'] = $xmlfile;
 			$myinfo['name']     = $xmlfile;

lib/api_automation.php

@@ -3539,7 +3539,7 @@ function create_graph_node(int $graph_id, int $parent, array $rule) : int {
  * @return void
  */
 function automation_poller_bottom() : void {
-	$command_string = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+	$command_string = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 
 	// If its not set, just assume its in the path
 	if (trim($command_string) == '') {

lib/boost.php

@@ -1987,7 +1987,7 @@ function boost_poller_bottom() : void {
 			}
 		}
 
-		$command_string = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+		$command_string = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 
 		if ($boost_debug && $boost_log != '') {
 			if (CACTI_SERVER_OS == 'unix') {

lib/functions.php

@@ -6600,7 +6600,7 @@ function get_dns_from_ip(string $ip, string $dns, int $timeout = 1000) : string
 }
 
 function poller_maintenance() : void {
-	$command_string = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+	$command_string = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 
 	// If its not set, just assume its in the path
 	if (empty($command_string) || trim($command_string) == '') {

lib/installer.php

@@ -3364,7 +3364,7 @@ class Installer implements JsonSerializable {
 		}
 
 		if ($backgroundNeeded) {
-			$php      = cacti_escapeshellcmd(read_config_option('path_php_binary', true));
+			$php      = cacti_escapeshellcmd((string) read_config_option('path_php_binary', true));
 			$php_file = cacti_escapeshellarg(CACTI_PATH_INSTALL . '/background.php') . ' ' . $backgroundTime;
 
 			log_install_always('', __('Spawning background process: %s %s', $php, $php_file));
@@ -3931,7 +3931,7 @@ class Installer implements JsonSerializable {
 			$this->setProgress(Installer::PROGRESS_DEVICE_TEMPLATE);
 			log_install_always('', __('Device Template for First Cacti Device is %s', $host_template_id));
 
-			$command = cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' .
+			$command = cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' .
 				cacti_escapeshellarg(CACTI_PATH_CLI . '/add_device.php') .
 				' --description=' . cacti_escapeshellarg($description) .
 				' --ip=' . cacti_escapeshellarg($ip) .
@@ -3985,7 +3985,7 @@ class Installer implements JsonSerializable {
 
 					$this->setProgress(Installer::PROGRESS_DEVICE_TREE);
 					log_install_always('', __('Adding Device to Default Tree'));
-					shell_exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' .
+					shell_exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' .
 						cacti_escapeshellarg(CACTI_PATH_CLI . '/add_tree.php') .
 						' --type=node' .
 						' --node-type=host' .
@@ -4043,7 +4043,7 @@ class Installer implements JsonSerializable {
 
 				if (!empty($name)) {
 					log_install_always('', __('Converting Table #%s \'%s\'', $i, $name), true);
-					$results = shell_exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' .
+					$results = shell_exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' .
 						cacti_escapeshellarg(CACTI_PATH_CLI . '/convert_tables.php') .
 						' --table=' . cacti_escapeshellarg($name) .
 						' --utf8 --innodb --dynamic');

lib/poller.php

@@ -2324,7 +2324,7 @@ function replicate_table_to_poller(mixed $db_conn, array &$data, string $table,
 function poller_recovery_flush_boost(int $poller_id) : void {
 	if ($poller_id > 1) {
 		if (CACTI_CONNECTION == 'recovery') {
-			$command_string = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+			$command_string = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 			$extra_args     = '-q ' . cacti_escapeshellarg(CACTI_PATH_BASE . '/poller_recovery.php');
 			exec_background($command_string, $extra_args);
 		}

lib/utility.php

@@ -1826,7 +1826,7 @@ function utility_php_sort_extensions(mixed $a, mixed $b) : int {
 }
 
 function utility_php_extensions() : array {
-	$php      = cacti_escapeshellcmd(read_config_option('path_php_binary', true));
+	$php      = cacti_escapeshellcmd((string) read_config_option('path_php_binary', true));
 	$php_file = cacti_escapeshellarg(CACTI_PATH_INSTALL . '/cli_check.php') . ' extensions';
 	$json     = shell_exec($php . ' -q ' . $php_file);
 
@@ -1887,7 +1887,7 @@ function utility_php_verify_extensions(mixed &$extensions, string $source) : voi
 }
 
 function utility_php_recommends() : array {
-	$php        = cacti_escapeshellcmd(read_config_option('path_php_binary', true));
+	$php        = cacti_escapeshellcmd((string) read_config_option('path_php_binary', true));
 	$php_file   = cacti_escapeshellarg(CACTI_PATH_INSTALL . '/cli_check.php') . ' recommends';
 	$json       = shell_exec($php . ' -q ' . $php_file);
 	$ext        = ['web' => '', 'cli' => ''];
@@ -2014,7 +2014,7 @@ function utility_php_set_recommends_text(mixed &$recs) : void {
 }
 
 function utility_php_optionals() : array {
-	$php      = cacti_escapeshellcmd(read_config_option('path_php_binary', true));
+	$php      = cacti_escapeshellcmd((string) read_config_option('path_php_binary', true));
 	$php_file = cacti_escapeshellarg(CACTI_PATH_INSTALL . '/cli_check.php') . ' optionals';
 	$json     = shell_exec($php . ' -q ' . $php_file);
 	$opt      = [];

lib/variables.php

@@ -321,7 +321,7 @@ function expand_title(int $host_id, int $snmp_query_id, string $snmp_index, stri
  */
 function substitute_script_query_path(string $path) : string {
 	$path = clean_up_path(str_replace('|path_cacti|', CACTI_PATH_BASE, $path));
-	$path = clean_up_path(str_replace('|path_php_binary|', read_config_option('path_php_binary'), $path));
+	$path = clean_up_path(str_replace('|path_php_binary|', (string) read_config_option('path_php_binary'), $path));
 
 	return $path;
 }

poller.php

@@ -724,12 +724,12 @@ while ($poller_runs_completed < $poller_runs) {
 			$total_procs    = $concurrent_processes * $max_threads;
 			chdir(dirname(read_config_option('path_spine')));
 		} elseif (CACTI_SERVER_OS == 'unix') {
-			$command_string = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+			$command_string = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 			$extra_args     = '-q ' . cacti_escapeshellarg(CACTI_PATH_BASE . '/cmd.php');
 			$method         = 'cmd.php';
 			$total_procs    = $concurrent_processes;
 		} else {
-			$command_string = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+			$command_string = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 			$extra_args     = '-q ' . cacti_escapeshellarg(cacti_strtolower(CACTI_PATH_BASE . '/cmd.php'));
 			$method         = 'cmd.php';
 			$total_procs    = $concurrent_processes;
@@ -902,7 +902,7 @@ while ($poller_runs_completed < $poller_runs) {
 			[$poller_id], '', true, $poller_db_cnn_id);
 
 		if ($commands > 0) {
-			$command_string = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+			$command_string = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 			$extra_args     = '-q ' . cacti_escapeshellarg(CACTI_PATH_BASE . '/poller_commands.php') . ' --poller=' . $poller_id;
 			exec_background($command_string, $extra_args);
 		} else {
@@ -1173,7 +1173,7 @@ function poller_replicate_check() : void {
 
 	if (cacti_sizeof($pollers)) {
 		foreach ($pollers as $poller) {
-			$command_string = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+			$command_string = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 			$extra_args     = '-q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/poller_replicate.php') . ' --poller=' . $poller['id'];
 			exec_background($command_string, $extra_args);
 		}
@@ -1450,7 +1450,7 @@ function multiple_poller_boost_check() : void {
 function spikekill_poller_bottom() : void {
 	require_once(CACTI_PATH_LIBRARY . '/poller.php');
 
-	$command_string = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+	$command_string = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 	$extra_args     = '-q ' . cacti_escapeshellarg(CACTI_PATH_BASE . '/poller_spikekill.php');
 	exec_background($command_string, $extra_args);
 }

poller_maintenance.php

@@ -323,7 +323,7 @@ function reindex_devices() : bool {
 	// 2 - Weekly on Sunday
 	// 3 - Monthly on Sunday
 
-	$command_string = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+	$command_string = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 	$extra_args     = CACTI_PATH_CLI . '/poller_reindex_hosts.php --id=all --qid=all';
 
 	if ($schedule == 0) {

poller_realtime.php

@@ -145,7 +145,7 @@ $change_files = false;
 $max_threads = read_config_option('max_threads');
 
 // Determine Command Name
-$command_string = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+$command_string = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 $extra_args     = '-q ' . cacti_escapeshellarg(CACTI_PATH_BASE . '/cmd_realtime.php') . ' ' . cacti_escapeshellarg($poller_id) . " $graph_id $interval";
 
 // Determine if Realtime will work or not

poller_spikekill.php

@@ -263,7 +263,7 @@ function kill_spikes(array $templates, int &$found) : int {
 		foreach ($rrdfiles as $f) {
 			debug("Removing Spikes from '$f'");
 
-			$response = exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' .
+			$response = exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' .
 				cacti_escapeshellarg(CACTI_PATH_CLI . '/removespikes.php') . ' --rrdfile=' . cacti_escapeshellarg($f) . ($debug ? ' --debug' : ''));
 
 			if (substr_count($response, 'Spikes Found and Remediated')) {

remote_agent.php

@@ -543,7 +543,7 @@ function run_remote_data_query() : void {
 function run_remote_discovery() : void {
 	$poller_id = cacti_escapeshellarg((string) POLLER_ID);
 	$network   = cacti_escapeshellarg(gfrv('network'));
-	$php       = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+	$php       = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 	$path      = cacti_escapeshellarg(read_config_option('path_webroot') . '/poller_automation.php');
 
 	$options   = ' --poller=' . $poller_id . ' --network=' . $network . ' --force';

snmpagent_mibcache.php

@@ -46,7 +46,7 @@ if (file_exists($path_mibcache_lock) && is_writable($path_mibcache_lock)) {
 }
 
 // start background caching process if not running
-$php        = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+$php        = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 $extra_args = ' ' . cacti_escapeshellarg('./snmpagent_mibcachechild.php');
 
 while (true) {

snmpagent_persist.php

@@ -75,7 +75,7 @@ $cache_last_refresh = false;
 get_options();
 
 // start background caching process if not running
-$php            = cacti_escapeshellcmd(read_config_option('path_php_binary'));
+$php            = cacti_escapeshellcmd((string) read_config_option('path_php_binary'));
 $extra_args     = '-q ' . cacti_escapeshellarg('./snmpagent_mibcache.php');
 
 if (cacti_strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {

tests/Unit/GraphRealtimeShellTest.php

@@ -27,7 +27,7 @@ $graphRealtimePath = __DIR__ . '/../../graph_realtime.php';
 test('graph_realtime.php uses cacti_escapeshellcmd for PHP binary', function () use ($graphRealtimePath) {
 	$contents = file_get_contents($graphRealtimePath);
 
-	expect($contents)->toContain("cacti_escapeshellcmd(read_config_option('path_php_binary')");
+	expect($contents)->toContain("cacti_escapeshellcmd((string) read_config_option('path_php_binary')");
 });
 
 test('graph_realtime.php uses cacti_escapeshellarg for poller_realtime script path', function () use ($graphRealtimePath) {

tests/Unit/PhpBinaryPathNullCoercionTest.php

@@ -0,0 +1,147 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * path_php_binary is the one path setting in include/global_settings.php with
+ * no 'default' key, so read_default_config_option() returns null for it and
+ * read_config_option() hands back null whenever the settings row is absent.
+ * That happens on a fresh install and after a partial one.
+ *
+ * Three callers then passed the null straight into a string parameter. PHP
+ * coerces it to '' and raises a deprecation today; PHP 9 makes it a TypeError,
+ * which would take out script query collection, poller maintenance and the
+ * boost launcher. The callers already handle an empty path, so making the
+ * coercion explicit changes nothing except the warning.
+ */
+
+/**
+ * Reads a function body out of a source file.
+ *
+ * @param string $file     Repository-relative path to the file.
+ * @param string $function The function name to extract.
+ *
+ * @return string The body, up to the next top-level function.
+ */
+function php_binary_body(string $file, string $function) : string {
+	$source = file_get_contents(dirname(__DIR__, 2) . '/' . $file);
+
+	expect($source)->not->toBeFalse("$file must be readable");
+
+	$start = strpos($source, 'function ' . $function . '(');
+
+	expect($start)->not->toBeFalse("$function must exist in $file");
+
+	$end = strpos($source, "\nfunction ", $start + 1);
+
+	return substr($source, $start, ($end === false ? strlen($source) : $end) - $start);
+}
+
+test('path_php_binary really has no default to fall back on', function () {
+	$settings = file_get_contents(dirname(__DIR__, 2) . '/include/global_settings.php');
+	expect($settings)->not->toBeFalse('include/global_settings.php must be readable');
+
+	$start = strpos($settings, "'path_php_binary' => [");
+	expect($start)->not->toBeFalse();
+
+	$end = strpos($settings, "\n\t],", $start);
+	expect($end)->not->toBeFalse('path_php_binary settings block must have a closing delimiter');
+
+	$block = substr($settings, $start, $end - $start);
+
+	// if a default is ever added, these casts stop being load-bearing
+	expect($block)->toContain("'method'")
+		->and($block)->not->toContain("'default'");
+});
+
+test('a null option is what PHP deprecates, so the guard is not theoretical', function () {
+	$raised                  = null;
+	$previousErrorReporting = error_reporting(E_ALL);
+
+	set_error_handler(function ($number, $string) use (&$raised) {
+		$raised = $string;
+
+		return true;
+	});
+
+	try {
+		str_replace('|path_php_binary|', null, '|path_php_binary|/x');
+	} finally {
+		// restore before asserting, so a failure here cannot leave the custom
+		// handler installed for the rest of the run
+		restore_error_handler();
+		error_reporting($previousErrorReporting);
+	}
+
+	expect($raised)->toContain('Passing null to parameter');
+});
+
+test('the script query path substitution casts the binary path', function () {
+	expect(php_binary_body('lib/variables.php', 'substitute_script_query_path'))
+		->toContain("(string) read_config_option('path_php_binary')");
+});
+
+test('poller maintenance casts the binary path before escaping it', function () {
+	expect(php_binary_body('lib/functions.php', 'poller_maintenance'))
+		->toContain("cacti_escapeshellcmd((string) read_config_option('path_php_binary'))");
+});
+
+test('no shipped file escapes the binary path without casting it first', function () {
+	$root = dirname(__DIR__, 2);
+
+	if (!function_exists('exec') || str_contains((string) ini_get('disable_functions'), 'exec')) {
+		test()->markTestSkipped('exec is disabled, so the shipped file list is unavailable');
+	}
+
+	exec('git -C ' . escapeshellarg($root) . ' ls-files "*.php"', $tracked, $status);
+
+	if ($status !== 0 || $tracked === []) {
+		test()->markTestSkipped('not a git checkout, so the shipped file list is unknown');
+	}
+
+	$unguarded = [];
+
+	foreach ($tracked as $file) {
+		if (str_starts_with($file, 'tests/') || str_contains($file, 'vendor/')) {
+			continue;
+		}
+
+		$source = file_get_contents($root . '/' . $file);
+
+		if ($source !== false && preg_match(
+			'/cacti_escapeshellcmd\s*\(\s*(?!\(\s*string\s*\)\s*)read_config_option\s*\(\s*[\'\"]path_php_binary[\'\"](?:\s*,[^)]*)?\)/',
+			$source
+		)) {
+			$unguarded[] = $file;
+		}
+	}
+
+	// there were 21 of these; a new one is easier to add than to notice
+	expect($unguarded)->toBe([]);
+});
+
+/**
+ * The callers treat an unset path as "assume it is on the PATH", so the cast
+ * has to preserve that rather than turn it into a literal 'null' or an error.
+ */
+test('casting a null option yields the empty string the callers expect', function () {
+	$option = null;
+
+	expect((string) $option)->toBe('')
+		->and(empty((string) $option))->toBeTrue();
+});

tests/security/baselines/architectural_hotspots.baseline.tsv

@@ -18,8 +18,8 @@ cmd_exec	./cli/update_heartbeat.php:274				$result = exec($command, $output, $re
 cmd_exec	./cmd.php:342			$cactiphp = proc_open($command, $cactides, $pipes);
 cmd_exec	./cmd_realtime.php:127				$cactiphp = proc_open(read_config_option('path_php_binary') . ' -q ' . CACTI_PATH_BASE . '/script_server.php realtime ' . cacti_escapeshellarg($poller_id), $cactides, $pipes);
 cmd_exec	./graph_realtime.php:226			shell_exec($php_binary . ' -q ' . $script_path . ' ' . $args);
-cmd_exec	./host.php:203		shell_exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/poller_reindex_hosts.php') . ' --qid=all --id=' . $host_id);
-cmd_exec	./install/functions.php:958				$shell_output       = shell_exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/import_package.php') . ' --filename=' . cacti_escapeshellarg("/$path/$xmlfile") . ' --info');
+cmd_exec	./host.php:203		shell_exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/poller_reindex_hosts.php') . ' --qid=all --id=' . $host_id);
+cmd_exec	./install/functions.php:958				$shell_output       = shell_exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/import_package.php') . ' --filename=' . cacti_escapeshellarg("/$path/$xmlfile") . ' --info');
 cmd_exec	./install/install.php:135			print '<li>' . __('The shell_exec() and/or exec() functions are currently blocked.') . '<br>' . __('See the PHP Manual: <a href="http://php.net/manual/en/ini.core.php#ini.disable-functions">Disable Functions</a>.') . '</li>';
 cmd_exec	./lib/database.php:2663			exec("$dump_esc $options $credentials_string " . cacti_escapeshellarg($database) . ($tables_esc !== '' ? ' ' . $tables_esc : '') . " > $output_esc", $output, $retval);
 cmd_exec	./lib/database.php:2665			exec("$dump_esc $options $credentials_string " . cacti_escapeshellarg($database) . ' version >/dev/null 2>&1', $output, $retval);
@@ -44,8 +44,8 @@ cmd_exec	./lib/functions.php:9997			$output = shell_exec('powershell -Command "G
 cmd_exec	./lib/installer.php:3564			$check    = shell_exec("$composer install --dry-run --no-interaction --working-dir=$base 2>&1");
 cmd_exec	./lib/installer.php:3607			$output = shell_exec("$composer install --no-interaction --no-progress --working-dir=$base 2>&1");
 cmd_exec	./lib/installer.php:3949				$last_line = exec($command, $output, $return);
-cmd_exec	./lib/installer.php:3988						shell_exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' .
-cmd_exec	./lib/installer.php:4046						$results = shell_exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' .
+cmd_exec	./lib/installer.php:3988						shell_exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' .
+cmd_exec	./lib/installer.php:4046						$results = shell_exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' .
 cmd_exec	./lib/installer.php:965						$output = shell_exec(
 cmd_exec	./lib/installer.php:979						$output = shell_exec(cacti_escapeshellcmd(str_replace('\\', '/', $path)) . ' --version 2>&1');
 cmd_exec	./lib/ping.php:175					$result = shell_exec(cacti_escapeshellarg($fping) . ' -q -t ' . $this->timeout . ' -c 1 -r ' . $this->retries . ' ' . cacti_escapeshellarg($this->host['hostname']) . ' 2>&1');
@@ -97,7 +97,7 @@ cmd_exec	./lib/utility.php:1892		$json       = shell_exec($php . ' -q ' . $php_f
 cmd_exec	./lib/utility.php:2019		$json     = shell_exec($php . ' -q ' . $php_file);
 cmd_exec	./poller_realtime.php:166	shell_exec("$command_string $extra_args");
 cmd_exec	./poller_realtime.php:252					shell_exec($command);
-cmd_exec	./poller_spikekill.php:266				$response = exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' .
+cmd_exec	./poller_spikekill.php:266				$response = exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' .
 cmd_exec	./remote_agent.php:472									$cactiphp = proc_open(read_config_option('path_php_binary') . ' -q ' . CACTI_PATH_BASE . '/script_server.php realtime ' . cacti_escapeshellarg($poller_id), $cactides, $pipes);
 cmd_exec	./script_server.php:194					exec("TASKLIST /FO LIST /FI \"PID eq $ppid\"", $out);
 cmd_exec	./scripts/sql.php:17	$sql = shell_exec($cmd);

tests/security/baselines/sink_inventory.baseline.tsv

@@ -18,8 +18,8 @@ cmd_exec	./cli/update_heartbeat.php:274				$result = exec($command, $output, $re
 cmd_exec	./cmd.php:342			$cactiphp = proc_open($command, $cactides, $pipes);
 cmd_exec	./cmd_realtime.php:127				$cactiphp = proc_open(read_config_option('path_php_binary') . ' -q ' . CACTI_PATH_BASE . '/script_server.php realtime ' . cacti_escapeshellarg($poller_id), $cactides, $pipes);
 cmd_exec	./graph_realtime.php:226			shell_exec($php_binary . ' -q ' . $script_path . ' ' . $args);
-cmd_exec	./host.php:203		shell_exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/poller_reindex_hosts.php') . ' --qid=all --id=' . $host_id);
-cmd_exec	./install/functions.php:958				$shell_output       = shell_exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/import_package.php') . ' --filename=' . cacti_escapeshellarg("/$path/$xmlfile") . ' --info');
+cmd_exec	./host.php:203		shell_exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/poller_reindex_hosts.php') . ' --qid=all --id=' . $host_id);
+cmd_exec	./install/functions.php:958				$shell_output       = shell_exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/import_package.php') . ' --filename=' . cacti_escapeshellarg("/$path/$xmlfile") . ' --info');
 cmd_exec	./install/install.php:135			print '<li>' . __('The shell_exec() and/or exec() functions are currently blocked.') . '<br>' . __('See the PHP Manual: <a href="http://php.net/manual/en/ini.core.php#ini.disable-functions">Disable Functions</a>.') . '</li>';
 cmd_exec	./lib/database.php:2663			exec("$dump_esc $options $credentials_string " . cacti_escapeshellarg($database) . ($tables_esc !== '' ? ' ' . $tables_esc : '') . " > $output_esc", $output, $retval);
 cmd_exec	./lib/database.php:2665			exec("$dump_esc $options $credentials_string " . cacti_escapeshellarg($database) . ' version >/dev/null 2>&1', $output, $retval);
@@ -44,8 +44,8 @@ cmd_exec	./lib/functions.php:9997			$output = shell_exec('powershell -Command "G
 cmd_exec	./lib/installer.php:3564			$check    = shell_exec("$composer install --dry-run --no-interaction --working-dir=$base 2>&1");
 cmd_exec	./lib/installer.php:3607			$output = shell_exec("$composer install --no-interaction --no-progress --working-dir=$base 2>&1");
 cmd_exec	./lib/installer.php:3949				$last_line = exec($command, $output, $return);
-cmd_exec	./lib/installer.php:3988						shell_exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' .
-cmd_exec	./lib/installer.php:4046						$results = shell_exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' .
+cmd_exec	./lib/installer.php:3988						shell_exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' .
+cmd_exec	./lib/installer.php:4046						$results = shell_exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' .
 cmd_exec	./lib/installer.php:965						$output = shell_exec(
 cmd_exec	./lib/installer.php:979						$output = shell_exec(cacti_escapeshellcmd(str_replace('\\', '/', $path)) . ' --version 2>&1');
 cmd_exec	./lib/ping.php:175					$result = shell_exec(cacti_escapeshellarg($fping) . ' -q -t ' . $this->timeout . ' -c 1 -r ' . $this->retries . ' ' . cacti_escapeshellarg($this->host['hostname']) . ' 2>&1');
@@ -97,7 +97,7 @@ cmd_exec	./lib/utility.php:1892		$json       = shell_exec($php . ' -q ' . $php_f
 cmd_exec	./lib/utility.php:2019		$json     = shell_exec($php . ' -q ' . $php_file);
 cmd_exec	./poller_realtime.php:166	shell_exec("$command_string $extra_args");
 cmd_exec	./poller_realtime.php:252					shell_exec($command);
-cmd_exec	./poller_spikekill.php:266				$response = exec(cacti_escapeshellcmd(read_config_option('path_php_binary')) . ' -q ' .
+cmd_exec	./poller_spikekill.php:266				$response = exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' .
 cmd_exec	./remote_agent.php:472									$cactiphp = proc_open(read_config_option('path_php_binary') . ' -q ' . CACTI_PATH_BASE . '/script_server.php realtime ' . cacti_escapeshellarg($poller_id), $cactides, $pipes);
 cmd_exec	./script_server.php:194					exec("TASKLIST /FO LIST /FI \"PID eq $ppid\"", $out);
 cmd_exec	./scripts/sql.php:17	$sql = shell_exec($cmd);