6 Commits

Include renames

Author	SHA1	Message	Date
Thomas Vincent	e2a5f32ee9	fix(ci): [develop] harden dependency installs and Docker build boundaries (#8294) ... * security(ci): constrain dependency installs and container build boundaries Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(docker): retain shipped runtime libraries in build context Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(tooling): quote gettext paths and honor Docker base selection Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test(auth): use certificate expiry truth in rendering assertions Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(tooling): finish Docker layer and regex scan findings Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(ci): preserve documentation badge anchors without alternation Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test(ci): preserve contributor badges and enforce Python coverage Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: share changed-code coverage contracts and enforce shell policy Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(ci): enforce private review files and run path regressions Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: measure changed gettext shell coverage Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: pin coverage to the reviewed PR revision Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>	2026-10-14 22:52:37 -04:00
Thomas Vincent	8221a941a7	test(performance): [develop] add disposable browser and SQL/RRD profiling (#8336) ... * perf: add disposable browser and SQL/RRD profiling Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: record profiling harness in the changelog Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>	2026-10-14 00:01:32 -07:00
Thomas Vincent	d8d81f273d	build: make the containerised test image run the whole suite (#7953)	2026-09-04 13:37:37 -07:00
Thomas Vincent	d4e255b5d9	security: stage nonce CSP migration and gated enforcement (#7662) ... * security: add nonce CSP mode for inline JavaScript protection Reworks the content_security_policy_script setting into a three-mode Inline JavaScript Protection dropdown (HTMLX default, Nonce, None) and ports the per-request nonce, strict-dynamic policy, and CSP violation report endpoint from 1.2.x. The stored option key and its default are unchanged, so existing installs keep their current policy byte-for-byte; nonce mode is opt-in. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * security: stage nonce CSP enforcement safely Add report-only migration, gated enforcement, nonce-aware shared emitters, Linux Docker validation, and operator documentation.\n\nRefs #7703 * security: validate CSP header sources Reject malformed alternate-source configurations at the CSP boundary, validate fallback report URIs, and remove the obsolete Psalm header-taint baseline entry.\n\nRefs #7705 * chore: drop the composer.json change from this PR Dependency and manifest changes are a maintainer call and do not belong in this one. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>	2026-08-16 21:38:46 -04:00
3 people	242751e41b	fix: harden Docker dev environment (#6621) ... * fix: harden Docker dev environment and add smoke tests Address Copilot review feedback from #6618: input validation on DB env vars in entrypoint, scoped AllowOverride, localhost-only DB port binding, security headers (Referrer-Policy, Permissions-Policy, X-Permitted-Cross-Domain-Policies), reduced php-fpm worker count, expose_php disabled, and .env excluded from git. Adds tests/tools/check_docker.sh — 29-point smoke test covering build, health, PHP extensions, config generation, cron, HTTP, security headers, and DB connectivity. * Update docker/entrypoint.sh Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: address Copilot and TheWitness review feedback tests/tools/check_docker.sh: - shebang: #!/bin/bash -> #!/usr/bin/env bash (consistent with repo) - add GPL copyright header (2004-2026) - fix grep pattern: single-quoted '^${ext}$' never expanded variable; use double quotes so extension name is actually matched - add opcache to REQUIRED_EXTS (TheWitness) docker/entrypoint.sh: - shebang: #!/bin/bash -> #!/usr/bin/env bash docker/Dockerfile: - rrdtool comment: clarify that 1.9+ enables graph tooltip output via graphv, not merely "hover tooltips" (TheWitness) docker/apache.conf: - X-XSS-Protection: add TODO comment noting it is deprecated and that Cacti sets its own headers at the application layer (TheWitness) --------- Co-authored-by: TheWitness <thewitness@cacti.net> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2026-02-17 22:46:45 -05:00
Thomas Vincent	016fbe9b1b	feat: add Docker-based development environment (#6618) ... PHP 8.4-fpm with Apache, MariaDB 11.8, rrdtool. Configurable via .env (ports, credentials, DB tuning). Schema auto-imported from cacti.sql on first startup. Closes #6617	2026-02-14 11:33:49 -05:00