* Port #8166 SNMP credential cache + procedural SNMPv3 to develop
Ports the shared SNMPv3 credential cache and procedural SNMPv3 routing from the
1.2.x feature (merged as #8166) onto develop, adapted to develop's refactored
SNMP layer. Parts of the 1.2.x change that do not apply to develop are omitted:
the cacti_exec() idle-timeout rewrite (develop has no cacti_exec()), the PHP
floor bump and composer/doc changes (develop is already 8.3+), and the cmd.php
max_oids batching (develop's cmd.php already collects SNMP in-process through
persistent sessions, so the per-item spawn the batching removed does not occur).
- lib/cache.php: new cross-process \Cacti\Cache\SharedCache (file + POSIX
shared-memory + process-local tiers, optional AES-256-GCM sealing). Loaded via
lib/snmp.php (the Cacti\Cache\ namespace is not PSR-4 autoloaded). The crypto
helpers it seals with already live in develop's lib/auth.php, loaded by
global.php, so no duplicate was added.
- lib/snmp.php: snmp_get_method() now routes SNMPv3 get/getnext to the
procedural snmp3_*() calls when the running PHP supports the configured
auth/privacy tokens and no context/engine id is set (SHA-224/384 and
AES-192/256[C] stay on the binary before PHP 8.6); the three single-get
functions gain the procedural v3 path with \Throwable handling; adds the
credential-cache subsystem, protocol-option/MD5-DES helpers,
snmp_native_protocol(), snmp_format_agent() and cacti_snmp_get_multi(); the
binary v3 auth builder consults the cache when enabled.
- poller.php / script_server.php: prime / load the shared cache.
- poller_maintenance.php: daily out-of-band cache rebuild on every collector
(per-poller lastrun marker).
- lib/api_device.php / lib/utility.php: bump snmp_cred_version only on v3
credential add/change (and propagate the token to the affected remote poller).
- include/global.php: resolve and create the private cache/ directory.
- include/global_settings.php: add 'Enable Credential Cache' and 'Enable MD5 and
DES for SNMPv3' settings (both off by default); default new-device v3
auth/privacy to SHA/AES instead of legacy MD5/DES.
- host.php / automation_snmp.php: drop MD5/DES from the pickers when disabled and
default new records to SHA/AES on upgraded installs.
- include/config.php.dist: document $config['cache_dir'].
- tests/Unit/Core/Cache/SharedCacheTest.php: SharedCache behaviour coverage.
- tests/security/baselines: baseline the two new lib/cache.php sinks.
* Incorporate #8171: binary fallback for unsupported SNMPv3 protocols
Layers PR #8171 onto the develop port so an SNMPv3 device whose auth/privacy
protocols the running PHP's ext-snmp cannot service natively (e.g. AES-256
before PHP 8.6) no longer fatals the poller or device-edit screen.
- lib/snmp.php: add CactiSnmpBinarySession, a session stand-in exposing the
get/getnext/walk/close interface the cacti_snmp_session_*() helpers use and
delegating each call to cacti_snmp_*() -> the Net-SNMP binary.
cacti_snmp_session() returns it when php-snmp is absent or the v3 protocol is
not natively serviceable, so cmd.php/host.php collect these devices via the
binary on pre-8.6 and switch to the in-process path on 8.6 with no caller
change. v1/v2 snmpget/snmp2_get now go through snmp_format_agent(). The
ERRNO_TIMEOUT check tolerates php-snmp being absent. Drop the vendored
classSNMP.php compatibility shim and its include (and the Yandex attribution).
- cmd.php: open_snmp_session() returns the down sentinel when a host is already
marked down this run, instead of returning an unset (null) []
that cacti_snmp_session_get() then dereferenced (TypeError).
- lib/ping.php: ping_snmp() runs the availability check through the procedural
cacti_snmp_get()/getnext() path so an unsupported protocol falls back to the
binary instead of raising a ValueError in SNMP::setSecurity().
* Incorporate #8172: retire include/vendor/phpsnmp, relocate into lib
Follow-up to #8171 on the develop port. After classSNMP.php was removed, the
include/vendor/phpsnmp/ directory held only Cacti-owned files; this retires it.
- lib/snmp.php: the ext-snmp subclass that carried Cacti's bulk_walk_size /
value_output_format (previously vendor/phpsnmp/extension.php) is now declared
directly as CactiSnmpNativeSession, guarded by CACTI_PHP_SNMP; the include and
the 'use phpsnmp\SNMP' alias are gone, and new SNMP(...) / SNMP::VERSION_*
now reference the native \SNMP and the new subclass.
- lib/mib_parser.php: moved from include/vendor/phpsnmp/mib_parser.php;
lib/mib_cache.php includes it via __DIR__.
- Remove include/vendor/phpsnmp/extension.php and index.php (directory retired).
- tests: SnmpCoverageTest uses \SNMP::ERRNO_TIMEOUT now that phpsnmp\SNMP is
gone; drop the stale include/vendor/phpsnmp/ entry from the vendor-policy
allowlist.
develop's sink baseline tracks constant-based includes differently than 1.2.x,
so no baseline refresh was needed here.
* Address PR #8174 review: snmp_get_method params, v3 walk, getnext agent, cache bump, CHANGELOG
- lib/snmp.php: restore $php_snmp as the 6th snmp_get_method() parameter and move
the new $auth_proto/$priv_proto after it (callers pass them by name), so the
positional $php_snmp used by SnmpCoverageTest and others keeps working.
- lib/snmp.php: keep every SNMPv3 operation except get/getnext on the Net-SNMP
binary - the native walk branch implements only v1/v2, so a v3 walk reaching
the procedural gate would have silently returned empty when path_snmpbulkwalk
is missing.
- lib/snmp.php: cacti_snmp_getnext() v1/v2 branches now use snmp_format_agent()
like get/get_raw, so an IPv6 literal / non-default port is bracketed.
- lib/api_device.php: bump snmp_cred_version only when the host's v3 membership
or one of the cached credential fields actually changed, instead of on every
save of a v3 device.
- CHANGELOG: move the #8171 entry into the issue block and the #8166 entries into
the feature block, matching the established section ordering.
* Fix CI: unbracket IPv4/DNS SNMP targets, inline auth-cache SQL columns, apply phpcsfixer standard
* Refresh sink inventory baseline after short-array normalization
* Restore lib/snmp.php 100% coverage after aligning v3 routing to 1.2.x
- update the three SnmpCoverageTest assertions that still encoded develop's
pre-port behavior: v3 snmp_get_method now returns PHP, an unsupported-
protocol v3 session returns the binary-delegating session object, and the
v3 cacti_snmp_get path runs natively
- add a v3 noAuthNoPriv user to the snmp-coverage snmpd fixture so native
snmp3_get is exercised deterministically
- add tests covering the ported subsystems to 100%: shared auth cache,
binary-delegating session, protocol pickers, v3 credential args,
cacti_snmp_get_multi, and the cacti_get_snmpv3_auth cache path
- snmp_auth_cache_load uses a resettable process guard so its enabled and
disabled branches are both coverable in a single process
* Resolve phpstan errors in the relocated SNMP MIB parser and ported snmp.php
- lib/mib_parser.php: type the MibParser properties, add parameter/return
types, guard file_get_contents()/preg_split() against false, correct the
parse_bracket_token delimiter params (string, not integer), and drop the
unreachable return after trigger_error(E_USER_ERROR) - now phpstan clean
- lib/mib_cache.php: drop the redundant isset($mp->oids) guard (the typed
property is always initialized; $mp->mib is the real check)
- lib/snmp.php: type the CactiSnmpBinarySession and CactiSnmpNativeSession
properties/methods and pass bool to snmp_set_quick_print()
- .phpstan.neon: ignore greaterOrEqual.alwaysFalse alongside the existing
greater.alwaysFalse (the PHP_VERSION_ID >= 80600 forward-compat gate)
- regenerate phpstan-baseline.neon for the irreducible ext-snmp stub
strictness (snmp3_get literal-union protocols, int<-1,max> timeouts) in
the ported procedural v3 path, the new lib/cache.php shmop stubs, and the
$config array-shape offsets in include/global.php
* Make the v3 getter catch coverage net-snmp-build-independent
The DES-rejection trick that drove the procedural snmp3_get()/snmp3_getnext()
try/catch blocks only works on net-snmp builds compiled without DES; CI's
Debian net-snmp accepts DES, so those catches went uncovered (98.3%).
- extend the existing native_get injection seam (already on cacti_snmp_get)
to cacti_snmp_get_raw, cacti_snmp_getnext, and cacti_snmp_get_multi, and
drive the catch blocks with a throwing native getter in the test
- mark the seam-less cacti_snmp_session() setSecurity catch with
@codeCoverageIgnore (it only throws for a protocol the running net-snmp
rejects, which is not portably reproducible in the fixture)
* Exclude ext-snmp/PHP-8.6-gated defensive branches from snmp coverage
Two branches in lib/snmp.php are unreachable on the PHP 8.3 + ext-snmp
coverage runner and were only "covered" locally via opcache dead-code
elimination:
- snmp_get_method()'s !function_exists('snmp3_get') fallback (ext-snmp
always provides snmp3_get)
- snmp_php_v3_protocols_supported()'s PHP_VERSION_ID >= 80600 block
(SHA-224/384 and AES-192/256 tokens are only accepted on PHP 8.6+)
Mark both with @codeCoverageIgnore so the 100% gate is deterministic
across runners regardless of opcache settings.
* Account for the #8166 SNMPv3 credential-cache gate query in the batching test
poller_update_poller_cache_from_buffer() now runs one SELECT per flush to
decide whether the flush touched SNMPv3 poller items before bumping the shared
credential-cache version (matching 1.2.x). UpdateDataQueryCacheBatchingIntegrationTest
counted 4 statements per flush; update it to 5 (and 3 per-row flushes to 15,
1 batched flush to 5). The guard's intent - batching issues fewer statements
than per-row flushes - still holds.
* Port #8175: group SNMP options under an SNMP Behavior section
Mirror the 1.2.x settings reorganization (#8175) on develop. develop already
keeps the SNMP options in a dedicated SNMP tab, so add an "SNMP Behavior"
spacer there, order the behavior options as md5/des, credential cache, max
get size, bulkwalk fetch size, and move "Disable increasing OID Check" out of
the Poller tab to sit last in that group. Display-only; no settings added or
removed and no behavior change. Adds the "SNMP Behavior" heading to cacti.pot.
* fix: complete dependabot htmx 2.0.10 to 2.0.11 bump
Dependabot bumped package.json and package-lock.json to htmx.org 2.0.11
(PR 8179) but left the vendored include/js/htmx.js, its version marker,
and the pinned SRI constant at 2.0.10. The htmx-filters CI workflow runs
npm ci, which regenerates include/js/htmx.js from the 2.0.11 package, so
HtmxTest's runtime sha384 no longer matches the HTMX_2_0_10_SRI constant
and the integrity assertion fails.
Complete the bump: regenerate the vendored include/js/htmx.js to the
2.0.11 build, bump include/js/htmx.js.version to 2.0.11, rename
HTMX_2_0_10_SRI to HTMX_2_0_11_SRI with the recomputed sha384 hash, and
update the version/integrity assertions in tests/Unit/Ui/Html/HtmxTest.php
and tests/HandOff/HtmxLoaderHandOffTest.php. package.json and
package-lock.json match the values dependabot already landed on develop.
* settings: move SNMP Agent Support under the SNMP Behavior spacer
Relocate the enable_snmp_agent setting (SNMP Agent Support Enabled) so it
is the first item under the SNMP Behavior spacer instead of sitting in the
Poller General group, grouping it with the other SNMP behavior options.
* Address PR #8174 review: keep SHA-224/384 on the binary, honor port on transport targets
Resolves the two still-valid Copilot review findings on lib/snmp.php that were
left unresolved (only marked outdated after later commits shifted their lines).
- snmp_php_v3_protocols_supported(): drop SHA224/SHA384 from the native auth
allowlist. ext-snmp's SNMP::setSecurity()/snmp3_*() only map MD5/SHA/SHA256/
SHA512 - there is no SHA-224/SHA-384 mapping on any build, including PHP 8.6
(verified against php-src ext/snmp/snmp.c), so routing those tokens to the
procedural path raised a ValueError instead of using the binary. They now
always fall back to the Net-SNMP binary. The AES-192/256 privacy tokens that
ext-snmp does add on 8.6 stay gated behind PHP_VERSION_ID >= 80600.
- snmp_format_agent(): a udp/tcp transport-qualified target that omits a port
now has the configured non-default port appended (udp6:[2001:db8::1] + 1161 ->
udp6:[2001:db8::1]:1161), matching the Net-SNMP binary path. Targets that
already carry a port, and unix: sockets (no port), are left untouched.
- SnmpCoverageTest: cover the new transport-target branches; lib/snmp.php stays
at 100%.
* chore: replace unmaintained phpdiff vendor lib with jfcherng/php-diff
The manually-vendored include/vendor/phpdiff (chrisboulton/php-diff v1.1,
2009 - unmaintained since ~2013) backed the package-import file diff
viewer (package_import.php's package_diff_file()), its only call site.
Replace it with jfcherng/php-diff (^6.16, BSD-3-Clause), an actively
maintained continuation of the same library, declared as a real Composer
dependency in composer.json/composer.lock (installed at build/CI time,
same as this branch's other composer.json dependencies - not committed
to include/vendor, unlike the old hand-vendored phpdiff).
package_import.php now uses Jfcherng\Diff\Differ + RendererFactory in
place of the old Diff/Diff_Renderer_Html_Inline classes. Preserved the
existing nosemgrep justification comment, updated to reference the new
library's AbstractHtml::htmlSafe() escaping.
Adopted the vendor's own diff-table.css as the Diff.css in all 10 themes,
replacing the bespoke per-theme stylesheets that were tied to the old
library's class names.
* fix: address review feedback on jfcherng/php-diff migration
- package_import.php: narrow $oldfile/$newfile to array before
constructing Jfcherng\Diff\Differ so PHPStan can see the
false branch is excluded (fixes level 6/8 analysis failure).
- tests/tools/check_vendor_policy.php: drop the removed
include/vendor/phpdiff/ path from the legacy allowlist.
- tests/Unit/Security/Xss/PackageDiffRendererTest.php: rewrite
against the new Jfcherng\Diff\Differ/RendererFactory API instead
of the deleted vendored phpdiff classes.
* build: add symfony/security-csrf
Backs the CSRF token core that replaces the vendored csrf-magic fork.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test: fix security-csrf package path assertion
symfony/security-csrf ships CsrfTokenManager.php at the package root, not under src/.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* refactor: register the composer autoloader before the CSRF include
CSRF validation ran before the autoloader existed, which blocks any class-based guard.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* feat(csrf): add CactiCsrfGuard over symfony/security-csrf
Issues and validates session-scoped tokens; not yet wired into the request path.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* feat(csrf): accept pre-upgrade csrf-magic tokens during the grace window
Legacy tokens carry their own expiry, so the fallback closes itself without a config flag.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* feat(csrf): port the output buffer rewriter to CactiCsrfGuard
Keeps the hidden field name and JS globals that third-party plugins rely on.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(csrf): use json_encode for the JS script context in rewriteBuffer
htmlspecialchars() protects the HTML attribute context but not the
<script> string literal, which relied on Symfony's token generator
never emitting a quote rather than being safe by construction.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* refactor(csrf): move the XHR shim to include/js as Cacti-owned code
It has been maintained by the Cacti Group since 2020 and is not an upstream package.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* refactor(csrf): retire the vendored csrf-magic fork
The procedural csrf_* surface stays as a deprecated shim so plugins keep working.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* feat(csrf): validate requests through CactiCsrfGuard
csrf-magic self-invoked from its own file; the guard is called explicitly.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(install): stop gating the permission step on the csrf secret
Retiring csrf-magic removed the directory its default path lives in, and setStep() clamps to the first errored step, so no fresh install could advance.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(csrf): key the legacy fallback on the raw secret bytes
refresh_csrf.php writes PHP source with a trailing newline, and trimming that yields a different HMAC key than csrf-magic used.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(csrf): log when the guard degrades to disabled in a web context
The installer is the only web path that can reach it, and failing open in silence is not something csrf-magic could do.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: changelog for the CSRF library replacement
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(csrf): mint the token before the session write callback closes it
csrf_startup() minted lazily from the output buffer callback, which runs after session_write_close()'s shutdown-function registration, so a token minted there on a legacy-fallback POST was silently dropped.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(csrf): make refresh_csrf.php a no-op
Its default secret path no longer ships and live tokens are session-bound, not HMACs over the secret, so rotation neither worked nor did anything meaningful; running it during the upgrade grace window used to delete the legacy secret and kill validation for pre-upgrade tokens outright.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(csrf): fall back to the old default secret path when reading it
csrf-magic tried its own directory as a second candidate regardless of $path_csrf_secret; the new reader only tried the configured path, so a site pointing $path_csrf_secret at a file that was never created lost the legacy-token grace window entirely.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs(csrf): point the JS header at its BSD license sidecar
The header reduces the original BSD terms to prose and the actual text sits in an unreferenced csrf.js.LICENSE, so add a pointer to it.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(csrf): restore csrf_check()'s bool return and $fatal contract
The shim ignored $fatal and always returned void, so audit/audit.php's `!csrf_check(false)` evaluated `!null` (always true) and denied every request instead of getting a real pass/fail result back.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: reference the pull request number in the changelog entry
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test: resolve includes through Cacti path constants
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(csrf): enforce full coverage
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Harden CSRF fallback handling
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(csrf): assert the component stays out of the index
Committing it would leave a second copy to drift against the lock.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: align CSRF checks with PHP 8.2
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: normalize the CSRF changelog entry
* Fix CHANGELOG entry ordering
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(csrf): support constrained test environments
* fix(csrf): narrow nullable guard state
* test: place CSRF coverage in security domain
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* security(test): match disabled exec exactly
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: run CSRF coverage on PHP 8.3
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
* chore: manage front-end JavaScript libraries with npm and Dependabot
Move all third-party front-end JavaScript to npm so Dependabot tracks it, and
drop the committed copies in favour of a build. package.json pins jquery,
jquery-ui, jstree (3.3.12 -> 3.3.17), billboard.js, pace-js, tablesorter and
jquery-validation; build/sync-js.mjs copies their dist files into include/js/
and runs on npm install via postinstall.
pace-js carries a one-line local fix (a stray regex alternation that made it
match the empty string) applied through patch-package
(patches/pace-js+1.2.4.patch); the fix should be sent upstream so the patch can
be dropped. Only Cacti's own themed jquery-ui/jstree CSS stays committed.
An npm ecosystem is added to dependabot.yml for develop. The release pipeline
and any workflow that serves Cacti pages must run 'npm ci' (which builds via
postinstall) before use, since the generated files are no longer in the tree.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* hardening: remove vendored development artifacts
* feat(release): attach the built artifact to the release
The workflow already builds an attested, checksummed archive carrying the
Composer dependencies, then discards it after thirty days.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: fail the publish step when the bundle is empty
An unmatched glob would otherwise reach gh as a literal path.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: treat the maintenance lock notice as expected log output
The line records the lock working, so a second maintenance run overlapping
in CI failed unrelated pull requests.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: consolidate release dependency changelog
* ci: build managed JavaScript in release artifacts
* test: cover managed JavaScript build end to end
* deps: complete phpseclib 4 migration
* deps: update patch-package to audited release
* ci: satisfy workflow shell policy
* chore: source DOMPurify from npm and update it to 3.4.14
Add dompurify to the npm-managed set (was committed at 3.4.7) and bump to 3.4.14.
DOMPurify is the client-side XSS sanitizer used on tree labels, device tooltips
and plugin messages; keeping it current with upstream bypass fixes matters more
than for the UI libraries.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: preserve release changelog ordering
* test: preserve DOMPurify source map in npm build
* chore: source htmx, d3, big.js, lzjs and screenfull from npm
Add the remaining unmodified third-party libraries to the npm-managed build:
htmx.org 2.0.6, d3 7.8.2, big.js 6.2.2, lzjs 1.3.1 and screenfull 3.3.3. Each
was verified byte-identical (lzjs differs only in a JSDoc comment) to the copies
being removed. htmx in particular moves from a hand-tracked SHA pin to npm with
lockfile integrity.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test: cover phpseclib 4 integration
* ci: build managed assets before htmx tests
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Make PHP 8.1 dependency builds reproducible
* Tighten integration runner permissions
* Harden and standardize GitHub Actions
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Restore ripgrep for security guards
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Wait for Cacti daemon readiness in CI
* Satisfy strict shell policy in diagnostics
* Preserve Cacti config group ownership
* Run stateful Cacti checks as the web user
* Run privileged page-crawl harness as root
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Dependabot raises the composer.json constraints without reinstalling, so the
committed tree still held psr/log 1.1.4 against a ^3.0 requirement and
league/oauth2-google 4.2.0 against ^5.0. Guzzle, phpseclib and fast-route pick
up their current patch releases in the same pass.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix: stop tracking the generated CSRF secret so each install creates its own
Every install built from this tree inherited the committed secret, because
csrf_get_secret() only generates one when the file is missing or empty.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: append the changelog entry at the end of the issue block
Matches .github/copilot-instructions.md, which appends rather than inserting
in numeric order.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test: use the full licence header on the new test files
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test: detect a git checkout by existence, not by directory
In a worktree or submodule .git is a file, so the directory test skipped where
tracking could have been inspected.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test: harden CSRF source extraction
* test: fail clearly on unreadable CSRF files
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
* refactor(mail): replace phpmailer with symfony mailer
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* style(codex): fix coding standards in Symfony Mailer migration
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(codex): fix TLS downgrade bug and From address overwrite in Symfony Mailer
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(codex): guard SMTP stream setTimeout calls behind SocketStream check
setTimeout() exists on SocketStream only; getStream() is typed AbstractStream, which fails PHPStan level 6.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(codex): correct inline graph CID, mandatory STARTTLS, and address validation in Symfony Mailer
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(codex): test inline CID, STARTTLS enforcement, and address-error handling
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(mail): qualify bare local addresses so sendmail recipients still work
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(mail): prune the stale PHPMailer vendor tree on upgrade
Replacing PHPMailer with Symfony Mailer dropped phpmailer from composer.json,
but the change also removed the prune_deprecated_files entries that cleaned up
the vendored tree, so an upgraded install would keep stale PHPMailer code on
disk. Add include/vendor/phpmailer (whole directory) to the prune list.
Co-Authored-By: Oz <oz-agent@warp.dev>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(mail): address transport review feedback
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(mail): drop setAutoTls() call missing from symfony/mailer 6.4
EsmtpTransport::setAutoTls() only exists in symfony/mailer >= 7.1, and the
6.4 series (needed for PHP 8.1) has no switch to disable opportunistic
STARTTLS, so hide the advertised capability in a small subclass instead.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(mail): vendor the psr/log 1.1.4 sources
include/vendor/psr/log was tracked with only its package metadata, so
composer treats it as installed and never extracts the classes. That was
harmless while nothing loaded them, but Symfony Mailer's AbstractTransport
instantiates Psr\Log\NullLogger on every transport, which now fatals at
runtime and in the test job.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(mail): match PHPMailer SMTP and attachment semantics
Empty secure modes use no-STARTTLS transport; inline disposition
is honoured; unreadable attachments fail closed.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: Thomas Vincent <thomas@vincent.dev>
Co-authored-by: Oz <oz-agent@warp.dev>
* Return exit code and increase max_allowed_packet
* Adding max_allowed_packet to client section
* Command not recognized
* Trying to re-introduce command
* Moving the max-allowed-packet
* Moving the max-allowed-packet
* One more try to change max_allowed_packet size
* Set the global when creating the database
* Plumbing in PHP Pest without running
* Fixing composer.json, composer.loc, swapping net_dns2 as it's abandoned
* Removing composer lock file
* Removing dev components
* Allow form_selectable_cell to more easily port
* Removing exclusion for scripts directory
* More fixes for scripts
* Some issues with ss_host_disk.php that passed locally
* More issues not detected locally
* Issues with typing in cacti_snmp_walk
* Adding base files for non-savy composer users
* One more try on ss_host_disk.php
* Aparantly I have to add the lock file
* More changes to lib/snmp.php after testing
* More changes to lib/snmp.php after testing
* Fix number script from Copilot review
* More Composer reviews
* Update scripts/ss_apache_stats.php
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update scripts/motorola_surfboard_SB6141.py
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update scripts/motorola_surfboard_SB6141.py
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Changing syntax of PHP requirement
* Updating composer
* Attempt to quiet some warnings
* Add Syntax Check
* Wrong file name
* Wrong file name
* Better to report before and after
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Improve PHP 8.5 support
* The backtick operator is now deprecated in favor of shell_exec.
* Terminating case statements with a semicolon instead of a colon has
been deprecated.
* xml_parser_free was a noop since PHP 8.0 and is now deprecated.
* Fix case statement formatting in mib_parser.php
* Fix indentation for version check in xml.php
* Add whitespace handling for XML parsing
---------
Co-authored-by: TheWitness <thewitness@cacti.net>
* Fix#6539 - Allow Standard Cacti Log Files to be Rotated on Demand from the Cacti UI
* QA: php-cs-fixer updates and documentation for lib/database.php
* QA: Update .gitignore for composer files
* QA: Update .gitignore for composer files
* QA: Back off .gitignore change its duplicated
* QA: Fix typing of db_has_permissions
* QA: Fixing typing issue in db_format_index_create
* Update lib/clog_webapi.php
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* QA: Fix additional code issues
* QA: Applying more defaults to add device
* QA: Fix at the database layer
* QA: Fixes based upon automated testing
* QA: Fix at the database layer
* QA: After new SQL checking
* QA: Skip MacTrack oui database download warnings
* QA: Fixing type issue
* QA: Recommendation from Copilot
* QA: Recommendation from Copilot
* QA: Recommendation from Copilot
* QA: Recommendation from Copilot
* QA: Some minor changes to avoid errors in testing
* QA: Unused variable
* QA: Recommendation from Copilot
* QA: Recommendation from Copilot
* QA: Recommendation from Copilot
* QA: Minor introduced code defect
* QA: Adding some unifying space around concatination
* QA: Consistent comments and new function alias'
* QA: Multi-line comment corrections
* QA: Fix SQL Style
* QA: Missed one function alias
* QA: PHPStan Level 2 and PHPDoc fixes
* QA: PHPStan Level 2 and PHPDoc Fixes
* QA: PHPStan Level 6 Fixes
* QA: Fix lib/xml.php to PHPStan Level 6
* QA: Wrong grep -v
* PHPStan Level 6 for lib/vdef.php
* PHPStan Level 8 for lib/time.php
* QA: Raise PHPStan to Level 6 for lib/database.php
* QA: Remove @deprecated tag from grv()
* QA: Switch to htmle() alias over html_escape()
* QA: More addressing PHPStan issues at Level 6
* QA: Change recommended by Copilot for Readability
* QA: More PHPStan fixes
* QA: More PHPStan fixes
* QA: More PHPStan fixes for lib/utility.php
* QA: More PHPStan fixes at Level 6
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: More PHPStan fixes at Level 6
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: More PHPStan fixes at Level 6
* QA: More PHPStan fixes at Level 6
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: More PHPStan fixes at Level 6
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: More PHPStan fixes at Level 6
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: More PHPStan fixes at Level 6
* QA: More PHPStan fixes at Level 6
* QA: More PHPStan fixes at Level 6
* QA: Raise PHPStan to Level 6 More Functions
* QA: More PHPStan fixes at Level 6
* QA: Some phpseclib3 fixups to update to latest
* QA: More fixups for graphing for magic strings
* QA: More PHPStan fixes at Level 6
* QA: Fixing order string type on get_allowed_graphs()
* QA: Fixing improper use of print
* QA: Optimization of color_templates
* QA: Copilot recommendation
* QA: Copilot recommendation
* QA: Copilot recommendation
* QA: Copilot recommendation
* QA: Copilot recommendation
* QA: Copilot recommendation
* QA: Copilot recommendation
* QA: Copilot recommendation
* QA: Raise PHPStan to Level 6 More Functions
* QA: Issues insalling Cacti
* QA: Issues insalling Cacti
* QA: Issues insalling Cacti
* QA: Issues insalling Cacti
* QA: Issues insalling Cacti
* QA: Issues testing Cacti
* QA: Copilot recommendation
* QA: More PHPStan fixes at Level 6
* QA: More PHPStan fixes at Level 6
* QA: More PHPStan fixes at Level 6
* QA: More PHPStan fixes at Level 6
* QA: More PHPStan fixes at Level 6
* QA: Installer failing
* Undo ownership changes to remove tar errors
* QA: Updates after php-cs-fixer
* QA: Adding code checks to syntax checking
* QA Change syntax flow language
* QA: Reduce the number of cures
* QA: Use sequentional option
* Change runner to self-hosted for check job
* Fix typo in OS version in workflow file
* Add Git installation step in workflow
Added step to install Git if not already installed.
* Add '-y' flag to apt-get install and update commands
Updated apt-get commands to include '-y' for automatic confirmation.
* Change workflow OS version to 'ubuntu-latest'
Updated the workflow to use 'ubuntu-latest' instead of 'ubuntu:latest' and modified the 'runs-on' configuration.
* Remove sequential option from phpcsfixer script
* Remove PHPCS fixer step from workflow
Removed PHP coding standards check from workflow.
* Move code checks to before plugins
Moving these core checks to before the plugins are installed as we really want to check only the base Cacti here.
* Add Composer validation and caching to start of workflow
* QA: Addressing PHPStan additional
* QA: Restore composer lock file
* QA: Addressing PHPStan additional
* QA: Addressing PHPStan additional
* QA: Complete LDAP Project
* QA: php-cs-fixer doing it's thing
* QA: Syntax is already happening in PHPStan
* QA: The md5 function no longer exists
* QA: Update after ldap changes
* QA: Undo that last password hack
* QA: Attempting to switch to MariaDB 11.8
* QA: Attempting to switch to MariaDB 11.8
* QA: Resolving some issues with PHP8.4
* QA: Resolving some issues with PHP8.4
* QA: Add PHP8.5 to the matrix
* QA: Removing PHP8.5 due to dependency issues
* QA: Add the DB version to the testing output
* QA: Switch back to MySQL for the moment
* QA: More fidelity in reporting
* QA: The pipe must be mixed
* QA: Moving audit_schema.php changes from 1.2.x
* QA: Moving audit_schema.php changes from 1.2.x
* QA: Restore mysql monitoring
* QA: php-cs-fixer issues
* QA: Attempt to roll back to MariaDB 10.6
* QA: Attempt to fix check_all_pages.sh
* QA: Make installer functional again
* QA: Fix installer php-cs-fixer issues
* QA: Type to a string
* QA: Get the database version correctly
* QA: Fix issue with reports in check_all_pages.sh
* QA: Check the server version in the right place
* Feature: Support SHA256 as a new hash for passwords
* QA: Function definition and return typing audit
* QA: Refinement of form types
* QA: Refinement of form types
* QA: Consistency of comments
* QA: Issues with php-cs-fixer and more comments
* QA: More typing issues
* QA: php-cs-fixer on merge conflict resolution
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Add Rector
* Add Rector
* Fix "Cashed" misspelling
Also harmonize the phrase with the one below it
* Fix implode error in db_table_create
Only relevant when multiple primary keys
* Fix auth issue, parentheses in the wrong location
Was causing too many arguments to be sent to cacti_sizeof which only take 1, instead of get_allowed_devices.
* Fix issue with session_var not properly using class variable
* Fix pass by reference error in get_allowed_devices
get_allowed_devices has a pass by reference on the "total_rows" field. It is used in several places to pass the total_rows back to a counter. Here though, we are passing a number directly to the function, which errors out with "Uncaught Error: get_allowed_devices(): Argument #4 ($total_rows) cannot be passed by reference". So we will just place a dummy variable in front to catch the pass.
This wasn't caught before because the previous parentheses issue.
* Fix undefined variable "field_array" in html_filter
* Fix undefined function 'get_nfilter_filter_request_var'
* Fix undefined variable 'resizable'
I corrected the function parameter, as that was technically the incorrect spelling
* Fix invalid variable $user_id
* Fix undefined vars in spikekill class
* Fix copy and paste error
Oops
* Forgot to use the dummy variables
* Add missing $
Oops
* Start converting to newer PHP Syntax and Functions
* Test fixing the workflow by install composer
* Lets not valid the composer file right now
Seems we have a few things to fix it in
* Validate composer
* Lite formating changes
* lite formatting
* lite formatting
* lite format changes
* lite format changes
* lite format changes
* lite format changes
* lite format changes
* lite format changes
* lite format changes
* lite format changes
---------
Co-authored-by: TheWitness <thewitness@cacti.net>
TheWitness