* fix(core): correct client state and declare public method contracts
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(security): isolate Midwinter external homepage popup
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(client): isolate menu state and simplify validated JavaScript guards
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(auth): use certificate expiry truth in rendering assertions
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* refactor(js): remove unused local storage while retaining initializer calls
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(js): encode inline translated values through the shared JSON boundary
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* style(js): wrap encoded translation literals without changing messages
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(client): remove unused checkbox reads from graph resizing
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* refactor(client): declare repeated function locals once
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(ui): run column width regression in browser CI
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(installer): recover from expired CSRF tokens
Return a replacement token for expired installer AJAX requests, retry the failed action once, and roll tokens forward after successful responses.
Fixes#7343
Signed-off-by: Abdul Mohammad <abdul.mohammad9087@gmail.com>
* test(installer): exercise CSRF recovery round trip
Signed-off-by: Abdul Mohammad <abdul.mohammad9087@gmail.com>
---------
Signed-off-by: Abdul Mohammad <abdul.mohammad9087@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
* fix: correct grammar and possessive errors in English source strings (batch 2) (#1)
* fix: correct grammar and possessive errors in English source strings (batch 2)
Seven errors found via cacti.pot audit:
- automation_networks.php: "senders name" → "sender\'s name" (line 839)
- automation_networks.php: "senders Email" → "sender\'s Email" (line 848)
- automation_templates.php: "devices sysDescr" → "device\'s sysDescr" (line 1060)
- automation_templates.php: "devices sysName" → "device\'s sysName" (line 1067)
- automation_templates.php: "devices sysOid" → "device\'s sysOid" (line 1074)
- data_templates.php: garbled "it either it value...critical data Data Query" →
"its value...Data Query" (line 903)
- package_repos.php: "Package Repositorites" → "Package Repositories" (line 436)
All changes are to UI description strings inside __() / __esc() calls.
cacti.pot should be regenerated via build_gettext.sh after merge.
* fix: correct grammar and possessive errors in English source strings (batch 2)
Seven errors found via cacti.pot audit:
- automation_networks.php: "senders name" → "sender\'s name" (line 839)
- automation_networks.php: "senders Email" → "sender\'s Email" (line 848)
- automation_templates.php: "devices sysDescr" → "device\'s sysDescr" (line 1060)
- automation_templates.php: "devices sysName" → "device\'s sysName" (line 1067)
- automation_templates.php: "devices sysOid" → "device\'s sysOid" (line 1074)
- data_templates.php: garbled string → "its value...Data Query" (line 903)
- package_repos.php: "Package Repositorites" → "Package Repositories" (line 436)
All changes are to UI description strings inside __() / __esc() calls.
cacti.pot should be regenerated via build_gettext.sh after merge.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: add dependabot config with npm and github-actions
* ci: add CodeQL (JS/TS, excludes PHP) with workflow_dispatch
* ci: update CodeQL for javascript-typescript, python
* fix(ci): use specific runner labels, fix codeql concurrency
* Improve IPv6 support in RRDtool proxy and ping utilities (#2)
* Improve IPv6 support in RRDtool proxy and ping utilities
- Fix RRDtool proxy to dynamically detect IPv6 addresses and use
AF_INET6 sockets instead of hardcoded AF_INET (IPv4-only), enabling
connections to IPv6 RRDtool proxy servers including backup servers
- Strip brackets from IPv6 addresses before passing to socket_connect
- Properly close failed sockets before creating new ones for failover
- Replace fragile str_contains(':') IPv6 detection in ping with
filter_var(FILTER_FLAG_IPV6) for more robust address validation
https://claude.ai/code/session_01SbuDigvAkYvPKvdcougsdo
* Fix JS code quality: implicit globals, deprecated APIs, loose equality
- Add var declarations to prevent implicit globals in install.js
(element, enabled, button, buttonCheck)
- Remove console.log debug output left in production (install.js)
- Replace deprecated jQuery .unbind() with .off() (layout.js)
- Fix "depreciated" typo to "deprecated" in deprecation warnings
- Convert == / != to === / !== for null, boolean, string, typeof,
and numeric comparisons across install.js and realtime.js
https://claude.ai/code/session_01SbuDigvAkYvPKvdcougsdo
* Replace deprecated jQuery shorthand event methods in layout.js
Replace .click(), .keyup(), .keydown(), .mousedown(), .mouseenter(),
.mouseleave(), .submit(), .resize() with .on() equivalents. Replace
.focus(), .change() trigger calls with .trigger(). These shorthands
were deprecated in jQuery 3.5.
https://claude.ai/code/session_01SbuDigvAkYvPKvdcougsdo
* Replace deprecated jQuery methods in realtime.js
Replace .bind() with .on() and .change() trigger calls with
.trigger('change'). .bind() was deprecated in jQuery 3.0 and
shorthand triggers in jQuery 3.5.
https://claude.ai/code/session_01SbuDigvAkYvPKvdcougsdo
* Replace deprecated jQuery methods in install.js and fix ===/!== errors
Replace .click(), .change(), .focus() with .on()/.trigger() equivalents.
Also fix !=== and ==== operators that were incorrectly introduced by a
prior replace-all of == to === within existing !== and === expressions.
https://claude.ai/code/session_01SbuDigvAkYvPKvdcougsdo
* Restore == null where needed to catch both null and undefined
In JavaScript, == null matches both null and undefined, which is an
intentional idiom. The prior === null conversion broke cases where
values come from jQuery .val(), .data(), $.urlParam(), or object
property access that may return undefined rather than null. Revert
those specific cases while keeping === null where variables are
explicitly initialized to null.
https://claude.ai/code/session_01SbuDigvAkYvPKvdcougsdo
* Replace deprecated jQuery methods in all theme main.js files
Replace .unbind().click() with .off('click').on('click'), convert
.hover() to .on('mouseenter').on('mouseleave'), replace .change(),
.scroll(), .click() shorthands with .on() equivalents, and .blur()
with .trigger('blur') across all 10 theme files.
https://claude.ai/code/session_01SbuDigvAkYvPKvdcougsdo
* Convert string concatenation to template literals
Replace 'str' + var + 'str' patterns with ES6 template literals
in realtime.js and install.js. Improves readability especially for
URL construction and HTML building. Also replace $.parseJSON() with
native JSON.parse() in realtime.js.
https://claude.ai/code/session_01SbuDigvAkYvPKvdcougsdo
* Convert var to const for single-assignment variables
Replace var with const where the variable is assigned once and never
reassigned within its scope, in install.js and realtime.js. Keeps var
for variables that are conditionally reassigned (e.g. size, url).
https://claude.ai/code/session_01SbuDigvAkYvPKvdcougsdo
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(sqli): sanitize sort_column and enforce sort_direction in ORDER BY clauses
Closes GHSA-q9xg-p762-9jm3 and GHSA-72vr-jr4v-55vf.
- Add sanitize_sql_column() to lib/functions.php stripping all chars
outside [a-zA-Z0-9_().] from user-supplied column names
- Apply sanitize_sql_column() at every ORDER BY concatenation in
api_automation.php and html_reports.php
- Enforce direction to literal ASC/DESC in html_reports.php,
api_automation.php, and html_utility.php (update_order_string,
get_order_string)
- Add tests/Unit/SafeSortTest.php with 22 stub-based regression tests
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(docs): move sanitize_sql_column above sanitize_search_string docblock
The sanitize_search_string docblock was orphaned after sanitize_sql_column
was inserted between it and the function body. Reorder so each function
follows its own docblock directly.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(sqli): escape apostrophes in automation_templates and harden sort_direction in display_matching_hosts
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(sqli): restore allowlist guard, sanitize session keys, add sanitize_sql_column default
Restore the preg_match allowlist guard in get_order_string() that was
removed by the PR, re-opening the ORDER BY injection surface. When the
request var is empty after sanitization, return '' rather than building
a malformed ORDER BY clause.
Sanitize sort_column before storing as SESSION array key in
update_order_string() and add read-time guard in the inplace loop that
rebuilds ORDER BY from stored keys.
Add $default parameter to sanitize_sql_column() so callers get a safe
fallback instead of an empty string that produces 'ORDER BY ASC'.
Fix inconsistent INET_ATON substitution in display_matching_hosts().
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Improve sanitize_sql_column function
Fix regex to sanitize SQL column names properly.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* This change will allow both cli and web installs to function again
* Also introduces a new prompt to inform the user about whitelist protection, but does not enable it.
* Add SNMP options during installer profile defaults, use draw_form()
* Installer now has field arrays to determine fields to parse
* Install SNMP option set item and make device defaults too
* Fixes for Issues 1781, 1782 and 1784
This patch corrects the following issues:
- #1782 During Install, changing the Theme from Modern to another theme has no
effect
- #1784 During Install, changing the Language from one to another has no
effect
- #1781 Installer does not warn when mysql optimizations not set
As part of #1781's fixes, a new warning icon is displayed instead of a thumbs
up or down. Additionally, recommendations have been revamped so that the ones
which are optionally (and some even state can be ignored) are now optional!
Also, introduced the correct calculation for innodb instances by taking the
buffer size during a previous recommendation and calculating from that. If
the buffer size is never found or the calcuation finds less than 1 instances
are recommended, a minimum of 1 is set.
The main reason for #1782 and #1784's issues were caused by renaming index.php
to install.php as part of the recent security update (see PR #1747). Updated
the javascript to use the correct install.php and then removed some extra data
that was being returned outside of StepData unnecessarily.
* Further fixes
This update corrects a number of issues with the database upgrading code, adds
the 'debug' plugin from cigamit, improves database functions to be more
consistent with errors across all functions and various installer based fixes
for the display and update of database upgrades.
It also brings a more visual response to the cli/upgrade_database.php so that
end users are not left wondering if something is happening. Also, reviewed
all upgrade scripts to ensure that an upgrade from 0.8.8 through to 1.2.0 is
possible even if a previous database upgrade have been done.
* Fix QA issue with 'path_cactilog'
Due to some code reshuffle and testing, found that the above setting was being
read via read_config_option() before there was a database open so no path was
ever detected unless the force option was used.
* Feature #1588: Check that PHP can run a test file
* Feature #1628 - Allow the User to define a initial Network Discovery during Setup
* Fix QA issue with PHP 5.4
* Replace \n with PHP_EOL
* Minor changes to tabs vs. space and PHP_EOL
Will have to update packages based upon this too.
* Another minor pull where PHP_EOL was removed
* Fixes for issues #1589 and 1690
This commit applies fixes for #1589 (Checking temporary folder is writable) and #1690 (Report a warning if collation is not utf8mb4_unicode_ci)
* Remove debug code
1) Correct some US vs. UK English defaults
2) Make theme selection active on all installer pages
3) Some jQueryUI fixes
4) Change Copyright to use constant
5) Javascript cleanup
6) Remote poller button visibility
7) Header Show/Hide Simplication
8) Double to single quotes
* Beginning of Install via AJAX calls
* Added steps 3 & 4 to the installer system
* Add background update procedure. Still needs more upgrade code adding, like upgrading the DB
* Minor fixup during QA
* Remove debug code from lib/functions.php
* More QA fixes, add slight delay to index.php initialisation to see javascript warning (should be removed)
* beta3 - added data source profiles
* beta4 - fix some issues found in QA
* beta5 - upgrade databsae routines added, error results screen styled
* Add some colour to the thumb icons
* QA fix to remove unneeded option
* Fix for PHP 5.4 travis failure
Thomas Vincent