55 Commits
Author SHA1 Message Date
Thomas VincentandTheWitness 29a1ab2996 feat(logging): emit structured security events for validation failures (#7605)
* Log structured input validation events

* Harden validation failure diagnostics

* docs(tests): complete validation test license

---------

Co-authored-by: TheWitness <thewitness@cacti.net>
2026-08-10 13:08:28 -04:00
TheWitness 27919c50d7 Updating Copyrights to 2026 (#6578) 2026-01-28 16:11:10 -05:00
TheWitnessandCopilot b993471579 Fix #6539 - Allow Standard Cacti Log Files to be Rotated on Demand,PHPdoc, and Typing (#6540)
* Fix #6539 - Allow Standard Cacti Log Files to be Rotated on Demand from the Cacti UI

* QA: php-cs-fixer updates and documentation for lib/database.php

* QA: Update .gitignore for composer files

* QA: Update .gitignore for composer files

* QA: Back off .gitignore change its duplicated

* QA: Fix typing of db_has_permissions

* QA: Fixing typing issue in db_format_index_create

* Update lib/clog_webapi.php

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* QA: Fix additional code issues

* QA: Applying more defaults to add device

* QA: Fix at the database layer

* QA: Fixes based upon automated testing

* QA: Fix at the database layer

* QA: After new SQL checking

* QA: Skip MacTrack oui database download warnings

* QA: Fixing type issue

* QA: Recommendation from Copilot

* QA: Recommendation from Copilot

* QA: Recommendation from Copilot

* QA: Recommendation from Copilot

* QA: Some minor changes to avoid errors in testing

* QA: Unused variable

* QA: Recommendation from Copilot

* QA: Recommendation from Copilot

* QA: Recommendation from Copilot

* QA: Minor introduced code defect

* QA: Adding some unifying space around concatination

* QA: Consistent comments and new function alias'

* QA: Multi-line comment corrections

* QA: Fix SQL Style

* QA: Missed one function alias

* QA: PHPStan Level 2 and PHPDoc fixes

* QA: PHPStan Level 2 and PHPDoc Fixes

* QA: PHPStan Level 6 Fixes

* QA: Fix lib/xml.php to PHPStan Level 6

* QA: Wrong grep -v

* PHPStan Level 6 for lib/vdef.php

* PHPStan Level 8 for lib/time.php

* QA: Raise PHPStan to Level 6 for lib/database.php

* QA: Remove @deprecated tag from grv()

* QA: Switch to htmle() alias over html_escape()

* QA: More addressing PHPStan issues at Level 6

* QA: Change recommended by Copilot for Readability

* QA: More PHPStan fixes

* QA: More PHPStan fixes

* QA: More PHPStan fixes for lib/utility.php

* QA: More PHPStan fixes at Level 6

* QA: Raise PHPStan to Level 6 More Functions

* QA: Raise PHPStan to Level 6 More Functions

* QA: Raise PHPStan to Level 6 More Functions

* QA: Raise PHPStan to Level 6 More Functions

* QA: Raise PHPStan to Level 6 More Functions

* QA: More PHPStan fixes at Level 6

* QA: Raise PHPStan to Level 6 More Functions

* QA: Raise PHPStan to Level 6 More Functions

* QA: More PHPStan fixes at Level 6

* QA: More PHPStan fixes at Level 6

* QA: Raise PHPStan to Level 6 More Functions

* QA: Raise PHPStan to Level 6 More Functions

* QA: More PHPStan fixes at Level 6

* QA: Raise PHPStan to Level 6 More Functions

* QA: Raise PHPStan to Level 6 More Functions

* QA: More PHPStan fixes at Level 6

* QA: Raise PHPStan to Level 6 More Functions

* QA: Raise PHPStan to Level 6 More Functions

* QA: More PHPStan fixes at Level 6

* QA: More PHPStan fixes at Level 6

* QA: More PHPStan fixes at Level 6

* QA: Raise PHPStan to Level 6 More Functions

* QA: More PHPStan fixes at Level 6

* QA: Some phpseclib3 fixups to update to latest

* QA: More fixups for graphing for magic strings

* QA: More PHPStan fixes at Level 6

* QA: Fixing order string type on get_allowed_graphs()

* QA: Fixing improper use of print

* QA: Optimization of color_templates

* QA: Copilot recommendation

* QA: Copilot recommendation

* QA: Copilot recommendation

* QA: Copilot recommendation

* QA: Copilot recommendation

* QA: Copilot recommendation

* QA: Copilot recommendation

* QA: Copilot recommendation

* QA: Raise PHPStan to Level 6 More Functions

* QA: Issues insalling Cacti

* QA: Issues insalling Cacti

* QA: Issues insalling Cacti

* QA: Issues insalling Cacti

* QA: Issues insalling Cacti

* QA: Issues testing Cacti

* QA: Copilot recommendation

* QA: More PHPStan fixes at Level 6

* QA: More PHPStan fixes at Level 6

* QA: More PHPStan fixes at Level 6

* QA: More PHPStan fixes at Level 6

* QA: More PHPStan fixes at Level 6

* QA: Installer failing

* Undo ownership changes to remove tar errors

* QA: Updates after php-cs-fixer

* QA: Adding code checks to syntax checking

* QA Change syntax flow language

* QA: Reduce the number of cures

* QA: Use sequentional option

* Change runner to self-hosted for check job

* Fix typo in OS version in workflow file

* Add Git installation step in workflow

Added step to install Git if not already installed.

* Add '-y' flag to apt-get install and update commands

Updated apt-get commands to include '-y' for automatic confirmation.

* Change workflow OS version to 'ubuntu-latest'

Updated the workflow to use 'ubuntu-latest' instead of 'ubuntu:latest' and modified the 'runs-on' configuration.

* Remove sequential option from phpcsfixer script

* Remove PHPCS fixer step from workflow

Removed PHP coding standards check from workflow.

* Move code checks to before plugins

Moving these core checks to before the plugins are installed as we really want to check only the base Cacti here.

* Add Composer validation and caching to start of workflow

* QA: Addressing PHPStan additional

* QA: Restore composer lock file

* QA: Addressing PHPStan additional

* QA: Addressing PHPStan additional

* QA: Complete LDAP Project

* QA: php-cs-fixer doing it's thing

* QA: Syntax is already happening in PHPStan

* QA: The md5 function no longer exists

* QA: Update after ldap changes

* QA: Undo that last password hack

* QA: Attempting to switch to MariaDB 11.8

* QA: Attempting to switch to MariaDB 11.8

* QA: Resolving some issues with PHP8.4

* QA: Resolving some issues with PHP8.4

* QA: Add PHP8.5 to the matrix

* QA: Removing PHP8.5 due to dependency issues

* QA: Add the DB version to the testing output

* QA: Switch back to MySQL for the moment

* QA: More fidelity in reporting

* QA: The pipe must be mixed

* QA: Moving audit_schema.php changes from 1.2.x

* QA: Moving audit_schema.php changes from 1.2.x

* QA: Restore mysql monitoring

* QA: php-cs-fixer issues

* QA: Attempt to roll back to MariaDB 10.6

* QA: Attempt to fix check_all_pages.sh

* QA: Make installer functional again

* QA: Fix installer php-cs-fixer issues

* QA: Type to a string

* QA: Get the database version correctly

* QA: Fix issue with reports in check_all_pages.sh

* QA: Check the server version in the right place

* Feature: Support SHA256 as a new hash for passwords

* QA: Function definition and return typing audit

* QA: Refinement of form types

* QA: Refinement of form types

* QA: Consistency of comments

* QA: Issues with php-cs-fixer and more comments

* QA: More typing issues

* QA: php-cs-fixer on merge conflict resolution

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-01-25 10:13:56 -05:00
TheWitness b9334a15d9 QA: Updates for files for php-cs-fixer and some php-doc changes 2025-11-18 21:01:15 -05:00
TheWitness beb0fe913c Fix: #6217 - Improve Validation Error Logging 2025-06-26 22:22:58 -04:00
TheWitness 2c779273f9 Copyright Updates and PHP-CS-Fixer updates 2025-03-09 14:34:19 -04:00
TheWitness 0058fef482 QA: Merging Security Updates from 1.2.x into develop 2025-01-26 13:43:37 -05:00
Jimmy Conner ad07471bb1 Lots of PHPDoc formatting and cleanup
Lots more to go
2024-12-09 02:50:06 -06:00
TheWitness 866b4323a4 Fixing XSS Issue with Form Validation
As reported in  GHSA-5p79-q5q3-84vw
2024-04-07 10:33:43 -04:00
TheWitness a1884d5564 QA: Fixing input validation error 2024-02-18 11:03:24 -05:00
TheWitness 1aa72d24c9 QA: Update Copyright to 2024 2024-02-03 14:18:57 -05:00
Mark Brugnoli-Vinten 7776b5af8f QA: Fix up error during validation death 2023-05-03 13:40:43 +01:00
Mark Brugnoli-Vinten 32ba2f19f4 Update copyright year for 2023 2023-01-03 20:34:26 +00:00
Mark Brugnoli-Vinten 8b29d12cc9 Define cacti system paths as constants for better code checking (#5120)
This also provides a full run of src-fixer against all files to
ensure all code is now in alignment.

Closes #5120
2023-01-01 01:03:15 +00:00
Mark Brugnoli-Vinten c8157e3cbb Switch to constants for common session/cookie options 2022-12-21 10:53:53 +00:00
netniV 371f8b5253 Fix issues with backtracing and input validation (#3559, #3560)
- When a developer uses backtracing, HTML output can be seen from command line bug confirmed
- When using `input_validate_xxx`, calls to `die_html_input_error()` do not pass variable name bug confirmed

Closes #3559
Closes #3560
2022-11-26 18:28:29 +00:00
TheWitness 82b229db9e Updating Copyright to 2022. 2022-02-06 17:16:20 -05:00
TheWitness df54a4a3f3 Updating copright years 2021-01-01 20:28:58 -05:00
netniV 4fa9a68fb3 Update copyright to 2020 2020-01-12 12:19:49 +00:00
netniV 308292e2d7 Update copyright notices for 2019 2019-01-25 08:05:00 +00:00
cigamit 0730ce3873 Add additional escaping #1457
These discoveries were made during testing.
2018-03-18 09:02:03 -05:00
cigamit d18bd488ed Minor update for html_validate.php for json logging. 2018-02-04 10:30:34 -06:00
cigamit f5cdde2550 Add i18n to validation statusText for #1286 2018-02-04 09:29:01 -06:00
cigamit 99d670bed2 Proposed fix for issue #1286
Will allow the validation function to return a json array if validation
fails if json is requested.
2018-02-04 09:25:38 -06:00
Tony Roman 519b35f5cd Update copyright to 2018 2018-01-06 09:10:15 -05:00
Wolfgang Stöggl 4a1a15d72c Correct spelling of RRDtool (#1038)
- Change RRDTool -> RRDtool with a lowercase t.
- Replace in all files except *.mo, *.po, *.pot
2017-10-16 11:32:05 -04:00
cigamit 3381cba6a9 Resolving Issue #838
Cross-site Scripting (XSS) issue with link.php
2017-07-05 06:45:03 -05:00
Tony Roman 35a5988f41 Update source code files copyright to new year 2017-01-01 13:45:29 -05:00
cigamit 74b7462a65 repair some validation logic 2016-08-25 14:09:48 -05:00
cigamit af96c70018 add new validate option FILTER_VALIDATE_IS_REGEX
with this validation function, you can validate that a request variable
is a valid regular expression.  this essentially will allow Cacti
developers to include regex's for search terms safely.
2016-08-21 11:13:10 -05:00
cigamit f1e4bc55b5 add additional debug output for troubleshooting 2016-02-15 12:32:42 -06:00
cigamit 11e7294de8 better validation log messages
If there is an unchecked request variable, let the developer know what
variable and what it was set to.
2016-02-13 09:15:26 -06:00
Micke2k d188f1631d Change Copyright year 2015 -> 2016 2016-01-29 21:46:02 +04:00
cigamit f016228fb5 adding more validation functions for exploit mitigation correcting 0.8.8 bugs
developer mode will inform the end user of any variables used without a
validation check first when using the new functions.
Bug:2591,
Bug:2618,
2016-01-17 15:52:06 -06:00
cigamit 0ed731cd8a Improve debug_backtrack() logic and consolidate use
Remove debug_backtrace() from a few areas and consolidate into a single
call.  Improve backtrace logging to include HTML output as an option.
2015-08-02 14:15:52 -05:00
cigamit 4b11861226 Beef up validation logging
Make html validation logging similar to SQL logging.
2015-08-02 14:02:32 -05:00
cigamit e4e71337c0 Add check for nulls
Add check for null values.
2015-07-26 07:55:30 -05:00
cigamit f49357c71b HTML5 Support
changes to support html5
2015-05-15 22:29:42 -05:00
cigamit 5081063fbb Various Fixes
- Miscellaneous cleanup
- SQL Syntax error in rrdcleaner
- Filter Changes to match standard
2015-03-30 08:24:44 -05:00
Jimmy Conner 5bde3da972 1) Update Copyright Years Correct a few minor CY Issues
2) Allow Locking/UnLocking of Graphs
3) ToolTips
4) Correct Minor Issues with Login/Out/Permission associated with Theme JS
5) Upgrade jQuery which has Fixes for Major issue in Safari 7/8.1

git-svn-id: svn+ssh://repo.cacti.net/var/data/svnroot/cacti/cacti/branches/0.8.8@7662 860744bd-22fc-0310-8c96-e9fe5004b5ca
2015-01-04 01:52:50 +00:00
Jimmy Conner 9baca61343 A little bit of cleanup
Change double quotes to single quotes where possible
Move to prepared statements were possible

git-svn-id: svn+ssh://repo.cacti.net/var/data/svnroot/cacti/cacti/branches/0.8.8@7604 860744bd-22fc-0310-8c96-e9fe5004b5ca
2014-12-24 08:44:40 +00:00
Jimmy Conner ac6d6929cc Remove some unnecessary ending PHP closing tags
git-svn-id: svn+ssh://repo.cacti.net/var/data/svnroot/cacti/cacti/branches/0.8.8@7571 860744bd-22fc-0310-8c96-e9fe5004b5ca
2014-12-17 03:02:03 +00:00
Tony Roman 65be30ffe0 Update copyright to 2014
git-svn-id: svn+ssh://repo.cacti.net/var/data/svnroot/cacti/cacti/branches/0.8.8@7437 860744bd-22fc-0310-8c96-e9fe5004b5ca
2014-03-30 19:54:50 +00:00
Tony Roman ce40281901 Update copyright to 2013 for 0.8.8
git-svn-id: svn+ssh://repo.cacti.net/var/data/svnroot/cacti/cacti/branches/0.8.8@7386 860744bd-22fc-0310-8c96-e9fe5004b5ca
2013-07-21 23:00:42 +00:00
Tony Roman a257958a0b Update copyright to 2012
git-svn-id: svn+ssh://repo.cacti.net/var/data/svnroot/cacti/cacti/branches/0.8.7@7016 860744bd-22fc-0310-8c96-e9fe5004b5ca
2012-02-27 07:04:37 +00:00
Tony Roman 9acba795fe Update copyright to 2011
git-svn-id: svn+ssh://repo.cacti.net/var/data/svnroot/cacti/cacti/branches/0.8.7@6233 860744bd-22fc-0310-8c96-e9fe5004b5ca
2011-01-27 03:44:05 +00:00
Reinhard Scheck 9d2a164909 -bug#0001568: Cacti currently gives a lot of warnings of deprecated functions on PHP 5.3
git-svn-id: svn+ssh://repo.cacti.net/var/data/svnroot/cacti/cacti/branches/0.8.7@6200 860744bd-22fc-0310-8c96-e9fe5004b5ca
2011-01-06 21:03:25 +00:00
Larry Adams c5403f3844 QA: Update copyrights
git-svn-id: svn+ssh://repo.cacti.net/var/data/svnroot/cacti/cacti/branches/0.8.7@5806 860744bd-22fc-0310-8c96-e9fe5004b5ca
2010-04-28 03:48:09 +00:00
Tony Roman 26d1957d62 Update copyright to 2009
git-svn-id: svn+ssh://repo.cacti.net/var/data/svnroot/cacti/cacti/branches/0.8.7@4931 860744bd-22fc-0310-8c96-e9fe5004b5ca
2009-02-11 22:53:50 +00:00
Larry Adams 22f9e12ddb Update Copyright Notice for 2008.
git-svn-id: svn+ssh://repo.cacti.net/var/data/svnroot/cacti/cacti/branches/0.8.7@4434 860744bd-22fc-0310-8c96-e9fe5004b5ca
2008-01-29 00:40:43 +00:00