1 Commits
Author SHA1 Message Date
Thomas Vincent 668333b7c9 security(import): validate Data Source item fields coming from Template XML (#7720)
* security(import): validate Data Source item fields coming from Template XML

data_source_name, rrd_minimum and rrd_maximum reach an RRDtool command line
but never pass through the data_sources.php form on the import path, so the
same field rules are applied at the XML handoff instead.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* chore: add the CHANGELOG entry

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(import): name the rejection and keep the value out of the log lines

Code 7 reads as an XML parse error, which this is not, and the value comes
from the file being imported.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* style: use a line comment to satisfy php-cs-fixer

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: resolve includes through Cacti path constants

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: restore changelog entry ordering

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(changelog): order the 7720 issue entry before features and drop a duplicate

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
2026-08-31 17:08:26 -04:00