* security: consolidate verified GHSA fixes for develop (batch 3)
Develop counterparts of the 1.2.x fixes in #8138, each re-verified against
develop HEAD.
- GHSA-77pr-g949-4v5f: spikekill.php also requires is_graph_allowed() on the
target graph, not just the Spike Kill realm.
- GHSA-w3qw-762w-6g9v: the include/global.php GET action guard fails closed on
an array-form action[] before the scalar denylist comparison.
- GHSA-xhpr-w454-cc9w: update_poller_cache() casts the stored output_type to
int before interpolation.
- GHSA-j3px-vw6r-g25x: graphs_new.php escapes stored snmp_index via db_qstr()
in the data-query IN() pivot.
- GHSA-h745-3r76-g253: graphs_new.php escapes the data-query and field names in
the XML parse error messages (__ -> __esc).
GHSA-297h-95ff-r767 does not apply on develop: the clog log-file selector
renders through the drop_array filter framework, which escapes.
tests/Unit/Security/ConsolidatedBatch3Test.php adds source-scanning regression
guards. CHANGELOG (1.3.0-dev) updated; php -l, the security baselines, and
check-changelog.py all pass.
* chore: lead 1.3.0-dev security CHANGELOG entries with the GHSA id
Normalize the 1.3.0-dev -security entries to the approved
"-security: GHSA-xxxx [CVE-xxxx] Description" form, moving the advisory id to
the front. CVE tokens are omitted because none of these advisories have a CVE
issued yet (verified via the repository security-advisories API). Covers the
five batch-3 entries plus the pre-existing entries that still used the trailing
(GHSA-xxxx) form.
* chore: use the -security#GHSA-xxxx: form for the 1.3.0-dev CHANGELOG entries
Correct the batch-3 and reconciled 1.3.0-dev -security entries to the approved
"-security#GHSA-xxxx: CVE-yyyy Description" form (GHSA id in the prefix). No CVE
tokens are added because none of these advisories have a CVE issued yet
(verified via the repository security-advisories API).
* test: split batch-3 security guards into vulnerability-class files; reconcile CHANGELOG
- Move the ConsolidatedBatch3Test.php guards into the matching Auth, Csrf,
SqlInjection and Xss folders with behavior-based filenames, and strengthen
them per review: the GET-guard test asserts the array branch actually returns
405 and exits; the snmp_index test rejects both raw concatenation branches;
the parse-error test asserts every name-bearing message uses __esc().
- Append this pull request number to the five new 1.3.0-dev security entries.
- Add issued CVE identifiers to the older -security#GHSA CHANGELOG entries
(verified via the repository security-advisories API). Entries with no CVE
yet, entries that already carried a CVE, and non-GHSA lines are unchanged.
TheWitness