2 Commits

Include renames

Author	SHA1	Message	Date
3 people	5403cf75bb	feature: user-defined filter layouts with administrator publishing (#8185) ... * feature: user-defined filter layouts with administrator publishing Add a render_layouts toggle to the CactiTableFilter class so list pages offer Save / New / Rename / Delete controls for saved filter layouts, modelled on the monitor plugin. Layouts persist to a new user_layouts table (id, user_id, page, name, url). The toggle defaults on for every page except the Console > Presets pages (CDEFs, VDEFs, Colors, GPRINTs, Data Profiles, SNMP), where it is off. Each user manages their own layouts from any filter. Administrators who hold the Settings/Utilities realm can publish a layout to all users (moving it to user_id = 0) from the filter, and from a new Console > Presets > Filters management page (layouts.php) where they can view and manage every user's layouts. Published layouts appear for all users on that page. Layout create/rename/delete/publish requests are handled centrally by filter_layouts_handle_request(), invoked from include/auth.php after the user has been authorized for the current page, so the controls work on any filter page while publishing stays gated on the realm. layouts.php itself is mapped to the Settings/Utilities realm so the Presets > Filters menu pick is administrator-only. Schema added to cacti.sql, install/upgrades/1_3_0.php, and docs/audit_schema.sql. Adds tests/Unit/FilterLayoutsTest.php covering the URL-safety validation, preset-page defaults, and the request/permission wiring. * changelog: 8185.feature fragment for filter layouts * chore: enforce LF line endings via .gitattributes and normalize new files * fix: address review - attribute-escape layout options, honor failed/non-editable layout ops, regenerate cacti.pot, move test to Unit/Ui/Html * chore: renormalize pre-existing CRLF files to LF per .gitattributes * chore: keep vendored JS (big.js, tablesorter) byte-identical to upstream and exclude from LF normalization * style: apply php-cs-fixer formatting and resolve PHPStan level 8 findings in filter layouts * ci: re-trigger checks on current head * refactor: store filter layouts as a versioned JSON document in a TEXT data column Replace the user_layouts.url varchar(1024) column with a data TEXT column holding a versioned {version,page,filter} document. The navigable url is rebuilt server-side from the document (page basename + rebuilt query) plus the filter_layout marker, removing the stored-url redirect/XSS surface and making the backend forward-compatible with a structured query builder without a further schema change. * feature: add Modern/Legacy page filter format with an Edit dialog for filters Modern (default) collapses the filter to a Layouts selector plus an Edit dialog holding the Filter Name and all filter fields; Save and Publish live in the dialog, with Edit/Rename/Delete/Save As on the bar and time controls/refresh kept on the bar. Legacy keeps the classic inline filter. The format is a per-user General setting (page_filter_format). Field rendering is factored into emit_field() so both layouts share one source. * fix: render page-action buttons (import, export, sort) on the modern filter bar Import, Export, Purge, Save, and sort ascending/descending are page actions, not filter inputs, so they render on the bar beside the Layouts selector instead of inside the Edit dialog. Only go/clear are dropped from the bar; the dialog keeps the Search/Clear footer. * feature: render the modern Edit dialog one filter variable per row The dialog no longer mirrors the inline filter's multi-field row packing; each filter variable renders on its own row (label + control) for a clean, responsive form. Hidden/validate fields stay in the form without an empty visible row. Rows carry a cactiFilterEditRow hook for label-column alignment styling. * feature: align the modern edit dialog one-per-row and skin it per theme Render all dialog fields in a single table so the label column aligns via the existing table-cell layout. Tag the dialog widget with cactiFilterDialog and add a scoped skin to the modern theme (slate titlebar, styled button pane, accented primary action). Add a bar separator between layout and page-action buttons. * feature: skin the modern filter Edit dialog across the classic themes Add the scoped .cactiFilterDialog skin (accent titlebar, white title/close, styled button pane with an accented primary action) to cacti, carrot, dark, hollyberry, paper-plane, paw, raspberry, and sunrise, each using its own brand accent. The skin is accent-only and inherits each theme's dialog surface, so it works on light and dark themes. MidWinter is intentionally skipped (its variable-based CSS is handled in a separate Epic). * fix: delete a user's saved filter layouts when the user is removed user_remove() now deletes the user's own user_layouts rows alongside their other per-user data. Scoped to user_id so published (user_id = 0) layouts remain available to everyone. * fix: address PR review — PHPStan return type, escaping, callbacks, SQL columns, mb truncation, contrast, POT - create_filter(): cast both ob_get_clean() returns to string and drop the now-unused PHPStan baseline entry (fixes Level 6 failure). - Edit dialog title now uses html_escape_attr() (attribute-context double-encoding). - Modern Search/Clear honor the page's configured go/clear callbacks instead of hardcoding applyFilter()/clearFilter(). - filter_layouts_get() and layouts.php select explicit columns instead of *. - Layout name truncation uses mb_substr() to avoid cutting multibyte codepoints. - layouts.php management callback checks result.ok before reloading. - carrot/paper-plane dialog accents darkened to meet WCAG AA (>=4.5:1) with white text. - Added the new translatable msgids (Page Filter Format, Filters, Edit Filter, Filter Name, Save As, ...) to cacti.pot. * fix: resolve Semgrep reflected-xss by reading filter_layout inside layout_select The request var is no longer passed into layout_select() as a parameter (which Semgrep tracked parameter-to-return to the print sink); it is read internally like create_filter(), and the option markup remains escaped. No behavior change. --------- Co-authored-by: TheWitness <copilot@users.noreply.github.com> Co-authored-by: TheWitness <TheWitness@users.noreply.github.com>	2026-10-05 19:49:42 -04:00
TheWitnessandLarry Adams	75d816a335	security: consolidate GHSA batch 11 fixes for develop (fq9x, hh7r, v99q, f5f5) (#8165) ... * security: consolidate GHSA batch 11 fixes for develop (fq9x, hh7r, v99q, f5f5) Mirrors the 1.2.x batch-11 security consolidation. Items already fixed on the develop tip are credited on their advisories and omitted here: - GHSA-54hx-hxc4-jq7j: TICK/SHIFT values already pass through strip_alpha(). - GHSA-hh7r CSV portion: already guarded via cacti_csv_cell(); only the Content-Disposition filename needed sanitizing (included below). - GHSA-mx5c: REST scaffold already deny-by-default (404 unless api_enabled), enforced by tests/Unit/ApiDenyByDefaultTest.php. - GHSA-rjvj/pjq5/fmhq/mfw8: already addressed on develop. Fixes applied here: - GHSA-fq9x-x3vf-3vf2 (High): add substitute_script_path() single-pass token substitution and refactor get_full_script_path()/get_full_test_script_path() to use a pre-escaped value map, closing the second-order re-substitution OS command injection. - GHSA-hh7r-464j-rf39: sanitize the Content-Disposition filename in graph_xport.php. - GHSA-v99q-57w7-mpmg: escape the page title rendered in the HTML <title>. - GHSA-f5f5-h85v-6m3h: render user admin tooltip content as escaped text. * security: add batch-11 consolidation regression tests for develop Addresses PR #8165 review feedback by adding regression coverage for all four fixed sinks: - GHSA-fq9x: behavioral single-pass proof that substitute_script_path() does not re-substitute a field value containing another field token, plus source guards that both path builders use the helper. - GHSA-hh7r: Content-Disposition filename strips CR/LF/quote/backslash. - GHSA-v99q: the HTML <title> is html_escape()'d. - GHSA-f5f5: both the user_admin.php and user_group_admin.php tooltips render data-tooltip as escaped text. * style: apply php-cs-fixer formatting to substitute_script_path (CI coding standards) * docs: require composer run-script php-cs-fixit before creating any pull request * docs: require PHPStan (level 8, satisfies Level 6 floor) to pass before creating any pull request --------- Co-authored-by: Larry Adams <TheWitness@users.noreply.github.com>	2026-10-03 14:20:33 -04:00