1 Commits
Author SHA1 Message Date
Thomas VincentandTheWitness 1f1ce78c61 Force the SNMP port to an integer before the net-snmp command line (#7689)
* Force the SNMP port to an integer in cacti_snmp_options_sanitize

Every net-snmp exec path interpolates $port raw into the command line
(hostname:port). The sanitizer only defaulted an empty port to 161 without
casting, so a non-numeric value passed through verbatim. Cast it to an integer
(falling back to 161 for empty/non-numeric input) so it can never carry shell
metacharacters, and cast the port in the ext-based SNMP session target too.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Move the 1.3.0-dev changelog entry to the end of the issue block

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
2026-08-15 14:03:13 -07:00