mirror of
https://github.com/Cacti/cacti.git
synced 2026-11-03 02:27:13 +09:00
fix/graph-wrapper-date-range-develop
4
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 TheWitness
|
46908e350b |
fix(ci): pin htmx.org back to 2.0.10 to match vendored asset and SRI (#8091)
* fix(ci): pin htmx.org back to 2.0.10 to match vendored asset and SRI The npm group bump #8085 raised htmx.org to 4.0.0, but the vendored include/js/htmx.js, the HTMX_2_0_10_SRI integrity constant, and the htmx.js.version file were not regenerated. CI's 'Build managed JavaScript' step (build/sync-js.mjs) copies node_modules/htmx.org/dist/htmx.js, so it shipped 4.0.0 while htmx_script_tag() still emitted the 2.0.10 SRI, failing tests/Unit/Ui/Html/HtmxTest. Revert htmx.org to the vendored/pinned 2.0.10; a real htmx 4.x upgrade should be a separate, tested PR. * fix(htmx): sync version file, tests and docs to vendored 2.0.10 |
||
|
dependabot[bot]andThomas Vincent
|
c54a5595de |
deps(deps): bump the npm group with 8 updates (#7919)
* deps(deps): bump the npm group with 8 updates Bumps the npm group with 8 updates: | Package | From | To | | --- | --- | --- | | [big.js](https://github.com/MikeMcl/big.js) | `6.2.2` | `7.0.1` | | [billboard.js](https://github.com/naver/billboard.js) | `3.18.0` | `4.0.3` | | [d3](https://github.com/d3/d3) | `7.8.2` | `7.9.0` | | [htmx.org](https://github.com/bigskysoftware/htmx) | `2.0.6` | `2.0.10` | | [jquery](https://github.com/jquery/jquery) | `3.7.1` | `4.0.0` | | [jquery-validation](https://github.com/jquery-validation/jquery-validation) | `1.21.0` | `1.22.1` | | [screenfull](https://github.com/sindresorhus/screenfull) | `3.3.3` | `6.0.2` | | [tablesorter](https://github.com/Mottie/tablesorter) | `2.31.3` | `2.32.0` | Updates `big.js` from 6.2.2 to 7.0.1 - [Changelog](https://github.com/MikeMcl/big.js/blob/main/CHANGELOG.md) - [Commits](https://github.com/MikeMcl/big.js/compare/v6.2.2...v7.0.1) Updates `billboard.js` from 3.18.0 to 4.0.3 - [Release notes](https://github.com/naver/billboard.js/releases) - [Changelog](https://github.com/naver/billboard.js/blob/master/CHANGELOG.md) - [Commits](https://github.com/naver/billboard.js/compare/3.18.0...4.0.3) Updates `d3` from 7.8.2 to 7.9.0 - [Release notes](https://github.com/d3/d3/releases) - [Changelog](https://github.com/d3/d3/blob/main/CHANGES.md) - [Commits](https://github.com/d3/d3/compare/v7.8.2...v7.9.0) Updates `htmx.org` from 2.0.6 to 2.0.10 - [Release notes](https://github.com/bigskysoftware/htmx/releases) - [Changelog](https://github.com/bigskysoftware/htmx/blob/master/CHANGELOG.md) - [Commits](https://github.com/bigskysoftware/htmx/compare/v2.0.6...v2.0.10) Updates `jquery` from 3.7.1 to 4.0.0 - [Release notes](https://github.com/jquery/jquery/releases) - [Changelog](https://github.com/jquery/jquery/blob/main/changelog.md) - [Commits](https://github.com/jquery/jquery/compare/3.7.1...4.0.0) Updates `jquery-validation` from 1.21.0 to 1.22.1 - [Release notes](https://github.com/jquery-validation/jquery-validation/releases) - [Changelog](https://github.com/jquery-validation/jquery-validation/blob/master/changelog.md) - [Commits](https://github.com/jquery-validation/jquery-validation/compare/1.21.0...1.22.1) Updates `screenfull` from 3.3.3 to 6.0.2 - [Release notes](https://github.com/sindresorhus/screenfull/releases) - [Commits](https://github.com/sindresorhus/screenfull/compare/v3.3.3...v6.0.2) Updates `tablesorter` from 2.31.3 to 2.32.0 - [Changelog](https://github.com/Mottie/tablesorter/blob/master/CHANGELOG.md) - [Commits](https://github.com/Mottie/tablesorter/compare/v2.31.3...v2.32.0) --- updated-dependencies: - dependency-name: big.js dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm - dependency-name: billboard.js dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm - dependency-name: d3 dependency-version: 7.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: htmx.org dependency-version: 2.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: jquery dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm - dependency-name: jquery-validation dependency-version: 1.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: screenfull dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm - dependency-name: tablesorter dependency-version: 2.32.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com> * Keep screenfull on browser-compatible release Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * Refresh htmx integrity metadata Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Thomas Vincent <thomasvincent@gmail.com> |
||
|
Thomas Vincent
|
d4e255b5d9 |
security: stage nonce CSP migration and gated enforcement (#7662)
* security: add nonce CSP mode for inline JavaScript protection Reworks the content_security_policy_script setting into a three-mode Inline JavaScript Protection dropdown (HTMLX default, Nonce, None) and ports the per-request nonce, strict-dynamic policy, and CSP violation report endpoint from 1.2.x. The stored option key and its default are unchanged, so existing installs keep their current policy byte-for-byte; nonce mode is opt-in. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * security: stage nonce CSP enforcement safely Add report-only migration, gated enforcement, nonce-aware shared emitters, Linux Docker validation, and operator documentation.\n\nRefs #7703 * security: validate CSP header sources Reject malformed alternate-source configurations at the CSP boundary, validate fallback report URIs, and remove the obsolete Psalm header-taint baseline entry.\n\nRefs #7705 * chore: drop the composer.json change from this PR Dependency and manifest changes are a maintainer call and do not belong in this one. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> |
||
|
Thomas VincentandTheWitness
|
a75bf823bb |
feat: consolidate htmx loader and renderer abstraction global.php includes (#7517)
* feat(rendering): add view renderer abstraction Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * isolate renderer traversal test file * Standardize renderer headers and endpoint guard * style(renderer): use standard unit-test header in CactiRendererTest Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(renderer): reject null-byte paths before realpath Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: refresh sink and hotspot baselines for line shifts Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(renderer): guard root base path and template-dir redirect Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(renderer): canonicalize both paths in index.php direct-access guard Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * hardening: normalize renderer base path to one separator Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(renderer): reject filesystem root as template path A /-rooted renderer collapsed the containment prefix to /, which str_starts_with() matches for every absolute path, so any file was includable. Fail closed by refusing a root template path. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * hardening: reject windows drive-root template path Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * refactor: adopt PHP 8.4 idioms in view renderer Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: cover renderer abstraction to full coverage Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * hardening(renderer): reject UNC template names and fix sink baselines Refuse a leading-backslash (UNC) template name the same way absolute POSIX paths are refused, skip the direct-request redirect when SCRIPT_FILENAME carries a null byte, and correct the renderer include and views redirect line numbers in the security baselines. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * style: apply php-cs-fixer Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(renderer): use PHP 8.1-compatible readonly property in CactiRenderer Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * hardening(rendering): drop template context array before include Unset the internal context array after extract so an included template only sees the extracted variables, not the full context. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: refresh security baselines for renderer line shift Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(renderer): simplify containment check and drain nested output buffers The redundant real_path !== template_path comparison in validateTemplateFile() can never be false once is_file()/is_dir() have run, so drop it and keep the str_starts_with() prefix check as the actual containment guard. renderFile() also only unwound a single output buffer, so a template that opens (and leaves) its own buffer could leak an ob level or drop its content; unwind every buffer opened during rendering and reassemble them in the order they were written. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: refresh security baselines for renderer buffer/containment fix The dynamic_include line for lib/renderer.php's include shifted again after adding drainOutputBuffers(). Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * feat(htmx): vendor htmx 2.0.6 and add opt-in filter loader Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: cover htmx filter loader Add missing-vendored-file case for htmx_script_tag and mark the pre-bootstrap read_config_option guard as uncoverable. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: harden htmx loader harness and tighten enable check Skip anything but an exact 'on' for htmx_enabled, reject 4xx/5xx fixture responses, fail fast when the fixture base path is unresolved, pin setup-php to a commit SHA, and reindent the e2e specs to tabs. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * style: apply php-cs-fixer to htmx test files Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test(htmx): drop duplicate script-tag src assertion The subdir-install test repeated the preceding assertion; CACTI_PATH_URL is fixed at bootstrap so it could not exercise a distinct scenario. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(e2e): drop sqlite3 from docker-php-ext-install php:8.2-apache already ships sqlite3 built in, and its ext/sqlite3 source only carries config0.m4 (not config.m4), so building it standalone always fails with "Cannot find config.m4", breaking the e2e image build before Playwright ever runs. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test(htmx): clear stat cache around version-file rename Earlier tests already stat the version file via file_exists()/ file_get_contents(), so PHP's stat cache can report it present right after these tests rename it away, making the assertions flaky. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(htmx): recompute script-tag cache-buster per call The md5 cache-buster was cached in a static, so FPM/script_server processes kept serving a stale ?v=... hash after an htmx.min.js upgrade. Recompute it per call, matching get_md5_include_js() and get_theme_paths() in lib/functions.php, and drop the 'v=' parameter name to match their path + '?' + hash shape. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test(e2e): drop obsolete MariaDB options * ci(htmx): run the htmx integration test by path instead of a testsuite filter Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * build: vendor htmx unminified Debian rejects minified sources. The file is the htmx 2.0.6 dist source; its minified sibling hashes identically to what was committed, and the pinned SRI is recomputed over the unminified file. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix: address htmx review feedback * test(e2e): resolve Cacti version through PHP * test(htmx): harden portable server cleanup * ci(actions): update checkout action pins --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: TheWitness <thewitness@cacti.net> |