* chore: exclude plugins/ from phplint and add pre-commit hook
phplint (composer lint) only excluded include/vendor; locally installed
plugins were scanned too, causing spurious failures for plugin code that
doesn't follow Cacti's style rules.
Also adds tests/tools/pre-commit -- a hook that checks syntax and runs
php-cs-fixer dry-run on staged PHP files only (excluding plugins/ and
include/vendor/). Install once with: composer run-script install-hooks
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix: address five Copilot review findings in pre-commit hook
- php -l now lints the staged blob (via mktemp + git show :FILE)
so partial staging cannot block a clean commit or pass a staged error
- STAGED is now a bash array; paths are expanded via "${STAGED[@]}"
to prevent word splitting and glob expansion on filenames with spaces
- install-hooks resolves the hook path with git rev-parse --git-path
so installation works in linked worktrees where .git is a file
- --path-mode=override replaces --path-mode=intersection so staged
files in excluded directories (tests/, docs/) are not silently skipped
- removed 2>/dev/null from php-cs-fixer so configuration errors are
visible to the developer
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix: [Security] harden SQL and shell injection call sites
- api_automation.php: validate tree item field via api_automation_column_exists()
before SELECT construction (GHSA-37jj pattern)
- api_automation.php: whitelist sort_column and sort_direction before ORDER BY
(GHSA-q9xg pattern)
- functions.php: wrap data input value in cacti_escapeshellarg() before shell
interpolation (GHSA-9mv2 pattern)
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
Thomas Vincent