* Vulnerability report: Lack of escaping on some pages can lead
to XSS exposure
* Also cleaning up additional copyrights
* Make the way filter headers are escaped consistent
* Resolving issue #1689
As noted in issue #1689 (Technical Support's RRDTool version should show
detected RRD version) the version of the RRDTool is never actually displayed.
The code has now been updated to properly handle versioning and displays both
the configured and installed versions.
The setting for rrdtool_version has been updated to a proper minimum version
number so that the cacti_version_compare() function may be effectively used.
This means that the constant values of RRDTOOL_VERSION_1_3 through
RRDTOOL_VERSION_7 have now been removed from the system.
* Some QA updates
* Further QA fixes
1) Hide Aggregate system cdefs when editing graphs and graph templates
2) For themes other than classic, make color_id selection autocomplete
for easier searches
back port the following features from main:
1) vdef support
2) new graph items
3) new graph options
this covers all the high points available in rrdtool today.
also change the following:
1) allow forms to include spacers
2) reorganize graph template form with spacers
3) many help wording back ports from main
for those testing, if you are going to start using this version, you
will have to implement the changes in the upgrade script or reinstall.
also note that this change may break new aggregates.
There are still three steps to go in this overall. The first is to
replace all the page filtering session storing and validation functions
and the second is to propagate those changes into various areas of the
lib directory that include the use of the various variables, lastly,
developer mode will have to be enable to see if there are any variables
used in the code that have not been sanitized. Note, at this point the
develop branch should be thought of as slightly unstable
this is part three of project to remove the use of $_GET, $_REQUEST, and
$_POST in the code. Parts one and two have already been completed.
Part one was to remove the use of $_GET throughout the code, part two
was the incorporation of wrapper functions to handle specific
validation, verification and sanitization cases. This third part will
remove the use of the get_request_var_request() from the code. Part
four, and beyond will include the removal of both $_REQUEST and $_POST
super globals from the code.
Mark Brugnoli-Vinten