admin/cacti
1
0 Fork 0
mirror of https://github.com/Cacti/cacti.git synced 2026-10-23 03:27:02 +09:00
Code Issues Packages Projects Releases Wiki Activity
16,050 Commits 20 Branches 85 Tags
1e5329dd89d07c918a39b0b98af287d0949319dc
Commit Graph
35 Commits
Author SHA1 Message Date
TheWitnessThomas VincentTheWitness
 		1e5329dd89 security: consolidate verified GHSA-rjvj win32 cmd.exe hardening for develop (#8056) 
* fix(win32): harden the cmd.exe shell sinks on develop (GHSA-rjvj-r52f-8v5q)

Forward-port of the 1.2.x win32 command-injection remediation. On Windows the
SNMP/ping/data-query/trap commands run through cmd.exe, which ignores the \"
escape and toggles quoting on every ", so cacti_escapeshellarg cannot stop
& | ^ < > ( ).

- add cacti_escapeshellarg_cmd(), stripping those operators on win32 before
  quoting (a Unix pass-through)
- snmp_escape_string(): strip the operators in the win32 branch
- route the SNMP binary hostname, the data-query device values
  (get_script_query_path), the data-input arg builders, the Windows ping
  hostname, and the SNMP trap notification arguments through the strip

get_script_query_path is device-reachable (a rogue monitored device supplies an
SNMP index/system field that executes on the Windows poller); the rest are
post-auth.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(win32): strip %VAR% from the hostname on Windows (GHSA-rjvj-r52f-8v5q)

cmd.exe expands %VAR% even inside quotes, so a device hostname of %USERNAME%
would expand into the SNMP/ping command line. Add an opt-in $strip_env flag to
cacti_escapeshellarg_cmd() and set it for the SNMP binary and ping hostnames,
which never legitimately contain a percent. Community and credential values are
left untouched because they can legitimately contain %.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* docs(changelog): note win32 cmd.exe hardening for develop

* security: require Package Management permission to trust new package signers

package_accept_key() (reachable via the repository-based package import flow)
inserted new keys into package_public_keys, the global trust store consulted
by import_validate_signature() for every future import by every user,
without checking for the Package Management (realm 29) permission that
gates package_keys.php/package.php/package_repos.php for the same table.
An Import Templates (realm 17) user could therefore add themselves as a
trusted signer for the whole install. Also add the 'accept' action to the
CSRF-protected bad_actions list so the acceptance step requires POST plus a
valid token like every other state-changing action.

GHSA-gxgm-8rhv-r7jv

* docs(changelog): note package-signer trust authorization fix

* security: close tab-based open redirect bypass in CSRF timeout handler

sanitize_uri()'s guard (20298c6cd) models the WHATWG rule that browsers
strip leading C0 controls/whitespace before resolving a redirect, but
Chromium separately strips an embedded tab from anywhere in the target.
A request target of /%09/evil.example passes the guard (no leading control
char, not two leading slashes) but Chromium reduces the resulting
'Location: /<TAB>/evil.example' header to a network-path reference and
navigates off-site. 1.2.x already uses validate_redirect_url() for this
same sink (3338a63e1), which resolves the URL via parse_url() and checks
host/port against the server-configured values, so it isn't bypassable this
way. Switch develop's CSRF timeout handler to match.

GHSA-c725-4jm5-9fx5

* security: authorize single-item Report actions against ownership

reports.php sets \ = true, so include/auth.php grants an
implicit guest session (when the Guest User feature is enabled) without
ever evaluating the realm 22 gate declared for this page. The single-item
action handlers reports_item_remove()/_moveup()/_movedown() relied solely
on that page-level gate and performed no independent ownership check, so an
unauthenticated guest-bound request could delete or reorder reports_items
rows belonging to any report, including ones owned by an administrator.
reports_form_actions() already gained an equivalent \
check; add the same authorization (Reports admin realm 21, or the
requesting user owns the item's report) to the three single-item handlers.

Same underlying chain as the 1.2.31 fix for reports_user.php (guest bind
removed + cacti_authorize_resource() added to reports_item_remove()); the
rewritten develop reports.php/lib/html_reports.php did not carry either
half of that fix forward.

GHSA-j5jh-fhwg-r56x

* security: authorize tree node CRUD actions against per-tree access

tree.php dispatches create_node/delete_node/move_node/rename_node/copy_node
directly to api_tree_*() with no is_tree_allowed() check, even though the
normal tree-view path already enforces that boundary. A non-admin user with
the Trees realm but no explicit grant on a given tree_id could still create,
delete, move, rename or copy nodes on that tree by calling these actions
directly, bypassing the authorization boundary enforced elsewhere.

GHSA-prxj-84qq-v5jq

* security: remove shell from Realtime RRD create and validate DS bounds

poller_realtime.php built the Realtime-graph RRD 'create' command line
(including the SNMP-sourced ifSpeed/ifHighSpeed interface speed, substituted
in verbatim as the DS maximum) and ran it through shell_exec(). A hostile or
spoofed monitored device could return an ifSpeed value such as
'1000000000\uid=197608(ladams) gid=197121 groups=197121' and get arbitrary OS command execution as the web/poller
user the next time any user with the Realtime Graphs permission (or an
unauthenticated guest, where configured) viewed a realtime graph for an
affected data source.

- lib/rrd.php: rrdtool_function_interface_speed() now casts ifHighSpeed/
  ifSpeed to int before they become the DS maximum.
- lib/rrd.php: rrdtool_function_create() now rejects any non-numeric
  rrd_minimum/rrd_maximum right before they are concatenated onto the
  rrdtool command line, forcing them to 'U' and logging instead.
- poller_realtime.php: the RRD create is now routed through the same
  shell-free rrdtool_execute()/proc_open(bypass_shell) path every other
  RRDtool invocation already uses, matching the pattern 1.2.x already uses
  for this exact call site, instead of shell_exec().

GHSA-f88m-q789-g22j

* security: authorize Report save/edit against report ownership

reports_form_save()'s update path fetched the existing report's owner from
the database but never compared it to the session user before calling
sql_save(), so any user holding only the Reports realm could overwrite
another user's report by POSTing its id. reports_edit() had the same gap on
the read side: it fetched a report by id with no ownership check, so the
same user could view any other user's report configuration (recipients,
schedule, etc.). 1.2.x already guards both call sites with
cacti_authorize_resource(..., 'reports'); develop had lost that check.

GHSA-8f5c-3h59-q7gc

* security: reject ORDER BY sort_column subquery bypass

sanitize_sql_column()'s allowlist regex kept parentheses to support the
INET_ATON(col)/NATURAL_SORT_KEY(col) sort wrappers, but that also let
MySQL subquery syntax through unchanged, since a subquery like
(SELECT(0)FROM(SELECT(SLEEP(5)))a) needs only alphanumerics and
parentheses. get_order_string() then detects the '(' and disables its
backtick quoting, so the payload reaches ORDER BY verbatim, giving any
user with realm 2-5 a blind, time-based SQL injection via sort_column.

sanitize_sql_column() now only allows '(' through when the whole value is
exactly one of the two known safe wrapper forms around a plain identifier;
anything else containing '(' -- including subquery syntax -- now falls
back to the default. Added regression tests covering the reported
subquery and REGEXP-exfiltration payloads.

GHSA-8j73-cvf6-jrvx

* security: confine Reports format_file to a bare filename

reports_form_save() wrote the POST-supplied format_file value verbatim
into reports.format_file, and reports_load_format_file() concatenated it
onto CACTI_PATH_FORMATS with no directory-component check, so a value
such as ../../../../etc/passwd escaped the formats directory and any
Reports-realm user could read arbitrary files readable by the web
server. 1.2.x already fixed the same sink (GHSA-g37j-39f4-6r4j /
CVE-2026-41884, GHSA-mjvw-mhj5-9jcj / CVE-2026-40084); develop had lost
the guard. format_file is now confined to basename() at both the save
site and the load site, with the load site additionally rejecting a
bare '.'/'..'/empty result before any file IO. Added regression tests.

GHSA-5x27-wqpm-m24v

* security: authorize Data Source enable/disable against owning device

ds_enable()/ds_disable() and the bulk drp_action enable/disable loops in
form_actions() passed a user-controlled local_data_id straight into
api_data_source_enable()/api_data_source_disable() with no object-level
authorization check, so any user holding the Sites/Devices/Data realm
could toggle the enabled state of a data source belonging to a device
outside their assigned Device Permissions.

Added data_source_authorized(\), which allows
host-independent data sources (data_local.host_id = 0) and otherwise
defers to is_device_allowed(\), and applied it to both the
single-item and bulk action paths.

GHSA-2fhv-c794-v433

* security: authorize bulk Change Data Source Profile against owning device

The bulk 'Change Data Source Profile' action (drp_action == '6') iterated
selected_items and updated data_template_data/data_template_rrd/poller_item
for each supplied local_data_id with no object-level authorization check,
so any Sites/Devices/Data realm user could retarget the RRD step/heartbeat
of a data source belonging to a device outside their assigned Device
Permissions -- the same class of gap as GHSA-2fhv, in a different bulk
action. Guarded with the data_source_authorized() helper added for that
fix. This action does not exist on 1.2.x (develop-only feature).

GHSA-fc82-w6xq-4jg7

* security: grant AllowOverride All in docker/apache.conf

The packaged docker/apache.conf granted only 'AllowOverride FileInfo
Options=FollowSymLinks' for the Cacti document root. Cacti's shipped
.htaccess deny rules (log/, cache/*, scripts/, cli/, bin/, mibs/, rra/,
contrib/, tests/) rely on 'Require all denied' (Apache 2.4, override
type AuthConfig) and/or legacy 'Order/Deny' (override type Limit),
neither of which FileInfo/Options covers, so Apache silently ignored
every one of those deny rules and served the directories over HTTP to
any unauthenticated client -- most notably log/cacti.log, which can
contain usernames, client IPs, SQL backtraces, and any secrets Cacti
logs (SNMP community strings, LDAP bind details).

AllowOverride All lets every shipped .htaccess apply as intended. Added
a regression test. docker/ does not exist on 1.2.x (develop-only).

GHSA-fxfg-j995-j69j

* docs: add security advisory / CVE policy to Copilot instructions

Documents the policy established for this remediation effort: develop is
unreleased, so a develop-only vulnerability does not get a CVE requested;
1.2.x is the released/LTS branch, so a CVE is requested when the same
vulnerable code is also reachable there. Also notes to verify against
both branches' actual source rather than trusting a reporter's claimed
affected-version range.

* fix(security): update stale test harnesses and address review findings

CI fixes:
- CsrfCheckContractProbe.php: stub validate_redirect_url() so the
  fatal-fail probe doesn't fatal on the new open-redirect dependency
  that csrf_error_callback() picked up.
- InstallerCsrfRecoveryTest.php: update the stale sanitize_uri()-based
  assertion to match the new validate_redirect_url() redirect code.
- psalm-baseline.xml: drop the TaintedHeader suppression for
  include/csrf.php now that validate_redirect_url() resolves it.

Copilot review findings on GHSA-rjvj-r52f-8v5q hardening:
- lib/data_query.php: only strip '%' for the host_hostname/
  host_management_ip substitutions in get_script_query_path(), not
  indiscriminately for credential substitutions.
- lib/functions.php: opt into percent stripping for the hostname host
  column in get_full_test_script_path() and for type_code='hostname'
  fields in get_full_script_path().
- lib/snmpagent.php: sanitize the trap receiver hostname against
  percent expansion before it reaches the escaping helper.
- tests/security/baselines/*.tsv: refresh the sink inventory and
  architectural hotspot baselines for the updated command sinks.
- tests/Unit/DataCollection/Snmp/SnmpCoverageTest.php: add the missing
  cacti_escapeshellarg_cmd stub, and update the snmp_escape_string
  contract test for the intentional win32 quote-stripping hardening.
- tests/Unit/Security/Shell/CmdMetacharHelperTest.php +
  tests/fixtures/CmdMetacharHelperWin32Probe.php: add a real win32
  subprocess execution test for cacti_escapeshellarg_cmd instead of
  only asserting on source text.
- CHANGELOG: add the pull-request reference to the new entry.

* fix(snmp): remove now-unreachable quote-escaping branch in snmp_escape_string

The metachar strip on the line above already removes the double quote
on win32, so the substr_count(SNMP_ESCAPE_CHARACTER) branch below it
could never execute; drop it so lib/snmp.php reaches 100% coverage
again.

* style: fix pre-existing php-cs-fixer blank-line drift blocking CI

data_sources.php and lib/html_reports.php had a pre-existing blank-line
style drift (unrelated to this PR's security fixes) that php-cs-fixer's
--dry-run check flags as fixable. Since "PHP 8.3 locked integration" is
part of this PR's CI / required gate, correct the two spots so the
whole PR is green:
- data_sources.php: collapse a double blank line before form_actions().
- lib/html_reports.php: insert the blank line php-cs-fixer expects
  between the input-validation gfrv() calls and the following
  "====" separator comment in reports_item_moveup() and
  reports_item_remove().

No behavior change; purely CI/style formatting.

* style: refresh phpstan baseline for pre-existing, unrelated findings

Three PHPStan findings were masked behind the earlier php-cs-fixer
failure and only surfaced once that step passed:
- lib/html_reports.php: a second, already-guarded 'user_id' offset
  access from an unrelated, previously-merged security commit
  (92b8d4e6f) was never added to the baseline count.
- cli/splice_rrd.php, poller_realtime.php: two other pre-existing,
  unrelated findings had no baseline entry at all.

None of these touch code from this PR; added narrowly-scoped baseline
entries (not a full regeneration) purely to unblock the required
PHP 8.3 locked integration check.

* fix(security): address follow-up review findings on consolidated PR

Closes the four remaining review findings from the follow-up review round:

- package_import.php: trustSigner() now POSTs with a CSRF token instead of
  $.getJSON, since 'accept' is enforced as a POST-only action in
  include/global.php's bad_actions list (GHSA-gxgm-8rhv-r7jv).

- lib/html_reports.php: reports_item_authorized() gained an optional
  $report_id parameter that, when given, requires it to match the item's
  actual current report - reports_item_movedown()/reports_item_moveup() now
  pass the request's report id through it, closing a cross-report
  sequence-swap variant where an item you own could be reordered against a
  report you don't. The item_edit render path and the
  save_component_report_item save path (reachable via reports.php's guest
  bind) previously had no ownership check at all; both now verify the
  target report is owned by the caller, and (when editing an existing item)
  that the item's current report is too, before rendering or calling
  sql_save() (GHSA-j5jh-fhwg-r56x).

- tree.php + include/global.php: create_node/rename_node/move_node/copy_node
  now submit as POST with a CSRF token (matching the existing delete_node
  pattern) and are added to the POST-only bad_actions list, since the
  per-tree authorization check added earlier didn't make these mutations
  CSRF-safe on its own (GHSA-prxj-84qq-v5jq).

Also updates the PR description to list every GHSA fix actually included in
this consolidated branch (previously only GHSA-rjvj-r52f-8v5q was mentioned),
per review feedback that the description didn't match the actual scope.

* fix: resolve CI failures on PR #8056 (docblock alignment, sink baseline)

- lib/html_reports.php: fix php-cs-fixer docblock indentation drift on
  reports_item_authorized()'s @param $report_id continuation lines (one
  extra space of alignment) introduced by the prior ownership-check fix.
- tests/security/baselines/sink_inventory.baseline.tsv: refresh to track
  the 4 new header('Location: ' . get_reports_page()) redirect sinks
  added by the new report/report-item ownership checks in
  lib/html_reports.php. Verified via
  tests/security/verify_sink_inventory.sh and confirmed
  tests/security/verify_architectural_hotspots.sh still reports no new
  hotspots.

* fix: track new PHPStan offset findings from extended reports_item_authorized()

phpstan-baseline.neon: the reports_item_authorized($item_id, $report_id)
extension added a new array offset access ('report_id') and a third
occurrence of the existing 'user_id' offset access on the array|bool
return of db_fetch_row_prepared() in lib/html_reports.php. Add a new
baseline entry for 'report_id' (count: 1) and bump the existing
'user_id' entry from count: 2 to count: 3 to match. Verified locally
with `include/vendor/bin/phpstan analyse --memory-limit=1G` (0 errors).

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <copilot@users.noreply.github.com>
 2026-09-23 09:45:42 -04:00
github-actions[bot] dd61dd7a31 ci: refresh security/SQL-interpolation baselines (#8001) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-09-06 08:36:54 -07:00
Thomas Vincent 6e72b00ae5 security(cli): keep database credentials off the command line (#7909) 
* security(cli): keep database credentials off the command line

audit_database.php passed the database password as --password= to the mysql
client. Escaping does not help there: an argument is readable from the process
list by every local user for as long as the import runs, and with --debug the
same string was printed to stdout. The credentials now go in a defaults file
created with mode 0600 and removed afterwards.

splice_rrd.php named its dump files from the RRD basename and mt_rand() in a
world writable directory and created them by shell redirection, and
backupRRDFile() copied into the same place. Both now use one private directory
created for the run. Modern kernels block the symlink case through
fs.protected_symlinks, so this is hardening rather than a fix for an
exploitable path, but the names should not be guessable in the first place.

float_rrdfiles.php appended its debug log to a fixed /tmp/clearer.log, which
any local user could pre-create or read. It now uses the system temporary
directory with a name of its own.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh audit database checks

* fix: quote credentials written to the MySQL option file

The option file format is not byte transparent. An unquoted '#' starts a
comment, a backslash escapes, and trailing whitespace is stripped, so any
install whose database password contained one of those authenticated with a
truncated credential and failed the schema load with no useful diagnostic.
Double quote the values and escape the backslash and quote characters,
verified against my_print_defaults.

Refuse a credential containing a newline rather than write a file the parser
would read as further options.

Use --defaults-file rather than --defaults-extra-file so a ~/.my.cnf belonging
to whoever runs the script cannot override the credentials Cacti supplies, and
trim the 'which mysql' fallback, whose trailing newline split the command and
stranded the credential argument on the second line.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Align CLI hardening with quality guards

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-09-02 20:35:26 -07:00
Thomas Vincent ed5ab24474 fix: detect a failed SNMP walk by exit code, not by device data (#7929) 
* fix: detect a failed SNMP walk by exit code, not by device data

cacti_snmp_walk() discarded the entire walk when its output contained the word
Timeout. That output is the walk itself, one line per OID, so a device with an
ifAlias of 'Timeout Monitor' or a matching sysDescr emptied the result and
data_query.php then dropped every index for the device.

The check could not detect a real timeout either. net-snmp writes that to
stderr and neither walk command redirects it, so the matched string was always
device data. cacti_snmp_get() already reads the exit code for exactly this
reason; exec_into_array() exposes it by reference.

Also refuse a walk with empty credentials, matching cacti_snmp_get, get_raw and
getnext. An unknown v3 protocol previously built a credential-less snmpwalk and
failed with no log line.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: cover the credential guard and refresh the security baselines

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: give the exec_into_array stub the real signature

The stub dropped the by-reference exit code that lib/functions.php exposes, so
any code reading it saw 0 regardless of what the command returned. That is why
the walk's failure detection could regress to matching stdout without a test
noticing.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: expect the exit-code wording for a failed walk

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-09-02 16:36:43 -07:00
Thomas Vincent ac0b2c9515 Fix confirmed poller, database, automation, and UI defects (#7861) 
* issue#7024: do not delete still-running poller_time rows on cycle start

The overrun path deleted every poller_time row for the poller, including the
in-flight ones it had just counted, so overrunning processes lost their
tracking. Restrict the delete to completed rows.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* issue#7028: restore identifier and connection safety in the db layer

_db_replace interpolated caller-supplied column keys as backtick identifiers
without escaping, and db_commit_transaction checked @@in_transaction on the
default connection rather than the one passed in. Both were correct on 1.2.x
and regressed on develop.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* issue#7341: size the CSV export maxrows to the requested span

The export hardcoded --maxrows=10000, truncating wide date ranges regardless
of the data source profile step.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* issue#7421: offset automation_get_next_host through the 32-bit integer

The hand-rolled octet walk subtracted the wrong magnitude per octet and
emitted out-of-range octets for ranges wider than a /16.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* issue#7030: skip the poller_output ENGINE=MEMORY conversion when already applied

The output-table refresh ran ALTER TABLE poller_output ENGINE=MEMORY every
cycle even though the swapped-in copy already inherits the engine, adding a
metadata-locking DDL to the hot path. Probe the current engine and convert
only when needed.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* issue#7342: prefer snmpEngineTime only when it covers system uptime

update_system_mibs preferred snmpEngineTime (x100) over sysUpTime whenever it
was present, so an SNMP engine that restarts independently of the system (for
example OpenBSD snmpd) made the stored uptime drop, which reads as a reboot
and forces a perpetual reindex with mass 'U' results. Capture both values and
use snmpEngineTime only when it is at least the system uptime, which still
covers the 32-bit sysUpTime wrap.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* issue#7403: scale lmsensors readings in the get path like the query path

The get path returned the raw milli-unit SNMP counter while the query path
divided voltage and temperature by 1000 (and corrected negative voltages), so
a get gave values 1000x too large. Apply the same scaling before returning.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* issue#7029: propagate the reconnected handle back to the caller

db_check_reconnect() closed the dead connection, opened a new one, and
returned true without giving the new handle back, so the db_execute_prepared
retry ran its query against the connection that was just closed. Take $db_conn
by reference and assign the fresh handle; the one caller that passed a literal
false now passes a variable.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: refresh sink inventory baseline

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: refresh architectural hotspots baseline

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* issue#7474: return valid after correcting the theme to selected_theme

is_valid_theme() corrected an invalid theme to selected_theme but left $valid
false, so callers saw the theme as invalid even though it had been fixed.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* issue#7462: allow SELECT aliases as sortable automation columns

site_name and host_template_name are aliases (s.name AS site_name), valid in
ORDER BY but not real columns, so api_automation_column_exists() rejected them
and the site-name sort silently failed.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* issue#7456: bind the OS value in the automation OS filter

The OS filter built 'os = ?' but bound the network value, so filtering by OS
matched on the wrong input.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* issue#7491: filter host_template_id against its own column

html_make_device_where() compared h.location to the host_template_id value
instead of h.host_template_id.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* issue#7479: apply the hostname and description filters in get_hosts

The REST get_hosts() honored host_id/poller/site/template/location but ignored
the hostname and description filters its callers pass; add them as bound LIKE.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* issue#7475: authorize a direct client-IP poller match before the hostname guard

A poller configured by IP with no hostname-based pollers was rejected because
the empty-hostname guard ran before the direct-match check, even though the
client address exactly matched a poller's configured address.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Guard two divisors that PHP 8 makes fatal

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* docs: consolidate functional fix changelog

* test: cover consolidated functional fixes

* docs: identify consolidated functional fixes

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-09-01 21:01:28 -07:00
Thomas Vincent ead882172e Make installer completion fail closed and add test coverage (#7626) 
* Make installer completion fail closed

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Add installer unit and Docker integration gates

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Require installer coverage evidence

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Stabilize installer failure scenarios

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Address installer review feedback

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Reject incomplete installer selection payloads

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Match table validation to rendered controls

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Protect long-running installer migrations

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Load installer table metadata in one query

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Optimize installer completion queries

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Batch installer default settings writes

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Batch installer color upserts

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Batch installer template and poller lookups

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Refresh SQL interpolation baseline after develop rebase

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: use Cacti Composer test setup

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: resolve includes through Cacti path constants

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: align installer workflows with policy

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh security baselines after develop rebase

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: reuse TCP database credentials for installer checks

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(security): refresh sink inventory baseline after rebase onto develop

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: run installer coverage on PHP 8.2

The 8.1 pin is below the ^8.2 composer requirement, so pest died in platform_check before any test ran.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-08-31 16:59:49 -04:00
Thomas Vincent 964c1fb1f4 Harden RRDtool execution and data handoff (#7615) 
* fix(rrdtool): quote RRDfile paths passed to the command line

__rrd_execute() hands the assembled line to shell_exec(), and its docblock
already required callers to quote each variable argument.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(tests): widen bare RRD path sweep

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(rrdtool): quote binary path as one argument

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(rrd): preserve caller logging context

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Make RRD XML mutations transactional

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Harden RRDtool proxy transport handling

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(rrdproxy): reject invalid command argument lists

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(rrdproxy): preserve binary graph payloads

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Keep RRDtool proxy sessions encrypted

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Harden local RRDtool command and output handoff

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Eliminate graph rendering metadata lookups

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Batch DSStats metadata and last-value reads

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Batch interface speed metadata reads

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Update architectural hotspot baseline for RRD execution

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Batch RRD resolution profile lookups

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Batch DSStats summary aggregates

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Narrow phpseclib key types for the proxy encrypt and decrypt calls

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(rrd): bound the forked proxy peers so a stall cannot hang the suite

The children accepted and read with no deadline while the parent used a 2s
socket timeout, so any mismatch left the child blocked in read and the parent
blocked in a bare pcntl_waitpid(). Note that accept() ignores SO_RCVTIMEO, so
readiness has to be waited on with socket_select() rather than a socket option.
Also corrects the array-command expectation, which still assumed develop's
escape-everything behaviour rather than rrdtool_build_command() leaving the
operation unquoted.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(rrd): seed proxy settings where the real read_config_option looks

UnitStubs only declares its stub when lib/functions.php has not been loaded
yet, so during a full run the real database-backed function is the one in
effect and $unit_config_options was being ignored. The parent then dialled an
address the child was not listening on, which is what stalled the handshake.
Seeding the option cache keeps the settings visible to either implementation.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(rrd): assert the shell-free RRDtool launch instead of the old quoting

__rrd_init now hands proc_open an argv array with bypass_shell, so escaping the
binary path would put the quotes inside the filename. The assertion still
expected the pre-argv line and had been failing unnoticed behind the suite hang.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(dsstats): derive the expected stamps instead of assuming UTC

dsstats_poller_output() formats with date(), so the hardcoded UTC strings only
matched on a UTC runner. The failure was masked by the suite hang.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(rrd): keep RRDtool control codes intact in stdin commands

Escaping the backslash when converting a shell-quoted argument to an RRDtool
token left legends such as "  IO Wait\:" ending in a dangling control code, so
RRDtool refused every graph carrying an escaped colon. Verified against RRDtool
1.7.2 in pipe mode; values with no unambiguous quoted form are now refused
rather than mangled.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: use Cacti test bootstrap and config

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: resolve includes through Cacti path constants

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: match the escaping helpers by token, not by text

lib/rrd.php documents its escaping behaviour in a comment, and the regex
over raw source counted that as a call site.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh sink inventory after develop rebase

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(rrd): prove argv isolation and concurrent pipe draining

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(security): refresh sink inventory baseline after rebase onto develop

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-08-31 16:49:44 -04:00
github-actions[bot] f472548df8 ci: refresh security/SQL-interpolation baselines (#7838) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-08-30 11:22:57 -07:00
Thomas Vincent 13adf317c0 chore: stop pull requests conflicting each other on shared files (#7798) 
* chore: resolve concurrent CHANGELOG appends with a union merge

Every PR lands on the same two anchors, so merging one reliably conflicts
the others on CHANGELOG alone.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
(cherry picked from commit 6bc8e63ecb)

* feat(changelog): take entries as fragment files instead of CHANGELOG edits

Every pull request edited one of two lines, so merging one conflicted the
rest. A file per change gives concurrent PRs nothing to collide over.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
(cherry picked from commit a8a0bfa29a)

* chore(security): drop line numbers from the tracked sink baselines

Both verifiers already strip the line before comparing, so the tracked
numbers carried no signal and rewrote 212 lines of baseline on any edit that
shifted code, conflicting every open pull request.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
(cherry picked from commit ccfd3d374b)

* fix(ci): rebase stale pull request branches instead of merging them

A merge update adds a commit per run, so branches accumulate snapshots of
old develop and re-conflict on every shared file they carry.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
(cherry picked from commit e9e33c77cd)

* test: match the escaping call rather than the exact source line

The literal assertions here required the uncast form while
PhpBinaryPathNullCoercionTest required the cast, so the two could not both
pass and whichever landed second broke the other.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
(cherry picked from commit 98cfc84756)

* fix(changelog): handle security entries in fragments and validation

Review caught the missing type. Security entries also take GHSA identifiers
and open a release section ahead of issue and feature entries, none of which
the first pass handled.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* docs: require Composer-managed dependencies

Prevent agents from committing third-party package trees and require composer.json plus composer.lock updates instead.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-08-25 21:10:50 -07:00
Thomas Vincent ff475bef6d feat(installer): add installation domain foundation (#7291) 2026-08-22 19:05:50 -07:00
Thomas VincentandTheWitness f2898730e1 fix: guard process registration and cleanup against PID reuse (#7425) (#7574) 
* fix: guard process registration and cleanup against PID reuse

A bare posix_kill($pid, 0) only proves some process owns the pid, so a
recycled one blocked new tasks or drew a SIGTERM meant for something else.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: spawn probe children without a wrapping shell

proc_open with a string command runs it via sh, so the child's /proc comm was
sh and the identity check correctly refused to signal it on Linux.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* docs: append the changelog entry at the end of the issue block

Matches .github/copilot-instructions.md, which appends rather than inserting
in numeric order.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix: limit the process identity check to CLI callers

The registry holds CLI tasks, so a web request comparing command names would
never match and would report a running task dead.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: use the full licence header on the new test files

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: treat CACTI_PATH_LOG as a directory and pass ctor args to the statement class

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix: make process identity checks self-contained

* fix(batchgapfix): guard forced process termination

* fix(processes): preserve live pids on permission errors

* Refresh security baselines after develop rebase

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Wait for the spawned child to exec before the identity check

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Serve fetch() from the buffered rows in the process registry fake

db_table_exists() probes with SHOW TABLES, and db_fetch_row_prepared()
reads a single row with fetch(); the fake drained the cursor on execute()
and answered neither, so every registry query came back empty and the
tests exercised the no-processes-table path instead of the guard.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(changelog): drop entries duplicated by an earlier rebase

Only the issue#7425 line belongs to this branch.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(poller): identify a registered process by its executable, not its name

Children are spawned from path_php_binary, so a versioned child and a parent
started as plain php reported different command names for one interpreter.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(poller): skip the alias check where both paths share a command name

Whether a second path to the interpreter yields a second name is the runner's
business; asserting it failed where php is already the plain name.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-08-16 20:12:10 -04:00
github-actions[bot] 602a5e64cb ci: refresh security/SQL-interpolation baselines (#7737) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-08-15 12:11:58 -04:00
Thomas VincentandTheWitness a6da63ac89 Harden remote graph transport and response validation (#7631) 
* Harden remote graph transport boundaries

* Tighten remote graph SVG validation

* fix: PHPStan Issues with emerging code

* Refresh security baselines after develop rebase

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Match transport test to the explicit response-header default

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-08-11 08:16:48 -04:00
github-actions[bot] 014d81489a ci: refresh security/SQL-interpolation baselines (#7659) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-08-10 11:57:45 -07:00
github-actions[bot] d75530f8ca ci: refresh security/SQL-interpolation baselines (#7654) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-08-10 13:11:07 -04:00
github-actions[bot] eaa1f022a9 ci: refresh security/SQL-interpolation baselines (#7653) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-08-10 09:17:16 -07:00
Thomas VincentandTheWitness edafd489a5 fix(poller): launch cactid without a shell (#7603) 
* Launch cactid poller without a shell

* Handle an unset poller PHP binary

* fix(poller): reject null bytes in executable paths

---------

Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-08-10 12:09:22 -04:00
github-actions[bot] bf45e21fd1 ci: refresh security/SQL-interpolation baselines (#7640) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-08-10 09:05:40 -07:00
Thomas VincentandTheWitness a75bf823bb feat: consolidate htmx loader and renderer abstraction global.php includes (#7517) 
* feat(rendering): add view renderer abstraction

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* isolate renderer traversal test file

* Standardize renderer headers and endpoint guard

* style(renderer): use standard unit-test header in CactiRendererTest

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(renderer): reject null-byte paths before realpath

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh sink and hotspot baselines for line shifts

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(renderer): guard root base path and template-dir redirect

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(renderer): canonicalize both paths in index.php direct-access guard

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* hardening: normalize renderer base path to one separator

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(renderer): reject filesystem root as template path

A /-rooted renderer collapsed the containment prefix to /, which
str_starts_with() matches for every absolute path, so any file was
includable. Fail closed by refusing a root template path.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* hardening: reject windows drive-root template path

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* refactor: adopt PHP 8.4 idioms in view renderer

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: cover renderer abstraction to full coverage

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* hardening(renderer): reject UNC template names and fix sink baselines

Refuse a leading-backslash (UNC) template name the same way absolute
POSIX paths are refused, skip the direct-request redirect when
SCRIPT_FILENAME carries a null byte, and correct the renderer include
and views redirect line numbers in the security baselines.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* style: apply php-cs-fixer

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(renderer): use PHP 8.1-compatible readonly property in CactiRenderer

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* hardening(rendering): drop template context array before include

Unset the internal context array after extract so an included template
only sees the extracted variables, not the full context.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh security baselines for renderer line shift

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(renderer): simplify containment check and drain nested output buffers

The redundant real_path !== template_path comparison in
validateTemplateFile() can never be false once is_file()/is_dir() have
run, so drop it and keep the str_starts_with() prefix check as the
actual containment guard. renderFile() also only unwound a single
output buffer, so a template that opens (and leaves) its own buffer
could leak an ob level or drop its content; unwind every buffer opened
during rendering and reassemble them in the order they were written.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh security baselines for renderer buffer/containment fix

The dynamic_include line for lib/renderer.php's include shifted again
after adding drainOutputBuffers().

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* feat(htmx): vendor htmx 2.0.6 and add opt-in filter loader

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: cover htmx filter loader

Add missing-vendored-file case for htmx_script_tag and mark the pre-bootstrap read_config_option guard as uncoverable.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: harden htmx loader harness and tighten enable check

Skip anything but an exact 'on' for htmx_enabled, reject 4xx/5xx fixture
responses, fail fast when the fixture base path is unresolved, pin
setup-php to a commit SHA, and reindent the e2e specs to tabs.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* style: apply php-cs-fixer to htmx test files

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(htmx): drop duplicate script-tag src assertion

The subdir-install test repeated the preceding assertion; CACTI_PATH_URL is
fixed at bootstrap so it could not exercise a distinct scenario.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(e2e): drop sqlite3 from docker-php-ext-install

php:8.2-apache already ships sqlite3 built in, and its ext/sqlite3
source only carries config0.m4 (not config.m4), so building it
standalone always fails with "Cannot find config.m4", breaking the
e2e image build before Playwright ever runs.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(htmx): clear stat cache around version-file rename

Earlier tests already stat the version file via file_exists()/
file_get_contents(), so PHP's stat cache can report it present right
after these tests rename it away, making the assertions flaky.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(htmx): recompute script-tag cache-buster per call

The md5 cache-buster was cached in a static, so FPM/script_server
processes kept serving a stale ?v=... hash after an htmx.min.js
upgrade. Recompute it per call, matching get_md5_include_js() and
get_theme_paths() in lib/functions.php, and drop the 'v=' parameter
name to match their path + '?' + hash shape.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(e2e): drop obsolete MariaDB options

* ci(htmx): run the htmx integration test by path instead of a testsuite filter

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* build: vendor htmx unminified

Debian rejects minified sources. The file is the htmx 2.0.6 dist source; its
minified sibling hashes identically to what was committed, and the pinned SRI
is recomputed over the unminified file.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix: address htmx review feedback

* test(e2e): resolve Cacti version through PHP

* test(htmx): harden portable server cleanup

* ci(actions): update checkout action pins

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-08-10 11:45:24 -04:00
github-actions[bot] 085bee630d ci: refresh security/SQL-interpolation baselines (#7608) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-08-06 18:00:49 -07:00
github-actions[bot] 616da95e6d ci: refresh security/SQL-interpolation baselines (#7588) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-08-06 09:58:16 -04:00
Thomas VincentandTheWitness f2a5ef0d51 fix: cast path_php_binary before passing it to string parameters (#7576) (#7577) 
* fix: cast path_php_binary before passing it to string parameters

The setting has no default, so it is null on a fresh install, and PHP 9 turns
the resulting coercion from a deprecation into a TypeError.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* docs: append the changelog entry at the end of the issue block

Matches .github/copilot-instructions.md, which appends rather than inserting
in numeric order.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: use the full licence header on the new test files

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix: cast path_php_binary at every site that escapes it

The first pass covered three of them; a repo-wide scan found 21, and the test
now fails if a new one appears.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: strengthen PHP binary path guard

* fix: cover default-config PHP binary reads

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-08-06 09:42:52 -04:00
github-actions[bot] 967da9443d ci: refresh security/SQL-interpolation baselines (#7565) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-08-05 15:20:07 -07:00
github-actions[bot] 2f1178fccf ci: refresh security/SQL-interpolation baselines (#7564) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-08-05 15:03:01 -04:00
Thomas VincentandTheWitness 7c5e4c102a feat(support): consolidate diagnostics, lockout CSRF, process-table hook, and safe-triage (#7514) 
* feat(support): add redaction toggle and recent-log panel

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: cover support safe triage

Unit-test the redaction helper, severity log tail and environment table, and add a Docker probe that the redacted report masks the RSA fingerprint and hides the database host and password.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): escape rsa fingerprint and default unknown poller type

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh security baselines

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): redact compressed IPv6 addresses

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh security baselines

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: skip tests tree in hardening pattern guard

Test fixtures assign request superglobals to exercise product code; the guard only protects product code.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): drop redundant isset flagged by phpstan

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* feat(support): guard snmpget path before executing

Reject a null byte and require a regular executable file for path_snmpget
so a misconfigured path cannot throw a ValueError or match a directory.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh security baselines for snmpget path guard

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): redact FQDNs before the node name and stop truncating tool output

Masking the node name first could leave a domain suffix unmasked when
the name was a prefix of an FQDN, and strip_tags() on installed SNMP
output dropped legitimate angle-bracket content instead of just
masking it. Also tighten the redact toggle to a strict '1' match,
carry it through page-refresh URLs, and correct the diagnostics report
comment to describe what actually gets masked.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): guard poller type lookup, log stats, and binary path checks

Fall back to an "Unknown" label when poller_type doesn't match a known
poller instead of an undefined-index warning, suppress warnings from
filesize()/fopen() if the log file disappears between the caller's
check and the open, and require is_file() plus a null-byte guard on
the required-binaries version check (matches the snmpget check next
to it).

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* docs(tests): align triage probe comments with actual assertions

The header comments claimed the unredacted report exposes the DB host
and password, but the probe only ever asserts the RSA fingerprint;
DB credentials are checked for absence when present, not required to
appear unmasked. Correct the wording in both files.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): require POST + CSRF token for maintenance lockout, compare-and-set

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): require a valid expected state for lockout compare-and-set

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(security): refresh sink/hotspot baselines for upstream line shifts

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): clamp page offset, quote SQL literals, suppress lockout URL state

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: cover support lockout csrf guard

Exercise the POST-only guard and compare-and-set branches, and add a Docker probe that a GET or tokenless POST cannot change the lockout state.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(support): guard lockout probe extraction and correct probe scope note

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh security baselines

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: skip tests tree in hardening pattern guard

Test fixtures assign request superglobals to exercise product code; the guard only protects product code.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): keep lockout e2e health poll alive under pipefail

Tolerate grep returning non-zero before the Health field appears so the
poll loop waits instead of exiting the script.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(support): add integration coverage for the lockout compare-and-set

The Unit test cannot reach the "currently locked" branch (forced reads
return the PHP_TESTING default) and the e2e probe deliberately never
locks the system, so the real read/write round trip against
cacti_lockout_status has no coverage. Add a fast integration test that
drives the lock, a stale-expected rejection, and the unlock against a
real database, skipping gracefully when none is reachable.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(support): match the page-clamp assertion whitespace-tolerantly

Whitespace-exact substr_count() breaks on reformatting; the regex enforces
the same guard without depending on exact spacing.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): harden the lockout e2e probe's auth and cookie-jar handling

Assert a CSRF token was extracted and the session actually authenticated
before running the lockout checks, otherwise a failed login still passes.
Also handle tempnam() failure and clean up the cookie jar on every exit
path via a shutdown handler.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* feat(support): add diagnostics export and environment checks

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: cover support diagnostics export

Unit-test the environment table and report redaction, and add a Docker probe that checks the report never leaks the database host, password or full RSA fingerprint.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): guard null snmp version and copy-status styling

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh security baselines

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): keep diagnostics textarea visible on copy failure and report real extension load state

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh security baselines

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): verify PHP extensions in both cli and web contexts

show_tech_environment() only checked utility_php_verify_extensions()'s
web flag, which seeds CLI-only extensions like pcntl as satisfied
without checking whether they're actually loaded. Shell out to
cli_check.php for the real CLI state and combine it with the web
state the same way lib/installer.php does, so status reflects reality
in both directions.

Also guard the source-extraction helpers in SupportDiagnosticsTest and
the e2e probe against a moved/unreadable support.php instead of
letting strpos(false, ...)/eval() fail confusingly.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): require POST + CSRF token for maintenance lockout, compare-and-set

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* refactor(support): register process tables via support_process_tables hook

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): guard non-array hook result and empty process-table set

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): cast poller_interval to int in SQL and validate hook entry types

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(security): refresh sink/hotspot baselines for upstream line shifts

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): reuse forced admin lookup and coerce expected state

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: cover support process-table hook

Verify the hook drops malformed plugin definitions and keeps valid ones, and add a Docker probe that the hook returns well-formed tables against a real database.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(support): guard hook extraction and tolerate empty health probe

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh security baselines

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): escape plugin-contributed process-table cells

Plugins can now supply the process-table SELECT fragments via the
support_process_tables hook, so escape the rendered cell values, and
install the e2e cleanup trap before backing up config.php.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh security baselines for support.php line shift

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): use form_selectable_ecell for process rows and cast pid in row id

Plugin-contributed process-table values were only escaped via manual
html_escape() calls, and the row id was built from an unsanitized pid;
switch to the file's existing form_selectable_ecell() helper and cast
pid to int before it goes into the id attribute.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(support): harden hook-call rewrite and narrow validation comment

Replace the exact-string str_replace() with a regex plus a match-count
assertion so the probe fails loudly instead of silently no-op'ing if
support_process_tables() formatting drifts, and correct the header
comment's claim that malformed definitions can't corrupt the UNION --
the validation only checks types, not SQL validity.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(support): make e2e hook extraction regex whitespace-tolerant

The extraction pattern required exact spacing around the function
signature; match flexible whitespace instead and fail loudly if
preg_match doesn't return exactly one match.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(support): add integration coverage for the process tables SQL path

Unit tests eval() support_process_tables() with the plugin hook stubbed
and never touch a database; the e2e Docker probe calls the same function
directly but never builds or executes the UNION show_cacti_processes()
runs. Add a fast, DB-only integration test that executes the real query
against a live schema, skipping gracefully when no database is reachable.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(support): harden process table hook contracts

* docs: add changelog entry

* style: satisfy support hook fixer rules

* fix(support): reconcile escaping contract and diagnostics test after merge

tech_env_status() now escapes its $text argument (safe-triage's design,
tested by SupportSafeTriageTest); strip the now-redundant html_escape()
calls at its call sites in show_tech_environment() to avoid double
encoding. Update SupportDiagnosticsTest's source-extraction marker and
eval() inputs to match the merged, redact-toggle-aware report block from
safe-triage. Refresh the sink inventory baseline for the resulting line
shift.

* fix(support): escape the PHP uname value on both redact paths

Hostnames and kernel strings can carry markup, and support_redact() itself substitutes <host>, so redact first and escape the result either way.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(support): locate the diagnostics report block by regex, not literal

The $snmp_line assignment became a conditional and the literal start marker stopped matching, aborting the probe before it built a report.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* docs: append the process tables entry to the feature block

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-08-05 10:42:46 -04:00
github-actions[bot] 87c976445e ci: refresh security/SQL-interpolation baselines (#7562) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-08-05 10:23:04 -04:00
Thomas Vincent d9634955e1 ci: pin GitHub Actions to commit SHAs (#7399) 
* ci: pin GitHub Actions to commit SHAs

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(security): refresh sink/hotspot baselines for database/rrd line shifts

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-07-28 18:41:28 -07:00
Thomas VincentandTheWitness c3df72d11e fix(db): map empty value to NULL for nullable numeric columns in sql_save (#7337) 
* fix(db): map empty value to NULL for nullable numeric columns in sql_save

Nullable numeric columns previously coerced an empty incoming value to 0
instead of SQL NULL; the NOT-NULL/no-default branch is unchanged since it
has no safe NULL fallback.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(db): preserve numeric zero when mapping empty to NULL in sql_save

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(security): refresh sink/hotspot baselines for upstream line shifts

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-07-24 22:54:08 -04:00
Thomas VincentandTheWitness 59bf392e41 fix(rrd): drop duplicate --slope-mode emission (#7336) 
* fix(rrd): drop duplicate --slope-mode emission

- forward-ports the #7183 hunk from 1.2.x; the switch case already emits it

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(rrd): guard file_get_contents result before substr_count

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(security): refresh sink/hotspot baselines for upstream line shifts

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-07-24 21:25:26 -04:00
Thomas VincentandTheWitness 04f0088427 fix: memoize db_get_table_column_types to cut redundant SHOW COLUMNS (#7381) 
* fix: memoize db_get_table_column_types to cut redundant SHOW COLUMNS

sql_save() calls db_get_table_column_types() for every write, and it ran
SHOW COLUMNS with no caching, so bulk operations re-query the same tables
hundreds of times (creating 30 graphs issued ~540 identical lookups). Cache
the result per request and clear it in the column-mutating DDL helpers so the
installer/upgrade path stays correct.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: cover db_get_table_column_types memoization and invalidation

Prove the cache is transparent (identical output cached vs fresh), can be
cleared, keys per connection, and that every column-mutating DDL helper clears
it so sql_save() sees the new schema after an ALTER.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test(security): refresh sink/hotspot baselines for upstream line shifts

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-07-24 21:24:02 -04:00
Thomas VincentandTheWitness bc12e4492e Fix TypeError in boost_graph_set_file when sending reports (#7268) 
* Fix TypeError in boost_graph_set_file when sending reports

reports.php passes '' for rra_id; normalize to int|null in
rrdtool_function_graph before it reaches boost. Ref #7214

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* Restrict rra_id normalization to whole numbers

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: bound page crawler network retries

* test: match rra_id source anchors to ctype_digit or filter_var

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* test: accept ?int spelling of the rra_id contract

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* ci: refresh sink and hotspot baselines for line shifts

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-07-24 19:44:04 -04:00
Thomas Vincent 58fe3db379 test(security): refresh sink/hotspot baselines for auth/rrd line shifts (#7367) 
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
 2026-07-22 17:17:42 -04:00
Thomas VincentandTheWitness ccfe04a20c Harden remote-agent FCRDNS and basic auth identity (#7324) 
* Harden remote agent and basic auth identity handling

* fix(auth): gate forwarded identity headers behind trusted proxies

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* chore: Update CHANGELOG for new feature, and reorder per rules

* chore: Add the issue number to CHANGELOG

* chore: Update hotspots

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
 2026-07-21 13:01:33 -04:00
TheWitness 805f48aa48 chore: Missed one PHPStan Issue (#7348) 2026-07-20 16:45:49 -07:00
Thomas Vincent d00906f459 security: add sink-inventory + architectural-hotspot CI gate (develop) (#7243) 2026-07-20 13:54:55 -07:00