* In a recent audit of core Cacti code, there were a few stored XSS issues that can be exposed
* Also removed a few spurious title_trims, that should no longer be a problem.
When sorting data debug checks by user, no results are shown and
errors recorded into the cacti log because the user field was being
looked up seperately. However, there is no need for this as it can
all be done in the SQL statement so removed the extra code and had
SQL bring the user in allowing it to be sortable.
Closes#3713
* Vulnerability report: Lack of escaping on some pages can lead
to XSS exposure
* Also cleaning up additional copyrights
* Make the way filter headers are escaped consistent
-issue#2590: Language selection is not working as expected
-issue#2605: When checking for tables to upgrade, undefined variable $config error occurs
-issue#2608: db_update_table() function should not require an engine type or comment
-issue#2610: Data Sources troubleshooter generates warning that each() function is deprecated
Closes#2590, 2605, 2608, 2610
* Fixes for Issues 1781, 1782 and 1784
This patch corrects the following issues:
- #1782 During Install, changing the Theme from Modern to another theme has no
effect
- #1784 During Install, changing the Language from one to another has no
effect
- #1781 Installer does not warn when mysql optimizations not set
As part of #1781's fixes, a new warning icon is displayed instead of a thumbs
up or down. Additionally, recommendations have been revamped so that the ones
which are optionally (and some even state can be ignored) are now optional!
Also, introduced the correct calculation for innodb instances by taking the
buffer size during a previous recommendation and calculating from that. If
the buffer size is never found or the calcuation finds less than 1 instances
are recommended, a minimum of 1 is set.
The main reason for #1782 and #1784's issues were caused by renaming index.php
to install.php as part of the recent security update (see PR #1747). Updated
the javascript to use the correct install.php and then removed some extra data
that was being returned outside of StepData unnecessarily.
* Further fixes
This update corrects a number of issues with the database upgrading code, adds
the 'debug' plugin from cigamit, improves database functions to be more
consistent with errors across all functions and various installer based fixes
for the display and update of database upgrades.
It also brings a more visual response to the cli/upgrade_database.php so that
end users are not left wondering if something is happening. Also, reviewed
all upgrade scripts to ensure that an upgrade from 0.8.8 through to 1.2.0 is
possible even if a previous database upgrade have been done.
* Fix QA issue with 'path_cactilog'
Due to some code reshuffle and testing, found that the above setting was being
read via read_config_option() before there was a database open so no path was
ever detected unless the force option was used.
TheWitness