Thomas VincentandTheWitness 769c59ec9e fix(forms): encode form action URLs and configured attributes (#8437) ...

* fix(forms): preserve action URLs in HTML and JavaScript

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* docs(changelog): record form action URL fix for issue 8438

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(forms): encode configured form name and enctype attributes

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>

2026-10-20 13:18:37 -07:00

..

Auth

fix(auth): [develop] preserve SAML POST callback sessions (#8333)

2026-10-12 15:42:00 -07:00

Console

feat(cli): add unified command frontend and normalize legacy failures (#7903)

2026-09-07 18:36:55 -07:00

Domain/Installation

feat(installer): add installation domain foundation (#7291)

2026-08-22 19:05:50 -07:00

aggregate.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

api_aggregate.php

feat: expose RRDtool 1.11 graph axis controls (#8356)

2026-10-14 12:10:28 -04:00

api_automation_tools.php

fix(automation): bind template IDs and enforce 100% coverage (#7612)

2026-08-10 12:33:26 -04:00

api_automation.php

security: batch 7 develop - consolidate remaining develop-only GHSA advisories (12 fixes + 8 confirmations) (#8149)

2026-10-02 15:27:34 -04:00

api_data_source.php

security: consolidate verified GHSA fixes for develop (batch 4) (#8145)

2026-10-02 13:10:42 -04:00

api_device.php

deps: update Composer tooling and resolve PHPStan 2.3 diagnostics (#8357)

2026-10-16 08:49:23 -04:00

api_graph.php

security: restrict graph input fields across handoffs (CVE-2024-31458) (#7669)

2026-08-30 10:56:16 -07:00

api_notification.php

Let one notification address several recipients (#7782)

2026-09-02 21:01:03 -07:00

api_poller.php

Updating Copyrights to 2026 (#6578)

2026-01-28 16:11:10 -05:00

api_scheduler.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

api_tree.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

auth.php

Fix restrictive graph permission display for default-deny templates (#8422)

2026-10-18 10:39:20 -04:00

boost.php

fix(boost): never re-stage poller output when boost_redirect is on (#8374)

2026-10-14 21:13:43 -04:00

cache.php

Port #8166 SNMP credential cache + procedural SNMPv3 (with #8171/#8172 follow-ups) to develop (#8174)

2026-10-05 10:18:41 -04:00

cacti_dispatch.php

feat(security): add cacti_dispatch helper for action table authorisation (#7063)

2026-05-12 15:01:49 -04:00

CactiEmailChannel.php

Let one notification address several recipients (#7782)

2026-09-02 21:01:03 -07:00

CactiFilesystem.php

Add DI-friendly CactiFilesystem and adopt atomic CLI writes (#7189)

2026-08-29 17:52:26 -07:00

CactiForm.php

Add a Cacti-native form API and migrate the Site editor (#7368)

2026-08-22 19:06:10 -07:00

CactiMailerTransport.php

refactor(mail): replace PHPMailer with Symfony Mailer (#7190)

2026-07-15 08:30:24 -04:00

CactiMd5FileFinder.php

Use a maintained finder for recursive MD5 discovery (#7718)

2026-08-31 17:07:36 -04:00

CactiNotification.php

ci: restore coverage and workflow policy gates (#7791)

2026-08-22 19:05:25 -07:00

CactiOAuth.php

refactor(oauth): extract CactiOAuth provider factory (#7129)

2026-05-13 10:36:06 -04:00

CactiProcessLock.php

Serialize process registry admission with portable locks (#7771)

2026-09-04 19:36:42 -07:00

CactiRecipient.php

Add plugin-extensible notification API (#7775)

2026-08-21 14:29:33 -07:00

CactiSettings.php

fix(security): close validator migration regressions (#7240)

2026-07-13 15:13:59 -04:00

CactiValidator.php

feat: expose RRDtool 1.11 graph axis controls (#8356)

2026-10-14 12:10:28 -04:00

cdef.php

test(cdef): enforce resolver coverage (#7974)

2026-09-23 13:38:51 -04:00

client_address.php

Resolve the client address through the trusted proxy list (#7658)

2026-08-29 17:52:12 -07:00

clog_webapi.php

deps: update Composer tooling and resolve PHPStan 2.3 diagnostics (#8357)

2026-10-16 08:49:23 -04:00

csp_report_endpoint.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

csrf.php

Replace csrf-magic with maintained CSRF protection (#7744)

2026-09-18 00:16:39 -04:00

data_query.php

security: consolidate verified GHSA fixes for develop (batch 4) (#8145)

2026-10-02 13:10:42 -04:00

database.php

feat(auth): log administrative account actions after confirmed writes (#8360)

2026-10-14 09:54:14 -04:00

dbparallel.php

fix: correct codespell-detected spelling errors in PHP source files (#6804)

2026-03-09 10:08:12 -04:00

dsdebug.php

fix(errors): remove dead E_STRICT and always-true constant guards (#7546)

2026-08-05 09:40:56 -04:00

dsstats.php

security: consolidate additional verified GHSA fixes for develop (batch 2) (#8065)

2026-09-24 10:06:01 -04:00

export.php

Fix Package Export (#6603)

2026-02-06 06:58:47 -05:00

functions.php

fix: Update the deepness favicon (#8419)

2026-10-18 11:51:18 -04:00

graph_template_input.php

security: restrict graph input fields across handoffs (CVE-2024-31458) (#7669)

2026-08-30 10:56:16 -07:00

graph_variables.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

graphs.php

Updating Copyrights to 2026 (#6578)

2026-01-28 16:11:10 -05:00

headers_secure.php

security: stage nonce CSP migration and gated enforcement (#7662)

2026-08-16 21:38:46 -04:00

html_filter.php

Legacy filter rendering: show only the classic inline filter (#8404)

2026-10-16 08:11:50 -04:00

html_form_template.php

security: restrict graph input fields across handoffs (CVE-2024-31458) (#7669)

2026-08-30 10:56:16 -07:00

html_form.php

fix(forms): encode form action URLs and configured attributes (#8437)

2026-10-20 13:18:37 -07:00

html_graph.php

Cross-filter Device and Graph Template on Preview and List views (#8363)

2026-10-14 13:21:22 -04:00

html_reports.php

security: consolidate verified GHSA fixes for develop (batch 4) (#8145)

2026-10-02 13:10:42 -04:00

html_tree.php

Scope the tree Graph Templates filter to the drilled Device Template (#8370)

2026-10-14 20:56:12 -04:00

html_utility.php

Add 'Deepness' dark emerald-green theme to develop (with billboard overload CSS) (#8206)

2026-10-07 14:16:56 -04:00

html_validate.php

feat(logging): emit structured security events for validation failures (#7605)

2026-08-10 13:08:28 -04:00

html.php

fix: Update the deepness favicon (#8419)

2026-10-18 11:51:18 -04:00

htmx.php

security: harden browser rendering and review CodeQL boundaries (#8298)

2026-10-11 21:26:38 -04:00

import.php

security: batch 7 develop - consolidate remaining develop-only GHSA advisories (12 fixes + 8 confirmations) (#8149)

2026-10-02 15:27:34 -04:00

index.php

Updating Copyrights to 2026 (#6578)

2026-01-28 16:11:10 -05:00

installer.php

fix(installer): preserve upgrade state and propagate failures (#8266)

2026-10-11 17:08:12 -04:00

ldap.php

Fix develop client behavior, popup isolation and PHP method visibility (#8292)

2026-10-11 21:15:39 -04:00

mib_cache.php

Port #8166 SNMP credential cache + procedural SNMPv3 (with #8171/#8172 follow-ups) to develop (#8174)

2026-10-05 10:18:41 -04:00

mib_parser.php

Fix develop client behavior, popup isolation and PHP method visibility (#8292)

2026-10-11 21:15:39 -04:00

package.php

security: consolidate verified GHSA fixes for develop (batch 4) (#8145)

2026-10-02 13:10:42 -04:00

PackageListFilter.php

hardening(rendering): enforce changed-file guardrails (#7255)

2026-07-07 18:00:59 -07:00

ping.php

Fix develop client behavior, popup isolation and PHP method visibility (#8292)

2026-10-11 21:15:39 -04:00

plugins.php

fix(plugins): [develop] restore lifecycle diagnostics, compatibility and error attribution (#8297)

2026-10-14 22:53:44 -04:00

poller.php

fix(poller): [develop] retain output until bounded storage batches succeed (#8332)

2026-10-12 15:41:53 -07:00

remote_agent_transport.php

Harden remote graph transport and response validation (#7631)

2026-08-11 08:16:48 -04:00

renderer.php

feat: consolidate htmx loader and renderer abstraction global.php includes (#7517)

2026-08-10 11:45:24 -04:00

reports.php

security: consolidate verified GHSA fixes for develop (batch 4) (#8145)

2026-10-02 13:10:42 -04:00

rrd_graph_axis.php

feat: expose RRDtool 1.11 graph axis controls (#8356)

2026-10-14 12:10:28 -04:00

rrd_graph_item.php

Validate graph item fields before they reach the RRDtool command line (#7655)

2026-08-16 21:35:44 -04:00

rrd.php

Render RRDtool Tune Info as balanced div boxes and POST the Data Source repair actions (#8412)

2026-10-16 11:23:07 -04:00

rrdcheck.php

Detect and repair RRDfile Data Source count mismatches via RRDtune (#8368)

2026-10-14 20:55:52 -04:00

snmp.php

Port #8166 SNMP credential cache + procedural SNMPv3 (with #8171/#8172 follow-ups) to develop (#8174)

2026-10-05 10:18:41 -04:00

snmpagent.php

security: consolidate verified GHSA-rjvj win32 cmd.exe hardening for develop (#8056)

2026-09-23 09:45:42 -04:00

sort.php

Updating Copyrights to 2026 (#6578)

2026-01-28 16:11:10 -05:00

spikekill.php

fix(spikekill): preserve valid reference samples during repair (#8427)

2026-10-19 09:32:59 -04:00

template.php

security: consolidate verified GHSA fixes for develop (batch 4) (#8145)

2026-10-02 13:10:42 -04:00

time.php

hardening: modernize string comparisons with PHP 8 functions (#6863) (#6864)

2026-03-23 13:08:45 -04:00

timespan_settings.php

security: consolidate verified GHSA fixes for develop (batch 4) (#8145)

2026-10-02 13:10:42 -04:00

utility.php

Fix dsstats partition dispatch and profile retention fallbacks (#8304)

2026-10-11 21:32:00 -04:00

variables.php

fix(graphs): [develop] clear empty query fields in rendered text (#8349)

2026-10-15 20:38:03 -04:00

vdef.php

Updating Copyrights to 2026 (#6578)

2026-01-28 16:11:10 -05:00

xml.php

Updating Copyrights to 2026 (#6578)

2026-01-28 16:11:10 -05:00