Thomas VincentandTheWitness 769c59ec9e fix(forms): encode form action URLs and configured attributes (#8437) ...

* fix(forms): preserve action URLs in HTML and JavaScript

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* docs(changelog): record form action URL fix for issue 8438

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix(forms): encode configured form name and enctype attributes

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>

2026-10-20 13:18:37 -07:00

..

Core

Render RRDtool Tune Info as balanced div boxes and POST the Data Source repair actions (#8412)

2026-10-16 11:23:07 -04:00

Database

feat(auth): log administrative account actions after confirmed writes (#8360)

2026-10-14 09:54:14 -04:00

DataCollection

fix(boost): never re-stage poller output when boost_redirect is on (#8374)

2026-10-14 21:13:43 -04:00

Domain/Installation

feat(installer): add installation domain foundation (#7291)

2026-08-22 19:05:50 -07:00

fixtures

fix(security): [develop] require protected POSTs for administrative mutation endpoints (#8331)

2026-10-12 15:41:29 -07:00

Installer

fix(installer): preserve upgrade state and propagate failures (#8266)

2026-10-11 17:08:12 -04:00

Plugin

fix(plugins): [develop] restore lifecycle diagnostics, compatibility and error attribution (#8297)

2026-10-14 22:53:44 -04:00

Poller

Serialize process registry admission with portable locks (#7771)

2026-09-04 19:36:42 -07:00

Scripts

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

Security

Fix restrictive graph permission display for default-deny templates (#8422)

2026-10-18 10:39:20 -04:00

Snmp

fix: detect a failed SNMP walk by exit code, not by device data (#7929)

2026-09-02 16:36:43 -07:00

Ui

fix(forms): encode form action URLs and configured attributes (#8437)

2026-10-20 13:18:37 -07:00

AggregateSequenceSqliTest.php

chore: normalize CRLF line endings to LF across Cacti-owned files (#8156)

2026-10-02 17:22:42 -04:00

ApiDenyByDefaultTest.php

Refuse to serve the REST scaffold unless it is switched on (#7716)

2026-08-21 12:30:21 -07:00

ApiDeviceCloneRrdRemapGuardTest.php

security: bind device IDs and escape graph and device output (#7732)

2026-08-16 20:21:07 -04:00

AuthBruteForceHardeningTest.php

feat(auth): rename User Domains to Login Providers, add SAML2 and OpenID Connect (#8066)

2026-09-24 17:51:18 -04:00

AuthFailureLogFormatTest.php

Add fail2ban support for authentication failures (#7676)

2026-08-31 17:02:27 -04:00

AuthLoginRedirectValidationTest.php

Validate the post-login referer redirect (#7680)

2026-08-16 20:20:20 -04:00

AuthLogoutRevocationTest.php

Revoke server-side auth tokens on logout (#7677)

2026-08-16 21:22:49 -04:00

AuthRehashScopeTest.php

feat(auth): rename User Domains to Login Providers, add SAML2 and OpenID Connect (#8066)

2026-09-24 17:51:18 -04:00

AutomationSqlIdentifierTest.php

Confine names used as SQL identifiers in automation (#7701)

2026-08-29 17:53:44 -07:00

CactiFilesystemTest.php

Add DI-friendly CactiFilesystem and adopt atomic CLI writes (#7189)

2026-08-29 17:52:26 -07:00

CactiFormTest.php

Add a Cacti-native form API and migrate the Site editor (#7368)

2026-08-22 19:06:10 -07:00

CactiMd5FileFinderTest.php

Use a maintained finder for recursive MD5 discovery (#7718)

2026-08-31 17:07:36 -04:00

ConsolidatedFunctionalFixesTest.php

Device Template Ordering Issues (#8035)

2026-09-18 00:13:05 -04:00

CspReportEndpointTest.php

security: stage nonce CSP migration and gated enforcement (#7662)

2026-08-16 21:38:46 -04:00

CsrfGetDeleteTest.php

fix(csrf): require POST tokens for state-changing actions (#7991)

2026-09-12 15:09:25 -04:00

DbLikeEscapeTest.php

security: escape LIKE wildcards in poller_automation and plugins.php filters (#7670)

2026-08-16 21:15:44 -04:00

DsstatsPollerOutputBatchingTest.php

Harden RRDtool execution and data handoff (#7615)

2026-08-31 16:49:44 -04:00

DsstatsQueryEfficiencyTest.php

Harden RRDtool execution and data handoff (#7615)

2026-08-31 16:49:44 -04:00

DsstatsStatisticsQueryTest.php

Harden RRDtool execution and data handoff (#7615)

2026-08-31 16:49:44 -04:00

FunctionsSanitizeUriOffsetTest.php

Repair the string sanitisers in lib/functions.php (#7696)

2026-08-16 21:31:29 -04:00

GraphViewHostIdValidationTest.php

security: validate host_id before the graph_view filter WHERE clauses (GHSA-r7hc-hrpv-52gf) (#8100)

2026-09-29 10:25:12 -04:00

HeadersSecureTest.php

security: stage nonce CSP migration and gated enforcement (#7662)

2026-08-16 21:38:46 -04:00

HtmlGraphDeviceHardeningTest.php

security: bind device IDs and escape graph and device output (#7732)

2026-08-16 20:21:07 -04:00

I18nFallbackTranslateTest.php

fix(tests): restore paths and isolate test doubles (#7764)

2026-08-19 12:28:45 -07:00

ImportDataSourceItemValidationTest.php

security(import): validate Data Source item fields coming from Template XML (#7720)

2026-08-31 17:08:26 -04:00

IndexExternalLinkConfinementTest.php

Confine index.php external-link content includes (#7687)

2026-08-16 20:39:10 -04:00

InlineScriptDataEncodingTest.php

feat(rendering): add HTML, URL, and inline-data output helpers (#7252)

2026-08-22 17:15:06 -07:00

MibCacheSqlBindingTest.php

Bind the MIB column names in MibCache::select() (#7707)

2026-08-29 16:02:39 -07:00

PathContainmentTest.php

Fix plugin archive restore skipping not-yet-created nested directories (#8398)

2026-10-15 14:14:19 -04:00

Php8ZeroDivisorGuardTest.php

Fix confirmed poller, database, automation, and UI defects (#7861)

2026-09-01 21:01:28 -07:00

Php85DeprecationCompatibilityTest.php

fix(php85): remove test and authenticator deprecations (#7632)

2026-08-29 17:38:51 -07:00

PluginArchiveContainmentTest.php

Contain plugin archive writes and validate the repository URL (#7656)

2026-08-16 21:33:43 -04:00

PluginsFilterLikeSqliTest.php

security: escape LIKE wildcards in poller_automation and plugins.php filters (#7670)

2026-08-16 21:15:44 -04:00

PollerZeroDivisorGuardTest.php

Guard two divisions PHP 8 made fatal (#7697)

2026-08-16 21:04:12 -04:00

RrdAtomicWriteTest.php

Harden RRDtool execution and data handoff (#7615)

2026-08-31 16:49:44 -04:00

RrdcheckDataSourceFindingsTest.php

Detect and repair RRDfile Data Source count mismatches via RRDtune (#8368)

2026-10-14 20:55:52 -04:00

RrdCheckPathTest.php

security: confine rrd data source paths to the RRA directory (#7665)

2026-08-31 17:00:25 -04:00

RrdControlCharTest.php

security: strip control characters from rrdtool command line (#7663)

2026-08-16 21:26:06 -04:00

RrdDataSourceDiffTest.php

Detect and repair RRDfile Data Source count mismatches via RRDtune (#8368)

2026-10-14 20:55:52 -04:00

RrdGraphItemFieldContractTest.php

Validate graph item fields before they reach the RRDtool command line (#7655)

2026-08-16 21:35:44 -04:00

RrdGraphQueryEfficiencyTest.php

Harden RRDtool execution and data handoff (#7615)

2026-08-31 16:49:44 -04:00

RrdGraphSubstitutionSafetyTest.php

Harden RRDtool execution and data handoff (#7615)

2026-08-31 16:49:44 -04:00

RrdInterfaceSpeedQueryTest.php

Harden RRDtool execution and data handoff (#7615)

2026-08-31 16:49:44 -04:00

RrdMutationTransactionTest.php

Harden RRDtool execution and data handoff (#7615)

2026-08-31 16:49:44 -04:00

RrdProcessSafetyTest.php

fix: relaunch RRDtool after a crash instead of failing the rest of the run (#7927)

2026-09-02 13:22:32 -07:00

RrdProxyProtocolTest.php

Build releases from managed dependencies (#7888)

2026-09-01 23:11:49 -07:00

RrdResolutionStepQueryTest.php

Harden RRDtool execution and data handoff (#7615)

2026-08-31 16:49:44 -04:00

RrdtoolArgEscapeTest.php

Harden RRDtool execution and data handoff (#7615)

2026-08-31 16:49:44 -04:00

SessionLookupIndexTest.php

Add indexes for host-template and session lookups (#7634)

2026-08-26 16:16:26 -07:00

ShellEscapingContractTest.php

Harden RRDtool execution and data handoff (#7615)

2026-08-31 16:49:44 -04:00

SnmpPortIntCastTest.php

Force the SNMP port to an integer before the net-snmp command line (#7689)

2026-08-15 14:03:13 -07:00

SsrfRemoteCollectorTest.php

security: block loopback/link-local SSRF targets in call_remote_data_collector (#7672)

2026-08-16 21:16:55 -04:00

TemplateColumnSqliTest.php

security: restrict graph input fields across handoffs (CVE-2024-31458) (#7669)

2026-08-30 10:56:16 -07:00

TreeNodeIdorTest.php

security: enforce tree access in api_tree node create/delete/rename (IDOR) (#7674)

2026-08-16 20:36:45 -04:00