TheWitnessandci 9facd9b500 security: batch 7 develop - consolidate remaining develop-only GHSA advisories (12 fixes + 8 confirmations) (#8149) ...

* security: batch 7 develop - consolidate remaining develop-only GHSA advisories (12 fixes + 8 regression confirmations)

Fixes: f7jw (automation preview XSS), rp5g (db_column_exists LIKE), vx2m (automation pivot CASE WHEN), h5wg (plugin DDL identifiers), 929h (aggregate LIKE filter), mfw8 (add_graphs REGEXP), m49v (user_admin sort_column allowlist), mpfm (rrd error-image theme allowlist), m3fh (SNMPv3 control chars), cg45 (remember-me row revoke), xq26 (remember-me retention window), m67r (import xml_path containment).

Confirmed already fixed on develop, pinned with regression tests: 4gph, 977w, mgcq, 5p79, cfhh, wfcf, pjq5, wp33.

Excluded: 227p (1.2.x-only), mx5c (maintainer private branch).

* security: address batch-7 review feedback (lexical-first xml_path containment, session-wide sort allowlist, connection-aware db_column_exists quoting, reject-not-normalize plugin DDL identifiers, behavior-based test names)

* style: apply php-cs-fixer single-quote fix to api_automation pivot builders; add WSL dev-environment note to copilot instructions

* fix phpstan string typing

* test: refresh SQL interpolation baseline for db_column_exists db_qstr change (database.php 9->8)

---------

Co-authored-by: ci <ci@local>

2026-10-02 15:27:34 -04:00

..

.htaccess

Updating Copyrights to 2026 (#6578)

2026-01-28 16:11:10 -05:00

add_data_query.php

fix: replace strtolower/strtoupper with locale-independent wrappers (#6717)

2026-03-05 19:51:02 -05:00

add_datasource.php

refactor: replace strpos() boolean checks with str_contains/str_starts_with (#6645)

2026-02-25 11:38:59 -05:00

add_device.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

add_graph_template.php

refactor: replace strpos() boolean checks with str_contains/str_starts_with (#6645)

2026-02-25 11:38:59 -05:00

add_graphs.php

security: batch 7 develop - consolidate remaining develop-only GHSA advisories (12 fixes + 8 confirmations) (#8149)

2026-10-02 15:27:34 -04:00

add_group_perms.php

refactor: replace strpos() boolean checks with str_contains/str_starts_with (#6645)

2026-02-25 11:38:59 -05:00

add_group.php

refactor: replace strpos() boolean checks with str_contains/str_starts_with (#6645)

2026-02-25 11:38:59 -05:00

add_perms.php

refactor: replace strpos() boolean checks with str_contains/str_starts_with (#6645)

2026-02-25 11:38:59 -05:00

add_site.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

add_tree.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

analyze_database.php

refactor: replace strpos() boolean checks with str_contains/str_starts_with (#6645)

2026-02-25 11:38:59 -05:00

apply_automation_rules.php

refactor: replace strpos() boolean checks with str_contains/str_starts_with (#6645)

2026-02-25 11:38:59 -05:00

audit_database.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

audit_graph_template_inputs.php

security: restrict graph input fields across handoffs (CVE-2024-31458) (#7669)

2026-08-30 10:56:16 -07:00

batchgapfix.php

fix(poller): stop the registry pid probe narrowing a wide pid to -1 (#7956)

2026-09-12 15:24:27 -04:00

change_device.php

Break out of the --bulk_walk case in change_device.php (#7904)

2026-09-02 21:01:34 -07:00

clone_device_template.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

convert_tables.php

Make installer completion fail closed and add test coverage (#7626)

2026-08-31 16:59:49 -04:00

copy_user.php

fix: replace strtolower/strtoupper with locale-independent wrappers (#6717)

2026-03-05 19:51:02 -05:00

fetch_plugins.php

Updating Copyrights to 2026 (#6578)

2026-01-28 16:11:10 -05:00

fix_mediumint.php

fix: replace strtolower/strtoupper with locale-independent wrappers (#6717)

2026-03-05 19:51:02 -05:00

float_rrdfiles.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

genkey.php

feat(cli): add unified command frontend and normalize legacy failures (#7903)

2026-09-07 18:36:55 -07:00

genmanifest.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

host_update_template.php

fix: replace strtolower/strtoupper with locale-independent wrappers (#6717)

2026-03-05 19:51:02 -05:00

import_package.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

import_template.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

index.php

Updating Copyrights to 2026 (#6578)

2026-01-28 16:11:10 -05:00

input_whitelist.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

install_cacti.php

Make installer completion fail closed and add test coverage (#7626)

2026-08-31 16:59:49 -04:00

md5sum.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

migrate_poller.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

plugin_manage.php

Updating Copyrights to 2026 (#6578)

2026-01-28 16:11:10 -05:00

poller_data_sources_reapply_names.php

fix: replace strtolower/strtoupper with locale-independent wrappers (#6717)

2026-03-05 19:51:02 -05:00

poller_graphs_reapply_names.php

feat(cli): add unified command frontend and normalize legacy failures (#7903)

2026-09-07 18:36:55 -07:00

poller_output_empty.php

refactor: replace strpos() boolean checks with str_contains/str_starts_with (#6645)

2026-02-25 11:38:59 -05:00

poller_reindex_hosts.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

poller_replicate.php

refactor: replace strpos() boolean checks with str_contains/str_starts_with (#6645)

2026-02-25 11:38:59 -05:00

push_out_hosts.php

Updating Copyrights to 2026 (#6578)

2026-01-28 16:11:10 -05:00

rebuild_poller_cache.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

refresh_csrf.php

Replace csrf-magic with maintained CSRF protection (#7744)

2026-09-18 00:16:39 -04:00

remove_broken_graphs.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

remove_device.php

refactor: replace strpos() boolean checks with str_contains/str_starts_with (#6645)

2026-02-25 11:38:59 -05:00

remove_graphs.php

feat(cli): add unified command frontend and normalize legacy failures (#7903)

2026-09-07 18:36:55 -07:00

removespikes.php

feat(cli): add unified command frontend and normalize legacy failures (#7903)

2026-09-07 18:36:55 -07:00

reorder_data_query.php

fix: replace strtolower/strtoupper with locale-independent wrappers (#6717)

2026-03-05 19:51:02 -05:00

repair_database.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

repair_graphs.php

refactor: replace strpos() boolean checks with str_contains/str_starts_with (#6645)

2026-02-25 11:38:59 -05:00

repair_templates.php

refactor: replace strpos() boolean checks with str_contains/str_starts_with (#6645)

2026-02-25 11:38:59 -05:00

rrdresize.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

show_perms.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

splice_rrd.php

PHPStan Level 8 - Phase 1 Conversion (#8135)

2026-10-02 10:08:56 -04:00

sqltable_to_php.php

fix: correct grammar and spelling errors in English source strings (#6802)

2026-03-10 09:25:10 -04:00

structure_rra_paths.php

fix: replace strtolower/strtoupper with locale-independent wrappers (#6717)

2026-03-05 19:51:02 -05:00

update_heartbeat.php

fix(cli): escape RRDfile paths passed to the shell (#7609)

2026-08-08 11:31:09 -07:00

upgrade_database.php

fix: logic and security bugs in 1.3.0 upgrade scripts (#7161)

2026-05-16 12:59:59 -04:00

version.php

refactor: replace strpos() boolean checks with str_contains/str_starts_with (#6645)

2026-02-25 11:38:59 -05:00