mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-28 15:47:39 +09:00
TheWitness
7b551eea72
Excludes vendored packages, third-party JS, patches, and the Win32 probe fixture. Pure EOL change; guards pass and php -l is clean.
21 lines
878 B
PHP
21 lines
878 B
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
/*
|
|
* GHSA-m6wx-f538-m6q3: path_boost_log went through settings.php's generic
|
|
* is_valid_pathname() branch instead of the hard .log extension whitelist
|
|
* applied to path_cactilog/path_stderrlog, re-enabling the log-poisoning-to-RCE
|
|
* primitive (point the Boost Debug Log at a .php file under the webroot).
|
|
*/
|
|
|
|
$root = dirname(__DIR__, 4);
|
|
$source = file_get_contents($root . '/settings.php');
|
|
|
|
test('path_boost_log is covered by the .log extension whitelist', function () use ($source) {
|
|
expect($source)->toContain("\$field_name == 'path_cactilog' || \$field_name == 'path_stderrlog' || \$field_name == 'path_boost_log'");
|
|
});
|