admin/cacti

0 Fork 0

mirror of https://github.com/Cacti/cacti.git synced 2026-11-03 10:37:46 +09:00

Files

T

History

2b4140e646 fix: use get_client_addr() in API instead of raw REMOTE_ADDR (#6716 )

* cleanup: remove unreachable defensive error logs in aggregate graph item validation

* fix: use get_client_addr() instead of raw REMOTE_ADDR in API

$_SERVER['REMOTE_ADDR'] bypasses proxy header validation,
IP filtering, and logging that get_client_addr() provides.
This matters when Cacti sits behind a reverse proxy.

Add Pest tests for get_client_addr() covering proxy header
handling, IPv6, invalid IPs, and config-driven header filtering.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* chore: drop unrelated lib/api_aggregate changes

Keep PR scope focused on the issue for this branch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: TheWitness <thewitness@cacti.net>

2026-03-05 19:52:05 -05:00

include

Fix #6539 - Allow Standard Cacti Log Files to be Rotated on Demand,PHPdoc, and Typing (#6540 )

2026-01-25 10:13:56 -05:00

public

fix: use get_client_addr() in API instead of raw REMOTE_ADDR (#6716 )

2026-03-05 19:52:05 -05:00

composer.json

Cacti Restuful API V0.1 (#6310 )

2025-09-11 13:06:45 -04:00

index.php

QA: Updates for files for php-cs-fixer and some php-doc changes

2025-11-18 21:01:15 -05:00

README.md

docs: fix typos and grammar in api, locales, and service READMEs (#6690 )

2026-03-02 08:57:28 -05:00

README.md

Cacti RESTful Slim API

This project provides a RESTful API for accessing Cacti monitoring data using the Slim PHP framework.

Overview

The API exposes endpoints to retrieve information about hosts, host templates, poller status, graph lists, Cacti status, boost status, database connectivity, and plugin thresholds. All responses are in JSON format.

This API is not production ready.

To run the API for development:

php -S 127.0.0.1:8080 -t public public/index.php

For production, this should be served by a proper web server (Apache, Nginx, etc.).

API Versioning

The API uses URL path versioning. All endpoints are prefixed with a version number:

/v1/ - Current stable version

Endpoints

GET /
Returns a welcome message.

Version 1 (v1) Endpoints

Info Endpoints

GET /v1/info/hosts
Returns a list of hosts.
Allowed query parameters:
- host_id
- poller_id
- site_id
- template_id
- status
GET /v1/info/host_templates
Returns host template information. Accepts template_id as a query parameter.
GET /v1/info/graph_list
Returns a list of graphs. Accepts host_id as a query parameter.

Status Endpoints

GET /v1/status/poller_status
Returns poller status. Accepts poller_id as a query parameter.
GET /v1/status/cacti_status
Returns the status of the Cacti system.
GET /v1/status/boost_status
Returns the status of the Cacti Boost system.
GET /v1/status/api_db_ping
Checks database connectivity.
GET /v1/status/cacti_db_status Returns metrics for the main Cacti database.

Plugin Endpoints

GET /v1/plugin/thold/thresholds
Returns threshold information from the thold plugin.
GET /v1/plugin/thold/status
Returns threshold status information.

Usage

Install dependencies with Composer.
Configure your web server to serve the public/ directory.
Access the API endpoints as described above using the versioned URLs (e.g., /v1/info/hosts).

Requirements

PHP 8.1 or higher
Composer
Cacti database and configuration

TODO

Import Cacti base db_functions
Logging
Authentication/Authorization
Rate limiting
API documentation (OpenAPI/Swagger)