Files
cacti/scripts
Thomas VincentandCopilot 78e4644f9f fix: harden data collection scripts — SQL injection, counter math, column allow-listing (#6651)
* cleanup: remove unreachable defensive error logs in aggregate graph item validation

* fix: harden data collection scripts with correct SNMP retry parameter

Replace $host['ping_retries'] with $host['snmp_retries'] across all
SNMP data collection scripts. Add column allow-lists for MikroTik
scripts to prevent SQL injection via column name interpolation.

Add Pest tests verifying column allow-lists reject injection attempts
and all scripts reference snmp_retries instead of ping_retries.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix: consolidate disk device detection with preg_match

Replace 8 str_starts_with() calls with a single preg_match() in
ss_net_snmp_disk_io.php for readability. Align ss_net_snmp_disk_bytes.php
with the same device prefixes (xvd, vd, hd, md, dm-) and improved
nvme-aware partition filter.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* chore: drop unrelated lib/api_aggregate changes

Keep PR scope focused on the issue for this branch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-05 20:09:08 -05:00
..
2026-01-28 16:11:10 -05:00
2026-01-28 16:11:10 -05:00
2018-09-07 06:08:36 -05:00
2018-09-07 06:08:36 -05:00
2018-09-07 06:08:36 -05:00