mirror of
https://github.com/Cacti/cacti.git
synced 2026-11-03 18:47:54 +09:00
f872184279
* cleanup: remove unreachable defensive error logs in aggregate graph item validation * fix: replace backtick operator with shell_exec() and escape args Replace deprecated backtick execution operator with shell_exec() in scripts/sql.php and scripts/ss_sql.php. Add escapeshellarg() to all interpolated database credentials to prevent shell injection. Handle null return from shell_exec() with null coalescing. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: verify sql scripts use shell_exec with escaped arguments Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * chore: drop unrelated lib/api_aggregate changes Keep PR scope focused on the issue for this branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: TheWitness <thewitness@cacti.net>
20 lines
433 B
PHP
Executable File
20 lines
433 B
PHP
Executable File
<?php
|
|
|
|
error_reporting(0);
|
|
|
|
include(__DIR__ . '/../include/cli_check.php');
|
|
|
|
global $database_hostname, $database_username, $database_password;
|
|
|
|
$cmd = 'mysqladmin -h ' . escapeshellarg($database_hostname) . ' -u ' . escapeshellarg($database_username);
|
|
|
|
if ($database_password != '') {
|
|
$cmd .= ' -p' . escapeshellarg($database_password);
|
|
}
|
|
|
|
$cmd .= " status | awk '{print \$6 }'";
|
|
|
|
$sql = shell_exec($cmd);
|
|
|
|
print trim($sql ?? '');
|