mirror of
https://github.com/Cacti/cacti.git
synced 2026-11-03 18:47:54 +09:00
f872184279
* cleanup: remove unreachable defensive error logs in aggregate graph item validation * fix: replace backtick operator with shell_exec() and escape args Replace deprecated backtick execution operator with shell_exec() in scripts/sql.php and scripts/ss_sql.php. Add escapeshellarg() to all interpolated database credentials to prevent shell injection. Handle null return from shell_exec() with null coalescing. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: verify sql scripts use shell_exec with escaped arguments Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * chore: drop unrelated lib/api_aggregate changes Keep PR scope focused on the issue for this branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: TheWitness <thewitness@cacti.net>
58 lines
2.4 KiB
PHP
58 lines
2.4 KiB
PHP
#!/usr/bin/env php
|
|
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
| |
|
|
| This program is free software; you can redistribute it and/or |
|
|
| modify it under the terms of the GNU General Public License |
|
|
| as published by the Free Software Foundation; either version 2 |
|
|
| of the License, or (at your option) any later version. |
|
|
| |
|
|
| This program is distributed in the hope that it will be useful, |
|
|
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
|
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
|
| GNU General Public License for more details. |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDtool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
| This code is designed, written, and maintained by the Cacti Group. See |
|
|
| about.php and/or the AUTHORS file for specific developer information. |
|
|
+-------------------------------------------------------------------------+
|
|
| http://www.cacti.net/ |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
error_reporting(0);
|
|
|
|
if (!isset($called_by_script_server)) {
|
|
include_once(__DIR__ . '/../include/cli_check.php');
|
|
|
|
print call_user_func('ss_sql');
|
|
}
|
|
|
|
function ss_sql() : string {
|
|
global $database_username;
|
|
global $database_password;
|
|
global $database_hostname;
|
|
|
|
$cmd = 'mysqladmin --host=' . escapeshellarg($database_hostname) . ' --user=' . escapeshellarg($database_username);
|
|
|
|
if ($database_password != '') {
|
|
$cmd .= ' --password=' . escapeshellarg($database_password);
|
|
}
|
|
|
|
$cmd .= ' status';
|
|
|
|
$result = shell_exec($cmd) ?? '';
|
|
|
|
$result = preg_replace('/: /', ':', $result);
|
|
$result = preg_replace('/ /', ' ', $result);
|
|
$result = preg_replace('/Slow queries/', 'SlowQueries', $result);
|
|
$result = preg_replace('/Open tables/', 'OpenTables', $result);
|
|
$result = preg_replace('/Queries per second avg/', 'QPS', $result);
|
|
$result = preg_replace('/Flush tables/', 'FlushTables', $result);
|
|
|
|
return trim($result);
|
|
}
|