security: harden SQL, output escaping, and unserialize paths - #773

Open

somethingwithproof wants to merge 42 commits into

Cacti:developfrom

somethingwithproof:security/consolidated-hardening-20260516

Commits on Aug 17, 2026

fix(security): RLIKE injection, XSS, unserialize, and trigger_cmd hardening
somethingwithproof
committed
484cdbb
test: add Pest v1 security regression suite
somethingwithproof
committed
eb9487b
test(security): strengthen TriggerCmd and RlikeInjection coverage
somethingwithproof
committed
850e05d
fix(security): replace raw SQL concatenation with prepared statements
somethingwithproof
committed
8b97adc
fix(security): wrap AJAX URL params with encodeURIComponent
somethingwithproof
committed
a57493f
test(security): add encodeURIComponent regression tests for AJAX filters
somethingwithproof
committed
4922fff
fix(compat): replace str_starts_with with strncmp for PHP 7.4
somethingwithproof
committed
8903631
fix(guard): cast drp_action valid-actions to strings for strict in_array
somethingwithproof
committed
e13f1a7
fix(validation): add gfrv() calls for id and action fields in bulk handlers
somethingwithproof
committed
c9035b2
test(security): add PreparedStatementConsistencyTest from #769
somethingwithproof
committed
62de01c
docs(api): document get_total_row_data third-arg contract at call sites
somethingwithproof
committed
a24496a
fix(atomicity): wrap bulk notify-list writes in transactions
somethingwithproof
committed
570b37b
fix(atomicity): rollback on db_execute_prepared failure in bulk handlers
somethingwithproof
committed
0095f22
fix(atomicity): break on failure in loops; move template cascade after commit
somethingwithproof
committed
913124c
docs(changelog): document security hardening entries for develop
somethingwithproof
committed
025dc6f
fix(thold): quote PHP_BINARY in lint test, add putenv/bootstrap sync notes
somethingwithproof
committed
0185bcb
fix(thold): clarify RLIKE test assertions and document sql_params contract
somethingwithproof
committed
b5d0677
fix(test): use nowdoc for RLIKE vulnerable-pattern strings
somethingwithproof
committed
6187ead
fix(test): replace nested-paren-hostile regex with substr_count; short-circuit delete block
somethingwithproof
committed
61ad805
thold: remove eval() from RPN evaluator and escape trigger_cmd shell tags

Thomas Vincent
authored and
somethingwithproof
committed
be3c392
thold: address automated review feedback (SQL quote consistency, exec env comments)

Thomas Vincent
authored and
somethingwithproof
committed
969418d
Fix Thold RPN evaluator formatting
somethingwithproof
committed
dc0e351
Fix Thold CI dependencies and formatting
somethingwithproof
committed
d200dfc
security: prepare notification queue bulk deletes
somethingwithproof
committed
c2ac1a0
fix: restore nested selected_graphs_array deserialize
somethingwithproof
committed
6d661ff
style: format unserialize hardening test
somethingwithproof
committed
45c7e44
test: replace source-grep assertions with behavioural tests
somethingwithproof
committed
72d17b6
fix(thold): abandon RPN expressions that have no usable result
somethingwithproof
committed
e8da977
fix(security): prefer Cacti's RLIKE quoting helper for the name filter
somethingwithproof
committed
0d83fb6
fix(notify_lists): repair the bulk actions, which never ran
somethingwithproof
committed
ed90d65
docs(changelog): record the hardening and the bugs it uncovered
somethingwithproof
committed
8c98930
test: cover the trigger command paths and the optional core branches
somethingwithproof
committed
3b839ad
fix(thold): log the result of an inline trigger command
somethingwithproof
committed
c23120d
ci: leave the Apache PHP package change to its own pull request
somethingwithproof
committed
a1a8a6c
fix(thold): quote substituted values before the trigger command is assembled
somethingwithproof
committed
4601159
test: move the Cacti library fixture out of an ignored path
somethingwithproof
committed
e1315a6
style: apply the project php-cs-fixer configuration
somethingwithproof
committed
97d18b4
test: follow Cacti's test layout and composer scripts
somethingwithproof
committed
fe41340
test: keep optional-core coverage in Pest process order
somethingwithproof
committed
9fb2072
ci: keep plugin PR integration checks on pinned Cacti
somethingwithproof
committed
8fd4be7
ci: bound package index refreshes
somethingwithproof
committed
52a8d98

Commits on Aug 22, 2026

Merge remote-tracking branch 'upstream/develop' into security/consolidated-hardening-20260516
somethingwithproof
committed
71ecdce