harden(mactrack): validate AJAX inputs and escape shell args in subprocess dispatch - #334

Merged

TheWitness merged 10 commits into

Cacti:developfrom

somethingwithproof:hardening/mactrack

Aug 31, 2026

Commits on Aug 31, 2026

harden(mactrack): escape extra_args tokens and capture passthru exit code
somethingwithproof
committed
2de3f68
harden(mactrack): validate request vars before AJAX shell dispatch; remove global clobber
somethingwithproof
committed
65c5d96
hardening(mactrack): cherry-pick prepared stmts and XSS fixes from #327
somethingwithproof
committed
c9b632a
test: add Pest v1 security test scaffold from #328
somethingwithproof
committed
8e9546c
fix(mactrack): address Copilot review on site_scan --web flag and error surfacing
somethingwithproof
committed
d756ec2
hardening(mactrack): escape drp_action output and parameterize row_id IN() deletes

authored and
somethingwithproof
committed
7c76670
hardening(mactrack): fix stored XSS and second-order SQLi in mactrack_devices.php

authored and
somethingwithproof
committed
e715d96
Apply project PHP formatting
somethingwithproof
committed
4edb6a2
fix: escape aggregated MAC confirm list fields
somethingwithproof
committed
198a76d
harden(mactrack): sanitize IP/MAC/port filter inputs on view pages
somethingwithproof
committed
2bbba21