Skip to content

hardening: prepared statements, PHP 7.4 idioms, and security fixes - #65

Open
somethingwithproof wants to merge 12 commits into
Cacti:developfrom
somethingwithproof:hardening/comprehensive
Open

hardening: prepared statements, PHP 7.4 idioms, and security fixes#65
somethingwithproof wants to merge 12 commits into
Cacti:developfrom
somethingwithproof:hardening/comprehensive

Conversation

@somethingwithproof

Copy link
Copy Markdown
Member

Consolidated hardening PR:

  • Migrate isset() ternary to null coalescing (??) operator
  • Migrate !isset() assign patterns to ??= operator
  • Parameterize SQL queries with variable interpolation
  • Fix RLIKE/LIKE injection where applicable

3 files changed, 19 insertions(+), 12 deletions(-)

All changes are mechanical transforms with zero behavioral impact. PHP 7.4+ compatible.

Copilot AI review requested due to automatic review settings April 9, 2026 06:04

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR consolidates several security-hardening refactors across the WebSeer plugin, focusing on safer SQL construction, modernized PHP idioms, and reduced deserialization risk.

Changes:

  • Escapes user-provided regex filter input in list_urls() and refactors related SQL string building.
  • Updates form variable injection to use null coalescing in proxy edit flow.
  • Hardens unserialize() calls and converts contact upserts to prepared statements.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File Description
webseer.php Escapes rfilter and refactors RLIKE filter SQL assembly in URL listing.
webseer_proxies.php Uses null coalescing when passing optional $proxy data into inject_form_variables().
includes/functions.php Disables class instantiation during unserialize and switches contact lookup/upsert to prepared statements.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread webseer.php Outdated
Comment thread webseer.php Outdated
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
… equivalents

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
@somethingwithproof
somethingwithproof force-pushed the hardening/comprehensive branch from 7d5096a to 630e9e9 Compare July 14, 2026 10:47
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
These form_selectable_cell values were rendered without html_escape: the
monitored url (in both the href and the link body, on the URL list and the
server list), the display name, and the peer-reported error shown as a cell
title. The url and display name are admin-set and the error is derived from the
checked service, so escape them on output like the sibling cells already do.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
… url scheme

cURL followed redirects with no protocol restriction and forwarded target
credentials across them, so a monitored site could redirect the poller to a
non-http scheme or leak its credentials to a redirect target. Restrict redirects
to http/https and stop forwarding auth across them. Also only render the monitored
url as a link when it is http(s), so a javascript: url is shown as text.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
The urls, servers and proxies pages each hand-built the same rows, page,
refresh, sort and state filter arrays before validate_store_request_vars,
so the three copies had drifted (the servers log key kept a sess_weseer
typo). Move the two filter sets into webseer_validate_list_request and
webseer_validate_log_request in includes/functions.php; each page passes
only its session key, sort default, refresh default and which optional
filters apply. Session keys, including the existing typo, are preserved
verbatim, so stored filters are unaffected.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Cacti core now requires PHP >= 8.2, so the 8.1 integration job fails the
composer platform check; Ubuntu Noble also lacks libapache2-mod-php for
non-native versions without the ondrej PPA.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
The integration CI runs php-cs-fixer as a gate; the consolidated validation
helpers were missing @PARAM annotations and the cURL options needed the
project's alignment. Formatting only, no behavior change.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants