hardening: prepared statements, PHP 7.4 idioms, and security fixes - #65
Open
somethingwithproof wants to merge 12 commits into
Open
hardening: prepared statements, PHP 7.4 idioms, and security fixes#65somethingwithproof wants to merge 12 commits into
somethingwithproof wants to merge 12 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR consolidates several security-hardening refactors across the WebSeer plugin, focusing on safer SQL construction, modernized PHP idioms, and reduced deserialization risk.
Changes:
- Escapes user-provided regex filter input in
list_urls()and refactors related SQL string building. - Updates form variable injection to use null coalescing in proxy edit flow.
- Hardens
unserialize()calls and converts contact upserts to prepared statements.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
webseer.php |
Escapes rfilter and refactors RLIKE filter SQL assembly in URL listing. |
webseer_proxies.php |
Uses null coalescing when passing optional $proxy data into inject_form_variables(). |
includes/functions.php |
Disables class instantiation during unserialize and switches contact lookup/upsert to prepared statements. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
somethingwithproof
force-pushed
the
hardening/comprehensive
branch
from
April 9, 2026 09:00
7bef544 to
2c90d56
Compare
This was referenced Apr 11, 2026
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
… equivalents Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
somethingwithproof
force-pushed
the
hardening/comprehensive
branch
from
July 14, 2026 10:47
7d5096a to
630e9e9
Compare
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
These form_selectable_cell values were rendered without html_escape: the monitored url (in both the href and the link body, on the URL list and the server list), the display name, and the peer-reported error shown as a cell title. The url and display name are admin-set and the error is derived from the checked service, so escape them on output like the sibling cells already do. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
… url scheme cURL followed redirects with no protocol restriction and forwarded target credentials across them, so a monitored site could redirect the poller to a non-http scheme or leak its credentials to a redirect target. Restrict redirects to http/https and stop forwarding auth across them. Also only render the monitored url as a link when it is http(s), so a javascript: url is shown as text. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
The urls, servers and proxies pages each hand-built the same rows, page, refresh, sort and state filter arrays before validate_store_request_vars, so the three copies had drifted (the servers log key kept a sess_weseer typo). Move the two filter sets into webseer_validate_list_request and webseer_validate_log_request in includes/functions.php; each page passes only its session key, sort default, refresh default and which optional filters apply. Session keys, including the existing typo, are preserved verbatim, so stored filters are unaffected. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Cacti core now requires PHP >= 8.2, so the 8.1 integration job fails the composer platform check; Ubuntu Noble also lacks libapache2-mod-php for non-native versions without the ondrej PPA. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
The integration CI runs php-cs-fixer as a gate; the consolidated validation helpers were missing @PARAM annotations and the cURL options needed the project's alignment. Formatting only, no behavior change. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidated hardening PR:
3 files changed, 19 insertions(+), 12 deletions(-)
All changes are mechanical transforms with zero behavioral impact. PHP 7.4+ compatible.