From ea17cc9f947d54a79a0897eeb35e47083fa9cf36 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Tue, 10 Mar 2026 13:51:15 -0700 Subject: [PATCH 01/13] hardening: enforce POST+CSRF for purge syslog devices utility Refs #259 Signed-off-by: Thomas Vincent --- setup.php | 64 ++++++++++- tests/regression/issue259_csrf_purge_test.php | 106 ++++++++++++++++++ 2 files changed, 169 insertions(+), 1 deletion(-) create mode 100644 tests/regression/issue259_csrf_purge_test.php diff --git a/setup.php b/setup.php index 46d0333..0f35667 100644 --- a/setup.php +++ b/setup.php @@ -1608,6 +1608,25 @@ function syslog_utilities_action($action) { } if ($action == 'purge_syslog_hosts') { + if ($_SERVER['REQUEST_METHOD'] !== 'POST') { + raise_message('syslog_error', __('Invalid request. This action requires a CSRF protected POST.', 'syslog'), MESSAGE_LEVEL_ERROR); + header('Location: utilities.php'); + exit; + } + + if (function_exists('csrf_check')) { + if (!csrf_check(false)) { + raise_message('syslog_error', __('Invalid request. This action requires a CSRF protected POST.', 'syslog'), MESSAGE_LEVEL_ERROR); + header('Location: utilities.php'); + exit; + } + } else { + cacti_log('WARNING: syslog purge blocked -- CSRF validation unavailable', false, 'SYSLOG'); + raise_message('syslog_error', __('Invalid request. Please try again.', 'syslog'), MESSAGE_LEVEL_ERROR); + header('Location: utilities.php'); + exit; + } + $records = 0; syslog_db_execute('DELETE FROM syslog_hosts @@ -1660,7 +1679,50 @@ function syslog_utilities_list() { - + '> + + diff --git a/tests/regression/issue259_csrf_purge_test.php b/tests/regression/issue259_csrf_purge_test.php new file mode 100644 index 0000000..54bdac2 --- /dev/null +++ b/tests/regression/issue259_csrf_purge_test.php @@ -0,0 +1,106 @@ + breakout in HTML script context +if (strpos($setup, 'JSON_HEX_TAG') === false) { + fwrite(STDERR, "json_encode() must use JSON_HEX_TAG to prevent script-context breakout.\n"); + exit(1); +} + +if (strpos($setup, 'JSON_HEX_AMP') === false) { + fwrite(STDERR, "json_encode() must use JSON_HEX_AMP to escape ampersands in script context.\n"); + exit(1); +} + +if (strpos($setup, 'JSON_HEX_APOS') === false) { + fwrite(STDERR, "json_encode() must use JSON_HEX_APOS.\n"); + exit(1); +} + +if (strpos($setup, 'JSON_HEX_QUOT') === false) { + fwrite(STDERR, "json_encode() must use JSON_HEX_QUOT.\n"); + exit(1); +} + +// Verify user-facing message does not expose CSRF internals (log message may use "CSRF") +if (strpos($setup, "raise_message('syslog_error', __('CSRF") !== false) { + fwrite(STDERR, "User-facing raise_message must not expose CSRF internals to end users.\n"); + exit(1); +} + +// Verify generic user-facing message is present +if (strpos($setup, "Invalid request. Please try again.") === false) { + fwrite(STDERR, "Fail-closed branch must use generic 'Invalid request. Please try again.' message.\n"); + exit(1); +} + +// Verify fail-closed raise_message uses MESSAGE_LEVEL_ERROR severity +if (strpos($setup, "raise_message('syslog_error', __('Invalid request. Please try again.', 'syslog'), MESSAGE_LEVEL_ERROR)") === false) { + fwrite(STDERR, "Fail-closed branch raise_message must use MESSAGE_LEVEL_ERROR severity.\n"); + exit(1); +} + +// Verify log message does not expose internal function name +if (strpos($setup, 'csrf_check() unavailable') !== false) { + fwrite(STDERR, "Log message must not name internal validation function.\n"); + exit(1); +} + +echo "issue259_csrf_purge_test passed\n"; From c734b5d28d28f65a0f6d1dc76e655b1e029c833b Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Sat, 11 Apr 2026 03:59:17 -0700 Subject: [PATCH 02/13] fix(csrf): distinct error codes, audit log on non-POST, honest lint header - Distinct raise_message IDs per failure mode (syslog_method_error, syslog_csrf_error, syslog_csrf_unavailable) so log triage can differentiate non-POST, invalid token, and missing-helper paths - Add cacti_log entry on the non-POST rejection path so the audit trail is symmetric with the other two fail-closed branches - Document csrf_check($fatal=false) arg semantics inline so future readers see the helper contract - Rename the regression test comment block to call out explicitly that it is a source-scan lint, not a behavioral test; flag follow-up for real behavioral coverage once a DB-backed test harness exists Signed-off-by: Thomas Vincent --- setup.php | 11 +++++++--- tests/regression/issue259_csrf_purge_test.php | 20 ++++++++++++++++--- 2 files changed, 25 insertions(+), 6 deletions(-) diff --git a/setup.php b/setup.php index 0f35667..66e7ed6 100644 --- a/setup.php +++ b/setup.php @@ -1609,20 +1609,25 @@ function syslog_utilities_action($action) { if ($action == 'purge_syslog_hosts') { if ($_SERVER['REQUEST_METHOD'] !== 'POST') { - raise_message('syslog_error', __('Invalid request. This action requires a CSRF protected POST.', 'syslog'), MESSAGE_LEVEL_ERROR); + cacti_log('WARNING: syslog purge blocked -- non-POST request', false, 'SYSLOG'); + raise_message('syslog_method_error', __('Invalid request. This action requires a CSRF protected POST.', 'syslog'), MESSAGE_LEVEL_ERROR); header('Location: utilities.php'); exit; } + // csrf_check($fatal) returns bool; $fatal=false tells the helper not to + // die/exit on failure so we can log and redirect with a user-visible + // message ourselves. if (function_exists('csrf_check')) { if (!csrf_check(false)) { - raise_message('syslog_error', __('Invalid request. This action requires a CSRF protected POST.', 'syslog'), MESSAGE_LEVEL_ERROR); + cacti_log('WARNING: syslog purge blocked -- CSRF token validation failed', false, 'SYSLOG'); + raise_message('syslog_csrf_error', __('Invalid request. This action requires a CSRF protected POST.', 'syslog'), MESSAGE_LEVEL_ERROR); header('Location: utilities.php'); exit; } } else { cacti_log('WARNING: syslog purge blocked -- CSRF validation unavailable', false, 'SYSLOG'); - raise_message('syslog_error', __('Invalid request. Please try again.', 'syslog'), MESSAGE_LEVEL_ERROR); + raise_message('syslog_csrf_unavailable', __('Invalid request. Please try again.', 'syslog'), MESSAGE_LEVEL_ERROR); header('Location: utilities.php'); exit; } diff --git a/tests/regression/issue259_csrf_purge_test.php b/tests/regression/issue259_csrf_purge_test.php index 54bdac2..dbcaa46 100644 --- a/tests/regression/issue259_csrf_purge_test.php +++ b/tests/regression/issue259_csrf_purge_test.php @@ -1,4 +1,18 @@ Date: Sat, 11 Apr 2026 13:37:45 -0700 Subject: [PATCH 03/13] fix(security): harden syslog bulk form and nav encoding --- syslog.php | 10 ++-- syslog_alerts.php | 4 +- syslog_removal.php | 4 +- syslog_reports.php | 4 +- ...sue279_bulk_form_and_nav_encoding_test.php | 58 +++++++++++++++++++ 5 files changed, 69 insertions(+), 11 deletions(-) create mode 100644 tests/regression/issue279_bulk_form_and_nav_encoding_test.php diff --git a/syslog.php b/syslog.php index 0d1c45c..02c397a 100644 --- a/syslog.php +++ b/syslog.php @@ -1184,11 +1184,11 @@ function syslog_filter($sql_where, $tab) { ?> - + $save_html "; @@ -856,7 +856,7 @@ function syslog_alerts() { 'user' => [__('By User', 'syslog'), 'DESC'] ]; - $nav = html_nav_bar('syslog_alerts.php?filter=' . get_request_var('filter'), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Alerts', 'syslog'), 'page', 'main'); + $nav = html_nav_bar('syslog_alerts.php?filter=' . rawurlencode(get_request_var('filter')), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Alerts', 'syslog'), 'page', 'main'); form_start('syslog_alerts.php', 'chk'); diff --git a/syslog_removal.php b/syslog_removal.php index e047e68..b8768b5 100644 --- a/syslog_removal.php +++ b/syslog_removal.php @@ -234,7 +234,7 @@ function form_actions() { - + $save_html "; @@ -667,7 +667,7 @@ function syslog_removal() { form_start('syslog_removal.php', 'chk'); - $nav = html_nav_bar('syslog_removal.php?filter=' . get_request_var('filter'), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Rules', 'syslog'), 'page', 'main'); + $nav = html_nav_bar('syslog_removal.php?filter=' . rawurlencode(get_request_var('filter')), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Rules', 'syslog'), 'page', 'main'); print $nav; diff --git a/syslog_reports.php b/syslog_reports.php index fd7b212..ecf2ef1 100644 --- a/syslog_reports.php +++ b/syslog_reports.php @@ -206,7 +206,7 @@ function form_actions() { - + $save_html \n"; @@ -704,7 +704,7 @@ function syslog_report() { 'user' => [__('By User', 'syslog'), 'DESC'] ]; - $nav = html_nav_bar('syslog_reports.php?filter=' . get_request_var('filter'), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Reports', 'syslog'), 'page', 'main'); + $nav = html_nav_bar('syslog_reports.php?filter=' . rawurlencode(get_request_var('filter')), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Reports', 'syslog'), 'page', 'main'); form_start('syslog_reports.php', 'chk'); diff --git a/tests/regression/issue279_bulk_form_and_nav_encoding_test.php b/tests/regression/issue279_bulk_form_and_nav_encoding_test.php new file mode 100644 index 0000000..5af309f --- /dev/null +++ b/tests/regression/issue279_bulk_form_and_nav_encoding_test.php @@ -0,0 +1,58 @@ + file_get_contents(__DIR__ . '/../../syslog_removal.php'), + 'syslog_alerts.php' => file_get_contents(__DIR__ . '/../../syslog_alerts.php'), + 'syslog_reports.php' => file_get_contents(__DIR__ . '/../../syslog_reports.php'), + 'syslog.php' => file_get_contents(__DIR__ . '/../../syslog.php'), +); + +foreach ($targets as $file => $contents) { + if ($contents === false) { + fwrite(STDERR, "Unable to read $file\n"); + exit(1); + } +} + +foreach (array('syslog_removal.php', 'syslog_alerts.php', 'syslog_reports.php') as $file) { + if (strpos($targets[$file], "html_escape(get_request_var('drp_action'))") === false) { + fwrite(STDERR, "Expected escaped drp_action hidden field in $file\n"); + exit(1); + } + + if (strpos($targets[$file], "rawurlencode(get_request_var('filter'))") === false) { + fwrite(STDERR, "Expected URL-encoded filter nav value in $file\n"); + exit(1); + } + + if (strpos($targets[$file], "") !== false) { + fwrite(STDERR, "Legacy raw drp_action hidden field remains in $file\n"); + exit(1); + } +} + +$syslog = $targets['syslog.php']; + +if (strpos($syslog, "pageTab: ,") === false) { + fwrite(STDERR, "Expected JSON-encoded syslog pageTab value\n"); + exit(1); +} + +foreach (array( + "json_encode(__('Enter a search term', 'syslog'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT)", + "json_encode(__('Select Device(s)', 'syslog'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT)", + "json_encode(__('Devices Selected', 'syslog'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT)", + "json_encode(__('All Devices Selected', 'syslog'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT)", +) as $needle) { + if (strpos($syslog, $needle) === false) { + fwrite(STDERR, "Expected JS-safe initSyslogMain text encoding\n"); + exit(1); + } +} + +if (strpos($syslog, "pageTab: ''") !== false) { + fwrite(STDERR, "Legacy raw pageTab JS assignment still present\n"); + exit(1); +} + +echo "OK\n"; From 18f7f45a6599c38bfef8ccc3e2816a17e9844430 Mon Sep 17 00:00:00 2001 From: TheWitness Date: Thu, 4 Jun 2026 11:56:33 -0400 Subject: [PATCH 04/13] Update syslog_alerts.php --- syslog_alerts.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/syslog_alerts.php b/syslog_alerts.php index b97f8c9..4e155dd 100644 --- a/syslog_alerts.php +++ b/syslog_alerts.php @@ -856,7 +856,7 @@ function syslog_alerts() { 'user' => [__('By User', 'syslog'), 'DESC'] ]; - $nav = html_nav_bar('syslog_alerts.php?filter=' . rawurlencode(get_request_var('filter')), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Alerts', 'syslog'), 'page', 'main'); + $nav = html_nav_bar('syslog_alerts.php', MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Alerts', 'syslog'), 'page', 'main'); form_start('syslog_alerts.php', 'chk'); From 8fb02494cfc1407dfcb3bf4f38aa1445b2df8737 Mon Sep 17 00:00:00 2001 From: TheWitness Date: Thu, 4 Jun 2026 11:59:10 -0400 Subject: [PATCH 05/13] Refactor navigation bar URL in syslog_removal.php --- syslog_removal.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/syslog_removal.php b/syslog_removal.php index b8768b5..15ff88e 100644 --- a/syslog_removal.php +++ b/syslog_removal.php @@ -667,7 +667,7 @@ function syslog_removal() { form_start('syslog_removal.php', 'chk'); - $nav = html_nav_bar('syslog_removal.php?filter=' . rawurlencode(get_request_var('filter')), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Rules', 'syslog'), 'page', 'main'); + $nav = html_nav_bar('syslog_removal.php', MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Rules', 'syslog'), 'page', 'main'); print $nav; From 4292f094e859339d8bba1325e6519d71782da73b Mon Sep 17 00:00:00 2001 From: TheWitness Date: Thu, 4 Jun 2026 11:59:50 -0400 Subject: [PATCH 06/13] Fix navigation bar URL in syslog_reports.php --- syslog_reports.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/syslog_reports.php b/syslog_reports.php index ecf2ef1..f51e3f9 100644 --- a/syslog_reports.php +++ b/syslog_reports.php @@ -704,7 +704,7 @@ function syslog_report() { 'user' => [__('By User', 'syslog'), 'DESC'] ]; - $nav = html_nav_bar('syslog_reports.php?filter=' . rawurlencode(get_request_var('filter')), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Reports', 'syslog'), 'page', 'main'); + $nav = html_nav_bar('syslog_reports.php', MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Reports', 'syslog'), 'page', 'main'); form_start('syslog_reports.php', 'chk'); From 24471608ffdf66cc2aae2d682b6f7c9e7a7cd347 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Mon, 13 Jul 2026 20:14:19 -0700 Subject: [PATCH 07/13] Address Syslog purge security review --- functions.php | 4 ++++ setup.php | 4 ++-- syslog.php | 10 +++++----- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/functions.php b/functions.php index 1e54c13..2a147b7 100644 --- a/functions.php +++ b/functions.php @@ -47,6 +47,10 @@ function syslog_include_js() { Date: Mon, 13 Jul 2026 20:18:14 -0700 Subject: [PATCH 08/13] Preserve Syslog filter navigation safely --- syslog_alerts.php | 2 +- syslog_removal.php | 2 +- syslog_reports.php | 2 +- .../issue279_bulk_form_and_nav_encoding_test.php | 10 +++++----- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/syslog_alerts.php b/syslog_alerts.php index 4e155dd..b97f8c9 100644 --- a/syslog_alerts.php +++ b/syslog_alerts.php @@ -856,7 +856,7 @@ function syslog_alerts() { 'user' => [__('By User', 'syslog'), 'DESC'] ]; - $nav = html_nav_bar('syslog_alerts.php', MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Alerts', 'syslog'), 'page', 'main'); + $nav = html_nav_bar('syslog_alerts.php?filter=' . rawurlencode(get_request_var('filter')), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Alerts', 'syslog'), 'page', 'main'); form_start('syslog_alerts.php', 'chk'); diff --git a/syslog_removal.php b/syslog_removal.php index 15ff88e..b8768b5 100644 --- a/syslog_removal.php +++ b/syslog_removal.php @@ -667,7 +667,7 @@ function syslog_removal() { form_start('syslog_removal.php', 'chk'); - $nav = html_nav_bar('syslog_removal.php', MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Rules', 'syslog'), 'page', 'main'); + $nav = html_nav_bar('syslog_removal.php?filter=' . rawurlencode(get_request_var('filter')), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Rules', 'syslog'), 'page', 'main'); print $nav; diff --git a/syslog_reports.php b/syslog_reports.php index f51e3f9..ecf2ef1 100644 --- a/syslog_reports.php +++ b/syslog_reports.php @@ -704,7 +704,7 @@ function syslog_report() { 'user' => [__('By User', 'syslog'), 'DESC'] ]; - $nav = html_nav_bar('syslog_reports.php', MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Reports', 'syslog'), 'page', 'main'); + $nav = html_nav_bar('syslog_reports.php?filter=' . rawurlencode(get_request_var('filter')), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Reports', 'syslog'), 'page', 'main'); form_start('syslog_reports.php', 'chk'); diff --git a/tests/regression/issue279_bulk_form_and_nav_encoding_test.php b/tests/regression/issue279_bulk_form_and_nav_encoding_test.php index 5af309f..63f8e23 100644 --- a/tests/regression/issue279_bulk_form_and_nav_encoding_test.php +++ b/tests/regression/issue279_bulk_form_and_nav_encoding_test.php @@ -33,16 +33,16 @@ $syslog = $targets['syslog.php']; -if (strpos($syslog, "pageTab: ,") === false) { +if (strpos($syslog, "pageTab: ,") === false) { fwrite(STDERR, "Expected JSON-encoded syslog pageTab value\n"); exit(1); } foreach (array( - "json_encode(__('Enter a search term', 'syslog'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT)", - "json_encode(__('Select Device(s)', 'syslog'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT)", - "json_encode(__('Devices Selected', 'syslog'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT)", - "json_encode(__('All Devices Selected', 'syslog'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT)", + "syslog_json_encode_for_script(__('Enter a search term', 'syslog'))", + "syslog_json_encode_for_script(__('Select Device(s)', 'syslog'))", + "syslog_json_encode_for_script(__('Devices Selected', 'syslog'))", + "syslog_json_encode_for_script(__('All Devices Selected', 'syslog'))", ) as $needle) { if (strpos($syslog, $needle) === false) { fwrite(STDERR, "Expected JS-safe initSyslogMain text encoding\n"); From 7575a9f4268331b184c29b9f9a76483e9f7e9f9d Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Mon, 13 Jul 2026 22:04:27 -0700 Subject: [PATCH 09/13] Strengthen Syslog CSRF regression coverage --- tests/regression/issue259_csrf_purge_test.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/regression/issue259_csrf_purge_test.php b/tests/regression/issue259_csrf_purge_test.php index dbcaa46..b2d30c0 100644 --- a/tests/regression/issue259_csrf_purge_test.php +++ b/tests/regression/issue259_csrf_purge_test.php @@ -94,7 +94,7 @@ } // Verify user-facing messages do not expose CSRF internals (log messages may use "CSRF") -if (preg_match("/raise_message\\('syslog_[a-z_]*', __\\('CSRF/", $setup)) { +if (preg_match('/raise_message\\s*\\(\\s*[^,]+,\\s*__\\(\\s*([\'\"])[^\'\"]*CSRF[^\'\"]*\\1/si', $setup)) { fwrite(STDERR, "User-facing raise_message must not expose CSRF internals to end users.\n"); exit(1); } From e49592ae604fe76c595803c96271b37e994ae3ab Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Tue, 14 Jul 2026 02:36:00 -0700 Subject: [PATCH 10/13] Use runner PHP without versioned Apache package --- .github/workflows/plugin-ci-workflow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml index 86237dc..3840fa2 100644 --- a/.github/workflows/plugin-ci-workflow.yml +++ b/.github/workflows/plugin-ci-workflow.yml @@ -143,7 +143,7 @@ jobs: run: sudo apt-get update - name: Install System Dependencies - run: sudo apt-get install -y apache2 snmp snmpd rrdtool fping libapache2-mod-php${{ matrix.php }} + run: sudo apt-get install -y apache2 snmp snmpd rrdtool fping - name: Start SNMPD Agent and Test run: | From 09d019793e70e436e7718b0f851606f20d9e4751 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Wed, 29 Jul 2026 17:51:34 -0700 Subject: [PATCH 11/13] refactor: reuse syslog JSON script encoder --- setup.php | 6 ++--- tests/regression/issue259_csrf_purge_test.php | 25 ++++++++++++------- 2 files changed, 19 insertions(+), 12 deletions(-) diff --git a/setup.php b/setup.php index f31eeba..38197cb 100644 --- a/setup.php +++ b/setup.php @@ -1692,21 +1692,21 @@ function syslog_utilities_list() { $(function() { $('#syslog_purge_hosts').on('click', function() { $('#syslog_purge_dialog').dialog({ - title: , + title: , minHeight: 80, minWidth: 400, resizable: false, draggable: true, buttons: { 'Cancel': { - text: , + text: , id: 'btnPurgeCancel', click: function() { $(this).dialog('close'); } }, 'Continue': { - text: , + text: , id: 'btnPurgeContinue', click: function() { $(this).dialog('close'); diff --git a/tests/regression/issue259_csrf_purge_test.php b/tests/regression/issue259_csrf_purge_test.php index b2d30c0..9d459d8 100644 --- a/tests/regression/issue259_csrf_purge_test.php +++ b/tests/regression/issue259_csrf_purge_test.php @@ -14,10 +14,11 @@ * real behavioral coverage once a DB-backed test harness exists. */ -$setup = file_get_contents(dirname(__DIR__, 2) . '/setup.php'); +$setup = file_get_contents(dirname(__DIR__, 2) . '/setup.php'); +$functions = file_get_contents(dirname(__DIR__, 2) . '/functions.php'); -if ($setup === false) { - fwrite(STDERR, "Failed to read setup.php\n"); +if ($setup === false || $functions === false) { + fwrite(STDERR, "Failed to read setup.php or functions.php\n"); exit(1); } @@ -67,28 +68,34 @@ exit(1); } -if (strpos($setup, 'json_encode(__(') === false) { - fwrite(STDERR, "Expected json_encode(__(...)) for JS-safe encoding of confirm message.\n"); +if (strpos($setup, "syslog_json_encode_for_script(__('Confirm Purge', 'syslog'))") === false) { + fwrite(STDERR, "Expected syslog_json_encode_for_script() for JS-safe dialog title encoding.\n"); + exit(1); +} + +if (strpos($setup, "syslog_json_encode_for_script(__('Cancel', 'syslog'))") === false || + strpos($setup, "syslog_json_encode_for_script(__('Continue', 'syslog'))") === false) { + fwrite(STDERR, "Expected syslog_json_encode_for_script() for JS-safe button text encoding.\n"); exit(1); } // Verify json_encode uses JSON_HEX_TAG to prevent breakout in HTML script context -if (strpos($setup, 'JSON_HEX_TAG') === false) { +if (strpos($functions, 'JSON_HEX_TAG') === false) { fwrite(STDERR, "json_encode() must use JSON_HEX_TAG to prevent script-context breakout.\n"); exit(1); } -if (strpos($setup, 'JSON_HEX_AMP') === false) { +if (strpos($functions, 'JSON_HEX_AMP') === false) { fwrite(STDERR, "json_encode() must use JSON_HEX_AMP to escape ampersands in script context.\n"); exit(1); } -if (strpos($setup, 'JSON_HEX_APOS') === false) { +if (strpos($functions, 'JSON_HEX_APOS') === false) { fwrite(STDERR, "json_encode() must use JSON_HEX_APOS.\n"); exit(1); } -if (strpos($setup, 'JSON_HEX_QUOT') === false) { +if (strpos($functions, 'JSON_HEX_QUOT') === false) { fwrite(STDERR, "json_encode() must use JSON_HEX_QUOT.\n"); exit(1); } From c64f592a019feedfc7c232fcc549c2cb93d10d7e Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Sun, 16 Aug 2026 23:17:31 -0700 Subject: [PATCH 12/13] ci: repair the integration workflow Three defects, all failing open or failing at setup: - the plugin syntax check redirected find's own output rather than php's, so PHP errors never reached the grep testing for them; the step could not fail - MYSQL_AUTH_USR carried a literal tilde, because parameter expansion happens after tilde expansion, so MySQL was handed a path it could not resolve - the Cacti checkout took the default branch, which is 1.3 in development and whose CLI installer currently fatals with an undefined __() plugin_syslog additionally installed libapache2-mod-php${{ matrix.php }}, which Ubuntu does not package, so apt exited 100 before Cacti was reached. Verified with actionlint, which is clean on the result. Signed-off-by: Thomas Vincent --- .github/workflows/plugin-ci-workflow.yml | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml index 86237dc..265b555 100644 --- a/.github/workflows/plugin-ci-workflow.yml +++ b/.github/workflows/plugin-ci-workflow.yml @@ -40,6 +40,7 @@ jobs: uses: actions/checkout@v4 with: repository: Cacti/cacti + ref: release/1.2.31 path: cacti - name: Checkout Syslog Plugin @@ -57,7 +58,7 @@ jobs: - name: Check PHP Syntax (Lint) run: | cd cacti/plugins/syslog - if find . -name '*.php' -not -path './vendor/*' -exec php -l {} 2>&1 \; | grep -iv 'no syntax errors detected'; then + if find . -name '*.php' -not -path './vendor/*' -exec php -l {} \; 2>&1 | grep -iv 'no syntax errors detected'; then echo "Syntax errors found!" exit 1 fi @@ -122,6 +123,7 @@ jobs: uses: actions/checkout@v4 with: repository: Cacti/cacti + ref: release/1.2.31 path: cacti - name: Checkout Syslog Plugin @@ -143,7 +145,7 @@ jobs: run: sudo apt-get update - name: Install System Dependencies - run: sudo apt-get install -y apache2 snmp snmpd rrdtool fping libapache2-mod-php${{ matrix.php }} + run: sudo apt-get install -y apache2 snmp snmpd rrdtool fping libapache2-mod-php - name: Start SNMPD Agent and Test run: | @@ -163,16 +165,15 @@ jobs: echo -e "[client]\nuser = root\npassword = cactiroot\nhost = 127.0.0.1\n" > ~/.my.cnf - name: Initialize Cacti Database - env: - MYSQL_AUTH_USR: '--defaults-file=~/.my.cnf' run: | - mysql $MYSQL_AUTH_USR -e 'CREATE DATABASE IF NOT EXISTS cacti;' - mysql $MYSQL_AUTH_USR -e "CREATE USER IF NOT EXISTS 'cactiuser'@'localhost' IDENTIFIED BY 'cactiuser';" - mysql $MYSQL_AUTH_USR -e "GRANT ALL PRIVILEGES ON cacti.* TO 'cactiuser'@'localhost';" - mysql $MYSQL_AUTH_USR -e "GRANT SELECT ON mysql.time_zone_name TO 'cactiuser'@'localhost';" - mysql $MYSQL_AUTH_USR -e "FLUSH PRIVILEGES;" - mysql $MYSQL_AUTH_USR cacti < ${{ github.workspace }}/cacti/cacti.sql - mysql $MYSQL_AUTH_USR -e "INSERT INTO settings (name, value) VALUES ('path_php_binary', '/usr/bin/php')" cacti + MYSQL_AUTH_USR="--defaults-file=$HOME/.my.cnf" + mysql "$MYSQL_AUTH_USR" -e 'CREATE DATABASE IF NOT EXISTS cacti;' + mysql "$MYSQL_AUTH_USR" -e "CREATE USER IF NOT EXISTS 'cactiuser'@'localhost' IDENTIFIED BY 'cactiuser';" + mysql "$MYSQL_AUTH_USR" -e "GRANT ALL PRIVILEGES ON cacti.* TO 'cactiuser'@'localhost';" + mysql "$MYSQL_AUTH_USR" -e "GRANT SELECT ON mysql.time_zone_name TO 'cactiuser'@'localhost';" + mysql "$MYSQL_AUTH_USR" -e "FLUSH PRIVILEGES;" + mysql "$MYSQL_AUTH_USR" cacti < ${{ github.workspace }}/cacti/cacti.sql + mysql "$MYSQL_AUTH_USR" -e "INSERT INTO settings (name, value) VALUES ('path_php_binary', '/usr/bin/php')" cacti - name: Validate composer files run: | From a96cba23bd26382b22ce785ccac693f2683a800f Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Mon, 17 Aug 2026 00:25:32 -0700 Subject: [PATCH 13/13] Modernize CSRF hardening for PHP 8.0 --- functions.php | 4 +-- setup.php | 22 ++++++------ tests/regression/issue259_csrf_purge_test.php | 36 +++++++++---------- ...sue279_bulk_form_and_nav_encoding_test.php | 22 ++++++------ 4 files changed, 42 insertions(+), 42 deletions(-) diff --git a/functions.php b/functions.php index 2a147b7..d39c435 100644 --- a/functions.php +++ b/functions.php @@ -47,8 +47,8 @@ function syslog_include_js() { breakout in HTML script context -if (strpos($functions, 'JSON_HEX_TAG') === false) { +if (!str_contains($functions, 'JSON_HEX_TAG')) { fwrite(STDERR, "json_encode() must use JSON_HEX_TAG to prevent script-context breakout.\n"); exit(1); } -if (strpos($functions, 'JSON_HEX_AMP') === false) { +if (!str_contains($functions, 'JSON_HEX_AMP')) { fwrite(STDERR, "json_encode() must use JSON_HEX_AMP to escape ampersands in script context.\n"); exit(1); } -if (strpos($functions, 'JSON_HEX_APOS') === false) { +if (!str_contains($functions, 'JSON_HEX_APOS')) { fwrite(STDERR, "json_encode() must use JSON_HEX_APOS.\n"); exit(1); } -if (strpos($functions, 'JSON_HEX_QUOT') === false) { +if (!str_contains($functions, 'JSON_HEX_QUOT')) { fwrite(STDERR, "json_encode() must use JSON_HEX_QUOT.\n"); exit(1); } @@ -107,19 +107,19 @@ } // Verify generic user-facing message is present -if (strpos($setup, "Invalid request. Please try again.") === false) { +if (!str_contains($setup, 'Invalid request. Please try again.')) { fwrite(STDERR, "Fail-closed branch must use generic 'Invalid request. Please try again.' message.\n"); exit(1); } // Verify fail-closed raise_message uses MESSAGE_LEVEL_ERROR severity -if (strpos($setup, "raise_message('syslog_csrf_unavailable', __('Invalid request. Please try again.', 'syslog'), MESSAGE_LEVEL_ERROR)") === false) { +if (!str_contains($setup, "raise_message('syslog_csrf_unavailable', __('Invalid request. Please try again.', 'syslog'), MESSAGE_LEVEL_ERROR)")) { fwrite(STDERR, "Fail-closed branch raise_message must use MESSAGE_LEVEL_ERROR severity.\n"); exit(1); } // Verify log message does not expose internal function name -if (strpos($setup, 'csrf_check() unavailable') !== false) { +if (str_contains($setup, 'csrf_check() unavailable')) { fwrite(STDERR, "Log message must not name internal validation function.\n"); exit(1); } diff --git a/tests/regression/issue279_bulk_form_and_nav_encoding_test.php b/tests/regression/issue279_bulk_form_and_nav_encoding_test.php index 63f8e23..48f533c 100644 --- a/tests/regression/issue279_bulk_form_and_nav_encoding_test.php +++ b/tests/regression/issue279_bulk_form_and_nav_encoding_test.php @@ -1,11 +1,11 @@ file_get_contents(__DIR__ . '/../../syslog_removal.php'), 'syslog_alerts.php' => file_get_contents(__DIR__ . '/../../syslog_alerts.php'), 'syslog_reports.php' => file_get_contents(__DIR__ . '/../../syslog_reports.php'), 'syslog.php' => file_get_contents(__DIR__ . '/../../syslog.php'), -); +]; foreach ($targets as $file => $contents) { if ($contents === false) { @@ -14,18 +14,18 @@ } } -foreach (array('syslog_removal.php', 'syslog_alerts.php', 'syslog_reports.php') as $file) { - if (strpos($targets[$file], "html_escape(get_request_var('drp_action'))") === false) { +foreach (['syslog_removal.php', 'syslog_alerts.php', 'syslog_reports.php'] as $file) { + if (!str_contains($targets[$file], "html_escape(get_request_var('drp_action'))")) { fwrite(STDERR, "Expected escaped drp_action hidden field in $file\n"); exit(1); } - if (strpos($targets[$file], "rawurlencode(get_request_var('filter'))") === false) { + if (!str_contains($targets[$file], "rawurlencode(get_request_var('filter'))")) { fwrite(STDERR, "Expected URL-encoded filter nav value in $file\n"); exit(1); } - if (strpos($targets[$file], "") !== false) { + if (str_contains($targets[$file], "")) { fwrite(STDERR, "Legacy raw drp_action hidden field remains in $file\n"); exit(1); } @@ -33,24 +33,24 @@ $syslog = $targets['syslog.php']; -if (strpos($syslog, "pageTab: ,") === false) { +if (!str_contains($syslog, "pageTab: ,")) { fwrite(STDERR, "Expected JSON-encoded syslog pageTab value\n"); exit(1); } -foreach (array( +foreach ([ "syslog_json_encode_for_script(__('Enter a search term', 'syslog'))", "syslog_json_encode_for_script(__('Select Device(s)', 'syslog'))", "syslog_json_encode_for_script(__('Devices Selected', 'syslog'))", "syslog_json_encode_for_script(__('All Devices Selected', 'syslog'))", -) as $needle) { - if (strpos($syslog, $needle) === false) { +] as $needle) { + if (!str_contains($syslog, $needle)) { fwrite(STDERR, "Expected JS-safe initSyslogMain text encoding\n"); exit(1); } } -if (strpos($syslog, "pageTab: ''") !== false) { +if (str_contains($syslog, "pageTab: ''")) { fwrite(STDERR, "Legacy raw pageTab JS assignment still present\n"); exit(1); }