hardening: prepared statements, PHP 7.4 idioms, and security fixes - #49
hardening: prepared statements, PHP 7.4 idioms, and security fixes#49somethingwithproof wants to merge 5 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR hardens the maint plugin’s UI and runtime schedule evaluation by modernizing a few PHP idioms, escaping user-controlled output in the schedules list, and adding a guard to prevent pathological recurring-schedule recalculation.
Changes:
- Replace
isset(...) ? ... : ...with??in the schedule edit form field values. - Escape schedule names passed into
form_checkbox_cell()in the schedules list. - Prevent an infinite loop in recurring schedule rollover when
minterval <= 0by returning early.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| maint.php | Uses ?? for form values and escapes schedule name in the schedules table checkbox label. |
| functions.php | Adds a minterval guard to prevent infinite looping when rolling recurring schedules forward. |
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Add targeted tests for prepared statement migration, output escaping, auth guard presence, CSRF token validation, redirect safety, and PHP 7.4 compatibility. Tests use source-scan patterns that verify security invariants without requiring the Cacti database. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
c71982b to
6cd5c54
Compare
log a warning when a recurring schedule has invalid minterval Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
|
Fixed the CI failure: unescaped quotes in tests/Security/RedirectSafetyTest.php:27 and AuthGuardTest.php:52 (single-quoted PHP string containing an unescaped |
Consolidated hardening PR:
PHP 7.4+ compatible. The minterval guard and the CI package fix are behavioral changes, not purely mechanical; everything else in this PR is a mechanical transform.