fix(security): consolidated hardening — SQL injection, XSS, unserialize, trigger_cmd#773

Open

somethingwithproof wants to merge 29 commits into

Cacti:developfrom

somethingwithproof:security/consolidated-hardening-20260516

Commits on May 17, 2026

fix(security): RLIKE injection, XSS, unserialize, and trigger_cmd hardening
somethingwithproof
committed
test: add Pest v1 security regression suite
somethingwithproof
committed
test(security): strengthen TriggerCmd and RlikeInjection coverage
somethingwithproof
committed
fix(security): replace raw SQL concatenation with prepared statements
somethingwithproof
committed
fix(security): wrap AJAX URL params with encodeURIComponent
somethingwithproof
committed
test(security): add encodeURIComponent regression tests for AJAX filters
somethingwithproof
committed
fix(compat): replace str_starts_with with strncmp for PHP 7.4
somethingwithproof
committed
fix(guard): cast drp_action valid-actions to strings for strict in_array
somethingwithproof
committed
fix(validation): add gfrv() calls for id and action fields in bulk handlers
somethingwithproof
committed
test(security): add PreparedStatementConsistencyTest from #769
somethingwithproof
committed
docs(api): document get_total_row_data third-arg contract at call sites
somethingwithproof
committed
fix(atomicity): wrap bulk notify-list writes in transactions
somethingwithproof
committed
fix(atomicity): rollback on db_execute_prepared failure in bulk handlers
somethingwithproof
committed
fix(atomicity): break on failure in loops; move template cascade after commit
somethingwithproof
committed
docs(changelog): document security hardening entries for develop
somethingwithproof
committed
fix(thold): quote PHP_BINARY in lint test, add putenv/bootstrap sync notes
somethingwithproof
committed
fix(thold): clarify RLIKE test assertions and document sql_params contract
somethingwithproof
committed
fix(test): use nowdoc for RLIKE vulnerable-pattern strings
somethingwithproof
committed
fix(test): replace nested-paren-hostile regex with substr_count; short-circuit delete block
somethingwithproof
committed

Commits on Jul 13, 2026

thold: remove eval() from RPN evaluator and escape trigger_cmd shell tags

Thomas Vincent
authored and
somethingwithproof
committed
thold: address automated review feedback (SQL quote consistency, exec env comments)

Thomas Vincent
authored and
somethingwithproof
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(security): consolidated hardening — SQL injection, XSS, unserialize, trigger_cmd#773

fix(security): consolidated hardening — SQL injection, XSS, unserialize, trigger_cmd#773
somethingwithproof wants to merge 29 commits into
Cacti:developfrom
somethingwithproof:security/consolidated-hardening-20260516

Commits on May 17, 2026

fix(security): RLIKE injection, XSS, unserialize, and trigger_cmd hardening

test: add Pest v1 security regression suite

test(security): strengthen TriggerCmd and RlikeInjection coverage

fix(security): replace raw SQL concatenation with prepared statements

fix(security): wrap AJAX URL params with encodeURIComponent

test(security): add encodeURIComponent regression tests for AJAX filters

fix(compat): replace str_starts_with with strncmp for PHP 7.4

fix(guard): cast drp_action valid-actions to strings for strict in_array

fix(validation): add gfrv() calls for id and action fields in bulk handlers

test(security): add PreparedStatementConsistencyTest from #769

docs(api): document get_total_row_data third-arg contract at call sites

fix(atomicity): wrap bulk notify-list writes in transactions

fix(atomicity): rollback on db_execute_prepared failure in bulk handlers

fix(atomicity): break on failure in loops; move template cascade after commit

docs(changelog): document security hardening entries for develop

fix(thold): quote PHP_BINARY in lint test, add putenv/bootstrap sync notes

fix(thold): clarify RLIKE test assertions and document sql_params contract

fix(test): use nowdoc for RLIKE vulnerable-pattern strings

fix(test): replace nested-paren-hostile regex with substr_count; short-circuit delete block

Commits on Jul 13, 2026

thold: remove eval() from RPN evaluator and escape trigger_cmd shell tags

thold: address automated review feedback (SQL quote consistency, exec env comments)

Commits on Jul 14, 2026

Merge branch 'develop' into security/consolidated-hardening-20260516

Fix Thold RPN evaluator formatting

Fix Thold CI dependencies and formatting

security: prepare notification queue bulk deletes

chore: drop accidental thold_functions.php whitespace from CI PR

fix: restore nested selected_graphs_array deserialize

Revert "chore: drop accidental thold_functions.php whitespace from CI PR"

style: format unserialize hardening test