backport: hardening and bugfixes for main stable by somethingwithproof · Pull Request #283 · Cacti/plugin_syslog

somethingwithproof · 2026-03-12T00:30:41Z

Consolidated backport of security and bugfix PRs.

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Though it's not complete. This should reduce the number of warnings.

Currently translated at 33.8% (126 of 372 strings) Co-authored-by: Anatoliy <hamrad99h2@gmail.com> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ru/ Translation: Cacti/syslog

Updated by "Squash Git commits" hook in Weblate. Translation: Cacti/syslog Translate-URL: http://translate.cacti.net/projects/cacti/syslog/

This changes cleans up some logging as well.

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Refs Cacti#273 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Refs Cacti#280 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

- LICENSE: remove stale conflict markers - database.php: restore backward-compat optional param on syslog_db_fetch_insert_id - js/functions.js: fix missing var declaration, #test->#term, prop('disabled'), remove empty .each() - CI workflow: authenticate MySQL healthcheck, remove password echo - populate script: INSERT -> REPLACE INTO for idempotent reruns - README.md: fix malformed code fence - locales: add exit after redirect, fix sed -i for macOS compat - es-ES.po: fix 'Cactus' -> 'Cacti', 'Depuraración' -> 'Depuración' Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Refs Cacti#281 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

…cti#294)

TheWitness

A few comments here.

TheWitness · 2026-03-18T12:43:13Z

.github/agents/triage_agent.md.agent.md

Is the naming correct on this file. It looks very redundant.

TheWitness · 2026-03-18T12:45:36Z

locales/index.php


-header("Location:../index.php");
+header('Location:../index.php');



Take it out as the script exit's anyway after the location. Same in the other pull requests.

- LICENSE: remove stale conflict markers - database.php: restore backward-compat optional param on syslog_db_fetch_insert_id - js/functions.js: fix missing var declaration, #test->#term, prop('disabled'), remove empty .each() - CI workflow: authenticate MySQL healthcheck, remove password echo - populate script: INSERT -> REPLACE INTO for idempotent reruns - README.md: fix malformed code fence - locales: add exit after redirect, fix sed -i for macOS compat - es-ES.po: fix 'Cactus' -> 'Cacti', 'Depuraración' -> 'Depuración' Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

somethingwithproof · 2026-03-18T22:44:29Z

Yes -- working on all four items now.

- Remove $uniqueID filter from syslog_remove query (incorrectly filtered removal rules by random batch marker) - Reorder CI workflow: lint/PHPStan before integration tests - Switch echo to print in syslog_batch_transfer.php Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix: trim xml import payload value before emptiness check Refs Cacti#272 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(i18n): correct zh-CN.po format string errors Fix fullwidth percent signs and missing format specifiers. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* refactor: deduplicate selected-item bulk action dispatch Refs Cacti#279 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(i18n): correct zh-CN.po format string errors Fix fullwidth percent signs and missing format specifiers. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

TheWitness · 2026-03-19T01:39:29Z

We should do this at release time I think. Just to minimize commits into this branch.

- LICENSE: remove stale conflict markers - database.php: restore backward-compat optional param on syslog_db_fetch_insert_id - js/functions.js: fix missing var declaration, #test->#term, prop('disabled'), remove empty .each() - CI workflow: authenticate MySQL healthcheck, remove password echo - populate script: INSERT -> REPLACE INTO for idempotent reruns - README.md: fix malformed code fence - locales: add exit after redirect, fix sed -i for macOS compat - es-ES.po: fix 'Cactus' -> 'Cacti', 'Depuraración' -> 'Depuración' Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

- Remove $uniqueID filter from syslog_remove query (incorrectly filtered removal rules by random batch marker) - Reorder CI workflow: lint/PHPStan before integration tests - Switch echo to print in syslog_batch_transfer.php Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

- LICENSE: remove stale conflict markers - database.php: restore backward-compat optional param on syslog_db_fetch_insert_id - js/functions.js: fix missing var declaration, #test->#term, prop('disabled'), remove empty .each() - CI workflow: authenticate MySQL healthcheck, remove password echo - populate script: INSERT -> REPLACE INTO for idempotent reruns - README.md: fix malformed code fence - locales: add exit after redirect, fix sed -i for macOS compat - es-ES.po: fix 'Cactus' -> 'Cacti', 'Depuraración' -> 'Depuración' Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

- Remove $uniqueID filter from syslog_remove query (incorrectly filtered removal rules by random batch marker) - Reorder CI workflow: lint/PHPStan before integration tests - Switch echo to print in syslog_batch_transfer.php Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

- LICENSE: remove stale conflict markers - database.php: restore backward-compat optional param on syslog_db_fetch_insert_id - js/functions.js: fix missing var declaration, #test->#term, prop('disabled'), remove empty .each() - CI workflow: authenticate MySQL healthcheck, remove password echo - populate script: INSERT -> REPLACE INTO for idempotent reruns - README.md: fix malformed code fence - locales: add exit after redirect, fix sed -i for macOS compat - es-ES.po: fix 'Cactus' -> 'Cacti', 'Depuraración' -> 'Depuración' Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

- Remove $uniqueID filter from syslog_remove query (incorrectly filtered removal rules by random batch marker) - Reorder CI workflow: lint/PHPStan before integration tests - Switch echo to print in syslog_batch_transfer.php Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

somethingwithproof · 2026-03-20T01:22:39Z

Makes sense. Will hold this until release time to keep the main branch stable.

weblate and others added 30 commits March 19, 2022 09:45

Update translation files

0b91321

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

97265a4

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

f70eba1

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

c1148eb

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

8e23732

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

a6a4959

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

0784876

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

cfb3dc6

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

cdfe99e

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

d52b107

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

b19d897

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

2ce9d3c

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translations

a7b6bd7

More updates for reporting to be conforming to Format CSS specification

7a6f3bb

Don't use syslog.css if using a format css file.

8f55100

Changes to support 'level'. Not fully QA'd

d88654c

Replacement of MultiSelectFilter with private implementation

a97f3d8

Add a placeholder

527ad26

Commit missed database.php changes and query error for remote syslog

cecc1ca

QA: Missed the setup.php changes.

5948d8b

Resolving Cacti#172

feb8042

Though it's not complete. This should reduce the number of warnings.

Another minor update to Cacti#172

cb00018

Fixing Issue Cacti#160

c04d75f

Fixing Issue Cacti#151 - Executables executing

e5fbf2c

ChangeLog Update only.

61bfbc8

Translated using Weblate (Russian)

2b81b79

Currently translated at 33.8% (126 of 372 strings) Co-authored-by: Anatoliy <hamrad99h2@gmail.com> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ru/ Translation: Cacti/syslog

Update translation files

01674f0

Updated by "Squash Git commits" hook in Weblate. Translation: Cacti/syslog Translate-URL: http://translate.cacti.net/projects/cacti/syslog/

Fixing Issue Cacti#108 Add Body Text to Alerts

33bfc41

This changes cleans up some logging as well.

Update translation file

7e6e093

Update translation files

20701f1

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

somethingwithproof and others added 3 commits March 16, 2026 12:01

fix: use strict MariaDB detection in install advisor (Cacti#273)

960186e

Refs Cacti#273 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

refactor: centralize XML import payload loading (Cacti#280)

4aceb63

Refs Cacti#280 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

typos (Cacti#282)

41bd748

somethingwithproof force-pushed the backport/main-hardening-v2 branch from a482d04 to bf55698 Compare March 16, 2026 16:43

somethingwithproof added 5 commits March 16, 2026 13:12

refactor: extract duplicated alert command execution paths (Cacti#281)

9f6715d

Refs Cacti#281 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Locales: Fix zh-TW full-width percent sign syntax errors (Cacti#292)

baf13dc

Locales: Fix ja-JP System Logs copy-paste error (Cacti#293)

d4fe834

Locales: Cleanup Portuguese (PT and BR) and resolve fuzzy strings (Ca…

d694387

…cti#294)

Locales: Resolve fuzzy strings in Russian and Turkish (Cacti#295)

9166406

TheWitness requested changes Mar 18, 2026

View reviewed changes

somethingwithproof force-pushed the backport/main-hardening-v2 branch from bf55698 to da87864 Compare March 18, 2026 19:12

somethingwithproof added 2 commits March 18, 2026 21:25

somethingwithproof added 4 commits March 19, 2026 09:32

backport: consolidated security hardening and bugfixes for main

720de73

test: add Pest unit tests for XML import payload helper

9eecf4a

somethingwithproof force-pushed the backport/main-hardening-v2 branch from b1f3b8c to c5f4153 Compare March 19, 2026 17:19

somethingwithproof marked this pull request as draft March 20, 2026 10:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

backport: hardening and bugfixes for main stable#283

backport: hardening and bugfixes for main stable#283
somethingwithproof wants to merge 508 commits intoCacti:mainfrom
somethingwithproof:backport/main-hardening-v2

somethingwithproof commented Mar 12, 2026

Uh oh!

TheWitness left a comment

Uh oh!

TheWitness Mar 18, 2026

Uh oh!

TheWitness Mar 18, 2026

Uh oh!

somethingwithproof commented Mar 18, 2026

Uh oh!

TheWitness commented Mar 19, 2026

Uh oh!

somethingwithproof commented Mar 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants


		header("Location:../index.php");
		header('Location:../index.php');

Conversation

somethingwithproof commented Mar 12, 2026

Uh oh!

TheWitness left a comment

Choose a reason for hiding this comment

Uh oh!

TheWitness Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

TheWitness Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

somethingwithproof commented Mar 18, 2026

Uh oh!

TheWitness commented Mar 19, 2026

Uh oh!

somethingwithproof commented Mar 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants