fix(security): consolidated hardening — SQL injection, XSS, unserialize, trigger_cmd#773

Open

somethingwithproof wants to merge 19 commits into

Cacti:developfrom

somethingwithproof:security/consolidated-hardening-20260516

Commits on May 17, 2026

fix(security): RLIKE injection, XSS, unserialize, and trigger_cmd hardening
somethingwithproof
committed
test: add Pest v1 security regression suite
somethingwithproof
committed
test(security): strengthen TriggerCmd and RlikeInjection coverage
somethingwithproof
committed
fix(security): replace raw SQL concatenation with prepared statements
somethingwithproof
committed
fix(security): wrap AJAX URL params with encodeURIComponent
somethingwithproof
committed
test(security): add encodeURIComponent regression tests for AJAX filters
somethingwithproof
committed
fix(compat): replace str_starts_with with strncmp for PHP 7.4
somethingwithproof
committed
fix(guard): cast drp_action valid-actions to strings for strict in_array
somethingwithproof
committed
fix(validation): add gfrv() calls for id and action fields in bulk handlers
somethingwithproof
committed
test(security): add PreparedStatementConsistencyTest from #769
somethingwithproof
committed
docs(api): document get_total_row_data third-arg contract at call sites
somethingwithproof
committed
fix(atomicity): wrap bulk notify-list writes in transactions
somethingwithproof
committed
fix(atomicity): rollback on db_execute_prepared failure in bulk handlers
somethingwithproof
committed
fix(atomicity): break on failure in loops; move template cascade after commit
somethingwithproof
committed
docs(changelog): document security hardening entries for develop
somethingwithproof
committed
fix(thold): quote PHP_BINARY in lint test, add putenv/bootstrap sync notes
somethingwithproof
committed
fix(thold): clarify RLIKE test assertions and document sql_params contract
somethingwithproof
committed
fix(test): use nowdoc for RLIKE vulnerable-pattern strings
somethingwithproof
committed
fix(test): replace nested-paren-hostile regex with substr_count; short-circuit delete block
somethingwithproof
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(security): consolidated hardening — SQL injection, XSS, unserialize, trigger_cmd#773

fix(security): consolidated hardening — SQL injection, XSS, unserialize, trigger_cmd#773
somethingwithproof wants to merge 19 commits into
Cacti:developfrom
somethingwithproof:security/consolidated-hardening-20260516

Commits on May 17, 2026

fix(security): RLIKE injection, XSS, unserialize, and trigger_cmd hardening

test: add Pest v1 security regression suite

test(security): strengthen TriggerCmd and RlikeInjection coverage

fix(security): replace raw SQL concatenation with prepared statements

fix(security): wrap AJAX URL params with encodeURIComponent

test(security): add encodeURIComponent regression tests for AJAX filters

fix(compat): replace str_starts_with with strncmp for PHP 7.4

fix(guard): cast drp_action valid-actions to strings for strict in_array

fix(validation): add gfrv() calls for id and action fields in bulk handlers

test(security): add PreparedStatementConsistencyTest from #769

docs(api): document get_total_row_data third-arg contract at call sites

fix(atomicity): wrap bulk notify-list writes in transactions

fix(atomicity): rollback on db_execute_prepared failure in bulk handlers

fix(atomicity): break on failure in loops; move template cascade after commit

docs(changelog): document security hardening entries for develop

fix(thold): quote PHP_BINARY in lint test, add putenv/bootstrap sync notes

fix(thold): clarify RLIKE test assertions and document sql_params contract

fix(test): use nowdoc for RLIKE vulnerable-pattern strings

fix(test): replace nested-paren-hostile regex with substr_count; short-circuit delete block