[packages/cacti] Up to 1.2.31
arekm
arekm at pld-linux.org
Wed Oct 14 21:54:05 CEST 2026
commit 64d619a6dd8a49284f77e40f4b280235b1e61a20
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Wed Oct 14 21:51:32 2026 +0200
Up to 1.2.31
Fixes CVE-2026-39894, CVE-2026-40082, CVE-2026-40941, CVE-2026-39897,
CVE-2026-39900, CVE-2026-46531, CVE-2026-44481, CVE-2026-39952,
CVE-2026-39893, CVE-2026-22802, CVE-2026-40080, CVE-2026-40078,
CVE-2026-39949, CVE-2026-40081, CVE-2026-39948, CVE-2026-39902,
CVE-2026-39898, CVE-2026-41884, CVE-2026-39955, CVE-2026-39896,
CVE-2026-39950, CVE-2026-40083, CVE-2026-40084, CVE-2026-39951,
CVE-2026-39899, CVE-2026-39938, CVE-2026-39939, CVE-2026-39947,
CVE-2026-39895, CVE-2026-40079, CVE-2026-40194, CVE-2026-32935,
CVE-2026-1513.
cacti-apache.conf | 12 ++++++++++
cacti-config.patch | 52 +++++++++++++++++++++++++++---------------
cacti-htmlpurifier-cache.patch | 16 +++++++++++++
cacti-lighttpd.conf | 4 ++++
cacti.spec | 33 ++++++++++++++++++++++-----
5 files changed, 93 insertions(+), 24 deletions(-)
---
diff --git a/cacti.spec b/cacti.spec
index efd09c8..7134de9 100644
--- a/cacti.spec
+++ b/cacti.spec
@@ -1,14 +1,14 @@
%define pia_ver 3.1
-%define php_min_version 5.4.0
+%define php_min_version 8.0.0
Summary: Cacti is a PHP frontend for rrdtool
Summary(pl.UTF-8): Cacti - frontend w PHP do rrdtoola
Name: cacti
-Version: 1.2.30
+Version: 1.2.31
Release: 1
License: GPL v2
Group: Applications/WWW
-Source0: http://www.cacti.net/downloads/%{name}-%{version}.tar.gz
-# Source0-md5: f330157afc4b4527e78585b5327f86ef
+Source0: https://www.cacti.net/downloads/%{name}-%{version}.tar.gz
+# Source0-md5: 23fd50e0e9bd970ccf5551d5257639f9
Source2: %{name}.crontab
Source3: %{name}-apache.conf
Source4: %{name}-lighttpd.conf
@@ -21,12 +21,14 @@ Patch3: %{name}-ioerror.patch
Patch4: %{name}-webroot.patch
Patch5: %{name}-linux_memory.patch
Patch6: %{name}-log-verbosity.patch
+Patch7: %{name}-htmlpurifier-cache.patch
Patch8: host_name-url.patch
# http://www.cacti.net/download_patches.php
# Patch100: ..
-URL: http://www.cacti.net/
+URL: https://www.cacti.net/
BuildRequires: sed >= 4.0
+Requires(post): coreutils
Requires(postun): /usr/sbin/userdel
Requires(pre): /bin/id
Requires(pre): /usr/sbin/useradd
@@ -35,9 +37,11 @@ Requires: group(http)
Requires: net-snmp-utils
Requires: php(core) >= %{php_min_version}
Requires: php(ctype)
+Requires: php(dom)
Requires: php(filter)
Requires: php(gd)
Requires: php(gettext)
+Requires: php(gmp)
Requires: php(intl)
Requires: php(json)
Requires: php(ldap)
@@ -48,6 +52,7 @@ Requires: php(pcntl)
Requires: php(pdo-mysql)
Requires: php(posix)
Requires: php(session)
+Requires: php(simplexml)
Requires: php(sockets)
Requires: php(xml)
Requires: php(zlib)
@@ -61,7 +66,6 @@ Requires: webserver(php)
Suggests: cacti-spine
Suggests: php(bcmath)
Suggests: php(ftp)
-Suggests: php(gmp)
Suggests: php(snmp)
Provides: cacti(pia) = %{pia_ver}
Provides: user(cacti)
@@ -148,6 +152,7 @@ Dokumentacja do Cacti w formacie HTML.
%patch -P4 -p1
%patch -P5 -p1
%patch -P6 -p1
+%patch -P7 -p1
# ?
# %%patch -P8 -p1
@@ -158,8 +163,16 @@ mv *.sql sql
cp -p %{SOURCE5} sql
%{__rm} log/.htaccess
+%{__rm} log/index.php
%{__rm} cli/.htaccess
%{__rm} rra/.htaccess
+%{__rm} scripts/.htaccess
+
+# upstream tarball ships a fixed CSRF secret, every install must generate its own
+%{__rm} include/vendor/csrf/csrf-secret.php
+
+# phar build tooling of bundled random_compat, not used at runtime
+%{__rm} -r include/vendor/paragonie/random_compat/{build-phar.sh,dist,other,psalm-autoload.php,psalm.xml}
# must require libs to get fatals on missing files, not include
%{__sed} -i -e '
@@ -190,6 +203,7 @@ cp -p *.php $RPM_BUILD_ROOT%{_appdir}
# dirs that contain index.php are likely to be installed
# ls -1d */index.php | cut -d"/" -f1 | xargs
cp -a cache/* $RPM_BUILD_ROOT/var/cache/%{name}
+install -d $RPM_BUILD_ROOT/var/cache/%{name}/htmlpurifier
ln -s /var/cache/%{name} $RPM_BUILD_ROOT%{_appdir}/cache
cp -a cli docs formats images include install lib locales mibs plugins resource scripts sql $RPM_BUILD_ROOT%{_appdir}
mv $RPM_BUILD_ROOT{%{_appdir}/poller.php,%{_sbindir}/cacti-poller}
@@ -198,6 +212,7 @@ cp -a log $RPM_BUILD_ROOT/var/log/%{name}
:> $RPM_BUILD_ROOT/var/log/%{name}/%{name}.log
install -d $RPM_BUILD_ROOT/var/log/archive/%{name}
cp -a rra $RPM_BUILD_ROOT/var/lib/%{name}
+:> $RPM_BUILD_ROOT/var/lib/%{name}/csrf-secret.php
mv $RPM_BUILD_ROOT%{_appdir}/include/config.php.dist $RPM_BUILD_ROOT%{_sysconfdir}/config.php
cp -p %{SOURCE2} $RPM_BUILD_ROOT/etc/cron.d/%{name}
@@ -227,6 +242,10 @@ exit 0
if [ ! -f /var/log/%{name}/cacti.log ]; then
install -m660 -oroot -ghttp /dev/null /var/log/%{name}/cacti.log
fi
+if [ ! -s /var/lib/%{name}/csrf-secret.php ]; then
+ install -m640 -oroot -ghttp /dev/null /var/lib/%{name}/csrf-secret.php
+ head -c 32 /dev/urandom | sha1sum | cut -c1-40 > /var/lib/%{name}/csrf-secret.php
+fi
%postun
if [ "$1" = "0" ]; then
@@ -293,6 +312,7 @@ fi
%attr(755,root,root) %{_appdir}/scripts/*
%attr(750,root,http) %dir /var/lib/%{name}
+%attr(640,root,http) %ghost /var/lib/%{name}/csrf-secret.php
%attr(770,root,http) %dir /var/lib/%{name}/rra
%attr(730,root,http) %dir /var/log/%{name}
%attr(750,root,logs) %dir /var/log/archive/%{name}
@@ -300,6 +320,7 @@ fi
%attr(730,root,http) %dir /var/cache/%{name}
/var/cache/%{name}/index.php
%attr(730,root,http) %dir /var/cache/%{name}/boost
+%attr(770,root,http) %dir /var/cache/%{name}/htmlpurifier
%attr(730,root,http) %dir /var/cache/%{name}/mibcache
%attr(770,root,http) %dir /var/cache/%{name}/realtime
%attr(730,root,http) %dir /var/cache/%{name}/spikekill
diff --git a/cacti-apache.conf b/cacti-apache.conf
index 1b46036..9b397da 100644
--- a/cacti-apache.conf
+++ b/cacti-apache.conf
@@ -15,6 +15,18 @@ Alias /cacti /usr/share/cacti
</IfModule>
</Directory>
+<DirectoryMatch "^/usr/share/cacti/(cli|scripts)/">
+ <IfModule mod_authz_core.c>
+ # Apache 2.4
+ Require all denied
+ </IfModule>
+ <IfModule !mod_authz_core.c>
+ # Apache 1.3, 2.x
+ Order allow,deny
+ Deny from all
+ </IfModule>
+</DirectoryMatch>
+
<Directory /usr/share/cacti/install>
# mod_security overrides.
# Uncomment these if you use mod_security.
diff --git a/cacti-config.patch b/cacti-config.patch
index 2dc639b..2ddcd8d 100644
--- a/cacti-config.patch
+++ b/cacti-config.patch
@@ -1,6 +1,6 @@
---- cacti-1.2.26/include/global.php~ 2023-12-24 03:17:14.000000000 +0100
-+++ cacti-1.2.26/include/global.php 2024-02-28 13:34:23.293235210 +0100
-@@ -81,13 +81,7 @@ $disable_log_rotation = false;
+--- cacti-1.2.31/include/global.php~
++++ cacti-1.2.31/include/global.php
+@@ -81,13 +81,7 @@
$config = array();
@@ -15,7 +15,16 @@
if (isset($config['cacti_version'])) {
die('Invalid include/config.php file detected.' . PHP_EOL);
-@@ -238,7 +232,7 @@ if ($config['cacti_server_os'] == 'win32
+@@ -195,6 +189,8 @@
+
+ if (!empty($path_csrf_secret)) {
+ $config['path_csrf_secret'] = $path_csrf_secret;
++} else {
++ $config['path_csrf_secret'] = '/var/lib/cacti/csrf-secret.php';
+ }
+
+ /* built-in snmp support */
+@@ -238,7 +234,7 @@
}
$config['include_path'] = dirname(__FILE__);
@@ -24,8 +33,8 @@
/* for multiple pollers, we need to know this location */
if (!isset($scripts_path)) {
---- cacti-1.2.26/include/config.php.dist~ 2023-12-24 03:17:14.000000000 +0100
-+++ cacti-1.2.26/include/config.php.dist 2024-02-28 13:35:19.813235204 +0100
+--- cacti-1.2.31/include/config.php.dist~
++++ cacti-1.2.31/include/config.php.dist
@@ -29,8 +29,8 @@
$database_type = 'mysql';
$database_default = 'cacti';
@@ -37,9 +46,18 @@
$database_port = '3306';
$database_retries = 5;
$database_ssl = false;
---- cacti-1.2.26/poller.php~ 2023-12-24 03:17:14.000000000 +0100
-+++ cacti-1.2.26/poller.php 2024-02-28 13:36:02.066568538 +0100
-@@ -31,7 +31,7 @@ if (function_exists('pcntl_async_signals
+@@ -131,7 +131,7 @@
+ * the CRSF secret file.
+ */
+
+-//$path_csrf_secret = '/usr/share/cacti/resource/csrf-secret.php';
++//$path_csrf_secret = '/var/lib/cacti/csrf-secret.php';
+
+ /**
+ * The following are optional variables for debugging low level system
+--- cacti-1.2.31/poller.php~
++++ cacti-1.2.31/poller.php
+@@ -31,7 +31,7 @@
ini_set('output_buffering', 'Off');
@@ -48,10 +66,9 @@
require_once($config['base_path'] . '/lib/poller.php');
require_once($config['base_path'] . '/lib/data_query.php');
require_once($config['base_path'] . '/lib/rrd.php');
-diff -ur cacti-1.2.6.org/install/functions.php cacti-1.2.6/install/functions.php
---- cacti-1.2.6.org/install/functions.php 2019-09-02 10:23:43.000000000 +0200
-+++ cacti-1.2.6/install/functions.php 2019-09-26 11:19:59.780907049 +0200
-@@ -794,8 +794,8 @@
+--- cacti-1.2.31/install/functions.php~
++++ cacti-1.2.31/install/functions.php
+@@ -1056,8 +1056,8 @@
$section = 'general';
}
$logfile = 'install' . '-' . $section;
@@ -62,9 +79,9 @@ diff -ur cacti-1.2.6.org/install/functions.php cacti-1.2.6/install/functions.php
}
}
---- cacti-1.2.26/lib/installer.php~ 2023-12-24 03:17:14.000000000 +0100
-+++ cacti-1.2.26/lib/installer.php 2024-02-28 13:37:29.589901867 +0100
-@@ -528,7 +528,6 @@ class Installer implements JsonSerializa
+--- cacti-1.2.31/lib/installer.php~
++++ cacti-1.2.31/lib/installer.php
+@@ -528,7 +528,6 @@
$always_paths = array(
'sys_temp' => sys_get_temp_dir(),
@@ -72,7 +89,7 @@ diff -ur cacti-1.2.6.org/install/functions.php cacti-1.2.6/install/functions.php
'boost' => $config['base_path'] . '/cache/boost',
'mibcache' => $config['base_path'] . '/cache/mibcache',
'realtime' => $config['base_path'] . '/cache/realtime',
-@@ -3539,7 +3538,7 @@ class Installer implements JsonSerializa
+@@ -3556,7 +3555,7 @@
$page_nr = 1;
$total_rows = 500;
@@ -81,4 +98,3 @@ diff -ur cacti-1.2.6.org/install/functions.php cacti-1.2.6/install/functions.php
$output_log = '';
foreach ($logcontents as $logline) {
-
diff --git a/cacti-htmlpurifier-cache.patch b/cacti-htmlpurifier-cache.patch
new file mode 100644
index 0000000..5fe56e4
--- /dev/null
+++ b/cacti-htmlpurifier-cache.patch
@@ -0,0 +1,16 @@
+HTMLPurifier by default writes its definition cache into its own library dir,
+which is read-only under /usr/share and triggers warnings on every call
+
+--- cacti-1.2.31/lib/html.php~
++++ cacti-1.2.31/lib/html.php
+@@ -1160,7 +1160,9 @@
+ * @return string The sanitized string
+ */
+ function html_purify($string) {
+- $purifier = new HTMLPurifier();
++ $purifier_config = HTMLPurifier_Config::createDefault();
++ $purifier_config->set('Cache.SerializerPath', '/var/cache/cacti/htmlpurifier');
++ $purifier = new HTMLPurifier($purifier_config);
+
+ return $purifier->purify($string);
+ }
diff --git a/cacti-lighttpd.conf b/cacti-lighttpd.conf
index e94f3d4..9a5f845 100644
--- a/cacti-lighttpd.conf
+++ b/cacti-lighttpd.conf
@@ -4,6 +4,10 @@ alias.url += (
"/cacti" => "/usr/share/cacti",
)
+$HTTP["url"] =~ "^/cacti/(cli|scripts)/" {
+ url.access-deny = ("")
+}
+
$HTTP["url"] =~ "^/cacti/" {
auth.require = (
"/disabled-cacti/" => (
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/cacti.git/commitdiff/64d619a6dd8a49284f77e40f4b280235b1e61a20
More information about the pld-cvs-commit
mailing list