v1.2.8

Release of Cacti 1.2.8

Thank you everyone who are using Cacti and especially those helping to make Cacti better!

For additional details check out the README located on GitHub.

IMPORTANT: This release addresses two CVE's that were reported. For more information see the changelog.

Contribute

Active development of Cacti is located on GitHub! Join us in making Cacti better, submit issues, fork and submit pull requests!

Change Log

• security#3025: CVE-2019-17357 When viewing graphs, some input variables are not properly checked (SQL injection possible)
• security#3026: CVE-2019-17358 When deserializating data, ensure basic sanitization has been performed
• security#3066: When using HTTPS, secure cookie to prevent potential weakness
• issue#1228: Any tree or branch with a long name force main content off screen
• issue#2133: Long snmp_indexes are being cut off
• issue#2888: Long hostnames cause template filter to go off page
• issue#2987: Changing Color Template does not update Aggregate
• issue#2989: Allow Remote Data Collectors to maintain their own path variables
• issue#2991: Cacti Statistics device template can generate unexpected errors
• issue#2995: When editing a report, column setting may be ignored incorrectly
• issue#2996: When editing a user, graph options do not properly reflect previously saved settings
• issue#2998: Session performance issues due to excessive use for database storage
• issue#2999: Blank arguments can lead to extra spaces in script arguments
• issue#3006: Boost generates undefined variables warning during poller run
• issue#3011: i18n logging does not check write permission exists
• issue#3012: When viewing realtime graphs, some input variables are not properly checked
• issue#3013: Allow legends to be modified for Aggregate Graphs
• issue#3017: Automation network range with spaces fails validation
• issue#3019: User selected language is not always adhered to
• issue#3021: Tree view cuts off at the bottom of page on modern theme
• issue#3023: When clicking highlighted tab, side panel is not always shown/hidden correctly
• issue#3027: Aggregate Graph re-ordering does not work
• issue#3028: When zooming a graph, unable to reach edge of graph without losing focus
• issue#3030: Pace continues to run even after a page is finished rendering
• issue#3032: Graphs may select MAX instead of AVERAGE as consolidation function even if there is no item with MAX present.
• issue#3035: When editing a tree, can not remove entries due to CSS bug
• issue#3037: When emptying poller output using cli, debug functions are not properly included
• issue#3039: Allow packagers to be able to specify an alternate location of csrf-secret.php file
• issue#3040: When running automation, discovery can still run even if cancelled
• issue#3041: When running automation, scans do not always respond to being cancelled
• issue#3042: When running automation, scan can fail when selecting remote pollers
• issue#3045: When viewing Aggregate Graphs, an error due to undefined referrer may occur
• issue#3047: When saving settings, ignore remote pollers who have not checked in recently
• issue#3050: When viewing graph trees, some input variables are not properly checked
• issue#3052: When editing CDEF's, slow database performance can occur
• issue#3053: When viewing graph thumbnails, some input variables are not properly checked
• issue#3055: During install/upgrade, database tests are not performed correctly
• issue#3059: When using nth_percentile, correct value is not always returned if using MAX consolidation
• issue#3060: When upgrading from older MySQL databases, format is not changed from compact to dynamic
• issue#3061: When running automation, allow SNMP to be used as a ping method
• issue#3068: When administrating users, some input variables are not properly checked
• issue#3070: Improve database logging when a crashed table is encountered
• issue#3073: Automation network range does not always produce the correct start/end values
• issue#3078: When viewing graph debug from remote data collector, File Not Found warnings can appear incorrectly
• issue#3079: Allow domain names to be stripped from a device's long description
• issue#3080: Remote Agent throws warnings that graph_nolegend has not been sanitized
• issue#3085: When editing a poller, ensure each listening IP is unique
• issue#3081: External Links are not showing a glyph when they appear on the Console menu
• issue#3089: When viewing graphs in realtime, undefined variable can be logged for 95th Percentile graphs
• issue#3099: Graph template 'Linux - Memory Usage' has the wrong unit on its vertical_label
• issue#3101: Polling times can be slightly inconsistent due
• issue#3104: When viewing graphs, a byref error can be seen in the error logs
• issue#3105: When viewing hosts, some input variables are not properly checked
• issue#3111: When adding devices via command line, bad SNMP versions are not reported
• issue#3112: When zooming on Graphs, too many requests are being made causing slowness
• issue#3114: Support for USB devices that change name due to their hosts restarting
• issue#3118: When converting tables, the dynamic row format should be selected
• issue#3119: Main Data Collector should perform a Full Sync whenever it is installed/upgraded
• issue#3120: Correct issues causing incompatibility with PHP 7.4
• issue#3121: When converting tables during install, show what will be changed
• issue#3123: Named colors table is not properly imported/upgraded
• issue#3124: When a second data collector is added, boost is not enabled automatically
• issue#3128: i18n handler checks for existence of wrong mo file
• issue#3129: Logout repeated occurs even when already logged out
• issue#3132: Installer fails to continue if automation range is array of networks
• feature#3077: Allow disabling remote poller resource cache replication to support upgrade testing

*** Reporting Issues ***

http://www.cacti.net/issues.php

*** Download Cacti ***

http://www.cacti.net/download_cacti.php

*** Download Spine ***

http://www.cacti.net/spine_download.php

Thanks!
The Cacti Group

v1.2.7

Release of Cacti 1.2.7

Thank you everyone who are using Cacti and especially those helping to make Cacti better!

For additional details check out the README located on GitHub.

IMPORTANT: Security issue #2964 (CVE-2019-16723) was found and fixed that allowed unrestricted access to graphs via the https://cacti/graphs_json.php url. Whilst this page did check that a valid user was logged in, any user would be able to access any graph regardless of any defined permissions.

Contribute

Active development of Cacti is located on GitHub! Join us in making Cacti better, submit issues, fork and submit pull requests!

Change Log

• security#2964: CVE-2019-16723 Security issue allows to view all graphs
• issue#1181: When opening the Scheduler, it may appear off screen when opened near the bottom of a window
• issue#2894: When using Remote Data Collectors, database information and recommendations may show Incorrect values
• issue#2895: When using data sources from different RRDs, Percentile calculation may be incorrect
• issue#2899: When displaying a form, variable substitution may not always work as expected
• issue#2922: When running a data query, the result may come back as undefined
• issue#2925: When using consolidation functions, retrieving the first step can cause errors
• issue#2926: When editing a graph, variable validation errors may prevent changes from being saved
• issue#2929: Boost performance may become poor even in single server mode
• issue#2930: RRDtool can generate errors to standard output which can corrupt images
• issue#2932: When RRDTool generates an error creating an image, it is not always reportedly properly
• issue#2936: Installer will loop when number of tables exceeds PHP's max_input_vars limit
• issue#2938: Under CentOS packages, upgrade_database.php script uses incorrect location for DB upgrade scripts
• issue#2940: Images are not always properly sized until the page size changes
• issue#2949: Order icons may not be properly aligned
• issue#2951: Allow legends to be modified for Aggregate Graphs
• issue#2958: Drop down autocomplete lists do not always open as expected
• issue#2961: When syncing device templates, undefined function may be raised
• issue#2963: When running ss_cpoller script, avgTime incorrect returns maxTime
• issue#2966: Realtime popup windows do not always honor settings
• issue#2967: When using Spikekill, gap and range fill are not operating as expected
• issue#2970: When a user edits their profile, buttons may appear as unusable whilst still being enabled
• issue#2973: User menu does not always display properly on mobile devices
• issue#2974: Script Server can raise unexpected warnings when 'arg_num_indexes' set but not found in data source
• issue#2975: Datasource Debug does not properly handle European numbers in certain circumstances
• issue#2976: Boost messages should be stored in their own log file
• issue#2977: Data updates with past timestamps can cause boost errors
• issue#2978: Moving hosts between data collectors is slow
• issue#2979: Multi Output Fields are not parsed correctly
• issue#2984: When checking SQL fields, value was not always primed
• issue#2986: Selecting 'Devices' menu pick closes 'Management' menu
• feature#2943: Allow all Data Queries of a device to be re-indexed at once
• feature#2952: If device is down or threshold breached, highlight in tree view
• feature#2985: Update phpseclib to 2.0.23

v1.2.6

Release of Cacti 1.2.6

Thank you everyone who are using Cacti and especially those helping to make Cacti better!

For additional details check out the README located on GitHub.

Contribute

Active development of Cacti is located on GitHub! Join us in making Cacti better, submit issues, fork and submit pull requests!

Change Log

• issue#2794: Graph template not saved on graph edit
• issue#2825: "innodb_doublewrite = off" possibly dangerous recommendation
• issue#2829: PHP recommendations always see memory limit as unlimited
• issue#2830: Disabled Top/Bottom external links should not be displayed
• issue#2832: Install/Upgrade log does not show anything
• issue#2833: Undefined index can occur when data source does not have an snmp_index
• issue#2834: Boost performance drops on very large systems
• issue#2835: When creating graphs and inneficient query is causing long creation times
• issue#2837: Sunrise theme does not render checkboxes 100% correctly
• issue#2838: jQueryMultiselect does not match upstream due to forking
• issue#2839: Non regular expression search filters don't support international characters
• issue#2841: Total count is wrong after searching for External Link pages
• issue#2843: DSStats reruns Daily Aggregation every minute
• issue#2844: Autocomplete settings for passwords are not properly defined
• issue#2845: Data Template can't be edited when it is in use
• issue#2846: Allow tooltips for section headers with 'question' icon
• issue#2847: Permanently convert an Aggregate to a regular graph
• issue#2848: Aggregate graphs get clipped due to incorrect date range
• issue#2856: Aggregate issues with very long RRDtool command lines
• issue#2857: When trying to find the best index to use, a 'must implement Countable' warning appears
• issue#2860: When testing remote poller connections during install, undefined variable warning can occur
• issue#2862: Automation does not calculate network information correctly for single hosts
• issue#2866: Add poller ID to subject for admin notifications
• issue#2869: When creating aggregates from Graphs, JavaScript issues can occur
• issue#2872: Add support for MySQL 8 and use of grouping as name for a column
• issue#2875: Undefined variable when removing spikes in some cases
• issue#2877: When attempting to send report, undefined function 'get_tinespan' messages appear
• issue#2878: Function get_magic_quotes_gpc() is now deprecated in PHP 7.4
• issue#2879: Switching from authPriv to authNoPriv produces error when saving
• issue#2884: Replication continues to occur when poller has been disabled by sysres-dev
• issue#2891: Script server script ss_fping.php generates error when not called by script server
• issue#2895: Percentile calculation is incorrect on Graphs with multiple Data Sources from different RRDs
• issue#2901: Poller overrun warning message is badly worded
• issue#2902: Mailer incorrectly reports it is sending to noone
• issue#2903: PHP recommendations can generate a warning causing JSON issues
• issue#2905: Sorting plugins by version can lead to unexpected ordering
• issue#2907: SSL column for multiple pollers can be incorrectly set causing SQL errors
• issue#2908: When URL_PATH is blank, it should assume that it is '/'
• issue#2909: Correct usage of affect vs effect in strings
• issue#2910: Can not show user menu when in portrait mode on mobile devices
• issue#2911: Graph variables are not always encoded to JSON properly resulting in warnings
• issue#2912: Navigation cache can sometimes be corrupted resulting in a non-array value
• issue#2913: When adding new graphs, the type of graph is not remembered
• issue#2917: Action icons next to graphs can sometimes become unselectable due to zoom
• issue#2919: When refreshing menu, selected items are sometimes lost and submenu items can become hidden

Reporting Issues

http://www.cacti.net/issues.php

Download Cacti

http://www.cacti.net/download_cacti.php

Download Spine

http://www.cacti.net/spine_download.php

v1.2.5

Release of Cacti 1.2.5

Thank you everyone who are using Cacti and especially those helping to make Cacti better!

For additional details check out the README located on GitHub.

Contribute

Active development of Cacti is located on GitHub! Join us in making Cacti better, submit issues, fork and submit pull requests!

Change Log

• issue#1978: Popup Menus can appear off screen when using Graph Thumbnails
• issue#2282: Installation wizard does not detect RRDtool version correctly
• issue#2524: When editing a tree, Drag and Drop of Devices does not always work as expected
• issue#2573: Associated Graph Template for Data Query can sometime disappear
• issue#2656: GPRINT text_format does not replace Data Query and Host Fields
• issue#2661: Automation does not always calculate network range/subnet correctly
• issue#2663: Some legacy Data Queries can not determine their index order causing broken graphs
• issue#2674: Large strings can sometimes cause language translation can fail
• issue#2719: Automation may sometimes create empty graphs
• issue#2721: When replacing '|input_xxxx|' strings, undefined index can occur
• issue#2722: Calls to _db_replace() are not consistent resulting in warnings
• issue#2723: When replicating to remote pollers, Undefined Variable errors may be seen
• issue#2724: When graphing HRULE items, 'Only Variables should be passed by reference' error may be seen
• issue#2725: When viewing logs in utilities, filenames should be limited the same as clog
• issue#2726: During Automation logging, include the Rule ID that triggers the creation of an item by xmacan
• issue#2732: When using basic authentication, automatically strip any @Domain information
• issue#2734: Allow non-english labels to be used on Graph Templates
• issue#2727: When using Polling Hosts Template, warnings can be issued when CMD.PHP is the poller
• issue#2733: When processing SNMP data, space delimited hex strings do not always convert into MAC addresses
• issue#2735: Mouse cursor should show as default pointer if column is not sortable
• issue#2736: When using MySQL 8 or above, 'function' is considered a reserved word unless quoted by xmacan
• issue#2741: Various errors can occur due to undefined or incorrect variable names
• issue#2742: Various errors can occur due to undefined or incorrect variable names
• issue#2743: Attempts to close a tooltip when no tooltip has been set may cause errors
• issue#2744: When changing password, undefined index error can occur if user is not logged in
• issue#2748: If PHP location setting is invalid during install/upgrade, this should be notified on modules page
• issue#2750: When performing multiple sort, highlighting of content occurs
• issue#2751: When editing a Tree, display filter may not allow 'All' option to work
• issue#2752: When running verbose query on device, you are unable to copy text from items
• issue#2753: Unable to copy entire verbose query using clipboard command
• issue#2757: Page Navigation can be subject to XSS injection
• issue#2758: Various sensitive directories are browsable if web server directory browsing is enabled
• issue#2760: Unable to add items into a report
• issue#2762: Creating an aggregate graph can sometimes fail due to unknown RRD tools error
• issue#2766: When modifying Aggregate Templates, changes are not always cascaded to Graph
• issue#2768: Aggregate Graphs may sometimes show the wrong row count
• issue#2770: ItemType is not updated when saving Report Items
• issue#2772: Add tooltip support to html_header() and html_header_checkbox()
• issue#2775: Remote pollers may sometimes fail to replicate data back to main system
• issue#2777: Attempting to edit a non-existent report generates an error
• issue#2778: When rendering graphs, resizing can sometimes occur repeatedly
• issue#2779: On new installations, automation rules for Interface Graphs are broken
• issue#2780: Upgrade database script not actually upgrading Cacti
• issue#2782: When replicating the syslog plugin, the configuration file is ignored causing errors
• issue#2783: When limiting the number of displayed characters, international characters may sometimes display incorrectly
• issue#2784: When removing a device with graphs but no data sources , errors are generated
• issue#2785: When editing a graph rule, warnings incorrectly appear about unsaved changes
• issue#2792: When a checkbox 'friendly name' has a comma, checkbox functionality stops working
• issue#2797: When upgrading from before 1.x, SuperLinks view permissions may not be correct
• issue#2799: Under heavy use of Real Time Graphs, SQL errors may start appearing
• issue#2800: When editing a tree, using a comma in the search field stops search from working
• issue#2802: If a Device lacks ifName, an alternative field is not always found even if available
• issue#2807: When editing a Data Template that has dependant graphs, some attributes should not be modifiable
• issue#2808: When navigating a tree, the layout may unexpectedly move
• issue#2814: When viewing the utilities page, HTML tags may be seen rather than rendered
• issue#2816: When viewing logs, paging does not always working correctly
• issue#2818: Automation can sometimes incorrectly add duplicate devices with the same sysname
• issue#2820: When path is blank, is_resource_writable() will generate 'Uninitialized string offset: -1'
• issue#2821: When the desired locale can not be located, a number format issue may occur
• feature#2728: Update phpseclib to 2.0.17 by DavidLiedke
• feature#2809: Update c3.js & d3.js by DavidLiedke
• feature#2730: Update jstree.js to 3.3.8 by DavidLiedke
• feature#2754: Allow Devices, Graphs and Data Sources to be searched by ID
• feature#2765: When editing a tree, allow cascading selection of available graphics
• feature#2805: Merged plugins are not always upgraded correctly
• feature#2823: Enhance the splice_rrd.php to be able to merge RRDfiles of differing step

Reporting Issues

http://www.cacti.net/issues.php

Download Cacti

http://www.cacti.net/download_cacti.php

Download Spine

http://www.cacti.net/spine_download.php

v1.2.4

Release of Cacti 1.2.4

Thank you everyone who are using Cacti and especially those helping to make Cacti better!

For additional details check out the README located on GitHub.

Contribute

Active development of Cacti is located on GitHub! Join us in making Cacti better, submit issues, fork and submit pull requests!

Change Log

• issue #2523: Send A Test Email stops working under PHP 7.3
• issue #2589: Missing RRD file can cause DSSTATS to throw errors
• issue #2590: When installing, chosen language is sometimes lost
• issue #2591: Menu selection does not always match selected page/section
• issue #2592: When viewing an aggregate graph, 'Display graphs from this aggregate' option does always not work
• issue #2593: Unable to migrate aggregate graphs to matching aggregate template
• issue #2598: Creating an aggregate graph without associated template causes RRDtool error
• issue #2599: Creating/Updating an Aggregate Graph to use LINE/STACK's generates invalid SQL statements
• issue #2604: When adding a dataquery, SQL errors can be generated
• issue #2605: When installing, checking database tables can cause errors
• issue #2608: db_update_table() function should not require an engine type or comment
• issue #2609: When updating from earlier than 1.2, timezone column might not exist
• issue #2610: Data Sources troubleshooter generates warning that each() function is deprecated
• issue #2612: When RRDtool fails to initialize, DSStats generates lots of warnings
• issue #2618: ifAdminStatus in snmp_queries/interfaces.xml
• issue #2621: File paths that accept blanks are not allowing blanks
• issue #2622: Various undefined variables generate errors within database.php
• issue #2623: When using form_text_area(), invalid HTML can be generated
• issue #2627: Some filenames can be lost in log file selection list
• issue #2629: When upgrading, ldap library is not loaded properly due to incorrect paths
• issue #2632: Automated Networks are not being properly replicated to additional pollers
• issue #2635: When running automation scans, database connection should be forced to central database
• issue #2638: Support disabling PHP SNMP extension by mhoran
• issue #2645: Some URLs are incorrectly calculated
• issue #2649: Automation not creating graphs when there are custom items
• issue #2650: Several undefined variables are generating warnings
• issue #2662: HRULE objects broken in some cases
• issue #2668: Trailing parentheses are removed from the SNMP system description
• issue #2672: Cacti Install on Windows Fails
• issue #2676: Skin paper plane not working on iPhone XR
• issue #2678: Call to undefined function _() in data_queries.php
• issue #2679: Users with passwords that do not meet complexity requirements are not redirected to the Change Password page
• issue #2680: Remove deprecated $php_errormsg usage
• issue #2689: Increase boost maximum memory limits
• issue #2693: Graph links do not contain URL path causing links to fail
• issue #2698: Avoid duplicated icon in the main.js of all themes
• issue #2699: Login option "Show the page that user pointed their browser to" does not work properly
• issue #2702: sqltable_to_php.php does not always generate valid table data arrays
• issue #2707: Some pages that have permission errors dont raise proper messages
• issue #2712: PHP memory should be unlimited in scripts that need more memory than the default
• issue #2713: SNMP System Description with UTF8 strings properly are not properly parsed
• issue #2718: When links are converted to ajax calls, mailto links should not be included
• issue #2720: When calculating percentiles, the value is incorrect as the steps are not placed in correct order
• feature #2538: Allow users to change default method of removing data sources when deleting graphs
• feature #2539: Allow users to set the default graph lock status
• feature #2540: Allow users to enable/disable graph tree history
• feature #2646: Allow application of automation rules on CLI by rb83
• feature #2654: New hook to notify plugins of user profile changes ('auth_profile_update_data')
• feature #2664: Add option to purge spikekill backups
• feature #2701: Provide option to continue graphing objects that loose their index
• feature #2704: Device and template cache do not refresh properly

Reporting Issues

http://www.cacti.net/issues.php

Download Cacti

http://www.cacti.net/download_cacti.php

Download Spine

http://www.cacti.net/spine_download.php