security: escape output in threshold web views

[somethingwithproof]

Escapes output that reaches the browser from threshold web views: page, id
and drp_action where they print into hidden inputs, and AJAX filter parameters
wrapped in encodeURIComponent().

The rfilter value is quoted through db_qstr() where it builds RLIKE clauses,
replacing raw interpolation.

Split out of #773 as one concern. No behaviour change beyond escaping.

[Copilot]

Pull request overview

This PR hardens the thold plugin’s web-facing threshold views by reducing XSS risk in rendered HTML/JS, and by improving safety of user-supplied filter values used in SQL RLIKE clauses.

Changes:

• Escapes request-derived values before rendering into hidden form inputs.
• Wraps AJAX filter parameters with encodeURIComponent() when building URLs client-side.
• Quotes rfilter values via db_qstr() for RLIKE SQL fragments, and adds a safer unserialize fallback path for selected_graphs_array.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
thold.php	Quotes RLIKE filter operand and escapes page when rendered into a hidden input; URL-encodes filter parameters in JS.
thold_graph.php	Applies the same URL-encoding and output escaping patterns; quotes multiple RLIKE filter operands.
thold_webapi.php	URL-encodes wizard filter parameters; adds guarded unserialize/sanitization logic for nested graph selection payloads.
thold_templates.php	URL-encodes the filter value when applying the templates page filter via JS.

Suppressed comments (2)

thold_graph.php:942

• These host filter RLIKE clauses are now quoted via db_qstr(), which addresses SQL injection but doesn’t apply Cacti’s RLIKE-specific hardening (db_qstr_rlike). Consider using db_qstr_rlike() when available (fallback to db_qstr) so the operand is bounded/cleaned per core mitigation.

	if (get_request_var('rfilter') != '') {
		$sql_where .= " (h.deleted = ''
			AND (h.hostname " . 'RLIKE ' . db_qstr(get_request_var('rfilter')) . '
			OR h.description ' . 'RLIKE ' . db_qstr(get_request_var('rfilter')) . ')';
	}

thold_graph.php:1494

• This RLIKE clause is quoted with db_qstr(), but doesn’t use Cacti’s RLIKE-specific hardening helper (db_qstr_rlike). Consider using db_qstr_rlike() when available (fallback to db_qstr) so the regex operand is bounded/cleaned consistently with core mitigations.

	if (get_request_var('rfilter') != '') {
		$sql_where .= ($sql_where == '' ? '' : ' AND') . ' tl.description ' . 'RLIKE ' . db_qstr(get_request_var('rfilter'));
	}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.