hardening: prepared statements, PHP 7.4 idioms, and security fixes - #8
Open
somethingwithproof wants to merge 7 commits into
Open
hardening: prepared statements, PHP 7.4 idioms, and security fixes#8somethingwithproof wants to merge 7 commits into
somethingwithproof wants to merge 7 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR hardens the WMI plugin by reducing SQL injection risk via prepared statements and tightening command/credential handling in the Linux WMI execution path.
Changes:
- Converted several SQL calls to prepared statements (
db_fetch_*_prepared,db_execute_prepared). - Hardened shell command construction by escaping the WMI hostname before execution.
- Changed stored credential encoding from PHP
serialize()to base64(JSON), while retaining legacy decode support.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
script/wmi-script.php |
Fetch WMI query metadata using a prepared statement. |
poller_wmi.php |
Purge queries use prepared deletes keyed by host_id. |
linux_wmi.php |
Escape hostname for shell execution; update password encode/decode format with legacy support. |
functions.php |
Prepared query for data_input_fields lookup in XML export generation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
somethingwithproof
force-pushed
the
hardening/comprehensive
branch
from
April 9, 2026 09:00
03bd9c5 to
76de570
Compare
This was referenced Apr 11, 2026
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
… equivalents Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
somethingwithproof
force-pushed
the
hardening/comprehensive
branch
from
July 14, 2026 10:47
9497065 to
dbd67bc
Compare
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidated hardening: migrate to prepared statements, null coalescing operators, PHP 7.4 str_starts_with replacement.