Import of pkgsrc-2014Q1

net/cacti/INSTALL

@@ -0,0 +1,9 @@
+# $NetBSD: INSTALL,v 1.1 2014/01/16 21:10:00 tron Exp $
+
+case ${STAGE} in
+POST-INSTALL)
+	${TOUCH} @CACTI_LOGDIR@/cacti.log
+	${CHOWN} cacti:cacti @CACTI_LOGDIR@/cacti.log
+	${CHMOD} 640 @CACTI_LOGDIR@/cacti.log
+	;;
+esac

net/cacti/MESSAGE

@@ -1,29 +1,23 @@
 ===========================================================================
-$NetBSD: MESSAGE,v 1.1.1.1 2011/11/22 22:23:13 tez Exp $
+$NetBSD: MESSAGE,v 1.2 2014/01/16 21:10:00 tron Exp $
 
 cacti is now installed.
 
 To get cacti up and running asap, you have to complete these steps:
 
-- Install & Configure mysql-server
+- Install & Configure MySQL database server.
 
-- Add a cacti database and cactiuser user to mysql
+- Add a cacti database and cactiuser user to MySQL and create the cacti
+  database layout (${CACTIDIR}/cacti.sql) to MySQL:
 
 	mysql> CREATE DATABASE cacti;
 	mysql> GRANT ALL PRIVILEGES ON cacti.* TO 'cactiuser'@'localhost'
 	    -> IDENTIFIED BY 'cactiuser';
+        mysql> FLUSH PRIVILEGES;
+        mysql> USE cacti;
+        mysql> SOURCE ${CACTIDIR}/cacti.sql;
 
-- Add the cacti database layout (${CACTIDIR}/cacti.sql) to mysql
-
-	shell> mysql [-p] cacti < ${CACTIDIR}/cacti.sql
-
-- Add a symlink from ${CACTIDIR}/scripts/local_memory.pl to the appropriate
-  *_memory.pl script (or create one if none for your OS exists)
-
-	shell> ln -s ${CACTIDIR}/scripts/netbsd_memory.pl \
-			${CACTIDIR}/scripts/local_memory.pl
-
-- Install & Configure an apache webserver
+- Install & Configure an Apache webserver.
 
 - If you have not already done so, add these lines to enable php extensions
   required by cacti in ${PKG_SYSCONFBASE}/etc/php.ini
@@ -32,14 +26,14 @@ To get cacti up and running asap, you have to complete these steps:
 	extension=snmp.so
 	extension=sockets.so
 
-- Append this to apache's httpd.conf and restart apache
+- Append this to Apache webserver's "httpd.conf" and restart the server.
 
 	Include etc/httpd/httpd-cacti.conf
 
 - Add the following lines to ${CACTI_USER}'s crontab
 
-# Invoke poller.php to collect snmp-statistics
-*/5 * * * * ${PREFIX}/bin/php ${CACTIDIR}/poller.php > ${CACTI_LOGDIR}/poller.log 2>&1
+# Invoke poller.php to collect SNMP statistics.
+*/5 * * * *	${PREFIX}/bin/cacti-poller
 
 Please read the included README (${CACTIDIR}/docs/README) file,
 for more information about configuring and starting cacti.

net/cacti/Makefile

@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.17 2013/06/06 12:54:54 wiz Exp $
-#
+# $NetBSD: Makefile,v 1.22 2014/01/16 21:10:00 tron Exp $
 
-DISTNAME=		cacti-0.8.8a
-PKGREVISION=		5
+DISTNAME=		cacti-0.8.8b
+PKGREVISION=		1
 CATEGORIES=		net
 MASTER_SITES=		http://www.cacti.net/downloads/
 
@@ -48,19 +47,22 @@ REPLACE_FILES.php=      cli/*.php
 REPLACE_PERL+=         scripts/*.pl
 
 MESSAGE_SUBST+=         CACTIDIR=${CACTIDIR}
-MESSAGE_SUBST+=         CACTI_LOGDIR=${CACTI_LOGDIR}
 MESSAGE_SUBST+=         CACTI_USER=${CACTI_USER}
 MESSAGE_SUBST+=         EGDIR=${EGDIR}
 MESSAGE_SUBST+=         PREFIX=${PREFIX}
 MESSAGE_SUBST+=         PKG_SYSCONFBASE=${PKG_SYSCONFBASE}
 FILES_SUBST+=		CACTIDIR=${CACTIDIR}
+FILES_SUBST+=		CACTI_GROUP=${CACTI_GROUP}
+FILES_SUBST+=		CACTI_USER=${CACTI_USER}
+FILES_SUBST+=		CACTI_LOGDIR=${CACTI_LOGDIR}
 
 SUBST_CLASSES+=		paths
 SUBST_STAGE.paths=	pre-configure
 SUBST_FILES.paths=	${WRKDIR}/httpd-cacti.conf install/index.php
 SUBST_FILES.paths+=	include/global.php include/global_settings.php
+SUBST_FILES.paths+=	${WRKDIR}/cacti-poller
 SUBST_VARS.paths=	CACTIDIR PREFIX CACTI_USER CACTI_LOGDIR CACTI_RRADIR
-SUBST_VARS.paths+=	PKG_PHP_MAJOR_VERS
+SUBST_VARS.paths+=	PKG_PHP_MAJOR_VERS SH
 
 SUBST_CLASSES+=		docs
 SUBST_STAGE.docs=	pre-configure
@@ -69,22 +71,33 @@ SUBST_SED.docs=		-e 's,/var/www/html/cacti,${CACTIDIR},g'
 
 OWN_DIRS_PERMS+=	${CACTI_LOGDIR} ${CACTI_USER} ${CACTI_GROUP} 755
 OWN_DIRS_PERMS+=	${CACTI_RRADIR} ${CACTI_USER} ${CACTI_GROUP} 755
-SPECIAL_PERMS+=		share/cacti/log/cacti.log ${CACTI_USER} ${CACTI_GROUP} 755
 
-INSTALLATION_DIRS=      share/examples/cacti
+INSTALLATION_DIRS=	bin
+INSTALLATION_DIRS+=	share/examples/cacti
 INSTALLATION_DIRS+=	share/cacti
 
+PLIST_VARS+=	localmemory
+.if ${OPSYS} == "FreeBSD" || ${OPSYS} == "Linux" || \
+    ${OPSYS} == "NetBSD" || ${OPSYS} == "SunOS"
+PLIST.localmemory=	yes
+.endif
+
 post-extract:
 	${CP} ${FILESDIR}/httpd-cacti.conf ${WRKDIR}/
+	${CP} ${FILESDIR}/cacti-poller ${WRKDIR}/
 	${CP} ${FILESDIR}/freebsd_memory.pl ${WRKSRC}/scripts/
 	${CP} ${FILESDIR}/netbsd_memory.pl ${WRKSRC}/scripts/
 	${CP} ${FILESDIR}/solaris_memory.pl ${WRKSRC}/scripts/
+	cd ${WRKSRC}/scripts;					\
+	if [ -f ${LOWER_OPSYS}_memory.pl ]; then		\
+	  ${LN} -fs ${LOWER_OPSYS}_memory.pl local_memory.pl;	\
+	fi
 
 do-install:
 	${INSTALL_DATA} ${WRKDIR}/httpd-cacti.conf ${DESTDIR}${EGDIR}/httpd-cacti.conf
 	${FIND} ${WRKSRC} -type f -name '*.orig' -exec ${RM} -f {} \;
 	cd ${WRKSRC} && ${PAX} -wr * ${DESTDIR}${CACTIDIR}
-
+	${INSTALL_SCRIPT} ${WRKDIR}/cacti-poller ${DESTDIR}${PREFIX}/bin
 
 .include "../../databases/rrdtool/buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"

net/cacti/PLIST

@@ -1,4 +1,5 @@
-@comment $NetBSD: PLIST,v 1.3 2012/12/12 10:48:43 wiz Exp $
+@comment $NetBSD: PLIST,v 1.5 2014/01/16 21:10:00 tron Exp $
+bin/cacti-poller
 share/cacti/LICENSE
 share/cacti/README
 share/cacti/about.php
@@ -316,6 +317,7 @@ share/cacti/install/0_8_7g_to_0_8_7h.php
 share/cacti/install/0_8_7h_to_0_8_7i.php
 share/cacti/install/0_8_7i_to_0_8_8.php
 share/cacti/install/0_8_8_to_0_8_8a.php
+share/cacti/install/0_8_8_to_0_8_8b.php
 share/cacti/install/0_8_to_0_8_1.php
 share/cacti/install/index.php
 share/cacti/install/install_finish.gif
@@ -443,7 +445,6 @@ share/cacti/lib/utility.php
 share/cacti/lib/variables.php
 share/cacti/lib/xml.php
 share/cacti/log/.htaccess
-share/cacti/log/cacti.log
 share/cacti/logout.php
 share/cacti/plugins.php
 share/cacti/plugins/index.php
@@ -472,6 +473,7 @@ share/cacti/scripts/freebsd_memory.pl
 share/cacti/scripts/linux_memory.pl
 share/cacti/scripts/loadavg.pl
 share/cacti/scripts/loadavg_multi.pl
+${PLIST.localmemory}share/cacti/scripts/local_memory.pl
 share/cacti/scripts/netbsd_memory.pl
 share/cacti/scripts/ping.pl
 share/cacti/scripts/query_host_cpu.php

net/cacti/distinfo

@@ -1,9 +1,11 @@
-$NetBSD: distinfo,v 1.3 2012/12/12 10:48:43 wiz Exp $
+$NetBSD: distinfo,v 1.4 2014/01/08 20:51:28 tron Exp $
 
-SHA1 (cacti-0.8.8a.tar.gz) = e66f5fde96b28b273a9e62f79f8a7bb8827812c2
-RMD160 (cacti-0.8.8a.tar.gz) = 1462a71af844810a3451c24fd733b3f2351b75df
-Size (cacti-0.8.8a.tar.gz) = 2273280 bytes
+SHA1 (cacti-0.8.8b.tar.gz) = 84979416ae08d586064328d6451a3108b74a3b06
+RMD160 (cacti-0.8.8b.tar.gz) = a2c88961565c6b5d593b4f2603514139800c9145
+Size (cacti-0.8.8b.tar.gz) = 2272130 bytes
 SHA1 (patch-cacti.sql) = 37e18026c4136630d939ab5a7a4d6336bf166282
+SHA1 (patch-host.php) = 679fd76c81a719d949e023cecc4cc0c47ac6acf4
 SHA1 (patch-include_global.php) = fb0d2f15596b051c60ed6032ecb9038315b7c663
 SHA1 (patch-include_global__settings.php) = 54ffd0c3fc9d927595b1568a874c45a4a6033f7b
-SHA1 (patch-install_index.php) = 84b25c39a4ce1bc6144cffcdb9e32bf257cfcae6
+SHA1 (patch-install_index.php) = e5ee36159968e1ca160aba953e02b9e80a2eb5d9
+SHA1 (patch-lib_api_device.php) = 0a2d495a0245c8957bfd5214a5e79dbb31f135c4

net/cacti/files/cacti-poller

@@ -0,0 +1,7 @@
+#!@SH@
+#
+#	$NetBSD: cacti-poller,v 1.1 2014/01/16 21:10:00 tron Exp $
+#
+
+LOGFILE=@CACTI_LOGDIR@/cacti.log
+exec @PREFIX@/bin/php @CACTIDIR@/poller.php >>$LOGFILE 2>&1

net/cacti/files/netbsd_memory.pl

@@ -1,23 +1,99 @@
-#!/usr/bin/perl 
+#!/usr/bin/perl
+#
+#	$NetBSD: netbsd_memory.pl,v 1.2 2014/01/16 21:10:00 tron Exp $
+#
+# Copyright (c) 2014 The NetBSD Foundation, Inc.
+# All rights reserved.
+#
+# This code is derived from software contributed to The NetBSD Foundation
+# by Matthias Scheler.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+#
 
-if (($ARGV[0] =~ /Cached:/) || ($ARGV[0] =~ /SwapFree:/)) { 
-	open(PROCESS, "pstat -ks |"); 
-	$s = 0; 
-	while (<PROCESS>) { 
-		if (!/^Device/) { 
-			split(); 
-			$s += $_[3]; 
-		} 
-	} 
-	print "$s"; 
-} 
-else { # $ARGV[0] is Buffers:, MemFree:, or anything else 
-	open(PROCESS, "vmstat |"); 
-	while (<PROCESS>) { 
-		if (!/p/) { # the numbers line happens not to have "p" 
-			split(); 
-			print("$_[4]"); 
-		} 
-	} 
-} 
-close(PROCESS); 
+use warnings;
+use strict;
+
+use POSIX;
+
+# Use vmstat(1) to get memory usage information. "vmstat -s" produces
+# output lines like these:
+#
+#  2034763 pages managed
+#    28953 pages free
+#
+# This function creates a hash using the description as a key to the value.
+
+sub get_vm_stats()
+{
+	my %vm_stats;
+	
+	my $vmstat_fh;
+	if (!open($vmstat_fh, '-|', '/usr/bin/vmstat -s')) {
+		die('Cannot start vmstat.');
+	}
+	
+	while (my $line = <$vmstat_fh>) {
+		$line =~ s/^\s+//;
+		$line =~ s/\s+$//;
+		my @words = split(/\s+/, $line, 2);
+		if (scalar(@words) < 2) {
+			next;
+		}
+		my ($value, $descr) = @words;
+	
+		$vm_stats{$descr} = $value;
+	}
+	
+	close($vmstat_fh);
+	return %vm_stats;
+}
+
+if (scalar(@ARGV) < 1) {
+	die('Please provide a field name');
+}
+
+my $page_size = POSIX::sysconf(&POSIX::_SC_PAGESIZE);
+my %vm_stats = get_vm_stats();
+
+# Calculate metrics using the stats reported by vmstat(1).
+# Cacti only uses "MemFree" and "SwapFree" at the moment.
+my $value = 0;
+if ($ARGV[0] =~ 'MemTotal') {
+	$value = $vm_stats{'pages managed'};
+} elsif ($ARGV[0] =~ 'MemFree') {
+	$value = $vm_stats{'pages free'};
+} elsif ($ARGV[0] =~ 'Buffers') {
+	$value = $vm_stats{'cached file pages'};
+} elsif ($ARGV[0] =~ 'Cached') {
+	$value = $vm_stats{'anonymous pages'} +
+                 $vm_stats{'cached file pages'} +
+                 $vm_stats{'cached executable pages'};
+} elsif ($ARGV[0] =~ 'SwapTotal') {
+	$value = $vm_stats{'swap pages'};
+} elsif ($ARGV[0] =~ 'SwapFree') {
+	$value = $vm_stats{'swap pages'} -
+                 $vm_stats{'swap pages in use'};
+}
+
+print $value * ($page_size / 1024);
+exit(0);

net/cacti/patches/patch-host.php

@@ -0,0 +1,18 @@
+$NetBSD: patch-host.php,v 1.1 2014/01/08 20:51:28 tron Exp $
+
+Fix vulnerability reported in SA54531. Patch taken from here:
+
+http://svn.cacti.net/viewvc?view=rev&revision=7420
+
+--- host.php.orig	2013-08-07 03:31:19.000000000 +0100
++++ host.php	2014-01-08 20:26:33.000000000 +0000
+@@ -149,6 +149,9 @@
+ 		if ($_POST["snmp_version"] == 3 && ($_POST["snmp_password"] != $_POST["snmp_password_confirm"])) {
+ 			raise_message(4);
+ 		}else{
++			input_validate_input_number(get_request_var_post("id"));
++			input_validate_input_number(get_request_var_post("host_template_id"));
++
+ 			$host_id = api_device_save($_POST["id"], $_POST["host_template_id"], $_POST["description"],
+ 				trim($_POST["hostname"]), $_POST["snmp_community"], $_POST["snmp_version"],
+ 				$_POST["snmp_username"], $_POST["snmp_password"],

net/cacti/patches/patch-install_index.php

@@ -1,12 +1,15 @@
-$NetBSD: patch-install_index.php,v 1.1.1.1 2011/11/22 22:23:13 tez Exp $
+$NetBSD: patch-install_index.php,v 1.2 2014/01/08 20:51:28 tron Exp $
 
-find utilites in PREFIX first
-fixup hard coded user and path (documentaion only)
-make log directory configurable by package variable
+- Find utilites in PREFIX first.
+- Fix-up hard coded user and path (documentaion only).
+- Make log directory configurable by package variable
+- Fix vulnerability reported in SA54531. Patch taken from here:
 
---- install/index.php.orig	2011-09-26 20:41:03.000000000 +0000
-+++ install/index.php
-@@ -95,7 +95,7 @@ function find_best_path($binary_name) {
+  http://svn.cacti.net/viewvc?view=rev&revision=7420
+
+--- install/index.php.orig	2013-08-07 03:31:19.000000000 +0100
++++ install/index.php	2014-01-08 20:26:33.000000000 +0000
+@@ -96,7 +96,7 @@
  	if ($config["cacti_server_os"] == "win32") {
  		$search_paths = array("c:/usr/bin", "c:/cacti", "c:/rrdtool", "c:/spine", "c:/php", "c:/progra~1/php", "c:/net-snmp/bin", "c:/progra~1/net-snmp/bin", "d:/usr/bin", "d:/net-snmp/bin", "d:/progra~1/net-snmp/bin", "d:/cacti", "d:/rrdtool", "d:/spine", "d:/php", "d:/progra~1/php");
  	}else{
@@ -15,7 +18,7 @@ make log directory configurable by package variable
  	}
  
  	for ($i=0; $i<count($search_paths); $i++) {
-@@ -266,7 +266,7 @@ $input["path_cactilog"]["description"] =
+@@ -267,7 +267,7 @@
  if (config_value_exists("path_cactilog")) {
  	$input["path_cactilog"]["default"] = read_config_option("path_cactilog");
  } else {
@@ -24,7 +27,108 @@ make log directory configurable by package variable
  }
  
  /* SNMP Version */
-@@ -652,7 +652,7 @@ if ($_REQUEST["step"] == "4") {
+@@ -310,27 +310,28 @@
+ }
+ 
+ /* pre-processing that needs to be done for each step */
+-if (empty($_REQUEST["step"])) {
+-	$_REQUEST["step"] = 1;
+-}else{
+-	if ($_REQUEST["step"] == "1") {
+-		$_REQUEST["step"] = "2";
+-	}elseif (($_REQUEST["step"] == "2") && ($_REQUEST["install_type"] == "1")) {
+-		$_REQUEST["step"] = "3";
+-	}elseif (($_REQUEST["step"] == "2") && ($_REQUEST["install_type"] == "3")) {
+-		$_REQUEST["step"] = "8";
+-	}elseif (($_REQUEST["step"] == "8") && ($old_version_index <= array_search("0.8.5a", $cacti_versions))) {
+-		$_REQUEST["step"] = "9";
+-	}elseif ($_REQUEST["step"] == "8") {
+-		$_REQUEST["step"] = "3";
+-	}elseif ($_REQUEST["step"] == "9") {
+-		$_REQUEST["step"] = "3";
+-	}elseif ($_REQUEST["step"] == "3") {
+-		$_REQUEST["step"] = "4";
++if (isset($_REQUEST["step"]) && $_REQUEST["step"] > 0) {
++	$step = intval($_REQUEST["step"]);
++	if ($step == "1") {
++		$step = "2";
++	} elseif (($step == "2") && ($_REQUEST["install_type"] == "1")) {
++		$step = "3";
++	} elseif (($step == "2") && ($_REQUEST["install_type"] == "3")) {
++		$step = "8";
++	} elseif (($step == "8") && ($old_version_index <= array_search("0.8.5a", $cacti_versions))) {
++		$step = "9";
++	} elseif ($step == "8") {
++		$step = "3";
++	} elseif ($step == "9") {
++		$step = "3";
++	} elseif ($step == "3") {
++		$step = "4";
+ 	}
++} else {
++	$step = 1;
+ }
+ 
+-if ($_REQUEST["step"] == "4") {
++if ($step == "4") {
+ 	include_once("../lib/data_query.php");
+ 	include_once("../lib/utility.php");
+ 
+@@ -366,7 +367,7 @@
+ 
+ 	header ("Location: ../index.php");
+ 	exit;
+-}elseif (($_REQUEST["step"] == "8") && ($_REQUEST["install_type"] == "3")) {
++}elseif (($step == "8") && ($_REQUEST["install_type"] == "3")) {
+ 	/* if the version is not found, die */
+ 	if (!is_int($old_version_index)) {
+ 		print "	<p style='font-family: Verdana, Arial; font-size: 16px; font-weight: bold; color: red;'>Error</p>
+@@ -505,7 +506,7 @@
+ 				</tr>
+ 				<tr>
+ 					<td width="100%" style="font-size: 12px;">
+-						<?php if ($_REQUEST["step"] == "1") { ?>
++						<?php if ($step == "1") { ?>
+ 
+ 						<p>Thanks for taking the time to download and install cacti, the complete graphing
+ 						solution for your network. Before you can start making cool graphs, there are a few
+@@ -530,7 +531,7 @@
+ 						MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ 						GNU General Public License for more details.</p>
+ 
+-						<?php }elseif ($_REQUEST["step"] == "2") { ?>
++						<?php }elseif ($step == "2") { ?>
+ 
+ 						<p>Please select the type of installation</p>
+ 
+@@ -551,7 +552,7 @@
+ 							print "Server Operating System Type: " . $config["cacti_server_os"] . "<br>"; ?>
+ 						</p>
+ 
+-						<?php }elseif ($_REQUEST["step"] == "3") { ?>
++						<?php }elseif ($step == "3") { ?>
+ 
+ 						<p>Make sure all of these values are correct before continuing.</p>
+ 						<?php
+@@ -609,7 +610,7 @@
+ 						is an upgrade. You can change any of the settings on this screen at a later
+ 						time by going to "Cacti Settings" from within Cacti.</p>
+ 
+-						<?php }elseif ($_REQUEST["step"] == "8") { ?>
++						<?php }elseif ($step == "8") { ?>
+ 
+ 						<p>Upgrade results:</p>
+ 
+@@ -659,7 +660,7 @@
+ 						print $upgrade_results;
+ 						?>
+ 
+-						<?php }elseif ($_REQUEST["step"] == "9") { ?>
++						<?php }elseif ($step == "9") { ?>
+ 
+ 						<p style='font-size: 16px; font-weight: bold; color: red;'>Important Upgrade Notice</p>
+ 
+@@ -667,13 +668,13 @@
  
  						<p>See the sample crontab entry below with the change made in red. Your crontab line will look slightly different based upon your setup.</p>
  
@@ -33,3 +137,19 @@ make log directory configurable by package variable
  
  						<p>Once you have made this change, please click Next to continue.</p>
  
+ 						<?php }?>
+ 
+-						<p align="right"><input type="image" src="install_<?php if ($_REQUEST["step"] == "3") {?>finish<?php }else{?>next<?php }?>.gif" alt="<?php if ($_REQUEST["step"] == "3"){?>Finish<?php }else{?>Next<?php }?>"></p>
++						<p align="right"><input type="image" src="install_<?php if ($step == "3") {?>finish<?php }else{?>next<?php }?>.gif" alt="<?php if ($step == "3"){?>Finish<?php }else{?>Next<?php }?>"></p>
+ 					</td>
+ 				</tr>
+ 			</table>
+@@ -681,7 +682,7 @@
+ 	</tr>
+ </table>
+ 
+-<input type="hidden" name="step" value="<?php print $_REQUEST["step"];?>">
++<input type="hidden" name="step" value="<?php print $step;?>">
+ 
+ </form>
+ 

net/cacti/patches/patch-lib_api_device.php

@@ -0,0 +1,17 @@
+$NetBSD: patch-lib_api_device.php,v 1.1 2014/01/08 20:51:28 tron Exp $
+
+Fix vulnerability reported in SA54531. Patch taken from here:
+
+http://svn.cacti.net/viewvc?view=rev&revision=7420
+
+--- lib/api_device.php.orig	2013-08-07 03:31:18.000000000 +0100
++++ lib/api_device.php	2014-01-08 20:26:33.000000000 +0000
+@@ -107,7 +107,7 @@
+ 		$_host_template_id = db_fetch_cell("select host_template_id from host where id=$id");
+ 	}
+ 
+-	$save["id"] = $id;
++	$save["id"]                   = form_input_validate($id, "id", "^[0-9]+$", false, 3);
+ 	$save["host_template_id"]     = form_input_validate($host_template_id, "host_template_id", "^[0-9]+$", false, 3);
+ 	$save["description"]          = form_input_validate($description, "description", "", false, 3);
+ 	$save["hostname"]             = form_input_validate(trim($hostname), "hostname", "", false, 3);