Cacti · somethingwithproof · Apr 9, 2026 · Apr 9, 2026 · Apr 10, 2026 · Apr 10, 2026
diff --git a/.gitignore b/.gitignore
@@ -21,4 +21,5 @@
 
 *.swp
 .DS_Store
+.omc/
 locales/po/*.mo
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,27 @@
+# Security Policy
+
+## Supported Versions
+
+This plugin follows the Cacti project's support policy. Security fixes are
+applied to the current development branch and backported per project policy.
+
+## Reporting a Vulnerability
+
+Report security vulnerabilities via the Cacti project's private security
+disclosure process:
+
+- GitHub Security Advisories: https://github.com/Cacti/plugin_webseer/security/advisories
+- Do NOT open public issues for security vulnerabilities.
+
+Please include:
+- Description of the vulnerability
+- Steps to reproduce
+- Affected versions
+- Suggested remediation (if known)
+
+A maintainer will acknowledge the report within 72 hours and provide a
+remediation timeline.
+
+## Security Hardening Notes
+
+See SECURITY-AUDIT.md for the current known finding backlog and remediation status.
diff --git a/classes/cURL.php b/classes/cURL.php
@@ -1,4 +1,6 @@
 <?php
+
+declare(strict_types=1);
 /*
  +-------------------------------------------------------------------------+
  | Copyright (C) 2004-2026 The Cacti Group                                 |
@@ -83,22 +85,22 @@ function cookie($cookie_file) {
 		}
 	}
 
-	function post($url, $data = array()) {
+	function post($url, $data = []) {
 		global $httpcompressions;
 
 		$this->debug('Executing Post Request');
 
 		$process = curl_init($url);
 		$this->headers[] = 'Content-type: application/x-www-form-urlencoded;charset=UTF-8';
 
-		$d = array();
+		$d = [];
 		foreach ($data as $i => $j) {
 			$d[] = "$i=$j";
 		}
 
 		$data = implode('&', $d);
 
-		$options = array(
+		$options = [
 			CURLOPT_HTTPHEADER => $this->headers,
 			CURLOPT_HEADER => true,
 			CURLOPT_USERAGENT => $this->user_agent,
@@ -107,7 +109,7 @@ function post($url, $data = array()) {
 			CURLOPT_RETURNTRANSFER => true,
 			CURLOPT_FOLLOWLOCATION => true,
 			CURLOPT_POST => true,
-		);
+		];
 
 		if (!empty($this->compression)) {
 			$options[CURLOPT_ENCODING] = $httpcompressions[$this->compression];
@@ -175,38 +177,38 @@ function get() {
 
 			$is_https = (substr(strtolower($url), 0, 5) == 'https');
 
-			$proxy_opts = array(
+			$proxy_opts = [
 				CURLOPT_UNRESTRICTED_AUTH => true,
 				CURLOPT_PROXY             => $this->proxy_hostname,
 				CURLOPT_PROXYPORT         => $is_https ? $port_https : $port_http,
-			);
+			];
 
 			if ($this->proxy_username != '') {
 				$proxy_opts[CURLOPT_PROXYUSERPWD] = $this->proxy_username . ':' . $this->proxy_password;
 			}
 		} else {
-			$proxy_opts = array();
+			$proxy_opts = [];
 		}
 
 		// Disable Cert checking for now
 		if ($this->host['checkcert'] == '') {
-			$cert_opts = array(
+			$cert_opts = [
 				CURLOPT_SSL_VERIFYPEER => FALSE,
 				CURLOPT_SSL_VERIFYHOST => FALSE,
-			);
+			];
 		} else {
-			$cert_opts = array();
+			$cert_opts = [];
 		}
 
 		$options += $proxy_opts;
 		$options += $cert_opts;
 
 		$this->debug('cURL options: ' . clean_up_lines(var_export($options, true)));
-		curl_setopt_array($process,$options);
+		curl_setopt_array($process, $options);
 
 		$data = curl_exec($process);
 
-		$this->data = str_replace(array("'", "\\"), array(''), $data);
+		$this->data = str_replace(["'", "\\"], [''], $data);
 
 		$this->results['options'] = curl_getinfo($process);
 		$this->results['options']['compression'] = $this->compression;
@@ -222,7 +224,7 @@ function get() {
 			case 0:
 				break;
 			default:
-				$this->results['error'] = 'HTTP ERROR: ' . str_replace(array('"', "'"), '', (curl_error($process)));
+				$this->results['error'] = 'HTTP ERROR: ' . str_replace(['"', "'"], '', (curl_error($process)));
 
 				break;
 		}

diff --git a/classes/index.php b/classes/index.php
@@ -1,4 +1,6 @@
 <?php
+
+declare(strict_types=1);
 /*
  +-------------------------------------------------------------------------+
  | Copyright (C) 2004-2026 The Cacti Group                                 |

diff --git a/classes/mxlookup.php b/classes/mxlookup.php
@@ -1,4 +1,6 @@
 <?php
+
+declare(strict_types=1);
 /*
  +-------------------------------------------------------------------------+
  | Copyright (C) 2004-2026 The Cacti Group                                 |
@@ -28,7 +30,7 @@ class mxlookup {
 	var $dns_packet = NULL;
 	var $ANCOUNT    = 0;
 	var $cIx        = 0;
-	var $arrMX      = array();
+	var $arrMX      = [];
 	var $dns_repl_domain;
 
 	function __construct($domain, $dns = '4.2.2.1') {
@@ -67,7 +69,7 @@ function __construct($domain, $dns = '4.2.2.1') {
 
 			//$mxPref = ord($this->gdi($this->cIx));
 			//$this->parse_data($curmx);
-			//$this->arrMX[] = array('MX_Pref' => $mxPref, 'MX' => $curmx);
+			//$this->arrMX[] = ['MX_Pref' => $mxPref, 'MX' => $curmx];
 			//$this->cIx += 3;
 		}
 	}
@@ -77,7 +79,7 @@ function __destruct() {
 	}
 
 	function parse_data(&$retval) {
-		$arName = array();
+		$arName = [];
 		$byte   = ord($this->gdi($this->cIx));
 
 		while($byte !== 0) {

diff --git a/images/index.php b/images/index.php
@@ -1,4 +1,6 @@
 <?php
+
+declare(strict_types=1);
 /*
  +-------------------------------------------------------------------------+
  | Copyright (C) 2004-2026 The Cacti Group                                 |

diff --git a/includes/arrays.php b/includes/arrays.php
@@ -1,4 +1,6 @@
 <?php
+
+declare(strict_types=1);
 /*
  +-------------------------------------------------------------------------+
  | Copyright (C) 2004-2026 The Cacti Group                                 |
@@ -74,7 +76,7 @@
 	505 => 'HTTP Version Not Supported',
 );
 
-$httpcompressions = array(
+$httpcompressions = [
 	0  => '',
 	1  => 'aes128gcm',
 	2  => 'br',
@@ -87,7 +89,7 @@
 	9  => 'x-compress',
 	10 => 'x-gzip',
 	11 => 'zstd',
-);
+];
 
 $webseer_minutes = array(
 	1  => __('%d Minute', 1, 'webseer'),
@@ -113,10 +115,10 @@
 	10 => __('%d Seconds', 10, 'webseer'),
 );
 
-$webseer_notify_formats = array(
+$webseer_notify_formats = [
 	WEBSEER_FORMAT_HTML  => 'html',
 	WEBSEER_FORMAT_PLAIN => 'plain',
-);
+];
 
 if (db_table_exists('plugin_webseer_contacts')) {
 	$webseer_contact_users = db_fetch_assoc("SELECT pwc.id, pwc.data, pwc.type, ua.full_name
@@ -125,10 +127,10 @@
 		ON ua.id=pwc.user_id
 		WHERE pwc.data != ''");
 } else {
-	$webseer_contact_users = array();
+	$webseer_contact_users = [];
 }
 
-$webseer_notify_accounts = array();
+$webseer_notify_accounts = [];
 if (!empty($webseer_contact_users)) {
 	foreach ($webseer_contact_users as $webseer_contact_user) {
 		$webseer_notify_accounts[$webseer_contact_user['id']] = $webseer_contact_user['full_name'] . ' - ' . ucfirst($webseer_contact_user['type']);
@@ -211,14 +213,14 @@
 		'size' => '40',
 		'default' => ''
 	),
-	'id' => array(
+	'id' => [
 		'method' => 'hidden_zero',
 		'value' => '|arg1:id|'
-	),
-	'save_component_proxy' => array(
+	],
+	'save_component_proxy' => [
 		'method' => 'hidden',
 		'value' => '1'
-	)
+	]
 );
 
 $webseer_server_fields = array(
@@ -275,10 +277,10 @@
 		'value' => '|arg1:location|',
 		'max_length' => '256',
 	),
-	'id' => array(
+	'id' => [
 		'method' => 'hidden_zero',
 		'value' => '|arg1:id|'
-	),
+	],
 );
 
 $webseer_url_fields = array(
@@ -433,8 +435,8 @@
 		'description' => __('You may specify here extra Emails to receive alerts for this URL (comma separated)', 'webseer'),
 		'value' => '|arg1:notify_extra|',
 	),
-	'id' => array(
+	'id' => [
 		'method' => 'hidden_zero',
 		'value' => '|arg1:id|'
-	),
+	],
 );
diff --git a/includes/constants.php b/includes/constants.php
@@ -1,4 +1,6 @@
 <?php
+
+declare(strict_types=1);
 /*
  +-------------------------------------------------------------------------+
  | Copyright (C) 2004-2026 The Cacti Group                                 |
-Original file line number
+Diff line change
@@ Expand Up / @@ -21,4 +21,5 @@ @@
     *.swp
     .DS_Store
+    .omc/
     locales/po/*.mo