Your message dated Sun, 26 Jul 2026 13:34:19 +0000
with message-id <[email protected]>
and subject line Bug#1142799: fixed in cacti 1.2.31+ds1-2
has caused the Debian Bug report #1142799,
regarding cacti: script server datasources broken in 1.2.31
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1142799: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142799
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: cacti
Version: 1.2.31+ds1-1
Severity: normal
Tags: patch
As part of security fixes in 1.2.31 the realpath for script servers was
limited to `base_path` (/usr/share/cacti/site/scripts/). Debian symlinks
that to /var/lib/cacti/scripts so the security check fails.
Upstream has fixed this with commit 7015c26
(https://github.com/Cacti/cacti/pull/7320) which allows scripts to also
reside in `scripts_path`.
Please consider applying the fix (and adding script_path to
the default debian config) as a patch.
Thanks
Norman
-- System Information:
Debian Release: forky/sid
APT prefers testing
APT policy: (700, 'testing'), (500, 'stable-updates'), (500,
'stable-security')
Architecture: i386 (i686)
Kernel: Linux 6.10.11-686-pae (SMP w/4 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages cacti depends on:
ii composer 2.10.2-1
ii dbconfig-common 2.0.26
ii dbconfig-mysql 2.0.26
ii debconf [debconf-2.0] 1.5.92
ii fonts-dejavu-core 2.37-9
ii fonts-dejavu-extra 2.37-9
ii javascript-common 12+nmu1
ii libapache2-mod-php 2:8.4+99
ii libapache2-mod-php8.4 [php-json] 8.4.23-1
ii libjs-chart.js 3.9.1+~cs3.1.2-3
ii libjs-jquery 3.7.1+dfsg+~3.5.33-1
ii libjs-jquery-colorpicker 1.2.20-4
ii libjs-jquery-cookie 12-4
ii libjs-jquery-hotkeys 0.2.0-1
ii libjs-jquery-jstree 3.3.17+dfsg1-1
ii libjs-jquery-metadata 12-4
ii libjs-jquery-tablesorter 1:2.31.3+dfsg1-5
ii libjs-jquery-timepicker 1.6.3-6
ii libjs-jquery-ui 1.13.2+dfsg-1
ii libjs-jquery-ui-theme-smoothness 1.14.2+dfsg-1
ii libjs-jquery-ui-theme-south-street 1.14.2+dfsg-1
ii libjs-jquery-ui-theme-ui-darkness 1.14.2+dfsg-1
ii libjs-jquery-ui-touch-punch 0.0~git20141218.2.4bc0091+dfsg1-4.1
ii libphp-phpmailer 7.1.1-1
ii node-d3 5.16.0+~cs5.28.10-3
ii node-dompurify 3.4.12+dfsg-1
ii node-fortawesome-fontawesome-free 7.3.0+ds1-1
ii node-ua-parser-js 0.8.1+ds+~0.7.36-3
ii perl 5.40.1-8
ii php 2:8.4+99
pn php-cli <none>
ii php-gd 2:8.4+99
ii php-gmp 2:8.4+99
ii php-json 2:8.4+99
ii php-ldap 2:8.4+99
ii php-mbstring 2:8.4+99
ii php-mysql 2:8.4+99
ii php-phpmyadmin-motranslator 5.4.0-3
ii php-phpseclib3 3.0.55-1
ii php-snmp 2:8.4+99
ii php-twig 3.27.1-1
ii php-xml 2:8.4+99
ii php8.4 [php] 8.4.23-1
ii php8.4-cgi [php-json] 8.4.23-1
ii php8.4-cli [php-json] 8.4.23-1
ii php8.4-gd [php-gd] 8.4.23-1
ii php8.4-gmp [php-gmp] 8.4.23-1
ii php8.4-ldap [php-ldap] 8.4.23-1
ii php8.4-mbstring [php-mbstring] 8.4.23-1
ii php8.4-snmp [php-snmp] 8.4.23-1
ii php8.4-xml [php-xml] 8.4.23-1
ii rrdtool 1.9.0-2.1
ii snmp 5.9.5.2+dfsg-2.1+b1
ii ucf 3.0056
Versions of packages cacti recommends:
ii apache2 [httpd] 2.4.68-1
ii default-mysql-server 1.1.1
ii iputils-ping 3:20250605-1
ii logrotate 3.22.0-1
ii mariadb-server [virtual-mysql-server] 1:11.8.8-1
Versions of packages cacti suggests:
pn cacti-spine <none>
ii moreutils 0.70-1
ii snmpd 5.9.5.2+dfsg-2.1+b1
-- debconf information excluded
--- End Message ---
--- Begin Message ---
Source: cacti
Source-Version: 1.2.31+ds1-2
Done: Paul Gevers <[email protected]>
We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Paul Gevers <[email protected]> (supplier of updated cacti package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 26 Jul 2026 14:44:20 +0200
Source: cacti
Architecture: source
Version: 1.2.31+ds1-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Commons <[email protected]>
Changed-By: Paul Gevers <[email protected]>
Closes: 1142799
Changes:
cacti (1.2.31+ds1-2) unstable; urgency=medium
.
* Add 0001-fix-allow-configured-external-script-root-in-script-.patch
(Closes: #1142799)
Checksums-Sha1:
9d001241fe5745b418263a6df72783dba47b7ac9 2455 cacti_1.2.31+ds1-2.dsc
72e9bb965a8928bbb68a731c65de3dba752d295a 61068 cacti_1.2.31+ds1-2.debian.tar.xz
Checksums-Sha256:
1f226f77454d023648dedd263618b81e5a8e338f99abc7e5ee6c85189e025a94 2455
cacti_1.2.31+ds1-2.dsc
38bfedeeff49dfe40ffef7844da2d956d46c4773f8db40160d9eb71979afe30a 61068
cacti_1.2.31+ds1-2.debian.tar.xz
Files:
a77210a95d08bc0d842dab02d117f20d 2455 web optional cacti_1.2.31+ds1-2.dsc
5d60a5e216765d34fb69bb72672c41f2 61068 web optional
cacti_1.2.31+ds1-2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEG5OTVaxMNcrfvXOcBqMo4AxqzhUFAmpmCMMACgkQBqMo4Axq
zhWFhw/8CGKdQ8ViFswMdJjBlTzW0OHLOm5y6P3prET7FyKfTddDDVkQBJQC0g/4
kJAm+tHuC5Jgm1ApWqrBJaEbv/o0LpTkx6PIBrnhxmaiGt5GVdYklnqS8BgHFtGe
ML+gqv6qIqiwHMIkW15AnIO4tpV7UY1LqwGf7A1nwGWJ2/1cYthkP6CnpJO9InM3
+2tFE5qQOJuIjLoaiV79u1SYI4tHkbwSpANZunypKQ/D6MHAExx3YfhhFSlfyZTc
tQbjZv4KFn18L4TgGElBZzdQp7DgVh9PsCCvbIWtp9fxyH3e7KMFZs+VqGk71WOu
Y+P0Z+xhj6wuXnm4zGKRCYWVsVIRvNQo2fJp7Rp+2huywZ2tgYjJgOj2QfA7b0Jf
9RIRIXJ1oFQRqGI2g3USITM+mW538tCR6+edTBlh35Rv5f64x5P76kDWaqhj30Oa
m6L3XmTwymSEJel+PlaS5TWNo5G7c/V1HNm8Pu2jNBruxcTSV5ulRTvATojNafeF
ZupypT8Q66gEFVLVI3CqNtE9y9jizNOSzbpNvhV/KD278m6hDCr7/iikGWz3ybk6
xwvcRQbCNypJ408xYgq+Jf4mt73ZdhB74SZqOyWYilO3R8SHQFLv3uMXU7z9pjcg
75EtMy8jOfvLDfy+LmYl6+GMX8qupBn37nxtwVAxxuORBvysQ/w=
=OZxS
-----END PGP SIGNATURE-----
pgpcNcbdPrvdg.pgp
Description: PGP signature
--- End Message ---
