Security: defense-in-depth audit findings (8 items)

[somethingwithproof]

Defense-in-Depth Audit

An automated security audit identified 8 defense-in-depth opportunities in plugin_monitor.

Breakdown

SQLi(1), Path(5), CSRF(2)

Recommended fixes

• SQLi: Convert string-concatenated SQL to db_execute_prepared() / db_fetch_*_prepared()
• XSS: Wrap get_request_var() in HTML contexts with html_escape_request_var()
• CMD: Verify exec()/shell_exec() args use cacti_escapeshellarg()
• Path: Add realpath() + prefix validation for include/require with variable paths
• Deser: Add array('allowed_classes' => false) to unserialize() calls
• CSRF: Verify forms integrate with Cacti CSRF framework

All recommended changes are PHP 7.0+ compatible.