security: fix SSRF, command injection, and XSS in core functions (1.2.x)

[somethingwithproof]

Summary

Surgical defense-in-depth fixes. +14/-5 lines, 3 files.

• Validate URL in call_remote_data_collector() rejects :// and @ to prevent SSRF
• Escape $database, $username, $password, $output_file in db_dump_data() exec calls via cacti_escapeshellarg()
• Escape $title in html_start_box() via html_escape() to prevent stored XSS

All three have limited exploitability (admin-only callers, DB-sourced inputs, translated string titles) but are worth hardening per security audit findings.

Test plan

• Verify remote poller communication works
• Verify cli/audit_database.php dump still works
• Verify page headers render correctly (no double-escaping)

[Copilot]

Pull request overview

Defense-in-depth security hardening across core Cacti helpers to reduce risk of stored XSS, SSRF-style URL authority injection, and shell command injection in mysqldump execution paths.

Changes:

• Escape html_start_box() title output to mitigate stored XSS.
• Add URL validation in call_remote_data_collector() to restrict unsafe inputs.
• Shell-escape mysqldump arguments in db_dump_data().

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
lib/html.php	Escapes html_start_box() title output.
lib/functions.php	Adds URL validation before remote collector file_get_contents().
lib/database.php	Escapes selected mysqldump arguments before exec().

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

lib/database.php:2228

• In db_dump_data(), $credentials_string is still built by concatenating raw credential values (e.g. --host, --ssl-ca paths) directly into the shell command. Even with $database/$username/$password/$output_file escaped, this leaves room for shell metacharacters or spaces in those values to break the command (and can reintroduce command injection if any caller passes untrusted credentials). Build $credentials_string using cacti_escapeshellarg() for values (and ensure flags/keys are validated) before interpolating into exec().

	if (cacti_sizeof($credentials)) {
		foreach ($credentials as $key => $value) {
			$name = trim($key);
			if (strstr($name, '--') !== false) {      //name like --host
				if($name == '--password') {
					$password = $value;
				} elseif ($name == '--user') {
					$username = $value;
				} else {
					$credentials_string .= $name . '=' . $value . ' ';
				}
			} elseif(strstr($name, '-') !== false) { //name like -h
				if($name == '-p') {
					$password = $value;
				} elseif ($name == '-u') {
					$username = $value;
				} else {
					$credentials_string .= $name . $value . ' ';
				}
			} else {                                  //name like host
				if($name == 'password') {
					$password = $value;
				} elseif ($name == 'user') {
					$username = $value;
				} else {
					$credentials_string .= '--' . $name . '=' . $value . ' ';
				}