Security: add and clear mutate QuickTree state through unprotected GET requests #40

Reviewed develop at 87792f2c8b4990ef9fb1ec4cf0c29816211360cb.

quicktree.php accepts state-changing add and clear actions through GET without an endpoint-level method/CSRF check (CWE-352). drp_action=3 also remaps to clear, independently of the original action.

Evidence: action remapping and add insertion, clear deletion, GET add client.

A crafted top-level navigation made by an authenticated QuickTree user can clear that user's queued graphs or add an attacker-selected graph. The selected Cacti host only checks CSRF tokens on POST and its global GET mutation blocklist does not cover add, clear, or this drp_action remapping. Thus simply including auth.php does not protect these routes.

Validation: traced the dispatch, database mutations, client GET call, and host method/CSRF guards. No database writes or deployed requests were made.

Enforce POST plus CSRF validation on the effective action after remapping, before any mutation. Update the add client and clear form accordingly. Cover direct actions and drp_action=3 in regression tests; GET and tokenless requests must leave the queue unchanged.