hardening(slowlog): escape drp_action before HTML attribute output

[somethingwithproof]

Summary

slowlog.php:204 reflects the drp_action POST parameter into an HTML attribute without escaping. An authenticated user can craft a POST request that injects JavaScript into the action confirmation page.

Details

Field	Value
File	slowlog.php
Line	204
Auth required	Yes — authenticated Cacti user
CWE	CWE-79

// Before
echo "<input type='hidden' name='drp_action' value='" . $_POST['drp_action'] . "'>";

// After
echo "<input type='hidden' name='drp_action' value='" . html_escape(get_filter_request_var('drp_action')) . "'>";

Fix applied in branch security/slowlog-escape-drp-action.

Acceptance criteria

• html_escape() applied to drp_action before output at line 204
• get_filter_request_var() used instead of raw $_POST access
• Regression test in tests/Security/SlowlogXssTest.php

[somethingwithproof]

Closing public issue — moving to private security advisory per responsible disclosure policy.