fix(security): comprehensive bug and security cleanup

[somethingwithproof]

Summary

Security and bug fixes across 7 files. Each fix is minimal and targeted. All files pass php -l lint. Independently reviewed by Grok (xAI) for correctness, regressions, and remaining gaps.

Fixes

CRITICAL

• Prevent syslog_reports table DROP on upgrade. The condition if ($truncate || !$newreport) caused DROP even when truncate was false, destroying user report rules. Changed to if ($truncate) only. (Syslog table drop with no apparent reason #300)

HIGH

• Parameterize domain stripping SQL in syslog_strip_incoming_domains (hardening: parameterize domain stripping update in syslog_strip_incoming_domains #261)
• Wrap RLIKE filter values with db_qstr() in syslog.php to prevent SQL injection via rfilter parameter

MEDIUM

• Add CSV formula injection protection via syslog_csv_safe() helper (hardening: prevent CSV formula injection and malformed CSV output in exports #256)
• Replace eval(onChange) with safe function reference lookup in JS autocomplete (hardening: replace eval-based callback execution in syslog autocomplete JS #260)

LOW

• Parameterize admin CRUD delete/enable/disable functions in syslog_alerts.php, syslog_removal.php, syslog_reports.php using prepared statements (hardening: escape device hostname output in syslog view; parameterize alert API functions #252)
• Fix DST partition boundary calculation using strtotime('+1 day') instead of $time+86400 ([4.0] - Duplicate Partition name errors #199)

Files changed

• setup.php: DROP TABLE condition fix
• functions.php: CSV safe helper, domain stripping parameterization, DST fix
• syslog.php: RLIKE db_qstr wrapping
• syslog_alerts.php: prepared statement CRUD
• syslog_removal.php: prepared statement CRUD
• syslog_reports.php: prepared statement CRUD
• js/functions.js: eval() removal

Test plan

• Upgrade from pre-body-column state: verify syslog_reports table is NOT dropped
• Create/edit/delete alert, removal, and report rules
• Verify domain stripping still works with configured domains
• Export syslog CSV and verify formula-safe output
• Verify syslog filter (rfilter) works with special characters
• Verify JS autocomplete still fires callbacks

Closes #199, #252, #256, #259, #260, #261, #300

[Copilot]

Pull request overview

This PR performs a security hardening and bug-fix sweep across the Syslog plugin, focusing on preventing destructive upgrades, reducing SQL injection surfaces, and removing unsafe client-side execution.

Changes:

• Prevents unintended table drops during setup/upgrade and fixes DST-related partition boundary calculation.
• Hardens several SQL paths by quoting/parameterizing user-controlled inputs and CRUD operations.
• Removes eval() usage from the autocomplete callback flow and introduces CSV-safety scaffolding.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
setup.php	Adjusts syslog_reports drop condition during setup to avoid accidental data loss.
functions.php	Fixes partition boundary calculation and adds a CSV-safety helper (currently problematic).
syslog.php	Wraps RLIKE filter input in db_qstr() to reduce SQL injection risk via rfilter.
syslog_alerts.php	Converts alert rule delete/enable/disable to prepared statements.
syslog_removal.php	Converts removal rule delete/enable/disable to prepared statements.
syslog_reports.php	Converts report rule delete to a prepared statement (but enable/disable still unparameterized).
js/functions.js	Replaces eval() callback execution with function reference lookup.

Comments suppressed due to low confidence (1)

syslog_reports.php:329

• Only api_syslog_report_remove() was converted to a prepared statement. api_syslog_report_disable() and api_syslog_report_enable() still concatenate $id directly into SQL, which is inconsistent with the hardening in this PR and reintroduces an injection surface for future callers. Convert both to syslog_db_execute_prepared(... WHERE id = ?) (and/or intval($id)), matching the other CRUD helpers.

	syslog_db_execute_prepared("DELETE FROM `" . $syslogdb_default . "`.`syslog_reports` WHERE id = ?", array(intval($id)));
}

function api_syslog_report_disable($id) {
	global $syslogdb_default;
	syslog_db_execute('UPDATE `' . $syslogdb_default . "`.`syslog_reports` SET enabled='' WHERE id=" . $id);
}

function api_syslog_report_enable($id) {
	global $syslogdb_default;
	syslog_db_execute('UPDATE `' . $syslogdb_default . "`.`syslog_reports` SET enabled='on' WHERE id=" . $id);
}

[TheWitness]

I'm going to approve this, but we will need to move that escaping to dompurify and change the way the unit tests operate as mentioned separately.

[TheWitness]

Should use dompurify here. It's in the base.

[TheWitness]

Why gmdate()?