Skip to content

Multiple Fixes: Range Pruning, Callback Execution, Early Rotation, CSV Export Hardening, Prepared Statements, SQL Readability #313

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheWitness merged 11 commits into from
Apr 10, 2026
Merged

Multiple Fixes: Range Pruning, Callback Execution, Early Rotation, CSV Export Hardening, Prepared Statements, SQL Readability #313

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
5d28295
fix: Rotate Partition Early - CSV Export
TheWitness Apr 10, 2026
d7eec70
fix: Increase readability of SQL statements
TheWitness Apr 10, 2026
2ddef96
fix: Error in syslog displaying rows
TheWitness Apr 10, 2026
91bcf64
fix: Multiple fixes
TheWitness Apr 10, 2026
29114fb
fix: Copilot reviews
TheWitness Apr 10, 2026
12e8a37
fixes: Copilot reviews
TheWitness Apr 10, 2026
18aa3f4
fix: Make partition reorganization work with TO_DAYS legacy
TheWitness Apr 10, 2026
210dd0f
fix: Copilot reviews
TheWitness Apr 10, 2026
6278cf9
fix: Missed DOMPurify fix
TheWitness Apr 10, 2026
495c2e3
fix: More copilot comments
TheWitness Apr 10, 2026
a58d099
fix: Copilot review
TheWitness Apr 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
525 changes: 291 additions & 234 deletions functions.php
View file
Open in desktop

Large diffs are not rendered by default.

22 changes: 20 additions & 2 deletions js/functions.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,7 +225,7 @@ function initSyslogMain(config) {

$.each(data, function(index, hostData) {
if ($('#host option[value="'+index+'"]').length == 0) {
$('#host').append('<option class="'+hostData.class+'" value="'+index+'">'+hostData.host+'</option>');
$('#host').append('<option class="'+DOMPurify.sanitize(hostData.class)+'" value="'+DOMPurify.sanitize(index)+'">'+DOMPurify.sanitize(hostData.host)+'</option>');
}
});

Expand Down Expand Up @@ -580,6 +580,18 @@ function initSyslogReports() {
* Autocomplete Form Callback Functions
* ======================================================================== */

function syslogExecuteFunctionByName(functionName, context /*, args */) {
var args = Array.prototype.slice.call(arguments, 2);
var namespaces = functionName.split('.');
var func = namespaces.pop();

for(var i = 0; i < namespaces.length; i++) {
context = context[namespaces[i]];
}

return context[func].apply(context, args);
}

/**
* Initialize autocomplete for form dropdown fields
* @param {string} formName - The name of the form field
Expand All @@ -598,13 +610,19 @@ function initSyslogAutocomplete(formName, callback, onChange) {
minLength: 0,
select: function(event, ui) {
$('#' + formName + '_input').val(ui.item.label);

if (ui.item.id) {
$('#' + formName).val(ui.item.id);
} else {
$('#' + formName).val(ui.item.value);
}

if (onChange) {
eval(onChange);
$(this).autocomplete('close');

onChange = onChange.replace('(', '').replace(')', '');

syslogExecuteFunctionByName(onChange, window);
}
}
}).css('border', 'none').css('background-color', 'transparent');
Expand Down
114 changes: 59 additions & 55 deletions setup.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ function plugin_syslog_install() {

syslog_connect();

$syslog_exists = sizeof(syslog_db_fetch_row('SHOW TABLES FROM `' . $syslogdb_default . "` LIKE 'syslog'"));
$syslog_exists = sizeof(syslog_db_fetch_row("SHOW TABLES FROM `$syslogdb_default` LIKE 'syslog'"));

// ================= input validation =================
get_filter_request_var('days');
Expand Down Expand Up @@ -122,23 +122,23 @@ function plugin_syslog_uninstall() {
if (isset_request_var('uninstall_method')) {
if (get_nfilter_request_var('uninstall_method') == 'all') {
// do the big tables first
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog`');
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_removed`');
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog`");
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_removed`");

// do the settings tables last
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_incoming`');
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_alert`');
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_remove`');
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_reports`');
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_facilities`');
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_statistics`');
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_host_facilities`');
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_priorities`');
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_logs`');
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_hosts`');
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_incoming`");
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_alert`");
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_remove`");
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_reports`");
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_facilities`");
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_statistics`");
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_host_facilities`");
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_priorities`");
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_logs`");
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_hosts`");
} else {
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog`');
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_removed`');
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog`");
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_removed`");
}
} elseif (function_exists('syslog_uninstall_advisor')) {
syslog_uninstall_advisor();
Expand Down Expand Up @@ -440,12 +440,12 @@ function syslog_create_partitioned_syslog_table($engine = 'InnoDB', $days = 30)
$row_format = 'ROW_FORMAT=Dynamic';
}

$sql = 'CREATE TABLE IF NOT EXISTS `' . $syslogdb_default . "`.`syslog` (
$sql = "CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog` (
facility_id int(10) unsigned default NULL,
priority_id int(10) unsigned default NULL,
program_id int(10) unsigned default NULL,
host_id int(10) unsigned default NULL,
logtime DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00',
logtime timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
message varchar(1024) NOT NULL default '',
seq bigint unsigned NOT NULL auto_increment,
PRIMARY KEY(seq, logtime),
Expand All @@ -457,20 +457,24 @@ function syslog_create_partitioned_syslog_table($engine = 'InnoDB', $days = 30)
INDEX facility_id (facility_id))
ENGINE=$engine
$row_format
PARTITION BY RANGE (TO_DAYS(logtime))\n";
PARTITION BY RANGE (UNIX_TIMESTAMP(logtime))\n";

$now = time();

$parts = '';

for ($i = $days; $i >= -1; $i--) {
$timestamp = $now - ($i * 86400);
$date = date('Y-m-d', $timestamp);
$format = date('Ymd', $timestamp - 86400);
$parts .= ($parts != '' ? ",\n" : '(') . ' PARTITION d' . $format . " VALUES LESS THAN (TO_DAYS('" . $date . "'))";
$date = gmdate('Y-m-d', $timestamp);
$format = gmdate('Ymd', strtotime('- 1 day', $timestamp));

$parts .= ($parts != '' ? ",\n" : '(') . ' PARTITION d' . $format . " VALUES LESS THAN (UNIX_TIMESTAMP('" . $date . "'))";
}

$parts .= ",\nPARTITION dMaxValue VALUES LESS THAN MAXVALUE);";

//cacti_log($sql . $parts);

syslog_db_execute($sql . $parts);
}

Expand Down Expand Up @@ -521,7 +525,7 @@ function syslog_setup_table_new($options) {
$truncate = isset($options['upgrade_type']) && $options['upgrade_type'] == 'truncate' ? true : false;
$engine = isset($options['engine']) && $options['engine'] == 'innodb' ? 'InnoDB' : $options['engine'];
$partitioned = isset($options['db_type']) && $options['db_type'] == 'part' ? true : false;
$syslogexists = sizeof(syslog_db_fetch_row('SHOW TABLES FROM `' . $syslogdb_default . "` LIKE 'syslog'"));
$syslogexists = sizeof(syslog_db_fetch_row("SHOW TABLES FROM `$syslogdb_default` LIKE 'syslog'"));

// set table construction settings for the remote pollers
set_config_option('syslog_install_upgrade_type', empty($options['upgrade_type']) ? '' : $options['upgrade_type'], true);
Expand All @@ -530,7 +534,7 @@ function syslog_setup_table_new($options) {
set_config_option('syslog_install_days', empty($options['days']) ? '' : $options['days'], true);

if ($truncate) {
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog`');
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog`");
}

if (stripos($engine, 'aria') !== false) {
Expand All @@ -540,7 +544,7 @@ function syslog_setup_table_new($options) {
}

if (!$partitioned) {
syslog_db_execute('CREATE TABLE IF NOT EXISTS `' . $syslogdb_default . "`.`syslog` (
syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog` (
facility_id int(10) unsigned default NULL,
priority_id int(10) unsigned default NULL,
program_id int(10) unsigned default NULL,
Expand All @@ -562,10 +566,10 @@ function syslog_setup_table_new($options) {
}

if ($truncate) {
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_alert`');
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_alert`");
}

syslog_db_execute('CREATE TABLE IF NOT EXISTS `' . $syslogdb_default . "`.`syslog_alert` (
syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_alert` (
`id` int(10) NOT NULL auto_increment,
`hash` varchar(32) NOT NULL default '',
`name` varchar(255) NOT NULL default '',
Expand All @@ -589,10 +593,10 @@ function syslog_setup_table_new($options) {
ENGINE=InnoDB");

if ($truncate) {
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_incoming`');
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_incoming`");
}

syslog_db_execute('CREATE TABLE IF NOT EXISTS `' . $syslogdb_default . "`.`syslog_incoming` (
syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_incoming` (
facility_id int(10) unsigned default NULL,
priority_id int(10) unsigned default NULL,
program varchar(40) default NULL,
Expand All @@ -608,10 +612,10 @@ function syslog_setup_table_new($options) {
ROW_FORMAT=Dynamic");

if ($truncate) {
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_remove`');
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_remove`");
}

syslog_db_execute('CREATE TABLE IF NOT EXISTS `' . $syslogdb_default . "`.`syslog_remove` (
syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_remove` (
id int(10) NOT NULL auto_increment,
`hash` varchar(32) NOT NULL default '',
name varchar(255) NOT NULL default '',
Expand All @@ -626,19 +630,19 @@ function syslog_setup_table_new($options) {
ENGINE=$engine
$row_format");

$present = syslog_db_fetch_row('SHOW TABLES FROM `' . $syslogdb_default . "` LIKE 'syslog_reports'");
$present = syslog_db_fetch_row("SHOW TABLES FROM `$syslogdb_default` LIKE 'syslog_reports'");

if (cacti_sizeof($present)) {
$newreport = sizeof(syslog_db_fetch_row('SHOW COLUMNS FROM `' . $syslogdb_default . "`.`syslog_reports` LIKE 'body'"));
$newreport = sizeof(syslog_db_fetch_row("SHOW COLUMNS FROM `$syslogdb_default`.`syslog_reports` LIKE 'body'"));
} else {
$newreport = true;
}

if ($truncate || !$newreport) {
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_reports`');
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_reports`");
}

syslog_db_execute('CREATE TABLE IF NOT EXISTS `' . $syslogdb_default . "`.`syslog_reports` (
syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_reports` (
id int(10) NOT NULL auto_increment,
`hash` varchar(32) NOT NULL default '',
name varchar(255) NOT NULL default '',
Expand All @@ -659,10 +663,10 @@ function syslog_setup_table_new($options) {
ROW_FORMAT=Dynamic");

if ($truncate) {
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_hosts`');
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_hosts`");
}

syslog_db_execute('CREATE TABLE IF NOT EXISTS `' . $syslogdb_default . "`.`syslog_programs` (
syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_programs` (
`program_id` int(10) unsigned NOT NULL auto_increment,
`program` VARCHAR(40) NOT NULL,
`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
Expand All @@ -673,7 +677,7 @@ function syslog_setup_table_new($options) {
ROW_FORMAT=Dynamic
COMMENT='Contains all programs currently in the syslog table'");

syslog_db_execute('CREATE TABLE IF NOT EXISTS `' . $syslogdb_default . "`.`syslog_hosts` (
syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_hosts` (
`host_id` int(10) unsigned NOT NULL auto_increment,
`host` VARCHAR(64) NOT NULL,
`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
Expand All @@ -684,52 +688,52 @@ function syslog_setup_table_new($options) {
ROW_FORMAT=Dynamic
COMMENT='Contains all hosts currently in the syslog table'");

syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_facilities`');
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_facilities`");

syslog_db_execute('CREATE TABLE IF NOT EXISTS `' . $syslogdb_default . '`.`syslog_facilities` (
syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_facilities` (
`facility_id` int(10) unsigned NOT NULL,
`facility` varchar(10) NOT NULL,
`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
PRIMARY KEY (`facility_id`),
INDEX last_updated (`last_updated`))
ENGINE=InnoDB
ROW_FORMAT=Dynamic');
ROW_FORMAT=Dynamic");

syslog_db_execute('INSERT INTO `' . $syslogdb_default . "`.`syslog_facilities` (facility_id, facility) VALUES
syslog_db_execute("INSERT INTO `$syslogdb_default`.`syslog_facilities` (facility_id, facility) VALUES
(0,'kern'), (1,'user'), (2,'mail'), (3,'daemon'), (4,'auth'), (5,'syslog'), (6,'lpd'), (7,'news'),
(8,'uucp'), (9,'crond'), (10,'authpriv'), (11,'ftpd'), (12,'ntpd'), (13,'logaudit'), (14,'logalert'),
(15,'crond'), (16,'local0'), (17,'local1'), (18,'local2'), (19,'local3'), (20,'local4'), (21,'local5'),
(22,'local6'), (23,'local7');");
(22,'local6'), (23,'local7')");

syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_priorities`');
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_priorities`");

syslog_db_execute('CREATE TABLE IF NOT EXISTS `' . $syslogdb_default . '`.`syslog_priorities` (
syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_priorities` (
`priority_id` int(10) unsigned NOT NULL,
`priority` varchar(10) NOT NULL,
`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
PRIMARY KEY (`priority_id`),
INDEX last_updated (`last_updated`))
ENGINE=InnoDB
ROW_FORMAT=Dynamic');
ROW_FORMAT=Dynamic");

syslog_db_execute('INSERT INTO `' . $syslogdb_default . "`.`syslog_priorities` (priority_id, priority) VALUES
(0,'emerg'), (1,'alert'), (2,'crit'), (3,'err'), (4,'warning'), (5,'notice'), (6,'info'), (7,'debug'), (8,'other');");
syslog_db_execute("INSERT INTO `$syslogdb_default`.`syslog_priorities` (priority_id, priority) VALUES
(0,'emerg'), (1,'alert'), (2,'crit'), (3,'err'), (4,'warning'), (5,'notice'), (6,'info'), (7,'debug'), (8,'other')");

syslog_db_execute('CREATE TABLE IF NOT EXISTS `' . $syslogdb_default . '`.`syslog_host_facilities` (
syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_host_facilities` (
`host_id` int(10) unsigned NOT NULL,
`facility_id` int(10) unsigned NOT NULL,
`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
PRIMARY KEY (`host_id`,`facility_id`))
ENGINE=InnoDB
ROW_FORMAT=Dynamic');
ROW_FORMAT=Dynamic");

if ($truncate) {
syslog_db_execute('DROP TABLE IF EXISTS `' . $syslogdb_default . '`.`syslog_removed`');
syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_removed`");
}

syslog_db_execute('CREATE TABLE IF NOT EXISTS `' . $syslogdb_default . '`.`syslog_removed` LIKE `' . $syslogdb_default . '`.`syslog`');
syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_removed` LIKE `$syslogdb_default`.`syslog`");

syslog_db_execute('CREATE TABLE IF NOT EXISTS `' . $syslogdb_default . "`.`syslog_logs` (
syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_logs` (
alert_id int(10) unsigned not null default '0',
logseq bigint unsigned NOT NULL,
logtime TIMESTAMP NOT NULL default '0000-00-00 00:00:00',
Expand All @@ -752,7 +756,7 @@ function syslog_setup_table_new($options) {
ENGINE=InnoDB
ROW_FORMAT=Dynamic");

syslog_db_execute('CREATE TABLE IF NOT EXISTS `' . $syslogdb_default . "`.`syslog_statistics` (
syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_statistics` (
`id` bigint UNSIGNED auto_increment,
`host_id` int(10) UNSIGNED NOT NULL,
`facility_id` int(10) UNSIGNED NOT NULL,
Expand All @@ -769,7 +773,7 @@ function syslog_setup_table_new($options) {
INDEX `insert_time`(`insert_time`))
ENGINE=InnoDB
ROW_FORMAT=Dynamic
COMMENT='Maintains High Level Statistics';");
COMMENT='Maintains High Level Statistics'");

if (!isset($settings['syslog'])) {
syslog_config_settings();
Expand Down Expand Up @@ -1023,7 +1027,7 @@ function syslog_uninstall_advisor() {

syslog_connect();

$syslog_exists = sizeof(syslog_db_fetch_row('SHOW TABLES FROM `' . $syslogdb_default . "` LIKE 'syslog'"));
$syslog_exists = sizeof(syslog_db_fetch_row("SHOW TABLES FROM `$syslogdb_default` LIKE 'syslog'"));

top_header();

Expand Down
Loading
Loading