fix: correct host/program alert status placeholders

Refs Cacti#266

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Author: somethingwithproof

.github/workflows/plugin-ci-workflow.yml

@@ -187,6 +187,16 @@ jobs:
           echo "Syntax errors found!"
           exit 1
         fi
+
+    - name: Run Plugin Regression Tests
+      run: |
+        cd ${{ github.workspace }}/cacti/plugins/syslog
+        if [ -d tests/regression ]; then
+          for test in tests/regression/*.php; do
+            [ -f "$test" ] || continue
+            php "$test"
+          done
+        fi
     
 
     - name: Run Cacti Poller

CHANGELOG.md

@@ -3,6 +3,7 @@
 --- develop ---
 
 * issue#250: Fix date filter persistence by validating before shift_span detection
+* issue#253: Correct host/program alert SQL placeholder handling
 * issue: Making changes to support Cacti 1.3
 * issue: Don't use MyISAM for non-analytical tables
 * issue: The install advisor for Syslog was broken in current Cacti releases

functions.php

@@ -1667,15 +1667,15 @@ function syslog_get_alert_sql(&$alert, $uniqueID) {
 		$sql = 'SELECT *
 			FROM `' . $syslogdb_default . '`.`syslog_incoming`
 			WHERE `' . $syslog_incoming_config['hostField'] . '` = ?
-			AND `status` = ?' . $uniqueID;
+			AND `status` = ?';
 
 		$params[] = $alert['message'];
 		$params[] = $uniqueID;
 	} elseif ($alert['type'] == 'program') {
 		$sql = 'SELECT *
 			FROM `' . $syslogdb_default . '`.`syslog_incoming`
 			WHERE `' . $syslog_incoming_config['programField'] . '` = ?
-			AND `status` = ?' . $uniqueID;
+			AND `status` = ?';
 
 		$params[] = $alert['message'];
 		$params[] = $uniqueID;

tests/regression/issue253_alert_sql_placeholder_test.php

@@ -0,0 +1,43 @@
+<?php
+
+$GLOBALS['syslogdb_default'] = 'syslogdb';
+$GLOBALS['syslog_incoming_config'] = array(
+	'hostField'    => 'host',
+	'programField' => 'program',
+	'facilityField'=> 'facility',
+	'textField'    => 'message'
+);
+
+require_once dirname(__DIR__, 2) . '/functions.php';
+
+function issue253_assert($condition, $message) {
+	if (!$condition) {
+		fwrite(STDERR, $message . "\n");
+		exit(1);
+	}
+}
+
+$hostAlert = array(
+	'type'    => 'host',
+	'message' => 'router1'
+);
+
+$programAlert = array(
+	'type'    => 'program',
+	'message' => 'sshd'
+);
+
+$hostSql = syslog_get_alert_sql($hostAlert, 55);
+$progSql = syslog_get_alert_sql($programAlert, 66);
+
+issue253_assert(strpos($hostSql['sql'], "AND `status` = ?") !== false, 'Host alert SQL must keep status as a placeholder.');
+issue253_assert(strpos($hostSql['sql'], '?55') === false, 'Host alert SQL must not concatenate uniqueID into SQL text.');
+issue253_assert(count($hostSql['params']) === 2, 'Host alert SQL must pass two prepared parameters.');
+issue253_assert($hostSql['params'][1] === 55, 'Host alert status param should be the uniqueID.');
+
+issue253_assert(strpos($progSql['sql'], "AND `status` = ?") !== false, 'Program alert SQL must keep status as a placeholder.');
+issue253_assert(strpos($progSql['sql'], '?66') === false, 'Program alert SQL must not concatenate uniqueID into SQL text.');
+issue253_assert(count($progSql['params']) === 2, 'Program alert SQL must pass two prepared parameters.');
+issue253_assert($progSql['params'][1] === 66, 'Program alert status param should be the uniqueID.');
+
+echo "issue253_alert_sql_placeholder_test passed\n";