Files
cacti/scripts/ss_mikrotik_qtrees.php
Thomas VincentandCopilot 78e4644f9f fix: harden data collection scripts — SQL injection, counter math, column allow-listing (#6651)
* cleanup: remove unreachable defensive error logs in aggregate graph item validation

* fix: harden data collection scripts with correct SNMP retry parameter

Replace $host['ping_retries'] with $host['snmp_retries'] across all
SNMP data collection scripts. Add column allow-lists for MikroTik
scripts to prevent SQL injection via column name interpolation.

Add Pest tests verifying column allow-lists reject injection attempts
and all scripts reference snmp_retries instead of ping_retries.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix: consolidate disk device detection with preg_match

Replace 8 str_starts_with() calls with a single preg_match() in
ss_net_snmp_disk_io.php for readability. Align ss_net_snmp_disk_bytes.php
with the same device prefixes (xvd, vd, hd, md, dm-) and improved
nvme-aware partition filter.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* chore: drop unrelated lib/api_aggregate changes

Keep PR scope focused on the issue for this branch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-05 20:09:08 -05:00

140 lines
4.0 KiB
PHP
Executable File

<?php
/*
+-------------------------------------------------------------------------+
| Copyright (C) 2004-2026 The Cacti Group |
| |
| This program is free software; you can redistribute it and/or |
| modify it under the terms of the GNU General Public License |
| as published by the Free Software Foundation; either version 2 |
| of the License, or (at your option) any later version. |
| |
| This program is distributed in the hope that it will be useful, |
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| GNU General Public License for more details. |
+-------------------------------------------------------------------------+
| Cacti: The Complete RRDTool-based Graphing Solution |
+-------------------------------------------------------------------------+
| This code is designed, written, and maintained by the Cacti Group. See |
| about.php and/or the AUTHORS file for specific developer information. |
+-------------------------------------------------------------------------+
| http://www.cacti.net/ |
+-------------------------------------------------------------------------+
*/
// display no errors
error_reporting(0);
if (!isset($called_by_script_server)) {
include(__DIR__ . '/../include/cli_check.php');
array_shift($_SERVER['argv']);
print call_user_func_array('ss_mikrotik_qtrees', $_SERVER['argv']);
}
function ss_mikrotik_qtrees(int $host_id, string $cmd = 'index', string $arg1 = '', string $arg2 = '') : mixed {
if ($cmd == 'index') {
$return_arr = ss_mikrotik_qtrees_getnames($host_id);
for ($i = 0; ($i < cacti_sizeof($return_arr)); $i++) {
print $return_arr[$i] . "\n";
}
} elseif ($cmd == 'query') {
$arr_index = ss_mikrotik_qtrees_getnames($host_id);
$arr = ss_mikrotik_qtrees_getinfo($host_id, $arg1);
for ($i = 0; ($i < cacti_sizeof($arr_index)); $i++) {
if (isset($arr[$arr_index[$i]])) {
print $arr_index[$i] . '!' . $arr[$arr_index[$i]] . "\n";
}
}
} elseif ($cmd == 'get') {
$arg = $arg1;
$index = $arg2;
return ss_mikrotik_qtrees_getvalue($host_id, $index, $arg);
}
return null;
}
function ss_mikrotik_qtrees_getvalue(int $host_id, string $index, string $column) : string {
switch ($column) {
case 'qtBytes':
$column = 'curHCBytes';
break;
case 'qtPackets':
$column = 'curPackets';
break;
default:
$column = 'curHCBytes';
break;
}
$index2 = str_replace('_', ' ', $index);
$value = db_fetch_cell_prepared('SELECT
' . $column . ' AS value
FROM plugin_mikrotik_trees
WHERE name IN (' . db_qstr($index) . ', ' . db_qstr($index2) . ', ' . db_qstr('<' . $index . '>') . ')
AND host_id = ?',
[$host_id]);
return $value;
}
function ss_mikrotik_qtrees_getnames(int $host_id) : array {
$return_arr = [];
$arr = db_fetch_assoc_prepared("SELECT REPLACE(name, ' ', '_') AS name
FROM plugin_mikrotik_trees
WHERE host_id = ?
ORDER BY name",
[$host_id]);
for ($i = 0; ($i < cacti_sizeof($arr)); $i++) {
$return_arr[$i] = $arr[$i]['name'];
}
return $return_arr;
}
function ss_mikrotik_qtrees_getinfo(int $host_id, string $info_requested) : array {
$return_arr = [];
switch($info_requested) {
case 'qtName':
$column = 'name';
break;
case 'qtFlow':
$column = 'flow';
break;
case 'qtParent':
$column = 'parentIndex';
break;
default:
$column = 'name';
break;
}
$arr = db_fetch_assoc_prepared("SELECT
REPLACE(name, ' ', '_') AS qry_index,
$column AS qry_value
FROM plugin_mikrotik_trees
WHERE host_id = ?
ORDER BY name",
[$host_id]);
for ($i = 0; ($i < cacti_sizeof($arr)); $i++) {
$return_arr[$arr[$i]['qry_index']] = $arr[$i]['qry_value'];
}
return $return_arr;
}