Files
cacti/scripts/ss_mikrotik_wireless_reg.php
Thomas VincentandCopilot 78e4644f9f fix: harden data collection scripts — SQL injection, counter math, column allow-listing (#6651)
* cleanup: remove unreachable defensive error logs in aggregate graph item validation

* fix: harden data collection scripts with correct SNMP retry parameter

Replace $host['ping_retries'] with $host['snmp_retries'] across all
SNMP data collection scripts. Add column allow-lists for MikroTik
scripts to prevent SQL injection via column name interpolation.

Add Pest tests verifying column allow-lists reject injection attempts
and all scripts reference snmp_retries instead of ping_retries.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* fix: consolidate disk device detection with preg_match

Replace 8 str_starts_with() calls with a single preg_match() in
ss_net_snmp_disk_io.php for readability. Align ss_net_snmp_disk_bytes.php
with the same device prefixes (xvd, vd, hd, md, dm-) and improved
nvme-aware partition filter.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* chore: drop unrelated lib/api_aggregate changes

Keep PR scope focused on the issue for this branch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-05 20:09:08 -05:00

87 lines
3.3 KiB
PHP

<?php
/*
+-------------------------------------------------------------------------+
| Copyright (C) 2004-2026 The Cacti Group |
| |
| This program is free software; you can redistribute it and/or |
| modify it under the terms of the GNU General Public License |
| as published by the Free Software Foundation; either version 2 |
| of the License, or (at your option) any later version. |
| |
| This program is distributed in the hope that it will be useful, |
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| GNU General Public License for more details. |
+-------------------------------------------------------------------------+
| Cacti: The Complete RRDTool-based Graphing Solution |
+-------------------------------------------------------------------------+
| This code is designed, written, and maintained by the Cacti Group. See |
| about.php and/or the AUTHORS file for specific developer information. |
+-------------------------------------------------------------------------+
| http://www.cacti.net/ |
+-------------------------------------------------------------------------+
*/
// display No errors
error_reporting(0);
if (!isset($called_by_script_server)) {
include(__DIR__ . '/../include/cli_check.php');
array_shift($_SERVER['argv']);
print call_user_func_array('ss_mikrotik_wireless_reg', $_SERVER['argv']);
}
function ss_mikrotik_wireless_reg(int $host_id, string $cmd, string $object = '', string $index = '') : mixed {
if ($cmd == 'index') {
$return_arr = db_fetch_assoc_prepared('SELECT `index` AS macAddress
FROM plugin_mikrotik_wireless_registrations
WHERE host_id = ?
ORDER BY macAddress',
[$host_id]);
foreach ($return_arr as $index) {
print $index['macAddress'] . "\n";
}
} elseif ($cmd == 'num_indexes') {
$indexes = db_fetch_cell_prepared('SELECT COUNT(*)
FROM plugin_mikrotik_wireless_registrations
WHERE host_id = ?',
[$host_id]);
return $indexes;
} elseif ($cmd == 'query') {
if ($object == 'macAddress') {
$return_arr = db_fetch_assoc_prepared('SELECT `index` AS macAddress
FROM plugin_mikrotik_wireless_registrations
WHERE host_id = ?
ORDER BY macAddress',
[$host_id]);
if (cacti_sizeof($return_arr)) {
foreach ($return_arr as $index) {
print $index['macAddress'] . '!' . $index['macAddress'] . "\n";
}
}
}
} elseif ($cmd == 'get') {
$allowed_objects = [
'macAddress', 'interface', 'apTxRate', 'apRxRate', 'apStrength',
'apSsid', 'apBand', 'apFreq', 'apNoiseFloor', 'apOverallTxCcq',
'apTxBytes', 'apRxBytes', 'apTxPackets', 'apRxPackets',
'apTxFrames', 'apRxFrames', 'apTxHwFrames', 'apRxHwFrames',
];
if (!in_array($object, $allowed_objects, true)) {
return null;
}
return db_fetch_cell_prepared('SELECT `' . $object . '`
FROM plugin_mikrotik_wireless_registrations
WHERE host_id = ?
AND `index` = ?',
[$host_id, $index]);
}
return null;
}