Files
cacti/poller_spikekill.php
TheWitnessandTheWitness 3ab4c69fb7 PHPStan Level 8 - Phase 1 Conversion (#8135)
* PHPStan Level 8 - Phase 1 Conversion

Reduces the real (no-baseline) PHPStan level 8 error count from ~2,724 to 425
and regenerates phpstan-baseline.neon accordingly (8,941 -> 1,921 lines).

Core type-safety changes
- lib/database.php: narrow db_fetch_row()/db_fetch_row_prepared() to return
  array (was bool|array) and db_fetch_assoc()/db_fetch_assoc_prepared() to
  return array (was mixed); the _prepared workers coerce the connection-failure
  path to an empty array so the declared type is honest. empty()/cacti_sizeof()
  checks are unaffected.
- lib/database.php: narrow $db_conn guards from is_object() to instanceof PDO in
  the transaction/quote/insert-id helpers so the PDO calls resolve.
- lib/mib_cache.php: the fluent MibCache methods mib()/object()/table()/row()
  now return self instead of a bare object so chained calls type-check.

Type-safety casts and guards (mechanical, behaviour-preserving)
- Cast string|false/|null builtin results feeding string parameters
  (json_decode, base64_encode, trim, htmle, preg_replace, explode, etc.).
- Cast int|string / int|false values feeding int id/pid parameters.
- Guard resource|false fopen()/popen() handles before fwrite/fclose/fread, and
  wrap foreach over array|false/list|false results with `?: []`.

Genuine bugs found and fixed
- cli/add_tree.php / lib/api_tree.php: site tree nodes could not be created via
  the CLI - the --site-id option was never parsed, $nodeTypes had no 'site'
  entry (passing null to api_tree_item_save(int $type) -> TypeError), and
  api_tree_item_save() never persisted site_id. All three fixed.
- tree.php: leaves_exist() is typed : int but returned db_fetch_assoc_prepared()
  (an array of rows) for a SELECT COUNT(*); now uses db_fetch_cell_prepared()
  and returns the scalar count.
- lib/mib_cache.php: $entries_per_object was a float (division / ceil) used as
  an array key (PHP 8.1 implicit float-to-int key deprecation); now cast to int.

Config
- .phpstan.neon: add notIdentical.alwaysTrue and booleanAnd.alwaysFalse to the
  existing always-true/false ignore family (same "PHPStan gets confused"
  dynamic-constant cause already covered by identical.alwaysTrue,
  notEqual.alwaysTrue, booleanAnd.leftAlwaysTrue, etc.).
- phpstan-baseline.neon: regenerated; the remaining 425 entries are the
  untouched long tail for Phase 2.

* Remove redundant @phpstan-ignore comments

Follow-up cleanup for the level 8 Phase 1 work. Removes 14 inline
@phpstan-ignore comments that no longer suppress any reported error:

- cli/repair_database.php: `@phpstan-ignore booleanAnd.alwaysFalse` is now
  covered by the global booleanAnd.alwaysFalse ignore added to .phpstan.neon.
- 13 others (host.php, include/global.php, include/session.php,
  lib/api_automation.php x2, lib/functions.php x2, lib/html_utility.php x2,
  lib/installer.php, lib/package.php, lib/reports.php, lib/rrd.php) no longer
  match any reported error after the type-safety fixes (e.g. the
  db_fetch_row_prepared() return-type narrowing removed the offset-assign
  errors the api_automation ignores were suppressing).

Verified with reportUnmatchedIgnoredErrors enabled: 0 unmatched ignores
remain and the full level 8 run still reports 0 errors.

* ci: satisfy validator ratchet and refresh security sink baselines

- lib/api_tree.php: give the new tree-item site_id a real numeric
  constraint ('^[-0-9]+$', matching html_reports.php) instead of an
  empty regex, so the validator constraint ratchet passes without
  bumping its baseline.
- tests/security/baselines: refresh the three sink/hotspot signatures
  whose code text changed from the (string) casts added in this branch
  (lib/poller.php setsid, cli/rrdresize.php json_encode, lib/import.php
  simplexml_load_string).

* ci(js): allow DOMPurify 3.4.16 and update sync_js pin test

The dependabot bump (#8134) moved package.json/package-lock.json to
DOMPurify 3.4.16 on develop but left tests/js/sync_js.test.mjs pinned to
3.4.15, so the PR merge commit fails the 'DOMPurify is pinned' contract.
Bring package.json/package-lock.json to 3.4.16 (matching develop) and
update the pin test to expect 3.4.16.

* test: update sql.php null-handling assertion for the (string) cast

This branch changed scripts/sql.php from trim(\ ?? '') to
trim((string) \) (the phpstan-safe form that coerces both null and
false from shell_exec()). Update SqlScriptsTest's null-return assertion
to match the new cast instead of the removed '?? ''.

* fix: address Copilot review - ownership IDs, fopen guards, mib_cache bound

- chown()/chgrp(): pass integer UID/GID from fileowner()/filegroup()
  (guarding the false lookup) instead of string-casting them, which made
  them resolve account/group names like '1001' and fail. Covers
  lib/api_device.php, lib/boost.php and poller_maintenance.php (x2).
- fopen() failure now short-circuits instead of reporting success:
  lib/package.php returns false, lib/clog_webapi.php and utilities.php
  render an error, and snmpagent_mibcachechild.php skips the cache write
  and sentinel unlink so a concurrent writer's lock is preserved.
- lib/mib_cache.php: keep the float quotient as the loop bound and cast
  only the array offset, so a non-even entries/columns split no longer
  truncates the loop and drops a cached row.

* revert: keep db_fetch_* returning false on error; baseline Level 8 instead

Per review, restoring the intentional fail-safe: db_fetch_row[_prepared]()
return bool|array and db_fetch_assoc[_prepared]() return mixed again, so a
genuine SQL error (not just a missing connection) is signalled as false and
the === false checks in cdef_is_in_use(), boost_process_* and aggregate.php
work as before. Dropped the is_array() ? : [] coercion.

Level 8 stays green by regenerating phpstan-baseline.neon to capture the
re-introduced bool|array/mixed call-site errors (the ~1,850 the narrowing
had eliminated). Tightening those callers to drop them from the baseline is
Phase 2 work.

---------

Co-authored-by: TheWitness <copilot@users.noreply.github.com>
2026-10-02 10:08:56 -04:00

297 lines
8.2 KiB
PHP

#!/usr/bin/env php
<?php
/*
+-------------------------------------------------------------------------+
| Copyright (C) 2004-2026 The Cacti Group |
| |
| This program is free software; you can redistribute it and/or |
| modify it under the terms of the GNU General Public License |
| as published by the Free Software Foundation; either version 2 |
| of the License, or (at your option) any later version. |
| |
| This program is distributed in the hope that it will be useful, |
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| GNU General Public License for more details. |
+-------------------------------------------------------------------------+
| Cacti: The Complete RRDtool-based Graphing Solution |
+-------------------------------------------------------------------------+
| This code is designed, written, and maintained by the Cacti Group. See |
| about.php and/or the AUTHORS file for specific developer information. |
+-------------------------------------------------------------------------+
| http://www.cacti.net/ |
+-------------------------------------------------------------------------+
*/
require(__DIR__ . '/include/cli_check.php');
ini_set('memory_limit', '-1');
// process calling arguments
$parms = $_SERVER['argv'];
array_shift($parms);
global $debug, $start, $seed, $forcerun;
$debug = false;
$forcerun = false;
$templates = false;
$kills = 0;
if (cacti_sizeof($parms)) {
foreach ($parms as $parameter) {
if (str_contains($parameter, '=')) {
[$arg, $value] = explode('=', $parameter, 2);
} else {
$arg = $parameter;
$value = '';
}
switch ($arg) {
case '-d':
case '--debug':
$debug = true;
break;
case '--templates':
$templates = $value;
break;
case '-f':
case '--force':
$forcerun = true;
break;
case '--version':
case '-V':
case '-v':
display_version();
exit(0);
case '--help':
case '-H':
case '-h':
display_help();
exit(0);
default:
print 'ERROR: Invalid Parameter ' . $parameter . PHP_EOL . PHP_EOL;
display_help();
exit(1);
}
}
}
$timeout = intval(read_config_option('spikekill_timeout'));
// silently end if the registered process is still running, or process table missing
if (!register_process_start('spikekill', 'master', 0, $timeout)) {
exit(0);
}
print 'NOTE: SpikeKill Running' . PHP_EOL;
if (!$templates) {
$templates = db_fetch_cell("SELECT value FROM settings WHERE name='spikekill_templates'");
if ($templates != '') {
$templates = explode(',', $templates);
}
} else {
$templates = explode(',', $templates);
}
if (!cacti_sizeof($templates)) {
print 'ERROR: No valid Graph Templates selected' . PHP_EOL . PHP_EOL;
unregister_process('spikekill', 'master', 0);
exit(1);
} else {
foreach ($templates as $template) {
if (!is_numeric($template)) {
print "ERROR: Graph Template '" . $template . "' Invalid" . PHP_EOL . PHP_EOL;
unregister_process('spikekill', 'master', 0);
exit(1);
}
}
}
if (timeToRun()) {
debug('Starting Spikekill Process');
$start = microtime(true);
$graphs = kill_spikes($templates, $kills);
$purges = 0;
if (read_config_option('spikekill_purge') > 0) {
$purges = purge_spike_backups();
}
$end = microtime(true);
$cacti_stats = sprintf(
'Time:%01.4f ' .
'Graphs:%s ' .
'Purges:%s ' .
'Kills:%s',
round($end - $start,2),
$graphs,
$purges,
$kills);
// log to the database
db_execute_prepared('REPLACE INTO settings (name,value) VALUES ("stats_spikekill", ?)', [$cacti_stats]);
// log to the logfile
cacti_log('SPIKEKILL STATS: ' . $cacti_stats , true, 'SYSTEM');
}
print 'NOTE: SpikeKill Finished' . PHP_EOL;
unregister_process('spikekill', 'master', 0);
exit(0);
function timeToRun() : bool {
global $forcerun;
$lastrun = read_config_option('spikekill_lastrun');
$frequency = read_config_option('spikekill_batch') * 3600;
$basetime = strtotime(read_config_option('spikekill_basetime'));
$baseupper = $basetime + 300;
$baselower = $basetime - 300;
$now = time();
debug("LastRun:'$lastrun', Frequency:'$frequency', BaseTime:'" . date('Y-m-d H:i:s', $basetime) . "', BaseUpper:'$baseupper', BaseLower:'$baselower', Now:'" . date('Y-m-d H:i:s', $now) . "'");
if ($frequency > 0 && ($now - $lastrun > $frequency)) {
debug("Frequency is '$frequency' Seconds");
if (empty($lastrun) && ($now < $baseupper) && ($now > $baselower)) {
debug('Time to Run');
db_execute_prepared('REPLACE INTO settings (name,value) VALUES ("spikekill_lastrun", ?)', [time()]);
return true;
}
if (($now - $lastrun > $frequency) && ($now < $baseupper) && ($now > $baselower)) {
debug('Time to Run');
db_execute_prepared('REPLACE INTO settings (name,value) VALUES ("spikekill_lastrun", ?)', [time()]);
return true;
} else {
debug('Not Time to Run');
return false;
}
} elseif ($forcerun) {
debug('Force to Run');
db_execute_prepared('REPLACE INTO settings (name,value) VALUES ("spikekill_lastrun", ?)', [time()]);
return true;
} else {
debug('Not time to Run');
return false;
}
}
function debug(string $message) : void {
global $debug;
if ($debug) {
print 'DEBUG: ' . trim($message) . PHP_EOL;
}
}
function purge_spike_backups() : mixed {
$directory = read_config_option('spikekill_backupdir');
$retention = intval(read_config_option('spikekill_purge'));
$purges = 0;
if (empty($retention)) {
return false;
}
$earlytime = time() - $retention;
if ($directory != '' && is_dir($directory) && is_writable($directory)) {
$files = array_diff(scandir($directory), ['.', '..']);
if (cacti_sizeof($files)) {
foreach ($files as $file) {
$filepath = $directory . '/' . $file;
if (is_file($filepath) && str_contains($filepath, 'rrd')) {
$mtime = filemtime($filepath);
if ($mtime < $earlytime) {
if (is_writable($filepath)) {
unlink($filepath);
$purges++;
} else {
cacti_log('Unable to remove ' . $filepath . ' due to write permissions', false, 'SPIKES');
}
}
}
}
}
}
return $purges;
}
function kill_spikes(array $templates, int &$found) : int {
global $debug;
$rrdfiles = array_rekey(db_fetch_assoc('SELECT DISTINCT rrd_path
FROM graph_templates AS gt
INNER JOIN graph_templates_item AS gti
ON gt.id=gti.graph_template_id
INNER JOIN data_template_rrd AS dtr
ON gti.task_item_id=dtr.id
INNER JOIN poller_item AS pi ON pi.local_data_id=dtr.local_data_id
WHERE gt.id IN (' . implode(',', $templates) . ')'), 'rrd_path', 'rrd_path');
if (cacti_sizeof($rrdfiles)) {
foreach ($rrdfiles as $f) {
debug("Removing Spikes from '$f'");
$response = exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' .
cacti_escapeshellarg(CACTI_PATH_CLI . '/removespikes.php') . ' --rrdfile=' . cacti_escapeshellarg($f) . ($debug ? ' --debug' : ''));
if (substr_count((string) $response, 'Spikes Found and Remediated')) {
$found++;
}
debug(str_replace('NOTE: ', '', $response));
}
}
return cacti_sizeof($rrdfiles);
}
// display_version - displays version information
function display_version() : void {
$version = get_cacti_cli_version();
print "Cacti SpikeKiller Batch Poller, Version $version, " . COPYRIGHT_YEARS . PHP_EOL;
}
function display_help() : void {
display_version();
print PHP_EOL . 'usage: poller_spikekill.php [--templates=N,N,...] [--force] [--debug]' . PHP_EOL . PHP_EOL;
print "Cacti's SpikeKill batch removal poller. This poller will remove spikes" . PHP_EOL;
print "in Cacti's RRDfiles based upon the settings maintained in Cacti's database." . PHP_EOL . PHP_EOL;
print 'Optional:' . PHP_EOL;
print ' --templates=N,N,... - Only despike the templates provided.' . PHP_EOL;
print ' --force - Force running the despiking immediately.' . PHP_EOL;
print ' --debug - Display verbose output during execution.' . PHP_EOL;
}