mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-23 03:27:02 +09:00
* PHPStan Level 8 - Phase 1 Conversion
Reduces the real (no-baseline) PHPStan level 8 error count from ~2,724 to 425
and regenerates phpstan-baseline.neon accordingly (8,941 -> 1,921 lines).
Core type-safety changes
- lib/database.php: narrow db_fetch_row()/db_fetch_row_prepared() to return
array (was bool|array) and db_fetch_assoc()/db_fetch_assoc_prepared() to
return array (was mixed); the _prepared workers coerce the connection-failure
path to an empty array so the declared type is honest. empty()/cacti_sizeof()
checks are unaffected.
- lib/database.php: narrow $db_conn guards from is_object() to instanceof PDO in
the transaction/quote/insert-id helpers so the PDO calls resolve.
- lib/mib_cache.php: the fluent MibCache methods mib()/object()/table()/row()
now return self instead of a bare object so chained calls type-check.
Type-safety casts and guards (mechanical, behaviour-preserving)
- Cast string|false/|null builtin results feeding string parameters
(json_decode, base64_encode, trim, htmle, preg_replace, explode, etc.).
- Cast int|string / int|false values feeding int id/pid parameters.
- Guard resource|false fopen()/popen() handles before fwrite/fclose/fread, and
wrap foreach over array|false/list|false results with `?: []`.
Genuine bugs found and fixed
- cli/add_tree.php / lib/api_tree.php: site tree nodes could not be created via
the CLI - the --site-id option was never parsed, $nodeTypes had no 'site'
entry (passing null to api_tree_item_save(int $type) -> TypeError), and
api_tree_item_save() never persisted site_id. All three fixed.
- tree.php: leaves_exist() is typed : int but returned db_fetch_assoc_prepared()
(an array of rows) for a SELECT COUNT(*); now uses db_fetch_cell_prepared()
and returns the scalar count.
- lib/mib_cache.php: $entries_per_object was a float (division / ceil) used as
an array key (PHP 8.1 implicit float-to-int key deprecation); now cast to int.
Config
- .phpstan.neon: add notIdentical.alwaysTrue and booleanAnd.alwaysFalse to the
existing always-true/false ignore family (same "PHPStan gets confused"
dynamic-constant cause already covered by identical.alwaysTrue,
notEqual.alwaysTrue, booleanAnd.leftAlwaysTrue, etc.).
- phpstan-baseline.neon: regenerated; the remaining 425 entries are the
untouched long tail for Phase 2.
* Remove redundant @phpstan-ignore comments
Follow-up cleanup for the level 8 Phase 1 work. Removes 14 inline
@phpstan-ignore comments that no longer suppress any reported error:
- cli/repair_database.php: `@phpstan-ignore booleanAnd.alwaysFalse` is now
covered by the global booleanAnd.alwaysFalse ignore added to .phpstan.neon.
- 13 others (host.php, include/global.php, include/session.php,
lib/api_automation.php x2, lib/functions.php x2, lib/html_utility.php x2,
lib/installer.php, lib/package.php, lib/reports.php, lib/rrd.php) no longer
match any reported error after the type-safety fixes (e.g. the
db_fetch_row_prepared() return-type narrowing removed the offset-assign
errors the api_automation ignores were suppressing).
Verified with reportUnmatchedIgnoredErrors enabled: 0 unmatched ignores
remain and the full level 8 run still reports 0 errors.
* ci: satisfy validator ratchet and refresh security sink baselines
- lib/api_tree.php: give the new tree-item site_id a real numeric
constraint ('^[-0-9]+$', matching html_reports.php) instead of an
empty regex, so the validator constraint ratchet passes without
bumping its baseline.
- tests/security/baselines: refresh the three sink/hotspot signatures
whose code text changed from the (string) casts added in this branch
(lib/poller.php setsid, cli/rrdresize.php json_encode, lib/import.php
simplexml_load_string).
* ci(js): allow DOMPurify 3.4.16 and update sync_js pin test
The dependabot bump (#8134) moved package.json/package-lock.json to
DOMPurify 3.4.16 on develop but left tests/js/sync_js.test.mjs pinned to
3.4.15, so the PR merge commit fails the 'DOMPurify is pinned' contract.
Bring package.json/package-lock.json to 3.4.16 (matching develop) and
update the pin test to expect 3.4.16.
* test: update sql.php null-handling assertion for the (string) cast
This branch changed scripts/sql.php from trim(\ ?? '') to
trim((string) \) (the phpstan-safe form that coerces both null and
false from shell_exec()). Update SqlScriptsTest's null-return assertion
to match the new cast instead of the removed '?? ''.
* fix: address Copilot review - ownership IDs, fopen guards, mib_cache bound
- chown()/chgrp(): pass integer UID/GID from fileowner()/filegroup()
(guarding the false lookup) instead of string-casting them, which made
them resolve account/group names like '1001' and fail. Covers
lib/api_device.php, lib/boost.php and poller_maintenance.php (x2).
- fopen() failure now short-circuits instead of reporting success:
lib/package.php returns false, lib/clog_webapi.php and utilities.php
render an error, and snmpagent_mibcachechild.php skips the cache write
and sentinel unlink so a concurrent writer's lock is preserved.
- lib/mib_cache.php: keep the float quotient as the loop bound and cast
only the array offset, so a non-even entries/columns split no longer
truncates the loop and drops a cached row.
* revert: keep db_fetch_* returning false on error; baseline Level 8 instead
Per review, restoring the intentional fail-safe: db_fetch_row[_prepared]()
return bool|array and db_fetch_assoc[_prepared]() return mixed again, so a
genuine SQL error (not just a missing connection) is signalled as false and
the === false checks in cdef_is_in_use(), boost_process_* and aggregate.php
work as before. Dropped the is_array() ? : [] coercion.
Level 8 stays green by regenerating phpstan-baseline.neon to capture the
re-introduced bool|array/mixed call-site errors (the ~1,850 the narrowing
had eliminated). Tightening those callers to drop them from the baseline is
Phase 2 work.
---------
Co-authored-by: TheWitness <copilot@users.noreply.github.com>
508 lines
15 KiB
PHP
508 lines
15 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
| |
|
|
| This program is free software; you can redistribute it and/or |
|
|
| modify it under the terms of the GNU General Public License |
|
|
| as published by the Free Software Foundation; either version 2 |
|
|
| of the License, or (at your option) any later version. |
|
|
| |
|
|
| This program is distributed in the hope that it will be useful, |
|
|
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
|
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
|
| GNU General Public License for more details. |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDTool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
| This code is designed, written, and maintained by the Cacti Group. See |
|
|
| about.php and/or the AUTHORS file for specific developer information. |
|
|
+-------------------------------------------------------------------------+
|
|
| http://www.cacti.net/ |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
require('./include/auth.php');
|
|
require_once(CACTI_PATH_LIBRARY . '/export.php');
|
|
require_once(CACTI_PATH_LIBRARY . '/import.php');
|
|
require_once(CACTI_PATH_LIBRARY . '/package.php');
|
|
require_once(CACTI_PATH_LIBRARY . '/xml.php');
|
|
|
|
// set default action
|
|
set_default_action();
|
|
|
|
if (check_get_author_info() === false) {
|
|
exit;
|
|
}
|
|
|
|
switch (grv('action')) {
|
|
case 'save':
|
|
form_save();
|
|
|
|
break;
|
|
case 'get_contents':
|
|
$export_type = gnrv('export_type');
|
|
$export_item_id = gnrv('export_item_id');
|
|
$include_deps = (gnrv('include_deps') == 'true' ? true : false);
|
|
|
|
print get_package_contents($export_type, $export_item_id);
|
|
|
|
break;
|
|
default:
|
|
top_header();
|
|
export();
|
|
bottom_footer();
|
|
|
|
break;
|
|
}
|
|
|
|
function form_save() : void {
|
|
global $export_types, $export_errors, $debug, $package_file;
|
|
|
|
// ================= input validation =================
|
|
gfrv('export_item_id');
|
|
// ====================================================
|
|
|
|
$export_okay = false;
|
|
|
|
$export_type = gnrv('export_type');
|
|
$export_item_id = intval(gfrv('export_item_id'));
|
|
|
|
if (isrv('include_deps') && gnrv('include_deps') == '') {
|
|
$include_deps = false;
|
|
} else {
|
|
$include_deps = true;
|
|
}
|
|
|
|
$xml_data = get_item_xml($export_type, $export_item_id, $include_deps);
|
|
|
|
$info = [];
|
|
$info['name'] = gnrv('name');
|
|
$info['author'] = gnrv('author');
|
|
$info['homepage'] = gnrv('homepage');
|
|
$info['email'] = gnrv('email');
|
|
$info['description'] = gnrv('description');
|
|
$info['class'] = gnrv('class');
|
|
$info['tags'] = gnrv('tags');
|
|
$info['installation'] = gnrv('installation');
|
|
$info['version'] = gnrv('version');
|
|
$info['copyright'] = gnrv('copyright');
|
|
|
|
// Let's store the Template information for subsequent exports
|
|
$hash = get_export_hash(gnrv('export_type'), gnrv('export_item_id'));
|
|
|
|
$export_okay = save_packager_metadata($hash, $info);
|
|
|
|
$debug = '';
|
|
|
|
if ($export_okay) {
|
|
$files = find_dependent_files($xml_data);
|
|
|
|
// search xml files for scripts
|
|
if (cacti_sizeof($files)) {
|
|
foreach ($files as $file) {
|
|
if (str_contains($file['file'], '.xml')) {
|
|
$files = array_merge($files, find_dependent_files((string) file_get_contents($file['file'])));
|
|
}
|
|
}
|
|
}
|
|
|
|
$success = package_template($xml_data, $info, $files, $debug);
|
|
} else {
|
|
top_header();
|
|
print __('WARNING: Export Errors Encountered. Refresh Browser Window for Details!') . "\n";
|
|
print $xml_data;
|
|
bottom_footer();
|
|
|
|
exit;
|
|
}
|
|
|
|
if ($export_errors || !$success) {
|
|
raise_message('package_error', __('There were errors packaging your Templates. Errors Follow. ') . str_replace("\n", '<br>', $debug), MESSAGE_LEVEL_ERROR);
|
|
header('Location: package.php');
|
|
|
|
exit;
|
|
}
|
|
|
|
if ($package_file != '') {
|
|
header('Content-Type: application/gzip');
|
|
header('Content-Disposition: attachment; filename="' . basename($package_file) . '"');
|
|
header('Content-Length: ' . filesize($package_file));
|
|
header('Content-Control: no-cache');
|
|
header('Pragma: public');
|
|
header('Expires: 0');
|
|
readfile($package_file);
|
|
unlink($package_file);
|
|
|
|
exit;
|
|
}
|
|
}
|
|
|
|
function export() : void {
|
|
global $export_types, $device_classes, $graph_template_classes, $copyrights;
|
|
|
|
// 'graph_template' should be the default
|
|
if (!isrv('export_type')) {
|
|
srv('export_type', 'host_template');
|
|
|
|
$id = db_fetch_cell('SELECT id FROM host_template ORDER BY name LIMIT 1');
|
|
|
|
srv('export_item_id', $id);
|
|
}
|
|
|
|
unset($export_types['data_template']);
|
|
unset($export_types['data_query']);
|
|
|
|
switch (gnrv('export_type')) {
|
|
case 'host_template':
|
|
case 'graph_template':
|
|
case 'data_query':
|
|
break;
|
|
default:
|
|
srv('export_type', 'host_template');
|
|
}
|
|
|
|
html_start_box(__('Package Templates'), '100%', false, 3, 'center', '');
|
|
|
|
?>
|
|
<tr class='tableRow'>
|
|
<td>
|
|
<table>
|
|
<tr>
|
|
<td><span class='formItemName'><?php print __('What would you like to Package?'); ?> </span></td>
|
|
<td>
|
|
<select id='export_type'>
|
|
<?php
|
|
foreach ($export_types as $key => $array) {
|
|
print "<option value='$key'";
|
|
|
|
if (gnrv('export_type') == $key) {
|
|
print ' selected';
|
|
} print '>' . htmle($array['name']) . '</option>';
|
|
}
|
|
?>
|
|
</select>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</td>
|
|
</tr>
|
|
<?php
|
|
|
|
html_end_box();
|
|
|
|
$info = check_get_author_info();
|
|
|
|
if ($info === false) {
|
|
exit;
|
|
}
|
|
|
|
// Let's get any saved package details from the last time the template was packaged
|
|
$data = [];
|
|
$hash = get_export_hash(gnrv('export_type'), gnrv('export_item_id'));
|
|
|
|
// Two methods, one with SQLite and one without
|
|
|
|
$data = [];
|
|
$detail = [];
|
|
$classes = [];
|
|
|
|
if (class_exists('SQLite3')) {
|
|
$data = get_packager_metadata($hash);
|
|
}
|
|
|
|
// Legacy support, to be deprecated eventually
|
|
if (!cacti_sizeof($data)) {
|
|
$data = read_config_option('package_export_' . $hash);
|
|
|
|
if ($data != '') {
|
|
$data = json_decode($data, true);
|
|
}
|
|
}
|
|
|
|
// If this template has not been saved before, initialize values
|
|
switch(gnrv('export_type')) {
|
|
case 'host_template':
|
|
$classes = $device_classes;
|
|
|
|
if (!isrv('export_item_id')) {
|
|
$detail = db_fetch_row('SELECT *
|
|
FROM host_template
|
|
ORDER BY name
|
|
LIMIT 1');
|
|
} else {
|
|
$detail = db_fetch_row_prepared('SELECT *
|
|
FROM host_template
|
|
WHERE id = ?',
|
|
[gfrv('export_item_id')]);
|
|
}
|
|
|
|
break;
|
|
case 'graph_template':
|
|
$classes = $graph_template_classes;
|
|
|
|
if (!isrv('export_item_id')) {
|
|
$detail = db_fetch_row('SELECT *
|
|
FROM graph_templates
|
|
ORDER BY name
|
|
LIMIT 1');
|
|
} else {
|
|
$detail = db_fetch_row_prepared('SELECT *
|
|
FROM graph_templates
|
|
WHERE id = ?',
|
|
[gfrv('export_item_id')]);
|
|
}
|
|
|
|
break;
|
|
case 'data_query':
|
|
$classes = $graph_template_classes;
|
|
|
|
if (!isrv('export_item_id')) {
|
|
$detail = db_fetch_row('SELECT id, name
|
|
FROM snmp_query
|
|
ORDER BY name
|
|
LIMIT 1');
|
|
} else {
|
|
$detail = db_fetch_row_prepared('SELECT id, name
|
|
FROM snmp_query
|
|
WHERE id = ?',
|
|
[gfrv('export_item_id')]);
|
|
}
|
|
|
|
break;
|
|
}
|
|
|
|
if (cacti_sizeof($detail)) {
|
|
switch(gnrv('export_type')) {
|
|
case 'host_template':
|
|
$data['description'] = __('%s Device Package', $detail['name']);
|
|
|
|
break;
|
|
case 'graph_template':
|
|
$data['description'] = __('%s Graph Template Package', $detail['name']);
|
|
|
|
break;
|
|
case 'data_query':
|
|
$data['description'] = __('%s Data Query Package', $detail['name']);
|
|
|
|
break;
|
|
}
|
|
|
|
$meta_columns = ['version', 'class', 'author', 'email', 'tags', 'copyright', 'installation'];
|
|
|
|
foreach ($meta_columns as $m) {
|
|
if (isset($detail[$m]) && $detail[$m] != '') {
|
|
$data[$m] = $detail[$m];
|
|
} else {
|
|
$default = read_config_option("package_$m");
|
|
|
|
if (!empty($default)) {
|
|
$data[$m] = $default;
|
|
}
|
|
}
|
|
}
|
|
|
|
$data['name'] = $detail['name'];
|
|
}
|
|
|
|
if (cacti_sizeof($data)) {
|
|
$info = array_merge($info, $data);
|
|
}
|
|
|
|
form_start('package.php', 'form_id');
|
|
|
|
html_start_box(__('Available Templates [%s]', $export_types[gnrv('export_type')]['name']), '100%', false, 3, 'center', '');
|
|
|
|
$package_form = [
|
|
'spacer0' => [
|
|
'method' => 'spacer',
|
|
'friendly_name' => __('Available Templates'),
|
|
],
|
|
'export_item_id' => [
|
|
'method' => 'drop_sql',
|
|
'friendly_name' => __('%s to Export', $export_types[gnrv('export_type')]['name']),
|
|
'description' => __('Choose the exact items to export in the Package.'),
|
|
'value' => (isrv('export_item_id') ? gfrv('export_item_id') : '|arg1:export_item_id|'),
|
|
'sql' => $export_types[gnrv('export_type')]['dropdown_sql']
|
|
],
|
|
'include_deps' => [
|
|
'method' => 'checkbox',
|
|
'friendly_name' => __('Include Dependencies'),
|
|
'description' => __('Some templates rely on other items in Cacti to function properly. It is highly recommended that you select this box or the resulting import may fail.'),
|
|
'value' => 'on',
|
|
'sql' => $export_types[gnrv('export_type')]['dropdown_sql']
|
|
],
|
|
'spacer1' => [
|
|
'method' => 'spacer',
|
|
'friendly_name' => __('Package Information'),
|
|
],
|
|
'description' => [
|
|
'method' => 'textbox',
|
|
'friendly_name' => __('Description'),
|
|
'description' => __('The Package Description.'),
|
|
'value' => (isset($info['description']) ? $info['description'] : read_config_option('package_description', true)),
|
|
'max_length' => '255',
|
|
'size' => '80'
|
|
],
|
|
'copyright' => [
|
|
'method' => 'drop_array',
|
|
'friendly_name' => __('Copyright'),
|
|
'description' => __('The license type for this package.'),
|
|
'value' => (isset($info['copyright']) ? $info['copyright'] : 'GNU General Public License'),
|
|
'array' => [
|
|
'Apache License 2.0' => __('Apache License 2.0'),
|
|
'Creative Commons' => __('Creative Commons'),
|
|
'GNU General Public License' => __('GNU General Public License'),
|
|
'MIT License' => __('MIT License'),
|
|
'Eclipse Public License version 2.0' => __('Eclipse Public License version 2.0'),
|
|
],
|
|
'default' => 'GNU General Public License'
|
|
],
|
|
'version' => [
|
|
'method' => 'textbox',
|
|
'friendly_name' => __('Version'),
|
|
'description' => __('The version number to publish for this Package.'),
|
|
'value' => (isset($info['version']) ? $info['version'] : read_config_option('package_version', true)),
|
|
'max_length' => '10',
|
|
'size' => '10'
|
|
],
|
|
'class' => [
|
|
'method' => 'drop_array',
|
|
'friendly_name' => __('Class'),
|
|
'description' => __('The Classification of the Package.'),
|
|
'value' => (isset($info['class']) ? $info['class'] : read_config_option('package_class', true)),
|
|
'array' => $classes,
|
|
'default' => 'unassigned'
|
|
],
|
|
'tags' => [
|
|
'method' => 'textarea',
|
|
'friendly_name' => __('Tags'),
|
|
'description' => __('Assign various searchable attributes to the Package.'),
|
|
'value' => (isset($info['tags']) ? $info['tags'] : read_config_option('package_tags', true)),
|
|
'textarea_rows' => '2',
|
|
'textarea_cols' => '80'
|
|
],
|
|
'installation' => [
|
|
'method' => 'textarea',
|
|
'friendly_name' => __('Installation Instructions'),
|
|
'description' => __('Some Packages require additional changes outside of Cacti\'s scope such as setting up an SNMP Agent Extension on the Devices to be monitored. You should add those instructions here..'),
|
|
'value' => (isset($info['installation']) ? $info['installation'] : read_config_option('package_installation', true)),
|
|
'textarea_rows' => '5',
|
|
'textarea_cols' => '80'
|
|
],
|
|
'spacer2' => [
|
|
'method' => 'spacer',
|
|
'friendly_name' => __('Author Information'),
|
|
],
|
|
'author' => [
|
|
'method' => 'other',
|
|
'friendly_name' => __('Author Name'),
|
|
'description' => __('The Registered Authors Name.'),
|
|
'value' => $info['author'],
|
|
'max_length' => '40',
|
|
'size' => '40'
|
|
],
|
|
'homepage' => [
|
|
'method' => 'other',
|
|
'friendly_name' => __('Homepage'),
|
|
'description' => __('The Registered Authors Home Page.'),
|
|
'value' => $info['homepage'],
|
|
'max_length' => '60',
|
|
'size' => '60'
|
|
],
|
|
'email' => [
|
|
'method' => 'other',
|
|
'friendly_name' => __('Email Address'),
|
|
'description' => __('The Registered Authors Email Address.'),
|
|
'value' => $info['email'],
|
|
'max_length' => '60',
|
|
'size' => '60'
|
|
],
|
|
'export_type' => [
|
|
'method' => 'hidden',
|
|
'value' => gnrv('export_type')
|
|
]
|
|
];
|
|
|
|
draw_edit_form(
|
|
[
|
|
'config' => ['no_form_tag' => true],
|
|
'fields' => $package_form
|
|
]
|
|
);
|
|
|
|
html_end_box();
|
|
|
|
?>
|
|
<table style='width:100%;text-align:center;'>
|
|
<tr>
|
|
<td class='saveRow'>
|
|
<input type='hidden' name='action' value='save'>
|
|
<input type='hidden' id='name' name='name' value='<?php print htmle($detail['name']); ?>'>
|
|
<button class='export ui-button ui-corner-all ui-widget ui-state-active' type='submit'><?php print __('Package'); ?></button>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</form>
|
|
<script type='text/javascript'>
|
|
var stopTimer = null;
|
|
|
|
$(function() {
|
|
$('#export_type').change(function() {
|
|
strURL = urlPath+'package.php';
|
|
strURL += '?export_type='+$('#export_type').val();
|
|
strURL += '&author='+$('#author').val();
|
|
strURL += '&homepage='+escape($('#homepage').val());
|
|
strURL += '&email='+$('#email').val();
|
|
strURL += '&description='+escape($('#description').val());
|
|
strURL += '&version='+escape($('#version').val());
|
|
loadPageNoHeader(strURL);
|
|
});
|
|
|
|
$('#export_item_id').change(function() {
|
|
strURL = urlPath+'package.php';
|
|
strURL += '?export_type='+$('#export_type').val();
|
|
strURL += '&export_item_id='+$('#export_item_id').val();
|
|
strURL += '&author='+$('#author').val();
|
|
strURL += '&homepage='+escape($('#homepage').val());
|
|
strURL += '&email='+$('#email').val();
|
|
strURL += '&description='+escape($('#description').val());
|
|
strURL += '&version='+escape($('#version').val());
|
|
loadPageNoHeader(strURL);
|
|
});
|
|
|
|
if ($('#details').length) {
|
|
strURL = urlPath+'package.php';
|
|
strURL += '?action=get_contents';
|
|
strURL += '&export_type='+$('#export_type').val();
|
|
strURL += '&export_item_id='+$('#export_item_id').val();
|
|
strURL += '&include_deps='+$('#include_deps').is(':checked');
|
|
$.get(strURL, function(data) {
|
|
$('#details').html(data);
|
|
$('#name').val($('#export_item_id option:selected').text());
|
|
});
|
|
}
|
|
|
|
$('form#form_id').submit(function(event) {
|
|
stopTimer = setTimeout(function() { Pace.stop() }, 1000);
|
|
});
|
|
|
|
if ($('#name').val() == '') {
|
|
$('#name').val($('#export_item_id option:selected').text());
|
|
}
|
|
});
|
|
</script>
|
|
<?php
|
|
|
|
html_start_box(__('Package Contents Include'), '100%', false, 3, 'center', '');
|
|
|
|
if (isrv('export_type') && isrv('export_item_id')) {
|
|
print get_package_contents(grv('export_type'), grv('export_item_id'));
|
|
} else {
|
|
print '<div id="details" style="vertical-align:top">';
|
|
print '</div>';
|
|
}
|
|
|
|
html_end_box();
|
|
}
|