mactrack_view_interfaces.php:48 on develop runs the mt_ignorePorts setting through Cacti's db_qstr_rlike():
$ignore = '(ifName NOT ' . db_qstr_rlike($match) . ' AND ifDescr NOT ' . db_qstr_rlike($match) . ')';
Two separate problems.
1. The helper strips the regular expression.
db_qstr_rlike() removes |, { and } to bound backtracking (lib/database.php:2015). That is correct for a search box, but mt_ignorePorts is an admin-configured regular expression whose shipped default is (Vlan|Loopback|Null) (setup.php:359, written by mactrack_view_interfaces.php:45). It becomes (VlanLoopbackNull).
Against MariaDB:
'Vlan10' NOT RLIKE '(Vlan|Loopback|Null)' -> 0 suppressed, correct
'Vlan10' NOT RLIKE '(VlanLoopbackNull)' -> 1 returned, wrong
'Gi1/0/1' -> 1 either way
Every Vlan, Loopback and Null interface reappears in the Issues views (issues of -1, 0, 1, 2, 3, 9, 10, 11 and -3), and "Ignored Interfaces" (issues=-4) returns an empty list. Any admin who used {2,3} bounded repeats loses those too.
2. db_qstr_rlike() does not exist before Cacti 1.2.31.
Checked every 1.2 tag:
release/1.2.14 ABSENT
release/1.2.25 ABSENT
release/1.2.29 ABSENT
release/1.2.30 ABSENT
release/1.2.31 PRESENT
It is absent on develop as well. INFO declares compat = 1.2.14, so the Interfaces view is an undefined-function fatal on 17 of the 18 supported 1.2 releases, and on 1.3.
Introduced in #336. Fixed in #345 by quoting the pattern with db_qstr() and leaving it intact, which keeps the injection fix from #336 and removes the version dependency entirely.
mactrack_view_interfaces.php:48on develop runs themt_ignorePortssetting through Cacti'sdb_qstr_rlike():Two separate problems.
1. The helper strips the regular expression.
db_qstr_rlike()removes|,{and}to bound backtracking (lib/database.php:2015). That is correct for a search box, butmt_ignorePortsis an admin-configured regular expression whose shipped default is(Vlan|Loopback|Null)(setup.php:359, written bymactrack_view_interfaces.php:45). It becomes(VlanLoopbackNull).Against MariaDB:
Every Vlan, Loopback and Null interface reappears in the Issues views (
issuesof -1, 0, 1, 2, 3, 9, 10, 11 and -3), and "Ignored Interfaces" (issues=-4) returns an empty list. Any admin who used{2,3}bounded repeats loses those too.2.
db_qstr_rlike()does not exist before Cacti 1.2.31.Checked every 1.2 tag:
It is absent on
developas well. INFO declarescompat = 1.2.14, so the Interfaces view is an undefined-function fatal on 17 of the 18 supported 1.2 releases, and on 1.3.Introduced in #336. Fixed in #345 by quoting the pattern with
db_qstr()and leaving it intact, which keeps the injection fix from #336 and removes the version dependency entirely.