Skip to content

Ports to Ignore setting is stripped of regex characters, and the Interfaces view is fatal before Cacti 1.2.31 #347

Description

@somethingwithproof

mactrack_view_interfaces.php:48 on develop runs the mt_ignorePorts setting through Cacti's db_qstr_rlike():

$ignore = '(ifName NOT ' . db_qstr_rlike($match) . ' AND ifDescr NOT ' . db_qstr_rlike($match) . ')';

Two separate problems.

1. The helper strips the regular expression.

db_qstr_rlike() removes |, { and } to bound backtracking (lib/database.php:2015). That is correct for a search box, but mt_ignorePorts is an admin-configured regular expression whose shipped default is (Vlan|Loopback|Null) (setup.php:359, written by mactrack_view_interfaces.php:45). It becomes (VlanLoopbackNull).

Against MariaDB:

'Vlan10' NOT RLIKE '(Vlan|Loopback|Null)'  -> 0   suppressed, correct
'Vlan10' NOT RLIKE '(VlanLoopbackNull)'    -> 1   returned, wrong
'Gi1/0/1'                                  -> 1   either way

Every Vlan, Loopback and Null interface reappears in the Issues views (issues of -1, 0, 1, 2, 3, 9, 10, 11 and -3), and "Ignored Interfaces" (issues=-4) returns an empty list. Any admin who used {2,3} bounded repeats loses those too.

2. db_qstr_rlike() does not exist before Cacti 1.2.31.

Checked every 1.2 tag:

release/1.2.14  ABSENT
release/1.2.25  ABSENT
release/1.2.29  ABSENT
release/1.2.30  ABSENT
release/1.2.31  PRESENT

It is absent on develop as well. INFO declares compat = 1.2.14, so the Interfaces view is an undefined-function fatal on 17 of the 18 supported 1.2 releases, and on 1.3.

Introduced in #336. Fixed in #345 by quoting the pattern with db_qstr() and leaving it intact, which keeps the injection fix from #336 and removes the version dependency entirely.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions