backport: hardening and bugfixes for main stable by somethingwithproof · Pull Request #283 · Cacti/plugin_syslog

somethingwithproof · 2026-03-12T00:30:41Z

Consolidated backport of security and bugfix PRs.

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Though it's not complete. This should reduce the number of warnings.

Currently translated at 33.8% (126 of 372 strings) Co-authored-by: Anatoliy <hamrad99h2@gmail.com> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ru/ Translation: Cacti/syslog

Updated by "Squash Git commits" hook in Weblate. Translation: Cacti/syslog Translate-URL: http://translate.cacti.net/projects/cacti/syslog/

This changes cleans up some logging as well.

Copilot

Pull request overview

Consolidated backport that hardens the Syslog plugin and rolls in multiple bugfixes, with additional tooling/docs updates to support newer Cacti/PHP environments.

Changes:

Added/updated localization assets and helper scripts for gettext generation.
Refactored/consolidated frontend JS into js/functions.js, and expanded DB wrapper utilities.
Added CI workflow + test data population script, plus documentation/versioning updates.

Reviewed changes

Copilot reviewed 38 out of 95 changed files in this pull request and generated 16 comments.

Show a summary per file

File	Description
`locales/po/es-ES.po`	Adds Spanish (es_ES) translation catalog for Syslog UI strings
`locales/po/ar-SA.po`	Adds Arabic (ar_SA) translation catalog for Syslog UI strings
`locales/index.php`	Adds header block + normalizes redirect header quoting
`locales/build_gettext.sh`	Adds gettext build/merge/compile helper script
`locales/LC_MESSAGES/index.php`	Adds header block + normalizes redirect header quoting
`js/functions.js`	Centralizes Syslog plugin JS previously inlined in PHP
`index.php`	Adds header block; normalizes redirect
`images/index.php`	Adds header block + normalizes redirect header quoting
`database.php`	Expands/modernizes syslog DB wrapper API incl. prepared helpers and utility methods
`contrib/snmptt-syslog-connector.py`	Adds a contrib SNMPTT → syslog_incoming connector script
`config_local.php.dist`	Adds local syslog config template (incl. ssl/retries/install options)
`config.php.dist`	Extends DB config options (retries/SSL) + updates incoming field mappings
`README.md`	Major doc refresh: features, install notes, rsyslog examples, DB notes
`LICENSE`	Updates GPL text formatting/address (but currently contains conflict markers)
`INFO`	Updates plugin metadata (version/compat/capabilities)
`CHANGELOG.md`	Adds a standalone changelog capturing issues/features across versions
`.mdlrc`	Adds markdownlint configuration
`.mdl_style.rb`	Adds markdownlint style customizations
`.github/workflows/populate_syslog_incoming.sh`	Adds script to insert test syslog/rules data for CI
`.github/workflows/plugin-ci-workflow.yml`	Adds GitHub Actions workflow to run integration checks against Cacti + Syslog
`.github/copilot-instructions.md`	Adds repository-specific Copilot guidance for Syslog plugin development
`.github/agents/triage_agent.md.agent.md`	Adds agent definition doc for triage workflow
`.github/agents/triage_agent.agent.md`	Adds triage agent definition (duplicate/alternate)
`.github/agents/php-developer.agent.md`	Adds PHP developer agent definition
`.github/agents/mysql-mariadb.agent.md`	Adds MySQL/MariaDB DBA agent definition
`.github/agents/code-quality.agent.md`	Adds code-quality agent definition
`.github/ISSUE_TEMPLATE/feature_request.md`	Adds feature request issue template
`.github/ISSUE_TEMPLATE/bug_report.md`	Adds bug report issue template
`.github/ISSUE_TEMPLATE/agents/php-developer.agent.md`	Adds agent template copy for PHP developer
`.github/ISSUE_TEMPLATE/agents/mysql-mariadb.agent.md`	Adds agent template copy for MySQL/MariaDB
`.github/ISSUE_TEMPLATE/agents/code-quality.agent.md`	Adds agent template copy for code quality

You can also share your feedback on Copilot code review. Take the survey.

LICENSE

Copilot · 2026-03-12T00:33:25Z

database.php

+ * @param $syslog_cnn - the connection object to connect to
+ *
+ * @return the id of the last auto incriment row that was created
+ */
+function syslog_db_fetch_insert_id() {
+	global $syslog_cnn;
 	return  db_fetch_insert_id($syslog_cnn);


This changes syslog_db_fetch_insert_id from taking a $syslog_cnn argument to taking none. In PHP 8+, existing call sites that still pass an argument will throw ArgumentCountError. To preserve backward compatibility, accept an optional parameter (or variadic) and fall back to global $syslog_cnn when not provided.

Suggested change

* @param $syslog_cnn - the connection object to connect to

*

* @return the id of the last auto incriment row that was created

*/

function syslog_db_fetch_insert_id() {

global $syslog_cnn;

return db_fetch_insert_id($syslog_cnn);

* @param object|null $syslog_cnn - (optional) the connection object to use; falls back to global $syslog_cnn when null

*

* @return the id of the last auto incriment row that was created

*/

function syslog_db_fetch_insert_id($syslog_cnn = null) {

if ($syslog_cnn === null) {

global $syslog_cnn;

}

return db_fetch_insert_id($syslog_cnn);

Fixed -- added optional param with null default.

js/functions.js

README.md

Copilot · 2026-03-12T00:33:28Z

locales/index.php


-header("Location:../index.php");
+header('Location:../index.php');



After sending a Location header, it’s best practice to terminate the script (exit;) to prevent any further output/side effects (especially if additional code is ever added later). Consider adding exit; after the redirect.

Suggested change

exit;

Take it out as the script exit's anyway after the location. Same in the other pull requests.

locales/po/es-ES.po

INFO

Currently translated at 100.0% (385 of 385 strings) Co-authored-by: Daniel Nylander <daniel@danielnylander.se> Translate-URL: https://translate.cacti.net/projects/cacti/syslog/sv/ Translation: Cacti/syslog

Updated by "Squash Git commits" hook in Weblate. Translation: Cacti/syslog Translate-URL: https://translate.cacti.net/projects/cacti/syslog/

Refs Cacti#266 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

…cti#267) Refs Cacti#267 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

…Cacti#271) Refs Cacti#271 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Refs Cacti#273 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Refs Cacti#280 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

- LICENSE: remove stale conflict markers - database.php: restore backward-compat optional param on syslog_db_fetch_insert_id - js/functions.js: fix missing var declaration, #test->#term, prop('disabled'), remove empty .each() - CI workflow: authenticate MySQL healthcheck, remove password echo - populate script: INSERT -> REPLACE INTO for idempotent reruns - README.md: fix malformed code fence - locales: add exit after redirect, fix sed -i for macOS compat - es-ES.po: fix 'Cactus' -> 'Cacti', 'Depuraración' -> 'Depuración' Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Refs Cacti#281 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

…cti#294)

TheWitness

A few comments here.

TheWitness · 2026-03-18T12:43:13Z

.github/agents/triage_agent.md.agent.md

Is the naming correct on this file. It looks very redundant.

TheWitness · 2026-03-18T12:45:36Z

locales/index.php


-header("Location:../index.php");
+header('Location:../index.php');



Take it out as the script exit's anyway after the location. Same in the other pull requests.

- LICENSE: remove stale conflict markers - database.php: restore backward-compat optional param on syslog_db_fetch_insert_id - js/functions.js: fix missing var declaration, #test->#term, prop('disabled'), remove empty .each() - CI workflow: authenticate MySQL healthcheck, remove password echo - populate script: INSERT -> REPLACE INTO for idempotent reruns - README.md: fix malformed code fence - locales: add exit after redirect, fix sed -i for macOS compat - es-ES.po: fix 'Cactus' -> 'Cacti', 'Depuraración' -> 'Depuración' Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

somethingwithproof · 2026-03-18T22:44:29Z

Yes -- working on all four items now.

- Remove $uniqueID filter from syslog_remove query (incorrectly filtered removal rules by random batch marker) - Reorder CI workflow: lint/PHPStan before integration tests - Switch echo to print in syslog_batch_transfer.php Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Fix fullwidth percent signs and missing format specifiers. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

weblate and others added 30 commits March 19, 2022 09:45

Update translation files

cd3ace9

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

0b91321

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

97265a4

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

f70eba1

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

c1148eb

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

8e23732

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

a6a4959

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

0784876

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

cfb3dc6

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

cdfe99e

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

d52b107

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

b19d897

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translation files

2ce9d3c

Updated by "Update PO files to match POT (msgmerge)" hook in Weblate. Co-authored-by: Weblate <noreply@weblate.org> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ Translation: Cacti/syslog

Update translations

a7b6bd7

More updates for reporting to be conforming to Format CSS specification

7a6f3bb

Don't use syslog.css if using a format css file.

8f55100

Changes to support 'level'. Not fully QA'd

d88654c

Replacement of MultiSelectFilter with private implementation

a97f3d8

Add a placeholder

527ad26

Commit missed database.php changes and query error for remote syslog

cecc1ca

QA: Missed the setup.php changes.

5948d8b

Resolving Cacti#172

feb8042

Though it's not complete. This should reduce the number of warnings.

Another minor update to Cacti#172

cb00018

Fixing Issue Cacti#160

c04d75f

Fixing Issue Cacti#151 - Executables executing

e5fbf2c

ChangeLog Update only.

61bfbc8

Translated using Weblate (Russian)

2b81b79

Currently translated at 33.8% (126 of 372 strings) Co-authored-by: Anatoliy <hamrad99h2@gmail.com> Translate-URL: http://translate.cacti.net/projects/cacti/syslog/ru/ Translation: Cacti/syslog

Update translation files

01674f0

Updated by "Squash Git commits" hook in Weblate. Translation: Cacti/syslog Translate-URL: http://translate.cacti.net/projects/cacti/syslog/

Fixing Issue Cacti#108 Add Body Text to Alerts

33bfc41

This changes cleans up some logging as well.

Update translation file

7e6e093

Copilot AI review requested due to automatic review settings March 12, 2026 00:30

Copilot AI reviewed Mar 12, 2026

View reviewed changes

somethingwithproof force-pushed the backport/main-hardening-v2 branch 3 times, most recently from 2b8d746 to a482d04 Compare March 12, 2026 00:41

weblate and others added 9 commits March 14, 2026 07:18

Translated using Weblate (Swedish)

6902d91

Currently translated at 100.0% (385 of 385 strings) Co-authored-by: Daniel Nylander <daniel@danielnylander.se> Translate-URL: https://translate.cacti.net/projects/cacti/syslog/sv/ Translation: Cacti/syslog

Translated using Weblate (Swedish)

4ad1089

Currently translated at 100.0% (385 of 385 strings) Co-authored-by: Daniel Nylander <daniel@danielnylander.se> Translate-URL: https://translate.cacti.net/projects/cacti/syslog/sv/ Translation: Cacti/syslog

Update translation files

13feea6

Updated by "Squash Git commits" hook in Weblate. Translation: Cacti/syslog Translate-URL: https://translate.cacti.net/projects/cacti/syslog/

fix: correct host/program alert status placeholders (Cacti#266)

9ed2966

Refs Cacti#266 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

fix: execute replication CREATE TABLE SQL from SHOW CREATE output (Ca…

203b90e

…cti#267) Refs Cacti#267 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

fix: scope partition maintenance to target table and lock create path (…

6f1a5a9

…Cacti#271) Refs Cacti#271 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

fix: use strict MariaDB detection in install advisor (Cacti#273)

960186e

Refs Cacti#273 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

refactor: centralize XML import payload loading (Cacti#280)

4aceb63

Refs Cacti#280 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

typos (Cacti#282)

41bd748

somethingwithproof force-pushed the backport/main-hardening-v2 branch from a482d04 to bf55698 Compare March 16, 2026 16:43

somethingwithproof added 5 commits March 16, 2026 13:12

refactor: extract duplicated alert command execution paths (Cacti#281)

9f6715d

Refs Cacti#281 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Locales: Fix zh-TW full-width percent sign syntax errors (Cacti#292)

baf13dc

Locales: Fix ja-JP System Logs copy-paste error (Cacti#293)

d4fe834

Locales: Cleanup Portuguese (PT and BR) and resolve fuzzy strings (Ca…

d694387

…cti#294)

Locales: Resolve fuzzy strings in Russian and Turkish (Cacti#295)

9166406

TheWitness requested changes Mar 18, 2026

View reviewed changes

somethingwithproof added 3 commits March 18, 2026 12:12

backport: consolidated security hardening and bugfixes for main

f81e911

test: add Pest unit tests for XML import payload helper

0229248

somethingwithproof force-pushed the backport/main-hardening-v2 branch from bf55698 to da87864 Compare March 18, 2026 19:12

somethingwithproof added 2 commits March 18, 2026 16:11

fix(i18n): correct zh-CN.po format string errors

b1f3b8c

Fix fullwidth percent signs and missing format specifiers. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>


		header("Location:../index.php");
		header('Location:../index.php');

Conversation

somethingwithproof commented Mar 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

somethingwithproof Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

somethingwithproof Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

TheWitness Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheWitness left a comment

Choose a reason for hiding this comment

Uh oh!

TheWitness Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

TheWitness Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

somethingwithproof commented Mar 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants