setup.php

<?php
/*
 +-------------------------------------------------------------------------+
 | Copyright (C) 2004-2026 The Cacti Group                                 |
 |                                                                         |
 | This program is free software; you can redistribute it and/or           |
 | modify it under the terms of the GNU General Public License             |
 | as published by the Free Software Foundation; either version 2          |
 | of the License, or (at your option) any later version.                  |
 |                                                                         |
 | This program is distributed in the hope that it will be useful,         |
 | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
 | GNU General Public License for more details.                            |
 +-------------------------------------------------------------------------+
 | Cacti: The Complete RRDTool-based Graphing Solution                     |
 +-------------------------------------------------------------------------+
 | This code is designed, written, and maintained by the Cacti Group. See  |
 | about.php and/or the AUTHORS file for specific developer information.   |
 +-------------------------------------------------------------------------+
 | http://www.cacti.net/                                                   |
 +-------------------------------------------------------------------------+
*/

/**
 * Return the CSP nonce attribute for inline <script> tags, safely across
 * Cacti versions. Newer Cacti releases enforce a Content-Security-Policy that
 * requires a per-request nonce on parser-inserted scripts; older releases lack
 * the CactiSecureHeaders class, so this returns an empty string there.
 *
 * @return string The nonce attribute when supported, otherwise empty string.
 */
function plugin_syslog_csp_nonce(): string {
	if (class_exists('CactiSecureHeaders')) {
		return CactiSecureHeaders::getNonceAttribute();
	}

	return '';
}

/**
 * Install the Syslog plugin, registering its hooks, realms and database tables.
 *
 * @return bool|void True when the install action was queued or completed, false
 *                   when the Syslog config file has not been created yet, and
 *                   nothing when the install is already running in the background.
 */
function plugin_syslog_install() {
	global $config, $syslog_upgrade;
	static $bg_inprocess = false;

	require_once(__DIR__ . '/includes/installer.php');
	require_once(__DIR__ . '/includes/schema.php');
	require_once(__DIR__ . '/includes/settings.php');

	syslog_determine_config();

	if (defined('SYSLOG_CONFIG')) {
		include(SYSLOG_CONFIG);
	} else {
		raise_message('syslog_info', __('Please rename either your config.php.dist or config_local.php.dist files in the syslog directory, and change setup your database before installing.', 'syslog'), MESSAGE_LEVEL_ERROR);

		return false;
	}

	syslog_connect();

	/** @var string $syslogdb_default The name of the Syslog database, defined in the Syslog config file. */
	$syslog_exists = sizeof(syslog_db_fetch_row("SHOW TABLES FROM `$syslogdb_default` LIKE 'syslog'"));

	// ================= input validation =================
	get_filter_request_var('days');
	// ====================================================

	api_plugin_register_hook('syslog', 'config_arrays',         'syslog_config_arrays',        'includes/settings.php');
	api_plugin_register_hook('syslog', 'draw_navigation_text',  'syslog_draw_navigation_text', 'includes/navigation.php');
	api_plugin_register_hook('syslog', 'config_settings',       'syslog_config_settings',      'includes/settings.php');
	api_plugin_register_hook('syslog', 'settings_bottom',       'syslog_settings_bottom',      'includes/settings.php', true);
	api_plugin_register_hook('syslog', 'top_header_tabs',       'syslog_show_tab',             'includes/navigation.php');
	api_plugin_register_hook('syslog', 'top_graph_header_tabs', 'syslog_show_tab',             'includes/navigation.php');
	api_plugin_register_hook('syslog', 'poller_bottom',         'syslog_poller_bottom',        'includes/processing.php');
	api_plugin_register_hook('syslog', 'graph_buttons',         'syslog_graph_buttons',        'includes/navigation.php');
	api_plugin_register_hook('syslog', 'utilities_list',        'syslog_utilities_list',       'includes/utilities.php');
	api_plugin_register_hook('syslog', 'utilities_action',      'syslog_utilities_action',     'includes/utilities.php');

	// hook for table replication
	api_plugin_register_hook('syslog', 'replicate_out',         'syslog_replicate_out',        'includes/processing.php');

	api_plugin_register_realm('syslog', 'syslog.php', 'Syslog User', 1);
	api_plugin_register_realm('syslog', 'syslog_alerts.php,syslog_removal.php,syslog_reports.php', 'Rule Viewer', 1);
	api_plugin_register_realm('syslog', 'syslog_rule_administrator.php,syslog_device_rules.php', 'Rule Administrator', 1);
	api_plugin_register_realm('syslog', 'syslog_saved_searches.php,syslog_dashboards.php', 'Syslog Administration', 1);
	api_plugin_register_realm('syslog', 'syslog_saved_searches_share.php', 'Share Saved Templates', 1);
	api_plugin_register_realm('syslog', 'syslog_dashboards_share.php', 'Share Dashboards', 1);

	if (isset_request_var('install')) {
		if (!$bg_inprocess) {
			syslog_execute_update($syslog_exists, $_REQUEST);
			$bg_inprocess = true;

			return true;
		}
	} elseif (isset($syslog_install_options) && cacti_sizeof($syslog_install_options)) {
		// hack for syslog so IBM Spectrum LSF RTM can install syslog without user interaction with preset defaults
		if (!$bg_inprocess) {
			/** @var array<string, mixed> $syslog_install_options Optional pre-configured install options, defined in the Syslog config file. */
			syslog_execute_update($syslog_exists, $syslog_install_options);
			$bg_inprocess = true;
		}
	} elseif (isset_request_var('cancel')) {
		header('Location:' . $config['url_path'] . 'plugins.php?mode=uninstall&id=syslog&uninstall&uninstall_method=all');
		exit;
	} else {
		syslog_install_advisor($syslog_exists);
		exit;
	}
}

/**
 * Perform the requested Syslog install or upgrade action.
 *
 * @param int                  $syslog_exists Whether the Syslog table already exists.
 * @param array<string, mixed> $options       The install options, either from the
 *                                            request or the Syslog config file.
 *
 * @return void
 */
function syslog_execute_update(int $syslog_exists, array $options): void {
	global $config;
	$remote_options = ['syslog_remote_enabled', 'syslog_remote_sync_rules', 'syslog_remote_store_records'];

	require_once(__DIR__ . '/includes/installer.php');
	require_once(__DIR__ . '/includes/schema.php');

	if (isset($options['cancel'])) {
		header('Location:' . $config['url_path'] . 'plugins.php?mode=uninstall&id=syslog&uninstall&uninstall_method=all');
		exit;
	}

	// Millisecond (TIMESTAMP(3)) logtime storage is only supported on MariaDB,
	// where a fractional column can still be RANGE partitioned and pruned.
	// Reject an explicit millisecond request on MySQL rather than silently
	// downgrading it, so the operator understands why.
	if (isset($options['logtime_precision']) && $options['logtime_precision'] === 'ms' && !syslog_db_is_mariadb()) {
		raise_message('syslog_error', __('Millisecond (TIMESTAMP(3)) timestamps are only supported on MariaDB. This server is MySQL, so install with second precision timestamps instead.', 'syslog'), MESSAGE_LEVEL_ERROR);
		cacti_log('SYSLOG ERROR: Install rejected because millisecond timestamps were requested on MySQL, which cannot partition-prune a fractional logtime column', false, 'SYSLOG');

		if (isset($options['install'])) {
			syslog_install_advisor($syslog_exists, $options);
		}

		return;
	}

	$requested_engine      = isset($options['engine']) ? $options['engine'] : 'InnoDB';
	$compatibility_options = $options;

	if (isset($options['install'])) {
		foreach ($remote_options as $option) {
			$compatibility_options[$option] = isset($options[$option]) && $options[$option] === 'on' ? 'on' : '';
		}
	}

	if (!syslog_install_storage_engine_is_compatible($requested_engine, $compatibility_options)) {
		raise_message('syslog_error', __('Aria storage cannot be used when any Remote Data Collector option is enabled. Select InnoDB or disable all Remote Data Collector options.', 'syslog'), MESSAGE_LEVEL_ERROR);
		cacti_log('SYSLOG ERROR: Install rejected because Aria storage is incompatible with Remote Data Collector options', false, 'SYSLOG');

		if (isset($options['install'])) {
			syslog_install_advisor($syslog_exists, $options);
		}

		return;
	}

	if (!isset($options['return']) && (isset($options['install']) || array_intersect($remote_options, array_keys($options)))) {
		foreach ($remote_options as $option) {
			set_config_option($option, isset($options[$option]) && $options[$option] === 'on' ? 'on' : '');
		}
	}

	if (isset($options['return'])) {
		db_execute('DELETE FROM plugin_config WHERE directory="syslog"');
		db_execute('DELETE FROM plugin_realms WHERE plugin="syslog"');
		db_execute('DELETE FROM plugin_db_changes WHERE plugin="syslog"');
		db_execute('DELETE FROM plugin_hooks WHERE name="syslog"');
	} else {
		syslog_setup_table_new($options, $syslog_exists && ($options['upgrade_type'] ?? '') !== 'truncate');
	}

	if (isset($options['days'])) {
		set_config_option('syslog_retention', $options['days']);
	}
}

/**
 * Uninstall the Syslog plugin, optionally removing its database tables.
 *
 * @return void
 */
function plugin_syslog_uninstall(): void {
	global $config, $syslogdb_default;

	require_once(__DIR__ . '/includes/installer.php');

	syslog_determine_config();
	syslog_connect();

	if (isset_request_var('cancel') || isset_request_var('return')) {
		header('Location:' . $config['url_path'] . 'plugins.php?header=false');
		exit;
	}

	if (isset_request_var('uninstall_method')) {
		if (get_nfilter_request_var('uninstall_method') == 'all') {
			// do the big tables first
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_removed`");

			// do the settings tables last
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_programs`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_status`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_device_rule`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_alert_counts`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_alert_suppression`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_threshold_state`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_threshold_messages`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_incoming`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_threshold_recovery_queue`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_alert`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_remove`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_reports`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_facilities`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_statistics`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_host_facilities`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_priorities`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_logs`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_hosts`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_saved_searches`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_dashboard_panels`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_dashboards`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_dashboards_perm`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_saved_searches_perm`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_replication_output`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_replication_receipts`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_replication_collectors`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_replication_recovery`");

			// Remote collectors may also own message history and operational tables.
			if ($config['poller_id'] == 1) {
				foreach ([
					'syslog',
					'syslog_removed',
					'syslog_programs',
					'syslog_status',
					'syslog_device_rule',
					'syslog_alert_counts',
					'syslog_alert_suppression',
					'syslog_threshold_state',
					'syslog_threshold_messages',
					'syslog_incoming',
					'syslog_threshold_recovery_queue',
					'syslog_alert',
					'syslog_remove',
					'syslog_reports',
					'syslog_facilities',
					'syslog_statistics',
					'syslog_host_facilities',
					'syslog_priorities',
					'syslog_logs',
					'syslog_hosts',
					'syslog_saved_searches',
					'syslog_dashboard_panels',
					'syslog_dashboards',
					'syslog_dashboards_perm',
					'syslog_saved_searches_perm',
					'syslog_replication_output',
					'syslog_replication_receipts',
					'syslog_replication_collectors',
					'syslog_replication_recovery'
				] as $table) {
					api_plugin_drop_remote_table($table);
				}
			}
		} else {
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_removed`");
		}
	} elseif (function_exists('syslog_uninstall_advisor')) {
		syslog_uninstall_advisor();
		exit;
	}
}

/**
 * Check that the Syslog config file has been created before installing.
 *
 * @return bool True when either config file is present, false otherwise.
 */
function plugin_syslog_check_config(): bool {
	// Here we will check to ensure everything is configured
	if (!file_exists(__DIR__ . '/config_local.php') && !file_exists(__DIR__ . '/config.php')) {
		raise_message('syslog_info', __('Please rename either your config.php.dist or config_local.php.dist files in the syslog directory, and change setup your database before installing.', 'syslog'), MESSAGE_LEVEL_ERROR);

		return false;
	}

	$version   = plugin_syslog_version();
	$installed = db_fetch_cell_prepared('SELECT version FROM plugin_config WHERE directory = ?', ['syslog']);

	if (get_current_page() === 'plugins.php' && get_nfilter_request_var('mode') === 'enable' &&
		$installed !== false && isset($version['version']) && version_compare((string) $installed, $version['version'], '<') &&
		!isset_request_var('syslog_upgrade_confirm')) {
		require_once(__DIR__ . '/includes/installer.php');
		syslog_upgrade_advisor((string) $installed, $version['version']);
	}

	require_once(__DIR__ . '/includes/settings.php');
	syslog_upgrade_hook_module_paths();

	return syslog_check_upgrade();
}

/**
 * Upgrade the Syslog plugin to the newest version.
 *
 * @return bool Always false, the upgrade is handled by syslog_check_upgrade().
 */
function plugin_syslog_upgrade(): bool {
	require_once(__DIR__ . '/includes/settings.php');

	syslog_upgrade_hook_module_paths();
	syslog_check_upgrade();

	return false;
}

/** Move existing Cacti hook rows from the old setup.php facade to their modules. */
function syslog_upgrade_hook_module_paths(): void {
	$hooks = [
		'config_arrays'         => ['syslog_config_arrays', 'includes/settings.php'],
		'draw_navigation_text'  => ['syslog_draw_navigation_text', 'includes/navigation.php'],
		'config_settings'       => ['syslog_config_settings', 'includes/settings.php'],
		'settings_bottom'       => ['syslog_settings_bottom', 'includes/settings.php'],
		'top_header_tabs'       => ['syslog_show_tab', 'includes/navigation.php'],
		'top_graph_header_tabs' => ['syslog_show_tab', 'includes/navigation.php'],
		'poller_bottom'         => ['syslog_poller_bottom', 'includes/processing.php'],
		'graph_buttons'         => ['syslog_graph_buttons', 'includes/navigation.php'],
		'config_insert'         => ['syslog_config_insert', 'includes/settings.php'],
		'utilities_list'        => ['syslog_utilities_list', 'includes/utilities.php'],
		'utilities_action'      => ['syslog_utilities_action', 'includes/utilities.php'],
		'replicate_out'         => ['syslog_replicate_out', 'includes/processing.php']
	];
	$registered = db_fetch_assoc_prepared('SELECT hook FROM plugin_hooks WHERE name = ? AND file = ?', ['syslog', 'setup.php']);

	if (!is_array($registered) || !$registered) {
		return;
	}
	$modules = [];

	foreach ($registered as $row) {
		if (isset($hooks[$row['hook']])) {
			[$function, $file] = $hooks[$row['hook']];
			db_execute_prepared('UPDATE plugin_hooks SET `function` = ?, file = ? WHERE name = ? AND hook = ? AND file = ?', [$function, $file, 'syslog', $row['hook'], 'setup.php']);
			$modules[$file] = true;
		}
	}

	foreach (array_keys($modules) as $file) {
		require_once(__DIR__ . '/' . $file);
	}
}

/**
 * Determine which Syslog config file is present, and if it is for a remote database.
 *
 * @return void
 */
function syslog_determine_config(): void {
	global $config;

	if (!defined('SYSLOG_CONFIG')) {
		if (file_exists(__DIR__ . '/config_local.php')) {
			define('SYSLOG_CONFIG', __DIR__ . '/config_local.php');
			$config['syslog_remote_db'] = true;
		} elseif (file_exists(__DIR__ . '/config.php')) {
			define('SYSLOG_CONFIG', __DIR__ . '/config.php');
			$config['syslog_remote_db'] = false;
		}
	}
}

/**
 * Check that either Syslog config file exists and is readable.
 *
 * @return bool True when a Syslog config file is available, false otherwise.
 */
function syslog_config_safe(): bool {
	foreach ([__DIR__ . '/config_local.php', __DIR__ . '/config.php'] as $file) {
		if (file_exists($file) && is_readable($file)) {
			return true;
		}
	}

	return false;
}

/**
 * Connect to the Syslog database, either the local Cacti database or a remote one.
 *
 * @return bool True when a Syslog database connection is available, false otherwise.
 */
function syslog_connect(): bool {
	global $config, $syslog_cnn, $syslogdb_default, $local_db_cnn_id, $remote_db_cnn_id, $syslog_incoming_config;

	syslog_determine_config();

	global $database_sessions, $database_hostname, $database_port, $database_default;

	static $schema_inprocess = false;
	static $schema_ready     = false;

	// Handle remote syslog processing
	if (defined('SYSLOG_CONFIG')) {
		include(SYSLOG_CONFIG);
	}

	require_once(__DIR__ . '/includes/functions.php');
	require_once(__DIR__ . '/includes/database.php');

	$cacti_local_cnn = $local_db_cnn_id
		?? ($database_sessions["$database_hostname:$database_port:$database_default"] ?? false);

	$connect_remote = false;
	$connected      = true;

	// Connect to the Syslog Database
	if (empty($syslog_cnn)) {
		/** @var bool $use_cacti_db Whether the Syslog tables live in the local Cacti database, defined in the Syslog config file. */
		if ($config['poller_id'] == 1) {
			if ($use_cacti_db == true) {
				$syslog_cnn = $cacti_local_cnn;
				$connected  = is_object($syslog_cnn);
			} else {
				$connect_remote = true;
			}
		} elseif (isset($config['syslog_remote_db'])) {
			if ($use_cacti_db == true) {
				$syslog_cnn = $cacti_local_cnn;
				$connected  = is_object($syslog_cnn);
			} else {
				$connect_remote = true;
			}
		} else {
			if ($use_cacti_db == true) {
				$syslog_cnn = $remote_db_cnn_id;
				$connected  = is_object($syslog_cnn);
			} else {
				$connect_remote = true;
			}
		}

		if ($connect_remote) {
			if (!isset($syslogdb_port)) {
				$syslogdb_port = '3306';
			}

			if (!isset($syslogdb_retries)) {
				$syslogdb_retries = '5';
			}

			if (!isset($syslogdb_ssl)) {
				$syslogdb_ssl = false;
			}

			if (!isset($syslogdb_ssl_key)) {
				$syslogdb_ssl_key = '';
			}

			if (!isset($syslogdb_ssl_cert)) {
				$syslogdb_ssl_cert = '';
			}

			if (!isset($syslogdb_ssl_ca)) {
				$syslogdb_ssl_ca = '';
			}

			/**
			 * @var string $syslogdb_hostname The hostname of the Syslog database server.
			 * @var string $syslogdb_username The username for the Syslog database server.
			 * @var string $syslogdb_password The password for the Syslog database server.
			 * @var string $syslogdb_type     The database type of the Syslog database server.
			 */
			$syslog_cnn = syslog_db_connect_real($syslogdb_hostname, $syslogdb_username, $syslogdb_password, $syslogdb_default, $syslogdb_type, $syslogdb_port, $syslogdb_retries, $syslogdb_ssl, $syslogdb_ssl_key, $syslogdb_ssl_cert, $syslogdb_ssl_ca);

			if ($syslog_cnn == false) {
				print "FATAL Can not connect\n";
				$connected = false;
			}
		}
	}

	// Repair missing tables before any main or enabled remote collector queries.
	if ($connected && ((int) $config['poller_id'] <= 1 || read_config_option('syslog_remote_enabled') === 'on')
		&& !$schema_inprocess && !$schema_ready && !defined('IN_PLUGIN_INSTALL') && api_plugin_is_enabled('syslog')) {
		$schema_inprocess = true;

		try {
			require_once(__DIR__ . '/includes/schema.php');
			$schema_ready = syslog_ensure_table_structures();
			$connected    = $schema_ready;
		} finally {
			$schema_inprocess = false;
		}
	}

	return $connected;
}

/**
 * Repair old installs before Cacti's auth.php checks the requested page.
 *
 * @return void
 */
function syslog_upgrade_saved_search_realm(): void {
	$admin    = null;
	$template = null;
	$realms   = db_fetch_assoc_prepared('SELECT id, file, display FROM plugin_realms WHERE plugin = ?', ['syslog']);

	if (is_array($realms)) {
		foreach ($realms as $realm) {
			$files = explode(',', $realm['file']);

			if (in_array('syslog_alerts.php', $files, true) && ($realm['display'] ?? '') !== 'Rule Viewer') {
				$admin = $realm;
			}

			if (in_array('syslog_saved_searches.php', $files, true)) {
				$template = $realm;
			}
		}
	}

	if ($admin === null) {
		return;
	}

	if ($template === null) {
		// Keep the realm ID: existing user and group grants must not change.
		if (!db_execute_prepared('UPDATE plugin_realms SET file = ? WHERE id = ? AND plugin = ?',
			[$admin['file'] . ',syslog_saved_searches.php', $admin['id'], 'syslog'])) {
			return;
		}
		$template = $admin;
	}
}

/**
 * Give pre-existing installs the Dashboards console page inside the admin realm.
 *
 * @return void
 */
function syslog_upgrade_dashboard_realm(): void {
	$realms = db_fetch_assoc_prepared('SELECT id, file, display FROM plugin_realms WHERE plugin = ?', ['syslog']);

	if (is_array($realms)) {
		foreach ($realms as $realm) {
			$files = explode(',', $realm['file']);

			if (!in_array('syslog_alerts.php', $files, true) || ($realm['display'] ?? '') === 'Rule Viewer') {
				continue;
			}

			if (in_array('syslog_dashboards.php', $files, true)) {
				return;
			}

			// Keep the realm ID: existing user and group grants must not change.
			if (!db_execute_prepared('UPDATE plugin_realms SET file = ? WHERE id = ? AND plugin = ?',
				[$realm['file'] . ',syslog_dashboards.php', $realm['id'], 'syslog'])) {
				return;
			}

			return;
		}
	}
}

/** Give Rule Administrators access to device alert rules. */
function syslog_upgrade_device_rule_realm(): void {
	$realms = db_fetch_assoc_prepared('SELECT id, file, display FROM plugin_realms WHERE plugin = ?', ['syslog']);

	if (!is_array($realms)) {
		return;
	}

	foreach ($realms as $realm) {
		if (($realm['display'] ?? '') !== 'Rule Administrator') {
			continue;
		}
		$files = explode(',', $realm['file']);

		if (!in_array('syslog_device_rules.php', $files, true)) {
			$files[] = 'syslog_device_rules.php';

			if (!db_execute_prepared('UPDATE plugin_realms SET file = ? WHERE id = ? AND plugin = ?', [implode(',', $files), $realm['id'], 'syslog'])) {
				return;
			}
		}

		return;
	}
}

/**
 * Preserve existing Syslog Administration grants as Rule Administrator grants.
 *
 * Rule pages must be registered to the Rule Viewer realm so Cacti can admit
 * read-only users before page code runs.  The administrator realm is a
 * permission-only entry that the rule pages check before every mutation.
 * Legacy combined realms must not retain Saved Search Templates or Dashboards:
 * those pages belong exclusively to the separate Syslog Administration realm.
 *
 * @return void
 */
function syslog_upgrade_rule_permissions(): void {
	$realms = db_fetch_assoc_prepared('SELECT id, file, display FROM plugin_realms WHERE plugin = ?', ['syslog']);

	if (!is_array($realms)) {
		return;
	}

	foreach ($realms as $realm) {
		$files = explode(',', $realm['file']);

		if (($realm['display'] ?? '') !== 'Syslog Administration' || !in_array('syslog_alerts.php', $files, true) || in_array('syslog_rule_administrator.php', $files, true)) {
			continue;
		}

		$files = array_values(array_diff($files, [
			'syslog_alerts.php',
			'syslog_removal.php',
			'syslog_reports.php',
			'syslog_saved_searches.php',
			'syslog_dashboards.php'
		]));
		$files[] = 'syslog_rule_administrator.php';
		$files[] = 'syslog_device_rules.php';

		if (!db_execute_prepared('UPDATE plugin_realms SET file = ? WHERE id = ? AND plugin = ?',
			[implode(',', $files), $realm['id'], 'syslog'])) {
			return;
		}

		return;
	}
}

/**
 * Merge duplicate granular-rule realms created by earlier registrations.
 *
 * Cacti renders one permission checkbox per realm record.  If an install has
 * several records with the same Rule Viewer or Rule Administrator label, the
 * permissions screen repeats that label. Preserve their grants in the first
 * record and restore canonical filenames so the roles remain separate.
 *
 * @return bool Whether duplicate repair succeeded.
 */
function syslog_upgrade_consolidate_rule_realms(): bool {
	foreach (['Rule Viewer', 'Rule Administrator'] as $display) {
		$realms = db_fetch_assoc_prepared('SELECT id, file FROM plugin_realms WHERE plugin = ? AND display = ? ORDER BY id', ['syslog', $display]);
		$files  = $display === 'Rule Viewer' ? 'syslog_alerts.php,syslog_removal.php,syslog_reports.php' : 'syslog_rule_administrator.php,syslog_device_rules.php';

		if (!is_array($realms) || !$realms || (count($realms) === 1 && $realms[0]['file'] === $files)) {
			continue;
		}

		$keeper = array_shift($realms);

		if (!db_begin_transaction()) {
			return false;
		}

		foreach ($realms as $realm) {
			foreach (['user_auth_realm' => 'user_id', 'user_auth_group_realm' => 'group_id'] as $table => $owner) {
				if (!db_execute_prepared("INSERT IGNORE INTO $table ($owner, realm_id) SELECT $owner, ? FROM $table WHERE realm_id = ?", [(int) $keeper['id'] + 100, (int) $realm['id'] + 100]) ||
					!db_execute_prepared("DELETE FROM $table WHERE realm_id = ?", [(int) $realm['id'] + 100])) {
					db_rollback_transaction();

					return false;
				}
			}

			if (!db_execute_prepared('DELETE FROM plugin_realms WHERE id = ? AND plugin = ?', [(int) $realm['id'], 'syslog'])) {
				db_rollback_transaction();

				return false;
			}
		}

		// Broken migrations put the administrator filename in Viewer records.
		// Never union those files: doing so merges the two permission levels.
		if (!db_execute_prepared('UPDATE plugin_realms SET file = ? WHERE id = ?', [$files, (int) $keeper['id']]) || !db_commit_transaction()) {
			db_rollback_transaction();

			return false;
		}
	}

	return true;
}

/** Replace synthetic role inheritance with explicit Cacti realm grants. */
function syslog_upgrade_explicit_realm_grants(): bool {
	$realms = db_fetch_assoc_prepared('SELECT id, display FROM plugin_realms WHERE plugin = ?', ['syslog']);

	if (!is_array($realms)) {
		return false;
	}

	$ids = [];

	foreach ($realms as $realm) {
		$ids[$realm['display']][] = (int) $realm['id'] + 100;
	}
	$viewer        = $ids['Rule Viewer'][0] ?? 0;
	$administrator = $ids['Rule Administrator'][0] ?? 0;
	$umbrella      = $ids['Syslog Administrator'] ?? [];

	if (!$viewer || !$administrator || !db_begin_transaction()) {
		return false;
	}

	$source_ids   = array_merge([$viewer, $administrator], $umbrella);
	$placeholders = implode(',', array_fill(0, count($source_ids), '?'));
	$direct       = db_fetch_assoc_prepared("SELECT user_id, realm_id FROM user_auth_realm WHERE realm_id IN ($placeholders)", $source_ids);
	$groups       = db_fetch_assoc_prepared("SELECT group_id, realm_id FROM user_auth_group_realm WHERE realm_id IN ($placeholders)", $source_ids);

	if (!is_array($direct) || !is_array($groups)) {
		db_rollback_transaction();

		return false;
	}
	$direct_grants = [];
	$group_grants  = [];

	foreach ($direct as $grant) {
		$direct_grants[(int) $grant['user_id']][(int) $grant['realm_id']] = true;
	}

	foreach ($groups as $grant) {
		$group_grants[(int) $grant['group_id']][(int) $grant['realm_id']] = true;
	}
	$affected = [];

	foreach ($direct_grants as $user_id => $granted) {
		if (array_intersect($umbrella, array_keys($granted)) || (isset($granted[$administrator]) && !isset($granted[$viewer]))) {
			$affected[$user_id] = true;
		}
	}

	foreach ($group_grants as $group_id => $granted) {
		if (array_intersect($umbrella, array_keys($granted)) || (isset($granted[$administrator]) && !isset($granted[$viewer]))) {
			$members = db_fetch_assoc_prepared('SELECT user_id FROM user_auth_group_members WHERE group_id = ?', [$group_id]);

			if (!is_array($members)) {
				db_rollback_transaction();

				return false;
			}

			foreach ($members as $member) {
				$affected[(int) $member['user_id']] = true;
			}
		}
	}

	$grants    = [$administrator => [$viewer]];
	$all_pages = [];

	foreach ($ids as $display => $realm_ids) {
		if ($display !== 'Syslog Administrator') {
			$all_pages = array_merge($all_pages, $realm_ids);
		}
	}

	foreach ($umbrella as $source) {
		$grants[$source] = array_values(array_unique($all_pages));
	}

	foreach ($grants as $source => $targets) {
		foreach ($targets as $target) {
			foreach (['user_auth_realm' => 'user_id', 'user_auth_group_realm' => 'group_id'] as $table => $owner) {
				if (!db_execute_prepared("INSERT IGNORE INTO $table ($owner, realm_id) SELECT $owner, ? FROM $table WHERE realm_id = ?", [$target, $source])) {
					db_rollback_transaction();

					return false;
				}
			}
		}
	}

	foreach ($umbrella as $source) {
		foreach (['user_auth_realm', 'user_auth_group_realm'] as $table) {
			if (!db_execute_prepared("DELETE FROM $table WHERE realm_id = ?", [$source])) {
				db_rollback_transaction();

				return false;
			}
		}

		if (!db_execute_prepared('DELETE FROM plugin_realms WHERE plugin = ? AND id = ?', ['syslog', $source - 100])) {
			db_rollback_transaction();

			return false;
		}
	}

	foreach (array_keys($affected) as $user_id) {
		if (!db_execute_prepared('DELETE FROM user_auth_cache WHERE user_id = ?', [$user_id]) ||
			!db_execute_prepared('UPDATE user_auth SET reset_perms = FLOOR(RAND() * 4294967295) + 1 WHERE id = ?', [$user_id])) {
			db_rollback_transaction();

			return false;
		}
	}

	if (!db_commit_transaction()) {
		db_rollback_transaction();

		return false;
	}

	if (isset($_SESSION['sess_user_id'], $affected[(int) $_SESSION['sess_user_id']])) {
		unset($_SESSION['sess_user_realms'], $_SESSION['sess_auth_names']);
	}

	return true;
}

/**
 * Create granular realms on existing installations and preserve legacy grants.
 *
 * @return bool Whether realm creation and grant migration succeeded.
 */
function syslog_upgrade_create_permission_realms(): bool {
	$targets = [
		'Rule Viewer'           => 'syslog_alerts.php,syslog_removal.php,syslog_reports.php',
		'Rule Administrator'    => 'syslog_rule_administrator.php,syslog_device_rules.php',
		'Syslog Administration' => 'syslog_saved_searches.php,syslog_dashboards.php',
		'Share Saved Templates' => 'syslog_saved_searches_share.php',
		'Share Dashboards'      => 'syslog_dashboards_share.php'
	];
	$realms = db_fetch_assoc_prepared('SELECT id, file, display FROM plugin_realms WHERE plugin = ?', ['syslog']);

	if (!is_array($realms)) {
		return false;
	}

	$legacy_viewers = [];
	$legacy_admins  = [];
	$missing        = [];

	foreach ($realms as $realm) {
		$files = explode(',', $realm['file']);

		if (in_array('syslog.php', $files, true) && ($realm['display'] ?? '') === 'Syslog User') {
			$legacy_viewers[] = (int) $realm['id'] + 100;
		}

		if (array_intersect($files, ['syslog_alerts.php', 'syslog_removal.php', 'syslog_reports.php'])
			&& !in_array($realm['display'] ?? '', ['Rule Viewer', 'Rule Administrator'], true)) {
			$legacy_admins[] = (int) $realm['id'] + 100;
		}
	}

	foreach ($targets as $display => $files) {
		$found = false;

		foreach ($realms as $realm) {
			if (($realm['display'] ?? '') === $display && $realm['file'] === $files) {
				$found = true;

				break;
			}
		}

		if (!$found) {
			$missing[$display] = $files;
		}
	}

	if (!$missing) {
		return true;
	}

	if (!db_begin_transaction()) {
		return false;
	}

	foreach ($missing as $display => $files) {
		if (!db_execute_prepared('INSERT INTO plugin_realms (plugin, file, display) VALUES (?, ?, ?)', ['syslog', $files, $display])) {
			db_rollback_transaction();

			return false;
		}
	}

	$updated_realms = db_fetch_assoc_prepared('SELECT id, file, display FROM plugin_realms WHERE plugin = ?', ['syslog']);

	if (!is_array($updated_realms)) {
		db_rollback_transaction();

		return false;
	}
	$target_ids = [];

	foreach ($updated_realms as $realm) {
		foreach ($targets as $display => $files) {
			if (($realm['display'] ?? '') === $display && $realm['file'] === $files) {
				$target_ids[$display] = (int) $realm['id'] + 100;
			}
		}
	}

	$sources = [
		'Rule Viewer'           => $legacy_viewers,
		'Rule Administrator'    => $legacy_admins,
		'Syslog Administration' => $legacy_admins
	];

	foreach ($sources as $display => $source_ids) {
		if (!isset($missing[$display], $target_ids[$display])) {
			continue;
		}

		foreach ($source_ids as $source_id) {
			foreach (['user_auth_realm' => 'user_id', 'user_auth_group_realm' => 'group_id'] as $table => $owner) {
				if (!db_execute_prepared("INSERT IGNORE INTO $table ($owner, realm_id) SELECT $owner, ? FROM $table WHERE realm_id = ?", [$target_ids[$display], $source_id])) {
					db_rollback_transaction();

					return false;
				}
			}
		}
	}

	$new_ids = array_values(array_intersect_key($target_ids, $missing));

	if (!$new_ids) {
		db_rollback_transaction();

		return false;
	}
	$placeholders = implode(',', array_fill(0, count($new_ids), '?'));
	$affected     = db_fetch_assoc_prepared("SELECT user_id FROM user_auth_realm WHERE realm_id IN ($placeholders)
		UNION SELECT ugm.user_id FROM user_auth_group_realm AS ugr
		INNER JOIN user_auth_group_members AS ugm ON ugm.group_id = ugr.group_id
		WHERE ugr.realm_id IN ($placeholders)", array_merge($new_ids, $new_ids));

	if (!is_array($affected)) {
		db_rollback_transaction();

		return false;
	}

	foreach ($affected as $row) {
		$user_id = (int) $row['user_id'];

		if (!db_execute_prepared('DELETE FROM user_auth_cache WHERE user_id = ?', [$user_id]) ||
			!db_execute_prepared('UPDATE user_auth SET reset_perms = FLOOR(RAND() * 4294967295) + 1 WHERE id = ?', [$user_id])) {
			db_rollback_transaction();

			return false;
		}
	}

	if (!db_commit_transaction()) {
		db_rollback_transaction();

		return false;
	}

	foreach ($affected as $row) {
		if (isset($_SESSION['sess_user_id']) && (int) $_SESSION['sess_user_id'] === (int) $row['user_id']) {
			unset($_SESSION['sess_user_realms'], $_SESSION['sess_auth_names']);

			break;
		}
	}

	return true;
}

/** Upgrade the Syslog schema and permissions at install/upgrade time. */
function syslog_check_upgrade(bool $force = false): bool {
	global $config, $syslogdb_default, $syslog_levels, $syslog_upgrade, $syslog_cnn;

	require_once(__DIR__ . '/includes/schema.php');
	require_once(__DIR__ . '/includes/settings.php');

	if (!syslog_connect()) {
		return false;
	}

	if (!syslog_upgrade_create_permission_realms()) {
		return false;
	}
	syslog_upgrade_saved_search_realm();
	syslog_upgrade_dashboard_realm();
	syslog_upgrade_rule_permissions();

	if (!syslog_upgrade_consolidate_rule_realms()) {
		return false;
	}
	// Cacti's registration API merges overlapping filenames; preserve legacy
	// realm IDs and grants while moving those pages to their explicit realms.
	syslog_upgrade_device_rule_realm();

	if (!syslog_upgrade_explicit_realm_grants()) {
		return false;
	}

	if (!syslog_ensure_table_structures()) {
		return false;
	}
	syslog_dashboard_seed_default();
	db_execute_prepared('DELETE FROM plugin_hooks WHERE name = ? AND hook = ?', ['syslog', 'config_insert']);

	// don't let this script timeout
	ini_set('max_execution_time', 0);

	$version   = plugin_syslog_version();
	$installed = db_fetch_cell_prepared('SELECT version FROM plugin_config WHERE directory = ?', ['syslog']);

	if (!$force && $installed !== false && version_compare((string) $installed, $version['version'], '>=')) {
		syslog_notice_traditional_tables(true);
		include_once($config['base_path'] . '/lib/poller.php');
		api_plugin_replicate_config();

		return true;
	}

	// Housekeeping: when genuinely upgrading from an older version (never on a
	// fresh install or a same-version repair), remove files tombstoned in
	// manifest.json before the stored version is bumped below. This runs on
	// every version-aware entry point - plugin_syslog_upgrade(), the re-enable
	// path and cli/syslog_schema.php - so a stale top-level module left by an
	// older layout cannot redeclare a function now living under includes/ and
	// fatal the plugin on load. Gating on an older installed version keeps the
	// dev-only tests/ tree intact on a same-version checkout.
	if ($installed !== false && version_compare((string) $installed, $version['version'], '<')) {
		syslog_prune_files();
	}

	foreach (['syslog_alert', 'syslog_remove', 'syslog_reports'] as $table) {
		db_update_table($table, [
			'columns' => [['name' => 'hash', 'type' => 'varchar(32)', 'NULL' => false, 'default' => '', 'after' => 'id']],
			'primary' => ['id']
		], false, true, $syslog_cnn);
	}

	if (syslog_db_column_exists('syslog_incoming', 'date')) {
		syslog_db_execute("ALTER TABLE syslog_incoming
			DROP COLUMN date,
			CHANGE COLUMN `time` logtime timestamp default '0000-00-00';");
	}

	$alerts = syslog_db_fetch_assoc('SELECT *
			FROM syslog_alert
			WHERE hash IS NULL OR hash = ""');

	if (cacti_sizeof($alerts)) {
		foreach ($alerts as $a) {
			$hash = get_hash_syslog($a['id'], 'syslog_alert');
			syslog_db_execute_prepared('UPDATE syslog_alert
					SET hash = ?
					WHERE id = ?',
				[$hash, $a['id']]);
		}
	}

	$removes = syslog_db_fetch_assoc('SELECT *
			FROM syslog_remove
			WHERE hash IS NULL OR hash = ""');

	if (cacti_sizeof($removes)) {
		foreach ($removes as $r) {
			$hash = get_hash_syslog($r['id'], 'syslog_remove');
			syslog_db_execute_prepared('UPDATE syslog_remove
					SET hash = ?
					WHERE id = ?',
				[$hash, $r['id']]);
		}
	}

	$reports = syslog_db_fetch_assoc('SELECT *
			FROM syslog_reports
			WHERE hash IS NULL OR hash = ""');

	if (cacti_sizeof($reports)) {
		foreach ($reports as $r) {
			$hash = get_hash_syslog($r['id'], 'syslog_reports');
			syslog_db_execute_prepared('UPDATE syslog_reports
					SET hash = ?
					WHERE id = ?',
				[$hash, $r['id']]);
		}
	}

	$searches = syslog_db_fetch_assoc('SELECT *
			FROM syslog_saved_searches
			WHERE hash IS NULL OR hash = ""');

	if (cacti_sizeof($searches)) {
		foreach ($searches as $s) {
			$hash = get_hash_syslog($s['id'], 'syslog_saved_searches');
			syslog_db_execute_prepared('UPDATE syslog_saved_searches
					SET hash = ?
					WHERE id = ?',
				[$hash, $s['id']]);
		}
	}

	$dashboards = syslog_db_fetch_assoc('SELECT *
			FROM syslog_dashboards
			WHERE hash IS NULL OR hash = ""');

	if (cacti_sizeof($dashboards)) {
		foreach ($dashboards as $d) {
			$hash = get_hash_syslog($d['id'], 'syslog_dashboards');
			syslog_db_execute_prepared('UPDATE syslog_dashboards
					SET hash = ?
					WHERE id = ?',
				[$hash, $d['id']]);
		}
	}

	db_update_table('syslog_alert', [
		'columns' => [
			['name' => 'level', 'type' => 'int(10)', 'unsigned' => true, 'NULL' => false, 'default' => '0', 'after' => 'method'],
			['name' => 'notify', 'type' => 'int(10)', 'unsigned' => true, 'NULL' => false, 'default' => '0', 'after' => 'email'],
			['name' => 'body', 'type' => 'varchar(8192)', 'NULL' => false, 'default' => '', 'after' => 'message'],
			['name' => 'cooldown_minutes', 'type' => 'int(10)', 'NULL' => false, 'default' => '-1', 'after' => 'repeat_alert'],
			['name' => 'deduplication_minutes', 'type' => 'int(10)', 'NULL' => false, 'default' => '-1', 'after' => 'cooldown_minutes'],
			['name' => 'suppression_schedule', 'type' => 'text', 'NULL' => false, 'default' => '', 'after' => 'deduplication_minutes'],
			['name' => 'maintenance_mode', 'type' => 'varchar(16)', 'NULL' => false, 'default' => 'inherit', 'after' => 'suppression_schedule'],
			['name' => 'maintenance_days', 'type' => 'varchar(32)', 'NULL' => false, 'default' => '1,2,3,4,5', 'after' => 'maintenance_mode'],
			['name' => 'maintenance_start', 'type' => 'char(5)', 'NULL' => false, 'default' => '00:00', 'after' => 'maintenance_days'],
			['name' => 'maintenance_end', 'type' => 'char(5)', 'NULL' => false, 'default' => '00:00', 'after' => 'maintenance_start'],
			['name' => 'maintenance_datetime_start', 'type' => 'varchar(16)', 'NULL' => false, 'default' => '', 'after' => 'maintenance_end'],
			['name' => 'maintenance_datetime_end', 'type' => 'varchar(16)', 'NULL' => false, 'default' => '', 'after' => 'maintenance_datetime_start']
		],
		'primary' => ['id']
	], false, true, $syslog_cnn);

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_alert_suppression` (
		`alert_id` int(10) unsigned NOT NULL,
		`scope_key` varchar(255) NOT NULL,
		`dedup_hash` char(40) NOT NULL,
		`last_sent` int(10) unsigned NOT NULL default '0',
		PRIMARY KEY (`alert_id`, `scope_key`, `dedup_hash`),
		INDEX `last_sent` (`last_sent`))
		ENGINE=InnoDB");

	// Structured filter JSON can exceed the old VARCHAR limit. TEXT also keeps
	// the alert table below the InnoDB/MariaDB inline row-size ceiling.
	syslog_db_execute('ALTER TABLE syslog_alert MODIFY column message TEXT NOT NULL');

	// Removal rules now store the same structured filter JSON as alert rules.
	syslog_db_execute('ALTER TABLE syslog_remove MODIFY column message TEXT NOT NULL');

	db_update_table('syslog_reports', [
		'columns' => [['name' => 'notify', 'type' => 'int(10)', 'unsigned' => true, 'NULL' => false, 'default' => '0', 'after' => 'email']],
		'primary' => ['id']
	], false, true, $syslog_cnn);

	syslog_db_execute('ALTER TABLE syslog_reports MODIFY column body VARCHAR(8192) NOT NULL default ""');

	syslog_create_replication_output_table();
	syslog_create_replication_receipts_table();
	syslog_create_replication_collectors_table();
	syslog_create_replication_recovery_table();
	syslog_ensure_message_text();
	syslog_ensure_replication_history_columns();
	syslog_refresh_plugin_version();
	include_once($config['base_path'] . '/lib/poller.php');
	api_plugin_replicate_config();

	return true;
}

/** Create dashboard structures and seed the shared starter during install/upgrade. */
function syslog_dashboard_seed_default(): void {
	global $syslogdb_default;

	syslog_ensure_dashboard_tables();

	$lock = 'syslog_dashboard_' . md5($syslogdb_default);

	if (!syslog_db_fetch_cell_prepared('SELECT GET_LOCK(?, 5)', [$lock])) {
		return;
	}

	try {
		if (syslog_db_fetch_cell_prepared("SELECT id FROM `$syslogdb_default`.`syslog_dashboards` WHERE hash = ? LIMIT 1", [md5('syslog_default_dashboard')])) {
			return;
		}

		if (!syslog_db_execute('START TRANSACTION')) {
			return;
		}

		$now = time();

		if (!syslog_db_execute_prepared("INSERT INTO `$syslogdb_default`.`syslog_dashboards`
			(hash, name, `user`, is_global, `date`, updated) VALUES (?, ?, ?, ?, ?, ?)", [md5('syslog_default_dashboard'), 'default', '', 'on', $now, $now])) {
			syslog_db_execute('ROLLBACK');

			return;
		}

		$id = (int) syslog_db_fetch_insert_id();

		if ($id <= 0) {
			syslog_db_execute('ROLLBACK');

			return;
		}

		$panels = [
			[__('Top 10 Hosts', 'syslog'), 'syslog', 'breakdown', 'donut', 'host', 'dashboard'],
			[__('Syslog Messages - Past Hour', 'syslog'), 'syslog', 'timeseries', 'area', 'host', '3600'],
			[__('Messages by Severity', 'syslog'), 'syslog', 'breakdown', 'donut', 'priority', 'dashboard'],
			[__('Top 10 Programs', 'syslog'), 'syslog', 'breakdown', 'donut', 'program', 'dashboard'],
			[__('Alert Activity', 'syslog'), 'alerts', 'timeseries', 'bar', 'host', 'dashboard']
		];

		foreach ($panels as $position => [$title, $source, $kind, $chart, $field, $timespan]) {
			if (!syslog_db_execute_prepared("INSERT INTO `$syslogdb_default`.`syslog_dashboard_panels`
				(dashboard_id, title, expression, source, removal, kind, chart, field,
				`interval`, timespan, top_n, width, height, position, `date`)
				VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
				[$id, $title, '', $source, 1, $kind, $chart, $field, 'auto', $timespan, 10, 1, 0, $position + 1, $now])) {
				syslog_db_execute('ROLLBACK');

				return;
			}
		}

		if (!syslog_db_execute('COMMIT')) {
			syslog_db_execute('ROLLBACK');
		}
	} catch (Throwable $error) {
		syslog_db_execute('ROLLBACK');

		throw $error;
	} finally {
		syslog_db_fetch_cell_prepared('SELECT RELEASE_LOCK(?)', [$lock]);
	}
}

/**
 * Return the version information for the Syslog plugin.
 *
 * @return array<string, mixed> The 'info' section of the plugin INFO file, or an
 *                              empty array when the file cannot be parsed.
 */
function plugin_syslog_version(): array {
	$info = parse_ini_file(__DIR__ . '/INFO', true);

	if (is_array($info) && isset($info['info']) && is_array($info['info'])) {
		return $info['info'];
	}

	return [];
}

/** Keep the installed plugin metadata aligned with INFO without reinstalling. */
function syslog_refresh_plugin_version(): void {
	$version        = plugin_syslog_version();
	$stored_version = db_fetch_cell_prepared('SELECT version FROM plugin_config WHERE directory = ?', ['syslog']);

	if (!isset($version['version']) || ($stored_version !== false && version_compare((string) $stored_version, $version['version'], '>='))) {
		return;
	}

	db_execute_prepared('UPDATE plugin_config SET version = ?, name = ?, author = ?, webpage = ? WHERE directory = ?', [
		$version['version'],
		$version['longname'] ?? '',
		$version['author'] ?? '',
		$version['homepage'] ?? '',
		'syslog'
	]);
}

/**
 * Check that the Syslog plugin dependencies are met.
 *
 * @return bool Always true, the Syslog plugin has no dependencies.
 */
function syslog_check_dependencies(): bool {
	return true;
}

/**
 * Remove files and directories that a previous version of this plugin shipped
 * but that have since moved or been deleted, using the tombstone and whitelist
 * lists in manifest.json. This "housecleaning" stops stale top-level modules
 * (for example the old database.php/functions.php that now live under
 * includes/) from redeclaring functions and fataling the plugin on load after
 * an upgrade. Whitelisted (user-data) paths and any VCS metadata (.git*) are
 * never touched; the dev-only tests/ tree and phpunit.xml are removed. Any path
 * that resolves outside the plugin directory (a tampered manifest.json) is
 * refused, and any file/directory that cannot be removed (for example
 * read-only) is reported to the Cacti log. Any top-level entry that is neither
 * expected nor a tombstone nor whitelisted is logged and left in place. Called
 * on a plugin version change from plugin_syslog_upgrade().
 *
 * @return void
 */
function syslog_prune_files(): void {
	global $config;

	$plugin_dir    = $config['base_path'] . '/plugins/syslog';
	$manifest_path = $plugin_dir . '/manifest.json';

	if (!is_readable($manifest_path)) {
		return;
	}

	$manifest = json_decode((string) file_get_contents($manifest_path), true);

	if (!is_array($manifest)) {
		cacti_log('WARNING: syslog manifest.json could not be parsed; skipping file prune', false, 'SYSLOG');

		return;
	}

	$tombstones = isset($manifest['tombstones']) && is_array($manifest['tombstones']) ? $manifest['tombstones'] : [];
	$expected   = isset($manifest['expected'])   && is_array($manifest['expected'])   ? $manifest['expected']   : [];
	$whitelist  = isset($manifest['whitelist'])  && is_array($manifest['whitelist'])  ? $manifest['whitelist']  : [];

	$protected = function (string $rel) use ($whitelist): bool {
		if (strncmp($rel, '.git', 4) === 0 || strncmp($rel, '.md', 3) === 0) {
			return true;
		}

		foreach ($whitelist as $entry) {
			$entry = trim((string) $entry, '/');

			if ($entry !== '' && ($rel === $entry
				|| strncmp($rel, $entry . '/', strlen($entry) + 1) === 0
				|| strncmp($entry, $rel . '/', strlen($rel) + 1) === 0)) {
				return true;
			}
		}

		return false;
	};

	// Security: resolve the plugin directory so a tampered manifest.json
	// cannot steer the prune outside of it.
	$plugin_real = realpath($plugin_dir);

	// Remove tombstoned (moved/deleted) paths plus the dev-only tests/ tree
	// and the phpunit.xml test configuration.
	$remove   = $tombstones;
	$remove[] = 'tests/';
	$remove[] = 'phpunit.xml';

	foreach ($remove as $rel) {
		$rel = trim((string) $rel, '/');

		if ($rel === '' || $protected($rel)) {
			continue;
		}

		// A tombstone must never contain '.'/'..' segments; a tampered manifest
		// could use them to escape the plugin directory or target its root.
		$segments = explode('/', $rel);

		if (in_array('.', $segments, true) || in_array('..', $segments, true)) {
			cacti_log(sprintf('WARNING: syslog prune refused to remove %s: path contains a traversal segment (tampered manifest.json?)', $rel), false, 'SYSLOG');

			continue;
		}

		$path = $plugin_dir . '/' . $rel;

		if (!is_link($path) && !file_exists($path)) {
			continue;
		}

		// Reject any tombstone reached through a symlinked parent directory:
		// each parent must resolve to its own lexical location inside the
		// plugin. This stops a tombstone like 'alias/config.php' (where alias
		// is a symlink to the plugin root) from aliasing - and deleting - a
		// protected, whitelisted file, and also refuses a parent that escapes
		// the plugin entirely. A tombstone that is *itself* a symlink is still
		// allowed; only the link is unlinked, never its target.
		$parent_rel  = (strpos($rel, '/') !== false) ? substr($rel, 0, strrpos($rel, '/')) : '';
		$parent_real = realpath($parent_rel === '' ? $plugin_dir : $plugin_dir . '/' . $parent_rel);
		$expected_parent = $parent_rel === '' ? $plugin_real : $plugin_real . DIRECTORY_SEPARATOR . str_replace('/', DIRECTORY_SEPARATOR, $parent_rel);

		if ($plugin_real === false || $parent_real === false || $parent_real !== $expected_parent) {
			cacti_log(sprintf('WARNING: syslog prune refused to remove %s: path resolves outside the plugin directory (tampered manifest.json?)', $rel), false, 'SYSLOG');

			continue;
		}

		$target = $parent_real . DIRECTORY_SEPARATOR . basename($rel);

		if (is_dir($target) && !is_link($target)) {
			$removed = syslog_rmtree($target);
		} else {
			$removed = @unlink($target);
		}

		if (!$removed) {
			cacti_log(sprintf('WARNING: syslog upgrade could not remove %s (check file/directory permissions)', $rel), false, 'SYSLOG');
		}
	}

	// Surface any top-level entry the manifest does not account for.
	$known = [];

	foreach (array_merge($expected, $tombstones) as $entry) {
		$top = explode('/', trim((string) $entry, '/'))[0];

		if ($top !== '') {
			$known[$top] = true;
		}
	}

	$entries = scandir($plugin_dir);

	foreach (($entries !== false ? $entries : []) as $entry) {
		if ($entry === '.' || $entry === '..' || $entry === 'tests' || $entry === 'phpunit.xml' || $protected($entry) || isset($known[$entry])) {
			continue;
		}

		cacti_log(sprintf('WARNING: syslog upgrade found a file/directory not described in manifest.json: %s (left in place)', $entry), false, 'SYSLOG');
	}
}

/**
 * Recursively delete a directory and its contents. Symlinks are removed without
 * being followed. VCS metadata (.git*) and dot-markdown config (.md*) are never
 * deleted, even when nested inside a tombstoned directory; a directory that is
 * deliberately retained because it still holds such protected content is not
 * reported as a failure. Helper for syslog_prune_files().
 *
 * @param string $dir Absolute path to the directory to remove.
 *
 * @return bool True if everything that should be removed was removed; false if
 *              an entry that should have been deleted could not be.
 */
function syslog_rmtree(string $dir): bool {
	$entries = scandir($dir);
	$ok      = true;

	foreach (($entries !== false ? $entries : []) as $entry) {
		if ($entry === '.' || $entry === '..') {
			continue;
		}

		// Never remove VCS metadata or dot-markdown config, even when nested
		// inside a tombstoned directory (for example include/.git/config). The
		// directory holding them is retained below.
		if (strncmp($entry, '.git', 4) === 0 || strncmp($entry, '.md', 3) === 0) {
			continue;
		}

		$path = $dir . '/' . $entry;

		if (is_dir($path) && !is_link($path)) {
			if (!syslog_rmtree($path)) {
				$ok = false;
			}
		} elseif (!@unlink($path)) {
			$ok = false;
		}
	}

	// Remove the directory itself only once it is genuinely empty. A directory
	// intentionally kept because it still holds protected content (its own or a
	// child's) is left in place and is not treated as a removal failure.
	$remaining = scandir($dir);

	if ($remaining !== false && count($remaining) <= 2 && !@rmdir($dir)) {
		$ok = false;
	}

	return $ok;
}