Logs contain "Uncaught TypeError" from 1.2.x branch

[SMark-Black]

Describe the bug

Using the latest 1.2.x branch code after install there is an error in the cacti.log
The issue is in cacti/lib/import.php in function xml_to_data_input_method().  It can return an array, or a boolean.  When it returns a boolean it triggers the error:

2026/05/07 05:26:20 - ERROR PHP ERROR: Uncaught TypeError: Unsupported operand types: array + bool in /opt/IBM/cacti/lib/import.php:242 
Stack trace: #0 /opt/IBM/cacti/lib/rtm_functions.php(496): import_xml_data('<!-- $Id: 7978f...', false, 1) 
#1 /opt/IBM/cacti/plugins/grid/import_default_templates.php(199): rtm_do_import('/opt/IBM/cacti/...') 
#2 {main} thrown in file: /opt/IBM/cacti/lib/import.php on line: 242

To Reproduce

1. Install the latest code from 1.2.x branch
2. Check the logs

Expected behavior

No PHP errors in logs

Screenshots

2026/05/07 05:26:08 - PUSHOUT Child Started Process 1 with 1 hosts, from: 0
2026/05/07 05:26:20 - IMPORT ERROR: Refusing to import data input method '5036ba4f10baf24c1bd8ab0ed18bae82' -
 input_string contains shell metacharacters
2026/05/07 05:26:20 - ERROR PHP ERROR: Uncaught TypeError: Unsupported operand types: array + bool in /opt/IBM/cacti/lib/import.php:242 
Stack trace: 
#0 /opt/IBM/cacti/lib/rtm_functions.php(496): import_xml_data('<!-- $Id: 7978f...', false, 1) 
#1 /opt/IBM/cacti/plugins/grid/import_default_templates.php(199): rtm_do_import('/opt/IBM/cacti/...') 
#2 {main} thrown in file: /opt/IBM/cacti/lib/import.php on line: 242
2026/05/07 05:26:20 - CMDPHP PHP ERROR Backtrace:  (CactiShutdownHandler())

If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information)

• OS: RHEL 8.10
• PHP: 8.2.30

Additional context

Add any other context about the problem here.

[SMark-Black]

This change cleans up the PHP error:

--- import.php  2026-04-27 06:37:37.106607535 -0700
+++ /local-disk-cache/src/rtm/rtm/cacti/lib/import.php  2026-05-07 06:24:15.832220699 -0700
@@ -239,8 +239,11 @@ function import_xml_data(&$xml_data, $im
                                        $hash_cache += xml_to_host_template($dep_hash_cache[$type][$i]['hash'], $hash_array, $hash_cache, $host_template_data, $class);
                                        break;
                                case 'data_input_method':
-                                       $hash_cache += xml_to_data_input_method($dep_hash_cache[$type][$i]['hash'], $hash_array, $hash_cache);
-                                       $repair++;
+                                       $return = xml_to_data_input_method($dep_hash_cache[$type][$i]['hash'], $hash_array, $hash_cache);
+                                       if ($return !== false) {
+                                               $hash_cache += $return;
+                                               $repair++;
+                                       }
                                        break;
                                case 'data_query':
                                        $hash_cache += xml_to_data_query($dep_hash_cache[$type][$i]['hash'], $hash_array, $hash_cache, $files, $replace_svalues);

Now the PHP error us gone and you get:

2026/05/07 06:51:04 - PUSHOUT Child Started Process 1 with 1 hosts, from: 0
2026/05/07 06:51:17 - IMPORT ERROR: Refusing to import data input method '5036ba4f10baf24c1bd8ab0ed18bae82' - input_string contains shell metacharacters
2026/05/07 06:51:23 - THOLD NOTE: Import of Threshold Template file '../gridalarms/templates/thold_template_export.xml' succeeded.

[TheWitness]

Can you please upload the XML file?

[TheWitness]

This pull should address the issue. Thanks for reporting.
#7122

[SMark-Black]

This is the portion of the template causing issues:

	<hash_0301025036ba4f10baf24c1bd8ab0ed18bae82>
		<name>GRID - Cluster Pending by Pending Reason</name>
		<type_id>5</type_id>
                <input_string><path_cacti>/scripts/ss_grid_preason.php ss_grid_preason <clusterid> "<reason>"</input_string>

The problem is introduced by the "reason". The double-quotes are the trigger.
The "reason" is a string with multiple spaces e.g "Failed in talking to server to start the job".
The double-quotes were there to lump the string into a single arg for the ss_grid_preason.php script rather than multiple args.

[TheWitness]

Okay, thanks for that. @somethingwithproof, it seems the double quotes and single quotes will be required. Thoughts?

[TheWitness]

The <reason> itself is a string of characters like "The user reached a slot limit in queue normal". So, they are quoting it in the input method.

[somethingwithproof]

Root cause is the strip pattern in cacti_input_string_is_safe() at lib/functions.php:7388, introduced by #7112. The blocklist was extended with ' " < > ( ) { } but the strip kept matching only <[a-zA-Z_]+>, so two legitimate shapes leak into the residue check:

1. Paired shell-arg quoting around a placeholder: after stripping <reason>, the literal "" remains and matches the new " blocklist entry. This is the ss_grid_preason template you posted.
2. Digit-suffixed placeholder names: <arg1> does not match [a-zA-Z_]+, so the bare < and > survive into the residue and match the new < > blocklist entries. Vendor packages with <arg1>, <host_id2> etc. trip this even without quotes.

The same validator gates both paths, so data_input.php form_save and lib/import.php xml_to_data_input_method() reject the same templates. The latter then cascades into the array + bool TypeError @SMark-Black diffed.

Fix at the source in #7130: relax the strip to "<x>" | '<x>' | <x> with x = [a-zA-Z0-9_]+, matching the grammar already used by generate_data_input_field_sequences() and get_full_script_path(). Blocklist unchanged, GHSA-c4qp protection preserved on both paths.