Unix timestamps after Sep 13 2020 are rejected as graph start/end arguments

[nuno-silva]

Describe the bug

The graph_start and graph_end request variables in graph_image.php only accept values less than 1600000000, which is Sun Sep 13 12:26:40 2020 in UTC (just 7 months from now!).

Note: at least graph_json.php, graph_xport.php and remote_agent.php are also affected.

To Reproduce
Steps to reproduce the behaviour:

1. Obtain the ID of any graph.
2. Open http://host.example.com/cacti/graph_image.php?local_graph_id=123&graph_end=1600000000&disable_cache=true.
3. Bug: graph will not display the desired timespan and will instead ignore the graph_end variable.
4. Repeat step 2 using 1599999999 if you wanna see it working, or just look at my screenshots.

Expected behavior
The example URL should display a timespan ranging from <today> until Sep 13 2020.

Screenshots

• graph_image.php using graph_end=1599999999

• graph_image.php using graph_end=1600000000

Desktop:
N/A

Smartphone:
N/A

Additional context
Relevant lines of code:

cacti/graph_image.php

Lines 82 to 90 in bb619ef

	/* override: graph start time (unix time) */
	if (!isempty_request_var('graph_start') && get_request_var('graph_start') < 1600000000) {
	$graph_data_array['graph_start'] = get_request_var('graph_start');
	}
	/* override: graph end time (unix time) */
	if (!isempty_request_var('graph_end') && get_request_var('graph_end') < 1600000000) {
	$graph_data_array['graph_end'] = get_request_var('graph_end');
	}

My suggestion is to compare these timestamps with something like now + 1 year instead of an hard-coded one. I don't mind preparing a pull request to fix this after further discussion about a solution.

[netniV]

Should now be resolved, thanks!

[nuno-silva]

Thank you for the fix, but you just moved the problem 16 years into the future 😛

[netniV]

I did, well spotted 👍

If you're still using this version of the software then, I'd worry 😱

[nuno-silva]

Well, I'd worry, too, but my point is that someone will have to deal with this again in the future before the 16 years, no matter the version 😛

[netniV]

It does, but by then we will hopefully be all on 64-bit so we can then go above the 32-bit barrier :)

[paulgevers]

@netniV I guess this issue is present in (much) older versions of Cacti. Do you happen to know when it was introduced? I probably need to fix Cacti in the stable and oldstable releases as well as let the Ubuntu people know about it.

[TheWitness]

This setting goes back to at least 0.8.7. So, anything after that has this clipping boundary to future times.