Viewing Data Query Cache can cause errors to be logged

[jab60]

Describe the bug

An ERROR message in the cacti log file as below followed by SQL Backtrace message (Log level is LOW)
09-09-2023 21:11:27 - CMDPHP SQL Backtrace: (/utilities.php[51]:utilities_view_snmp_cache(), /utilities.php[1751]:db_fetch_assoc_prepared(), /lib/database.php[704]:db_execute_prepared())

09-09-2023 21:11:27 - CMDPHP ERROR: A DB Row Failed!, Error: PDOStatement::execute(): SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens

To Reproduce

Steps to reproduce the behavior:

1. Go to System utilities>>View Data Query Cache>>

2. Select a device from the device drop down box

See error message in cacti log file

Expected behavior

No error should be logged

Screenshots

If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information)

• OS: Windows 10 22H2

• Browser Chrome Version 116.0.5845.180 (Official Build) (64-bit)

Additional context

I reviewed the code in utilities.php at line 1751 as indicated in error message
It looks like the query command is missing its WHERE clause
After adding the clause error is no longer produced

Full query is now
$snmp_queries = db_fetch_assoc_prepared("SELECT DISTINCT sq.id, sq.name
FROM host_snmp_cache AS hsc
INNER JOIN snmp_query AS sq
ON hsc.snmp_query_id=sq.id
INNER JOIN host AS h
ON hsc.host_id=h.id
WHERE hsc.host_id = ?
ORDER by sq.name", array(get_request_var('host_id')));

I first noticed this in V1.2.24, but as 1.2.25 has just been released I upgraded and same error was present.

[TheWitness]

I can not reproduce this in my development environment.

[jab60]

Thanks for looking.
Not sure how to comment without closing?

Even if you can not reproduce the error the call to db_fetch_assoc_prepared requires a property item in the SQL statement which is the question mark character, for the dynamically replaceable variables.
In latest development branch the code line for this is now 655 and the filter clause is still missing in the SQL statement.

Please add
WHERE hsc.host_id = ?
at line 661

[TheWitness]

Okay, I guess if I had opened the Cacti log, it would have stuck out. Bad Larry! Fixing it now. Have you considered opening pull requests?

[TheWitness]

I think our CI/CD would have caught this, but wget appears to have been crippled. Does not walk all paths like it used to.