From 180790c2a5b6a108abcecfb36923338d48bb33b5 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 21:09:31 -0600
Subject: [PATCH 01/41] Call Cacti controller methods on an instance in the
 host import

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 controllers/sync.php          |  10 +--
 phpunit.xml                   |   1 +
 tests/Unit/SyncImportTest.php | 116 ++++++++++++++++++++++++++++++++++
 tests/bootstrap-unit.php      |  72 +++++++++++++++++++--
 4 files changed, 189 insertions(+), 10 deletions(-)
 create mode 100644 tests/Unit/SyncImportTest.php

diff --git a/controllers/sync.php b/controllers/sync.php
index c24b839..a30c194 100644
--- a/controllers/sync.php
+++ b/controllers/sync.php
@@ -48,11 +48,12 @@ function import($params) {
 
         $config = $params['config'];
         $path = $config["base_path"] . "/cli/add_device.php";
+        $cacti = new NpcCactiController();
 
         $return = $params['description'] . '|';
 
         // If the host exists and is already mapped return with notice
-        if (NpcCactiController::isMapped($params['host_object_id'])) {
+        if ($cacti->isMapped($params['host_object_id'])) {
             $this->logger('info', get_class($this), __FUNCTION__ , $params['description'] . " already exists and is mapped.");
             $return .= '0|0|The host already exists and is mapped';
             return($return);
@@ -60,7 +61,7 @@ function import($params) {
 
         // If the host already exists, map it and return.
         if ($cactiId = $this->checkHostExists($params['ip'], $params['cache_id'])) {
-            NpcCactiController::mapHost($params['host_object_id'], $cactiId);
+            $cacti->mapHost($params['host_object_id'], $cactiId);
             $this->logger('info', get_class($this), __FUNCTION__ , $params['description'] . " already existed and was mapped.");
             $return .= '0|1|The host already existed in Cacti with device ID: ' . $cactiId;
             return($return);
@@ -83,7 +84,7 @@ function import($params) {
 
                 if (isset($matches[1])) {
                     // Import was successful. Now map the hosts
-                    NpcCactiController::mapHost($params['host_object_id'], $matches[1]);
+                    $cacti->mapHost($params['host_object_id'], $matches[1]);
                     $this->logger('info', get_class($this), __FUNCTION__ , "Successfully imported and mapped " . $params['description'] . ": $output");
                     $return .= '1|1|' . $output;
                 } elseif (isset($matches[0])) {
@@ -204,7 +205,8 @@ function checkHostExists($ip, $cache_id) {
             $string .= "\$cacheKey = '" . $cache_id . "';\n";
             $string .= "\$hosts = array(\n";
 
-            $results = NpcCactiController::getHostnames();
+            $cacti = new NpcCactiController();
+            $results = $cacti->getHostnames();
 
             for ($i = 0; $i < count($results); $i++) {
                 $address = gethostbyname($results[$i]['hostname']);
diff --git a/phpunit.xml b/phpunit.xml
index bace346..493d1f2 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -29,6 +29,7 @@
     <source>
         <include>
             <file>setup.php</file>
+            <directory suffix=".php">controllers</directory>
         </include>
     </source>
 </phpunit>
diff --git a/tests/Unit/SyncImportTest.php b/tests/Unit/SyncImportTest.php
new file mode 100644
index 0000000..625474a
--- /dev/null
+++ b/tests/Unit/SyncImportTest.php
@@ -0,0 +1,116 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Unit coverage for the Nagios host import in controllers/sync.php.
+ *
+ * The import shells out to cli/add_device.php. The tests point base_path at a
+ * temporary tree whose add_device.php records its argument vector, so the real
+ * exec() path runs without touching a Cacti install or a database.
+ */
+
+beforeAll(function () {
+	npc_test_stub_cacti_includes();
+	npc_test_load(dirname(__DIR__, 2) . '/controllers/sync.php');
+});
+
+beforeEach(function () {
+	$GLOBALS['__test_db_calls']   = array();
+	$GLOBALS['__test_db_results'] = array();
+});
+
+/**
+ * Temporary Cacti-like tree with a stand-in add_device.php.
+ */
+function npc_sync_sandbox() {
+	$base = sys_get_temp_dir() . '/npc-sync-' . uniqid();
+	mkdir($base . '/cli', 0777, true);
+	file_put_contents($base . '/cli/add_device.php', "<?php\nfile_put_contents(__DIR__ . '/argv.json', json_encode(array_slice(\$argv, 1)));\nprint \"Success - new device-id: (12)\\n\";\n");
+
+	return $base;
+}
+
+function npc_sync_unmapped_controller() {
+	return new class extends NpcSyncController {
+		function checkHostExists($ip, $cache_id) {
+			return null;
+		}
+	};
+}
+
+it('reports an already mapped host without running the import', function () {
+	$GLOBALS['__test_db_results']['db_fetch_assoc_prepared']['WHERE npc_host_object_id'] = array(array('id' => 3));
+
+	$out = (new NpcSyncController())->import(array(
+		'config'         => array('base_path' => '/nonexistent'),
+		'description'    => 'web1',
+		'host_object_id' => 10,
+		'ip'             => '192.0.2.10',
+		'cache_id'       => 'k',
+		'template_id'    => 1,
+	));
+
+	expect($out)->toBe('web1|0|0|The host already exists and is mapped');
+});
+
+it('maps a host whose address already exists in Cacti', function () {
+	$sync = new class extends NpcSyncController {
+		function checkHostExists($ip, $cache_id) {
+			return 5;
+		}
+	};
+
+	$out = $sync->import(array(
+		'config'         => array('base_path' => '/nonexistent'),
+		'description'    => 'web1',
+		'host_object_id' => 10,
+		'ip'             => '192.0.2.10',
+		'cache_id'       => 'k',
+		'template_id'    => 1,
+	));
+
+	expect($out)->toBe('web1|0|1|The host already existed in Cacti with device ID: 5');
+
+	$update = end($GLOBALS['__test_db_calls']);
+	expect($update['sql'])->toContain('UPDATE host');
+	expect($update['params'])->toBe(array(10, 5));
+});
+
+it('imports a new host and maps the returned device id', function () {
+	$base = npc_sync_sandbox();
+
+	$out = npc_sync_unmapped_controller()->import(array(
+		'config'         => array('base_path' => $base),
+		'description'    => 'web1',
+		'host_object_id' => 10,
+		'ip'             => '192.0.2.10',
+		'cache_id'       => 'k',
+		'template_id'    => 7,
+	));
+
+	expect($out)->toBe('web1|1|1|Success - new device-id: (12)');
+
+	$update = end($GLOBALS['__test_db_calls']);
+	expect($update['params'])->toBe(array(10, '12'));
+})->skip(trim((string) shell_exec('command -v php')) === '', 'php binary is not on PATH');
+
+it('builds the address cache from Cacti devices when none exists', function () {
+	$cache = '/tmp/npc_address_cache.php';
+	if (file_exists($cache)) {
+		unlink($cache);
+	}
+
+	$GLOBALS['__test_db_results']['db_fetch_assoc']['FROM host'] = array(array('id' => 4, 'hostname' => '127.0.0.1'));
+
+	try {
+		expect((new NpcSyncController())->checkHostExists('127.0.0.1', 'k1'))->toBe(4);
+	} finally {
+		if (file_exists($cache)) {
+			unlink($cache);
+		}
+	}
+});
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index 87a17ef..3977c50 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -80,6 +80,42 @@
 );
 
 $GLOBALS['__test_db_calls'] = array();
+$GLOBALS['__test_db_results'] = array();
+$GLOBALS['__test_db_fetch_log'] = array();
+
+/**
+ * Result for a db_fetch_* stub.
+ *
+ * A test maps a substring of the SQL to the rows it wants back, per stub:
+ * $GLOBALS['__test_db_results']['db_fetch_assoc']['FROM user_auth'] = array(...).
+ * Every fetch is logged so a test can assert the bound parameters.
+ */
+function npc_test_db_result($fn, $sql, $params, $default) {
+	$GLOBALS['__test_db_fetch_log'][] = array('fn' => $fn, 'sql' => $sql, 'params' => $params);
+
+	foreach (($GLOBALS['__test_db_results'][$fn] ?? array()) as $match => $result) {
+		if (strpos($sql, (string) $match) !== false) {
+			return $result;
+		}
+	}
+
+	return $default;
+}
+
+/**
+ * Make require_once('include/auth.php') resolve to an empty stub, ahead of
+ * the real Cacti file that the working directory would otherwise supply.
+ */
+function npc_test_stub_cacti_includes() {
+	static $dir = null;
+
+	if ($dir === null) {
+		$dir = sys_get_temp_dir() . '/npc-inc-' . uniqid();
+		mkdir($dir . '/include', 0777, true);
+		file_put_contents($dir . '/include/auth.php', "<?php\n");
+		set_include_path($dir . PATH_SEPARATOR . $GLOBALS['config']['base_path'] . PATH_SEPARATOR . get_include_path());
+	}
+}
 
 if (!function_exists('get_md5_include_js')) {
 	function get_md5_include_js($path, $async = false) {
@@ -109,37 +145,37 @@ function db_execute_prepared($sql, $params = array()) {
 
 if (!function_exists('db_fetch_assoc')) {
 	function db_fetch_assoc($sql) {
-		return array();
+		return npc_test_db_result('db_fetch_assoc', $sql, array(), array());
 	}
 }
 
 if (!function_exists('db_fetch_assoc_prepared')) {
 	function db_fetch_assoc_prepared($sql, $params = array()) {
-		return array();
+		return npc_test_db_result('db_fetch_assoc_prepared', $sql, $params, array());
 	}
 }
 
 if (!function_exists('db_fetch_row')) {
 	function db_fetch_row($sql) {
-		return array();
+		return npc_test_db_result('db_fetch_row', $sql, array(), array());
 	}
 }
 
 if (!function_exists('db_fetch_row_prepared')) {
 	function db_fetch_row_prepared($sql, $params = array()) {
-		return array();
+		return npc_test_db_result('db_fetch_row_prepared', $sql, $params, array());
 	}
 }
 
 if (!function_exists('db_fetch_cell')) {
 	function db_fetch_cell($sql) {
-		return $GLOBALS['__test_db_fetch_cell'] ?? '';
+		return npc_test_db_result('db_fetch_cell', $sql, array(), $GLOBALS['__test_db_fetch_cell'] ?? '');
 	}
 }
 
 if (!function_exists('db_fetch_cell_prepared')) {
 	function db_fetch_cell_prepared($sql, $params = array()) {
-		return '';
+		return npc_test_db_result('db_fetch_cell_prepared', $sql, $params, '');
 	}
 }
 
@@ -255,6 +291,30 @@ function cacti_sizeof($array) {
 	}
 }
 
+if (!function_exists('cacti_count')) {
+	function cacti_count($array) {
+		return is_array($array) ? count($array) : 0;
+	}
+}
+
+if (!function_exists('cacti_escapeshellarg')) {
+	function cacti_escapeshellarg($string) {
+		return escapeshellarg($string);
+	}
+}
+
+if (!function_exists('api_user_realm_auth')) {
+	function api_user_realm_auth($filename = '') {
+		return !in_array($filename, $GLOBALS['__test_denied_realms'] ?? array(), true);
+	}
+}
+
+if (!function_exists('api_plugin_user_realm_auth')) {
+	function api_plugin_user_realm_auth($filename = '') {
+		return !in_array($filename, $GLOBALS['__test_denied_realms'] ?? array(), true);
+	}
+}
+
 if (!function_exists('is_realm_allowed')) {
 	function is_realm_allowed($realm) {
 		return true;

From 54d4a954781111fa76e3a4360f23ead317f024dc Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 21:10:37 -0600
Subject: [PATCH 02/41] Quote the arguments of the host import command

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                  |  2 ++
 controllers/sync.php          | 14 ++++++++----
 tests/Unit/SyncImportTest.php | 40 +++++++++++++++++++++++++++++++++++
 3 files changed, 52 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e4afea3..0258604 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* security: Quote the description, address and template arguments of the Nagios host
+  import command and reject non-numeric template IDs
 * dev: Relocate the schema provisioning function `npc_setup_tables()` from
   `setup.php` into `includes/database.php` (loaded via `require_once`) to align
   with the fleet schema/includes convention; behavior is unchanged
diff --git a/controllers/sync.php b/controllers/sync.php
index a30c194..46997b4 100644
--- a/controllers/sync.php
+++ b/controllers/sync.php
@@ -67,10 +67,16 @@ function import($params) {
             return($return);
         }
 
-        $importCmd = 'php ' . $path
-                   . ' --description=' . $params['description']
-                   . ' --ip=' . $params['ip']
-                   . ' --template=' . $params['template_id']
+        if ($params['description'] === '' || $params['ip'] === '' || !ctype_digit((string) $params['template_id'])) {
+            $this->logger('warn', get_class($this), __FUNCTION__ , "Import rejected, invalid parameters for " . $params['description']);
+            $return .= '0|0|Invalid import parameters';
+            return($return);
+        }
+
+        $importCmd = 'php ' . cacti_escapeshellarg($path)
+                   . ' --description=' . cacti_escapeshellarg($params['description'])
+                   . ' --ip=' . cacti_escapeshellarg($params['ip'])
+                   . ' --template=' . cacti_escapeshellarg($params['template_id'])
                    . ' 2> /dev/null';
 
         $this->logger('debug', get_class($this), __FUNCTION__ , "Import command: $importCmd");
diff --git a/tests/Unit/SyncImportTest.php b/tests/Unit/SyncImportTest.php
index 625474a..750f08e 100644
--- a/tests/Unit/SyncImportTest.php
+++ b/tests/Unit/SyncImportTest.php
@@ -114,3 +114,43 @@ function checkHostExists($ip, $cache_id) {
 		}
 	}
 });
+
+it('passes the import arguments to add_device.php as single values', function () {
+	$base = npc_sync_sandbox();
+
+	$out = npc_sync_unmapped_controller()->import(array(
+		'config'         => array('base_path' => $base),
+		'description'    => 'web 1 & echo extra',
+		'host_object_id' => 10,
+		'ip'             => '192.0.2.10',
+		'cache_id'       => 'k',
+		'template_id'    => 7,
+	));
+
+	expect($out)->toBe('web 1 & echo extra|1|1|Success - new device-id: (12)');
+	expect(json_decode(file_get_contents($base . '/cli/argv.json'), true))->toBe(array(
+		'--description=web 1 & echo extra',
+		'--ip=192.0.2.10',
+		'--template=7',
+	));
+})->skip(trim((string) shell_exec('command -v php')) === '', 'php binary is not on PATH');
+
+it('rejects an import with a non-numeric template id or an empty address', function (array $override) {
+	$base = npc_sync_sandbox();
+
+	$out = npc_sync_unmapped_controller()->import(array_merge(array(
+		'config'         => array('base_path' => $base),
+		'description'    => 'web1',
+		'host_object_id' => 10,
+		'ip'             => '192.0.2.10',
+		'cache_id'       => 'k',
+		'template_id'    => 7,
+	), $override));
+
+	expect($out)->toBe(($override['description'] ?? 'web1') . '|0|0|Invalid import parameters');
+	expect(file_exists($base . '/cli/argv.json'))->toBeFalse();
+})->with(array(
+	'template id with a suffix' => array(array('template_id' => '7; id')),
+	'empty address'             => array(array('ip' => '')),
+	'empty description'         => array(array('description' => '')),
+));

From 65cb48b685bb2480103c594fae95197f756a9c8b Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 21:13:55 -0600
Subject: [PATCH 03/41] Store the host import address cache as JSON in the
 Cacti cache directory

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                  |   2 +
 controllers/sync.php          |  62 +++++++++++--------
 tests/Unit/SyncImportTest.php | 109 +++++++++++++++++++++++++++++++---
 3 files changed, 140 insertions(+), 33 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0258604..598e732 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* security: Keep the host import address cache as JSON in the Cacti cache directory
+  instead of a PHP file in the system temp directory that was included on each call
 * security: Quote the description, address and template arguments of the Nagios host
   import command and reject non-numeric template IDs
 * dev: Relocate the schema provisioning function `npc_setup_tables()` from
diff --git a/controllers/sync.php b/controllers/sync.php
index 46997b4..0422991 100644
--- a/controllers/sync.php
+++ b/controllers/sync.php
@@ -187,44 +187,30 @@ function listHostgroups() {
      * @return int   The Cacti host ID
      */
     function checkHostExists($ip, $cache_id) {
+        global $config;
 
-        $cacheFile = '/tmp/npc_address_cache.php';
+        $cacheFile = $config['base_path'] . '/cache/npc_address_cache.json';
+        $hosts     = null;
 
-        $buildCache = 0;
+        if (is_file($cacheFile) && is_readable($cacheFile)) {
+            $cache = json_decode((string) file_get_contents($cacheFile), true);
 
-        if (file_exists($cacheFile)) {
-            include($cacheFile);
-            if ($cacheKey != $cache_id) {
-                $buildCache = 1;
+            if (is_array($cache) && isset($cache['key']) && $cache['key'] === (string) $cache_id && isset($cache['hosts']) && is_array($cache['hosts'])) {
+                $hosts = $cache['hosts'];
             }
-        } else {
-            $buildCache = 1;
         }
 
-        if ($buildCache) {
-
-            $fh = fopen($cacheFile, 'w') or die("can't open file");
-
+        if ($hosts === null) {
             $hosts = array();
 
-            $string = "<?php\n\n";
-            $string .= "\$cacheKey = '" . $cache_id . "';\n";
-            $string .= "\$hosts = array(\n";
-
-            $cacti = new NpcCactiController();
+            $cacti   = new NpcCactiController();
             $results = $cacti->getHostnames();
 
             for ($i = 0; $i < count($results); $i++) {
-                $address = gethostbyname($results[$i]['hostname']);
-                $string .= "'" . $address . "' => '" . $results[$i]['id'] . "',\n";
-                $hosts[$address] = $results[$i]['id'];
+                $hosts[gethostbyname($results[$i]['hostname'])] = $results[$i]['id'];
             }
 
-            $string .= ");";
-
-            fwrite($fh, $string);
-
-            fclose($fh);
+            $this->writeAddressCache($cacheFile, $cache_id, $hosts);
         }
 
         if (isset($hosts[$ip])) {
@@ -234,4 +220,30 @@ function checkHostExists($ip, $cache_id) {
         return(null);
     }
 
+    /**
+     * writeAddressCache
+     *
+     * Stores the address map as JSON in the Cacti cache directory. The file is
+     * written under a temporary name and renamed so a concurrent import never
+     * reads a partial file. A cache that cannot be written only costs a rebuild
+     * on the next call.
+     *
+     * @return void
+     */
+    private function writeAddressCache($cacheFile, $cache_id, $hosts) {
+        if (!is_dir(dirname($cacheFile)) || !is_writable(dirname($cacheFile))) {
+            $this->logger('warn', get_class($this), __FUNCTION__, 'Unable to create the address cache in ' . dirname($cacheFile));
+            return;
+        }
+
+        $tmp = tempnam(dirname($cacheFile), 'npc');
+
+        $bytes = file_put_contents($tmp, json_encode(array('key' => (string) $cache_id, 'hosts' => $hosts)));
+
+        if ($bytes === false || is_dir($cacheFile) || !rename($tmp, $cacheFile)) {
+            $this->logger('warn', get_class($this), __FUNCTION__, 'Unable to write the address cache ' . $cacheFile);
+            unlink($tmp);
+        }
+    }
+
 }
diff --git a/tests/Unit/SyncImportTest.php b/tests/Unit/SyncImportTest.php
index 750f08e..760a414 100644
--- a/tests/Unit/SyncImportTest.php
+++ b/tests/Unit/SyncImportTest.php
@@ -21,6 +21,7 @@
 beforeEach(function () {
 	$GLOBALS['__test_db_calls']   = array();
 	$GLOBALS['__test_db_results'] = array();
+	$GLOBALS['__test_db_fetch_log'] = array();
 });
 
 /**
@@ -98,21 +99,113 @@ function checkHostExists($ip, $cache_id) {
 	expect($update['params'])->toBe(array(10, '12'));
 })->skip(trim((string) shell_exec('command -v php')) === '', 'php binary is not on PATH');
 
-it('builds the address cache from Cacti devices when none exists', function () {
-	$cache = '/tmp/npc_address_cache.php';
-	if (file_exists($cache)) {
-		unlink($cache);
+/**
+ * Run checkHostExists() against a temporary base_path and return the result
+ * together with that path, so each test can inspect the cache directory.
+ */
+function npc_sync_cache_run($ip, $cache_id, $prepare = null) {
+	$base = sys_get_temp_dir() . '/npc-cache-' . uniqid();
+	mkdir($base . '/cache', 0777, true);
+
+	if ($prepare !== null) {
+		$prepare($base . '/cache/npc_address_cache.json');
+	}
+
+	$restore                        = $GLOBALS['config']['base_path'];
+	$GLOBALS['config']['base_path'] = $base;
+
+	try {
+		$found = (new NpcSyncController())->checkHostExists($ip, $cache_id);
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+	}
+
+	return array($found, $base);
+}
+
+it('builds the address cache as JSON from Cacti devices', function () {
+	$GLOBALS['__test_db_results']['db_fetch_assoc']['FROM host'] = array(array('id' => 4, 'hostname' => '127.0.0.1'));
+
+	list($found, $base) = npc_sync_cache_run('127.0.0.1', 'k1');
+	$file               = $base . '/cache/npc_address_cache.json';
+
+	expect($found)->toBe(4);
+	expect(json_decode(file_get_contents($file), true))->toBe(array('key' => 'k1', 'hosts' => array('127.0.0.1' => 4)));
+	expect(substr(sprintf('%o', fileperms($file)), -4))->toBe('0600');
+	expect(glob($base . '/cache/*'))->toBe(array($file));
+});
+
+it('answers from a current cache without reading the device list', function () {
+	list($found) = npc_sync_cache_run('10.0.0.1', 'k1', function ($file) {
+		file_put_contents($file, json_encode(array('key' => 'k1', 'hosts' => array('10.0.0.1' => 7))));
+	});
+
+	expect($found)->toBe(7);
+	expect($GLOBALS['__test_db_fetch_log'])->toBe(array());
+});
+
+it('rebuilds the cache when the key differs or the file is damaged', function (string $content) {
+	$GLOBALS['__test_db_results']['db_fetch_assoc']['FROM host'] = array(array('id' => 4, 'hostname' => '127.0.0.1'));
+	$GLOBALS['__test_db_fetch_log']                              = array();
+
+	list($found) = npc_sync_cache_run('127.0.0.1', 'k2', function ($file) use ($content) {
+		file_put_contents($file, $content);
+	});
+
+	expect($found)->toBe(4);
+	expect($GLOBALS['__test_db_fetch_log'])->not->toBe(array());
+})->with(array(
+	'stale key'    => array('{"key":"k1","hosts":{"127.0.0.1":9}}'),
+	'invalid JSON' => array('not json'),
+	'wrong shape'  => array('{"key":"k2"}'),
+));
+
+it('does not execute a PHP cache file left in the system temp directory', function () {
+	$legacy = '/tmp/npc_address_cache.php';
+
+	if (file_exists($legacy)) {
+		$this->markTestSkipped($legacy . ' already exists');
+	}
+
+	file_put_contents($legacy, "<?php\n\$GLOBALS['npc_legacy_cache_ran'] = true;\n\$cacheKey = 'k1';\n\$hosts = array('10.0.0.1' => '9');\n");
+	unset($GLOBALS['npc_legacy_cache_ran']);
+
+	try {
+		list($found) = npc_sync_cache_run('10.0.0.1', 'k1');
+	} finally {
+		unlink($legacy);
 	}
 
+	expect($found)->toBeNull();
+	expect(isset($GLOBALS['npc_legacy_cache_ran']))->toBeFalse();
+});
+
+it('still answers when the cache directory is missing', function () {
 	$GLOBALS['__test_db_results']['db_fetch_assoc']['FROM host'] = array(array('id' => 4, 'hostname' => '127.0.0.1'));
 
+	$base                           = sys_get_temp_dir() . '/npc-nocache-' . uniqid();
+	$restore                        = $GLOBALS['config']['base_path'];
+	$GLOBALS['config']['base_path'] = $base;
+
 	try {
-		expect((new NpcSyncController())->checkHostExists('127.0.0.1', 'k1'))->toBe(4);
+		$found = (new NpcSyncController())->checkHostExists('127.0.0.1', 'k1');
 	} finally {
-		if (file_exists($cache)) {
-			unlink($cache);
-		}
+		$GLOBALS['config']['base_path'] = $restore;
 	}
+
+	expect($found)->toBe(4);
+	expect(file_exists($base))->toBeFalse();
+});
+
+it('removes its temporary file when the cache cannot be moved into place', function () {
+	$GLOBALS['__test_db_results']['db_fetch_assoc']['FROM host'] = array(array('id' => 4, 'hostname' => '127.0.0.1'));
+
+	list($found, $base) = npc_sync_cache_run('127.0.0.1', 'k1', function ($file) {
+		mkdir($file);
+	});
+
+	expect($found)->toBe(4);
+	expect(glob($base . '/cache/*'))->toBe(array($base . '/cache/npc_address_cache.json'));
 });
 
 it('passes the import arguments to add_device.php as single values', function () {

From e6797ef9298b52819e28fc275d5886ddc497cf1f Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 21:16:07 -0600
Subject: [PATCH 04/41] Require device and data input realms for the host
 import and data input creation

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                       |  3 +++
 controllers/cacti.php              |  4 ++++
 controllers/sync.php               |  4 ++++
 tests/Unit/CactiControllerTest.php | 33 ++++++++++++++++++++++++++++++
 tests/Unit/SyncImportTest.php      | 20 ++++++++++++++++++
 5 files changed, 64 insertions(+)
 create mode 100644 tests/Unit/CactiControllerTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 598e732..6fd6f63 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 --- develop ---
 
+* security: Require the Devices realm for the Nagios host import and the Data Input
+  Methods realm for creating a perfdata data input method; both were open to any
+  user with NPC access
 * security: Keep the host import address cache as JSON in the Cacti cache directory
   instead of a PHP file in the system temp directory that was included on each call
 * security: Quote the description, address and template arguments of the Nagios host
diff --git a/controllers/cacti.php b/controllers/cacti.php
index 3bdb2a0..3b57609 100644
--- a/controllers/cacti.php
+++ b/controllers/cacti.php
@@ -76,6 +76,10 @@ function getHostnames() {
 	 * @return string   json encoded results
 	 */
 	function addDataInputMethod($params) {
+		if (!api_user_realm_auth('data_input.php')) {
+			return(json_encode(array('success' => false, 'msg' => __('You do not have permission to create data input methods.', 'npc'))));
+		}
+
 		$name = 'NPC - Perfdata - ' . $params['host'];
 
         if (isset($params['service'])) {
diff --git a/controllers/sync.php b/controllers/sync.php
index 0422991..7355adf 100644
--- a/controllers/sync.php
+++ b/controllers/sync.php
@@ -44,6 +44,10 @@ class NpcSyncController extends Controller {
      */
     function import($params) {
 
+        if (!api_user_realm_auth('host.php')) {
+            return($params['description'] . '|0|0|You do not have permission to add devices');
+        }
+
         $this->logger('info', get_class($this), __FUNCTION__ , "Starting import of " . $params['description']);
 
         $config = $params['config'];
diff --git a/tests/Unit/CactiControllerTest.php b/tests/Unit/CactiControllerTest.php
new file mode 100644
index 0000000..09d6f02
--- /dev/null
+++ b/tests/Unit/CactiControllerTest.php
@@ -0,0 +1,33 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Unit coverage for controllers/cacti.php, the bridge between NPC and Cacti
+ * devices and data input methods.
+ */
+
+beforeAll(function () {
+	npc_test_stub_cacti_includes();
+	npc_test_load(dirname(__DIR__, 2) . '/controllers/cacti.php');
+});
+
+beforeEach(function () {
+	$GLOBALS['__test_db_calls']      = array();
+	$GLOBALS['__test_db_results']    = array();
+	$GLOBALS['__test_db_fetch_log']  = array();
+	$GLOBALS['__test_denied_realms'] = array();
+});
+
+it('refuses to create a data input method without the data input realm', function () {
+	$GLOBALS['__test_denied_realms'] = array('data_input.php');
+
+	$out = json_decode((new NpcCactiController())->addDataInputMethod(array('host' => 'web1', 'object_id' => '12')), true);
+
+	expect($out['success'])->toBeFalse();
+	expect($out['msg'])->toBe('You do not have permission to create data input methods.');
+	expect($GLOBALS['__test_db_calls'])->toBe(array());
+});
diff --git a/tests/Unit/SyncImportTest.php b/tests/Unit/SyncImportTest.php
index 760a414..cef43a7 100644
--- a/tests/Unit/SyncImportTest.php
+++ b/tests/Unit/SyncImportTest.php
@@ -22,6 +22,7 @@
 	$GLOBALS['__test_db_calls']   = array();
 	$GLOBALS['__test_db_results'] = array();
 	$GLOBALS['__test_db_fetch_log'] = array();
+	$GLOBALS['__test_denied_realms'] = array();
 });
 
 /**
@@ -247,3 +248,22 @@ function npc_sync_cache_run($ip, $cache_id, $prepare = null) {
 	'empty address'             => array(array('ip' => '')),
 	'empty description'         => array(array('description' => '')),
 ));
+
+it('refuses the import to a user without device management rights', function () {
+	$GLOBALS['__test_denied_realms'] = array('host.php');
+
+	$base = npc_sync_sandbox();
+
+	$out = npc_sync_unmapped_controller()->import(array(
+		'config'         => array('base_path' => $base),
+		'description'    => 'web1',
+		'host_object_id' => 10,
+		'ip'             => '192.0.2.10',
+		'cache_id'       => 'k',
+		'template_id'    => 7,
+	));
+
+	expect($out)->toBe('web1|0|0|You do not have permission to add devices');
+	expect($GLOBALS['__test_db_calls'])->toBe(array());
+	expect(file_exists($base . '/cli/argv.json'))->toBeFalse();
+});

From 3f462f7364f3421ce43793a2b6cea04ffdc6b817 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 21:17:14 -0600
Subject: [PATCH 05/41] Use the plain object id when reading perfdata for a new
 data input method

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                       |  3 +++
 controllers/cacti.php              |  6 +++---
 tests/Unit/CactiControllerTest.php | 31 ++++++++++++++++++++++++++++++
 tests/bootstrap-unit.php           |  2 ++
 4 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6fd6f63..5e75637 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 --- develop ---
 
+* issue: Look up the stored perfdata with the plain object ID when creating a
+  perfdata data input method; the shell-quoted value never matched, so no output
+  fields were created
 * security: Require the Devices realm for the Nagios host import and the Data Input
   Methods realm for creating a perfdata data input method; both were open to any
   user with NPC access
diff --git a/controllers/cacti.php b/controllers/cacti.php
index 3b57609..3e3dcd4 100644
--- a/controllers/cacti.php
+++ b/controllers/cacti.php
@@ -91,9 +91,9 @@ function addDataInputMethod($params) {
             $class = 'NpcHostsController';
         }
 
-        $object_id = cacti_escapeshellarg($params['object_id']);
+        $object_id = $params['object_id'];
 
-        $input = "php <path_cacti>/plugins/npc/perfdata.php --type=$type --id=$object_id 2> /dev/null";
+        $input = "php <path_cacti>/plugins/npc/perfdata.php --type=$type --id=" . cacti_escapeshellarg($object_id) . " 2> /dev/null";
 
 		$save = array();
 		$save['hash'] = $this->generateHash();
@@ -106,7 +106,7 @@ function addDataInputMethod($params) {
         $obj = new $class;
         $results = $obj->getPerfData($object_id);
 
-        $perfParts = explode(';', $results[0]['perfdata']);
+        $perfParts = explode(';', isset($results[0]['perfdata']) ? $results[0]['perfdata'] : '');
 
         foreach ($perfParts as $perf) {
             if (preg_match('/=/', $perf)) {
diff --git a/tests/Unit/CactiControllerTest.php b/tests/Unit/CactiControllerTest.php
index 09d6f02..dd6b1fd 100644
--- a/tests/Unit/CactiControllerTest.php
+++ b/tests/Unit/CactiControllerTest.php
@@ -20,6 +20,7 @@
 	$GLOBALS['__test_db_results']    = array();
 	$GLOBALS['__test_db_fetch_log']  = array();
 	$GLOBALS['__test_denied_realms'] = array();
+	$GLOBALS['__test_sql_save']      = array();
 });
 
 it('refuses to create a data input method without the data input realm', function () {
@@ -31,3 +32,33 @@
 	expect($out['msg'])->toBe('You do not have permission to create data input methods.');
 	expect($GLOBALS['__test_db_calls'])->toBe(array());
 });
+
+it('reads the stored perfdata for the plain object id and adds one output field per label', function () {
+	$GLOBALS['__test_db_results']['db_fetch_assoc_prepared']['FROM npc_hostchecks'] = array(array('perfdata' => 'rta=0.5ms;100;200;0;10;pl=0%'));
+
+	$out = json_decode((new NpcCactiController())->addDataInputMethod(array('host' => 'web1', 'object_id' => '12')), true);
+
+	expect($out['success'])->toBeTrue();
+
+	$save = $GLOBALS['__test_sql_save'][0];
+	expect($save['table'])->toBe('data_input');
+	expect($save['row']['name'])->toBe('NPC - Perfdata - web1');
+	expect($save['row']['input_string'])->toBe("php <path_cacti>/plugins/npc/perfdata.php --type=host --id='12' 2> /dev/null");
+
+	expect($GLOBALS['__test_db_fetch_log'][0]['params'])->toBe(array('12'));
+
+	$fields = array_values(array_filter($GLOBALS['__test_db_calls'], function ($call) {
+		return strpos($call['sql'], 'INSERT INTO data_input_fields') !== false;
+	}));
+
+	expect(array_column(array_column($fields, 'params'), 2))->toBe(array('rta', 'pl'));
+});
+
+it('creates the data input method without fields when no check has been stored', function () {
+	$out = json_decode((new NpcCactiController())->addDataInputMethod(array('host' => 'web1', 'service' => 'Load', 'object_id' => '31')), true);
+
+	expect($out['success'])->toBeTrue();
+	expect($GLOBALS['__test_sql_save'][0]['row']['name'])->toBe('NPC - Perfdata - web1: Load');
+	expect($GLOBALS['__test_sql_save'][0]['row']['input_string'])->toContain('--type=service --id=');
+	expect($GLOBALS['__test_db_calls'])->toBe(array());
+});
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index 3977c50..fd86bca 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -389,6 +389,8 @@ function is_error_message() {
 
 if (!function_exists('sql_save')) {
 	function sql_save($array, $table, $key = 'id') {
+		$GLOBALS['__test_sql_save'][] = array('table' => $table, 'row' => $array);
+
 		return isset($array['id']) ? $array['id'] : 1;
 	}
 }

From 12a6cff3a48c19bad3e38d46bb7e7100c43f3fac Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 21:18:21 -0600
Subject: [PATCH 06/41] fix: accept only known tab names in the NPC frame
 script

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                        |  2 +
 controllers/layout.php              | 15 ++++--
 tests/Unit/LayoutControllerTest.php | 74 +++++++++++++++++++++++++++++
 3 files changed, 86 insertions(+), 5 deletions(-)
 create mode 100644 tests/Unit/LayoutControllerTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5e75637..519c4e2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* security: Accept only known tab names for the `tab` request variable of the NPC
+  frame; the raw value was written into an inline script block
 * issue: Look up the stored perfdata with the plain object ID when creating a
   perfdata data input method; the shell-quoted value never matched, so no output
   fields were created
diff --git a/controllers/layout.php b/controllers/layout.php
index 3618c31..6533751 100644
--- a/controllers/layout.php
+++ b/controllers/layout.php
@@ -10,11 +10,6 @@ function drawFrame($params) {
 
 		$npc_base = $config['url_path'] . 'plugins/npc/';
 
-		$current_tab = 'dashboard';
-		if (isset_request_var('tab')) {
-			$current_tab = get_request_var('tab');
-		}
-
 		$tabs = array(
 			'dashboard'  => __('Dashboard', 'npc'),
 			'hosts'      => __('Hosts', 'npc'),
@@ -25,6 +20,16 @@ function drawFrame($params) {
 			'process'    => __('Process Info', 'npc'),
 		);
 
+		/* only a known tab name is ever written into the page */
+		$current_tab = 'dashboard';
+		if (isset_request_var('tab')) {
+			$requested_tab = get_request_var('tab');
+
+			if (is_string($requested_tab) && isset($tabs[$requested_tab])) {
+				$current_tab = $requested_tab;
+			}
+		}
+
 		/* draw the tabs */
 		print "<div class='tabs' style='margin-bottom:0px;'><nav><ul role='tablist'>\n";
 
diff --git a/tests/Unit/LayoutControllerTest.php b/tests/Unit/LayoutControllerTest.php
new file mode 100644
index 0000000..d2ad8a6
--- /dev/null
+++ b/tests/Unit/LayoutControllerTest.php
@@ -0,0 +1,74 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Unit coverage for controllers/layout.php: the frame that carries the NPC
+ * tabs and the script block handing the current tab to js/npc.js.
+ */
+
+beforeAll(function () {
+	require_once dirname(__DIR__, 2) . '/setup.php';
+	require_once dirname(__DIR__, 2) . '/controllers/controller.php';
+	npc_test_load(dirname(__DIR__, 2) . '/controllers/layout.php');
+
+	if (!function_exists('general_header')) {
+		function general_header() {
+		}
+	}
+
+	if (!function_exists('bottom_footer')) {
+		function bottom_footer() {
+		}
+	}
+
+	if (!function_exists('csrf_get_tokens')) {
+		function csrf_get_tokens() {
+			return 'token';
+		}
+	}
+});
+
+afterEach(function () {
+	unset($_GET['tab'], $_SESSION['sess_user_id']);
+});
+
+function npc_layout_output($tab) {
+	$_SESSION['sess_user_id'] = 1;
+
+	if ($tab !== null) {
+		$_GET['tab'] = $tab;
+	}
+
+	ob_start();
+
+	try {
+		(new NpcLayoutController())->drawFrame(array('config' => $GLOBALS['config']));
+	} finally {
+		$html = ob_get_clean();
+	}
+
+	return $html;
+}
+
+it('hands a known tab name to the page script', function () {
+	expect(npc_layout_output('hosts'))->toContain("currentTab:       'hosts'");
+});
+
+it('falls back to the dashboard when no tab is requested', function () {
+	expect(npc_layout_output(null))->toContain("currentTab:       'dashboard'");
+});
+
+it('never writes an unknown or malformed tab value into the script block', function ($tab) {
+	$html = npc_layout_output($tab);
+
+	expect($html)->toContain("currentTab:       'dashboard'");
+	expect($html)->not->toContain('breakout');
+})->with(array(
+	'markup that closes the script block' => array("x</script><b>breakout</b>"),
+	'quote and statement'                  => array("x';breakout();'"),
+	'array value'                          => array(array('breakout')),
+));

From 67434d177a8353d4fc2e66ded9eb657e48614734 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 21:19:27 -0600
Subject: [PATCH 07/41] Call the Nagios controller on an instance when deleting
 all comments

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                          |  2 +
 controllers/comments.php              |  6 ++-
 tests/Unit/CommentsControllerTest.php | 77 +++++++++++++++++++++++++++
 tests/bootstrap-unit.php              |  2 +-
 4 files changed, 84 insertions(+), 3 deletions(-)
 create mode 100644 tests/Unit/CommentsControllerTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 519c4e2..fb7d058 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* issue: Call the Nagios controller on an instance when deleting all host or service
+  comments; the static call raised an Error on PHP 8
 * security: Accept only known tab names for the `tab` request variable of the NPC
   frame; the raw value was written into an inline script block
 * issue: Look up the stored perfdata with the plain object ID when creating a
diff --git a/controllers/comments.php b/controllers/comments.php
index aca79ae..b9f7172 100644
--- a/controllers/comments.php
+++ b/controllers/comments.php
@@ -118,6 +118,7 @@ function deleteAllHostComments() {
         require_once("plugins/npc/controllers/nagios.php");
 
         $seen = array();
+        $nagios = new NpcNagiosController();
 
         $results = $this->flattenArray($this->comments(null, 'o.objecttype_id = 1'));
 
@@ -128,7 +129,7 @@ function deleteAllHostComments() {
                     'command' => 'DEL_ALL_HOST_COMMENTS',
                     'host_name' => $host
                 );
-                NpcNagiosController::command($params);
+                $nagios->command($params);
                 $seen[$host] = 1;
             }
         }
@@ -146,6 +147,7 @@ function deleteAllServiceComments() {
         require_once("plugins/npc/controllers/nagios.php");
 
         $seen = array();
+        $nagios = new NpcNagiosController();
 
         $results = $this->flattenArray($this->comments(null, 'o.objecttype_id = 2'));
 
@@ -158,7 +160,7 @@ function deleteAllServiceComments() {
                     'host_name' => $host,
                     'service_description' => $service,
                 );
-                NpcNagiosController::command($params);
+                $nagios->command($params);
                 $seen[$host][$service] = 1;
             }
         }
diff --git a/tests/Unit/CommentsControllerTest.php b/tests/Unit/CommentsControllerTest.php
new file mode 100644
index 0000000..6debad7
--- /dev/null
+++ b/tests/Unit/CommentsControllerTest.php
@@ -0,0 +1,77 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Unit coverage for the bulk comment deletion in controllers/comments.php,
+ * which hands one command per host or service to the Nagios controller.
+ */
+
+beforeAll(function () {
+	npc_test_stub_cacti_includes();
+	npc_test_load(dirname(__DIR__, 2) . '/controllers/comments.php');
+});
+
+beforeEach(function () {
+	$GLOBALS['__test_db_results'] = array();
+	$GLOBALS['__test_config']     = array();
+});
+
+afterEach(function () {
+	$GLOBALS['__test_config'] = array();
+});
+
+/**
+ * A named pipe stands in for the Nagios command file, which is also a pipe, so
+ * every command written by the controller can be read back in order.
+ */
+function npc_comments_command_pipe() {
+	$pipe = sys_get_temp_dir() . '/npc-cmd-' . uniqid();
+	posix_mkfifo($pipe, 0600);
+
+	$reader = fopen($pipe, 'r+');
+	stream_set_blocking($reader, false);
+
+	$GLOBALS['__test_config'] = array('npc_nagios_commands' => '1', 'npc_nagios_cmd_path' => $pipe);
+
+	return $reader;
+}
+
+function npc_comments_commands($reader) {
+	$lines = array_filter(explode("\n", (string) stream_get_contents($reader)));
+
+	return array_values(array_map(function ($line) {
+		return preg_replace('/^\\[\\d+\\] /', '', $line);
+	}, $lines));
+}
+
+it('deletes the comments of every host once', function () {
+	$reader = npc_comments_command_pipe();
+
+	$GLOBALS['__test_db_results']['db_fetch_assoc_prepared']['FROM npc_comments'] = array(
+		array('host_name' => 'web1', 'comment_data' => 'a'),
+		array('host_name' => 'web1', 'comment_data' => 'b'),
+		array('host_name' => 'db1', 'comment_data' => 'c'),
+	);
+
+	(new NpcCommentsController())->deleteAllHostComments();
+
+	expect(npc_comments_commands($reader))->toBe(array('DEL_ALL_HOST_COMMENTS;web1', 'DEL_ALL_HOST_COMMENTS;db1'));
+})->skip(!function_exists('posix_mkfifo'), 'posix extension is not loaded');
+
+it('deletes the comments of every service once', function () {
+	$reader = npc_comments_command_pipe();
+
+	$GLOBALS['__test_db_results']['db_fetch_assoc_prepared']['FROM npc_comments'] = array(
+		array('host_name' => 'web1', 'service_description' => 'Load', 'comment_data' => 'a'),
+		array('host_name' => 'web1', 'service_description' => 'Load', 'comment_data' => 'b'),
+		array('host_name' => 'web1', 'service_description' => 'Disk', 'comment_data' => 'c'),
+	);
+
+	(new NpcCommentsController())->deleteAllServiceComments();
+
+	expect(npc_comments_commands($reader))->toBe(array('DEL_ALL_SVC_COMMENTS;web1;Load', 'DEL_ALL_SVC_COMMENTS;web1;Disk'));
+})->skip(!function_exists('posix_mkfifo'), 'posix extension is not loaded');
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index fd86bca..16dc0dd 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -251,7 +251,7 @@ function api_plugin_remove_realms($plugin) {
 
 if (!function_exists('read_config_option')) {
 	function read_config_option($name, $force = false) {
-		return '';
+		return $GLOBALS['__test_config'][$name] ?? '';
 	}
 }
 

From 880e6d7774b2008f76c2e27b14551fdbd17cd3f7 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 21:20:34 -0600
Subject: [PATCH 08/41] fix: check the command realm before the command file
 settings

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                        |  2 ++
 controllers/nagios.php              | 12 +++----
 tests/Unit/NagiosControllerTest.php | 54 +++++++++++++++++++++++++++++
 3 files changed, 62 insertions(+), 6 deletions(-)
 create mode 100644 tests/Unit/NagiosControllerTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fb7d058..e6e473b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* security: Check the NPC command realm before the command file settings so users
+  without the realm no longer see the configured command file path
 * issue: Call the Nagios controller on an instance when deleting all host or service
   comments; the static call raised an Error on PHP 8
 * security: Accept only known tab names for the `tab` request variable of the NPC
diff --git a/controllers/nagios.php b/controllers/nagios.php
index 2128759..411ed04 100644
--- a/controllers/nagios.php
+++ b/controllers/nagios.php
@@ -151,6 +151,12 @@ function command($params) {
 		$nagios = new NagiosCmd;
 		$args = array();
 
+		/* Check that the user has permission to execute the command */
+		if (!api_plugin_user_realm_auth('npc1.php')) {
+			$response = array('success' => false, 'msg' => __('You do not have permission to execute this command.', 'npc'));
+			return(json_encode($response));
+		}
+
 		/* Do some sanity checking */
 
 		if (!read_config_option('npc_nagios_commands')) {
@@ -168,12 +174,6 @@ function command($params) {
 			return(json_encode($response));
 		}
 
-		/* Check that the user has permission to execute the command */
-		if (!api_plugin_user_realm_auth('npc1.php')) {
-			$response = array('success' => false, 'msg' => __('You do not have permission to execute this command.', 'npc'));
-			return(json_encode($response));
-		}
-
 		/* Get the command definition */
 		$commandDef = $nagios->getCommands($cmd);
 
diff --git a/tests/Unit/NagiosControllerTest.php b/tests/Unit/NagiosControllerTest.php
new file mode 100644
index 0000000..1ff0eff
--- /dev/null
+++ b/tests/Unit/NagiosControllerTest.php
@@ -0,0 +1,54 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Unit coverage for the command entry point of controllers/nagios.php.
+ */
+
+beforeAll(function () {
+	npc_test_stub_cacti_includes();
+	require_once dirname(__DIR__, 2) . '/controllers/controller.php';
+	npc_test_load(dirname(__DIR__, 2) . '/controllers/nagios.php');
+});
+
+beforeEach(function () {
+	$GLOBALS['__test_config']        = array();
+	$GLOBALS['__test_denied_realms'] = array();
+});
+
+afterEach(function () {
+	$GLOBALS['__test_config']        = array();
+	$GLOBALS['__test_denied_realms'] = array();
+});
+
+it('checks the command realm before it looks at the command file', function () {
+	$GLOBALS['__test_denied_realms'] = array('npc1.php');
+	$GLOBALS['__test_config']        = array('npc_nagios_commands' => '1', 'npc_nagios_cmd_path' => '/nonexistent/nagios.cmd');
+
+	$out = json_decode((new NpcNagiosController())->command(array('command' => 'ENABLE_NOTIFICATIONS')), true);
+
+	expect($out)->toBe(array('success' => false, 'msg' => 'You do not have permission to execute this command.'));
+});
+
+it('reports a disabled feature to a user who holds the realm', function () {
+	$out = json_decode((new NpcNagiosController())->command(array('command' => 'ENABLE_NOTIFICATIONS')), true);
+
+	expect($out['success'])->toBeFalse();
+	expect($out['msg'])->toContain('Remote Commands must be enabled');
+});
+
+it('writes a permitted command to the command file', function () {
+	$file = sys_get_temp_dir() . '/npc-cmd-' . uniqid();
+	file_put_contents($file, '');
+
+	$GLOBALS['__test_config'] = array('npc_nagios_commands' => '1', 'npc_nagios_cmd_path' => $file);
+
+	$out = json_decode((new NpcNagiosController())->command(array('command' => 'ENABLE_NOTIFICATIONS')), true);
+
+	expect($out)->toBe(array('success' => true));
+	expect(file_get_contents($file))->toMatch('/^\\[\\d+\\] ENABLE_NOTIFICATIONS\\n$/');
+});

From b0a6f0ce0a9bf35ec5b4896682b1728694324815 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 21:25:50 -0600
Subject: [PATCH 09/41] fix: load the base controller class in npc.php

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                                |   2 +
 npc.php                                     |   2 +
 tests/E2E/FrontControllerTest.php           |  93 +++++++++++
 tests/E2E/support/front-controller-auth.php | 172 ++++++++++++++++++++
 tests/bin/patch-coverage.php                |   4 +
 5 files changed, 273 insertions(+)
 create mode 100644 tests/E2E/FrontControllerTest.php
 create mode 100644 tests/E2E/support/front-controller-auth.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e6e473b..109d7c1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* issue: Load the base controller class in npc.php; every NPC page failed with
+  a missing Controller class before
 * security: Check the NPC command realm before the command file settings so users
   without the realm no longer see the configured command file path
 * issue: Call the Nagios controller on an instance when deleting all host or service
diff --git a/npc.php b/npc.php
index d02773b..210b41c 100644
--- a/npc.php
+++ b/npc.php
@@ -72,6 +72,8 @@
 }
 
 /* Include the validated controller */
+require_once(dirname(__FILE__) . '/controllers/controller.php');
+
 $controller_path = dirname(__FILE__) . '/controllers/' . $module . '.php';
 
 if (!file_exists($controller_path)) {
diff --git a/tests/E2E/FrontControllerTest.php b/tests/E2E/FrontControllerTest.php
new file mode 100644
index 0000000..286b837
--- /dev/null
+++ b/tests/E2E/FrontControllerTest.php
@@ -0,0 +1,93 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * End-to-end coverage of npc.php, the front controller every NPC request goes
+ * through. Each test runs the real npc.php and the real controllers in a PHP
+ * subprocess; tests/E2E/support/front-controller-auth.php replaces only the
+ * session, the database and the page chrome, and Cacti's own request helpers
+ * do the validation and sanitizing.
+ */
+
+/**
+ * Run npc.php for one request.
+ *
+ * @param array $request method, get, post, rows (database fixtures), options
+ *
+ * @return array stdout, the recorded calls, the sandbox path
+ */
+function npc_e2e_run(array $request) {
+	$cacti = $GLOBALS['config']['base_path'];
+	$base  = sys_get_temp_dir() . '/npc-e2e-' . uniqid();
+	$npc   = $base . '/plugins/npc';
+
+	mkdir($npc, 0777, true);
+	mkdir($base . '/include', 0777, true);
+	copy(dirname(__DIR__, 2) . '/npc.php', $npc . '/npc.php');
+	copy(__DIR__ . '/support/front-controller-auth.php', $base . '/include/auth.php');
+
+	foreach (array('controllers', 'includes', 'nagioscmd.php', 'setup.php', 'INFO') as $entry) {
+		symlink(dirname(__DIR__, 2) . '/' . $entry, $npc . '/' . $entry);
+	}
+
+	$scenario = array_merge(array(
+		'method'     => 'GET',
+		'get'        => array(),
+		'post'       => array(),
+		'rows'       => array(),
+		'options'    => array('npc_config_type' => '1'),
+		'cacti_path' => $cacti,
+		'base_path'  => $base,
+		'log'        => $base . '/calls.log',
+	), $request);
+
+	if ($scenario['method'] === 'POST') {
+		$scenario['post'] = $scenario['post'] + $scenario['get'];
+	}
+
+	$process = proc_open(
+		array(PHP_BINARY, '-d', 'display_errors=stderr', 'npc.php'),
+		array(1 => array('pipe', 'w'), 2 => array('pipe', 'w')),
+		$pipes,
+		$npc,
+		array('NPC_E2E' => json_encode($scenario))
+	);
+
+	$stdout = stream_get_contents($pipes[1]);
+	$stderr = stream_get_contents($pipes[2]);
+	proc_close($process);
+
+	$calls = array();
+
+	if (is_file($scenario['log'])) {
+		foreach (array_filter(explode("\n", file_get_contents($scenario['log']))) as $line) {
+			$calls[] = json_decode($line, true);
+		}
+	}
+
+	return array('stdout' => $stdout, 'stderr' => $stderr, 'calls' => $calls, 'base' => $base);
+}
+
+function npc_e2e_calls(array $run, $kind) {
+	return array_values(array_filter($run['calls'], function ($call) use ($kind) {
+		return $call['kind'] === $kind;
+	}));
+}
+
+it('serves the frame for a known tab', function () {
+	$run = npc_e2e_run(array('get' => array('module' => 'layout', 'action' => 'drawFrame', 'tab' => 'hosts')));
+
+	expect($run['stderr'])->toBe('');
+	expect($run['stdout'])->toContain("currentTab:       'hosts'");
+});
+
+it('does not echo an unknown tab value into the frame script', function () {
+	$run = npc_e2e_run(array('get' => array('module' => 'layout', 'action' => 'drawFrame', 'tab' => 'x</script><b>breakout</b>')));
+
+	expect($run['stdout'])->toContain("currentTab:       'dashboard'");
+	expect($run['stdout'])->not->toContain('breakout');
+});
diff --git a/tests/E2E/support/front-controller-auth.php b/tests/E2E/support/front-controller-auth.php
new file mode 100644
index 0000000..527ddcf
--- /dev/null
+++ b/tests/E2E/support/front-controller-auth.php
@@ -0,0 +1,172 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Stand-in for Cacti's include/auth.php, used only by the front controller
+ * tests in tests/E2E.
+ *
+ * The request, validation and sanitizing helpers are Cacti's own, loaded from
+ * the Cacti tree the plugin sits in. Only the session, the database and the
+ * page chrome are replaced. The scenario comes in through the NPC_E2E
+ * environment variable as JSON: request method, query and form values, the
+ * rows the database should return for a statement, and the configuration
+ * options. Every database call and log line is appended to a file named in
+ * the same JSON so the test can inspect what the plugin did.
+ */
+
+$scenario = json_decode((string) getenv('NPC_E2E'), true);
+
+$config = array(
+	'base_path'     => $scenario['base_path'],
+	'library_path'  => $scenario['cacti_path'] . '/lib',
+	'url_path'      => '/cacti/',
+	'cacti_version' => '1.2.30',
+);
+
+require_once $scenario['cacti_path'] . '/include/global_constants.php';
+require_once $scenario['cacti_path'] . '/lib/html_utility.php';
+
+/*
+ * lib/functions.php cannot be loaded next to the stubs below, so the one
+ * helper the front controller needs from it, the search string sanitizer, is
+ * taken from the file source unchanged.
+ */
+$source = file_get_contents($scenario['cacti_path'] . '/lib/functions.php');
+$start  = strpos($source, 'function sanitize_search_string');
+$open   = strpos($source, '{', $start);
+$depth  = 0;
+
+for ($end = $open; $end < strlen($source); $end++) {
+	if ($source[$end] === '{') {
+		$depth++;
+	} elseif ($source[$end] === '}' && --$depth === 0) {
+		break;
+	}
+}
+
+eval(substr($source, $start, $end - $start + 1));
+require_once $scenario['base_path'] . '/plugins/npc/setup.php';
+
+$_SERVER['REQUEST_METHOD'] = $scenario['method'];
+$_GET                      = $scenario['get'];
+$_POST                     = $scenario['post'];
+$_REQUEST                  = array_merge($_GET, $_POST);
+$_SESSION['sess_user_id']  = 1;
+
+function npc_e2e_record($kind, $detail) {
+	global $scenario;
+
+	file_put_contents($scenario['log'], json_encode(array('kind' => $kind) + $detail) . "\n", FILE_APPEND);
+}
+
+function npc_e2e_rows($fn, $sql, $params, $default) {
+	global $scenario;
+
+	npc_e2e_record($fn, array('sql' => $sql, 'params' => $params));
+
+	foreach (($scenario['rows'][$fn] ?? array()) as $match => $rows) {
+		if (strpos($sql, (string) $match) !== false) {
+			return $rows;
+		}
+	}
+
+	return $default;
+}
+
+function db_fetch_assoc($sql) {
+	return npc_e2e_rows(__FUNCTION__, $sql, array(), array());
+}
+
+function db_fetch_assoc_prepared($sql, $params = array()) {
+	return npc_e2e_rows(__FUNCTION__, $sql, $params, array());
+}
+
+function db_fetch_row_prepared($sql, $params = array()) {
+	return npc_e2e_rows(__FUNCTION__, $sql, $params, array());
+}
+
+function db_fetch_cell($sql) {
+	return npc_e2e_rows(__FUNCTION__, $sql, array(), '');
+}
+
+function db_fetch_cell_prepared($sql, $params = array()) {
+	return npc_e2e_rows(__FUNCTION__, $sql, $params, '');
+}
+
+function db_execute_prepared($sql, $params = array()) {
+	npc_e2e_record(__FUNCTION__, array('sql' => $sql, 'params' => $params));
+
+	return true;
+}
+
+function sql_save($array, $table, $key = 'id') {
+	npc_e2e_record(__FUNCTION__, array('table' => $table, 'row' => $array));
+
+	return 1;
+}
+
+function read_config_option($name, $force = false) {
+	global $scenario;
+
+	return $scenario['options'][$name] ?? '';
+}
+
+function cacti_log($message, $also_print = false, $log_type = '', $level = 0) {
+	npc_e2e_record('cacti_log', array('message' => $message));
+}
+
+function raise_message($id, $text = '', $level = 0) {
+	npc_e2e_record('raise_message', array('id' => $id));
+}
+
+function api_user_realm_auth($filename = '') {
+	return true;
+}
+
+function api_plugin_user_realm_auth($filename = '') {
+	return true;
+}
+
+function cacti_sizeof($array) {
+	return is_array($array) ? count($array) : 0;
+}
+
+function cacti_count($array) {
+	return is_array($array) ? count($array) : 0;
+}
+
+function cacti_escapeshellarg($string) {
+	return escapeshellarg($string);
+}
+
+function html_escape($string) {
+	return htmlspecialchars((string) $string, ENT_QUOTES | ENT_HTML5, 'UTF-8');
+}
+
+function __($text, $domain = 'cacti') {
+	return $text;
+}
+
+function csrf_get_tokens() {
+	return 'token';
+}
+
+function general_header() {
+}
+
+function bottom_footer() {
+}
+
+function html_start_box() {
+}
+
+function html_end_box() {
+}
+
+function get_md5_include_js($path) {
+	return "<script src='" . $path . "'></script>";
+}
diff --git a/tests/bin/patch-coverage.php b/tests/bin/patch-coverage.php
index e2f342b..13ebdce 100644
--- a/tests/bin/patch-coverage.php
+++ b/tests/bin/patch-coverage.php
@@ -160,6 +160,10 @@ function changed_lines($base_ref) {
  * Empty by default; add entries per repository as the need arises.
  */
 $unmeasured_allowlist = [
+	// Front controller: chdirs, includes Cacti's auth.php and dispatches at the
+	// top level, so it cannot be loaded into the isolated unit process. It runs
+	// as a subprocess in tests/E2E/FrontControllerTest.php instead.
+	'npc.php',
 	// Schema provisioning relocated verbatim from setup.php; only loaded from
 	// plugin_npc_install() at install time, not exercisable in the isolated
 	// unit process.

From c06cc2934c8216e43eb9dfdb781f926133cbd03d Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 21:26:57 -0600
Subject: [PATCH 10/41] fix: accept state-changing NPC actions only as POST
 requests

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                      |  3 +++
 npc.php                           | 21 +++++++++++++++
 tests/E2E/FrontControllerTest.php | 43 +++++++++++++++++++++++++++++++
 3 files changed, 67 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 109d7c1..2209e79 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 --- develop ---
 
+* security: Accept the state-changing NPC actions (Nagios commands, comment
+  deletion, data input creation, host import, graph mapping, settings save) only
+  as POST requests so Cacti's CSRF token check applies to them
 * issue: Load the base controller class in npc.php; every NPC page failed with
   a missing Controller class before
 * security: Check the NPC command realm before the command file settings so users
diff --git a/npc.php b/npc.php
index 210b41c..cc9967b 100644
--- a/npc.php
+++ b/npc.php
@@ -71,6 +71,27 @@
 	exit;
 }
 
+/* Actions that change state are only accepted from POST, the one method
+whose request csrf-magic validates. */
+$post_only = array(
+	'nagios'   => array('command'),
+	'comments' => array('deleteAllHostComments', 'deleteAllServiceComments'),
+	'cacti'    => array('addDataInputMethod'),
+	'sync'     => array('import'),
+	'hosts'    => array('setMappedGraph'),
+	'services' => array('setMappedGraph'),
+	'settings' => array('save'),
+);
+
+if (isset($post_only[$module]) && in_array($action, $post_only[$module], true)
+	&& (!isset($_SERVER['REQUEST_METHOD']) || $_SERVER['REQUEST_METHOD'] !== 'POST')) {
+	cacti_log('SECURITY: NPC rejected non-POST request for ' . $module . '/' . $action, false, 'NPC');
+	http_response_code(405);
+	header('Allow: POST');
+	print json_encode(array('success' => false, 'msg' => __('This action requires a POST request.', 'npc')));
+	exit;
+}
+
 /* Include the validated controller */
 require_once(dirname(__FILE__) . '/controllers/controller.php');
 
diff --git a/tests/E2E/FrontControllerTest.php b/tests/E2E/FrontControllerTest.php
index 286b837..5745566 100644
--- a/tests/E2E/FrontControllerTest.php
+++ b/tests/E2E/FrontControllerTest.php
@@ -91,3 +91,46 @@ function npc_e2e_calls(array $run, $kind) {
 	expect($run['stdout'])->toContain("currentTab:       'dashboard'");
 	expect($run['stdout'])->not->toContain('breakout');
 });
+
+it('refuses state-changing actions sent as GET requests', function (string $module, string $action) {
+	$run = npc_e2e_run(array('get' => array('module' => $module, 'action' => $action, 'p_command' => 'ENABLE_NOTIFICATIONS', 'p_object_id' => '12', 'p_host' => 'web1')));
+
+	expect(json_decode($run['stdout'], true))->toBe(array('success' => false, 'msg' => 'This action requires a POST request.'));
+	expect(npc_e2e_calls($run, 'db_execute_prepared'))->toBe(array());
+	expect(npc_e2e_calls($run, 'sql_save'))->toBe(array());
+})->with(array(
+	'nagios command'          => array('nagios', 'command'),
+	'delete host comments'    => array('comments', 'deleteAllHostComments'),
+	'delete service comments' => array('comments', 'deleteAllServiceComments'),
+	'data input method'       => array('cacti', 'addDataInputMethod'),
+	'host import'             => array('sync', 'import'),
+	'host graph mapping'      => array('hosts', 'setMappedGraph'),
+	'service graph mapping'   => array('services', 'setMappedGraph'),
+	'settings save'           => array('settings', 'save'),
+));
+
+it('accepts the same actions sent as POST', function () {
+	$run = npc_e2e_run(array(
+		'method' => 'POST',
+		'get'    => array('module' => 'cacti', 'action' => 'addDataInputMethod'),
+		'post'   => array('p_object_id' => '12', 'p_host' => 'web1'),
+	));
+
+	expect(json_decode($run['stdout'], true))->toBe(array('success' => true));
+	expect(npc_e2e_calls($run, 'sql_save'))->not->toBe(array());
+});
+
+it('writes a Nagios command only for a POST request', function () {
+	$file = sys_get_temp_dir() . '/npc-e2e-cmd-' . uniqid();
+	file_put_contents($file, '');
+
+	$options = array('npc_config_type' => '1', 'npc_nagios_commands' => '1', 'npc_nagios_cmd_path' => $file);
+	$query   = array('module' => 'nagios', 'action' => 'command', 'p_command' => 'ENABLE_NOTIFICATIONS');
+
+	npc_e2e_run(array('get' => $query, 'options' => $options));
+	expect(file_get_contents($file))->toBe('');
+
+	$run = npc_e2e_run(array('method' => 'POST', 'get' => $query, 'options' => $options));
+	expect(json_decode($run['stdout'], true))->toBe(array('success' => true));
+	expect(file_get_contents($file))->toMatch('/^\[\d+\] ENABLE_NOTIFICATIONS\n$/');
+});

From bcf41bd93a700437ace7ecb82eb617523ccbf6ef Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 21:28:03 -0600
Subject: [PATCH 11/41] fix: copy only known request parameters onto
 controllers and bound start and limit

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                      |  2 ++
 npc.php                           | 26 ++++++++++++++++++-----
 tests/E2E/FrontControllerTest.php | 34 +++++++++++++++++++++++++++++++
 3 files changed, 57 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2209e79..8c178fc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* security: Copy only the known request parameters onto the NPC controllers and keep
+  `start` and `limit` within bounds (at most 1000 rows per request)
 * security: Accept the state-changing NPC actions (Nagios commands, comment
   deletion, data input creation, host import, graph mapping, settings save) only
   as POST requests so Cacti's CSRF token check applies to them
diff --git a/npc.php b/npc.php
index cc9967b..3fe4749 100644
--- a/npc.php
+++ b/npc.php
@@ -116,7 +116,10 @@
 
 $obj = new $class;
 
-/* Collect sanitized parameters. Only allow known parameter prefixes. */
+/* Collect sanitized parameters. Only allow known parameter prefixes. Only the
+   names in $request_properties are copied onto the controller, so a request
+   cannot overwrite its other properties. */
+$request_properties = array('state', 'id', 'searchString', 'searchFields', 'hostgroup', 'unhandled');
 $params = array('config' => $config);
 
 if (is_array($_REQUEST)) {
@@ -124,11 +127,24 @@
 		/* Only accept p_ prefixed parameters, start, limit, and sort params */
 		if (preg_match('/^p_[a-zA-Z0-9_]+$/', $key)) {
 			$parm = preg_replace('/^p_/', '', $key);
-			$obj->$parm = get_filter_request_var($key, FILTER_CALLBACK, array('options' => 'sanitize_search_string'));
-			$params[$parm] = $obj->$parm;
+
+			/* $params['config'] carries the Cacti configuration */
+			if ($parm === 'config') {
+				continue;
+			}
+
+			$parsed = get_filter_request_var($key, FILTER_CALLBACK, array('options' => 'sanitize_search_string'));
+
+			if (in_array($parm, $request_properties, true)) {
+				$obj->$parm = $parsed;
+			}
+
+			$params[$parm] = $parsed;
 		} elseif (in_array($key, array('start', 'limit', 'sort', 'dir'), true)) {
-			if ($key == 'start' || $key == 'limit') {
-				$obj->$key = get_filter_request_var($key, FILTER_VALIDATE_INT);
+			if ($key == 'start') {
+				$obj->start = max(0, (int) get_filter_request_var($key, FILTER_VALIDATE_INT));
+			} elseif ($key == 'limit') {
+				$obj->limit = min(1000, max(1, (int) get_filter_request_var($key, FILTER_VALIDATE_INT)));
 			} elseif ($key == 'dir') {
 				$val = strtoupper(get_filter_request_var($key, FILTER_CALLBACK, array('options' => 'sanitize_search_string')));
 				$obj->dir = in_array($val, array('ASC', 'DESC'), true) ? $val : 'ASC';
diff --git a/tests/E2E/FrontControllerTest.php b/tests/E2E/FrontControllerTest.php
index 5745566..ba52d31 100644
--- a/tests/E2E/FrontControllerTest.php
+++ b/tests/E2E/FrontControllerTest.php
@@ -134,3 +134,37 @@ function npc_e2e_calls(array $run, $kind) {
 	expect(json_decode($run['stdout'], true))->toBe(array('success' => true));
 	expect(file_get_contents($file))->toMatch('/^\[\d+\] ENABLE_NOTIFICATIONS\n$/');
 });
+
+it('does not let a request overwrite controller properties', function () {
+	$run = npc_e2e_run(array('get' => array('module' => 'hosts', 'action' => 'summary', 'p_config_type' => '99')));
+
+	$summary = array_values(array_filter(npc_e2e_calls($run, 'db_fetch_assoc_prepared'), function ($call) {
+		return strpos($call['sql'], 'h.config_type = ?') !== false;
+	}));
+
+	expect($summary[0]['params'])->toBe(array('1'));
+});
+
+it('keeps the config parameter out of the request values', function () {
+	$run = npc_e2e_run(array('get' => array('module' => 'layout', 'action' => 'drawFrame', 'p_config' => 'x')));
+
+	expect($run['stderr'])->toBe('');
+	expect($run['stdout'])->toContain("currentTab:       'dashboard'");
+});
+
+it('bounds the page size and start of a listing', function (array $query, array $expected) {
+	$run = npc_e2e_run(array('get' => array('module' => 'logentries', 'action' => 'getLogs') + $query));
+
+	$select = array_values(array_filter(npc_e2e_calls($run, 'db_fetch_assoc_prepared'), function ($call) {
+		return strpos($call['sql'], 'LIMIT ?, ?') !== false;
+	}));
+
+	expect(array_slice($select[0]['params'], -2))->toBe($expected);
+})->with(array(
+	'default page'     => array(array(), array(0, 25)),
+	'large limit'      => array(array('limit' => '100000'), array(0, 1000)),
+	'negative limit'   => array(array('limit' => '-5'), array(0, 1)),
+	'negative start'   => array(array('start' => '-50', 'limit' => '10'), array(0, 10)),
+	'second page'      => array(array('start' => '50', 'limit' => '50'), array(50, 50)),
+	'limit as p_limit' => array(array('p_limit' => '100000'), array(0, 25)),
+));

From 3a7de47358de12a57a0031aa7c83d31c8158dad1 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:02:58 -0600
Subject: [PATCH 12/41] fix: pass searchFields and data to controllers as JSON

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                      |  4 ++++
 controllers/sync.php              |  3 ++-
 npc.php                           | 10 +++++++-
 tests/E2E/FrontControllerTest.php | 38 +++++++++++++++++++++++++++++++
 4 files changed, 53 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8c178fc..5a9a185 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 --- develop ---
 
+* issue: Pass the searchFields and data request values to the controllers as
+  JSON; the search string sanitizer removed their quotes, so grid searches and the
+  host import selection never applied; the selection lookup also called a
+  non-static method statically
 * security: Copy only the known request parameters onto the NPC controllers and keep
   `start` and `limit` within bounds (at most 1000 rows per request)
 * security: Accept the state-changing NPC actions (Nagios commands, comment
diff --git a/controllers/sync.php b/controllers/sync.php
index 7355adf..ed0793b 100644
--- a/controllers/sync.php
+++ b/controllers/sync.php
@@ -128,10 +128,11 @@ function getHosts($params) {
         $results = array();
 
 	$hgc = new NpcHostgroupsController();
+        $cacti = new NpcCactiController();
         foreach ($data as $hostgroup) {
             $hosts = $hgc->getHostList(array('alias' => $hostgroup->alias));
             foreach ($hosts as $host) {
-                if (!NpcCactiController::isMapped($host['host_object_id'])) {
+                if (!$cacti->isMapped($host['host_object_id'])) {
                     $results[] = array(
                         'host_object_id' => $host['host_object_id'],
                         'display_name' => $host['display_name'],
diff --git a/npc.php b/npc.php
index 3fe4749..c9196be 100644
--- a/npc.php
+++ b/npc.php
@@ -133,7 +133,15 @@
 				continue;
 			}
 
-			$parsed = get_filter_request_var($key, FILTER_CALLBACK, array('options' => 'sanitize_search_string'));
+			if ($parm === 'searchFields' || $parm === 'data') {
+				/* JSON documents. The search sanitizer would strip their quotes; the
+				   controllers only decode them and match field names against fixed
+				   maps. */
+				$parsed = get_nfilter_request_var($key);
+				$parsed = is_string($parsed) ? $parsed : '';
+			} else {
+				$parsed = get_filter_request_var($key, FILTER_CALLBACK, array('options' => 'sanitize_search_string'));
+			}
 
 			if (in_array($parm, $request_properties, true)) {
 				$obj->$parm = $parsed;
diff --git a/tests/E2E/FrontControllerTest.php b/tests/E2E/FrontControllerTest.php
index ba52d31..cffb98c 100644
--- a/tests/E2E/FrontControllerTest.php
+++ b/tests/E2E/FrontControllerTest.php
@@ -168,3 +168,41 @@ function npc_e2e_calls(array $run, $kind) {
 	'second page'      => array(array('start' => '50', 'limit' => '50'), array(50, 50)),
 	'limit as p_limit' => array(array('p_limit' => '100000'), array(0, 25)),
 ));
+
+it('applies a JSON search field list to the query', function () {
+	$run = npc_e2e_run(array('get' => array(
+		'module'         => 'logentries',
+		'action'         => 'getLogs',
+		'p_searchString' => 'restart',
+		'p_searchFields' => '["logentry_data","not_a_field"]',
+	)));
+
+	$count = npc_e2e_calls($run, 'db_fetch_cell_prepared');
+
+	expect($count[0]['sql'])->toContain('l.logentry_data LIKE ?');
+	expect($count[0]['sql'])->not->toContain('not_a_field');
+	expect($count[0]['params'])->toBe(array('%restart%'));
+});
+
+it('reads the hostgroup selection of the import as JSON', function () {
+	$run = npc_e2e_run(array(
+		'get'  => array(
+			'module' => 'sync',
+			'action' => 'getHosts',
+			'p_data' => '{"g1":{"alias":"web servers","create_graphs":1,"template":2}}',
+		),
+		'rows' => array('db_fetch_assoc_prepared' => array('INNER JOIN npc_hostgroup_members' => array(
+			array('host_object_id' => 10, 'display_name' => 'web1', 'address' => '192.0.2.10'),
+		))),
+	));
+
+	expect(json_decode($run['stdout'], true))->toBe(array(
+		array('host_object_id' => 10, 'display_name' => 'web1', 'address' => '192.0.2.10', 'create_graphs' => 1, 'template' => 2),
+	));
+
+	$lookup = array_values(array_filter(npc_e2e_calls($run, 'db_fetch_assoc_prepared'), function ($call) {
+		return strpos($call['sql'], 'hg.alias = ?') !== false;
+	}));
+
+	expect($lookup[0]['params'])->toBe(array('web servers'));
+});

From 6e75bd1e054b12cd8e0e3316a966b4126cb775ee Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:04:05 -0600
Subject: [PATCH 13/41] fix: drop dispatcher actions that cannot run with a
 single parameter array

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                      |  2 ++
 npc.php                           |  6 +++---
 tests/E2E/FrontControllerTest.php | 13 +++++++++++++
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5a9a185..13b5f09 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* issue: Remove dispatcher actions that cannot work with the single parameter array
+  they are called with (getSetting, isMapped, mapHost, getSettings, checkHostExists)
 * issue: Pass the searchFields and data request values to the controllers as
   JSON; the search string sanitizer removed their quotes, so grid searches and the
   host import selection never applied; the selection lookup also called a
diff --git a/npc.php b/npc.php
index c9196be..6f3af19 100644
--- a/npc.php
+++ b/npc.php
@@ -33,9 +33,9 @@
 	'logentries'    => array('getLogs'),
 	'statehistory'  => array('getStateHistory'),
 	'nagios'        => array('getProgramStatus', 'getProcessInfoGrid', 'processInfo', 'command', 'checkPerf'),
-	'settings'      => array('getSettings', 'save'),
-	'cacti'         => array('getSetting', 'getHostTemplates', 'isMapped', 'mapHost', 'getHostnames', 'addDataInputMethod', 'generateHash', 'getGraphList'),
-	'sync'          => array('import', 'getHosts', 'listHostgroups', 'checkHostExists'),
+	'settings'      => array('save'),
+	'cacti'         => array('getHostTemplates', 'getHostnames', 'addDataInputMethod', 'generateHash', 'getGraphList'),
+	'sync'          => array('import', 'getHosts', 'listHostgroups'),
 );
 
 $module = 'layout';
diff --git a/tests/E2E/FrontControllerTest.php b/tests/E2E/FrontControllerTest.php
index cffb98c..939f03f 100644
--- a/tests/E2E/FrontControllerTest.php
+++ b/tests/E2E/FrontControllerTest.php
@@ -206,3 +206,16 @@ function npc_e2e_calls(array $run, $kind) {
 
 	expect($lookup[0]['params'])->toBe(array('web servers'));
 });
+
+it('rejects actions that were removed from the dispatcher', function (string $module, string $action) {
+	$run = npc_e2e_run(array('get' => array('module' => $module, 'action' => $action)));
+
+	expect($run['stdout'])->toBe('');
+	expect(implode("\n", array_column(npc_e2e_calls($run, 'cacti_log'), 'message')))->toContain('rejected unknown action: ' . $module . '/' . $action);
+})->with(array(
+	'setting lookup'       => array('cacti', 'getSetting'),
+	'mapped check'         => array('cacti', 'isMapped'),
+	'host mapping'         => array('cacti', 'mapHost'),
+	'user settings lookup' => array('settings', 'getSettings'),
+	'address lookup'       => array('sync', 'checkHostExists'),
+));

From 720300f52dc29feea8e9ef80e486a42c97e48673 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:05:12 -0600
Subject: [PATCH 14/41] test: cover the hostgroup selection of the host import

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 tests/Unit/SyncImportTest.php | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/tests/Unit/SyncImportTest.php b/tests/Unit/SyncImportTest.php
index cef43a7..473bc12 100644
--- a/tests/Unit/SyncImportTest.php
+++ b/tests/Unit/SyncImportTest.php
@@ -267,3 +267,26 @@ function npc_sync_cache_run($ip, $cache_id, $prepare = null) {
 	expect($GLOBALS['__test_db_calls'])->toBe(array());
 	expect(file_exists($base . '/cli/argv.json'))->toBeFalse();
 });
+
+it('lists the unmapped hosts of the selected hostgroups', function () {
+	$GLOBALS['__test_db_results']['db_fetch_assoc_prepared']['INNER JOIN npc_hostgroup_members'] = array(
+		array('host_object_id' => 10, 'display_name' => 'web1', 'address' => '192.0.2.10'),
+	);
+
+	$out = json_decode((new NpcSyncController())->getHosts(array('data' => '{"g1":{"alias":"web","create_graphs":1,"template":2}}')), true);
+
+	expect($out)->toBe(array(
+		array('host_object_id' => 10, 'display_name' => 'web1', 'address' => '192.0.2.10', 'create_graphs' => 1, 'template' => 2),
+	));
+});
+
+it('leaves hosts that are already mapped out of the selection', function () {
+	$GLOBALS['__test_db_results']['db_fetch_assoc_prepared']['INNER JOIN npc_hostgroup_members'] = array(
+		array('host_object_id' => 10, 'display_name' => 'web1', 'address' => '192.0.2.10'),
+	);
+	$GLOBALS['__test_db_results']['db_fetch_assoc_prepared']['WHERE npc_host_object_id'] = array(array('id' => 3));
+
+	$out = (new NpcSyncController())->getHosts(array('data' => '{"g1":{"alias":"web","create_graphs":1,"template":2}}'));
+
+	expect(json_decode($out, true))->toBe(array());
+});

From 936ebdbf114f5199fc337d94dcf18aeb3c92d32b Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:06:20 -0600
Subject: [PATCH 15/41] fix: name the failing class and method in the
 controller error response

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                        |  2 ++
 controllers/controller.php          |  2 +-
 tests/Unit/ControllerLoggerTest.php | 35 +++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 tests/Unit/ControllerLoggerTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 13b5f09..8573983 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* issue: Name the failing class and method in the generic error returned by the
+  controller logger; the message was built from an invalid property read
 * issue: Remove dispatcher actions that cannot work with the single parameter array
   they are called with (getSetting, isMapped, mapHost, getSettings, checkHostExists)
 * issue: Pass the searchFields and data request values to the controllers as
diff --git a/controllers/controller.php b/controllers/controller.php
index 876703c..e64263d 100644
--- a/controllers/controller.php
+++ b/controllers/controller.php
@@ -416,7 +416,7 @@ function logger($level, $class, $method, $message) {
 
         // If this was an error send a generic response to the client
         if ($level == 'error') {
-            return(json_encode(array('success' => false, 'msg' => __('An error occurred in %s. See error logs for detail.', $class -> $method, 'npc'))));
+            return(json_encode(array('success' => false, 'msg' => sprintf(__('An error occurred in %s. See error logs for detail.', 'npc'), $class . '::' . $method))));
         }
     }
 
diff --git a/tests/Unit/ControllerLoggerTest.php b/tests/Unit/ControllerLoggerTest.php
new file mode 100644
index 0000000..db55dcb
--- /dev/null
+++ b/tests/Unit/ControllerLoggerTest.php
@@ -0,0 +1,35 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Unit coverage for Controller::logger(), which logs a message and hands the
+ * client a generic error for the error level.
+ */
+
+beforeAll(function () {
+	require_once dirname(__DIR__, 2) . '/controllers/controller.php';
+});
+
+beforeEach(function () {
+	$GLOBALS['__test_config']   = array('npc_log_level' => '4');
+	$GLOBALS['__test_cacti_log'] = array();
+});
+
+afterEach(function () {
+	$GLOBALS['__test_config'] = array();
+});
+
+it('names the failing class and method in the error returned to the client', function () {
+	$out = json_decode((new Controller())->logger('error', 'NpcSyncController', 'import', 'boom'), true);
+
+	expect($out)->toBe(array('success' => false, 'msg' => 'An error occurred in NpcSyncController::import. See error logs for detail.'));
+	expect($GLOBALS['__test_cacti_log'])->toBe(array('ERROR [NpcSyncController] (import) - boom'));
+});
+
+it('returns nothing to the client below the error level', function () {
+	expect((new Controller())->logger('info', 'NpcSyncController', 'import', 'started'))->toBeNull();
+});

From b3f31e9394cfa7da6c3e011ecd88c2f26ebb9a04 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:07:27 -0600
Subject: [PATCH 16/41] fix: read only the newest host check when fetching host
 perfdata

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                       |  2 ++
 controllers/hosts.php              |  4 +++-
 tests/Unit/HostsControllerTest.php | 34 ++++++++++++++++++++++++++++++
 3 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 tests/Unit/HostsControllerTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8573983..3f08b20 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* issue: Read only the newest host check when fetching host perfdata; the query
+  returned every stored check and the oldest one was used
 * issue: Name the failing class and method in the generic error returned by the
   controller logger; the message was built from an invalid property read
 * issue: Remove dispatcher actions that cannot work with the single parameter array
diff --git a/controllers/hosts.php b/controllers/hosts.php
index f6e79bf..aa2da8c 100644
--- a/controllers/hosts.php
+++ b/controllers/hosts.php
@@ -103,7 +103,9 @@ function summary() {
 	function getPerfData($id) {
 		return db_fetch_assoc_prepared('SELECT perfdata
 			FROM npc_hostchecks
-			WHERE host_object_id = ?',
+			WHERE host_object_id = ?
+			ORDER BY hostcheck_id DESC
+			LIMIT 1',
 			array($id));
 	}
 
diff --git a/tests/Unit/HostsControllerTest.php b/tests/Unit/HostsControllerTest.php
new file mode 100644
index 0000000..5218aa7
--- /dev/null
+++ b/tests/Unit/HostsControllerTest.php
@@ -0,0 +1,34 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Unit coverage for controllers/hosts.php. The query semantics are checked
+ * against MariaDB in tests/Integration/NpcDatabaseTest.php.
+ */
+
+beforeAll(function () {
+	npc_test_stub_cacti_includes();
+	require_once dirname(__DIR__, 2) . '/controllers/controller.php';
+	npc_test_load(dirname(__DIR__, 2) . '/controllers/hosts.php');
+});
+
+beforeEach(function () {
+	$GLOBALS['__test_db_results']   = array();
+	$GLOBALS['__test_db_fetch_log'] = array();
+});
+
+it('asks for only the newest stored check of a host', function () {
+	$GLOBALS['__test_db_results']['db_fetch_assoc_prepared']['FROM npc_hostchecks'] = array(array('perfdata' => 'rta=0.5ms'));
+
+	$rows = (new NpcHostsController())->getPerfData(12);
+
+	expect($rows)->toBe(array(array('perfdata' => 'rta=0.5ms')));
+
+	$query = $GLOBALS['__test_db_fetch_log'][0];
+	expect(preg_replace('/\s+/', ' ', $query['sql']))->toContain('WHERE host_object_id = ? ORDER BY hostcheck_id DESC LIMIT 1');
+	expect($query['params'])->toBe(array(12));
+});

From 457911ce7632d5897f89bc103015ed38f2dc7547 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:08:34 -0600
Subject: [PATCH 17/41] fix: declare the request properties the controllers
 read

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                                  |  2 ++
 controllers/controller.php                    | 16 +++++++++
 .../Unit/ControllerRequestPropertiesTest.php  | 36 +++++++++++++++++++
 3 files changed, 54 insertions(+)
 create mode 100644 tests/Unit/ControllerRequestPropertiesTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3f08b20..850a5e8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* issue: Declare the hostgroup and unhandled request properties on the base
+  controller; assigning them raised the PHP 8.2 dynamic property deprecation
 * issue: Read only the newest host check when fetching host perfdata; the query
   returned every stored check and the oldest one was used
 * issue: Name the failing class and method in the generic error returned by the
diff --git a/controllers/controller.php b/controllers/controller.php
index e64263d..f009a62 100644
--- a/controllers/controller.php
+++ b/controllers/controller.php
@@ -120,6 +120,22 @@ class Controller {
      */
     var $searchString = null;
 
+    /**
+     * Restricts a listing to the hostgroup with this alias
+     *
+     * @var string
+     * @access public
+     */
+    var $hostgroup = null;
+
+    /**
+     * When set, a service listing leaves out acknowledged problems
+     *
+     * @var string
+     * @access public
+     */
+    var $unhandled = null;
+
     /**
      * json encoded list of fields to search
      *
diff --git a/tests/Unit/ControllerRequestPropertiesTest.php b/tests/Unit/ControllerRequestPropertiesTest.php
new file mode 100644
index 0000000..bc66bfd
--- /dev/null
+++ b/tests/Unit/ControllerRequestPropertiesTest.php
@@ -0,0 +1,36 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * npc.php copies a fixed set of request values onto the controller. PHP 8.2
+ * deprecates creating a property that the class does not declare, so every
+ * name in that set has to be declared on the base controller.
+ */
+
+beforeAll(function () {
+	require_once dirname(__DIR__, 2) . '/controllers/controller.php';
+});
+
+it('declares every property npc.php assigns from the request', function () {
+	preg_match("/\\\$request_properties = array\\(([^)]*)\\)/", file_get_contents(dirname(__DIR__, 2) . '/npc.php'), $match);
+	preg_match_all("/'(\\w+)'/", $match[1], $names);
+
+	expect($names[1])->not->toBe(array());
+
+	$controller = new Controller();
+
+	foreach ($names[1] as $name) {
+		expect(property_exists($controller, $name))->toBeTrue($name . ' is not declared');
+	}
+});
+
+it('treats the optional listing filters as unset until a request sets them', function () {
+	$controller = new Controller();
+
+	expect(isset($controller->hostgroup))->toBeFalse();
+	expect(isset($controller->unhandled))->toBeFalse();
+});

From a2f51078913c00c8eab920f98bc8b4948306b865 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:09:41 -0600
Subject: [PATCH 18/41] fix: list each service once in the service grid

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                          |  3 ++
 controllers/services.php              | 12 ++++---
 tests/Unit/ServicesControllerTest.php | 45 +++++++++++++++++++++++++++
 3 files changed, 56 insertions(+), 4 deletions(-)
 create mode 100644 tests/Unit/ServicesControllerTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 850a5e8..38ec99f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,9 @@
 
 * issue: Declare the hostgroup and unhandled request properties on the base
   controller; assigning them raised the PHP 8.2 dynamic property deprecation
+* issue: List each service once; the service grid joined the hostgroup members
+  unconditionally, so a host in several hostgroups repeated its services and
+  inflated the row count
 * issue: Read only the newest host check when fetching host perfdata; the query
   returned every stored check and the oldest one was used
 * issue: Name the failing class and method in the generic error returned by the
diff --git a/controllers/services.php b/controllers/services.php
index b19b16b..b83d763 100644
--- a/controllers/services.php
+++ b/controllers/services.php
@@ -166,7 +166,13 @@ function services($id = null, $where = null) {
 			$params[] = intval($svc_id);
 		}
 
+		/* A service is listed once however many hostgroups its host is in; the
+		   membership tables are only joined to filter on one. */
+		$hostgroup_join = '';
+
 		if (isset($this->hostgroup)) {
+			$hostgroup_join = 'LEFT JOIN npc_hostgroup_members hgm ON h.host_object_id = hgm.host_object_id
+				LEFT JOIN npc_hostgroups hg ON hgm.hostgroup_id = hg.hostgroup_id';
 			$where .= ' AND hg.alias = ?';
 			$params[] = $this->hostgroup;
 		}
@@ -195,8 +201,7 @@ function services($id = null, $where = null) {
 			LEFT JOIN npc_objects o ON ss.service_object_id = o.object_id
 			LEFT JOIN npc_services s ON ss.service_object_id = s.service_object_id
 			LEFT JOIN npc_hosts h ON s.host_object_id = h.host_object_id
-			LEFT JOIN npc_hostgroup_members hgm ON h.host_object_id = hgm.host_object_id
-			LEFT JOIN npc_hostgroups hg ON hgm.hostgroup_id = hg.hostgroup_id
+			' . $hostgroup_join . '
 			LEFT JOIN npc_instances i ON s.instance_id = i.instance_id
 			WHERE ' . $where,
 			$params);
@@ -224,8 +229,7 @@ function services($id = null, $where = null) {
 			LEFT JOIN npc_objects o ON ss.service_object_id = o.object_id
 			LEFT JOIN npc_services s ON ss.service_object_id = s.service_object_id
 			LEFT JOIN npc_hosts h ON s.host_object_id = h.host_object_id
-			LEFT JOIN npc_hostgroup_members hgm ON h.host_object_id = hgm.host_object_id
-			LEFT JOIN npc_hostgroups hg ON hgm.hostgroup_id = hg.hostgroup_id
+			' . $hostgroup_join . '
 			LEFT JOIN npc_instances i ON s.instance_id = i.instance_id
 			LEFT JOIN npc_service_graphs sg ON ss.service_object_id = sg.service_object_id
 			WHERE ' . $where . '
diff --git a/tests/Unit/ServicesControllerTest.php b/tests/Unit/ServicesControllerTest.php
new file mode 100644
index 0000000..28dec16
--- /dev/null
+++ b/tests/Unit/ServicesControllerTest.php
@@ -0,0 +1,45 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Unit coverage for the service listing query in controllers/services.php.
+ * The row counts are checked against MariaDB in
+ * tests/Integration/NpcDatabaseTest.php.
+ */
+
+beforeAll(function () {
+	npc_test_stub_cacti_includes();
+	require_once dirname(__DIR__, 2) . '/controllers/controller.php';
+	npc_test_load(dirname(__DIR__, 2) . '/controllers/services.php');
+});
+
+beforeEach(function () {
+	$GLOBALS['__test_db_fetch_log'] = array();
+});
+
+it('does not join the hostgroup tables when no hostgroup filter is set', function () {
+	(new NpcServicesController())->services();
+
+	foreach ($GLOBALS['__test_db_fetch_log'] as $query) {
+		expect($query['sql'])->not->toContain('npc_hostgroup');
+	}
+
+	expect(count($GLOBALS['__test_db_fetch_log']))->toBe(2);
+});
+
+it('joins the hostgroup tables and binds the alias when filtering by hostgroup', function () {
+	$services            = new NpcServicesController();
+	$services->hostgroup = 'web servers';
+
+	$services->services();
+
+	foreach ($GLOBALS['__test_db_fetch_log'] as $query) {
+		expect($query['sql'])->toContain('LEFT JOIN npc_hostgroups hg ON hgm.hostgroup_id = hg.hostgroup_id');
+		expect($query['sql'])->toContain('hg.alias = ?');
+		expect($query['params'][1])->toBe('web servers');
+	}
+});

From bb600ed78ab114417dd80d3976c98025a636f406 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:11:00 -0600
Subject: [PATCH 19/41] fix: skip non-numeric perfdata entries in the data
 input scripts

Also moves the E2E subprocess runner to support/harness.php and makes the stand-in auth file inert outside the test process.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                                |  2 +
 cli.php                                     |  6 +-
 perfdata.php                                |  7 +-
 tests/E2E/CliScriptsTest.php                | 52 +++++++++++++
 tests/E2E/FrontControllerTest.php           | 71 ++----------------
 tests/E2E/support/front-controller-auth.php | 49 +++++++++---
 tests/E2E/support/harness.php               | 82 +++++++++++++++++++++
 tests/bin/patch-coverage.php                |  5 ++
 8 files changed, 192 insertions(+), 82 deletions(-)
 create mode 100644 tests/E2E/CliScriptsTest.php
 create mode 100644 tests/E2E/support/harness.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 38ec99f..9ea9d0b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* issue: Skip perfdata entries without a numeric value (label=U) in perfdata.php and
+  cli.php instead of printing PHP warnings into the data input output
 * issue: Declare the hostgroup and unhandled request properties on the base
   controller; assigning them raised the PHP 8.2 dynamic property deprecation
 * issue: List each service once; the service grid joined the hostgroup members
diff --git a/cli.php b/cli.php
index 0ff48ee..d002ed7 100644
--- a/cli.php
+++ b/cli.php
@@ -137,13 +137,13 @@ function getPerfData() {
 	$obj = new $class;
 	$results = $obj->getPerfData($objectId, $hostname, $serviceName);
 
-	$perfParts = explode(' ', $results[0]['perfdata']);
+	$perfParts = explode(' ', isset($results[0]['perfdata']) ? $results[0]['perfdata'] : '');
 
 	$output = '';
 
 	foreach ($perfParts as $perf) {
-		if (preg_match('/=/', $perf)) {
-			preg_match('/(\S+)=([-+]?[0-9]*\.?[0-9]+)/', $perf, $matches);
+		/* Entries without a numeric value, such as label=U, are left out. */
+		if (preg_match('/(\S+)=([-+]?[0-9]*\.?[0-9]+)/', $perf, $matches)) {
 			if (preg_match('/^iso./', $matches[1])) {
 				$matches[1] = 'output';
 			}
diff --git a/perfdata.php b/perfdata.php
index 869411c..686a63f 100644
--- a/perfdata.php
+++ b/perfdata.php
@@ -12,6 +12,7 @@
 array_shift($parms);
 
 $objectId = null;
+$type = null;
 $serviceName = null;
 $hostname = null;
 
@@ -74,13 +75,13 @@
 $obj = new $class;
 $results = $obj->getPerfData($objectId, $hostname, $serviceName);
 
-$perfParts = explode(' ', $results[0]['perfdata']);
+$perfParts = explode(' ', isset($results[0]['perfdata']) ? $results[0]['perfdata'] : '');
 
 $output = '';
 
 foreach ($perfParts as $perf) {
-    if (preg_match('/=/', $perf)) {
-        preg_match('/(\S+)=([-+]?[0-9]*\.?[0-9]+)/', $perf, $matches);
+    /* Entries without a numeric value, such as label=U, are left out. */
+    if (preg_match('/(\S+)=([-+]?[0-9]*\.?[0-9]+)/', $perf, $matches)) {
         if (preg_match('/^iso./', $matches[1])) {
                 $matches[1] = 'output';
         }
diff --git a/tests/E2E/CliScriptsTest.php b/tests/E2E/CliScriptsTest.php
new file mode 100644
index 0000000..e5c453b
--- /dev/null
+++ b/tests/E2E/CliScriptsTest.php
@@ -0,0 +1,52 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * End-to-end coverage of the command line scripts Cacti data input methods
+ * run to read Nagios perfdata. Each test runs the real script in a PHP
+ * subprocess against the sandbox described in tests/E2E/support/harness.php.
+ */
+
+require_once __DIR__ . '/support/harness.php';
+
+$npc_perfdata_rows = array(
+	'db_fetch_cell_prepared'  => array('MAX(servicecheck_id)' => 5),
+	'db_fetch_assoc_prepared' => array('FROM npc_servicechecks' => array(
+		array('perfdata' => 'load1=0.52;1;2 load5=U;1;2 load15=0.4 iso.1.3=7'),
+	)),
+);
+
+it('prints the numeric perfdata values of a service', function (string $script, array $args) use ($npc_perfdata_rows) {
+	$run = npc_e2e_run(array('script' => $script, 'args' => $args, 'rows' => $npc_perfdata_rows));
+
+	expect($run['stderr'])->toBe('');
+	expect($run['stdout'])->toBe("load1:0.52 load15:0.4 output:7 \n");
+})->with(array(
+	'perfdata.php' => array('perfdata.php', array('--type=service', '--id=5')),
+	'cli.php'      => array('cli.php', array('--perfdata', '--type=service', '--id=5')),
+));
+
+it('prints an empty line when no check has been stored', function (string $script, array $args) {
+	$run = npc_e2e_run(array('script' => $script, 'args' => $args));
+
+	expect($run['stderr'])->toBe('');
+	expect($run['stdout'])->toBe("\n");
+})->with(array(
+	'perfdata.php' => array('perfdata.php', array('--type=service', '--id=5')),
+	'cli.php'      => array('cli.php', array('--perfdata', '--type=host', '--id=5')),
+));
+
+it('reads the newest host check for a host', function () {
+	$run = npc_e2e_run(array(
+		'script' => 'perfdata.php',
+		'args'   => array('--type=host', '--id=12'),
+		'rows'   => array('db_fetch_assoc_prepared' => array('FROM npc_hostchecks' => array(array('perfdata' => 'rta=0.5ms;100;200;0 pl=0%')))),
+	));
+
+	expect($run['stderr'])->toBe('');
+	expect($run['stdout'])->toBe("rta:0.5 pl:0 \n");
+});
diff --git a/tests/E2E/FrontControllerTest.php b/tests/E2E/FrontControllerTest.php
index 939f03f..948fbab 100644
--- a/tests/E2E/FrontControllerTest.php
+++ b/tests/E2E/FrontControllerTest.php
@@ -13,70 +13,7 @@
  * do the validation and sanitizing.
  */
 
-/**
- * Run npc.php for one request.
- *
- * @param array $request method, get, post, rows (database fixtures), options
- *
- * @return array stdout, the recorded calls, the sandbox path
- */
-function npc_e2e_run(array $request) {
-	$cacti = $GLOBALS['config']['base_path'];
-	$base  = sys_get_temp_dir() . '/npc-e2e-' . uniqid();
-	$npc   = $base . '/plugins/npc';
-
-	mkdir($npc, 0777, true);
-	mkdir($base . '/include', 0777, true);
-	copy(dirname(__DIR__, 2) . '/npc.php', $npc . '/npc.php');
-	copy(__DIR__ . '/support/front-controller-auth.php', $base . '/include/auth.php');
-
-	foreach (array('controllers', 'includes', 'nagioscmd.php', 'setup.php', 'INFO') as $entry) {
-		symlink(dirname(__DIR__, 2) . '/' . $entry, $npc . '/' . $entry);
-	}
-
-	$scenario = array_merge(array(
-		'method'     => 'GET',
-		'get'        => array(),
-		'post'       => array(),
-		'rows'       => array(),
-		'options'    => array('npc_config_type' => '1'),
-		'cacti_path' => $cacti,
-		'base_path'  => $base,
-		'log'        => $base . '/calls.log',
-	), $request);
-
-	if ($scenario['method'] === 'POST') {
-		$scenario['post'] = $scenario['post'] + $scenario['get'];
-	}
-
-	$process = proc_open(
-		array(PHP_BINARY, '-d', 'display_errors=stderr', 'npc.php'),
-		array(1 => array('pipe', 'w'), 2 => array('pipe', 'w')),
-		$pipes,
-		$npc,
-		array('NPC_E2E' => json_encode($scenario))
-	);
-
-	$stdout = stream_get_contents($pipes[1]);
-	$stderr = stream_get_contents($pipes[2]);
-	proc_close($process);
-
-	$calls = array();
-
-	if (is_file($scenario['log'])) {
-		foreach (array_filter(explode("\n", file_get_contents($scenario['log']))) as $line) {
-			$calls[] = json_decode($line, true);
-		}
-	}
-
-	return array('stdout' => $stdout, 'stderr' => $stderr, 'calls' => $calls, 'base' => $base);
-}
-
-function npc_e2e_calls(array $run, $kind) {
-	return array_values(array_filter($run['calls'], function ($call) use ($kind) {
-		return $call['kind'] === $kind;
-	}));
-}
+require_once __DIR__ . '/support/harness.php';
 
 it('serves the frame for a known tab', function () {
 	$run = npc_e2e_run(array('get' => array('module' => 'layout', 'action' => 'drawFrame', 'tab' => 'hosts')));
@@ -219,3 +156,9 @@ function npc_e2e_calls(array $run, $kind) {
 	'user settings lookup' => array('settings', 'getSettings'),
 	'address lookup'       => array('sync', 'checkHostExists'),
 ));
+
+it('does nothing when its stand-in auth file is requested without the test environment', function () {
+	$output = shell_exec('NPC_E2E= ' . escapeshellarg(PHP_BINARY) . ' -r \'putenv("NPC_E2E"); require $argv[1];\' ' . escapeshellarg(__DIR__ . '/support/front-controller-auth.php') . ' 2>&1');
+
+	expect((string) $output)->toBe('');
+});
diff --git a/tests/E2E/support/front-controller-auth.php b/tests/E2E/support/front-controller-auth.php
index 527ddcf..eea4375 100644
--- a/tests/E2E/support/front-controller-auth.php
+++ b/tests/E2E/support/front-controller-auth.php
@@ -18,6 +18,17 @@
  * the same JSON so the test can inspect what the plugin did.
  */
 
+/*
+ * Inert unless a test process started it: tests/ can end up in the web root,
+ * so a request for this file must do nothing. Every path below comes from the
+ * NPC_E2E environment variable the test sets, never from the request.
+ */
+if (PHP_SAPI !== 'cli' || getenv('NPC_E2E') === false) {
+	http_response_code(404);
+
+	exit;
+}
+
 $scenario = json_decode((string) getenv('NPC_E2E'), true);
 
 $config = array(
@@ -33,22 +44,31 @@
 /*
  * lib/functions.php cannot be loaded next to the stubs below, so the one
  * helper the front controller needs from it, the search string sanitizer, is
- * taken from the file source unchanged.
+ * copied unchanged into a private file in the sandbox and required from there.
  */
-$source = file_get_contents($scenario['cacti_path'] . '/lib/functions.php');
-$start  = strpos($source, 'function sanitize_search_string');
-$open   = strpos($source, '{', $start);
-$depth  = 0;
-
-for ($end = $open; $end < strlen($source); $end++) {
-	if ($source[$end] === '{') {
-		$depth++;
-	} elseif ($source[$end] === '}' && --$depth === 0) {
-		break;
+if (!function_exists('sanitize_search_string')) {
+	$source = file_get_contents($scenario['cacti_path'] . '/lib/functions.php');
+	$start  = strpos($source, 'function sanitize_search_string');
+	$open   = strpos($source, '{', $start);
+	$depth  = 0;
+
+	for ($end = $open; $end < strlen($source); $end++) {
+		if ($source[$end] === '{') {
+			$depth++;
+		} elseif ($source[$end] === '}' && --$depth === 0) {
+			break;
+		}
 	}
+
+	$extracted = tempnam($scenario['base_path'], 'san');
+	file_put_contents($extracted, "<?php\n" . substr($source, $start, $end - $start + 1) . "\n");
+	register_shutdown_function(function () use ($extracted) {
+		unlink($extracted);
+	});
+
+	require_once $extracted;
 }
 
-eval(substr($source, $start, $end - $start + 1));
 require_once $scenario['base_path'] . '/plugins/npc/setup.php';
 
 $_SERVER['REQUEST_METHOD'] = $scenario['method'];
@@ -60,6 +80,11 @@
 function npc_e2e_record($kind, $detail) {
 	global $scenario;
 
+	/* Only a plain file name inside the sandbox directory may be written. */
+	if (!preg_match('/^[a-z0-9._-]+$/', basename($scenario['log'])) || realpath(dirname($scenario['log'])) !== realpath($scenario['base_path'])) {
+		return;
+	}
+
 	file_put_contents($scenario['log'], json_encode(array('kind' => $kind) + $detail) . "\n", FILE_APPEND);
 }
 
diff --git a/tests/E2E/support/harness.php b/tests/E2E/support/harness.php
new file mode 100644
index 0000000..06c38fc
--- /dev/null
+++ b/tests/E2E/support/harness.php
@@ -0,0 +1,82 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Test helper: runs one of the plugin's entry scripts in a PHP subprocess
+ * against a sandbox tree. Only function definitions, so it does nothing if a
+ * web server is asked for it.
+ */
+
+if (!function_exists('npc_e2e_run')) {
+	/**
+	 * Run an entry script (npc.php by default) for one request.
+	 *
+	 * @param array $request method, get, post, rows (database fixtures),
+	 *                       options, and for the CLI scripts script and args
+	 *
+	 * @return array stdout, stderr, the recorded calls and the sandbox path
+	 */
+	function npc_e2e_run(array $request) {
+		$root   = dirname(__DIR__, 3);
+		$base   = sys_get_temp_dir() . '/npc-e2e-' . uniqid();
+		$npc    = $base . '/plugins/npc';
+		$script = isset($request['script']) ? $request['script'] : 'npc.php';
+		$args   = isset($request['args']) ? $request['args'] : array();
+
+		mkdir($npc, 0700, true);
+		mkdir($base . '/include', 0700, true);
+		copy($root . '/' . $script, $npc . '/' . $script);
+		copy(__DIR__ . '/front-controller-auth.php', $base . '/include/auth.php');
+		copy(__DIR__ . '/front-controller-auth.php', $base . '/include/cli_check.php');
+
+		foreach (array('controllers', 'includes', 'nagioscmd.php', 'setup.php', 'config.php', 'INFO') as $entry) {
+			symlink($root . '/' . $entry, $npc . '/' . $entry);
+		}
+
+		$scenario = array_merge(array(
+			'method'     => 'GET',
+			'get'        => array(),
+			'post'       => array(),
+			'rows'       => array(),
+			'options'    => array('npc_config_type' => '1'),
+			'cacti_path' => $GLOBALS['config']['base_path'],
+			'base_path'  => $base,
+			'log'        => $base . '/calls.log',
+		), $request);
+
+		if ($scenario['method'] === 'POST') {
+			$scenario['post'] = $scenario['post'] + $scenario['get'];
+		}
+
+		$process = proc_open(
+			array_merge(array(PHP_BINARY, '-d', 'display_errors=stderr', $script), $args),
+			array(1 => array('pipe', 'w'), 2 => array('file', $base . '/stderr.txt', 'w')),
+			$pipes,
+			$npc,
+			array('NPC_E2E' => json_encode($scenario))
+		);
+
+		$stdout = stream_get_contents($pipes[1]);
+		proc_close($process);
+
+		$calls = array();
+
+		if (is_file($scenario['log'])) {
+			foreach (array_filter(explode("\n", file_get_contents($scenario['log']))) as $line) {
+				$calls[] = json_decode($line, true);
+			}
+		}
+
+		return array('stdout' => $stdout, 'stderr' => (string) file_get_contents($base . '/stderr.txt'), 'calls' => $calls, 'base' => $base);
+	}
+
+	function npc_e2e_calls(array $run, $kind) {
+		return array_values(array_filter($run['calls'], function ($call) use ($kind) {
+			return $call['kind'] === $kind;
+		}));
+	}
+}
diff --git a/tests/bin/patch-coverage.php b/tests/bin/patch-coverage.php
index 13ebdce..d1fabc0 100644
--- a/tests/bin/patch-coverage.php
+++ b/tests/bin/patch-coverage.php
@@ -164,6 +164,11 @@ function changed_lines($base_ref) {
 	// top level, so it cannot be loaded into the isolated unit process. It runs
 	// as a subprocess in tests/E2E/FrontControllerTest.php instead.
 	'npc.php',
+	// Command line entry points for Cacti data input methods: they include
+	// cli_check.php and run at the top level. They run as subprocesses in
+	// tests/E2E/CliScriptsTest.php instead.
+	'perfdata.php',
+	'cli.php',
 	// Schema provisioning relocated verbatim from setup.php; only loaded from
 	// plugin_npc_install() at install time, not exercisable in the isolated
 	// unit process.

From ab820f14ec31d5e6bf75490a411123c0588b4ef2 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:12:07 -0600
Subject: [PATCH 20/41] fix: correct the contacts table upgrade and the deleted
 user settings cleanup

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                  |  3 ++
 setup.php                     |  8 ++---
 tests/Unit/NpcUpgradeTest.php | 55 ++++++++++++++++++++++++++++++++++-
 3 files changed, 61 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9ea9d0b..51783e8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 --- develop ---
 
+* issue: Add the minimum_importance column to npc_contacts on upgrade (the upgrade
+  named a table that does not exist) and remove the settings of deleted users
+  (the cleanup read a column the query does not return)
 * issue: Skip perfdata entries without a numeric value (label=U) in perfdata.php and
   cli.php instead of printing PHP warnings into the data input output
 * issue: Declare the hostgroup and unhandled request properties on the base
diff --git a/setup.php b/setup.php
index 5cc639b..0c44e25 100644
--- a/setup.php
+++ b/setup.php
@@ -383,8 +383,8 @@ function npc_config_settings() {
 
 			// Delete non existent users from npc_settings
 			for ($i = 0; $i < count($nUser); $i++) {
-				if (isset($nUser[$i]['id']) && !db_fetch_cell('SELECT id FROM user_auth WHERE id = ' . $nUser[$i]['id'])) {
-					db_execute('DELETE FROM npc_settings WHERE user_id = ' . $nUser[$i]['id']);
+				if (!db_fetch_cell_prepared('SELECT id FROM user_auth WHERE id = ?', array($nUser[$i]['user_id']))) {
+					db_execute_prepared('DELETE FROM npc_settings WHERE user_id = ?', array($nUser[$i]['user_id']));
 				}
 			}
 
@@ -505,8 +505,8 @@ function npc_upgrade_tables() {
 		db_execute("ALTER TABLE `npc_hosts` ADD COLUMN `importance` smallint(6) NOT NULL default '0' AFTER `z_3d`");
 	}
 
-	if (!db_column_exists('npc_contracts', 'minimum_importance')) {
-		db_execute("ALTER TABLE `npc_contracts` ADD COLUMN `minimum_importance` smallint(6) NOT NULL default '0' AFTER `notify_host_downtime`");
+	if (!db_column_exists('npc_contacts', 'minimum_importance')) {
+		db_execute("ALTER TABLE `npc_contacts` ADD COLUMN `minimum_importance` smallint(6) NOT NULL default '0' AFTER `notify_host_downtime`");
 	}
 }
 
diff --git a/tests/Unit/NpcUpgradeTest.php b/tests/Unit/NpcUpgradeTest.php
index d988167..ecd17ab 100644
--- a/tests/Unit/NpcUpgradeTest.php
+++ b/tests/Unit/NpcUpgradeTest.php
@@ -16,7 +16,8 @@
 });
 
 beforeEach(function () {
-	$GLOBALS['__test_db_calls'] = array();
+	$GLOBALS['__test_db_calls']   = array();
+	$GLOBALS['__test_db_results'] = array();
 	unset($GLOBALS['__test_db_fetch_cell']);
 });
 
@@ -48,3 +49,55 @@
 
 	expect($updates)->not->toBeEmpty();
 });
+
+it('adds the importance column to the contacts table on upgrade', function () {
+	npc_upgrade_tables();
+
+	$statements = array_column($GLOBALS['__test_db_calls'], 'sql');
+	$alters     = array_values(array_filter($statements, function ($sql) {
+		return strpos($sql, 'minimum_importance') !== false;
+	}));
+
+	expect($alters)->toHaveCount(1);
+	expect($alters[0])->toContain('ALTER TABLE `npc_contacts` ADD COLUMN `minimum_importance`');
+	expect(implode("\n", $statements))->not->toContain('npc_contracts');
+});
+
+it('creates settings for new users and removes the settings of deleted users', function () {
+	$_SESSION['sess_user_id']                                         = 1;
+	$GLOBALS['npc_default_settings']                                  = array('date_format' => 's:Y-m-d');
+	$GLOBALS['__test_db_results']['db_fetch_cell_prepared']['status'] = '1';
+	$GLOBALS['__test_db_results']['db_fetch_assoc']['FROM user_auth'] = array(array('id' => 5));
+	$GLOBALS['__test_db_results']['db_fetch_assoc']['FROM npc_settings'] = array(array('user_id' => 9));
+
+	npc_config_settings();
+
+	$calls = $GLOBALS['__test_db_calls'];
+
+	$insert = array_values(array_filter($calls, function ($call) {
+		return $call['fn'] === 'db_execute' && strpos($call['sql'], 'INSERT INTO npc_settings VALUES(5,') === 0;
+	}));
+	$delete = array_values(array_filter($calls, function ($call) {
+		return $call['fn'] === 'db_execute_prepared' && strpos($call['sql'], 'DELETE FROM npc_settings') === 0;
+	}));
+
+	expect($insert)->toHaveCount(1);
+	expect($delete)->toHaveCount(1);
+	expect($delete[0]['params'])->toBe(array(9));
+});
+
+it('keeps the settings of users that still exist', function () {
+	$_SESSION['sess_user_id']                                            = 1;
+	$GLOBALS['npc_default_settings']                                     = array();
+	$GLOBALS['__test_db_results']['db_fetch_cell_prepared']['status']    = '1';
+	$GLOBALS['__test_db_results']['db_fetch_cell_prepared']['FROM user_auth'] = 9;
+	$GLOBALS['__test_db_results']['db_fetch_assoc']['FROM npc_settings'] = array(array('user_id' => 9));
+
+	npc_config_settings();
+
+	$deletes = array_filter($GLOBALS['__test_db_calls'], function ($call) {
+		return strpos($call['sql'], 'DELETE FROM npc_settings') === 0;
+	});
+
+	expect($deletes)->toBe(array());
+});

From 28b07b73d3d1b155bed09c08d586e37daca141f4 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:13:14 -0600
Subject: [PATCH 21/41] docs: describe the NPC Global Commands realm

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md | 1 +
 README.md    | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 51783e8..8826a45 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 --- develop ---
 
+* issue: Document the NPC Global Commands realm that gates remote commands
 * issue: Add the minimum_importance column to npc_contacts on upgrade (the upgrade
   named a table that does not exist) and remove the settings of deleted users
   (the cleanup read a column the query does not return)
diff --git a/README.md b/README.md
index 2c00e0b..a0b1b6d 100644
--- a/README.md
+++ b/README.md
@@ -124,8 +124,9 @@ Next, there are a few NPC settings to add/update. Goto Console > Configuration >
 Settings > NPC.
 
 * **Remote Commands** - Check the checkbox to enable remote commands. At the
-  moment this is system wide so all users that can access NPC will be able to
-  execute commands.
+  moment this is system wide. A user also needs the "NPC Global Commands" realm
+  (granted in the user's Realm Permissions) to execute commands; the realm is
+  checked by name, so no page of that name exists in the plugin directory.
 
 * **Nagios Command File Path** - Add the path to the Nagios command file. It
   will be something like /usr/local/nagios/var/rw/nagios.cmd

From c0aa52276dd63fbe6338d8390e4ce5c0e8d71c57 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:15:40 -0600
Subject: [PATCH 22/41] fix: read the grid and summary responses in the front
 end

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                  |   3 +
 js/npc.js                     |  58 ++++++++++----
 tests/Unit/JsFrontEndTest.php |  24 ++++++
 tests/js/harness.js           | 147 ++++++++++++++++++++++++++++++++++
 tests/js/npc.test.js          |  98 +++++++++++++++++++++++
 5 files changed, 315 insertions(+), 15 deletions(-)
 create mode 100644 tests/Unit/JsFrontEndTest.php
 create mode 100644 tests/js/harness.js
 create mode 100644 tests/js/npc.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8826a45..941350b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 --- develop ---
 
+* issue: Show the host, service, comment and event log grids and the summary and
+  process tables; the front end read a response shape the controllers do not
+  send, so every table rendered empty
 * issue: Document the NPC Global Commands realm that gates remote commands
 * issue: Add the minimum_importance column to npc_contacts on upgrade (the upgrade
   named a table that does not exist) and remove the settings of deleted users
diff --git a/js/npc.js b/js/npc.js
index b5bf496..cb538a1 100644
--- a/js/npc.js
+++ b/js/npc.js
@@ -51,6 +51,32 @@ var npc = (function($) {
 		return div.innerHTML;
 	}
 
+	/* Rows of a list response. The grid controllers answer with
+	   {data: [...]} or with {response: {value: {items: [...]}}}. */
+	function rowsOf(data) {
+		if (data && Array.isArray(data.data)) {
+			return data.data;
+		}
+
+		if (data && data.response && data.response.value && Array.isArray(data.response.value.items)) {
+			return data.response.value.items;
+		}
+
+		return [];
+	}
+
+	/* The summary actions answer with one object of counts per state. */
+	function summaryRows(data) {
+		var counts = rowsOf(data)[0] || {};
+		var rows   = [];
+
+		Object.keys(counts).forEach(function(state) {
+			rows.push({label: state.charAt(0).toUpperCase() + state.slice(1), count: counts[state]});
+		});
+
+		return rows;
+	}
+
 	function stateLabel(val, map, classMap) {
 		var label = map[val] || 'Unknown';
 		var cls   = classMap[val] || '';
@@ -131,7 +157,7 @@ var npc = (function($) {
 
 	function loadHostSummary() {
 		npcGet({module: 'hosts', action: 'summary'}, function(data) {
-			var rows = (data.data) ? data.data : [];
+			var rows = summaryRows(data);
 			var html = buildTable('host-summary', 'Host Status Summary', [
 				{label: 'State', field: 'label'},
 				{label: 'Count', field: 'count'}
@@ -142,7 +168,7 @@ var npc = (function($) {
 
 	function loadServiceSummary() {
 		npcGet({module: 'services', action: 'summary'}, function(data) {
-			var rows = (data.data) ? data.data : [];
+			var rows = summaryRows(data);
 			var html = buildTable('svc-summary', 'Service Status Summary', [
 				{label: 'State', field: 'label'},
 				{label: 'Count', field: 'count'}
@@ -153,7 +179,7 @@ var npc = (function($) {
 
 	function loadHostProblems() {
 		npcGet({module: 'hosts', action: 'getHosts', p_state: 'not_ok'}, function(data) {
-			var rows = (data.data) ? data.data : [];
+			var rows = rowsOf(data);
 			var html = buildTable('host-problems', 'Host Problems', [
 				{label: 'Host', field: 'host_name'},
 				{label: 'State', field: 'current_state', render: function(v) { return stateLabel(v, hostStateMap, hostStateClass); }},
@@ -166,7 +192,7 @@ var npc = (function($) {
 
 	function loadServiceProblems() {
 		npcGet({module: 'services', action: 'getServices', p_state: 'not_ok'}, function(data) {
-			var rows = (data.data) ? data.data : [];
+			var rows = rowsOf(data);
 			var html = buildTable('svc-problems', 'Service Problems', [
 				{label: 'Host', field: 'host_name'},
 				{label: 'Service', field: 'service_description'},
@@ -207,7 +233,7 @@ var npc = (function($) {
 
 	function loadHostTable(filter) {
 		npcGet({module: 'hosts', action: 'getHosts', p_state: filter}, function(data) {
-			var rows = (data.data) ? data.data : [];
+			var rows = rowsOf(data);
 			var html = buildTable('hosts-grid', 'Hosts', [
 				{label: 'Host Name', field: 'host_name', render: function(v, row) {
 					return '<a href="#" class="npc-host-link" data-id="' + escHtml(row.host_object_id) + '">' + escHtml(v) + '</a>';
@@ -268,7 +294,7 @@ var npc = (function($) {
 
 	function loadServiceTable(filter) {
 		npcGet({module: 'services', action: 'getServices', p_state: filter}, function(data) {
-			var rows = (data.data) ? data.data : [];
+			var rows = rowsOf(data);
 			var html = buildTable('svc-grid', 'Services', [
 				{label: 'Host', field: 'host_name'},
 				{label: 'Service', field: 'service_description', render: function(v, row) {
@@ -304,7 +330,7 @@ var npc = (function($) {
 		$('#npc-content').html('<div id="npc-comments-table"></div>');
 
 		npcGet({module: 'comments', action: 'getHostComments'}, function(data) {
-			var rows = (data.data) ? data.data : [];
+			var rows = rowsOf(data);
 			var html = buildTable('host-comments', 'Host Comments', [
 				{label: 'Host', field: 'host_name'},
 				{label: 'Author', field: 'author_name'},
@@ -318,7 +344,7 @@ var npc = (function($) {
 			$('#npc-comments-table').html(html);
 
 			npcGet({module: 'comments', action: 'getServiceComments'}, function(sdata) {
-				var srows = (sdata.data) ? sdata.data : [];
+				var srows = rowsOf(sdata);
 				var shtml = buildTable('svc-comments', 'Service Comments', [
 					{label: 'Host', field: 'host_name'},
 					{label: 'Service', field: 'service_description'},
@@ -347,7 +373,7 @@ var npc = (function($) {
 		$('#npc-content').html('<div id="npc-downtime-table"></div>');
 
 		npcGet({module: 'downtime', action: 'getHostDowntime'}, function(data) {
-			var rows = (data.data) ? data.data : [];
+			var rows = rowsOf(data);
 			var html = buildTable('host-downtime', 'Host Downtime', [
 				{label: 'Host', field: 'host_name'},
 				{label: 'Author', field: 'author_name'},
@@ -360,7 +386,7 @@ var npc = (function($) {
 		});
 
 		npcGet({module: 'downtime', action: 'getServiceDowntime'}, function(data) {
-			var rows = (data.data) ? data.data : [];
+			var rows = rowsOf(data);
 			var html = buildTable('svc-downtime', 'Service Downtime', [
 				{label: 'Host', field: 'host_name'},
 				{label: 'Service', field: 'service_description'},
@@ -379,7 +405,7 @@ var npc = (function($) {
 		$('#npc-content').html('<div id="npc-eventlog-table"></div>');
 
 		npcGet({module: 'logentries', action: 'getLogs'}, function(data) {
-			var rows = (data.data) ? data.data : [];
+			var rows = rowsOf(data);
 			var html = buildTable('eventlog', 'Event Log', [
 				{label: 'Entry Time', field: 'entry_time'},
 				{label: 'Log Entry', field: 'logentry_data'}
@@ -396,9 +422,9 @@ var npc = (function($) {
 		$('#npc-content').html('<div id="npc-process-table"></div>');
 
 		npcGet({module: 'nagios', action: 'getProcessInfoGrid'}, function(data) {
-			var rows = (data.data) ? data.data : [];
+			var rows = rowsOf(data);
 			var html = buildTable('process-info', 'Nagios Process Information', [
-				{label: 'Property', field: 'key'},
+				{label: 'Property', field: 'name'},
 				{label: 'Value', field: 'value'}
 			], rows);
 			$('#npc-process-table').html(html);
@@ -409,7 +435,7 @@ var npc = (function($) {
 
 	function showHostDetail(hostObjectId) {
 		npcGet({module: 'hosts', action: 'getHosts', p_id: hostObjectId}, function(data) {
-			var rows = (data.data) ? data.data : [];
+			var rows = rowsOf(data);
 			if (rows.length === 0) {
 				return;
 			}
@@ -453,7 +479,7 @@ var npc = (function($) {
 
 	function showServiceDetail(svcObjectId) {
 		npcGet({module: 'services', action: 'getServices', p_id: svcObjectId}, function(data) {
-			var rows = (data.data) ? data.data : [];
+			var rows = rowsOf(data);
 			if (rows.length === 0) {
 				return;
 			}
@@ -632,6 +658,8 @@ var npc = (function($) {
 		npcGet: npcGet,
 		npcPost: npcPost,
 		showHostDetail: showHostDetail,
+		rowsOf: rowsOf,
+		summaryRows: summaryRows,
 		showServiceDetail: showServiceDetail
 	};
 
diff --git a/tests/Unit/JsFrontEndTest.php b/tests/Unit/JsFrontEndTest.php
new file mode 100644
index 0000000..bcbef3f
--- /dev/null
+++ b/tests/Unit/JsFrontEndTest.php
@@ -0,0 +1,24 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Runs the front end tests in tests/js with Node's built-in test runner. They
+ * load js/npc.js against a small stand-in for jQuery and the DOM.
+ */
+
+it('passes the js/npc.js tests', function () {
+	$output = array();
+	$status = 0;
+
+	exec('cd ' . escapeshellarg(dirname(__DIR__, 2)) . ' && node --test tests/js/npc.test.js 2>&1', $output, $status);
+
+	$report = implode("\n", $output);
+
+	expect($report)->toContain('# fail 0');
+	expect($report)->not->toContain('# tests 0');
+	expect($status)->toBe(0);
+})->skip(trim((string) shell_exec('command -v node')) === '', 'node is not installed');
diff --git a/tests/js/harness.js b/tests/js/harness.js
new file mode 100644
index 0000000..75e39b1
--- /dev/null
+++ b/tests/js/harness.js
@@ -0,0 +1,147 @@
+'use strict';
+
+/*
+ * Runs js/npc.js against a minimal stand-in for jQuery and the DOM, so the
+ * rendering code can be exercised without a browser. The stand-in records the
+ * HTML written to each selector, the requests sent, the dialogs opened and the
+ * event handlers registered.
+ *
+ * Text escaping follows what a browser does for a text node: & < > only, quotes
+ * stay as they are.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const vm = require('vm');
+
+const source = fs.readFileSync(path.join(__dirname, '../../js/npc.js'), 'utf8');
+
+function load(options) {
+	const opts = options || {};
+	const env = {
+		html: {},
+		requests: [],
+		dialogs: [],
+		handlers: {},
+		alerts: []
+	};
+	const ready = [];
+
+	function wrap(target) {
+		const sel = typeof target === 'string' ? target : null;
+		const obj = {
+			html(value) {
+				if (value === undefined) {
+					return env.html[sel] || '';
+				}
+				env.html[sel] = value;
+				return obj;
+			},
+			append(value) {
+				env.html[sel] = (env.html[sel] || '') + value;
+				return obj;
+			},
+			off() {
+				return obj;
+			},
+			on(event, a, b) {
+				env.handlers[(sel || 'element') + ' ' + event + ' ' + (typeof a === 'string' ? a : '')] = typeof a === 'function' ? a : b;
+				return obj;
+			},
+			val() {
+				return (opts.values || {})[sel];
+			},
+			data(name) {
+				return target && target.__data ? target.__data[name] : undefined;
+			},
+			find(selector) {
+				return wrap(selector);
+			},
+			each(fn) {
+				((opts.elements || {})[sel] || []).forEach(fn);
+				return obj;
+			},
+			toggle() {
+				return obj;
+			},
+			serializeArray() {
+				return (opts.forms || {})[sel] || [];
+			},
+			dialog(settings) {
+				if (typeof settings === 'object') {
+					env.dialogs.push({markup: target, settings});
+				}
+				return obj;
+			},
+			remove() {
+				return obj;
+			}
+		};
+		return obj;
+	}
+
+	function jq(target) {
+		if (typeof target === 'function') {
+			ready.push(target);
+			return undefined;
+		}
+		return wrap(target);
+	}
+
+	jq.getJSON = function(url, params, callback) {
+		env.requests.push({method: 'GET', params});
+		const key = params.module + '/' + params.action;
+		if (opts.responses && key in opts.responses) {
+			callback(opts.responses[key]);
+		}
+	};
+
+	jq.post = function(url, params, callback) {
+		env.requests.push({method: 'POST', params});
+		callback({success: true});
+	};
+
+	const context = {
+		jQuery: jq,
+		window: {
+			npcConfig: Object.assign({npcUrl: 'npc.php', csrfToken: 'token', userName: 'admin', portletRefresh: 60}, opts.config || {})
+		},
+		document: {
+			createElement() {
+				return {
+					appendChild(node) {
+						this.text = node.text;
+					},
+					get innerHTML() {
+						return String(this.text).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+					}
+				};
+			},
+			createTextNode(text) {
+				return {text};
+			}
+		},
+		setInterval() {
+			return 1;
+		},
+		clearInterval() {},
+		confirm() {
+			return true;
+		},
+		alert(message) {
+			env.alerts.push(message);
+		},
+		console
+	};
+
+	vm.createContext(context);
+	vm.runInContext(source, context);
+	env.npc = context.npc;
+	env.ready = function() {
+		ready.forEach((fn) => fn());
+	};
+
+	return env;
+}
+
+module.exports = {load};
diff --git a/tests/js/npc.test.js b/tests/js/npc.test.js
new file mode 100644
index 0000000..5a98f28
--- /dev/null
+++ b/tests/js/npc.test.js
@@ -0,0 +1,98 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert');
+const {load} = require('./harness');
+
+const hostRows = [{host_object_id: 10, host_name: 'web1', address: '192.0.2.10', current_state: 1, output: 'down', last_check: 'now'}];
+
+function gridResponse(rows) {
+	return {response: {value: {items: rows, total_count: rows.length, version: 1}}};
+}
+
+test('lists hosts from the grid response shape', () => {
+	const env = load({config: {currentTab: 'hosts'}, responses: {'hosts/getHosts': gridResponse(hostRows)}});
+
+	env.npc.route('hosts');
+
+	assert.match(env.html['#npc-host-table'], /web1/);
+	assert.match(env.html['#npc-host-table'], /192\.0\.2\.10/);
+});
+
+test('lists hosts from the data response shape', () => {
+	const env = load({responses: {'hosts/getHosts': {totalCount: 1, data: hostRows}}});
+
+	env.npc.route('hosts');
+
+	assert.match(env.html['#npc-host-table'], /web1/);
+});
+
+test('shows the empty message when a response has no rows', () => {
+	const env = load({responses: {'hosts/getHosts': gridResponse([])}});
+
+	env.npc.route('hosts');
+
+	assert.match(env.html['#npc-host-table'], /No records found/);
+});
+
+test('lists services, comments and log entries from the grid response shape', () => {
+	const env = load({responses: {
+		'services/getServices': gridResponse([{host_name: 'web1', service_description: 'Load', service_object_id: 3, current_state: 2, output: 'high'}]),
+		'comments/getHostComments': gridResponse([{host_name: 'web1', author_name: 'ann', comment_data: 'looking', comment_time: 't', is_persistent: 1, internal_comment_id: 4}]),
+		'comments/getServiceComments': gridResponse([{host_name: 'web1', service_description: 'Load', author_name: 'bob', comment_data: 'checked', comment_time: 't'}]),
+		'logentries/getLogs': gridResponse([{entry_time: 't', logentry_data: 'restart requested'}])
+	}});
+
+	env.npc.route('services');
+	assert.match(env.html['#npc-svc-table'], /Load/);
+
+	env.npc.route('comments');
+	assert.match(env.html['#npc-comments-table'], /looking/);
+	assert.match(env.html['#npc-comments-table'], /checked/);
+
+	env.npc.route('eventlog');
+	assert.match(env.html['#npc-eventlog-table'], /restart requested/);
+});
+
+test('renders the state counts of the host and service summaries', () => {
+	const env = load({responses: {
+		'hosts/summary': {totalCount: 1, data: [{down: 2, unreachable: 0, up: 9, pending: 1}]},
+		'services/summary': {totalCount: 1, data: [{critical: 3, warning: 4, unknown: 0, ok: 40, pending: 0}]},
+		'hosts/getHosts': gridResponse([]),
+		'services/getServices': gridResponse([])
+	}});
+
+	env.npc.route('dashboard');
+
+	const hosts = env.html['#npc-summary-row'];
+	assert.match(hosts, /<td class="">Down<\/td><td class="">2<\/td>/);
+	assert.match(hosts, /<td class="">Up<\/td><td class="">9<\/td>/);
+	assert.match(hosts, /<td class="">Critical<\/td><td class="">3<\/td>/);
+	assert.match(hosts, /<td class="">Ok<\/td><td class="">40<\/td>/);
+});
+
+test('shows the property names of the process information', () => {
+	const env = load({responses: {'nagios/getProcessInfoGrid': {totalCount: 2, data: [
+		{name: 'Nagios Version', value: '4.5'},
+		{name: 'Process ID', value: '321'}
+	]}}});
+
+	env.npc.route('process');
+
+	assert.match(env.html['#npc-process-table'], /<td class="">Nagios Version<\/td><td class="">4\.5<\/td>/);
+	assert.match(env.html['#npc-process-table'], /<td class="">Process ID<\/td><td class="">321<\/td>/);
+});
+
+/* Values built inside the vm context have that context's prototypes. */
+function plain(value) {
+	return JSON.parse(JSON.stringify(value));
+}
+
+test('rowsOf accepts either shape and nothing else', () => {
+	const env = load({});
+
+	assert.deepStrictEqual(plain(env.npc.rowsOf({data: [1]})), [1]);
+	assert.deepStrictEqual(plain(env.npc.rowsOf(gridResponse([2]))), [2]);
+	assert.deepStrictEqual(plain(env.npc.rowsOf({data: 'x'})), []);
+	assert.deepStrictEqual(plain(env.npc.rowsOf(null)), []);
+});

From fa6fc05eaec1d8d3534136afe1faaca21a9cf8bb Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:16:47 -0600
Subject: [PATCH 23/41] fix: escape quotes in attribute values written by the
 front end

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md         |  2 ++
 js/npc.js            | 37 ++++++++++++++++++++++---------------
 tests/js/npc.test.js | 38 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 62 insertions(+), 15 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 941350b..67e14c8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* security: Escape quotes in values the front end places inside HTML attributes
+  (host and service names, user name)
 * issue: Show the host, service, comment and event log grids and the summary and
   process tables; the front end read a response shape the controllers do not
   send, so every table rendered empty
diff --git a/js/npc.js b/js/npc.js
index cb538a1..5072071 100644
--- a/js/npc.js
+++ b/js/npc.js
@@ -51,6 +51,12 @@ var npc = (function($) {
 		return div.innerHTML;
 	}
 
+	/* escHtml leaves quotes alone, which is fine between tags but not inside an
+	   attribute value */
+	function escAttr(str) {
+		return escHtml(str).replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+	}
+
 	/* Rows of a list response. The grid controllers answer with
 	   {data: [...]} or with {response: {value: {items: [...]}}}. */
 	function rowsOf(data) {
@@ -236,14 +242,14 @@ var npc = (function($) {
 			var rows = rowsOf(data);
 			var html = buildTable('hosts-grid', 'Hosts', [
 				{label: 'Host Name', field: 'host_name', render: function(v, row) {
-					return '<a href="#" class="npc-host-link" data-id="' + escHtml(row.host_object_id) + '">' + escHtml(v) + '</a>';
+					return '<a href="#" class="npc-host-link" data-id="' + escAttr(row.host_object_id) + '">' + escHtml(v) + '</a>';
 				}},
 				{label: 'Address', field: 'address'},
 				{label: 'State', field: 'current_state', render: function(v) { return stateLabel(v, hostStateMap, hostStateClass); }},
 				{label: 'Output', field: 'output'},
 				{label: 'Last Check', field: 'last_check'},
 				{label: 'Actions', field: 'host_object_id', render: function(v, row) {
-					return '<a href="#" class="npc-cmd-link" data-host="' + escHtml(row.host_name) +
+					return '<a href="#" class="npc-cmd-link" data-host="' + escAttr(row.host_name) +
 						'" title="Commands">&#9881;</a>';
 				}}
 			], rows);
@@ -298,14 +304,14 @@ var npc = (function($) {
 			var html = buildTable('svc-grid', 'Services', [
 				{label: 'Host', field: 'host_name'},
 				{label: 'Service', field: 'service_description', render: function(v, row) {
-					return '<a href="#" class="npc-svc-link" data-id="' + escHtml(row.service_object_id) + '">' + escHtml(v) + '</a>';
+					return '<a href="#" class="npc-svc-link" data-id="' + escAttr(row.service_object_id) + '">' + escHtml(v) + '</a>';
 				}},
 				{label: 'State', field: 'current_state', render: function(v) { return stateLabel(v, svcStateMap, svcStateClass); }},
 				{label: 'Output', field: 'output'},
 				{label: 'Last Check', field: 'last_check'},
 				{label: 'Actions', field: 'service_object_id', render: function(v, row) {
-					return '<a href="#" class="npc-svc-cmd-link" data-host="' + escHtml(row.host_name) +
-						'" data-svc="' + escHtml(row.service_description) + '" title="Commands">&#9881;</a>';
+					return '<a href="#" class="npc-svc-cmd-link" data-host="' + escAttr(row.host_name) +
+						'" data-svc="' + escAttr(row.service_description) + '" title="Commands">&#9881;</a>';
 				}}
 			], rows);
 			$('#npc-svc-table').html(html);
@@ -338,7 +344,7 @@ var npc = (function($) {
 				{label: 'Entry Time', field: 'comment_time'},
 				{label: 'Persistent', field: 'is_persistent', render: function(v) { return v == 1 ? 'Yes' : 'No'; }},
 				{label: 'Actions', field: 'internal_comment_id', render: function(v) {
-					return '<a href="#" class="npc-del-comment" data-id="' + escHtml(v) + '" title="Delete">&#10005;</a>';
+					return '<a href="#" class="npc-del-comment" data-id="' + escAttr(v) + '" title="Delete">&#10005;</a>';
 				}}
 			], rows);
 			$('#npc-comments-table').html(html);
@@ -463,7 +469,7 @@ var npc = (function($) {
 			}
 			html += '</table>';
 
-			var $dlg = $('<div title="Host Detail: ' + escHtml(host.host_name) + '">' + html + '</div>');
+			var $dlg = $('<div title="Host Detail: ' + escAttr(host.host_name) + '">' + html + '</div>');
 			$dlg.dialog({
 				width: 600,
 				modal: true,
@@ -507,7 +513,7 @@ var npc = (function($) {
 			}
 			html += '</table>';
 
-			var $dlg = $('<div title="Service Detail: ' + escHtml(svc.service_description) + '">' + html + '</div>');
+			var $dlg = $('<div title="Service Detail: ' + escAttr(svc.service_description) + '">' + html + '</div>');
 			$dlg.dialog({
 				width: 600,
 				modal: true,
@@ -536,14 +542,14 @@ var npc = (function($) {
 			'<option value="DISABLE_HOST_NOTIFICATIONS">Disable Notifications</option>' +
 			'</select></td></tr>' +
 			'<tr><td><label>Host:</label></td>' +
-			'<td><input type="text" name="p_host_name" value="' + escHtml(hostName) + '" readonly class="ui-state-disabled" style="width:250px;"></td></tr>' +
+			'<td><input type="text" name="p_host_name" value="' + escAttr(hostName) + '" readonly class="ui-state-disabled" style="width:250px;"></td></tr>' +
 			'<tr><td><label for="npc-hcmd-author">Author:</label></td>' +
-			'<td><input type="text" id="npc-hcmd-author" name="p_author" value="' + escHtml(cfg.userName) + '" style="width:250px;"></td></tr>' +
+			'<td><input type="text" id="npc-hcmd-author" name="p_author" value="' + escAttr(cfg.userName) + '" style="width:250px;"></td></tr>' +
 			'<tr><td><label for="npc-hcmd-comment">Comment:</label></td>' +
 			'<td><textarea id="npc-hcmd-comment" name="p_comment" rows="3" style="width:250px;"></textarea></td></tr>' +
 			'</table></form>';
 
-		var $dlg = $('<div title="Host Command: ' + escHtml(hostName) + '">' + html + '</div>');
+		var $dlg = $('<div title="Host Command: ' + escAttr(hostName) + '">' + html + '</div>');
 		$dlg.dialog({
 			width: 500,
 			modal: true,
@@ -581,16 +587,16 @@ var npc = (function($) {
 			'<option value="DISABLE_SVC_NOTIFICATIONS">Disable Notifications</option>' +
 			'</select></td></tr>' +
 			'<tr><td><label>Host:</label></td>' +
-			'<td><input type="text" name="p_host_name" value="' + escHtml(hostName) + '" readonly class="ui-state-disabled" style="width:250px;"></td></tr>' +
+			'<td><input type="text" name="p_host_name" value="' + escAttr(hostName) + '" readonly class="ui-state-disabled" style="width:250px;"></td></tr>' +
 			'<tr><td><label>Service:</label></td>' +
-			'<td><input type="text" name="p_service_description" value="' + escHtml(svcDesc) + '" readonly class="ui-state-disabled" style="width:250px;"></td></tr>' +
+			'<td><input type="text" name="p_service_description" value="' + escAttr(svcDesc) + '" readonly class="ui-state-disabled" style="width:250px;"></td></tr>' +
 			'<tr><td><label for="npc-scmd-author">Author:</label></td>' +
-			'<td><input type="text" id="npc-scmd-author" name="p_author" value="' + escHtml(cfg.userName) + '" style="width:250px;"></td></tr>' +
+			'<td><input type="text" id="npc-scmd-author" name="p_author" value="' + escAttr(cfg.userName) + '" style="width:250px;"></td></tr>' +
 			'<tr><td><label for="npc-scmd-comment">Comment:</label></td>' +
 			'<td><textarea id="npc-scmd-comment" name="p_comment" rows="3" style="width:250px;"></textarea></td></tr>' +
 			'</table></form>';
 
-		var $dlg = $('<div title="Service Command: ' + escHtml(svcDesc) + '">' + html + '</div>');
+		var $dlg = $('<div title="Service Command: ' + escAttr(svcDesc) + '">' + html + '</div>');
 		$dlg.dialog({
 			width: 500,
 			modal: true,
@@ -660,6 +666,7 @@ var npc = (function($) {
 		showHostDetail: showHostDetail,
 		rowsOf: rowsOf,
 		summaryRows: summaryRows,
+		escAttr: escAttr,
 		showServiceDetail: showServiceDetail
 	};
 
diff --git a/tests/js/npc.test.js b/tests/js/npc.test.js
index 5a98f28..e2bf9bb 100644
--- a/tests/js/npc.test.js
+++ b/tests/js/npc.test.js
@@ -96,3 +96,41 @@ test('rowsOf accepts either shape and nothing else', () => {
 	assert.deepStrictEqual(plain(env.npc.rowsOf({data: 'x'})), []);
 	assert.deepStrictEqual(plain(env.npc.rowsOf(null)), []);
 });
+
+const quoted = 'a"b\'c';
+
+test('escapes quotes in values placed inside attributes', () => {
+	const env = load({});
+
+	assert.strictEqual(env.npc.escAttr(quoted), 'a&quot;b&#39;c');
+	assert.strictEqual(env.npc.escAttr('<b>&'), '&lt;b&gt;&amp;');
+});
+
+test('keeps a host name with quotes inside its attributes in the host grid', () => {
+	const rows = [{host_object_id: 10, host_name: quoted, address: 'x', current_state: 0, output: '', last_check: ''}];
+	const env  = load({responses: {'hosts/getHosts': gridResponse(rows)}});
+
+	env.npc.route('hosts');
+
+	assert.match(env.html['#npc-host-table'], /data-host="a&quot;b&#39;c"/);
+	assert.ok(!env.html['#npc-host-table'].includes('data-host="a"'));
+});
+
+test('keeps a service description with quotes inside its attributes in the service grid', () => {
+	const rows = [{host_name: 'web1', service_description: quoted, service_object_id: 3, current_state: 0, output: ''}];
+	const env  = load({responses: {'services/getServices': gridResponse(rows)}});
+
+	env.npc.route('services');
+
+	assert.match(env.html['#npc-svc-table'], /data-svc="a&quot;b&#39;c"/);
+});
+
+test('keeps the user name with quotes inside the value attribute of the command dialog', () => {
+	const rows = [{host_object_id: 10, host_name: 'web1', address: 'x', current_state: 0, output: '', last_check: ''}];
+	const env  = load({config: {userName: quoted}, responses: {'hosts/getHosts': gridResponse(rows)}});
+
+	env.npc.route('hosts');
+	env.handlers['#npc-host-table click .npc-cmd-link'].call({__data: {host: 'web1'}}, {preventDefault() {}});
+
+	assert.match(env.dialogs[0].markup, /name="p_author" value="a&quot;b&#39;c"/);
+});

From aae0e60bed9675f70a1444edbc354da3c2386dcb Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:17:53 -0600
Subject: [PATCH 24/41] fix: send the required values from the Nagios command
 dialogs

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md         |   4 ++
 js/npc.js            | 124 ++++++++++++++++++++++++++++++++++++-------
 tests/js/harness.js  |   9 ++--
 tests/js/npc.test.js | 119 +++++++++++++++++++++++++++++++++++++++++
 4 files changed, 235 insertions(+), 21 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 67e14c8..c901bf3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 --- develop ---
 
+* issue: Send the values Acknowledge, Add Comment, Schedule Downtime and Schedule
+  Check need from the host and service command dialogs; they were rejected for
+  missing parameters. Sticky, notify and persistent are options in the dialog and
+  a downtime takes a duration in minutes
 * security: Escape quotes in values the front end places inside HTML attributes
   (host and service names, user name)
 * issue: Show the host, service, comment and event log grids and the summary and
diff --git a/js/npc.js b/js/npc.js
index 5072071..7b107aa 100644
--- a/js/npc.js
+++ b/js/npc.js
@@ -527,6 +527,102 @@ var npc = (function($) {
 
 	/* --- command dialogs --- */
 
+	/* The Nagios commands the dialogs offer need more than a host, an author and a
+	   comment: which extra values depend on the kind of command. */
+	function commandKind(cmd) {
+		if (/^ACKNOWLEDGE_/.test(cmd)) {
+			return 'ack';
+		}
+
+		if (/^ADD_(HOST|SVC)_COMMENT$/.test(cmd)) {
+			return 'comment';
+		}
+
+		if (/^SCHEDULE_(HOST|SVC)_DOWNTIME$/.test(cmd)) {
+			return 'downtime';
+		}
+
+		if (/^SCHEDULE_(HOST|SVC)_CHECK$/.test(cmd)) {
+			return 'check';
+		}
+
+		return 'plain';
+	}
+
+	/* Completes the serialized dialog form with the values the command needs.
+	   A downtime starts now, is fixed, and is not triggered by another one. */
+	function buildCommandParams(form, now) {
+		var params = {};
+		var kind   = commandKind(form.p_command);
+
+		Object.keys(form).forEach(function(name) {
+			if (name !== 'duration_minutes' && !/^p_(sticky|notify|persistent)$/.test(name)) {
+				params[name] = form[name];
+			}
+		});
+
+		if (kind === 'ack') {
+			params.p_sticky     = form.p_sticky ? 1 : 0;
+			params.p_notify     = form.p_notify ? 1 : 0;
+			params.p_persistent = form.p_persistent ? 1 : 0;
+		} else if (kind === 'comment') {
+			params.p_persistent = form.p_persistent ? 1 : 0;
+		} else if (kind === 'downtime') {
+			var minutes = parseInt(form.duration_minutes, 10);
+			var seconds = (minutes > 0 ? minutes : 60) * 60;
+
+			params.p_start_time = now;
+			params.p_end_time   = now + seconds;
+			params.p_fixed      = 1;
+			params.p_trigger_id = 0;
+			params.p_duration   = seconds;
+		} else if (kind === 'check') {
+			params.p_check_time = now;
+		}
+
+		return params;
+	}
+
+	function commandOptionRows() {
+		return '<tr class="npc-opt" data-kinds="ack"><td>Options:</td>' +
+			'<td><label><input type="checkbox" name="p_sticky" value="1" checked> Sticky</label> ' +
+			'<label><input type="checkbox" name="p_notify" value="1" checked> Notify</label></td></tr>' +
+			'<tr class="npc-opt" data-kinds="ack comment"><td>Persistent:</td>' +
+			'<td><input type="checkbox" name="p_persistent" value="1"></td></tr>' +
+			'<tr class="npc-opt" data-kinds="downtime"><td><label>Minutes:</label></td>' +
+			'<td><input type="number" name="duration_minutes" value="60" min="1" style="width:80px;"></td></tr>';
+	}
+
+	function showCommandOptions($form) {
+		var kind = commandKind($form.find('select[name="p_command"]').val());
+
+		$form.find('.npc-opt').each(function() {
+			$(this).toggle((' ' + $(this).data('kinds') + ' ').indexOf(' ' + kind + ' ') !== -1);
+		});
+	}
+
+	function bindCommandOptions($form) {
+		$form.find('select[name="p_command"]').on('change', function() {
+			showCommandOptions($form);
+		});
+
+		showCommandOptions($form);
+	}
+
+	function submitCommand($form) {
+		var formData = {};
+
+		$form.serializeArray().forEach(function(item) {
+			formData[item.name] = item.value;
+		});
+
+		npcPost(buildCommandParams(formData, Math.floor(Date.now() / 1000)), function(resp) {
+			if (resp && !resp.success) {
+				alert(resp.msg || 'Command failed');
+			}
+		});
+	}
+
 	function showHostCommandDialog(hostName) {
 		var html = '<form id="npc-host-cmd-form">' +
 			'<input type="hidden" name="module" value="nagios">' +
@@ -547,6 +643,7 @@ var npc = (function($) {
 			'<td><input type="text" id="npc-hcmd-author" name="p_author" value="' + escAttr(cfg.userName) + '" style="width:250px;"></td></tr>' +
 			'<tr><td><label for="npc-hcmd-comment">Comment:</label></td>' +
 			'<td><textarea id="npc-hcmd-comment" name="p_comment" rows="3" style="width:250px;"></textarea></td></tr>' +
+			commandOptionRows() +
 			'</table></form>';
 
 		var $dlg = $('<div title="Host Command: ' + escAttr(hostName) + '">' + html + '</div>');
@@ -555,21 +652,15 @@ var npc = (function($) {
 			modal: true,
 			buttons: {
 				'Submit': function() {
-					var formData = {};
-					$('#npc-host-cmd-form').serializeArray().forEach(function(item) {
-						formData[item.name] = item.value;
-					});
-					npcPost(formData, function(resp) {
-						if (resp && !resp.success) {
-							alert(resp.msg || 'Command failed');
-						}
-					});
+					submitCommand($('#npc-host-cmd-form'));
 					$(this).dialog('close');
 				},
 				'Cancel': function() { $(this).dialog('close'); }
 			},
 			close: function() { $(this).remove(); }
 		});
+
+		bindCommandOptions($dlg.find('form'));
 	}
 
 	function showServiceCommandDialog(hostName, svcDesc) {
@@ -594,6 +685,7 @@ var npc = (function($) {
 			'<td><input type="text" id="npc-scmd-author" name="p_author" value="' + escAttr(cfg.userName) + '" style="width:250px;"></td></tr>' +
 			'<tr><td><label for="npc-scmd-comment">Comment:</label></td>' +
 			'<td><textarea id="npc-scmd-comment" name="p_comment" rows="3" style="width:250px;"></textarea></td></tr>' +
+			commandOptionRows() +
 			'</table></form>';
 
 		var $dlg = $('<div title="Service Command: ' + escAttr(svcDesc) + '">' + html + '</div>');
@@ -602,21 +694,15 @@ var npc = (function($) {
 			modal: true,
 			buttons: {
 				'Submit': function() {
-					var formData = {};
-					$('#npc-svc-cmd-form').serializeArray().forEach(function(item) {
-						formData[item.name] = item.value;
-					});
-					npcPost(formData, function(resp) {
-						if (resp && !resp.success) {
-							alert(resp.msg || 'Command failed');
-						}
-					});
+					submitCommand($('#npc-svc-cmd-form'));
 					$(this).dialog('close');
 				},
 				'Cancel': function() { $(this).dialog('close'); }
 			},
 			close: function() { $(this).remove(); }
 		});
+
+		bindCommandOptions($dlg.find('form'));
 	}
 
 	/* --- tab routing --- */
@@ -667,6 +753,8 @@ var npc = (function($) {
 		rowsOf: rowsOf,
 		summaryRows: summaryRows,
 		escAttr: escAttr,
+		commandKind: commandKind,
+		buildCommandParams: buildCommandParams,
 		showServiceDetail: showServiceDetail
 	};
 
diff --git a/tests/js/harness.js b/tests/js/harness.js
index 75e39b1..662bea3 100644
--- a/tests/js/harness.js
+++ b/tests/js/harness.js
@@ -58,10 +58,13 @@ function load(options) {
 				return wrap(selector);
 			},
 			each(fn) {
-				((opts.elements || {})[sel] || []).forEach(fn);
+				((opts.elements || {})[sel] || []).forEach((element, index) => fn.call(element, index, element));
 				return obj;
 			},
-			toggle() {
+			toggle(show) {
+				if (target && typeof target === 'object') {
+					target.__shown = show;
+				}
 				return obj;
 			},
 			serializeArray() {
@@ -98,7 +101,7 @@ function load(options) {
 
 	jq.post = function(url, params, callback) {
 		env.requests.push({method: 'POST', params});
-		callback({success: true});
+		callback(opts.postResponse || {success: true});
 	};
 
 	const context = {
diff --git a/tests/js/npc.test.js b/tests/js/npc.test.js
index e2bf9bb..f939bab 100644
--- a/tests/js/npc.test.js
+++ b/tests/js/npc.test.js
@@ -134,3 +134,122 @@ test('keeps the user name with quotes inside the value attribute of the command
 
 	assert.match(env.dialogs[0].markup, /name="p_author" value="a&quot;b&#39;c"/);
 });
+
+test('names the kind of each command the dialogs offer', () => {
+	const env = load({});
+	const kinds = {
+		ACKNOWLEDGE_HOST_PROBLEM: 'ack',
+		ACKNOWLEDGE_SVC_PROBLEM: 'ack',
+		ADD_HOST_COMMENT: 'comment',
+		ADD_SVC_COMMENT: 'comment',
+		SCHEDULE_HOST_DOWNTIME: 'downtime',
+		SCHEDULE_SVC_DOWNTIME: 'downtime',
+		SCHEDULE_HOST_CHECK: 'check',
+		SCHEDULE_SVC_CHECK: 'check',
+		ENABLE_HOST_NOTIFICATIONS: 'plain',
+		DISABLE_SVC_NOTIFICATIONS: 'plain'
+	};
+
+	Object.keys(kinds).forEach((cmd) => assert.strictEqual(env.npc.commandKind(cmd), kinds[cmd], cmd));
+});
+
+test('completes an acknowledgement with its flags', () => {
+	const env  = load({});
+	const base = {p_command: 'ACKNOWLEDGE_HOST_PROBLEM', p_host_name: 'web1', p_author: 'ann', p_comment: 'x'};
+
+	assert.deepStrictEqual(plain(env.npc.buildCommandParams(Object.assign({p_sticky: '1', p_notify: '1'}, base), 100)),
+		Object.assign({p_sticky: 1, p_notify: 1, p_persistent: 0}, base));
+	assert.deepStrictEqual(plain(env.npc.buildCommandParams(base, 100)),
+		Object.assign({p_sticky: 0, p_notify: 0, p_persistent: 0}, base));
+});
+
+test('completes a comment with its persistence flag', () => {
+	const env  = load({});
+	const base = {p_command: 'ADD_SVC_COMMENT', p_host_name: 'web1', p_service_description: 'Load', p_author: 'ann', p_comment: 'x'};
+
+	assert.strictEqual(env.npc.buildCommandParams(Object.assign({p_persistent: '1'}, base), 100).p_persistent, 1);
+	assert.strictEqual(env.npc.buildCommandParams(base, 100).p_persistent, 0);
+});
+
+test('completes a downtime with a fixed window starting now', () => {
+	const env    = load({});
+	const params = plain(env.npc.buildCommandParams({p_command: 'SCHEDULE_HOST_DOWNTIME', p_host_name: 'web1', duration_minutes: '30'}, 1000));
+
+	assert.deepStrictEqual(params, {
+		p_command: 'SCHEDULE_HOST_DOWNTIME',
+		p_host_name: 'web1',
+		p_start_time: 1000,
+		p_end_time: 2800,
+		p_fixed: 1,
+		p_trigger_id: 0,
+		p_duration: 1800
+	});
+	assert.strictEqual(env.npc.buildCommandParams({p_command: 'SCHEDULE_SVC_DOWNTIME', duration_minutes: ''}, 1000).p_duration, 3600);
+	assert.strictEqual(env.npc.buildCommandParams({p_command: 'SCHEDULE_SVC_DOWNTIME', duration_minutes: '-5'}, 1000).p_duration, 3600);
+});
+
+test('completes a check with the time to run it', () => {
+	const env = load({});
+
+	assert.strictEqual(env.npc.buildCommandParams({p_command: 'SCHEDULE_HOST_CHECK', p_host_name: 'web1'}, 1000).p_check_time, 1000);
+});
+
+test('leaves the other commands as the form sent them', () => {
+	const env  = load({});
+	const form = {p_command: 'ENABLE_HOST_NOTIFICATIONS', p_host_name: 'web1', p_sticky: '1'};
+
+	assert.deepStrictEqual(plain(env.npc.buildCommandParams(form, 1000)), {p_command: 'ENABLE_HOST_NOTIFICATIONS', p_host_name: 'web1'});
+});
+
+function openHostDialog(extra) {
+	const rows = [{host_object_id: 10, host_name: 'web1', address: 'x', current_state: 0, output: '', last_check: ''}];
+	const env  = load(Object.assign({responses: {'hosts/getHosts': gridResponse(rows)}}, extra));
+
+	env.npc.route('hosts');
+	env.handlers['#npc-host-table click .npc-cmd-link'].call({__data: {host: 'web1'}}, {preventDefault() {}});
+
+	return env;
+}
+
+test('sends the extra values when a host acknowledgement is submitted', () => {
+	const env = openHostDialog({forms: {'#npc-host-cmd-form': [
+		{name: 'module', value: 'nagios'},
+		{name: 'action', value: 'command'},
+		{name: 'p_command', value: 'ACKNOWLEDGE_HOST_PROBLEM'},
+		{name: 'p_host_name', value: 'web1'},
+		{name: 'p_author', value: 'admin'},
+		{name: 'p_comment', value: 'looking'},
+		{name: 'p_sticky', value: '1'}
+	]}});
+
+	env.dialogs[0].settings.buttons.Submit.call({dialog() {}});
+
+	const post = env.requests.filter((request) => request.method === 'POST')[0].params;
+	assert.strictEqual(post.p_sticky, 1);
+	assert.strictEqual(post.p_notify, 0);
+	assert.strictEqual(post.p_persistent, 0);
+	assert.strictEqual(post.module, 'nagios');
+	assert.strictEqual(post.action, 'command');
+});
+
+test('shows only the options that fit the selected command', () => {
+	const elements = [{__data: {kinds: 'ack'}}, {__data: {kinds: 'ack comment'}}, {__data: {kinds: 'downtime'}}];
+
+	openHostDialog({
+		values: {'select[name="p_command"]': 'ADD_HOST_COMMENT'},
+		elements: {'.npc-opt': elements}
+	});
+
+	assert.deepStrictEqual(elements.map((element) => element.__shown), [false, true, false]);
+});
+
+test('reports a failed command to the user', () => {
+	const env = openHostDialog({
+		postResponse: {success: false, msg: 'Missing required parameter: persistent'},
+		forms: {'#npc-host-cmd-form': [{name: 'p_command', value: 'ENABLE_HOST_NOTIFICATIONS'}]}
+	});
+
+	env.dialogs[0].settings.buttons.Submit.call({dialog() {}});
+
+	assert.deepStrictEqual(env.alerts, ['Missing required parameter: persistent']);
+});

From 8b19f56c3e675464fb7fac7999cbe818482cdad9 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:19:20 -0600
Subject: [PATCH 25/41] fix: write the LIMIT values of the listing queries as
 integers

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                      |  4 ++
 controllers/comments.php          |  5 +--
 controllers/controller.php        | 16 +++++++
 controllers/downtime.php          |  5 +--
 controllers/hosts.php             |  5 +--
 controllers/logentries.php        |  5 +--
 controllers/notifications.php     |  5 +--
 controllers/services.php          |  5 +--
 controllers/statehistory.php      |  7 +---
 tests/E2E/FrontControllerTest.php |  6 ++-
 tests/Unit/ListingLimitTest.php   | 69 +++++++++++++++++++++++++++++++
 11 files changed, 107 insertions(+), 25 deletions(-)
 create mode 100644 tests/Unit/ListingLimitTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c901bf3..d1283d9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 --- develop ---
 
+* issue: Write the LIMIT values of the host, service, comment, downtime, event log,
+  notification and state history listings into the statement as integers;
+  Cacti binds values as strings and the databases reject a quoted LIMIT, so these
+  listings failed with an SQL syntax error
 * issue: Send the values Acknowledge, Add Comment, Schedule Downtime and Schedule
   Check need from the host and service command dialogs; they were rejected for
   missing parameters. Sticky, notify and persistent are options in the dialog and
diff --git a/controllers/comments.php b/controllers/comments.php
index b9f7172..7f5543b 100644
--- a/controllers/comments.php
+++ b/controllers/comments.php
@@ -243,7 +243,6 @@ function comments($id = null, $where = '') {
             ' . $whereClause,
             $params);
 
-        $offset = ($this->currentPage - 1) * $this->limit;
 
         $results = db_fetch_assoc_prepared('SELECT i.instance_name,
                 o.name1 AS host_name,
@@ -260,8 +259,8 @@ function comments($id = null, $where = '') {
             LEFT JOIN npc_hosts h ON c.object_id = h.host_object_id
             ' . $whereClause . '
             ORDER BY ' . $orderBy . '
-            LIMIT ?, ?',
-            array_merge($params, array($offset, $this->limit)));
+            ' . $this->limitClause(),
+            $params);
 
         return($results);
     }
diff --git a/controllers/controller.php b/controllers/controller.php
index f009a62..57d67e0 100644
--- a/controllers/controller.php
+++ b/controllers/controller.php
@@ -269,6 +269,22 @@ function __construct() {
         $this->config_type = isset($config_type) ? $config_type : 1;
     }
 
+    /**
+     * limitClause
+     *
+     * The LIMIT clause for the current page. The values are written into the
+     * statement because Cacti's database layer sends bound values as strings,
+     * and MariaDB and MySQL reject a quoted LIMIT value.
+     *
+     * @return string  for example " LIMIT 0, 25"
+     */
+    function limitClause() {
+        $limit  = max(1, (int) $this->limit);
+        $offset = max(0, ((int) $this->currentPage - 1) * $limit);
+
+        return ' LIMIT ' . $offset . ', ' . $limit;
+    }
+
     function jsonOutput($results=array()) {
         if (!$this->numRecords) {
             $this->numRecords = count($results);
diff --git a/controllers/downtime.php b/controllers/downtime.php
index 6584d44..db859f8 100644
--- a/controllers/downtime.php
+++ b/controllers/downtime.php
@@ -181,7 +181,6 @@ function downtimeHistory($id = null, $where = '') {
             ' . $whereClause,
             $params);
 
-        $offset = ($this->currentPage - 1) * $this->limit;
 
         $results = db_fetch_assoc_prepared('SELECT i.instance_name,
                 o.name1 AS host_name,
@@ -192,8 +191,8 @@ function downtimeHistory($id = null, $where = '') {
             LEFT JOIN npc_instances i ON d.instance_id = i.instance_id
             ' . $whereClause . '
             ORDER BY d.scheduled_start_time DESC, d.actual_start_time DESC, d.actual_start_time_usec DESC
-            LIMIT ?, ?',
-            array_merge($params, array($offset, $this->limit)));
+            ' . $this->limitClause(),
+            $params);
 
         return($results);
     }
diff --git a/controllers/hosts.php b/controllers/hosts.php
index aa2da8c..5c1b1c1 100644
--- a/controllers/hosts.php
+++ b/controllers/hosts.php
@@ -158,7 +158,6 @@ function hosts() {
 			$params);
 
 		/* Paginated results */
-		$offset = ($this->currentPage - 1) * $this->limit;
 
 		$hosts = db_fetch_assoc_prepared(
 			'SELECT i.instance_name,
@@ -179,8 +178,8 @@ function hosts() {
 			LEFT JOIN npc_host_graphs hg ON hs.host_object_id = hg.host_object_id
 			WHERE ' . $where . '
 			ORDER BY ' . $orderBy . '
-			LIMIT ?, ?',
-			array_merge($params, array($offset, $this->limit)));
+			' . $this->limitClause(),
+			$params);
 
 		return $hosts;
 	}
diff --git a/controllers/logentries.php b/controllers/logentries.php
index 8cea191..08c55a6 100644
--- a/controllers/logentries.php
+++ b/controllers/logentries.php
@@ -52,15 +52,14 @@ function getLogs() {
             WHERE ' . $where,
             $params);
 
-        $offset = ($this->currentPage - 1) * $this->limit;
 
         $results = db_fetch_assoc_prepared('SELECT i.instance_name, l.*
             FROM npc_logentries l
             LEFT JOIN npc_instances i ON l.instance_id = i.instance_id
             WHERE ' . $where . '
             ORDER BY l.entry_time DESC, l.entry_time_usec DESC
-            LIMIT ?, ?',
-            array_merge($params, array($offset, $this->limit)));
+            ' . $this->limitClause(),
+            $params);
 
         $results = $this->flattenArray($results);
 
diff --git a/controllers/notifications.php b/controllers/notifications.php
index 095b09f..21287f1 100644
--- a/controllers/notifications.php
+++ b/controllers/notifications.php
@@ -50,7 +50,6 @@ function getNotifications() {
             WHERE ' . $where,
             $params);
 
-        $offset = ($this->currentPage - 1) * $this->limit;
 
         $results = db_fetch_assoc_prepared('SELECT i.instance_name,
                 o.name1 AS host_name,
@@ -61,8 +60,8 @@ function getNotifications() {
             LEFT JOIN npc_instances i ON n.instance_id = i.instance_id
             WHERE ' . $where . '
             ORDER BY n.start_time DESC, n.start_time_usec DESC
-            LIMIT ?, ?',
-            array_merge($params, array($offset, $this->limit)));
+            ' . $this->limitClause(),
+            $params);
 
         return($this->jsonOutput($results));
     }
diff --git a/controllers/services.php b/controllers/services.php
index b83d763..9671f8f 100644
--- a/controllers/services.php
+++ b/controllers/services.php
@@ -206,7 +206,6 @@ function services($id = null, $where = null) {
 			WHERE ' . $where,
 			$params);
 
-		$offset = ($this->currentPage - 1) * $this->limit;
 
 		$services = db_fetch_assoc_prepared(
 			'SELECT i.instance_name,
@@ -234,8 +233,8 @@ function services($id = null, $where = null) {
 			LEFT JOIN npc_service_graphs sg ON ss.service_object_id = sg.service_object_id
 			WHERE ' . $where . '
 			ORDER BY ' . $orderBy . '
-			LIMIT ?, ?',
-			array_merge($params, array($offset, $this->limit)));
+			' . $this->limitClause(),
+			$params);
 
 		return $services;
 	}
diff --git a/controllers/statehistory.php b/controllers/statehistory.php
index dcada7b..2d16d35 100644
--- a/controllers/statehistory.php
+++ b/controllers/statehistory.php
@@ -50,9 +50,6 @@ function getStateHistory() {
             WHERE ' . $where,
             $params);
 
-		$offset = (int) (($this->currentPage - 1) * $this->limit);
-		$limit  = (int) $this->limit;
-
         $results = db_fetch_assoc_prepared('SELECT i.instance_name,
                 o.name1 AS host_name,
                 o.name2 AS service_description,
@@ -62,8 +59,8 @@ function getStateHistory() {
             LEFT JOIN npc_instances i ON sh.instance_id = i.instance_id
             WHERE ' . $where . '
             ORDER BY sh.state_time DESC, sh.state_time_usec DESC
-            LIMIT ?, ?',
-			array_merge($params, array($offset, $limit)));
+            ' . $this->limitClause(),
+            $params);
 
         return($this->jsonOutput($results));
     }
diff --git a/tests/E2E/FrontControllerTest.php b/tests/E2E/FrontControllerTest.php
index 948fbab..92556a0 100644
--- a/tests/E2E/FrontControllerTest.php
+++ b/tests/E2E/FrontControllerTest.php
@@ -93,10 +93,12 @@
 	$run = npc_e2e_run(array('get' => array('module' => 'logentries', 'action' => 'getLogs') + $query));
 
 	$select = array_values(array_filter(npc_e2e_calls($run, 'db_fetch_assoc_prepared'), function ($call) {
-		return strpos($call['sql'], 'LIMIT ?, ?') !== false;
+		return strpos($call['sql'], 'LIMIT') !== false;
 	}));
 
-	expect(array_slice($select[0]['params'], -2))->toBe($expected);
+	preg_match('/LIMIT (\d+), (\d+)/', $select[0]['sql'], $limit);
+
+	expect(array((int) $limit[1], (int) $limit[2]))->toBe($expected);
 })->with(array(
 	'default page'     => array(array(), array(0, 25)),
 	'large limit'      => array(array('limit' => '100000'), array(0, 1000)),
diff --git a/tests/Unit/ListingLimitTest.php b/tests/Unit/ListingLimitTest.php
new file mode 100644
index 0000000..9a1aeb2
--- /dev/null
+++ b/tests/Unit/ListingLimitTest.php
@@ -0,0 +1,69 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Cacti's database layer sends bound values to MariaDB as strings, and a
+ * quoted LIMIT value is a syntax error. The listings therefore write the
+ * paging values into the statement as integers. tests/Integration/
+ * NpcDatabaseTest.php runs the same statements against MariaDB.
+ */
+
+beforeAll(function () {
+	npc_test_stub_cacti_includes();
+	require_once dirname(__DIR__, 2) . '/controllers/controller.php';
+
+	foreach (array('hosts', 'services', 'comments', 'downtime', 'logentries', 'notifications', 'statehistory') as $controller) {
+		npc_test_load(dirname(__DIR__, 2) . '/controllers/' . $controller . '.php');
+	}
+});
+
+beforeEach(function () {
+	$GLOBALS['__test_db_fetch_log'] = array();
+});
+
+it('builds the clause for the first and later pages', function () {
+	$controller = new Controller();
+
+	expect($controller->limitClause())->toBe(' LIMIT 0, 25');
+
+	$controller->limit       = 10;
+	$controller->currentPage = 3;
+	expect($controller->limitClause())->toBe(' LIMIT 20, 10');
+});
+
+it('keeps the clause numeric whatever the properties hold', function () {
+	$controller              = new Controller();
+	$controller->limit       = '7 OR 1';
+	$controller->currentPage = '2x';
+
+	expect($controller->limitClause())->toBe(' LIMIT 7, 7');
+
+	$controller->limit       = 0;
+	$controller->currentPage = -4;
+	expect($controller->limitClause())->toBe(' LIMIT 0, 1');
+});
+
+it('writes the paging values into every listing query', function (string $class, string $method) {
+	$controller = new $class();
+	$controller->$method();
+
+	$selects = array_values(array_filter($GLOBALS['__test_db_fetch_log'], function ($query) {
+		return strpos($query['sql'], 'COUNT(*)') === false;
+	}));
+
+	expect($selects)->not->toBe(array());
+	expect($selects[0]['sql'])->toMatch('/ LIMIT 0, 25$/');
+	expect($selects[0]['sql'])->not->toContain('LIMIT ?');
+})->with(array(
+	'hosts'         => array('NpcHostsController', 'hosts'),
+	'services'      => array('NpcServicesController', 'services'),
+	'comments'      => array('NpcCommentsController', 'comments'),
+	'downtime'      => array('NpcDowntimeController', 'downtimeHistory'),
+	'log entries'   => array('NpcLogentriesController', 'getLogs'),
+	'notifications' => array('NpcNotificationsController', 'getNotifications'),
+	'state history' => array('NpcStatehistoryController', 'getStateHistory'),
+));

From 3a954bd1b31b8c9fa25c92958e546efde07ba00a Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:20:57 -0600
Subject: [PATCH 26/41] test: run the schema and queries against MariaDB

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                          |   3 +
 tests/Integration/NpcDatabaseTest.php | 252 ++++++++++++++++++++++++++
 tests/bootstrap-unit.php              |  47 +++++
 3 files changed, 302 insertions(+)
 create mode 100644 tests/Integration/NpcDatabaseTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1283d9..db72a89 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 --- develop ---
 
+* dev: Run the schema and the listing, perfdata and upgrade queries against MariaDB
+  in the Pest suite, and run npc.php, perfdata.php and cli.php as subprocesses
+  (tests/E2E); the JavaScript front end is tested with Node's test runner
 * issue: Write the LIMIT values of the host, service, comment, downtime, event log,
   notification and state history listings into the statement as integers;
   Cacti binds values as strings and the databases reject a quoted LIMIT, so these
diff --git a/tests/Integration/NpcDatabaseTest.php b/tests/Integration/NpcDatabaseTest.php
new file mode 100644
index 0000000..e087364
--- /dev/null
+++ b/tests/Integration/NpcDatabaseTest.php
@@ -0,0 +1,252 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Runs the plugin's schema and queries against a real MariaDB or MySQL
+ * server. The fetch helpers of the unit bootstrap hand each statement to PDO
+ * the way Cacti's database layer does (default PDO settings, values passed to
+ * execute() as an array), so a statement that Cacti would send is a statement
+ * this test sends.
+ *
+ * The server comes from NPC_TEST_DB_HOST, NPC_TEST_DB_PORT, NPC_TEST_DB_NAME,
+ * NPC_TEST_DB_USER and NPC_TEST_DB_PASS, or else from the database settings in
+ * the include/config.php of the Cacti tree the plugin sits in. Without a
+ * reachable server the tests are skipped, except under CI, where that is an
+ * error.
+ */
+
+/**
+ * @return array|null host, port, name, user and password of the test database
+ */
+function npc_db_settings() {
+	if (getenv('NPC_TEST_DB_HOST') !== false) {
+		return array(
+			'host' => getenv('NPC_TEST_DB_HOST'),
+			'port' => getenv('NPC_TEST_DB_PORT') ?: '3306',
+			'name' => getenv('NPC_TEST_DB_NAME') ?: 'cacti',
+			'user' => getenv('NPC_TEST_DB_USER') ?: 'cactiuser',
+			'pass' => getenv('NPC_TEST_DB_PASS') !== false ? getenv('NPC_TEST_DB_PASS') : 'cactiuser',
+		);
+	}
+
+	$file = $GLOBALS['config']['base_path'] . '/include/config.php';
+
+	if (!is_readable($file)) {
+		return null;
+	}
+
+	$text     = (string) file_get_contents($file);
+	$settings = array();
+
+	foreach (array('host' => 'hostname', 'port' => 'port', 'name' => 'default', 'user' => 'username', 'pass' => 'password') as $key => $variable) {
+		if (preg_match('/^\s*\$database_' . $variable . '\s*=\s*[\'"]([^\'"]*)[\'"]/m', $text, $match)) {
+			$settings[$key] = $match[1];
+		}
+	}
+
+	return isset($settings['host'], $settings['name'], $settings['user']) ? $settings + array('port' => '3306', 'pass' => '') : null;
+}
+
+function npc_db_connect() {
+	$settings = npc_db_settings();
+
+	if ($settings === null) {
+		return null;
+	}
+
+	try {
+		$pdo = new PDO(
+			'mysql:host=' . $settings['host'] . ';port=' . $settings['port'] . ';dbname=' . $settings['name'] . ';charset=utf8',
+			$settings['user'],
+			$settings['pass'],
+			array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::ATTR_TIMEOUT => 2)
+		);
+	} catch (PDOException $e) {
+		return null;
+	}
+
+	/* Cacti runs its sessions without the strict modes. */
+	$pdo->exec("SET SESSION sql_mode = 'NO_ENGINE_SUBSTITUTION'");
+
+	return $pdo;
+}
+
+function npc_db_insert($pdo, $table, array $row) {
+	$columns = '`' . implode('`, `', array_keys($row)) . '`';
+	$marks   = implode(', ', array_fill(0, count($row), '?'));
+
+	$pdo->prepare('INSERT INTO `' . $table . '` (' . $columns . ') VALUES (' . $marks . ')')->execute(array_values($row));
+}
+
+beforeAll(function () {
+	require_once dirname(__DIR__, 2) . '/setup.php';
+	npc_test_stub_cacti_includes();
+	require_once dirname(__DIR__, 2) . '/controllers/controller.php';
+
+	foreach (array('hosts', 'services', 'comments', 'downtime', 'logentries', 'notifications', 'statehistory') as $controller) {
+		npc_test_load(dirname(__DIR__, 2) . '/controllers/' . $controller . '.php');
+	}
+
+	$GLOBALS['npc_db'] = npc_db_connect();
+
+	if ($GLOBALS['npc_db'] === null) {
+		return;
+	}
+
+	/* Create the tables from the SQL the installer issues. */
+	$stub = sys_get_temp_dir() . '/npc-test-lib-stub';
+
+	if (!is_dir($stub)) {
+		mkdir($stub, 0777, true);
+	}
+
+	file_put_contents($stub . '/database.php', "<?php\n");
+	$GLOBALS['config']['library_path'] = $stub;
+	$GLOBALS['__test_db_calls']        = array();
+	$GLOBALS['__test_pdo']             = null;
+	unset($GLOBALS['__test_pdo']);
+
+	npc_setup_tables();
+
+	foreach ($GLOBALS['__test_db_calls'] as $call) {
+		if (strpos($call['sql'], 'CREATE TABLE `') === 0) {
+			$GLOBALS['npc_db']->exec(preg_replace('/^CREATE TABLE /', 'CREATE TABLE IF NOT EXISTS ', $call['sql']));
+		}
+	}
+});
+
+beforeEach(function () {
+	if ($GLOBALS['npc_db'] === null) {
+		if (getenv('CI') === 'true') {
+			throw new RuntimeException('The integration database is not reachable.');
+		}
+
+		$this->markTestSkipped('No test database is reachable.');
+	}
+
+	$GLOBALS['__test_pdo']          = $GLOBALS['npc_db'];
+	$GLOBALS['__test_config']       = array('npc_config_type' => '1');
+	$GLOBALS['__test_db_calls']     = array();
+	$GLOBALS['__test_db_fetch_log'] = array();
+	$GLOBALS['npc_db']->beginTransaction();
+});
+
+afterEach(function () {
+	unset($GLOBALS['__test_pdo']);
+	$GLOBALS['__test_config'] = array();
+
+	if ($GLOBALS['npc_db'] !== null && $GLOBALS['npc_db']->inTransaction()) {
+		$GLOBALS['npc_db']->rollBack();
+	}
+});
+
+it('creates every table of the schema', function () {
+	preg_match_all('/CREATE TABLE `(npc_\w+)`/', file_get_contents(dirname(__DIR__, 2) . '/includes/database.php'), $declared);
+
+	$present = $GLOBALS['npc_db']->query("SHOW TABLES LIKE 'npc\\_%'")->fetchAll(PDO::FETCH_COLUMN);
+
+	expect(count($declared[1]))->toBeGreaterThan(50);
+	expect(array_diff($declared[1], $present))->toBe(array());
+});
+
+it('is rejected by the server when the paging values are bound the way Cacti binds them', function () {
+	$statement = $GLOBALS['npc_db']->prepare('SELECT 1 FROM npc_logentries LIMIT ?, ?');
+
+	expect(fn () => $statement->execute(array(0, 25)))->toThrow(PDOException::class);
+});
+
+it('runs every listing query against the server', function (string $class, string $method) {
+	$controller = new $class();
+	$rows       = $controller->$method();
+
+	expect(is_array($rows) || is_string($rows))->toBeTrue();
+})->with(array(
+	'hosts'         => array('NpcHostsController', 'hosts'),
+	'services'      => array('NpcServicesController', 'services'),
+	'comments'      => array('NpcCommentsController', 'comments'),
+	'downtime'      => array('NpcDowntimeController', 'downtimeHistory'),
+	'log entries'   => array('NpcLogentriesController', 'getLogs'),
+	'notifications' => array('NpcNotificationsController', 'getNotifications'),
+	'state history' => array('NpcStatehistoryController', 'getStateHistory'),
+));
+
+it('pages through a listing', function () {
+	$pdo = $GLOBALS['npc_db'];
+
+	for ($i = 1; $i <= 7; $i++) {
+		npc_db_insert($pdo, 'npc_logentries', array('instance_id' => 99, 'logentry_time' => '2026-01-01 00:00:0' . $i, 'entry_time' => '2026-01-01 00:00:0' . $i, 'logentry_data' => 'entry ' . $i));
+	}
+
+	$controller              = new NpcLogentriesController();
+	$controller->limit       = 3;
+	$controller->currentPage = 3;
+
+	$page = json_decode($controller->getLogs(), true)['response']['value'];
+
+	expect(array_column($page['items'], 'logentry_data'))->toBe(array('entry 1'));
+	expect((int) $page['total_count'])->toBeGreaterThanOrEqual(7);
+});
+
+it('lists each service once however many hostgroups its host belongs to', function () {
+	$pdo = $GLOBALS['npc_db'];
+
+	npc_db_insert($pdo, 'npc_instances', array('instance_id' => 99, 'instance_name' => 'default'));
+	npc_db_insert($pdo, 'npc_objects', array('object_id' => 9100, 'instance_id' => 99, 'objecttype_id' => 1, 'name1' => 'web1'));
+
+	foreach (array(9101 => 'Load', 9102 => 'Disk') as $id => $description) {
+		npc_db_insert($pdo, 'npc_objects', array('object_id' => $id, 'instance_id' => 99, 'objecttype_id' => 2, 'name1' => 'web1', 'name2' => $description));
+		npc_db_insert($pdo, 'npc_services', array('instance_id' => 99, 'config_type' => 1, 'host_object_id' => 9100, 'service_object_id' => $id));
+		npc_db_insert($pdo, 'npc_servicestatus', array('instance_id' => 99, 'service_object_id' => $id, 'current_state' => 0));
+	}
+
+	npc_db_insert($pdo, 'npc_hosts', array('instance_id' => 99, 'config_type' => 1, 'host_object_id' => 9100, 'alias' => 'web1'));
+
+	foreach (array(9201 => 'web servers', 9202 => 'linux servers') as $object_id => $alias) {
+		npc_db_insert($pdo, 'npc_hostgroups', array('hostgroup_id' => $object_id, 'instance_id' => 99, 'config_type' => 1, 'hostgroup_object_id' => $object_id, 'alias' => $alias));
+		npc_db_insert($pdo, 'npc_hostgroup_members', array('instance_id' => 99, 'hostgroup_id' => $object_id, 'host_object_id' => 9100));
+	}
+
+	$services = new NpcServicesController();
+	$rows     = $services->services();
+
+	expect(array_column($rows, 'service_description'))->toBe(array('Disk', 'Load'));
+	expect((int) $services->numRecords)->toBe(2);
+
+	$filtered            = new NpcServicesController();
+	$filtered->hostgroup = 'web servers';
+
+	expect(array_column($filtered->services(), 'service_description'))->toBe(array('Disk', 'Load'));
+	expect((int) $filtered->numRecords)->toBe(2);
+});
+
+it('returns only the newest stored check as host perfdata', function () {
+	$pdo = $GLOBALS['npc_db'];
+
+	foreach (array('2026-01-01 00:00:01' => 'old=1', '2026-01-01 00:00:02' => 'mid=2', '2026-01-01 00:00:03' => 'new=3') as $time => $perfdata) {
+		npc_db_insert($pdo, 'npc_hostchecks', array('instance_id' => 99, 'host_object_id' => 9100, 'start_time' => $time, 'perfdata' => $perfdata));
+	}
+
+	$rows = (new NpcHostsController())->getPerfData(9100);
+
+	expect($rows)->toBe(array(array('perfdata' => 'new=3')));
+});
+
+it('adds the importance column to the contacts table on upgrade', function () {
+	$pdo = $GLOBALS['npc_db'];
+
+	if ($pdo->inTransaction()) {
+		$pdo->rollBack();
+	}
+
+	if (db_column_exists('npc_contacts', 'minimum_importance')) {
+		$pdo->exec('ALTER TABLE `npc_contacts` DROP COLUMN `minimum_importance`');
+	}
+
+	npc_upgrade_tables();
+
+	expect(db_column_exists('npc_contacts', 'minimum_importance'))->toBeTrue();
+});
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index 16dc0dd..4644349 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -93,6 +93,10 @@
 function npc_test_db_result($fn, $sql, $params, $default) {
 	$GLOBALS['__test_db_fetch_log'][] = array('fn' => $fn, 'sql' => $sql, 'params' => $params);
 
+	if (isset($GLOBALS['__test_pdo'])) {
+		return npc_test_pdo_fetch($GLOBALS['__test_pdo'], $fn, $sql, $params);
+	}
+
 	foreach (($GLOBALS['__test_db_results'][$fn] ?? array()) as $match => $result) {
 		if (strpos($sql, (string) $match) !== false) {
 			return $result;
@@ -102,6 +106,31 @@ function npc_test_db_result($fn, $sql, $params, $default) {
 	return $default;
 }
 
+/**
+ * Run a fetch against a real connection, the way Cacti's database layer does:
+ * the statement is prepared with PDO's defaults and the values are handed to
+ * execute() as an array, so every value reaches the server as a string.
+ * Integration tests set $GLOBALS['__test_pdo'] to turn this on.
+ */
+function npc_test_pdo_fetch($pdo, $fn, $sql, $params) {
+	$statement = $pdo->prepare($sql);
+	$statement->execute(array_values($params));
+
+	if (strpos($fn, 'assoc') !== false) {
+		return $statement->fetchAll(PDO::FETCH_ASSOC);
+	}
+
+	if (strpos($fn, 'row') !== false) {
+		$row = $statement->fetch(PDO::FETCH_ASSOC);
+
+		return $row === false ? array() : $row;
+	}
+
+	$value = $statement->fetchColumn();
+
+	return $value === false ? '' : $value;
+}
+
 /**
  * Make require_once('include/auth.php') resolve to an empty stub, ahead of
  * the real Cacti file that the working directory would otherwise supply.
@@ -132,6 +161,11 @@ function get_md5_include_css($path) {
 if (!function_exists('db_execute')) {
 	function db_execute($sql) {
 		$GLOBALS['__test_db_calls'][] = array('fn' => 'db_execute', 'sql' => $sql, 'params' => array());
+
+		if (isset($GLOBALS['__test_pdo'])) {
+			$GLOBALS['__test_pdo']->exec($sql);
+		}
+
 		return true;
 	}
 }
@@ -139,6 +173,11 @@ function db_execute($sql) {
 if (!function_exists('db_execute_prepared')) {
 	function db_execute_prepared($sql, $params = array()) {
 		$GLOBALS['__test_db_calls'][] = array('fn' => 'db_execute_prepared', 'sql' => $sql, 'params' => $params);
+
+		if (isset($GLOBALS['__test_pdo'])) {
+			$GLOBALS['__test_pdo']->prepare($sql)->execute(array_values($params));
+		}
+
 		return true;
 	}
 }
@@ -187,12 +226,20 @@ function db_index_exists($table, $index) {
 
 if (!function_exists('db_column_exists')) {
 	function db_column_exists($table, $column) {
+		if (isset($GLOBALS['__test_pdo'])) {
+			return $GLOBALS['__test_pdo']->query('SHOW COLUMNS FROM `' . $table . "` LIKE '" . $column . "'")->rowCount() > 0;
+		}
+
 		return false;
 	}
 }
 
 if (!function_exists('db_table_exists')) {
 	function db_table_exists($table) {
+		if (isset($GLOBALS['__test_pdo'])) {
+			return $GLOBALS['__test_pdo']->query("SHOW TABLES LIKE '" . $table . "'")->rowCount() > 0;
+		}
+
 		return false;
 	}
 }

From ada16c55531aefa9c7f007e38a5cf9d9f3396e44 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 22:22:03 -0600
Subject: [PATCH 27/41] chore: refresh the translation template

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 locales/po/cacti.pot | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index 6e9b742..a760342 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -8,15 +8,19 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti \n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-09-28 16:07-0400\n"
+"POT-Creation-Date: 2026-10-23 22:20-0600\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"Last-Translator: Cacti Developers <developers@cacti.net>>\n"
+"Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
 "Language: \n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 
+#: controllers/cacti.php
+msgid "You do not have permission to create data input methods."
+msgstr ""
+
 #: controllers/cacti.php setup.php
 msgid "None"
 msgstr ""
@@ -67,15 +71,15 @@ msgid "Process Info"
 msgstr ""
 
 #: controllers/nagios.php
-msgid "Remote Commands must be enabled under console->Settings->NPC"
+msgid "You do not have permission to execute this command."
 msgstr ""
 
 #: controllers/nagios.php
-msgid "The Nagios Command File Path must be set under console->Settings->NPC"
+msgid "Remote Commands must be enabled under console->Settings->NPC"
 msgstr ""
 
 #: controllers/nagios.php
-msgid "You do not have permission to execute this command."
+msgid "The Nagios Command File Path must be set under console->Settings->NPC"
 msgstr ""
 
 #: controllers/nagios.php
@@ -106,6 +110,10 @@ msgstr ""
 msgid "Invalid action requested."
 msgstr ""
 
+#: npc.php
+msgid "This action requires a POST request."
+msgstr ""
+
 #: npc.php
 msgid "Controller not found."
 msgstr ""

From 7f8cdd07a665b667ee9ebd12c7cbb7dfb872794f Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 23:29:58 -0600
Subject: [PATCH 28/41] test: give the Cacti function stubs their real
 signatures

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 tests/E2E/support/front-controller-auth.php | 36 ++++++------
 tests/Unit/NpcFormAndNavigationTest.php     |  2 +-
 tests/bootstrap-unit.php                    | 62 ++++++++++-----------
 3 files changed, 50 insertions(+), 50 deletions(-)

diff --git a/tests/E2E/support/front-controller-auth.php b/tests/E2E/support/front-controller-auth.php
index eea4375..0c703ae 100644
--- a/tests/E2E/support/front-controller-auth.php
+++ b/tests/E2E/support/front-controller-auth.php
@@ -102,50 +102,50 @@ function npc_e2e_rows($fn, $sql, $params, $default) {
 	return $default;
 }
 
-function db_fetch_assoc($sql) {
+function db_fetch_assoc($sql, $log = true, $db_conn = false) {
 	return npc_e2e_rows(__FUNCTION__, $sql, array(), array());
 }
 
-function db_fetch_assoc_prepared($sql, $params = array()) {
+function db_fetch_assoc_prepared($sql, $params = array(), $log = true, $db_conn = false) {
 	return npc_e2e_rows(__FUNCTION__, $sql, $params, array());
 }
 
-function db_fetch_row_prepared($sql, $params = array()) {
+function db_fetch_row_prepared($sql, $params = array(), $log = true, $db_conn = false) {
 	return npc_e2e_rows(__FUNCTION__, $sql, $params, array());
 }
 
-function db_fetch_cell($sql) {
+function db_fetch_cell($sql, $col_name = '', $log = true, $db_conn = false) {
 	return npc_e2e_rows(__FUNCTION__, $sql, array(), '');
 }
 
-function db_fetch_cell_prepared($sql, $params = array()) {
+function db_fetch_cell_prepared($sql, $params = array(), $col_name = '', $log = true, $db_conn = false) {
 	return npc_e2e_rows(__FUNCTION__, $sql, $params, '');
 }
 
-function db_execute_prepared($sql, $params = array()) {
+function db_execute_prepared($sql, $params = array(), $log = true, $db_conn = false, $execute_name = 'Exec', $default_value = true) {
 	npc_e2e_record(__FUNCTION__, array('sql' => $sql, 'params' => $params));
 
 	return true;
 }
 
-function sql_save($array, $table, $key = 'id') {
-	npc_e2e_record(__FUNCTION__, array('table' => $table, 'row' => $array));
+function sql_save($array_items, $table_name, $key_cols = 'id', $autoinc = true, $db_conn = false) {
+	npc_e2e_record(__FUNCTION__, array('table' => $table_name, 'row' => $array_items));
 
 	return 1;
 }
 
-function read_config_option($name, $force = false) {
+function read_config_option($config_name, $force = false) {
 	global $scenario;
 
-	return $scenario['options'][$name] ?? '';
+	return $scenario['options'][$config_name] ?? '';
 }
 
-function cacti_log($message, $also_print = false, $log_type = '', $level = 0) {
-	npc_e2e_record('cacti_log', array('message' => $message));
+function cacti_log($string, $output = false, $environ = 'CMDPHP', $level = '') {
+	npc_e2e_record('cacti_log', array('message' => $string));
 }
 
-function raise_message($id, $text = '', $level = 0) {
-	npc_e2e_record('raise_message', array('id' => $id));
+function raise_message($message_id, $message = '', $message_level = 0) {
+	npc_e2e_record('raise_message', array('id' => $message_id));
 }
 
 function api_user_realm_auth($filename = '') {
@@ -164,7 +164,7 @@ function cacti_count($array) {
 	return is_array($array) ? count($array) : 0;
 }
 
-function cacti_escapeshellarg($string) {
+function cacti_escapeshellarg($string, $quote = true) {
 	return escapeshellarg($string);
 }
 
@@ -186,12 +186,12 @@ function general_header() {
 function bottom_footer() {
 }
 
-function html_start_box() {
+function html_start_box($title, $width, $div, $cell_padding, $align, $add_text, $add_label = false) {
 }
 
-function html_end_box() {
+function html_end_box($trailing_br = true, $div = false) {
 }
 
-function get_md5_include_js($path) {
+function get_md5_include_js($path, $async = false) {
 	return "<script src='" . $path . "'></script>";
 }
diff --git a/tests/Unit/NpcFormAndNavigationTest.php b/tests/Unit/NpcFormAndNavigationTest.php
index c55a8d2..f5c98f5 100644
--- a/tests/Unit/NpcFormAndNavigationTest.php
+++ b/tests/Unit/NpcFormAndNavigationTest.php
@@ -49,7 +49,7 @@
 
 	$_POST['npc_host_object_id'] = '42';
 	$save = npc_api_device_save(array('id' => 1));
-	expect($save['npc_host_object_id'])->toBe('42');
+	expect($save['npc_host_object_id'])->toBe(42);
 });
 
 it('prints no meaningful header output', function () {
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index 4644349..a58e535 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -159,7 +159,7 @@ function get_md5_include_css($path) {
 }
 
 if (!function_exists('db_execute')) {
-	function db_execute($sql) {
+	function db_execute($sql, $log = true, $db_conn = false) {
 		$GLOBALS['__test_db_calls'][] = array('fn' => 'db_execute', 'sql' => $sql, 'params' => array());
 
 		if (isset($GLOBALS['__test_pdo'])) {
@@ -171,7 +171,7 @@ function db_execute($sql) {
 }
 
 if (!function_exists('db_execute_prepared')) {
-	function db_execute_prepared($sql, $params = array()) {
+	function db_execute_prepared($sql, $params = array(), $log = true, $db_conn = false, $execute_name = 'Exec', $default_value = true) {
 		$GLOBALS['__test_db_calls'][] = array('fn' => 'db_execute_prepared', 'sql' => $sql, 'params' => $params);
 
 		if (isset($GLOBALS['__test_pdo'])) {
@@ -183,49 +183,49 @@ function db_execute_prepared($sql, $params = array()) {
 }
 
 if (!function_exists('db_fetch_assoc')) {
-	function db_fetch_assoc($sql) {
+	function db_fetch_assoc($sql, $log = true, $db_conn = false) {
 		return npc_test_db_result('db_fetch_assoc', $sql, array(), array());
 	}
 }
 
 if (!function_exists('db_fetch_assoc_prepared')) {
-	function db_fetch_assoc_prepared($sql, $params = array()) {
+	function db_fetch_assoc_prepared($sql, $params = array(), $log = true, $db_conn = false) {
 		return npc_test_db_result('db_fetch_assoc_prepared', $sql, $params, array());
 	}
 }
 
 if (!function_exists('db_fetch_row')) {
-	function db_fetch_row($sql) {
+	function db_fetch_row($sql, $log = true, $db_conn = false) {
 		return npc_test_db_result('db_fetch_row', $sql, array(), array());
 	}
 }
 
 if (!function_exists('db_fetch_row_prepared')) {
-	function db_fetch_row_prepared($sql, $params = array()) {
+	function db_fetch_row_prepared($sql, $params = array(), $log = true, $db_conn = false) {
 		return npc_test_db_result('db_fetch_row_prepared', $sql, $params, array());
 	}
 }
 
 if (!function_exists('db_fetch_cell')) {
-	function db_fetch_cell($sql) {
+	function db_fetch_cell($sql, $col_name = '', $log = true, $db_conn = false) {
 		return npc_test_db_result('db_fetch_cell', $sql, array(), $GLOBALS['__test_db_fetch_cell'] ?? '');
 	}
 }
 
 if (!function_exists('db_fetch_cell_prepared')) {
-	function db_fetch_cell_prepared($sql, $params = array()) {
+	function db_fetch_cell_prepared($sql, $params = array(), $col_name = '', $log = true, $db_conn = false) {
 		return npc_test_db_result('db_fetch_cell_prepared', $sql, $params, '');
 	}
 }
 
 if (!function_exists('db_index_exists')) {
-	function db_index_exists($table, $index) {
+	function db_index_exists($table, $index, $log = true, $db_conn = false) {
 		return false;
 	}
 }
 
 if (!function_exists('db_column_exists')) {
-	function db_column_exists($table, $column) {
+	function db_column_exists($table, $column, $log = true, $db_conn = false) {
 		if (isset($GLOBALS['__test_pdo'])) {
 			return $GLOBALS['__test_pdo']->query('SHOW COLUMNS FROM `' . $table . "` LIKE '" . $column . "'")->rowCount() > 0;
 		}
@@ -235,7 +235,7 @@ function db_column_exists($table, $column) {
 }
 
 if (!function_exists('db_table_exists')) {
-	function db_table_exists($table) {
+	function db_table_exists($table, $log = true, $db_conn = false) {
 		if (isset($GLOBALS['__test_pdo'])) {
 			return $GLOBALS['__test_pdo']->query("SHOW TABLES LIKE '" . $table . "'")->rowCount() > 0;
 		}
@@ -259,7 +259,7 @@ function api_plugin_db_table_create($plugin, $table, $data) {
 $GLOBALS['__test_registered_hooks'] = array();
 
 if (!function_exists('api_plugin_register_hook')) {
-	function api_plugin_register_hook($plugin, $hook, $function, $file, $subtype = '') {
+	function api_plugin_register_hook($plugin, $hook, $function, $file, $enable = false) {
 		$GLOBALS['__test_registered_hooks'][] = array(
 			'name'     => $plugin,
 			'hook'     => $hook,
@@ -274,12 +274,12 @@ function api_plugin_register_hook($plugin, $hook, $function, $file, $subtype = '
 $GLOBALS['__test_registered_realms'] = array();
 
 if (!function_exists('api_plugin_register_realm')) {
-	function api_plugin_register_realm($plugin, $file, $description, $enabled) {
+	function api_plugin_register_realm($plugin, $file, $display, $admin = true) {
 		$GLOBALS['__test_registered_realms'][] = array(
 			'name'        => $plugin,
 			'file'        => $file,
-			'description' => $description,
-			'enabled'     => $enabled,
+			'description' => $display,
+			'enabled'     => $admin,
 		);
 
 		return true;
@@ -297,13 +297,13 @@ function api_plugin_remove_realms($plugin) {
 }
 
 if (!function_exists('read_config_option')) {
-	function read_config_option($name, $force = false) {
-		return $GLOBALS['__test_config'][$name] ?? '';
+	function read_config_option($config_name, $force = false) {
+		return $GLOBALS['__test_config'][$config_name] ?? '';
 	}
 }
 
 if (!function_exists('set_config_option')) {
-	function set_config_option($name, $value) {
+	function set_config_option($config_name, $value, $remote = false) {
 	}
 }
 
@@ -326,7 +326,7 @@ function __esc($text, $domain = '') {
 }
 
 if (!function_exists('cacti_log')) {
-	function cacti_log($message, $also_print = false, $log_type = '', $level = 0) {
+	function cacti_log($string, $output = false, $environ = 'CMDPHP', $level = '') {
 		$args = func_get_args();
 		$GLOBALS["__test_cacti_log"][] = isset($args[0]) ? (string) $args[0] : "";
 	}
@@ -345,7 +345,7 @@ function cacti_count($array) {
 }
 
 if (!function_exists('cacti_escapeshellarg')) {
-	function cacti_escapeshellarg($string) {
+	function cacti_escapeshellarg($string, $quote = true) {
 		return escapeshellarg($string);
 	}
 }
@@ -363,13 +363,13 @@ function api_plugin_user_realm_auth($filename = '') {
 }
 
 if (!function_exists('is_realm_allowed')) {
-	function is_realm_allowed($realm) {
+	function is_realm_allowed($realm, $check_user = false) {
 		return true;
 	}
 }
 
 if (!function_exists('raise_message')) {
-	function raise_message($id, $text = '', $level = 0) {
+	function raise_message($message_id, $message = '', $message_level = 0) {
 	}
 }
 
@@ -409,22 +409,22 @@ function get_nfilter_request_var($name, $default = '') {
 }
 
 if (!function_exists('get_filter_request_var')) {
-	function get_filter_request_var($name, $filter = FILTER_DEFAULT, $default = '') {
+	function get_filter_request_var($name, $filter = FILTER_VALIDATE_INT, $options = array()) {
 		$value = npc_test_request_value($name);
 
-		return $value !== null ? filter_var($value, $filter) : $default;
+		return $value !== null ? filter_var($value, $filter, $options) : '';
 	}
 }
 
 if (!function_exists('isset_request_var')) {
-	function isset_request_var($name) {
-		return npc_test_request_value($name) !== null;
+	function isset_request_var($variable) {
+		return npc_test_request_value($variable) !== null;
 	}
 }
 
 if (!function_exists('form_input_validate')) {
-	function form_input_validate($value, $name, $regex, $optional, $error) {
-		return $value;
+	function form_input_validate($field_value, $field_name, $regexp_match, $allow_nulls, $custom_message = 3) {
+		return $field_value;
 	}
 }
 
@@ -435,10 +435,10 @@ function is_error_message() {
 }
 
 if (!function_exists('sql_save')) {
-	function sql_save($array, $table, $key = 'id') {
-		$GLOBALS['__test_sql_save'][] = array('table' => $table, 'row' => $array);
+	function sql_save($array_items, $table_name, $key_cols = 'id', $autoinc = true, $db_conn = false) {
+		$GLOBALS['__test_sql_save'][] = array('table' => $table_name, 'row' => $array_items);
 
-		return isset($array['id']) ? $array['id'] : 1;
+		return isset($array_items['id']) ? $array_items['id'] : 1;
 	}
 }
 

From 06b0e99d02c26c4f23f0431366e5a54da1145a61 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 23:31:05 -0600
Subject: [PATCH 29/41] test: load js/npc.js through require instead of a vm
 context

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 js/npc.js           |  7 ++++-
 tests/js/harness.js | 64 ++++++++++++++++++++-------------------------
 2 files changed, 34 insertions(+), 37 deletions(-)

diff --git a/js/npc.js b/js/npc.js
index 7b107aa..fbbe91e 100644
--- a/js/npc.js
+++ b/js/npc.js
@@ -568,7 +568,7 @@ var npc = (function($) {
 		} else if (kind === 'comment') {
 			params.p_persistent = form.p_persistent ? 1 : 0;
 		} else if (kind === 'downtime') {
-			var minutes = parseInt(form.duration_minutes, 10);
+			var minutes = Number.parseInt(form.duration_minutes, 10);
 			var seconds = (minutes > 0 ? minutes : 60) * 60;
 
 			params.p_start_time = now;
@@ -759,3 +759,8 @@ var npc = (function($) {
 	};
 
 })(jQuery);
+
+/* The Node tests load this file with require(); browsers have no module object. */
+if (typeof module !== 'undefined' && module.exports) {
+	module.exports = npc;
+}
diff --git a/tests/js/harness.js b/tests/js/harness.js
index 662bea3..e1d5134 100644
--- a/tests/js/harness.js
+++ b/tests/js/harness.js
@@ -10,11 +10,9 @@
  * stay as they are.
  */
 
-const fs = require('fs');
 const path = require('path');
-const vm = require('vm');
 
-const source = fs.readFileSync(path.join(__dirname, '../../js/npc.js'), 'utf8');
+const script = path.join(__dirname, '../../js/npc.js');
 
 function load(options) {
 	const opts = options || {};
@@ -104,42 +102,36 @@ function load(options) {
 		callback(opts.postResponse || {success: true});
 	};
 
-	const context = {
-		jQuery: jq,
-		window: {
-			npcConfig: Object.assign({npcUrl: 'npc.php', csrfToken: 'token', userName: 'admin', portletRefresh: 60}, opts.config || {})
-		},
-		document: {
-			createElement() {
-				return {
-					appendChild(node) {
-						this.text = node.text;
-					},
-					get innerHTML() {
-						return String(this.text).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
-					}
-				};
-			},
-			createTextNode(text) {
-				return {text};
-			}
-		},
-		setInterval() {
-			return 1;
-		},
-		clearInterval() {},
-		confirm() {
-			return true;
-		},
-		alert(message) {
-			env.alerts.push(message);
+	/* js/npc.js reads these as globals when it is evaluated. Each load gets a
+	   fresh copy of the module so no state carries over between tests. */
+	global.jQuery = jq;
+	global.window = {
+		npcConfig: Object.assign({npcUrl: 'npc.php', csrfToken: 'token', userName: 'admin', portletRefresh: 60}, opts.config || {})
+	};
+	global.document = {
+		createElement() {
+			return {
+				appendChild(node) {
+					this.text = node.text;
+				},
+				get innerHTML() {
+					return String(this.text).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+				}
+			};
 		},
-		console
+		createTextNode(text) {
+			return {text};
+		}
+	};
+	global.setInterval = () => 1;
+	global.clearInterval = () => {};
+	global.confirm = () => true;
+	global.alert = (message) => {
+		env.alerts.push(message);
 	};
 
-	vm.createContext(context);
-	vm.runInContext(source, context);
-	env.npc = context.npc;
+	delete require.cache[require.resolve(script)];
+	env.npc = require(script);
 	env.ready = function() {
 		ready.forEach((fn) => fn());
 	};

From d18a1017b312da39834ee0a3dd5c86fffb299301 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 23:32:11 -0600
Subject: [PATCH 30/41] refactor: share one perfdata parser between the data
 input scripts

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                          |  3 ++-
 cli.php                               | 16 +--------------
 controllers/controller.php            | 26 +++++++++++++++++++++++++
 perfdata.php                          | 16 +--------------
 tests/Unit/ControllerPerfdataTest.php | 28 +++++++++++++++++++++++++++
 5 files changed, 58 insertions(+), 31 deletions(-)
 create mode 100644 tests/Unit/ControllerPerfdataTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index db72a89..d313dd0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,7 +23,8 @@
   named a table that does not exist) and remove the settings of deleted users
   (the cleanup read a column the query does not return)
 * issue: Skip perfdata entries without a numeric value (label=U) in perfdata.php and
-  cli.php instead of printing PHP warnings into the data input output
+  cli.php instead of printing PHP warnings into the data input output; both
+  scripts now share one parser in the base controller
 * issue: Declare the hostgroup and unhandled request properties on the base
   controller; assigning them raised the PHP 8.2 dynamic property deprecation
 * issue: List each service once; the service grid joined the hostgroup members
diff --git a/cli.php b/cli.php
index d002ed7..469d7d1 100644
--- a/cli.php
+++ b/cli.php
@@ -137,21 +137,7 @@ function getPerfData() {
 	$obj = new $class;
 	$results = $obj->getPerfData($objectId, $hostname, $serviceName);
 
-	$perfParts = explode(' ', isset($results[0]['perfdata']) ? $results[0]['perfdata'] : '');
-
-	$output = '';
-
-	foreach ($perfParts as $perf) {
-		/* Entries without a numeric value, such as label=U, are left out. */
-		if (preg_match('/(\S+)=([-+]?[0-9]*\.?[0-9]+)/', $perf, $matches)) {
-			if (preg_match('/^iso./', $matches[1])) {
-				$matches[1] = 'output';
-			}
-			$output .= $matches[1] . ':' . $matches[2] . ' ';
-		}
-	}
-
-	print $output . "\n";
+	print $obj->perfdataOutput(isset($results[0]['perfdata']) ? $results[0]['perfdata'] : '') . "\n";
 }
 
 function listHosts() {
diff --git a/controllers/controller.php b/controllers/controller.php
index 57d67e0..e2434ad 100644
--- a/controllers/controller.php
+++ b/controllers/controller.php
@@ -285,6 +285,32 @@ function limitClause() {
         return ' LIMIT ' . $offset . ', ' . $limit;
     }
 
+    /**
+     * perfdataOutput
+     *
+     * Reduces Nagios perfdata to the "label:value" pairs a Cacti data input
+     * method reads. Entries without a numeric value, such as label=U, are left
+     * out.
+     *
+     * @param  string $perfdata  The perfdata of a check
+     * @return string  for example "load1:0.52 load5:0.4 "
+     */
+    function perfdataOutput($perfdata) {
+        $output = '';
+
+        foreach (explode(' ', (string) $perfdata) as $perf) {
+            if (preg_match('/(\S+)=([-+]?[0-9]*\.?[0-9]+)/', $perf, $matches)) {
+                if (preg_match('/^iso./', $matches[1])) {
+                    $matches[1] = 'output';
+                }
+
+                $output .= $matches[1] . ':' . $matches[2] . ' ';
+            }
+        }
+
+        return $output;
+    }
+
     function jsonOutput($results=array()) {
         if (!$this->numRecords) {
             $this->numRecords = count($results);
diff --git a/perfdata.php b/perfdata.php
index 686a63f..fa9422d 100644
--- a/perfdata.php
+++ b/perfdata.php
@@ -75,21 +75,7 @@
 $obj = new $class;
 $results = $obj->getPerfData($objectId, $hostname, $serviceName);
 
-$perfParts = explode(' ', isset($results[0]['perfdata']) ? $results[0]['perfdata'] : '');
-
-$output = '';
-
-foreach ($perfParts as $perf) {
-    /* Entries without a numeric value, such as label=U, are left out. */
-    if (preg_match('/(\S+)=([-+]?[0-9]*\.?[0-9]+)/', $perf, $matches)) {
-        if (preg_match('/^iso./', $matches[1])) {
-                $matches[1] = 'output';
-        }
-        $output .= $matches[1] . ':' . $matches[2] . ' ';
-    }
-}
-
-echo $output . "\n";
+echo $obj->perfdataOutput(isset($results[0]['perfdata']) ? $results[0]['perfdata'] : '') . "\n";
 
 function listHosts() {
     $parms = $_SERVER["argv"];
diff --git a/tests/Unit/ControllerPerfdataTest.php b/tests/Unit/ControllerPerfdataTest.php
new file mode 100644
index 0000000..1b8ec92
--- /dev/null
+++ b/tests/Unit/ControllerPerfdataTest.php
@@ -0,0 +1,28 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Unit coverage for Controller::perfdataOutput(), which reduces the perfdata
+ * of a check to the label:value pairs a data input method reads.
+ */
+
+beforeAll(function () {
+	require_once dirname(__DIR__, 2) . '/controllers/controller.php';
+});
+
+it('reduces perfdata to label and value pairs', function (?string $perfdata, string $expected) {
+	expect((new Controller())->perfdataOutput($perfdata))->toBe($expected);
+})->with(array(
+	'one value'                  => array('rta=0.5ms;100;200;0', 'rta:0.5 '),
+	'several values'             => array('load1=0.52;1;2 load5=0.4;1;2', 'load1:0.52 load5:0.4 '),
+	'negative and signed values' => array('temp=-3.5C hum=+40%', 'temp:-3.5 hum:+40 '),
+	'unknown value is left out'  => array('load1=U;1;2 load5=0.4', 'load5:0.4 '),
+	'text without a value'       => array('OK - all fine', ''),
+	'iso label is renamed'       => array('iso.1.3=7', 'output:7 '),
+	'empty string'               => array('', ''),
+	'null'                       => array(null, ''),
+));

From 8af7219117c9a2048bf1c1be899cd068d1ca21af Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 23:38:04 -0600
Subject: [PATCH 31/41] test: let the subprocess tests record line coverage

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 tests/E2E/support/coverage-prepend.php | 51 ++++++++++++++++++++++++++
 tests/E2E/support/harness.php          | 35 +++++++++++++++++-
 2 files changed, 84 insertions(+), 2 deletions(-)
 create mode 100644 tests/E2E/support/coverage-prepend.php

diff --git a/tests/E2E/support/coverage-prepend.php b/tests/E2E/support/coverage-prepend.php
new file mode 100644
index 0000000..ee9f93f
--- /dev/null
+++ b/tests/E2E/support/coverage-prepend.php
@@ -0,0 +1,51 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Test helper, used as auto_prepend_file by the end-to-end tests when they are
+ * asked to measure coverage. It records which lines of the plugin ran during a
+ * request and writes them as JSON when the request ends.
+ *
+ * Inert unless a test process asked for it: it does nothing outside the CLI and
+ * the built-in server, nothing unless NPC_COVERAGE_DIR names an existing
+ * directory, and it only ever writes inside that directory. The file name is
+ * the label below, restricted to a plain name.
+ */
+
+if ((PHP_SAPI === 'cli' || PHP_SAPI === 'cli-server') && is_dir((string) getenv('NPC_COVERAGE_DIR')) && function_exists('xdebug_start_code_coverage') && strpos((string) ini_get('xdebug.mode'), 'coverage') !== false) {
+	xdebug_start_code_coverage(XDEBUG_CC_UNUSED);
+
+	register_shutdown_function(function () {
+		$executed = array();
+
+		foreach (xdebug_get_code_coverage() as $file => $lines) {
+			if (strpos($file, '/plugins/npc/') !== false) {
+				$executed[$file] = array(
+					'hit' => array_keys(array_filter($lines, function ($hits) {
+						return $hits > 0;
+					})),
+					'all' => array_keys(array_filter($lines, function ($hits) {
+						return $hits !== -2;
+					})),
+				);
+			}
+		}
+
+		xdebug_stop_code_coverage();
+
+		$label = getenv('NPC_COVERAGE_LABEL');
+
+		if (PHP_SAPI === 'cli-server' && isset($_SERVER['HTTP_X_NPC_TEST'])) {
+			$label = $_SERVER['HTTP_X_NPC_TEST'];
+		}
+
+		$label = substr(preg_replace('/[^A-Za-z0-9_.-]/', '_', (string) $label), 0, 120);
+		$label = $label === '' ? 'unlabelled' : $label;
+
+		file_put_contents(rtrim(getenv('NPC_COVERAGE_DIR'), '/') . '/' . $label . '-' . bin2hex(random_bytes(4)) . '.json', json_encode($executed));
+	});
+}
diff --git a/tests/E2E/support/harness.php b/tests/E2E/support/harness.php
index 06c38fc..38a9195 100644
--- a/tests/E2E/support/harness.php
+++ b/tests/E2E/support/harness.php
@@ -52,12 +52,20 @@ function npc_e2e_run(array $request) {
 			$scenario['post'] = $scenario['post'] + $scenario['get'];
 		}
 
+		$environment = array('NPC_E2E' => json_encode($scenario));
+		$options     = array('-d', 'display_errors=stderr');
+
+		if (getenv('NPC_COVERAGE_DIR') !== false) {
+			$environment += npc_e2e_coverage_environment();
+			$options      = array_merge($options, npc_e2e_coverage_options());
+		}
+
 		$process = proc_open(
-			array_merge(array(PHP_BINARY, '-d', 'display_errors=stderr', $script), $args),
+			array_merge(array(PHP_BINARY), $options, array($script), $args),
 			array(1 => array('pipe', 'w'), 2 => array('file', $base . '/stderr.txt', 'w')),
 			$pipes,
 			$npc,
-			array('NPC_E2E' => json_encode($scenario))
+			$environment
 		);
 
 		$stdout = stream_get_contents($pipes[1]);
@@ -74,6 +82,29 @@ function npc_e2e_run(array $request) {
 		return array('stdout' => $stdout, 'stderr' => (string) file_get_contents($base . '/stderr.txt'), 'calls' => $calls, 'base' => $base);
 	}
 
+	/**
+	 * Environment that makes a subprocess record line coverage when the test
+	 * process was started with NPC_COVERAGE_DIR set (see coverage-prepend.php).
+	 * The label is the name of the running test.
+	 */
+	function npc_e2e_coverage_environment() {
+		$label = 'unlabelled';
+
+		foreach (debug_backtrace(DEBUG_BACKTRACE_PROVIDE_OBJECT, 20) as $frame) {
+			if (isset($frame['object']) && $frame['object'] instanceof \PHPUnit\Framework\TestCase) {
+				$label = $frame['object']->name();
+
+				break;
+			}
+		}
+
+		return array('NPC_COVERAGE_DIR' => getenv('NPC_COVERAGE_DIR'), 'NPC_COVERAGE_LABEL' => $label);
+	}
+
+	function npc_e2e_coverage_options() {
+		return array('-d', 'xdebug.mode=coverage', '-d', 'auto_prepend_file=' . __DIR__ . '/coverage-prepend.php');
+	}
+
 	function npc_e2e_calls(array $run, $kind) {
 		return array_values(array_filter($run['calls'], function ($call) use ($kind) {
 			return $call['kind'] === $kind;

From 5cdb54575279cea98f8ea52cb1419826dca75ec2 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 23:39:10 -0600
Subject: [PATCH 32/41] fix: cast unsaved settings to strings in the NPC frame

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                        |  2 ++
 controllers/layout.php              |  6 +++---
 tests/Unit/LayoutControllerTest.php | 27 +++++++++++++++++++++++++++
 tests/bootstrap-unit.php            |  2 +-
 4 files changed, 33 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d313dd0..a41fe7e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* issue: Cast the date format, time format and Nagios URL settings to strings in the
+  NPC frame; unsaved settings raised the PHP 8.1 null deprecation on every page
 * dev: Run the schema and the listing, perfdata and upgrade queries against MariaDB
   in the Pest suite, and run npc.php, perfdata.php and cli.php as subprocesses
   (tests/E2E); the JavaScript front end is tested with Node's test runner
diff --git a/controllers/layout.php b/controllers/layout.php
index 6533751..e354550 100644
--- a/controllers/layout.php
+++ b/controllers/layout.php
@@ -49,9 +49,9 @@ function drawFrame($params) {
 			baseUrl:          '<?php echo $npc_base; ?>',
 			npcUrl:           '<?php echo $npc_base; ?>npc.php',
 			portletRefresh:   <?php echo (int) read_config_option('npc_portlet_refresh'); ?>,
-			dateFormat:       '<?php echo addslashes(read_config_option('npc_date_format')); ?>',
-			timeFormat:       '<?php echo addslashes(read_config_option('npc_time_format')); ?>',
-			nagiosUrl:        '<?php echo addslashes(read_config_option('npc_nagios_url')); ?>',
+			dateFormat:       '<?php echo addslashes((string) read_config_option('npc_date_format')); ?>',
+			timeFormat:       '<?php echo addslashes((string) read_config_option('npc_time_format')); ?>',
+			nagiosUrl:        '<?php echo addslashes((string) read_config_option('npc_nagios_url')); ?>',
 			userName:         <?php echo json_encode(db_fetch_cell_prepared('SELECT username FROM user_auth WHERE id = ?', array($_SESSION['sess_user_id']))); ?>,
 			hostIcons:        '<?php echo read_config_option('npc_host_icons'); ?>',
 			serviceIcons:     '<?php echo read_config_option('npc_service_icons'); ?>',
diff --git a/tests/Unit/LayoutControllerTest.php b/tests/Unit/LayoutControllerTest.php
index d2ad8a6..e63071d 100644
--- a/tests/Unit/LayoutControllerTest.php
+++ b/tests/Unit/LayoutControllerTest.php
@@ -72,3 +72,30 @@ function npc_layout_output($tab) {
 	'quote and statement'                  => array("x';breakout();'"),
 	'array value'                          => array(array('breakout')),
 ));
+
+it('writes empty strings for settings that were never saved', function () {
+	$GLOBALS['__test_config'] = array('npc_date_format' => null, 'npc_time_format' => null, 'npc_nagios_url' => null);
+
+	try {
+		$html = npc_layout_output('hosts');
+	} finally {
+		$GLOBALS['__test_config'] = array();
+	}
+
+	expect($html)->toContain("dateFormat:       ''");
+	expect($html)->toContain("timeFormat:       ''");
+	expect($html)->toContain("nagiosUrl:        ''");
+});
+
+it('escapes quotes in the saved date format and Nagios URL', function () {
+	$GLOBALS['__test_config'] = array('npc_date_format' => "Y'm", 'npc_time_format' => 'H:i', 'npc_nagios_url' => "https://nagios.example/'x");
+
+	try {
+		$html = npc_layout_output('hosts');
+	} finally {
+		$GLOBALS['__test_config'] = array();
+	}
+
+	expect($html)->toContain("dateFormat:       'Y\\'m'");
+	expect($html)->toContain("nagiosUrl:        'https://nagios.example/\\'x'");
+});
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index a58e535..db15ec8 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -298,7 +298,7 @@ function api_plugin_remove_realms($plugin) {
 
 if (!function_exists('read_config_option')) {
 	function read_config_option($config_name, $force = false) {
-		return $GLOBALS['__test_config'][$config_name] ?? '';
+		return array_key_exists($config_name, $GLOBALS['__test_config'] ?? array()) ? $GLOBALS['__test_config'][$config_name] : '';
 	}
 }
 

From 69d91a3b36591d9a7cd5ddc4a7f48343a52ba6a8 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 23:40:17 -0600
Subject: [PATCH 33/41] test: run the plugin under a real web server with real
 logins

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 tests/E2E/RealServerTest.php           | 458 +++++++++++++++++++++++++
 tests/E2E/support/server.php           | 169 +++++++++
 tests/Integration/NpcDatabaseTest.php  |  63 +---
 tests/Integration/support/database.php |  84 +++++
 4 files changed, 712 insertions(+), 62 deletions(-)
 create mode 100644 tests/E2E/RealServerTest.php
 create mode 100644 tests/E2E/support/server.php
 create mode 100644 tests/Integration/support/database.php

diff --git a/tests/E2E/RealServerTest.php b/tests/E2E/RealServerTest.php
new file mode 100644
index 0000000..94069c7
--- /dev/null
+++ b/tests/E2E/RealServerTest.php
@@ -0,0 +1,458 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Real requests against the real Cacti the plugin is installed in: PHP's
+ * built-in web server, Cacti's own login, sessions, realm checks and CSRF
+ * token check, and the Cacti database.
+ *
+ * The tests create four users with different realms, a handful of rows in the
+ * NPC tables and two settings, and remove them again afterwards. The Nagios
+ * command file is a temporary file. cacti.log is cut back to its length from
+ * before the run, so a warning provoked on purpose does not fail the
+ * workflow's log check.
+ *
+ * Skipped, with the reason, when there is no database, the plugin is not
+ * enabled, or the Cacti log cannot be written (the workflow's install step
+ * leaves it owned by root). Under CI a missing database is an error.
+ */
+
+require_once __DIR__ . '/support/harness.php';
+require_once __DIR__ . '/support/server.php';
+require_once dirname(__DIR__) . '/Integration/support/database.php';
+
+beforeAll(function () {
+	$GLOBALS['npc_rs'] = array('skip' => null);
+	$state             = &$GLOBALS['npc_rs'];
+	$state['db']       = npc_db_connect();
+
+	if ($state['db'] === null) {
+		$state['skip'] = 'No test database is reachable.';
+
+		if (getenv('CI') === 'true') {
+			throw new RuntimeException($state['skip']);
+		}
+
+		return;
+	}
+
+	$db = $state['db'];
+
+	if ($db->query("SHOW TABLES LIKE 'user_auth'")->rowCount() === 0 || $db->query("SELECT 1 FROM plugin_config WHERE directory = 'npc' AND status = 1")->rowCount() === 0) {
+		$state['skip'] = 'Cacti is not installed with the npc plugin enabled in the test database.';
+
+		return;
+	}
+
+	$log = $GLOBALS['config']['base_path'] . '/log/cacti.log';
+
+	if (!extension_loaded('curl') || (file_exists($log) && !is_writable($log)) || (!file_exists($log) && !is_writable(dirname($log)))) {
+		$state['skip'] = 'curl is missing or the Cacti log is not writable.';
+
+		return;
+	}
+
+	$state['log']      = $log;
+	$state['log_size'] = file_exists($log) ? filesize($log) : null;
+	$state['server']   = npc_server_start();
+
+	if ($state['server'] === null) {
+		$state['skip'] = 'The built-in web server did not start.';
+
+		return;
+	}
+
+	$realm = function ($file) use ($db) {
+		$statement = $db->prepare('SELECT id + 100 FROM plugin_realms WHERE plugin = ? AND file = ?');
+		$statement->execute(array('npc', $file));
+
+		return (int) $statement->fetchColumn();
+	};
+
+	$grants = array(
+		'viewer'    => array($realm('npc.php')),
+		'nobody'    => array(1),
+		'commander' => array($realm('npc.php'), $realm('npc1.php')),
+		'admin'     => array($realm('npc.php'), $realm('npc1.php'), 3, 2),
+	);
+
+	$password          = bin2hex(random_bytes(8));
+	$state['password'] = $password;
+	$state['jars']   = array();
+	$state['tokens'] = array();
+	$state['users']  = array();
+
+	foreach ($grants as $name => $realms) {
+		$username = 'npc_e2e_' . $name;
+
+		$db->prepare('DELETE FROM user_auth WHERE username = ?')->execute(array($username));
+		npc_db_insert($db, 'user_auth', array('username' => $username, 'password' => password_hash($password, PASSWORD_DEFAULT), 'realm' => 0, 'must_change_password' => '', 'password_change' => '', 'enabled' => 'on', 'locked' => ''));
+
+		$id = (int) $db->lastInsertId();
+		$state['users'][] = $id;
+
+		foreach ($realms as $realm_id) {
+			npc_db_insert($db, 'user_auth_realm', array('realm_id' => $realm_id, 'user_id' => $id));
+		}
+
+		$state['jars'][$name] = npc_http_login($state['server'], $username, $password, 'login');
+
+		if ($state['jars'][$name] === null) {
+			$state['skip'] = 'Cacti did not accept the login of ' . $username . '.';
+
+			return;
+		}
+
+		if (in_array($realm('npc.php'), $realms, true)) {
+			$state['tokens'][$name] = npc_http_token($state['server'], $state['jars'][$name]);
+		}
+	}
+
+	/* The Nagios command file and the settings that point to it. */
+	$state['command_file'] = sys_get_temp_dir() . '/npc-e2e-cmd-' . uniqid();
+	file_put_contents($state['command_file'], '');
+
+	$state['settings'] = array();
+
+	foreach (array('npc_nagios_commands' => '1', 'npc_nagios_cmd_path' => $state['command_file']) as $name => $value) {
+		$old = $db->prepare('SELECT value FROM settings WHERE name = ?');
+		$old->execute(array($name));
+		$state['settings'][$name] = $old->fetchColumn();
+
+		$db->prepare('REPLACE INTO settings (name, value) VALUES (?, ?)')->execute(array($name, $value));
+	}
+
+	/* Rows the listings and the bulk comment deletion read. */
+	npc_db_insert($db, 'npc_objects', array('object_id' => 9300, 'instance_id' => 99, 'objecttype_id' => 1, 'name1' => 'e2ehost'));
+	npc_db_insert($db, 'npc_comments', array('instance_id' => 99, 'object_id' => 9300, 'comment_data' => 'e2e comment', 'author_name' => 'e2e'));
+
+	for ($i = 0; $i < 1005; $i++) {
+		npc_db_insert($db, 'npc_logentries', array('instance_id' => 99, 'logentry_time' => '2026-01-01 00:00:00', 'entry_time' => '2026-01-01 00:00:00', 'entry_time_usec' => $i, 'logentry_data' => 'e2e entry ' . $i));
+	}
+});
+
+afterAll(function () {
+	$state = &$GLOBALS['npc_rs'];
+
+	if (isset($state['server'])) {
+		npc_server_stop($state['server']);
+	}
+
+	$db = $state['db'] ?? null;
+
+	if ($db !== null) {
+		foreach ($state['users'] ?? array() as $id) {
+			$db->prepare('DELETE FROM user_auth_realm WHERE user_id = ?')->execute(array($id));
+			$db->prepare('DELETE FROM user_auth WHERE id = ?')->execute(array($id));
+		}
+
+		foreach ($state['settings'] ?? array() as $name => $old) {
+			if ($old === false) {
+				$db->prepare('DELETE FROM settings WHERE name = ?')->execute(array($name));
+			} else {
+				$db->prepare('REPLACE INTO settings (name, value) VALUES (?, ?)')->execute(array($name, $old));
+			}
+		}
+
+		$db->prepare('DELETE FROM npc_comments WHERE instance_id = ?')->execute(array(99));
+		$db->prepare('DELETE FROM npc_objects WHERE object_id = ?')->execute(array(9300));
+		$db->prepare('DELETE FROM npc_logentries WHERE instance_id = ?')->execute(array(99));
+		$db->prepare('DELETE FROM data_input WHERE name LIKE ?')->execute(array('NPC - Perfdata - e2e%'));
+		$db->prepare('DELETE FROM host WHERE description LIKE ?')->execute(array('e2e import%'));
+	}
+
+	if (isset($state['log']) && $state['log_size'] !== null && file_exists($state['log'])) {
+		$handle = fopen($state['log'], 'r+');
+		ftruncate($handle, $state['log_size']);
+		fclose($handle);
+	}
+});
+
+beforeEach(function () {
+	if ($GLOBALS['npc_rs']['skip'] !== null) {
+		$this->markTestSkipped($GLOBALS['npc_rs']['skip']);
+	}
+
+	file_put_contents($GLOBALS['npc_rs']['command_file'], '');
+});
+
+/** One request as the named user ('' for nobody logged in). */
+function npc_rs_request($user, $method, array $fields, $token = true) {
+	$state = $GLOBALS['npc_rs'];
+	$jar   = $user === '' ? sys_get_temp_dir() . '/npc-jar-' . uniqid() : $state['jars'][$user];
+
+	if ($method !== 'GET' && $token === true && isset($state['tokens'][$user])) {
+		$fields['__csrf_magic'] = $state['tokens'][$user];
+	}
+
+	return npc_http($state['server'], $method, 'plugins/npc/npc.php', $fields, $jar, 'real-server');
+}
+
+/** A failed CSRF check ends the session, so those tests log in again afterwards. */
+function npc_rs_relogin($user) {
+	$state = &$GLOBALS['npc_rs'];
+
+	$state['jars'][$user]   = npc_http_login($state['server'], 'npc_e2e_' . $user, $state['password'], 'login');
+	$state['tokens'][$user] = npc_http_token($state['server'], $state['jars'][$user]);
+}
+
+function npc_rs_commands() {
+	return array_values(array_filter(explode("\n", (string) file_get_contents($GLOBALS['npc_rs']['command_file']))));
+}
+
+function npc_rs_json($response) {
+	return json_decode($response['body'], true);
+}
+
+it('asks a visitor who is not logged in to log in', function (string $method, array $fields) {
+	$response = npc_rs_request('', $method, $fields, false);
+
+	expect($response['body'])->not->toContain('currentTab');
+	expect(json_decode($response['body'], true))->toBeNull();
+	expect(npc_rs_commands())->toBe(array());
+})->with(array(
+	'frame'          => array('GET', array('module' => 'layout', 'action' => 'drawFrame')),
+	'listing'        => array('GET', array('module' => 'hosts', 'action' => 'getHosts')),
+	'command'        => array('POST', array('module' => 'nagios', 'action' => 'command', 'p_command' => 'ENABLE_NOTIFICATIONS')),
+	'host import'    => array('POST', array('module' => 'sync', 'action' => 'import', 'p_description' => 'e2e import', 'p_ip' => '192.0.2.5', 'p_template_id' => '1')),
+));
+
+it('keeps a user without the NPC realm out', function (string $method, array $fields) {
+	$response = npc_rs_request('nobody', $method, $fields, false);
+
+	expect($response['body'])->not->toContain('currentTab');
+	expect(json_decode($response['body'], true))->toBeNull();
+	expect(npc_rs_commands())->toBe(array());
+})->with(array(
+	'frame'   => array('GET', array('module' => 'layout', 'action' => 'drawFrame')),
+	'listing' => array('GET', array('module' => 'hosts', 'action' => 'getHosts')),
+	'command' => array('POST', array('module' => 'nagios', 'action' => 'command', 'p_command' => 'ENABLE_NOTIFICATIONS')),
+));
+
+it('shows the frame to a user with the NPC realm', function (string $tab, string $expected) {
+	$response = npc_rs_request('viewer', 'GET', array('module' => 'layout', 'action' => 'drawFrame', 'tab' => $tab));
+
+	expect($response['status'])->toBe(200);
+	expect($response['body'])->toContain("currentTab:       '" . $expected . "'");
+	expect($response['body'])->not->toContain('breakout');
+})->with(array(
+	'known tab'               => array('hosts', 'hosts'),
+	'unknown tab'             => array('nonsense', 'dashboard'),
+	'markup closing a script' => array('x</script><b>breakout</b>', 'dashboard'),
+	'quote and statement'     => array("x';breakout();'", 'dashboard'),
+));
+
+it('answers every listing from the database', function (string $module, string $action) {
+	$response = npc_rs_request('viewer', 'GET', array('module' => $module, 'action' => $action));
+	$body     = npc_rs_json($response);
+
+	expect($response['status'])->toBe(200);
+	expect($body)->toBeArray();
+	expect($response['body'])->not->toContain('SQLSTATE');
+})->with(array(
+	'hosts'              => array('hosts', 'getHosts'),
+	'host summary'       => array('hosts', 'summary'),
+	'services'           => array('services', 'getServices'),
+	'service summary'    => array('services', 'summary'),
+	'host comments'      => array('comments', 'getHostComments'),
+	'service comments'   => array('comments', 'getServiceComments'),
+	'host downtime'      => array('downtime', 'getHostDowntime'),
+	'service downtime'   => array('downtime', 'getServiceDowntime'),
+	'log entries'        => array('logentries', 'getLogs'),
+	'notifications'      => array('notifications', 'getNotifications'),
+	'state history'      => array('statehistory', 'getStateHistory'),
+	'process info'       => array('nagios', 'getProcessInfoGrid'),
+));
+
+it('pages through a listing within the allowed bounds', function (array $query, int $items) {
+	$response = npc_rs_request('viewer', 'GET', array('module' => 'logentries', 'action' => 'getLogs') + $query);
+	$page     = npc_rs_json($response)['response']['value'];
+
+	expect(count($page['items']))->toBe($items);
+	expect((int) $page['total_count'])->toBeGreaterThanOrEqual(1005);
+})->with(array(
+	'default page'   => array(array(), 25),
+	'above the cap'  => array(array('limit' => '100000'), 1000),
+	'below one'      => array(array('limit' => '-5'), 1),
+	'negative start' => array(array('start' => '-50', 'limit' => '10'), 10),
+	'last page'      => array(array('start' => '1000', 'limit' => '50'), 5),
+	'limit as p_'    => array(array('p_limit' => '100000'), 25),
+));
+
+it('refuses a state-changing action sent with the wrong method', function (string $method, string $module, string $action) {
+	$response = npc_rs_request('admin', $method, array('module' => $module, 'action' => $action, 'p_command' => 'ENABLE_NOTIFICATIONS', 'p_object_id' => '1', 'p_host' => 'e2e'), false);
+
+	expect($response['status'])->toBe(405);
+	/* Cacti's own method check answers some actions, such as save, before the plugin does. */
+	expect($response['body'] === '' || npc_rs_json($response) === array('success' => false, 'msg' => 'This action requires a POST request.'))->toBeTrue();
+	expect(npc_rs_commands())->toBe(array());
+})->with(function () {
+	$actions = array('nagios' => 'command', 'comments' => 'deleteAllHostComments', 'cacti' => 'addDataInputMethod', 'sync' => 'import', 'hosts' => 'setMappedGraph', 'services' => 'setMappedGraph', 'settings' => 'save');
+
+	foreach (array('GET', 'PUT', 'DELETE') as $method) {
+		foreach ($actions as $module => $action) {
+			yield $method . ' ' . $module . '/' . $action => array($method, $module, $action);
+		}
+	}
+});
+
+it('rejects a POST without the CSRF token', function () {
+	$response = npc_rs_request('commander', 'POST', array('module' => 'nagios', 'action' => 'command', 'p_command' => 'ENABLE_NOTIFICATIONS'), false);
+
+	expect($response['body'])->not->toContain('"success":true');
+	expect(npc_rs_commands())->toBe(array());
+
+	npc_rs_relogin('commander');
+});
+
+it('rejects a POST with a token that is not valid', function () {
+	$response = npc_rs_request('commander', 'POST', array('module' => 'nagios', 'action' => 'command', 'p_command' => 'ENABLE_NOTIFICATIONS', '__csrf_magic' => 'not-a-token'), false);
+
+	expect($response['body'])->not->toContain('"success":true');
+	expect(npc_rs_commands())->toBe(array());
+
+	npc_rs_relogin('commander');
+});
+
+it('writes a Nagios command for a user with the command realm', function () {
+	$response = npc_rs_request('commander', 'POST', array('module' => 'nagios', 'action' => 'command', 'p_command' => 'ENABLE_NOTIFICATIONS'));
+
+	expect(npc_rs_json($response))->toBe(array('success' => true));
+	expect(npc_rs_commands())->toHaveCount(1);
+	expect(npc_rs_commands()[0])->toMatch('/^\[\d+\] ENABLE_NOTIFICATIONS$/');
+});
+
+it('refuses the command to a user without the command realm', function () {
+	$response = npc_rs_request('viewer', 'POST', array('module' => 'nagios', 'action' => 'command', 'p_command' => 'ENABLE_NOTIFICATIONS'));
+
+	expect(npc_rs_json($response))->toBe(array('success' => false, 'msg' => 'You do not have permission to execute this command.'));
+	expect(npc_rs_commands())->toBe(array());
+});
+
+it('keeps a hostile host name inside one field of one command', function (string $host) {
+	$response = npc_rs_request('commander', 'POST', array(
+		'module'       => 'nagios',
+		'action'       => 'command',
+		'p_command'    => 'ADD_HOST_COMMENT',
+		'p_host_name'  => $host,
+		'p_persistent' => '0',
+		'p_author'     => 'e2e',
+		'p_comment'    => "first line\nsecond;line",
+	));
+
+	expect(npc_rs_json($response))->toBe(array('success' => true));
+
+	$commands = npc_rs_commands();
+
+	expect($commands)->toHaveCount(1);
+	expect(substr_count($commands[0], ';'))->toBe(4);
+})->with(array(
+	'separator and new line' => array("web1;DISABLE_NOTIFICATIONS\nDISABLE_EVENT_HANDLERS"),
+	'carriage return'        => array("web1\rDISABLE_NOTIFICATIONS"),
+	'semicolons only'        => array(';;;'),
+));
+
+it('rejects an unknown or incomplete command', function (array $fields, string $message) {
+	$response = npc_rs_request('commander', 'POST', array('module' => 'nagios', 'action' => 'command') + $fields);
+
+	expect(npc_rs_json($response)['success'])->toBeFalse();
+	expect(npc_rs_json($response)['msg'])->toContain($message);
+	expect(npc_rs_commands())->toBe(array());
+})->with(array(
+	'unknown command'    => array(array('p_command' => 'FORMAT_DISK'), 'not a valid command'),
+	'missing parameters' => array(array('p_command' => 'ADD_HOST_COMMENT', 'p_host_name' => 'web1'), 'Missing required parameter'),
+));
+
+it('deletes the comments of a host for a user with the command realm', function () {
+	$response = npc_rs_request('commander', 'POST', array('module' => 'comments', 'action' => 'deleteAllHostComments'));
+
+	expect($response['status'])->toBe(200);
+	expect(preg_replace('/^\[\d+\] /', '', npc_rs_commands()[0] ?? ''))->toBe('DEL_ALL_HOST_COMMENTS;e2ehost');
+});
+
+it('deletes no comments for a user without the command realm', function () {
+	npc_rs_request('viewer', 'POST', array('module' => 'comments', 'action' => 'deleteAllHostComments'));
+	npc_rs_request('viewer', 'POST', array('module' => 'comments', 'action' => 'deleteAllServiceComments'));
+
+	expect(npc_rs_commands())->toBe(array());
+});
+
+it('rejects dispatcher actions that were removed', function (string $module, string $action) {
+	$response = npc_rs_request('admin', 'GET', array('module' => $module, 'action' => $action));
+
+	expect($response['status'])->toBe(302);
+	expect($response['body'])->toBe('');
+})->with(array(
+	'setting lookup' => array('cacti', 'getSetting'),
+	'mapped check'   => array('cacti', 'isMapped'),
+	'host mapping'   => array('cacti', 'mapHost'),
+	'user settings'  => array('settings', 'getSettings'),
+	'address check'  => array('sync', 'checkHostExists'),
+));
+
+it('creates a data input method only for a user with the data input realm', function (string $user, bool $allowed) {
+	$db = $GLOBALS['npc_rs']['db'];
+
+	$response = npc_rs_request($user, 'POST', array('module' => 'cacti', 'action' => 'addDataInputMethod', 'p_host' => 'e2e' . $user, 'p_object_id' => '12'));
+	$count    = $db->prepare('SELECT COUNT(*) FROM data_input WHERE name = ?');
+	$count->execute(array('NPC - Perfdata - e2e' . $user));
+
+	expect(npc_rs_json($response)['success'])->toBe($allowed);
+	expect((int) $count->fetchColumn())->toBe($allowed ? 1 : 0);
+})->with(array(
+	'user with the realm'    => array('admin', true),
+	'user without the realm' => array('commander', false),
+	'viewer'                 => array('viewer', false),
+));
+
+it('runs the host import for a user with the devices realm without running request text as a command', function () {
+	$marker = sys_get_temp_dir() . '/npc-marker-' . uniqid();
+
+	$response = npc_rs_request('admin', 'POST', array(
+		'module'           => 'sync',
+		'action'           => 'import',
+		'p_description'    => 'e2e import & touch ' . $marker . ' &',
+		'p_host_object_id' => '9301',
+		'p_ip'             => '192.0.2.77',
+		'p_cache_id'       => 'e2e',
+		'p_template_id'    => '99999',
+	));
+
+	expect($response['status'])->toBe(200);
+	expect($response['body'])->toStartWith('e2e import');
+	expect(file_exists($marker))->toBeFalse();
+});
+
+it('rejects a host import with unusable parameters', function (array $override, string $message) {
+	$response = npc_rs_request('admin', 'POST', array_merge(array(
+		'module'           => 'sync',
+		'action'           => 'import',
+		'p_description'    => 'e2e import',
+		'p_host_object_id' => '9301',
+		'p_ip'             => '192.0.2.77',
+		'p_cache_id'       => 'e2e',
+		'p_template_id'    => '1',
+	), $override));
+
+	expect($response['body'])->toBe(($override['p_description'] ?? 'e2e import') . '|0|0|' . $message);
+})->with(array(
+	'template id with a suffix' => array(array('p_template_id' => '7 id'), 'Invalid import parameters'),
+	'empty address'             => array(array('p_ip' => ''), 'Invalid import parameters'),
+));
+
+it('refuses the host import to a user without the devices realm', function (string $user) {
+	$response = npc_rs_request($user, 'POST', array('module' => 'sync', 'action' => 'import', 'p_description' => 'e2e import', 'p_ip' => '192.0.2.77', 'p_template_id' => '1'));
+
+	expect($response['body'])->toBe('e2e import|0|0|You do not have permission to add devices');
+})->with(array('viewer', 'commander'));
+
+it('lists the hostgroups selected for the import as JSON', function () {
+	$response = npc_rs_request('viewer', 'GET', array('module' => 'sync', 'action' => 'getHosts', 'p_data' => '{"g1":{"alias":"e2e group","create_graphs":1,"template":2}}'));
+
+	expect($response['status'])->toBe(200);
+	expect(npc_rs_json($response))->toBe(array());
+});
diff --git a/tests/E2E/support/server.php b/tests/E2E/support/server.php
new file mode 100644
index 0000000..0c197b8
--- /dev/null
+++ b/tests/E2E/support/server.php
@@ -0,0 +1,169 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Test helper: runs the Cacti tree the plugin is installed in under PHP's
+ * built-in web server and talks to it with real HTTP requests and real
+ * sessions. Only function definitions, so it does nothing if a web server is
+ * asked for it.
+ *
+ * The server listens on 127.0.0.1 on a free port for the length of the test
+ * run. When the test process was started with NPC_COVERAGE_DIR set, the server
+ * records line coverage per request (see coverage-prepend.php); each request
+ * names the running test in the X-Npc-Test header, which is only ever used to
+ * build a file name.
+ */
+
+if (!function_exists('npc_server_url_path')) {
+	/**
+	 * The $url_path of the Cacti install, which is also the path of the session
+	 * cookie.
+	 */
+	function npc_server_url_path() {
+		$file = $GLOBALS['config']['base_path'] . '/include/config.php';
+		$text = is_readable($file) ? (string) file_get_contents($file) : '';
+
+		if (preg_match('/^\s*\$url_path\s*=\s*[\'"]([^\'"]*)[\'"]/m', $text, $match)) {
+			$path = trim($match[1], '/');
+
+			return $path === '' ? '/' : '/' . $path . '/';
+		}
+
+		return '/';
+	}
+
+	/**
+	 * Start the server. Returns a handle for npc_server_stop() or null when the
+	 * server could not be started.
+	 */
+	function npc_server_start() {
+		$root     = $GLOBALS['config']['base_path'];
+		$prefix   = trim(npc_server_url_path(), '/');
+		$docroot  = $root;
+		$listener = stream_socket_server('tcp://127.0.0.1:0', $errno, $error);
+
+		if ($listener === false) {
+			return null;
+		}
+
+		$port = (int) substr(strrchr(stream_socket_get_name($listener, false), ':'), 1);
+		fclose($listener);
+
+		if ($prefix !== '') {
+			$docroot = sys_get_temp_dir() . '/npc-docroot-' . uniqid();
+			mkdir($docroot, 0700, true);
+			symlink($root, $docroot . '/' . $prefix);
+		}
+
+		$options = array('-d', 'display_errors=0');
+		$env     = array();
+
+		if (getenv('NPC_COVERAGE_DIR') !== false) {
+			$options = array_merge($options, npc_e2e_coverage_options());
+			$env     = array('NPC_COVERAGE_DIR' => getenv('NPC_COVERAGE_DIR'), 'NPC_COVERAGE_LABEL' => 'server');
+		}
+
+		$process = proc_open(
+			array_merge(array(PHP_BINARY), $options, array('-S', '127.0.0.1:' . $port, '-t', $docroot)),
+			array(1 => array('file', sys_get_temp_dir() . '/npc-server-' . $port . '.out', 'w'), 2 => array('file', sys_get_temp_dir() . '/npc-server-' . $port . '.err', 'w')),
+			$pipes,
+			$root,
+			$env + array('PATH' => (string) getenv('PATH'))
+		);
+
+		for ($try = 0; $try < 50; $try++) {
+			$socket = @fsockopen('127.0.0.1', $port, $errno, $error, 0.2);
+
+			if ($socket !== false) {
+				fclose($socket);
+
+				return array('process' => $process, 'base' => 'http://127.0.0.1:' . $port . npc_server_url_path(), 'docroot' => $docroot);
+			}
+
+			usleep(100000);
+		}
+
+		proc_terminate($process);
+
+		return null;
+	}
+
+	function npc_server_stop($server) {
+		if ($server !== null) {
+			proc_terminate($server['process']);
+			proc_close($server['process']);
+		}
+	}
+
+	/**
+	 * One HTTP request. $jar is a cookie file; the label names the running test
+	 * for the coverage files.
+	 *
+	 * @return array status, body and the Location header
+	 */
+	function npc_http($server, $method, $path, array $fields, $jar, $label = 'request') {
+		$url = $server['base'] . $path;
+
+		if ($method !== 'POST' && $fields) {
+			$url .= (strpos($path, '?') === false ? '?' : '&') . http_build_query($fields);
+		}
+
+		$curl = curl_init($url);
+
+		curl_setopt_array($curl, array(
+			CURLOPT_CUSTOMREQUEST  => $method,
+			CURLOPT_RETURNTRANSFER => true,
+			CURLOPT_HEADER         => true,
+			CURLOPT_COOKIEJAR      => $jar,
+			CURLOPT_COOKIEFILE     => $jar,
+			CURLOPT_FOLLOWLOCATION => false,
+			CURLOPT_TIMEOUT        => 30,
+			CURLOPT_HTTPHEADER     => array('X-Npc-Test: ' . $label),
+		));
+
+		if ($method === 'POST') {
+			curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($fields));
+		}
+
+		$response = (string) curl_exec($curl);
+		$status   = curl_getinfo($curl, CURLINFO_HTTP_CODE);
+		$split    = (int) curl_getinfo($curl, CURLINFO_HEADER_SIZE);
+		curl_close($curl);
+
+		$head = substr($response, 0, $split);
+
+		return array(
+			'status'   => $status,
+			'body'     => substr($response, $split),
+			'location' => preg_match('/^Location:\s*(\S+)/mi', $head, $match) ? $match[1] : null,
+		);
+	}
+
+	/**
+	 * Log in through Cacti's login form and return the cookie file, or null when
+	 * the login did not give a session.
+	 */
+	function npc_http_login($server, $username, $password, $label = 'login') {
+		$jar   = sys_get_temp_dir() . '/npc-jar-' . uniqid();
+		$login = npc_http($server, 'GET', 'plugins/npc/npc.php', array(), $jar, $label);
+
+		if (!preg_match('/name=.__csrf_magic. value="([^"]+)"/', $login['body'], $token)) {
+			return null;
+		}
+
+		$result = npc_http($server, 'POST', 'plugins/npc/npc.php', array('action' => 'login', 'login_username' => $username, 'login_password' => $password, '__csrf_magic' => $token[1]), $jar, $label);
+
+		return $result['status'] === 302 ? $jar : null;
+	}
+
+	/** The CSRF token the NPC frame hands to its script. */
+	function npc_http_token($server, $jar, $label = 'token') {
+		$frame = npc_http($server, 'GET', 'plugins/npc/npc.php', array('module' => 'layout', 'action' => 'drawFrame'), $jar, $label);
+
+		return preg_match('/csrfToken:\s+"([^"]+)"/', $frame['body'], $match) ? $match[1] : null;
+	}
+}
diff --git a/tests/Integration/NpcDatabaseTest.php b/tests/Integration/NpcDatabaseTest.php
index e087364..ce46682 100644
--- a/tests/Integration/NpcDatabaseTest.php
+++ b/tests/Integration/NpcDatabaseTest.php
@@ -19,68 +19,7 @@
  * error.
  */
 
-/**
- * @return array|null host, port, name, user and password of the test database
- */
-function npc_db_settings() {
-	if (getenv('NPC_TEST_DB_HOST') !== false) {
-		return array(
-			'host' => getenv('NPC_TEST_DB_HOST'),
-			'port' => getenv('NPC_TEST_DB_PORT') ?: '3306',
-			'name' => getenv('NPC_TEST_DB_NAME') ?: 'cacti',
-			'user' => getenv('NPC_TEST_DB_USER') ?: 'cactiuser',
-			'pass' => getenv('NPC_TEST_DB_PASS') !== false ? getenv('NPC_TEST_DB_PASS') : 'cactiuser',
-		);
-	}
-
-	$file = $GLOBALS['config']['base_path'] . '/include/config.php';
-
-	if (!is_readable($file)) {
-		return null;
-	}
-
-	$text     = (string) file_get_contents($file);
-	$settings = array();
-
-	foreach (array('host' => 'hostname', 'port' => 'port', 'name' => 'default', 'user' => 'username', 'pass' => 'password') as $key => $variable) {
-		if (preg_match('/^\s*\$database_' . $variable . '\s*=\s*[\'"]([^\'"]*)[\'"]/m', $text, $match)) {
-			$settings[$key] = $match[1];
-		}
-	}
-
-	return isset($settings['host'], $settings['name'], $settings['user']) ? $settings + array('port' => '3306', 'pass' => '') : null;
-}
-
-function npc_db_connect() {
-	$settings = npc_db_settings();
-
-	if ($settings === null) {
-		return null;
-	}
-
-	try {
-		$pdo = new PDO(
-			'mysql:host=' . $settings['host'] . ';port=' . $settings['port'] . ';dbname=' . $settings['name'] . ';charset=utf8',
-			$settings['user'],
-			$settings['pass'],
-			array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::ATTR_TIMEOUT => 2)
-		);
-	} catch (PDOException $e) {
-		return null;
-	}
-
-	/* Cacti runs its sessions without the strict modes. */
-	$pdo->exec("SET SESSION sql_mode = 'NO_ENGINE_SUBSTITUTION'");
-
-	return $pdo;
-}
-
-function npc_db_insert($pdo, $table, array $row) {
-	$columns = '`' . implode('`, `', array_keys($row)) . '`';
-	$marks   = implode(', ', array_fill(0, count($row), '?'));
-
-	$pdo->prepare('INSERT INTO `' . $table . '` (' . $columns . ') VALUES (' . $marks . ')')->execute(array_values($row));
-}
+require_once __DIR__ . '/support/database.php';
 
 beforeAll(function () {
 	require_once dirname(__DIR__, 2) . '/setup.php';
diff --git a/tests/Integration/support/database.php b/tests/Integration/support/database.php
new file mode 100644
index 0000000..99d1437
--- /dev/null
+++ b/tests/Integration/support/database.php
@@ -0,0 +1,84 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Test helper: connection to the test database. Only function definitions, so
+ * it does nothing if a web server is asked for it.
+ *
+ * The server comes from NPC_TEST_DB_HOST, NPC_TEST_DB_PORT, NPC_TEST_DB_NAME,
+ * NPC_TEST_DB_USER and NPC_TEST_DB_PASS, or else from the database settings in
+ * the include/config.php of the Cacti tree the plugin sits in.
+ */
+
+if (!function_exists('npc_db_settings')) {
+	/**
+	 * @return array|null host, port, name, user and password of the test database
+	 */
+	function npc_db_settings() {
+		if (getenv('NPC_TEST_DB_HOST') !== false) {
+			return array(
+				'host' => getenv('NPC_TEST_DB_HOST'),
+				'port' => getenv('NPC_TEST_DB_PORT') ?: '3306',
+				'name' => getenv('NPC_TEST_DB_NAME') ?: 'cacti',
+				'user' => getenv('NPC_TEST_DB_USER') ?: 'cactiuser',
+				'pass' => getenv('NPC_TEST_DB_PASS') !== false ? getenv('NPC_TEST_DB_PASS') : 'cactiuser',
+			);
+		}
+
+		$file = $GLOBALS['config']['base_path'] . '/include/config.php';
+
+		if (!is_readable($file)) {
+			return null;
+		}
+
+		$text     = (string) file_get_contents($file);
+		$settings = array();
+
+		foreach (array('host' => 'hostname', 'port' => 'port', 'name' => 'default', 'user' => 'username', 'pass' => 'password') as $key => $variable) {
+			if (preg_match('/^\s*\$database_' . $variable . '\s*=\s*[\'"]([^\'"]*)[\'"]/m', $text, $match)) {
+				$settings[$key] = $match[1];
+			}
+		}
+
+		return isset($settings['host'], $settings['name'], $settings['user']) ? $settings + array('port' => '3306', 'pass' => '') : null;
+	}
+}
+
+if (!function_exists('npc_db_connect')) {
+	function npc_db_connect() {
+		$settings = npc_db_settings();
+
+		if ($settings === null) {
+			return null;
+		}
+
+		try {
+			$pdo = new PDO(
+				'mysql:host=' . $settings['host'] . ';port=' . $settings['port'] . ';dbname=' . $settings['name'] . ';charset=utf8',
+				$settings['user'],
+				$settings['pass'],
+				array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::ATTR_TIMEOUT => 2)
+			);
+		} catch (PDOException $e) {
+			return null;
+		}
+
+		/* Cacti runs its sessions without the strict modes. */
+		$pdo->exec("SET SESSION sql_mode = 'NO_ENGINE_SUBSTITUTION'");
+
+		return $pdo;
+	}
+}
+
+if (!function_exists('npc_db_insert')) {
+	function npc_db_insert($pdo, $table, array $row) {
+		$columns = '`' . implode('`, `', array_keys($row)) . '`';
+		$marks   = implode(', ', array_fill(0, count($row), '?'));
+
+		$pdo->prepare('INSERT INTO `' . $table . '` (' . $columns . ') VALUES (' . $marks . ')')->execute(array_values($row));
+	}
+}

From 2f9dfa16a12480366624193ec50ff5e4bdb34ae0 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 23:44:09 -0600
Subject: [PATCH 34/41] test: use fixed statements for fixtures and add
 real-database paths

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 tests/E2E/RealServerTest.php           | 65 ++++++++++++++++--
 tests/E2E/support/server.php           |  2 +-
 tests/Integration/NpcDatabaseTest.php  | 92 +++++++++++++++++++++++---
 tests/Integration/support/database.php | 28 ++++++--
 tests/bootstrap-unit.php               | 10 ++-
 5 files changed, 175 insertions(+), 22 deletions(-)

diff --git a/tests/E2E/RealServerTest.php b/tests/E2E/RealServerTest.php
index 94069c7..75d0fbd 100644
--- a/tests/E2E/RealServerTest.php
+++ b/tests/E2E/RealServerTest.php
@@ -90,13 +90,13 @@
 		$username = 'npc_e2e_' . $name;
 
 		$db->prepare('DELETE FROM user_auth WHERE username = ?')->execute(array($username));
-		npc_db_insert($db, 'user_auth', array('username' => $username, 'password' => password_hash($password, PASSWORD_DEFAULT), 'realm' => 0, 'must_change_password' => '', 'password_change' => '', 'enabled' => 'on', 'locked' => ''));
+		npc_db_insert($db, 'user', array($username, password_hash($password, PASSWORD_DEFAULT), 0, '', '', 'on', ''));
 
 		$id = (int) $db->lastInsertId();
 		$state['users'][] = $id;
 
 		foreach ($realms as $realm_id) {
-			npc_db_insert($db, 'user_auth_realm', array('realm_id' => $realm_id, 'user_id' => $id));
+			npc_db_insert($db, 'user_realm', array($realm_id, $id));
 		}
 
 		$state['jars'][$name] = npc_http_login($state['server'], $username, $password, 'login');
@@ -127,11 +127,15 @@
 	}
 
 	/* Rows the listings and the bulk comment deletion read. */
-	npc_db_insert($db, 'npc_objects', array('object_id' => 9300, 'instance_id' => 99, 'objecttype_id' => 1, 'name1' => 'e2ehost'));
-	npc_db_insert($db, 'npc_comments', array('instance_id' => 99, 'object_id' => 9300, 'comment_data' => 'e2e comment', 'author_name' => 'e2e'));
+	npc_db_insert($db, 'object', array(9300, 99, 1, 'e2ehost', ''));
+	npc_db_insert($db, 'comment', array(99, 9300, 'e2e comment', 'e2e'));
+
+	foreach (array('2026-01-01 00:00:01' => 'old=1;1;2', '2026-01-01 00:00:02' => 'rta=0.5ms;100;200;0 pl=0%;20;60;0;100 bad=U') as $time => $perfdata) {
+		npc_db_insert($db, 'host_check', array(99, 9400, $time, $perfdata));
+	}
 
 	for ($i = 0; $i < 1005; $i++) {
-		npc_db_insert($db, 'npc_logentries', array('instance_id' => 99, 'logentry_time' => '2026-01-01 00:00:00', 'entry_time' => '2026-01-01 00:00:00', 'entry_time_usec' => $i, 'logentry_data' => 'e2e entry ' . $i));
+		npc_db_insert($db, 'log_entry', array(99, '2026-01-01 00:00:00', '2026-01-01 00:00:00', $i, 'e2e entry ' . $i));
 	}
 });
 
@@ -161,6 +165,7 @@
 		$db->prepare('DELETE FROM npc_comments WHERE instance_id = ?')->execute(array(99));
 		$db->prepare('DELETE FROM npc_objects WHERE object_id = ?')->execute(array(9300));
 		$db->prepare('DELETE FROM npc_logentries WHERE instance_id = ?')->execute(array(99));
+		$db->prepare('DELETE FROM npc_hostchecks WHERE instance_id = ?')->execute(array(99));
 		$db->prepare('DELETE FROM data_input WHERE name LIKE ?')->execute(array('NPC - Perfdata - e2e%'));
 		$db->prepare('DELETE FROM host WHERE description LIKE ?')->execute(array('e2e import%'));
 	}
@@ -456,3 +461,53 @@ function npc_rs_json($response) {
 	expect($response['status'])->toBe(200);
 	expect(npc_rs_json($response))->toBe(array());
 });
+
+/** Run one of the plugin's command line scripts with Cacti's own command line bootstrap. */
+function npc_rs_cli($script, array $args) {
+	$options = array('-d', 'display_errors=stderr');
+	$env     = array('PATH' => (string) getenv('PATH'));
+
+	if (getenv('NPC_COVERAGE_DIR') !== false) {
+		$options = array_merge($options, npc_e2e_coverage_options());
+		$env    += npc_e2e_coverage_environment();
+	}
+
+	$process = proc_open(
+		array_merge(array(PHP_BINARY), $options, array($script), $args),
+		array(1 => array('pipe', 'w'), 2 => array('pipe', 'w')),
+		$pipes,
+		$GLOBALS['config']['base_path'] . '/plugins/npc',
+		$env
+	);
+
+	$output = stream_get_contents($pipes[1]);
+	$errors = stream_get_contents($pipes[2]);
+	proc_close($process);
+
+	return array($output, $errors);
+}
+
+it('prints the newest host perfdata through the Cacti command line bootstrap', function (string $script, array $args, string $expected) {
+	list($output, $errors) = npc_rs_cli($script, $args);
+
+	expect($errors)->toBe('');
+	expect($output)->toBe($expected);
+})->with(array(
+	'perfdata.php, stored checks'     => array('perfdata.php', array('--type=host', '--id=9400'), "rta:0.5 pl:0 \n"),
+	'perfdata.php, no stored checks'  => array('perfdata.php', array('--type=host', '--id=9401'), "\n"),
+	'cli.php, stored checks'          => array('cli.php', array('--perfdata', '--type=host', '--id=9400'), "rta:0.5 pl:0 \n"),
+	'cli.php, no stored checks'       => array('cli.php', array('--perfdata', '--type=host', '--id=9401'), "\n"),
+));
+
+it('treats a hostile id as a bound value in the command line scripts', function (string $id) {
+	list($output, $errors) = npc_rs_cli('perfdata.php', array('--type=host', '--id=' . $id));
+
+	/* The id is compared as a number, so the leading digits select the host and
+	   the rest is never part of the statement. */
+	expect($errors)->toBe('');
+	expect($output)->toBe("rta:0.5 pl:0 \n");
+	expect($GLOBALS['npc_rs']['db']->query("SHOW TABLES LIKE 'npc\\_hosts'")->rowCount())->toBe(1);
+})->with(array(
+	'quote'     => array("9400' OR '1'='1"),
+	'separator' => array('9400; DROP TABLE npc_hosts'),
+));
diff --git a/tests/E2E/support/server.php b/tests/E2E/support/server.php
index 0c197b8..aa5081c 100644
--- a/tests/E2E/support/server.php
+++ b/tests/E2E/support/server.php
@@ -81,7 +81,7 @@ function npc_server_start() {
 			if ($socket !== false) {
 				fclose($socket);
 
-				return array('process' => $process, 'base' => 'http://127.0.0.1:' . $port . npc_server_url_path(), 'docroot' => $docroot);
+				return array('process' => $process, 'base' => '127.0.0.1:' . $port . npc_server_url_path(), 'docroot' => $docroot);
 			}
 
 			usleep(100000);
diff --git a/tests/Integration/NpcDatabaseTest.php b/tests/Integration/NpcDatabaseTest.php
index ce46682..ceba38c 100644
--- a/tests/Integration/NpcDatabaseTest.php
+++ b/tests/Integration/NpcDatabaseTest.php
@@ -117,7 +117,7 @@
 	$pdo = $GLOBALS['npc_db'];
 
 	for ($i = 1; $i <= 7; $i++) {
-		npc_db_insert($pdo, 'npc_logentries', array('instance_id' => 99, 'logentry_time' => '2026-01-01 00:00:0' . $i, 'entry_time' => '2026-01-01 00:00:0' . $i, 'logentry_data' => 'entry ' . $i));
+		npc_db_insert($pdo, 'log_entry', array(99, '2026-01-01 00:00:0' . $i, '2026-01-01 00:00:0' . $i, 0, 'entry ' . $i));
 	}
 
 	$controller              = new NpcLogentriesController();
@@ -133,20 +133,20 @@
 it('lists each service once however many hostgroups its host belongs to', function () {
 	$pdo = $GLOBALS['npc_db'];
 
-	npc_db_insert($pdo, 'npc_instances', array('instance_id' => 99, 'instance_name' => 'default'));
-	npc_db_insert($pdo, 'npc_objects', array('object_id' => 9100, 'instance_id' => 99, 'objecttype_id' => 1, 'name1' => 'web1'));
+	npc_db_insert($pdo, 'instance', array(99, 'default'));
+	npc_db_insert($pdo, 'object', array(9100, 99, 1, 'web1', ''));
 
 	foreach (array(9101 => 'Load', 9102 => 'Disk') as $id => $description) {
-		npc_db_insert($pdo, 'npc_objects', array('object_id' => $id, 'instance_id' => 99, 'objecttype_id' => 2, 'name1' => 'web1', 'name2' => $description));
-		npc_db_insert($pdo, 'npc_services', array('instance_id' => 99, 'config_type' => 1, 'host_object_id' => 9100, 'service_object_id' => $id));
-		npc_db_insert($pdo, 'npc_servicestatus', array('instance_id' => 99, 'service_object_id' => $id, 'current_state' => 0));
+		npc_db_insert($pdo, 'object', array($id, 99, 2, 'web1', $description));
+		npc_db_insert($pdo, 'service', array(99, 1, 9100, $id));
+		npc_db_insert($pdo, 'service_status', array(99, $id, 0));
 	}
 
-	npc_db_insert($pdo, 'npc_hosts', array('instance_id' => 99, 'config_type' => 1, 'host_object_id' => 9100, 'alias' => 'web1'));
+	npc_db_insert($pdo, 'host', array(99, 1, 9100, 'web1'));
 
 	foreach (array(9201 => 'web servers', 9202 => 'linux servers') as $object_id => $alias) {
-		npc_db_insert($pdo, 'npc_hostgroups', array('hostgroup_id' => $object_id, 'instance_id' => 99, 'config_type' => 1, 'hostgroup_object_id' => $object_id, 'alias' => $alias));
-		npc_db_insert($pdo, 'npc_hostgroup_members', array('instance_id' => 99, 'hostgroup_id' => $object_id, 'host_object_id' => 9100));
+		npc_db_insert($pdo, 'hostgroup', array($object_id, 99, 1, $object_id, $alias));
+		npc_db_insert($pdo, 'hostgroup_member', array(99, $object_id, 9100));
 	}
 
 	$services = new NpcServicesController();
@@ -166,7 +166,7 @@
 	$pdo = $GLOBALS['npc_db'];
 
 	foreach (array('2026-01-01 00:00:01' => 'old=1', '2026-01-01 00:00:02' => 'mid=2', '2026-01-01 00:00:03' => 'new=3') as $time => $perfdata) {
-		npc_db_insert($pdo, 'npc_hostchecks', array('instance_id' => 99, 'host_object_id' => 9100, 'start_time' => $time, 'perfdata' => $perfdata));
+		npc_db_insert($pdo, 'host_check', array(99, 9100, $time, $perfdata));
 	}
 
 	$rows = (new NpcHostsController())->getPerfData(9100);
@@ -189,3 +189,75 @@
 
 	expect(db_column_exists('npc_contacts', 'minimum_importance'))->toBeTrue();
 });
+
+/** The stored settings of every user row, keyed by user id. */
+function npc_db_settings_users($pdo) {
+	return array_map('intval', $pdo->query('SELECT user_id FROM npc_settings ORDER BY user_id')->fetchAll(PDO::FETCH_COLUMN));
+}
+
+it('removes the settings of deleted users and creates those of new users', function () {
+	$pdo = $GLOBALS['npc_db'];
+
+	if ($pdo->query("SHOW TABLES LIKE 'user_auth'")->rowCount() === 0) {
+		$this->markTestSkipped('Cacti user table is not available.');
+	}
+
+	npc_db_insert($pdo, 'user', array('npc_db_new_user', 'x', 0, '', '', 'on', ''));
+	$new = (int) $pdo->lastInsertId();
+	npc_db_insert($pdo, 'user_settings', array(987654321, 'a:0:{}'));
+
+	$_SESSION['sess_user_id']        = 1;
+	$GLOBALS['npc_default_settings'] = array('date_format' => 's:Y-m-d');
+	$GLOBALS['__test_pdo']           = $pdo;
+
+	$version = $pdo->query("SELECT version FROM plugin_config WHERE directory = 'npc'")->fetchColumn();
+
+	npc_config_settings();
+
+	unset($_SESSION['sess_user_id']);
+
+	$kept = npc_db_settings_users($pdo);
+
+	expect($kept)->toContain($new);
+	expect($kept)->not->toContain(987654321);
+	expect($pdo->query("SELECT version FROM plugin_config WHERE directory = 'npc'")->fetchColumn())->toBe($version);
+});
+
+it('runs the upgrade against the real tables when the stored version is old', function () {
+	$pdo = $GLOBALS['npc_db'];
+
+	if ($pdo->query("SHOW TABLES LIKE 'plugin_config'")->rowCount() === 0) {
+		$this->markTestSkipped('Cacti plugin table is not available.');
+	}
+
+	/* The prune step of the upgrade works on base_path/plugins/npc, so it gets a
+	   copy of the layout and never the real plugin directory. */
+	$base = sys_get_temp_dir() . '/npc-upgrade-' . uniqid();
+	mkdir($base . '/plugins/npc/tests', 0777, true);
+	file_put_contents($base . '/plugins/npc/INFO', "[info]\nversion = 9.9.9\nname = npc\nauthor = x\n");
+	file_put_contents($base . '/plugins/npc/manifest.json', json_encode(array('tombstones' => array(), 'expected' => array('INFO', 'manifest.json'), 'whitelist' => array())));
+	file_put_contents($base . '/plugins/npc/tests/marker.txt', 'x');
+
+	$realTests = dirname(__DIR__);
+
+	$pdo->prepare("UPDATE plugin_config SET version = ? WHERE directory = 'npc'")->execute(array('0.1'));
+	npc_db_insert($pdo, 'user_settings', array(987654322, 'a:0:{}'));
+
+	$restore                        = $GLOBALS['config']['base_path'];
+	$GLOBALS['config']['base_path'] = $base;
+	$GLOBALS['__test_pdo']          = $pdo;
+	$_SESSION['sess_user_id']       = 1;
+
+	try {
+		npc_config_settings();
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+		unset($_SESSION['sess_user_id']);
+	}
+
+	expect($pdo->query("SELECT version FROM plugin_config WHERE directory = 'npc'")->fetchColumn())->toBe('9.9.9');
+	expect(npc_db_settings_users($pdo))->not->toContain(987654322);
+	expect(file_exists($base . '/plugins/npc/tests'))->toBeFalse();
+	expect(is_dir($realTests))->toBeTrue();
+	expect(is_dir(dirname(__DIR__) . '/Integration'))->toBeTrue();
+});
diff --git a/tests/Integration/support/database.php b/tests/Integration/support/database.php
index 99d1437..0cac30e 100644
--- a/tests/Integration/support/database.php
+++ b/tests/Integration/support/database.php
@@ -75,10 +75,30 @@ function npc_db_connect() {
 }
 
 if (!function_exists('npc_db_insert')) {
-	function npc_db_insert($pdo, $table, array $row) {
-		$columns = '`' . implode('`, `', array_keys($row)) . '`';
-		$marks   = implode(', ', array_fill(0, count($row), '?'));
+	/**
+	 * Insert one fixture row with one of the fixed statements below.
+	 *
+	 * @param PDO    $pdo       connection
+	 * @param string $statement key of npc_db_statements()
+	 * @param array  $values    values in the order of the statement's columns
+	 */
+	function npc_db_insert($pdo, $statement, array $values) {
+		$statements = array(
+			'user'              => 'INSERT INTO user_auth (username, password, realm, must_change_password, password_change, enabled, locked) VALUES (?, ?, ?, ?, ?, ?, ?)',
+			'user_realm'        => 'INSERT INTO user_auth_realm (realm_id, user_id) VALUES (?, ?)',
+			'instance'          => 'INSERT INTO npc_instances (instance_id, instance_name) VALUES (?, ?)',
+			'object'            => 'INSERT INTO npc_objects (object_id, instance_id, objecttype_id, name1, name2) VALUES (?, ?, ?, ?, ?)',
+			'comment'           => 'INSERT INTO npc_comments (instance_id, object_id, comment_data, author_name) VALUES (?, ?, ?, ?)',
+			'log_entry'         => 'INSERT INTO npc_logentries (instance_id, logentry_time, entry_time, entry_time_usec, logentry_data) VALUES (?, ?, ?, ?, ?)',
+			'host'              => 'INSERT INTO npc_hosts (instance_id, config_type, host_object_id, alias) VALUES (?, ?, ?, ?)',
+			'service'           => 'INSERT INTO npc_services (instance_id, config_type, host_object_id, service_object_id) VALUES (?, ?, ?, ?)',
+			'service_status'    => 'INSERT INTO npc_servicestatus (instance_id, service_object_id, current_state) VALUES (?, ?, ?)',
+			'hostgroup'         => 'INSERT INTO npc_hostgroups (hostgroup_id, instance_id, config_type, hostgroup_object_id, alias) VALUES (?, ?, ?, ?, ?)',
+			'hostgroup_member'  => 'INSERT INTO npc_hostgroup_members (instance_id, hostgroup_id, host_object_id) VALUES (?, ?, ?)',
+			'host_check'        => 'INSERT INTO npc_hostchecks (instance_id, host_object_id, start_time, perfdata) VALUES (?, ?, ?, ?)',
+			'user_settings'     => 'INSERT INTO npc_settings (user_id, settings) VALUES (?, ?)',
+		);
 
-		$pdo->prepare('INSERT INTO `' . $table . '` (' . $columns . ') VALUES (' . $marks . ')')->execute(array_values($row));
+		$pdo->prepare($statements[$statement])->execute($values);
 	}
 }
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index db15ec8..1096e14 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -227,7 +227,10 @@ function db_index_exists($table, $index, $log = true, $db_conn = false) {
 if (!function_exists('db_column_exists')) {
 	function db_column_exists($table, $column, $log = true, $db_conn = false) {
 		if (isset($GLOBALS['__test_pdo'])) {
-			return $GLOBALS['__test_pdo']->query('SHOW COLUMNS FROM `' . $table . "` LIKE '" . $column . "'")->rowCount() > 0;
+			$lookup = $GLOBALS['__test_pdo']->prepare('SELECT 1 FROM information_schema.columns WHERE table_schema = DATABASE() AND table_name = ? AND column_name = ?');
+			$lookup->execute(array($table, $column));
+
+			return $lookup->rowCount() > 0;
 		}
 
 		return false;
@@ -237,7 +240,10 @@ function db_column_exists($table, $column, $log = true, $db_conn = false) {
 if (!function_exists('db_table_exists')) {
 	function db_table_exists($table, $log = true, $db_conn = false) {
 		if (isset($GLOBALS['__test_pdo'])) {
-			return $GLOBALS['__test_pdo']->query("SHOW TABLES LIKE '" . $table . "'")->rowCount() > 0;
+			$lookup = $GLOBALS['__test_pdo']->prepare('SELECT 1 FROM information_schema.tables WHERE table_schema = DATABASE() AND table_name = ?');
+			$lookup->execute(array($table));
+
+			return $lookup->rowCount() > 0;
 		}
 
 		return false;

From 5547d6148f411bacb0e707b7efe53cb0948d5020 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 23:45:16 -0600
Subject: [PATCH 35/41] fix: log a fixed message for a host selection that is
 not JSON

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                  |  2 +
 controllers/sync.php          |  2 +-
 tests/Unit/SyncImportTest.php | 82 +++++++++++++++++++++++++++++++++++
 3 files changed, 85 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a41fe7e..a31813c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* issue: Log a fixed message when the host import selection is not a JSON object;
+  the old message converted an array to a string
 * issue: Cast the date format, time format and Nagios URL settings to strings in the
   NPC frame; unsaved settings raised the PHP 8.1 null deprecation on every page
 * dev: Run the schema and the listing, perfdata and upgrade queries against MariaDB
diff --git a/controllers/sync.php b/controllers/sync.php
index ed0793b..9b502d7 100644
--- a/controllers/sync.php
+++ b/controllers/sync.php
@@ -122,7 +122,7 @@ function getHosts($params) {
         $data = json_decode(stripslashes($params['data']));
 
         if (!is_object($data)) {
-            return($this->logger('error', get_class($this), __FUNCTION__ , "json_decode(".$params['data'].") returned: $data"));
+            return($this->logger('error', get_class($this), __FUNCTION__ , 'The host selection is not a JSON object'));
         }
 
         $results = array();
diff --git a/tests/Unit/SyncImportTest.php b/tests/Unit/SyncImportTest.php
index 473bc12..db22cf2 100644
--- a/tests/Unit/SyncImportTest.php
+++ b/tests/Unit/SyncImportTest.php
@@ -290,3 +290,85 @@ function npc_sync_cache_run($ip, $cache_id, $prepare = null) {
 
 	expect(json_decode($out, true))->toBe(array());
 });
+
+it('passes hostile description values through as one argument', function (string $description) {
+	$base = npc_sync_sandbox();
+
+	$out = npc_sync_unmapped_controller()->import(array(
+		'config'         => array('base_path' => $base),
+		'description'    => $description,
+		'host_object_id' => 10,
+		'ip'             => '192.0.2.10',
+		'cache_id'       => 'k',
+		'template_id'    => 7,
+	));
+
+	expect($out)->toBe($description . '|1|1|Success - new device-id: (12)');
+	expect(json_decode(file_get_contents($base . '/cli/argv.json'), true)[0])->toBe('--description=' . $description);
+	expect(glob($base . '/*'))->toBe(array($base . '/cli'));
+})->with(array(
+	'single quote'          => array("web1' ; echo extra ; '"),
+	'double quote'          => array('web1" ; echo extra ; "'),
+	'command substitution'  => array('web1 $(echo extra)'),
+	'backticks'             => array('web1 `echo extra`'),
+	'redirect and pipe'     => array('web1 > out.txt | cat'),
+	'new line'              => array("web1\necho extra"),
+	'option like text'      => array('--ip=203.0.113.9 --template=1'),
+	'ampersands only'       => array('&& &'),
+))->skip(trim((string) shell_exec('command -v php')) === '', 'php binary is not on PATH');
+
+it('reports a failed import when add_device.php prints no device id', function () {
+	$base = sys_get_temp_dir() . '/npc-sync-' . uniqid();
+	mkdir($base . '/cli', 0777, true);
+	file_put_contents($base . '/cli/add_device.php', "<?php\nprint \"ERROR: Template 7 does not exist\\n\";\nexit(1);\n");
+
+	$out = npc_sync_unmapped_controller()->import(array(
+		'config'         => array('base_path' => $base),
+		'description'    => 'web1',
+		'host_object_id' => 10,
+		'ip'             => '192.0.2.10',
+		'cache_id'       => 'k',
+		'template_id'    => 7,
+	));
+
+	expect($out)->toBe('web1|');
+	expect($GLOBALS['__test_db_calls'])->toBe(array());
+})->skip(trim((string) shell_exec('command -v php')) === '', 'php binary is not on PATH');
+
+it('does not map a host when the import prints a malformed device id', function () {
+	$base = sys_get_temp_dir() . '/npc-sync-' . uniqid();
+	mkdir($base . '/cli', 0777, true);
+	file_put_contents($base . '/cli/add_device.php', "<?php\nprint \"Success - new device-id: ()\\n\";\n");
+
+	$out = npc_sync_unmapped_controller()->import(array(
+		'config'         => array('base_path' => $base),
+		'description'    => 'web1',
+		'host_object_id' => 10,
+		'ip'             => '192.0.2.10',
+		'cache_id'       => 'k',
+		'template_id'    => 7,
+	));
+
+	expect($out)->toBe('web1|1|1|Success - new device-id: ()');
+})->skip(trim((string) shell_exec('command -v php')) === '', 'php binary is not on PATH');
+
+it('answers an unknown address with null from a current cache', function () {
+	list($found) = npc_sync_cache_run('203.0.113.9', 'k1', function ($file) {
+		file_put_contents($file, json_encode(array('key' => 'k1', 'hosts' => array('10.0.0.1' => 7))));
+	});
+
+	expect($found)->toBeNull();
+	expect($GLOBALS['__test_db_fetch_log'])->toBe(array());
+});
+
+it('reports a selection that is not a JSON object', function (string $data) {
+	$out = json_decode((new NpcSyncController())->getHosts(array('data' => $data)), true);
+
+	expect($out['success'])->toBeFalse();
+	expect($out['msg'])->toBe('An error occurred in NpcSyncController::getHosts. See error logs for detail.');
+})->with(array(
+	'plain text'    => array('web servers'),
+	'broken JSON'   => array('{"g1":'),
+	'a JSON list'   => array('["web servers"]'),
+	'empty string'  => array(''),
+));

From 28adb8a7613472480adfbfae969d7bceeb320f9d Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 23:46:23 -0600
Subject: [PATCH 36/41] fix: return an empty definition for an unknown Nagios
 command

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                        |  2 ++
 nagioscmd.php                       |  2 +-
 phpunit.xml                         |  1 +
 tests/Unit/NagiosControllerTest.php | 39 +++++++++++++++++++++++++++++
 4 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a31813c..ebad312 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* issue: Return an empty definition for an unknown Nagios command instead of raising
+  undefined index and foreach warnings before the not a valid command message
 * issue: Log a fixed message when the host import selection is not a JSON object;
   the old message converted an array to a string
 * issue: Cast the date format, time format and Nagios URL settings to strings in the
diff --git a/nagioscmd.php b/nagioscmd.php
index 52d9737..32f1383 100644
--- a/nagioscmd.php
+++ b/nagioscmd.php
@@ -1643,7 +1643,7 @@ function getCommand() {
      */
     function getCommands($cmd=null) {
         if ($cmd) {
-            return($this->commands[$cmd]);
+            return(isset($this->commands[$cmd]) ? $this->commands[$cmd] : array());
         }
         return($this->commands);
     }
diff --git a/phpunit.xml b/phpunit.xml
index 493d1f2..2990188 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -29,6 +29,7 @@
     <source>
         <include>
             <file>setup.php</file>
+            <file>nagioscmd.php</file>
             <directory suffix=".php">controllers</directory>
         </include>
     </source>
diff --git a/tests/Unit/NagiosControllerTest.php b/tests/Unit/NagiosControllerTest.php
index 1ff0eff..73f3182 100644
--- a/tests/Unit/NagiosControllerTest.php
+++ b/tests/Unit/NagiosControllerTest.php
@@ -52,3 +52,42 @@
 	expect($out)->toBe(array('success' => true));
 	expect(file_get_contents($file))->toMatch('/^\\[\\d+\\] ENABLE_NOTIFICATIONS\\n$/');
 });
+
+it('reports each missing piece of the command setup', function (array $config, string $message) {
+	$GLOBALS['__test_config'] = $config;
+
+	$out = json_decode((new NpcNagiosController())->command(array('command' => 'ENABLE_NOTIFICATIONS')), true);
+
+	expect($out['success'])->toBeFalse();
+	expect($out['msg'])->toContain($message);
+})->with(array(
+	'commands disabled'     => array(array(), 'Remote Commands must be enabled'),
+	'no command file path'  => array(array('npc_nagios_commands' => '1'), 'Command File Path must be set'),
+	'command file missing'  => array(array('npc_nagios_commands' => '1', 'npc_nagios_cmd_path' => '/nonexistent/nagios.cmd'), 'does not exist'),
+));
+
+it('rejects an unknown command and one with a missing parameter without touching the file', function (array $params, string $message) {
+	$file = sys_get_temp_dir() . '/npc-cmd-' . uniqid();
+	file_put_contents($file, '');
+	$GLOBALS['__test_config'] = array('npc_nagios_commands' => '1', 'npc_nagios_cmd_path' => $file);
+
+	$out = json_decode((new NpcNagiosController())->command($params), true);
+
+	expect($out['success'])->toBeFalse();
+	expect($out['msg'])->toContain($message);
+	expect(file_get_contents($file))->toBe('');
+})->with(array(
+	'unknown command'    => array(array('command' => 'FORMAT_DISK'), 'is not a valid command'),
+	'missing parameter'  => array(array('command' => 'ADD_HOST_COMMENT', 'host_name' => 'web1'), 'Missing required parameter'),
+	'boolean out of range' => array(array('command' => 'ADD_HOST_COMMENT', 'host_name' => 'web1', 'persistent' => '5', 'author' => 'a', 'comment' => 'c'), 'must be equal to 1 or 0'),
+));
+
+it('turns line breaks in a comment into markup and drops semicolons', function () {
+	$file = sys_get_temp_dir() . '/npc-cmd-' . uniqid();
+	file_put_contents($file, '');
+	$GLOBALS['__test_config'] = array('npc_nagios_commands' => '1', 'npc_nagios_cmd_path' => $file);
+
+	(new NpcNagiosController())->command(array('command' => 'ADD_HOST_COMMENT', 'host_name' => 'web1', 'persistent' => 'true', 'author' => 'ann', 'comment' => "one\ntwo;three&nbsp;four"));
+
+	expect(preg_replace('/^\[\d+\] /', '', trim(file_get_contents($file))))->toBe('ADD_HOST_COMMENT;web1;1;ann;one<br />two three four');
+});

From 10bade0689caf7093deafcd3ad4cdc652b282c9b Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 23:47:30 -0600
Subject: [PATCH 37/41] fix: treat a missing searchFields value as empty

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                      |  2 ++
 controllers/controller.php        |  2 +-
 tests/E2E/FrontControllerTest.php | 23 +++++++++++++++++
 tests/Unit/ControllerBaseTest.php | 43 +++++++++++++++++++++++++++++++
 4 files changed, 69 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ebad312..1aeda06 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* issue: Treat a missing searchFields value as empty in the grid search; a search
+  string without it raised the PHP 8.1 null deprecation
 * issue: Return an empty definition for an unknown Nagios command instead of raising
   undefined index and foreach warnings before the not a valid command message
 * issue: Log a fixed message when the host import selection is not a JSON object;
diff --git a/controllers/controller.php b/controllers/controller.php
index e2434ad..4ec0de5 100644
--- a/controllers/controller.php
+++ b/controllers/controller.php
@@ -380,7 +380,7 @@ function flattenArray($array=array()) {
      * @return string  The appended where clause
      */
 	function searchClause($where, $fieldMap, &$params = array()) {
-		$fields = json_decode(stripslashes($this->searchFields));
+		$fields = json_decode(stripslashes((string) $this->searchFields));
 		if (!is_array($fields)) {
 			return $where;
 		}
diff --git a/tests/E2E/FrontControllerTest.php b/tests/E2E/FrontControllerTest.php
index 92556a0..85623ff 100644
--- a/tests/E2E/FrontControllerTest.php
+++ b/tests/E2E/FrontControllerTest.php
@@ -164,3 +164,26 @@
 
 	expect((string) $output)->toBe('');
 });
+
+it('treats an array given for a JSON request value as empty', function (string $name) {
+	$run = npc_e2e_run(array('get' => array('module' => 'logentries', 'action' => 'getLogs', 'p_searchString' => 'x', $name => array('a', 'b'))));
+
+	$count = npc_e2e_calls($run, 'db_fetch_cell_prepared');
+
+	expect($run['stderr'])->toBe('');
+	expect($count[0]['sql'])->not->toContain('LIKE');
+})->with(array('p_searchFields', 'p_data'));
+
+it('reports a host import selection that is not a JSON object', function () {
+	$run = npc_e2e_run(array('get' => array('module' => 'sync', 'action' => 'getHosts', 'p_data' => array('x'))));
+
+	expect($run['stderr'])->toBe('');
+	expect(json_decode($run['stdout'], true)['success'])->toBeFalse();
+});
+
+it('refuses the same state-changing action for other methods', function (string $method) {
+	$run = npc_e2e_run(array('method' => $method, 'get' => array('module' => 'nagios', 'action' => 'command', 'p_command' => 'ENABLE_NOTIFICATIONS')));
+
+	expect(json_decode($run['stdout'], true)['success'])->toBeFalse();
+	expect(npc_e2e_calls($run, 'db_execute_prepared'))->toBe(array());
+})->with(array('PUT', 'DELETE', 'HEAD', 'PATCH'));
diff --git a/tests/Unit/ControllerBaseTest.php b/tests/Unit/ControllerBaseTest.php
index 5f04c2f..970807f 100644
--- a/tests/Unit/ControllerBaseTest.php
+++ b/tests/Unit/ControllerBaseTest.php
@@ -259,3 +259,46 @@
 	$ctrl = new Controller();
 	expect($ctrl->start)->toBe(0);
 });
+
+// ---------------------------------------------------------------------------
+// searchClause()
+// ---------------------------------------------------------------------------
+
+it('searchClause leaves the clause alone when no search fields were sent', function () {
+	$ctrl               = new Controller();
+	$ctrl->searchString = 'web';
+	$params             = array();
+
+	expect($ctrl->searchClause('', array('host_name' => 'o.name1'), $params))->toBe('');
+	expect($params)->toBe(array());
+});
+
+it('searchClause ignores fields that are not in the field map', function () {
+	$ctrl               = new Controller();
+	$ctrl->searchString = 'web';
+	$ctrl->searchFields = '["host_name","evil; DROP TABLE x"]';
+	$params             = array();
+
+	$where = $ctrl->searchClause('hs.current_state IN (0)', array('host_name' => 'o.name1'), $params);
+
+	expect($where)->toBe('hs.current_state IN (0) AND ( o.name1 LIKE ? ) ');
+	expect($params)->toBe(array('%web%'));
+});
+
+it('searchClause leaves the clause alone when no field matches', function () {
+	$ctrl               = new Controller();
+	$ctrl->searchFields = '["nothing"]';
+	$params             = array();
+
+	expect($ctrl->searchClause('a = 1', array('host_name' => 'o.name1'), $params))->toBe('a = 1');
+});
+
+it('searchClause combines several fields with OR', function () {
+	$ctrl               = new Controller();
+	$ctrl->searchString = '50%';
+	$ctrl->searchFields = '["host_name","alias"]';
+	$params             = array();
+
+	expect($ctrl->searchClause('', array('host_name' => 'o.name1', 'alias' => 'h.alias'), $params))->toBe(' ( o.name1 LIKE ? OR h.alias LIKE ? ) ');
+	expect($params)->toBe(array('%50%%', '%50%%'));
+});

From 93c77f86f6943c48ce608fec4240f780b6e3d050 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 23:48:36 -0600
Subject: [PATCH 38/41] test: cover denied, empty and hostile input for the
 changed actions

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 tests/Unit/CactiControllerTest.php    | 37 +++++++++++++++++++++++++++
 tests/Unit/CommentsControllerTest.php | 23 +++++++++++++++++
 tests/Unit/HostsControllerTest.php    |  4 +++
 tests/Unit/NpcUpgradeTest.php         | 33 ++++++++++++++++++++++++
 4 files changed, 97 insertions(+)

diff --git a/tests/Unit/CactiControllerTest.php b/tests/Unit/CactiControllerTest.php
index dd6b1fd..eb08601 100644
--- a/tests/Unit/CactiControllerTest.php
+++ b/tests/Unit/CactiControllerTest.php
@@ -62,3 +62,40 @@
 	expect($GLOBALS['__test_sql_save'][0]['row']['input_string'])->toContain('--type=service --id=');
 	expect($GLOBALS['__test_db_calls'])->toBe(array());
 });
+
+it('stores the host and service names of a data input method as text', function (string $host) {
+	(new NpcCactiController())->addDataInputMethod(array('host' => $host, 'service' => $host, 'object_id' => '12'));
+
+	$row = $GLOBALS['__test_sql_save'][0]['row'];
+
+	expect($row['name'])->toBe('NPC - Perfdata - ' . $host . ': ' . $host);
+	expect($row['input_string'])->toBe("php <path_cacti>/plugins/npc/perfdata.php --type=service --id='12' 2> /dev/null");
+})->with(array(
+	'quotes'          => array("web1' OR '1'='1"),
+	'markup'          => array('<b>web1</b>'),
+	'shell characters' => array('web1; touch the-marker'),
+));
+
+it('quotes a hostile object id in the stored command', function (string $object_id, string $expected) {
+	(new NpcCactiController())->addDataInputMethod(array('host' => 'web1', 'object_id' => $object_id));
+
+	expect($GLOBALS['__test_sql_save'][0]['row']['input_string'])->toBe('php <path_cacti>/plugins/npc/perfdata.php --type=host --id=' . $expected . ' 2> /dev/null');
+})->with(array(
+	'plain number'      => array('12', "'12'"),
+	'command separator' => array('12; id', "'12; id'"),
+	'quote'             => array("12' id", "'12'\\'' id'"),
+));
+
+it('refuses the data input method to a user without the realm whatever the input', function (array $params) {
+	$GLOBALS['__test_denied_realms'] = array('data_input.php');
+
+	$out = json_decode((new NpcCactiController())->addDataInputMethod($params), true);
+
+	expect($out['success'])->toBeFalse();
+	expect($GLOBALS['__test_sql_save'])->toBe(array());
+	expect($GLOBALS['__test_db_calls'])->toBe(array());
+})->with(array(
+	'host check'    => array(array('host' => 'web1', 'object_id' => '12')),
+	'service check' => array(array('host' => 'web1', 'service' => 'Load', 'object_id' => '12')),
+	'nothing'       => array(array()),
+));
diff --git a/tests/Unit/CommentsControllerTest.php b/tests/Unit/CommentsControllerTest.php
index 6debad7..14bf9bd 100644
--- a/tests/Unit/CommentsControllerTest.php
+++ b/tests/Unit/CommentsControllerTest.php
@@ -75,3 +75,26 @@ function npc_comments_commands($reader) {
 
 	expect(npc_comments_commands($reader))->toBe(array('DEL_ALL_SVC_COMMENTS;web1;Load', 'DEL_ALL_SVC_COMMENTS;web1;Disk'));
 })->skip(!function_exists('posix_mkfifo'), 'posix extension is not loaded');
+
+it('writes nothing when there are no comments', function () {
+	$reader = npc_comments_command_pipe();
+
+	(new NpcCommentsController())->deleteAllHostComments();
+	(new NpcCommentsController())->deleteAllServiceComments();
+
+	expect(npc_comments_commands($reader))->toBe(array());
+})->skip(!function_exists('posix_mkfifo'), 'posix extension is not loaded');
+
+it('writes nothing when the user lacks the command realm', function () {
+	$reader = npc_comments_command_pipe();
+
+	$GLOBALS['__test_denied_realms']                                           = array('npc1.php');
+	$GLOBALS['__test_db_results']['db_fetch_assoc_prepared']['FROM npc_comments'] = array(array('host_name' => 'web1', 'service_description' => 'Load', 'comment_data' => 'a'));
+
+	(new NpcCommentsController())->deleteAllHostComments();
+	(new NpcCommentsController())->deleteAllServiceComments();
+
+	$GLOBALS['__test_denied_realms'] = array();
+
+	expect(npc_comments_commands($reader))->toBe(array());
+})->skip(!function_exists('posix_mkfifo'), 'posix extension is not loaded');
diff --git a/tests/Unit/HostsControllerTest.php b/tests/Unit/HostsControllerTest.php
index 5218aa7..8f24ac8 100644
--- a/tests/Unit/HostsControllerTest.php
+++ b/tests/Unit/HostsControllerTest.php
@@ -32,3 +32,7 @@
 	expect(preg_replace('/\s+/', ' ', $query['sql']))->toContain('WHERE host_object_id = ? ORDER BY hostcheck_id DESC LIMIT 1');
 	expect($query['params'])->toBe(array(12));
 });
+
+it('returns no rows when a host has no stored check', function () {
+	expect((new NpcHostsController())->getPerfData(12))->toBe(array());
+});
diff --git a/tests/Unit/NpcUpgradeTest.php b/tests/Unit/NpcUpgradeTest.php
index ecd17ab..ebfec28 100644
--- a/tests/Unit/NpcUpgradeTest.php
+++ b/tests/Unit/NpcUpgradeTest.php
@@ -101,3 +101,36 @@
 
 	expect($deletes)->toBe(array());
 });
+
+it('does nothing for the settings of users when nobody is logged in', function () {
+	unset($_SESSION['sess_user_id']);
+
+	npc_config_settings();
+
+	expect($GLOBALS['__test_db_calls'])->toBe(array());
+});
+
+it('leaves the settings alone when the plugin is not enabled', function () {
+	$_SESSION['sess_user_id']                                         = 1;
+	$GLOBALS['__test_db_results']['db_fetch_cell_prepared']['status'] = '0';
+	$GLOBALS['__test_db_results']['db_fetch_assoc']['FROM npc_settings'] = array(array('user_id' => 9));
+
+	npc_config_settings();
+
+	expect($GLOBALS['__test_db_calls'])->toBe(array());
+});
+
+it('does not touch the schema when the stored version is current', function () {
+	$_SESSION['sess_user_id']                                         = 1;
+	$GLOBALS['npc_default_settings']                                  = array();
+	$GLOBALS['__test_db_results']['db_fetch_cell_prepared']['status'] = '1';
+	$GLOBALS['__test_db_results']['db_fetch_cell']['SELECT version FROM plugin_config'] = plugin_npc_version()['version'];
+
+	npc_config_settings();
+
+	$alters = array_filter(array_column($GLOBALS['__test_db_calls'], 'sql'), function ($sql) {
+		return stripos($sql, 'ALTER TABLE') !== false || stripos($sql, 'UPDATE plugin_config') !== false;
+	});
+
+	expect($alters)->toBe(array());
+});

From 72058d2a861e2a0072d17a5e6c1aaae5f56044a7 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 23:49:42 -0600
Subject: [PATCH 39/41] test: cover the detail dialogs, comment deletion,
 filters and routing in the front end

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 tests/js/npc.test.js | 173 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 173 insertions(+)

diff --git a/tests/js/npc.test.js b/tests/js/npc.test.js
index f939bab..a478aec 100644
--- a/tests/js/npc.test.js
+++ b/tests/js/npc.test.js
@@ -253,3 +253,176 @@ test('reports a failed command to the user', () => {
 
 	assert.deepStrictEqual(env.alerts, ['Missing required parameter: persistent']);
 });
+
+const serviceRows = [{host_name: 'web1', service_description: quoted, service_object_id: 3, current_state: 2, output: 'high', last_check: 't'}];
+
+function clickHandler(env, key, data) {
+	return env.handlers[key].call({__data: data}, {preventDefault() {}});
+}
+
+test('opens the host detail dialog with the host name escaped in its title', () => {
+	const rows = [{host_object_id: 10, host_name: quoted, address: 'x', current_state: 1, output: 'down', last_check: 't'}];
+	const env  = load({responses: {'hosts/getHosts': gridResponse(rows)}});
+
+	env.npc.route('hosts');
+	clickHandler(env, '#npc-host-table click .npc-host-link', {id: 10});
+
+	assert.strictEqual(env.requests[env.requests.length - 1].params.p_id, 10);
+	assert.match(env.dialogs[0].markup, /^<div title="Host Detail: a&quot;b&#39;c">/);
+	assert.match(env.dialogs[0].markup, /Down/);
+});
+
+test('shows nothing when the host detail request finds no host', () => {
+	const env = load({responses: {'hosts/getHosts': gridResponse([])}});
+
+	env.npc.showHostDetail(10);
+
+	assert.strictEqual(env.dialogs.length, 0);
+});
+
+test('opens the service detail dialog with the description escaped in its title', () => {
+	const env = load({responses: {'services/getServices': gridResponse(serviceRows)}});
+
+	env.npc.route('services');
+	clickHandler(env, '#npc-svc-table click .npc-svc-link', {id: 3});
+
+	assert.match(env.dialogs[0].markup, /^<div title="Service Detail: a&quot;b&#39;c">/);
+	assert.match(env.dialogs[0].markup, /Critical/);
+});
+
+test('shows nothing when the service detail request finds no service', () => {
+	const env = load({responses: {'services/getServices': gridResponse([])}});
+
+	env.npc.showServiceDetail(3);
+
+	assert.strictEqual(env.dialogs.length, 0);
+});
+
+test('submits a service command with the service and the completed values', () => {
+	const env = load({responses: {'services/getServices': gridResponse(serviceRows)}, forms: {'#npc-svc-cmd-form': [
+		{name: 'p_command', value: 'SCHEDULE_SVC_DOWNTIME'},
+		{name: 'p_host_name', value: 'web1'},
+		{name: 'p_service_description', value: 'Load'},
+		{name: 'duration_minutes', value: '15'}
+	]}});
+
+	env.npc.route('services');
+	clickHandler(env, '#npc-svc-table click .npc-svc-cmd-link', {host: 'web1', svc: 'Load'});
+
+	assert.match(env.dialogs[0].markup, /title="Service Command: Load"/);
+	assert.match(env.dialogs[0].markup, /name="p_service_description" value="Load"/);
+
+	env.dialogs[0].settings.buttons.Submit.call({dialog() {}});
+
+	const post = env.requests.filter((request) => request.method === 'POST')[0].params;
+	assert.strictEqual(post.p_duration, 900);
+	assert.strictEqual(post.p_fixed, 1);
+	assert.strictEqual(post.p_end_time - post.p_start_time, 900);
+	assert.strictEqual(post.duration_minutes, undefined);
+});
+
+test('closes a command dialog on cancel without sending anything', () => {
+	const env = openHostDialog({});
+
+	env.dialogs[0].settings.buttons.Cancel.call({dialog() {}});
+
+	assert.strictEqual(env.requests.filter((request) => request.method === 'POST').length, 0);
+});
+
+const commentRows = [{host_name: 'web1', author_name: 'ann', comment_data: 'x', comment_time: 't', is_persistent: 0, internal_comment_id: 4}];
+
+function commentEnv() {
+	return load({responses: {'comments/getHostComments': gridResponse(commentRows), 'comments/getServiceComments': gridResponse([])}});
+}
+
+test('deletes a host comment after confirmation', () => {
+	const env = commentEnv();
+
+	env.npc.route('comments');
+	clickHandler(env, '#npc-comments-table click .npc-del-comment', {id: 4});
+
+	const post = env.requests.filter((request) => request.method === 'POST')[0].params;
+	assert.strictEqual(post.p_command, 'DEL_HOST_COMMENT');
+	assert.strictEqual(post.p_comment_id, 4);
+});
+
+test('keeps a host comment when the user declines the confirmation', () => {
+	const env = commentEnv();
+
+	env.npc.route('comments');
+	global.confirm = () => false;
+	clickHandler(env, '#npc-comments-table click .npc-del-comment', {id: 4});
+
+	assert.strictEqual(env.requests.filter((request) => request.method === 'POST').length, 0);
+});
+
+test('lists host and service downtime from the grid response shape', () => {
+	const env = load({responses: {
+		'downtime/getHostDowntime': gridResponse([{host_name: 'web1', author_name: 'ann', comment_data: 'patching', scheduled_start_time: 's', scheduled_end_time: 'e', is_fixed: 1}]),
+		'downtime/getServiceDowntime': gridResponse([{host_name: 'web1', service_description: 'Load', author_name: 'bob', comment_data: 'tuning', scheduled_start_time: 's', scheduled_end_time: 'e'}])
+	}});
+
+	env.npc.route('downtime');
+
+	assert.match(env.html['#npc-downtime-table'], /patching/);
+	assert.match(env.html['#npc-downtime-table'], /tuning/);
+});
+
+test('reloads the host and service grids for the state chosen in the filter', () => {
+	const env = load({values: {'#npc-host-state': 'down', '#npc-svc-state': 'critical'}, responses: {
+		'hosts/getHosts': gridResponse(hostRows),
+		'services/getServices': gridResponse(serviceRows)
+	}});
+
+	env.npc.route('hosts');
+	env.handlers['#npc-host-filter submit '].call({}, {preventDefault() {}});
+	env.npc.route('services');
+	env.handlers['#npc-svc-filter submit '].call({}, {preventDefault() {}});
+
+	const states = env.requests.map((request) => request.params.p_state);
+	assert.ok(states.includes('down'));
+	assert.ok(states.includes('critical'));
+});
+
+test('opens the service command dialog options for each kind of command', () => {
+	const elements = [{__data: {kinds: 'ack'}}, {__data: {kinds: 'downtime'}}];
+	const env      = load({
+		values: {'select[name="p_command"]': 'SCHEDULE_SVC_DOWNTIME'},
+		elements: {'.npc-opt': elements},
+		responses: {'services/getServices': gridResponse(serviceRows)}
+	});
+
+	env.npc.route('services');
+	clickHandler(env, '#npc-svc-table click .npc-svc-cmd-link', {host: 'web1', svc: 'Load'});
+
+	assert.deepStrictEqual(elements.map((element) => element.__shown), [false, true]);
+});
+
+test('shows the options again when another command is selected in the dialog', () => {
+	const elements = [{__data: {kinds: 'ack'}}, {__data: {kinds: 'downtime'}}];
+	const values   = {'select[name="p_command"]': 'ACKNOWLEDGE_HOST_PROBLEM'};
+	const env      = openHostDialog({values, elements: {'.npc-opt': elements}});
+
+	assert.deepStrictEqual(elements.map((element) => element.__shown), [true, false]);
+
+	values['select[name="p_command"]'] = 'SCHEDULE_HOST_DOWNTIME';
+	env.handlers['select[name="p_command"] change '].call({});
+
+	assert.deepStrictEqual(elements.map((element) => element.__shown), [false, true]);
+});
+
+test('opens the tab named in the page configuration when the page is ready', () => {
+	const env = load({config: {currentTab: 'process'}, responses: {'nagios/getProcessInfoGrid': {data: [{name: 'Nagios Version', value: '4.5'}]}}});
+
+	env.ready();
+
+	assert.match(env.html['#npc-process-table'], /Nagios Version/);
+});
+
+test('opens the dashboard for a tab it does not know', () => {
+	const env = load({config: {currentTab: 'nonsense'}});
+
+	env.ready();
+
+	assert.ok(env.requests.some((request) => request.params.module === 'hosts' && request.params.action === 'summary'));
+});

From a0ff0448d18e040df7d99e1f4531faa3202a9684 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 23:50:49 -0600
Subject: [PATCH 40/41] fix: drop the device mapping column on uninstall only
 when it exists

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 CHANGELOG.md                    |  2 ++
 setup.php                       |  5 ++++-
 tests/Unit/NpcLifecycleTest.php | 23 +++++++++++++++++++++++
 tests/bootstrap-unit.php        |  4 ++++
 4 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1aeda06..5a14499 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 --- develop ---
 
+* issue: Drop the device mapping column on uninstall only when it exists; a repeated
+  uninstall logged a failed ALTER TABLE
 * issue: Treat a missing searchFields value as empty in the grid search; a search
   string without it raised the PHP 8.1 null deprecation
 * issue: Return an empty definition for an unknown Nagios command instead of raising
diff --git a/setup.php b/setup.php
index 0c44e25..42c78db 100644
--- a/setup.php
+++ b/setup.php
@@ -164,7 +164,10 @@ function plugin_npc_uninstall() {
 	db_execute('DROP TABLE IF EXISTS `npc_timeperiod_timeranges`');
 	db_execute('DROP TABLE IF EXISTS `npc_timeperiods`');
 
-	db_execute('ALTER TABLE `host` DROP `npc_host_object_id`');
+	if (db_column_exists('host', 'npc_host_object_id')) {
+		db_execute('ALTER TABLE `host` DROP `npc_host_object_id`');
+	}
+
 	db_execute('DELETE FROM `settings` WHERE `name` like "npc\_%"');
 
 	api_plugin_remove_realms('npc');
diff --git a/tests/Unit/NpcLifecycleTest.php b/tests/Unit/NpcLifecycleTest.php
index 4955967..f2b3ead 100644
--- a/tests/Unit/NpcLifecycleTest.php
+++ b/tests/Unit/NpcLifecycleTest.php
@@ -18,6 +18,7 @@
 beforeEach(function () {
 	$GLOBALS['__test_db_calls']      = array();
 	$GLOBALS['__test_removed_realms'] = array();
+	$GLOBALS['__test_columns']        = array();
 });
 
 it('parses the plugin INFO file into an info array', function () {
@@ -43,3 +44,25 @@
 	expect(count($drops))->toBeGreaterThan(50);
 	expect($GLOBALS['__test_removed_realms'])->toBe(array('npc'));
 });
+
+it('removes the device mapping column on uninstall when it exists', function () {
+	$GLOBALS['__test_columns'] = array('host' => array('npc_host_object_id' => true));
+
+	plugin_npc_uninstall();
+
+	$alters = array_filter(array_column($GLOBALS['__test_db_calls'], 'sql'), function ($sql) {
+		return strpos($sql, 'ALTER TABLE `host` DROP `npc_host_object_id`') === 0;
+	});
+
+	expect($alters)->toHaveCount(1);
+});
+
+it('does not alter the device table on uninstall when the column is already gone', function () {
+	plugin_npc_uninstall();
+
+	$alters = array_filter(array_column($GLOBALS['__test_db_calls'], 'sql'), function ($sql) {
+		return stripos($sql, 'ALTER TABLE') !== false;
+	});
+
+	expect($alters)->toBe(array());
+});
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index 1096e14..31d3822 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -226,6 +226,10 @@ function db_index_exists($table, $index, $log = true, $db_conn = false) {
 
 if (!function_exists('db_column_exists')) {
 	function db_column_exists($table, $column, $log = true, $db_conn = false) {
+		if (!empty($GLOBALS['__test_columns'][$table][$column])) {
+			return true;
+		}
+
 		if (isset($GLOBALS['__test_pdo'])) {
 			$lookup = $GLOBALS['__test_pdo']->prepare('SELECT 1 FROM information_schema.columns WHERE table_schema = DATABASE() AND table_name = ? AND column_name = ?');
 			$lookup->execute(array($table, $column));

From a919095998097e8cf65d36fc12c827faa33c186d Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Fri, 23 Oct 2026 23:51:56 -0600
Subject: [PATCH 41/41] test: share the import fixture and check that the test
 helpers stay inert

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 tests/E2E/FrontControllerTest.php | 16 ++++++
 tests/Unit/SyncImportTest.php     | 95 ++++++++-----------------------
 2 files changed, 39 insertions(+), 72 deletions(-)

diff --git a/tests/E2E/FrontControllerTest.php b/tests/E2E/FrontControllerTest.php
index 85623ff..2a06707 100644
--- a/tests/E2E/FrontControllerTest.php
+++ b/tests/E2E/FrontControllerTest.php
@@ -187,3 +187,19 @@
 	expect(json_decode($run['stdout'], true)['success'])->toBeFalse();
 	expect(npc_e2e_calls($run, 'db_execute_prepared'))->toBe(array());
 })->with(array('PUT', 'DELETE', 'HEAD', 'PATCH'));
+
+it('does nothing when a test helper is run without the test environment', function (string $file) {
+	$dir = sys_get_temp_dir() . '/npc-inert-' . uniqid();
+	mkdir($dir, 0700);
+
+	$command = 'cd ' . escapeshellarg($dir) . ' && env -u NPC_E2E -u NPC_COVERAGE_DIR ' . escapeshellarg(PHP_BINARY) . ' ' . escapeshellarg(dirname(__DIR__) . '/' . $file) . ' 2>&1';
+
+	expect((string) shell_exec($command))->toBe('');
+	expect(glob($dir . '/*'))->toBe(array());
+})->with(array(
+	'stand-in auth file' => array('E2E/support/front-controller-auth.php'),
+	'coverage recorder'  => array('E2E/support/coverage-prepend.php'),
+	'subprocess runner'  => array('E2E/support/harness.php'),
+	'web server runner'  => array('E2E/support/server.php'),
+	'database helper'    => array('Integration/support/database.php'),
+));
diff --git a/tests/Unit/SyncImportTest.php b/tests/Unit/SyncImportTest.php
index db22cf2..b00bc3c 100644
--- a/tests/Unit/SyncImportTest.php
+++ b/tests/Unit/SyncImportTest.php
@@ -36,6 +36,20 @@ function npc_sync_sandbox() {
 	return $base;
 }
 
+/**
+ * Parameters of one import request.
+ */
+function npc_sync_params($base, array $override = array()) {
+	return array_merge(array(
+		'config'         => array('base_path' => $base),
+		'description'    => 'web1',
+		'host_object_id' => 10,
+		'ip'             => '192.0.2.10',
+		'cache_id'       => 'k',
+		'template_id'    => 7,
+	), $override);
+}
+
 function npc_sync_unmapped_controller() {
 	return new class extends NpcSyncController {
 		function checkHostExists($ip, $cache_id) {
@@ -47,14 +61,7 @@ function checkHostExists($ip, $cache_id) {
 it('reports an already mapped host without running the import', function () {
 	$GLOBALS['__test_db_results']['db_fetch_assoc_prepared']['WHERE npc_host_object_id'] = array(array('id' => 3));
 
-	$out = (new NpcSyncController())->import(array(
-		'config'         => array('base_path' => '/nonexistent'),
-		'description'    => 'web1',
-		'host_object_id' => 10,
-		'ip'             => '192.0.2.10',
-		'cache_id'       => 'k',
-		'template_id'    => 1,
-	));
+	$out = (new NpcSyncController())->import(npc_sync_params('/nonexistent', array('template_id' => 1)));
 
 	expect($out)->toBe('web1|0|0|The host already exists and is mapped');
 });
@@ -66,14 +73,7 @@ function checkHostExists($ip, $cache_id) {
 		}
 	};
 
-	$out = $sync->import(array(
-		'config'         => array('base_path' => '/nonexistent'),
-		'description'    => 'web1',
-		'host_object_id' => 10,
-		'ip'             => '192.0.2.10',
-		'cache_id'       => 'k',
-		'template_id'    => 1,
-	));
+	$out = $sync->import(npc_sync_params('/nonexistent', array('template_id' => 1)));
 
 	expect($out)->toBe('web1|0|1|The host already existed in Cacti with device ID: 5');
 
@@ -85,14 +85,7 @@ function checkHostExists($ip, $cache_id) {
 it('imports a new host and maps the returned device id', function () {
 	$base = npc_sync_sandbox();
 
-	$out = npc_sync_unmapped_controller()->import(array(
-		'config'         => array('base_path' => $base),
-		'description'    => 'web1',
-		'host_object_id' => 10,
-		'ip'             => '192.0.2.10',
-		'cache_id'       => 'k',
-		'template_id'    => 7,
-	));
+	$out = npc_sync_unmapped_controller()->import(npc_sync_params($base));
 
 	expect($out)->toBe('web1|1|1|Success - new device-id: (12)');
 
@@ -212,14 +205,7 @@ function npc_sync_cache_run($ip, $cache_id, $prepare = null) {
 it('passes the import arguments to add_device.php as single values', function () {
 	$base = npc_sync_sandbox();
 
-	$out = npc_sync_unmapped_controller()->import(array(
-		'config'         => array('base_path' => $base),
-		'description'    => 'web 1 & echo extra',
-		'host_object_id' => 10,
-		'ip'             => '192.0.2.10',
-		'cache_id'       => 'k',
-		'template_id'    => 7,
-	));
+	$out = npc_sync_unmapped_controller()->import(npc_sync_params($base, array('description' => 'web 1 & echo extra')));
 
 	expect($out)->toBe('web 1 & echo extra|1|1|Success - new device-id: (12)');
 	expect(json_decode(file_get_contents($base . '/cli/argv.json'), true))->toBe(array(
@@ -232,14 +218,7 @@ function npc_sync_cache_run($ip, $cache_id, $prepare = null) {
 it('rejects an import with a non-numeric template id or an empty address', function (array $override) {
 	$base = npc_sync_sandbox();
 
-	$out = npc_sync_unmapped_controller()->import(array_merge(array(
-		'config'         => array('base_path' => $base),
-		'description'    => 'web1',
-		'host_object_id' => 10,
-		'ip'             => '192.0.2.10',
-		'cache_id'       => 'k',
-		'template_id'    => 7,
-	), $override));
+	$out = npc_sync_unmapped_controller()->import(array_merge(npc_sync_params($base), $override));
 
 	expect($out)->toBe(($override['description'] ?? 'web1') . '|0|0|Invalid import parameters');
 	expect(file_exists($base . '/cli/argv.json'))->toBeFalse();
@@ -254,14 +233,7 @@ function npc_sync_cache_run($ip, $cache_id, $prepare = null) {
 
 	$base = npc_sync_sandbox();
 
-	$out = npc_sync_unmapped_controller()->import(array(
-		'config'         => array('base_path' => $base),
-		'description'    => 'web1',
-		'host_object_id' => 10,
-		'ip'             => '192.0.2.10',
-		'cache_id'       => 'k',
-		'template_id'    => 7,
-	));
+	$out = npc_sync_unmapped_controller()->import(npc_sync_params($base));
 
 	expect($out)->toBe('web1|0|0|You do not have permission to add devices');
 	expect($GLOBALS['__test_db_calls'])->toBe(array());
@@ -294,14 +266,7 @@ function npc_sync_cache_run($ip, $cache_id, $prepare = null) {
 it('passes hostile description values through as one argument', function (string $description) {
 	$base = npc_sync_sandbox();
 
-	$out = npc_sync_unmapped_controller()->import(array(
-		'config'         => array('base_path' => $base),
-		'description'    => $description,
-		'host_object_id' => 10,
-		'ip'             => '192.0.2.10',
-		'cache_id'       => 'k',
-		'template_id'    => 7,
-	));
+	$out = npc_sync_unmapped_controller()->import(npc_sync_params($base, array('description' => $description)));
 
 	expect($out)->toBe($description . '|1|1|Success - new device-id: (12)');
 	expect(json_decode(file_get_contents($base . '/cli/argv.json'), true)[0])->toBe('--description=' . $description);
@@ -322,14 +287,7 @@ function npc_sync_cache_run($ip, $cache_id, $prepare = null) {
 	mkdir($base . '/cli', 0777, true);
 	file_put_contents($base . '/cli/add_device.php', "<?php\nprint \"ERROR: Template 7 does not exist\\n\";\nexit(1);\n");
 
-	$out = npc_sync_unmapped_controller()->import(array(
-		'config'         => array('base_path' => $base),
-		'description'    => 'web1',
-		'host_object_id' => 10,
-		'ip'             => '192.0.2.10',
-		'cache_id'       => 'k',
-		'template_id'    => 7,
-	));
+	$out = npc_sync_unmapped_controller()->import(npc_sync_params($base));
 
 	expect($out)->toBe('web1|');
 	expect($GLOBALS['__test_db_calls'])->toBe(array());
@@ -340,14 +298,7 @@ function npc_sync_cache_run($ip, $cache_id, $prepare = null) {
 	mkdir($base . '/cli', 0777, true);
 	file_put_contents($base . '/cli/add_device.php', "<?php\nprint \"Success - new device-id: ()\\n\";\n");
 
-	$out = npc_sync_unmapped_controller()->import(array(
-		'config'         => array('base_path' => $base),
-		'description'    => 'web1',
-		'host_object_id' => 10,
-		'ip'             => '192.0.2.10',
-		'cache_id'       => 'k',
-		'template_id'    => 7,
-	));
+	$out = npc_sync_unmapped_controller()->import(npc_sync_params($base));
 
 	expect($out)->toBe('web1|1|1|Success - new device-id: ()');
 })->skip(trim((string) shell_exec('command -v php')) === '', 'php binary is not on PATH');