From b014d268f466d7447d0fdbb1a8ae266500394ca4 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Wed, 29 Jul 2026 15:32:43 -0700
Subject: [PATCH] chore: use filtered audit user id binding

---
 audit.php                          | 14 +++++---
 tests/e2e/test_security_wiring.php | 53 ++++++++++++++++++++++++++++++
 2 files changed, 62 insertions(+), 5 deletions(-)
 create mode 100644 tests/e2e/test_security_wiring.php

diff --git a/audit.php b/audit.php
index 8703ec0..527c585 100644
--- a/audit.php
+++ b/audit.php
@@ -306,13 +306,15 @@ function audit_export_rows() {
 	}
 
 	if (get_request_var('event_page') != '-1') {
+		/* event_page is a sanitized page basename, not a numeric ID. */
 		$sql_clauses[] = 'page = ?';
 		$sql_params[]  = get_request_var('event_page');
 	}
 
-	if (!isempty_request_var('user_id') && get_request_var('user_id') > '-1') {
+	$user_id = get_filter_request_var('user_id');
+	if ($user_id > -1) {
 		$sql_clauses[] = 'user_id = ?';
-		$sql_params[]  = get_request_var('user_id');
+		$sql_params[]  = $user_id;
 	}
 
 	$sql_where = cacti_sizeof($sql_clauses) ? 'WHERE ' . implode(' AND ', $sql_clauses) : '';
@@ -552,13 +554,15 @@ function audit_log() {
 	}
 
 	if (get_request_var('event_page') != '-1') {
+		/* event_page is a sanitized page basename, not a numeric ID. */
 		$sql_clauses[] = 'page = ?';
 		$sql_params[]  = get_request_var('event_page');
 	}
 
-	if (!isempty_request_var('user_id') && get_request_var('user_id') > '-1') {
+	$user_id = get_filter_request_var('user_id');
+	if ($user_id > -1) {
 		$sql_clauses[] = 'user_id = ?';
-		$sql_params[]  = get_request_var('user_id');
+		$sql_params[]  = $user_id;
 	}
 
 	$sql_where = cacti_sizeof($sql_clauses) ? 'WHERE ' . implode(' AND ', $sql_clauses) : '';
@@ -684,7 +688,7 @@ function audit_log() {
 	<?php
 }
 
-function audit_render_syslog_health() {
+	function audit_render_syslog_health() {
 	$config = audit_syslog_config();
 	$health = audit_syslog_health();
 	$enabled = audit_syslog_enabled();
diff --git a/tests/e2e/test_security_wiring.php b/tests/e2e/test_security_wiring.php
new file mode 100644
index 0000000..2e9a5c1
--- /dev/null
+++ b/tests/e2e/test_security_wiring.php
@@ -0,0 +1,53 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | End-to-end wiring checks for audit security fixes.                      |
+ |                                                                         |
+ | Run: php tests/e2e/test_security_wiring.php                             |
+ +-------------------------------------------------------------------------+
+ */
+
+$pass = 0;
+$fail = 0;
+
+function assert_true($label, $value) {
+	global $pass, $fail;
+
+	if ($value) {
+		echo "PASS  $label\n";
+		$pass++;
+	} else {
+		echo "FAIL  $label\n";
+		$fail++;
+	}
+}
+
+$source = file_get_contents(__DIR__ . '/../../audit.php');
+
+assert_true(
+	'user_id filter uses integer normalization before prepared SQL binding',
+	substr_count($source, "get_filter_request_var('user_id')") === 2
+);
+
+assert_true(
+	'event_page filter documents string binding',
+	substr_count($source, 'event_page is a sanitized page basename') === 2
+);
+
+assert_true(
+	'detail popup escapes field names and values',
+	strpos($source, "html_escape(\$field)") !== false &&
+	strpos($source, "audit_render_value(\$content)") !== false
+);
+
+assert_true(
+	'record data json is escaped before rendering',
+	strpos($source, "html_escape(json_encode(\$record, JSON_PRETTY_PRINT | JSON_INVALID_UTF8_SUBSTITUTE))") !== false
+);
+
+echo "\n";
+echo "Results: $pass passed, $fail failed\n";
+
+exit($fail > 0 ? 1 : 0);