From 73c123a17e8e797f75e8ff0c89c2143dba3d3d8c Mon Sep 17 00:00:00 2001
From: TheWitness <thewitness@cacti.net>
Date: Fri, 16 Oct 2026 12:50:40 -0400
Subject: [PATCH] fix: remove trailing comma in device edit SNMP settings
 UPDATE

The UPDATE mac_track_devices statement ended its SET list with a comma
before WHERE, causing an SQL syntax error whenever the device edit page
auto-corrected the SNMP settings. Adds a regression test.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 CHANGELOG.md                               |  1 +
 mactrack_devices.php                       |  2 +-
 tests/Unit/DeviceEditSnmpUpdateSqlTest.php | 15 +++++++++++++++
 3 files changed, 17 insertions(+), 1 deletion(-)
 create mode 100644 tests/Unit/DeviceEditSnmpUpdateSqlTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 305c64e7..e08ff91e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,7 @@
 * issue: Decode MAC/IP OIDs as hex in the Extreme scanner by correcting a misplaced xform_stripped_oid() argument
 * issue: Fix an undefined $ifindex reference (should be $ifIndex) in the Nortel Bay scanner
 * issue: Fix a misplaced parenthesis in the running-process stats parser
+* issue: Remove a trailing comma before WHERE in the device edit page's SNMP settings UPDATE, which caused an SQL syntax error whenever the SNMP settings were auto-corrected
 * security: Move every inline `onClick`/`onChange` handler (filter selects, Return/Cancel buttons, the device rescan icon, the utilities refresh controls) into `$(function() {})` handlers, using delegated handlers in `js/mactrack.js` for markup rendered by shared or AJAX-refreshed code, so pages work under a Content-Security-Policy that blocks inline event-handler attributes; all inline `<script>` tags already carry the version-safe nonce, and a regression test now enforces both
 * security: Add a version-safe CSP nonce (`plugin_mactrack_csp_nonce()`) to every inline `<script>` tag, and emit external JavaScript includes through Cacti's `get_md5_include_js()` helper so they carry the request nonce automatically; pages stay compatible with Cacti's Content-Security-Policy nonce enforcement while falling back cleanly on older Cacti releases that lack the `CactiSecureHeaders` class
 * issue#349: Keep punctuation in the port name filter
diff --git a/mactrack_devices.php b/mactrack_devices.php
index fda51645..3c876e79 100644
--- a/mactrack_devices.php
+++ b/mactrack_devices.php
@@ -1036,7 +1036,7 @@ function mactrack_device_edit(): void {
 								SET device_type_id = ?, scan_type = ?, snmp_version = ?,
 								snmp_readstring = ?, snmp_port = ?, snmp_timeout = ?, snmp_retries = ?,
 								max_oids = ?, snmp_username = ?, snmp_password = ?, snmp_auth_protocol = ?,
-								snmp_priv_passphrase = ?, snmp_priv_protocol = ?, snmp_context = ?,
+								snmp_priv_passphrase = ?, snmp_priv_protocol = ?, snmp_context = ?
 								WHERE device_id = ?',
 					[
 						$device['device_type_id'], $device['scan_type'], $device['snmp_version'],
diff --git a/tests/Unit/DeviceEditSnmpUpdateSqlTest.php b/tests/Unit/DeviceEditSnmpUpdateSqlTest.php
new file mode 100644
index 00000000..289acbf8
--- /dev/null
+++ b/tests/Unit/DeviceEditSnmpUpdateSqlTest.php
@@ -0,0 +1,15 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+*/
+
+it('does not leave a trailing comma before WHERE in any mac_track_devices UPDATE', function () {
+	$source = plugin_test_read_source('mactrack_devices.php');
+
+	expect(preg_match('/,\s*WHERE\b/i', $source))->toBe(0);
+	expect($source)->toContain("snmp_context = ?\n\t\t\t\t\t\t\t\tWHERE device_id = ?");
+});