Fix #756: Correct malformed UPDATE SET clause in notify list delete

[bmfmancini]

Summary

Fixes #756

In notify_lists.php, the bulk delete flow (drp_action == 1) contained a malformed SQL statement for the host email reset:

UPDATE host
SET thold_host_email = 0
AND deleted=""
WHERE ...

The AND deleted="" was incorrectly placed in the SET clause as part of the assignment expression, rather than in the WHERE clause as a filter condition.

Impact

• The deleted="" filter was not applied as intended.
• The expression semantics were incorrect and could silently produce unintended updates.

Fix

Moved the deleted="" filter from the SET clause to the WHERE clause, matching the structure of the adjacent thold_send_email update queries in the same function:

UPDATE host
SET thold_host_email = 0
WHERE deleted=""
AND ...

Testing

• Verified PHP syntax with php -l notify_lists.php — no syntax errors.
• The corrected query now matches the pattern used by the two thold_send_email updates immediately above it in the same delete path.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[somethingwithproof]

Please do not merge this form. It carries the unrelated three-line #789 change, and its host update conflicts semantically with #773's transactional notification-list deletion: #773 deliberately clears thold_host_email for soft-deleted hosts too, so restoring a host cannot resurrect a reference to a deleted list. Rebase on #773 (or choose one implementation), keep the transactional prepared-query version, add a deletion/restoration Pest case through Cacti Composer, and add the CHANGELOG entry.

[somethingwithproof]

The four integration checks are using the older unpinned Cacti workflow and fail during Cacti setup before the plugin can be validated. Maintainer edits are disabled, so I cannot apply the pinned-Cacti and bounded-retry workflow fix. Please enable maintainer edits or update/rebase the branch.

[somethingwithproof]

Both of these look to have landed on develop already, which is why the branch now shows a conflict.

The malformed clause order in notify_lists.php is gone. The bulk delete was rewritten to prepared statements, and deleted is now part of the WHERE rather than trailing the SET:

notify_lists.php:195  'UPDATE host SET thold_send_email = 0 WHERE thold_send_email = 2 AND deleted = "" AND thold_host_email IN (' . $placeholders . ')',

The warning branch in thold_functions.php reads the warning columns:

thold_functions.php:3472  'threshold_value' => ($warning_breach_up ? $thold_data['time_warning_hi'] : $thold_data['time_warning_low']),
thold_functions.php:3488  same
thold_functions.php:3502  same

Leaving this open rather than closing it, in case you read the current state differently. Nothing here needs rebasing if you agree it is covered.

[somethingwithproof]

Closing this, following up on my comment above.

The malformed clause is fixed on develop at notify_lists.php:195-196, with deleted moved into the WHERE rather than trailing the SET. Line 197 omits it deliberately, which is what this branch conflicts against. That work landed with #773.

Issue #756 was a valid report. Reopen if you read the current develop differently.