From 33bcdb4ef05a7d8daf8d925924eadc6a32d64740 Mon Sep 17 00:00:00 2001
From: cschantz <admin@server.local>
Date: Sat, 13 Dec 2025 02:26:39 -0500
Subject: [PATCH] Fix 'local can only be used in a function' errors in
 historical analyzer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The code block writing to $OUTPUT_FILE was using 'local' variables
but was not inside a function. The 'local' keyword is only valid inside
functions in bash.

Fixed:
- Removed all 'local' keywords (changed to regular variables)
- Code is in global scope redirected to file, not in a function
- Variables are properly scoped within the { } block

This was causing errors:
  line 190: local: can only be used in a function
  line 203: local: can only be used in a function
  etc.

Now all variables use proper global scope within the output redirection block.

✅ Syntax validated
---
 tools/analyze-historical-attacks.sh | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/tools/analyze-historical-attacks.sh b/tools/analyze-historical-attacks.sh
index 5a7e354..e113935 100755
--- a/tools/analyze-historical-attacks.sh
+++ b/tools/analyze-historical-attacks.sh
@@ -151,9 +151,9 @@ declare -A SIGNATURE_HITS
 
 # Progress indicator
 show_progress() {
-    local count=$1
-    local total=$2
-    local percent=$((count * 100 / total))
+count=$1
+total=$2
+percent=$((count * 100 / total))
     echo -ne "\r${BLUE}[*]${NC} Processing: $count/$total lines ($percent%) "
 }
 
@@ -187,8 +187,8 @@ echo ""
             CAT_CMD="cat"
         fi
 
-        local file_attacks=0
-        local line_count=0
+file_attacks=0
+line_count=0
 
         while IFS= read -r line; do
             line_count=$((line_count + 1))
@@ -200,17 +200,17 @@ echo ""
             fi
 
             # Analyze line
-            local result=$(analyze_http_log_line "$line" 2>/dev/null)
-            local threat_score="${result%%||*}"
+result=$(analyze_http_log_line "$line" 2>/dev/null)
+threat_score="${result%%||*}"
 
             if [ "$threat_score" -ge "$THRESHOLD" ]; then
-                local temp="${result#*||}"
-                local attack_types="${temp%%||*}"
+temp="${result#*||}"
+attack_types="${temp%%||*}"
                 temp="${temp#*||}"
-                local signatures="${temp%%||*}"
+signatures="${temp%%||*}"
                 temp="${temp#*||}"
-                local ip="${temp%%||*}"
-                local uri="${temp#*||}"
+ip="${temp%%||*}"
+uri="${temp#*||}"
 
                 # Count attacks
                 TOTAL_ATTACKS=$((TOTAL_ATTACKS + 1))