From f591248a6f1bee6a59dbe02a42c1bf5a02d455bf Mon Sep 17 00:00:00 2001
From: cschantz <admin@server.local>
Date: Fri, 14 Nov 2025 16:23:55 -0500
Subject: [PATCH] Fix variable comparison error in Quick Actions

Added proper quoting and default values for numeric comparisons to prevent
'too many arguments' error when variables are empty or contain spaces.

Changes:
- Quote all numeric comparisons in conditional statements
- Add fallback default values for grep results (high_conn_count, ssh_attacks)
- Ensures variables always contain valid numbers before comparison
---
 modules/security/live-attack-monitor.sh | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/modules/security/live-attack-monitor.sh b/modules/security/live-attack-monitor.sh
index 5be8db5..1cadccd 100755
--- a/modules/security/live-attack-monitor.sh
+++ b/modules/security/live-attack-monitor.sh
@@ -472,8 +472,11 @@ draw_quick_actions() {
         high_conn_count=$(grep -c "HIGH_CONN_COUNT" "$TEMP_DIR/recent_events" 2>/dev/null || echo "0")
     fi
 
+    # Ensure it's a valid number
+    high_conn_count=${high_conn_count:-0}
+
     # IP Blocking Recommendations
-    if [ $blockable_count -gt 0 ]; then
+    if [ "$blockable_count" -gt 0 ]; then
         echo -e "${HIGH_COLOR}  ⚠️  $blockable_count high-threat IPs ready to block${NC}"
         echo -e "${MEDIUM_COLOR}     → Press 'b' to open blocking menu${NC}"
     else
@@ -483,7 +486,7 @@ draw_quick_actions() {
     # Intelligent Firewall Recommendations
     local recommendations=0
 
-    if [ $has_ddos -eq 1 ] || [ $high_conn_count -gt 0 ]; then
+    if [ "$has_ddos" -eq 1 ] || [ "$high_conn_count" -gt 0 ]; then
         echo -e "${HIGH_COLOR}  ⚠️  DDoS/SYN Flood Detected - Firewall Protection Recommended${NC}"
         echo -e "${MEDIUM_COLOR}     → Enable SYNFLOOD protection: ${BOLD}csf -e SYNFLOOD${NC}"
         echo -e "${MEDIUM_COLOR}     → Optimize CT_LIMIT: ${BOLD}Press 'c' to run CT_LIMIT optimizer${NC}"
@@ -491,9 +494,10 @@ draw_quick_actions() {
         recommendations=1
     fi
 
-    if [ $has_ssh_bruteforce -eq 1 ]; then
+    if [ "$has_ssh_bruteforce" -eq 1 ]; then
         local ssh_attacks=$(grep -c "SSH_BRUTEFORCE" "$TEMP_DIR/recent_events" 2>/dev/null || echo "0")
-        if [ $ssh_attacks -gt 5 ]; then
+        ssh_attacks=${ssh_attacks:-0}
+        if [ "$ssh_attacks" -gt 5 ]; then
             echo -e "${HIGH_COLOR}  ⚠️  SSH Bruteforce ($ssh_attacks attempts) - Strengthen SSH Security${NC}"
             echo -e "${MEDIUM_COLOR}     → Lower LF_SSHD trigger: ${BOLD}Edit /etc/csf/csf.conf → LF_SSHD=\"3\"${NC}"
             echo -e "${MEDIUM_COLOR}     → Enable PortKnocking or change SSH port${NC}"