hardening(mikrotik_users): use prepared statement for name IN() delete query

[somethingwithproof]

Summary

mikrotik_users.php:108 (prior to fix) built an IN-list by concatenating POST values directly into a DELETE statement via implode(). A name value containing ',' breaks the quoting and allows arbitrary SQL. The name column is a string type, so quoting alone does not prevent injection.

Details

Field	Value
File	mikrotik_users.php
Line	108
Auth required	Yes — authenticated Cacti user
CWE	CWE-89

// Before
db_execute("DELETE FROM plugin_mikrotik_users WHERE name IN ('" . implode("','", $devices_to_act_on) . "')");

// After
$placeholders = implode(',', array_fill(0, count($devices_to_act_on), '?'));
db_execute_prepared("DELETE FROM plugin_mikrotik_users WHERE name IN ($placeholders)", $devices_to_act_on);

Fix applied in branch security/mikrotik-prepared-in-clause.

Acceptance criteria

• Repeated-placeholder prepared statement used for IN() clause
• No user-supplied values concatenated into SQL string
• Placeholder count equals device count (regression test)

[somethingwithproof]

Closing public issue — moving to private security advisory per responsible disclosure policy.