Patch for Version 1.4.1 to fix Read-Write access

[azurit]

i noticed that after adding an 'Zabbix admin' user and allowing him read-write access to any single host group, he will gets read-write access to _all_ hosts and groups. i really wonder why this is not fixed in any patches here cos this makes user management completely useless. here is the patch (not the best but works).
File: include/perm.inc.php
find definition of function 'get_accessible_hosts_by_user' and edit it like this:

Before:

...
while($host_data = DBfetch($db_hosts))
{
	$host_data += DBfetch(DBselect('select * from hosts where hostid='.$host_data['hostid']));

	if(is_null($host_data['nodeid'])) $host_data['nodeid'] = id2nodeid($host_data['hostid']);

	/* if no rights defined used node rights */
	if( (is_null($host_data['permission']) || is_null($host_data['userid'])) )
	{
		if( isset($processed[$host_data['hostid']]) )
			continue;

		if(!isset($nodes))
		{
			$nodes = get_accessible_nodes_by_user($user_data,PERM_DENY,PERM_MODE_GE,PERM_RES_DATA_ARRAY);
		}
		if( !isset($nodes[$host_data['nodeid']]) || $user_type==USER_TYPE_ZABBIX_USER )
			$host_data['permission'] = PERM_DENY;
		else
			$host_data['permission'] = $nodes[$host_data['nodeid']]['permission'];
	}

	$processed[$host_data['hostid']] = true;

	if(eval('return ('.$host_data["permission"].' '.perm_mode2comparator($perm_mode).' '.$perm.')? 0 : 1;'))
		continue;

	$result[$host_data['hostid']] = eval('return '.$resdata.';');
}
...

After:

...
while($host_data = DBfetch($db_hosts))
{
	[B]if(!is_null($host_data['userid'])) {[/B]
		$host_data += DBfetch(DBselect('select * from hosts where hostid='.$host_data['hostid']));

		if(is_null($host_data['nodeid'])) $host_data['nodeid'] = id2nodeid($host_data['hostid']);

		/* if no rights defined used node rights */
		if( (is_null($host_data['permission']) || is_null($host_data['userid'])) )
		{
			if( isset($processed[$host_data['hostid']]) )
				continue;

			if(!isset($nodes))
			{
				$nodes = get_accessible_nodes_by_user($user_data,PERM_DENY,PERM_MODE_GE,PERM_RES_DATA_ARRAY);
			}
			if( !isset($nodes[$host_data['nodeid']]) || $user_type==USER_TYPE_ZABBIX_USER )
				$host_data['permission'] = PERM_DENY;
			else
				$host_data['permission'] = $nodes[$host_data['nodeid']]['permission'];
		}

		$processed[$host_data['hostid']] = true;

		if(eval('return ('.$host_data["permission"].' '.perm_mode2comparator($perm_mode).' '.$perm.')? 0 : 1;'))
			continue;

		$result[$host_data['hostid']] = eval('return '.$resdata.';');
	[B]}[/B]
}
...

[azurit]

sorry, i found out that 'zabbix super admin' wasn't able to access all hosts _without_ giving him persmission - super admin should have perm to everything automatically. just replace this line in patch:

if(!is_null($host_data['userid'])) {

by this line:

if(!is_null($host_data['userid']) || $user_type == USER_TYPE_SUPER_ADMIN) {

BTW, the similiar fix should be applied to the function 'get_accessible_groups_by_user':

if(!is_null($group_data['userid']) || $user_type == USER_TYPE_SUPER_ADMIN) {

[azurit]

i have some other patches which fixies another permissions issues. anyone interested ?

[Palmertree]

Yes, please submit your patches.

[azurit]

here goes the patch to fix graphs - after applying, only the user who has the read or write privileges to the host will be able to see it's graphs (you need to apply the first patch in this thread to make this work good):
file charts.php

find this:

$denyed_hosts = get_accessible_hosts_by_user($USER_DETAILS, PERM_READ_ONLY, PERM_MODE_LT);

replace by this:

$available_hosts = get_accessible_hosts_by_user($USER_DETAILS, PERM_READ_ONLY,null,null,$ZBX_CURNODEID);

--
find:

" and h.hostid not in (".$denyed_hosts.") ".

replace:

" and h.hostid in (".$available_hosts.") ".

--
find:

" and h.hostid not in (".$denyed_hosts.") and i.itemid=gi.itemid".

replace:

" and h.hostid in (".$available_hosts.") and i.itemid=gi.itemid".

--
find:

" and h.hostid not in (".$denyed_hosts.") and i.itemid=gi.itemid".

replace:

" and h.hostid in (".$available_hosts.") and i.itemid=gi.itemid".

--
find:

" and i.hostid not in (".$denyed_hosts.") ".

replace:

" and i.hostid in (".$available_hosts.") ".

--
find:

" and h.hostid not in (".$denyed_hosts.") ".

replace:

" and h.hostid not in (".$available_hosts.") ".

--
find:

" and h.hostid not in (".$denyed_hosts.") ".

replace:

" and h.hostid in (".$available_hosts.") ".

[azurit]

patch to fix triggers - after applying, only the user who has the read or write privileges to the host will be able to see it's triggers (you need to apply the first patch in this thread to make this work good):
file tr_status.php

find:

$result = DBselect("select distinct t.triggerid,t.status,t.description,t.expression,t.priority,".
	" t.lastchange,t.comments,t.url,t.value,h.host from triggers t,hosts h,items i,functions f".
	" where f.itemid=i.itemid and h.hostid=i.hostid and t.triggerid=f.triggerid and t.status=".TRIGGER_STATUS_ENABLED.
	" and t.description $select_cond and i.status=".ITEM_STATUS_ACTIVE.
	" and ".DBid2nodeid("t.triggerid")."=".$ZBX_CURNODEID.
	" and h.hostid not in (".get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_ONLY, PERM_MODE_LT).") ". 
	" and h.status=".HOST_STATUS_MONITORED." $cond $sort");

replace:

$available_hosts = get_accessible_hosts_by_user($USER_DETAILS, PERM_READ_ONLY,null,null,$ZBX_CURNODEID);

$result = DBselect("select distinct t.triggerid,t.status,t.description,t.expression,t.priority,".
	" t.lastchange,t.comments,t.url,t.value,h.host from triggers t,hosts h,items i,functions f".
	" where f.itemid=i.itemid and h.hostid=i.hostid and t.triggerid=f.triggerid and t.status=".TRIGGER_STATUS_ENABLED.
	" and t.description $select_cond and i.status=".ITEM_STATUS_ACTIVE.
	" and ".DBid2nodeid("t.triggerid")."=".$ZBX_CURNODEID.
	" and h.hostid in (".$available_hosts.") ".
	" and h.status=".HOST_STATUS_MONITORED." $cond $sort");

i'm working on some other patches

[Andreas Bollhalder]

Very good! This should really get into the stable version of 1.4.2. We got interally the same problems.

Andreas

[technow0rker]

Maybe you guys would better use diff utility? )) Patch files make our life easier

[azurit]

here goes the diffs! there is a little correction in patch for charts.php

[Palmertree]

I was having issues with permissions and maps and applied your patches and it did the trick. I found the problem was due to the fact have if a host is in two different groups and if a user only had read-only access to that one group but the other group they were denied by default, it would sometimes show the map and sometimes it would not. With this patch I was able to control the behavior better and not allow the user to see the other host in the denied group. I was also able to control admin access as well to which groups they could modify. I had to modify the patch a little by replacing the $ZBX_CURNOIDID with get_current_nodeid() function. Thanks for the patch.