Zabbix 1.4.1: Monitoring -> Web -> "Permission Denied" for Read-Only Users

[Palmertree]

Not sure if this was by design or a bug so I decided to report this and a fix.

If a read-only user with access to all the groups goes to "Monitoring" -> "Web" -> Expand an application -> Click on a Scenario. They get "Permission Denied" message. The user can go to latest data and see the result.

Fix below:

Modify /php/httpdetails.php around the top of the file.
Modified the "RED".

Before:

check_fields($fields);

$accessible_hosts = get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_WRITE,null,null,$ZBX_CURNODEID);

if(!($httptest_data = DBfetch(DBselect('select ht.* from httptest ht, applications a '.
' where a.hostid in ('.$accessible_hosts.') and a.applicationid=ht.applicationid '.
' and ht.httptestid='.$_REQUEST['httptestid']))))
{

After:

check_fields($fields);

$accessible_hosts = get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_ONLY,null,null,$ZBX_CURNODEID);

if(!($httptest_data = DBfetch(DBselect('select ht.* from httptest ht, applications a '.
' where a.hostid in ('.$accessible_hosts.') and a.applicationid=ht.applicationid '.
' and ht.httptestid='.$_REQUEST['httptestid']))))
{

[murray]

Monitoring -> Screens -> Slideshows: 'No slideshows defined' for Read-Only Users

I think this is a similar issue. I cannot see any slideshows defined when I am not logged in (guest).

Zabbix 1.4.1 with 1.4.2-pre frontend (due to bug when adding tcp simple checks).

- Murray

[Alexei]

Thanks for reporting this and for the fix! It seems to be correct yet it has to be verified.

[richlv]

this was reported as still reproducible in 1.4.4 today on irc.

[murray]

I have sinced fixed my issue. I needed to add read-only permission to the 'guests' group for all hosts used on my slideshow.

[xs-]

There is a bug like this in 1.4.4.
Its not really about read-only users but a bug in a query used in the perm.inc.php which will effect users of a host group where the host belongs to multiple groups.

The problem is subtle and there is an easy quickfix. So far i havent seen any negative side-effects of the patch
Fix here: http://www.zabbix.com/forum/showthread.php?t=8997