Permissions issue with Host tied to multiple Groups

[WO-Jacob]

Ok, here's the situation:

We're giving our dedicated server clients logins to see history and such on their servers.

So, we create a special server group for each client, add their servers to it.

All of these servers are also added to the 'Dedicated Servers' group for us internally.

Now, when a client goes to Latest Data and such, everything is fine.

But when they go to Events (at least events, not sure about others), in the Group option, Dedicated servers, shows up, and for Host, if they select All, they now can view all events for all dedicated servers.

Obviously, this is not the desired effect.

I'll be looking at the code to see if I can do a patch, but I figured I would let people know about this. This is in Zabbix 1.4.2.

Edit: Quick check also shows this issue on the Inventory page, and the reports page.

[WO-Jacob]

Ok, patched the events page issue... here's the diff, patch -p0 from your zabbix directory... Fixes both the group dropdown and the actual default display for host/group id's of 0

--- ../install/zabbix-1.4.2/frontends/php/events.php    2007-08-20 15:22:27.000000000 -0400
+++ events.php  2007-09-20 01:34:00.000000000 -0400
@@ -115,6 +115,7 @@

                $cmbGroup->AddItem(0,S_ALL_SMALL);

+               $availiable_groups= get_accessible_groups_by_user($USER_DETAILS,PERM_READ_LIST, null, null, get_current_nodeid());
                $availiable_hosts = get_accessible_hosts_by_user($USER_DETAILS, PERM_READ_LIST, null, null, get_current_nodeid());

                $result=DBselect('SELECT DISTINCT g.groupid,g.name '.
@@ -123,6 +124,11 @@
                                ' AND hg.groupid=g.groupid AND h.status='.HOST_STATUS_MONITORED.
                                ' AND h.hostid=i.hostid AND hg.hostid=h.hostid '.
                        ' ORDER BY g.name');
+               $result=DBselect("select distinct g.groupid,g.name from groups g, hosts_groups hg, hosts h, items i ".
+                       " where g.groupid in (".$availiable_groups.") ".
+                       " and hg.groupid=g.groupid and h.status=".HOST_STATUS_MONITORED.
+                       " and h.hostid=i.hostid and hg.hostid=h.hostid and i.status=".ITEM_STATUS_ACTIVE.
+                       " order by g.name");

                while($row=DBfetch($result))
                {
--- ../install/zabbix-1.4.2/frontends/php/include/events.inc.php        2007-08-20 15:22:24.000000000 -0400
+++ include/events.inc.php      2007-09-20 01:42:56.000000000 -0400
@@ -36,6 +36,9 @@
                $show_unknown = get_profile('web.events.show_unknown',0);

                $sql_from = $sql_cond = "";
+
+               $availiable_groups= get_accessible_groups_by_user($USER_DETAILS,PERM_READ_LIST, null, null, get_current_nodeid());
+               $availiable_hosts = get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_LIST, null, null, get_current_nodeid());

                if($hostid > 0)
                {
@@ -46,6 +49,11 @@
                        $sql_from = ", hosts_groups hg ";
                        $sql_cond = " and h.hostid=hg.hostid and hg.groupid=".$groupid;
                }
+               else
+               {
+                       $sql_from = ", hosts_groups hg ";
+                       $sql_cond = " and h.hostid in (".$availiable_hosts.") ";
+               }

                if($show_unknown == 0){
                        $sql_cond.= ' AND e.value<>2 ';