- This change moves the function get_permission_string() to lib/auth.php
- Additionally, it makes the "Details" display on the Graph permissions consistent with the User Administration page.
-security#4576: Stored XSS Issue in Cacti Device, Graph, Graph Template, and Graph Items callbacks
-security#4579: Cacti account lockout policies are not properly applied to LDAP and Domain Users
-issue#4573: The Cacti permission system does not scale to very large installations
-issue#4575: When you delete a user, their 'remember me' cookie data is not automatically removed
-issue#4576: Stored XSS Issue in Cacti Device, Graph, Graph Template, and Graph Items callbacks
-issue#4577: Cacti allows you to disable the currently logged in administrator disabling the user
-issue#4578: The Cacti login algorithm is complicated to understand due to too much strait line code
-feature#4574: Cacti needs some additional permission methods for larger installations
This change properly documents the file lib/auth.php using phpDocument format, and performed multiple sanity and readability changes such as the renaming of variables commonly used in multiple functions.
The the restructuring of the three authentication files:
- auth_login.php
- include/auth.php
- lib/auth.php
Makes the code more readable, it's not a complete solution, however, it is much easier to follow now.
- User and Group Administration - Unused Templates are missing and row count wrong on Group page
- Some light cleanup of filter checks
- Add some prepared statements
- Cacti should disallow deleting the currently logged in user
- Cacti incorrectly uses the user_auth_cache from identical username from the wrong realm
- This second issue may require further work, but no in the 1.2.20 release
* Allow the get_template_account() function to be hookable by third party plugin
* Allow The User Management interface to be filterable by Realm
* Prevent Template User Accounts from being Removed
* Move the get_guest_account() and get_template_account() functions into lib/auth.php
* Fixed#1985: more fixing to clean user_auth_cache when Cacti Admin change password by someone request
* Minor formating changes
Co-authored-by: Jing Chen <three_chenjing@sohu.com>
Co-authored-by: South Park Neo <thewitness@cacti.net>
* Vulnerability report: Lack of escaping on some pages can lead
to XSS exposure
* Also cleaning up additional copyrights
* Make the way filter headers are escaped consistent
* User Admin - Effective Permissions - Disable Devices should show denied
* User Admin - Effective Permissions - Too many groups hide effective permission column
TheWitness