Seems that the SESSION variable starts in a awkward place. This fix has everything working again. I can confirm now in the general log that the settings table no longer get's thrashed.
- This change moves the function get_permission_string() to lib/auth.php
- Additionally, it makes the "Details" display on the Graph permissions consistent with the User Administration page.
-security#4576: Stored XSS Issue in Cacti Device, Graph, Graph Template, and Graph Items callbacks
-security#4579: Cacti account lockout policies are not properly applied to LDAP and Domain Users
-issue#4573: The Cacti permission system does not scale to very large installations
-issue#4575: When you delete a user, their 'remember me' cookie data is not automatically removed
-issue#4576: Stored XSS Issue in Cacti Device, Graph, Graph Template, and Graph Items callbacks
-issue#4577: Cacti allows you to disable the currently logged in administrator disabling the user
-issue#4578: The Cacti login algorithm is complicated to understand due to too much strait line code
-feature#4574: Cacti needs some additional permission methods for larger installations
This change properly documents the file lib/auth.php using phpDocument format, and performed multiple sanity and readability changes such as the renaming of variables commonly used in multiple functions.
The the restructuring of the three authentication files:
- auth_login.php
- include/auth.php
- lib/auth.php
Makes the code more readable, it's not a complete solution, however, it is much easier to follow now.
- Reports Tab always shows 'Administration' despite a users permissions
- Improves the caching of permissions to include both true and false to reduce page query load.
- Also short circuits is_realm_allowed() for CLI's
- The user and admin realms where flipped.
* Allow the get_template_account() function to be hookable by third party plugin
* Allow The User Management interface to be filterable by Realm
* Prevent Template User Accounts from being Removed
* Move the get_guest_account() and get_template_account() functions into lib/auth.php
* After authenticating via Web Basic Authentication, user always mapped as guest.
* This is a slight redesign to make provide a better flow. It will require rework to merge back to develop.
* deprecated use of display_custom_error_message()
* Add custom error message for basic authentication
* Fix some display issues on the settings page related to new settings.
* Make it clear in the cacti.log that LOGIN messages are failed or otherwise.
* Allow Setting of Cookie 'Cacti' domain edition
* This also allows the Cacti administrator to extend the content security policy to include unsafe-eval for scripts.
