- ensure that mime type will be updated.
- stop that rrd_function_process_graph_options will be forced to export PNG format only if Realtime has been identified as requestor.
- Graph CSV export NaN with wrong date range if browser timezone is different with web server
- This will ensure that the times in the browser match the backend too.
* Graph CSV export NaN with wrong date range if browser timezone is different with web server
* Data Collectors and Data Profiles Filter Sub-Panel Go buttons not working as expected
* Fixed#3422: COMMENT text_format does not replace Data Query if graph item does not associate to any datasource.
* Fixed#3422: Update CHANGELOG
Co-authored-by: Jing Chen <three_chenjing@sohu.com>
Co-authored-by: Mark Brugnoli-Vinten <netniv@hotmail.com>
This is a low risk exploit as the default Cacti configuration is set such that the Guest account is disabled, the Guest account has no access to realtime graphs under permissions and the guest template user is not set.
It should also be noted, that this issue only seems to affect PHP versions before 7.2 and as such that again mitigates the likelihood of this being exploited.
However, should someone running PHP 7.1 or before, enable access to realtime graphs for guest users (which is against the recommendations of the group), it would be possible to craft a malicious packet that could be executed unwittingly.
The main reason for this is a lack of escaping around the session_id() when assigned to the poller id whilst building on the command to run poller_realtime.php. The simple fix was to hash the value so that it generated a reasonable unique poller id, that couldn't execute code.
This fix has already been verified by @mhasker before posting his findings.
Closes#3285
* CVE-2019-16723 Security issue allows to view all graphs
* Thischange restores the check inside of lib/rrr.php and updates all but on calling of the graph function to include the user.
This should correct the boost and dsstat's issues. There were a few hands on this one and it had not undergone a full regression in a while.
This update should speed things up pretty signifcantly.
First, don't check the last_update time if rrdtool is >= 1.5
Second, we can accurately assume that the filemtime() is the last update time. This speeds things up dramatically.
* When working in pipe mode RRDtool appends stderr to stdout causing SVG graphing to break
* Removing GIF87 as it's no longer supported
* Adding new Trim function
The percentile calculation sorting ends up using incorrect step length due to incorrect sorting. I'm not actually 100% sure what the intended behavior here is, so I left it as sorting by step first, and steps second, though on my graphs steps seems to work just fine.
TheWitness