- Browsers to begin rejecting CactiTimeZone and CactiDateTime cookies due to SameSite Requirements
- Remember me not working after upgrade to 1.2.20 from 1.2.19
* add mark.js
* Update main.css
- fix and force height calculation of cactiHead, breadbrumbar and cactiContent in standard mode
- fix scrollbar border color of console menu for WebKit browser in standard mode
* start splitting CSS
split CSS in 'core' containing all elements Cacti provides, while MidWinter CSS will be maintained separately
* Update jquery.zoom.css
fix borders,
* drop unused media query
1280 definition have not been become active yet.
* add print css
keep print separately, too.
* Update min-width-600.css
skip particles - would have been nice, but MidWinter is already heavy enough.
* split compact mode
more css changes
* more separation
see above
* move css out of main
remove remaining css fragments
* fix kiosk mode
kwt
* start restructuring standard layout
more css
* change compact menu click on
hide menu automatically when menuitem clicked.
-security#4576: Stored XSS Issue in Cacti Device, Graph, Graph Template, and Graph Items callbacks
-security#4579: Cacti account lockout policies are not properly applied to LDAP and Domain Users
-issue#4573: The Cacti permission system does not scale to very large installations
-issue#4575: When you delete a user, their 'remember me' cookie data is not automatically removed
-issue#4576: Stored XSS Issue in Cacti Device, Graph, Graph Template, and Graph Items callbacks
-issue#4577: Cacti allows you to disable the currently logged in administrator disabling the user
-issue#4578: The Cacti login algorithm is complicated to understand due to too much strait line code
-feature#4574: Cacti needs some additional permission methods for larger installations
This change properly documents the file lib/auth.php using phpDocument format, and performed multiple sanity and readability changes such as the renaming of variables commonly used in multiple functions.
The the restructuring of the three authentication files:
- auth_login.php
- include/auth.php
- lib/auth.php
Makes the code more readable, it's not a complete solution, however, it is much easier to follow now.
- Some Cacti PSR on main.js
- Don't show the console if the user does not have access
- Don't show miscellaneous if the user does not have any extra tabs
- i18n Many strings in English
- Detect pages even when their action does not match the navigation like graph_view.php
- Fix two memory leaks
- Remove some white space
- Clicking the Cacti Logo when you don't have access to the console takes you to cacti.net instead
- Update base language file
- Cacti should disallow deleting the currently logged in user
- Cacti incorrectly uses the user_auth_cache from identical username from the wrong realm
- This second issue may require further work, but no in the 1.2.20 release
TheWitness