-security#4576: Stored XSS Issue in Cacti Device, Graph, Graph Template, and Graph Items callbacks
-security#4579: Cacti account lockout policies are not properly applied to LDAP and Domain Users
-issue#4573: The Cacti permission system does not scale to very large installations
-issue#4575: When you delete a user, their 'remember me' cookie data is not automatically removed
-issue#4576: Stored XSS Issue in Cacti Device, Graph, Graph Template, and Graph Items callbacks
-issue#4577: Cacti allows you to disable the currently logged in administrator disabling the user
-issue#4578: The Cacti login algorithm is complicated to understand due to too much strait line code
-feature#4574: Cacti needs some additional permission methods for larger installations
This change properly documents the file lib/auth.php using phpDocument format, and performed multiple sanity and readability changes such as the renaming of variables commonly used in multiple functions.
The the restructuring of the three authentication files:
- auth_login.php
- include/auth.php
- lib/auth.php
Makes the code more readable, it's not a complete solution, however, it is much easier to follow now.
- Reports Tab always shows 'Administration' despite a users permissions
- Improves the caching of permissions to include both true and false to reduce page query load.
- Also short circuits is_realm_allowed() for CLI's
- The user and admin realms where flipped.
This variable always existed, but was never exposed. This change will expose that setting and cleanup a bit of the variable definitions. We've gone between l10n and i18n in various areas of the API, and moving everything to i18n now too.
* After authenticating via Web Basic Authentication, user always mapped as guest.
* This is a slight redesign to make provide a better flow. It will require rework to merge back to develop.
* deprecated use of display_custom_error_message()
* Add custom error message for basic authentication
* Fix some display issues on the settings page related to new settings.
* Make it clear in the cacti.log that LOGIN messages are failed or otherwise.
* DSStats Does not Scale on Large Systems
* DSStats will get invalid data for some devices after reboot requiring purging of stats
This is way less than what I want to do, but these are all essentially bugs.
There is also a change to lib/boost.php to provide better debug logging when testing.
issue#4324: Date/Time format of replacement fild on graph cannot be changed
issue#4325: Make identifying rows when editing graph items easier
issue#4326: When using large lists, selection is visible in dropdown menus
* Add ability to set how long a user can stay logged in before being automatically logged out
* Update CHANGELOG
* Changed the option in the drop-down to Default rather than Never to avoid confusion
* The auto logout time can not be greater than gc_maxlifetime
* Setting maximum value as 4 Weeks as this is the maximum that session.gc_maxlifetime will allow
* Fixed login loop if no value set on Auto Log Out Time
* Removing debate on the argument.
* Update global_settings.php
* Wrong Realm
* Secondary check
* Update global_settings.php
Co-authored-by: TheWitness <thewitness@cacti.net>
- cmd.php error response logging is not properly following the detailed/summary logging setting
- This is basically a rewrite of the cmd.php that makes it much easier to read, and actually makes it 2x faster than previous versions.
- Change the 'tics' behavior to not loop so hard watching for signals.
- Makes the snmp session data passing more reasonable
- Like spine, if a host times out when attempting to fetch and OID, the remainder of the host will be skipped, resulting in a more reliable performance as well.
* Add ability to set how long a user can stay logged in before being automatically logged out
* Update CHANGELOG
* Update global_session.php
Co-authored-by: TheWitness <thewitness@cacti.net>
* Graph CSV export NaN with wrong date range if browser timezone is different with web server
* Data Collectors and Data Profiles Filter Sub-Panel Go buttons not working as expected
* 1.2.11 shows snmpv3 password is not obfuscated in device defaults screen
* In automation, when viewing an 'SNMP option set', the private passphrase is in clear
* Allow Setting of Cookie 'Cacti' domain edition
* This also allows the Cacti administrator to extend the content security policy to include unsafe-eval for scripts.
* Any tree or branch with a long name force main content off screen
* Long hostnames cause template filter to go off page
* Tree view cuts off at the bottom of page on modern theme
* Introducing new settings Min Tree Width and Max Tree Width in Settings > Visual and User Profile.
* Corrects a major slowdown in graph templates are presented due to removal of very slow textWidth() function.
TheWitness