[icinga-devel] Fwd: [Nagios-devel] host/servicegroup commands

Robert Marxreiter rmarxreiter at web.de
Sat Jun 25 23:37:06 CEST 2011


Hello,

this bug seems to apply to icinga as well.

Regards
- Robert

-------- Original Message --------
Subject: 	[Nagios-devel] host/servicegroup commands
Date: 	Sat, 25 Jun 2011 17:11:29 +0200
From: 	Sven Nierlein <sven.nierlein at consol.de>
Reply-To: 	Nagios Developers List <nagios-devel at lists.sourceforge.net>
To: 	nagios-devel at lists.sourceforge.net



Hi,

One of our customers found a bug in the nagios cgis. It's easy to reproduce:

1. create a new user
2. give him authorized_for_all_services and authorized_for_all_hosts in
your cgi.cfg

The contact should now be able to see all hosts and services but should
not be allowed to submit any commands.
However, if the contact submits hostgroup or servicegroup commands, they
are accepted and executed.
The attached patch fixes that behavior.

Regards,
    Sven


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.icinga.org/pipermail/icinga-devel/attachments/20110625/5e7746d9/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-host_servicegroup_auth_fix.patch
Type: text/x-patch
Size: 2947 bytes
Desc: not available
URL: <http://lists.icinga.org/pipermail/icinga-devel/attachments/20110625/5e7746d9/attachment.bin>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: Attached Message Part
URL: <http://lists.icinga.org/pipermail/icinga-devel/attachments/20110625/5e7746d9/attachment.ksh>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: Attached Message Part
URL: <http://lists.icinga.org/pipermail/icinga-devel/attachments/20110625/5e7746d9/attachment-0001.ksh>


More information about the icinga-devel mailing list