nagios4/debian/patches/99_security_status_cgi_servicegroup.patch
2017-05-19 22:22:41 +02:00

51 lines
1.5 KiB
Diff

Author: Jonas Meurer <jmeurer@inet.de>
Description: Stop cgi-bin/status.c from listing unauthorized hosts and
services in servicegroup view
Upstream bugreport: http://tracker.nagios.org/view.php?id=456
--- a/cgi/status.c
+++ b/cgi/status.c
@@ -2547,6 +2547,10 @@
if(temp_host == NULL)
continue;
+ /* make sure user has rights to view this host */
+ if(is_authorized_for_host(temp_host, &current_authdata) == FALSE)
+ continue;
+
/* skip this if it isn't a new host... */
if(temp_host == last_host)
continue;
@@ -2752,6 +2756,10 @@
if(temp_host == NULL)
continue;
+ /* make sure user has rights to view this host */
+ if(is_authorized_for_host(temp_host, &current_authdata) == FALSE)
+ continue;
+
/* skip this if it isn't a new host... */
if(temp_host == last_host)
continue;
@@ -2936,6 +2944,10 @@
if(temp_service == last_service)
continue;
+ /* make sure user has rights to view this service */
+ if(is_authorized_for_service(temp_service, &current_authdata) == FALSE)
+ continue;
+
/* find the service status */
temp_servicestatus = find_servicestatus(temp_service->host_name, temp_service->description);
if(temp_servicestatus == NULL)
@@ -3290,6 +3302,10 @@
if(temp_host == NULL)
continue;
+ /* make sure user has rights to view this host */
+ if(is_authorized_for_host(temp_host, &current_authdata) == FALSE)
+ continue;
+
/* get the status of the host */
temp_hoststatus = find_hoststatus(temp_host->name);
if(temp_hoststatus == NULL)