tyler.durden/pandorafms
1
0
Fork 0
mirror of https://github.com/pandorafms/pandorafms.git synced 2025-07-28 08:14:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

2009-03-27 Evi Vanoost <vanooste@rcbi.rochester.edu>

Browse Source 
* include/functions_db.php: Fixed group functions that would return
	data even if the user didn't have access to the group. Added 
	safe_acl_group which filters out groups the user doesn't have access to
	out of an array of groups. Added check_acl which deprecates give_acl
	(new naming scheme)


git-svn-id: https://svn.code.sf.net/p/pandora/code/trunk@1576 c3f86ba8-e40f-0410-aaad-9ba5e7f4b01f
This commit is contained in:
guruevi 2009-03-27 20:01:13 +00:00
parent 7354f983bd
commit 413619dba5
2 changed files with 140 additions and 84 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
pandora_console/ChangeLog
View File

@ -1,3 +1,11 @@
2009-03-27 Evi Vanoost <vanooste@rcbi.rochester.edu>
* include/functions_db.php: Fixed group functions that would return
data even if the user didn't have access to the group. Added
safe_acl_group which filters out groups the user doesn't have access to
out of an array of groups. Added check_acl which deprecates give_acl
(new naming scheme)
2009-03-27 Esteban Sanchez <estebans@artica.es> 2009-03-27 Esteban Sanchez <estebans@artica.es>
* include/functions_ui.php: Put template details icon on the left of * include/functions_ui.php: Put template details icon on the left of

140
pandora_console/include/functions_db.php
View File

@ -59,36 +59,37 @@ function check_login () {
* PM - Pandora Management * PM - Pandora Management
* *
* @param int $id_user User id * @param int $id_user User id
* @param int $id_group Agents group id * @param int $id_group Agents group id to check from
* @param string $access Access privilege * @param string $access Access privilege
* *
* @return bool 1 if the user has privileges, 0 if not. * @return bool 1 if the user has privileges, 0 if not.
*/ */
function give_acl ($id_user, $id_group, $access) { function check_acl ($id_user, $id_group, $access) {
// IF user is level = 1 then always return 1 if (empty ($id_user)) {
//User ID needs to be specified
global $config; trigger_error ("Security error: check_acl got an empty string for user id", E_USER_WARNING);
$nivel = is_user_admin ($id_user); return 0;
if ($nivel) { } elseif (is_user_admin ($id_user)) {
return 1; return 1;
//Apparently nivel is 1 if user has full admin access } else {
$id_group = (int) $id_group;
} }
//Joined multiple queries into one. That saves on the query overhead and query cache. //Joined multiple queries into one. That saves on the query overhead and query cache.
if ($id_group == 0) { if ($id_group == 0) {
$query1=sprintf("SELECT tperfil.incident_view,tperfil.incident_edit,tperfil.incident_management,tperfil.agent_view,tperfil.agent_edit,tperfil.alert_edit,tperfil.alert_management,tperfil.pandora_management,tperfil.db_management,tperfil.user_management FROM tusuario_perfil,tperfil WHERE tusuario_perfil.id_perfil = tperfil.id_perfil AND tusuario_perfil.id_usuario = '%s'", $id_user); $query = sprintf("SELECT tperfil.incident_view,tperfil.incident_edit,tperfil.incident_management,tperfil.agent_view,tperfil.agent_edit,tperfil.alert_edit,tperfil.alert_management,tperfil.pandora_management,tperfil.db_management,tperfil.user_management FROM tusuario_perfil,tperfil WHERE tusuario_perfil.id_perfil = tperfil.id_perfil AND tusuario_perfil.id_usuario = '%s'", $id_user);
//GroupID = 0, access doesnt matter (use with caution!) - Any user gets access to group 0 //GroupID = 0, group id doesnt matter (use with caution!)
} else { } else {
$query1=sprintf("SELECT tperfil.incident_view,tperfil.incident_edit,tperfil.incident_management,tperfil.agent_view,tperfil.agent_edit,tperfil.alert_edit,tperfil.alert_management,tperfil.pandora_management,tperfil.db_management,tperfil.user_management FROM tusuario_perfil,tperfil WHERE tusuario_perfil.id_perfil = tperfil.id_perfil $query = sprintf("SELECT tperfil.incident_view,tperfil.incident_edit,tperfil.incident_management,tperfil.agent_view,tperfil.agent_edit,tperfil.alert_edit,tperfil.alert_management,tperfil.pandora_management,tperfil.db_management,tperfil.user_management FROM tusuario_perfil,tperfil WHERE tusuario_perfil.id_perfil = tperfil.id_perfil
AND tusuario_perfil.id_usuario = '%s' AND (tusuario_perfil.id_grupo = %d OR tusuario_perfil.id_grupo = 1)", $id_user, $id_group); AND tusuario_perfil.id_usuario = '%s' AND (tusuario_perfil.id_grupo = %d OR tusuario_perfil.id_grupo = 1)", $id_user, $id_group);
} }
$rowdup = get_db_all_rows_sql ($query1); $rowdup = get_db_all_rows_sql ($query);
if (empty ($rowdup))
return 0;
$result = 0; $result = 0;
if (!$rowdup)
return $result;
foreach ($rowdup as $row) { foreach ($rowdup as $row) {
// For each profile for this pair of group and user do... // For each profile for this pair of group and user do...
switch ($access) { switch ($access) {
@ -124,11 +125,59 @@ function give_acl ($id_user, $id_group, $access) {
break; break;
} }
} }
if ($result > 1)
$result = 1; if ($result >= 1)
return $result; return 1;
return 0;
} }
/*
* @deprecated Use check_acl instead
*/
function give_acl ($id_user, $id_group, $access) {
return check_acl ($id_user, $id_group, $access);
}
/**
* Filter out groups the user doesn't have access to
*
* Access can be:
* IR - Incident Read
* IW - Incident Write
* IM - Incident Management
* AR - Agent Read
* AW - Agent Write
* LW - Alert Write
* UM - User Management
* DM - DB Management
* LM - Alert Management
* PM - Pandora Management
*
* @param int $id_user User id
* @param mixed $id_group Group ID(s) to check
* @param string $access Access privilege
*
* @return array Groups the user DOES have acces to (or an empty array)
*/
function safe_acl_group ($id_user, $id_groups, $access) {
if (!is_array ($id_groups) && check_acl ($id_user, $id_groups, $access)) {
return array ($id_groups);
} elseif (!is_array ($id_groups)) {
return array ();
}
foreach ($id_groups as $group) {
//Check ACL. If it doesn't match, remove the group
if (!check_acl ($id_user, $group, $access)) {
unset ($id_groups[$group]);
}
}
return $id_groups;
}
/** /**
* Adds an audit log entry. * Adds an audit log entry.
* *
@ -266,7 +315,7 @@ function give_disabled_group ($id_group) {
} }
/** /**
* Get all the agents within a group(s). For non-godmode usage get_user_groups should be used. * Get all the agents within a group(s).
* *
* @param mixed $id_group Group id or an array of ID's. If nothing is selected, it will select all * @param mixed $id_group Group id or an array of ID's. If nothing is selected, it will select all
* @param bool $disabled Add disabled agents to agents. Default: False. * @param bool $disabled Add disabled agents to agents. Default: False.
@ -275,24 +324,19 @@ function give_disabled_group ($id_group) {
* @return array An array with all agents in the group or an empty array * @return array An array with all agents in the group or an empty array
*/ */
function get_group_agents ($id_group = 0, $disabled = false, $case = "lower") { function get_group_agents ($id_group = 0, $disabled = false, $case = "lower") {
$id_group = safe_int ($id_group, 1); global $config;
//If id_group is an array, then $id_group = safe_acl_group ($config["id_user"], $id_group, "AR");
if (empty ($id_group) || in_array (1, (array) $id_group)) {
//If All is included in the group list, just select All if (empty ($id_group)) {
$id_group = 1; //An empty array means the user doesn't have access
} else { return array ();
//If All is not included, select what we need
$id_group = implode (",", (array) $id_group);
} }
/* 'All' group must return all agents */ $search = sprintf ('WHERE id_grupo IN (%s)', implode (",", $id_group));
$search = '';
if (!empty ($id_group) && $id_group > 1) { if (!empty ($disabled)) {
$search .= sprintf (' WHERE id_grupo IN (%s)', $id_group); $search .= ' AND disabled = 0';
}
if ($disabled !== false) {
$search .= (($search == '') ? ' WHERE' : ' AND' ).' disabled = 0';
} }
$sql = sprintf ("SELECT id_agente, nombre FROM tagente %s ORDER BY nombre", $search); $sql = sprintf ("SELECT id_agente, nombre FROM tagente %s ORDER BY nombre", $search);
@ -666,27 +710,29 @@ function get_monitors_in_group ($id_group) {
* *
* The returned events will be in the time interval ($date - $period, $date] * The returned events will be in the time interval ($date - $period, $date]
* *
* @param int $id_group Group id to get events. * @param mixed $id_group Group id to get events for.
* @param int $period Period of time in seconds to get events. * @param int $period Period of time in seconds to get events.
* @param int $date Beginning date to get events. * @param int $date Beginning date to get events.
* *
* @return array An array with all the events happened. * @return array An array with all the events happened.
*/ */
function get_group_events ($id_group, $period, $date) { function get_group_events ($id_group, $period, $date) {
global $config;
$id_group = safe_acl_group ($config["id_user"], $id_group, "AR");
if (empty ($id_group)) {
//An empty array means the user doesn't have access
return false;
}
$datelimit = $date - $period; $datelimit = $date - $period;
if ($id_group == 1) {
$sql = sprintf ('SELECT * FROM tevento $sql = sprintf ('SELECT * FROM tevento
WHERE utimestamp > %d AND utimestamp <= %d WHERE utimestamp > %d AND utimestamp <= %d
AND id_grupo IN (%s)
ORDER BY utimestamp ASC', ORDER BY utimestamp ASC',
$datelimit, $date); $datelimit, $date, implode (",", $id_group));
} else {
$sql = sprintf ('SELECT * FROM tevento
WHERE utimestamp > %d AND utimestamp <= %d
AND id_grupo = %d
ORDER BY utimestamp ASC',
$datelimit, $date, $id_group);
}
return get_db_all_rows_sql ($sql); return get_db_all_rows_sql ($sql);
} }
@ -794,9 +840,11 @@ function get_alert_fires_in_period ($id_alert_module, $period, $date = 0) {
* @return array An array with alerts dictionaries defined in a group. * @return array An array with alerts dictionaries defined in a group.
*/ */
function get_group_alerts ($id_group) { function get_group_alerts ($id_group) {
require_once ('include/functions_agents.php');
$alerts = array (); $alerts = array ();
$agents = get_group_agents ($id_group, false, "none"); $agents = get_group_agents ($id_group, false, "none");
require_once ('include/functions_agents.php');
foreach ($agents as $agent_id => $agent_name) { foreach ($agents as $agent_id => $agent_name) {
$agent_alerts = get_agent_alerts ($agent_id); $agent_alerts = get_agent_alerts ($agent_id);
$alerts = array_merge ($alerts, $agent_alerts); $alerts = array_merge ($alerts, $agent_alerts);