diff --git a/pandora_console/ChangeLog b/pandora_console/ChangeLog index c0bf0366ab..209fde642e 100644 --- a/pandora_console/ChangeLog +++ b/pandora_console/ChangeLog @@ -1,3 +1,19 @@ +2008-09-03 Evi Vanoost + + * reporting/fgraph.php: Fixed bug where a graph wouldn't return + when free search was specified. Also made SQL safer against + attacks since fgraph can be accessed by anyone. This should be + fixed in later versions so there has to be no SQL query passed + + * operation/events/events_rss.php: Made RSS feed better. Now you can + also pass a filter from events.php. Fixed direction of the links + + * operation/events/events.php: Added a filter on agent name. Updated + for RSS feeds. Added filter on event id + + * install.php: A little bit of automatic field filling. Corrected some + text for more correct English and update to the new URL specification + 2008-09-03 Esteban Sanchez * include/functions_html.php: Fixed a typo error in print_textarea diff --git a/pandora_console/install.php b/pandora_console/install.php index ff524eac2f..200d3663d2 100644 --- a/pandora_console/install.php +++ b/pandora_console/install.php @@ -317,13 +317,13 @@ function install_step3() { + value='".dirname (__FILE__)."'> -
Full local URL to Pandora FMS Console
+
URL path to Pandora FMS Console
For example '/pandora_console'
+ value='".dirname ($_SERVER['PHP_SELF'])."'>
@@ -474,7 +474,7 @@ function install_step5() {

Installation complete

You now must delete manually this installer ('install.php') file for security before trying to access to your Pandora FMS console. -

Now you need to install Pandora FMS server before trying to monitor anything, +

You should also install the Pandora FMS Servers before trying to monitor anything, please read documentation on how to install it.

Don't forget to check http://pandorafms.com for updates. diff --git a/pandora_console/operation/events/events.php b/pandora_console/operation/events/events.php index 30105418e3..13358f88ed 100644 --- a/pandora_console/operation/events/events.php +++ b/pandora_console/operation/events/events.php @@ -164,13 +164,14 @@ if (isset ($_POST["updatebt"])) { // Get data -$offset = get_parameter ( "offset",0); -$ev_group = get_parameter ("ev_group", 0); // group +$offset = (int) get_parameter ( "offset",0); +$ev_group = (int) get_parameter ("ev_group", 0); // group $search = get_parameter ("search", ""); // free search $event_type = get_parameter ("event_type", ''); // 0 all -$severity = get_parameter ("severity", -1); // -1 all -$status = get_parameter ("status", 0); // -1 all, 0 only red, 1 only green -$id_agent = get_parameter ("id_agent", -1); +$severity = (int) get_parameter ("severity", -1); // -1 all +$status = (int) get_parameter ("status", 0); // -1 all, 0 only red, 1 only green +$id_agent = (int) get_parameter ("id_agent", -1); +$id_event = (int) get_parameter ("id_event", -1); $sql_post = ""; if ($ev_group > 1) @@ -184,10 +185,13 @@ if ($search != "") if ($event_type != "") $sql_post .= " AND event_type = '$event_type'"; if ($severity != -1) - $sql_post .= " AND criticity >= $severity"; + $sql_post .= " AND criticity >= ".$severity; if ($id_agent != -1) - $sql_post .= " AND id_agente = $id_agent"; -$url = "index.php?sec=eventos&sec2=operation/events/events&search=$search&event_type=$event_type&severity=$severity&status=$status&ev_group=$ev_group&refr=60&id_agent=$id_agent"; + $sql_post .= " AND id_agente = ".$id_agent; +if ($id_event != -1) + $sql_post .= " AND id_evento = ".$id_event; + +$url = "index.php?sec=eventos&sec2=operation/events/events&search=$search&event_type=$event_type&severity=$severity&status=$status&ev_group=$ev_group&refr=60&id_agent=$id_agent&id_event=$id_event"; echo "

".__('Events')." > ".__('Main event view'). " "; @@ -250,7 +254,24 @@ echo ""; // Free search echo "".__('Free search').""; print_input_text ('search', $search, '', 15); -echo ""; + +//Agent search +echo "".__('Agent search').""; +$sql = "SELECT DISTINCT(id_agente) FROM tevento WHERE 1=1 ".$sql_post; +$result = get_db_all_rows_sql ($sql); +if ($result === false) + $result = array(); +$agents = array(-1 => "All"); + +foreach ($result as $id_row) { + $agents[$id_row[0]] = dame_nombre_agente ($id_row[0]); +} + +print_select ($agents, 'id_agent', $id_agent, 'javascript:this.form.submit();', '', ''); +echo ""; + +//The buttons +echo ''; print_submit_button (__('Update'), '', false, $attributes = 'class="sub upd"'); // CSV @@ -260,7 +281,7 @@ echo '    // Marquee echo " "; // RSS -echo " "; +echo ' '; echo ""; diff --git a/pandora_console/operation/events/events_rss.php b/pandora_console/operation/events/events_rss.php index ceca2eb1be..b4acd9dd89 100644 --- a/pandora_console/operation/events/events_rss.php +++ b/pandora_console/operation/events/events_rss.php @@ -16,54 +16,82 @@ // along with this program; if not, write to the Free Software // Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -error_reporting(E_ALL); - require "../../include/config.php"; require "../../include/functions.php"; require_once "../../include/functions_db.php"; -$constraints = ""; +$ev_group = get_parameter ("ev_group", 0); // group +$search = get_parameter ("search", ""); // free search +$event_type = get_parameter ("event_type", ''); // 0 all +$severity = (int) get_parameter ("severity", -1); // -1 all +$status = (int) get_parameter ("status", 0); // -1 all, 0 only red, 1 only green +$id_agent = (int) get_parameter ("id_agent", -1); +$id_event = (int) get_parameter ("id_event", -1); //This will allow to select only 1 event (eg. RSS) +$sql_post = ""; +if ($ev_group > 1) + $sql_post .= " AND `tevento`.`id_grupo` = $ev_group"; +if ($status == 1) + $sql_post .= " AND `tevento`.`estado` = 1"; +if ($status == 0) + $sql_post .= " AND `tevento`.`estado` = 0"; +if ($search != "") + $sql_post .= " AND `tevento`.`evento` LIKE '%$search%'"; +if ($event_type != "") + $sql_post .= " AND `tevento`.`event_type` = '$event_type'"; +if ($severity != -1) + $sql_post .= " AND `tevento`.`criticity` >= ".$severity; +if ($id_agent != -1) + $sql_post .= " AND `tevento`.`id_agente` = ".$id_agent; +if ($id_event != -1) + $sql_post .= " AND id_evento = ".$id_event; + +$sql="SELECT `tevento`.`id_evento` AS event_id, + `tagente`.`nombre` AS agent_name, + `tevento`.`id_usuario` AS validated_by, + `tevento`.`estado` AS validated, + `tevento`.`evento` AS event_descr, + `tevento`.`utimestamp` AS unix_timestamp + FROM tevento, tagente + WHERE `tevento`.`id_agente` = `tagente`.`id_agente` ".$sql_post." + ORDER BY utimestamp DESC LIMIT 0 , 30"; -$sql="SELECT `tevento`.`id_evento` AS event_id, `tagente`.`nombre` AS agent_name, `tevento`.`id_usuario` AS validated_by , `tevento`.`estado` AS validated, `tevento`.`evento` AS event_descr , `tevento`.`utimestamp` AS unix_timestamp, `tgrupo`.`nombre` AS group_name, `tgrupo`.`icon` AS group_icon -FROM tevento, tagente, tgrupo -WHERE `tevento`.`id_agente` = `tagente`.`id_agente` AND `tevento`.`id_grupo` = `tgrupo`.`id_grupo` $constraints -ORDER BY utimestamp DESC -LIMIT 0 , 30"; - -$result=mysql_query($sql); +$result= get_db_all_rows_sql ($sql); //$url = "https://".$_SERVER['HTTP_HOST']."/pandora_console"; $url = 'http://'.$_SERVER['HTTP_HOST'].$config["homeurl"]; +$selfurl = 'http://'.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF'].'?'.$_SERVER['QUERY_STRING']; +$rss_feed = ''; +$rss_feed .= 'Pandora RSS FeedLatest events on Pandora'; +$rss_feed .= ''.date(DATE_RFC822, $result[0]['unix_timestamp']).''; +$rss_feed .= ''.$url.''; +$rss_feed .= ''; -$rss_feed = ' -Pandora RSS Feed -Latest events on Pandora -' . $url . ' -'; +if ($result === false) { + $result = array(); + $rss_feed .= ''.$url.'/index.php?sec=eventos&sec2=operation/events/eventsNo results'; + $rss_feed .= 'There are no results. Click on the link to see all Pending events'; + $rss_feed .= ''.$url.'/index.php?sec=eventos&sec2=operation/events/events'; +} -while($row=mysql_fetch_array($result,MYSQL_ASSOC)) { +foreach ($result as $row) { //This is mandatory $rss_feed .= ''; - $rss_feed .= $url . "/operation/events/view_event?id=" . $row['event_id']; + $rss_feed .= htmlentities ($url . "/index.php?sec=eventos&sec2=operation/events/events&id_event=" . $row['event_id']); $rss_feed .= ''; - $rss_feed .= htmlentities($row['agent_name']); + $rss_feed .= htmlentities ($row['agent_name']); $rss_feed .= ''; - $rss_feed .= htmlentities($row['event_descr']); - if($row['validated'] == 1) { - $rss_feed .= '

Validated by ' . $row['validated_by']; - } + $rss_feed .= htmlentities ($row['event_descr']); + if($row['validated'] == 1) { + $rss_feed .= '

Validated by ' . $row['validated_by']; + } $rss_feed .= ''; - $rss_feed .= $url . "/operation/events/view_event?id=" . $row["event_id"]; + $rss_feed .= htmlentities ($url . "/index.php?sec=eventos&sec2=operation/events/events&id_event=" . $row["event_id"]); $rss_feed .= ''; + //The rest is optional $rss_feed .= '' . date(DATE_RFC822, $row['unix_timestamp']) . ''; - $rss_feed .= ''; - $rss_feed .= '' . $url . ''; - $rss_feed .= '' . $row['group_name'] . ''; - $rss_feed .= '' . $url . '/images/groups_small/' . $row['group_icon'] . '.png'; - $rss_feed .= ''; //This is mandatory again $rss_feed .= ''; diff --git a/pandora_console/reporting/fgraph.php b/pandora_console/reporting/fgraph.php index 9bd68c3cf4..3b8d3b5caf 100644 --- a/pandora_console/reporting/fgraph.php +++ b/pandora_console/reporting/fgraph.php @@ -1325,7 +1325,7 @@ function graph_event_module ($width = 300, $height = 200, $id_agent) { $data = array(); $legend = array(); - $sql = "SELECT DISTINCT(id_agentmodule) AS id_agentmodule, id_grupo, COUNT(id_agentmodule) AS count FROM tevento WHERE id_agente = ".$id_agent." GROUP BY id_agentmodule"; + $sql = sprintf ("SELECT DISTINCT(id_agentmodule) AS id_agentmodule, id_grupo, COUNT(id_agentmodule) AS count FROM tevento WHERE id_agente = %d GROUP BY id_agentmodule",$id_agent); $result = get_db_all_rows_sql ($sql); if ($result === false) $result = array(); @@ -1359,10 +1359,13 @@ function graph_event_module ($width = 300, $height = 200, $id_agent) { function grafico_eventos_grupo ($width = 300, $height = 200, $url = "") { global $config; - $url = rawurldecode ($url); //It was urlencoded, so we urldecode it + $url = html_entity_decode (rawurldecode ($url),ENT_QUOTES); //It was urlencoded, so we urldecode it $data = array(); $legend = array(); - + + $badstrings = array (";", "SELECT ", "DELETE ", "UPDATE ", "INSERT "); + $url = str_ireplace ($badstrings,"",$url); //remove bad strings from the query so queries like ; DELETE FROM don't pass + //This will give the distinct id_agente, give the id_grupo that goes //with it and then the number of times it occured. GROUP BY statement //is required if both DISTINCT() and COUNT() are in the statement