diff --git a/pandora_console/ChangeLog b/pandora_console/ChangeLog index f90f699680..84d5a744e9 100644 --- a/pandora_console/ChangeLog +++ b/pandora_console/ChangeLog @@ -1,3 +1,18 @@ +2013-01-14 Sergio Martin + + * include/functions_ui.php + include/functions.php + operation/agentes/alerts_status.php + operation/agentes/estado_agente.php + godmode/agentes/module_manager.php + godmode/agentes/modificar_agente.php + godmode/agentes/configurar_agente.php + godmode/menu.php + godmode/alerts/alert_list.list.php + godmode/alerts/alert_list.php: Added checks to new flag AD + in godmode views for agents, modules and alerts. Clean + some old extra_sql (policy acls) code + 2013-01-14 Dario Rodriguez * pandoradb_data.sql: Added a missing column name in diff --git a/pandora_console/godmode/agentes/configurar_agente.php b/pandora_console/godmode/agentes/configurar_agente.php index 0df7ad5606..ec5614cb8b 100644 --- a/pandora_console/godmode/agentes/configurar_agente.php +++ b/pandora_console/godmode/agentes/configurar_agente.php @@ -26,23 +26,34 @@ ui_require_javascript_file('encode_decode_base64'); check_login (); +//Get tab parameter to check ACL in each tabs +$tab = get_parameter ('tab', 'main'); + //See if id_agente is set (either POST or GET, otherwise -1 $id_agente = (int) get_parameter ("id_agente"); $group = 0; if ($id_agente) $group = agents_get_agent_group ($id_agente); -$is_extra = enterprise_hook('policies_is_agent_extra_policy', array($id_agente)); - -if($is_extra === ENTERPRISE_NOT_HOOK) { - $is_extra = false; -} - -if (! check_acl ($config["id_user"], $group, "AW", $id_agente) && !$is_extra) { - db_pandora_audit("ACL Violation", - "Trying to access agent manager"); - require ("general/noaccess.php"); - return; +if (! check_acl ($config["id_user"], $group, "AW", $id_agente)) { + $access_granted = false; + switch($tab) { + case 'alert': + case 'module': + if (check_acl ($config["id_user"], $group, "AD", $id_agente)) { + $access_granted = true; + } + break; + default: + break; + } + + if(!$access_granted) { + db_pandora_audit("ACL Violation", + "Trying to access agent manager"); + require ("general/noaccess.php"); + return; + } } require_once ('include/functions_modules.php'); @@ -50,7 +61,6 @@ require_once ('include/functions_alerts.php'); require_once ('include/functions_reporting.php'); // Get passed variables -$tab = get_parameter ('tab', 'main'); $alerttype = get_parameter ('alerttype'); $id_agent_module = (int) get_parameter ('id_agent_module'); @@ -337,25 +347,33 @@ if ($id_agente) { $incidenttab['active'] = false; } - $onheader = array('view' => $viewtab, - 'separator' => "", - 'main' => $maintab, - 'module' => $moduletab, - 'alert' => $alerttab, - 'template' => $templatetab, - 'inventory' => $inventorytab, - 'pluginstab' => $pluginstab, - 'collection'=> $collectiontab, - 'group' => $grouptab, - 'gis' => $gistab); - - // Only if the agent has incidents associated show incidents tab - if ($total_incidents) { - $onheader['incident'] = $incidenttab; + if(check_acl ($config["id_user"], $group, "AW", $id_agente)) { + $onheader = array('view' => $viewtab, + 'separator' => "", + 'main' => $maintab, + 'module' => $moduletab, + 'alert' => $alerttab, + 'template' => $templatetab, + 'inventory' => $inventorytab, + 'pluginstab' => $pluginstab, + 'collection'=> $collectiontab, + 'group' => $grouptab, + 'gis' => $gistab); + + // Only if the agent has incidents associated show incidents tab + if ($total_incidents) { + $onheader['incident'] = $incidenttab; + } + } + else { + $onheader = array('view' => $viewtab, + 'separator' => "", + 'module' => $moduletab, + 'alert' => $alerttab); } foreach ($config['extensions'] as $extension) { - if (isset($extension['extension_god_tab'])) { + if (isset($extension['extension_god_tab']) && check_acl ($config["id_user"], $group, "AW", $id_agente)) { $image = $extension['extension_god_tab']['icon']; $name = $extension['extension_god_tab']['name']; $id = $extension['extension_god_tab']['id']; @@ -608,12 +626,7 @@ if ($update_agent) { // if modified some agent paramenter if ($id_agente) { //This has been done in the beginning of the page, but if an agent was created, this id might change $id_grupo = agents_get_agent_group ($id_agente); - $is_extra = enterprise_hook('policies_is_agent_extra_policy', array($id_agente)); - - if ($is_extra === ENTERPRISE_NOT_HOOK) { - $is_extra = false; - } - if (!check_acl ($config["id_user"], $id_grupo, "AW") && !$is_extra) { + if (!check_acl ($config["id_user"], $id_grupo, "AW") && !check_acl ($config["id_user"], $id_grupo, "AD")) { db_pandora_audit("ACL Violation","Trying to admin an agent without access"); require ("general/noaccess.php"); exit; @@ -648,6 +661,8 @@ if ($id_agente) { $update_module = (bool) get_parameter ('update_module'); $create_module = (bool) get_parameter ('create_module'); $delete_module = (bool) get_parameter ('delete_module'); +$enable_module = (int) get_parameter ('enable_module'); +$disable_module = (int) get_parameter ('disable_module'); //It is the id_agent_module to duplicate $duplicate_module = (int) get_parameter ('duplicate_module'); $edit_module = (bool) get_parameter ('edit_module'); @@ -656,18 +671,13 @@ $edit_module = (bool) get_parameter ('edit_module'); if ($update_module || $create_module) { $id_grupo = agents_get_agent_group ($id_agente); - $is_extra = enterprise_hook('policies_is_agent_extra_policy', array($id_agente)); - - if ($is_extra === ENTERPRISE_NOT_HOOK) { - $is_extra = false; - } - - if (!check_acl ($config["id_user"], $id_grupo, "AW") && !$is_extra) { + if (!check_acl ($config["id_user"], $id_grupo, "AW")) { db_pandora_audit("ACL Violation", "Trying to create a module without admin rights"); require ("general/noaccess.php"); exit; } + $id_module_type = (int) get_parameter ('id_module_type'); $name = (string) get_parameter ('name'); $description = (string) get_parameter ('description'); @@ -1195,6 +1205,36 @@ if (!empty($duplicate_module)) { // DUPLICATE agent module ! } } +// MODULE ENABLE/DISABLE +// ===================== +if($enable_module) { + $result = db_process_sql_update('tagente_modulo', array('disabled' => 0), array('id_agente_modulo' => $enable_module)); + + if ($result) { + db_pandora_audit("Module management", 'Enable ' . $enable_module); + } + else { + db_pandora_audit("Module management", 'Fail to enable ' . $enable_module); + } + + ui_print_result_message ($result, + __('Successfully enabled'), __('Could not be enabled')); +} + +if($disable_module) { + $result = db_process_sql_update('tagente_modulo', array('disabled' => 1), array('id_agente_modulo' => $disable_module)); + + if ($result) { + db_pandora_audit("Module management", 'Disable ' . $disable_module); + } + else { + db_pandora_audit("Module management", 'Fail to disable ' . $disable_module); + } + + ui_print_result_message ($result, + __('Successfully disabled'), __('Could not be disabled')); +} + // UPDATE GIS // ========== $updateGIS = get_parameter('update_gis', 0); diff --git a/pandora_console/godmode/agentes/modificar_agente.php b/pandora_console/godmode/agentes/modificar_agente.php index b9a9465ffe..cc931589d1 100644 --- a/pandora_console/godmode/agentes/modificar_agente.php +++ b/pandora_console/godmode/agentes/modificar_agente.php @@ -30,7 +30,7 @@ if ($ag_group == -1 ) if (($ag_group == -1) && ($group_id != 0)) $ag_group = $group_id; -if (! check_acl ($config["id_user"], 0, "AW")) { +if (! check_acl ($config["id_user"], 0, "AW") && ! check_acl ($config["id_user"], 0, "AD")) { db_pandora_audit("ACL Violation", "Trying to access agent manager"); require ("general/noaccess.php"); @@ -43,27 +43,6 @@ require_once ('include/functions_users.php'); $search = get_parameter ("search", ""); -$agent_to_delete = (int)get_parameter('borrar_agente'); - -$result = null; - -if (!empty($agent_to_delete)) { - $id_agente = $agent_to_delete; - $agent_name = agents_get_name ($id_agente); - $id_grupo = agents_get_agent_group($id_agente); - if (check_acl ($config["id_user"], $id_grupo, "AW")==1) { - $id_agentes[0] = $id_agente; - $result = agents_delete_agent($id_agentes); - } - else { - // NO permissions. - db_pandora_audit("ACL Violation", - "Trying to delete agent \'$agent_name\'"); - require ("general/noaccess.php"); - exit; - } -} - // Prepare the tab system to the future $tab = 'view'; @@ -82,8 +61,32 @@ $onheader = array('view' => $viewtab); // Header ui_print_page_header (__('Agent configuration')." » ".__('Agents defined in Pandora'), "", false, "", true, $onheader); -if (isset($result)) { +// Perform actions +$agent_to_delete = (int)get_parameter('borrar_agente'); +$enable_agent = (int)get_parameter('enable_agent'); +$disable_agent = (int)get_parameter('disable_agent'); + +$result = null; + +if ($agent_to_delete) { + $id_agente = $agent_to_delete; + $agent_name = agents_get_name ($id_agente); + $id_grupo = agents_get_agent_group($id_agente); + if (check_acl ($config["id_user"], $id_grupo, "AW")) { + $id_agentes[0] = $id_agente; + $result = agents_delete_agent($id_agentes); + } + else { + // NO permissions. + db_pandora_audit("ACL Violation", + "Trying to delete agent \'$agent_name\'"); + require ("general/noaccess.php"); + exit; + } + ui_print_result_message($result, __('Success deleted agent.'), __('Could not be deleted.')); + + // Check if the remote config file still exist if (isset ($config["remote_config"])) { $agent_md5 = md5 (agents_get_name($id_agente, ""), FALSE); @@ -94,6 +97,34 @@ if (isset($result)) { } } +if($enable_agent) { + $result = db_process_sql_update('tagente', array('disabled' => 0), array('id_agente' => $enable_agent)); + + if ($result) { + db_pandora_audit("Agent management", 'Enable ' . $enable_agent); + } + else { + db_pandora_audit("Agent management", 'Fail to enable ' . $enable_agent); + } + + ui_print_result_message ($result, + __('Successfully enabled'), __('Could not be enabled')); +} + +if($disable_agent) { + $result = db_process_sql_update('tagente', array('disabled' => 1), array('id_agente' => $disable_agent)); + + if ($result) { + db_pandora_audit("Agent management", 'Disable ' . $disable_agent); + } + else { + db_pandora_audit("Agent management", 'Fail to disable ' . $disable_agent); + } + + ui_print_result_message ($result, + __('Successfully disabled'), __('Could not be disabled')); +} + // Show group selector if (isset($_POST["ag_group"])) { $ag_group = get_parameter_post ("ag_group"); @@ -250,24 +281,21 @@ if ($ag_group > 0) { } } else { - // CLEAN: sql_extra - $sql_extra = ''; - // Admin user get ANY group, even if they doesnt exist if (check_acl ($config['id_user'], 0, "PM")) { - $sql = sprintf ('SELECT COUNT(*) FROM tagente WHERE (1=1 %s) %s', $search_sql, $sql_extra); + $sql = sprintf ('SELECT COUNT(*) FROM tagente WHERE 1=1 %s', $search_sql); $total_agents = db_get_sql ($sql); switch ($config["dbtype"]) { case "mysql": $sql = sprintf ('SELECT * - FROM tagente WHERE (1=1 %s) %s - ORDER BY %s, %s %s LIMIT %d, %d', $search_sql, $sql_extra, $order['field'], $order['field2'], + FROM tagente WHERE 1=1 %s + ORDER BY %s, %s %s LIMIT %d, %d', $search_sql, $order['field'], $order['field2'], $order['order'], $offset, $config["block_size"]); break; case "postgresql": $sql = sprintf ('SELECT * - FROM tagente WHERE (1=1 %s) %s - ORDER BY %s, %s %s LIMIT %d OFFSET %d', $search_sql, $sql_extra, $order['field'], $order['field2'], + FROM tagente WHERE 1=1 %s + ORDER BY %s, %s %s LIMIT %d OFFSET %d', $search_sql, $order['field'], $order['field2'], $order['order'], $config["block_size"], $offset); break; case "oracle": @@ -275,40 +303,46 @@ else { $set['limit'] = $config["block_size"]; $set['offset'] = $offset; $sql = sprintf ('SELECT * - FROM tagente WHERE (1=1 %s) %s - ORDER BY %s, %s %s', $search_sql, $sql_extra, $order['field'], $order['field2'], $order['order']); + FROM tagente WHERE 1=1 %s + ORDER BY %s, %s %s', $search_sql, $order['field'], $order['field2'], $order['order']); $sql = oracle_recode_query ($sql, $set); break; } } else { + // Concatenate AW and AD permisions to get all the possible groups where the user can manage + $user_groupsAW = users_get_groups ($config['id_user'], 'AW'); + $user_groupsAD = users_get_groups ($config['id_user'], 'AD'); + + $user_groups = $user_groupsAW + $user_groupsAD; + $sql = sprintf ('SELECT COUNT(*) FROM tagente - WHERE (id_grupo IN (%s) - %s) %s', - implode (',', array_keys (users_get_groups ())), - $search_sql, $sql_extra); + WHERE id_grupo IN (%s) + %s', + implode (',', array_keys ($user_groups)), + $search_sql); $total_agents = db_get_sql ($sql); - + switch ($config["dbtype"]) { case "mysql": $sql = sprintf ('SELECT * FROM tagente - WHERE (id_grupo IN (%s) - %s) %s + WHERE id_grupo IN (%s) + %s ORDER BY %s, %s %s LIMIT %d, %d', - implode (',', array_keys (users_get_groups ())), - $search_sql, $sql_extra, $order['field'], $order['field2'], $order['order'], $offset, $config["block_size"]); + implode (',', array_keys ($user_groups)), + $search_sql, $order['field'], $order['field2'], $order['order'], $offset, $config["block_size"]); break; case "postgresql": $sql = sprintf ('SELECT * FROM tagente - WHERE (id_grupo IN (%s) - %s) %s + WHERE id_grupo IN (%s) + %s ORDER BY %s, %s %s LIMIT %d OFFSET %d', - implode (',', array_keys (users_get_groups ())), - $search_sql, $sql_extra, $order['field'], $order['field2'], $order['order'], $config["block_size"], $offset); + implode (',', array_keys ($user_groups)), + $search_sql, $order['field'], $order['field2'], $order['order'], $config["block_size"], $offset); break; case "oracle": $set = array (); @@ -316,10 +350,10 @@ else { $set['offset'] = $offset; $sql = sprintf ('SELECT * FROM tagente - WHERE (id_grupo IN (%s) - %s) %s + WHERE id_grupo IN (%s) + %s ORDER BY %s, %s %s', - implode (',', array_keys (users_get_groups ())), + implode (',', array_keys ($user_groups)), $search_sql, $order['field'], $order['field2'], $order['order']); $sql = oracle_recode_query ($sql, $set); break; @@ -357,19 +391,15 @@ if ($agents !== false) { '' . html_print_image("images/sort_down.png", true, array("style" => $selectGroupDown)) . ''; echo ""; echo "".__('Description').""; - echo "".__('Delete').""; + echo "".__('Actions').""; $color=1; $rowPair = true; $iterator = 0; foreach ($agents as $agent) { $id_grupo = $agent["id_grupo"]; - $is_extra = enterprise_hook('policies_is_agent_extra_policy', array($agent["id_agente"])); - - if($is_extra === ENTERPRISE_NOT_HOOK) { - $is_extra = false; - } - if (! check_acl ($config["id_user"], $id_grupo, "AW", $agent['id_agente']) && !$is_extra) + + if (! check_acl ($config["id_user"], $id_grupo, "AW", $agent['id_agente']) && ! check_acl ($config["id_user"], $id_grupo, "AD", $agent['id_agente'])) continue; if ($color == 1) { @@ -399,8 +429,16 @@ if ($agents !== false) { html_print_image("images/dot_green.disabled.png", false, array("border" => '0', "title" => __('Quiet'), "alt" => "")); echo " "; } + + if(check_acl ($config["id_user"], $agent["id_grupo"], "AW")) { + $main_tab = 'main'; + } + else { + $main_tab = 'module'; + } + echo "" . ui_print_truncate_text($agent["nombre"], 'agent_medium', true, true, true, '[…]', 'font-size: 7pt') . ""; @@ -410,10 +448,12 @@ if ($agents !== false) { echo ""; } echo '