diff --git a/pandora_console/include/lib/Dashboard/Manager.php b/pandora_console/include/lib/Dashboard/Manager.php index e55cdd5d1e..83571ef68a 100644 --- a/pandora_console/include/lib/Dashboard/Manager.php +++ b/pandora_console/include/lib/Dashboard/Manager.php @@ -363,6 +363,27 @@ class Manager implements PublicLogin } + /** + * Generates a hash to authenticate in public dashboards with user form url. + * + * @param string|null $other_secret To authenticate some parts + * of public dashboards (like visual consoles or wux widgets) + * another hash is needed. Other secret avoid + * to reuse the main hash to view other components. + * + * @return string Returns a hash with the authenticaction. + */ + public static function generatePublicHashUser(?string $other_secret='', $id_user=''):string + { + global $config; + + $str = $config['dbpass']; + $str .= ($id_user ?? $config['id_user']); + $str .= $other_secret; + return hash('sha256', $str); + } + + /** * Validates a hash to authenticate in public dashboards. * @@ -1040,6 +1061,17 @@ class Manager implements PublicLogin break; } } + + if (empty($this->dashboardId) === true) { + $id_user_url = get_parameter('id_user', $config['id_user']); + foreach ($dashboards as $key => $layout) { + $hash_compare = self::generatePublicHashUser($key, $id_user_url); + if (hash_equals($hash_aux, $hash_compare)) { + $this->dashboardId = $key; + break; + } + } + } } if ($this->dashboardId === 0 diff --git a/pandora_console/include/lib/User.php b/pandora_console/include/lib/User.php index 5baace3b12..7aed6a7f93 100644 --- a/pandora_console/include/lib/User.php +++ b/pandora_console/include/lib/User.php @@ -236,6 +236,25 @@ class User extends Entity implements PublicLogin } + /** + * Generates a hash to authenticate in public views with user from url. + * + * @param string|null $other_secret If you need to authenticate using a + * varable string, use this 'other_secret' to customize the hash. + * + * @return string Returns a hash with the authenticaction. + */ + public static function generatePublicHashUser(?string $other_secret='', $id_user_url=''): string + { + global $config; + + $str = $config['dbpass']; + $str .= ($id_user_url ?? $config['id_user']); + $str .= $other_secret; + return hash('sha256', $str); + } + + /** * Validates a hash to authenticate in public view. * diff --git a/pandora_console/operation/visual_console/public_view.php b/pandora_console/operation/visual_console/public_view.php index ff6f7763e0..e95495ccb1 100644 --- a/pandora_console/operation/visual_console/public_view.php +++ b/pandora_console/operation/visual_console/public_view.php @@ -79,6 +79,17 @@ foreach ($vcs as $key => $data) { } } +$id_user_url = get_parameter('id_user', $config['id_user']); +if (empty($visualConsoleId) === true) { + foreach ($vcs as $key => $data) { + $hash_compare = User::generatePublicHashUser($key, $id_user_url); + if (hash_equals($hash_compare, $hash)) { + $visualConsoleId = (int) $key; + break; + } + } +} + if (empty($visualConsoleId) === true) { db_pandora_audit( AUDIT_LOG_VISUAL_CONSOLE_MANAGEMENT,