From ca9b167741bed0c6c8496a51977b6a0f07e172ae Mon Sep 17 00:00:00 2001 From: fbsanchez Date: Fri, 16 Oct 2020 14:00:38 +0200 Subject: [PATCH 01/26] SAML with pandora sessions --- pandora_console/include/auth/mysql.php | 3 +- pandora_console/include/load_session.php | 68 +++++++++++++++++++++--- pandora_console/index.php | 29 +++++----- 3 files changed, 76 insertions(+), 24 deletions(-) diff --git a/pandora_console/include/auth/mysql.php b/pandora_console/include/auth/mysql.php index 930e2cdbd2..f297089ea0 100644 --- a/pandora_console/include/auth/mysql.php +++ b/pandora_console/include/auth/mysql.php @@ -239,8 +239,7 @@ function process_user_login_remote($login, $pass, $api=false) // Unknown authentication method default: - $config['auth_error'] = 'User not found in database - or incorrect password'; + $config['auth_error'] = 'User not found in database or incorrect password'; return false; break; } diff --git a/pandora_console/include/load_session.php b/pandora_console/include/load_session.php index 3575310141..bcc1cc594f 100644 --- a/pandora_console/include/load_session.php +++ b/pandora_console/include/load_session.php @@ -198,11 +198,63 @@ function pandora_session_gc($max_lifetime=300) } -$result_handler = session_set_save_handler( - 'pandora_session_open', - 'pandora_session_close', - 'pandora_session_read', - 'pandora_session_write', - 'pandora_session_destroy', - 'pandora_session_gc' -); +/** + * Enables custom session handlers. + * + * @return boolean Context changed or not. + */ +function enable_session_handlers() +{ + global $config; + + if ($config['_using_pandora_sessionhandlers'] !== true) { + if (session_status() !== PHP_SESSION_NONE) { + // Close previous version. + session_write_close(); + } + + $sesion_handler = session_set_save_handler( + 'pandora_session_open', + 'pandora_session_close', + 'pandora_session_read', + 'pandora_session_write', + 'pandora_session_destroy', + 'pandora_session_gc' + ); + + session_start(); + + // Restore previous session. + $config['_using_pandora_sessionhandlers'] = true; + return $sesion_handler; + } + + return false; +} + + +/** + * Disables custom session handlers. + * + * @return void + */ +function disable_session_handlers() +{ + global $config; + + if (session_status() !== PHP_SESSION_NONE) { + // Close previous version. + session_write_close(); + } + + $ss = new SessionHandler(); + session_set_save_handler($ss, true); + + session_start(); + + $config['_using_pandora_sessionhandlers'] = false; +} + + +// Always enable session handler. +$result_handler = enable_session_handlers(); diff --git a/pandora_console/index.php b/pandora_console/index.php index af8671ded7..43645f69cb 100755 --- a/pandora_console/index.php +++ b/pandora_console/index.php @@ -395,24 +395,25 @@ if (! isset($config['id_user'])) { $nick_in_db = $_SESSION['prepared_login_da']['id_user']; $expired_pass = false; } else if (($config['auth'] == 'saml') && ($login_button_saml)) { - $saml_configured = include_once $config['homedir'].'/'.ENTERPRISE_DIR.'/include/auth/saml.php'; - - if (!$saml_configured) { + $saml_path = $config['homedir'].'/'.ENTERPRISE_DIR.'/include/auth/saml.php'; + if (!$saml_path) { include_once 'general/noaccesssaml.php'; - } + } else { + include_once $saml_path; - $saml_user_id = saml_process_user_login(); + $saml_user_id = saml_process_user_login(); - if (!$saml_user_id) { - include_once 'general/noaccesssaml.php'; - } + if (!$saml_user_id) { + include_once 'general/noaccesssaml.php'; + } - $nick_in_db = $saml_user_id; - if (!$nick_in_db) { - include_once $config['saml_path'].'simplesamlphp/lib/_autoload.php'; - $as = new SimpleSAML_Auth_Simple($config['saml_source']); - $as->logout(); + $nick_in_db = $saml_user_id; + if (!$nick_in_db) { + include_once $config['saml_path'].'simplesamlphp/lib/_autoload.php'; + $as = new SimpleSAML_Auth_Simple($config['saml_source']); + $as->logout(); + } } } else { // process_user_login is a virtual function which should be defined in each auth file. @@ -971,7 +972,7 @@ if (isset($_GET['bye'])) { if ($config['auth'] == 'saml') { include_once $config['saml_path'].'simplesamlphp/lib/_autoload.php'; - $as = new SimpleSAML_Auth_Simple('PandoraFMS'); + $as = new SimpleSAML_Auth_Simple($config['saml_source']); $as->logout(); } From 30c7da054f6e1227339b3ef74f5b76243f9aa98d Mon Sep 17 00:00:00 2001 From: fbsanchez Date: Fri, 16 Oct 2020 15:24:21 +0200 Subject: [PATCH 02/26] fixes SAML --- pandora_console/include/load_session.php | 8 +++++++- pandora_console/index.php | 6 ++---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/pandora_console/include/load_session.php b/pandora_console/include/load_session.php index bcc1cc594f..883704b8e0 100644 --- a/pandora_console/include/load_session.php +++ b/pandora_console/include/load_session.php @@ -236,9 +236,11 @@ function enable_session_handlers() /** * Disables custom session handlers. * + * @param string|null $id_session Force swap to target session. + * * @return void */ -function disable_session_handlers() +function disable_session_handlers($id_session=null) { global $config; @@ -250,6 +252,10 @@ function disable_session_handlers() $ss = new SessionHandler(); session_set_save_handler($ss, true); + if ($id_session !== null) { + session_id($id_session); + } + session_start(); $config['_using_pandora_sessionhandlers'] = false; diff --git a/pandora_console/index.php b/pandora_console/index.php index 43645f69cb..e87fae5353 100755 --- a/pandora_console/index.php +++ b/pandora_console/index.php @@ -411,8 +411,7 @@ if (! isset($config['id_user'])) { $nick_in_db = $saml_user_id; if (!$nick_in_db) { include_once $config['saml_path'].'simplesamlphp/lib/_autoload.php'; - $as = new SimpleSAML_Auth_Simple($config['saml_source']); - $as->logout(); + saml_logout(); } } } else { @@ -972,8 +971,7 @@ if (isset($_GET['bye'])) { if ($config['auth'] == 'saml') { include_once $config['saml_path'].'simplesamlphp/lib/_autoload.php'; - $as = new SimpleSAML_Auth_Simple($config['saml_source']); - $as->logout(); + saml_logout(); } while (@ob_end_flush()) { From 85ac793e2b7c30e841f0f6063ff79d0570feb8f1 Mon Sep 17 00:00:00 2001 From: Kevin Date: Fri, 16 Oct 2020 16:05:57 +0200 Subject: [PATCH 03/26] force folders creation --- pandora_agents/unix/Darwin/dmg/scripts/postinstall | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/pandora_agents/unix/Darwin/dmg/scripts/postinstall b/pandora_agents/unix/Darwin/dmg/scripts/postinstall index 2f76310fee..5b25222a37 100644 --- a/pandora_agents/unix/Darwin/dmg/scripts/postinstall +++ b/pandora_agents/unix/Darwin/dmg/scripts/postinstall @@ -26,11 +26,13 @@ else `/usr/local/share/pandora_agent/inst_utilities/print_conf.pl /usr/local/share/pandora_agent/pandora_agent.conf remote_config $REMOTECFG` # Create agent directories and files - mkdir -p /usr/local/share/pandora_agent/collections - mkdir -p /usr/local/share/pandora_agent/commands + mkdir -p /usr/local/bin/ + mkdir -p /usr/local/share/man/man1/ + mkdir -p /usr/local/share/pandora_agent/collections/ + mkdir -p /usr/local/share/pandora_agent/commands/ mkdir -p /etc/pandora/ - mkdir -p /var/spool/pandora/data_out - mkdir -p /var/log/pandora + mkdir -p /var/spool/pandora/data_out/ + mkdir -p /var/log/pandora/ mv pandora_agent.conf /etc/pandora/ touch /var/log/pandora/pandora_agent.log @@ -70,9 +72,9 @@ ln -s /usr/local/share/pandora_agent/collections /etc/pandora/collections # Copy manuals -cp -f man/man1/pandora_agent.1.gz /usr/local/share/man/man1 +cp -f man/man1/pandora_agent.1.gz /usr/local/share/man/man1/ chmod 644 /usr/local/share/man/man1/pandora_agent.1.gz -cp -f man/man1/tentacle_client.1.gz /usr/local/share/man/man1 +cp -f man/man1/tentacle_client.1.gz /usr/local/share/man/man1/ chmod 644 /usr/local/share/man/man1/tentacle_client.1.gz # Create newsyslog entry From ee45d0c684142bcca838b7bed85bd75f9b3ff2ba Mon Sep 17 00:00:00 2001 From: Kevin Date: Fri, 16 Oct 2020 16:29:02 +0200 Subject: [PATCH 04/26] Fix autoupdate version issue --- extras/pandora_update_version.sh | 2 +- pandora_agents/unix/Darwin/dmg/build_darwin_dmg.sh | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/extras/pandora_update_version.sh b/extras/pandora_update_version.sh index 8a16e8e18d..23ea7a4627 100755 --- a/extras/pandora_update_version.sh +++ b/extras/pandora_update_version.sh @@ -143,7 +143,7 @@ done # Darwin dmg installer files echo "Updating DARWIN DMG files..." -sed -i -e "/VERSION/s/=.*/=\"$VERSION\"/" "$AGENT_DARWIN_BUILDER" +sed -i -e "/VERSION/s/=\"7.0NG.*/=\"$VERSION\"/" "$AGENT_DARWIN_BUILDER" sed -i -r "s/(version=\").*(\"\s+onConclusion=)/\1$VERSION\2/g" "$AGENT_DARWIN_DISTR" sed -i -r "s/(CFBundleVersion<\/key>\s*).*(<\/string>)/\1$VERSION\2/g" "$AGENT_DARWIN_PLIST" sed -i -r "s/(CFBundleShortVersionString<\/key>\s*).*(<\/string>)/\1$VERSION\2/g" "$AGENT_DARWIN_PLIST" diff --git a/pandora_agents/unix/Darwin/dmg/build_darwin_dmg.sh b/pandora_agents/unix/Darwin/dmg/build_darwin_dmg.sh index 325d149578..95878467ab 100644 --- a/pandora_agents/unix/Darwin/dmg/build_darwin_dmg.sh +++ b/pandora_agents/unix/Darwin/dmg/build_darwin_dmg.sh @@ -22,7 +22,7 @@ fi # DMG package version if [ "$#" -ge 2 ]; then - VERSION="7.0NG.750" + VERSION="$2" else VERSION="7.0NG.750" fi @@ -37,7 +37,7 @@ fi BUILD_DMG="$BUILD_PATH/build" BUILD_TMP="$BUILD_PATH/buildtmp" -FULLNAME="7.0NG.749" +FULLNAME="$DMGNAME-$VERSION.dmg" echo "VERSION-"$VERSION" NAME-"$DMGNAME pushd . cd $LOCALINST From 7b73a36eb02e1b28b63cf88b02c6838204cd4b6e Mon Sep 17 00:00:00 2001 From: fbsanchez Date: Fri, 16 Oct 2020 16:41:42 +0200 Subject: [PATCH 05/26] rc1 --- pandora_console/index.php | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/pandora_console/index.php b/pandora_console/index.php index e87fae5353..8a95702146 100755 --- a/pandora_console/index.php +++ b/pandora_console/index.php @@ -961,19 +961,23 @@ if (file_exists(ENTERPRISE_DIR.'/load_enterprise.php')) { // Log off. if (isset($_GET['bye'])) { - include 'general/logoff.php'; $iduser = $_SESSION['id_usuario']; + $samlid = $_SESSION['samlid']; + + // Process logout. + include 'general/logoff.php'; + + if ($config['auth'] == 'saml' && empty($samlid) === false) { + include_once $config['saml_path'].'simplesamlphp/lib/_autoload.php'; + enterprise_include('include/auth/saml.php'); + enterprise_hook('saml_logout', [$samlid]); + } $_SESSION = []; session_destroy(); header_remove('Set-Cookie'); setcookie(session_name(), $_COOKIE[session_name()], (time() - 4800), '/'); - if ($config['auth'] == 'saml') { - include_once $config['saml_path'].'simplesamlphp/lib/_autoload.php'; - saml_logout(); - } - while (@ob_end_flush()) { // Dumping... continue; From f6020e87918206218775dce0f2f3f3ef33c3fbc3 Mon Sep 17 00:00:00 2001 From: fbsanchez Date: Mon, 19 Oct 2020 10:59:46 +0200 Subject: [PATCH 06/26] Removed unwanted traces --- pandora_console/general/login_page.php | 7 ++- pandora_console/include/load_session.php | 40 ++++++++----- pandora_console/index.php | 73 +++++++++++++++++------- 3 files changed, 83 insertions(+), 37 deletions(-) diff --git a/pandora_console/general/login_page.php b/pandora_console/general/login_page.php index c4cd8482bc..97548deee4 100755 --- a/pandora_console/general/login_page.php +++ b/pandora_console/general/login_page.php @@ -450,7 +450,12 @@ if ($login_screen == 'logout') { echo '
'; echo '
'; echo '

'.__('Logged out').'

'; - echo '

'.__('Your session has ended. Please close your browser window to close this %s session.', get_product_name()).'

'; + if (empty($config['logout_msg']) === true) { + echo '

'.__('Your session has ended. Please close your browser window to close this %s session.', get_product_name()).'

'; + } else { + echo '

'.__($config['logout_msg']).'

'; + } + echo '
'; echo '
'; html_print_submit_button('Ok', 'hide-login-logout', false); diff --git a/pandora_console/include/load_session.php b/pandora_console/include/load_session.php index 883704b8e0..b557edd5d3 100644 --- a/pandora_console/include/load_session.php +++ b/pandora_console/include/load_session.php @@ -64,14 +64,23 @@ function pandora_session_close() function pandora_session_read($session_id) { $session_id = addslashes($session_id); - $session_data = db_get_value( - 'data', - 'tsessions_php', - 'id_session', - $session_id + + // Do not use SQL cache here. + $session_data = db_get_all_rows_sql( + sprintf( + 'SELECT data + FROM `tsessions_php` WHERE id_session="%s"', + $session_id + ), + false, + false ); - if (!empty($session_data)) { + if (is_array($session_data) === true) { + $session_data = $session_data[0]['data']; + } + + if (empty($session_data) === false) { return $session_data; } else { return ''; @@ -90,7 +99,6 @@ function pandora_session_read($session_id) function pandora_session_write($session_id, $data) { $session_id = addslashes($session_id); - if (is_ajax()) { // Avoid session upadte while processing ajax responses - notifications. if (get_parameter('check_new_notifications', false)) { @@ -101,18 +109,22 @@ function pandora_session_write($session_id, $data) $values = []; $values['last_active'] = time(); - if (!empty($data)) { + if (empty($data) === false) { $values['data'] = addslashes($data); } - $session_exists = (bool) db_get_value( - 'COUNT(id_session)', - 'tsessions_php', - 'id_session', - $session_id + // Do not use SQL cache here. + $session_exists = db_get_all_rows_sql( + sprintf( + 'SELECT id_session + FROM `tsessions_php` WHERE id_session="%s"', + $session_id + ), + false, + false ); - if (!$session_exists) { + if ($session_exists === false) { $values['id_session'] = $session_id; $retval_write = db_process_sql_insert('tsessions_php', $values); } else { diff --git a/pandora_console/index.php b/pandora_console/index.php index 8a95702146..56ea0fcd34 100755 --- a/pandora_console/index.php +++ b/pandora_console/index.php @@ -222,7 +222,7 @@ echo ''."\n"; ob_start('ui_process_page_head'); // Enterprise main. -enterprise_include('index.php'); +enterprise_include_once('index.php'); echo '