From c6b1e92bda7de0322c97e55d2116721c84f0f0ae Mon Sep 17 00:00:00 2001 From: Jose Gonzalez Date: Mon, 8 Jun 2020 08:44:24 +0200 Subject: [PATCH 1/7] Modified match for forbidden words. Now not allows spaces or scaped chars. Other cases must not be problemathic --- pandora_console/include/functions.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pandora_console/include/functions.php b/pandora_console/include/functions.php index 724fe11fd6..8805a0b1e2 100644 --- a/pandora_console/include/functions.php +++ b/pandora_console/include/functions.php @@ -2136,7 +2136,7 @@ function check_sql($sql) { // We remove "*" to avoid things like SELECT * FROM tusuario // Check that it not delete_ as "delete_pending" (this is a common field in pandora tables). - if (preg_match('/\*|delete[^_]|drop|alter|modify|password|pass|insert|update/i', $sql)) { + if (preg_match('/([ ]*(delete|drop|alter|modify|password|pass|insert|update)\b[ \\]+)/i', $sql)) { return ''; } From 82b66d567d676c65b49d7c745381868a92a80299 Mon Sep 17 00:00:00 2001 From: Daniel Barbero Martin Date: Mon, 8 Jun 2020 14:14:35 +0200 Subject: [PATCH 2/7] Fixed sla graph in pdf --- pandora_console/include/chart_generator.php | 3 ++- .../include/graphs/functions_flot.php | 21 +++++++++++++++++-- 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/pandora_console/include/chart_generator.php b/pandora_console/include/chart_generator.php index edd8208b05..97fdf32b9c 100644 --- a/pandora_console/include/chart_generator.php +++ b/pandora_console/include/chart_generator.php @@ -277,7 +277,8 @@ if (file_exists('languages/'.$user_language.'.mo') === true) { $params['ttl'], $params['sizeForTicks'], $params['show'], - $params['date_to'] + $params['date_to'], + $params['server_id'] ); break; diff --git a/pandora_console/include/graphs/functions_flot.php b/pandora_console/include/graphs/functions_flot.php index 1a74f456b2..9666196a6c 100644 --- a/pandora_console/include/graphs/functions_flot.php +++ b/pandora_console/include/graphs/functions_flot.php @@ -699,6 +699,7 @@ function flot_slicesbar_graph( 'show' => $show, 'return_img_base_64' => true, 'date_to' => $date_to, + 'server_id' => $server_id, ]; $graph = '"; $return .= "//"; $return .= ''; From 1fd19802ac57bee688407ed56a856c026721912d Mon Sep 17 00:00:00 2001 From: Jose Gonzalez Date: Fri, 12 Jun 2020 14:11:41 +0200 Subject: [PATCH 3/7] Added api function for update events --- pandora_console/include/api.php | 7 ++ pandora_console/include/functions_api.php | 84 +++++++++++++++++++++++ 2 files changed, 91 insertions(+) diff --git a/pandora_console/include/api.php b/pandora_console/include/api.php index f263350685..ed366f64c6 100644 --- a/pandora_console/include/api.php +++ b/pandora_console/include/api.php @@ -261,6 +261,13 @@ if ($correctLogin) { } break; + case 'event': + // Preventive check for users if not available write events + if (! check_acl($config['id_user'], $event['id_grupo'], 'EW')) { + return false; + } + break; + default: // Ignore. break; diff --git a/pandora_console/include/functions_api.php b/pandora_console/include/functions_api.php index 76e10533aa..4e75b955e8 100644 --- a/pandora_console/include/functions_api.php +++ b/pandora_console/include/functions_api.php @@ -8790,6 +8790,11 @@ function otherParameter2Filter($other, $return_as_array=false, $use_agent_name=f } } + // Esto es extraño, hablar con Tati + /* + $filter['1'] = $filter['sql']; + unset($filter['sql']); */ + if (isset($other['data'][4]) && $other['data'][4] != '') { $idTemplate = db_get_value_filter('id', 'talert_templates', ['name' => $other['data'][4]]); if ($idTemplate !== false) { @@ -10721,6 +10726,85 @@ function get_events_with_user($trash1, $trash2, $other, $returnType, $user_in_db } +/** + * Update an event + * + * @param string $id_event Id of the event for change. + * @param string $unused1 Without use. + * @param array $params Dictionary with field,value format with the data for update. + * @param string $unused2 Without use. + * @param string $unused3 Without use. + * + * @return void + */ +function api_set_event($id_event, $unused1, $params, $unused2, $unused3) +{ + // Get the event + $event = events_get_event($id_event); + // If event not exists, end the execution. + if ($event === false) { + returnError( + 'event_not_exists', + 'Event not exists' + ); + return false; + } + + $paramsSerialize = []; + // Serialize the data for update + if ($params['type'] === 'array') { + // Keys that is not available to change + $invalidKeys = [ + 'id_evento', + 'id_agente', + 'id_grupo', + 'timestamp', + 'utimestamp', + 'id_agentmodule', + 'id_alert_am', + 'criticity', + 'user_comment', + 'tags', + 'source', + 'id_extra', + 'critical_instructions', + 'warning_instructions', + 'unknown_instructions', + 'ack_utimestamp', + 'data', + ]; + + foreach ($params['data'] as $key_value) { + list($key, $value) = explode(',', $key_value, 2); + if (in_array($key, $invalidKeys) == false) { + $paramsSerialize[$key] = $value; + } + } + } + + // TODO. Stablish security for prevent sql injection? + // Update the row + $result = db_process_sql_update( + 'tevento', + $paramsSerialize, + [ 'id_evento' => $id_event ] + ); + + // If update results failed + if (empty($result) === true || $result === false) { + returnError( + 'failed_event_update', + __('Failed event update') + ); + return false; + } else { + returnData('string', ['data' => 'Event updated']); + } + + return; +} + + /** * * @param $trash1 From 90cc854ea58f778bd3fc360a138de04e4094f8fa Mon Sep 17 00:00:00 2001 From: artica Date: Tue, 16 Jun 2020 01:00:16 +0200 Subject: [PATCH 4/7] Auto-updated build strings. --- pandora_agents/unix/DEBIAN/control | 2 +- pandora_agents/unix/DEBIAN/make_deb_package.sh | 2 +- pandora_agents/unix/pandora_agent | 2 +- pandora_agents/unix/pandora_agent.redhat.spec | 2 +- pandora_agents/unix/pandora_agent.spec | 2 +- pandora_agents/unix/pandora_agent_installer | 2 +- pandora_agents/win32/installer/pandora.mpi | 2 +- pandora_agents/win32/pandora.cc | 2 +- pandora_agents/win32/versioninfo.rc | 2 +- pandora_console/DEBIAN/control | 2 +- pandora_console/DEBIAN/make_deb_package.sh | 2 +- pandora_console/include/config_process.php | 2 +- pandora_console/install.php | 2 +- pandora_console/pandora_console.redhat.spec | 2 +- pandora_console/pandora_console.rhel7.spec | 2 +- pandora_console/pandora_console.spec | 2 +- pandora_server/DEBIAN/control | 2 +- pandora_server/DEBIAN/make_deb_package.sh | 2 +- pandora_server/lib/PandoraFMS/Config.pm | 2 +- pandora_server/lib/PandoraFMS/PluginTools.pm | 2 +- pandora_server/pandora_server.redhat.spec | 2 +- pandora_server/pandora_server.spec | 2 +- pandora_server/pandora_server_installer | 2 +- pandora_server/util/pandora_db.pl | 2 +- pandora_server/util/pandora_manage.pl | 2 +- 25 files changed, 25 insertions(+), 25 deletions(-) diff --git a/pandora_agents/unix/DEBIAN/control b/pandora_agents/unix/DEBIAN/control index 065c44aa1c..cc77419afa 100644 --- a/pandora_agents/unix/DEBIAN/control +++ b/pandora_agents/unix/DEBIAN/control @@ -1,5 +1,5 @@ package: pandorafms-agent-unix -Version: 7.0NG.746-200615 +Version: 7.0NG.746-200616 Architecture: all Priority: optional Section: admin diff --git a/pandora_agents/unix/DEBIAN/make_deb_package.sh b/pandora_agents/unix/DEBIAN/make_deb_package.sh index d9f481d9ce..db089152dc 100644 --- a/pandora_agents/unix/DEBIAN/make_deb_package.sh +++ b/pandora_agents/unix/DEBIAN/make_deb_package.sh @@ -14,7 +14,7 @@ # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. -pandora_version="7.0NG.746-200615" +pandora_version="7.0NG.746-200616" echo "Test if you has the tools for to make the packages." whereis dpkg-deb | cut -d":" -f2 | grep dpkg-deb > /dev/null diff --git a/pandora_agents/unix/pandora_agent b/pandora_agents/unix/pandora_agent index ee20a81c3a..ab83553edb 100755 --- a/pandora_agents/unix/pandora_agent +++ b/pandora_agents/unix/pandora_agent @@ -55,7 +55,7 @@ my $Sem = undef; my $ThreadSem = undef; use constant AGENT_VERSION => '7.0NG.746'; -use constant AGENT_BUILD => '200615'; +use constant AGENT_BUILD => '200616'; # Agent log default file size maximum and instances use constant DEFAULT_MAX_LOG_SIZE => 600000; diff --git a/pandora_agents/unix/pandora_agent.redhat.spec b/pandora_agents/unix/pandora_agent.redhat.spec index 7e81922366..d3bb97711b 100644 --- a/pandora_agents/unix/pandora_agent.redhat.spec +++ b/pandora_agents/unix/pandora_agent.redhat.spec @@ -3,7 +3,7 @@ # %define name pandorafms_agent_unix %define version 7.0NG.746 -%define release 200615 +%define release 200616 Summary: Pandora FMS Linux agent, PERL version Name: %{name} diff --git a/pandora_agents/unix/pandora_agent.spec b/pandora_agents/unix/pandora_agent.spec index 49bf28595a..afc829aed9 100644 --- a/pandora_agents/unix/pandora_agent.spec +++ b/pandora_agents/unix/pandora_agent.spec @@ -3,7 +3,7 @@ # %define name pandorafms_agent_unix %define version 7.0NG.746 -%define release 200615 +%define release 200616 Summary: Pandora FMS Linux agent, PERL version Name: %{name} diff --git a/pandora_agents/unix/pandora_agent_installer b/pandora_agents/unix/pandora_agent_installer index d81b610641..ccdc111946 100755 --- a/pandora_agents/unix/pandora_agent_installer +++ b/pandora_agents/unix/pandora_agent_installer @@ -10,7 +10,7 @@ # ********************************************************************** PI_VERSION="7.0NG.746" -PI_BUILD="200615" +PI_BUILD="200616" OS_NAME=`uname -s` FORCE=0 diff --git a/pandora_agents/win32/installer/pandora.mpi b/pandora_agents/win32/installer/pandora.mpi index 994e9017fd..c1b56b1298 100644 --- a/pandora_agents/win32/installer/pandora.mpi +++ b/pandora_agents/win32/installer/pandora.mpi @@ -186,7 +186,7 @@ UpgradeApplicationID {} Version -{200615} +{200616} ViewReadme {Yes} diff --git a/pandora_agents/win32/pandora.cc b/pandora_agents/win32/pandora.cc index 0f2e395d48..aba40e6f80 100644 --- a/pandora_agents/win32/pandora.cc +++ b/pandora_agents/win32/pandora.cc @@ -30,7 +30,7 @@ using namespace Pandora; using namespace Pandora_Strutils; #define PATH_SIZE _MAX_PATH+1 -#define PANDORA_VERSION ("7.0NG.746(Build 200615)") +#define PANDORA_VERSION ("7.0NG.746(Build 200616)") string pandora_path; string pandora_dir; diff --git a/pandora_agents/win32/versioninfo.rc b/pandora_agents/win32/versioninfo.rc index e09ee9ea45..6bca3a735a 100644 --- a/pandora_agents/win32/versioninfo.rc +++ b/pandora_agents/win32/versioninfo.rc @@ -11,7 +11,7 @@ BEGIN VALUE "LegalCopyright", "Artica ST" VALUE "OriginalFilename", "PandoraAgent.exe" VALUE "ProductName", "Pandora FMS Windows Agent" - VALUE "ProductVersion", "(7.0NG.746(Build 200615))" + VALUE "ProductVersion", "(7.0NG.746(Build 200616))" VALUE "FileVersion", "1.0.0.0" END END diff --git a/pandora_console/DEBIAN/control b/pandora_console/DEBIAN/control index ad19521c2a..dd1f5f5dba 100644 --- a/pandora_console/DEBIAN/control +++ b/pandora_console/DEBIAN/control @@ -1,5 +1,5 @@ package: pandorafms-console -Version: 7.0NG.746-200615 +Version: 7.0NG.746-200616 Architecture: all Priority: optional Section: admin diff --git a/pandora_console/DEBIAN/make_deb_package.sh b/pandora_console/DEBIAN/make_deb_package.sh index 37592bfd49..f0a953b59d 100644 --- a/pandora_console/DEBIAN/make_deb_package.sh +++ b/pandora_console/DEBIAN/make_deb_package.sh @@ -14,7 +14,7 @@ # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. -pandora_version="7.0NG.746-200615" +pandora_version="7.0NG.746-200616" package_pear=0 package_pandora=1 diff --git a/pandora_console/include/config_process.php b/pandora_console/include/config_process.php index b459d0008d..de27481752 100644 --- a/pandora_console/include/config_process.php +++ b/pandora_console/include/config_process.php @@ -20,7 +20,7 @@ /** * Pandora build version and version */ -$build_version = 'PC200615'; +$build_version = 'PC200616'; $pandora_version = 'v7.0NG.746'; // Do not overwrite default timezone set if defined. diff --git a/pandora_console/install.php b/pandora_console/install.php index 916492ea12..7a088e199f 100644 --- a/pandora_console/install.php +++ b/pandora_console/install.php @@ -129,7 +129,7 @@
[ qw() ] ); diff --git a/pandora_server/pandora_server.redhat.spec b/pandora_server/pandora_server.redhat.spec index 8c5cf5d855..93a7ee731c 100644 --- a/pandora_server/pandora_server.redhat.spec +++ b/pandora_server/pandora_server.redhat.spec @@ -3,7 +3,7 @@ # %define name pandorafms_server %define version 7.0NG.746 -%define release 200615 +%define release 200616 Summary: Pandora FMS Server Name: %{name} diff --git a/pandora_server/pandora_server.spec b/pandora_server/pandora_server.spec index 49baa1329f..b63f857045 100644 --- a/pandora_server/pandora_server.spec +++ b/pandora_server/pandora_server.spec @@ -3,7 +3,7 @@ # %define name pandorafms_server %define version 7.0NG.746 -%define release 200615 +%define release 200616 Summary: Pandora FMS Server Name: %{name} diff --git a/pandora_server/pandora_server_installer b/pandora_server/pandora_server_installer index 964289b1a5..a1cfb29b83 100755 --- a/pandora_server/pandora_server_installer +++ b/pandora_server/pandora_server_installer @@ -9,7 +9,7 @@ # ********************************************************************** PI_VERSION="7.0NG.746" -PI_BUILD="200615" +PI_BUILD="200616" MODE=$1 if [ $# -gt 1 ]; then diff --git a/pandora_server/util/pandora_db.pl b/pandora_server/util/pandora_db.pl index 785ec1a889..37f715e59a 100755 --- a/pandora_server/util/pandora_db.pl +++ b/pandora_server/util/pandora_db.pl @@ -35,7 +35,7 @@ use PandoraFMS::Config; use PandoraFMS::DB; # version: define current version -my $version = "7.0NG.746 PS200615"; +my $version = "7.0NG.746 PS200616"; # Pandora server configuration my %conf; diff --git a/pandora_server/util/pandora_manage.pl b/pandora_server/util/pandora_manage.pl index ba8825a72e..5248dae515 100755 --- a/pandora_server/util/pandora_manage.pl +++ b/pandora_server/util/pandora_manage.pl @@ -36,7 +36,7 @@ use Encode::Locale; Encode::Locale::decode_argv; # version: define current version -my $version = "7.0NG.746 PS200615"; +my $version = "7.0NG.746 PS200616"; # save program name for logging my $progname = basename($0); From 40569d209258dbb7363ab78370cd0e24b90f9b69 Mon Sep 17 00:00:00 2001 From: Jose Gonzalez Date: Tue, 16 Jun 2020 08:55:54 +0200 Subject: [PATCH 5/7] Added change for metaconsole --- pandora_console/include/functions_api.php | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pandora_console/include/functions_api.php b/pandora_console/include/functions_api.php index 4e75b955e8..96a37e4499 100644 --- a/pandora_console/include/functions_api.php +++ b/pandora_console/include/functions_api.php @@ -10782,10 +10782,16 @@ function api_set_event($id_event, $unused1, $params, $unused2, $unused3) } } + if (is_metaconsole() === true) { + $table = 'tmetaconsole_event'; + } else { + $table = 'tevento'; + } + // TODO. Stablish security for prevent sql injection? // Update the row $result = db_process_sql_update( - 'tevento', + $table, $paramsSerialize, [ 'id_evento' => $id_event ] ); From 370bd8e34ff086b7a1a7415cccdfb7dee9dc4338 Mon Sep 17 00:00:00 2001 From: Jose Gonzalez Date: Tue, 16 Jun 2020 09:45:00 +0200 Subject: [PATCH 6/7] Stablished correct invalid keys --- pandora_console/include/functions_api.php | 9 --------- 1 file changed, 9 deletions(-) diff --git a/pandora_console/include/functions_api.php b/pandora_console/include/functions_api.php index 96a37e4499..c64059523f 100644 --- a/pandora_console/include/functions_api.php +++ b/pandora_console/include/functions_api.php @@ -10761,15 +10761,6 @@ function api_set_event($id_event, $unused1, $params, $unused2, $unused3) 'timestamp', 'utimestamp', 'id_agentmodule', - 'id_alert_am', - 'criticity', - 'user_comment', - 'tags', - 'source', - 'id_extra', - 'critical_instructions', - 'warning_instructions', - 'unknown_instructions', 'ack_utimestamp', 'data', ]; From e3fa68aef69848565ad832f03fabb2562afc374c Mon Sep 17 00:00:00 2001 From: Jose Gonzalez Date: Tue, 16 Jun 2020 10:03:22 +0200 Subject: [PATCH 7/7] Correct event get for metaconsole --- pandora_console/include/functions_api.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pandora_console/include/functions_api.php b/pandora_console/include/functions_api.php index c64059523f..15af117305 100644 --- a/pandora_console/include/functions_api.php +++ b/pandora_console/include/functions_api.php @@ -10740,7 +10740,7 @@ function get_events_with_user($trash1, $trash2, $other, $returnType, $user_in_db function api_set_event($id_event, $unused1, $params, $unused2, $unused3) { // Get the event - $event = events_get_event($id_event); + $event = events_get_event($id_event, false, is_metaconsole()); // If event not exists, end the execution. if ($event === false) { returnError( @@ -10773,6 +10773,7 @@ function api_set_event($id_event, $unused1, $params, $unused2, $unused3) } } + // In meta or node. if (is_metaconsole() === true) { $table = 'tmetaconsole_event'; } else {