Commit Graph

27 Commits

Author SHA1 Message Date
Tony Murray
3252ea37af Fix some xss injection for sysLocation and some other fields (#15183)
Reported by [Zluudg](https://huntr.dev/users/zluudg/)
2023-08-02 09:51:31 -05:00
Jellyfrog
153be4d583 Tests: Fix Dusk tests after 13626 (#15057) 2023-05-23 19:23:15 +02:00
eskyuu
ce0734ff5d Added support for user timezones and user browser timezone by default (incomplete) (#13626)
* Added support for user timezones and user browser timezone byt default

* Formatting fixes

* Use the timezone for alert log display

also added validation for the timezone because it's being used in SQL.

* Formatting fixes

* Added return type

* Formatting"

* Update the latency graphs to use the user timezone

* Simplify the web routes config

* Update phpstan to ignore type error

* Fixed up the phpstan config

* Reverse phpstan change

* Re-apply phpstan override

* Remove the option to unset the session timezone

* Formatting fix

* Update outge and event logs to use session timezone

* Fix route for the timezone control

* Made the timezone more dynamic

* Fix a logic error that was stopping the timezone from being set automatically on login

* Prevent getPref from being called twice

* again prevent getPref double call

* getPref double call

* Fixed typo made during merge

* Fixed merge error in phpstan-baseline.neon

* Change spaces to tabs in phpstan-baseline.neon

* Update error count

---------

Co-authored-by: Tony Murray <murraytony@gmail.com>
2023-05-09 10:24:48 -05:00
Jellyfrog
68e0b3df28 Apply fixes from StyleCI (#14899)
Co-authored-by: StyleCI Bot <bot@styleci.io>
2023-03-13 22:32:22 +01:00
Tony Murray
78d6ed49ee Fix some icons (#14584)
fa-info icons, update to FA6 style
2022-11-04 23:13:36 -05:00
Andrea Beccaris
0fc2f9e4c9 Add API-routes for listing MPLS SAPs and services (#13561)
* add apis for mpsl services and saps

* updated docs

* removed dbFetch, orm instead

* changed queries

* Removed unused variables

* Update api_functions.inc.php

* Update api_functions.inc.php

* Update api_functions.inc.php

* Update api_functions.inc.php

Co-authored-by: laf <gh+n@laf.io>
2022-01-20 08:15:23 -06:00
Tony Murray
790c4b3402 Configurable device display name (#13528)
* Configurable device display name
You can just set the display name in device settings.

It also accepts simple template format with  the variables: hostname, sysName, sysName_fallback, ip

Default controlled by device_display_default, (set from old force_hostname_to_sysname and force_ip_to_sysname settings

* remove second argument to format_hostname()

* Style fixes

* Update schema

* update phpstan baseline

* Improved settings strings (and add for translation)
2021-11-18 15:46:22 -06:00
Tony Murray
0b8b97bb68 Push Notifications (Mobile and PC) (#13277)
* Update manifest and add service worker
cleanup icons a bit

* Push notifications WIP

* navigate working

* cleanup

* acknowledge wired up

* Set VAPID keys on composer install

* Component to control notification permissions.

* Allow all user option to validate

* Enable on browser load if transport exists.

* Check for transport before showing user permissions
translations

* Documentation

* style fixes

* access via the attribute model

* fix alerting test

* update schema

* cleanup subscription on disable

* non-configurable db and table for webpush subscriptions (respect system connection)

* revert AlertTransport change
hopefully phpstan can figure it out

* phpstan fixes

* Support custom details display

* Match transport names to brand's preferred display

* less duplicate id errors

* Tests are done in Laravel code now so
remove legacy function usage... could be better, but ok

* Style fixes

* Style fixes 2

* Fix alert test

* Doc updates requires HTTPS and GMP

* unregister subscription when permission is set to denied

* cleanup after user deletion

* delete the right thing

* fix whitespace

* update install docs to include php-gmp

* suggest ext-gmp

* update javascript

* Update functions.php

Co-authored-by: Jellyfrog <Jellyfrog@users.noreply.github.com>
2021-10-06 07:29:47 -05:00
SourceDoctor
8e1b9e2989 Show Detail by default Option on Alert Widget (#13309)
* Show Detail by default on Alert Widget

* .

* change to row count length limitation

* .

* .
2021-10-03 01:12:18 +02:00
Tony Murray
1c379dcd05 Remove legacy function calls (#12651)
* massive inlines

* fix style and wtf

* remove rrdtool.inc.php include

* fix CommonFunctions namespace issues

* looking for missing class space, fix undefined class issues

* style fixes
2021-03-29 00:25:30 +02:00
theochita
c5178cf550 webui: Add button to show verbose alert details in the alert, alert-log webui (#12484)
* Show verbose alert details in the alert, alert-log webui

update file permissions

* Make global admin permission required to use alert details ui

* StyleCI patch

Co-authored-by: root <root@usopsl-libre001.corp.blizzard.net>
2021-03-06 21:57:06 +01:00
Tony Murray
6e19805bcb remove legacy json format function (#12583)
* remove legacy json format function

* remove silly use
2021-03-04 14:55:41 +01:00
Jellyfrog
20b4215204 Swich links to https (#12511)
* Switch librenms links to https

* Convert librenms links in comments

* Switch gnu.org url to https

* switch php urls to https
2021-02-09 00:29:04 +01:00
ottorei
a7e65be09d Bugfix: SQL error with alerts search bar (#12329)
* Fix SQL-error on search bar

* restore escapes

Co-authored-by: Tony Murray <murraytony@gmail.com>
2020-11-20 22:13:59 -06:00
Jellyfrog
29f45ca352 Apply fixes from StyleCI (#12124) 2020-09-21 15:59:34 +02:00
Jellyfrog
82f43cb98d Apply fixes from StyleCI (#12120) 2020-09-21 15:40:17 +02:00
Jellyfrog
32f72bc1ab Fix SQL injections in ajax_table.php (#11920)
* Fix SQL injections via searchPhrase parameter

* Fix SQL injections via address parameter

* Fix sort injection

Co-authored-by: Tony Murray <murraytony@gmail.com>
2020-07-10 09:17:09 -05:00
SourceDoctor
e28b86a295 Fix - Show OS specific mouseover (#11457) 2020-04-26 13:11:13 +02:00
SourceDoctor
d2247ebda3 Running Alerts colorized depending on to their severity (#11210)
* Running Alerts colorized depending on to their severity

* extra alert styling to generic function

* .

* link from table alerts to alert_layout function

* info icon for information alert severity
2020-03-01 15:50:45 +01:00
louis-oui
6dfa5ed75a Fix alerts not displayed (#11034) 2020-01-15 16:59:24 +01:00
Jellyfrog
b361710148 Device group based access (#10568)
* Device group based access

* Use Permissions class to resolve permissions

Also give port access based on device access

* Convert more pages to use Permissions class

* shorten config setting name
use Eloquent relationships in several places
alphabetize config_definitions.json

* Change Models and Permissions

* Clean up ajax_search LIMIT sql

* Convert more pages to use Permissions class

Co-authored-by: Tony Murray <murraytony@gmail.com>
2019-12-30 12:11:26 +01:00
louis-oui
7d9770c9ff Add severity filter to webui alert history (#10918)
* Add severity filter to webui alert history
* Selected options displayed by default
* Fix selected critical
* fix upper
* Fix CI
* fix code climate
2019-12-16 23:58:54 +01:00
louis-oui
b1e56c77ef Fix alert icons wrongly defaults to blue info level (#10906)
* fix bad alert icons

* fix bad alert icons
2019-12-05 15:51:58 +01:00
Dragan Savic
b0c20666dd Corrected div element IDs when listing alerts in tables (#10587)
Use $alert['id'] instead of $rulei as HTML div elements ids.
2019-09-06 19:43:13 +02:00
Tony Murray
e99f421511 Remove legacy auth usage of $_SESSION (#10491)
* Remove auth use of $_SESSION

Will break plugins that depend on $_SESSION, Weathermap was already fixed.
Port them to use Auth::check()/Auth::user()/Auth:id()

* revert accidental replacement
2019-08-05 14:16:05 -05:00
djamp42
fd42ea6e83 Add more detail to webgui alerts (#10388)
* alert sysname

* use existing config option

* add location to alert table

* made location a link

* fix formating

* Update alerts.inc.php
2019-07-18 23:24:24 -05:00
Tony Murray
36431dd296 Security fix: unauthorized access (#10091)
* Security fix: unauthorized access
Affects nginx users:
Moved php files outside of public html directory (Apache was protected by .htaccess)

Affects all users:
Some files did not check for authentication and could disclose some info.
Better checks before including files from user input

* git mv html/includes/ includes/html
git mv html/pages/ includes/html/
2019-04-11 23:26:42 -05:00