Commit Graph

10 Commits

Author SHA1 Message Date
Jellyfrog
32f72bc1ab Fix SQL injections in ajax_table.php (#11920)
* Fix SQL injections via searchPhrase parameter

* Fix SQL injections via address parameter

* Fix sort injection

Co-authored-by: Tony Murray <murraytony@gmail.com>
2020-07-10 09:17:09 -05:00
Jellyfrog
b361710148 Device group based access (#10568)
* Device group based access

* Use Permissions class to resolve permissions

Also give port access based on device access

* Convert more pages to use Permissions class

* shorten config setting name
use Eloquent relationships in several places
alphabetize config_definitions.json

* Change Models and Permissions

* Clean up ajax_search LIMIT sql

* Convert more pages to use Permissions class

Co-authored-by: Tony Murray <murraytony@gmail.com>
2019-12-30 12:11:26 +01:00
Tony Murray
699aa8a042 Consolidate configuration settings and implement dynamic webui settings (#9809)
* initial db/defaults dump

* numeric values

* Remove $config['time']

* Use config_definitions.json

* try setting definition as a complete array

* a little more

* fix format

* WIP converting dynamic setting pages

* rewriting the webui

* remove legacy and add translations

* finish email section

* improve navigation
update js a bit

* Import the remaining existing settings

* Update backend still some wip
migration

* fix config loading (db not overriding defaults)

* some cleanup

* more array collapsing

* update settings

* Settings search

* add purge settings to ui, order groups and sections

* collapse more arrays

* Auth definitions WIP

* remove needless slash escapes

* add warning to json

* moving settings from defaults.inc

* remove slow_statistics

* Move rrdtool settings to the poller section

* Use translations more consistently

* removing more settings from defaults.inc.php

* show setting name in tooltip

* allow help text to be shown on mobile

* disable settings that are set in config.php

* Implement undo and reset to default.

* Vue.js functional

* Vue.js WIP

* Implement tabs component

* accordion WIP

* lodash ver update

* two items

* Accordion somewhat working

* hash navigation

* Refine Accordion

* Fix up tab styling a bit

* Cleaner tab selected property
Hide html while loading

* spinner?

* Icon support
property for accordion to active

* WIP

* Tabs/Sections from ajax

* Setting Component skeletons

* Dynamic Component resolution

* Basic functionality

* toggle class

* Refactor components

* translate tabs and accordions

* simple array attempt

* improve readonly tooltip

* array styling

* array value editing

* organize snmp info

* Handle initial tab/section in url

* Use Laravel to parse tab/section, dump old

* Draggable array entries

* v-tooltip, for clickable (and touch) help tooltips
disable draggable

* Navigation WIP

* Navigation WIP

* groups computed

* filter settings

* fix event reference

* vue.js i18n initial

* missing description = just setting name

* en fallback

* tidy up the language support and js generation

* persist value to db

* fix issue with 0

* Delete settings from DB instead of setting them to default

* ldap-groups
fixup style

* Default dashboard selection

* fix array of options instead of object

* allow custom validation for settings

* translate options in SettingSelect

* SNMP v3 WIP

* fix setting arrays

* Split persist out of set

* Hook up events for SNMP v3 Auth
correct Config::persist behaviour with arrays

* dependent settings (primitive for now)
actually update the settings values in the LibrenmsSettings component

* more complex "when" behaviour

* remove un-needed seeder

* add poller_modules.cisco-qfp

* remove en.json (disable warning)

* don't set default for log_dir or log_file, otherwise it won't be processed correctly

* Fix module order
add some missing settings

* more config corrections

* correct graphs
correct loading values set to null (although it should have no difference)
remove project_name_version

* Add nfsen settings.  Docs are very confusing, so might have flubbed something
remove option for array definition of select option as numeric indexes messes it up

* Correct more upstream config differences

* Config cleanup after a bunch of merges.

* Fixes

* add version tags to js/css files
remove old js

* Print out full settings list read-only

* Add http_proxy setting
fix indents in config_definitions.json

* repeaters default is 0 (aka 20)

* cleanups

* rewrite the dynamic config docs

* add language docs

* Don't show snmp v3 auth add/remove if disabled by config.php
2019-10-16 21:22:05 +00:00
Tony Murray
e99f421511 Remove legacy auth usage of $_SESSION (#10491)
* Remove auth use of $_SESSION

Will break plugins that depend on $_SESSION, Weathermap was already fixed.
Port them to use Auth::check()/Auth::user()/Auth:id()

* revert accidental replacement
2019-08-05 14:16:05 -05:00
Tony Murray
f83ce13a7a Fixed tabs and units on the wireless page (#10401) 2019-07-02 13:11:58 +01:00
Martijn Schmidt
9d68f27296 Use sensor labels for overview/inventory pages, refactor some html-page related code (#10287)
* Refactor: use get_state_label() for the overview

* Move state translation to get_state_label()

Several html pages used similar database calls and sometimes very
different methodology to determine the state label and state text
before calling get_state_label(), so moved that part of the task
into the function itself instead of replicating the same code
multiple times on different pages.

* Move label creation to get_sensor_label_color()

Also removed a duplicate sensor class to unit function.

* Refactor some if/else statements for simplicity.

* Enable state translations for the inventory page.

* Remove blank line found at end of control structure

* Enable unit translation, fix typos.

* Change to dbFetchRow(), return string directly.

* Update functions.inc.php

* Stop displaying the raw value on state labels.

* Apply 1c7c3ca change for default case too.
2019-06-27 00:30:10 -05:00
Tony Murray
f3ba8947f7 Use Config helper (#10339)
remove usage of global variable
2019-06-23 00:29:12 -05:00
ckforum
9dc60029be change <h2></h1> ? by span and class like the other (#10305)
* change tab <h2></h1> ? by tab span and class like the other

replace bad tag h1 h2 by span and class to be in phase with the others link

* Update sensors-common.php
2019-06-05 22:14:03 -05:00
CirnoT
97005c0b57 Fixed state sensors on global Health table always displayed as 'OK' (#10171) 2019-04-30 22:49:53 +02:00
Tony Murray
36431dd296 Security fix: unauthorized access (#10091)
* Security fix: unauthorized access
Affects nginx users:
Moved php files outside of public html directory (Apache was protected by .htaccess)

Affects all users:
Some files did not check for authentication and could disclose some info.
Better checks before including files from user input

* git mv html/includes/ includes/html
git mv html/pages/ includes/html/
2019-04-11 23:26:42 -05:00