Checkmk git commits June 2015

checkmk-commits@lists.checkmk.com

8 participants
227 discussions

Check_MK Git: check_mk: Fixed issues with yesterdays change to handle agent data in unicode format ; Some other minor cleanups

by Lars Michelsen

Module: check_mk Branch: master Commit: 5baf1072b78b58bfd96ea36c664a38e4a443fa03 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=5baf1072b78b58… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Tue Jun 30 17:29:02 2015 +0200 Fixed issues with yesterdays change to handle agent data in unicode format; Some other minor cleanups --- modules/check_mk.py | 34 ++++++---- modules/check_mk_base.py | 165 ++++++++++++++++++++++++++-------------------- modules/discovery.py | 5 +- 3 files changed, 119 insertions(+), 85 deletions(-) Diff: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commitdiff;h=5baf1072b7…

8 years, 11 months

Check_MK Git: check_mk: Fixed issue with garbled perfdata

by Lars Michelsen

Module: check_mk Branch: master Commit: 44ea3f322bcb41d39158a25ae9095e1997bc2e13 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=44ea3f322bcb41… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Tue Jun 30 17:37:14 2015 +0200 Fixed issue with garbled perfdata --- modules/check_mk_base.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/check_mk_base.py b/modules/check_mk_base.py index 5f0b950..9da1d48 100644 --- a/modules/check_mk_base.py +++ b/modules/check_mk_base.py @@ -1590,7 +1590,7 @@ def sanitize_yield_check_result(result, is_snmp): status = 0 for subresult in subresults: - st, text, perfdata = sanitize_check_result_encoding(subresult) + st, text, perf = sanitize_check_result_encoding(subresult) if text != None: infotexts.append(text + ["", "(!)", "(!!)", "(?)"][st]) @@ -1599,7 +1599,7 @@ def sanitize_yield_check_result(result, is_snmp): else: status = max(status, st) - if perfdata != None: + if perf != None: perfdata += subresult[2] return status, ", ".join(infotexts), perfdata

8 years, 11 months

Check_MK Git: check_mk: Automatically create graphs for all perf variables that are not graphed

by Mathias Kettner

Module: check_mk Branch: master Commit: 3deb8c1d87cdc36f7316fa544fbee16f53d6410b URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=3deb8c1d87cdc3… Author: Mathias Kettner <mk(a)mathias-kettner.de> Date: Tue Jun 30 16:41:11 2015 +0200 Automatically create graphs for all perf variables that are not graphed --- web/htdocs/metrics.py | 75 ++++++++++++++++++++++++++++++++++++--- web/plugins/metrics/check_mk.py | 53 +++++++++++++++++++++------ 2 files changed, 112 insertions(+), 16 deletions(-) diff --git a/web/htdocs/metrics.py b/web/htdocs/metrics.py index b48b99e..de87d5f 100644 --- a/web/htdocs/metrics.py +++ b/web/htdocs/metrics.py @@ -192,6 +192,10 @@ cmk_color_palette = { "53" : (0.083, 0.8, 0.55), # brown 2 } +def get_palette_color_by_index(i, shading='a'): + color_key = sorted(cmk_color_palette.keys())[i % len(cmk_color_palette)] + return "%s/%s" % (color_key, shading) + # 23/c -> #ff8040 # #ff8040 -> #ff8040 @@ -326,6 +330,7 @@ def translate_metrics(perf_data, check_command): cm = check_metrics[check_command] translated_metrics = {} + color_index = 0 for nr, entry in enumerate(perf_data): varname = entry[0] @@ -342,12 +347,17 @@ def translate_metrics(perf_data, check_command): # Translate name metric_name = translation_entry.get("name", varname) + if metric_name in translated_metrics: + continue # ignore duplicate value if metric_name not in metric_info: + color_index += 1 + palette_color = get_palette_color_by_index(color_index) mi = { - "title" : metric_name, - "unit" : "count", - "color" : "#888888", + "title" : metric_name.title(), + "unit" : "", + "color" : parse_color_into_hexrgb(palette_color), + "palHIRN" : palette_color, } else: mi = metric_info[metric_name].copy() @@ -833,11 +843,54 @@ def build_perfometer(perfometer, translated_metrics): def get_graph_templates(translated_metrics): if not translated_metrics: return + + explicit_templates = get_explicit_graph_templates(translated_metrics) + already_graphed_metrics = get_graphed_metrics(explicit_templates) + implicit_templates = get_implicit_graph_templates(translated_metrics, already_graphed_metrics) + templates = explicit_templates + implicit_templates + return templates + + +def get_explicit_graph_templates(translated_metrics): + templates = [] for graph_template in graph_info: if graph_possible(graph_template, translated_metrics): - yield graph_template + templates.append(graph_template) elif graph_possible_without_optional_metrics(graph_template, translated_metrics): - yield graph_without_missing_optional_metrics(graph_template, translated_metrics) + templates.append(graph_without_missing_optional_metrics(graph_template, translated_metrics)) + return templates + + +def get_implicit_graph_templates(translated_metrics, already_graphed_metrics): + templates = [] + for metric_name in sorted(translated_metrics.keys()): + if metric_name not in already_graphed_metrics: + templates.append(generic_graph_template(metric_name)) + return templates + + +def get_graphed_metrics(graph_templates): + graphed_metrics = set([]) + for graph_template in graph_templates: + graphed_metrics.update(metrics_used_by_graph(graph_template)) + return graphed_metrics + + +def metrics_used_by_graph(graph_template): + used_metrics = [] + for metric_definition in graph_template["metrics"]: + used_metrics += list(metrics_used_in_definition(metric_definition[0])) + return used_metrics + + +def metrics_used_in_definition(metric_definition): + without_unit = metric_definition.split("@")[0] + without_color = metric_definition.split("#")[0] + parts = without_color.split(",") + for part in parts: + metric_name = part.split(".")[0] # drop .min, .max, .average + if metric_name in metric_info: + yield metric_name def graph_possible(graph_template, translated_metrics): @@ -891,6 +944,18 @@ def add_fake_metrics(translated_metrics, metric_names): } return with_fake +def generic_graph_template(metric_name): + return { + "metrics" : [ + ( metric_name, "area" ), + ], + "scalars" : [ + metric_name + ":warn", + metric_name + ":crit", + ] + } + + # Called with exactly one variable: the template ID. Example: # "check_mk-kernel.util:guest,steal,system,user,wait". def page_pnp_template(): diff --git a/web/plugins/metrics/check_mk.py b/web/plugins/metrics/check_mk.py index e32af7b..b9ec17e 100644 --- a/web/plugins/metrics/check_mk.py +++ b/web/plugins/metrics/check_mk.py @@ -871,6 +871,20 @@ metric_info["io_wait"] = { "color" : "#00b0c0", } +metric_info["cpu_util_guest"] = { + "title" : _("Guest operating systems"), + "help" : _("CPU time spent for executing guest operating systems"), + "unit" : "%", + "color" : "12/a", +} + +metric_info["cpu_util_steal"] = { + "title" : _("Steal"), + "help" : _("CPU time stolen by other operating systems"), + "unit" : "%", + "color" : "16/a", +} + metric_info["idle"] = { "title" : _("Idle"), "help" : _("CPU idle time"), @@ -2530,7 +2544,12 @@ check_metrics["check_mk-mysql_capacity"] = {} check_metrics["check_mk-mysql_slave"] = {} check_metrics["check_mk-hr_cpu"] = {} -check_metrics["check_mk-kernel.util"] = { "wait" : { "name" : "io_wait" } } +check_metrics["check_mk-kernel.util"] = { + "wait" : { "name" : "io_wait" }, + "guest" : { "name" : "cpu_util_guest" }, + "steal" : { "name" : "cpu_util_steal" }, +} + check_metrics["check_mk-lparstat_aix.cpu_util"] = { "wait" : { "name" : "io_wait" } } check_metrics["check_mk-ucd_cpu_util"] = { "wait" : { "name" : "io_wait" } } check_metrics["check_mk-vms_cpu"] = { "wait" : { "name" : "io_wait" } } @@ -2835,6 +2854,8 @@ check_metrics["check_mk-ps.perf"] = check_metrics["check_mk-ps"] check_metrics["check_mk-ruckus_spot_ap"] = {} +check_metrics["check_mk-local"] = {} + #. # .--Perf-O-Meters-------------------------------------------------------. # | ____ __ ___ __ __ _ | @@ -3384,15 +3405,7 @@ perfometer_info.append({ # ('tablespace_used', 'area') def define_generic_graph(metric_name): - graph_info.append({ - "metrics" : [ - ( metric_name, "area" ), - ], - "scalars" : [ - metric_name + ":warn", - metric_name + ":crit", - ] - }) + graph_info.append(generic_graph_template(metric_name)) define_generic_graph("context_switches") define_generic_graph("major_page_faults") @@ -3782,6 +3795,25 @@ graph_info.append({ ( "io_wait", "stack" ), ( "user,system,io_wait,+,+#004080", "line", _("Total") ), ], + "conflicting_metrics" : [ + "cpu_util_guest", + "cpu_util_steal", + ], + "mirror_legend" : True, + "range" : (0, 100), +}) + +graph_info.append({ + "title" : _("CPU utilization"), + "metrics" : [ + ( "user", "area" ), + ( "system", "stack" ), + ( "io_wait", "stack" ), + ( "cpu_util_guest", "stack" ), + ( "cpu_util_steal", "stack" ), + ( "user,system,io_wait,cpu_util_guest,cpu_util_steal,+,+,+,+#004080", "line", _("Total") ), + ], + "omit_zero_metrics" : True, "mirror_legend" : True, "range" : (0, 100), }) @@ -4273,7 +4305,6 @@ graph_info.append({ "scalars" : [ "mem_heap:warn", "mem_heap:crit", - "mem_heap:max", ] })

8 years, 11 months

Check_MK Git: check_mk: Fixed computation of service descriptions when having unicode strings

by Lars Michelsen

Module: check_mk Branch: master Commit: 25c1c43bbbf78113008d6f658a4fdc6f25456568 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=25c1c43bbbf781… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Tue Jun 30 15:37:46 2015 +0200 Fixed computation of service descriptions when having unicode strings --- modules/check_mk.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/check_mk.py b/modules/check_mk.py index 270b032..4399fe6 100755 --- a/modules/check_mk.py +++ b/modules/check_mk.py @@ -1265,13 +1265,14 @@ def service_description(check_type, item): # can by empty in some cases. Nagios silently drops leading # and trailing spaces in the configuration file. - if type(item) == str: + item_type = type(item) + if item_type in [ str, unicode ]: # Remove characters from item name that are banned by Nagios item_safe = sanitize_service_description(item) if "%s" not in descr_format: descr_format += " %s" return (descr_format % (item_safe,)).strip() - if type(item) == int or type(item) == long: + elif item_type in [ int, long ]: if "%s" not in descr_format: descr_format += " %s" return (descr_format % (item,)).strip()

8 years, 11 months

Check_MK Git: check_mk: Fixed setting cooki secure flag correctly

by Lars Michelsen

Module: check_mk Branch: master Commit: d49fb600e6aeaada7a5b657a9c98770ead7410a8 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=d49fb600e6aeaa… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Tue Jun 30 14:23:40 2015 +0200 Fixed setting cooki secure flag correctly --- web/htdocs/html_mod_python.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/web/htdocs/html_mod_python.py b/web/htdocs/html_mod_python.py index c15d54c..6a0c6f5 100644 --- a/web/htdocs/html_mod_python.py +++ b/web/htdocs/html_mod_python.py @@ -71,7 +71,11 @@ class html_mod_python(htmllib.html): def set_cookie(self, varname, value, expires = None): # httponly tells the browser not to make this cookie available to Javascript - c = Cookie.Cookie(varname, value, path='/', secure=self.is_ssl_request(), httponly=True) + c = Cookie.Cookie(varname, value, path='/', httponly=True) + + if self.is_ssl_request(): + c.secure = True + if expires is not None: c.expires = expires

8 years, 11 months

Check_MK Git: check_mk: #2392 SEC Auth cookie is always using "httponly" flag

by Lars Michelsen

Module: check_mk Branch: master Commit: 86a8383d0d992d96a0053e1759500ea56b721da9 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=86a8383d0d992d… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Tue Jun 30 13:46:06 2015 +0200 #2392 SEC Auth cookie is always using "httponly" flag All newly issued authentication cookies have the flag "httponly" set now. This makes the cookie values inaccessible from scripts executed in the browser, e.g. from Javascript. This secures the cookie against some sorts of cookie stealing attempts. See https://www.owasp.org/index.php/HttpOnly for details. --- .werks/2392 | 15 +++++++++++++++ ChangeLog | 1 + web/htdocs/html_mod_python.py | 3 ++- 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/.werks/2392 b/.werks/2392 new file mode 100644 index 0000000..4b1a249 --- /dev/null +++ b/.werks/2392 @@ -0,0 +1,15 @@ +Title: Auth cookie is always using "httponly" flag +Level: 1 +Component: multisite +Class: security +Compatible: compat +State: unknown +Version: 1.2.7i3 +Date: 1435664667 + +All newly issued authentication cookies have the flag "httponly" +set now. This makes the cookie values inaccessible from scripts +executed in the browser, e.g. from Javascript. This secures the +cookie against some sorts of cookie stealing attempts. + +See https://www.owasp.org/index.php/HttpOnly for details. diff --git a/ChangeLog b/ChangeLog index ec63693..90509c6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -31,6 +31,7 @@ * 2389 SEC: Fixed XSS using the _body_class parameter of views... * 2390 SEC: Fixed possible XSS issue on views... * 2391 SEC: Auth cookie is using "secure" flag when HTTPS request detected... + * 2392 SEC: Auth cookie is always using "httponly" flag... * 2314 FIX: Availability: fixed exception when grouping by host or service group * 2361 FIX: Fix exception for missing key 'title' in certain cases of older customized views * 2379 FIX: Plugin-Output: Fixed handling of URLs within output of check_http... diff --git a/web/htdocs/html_mod_python.py b/web/htdocs/html_mod_python.py index 1c72e2f..c15d54c 100644 --- a/web/htdocs/html_mod_python.py +++ b/web/htdocs/html_mod_python.py @@ -70,7 +70,8 @@ class html_mod_python(htmllib.html): return self.req.headers_in.get('X-Forwarded-Proto') == 'https' def set_cookie(self, varname, value, expires = None): - c = Cookie.Cookie(varname, value, path='/', secure=self.is_ssl_request()) + # httponly tells the browser not to make this cookie available to Javascript + c = Cookie.Cookie(varname, value, path='/', secure=self.is_ssl_request(), httponly=True) if expires is not None: c.expires = expires

8 years, 11 months

Check_MK Git: check_mk: #2391 SEC Auth cookie is using "secure" flag when HTTPS request detected

by Lars Michelsen

Module: check_mk Branch: master Commit: 46f0181efe57544c16f34c29d6d63ba40a7b024f URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=46f0181efe5754… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Tue Jun 30 13:19:10 2015 +0200 #2391 SEC Auth cookie is using "secure" flag when HTTPS request detected In previous versions the authentication cookie, which identifies an authenticated user with the GUI, was never using the "secure" flag. This means the cookie was sent to the webserver when doing HTTP and HTTPS requests. In such a situation a user which authenticated using HTTPS could access the GUI using HTTP and was still authenticated becaus the browser sends the HTTPS related cookie via HTTP. This is some kind of security risk since the information which should only be transported using the encrypted HTTPS requests could be transported in clear text over the network using HTTP. The GUI tries now to detect the HTTPS requests. In case a HTTPS request is detected, the cookies are set with the "secure" flag which makes the cookies only used via HTTPS. The HTTPS detection currently checks wether or not the HTTP request header <tt>X-Forwarded-Proto</tt> is set to <tt>https</tt>. --- .werks/2391 | 25 +++++++++++++++++++++++++ ChangeLog | 1 + web/htdocs/html_mod_python.py | 5 ++++- 3 files changed, 30 insertions(+), 1 deletion(-) diff --git a/.werks/2391 b/.werks/2391 new file mode 100644 index 0000000..26f2bb2 --- /dev/null +++ b/.werks/2391 @@ -0,0 +1,25 @@ +Title: Auth cookie is using "secure" flag when HTTPS request detected +Level: 1 +Component: multisite +Class: security +Compatible: compat +State: unknown +Version: 1.2.7i3 +Date: 1435662820 + +In previous versions the authentication cookie, which identifies an +authenticated user with the GUI, was never using the "secure" flag. +This means the cookie was sent to the webserver when doing HTTP and +HTTPS requests. In such a situation a user which authenticated using +HTTPS could access the GUI using HTTP and was still authenticated +becaus the browser sends the HTTPS related cookie via HTTP. This is +some kind of security risk since the information which should only +be transported using the encrypted HTTPS requests could be transported +in clear text over the network using HTTP. + +The GUI tries now to detect the HTTPS requests. In case a HTTPS +request is detected, the cookies are set with the "secure" flag +which makes the cookies only used via HTTPS. + +The HTTPS detection currently checks wether or not the HTTP request +header <tt>X-Forwarded-Proto</tt> is set to <tt>https</tt>. diff --git a/ChangeLog b/ChangeLog index 272e4b6..ec63693 100644 --- a/ChangeLog +++ b/ChangeLog @@ -30,6 +30,7 @@ * 2388 SEC: Fixed reflected XSS on the index page using the start_url parameter * 2389 SEC: Fixed XSS using the _body_class parameter of views... * 2390 SEC: Fixed possible XSS issue on views... + * 2391 SEC: Auth cookie is using "secure" flag when HTTPS request detected... * 2314 FIX: Availability: fixed exception when grouping by host or service group * 2361 FIX: Fix exception for missing key 'title' in certain cases of older customized views * 2379 FIX: Plugin-Output: Fixed handling of URLs within output of check_http... diff --git a/web/htdocs/html_mod_python.py b/web/htdocs/html_mod_python.py index 0d6a3f9..1c72e2f 100644 --- a/web/htdocs/html_mod_python.py +++ b/web/htdocs/html_mod_python.py @@ -66,8 +66,11 @@ class html_mod_python(htmllib.html): except: pass + def is_ssl_request(self): + return self.req.headers_in.get('X-Forwarded-Proto') == 'https' + def set_cookie(self, varname, value, expires = None): - c = Cookie.Cookie(varname, value, path = '/') + c = Cookie.Cookie(varname, value, path='/', secure=self.is_ssl_request()) if expires is not None: c.expires = expires

8 years, 11 months

Check_MK Git: check_mk: #2371 appdynamics_memory, appdynamics_sessions, appdynamics_web_container: New checks for AppDynamic

by Mathias Kettner

Module: check_mk Branch: master Commit: b4704ca75fa7262595796e4aff44e2b483289d4e URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=b4704ca75fa726… Author: Mathias Kettner <mk(a)mathias-kettner.de> Date: Tue Jun 30 11:20:21 2015 +0200 #2371 appdynamics_memory, appdynamics_sessions, appdynamics_web_container: New checks for AppDynamic Check_MK now has a new special agent for monitoring AppDynamics via its REST API. Information is mapped to your existing monitoring hosts via Piggyback. --- .werks/2371 | 10 ++ ChangeLog | 1 + agents/special/agent_appdynamics | 189 +++++++++++++++++++++++++++++++ checkman/appdynamics_memory | 14 +++ checkman/appdynamics_sessions | 14 +++ checkman/appdynamics_web_container | 15 +++ checks/agent_appdynamics | 47 ++++++++ checks/appdynamics_memory | 107 +++++++++++++++++ checks/appdynamics_sessions | 83 ++++++++++++++ checks/appdynamics_web_container | 100 ++++++++++++++++ web/plugins/metrics/check_mk.py | 123 +++++++++++++++++--- web/plugins/wato/datasource_programs.py | 55 +++++++++ 12 files changed, 741 insertions(+), 17 deletions(-) Diff: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commitdiff;h=b4704ca75f…

8 years, 11 months

Check_MK Git: check_mk: It was possible to use the view_name variable to inject HTML/Javascript

by Lars Michelsen

Module: check_mk Branch: master Commit: 18c7a774c9cf8764b044458b50e8d62a8ae8ae12 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=18c7a774c9cf87… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Tue Jun 30 10:49:08 2015 +0200 It was possible to use the view_name variable to inject HTML/Javascript code into the status GUI views. Conflicts: ChangeLog web/htdocs/htmllib.py --- .werks/2390 | 11 +++++++++++ ChangeLog | 1 + web/htdocs/htmllib.py | 2 +- 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/.werks/2390 b/.werks/2390 new file mode 100644 index 0000000..27b905a --- /dev/null +++ b/.werks/2390 @@ -0,0 +1,11 @@ +Title: Fixed possible XSS issue on views +Level: 1 +Component: multisite +Class: security +Compatible: compat +State: unknown +Version: 1.2.7i3 +Date: 1435654030 + +It was possible to use the view_name variable to inject HTML/Javascript +code into the status GUI views. diff --git a/ChangeLog b/ChangeLog index 7bce667..0255535 100644 --- a/ChangeLog +++ b/ChangeLog @@ -28,6 +28,7 @@ * 2387 SEC: Fixed XSS problem on all pages using confirm dialogs outputting user provided parameters... * 2388 SEC: Fixed reflected XSS on the index page using the start_url parameter * 2389 SEC: Fixed XSS using the _body_class parameter of views... + * 2390 SEC: Fixed possible XSS issue on views... * 2314 FIX: Availability: fixed exception when grouping by host or service group * 2361 FIX: Fix exception for missing key 'title' in certain cases of older customized views * 2379 FIX: Plugin-Output: Fixed handling of URLs within output of check_http... diff --git a/web/htdocs/htmllib.py b/web/htdocs/htmllib.py index fd3d5b7..1d0b83f 100644 --- a/web/htdocs/htmllib.py +++ b/web/htdocs/htmllib.py @@ -1004,7 +1004,7 @@ class html: '<img class=statusicon src="images/icon_menu.png" title="%s">\n' % _("Add this view to..."), 'add_visual', 'add_visual', data='[\'%s\', %s, {\'name\': \'%s\'}]' % (mode_name, self.attrencode(repr(encoded_vars)), - self.var('view_name'))) + self.attrencode(self.var('view_name')))) for img, tooltip in self.status_icons.items(): if type(tooltip) == tuple:

8 years, 11 months

Check_MK Git: check_mk: #2389 SEC Fixed XSS using the _body_class parameter of views

by Lars Michelsen

Module: check_mk Branch: master Commit: d65dda742a9141ca9fa444010730aa31512d0308 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=d65dda742a9141… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Tue Jun 30 10:42:31 2015 +0200 #2389 SEC Fixed XSS using the _body_class parameter of views It was possible to use the _body_class parameter of the status GUI views to inject HTML/Javascript code into the pages. The _body_class parameter, which was only used for internal purposes, has totally been removed now. --- .werks/2389 | 14 ++++++++++++++ ChangeLog | 1 + web/htdocs/htmllib.py | 12 +++++++----- web/htdocs/views.py | 3 --- web/plugins/dashboard/dashlets.py | 2 +- 5 files changed, 23 insertions(+), 9 deletions(-) diff --git a/.werks/2389 b/.werks/2389 new file mode 100644 index 0000000..f3d7ed6 --- /dev/null +++ b/.werks/2389 @@ -0,0 +1,14 @@ +Title: Fixed XSS using the _body_class parameter of views +Level: 1 +Component: multisite +Class: security +Compatible: compat +State: unknown +Version: 1.2.7i3 +Date: 1435653652 + +It was possible to use the _body_class parameter of the status GUI views +to inject HTML/Javascript code into the pages. + +The _body_class parameter, which was only used for internal purposes, has +totally been removed now. diff --git a/ChangeLog b/ChangeLog index ec8b852..7bce667 100644 --- a/ChangeLog +++ b/ChangeLog @@ -27,6 +27,7 @@ * 2385 SEC: Fixed possible reflected XSS on all GUI pages where users can produce unhandled exceptions... * 2387 SEC: Fixed XSS problem on all pages using confirm dialogs outputting user provided parameters... * 2388 SEC: Fixed reflected XSS on the index page using the start_url parameter + * 2389 SEC: Fixed XSS using the _body_class parameter of views... * 2314 FIX: Availability: fixed exception when grouping by host or service group * 2361 FIX: Fix exception for missing key 'title' in certain cases of older customized views * 2379 FIX: Plugin-Output: Fixed handling of URLs within output of check_http... diff --git a/web/htdocs/htmllib.py b/web/htdocs/htmllib.py index d6ffbef..fd3d5b7 100644 --- a/web/htdocs/htmllib.py +++ b/web/htdocs/htmllib.py @@ -114,6 +114,7 @@ class html: self.ignore_transids = False self.current_transid = None self.page_context = {} + self.body_classes = ['main'] # Time measurement self.times = {} @@ -865,17 +866,18 @@ class html: def immediate_browser_redirect(self, secs, url): self.javascript("set_reload(%s, '%s');" % (secs, url)) - def body_css_classes(self): - body_classes = [ "main" ] - if self.var("_body_class"): - body_classes.append(self.var("_body_class")) + def add_body_css_class(self, cls): + self.body_classes.append(cls) + + def get_body_css_classes(self): + body_classes = self.body_classes if self.screenshotmode: body_classes.append("screenshotmode") return " ".join(body_classes) def body_start(self, title='', **args): self.html_head(title, **args) - self.write('<body class="%s">' % self.body_css_classes()) + self.write('<body class="%s">' % self.get_body_css_classes()) def header(self, title='', **args): if self.output_format == "html": diff --git a/web/htdocs/views.py b/web/htdocs/views.py index 6181f53..a7e0dfe 100644 --- a/web/htdocs/views.py +++ b/web/htdocs/views.py @@ -2301,7 +2301,6 @@ def paint_header(view, p): # Important for links: # - Add the display options (Keeping the same display options as current) # - Link to _self (Always link to the current frame) - # - Keep the _body_class variable (e.g. for dashlets) thclass = '' onclick = '' title = '' @@ -2311,8 +2310,6 @@ def paint_header(view, p): params = [ ('sort', sort_url(view, painter, join_index)), ] - if html.has_var('_body_class'): - params.append(('_body_class', html.var('_body_class'))) if hasattr(html, 'title_display_options'): params.append(('display_options', html.title_display_options)) diff --git a/web/plugins/dashboard/dashlets.py b/web/plugins/dashboard/dashlets.py index ee74711..398f537 100644 --- a/web/plugins/dashboard/dashlets.py +++ b/web/plugins/dashboard/dashlets.py @@ -550,7 +550,7 @@ def dashlet_view(nr, dashlet): html.set_var('display_options', 'HRSIXL') html.set_var('_display_options', 'HRSIXL') - html.set_var('_body_class', 'dashlet') + html.add_body_css_class('dashlet') import views # FIXME: HACK, clean this up somehow views.load_views()

8 years, 11 months

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

Checkmk git commits June 2015