Checkmk git commits September 2018

checkmk-commits@lists.checkmk.com

12 participants
371 discussions

Temporary fix for new test (There are no graph values available yet)

by Lars Michelsen

Module: check_mk Branch: master Commit: f7c21349faaa1e266cc43535734b05f3415f8c44 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=f7c21349faaa1e… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Fri Sep 28 19:50:19 2018 +0200 Temporary fix for new test (There are no graph values available yet) Change-Id: Ib036ce8f5bf65dc2254d9f792f11488e23e37123 --- tests/integration/cmk/gui/test_webapi.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/tests/integration/cmk/gui/test_webapi.py b/tests/integration/cmk/gui/test_webapi.py index 3b83c3f..229dae8 100644 --- a/tests/integration/cmk/gui/test_webapi.py +++ b/tests/integration/cmk/gui/test_webapi.py @@ -529,5 +529,8 @@ def test_get_graph_hover(web, graph_test_config): assert curve_value["color"] == metric["color"] assert curve_value["title"] == metric["title"] - assert isinstance(curve_value["rendered_value"][0], (int, float)) - assert curve_value["rendered_value"][1] != "" + # TODO: Wait for first values? + assert curve_value["rendered_value"][0] is None + assert curve_value["rendered_value"][1] == "n/a" + #assert isinstance(curve_value["rendered_value"][0], (int, float)) + #assert curve_value["rendered_value"][1] != ""

5 years, 10 months

Refactor filter

by Óscar Nájera

Module: check_mk Branch: master Commit: 85155f344ef699a5b70a7529d842875b5e3db7e4 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=85155f344ef699… Author: Óscar Nájera <on(a)mathias-kettner.de> Date: Thu Sep 27 18:29:24 2018 +0200 Refactor filter Change-Id: I5f4c14de74d2842dc809395b4bbe8fbae12676ad --- cmk/gui/bi.py | 18 +++++++++--------- cmk/gui/plugins/dashboard/stats.py | 6 +++--- cmk/gui/views.py | 4 ++-- cmk/gui/visuals.py | 18 +++++++++--------- 4 files changed, 23 insertions(+), 23 deletions(-) diff --git a/cmk/gui/bi.py b/cmk/gui/bi.py index e6bcb39..1914c0f 100644 --- a/cmk/gui/bi.py +++ b/cmk/gui/bi.py @@ -3352,19 +3352,19 @@ def table(columns, add_headers, only_sites, limit, filters): only_aggr_name = None required_groups = tuple() - for filter in filters: - if filter.name == "aggr_group": - val = filter.selected_group() + for filter_ in filters: + if filter_.name == "aggr_group": + val = filter_.selected_group() if val: only_group = val - elif filter.name == "aggr_service": - only_service = filter.service_spec() - elif filter.name == "aggr_name": - only_aggr_name = filter.value().get("aggr_name") + elif filter_.name == "aggr_service": + only_service = filter_.service_spec() + elif filter_.name == "aggr_name": + only_aggr_name = filter_.value().get("aggr_name") # TODO: can be further improved by filtering aggr_name_regex # See BITextFilter(Filter): filter_table(self, rows) - elif filter.name == "aggr_group_tree": - val = filter.value().get("aggr_group_tree") + elif filter_.name == "aggr_group_tree": + val = filter_.value().get("aggr_group_tree") if val: required_groups = tuple(val.split("/")) diff --git a/cmk/gui/plugins/dashboard/stats.py b/cmk/gui/plugins/dashboard/stats.py index d102d4c..3cc77e5 100644 --- a/cmk/gui/plugins/dashboard/stats.py +++ b/cmk/gui/plugins/dashboard/stats.py @@ -79,7 +79,7 @@ class DashletStats(Dashlet): pie_right_aspect = 0.8 what = self._livestatus_table() table = self._table() - filter = self._filter() + filter_ = self._filter() if what == 'hosts': info = 'host' @@ -90,12 +90,12 @@ class DashletStats(Dashlet): use_filters = visuals.filters_of_visual(self._dashlet_spec, infos) for filt in use_filters: if filt.available() and not isinstance(filt, visuals.FilterSite): - filter += filt.filter(info) + filter_ += filt.filter(info) query = "GET %s\n" % what for entry in table: query += entry[3] - query += filter + query += filter_ site = self._dashlet_spec['context'].get('siteopt', {}).get('site') if site: diff --git a/cmk/gui/views.py b/cmk/gui/views.py index 568c5dc..5289b60 100644 --- a/cmk/gui/views.py +++ b/cmk/gui/views.py @@ -1001,8 +1001,8 @@ def show_view(view, show_heading = False, show_buttons = True, rows = [] # Apply non-Livestatus filters - for filter in all_active_filters: - rows = filter.filter_table(rows) + for filter_ in all_active_filters: + rows = filter_.filter_table(rows) if html.var("mode") == "availability": cmk.gui.plugins.views.availability.render_bi_availability(view_title(view), rows) diff --git a/cmk/gui/visuals.py b/cmk/gui/visuals.py index c65cb0e..290e775 100644 --- a/cmk/gui/visuals.py +++ b/cmk/gui/visuals.py @@ -1007,9 +1007,9 @@ def filters_of_visual(visual, info_keys, show_all=False, link_filters=None): # Collect all available filters for these infos all_possible_filters = [] - for _filter_name, filter in multisite_filters.items(): - if filter.info in info_keys: - all_possible_filters.append(filter) + for _filter_name, filter_ in multisite_filters.items(): + if filter_.info in info_keys: + all_possible_filters.append(filter_) for info_key in info_keys: if info_key in visual['single_infos']: @@ -1034,12 +1034,12 @@ def filters_of_visual(visual, info_keys, show_all=False, link_filters=None): # add ubiquitary_filters that are possible for these infos for fn in get_ubiquitary_filters(): # Disable 'wato_folder' filter, if WATO is disabled or there is a single host view - filter = get_filter(fn) + filter_ = get_filter(fn) - if fn == "wato_folder" and (not filter.available() or 'host' in visual['single_infos']): + if fn == "wato_folder" and (not filter_.available() or 'host' in visual['single_infos']): continue - if not filter.info or filter.info in info_keys: - filters.append(filter) + if not filter_.info or filter_.info in info_keys: + filters.append(filter_) return list(set(filters)) # remove duplicates @@ -1159,10 +1159,10 @@ class VisualFilterList(ListOfMultiple): fspecs = {} self._filters = {} for info in self._infos: - for fname, filter in filters_allowed_for_info(info).items(): + for fname, filter_ in filters_allowed_for_info(info).items(): if fname not in fspecs and fname not in ignore: fspecs[fname] = VisualFilter(fname, - title = filter.title, + title = filter_.title, ) self._filters[fname] = fspecs[fname]._filter

5 years, 10 months

Moved GUI tests to correct place after move of GUI code to cmk.gui

by Lars Michelsen

Module: check_mk Branch: master Commit: 50423002886822aea9fda239564ea69b7ce0fbc1 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=50423002886822… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Fri Sep 28 15:19:26 2018 +0200 Moved GUI tests to correct place after move of GUI code to cmk.gui Change-Id: I697febbb12bb74cec3c00f6db4ee26a04f624324 --- tests/integration/{web => cmk/gui}/test_backup.py | 0 tests/integration/{web => cmk/gui}/test_crawl.py | 0 tests/integration/{web => cmk/gui}/test_login.py | 0 tests/integration/{web => cmk/gui}/test_webapi.py | 0 tests/unit/{web => cmk/gui}/conftest.py | 0 tests/unit/{web => cmk/gui}/old/classes.py | 0 tests/unit/{web => cmk/gui}/old/html_tests.py | 4 ++-- tests/unit/{web => cmk/gui}/old/test_integration.py | 0 tests/unit/{web => cmk/gui}/old/unittest_files/body_start.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/button.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/buttonlink.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/checkbox.unittest | 0 .../{web => cmk/gui}/old/unittest_files/context_button_test.unittest | 0 .../{web => cmk/gui}/old/unittest_files/default_html_headers.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/empty_icon.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/header.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/help.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/hidden_field.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/html_foot.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/html_head.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/icon.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/icon_button.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/icon_select.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/javascript.unittest | 0 .../unit/{web => cmk/gui}/old/unittest_files/javascript_file.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/play_sound.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/popup_trigger.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/radiobuttons.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/render_icon.unittest | 0 .../{web => cmk/gui}/old/unittest_files/render_icon_button.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/select.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/stylesheet.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/test_1.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/test_2.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/test_3.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/text_area.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/text_input.unittest | 0 tests/unit/{web => cmk/gui}/old/unittest_files/top_heading.unittest | 0 .../{web => cmk/gui}/old/unittest_files/top_heading_left.unittest | 0 .../{web => cmk/gui}/old/unittest_files/top_heading_right.unittest | 0 tests/unit/{web => cmk/gui}/test_dashboard.py | 0 tests/unit/{web => cmk/gui}/test_htmllib_Encoder.py | 0 tests/unit/{web => cmk/gui}/test_htmllib_Escaper.py | 0 tests/unit/{web => cmk/gui}/test_htmllib_HTML.py | 0 tests/unit/{web => cmk/gui}/test_htmllib_HTMLGenerator.py | 0 tests/unit/{web => cmk/gui}/test_htmllib_OutputFunnel.py | 0 tests/unit/{web => cmk/gui}/test_htmllib_TimeoutManager.py | 0 tests/unit/{web => cmk/gui}/test_htmllib_TransactionManager.py | 0 tests/unit/{web => cmk/gui}/test_http.py | 0 tests/unit/{web => cmk/gui}/test_key_mgmt.py | 0 tests/unit/{web => cmk/gui}/test_plugin_registry.py | 0 tests/unit/{web => cmk/gui}/test_sidebar.py | 0 tests/unit/{web => cmk/gui}/test_table.py | 0 tests/unit/{web => cmk/gui}/test_userdb_ldap_connector.py | 0 tests/unit/{web => cmk/gui}/tools.py | 0 55 files changed, 2 insertions(+), 2 deletions(-) Diff: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commitdiff;h=5042300288…

5 years, 10 months

6410 FIX Determine the parent process more reliably

by Tom Baerwinkel

Module: check_mk Branch: master Commit: bd07f94ea7c38ebe3193fe20937653a9fd5b181f URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=bd07f94ea7c38e… Author: Tom Baerwinkel <tb(a)mathias-kettner.de> Date: Fri Sep 28 13:58:56 2018 +0200 6410 FIX Determine the parent process more reliably Previously, the parent process was determined by parsing /proc/{PID}/stat and columns where assumed to be separated by space. This was unreliable because the filename in the second column may contain a space as well. If omd was issued e.g. from tmux the process name "tmux: server" was used. This resulted in a traceback during e.g. omd rm. Now the psutil module is used to determine the parent process. Change-Id: If0a52723a2d95f961973912a4ee3418de90fbef2 --- .werks/6410 | 16 ++++++++++++++++ omd/packages/omd/omd | 9 +++++---- 2 files changed, 21 insertions(+), 4 deletions(-) diff --git a/.werks/6410 b/.werks/6410 new file mode 100644 index 0000000..367276c --- /dev/null +++ b/.werks/6410 @@ -0,0 +1,16 @@ +Title: Determine the parent process more reliably +Level: 1 +Component: omd +Compatible: compat +Edition: cre +Version: 1.6.0i1 +Date: 1538138123 +Class: fix + +Previously, the parent process was determined by parsing +/proc/{PID}/stat and columns where assumed to be separated by space. +This was unreliable because the filename in the second +column may contain a space as well. If omd was issued e.g. from tmux +the process name "tmux: server" was used. This resulted in a traceback +during e.g. omd rm. Now the psutil module is used to determine the +parent process. diff --git a/omd/packages/omd/omd b/omd/packages/omd/omd index 280a4f6..56c68b2 100644 --- a/omd/packages/omd/omd +++ b/omd/packages/omd/omd @@ -66,6 +66,7 @@ import errno import fcntl import shlex import pprint +import psutil import random import shutil import socket @@ -3967,10 +3968,10 @@ def kill_site_user_processes(exclude_current_and_parents=False): def get_current_and_parent_pids(): """Return list of PIDs of the current process and parent process tree till pid 0""" pids = [] - pid = os.getpid() - while pid != 0: - pids.append(pid) - pid = int(file("/proc/%d/stat" % pid).read().split(" ")[3]) + process = psutil.Process() + while process and process.pid != 0: + pids.append(process.pid) + process = process.parent() return pids

5 years, 10 months

Fixed invalid hostname in test

by Lars Michelsen

Module: check_mk Branch: master Commit: 9eb26dd7ba1d8af8d5c577777bc014e23d1ba7ee URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=9eb26dd7ba1d8a… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Fri Sep 28 15:18:39 2018 +0200 Fixed invalid hostname in test Change-Id: I22ef0acb37d788a9c7b1fc5704002be4d872d8c7 --- tests/integration/web/test_webapi.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/integration/web/test_webapi.py b/tests/integration/web/test_webapi.py index 76ed6d3..3b83c3f 100644 --- a/tests/integration/web/test_webapi.py +++ b/tests/integration/web/test_webapi.py @@ -452,7 +452,7 @@ def test_get_graph_hover(web, graph_test_config): u'line_type': u'stack', u'expression': [ u'operator', u'+', - [[u'rrd', u'heute', u'heute', u'Check_MK', u'user_time', None, 1], [u'rrd', u'heute', u'heute', u'Check_MK', u'children_user_time', None, 1]] + [[u'rrd', u'test-host-get-graph', u'test-host-get-graph', u'Check_MK', u'user_time', None, 1], [u'rrd', u'test-host-get-graph', u'test-host-get-graph', u'Check_MK', u'children_user_time', None, 1]] ], u'unit': u's', u'title': u'CPU time in user space' @@ -461,7 +461,7 @@ def test_get_graph_hover(web, graph_test_config): u'color': u'#ff8840', u'line_type': u'stack', u'expression': [ u'operator', u'+', - [[u'rrd', u'heute', u'heute', u'Check_MK', u'system_time', None, 1], [u'rrd', u'heute', u'heute', u'Check_MK', u'children_system_time', None, 1]] + [[u'rrd', u'test-host-get-graph', u'test-host-get-graph', u'Check_MK', u'system_time', None, 1], [u'rrd', u'test-host-get-graph', u'test-host-get-graph', u'Check_MK', u'children_system_time', None, 1]] ], u'unit': u's', u'title': u'CPU time in operating system' @@ -469,14 +469,14 @@ def test_get_graph_hover(web, graph_test_config): { u'color': u'#00b2ff', u'line_type': u'stack', - u'expression': [u'rrd', u'heute', u'heute', u'Check_MK', u'cmk_time_agent', None, 1], + u'expression': [u'rrd', u'test-host-get-graph', u'test-host-get-graph', u'Check_MK', u'cmk_time_agent', None, 1], u'unit': u's', u'title': u'Time spent waiting for Check_MK agent' }, { u'color': u'#d080af', u'line_type': u'line', - u'expression': [u'rrd', u'heute', u'heute', u'Check_MK', u'execution_time', None, 1], + u'expression': [u'rrd', u'test-host-get-graph', u'test-host-get-graph', u'Check_MK', u'execution_time', None, 1], u'unit': u's', u'title': u'Total execution time' } ],

5 years, 10 months

6733 FIX veeam_backup_status: Plugin is bakeable

by Simon Betz

Module: check_mk Branch: master Commit: 7a2d7fe3696d8aae394660cb0d3767f8c8c1556c URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=7a2d7fe3696d8a… Author: Simon Betz <si(a)mathias-kettner.de> Date: Fri Sep 28 14:51:35 2018 +0200 6733 FIX veeam_backup_status: Plugin is bakeable Change-Id: I2ab4de22a0d7d18225124e07b836536da2dbe98a --- .werks/6733 | 18 ++++++++++++++++++ agents/windows/plugins/veeam_backup_status.bat | 8 -------- ...eeam_backup_status.ps1_ => veeam_backup_status.ps1} | 0 3 files changed, 18 insertions(+), 8 deletions(-) diff --git a/.werks/6733 b/.werks/6733 new file mode 100644 index 0000000..2ebd3bb --- /dev/null +++ b/.werks/6733 @@ -0,0 +1,18 @@ +Title: veeam_backup_status: Plugin is bakeable +Level: 1 +Component: agents +Class: fix +Compatible: compat +Edition: cee +State: unknown +Version: 1.6.0i1 +Date: 1538042010 + +If no 64-bit Windows agent is used you have to create a wrapper batch script, +eg. {{veeam_backup_status.bat}} which calls the {{veeam_backup_status.ps1}}. +In this case the powershell script needs to be put somewhere else (see example +here) and is called from this .bat script with the 64 bit powershell: +<code> +@ECHO OFF +%systemroot%\sysnative\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted " & ""C:\scripts\veeam_backup_status.ps1""" +</code> diff --git a/agents/windows/plugins/veeam_backup_status.bat b/agents/windows/plugins/veeam_backup_status.bat deleted file mode 100644 index 1e21286..0000000 --- a/agents/windows/plugins/veeam_backup_status.bat +++ /dev/null @@ -1,8 +0,0 @@ -@ECHO OFF -REM version 0.9 -REM Put this file in cmk Plugins-Folder *only* if you need to run -REM the veeam_backup_status.ps1 powershell script and you -REM have no 64 bit check_mk agent available -REM In this case the powershell script needs to be put somewhere else -REM (see example here) and is called from this .bat script with the 64 bit powershell -%systemroot%\sysnative\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted " & ""C:\skripte\veeam_backup_status.ps1""" diff --git a/agents/windows/plugins/veeam_backup_status.ps1_ b/agents/windows/plugins/veeam_backup_status.ps1 similarity index 100% rename from agents/windows/plugins/veeam_backup_status.ps1_ rename to agents/windows/plugins/veeam_backup_status.ps1

5 years, 10 months

dir -> directory

by Óscar Nájera

Module: check_mk Branch: master Commit: cbb9b1e8b7cf2a12ca9396ec8b86b61c16397296 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=cbb9b1e8b7cf2a… Author: Óscar Nájera <on(a)mathias-kettner.de> Date: Thu Sep 27 09:39:47 2018 +0200 dir -> directory Change-Id: I501f788c7b254eb3e2bf91952a7c72c1a7b6792e --- cmk/gui/htmllib.py | 6 +-- cmk/gui/plugins/views/painters.py | 8 ++-- cmk/gui/prediction.py | 15 ++++--- cmk/gui/userdb.py | 10 ++--- cmk/gui/valuespec.py | 12 +++--- cmk/gui/wato/__init__.py | 10 ++--- cmk_base/config.py | 4 +- cmk_base/core_config.py | 4 +- cmk_base/modes/check_mk.py | 80 ++++++++++++++++++------------------ cmk_base/packaging.py | 86 +++++++++++++++++++-------------------- cmk_base/prediction.py | 21 +++++----- omd/packages/omd/omd | 22 +++++----- 12 files changed, 139 insertions(+), 139 deletions(-) Diff: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commitdiff;h=cbb9b1e8b7…

5 years, 10 months

6770 Showing graph metric values at mouse position now

by Lars Michelsen

Module: check_mk Branch: master Commit: 5fa1e4bd28bc12bc64d4ec601e551d0f29319242 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=5fa1e4bd28bc12… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Thu Sep 27 16:08:45 2018 +0200 6770 Showing graph metric values at mouse position now When moving the mouse pointer on Check_MK graphs a hover popup will be shown at the mous position that contains the date and time of the current mouse position together with the values of the single metrics. Change-Id: Ib0b6089b9e6a64253066d00af2b89deaa5d36cf7 --- .werks/6770 | 12 +++ tests/integration/web/test_webapi.py | 177 +++++++++++++++++++++++++++-------- web/htdocs/js/checkmk.js | 73 ++++++++++----- web/htdocs/themes/facelift/theme.css | 20 ++++ 4 files changed, 220 insertions(+), 62 deletions(-) Diff: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commitdiff;h=5fa1e4bd28…

5 years, 10 months

6774 SEC Add Content-Security-Policy header to prevent some cross site scripting and injection attacks

by Lars Michelsen

Module: check_mk Branch: master Commit: 9f6161580aa9b5d68da9cce082078f0683dcb933 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=9f6161580aa9b5… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Fri Sep 28 09:49:24 2018 +0200 6774 SEC Add Content-Security-Policy header to prevent some cross site scripting and injection attacks When requesting pages from the GUI a <tt>Content-Security-Policy</tt> is now been set in the HTTP response. Using this mechanism the application can tell the browser which things are allowed to be done by the web page in the context of the browser. We are now, for example limiting the URLs where AJAX calls can be made to or the URLs which can be used as form targets. This helps to prevent some XSS and other injection attacks. The configuration of this policy is made in the apache configuration file <tt>etc/apache/conf.d/security.conf</tt>. In case you want to have a look at the details or want to extend the policy somehow you may edit the file in the context of your site configuration. To apply the changes you need to restart your site apache using <tt>omd restart apache</tt>. In case of trouble please let us know. We can probably adapt the default configuration to solve common issues with this policy for all users. One thing that may affect users that include Check_MK pages on other web pages using frames or iframes: We set the <tt>frame-ancestors</tt> option to <tt>'self'</tt> which means that only pages with the same protocol, url and port as the Check_MK page may refer to Check_MK pages. You can extend this statement with the URLs you want to allow. CMK-973 Change-Id: I27cab62a9bcee3cce05b6bef15d4ff4be6e752d9 --- .werks/6774 | 28 ++++++++++++++++ .../skel/etc/apache/conf.d/security.conf | 38 ++++++++++++++++++++++ 2 files changed, 66 insertions(+) diff --git a/.werks/6774 b/.werks/6774 new file mode 100644 index 0000000..e79ac4d --- /dev/null +++ b/.werks/6774 @@ -0,0 +1,28 @@ +Title: Add Content-Security-Policy header to prevent some cross site scripting and injection attacks +Level: 1 +Component: multisite +Compatible: compat +Edition: cre +Version: 1.6.0i1 +Date: 1538120513 +Class: security + +When requesting pages from the GUI a <tt>Content-Security-Policy</tt> is now been set in the HTTP +response. Using this mechanism the application can tell the browser which things are allowed to +be done by the web page in the context of the browser. + +We are now, for example limiting the URLs where AJAX calls can be made to or the URLs which can +be used as form targets. This helps to prevent some XSS and other injection attacks. + +The configuration of this policy is made in the apache configuration file +<tt>etc/apache/conf.d/security.conf</tt>. In case you want to have a look at the details or +want to extend the policy somehow you may edit the file in the context of your site configuration. +To apply the changes you need to restart your site apache using <tt>omd restart apache</tt>. + +In case of trouble please let us know. We can probably adapt the default configuration to solve +common issues with this policy for all users. + +One thing that may affect users that include Check_MK pages on other web pages using frames or +iframes: We set the <tt>frame-ancestors</tt> option to <tt>'self'</tt> which means that only pages +with the same protocol, url and port as the Check_MK page may refer to Check_MK pages. You can +extend this statement with the URLs you want to allow. diff --git a/omd/packages/apache-omd/skel/etc/apache/conf.d/security.conf b/omd/packages/apache-omd/skel/etc/apache/conf.d/security.conf new file mode 100644 index 0000000..7122129 --- /dev/null +++ b/omd/packages/apache-omd/skel/etc/apache/conf.d/security.conf @@ -0,0 +1,38 @@ +# This file contains some common security settings we apply to the site apache +# and the requests to it. Please let us know in case these settings limit you +# in valid use cases. + +# Mitigate the risk of cross-site scripting and other injection attacks. +# +# To make things easier, you can use an online CSP header generator +# such as: https://www.cspisawesome.com/. +# +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-… +# https://www.w3.org/TR/CSP3/ +# https://content-security-policy.com/ +# https://www.html5rocks.com/en/tutorials/security/content-security-policy/ +# +<IfModule mod_headers.c> + # Default policy for all not configured ones + Header always set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'" + + # Allow AJAX calls to current scheme/url/port and the crash report API + Header always append Content-Security-Policy "connect-src 'self' https://mathias-kettner.de/crash_report.php" + + # Only allow to include the pages served by this site in frames of same URLs + Header always append Content-Security-Policy "frame-ancestors 'self'" + + # <base>-Tag is limited to current scheme/url/port + Header always append Content-Security-Policy "base-uri 'self'" + + # Form submissions are limited to current scheme/url/port + Header always append Content-Security-Policy "form-action 'self'" + + # Disallow plugins like flash or java + Header always append Content-Security-Policy "object-src 'none'" + + # Only set Content-Security-Policy for web pages and not other resources + <FilesMatch "\.(js|css|png|ico|wav|jpg)$"> + Header always unset Content-Security-Policy + </FilesMatch> +</IfModule>

5 years, 10 months

Add basic config for eslint and missing .f12 files

by Lars Michelsen

Module: check_mk Branch: master Commit: 1b067c6deffe83c51f13d9a30d74a1a6a2acd40c URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=1b067c6deffe83… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Wed Sep 26 07:44:17 2018 +0200 Add basic config for eslint and missing .f12 files Change-Id: Iad147e402ae795a29554beeeb4f901b0d741252a --- .eslintrc.json | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/.eslintrc.json b/.eslintrc.json new file mode 100644 index 0000000..4ffa189 --- /dev/null +++ b/.eslintrc.json @@ -0,0 +1,27 @@ +{ + "env": { + "browser": true + }, + "extends": "eslint:recommended", + "parserOptions": { + "ecmaVersion": 5 + }, + "rules": { + "indent": [ + "error", + 4 + ], + "linebreak-style": [ + "error", + "unix" + ], + "quotes": [ + "error", + "double" + ], + "semi": [ + "error", + "always" + ] + } +} \ No newline at end of file

5 years, 10 months

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

Checkmk git commits September 2018