Module: check_mk Branch: master Commit: 6a1845bcba346111c391f28dfc3214b0e5dd8876 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=6a1845bcba3461… Author: Lars Michelsen &lt;lm(a)mathias-kettner.de&gt; Date: Tue Jul 25 17:59:00 2017 +0200 5042 FIX Removed export of WATO folder permissions to NagVis In previous versions it was possible to export the WATO folder permissions of each user to NagVis. This was only used for maps that are named exactly like the WATO folder name. If you don't have such NagVis maps you are not affected by this change. This feature has never been documented officially, It was disabled by default and could be enabled with the global setting "Export WATO folder permissions". When having a large amount of users (1000+) and/or a bigger folder hierarchy while having the global setting enabled this lead to a huge performance impact when editing several things in WATO (users, roles, groups, ...) and during activation of changes. In case you really used this feature, you now need to configure the permissions manually e.g. by defining contact groups and giving them permissions on the NagVis maps (via WATO). Change-Id: If3485261e4a7b6957f3d29d70aab07c186a96a91 --- .werks/5042 | 27 ++++++++++++++++++++++ web/plugins/config/builtin.py | 3 --- web/plugins/userdb/hook_auth.py | 36 ++++-------------------------- web/plugins/wato/check_mk_configuration.py | 15 ------------- 4 files changed, 31 insertions(+), 50 deletions(-) diff --git a/.werks/5042 b/.werks/5042 new file mode 100644 index 0000000..264356c --- /dev/null +++ b/.werks/5042 @@ -0,0 +1,27 @@ +Title: Removed export of WATO folder permissions to NagVis +Level: 1 +Component: wato +Compatible: incomp +Edition: cre +Version: 1.5.0i1 +Date: 1500997952 +Class: fix + +In previous versions it was possible to export the WATO folder +permissions of each user to NagVis. This was only used for maps +that are named exactly like the WATO folder name. If you don't +have such NagVis maps you are not affected by this change. + +This feature has never been documented officially, + +It was disabled by default and could be enabled with the global +setting "Export WATO folder permissions". + +When having a large amount of users (1000+) and/or a bigger folder +hierarchy while having the global setting enabled this lead to +a huge performance impact when editing several things in WATO +(users, roles, groups, ...) and during activation of changes. + +In case you really used this feature, you now need to configure +the permissions manually e.g. by defining contact groups and +giving them permissions on the NagVis maps (via WATO). diff --git a/web/plugins/config/builtin.py b/web/plugins/config/builtin.py index 2e02099..5a61f03 100644 --- a/web/plugins/config/builtin.py +++ b/web/plugins/config/builtin.py @@ -332,9 +332,6 @@ user_downtime_timeranges = [ # Override toplevel and sort_index settings of builtin icons builtin_icon_visibility = {} -# Write WATO folder permissions to auth.php file -export_folder_permissions = False - # Name of the hostgroup to filter the network topology view by default topology_default_filter_group = None diff --git a/web/plugins/userdb/hook_auth.py b/web/plugins/userdb/hook_auth.py index d671cfe..c89c470 100644 --- a/web/plugins/userdb/hook_auth.py +++ b/web/plugins/userdb/hook_auth.py @@ -52,11 +52,6 @@ # users_with_permission(<PERMISSION>) # Returns an array of usernames with the given permission # -# get_folder_permissions(<USERNAME>) -# Returns an array of all wato folder related permissions of the -# given user. The keys are the folder paths and the values are an -# array of "read" and "write" elements with boolean values. -# # may(<USER_NAME>, <PERMISSION>) # Returns true/false whether or not the user is permitted @@ -90,7 +85,7 @@ def format_php(data, lvl = 1): return s -def create_php_file(callee, users, role_permissions, groups, folder_permissions): +def create_php_file(callee, users, role_permissions, groups): # Do not change WATO internal objects nagvis_users = copy.deepcopy(users) @@ -110,27 +105,10 @@ def create_php_file(callee, users, role_permissions, groups, folder_permissions) # when reading half written files during creating that new file file(tempfile, 'w').write('''<?php // Created by Multisite UserDB Hook (%s) -global $mk_users, $mk_roles, $mk_groups, $mk_folders; +global $mk_users, $mk_roles, $mk_groups; $mk_users = %s; $mk_roles = %s; $mk_groups = %s; -$mk_folders = %s; - -function get_folder_permissions($username) { - global $mk_folders; - if(!isset($mk_folders[$username])) { - return array(); - } else { - $permissions = $mk_folders[$username]; - foreach ($permissions as $folder => $perms) { - if (!isset($perms['read'])) - $perms['read'] = false; - elseif (!isset($perms['write'])) - $perms['write'] = false; - } - return $permissions; - } -} function all_users() { global $mk_users; @@ -230,7 +208,7 @@ function permitted_maps($username) { ?> ''' % (callee, format_php(nagvis_users), format_php(role_permissions), - format_php(groups), format_php(folder_permissions))) + format_php(groups))) # Now really replace the file os.rename(tempfile, g_auth_base_dir + '/auth.php') @@ -241,19 +219,13 @@ function permitted_maps($username) { def create_auth_file(callee, users): make_nagios_directory(g_auth_base_dir) - if config.export_folder_permissions: - import wato # HACK: cleanup! - folder_permissions = get_folder_permissions_of_users(users) - else: - folder_permissions = {} - contactgroups = load_group_information().get('contact', {}) groups = {} for gid, group in contactgroups.items(): if 'nagvis_maps' in group and group['nagvis_maps']: groups[gid] = group['nagvis_maps'] - create_php_file(callee, users, config.get_role_permissions(), groups, folder_permissions) + create_php_file(callee, users, config.get_role_permissions(), groups) def get_folder_permissions_of_users(users): diff --git a/web/plugins/wato/check_mk_configuration.py b/web/plugins/wato/check_mk_configuration.py index 0a2c80f..5341bc7 100644 --- a/web/plugins/wato/check_mk_configuration.py +++ b/web/plugins/wato/check_mk_configuration.py @@ -1205,21 +1205,6 @@ register_configvar(group, domain = "multisite" ) - -register_configvar(group, - "export_folder_permissions", - Checkbox( - title = _("Export WATO folder permissions"), - label = _("Make WATO folder permissions usable e.g. by NagVis"), - help = _("It is possible to create maps representing the WATO folder hierarchy within " - "NagVis by naming the maps like the folders are named internally. To make the " - "restriction of access to the maps as comfortable as possible, the permissions " - "configured within WATO can be exported to NagVis."), - default_value = False, - ), - domain = "multisite" -) - #. # .--Check_MK------------------------------------------------------------. # | ____ _ _ __ __ _ __ |