Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-22405

Macro Expansion Broken For Users Without Read Access to Templates

XMLWordPrintable

      Steps to reproduce:

      1. This can easily be reproduced using the built-in Zabbix server host and 'Zabbix Server health' Template
      2. Create a User group, call it 'test'
      3. Under Host Permissions, give it access to 'Zabbix Servers'
      4. Give no permissions for Template Permissions.
      5. Under Problem tags filters, add Zabbix Servers without any specific tags to grant access to all tags:.
      6. Create a user, i.e. 'favorite-zabbix-customer', and add it to the 'test' user group. I set the user role to the built in 'User Role'. The same behavior can be observed for 'Admin Role'. 
      7. Sign in as the user you just created (favorite-zabbix-customer)
      8. Navigate to Monitoring -> Problems.
      9. Select any current or previous Event by clicking on the timestamp in the timeline to bring up the event details. Several of the fields contain the words "ERROR" (expression) and unresolved macros (description field from the templated trigger). The user macros expand only in the trigger name. 
      10. Watch as 'favorite-zabbix-customer' becomes 'sad-zabbix-customer'

      Expected:
      I think usermacros should expand/resolve for any user that has permissions to the object. For example, in all of my triggers I include the names of the usermacros used in that trigger for the purpose of indicating to the user what is customizable:

      Configurable Thresholds:

          $SOME_MACRO - {$SOME_MACRO}

          $ANOTHER_MACRO:"{#WITH_CONTEXT}" - {$ANOTHER_MACRO:"

      {#WITH_CONTEXT}

      "}

      This is useful so the users don't need to guess which values are configurable in the trigger.

       

      Also, the only way for the user created above (favorite-zabbix-customer) to be able to see the macros resolved is to go back and give that user Template permissions to the template group that Zabbix server health belongs in. In the case of Zabbix server health that is Templates/Applications. What this does is override the Host permissions and now the user will have read access to every host linked to a template in Templates/Applications. This is probably not what we want.

            zabbix.dev Zabbix Development Team
            GRyan337 Ryan Eberly
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated: