Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-25083

User with read-only permissions can open item form via link from trigger expression

XMLWordPrintable

      Before in 6.4 and earlier versions triggers that belong to multiple hosts with different permissions (read + read-write) were not visible in trigger list view at all. However in earlier versions in item list view clicking on "..." context menu such trigger was visible there, but user had no permissions to open the trigger form. Now since 7.0 it is possible to open those triggers in edit form. As well as graphs. And then all kinds of situations can happen. For example expression cannot be changed or simply cloned with same expression. There will be an error. Similar how graphs work with multiple items from multiple hosts with different permissions. Graphs are visible and editable, however cloning them and changing name simply will not work. Read-only item must be removed first. But most troubling is the link to a read-only item in trigger expression.

      Steps to reproduce:

      1. create two hosts groups R and RW;
      2. create host R in group R and host RW in group RW;
      3. create item R in host R and item RW in host RW;
      4. create trigger with two items from both hosts R and RW;
      5. create regular admin role;
      6. create user group and assign permissions to hosts R - read and RW - read-write;
      7. create user and assign him to this new group and role;
      8. log in with that user and navigate to trigger list;

      Result:
      Observe that trigger is visible and it has read and read write items in trigger expression. There are links to items. Item with read-only permissions also has a link in trigger expression. It's possible to open it in the item edit form. Pressing update, however, results in error saying that user has no permissions to do it. I suppose there shouldn't be a link to such item, that cannot be updated. Even cloning the item and changing name is not allowed, since the host cannot be changed.

            zabbix.dev Zabbix Development Team
            iivs Ivo Kurzemnieks
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated: