Errors in log when trigger and trigger prototype edit forms URLs contain invalid parameters

ExportXMLWordPrintable

      Steps to reproduce:
      1. Have a host with item and trigger (optionally LLD rule with item prototype and trigger prototype);
      2. open the trigger URL, for example,

      /ui/zabbix.php?action=popup&popup=trigger.edit&triggerid=24353&hostid=11543&context=host

      and change hostid to something invalid. For example a string "aaa" like so:

      /ui/zabbix.php?action=popup&popup=trigger.edit&triggerid=24353&hostid=aaa&context=host

      Result:
      You will be greeted by error "Access denied. You are logged in as "Admin". You have no permissions to access this page." etc, but if you open the log, you will see some bad things:

      pg_query(): Query failed: ERROR:  invalid input syntax for type bigint: "aaa"
LINE 1: ... FROM hosts h WHERE h.flags IN (0,4) AND h.hostid='aaa' AND ...
                                                             ^ [zabbix.php:17 -> require_once() -> ZBase->run() -> ZBase->processRequest() -> CController->run() -> CControllerPopup->checkPermissions() -> CControllerTriggerEdit->checkPermissions() -> CApiWrapper->__call() -> CFrontendApiWrapper->callMethod() -> CApiWrapper->callMethod() -> CApiWrapper->callClientMethod() -> CLocalApiClient->callMethod() -> CHost->get() -> CApiService->customFetch() -> DBselect() -> pg_query() -> CConfigFile->{closure}() in include\db.inc.php:206]
Error in query [SELECT h.hostid FROM hosts h WHERE h.flags IN (0,4) AND h.hostid='aaa' AND h.status IN (0,1)] [ERROR:  invalid input syntax for type bigint: "aaa"
LINE 1: ... FROM hosts h WHERE h.flags IN (0,4) AND h.hostid='aaa' AND ...
                                                             ^] [zabbix.php:17 -> require_once() -> ZBase->run() -> ZBase->processRequest() -> CController->run() -> CControllerPopup->checkPermissions() -> CControllerTriggerEdit->checkPermissions() -> CApiWrapper->__call() -> CFrontendApiWrapper->callMethod() -> CApiWrapper->callMethod() -> CApiWrapper->callClientMethod() -> CLocalApiClient->callMethod() -> CHost->get() -> CApiService->customFetch() -> DBselect() -> trigger_error() -> CConfigFile->{closure}() in include\db.inc.php:207]

      Same for trigger prototypes.

      Expected:
      Preferably instead of Access denied, we should see the system warning page with title "Fatal error, please report to the Zabbix team" and then the corresponding errors and fields:
      Incorrect value for "hostid" field.
      Controller: popup
      action: popup
      context: host
      hostid: aaa
      popup: trigger.edit
      triggerid: 24353

      For more details on how to show error messages, see ZBX-27932.

      And of course no DB query errors in logs.

            Assignee:
            Zabbix Development Team
            Reporter:
            Ivo Kurzemnieks
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: