-
Type:
Problem report
-
Resolution: Unresolved
-
Priority:
Trivial
-
None
-
Affects Version/s: 7.4.16
-
Component/s: Frontend (F)
-
None
Description
In ui/app/controllers/CControllerTemplateDashboardDelete.php (lines 34-36), checkPermissions() unconditionally returns true:
protected function checkPermissions(): bool { return true; }
In contrast, sibling controllers such as CControllerTemplateDashboardList::checkPermissions() and CControllerTemplateDashboardEdit::checkPermissions() verify that the user is at least USER_TYPE_ZABBIX_ADMIN and that templateid is writable via isWritableHostTemplates():
protected function checkPermissions(): bool { if ($this->getUserType() < USER_TYPE_ZABBIX_ADMIN) { return false; } return isWritableHostTemplates((array) $this->getInput('templateid')); }
While API::TemplateDashboard()->delete() subsequently checks permissions at the API layer, CControllerTemplateDashboardDelete::checkPermissions() should enforce the same controller-level access control check for consistency and defense-in-depth.
Suggested Patch
Unable to find source-code formatter for language: diff. Available languages are: actionscript, ada, applescript, bash, c, c#, c++, cpp, css, erlang, go, groovy, haskell, html, java, javascript, js, json, lua, none, nyan, objc, perl, php, python, r, rainbow, ruby, scala, sh, sql, swift, visualbasic, xml, yaml
--- a/ui/app/controllers/CControllerTemplateDashboardDelete.php +++ b/ui/app/controllers/CControllerTemplateDashboardDelete.php @@ -32,7 +32,10 @@ class CControllerTemplateDashboardDelete extends CController { } protected function checkPermissions(): bool { - return true; + if ($this->getUserType() < USER_TYPE_ZABBIX_ADMIN) { + return false; + } + + return isWritableHostTemplates((array) $this->getInput('templateid')); }