Input validation in sysmap.php

XMLWordPrintable

    • Type: Incident report
    • Resolution: Fixed
    • Priority: Major
    • None
    • Affects Version/s: 1.6
    • Component/s: Frontend (F)
    • None
    • Environment:
      Any

      In Configuration->Maps, user could insert an image without associate it to an host id(elementid). After database insertion of those new image, zabbix dosen't display the maps because the user aren't permision on host 0. Normaly, application may insert an image without associated host, only and only if she has the type of 4.
      I address this bug modifing the file maps.inc.php, adding the line

      if(($elementid == 0) and ($elementtype != 4)) return FALSE;

      to function add_element_to_sysmap .

            Assignee:
            Unassigned
            Reporter:
            Alexandru Ticlea
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved: